tech-lead-skill 5.4.4 → 5.4.6

package/README.md

@@ -50,7 +50,13 @@ The installer is idempotent: repeated runs back up existing files as `*.bak-<tim
 
 ### DeepSeek Harness plugin (read-only tools)
 
-This source repository includes an opt-in DSH bundle exposing 21 read-only lifecycle tools. The original nine audit tools remain compatible, and the strengthened surface adds context validation, evidence graph/freshness analysis, progress decisions, critical-path and impact analysis, resume reconciliation, gate planning/aggregation/reopen checks, and mutation preview. The tools compute over caller-supplied JSON only — no filesystem writes, no subprocesses, no network access. The root npm package distributes the skill and installer only; clone this repository before installing the private workspace bundle.
+Ships on the DSH plugin market (npm). Install into any profile:
+
+```
+dsh plugin --profile headless add @240xu/dsh-tech-lead-bundle
+```
+
+The bundle pulls in `@240xu/dsh-tech-lead-plugin` and `@240xu/dsh-tech-lead-core` automatically — 21 read-only lifecycle tools total: the original nine audits plus context validation, evidence graph/freshness analysis, progress decisions, critical-path/impact analysis, resume reconciliation, gate planning/aggregation/reopen checks, and mutation preview. Tools compute over caller-supplied JSON only — no filesystem writes, no subprocesses, no network access. Source checkouts remain supported: `dsh plugin add /path/to/packages/dsh-tech-lead-bundle`. The root npm package distributes the skill and installer only.
 
 ```bash
 dsh plugin --profile headless add /path/to/tech-lead-skill/packages/dsh-tech-lead-bundle
@@ -61,7 +67,7 @@ dsh --profile headless --dump-config   # verify the tech-lead-tools row is prese
 Output families and limits:
 
 - The twelve strengthened tools return a `tech-lead.result.v1` envelope (discriminator: `meta.schema`); the original nine tools return their bare domain shapes for backward compatibility.
-- Rendered output is clamped: finding/error arrays are capped at 500 entries with a `FINDINGS_TRUNCATED` warning, oversized caller-echo arrays collapse into `{truncated,total}` summaries, and payloads above 256 KB switch to compact serialization.
+- Rendered output is clamped: finding/error arrays are capped at 500 entries with a `FINDINGS_TRUNCATED` warning; caller-echo arrays (evidence/targets/expectedDiff/verification/items) collapse into `{truncated,total}` beyond 100 entries; any OTHER array inside `data` (including computed results such as `criticalPath`) is head-sliced at 1000 entries while keeping its shape; subtrees deeper than 64 levels collapse into a `DEPTH_LIMIT` marker; payloads above 256 KB switch to compact serialization. Legacy bare top-level arrays slice silently at 500 (no warning field exists on that shape).
 
 See [`docs/superpowers/specs/2026-08-25-dsh-tech-lead-system.md`](https://github.com/240xu/tech-lead-skill/blob/main/docs/superpowers/specs/2026-08-25-dsh-tech-lead-system.md) for the architecture and permission matrix.
 
@@ -131,6 +137,6 @@ The executable skill body (`SKILL.md`) is authored in Simplified Chinese; coding
 
 ## Version
 
-Current version: `v5.4.4`.
+Current version: `v5.4.6`.
 
 See [`docs/TECHNICAL_GUIDE.md`](docs/TECHNICAL_GUIDE.md) for the full operating model and [`docs/AUDIT_REPORT.md`](docs/AUDIT_REPORT.md) for the publication audit.

package/README.zh-CN.md

@@ -50,7 +50,13 @@ npx github:240xu/tech-lead-skill
 
 ### DeepSeek Harness 插件（只读工具）
 
-本源码仓库提供可选 DSH bundle，暴露 21 个只读生命周期工具。原有九个审计工具保持兼容，并新增上下文校验、证据图与新鲜度分析、推进决策、关键路径与影响分析、续跑对账、Gate 计划/聚合/重开检查，以及变更预览。工具仅对调用方传入的 JSON 做计算——无文件写入、无子进程、无网络访问。根 npm 包只发布技能与安装器；DSH workspace bundle 尚未独立发布，安装前请先 clone 本仓库。
+已上架 DSH 插件市场（npm），任意 profile 一键安装：
+
+```
+dsh plugin --profile headless add @240xu/dsh-tech-lead-bundle
+```
+
+bundle 自动拉取 `@240xu/dsh-tech-lead-plugin` 与 `@240xu/dsh-tech-lead-core`，共 21 个只读生命周期工具：原九项审计＋上下文校验、证据图/新鲜度分析、推进决策、关键路径/影响分析、续跑对账、Gate 计划/聚合/重开、变更预览。仅对调用方传入的 JSON 做计算——无文件写入、无子进程、无网络访问。源码安装仍受支持：`dsh plugin add /path/to/packages/dsh-tech-lead-bundle`。根 npm 包只发布技能与安装器。
 
 ```bash
 dsh plugin --profile headless add /path/to/tech-lead-skill/packages/dsh-tech-lead-bundle
@@ -131,6 +137,6 @@ dsh --profile headless --dump-config   # 确认 tech-lead-tools 行已注入
 
 ## 版本
 
-当前版本：`v5.4.4`。
+当前版本：`v5.4.5`.
 
 完整运行模型见[技术指南](./docs/TECHNICAL_GUIDE.zh-CN.md)，发布审计见 [docs/AUDIT_REPORT.md](docs/AUDIT_REPORT.md)。

package/bin/install.js

@@ -87,7 +87,7 @@ function readMarker(target) {
 // A manifest entry may only address paths INSIDE target: blocks traversal via
 // tampered marker.files ("../x", absolute paths resolve under target anyway).
 function containedRel(target, rel) {
-  if (typeof rel !== 'string' || !rel || rel.includes('\\0')) return null;
+  if (typeof rel !== 'string' || !rel || rel.includes('\0')) return null;
   const abs = path.resolve(target, rel);
   const base = path.resolve(target);
   const relCheck = path.relative(base, abs);
@@ -196,21 +196,26 @@ if (args.includes('--check')) {
   }
   const missing = [];
   const drifted = [];
+  const orphaned = [];
   for (const raw of marker.files) {
     const rel = containedRel(target, raw);
     if (!rel) { console.warn('skipped unsafe manifest entry: ' + JSON.stringify(raw)); continue; }
     const abs = path.join(target, rel);
     const src = path.join(srcSkill, rel);
     if (!fs.existsSync(abs)) { missing.push(rel); continue; }
-    if (fs.existsSync(src) && sha256File(abs) !== sha256File(src)) drifted.push(rel);
+    if (!fs.existsSync(src)) { orphaned.push(rel); continue; }
+    if (sha256File(abs) !== sha256File(src)) drifted.push(rel);
   }
   if (missing.length) hasError = true;
   if (drifted.length) hasError = true;
+  if (orphaned.length) hasError = true;
 
   const managedSet = new Set(marker.files);
   const unmanaged = walkFiles(target).filter((rel) => !managedSet.has(rel) && !isBackup(rel) && rel !== markerName);
   if (missing.length) console.log('MISSING managed files:');
   for (const rel of missing) console.log('  missing: ' + rel);
+  if (orphaned.length) console.log('ORPHANED managed files absent from current package:');
+  for (const rel of orphaned) console.log('  orphan : ' + rel);
   if (drifted.length) console.log('MODIFIED since install:');
   for (const rel of drifted) console.log('  drift  : ' + rel);
   if (unmanaged.length) {

package/docs/AUDIT_REPORT.md

@@ -35,7 +35,7 @@ The source set was scanned for local absolute paths, passwords, API-key prefixes
 ### Structural scan
 
 - YAML frontmatter has `name: tech-lead` and a trigger description.
-- The skill version is `v5.4.4`.
+- The skill version is `v5.4.6`.
 - The eight templates referenced by the skill exist.
 - The installer validates options, requires a marker before removing any target, and records the managed package/version after installation.
 - The release-check template covers allowlist inventory, sensitive-content scanning, reference checks, scope checks, publication results, and remote verification.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tech-lead-skill",
-  "version": "5.4.4",
+  "version": "5.4.6",
   "description": "Evidence-driven planning and safe change-control skill for OpenCode-compatible agents",
   "license": "MIT",
   "repository": {

package/skill/SKILL.md

@@ -3,7 +3,7 @@ name: tech-lead
 description: 用于软件、基础设施、研究和运维中的多步、跨边界或有状态工程交付：项目规划、架构选择、跨模块实现、部署、迁移、发布、恢复、重构、长期运行与跨会话续跑。涉及不可逆/生产变更、回滚验证、真实环境对账、发布安全或项目级交付治理时优先加载，即使用户没有说“项目”或“Tech Lead”。不要仅因一次性小修复、单文件编辑、普通解释、单次测试或只读代码审查而自动加载，除非用户明确要求项目级计划或本规范。
 ---
 
-# Tech Lead · 自主演进规划与交付规范 v5.4.4
+# Tech Lead · 自主演进规划与交付规范 v5.4.6
 
 > 双层架构声明：本文件是**判断层**（自由裁量域）。其中可机械判定的不变量（Gate 前置校验、
 > 证据锚点存在性、分级判定器、状态机转换有效性）为未来 **MCP 工具化候选**——