dsh-mcp-panel 0.2.0 → 0.3.0

package/CHANGELOG.md

@@ -0,0 +1,95 @@
+# Changelog
+
+All notable changes to this project are documented in this file.
+
+## [0.3.0] - 2026-08-15
+
+### Added
+
+- Panel at a glance: a summary line above the cards (total servers, connected, with errors — counted from the same badge codes the rows show), a server search box that filters cards by name or target, and expand-all / collapse-all buttons (multi-card expansion replaces the single-open accordion).
+- Release pipeline: `scripts/release.mjs` (version bump + changelog stamp + full gate + commit + annotated tag, with revert on failure), `scripts/check-tag-version.mjs` (tag/version tripwire for CI), `scripts/changelog-section.mjs` (prints one version's changelog section), and the tag-triggered `release` workflow — gate again → npm publish with provenance → GitHub Release with the packed tarball attached and notes from the changelog.
+- Package metadata: `homepage`, `bugs`, and `author` fields.
+
+### Changed
+
+- The dependency line actually lands: typescript 7.0.2 (the TS7 build the tsconfigs were already prepared for), vitest 4.1.10, jsdom 30.0.1 — the full gate suite stays green. The 0.2.1 changelog had claimed these bumps prematurely; that claim is removed from the 0.2.1 entry.
+
+### Engineering
+
+- 109 tests (up from 105): summary counting, server-filter matching, and their agreement with badge derivation.
+
+## [0.2.1] - 2026-08-14
+
+### Fixed
+
+- CI never passed: `pnpm/action-setup` had no pnpm version to install (no `packageManager` field and no `version` input). Added `packageManager: pnpm@11.7.0`, upgraded the actions (checkout@v7, setup-node@v7, pnpm/action-setup@v6), and pinned the pnpm version explicitly in `compat.yml` (its subdirectory checkout has no workspace-root `package.json` to auto-detect from).
+- Probe targeting for rows nested under loader groups: `rawEndpoint` compared the group-composed `entry.id` (`include:…`) against the snapshot namespace derived from `entry.options.id`, so group-nested rows without an explicit `serverName` could never be probed.
+- Upstream `mcp/status` payloads are validated before storage — a malformed payload (unknown phase, non-numeric counts) previously flowed into the snapshot verbatim and got the whole `mcpPanel/status` response rejected by the strict Typert codec on the client.
+- Reconnect counting is idempotent per observed attempt: re-observing the same payload (HMR remount, event + query seed) no longer double counts; `connected`/`disposed` resets the counter so the next outage counts from attempt 1.
+- `/mcp <server> disable|enable` on a leftover (unconfigured) `mcp__` namespace emitted a malformed `- set: { id: , … }` suggestion — it now refuses with a localized explanation, and listings mark those rows `unconfigured` instead of `disabled`.
+- Job lifecycle states outside the panel vocabulary render as `unknown` (muted) instead of failing the wire codec or throwing at render.
+- Repaired mojibake (corrupted em-dashes/arrows) in `docs/upstream-proposal.md`; its status header now points at the implemented fork branch and the Discussions handoff.
+
+### Changed
+
+- The tab polls on a short cadence while any probe is running, so probe rows and the disabled probe button settle even when `refreshIntervalMs` is `0`.
+- The tab's error state now shows the underlying failure message instead of a generic notice.
+- Badges no longer double-announce to screen readers (dropped `role="img"`/`aria-label`; the label is visible text).
+- The `/mcp` command hint is served from the localized message dictionaries.
+
+### Engineering
+
+- tsdown config migrated off the deprecated `external`/`noExternal` options to `deps.neverBundle`/`deps.alwaysBundle`/`deps.onlyBundle`.
+- Removed `baseUrl` from the tsconfigs (dropped in TypeScript 7; `paths` resolves relative to the config file), unblocking the typescript@7 line.
+- `files` now ships `docs/`, `CHANGELOG.md`, `THIRD_PARTY_NOTICES.md`, and all five READMEs (the published tarball was missing `docs/upstream-proposal.md`, which the READMEs link to).
+- 105 tests (up from 96): observation validation and idempotent reconnect counting, nested-row probe targeting, leftover-namespace command behavior, and unknown job-state presentation.
+
+## [0.2.0] - 2026-08-14
+
+### Added
+
+- Panel probe action (`mcpPanel/probe`): one-click connectivity probe of one streamable-http server from the settings tab; results stay panel-only.
+- Passive background probes (`passiveProbeEnabled` / `passiveProbeIntervalMs`) with per-server reachability badges kept separate from connection status.
+- Suggested panel polling (`refreshIntervalMs`); the tab refreshes automatically on the suggested interval.
+- `/mcp` output language (`outputLanguage: 'en' | 'zh' | 'es' | 'pt' | 'hi'`); renderers parameterized on a message dictionary, patch lines stay machine-identical.
+- Probe record cap (`maxProbes`) and upstream event freshness (`observedAt` → "last event Ns ago").
+- `/mcp <server> probe` command action: start a panel-only probe from the command surface.
+- Panel detail row for config-declared policy facts (`configuredNote`: reconnect budget, fail-fast, tool timeout).
+- Probe rows show local start/end wall-clock times; the probe button disables while a probe for that server is running.
+- Panel polish: focus-visible rings, attempt x/y budget row, bounded server-info display in probe details.
+
+### Changed
+
+- Tool filter input is now per-card: one query per expanded server, no cross-card leakage.
+- Polling pauses while the document is hidden and refreshes on visibility regain.
+- URL fragment credentials (`#token=…`) are redacted like query credentials, in URLs and free text.
+- Leftover (unconfigured) `mcp__` namespaces badge as "unknown" instead of "disabled".
+- The settings tab keeps following the app UI language (en/zh — the harness locale face supports those two codes today); the `/mcp` command language is the separate five-language `outputLanguage` config.
+
+### Engineering
+
+- `.gitattributes` pins LF line endings so Windows checkouts stop producing CRLF diff noise.
+- Version-consistency tripwire: the probe's MCP `clientInfo.version` must equal the package version.
+- CI restores typecheck: `typecheck:ci` resolves the npm-published `0.1.0-rc.6` type faces (new client-* devDeps, no checkout paths); CI matrix runs Node 22 + 24 on Ubuntu + Windows.
+- Monthly harness-compat job (`.github/workflows/compat.yml`): packs the plugin, installs it into a fresh web profile of a pinned deepseek-harness SHA, and boots it end to end.
+- `scripts/verify-headless.mjs` now replicates the launcher's `prepareProfile` steps (flat module fallback heal, empty root-config write) and locates the installation anchor by walking up (plus `DSH_INSTALL_ANCHOR` override) — it works for plugin repos checked out at any depth under the harness.
+- Upstream `mcp/status` seam: implemented in a deepseek-harness branch (`feat/mcp-client-status-observability-seam`) with tests, docs, and an Agent Note; the panel consumes it unchanged — verified end to end with a real `server-everything` row reporting `status: connected (source: upstream-event)`.
+
+## [0.1.0] - 2026-08-14
+
+Initial release.
+
+### Added
+
+- Read-only MCP management panel for the official `@deepseek-ai/dsh-mcp-client`:
+  - `/mcp` command (list, per-server detail, `tools`, controlled `disable`/`enable` patch suggestions), model-readable and session-log reconstructable.
+  - Settings → Plugins → **MCP** tab (panel-only snapshot over the `mcpPanel` Typert Remote namespace): transport/target, status badges, tool inventory, sanitized errors, reconnect counts, probe results.
+  - `mcp_probe` one-shot Streamable HTTP connectivity probe (background job, panel-only results).
+  - Display sanitization (URL query credentials, userinfo passwords, header values, bearer tokens, JWTs, env-var credentials).
+  - Consumption of the proposed upstream `mcp/status` seam (typed event + query service, feature-detected; honest `unknown`/`derived` fallback).
+- Hand-written `./typert` host manifest + client Remote contribution sharing one canonical descriptor.
+- 58 unit tests; headless verification script; Apache-2.0; five-language READMEs.
+
+### Verified
+
+- Against a source checkout of deepseek-harness (workspace packages `0.1.0-rc.5`, mainline `7b9644f`): headless `/mcp` end-to-end (13 real tools enumerated), live web profile (gateway RPC, client bundle, boot manifest).

package/README.es.md

@@ -5,6 +5,9 @@
 [English](README.md) · [简体中文](README.zh.md) · [Español](README.es.md) · [Português](README.pt.md) · [हिन्दी](README.hi.md)
 
 [![License](https://img.shields.io/badge/license-Apache%202.0-blue.svg)](LICENSE)
+[![npm](https://img.shields.io/npm/v/dsh-mcp-panel)](https://www.npmjs.com/package/dsh-mcp-panel)
+[![downloads](https://img.shields.io/npm/dm/dsh-mcp-panel)](https://www.npmjs.com/package/dsh-mcp-panel)
+[![CI](https://github.com/PerryLink/dsh-mcp-panel/actions/workflows/ci.yml/badge.svg)](https://github.com/PerryLink/dsh-mcp-panel/actions/workflows/ci.yml)
 [![dsh-plugin](https://img.shields.io/badge/ecosystem-dsh--plugin-8b5cf6)](https://github.com/topics/dsh-plugin)
 [![deepseek-harness](https://img.shields.io/badge/runtime-deepseek--harness-4f46e5)](https://github.com/deepseek-ai/deepseek-harness)
 
@@ -13,14 +16,16 @@
 ## Compatibilidad
 
 - **Runtime**: DeepSeek Harness ≥ `0.1.0-rc.5` (las peerDependencies fijan la línea `0.1.0-rc.6`).
+- **Última versión**: v0.3.0 (2026-08-15) — compuerta completa en verde con la cadena TypeScript 7 / Vitest 4 / jsdom 30, 109 pruebas.
 - **Última verificación**: 2026-08-14 contra un checkout del código fuente de deepseek-harness (paquetes del workspace en `0.1.0-rc.5`, mainline `7b9644f`) — `/mcp` headless de extremo a extremo más un perfil web en vivo; evidencia en [docs/research-notes.zh.md](docs/research-notes.zh.md). Reverificado el mismo día contra mainline `47f9438` con la rama de la costura `mcp/status` (`feat/mcp-client-status-observability-seam`): una fila real de `server-everything` muestra `status: connected (source: upstream-event)` a través del plugin empaquetado, más el flujo de compatibilidad fiel al lanzador; registro en [docs/optimization-plan-v2.zh.md](docs/optimization-plan-v2.zh.md).
 
 ## Qué obtienes
 
 | Superficie | Qué muestra |
 |---|---|
-| **Comando `/mcp`** | transporte, destino, número de herramientas, estado de conexión, último error, contador de reconexiones — legible por el modelo y reconstruible desde el log, bilingüe (`outputLanguage: en\|zh`) |
+| **Comando `/mcp`** | transporte, destino, número de herramientas, estado de conexión, último error, contador de reconexiones — legible por el modelo y reconstruible desde el log, cinco idiomas de salida (`outputLanguage: en\|zh\|es\|pt\|hi`) |
 | **Ajustes → Plugins → pestaña MCP** | la misma instantánea en solo lectura, con insignias de estado, listas de herramientas expandibles, errores saneados y resultados de sondas |
+| **De un vistazo** | recuentos de resumen sobre las tarjetas, un buscador de servidores y botones de expandir/contraer todo |
 | **Botón de sonda del panel** | sonda de conectividad de un clic para un servidor streamable-http desde la pestaña; los resultados siguen siendo solo del panel |
 | **Sondas pasivas** | insignias de alcanzabilidad opcionales en segundo plano por servidor, separadas del estado de conexión |
 | **Refresco automático** | el host sugiere un intervalo de refresco (`refreshIntervalMs`); la pestaña consulta y se pausa mientras está oculta |
@@ -30,7 +35,10 @@
 ## Inicio rápido
 
 ```sh
-dsh plugin --profile web add github:PerryLink/dsh-mcp-panel#v0.2.0
+# canal git (compila mediante el script prepare del paquete)
+dsh plugin --profile web add github:PerryLink/dsh-mcp-panel#v0.3.0
+# canal npm (tarball publicado, sin aprobación de compilación)
+dsh plugin --profile web add dsh-mcp-panel@0.3.0
 ```
 
 Reinicia (o deja que la superficie web recargue su `cordis.patch.yml`) y ejecuta:
@@ -114,13 +122,17 @@ respaldo compartido `$DSH_HOME/profiles/node_modules`) y añade la fila a `cordi
 
 ```sh
 pnpm install
-pnpm run typecheck
-pnpm test          # 96 pruebas: extremos del saneador, agrupación, tolerancia de agregación, salida del comando (5 idiomas), control de sondas, cableado del cliente, presentador
-pnpm run build     # declaraciones tsc → lib/types; tsdown → lib/index.js + lib/typert.host.js + lib/client.js
+pnpm run typecheck    # compuerta local: resuelve las caras de tipo frescas del checkout del harness vía rutas tsconfig
+pnpm run typecheck:ci # compuerta npm: resuelve las caras de tipo publicadas 0.1.0-rc.6 (lo que ejecuta CI)
+pnpm test             # 109 pruebas: extremos del saneador, agrupación, tolerancia de agregación, salida del comando (5 idiomas), control de sondas, cableado del cliente, presentador (insignias/resumen/filtro)
+pnpm run build        # declaraciones tsc → lib/types; tsdown → lib/index.js + lib/typert.host.js + lib/client.js
 pnpm run verify:self-contained
+pnpm run verify:artifacts
 pnpm pack
 ```
 
+Publicación: `node scripts/release.mjs <x.y.z>` sube la versión, sella el CHANGELOG, vuelve a ejecutar la compuerta, hace commit y crea el tag; al empujar el tag se publican npm y el GitHub Release automáticamente (ver [CONTRIBUTING.md](CONTRIBUTING.md)).
+
 Verificación contra un checkout real del harness:
 `node --import tsx/esm scripts/verify-headless.mjs` arranca el perfil web completo en proceso (puerto efímero) e imprime la salida exacta de `/mcp`, `/mcp <server> tools` y `/mcp <server> disable`.
 

package/README.hi.md

@@ -5,6 +5,9 @@
 [English](README.md) · [简体中文](README.zh.md) · [Español](README.es.md) · [Português](README.pt.md) · [हिन्दी](README.hi.md)
 
 [![License](https://img.shields.io/badge/license-Apache%202.0-blue.svg)](LICENSE)
+[![npm](https://img.shields.io/npm/v/dsh-mcp-panel)](https://www.npmjs.com/package/dsh-mcp-panel)
+[![downloads](https://img.shields.io/npm/dm/dsh-mcp-panel)](https://www.npmjs.com/package/dsh-mcp-panel)
+[![CI](https://github.com/PerryLink/dsh-mcp-panel/actions/workflows/ci.yml/badge.svg)](https://github.com/PerryLink/dsh-mcp-panel/actions/workflows/ci.yml)
 [![dsh-plugin](https://img.shields.io/badge/ecosystem-dsh--plugin-8b5cf6)](https://github.com/topics/dsh-plugin)
 [![deepseek-harness](https://img.shields.io/badge/runtime-deepseek--harness-4f46e5)](https://github.com/deepseek-ai/deepseek-harness)
 
@@ -13,14 +16,16 @@
 ## संगतता
 
 - **रनटाइम**: DeepSeek Harness ≥ `0.1.0-rc.5` (peerDependencies `0.1.0-rc.6` पैकेज लाइन पिन करती हैं)।
+- **नवीनतम संस्करण**: v0.3.0 (2026-08-15) — TypeScript 7 / Vitest 4 / jsdom 30 टूलचेन पर पूरा द्वार हरा, 109 टेस्ट।
 - **अंतिम सत्यापन**: 2026-08-14, deepseek-harness के सोर्स checkout के विरुद्ध (workspace पैकेज `0.1.0-rc.5`, mainline `7b9644f`) — headless `/mcp` एंड-टू-एंड + लाइव वेब प्रोफ़ाइल; प्रमाण [docs/research-notes.zh.md](docs/research-notes.zh.md) में। उसी दिन mainline `47f9438` + `mcp/status` सीम ब्रांच (`feat/mcp-client-status-observability-seam`) के विरुद्ध पुनः सत्यापित: असली `server-everything` पंक्ति पैक किए गए प्लगइन से `status: connected (source: upstream-event)` दिखाती है, साथ ही लॉन्चर-समतुल्य संगतता प्रवाह; रिकॉर्ड [docs/optimization-plan-v2.zh.md](docs/optimization-plan-v2.zh.md) में।
 
 ## आपको क्या मिलता है
 
 | सतह | क्या दिखाती है |
 |---|---|
-| **`/mcp` कमांड** | ट्रांसपोर्ट, टार्गेट, टूल काउंट, कनेक्शन स्टेटस, अंतिम एरर, रीकनेक्ट काउंट — मॉडल-रीडेबल और लॉग से रीकंस्ट्रक्टेबल, द्विभाषी (`outputLanguage: en\|zh`) |
+| **`/mcp` कमांड** | ट्रांसपोर्ट, टार्गेट, टूल काउंट, कनेक्शन स्टेटस, अंतिम एरर, रीकनेक्ट काउंट — मॉडल-रीडेबल और लॉग से रीकंस्ट्रक्टेबल, पाँच आउटपुट भाषाएँ (`outputLanguage: en\|zh\|es\|pt\|hi`) |
 | **सेटिंग्स → प्लगइन्स → MCP टैब** | वही स्नैपशॉट रीड-ओनली: स्टेटस बैज, विस्तार योग्य टूल सूचियाँ, सैनिटाइज़्ड एरर, प्रोब परिणाम |
+| **एक नज़र में** | कार्ड के ऊपर सारांश गिनती, सर्वर खोज बॉक्स, और सभी विस्तार/संकुचन बटन |
 | **पैनल प्रोब बटन** | टैब से एक streamable-http सर्वर की एक-क्लिक कनेक्टिविटी प्रोब; परिणाम केवल पैनल में रहते हैं |
 | **पैसिव प्रोब** | प्रति सर्वर वैकल्पिक बैकग्राउंड रीचेबिलिटी बैज, कनेक्शन स्टेटस से अलग |
 | **ऑटो रिफ्रेश** | होस्ट एक रिफ्रेश अंतराल सुझाता है (`refreshIntervalMs`); टैब पोल करता है और छिपा होने पर रुक जाता है |
@@ -30,7 +35,10 @@
 ## त्वरित शुरुआत
 
 ```sh
-dsh plugin --profile web add github:PerryLink/dsh-mcp-panel#v0.2.0
+# git चैनल (पैकेज के prepare स्क्रिप्ट से बिल्ड होता है)
+dsh plugin --profile web add github:PerryLink/dsh-mcp-panel#v0.3.0
+# npm चैनल (प्रकाशित tarball, बिल्ड अनुमोदन की आवश्यकता नहीं)
+dsh plugin --profile web add dsh-mcp-panel@0.3.0
 ```
 
 फिर रीस्टार्ट करें (या वेब सतह को अपनी `cordis.patch.yml` हॉट-रीलोड करने दें) और चलाएँ:
@@ -114,13 +122,17 @@ MCP servers (1):
 
 ```sh
 pnpm install
-pnpm run typecheck
-pnpm test          # 96 टेस्ट: सैनिटाइज़र चरम मामले, समूहन, एग्रीगेशन सहनशीलता, कमांड आउटपुट (5 भाषाएँ), प्रोब गेटिंग, क्लाइंट वायरिंग, प्रेज़ेंटर
-pnpm run build     # tsc डिक्लेरेशन → lib/types; tsdown → lib/index.js + lib/typert.host.js + lib/client.js
+pnpm run typecheck    # स्थानीय द्वार: tsconfig पथों से harness checkout के ताज़ा टाइप फेस
+pnpm run typecheck:ci # npm द्वार: प्रकाशित 0.1.0-rc.6 टाइप फेस (जो CI चलाता है)
+pnpm test             # 109 टेस्ट: सैनिटाइज़र चरम मामले, समूहन, एग्रीगेशन सहनशीलता, कमांड आउटपुट (5 भाषाएँ), प्रोब गेटिंग, क्लाइंट वायरिंग, प्रेज़ेंटर (बैज/सारांश/फ़िल्टर)
+pnpm run build        # tsc डिक्लेरेशन → lib/types; tsdown → lib/index.js + lib/typert.host.js + lib/client.js
 pnpm run verify:self-contained
+pnpm run verify:artifacts
 pnpm pack
 ```
 
+रिलीज़: `node scripts/release.mjs <x.y.z>` संस्करण बढ़ाता है, CHANGELOG पर मुहर लगाता है, द्वार फिर चलाता है, कमिट और टैग करता है; टैग पुश करने पर npm और GitHub Release अपने आप प्रकाशित होते हैं (देखें [CONTRIBUTING.md](CONTRIBUTING.md))।
+
 असली harness checkout के विरुद्ध सत्यापन:
 `node --import tsx/esm scripts/verify-headless.mjs` पूरे वेब प्रोफ़ाइल को प्रोसेस में बूट करता है (क्षणिक पोर्ट) और `/mcp`, `/mcp <server> tools`, `/mcp <server> disable` का सटीक आउटपुट छापता है।
 

package/README.md

@@ -5,6 +5,9 @@
 [English](README.md) · [简体中文](README.zh.md) · [Español](README.es.md) · [Português](README.pt.md) · [हिन्दी](README.hi.md)
 
 [![License](https://img.shields.io/badge/license-Apache%202.0-blue.svg)](LICENSE)
+[![npm](https://img.shields.io/npm/v/dsh-mcp-panel)](https://www.npmjs.com/package/dsh-mcp-panel)
+[![downloads](https://img.shields.io/npm/dm/dsh-mcp-panel)](https://www.npmjs.com/package/dsh-mcp-panel)
+[![CI](https://github.com/PerryLink/dsh-mcp-panel/actions/workflows/ci.yml/badge.svg)](https://github.com/PerryLink/dsh-mcp-panel/actions/workflows/ci.yml)
 [![dsh-plugin](https://img.shields.io/badge/ecosystem-dsh--plugin-8b5cf6)](https://github.com/topics/dsh-plugin)
 [![deepseek-harness](https://img.shields.io/badge/runtime-deepseek--harness-4f46e5)](https://github.com/deepseek-ai/deepseek-harness)
 
@@ -13,14 +16,16 @@
 ## Compatibility
 
 - **Runtime**: DeepSeek Harness ≥ `0.1.0-rc.5` (peer dependencies pin the `0.1.0-rc.6` package line).
+- **Latest release**: v0.3.0 (2026-08-15) — full gate green on the TypeScript 7 / Vitest 4 / jsdom 30 toolchain, 109 tests.
 - **Last verified**: 2026-08-14 against a source checkout of deepseek-harness (workspace packages at `0.1.0-rc.5`, mainline `7b9644f`) — headless `/mcp` end-to-end plus a live web profile; evidence in [docs/research-notes.zh.md](docs/research-notes.zh.md). Re-verified the same day against mainline `47f9438` with the `mcp/status` seam branch (`feat/mcp-client-status-observability-seam`): a real `server-everything` row renders `status: connected (source: upstream-event)` through the packed plugin, plus the launcher-faithful compat flow; record in [docs/optimization-plan-v2.zh.md](docs/optimization-plan-v2.zh.md).
 
 ## What you get
 
 | Surface | What it shows |
 |---|---|
-| **`/mcp` command** | transport, target, tool count, connection status, last error, reconnect count — model-readable, session-log reconstructable, bilingual (`outputLanguage: en\|zh`) |
+| **`/mcp` command** | transport, target, tool count, connection status, last error, reconnect count — model-readable, session-log reconstructable, five output languages (`outputLanguage: en\|zh\|es\|pt\|hi`) |
 | **Settings → Plugins → MCP tab** | the same snapshot read-only, with status badges, expandable tool lists, sanitized errors, probe results |
+| **At a glance** | summary counts above the cards, a server search box, and expand-all / collapse-all buttons |
 | **Panel probe button** | one-click connectivity probe of one streamable-http server from the tab; results stay panel-only |
 | **Passive probes** | optional background reachability badges per server, kept separate from connection status |
 | **Auto refresh** | the host suggests a refresh interval (`refreshIntervalMs`); the tab polls and pauses while hidden |
@@ -30,7 +35,10 @@
 ## Quick start
 
 ```sh
-dsh plugin --profile web add github:PerryLink/dsh-mcp-panel#v0.2.0
+# git channel (builds via the package's prepare script)
+dsh plugin --profile web add github:PerryLink/dsh-mcp-panel#v0.3.0
+# npm channel (published tarball, no build approval needed)
+dsh plugin --profile web add dsh-mcp-panel@0.3.0
 ```
 
 Then restart (or let the web surface hot-reload its `cordis.patch.yml`) and:
@@ -114,13 +122,17 @@ Found a security issue? Open a GitHub issue **without** pasting secrets, keys, o
 
 ```sh
 pnpm install
-pnpm run typecheck
-pnpm test          # 96 tests: sanitizer extremes, grouping, aggregation tolerance, command output (5 languages), probe gating, client wiring, presenter
-pnpm run build     # tsc declarations → lib/types; tsdown → lib/index.js + lib/typert.host.js + lib/client.js
+pnpm run typecheck    # local gate: resolves the harness checkout's fresh type faces via tsconfig paths
+pnpm run typecheck:ci # npm gate: resolves the published 0.1.0-rc.6 type faces (what CI runs)
+pnpm test             # 109 tests: sanitizer extremes, grouping, aggregation tolerance, command output (5 languages), probe gating, client wiring, presenter (badges, summary, filter)
+pnpm run build        # tsc declarations → lib/types; tsdown → lib/index.js + lib/typert.host.js + lib/client.js
 pnpm run verify:self-contained
+pnpm run verify:artifacts
 pnpm pack
 ```
 
+Release: `node scripts/release.mjs <x.y.z>` bumps the version, stamps the changelog, re-runs the gate, commits and tags; pushing the tag publishes npm + the GitHub Release automatically (see [CONTRIBUTING.md](CONTRIBUTING.md)).
+
 Verification against a real harness checkout:
 `node --import tsx/esm scripts/verify-headless.mjs` boots the full web profile in process (ephemeral port) and prints the exact `/mcp`, `/mcp <server> tools`, and `/mcp <server> disable` output.
 

package/README.pt.md

@@ -5,6 +5,9 @@
 [English](README.md) · [简体中文](README.zh.md) · [Español](README.es.md) · [Português](README.pt.md) · [हिन्दी](README.hi.md)
 
 [![License](https://img.shields.io/badge/license-Apache%202.0-blue.svg)](LICENSE)
+[![npm](https://img.shields.io/npm/v/dsh-mcp-panel)](https://www.npmjs.com/package/dsh-mcp-panel)
+[![downloads](https://img.shields.io/npm/dm/dsh-mcp-panel)](https://www.npmjs.com/package/dsh-mcp-panel)
+[![CI](https://github.com/PerryLink/dsh-mcp-panel/actions/workflows/ci.yml/badge.svg)](https://github.com/PerryLink/dsh-mcp-panel/actions/workflows/ci.yml)
 [![dsh-plugin](https://img.shields.io/badge/ecosystem-dsh--plugin-8b5cf6)](https://github.com/topics/dsh-plugin)
 [![deepseek-harness](https://img.shields.io/badge/runtime-deepseek--harness-4f46e5)](https://github.com/deepseek-ai/deepseek-harness)
 
@@ -13,14 +16,16 @@
 ## Compatibilidade
 
 - **Runtime**: DeepSeek Harness ≥ `0.1.0-rc.5` (as peerDependencies fixam a linha `0.1.0-rc.6`).
+- **Última versão**: v0.3.0 (2026-08-15) — porta completa em verde com a cadeia TypeScript 7 / Vitest 4 / jsdom 30, 109 testes.
 - **Última verificação**: 2026-08-14 contra um checkout do código-fonte do deepseek-harness (pacotes do workspace em `0.1.0-rc.5`, mainline `7b9644f`) — `/mcp` headless de ponta a ponta mais um perfil web ao vivo; evidências em [docs/research-notes.zh.md](docs/research-notes.zh.md). Reverificado no mesmo dia contra mainline `47f9438` com o ramo da costura `mcp/status` (`feat/mcp-client-status-observability-seam`): uma linha real de `server-everything` mostra `status: connected (source: upstream-event)` através do plugin empacotado, além do fluxo de compatibilidade fiel ao lançador; registro em [docs/optimization-plan-v2.zh.md](docs/optimization-plan-v2.zh.md).
 
 ## O que você ganha
 
 | Superfície | O que mostra |
 |---|---|
-| **Comando `/mcp`** | transporte, alvo, contagem de ferramentas, status de conexão, último erro, contador de reconexões — legível pelo modelo e reconstruível pelo log, bilíngue (`outputLanguage: en\|zh`) |
+| **Comando `/mcp`** | transporte, alvo, contagem de ferramentas, status de conexão, último erro, contador de reconexões — legível pelo modelo e reconstruível pelo log, cinco idiomas de saída (`outputLanguage: en\|zh\|es\|pt\|hi`) |
 | **Configurações → Plugins → aba MCP** | o mesmo snapshot somente leitura, com selos de status, listas expansíveis de ferramentas, erros sanitizados e resultados de sondas |
+| **De relance** | contagens de resumo acima dos cartões, um campo de busca de servidores e botões de expandir/recolher tudo |
 | **Botão de sonda do painel** | sonda de conectividade em um clique para um servidor streamable-http a partir da aba; os resultados continuam somente do painel |
 | **Sondas passivas** | selos de alcançabilidade opcionais em segundo plano por servidor, separados do status de conexão |
 | **Atualização automática** | o host sugere um intervalo de atualização (`refreshIntervalMs`); a aba consulta e pausa enquanto oculta |
@@ -30,7 +35,10 @@
 ## Início rápido
 
 ```sh
-dsh plugin --profile web add github:PerryLink/dsh-mcp-panel#v0.2.0
+# canal git (compila pelo script prepare do pacote)
+dsh plugin --profile web add github:PerryLink/dsh-mcp-panel#v0.3.0
+# canal npm (tarball publicado, sem aprovação de compilação)
+dsh plugin --profile web add dsh-mcp-panel@0.3.0
 ```
 
 Reinicie (ou deixe a superfície web recarregar seu `cordis.patch.yml`) e execute:
@@ -114,13 +122,17 @@ Encontrou um problema de segurança? Abra uma issue no GitHub **sem** colar segr
 
 ```sh
 pnpm install
-pnpm run typecheck
-pnpm test          # 96 testes: extremos do sanitizador, agrupamento, tolerância de agregação, saída do comando (5 idiomas), controle de sondas, fiação do cliente, apresentador
-pnpm run build     # declarações tsc → lib/types; tsdown → lib/index.js + lib/typert.host.js + lib/client.js
+pnpm run typecheck    # porta local: resolve as faces de tipo frescas do checkout do harness via caminhos tsconfig
+pnpm run typecheck:ci # porta npm: resolve as faces de tipo publicadas 0.1.0-rc.6 (o que o CI executa)
+pnpm test             # 109 testes: extremos do sanitizador, agrupamento, tolerância de agregação, saída do comando (5 idiomas), controle de sondas, fiação do cliente, apresentador (selos/resumo/filtro)
+pnpm run build        # declarações tsc → lib/types; tsdown → lib/index.js + lib/typert.host.js + lib/client.js
 pnpm run verify:self-contained
+pnpm run verify:artifacts
 pnpm pack
 ```
 
+Publicação: `node scripts/release.mjs <x.y.z>` sobe a versão, sela o CHANGELOG, reexecuta a porta, faz commit e cria a tag; ao empurrar a tag, npm e GitHub Release são publicados automaticamente (ver [CONTRIBUTING.md](CONTRIBUTING.md)).
+
 Verificação contra um checkout real do harness:
 `node --import tsx/esm scripts/verify-headless.mjs` inicializa o perfil web completo em processo (porta efêmera) e imprime a saída exata de `/mcp`, `/mcp <server> tools` e `/mcp <server> disable`.
 

package/README.zh.md

@@ -5,6 +5,9 @@
 [English](README.md) · [简体中文](README.zh.md) · [Español](README.es.md) · [Português](README.pt.md) · [हिन्दी](README.hi.md)
 
 [![License](https://img.shields.io/badge/license-Apache%202.0-blue.svg)](LICENSE)
+[![npm](https://img.shields.io/npm/v/dsh-mcp-panel)](https://www.npmjs.com/package/dsh-mcp-panel)
+[![downloads](https://img.shields.io/npm/dm/dsh-mcp-panel)](https://www.npmjs.com/package/dsh-mcp-panel)
+[![CI](https://github.com/PerryLink/dsh-mcp-panel/actions/workflows/ci.yml/badge.svg)](https://github.com/PerryLink/dsh-mcp-panel/actions/workflows/ci.yml)
 [![dsh-plugin](https://img.shields.io/badge/ecosystem-dsh--plugin-8b5cf6)](https://github.com/topics/dsh-plugin)
 [![deepseek-harness](https://img.shields.io/badge/runtime-deepseek--harness-4f46e5)](https://github.com/deepseek-ai/deepseek-harness)
 
@@ -13,14 +16,16 @@
 ## 兼容性
 
 - **运行时**：DeepSeek Harness ≥ `0.1.0-rc.5`（peerDependencies 固定 `0.1.0-rc.6` 包线）。
+- **最新版本**：v0.3.0（2026-08-15）——TypeScript 7 / Vitest 4 / jsdom 30 工具链下全门禁通过，109 个测试。
 - **最后验证**：2026-08-14，针对 deepseek-harness 源码 checkout（workspace 包 `0.1.0-rc.5`，mainline `7b9644f`）——headless `/mcp` 端到端 + 实时 web profile；证据见 [docs/research-notes.zh.md](docs/research-notes.zh.md)。同日对 mainline `47f9438` + `mcp/status` seam 分支（`feat/mcp-client-status-observability-seam`）复验：真实 `server-everything` 行经打包插件渲染 `status: connected (source: upstream-event)`，并跑通与启动器一致的全流程；记录见 [docs/optimization-plan-v2.zh.md](docs/optimization-plan-v2.zh.md)。
 
 ## 你能得到什么
 
 | 界面 | 展示内容 |
 |---|---|
-| **`/mcp` 命令** | transport、目标、工具数、连接状态、最近错误、重连计数——模型可读、可日志重建，支持双语（`outputLanguage: en\|zh`） |
+| **`/mcp` 命令** | transport、目标、工具数、连接状态、最近错误、重连计数——模型可读、可日志重建，支持五种输出语言（`outputLanguage: en\|zh\|es\|pt\|hi`） |
 | **设置 → 插件 → MCP 页签** | 同一快照的只读视图：状态徽标、可展开工具清单、脱敏错误、探测结果 |
+| **一览即得** | 卡片上方的统计汇总、服务器搜索框、全部展开/折叠按钮 |
 | **面板探测按钮** | 从页签对单个 streamable-http 服务器一键发起连通性探测；结果仍仅面板可见 |
 | **被动探测** | 可选的每服务器后台可达性徽标，与连接状态严格分离展示 |
 | **自动刷新** | 宿主建议刷新间隔（`refreshIntervalMs`）；页签轮询并在后台隐藏时暂停 |
@@ -30,7 +35,10 @@
 ## 快速上手
 
 ```sh
-dsh plugin --profile web add github:PerryLink/dsh-mcp-panel#v0.2.0
+# git 通道（经包的 prepare 脚本构建）
+dsh plugin --profile web add github:PerryLink/dsh-mcp-panel#v0.3.0
+# npm 通道（已发布产物，免构建放行）
+dsh plugin --profile web add dsh-mcp-panel@0.3.0
 ```
 
 重启（或让 web 面板热重载 `cordis.patch.yml`），然后：
@@ -114,13 +122,17 @@ MCP servers (1):
 
 ```sh
 pnpm install
-pnpm run typecheck
-pnpm test          # 96 个测试：脱敏极端用例、分组、聚合容错、命令输出（五语言）、探测门控、客户端接线、presenter
-pnpm run build     # tsc 声明 → lib/types；tsdown → lib/index.js + lib/typert.host.js + lib/client.js
+pnpm run typecheck    # 本地门禁：经 tsconfig paths 解析 harness checkout 的最新类型面
+pnpm run typecheck:ci # npm 门禁：解析已发布的 0.1.0-rc.6 类型面（CI 实际执行）
+pnpm test             # 109 个测试：脱敏极端用例、分组、聚合容错、命令输出（五语言）、探测门控、客户端接线、presenter（徽标/汇总/过滤）
+pnpm run build        # tsc 声明 → lib/types；tsdown → lib/index.js + lib/typert.host.js + lib/client.js
 pnpm run verify:self-contained
+pnpm run verify:artifacts
 pnpm pack
 ```
 
+发布：`node scripts/release.mjs <x.y.z>` 会改版本号、盖章 CHANGELOG、重跑门禁并提交打 tag；推送 tag 后自动发布 npm 与 GitHub Release（见 [CONTRIBUTING.md](CONTRIBUTING.md)）。
+
 对真实 harness checkout 的验证：
 `node --import tsx/esm scripts/verify-headless.mjs` 在进程内启动完整 web profile（临时端口），打印真实的 `/mcp`、`/mcp <server> tools`、`/mcp <server> disable` 输出。
 

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,11 @@
+# Third-party notices
+
+This distribution bundles the following third-party software:
+
+## zod
+
+- License: MIT
+- Copyright: Colin McDonnell and contributors
+- Homepage: https://github.com/colinhacks/zod
+- Bundled into `lib/typert.host.js` (host face) and `lib/client.js` (browser face)
+  as the runtime behind the hand-written Typert wire schemas. No source is modified.