npm - dsh-plugin-upgrade - Versions diffs - 2.0.0 → 2.0.2 - Mend

dsh-plugin-upgrade 2.0.0 → 2.0.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (15) hide show

package/AGENTS.md +74 -43
package/CHANGELOG.md +58 -0
package/README-es.md +71 -55
package/README-hi.md +66 -50
package/README-pt.md +71 -55
package/README-zh.md +66 -50
package/README.md +66 -50
package/THIRD_PARTY_NOTICES.md +2 -2
package/docs/EVIDENCE.md +69 -0
package/lib/route.mjs +20 -4
package/lib/scan-0.1.6.mjs +39 -4
package/package.json +11 -8
package/scripts/verify-artifacts.mjs +3 -2
package/skills/plugin-upgrade/SKILL.md +12 -12
package/skills/plugin-upgrade/references/v0.1.5-rc.2-to-v0.1.6-alpha.2.md +2 -2

package/AGENTS.md CHANGED Viewed

@@ -2,37 +2,52 @@
 Standalone DeepSeek Harness plugin repository (`dsh-plugin-upgrade`). Development
 follows the dsh-plugin-guide skill and the official plugin contract; this file records
-repo-local decisions. Read `README.md` (external contract) and the packaged merged corridor
-card (`skills/plugin-upgrade/references/v0.1.3-alpha.1-to-v0.1.5-rc.1.md`) before changing
-behavior.
-## A corridor never widens (and one package may carry several closed corridors)
-- **A corridor never widens.** This package upgrades plugins across `0.1.3-alpha.1 →
-  0.1.5-rc.1` and nothing else. Do not widen the peer band or the card to "all versions":
-  a drifting card is worse than no card. A hop that adds a seam is a new package.
-- **One package may carry several *closed* corridors.** That is what this repository is: one
-  npm package holding leg A (`0.1.3-alpha.1 → 0.1.5-alpha.1`) and leg B (`0.1.5-alpha.1 →
-  0.1.5-rc.1`) as **two closed corridors of one span**, each keeping its own evidence, card
-  section, fixtures and rollback path. Neither leg may absorb a third hop.
-- **This supersedes the family's earlier rule.** The retired `dsh-plugin-upgrade` and
-  `dsh-plugin-upgrade-rc1` each carried a "**The corridor is locked** … a new corridor is a
-  new package" section plus "**zero code dependency on the sibling corridor**: no `import`,
-  no vendoring, no shared `SEAMS`". The owner deliberately superseded the second half of that
-  pair: the merged package **does** share one `SEAMS` (one scanner, one catalog, one
-  id-parity gate) because the two legs are contiguous hops of one span. What survives
+repo-local decisions. Read `README.md` (external contract) and **both** packaged corridor
+cards (`skills/plugin-upgrade/references/v0.1.3-alpha.1-to-v0.1.5-rc.1.md` and
+`skills/plugin-upgrade/references/v0.1.5-rc.2-to-v0.1.6-alpha.2.md`) before changing behavior.
+## One package, one corridor index (a corridor still never widens)
+- **A corridor never widens.** A corridor is one *closed, measured* span with its own card,
+  catalog, evidence, fixtures and rollback path. Never stretch a card to "all versions":
+  a drifting card is worse than no card.
+- **A new corridor adds a card and an index row, not a package.** Owner decision
+  (2026-09-19), recorded in `lib/route.mjs`: this package carries the corridor **index**.
+  `resolveCorridor()` reads the target repository's declared band (`engines.dsh`, the
+  `@deepseek-ai/dsh*` ranges) and routes to the matching corridor; `--span legAB|legC`
+  overrides the guess, and an undeclared band falls back to the older corridor.
+  - **`legAB`** — `0.1.3-alpha.1 → 0.1.5-rc.1`, carried as leg A (`0.1.3-alpha.1 →
+    0.1.5-alpha.1`) and leg B (`0.1.5-alpha.1 → 0.1.5-rc.1`): 20 seams, catalog
+    `lib/scan.mjs`, card `…/references/v0.1.3-alpha.1-to-v0.1.5-rc.1.md` (§1 leg A, §2 leg B,
+    §3 the 20-seam index), evidence `docs/EVIDENCE.md` §A + §1–§10.
+  - **`legC`** — `0.1.5-rc.2 → 0.1.6-alpha.2`: 5 seams (`E1`–`E5`, all `error`), catalog
+    `lib/scan-0.1.6.mjs`, card `…/references/v0.1.5-rc.2-to-v0.1.6-alpha.2.md`, evidence
+    `docs/EVIDENCE.md` §11. The retired `dsh-plugin-upgrade-016` name never reached the
+    registry; this corridor is folded in here.
+- **The seam arrays are never merged.** Two corridors mean two catalogs, two cards and two
+  parity gates, so every card claim stays traceable to its own measurement. What the
+  corridors *do* share is the entry point: one skill id (`plugin-upgrade`), one CLI
+  (`dsh-plugin-upgrade-scan`), one report shape.
+- **This supersedes the family's earlier rule.** The retired `dsh-plugin-upgrade`,
+  `dsh-plugin-upgrade-rc1` and `dsh-plugin-upgrade-016` each carried a "**The corridor is
+  locked** … a new corridor is a new package" section plus "**zero code dependency on the
+  sibling corridor**: no `import`, no vendoring, no shared `SEAMS`". The owner deliberately
+  superseded that pair: one package now carries the index, and each corridor keeps its own
+  `SEAMS` while the *plumbing* (router, entry point, report shape) is shared. What survives
   unchanged is the numbering discipline — a corridor is *closed*, not open-ended — and the
   per-leg ownership below.
 Consequences accepted by this repository:
-- The merged catalog (20 seams: `S3`, `S8`, `S9`, `M1`, `S4`, `S5`, `S6`, `S7`, `S2`, `S1`,
+- The `legAB` catalog (20 seams: `S3`, `S8`, `S9`, `M1`, `S4`, `S5`, `S6`, `S7`, `S2`, `S1`,
   `S10`, `C1`, `C2`, `P1`, `C4`, `C5`, `H1`, `H2`, `H4`, `H3`) is evidence-bound to the two
   tag ranges it was measured on — leg A `dsh-v0.1.5-alpha.1` (2026-09-09 wave over 40 plugin
-  repos) and leg B `dsh-v0.1.5-alpha.1..dsh-v0.1.5-rc.1` (2026-09-10). A hop after
-  `0.1.5-rc.1` (rc.2, the final release, anything later) is a **new package**, not a wider
-  card. The harness hop `0.1.5-rc.1 → 0.1.5-rc.2` added no plugin-facing seam, which is why
-  the span ends at rc.1 while the dev/test pin and the CI probe run on `0.1.5-rc.2`.
+  repos) and leg B `dsh-v0.1.5-alpha.1..dsh-v0.1.5-rc.1` (2026-09-10). The harness hop
+  `0.1.5-rc.1 → 0.1.5-rc.2` added no plugin-facing seam, which is why that span ends at rc.1
+  while the dev/test pin runs on the `0.1.7-alpha.2` line and the compat probe matrix covers
+  every published line the peer band admits (`0.1.2-rc.1`, `0.1.5-rc.2`, `0.1.6-alpha.2`,
+  `0.1.7-alpha.2`). The `legC` catalog (`E1`–`E5`)
+  is evidence-bound to `dsh-v0.1.6-alpha.2` (2026-09-19, §11).
 - **Leg A owns the session-format seams** (`assistant/message.stream`, `S3`;
   `SessionHandleReadResult`, `S8`; `EpochHeader.system`, `S2`; `ctx.agent`, `S5`; `Inbox`,
   `S6`; `SystemPrompt.persona`, `S9`; the V3 log generation, `S1`) and **leg B does not
@@ -47,7 +62,9 @@ Consequences accepted by this repository:
 - The peer band is **unchanged** by both legs. `>=0.1.2-rc.1 <0.2.0` alone rejects
   `0.1.5-rc.1` under npm semver's prerelease-tuple rule (measured `false` on semver 7.8.5);
   the `|| >=0.1.5-alpha.1 <0.2.0` segment is what admits it. `P1` forbids dropping it, and
-  this package's own `peerDependencies` keeps both segments.
+  this package's own `peerDependencies` keeps all four segments
+  (`>=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0 || >=0.1.7-0 <0.2.0`),
+  each newly published prerelease tuple having gained its own clause under the same rule.
 - The `C1` ruling (the bare `conversation` slot removal is a **public extension-point
   break**, kept at `error`, with a rewrite recipe and a real-browser exit criterion) is
   recorded in card §2 §3.3. Do not downgrade it to an advisory without new upstream
@@ -58,8 +75,14 @@ Consequences accepted by this repository:
 ```
 index.mjs             single host face: Config schema + skill bundle reader + apply()
 types.d.ts            Config, SeamId, SeamHit, ScanReport and the public function surface
-lib/scan.mjs          zero-dependency merged seam catalog (both legs) + scanner + CLI main()
-scripts/scan-0.1.5.mjs   thin bin wrapper (npx dsh-plugin-upgrade-scan)
+lib/route.mjs         the corridor index: CORRIDORS, declaredBand(), resolveCorridor(),
+                      --span/--repo parsing, loadCatalog()
+lib/scan.mjs          zero-dependency `legAB` seam catalog (legs A+B) + scanner + CLI main()
+lib/scan-0.1.6.mjs    zero-dependency `legC` seam catalog (E1–E5) + scanner + CLI main()
+scripts/scan-0.1.5.mjs   thin bin wrapper (npx dsh-plugin-upgrade-scan): resolves the
+                         corridor through lib/route.mjs and hands the same argv to that
+                         corridor's catalog main(). The filename is historical; the wrapper
+                         routes both corridors
 skills/plugin-upgrade/scripts/scan-0.1.5.mjs  the same wrapper inside the skill
                       directory, so the skill body's `./scripts/...` resolves against its
                       resourceBase
@@ -71,17 +94,19 @@ scripts/verify-artifacts.mjs       pack + inspect the published tarball (also as
                                    leg-A seam fails the packaged CLI)
 scripts/check-readme-sync.mjs      five-language README consistency
 skills/plugin-upgrade/SKILL.md  the bundled skill body (frontmatter name is the skill id;
-                                    it routes the caller to the leg matching its peer band)
-skills/plugin-upgrade/references/v0.1.3-alpha.1-to-v0.1.5-rc.1.md  the merged card:
+                                    it routes the caller to the corridor matching its peer band)
+skills/plugin-upgrade/references/v0.1.3-alpha.1-to-v0.1.5-rc.1.md  the `legAB` card:
                                     §1 Leg A, §2 Leg B, §3 the 20-seam index
+skills/plugin-upgrade/references/v0.1.5-rc.2-to-v0.1.6-alpha.2.md  the `legC` card:
+                                    the 5-seam `E1`–`E5` index and the fix/verify recipes
 test/scan.test.mjs    synthetic bad/good fixtures for BOTH legs + --seams + a live negative
 test/plugin.test.mjs  real Cordis Context + real SkillRegistry: register, dispose, negatives
-test/card.test.mjs    the card↔catalog id/severity parity gate
+test/card.test.mjs    the card↔catalog id/severity parity gate for BOTH corridors
 fixtures/             scanner fixtures — never published:
                         bad-repo / good-repo            leg B (client-slot oriented)
                         leg-a-bad-repo / leg-a-good-repo  leg A (TypeScript/session oriented)
 docs/EVIDENCE.md      the command→output record every card claim traces to
-                      (§A = leg A's provenance, §1–§10 = leg B's records)
+                      (§A = leg A's provenance, §1–§10 = leg B's records, §11 = leg C's)
 cordis.patch.yml      bundle declaration (insert dsh-plugin-upgrade); every
                       Config key inline
 pnpm-workspace.yaml   nearest-workspace root (isolates this repo from a surrounding harness checkout)
@@ -118,9 +143,10 @@ LICENSE               Apache-2.0
   adaptation: this span's breakage is silent from both ends, so a session-log writer needs a
   resume round-trip (`S3`), a client half needs a real browser assertion, and the card's exit
   criterion is a real-host smoke on a temp `DSH_HOME`.
-- **The card and the catalog are one catalog.** `test/card.test.mjs` fails when their ids or
-  severities disagree, and when the card mints an id outside the merged 20. Change the card
-  first, then the catalog, in the same commit.
+- **The card and the catalog are one catalog — per corridor.** `test/card.test.mjs` fails when
+  a card's index and that corridor's catalog disagree on ids or severities, when a card mints
+  an id outside its own catalog, and when `legC`'s `CARD_ONLY` is not empty. The two corridors'
+  catalogs are never merged. Change the card first, then the catalog, in the same commit.
 - **Mount loud.** A missing `SKILL.md`, an empty body, or a frontmatter without `name` must
   abort the mount. Never register a placeholder skill.
 - **The skill id is the frontmatter name.** `skillName` selects the directory; the registered
@@ -140,6 +166,9 @@ LICENSE               Apache-2.0
 ```sh
 npm install                        # or: pnpm install (pnpm-lock.yaml is committed)
 npm test                           # node --test: scanner (both legs) + card parity + real-registry mount
+npm run check                      # tsc -p tsconfig.check.json: the checked-JS shipping surface (index.mjs, lib/**, scripts/**)
+npm run typecheck:ci               # tsc -p tsconfig.check.ci.json: same program, published host types (empty paths)
+npm run typecheck:checkout         # tsc -p tsconfig.checkout.json: shipping surface + checkout/host-surface.mts, against the local harness checkout's built types
 npm run verify:self-contained      # every import resolves inside the package
 npm run verify:artifacts           # tarball contents + entry import + dev-only content excluded
 npm run check:readmes              # five-language README consistency
@@ -153,9 +182,9 @@ after every harness release.
 ## Release
-Version is currently `0.1.0`. The npm name `dsh-plugin-upgrade` is brand new, so
-this package starts its own version line at `0.1.0`; the two retired packages' histories live
-in `CHANGELOG.md` under `[Unreleased]` and below. For a new version: bump
+Version is currently `2.0.1` (`2.0.0` was the package that returned as the corridor index;
+`2.0.1` re-published the corrected npm description). The retired packages' histories live in
+`CHANGELOG.md` under `[Unreleased]` and below. For a new version: bump
 `package.json#version`, stamp the CHANGELOG `[Unreleased]` section into `## [<x.y.z>] - <UTC
 date>`, re-run the full gate, commit `chore(release): <x.y.z>`, and `git tag -a v<x.y.z>`.
 `git push origin main --follow-tags` triggers `.github/workflows/release.yml`, which re-runs
@@ -182,9 +211,11 @@ same commit.
 row expects `PerryLink/dsh-plugin-doctor` to carry a
 `PerryLink__dsh-plugin-upgrade.svg` badge, and the family also enrols each package
 in the Gitee mirror, the `dsh-catalog` directory and the omdsh workshop list. Those are
-release-side steps performed from the family workspace after the first tag. The two retired
-package names stay on the registry (unpublished content is not removed by publishing a new
-name); their README/card wording is now historical.
+release-side steps performed from the family workspace after the first tag. The three
+retired package names (`dsh-plugin-upgrade` leg A, `dsh-plugin-upgrade-rc1` leg B, and the
+never-published `dsh-plugin-upgrade-016` corridor) stay on the registry or in history only
+(unpublished content is not removed by publishing a new name); their README/card wording is
+now historical.
 ## Docs
@@ -196,7 +227,7 @@ name); their README/card wording is now historical.
   `package.json` keywords; the ecosystem's visibility channel is the `dsh-plugin` topic).
 - License is Apache-2.0 (`LICENSE` + the package.json `license` field).
   `THIRD_PARTY_NOTICES.md` documents install-time dependencies; nothing is bundled.
-- Every factual claim in the card or the scanner traces to a command recorded in
+- Every factual claim in a card or the scanner traces to a command recorded in
   `docs/EVIDENCE.md` — §A for leg A's provenance (via the retired `dsh-plugin-upgrade` card,
-  now merged in as Leg A) and §1–§10 for leg B's records. Where a claim could not be verified
-  it is marked **unverified** and kept out of the card.
+  now merged in as Leg A), §1–§10 for leg B's records, and §11 for leg C's. Where a claim
+  could not be verified it is marked **unverified** and kept out of the card.

package/CHANGELOG.md CHANGED Viewed

@@ -5,6 +5,64 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+## [2.0.2] - 2026-09-23
+### Added
+- A checkout ruler: `checkout/host-surface.mts`, `tsconfig.checkout.json` and `typecheck:checkout` (`tsc -p tsconfig.checkout.json --noEmit`). The probe mirrors the real call sites — the Schemastery `Config` from `index.mjs`, the exact `SkillRegistration` object `apply()` hands `ctx.skills.register()`, and a real `Context` + `SkillRegistry` + `ctx.effect()` as in `test/plugin.test.mjs` — and the three `@deepseek-ai/*` specifiers this package really imports (`index.mjs` → `schemastery`; `test/plugin.test.mjs` → `cordis`, `dsh-skill`) are aliased to the local harness checkout's built types. The `@deepseek-ai/*` names under `fixtures/` are synthetic scanner inputs, including packages that no longer exist, so they are deliberately not mapped. It is never executed; it exists so a host-line shape change fails against the checkout instead of at a user's first mount.
+### Changed
+- The published line this package checks against moves to `0.1.7-alpha.2`: the `@deepseek-ai/dsh-skill` dev/test pin moves from `0.1.5-rc.2`, `@deepseek-ai/cordis` to `^4.0.4` and `@deepseek-ai/schemastery` to `^3.18.4`; the `0.1.7` tuple gains its own clause on the `@deepseek-ai/dsh-skill` peer band; `dshWorkshop.compatibility.dshVersions` records `0.1.7-alpha.2`; and the `compat.yml` probe matrix now covers `0.1.2-rc.1`, `0.1.5-rc.2`, `0.1.6-alpha.2` and `0.1.7-alpha.2`. This is a correctness fix, not a tightening: under npm semver's prerelease rule a comparator set whose only prerelease comparators sit on earlier `[major, minor, patch]` tuples cannot admit a later alpha, so the three-clause band could not admit the very host this release targets. The three existing clauses are unchanged, in place and in order; `P1` still forbids collapsing them. The lockfile now resolves exactly one `cordis` and one `schemastery` copy, so the two-copy `Volatile` typing trap cannot occur here.
+- The five-language READMEs name the `0.1.7-alpha.2` line and quote the four-clause band; `AGENTS.md`, `THIRD_PARTY_NOTICES.md` and the checks block are brought in line with the declared state (the prose commit `070309e`), including the `AGENTS.md` peer-segment note that still said the package keeps "both segments" and the dev/test-pin sentence that still said `0.1.5-rc.2`.
+### Fixed
+- `pnpm run check` (`tsc -p tsconfig.check.json`) had been red since the corridor index landed: 24 `TS7006` (implicitly-`any` parameter) errors, all of them in two committed checked-JS source files that no build step generates (`lib/route.mjs` 8, `lib/scan-0.1.6.mjs` 16). The same 24 errors reddened `pnpm run typecheck:ci`, whose config includes the same file set. The defects were genuine rather than checker noise — those two files were the only checked-JS sources in the repo whose functions carried no JSDoc. Every annotation was derived from the function body and its call sites and mirrors the sibling catalog `lib/scan.mjs`, which already passes the same checker; the change is comment-only (all 58 added lines sit inside JSDoc blocks), `allowJs`, `checkJs` and `noImplicitAny: true` are untouched, no file was dropped from `include`, and no `@ts-nocheck` or `@ts-ignore` was added. With the shipping surface type-checking, the checkout ruler compiles what actually ships (`index.mjs`, `lib/**`, `scripts/**`) instead of only the probe, which is what the ruler was for.
+- **The documentation still described the retired "one package per hop" model.** `2.0.0`
+  introduced the corridor index (`lib/route.mjs`) and folded the `0.1.5-rc.2` →
+  `0.1.6-alpha.2` corridor in as `legC`, but the surrounding prose had not caught up: the
+  internal `AGENTS.md` still said the package "upgrades plugins across `0.1.3-alpha.1` →
+  `0.1.5-rc.1` and nothing else" and that "a hop after `0.1.5-rc.1` … is a new package"; the
+  `legC` card still called itself the new package `dsh-plugin-upgrade-016`; the skill
+  frontmatter still carried a single `corridor:` key and a `whenToUse` that told the model a
+  later hop is a new package; and all five READMEs described one merged corridor with two
+  legs, never naming `legC`. Corrected here, with the two corridors now named consistently
+  everywhere (`legAB` = `0.1.3-alpha.1` → `0.1.5-rc.1`, `legC` = `0.1.5-rc.2` →
+  `0.1.6-alpha.2`) and the "a new corridor adds a card and an index row, not a package" rule
+  stated wherever the old rule was.
+- **`test/card.test.mjs` had no gate for the second corridor.** The evidence-binding parity
+  check only pinned the `legAB` card to `lib/scan.mjs`. It now also pins the `legC` card to
+  `lib/scan-0.1.6.mjs` (ids, order, severities), asserts `legC`'s `CARD_ONLY` is empty,
+  asserts the two catalogs share no seam id, and asserts the skill frontmatter names both
+  corridors while the superseded "a new package" phrasing is gone.
+  `scripts/verify-artifacts.mjs` checks the packaged `SKILL.md` frontmatter for both
+  corridors instead of the retired single `corridor:` key.
+- No functional change: `index.mjs`, `lib/**`, `cordis.patch.yml`, `fixtures/**` and the
+  cards' seam facts are untouched. `package.json` changes only documentation fields
+  (`dshWorkshop.capability.expected`, and `compatibility.dshVersions` gains
+  `0.1.6-alpha.2`, which `peerDependencies` already admitted). The gate chain is re-run in
+  full; the published `2.0.1` tarball is unaffected and this lands with the next release.
+- **The family-size claim was one release behind.** All five READMEs said this package is
+  "one of the **40** DeepSeek Harness plugins"; the family roster is **41** (`PerryLink/dsh-kit`
+  states 41 in both the tagline and the same family line, and `dsh-wechat` left the family).
+  Corrected in all five in the same commit.
+## [2.0.1] - 2026-09-20
+### Fixed
+- **The package description named the retired corridor card instead of this one.** `package.json`
+  described 2.0.0 as "the merged version-locked `0.1.3-alpha.1` -> `0.1.5-rc.1` corridor card …
+  over one 20-seam catalog" and never mentioned the second corridor. 2.0.0 is the opposite of
+  version-locked: the scanner reads the caller peer band and routes between two closed corridors
+  (`0.1.3-alpha.1` -> `0.1.5-rc.1` as legs A+B, and `0.1.5-rc.2` -> `0.1.6-alpha.2` as leg C).
+  The text was corrected in the repository on 2026-09-20 (`b543400`); npm metadata is immutable
+  per version, so 2.0.1 is the release that carries the corrected description to the registry,
+  and with it to every catalog that copies an author's own words.
+- No functional change: `lib/route.mjs`, `lib/scan.mjs`, `lib/scan-0.1.6.mjs`, the cards, the
+  skill body and the CLI are byte-identical to 2.0.0.
 ## [2.0.0] - 2026-09-19
 ### Changed

package/README-es.md CHANGED Viewed

@@ -3,16 +3,18 @@
 # ⬆️ dsh-plugin-upgrade
 - **Canal de la tienda 1024**: ejecuta `npm i -g dsh1024` una vez y luego `dsh1024 plugin --profile web add dsh-plugin-upgrade` (cuenta para el ranking de instalaciones de [deepseek1024.com](https://deepseek1024.com)).
 [![Gitee](https://img.shields.io/badge/Gitee-mirror-c71d23?logo=gitee)](https://gitee.com/perrylink/dsh-plugin-upgrade)
+[![dshfind](https://dshfind.com/api/badge/PerryLink/dsh-plugin-upgrade?metric=downloads&lang=es)](https://dshfind.com/es/plugins/PerryLink/dsh-plugin-upgrade?ref=badge)
-**Habilidad de actualización de plugins para DeepSeek Harness, fusionada y con versión bloqueada — `0.1.3-alpha.1` → `0.1.5-rc.1`, llevada como dos tramos cerrados.**
+**Habilidad de actualización de plugins para DeepSeek Harness — un paquete, un índice de corredores, dos corredores cerrados: `0.1.3-alpha.1` → `0.1.5-rc.1` (`legAB`) y `0.1.5-rc.2` → `0.1.6-alpha.2` (`legC`).**
-*Tramo A `0.1.3-alpha.1` → `0.1.5-alpha.1`, tramo B `0.1.5-alpha.1` → `0.1.5-rc.1`: una tarjeta de corredor más un escáner de costuras sin dependencias sobre el catálogo fusionado de 20 costuras, para que una mitad de cliente que dejó de montarse en silencio nunca se confunda con «typecheck en verde».*
+*El escáner se enruta solo: lee la banda dsh declarada por el repositorio destino (o toma `--span`) y luego aplica el catálogo propio de ese corredor, vinculado a evidencia — las 20 costuras de `legAB` (tramo A `0.1.3-alpha.1` → `0.1.5-alpha.1` más tramo B `0.1.5-alpha.1` → `0.1.5-rc.1`) o las 5 costuras de `legC` (`E1`–`E5`). Un solo punto de entrada, para que una mitad de cliente que dejó de montarse en silencio nunca se confunda con «typecheck en verde».*
-> **Repositorio oficial.** Este es el único repositorio oficial de dsh-plugin-upgrade, mantenido por PerryLink. Sustituye a los dos paquetes con versión bloqueada `dsh-plugin-upgrade` (tramo A) y `dsh-plugin-upgrade-rc1` (tramo B). Los repositorios con el mismo nombre en otras cuentas no están afiliados.
+> **Repositorio oficial.** Este es el único repositorio oficial de dsh-plugin-upgrade, mantenido por PerryLink. Sustituye a los dos paquetes retirados con versión bloqueada `dsh-plugin-upgrade` (tramo A) y `dsh-plugin-upgrade-rc1` (tramo B), y es el paquete en el que se integró el corredor `0.1.5-rc.2` → `0.1.6-alpha.2` (tramo C): el nombre `dsh-plugin-upgrade-016` nunca llegó al registro. Los repositorios con el mismo nombre en otras cuentas no están afiliados.
 [![License](https://img.shields.io/badge/license-Apache%202.0-blue.svg)](LICENSE)
 [![DSH plugin](https://img.shields.io/badge/dsh--plugin-✅-green)](https://github.com/topics/dsh-plugin)
 [![dsh-doctor](https://raw.githubusercontent.com/PerryLink/dsh-plugin-doctor/main/badges/PerryLink__dsh-plugin-upgrade.svg)](https://github.com/PerryLink/dsh-plugin-doctor#verified-徽章)
+[![DSH Market](https://raw.githubusercontent.com/2BingLing/dsh-market/master/assets/readme/badge-listed-en.svg)](https://dsh.market/)
 [![Node](https://img.shields.io/badge/node-%5E22.19%20%7C%7C%20%3E%3D24-brightgreen.svg)](#)
 [![CI](https://img.shields.io/github/actions/workflow/status/PerryLink/dsh-plugin-upgrade/ci.yml?branch=main&label=CI)](https://github.com/PerryLink/dsh-plugin-upgrade/actions)
 [![Version](https://img.shields.io/github/v/tag/PerryLink/dsh-plugin-upgrade?label=version)](https://github.com/PerryLink/dsh-plugin-upgrade/releases)
@@ -29,21 +31,22 @@
 | Superficie | Estado |
 |---|---|
-| Harness | DeepSeek Harness `0.1.5-rc.1` (tag `dsh-v0.1.5-rc.1` = `183f08e9c6dd`; relevo tramo A→B `dsh-v0.1.5-alpha.1` = `5dda764ed3aa`; inicio del corredor `0.1.3-alpha.1`). Banda de peers `@deepseek-ai/dsh-skill >=0.1.2-rc.1 <0.2.0 \|\| >=0.1.5-alpha.1 <0.2.0`, `@deepseek-ai/cordis ^4.0.2`, `@deepseek-ai/schemastery ^3.18.2`. |
+| Harness | DeepSeek Harness `0.1.5-rc.1` (tag `dsh-v0.1.7-alpha.2` = `183f08e9c6dd`; relevo tramo A→B `dsh-v0.1.7-alpha.2` = `5dda764ed3aa`; inicio del corredor `0.1.3-alpha.1`) y, para `legC`, DeepSeek Harness `0.1.6-alpha.2` (tag `dsh-v0.1.7-alpha.2`). Banda de peers `@deepseek-ai/dsh-skill >=0.1.2-rc.1 <0.2.0 \|\| >=0.1.5-alpha.1 <0.2.0 \|\| >=0.1.6-0 <0.2.0 \|\| >=0.1.7-0 <0.2.0`, `@deepseek-ai/cordis ^4.0.2`, `@deepseek-ai/schemastery ^3.18.2`. |
 | Node | `^22.19.0 \|\| >=24.0.0` |
 | Plataformas | Donde corra Node; el escáner solo usa el sistema de archivos y es neutral respecto a la plataforma |
 | Modelo | Modelos solo de texto totalmente soportados; la habilidad es un Markdown, sin requisitos de herramientas ni visión |
-| Alcance | **Dos tramos cerrados, un solo lapso**: tramo A `0.1.3-alpha.1` → `0.1.5-alpha.1` más tramo B `0.1.5-alpha.1` → `0.1.5-rc.1`. Un corredor nunca se ensancha: un salto posterior a `0.1.5-rc.1` es un paquete nuevo. |
-| Tramos | Ambos tramos viven en este paquete: el tramo A conserva las costuras `S1`–`S10` + `M1`, el tramo B conserva `C1`, `C2`, `C4`, `C5`, `H1`–`H4`, `P1` — cada uno con su propia evidencia, sección de tarjeta, fixtures y ruta de reversión. No hay paquete hermano que instalar. |
+| Índice de corredores | Un paquete, un punto de entrada. `lib/route.mjs` contiene los corredores cerrados y la CLI enruta al que corresponde según la banda declarada del repo destino (`engines.dsh`, los rangos `@deepseek-ai/dsh*`); `--span legAB\|legC` anula la conjetura y una banda no declarada recae en el corredor más antiguo. Los dos catálogos nunca se fusionan: cada corredor conserva su propio array de costuras, tarjeta, evidencia, fixtures y puerta de paridad. |
+| Alcance | **Dos corredores cerrados**: `legAB` = `0.1.3-alpha.1` → `0.1.5-rc.1` (tramo A + tramo B), `legC` = `0.1.5-rc.2` → `0.1.6-alpha.2`. Un corredor nunca se ensancha: un salto que añade una costura es un corredor nuevo — una tarjeta nueva y una fila nueva en el índice, no un paquete nuevo. |
+| Tramos | Cada tramo vive en este paquete: el tramo A conserva las costuras `S1`–`S10` + `M1`, el tramo B conserva `C1`, `C2`, `C4`, `C5`, `H1`–`H4`, `P1`, y el tramo C conserva `E1`–`E5` — cada uno con su propia evidencia, sección de tarjeta, fixtures y ruta de reversión. No hay paquete hermano que instalar. |
 | `C3` | Retirada: la tarjeta del tramo B escribía como `C3` el falso verde de la línea de tipos obsoleta, que es el mismo defecto que el `M1` del tramo A. La fusión queda registrada en la tarjeta; `--seams C3` no coincide con nada. |
 | Paquete anterior | No montes el retirado `dsh-plugin-upgrade` en el mismo perfil: ambos registran la skill `plugin-upgrade`, así que el segundo montaje colisiona con ese nombre. Ese paquete está obsoleto en npm y su repositorio se retiró; este paquete sustituye sus dos tramos. |
 ## Lo que obtienes
-Dos mitades, un solo catálogo de costuras:
+Dos mitades, un catálogo de costuras por corredor:
 - **Una habilidad de agente incluida (`plugin-upgrade`)** — la tarjeta del corredor fusionado y un bucle de arreglar-y-verificar. El cuerpo primero enruta a quien la llama al tramo que corresponde a su banda de peers; el modelo la carga solo cuando una tarea la necesita de verdad, y el paquete no aporta ningún párrafo al prompt del sistema ni registra herramientas.
-- **Una CLI sin dependencias (`dsh-plugin-upgrade-scan`)** — informa hechos `file:line` de las veinte costuras fusionadas (`S3`, `S8`, `S9`, `M1`, `S4`, `S5`, `S6`, `S7`, `S2`, `S1`, `S10`, `C1`, `C2`, `P1`, `C4`, `C5`, `H1`, `H2`, `H4`, `H3`) releídas de los rangos de tags del harness el 2026-09-09 (tramo A) y el 2026-09-10 (tramo B). Sale con `1` ante cualquier hallazgo de severidad error, así que entra directo en CI.
+- **Una CLI sin dependencias (`dsh-plugin-upgrade-scan`)** — resuelve el corredor e informa hechos `file:line` de las costuras de ese corredor: las veinte de `legAB` (`S3`, `S8`, `S9`, `M1`, `S4`, `S5`, `S6`, `S7`, `S2`, `S1`, `S10`, `C1`, `C2`, `P1`, `C4`, `C5`, `H1`, `H2`, `H4`, `H3`) releídas de los rangos de tags del harness el 2026-09-09 (tramo A) y el 2026-09-10 (tramo B), o las cinco de `legC` (`E1`–`E5`) medidas en `dsh-v0.1.7-alpha.1` (2026-09-19). Sale con `1` ante cualquier hallazgo de severidad error, así que entra directo en CI.
 El objetivo es el modo de fallo que este corredor existe para matar: **la rotura de este lapso es mayormente silenciosa, y lo es por ambos extremos.** La línea de tipos puede estar obsoleta, así que el repo compila contra el **catálogo antiguo** (costura `M1`), y el slot de cliente desnudo `conversation` se eliminó sin alias mientras `ctx.slots.inject()` solo ejecuta su callback cuando la declaración existe: una mitad de cliente que aún lo apunta deja de montarse sin error, sin línea de log y sin build fallido (costura `C1`). Tres clases de rotura sobreviven a `typecheck` + `test`:
@@ -66,8 +69,8 @@ dsh --profile web --dump-config | grep -A3 'id: dsh-plugin-upgrade'
 npx dsh-plugin-upgrade-scan --repo ../my-plugin
 ```
-Luego pide al agente que use la habilidad `plugin-upgrade`, o lleva el bucle tú mismo con la tarjeta en
-`skills/plugin-upgrade/references/v0.1.3-alpha.1-to-v0.1.5-rc.1.md` (el tramo A es §1, el tramo B es §2, el índice de costuras fusionado es §3).
+Luego pide al agente que use la habilidad `plugin-upgrade`, o lleva el bucle tú mismo con la tarjeta que corresponda a tu banda:
+`skills/plugin-upgrade/references/v0.1.3-alpha.1-to-v0.1.5-rc.1.md` (`legAB` — el tramo A es §1, el tramo B es §2, el índice de costuras fusionado es §3) o `skills/plugin-upgrade/references/v0.1.5-rc.2-to-v0.1.6-alpha.2.md` (`legC`). El escáner elige el corredor por ti; añade `--span legC` cuando la banda declarada sea ambigua.
 ## Instalación y desinstalación
@@ -107,19 +110,20 @@ El plugin monta de forma ruidosa: un `SKILL.md` ausente, un cuerpo vacío o un f
 **CLI** — `dsh-plugin-upgrade-scan`:
 ```sh
-dsh-plugin-upgrade-scan [--repo <path>] [--json <out.json>] [--seams S3,C1,P1] [--quiet]
+dsh-plugin-upgrade-scan [--repo <path>] [--span legAB|legC|<span>] [--json <out.json>] [--seams S3,C1,P1] [--quiet]
 ```
 | Bandera | Significado |
 |---|---|
-| `--repo <path>` | Repositorio a escanear (por defecto: el directorio actual). |
+| `--repo <path>` | Repositorio a escanear (por defecto: el directorio actual). Su banda dsh declarada elige el corredor. |
+| `--span legAB\|legC\|<span>` | Fuerza un corredor en lugar de conjeturarlo desde la banda declarada. Una banda desconocida recae en `legAB`. |
 | `--json <out.json>` | También escribe el informe legible por máquina (`repo`, `scannedAt`, `files`, `hits[]`, `bySeam`). |
-| `--seams S3,C1,P1` | Restringe a costuras concretas del catálogo fusionado. |
+| `--seams S3,C1,P1` | Restringe a costuras concretas del catálogo del corredor resuelto (los ids nunca se comparten entre corredores). |
 | `--quiet` | Suprime la salida humana (combínala con `--json`). |
 Códigos de salida: `0` sin hallazgos de severidad error · `1` al menos un hallazgo de severidad error · `2` uso o fallo del escaneo. Un escaneo limpio es necesario pero no suficiente: el criterio de salida es un smoke real en el host, más un ida y vuelta de reanudación para los escritores de logs (tramo A) y una aserción en un navegador real para la mitad de cliente (tramo B).
-## Las veinte costuras
+## Las veinte costuras de `legAB`
 El orden sigue el catálogo de `lib/scan.mjs` (primero el tramo A, luego el tramo B), que es también el orden al que `test/card.test.mjs` fija la tarjeta.
@@ -148,9 +152,23 @@ El orden sigue el catálogo de `lib/scan.mjs` (primero el tramo A, luego el tram
 `S7`, `S2`, `S1`, `S10`, `C4`, `C5`, `H1`, `H2` y `H4` son deliberadamente asesorables: tienen coincidencias legítimas (un repo que ya usa la API nueva, una instantánea de documentación, la tabla de ids de modelo de un plugin, un `ChildProcess.pid` de Node), así que el escáner las reporta como pistas para revisión manual, no como fallos. `M1` y `P1` son comprobaciones **estructurales** — resuelven `package.json` y `tsconfig*.json` en lugar de coincidir texto — y `H3` es **solo de tarjeta**: documentada, con paridad de ids comprobada y deliberadamente sin detector (`CARD_ONLY = ['H3']`).
+## Las cinco costuras de `legC` (`0.1.5-rc.2` → `0.1.6-alpha.2`)
+El orden sigue el catálogo de `lib/scan-0.1.6.mjs`, que es también el orden al que `test/card.test.mjs` fija la tarjeta de `legC`. Aquí toda costura es `error` y todas se detectan (`CARD_ONLY = []`).
+| Id | Severidad | Qué cambió en el camino a `0.1.6-alpha.2` |
+|---|---|---|
+| `E1` | error | `agent/created` despacha sus listeners en serie: un listener que lanza — o que hace trabajo lento — bloquea por completo la creación del agente. Envuelve el trabajo síncrono en `try`/`catch` y aplaza el resto con `queueMicrotask`/`setImmediate` o tu propia cola. |
+| `E2` | error | Un `apply()` asíncrono cuyo primer `await` precede a sus registros: todo lo registrado después cae en la ventana de descarga y lanza `INACTIVE_EFFECT`, mientras el cierre antiguo sigue corriendo. Registra todo antes del primer `await`, dentro de un único `ctx.effect()`. |
+| `E3` | error | Claves de slot/estado eliminadas: `settings.plugin.item` pasó a ser el keyed→list `plugins.item`, y `SessionListState.current` desapareció — una tarjeta de ajustes desaparece **en silencio** (retorno temprano por `spec === undefined`), y los casts de `current` siguen compilando mientras la función está muerta. |
+| `E4` | error | API de cliente eliminada: `sessions.open` / `openSubagent` / `clear` pasaron a `retain` / `using` / `retainInfo`. |
+| `E5` | error | Literales de modelo eliminados: `deepseek-v4-flash*` y `deepseek-v4-vision-exp`. El catálogo de modelos por defecto se encogió de 4 a 2, y un id sin catalogar pasa tal cual como solo texto. |
+Se aplica la misma disciplina que en `legAB`: un escaneo limpio es necesario, no suficiente. La rotura de `legC` es silenciosa o solo en tiempo de ejecución (la línea de tipos publicada oculta las eliminaciones), así que el criterio de salida sigue siendo un smoke real en el host sobre un `DSH_HOME` temporal, más el ida y vuelta del escritor de logs y la aserción en navegador real donde correspondan.
 ## Lo que esto no cubre
-- **Un salto posterior a `0.1.5-rc.1`.** El lapso fusionado termina en rc.1 por construcción: el salto del harness `0.1.5-rc.1` → `0.1.5-rc.2` no añadió ninguna costura de cara a los plugins (el pin de dev/test y la sonda de CI de este propio paquete corren sobre la línea `0.1.5-rc.2`, de modo que el catálogo queda verificado contra los tipos publicados más recientes). Cualquier cosa que añada una costura más adelante es un **paquete nuevo**: una tarjeta que deriva es peor que ninguna tarjeta.
+- **Un salto más allá de todos los corredores de aquí.** `legAB` termina en `0.1.5-rc.1` por construcción: el salto del harness `0.1.5-rc.1` → `0.1.5-rc.2` no añadió ninguna costura de cara a los plugins (el pin de dev/test de este propio paquete corre ahora sobre la línea `0.1.7-alpha.2`, de modo que el catálogo queda verificado contra esos tipos publicados; la sonda del workflow compat sigue anclada en `0.1.6-alpha.2`), y `legC` cubre `0.1.5-rc.2` → `0.1.6-alpha.2`. Un salto posterior que añada una costura **no** está cubierto: un corredor está cerrado, y ensanchar una tarjeta es peor que añadir una. Ese salto recibe una tarjeta nueva y una fila nueva en el índice — no un paquete nuevo.
 - **El salto `0.1.1` → `0.1.2`.** Usa la habilidad de convergencia de la comunidad.
 - **Repetir entre tramos.** El tramo A posee las costuras del formato de sesión (`assistant/message.stream`, `SessionHandleReadResult`, `EpochHeader.system`, `ctx.agent`, `Inbox`, `SystemPrompt.persona`, la generación de log V3) y el tramo B no las repite: todo el diff de `packages/core/session/src` en el rango del tramo B son dos literales de tipo de evento añadidos y una línea de comentario. La sección de tarjeta de cada tramo conserva su propia declaración de alcance.
 - **La ruta de actualización del usuario de DSH.** Este paquete actualiza *código fuente de plugins*, no la instalación del harness de un usuario.
@@ -175,15 +193,20 @@ npm run check:readmes              # consistencia de los README en cinco idiomas
 npm pack
 ```
-El escáner tiene un par de fixtures sintéticos **por tramo**: `fixtures/leg-a-bad-repo` (las costuras de sesión/configuración del tramo A, con todas las costuras de error presentes a propósito) junto con `fixtures/leg-a-good-repo` (adaptado), y `fixtures/bad-repo` (las costuras de slot de cliente del tramo B) junto con `fixtures/good-repo` (adaptado) — más un negativo en vivo sobre un repositorio de la familia ya fijado a `0.1.5-rc.1`, de modo que una regresión del catálogo falla en esta suite y no en un usuario aguas abajo. `test/card.test.mjs` afirma que el índice de la tarjeta fusionada y `lib/scan.mjs` nombran **exactamente** los mismos veinte ids de costura con las mismas severidades, y que `CARD_ONLY` es exactamente `['H3']`: la regla de vinculación de evidencia como puerta de máquina.
+El escáner tiene un par de fixtures sintéticos **por tramo de `legAB`**: `fixtures/leg-a-bad-repo` (las costuras de sesión/configuración del tramo A, con todas las costuras de error presentes a propósito) junto con `fixtures/leg-a-good-repo` (adaptado), y `fixtures/bad-repo` (las costuras de slot de cliente del tramo B) junto con `fixtures/good-repo` (adaptado) — más un negativo en vivo sobre un repositorio de la familia ya fijado a `0.1.5-rc.1`, de modo que una regresión del catálogo falla en esta suite y no en un usuario aguas abajo. `test/card.test.mjs` afirma que el índice de cada tarjeta y su propio catálogo (`lib/scan.mjs` para `legAB`, `lib/scan-0.1.6.mjs` para `legC`) nombran **exactamente** los mismos ids de costura con las mismas severidades, que el `CARD_ONLY` de `legAB` es exactamente `['H3']` mientras el de `legC` está vacío, y que los dos catálogos no comparten ningún id de costura — la regla de vinculación de evidencia como puerta de máquina, por corredor.
 ## Temas
 `dsh`, `dsh-plugin`, `deepseek-harness`, `deepseek`, `cordis`, `plugin-upgrade`, `migration`, `skill`, `version-card`, `scanner`, `client-slots` (reflejan las `keywords` de `package.json`; `dsh-plugin` es el canal de visibilidad del ecosistema).
-## Familia de plugins DSH de PerryLink
+## Licencia
+Apache-2.0 — consulta [LICENSE](LICENSE). Las dependencias de instalación y sus licencias están en [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md); no se incluye nada empaquetado.
-Este proyecto es uno de los [40 complementos de DeepSeek Harness](https://github.com/PerryLink) mantenidos por [PerryLink](https://github.com/PerryLink). Si este te ayuda, probablemente los demás también:
+## PerryLink DSH Plugin Family
+This project is one of the **45 DeepSeek Harness plugins** maintained by [PerryLink](https://github.com/PerryLink). If this one helps you, the others likely will too:
 | Plugin | One-liner |
 |---|---|
@@ -193,49 +216,42 @@ Este proyecto es uno de los [40 complementos de DeepSeek Harness](https://github
 | **[dsh-budget](https://github.com/PerryLink/dsh-budget)** | Cost governance for DeepSeek Harness: budgets, carbon, and latency in one panel. | |
 | **[dsh-catalog](https://github.com/PerryLink/dsh-catalog)** | DSH Desktop Market standard catalog source for the PerryLink family | |
 | **[dsh-cert-mcp](https://github.com/PerryLink/dsh-cert-mcp)** | Read-only MCP server exposing the certification registry: grades, snapshots and five-dimension evidence | |
-| **[dsh-checkpoint-rewind](https://github.com/PerryLink/dsh-checkpoint-rewind)** | Unified session + workspace + config checkpoints with one-shot `/rewind` | |
-| **[dsh-claude-move](https://github.com/PerryLink/dsh-claude-move)** | Migrate Claude Code, Codex, OpenCode and Hermes sessions, memories and skills into DSH | |
+| **[dsh-checkpoint-rewind](https://github.com/PerryLink/dsh-checkpoint-rewind)** | Claude Code /rewind-equivalent: snapshots, session forks, one-shot restore | |
+| **[dsh-claude-move](https://github.com/PerryLink/dsh-claude-move)** | Migrate Claude Code sessions, memory, skills and CLAUDE.md into DSH | |
 | **[dsh-click](https://github.com/PerryLink/dsh-click)** | Cross-platform native desktop control for DeepSeek Harness — Windows first. | |
 | **[dsh-composer-history](https://github.com/PerryLink/dsh-composer-history)** | Terminal-style input history for the web composer: arrows, Ctrl+R search | |
-| **[dsh-data-quality](https://github.com/PerryLink/dsh-data-quality)** | Deterministic dataset profiling, cleaning and citation verification | |
+| **[dsh-data-quality](https://github.com/PerryLink/dsh-data-quality)** | Dataset quality checks and citation cross-checks (the optional numeric bridge consumed here) | |
 | **[dsh-defend](https://github.com/PerryLink/dsh-defend)** | Prompt-injection, jailbreak, and secret-leak defense for DeepSeek Harness. | |
 | **[dsh-doublecheck](https://github.com/PerryLink/dsh-doublecheck)** | Engineering-discipline guard: requirements grill, test gates, adversary review | |
 | **[dsh-draw](https://github.com/PerryLink/dsh-draw)** | Unified static-image generation routing for DeepSeek Harness. | |
-| **[dsh-fast](https://github.com/PerryLink/dsh-fast)** | Read-only performance diagnostics: load, spill, compaction and cache hit rate | |
-| **[dsh-fund-research](https://github.com/PerryLink/dsh-fund-research)** | Chinese mutual-fund research with sealed, traceable source snapshots | |
-| **[dsh-github](https://github.com/PerryLink/dsh-github)** | GitHub PR/issue/CI integration with every write approval-gated | |
-| **[dsh-industry-research](https://github.com/PerryLink/dsh-industry-research)** | Industry and company research pack: chain map, policy timeline, company cards | |
-| **[dsh-kit](https://github.com/PerryLink/dsh-kit)** | One-command starter pack that installs the core family | |
-| **[dsh-library](https://github.com/PerryLink/dsh-library)** | Local document knowledge base with hybrid search and citation-aware injection | |
-| **[dsh-local-ai](https://github.com/PerryLink/dsh-local-ai)** | Local Ollama model discovery and task-based routing with cloud fallback | |
-| **[dsh-lsp-actions](https://github.com/PerryLink/dsh-lsp-actions)** | LSP diagnostics, formatting, completion, code actions, symbols and rename | |
-| **[dsh-mask](https://github.com/PerryLink/dsh-mask)** | PII masking at the model boundary with a host-side restore table | |
-| **[dsh-mcp-panel](https://github.com/PerryLink/dsh-mcp-panel)** | MCP management console: `/mcp` command, Settings tab and trial calls | |
-| **[dsh-memento](https://github.com/PerryLink/dsh-memento)** | Approval-gated cross-session memory protocol (`ctx.memory` + SQLite) | |
-| **[dsh-observe](https://github.com/PerryLink/dsh-observe)** | OpenTelemetry and Langfuse telemetry export from the session event stream | |
-| **[dsh-output-styles](https://github.com/PerryLink/dsh-output-styles)** | Runtime-switchable model output styles | |
-| **[dsh-permission-rules](https://github.com/PerryLink/dsh-permission-rules)** | Declarative allow/deny/ask rules plus a process-level network policy | |
+| **[dsh-fast](https://github.com/PerryLink/dsh-fast)** | Read-only performance diagnostics for DeepSeek Harness. | |
+| **[dsh-fund-research](https://github.com/PerryLink/dsh-fund-research)** | Deterministic research reports for Chinese public mutual funds | |
+| **[dsh-github](https://github.com/PerryLink/dsh-github)** | GitHub PR/issues integration for DSH, every write gated by approval | |
+| **[dsh-industry-research](https://github.com/PerryLink/dsh-industry-research)** | Industry research orchestration that seals its deliverables through this plugin's `ctx.researchReport.assemble` | |
+| **[dsh-laya](https://github.com/PerryLink/dsh-laya)** | Laya typed decisions (`noul`/`choice`/`score`) as a first-class Cordis service and model-visible tools | |
+| **[dsh-library](https://github.com/PerryLink/dsh-library)** | Local document knowledge base for DeepSeek Harness. | |
+| **[dsh-local-ai](https://github.com/PerryLink/dsh-local-ai)** | Local-model (Ollama) integration for DeepSeek Harness. | |
+| **[dsh-lsp-actions](https://github.com/PerryLink/dsh-lsp-actions)** | LSP diagnostics, formatting, completion, code actions and rename over language servers | |
+| **[dsh-mask](https://github.com/PerryLink/dsh-mask)** | PII masking middleware: anonymize at the model boundary, restore at the display layer | |
+| **[dsh-mcp-panel](https://github.com/PerryLink/dsh-mcp-panel)** | Read-only MCP runtime panel: /mcp command + Settings tab with status, tools and errors | |
+| **[dsh-memento](https://github.com/PerryLink/dsh-memento)** | Approval-gated cross-session memory: ctx.memory seam + SQLite + memory tool | |
+| **[dsh-observe](https://github.com/PerryLink/dsh-observe)** | OpenTelemetry and Langfuse observability exporter for DeepSeek Harness. | |
+| **[dsh-output-styles](https://github.com/PerryLink/dsh-output-styles)** | Claude Code outputStyles-equivalent runtime style switching | |
+| **[dsh-permission-rules](https://github.com/PerryLink/dsh-permission-rules)** | Claude Code-style declarative allow/deny/ask permission rules with audit | |
 | **[dsh-plugin-certification](https://github.com/PerryLink/dsh-plugin-certification)** | Community certification registry with repro-checkable grades and badges | |
 | **[dsh-plugin-doctor](https://github.com/PerryLink/dsh-plugin-doctor)** | Zero-dependency static + sandbox smoke detector for DSH plugins | |
-| **[dsh-plugin-guide](https://github.com/PerryLink/dsh-plugin-guide)** | Plugin-dev knowledge base, agent skill and the `dsh-plugin-dev` CLI toolchain | |
+| **[dsh-plugin-guide](https://github.com/PerryLink/dsh-plugin-guide)** | Plugin-development knowledge base as an on-demand agent skill | |
 | **[dsh-plugin-kit](https://github.com/PerryLink/dsh-plugin-kit)** | Shared zero-runtime-dependency toolkit for the PerryLink DSH plugins | |
-| **[dsh-plugin-portal](https://github.com/PerryLink/dsh-plugin-portal)** | Zero-dependency static portal rendering the whole plugin family as one page | |
-| **[dsh-reach](https://github.com/PerryLink/dsh-reach)** | Multi-channel approval/question bridge: WeChat, Telegram, Feishu + a session console | |
-| **[dsh-research-report](https://github.com/PerryLink/dsh-research-report)** | Verifiable research reports: evidence ledger, manifest seal, per-claim verdicts | |
-| **[dsh-score](https://github.com/PerryLink/dsh-score)** | Multi-dimensional plugin quality scoring with an evidence-backed leaderboard | |
-| **[dsh-session-pin](https://github.com/PerryLink/dsh-session-pin)** | Pin sessions and workspaces in the Web sidebar with per-pin colors | |
-| **[dsh-session-sync](https://github.com/PerryLink/dsh-session-sync)** | Git-backed cross-device session synchronization with keep-both merges | |
-| **[dsh-skill-pack-security](https://github.com/PerryLink/dsh-skill-pack-security)** | Security-audit skill pack plus the `plugin_vet` supply-chain gate | |
-| **[dsh-talk](https://github.com/PerryLink/dsh-talk)** | Voice-first session loop: speech-to-text input and text-to-speech replies | |
+| **[dsh-plugin-upgrade](https://github.com/PerryLink/dsh-plugin-upgrade)** | One-package, one-corridor-index plugin upgrade skill: routes a repository to the matching closed corridor card | |
+| **[dsh-plugin-upgrade-015](https://github.com/PerryLink/dsh-plugin-upgrade-015)** | Merged `0.1.3-alpha.1` → `0.1.5-rc.1` upgrade corridor card plus a zero-dependency seam scanner | |
+| **[dsh-reach](https://github.com/PerryLink/dsh-reach)** | Multi-channel approval/question bridge: WeChat/Telegram/Feishu, session console | |
+| **[dsh-research-report](https://github.com/PerryLink/dsh-research-report)** | Verifiable research-report engine: content-addressed evidence ledger and sealed versions | |
+| **[dsh-score](https://github.com/PerryLink/dsh-score)** | Multi-dimensional quality scoring for DeepSeek Harness plugins. | |
+| **[dsh-session-pin](https://github.com/PerryLink/dsh-session-pin)** | Pin sessions in the Web sidebar with durable ordering | |
+| **[dsh-session-sync](https://github.com/PerryLink/dsh-session-sync)** | Cross-device session sync for DeepSeek Harness — a dedicated git mirror of your session store. | |
+| **[dsh-skill-pack-security](https://github.com/PerryLink/dsh-skill-pack-security)** | Security-audit skill pack: secret scan, dependency and supply-chain review | |
+| **[dsh-talk](https://github.com/PerryLink/dsh-talk)** | Voice-first session loop for DeepSeek Harness: talk to it, hear it answer. | |
 | **[dsh-team-rooms](https://github.com/PerryLink/dsh-team-rooms)** | Cross-session team rooms: shared message bus, task board and timeline | |
-| **[dsh-test-drive](https://github.com/PerryLink/dsh-test-drive)** | Isolated install-and-smoke test drives with a pass/fail matrix | |
-| **[dsh-ticktick](https://github.com/PerryLink/dsh-ticktick)** | TickTick/Dida365 task bridge: session-header panel plus eleven agent tools | |
-| **[dsh-translate](https://github.com/PerryLink/dsh-translate)** | Vendor parameter translation and deterministic JSON repair | |
-| **[dsh-wechat](https://github.com/pan17/dsh-wechat)** | WeChat ↔ DSH bridge (Tencent iLink bot) developed with [pan17](https://github.com/pan17/dsh-wechat), who hosts the repo | |
-| **[dsh-personal-directive](https://github.com/PerryLink/dsh-personal-directive)** | Personal directive injector with a top-bar toggle (fork of liucai2026/dsh-personal-directive) | |
-Parte de la familia de plugins DSH de PerryLink: más de 40 repositorios que cubren sesiones, memoria, permisos, entrega, observabilidad y herramientas para desarrolladores. Explora el catálogo en [perrylink-dsh-catalog.perrylink.workers.dev](https://perrylink-dsh-catalog.perrylink.workers.dev) o el [tema `dsh-plugin`](https://github.com/topics/dsh-plugin).
-## Licencia
-Apache-2.0 — consulta [LICENSE](LICENSE). Las dependencias de instalación y sus licencias están en [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md); no se incluye nada empaquetado.
+| **[dsh-test-drive](https://github.com/PerryLink/dsh-test-drive)** | Isolated install-and-smoke test drives for DeepSeek Harness plugins. | |
+| **[dsh-ticktick](https://github.com/PerryLink/dsh-ticktick)** | TickTick/Dida365 task bridge: session-header panel + 11 tools | |
+| **[dsh-translate](https://github.com/PerryLink/dsh-translate)** | Vendor parameter translation and deterministic JSON repair for DeepSeek Harness. | |