dsh-plugin-upgrade 0.1.0 → 0.1.2

package/AGENTS.md

@@ -28,7 +28,8 @@ fixtures/             scanner fixtures (bad-repo, good-repo)
 cordis.patch.yml      bundle declaration (insert dsh-plugin-upgrade); every Config key inline
 pnpm-workspace.yaml   nearest-workspace root (isolates this repo from a surrounding harness checkout)
 package.json          npm metadata; files whitelist = published content
-.github/workflows/    CI (3 OS × 2 Node), monthly compat probe, v* npm release
+.github/workflows/    CI (3 OS × 2 Node), monthly compat probe, v* npm release,
+                      plugin-doctor static R/K gate, OpenSSF Scorecard
 README.md             English primary (GitHub default page; source of truth)
 README.{zh,es,pt,hi}.md  translations, top switcher, updated in the same commit
 CHANGELOG.md          Keep a Changelog, [Unreleased] at the top
@@ -66,7 +67,7 @@ LICENSE               Apache-2.0
 
 ```sh
 pnpm install
-pnpm test                          # node --test (9 tests: scanner + real-registry mount)
+pnpm test                          # node --test (11 tests: scanner + real-registry mount)
 pnpm run verify:self-contained     # dependency specs resolve from the registry
 pnpm run verify:artifacts          # shipped files present + entry importable from the tarball
 pnpm run check:readmes             # five-language README consistency
@@ -80,7 +81,7 @@ after every harness release.
 
 ## Release
 
-Version is currently `0.1.0`. For a new version: bump `package.json#version`, stamp the
+Version is currently `0.1.2`. For a new version: bump `package.json#version`, stamp the
 CHANGELOG `[Unreleased]` section into `## [<x.y.z>] - <UTC date>`, re-run the full gate,
 commit `chore(release): <x.y.z>`, and `git tag -a v<x.y.z>`. `git push origin main
 --follow-tags` triggers `.github/workflows/release.yml`, which re-runs the gate, publishes to

package/CHANGELOG.md

@@ -7,6 +7,32 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.1.2] - 2026-09-09
+
+### Fixed
+
+- **The shipped version card no longer describes itself as unpublished.** Its status line
+  now names the three published channels and points at the packaged CLI
+  (`dsh-plugin-upgrade-scan`) for reproduction instead of a workspace-private evidence
+  path that no reader of the tarball can follow.
+
+### Changed
+
+- Family-standard CI: the `plugin-doctor` static R/K gate and OpenSSF Scorecard now run in
+  this repository, and `dsh-plugin-upgrade` is enrolled in the
+  `dsh-plugin-doctor` verified registry (badge: passing).
+
+## [0.1.1] - 2026-09-09
+
+### Fixed
+
+- **SKILL.md frontmatter on a CRLF checkout.** The parser required the `---\n`
+  delimiter, so a Windows checkout (`core.autocrlf=true`) mounted the skill with the
+  frontmatter leaked into the body and no description/`whenToUse`. Line endings are now
+  normalized before parsing, `.gitattributes` pins every text file to LF, and the suite
+  covers both a CRLF string and a CRLF-converted bundle on disk. Caught by the Windows
+  CI leg of v0.1.0.
+
 ## [0.1.0] - 2026-09-09
 
 ### Added

package/index.mjs

@@ -37,16 +37,19 @@ export const Config = Schema.object({
 
 /**
  * Strip the YAML frontmatter block from SKILL.md and return its routing fields
- * and body. A missing block falls back to the full text as the body.
+ * and body. Line endings are normalized first: a Windows checkout with
+ * `core.autocrlf=true` hands us CRLF, and the frontmatter delimiters are `\n`.
+ * A missing block falls back to the full text as the body.
  * @param text - raw SKILL.md content.
  * @returns the parsed description/whenToUse (when present) and the instruction body.
  */
 export function splitFrontmatter(text) {
-  if (!text.startsWith('---\n')) return { description: undefined, whenToUse: undefined, body: text }
-  const end = text.indexOf('\n---', 4)
-  if (end < 0) return { description: undefined, whenToUse: undefined, body: text }
-  const meta = text.slice(4, end)
-  const body = text.slice(end + 4).replace(/^\n+/, '')
+  const source = text.replace(/\r\n/g, '\n')
+  if (!source.startsWith('---\n')) return { description: undefined, whenToUse: undefined, body: source }
+  const end = source.indexOf('\n---', 4)
+  if (end < 0) return { description: undefined, whenToUse: undefined, body: source }
+  const meta = source.slice(4, end)
+  const body = source.slice(end + 4).replace(/^\n+/, '')
   const scalar = (key) => new RegExp(`^${key}:\\s*(.+)$`, 'm').exec(meta)?.[1]?.trim()
   return { description: scalar('description'), whenToUse: scalar('whenToUse'), body }
 }
@@ -61,12 +64,13 @@ export function splitFrontmatter(text) {
  */
 export function readSkillBundle(skillsRoot, skillName) {
   const skillPath = join(skillsRoot, skillName, 'SKILL.md')
-  let text
+  let raw
   try {
-    text = readFileSync(skillPath, 'utf8')
+    raw = readFileSync(skillPath, 'utf8')
   } catch (error) {
     throw new Error(`dsh-plugin-upgrade: cannot read skill bundle at ${skillPath}: ${error instanceof Error ? error.message : String(error)}`)
   }
+  const text = raw.replace(/\r\n/g, '\n')
   const { description, whenToUse, body } = splitFrontmatter(text)
   if (body.trim() === '') throw new Error(`dsh-plugin-upgrade: skill body is empty at ${skillPath}`)
   const frontmatterName = /^name:\s*(\S+)\s*$/m.exec(text.slice(0, text.indexOf('\n---', 4) + 1))?.[1]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-plugin-upgrade",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Plugin-author upgrade skill for DeepSeek Harness: a version-locked 0.1.3-alpha.1 -> 0.1.5-alpha.1 version card plus a zero-dependency seam scanner (V3 session format, assistant/message.stream, SessionHandleReadResult, ctx.agent, Inbox, SubprocessHandle.pid, SystemPrompt persona, PTC rename, EpochHeader.system, and the tsconfig stale-path false green), packaged as a bundle skill and an npx CLI.",
   "repository": {
     "type": "git",

package/skills/plugin-upgrade-015/references/v0.1.3-alpha.1-to-v0.1.5-alpha.1.md

@@ -1,8 +1,8 @@
 # Version card · `0.1.3-alpha.1` → `0.1.5-alpha.1`
 
 > 适用：任何 `@deepseek-ai/dsh-*` peer 落在 `>=0.1.2-rc.1 <0.2.0`、且需要同时支持 `0.1.5-alpha.1` 的插件仓。
-> 状态：**本地留档（未发布）**。证据来自 2026-09-09 批次 40 个真实插件仓的实测升级波（宿主 checkout `0.1.5-alpha.1`，HEAD `19d2e38480`；官方 tag `dsh-v0.1.5-alpha.1` = `5dda764ed3`）。
-> 证据目录：`_scratch/batch-2026-09-09/`（`COMPLETION-REPORT.md` §2、`cards/*.md`、`probe/*.json`、`doctor/`、`charset/`、`phase-e/`）。
+> 状态：**已发布**（当前发布版本见本包 `package.json`；npm `dsh-plugin-upgrade` · GitHub `PerryLink/dsh-plugin-upgrade` · Gitee 镜像）。
+> 证据：2026-09-09 批次 **40 个真实插件仓**的实测升级波（宿主 checkout `0.1.5-alpha.1`，HEAD `19d2e38480`；官方 tag `dsh-v0.1.5-alpha.1` = `5dda764ed3`）。复现方式：本包 CLI `dsh-plugin-upgrade-scan --repo <仓库>` 输出 `file:line`，再按本卡逐缝处理。
 
 ## 0. 这一跳与其它跳的关系