dsh-scout 0.8.0 → 0.9.0

package/README.en.md

@@ -3,8 +3,8 @@
 [![ci](https://github.com/MaxHou-infinity/dsh-scout/actions/workflows/ci.yml/badge.svg)](https://github.com/MaxHou-infinity/dsh-scout/actions/workflows/ci.yml)
 [![license MIT](https://img.shields.io/badge/license-MIT-blue)](LICENSE)
 [![node >=22.19](https://img.shields.io/badge/node-%3E%3D22.19-brightgreen)](package.json)
-[![dsh-tools 0.1.0-rc.6](https://img.shields.io/badge/dsh-tools-0.1.0--rc.6-4b32c3)](package.json)
-[![tests 32 passing](https://img.shields.io/badge/tests-32%20passing-green)](tests/model.test.mjs)
+[![DSH nightly compatibility](https://github.com/MaxHou-infinity/dsh-scout/actions/workflows/compatibility-nightly.yml/badge.svg)](https://github.com/MaxHou-infinity/dsh-scout/actions/workflows/compatibility-nightly.yml)
+[![tests 34 passing](https://img.shields.io/badge/tests-34%20passing-green)](tests/model.test.mjs)
 [![中文 README](https://img.shields.io/badge/README-%E4%B8%AD%E6%96%87-2ea44f)](README.md)
 
 **司察（Scout）** — evidence-driven company & job due-diligence plugin for [DeepSeek Harness](https://github.com/deepseek-ai/DeepSeek-Harness).
@@ -49,7 +49,7 @@ pnpm test
 pnpm run check:release
 ```
 
-The tests cover the conservative decision default, evidence-level constraints, identity verification, session isolation, report rendering, export/import round-trips, auto-persist, question generation, and tool cleanup on unload. `check:release` additionally packs the plugin, installs it into an isolated temporary DSH profile, verifies `--dump-config`, checks the mounted tools, and observes the Cordis unload disposer. The gate uses `DSH_BIN` or a local `dsh` binary when available; otherwise it downloads the exact official CLI version `0.1.0-rc.6` through `npx`.
+The 34 tests cover the conservative decision default, evidence-level constraints, identity verification, session isolation, report rendering, export/import round-trips, auto-persist, question generation, and tool cleanup on unload. `check:release` additionally packs the plugin, installs it into isolated temporary DSH profiles for the four exact versions in the table below, verifies `--dump-config`, checks the mounted tools, observes the Cordis unload disposer, and checks package contents. `test:profile` uses `DSH_BIN` when explicitly set; otherwise it downloads the exact `DSH_VERSION` (default `0.2.0-rc.2`) through `npx`.
 
 ## Install into a DSH profile
 
@@ -60,7 +60,20 @@ dsh plugin --profile scout-demo add github:MaxHou-infinity/dsh-scout#<commit>
 dsh --profile scout-demo --dump-config
 ```
 
-Git installs fetch source and run `prepare`. pnpm may require an explicit `allowBuilds` entry for `dsh-scout`; only allow a pinned source you have reviewed. The current package targets `@deepseek-ai/dsh-tools` `0.1.0-rc.6` and `@deepseek-ai/cordis` `4.0.x`.
+Git installs fetch source and run `prepare`. pnpm may require an explicit `allowBuilds` entry for `dsh-scout`; only allow a pinned source you have reviewed. The `@deepseek-ai/dsh-tools` peer range is `>=0.1.0-rc.6 <0.3.0-0`; the `@deepseek-ai/cordis` peer range is `>=4.0.2 <5`.
+
+### DSH compatibility
+
+DSH checks a plugin's `@deepseek-ai/dsh-*` peers at install and startup, including prereleases. The `<0.3.0-0` upper bound excludes `0.3.0-alpha` and later releases. **Verified on 2026-10-12** with the 0.9.0 candidate tarball in isolated profiles, covering installation, cold startup, tool mounting, and unload:
+
+| DSH version | npm channel on that date | Result |
+| --- | --- | --- |
+| `0.1.0-rc.6` | Declared lower bound | Pass |
+| `0.1.2-rc.1` | Older release regression | Pass |
+| `0.2.0-rc.2` | `latest` / `next` | Pass |
+| `0.2.1-alpha.2` | `alpha` | Pass |
+
+Future `0.2.x` versions still require runtime verification. The [nightly compatibility workflow](https://github.com/MaxHou-infinity/dsh-scout/actions/workflows/compatibility-nightly.yml) resolves npm's `latest`, `next`, and `alpha` tags to exact versions before testing each one. The badge shows the latest workflow result; this table records versions already verified.
 
 ## Configuration (optional)
 
@@ -87,4 +100,4 @@ See [the product contract](docs/dsh-scout-product-contract.md) for the full MVP
 
 ## Community
 
-This is an independent community plugin for DeepSeek Harness. The repository uses the `dsh-plugin`, `deepseek-harness`, `due-diligence`, `company-research`, `job-research`, `hr-tech`, and `evidence-based` topics for discovery.
+This is an independent community plugin for DeepSeek Harness. The repository uses the `dsh-plugin`, `deepseek-harness`, `due-diligence`, `company-research`, `job-research`, `hr-tech`, and `evidence-based` topics for discovery. For install or startup failures, use the [compatibility issue template](https://github.com/MaxHou-infinity/dsh-scout/issues/new?template=compatibility.yml) with exact versions and redacted logs.

package/README.md

@@ -3,8 +3,8 @@
 [![ci](https://github.com/MaxHou-infinity/dsh-scout/actions/workflows/ci.yml/badge.svg)](https://github.com/MaxHou-infinity/dsh-scout/actions/workflows/ci.yml)
 [![license MIT](https://img.shields.io/badge/license-MIT-blue)](LICENSE)
 [![node >=22.19](https://img.shields.io/badge/node-%3E%3D22.19-brightgreen)](package.json)
-[![dsh-tools 0.1.0-rc.6](https://img.shields.io/badge/dsh-tools-0.1.0--rc.6-4b32c3)](package.json)
-[![tests 32 passing](https://img.shields.io/badge/tests-32%20passing-green)](tests/model.test.mjs)
+[![DSH 兼容性夜间检查](https://github.com/MaxHou-infinity/dsh-scout/actions/workflows/compatibility-nightly.yml/badge.svg)](https://github.com/MaxHou-infinity/dsh-scout/actions/workflows/compatibility-nightly.yml)
+[![tests 34 passing](https://img.shields.io/badge/tests-34%20passing-green)](tests/model.test.mjs)
 [![English README](https://img.shields.io/badge/README-English-blue)](README.en.md)
 
 **司察（Scout）** —— 面向 [DeepSeek Harness](https://github.com/deepseek-ai/DeepSeek-Harness) 的**证据驱动型公司与岗位尽调 / 背调插件**。
@@ -119,7 +119,20 @@ dsh plugin --profile scout-demo add github:MaxHou-infinity/dsh-scout#<commit>
 dsh --profile scout-demo --dump-config   # 验证工具挂载
 ```
 
-要求：Node ≥ 22.19；面向 `@deepseek-ai/dsh-tools` `0.1.0-rc.6` 与 `@deepseek-ai/cordis` `4.0.x`。Git 安装会运行 `prepare`，pnpm 可能需要为 `dsh-scout` 显式添加 `allowBuilds`（只放行你审查过的固定版本）。
+要求：Node ≥ 22.19；`@deepseek-ai/dsh-tools` peer 范围为 `>=0.1.0-rc.6 <0.3.0-0`，`@deepseek-ai/cordis` 为 `>=4.0.2 <5`。Git 安装会运行 `prepare`，pnpm 可能需要为 `dsh-scout` 显式添加 `allowBuilds`（只放行你审查过的固定版本）。
+
+### DSH 兼容性
+
+DSH 安装和启动时会检查插件的 `@deepseek-ai/dsh-*` peer；预发布版本也参与匹配。上界 `<0.3.0-0` 排除 `0.3.0-alpha` 及之后的版本。以下是 **2026-10-12 在隔离 profile 中用 0.9.0 候选 tarball 实测**的版本，覆盖安装、冷启动、工具挂载和卸载：
+
+| DSH 版本 | npm 渠道（核对当日） | 结果 |
+| --- | --- | --- |
+| `0.1.0-rc.6` | 兼容范围下界 | 通过 |
+| `0.1.2-rc.1` | 旧版回归 | 通过 |
+| `0.2.0-rc.2` | `latest` / `next` | 通过 |
+| `0.2.1-alpha.2` | `alpha` | 通过 |
+
+未来的 `0.2.x` 版本虽落在声明范围内，仍需实际验证。[夜间兼容检查](https://github.com/MaxHou-infinity/dsh-scout/actions/workflows/compatibility-nightly.yml)每天解析 npm 的 `latest`、`next`、`alpha` 到精确版本，再运行测试和隔离 profile 检查。徽章显示该工作流最近一次运行结果；以上表格记录已完成的精确版本验证。
 
 ## 配置（可选）
 
@@ -162,10 +175,12 @@ report.md      当前报告快照
 
 ```sh
 pnpm install
-pnpm test        # 32 个测试：决策默认值/证据约束/主体核验/会话隔离/报告渲染/导出导入往返/自动持久化/面试问题/采集→主张流转
+pnpm test        # 34 个测试：决策默认值/证据约束/主体核验/会话隔离/报告渲染/导出导入往返/自动持久化/面试问题/采集→主张流转
 pnpm run check:release
 ```
 
+`check:release` 在运行 34 项测试后，分别用表中的四个精确 DSH 版本安装候选 tarball 并检查 profile 生命周期，最后检查打包内容。
+
 ## 路线图
 
 - ✅ v0.1：证据纪律、三态决策、结构化报告、会话隔离
@@ -178,4 +193,4 @@ pnpm run check:release
 
 ## 社区
 
-面向 DeepSeek Harness 的独立社区插件（Topic：`dsh-plugin`、`deepseek-harness`、`due-diligence`、`company-research`、`job-research`、`hr-tech`、`evidence-based`）。欢迎 Issues / PR。
+面向 DeepSeek Harness 的独立社区插件（Topic：`dsh-plugin`、`deepseek-harness`、`due-diligence`、`company-research`、`job-research`、`hr-tech`、`evidence-based`）。安装或启动遇到问题时，请用[兼容性问题模板](https://github.com/MaxHou-infinity/dsh-scout/issues/new?template=compatibility.yml)提供精确版本和脱敏日志；也欢迎其他 Issues / PR。

package/dist/index.d.ts

@@ -1,11 +1,23 @@
 import type { Context } from '@deepseek-ai/cordis';
+import z from '@deepseek-ai/schemastery';
 export declare const name = "dsh-scout";
 export declare const inject: string[];
-export interface ScoutConfig {
+export interface Config {
     /** Default directory for case exports; case files land under `<scoutDir>/<caseId>/`. */
     scoutDir?: string;
     /** Persist the five-file export after every mutation when `scoutDir` is set. */
     autoPersist?: boolean;
+    /** Trusted authority host suffixes used by the E3 evidence policy. */
+    authorityHostSuffixes?: readonly string[];
 }
-export declare function apply(ctx: Context, config?: ScoutConfig): void;
+export declare const Config: z<Schemastery.ObjectS<{
+    scoutDir: z<string, string>;
+    autoPersist: z<boolean, boolean>;
+    authorityHostSuffixes: z<string[], string[]>;
+}>, Schemastery.ObjectT<{
+    scoutDir: z<string, string>;
+    autoPersist: z<boolean, boolean>;
+    authorityHostSuffixes: z<string[], string[]>;
+}>>;
+export declare function apply(ctx: Context, config?: Config): void;
 export * from './model.js';

package/dist/index.js

@@ -1,7 +1,13 @@
 import { defineTool } from '@deepseek-ai/dsh-tools';
-import { addClaim, addSource, appendEvent, CLAIM_DIMENSIONS, CLAIM_IMPACTS, CLAIM_STATUSES, createCase, decideCase, EVIDENCE_LEVELS, EXPORT_FILE_NAMES, exportCaseFiles, generateInterviewQuestions, importCaseFromFiles, inferEvidenceLevel, inferSourceType, renderComparison, renderReport, SOURCE_TYPES, verifyClaim, verifyIdentity, } from './model.js';
+import z from '@deepseek-ai/schemastery';
+import { addClaim, addSource, appendEvent, CLAIM_DIMENSIONS, CLAIM_IMPACTS, CLAIM_STATUSES, createCase, decideCase, DEFAULT_AUTHORITY_HOST_SUFFIXES, EVIDENCE_LEVELS, EXPORT_FILE_NAMES, exportCaseFiles, generateInterviewQuestions, importCaseFromFiles, inferEvidenceLevel, inferSourceType, renderComparison, renderReport, SOURCE_TYPES, verifyClaim, verifyIdentity, } from './model.js';
 export const name = 'dsh-scout';
-export const inject = ['tools', 'fs', 'web'];
+export const inject = ['tools'];
+export const Config = z.object({
+    scoutDir: z.string().default('dsh-scout'),
+    autoPersist: z.boolean().default(false),
+    authorityHostSuffixes: z.array(z.string()).default([...DEFAULT_AUTHORITY_HOST_SUFFIXES]),
+});
 export function apply(ctx, config = {}) {
     const cases = new Map();
     const caseKey = (caseId, agentId) => `${String(agentId ?? 'unscoped')}::${caseId}`;
@@ -11,8 +17,11 @@ export function apply(ctx, config = {}) {
             throw new Error(`Unknown case: ${key.split('::').at(-1)}`);
         return scoutCase;
     };
-    const fs = ctx.fs;
-    const web = ctx.web;
+    // Optional host services: unavailable hosts degrade gracefully (tools report
+    // the missing service instead of failing to register).
+    const fs = ctx.get('fs');
+    const web = ctx.get('web');
+    const authoritySuffixes = config.authorityHostSuffixes ?? DEFAULT_AUTHORITY_HOST_SUFFIXES;
     const defaultScoutDir = config.scoutDir?.replace(/\/+$/, '') || 'dsh-scout';
     const caseExportDir = (caseId) => `${defaultScoutDir}/${caseId}`;
     const persistFiles = async (scoutCase, targetDir) => {
@@ -45,7 +54,7 @@ export function apply(ctx, config = {}) {
             detail,
         });
     };
-    const registerSource = (scoutCase, source) => recordEvent(addSource(scoutCase, source), 'source_added', {
+    const registerSource = (scoutCase, source) => recordEvent(addSource(scoutCase, source, authoritySuffixes), 'source_added', {
         sourceId: source.sourceId,
         type: source.type,
         title: source.title,
@@ -199,8 +208,8 @@ export function apply(ctx, config = {}) {
                             errors.push({ url, error: `invalid evidenceLevel: ${String(item.evidenceLevel)}` });
                             continue;
                         }
-                        const typeGuess = inferSourceType(url, explicitType);
-                        const levelGuess = inferEvidenceLevel(url, typeGuess.type, explicitLevel);
+                        const typeGuess = inferSourceType(url, explicitType, authoritySuffixes);
+                        const levelGuess = inferEvidenceLevel(url, typeGuess.type, explicitLevel, authoritySuffixes);
                         let sourceId = `src-${nextId}`;
                         while (scoutCase.sources.some(source => source.sourceId === sourceId)) {
                             nextId += 1;
@@ -349,8 +358,8 @@ export function apply(ctx, config = {}) {
                         return;
                     }
                     try {
-                        const typeGuess = inferSourceType(url);
-                        const levelGuess = inferEvidenceLevel(url, typeGuess.type);
+                        const typeGuess = inferSourceType(url, undefined, authoritySuffixes);
+                        const levelGuess = inferEvidenceLevel(url, typeGuess.type, undefined, authoritySuffixes);
                         let sourceId = `src-${nextId}`;
                         while (scoutCase.sources.some(source => source.sourceId === sourceId)) {
                             nextId += 1;
@@ -542,7 +551,7 @@ export function apply(ctx, config = {}) {
                     evidenceLevel: args.evidenceLevel,
                     status: 'captured',
                 };
-                let nextCase = recordEvent(addSource(scoutCase, source), 'source_added', {
+                let nextCase = recordEvent(addSource(scoutCase, source, authoritySuffixes), 'source_added', {
                     sourceId: source.sourceId,
                     evidenceLevel: source.evidenceLevel,
                 });
@@ -577,7 +586,7 @@ export function apply(ctx, config = {}) {
                     legalRepresentative: args.legalRepresentative,
                     brandRelationship: args.brandRelationship,
                     sourceIds: args.sourceIds.split(',').map(value => value.trim()).filter(Boolean),
-                })), 'identity_verified', {
+                }, authoritySuffixes)), 'identity_verified', {
                     legalEntity: args.legalEntity,
                     registrationNumber: args.registrationNumber,
                 });

package/dist/model.d.ts

@@ -17,6 +17,8 @@ export interface ScoutEvent {
     at: string;
     detail: Record<string, unknown>;
 }
+/** Default trusted authority host suffixes used by the E3 evidence policy. */
+export declare const DEFAULT_AUTHORITY_HOST_SUFFIXES: readonly ["gov", "gov.cn", "gov.uk", "gov.hk", "gov.au", "gc.ca", "brreg.no", "handelsregister.de", "hkexnews.hk", "sse.com.cn", "szse.cn", "neeq.com.cn"];
 export interface ScoutSource {
     sourceId: string;
     type: SourceType;
@@ -80,15 +82,15 @@ export declare function createCase(input: {
     location?: string;
     decisionObjective?: string;
 }): ScoutCase;
-export declare function addSource(scoutCase: ScoutCase, source: ScoutSource): ScoutCase;
-export declare function isTrustedAuthorityUrl(value: string | null): boolean;
+export declare function addSource(scoutCase: ScoutCase, source: ScoutSource, authoritySuffixes?: readonly string[]): ScoutCase;
+export declare function isTrustedAuthorityUrl(value: string | null, authoritySuffixes?: readonly string[]): boolean;
 /** Guess a source category from its URL when the caller did not provide one. */
-export declare function inferSourceType(url: string | null, explicit?: SourceType): {
+export declare function inferSourceType(url: string | null, explicit?: SourceType, authoritySuffixes?: readonly string[]): {
     type: SourceType;
     inferred: boolean;
 };
 /** Guess an evidence level from the URL and category when not provided explicitly. */
-export declare function inferEvidenceLevel(url: string | null, type: SourceType, explicit?: EvidenceLevel): {
+export declare function inferEvidenceLevel(url: string | null, type: SourceType, explicit?: EvidenceLevel, authoritySuffixes?: readonly string[]): {
     evidenceLevel: EvidenceLevel;
     inferred: boolean;
 };
@@ -107,7 +109,7 @@ export declare function verifyIdentity(scoutCase: ScoutCase, input: {
     legalRepresentative: string;
     brandRelationship: string;
     sourceIds: string[];
-}): ScoutCase;
+}, authoritySuffixes?: readonly string[]): ScoutCase;
 export declare function decideCase(scoutCase: ScoutCase): ScoutCase;
 /** Derive a deduplicated, prioritized interview question list from the case. */
 export declare function generateInterviewQuestions(scoutCase: ScoutCase): string[];

package/dist/model.js

@@ -56,7 +56,8 @@ const JOB_PLATFORM_HOST_HINTS = [
     'nowcoder.com',
     'jobs.feishu.cn',
 ];
-const AUTHORITY_HOST_SUFFIXES = [
+/** Default trusted authority host suffixes used by the E3 evidence policy. */
+export const DEFAULT_AUTHORITY_HOST_SUFFIXES = [
     'gov',
     'gov.cn',
     'gov.uk',
@@ -111,17 +112,17 @@ export function createCase(input) {
         ],
     };
 }
-export function addSource(scoutCase, source) {
+export function addSource(scoutCase, source, authoritySuffixes = DEFAULT_AUTHORITY_HOST_SUFFIXES) {
     if (scoutCase.sources.some(item => item.sourceId === source.sourceId)) {
         throw new Error(`Duplicate source: ${source.sourceId}`);
     }
     if (source.evidenceLevel === 'E3'
-        && (!IDENTITY_SOURCE_TYPES.has(source.type) || !isTrustedAuthorityUrl(source.url))) {
+        && (!IDENTITY_SOURCE_TYPES.has(source.type) || !isTrustedAuthorityUrl(source.url, authoritySuffixes))) {
         throw new Error('E3 sources require a supported registry, regulator, or official filing HTTPS origin');
     }
     return { ...scoutCase, sources: [...scoutCase.sources, source] };
 }
-export function isTrustedAuthorityUrl(value) {
+export function isTrustedAuthorityUrl(value, authoritySuffixes = DEFAULT_AUTHORITY_HOST_SUFFIXES) {
     if (!value)
         return false;
     try {
@@ -131,21 +132,21 @@ export function isTrustedAuthorityUrl(value) {
         if (url.port && url.port !== '443')
             return false;
         const hostname = url.hostname.toLowerCase().replace(/\.$/, '');
-        return AUTHORITY_HOST_SUFFIXES.some(suffix => hostname === suffix || hostname.endsWith(`.${suffix}`));
+        return authoritySuffixes.some(suffix => hostname === suffix || hostname.endsWith(`.${suffix}`));
     }
     catch {
         return false;
     }
 }
 /** Guess a source category from its URL when the caller did not provide one. */
-export function inferSourceType(url, explicit) {
+export function inferSourceType(url, explicit, authoritySuffixes = DEFAULT_AUTHORITY_HOST_SUFFIXES) {
     if (explicit && SOURCE_TYPES.includes(explicit))
         return { type: explicit, inferred: false };
     if (url) {
         try {
             const hostname = new URL(url).hostname.toLowerCase().replace(/\.$/, '');
             // Trusted authority origins (official registry/regulator) take priority.
-            if (isTrustedAuthorityUrl(url)) {
+            if (isTrustedAuthorityUrl(url, authoritySuffixes)) {
                 const isRegistry = REGISTRY_HOST_SUFFIXES.some(suffix => hostname === suffix || hostname.endsWith(`.${suffix}`));
                 return { type: isRegistry ? 'company_registry' : 'regulator', inferred: true };
             }
@@ -161,10 +162,10 @@ export function inferSourceType(url, explicit) {
     return { type: 'other', inferred: true };
 }
 /** Guess an evidence level from the URL and category when not provided explicitly. */
-export function inferEvidenceLevel(url, type, explicit) {
+export function inferEvidenceLevel(url, type, explicit, authoritySuffixes = DEFAULT_AUTHORITY_HOST_SUFFIXES) {
     if (explicit && EVIDENCE_LEVELS.includes(explicit))
         return { evidenceLevel: explicit, inferred: false };
-    if (IDENTITY_SOURCE_TYPES.has(type) && isTrustedAuthorityUrl(url)) {
+    if (IDENTITY_SOURCE_TYPES.has(type) && isTrustedAuthorityUrl(url, authoritySuffixes)) {
         return { evidenceLevel: 'E3', inferred: true };
     }
     if (type === 'user_provided') {
@@ -228,7 +229,7 @@ export function verifyClaim(scoutCase, input) {
     claims[claimIndex] = verified;
     return { ...scoutCase, claims };
 }
-export function verifyIdentity(scoutCase, input) {
+export function verifyIdentity(scoutCase, input, authoritySuffixes = DEFAULT_AUTHORITY_HOST_SUFFIXES) {
     const requiredValues = [
         input.legalEntity,
         input.registrationNumber,
@@ -250,7 +251,7 @@ export function verifyIdentity(scoutCase, input) {
     });
     const hasAuthoritativeSource = sources.some(source => source.evidenceLevel === 'E3'
         && IDENTITY_SOURCE_TYPES.has(source.type)
-        && isTrustedAuthorityUrl(source.url));
+        && isTrustedAuthorityUrl(source.url, authoritySuffixes));
     if (!hasAuthoritativeSource) {
         throw new Error('Company identity verification requires a linked E3 registry, regulator, or official filing source');
     }

package/package.json

@@ -1,19 +1,29 @@
 {
   "name": "dsh-scout",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "Evidence-driven company and job intelligence plugin for DeepSeek Harness.",
   "license": "MIT",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./cordis.patch.yml": "./cordis.patch.yml",
+    "./package.json": "./package.json"
+  },
   "files": [
     "dist",
     "cordis.patch.yml",
-    "scripts",
+    "scripts/check-release.mjs",
+    "scripts/profile-smoke.mjs",
     "README.md",
     "LICENSE",
-    "docs",
-    "tests",
+    "docs/dsh-scout-product-contract.md",
+    "docs/fixtures/dsh-scout/snapmaker-hr-head.json",
+    "tests/model.test.mjs",
     "README.en.md"
   ],
   "scripts": {
@@ -21,15 +31,15 @@
     "test": "npm run build && node --test tests/*.test.mjs",
     "check": "npm test",
     "test:profile": "node scripts/profile-smoke.mjs",
-    "check:release": "npm test && npm run test:profile && pnpm pack --dry-run",
+    "check:release": "node scripts/check-release.mjs",
     "prepare": "npm run build"
   },
   "engines": {
     "node": ">=22.19.0"
   },
   "peerDependencies": {
-    "@deepseek-ai/cordis": ">=4.0.1 <5",
-    "@deepseek-ai/dsh-tools": ">=0.1.0-rc.6 <0.2.0"
+    "@deepseek-ai/cordis": ">=4.0.2 <5",
+    "@deepseek-ai/dsh-tools": ">=0.1.0-rc.6 <0.3.0-0"
   },
   "peerDependenciesMeta": {
     "@deepseek-ai/cordis": {
@@ -40,10 +50,13 @@
     }
   },
   "devDependencies": {
-    "@deepseek-ai/cordis": "4.0.1",
-    "@deepseek-ai/dsh-tools": "0.1.0-rc.6",
+    "@deepseek-ai/cordis": "4.0.4",
+    "@deepseek-ai/dsh-tools": "0.2.0-rc.2",
     "typescript": "^5.8.3"
   },
+  "dependencies": {
+    "@deepseek-ai/schemastery": "^3.18.2"
+  },
   "dsh": {
     "bundle": {
       "patch": "./cordis.patch.yml"

package/scripts/check-release.mjs

@@ -0,0 +1,23 @@
+import { spawnSync } from 'node:child_process'
+
+const command = name => process.platform === 'win32' ? `${name}.cmd` : name
+const verifiedDshVersions = [
+  '0.1.0-rc.6',
+  '0.1.2-rc.1',
+  '0.2.0-rc.2',
+  '0.2.1-alpha.2',
+]
+
+function run(program, args, env = process.env) {
+  const result = spawnSync(command(program), args, { env, stdio: 'inherit' })
+  if (result.error) throw result.error
+  if (result.status !== 0) {
+    throw new Error(`${program} ${args.join(' ')} failed with exit code ${result.status}`)
+  }
+}
+
+run('npm', ['test'])
+for (const version of verifiedDshVersions) {
+  run('npm', ['run', 'test:profile'], { ...process.env, DSH_VERSION: version })
+}
+run('pnpm', ['pack', '--dry-run'])

package/scripts/profile-smoke.mjs

@@ -1,18 +1,14 @@
 import assert from 'node:assert/strict'
-import { existsSync } from 'node:fs'
 import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { spawnSync } from 'node:child_process'
 
-const DSH_VERSION = '0.1.0-rc.6'
+const DSH_VERSION = process.env.DSH_VERSION ?? '0.2.0-rc.2'
 const command = name => process.platform === 'win32' ? `${name}.cmd` : name
-const localDsh = join(process.cwd(), 'node_modules', '.bin', command('dsh'))
 const dshCommand = process.env.DSH_BIN
   ? { program: process.env.DSH_BIN, prefix: [] }
-  : existsSync(localDsh)
-    ? { program: localDsh, prefix: [] }
-    : { program: 'npx', prefix: ['--yes', `@deepseek-ai/dsh@${DSH_VERSION}`] }
+  : { program: 'npx', prefix: ['--yes', `@deepseek-ai/dsh@${DSH_VERSION}`] }
 
 function run(program, args, options = {}) {
   const result = spawnSync(command(program), args, {
@@ -95,7 +91,7 @@ export async function apply(ctx) {
   ], { capture: true, env: gateEnv })
   assert.match(lifecycle, /DSH_SCOUT_LOAD/)
   assert.match(lifecycle, /DSH_SCOUT_UNLOAD/)
-  console.log('dsh-scout profile smoke: PASS')
+  console.log(`dsh-scout profile smoke: PASS (dsh ${DSH_VERSION})`)
 } finally {
   await rm(gateRoot, { recursive: true, force: true })
 }

package/tests/model.test.mjs

@@ -18,7 +18,7 @@ import {
   verifyClaim,
   verifyIdentity,
 } from '../dist/model.js'
-import { apply, inject, name } from '../dist/index.js'
+import { apply, Config, inject, name } from '../dist/index.js'
 
 test('starts conservatively until company identity is verified', () => {
   const scoutCase = createCase({
@@ -327,6 +327,7 @@ test('only proceeds after identity and all required role dimensions are verified
 test('isolates identical case ids by DSH agent session identity', async () => {
   const registered = []
   apply({
+    get(name) { return this[name] },
     tools: {
       register(tool) {
         registered.push(tool)
@@ -413,6 +414,7 @@ test('exports a disposable DSH plugin tool surface', async () => {  const regist
   const disposed = []
   const effects = []
   apply({
+    get(name) { return this[name] },
     tools: {
       register(tool) {
         registered.push(tool)
@@ -425,7 +427,7 @@ test('exports a disposable DSH plugin tool surface', async () => {  const regist
   })
 
   assert.equal(name, 'dsh-scout')
-  assert.deepEqual(inject, ['tools', 'fs', 'web'])
+  assert.deepEqual(inject, ['tools'])
   assert.deepEqual(
     registered.map(tool => tool.name).sort(),
     [
@@ -521,6 +523,7 @@ test('exports and imports a case through the fs-backed tools', async () => {
     },
   }
   apply({
+    get(name) { return this[name] },
     tools: {
       register(tool) {
         registered.push(tool)
@@ -651,6 +654,7 @@ test('auto-persists each mutation when configured, and exports to the default di
     },
   }
   apply({
+    get(name) { return this[name] },
     tools: {
       register(tool) {
         registered.push(tool)
@@ -690,6 +694,7 @@ test('auto-persists each mutation when configured, and exports to the default di
 test('scout_questions tool returns the derived question list', async () => {
   const registered = []
   apply({
+    get(name) { return this[name] },
     tools: {
       register(tool) {
         registered.push(tool)
@@ -718,6 +723,7 @@ test('auto-persist and default export dir degrade gracefully without fs or scout
   // autoPersist enabled but no fs service: mutations still succeed
   const noFs = []
   apply({
+    get(name) { return this[name] },
     tools: { register(tool) { noFs.push(tool); return () => undefined } },
     effect(execute) { Array.from(execute()) },
   }, { scoutDir: '/nowhere', autoPersist: true })
@@ -743,6 +749,7 @@ test('auto-persist and default export dir degrade gracefully without fs or scout
     async writeText(target, content) { store.set(target.displayPath, content); return { operation: 'create' } },
   }
   apply({
+    get(name) { return this[name] },
     tools: { register(tool) { registered.push(tool); return () => undefined } },
     fs: mockFs,
     effect(execute) { Array.from(execute()) },
@@ -854,6 +861,7 @@ test('infers source type and evidence level from URLs', () => {
 test('scout_ingest batch-registers sources with inference and isolates errors', async () => {
   const registered = []
   apply({
+    get(name) { return this[name] },
     tools: { register(tool) { registered.push(tool); return () => undefined } },
     effect(execute) { Array.from(execute()) },
   })
@@ -906,6 +914,7 @@ test('scout_ingest isolates null items and invalid explicit enums, and avoids su
 
   const registered = []
   apply({
+    get(name) { return this[name] },
     tools: { register(tool) { registered.push(tool); return () => undefined } },
     effect(execute) { Array.from(execute()) },
   })
@@ -999,6 +1008,7 @@ test('scout_compare tool compares cases and inference rejects invalid explicit e
 
   const registered = []
   apply({
+    get(name) { return this[name] },
     tools: { register(tool) { registered.push(tool); return () => undefined } },
     effect(execute) { Array.from(execute()) },
   })
@@ -1020,6 +1030,7 @@ test('scout_compare tool compares cases and inference rejects invalid explicit e
 test('scout_compare deduplicates case ids and empty claims render cleanly', async () => {
   const registered = []
   apply({
+    get(name) { return this[name] },
     tools: { register(tool) { registered.push(tool); return () => undefined } },
     effect(execute) { Array.from(execute()) },
   })
@@ -1068,6 +1079,7 @@ test('scout_ingest drafts claims from items alongside sources', async () => {
 
   const registered = []
   apply({
+    get(name) { return this[name] },
     tools: { register(tool) { registered.push(tool); return () => undefined } },
     effect(execute) { Array.from(execute()) },
   })
@@ -1115,6 +1127,7 @@ test('scout_ingest drafts claims from items alongside sources', async () => {
 test('scout_ingest rejects invalid claim enums explicitly and keeps claim ids collision-safe', async () => {
   const registered = []
   apply({
+    get(name) { return this[name] },
     tools: { register(tool) { registered.push(tool); return () => undefined } },
     effect(execute) { Array.from(execute()) },
   })
@@ -1167,6 +1180,7 @@ test('covers registry boundaries, non-object claims, and verified-E0 rejection v
   const registered = []
   const store = new Map()
   apply({
+    get(name) { return this[name] },
     tools: { register(tool) { registered.push(tool); return () => undefined } },
     fs: {
       async resolve(path) { return { targetKey: path, displayPath: path } },
@@ -1211,6 +1225,7 @@ test('scout_search registers provider results as sources and requires the web se
   const registered = []
   const searched = []
   apply({
+    get(name) { return this[name] },
     tools: { register(tool) { registered.push(tool); return () => undefined } },
     web: {
       async search(request) {
@@ -1259,6 +1274,7 @@ test('scout_search registers provider results as sources and requires the web se
   // web service missing -> explicit error
   const noWeb = []
   apply({
+    get(name) { return this[name] },
     tools: { register(tool) { noWeb.push(tool); return () => undefined } },
     effect(execute) { Array.from(execute()) },
   })
@@ -1277,6 +1293,7 @@ test('scout_search handles provider edge cases and limit bounds', async () => {
   const providerCalls = []
   let failSearch = false
   apply({
+    get(name) { return this[name] },
     tools: { register(tool) { registered.push(tool); return () => undefined } },
     web: {
       async search(request) {
@@ -1339,6 +1356,7 @@ test('scout_search handles provider edge cases and limit bounds', async () => {
   // non-array sources -> reported as an error, tool still succeeds
   const noArray = []
   apply({
+    get(name) { return this[name] },
     tools: { register(tool) { noArray.push(tool); return () => undefined } },
     web: { async search() { return { sources: 'nope' } } },
     effect(execute) { Array.from(execute()) },
@@ -1354,3 +1372,50 @@ test('scout_search handles provider edge cases and limit bounds', async () => {
   assert.equal(nonArray.added.length, 0)
   assert.match(nonArray.errors[0].error, /non-array sources/)
 })
+
+test('exports a schemastery Config with sensible defaults', () => {
+  const parsed = Config({})
+  assert.equal(parsed.scoutDir, 'dsh-scout')
+  assert.equal(parsed.autoPersist, false)
+  assert.ok(parsed.authorityHostSuffixes.includes('gov.cn'))
+  assert.ok(parsed.authorityHostSuffixes.includes('gsxt.gov.cn') === false)
+})
+
+test('custom authority host suffixes extend the E3 trust boundary', async () => {
+  const registered = []
+  apply({
+    get(name) { return this[name] },
+    tools: {
+      register(tool) {
+        registered.push(tool)
+        return () => undefined
+      },
+    },
+    effect(execute) {
+      Array.from(execute())
+    },
+  }, {
+    authorityHostSuffixes: ['example-registry.example'],
+  })
+  const tools = new Map(registered.map(tool => [tool.name, tool]))
+  const start = tools.get('scout_start')
+  const addSource = tools.get('scout_add_source')
+  await start.execute({
+    caseId: 'custom-trust',
+    companyName: 'Custom Co',
+    roleTitle: 'Role',
+    location: '',
+  }, { agent: { id: 'session-a' } })
+  // The configured suffix makes this registry origin a valid E3 source.
+  const result = await addSource.execute({
+    caseId: 'custom-trust',
+    sourceId: 'registry',
+    sourceType: 'company_registry',
+    title: 'Custom registry',
+    url: 'https://registry.example-registry.example/rec/1',
+    evidenceLevel: 'E3',
+  }, { agent: { id: 'session-a' } })
+  assert.match(result, /"evidenceLevel": "E3"/)
+  // The default trust boundary still rejects the same origin without the override.
+  assert.equal(isTrustedAuthorityUrl('https://registry.example-registry.example/rec/1'), false)
+})