npm - dsh-tender-workbench - Versions diffs - 0.4.0 → 0.4.1 - Mend

dsh-tender-workbench 0.4.0 → 0.4.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (6) hide show

package/CHANGELOG.md CHANGED Viewed

@@ -4,6 +4,18 @@ All notable changes to `dsh-tender-workbench` are documented in this file.
 ## [Unreleased]
+## [0.4.1] - 2026-09-05
+### Changed
+- Reworked the GitHub and npm landing content into a Chinese-first product introduction for domestic customers, while preserving the complete English documentation in `README.en.md` with bidirectional language links.
+- Replaced the npm package description with a concise Chinese capability summary and added Chinese discovery keywords for tender notices, proposed projects, and Qichacha.
+- Updated packaging and release gates so both language pages and the 0.4.1 release record are verified in the public tarball.
+### Compatibility
+- The workflow, runtime implementation, public exports, and Artifact schema are unchanged from 0.4.0; this patch only changes product presentation and release metadata.
 ## [0.4.0] - 2026-09-05
 ### Added
@@ -25,5 +37,6 @@ All notable changes to `dsh-tender-workbench` are documented in this file.
 - Release automation uses GitHub OIDC Trusted Publishing and does not require a long-lived npm token in the repository.
 - Runtime credentials remain owned by the authorized MCP connector; Session-private source data and generated Artifacts are not published.
-[Unreleased]: https://github.com/duhu2000/dsh-tender-workbench/compare/v0.4.0...HEAD
+[Unreleased]: https://github.com/duhu2000/dsh-tender-workbench/compare/v0.4.1...HEAD
+[0.4.1]: https://github.com/duhu2000/dsh-tender-workbench/releases/tag/v0.4.1
 [0.4.0]: https://github.com/duhu2000/dsh-tender-workbench/releases/tag/v0.4.0

package/README.en.md ADDED Viewed

@@ -0,0 +1,144 @@
+# dsh-tender-workbench
+[中文](README.md) | **English**
+`dsh-tender-workbench` is an open-source DeepSeek Harness plugin for finding, screening, reviewing, and delivering tender opportunities. It combines authorized `qcc-tender` data, deterministic screening rules, bounded Agent analysis, explicit human decisions, and immutable Excel/PDF reports in one Session-scoped Better Sidebar workbench.
+Current stable version: **0.4.1** (stable release).
+## What it does
+The workbench follows four business phases:
+1. **Find opportunities**: search tender notices and proposed projects with source, keyword, date, region, stage, procurement, industry, type, amount, approval, and investment conditions supported by the connected data source.
+2. **Screen candidates**: edit Agent-proposed criteria, run deterministic impact previews, confirm a rule set, and inspect five mutually exclusive outcomes: included, observed, manual review, rule excluded, and unmatched.
+3. **Human confirmation**: review pending and completed records separately, prioritize Agent recommendations, make individual or batch decisions, retain notes, and undo the latest review operation.
+4. **Deliver**: confirm the reviewed scope and generate Excel and PDF files from one immutable report snapshot. Partial delivery remains explicit when records are still pending.
+Agent analysis covers every record classified as included, observed, or requiring manual review. Rule-excluded and unmatched records are not analyzed. Analysis runs in deterministic batches until the eligible set is complete, and interrupted work resumes from the remaining records.
+The human-review queue keeps Agent recommendations separate from user decisions. Its default ordering is priority review, watch, not recommended, then unanalyzed. Classification lists are ordered included, observed, manual review, rule excluded, then unmatched before pagination.
+## Architecture
+The package is a Host + Client DeepSeek Harness plugin:
+- The Client registers one Session-targeted Better Sidebar tab and public launcher actions. It builds typed, user-visible intents and consumes bounded Session projections and Artifact APIs.
+- The Host validates intents, calls the exact authorized MCP tools, owns workflow state transitions, stores Session-private Artifacts, and renders reports.
+- Persistent business state is reconstructed from typed conversation events and immutable Artifact references. The UI does not infer state from model text or maintain a second cross-Session state machine.
+- Query, criteria, analysis, review, and report writes share a Session-scoped single-flight guard. Read-only browsing remains available while a write is running.
+- Registrations, subscriptions, portals, routes, and other side effects are tied to the plugin Context lifecycle and are disposed on unload or hot reload.
+The plugin uses public DeepSeek Harness services and the public `dsh-better-sidebar` contract. It does not modify Harness source, access Provider internals, fetch MCP from the browser, read connector storage, hold API credentials, or write internal data to the Workspace.
+## Data and report boundaries
+Each Session has one active normalized dataset. A successful new query atomically replaces that active snapshot instead of merging results; historical Artifacts remain available for traceability while downstream state from the old snapshot becomes inactive.
+Schema-valid MCP fields are retained as source facts. Missing values, disclosed-but-unparseable values, source failures, rule exclusions, and user exclusions remain distinct states and are not inferred from one another.
+Excel is organized for analysis and verification, with separate overview, distribution, source-specific result, review, traceability, and data-quality sheets. PDF is organized for business readers, leading with deterministic conclusions, result distributions, deadline windows, and a bounded set of records requiring near-term verification. Both formats use the same immutable report snapshot; a failed format can be retried without re-querying or changing successful files.
+## Requirements and compatibility
+The published package declares minimum compatible versions without a stable-version upper bound:
+- DeepSeek Harness public packages: `0.1.1-rc.2`
+- `dsh-mcp-connector`: `0.2.31`
+- `dsh-better-sidebar`: `0.17.1`
+The active Profile must provide one coherent runtime with public Session Projection, JSONL Session Persistence, Tools, Skill, Sessions, and WebServer services. Better Sidebar must expose the public `targetedOpen` and `stateSubscription` features.
+An installed and authorized `qcc-tender` MCP connection must expose these exact tools:
+- `mcp__qcc-tender__search_tenders`
+- `mcp__qcc-tender__search_proposed_projects`
+Missing required services, incompatible Better Sidebar capabilities, unavailable MCP tools, and non-JSONL Session persistence fail explicitly. There is no Web-search, alternate-persistence, or Workspace-storage fallback.
+## Install
+Install the current stable release and its required Provider plugins:
+```sh
+dsh plugin --profile web add 'dsh-mcp-connector@>=0.2.31'
+dsh plugin --profile web add 'dsh-better-sidebar@>=0.17.1'
+dsh plugin --profile web add dsh-tender-workbench
+dsh web --no-open
+```
+To install the exact 0.4.1 release:
+```sh
+dsh plugin --profile web add 'dsh-mcp-connector@>=0.2.31'
+dsh plugin --profile web add 'dsh-better-sidebar@>=0.17.1'
+dsh plugin --profile web add dsh-tender-workbench@0.4.1
+```
+To install from an independent checkout, install the required Provider plugins first, then run from this repository:
+```sh
+corepack pnpm@11.7.0 install --frozen-lockfile
+corepack pnpm@11.7.0 run build
+dsh plugin --profile web add 'dsh-mcp-connector@>=0.2.31'
+dsh plugin --profile web add 'dsh-better-sidebar@>=0.17.1'
+dsh plugin --profile web add .
+dsh web --no-open
+```
+To install a packed build:
+```sh
+dsh plugin --profile web add 'dsh-mcp-connector@>=0.2.31'
+dsh plugin --profile web add 'dsh-better-sidebar@>=0.17.1'
+dsh plugin --profile web add ./dsh-tender-workbench-0.4.1.tgz
+dsh web --no-open
+```
+The package's `dsh.bundle.patch` declaration activates `cordis.patch.yml`, which contributes the `dsh-tender-workbench` Loader row. Restart the Web profile after adding or removing the plugin.
+To remove it:
+```sh
+dsh plugin --profile web remove dsh-tender-workbench
+```
+## Upgrade and rollback
+Upgrade an existing installation by installing the stable version and fully restarting the Web profile:
+```sh
+dsh plugin --profile web add dsh-tender-workbench@0.4.1
+dsh web --no-open
+```
+Version 0.4.1 keeps the workflow and Artifact schema used by 0.4.0; it changes the GitHub/npm presentation language and distribution metadata rather than migrating Session data. If a deployment-specific regression requires rollback, reinstall `dsh-tender-workbench@0.4.0` and restart the profile. Published npm versions and Git tags are immutable; fixes after publication use a new patch version rather than overwriting 0.4.1.
+## Using the workbench
+The plugin exposes a top-left “招投标” launcher and a Session Header recovery action. Every top-left activation creates a distinct native Session in the current Session's workspace, the recent workspace, or the first available workspace, gives that blank Session the “招投标” hero label and goal icon, and opens its Better Sidebar workbench. Other Sessions keep their existing host/provider hero label and the fish mark. The composer-bottom shortcuts are intentionally absent; the Header action only reopens the workbench for its existing Session.
+Navigation only changes the visible workbench phase. It does not mutate business state or run a later action. Criteria are proposed, edited, previewed, and confirmed as distinct steps. Agent recommendations never become user decisions automatically. Report generation always shows the reviewed and pending scope before creating a delivery snapshot.
+The layout is container-responsive: wide workspaces use master/detail grids, while medium and narrow workspaces preserve the same information order with local table scrolling and reachable fixed actions.
+## Development
+Use the Node.js and pnpm versions declared by the repository:
+```sh
+corepack pnpm@11.7.0 install --frozen-lockfile
+corepack pnpm@11.7.0 run check
+```
+The build emits the Host loader at `lib/index.js`, the Client bundle at `lib/client.js`, and declarations under `lib/types/`.
+`check` runs type checking, the full Vitest suite, the production build, README/release-state validation, and an npm tarball whitelist preview. Release tags are published by [the release workflow](.github/workflows/release.yml) through npm Trusted Publishing with provenance when Trusted Publishing is configured; manual npm publication must not claim provenance. The repository must never contain npm tokens, GitHub tokens, QCC credentials, source datasets, or Session-private Artifacts.
+The province, city, and district source snapshot is maintained in [resources/area.ts](resources/area.ts).
+See [CHANGELOG.md](CHANGELOG.md) and [the 0.4.1 release checklist](docs/RELEASE-0.4.1.md) for the stable-release scope and operational checks.
+## Current scope
+The plugin does not provide online PDF preview, delivery-version comparison, regeneration of already successful files, subscriptions, CRM follow-up, enterprise profiles, source-accuracy verification, or Bid/No-Bid decisions. Query, classification, analysis, and review are all valid stopping points; later actions only run after explicit user input.

package/README.md CHANGED Viewed

@@ -1,62 +1,44 @@
 # dsh-tender-workbench
-`dsh-tender-workbench` is an open-source DeepSeek Harness plugin for finding, screening, reviewing, and delivering tender opportunities. It combines authorized `qcc-tender` data, deterministic screening rules, bounded Agent analysis, explicit human decisions, and immutable Excel/PDF reports in one Session-scoped Better Sidebar workbench.
+**中文** | [English](README.en.md)
-Current stable version: **0.4.0** (stable release).
+> 面向国内招投标团队的 DeepSeek Harness 开源智能体插件：在一个会话级工作台内完成标讯与拟建项目查询、确定性规则初筛、限定范围智能分析、人工复核，以及 Excel/PDF 报告交付。
+>
+> 当前稳定版本：**0.4.1**（正式版本）
-## What it does
+[![CI](https://github.com/duhu2000/dsh-tender-workbench/actions/workflows/ci.yml/badge.svg)](https://github.com/duhu2000/dsh-tender-workbench/actions/workflows/ci.yml)
+[![npm](https://img.shields.io/npm/v/dsh-tender-workbench)](https://www.npmjs.com/package/dsh-tender-workbench)
+[![npm downloads](https://img.shields.io/npm/dm/dsh-tender-workbench)](https://www.npmjs.com/package/dsh-tender-workbench)
+[![GitHub release](https://img.shields.io/github/v/release/duhu2000/dsh-tender-workbench)](https://github.com/duhu2000/dsh-tender-workbench/releases)
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
-The workbench follows four business phases:
+## 产品简介
-1. **Find opportunities**: search tender notices and proposed projects with source, keyword, date, region, stage, procurement, industry, type, amount, approval, and investment conditions supported by the connected data source.
-2. **Screen candidates**: edit Agent-proposed criteria, run deterministic impact previews, confirm a rule set, and inspect five mutually exclusive outcomes: included, observed, manual review, rule excluded, and unmatched.
-3. **Human confirmation**: review pending and completed records separately, prioritize Agent recommendations, make individual or batch decisions, retain notes, and undo the latest review operation.
-4. **Deliver**: confirm the reviewed scope and generate Excel and PDF files from one immutable report snapshot. Partial delivery remains explicit when records are still pending.
+`dsh-tender-workbench` 是 DeepSeek Harness 的 Host + Client 插件，适合需要持续发现、筛选、复核和交付招投标机会的国内业务团队。插件连接客户已安装并授权的 `qcc-tender` MCP，以结构化标讯事实为基础，将规则判断、Agent 建议和人工决策明确分开，形成可追溯的工作流。
-Agent analysis covers every record classified as included, observed, or requiring manual review. Rule-excluded and unmatched records are not analyzed. Analysis runs in deterministic batches until the eligible set is complete, and interrupted work resumes from the remaining records.
+完整业务闭环为：
-The human-review queue keeps Agent recommendations separate from user decisions. Its default ordering is priority review, watch, not recommended, then unanalyzed. Classification lists are ordered included, observed, manual review, rule excluded, then unmatched before pagination.
+1. **查询机会**：按已连接数据源支持的来源、关键词、日期、地区、阶段、采购方式、行业、类型、金额、审批及投资条件，查询招投标公告和拟建项目。
+2. **规则初筛**：编辑 Agent 建议的筛选条件，先执行确定性影响预览，再确认规则集；结果被划分为纳入、观察、人工复核、规则排除和未匹配五个互斥类别。
+3. **智能分析**：仅分析纳入、观察和需人工复核的记录；规则排除及未匹配记录不进入分析。任务按确定性批次运行，中断后可从剩余记录继续。
+4. **人工复核**：分别查看待复核与已复核记录，参考但不自动采纳 Agent 建议，支持逐条或批量决策、保留备注，并可撤销最近一次复核操作。
+5. **报告交付**：确认复核范围后，基于同一份不可变报告快照生成 Excel 与 PDF；仍有待复核记录时，会明确标记为部分交付。
-## Architecture
+## 核心能力
-The package is a Host + Client DeepSeek Harness plugin:
+| 能力 | 实现方式 | 业务边界 |
+| --- | --- | --- |
+| 标讯查询 | 调用已授权的 `qcc-tender` 招投标与拟建项目搜索工具 | 不使用 Web 搜索兜底 |
+| 规则初筛 | 条件编辑、Dry Run 影响预览、人工确认后的确定性分类 | 预览与确认是两个独立步骤 |
+| Agent 分析 | 只覆盖纳入、观察、人工复核三类记录，按批次执行并可续跑 | 建议不会自动变成人工决策 |
+| 人工复核 | 待办/已办分区、逐条与批量决策、备注、最近操作撤销 | 最终业务判断由用户完成 |
+| Excel 报告 | 概览、分布、分来源结果、复核、追溯和数据质量工作表 | 面向分析与核验 |
+| PDF 报告 | 确定性结论、结果分布、截止时间窗及近期需核验记录 | 当前不提供在线 PDF 预览 |
+| 会话隔离 | 业务状态由类型化会话事件和不可变 Artifact 引用重建 | 不维护跨会话的第二套状态机 |
-- The Client registers one Session-targeted Better Sidebar tab and public launcher actions. It builds typed, user-visible intents and consumes bounded Session projections and Artifact APIs.
-- The Host validates intents, calls the exact authorized MCP tools, owns workflow state transitions, stores Session-private Artifacts, and renders reports.
-- Persistent business state is reconstructed from typed conversation events and immutable Artifact references. The UI does not infer state from model text or maintain a second cross-Session state machine.
-- Query, criteria, analysis, review, and report writes share a Session-scoped single-flight guard. Read-only browsing remains available while a write is running.
-- Registrations, subscriptions, portals, routes, and other side effects are tied to the plugin Context lifecycle and are disposed on unload or hot reload.
+## 30 秒开始
-The plugin uses public DeepSeek Harness services and the public `dsh-better-sidebar` contract. It does not modify Harness source, access Provider internals, fetch MCP from the browser, read connector storage, hold API credentials, or write internal data to the Workspace.
-## Data and report boundaries
-Each Session has one active normalized dataset. A successful new query atomically replaces that active snapshot instead of merging results; historical Artifacts remain available for traceability while downstream state from the old snapshot becomes inactive.
-Schema-valid MCP fields are retained as source facts. Missing values, disclosed-but-unparseable values, source failures, rule exclusions, and user exclusions remain distinct states and are not inferred from one another.
-Excel is organized for analysis and verification, with separate overview, distribution, source-specific result, review, traceability, and data-quality sheets. PDF is organized for business readers, leading with deterministic conclusions, result distributions, deadline windows, and a bounded set of records requiring near-term verification. Both formats use the same immutable report snapshot; a failed format can be retried without re-querying or changing successful files.
-## Requirements and compatibility
-The published package declares minimum compatible versions without a stable-version upper bound:
-- DeepSeek Harness public packages: `0.1.1-rc.2`
-- `dsh-mcp-connector`: `0.2.31`
-- `dsh-better-sidebar`: `0.17.1`
-The active Profile must provide one coherent runtime with public Session Projection, JSONL Session Persistence, Tools, Skill, Sessions, and WebServer services. Better Sidebar must expose the public `targetedOpen` and `stateSubscription` features.
-An installed and authorized `qcc-tender` MCP connection must expose these exact tools:
-- `mcp__qcc-tender__search_tenders`
-- `mcp__qcc-tender__search_proposed_projects`
-Missing required services, incompatible Better Sidebar capabilities, unavailable MCP tools, and non-JSONL Session persistence fail explicitly. There is no Web-search, alternate-persistence, or Workspace-storage fallback.
-## Install
-Install the current stable release and its required Provider plugins:
+先安装连接器、侧边栏能力和本插件：
 ```sh
 dsh plugin --profile web add 'dsh-mcp-connector@>=0.2.31'
@@ -65,78 +47,86 @@ dsh plugin --profile web add dsh-tender-workbench
 dsh web --no-open
 ```
-To install the exact 0.4.0 release:
+安装或移除插件后，请完整重启 Web Profile。插件通过 `dsh.bundle.patch` 启用 `cordis.patch.yml`，并注册 `dsh-tender-workbench` Loader。
+安装指定的 `0.4.1` 版本：
 ```sh
-dsh plugin --profile web add 'dsh-mcp-connector@>=0.2.31'
-dsh plugin --profile web add 'dsh-better-sidebar@>=0.17.1'
-dsh plugin --profile web add dsh-tender-workbench@0.4.0
+dsh plugin --profile web add dsh-tender-workbench@0.4.1
 ```
-To install from an independent checkout, install the required Provider plugins first, then run from this repository:
+移除插件：
 ```sh
-corepack pnpm@11.7.0 install --frozen-lockfile
-corepack pnpm@11.7.0 run build
-dsh plugin --profile web add 'dsh-mcp-connector@>=0.2.31'
-dsh plugin --profile web add 'dsh-better-sidebar@>=0.17.1'
-dsh plugin --profile web add .
-dsh web --no-open
+dsh plugin --profile web remove dsh-tender-workbench
 ```
-To install a packed build:
+## 使用工作台
-```sh
-dsh plugin --profile web add 'dsh-mcp-connector@>=0.2.31'
-dsh plugin --profile web add 'dsh-better-sidebar@>=0.17.1'
-dsh plugin --profile web add ./dsh-tender-workbench-0.4.0.tgz
-dsh web --no-open
-```
+插件提供左上角“招投标”入口和会话 Header 恢复入口。点击左上角入口会在当前工作区、最近工作区或第一个可用工作区中创建一个独立的原生会话，为空白会话显示“招投标”标题与目标图标，并打开对应的 Better Sidebar 工作台；其他会话继续保留各自原有标题与标识。
-The package's `dsh.bundle.patch` declaration activates `cordis.patch.yml`, which contributes the `dsh-tender-workbench` Loader row. Restart the Web profile after adding or removing the plugin.
+页面导航只切换可见阶段，不会修改业务状态或自动执行后续动作。规则建议、编辑、影响预览与确认彼此独立；报告生成前始终展示已复核和待复核范围。宽屏使用主从布局，中窄屏保持相同信息顺序，并保留局部表格滚动与可访问的固定操作区。
-To remove it:
+## 数据、安全与费用边界
-```sh
-dsh plugin --profile web remove dsh-tender-workbench
-```
+- 每个会话只有一份当前生效的标准化数据集。新查询成功后会原子替换当前快照，不与旧结果合并；历史 Artifact 仍可用于追溯，旧快照的后续业务状态不再生效。
+- 对符合 Schema 的 MCP 字段按来源事实保留。字段缺失、已披露但无法解析、来源失败、规则排除和用户排除是不同状态，插件不会互相推断或补造。
+- 浏览器端不直接调用 MCP，不读取连接器存储，也不持有 API 凭证；Host 负责校验意图、调用获授权工具、管理状态转换、保存会话私有 Artifact 并生成报告。
+- 插件不修改 DeepSeek Harness 源码，不访问 Provider 内部实现，不把内部数据写入 Workspace。仓库和发布包不得包含 npm/GitHub Token、QCC 凭证、源数据集或会话私有 Artifact。
+- `qcc-tender` 的授权范围、调用额度和费用由客户自己的 MCP 连接及相关服务合同决定；本插件不内置、不分发或共享开发者密钥，也不代理结算。
-## Upgrade and rollback
+## 环境要求与兼容性
-Upgrade an existing beta installation by installing the stable version and fully restarting the Web profile:
+发布包声明以下最低兼容版本，不设置稳定版上限：
-```sh
-dsh plugin --profile web add dsh-tender-workbench@0.4.0
-dsh web --no-open
-```
+- DeepSeek Harness 公共包：`0.1.1-rc.2`
+- `dsh-mcp-connector`：`0.2.31`
+- `dsh-better-sidebar`：`0.17.1`
+- Node.js：`^22.19.0 || >=24.0.0`
-Version 0.4.0 keeps the workflow and Artifact schema used by 0.3.0-beta.1; it changes the release state and distribution metadata rather than migrating Session data. If a deployment-specific regression requires rollback, reinstall `dsh-tender-workbench@0.3.0-beta.1` and restart the profile. Published npm versions and Git tags are immutable; fixes after publication use a new patch version rather than overwriting 0.4.0.
+当前 Profile 必须提供同一套公共 Session Projection、JSONL Session Persistence、Tools、Skill、Sessions 和 WebServer 服务；Better Sidebar 必须提供公共 `targetedOpen` 与 `stateSubscription` 能力。
-## Using the workbench
+已安装并授权的 `qcc-tender` MCP 连接必须暴露以下精确工具名：
-The plugin exposes a top-left “招投标” launcher and a Session Header recovery action. Every top-left activation creates a distinct native Session in the current Session's workspace, the recent workspace, or the first available workspace, gives that blank Session the “招投标” hero label and goal icon, and opens its Better Sidebar workbench. Other Sessions keep their existing host/provider hero label and the fish mark. The composer-bottom shortcuts are intentionally absent; the Header action only reopens the workbench for its existing Session.
+- `mcp__qcc-tender__search_tenders`
+- `mcp__qcc-tender__search_proposed_projects`
+缺少必要服务、Better Sidebar 能力不兼容、MCP 工具不可用或会话持久化不是 JSONL 时，插件会明确失败；不提供 Web 搜索、其他持久化或 Workspace 存储兜底。
-Navigation only changes the visible workbench phase. It does not mutate business state or run a later action. Criteria are proposed, edited, previewed, and confirmed as distinct steps. Agent recommendations never become user decisions automatically. Report generation always shows the reviewed and pending scope before creating a delivery snapshot.
+## 升级与回滚
-The layout is container-responsive: wide workspaces use master/detail grids, while medium and narrow workspaces preserve the same information order with local table scrolling and reachable fixed actions.
+从已有版本升级：
-## Development
+```sh
+dsh plugin --profile web add dsh-tender-workbench@0.4.1
+dsh web --no-open
+```
-Use the Node.js and pnpm versions declared by the repository:
+`0.4.1` 沿用 `0.4.0` 的工作流与 Artifact Schema，仅调整 GitHub/npm 的中文优先展示及分发元数据，不迁移会话数据。如部署环境出现特定回归，可重新安装 `dsh-tender-workbench@0.4.0` 并重启 Profile。已发布的 npm 版本和 Git 标签保持不可变，后续修复使用新的补丁版本。
+## 本地开发
+使用仓库声明的 Node.js 与 pnpm 版本：
 ```sh
 corepack pnpm@11.7.0 install --frozen-lockfile
 corepack pnpm@11.7.0 run check
 ```
-The build emits the Host loader at `lib/index.js`, the Client bundle at `lib/client.js`, and declarations under `lib/types/`.
+构建产物包括 Host Loader `lib/index.js`、Client Bundle `lib/client.js` 和 `lib/types/` 下的类型声明。
+`check` 会执行类型检查、完整 Vitest 测试、生产构建、README/发布状态校验以及 npm tarball 白名单预检。配置 npm Trusted Publishing 后，[发布工作流](.github/workflows/release.yml)可使用 OIDC 和 provenance；手工发布不得声称 provenance。
+省、市、区数据源快照维护在 [resources/area.ts](resources/area.ts)。版本变更见 [CHANGELOG.md](CHANGELOG.md)，发布检查见 [0.4.1 发布清单](docs/RELEASE-0.4.1.md)。
+## 当前范围
-`check` runs type checking, the full Vitest suite, the production build, README/release-state validation, and an npm tarball whitelist preview. Release tags are published by [the release workflow](.github/workflows/release.yml) through npm Trusted Publishing with provenance; the repository must never contain npm tokens, GitHub tokens, QCC credentials, source datasets, or Session-private Artifacts.
+当前版本不提供在线 PDF 预览、交付版本对比、已成功文件的重复生成、订阅、CRM 跟进、企业画像、来源准确性核验或 Bid/No-Bid 决策。查询、分类、分析和复核都可以作为合法结束点；只有用户明确操作后，后续阶段才会继续。
-The province, city, and district source snapshot is maintained in [resources/area.ts](resources/area.ts).
+## 参与贡献
-See [CHANGELOG.md](CHANGELOG.md) and [the 0.4.0 release checklist](docs/RELEASE-0.4.0.md) for the stable-release scope and operational checks.
+欢迎通过 [Issues](https://github.com/duhu2000/dsh-tender-workbench/issues) 提交缺陷与建议。提交代码前请运行完整 `check`，并避免在测试夹具、日志、截图或提交历史中加入真实客户数据和凭证。
-## Current scope
+## 许可证
-The plugin does not provide online PDF preview, delivery-version comparison, regeneration of already successful files, subscriptions, CRM follow-up, enterprise profiles, source-accuracy verification, or Bid/No-Bid decisions. Query, classification, analysis, and review are all valid stopping points; later actions only run after explicit user input.
+[MIT](LICENSE)

package/docs/RELEASE-0.4.1.md ADDED Viewed

@@ -0,0 +1,77 @@
+# dsh-tender-workbench 0.4.1 发布清单
+- Version: **0.4.1**
+- 发布日期：2026-09-05
+- Status: **release candidate**
+- 发布提交：待发布门禁与 CI 全部通过后填写
+- Git 标签：`v0.4.1`（待创建）
+- npm 发布：`dsh-tender-workbench@0.4.1`（待发布到 `latest`）
+- GitHub Release：<https://github.com/duhu2000/dsh-tender-workbench/releases/tag/v0.4.1>（待创建）
+## 发布范围
+0.4.1 是面向国内客户的中文展示补丁。GitHub 默认 `README.md` 与 npm 包首页改为中文优先，完整英文文档保留在 `README.en.md`，两个页面提供双向语言切换；npm `description` 与检索关键词同步更新。工作流、运行时代码、公共导出和 Artifact Schema 与 0.4.0 保持一致。
+## 兼容性与安装
+- Node.js：`^22.19.0 || >=24.0.0`
+- 包管理器：`pnpm@11.7.0`
+- DeepSeek Harness 公共包：`>=0.1.1-rc.2 || >=0.1.2-0`
+- `dsh-mcp-connector`：`>=0.2.31`
+- `dsh-better-sidebar`：`>=0.17.1 || >=0.18.0-0`
+- 必需 MCP 工具：`mcp__qcc-tender__search_tenders`、`mcp__qcc-tender__search_proposed_projects`
+安装 `dsh-tender-workbench@0.4.1` 及兼容 Provider 插件后，应完整重启 Web Profile。缺少必要服务、Better Sidebar 能力不兼容、MCP 工具不可用或会话持久化不是 JSONL 时，插件会明确失败。
+## 发布门禁
+- [x] 使用仓库锁文件完成 frozen pnpm install。
+- [x] TypeScript 类型检查通过。
+- [x] 完整 Vitest 测试通过。
+- [x] Host Loader、Client Bundle、source map 和类型声明构建成功。
+- [x] 中文/英文 README 与 0.4.1 发布状态检查通过。
+- [x] npm tarball 只包含白名单公开文件，且同时包含 `README.md` 与 `README.en.md`。
+- [x] 干净临时安装可导入 Host 入口、读取 0.4.1 元数据并注册 Client Bundle。
+- [ ] `main` CI 在 Linux Node 22/24 和 Windows Node 24 全部通过。
+- [ ] annotated tag `v0.4.1` 指向经审查的发布提交。
+- [ ] npm 发布成功，`latest` 指向 0.4.1，description 和 README 均为中文优先。
+- [ ] GitHub 默认 README 与 About 简介均为中文，GitHub Release 非 draft、非 prerelease。
+- [ ] npm Trusted Publishing provenance 已生效；若采用手工 fallback，本项保持未勾选且不得声称 provenance。
+未勾选项均为待办，不得报告为已完成。
+## 本地验证记录
+2026-09-05 使用 pnpm 11.7.0 完成验证：
+- `pnpm install --frozen-lockfile`：通过，仓库锁文件无需变更。
+- `pnpm run check`：通过；40 个测试文件中 207 项通过、1 项预期跳过，并完成类型检查、生产构建、双语文档检查、发布状态检查和打包白名单验证。
+- tag 模式检查：以 `GITHUB_REF_NAME=v0.4.1` 通过。
+- tarball：170 个白名单公开文件；最终 SHA-1 与完整性值在发布后从 npm registry 回读并记录，避免发布包自引用改变摘要。
+- 隔离安装：补齐同一 DSH Host peer 基线后，Host 入口导出 `apply` 和 6 项 `inject`，包元数据为 0.4.1 且 description 为中文，Client Bundle 以 `dsh-tender-workbench` 注册，中文 README 标记存在。
+上游 `@deepseek-ai/dsh-client-ui-primitives` 仍缺少其声明的 source map，Vitest 会给出提示；本包生成的 source map 完整，构建与门禁通过。普通 npm peer 自动安装仍可能遇到 DSH peer 组合约束，生产 DSH 插件管理器负责提供一致的 Host peer 集合。
+## 发布步骤
+1. 使用 pnpm 11.7.0 执行 frozen install。
+2. 执行 `pnpm run check`、tag 模式发布检查和干净 tarball 安装/导入冒烟。
+3. 只提交经审查的 0.4.1 文件并推送 `main`。
+4. 等待所有必需 CI job 通过。
+5. 在发布提交上创建 annotated tag `v0.4.1` 并推送。
+6. 若 npm Trusted Publisher 已正确关联 `duhu2000/dsh-tender-workbench` 与 `.github/workflows/release.yml`，由 tag workflow 通过 OIDC 发布并创建 GitHub Release；否则仅在确认 registry 中不存在 0.4.1 后，使用已授权 npm 账号手工发布同一经审查 tarball，并明确记录无 provenance。
+7. 核验 npm version、dist-tag、中文 description、中文 README、仓库地址、维护者、tarball 文件清单、干净安装、Git 提交/标签及 GitHub Release/About 状态。
+## 安全
+- 禁止存储或输出 npm/GitHub Token、QCC 凭证、源数据集、真实业务证据或会话私有 Artifact。
+- npm 包必须排除 `src`、测试、脚本、`.github`、`resources`、缓存、本地证据、环境文件与凭证。
+- QCC 访问继续由客户通过连接器授权；仓库不持有或代理凭证。
+- pnpm `allowBuilds` 策略继续禁用间接依赖 `node-pty` 的原生构建脚本，本包运行时和发布门禁均不使用其二进制文件。
+## 回滚
+- 推送标签前：仅删除必要的本地标签，修正发布提交并重新运行全部门禁。
+- 推送标签后、npm 发布前：停止失败工作流，以新补丁版本向前修复，不复用公开标签。
+- npm 发布后：不得覆盖或 unpublish 0.4.1；如需修复，发布新的补丁版本，源码回滚使用普通 revert 提交。
+- 部署回滚目标：重新安装 `dsh-tender-workbench@0.4.0` 并完整重启 Profile。

package/package.json CHANGED Viewed

@@ -1,14 +1,18 @@
 {
   "name": "dsh-tender-workbench",
-  "version": "0.4.0",
-  "description": "Open-source DeepSeek Harness tender Agent workbench with a Session-scoped end-to-end workflow",
+  "version": "0.4.1",
+  "description": "DeepSeek Harness 招投标工作台智能体：支持招投标查询、规则初筛、智能分析、人工复核及 Excel/PDF 报告交付。",
   "keywords": [
     "deepseek-harness",
     "dsh",
     "tender",
     "bidding",
     "procurement",
-    "proposed-projects"
+    "proposed-projects",
+    "招投标",
+    "标讯",
+    "拟建项目",
+    "企查查"
   ],
   "author": "Sunhh3221",
   "type": "module",
@@ -28,9 +32,10 @@
   "files": [
     "LICENSE",
     "README.md",
+    "README.en.md",
     "CHANGELOG.md",
     "cordis.patch.yml",
-    "docs/RELEASE-0.4.0.md",
+    "docs/RELEASE-0.4.1.md",
     "lib/index.js",
     "lib/client.js",
     "lib/client.js.map",

package/docs/RELEASE-0.4.0.md DELETED Viewed

@@ -1,75 +0,0 @@
-# dsh-tender-workbench 0.4.0 release checklist
-- Version: **0.4.0**
-- Release date: 2026-09-05
-- Status: **release candidate**
-- Release commit: pending
-- Git tag: pending
-- npm publication: pending
-- GitHub Release: pending
-## Scope
-Version 0.4.0 promotes the complete 0.3.0 beta workflow to the stable npm channel. It includes the Session-scoped query, deterministic rule screening, bounded Agent analysis, explicit human review, and immutable Excel/PDF delivery already represented by the V2 contracts. This release adds repeatable documentation, packaging, CI, and OIDC publication gates; it does not migrate the workflow or Artifact schema used by 0.3.0-beta.1.
-## Compatibility and installation
-- Node.js: `^22.19.0 || >=24.0.0`
-- Package manager: `pnpm@11.7.0`
-- DeepSeek Harness public packages: `>=0.1.1-rc.2 || >=0.1.2-0`
-- `dsh-mcp-connector`: `>=0.2.31`
-- `dsh-better-sidebar`: `>=0.17.1 || >=0.18.0-0`
-- Required MCP tools: `mcp__qcc-tender__search_tenders` and `mcp__qcc-tender__search_proposed_projects`
-Install `dsh-tender-workbench@0.4.0` together with compatible Provider plugins, then fully restart the Web profile. Missing required services, incompatible Better Sidebar capabilities, unavailable MCP tools, or non-JSONL Session persistence fail explicitly.
-## Release gates
-- [x] Frozen pnpm install completes with the repository lockfile.
-- [x] TypeScript type checking passes.
-- [x] Full Vitest suite passes.
-- [x] Host loader, Client bundle, source maps, and declarations build successfully.
-- [x] README and release-state checks pass for 0.4.0.
-- [x] `npm pack --dry-run --json` contains only whitelisted public files.
-- [x] A clean temporary installation imports the packed Host entry and package metadata and registers the Client bundle.
-- [ ] `main` CI passes on Linux Node 22/24 and Windows Node 24.
-- [ ] Tag `v0.4.0` resolves to the reviewed release commit.
-- [ ] npm Trusted Publishing creates `dsh-tender-workbench@0.4.0` with provenance and the `latest` dist-tag.
-- [ ] GitHub Release `v0.4.0` is neither draft nor prerelease.
-Unchecked items are pending and must not be reported as completed.
-## Local validation record
-Validated on 2026-09-05 with pnpm 11.7.0:
-- `pnpm install --frozen-lockfile`: passed with the checked-in lockfile and `allowBuilds` policy.
-- `pnpm run check`: passed, including 207 passing tests and 1 intentional skip across 40 test files.
-- Package whitelist: passed with 169 public files and no source, test, script, cache, credential, or private Artifact paths.
-- Clean-install smoke test: passed after supplying the same DSH Host peer baseline used by development; the Host entry exported `apply` and `inject`, package metadata reported 0.4.0, and the Client bundle registered with the module loader.
-The ordinary npm peer auto-installer currently reports an upstream DSH peer-version conflict between the connector and UI layout packages. The production DSH plugin manager supplies the Host peer set, so the isolated smoke test installs the tarball with peer auto-installation disabled and then injects the compatible 0.1.1-rc.2 Host baseline explicitly. The build also reports an upstream missing source-map warning from `@deepseek-ai/dsh-client-ui-primitives`; generated package source maps are present and the gate passes.
-## Publication procedure
-1. Run `pnpm install --frozen-lockfile` using pnpm 11.7.0.
-2. Run `pnpm run check` and the clean tarball installation/import smoke test.
-3. Commit only the reviewed 0.4.0 release files and push `main`.
-4. Wait for all required CI jobs to pass.
-5. Create annotated tag `v0.4.0` on the pushed release commit and push the tag.
-6. The tag workflow verifies `v${package.version}`, reruns the complete gates, publishes with npm OIDC Trusted Publishing and provenance, then creates the GitHub Release.
-7. Verify npm version, dist-tags, repository, maintainers, tarball metadata/file list, clean installation/import, Git commit/tag, and GitHub Release state.
-## Security
-- Never store or print npm tokens, GitHub tokens, QCC credentials, source datasets, real business evidence, or Session-private Artifacts.
-- The npm package must exclude `src`, `tests`, `scripts`, `.github`, `resources`, caches, local evidence, and environment files.
-- Runtime QCC access remains customer-authorized through the connector; this repository does not own or proxy credentials.
-- pnpm's `allowBuilds` policy explicitly keeps the indirect `node-pty` native build script disabled because this package does not use its binary at runtime or in the release gates.
-## Rollback
-- Before the tag is pushed: delete only the local tag if necessary, fix the release commit, and rerun all gates.
-- After the tag is pushed but before npm publication: stop the failing workflow, fix forward with a new patch version and tag, and do not reuse a public tag.
-- After npm publication: never overwrite or unpublish 0.4.0. Mark the affected version if necessary, publish a corrected patch version, and use an ordinary revert commit for source rollback.
-- Deployment rollback target: reinstall `dsh-tender-workbench@0.3.0-beta.1` and fully restart the profile.