dsh-plugin-rea 2.0.0 → 2.0.2

package/CHANGELOG.md

@@ -2,6 +2,21 @@
 
 本插件遵循语义化版本。版本号变化说明「配置组合」这层的变化，与 REA 自身的版本无关。
 
+## 2.0.2 — 2026-10-15
+
+**仅文档，无行为变更。**
+
+- 两份 README 的**末尾**（许可证之前）新增一节，说明**什么时候该用 1.x 线**以及它的安装方式
+  （`dsh-plugin-rea@1.0.6` 或 `github:czcdr/dsh-plugin-rea#v1.0.6`）—— 此前 1.x 只出现在开头的版本说明与升级章节里。
+## 2.0.1 — 2026-10-15
+
+**仅文档与版式，无行为变更。**
+
+- 两份 README 的**语言行正下方**现在先说明「这是哪个版本、1.x 与 2.x 各做什么」——此前版本说明排在
+  首屏那张大截图之后，npm 页面首屏看不到，容易被误判成「README 没改」；对比表与升级章节位置不变。
+- `docs/bundle-design.md` 的措辞跟上「`main` 已经是一体包线」这一事实（原先写的是「本分支新增、
+  `main` 不变」）。
+- 为什么纯文档也发一个补丁版：npm 的包页渲染的是**发布进 tarball 的 README**，不重新发布就更新不了首屏。
 ## 2.0.0 — 2026-10-15
 
 **一体包线的首个正式版**（此前的 `2.0.0-bundle.1` / `2.0.0-bundle.2` 是它的两个预发布）。

package/README.md

@@ -4,17 +4,17 @@
 
 **English** · [简体中文](README.zh-CN.md)
 
+> **Which version is this? 2.x — and `main` is it.** 2.x provisions the runtime itself (Node, the REA CLI, a
+> JDK, Ghidra) and then wires the row: install the plugin, run `scripts/setup.mjs` once, restart dsh.
+> **1.x** is the older configuration-only adapter — it expects `rea` on PATH and Ghidra installed by you —
+> kept on the [`v1` branch](https://github.com/czcdr/dsh-plugin-rea/tree/v1) and on npm as `dsh-plugin-rea@1.0.6`.
+> Full comparison: [Two lines: 1.x and 2.x](#two-lines-1x-and-2x) · upgrading: [Upgrading from 1.x](#upgrading-from-1x).
+
 Brings the upstream **[REA — Reverse Engineer Anything](https://github.com/morluto/rea)** MCP server into
 **DeepSeek Harness** (dsh), so its tools show up in a session as `mcp__rea__*`.
 
 ![dsh-plugin-rea: the session calls the official MCP client row, which launches the bundle's shim; the shim starts the provisioned REA and the Evidence comes back](assets/screenshot-1.png)
 
-> **This is the 2.x line, and `main` is it.** The all-in-one variant: it provisions the runtime (Node, the REA
-> CLI, a JDK, Ghidra) and then wires the row itself. The original configuration-only adapter — 1.x, which
-> assumed you had installed Node, `rea-agents` and Ghidra yourself — is preserved on the
-> [`v1` branch](https://github.com/czcdr/dsh-plugin-rea/tree/v1) and on npm as `dsh-plugin-rea@1.0.6`.
-> The two lines are compared in [Two lines: 1.x and 2.x](#two-lines-1x-and-2x).
-
 ## What this is
 
 A **Cordis bundle with a provisioning layer**. `package.json` declares `dsh.bundle.patch`, and that patch
@@ -248,6 +248,22 @@ back on the next start.
 
 `check-updates.ps1` (Windows PowerShell) reports the state of all of these at once.
 
+## Still prefer the configuration-only 1.x line?
+
+1.x is the adapter **without** provisioning: one row that launches `rea mcp` from PATH and expects Ghidra to be
+installed by you. It is the right choice when you already manage REA and Ghidra yourself, when you do not want
+the plugin fetching anything, or when you want the row to keep pointing at your own `rea` binary:
+
+```
+dsh plugin --profile <profile> add dsh-plugin-rea@1.0.6
+# or pin the branch instead of the version:
+dsh plugin --profile <profile> add github:czcdr/dsh-plugin-rea#v1.0.6
+```
+
+Both lines publish the same patch shape and the same `mcp__rea__*` surface. 1.x is maintained on the
+[`v1` branch](https://github.com/czcdr/dsh-plugin-rea/tree/v1), where its own install notes live (Node on REA's
+engines, `npm i -g rea-agents`, Ghidra 12.1.x for native analysis).
+
 ## License
 
 MIT (this adapter). REA is MIT and owned by its authors; Ghidra is Apache-2.0 and owned by the NSA; Temurin

package/README.zh-CN.md

@@ -4,16 +4,17 @@
 
 [English](README.md) · **简体中文**
 
+> **这是哪个版本？2.x —— 而 `main` 就是它。** 2.x 自己准备运行时（Node、REA CLI、JDK、Ghidra）再把那一行接好：
+> 装插件 → 跑一次 `scripts/setup.mjs` → 重启 dsh。
+> **1.x** 是更早的纯配置适配器 —— 它假设 `rea` 在 PATH 上、Ghidra 由你自己装好 —— 保留在
+> [`v1` 分支](https://github.com/czcdr/dsh-plugin-rea/tree/v1)，npm 上仍是 `dsh-plugin-rea@1.0.6`。
+> 完整对比：[两条线：1.x 与 2.x](#两条线1x-与-2x) · 升级：[从 1.x 升级](#从-1x-升级)。
+
 把上游 **[REA — Reverse Engineer Anything](https://github.com/morluto/rea)** 的 MCP 服务接入
 **DeepSeek Harness**（dsh），让它的工具在会话里以 `mcp__rea__*` 出现。
 
 ![dsh-plugin-rea：会话经官方 MCP 客户端行启动本包供给的 shim，再由 shim 拉起 bundle 内置的 REA，最后把 Evidence 带回会话](assets/screenshot-1.png)
 
-> **这是 2.x 线，而 `main` 就是它。** 一体包版本：它会自己准备运行时（Node、REA CLI、JDK、Ghidra），
-> 再把那一行接好。原本的纯配置适配器（1.x —— 假设 Node、`rea-agents`、Ghidra 都是你自己装好的）保留在
-> [`v1` 分支](https://github.com/czcdr/dsh-plugin-rea/tree/v1)，npm 上仍是 `dsh-plugin-rea@1.0.6`。
-> 两条线的对比见[两条线：1.x 与 2.x](#两条线1x-与-2x)。
-
 ## 这是什么
 
 一个**带供给层的 Cordis bundle**。`package.json` 声明 `dsh.bundle.patch`，该 patch 插入一行官方 MCP 客户端
@@ -232,6 +233,21 @@ node scripts/setup.mjs          # 或：powershell -File scripts\rea-bundle-boot
 
 `check-updates.ps1`（Windows PowerShell）会一次性报告以上各项的状态。
 
+## 还想用纯配置的 1.x 线？
+
+1.x 是**不带供给**的适配器：一行配置，从 PATH 上启动 `rea mcp`，并假设 Ghidra 由你自己装好。这些情况它是更合适的选择 ——
+你已经自己管理 REA 与 Ghidra、不希望插件去下载任何东西、或者想让那一行继续指向你自己的 `rea`：
+
+```
+dsh plugin --profile <profile> add dsh-plugin-rea@1.0.6
+# 或钉住分支而不是版本号：
+dsh plugin --profile <profile> add github:czcdr/dsh-plugin-rea#v1.0.6
+```
+
+两条线发布的 patch 形态与 `mcp__rea__*` 工具面完全相同。1.x 维护在
+[`v1` 分支](https://github.com/czcdr/dsh-plugin-rea/tree/v1)，它自己的安装说明也在那里（Node 满足 REA engines、
+`npm i -g rea-agents`、原生分析需要 Ghidra 12.1.x）。
+
 ## 许可证
 
 MIT（本适配器）。REA 是 MIT、归其作者；Ghidra 是 Apache-2.0、归 NSA；Temurin 是 GPLv2+CE；Node.js 是

package/docs/bundle-design.md

@@ -3,9 +3,10 @@
 Goal: a fresh machine installs **one DSH plugin** and gets a working `mcp__rea__*`
 tool surface, without first installing Node, REA, a JDK, or Ghidra by hand.
 
-`main` keeps the original **config-only adapter** (a single MCP row pointing at a
-`rea` the user installed themselves). This branch adds the self-provisioning
-variant next to it. Nothing on `main` changes.
+`main` **is** this variant: the self-provisioning one-plugin bundle. The earlier
+**config-only adapter** (a single MCP row pointing at a `rea` the user installed
+themselves) is preserved on the [`v1` branch](https://github.com/czcdr/dsh-plugin-rea/tree/v1)
+and on npm as `dsh-plugin-rea@1.0.6`; nothing here changes that line.
 
 ---
 
@@ -52,7 +53,7 @@ Three responsibilities, kept strictly apart:
    the component manifest, downloads what is missing into a cache, verifies
    checksums, unpacks, runs the readiness probe, and writes `bundle.json`.
    Idempotent and re-runnable; `--reuse` adopts pre-existing installs.
-3. **Patch (wiring, published).** `cordis.patch.yml` from this branch, carrying
+3. **Patch (wiring, published).** `cordis.patch.yml` on `main`, carrying
    **no machine path**: the row points at `<plugin>/bin/rea-shim.mjs` and the
    shim is responsible for the rest.
 
@@ -173,7 +174,7 @@ Ghidra itself is **not** redistributed inside the plugin package: the release is
 ~570 MB, which no npm package can carry. It is fetched from the official release
 and checksum-verified, or adopted from an existing install with `--reuse`.
 
-## 8. Honest limits of this branch
+## 8. Honest limits of this approach
 
 - npm's per-package limits (unpacked/compressed size) rule out shipping the JDK
   and Ghidra inside the tarball. "One plugin install" therefore means *one

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-plugin-rea",
-  "version": "2.0.0",
+  "version": "2.0.2",
   "description": "One-plugin bundle: provisions Node/REA/JDK/Ghidra for you, then registers the upstream REA MCP server as mcp__rea__* tools. · 一体包：自动准备 Node/REA/JDK/Ghidra，并把上游 REA 的 MCP 服务接入 DeepSeek Harness。",
   "type": "module",
   "license": "MIT",