dsh-plugin-compat-check 0.1.3 → 0.1.5

package/README.md

@@ -1,47 +1,63 @@
 # dsh-plugin-compat-check
 
-检查**已经安装的 DSH 插件**与当前 DSH 版本的兼容性，提供源码位置、运行时证据与覆盖限制。包含兼容性标签、插件详情发现/角标、`compat_check` 对话工具和skill provider。
+如果你觉得这个项目有用或有趣，欢迎点个 [Star ⭐](https://github.com/lcy0121/dsh-plugin-compat-check) 支持一下！
 
-![插件详情页：部分可用，含 file:line、影响与依据](https://raw.githubusercontent.com/lcy0121/dsh-plugin-compat-check/main/plugin/assets/compat-detail-partial.png)
+检查**已安装的 DSH 插件**与目标 DSH 版本的兼容性，提供源码位置、依据及覆盖限制。声明放行、激活成功不等于业务功能正常。
 
-本文描述 **0.1.3** 的实现；是否已发布及 npm latest 以[发布记录](https://github.com/lcy0121/dsh-plugin-compat-check/blob/main/docs/Plan.md)与registry为准。安装公开版本（发布前不能用源码测试代替公开包验收）：
+[简体中文](https://github.com/lcy0121/dsh-plugin-compat-check/blob/main/README.md) | [English](https://github.com/lcy0121/dsh-plugin-compat-check/blob/main/README.en.md) | [한국어](https://github.com/lcy0121/dsh-plugin-compat-check/blob/main/README.ko.md)
+
+**0.1.5** · Node `^22.19.0 || >=24`。提供兼容性标签、插件详情发现/角标、`compat_check` 对话工具和 skill provider。发布与验收记录见 [Plan](https://github.com/lcy0121/dsh-plugin-compat-check/blob/main/docs/Plan.md)。
+
+![插件详情：部分可用、源码位置、影响与依据](https://raw.githubusercontent.com/lcy0121/dsh-plugin-compat-check/main/plugin/assets/compat-detail-partial.png)
+
+## 安装与使用
 
 ```bash
 dsh plugin --profile <profile> add dsh-plugin-compat-check
 ```
 
+DSH 0.2.1-rc.2：**更多 → 设置 → 内置插件 → 兼容性**。请选择实际 profile，不默认使用 desktop；agent 可调用 `compat_check`。
+
+0.1.5 提供搜索/组合筛选、折叠发现、完整报告预览/显式复制、基线新增风险及“下一步核实”。安装/loader 事件和5秒巡检触发后台刷新，保留筛选与旧报告，失败显示原因。报告显示目标、参考目录版本/摘要和验收范围；重复插件身份无法判定且不推进基线。绑定探针超过5分钟的未来时钟偏差会被拒绝，保留静态发现及原因。分享前须预览敏感信息，筛选不会删减完整报告。
+
+依赖关系区分host/client、必需/可选/子作用域；提供声明仅为候选，路径/环不证明实际故障。人工复核记录单独保存，身份变化后待重审，不隐藏发现或覆盖判定、基线及豁免。健康面板**只导入历史 JSON**，不运行检查，历史通过不证明当前制品正常。步骤见 [使用指南](https://github.com/lcy0121/dsh-plugin-compat-check/blob/main/docs/guide.md)。
+
+## 升级前兼容性预检
+
+在面板输入目标 DSH 版本后运行，或调用 `compat_check({"upgradeTo":"0.2.1-rc.2"})`，需要时指定实际 `profile`；当前版本取自运行中的宿主。结果放在独立 `upgradePreview`，不覆盖普通 `report`。
+
+当前/目标两端仅支持精确 **0.2.0-rc.2、0.2.1-rc.2**。未知版本或范围返回 `status=unsupported-version`、退出3，不回退到邻近目录。对同一组插件私有字节副本静态提取，再按两端目录/声明独立判定，保留制品哈希、目录来源/摘要、当前/目标报告、差异和覆盖限制。worker有预算、卸载取消与清理，失败明确报错；不是 OS 原子快照。
+
+预检不执行插件或安装/升级宿主，不读运行时、探针、profile豁免、普通缓存/基线，不写产品状态。结果码 **0/1/2** 仅表示无新增/变重风险、非致命新增/变重、含致命新增/变重；**3** 为不可用。目标已有问题仍见 `targetReport`；**0不代表目标可用或升级后业务通过**，客户端功能需另验收。[契约及复现](https://github.com/lcy0121/dsh-plugin-compat-check/blob/main/docs/Plan.md#27-升级前静态预检契约)。
+
 ## 从源码构建安装
 
-本仓库根为私有开发工作区，不声明DSH bundle。不要把根目录GitHub安装规格当成plugin子目录的安装方式。在仓库根运行 `npm ci --ignore-scripts`，然后：
+仓库根是 private 开发工作区，不是可激活的插件包。在根安装依赖，再打完整 tgz：
 
 ```bash
+npm ci --ignore-scripts
 cd plugin
 npm pack --pack-destination <已存在的绝对输出目录>
 dsh plugin --profile <临时profile> add file:<生成的tgz绝对路径>
 ```
 
-prepack复制权威skill、同步单源报告契约的宿主/客户端产物，并暂存共享kernel和MIT LICENSE，postpack清理kernel。固定运行时依赖为 `@babel/parser@7.29.9` 与 `semver@7.7.3`，支持 Node `^22.19.0 || >=24`。源码裸复制或file安装不保证prepack运行，应使用完整仓库开发布局或预打包tarball。
+prepack 同步权威 skill/报告契约，暂存共享 kernel、LICENSE 和第三方说明，postpack 清理 kernel。根 GitHub spec、裸 `plugin/` 复制和源码 file 安装不能代替完整 tgz。
 
-npm产物**不带CLI bin、安装检查shell或probe入口**。CLI和安装检查从仓库使用；仓库源码现提供`--issue-report`默认脱敏Markdown导出，不读写基线、保留原退出码，须预览后自行分享，该功能不在npm包内。本插件不能做安装前检查。仓库使用说明：[README](https://github.com/lcy0121/dsh-plugin-compat-check#readme)。版本说明与发布状态请查看[开发计划与验收记录](https://github.com/lcy0121/dsh-plugin-compat-check/blob/main/docs/Plan.md)，本地路径为docs/Plan.md。
+npm 包**没有 CLI bin、安装检查 shell 或 probe 入口**，不支持 `npx dsh-plugin-compat-check`。CLI、安装检查、静态批量、作者CI、健康执行器及真实插件/浏览器/模型回归仅在[仓库](https://github.com/lcy0121/dsh-plugin-compat-check#readme)使用，不随 npm 分发。
 
-0.1.3增加目标版本声明适配、rc.2目录与卸载清理；历史0.1.2只修正文案和版本，算法与0.1.1一致；0.1.3改变了新版DSH声明判定。
+安装检查会联网、启动宿主并执行目标；临时 profile 不是 OS 沙箱。健康执行器默认审阅，须显式 `--run` 及当次授权才执行目标命令，也不是 OS 沙箱。风险/覆盖门禁、JSON/SARIF/JUnit和版本矩阵见[作者CI](https://github.com/lcy0121/dsh-plugin-compat-check/blob/main/docs/author-ci.md)。
 
 ## 判定与边界
 
-2026-10-18从候选完整tgz在私有rc.2宿主和真实Chrome验证：“更多 → 设置 → 内置插件 → 兼容性”可见标签和报告；禁用后报告路由消失，启用后恢复且标签唯一。59714e7中10月17日标签未显示的历史记录本次未复现，原因未定；不把这次局部UI验收当作所有业务功能认证。
-
-当前profile在宿主进程内采样服务描述符，不执行getter；未知访问器保留未知，并纳入能可靠映射的loader FAILED/PENDING。查询其它profile只用静态证据，不借用当前宿主服务。Babel AST扫描不执行目标源码，分析运行在有时间和内存上限的worker中；动态调用和跨函数数据流仍有限。
-
-`certainty`为certain或suspected；过滤、守卫、弃权另列。省略probe键为未采样，现代观测绑定profile/DSH版本且默认24小时过期，旧报告标记未绑定。0.1.3对DSH≥0.2.1-rc.1优先自有engines.dsh，缺失时回退官方peer；旧目标保持旧规则。声明冲突/非法字段的影响为推断，不冒充实测加载失败。只读profile独立compatibility.json，按插件名、插件精确版本及DSH精确版本匹配；无效记录整条忽略并限制覆盖，不可读/超64KiB则豁免未观测，不自动写入豁免。
-
-按已知目标选目录：DSH≥0.2.1-rc.2用rc.2快照（host98/client8），其余/未知用原0.2.0-rc.2快照（host91/client8）；未来版本未经认证。转述保留 `impactBasis=inferred`、coverage限制和vacuous。API发现通常有file:line，loader/声明事实可能无位置；声明获准不证明API或业务成功。客户端待界面核验；到货工具与新增的独立业务队列均不属于本面板。仓库业务队列覆盖固定dshmarket的备注/收藏，以及dsh-better-sidebar的保存/预览HTTP路径、编码/换行保留及失败后恢复；对照仅在浏览器注入POST503，业务标签不进入兼容性判定，结果不认证其它路径或原插件有缺陷。
-
-插件体检不安装包、不调用外部命令或联网；会启动分析worker，并默认写自己的schema2基线：`$DSH_HOME/dsh-plugin-compat-check/baseline.<profile>.<path-hash>.<mode>.json`。模式分离、锁内比较、原子替换；源码扫描不完整不推进基线。默认不输出共享loader诊断；诊断需显式私有DSC_OUT_DIR。若需完全禁止基线读写，请使用仓库CLI的 `--no-baseline`。
-
-0.1.1的分阶段证据包括默认回归、独立tarball执行及2026-10-15的真实DSH0.2.0-rc.2/macOS arm64验收：工具、skill、面板、详情角标、基线及Chrome正负向对照。2026-10-16另在Ubuntu24.04.5 arm64 VM通过Node22.19.0/24.21.0、真实DSH/tgz/HTTP及资源边界验收。同日提交38fa4a0的[GitHub Actions](https://github.com/lcy0121/dsh-plugin-compat-check/actions/runs/38892527900)在Ubuntu x64通过Node22/24资源检查及联合18项检查（4项真实DSH、1项冻结pnpm安装、13项离线）。后续main提交49403d7的[CI](https://github.com/lcy0121/dsh-plugin-compat-check/actions/runs/38923778251)再次通过Node22/24发布前与资源检查、Linux真实集成。Windows按约定待验收；skill正文修订后的仓库验证不冒充旧现场正文验收。具体测试数量与证据见仓库docs/current-state.json、docs/Plan.md；不把历史测试数字作为当前版本的完整功能认证。
+- 当前 profile 只采样服务描述符，不执行 getter，结合可靠映射且启用的 loader FAILED/PENDING。其它 profile 仅用静态证据，不借用当前宿主服务；未知、未采样或省略键不等于缺失。
+- Babel AST/包内值流在有时间/内存限额的 worker 中分析，不执行目标源码，动态覆盖仍有限。必需 inject 激活障碍与方法失效分别判断。
+- 保留 `certainty`、`impactBasis`、`coverage`、`vacuous`。API 发现通常有 `file:line`，声明/loader事实可能无位置；无发现不证明业务正常。
+- 声明规则与精确版本豁免依据目标 DSH 判定；非法字段不可豁免。普通检查的未知/未来版本回退及自定义目录保持未认证提示，内置目录摘要不符则无法判定。升级预检严格限定上述两个版本。[目录治理](https://github.com/lcy0121/dsh-plugin-compat-check/blob/main/docs/maintaining.md#api目录候选审查)须经来源核验、差分、规则复核及真实验收。
+- 宿主体检不装包、不调用外部命令或联网，默认写自身隔离基线；不完整扫描不推进。普通检查需禁基线读写时使用仓库 CLI 的 `--no-baseline`；升级预检始终隔离基线。
+- 报告保留完整发现、覆盖、观测与基线；面板拒绝损坏/不支持版本的负载。旧 probe 提示未绑定，旧基线中性重建。
 
-报告结构由仓库lib/contracts.mjs校验：HTTP envelope.report与compat_check.report均保留完整发现、覆盖、观测和基线；工具原summary/text字段保留。新面板拒绝损坏或不支持版本的负载，提示刷新和对齐版本。旧probe保持未绑定警告，旧schema1基线中性重建；内核现支持有界常量属性、函数参数/返回值、包内模块别名及透明Proxy；未知动态行为与超预算继续显示覆盖限制。具体字段与错误码见 [Plan契约记录](https://github.com/lcy0121/dsh-plugin-compat-check/blob/main/docs/Plan.md#23-报告结构与兼容策略)。
+已有 macOS/Linux 限定验证，Windows 待真实验收；固定样本不是生态准确率或完整业务/模型质量认证。[计数与证据](https://github.com/lcy0121/dsh-plugin-compat-check/blob/main/docs/current-state.json) · [完整契约](https://github.com/lcy0121/dsh-plugin-compat-check/blob/main/docs/Plan.md#2-现行判定与集成契约) · [源码及问题反馈](https://github.com/lcy0121/dsh-plugin-compat-check)。
 
 ## License
 
-MIT。源码、问题反馈与仓库文档：[GitHub](https://github.com/lcy0121/dsh-plugin-compat-check)。
+[MIT](https://github.com/lcy0121/dsh-plugin-compat-check/blob/main/LICENSE) · 第三方依赖及许可证见 [THIRD_PARTY_NOTICES.md](https://github.com/lcy0121/dsh-plugin-compat-check/blob/main/THIRD_PARTY_NOTICES.md)，两份文件也随 npm 包提供。

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,139 @@
+<!-- Generated by tools/third-party-notices.mjs; run npm run notices:generate after npm ci --ignore-scripts. -->
+
+# Third-Party Notices
+
+This project is licensed under [MIT](LICENSE). The third-party software below retains its own licenses and copyright notices.
+
+This inventory covers the production and development npm closure in the repository [package-lock.json](https://github.com/lcy0121/dsh-plugin-compat-check/blob/main/package-lock.json), checked against installed package metadata and license files. Plugin direct pins are checked against [plugin/package.json](https://github.com/lcy0121/dsh-plugin-compat-check/blob/main/plugin/package.json). Versions describe this checkout: fresh plugin installations also resolve the upstream packages' transitive ranges, so their installed license files remain authoritative.
+
+## Plugin runtime dependencies
+
+| Package | Locked version | License |
+| --- | --- | --- |
+| [`@babel/parser`](https://www.npmjs.com/package/@babel/parser/v/7.29.9) | 7.29.9 | MIT |
+| [`semver`](https://www.npmjs.com/package/semver/v/7.7.3) | 7.7.3 | ISC |
+
+### Transitive runtime dependencies
+
+| Package | Locked version | License |
+| --- | --- | --- |
+| [`@babel/helper-string-parser`](https://www.npmjs.com/package/@babel/helper-string-parser/v/7.29.7) | 7.29.7 | MIT |
+| [`@babel/helper-validator-identifier`](https://www.npmjs.com/package/@babel/helper-validator-identifier/v/7.29.7) | 7.29.7 | MIT |
+| [`@babel/types`](https://www.npmjs.com/package/@babel/types/v/7.29.8) | 7.29.8 | MIT |
+
+## Repository runtime dependencies
+
+These packages support repository-only tools and are not declared as npm plugin runtime dependencies.
+
+| Package | Locked version | License |
+| --- | --- | --- |
+| [`yaml`](https://www.npmjs.com/package/yaml/v/2.9.1) | 2.9.1 | ISC |
+
+## Development-only dependencies
+
+| Package | Locked version | License |
+| --- | --- | --- |
+| [`prettier`](https://www.npmjs.com/package/prettier/v/3.6.2) | 3.6.2 | MIT |
+
+Prettier also distributes its own bundled dependencies under MIT, ISC, BSD-3-Clause, BSD-2-Clause and Apache-2.0. Their individual notices are preserved in the installed `prettier/THIRD-PARTY-NOTICES.md`; the Prettier MIT license below does not replace those terms. Prettier is not shipped in this plugin.
+
+## Host-provided software and test inputs
+
+DeepSeek Harness and React are supplied by the host, not bundled here. The API catalog snapshots record their DSH source/version in `_source`; the upstream project is [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness), licensed under [MIT](https://github.com/deepseek-ai/deepseek-harness/blob/master/LICENSE). External Node.js, Python, pnpm and Chrome installations retain their respective notices. Real-plugin acceptance downloads separately identified npm artifacts into private test directories; those artifacts are not redistributed as repository fixtures or inside this npm package.
+
+## License texts
+
+### @babel/helper-string-parser@7.29.7, @babel/helper-validator-identifier@7.29.7, @babel/types@7.29.8 (MIT)
+
+> MIT License
+>
+> Copyright (c) 2014-present Sebastian McKenzie and other contributors
+>
+> Permission is hereby granted, free of charge, to any person obtaining
+> a copy of this software and associated documentation files (the
+> "Software"), to deal in the Software without restriction, including
+> without limitation the rights to use, copy, modify, merge, publish,
+> distribute, sublicense, and/or sell copies of the Software, and to
+> permit persons to whom the Software is furnished to do so, subject to
+> the following conditions:
+>
+> The above copyright notice and this permission notice shall be
+> included in all copies or substantial portions of the Software.
+>
+> THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+> EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+> MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+> NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+> LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+> OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+> WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+### @babel/parser@7.29.9 (MIT)
+
+> Copyright (C) 2012-2014 by various contributors (see AUTHORS)
+>
+> Permission is hereby granted, free of charge, to any person obtaining a copy
+> of this software and associated documentation files (the "Software"), to deal
+> in the Software without restriction, including without limitation the rights
+> to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+> copies of the Software, and to permit persons to whom the Software is
+> furnished to do so, subject to the following conditions:
+>
+> The above copyright notice and this permission notice shall be included in
+> all copies or substantial portions of the Software.
+>
+> THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+> IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+> FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+> AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+> LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+> OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+> THE SOFTWARE.
+
+### prettier@3.6.2 (MIT)
+
+> Copyright © James Long and contributors
+>
+> Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+>
+> The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+>
+> THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+### semver@7.7.3 (ISC)
+
+> The ISC License
+>
+> Copyright (c) Isaac Z. Schlueter and Contributors
+>
+> Permission to use, copy, modify, and/or distribute this software for any
+> purpose with or without fee is hereby granted, provided that the above
+> copyright notice and this permission notice appear in all copies.
+>
+> THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+> WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+> MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+> ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+> WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+> ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
+> IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+### yaml@2.9.1 (ISC)
+
+> Copyright Eemeli Aro <eemeli@gmail.com>
+>
+> Permission to use, copy, modify, and/or distribute this software for any purpose
+> with or without fee is hereby granted, provided that the above copyright notice
+> and this permission notice appear in all copies.
+>
+> THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+> REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND
+> FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+> INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
+> OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
+> TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF
+> THIS SOFTWARE.
+
+## Maintenance
+
+Run `npm ci --ignore-scripts`, then `npm run notices:generate` after dependency or license changes. `npm run notices:check` verifies the committed text without changing it. Prepack copies the source notice into the plugin tarball; each separately installed dependency retains its own license files. This document follows the section structure of the [DSH third-party inventory](https://github.com/deepseek-ai/deepseek-harness/blob/master/THIRD_PARTY_NOTICES.md), with this repository's dependency set.