iterate-plugin 3.3.0 → 3.3.1

package/README.md

@@ -286,6 +286,56 @@ All runtime state lives under `.iterate/` at the project root (can be excluded v
 
 ---
 
+## 🔐 Permissions, dependencies & compatibility
+
+### Node.js / DSH compatibility
+
+- **Node.js**: `>=20` (`package.json` `engines.node`).
+- **DSH**: declares `dsh.compatibility.dshReleases` — `compatible` for the official
+  `0.1.2-alpha.4`, `0.1.2-alpha.5`, and `0.1.2-rc.1` releases. The plugin is built
+  against `@deepseek-ai/dsh-tools` / `@deepseek-ai/dsh-util-values` `0.1.2-rc.1`
+  and uses only public contracts (tool registration, client slots + theme, bundle patch).
+
+### Runtime permissions (conservative disclosure)
+
+The plugin runs with the **same process capabilities as the DSH host** and touches the
+following capabilities; elevated capability means a DSH Profile install stays
+`user-reviewed`/guarded rather than auto-approved:
+
+- **Files** — reads and writes project-local state under `<projectRoot>/.iterate/`
+  (decision log, checkpoint, transcript, fix backups/registry, quality gate,
+  experience bank, defense events). `iterate_fix` / `iterate_triage` also apply
+  in-place edits to the user's source files (path-traversal protected to the
+  resolved project root, backups taken before every fix, rollback on failure).
+  The client half persists triage verdicts to `localStorage`.
+- **Commands** — the plugin registers model-facing tools; any shell execution that
+  the model performs (build / test / `git`) is run by the **host**, not by this
+  plugin. The client "command buttons" only copy paste-able instruction text; they
+  do not spawn processes.
+- **Credentials** — this plugin does **not** read or transmit credentials at
+  runtime. The sibling **iterate-skill / iterate-harness** components may read git
+  credentials / GitHub tokens when the user runs their own Git/API operations; those
+  are separate packages and are never loaded by this plugin.
+- **Network** — no network access at runtime (everything is local to the project).
+
+### Dependencies
+
+Runtime dependencies: `@deepseek-ai/cordis`, `@deepseek-ai/dsh-tools`,
+`@deepseek-ai/dsh-util-values`, `js-yaml` — all pinned exact versions. No
+install-time lifecycle scripts (`preinstall`/`install`/`postinstall`/`prepare`);
+only `prepublishOnly` (build) runs on publish.
+
+### Failure bounds
+
+- All writes are atomic (temp + rename) and confined under `.iterate/`; a crash
+  mid-write cannot corrupt the checkpoint/transcript.
+- Persistence failures surface as structured `{ ok: false, error }` results instead
+  of silent success.
+- Fix edits are applied to backups first and rolled back on validation failure.
+- The UI degrades gracefully when a slot/service is unavailable.
+
+---
+
 ## 🎨 Design
 
 The plugin follows dsh's "everything-is-a-plugin" architecture:

package/README.zh-CN.md

@@ -285,6 +285,49 @@ validation:
 
 ---
 
+## 🔐 权限、依赖与兼容性
+
+### Node.js / DSH 兼容范围
+
+- **Node.js**：`>=20`（`package.json` 的 `engines.node`）。
+- **DSH**：在 `dsh.compatibility.dshReleases` 中声明官方 `0.1.2-alpha.4`、
+  `0.1.2-alpha.5`、`0.1.2-rc.1` 三个版本为 `compatible`。插件基于
+  `@deepseek-ai/dsh-tools` / `@deepseek-ai/dsh-util-values` `0.1.2-rc.1` 构建，
+  只使用公开契约（工具注册、客户端 slots + theme、bundle patch）。
+
+### 运行时权限（保守披露）
+
+插件与 DSH 宿主共享同一进程能力，涉及以下能力；具备高权限意味着 DSH Profile
+安装仍需 `user-reviewed`/守卫，不会自动放行：
+
+- **文件（files）** — 读写 `<projectRoot>/.iterate/` 下的项目本地状态（决策日志、
+  检查点、transcript、修复备份/注册表、质量门禁、经验银行、防御事件）。
+  `iterate_fix` / `iterate_triage` 还会就地修改用户源码（路径遍历防护限定在解析后
+  的项目根目录内，每次修复前备份、失败回滚）。客户端侧把分诊判定持久化到 `localStorage`。
+- **命令（commands）** — 插件只注册模型可调用工具；模型要执行的任何 shell 操作
+  （build / test / `git`）都由**宿主**执行，不是本插件。客户端"指挥按钮"只复制可粘贴
+  的指令文本，不启动任何进程。
+- **凭据（credentials）** — 本插件运行时**不**读取或传输凭据。同生态的
+  **iterate-skill / iterate-harness** 组件在用户自行执行 Git/API 操作时可能读取
+  git 凭据 / GitHub token；它们是独立包，本插件从不加载它们。
+- **网络（network）** — 运行时无任何网络访问（全部本地）。
+
+### 依赖
+
+运行时依赖：`@deepseek-ai/cordis`、`@deepseek-ai/dsh-tools`、
+`@deepseek-ai/dsh-util-values`、`js-yaml`——全部精确锁版。无安装期生命周期脚本
+（`preinstall`/`install`/`postinstall`/`prepare`）；仅 `prepublishOnly`（构建）在发布时运行。
+
+### 失败边界
+
+- 所有写入都是原子的（临时文件 + rename），且限定在 `.iterate/` 下；写入中途崩溃
+  不会损坏 checkpoint / transcript。
+- 持久化失败以结构化 `{ ok: false, error }` 返回，而不是静默成功。
+- 修复编辑先备份再应用，验证失败自动回滚。
+- 某个 slot / 服务不可用时 UI 优雅降级。
+
+---
+
 ## 🎨 设计
 
 插件遵循 dsh "everything-is-a-plugin" 架构：

package/package.json

@@ -1,16 +1,17 @@
 {
   "name": "iterate-plugin",
-  "version": "3.3.0",
+  "version": "3.3.1",
   "description": "dsh plugin that turns the iterate skill into an autonomous closed-loop harness with quality command center and experience bank (v3.3). Features: plan -> parallel review xN -> atomic fixes -> validate -> loop -> auto-stop, plus dry-run pure-review mode, quality gate compute/persist, writable experience bank, defense events stream (record + bilingual labels), and native command buttons — with a live quality command center (F8/F9/F10 render real session data), §8 assign-fix instruction, and task_mode indicator wired end to end.",
   "type": "module",
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "https://github.com/jingzhao-l/iterate-plugin.git"
+    "url": "https://github.com/jingzhao-l/iterate-skill.git",
+    "directory": "harness/iterate-plugin"
   },
-  "homepage": "https://github.com/jingzhao-l/iterate-plugin#readme",
+  "homepage": "https://github.com/jingzhao-l/iterate-skill/tree/main/harness/iterate-plugin",
   "bugs": {
-    "url": "https://github.com/jingzhao-l/iterate-plugin/issues"
+    "url": "https://github.com/jingzhao-l/iterate-skill/issues"
   },
   "keywords": [
     "dsh-plugin",
@@ -26,6 +27,13 @@
     "bundle": {
       "patch": "./cordis.patch.yml"
     },
+    "compatibility": {
+      "dshReleases": {
+        "0.1.2-alpha.4": "compatible",
+        "0.1.2-alpha.5": "compatible",
+        "0.1.2-rc.1": "compatible"
+      }
+    },
     "client": {
       "platform": "web",
       "inject": [