dsh-scout 0.8.1 → 0.9.0

package/README.en.md

@@ -3,8 +3,8 @@
 [![ci](https://github.com/MaxHou-infinity/dsh-scout/actions/workflows/ci.yml/badge.svg)](https://github.com/MaxHou-infinity/dsh-scout/actions/workflows/ci.yml)
 [![license MIT](https://img.shields.io/badge/license-MIT-blue)](LICENSE)
 [![node >=22.19](https://img.shields.io/badge/node-%3E%3D22.19-brightgreen)](package.json)
-[![dsh-tools 0.1.0-rc.6](https://img.shields.io/badge/dsh-tools-0.1.0--rc.6-4b32c3)](package.json)
-[![tests 32 passing](https://img.shields.io/badge/tests-32%20passing-green)](tests/model.test.mjs)
+[![DSH nightly compatibility](https://github.com/MaxHou-infinity/dsh-scout/actions/workflows/compatibility-nightly.yml/badge.svg)](https://github.com/MaxHou-infinity/dsh-scout/actions/workflows/compatibility-nightly.yml)
+[![tests 34 passing](https://img.shields.io/badge/tests-34%20passing-green)](tests/model.test.mjs)
 [![中文 README](https://img.shields.io/badge/README-%E4%B8%AD%E6%96%87-2ea44f)](README.md)
 
 **司察（Scout）** — evidence-driven company & job due-diligence plugin for [DeepSeek Harness](https://github.com/deepseek-ai/DeepSeek-Harness).
@@ -49,7 +49,7 @@ pnpm test
 pnpm run check:release
 ```
 
-The tests cover the conservative decision default, evidence-level constraints, identity verification, session isolation, report rendering, export/import round-trips, auto-persist, question generation, and tool cleanup on unload. `check:release` additionally packs the plugin, installs it into an isolated temporary DSH profile, verifies `--dump-config`, checks the mounted tools, and observes the Cordis unload disposer. The gate uses `DSH_BIN` or a local `dsh` binary when available; otherwise it downloads the exact official CLI version `0.1.0-rc.6` through `npx`.
+The 34 tests cover the conservative decision default, evidence-level constraints, identity verification, session isolation, report rendering, export/import round-trips, auto-persist, question generation, and tool cleanup on unload. `check:release` additionally packs the plugin, installs it into isolated temporary DSH profiles for the four exact versions in the table below, verifies `--dump-config`, checks the mounted tools, observes the Cordis unload disposer, and checks package contents. `test:profile` uses `DSH_BIN` when explicitly set; otherwise it downloads the exact `DSH_VERSION` (default `0.2.0-rc.2`) through `npx`.
 
 ## Install into a DSH profile
 
@@ -60,7 +60,20 @@ dsh plugin --profile scout-demo add github:MaxHou-infinity/dsh-scout#<commit>
 dsh --profile scout-demo --dump-config
 ```
 
-Git installs fetch source and run `prepare`. pnpm may require an explicit `allowBuilds` entry for `dsh-scout`; only allow a pinned source you have reviewed. The current package targets `@deepseek-ai/dsh-tools` `0.1.0-rc.6` and `@deepseek-ai/cordis` `4.0.x`.
+Git installs fetch source and run `prepare`. pnpm may require an explicit `allowBuilds` entry for `dsh-scout`; only allow a pinned source you have reviewed. The `@deepseek-ai/dsh-tools` peer range is `>=0.1.0-rc.6 <0.3.0-0`; the `@deepseek-ai/cordis` peer range is `>=4.0.2 <5`.
+
+### DSH compatibility
+
+DSH checks a plugin's `@deepseek-ai/dsh-*` peers at install and startup, including prereleases. The `<0.3.0-0` upper bound excludes `0.3.0-alpha` and later releases. **Verified on 2026-10-12** with the 0.9.0 candidate tarball in isolated profiles, covering installation, cold startup, tool mounting, and unload:
+
+| DSH version | npm channel on that date | Result |
+| --- | --- | --- |
+| `0.1.0-rc.6` | Declared lower bound | Pass |
+| `0.1.2-rc.1` | Older release regression | Pass |
+| `0.2.0-rc.2` | `latest` / `next` | Pass |
+| `0.2.1-alpha.2` | `alpha` | Pass |
+
+Future `0.2.x` versions still require runtime verification. The [nightly compatibility workflow](https://github.com/MaxHou-infinity/dsh-scout/actions/workflows/compatibility-nightly.yml) resolves npm's `latest`, `next`, and `alpha` tags to exact versions before testing each one. The badge shows the latest workflow result; this table records versions already verified.
 
 ## Configuration (optional)
 
@@ -87,4 +100,4 @@ See [the product contract](docs/dsh-scout-product-contract.md) for the full MVP
 
 ## Community
 
-This is an independent community plugin for DeepSeek Harness. The repository uses the `dsh-plugin`, `deepseek-harness`, `due-diligence`, `company-research`, `job-research`, `hr-tech`, and `evidence-based` topics for discovery.
+This is an independent community plugin for DeepSeek Harness. The repository uses the `dsh-plugin`, `deepseek-harness`, `due-diligence`, `company-research`, `job-research`, `hr-tech`, and `evidence-based` topics for discovery. For install or startup failures, use the [compatibility issue template](https://github.com/MaxHou-infinity/dsh-scout/issues/new?template=compatibility.yml) with exact versions and redacted logs.

package/README.md

@@ -3,8 +3,8 @@
 [![ci](https://github.com/MaxHou-infinity/dsh-scout/actions/workflows/ci.yml/badge.svg)](https://github.com/MaxHou-infinity/dsh-scout/actions/workflows/ci.yml)
 [![license MIT](https://img.shields.io/badge/license-MIT-blue)](LICENSE)
 [![node >=22.19](https://img.shields.io/badge/node-%3E%3D22.19-brightgreen)](package.json)
-[![dsh-tools 0.1.0-rc.6](https://img.shields.io/badge/dsh-tools-0.1.0--rc.6-4b32c3)](package.json)
-[![tests 32 passing](https://img.shields.io/badge/tests-32%20passing-green)](tests/model.test.mjs)
+[![DSH 兼容性夜间检查](https://github.com/MaxHou-infinity/dsh-scout/actions/workflows/compatibility-nightly.yml/badge.svg)](https://github.com/MaxHou-infinity/dsh-scout/actions/workflows/compatibility-nightly.yml)
+[![tests 34 passing](https://img.shields.io/badge/tests-34%20passing-green)](tests/model.test.mjs)
 [![English README](https://img.shields.io/badge/README-English-blue)](README.en.md)
 
 **司察（Scout）** —— 面向 [DeepSeek Harness](https://github.com/deepseek-ai/DeepSeek-Harness) 的**证据驱动型公司与岗位尽调 / 背调插件**。
@@ -119,7 +119,20 @@ dsh plugin --profile scout-demo add github:MaxHou-infinity/dsh-scout#<commit>
 dsh --profile scout-demo --dump-config   # 验证工具挂载
 ```
 
-要求：Node ≥ 22.19；面向 `@deepseek-ai/dsh-tools` `0.1.0-rc.6` 与 `@deepseek-ai/cordis` `4.0.x`。Git 安装会运行 `prepare`，pnpm 可能需要为 `dsh-scout` 显式添加 `allowBuilds`（只放行你审查过的固定版本）。
+要求：Node ≥ 22.19；`@deepseek-ai/dsh-tools` peer 范围为 `>=0.1.0-rc.6 <0.3.0-0`，`@deepseek-ai/cordis` 为 `>=4.0.2 <5`。Git 安装会运行 `prepare`，pnpm 可能需要为 `dsh-scout` 显式添加 `allowBuilds`（只放行你审查过的固定版本）。
+
+### DSH 兼容性
+
+DSH 安装和启动时会检查插件的 `@deepseek-ai/dsh-*` peer；预发布版本也参与匹配。上界 `<0.3.0-0` 排除 `0.3.0-alpha` 及之后的版本。以下是 **2026-10-12 在隔离 profile 中用 0.9.0 候选 tarball 实测**的版本，覆盖安装、冷启动、工具挂载和卸载：
+
+| DSH 版本 | npm 渠道（核对当日） | 结果 |
+| --- | --- | --- |
+| `0.1.0-rc.6` | 兼容范围下界 | 通过 |
+| `0.1.2-rc.1` | 旧版回归 | 通过 |
+| `0.2.0-rc.2` | `latest` / `next` | 通过 |
+| `0.2.1-alpha.2` | `alpha` | 通过 |
+
+未来的 `0.2.x` 版本虽落在声明范围内，仍需实际验证。[夜间兼容检查](https://github.com/MaxHou-infinity/dsh-scout/actions/workflows/compatibility-nightly.yml)每天解析 npm 的 `latest`、`next`、`alpha` 到精确版本，再运行测试和隔离 profile 检查。徽章显示该工作流最近一次运行结果；以上表格记录已完成的精确版本验证。
 
 ## 配置（可选）
 
@@ -162,10 +175,12 @@ report.md      当前报告快照
 
 ```sh
 pnpm install
-pnpm test        # 32 个测试：决策默认值/证据约束/主体核验/会话隔离/报告渲染/导出导入往返/自动持久化/面试问题/采集→主张流转
+pnpm test        # 34 个测试：决策默认值/证据约束/主体核验/会话隔离/报告渲染/导出导入往返/自动持久化/面试问题/采集→主张流转
 pnpm run check:release
 ```
 
+`check:release` 在运行 34 项测试后，分别用表中的四个精确 DSH 版本安装候选 tarball 并检查 profile 生命周期，最后检查打包内容。
+
 ## 路线图
 
 - ✅ v0.1：证据纪律、三态决策、结构化报告、会话隔离
@@ -178,4 +193,4 @@ pnpm run check:release
 
 ## 社区
 
-面向 DeepSeek Harness 的独立社区插件（Topic：`dsh-plugin`、`deepseek-harness`、`due-diligence`、`company-research`、`job-research`、`hr-tech`、`evidence-based`）。欢迎 Issues / PR。
+面向 DeepSeek Harness 的独立社区插件（Topic：`dsh-plugin`、`deepseek-harness`、`due-diligence`、`company-research`、`job-research`、`hr-tech`、`evidence-based`）。安装或启动遇到问题时，请用[兼容性问题模板](https://github.com/MaxHou-infinity/dsh-scout/issues/new?template=compatibility.yml)提供精确版本和脱敏日志；也欢迎其他 Issues / PR。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-scout",
-  "version": "0.8.1",
+  "version": "0.9.0",
   "description": "Evidence-driven company and job intelligence plugin for DeepSeek Harness.",
   "license": "MIT",
   "type": "module",
@@ -17,11 +17,13 @@
   "files": [
     "dist",
     "cordis.patch.yml",
-    "scripts",
+    "scripts/check-release.mjs",
+    "scripts/profile-smoke.mjs",
     "README.md",
     "LICENSE",
-    "docs",
-    "tests",
+    "docs/dsh-scout-product-contract.md",
+    "docs/fixtures/dsh-scout/snapmaker-hr-head.json",
+    "tests/model.test.mjs",
     "README.en.md"
   ],
   "scripts": {
@@ -29,15 +31,15 @@
     "test": "npm run build && node --test tests/*.test.mjs",
     "check": "npm test",
     "test:profile": "node scripts/profile-smoke.mjs",
-    "check:release": "npm test && npm run test:profile && pnpm pack --dry-run",
+    "check:release": "node scripts/check-release.mjs",
     "prepare": "npm run build"
   },
   "engines": {
     "node": ">=22.19.0"
   },
   "peerDependencies": {
-    "@deepseek-ai/cordis": ">=4.0.1 <5",
-    "@deepseek-ai/dsh-tools": ">=0.1.0-rc.6 <0.2.0"
+    "@deepseek-ai/cordis": ">=4.0.2 <5",
+    "@deepseek-ai/dsh-tools": ">=0.1.0-rc.6 <0.3.0-0"
   },
   "peerDependenciesMeta": {
     "@deepseek-ai/cordis": {
@@ -48,12 +50,12 @@
     }
   },
   "devDependencies": {
-    "@deepseek-ai/cordis": "4.0.1",
-    "@deepseek-ai/dsh-tools": "0.1.0-rc.6",
+    "@deepseek-ai/cordis": "4.0.4",
+    "@deepseek-ai/dsh-tools": "0.2.0-rc.2",
     "typescript": "^5.8.3"
   },
   "dependencies": {
-    "@deepseek-ai/schemastery": "^3.18.1"
+    "@deepseek-ai/schemastery": "^3.18.2"
   },
   "dsh": {
     "bundle": {

package/scripts/check-release.mjs

@@ -0,0 +1,23 @@
+import { spawnSync } from 'node:child_process'
+
+const command = name => process.platform === 'win32' ? `${name}.cmd` : name
+const verifiedDshVersions = [
+  '0.1.0-rc.6',
+  '0.1.2-rc.1',
+  '0.2.0-rc.2',
+  '0.2.1-alpha.2',
+]
+
+function run(program, args, env = process.env) {
+  const result = spawnSync(command(program), args, { env, stdio: 'inherit' })
+  if (result.error) throw result.error
+  if (result.status !== 0) {
+    throw new Error(`${program} ${args.join(' ')} failed with exit code ${result.status}`)
+  }
+}
+
+run('npm', ['test'])
+for (const version of verifiedDshVersions) {
+  run('npm', ['run', 'test:profile'], { ...process.env, DSH_VERSION: version })
+}
+run('pnpm', ['pack', '--dry-run'])

package/scripts/profile-smoke.mjs

@@ -1,18 +1,14 @@
 import assert from 'node:assert/strict'
-import { existsSync } from 'node:fs'
 import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { spawnSync } from 'node:child_process'
 
-const DSH_VERSION = '0.1.0-rc.6'
+const DSH_VERSION = process.env.DSH_VERSION ?? '0.2.0-rc.2'
 const command = name => process.platform === 'win32' ? `${name}.cmd` : name
-const localDsh = join(process.cwd(), 'node_modules', '.bin', command('dsh'))
 const dshCommand = process.env.DSH_BIN
   ? { program: process.env.DSH_BIN, prefix: [] }
-  : existsSync(localDsh)
-    ? { program: localDsh, prefix: [] }
-    : { program: 'npx', prefix: ['--yes', `@deepseek-ai/dsh@${DSH_VERSION}`] }
+  : { program: 'npx', prefix: ['--yes', `@deepseek-ai/dsh@${DSH_VERSION}`] }
 
 function run(program, args, options = {}) {
   const result = spawnSync(command(program), args, {
@@ -95,7 +91,7 @@ export async function apply(ctx) {
   ], { capture: true, env: gateEnv })
   assert.match(lifecycle, /DSH_SCOUT_LOAD/)
   assert.match(lifecycle, /DSH_SCOUT_UNLOAD/)
-  console.log('dsh-scout profile smoke: PASS')
+  console.log(`dsh-scout profile smoke: PASS (dsh ${DSH_VERSION})`)
 } finally {
   await rm(gateRoot, { recursive: true, force: true })
 }