dsh-jev-guard 0.5.1 → 0.5.2

package/CHANGELOG.md

@@ -5,6 +5,22 @@
 This project follows a "record the facts by date" approach: every entry states clearly **what changed, why, and how it was verified**.
 The complete design trade-offs are in [`docs/DECISIONS.md`](./docs/DECISIONS.md), the measured data in [`docs/MEASUREMENTS.md`](./docs/MEASUREMENTS.md).
 
+## [0.5.2] — 2026-09-22
+
+**Releases now publish themselves from a tag.** The plugin's behaviour is unchanged: `bin/`, `lib/`, `adapters/`, `cordis.patch.yml` and the default config are identical to 0.5.1. Only the way a release reaches the registry changed.
+
+Pushing a `v*` tag runs `.github/workflows/publish.yml`, which publishes through npm [trusted publishing](https://docs.npmjs.com/trusted-publishers) — an OIDC identity exchanged for a one-shot publish grant. No publish token exists anywhere, so there is nothing to store, rotate, or to find expired at the worst possible moment; for a public repository and package npm also attaches a provenance attestation automatically.
+
+Three gates run first, and any one of them fails the release:
+
+1. **The tag must match the version in `package.json`.** `npm publish` ships the manifest's version and ignores the tag, so a forgotten bump would try to republish an old version and fail with a message naming the wrong cause.
+2. **The same self-checks the `selftest` workflow runs on `main`** — the seven offline suites, `guard selftest`, and the DSH adapter smoke test.
+3. **The tarball must carry no local state** — `config.json`, `secrets.json`, `HANDOVER.md`, `guard.log*`, `allow.txt`, `degraded.json`, `verification-results/` and `.zcode/` are rejected by name. A `files` allowlist is a control only for as long as nobody widens it, so the packed tarball is inspected rather than trusted.
+
+That last gate is why this is a release of its own: this project has shipped real credentials by accident before, and a release is precisely the moment such a mistake would reach a registry.
+
+**Acceptance**: `node bin/guard.mjs selftest` (12/12) and the seven offline suites pass, as does the DSH adapter smoke test; the version gate was exercised in both directions (`v0.5.1` accepted against a matching manifest, `v0.5.2` rejected against a `0.5.1` one); the tarball gate was executed against this repository (52 files, none flagged) and its pattern checked against names it must reject and names it must not. The pipeline's first real run is the `v0.5.2` tag itself.
+
 ## [0.5.1] — 2026-09-22
 
 **Published to npm, and the host-version declaration is withdrawn.** What changes here is how the plugin is installed and what it declares — not what it does. `bin/`, `lib/`, `adapters/`, `cordis.patch.yml` and the default config are unchanged from 0.5.0.

package/CHANGELOG.zh-CN.md

@@ -5,6 +5,22 @@
 本项目遵循「按日期记录事实」的写法:每条都写清**改了什么、为什么、以及怎么验证的**。
 完整的设计取舍见 [`docs/DECISIONS.md`](./docs/DECISIONS.md),实测数据见 [`docs/MEASUREMENTS.md`](./docs/MEASUREMENTS.md)。
 
+## [0.5.2] — 2026-09-22
+
+**发布这件事现在由 tag 自己完成。** 插件行为未变:`bin/`、`lib/`、`adapters/`、`cordis.patch.yml` 与默认配置相对 0.5.1 完全一致。变的只是"一个版本怎么到达 registry"。
+
+推一个 `v*` tag 会触发 `.github/workflows/publish.yml`,它走 npm 的 [trusted publishing](https://docs.npmjs.com/trusted-publishers) 发布 —— 用 OIDC 身份换取一次性的发布授权。**这个流程里不存在任何发布 token**,所以没有东西需要保存、轮换,也不会在最不该出错的时候发现它过期了;公开仓库 + 公开包还会由 npm 自动附上 provenance 证明。
+
+上传之前先过三道闸,任何一道不过就不发:
+
+1. **tag 必须与 `package.json` 里的 version 一致。** `npm publish` 发的是 manifest 里的版本号、根本不看 tag,所以忘了升版会变成"试图重发一个旧版本",报出来的错还指向错误的原因。
+2. **跑 `selftest` 工作流在 `main` 上跑的同一套自检** —— 七套离线自检、`guard selftest`、DSH 适配器冒烟。
+3. **tarball 不得夹带本机状态** —— `config.json`、`secrets.json`、`HANDOVER.md`、`guard.log*`、`allow.txt`、`degraded.json`、`verification-results/`、`.zcode/` 按名字拦下。`files` 白名单只在没人放宽它的前提下才算控件,所以这里检查的是打好的 tarball,而不是相信白名单。
+
+最后这道闸也是为什么值得为它单独发一个版本:这个项目**有过真的把凭据发出去的历史**,而发布正是这类失误会抵达 registry 的时刻。
+
+**验收**:`node bin/guard.mjs selftest`(12/12)与七套离线自检全过,DSH 适配器冒烟也通过;版本闸两个方向都实测过(`v0.5.1` 对匹配的 manifest 通过,`v0.5.2` 对 `0.5.1` 的 manifest 被拒);tarball 闸在本仓库上实跑过(52 个文件、无一命中),其正则也逐条对着"必须拒绝"与"必须放行"的名字验过。这条流水线的首次真实运行就是 `v0.5.2` 这个 tag 本身。
+
 ## [0.5.1] — 2026-09-22
 
 **发布到 npm,并撤销宿主版本声明。** 这次改的是**安装方式与声明内容**,不是行为 —— `bin/`、`lib/`、`adapters/`、`cordis.patch.yml` 与默认配置相对 0.5.0 一字未变。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-jev-guard",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "description": "Pre-execution safety valve for DeepSeek Harness: a TypeSafe Jev question decides whether a shell command/script would irreversibly delete or overwrite real data. Four states (allow/revise/block/escalate), mounted on tools/pre-execute. Zero dependencies; WSL/Linux (bash) and Windows (pwsh); one-shot tokens, credit-exhaustion degradation, shared audit log; bilingual (zh-CN / en) messages.",
   "keywords": [
     "deepseek-harness",