dsh-tender-workbench 0.4.2 → 0.4.4

package/CHANGELOG.md

@@ -4,6 +4,22 @@ All notable changes to `dsh-tender-workbench` are documented in this file.
 
 ## [Unreleased]
 
+## [0.4.4] - 2026-09-06
+
+### Fixed
+
+- 修复「新会话」误复用招投标工作台会话的问题：招投标入口会话改为仅以 `cwd`（工作区路径）创建、不再挂进工作区，DSH「新会话」的空白会话复用逻辑因此跳过它，恢复默认 DSH 标准页；只有点击「招投标」才进入带标题的工作台初始页。
+
+## [0.4.3] - 2026-09-05
+
+### Fixed
+
+- Bounded the tender-session hero-headline sync so the MutationObserver that keeps the "招投标" headline can only correct the title a finite number of times before disconnecting, preventing an unbounded cross-plugin rewrite loop. The rewrite remains single-session-scoped (`isTenderEntrySessionId`) and the correction budget (`MAX_HERO_CORRECTIONS = 8`) makes the sync bounded.
+
+### Compatibility
+
+- Runtime implementation, public exports, workflow behavior, and Artifact schema are otherwise unchanged from 0.4.2; this patch only adds a correction budget to the tender hero title rewrite.
+
 ## [0.4.2] - 2026-09-05
 
 ### Changed

package/README.en.md

@@ -4,7 +4,7 @@
 
 `dsh-tender-workbench` is an open-source DeepSeek Harness plugin for finding, screening, reviewing, and delivering tender opportunities. It combines authorized `qcc-tender` data, deterministic screening rules, bounded Agent analysis, explicit human decisions, and immutable Excel/PDF reports in one Session-scoped Better Sidebar workbench.
 
-Current stable version: **0.4.2** (stable release).
+Current stable version: **0.4.4** (stable release).
 
 ## What it does
 
@@ -67,12 +67,12 @@ dsh plugin --profile web add dsh-tender-workbench
 dsh web --no-open
 ```
 
-To install the exact 0.4.2 release:
+To install the exact 0.4.4 release:
 
 ```sh
 dsh plugin --profile web add 'dsh-mcp-connector@>=0.2.31'
 dsh plugin --profile web add 'dsh-better-sidebar@>=0.17.1'
-dsh plugin --profile web add dsh-tender-workbench@0.4.2
+dsh plugin --profile web add dsh-tender-workbench@0.4.4
 ```
 
 To install from an independent checkout, install the required Provider plugins first, then run from this repository:
@@ -91,7 +91,7 @@ To install a packed build:
 ```sh
 dsh plugin --profile web add 'dsh-mcp-connector@>=0.2.31'
 dsh plugin --profile web add 'dsh-better-sidebar@>=0.17.1'
-dsh plugin --profile web add ./dsh-tender-workbench-0.4.2.tgz
+dsh plugin --profile web add ./dsh-tender-workbench-0.4.4.tgz
 dsh web --no-open
 ```
 
@@ -108,11 +108,11 @@ dsh plugin --profile web remove dsh-tender-workbench
 Upgrade an existing installation by installing the stable version and fully restarting the Web profile:
 
 ```sh
-dsh plugin --profile web add dsh-tender-workbench@0.4.2
+dsh plugin --profile web add dsh-tender-workbench@0.4.4
 dsh web --no-open
 ```
 
-Version 0.4.2 keeps the runtime code, public exports, workflow, and Artifact schema used by 0.4.1. This patch validates the npm Trusted Publishing path from GitHub Actions through OIDC and provenance without migrating Session data. If a deployment-specific regression requires rollback, reinstall `dsh-tender-workbench@0.4.1` and restart the profile. Published npm versions and Git tags are immutable; fixes after publication use a new patch version rather than overwriting 0.4.2.
+Version 0.4.4 fixes the "New Session" action wrongly reopening the tender workbench session. The tender launcher now creates its entry session with `cwd` (the workspace path) only, without attaching it to the workspace, so DSH's blank-session reuse for New Session skips it and New Session restores the default DSH page; the "招投标" workbench initial page (with its own title) only appears when the launcher is clicked. Other runtime code, public exports, workflow, and Artifact schema are unchanged from 0.4.3, and no Session data is migrated. If a deployment-specific regression requires rollback, reinstall `dsh-tender-workbench@0.4.3` and restart the profile. Published npm versions and Git tags are immutable; fixes after publication use a new patch version rather than overwriting 0.4.4.
 
 ## Using the workbench
 
@@ -137,7 +137,7 @@ The build emits the Host loader at `lib/index.js`, the Client bundle at `lib/cli
 
 The province, city, and district source snapshot is maintained in [resources/area.ts](resources/area.ts).
 
-See [CHANGELOG.md](CHANGELOG.md) and [the 0.4.2 release checklist](docs/RELEASE-0.4.2.md) for the stable-release scope and operational checks.
+See [CHANGELOG.md](CHANGELOG.md) and [the 0.4.4 release checklist](docs/RELEASE-0.4.4.md) for the stable-release scope and operational checks.
 
 ## Current scope
 

package/README.md

@@ -4,7 +4,7 @@
 
 > 面向国内招投标团队的 DeepSeek Harness 开源智能体插件：在一个会话级工作台内完成标讯与拟建项目查询、确定性规则初筛、限定范围智能分析、人工复核，以及 Excel/PDF 报告交付。
 >
-> 当前稳定版本：**0.4.2**（正式版本）
+> 当前稳定版本：**0.4.4**（正式版本）
 
 [![CI](https://github.com/duhu2000/dsh-tender-workbench/actions/workflows/ci.yml/badge.svg)](https://github.com/duhu2000/dsh-tender-workbench/actions/workflows/ci.yml)
 [![npm](https://img.shields.io/npm/v/dsh-tender-workbench)](https://www.npmjs.com/package/dsh-tender-workbench)
@@ -49,10 +49,10 @@ dsh web --no-open
 
 安装或移除插件后，请完整重启 Web Profile。插件通过 `dsh.bundle.patch` 启用 `cordis.patch.yml`，并注册 `dsh-tender-workbench` Loader。
 
-安装指定的 `0.4.2` 版本：
+安装指定的 `0.4.4` 版本：
 
 ```sh
-dsh plugin --profile web add dsh-tender-workbench@0.4.2
+dsh plugin --profile web add dsh-tender-workbench@0.4.4
 ```
 
 移除插件：
@@ -98,11 +98,11 @@ dsh plugin --profile web remove dsh-tender-workbench
 从已有版本升级：
 
 ```sh
-dsh plugin --profile web add dsh-tender-workbench@0.4.2
+dsh plugin --profile web add dsh-tender-workbench@0.4.4
 dsh web --no-open
 ```
 
-`0.4.2` 与 `0.4.1` 的运行时代码、公共导出、工作流和 Artifact Schema 保持一致；本补丁用于通过 npm Trusted Publishing 验证 GitHub Actions OIDC 与 provenance 自动发布链路，不迁移会话数据。如部署环境出现特定回归，可重新安装 `dsh-tender-workbench@0.4.1` 并重启 Profile。已发布的 npm 版本和 Git 标签保持不可变，后续修复使用新的补丁版本。
+`0.4.4` 在 `0.4.3` 基础上修复「新会话」误复用招投标工作台会话的问题：招投标入口会话改为仅以 `cwd`（工作区路径）创建、不再挂进工作区，DSH「新会话」的空白会话复用逻辑因此跳过它，恢复默认 DSH 标准页；只有点击「招投标」才进入带标题的工作台初始页。其余运行时代码、公共导出、工作流和 Artifact Schema 与 0.4.3 保持一致，不迁移会话数据。如部署环境出现特定回归，可重新安装 `dsh-tender-workbench@0.4.3` 并重启 Profile。已发布的 npm 版本和 Git 标签保持不可变，后续修复使用新的补丁版本。
 
 ## 本地开发
 
@@ -117,7 +117,7 @@ corepack pnpm@11.7.0 run check
 
 `check` 会执行类型检查、完整 Vitest 测试、生产构建、README/发布状态校验以及 npm tarball 白名单预检。配置 npm Trusted Publishing 后，[发布工作流](.github/workflows/release.yml)可使用 OIDC 和 provenance；手工发布不得声称 provenance。
 
-省、市、区数据源快照维护在 [resources/area.ts](resources/area.ts)。版本变更见 [CHANGELOG.md](CHANGELOG.md)，发布检查见 [0.4.2 发布清单](docs/RELEASE-0.4.2.md)。
+省、市、区数据源快照维护在 [resources/area.ts](resources/area.ts)。版本变更见 [CHANGELOG.md](CHANGELOG.md)，发布检查见 [0.4.4 发布清单](docs/RELEASE-0.4.4.md)。
 
 ## 当前范围
 

package/docs/RELEASE-0.4.4.md

@@ -0,0 +1,53 @@
+# dsh-tender-workbench 0.4.4 发布清单
+
+- Version: **0.4.4**
+- 发布日期：2026-09-06
+- Status: **release candidate**
+- 发布提交：（发布工作流完成后回填 npm gitHead）
+- Git 标签：`v0.4.4`
+- npm 目标：`dsh-tender-workbench@0.4.4`（`latest`）
+
+## 发布范围
+
+0.4.4 修复「新会话」误复用招投标工作台会话的问题。招投标入口会话从 `create({ workspaceId, sessionId })` 改为 `create({ cwd, sessionId })`：仅以工作区路径创建、不再挂进工作区 `sessionIds`，DSH 核心 `connectWorkspace` 的空白会话复用因此跳过它，「新会话」恢复默认 DSH 标准页；只有点击「招投标」才进入带标题的工作台初始页。运行时代码、公共导出、工作流行为和 Artifact Schema 与 0.4.3 保持一致；版本通过 `v0.4.4` 标签触发 `.github/workflows/release.yml`，由 GitHub Actions OIDC 发布至 npm 并生成 provenance。
+
+## 兼容性与安装
+
+- Node.js：`^22.19.0 || >=24.0.0`
+- 包管理器：`pnpm@11.7.0`
+- DeepSeek Harness 公共包：`>=0.1.1-rc.2 || >=0.1.2-0`
+- `dsh-mcp-connector`：`>=0.2.31`
+- `dsh-better-sidebar`：`>=0.17.1 || >=0.18.0-0`
+- 必需 MCP 工具：`mcp__qcc-tender__search_tenders`、`mcp__qcc-tender__search_proposed_projects`
+
+## 发布门禁
+
+- [x] 使用仓库锁文件完成 frozen pnpm install。
+- [x] TypeScript 类型检查通过。
+- [x] 完整 Vitest 测试通过。
+- [x] Host Loader、Client Bundle、source map 和类型声明构建成功。
+- [x] 中文/英文 README 与 0.4.4 发布状态检查通过。
+- [x] npm tarball 只包含白名单公开文件。
+- [x] tag 模式检查确认 `v0.4.4` 与包版本一致。
+- [ ] `main` CI 在 Linux Node 22/24 和 Windows Node 24 全部通过。
+- [ ] npm Trusted Publishing OIDC 自动发布成功，`latest` 指向 0.4.4。
+- [ ] npm provenance 可验证。
+- [ ] GitHub Release 为 latest、非 draft、非 prerelease。
+
+## 发布步骤
+
+1. 使用 pnpm 11.7.0 执行 frozen install 和完整 `check`。
+2. 审查 Git diff，提交 0.4.4 发布元数据与「新会话」会话归属修复并推送 `main`。
+3. 等待必需 CI job 通过后，在发布提交上创建 annotated tag `v0.4.4` 并推送。
+4. 由 GitHub Actions 通过 OIDC 自动发布；不使用长期 npm Token。
+5. 核验 npm version、dist-tag、provenance、Git 标签和 GitHub Release。
+
+## 发布结果
+
+（发布工作流完成后回填。）
+
+## 安全与回滚
+
+- 禁止存储或输出 npm/GitHub Token、QCC 凭证、源数据集或会话私有 Artifact。
+- 推送标签后如自动发布失败，不复用或移动公开标签；诊断并使用新的补丁版本向前修复。
+- npm 发布后不得覆盖或 unpublish 0.4.4；部署回滚目标为 `dsh-tender-workbench@0.4.3`。

package/lib/client.js

@@ -4708,20 +4708,30 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			if (!UUID_PATTERN.test(uuid)) throw new TenderSessionEntryError("invalid-session-id");
 			return `${TENDER_ENTRY_SESSION_ID_PREFIX}${uuid}`;
 		}
-		function resolveTenderEntryWorkspace(sessions, workspaces) {
+		/**
+		* Resolve the owning workspace's canonical directory path to seed a
+		* `cwd`-owned entry Session. A `cwd`-only create deliberately does NOT attach
+		* the Session to the workspace, so DSH's New-Session blank-session reuse skips it.
+		*/
+		function resolveTenderEntryWorkspacePath(sessions, workspaces) {
 			const current = sessions.list.getSnapshot().current;
 			const workspaceSnapshot = workspaces.list.getSnapshot();
-			return (current === void 0 ? void 0 : workspaceSnapshot.items.find((workspace) => workspace.sessionIds.includes(current)))?.workspaceId ?? workspaceSnapshot.recentWorkspaceId ?? workspaceSnapshot.items[0]?.workspaceId;
+			return (current === void 0 ? void 0 : workspaceSnapshot.items.find((workspace) => workspace.sessionIds.includes(current)))?.path ?? workspaceSnapshot.items.find((workspace) => workspace.workspaceId === workspaceSnapshot.recentWorkspaceId)?.path ?? workspaceSnapshot.items[0]?.path;
 		}
-		/** Create a distinct native Session without falling back to blank-Session reuse. */
+		/**
+		* Create a distinct native Session with `cwd` ownership only (no workspace
+		* attachment). This keeps the Session out of the workspace's reusable blank-set,
+		* so DSH's 新会话 action mints a fresh default Session instead of reopening the
+		* workbench Session.
+		*/
 		async function createTenderEntrySession(sessions, workspaces, uuid = browserUuid) {
-			const workspaceId = resolveTenderEntryWorkspace(sessions, workspaces);
-			if (workspaceId === void 0) throw new TenderSessionEntryError("workspace-unavailable");
+			const cwd = resolveTenderEntryWorkspacePath(sessions, workspaces);
+			if (cwd === void 0) throw new TenderSessionEntryError("workspace-unavailable");
 			const capability = sessions;
 			if (typeof capability.create !== "function") throw new TenderSessionEntryError("create-unavailable");
 			const requestedId = createTenderEntrySessionId(uuid());
 			const createdId = await capability.create({
-				workspaceId,
+				cwd,
 				sessionId: requestedId
 			});
 			if (createdId !== requestedId) throw new TenderSessionEntryError("invalid-session-id");
@@ -4794,22 +4804,30 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			if (hero === null) return () => {};
 			const title = [...hero.querySelectorAll("span")].find((element) => element.dataset.dshTenderHeroHeadline === "true" || KNOWN_HERO_HEADLINES.has(element.textContent?.trim() ?? ""));
 			if (title === void 0) return () => {};
-			let original = title.dataset.dshTenderOriginalHeadline ?? title.textContent ?? "";
+			const original = title.dataset.dshTenderOriginalHeadline ?? title.textContent ?? "";
 			title.dataset.dshTenderHeroHeadline = "true";
 			title.dataset.dshTenderOriginalHeadline = original;
 			title.textContent = replacement;
 			const Observer = anchor.ownerDocument.defaultView?.MutationObserver;
-			const observer = Observer === void 0 ? void 0 : new Observer(() => {
-				if (title.textContent === replacement) return;
-				original = title.textContent ?? original;
-				title.dataset.dshTenderOriginalHeadline = original;
-				title.textContent = replacement;
-			});
-			observer?.observe(title, {
-				childList: true,
-				characterData: true,
-				subtree: true
-			});
+			const MAX_HERO_CORRECTIONS = 8;
+			let corrections = 0;
+			let observer;
+			if (Observer !== void 0) {
+				observer = new Observer(() => {
+					if (title.textContent === replacement) return;
+					if (corrections >= MAX_HERO_CORRECTIONS) {
+						observer?.disconnect();
+						return;
+					}
+					corrections += 1;
+					title.textContent = replacement;
+				});
+				observer.observe(title, {
+					childList: true,
+					characterData: true,
+					subtree: true
+				});
+			}
 			return () => {
 				observer?.disconnect();
 				if (title.dataset.dshTenderOriginalHeadline !== original) return;