dsh-molbio-tools 0.21.0 → 0.21.1

package/CHANGELOG.md

@@ -10,6 +10,97 @@
   改为按**包名**引用后模块缓存问题随之消失——没有拷贝，也就没有需要保持同步的版本目录。
   下文历史条目里出现的 `vN` 目录保持原样，作为当时的记录。
 
+## [0.21.1] — 2026-10-25（DSH STORE 提交前置：一个 patch、逐版本兼容声明、一个 tarball 一个清单）
+
+**工具数不变（60），插件运行时行为零改动。** 这一版不加任何计算能力，只把"这个包以什么形状提交"
+改成 DSH STORE 的提交预检与 DSH 自身的清单契约**都能接受、且不再互相矛盾**的那一种。三处改动都
+来自同一次上架提交：预检里能靠改包解决的两条已经解决，剩下两条的原理与请求另写在
+[docs/store-preset-exemption.md](docs/store-preset-exemption.md)。
+
+### 1. 两层 patch 合并成单个 `cordis.patch.yml`
+
+0.21.0 的 `dsh.bundle.patch` 是**有序数组**：`["./cordis.patch.yml", "./preset/molbio-lab/preset.patch.yml"]`。
+DSH 运行时接受这种写法（`@deepseek-ai/dsh-app-boot` 的 `bundlePatchPaths`：one file, or an
+ordered list of files），官方 `@deepseek-ai/dsh-web-app` 自己就列了 5 个文件；但 DSH STORE 的提交
+预检（`scripts/check-plugin-submission.mjs` 的 `safePatchPath`）只接受字符串，数组直接判
+`SUBMISSION_BUNDLE_PATCH_INVALID`。两边都自称官方契约，解法不必等预检放宽：
+
+- `build/preset-patch.mjs` 现在直接产出**根目录的 `cordis.patch.yml`**，内容是**两个 insert**：
+  `molbio-client → ./host.mjs`（惰性宿主锚点）在前，`preset-molbio-lab`（由
+  `preset/molbio-lab/agent.cordis.yml` 生成的 preset 行）在后；顺序即应用顺序。
+- 不再生成 `preset/molbio-lab/preset.patch.yml`（文件已删）；`package.json` 的
+  `dsh.bundle.patch` 是**单字符串**。
+- 四个读者改为跟单文件走：`test/preset-health.mjs`、`test/drift-probe.mjs`、
+  `preset/install.mjs`、`test/preset-rows.mjs`（后者在同一个文件的两个 insert 里找 preset 段，
+  不假设"preset.patch.yml 才是 preset"）。
+
+> 这一条同时守住一条更早的教训：**锚点行不能因为"文件变少了"而消失**。0.15.2 的两个侧栏 tab
+> 就是锚点丢失后静默消失的；`test/client-mount.mjs` 仍然逐包断言"被选中的包必须有一个宿主行
+> 能解析到它"，`test/contract.mjs` 仍然断言"产物里的每一处 `register` 都在 `inject` 里"。
+
+### 2. `engines.dsh` 与逐版本 `dshReleases`
+
+两个 manifest 各声明一份：
+
+```jsonc
+"engines": { "node": ">=26", "dsh": ">=0.2.1-rc.2 <0.3.0-0" },
+"dsh": { "compatibility": { "dshReleases": {
+  "0.2.1-rc.1": "unknown", "0.2.1-rc.2": "compatible", "0.2.1-rc.3": "unknown" } } }
+```
+
+上界写 `<0.3.0-0` 而不是 `<0.3.0`：DSH 用 `semver.satisfies(..., { includePrerelease: true })`
+判定（`@deepseek-ai/dsh-app-boot` 的 `unmetRequirements`），带 prerelease 选项时 `<0.3.0`
+会放行 `0.3.0-alpha.1`，`-0` 不会。`rc.1` 早于本包基线、`rc.3` 未取得也未验证，两者都只能
+标 `unknown`——**范围不等于验收**：`engines` 是安装时的粗筛，商城的 `dshReleases` 记录才是
+逐版本的验收结论。
+
+面板包随之 `0.1.3 → 0.1.4`：它的版本线独立于根包，但清单变了，不发这个版本号就没有能承载新
+声明的发布物。
+
+### 3. 根 tarball 不再内嵌面板包
+
+`files` 白名单去掉 `packages`。此前根 tarball 里同时躺着 `package.json` 与
+`packages/molbio-panel/package.json` 两个 DSH 插件清单，还重复携带 427 KB 相同的 `lib/client.js`；
+商城把"一个包里出现第二个插件清单"视为提交歧义是对的。现在根 tarball **只有一个插件清单**：
+**118 → 115 个文件、约 1.1 MB → 约 999 kB**（多出的 1 个文件是本次提交的
+`docs/store-preset-exemption-issue.md`）。面板没有因此消失——根包的 `lib/client.js` 本来就带着它
+（第 4 节的启动回读可以作证）；面板包继续按自己的地址单独发布。
+
+`test/contract.mjs` 的打包断言随之改向：不再要求 `files` 必须包含 `packages/`，而是断言
+**一个 tarball 里恰好只有一个 DSH 清单**（把 `packages` 加回白名单会立刻 FAIL）。
+
+### 4. 一次性 profile 证据（tarball 就是发布物）
+
+证据记录在 [docs/store-evidence.md](docs/store-evidence.md)，用临时 `DSH_HOME` 重跑，不碰真实
+`~/.dsh`：`npm pack` → `--from-default-profile web` 建 profile → `plugin add` tarball →
+`--dump-config`（`molbio-client` 解析到已安装包内，preset 行带 `tool-molbio`）→
+`--no-open --port 0` 启动 → 带 token 回读页面（**HTTP 200**，`__DSH_BOOT__` 图里有
+`dsh-molbio-tools/client.js`）→ `plugin remove` → 再 `--dump-config`（`molbio` 引用 **0** 处）。
+装 tarball 而不是目录，是因为 tarball 同时证明 `files` 白名单带全了运行文件。
+
+### 5. 未做 / 边界
+
+- **`0.2.1-rc.3` 没有验证**，因此标 `unknown`。拿到该版本后按
+  [docs/workflow.md](docs/workflow.md) 第 4 节的升级流程重跑 `preset-health` / `drift-probe` /
+  一次性 profile，再把它改成 `compatible`。
+- **预检的另外两条（保护命名空间、身份一致）不是改包能解决的**：本包已自行消掉
+  `SUBMISSION_BUNDLE_PATCH_INVALID`；剩下两条的证据、代码位置与三个可执行请求写在
+  [docs/store-preset-exemption.md](docs/store-preset-exemption.md)，可直接贴到 issue 的短版在
+  [docs/store-preset-exemption-issue.md](docs/store-preset-exemption-issue.md)。
+- **工具行为与 benchmark 一律不动**：60 个工具的输出与 0.21.0 相同，按规则 6 的"没变就不必跑
+  模型"；`bench --offline` 仍在 `npm test` 里，期望值照样逐条校验。
+
+### 6. 版本与验证
+
+- 根包 `0.21.0 → 0.21.1`；面板 `0.1.4`（见 §2）。
+- `npm test` 全绿：smoke、画面四套、客户端四套、contract 16 项、drift-probe 14 条突变、
+  preset-health 30 行、release 13 项、benchmark 四道守卫 + `bench --offline` 61 题。
+- `node build/preset-patch.mjs --check` 与 `node build/client-bundle.mjs --check` 均报告与源一致。
+- `node build/release-preflight.mjs --tag v0.21.1`：本地不变量全过；npm 上 `dsh-molbio-tools`
+  已有 0.21.0、本版按 `publish` 处理；面板 0.1.4 尚未发布。
+- 文档同步：maintainer 的版本号、roadmap 的当前状态、history 的版本一览与本段、store-evidence
+  的 tarball 名与文件数。
+
 ## [0.21.0] — 2026-10-23（DSH 0.2.1-rc.2 适配；两条 benchmark 欠账清零）
 
 **工具数不变（60），插件行为零改动。** 这是一次"只跟上游走"的版本：0.20.1 之后本机 harness

package/README.md

@@ -79,7 +79,7 @@ dsh plugin --profile web update dsh-molbio-tools
 > **0.7.1 起不再需要"注册 preset 根目录"这一步。**
 > DSH 0.1.7-alpha.1 移除了 `@deepseek-ai/dsh-agent-presets` 及其目录发现机制：preset 现在是
 > bundle patch 里的一个 `@deepseek-ai/dsh-agent-preset` **行**（本包的是
-> `preset/molbio-lab/preset.patch.yml`，由 `dsh.bundle.patch` 声明）。
+> `cordis.patch.yml` 里的第二个 insert，由 `dsh.bundle.patch` 声明）。
 > 因此 preset 随 bundle 一起安装，**装完即出现**。
 >
 > 老版本遗留的两样东西可以清理（`node preset\install.mjs --profile web` 会替你查出来）：
@@ -95,12 +95,12 @@ dsh plugin --profile web update dsh-molbio-tools
 
 ### 工具只在专属模式里出现（设计如此）
 
-本包的 bundle patch 分两层，分工是固定的：
+本包的 bundle patch 是**一个文件、两层 insert**，分工是固定的：
 
-| 层 | 作用 |
+| 层（同一个 `cordis.patch.yml` 里的两段） | 作用 |
 | --- | --- |
-| `cordis.patch.yml` | 只插一行**惰性宿主锚点**（`./host.mjs`），不注册任何工具 |
-| `preset/molbio-lab/preset.patch.yml` | 声明 **Molecular Biology Lab** 模式，60 个工具在这一层里 |
+| `molbio-client` → `./host.mjs` | 只插一行**惰性宿主锚点**，不注册任何工具 |
+| `preset-molbio-lab` → `@deepseek-ai/dsh-agent-preset` | 声明 **Molecular Biology Lab** 模式，60 个工具在这一层里 |
 
 所以 60 个工具**只在选中该模式的会话里加载**，其它模式（standard / ptc / minimal / cordis）
 不带它们，不占提示预算。bundle 安装 ≠ 工具全局可见：bundle 只是把"模式"和"面板"一起装进来。
@@ -741,11 +741,11 @@ dsh-molbio-tools/
 ├── lib/client.js    # 客户端产物（exports["./client"]，由 npm run build:client 生成）
 ├── packages/molbio-panel/ # 面板专用包（只面板、不带工具）
 ├── preset/molbio-lab/     # 专属模式 preset：agent.cordis.yml 是行清单（手改这里）
-│                          #   preset.patch.yml 由 build/preset-patch.mjs 生成
+│                          #   preset.yml 是选择器文案；两者由生成器写进下面的 cordis.patch.yml
 ├── benchmark/       # 可用性评估：tasks/*.json + 判分器 + headless profile 推导（见其 README）
 ├── test/            # 冒烟 + 光栅化器 + 客户端/组合检查（含 preset 漂移与 benchmark profile 守卫）
 ├── docs/            # 维护者与实现文档（rules / workflow / roadmap / history 是本目录的骨架）
-└── cordis.patch.yml # bundle 的第一层补丁（当前为空列表；工具由 preset 层承载）
+└── cordis.patch.yml # 唯一 bundle patch（生成物）：锚点 insert + preset insert
 ```
 
 ---

package/benchmark/README.md

@@ -222,7 +222,7 @@ session "…" runs under agent preset "molbio-lab", which the one-shot runner do
 Presets are an agent-plane feature the Web surface composes; the one-shot runner
 drives `agents.create()` directly and never joins one. So the tools must be
 mounted as **host rows**, which is the one shape this package otherwise refuses
-to ship (`cordis.patch.yml` is deliberately an empty list).
+to ship (`cordis.patch.yml` only inserts the inert client anchor).
 
 `benchmark/profile.mjs` therefore generates a dedicated profile
 (`$DSH_HOME/profiles/molbio-bench`) whose patch layer is **derived** from

package/benchmark/profile.mjs

@@ -17,7 +17,8 @@
  * agent-plane feature the Web surface composes; the one-shot runner drives
  * `agents.create()` directly and never joins one. So the tools have to be
  * mounted as HOST rows, which is the one shape this package otherwise refuses
- * to ship (`cordis.patch.yml` is deliberately empty — see the preset's header).
+ * to ship (`cordis.patch.yml` only inserts the inert client anchor — see the
+ * preset's header).
  *
  * ── What keeps the reconstruction honest ────────────────────────────────────
  *

package/build/preset-patch.mjs

@@ -1,35 +1,55 @@
 /**
  * dsh-molbio-tools/build/preset-patch.mjs
  *
- * Generate the AGENT-PRESET bundle patch from the canonical row list.
+ * Generate the ONE bundle patch this package ships: the client anchor plus the
+ * "Molecular Biology Lab" agent preset.
  *
- * WHY THIS EXISTS
- * ---------------
- * DSH 0.1.7-alpha.1 replaced the preset DIRECTORY mechanism. Before it, a preset
- * was an `agent.cordis.yml` the harness discovered from `<dshHome>/.agent-presets`
- * or from a configured root (`@deepseek-ai/dsh-agent-presets` scanned
- * directories). That package is gone, and the registry that replaced it "neither
- * scans directories nor accepts preset paths" — a preset is now a
- * `@deepseek-ai/dsh-agent-preset` ROW inside a bundle patch:
+ * WHY ONE FILE
+ * ------------
+ * DSH's runtime accepts `dsh.bundle.patch` as a file path or an ordered list of
+ * file paths (`@deepseek-ai/dsh-app-boot` → `bundlePatchPaths`), and the shipped
+ * `@deepseek-ai/dsh-web-app` uses the list form. DSH STORE's submission precheck
+ * only accepts a single string (`safePatchPath`), so the two layers this package
+ * used to ship as a list are emitted as one file with two top-level `insert`
+ * operations, in the same order they were applied:
  *
- *     - insert:
- *         - id: preset-molbio-lab
- *           name: '@deepseek-ai/dsh-agent-preset'
- *           config:
- *             id: molbio-lab
- *             name: Molecular Biology Lab
- *             description: ...
- *             plugins: [ ...the rows that used to be the composition... ]
+ *     1. molbio-client      → './host.mjs'  (inert host anchor; see below)
+ *     2. preset-molbio-lab  → '@deepseek-ai/dsh-agent-preset'
  *
- * The rows themselves did not change — only their container did. Keeping the
- * rows in ONE place and generating the container from them is what stops the two
- * from drifting, because `test/preset-health.mjs` validates every row against
- * the INSTALLED harness's own schemas.
+ * Nothing about either layer changes: a patch file is an ordered list of
+ * operations, and DSH applies them in file order exactly as it applied the two
+ * files in list order.
+ *
+ * WHY THE ANCHOR EXISTS
+ * ---------------------
+ * DSH's client-module scan walks the HOST Loader tree only. It reads each live
+ * host row's package manifest, takes `dsh.client` and `exports["./client"]` from
+ * it, and composes the browser graph that becomes `window.__DSH_BOOT__`. A
+ * preset's rows live in an isolated subtree that scan never visits.
+ *
+ * So when the tools moved into the preset, this package lost its only host-plane
+ * row, its bundle stopped reaching the page, and the two right-sidebar tabs
+ * (Molbio / Papers) silently disappeared. `host.mjs` restores exactly one inert
+ * row so the browser half is discoverable again — without putting any tool into
+ * a session that did not choose the molbio-lab mode.
+ *
+ * WHY THE PRESET IS GENERATED
+ * ---------------------------
+ * DSH 0.1.7-alpha.1 removed the `<dshHome>/.agent-presets` directory scan: a
+ * preset is now a `@deepseek-ai/dsh-agent-preset` ROW in a bundle patch, which
+ * is what the second insert below declares. Because the BUNDLE registers it,
+ * `dsh plugin --profile <p> add dsh-molbio-tools` puts the mode in the picker
+ * with no copy step and no preset-root patch — see README「安装」.
+ *
+ * Keeping the rows in ONE place and generating the container from them is what
+ * stops the two from drifting, because `test/preset-health.mjs` validates every
+ * row against the INSTALLED harness's own schemas.
  *
  *   source : preset/molbio-lab/agent.cordis.yml  (top-level row list, comments intact)
- *   output : preset/molbio-lab/preset.patch.yml  (the bundle patch, GENERATED)
+ *   source : preset/molbio-lab/preset.yml        (picker name + description)
+ *   output : cordis.patch.yml                    (GENERATED; anchor + preset)
  *
- * The source is emitted as-is: no re-serialization, so the comments that explain
+ * The rows are emitted as-is: no re-serialization, so the comments that explain
  * each row survive and the file stays diffable against the shipped `standard`
  * patch it descends from.
  *
@@ -55,20 +75,56 @@ export function rowBlockOf(source) {
 /** Indent every line of a block by `width` spaces. */
 const indent = (block, width) => block.split('\n').map((line) => (line === '' ? line : ' '.repeat(width) + line)).join('\n');
 
+const HEADER = [
+  '# dsh-molbio-tools bundle patch — the one file `dsh.bundle.patch` names.',
+  '#',
+  '# GENERATED by build/preset-patch.mjs. Edit the row list in',
+  '# preset/molbio-lab/agent.cordis.yml (and the picker strings in preset.yml), then',
+  '# re-run `node build/preset-patch.mjs`; hand edits here are reverted by the next',
+  '# run, and `node build/preset-patch.mjs --check` fails while the two disagree.',
+  '#',
+  '# Two top-level inserts, applied in this order:',
+  '#   1. molbio-client      — inert host anchor for the browser half (see below)',
+  '#   2. preset-molbio-lab  — the "Molecular Biology Lab" agent preset',
+].join('\n');
+
+const ANCHOR = [
+  '# ── 1. the CLIENT-BUNDLE ANCHOR ────────────────────────────────────────────',
+  '#',
+  '# `host.mjs` registers no tool and publishes no service. Its only job is to be a',
+  "# loader row DSH's client-module scan can see: that scan walks the HOST Loader",
+  "# tree, reads the row's package manifest, and takes `dsh.client` +",
+  '# `exports["./client"]` from it to compose `window.__DSH_BOOT__`. A preset\'s rows',
+  '# live in an isolated subtree the scan never visits, so a `dsh.client` package',
+  '# referenced only from inside a preset loses its only discoverable row and its',
+  '# right-sidebar tabs silently disappear.',
+  '#',
+  '# Keep the tool in the PRESET and only the anchor here. An earlier version of',
+  "# this file inserted a host row for the tool itself (`name: dsh-molbio-tools`),",
+  "# which both registered all 60 tools globally and collided with the preset's own",
+  '# copy of that row:',
+  '#',
+  '#     broken: "tool-molbio (...): never started"',
+  '- insert:',
+  '    - id: molbio-client',
+  "      name: './host.mjs'",
+].join('\n');
+
+/**
+ * Build the bundle patch: anchor first, preset second.
+ *
+ * @param {{rows: string, description: string, displayName?: string}} input
+ * @returns {string} the complete `cordis.patch.yml` text (single trailing newline)
+ */
 export function buildPatch({ rows, description, displayName = 'Molecular Biology Lab' }) {
-  const header = [
-    '# dsh-molbio-tools bundle layer: declares the "Molecular Biology Lab" agent preset.',
+  const presetHeader = [
+    '# ── 2. the MOLECULAR BIOLOGY LAB PRESET ───────────────────────────────────',
     '#',
-    '# GENERATED by build/preset-patch.mjs from preset/molbio-lab/agent.cordis.yml.',
-    '# Edit the ROW LIST there and re-run `node build/preset-patch.mjs`; editing the',
-    "# `plugins:` block below by hand will be reverted by the next run, and",
-    '# `node build/preset-patch.mjs --check` fails while the two disagree.',
-    '#',
-    '# DSH 0.1.7-alpha.1 removed the `<dshHome>/.agent-presets` directory scan: a preset is',
-    '# now a `@deepseek-ai/dsh-agent-preset` ROW in a bundle patch, which is what this',
-    '# layer inserts. Because the BUNDLE registers it, `dsh plugin --profile <p> add',
-    '# dsh-molbio-tools` puts the mode in the picker with no copy step and no',
-    '# preset-root patch — see README「安装」.',
+    '# DSH 0.1.7-alpha.1 removed the `<dshHome>/.agent-presets` directory scan: a',
+    '# preset is now a `@deepseek-ai/dsh-agent-preset` ROW in a bundle patch, which',
+    '# is what this insert declares. Because the BUNDLE registers it,',
+    '# `dsh plugin --profile <p> add dsh-molbio-tools` puts the mode in the picker',
+    '# with no copy step and no preset-root patch — see README「安装」.',
     '#',
     '# `order: 5` is deliberate: the shipped presets occupy 1..4 (standard, ptc,',
     '# minimal, cordis) and the registry sorts by `order` with an id tie-break, so a',
@@ -76,7 +132,11 @@ export function buildPatch({ rows, description, displayName = 'Molecular Biology
   ].join('\n');
 
   return [
-    header,
+    HEADER,
+    '',
+    ANCHOR,
+    '',
+    presetHeader,
     '- insert:',
     '    - id: preset-molbio-lab',
     "      name: '@deepseek-ai/dsh-agent-preset'",
@@ -95,7 +155,7 @@ function main() {
   const check = process.argv.includes('--check');
   const sourcePath = join(repoRoot, 'preset', 'molbio-lab', 'agent.cordis.yml');
   const metaPath = join(repoRoot, 'preset', 'molbio-lab', 'preset.yml');
-  const outPath = join(repoRoot, 'preset', 'molbio-lab', 'preset.patch.yml');
+  const outPath = join(repoRoot, 'cordis.patch.yml');
 
   const rows = rowBlockOf(readFileSync(sourcePath, 'utf8'));
   if (rows === undefined || !rows.includes('- id:')) {
@@ -124,16 +184,16 @@ function main() {
       process.exit(1);
     }
     if (current !== text) {
-      console.error('preset-patch: the committed preset patch is STALE — run `node build/preset-patch.mjs`');
+      console.error('preset-patch: the committed bundle patch is STALE — run `node build/preset-patch.mjs`');
       process.exit(1);
     }
-    console.log('preset patch is current');
+    console.log('bundle patch is current');
     return;
   }
 
   writeFileSync(outPath, text, 'utf8');
-  const rows_ = rows.split('\n').filter((line) => /^\s*- id:/.test(line)).length;
-  console.log(`preset patch written: ${outPath} (${rows_} rows)`);
+  const rowCount = rows.split('\n').filter((line) => /^\s*- id:/.test(line)).length;
+  console.log(`bundle patch written: ${outPath} (${rowCount} preset rows + anchor)`);
 }
 
 if (process.argv[1] !== undefined && import.meta.url === pathToFileURLSafe(process.argv[1])) main();

package/cordis.patch.yml

@@ -1,34 +1,196 @@
-# dsh-molbio-tools bundle layer: the CLIENT-BUNDLE ANCHOR.
+# dsh-molbio-tools bundle patch — the one file `dsh.bundle.patch` names.
 #
-# ── WHAT THIS LAYER INSERTS, AND WHY IT IS NOT THE TOOL ────────────────────
+# GENERATED by build/preset-patch.mjs. Edit the row list in
+# preset/molbio-lab/agent.cordis.yml (and the picker strings in preset.yml), then
+# re-run `node build/preset-patch.mjs`; hand edits here are reverted by the next
+# run, and `node build/preset-patch.mjs --check` fails while the two disagree.
 #
-#     - id: molbio-client
-#       name: './host.mjs'      # inert host half; see host.mjs
+# Two top-level inserts, applied in this order:
+#   1. molbio-client      — inert host anchor for the browser half (see below)
+#   2. preset-molbio-lab  — the "Molecular Biology Lab" agent preset
+
+# ── 1. the CLIENT-BUNDLE ANCHOR ────────────────────────────────────────────
 #
-# The 57 tools are NOT here. They load only inside the molbio-lab preset, which
-# is the point of that mode (see preset/molbio-lab/agent.cordis.yml, whose row is
-# generated into preset.patch.yml — the bundle's SECOND patch layer).
+# `host.mjs` registers no tool and publishes no service. Its only job is to be a
+# loader row DSH's client-module scan can see: that scan walks the HOST Loader
+# tree, reads the row's package manifest, and takes `dsh.client` +
+# `exports["./client"]` from it to compose `window.__DSH_BOOT__`. A preset's rows
+# live in an isolated subtree the scan never visits, so a `dsh.client` package
+# referenced only from inside a preset loses its only discoverable row and its
+# right-sidebar tabs silently disappear.
 #
-# This row exists because DSH's client-module scan walks the HOST Loader tree
-# only. It reads each live host row's package manifest, takes `dsh.client` and
-# `exports["./client"]` from it, and composes the browser graph that becomes
-# `window.__DSH_BOOT__`. A preset's rows live in an isolated subtree that scan
-# never visits.
-#
-# So when the tools moved into the preset, this package lost its only host-plane
-# row, its bundle stopped reaching the page, and the two right-sidebar tabs
-# (Molbio / Papers) silently disappeared: the panel code was still in the
-# artifact, nothing ever loaded it. `host.mjs` restores exactly one inert row so
-# the browser half is discoverable again — without putting any tool into a
-# session that did not choose the molbio-lab mode.
-#
-# An earlier version of this file inserted a host row for the tool itself
-# (`name: dsh-molbio-tools`), which both registered all 57 tools globally and
-# collided with the preset's own copy of that row:
+# Keep the tool in the PRESET and only the anchor here. An earlier version of
+# this file inserted a host row for the tool itself (`name: dsh-molbio-tools`),
+# which both registered all 60 tools globally and collided with the preset's own
+# copy of that row:
 #
 #     broken: "tool-molbio (...): never started"
-#
-# Keep the tool in the PRESET and only the anchor here.
 - insert:
     - id: molbio-client
       name: './host.mjs'
+
+# ── 2. the MOLECULAR BIOLOGY LAB PRESET ───────────────────────────────────
+#
+# DSH 0.1.7-alpha.1 removed the `<dshHome>/.agent-presets` directory scan: a
+# preset is now a `@deepseek-ai/dsh-agent-preset` ROW in a bundle patch, which
+# is what this insert declares. Because the BUNDLE registers it,
+# `dsh plugin --profile <p> add dsh-molbio-tools` puts the mode in the picker
+# with no copy step and no preset-root patch — see README「安装」.
+#
+# `order: 5` is deliberate: the shipped presets occupy 1..4 (standard, ptc,
+# minimal, cordis) and the registry sorts by `order` with an id tie-break, so a
+# shared number would let the picker order depend on alphabetical accident.
+- insert:
+    - id: preset-molbio-lab
+      name: '@deepseek-ai/dsh-agent-preset'
+      config:
+        id: molbio-lab
+        order: 5
+        name: Molecular Biology Lab
+        description: "分子生物学专属模式：标准编码能力 + 60 个 molbio_* 工具（序列分析、引物设计（含跨内含子 qPCR、盐/浓度旋钮与目标位置偏好）、TaqMan 水解探针（含 MGB 与订购 CSV）与多重 PCR 互扰/退火温度/浓度建议、克隆模拟与选酶（含 Golden Gate）、酶目录查询、甲基化敏感位点与双酶切 buffer 兼容检查、多序列比对（每个输入残基都会进比对结果）、保守性分析与比对后处理（共识/缺口修剪/同一性矩阵/逐列覆盖度，含 sequence logo 图）、CRISPR gRNA 设计（SpCas9/SaCas9/Cas12a/Cas13，家族特定 PAM/PFS/种子）与脱靶搜索、SnapGene/GenBank 解析与质粒图谱、Sanger 测序验证、蛋白性质/密码子优化/螺旋轮投影与疏水性图、qPCR 与绘图、虚拟凝胶、实验台分析（FASTQ 质控、密码子使用、系统发生树（长叶名自动折行）、in-silico PCR、CpG/GC 组成、批量文件分析/CSV）、静默酶切位点突变设计——生成的 SVG 图片自动用系统默认应用打开，文献/协议/实验记录）。"
+        plugins:
+          - id: persona
+            name: '@deepseek-ai/dsh-persona'
+            config:
+              prefix: You are a coding agent powered by the {{model}} model.
+          - id: agent-instructions
+            name: '@deepseek-ai/dsh-agent-instructions'
+            config:
+              maxBytes: 65536
+          - id: time-context
+            name: '@deepseek-ai/dsh-time-context'
+          - id: tool-bash
+            name: '@deepseek-ai/dsh-tool-bash'
+            disabled: !!js process.platform === 'win32'
+          - id: tool-pwsh
+            name: '@deepseek-ai/dsh-tool-pwsh'
+            disabled: !!js process.platform !== 'win32'
+          - id: tool-fs
+            name: '@deepseek-ai/dsh-tool-fs'
+          - id: tool-fs-search
+            name: '@deepseek-ai/dsh-tool-fs-search'
+            config:
+              sampleOverCapGlobResults: false
+          - id: tool-jobs
+            name: '@deepseek-ai/dsh-tool-jobs'
+          - id: tool-schedule
+            name: '@deepseek-ai/dsh-tool-schedule'
+          - id: skill-filesystem
+            name: '@deepseek-ai/dsh-skill-filesystem'
+          - id: tool-skill
+            name: '@deepseek-ai/dsh-tool-skill'
+          - id: command-goal
+            name: '@deepseek-ai/dsh-command-goal'
+          - id: tool-goal
+            name: '@deepseek-ai/dsh-tool-goal'
+          - id: planning
+            name: cordis:group
+            group: true
+            isolate:
+              planMode: true
+            config:
+              - id: plan-mode
+                name: '@deepseek-ai/dsh-plan-mode'
+                config:
+                  section: |
+                    You are in plan mode. Stay in plan mode until the user approves your plan through exit_plan_mode or switches the session mode. Imperative language to implement changes means plan the implementation, not execute it. A user's conversational agreement — including an answer confirming something you asked — approves nothing and does not end plan mode; fold the confirmed decision into the plan and submit it through exit_plan_mode.
+
+                    Explore first. Use non-mutating reads, searches, static analysis, and checks to ground the plan in the actual repository. Do not edit or write files, change configuration, run formatters or code generation that rewrites tracked files, commit, or otherwise carry out the plan. Prefer existing functions and patterns over new machinery.
+
+                    The tool catalog stays the same across modes for request-cache stability. These plan-mode rules override any later tool description or guidance that suggests using mutation tools; those tools remain listed to keep the tool catalog unchanged. Do not use todo_write to track this planning phase: it tracks implementation after an approved plan, while the plan itself belongs in exit_plan_mode.
+
+                    Resolve discoverable facts by inspection. Use ask_user_question only for user-owned choices or material ambiguity that inspection cannot answer. Do not ask the user where code lives or how current behavior works when you can find out.
+
+                    Make the plan decision-complete: state the goal and success criteria; group implementation changes by subsystem; identify public API, schema, and data-flow changes; cover edge cases, failure modes, tests, acceptance criteria, and explicit assumptions. Keep it concise enough to review but detailed enough that another engineer can implement it without making design decisions.
+
+                    When ready, call exit_plan_mode with the complete plan markdown, starting with a # title. Make exit_plan_mode the only and final tool call in that assistant response: it presents the plan for approval, and implementation begins only in a later step after approval. Do not paste the final plan as a plain reply or ask "should I proceed?" through prose or ask_user_question. If review rejects it, incorporate the feedback and present again. If the review channel is unavailable or aborted, stay in plan mode and ask the user to switch modes manually; do not proceed with implementation.
+          - id: compaction
+            name: cordis:group
+            group: true
+            isolate:
+              compaction: true
+              toolResultPruner: true
+            config:
+              - id: compaction-basic
+                name: '@deepseek-ai/dsh-compaction-basic'
+              - id: command-compact
+                name: '@deepseek-ai/dsh-command-compact'
+              - id: tool-result-pruner
+                name: '@deepseek-ai/dsh-compaction-tool-result-pruner'
+                config:
+                  thresholdChars: 8192
+                  headChars: 4096
+                  tailChars: 1024
+          - id: delegation
+            name: cordis:group
+            group: true
+            isolate:
+              workflowEngine: true
+            config:
+              - id: tool-subagent-control
+                name: '@deepseek-ai/dsh-tool-subagent-control'
+              - id: tool-subagent-list-agents
+                name: '@deepseek-ai/dsh-tool-subagent-control/list-agents'
+              - id: tool-subagent
+                name: '@deepseek-ai/dsh-tool-subagent'
+                config:
+                  provider: spawn
+                  toolName: subagent
+                  modelSelectionSettings: true
+              - id: tool-subagent-fork
+                name: '@deepseek-ai/dsh-tool-subagent'
+                config:
+                  provider: fork
+                  toolName: subagent_fork
+              - id: workflow-ptc
+                name: '@deepseek-ai/dsh-workflow-ptc'
+                config:
+                  provider: spawn
+              - id: tool-workflow
+                name: '@deepseek-ai/dsh-tool-workflow'
+          - id: tool-ask-user
+            name: '@deepseek-ai/dsh-tool-ask-user'
+          - id: tool-todo
+            name: '@deepseek-ai/dsh-tool-todo'
+            config:
+              allowParallelInProgress: true
+          - id: tool-web
+            name: '@deepseek-ai/dsh-tool-web'
+            config:
+              fetch: true
+              searchTimeoutMs: 60000
+          - id: present
+            name: '@deepseek-ai/dsh-tool-present'
+          - id: tool-plugin-manager
+            name: '@deepseek-ai/dsh-plugin-manager/tools'
+            disabled: true
+          - id: tool-plugin-market
+            name: '@deepseek-ai/dsh-plugin-market/tools'
+            disabled: true
+
+          # dsh-molbio-tools: molecular-biology toolset (60 tools across sequence
+          # analysis, primers (incl. TaqMan probes and multiplex compatibility),
+          # in-silico PCR, cloning (incl. Golden Gate), enzyme catalog, methylation-aware
+          # and double digests, plasmids, Sanger verification, proteins (incl. helical
+          # wheel/hydropathy plots), qPCR, virtual gels, multiple sequence
+          # alignment/conservation (every supplied residue is conserved), sequence logos,
+          # codon-usage analysis, phylogenetic trees (bootstrap + Newick, long labels
+          # wrapped), CpG-island/GC-skew composition, read-level FASTQ QC, CRISPR gRNA
+          # design, and literature/protocol/experiment records).
+          # Registers into the host `tools` registry and publishes no service, so it
+          # needs no isolate realm.
+          #
+          # The specifier is the PACKAGE NAME, resolved by Node from the profile's
+          # node_modules — not a `./plugins/…` path. A relative specifier here does NOT
+          # work on DSH 0.1.7-alpha.1: the preset mounts, but the entry is created without
+          # ever being imported, so the roster reports the mode as broken and it loads
+          # zero tools:
+          #
+          #     tool-molbio (./plugins/dsh-molbio-tools-v20/index.mjs): never started
+          #
+          # A bare name is also what makes upgrades automatic: `dsh plugin update` moves
+          # the package and this row follows it. The per-release `plugins/dsh-molbio-
+          # tools-vN/` copies existed only to work around ESM module-cache reuse of a
+          # relative file URL, which a resolved package name does not have.
+          - id: tool-molbio
+            name: 'dsh-molbio-tools'

package/docs/history.md

@@ -16,6 +16,7 @@
 
 | 包版本 | preset 版本 | 内容 | 工具数 |
 | --- | --- | --- | --- |
+| 0.21.1 | — | **DSH STORE 提交前置**：单文件 bundle patch、逐版本兼容声明；根 tarball 只带一个插件清单（工具行为零变化） | 60 |
 | 0.21.0 | — | **DSH 0.2.1-rc.2 适配**：preset 行清单逐行重抄；contract 两条断言重锚到行为；两条 suspended 记录用真实模型重录 | 60 |
 | 0.20.1 | — | 插件专属图标（透明底双螺旋 SVG），运行时零改动 | 60 |
 | 0.20.0 | — | **Cas 家族几何**（SpCas9/SaCas9/Cas12a/Cas13a/b/d）+ 反向链脱靶定位修复；TaqMan MGB/订购 CSV；multiplex 退火温度/浓度；批量分析 CSV；静默位点突变；并入 0.19.1 硬化 | 60 |
@@ -43,6 +44,29 @@
 
 ---
 
+## v0.21.1（2026-10-25，包 0.21.1）
+
+上架前置版：一个工具都没改，只改「提交的形状」。三条教训都关于**契约不止一份**。
+
+**(1) 当两个官方契约互相矛盾时，先让包同时满足两边，而不是等其中一个放宽。**
+`dsh.bundle.patch` 在 DSH 运行时是有序数组（官方 `dsh-web-app` 自己就列了 5 个文件），但 DSH STORE
+的提交预检只接受字符串。我们选了不依赖对方先改的解法：合并成一个 `cordis.patch.yml`，两个 insert
+（锚点 + preset）放在同一个文件里，生成器直接产出它。代价是四个读者要跟着换路径——真正危险的不是
+改路径，而是**锚点行可能在合并时被当成重复内容删掉**：0.15.2 的两个侧栏 tab 就是这么消失的。所以
+`client-mount` 的「每个被选中的包必须有一个可解析的宿主行」没有随合并松动。
+
+**(2) 兼容性声明是两件事：安装范围与逐版本验收。**
+`engines.dsh` 的 `>=0.2.1-rc.2 <0.3.0-0` 是粗筛（`-0` 是必要的：带 prerelease 的比较里
+`<0.3.0` 会放行 `0.3.0-alpha.1`）；`dsh.compatibility.dshReleases` 才是逐版本的结论。没有跑过的
+版本只能写 `unknown`，不能因为「补丁号在范围内」就写成 `compatible`——这正是把「范围」误读成
+「验收」时会发生的事。
+
+**(3) 一个 tarball 只能有一个插件清单。**
+根包曾把 `packages/molbio-panel` 一起打包，于是同一个 tarball 里有两个 `dsh` 清单、两份相同的
+427 KB `lib/client.js`。删掉 `packages` 不改变任何用户可见行为（面板照样由根包的 `lib/client.js`
+提供），但「不改变行为」必须能被观察到：一次性 profile 的启动回读里，`window.__DSH_BOOT__` 仍然
+包含 `dsh-molbio-tools/client.js`，这才是证据；tarball 此时是 115 个文件、约 999 kB。
+
 ## v0.21.0（2026-10-23，包 0.21.0）
 
 纯适配版：DSH 0.2.0-rc.2 → 0.2.1-rc.2。工具行为零变化，但上游动了三样本仓库**以为不会动**的东西，