dsh-tender-workbench 0.4.2 → 0.4.3

package/CHANGELOG.md

@@ -4,6 +4,16 @@ All notable changes to `dsh-tender-workbench` are documented in this file.
 
 ## [Unreleased]
 
+## [0.4.3] - 2026-09-05
+
+### Fixed
+
+- Bounded the tender-session hero-headline sync so the MutationObserver that keeps the "招投标" headline can only correct the title a finite number of times before disconnecting, preventing an unbounded cross-plugin rewrite loop. The rewrite remains single-session-scoped (`isTenderEntrySessionId`) and the correction budget (`MAX_HERO_CORRECTIONS = 8`) makes the sync bounded.
+
+### Compatibility
+
+- Runtime implementation, public exports, workflow behavior, and Artifact schema are otherwise unchanged from 0.4.2; this patch only adds a correction budget to the tender hero title rewrite.
+
 ## [0.4.2] - 2026-09-05
 
 ### Changed

package/README.en.md

@@ -4,7 +4,7 @@
 
 `dsh-tender-workbench` is an open-source DeepSeek Harness plugin for finding, screening, reviewing, and delivering tender opportunities. It combines authorized `qcc-tender` data, deterministic screening rules, bounded Agent analysis, explicit human decisions, and immutable Excel/PDF reports in one Session-scoped Better Sidebar workbench.
 
-Current stable version: **0.4.2** (stable release).
+Current stable version: **0.4.3** (stable release).
 
 ## What it does
 
@@ -67,12 +67,12 @@ dsh plugin --profile web add dsh-tender-workbench
 dsh web --no-open
 ```
 
-To install the exact 0.4.2 release:
+To install the exact 0.4.3 release:
 
 ```sh
 dsh plugin --profile web add 'dsh-mcp-connector@>=0.2.31'
 dsh plugin --profile web add 'dsh-better-sidebar@>=0.17.1'
-dsh plugin --profile web add dsh-tender-workbench@0.4.2
+dsh plugin --profile web add dsh-tender-workbench@0.4.3
 ```
 
 To install from an independent checkout, install the required Provider plugins first, then run from this repository:
@@ -91,7 +91,7 @@ To install a packed build:
 ```sh
 dsh plugin --profile web add 'dsh-mcp-connector@>=0.2.31'
 dsh plugin --profile web add 'dsh-better-sidebar@>=0.17.1'
-dsh plugin --profile web add ./dsh-tender-workbench-0.4.2.tgz
+dsh plugin --profile web add ./dsh-tender-workbench-0.4.3.tgz
 dsh web --no-open
 ```
 
@@ -108,11 +108,11 @@ dsh plugin --profile web remove dsh-tender-workbench
 Upgrade an existing installation by installing the stable version and fully restarting the Web profile:
 
 ```sh
-dsh plugin --profile web add dsh-tender-workbench@0.4.2
+dsh plugin --profile web add dsh-tender-workbench@0.4.3
 dsh web --no-open
 ```
 
-Version 0.4.2 keeps the runtime code, public exports, workflow, and Artifact schema used by 0.4.1. This patch validates the npm Trusted Publishing path from GitHub Actions through OIDC and provenance without migrating Session data. If a deployment-specific regression requires rollback, reinstall `dsh-tender-workbench@0.4.1` and restart the profile. Published npm versions and Git tags are immutable; fixes after publication use a new patch version rather than overwriting 0.4.2.
+Version 0.4.3 fixes a potential infinite loop where the tender-session hero headline could rewrite back and forth with other plugins. The headline sync now uses single-session ownership plus a bounded correction budget (`MAX_HERO_CORRECTIONS = 8`) that disconnects the observer at the limit. Other runtime code, public exports, workflow, and Artifact schema are unchanged from 0.4.2, and no Session data is migrated. If a deployment-specific regression requires rollback, reinstall `dsh-tender-workbench@0.4.2` and restart the profile. Published npm versions and Git tags are immutable; fixes after publication use a new patch version rather than overwriting 0.4.3.
 
 ## Using the workbench
 
@@ -137,7 +137,7 @@ The build emits the Host loader at `lib/index.js`, the Client bundle at `lib/cli
 
 The province, city, and district source snapshot is maintained in [resources/area.ts](resources/area.ts).
 
-See [CHANGELOG.md](CHANGELOG.md) and [the 0.4.2 release checklist](docs/RELEASE-0.4.2.md) for the stable-release scope and operational checks.
+See [CHANGELOG.md](CHANGELOG.md) and [the 0.4.3 release checklist](docs/RELEASE-0.4.3.md) for the stable-release scope and operational checks.
 
 ## Current scope
 

package/README.md

@@ -4,7 +4,7 @@
 
 > 面向国内招投标团队的 DeepSeek Harness 开源智能体插件：在一个会话级工作台内完成标讯与拟建项目查询、确定性规则初筛、限定范围智能分析、人工复核，以及 Excel/PDF 报告交付。
 >
-> 当前稳定版本：**0.4.2**（正式版本）
+> 当前稳定版本：**0.4.3**（正式版本）
 
 [![CI](https://github.com/duhu2000/dsh-tender-workbench/actions/workflows/ci.yml/badge.svg)](https://github.com/duhu2000/dsh-tender-workbench/actions/workflows/ci.yml)
 [![npm](https://img.shields.io/npm/v/dsh-tender-workbench)](https://www.npmjs.com/package/dsh-tender-workbench)
@@ -49,10 +49,10 @@ dsh web --no-open
 
 安装或移除插件后，请完整重启 Web Profile。插件通过 `dsh.bundle.patch` 启用 `cordis.patch.yml`，并注册 `dsh-tender-workbench` Loader。
 
-安装指定的 `0.4.2` 版本：
+安装指定的 `0.4.3` 版本：
 
 ```sh
-dsh plugin --profile web add dsh-tender-workbench@0.4.2
+dsh plugin --profile web add dsh-tender-workbench@0.4.3
 ```
 
 移除插件：
@@ -98,11 +98,11 @@ dsh plugin --profile web remove dsh-tender-workbench
 从已有版本升级：
 
 ```sh
-dsh plugin --profile web add dsh-tender-workbench@0.4.2
+dsh plugin --profile web add dsh-tender-workbench@0.4.3
 dsh web --no-open
 ```
 
-`0.4.2` 与 `0.4.1` 的运行时代码、公共导出、工作流和 Artifact Schema 保持一致；本补丁用于通过 npm Trusted Publishing 验证 GitHub Actions OIDC 与 provenance 自动发布链路，不迁移会话数据。如部署环境出现特定回归，可重新安装 `dsh-tender-workbench@0.4.1` 并重启 Profile。已发布的 npm 版本和 Git 标签保持不可变，后续修复使用新的补丁版本。
+`0.4.3` 在 `0.4.2` 基础上修复招投标会话 Hero 标题与其它插件互相改写可能导致的无限循环：标题同步改为单一会话所有权 + 有界校正预算（`MAX_HERO_CORRECTIONS = 8`），达到上限即断开观察器。其余运行时代码、公共导出、工作流和 Artifact Schema 与 0.4.2 保持一致，不迁移会话数据。如部署环境出现特定回归，可重新安装 `dsh-tender-workbench@0.4.2` 并重启 Profile。已发布的 npm 版本和 Git 标签保持不可变，后续修复使用新的补丁版本。
 
 ## 本地开发
 
@@ -117,7 +117,7 @@ corepack pnpm@11.7.0 run check
 
 `check` 会执行类型检查、完整 Vitest 测试、生产构建、README/发布状态校验以及 npm tarball 白名单预检。配置 npm Trusted Publishing 后，[发布工作流](.github/workflows/release.yml)可使用 OIDC 和 provenance；手工发布不得声称 provenance。
 
-省、市、区数据源快照维护在 [resources/area.ts](resources/area.ts)。版本变更见 [CHANGELOG.md](CHANGELOG.md)，发布检查见 [0.4.2 发布清单](docs/RELEASE-0.4.2.md)。
+省、市、区数据源快照维护在 [resources/area.ts](resources/area.ts)。版本变更见 [CHANGELOG.md](CHANGELOG.md)，发布检查见 [0.4.3 发布清单](docs/RELEASE-0.4.3.md)。
 
 ## 当前范围
 

package/docs/RELEASE-0.4.3.md

@@ -0,0 +1,48 @@
+# dsh-tender-workbench 0.4.3 发布清单
+
+- Version: **0.4.3**
+- 发布日期：2026-09-05
+- Status: **release candidate**
+- Git 标签：`v0.4.3`
+- npm 目标：`dsh-tender-workbench@0.4.3`（`latest`）
+
+## 发布范围
+
+0.4.3 修复招投标会话 Hero 标题与其它插件互相改写可能导致的无限循环。标题同步收敛为「单一会话所有权 + 有界同步」：仅在 `isTenderEntrySessionId(sessionId)` 为真的招投标会话改写标题，且观察器带校正预算（`MAX_HERO_CORRECTIONS = 8`），达到上限即断开，杜绝跨插件 ping-pong。运行时代码、公共导出、工作流行为和 Artifact Schema 与 0.4.2 保持一致；版本通过 `v0.4.3` 标签触发 `.github/workflows/release.yml`，由 GitHub Actions OIDC 发布至 npm 并生成 provenance。
+
+## 兼容性与安装
+
+- Node.js：`^22.19.0 || >=24.0.0`
+- 包管理器：`pnpm@11.7.0`
+- DeepSeek Harness 公共包：`>=0.1.1-rc.2 || >=0.1.2-0`
+- `dsh-mcp-connector`：`>=0.2.31`
+- `dsh-better-sidebar`：`>=0.17.1 || >=0.18.0-0`
+- 必需 MCP 工具：`mcp__qcc-tender__search_tenders`、`mcp__qcc-tender__search_proposed_projects`
+
+## 发布门禁
+
+- [ ] 使用仓库锁文件完成 frozen pnpm install。
+- [ ] TypeScript 类型检查通过。
+- [ ] 完整 Vitest 测试通过。
+- [ ] Host Loader、Client Bundle、source map 和类型声明构建成功。
+- [ ] 中文/英文 README 与 0.4.3 发布状态检查通过。
+- [ ] npm tarball 只包含白名单公开文件。
+- [ ] tag 模式检查确认 `v0.4.3` 与包版本一致。
+- [ ] `main` CI 在 Linux Node 22/24 和 Windows Node 24 全部通过。
+- [ ] npm Trusted Publishing OIDC 自动发布成功，`latest` 指向 0.4.3。
+- [ ] npm provenance 可验证。
+- [ ] GitHub Release 为 latest、非 draft、非 prerelease。
+
+## 发布步骤
+
+1. 使用 pnpm 11.7.0 执行 frozen install 和完整 `check`。
+2. 审查 Git diff，提交 0.4.3 发布元数据与 Hero 标题同步修复并推送 `main`。
+3. 等待必需 CI job 通过后，在发布提交上创建 annotated tag `v0.4.3` 并推送。
+4. 由 GitHub Actions 通过 OIDC 自动发布；不使用长期 npm Token。
+5. 核验 npm version、dist-tag、provenance、Git 标签和 GitHub Release。
+
+## 安全与回滚
+
+- 禁止存储或输出 npm/GitHub Token、QCC 凭证、源数据集或会话私有 Artifact。
+- 推送标签后如自动发布失败，不复用或移动公开标签；诊断并使用新的补丁版本向前修复。
+- npm 发布后不得覆盖或 unpublish 0.4.3；部署回滚目标为 `dsh-tender-workbench@0.4.2`。

package/lib/client.js

@@ -4794,22 +4794,30 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			if (hero === null) return () => {};
 			const title = [...hero.querySelectorAll("span")].find((element) => element.dataset.dshTenderHeroHeadline === "true" || KNOWN_HERO_HEADLINES.has(element.textContent?.trim() ?? ""));
 			if (title === void 0) return () => {};
-			let original = title.dataset.dshTenderOriginalHeadline ?? title.textContent ?? "";
+			const original = title.dataset.dshTenderOriginalHeadline ?? title.textContent ?? "";
 			title.dataset.dshTenderHeroHeadline = "true";
 			title.dataset.dshTenderOriginalHeadline = original;
 			title.textContent = replacement;
 			const Observer = anchor.ownerDocument.defaultView?.MutationObserver;
-			const observer = Observer === void 0 ? void 0 : new Observer(() => {
-				if (title.textContent === replacement) return;
-				original = title.textContent ?? original;
-				title.dataset.dshTenderOriginalHeadline = original;
-				title.textContent = replacement;
-			});
-			observer?.observe(title, {
-				childList: true,
-				characterData: true,
-				subtree: true
-			});
+			const MAX_HERO_CORRECTIONS = 8;
+			let corrections = 0;
+			let observer;
+			if (Observer !== void 0) {
+				observer = new Observer(() => {
+					if (title.textContent === replacement) return;
+					if (corrections >= MAX_HERO_CORRECTIONS) {
+						observer?.disconnect();
+						return;
+					}
+					corrections += 1;
+					title.textContent = replacement;
+				});
+				observer.observe(title, {
+					childList: true,
+					characterData: true,
+					subtree: true
+				});
+			}
 			return () => {
 				observer?.disconnect();
 				if (title.dataset.dshTenderOriginalHeadline !== original) return;