dsh-industry-research 0.3.8 → 0.3.10

package/CHANGELOG.md

@@ -5,8 +5,34 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased]
+## [0.3.10] - 2026-09-18
 
+### Changed
+
+- Move the verified baseline to the published `0.1.6-alpha.2` line: the `@deepseek-ai/dsh-*` dev/test pins and the `compat.yml` CLI/bundle pins now target it, and the peer range gains a third clause (`>=0.1.6-0 <0.2.0`). The two existing clauses are unchanged, so no previously supported host line is dropped. `dshWorkshop.compatibility.dshVersions` is unchanged: it records the lines verified by a real profile install, and the `0.1.6-alpha.2` smoke runs in CI rather than having been observed here.
+- Declare `dsh.manifestVersion: 1` and `engines.dsh` on the package manifest (same shape as the rest of the family).
+- **The `ctx.researchReport` contract is now owned by `dsh-research-report` instead of mirrored here.** `AssembleReportRequest`, `AssembleReportResult`, `EvidenceInput`, and `ReportSectionInput` were hand-copied interfaces in `src/engine-bridge.ts`, kept in sync by convention alone — if the sibling changed its contract, nothing here would have failed until a real call misbehaved. They are now imported with `import type` from `dsh-research-report@0.3.10`, so a mismatch is a compile error. The import is type-only and erased by the build: `lib/index.js` still contains no reference to the package, so the runtime seam is exactly as optional as before and the published package gains no dependency.
+- `company_scan` batch mode now reports a capability downgrade instead of degrading silently: with `parallel: true` and no mounted `ctx.jobs`, the value carries `degraded: { capability: 'ctx.jobs', reason }` and the rendered result states it. Previously the caller could only infer this from `mode: 'sequential'`, which is indistinguishable from never having asked for parallelism.
+
+### Fixed
+
+- The untyped `ctx.get(...)` results were bridged with `as unknown as`, which asserted a shape nobody checked: a service mounted under that name without the expected methods was accepted at lookup time and failed later inside the call path. `ctx.researchReport`, `ctx.web`, and `ctx.jobs` are now all proven by structural guards (`isResearchReportLike`, `isWebLike`, `isJobsLike`), so a wrong-shaped service takes the honest unmounted path — the builtin report fallback, or the loud mount guidance for `industry_track` and the marked sequential degrade for `company_scan` — instead of throwing from inside a call.
+- Pin `@deepseek-ai/dsh-sandbox` to `0.1.6-alpha.2`. A stale `0.1.1-rc.2` was resolved for it while the rest of the tree moved to `0.1.6-alpha.2`; that old build imports `assertNever` from `@deepseek-ai/dsh-llm`, which `0.1.6-alpha.2` no longer exports, so importing `@deepseek-ai/dsh-tools` — and therefore the built entry — failed to link at all (`does not provide an export named 'assertNever'`). Also pin `@deepseek-ai/dsh-user-approval` to `0.1.6-alpha.2`, which was the same class of stale resolution and broke `typecheck:ci` with `TS2614: Module '"@deepseek-ai/dsh-llm"' has no exported member 'CallId'`.
+
+### Docs
+
+- Refresh the five-language README compatibility sections to the `0.1.6-alpha.2` baseline and the three-clause peer range; the same correction is applied to `THIRD_PARTY_NOTICES.md`, and `AGENTS.md` now records that the report contract has one owner and that the optional lookup is guarded rather than asserted.
+
+## [0.3.9] - 2026-09-12
+
+### Changed
+
+- Rename the four translated READMEs to `README-<lang>.md`. npm selects the package-page readme as the first markdown file matching its `{README,README.*}` glob (`@npmcli/package-json`, publish path), and that glob order puts `README.<lang>.md` ahead of `README.md` — so npm was serving the Simplified-Chinese file for this package too (measured on 15/15 sampled packages of the family). The new names sit outside the glob, so the English source is served again. No content changed apart from the language-switcher link each translation holds to its siblings, and the repo readme gate still passes. Takes effect with the next release; an already-published version cannot gain a corrected readme retroactively.
+- Pin the `@deepseek-ai/dsh-*` dev/test dependencies to the published `0.1.5-rc.2` line and record `0.1.5-rc.2` in `dshWorkshop.compatibility.dshVersions`; the monthly Compat workflow now runs against `0.1.5-rc.2`. The peer range `>=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0` is unchanged, so no supported host line is dropped.
+
+### Fixed
+
+- The release workflow claimed provenance but never passed the flag: it runs `npm publish --access public`, and npm only attests a token-based publish when `--provenance` is given explicitly. The publish step is now `npm publish --access public --provenance`, matching the rest of the family. Takes effect from the next release; an already-published version cannot gain attestations retroactively.
 ## [0.3.8] - 2026-09-10
 
 ### Changed

package/{README.es.md → README-es.md}

@@ -8,6 +8,7 @@
 *Mapas de cadena industrial, seguimiento de fuentes públicas, tarjetas de empresa e informes auditables: cada cifra remonta a una fuente y cada laguna se declara.*
 
 [![License](https://img.shields.io/badge/license-Apache%202.0-blue.svg)](LICENSE)
+[![Gitee](https://img.shields.io/badge/Gitee-mirror-c71d23?logo=gitee)](https://gitee.com/perrylink/dsh-industry-research)
 [![DSH plugin](https://img.shields.io/badge/dsh--plugin-✅-green)](https://github.com/topics/dsh-plugin)
 [![dsh-doctor](https://raw.githubusercontent.com/PerryLink/dsh-plugin-doctor/main/badges/PerryLink__dsh-industry-research.svg)](https://github.com/PerryLink/dsh-plugin-doctor#verified-徽章)
 [![Node](https://img.shields.io/badge/node-%5E22.19%20%7C%7C%20%3E%3D24-brightgreen.svg)](#)
@@ -16,7 +17,7 @@
 [![npm version](https://img.shields.io/npm/v/dsh-industry-research)](https://www.npmjs.com/package/dsh-industry-research)
 [![npm downloads](https://img.shields.io/npm/dm/dsh-industry-research)](https://www.npmjs.com/package/dsh-industry-research)
 
-[English](README.md) · [简体中文](README.zh.md) · [Español](README.es.md) · [Português](README.pt.md) · [हिन्दी](README.hi.md)
+[English](README.md) · [简体中文](README-zh.md) · [Español](README-es.md) · [Português](README-pt.md) · [हिन्दी](README-hi.md)
 
 </div>
 
@@ -26,11 +27,11 @@
 
 ## Compatibility
 
-- DeepSeek Harness `dsh-v0.1.5-rc.1` (tag de GitHub, verificado el 2026-09-10; peers en `>=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0`).
+- DeepSeek Harness `0.1.6-alpha.2` (línea publicada en npm, verificado el 2026-09-18; peers en `>=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0`).
 0.1.2-rc.1 (adaptado el 2026-09-02): el sobre de sesión conserva su campo ignorable solo para compatibilidad de lectura de logs almacenados - Session.append aún no puede estamparlo, por lo que el comportamiento de la puerta no cambia.
-Verificado el 2026-09-10 contra el checkout master dsh-v0.1.5-rc.1 (cadena de puertas completa; el smoke de instalación de perfil real lo ejecuta el job mensual `compat.yml`).
+Verificado el 2026-09-18 contra los peers publicados `0.1.6-alpha.2` (cadena de puertas completa; el smoke de instalación de perfil real lo ejecuta el job semanal y por PR `compat.yml`).
 - Node `^22.19.0 || >=24.0.0`, solo ESM (`"type": "module"`).
-- Dependencias peer: `@deepseek-ai/cordis ^4.0.2`, `@deepseek-ai/schemastery ^3.18.2`, y `@deepseek-ai/dsh-tools`, `@deepseek-ai/dsh-skill`, `@deepseek-ai/dsh-skill-filesystem` en `>=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0` (todas compuestas por el bundle oficial `dsh-base`).
+- Dependencias peer: `@deepseek-ai/cordis ^4.0.2`, `@deepseek-ai/schemastery ^3.18.2`, y `@deepseek-ai/dsh-tools`, `@deepseek-ai/dsh-skill`, `@deepseek-ai/dsh-skill-filesystem` en `>=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0` (todas compuestas por el bundle oficial `dsh-base`).
 - Capacidades opcionales, resueltas en tiempo de ejecución (nunca inyectadas): `ctx.web` (recuperación de fuentes públicas, compuesta por `dsh-base`) y `ctx.researchReport` (el motor de sellado del plugin hermano `dsh-research-report`).
 
 ## What you get
@@ -182,7 +183,7 @@ Las contribuciones externas son bienvenidas — abre un issue o una pull request
 
 ## PerryLink DSH Plugin Family
 
-Este proyecto es uno de los [37 complementos de DeepSeek Harness](https://github.com/PerryLink) mantenidos por [PerryLink](https://github.com/PerryLink). Si este te ayuda, probablemente los demás también:
+Este proyecto es uno de los [40 complementos de DeepSeek Harness](https://github.com/PerryLink) mantenidos por [PerryLink](https://github.com/PerryLink). Si este te ayuda, probablemente los demás también:
 
 | Plugin | One-liner |
 |---|---|
@@ -211,6 +212,7 @@ Este proyecto es uno de los [37 complementos de DeepSeek Harness](https://github
 | **[dsh-permission-rules](https://github.com/PerryLink/dsh-permission-rules)** | Reglas de permisos declarativas allow/deny/ask estilo Claude Code con auditoría | |
 | **[dsh-personal-directive](https://github.com/PerryLink/dsh-personal-directive)** | Inyector de directivas personales con interruptor en la barra superior (edición framework) |
 | **[dsh-plugin-guide](https://github.com/PerryLink/dsh-plugin-guide)** | Base de conocimiento de desarrollo de plugins como habilidad de agente bajo demanda | |
+| **[dsh-plugin-doctor](https://github.com/PerryLink/dsh-plugin-doctor)** | Zero-dependency static + sandbox smoke detector for DSH plugins | |
 | **[dsh-reach](https://github.com/PerryLink/dsh-reach)** | Puente multicanal de aprobación/preguntas: WeChat/Telegram/Feishu, consola de sesión |
 | **[dsh-research-report](https://github.com/PerryLink/dsh-research-report)** | Motor de informes de investigación verificables con evidencia direccionada por contenido | |
 | **[dsh-score](https://github.com/PerryLink/dsh-score)** | Puntuación de calidad multidimensional para plugins de DeepSeek Harness. | |
@@ -221,7 +223,16 @@ Este proyecto es uno de los [37 complementos de DeepSeek Harness](https://github
 | **[dsh-test-drive](https://github.com/PerryLink/dsh-test-drive)** | Pruebas de instalación y humo aisladas para plugins de DeepSeek Harness. | |
 | **[dsh-ticktick](https://github.com/PerryLink/dsh-ticktick)** | Puente de tareas TickTick/Dida365: panel de cabecera de sesión + 11 herramientas |
 | **[dsh-translate](https://github.com/PerryLink/dsh-translate)** | Traducción de parámetros entre proveedores y reparación determinista de JSON para DeepSeek Harness. | |
-| **[dsh-wechat](https://github.com/PerryLink/dsh-wechat)** | Puente WeChat ↔ DSH (bot Tencent iLink): texto/imagen/archivo/voz, aprobaciones en el chat |
+| **[dsh-wechat](https://github.com/pan17/dsh-wechat)** | Puente WeChat ↔ DSH (bot Tencent iLink): texto/imagen/archivo/voz, aprobaciones en el chat |
+| **[dsh-autotier](https://github.com/PerryLink/dsh-autotier)** | Automatic strong/cheap model-tier routing with deterministic risk guards and a `/tier` command | |
+| **[dsh-catalog](https://github.com/PerryLink/dsh-catalog)** | DSH Desktop Market standard catalog source for the PerryLink family | |
+| **[dsh-cert-mcp](https://github.com/PerryLink/dsh-cert-mcp)** | Read-only MCP server exposing the certification registry: grades, snapshots and five-dimension evidence | |
+| **[dsh-kit](https://github.com/PerryLink/dsh-kit)** | One-command starter pack that installs the core family | |
+| **[dsh-plugin-certification](https://github.com/PerryLink/dsh-plugin-certification)** | Community certification registry with repro-checkable grades and badges | |
+| **[dsh-plugin-kit](https://github.com/PerryLink/dsh-plugin-kit)** | Shared zero-runtime-dependency toolkit for the PerryLink DSH plugins | |
+| **[dsh-plugin-portal](https://github.com/PerryLink/dsh-plugin-portal)** | Zero-dependency static portal rendering the whole plugin family as one page | |
+| **[dsh-plugin-upgrade-015](https://github.com/PerryLink/dsh-plugin-upgrade-015)** | Merged `0.1.3-alpha.1` → `0.1.5-rc.1` upgrade corridor card plus a zero-dependency seam scanner | |
+| **[dsh-team-rooms](https://github.com/PerryLink/dsh-team-rooms)** | Cross-session team rooms: shared message bus, task board and timeline | |
 
 ## License
 

package/{README.hi.md → README-hi.md}

@@ -8,6 +8,7 @@
 *औद्योगिक श्रृंखला मानचित्र, सार्वजनिक-स्रोत ट्रैकिंग, कंपनी कार्ड और ऑडिट योग्य रिपोर्ट — हर आंकड़ा किसी स्रोत से जुड़ा है, हर अंतराल घोषित है।*
 
 [![License](https://img.shields.io/badge/license-Apache%202.0-blue.svg)](LICENSE)
+[![Gitee](https://img.shields.io/badge/Gitee-mirror-c71d23?logo=gitee)](https://gitee.com/perrylink/dsh-industry-research)
 [![DSH plugin](https://img.shields.io/badge/dsh--plugin-✅-green)](https://github.com/topics/dsh-plugin)
 [![dsh-doctor](https://raw.githubusercontent.com/PerryLink/dsh-plugin-doctor/main/badges/PerryLink__dsh-industry-research.svg)](https://github.com/PerryLink/dsh-plugin-doctor#verified-徽章)
 [![Node](https://img.shields.io/badge/node-%5E22.19%20%7C%7C%20%3E%3D24-brightgreen.svg)](#)
@@ -16,7 +17,7 @@
 [![npm version](https://img.shields.io/npm/v/dsh-industry-research)](https://www.npmjs.com/package/dsh-industry-research)
 [![npm downloads](https://img.shields.io/npm/dm/dsh-industry-research)](https://www.npmjs.com/package/dsh-industry-research)
 
-[English](README.md) · [简体中文](README.zh.md) · [Español](README.es.md) · [Português](README.pt.md) · [हिन्दी](README.hi.md)
+[English](README.md) · [简体中文](README-zh.md) · [Español](README-es.md) · [Português](README-pt.md) · [हिन्दी](README-hi.md)
 
 </div>
 
@@ -26,11 +27,11 @@
 
 ## Compatibility
 
-- DeepSeek Harness `dsh-v0.1.5-rc.1` (GitHub tag, 2026-09-10 को सत्यापित; peers `>=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0` पर)।
+- DeepSeek Harness `0.1.6-alpha.2` (npm प्रकाशित लाइन, 2026-09-18 को सत्यापित; peers `>=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0` पर)।
 0.1.2-rc.1 (2026-09-02 को अनुकूलित): सत्र लिफ़ाफ़ा अपना ignorable फ़ील्ड केवल संग्रहीत-लॉग पठन संगतता के लिए रखता है - Session.append अभी भी इसे स्टैम्प नहीं कर सकता, इसलिए गेट व्यवहार अपरिवर्तित है।
-dsh-v0.1.5-rc.1 master checkout के विरुद्ध 2026-09-10 को सत्यापित (पूर्ण गेट श्रृंखला; वास्तविक प्रोफ़ाइल इंस्टॉल स्मोक मासिक `compat.yml` जॉब चलाता है)।
+`0.1.6-alpha.2` प्रकाशित peers के विरुद्ध 2026-09-18 को सत्यापित (पूर्ण गेट श्रृंखला; वास्तविक प्रोफ़ाइल इंस्टॉल स्मोक साप्ताहिक और प्रति-PR `compat.yml` जॉब चलाता है)।
 - Node `^22.19.0 || >=24.0.0`, केवल ESM (`"type": "module"`)।
-- Peer निर्भरताएँ: `@deepseek-ai/cordis ^4.0.2`, `@deepseek-ai/schemastery ^3.18.2`, और `>=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0` पर `@deepseek-ai/dsh-tools`, `@deepseek-ai/dsh-skill`, `@deepseek-ai/dsh-skill-filesystem` (सभी आधिकारिक `dsh-base` बंडल में समाहित)।
+- Peer निर्भरताएँ: `@deepseek-ai/cordis ^4.0.2`, `@deepseek-ai/schemastery ^3.18.2`, और `>=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0` पर `@deepseek-ai/dsh-tools`, `@deepseek-ai/dsh-skill`, `@deepseek-ai/dsh-skill-filesystem` (सभी आधिकारिक `dsh-base` बंडल में समाहित)।
 - वैकल्पिक क्षमताएँ, निष्पादन समय पर खोजी जाती हैं (कभी इंजेक्ट नहीं): `ctx.web` (सार्वजनिक-स्रोत पुनर्प्राप्ति, `dsh-base` में समाहित) और `ctx.researchReport` (सहयोगी `dsh-research-report` प्लगइन का सीलिंग इंजन)।
 
 ## What you get
@@ -182,7 +183,7 @@ pnpm run pack:check
 
 ## PerryLink DSH Plugin Family
 
-यह प्रोजेक्ट [PerryLink](https://github.com/PerryLink) द्वारा अनुरक्षित [37 DeepSeek Harness प्लगइनों](https://github.com/PerryLink) में से एक है। अगर यह आपकी मदद करता है, तो बाकी भी करेंगे:
+यह प्रोजेक्ट [PerryLink](https://github.com/PerryLink) द्वारा अनुरक्षित [40 DeepSeek Harness प्लगइनों](https://github.com/PerryLink) में से एक है। अगर यह आपकी मदद करता है, तो बाकी भी करेंगे:
 
 | Plugin | One-liner |
 |---|---|
@@ -211,6 +212,7 @@ pnpm run pack:check
 | **[dsh-permission-rules](https://github.com/PerryLink/dsh-permission-rules)** | ऑडिट के साथ Claude Code-शैली घोषणात्मक allow/deny/ask अनुमति नियम | |
 | **[dsh-personal-directive](https://github.com/PerryLink/dsh-personal-directive)** | शीर्ष-बार टॉगल के साथ व्यक्तिगत निर्देश इंजेक्टर (फ्रेमवर्क संस्करण) |
 | **[dsh-plugin-guide](https://github.com/PerryLink/dsh-plugin-guide)** | माँग पर एजेंट कौशल के रूप में प्लगइन-विकास ज्ञान आधार | |
+| **[dsh-plugin-doctor](https://github.com/PerryLink/dsh-plugin-doctor)** | Zero-dependency static + sandbox smoke detector for DSH plugins | |
 | **[dsh-reach](https://github.com/PerryLink/dsh-reach)** | मल्टी-चैनल अनुमोदन/प्रश्न ब्रिज: WeChat/Telegram/Feishu, सत्र कंसोल |
 | **[dsh-research-report](https://github.com/PerryLink/dsh-research-report)** | सामग्री-पता साक्ष्य और सीलबंद संस्करणों वाला सत्यापन-योग्य अनुसंधान-रिपोर्ट इंजन | |
 | **[dsh-score](https://github.com/PerryLink/dsh-score)** | DeepSeek Harness प्लगिनों की बहु-आयामी गुणवत्ता स्कोरिंग। | |
@@ -221,7 +223,16 @@ pnpm run pack:check
 | **[dsh-test-drive](https://github.com/PerryLink/dsh-test-drive)** | DeepSeek Harness प्लगिनों के लिए पृथक इंस्टॉल-एंड-स्मोक टेस्ट ड्राइव। | |
 | **[dsh-ticktick](https://github.com/PerryLink/dsh-ticktick)** | TickTick/Dida365 कार्य ब्रिज: सत्र-हेडर पैनल + 11 टूल |
 | **[dsh-translate](https://github.com/PerryLink/dsh-translate)** | DeepSeek Harness के लिए वेंडर पैरामीटर अनुवाद और नियतात्मक JSON मरम्मत। | |
-| **[dsh-wechat](https://github.com/PerryLink/dsh-wechat)** | WeChat ↔ DSH ब्रिज (Tencent iLink bot): टेक्स्ट/इमेज/फ़ाइल/आवाज़, चैट में अनुमोदन |
+| **[dsh-wechat](https://github.com/pan17/dsh-wechat)** | WeChat ↔ DSH ब्रिज (Tencent iLink bot): टेक्स्ट/इमेज/फ़ाइल/आवाज़, चैट में अनुमोदन |
+| **[dsh-autotier](https://github.com/PerryLink/dsh-autotier)** | Automatic strong/cheap model-tier routing with deterministic risk guards and a `/tier` command | |
+| **[dsh-catalog](https://github.com/PerryLink/dsh-catalog)** | DSH Desktop Market standard catalog source for the PerryLink family | |
+| **[dsh-cert-mcp](https://github.com/PerryLink/dsh-cert-mcp)** | Read-only MCP server exposing the certification registry: grades, snapshots and five-dimension evidence | |
+| **[dsh-kit](https://github.com/PerryLink/dsh-kit)** | One-command starter pack that installs the core family | |
+| **[dsh-plugin-certification](https://github.com/PerryLink/dsh-plugin-certification)** | Community certification registry with repro-checkable grades and badges | |
+| **[dsh-plugin-kit](https://github.com/PerryLink/dsh-plugin-kit)** | Shared zero-runtime-dependency toolkit for the PerryLink DSH plugins | |
+| **[dsh-plugin-portal](https://github.com/PerryLink/dsh-plugin-portal)** | Zero-dependency static portal rendering the whole plugin family as one page | |
+| **[dsh-plugin-upgrade-015](https://github.com/PerryLink/dsh-plugin-upgrade-015)** | Merged `0.1.3-alpha.1` → `0.1.5-rc.1` upgrade corridor card plus a zero-dependency seam scanner | |
+| **[dsh-team-rooms](https://github.com/PerryLink/dsh-team-rooms)** | Cross-session team rooms: shared message bus, task board and timeline | |
 
 ## License
 

package/{README.pt.md → README-pt.md}

@@ -8,6 +8,7 @@
 *Mapas de cadeia industrial, acompanhamento de fontes públicas, cartões de empresa e relatórios auditáveis — cada número remonta a uma fonte, cada lacuna é declarada.*
 
 [![License](https://img.shields.io/badge/license-Apache%202.0-blue.svg)](LICENSE)
+[![Gitee](https://img.shields.io/badge/Gitee-mirror-c71d23?logo=gitee)](https://gitee.com/perrylink/dsh-industry-research)
 [![DSH plugin](https://img.shields.io/badge/dsh--plugin-✅-green)](https://github.com/topics/dsh-plugin)
 [![dsh-doctor](https://raw.githubusercontent.com/PerryLink/dsh-plugin-doctor/main/badges/PerryLink__dsh-industry-research.svg)](https://github.com/PerryLink/dsh-plugin-doctor#verified-徽章)
 [![Node](https://img.shields.io/badge/node-%5E22.19%20%7C%7C%20%3E%3D24-brightgreen.svg)](#)
@@ -16,7 +17,7 @@
 [![npm version](https://img.shields.io/npm/v/dsh-industry-research)](https://www.npmjs.com/package/dsh-industry-research)
 [![npm downloads](https://img.shields.io/npm/dm/dsh-industry-research)](https://www.npmjs.com/package/dsh-industry-research)
 
-[English](README.md) · [简体中文](README.zh.md) · [Español](README.es.md) · [Português](README.pt.md) · [हिन्दी](README.hi.md)
+[English](README.md) · [简体中文](README-zh.md) · [Español](README-es.md) · [Português](README-pt.md) · [हिन्दी](README-hi.md)
 
 </div>
 
@@ -26,11 +27,11 @@
 
 ## Compatibility
 
-- DeepSeek Harness `dsh-v0.1.5-rc.1` (tag do GitHub, verificado em 2026-09-10; peers em `>=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0`).
+- DeepSeek Harness `0.1.6-alpha.2` (linha publicada no npm, verificado em 2026-09-18; peers em `>=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0`).
 0.1.2-rc.1 (adaptado em 2026-09-02): o envelope de sessão mantém seu campo ignorable apenas para compatibilidade de leitura de logs armazenados - o Session.append ainda não consegue estampá-lo, então o comportamento da porta não muda.
-Verificado em 2026-09-10 contra o checkout master dsh-v0.1.5-rc.1 (cadeia de portas completa; o smoke de instalação de perfil real roda no job mensal `compat.yml`).
+Verificado em 2026-09-18 contra os peers publicados `0.1.6-alpha.2` (cadeia de portas completa; o smoke de instalação de perfil real roda no job semanal e por PR `compat.yml`).
 - Node `^22.19.0 || >=24.0.0`, apenas ESM (`"type": "module"`).
-- Dependências peer: `@deepseek-ai/cordis ^4.0.2`, `@deepseek-ai/schemastery ^3.18.2`, e `@deepseek-ai/dsh-tools`, `@deepseek-ai/dsh-skill`, `@deepseek-ai/dsh-skill-filesystem` em `>=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0` (todas compostas pelo bundle oficial `dsh-base`).
+- Dependências peer: `@deepseek-ai/cordis ^4.0.2`, `@deepseek-ai/schemastery ^3.18.2`, e `@deepseek-ai/dsh-tools`, `@deepseek-ai/dsh-skill`, `@deepseek-ai/dsh-skill-filesystem` em `>=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0` (todas compostas pelo bundle oficial `dsh-base`).
 - Capacidades opcionais, resolvidas em tempo de execução (nunca injetadas): `ctx.web` (recuperação de fontes públicas, composta pelo `dsh-base`) e `ctx.researchReport` (o motor de selagem do plugin irmão `dsh-research-report`).
 
 ## What you get
@@ -182,7 +183,7 @@ Contribuições externas são bem-vindas — abra uma issue ou um pull request.
 
 ## PerryLink DSH Plugin Family
 
-Este projeto é um dos [37 plugins de DeepSeek Harness](https://github.com/PerryLink) mantidos por [PerryLink](https://github.com/PerryLink). Se este ajuda você, os outros provavelmente também:
+Este projeto é um dos [40 plugins de DeepSeek Harness](https://github.com/PerryLink) mantidos por [PerryLink](https://github.com/PerryLink). Se este ajuda você, os outros provavelmente também:
 
 | Plugin | One-liner |
 |---|---|
@@ -211,6 +212,7 @@ Este projeto é um dos [37 plugins de DeepSeek Harness](https://github.com/Perry
 | **[dsh-permission-rules](https://github.com/PerryLink/dsh-permission-rules)** | Regras de permissão declarativas allow/deny/ask estilo Claude Code com auditoria | |
 | **[dsh-personal-directive](https://github.com/PerryLink/dsh-personal-directive)** | Injetor de diretivas pessoais com alternância na barra superior (edição framework) |
 | **[dsh-plugin-guide](https://github.com/PerryLink/dsh-plugin-guide)** | Base de conhecimento de desenvolvimento de plugins como habilidade de agente sob demanda | |
+| **[dsh-plugin-doctor](https://github.com/PerryLink/dsh-plugin-doctor)** | Zero-dependency static + sandbox smoke detector for DSH plugins | |
 | **[dsh-reach](https://github.com/PerryLink/dsh-reach)** | Ponte multicanal de aprovação/perguntas: WeChat/Telegram/Feishu, console de sessão |
 | **[dsh-research-report](https://github.com/PerryLink/dsh-research-report)** | Motor de relatórios de pesquisa verificáveis com evidência endereçada por conteúdo | |
 | **[dsh-score](https://github.com/PerryLink/dsh-score)** | Pontuação de qualidade multidimensional para plugins de DeepSeek Harness. | |
@@ -221,7 +223,16 @@ Este projeto é um dos [37 plugins de DeepSeek Harness](https://github.com/Perry
 | **[dsh-test-drive](https://github.com/PerryLink/dsh-test-drive)** | Test drives isolados de instalação e smoke para plugins de DeepSeek Harness. | |
 | **[dsh-ticktick](https://github.com/PerryLink/dsh-ticktick)** | Ponte de tarefas TickTick/Dida365: painel no cabeçalho da sessão + 11 ferramentas |
 | **[dsh-translate](https://github.com/PerryLink/dsh-translate)** | Tradução de parâmetros entre fornecedores e reparo determinístico de JSON para DeepSeek Harness. | |
-| **[dsh-wechat](https://github.com/PerryLink/dsh-wechat)** | Ponte WeChat ↔ DSH (bot Tencent iLink): texto/imagem/arquivo/voz, aprovações no chat |
+| **[dsh-wechat](https://github.com/pan17/dsh-wechat)** | Ponte WeChat ↔ DSH (bot Tencent iLink): texto/imagem/arquivo/voz, aprovações no chat |
+| **[dsh-autotier](https://github.com/PerryLink/dsh-autotier)** | Automatic strong/cheap model-tier routing with deterministic risk guards and a `/tier` command | |
+| **[dsh-catalog](https://github.com/PerryLink/dsh-catalog)** | DSH Desktop Market standard catalog source for the PerryLink family | |
+| **[dsh-cert-mcp](https://github.com/PerryLink/dsh-cert-mcp)** | Read-only MCP server exposing the certification registry: grades, snapshots and five-dimension evidence | |
+| **[dsh-kit](https://github.com/PerryLink/dsh-kit)** | One-command starter pack that installs the core family | |
+| **[dsh-plugin-certification](https://github.com/PerryLink/dsh-plugin-certification)** | Community certification registry with repro-checkable grades and badges | |
+| **[dsh-plugin-kit](https://github.com/PerryLink/dsh-plugin-kit)** | Shared zero-runtime-dependency toolkit for the PerryLink DSH plugins | |
+| **[dsh-plugin-portal](https://github.com/PerryLink/dsh-plugin-portal)** | Zero-dependency static portal rendering the whole plugin family as one page | |
+| **[dsh-plugin-upgrade-015](https://github.com/PerryLink/dsh-plugin-upgrade-015)** | Merged `0.1.3-alpha.1` → `0.1.5-rc.1` upgrade corridor card plus a zero-dependency seam scanner | |
+| **[dsh-team-rooms](https://github.com/PerryLink/dsh-team-rooms)** | Cross-session team rooms: shared message bus, task board and timeline | |
 
 ## License
 

package/{README.zh.md → README-zh.md}

@@ -8,6 +8,7 @@
 *产业链建图、公开源跟踪、公司速览卡、可核查报告——每个数字都能回溯来源，每个缺口都如实声明。*
 
 [![License](https://img.shields.io/badge/license-Apache%202.0-blue.svg)](LICENSE)
+[![Gitee](https://img.shields.io/badge/Gitee-mirror-c71d23?logo=gitee)](https://gitee.com/perrylink/dsh-industry-research)
 [![DSH plugin](https://img.shields.io/badge/dsh--plugin-✅-green)](https://github.com/topics/dsh-plugin)
 [![dsh-doctor](https://raw.githubusercontent.com/PerryLink/dsh-plugin-doctor/main/badges/PerryLink__dsh-industry-research.svg)](https://github.com/PerryLink/dsh-plugin-doctor#verified-徽章)
 [![Node](https://img.shields.io/badge/node-%5E22.19%20%7C%7C%20%3E%3D24-brightgreen.svg)](#)
@@ -16,7 +17,7 @@
 [![npm version](https://img.shields.io/npm/v/dsh-industry-research)](https://www.npmjs.com/package/dsh-industry-research)
 [![npm downloads](https://img.shields.io/npm/dm/dsh-industry-research)](https://www.npmjs.com/package/dsh-industry-research)
 
-[English](README.md) · [简体中文](README.zh.md) · [Español](README.es.md) · [Português](README.pt.md) · [हिन्दी](README.hi.md)
+[English](README.md) · [简体中文](README-zh.md) · [Español](README-es.md) · [Português](README-pt.md) · [हिन्दी](README-hi.md)
 
 </div>
 
@@ -26,11 +27,11 @@
 
 ## Compatibility
 
-- DeepSeek Harness `dsh-v0.1.5-rc.1`（GitHub tag，2026-09-10 已核验；peer 范围 `>=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0`）。
+- DeepSeek Harness `0.1.6-alpha.2`（npm 发布线，2026-09-18 已核验；peer 范围 `>=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0`）。
 0.1.2-rc.1（2026-09-02 已适配）：会话信封保留 ignorable 字段但仅用于存量日志读取兼容——Session.append 仍无法盖章，门控行为不变。
-2026-09-10 已核验：对照 dsh-v0.1.5-rc.1 master checkout 实测（完整门禁链；真实 profile 安装冒烟由每月 `compat.yml` 任务执行）。
+2026-09-18 已核验：对照 `0.1.6-alpha.2` 已发布 peer 实测（完整门禁链；真实 profile 安装冒烟由每周及每 PR 的 `compat.yml` 任务执行）。
 - Node `^22.19.0 || >=24.0.0`，仅 ESM（`"type": "module"`）。
-- Peer 依赖：`@deepseek-ai/cordis ^4.0.2`、`@deepseek-ai/schemastery ^3.18.2`，以及 `>=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0` 的 `@deepseek-ai/dsh-tools`、`@deepseek-ai/dsh-skill`、`@deepseek-ai/dsh-skill-filesystem`（官方 `dsh-base` bundle 均已组合）。
+- Peer 依赖：`@deepseek-ai/cordis ^4.0.2`、`@deepseek-ai/schemastery ^3.18.2`，以及 `>=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0` 的 `@deepseek-ai/dsh-tools`、`@deepseek-ai/dsh-skill`、`@deepseek-ai/dsh-skill-filesystem`（官方 `dsh-base` bundle 均已组合）。
 - 可选能力在执行时查找（绝不注入）：`ctx.web`（公开源检索，`dsh-base` 已组合）与 `ctx.researchReport`（兄弟插件 `dsh-research-report` 的封存引擎）。
 
 ## What you get
@@ -183,7 +184,7 @@ pnpm run pack:check
 
 ## PerryLink DSH Plugin Family
 
-这是 [PerryLink](https://github.com/PerryLink) 维护的 [37 个 DeepSeek Harness 插件](https://github.com/PerryLink) 之一。如果它能帮到你，其他的也会：
+这是 [PerryLink](https://github.com/PerryLink) 维护的 [40 个 DeepSeek Harness 插件](https://github.com/PerryLink) 之一。如果它能帮到你，其他的也会：
 
 | Plugin | One-liner |
 |---|---|
@@ -212,6 +213,7 @@ pnpm run pack:check
 | **[dsh-permission-rules](https://github.com/PerryLink/dsh-permission-rules)** | Claude Code 风格声明式 allow/deny/ask 权限规则，带审计 | |
 | **[dsh-personal-directive](https://github.com/PerryLink/dsh-personal-directive)** | 个人指令注入器：顶栏开关（框架版） |
 | **[dsh-plugin-guide](https://github.com/PerryLink/dsh-plugin-guide)** | 作为按需代理技能的插件开发知识库 | |
+| **[dsh-plugin-doctor](https://github.com/PerryLink/dsh-plugin-doctor)** | Zero-dependency static + sandbox smoke detector for DSH plugins | |
 | **[dsh-reach](https://github.com/PerryLink/dsh-reach)** | 多渠道审批/提问桥接：微信/Telegram/飞书，会话控制台 |
 | **[dsh-research-report](https://github.com/PerryLink/dsh-research-report)** | 可验证研究报告引擎：内容寻址证据账本与封存版本 | |
 | **[dsh-score](https://github.com/PerryLink/dsh-score)** | DeepSeek Harness 插件的多维质量评分。 | |
@@ -222,7 +224,16 @@ pnpm run pack:check
 | **[dsh-test-drive](https://github.com/PerryLink/dsh-test-drive)** | DeepSeek Harness 插件的隔离试装冒烟。 | |
 | **[dsh-ticktick](https://github.com/PerryLink/dsh-ticktick)** | TickTick/滴答清单任务桥接：会话头面板 + 11 个工具 |
 | **[dsh-translate](https://github.com/PerryLink/dsh-translate)** | DeepSeek Harness 的厂商参数翻译与确定性 JSON 修复。 | |
-| **[dsh-wechat](https://github.com/PerryLink/dsh-wechat)** | 微信 ↔ DSH 桥接（Tencent iLink 机器人）：文本/图片/文件/语音，聊天内审批卡片 |
+| **[dsh-wechat](https://github.com/pan17/dsh-wechat)** | 微信 ↔ DSH 桥接（Tencent iLink 机器人）：文本/图片/文件/语音，聊天内审批卡片 |
+| **[dsh-autotier](https://github.com/PerryLink/dsh-autotier)** | Automatic strong/cheap model-tier routing with deterministic risk guards and a `/tier` command | |
+| **[dsh-catalog](https://github.com/PerryLink/dsh-catalog)** | DSH Desktop Market standard catalog source for the PerryLink family | |
+| **[dsh-cert-mcp](https://github.com/PerryLink/dsh-cert-mcp)** | Read-only MCP server exposing the certification registry: grades, snapshots and five-dimension evidence | |
+| **[dsh-kit](https://github.com/PerryLink/dsh-kit)** | One-command starter pack that installs the core family | |
+| **[dsh-plugin-certification](https://github.com/PerryLink/dsh-plugin-certification)** | Community certification registry with repro-checkable grades and badges | |
+| **[dsh-plugin-kit](https://github.com/PerryLink/dsh-plugin-kit)** | Shared zero-runtime-dependency toolkit for the PerryLink DSH plugins | |
+| **[dsh-plugin-portal](https://github.com/PerryLink/dsh-plugin-portal)** | Zero-dependency static portal rendering the whole plugin family as one page | |
+| **[dsh-plugin-upgrade-015](https://github.com/PerryLink/dsh-plugin-upgrade-015)** | Merged `0.1.3-alpha.1` → `0.1.5-rc.1` upgrade corridor card plus a zero-dependency seam scanner | |
+| **[dsh-team-rooms](https://github.com/PerryLink/dsh-team-rooms)** | Cross-session team rooms: shared message bus, task board and timeline | |
 
 ## License
 

package/README.md

@@ -17,7 +17,7 @@
 [![npm version](https://img.shields.io/npm/v/dsh-industry-research)](https://www.npmjs.com/package/dsh-industry-research)
 [![npm downloads](https://img.shields.io/npm/dm/dsh-industry-research)](https://www.npmjs.com/package/dsh-industry-research)
 
-[English](README.md) · [简体中文](README.zh.md) · [Español](README.es.md) · [Português](README.pt.md) · [हिन्दी](README.hi.md)
+[English](README.md) · [简体中文](README-zh.md) · [Español](README-es.md) · [Português](README-pt.md) · [हिन्दी](README-hi.md)
 
 </div>
 
@@ -27,11 +27,11 @@
 
 ## Compatibility
 
-- DeepSeek Harness `dsh-v0.1.5-rc.1` (GitHub tag, verified 2026-09-10; peers `>=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0`).
+- DeepSeek Harness `0.1.6-alpha.2` (published npm line, verified 2026-09-18; peers `>=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0`).
 0.1.2-rc.1 (adapted 2026-09-02): the session envelope keeps its ignorable field for stored-log read compatibility only - Session.append still cannot stamp it, so audit-gate behavior is unchanged.
-Verified 2026-09-10 against the dsh-v0.1.5-rc.1 master checkout (full gate chain; the real profile install smoke runs in the monthly `compat.yml` job).
+Verified 2026-09-18 against the `0.1.6-alpha.2` published peers (full gate chain; the real profile install smoke runs in the weekly and per-PR `compat.yml` job).
 - Node `^22.19.0 || >=24.0.0`, ESM only (`"type": "module"`).
-- Peer dependencies: `@deepseek-ai/cordis ^4.0.2`, `@deepseek-ai/schemastery ^3.18.2`, and `@deepseek-ai/dsh-tools`, `@deepseek-ai/dsh-skill`, `@deepseek-ai/dsh-skill-filesystem` at `>=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0` (all composed by the official `dsh-base` bundle).
+- Peer dependencies: `@deepseek-ai/cordis ^4.0.2`, `@deepseek-ai/schemastery ^3.18.2`, and `@deepseek-ai/dsh-tools`, `@deepseek-ai/dsh-skill`, `@deepseek-ai/dsh-skill-filesystem` at `>=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0` (all composed by the official `dsh-base` bundle).
 - Optional, looked up at execution time (never injected): `ctx.web` (public-source retrieval — composed by `dsh-base`) and `ctx.researchReport` (the sibling `dsh-research-report` sealing engine).
 
 ## What you get
@@ -185,7 +185,7 @@ External contributions are welcome — open an issue or a pull request.
 
 ## PerryLink DSH Plugin Family
 
-This project is one of the [37 DeepSeek Harness plugins](https://github.com/PerryLink) maintained by [PerryLink](https://github.com/PerryLink). If this one helps you, the others likely will too:
+This project is one of the [40 DeepSeek Harness plugins](https://github.com/PerryLink) maintained by [PerryLink](https://github.com/PerryLink). If this one helps you, the others likely will too:
 
 | Plugin | One-liner |
 |---|---|
@@ -214,6 +214,7 @@ This project is one of the [37 DeepSeek Harness plugins](https://github.com/Perr
 | **[dsh-permission-rules](https://github.com/PerryLink/dsh-permission-rules)** | Claude Code-style declarative allow/deny/ask permission rules with audit | |
 | **[dsh-personal-directive](https://github.com/PerryLink/dsh-personal-directive)** | Personal directive injector with top-bar toggle (framework edition) |
 | **[dsh-plugin-guide](https://github.com/PerryLink/dsh-plugin-guide)** | Plugin-development knowledge base as an on-demand agent skill | |
+| **[dsh-plugin-doctor](https://github.com/PerryLink/dsh-plugin-doctor)** | Zero-dependency static + sandbox smoke detector for DSH plugins | |
 | **[dsh-reach](https://github.com/PerryLink/dsh-reach)** | Multi-channel approval/question bridge: WeChat/Telegram/Feishu, session console |
 | **[dsh-research-report](https://github.com/PerryLink/dsh-research-report)** | Verifiable research-report engine: content-addressed evidence ledger and sealed versions | |
 | **[dsh-score](https://github.com/PerryLink/dsh-score)** | Multi-dimensional quality scoring for DeepSeek Harness plugins. | |
@@ -224,7 +225,16 @@ This project is one of the [37 DeepSeek Harness plugins](https://github.com/Perr
 | **[dsh-test-drive](https://github.com/PerryLink/dsh-test-drive)** | Isolated install-and-smoke test drives for DeepSeek Harness plugins. | |
 | **[dsh-ticktick](https://github.com/PerryLink/dsh-ticktick)** | TickTick/Dida365 task bridge: session-header panel + 11 tools |
 | **[dsh-translate](https://github.com/PerryLink/dsh-translate)** | Vendor parameter translation and deterministic JSON repair for DeepSeek Harness. | |
-| **[dsh-wechat](https://github.com/PerryLink/dsh-wechat)** | WeChat ↔ DSH bridge (Tencent iLink bot): text/image/file/voice, approvals in chat |
+| **[dsh-wechat](https://github.com/pan17/dsh-wechat)** | WeChat ↔ DSH bridge (Tencent iLink bot): text/image/file/voice, approvals in chat |
+| **[dsh-autotier](https://github.com/PerryLink/dsh-autotier)** | Automatic strong/cheap model-tier routing with deterministic risk guards and a `/tier` command | |
+| **[dsh-catalog](https://github.com/PerryLink/dsh-catalog)** | DSH Desktop Market standard catalog source for the PerryLink family | |
+| **[dsh-cert-mcp](https://github.com/PerryLink/dsh-cert-mcp)** | Read-only MCP server exposing the certification registry: grades, snapshots and five-dimension evidence | |
+| **[dsh-kit](https://github.com/PerryLink/dsh-kit)** | One-command starter pack that installs the core family | |
+| **[dsh-plugin-certification](https://github.com/PerryLink/dsh-plugin-certification)** | Community certification registry with repro-checkable grades and badges | |
+| **[dsh-plugin-kit](https://github.com/PerryLink/dsh-plugin-kit)** | Shared zero-runtime-dependency toolkit for the PerryLink DSH plugins | |
+| **[dsh-plugin-portal](https://github.com/PerryLink/dsh-plugin-portal)** | Zero-dependency static portal rendering the whole plugin family as one page | |
+| **[dsh-plugin-upgrade-015](https://github.com/PerryLink/dsh-plugin-upgrade-015)** | Merged `0.1.3-alpha.1` → `0.1.5-rc.1` upgrade corridor card plus a zero-dependency seam scanner | |
+| **[dsh-team-rooms](https://github.com/PerryLink/dsh-team-rooms)** | Cross-session team rooms: shared message bus, task board and timeline | |
 
 ### Install from the DSH Desktop Market
 

package/THIRD_PARTY_NOTICES.md

@@ -13,7 +13,8 @@ published tarball except where noted; these are install-time dependencies:
 | [typescript](https://github.com/microsoft/TypeScript) | `^5.9.0` | Apache-2.0 | Build-time declaration emission (`lib/types/`) |
 | [@deepseek-ai/cordis](https://www.npmjs.com/package/@deepseek-ai/cordis) | `^4.0.2` (peer) | See package | The plugin runtime |
 | [@deepseek-ai/schemastery](https://www.npmjs.com/package/@deepseek-ai/schemastery) | `^3.18.2` (peer) | See package | Configuration schema |
-| `@deepseek-ai/dsh-*` peers | `>=0.1.2-rc.1 <0.2.0 \|\| >=0.1.5-alpha.1 <0.2.0` (peer) | See packages | Official harness seams (`dsh-tools`, `dsh-skill`, `dsh-skill-filesystem`) |
+| `@deepseek-ai/dsh-*` peers | `>=0.1.2-rc.1 <0.2.0 \|\| >=0.1.5-alpha.1 <0.2.0 \|\| >=0.1.6-0 <0.2.0` (peer) | See packages | Official harness seams (`dsh-tools`, `dsh-skill`, `dsh-skill-filesystem`) |
+| [dsh-research-report](https://www.npmjs.com/package/dsh-research-report) | `0.3.10` (dev, types only) | Apache-2.0 | Type-level source of the optional `ctx.researchReport` contract. Imported with `import type` only, so the build erases it: `lib/index.js` contains no reference to it and the published package does not depend on it |
 
 At runtime the plugin talks to the harness services listed as peerDependencies
 plus the optional `ctx.web` and `ctx.researchReport` capabilities (looked up

package/lib/index.js

@@ -908,12 +908,29 @@ function registerSource(registry, origin, content, capturedAt, note) {
 //#endregion
 //#region src/web.ts
 /**
+* Structural guard for the optional web capability.
+*
+* `ctx.get()` is untyped, so the looked-up value is proven to carry both
+* methods this plugin calls rather than asserted with a cast. A service
+* mounted under `web` missing `search` or `fetch` would otherwise be accepted
+* here and fail inside `industry_track` instead of taking the loud,
+* actionable unmounted path.
+* @param value - the value returned by `ctx.get('web')`.
+* @returns true when the value exposes callable `search` and `fetch`.
+*/
+function isWebLike(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const candidate = value;
+	return typeof candidate.search === "function" && typeof candidate.fetch === "function";
+}
+/**
 * Look up the optional web capability.
 * @param ctx - the plugin context.
 * @returns the web service surface, or undefined when no web seam is mounted.
 */
 function lookupWeb(ctx) {
-	return ctx.get("web");
+	const candidate = ctx.get("web");
+	return isWebLike(candidate) ? candidate : void 0;
 }
 /**
 * Resolve the web capability or throw the actionable reason it cannot run:
@@ -2292,12 +2309,27 @@ function validateCompanyCard(card, now, strictTicker) {
 //#endregion
 //#region src/jobs.ts
 /**
+* Structural guard for the optional background-job registry.
+*
+* `ctx.get()` is untyped, so the looked-up value is proven to carry the one
+* method this plugin calls rather than asserted with a cast. A service mounted
+* under `jobs` without a callable `start` would otherwise be accepted here and
+* fail inside the batch path.
+* @param value - the value returned by `ctx.get('jobs')`.
+* @returns true when the value exposes a callable `start`.
+*/
+function isJobsLike(value) {
+	if (typeof value !== "object" || value === null) return false;
+	return typeof value.start === "function";
+}
+/**
 * Look up the optional background-job registry.
 * @param ctx - the plugin context.
 * @returns the registry surface, or undefined when no job service is mounted.
 */
 function lookupJobs(ctx) {
-	return ctx.get("jobs");
+	const candidate = ctx.get("jobs");
+	return isJobsLike(candidate) ? candidate : void 0;
 }
 //#endregion
 //#region src/tools/company.ts
@@ -2430,6 +2462,10 @@ const BATCH_OUTPUT = {
 			type: "string",
 			enum: ["sequential", "parallel"],
 			required: true
+		},
+		degraded: {
+			type: "json",
+			description: "仅在请求了部署不具备的能力时出现（parallel:true 但无 ctx.jobs ⇒ 已顺序降级）"
 		}
 	},
 	additionalProperties: false
@@ -2578,6 +2614,7 @@ function buildCompanyScanTool(ctx, config) {
 					const lines = [`批量公司扫描（${current.mode === "parallel" ? "parallel" : "sequential"}）：成功 ${current.results.length} 家，失败 ${current.failures.length} 家。`];
 					for (const result of current.results) lines.push(`- 成功：${result.name} → ${result.cardPath}`);
 					for (const failure of current.failures) lines.push(`- 失败：${failure.name}（${failure.reason}）`);
+					if (current.degraded !== void 0) lines.push(`- 能力降级（${current.degraded.capability}）：${current.degraded.reason}`);
 					return [{
 						type: "text",
 						text: lines.join("\n")
@@ -2622,7 +2659,12 @@ function buildCompanyScanTool(ctx, config) {
 					...company.ticker !== void 0 ? { ticker: company.ticker } : {},
 					...company.metrics !== void 0 ? { metrics: company.metrics } : {}
 				}));
-				const jobs = args.parallel === true ? lookupJobs(ctx) : void 0;
+				const wantsParallel = args.parallel === true;
+				const jobs = wantsParallel ? lookupJobs(ctx) : void 0;
+				const degraded = wantsParallel && jobs === void 0 ? {
+					capability: "ctx.jobs",
+					reason: "ctx.jobs 未挂载：批量扫描已顺序执行，未 fan-out 为独立 job"
+				} : void 0;
 				if (jobs !== void 0) {
 					const outcomes = specs.map((spec) => ({ name: spec.name }));
 					const dones = [];
@@ -2690,7 +2732,8 @@ function buildCompanyScanTool(ctx, config) {
 				return {
 					results,
 					failures,
-					mode: "sequential"
+					mode: "sequential",
+					...degraded !== void 0 ? { degraded } : {}
 				};
 			}
 			throw new Error("company_scan requires a name (single company) or companies (batch)");
@@ -3216,12 +3259,28 @@ function reportDirName(at, exists) {
 //#endregion
 //#region src/engine-bridge.ts
 /**
+* Structural guard for the optional report engine.
+*
+* `ctx.get()` is untyped, so the looked-up value must be proven to carry the
+* one method this plugin calls before it is used. This replaces the previous
+* `as unknown as` cast, which asserted a shape that was never checked: a
+* mounted service missing `assemble` would have been accepted here and failed
+* later inside the call path, where the cause is much harder to read.
+* @param value - the value returned by `ctx.get('researchReport')`.
+* @returns true when the value exposes a callable `assemble`.
+*/
+function isResearchReportLike(value) {
+	if (typeof value !== "object" || value === null) return false;
+	return typeof value.assemble === "function";
+}
+/**
 * Look up the optional report engine.
 * @param ctx - the plugin context.
 * @returns the engine surface, or undefined when no engine is mounted.
 */
 function lookupEngine(ctx) {
-	return ctx.get("researchReport");
+	const candidate = ctx.get("researchReport");
+	return isResearchReportLike(candidate) ? candidate : void 0;
 }
 //#endregion
 //#region src/tools/report.ts
@@ -3672,7 +3731,7 @@ function buildIndustryReportTool(ctx, config) {
 * @module dsh-industry-research/version
 */
 /** The package version. */
-const VERSION = "0.3.8";
+const VERSION = "0.3.10";
 //#endregion
 //#region src/index.ts
 /**

package/lib/types/engine-bridge.d.ts

@@ -1,55 +1,20 @@
 /**
  * Optional bridge to the `ctx.researchReport` report engine, provided by the
  * sibling `dsh-research-report` plugin. The engine is never injected and never
- * imported: it is looked up structurally with `ctx.get('researchReport')`, and
- * `industry_report` falls back to the builtin Markdown renderer when the
- * engine is absent. The request/result types below are the frozen
- * cross-plugin contract and must stay byte-identical with it.
+ * reached at runtime through an import: it is looked up structurally with
+ * `ctx.get('researchReport')`, and `industry_report` falls back to the builtin
+ * Markdown renderer when the engine is absent.
+ *
+ * The request/result types are **owned** by `dsh-research-report` and imported
+ * from it as types only (erased at build time, so no runtime dependency is
+ * created). They used to be mirrored as five local interfaces kept in sync by
+ * hand — that mirror could drift silently, and nothing would fail until a real
+ * call misbehaved. Re-exported here so existing import sites stay stable.
  * @module dsh-industry-research/engine-bridge
  */
 import type { Context } from '@deepseek-ai/cordis';
-export interface ReportSectionInput {
-    heading: string;
-    /** Paragraphs; each claim string may carry citations. */
-    paragraphs: Array<{
-        text: string;
-        claimIds?: string[];
-    }>;
-}
-export interface EvidenceInput {
-    id: string;
-    title: string;
-    /** Where the evidence came from (URL or workspace path). */
-    origin: string;
-    /** Verbatim content snapshot used for byte-level checks. */
-    content: string;
-    /** ISO-8601 time the snapshot was captured. */
-    capturedAt: string;
-}
-export interface AssembleReportRequest {
-    title: string;
-    topic: string;
-    evidence: EvidenceInput[];
-    sections: ReportSectionInput[];
-    /** Every claim id referenced in sections must be registered here. */
-    claims: Array<{
-        id: string;
-        text: string;
-        evidenceIds: string[];
-    }>;
-}
-export interface AssembleReportResult {
-    /** Workspace path of the sealed report directory (report.md + manifest.json). */
-    reportDir: string;
-    /** SHA-256 content hash of manifest.json. */
-    sealHash: string;
-    /** Per-claim verification verdicts. */
-    verdicts: Array<{
-        claimId: string;
-        status: 'verified' | 'unverified' | 'contradicted';
-        note?: string;
-    }>;
-}
+import type { AssembleReportRequest, AssembleReportResult, EvidenceInput, ReportSectionInput } from 'dsh-research-report';
+export type { AssembleReportRequest, AssembleReportResult, EvidenceInput, ReportSectionInput, };
 /** The structural surface of the optional `ctx.researchReport` engine. */
 export interface ResearchReportLike {
     /**

package/lib/types/engine-bridge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"engine-bridge.d.ts","sourceRoot":"","sources":["../../src/engine-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAElD,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAA;IACf,yDAAyD;IACzD,UAAU,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAA;CACzD;AACD,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAA;IACd,4DAA4D;IAC5D,OAAO,EAAE,MAAM,CAAA;IACf,+CAA+C;IAC/C,UAAU,EAAE,MAAM,CAAA;CACnB;AACD,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,aAAa,EAAE,CAAA;IACzB,QAAQ,EAAE,kBAAkB,EAAE,CAAA;IAC9B,qEAAqE;IACrE,MAAM,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAA;CACnE;AACD,MAAM,WAAW,oBAAoB;IACnC,iFAAiF;IACjF,SAAS,EAAE,MAAM,CAAA;IACjB,6CAA6C;IAC7C,QAAQ,EAAE,MAAM,CAAA;IAChB,uCAAuC;IACvC,QAAQ,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,YAAY,GAAG,cAAc,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACxG;AAED,0EAA0E;AAC1E,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;CACxE;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,kBAAkB,GAAG,SAAS,CAEzE"}
+{"version":3,"file":"engine-bridge.d.ts","sourceRoot":"","sources":["../../src/engine-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,EACV,qBAAqB,EACrB,oBAAoB,EACpB,aAAa,EACb,kBAAkB,EACnB,MAAM,qBAAqB,CAAA;AAE5B,YAAY,EACV,qBAAqB,EACrB,oBAAoB,EACpB,aAAa,EACb,kBAAkB,GACnB,CAAA;AAED,0EAA0E;AAC1E,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;CACxE;AAkBD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,kBAAkB,GAAG,SAAS,CAGzE"}