dsh-pr-release-workspace 0.0.0-stage → 0.1.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 tangyixiao
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,195 @@
-# Temporary Holding Version
+# dsh-pr-release-workspace
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+A pull request and release workspace for [DeepSeek Harness](https://github.com/deepseek-harness). It adds one sidebar entry that
+does two jobs: review pull requests without leaving DSH, and check whether a release
+actually shipped.
+
+The second job is the reason this plugin exists. A merged pull request, a green CI run, a
+published npm version, a GitHub Release, a merged market pull request, a market manifest
+entry and a live index update are seven different facts. Most release dashboards show one
+of them and call it done. This one takes the pull request as its target and shows the other
+six as separate verdicts, refusing to say "released" until every one of them passes.
+
+Licence: MIT. Author: Tang Yixiao.
+
+---
+
+## Requirements
+
+| Requirement | Why |
+| --- | --- |
+| DSH `>= 0.1.6-alpha.2` | The panel uses the `sidebar.panellist` and `main` slots |
+| Node `>= 22` | The host half uses `AbortSignal.any` |
+| [GitHub CLI](https://cli.github.com/) `gh` on `PATH`, signed in (`gh auth login`) | Every GitHub read goes through your existing `gh` session |
+| `read:org` scope for the team tab | `gh auth refresh -s read:org` if your token lacks it |
+
+The plugin never asks for a token of its own and never reads a browser cookie. It shells
+out to `gh`, so whatever `gh` can see is what the panel can see, and nothing more.
+
+---
+
+## Install
+
+```sh
+dsh plugin --profile <profile> add dsh-pr-release-workspace
+```
+
+In the desktop app the active profile is managed by the application itself, so install the
+package from the plugin market inside DSH, or add it to a profile you control:
+
+```sh
+dsh plugin --profile web add dsh-pr-release-workspace
+```
+
+Then restart the host and open **Pull requests** in the left sidebar.
+
+To try it from a local checkout instead:
+
+```sh
+dsh plugin --profile <profile> add file:/absolute/path/to/dsh-pr-release-workspace
+```
+
+## Uninstall
+
+```sh
+dsh plugin --profile <profile> remove dsh-pr-release-workspace
+```
+
+Local review notes survive an uninstall. Delete `~/.dsh/storages/dsh-pr-release-workspace/drafts.json`
+if you want them gone too.
+
+---
+
+## What you get
+
+### The sidebar entry
+
+One icon in the left rail. The panel has two halves, switched by a pair of pills at the top.
+
+### Pull requests
+
+Three lists, each loaded independently:
+
+| List | Query |
+| --- | --- |
+| Created by me | `is:pr author:@me is:open` |
+| Awaiting my review | `is:pr review-requested:@me is:open` |
+| Awaiting my team | `is:pr team-review-requested:<your-teams> is:open` |
+
+A list that could not be loaded says so, per list. A list whose team membership could not be
+confirmed says so — it is never rendered as "no results", because "we could not check" and
+"there is nothing" are different statements.
+
+The search box takes a pasted `https://github.com/owner/repo/pull/123` URL, the
+`owner/repo#123` shorthand, or free text passed to GitHub's search.
+
+### The pull request view
+
+Four tabs:
+
+- **Overview** — author, description, base and head branches, mergeable state, file and
+  line counts, and the CI rollup with one row per check.
+- **Files** — the changed file list with line totals. Expand a file for its diff, written as
+  old-side and new-side text and rendered by the host's own diff component.
+- **Comments** — review verdicts, conversation comments, and inline comments with their file
+  and line.
+- **My notes** — review notes you write locally, per file and per line.
+
+CI is reported as one of: passed, failed, pending, cancelled, only skipped checks, not
+configured, or unknown. An empty check list is **not configured**, never "passed". A
+cancelled run is not a pass. This distinction matters: a repository with no CI has not
+verified anything.
+
+### Release state
+
+Fill in the target — owner, repo, tag, commit SHA, npm package name, version, and the market
+repository plus pull request number — and the panel reports six independent facts:
+
+| Fact | Read from |
+| --- | --- |
+| Commit checks | check runs on the exact commit |
+| GitHub Release | the release for the tag |
+| npm | the published version and the `latest` dist-tag |
+| Market pull request | the market repository's pull request |
+| Market manifest | `market.json` on the market's default branch |
+| Live index | the published market index URL |
+
+Each row shows its own verdict, its reason, and the evidence it read. The summary reads
+"every fact checks out" only when all six pass.
+
+Three cases this is built to catch, all observed in the wild:
+
+- The market pull request is merged, but the manifest on `main` lists a *newer* version than
+  the one you asked about — so merging that PR did not publish your version.
+- npm has the version, but `latest` points somewhere else — so a plain `npm install` does not
+  get it.
+- The release exists, but CI on that commit is still pending — so nobody verified the
+  artifact.
+
+## What it does not do
+
+- **It does not write to GitHub.** No comments, no reviews, no approvals, no merges. Every
+  one of those is a decision with a name attached, and the panel is not where you make it.
+  Each pull request view links to GitHub for those actions.
+- **It does not read browser cookies or store a token.** Authentication is `gh`'s.
+- **It does not write pull request content to logs.** Errors are flattened to a code before
+  they are logged; a GitHub error message can quote private text.
+- **It does not cache pull request content on disk.** Lists and diffs are re-fetched. The
+  only file it writes is your own local notes.
+- **It does not render Markdown or HTML from GitHub.** Descriptions show as text with
+  `http(s)` links; a Markdown renderer is a large attack surface for a panel that can reach a
+  local HTTP route.
+
+## Local notes and privacy
+
+Notes are stored at `~/.dsh/storages/dsh-pr-release-workspace/drafts.json` (or under
+`$DSH_HOME`). Each note records the pull request, the commit it was written against, the
+file, and the line.
+
+A note written against an earlier commit is marked **stale** rather than moved to whatever
+now occupies that line. The read path never rewrites a note's position.
+
+Nothing leaves the machine. Nothing is posted. Deleting a note deletes it.
+
+## Routes
+
+The client talks to the host on `POST /dsh-pr-release-workspace/<endpoint>`. The route
+accepts only `POST` with `content-type: application/json`, rejects cross-site and foreign
+`Origin` requests, caps bodies at 1 MiB, and answers with a JSON envelope:
+`{"ok":true,"value":…}` or `{"ok":false,"error":{"code":…,"message":…}}`. Endpoint names and
+GitHub owner/repo/number arguments are validated against a fixed pattern before they reach
+`gh`; `gh` is spawned with an argument array, never a shell string.
+
+## Known limits
+
+- `gh pr view --json files` silently truncates at 100 files. The panel reports the real
+  changed-file count and says when it is showing fewer.
+- Diffs over 300 files cannot be fetched as one diff. The panel reassembles them from
+  per-file patches and says so.
+- A binary file has no text sides and renders as "binary file".
+- GitHub's search API allows 30 requests a minute. Reloading the three lists in a tight loop
+  will hit the limit; the panel then says how long to wait.
+- DSH `0.1.6-alpha.2` has no native diff or review panel to reuse, so the diff view is built
+  on the `DiffBlock` component that ships with `@deepseek-ai/dsh-client-ui-primitives`.
+
+## Development
+
+```sh
+npm install
+npm run build      # concatenates src/client/*.js into lib/client.js
+npm test           # node --test, 100+ cases
+```
+
+There is no bundler. `lib/client.js` is assembled from numbered fragments in `src/client/`,
+each of which appends to one namespace object, and is wrapped in the loader call DSH expects.
+The numeric prefixes are load order and must not be renumbered.
+
+`lib/host/` is plain ESM, no build step.
+
+See `docs/baseline.md` for the host-version research this was built against,
+`docs/research/gh-api.md` for the verified `gh` behaviour table, and
+`docs/research/native-review.md` for what native capability exists to reuse (almost none).
+
+## Licence
+
+MIT — see [LICENSE](./LICENSE).

package/README.zh.md

@@ -0,0 +1,167 @@
+# dsh-pr-release-workspace
+
+[DeepSeek Harness](https://github.com/deepseek-harness) 的拉取请求与发布工作台。左侧加一个入口，做两件事：
+不离开 DSH 就能看 PR，以及核验一次发布到底有没有真的发出去。
+
+第二件事才是这个插件存在的理由。PR 已合并、CI 已通过、npm 已发布、GitHub Release 已发布、
+市场 PR 已合并、市场清单里有这一版、线上索引已更新 —— 这是七个不同的事实。多数发布面板显示其中
+一个就当成了全部。这个面板并排显示六个判据，六个都通过之前不会说「已发布」。
+
+许可证：MIT。作者：Tang Yixiao。
+
+---
+
+## 环境要求
+
+| 要求 | 原因 |
+| --- | --- |
+| DSH `>= 0.1.6-alpha.2` | 面板用到 `sidebar.panellist` 和 `main` 两个扩展点 |
+| Node `>= 22` | 宿主侧用到 `AbortSignal.any` |
+| `PATH` 上有 [GitHub CLI](https://cli.github.com/) `gh`，并且已登录（`gh auth login`） | 所有 GitHub 读取都走你现有的 `gh` 会话 |
+| 「团队待审」需要 `read:org` scope | 没有就 `gh auth refresh -s read:org` |
+
+插件不申请自己的 token，也不读浏览器 Cookie。它就是调 `gh` —— `gh` 能看到的，面板才能看到，不会更多。
+
+---
+
+## 安装
+
+```sh
+dsh plugin --profile <profile> add dsh-pr-release-workspace
+```
+
+桌面版的当前 profile 由应用自己管理，所以请在 DSH 的插件市场里装，或者加到你自己的 profile：
+
+```sh
+dsh plugin --profile web add dsh-pr-release-workspace
+```
+
+重启宿主，然后在左侧栏打开 **拉取请求**。
+
+从本地目录试用：
+
+```sh
+dsh plugin --profile <profile> add file:/绝对路径/dsh-pr-release-workspace
+```
+
+## 卸载
+
+```sh
+dsh plugin --profile <profile> remove dsh-pr-release-workspace
+```
+
+本地批注不会因卸载消失。要一起清掉就删
+`~/.dsh/storages/dsh-pr-release-workspace/drafts.json`。
+
+---
+
+## 功能
+
+### 侧边栏入口
+
+左侧栏一个图标，面板顶部用两个 pill 切换两半。
+
+### 拉取请求
+
+三个列表，各自独立加载：
+
+| 列表 | 查询 |
+| --- | --- |
+| 我创建的 | `is:pr author:@me is:open` |
+| 待我审查 | `is:pr review-requested:@me is:open` |
+| 需要我的团队审查 | `is:pr team-review-requested:<你的团队> is:open` |
+
+某个列表加载失败就单独说失败。某个列表的团队成员身份无法确认，也单独说明 —— 绝不渲染成「没有内容」，
+因为「没法确认」和「确实没有」是两句话。
+
+搜索框接受粘贴的 `https://github.com/owner/repo/pull/123`、`owner/repo#123` 简写，或交给 GitHub 搜索的
+自由文本。
+
+### PR 详情
+
+四个标签页：
+
+- **概览** —— 作者、描述、base/head 分支、可否合并、文件与行数、CI 汇总（每个 check 一行）。
+- **文件** —— 变更文件列表与行数统计。展开就能看 diff，按旧侧/新侧文本渲染，用宿主自带的 diff 组件。
+- **评论** —— 评审结论、会话评论、带文件与行号的行内评论。
+- **我的批注** —— 你自己按文件和行写的本地评审批注。
+
+CI 只会是这几种之一：通过、失败、进行中、已取消、只有跳过的检查、未配置、未知。空的检查列表是
+**未配置**，不是「通过」。已取消的运行也不是通过。仓库根本没配 CI 的时候，它什么也没验证。
+
+### 发布状态
+
+填目标 —— owner、repo、tag、commit SHA、npm 包名、版本，以及市场仓库与 PR 号 —— 面板报告六个独立判据：
+
+| 判据 | 读取来源 |
+| --- | --- |
+| 提交检查 | 该 commit 上的 check runs |
+| GitHub Release | 该 tag 的 release |
+| npm | 已发布版本与 `latest` dist-tag |
+| 市场 PR | 市场仓库的那个 PR |
+| 市场清单 | 市场默认分支上的 `market.json` |
+| 线上索引 | 已发布的索引 URL |
+
+每行显示自己的结论、原因，以及它读到的证据。六项全通过时汇总行才显示「全部判据通过」。
+
+这三类情况是它专门要抓的，都是在真实数据里见过的：
+
+- 市场 PR 已合并，但 `main` 上的清单里列的是**更新**的版本 —— 合并那个 PR 并没有发布你这一版。
+- npm 上有这一版，但 `latest` 指向别处 —— 所以直接 `npm install` 拿不到。
+- Release 有了，但该 commit 的 CI 还在进行 —— 那就是没人验证过产物。
+
+## 它不做什么
+
+- **不向 GitHub 写入。** 不发评论、不提交评审、不 Approve、不合并。这些动作都带着你的名字，应该由你来
+  做，面板只负责把每项链接回 GitHub。
+- **不读浏览器 Cookie，不存 token。** 认证是 `gh` 的事。
+- **不把 PR 内容写进日志。** 错误在记录前先压成错误码；GitHub 的错误消息里可能带着私有文本。
+- **不在磁盘上缓存 PR 内容。** 列表和 diff 每次重新取。它唯一写的文件是你自己的批注。
+- **不渲染 GitHub 来的 Markdown 或 HTML。** 描述按纯文本显示，只把 `http(s)` 链接变成可点链接；
+  对一个能访问本机 HTTP 路由的面板来说，Markdown 渲染器是过大的攻击面。
+
+## 本地批注与隐私
+
+批注存在 `~/.dsh/storages/dsh-pr-release-workspace/drafts.json`（或 `$DSH_HOME` 下）。每条记录 PR、
+写入时的 commit、文件、行号。
+
+写在更早 commit 上的批注会被标成 **stale**（对应行可能已经移动），而不是被悄悄挪到那个位置现在的
+内容上。读取路径从不改写批注位置。
+
+任何内容都不离开这台机器，什么都不会发出去。删掉就是删掉。
+
+## 路由
+
+客户端通过 `POST /dsh-pr-release-workspace/<endpoint>` 与宿主通信。该路由只接受 `POST` 且
+`content-type: application/json`，拒绝跨站与外部 `Origin`，请求体上限 1 MiB，统一返回 JSON 信封：
+`{"ok":true,"value":…}` 或 `{"ok":false,"error":{"code":…,"message":…}}`。端点名与 GitHub 的
+owner/repo/number 参数在进入 `gh` 之前都会按固定模式校验；`gh` 以参数数组启动，从不经过 shell 字符串。
+
+## 已知限制
+
+- `gh pr view --json files` 在 100 个文件处静默截断。面板会报告真实的变更文件数，并说明当前只显示了其中多少。
+- 超过 300 个文件的 diff 无法一次取回。面板改用逐文件 patch 重组，并注明这一点。
+- 二进制文件没有文本两侧，显示为「二进制文件」。
+- GitHub 搜索接口限速 30 次/分钟。连续快速刷新三个列表会触限，面板会告诉你还要等多久。
+- DSH `0.1.6-alpha.2` 没有原生 diff 或评审面板可复用，所以 diff 视图建在
+  `@deepseek-ai/dsh-client-ui-primitives` 自带的 `DiffBlock` 之上。
+
+## 开发
+
+```sh
+npm install
+npm run build      # 把 src/client/*.js 拼成 lib/client.js
+npm test           # node --test，100+ 个用例
+```
+
+没有打包器。`lib/client.js` 由 `src/client/` 下按编号排列的片段拼装而成，每个片段往同一个命名空间
+对象上挂东西，最后包进 DSH 期望的 loader 调用。数字前缀就是加载顺序，不能重新编号。
+
+`lib/host/` 是纯 ESM，没有构建步骤。
+
+宿主版本调研见 `docs/baseline.md`，`gh` 行为实测表见 `docs/research/gh-api.md`，可复用的原生能力调研
+见 `docs/research/native-review.md`（几乎没有）。
+
+## 许可证
+
+MIT —— 见 [LICENSE](./LICENSE)。

package/cordis.patch.yml

@@ -0,0 +1,12 @@
+# Loader rows for the PR & release workspace.
+#
+# `name` must be this package's name: the loader resolves it from the profile's
+# node_modules by package name, so a renamed row silently disables the bundle.
+#
+# Local hot reload: replace `name` with an absolute `file://` URL of lib/index.js
+# plus `?v=N`. The loader only re-imports when the row name changes, and Node ESM
+# keys its cache on the full URL, so bump N after editing lib/*.js and re-enable
+# the bundle.
+- insert:
+    - id: pr-release-workspace
+      name: dsh-pr-release-workspace

package/icon.svg

@@ -0,0 +1,8 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" width="24" height="24" role="img" aria-label="Pull request with a review check" fill="none" stroke="currentColor" stroke-width="1.75" stroke-linecap="round" stroke-linejoin="round">
+  <circle cx="6.5" cy="5.6" r="2.3"/>
+  <circle cx="6.5" cy="18.4" r="2.3"/>
+  <path d="M6.5 7.9v8.2"/>
+  <circle cx="16.1" cy="8.6" r="2.3"/>
+  <path d="M6.5 13.6c0-3 2.3-5 5.1-5h2.2"/>
+  <path d="M13.9 17.8l2.2 2.2 4-4.3"/>
+</svg>