dsh-plugin-compat-check 0.1.4 → 0.1.5

package/README.md

@@ -1,43 +1,63 @@
 # dsh-plugin-compat-check
 
-检查**已经安装的 DSH 插件**与当前 DSH 版本的兼容性，提供源码位置、运行时证据与覆盖限制。包含兼容性标签、插件详情发现/角标、`compat_check` 对话工具和 skill provider。
+如果你觉得这个项目有用或有趣，欢迎点个 [Star ⭐](https://github.com/lcy0121/dsh-plugin-compat-check) 支持一下！
 
-![插件详情页：部分可用，含 file:line、影响与依据](https://raw.githubusercontent.com/lcy0121/dsh-plugin-compat-check/main/plugin/assets/compat-detail-partial.png)
+检查**已安装的 DSH 插件**与目标 DSH 版本的兼容性，提供源码位置、依据及覆盖限制。声明放行、激活成功不等于业务功能正常。
 
-本说明对应 **0.1.4**，支持 Node `^22.19.0 || >=24`。公开版本及 latest 以 [npm](https://www.npmjs.com/package/dsh-plugin-compat-check) 为准，发布和验收记录见 [Plan](https://github.com/lcy0121/dsh-plugin-compat-check/blob/main/docs/Plan.md)。
+[简体中文](https://github.com/lcy0121/dsh-plugin-compat-check/blob/main/README.md) | [English](https://github.com/lcy0121/dsh-plugin-compat-check/blob/main/README.en.md) | [한국어](https://github.com/lcy0121/dsh-plugin-compat-check/blob/main/README.ko.md)
+
+**0.1.5** · Node `^22.19.0 || >=24`。提供兼容性标签、插件详情发现/角标、`compat_check` 对话工具和 skill provider。发布与验收记录见 [Plan](https://github.com/lcy0121/dsh-plugin-compat-check/blob/main/docs/Plan.md)。
+
+![插件详情：部分可用、源码位置、影响与依据](https://raw.githubusercontent.com/lcy0121/dsh-plugin-compat-check/main/plugin/assets/compat-detail-partial.png)
+
+## 安装与使用
 
 ```bash
 dsh plugin --profile <profile> add dsh-plugin-compat-check
 ```
 
-DSH 0.2.1-rc.2 入口：**更多 → 设置 → 内置插件 → 兼容性**。agent 可调用 `compat_check`；请选择实际 profile，不默认使用 desktop。
+DSH 0.2.1-rc.2：**更多 → 设置 → 内置插件 → 兼容性**。请选择实际 profile，不默认使用 desktop；agent 可调用 `compat_check`。
+
+0.1.5 提供搜索/组合筛选、折叠发现、完整报告预览/显式复制、基线新增风险及“下一步核实”。安装/loader 事件和5秒巡检触发后台刷新，保留筛选与旧报告，失败显示原因。报告显示目标、参考目录版本/摘要和验收范围；重复插件身份无法判定且不推进基线。绑定探针超过5分钟的未来时钟偏差会被拒绝，保留静态发现及原因。分享前须预览敏感信息，筛选不会删减完整报告。
+
+依赖关系区分host/client、必需/可选/子作用域；提供声明仅为候选，路径/环不证明实际故障。人工复核记录单独保存，身份变化后待重审，不隐藏发现或覆盖判定、基线及豁免。健康面板**只导入历史 JSON**，不运行检查，历史通过不证明当前制品正常。步骤见 [使用指南](https://github.com/lcy0121/dsh-plugin-compat-check/blob/main/docs/guide.md)。
 
-0.1.4 补充必需 inject 未观测时的激活前提说明，修正 Origin 校验以比较协议、主机和有效端口（保留本机无 Origin 调用），并提供 `repository.directory=plugin`。仓库另增强了进程回收、Chrome 启动诊断及 Linux CI；浏览器开发工具不随 npm 插件交付。市场显示名与 1024 Store 采集问题须由相应上游修复，不因本包升级自动解决。
+## 升级前兼容性预检
+
+在面板输入目标 DSH 版本后运行，或调用 `compat_check({"upgradeTo":"0.2.1-rc.2"})`，需要时指定实际 `profile`；当前版本取自运行中的宿主。结果放在独立 `upgradePreview`，不覆盖普通 `report`。
+
+当前/目标两端仅支持精确 **0.2.0-rc.2、0.2.1-rc.2**。未知版本或范围返回 `status=unsupported-version`、退出3，不回退到邻近目录。对同一组插件私有字节副本静态提取，再按两端目录/声明独立判定，保留制品哈希、目录来源/摘要、当前/目标报告、差异和覆盖限制。worker有预算、卸载取消与清理，失败明确报错；不是 OS 原子快照。
+
+预检不执行插件或安装/升级宿主，不读运行时、探针、profile豁免、普通缓存/基线，不写产品状态。结果码 **0/1/2** 仅表示无新增/变重风险、非致命新增/变重、含致命新增/变重；**3** 为不可用。目标已有问题仍见 `targetReport`；**0不代表目标可用或升级后业务通过**，客户端功能需另验收。[契约及复现](https://github.com/lcy0121/dsh-plugin-compat-check/blob/main/docs/Plan.md#27-升级前静态预检契约)。
 
 ## 从源码构建安装
 
-仓库根是 private 开发工作区，不是可激活的插件包。先在根运行 `npm ci --ignore-scripts`，然后：
+仓库根是 private 开发工作区，不是可激活的插件包。在根安装依赖，再打完整 tgz：
 
 ```bash
+npm ci --ignore-scripts
 cd plugin
 npm pack --pack-destination <已存在的绝对输出目录>
 dsh plugin --profile <临时profile> add file:<生成的tgz绝对路径>
 ```
 
-prepack 同步权威 skill/报告契约，暂存共享 kernel 和 MIT LICENSE，postpack 清理 kernel。运行时依赖固定为 `@babel/parser@7.29.9`、`semver@7.7.3`。不要将根 GitHub spec、裸 `plugin/` 复制或源码 file 安装等同完整 tgz。
+prepack 同步权威 skill/报告契约，暂存共享 kernel、LICENSE 和第三方说明，postpack 清理 kernel。根 GitHub spec、裸 `plugin/` 复制和源码 file 安装不能代替完整 tgz。
 
-npm 产物**没有 CLI bin、安装检查 shell 或 probe 入口**，不支持 `npx dsh-plugin-compat-check`，本面板不做安装前检查。这些入口及 `--issue-report` 默认脱敏 Markdown 导出从[仓库](https://github.com/lcy0121/dsh-plugin-compat-check#readme)使用。显式安装检查会联网、启动宿主并执行目标插件；临时 profile 不是 OS 沙箱。
+npm 包**没有 CLI bin、安装检查 shell 或 probe 入口**，不支持 `npx dsh-plugin-compat-check`。CLI、安装检查、静态批量、作者CI、健康执行器及真实插件/浏览器/模型回归仅在[仓库](https://github.com/lcy0121/dsh-plugin-compat-check#readme)使用，不随 npm 分发。
+
+安装检查会联网、启动宿主并执行目标；临时 profile 不是 OS 沙箱。健康执行器默认审阅，须显式 `--run` 及当次授权才执行目标命令，也不是 OS 沙箱。风险/覆盖门禁、JSON/SARIF/JUnit和版本矩阵见[作者CI](https://github.com/lcy0121/dsh-plugin-compat-check/blob/main/docs/author-ci.md)。
 
 ## 判定与边界
 
-- 当前 profile 在宿主进程内采样服务描述符，不执行 getter，纳入可靠映射且启用的 loader FAILED/PENDING。其它 profile 仅用静态证据，不借用当前宿主服务；未知、未采样或省略键不等于缺失。
-- Babel AST 扫描不执行目标源码，分析运行在有时间/内存上限的 worker 中；有界包内值流支持部分别名、参数/返回值和透明 Proxy，动态行为仍有限。必需 inject 的激活障碍与方法失效分别判断。
-- 转述保留 `certainty`、`impactBasis`、`coverage` 和 `vacuous`。API 发现通常有 `file:line`，loader/声明事实可能无位置；声明放行、激活成功、条目到货和 ok 均不证明业务正常，客户端功能须另验收。
-- 从 DSH 0.2.1-rc.1 起优先自有 `engines.dsh`，缺失才回退官方 peer，旧目标保留旧规则。声明冲突/非法字段是推断风险，不冒充实际加载失败。只读独立 `compatibility.json`，按插件名、插件精确版本、DSH 精确版本匹配豁免；无效/不可读/超64KiB保留限制，不自动授予，非法字段不可豁免。
-- DSH≥0.2.1-rc.2 用新目录（host98/client8），其余/未知用旧0.2.0-rc.2目录（host91/client8）；未来 DSH 未认证。rc.2 的真实 Chrome 验收覆盖导航、报告渲染、禁用后路由移除及重启用后恢复/标签唯一；不认证所有插件业务。
-- 体检不装包、不调用外部命令或联网；默认写自身 schema2 基线：`$DSH_HOME/dsh-plugin-compat-check/baseline.<profile>.<path-hash>.<mode>.json`。模式隔离、锁内比较、原子替换，不完整扫描不推进。完全禁基线读写须用仓库 CLI 的 `--no-baseline`。
-- HTTP envelope.report 和 `compat_check.report` 保留完整发现、覆盖、观测和基线，原 summary/text 保留；新面板拒绝损坏或不支持版本的负载。旧 probe 提示未绑定，旧 schema1 基线中性重建，不兼容报告变更须升 schema。
+- 当前 profile 只采样服务描述符，不执行 getter，结合可靠映射且启用的 loader FAILED/PENDING。其它 profile 仅用静态证据，不借用当前宿主服务；未知、未采样或省略键不等于缺失。
+- Babel AST/包内值流在有时间/内存限额的 worker 中分析，不执行目标源码，动态覆盖仍有限。必需 inject 激活障碍与方法失效分别判断。
+- 保留 `certainty`、`impactBasis`、`coverage`、`vacuous`。API 发现通常有 `file:line`，声明/loader事实可能无位置；无发现不证明业务正常。
+- 声明规则与精确版本豁免依据目标 DSH 判定；非法字段不可豁免。普通检查的未知/未来版本回退及自定义目录保持未认证提示，内置目录摘要不符则无法判定。升级预检严格限定上述两个版本。[目录治理](https://github.com/lcy0121/dsh-plugin-compat-check/blob/main/docs/maintaining.md#api目录候选审查)须经来源核验、差分、规则复核及真实验收。
+- 宿主体检不装包、不调用外部命令或联网，默认写自身隔离基线；不完整扫描不推进。普通检查需禁基线读写时使用仓库 CLI 的 `--no-baseline`；升级预检始终隔离基线。
+- 报告保留完整发现、覆盖、观测与基线；面板拒绝损坏/不支持版本的负载。旧 probe 提示未绑定，旧基线中性重建。
+
+已有 macOS/Linux 限定验证，Windows 待真实验收；固定样本不是生态准确率或完整业务/模型质量认证。[计数与证据](https://github.com/lcy0121/dsh-plugin-compat-check/blob/main/docs/current-state.json) · [完整契约](https://github.com/lcy0121/dsh-plugin-compat-check/blob/main/docs/Plan.md#2-现行判定与集成契约) · [源码及问题反馈](https://github.com/lcy0121/dsh-plugin-compat-check)。
 
-限定 macOS/Linux、真实 DSH/Chrome、独立 tgz 和工程验收的逐次版本及证据见 [current-state.json](https://github.com/lcy0121/dsh-plugin-compat-check/blob/main/docs/current-state.json)。Windows 待真实验收。独立业务/模型度量属于仓库开发工具，不随 npm 分发、不进入产品判定，默认测试/CI不调用模型；固定样本不是生态准确率或完整模型质量认证。
+## License
 
-[完整契约与复现](https://github.com/lcy0121/dsh-plugin-compat-check/blob/main/docs/Plan.md#2-现行判定与集成契约) · [源码及问题反馈](https://github.com/lcy0121/dsh-plugin-compat-check) · [MIT License](https://github.com/lcy0121/dsh-plugin-compat-check/blob/main/LICENSE)
+[MIT](https://github.com/lcy0121/dsh-plugin-compat-check/blob/main/LICENSE) · 第三方依赖及许可证见 [THIRD_PARTY_NOTICES.md](https://github.com/lcy0121/dsh-plugin-compat-check/blob/main/THIRD_PARTY_NOTICES.md)，两份文件也随 npm 包提供。

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,139 @@
+<!-- Generated by tools/third-party-notices.mjs; run npm run notices:generate after npm ci --ignore-scripts. -->
+
+# Third-Party Notices
+
+This project is licensed under [MIT](LICENSE). The third-party software below retains its own licenses and copyright notices.
+
+This inventory covers the production and development npm closure in the repository [package-lock.json](https://github.com/lcy0121/dsh-plugin-compat-check/blob/main/package-lock.json), checked against installed package metadata and license files. Plugin direct pins are checked against [plugin/package.json](https://github.com/lcy0121/dsh-plugin-compat-check/blob/main/plugin/package.json). Versions describe this checkout: fresh plugin installations also resolve the upstream packages' transitive ranges, so their installed license files remain authoritative.
+
+## Plugin runtime dependencies
+
+| Package | Locked version | License |
+| --- | --- | --- |
+| [`@babel/parser`](https://www.npmjs.com/package/@babel/parser/v/7.29.9) | 7.29.9 | MIT |
+| [`semver`](https://www.npmjs.com/package/semver/v/7.7.3) | 7.7.3 | ISC |
+
+### Transitive runtime dependencies
+
+| Package | Locked version | License |
+| --- | --- | --- |
+| [`@babel/helper-string-parser`](https://www.npmjs.com/package/@babel/helper-string-parser/v/7.29.7) | 7.29.7 | MIT |
+| [`@babel/helper-validator-identifier`](https://www.npmjs.com/package/@babel/helper-validator-identifier/v/7.29.7) | 7.29.7 | MIT |
+| [`@babel/types`](https://www.npmjs.com/package/@babel/types/v/7.29.8) | 7.29.8 | MIT |
+
+## Repository runtime dependencies
+
+These packages support repository-only tools and are not declared as npm plugin runtime dependencies.
+
+| Package | Locked version | License |
+| --- | --- | --- |
+| [`yaml`](https://www.npmjs.com/package/yaml/v/2.9.1) | 2.9.1 | ISC |
+
+## Development-only dependencies
+
+| Package | Locked version | License |
+| --- | --- | --- |
+| [`prettier`](https://www.npmjs.com/package/prettier/v/3.6.2) | 3.6.2 | MIT |
+
+Prettier also distributes its own bundled dependencies under MIT, ISC, BSD-3-Clause, BSD-2-Clause and Apache-2.0. Their individual notices are preserved in the installed `prettier/THIRD-PARTY-NOTICES.md`; the Prettier MIT license below does not replace those terms. Prettier is not shipped in this plugin.
+
+## Host-provided software and test inputs
+
+DeepSeek Harness and React are supplied by the host, not bundled here. The API catalog snapshots record their DSH source/version in `_source`; the upstream project is [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness), licensed under [MIT](https://github.com/deepseek-ai/deepseek-harness/blob/master/LICENSE). External Node.js, Python, pnpm and Chrome installations retain their respective notices. Real-plugin acceptance downloads separately identified npm artifacts into private test directories; those artifacts are not redistributed as repository fixtures or inside this npm package.
+
+## License texts
+
+### @babel/helper-string-parser@7.29.7, @babel/helper-validator-identifier@7.29.7, @babel/types@7.29.8 (MIT)
+
+> MIT License
+>
+> Copyright (c) 2014-present Sebastian McKenzie and other contributors
+>
+> Permission is hereby granted, free of charge, to any person obtaining
+> a copy of this software and associated documentation files (the
+> "Software"), to deal in the Software without restriction, including
+> without limitation the rights to use, copy, modify, merge, publish,
+> distribute, sublicense, and/or sell copies of the Software, and to
+> permit persons to whom the Software is furnished to do so, subject to
+> the following conditions:
+>
+> The above copyright notice and this permission notice shall be
+> included in all copies or substantial portions of the Software.
+>
+> THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+> EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+> MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+> NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+> LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+> OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+> WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+### @babel/parser@7.29.9 (MIT)
+
+> Copyright (C) 2012-2014 by various contributors (see AUTHORS)
+>
+> Permission is hereby granted, free of charge, to any person obtaining a copy
+> of this software and associated documentation files (the "Software"), to deal
+> in the Software without restriction, including without limitation the rights
+> to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+> copies of the Software, and to permit persons to whom the Software is
+> furnished to do so, subject to the following conditions:
+>
+> The above copyright notice and this permission notice shall be included in
+> all copies or substantial portions of the Software.
+>
+> THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+> IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+> FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+> AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+> LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+> OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+> THE SOFTWARE.
+
+### prettier@3.6.2 (MIT)
+
+> Copyright © James Long and contributors
+>
+> Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+>
+> The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+>
+> THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+### semver@7.7.3 (ISC)
+
+> The ISC License
+>
+> Copyright (c) Isaac Z. Schlueter and Contributors
+>
+> Permission to use, copy, modify, and/or distribute this software for any
+> purpose with or without fee is hereby granted, provided that the above
+> copyright notice and this permission notice appear in all copies.
+>
+> THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+> WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+> MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+> ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+> WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+> ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
+> IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+### yaml@2.9.1 (ISC)
+
+> Copyright Eemeli Aro <eemeli@gmail.com>
+>
+> Permission to use, copy, modify, and/or distribute this software for any purpose
+> with or without fee is hereby granted, provided that the above copyright notice
+> and this permission notice appear in all copies.
+>
+> THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+> REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND
+> FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+> INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
+> OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
+> TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF
+> THIS SOFTWARE.
+
+## Maintenance
+
+Run `npm ci --ignore-scripts`, then `npm run notices:generate` after dependency or license changes. `npm run notices:check` verifies the committed text without changing it. Prepack copies the source notice into the plugin tarball; each separately installed dependency retains its own license files. This document follows the section structure of the [DSH third-party inventory](https://github.com/deepseek-ai/deepseek-harness/blob/master/THIRD_PARTY_NOTICES.md), with this repository's dependency set.