dsh-tender-workbench 0.4.0 → 0.4.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +26 -1
- package/README.en.md +144 -0
- package/README.md +79 -89
- package/docs/RELEASE-0.4.2.md +63 -0
- package/lib/client.js +283 -283
- package/package.json +9 -4
- package/docs/RELEASE-0.4.0.md +0 -75
package/CHANGELOG.md
CHANGED
|
@@ -4,6 +4,29 @@ All notable changes to `dsh-tender-workbench` are documented in this file.
|
|
|
4
4
|
|
|
5
5
|
## [Unreleased]
|
|
6
6
|
|
|
7
|
+
## [0.4.2] - 2026-09-05
|
|
8
|
+
|
|
9
|
+
### Changed
|
|
10
|
+
|
|
11
|
+
- Advanced the stable release metadata and bilingual installation guidance to 0.4.2 for an end-to-end Trusted Publishing verification release.
|
|
12
|
+
- Kept the runtime implementation, public exports, workflow behavior, and Artifact schema unchanged from 0.4.1.
|
|
13
|
+
|
|
14
|
+
### Security
|
|
15
|
+
|
|
16
|
+
- Publishes from the tag workflow through the npm Trusted Publisher binding for `duhu2000/dsh-tender-workbench` and `release.yml`, using GitHub Actions OIDC and npm provenance without a long-lived npm token.
|
|
17
|
+
|
|
18
|
+
## [0.4.1] - 2026-09-05
|
|
19
|
+
|
|
20
|
+
### Changed
|
|
21
|
+
|
|
22
|
+
- Reworked the GitHub and npm landing content into a Chinese-first product introduction for domestic customers, while preserving the complete English documentation in `README.en.md` with bidirectional language links.
|
|
23
|
+
- Replaced the npm package description with a concise Chinese capability summary and added Chinese discovery keywords for tender notices, proposed projects, and Qichacha.
|
|
24
|
+
- Updated packaging and release gates so both language pages and the 0.4.1 release record are verified in the public tarball.
|
|
25
|
+
|
|
26
|
+
### Compatibility
|
|
27
|
+
|
|
28
|
+
- The workflow, runtime implementation, public exports, and Artifact schema are unchanged from 0.4.0; this patch only changes product presentation and release metadata.
|
|
29
|
+
|
|
7
30
|
## [0.4.0] - 2026-09-05
|
|
8
31
|
|
|
9
32
|
### Added
|
|
@@ -25,5 +48,7 @@ All notable changes to `dsh-tender-workbench` are documented in this file.
|
|
|
25
48
|
- Release automation uses GitHub OIDC Trusted Publishing and does not require a long-lived npm token in the repository.
|
|
26
49
|
- Runtime credentials remain owned by the authorized MCP connector; Session-private source data and generated Artifacts are not published.
|
|
27
50
|
|
|
28
|
-
[Unreleased]: https://github.com/duhu2000/dsh-tender-workbench/compare/v0.4.
|
|
51
|
+
[Unreleased]: https://github.com/duhu2000/dsh-tender-workbench/compare/v0.4.2...HEAD
|
|
52
|
+
[0.4.2]: https://github.com/duhu2000/dsh-tender-workbench/releases/tag/v0.4.2
|
|
53
|
+
[0.4.1]: https://github.com/duhu2000/dsh-tender-workbench/releases/tag/v0.4.1
|
|
29
54
|
[0.4.0]: https://github.com/duhu2000/dsh-tender-workbench/releases/tag/v0.4.0
|
package/README.en.md
ADDED
|
@@ -0,0 +1,144 @@
|
|
|
1
|
+
# dsh-tender-workbench
|
|
2
|
+
|
|
3
|
+
[中文](README.md) | **English**
|
|
4
|
+
|
|
5
|
+
`dsh-tender-workbench` is an open-source DeepSeek Harness plugin for finding, screening, reviewing, and delivering tender opportunities. It combines authorized `qcc-tender` data, deterministic screening rules, bounded Agent analysis, explicit human decisions, and immutable Excel/PDF reports in one Session-scoped Better Sidebar workbench.
|
|
6
|
+
|
|
7
|
+
Current stable version: **0.4.2** (stable release).
|
|
8
|
+
|
|
9
|
+
## What it does
|
|
10
|
+
|
|
11
|
+
The workbench follows four business phases:
|
|
12
|
+
|
|
13
|
+
1. **Find opportunities**: search tender notices and proposed projects with source, keyword, date, region, stage, procurement, industry, type, amount, approval, and investment conditions supported by the connected data source.
|
|
14
|
+
2. **Screen candidates**: edit Agent-proposed criteria, run deterministic impact previews, confirm a rule set, and inspect five mutually exclusive outcomes: included, observed, manual review, rule excluded, and unmatched.
|
|
15
|
+
3. **Human confirmation**: review pending and completed records separately, prioritize Agent recommendations, make individual or batch decisions, retain notes, and undo the latest review operation.
|
|
16
|
+
4. **Deliver**: confirm the reviewed scope and generate Excel and PDF files from one immutable report snapshot. Partial delivery remains explicit when records are still pending.
|
|
17
|
+
|
|
18
|
+
Agent analysis covers every record classified as included, observed, or requiring manual review. Rule-excluded and unmatched records are not analyzed. Analysis runs in deterministic batches until the eligible set is complete, and interrupted work resumes from the remaining records.
|
|
19
|
+
|
|
20
|
+
The human-review queue keeps Agent recommendations separate from user decisions. Its default ordering is priority review, watch, not recommended, then unanalyzed. Classification lists are ordered included, observed, manual review, rule excluded, then unmatched before pagination.
|
|
21
|
+
|
|
22
|
+
## Architecture
|
|
23
|
+
|
|
24
|
+
The package is a Host + Client DeepSeek Harness plugin:
|
|
25
|
+
|
|
26
|
+
- The Client registers one Session-targeted Better Sidebar tab and public launcher actions. It builds typed, user-visible intents and consumes bounded Session projections and Artifact APIs.
|
|
27
|
+
- The Host validates intents, calls the exact authorized MCP tools, owns workflow state transitions, stores Session-private Artifacts, and renders reports.
|
|
28
|
+
- Persistent business state is reconstructed from typed conversation events and immutable Artifact references. The UI does not infer state from model text or maintain a second cross-Session state machine.
|
|
29
|
+
- Query, criteria, analysis, review, and report writes share a Session-scoped single-flight guard. Read-only browsing remains available while a write is running.
|
|
30
|
+
- Registrations, subscriptions, portals, routes, and other side effects are tied to the plugin Context lifecycle and are disposed on unload or hot reload.
|
|
31
|
+
|
|
32
|
+
The plugin uses public DeepSeek Harness services and the public `dsh-better-sidebar` contract. It does not modify Harness source, access Provider internals, fetch MCP from the browser, read connector storage, hold API credentials, or write internal data to the Workspace.
|
|
33
|
+
|
|
34
|
+
## Data and report boundaries
|
|
35
|
+
|
|
36
|
+
Each Session has one active normalized dataset. A successful new query atomically replaces that active snapshot instead of merging results; historical Artifacts remain available for traceability while downstream state from the old snapshot becomes inactive.
|
|
37
|
+
|
|
38
|
+
Schema-valid MCP fields are retained as source facts. Missing values, disclosed-but-unparseable values, source failures, rule exclusions, and user exclusions remain distinct states and are not inferred from one another.
|
|
39
|
+
|
|
40
|
+
Excel is organized for analysis and verification, with separate overview, distribution, source-specific result, review, traceability, and data-quality sheets. PDF is organized for business readers, leading with deterministic conclusions, result distributions, deadline windows, and a bounded set of records requiring near-term verification. Both formats use the same immutable report snapshot; a failed format can be retried without re-querying or changing successful files.
|
|
41
|
+
|
|
42
|
+
## Requirements and compatibility
|
|
43
|
+
|
|
44
|
+
The published package declares minimum compatible versions without a stable-version upper bound:
|
|
45
|
+
|
|
46
|
+
- DeepSeek Harness public packages: `0.1.1-rc.2`
|
|
47
|
+
- `dsh-mcp-connector`: `0.2.31`
|
|
48
|
+
- `dsh-better-sidebar`: `0.17.1`
|
|
49
|
+
|
|
50
|
+
The active Profile must provide one coherent runtime with public Session Projection, JSONL Session Persistence, Tools, Skill, Sessions, and WebServer services. Better Sidebar must expose the public `targetedOpen` and `stateSubscription` features.
|
|
51
|
+
|
|
52
|
+
An installed and authorized `qcc-tender` MCP connection must expose these exact tools:
|
|
53
|
+
|
|
54
|
+
- `mcp__qcc-tender__search_tenders`
|
|
55
|
+
- `mcp__qcc-tender__search_proposed_projects`
|
|
56
|
+
|
|
57
|
+
Missing required services, incompatible Better Sidebar capabilities, unavailable MCP tools, and non-JSONL Session persistence fail explicitly. There is no Web-search, alternate-persistence, or Workspace-storage fallback.
|
|
58
|
+
|
|
59
|
+
## Install
|
|
60
|
+
|
|
61
|
+
Install the current stable release and its required Provider plugins:
|
|
62
|
+
|
|
63
|
+
```sh
|
|
64
|
+
dsh plugin --profile web add 'dsh-mcp-connector@>=0.2.31'
|
|
65
|
+
dsh plugin --profile web add 'dsh-better-sidebar@>=0.17.1'
|
|
66
|
+
dsh plugin --profile web add dsh-tender-workbench
|
|
67
|
+
dsh web --no-open
|
|
68
|
+
```
|
|
69
|
+
|
|
70
|
+
To install the exact 0.4.2 release:
|
|
71
|
+
|
|
72
|
+
```sh
|
|
73
|
+
dsh plugin --profile web add 'dsh-mcp-connector@>=0.2.31'
|
|
74
|
+
dsh plugin --profile web add 'dsh-better-sidebar@>=0.17.1'
|
|
75
|
+
dsh plugin --profile web add dsh-tender-workbench@0.4.2
|
|
76
|
+
```
|
|
77
|
+
|
|
78
|
+
To install from an independent checkout, install the required Provider plugins first, then run from this repository:
|
|
79
|
+
|
|
80
|
+
```sh
|
|
81
|
+
corepack pnpm@11.7.0 install --frozen-lockfile
|
|
82
|
+
corepack pnpm@11.7.0 run build
|
|
83
|
+
dsh plugin --profile web add 'dsh-mcp-connector@>=0.2.31'
|
|
84
|
+
dsh plugin --profile web add 'dsh-better-sidebar@>=0.17.1'
|
|
85
|
+
dsh plugin --profile web add .
|
|
86
|
+
dsh web --no-open
|
|
87
|
+
```
|
|
88
|
+
|
|
89
|
+
To install a packed build:
|
|
90
|
+
|
|
91
|
+
```sh
|
|
92
|
+
dsh plugin --profile web add 'dsh-mcp-connector@>=0.2.31'
|
|
93
|
+
dsh plugin --profile web add 'dsh-better-sidebar@>=0.17.1'
|
|
94
|
+
dsh plugin --profile web add ./dsh-tender-workbench-0.4.2.tgz
|
|
95
|
+
dsh web --no-open
|
|
96
|
+
```
|
|
97
|
+
|
|
98
|
+
The package's `dsh.bundle.patch` declaration activates `cordis.patch.yml`, which contributes the `dsh-tender-workbench` Loader row. Restart the Web profile after adding or removing the plugin.
|
|
99
|
+
|
|
100
|
+
To remove it:
|
|
101
|
+
|
|
102
|
+
```sh
|
|
103
|
+
dsh plugin --profile web remove dsh-tender-workbench
|
|
104
|
+
```
|
|
105
|
+
|
|
106
|
+
## Upgrade and rollback
|
|
107
|
+
|
|
108
|
+
Upgrade an existing installation by installing the stable version and fully restarting the Web profile:
|
|
109
|
+
|
|
110
|
+
```sh
|
|
111
|
+
dsh plugin --profile web add dsh-tender-workbench@0.4.2
|
|
112
|
+
dsh web --no-open
|
|
113
|
+
```
|
|
114
|
+
|
|
115
|
+
Version 0.4.2 keeps the runtime code, public exports, workflow, and Artifact schema used by 0.4.1. This patch validates the npm Trusted Publishing path from GitHub Actions through OIDC and provenance without migrating Session data. If a deployment-specific regression requires rollback, reinstall `dsh-tender-workbench@0.4.1` and restart the profile. Published npm versions and Git tags are immutable; fixes after publication use a new patch version rather than overwriting 0.4.2.
|
|
116
|
+
|
|
117
|
+
## Using the workbench
|
|
118
|
+
|
|
119
|
+
The plugin exposes a top-left “招投标” launcher and a Session Header recovery action. Every top-left activation creates a distinct native Session in the current Session's workspace, the recent workspace, or the first available workspace, gives that blank Session the “招投标” hero label and goal icon, and opens its Better Sidebar workbench. Other Sessions keep their existing host/provider hero label and the fish mark. The composer-bottom shortcuts are intentionally absent; the Header action only reopens the workbench for its existing Session.
|
|
120
|
+
|
|
121
|
+
Navigation only changes the visible workbench phase. It does not mutate business state or run a later action. Criteria are proposed, edited, previewed, and confirmed as distinct steps. Agent recommendations never become user decisions automatically. Report generation always shows the reviewed and pending scope before creating a delivery snapshot.
|
|
122
|
+
|
|
123
|
+
The layout is container-responsive: wide workspaces use master/detail grids, while medium and narrow workspaces preserve the same information order with local table scrolling and reachable fixed actions.
|
|
124
|
+
|
|
125
|
+
## Development
|
|
126
|
+
|
|
127
|
+
Use the Node.js and pnpm versions declared by the repository:
|
|
128
|
+
|
|
129
|
+
```sh
|
|
130
|
+
corepack pnpm@11.7.0 install --frozen-lockfile
|
|
131
|
+
corepack pnpm@11.7.0 run check
|
|
132
|
+
```
|
|
133
|
+
|
|
134
|
+
The build emits the Host loader at `lib/index.js`, the Client bundle at `lib/client.js`, and declarations under `lib/types/`.
|
|
135
|
+
|
|
136
|
+
`check` runs type checking, the full Vitest suite, the production build, README/release-state validation, and an npm tarball whitelist preview. Release tags are published by [the release workflow](.github/workflows/release.yml) through npm Trusted Publishing with provenance when Trusted Publishing is configured; manual npm publication must not claim provenance. The repository must never contain npm tokens, GitHub tokens, QCC credentials, source datasets, or Session-private Artifacts.
|
|
137
|
+
|
|
138
|
+
The province, city, and district source snapshot is maintained in [resources/area.ts](resources/area.ts).
|
|
139
|
+
|
|
140
|
+
See [CHANGELOG.md](CHANGELOG.md) and [the 0.4.2 release checklist](docs/RELEASE-0.4.2.md) for the stable-release scope and operational checks.
|
|
141
|
+
|
|
142
|
+
## Current scope
|
|
143
|
+
|
|
144
|
+
The plugin does not provide online PDF preview, delivery-version comparison, regeneration of already successful files, subscriptions, CRM follow-up, enterprise profiles, source-accuracy verification, or Bid/No-Bid decisions. Query, classification, analysis, and review are all valid stopping points; later actions only run after explicit user input.
|
package/README.md
CHANGED
|
@@ -1,62 +1,44 @@
|
|
|
1
1
|
# dsh-tender-workbench
|
|
2
2
|
|
|
3
|
-
|
|
3
|
+
**中文** | [English](README.en.md)
|
|
4
4
|
|
|
5
|
-
|
|
5
|
+
> 面向国内招投标团队的 DeepSeek Harness 开源智能体插件：在一个会话级工作台内完成标讯与拟建项目查询、确定性规则初筛、限定范围智能分析、人工复核，以及 Excel/PDF 报告交付。
|
|
6
|
+
>
|
|
7
|
+
> 当前稳定版本：**0.4.2**（正式版本）
|
|
6
8
|
|
|
7
|
-
|
|
9
|
+
[](https://github.com/duhu2000/dsh-tender-workbench/actions/workflows/ci.yml)
|
|
10
|
+
[](https://www.npmjs.com/package/dsh-tender-workbench)
|
|
11
|
+
[](https://www.npmjs.com/package/dsh-tender-workbench)
|
|
12
|
+
[](https://github.com/duhu2000/dsh-tender-workbench/releases)
|
|
13
|
+
[](LICENSE)
|
|
8
14
|
|
|
9
|
-
|
|
15
|
+
## 产品简介
|
|
10
16
|
|
|
11
|
-
|
|
12
|
-
2. **Screen candidates**: edit Agent-proposed criteria, run deterministic impact previews, confirm a rule set, and inspect five mutually exclusive outcomes: included, observed, manual review, rule excluded, and unmatched.
|
|
13
|
-
3. **Human confirmation**: review pending and completed records separately, prioritize Agent recommendations, make individual or batch decisions, retain notes, and undo the latest review operation.
|
|
14
|
-
4. **Deliver**: confirm the reviewed scope and generate Excel and PDF files from one immutable report snapshot. Partial delivery remains explicit when records are still pending.
|
|
17
|
+
`dsh-tender-workbench` 是 DeepSeek Harness 的 Host + Client 插件，适合需要持续发现、筛选、复核和交付招投标机会的国内业务团队。插件连接客户已安装并授权的 `qcc-tender` MCP，以结构化标讯事实为基础，将规则判断、Agent 建议和人工决策明确分开，形成可追溯的工作流。
|
|
15
18
|
|
|
16
|
-
|
|
19
|
+
完整业务闭环为：
|
|
17
20
|
|
|
18
|
-
|
|
21
|
+
1. **查询机会**：按已连接数据源支持的来源、关键词、日期、地区、阶段、采购方式、行业、类型、金额、审批及投资条件，查询招投标公告和拟建项目。
|
|
22
|
+
2. **规则初筛**：编辑 Agent 建议的筛选条件，先执行确定性影响预览，再确认规则集；结果被划分为纳入、观察、人工复核、规则排除和未匹配五个互斥类别。
|
|
23
|
+
3. **智能分析**：仅分析纳入、观察和需人工复核的记录；规则排除及未匹配记录不进入分析。任务按确定性批次运行，中断后可从剩余记录继续。
|
|
24
|
+
4. **人工复核**：分别查看待复核与已复核记录，参考但不自动采纳 Agent 建议，支持逐条或批量决策、保留备注，并可撤销最近一次复核操作。
|
|
25
|
+
5. **报告交付**：确认复核范围后，基于同一份不可变报告快照生成 Excel 与 PDF；仍有待复核记录时，会明确标记为部分交付。
|
|
19
26
|
|
|
20
|
-
##
|
|
27
|
+
## 核心能力
|
|
21
28
|
|
|
22
|
-
|
|
29
|
+
| 能力 | 实现方式 | 业务边界 |
|
|
30
|
+
| --- | --- | --- |
|
|
31
|
+
| 标讯查询 | 调用已授权的 `qcc-tender` 招投标与拟建项目搜索工具 | 不使用 Web 搜索兜底 |
|
|
32
|
+
| 规则初筛 | 条件编辑、Dry Run 影响预览、人工确认后的确定性分类 | 预览与确认是两个独立步骤 |
|
|
33
|
+
| Agent 分析 | 只覆盖纳入、观察、人工复核三类记录，按批次执行并可续跑 | 建议不会自动变成人工决策 |
|
|
34
|
+
| 人工复核 | 待办/已办分区、逐条与批量决策、备注、最近操作撤销 | 最终业务判断由用户完成 |
|
|
35
|
+
| Excel 报告 | 概览、分布、分来源结果、复核、追溯和数据质量工作表 | 面向分析与核验 |
|
|
36
|
+
| PDF 报告 | 确定性结论、结果分布、截止时间窗及近期需核验记录 | 当前不提供在线 PDF 预览 |
|
|
37
|
+
| 会话隔离 | 业务状态由类型化会话事件和不可变 Artifact 引用重建 | 不维护跨会话的第二套状态机 |
|
|
23
38
|
|
|
24
|
-
|
|
25
|
-
- The Host validates intents, calls the exact authorized MCP tools, owns workflow state transitions, stores Session-private Artifacts, and renders reports.
|
|
26
|
-
- Persistent business state is reconstructed from typed conversation events and immutable Artifact references. The UI does not infer state from model text or maintain a second cross-Session state machine.
|
|
27
|
-
- Query, criteria, analysis, review, and report writes share a Session-scoped single-flight guard. Read-only browsing remains available while a write is running.
|
|
28
|
-
- Registrations, subscriptions, portals, routes, and other side effects are tied to the plugin Context lifecycle and are disposed on unload or hot reload.
|
|
39
|
+
## 30 秒开始
|
|
29
40
|
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
## Data and report boundaries
|
|
33
|
-
|
|
34
|
-
Each Session has one active normalized dataset. A successful new query atomically replaces that active snapshot instead of merging results; historical Artifacts remain available for traceability while downstream state from the old snapshot becomes inactive.
|
|
35
|
-
|
|
36
|
-
Schema-valid MCP fields are retained as source facts. Missing values, disclosed-but-unparseable values, source failures, rule exclusions, and user exclusions remain distinct states and are not inferred from one another.
|
|
37
|
-
|
|
38
|
-
Excel is organized for analysis and verification, with separate overview, distribution, source-specific result, review, traceability, and data-quality sheets. PDF is organized for business readers, leading with deterministic conclusions, result distributions, deadline windows, and a bounded set of records requiring near-term verification. Both formats use the same immutable report snapshot; a failed format can be retried without re-querying or changing successful files.
|
|
39
|
-
|
|
40
|
-
## Requirements and compatibility
|
|
41
|
-
|
|
42
|
-
The published package declares minimum compatible versions without a stable-version upper bound:
|
|
43
|
-
|
|
44
|
-
- DeepSeek Harness public packages: `0.1.1-rc.2`
|
|
45
|
-
- `dsh-mcp-connector`: `0.2.31`
|
|
46
|
-
- `dsh-better-sidebar`: `0.17.1`
|
|
47
|
-
|
|
48
|
-
The active Profile must provide one coherent runtime with public Session Projection, JSONL Session Persistence, Tools, Skill, Sessions, and WebServer services. Better Sidebar must expose the public `targetedOpen` and `stateSubscription` features.
|
|
49
|
-
|
|
50
|
-
An installed and authorized `qcc-tender` MCP connection must expose these exact tools:
|
|
51
|
-
|
|
52
|
-
- `mcp__qcc-tender__search_tenders`
|
|
53
|
-
- `mcp__qcc-tender__search_proposed_projects`
|
|
54
|
-
|
|
55
|
-
Missing required services, incompatible Better Sidebar capabilities, unavailable MCP tools, and non-JSONL Session persistence fail explicitly. There is no Web-search, alternate-persistence, or Workspace-storage fallback.
|
|
56
|
-
|
|
57
|
-
## Install
|
|
58
|
-
|
|
59
|
-
Install the current stable release and its required Provider plugins:
|
|
41
|
+
先安装连接器、侧边栏能力和本插件：
|
|
60
42
|
|
|
61
43
|
```sh
|
|
62
44
|
dsh plugin --profile web add 'dsh-mcp-connector@>=0.2.31'
|
|
@@ -65,78 +47,86 @@ dsh plugin --profile web add dsh-tender-workbench
|
|
|
65
47
|
dsh web --no-open
|
|
66
48
|
```
|
|
67
49
|
|
|
68
|
-
|
|
50
|
+
安装或移除插件后，请完整重启 Web Profile。插件通过 `dsh.bundle.patch` 启用 `cordis.patch.yml`，并注册 `dsh-tender-workbench` Loader。
|
|
51
|
+
|
|
52
|
+
安装指定的 `0.4.2` 版本：
|
|
69
53
|
|
|
70
54
|
```sh
|
|
71
|
-
dsh plugin --profile web add
|
|
72
|
-
dsh plugin --profile web add 'dsh-better-sidebar@>=0.17.1'
|
|
73
|
-
dsh plugin --profile web add dsh-tender-workbench@0.4.0
|
|
55
|
+
dsh plugin --profile web add dsh-tender-workbench@0.4.2
|
|
74
56
|
```
|
|
75
57
|
|
|
76
|
-
|
|
58
|
+
移除插件：
|
|
77
59
|
|
|
78
60
|
```sh
|
|
79
|
-
|
|
80
|
-
corepack pnpm@11.7.0 run build
|
|
81
|
-
dsh plugin --profile web add 'dsh-mcp-connector@>=0.2.31'
|
|
82
|
-
dsh plugin --profile web add 'dsh-better-sidebar@>=0.17.1'
|
|
83
|
-
dsh plugin --profile web add .
|
|
84
|
-
dsh web --no-open
|
|
61
|
+
dsh plugin --profile web remove dsh-tender-workbench
|
|
85
62
|
```
|
|
86
63
|
|
|
87
|
-
|
|
64
|
+
## 使用工作台
|
|
88
65
|
|
|
89
|
-
|
|
90
|
-
dsh plugin --profile web add 'dsh-mcp-connector@>=0.2.31'
|
|
91
|
-
dsh plugin --profile web add 'dsh-better-sidebar@>=0.17.1'
|
|
92
|
-
dsh plugin --profile web add ./dsh-tender-workbench-0.4.0.tgz
|
|
93
|
-
dsh web --no-open
|
|
94
|
-
```
|
|
66
|
+
插件提供左上角“招投标”入口和会话 Header 恢复入口。点击左上角入口会在当前工作区、最近工作区或第一个可用工作区中创建一个独立的原生会话，为空白会话显示“招投标”标题与目标图标，并打开对应的 Better Sidebar 工作台；其他会话继续保留各自原有标题与标识。
|
|
95
67
|
|
|
96
|
-
|
|
68
|
+
页面导航只切换可见阶段，不会修改业务状态或自动执行后续动作。规则建议、编辑、影响预览与确认彼此独立；报告生成前始终展示已复核和待复核范围。宽屏使用主从布局，中窄屏保持相同信息顺序，并保留局部表格滚动与可访问的固定操作区。
|
|
97
69
|
|
|
98
|
-
|
|
70
|
+
## 数据、安全与费用边界
|
|
99
71
|
|
|
100
|
-
|
|
101
|
-
|
|
102
|
-
|
|
72
|
+
- 每个会话只有一份当前生效的标准化数据集。新查询成功后会原子替换当前快照，不与旧结果合并；历史 Artifact 仍可用于追溯，旧快照的后续业务状态不再生效。
|
|
73
|
+
- 对符合 Schema 的 MCP 字段按来源事实保留。字段缺失、已披露但无法解析、来源失败、规则排除和用户排除是不同状态，插件不会互相推断或补造。
|
|
74
|
+
- 浏览器端不直接调用 MCP，不读取连接器存储，也不持有 API 凭证；Host 负责校验意图、调用获授权工具、管理状态转换、保存会话私有 Artifact 并生成报告。
|
|
75
|
+
- 插件不修改 DeepSeek Harness 源码，不访问 Provider 内部实现，不把内部数据写入 Workspace。仓库和发布包不得包含 npm/GitHub Token、QCC 凭证、源数据集或会话私有 Artifact。
|
|
76
|
+
- `qcc-tender` 的授权范围、调用额度和费用由客户自己的 MCP 连接及相关服务合同决定；本插件不内置、不分发或共享开发者密钥，也不代理结算。
|
|
103
77
|
|
|
104
|
-
##
|
|
78
|
+
## 环境要求与兼容性
|
|
105
79
|
|
|
106
|
-
|
|
80
|
+
发布包声明以下最低兼容版本，不设置稳定版上限：
|
|
107
81
|
|
|
108
|
-
|
|
109
|
-
|
|
110
|
-
dsh
|
|
111
|
-
|
|
82
|
+
- DeepSeek Harness 公共包：`0.1.1-rc.2`
|
|
83
|
+
- `dsh-mcp-connector`：`0.2.31`
|
|
84
|
+
- `dsh-better-sidebar`：`0.17.1`
|
|
85
|
+
- Node.js：`^22.19.0 || >=24.0.0`
|
|
112
86
|
|
|
113
|
-
|
|
87
|
+
当前 Profile 必须提供同一套公共 Session Projection、JSONL Session Persistence、Tools、Skill、Sessions 和 WebServer 服务；Better Sidebar 必须提供公共 `targetedOpen` 与 `stateSubscription` 能力。
|
|
114
88
|
|
|
115
|
-
|
|
89
|
+
已安装并授权的 `qcc-tender` MCP 连接必须暴露以下精确工具名：
|
|
116
90
|
|
|
117
|
-
|
|
91
|
+
- `mcp__qcc-tender__search_tenders`
|
|
92
|
+
- `mcp__qcc-tender__search_proposed_projects`
|
|
93
|
+
|
|
94
|
+
缺少必要服务、Better Sidebar 能力不兼容、MCP 工具不可用或会话持久化不是 JSONL 时，插件会明确失败；不提供 Web 搜索、其他持久化或 Workspace 存储兜底。
|
|
118
95
|
|
|
119
|
-
|
|
96
|
+
## 升级与回滚
|
|
120
97
|
|
|
121
|
-
|
|
98
|
+
从已有版本升级：
|
|
122
99
|
|
|
123
|
-
|
|
100
|
+
```sh
|
|
101
|
+
dsh plugin --profile web add dsh-tender-workbench@0.4.2
|
|
102
|
+
dsh web --no-open
|
|
103
|
+
```
|
|
124
104
|
|
|
125
|
-
|
|
105
|
+
`0.4.2` 与 `0.4.1` 的运行时代码、公共导出、工作流和 Artifact Schema 保持一致；本补丁用于通过 npm Trusted Publishing 验证 GitHub Actions OIDC 与 provenance 自动发布链路，不迁移会话数据。如部署环境出现特定回归，可重新安装 `dsh-tender-workbench@0.4.1` 并重启 Profile。已发布的 npm 版本和 Git 标签保持不可变，后续修复使用新的补丁版本。
|
|
106
|
+
|
|
107
|
+
## 本地开发
|
|
108
|
+
|
|
109
|
+
使用仓库声明的 Node.js 与 pnpm 版本：
|
|
126
110
|
|
|
127
111
|
```sh
|
|
128
112
|
corepack pnpm@11.7.0 install --frozen-lockfile
|
|
129
113
|
corepack pnpm@11.7.0 run check
|
|
130
114
|
```
|
|
131
115
|
|
|
132
|
-
|
|
116
|
+
构建产物包括 Host Loader `lib/index.js`、Client Bundle `lib/client.js` 和 `lib/types/` 下的类型声明。
|
|
117
|
+
|
|
118
|
+
`check` 会执行类型检查、完整 Vitest 测试、生产构建、README/发布状态校验以及 npm tarball 白名单预检。配置 npm Trusted Publishing 后，[发布工作流](.github/workflows/release.yml)可使用 OIDC 和 provenance；手工发布不得声称 provenance。
|
|
119
|
+
|
|
120
|
+
省、市、区数据源快照维护在 [resources/area.ts](resources/area.ts)。版本变更见 [CHANGELOG.md](CHANGELOG.md)，发布检查见 [0.4.2 发布清单](docs/RELEASE-0.4.2.md)。
|
|
121
|
+
|
|
122
|
+
## 当前范围
|
|
133
123
|
|
|
134
|
-
|
|
124
|
+
当前版本不提供在线 PDF 预览、交付版本对比、已成功文件的重复生成、订阅、CRM 跟进、企业画像、来源准确性核验或 Bid/No-Bid 决策。查询、分类、分析和复核都可以作为合法结束点；只有用户明确操作后，后续阶段才会继续。
|
|
135
125
|
|
|
136
|
-
|
|
126
|
+
## 参与贡献
|
|
137
127
|
|
|
138
|
-
|
|
128
|
+
欢迎通过 [Issues](https://github.com/duhu2000/dsh-tender-workbench/issues) 提交缺陷与建议。提交代码前请运行完整 `check`，并避免在测试夹具、日志、截图或提交历史中加入真实客户数据和凭证。
|
|
139
129
|
|
|
140
|
-
##
|
|
130
|
+
## 许可证
|
|
141
131
|
|
|
142
|
-
|
|
132
|
+
[MIT](LICENSE)
|
|
@@ -0,0 +1,63 @@
|
|
|
1
|
+
# dsh-tender-workbench 0.4.2 发布清单
|
|
2
|
+
|
|
3
|
+
- Version: **0.4.2**
|
|
4
|
+
- 发布日期：2026-09-05
|
|
5
|
+
- Status: **release candidate**
|
|
6
|
+
- Git 标签：`v0.4.2`
|
|
7
|
+
- npm 目标：`dsh-tender-workbench@0.4.2`（`latest`）
|
|
8
|
+
- GitHub Release：<https://github.com/duhu2000/dsh-tender-workbench/releases/tag/v0.4.2>
|
|
9
|
+
|
|
10
|
+
## 发布范围
|
|
11
|
+
|
|
12
|
+
0.4.2 是 npm Trusted Publishing 交付链路验证补丁。运行时代码、公共导出、工作流行为和 Artifact Schema 与 0.4.1 保持一致；版本通过 `v0.4.2` 标签触发 `.github/workflows/release.yml`，由 GitHub Actions OIDC 发布至 npm 并生成 provenance，不使用长期 npm Token。
|
|
13
|
+
|
|
14
|
+
## 兼容性与安装
|
|
15
|
+
|
|
16
|
+
- Node.js：`^22.19.0 || >=24.0.0`
|
|
17
|
+
- 包管理器：`pnpm@11.7.0`
|
|
18
|
+
- DeepSeek Harness 公共包：`>=0.1.1-rc.2 || >=0.1.2-0`
|
|
19
|
+
- `dsh-mcp-connector`：`>=0.2.31`
|
|
20
|
+
- `dsh-better-sidebar`：`>=0.17.1 || >=0.18.0-0`
|
|
21
|
+
- 必需 MCP 工具：`mcp__qcc-tender__search_tenders`、`mcp__qcc-tender__search_proposed_projects`
|
|
22
|
+
|
|
23
|
+
## 发布门禁
|
|
24
|
+
|
|
25
|
+
- [x] 使用仓库锁文件完成 frozen pnpm install。
|
|
26
|
+
- [x] TypeScript 类型检查通过。
|
|
27
|
+
- [x] 完整 Vitest 测试通过。
|
|
28
|
+
- [x] Host Loader、Client Bundle、source map 和类型声明构建成功。
|
|
29
|
+
- [x] 中文/英文 README 与 0.4.2 发布状态检查通过。
|
|
30
|
+
- [x] npm tarball 只包含白名单公开文件，且同时包含 `README.md` 与 `README.en.md`。
|
|
31
|
+
- [x] tag 模式检查确认 `v0.4.2` 与包版本一致。
|
|
32
|
+
- [ ] `main` CI 在 Linux Node 22/24 和 Windows Node 24 全部通过。
|
|
33
|
+
- [ ] npm Trusted Publishing OIDC 自动发布成功，`latest` 指向 0.4.2。
|
|
34
|
+
- [ ] npm provenance 可验证，仓库和工作流身份与 Trusted Publisher 精确匹配。
|
|
35
|
+
- [ ] GitHub Release 为 latest、非 draft、非 prerelease。
|
|
36
|
+
|
|
37
|
+
未勾选项均为待办，不得报告为已完成。发布成功后在 `main` 上追加不可变发布结果记录，不移动 `v0.4.2` 标签。
|
|
38
|
+
|
|
39
|
+
## 发布步骤
|
|
40
|
+
|
|
41
|
+
1. 使用 pnpm 11.7.0 执行 frozen install 和完整 `check`，再以 `GITHUB_REF_NAME=v0.4.2` 执行 tag 模式检查。
|
|
42
|
+
2. 审查 tarball 白名单与 Git diff，只提交 0.4.2 发布元数据并推送 `main`。
|
|
43
|
+
3. 等待所有必需 CI job 通过后，在发布提交上创建 annotated tag `v0.4.2` 并推送。
|
|
44
|
+
4. 由 GitHub Actions 通过 OIDC 自动发布；不使用手工 npm fallback 来替代本次验证目标。
|
|
45
|
+
5. 核验 npm version、dist-tag、provenance、中文 description、中文 README、仓库地址、tarball 摘要、Git 标签和 GitHub Release。
|
|
46
|
+
|
|
47
|
+
## 本地验证记录
|
|
48
|
+
|
|
49
|
+
2026-09-05 使用 Node.js 25.9.0 与 pnpm 11.7.0 完成验证：
|
|
50
|
+
|
|
51
|
+
- `pnpm install --frozen-lockfile`：通过，锁文件无需变更。
|
|
52
|
+
- `pnpm run check`：通过；40 个测试文件中 207 项通过、1 项预期跳过，并完成类型检查、生产构建、双语文档检查、发布状态检查和打包白名单验证。
|
|
53
|
+
- tag 模式检查：以 `GITHUB_REF_NAME=v0.4.2` 通过。
|
|
54
|
+
- tarball：170 个文件，全部位于发布白名单内。
|
|
55
|
+
|
|
56
|
+
上游 `@deepseek-ai/dsh-client-ui-primitives` 仍缺少其声明的 source map，Vitest 会给出提示；本包生成的 source map 完整，构建与门禁通过。
|
|
57
|
+
|
|
58
|
+
## 安全与回滚
|
|
59
|
+
|
|
60
|
+
- 禁止存储或输出 npm/GitHub Token、QCC 凭证、源数据集、真实业务证据或会话私有 Artifact。
|
|
61
|
+
- 推送标签前如门禁失败，修正发布提交并重新运行全部门禁。
|
|
62
|
+
- 推送标签后如自动发布失败，不复用或移动公开标签；诊断并使用新的补丁版本向前修复。
|
|
63
|
+
- npm 发布后不得覆盖或 unpublish 0.4.2；部署回滚目标为 `dsh-tender-workbench@0.4.1`。
|