dsh-harness-push 1.0.1 → 1.0.2

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 本项目遵循 [语义化版本](https://semver.org/lang/zh-CN/)。
 
+## [1.0.2] - 2026-10-22
+
+### 修复
+
+- **插件已启用但完全没有界面**：客户端 bundle 注册的模块 id 必须等于 `package.json` 的 `name`——浏览器模块加载器按包名索引客户端模块，官方模板与所有已装插件都是这么对的。1.0.1 为了发布到 npm 把包名改成了 `dsh-harness-push`，但 bundle 里仍然是 `id: 'dsh-push'`，于是这个模块注册在一个没人解析的 id 下：Host 半边照常 `active`（插件管理里显示已启用），而设置页、侧栏图标、工作区标签页三个界面全部不会出现。现已对齐，并加了两道断言，防止再次改名时静默卸载界面。
+- **工作区上一层的空 `package.json`**：一个 0 字节的 `package.json` 会让 Node 抛 `ERR_INVALID_PACKAGE_CONFIG`，破坏该目录下所有模块解析。已删除。
+
 ## [1.0.1] - 2026-10-22
 
 ### 修复

package/PUBLISHING.md

@@ -38,6 +38,17 @@ npm login
 npm whoami
 ```
 
+> **2FA 是硬性要求**：npm 明确拒绝无 2FA 的发布
+> （`Two-factor authentication or granular access token with bypass 2fa enabled is required to publish packages`）。
+> 两条可行路径：
+>
+> 1. **交互式发布**（推荐）：`npm login` 后执行 `npm publish`，终端会提示输入认证器里的 6 位码。
+> 2. **令牌发布**：在 npm → Access Tokens 创建 **Granular Access Token**，勾选
+>    **Bypass two-factor authentication**，权限选 *Read and write*，只授权 `dsh-harness-push`。
+>    **没有勾选该选项的令牌只能读、不能发布**（已实测被 403 拒绝）。
+>
+> 令牌一律当作密码对待：不要贴进聊天、不要写进仓库；用完即删、怀疑泄漏立刻吊销。
+
 ### 每次发版
 
 ```powershell
@@ -45,17 +56,17 @@ cd dsh-push
 
 # 1. 确认工作区干净、测试全过
 git status --short          # 应为空
-npm test                    # 11 组测试 + 可达性审计
+npm test                    # 14 组测试 + 可达性审计
 
 # 2. 升版本号（遵循语义化版本）
-npm version patch           # 修 bug：1.0.0 -> 1.0.1
-# npm version minor         # 加功能：1.0.0 -> 1.1.0
-# npm version major         # 破坏性变更：1.0.0 -> 2.0.0
+npm version patch           # 修 bug：1.0.1 -> 1.0.2
+# npm version minor         # 加功能：1.0.2 -> 1.1.0
+# npm version major         # 破坏性变更：1.0.2 -> 2.0.0
 
 # 3. 先看会打包进什么（不发布）
 npm pack --dry-run
 
-# 4. 发布（prepublishOnly 会自动再跑一遍测试）
+# 4. 发布（prepublishOnly 会自动再跑一遍测试；会提示输入 2FA 码）
 npm publish
 
 # 5. 把 tag 推上去

package/client.js

@@ -1,5 +1,8 @@
 window.__ModuleLoader__.load({
-  id: 'dsh-push',
+  // Must equal package.json `name`: the loader keys client modules by package
+  // name, so a mismatch registers the module under an id nobody resolves and
+  // every surface vanishes while the Host half still reports active.
+  id: 'dsh-harness-push',
   factory: (require) => {
     'use strict';
     /**
@@ -2538,8 +2541,6 @@ window.__ModuleLoader__.load({
       const [busy, setBusy] = useState(false);
       const [notice, setNotice] = useState('');
 
-  /* A dialog that opened by itself must say so. */
-  const agentAsked = Boolean(props.pending && props.pending.source === 'agent');
       const [actionError, setActionError] = useState('');
 
       // §设置 draft
@@ -5959,8 +5960,11 @@ function ReviewDialog(props) {
   const configureBody = [
     h('div', { className: 'dsh-push-rv-head', key: 'head' },
       h('span', { className: 'dsh-push-rv-title' }, t('rvTitle')),
-      // A dialog that opened by itself must say why.
-      agentAsked
+      // A dialog that opened by itself must say why. Computed inline on
+      // purpose: a component-local flag was once declared in ANOTHER
+      // component by mistake, and the resulting ReferenceError stopped the
+      // whole sidebar from opening.
+      (props.pending && props.pending.source === 'agent')
         ? h('span', { className: 'dsh-push-rv-agenttag', title: t('rvAgentAskedHint') },
           t('rvAgentAsked'))
         : null,

package/cordis.patch.yml

@@ -4,4 +4,4 @@
 # through `dsh.client` + the "./client" export, so no second row is needed.
 - insert:
     - id: push
-      name: dsh-push
+      name: dsh-harness-push

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-harness-push",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "description": "DeepSeek Harness 的 GitHub 与 Git 管理插件：多账号登录切换、仓库浏览与管理、工作区版本树、一键推送、推送前 Agent 审查。",
   "type": "module",
   "main": "index.js",
@@ -54,7 +54,7 @@
     "access": "public"
   },
   "scripts": {
-    "test": "node tests/verify-client.mjs && node tests/verify-cards.mjs && node tests/verify-tool-surface.mjs && node tests/verify-errors.mjs && node tests/verify-push-memory.mjs && node tests/verify-delete-semantics.mjs && node tests/verify-review-rules.mjs && node tests/verify-review-store.mjs && node tests/verify-review-scope.mjs && node tests/verify-contract.mjs && node tests/verify-review-gate.mjs && node tests/verify-package.mjs && node tests/audit-reachability.mjs",
+    "test": "node tests/verify-client.mjs && node tests/verify-cards.mjs && node tests/verify-tool-surface.mjs && node tests/verify-errors.mjs && node tests/verify-push-memory.mjs && node tests/verify-delete-semantics.mjs && node tests/verify-review-rules.mjs && node tests/verify-review-store.mjs && node tests/verify-review-scope.mjs && node tests/verify-contract.mjs && node tests/verify-render.mjs && node tests/verify-review-gate.mjs && node tests/verify-package.mjs && node tests/audit-reachability.mjs",
     "test:refspec": "powershell -ExecutionPolicy Bypass -File tests/run-refspec.ps1",
     "prepublishOnly": "npm test"
   },