dsh-plugin-upgrade 2.0.1 → 2.0.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (14) hide show
  1. package/AGENTS.md +74 -43
  2. package/CHANGELOG.md +43 -0
  3. package/README-es.md +71 -55
  4. package/README-hi.md +66 -50
  5. package/README-pt.md +71 -55
  6. package/README-zh.md +66 -50
  7. package/README.md +66 -50
  8. package/THIRD_PARTY_NOTICES.md +2 -2
  9. package/lib/route.mjs +20 -4
  10. package/lib/scan-0.1.6.mjs +39 -4
  11. package/package.json +10 -7
  12. package/scripts/verify-artifacts.mjs +3 -2
  13. package/skills/plugin-upgrade/SKILL.md +12 -12
  14. package/skills/plugin-upgrade/references/v0.1.5-rc.2-to-v0.1.6-alpha.2.md +2 -2
package/AGENTS.md CHANGED
@@ -2,37 +2,52 @@
2
2
 
3
3
  Standalone DeepSeek Harness plugin repository (`dsh-plugin-upgrade`). Development
4
4
  follows the dsh-plugin-guide skill and the official plugin contract; this file records
5
- repo-local decisions. Read `README.md` (external contract) and the packaged merged corridor
6
- card (`skills/plugin-upgrade/references/v0.1.3-alpha.1-to-v0.1.5-rc.1.md`) before changing
7
- behavior.
8
-
9
- ## A corridor never widens (and one package may carry several closed corridors)
10
-
11
- - **A corridor never widens.** This package upgrades plugins across `0.1.3-alpha.1 →
12
- 0.1.5-rc.1` and nothing else. Do not widen the peer band or the card to "all versions":
13
- a drifting card is worse than no card. A hop that adds a seam is a new package.
14
- - **One package may carry several *closed* corridors.** That is what this repository is: one
15
- npm package holding leg A (`0.1.3-alpha.1 → 0.1.5-alpha.1`) and leg B (`0.1.5-alpha.1 →
16
- 0.1.5-rc.1`) as **two closed corridors of one span**, each keeping its own evidence, card
17
- section, fixtures and rollback path. Neither leg may absorb a third hop.
18
- - **This supersedes the family's earlier rule.** The retired `dsh-plugin-upgrade` and
19
- `dsh-plugin-upgrade-rc1` each carried a "**The corridor is locked** … a new corridor is a
20
- new package" section plus "**zero code dependency on the sibling corridor**: no `import`,
21
- no vendoring, no shared `SEAMS`". The owner deliberately superseded the second half of that
22
- pair: the merged package **does** share one `SEAMS` (one scanner, one catalog, one
23
- id-parity gate) because the two legs are contiguous hops of one span. What survives
5
+ repo-local decisions. Read `README.md` (external contract) and **both** packaged corridor
6
+ cards (`skills/plugin-upgrade/references/v0.1.3-alpha.1-to-v0.1.5-rc.1.md` and
7
+ `skills/plugin-upgrade/references/v0.1.5-rc.2-to-v0.1.6-alpha.2.md`) before changing behavior.
8
+
9
+ ## One package, one corridor index (a corridor still never widens)
10
+
11
+ - **A corridor never widens.** A corridor is one *closed, measured* span with its own card,
12
+ catalog, evidence, fixtures and rollback path. Never stretch a card to "all versions":
13
+ a drifting card is worse than no card.
14
+ - **A new corridor adds a card and an index row, not a package.** Owner decision
15
+ (2026-09-19), recorded in `lib/route.mjs`: this package carries the corridor **index**.
16
+ `resolveCorridor()` reads the target repository's declared band (`engines.dsh`, the
17
+ `@deepseek-ai/dsh*` ranges) and routes to the matching corridor; `--span legAB|legC`
18
+ overrides the guess, and an undeclared band falls back to the older corridor.
19
+ - **`legAB`** — `0.1.3-alpha.1 → 0.1.5-rc.1`, carried as leg A (`0.1.3-alpha.1 →
20
+ 0.1.5-alpha.1`) and leg B (`0.1.5-alpha.1 → 0.1.5-rc.1`): 20 seams, catalog
21
+ `lib/scan.mjs`, card `…/references/v0.1.3-alpha.1-to-v0.1.5-rc.1.md` (§1 leg A, §2 leg B,
22
+ §3 the 20-seam index), evidence `docs/EVIDENCE.md` §A + §1–§10.
23
+ - **`legC`** — `0.1.5-rc.2 → 0.1.6-alpha.2`: 5 seams (`E1`–`E5`, all `error`), catalog
24
+ `lib/scan-0.1.6.mjs`, card `…/references/v0.1.5-rc.2-to-v0.1.6-alpha.2.md`, evidence
25
+ `docs/EVIDENCE.md` §11. The retired `dsh-plugin-upgrade-016` name never reached the
26
+ registry; this corridor is folded in here.
27
+ - **The seam arrays are never merged.** Two corridors mean two catalogs, two cards and two
28
+ parity gates, so every card claim stays traceable to its own measurement. What the
29
+ corridors *do* share is the entry point: one skill id (`plugin-upgrade`), one CLI
30
+ (`dsh-plugin-upgrade-scan`), one report shape.
31
+ - **This supersedes the family's earlier rule.** The retired `dsh-plugin-upgrade`,
32
+ `dsh-plugin-upgrade-rc1` and `dsh-plugin-upgrade-016` each carried a "**The corridor is
33
+ locked** … a new corridor is a new package" section plus "**zero code dependency on the
34
+ sibling corridor**: no `import`, no vendoring, no shared `SEAMS`". The owner deliberately
35
+ superseded that pair: one package now carries the index, and each corridor keeps its own
36
+ `SEAMS` while the *plumbing* (router, entry point, report shape) is shared. What survives
24
37
  unchanged is the numbering discipline — a corridor is *closed*, not open-ended — and the
25
38
  per-leg ownership below.
26
39
 
27
40
  Consequences accepted by this repository:
28
41
 
29
- - The merged catalog (20 seams: `S3`, `S8`, `S9`, `M1`, `S4`, `S5`, `S6`, `S7`, `S2`, `S1`,
42
+ - The `legAB` catalog (20 seams: `S3`, `S8`, `S9`, `M1`, `S4`, `S5`, `S6`, `S7`, `S2`, `S1`,
30
43
  `S10`, `C1`, `C2`, `P1`, `C4`, `C5`, `H1`, `H2`, `H4`, `H3`) is evidence-bound to the two
31
44
  tag ranges it was measured on — leg A `dsh-v0.1.5-alpha.1` (2026-09-09 wave over 40 plugin
32
- repos) and leg B `dsh-v0.1.5-alpha.1..dsh-v0.1.5-rc.1` (2026-09-10). A hop after
33
- `0.1.5-rc.1` (rc.2, the final release, anything later) is a **new package**, not a wider
34
- card. The harness hop `0.1.5-rc.1 → 0.1.5-rc.2` added no plugin-facing seam, which is why
35
- the span ends at rc.1 while the dev/test pin and the CI probe run on `0.1.5-rc.2`.
45
+ repos) and leg B `dsh-v0.1.5-alpha.1..dsh-v0.1.5-rc.1` (2026-09-10). The harness hop
46
+ `0.1.5-rc.1 → 0.1.5-rc.2` added no plugin-facing seam, which is why that span ends at rc.1
47
+ while the dev/test pin runs on the `0.1.7-alpha.2` line and the compat probe matrix covers
48
+ every published line the peer band admits (`0.1.2-rc.1`, `0.1.5-rc.2`, `0.1.6-alpha.2`,
49
+ `0.1.7-alpha.2`). The `legC` catalog (`E1`–`E5`)
50
+ is evidence-bound to `dsh-v0.1.6-alpha.2` (2026-09-19, §11).
36
51
  - **Leg A owns the session-format seams** (`assistant/message.stream`, `S3`;
37
52
  `SessionHandleReadResult`, `S8`; `EpochHeader.system`, `S2`; `ctx.agent`, `S5`; `Inbox`,
38
53
  `S6`; `SystemPrompt.persona`, `S9`; the V3 log generation, `S1`) and **leg B does not
@@ -47,7 +62,9 @@ Consequences accepted by this repository:
47
62
  - The peer band is **unchanged** by both legs. `>=0.1.2-rc.1 <0.2.0` alone rejects
48
63
  `0.1.5-rc.1` under npm semver's prerelease-tuple rule (measured `false` on semver 7.8.5);
49
64
  the `|| >=0.1.5-alpha.1 <0.2.0` segment is what admits it. `P1` forbids dropping it, and
50
- this package's own `peerDependencies` keeps both segments.
65
+ this package's own `peerDependencies` keeps all four segments
66
+ (`>=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0 || >=0.1.7-0 <0.2.0`),
67
+ each newly published prerelease tuple having gained its own clause under the same rule.
51
68
  - The `C1` ruling (the bare `conversation` slot removal is a **public extension-point
52
69
  break**, kept at `error`, with a rewrite recipe and a real-browser exit criterion) is
53
70
  recorded in card §2 §3.3. Do not downgrade it to an advisory without new upstream
@@ -58,8 +75,14 @@ Consequences accepted by this repository:
58
75
  ```
59
76
  index.mjs single host face: Config schema + skill bundle reader + apply()
60
77
  types.d.ts Config, SeamId, SeamHit, ScanReport and the public function surface
61
- lib/scan.mjs zero-dependency merged seam catalog (both legs) + scanner + CLI main()
62
- scripts/scan-0.1.5.mjs thin bin wrapper (npx dsh-plugin-upgrade-scan)
78
+ lib/route.mjs the corridor index: CORRIDORS, declaredBand(), resolveCorridor(),
79
+ --span/--repo parsing, loadCatalog()
80
+ lib/scan.mjs zero-dependency `legAB` seam catalog (legs A+B) + scanner + CLI main()
81
+ lib/scan-0.1.6.mjs zero-dependency `legC` seam catalog (E1–E5) + scanner + CLI main()
82
+ scripts/scan-0.1.5.mjs thin bin wrapper (npx dsh-plugin-upgrade-scan): resolves the
83
+ corridor through lib/route.mjs and hands the same argv to that
84
+ corridor's catalog main(). The filename is historical; the wrapper
85
+ routes both corridors
63
86
  skills/plugin-upgrade/scripts/scan-0.1.5.mjs the same wrapper inside the skill
64
87
  directory, so the skill body's `./scripts/...` resolves against its
65
88
  resourceBase
@@ -71,17 +94,19 @@ scripts/verify-artifacts.mjs pack + inspect the published tarball (also as
71
94
  leg-A seam fails the packaged CLI)
72
95
  scripts/check-readme-sync.mjs five-language README consistency
73
96
  skills/plugin-upgrade/SKILL.md the bundled skill body (frontmatter name is the skill id;
74
- it routes the caller to the leg matching its peer band)
75
- skills/plugin-upgrade/references/v0.1.3-alpha.1-to-v0.1.5-rc.1.md the merged card:
97
+ it routes the caller to the corridor matching its peer band)
98
+ skills/plugin-upgrade/references/v0.1.3-alpha.1-to-v0.1.5-rc.1.md the `legAB` card:
76
99
  §1 Leg A, §2 Leg B, §3 the 20-seam index
100
+ skills/plugin-upgrade/references/v0.1.5-rc.2-to-v0.1.6-alpha.2.md the `legC` card:
101
+ the 5-seam `E1`–`E5` index and the fix/verify recipes
77
102
  test/scan.test.mjs synthetic bad/good fixtures for BOTH legs + --seams + a live negative
78
103
  test/plugin.test.mjs real Cordis Context + real SkillRegistry: register, dispose, negatives
79
- test/card.test.mjs the card↔catalog id/severity parity gate
104
+ test/card.test.mjs the card↔catalog id/severity parity gate for BOTH corridors
80
105
  fixtures/ scanner fixtures — never published:
81
106
  bad-repo / good-repo leg B (client-slot oriented)
82
107
  leg-a-bad-repo / leg-a-good-repo leg A (TypeScript/session oriented)
83
108
  docs/EVIDENCE.md the command→output record every card claim traces to
84
- (§A = leg A's provenance, §1–§10 = leg B's records)
109
+ (§A = leg A's provenance, §1–§10 = leg B's records, §11 = leg C's)
85
110
  cordis.patch.yml bundle declaration (insert dsh-plugin-upgrade); every
86
111
  Config key inline
87
112
  pnpm-workspace.yaml nearest-workspace root (isolates this repo from a surrounding harness checkout)
@@ -118,9 +143,10 @@ LICENSE Apache-2.0
118
143
  adaptation: this span's breakage is silent from both ends, so a session-log writer needs a
119
144
  resume round-trip (`S3`), a client half needs a real browser assertion, and the card's exit
120
145
  criterion is a real-host smoke on a temp `DSH_HOME`.
121
- - **The card and the catalog are one catalog.** `test/card.test.mjs` fails when their ids or
122
- severities disagree, and when the card mints an id outside the merged 20. Change the card
123
- first, then the catalog, in the same commit.
146
+ - **The card and the catalog are one catalog — per corridor.** `test/card.test.mjs` fails when
147
+ a card's index and that corridor's catalog disagree on ids or severities, when a card mints
148
+ an id outside its own catalog, and when `legC`'s `CARD_ONLY` is not empty. The two corridors'
149
+ catalogs are never merged. Change the card first, then the catalog, in the same commit.
124
150
  - **Mount loud.** A missing `SKILL.md`, an empty body, or a frontmatter without `name` must
125
151
  abort the mount. Never register a placeholder skill.
126
152
  - **The skill id is the frontmatter name.** `skillName` selects the directory; the registered
@@ -140,6 +166,9 @@ LICENSE Apache-2.0
140
166
  ```sh
141
167
  npm install # or: pnpm install (pnpm-lock.yaml is committed)
142
168
  npm test # node --test: scanner (both legs) + card parity + real-registry mount
169
+ npm run check # tsc -p tsconfig.check.json: the checked-JS shipping surface (index.mjs, lib/**, scripts/**)
170
+ npm run typecheck:ci # tsc -p tsconfig.check.ci.json: same program, published host types (empty paths)
171
+ npm run typecheck:checkout # tsc -p tsconfig.checkout.json: shipping surface + checkout/host-surface.mts, against the local harness checkout's built types
143
172
  npm run verify:self-contained # every import resolves inside the package
144
173
  npm run verify:artifacts # tarball contents + entry import + dev-only content excluded
145
174
  npm run check:readmes # five-language README consistency
@@ -153,9 +182,9 @@ after every harness release.
153
182
 
154
183
  ## Release
155
184
 
156
- Version is currently `0.1.0`. The npm name `dsh-plugin-upgrade` is brand new, so
157
- this package starts its own version line at `0.1.0`; the two retired packages' histories live
158
- in `CHANGELOG.md` under `[Unreleased]` and below. For a new version: bump
185
+ Version is currently `2.0.1` (`2.0.0` was the package that returned as the corridor index;
186
+ `2.0.1` re-published the corrected npm description). The retired packages' histories live in
187
+ `CHANGELOG.md` under `[Unreleased]` and below. For a new version: bump
159
188
  `package.json#version`, stamp the CHANGELOG `[Unreleased]` section into `## [<x.y.z>] - <UTC
160
189
  date>`, re-run the full gate, commit `chore(release): <x.y.z>`, and `git tag -a v<x.y.z>`.
161
190
  `git push origin main --follow-tags` triggers `.github/workflows/release.yml`, which re-runs
@@ -182,9 +211,11 @@ same commit.
182
211
  row expects `PerryLink/dsh-plugin-doctor` to carry a
183
212
  `PerryLink__dsh-plugin-upgrade.svg` badge, and the family also enrols each package
184
213
  in the Gitee mirror, the `dsh-catalog` directory and the omdsh workshop list. Those are
185
- release-side steps performed from the family workspace after the first tag. The two retired
186
- package names stay on the registry (unpublished content is not removed by publishing a new
187
- name); their README/card wording is now historical.
214
+ release-side steps performed from the family workspace after the first tag. The three
215
+ retired package names (`dsh-plugin-upgrade` leg A, `dsh-plugin-upgrade-rc1` leg B, and the
216
+ never-published `dsh-plugin-upgrade-016` corridor) stay on the registry or in history only
217
+ (unpublished content is not removed by publishing a new name); their README/card wording is
218
+ now historical.
188
219
 
189
220
  ## Docs
190
221
 
@@ -196,7 +227,7 @@ name); their README/card wording is now historical.
196
227
  `package.json` keywords; the ecosystem's visibility channel is the `dsh-plugin` topic).
197
228
  - License is Apache-2.0 (`LICENSE` + the package.json `license` field).
198
229
  `THIRD_PARTY_NOTICES.md` documents install-time dependencies; nothing is bundled.
199
- - Every factual claim in the card or the scanner traces to a command recorded in
230
+ - Every factual claim in a card or the scanner traces to a command recorded in
200
231
  `docs/EVIDENCE.md` — §A for leg A's provenance (via the retired `dsh-plugin-upgrade` card,
201
- now merged in as Leg A) and §1–§10 for leg B's records. Where a claim could not be verified
202
- it is marked **unverified** and kept out of the card.
232
+ now merged in as Leg A), §1–§10 for leg B's records, and §11 for leg C's. Where a claim
233
+ could not be verified it is marked **unverified** and kept out of the card.
package/CHANGELOG.md CHANGED
@@ -5,6 +5,49 @@ All notable changes to this project are documented in this file.
5
5
  The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
6
6
  and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
7
7
 
8
+ ## [2.0.2] - 2026-09-23
9
+
10
+ ### Added
11
+
12
+ - A checkout ruler: `checkout/host-surface.mts`, `tsconfig.checkout.json` and `typecheck:checkout` (`tsc -p tsconfig.checkout.json --noEmit`). The probe mirrors the real call sites — the Schemastery `Config` from `index.mjs`, the exact `SkillRegistration` object `apply()` hands `ctx.skills.register()`, and a real `Context` + `SkillRegistry` + `ctx.effect()` as in `test/plugin.test.mjs` — and the three `@deepseek-ai/*` specifiers this package really imports (`index.mjs` → `schemastery`; `test/plugin.test.mjs` → `cordis`, `dsh-skill`) are aliased to the local harness checkout's built types. The `@deepseek-ai/*` names under `fixtures/` are synthetic scanner inputs, including packages that no longer exist, so they are deliberately not mapped. It is never executed; it exists so a host-line shape change fails against the checkout instead of at a user's first mount.
13
+
14
+ ### Changed
15
+
16
+ - The published line this package checks against moves to `0.1.7-alpha.2`: the `@deepseek-ai/dsh-skill` dev/test pin moves from `0.1.5-rc.2`, `@deepseek-ai/cordis` to `^4.0.4` and `@deepseek-ai/schemastery` to `^3.18.4`; the `0.1.7` tuple gains its own clause on the `@deepseek-ai/dsh-skill` peer band; `dshWorkshop.compatibility.dshVersions` records `0.1.7-alpha.2`; and the `compat.yml` probe matrix now covers `0.1.2-rc.1`, `0.1.5-rc.2`, `0.1.6-alpha.2` and `0.1.7-alpha.2`. This is a correctness fix, not a tightening: under npm semver's prerelease rule a comparator set whose only prerelease comparators sit on earlier `[major, minor, patch]` tuples cannot admit a later alpha, so the three-clause band could not admit the very host this release targets. The three existing clauses are unchanged, in place and in order; `P1` still forbids collapsing them. The lockfile now resolves exactly one `cordis` and one `schemastery` copy, so the two-copy `Volatile` typing trap cannot occur here.
17
+ - The five-language READMEs name the `0.1.7-alpha.2` line and quote the four-clause band; `AGENTS.md`, `THIRD_PARTY_NOTICES.md` and the checks block are brought in line with the declared state (the prose commit `070309e`), including the `AGENTS.md` peer-segment note that still said the package keeps "both segments" and the dev/test-pin sentence that still said `0.1.5-rc.2`.
18
+
19
+ ### Fixed
20
+
21
+ - `pnpm run check` (`tsc -p tsconfig.check.json`) had been red since the corridor index landed: 24 `TS7006` (implicitly-`any` parameter) errors, all of them in two committed checked-JS source files that no build step generates (`lib/route.mjs` 8, `lib/scan-0.1.6.mjs` 16). The same 24 errors reddened `pnpm run typecheck:ci`, whose config includes the same file set. The defects were genuine rather than checker noise — those two files were the only checked-JS sources in the repo whose functions carried no JSDoc. Every annotation was derived from the function body and its call sites and mirrors the sibling catalog `lib/scan.mjs`, which already passes the same checker; the change is comment-only (all 58 added lines sit inside JSDoc blocks), `allowJs`, `checkJs` and `noImplicitAny: true` are untouched, no file was dropped from `include`, and no `@ts-nocheck` or `@ts-ignore` was added. With the shipping surface type-checking, the checkout ruler compiles what actually ships (`index.mjs`, `lib/**`, `scripts/**`) instead of only the probe, which is what the ruler was for.
22
+ - **The documentation still described the retired "one package per hop" model.** `2.0.0`
23
+ introduced the corridor index (`lib/route.mjs`) and folded the `0.1.5-rc.2` →
24
+ `0.1.6-alpha.2` corridor in as `legC`, but the surrounding prose had not caught up: the
25
+ internal `AGENTS.md` still said the package "upgrades plugins across `0.1.3-alpha.1` →
26
+ `0.1.5-rc.1` and nothing else" and that "a hop after `0.1.5-rc.1` … is a new package"; the
27
+ `legC` card still called itself the new package `dsh-plugin-upgrade-016`; the skill
28
+ frontmatter still carried a single `corridor:` key and a `whenToUse` that told the model a
29
+ later hop is a new package; and all five READMEs described one merged corridor with two
30
+ legs, never naming `legC`. Corrected here, with the two corridors now named consistently
31
+ everywhere (`legAB` = `0.1.3-alpha.1` → `0.1.5-rc.1`, `legC` = `0.1.5-rc.2` →
32
+ `0.1.6-alpha.2`) and the "a new corridor adds a card and an index row, not a package" rule
33
+ stated wherever the old rule was.
34
+ - **`test/card.test.mjs` had no gate for the second corridor.** The evidence-binding parity
35
+ check only pinned the `legAB` card to `lib/scan.mjs`. It now also pins the `legC` card to
36
+ `lib/scan-0.1.6.mjs` (ids, order, severities), asserts `legC`'s `CARD_ONLY` is empty,
37
+ asserts the two catalogs share no seam id, and asserts the skill frontmatter names both
38
+ corridors while the superseded "a new package" phrasing is gone.
39
+ `scripts/verify-artifacts.mjs` checks the packaged `SKILL.md` frontmatter for both
40
+ corridors instead of the retired single `corridor:` key.
41
+ - No functional change: `index.mjs`, `lib/**`, `cordis.patch.yml`, `fixtures/**` and the
42
+ cards' seam facts are untouched. `package.json` changes only documentation fields
43
+ (`dshWorkshop.capability.expected`, and `compatibility.dshVersions` gains
44
+ `0.1.6-alpha.2`, which `peerDependencies` already admitted). The gate chain is re-run in
45
+ full; the published `2.0.1` tarball is unaffected and this lands with the next release.
46
+ - **The family-size claim was one release behind.** All five READMEs said this package is
47
+ "one of the **40** DeepSeek Harness plugins"; the family roster is **41** (`PerryLink/dsh-kit`
48
+ states 41 in both the tagline and the same family line, and `dsh-wechat` left the family).
49
+ Corrected in all five in the same commit.
50
+
8
51
  ## [2.0.1] - 2026-09-20
9
52
 
10
53
  ### Fixed
package/README-es.md CHANGED
@@ -3,16 +3,18 @@
3
3
  # ⬆️ dsh-plugin-upgrade
4
4
  - **Canal de la tienda 1024**: ejecuta `npm i -g dsh1024` una vez y luego `dsh1024 plugin --profile web add dsh-plugin-upgrade` (cuenta para el ranking de instalaciones de [deepseek1024.com](https://deepseek1024.com)).
5
5
  [![Gitee](https://img.shields.io/badge/Gitee-mirror-c71d23?logo=gitee)](https://gitee.com/perrylink/dsh-plugin-upgrade)
6
+ [![dshfind](https://dshfind.com/api/badge/PerryLink/dsh-plugin-upgrade?metric=downloads&lang=es)](https://dshfind.com/es/plugins/PerryLink/dsh-plugin-upgrade?ref=badge)
6
7
 
7
- **Habilidad de actualización de plugins para DeepSeek Harness, fusionada y con versión bloqueada — `0.1.3-alpha.1` → `0.1.5-rc.1`, llevada como dos tramos cerrados.**
8
+ **Habilidad de actualización de plugins para DeepSeek Harness — un paquete, un índice de corredores, dos corredores cerrados: `0.1.3-alpha.1` → `0.1.5-rc.1` (`legAB`) y `0.1.5-rc.2` → `0.1.6-alpha.2` (`legC`).**
8
9
 
9
- *Tramo A `0.1.3-alpha.1` → `0.1.5-alpha.1`, tramo B `0.1.5-alpha.1` → `0.1.5-rc.1`: una tarjeta de corredor más un escáner de costuras sin dependencias sobre el catálogo fusionado de 20 costuras, para que una mitad de cliente que dejó de montarse en silencio nunca se confunda con «typecheck en verde».*
10
+ *El escáner se enruta solo: lee la banda dsh declarada por el repositorio destino (o toma `--span`) y luego aplica el catálogo propio de ese corredor, vinculado a evidencia — las 20 costuras de `legAB` (tramo A `0.1.3-alpha.1` → `0.1.5-alpha.1` más tramo B `0.1.5-alpha.1` → `0.1.5-rc.1`) o las 5 costuras de `legC` (`E1`–`E5`). Un solo punto de entrada, para que una mitad de cliente que dejó de montarse en silencio nunca se confunda con «typecheck en verde».*
10
11
 
11
- > **Repositorio oficial.** Este es el único repositorio oficial de dsh-plugin-upgrade, mantenido por PerryLink. Sustituye a los dos paquetes con versión bloqueada `dsh-plugin-upgrade` (tramo A) y `dsh-plugin-upgrade-rc1` (tramo B). Los repositorios con el mismo nombre en otras cuentas no están afiliados.
12
+ > **Repositorio oficial.** Este es el único repositorio oficial de dsh-plugin-upgrade, mantenido por PerryLink. Sustituye a los dos paquetes retirados con versión bloqueada `dsh-plugin-upgrade` (tramo A) y `dsh-plugin-upgrade-rc1` (tramo B), y es el paquete en el que se integró el corredor `0.1.5-rc.2` → `0.1.6-alpha.2` (tramo C): el nombre `dsh-plugin-upgrade-016` nunca llegó al registro. Los repositorios con el mismo nombre en otras cuentas no están afiliados.
12
13
 
13
14
  [![License](https://img.shields.io/badge/license-Apache%202.0-blue.svg)](LICENSE)
14
15
  [![DSH plugin](https://img.shields.io/badge/dsh--plugin-✅-green)](https://github.com/topics/dsh-plugin)
15
16
  [![dsh-doctor](https://raw.githubusercontent.com/PerryLink/dsh-plugin-doctor/main/badges/PerryLink__dsh-plugin-upgrade.svg)](https://github.com/PerryLink/dsh-plugin-doctor#verified-徽章)
17
+ [![DSH Market](https://raw.githubusercontent.com/2BingLing/dsh-market/master/assets/readme/badge-listed-en.svg)](https://dsh.market/)
16
18
  [![Node](https://img.shields.io/badge/node-%5E22.19%20%7C%7C%20%3E%3D24-brightgreen.svg)](#)
17
19
  [![CI](https://img.shields.io/github/actions/workflow/status/PerryLink/dsh-plugin-upgrade/ci.yml?branch=main&label=CI)](https://github.com/PerryLink/dsh-plugin-upgrade/actions)
18
20
  [![Version](https://img.shields.io/github/v/tag/PerryLink/dsh-plugin-upgrade?label=version)](https://github.com/PerryLink/dsh-plugin-upgrade/releases)
@@ -29,21 +31,22 @@
29
31
 
30
32
  | Superficie | Estado |
31
33
  |---|---|
32
- | Harness | DeepSeek Harness `0.1.5-rc.1` (tag `dsh-v0.1.5-rc.1` = `183f08e9c6dd`; relevo tramo A→B `dsh-v0.1.5-alpha.1` = `5dda764ed3aa`; inicio del corredor `0.1.3-alpha.1`). Banda de peers `@deepseek-ai/dsh-skill >=0.1.2-rc.1 <0.2.0 \|\| >=0.1.5-alpha.1 <0.2.0`, `@deepseek-ai/cordis ^4.0.2`, `@deepseek-ai/schemastery ^3.18.2`. |
34
+ | Harness | DeepSeek Harness `0.1.5-rc.1` (tag `dsh-v0.1.7-alpha.2` = `183f08e9c6dd`; relevo tramo A→B `dsh-v0.1.7-alpha.2` = `5dda764ed3aa`; inicio del corredor `0.1.3-alpha.1`) y, para `legC`, DeepSeek Harness `0.1.6-alpha.2` (tag `dsh-v0.1.7-alpha.2`). Banda de peers `@deepseek-ai/dsh-skill >=0.1.2-rc.1 <0.2.0 \|\| >=0.1.5-alpha.1 <0.2.0 \|\| >=0.1.6-0 <0.2.0 \|\| >=0.1.7-0 <0.2.0`, `@deepseek-ai/cordis ^4.0.2`, `@deepseek-ai/schemastery ^3.18.2`. |
33
35
  | Node | `^22.19.0 \|\| >=24.0.0` |
34
36
  | Plataformas | Donde corra Node; el escáner solo usa el sistema de archivos y es neutral respecto a la plataforma |
35
37
  | Modelo | Modelos solo de texto totalmente soportados; la habilidad es un Markdown, sin requisitos de herramientas ni visión |
36
- | Alcance | **Dos tramos cerrados, un solo lapso**: tramo A `0.1.3-alpha.1` → `0.1.5-alpha.1` más tramo B `0.1.5-alpha.1` → `0.1.5-rc.1`. Un corredor nunca se ensancha: un salto posterior a `0.1.5-rc.1` es un paquete nuevo. |
37
- | Tramos | Ambos tramos viven en este paquete: el tramo A conserva las costuras `S1`–`S10` + `M1`, el tramo B conserva `C1`, `C2`, `C4`, `C5`, `H1`–`H4`, `P1` — cada uno con su propia evidencia, sección de tarjeta, fixtures y ruta de reversión. No hay paquete hermano que instalar. |
38
+ | Índice de corredores | Un paquete, un punto de entrada. `lib/route.mjs` contiene los corredores cerrados y la CLI enruta al que corresponde según la banda declarada del repo destino (`engines.dsh`, los rangos `@deepseek-ai/dsh*`); `--span legAB\|legC` anula la conjetura y una banda no declarada recae en el corredor más antiguo. Los dos catálogos nunca se fusionan: cada corredor conserva su propio array de costuras, tarjeta, evidencia, fixtures y puerta de paridad. |
39
+ | Alcance | **Dos corredores cerrados**: `legAB` = `0.1.3-alpha.1` → `0.1.5-rc.1` (tramo A + tramo B), `legC` = `0.1.5-rc.2` → `0.1.6-alpha.2`. Un corredor nunca se ensancha: un salto que añade una costura es un corredor nuevo — una tarjeta nueva y una fila nueva en el índice, no un paquete nuevo. |
40
+ | Tramos | Cada tramo vive en este paquete: el tramo A conserva las costuras `S1`–`S10` + `M1`, el tramo B conserva `C1`, `C2`, `C4`, `C5`, `H1`–`H4`, `P1`, y el tramo C conserva `E1`–`E5` — cada uno con su propia evidencia, sección de tarjeta, fixtures y ruta de reversión. No hay paquete hermano que instalar. |
38
41
  | `C3` | Retirada: la tarjeta del tramo B escribía como `C3` el falso verde de la línea de tipos obsoleta, que es el mismo defecto que el `M1` del tramo A. La fusión queda registrada en la tarjeta; `--seams C3` no coincide con nada. |
39
42
  | Paquete anterior | No montes el retirado `dsh-plugin-upgrade` en el mismo perfil: ambos registran la skill `plugin-upgrade`, así que el segundo montaje colisiona con ese nombre. Ese paquete está obsoleto en npm y su repositorio se retiró; este paquete sustituye sus dos tramos. |
40
43
 
41
44
  ## Lo que obtienes
42
45
 
43
- Dos mitades, un solo catálogo de costuras:
46
+ Dos mitades, un catálogo de costuras por corredor:
44
47
 
45
48
  - **Una habilidad de agente incluida (`plugin-upgrade`)** — la tarjeta del corredor fusionado y un bucle de arreglar-y-verificar. El cuerpo primero enruta a quien la llama al tramo que corresponde a su banda de peers; el modelo la carga solo cuando una tarea la necesita de verdad, y el paquete no aporta ningún párrafo al prompt del sistema ni registra herramientas.
46
- - **Una CLI sin dependencias (`dsh-plugin-upgrade-scan`)** — informa hechos `file:line` de las veinte costuras fusionadas (`S3`, `S8`, `S9`, `M1`, `S4`, `S5`, `S6`, `S7`, `S2`, `S1`, `S10`, `C1`, `C2`, `P1`, `C4`, `C5`, `H1`, `H2`, `H4`, `H3`) releídas de los rangos de tags del harness el 2026-09-09 (tramo A) y el 2026-09-10 (tramo B). Sale con `1` ante cualquier hallazgo de severidad error, así que entra directo en CI.
49
+ - **Una CLI sin dependencias (`dsh-plugin-upgrade-scan`)** — resuelve el corredor e informa hechos `file:line` de las costuras de ese corredor: las veinte de `legAB` (`S3`, `S8`, `S9`, `M1`, `S4`, `S5`, `S6`, `S7`, `S2`, `S1`, `S10`, `C1`, `C2`, `P1`, `C4`, `C5`, `H1`, `H2`, `H4`, `H3`) releídas de los rangos de tags del harness el 2026-09-09 (tramo A) y el 2026-09-10 (tramo B), o las cinco de `legC` (`E1`–`E5`) medidas en `dsh-v0.1.7-alpha.1` (2026-09-19). Sale con `1` ante cualquier hallazgo de severidad error, así que entra directo en CI.
47
50
 
48
51
  El objetivo es el modo de fallo que este corredor existe para matar: **la rotura de este lapso es mayormente silenciosa, y lo es por ambos extremos.** La línea de tipos puede estar obsoleta, así que el repo compila contra el **catálogo antiguo** (costura `M1`), y el slot de cliente desnudo `conversation` se eliminó sin alias mientras `ctx.slots.inject()` solo ejecuta su callback cuando la declaración existe: una mitad de cliente que aún lo apunta deja de montarse sin error, sin línea de log y sin build fallido (costura `C1`). Tres clases de rotura sobreviven a `typecheck` + `test`:
49
52
 
@@ -66,8 +69,8 @@ dsh --profile web --dump-config | grep -A3 'id: dsh-plugin-upgrade'
66
69
  npx dsh-plugin-upgrade-scan --repo ../my-plugin
67
70
  ```
68
71
 
69
- Luego pide al agente que use la habilidad `plugin-upgrade`, o lleva el bucle tú mismo con la tarjeta en
70
- `skills/plugin-upgrade/references/v0.1.3-alpha.1-to-v0.1.5-rc.1.md` (el tramo A es §1, el tramo B es §2, el índice de costuras fusionado es §3).
72
+ Luego pide al agente que use la habilidad `plugin-upgrade`, o lleva el bucle tú mismo con la tarjeta que corresponda a tu banda:
73
+ `skills/plugin-upgrade/references/v0.1.3-alpha.1-to-v0.1.5-rc.1.md` (`legAB` — el tramo A es §1, el tramo B es §2, el índice de costuras fusionado es §3) o `skills/plugin-upgrade/references/v0.1.5-rc.2-to-v0.1.6-alpha.2.md` (`legC`). El escáner elige el corredor por ti; añade `--span legC` cuando la banda declarada sea ambigua.
71
74
 
72
75
  ## Instalación y desinstalación
73
76
 
@@ -107,19 +110,20 @@ El plugin monta de forma ruidosa: un `SKILL.md` ausente, un cuerpo vacío o un f
107
110
  **CLI** — `dsh-plugin-upgrade-scan`:
108
111
 
109
112
  ```sh
110
- dsh-plugin-upgrade-scan [--repo <path>] [--json <out.json>] [--seams S3,C1,P1] [--quiet]
113
+ dsh-plugin-upgrade-scan [--repo <path>] [--span legAB|legC|<span>] [--json <out.json>] [--seams S3,C1,P1] [--quiet]
111
114
  ```
112
115
 
113
116
  | Bandera | Significado |
114
117
  |---|---|
115
- | `--repo <path>` | Repositorio a escanear (por defecto: el directorio actual). |
118
+ | `--repo <path>` | Repositorio a escanear (por defecto: el directorio actual). Su banda dsh declarada elige el corredor. |
119
+ | `--span legAB\|legC\|<span>` | Fuerza un corredor en lugar de conjeturarlo desde la banda declarada. Una banda desconocida recae en `legAB`. |
116
120
  | `--json <out.json>` | También escribe el informe legible por máquina (`repo`, `scannedAt`, `files`, `hits[]`, `bySeam`). |
117
- | `--seams S3,C1,P1` | Restringe a costuras concretas del catálogo fusionado. |
121
+ | `--seams S3,C1,P1` | Restringe a costuras concretas del catálogo del corredor resuelto (los ids nunca se comparten entre corredores). |
118
122
  | `--quiet` | Suprime la salida humana (combínala con `--json`). |
119
123
 
120
124
  Códigos de salida: `0` sin hallazgos de severidad error · `1` al menos un hallazgo de severidad error · `2` uso o fallo del escaneo. Un escaneo limpio es necesario pero no suficiente: el criterio de salida es un smoke real en el host, más un ida y vuelta de reanudación para los escritores de logs (tramo A) y una aserción en un navegador real para la mitad de cliente (tramo B).
121
125
 
122
- ## Las veinte costuras
126
+ ## Las veinte costuras de `legAB`
123
127
 
124
128
  El orden sigue el catálogo de `lib/scan.mjs` (primero el tramo A, luego el tramo B), que es también el orden al que `test/card.test.mjs` fija la tarjeta.
125
129
 
@@ -148,9 +152,23 @@ El orden sigue el catálogo de `lib/scan.mjs` (primero el tramo A, luego el tram
148
152
 
149
153
  `S7`, `S2`, `S1`, `S10`, `C4`, `C5`, `H1`, `H2` y `H4` son deliberadamente asesorables: tienen coincidencias legítimas (un repo que ya usa la API nueva, una instantánea de documentación, la tabla de ids de modelo de un plugin, un `ChildProcess.pid` de Node), así que el escáner las reporta como pistas para revisión manual, no como fallos. `M1` y `P1` son comprobaciones **estructurales** — resuelven `package.json` y `tsconfig*.json` en lugar de coincidir texto — y `H3` es **solo de tarjeta**: documentada, con paridad de ids comprobada y deliberadamente sin detector (`CARD_ONLY = ['H3']`).
150
154
 
155
+ ## Las cinco costuras de `legC` (`0.1.5-rc.2` → `0.1.6-alpha.2`)
156
+
157
+ El orden sigue el catálogo de `lib/scan-0.1.6.mjs`, que es también el orden al que `test/card.test.mjs` fija la tarjeta de `legC`. Aquí toda costura es `error` y todas se detectan (`CARD_ONLY = []`).
158
+
159
+ | Id | Severidad | Qué cambió en el camino a `0.1.6-alpha.2` |
160
+ |---|---|---|
161
+ | `E1` | error | `agent/created` despacha sus listeners en serie: un listener que lanza — o que hace trabajo lento — bloquea por completo la creación del agente. Envuelve el trabajo síncrono en `try`/`catch` y aplaza el resto con `queueMicrotask`/`setImmediate` o tu propia cola. |
162
+ | `E2` | error | Un `apply()` asíncrono cuyo primer `await` precede a sus registros: todo lo registrado después cae en la ventana de descarga y lanza `INACTIVE_EFFECT`, mientras el cierre antiguo sigue corriendo. Registra todo antes del primer `await`, dentro de un único `ctx.effect()`. |
163
+ | `E3` | error | Claves de slot/estado eliminadas: `settings.plugin.item` pasó a ser el keyed→list `plugins.item`, y `SessionListState.current` desapareció — una tarjeta de ajustes desaparece **en silencio** (retorno temprano por `spec === undefined`), y los casts de `current` siguen compilando mientras la función está muerta. |
164
+ | `E4` | error | API de cliente eliminada: `sessions.open` / `openSubagent` / `clear` pasaron a `retain` / `using` / `retainInfo`. |
165
+ | `E5` | error | Literales de modelo eliminados: `deepseek-v4-flash*` y `deepseek-v4-vision-exp`. El catálogo de modelos por defecto se encogió de 4 a 2, y un id sin catalogar pasa tal cual como solo texto. |
166
+
167
+ Se aplica la misma disciplina que en `legAB`: un escaneo limpio es necesario, no suficiente. La rotura de `legC` es silenciosa o solo en tiempo de ejecución (la línea de tipos publicada oculta las eliminaciones), así que el criterio de salida sigue siendo un smoke real en el host sobre un `DSH_HOME` temporal, más el ida y vuelta del escritor de logs y la aserción en navegador real donde correspondan.
168
+
151
169
  ## Lo que esto no cubre
152
170
 
153
- - **Un salto posterior a `0.1.5-rc.1`.** El lapso fusionado termina en rc.1 por construcción: el salto del harness `0.1.5-rc.1` → `0.1.5-rc.2` no añadió ninguna costura de cara a los plugins (el pin de dev/test y la sonda de CI de este propio paquete corren sobre la línea `0.1.5-rc.2`, de modo que el catálogo queda verificado contra los tipos publicados más recientes). Cualquier cosa que añada una costura más adelante es un **paquete nuevo**: una tarjeta que deriva es peor que ninguna tarjeta.
171
+ - **Un salto más allá de todos los corredores de aquí.** `legAB` termina en `0.1.5-rc.1` por construcción: el salto del harness `0.1.5-rc.1` → `0.1.5-rc.2` no añadió ninguna costura de cara a los plugins (el pin de dev/test de este propio paquete corre ahora sobre la línea `0.1.7-alpha.2`, de modo que el catálogo queda verificado contra esos tipos publicados; la sonda del workflow compat sigue anclada en `0.1.6-alpha.2`), y `legC` cubre `0.1.5-rc.2` → `0.1.6-alpha.2`. Un salto posterior que añada una costura **no** está cubierto: un corredor está cerrado, y ensanchar una tarjeta es peor que añadir una. Ese salto recibe una tarjeta nueva y una fila nueva en el índice — no un paquete nuevo.
154
172
  - **El salto `0.1.1` → `0.1.2`.** Usa la habilidad de convergencia de la comunidad.
155
173
  - **Repetir entre tramos.** El tramo A posee las costuras del formato de sesión (`assistant/message.stream`, `SessionHandleReadResult`, `EpochHeader.system`, `ctx.agent`, `Inbox`, `SystemPrompt.persona`, la generación de log V3) y el tramo B no las repite: todo el diff de `packages/core/session/src` en el rango del tramo B son dos literales de tipo de evento añadidos y una línea de comentario. La sección de tarjeta de cada tramo conserva su propia declaración de alcance.
156
174
  - **La ruta de actualización del usuario de DSH.** Este paquete actualiza *código fuente de plugins*, no la instalación del harness de un usuario.
@@ -175,15 +193,20 @@ npm run check:readmes # consistencia de los README en cinco idiomas
175
193
  npm pack
176
194
  ```
177
195
 
178
- El escáner tiene un par de fixtures sintéticos **por tramo**: `fixtures/leg-a-bad-repo` (las costuras de sesión/configuración del tramo A, con todas las costuras de error presentes a propósito) junto con `fixtures/leg-a-good-repo` (adaptado), y `fixtures/bad-repo` (las costuras de slot de cliente del tramo B) junto con `fixtures/good-repo` (adaptado) — más un negativo en vivo sobre un repositorio de la familia ya fijado a `0.1.5-rc.1`, de modo que una regresión del catálogo falla en esta suite y no en un usuario aguas abajo. `test/card.test.mjs` afirma que el índice de la tarjeta fusionada y `lib/scan.mjs` nombran **exactamente** los mismos veinte ids de costura con las mismas severidades, y que `CARD_ONLY` es exactamente `['H3']`: la regla de vinculación de evidencia como puerta de máquina.
196
+ El escáner tiene un par de fixtures sintéticos **por tramo de `legAB`**: `fixtures/leg-a-bad-repo` (las costuras de sesión/configuración del tramo A, con todas las costuras de error presentes a propósito) junto con `fixtures/leg-a-good-repo` (adaptado), y `fixtures/bad-repo` (las costuras de slot de cliente del tramo B) junto con `fixtures/good-repo` (adaptado) — más un negativo en vivo sobre un repositorio de la familia ya fijado a `0.1.5-rc.1`, de modo que una regresión del catálogo falla en esta suite y no en un usuario aguas abajo. `test/card.test.mjs` afirma que el índice de cada tarjeta y su propio catálogo (`lib/scan.mjs` para `legAB`, `lib/scan-0.1.6.mjs` para `legC`) nombran **exactamente** los mismos ids de costura con las mismas severidades, que el `CARD_ONLY` de `legAB` es exactamente `['H3']` mientras el de `legC` está vacío, y que los dos catálogos no comparten ningún id de costura — la regla de vinculación de evidencia como puerta de máquina, por corredor.
179
197
 
180
198
  ## Temas
181
199
 
182
200
  `dsh`, `dsh-plugin`, `deepseek-harness`, `deepseek`, `cordis`, `plugin-upgrade`, `migration`, `skill`, `version-card`, `scanner`, `client-slots` (reflejan las `keywords` de `package.json`; `dsh-plugin` es el canal de visibilidad del ecosistema).
183
201
 
184
- ## Familia de plugins DSH de PerryLink
202
+ ## Licencia
203
+
204
+ Apache-2.0 — consulta [LICENSE](LICENSE). Las dependencias de instalación y sus licencias están en [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md); no se incluye nada empaquetado.
185
205
 
186
- Este proyecto es uno de los [40 complementos de DeepSeek Harness](https://github.com/PerryLink) mantenidos por [PerryLink](https://github.com/PerryLink). Si este te ayuda, probablemente los demás también:
206
+
207
+ ## PerryLink DSH Plugin Family
208
+
209
+ This project is one of the **45 DeepSeek Harness plugins** maintained by [PerryLink](https://github.com/PerryLink). If this one helps you, the others likely will too:
187
210
 
188
211
  | Plugin | One-liner |
189
212
  |---|---|
@@ -193,49 +216,42 @@ Este proyecto es uno de los [40 complementos de DeepSeek Harness](https://github
193
216
  | **[dsh-budget](https://github.com/PerryLink/dsh-budget)** | Cost governance for DeepSeek Harness: budgets, carbon, and latency in one panel. | |
194
217
  | **[dsh-catalog](https://github.com/PerryLink/dsh-catalog)** | DSH Desktop Market standard catalog source for the PerryLink family | |
195
218
  | **[dsh-cert-mcp](https://github.com/PerryLink/dsh-cert-mcp)** | Read-only MCP server exposing the certification registry: grades, snapshots and five-dimension evidence | |
196
- | **[dsh-checkpoint-rewind](https://github.com/PerryLink/dsh-checkpoint-rewind)** | Unified session + workspace + config checkpoints with one-shot `/rewind` | |
197
- | **[dsh-claude-move](https://github.com/PerryLink/dsh-claude-move)** | Migrate Claude Code, Codex, OpenCode and Hermes sessions, memories and skills into DSH | |
219
+ | **[dsh-checkpoint-rewind](https://github.com/PerryLink/dsh-checkpoint-rewind)** | Claude Code /rewind-equivalent: snapshots, session forks, one-shot restore | |
220
+ | **[dsh-claude-move](https://github.com/PerryLink/dsh-claude-move)** | Migrate Claude Code sessions, memory, skills and CLAUDE.md into DSH | |
198
221
  | **[dsh-click](https://github.com/PerryLink/dsh-click)** | Cross-platform native desktop control for DeepSeek Harness — Windows first. | |
199
222
  | **[dsh-composer-history](https://github.com/PerryLink/dsh-composer-history)** | Terminal-style input history for the web composer: arrows, Ctrl+R search | |
200
- | **[dsh-data-quality](https://github.com/PerryLink/dsh-data-quality)** | Deterministic dataset profiling, cleaning and citation verification | |
223
+ | **[dsh-data-quality](https://github.com/PerryLink/dsh-data-quality)** | Dataset quality checks and citation cross-checks (the optional numeric bridge consumed here) | |
201
224
  | **[dsh-defend](https://github.com/PerryLink/dsh-defend)** | Prompt-injection, jailbreak, and secret-leak defense for DeepSeek Harness. | |
202
225
  | **[dsh-doublecheck](https://github.com/PerryLink/dsh-doublecheck)** | Engineering-discipline guard: requirements grill, test gates, adversary review | |
203
226
  | **[dsh-draw](https://github.com/PerryLink/dsh-draw)** | Unified static-image generation routing for DeepSeek Harness. | |
204
- | **[dsh-fast](https://github.com/PerryLink/dsh-fast)** | Read-only performance diagnostics: load, spill, compaction and cache hit rate | |
205
- | **[dsh-fund-research](https://github.com/PerryLink/dsh-fund-research)** | Chinese mutual-fund research with sealed, traceable source snapshots | |
206
- | **[dsh-github](https://github.com/PerryLink/dsh-github)** | GitHub PR/issue/CI integration with every write approval-gated | |
207
- | **[dsh-industry-research](https://github.com/PerryLink/dsh-industry-research)** | Industry and company research pack: chain map, policy timeline, company cards | |
208
- | **[dsh-kit](https://github.com/PerryLink/dsh-kit)** | One-command starter pack that installs the core family | |
209
- | **[dsh-library](https://github.com/PerryLink/dsh-library)** | Local document knowledge base with hybrid search and citation-aware injection | |
210
- | **[dsh-local-ai](https://github.com/PerryLink/dsh-local-ai)** | Local Ollama model discovery and task-based routing with cloud fallback | |
211
- | **[dsh-lsp-actions](https://github.com/PerryLink/dsh-lsp-actions)** | LSP diagnostics, formatting, completion, code actions, symbols and rename | |
212
- | **[dsh-mask](https://github.com/PerryLink/dsh-mask)** | PII masking at the model boundary with a host-side restore table | |
213
- | **[dsh-mcp-panel](https://github.com/PerryLink/dsh-mcp-panel)** | MCP management console: `/mcp` command, Settings tab and trial calls | |
214
- | **[dsh-memento](https://github.com/PerryLink/dsh-memento)** | Approval-gated cross-session memory protocol (`ctx.memory` + SQLite) | |
215
- | **[dsh-observe](https://github.com/PerryLink/dsh-observe)** | OpenTelemetry and Langfuse telemetry export from the session event stream | |
216
- | **[dsh-output-styles](https://github.com/PerryLink/dsh-output-styles)** | Runtime-switchable model output styles | |
217
- | **[dsh-permission-rules](https://github.com/PerryLink/dsh-permission-rules)** | Declarative allow/deny/ask rules plus a process-level network policy | |
227
+ | **[dsh-fast](https://github.com/PerryLink/dsh-fast)** | Read-only performance diagnostics for DeepSeek Harness. | |
228
+ | **[dsh-fund-research](https://github.com/PerryLink/dsh-fund-research)** | Deterministic research reports for Chinese public mutual funds | |
229
+ | **[dsh-github](https://github.com/PerryLink/dsh-github)** | GitHub PR/issues integration for DSH, every write gated by approval | |
230
+ | **[dsh-industry-research](https://github.com/PerryLink/dsh-industry-research)** | Industry research orchestration that seals its deliverables through this plugin's `ctx.researchReport.assemble` | |
231
+ | **[dsh-laya](https://github.com/PerryLink/dsh-laya)** | Laya typed decisions (`noul`/`choice`/`score`) as a first-class Cordis service and model-visible tools | |
232
+ | **[dsh-library](https://github.com/PerryLink/dsh-library)** | Local document knowledge base for DeepSeek Harness. | |
233
+ | **[dsh-local-ai](https://github.com/PerryLink/dsh-local-ai)** | Local-model (Ollama) integration for DeepSeek Harness. | |
234
+ | **[dsh-lsp-actions](https://github.com/PerryLink/dsh-lsp-actions)** | LSP diagnostics, formatting, completion, code actions and rename over language servers | |
235
+ | **[dsh-mask](https://github.com/PerryLink/dsh-mask)** | PII masking middleware: anonymize at the model boundary, restore at the display layer | |
236
+ | **[dsh-mcp-panel](https://github.com/PerryLink/dsh-mcp-panel)** | Read-only MCP runtime panel: /mcp command + Settings tab with status, tools and errors | |
237
+ | **[dsh-memento](https://github.com/PerryLink/dsh-memento)** | Approval-gated cross-session memory: ctx.memory seam + SQLite + memory tool | |
238
+ | **[dsh-observe](https://github.com/PerryLink/dsh-observe)** | OpenTelemetry and Langfuse observability exporter for DeepSeek Harness. | |
239
+ | **[dsh-output-styles](https://github.com/PerryLink/dsh-output-styles)** | Claude Code outputStyles-equivalent runtime style switching | |
240
+ | **[dsh-permission-rules](https://github.com/PerryLink/dsh-permission-rules)** | Claude Code-style declarative allow/deny/ask permission rules with audit | |
218
241
  | **[dsh-plugin-certification](https://github.com/PerryLink/dsh-plugin-certification)** | Community certification registry with repro-checkable grades and badges | |
219
242
  | **[dsh-plugin-doctor](https://github.com/PerryLink/dsh-plugin-doctor)** | Zero-dependency static + sandbox smoke detector for DSH plugins | |
220
- | **[dsh-plugin-guide](https://github.com/PerryLink/dsh-plugin-guide)** | Plugin-dev knowledge base, agent skill and the `dsh-plugin-dev` CLI toolchain | |
243
+ | **[dsh-plugin-guide](https://github.com/PerryLink/dsh-plugin-guide)** | Plugin-development knowledge base as an on-demand agent skill | |
221
244
  | **[dsh-plugin-kit](https://github.com/PerryLink/dsh-plugin-kit)** | Shared zero-runtime-dependency toolkit for the PerryLink DSH plugins | |
222
- | **[dsh-plugin-portal](https://github.com/PerryLink/dsh-plugin-portal)** | Zero-dependency static portal rendering the whole plugin family as one page | |
223
- | **[dsh-reach](https://github.com/PerryLink/dsh-reach)** | Multi-channel approval/question bridge: WeChat, Telegram, Feishu + a session console | |
224
- | **[dsh-research-report](https://github.com/PerryLink/dsh-research-report)** | Verifiable research reports: evidence ledger, manifest seal, per-claim verdicts | |
225
- | **[dsh-score](https://github.com/PerryLink/dsh-score)** | Multi-dimensional plugin quality scoring with an evidence-backed leaderboard | |
226
- | **[dsh-session-pin](https://github.com/PerryLink/dsh-session-pin)** | Pin sessions and workspaces in the Web sidebar with per-pin colors | |
227
- | **[dsh-session-sync](https://github.com/PerryLink/dsh-session-sync)** | Git-backed cross-device session synchronization with keep-both merges | |
228
- | **[dsh-skill-pack-security](https://github.com/PerryLink/dsh-skill-pack-security)** | Security-audit skill pack plus the `plugin_vet` supply-chain gate | |
229
- | **[dsh-talk](https://github.com/PerryLink/dsh-talk)** | Voice-first session loop: speech-to-text input and text-to-speech replies | |
245
+ | **[dsh-plugin-upgrade](https://github.com/PerryLink/dsh-plugin-upgrade)** | One-package, one-corridor-index plugin upgrade skill: routes a repository to the matching closed corridor card | |
246
+ | **[dsh-plugin-upgrade-015](https://github.com/PerryLink/dsh-plugin-upgrade-015)** | Merged `0.1.3-alpha.1` → `0.1.5-rc.1` upgrade corridor card plus a zero-dependency seam scanner | |
247
+ | **[dsh-reach](https://github.com/PerryLink/dsh-reach)** | Multi-channel approval/question bridge: WeChat/Telegram/Feishu, session console | |
248
+ | **[dsh-research-report](https://github.com/PerryLink/dsh-research-report)** | Verifiable research-report engine: content-addressed evidence ledger and sealed versions | |
249
+ | **[dsh-score](https://github.com/PerryLink/dsh-score)** | Multi-dimensional quality scoring for DeepSeek Harness plugins. | |
250
+ | **[dsh-session-pin](https://github.com/PerryLink/dsh-session-pin)** | Pin sessions in the Web sidebar with durable ordering | |
251
+ | **[dsh-session-sync](https://github.com/PerryLink/dsh-session-sync)** | Cross-device session sync for DeepSeek Harness — a dedicated git mirror of your session store. | |
252
+ | **[dsh-skill-pack-security](https://github.com/PerryLink/dsh-skill-pack-security)** | Security-audit skill pack: secret scan, dependency and supply-chain review | |
253
+ | **[dsh-talk](https://github.com/PerryLink/dsh-talk)** | Voice-first session loop for DeepSeek Harness: talk to it, hear it answer. | |
230
254
  | **[dsh-team-rooms](https://github.com/PerryLink/dsh-team-rooms)** | Cross-session team rooms: shared message bus, task board and timeline | |
231
- | **[dsh-test-drive](https://github.com/PerryLink/dsh-test-drive)** | Isolated install-and-smoke test drives with a pass/fail matrix | |
232
- | **[dsh-ticktick](https://github.com/PerryLink/dsh-ticktick)** | TickTick/Dida365 task bridge: session-header panel plus eleven agent tools | |
233
- | **[dsh-translate](https://github.com/PerryLink/dsh-translate)** | Vendor parameter translation and deterministic JSON repair | |
234
- | **[dsh-wechat](https://github.com/pan17/dsh-wechat)** | WeChat ↔ DSH bridge (Tencent iLink bot) developed with [pan17](https://github.com/pan17/dsh-wechat), who hosts the repo | |
235
- | **[dsh-personal-directive](https://github.com/PerryLink/dsh-personal-directive)** | Personal directive injector with a top-bar toggle (fork of liucai2026/dsh-personal-directive) | |
236
-
237
- Parte de la familia de plugins DSH de PerryLink: más de 40 repositorios que cubren sesiones, memoria, permisos, entrega, observabilidad y herramientas para desarrolladores. Explora el catálogo en [perrylink-dsh-catalog.perrylink.workers.dev](https://perrylink-dsh-catalog.perrylink.workers.dev) o el [tema `dsh-plugin`](https://github.com/topics/dsh-plugin).
238
-
239
- ## Licencia
240
-
241
- Apache-2.0 — consulta [LICENSE](LICENSE). Las dependencias de instalación y sus licencias están en [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md); no se incluye nada empaquetado.
255
+ | **[dsh-test-drive](https://github.com/PerryLink/dsh-test-drive)** | Isolated install-and-smoke test drives for DeepSeek Harness plugins. | |
256
+ | **[dsh-ticktick](https://github.com/PerryLink/dsh-ticktick)** | TickTick/Dida365 task bridge: session-header panel + 11 tools | |
257
+ | **[dsh-translate](https://github.com/PerryLink/dsh-translate)** | Vendor parameter translation and deterministic JSON repair for DeepSeek Harness. | |