dsh-mini-utility-dock 0.5.1 → 0.7.0

package/dist/launcher.js

@@ -1,18 +1,20 @@
-// Family utility launcher shared by the browser halves of the DSH plugins.
+// The shared launcher assembly: one icon plus the menu of panels it opens, for a
+// plugin's browser half.
 //
 // This fragment has ONE source of truth: dsh-mini-utility-dock/dist/launcher.js.
 // DSH client artifacts are self-contained classic scripts, so the fragment is
 // embedded into lib/client.js at build time by
 //   npm run launcher:sync    (write it)
 //   npm run launcher:check   (fail on drift)
-// instead of being imported: a bare import would put a runtime dependency on the
-// dock into every plugin, and the whole point of the dock is that a plugin ships
+// instead of being imported: a bare import would put a runtime dependency on
+// this package into the bundle that embeds it, and an embedding plugin ships
 // standalone, with nothing else required.
 //
-// The launcher is one icon that opens a menu of family panels. It is contributed
+// The launcher is one icon that opens a menu of utility panels. It is contributed
 // through slots, not through a page-local protocol: exactly one copy of this
-// assembly runs per page (the first plugin to load wins the window mutex and
-// declares the menu seat), and every plugin adds one row to that seat.
+// assembly runs per page — the first to load wins the window mutex, registers the
+// launcher, and declares the menu seat — while the other copies register nothing
+// here and only wait to take the claim over once their owner is disposed.
 const UTILITY_ITEM_SLOT = 'createhelper.utility.item'
 const UTILITY_MUTEX_KEY = '__CREATEHELPER_DSH_UTILITY_LAUNCHER_V1__'
 const UTILITY_CSS_ID = 'createhelper-utility-launcher'
@@ -21,7 +23,7 @@ const UTILITY_MEASURE_TRIES = 120
 const UTILITY_ICON = '<svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><rect x="3" y="3" width="7" height="7" rx="2"></rect><rect x="14" y="3" width="7" height="7" rx="2"></rect><rect x="3" y="14" width="7" height="7" rx="2"></rect><rect x="14" y="14" width="7" height="7" rx="2"></rect></svg>'
 
 // The launcher's own chrome, injected once by whichever copy wins the mutex.
-// The rows belong to other plugins, so the menu styles its own buttons by
+// The rows are other plugins' components, so the menu styles its buttons by
 // position instead of asking every contributor for a class name.
 function ensureUtilityStyles() {
   if (typeof document === 'undefined') return
@@ -41,8 +43,9 @@ function ensureUtilityStyles() {
   document.head.appendChild(styleEl)
 }
 
-// The position rule the retired page dock used: right of the sidebar, 16px
-// in, and 80px when the shell has not laid the column out yet.
+// The launcher tracks the shell's sidebar column rather than a fixed offset: its
+// left edge sits 16px right of the sidebar's edge, and 80px while the shell has
+// not laid that column out yet.
 const measureUtilityLeft = () => {
   if (typeof document === 'undefined') return UTILITY_FALLBACK_LEFT_PX
   const overlay = document.querySelector('[data-shell-overlay]')
@@ -105,7 +108,7 @@ const useUtilityMenu = () => {
 // The launcher and its menu. The menu is always rendered - a declared child
 // slot is not conditionally declared - and hidden when closed. Choosing a row
 // closes the menu through the click that bubbles out of it, because the rows
-// are other plugins' components.
+// belong to other plugins, not to this block.
 function UtilityLauncher (props) {
   const left = useUtilityLeft()
   const open = useUtilityMenu()
@@ -156,11 +159,11 @@ function UtilityLauncher (props) {
 // into it directly throws while that declaration is still pending, and a
 // launcher must never cost the caller the surfaces it registers afterwards.
 //
-// The claim lives on the page and is released with its owner. Every family
-// client half carries this assembly, so without the release a hot reload of the
-// owner would dispose its registration while the claim stayed taken, and the
-// launcher would stay missing until the page was reloaded. A released claim
-// wakes the other copies, which re-register immediately.
+// The claim lives on the page and is released with its owner. Any plugin that
+// embeds this block may win the claim, so without the release a hot reload of
+// the owner would dispose its registration while the claim stayed taken, and the
+// launcher would stay missing until the page was reloaded. A released claim wakes
+// the other copies on the page, which re-register immediately.
 const utilityClaim = () => {
   if (typeof window === 'undefined') return null
   const existing = window[UTILITY_MUTEX_KEY]
@@ -199,7 +202,7 @@ const registerUtilityLauncher = (scope) => {
     } catch (error) {
       release()
       if (typeof console !== 'undefined' && typeof console.error === 'function') {
-        console.error('[utility-launcher] could not register the family launcher', error)
+        console.error('[utility-launcher] could not register the launcher', error)
       }
     }
   })

package/dist/loopback.js

@@ -1,28 +1,25 @@
-// Loopback predicates shared by the host halves of the DSH plugins.
+// The loopback predicates: which Host names and which peer addresses count as
+// loopback, for a plugin's host half that binds an API to the loopback interface.
 //
 // This fragment has ONE source of truth: dsh-mini-utility-dock/dist/loopback.js.
-// DSH plugin host halves are plain Node ESM that each package ships standalone,
-// so the fragment is embedded into `lib/shared.js` at build time by
+// A host half is plain Node ESM that its package ships standalone, so the
+// fragment is embedded into `lib/shared.js` at build time by
 //   npm run loopback:sync    (write it)
 //   npm run loopback:check   (fail on drift)
 // instead of being imported: a bare `import 'dsh-mini-utility-dock/...'` would
-// put a runtime dependency on the dock into every plugin, and the whole point of
-// the dock is that a plugin ships standalone, with nothing else required.
-//
-// Why it is shared at all: these predicates were copy-pasted per repo and
-// drifted twice. The first drift rejected IPv6 loopback everywhere; the second
-// is that consumers disagreed on which Host spellings count as loopback
-// (see the parity bin this package ships, which compares this block across repositories).
+// put a runtime dependency on this package into the file that embeds it, and an
+// embedding plugin ships standalone, with nothing else required.
 //
 // "Loopback" is decided in exactly one place — LOOPBACK_HOSTNAMES plus the
 // IPv4-mapped IPv6 form of each entry — and both the name and the address
-// predicate route through it, so the Host path and the peer path cannot drift
-// apart again.
+// predicate route through it, so the Host path and the peer path cannot
+// disagree. Every spelling this file accepts is a documented one; anything
+// unrecognised fails closed.
 //
 // Kept a separate fragment from the host guard on purpose: the predicates are
 // stable facts about what an address is, while the guard is a policy about who
-// may call an API. `dist/guard.js` imports this module, so the guard depends on
-// this block and never the other way round.
+// may call an API. The guard block reads the names this block declares, so it
+// depends on this block and never the other way round.
 
 // Hostnames a request to a loopback-bound API may legitimately arrive with.
 // Exact spellings only: `api.localhost` and `127.0.0.1.evil.example` must stay

package/docs/CHANGELOG.en.md

@@ -0,0 +1,91 @@
+# Changelog
+
+Release notes are generated from the matching version section; newest first.
+For Chinese, see [CHANGELOG.md](CHANGELOG.md).
+
+## 0.7.0 - 2026-09-29
+
+### Changed
+
+- `dsh-plugin-docs` names no document. Which pairs to check, their paths and the shape each is compared with come from a `--config <module>` the calling repository supplies, exporting an array of `{ name, zh, en, shape? }`. `shape` defaults to `markdown` (heading-level sequence and code-fence languages); `changelog` compares releases, sections and per-section item counts. A document absent from that configuration is not compared, so a caller's `docs:check` passes `--config`.
+- This package's `CHANGELOG.md`, `CHANGELOG.en.md` and `RELEASING.md` move into `docs/`; the repository root keeps the two READMEs, `LICENSE` and `AGENTS.md`. The npm package ships the changelogs at their new paths.
+
+## 0.6.0 - 2026-09-28
+
+- New `dist/host-http.js` (marker `dsh-host-http`): the host half's reply glue becomes one block — `sendJson` (always `no-store`), the POST gate, the browser authorizer, `optionalSessionId` — so a reply policy has one definition. An already published vocabulary (`need_post`, Chinese wording, the echoed `action`) is a `policy` override, so no public identifier changes.
+- `createBrowserAuthorizer` takes accessors, not values: a service reload reassigns a host half's Connection to `null` and later to a new instance, and the value-shaped version would keep handing requests to a destroyed Connection.
+- The comments that ride verbatim into a consumer's repository with the launcher and host-http fragments now state the facts: no sentence misdescribes what the other copies do, and host-http's analogy to a guard-block name says where that name comes from.
+- `dsh-mini-utility-dock`'s `sync`/`check` reject a file whose marker ranges overlap (`<A> <B> </A> </B>`) and leave it unwritten, closing off the corruption the bottom-up splice could previously produce.
+- `dsh-plugin-parity` compares the `dsh-host-http` block byte for byte, and its block-position assertion now covers all three host blocks.
+- The parity bin's "private implementation outside the blocks" scan matches code shapes only: both the bracketed and the destructured Fetch Metadata read count, `LOOPBACK_HOSTNAMES` is caught on assignment but not comparison, and a composite heuristic that could false-FAIL a reasonable repository is gone — so a comment that explains why a helper is not a second guard no longer reads as drift.
+- The parity bin's block comparison strips each block's common indentation, so a consumer that indents its markers by 4 spaces or a tab is no longer reported as drift; `--fleet` naming a repository that is not a member now fails with a non-zero exit instead of the "skipped" line reading as a pass.
+- `dsh-plugin-docs --base` no longer dies inside `git diff` on an all-zero SHA — which is what `github.event.before` carries for a new or force-pushed branch; it notes that there is no previous state and still completes the structural checks.
+- `dsh-plugin-docs` now compares the `Unreleased` section for version, section and item structure — it is the most-edited section each round and was previously outside the check.
+- Tests filled in: process-level behavior for the two diagnostic bins, decision-level behavior for `dist/loopback.js`, `dist/guard.js` and the new fragment, and one `FRAGMENTS` integrity assertion, with a paired case for each behavior change above.
+- Maintenance: CI installs with `npm ci --ignore-scripts` and caches npm, both workflows run `docs:check`, syntax checks cover `bin` and `dist`, `publish.yml` gates on the tag being an ancestor of `main`, and `homepage`, `bugs` and `author` are filled in. Being dependency-free, this package now tracks `package-lock.json` so `npm ci` and the cache have one (reason in `.gitignore`).
+
+## 0.5.1 - 2026-09-25
+
+- Fix the launcher disappearing after a hot reload: the claim is released with its owner, which wakes the other copies to register again instead of requiring a full page reload.
+
+## 0.5.0 - 2026-09-24
+
+- New `dist/launcher.js` (marker `dsh-utility-launcher`): one icon at the bottom-left that opens a menu of utility panels, assembled through the host's slots rather than a page-local protocol. Exactly one copy runs per page (the first to load wins a `window` mutex and declares the menu seat `createhelper.utility.item`) and every other copy adds one row to it; consumers maintain it with `launcher:sync` / `launcher:check`.
+
+## 0.4.0 - 2026-09-24
+
+- Remove `dist/bootstrap.js` (the page-local dock bootstrap fragment) and its `FRAGMENTS` row: it appended a self-measuring `position:fixed` container to every consumer's `document.body`, so it necessarily floated above the page and covered the composer's own controls. Consumers now register the host's `sidebar.footer.action` seat, embed no fragment in `lib/client.js`, and have dropped `dock:sync` / `dock:check`.
+- The two host-side fragments (loopback predicates, host guard) are unchanged, so consumers stay pinned to `0.3.0` and `loopback:check` / `guard:check` keep comparing against that version.
+
+## 0.3.0 - 2026-09-22
+
+- New `dsh-plugin-docs`: a bilingual docs structure check, adopted from the `check-docs.mjs` copy each plugin repository carried. Same interface: no arguments checks the README and CHANGELOG pairs for structural alignment, `--base <revision>` requires bilingual pairs to change together. This package's own bilingual docs are now checked by it too.
+- README gains badges and a positioning statement; the two diagnostic bins (`dsh-plugin-parity`, `dsh-plugin-docs`) are documented with their purpose and opt-in mechanism; the package description states the "family shared assets" scope.
+
+## 0.2.0 - 2026-09-21
+
+- New `dsh-plugin-parity`: a cross-repository drift check, adopted from the copy each plugin repository carried. The member list is caller-supplied via `--member <repo>:<export>`; this package names no repository of its own. Without `--member` it runs the static checks only and discovers every repository that embeds the host-guard block.
+- The copy in each plugin repository is gone with it; the bilingual-structure half of `docs:check` stays with the repositories.
+
+## 0.1.8 - 2026-09-21
+
+- The two host-side fragments drop "sibling" and state the design goal directly: a plugin ships standalone, with nothing else required.
+
+## 0.1.7 - 2026-09-20
+
+- The two host-side fragments no longer state how many consumers exist ("all three plugins", "the three disagree", "diverged three times" give way to wording that names no count): a fragment is embedded verbatim into a consumer's repository, where no reader can check that count.
+
+## 0.1.6 - 2026-09-20
+
+- Fix the `allowRemoteHost` note in `dist/guard.js`: it read "stop being admitted", the opposite of what the code does — that mode skips both checks, so it admits them.
+
+## 0.1.5 - 2026-09-17
+
+- Documentation maintenance: README and CHANGELOG cleanup. Fragments and command behavior are unchanged, so consumer pins need no update.
+
+## 0.1.4 - 2026-09-16
+
+- Add a cross-repo consistency section to the READMEs, separating two different properties: **local** -- a consumer's `npm test` runs `loopback:check` / `guard:check` to compare both fragments byte-for-byte against the version of this package it pins, covering both "edited a block by hand" and "forgot to re-`sync`"; and **cross-repo** -- this package's published versions are immutable and consumers pin an exact version, so "all three pin the same version" already implies "all three hold byte-identical blocks".
+- That section also records that a consumer's `scripts/guard-parity.mjs` is a **manual diagnostic, not a CI gate**, because the property it asserts cannot hold while a peer checkout resolves to a different branch, which would make it report false failures.
+- The LICENSE copyright holder is now `xswt442-cmd`.
+
+## 0.1.3 - 2026-09-14
+
+- Add two host-side fragments. `dist/loopback.js` (`dsh-loopback-helpers`) exports `LOOPBACK_HOSTNAMES`, `normalizeHostValue`, `hostHostname`, `isLoopbackName` and `isLoopbackAddress`. `dist/guard.js` (`dsh-host-guard`) exports `portOf`, `GUARD_REASONS`, `DEFAULT_GUARD_POLICY` and an internal `bindGuard()` factory; a consumer passes its own error codes and wording as `policy`, so the enforcement does not fork per plugin.
+- `sync` / `check` now maintain **every** marked fragment in the target file, applied bottom-up in `FRAGMENTS` order, instead of requiring exactly one block. Single-block callers are unaffected.
+- Correct the READMEs and the package description: each host-side fragment's responsibility, the fixed order, and why `bindGuard` is not exported.
+- Add tests for multi-block sync and idempotent `check`, block order, the absence of `import`/`require` in either fragment, and `bindGuard` staying private with no duplicated predicates.
+
+## 0.1.2 - 2026-09-06
+
+- Fix the README `npm run dock:embed` examples: add the previously missing `dock:embed` script to `package.json` and switch the usage to `npm run dock:embed -- check|sync path/to/client.js` (npm argument passing needs the `--` separator, and the CLI takes `sync|check` subcommands, not `--check`). A new smoke test extracts the documented commands from both READMEs and runs them, preventing docs/script drift.
+
+## 0.1.1 - 2026-09-04
+
+- Normalize `label` in `register()`: a missing, blank, or non-string label falls back to `id`, so no item renders `aria-label="undefined"`.
+
+## 0.1.0
+
+- Add the Mini Utility Dock protocol v1 bootstrap.
+- Add `sync` and `check` commands for self-contained DSH client bundles.
+- Validate icons, registration ownership, placement, and load-order behavior.

package/docs/CHANGELOG.md

@@ -0,0 +1,91 @@
+# 更新日志
+
+Release Notes 由对应版本段生成；最新版本在前。
+英文版见 [CHANGELOG.en.md](CHANGELOG.en.md)。
+
+## 0.7.0 - 2026-09-29
+
+### 变更
+
+- `dsh-plugin-docs` 不再预设文档名。检查哪些文档对、各自的路径与比较形状由调用仓的 `--config <module>` 提供，该模块导出 `{ name, zh, en, shape? }` 数组；`shape` 缺省为 `markdown`（比标题层级序列与代码围栏语言），`changelog` 比版本段、分类段与小节条目数。未在配置中声明的文档不参与比较，因此调用方的 `docs:check` 需要带上 `--config`。
+- 本包的 `CHANGELOG.md`、`CHANGELOG.en.md`、`RELEASING.md` 移入 `docs/`，仓库根目录只留两份 README、`LICENSE` 与 `AGENTS.md`；npm 包内的两份 CHANGELOG 随新路径发布。
+
+## 0.6.0 - 2026-09-28
+
+- 新增 `dist/host-http.js`（标记 `dsh-host-http`）：宿主半的响应胶水收成一块——`sendJson`（一律带 `no-store`）、POST 门、浏览器授权器、`optionalSessionId`，回复策略自此只有一份定义。已发布的词汇（`need_post`、中文文案、回带 `action`）由 `policy` 覆盖，公开标识符不变。
+- `createBrowserAuthorizer` 收访问器而非值：宿主半的 Connection 会被服务重载置空再赋新值，捕获值的那一版会一直把请求交给一个已销毁的 Connection。
+- launcher 与 host-http 片段随片段逐字进入消费者的注释改为直陈事实：不再有误述其余副本行为的句子，host-http 把引用守卫块名字的类比写明其来源。
+- `dsh-mini-utility-dock` 的 `sync`/`check` 遇到标记区间交叠（`<A> <B> </A> </B>`）的文件直接拒绝且不写出，杜绝此前可能产生的损坏。
+- `dsh-plugin-parity` 把 `dsh-host-http` 块纳入逐块比对，块落点顺序的断言同时覆盖三个 host 块。
+- `dsh-plugin-parity` 的「块外私有实现」扫描只匹配代码形状：Fetch Metadata 的方括号取头与解构取头都算、`LOOPBACK_HOSTNAMES` 只认赋值不认比较，并删去会误伤合理仓库的复合启发式，讲清了理由的注释与散文不再被误判成漂移。
+- `dsh-plugin-parity` 的逐块比对改为剥离块的公共缩进，按 4 空格或 Tab 缩进标记的消费者不再被误判为漂移；`--fleet` 点名不在成员表中的仓即判 FAIL 并非零退出，不再把「未测」报成「跳过」。
+- `dsh-plugin-docs --base` 收到全 0 SHA（新建分支或强推时 `github.event.before` 的值）不再崩在 `git diff`，改为按「无可比前态」给提示并跑完结构校验。
+- `dsh-plugin-docs` 把 `Unreleased` 段纳入版本段/分类段/条目数比较——它是每轮改动最多的段落，此前完全不在检查范围内。
+- 补齐测试：两个诊断 bin 的进程级行为、`dist/loopback.js` / `dist/guard.js` 与新片段的判定行为、一条 `FRAGMENTS` 完整性断言，并为上述行为各补对照用例。
+- 维护：CI 改 `npm ci --ignore-scripts` 并启用缓存、两处都跑 `docs:check`，语法检查覆盖 `bin` 与 `dist`，`publish.yml` 加「tag 必须是 `main` 的祖先」闸门，补齐 `homepage`、`bugs`、`author`；本包零依赖，故开始跟踪 `package-lock.json` 以满足 `npm ci` 与缓存（理由见 `.gitignore`）。
+
+## 0.5.1 - 2026-09-25
+
+- 修复 launcher 热重载后消失：归属从一次性闩锁改为可释放的认领，owner 被销毁时唤醒其余副本重新注册，不再需要刷新整页。
+
+## 0.5.0 - 2026-09-24
+
+- 新增 `dist/launcher.js`（标记 `dsh-utility-launcher`）：左下角一个图标，点开一个列出各插件面板的菜单，走宿主的槽位而不是页面级协议。每页只有一份装配（先加载的一方赢得 `window` 互斥并声明菜单座位 `createhelper.utility.item`），其余副本各往那个座位投一行；消费方用 `launcher:sync` / `launcher:check` 维护。
+
+## 0.4.0 - 2026-09-24
+
+- 移除 `dist/bootstrap.js`（页面级 dock 引导片段）与其 `FRAGMENTS` 条目：它给每个消费插件在 `document.body` 上挂一个自量位置的 `position:fixed` 容器，必然浮在页面之上、压住 composer 自己的控件。消费方改为注册宿主的 `sidebar.footer.action` 座位，`lib/client.js` 不再嵌片段，各仓的 `dock:sync` / `dock:check` 随之删除。
+- 两个 host 侧片段（loopback 判定、host 守卫）字节未变，消费方仍可 pin `0.3.0`，`loopback:check` / `guard:check` 继续按该版本比对。
+
+## 0.3.0 - 2026-09-22
+
+- 新增 `dsh-plugin-docs`：双语文档结构校验，收编自插件仓里各自维护的 `check-docs.mjs`。接口不变：无参数查 README 与 CHANGELOG 的中英结构对齐，`--base <revision>` 检查双语对同改。本包自身的双语文档也由此接入校验。
+- README 补上 badges 与包定位说明；两个诊断 bin（`dsh-plugin-parity`、`dsh-plugin-docs`）的用途与接入方式补进文档；包描述同步「族级共享资产」的定位。
+
+## 0.2.0 - 2026-09-21
+
+- 新增 `dsh-plugin-parity`：跨仓漂移诊断，收编自插件仓里各自维护的那份脚本。成员表由调用方通过 `--member <repo>:<export>` 提供，本包不点名任何仓；不带 `--member` 时只跑静态检查，自动发现所有嵌入了宿主守卫块的仓。
+- 插件仓里的该脚本由此删除；`docs:check` 的双语结构校验仍归各仓。
+
+## 0.1.8 - 2026-09-21
+
+- 两个 host 侧片段的注释去掉 `sibling`，改为直接陈述设计目标：插件独立发布，不依赖同级安装。
+
+## 0.1.7 - 2026-09-20
+
+- 两个 host 侧片段的注释不再声明消费方数量（「all three plugins」「diverged three times」等改为不指名、不计数的说法）：片段逐字嵌入消费者的仓库，那里的读者无从得知有几个消费方。
+
+## 0.1.6 - 2026-09-20
+
+- 修正 `dist/guard.js` 里 `allowRemoteHost` 的行内注释：原文写作「不再被放行」，与代码相反——该模式是跳过这两项检查，即放行。
+
+## 0.1.5 - 2026-09-17
+
+- 文档维护：README 与 CHANGELOG 的整理，片段与命令行为不变，故无需改动消费仓的 pin。
+
+## 0.1.4 - 2026-09-16
+
+- README 新增「跨仓一致性」一节：本地由消费仓 `npm test` 的 `loopback:check` / `guard:check` 逐字节比对，跨仓由消费仓 pin 精确版本保证。
+- 该节记录 `scripts/guard-parity.mjs` 是人工诊断工具而非 CI 门禁。
+- LICENSE 版权署名统一为 `xswt442-cmd`。
+
+## 0.1.3 - 2026-09-14
+
+- 新增两个 host 侧片段：`dist/loopback.js`（`dsh-loopback-helpers`）导出回环判定谓词；`dist/guard.js`（`dsh-host-guard`）导出 `portOf`、`GUARD_REASONS`、`DEFAULT_GUARD_POLICY` 与内部的 `bindGuard()` 工厂，调用方以 `policy` 传入自己的错误码与文案。
+- `sync` / `check` 处理目标文件中所有已标记的片段，按 `FRAGMENTS` 顺序自下而上应用。
+- 修正 README 与包描述：说明两个 host 侧片段的职责、固定顺序与 `bindGuard` 不导出的原因。
+- 新增测试：多块同步与幂等 `check`、块顺序、片段不引入 `import`/`require`、判据不被重复声明。
+
+## 0.1.2 - 2026-09-06
+
+- 修正 README 的 `npm run dock:embed` 示例：补上 `package.json` 缺失的 `dock:embed` 脚本，用法改为 `npm run dock:embed -- check|sync path/to/client.js`（npm 传参需要 `--` 分隔符，CLI 接受 `sync|check` 子命令而非 `--check`）。新增从双语 README 提取命令逐条执行的 smoke test，防止文档与脚本漂移。
+
+## 0.1.1 - 2026-09-04
+
+- 归一化 `register()` 的 `label`：缺省、空白或非字符串的 `label` 回退为 `id`，避免渲染出 `aria-label="undefined"`。
+
+## 0.1.0
+
+- Add the Mini Utility Dock protocol v1 bootstrap.
+- Add `sync` and `check` commands for self-contained DSH client bundles.
+- Validate icons, registration ownership, placement, and load-order behavior.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-mini-utility-dock",
-  "version": "0.5.1",
-  "description": "The DSH plugin family's shared assets: source fragments (the loopback predicates and host request guard for host halves, the utility launcher for client halves), the embedding CLI, and the family diagnostics — cross-repo drift check and bilingual docs structure check.",
+  "version": "0.7.0",
+  "description": "The DSH plugin family's shared assets: source fragments (the loopback predicates, host request guard and host HTTP glue for host halves, the utility launcher for client halves), the embedding CLI, and the family diagnostics — cross-repo drift check and bilingual docs structure check.",
   "type": "module",
   "bin": {
     "dsh-mini-utility-dock": "bin/dsh-mini-utility-dock.js",
@@ -14,12 +14,12 @@
     "README.md",
     "README.en.md",
     "LICENSE",
-    "CHANGELOG.md",
-    "CHANGELOG.en.md"
+    "docs/CHANGELOG.md",
+    "docs/CHANGELOG.en.md"
   ],
   "scripts": {
     "dock:embed": "node bin/dsh-mini-utility-dock.js",
-    "docs:check": "node bin/dsh-plugin-docs.js",
+    "docs:check": "node bin/dsh-plugin-docs.js --config docs.config.mjs",
     "test": "node --test test/*.test.js"
   },
   "engines": {
@@ -29,6 +29,11 @@
     "type": "git",
     "url": "git+https://github.com/xswt442-cmd/dsh-mini-utility-dock.git"
   },
+  "homepage": "https://github.com/xswt442-cmd/dsh-mini-utility-dock#readme",
+  "bugs": {
+    "url": "https://github.com/xswt442-cmd/dsh-mini-utility-dock/issues"
+  },
+  "author": "xswt442-cmd",
   "keywords": [
     "dsh",
     "deepseek-harness",

package/CHANGELOG.en.md

@@ -1,73 +0,0 @@
-# Changelog
-
-Release notes are generated from the matching version section; newest first.
-For Chinese, see [CHANGELOG.md](CHANGELOG.md).
-
-## 0.5.1 - 2026-09-25
-
-- Fix the launcher disappearing after a hot reload: the claim is released with its owner, which wakes the other copies to register again instead of requiring a full page reload.
-
-## 0.5.0 - 2026-09-24
-
-- New `dist/launcher.js` (marker `dsh-utility-launcher`): the family's shared entry point — one icon at the bottom-left that opens a menu of the family's panels. It goes through slots rather than a page-local protocol: one copy of the assembly runs per page (the first plugin to load wins the `window` mutex and declares the menu seat `createhelper.utility.item`), and every other plugin contributes one row to that seat. Consumers maintain it with `launcher:sync` / `launcher:check`, so the three client halves no longer each carry their own copy.
-
-## 0.4.0 - 2026-09-24
-
-- Remove `dist/bootstrap.js` (the dock bootstrap fragment) and its `FRAGMENTS` row. It made every consumer append a `position:fixed; z-index:9997` container to `document.body` and locate it by measuring the sidebar — so it necessarily floated above the page and covered the composer's own controls. The three consumers now register the host's `sidebar.footer.action` seat instead (an icon button directly above Settings), embed no fragment in `lib/client.js` at all, and drop their `dock:sync` / `dock:check` scripts.
-- Consumers stay pinned to `0.3.0`: the two remaining fragments (loopback predicates, host guard) are unchanged, so `loopback:check` / `guard:check` keep comparing against that version byte for byte.
-
-## 0.3.0 - 2026-09-22
-
-- New `dsh-plugin-docs`: a bilingual docs structure check, adopted from the `check-docs.mjs` copy each plugin repository carried. Same interface: no arguments checks the README and CHANGELOG pairs for structural alignment, `--base <revision>` requires bilingual pairs to change together. This package's own bilingual docs are now checked by it too.
-- README gains badges and a positioning statement; the two diagnostic bins (`dsh-plugin-parity`, `dsh-plugin-docs`) are documented with their purpose and opt-in mechanism; the package description states the "family shared assets" scope.
-
-## 0.2.0 - 2026-09-21
-
-- New `dsh-plugin-parity`: a cross-repository drift check, adopted from the copy each plugin repository carried. The member list is caller-supplied via `--member <repo>:<export>`; this package names no repository of its own. Without `--member` it runs the static checks only and discovers every repository that embeds the host-guard block.
-- The copy in each plugin repository is gone with it; the bilingual-structure half of `docs:check` stays with the repositories.
-
-## 0.1.8 - 2026-09-21
-
-- The two host-side fragments no longer say "sibling": the three phrasings now state the design goal itself — a plugin ships standalone, with nothing else required. A fragment is embedded verbatim into each consumer, where the word had no referent.
-- The fragments' bytes change, so consumers must re-run `loopback:sync` / `guard:sync` and raise their pin to 0.1.8.
-
-## 0.1.7 - 2026-09-20
-
-- The two host-side fragments no longer state how many consumers exist: "all three plugins", "the three disagree" and "the three plugins / diverged three times" give way to wording that names no count. A fragment is embedded verbatim into each consumer, where the reader cannot know how many other consumers there are — the count is workspace knowledge, not that repository's.
-- The fragments' bytes change, so consumers must re-run `loopback:sync` / `guard:sync` and raise their pin to 0.1.7.
-
-## 0.1.6 - 2026-09-20
-
-- Fix the `allowRemoteHost` note in `dist/guard.js`: it read "stop being admitted", the opposite of what the code does — that mode skips both checks, so it admits them. The JSDoc was already right; only this inline comment was inverted.
-- The fragment's bytes change, so consumers must re-run `guard:sync` and raise their pin to 0.1.6.
-
-## 0.1.5 - 2026-09-17
-
-- Documentation maintenance: README and CHANGELOG cleanup. Fragments and command behavior are unchanged, so consumer pins need no update.
-
-## 0.1.4 - 2026-09-16
-
-- Add a cross-repo consistency section to the READMEs, separating two different properties: **local** -- a consumer's `npm test` runs `loopback:check` / `guard:check` to compare both fragments byte-for-byte against the version of this package it pins, covering both "edited a block by hand" and "forgot to re-`sync`"; and **cross-repo** -- this package's published versions are immutable and consumers pin an exact version, so "all three pin the same version" already implies "all three hold byte-identical blocks".
-- That section also records that a consumer's `scripts/guard-parity.mjs` is a **manual diagnostic, not a CI gate**, because the property it asserts cannot hold while a peer checkout resolves to a different branch, which would make it report false failures.
-- The LICENSE copyright holder is now `xswt442-cmd`.
-
-## 0.1.3 - 2026-09-14
-
-- Add two host-side fragments. `dist/loopback.js` (`dsh-loopback-helpers`) exports `LOOPBACK_HOSTNAMES`, `normalizeHostValue`, `hostHostname`, `isLoopbackName` and `isLoopbackAddress`. `dist/guard.js` (`dsh-host-guard`) exports `portOf`, `GUARD_REASONS`, `DEFAULT_GUARD_POLICY` and an internal `bindGuard()` factory; a consumer passes its own error codes and wording as `policy`, so the enforcement does not fork per plugin.
-- `sync` / `check` now maintain **every** marked fragment in the target file, applied bottom-up in `FRAGMENTS` order, instead of requiring exactly one block. Single-block callers are unaffected.
-- Correct the READMEs and the package description: each host-side fragment's responsibility, the fixed order, and why `bindGuard` is not exported.
-- Add tests for multi-block sync and idempotent `check`, block order, the absence of `import`/`require` in either fragment, and `bindGuard` staying private with no duplicated predicates.
-
-## 0.1.2 - 2026-09-06
-
-- Fix the README `npm run dock:embed` examples: add the previously missing `dock:embed` script to `package.json` and switch the usage to `npm run dock:embed -- check|sync path/to/client.js` (npm argument passing needs the `--` separator, and the CLI takes `sync|check` subcommands, not `--check`). A new smoke test extracts the documented commands from both READMEs and runs them, preventing docs/script drift.
-
-## 0.1.1 - 2026-09-04
-
-- Normalize `label` in `register()`: a missing, blank, or non-string label falls back to `id`, so no item renders `aria-label="undefined"`.
-
-## 0.1.0
-
-- Add the Mini Utility Dock protocol v1 bootstrap.
-- Add `sync` and `check` commands for self-contained DSH client bundles.
-- Validate icons, registration ownership, placement, and load-order behavior.

package/CHANGELOG.md

@@ -1,73 +0,0 @@
-# 更新日志
-
-Release Notes 由对应版本段生成；最新版本在前。
-英文版见 [CHANGELOG.en.md](CHANGELOG.en.md)。
-
-## 0.5.1 - 2026-09-25
-
-- 修复 launcher 热重载后消失：归属从一次性闩锁改为可释放的认领，owner 被销毁时唤醒其余副本重新注册，不再需要刷新整页。
-
-## 0.5.0 - 2026-09-24
-
-- 新增 `dist/launcher.js`（片段标记 `dsh-utility-launcher`）：族的共享入口——左下角一个图标，点开一个列出各插件面板的菜单。它走槽位而不是页面级协议：每页只有一份装配（先加载的插件赢得 `window` 互斥并声明菜单座位 `createhelper.utility.item`），其余插件各往那个座位投一行。消费插件用 `launcher:sync` / `launcher:check` 维护，三个 client 半从此不再各写一份。
-
-## 0.4.0 - 2026-09-24
-
-- 移除 `dist/bootstrap.js`（dock 引导片段）与对应的 `FRAGMENTS` 条目。它让每个消费插件在 `document.body` 上挂一个 `position:fixed; z-index:9997` 的容器，位置靠自己量侧边栏算出来——于是它必然悬在页面上方，会压住 composer 自己的控件。三个消费插件已改为注册宿主槽位 `sidebar.footer.action`（图标按钮，就在设置上方），`lib/client.js` 不再嵌任何片段，各仓的 `dock:sync` / `dock:check` 随之删除。
-- 消费仓仍 pin `0.3.0`：本仓剩下两个片段（loopback 判定、host 守卫）未变，`loopback:check` / `guard:check` 继续按该版本逐字节比对。
-
-## 0.3.0 - 2026-09-22
-
-- 新增 `dsh-plugin-docs`：双语文档结构校验，收编自插件仓里各自维护的 `check-docs.mjs`。接口不变：无参数查 README 与 CHANGELOG 的中英结构对齐，`--base <revision>` 检查双语对同改。本包自身的双语文档也由此接入校验。
-- README 补上 badges 与包定位说明；两个诊断 bin（`dsh-plugin-parity`、`dsh-plugin-docs`）的用途与接入方式补进文档；包描述同步「族级共享资产」的定位。
-
-## 0.2.0 - 2026-09-21
-
-- 新增 `dsh-plugin-parity`：跨仓漂移诊断，收编自插件仓里各自维护的那份脚本。成员表由调用方通过 `--member <repo>:<export>` 提供，本包不点名任何仓；不带 `--member` 时只跑静态检查，自动发现所有嵌入了宿主守卫块的仓。
-- 插件仓里的该脚本由此删除；`docs:check` 的双语结构校验仍归各仓。
-
-## 0.1.8 - 2026-09-21
-
-- 两个 host 侧片段的注释不再出现 `sibling`：三处改为陈述设计目标本身——插件独立运行，不依赖同级安装。片段会逐字嵌入消费仓，那个词在那里没有可指对象。
-- 片段字节因此变化，消费仓需重新运行 `loopback:sync` / `guard:sync` 并把 pin 升到 0.1.8。
-
-## 0.1.7 - 2026-09-20
-
-- 两个 host 侧片段的注释不再带消费仓数量：「all three plugins」「the three disagree」「the three plugins / diverged three times」改为不指名、不计数的说法。片段会逐字嵌入消费仓，那里的读者无从得知存在几个消费方，计数是工作区知识而非该仓知识。
-- 片段字节因此变化，消费仓需重新运行 `loopback:sync` / `guard:sync` 并把 pin 升到 0.1.7。
-
-## 0.1.6 - 2026-09-20
-
-- 修正 `dist/guard.js` 里 `allowRemoteHost` 的说明文字：原文写作「不再被放行」，与代码相反——开启该模式时这两项检查被跳过，即被放行。JSDoc 一直是对的，只有这处行内注释写反。
-- 该片段的字节因此变化，消费仓需重新运行 `guard:sync` 并把 pin 升到 0.1.6。
-
-## 0.1.5 - 2026-09-17
-
-- 文档维护：README 与 CHANGELOG 的整理，片段与命令行为不变，故无需改动消费仓的 pin。
-
-## 0.1.4 - 2026-09-16
-
-- README 新增「跨仓一致性」一节：本地由消费仓 `npm test` 的 `loopback:check` / `guard:check` 逐字节比对，跨仓由消费仓 pin 精确版本保证。
-- 该节记录 `scripts/guard-parity.mjs` 是人工诊断工具而非 CI 门禁。
-- LICENSE 版权署名统一为 `xswt442-cmd`。
-
-## 0.1.3 - 2026-09-14
-
-- 新增两个 host 侧片段：`dist/loopback.js`（`dsh-loopback-helpers`）导出回环判定谓词；`dist/guard.js`（`dsh-host-guard`）导出 `portOf`、`GUARD_REASONS`、`DEFAULT_GUARD_POLICY` 与内部的 `bindGuard()` 工厂，调用方以 `policy` 传入自己的错误码与文案。
-- `sync` / `check` 处理目标文件中所有已标记的片段，按 `FRAGMENTS` 顺序自下而上应用。
-- 修正 README 与包描述：说明两个 host 侧片段的职责、固定顺序与 `bindGuard` 不导出的原因。
-- 新增测试：多块同步与幂等 `check`、块顺序、片段不引入 `import`/`require`、判据不被重复声明。
-
-## 0.1.2 - 2026-09-06
-
-- 修正 README 的 `npm run dock:embed` 示例：补上 `package.json` 缺失的 `dock:embed` 脚本，用法改为 `npm run dock:embed -- check|sync path/to/client.js`（npm 传参需要 `--` 分隔符，CLI 接受 `sync|check` 子命令而非 `--check`）。新增从双语 README 提取命令逐条执行的 smoke test，防止文档与脚本漂移。
-
-## 0.1.1 - 2026-09-04
-
-- 归一化 `register()` 的 `label`：缺省、空白或非字符串的 `label` 回退为 `id`，避免渲染出 `aria-label="undefined"`。
-
-## 0.1.0
-
-- Add the Mini Utility Dock protocol v1 bootstrap.
-- Add `sync` and `check` commands for self-contained DSH client bundles.
-- Validate icons, registration ownership, placement, and load-order behavior.