dsh-tender-workbench 0.5.6 → 0.5.7

package/CHANGELOG.md

@@ -4,6 +4,11 @@ All notable changes to `dsh-tender-workbench` are documented in this file.
 
 ## [Unreleased]
 
+## [0.5.7] - 2026-09-11
+
+- 按 DSH-UX-001 v1.5.2，以 workspaceId + 命名空间 sessionId 创建业务会话，修复新会话落入“未分组”；保留普通会话防复用守卫及 0.5.6 Host 授权契约。
+- 新增所选 Workspace 归组、普通新会话、入口默认关闭、Tab X/宿主收起恢复与三侧栏路径的真实隔离回归；不自动迁移历史会话。
+
 ## [0.5.6] - 2026-09-10
 
 - 统一 Better Sidebar optional peer、基础/工作台安装预检和运行时降级文案；不自动安装侧栏、不重写工作台容器。

package/README.en.md

@@ -10,7 +10,9 @@ Related agents: [数据清洗补全](https://github.com/duhu2000/dsh-data-cleani
 
 `dsh-tender-workbench` is an open-source DeepSeek Harness plugin for finding, screening, reviewing, and delivering tender opportunities. It combines authorized `qcc-tender` data, deterministic screening rules, bounded Agent analysis, explicit human decisions, and immutable Excel/PDF reports in one Session-scoped Better Sidebar workbench.
 
-Current stable version: **0.5.6** (stable release).
+Current stable version: **0.5.7** (stable release).
+
+Version 0.5.7 fixes Workspace ownership for new business Sessions. See the [release record](docs/RELEASE-0.5.7.md) for publication status and verification boundaries.
 
 Base mode targets the full DSH 0.1.2-rc.1 distribution; Better Sidebar 0.18.1 is optional and only provides the visual workbench. Legacy hosts remain unsupported. Back up the complete Profile and verify dependencies before upgrading.
 
@@ -82,11 +84,11 @@ dsh web --no-open
 
 Optionally enable the visual workbench with `dsh plugin --profile web add dsh-better-sidebar@0.18.1`, enable the tender Tab and fully restart the Profile.
 
-To install the exact 0.5.6 release:
+To install the exact 0.5.7 release:
 
 ```sh
 dsh plugin --profile web add 'dsh-mcp-connector@>=0.2.31'
-dsh plugin --profile web add dsh-tender-workbench@0.5.6
+dsh plugin --profile web add dsh-tender-workbench@0.5.7
 ```
 
 To install base mode from an independent checkout:
@@ -103,7 +105,7 @@ To install a packed build:
 
 ```sh
 dsh plugin --profile web add 'dsh-mcp-connector@>=0.2.31'
-dsh plugin --profile web add ./dsh-tender-workbench-0.5.6.tgz
+dsh plugin --profile web add ./dsh-tender-workbench-0.5.7.tgz
 dsh web --no-open
 ```
 
@@ -120,11 +122,11 @@ dsh plugin --profile web remove dsh-tender-workbench
 Upgrade an existing installation by installing the stable version and fully restarting the Web profile:
 
 ```sh
-dsh plugin --profile web add dsh-tender-workbench@0.5.6
+dsh plugin --profile web add dsh-tender-workbench@0.5.7
 dsh web --no-open
 ```
 
-Version 0.5.6 aligns optional Sidebar metadata, installation checks and fallback guidance, and fixes Host Session event reads and current-turn binding. It retains the v1.5.0 singleton Tab, five navigation shortcuts and Client-lifetime draft recovery. Business schemas are unchanged; history remains Session-local and live MCP connectivity is not verified. Restore a backed-up, fully verified host/plugin combination for rollback, not the original 0.5.4 or an older package alone on the new host.
+Version 0.5.7 creates business Sessions with workspaceId plus a namespaced sessionId, not cwd-only. Current membership wins; a legacy ungrouped Session must match a registered path, and an unregistered selected directory is rejected rather than redirected. Existing ungrouped history is not automatically migrated. The ordinary Session guard and 0.5.6 snapshotEvents/turn-start authorization contract remain intact. Business schemas are unchanged; history remains Session-local and live MCP is not verified. Roll back the complete backed-up host/plugin combination, not an old plugin alone on the new host.
 
 ## Using the workbench
 

package/README.md

@@ -7,7 +7,7 @@
 招投标智能体：支持招投标搜索、招标查询、投标查询、标讯查询、拟建项目与项目筛选，辅助商机发现、人工复核及 Excel/PDF 导出，使用客户自备授权的企查查 MCP。
 
 ```sh
-dsh plugin --profile web add dsh-tender-workbench@0.5.6
+dsh plugin --profile web add dsh-tender-workbench@0.5.7
 ```
 
 请先满足下文的 DSH、连接器及侧边栏依赖要求；安装后完整停止并重启对应 Profile。
@@ -27,7 +27,9 @@ dsh plugin --profile web add dsh-tender-workbench@0.5.6
 
 > 面向国内招投标团队的 DeepSeek Harness 开源智能体插件：在一个会话级工作台内完成标讯与拟建项目查询、确定性规则初筛、限定范围智能分析、人工复核，以及 Excel/PDF 报告交付。
 >
-> 当前稳定版本：**0.5.6**（正式版本）
+> 当前稳定版本：**0.5.7**（正式版本）
+
+0.5.7 修复新建业务 Session 的 Workspace 归组；发布状态及验收边界见 [发布记录](docs/RELEASE-0.5.7.md)。
 
 [![CI](https://github.com/duhu2000/dsh-tender-workbench/actions/workflows/ci.yml/badge.svg)](https://github.com/duhu2000/dsh-tender-workbench/actions/workflows/ci.yml)
 [![npm](https://img.shields.io/npm/v/dsh-tender-workbench)](https://www.npmjs.com/package/dsh-tender-workbench)
@@ -73,10 +75,10 @@ dsh web --no-open
 
 需要可视化工作台时，再自选安装 `dsh plugin --profile web add dsh-better-sidebar@0.18.1`、在宿主设置启用招投标 Tab，并完整重启。无需侧栏也可使用下方列明的基础功能。
 
-安装指定的 `0.5.6` 版本：
+安装指定的 `0.5.7` 版本：
 
 ```sh
-dsh plugin --profile web add dsh-tender-workbench@0.5.6
+dsh plugin --profile web add dsh-tender-workbench@0.5.7
 ```
 
 移除插件：
@@ -87,7 +89,7 @@ dsh plugin --profile web remove dsh-tender-workbench
 
 ## 使用工作台
 
-插件提供左上角“招投标”入口和会话 Header 恢复入口。点击左上角入口会根据当前工作区、当前 Session 目录或第一个可用工作区的路径创建独立原生会话，显示“招投标智能体”标题与目标图标，默认不打开右侧工作台。点击输入框下方的找机会、筛候选、人工定案、形成交付或任务历史按钮时，才打开对应 Better Sidebar 视图；其他会话保留各自原有标题与标识。
+插件提供左上角“招投标”入口和会话 Header 恢复入口。入口解析当前 Session 所属 Workspace，以 `workspaceId + sessionId` 创建归入该工作区的独立原生会话。历史未分组会话仅按精确路径匹配已注册 Workspace；没有当前目录时回退首个已注册工作区，有未注册目录时提示先选择工作区，不静默转入别组。业务 ID 命名空间与普通会话守卫防止空白业务会话被“新会话”复用。显示“招投标智能体”标题与目标图标，默认不打开右侧工作台。五个流程按钮才打开对应 Better Sidebar 视图；其他会话保留各自原有标题与标识。
 
 页面导航只切换可见阶段，不会修改业务状态或自动执行后续动作。规则建议、编辑、影响预览与确认彼此独立；报告生成前始终展示已复核和待复核范围。宽屏使用主从布局，中窄屏保持相同信息顺序，并保留局部表格滚动与可访问的固定操作区。
 
@@ -144,11 +146,11 @@ node scripts/check-host-compatibility.mjs --host-root /实际路径/node_modules
 从已有版本升级：
 
 ```sh
-dsh plugin --profile web add dsh-tender-workbench@0.5.6
+dsh plugin --profile web add dsh-tender-workbench@0.5.7
 dsh web --no-open
 ```
 
-0.5.6 统一可选侧栏声明、安装预检和降级提示，并修复新版宿主 Session 事件读取及当前轮次绑定。保留 v1.5.0 Session 单例 Tab、五入口导航和 Client 生命周期内草稿恢复。查询、筛选、复核和报告业务格式不变；历史仍仅限当前 Session，真实 MCP 连接未核验。回退应恢复备份的完整已验证宿主/插件组合，不能在新版宿主上单独安装原始 0.5.4 或更早版本。
+0.5.7 修复新建业务 Session 的 Workspace 归组，不自动搬迁已有未分组历史。保留 0.5.6 可选侧栏、`snapshotEvents()` / `turn/start` 授权绑定、Session 单例 Tab、五入口及草稿恢复。业务数据格式不变，历史仍仅限当前 Session，真实 MCP 连接未核验。回退应恢复备份的完整已验证宿主/插件组合，不能在新版宿主上单独安装原始 0.5.4 或更早版本。
 
 ## 本地开发
 
@@ -163,7 +165,7 @@ corepack pnpm@11.7.0 run check
 
 `check` 会执行类型检查、完整 Vitest 测试、生产构建、README/发布状态校验以及 npm tarball 白名单预检。配置 npm Trusted Publishing 后，[发布工作流](.github/workflows/release.yml)可使用 OIDC 和 provenance；手工发布不得声称 provenance。
 
-省、市、区数据源快照维护在 [resources/area.ts](resources/area.ts)。版本变更见 [CHANGELOG.md](CHANGELOG.md)，发布检查见 [0.5.6 发布清单](docs/RELEASE-0.5.6.md)。
+省、市、区数据源快照维护在 [resources/area.ts](resources/area.ts)。版本变更见 [CHANGELOG.md](CHANGELOG.md)，发布检查见 [0.5.7 发布清单](docs/RELEASE-0.5.7.md)。
 
 ## 界面演示与市场投稿
 

package/docs/RELEASE-0.5.7.md

@@ -0,0 +1,20 @@
+# dsh-tender-workbench 0.5.7
+
+Version: **0.5.7**
+Status: **ready for release**
+
+用户于 2026-09-11 追加授权 commit、push、tag 与 npm 发布。通过精确提交的完整门禁后合并 PR #5，推送新的 v0.5.7 tag，由 release.yml 通过 OIDC 发布；不移动旧 tag，不变更生产 Profile 或全局宿主。
+
+## 范围与边界
+
+采用 DSH-UX-001 v1.5.2 UX-04：入口解析 Workspace 身份并通过公开 sessions.create({ workspaceId, sessionId }) 创建会话。当前显式归属优先；旧未分组会话按已注册路径精确匹配，无当前目录时取首个 Workspace；有未注册目录时提示用户选择/注册，不回退到不相关的组。命名空间 ID 与 ordinary Session guard 防止普通空白复用，不再通过脱离 Workspace 隔离。
+
+保留 0.5.6 的 snapshotEvents() + turn/start、直接用户请求、pending control.nextTool 与预览/确认授权边界，本版不修改 Host 工具实现。Better Sidebar 仍为可选增强，无侧栏保留原生会话/提示词/Host 工具，缺失提示不改变草稿或业务事实，不引入替代容器。
+
+不自动搬迁历史未分组会话、不替换原生容器、不引入 alpha 依赖。真实模型/MCP及四产品同装由协调任务另外验收。回滚需恢复完整已备份的宿主/Profile/任务组合；0.5.6 仍有归组缺陷，不能声称回退后该问题已解决。
+
+## 测试与证据
+
+复用最终 npm pack + 实际 DSH 0.1.2-rc.1 隔离 Profile，三路径 absent / Sidebar 0.18.1 / 已知坏 0.17.1。新测试以两个 Workspace 验证选中组而非首组，断言业务与普通 Session 均保持归组；入口不建 Tab、不展开侧栏，五流程单例，Tab X、Files、宿主收起恢复，合成业务及 Excel/PDF 下载仍通过。
+
+本地 check：43 文件、245 passed / 1 Windows-only skipped；UI 8/8。实际 DSH 无侧栏和 Sidebar 0.18.1 路径通过，旧 Sidebar 0.17.1 预检与实际启动按预期阻断。采用记录、实际结果与限制登记于 docs/WORKSPACE-OWNERSHIP-ADOPTION.md。此清单为发布前状态；发布工作流与 Registry 验证完成后以独立文档提交补充证据。

package/lib/client.js

@@ -4708,29 +4708,33 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 			return `${TENDER_ENTRY_SESSION_ID_PREFIX}${uuid}`;
 		}
 		/**
-		* Resolve the owning workspace's canonical directory path to seed a
-		* `cwd`-owned entry Session. A `cwd`-only create deliberately does NOT attach
-		* the Session to the workspace, so DSH's New-Session blank-session reuse skips it.
+		* Resolve Host-owned Workspace identity, not just a directory. Existing
+		* membership wins; a legacy ungrouped Session may match a registered path.
+		* Never register a new Workspace or create an ungrouped business Session here.
 		*/
-		function resolveTenderEntryWorkspacePath(sessions, workspaces) {
-			const current = sessions.list.getSnapshot().current;
+		function resolveTenderEntryWorkspaceId(sessions, workspaces) {
+			const sessionSnapshot = sessions.list.getSnapshot();
+			const current = sessionSnapshot.current;
 			const workspaceSnapshot = workspaces.list.getSnapshot();
-			return (current === void 0 ? void 0 : workspaceSnapshot.items.find((workspace) => workspace.sessionIds.includes(current)))?.path ?? (current === void 0 ? void 0 : sessions.list.getSnapshot().byId[current]?.cwd) ?? workspaceSnapshot.items[0]?.path;
+			const currentWorkspace = current === void 0 ? void 0 : workspaceSnapshot.items.find((workspace) => workspace.sessionIds.includes(current));
+			if (currentWorkspace !== void 0) return currentWorkspace.workspaceId;
+			const cwd = current === void 0 ? void 0 : sessionSnapshot.byId[current]?.cwd;
+			if (cwd !== void 0) return workspaceSnapshot.items.find((workspace) => workspace.path === cwd)?.workspaceId;
+			return workspaceSnapshot.items[0]?.workspaceId;
 		}
 		/**
-		* Create a distinct native Session with `cwd` ownership only (no workspace
-		* attachment). This keeps the Session out of the workspace's reusable blank-set,
-		* so DSH's 新会话 action mints a fresh default Session instead of reopening the
-		* workbench Session.
+		* Create a distinct native Session explicitly attached to its Workspace.
+		* Namespaced identity + ordinary-session-guard prevent New Session reuse;
+		* detaching the business Session from its Workspace is not an isolation method.
 		*/
 		async function createTenderEntrySession(sessions, workspaces, uuid = browserUuid) {
-			const cwd = resolveTenderEntryWorkspacePath(sessions, workspaces);
-			if (cwd === void 0) throw new TenderSessionEntryError("workspace-unavailable");
+			const workspaceId = resolveTenderEntryWorkspaceId(sessions, workspaces);
+			if (workspaceId === void 0) throw new TenderSessionEntryError("workspace-unavailable");
 			const capability = sessions;
 			if (typeof capability.create !== "function") throw new TenderSessionEntryError("create-unavailable");
 			const requestedId = createTenderEntrySessionId(uuid());
 			const createdId = await capability.create({
-				cwd,
+				workspaceId,
 				sessionId: requestedId
 			});
 			if (createdId !== requestedId) throw new TenderSessionEntryError("invalid-session-id");