signoff-cli 4.0.1 → 4.1.0

package/.pre-commit-hooks.yaml

@@ -1,5 +1,5 @@
 # pre-commit hooks: https://pre-commit.com
-#   - repo: https://github.com/ayuanxx-max/dsh-signoff  (package @signoff/cli)
+#   - repo: https://github.com/ayuanxx-max/signoff-cli  (package @signoff/cli)
 #     rev: v3.15.0
 #     hooks: [{id: signoff-guard}]
 - id: signoff-guard

package/CHANGELOG.md

@@ -1,3 +1,23 @@
+## 4.1.0
+
+**仓库改名为 `ayuanxx-max/signoff-cli`，与 npm 包名对齐。**
+
+- GitHub 仓库 `dsh-signoff` → `signoff-cli`；网页、`git clone`、pre-commit 的 `repo:`、`uses:` 由 GitHub 301 承接，
+  老地址仍可用（实测 `raw.githubusercontent` 老路径同样返回 200）。
+- MCP 注册表条目改为 `io.github.ayuanxx-max/signoff-cli`（注册表名与仓库名绑定）；旧条目
+  `io.github.ayuanxx-max/signoff` 保留为历史，不再更新。
+- `package.json#repository`、`server.json#repository.url`、README/文档里的绝对链接、`signoff.json` 的 schema URL
+  全部指向新仓库。
+- 包名、命令（`signoff`）、功能集不变。
+
+## 4.0.2
+
+**修 MCP 注册表发布：`server.json` 里 `packages[0].version` 一直停在 3.9.4。**
+
+- 现象：注册表返回 400 `version '3.9.4' was not found`，所以 4.x 一直注册不上，`isLatest` 卡在 3.15.3。
+- 修法：`server.json` 的两个版本字段都由 `package.json` 派生；自测新增三条断言，版本漂移在提交前就会被拦下。
+- 这一版没有改任何功能，只让注册表能被正确发布。
+
 ## 4.0.1
 
 **修 4.0.0 的 npx 入口：`npx signoff-cli` 找不到可执行文件。**

package/README.md

@@ -1,7 +1,7 @@
 # 落印 / SignOff
 
 > **包名 4.0.0 起为 `signoff-cli`**（曾用名 `dsh-signoff`，旧包已标记 deprecated）。
-> 命令仍是 `signoff`；仓库地址仍是 `ayuanxx-max/dsh-signoff`。DSH 只是它最早的使用场景，
+> 命令仍是 `signoff`；仓库地址仍是 `ayuanxx-max/signoff-cli`。DSH 只是它最早的使用场景，
 > 任意 git 仓库、任意语言都可以直接用。
 
 > 中文名「落印」：印落纸面才算数，对应英文名 SignOff。曾用名「一诺过五关」「执印」。命令 `signoff`、包名 `dsh-signoff` 不变。
@@ -27,14 +27,14 @@ signoff all               # p1 + p2 + p5 + p4 verify
 
 ## 一张图看懂
 
-![SignOff 完整能力与关系](https://raw.githubusercontent.com/ayuanxx-max/dsh-signoff/master/docs/diagrams/signoff-1-capability.png)
+![SignOff 完整能力与关系](https://raw.githubusercontent.com/ayuanxx-max/signoff-cli/master/docs/diagrams/signoff-1-capability.png)
 
 六个层次从左到右：**入口**（CLI / git 钩子 / CI / Agent 面）都走同一个 `guard.js`；**调度**决定跑哪几关、
 谁算通过；**五关**每关都写清“读什么、判什么、怎么修”；**状态机**说明一次提交里 marker 与 trailer 是怎么产生的；
 **产物**是判断留下的证据；最右是**外部依赖**——只有 Node ≥18 与 git 是硬要求，其余都可缺。
 判定没有“部分通过”：退出码 0 通过、1 任一关判红、2 用法或环境错。
 
-![用户路径：安装、使用、排错](https://raw.githubusercontent.com/ayuanxx-max/dsh-signoff/master/docs/diagrams/signoff-3-user.png)
+![用户路径：安装、使用、排错](https://raw.githubusercontent.com/ayuanxx-max/signoff-cli/master/docs/diagrams/signoff-3-user.png)
 
 上半部分按 0→5 的先后排：前置检查 → 安装 → 初始化 → 日常提交 → 红了怎么办 → 升级与卸载。
 红框是必做，黄框是最容易踩的坑（`--chain`、`--lock-test`、npm proxy）。
@@ -188,13 +188,13 @@ guard 通过后**自动续签**检查点（同一份账本不重复签，不产
 结论放在表后面而不是前面：**前七行是它和其他工具的分野，最后两行是它的短板**——托管面没有，
 生态采用量也还没起来（1 star、周下载三位数），所以六维里"生态"给 3 分，不是 5 分。
 
-![落印 3.15.2 执行流程与四层证据](https://raw.githubusercontent.com/ayuanxx-max/dsh-signoff/master/docs/diagrams/signoff-4-flow.png)
+![落印 3.15.2 执行流程与四层证据](https://raw.githubusercontent.com/ayuanxx-max/signoff-cli/master/docs/diagrams/signoff-4-flow.png)
 
 上图是一次提交的完整路径：入口（git commit / 命令 / CI）→ 三层零接触 → guard 固定顺序跑
 secrets → p5 → p1 → p2 → p4 → cov（opt-in）→ 判决 → 四层证据（marker → trailer → 账本 →
 检查点 → 锚点）。红一关即停，退出码就是判决。
 
-![落印 3.15.2 与匿名竞品：覆盖广度 vs 生态采用度](https://raw.githubusercontent.com/ayuanxx-max/dsh-signoff/master/docs/diagrams/signoff-5-competitors.png)
+![落印 3.15.2 与匿名竞品：覆盖广度 vs 生态采用度](https://raw.githubusercontent.com/ayuanxx-max/signoff-cli/master/docs/diagrams/signoff-5-competitors.png)
 
 上图横轴是生态采用度，纵轴是覆盖广度。落印落在左上角——**功能全、采用低**，这是它的真实位置：
 它不在右上角跟平台级产品比采用，差异在"判决可以带走、可以事后核对"。
@@ -297,12 +297,12 @@ signoff p5 docs README.md
 ### Package name (since 4.0.0)
 
 The package is `signoff-cli`; the former name `dsh-signoff` is deprecated. The command
-stays `signoff`, the repository stays `ayuanxx-max/dsh-signoff`, and nothing about the tool
+stays `signoff`, the repository stays `ayuanxx-max/signoff-cli`, and nothing about the tool
 is DSH-specific — any git repo and any language work.
 
 ### At a glance (English)
 
-![SignOff capabilities and relations](https://raw.githubusercontent.com/ayuanxx-max/dsh-signoff/master/docs/diagrams/signoff-1-capability-en.png)
+![SignOff capabilities and relations](https://raw.githubusercontent.com/ayuanxx-max/signoff-cli/master/docs/diagrams/signoff-1-capability-en.png)
 
 Six layers, left to right: **entry** (CLI / git hooks / CI / agents) all go through one `guard.js`; **dispatcher**
 decides which gates run and what counts as pass; **the five gates** each state read → decide → fix; **the state
@@ -310,7 +310,7 @@ machine** shows how the marker and the trailer appear inside a single commit; **
 verdict leaves behind; **external dependencies** — only Node ≥18 and git are hard requirements.
 There is no partial pass: exit 0 pass, 1 any gate red, 2 usage or environment error.
 
-![User path: install, use, troubleshoot](https://raw.githubusercontent.com/ayuanxx-max/dsh-signoff/master/docs/diagrams/signoff-3-user-en.png)
+![User path: install, use, troubleshoot](https://raw.githubusercontent.com/ayuanxx-max/signoff-cli/master/docs/diagrams/signoff-3-user-en.png)
 
 Stages 0 → 5 in order: precheck → install → init → daily commits → when it goes red → upgrade and uninstall.
 Red boxes are must-do; amber boxes are the places people trip on (`--chain` when the repo already has husky
@@ -390,13 +390,13 @@ not an advert; the mapping plus star/download figures live in
 Read the last two rows as the honest part: **no hosted surface, and adoption is still small**
 (1 star, three-digit weekly downloads) — which is why "ecosystem" scores 3, not 5.
 
-![SignOff 3.15.2 flow and four layers of evidence](https://raw.githubusercontent.com/ayuanxx-max/dsh-signoff/master/docs/diagrams/signoff-4-flow-en.png)
+![SignOff 3.15.2 flow and four layers of evidence](https://raw.githubusercontent.com/ayuanxx-max/signoff-cli/master/docs/diagrams/signoff-4-flow-en.png)
 
 One commit end to end: entries (git commit / CLI / CI) → three zero-touch layers → guard runs
 secrets → p5 → p1 → p2 → p4 → cov (opt-in) → verdict → four layers of evidence (marker → trailer →
 ledger → checkpoint → anchor). First red stops; the exit code is the verdict.
 
-![SignOff 3.15.2 vs anonymised peers](https://raw.githubusercontent.com/ayuanxx-max/dsh-signoff/master/docs/diagrams/signoff-5-competitors-en.png)
+![SignOff 3.15.2 vs anonymised peers](https://raw.githubusercontent.com/ayuanxx-max/signoff-cli/master/docs/diagrams/signoff-5-competitors-en.png)
 
 Adoption on the x-axis, coverage breadth on the y. SignOff sits top-left: **full-stack, low adoption**.
 It does not compete on adoption with platform products; the difference is that a verdict can leave

package/docs/integrations.md

@@ -13,7 +13,7 @@ npm i -g signoff-cli && cd your-repo && signoff init
 ## 2. GitHub Actions
 
 ```yaml
-- uses: ayuanxx-max/dsh-signoff@v3.15.0
+- uses: ayuanxx-max/signoff-cli@v3.15.0
   with:
     args: all
 ```
@@ -24,7 +24,7 @@ npm i -g signoff-cli && cd your-repo && signoff init
 
 ```yaml
 repos:
-  - repo: https://github.com/ayuanxx-max/dsh-signoff
+  - repo: https://github.com/ayuanxx-max/signoff-cli
     rev: v3.15.0
     hooks:
       - id: signoff-guard

package/docs/promotion.md

@@ -55,7 +55,7 @@ GitHub 的搜索会索引 description、topics、README 正文；topics 为空
 ```bash
 # 近 14 天浏览量/克隆量（需要 push 权限的 token）
 curl -s -H "Authorization: token $TOKEN" \
-  https://api.github.com/repos/ayuanxx-max/dsh-signoff/traffic/views
+  https://api.github.com/repos/ayuanxx-max/signoff-cli/traffic/views
 # 每周 npm 下载
 curl -s https://api.npmjs.org/downloads/point/last-week/dsh-signoff
 ```

package/lib/guard.js

@@ -608,7 +608,7 @@ function cmdInit(args) {
   if (args.share) {
     // Only the portable fields: a pinned test command would break on a clone without that
     // runner, which is the opposite of "clone and it works".
-    const decl = { $schema: "https://raw.githubusercontent.com/ayuanxx-max/dsh-signoff/master/docs/signoff.schema.json" };
+    const decl = { $schema: "https://raw.githubusercontent.com/ayuanxx-max/signoff-cli/master/docs/signoff.schema.json" };
     decl.gates = ["p1", "p2", "p3", "p4", "p5"];
     if (args.lockTest && cfg.test_cmd) decl.test_cmd = cfg.test_cmd;
     fs.writeFileSync(path.join(root, "signoff.json"), JSON.stringify(decl, null, 2) + "\n", "utf8");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "signoff-cli",
-  "version": "4.0.1",
+  "version": "4.1.0",
   "description": "SignOff (落印) — five gates that make an agent's \"done\" provable: verify, coverage, queue, ledger, anti-slop.",
   "publishConfig": {
     "access": "public"
@@ -50,7 +50,7 @@
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/ayuanxx-max/dsh-signoff.git"
+    "url": "https://github.com/ayuanxx-max/signoff-cli"
   },
   "mcpName": "io.github.ayuanxx-max/signoff"
 }

package/test/selftest.js

@@ -1157,9 +1157,14 @@ check("legacy mark still recognised", bootlib.markedByUs("# generated by dsh-sig
 check("new mark recognised", bootlib.markedByUs(bootlib.HOOK_MARK + " 4.0.0"), true);
 check("foreign hook is not ours", bootlib.markedByUs("#!/bin/sh\nnpx lint-staged"), false);
 check("ci template pins the package", /--package=signoff-cli/.test(require(path.join(__dirname, "..", "lib", "guard.js")).CI_BODY), true);
+const pkgj = require(path.join(__dirname, "..", "package.json"));
+const srvj = require(path.join(__dirname, "..", "server.json"));
+check("server.json tracks the package version", srvj.version === pkgj.version, true);
+check("server.json package version tracks too", srvj.packages[0].version === pkgj.version, true);
+check("server.json names the package", srvj.packages[0].identifier === pkgj.name, true);
 
       check("action runs signoff", /run: signoff \$\{\{ inputs.args \}\}/.test(action), true);
-      check("integrations doc lists actions", /uses: ayuanxx-max\/dsh-signoff/.test(fs.readFileSync(path.join(__dirname, "..", "docs", "integrations.md"), "utf8")), true);
+      check("integrations doc lists actions", /uses: ayuanxx-max\/signoff-cli/.test(fs.readFileSync(path.join(__dirname, "..", "docs", "integrations.md"), "utf8")), true);
 
       // 16. Deterministic fuzz: parsers must never throw on hostile input, and the
       // hashing primitives must be stable and order-sensitive.