dsh-context-toolkit 0.1.0 → 0.2.1

package/README.md

@@ -36,6 +36,12 @@ It separates *raw bytes* from *conclusions*: commands run in a child process, fi
 
 ## Install
 
+From npm (recommended):
+
+```bash
+dsh plugin --profile desktop add dsh-context-toolkit
+```
+
 From GitHub:
 
 ```bash
@@ -107,9 +113,10 @@ Tool switches: `tools.execute`, `tools.executeFile`, `tools.batchExecute`, `tool
 The offline suites need no DSH runtime:
 
 ```bash
-node smoke.mjs        # 52 checks: contract, runtime discovery, tools, gate, knowledge base, observability
+node smoke.mjs        # 58 checks: contract, runtime discovery, tools, gate, knowledge base, observability, version reporting
 node test-client.mjs  # 27 checks: browser-half contract and bilingual dictionary parity
-node test-package.mjs # 18 checks: publish manifest and the zero-dependency constraint
+node test-package.mjs # 20 checks: publish manifest and the zero-dependency constraint
+node release-check.mjs # 24 checks: release readiness (manifest, deps, tool count, gate, version, SHA coverage, no hardcoded paths)
 ```
 
 ## Known limits

package/README.zh.md

@@ -36,6 +36,12 @@
 
 ## 安装
 
+从 npm 安装（推荐）：
+
+```bash
+dsh plugin --profile desktop add dsh-context-toolkit
+```
+
 从 GitHub 安装：
 
 ```bash
@@ -107,9 +113,10 @@ await ctk_search({ queries: ['rate limit', 'auth'] });  // 只取相关片段
 离线套件不依赖 DSH 运行时：
 
 ```bash
-node smoke.mjs        # 52 项：契约、运行时探测、三工具、门禁、知识库、观测
+node smoke.mjs        # 58 项：契约、运行时探测、三工具、门禁、知识库、观测、版本自述
 node test-client.mjs  # 27 项：浏览器半体契约与双语字典一致性
-node test-package.mjs # 18 项：发布清单与零依赖约束
+node test-package.mjs # 20 项：发布清单与零依赖约束
+node release-check.mjs # 24 项：发布就绪（清单/依赖/工具数/门禁/版本/SHA 覆盖/无硬编码路径）
 ```
 
 ## 已知边界

package/index.js

@@ -18,8 +18,9 @@
  * no third-party runtime dependencies.
  */
 import { homedir } from 'node:os'
-import { existsSync, statSync, readdirSync } from 'node:fs'
-import { join, isAbsolute, resolve, basename } from 'node:path'
+import { existsSync, statSync, readdirSync, readFileSync } from 'node:fs'
+import { join, isAbsolute, resolve, basename, dirname } from 'node:path'
+import { fileURLToPath } from 'node:url'
 import { runProcess, availableRuntimes, probeRuntimes, shellPlan, scratchDir } from './lib/runner.js'
 import { mkdtempSync, rmSync } from 'node:fs'
 import { openStore } from './lib/store.js'
@@ -27,6 +28,26 @@ import { openStore } from './lib/store.js'
 export const name = 'dsh-context-toolkit'
 export const inject = ['tools', 'systemPrompt']
 
+/**
+ * The version this bundle actually ships, read from its own manifest.
+ *
+ * It used to be hardcoded and drifted: the manifest moved to 0.2.0 while the
+ * doctor still reported 0.1.0, so the one line meant to identify the build was
+ * the one line that could not be trusted. Reading the manifest keeps the two in
+ * step without a release step of its own.
+ */
+export const PLUGIN_VERSION = readManifestVersion()
+
+/** Read the neighbouring package.json; a bundled copy still gets a usable value. */
+export function readManifestVersion() {
+  try {
+    const here = dirname(fileURLToPath(import.meta.url))
+    const parsed = JSON.parse(readFileSync(join(here, 'package.json'), 'utf8'))
+    if (parsed && typeof parsed.version === 'string' && parsed.version) return parsed.version
+  } catch { /* not resolvable from here: still report something the doctor can print */ }
+  return '0.0.0'
+}
+
 const z = await loadSchemastery()
 
 /**
@@ -262,9 +283,22 @@ export function apply(ctx, rawConfig) {
 /** Names whose whole purpose is to pour raw bytes into the conversation. */
 const FLOOD_TOOLS = new Set(['curl', 'wget', 'httpie', 'http', 'aria2c'])
 
+/**
+ * Every tool name that runs a shell command, so the gate can read its `command`.
+ *
+ * This list is the gate's blind spot if it drifts: a host name that is absent here
+ * is simply not inspected, and the flood tools run unchecked through it. `ops_bash`
+ * is the live example - dsh-ops publishes it (and does not publish `bash` at all),
+ * so before this list existed `curl` through `ops_bash` slipped past a gate that
+ * was refusing the identical command through `pwsh`.
+ *
+ * Add a name here when a shell tool appears; the other branches key off this set.
+ */
+const SHELL_TOOL_NAMES = new Set(['bash', 'pwsh', 'shell', 'ops_bash', 'bash_persistent', 'pwsh_persistent'])
+
 function floodReason(toolName, args) {
   const command = typeof args.command === 'string' ? args.command : ''
-  if (toolName !== 'bash' && toolName !== 'pwsh' && toolName !== 'shell') return undefined
+  if (!SHELL_TOOL_NAMES.has(toolName)) return undefined
   for (const word of FLOOD_TOOLS) {
     if (new RegExp('(^|[ \\t;&|(])' + word + '([ \\t;&|)]|$)', 'i').test(command)) {
       return 'dsh-context-toolkit: "' + word + '" pours whole responses into the transcript. '
@@ -312,7 +346,7 @@ function registerRoutingGate(ctx, config, stats) {
         }
       }
 
-      if ((toolName === 'bash' || toolName === 'pwsh') && config.bashNudgeMinCommandBytes > 0) {
+      if (SHELL_TOOL_NAMES.has(toolName) && config.bashNudgeMinCommandBytes > 0) {
         const command = typeof args.command === 'string' ? args.command : ''
         if (command.length > config.bashNudgeMinCommandBytes) {
           const reason = 'dsh-context-toolkit: this command is about ' + command.length
@@ -1210,7 +1244,7 @@ function registerObservabilityTools(ctx, config, stats, store, storageDir, log)
 
         // storage
         ok('存储目录 Storage', storageDir)
-        ok('版本 Version', '0.1.0')
+        ok('版本 Version', PLUGIN_VERSION)
 
         lines.push('')
         const failed = lines.filter((l) => l.startsWith('[FAIL]')).length

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-context-toolkit",
-  "version": "0.1.0",
+  "version": "0.2.1",
   "description": "DeepSeek Harness bundle: native ctk_* sandbox tools, a routing gate that keeps bulk output out of the transcript, and a local full-text knowledge base. No third-party runtime dependencies.",
   "repository": {
     "type": "git",