dsh-tender-workbench 0.3.0-beta.0 → 0.4.0

package/CHANGELOG.md

@@ -0,0 +1,29 @@
+# Changelog
+
+All notable changes to `dsh-tender-workbench` are documented in this file.
+
+## [Unreleased]
+
+## [0.4.0] - 2026-09-05
+
+### Added
+
+- Stable Host + Client workbench flow for query, deterministic screening, bounded Agent analysis, explicit human review, and immutable Excel/PDF delivery.
+- Session-scoped V2 Intent, Projection, Tool, Artifact, and runtime Skill contracts with strict validation and idempotent mutation receipts.
+- Release gates for documentation/version consistency, stable-release metadata, full type/test/build verification, and an npm tarball file whitelist.
+- Linux Node 22/24 and Windows Node 24 CI, plus tag-driven npm Trusted Publishing with provenance and GitHub Release creation.
+
+### Changed
+
+- Promoted the 0.3.0 beta line to the stable 0.4.0 distribution without changing its workflow or Artifact schema.
+- Updated package repository, homepage, and issue metadata to `duhu2000/dsh-tender-workbench`.
+- Stable installations now use the npm `latest` dist-tag; the previous `0.3.0-beta.1` remains available as an immutable rollback target.
+
+### Security
+
+- The npm package whitelist excludes source files, tests, scripts, fixtures, local evidence, caches, environment files, and credentials.
+- Release automation uses GitHub OIDC Trusted Publishing and does not require a long-lived npm token in the repository.
+- Runtime credentials remain owned by the authorized MCP connector; Session-private source data and generated Artifacts are not published.
+
+[Unreleased]: https://github.com/duhu2000/dsh-tender-workbench/compare/v0.4.0...HEAD
+[0.4.0]: https://github.com/duhu2000/dsh-tender-workbench/releases/tag/v0.4.0

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 Sunhh3221
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 Sunhh3221
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -2,6 +2,8 @@
 
 `dsh-tender-workbench` is an open-source DeepSeek Harness plugin for finding, screening, reviewing, and delivering tender opportunities. It combines authorized `qcc-tender` data, deterministic screening rules, bounded Agent analysis, explicit human decisions, and immutable Excel/PDF reports in one Session-scoped Better Sidebar workbench.
 
+Current stable version: **0.4.0** (stable release).
+
 ## What it does
 
 The workbench follows four business phases:
@@ -54,27 +56,27 @@ Missing required services, incompatible Better Sidebar capabilities, unavailable
 
 ## Install
 
-The current release is an internal preview published under the `beta` dist-tag:
+Install the current stable release and its required Provider plugins:
 
 ```sh
 dsh plugin --profile web add 'dsh-mcp-connector@>=0.2.31'
 dsh plugin --profile web add 'dsh-better-sidebar@>=0.17.1'
-dsh plugin --profile web add dsh-tender-workbench@beta
+dsh plugin --profile web add dsh-tender-workbench
 dsh web --no-open
 ```
 
-To install the current exact preview version:
+To install the exact 0.4.0 release:
 
 ```sh
 dsh plugin --profile web add 'dsh-mcp-connector@>=0.2.31'
 dsh plugin --profile web add 'dsh-better-sidebar@>=0.17.1'
-dsh plugin --profile web add dsh-tender-workbench@0.2.2-beta.1
+dsh plugin --profile web add dsh-tender-workbench@0.4.0
 ```
 
 To install from an independent checkout, install the required Provider plugins first, then run from this repository:
 
 ```sh
-corepack pnpm@11.7.0 install --ignore-workspace
+corepack pnpm@11.7.0 install --frozen-lockfile
 corepack pnpm@11.7.0 run build
 dsh plugin --profile web add 'dsh-mcp-connector@>=0.2.31'
 dsh plugin --profile web add 'dsh-better-sidebar@>=0.17.1'
@@ -87,7 +89,7 @@ To install a packed build:
 ```sh
 dsh plugin --profile web add 'dsh-mcp-connector@>=0.2.31'
 dsh plugin --profile web add 'dsh-better-sidebar@>=0.17.1'
-dsh plugin --profile web add ./dsh-tender-workbench-0.2.2-beta.1.tgz
+dsh plugin --profile web add ./dsh-tender-workbench-0.4.0.tgz
 dsh web --no-open
 ```
 
@@ -99,6 +101,17 @@ To remove it:
 dsh plugin --profile web remove dsh-tender-workbench
 ```
 
+## Upgrade and rollback
+
+Upgrade an existing beta installation by installing the stable version and fully restarting the Web profile:
+
+```sh
+dsh plugin --profile web add dsh-tender-workbench@0.4.0
+dsh web --no-open
+```
+
+Version 0.4.0 keeps the workflow and Artifact schema used by 0.3.0-beta.1; it changes the release state and distribution metadata rather than migrating Session data. If a deployment-specific regression requires rollback, reinstall `dsh-tender-workbench@0.3.0-beta.1` and restart the profile. Published npm versions and Git tags are immutable; fixes after publication use a new patch version rather than overwriting 0.4.0.
+
 ## Using the workbench
 
 The plugin exposes a top-left “招投标” launcher and a Session Header recovery action. Every top-left activation creates a distinct native Session in the current Session's workspace, the recent workspace, or the first available workspace, gives that blank Session the “招投标” hero label and goal icon, and opens its Better Sidebar workbench. Other Sessions keep their existing host/provider hero label and the fish mark. The composer-bottom shortcuts are intentionally absent; the Header action only reopens the workbench for its existing Session.
@@ -112,16 +125,18 @@ The layout is container-responsive: wide workspaces use master/detail grids, whi
 Use the Node.js and pnpm versions declared by the repository:
 
 ```sh
-corepack pnpm@11.7.0 install --ignore-workspace
-corepack pnpm@11.7.0 run typecheck
-corepack pnpm@11.7.0 run test
-corepack pnpm@11.7.0 run build
+corepack pnpm@11.7.0 install --frozen-lockfile
+corepack pnpm@11.7.0 run check
 ```
 
 The build emits the Host loader at `lib/index.js`, the Client bundle at `lib/client.js`, and declarations under `lib/types/`.
 
+`check` runs type checking, the full Vitest suite, the production build, README/release-state validation, and an npm tarball whitelist preview. Release tags are published by [the release workflow](.github/workflows/release.yml) through npm Trusted Publishing with provenance; the repository must never contain npm tokens, GitHub tokens, QCC credentials, source datasets, or Session-private Artifacts.
+
 The province, city, and district source snapshot is maintained in [resources/area.ts](resources/area.ts).
 
+See [CHANGELOG.md](CHANGELOG.md) and [the 0.4.0 release checklist](docs/RELEASE-0.4.0.md) for the stable-release scope and operational checks.
+
 ## Current scope
 
 The plugin does not provide online PDF preview, delivery-version comparison, regeneration of already successful files, subscriptions, CRM follow-up, enterprise profiles, source-accuracy verification, or Bid/No-Bid decisions. Query, classification, analysis, and review are all valid stopping points; later actions only run after explicit user input.

package/cordis.patch.yml

@@ -1,3 +1,3 @@
-- insert:
-    - id: tender-workbench
-      name: dsh-tender-workbench
+- insert:
+    - id: tender-workbench
+      name: dsh-tender-workbench

package/docs/RELEASE-0.4.0.md

@@ -0,0 +1,75 @@
+# dsh-tender-workbench 0.4.0 release checklist
+
+- Version: **0.4.0**
+- Release date: 2026-09-05
+- Status: **release candidate**
+- Release commit: pending
+- Git tag: pending
+- npm publication: pending
+- GitHub Release: pending
+
+## Scope
+
+Version 0.4.0 promotes the complete 0.3.0 beta workflow to the stable npm channel. It includes the Session-scoped query, deterministic rule screening, bounded Agent analysis, explicit human review, and immutable Excel/PDF delivery already represented by the V2 contracts. This release adds repeatable documentation, packaging, CI, and OIDC publication gates; it does not migrate the workflow or Artifact schema used by 0.3.0-beta.1.
+
+## Compatibility and installation
+
+- Node.js: `^22.19.0 || >=24.0.0`
+- Package manager: `pnpm@11.7.0`
+- DeepSeek Harness public packages: `>=0.1.1-rc.2 || >=0.1.2-0`
+- `dsh-mcp-connector`: `>=0.2.31`
+- `dsh-better-sidebar`: `>=0.17.1 || >=0.18.0-0`
+- Required MCP tools: `mcp__qcc-tender__search_tenders` and `mcp__qcc-tender__search_proposed_projects`
+
+Install `dsh-tender-workbench@0.4.0` together with compatible Provider plugins, then fully restart the Web profile. Missing required services, incompatible Better Sidebar capabilities, unavailable MCP tools, or non-JSONL Session persistence fail explicitly.
+
+## Release gates
+
+- [x] Frozen pnpm install completes with the repository lockfile.
+- [x] TypeScript type checking passes.
+- [x] Full Vitest suite passes.
+- [x] Host loader, Client bundle, source maps, and declarations build successfully.
+- [x] README and release-state checks pass for 0.4.0.
+- [x] `npm pack --dry-run --json` contains only whitelisted public files.
+- [x] A clean temporary installation imports the packed Host entry and package metadata and registers the Client bundle.
+- [ ] `main` CI passes on Linux Node 22/24 and Windows Node 24.
+- [ ] Tag `v0.4.0` resolves to the reviewed release commit.
+- [ ] npm Trusted Publishing creates `dsh-tender-workbench@0.4.0` with provenance and the `latest` dist-tag.
+- [ ] GitHub Release `v0.4.0` is neither draft nor prerelease.
+
+Unchecked items are pending and must not be reported as completed.
+
+## Local validation record
+
+Validated on 2026-09-05 with pnpm 11.7.0:
+
+- `pnpm install --frozen-lockfile`: passed with the checked-in lockfile and `allowBuilds` policy.
+- `pnpm run check`: passed, including 207 passing tests and 1 intentional skip across 40 test files.
+- Package whitelist: passed with 169 public files and no source, test, script, cache, credential, or private Artifact paths.
+- Clean-install smoke test: passed after supplying the same DSH Host peer baseline used by development; the Host entry exported `apply` and `inject`, package metadata reported 0.4.0, and the Client bundle registered with the module loader.
+
+The ordinary npm peer auto-installer currently reports an upstream DSH peer-version conflict between the connector and UI layout packages. The production DSH plugin manager supplies the Host peer set, so the isolated smoke test installs the tarball with peer auto-installation disabled and then injects the compatible 0.1.1-rc.2 Host baseline explicitly. The build also reports an upstream missing source-map warning from `@deepseek-ai/dsh-client-ui-primitives`; generated package source maps are present and the gate passes.
+
+## Publication procedure
+
+1. Run `pnpm install --frozen-lockfile` using pnpm 11.7.0.
+2. Run `pnpm run check` and the clean tarball installation/import smoke test.
+3. Commit only the reviewed 0.4.0 release files and push `main`.
+4. Wait for all required CI jobs to pass.
+5. Create annotated tag `v0.4.0` on the pushed release commit and push the tag.
+6. The tag workflow verifies `v${package.version}`, reruns the complete gates, publishes with npm OIDC Trusted Publishing and provenance, then creates the GitHub Release.
+7. Verify npm version, dist-tags, repository, maintainers, tarball metadata/file list, clean installation/import, Git commit/tag, and GitHub Release state.
+
+## Security
+
+- Never store or print npm tokens, GitHub tokens, QCC credentials, source datasets, real business evidence, or Session-private Artifacts.
+- The npm package must exclude `src`, `tests`, `scripts`, `.github`, `resources`, caches, local evidence, and environment files.
+- Runtime QCC access remains customer-authorized through the connector; this repository does not own or proxy credentials.
+- pnpm's `allowBuilds` policy explicitly keeps the indirect `node-pty` native build script disabled because this package does not use its binary at runtime or in the release gates.
+
+## Rollback
+
+- Before the tag is pushed: delete only the local tag if necessary, fix the release commit, and rerun all gates.
+- After the tag is pushed but before npm publication: stop the failing workflow, fix forward with a new patch version and tag, and do not reuse a public tag.
+- After npm publication: never overwrite or unpublish 0.4.0. Mark the affected version if necessary, publish a corrected patch version, and use an ordinary revert commit for source rollback.
+- Deployment rollback target: reinstall `dsh-tender-workbench@0.3.0-beta.1` and fully restart the profile.