upstream-radar 0.27.0 → 0.28.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +10 -10
- package/dist/src/dsh-plugin.d.ts +16 -1
- package/dist/src/dsh-plugin.d.ts.map +1 -1
- package/dist/src/dsh-plugin.js +52 -6
- package/dist/src/dsh-plugin.js.map +1 -1
- package/dist/src/version.d.ts +1 -1
- package/dist/src/version.js +1 -1
- package/docs/README.zh-CN.md +10 -10
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -157,7 +157,7 @@ The generated graph is the actual installed profile graph. DSH also maintains a
|
|
|
157
157
|
|
|
158
158
|
For a hand-written or CI fixture, use [the example inventory](examples/radar/config.json). If neither a generated `--patch` overlay nor `UPSTREAM_RADAR_CONFIG` is provided, the bundle stays dormant and performs no polling.
|
|
159
159
|
|
|
160
|
-
Once running, Radar polls OSV, npm, and public GitHub Releases, persists incident state before delivery, and submits only changed incidents to the
|
|
160
|
+
Once running, Radar polls OSV, npm, and public GitHub Releases, persists incident state before delivery, and submits only changed incidents to the matching DSH project session. With one root Agent, delivery remains automatic; with multiple roots, Radar requires an exact match between `project.workspace` and `Agent.session.header.cwd`, and keeps the task queued when it cannot prove the route. If a source is temporarily unavailable, Radar keeps the last confirmed state instead of claiming that the project is clean, continues delivering already queued tasks, and creates one source-health notice after three consecutive failures.
|
|
161
161
|
|
|
162
162
|
Each release cycle also checks a bounded prefix of candidate dependency graphs. This is enabled by default in the DSH adapter and CLI; use `--no-deep-candidates` only when you deliberately want manifest-only compatibility checks. The graph resolver is isolated in a temporary directory and uses `package-lock-only` plus `ignore-scripts`, so candidate package code is not loaded or executed.
|
|
163
163
|
|
|
@@ -193,7 +193,7 @@ This proof runs in CI on Node.js 22. See the executable [showcase contract](exam
|
|
|
193
193
|
Before wiring a project into a compatibility gate, run the offline rule benchmark:
|
|
194
194
|
|
|
195
195
|
```bash
|
|
196
|
-
pnpm dlx --package=upstream-radar@0.
|
|
196
|
+
pnpm dlx --package=upstream-radar@0.28.0 upstream-radar benchmark compatibility
|
|
197
197
|
```
|
|
198
198
|
|
|
199
199
|
It covers six contracts: a safe patch, a change that only needs project analysis, an incompatible DSH peer, a publisher-declared breaking release, a vulnerable candidate dependency, and an incomplete candidate graph. The command does not access the network, install a package, load a plugin, or start DSH. It checks the behavior of Radar's deterministic rules and the `breaking`/`any` gates; it is not a runtime compatibility proof.
|
|
@@ -206,7 +206,7 @@ When you have an exact plugin artifact and want to know whether one exact DSH re
|
|
|
206
206
|
# Pack an exact npm release without running its lifecycle scripts.
|
|
207
207
|
npm pack --ignore-scripts dsh-plugin@1.2.3
|
|
208
208
|
|
|
209
|
-
pnpm dlx --package=upstream-radar@0.
|
|
209
|
+
pnpm dlx --package=upstream-radar@0.28.0 upstream-radar probe dsh-load \
|
|
210
210
|
./dsh-plugin-1.2.3.tgz \
|
|
211
211
|
--dsh-version 0.1.0-rc.6
|
|
212
212
|
```
|
|
@@ -232,7 +232,7 @@ It exercises a loadable bundle, a bundle patch DSH rejects, and a package that r
|
|
|
232
232
|
To compare a plugin against more than one DSH release, use the matrix form:
|
|
233
233
|
|
|
234
234
|
```bash
|
|
235
|
-
pnpm dlx --package=upstream-radar@0.
|
|
235
|
+
pnpm dlx --package=upstream-radar@0.28.0 upstream-radar probe dsh-matrix \
|
|
236
236
|
./dsh-plugin-1.2.3.tgz \
|
|
237
237
|
--dsh-version 0.1.0-rc.3 \
|
|
238
238
|
--dsh-version 0.1.0-rc.6 \
|
|
@@ -248,7 +248,7 @@ If your team wants a scheduled CI gate before wiring a machine to a live DSH pro
|
|
|
248
248
|
```yaml
|
|
249
249
|
steps:
|
|
250
250
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
251
|
-
- uses: MicroMilo/upstream-radar@v0.
|
|
251
|
+
- uses: MicroMilo/upstream-radar@v0.28.0
|
|
252
252
|
with:
|
|
253
253
|
config: upstream-radar.config.json
|
|
254
254
|
fail-on: high
|
|
@@ -256,12 +256,12 @@ steps:
|
|
|
256
256
|
fail-on-compatibility: breaking
|
|
257
257
|
```
|
|
258
258
|
|
|
259
|
-
The Action is a thin wrapper around `radar check --frozen --state :memory: --fail-on high --json`; when the optional compatibility input is enabled, it also passes `--fail-on-compatibility breaking` or `any`. `--frozen` is deliberate: it uses the graph in the reviewed config and does not try to read a developer's local DSH profile. Each run is independent, exits `2` when an active vulnerability or opted-in compatibility change meets its threshold, and exits `1` for an operational or source error. `breaking` catches confirmed or strong incompatibility signals; `any` catches every active compatibility event. The default is `never`, so vulnerability-only behavior stays unchanged. The Action does not deliver a DSH Agent task or modify a branch; the native DSH bundle remains the always-on analysis path. Pin the Action to a release tag such as `v0.
|
|
259
|
+
The Action is a thin wrapper around `radar check --frozen --state :memory: --fail-on high --json`; when the optional compatibility input is enabled, it also passes `--fail-on-compatibility breaking` or `any`. `--frozen` is deliberate: it uses the graph in the reviewed config and does not try to read a developer's local DSH profile. Each run is independent, exits `2` when an active vulnerability or opted-in compatibility change meets its threshold, and exits `1` for an operational or source error. `breaking` catches confirmed or strong incompatibility signals; `any` catches every active compatibility event. The default is `never`, so vulnerability-only behavior stays unchanged. The Action does not deliver a DSH Agent task or modify a branch; the native DSH bundle remains the always-on analysis path. Pin the Action to a release tag such as `v0.28.0`, and pin the checkout Action in your workflow according to your repository's policy.
|
|
260
260
|
|
|
261
261
|
The Action requires the caller to check out the repository first. It does not install the project's dependencies or run their lifecycle scripts; it only reads the committed graph and queries the configured upstream sources. For a fully explicit, lower-level invocation, the equivalent command is:
|
|
262
262
|
|
|
263
263
|
```bash
|
|
264
|
-
pnpm dlx --package=upstream-radar@0.
|
|
264
|
+
pnpm dlx --package=upstream-radar@0.28.0 upstream-radar radar check \
|
|
265
265
|
./upstream-radar.config.json --frozen --state :memory: --fail-on high \
|
|
266
266
|
--fail-on-compatibility breaking --json
|
|
267
267
|
```
|
|
@@ -269,7 +269,7 @@ pnpm dlx --package=upstream-radar@0.27.0 upstream-radar radar check \
|
|
|
269
269
|
To add the optional DSH load matrix for a published plugin, provide an exact npm package and at least two exact DSH versions:
|
|
270
270
|
|
|
271
271
|
```yaml
|
|
272
|
-
- uses: MicroMilo/upstream-radar@v0.
|
|
272
|
+
- uses: MicroMilo/upstream-radar@v0.28.0
|
|
273
273
|
id: radar
|
|
274
274
|
with:
|
|
275
275
|
config: upstream-radar.config.json
|
|
@@ -297,7 +297,7 @@ For a local or self-hosted DSH machine, omit `--frozen` so Radar refreshes the s
|
|
|
297
297
|
3. Watch npm releases for the installed plugin and DSH/Cordis packages.
|
|
298
298
|
4. Create or update one durable incident with the exact dependency path.
|
|
299
299
|
5. Persist a constrained analysis task before delivery.
|
|
300
|
-
6.
|
|
300
|
+
6. Route a plugin-originated follow-up to the DSH root whose session workspace matches the project.
|
|
301
301
|
7. Keep the task on disk when no Agent is available; cancel it when the incident resolves.
|
|
302
302
|
|
|
303
303
|
For a local process or a scheduled runner, the same loop is available as:
|
|
@@ -417,7 +417,7 @@ pnpm dlx --package=upstream-radar@latest upstream-radar inspect npm:dsh-cloudfla
|
|
|
417
417
|
- OSV, npm `latest`, and public GitHub Release notes are live sources; changelog, comparison-diff, and migration-guide ingestion are deferred.
|
|
418
418
|
- A failed OSV check preserves confirmed matches and returns a visible source warning; source health is durable and routed through DSH after three consecutive failures, while source-claim conflict handling and external health destinations are not implemented yet.
|
|
419
419
|
- `radar watch` is a CLI monitoring fallback; it does not deliver tasks into DSH by itself.
|
|
420
|
-
- Delivery
|
|
420
|
+
- Delivery uses one root Agent as the simple default; when several roots exist, it requires an exact project-workspace match and leaves ambiguous tasks queued instead of guessing.
|
|
421
421
|
- Agent conclusions stay in the DSH Session; Radar does not ingest them back into incident state yet.
|
|
422
422
|
- No Issue, branch, Pull Request, dependency override, or merge is created automatically.
|
|
423
423
|
|
package/dist/src/dsh-plugin.d.ts
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import type { AnalysisTask, RadarState } from './radar-types.js';
|
|
1
|
+
import type { AnalysisTask, ProjectReference, RadarState } from './radar-types.js';
|
|
2
2
|
export declare const name = "upstream-radar";
|
|
3
3
|
export declare const inject: string[];
|
|
4
4
|
export interface Config {
|
|
@@ -31,6 +31,11 @@ export interface DshRadarMessage {
|
|
|
31
31
|
}
|
|
32
32
|
interface DshAgentLike {
|
|
33
33
|
followup(message: DshRadarMessage): void;
|
|
34
|
+
session?: {
|
|
35
|
+
header?: {
|
|
36
|
+
cwd?: string | null;
|
|
37
|
+
};
|
|
38
|
+
};
|
|
34
39
|
}
|
|
35
40
|
interface DshRadarContext {
|
|
36
41
|
agents: {
|
|
@@ -47,6 +52,16 @@ interface DshRadarContext {
|
|
|
47
52
|
export declare function groupPendingAnalysisTasks(tasks: readonly AnalysisTask[]): AnalysisTask[][];
|
|
48
53
|
export declare function createDshRadarMessage(task: AnalysisTask): DshRadarMessage;
|
|
49
54
|
export declare function createDshRadarFamilyMessage(tasks: readonly AnalysisTask[]): DshRadarMessage;
|
|
55
|
+
/**
|
|
56
|
+
* Match one project to a DSH root by the session's working directory.
|
|
57
|
+
*
|
|
58
|
+
* A single root remains the backwards-compatible default. With multiple roots,
|
|
59
|
+
* an exact workspace match is required; guessing would deliver a security
|
|
60
|
+
* notice to the wrong project session.
|
|
61
|
+
*/
|
|
62
|
+
export declare function selectDshAgentForProject(project: ProjectReference, agents: readonly DshAgentLike[]): DshAgentLike | undefined;
|
|
63
|
+
/** Deliver grouped tasks to the matching DSH root; unroutable tasks stay queued. */
|
|
64
|
+
export declare function deliverPendingAnalysisTasksToAgents(state: RadarState, agents: readonly DshAgentLike[]): RadarState;
|
|
50
65
|
/** Synchronous follow-up admission is the acknowledgement boundary; failures stay queued. */
|
|
51
66
|
export declare function deliverPendingAnalysisTasks(state: RadarState, agent: DshAgentLike): RadarState;
|
|
52
67
|
/** Cordis function-plugin entrypoint. The polling loop stays deterministic; DSH receives only matched tasks. */
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"dsh-plugin.d.ts","sourceRoot":"","sources":["../../src/dsh-plugin.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;
|
|
1
|
+
{"version":3,"file":"dsh-plugin.d.ts","sourceRoot":"","sources":["../../src/dsh-plugin.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAElF,eAAO,MAAM,IAAI,mBAAmB,CAAA;AACpC,eAAO,MAAM,MAAM,UAAa,CAAA;AAEhC,MAAM,WAAW,MAAM;IACrB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,kFAAkF;IAClF,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,oEAAoE;IACpE,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,mEAAmE;IACnE,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,UAAU,CAAC,EAAE,OAAO,CAAA;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC9C,MAAM,EAAE;QACN,IAAI,EAAE,QAAQ,CAAA;QACd,MAAM,EAAE,gBAAgB,CAAA;QACxB,IAAI,EAAE,QAAQ,CAAA;QACd,OAAO,EAAE,MAAM,CAAA;KAChB,CAAA;CACF;AAED,UAAU,YAAY;IACpB,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI,CAAA;IACxC,OAAO,CAAC,EAAE;QACR,MAAM,CAAC,EAAE;YACP,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;SACpB,CAAA;KACF,CAAA;CACF;AAED,UAAU,eAAe;IACvB,MAAM,EAAE;QACN,KAAK,IAAI,YAAY,EAAE,CAAA;KACxB,CAAA;IACD,MAAM,EAAE;QACN,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;QAC3B,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAC5B,CAAA;IACD,MAAM,CAAC,KAAK,EAAE,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9E,EAAE,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAA;CAC7D;AAwBD,6GAA6G;AAC7G,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,SAAS,YAAY,EAAE,GAAG,YAAY,EAAE,EAAE,CAoB1F;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,YAAY,GAAG,eAAe,CAYzE;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,SAAS,YAAY,EAAE,GAAG,eAAe,CAc3F;AAOD;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,gBAAgB,EACzB,MAAM,EAAE,SAAS,YAAY,EAAE,GAC9B,YAAY,GAAG,SAAS,CAS1B;AAED,oFAAoF;AACpF,wBAAgB,mCAAmC,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,YAAY,EAAE,GAAG,UAAU,CAqBlH;AAED,6FAA6F;AAC7F,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,YAAY,GAAG,UAAU,CAE9F;AAaD,gHAAgH;AAChH,wBAAgB,KAAK,CAAC,GAAG,EAAE,eAAe,EAAE,MAAM,GAAE,MAAW,GAAG,IAAI,CAyErE"}
|
package/dist/src/dsh-plugin.js
CHANGED
|
@@ -83,17 +83,49 @@ export function createDshRadarFamilyMessage(tasks) {
|
|
|
83
83
|
},
|
|
84
84
|
});
|
|
85
85
|
}
|
|
86
|
-
|
|
87
|
-
|
|
86
|
+
function normalizedWorkspace(workspace) {
|
|
87
|
+
if (workspace === undefined || workspace.trim() === '')
|
|
88
|
+
return undefined;
|
|
89
|
+
return resolve(workspace);
|
|
90
|
+
}
|
|
91
|
+
/**
|
|
92
|
+
* Match one project to a DSH root by the session's working directory.
|
|
93
|
+
*
|
|
94
|
+
* A single root remains the backwards-compatible default. With multiple roots,
|
|
95
|
+
* an exact workspace match is required; guessing would deliver a security
|
|
96
|
+
* notice to the wrong project session.
|
|
97
|
+
*/
|
|
98
|
+
export function selectDshAgentForProject(project, agents) {
|
|
99
|
+
if (agents.length === 1)
|
|
100
|
+
return agents[0];
|
|
101
|
+
const workspace = normalizedWorkspace(project.workspace);
|
|
102
|
+
if (workspace === undefined)
|
|
103
|
+
return undefined;
|
|
104
|
+
const matches = agents.filter((agent) => {
|
|
105
|
+
const cwd = agent.session?.header?.cwd;
|
|
106
|
+
return typeof cwd === 'string' && normalizedWorkspace(cwd) === workspace;
|
|
107
|
+
});
|
|
108
|
+
return matches.length === 1 ? matches[0] : undefined;
|
|
109
|
+
}
|
|
110
|
+
/** Deliver grouped tasks to the matching DSH root; unroutable tasks stay queued. */
|
|
111
|
+
export function deliverPendingAnalysisTasksToAgents(state, agents) {
|
|
88
112
|
const deliveredIds = new Set();
|
|
89
113
|
for (const group of groupPendingAnalysisTasks(state.pendingAnalysisTasks)) {
|
|
114
|
+
const first = group[0];
|
|
115
|
+
if (first === undefined)
|
|
116
|
+
continue;
|
|
117
|
+
const agent = selectDshAgentForProject(first.event.project, agents);
|
|
118
|
+
if (agent === undefined)
|
|
119
|
+
continue;
|
|
90
120
|
try {
|
|
91
121
|
agent.followup(group.length === 1 ? createDshRadarMessage(group[0]) : createDshRadarFamilyMessage(group));
|
|
92
122
|
for (const task of group)
|
|
93
123
|
deliveredIds.add(task.id);
|
|
94
124
|
}
|
|
95
125
|
catch {
|
|
96
|
-
|
|
126
|
+
// Admission failed for this project only; unrelated project tasks may
|
|
127
|
+
// still be delivered, while this group remains durable for retry.
|
|
128
|
+
continue;
|
|
97
129
|
}
|
|
98
130
|
}
|
|
99
131
|
if (deliveredIds.size === 0)
|
|
@@ -103,6 +135,10 @@ export function deliverPendingAnalysisTasks(state, agent) {
|
|
|
103
135
|
pendingAnalysisTasks: state.pendingAnalysisTasks.filter(task => !deliveredIds.has(task.id)),
|
|
104
136
|
};
|
|
105
137
|
}
|
|
138
|
+
/** Synchronous follow-up admission is the acknowledgement boundary; failures stay queued. */
|
|
139
|
+
export function deliverPendingAnalysisTasks(state, agent) {
|
|
140
|
+
return deliverPendingAnalysisTasksToAgents(state, [agent]);
|
|
141
|
+
}
|
|
106
142
|
async function readConfig(path) {
|
|
107
143
|
const contents = await readFile(path, 'utf8');
|
|
108
144
|
if (Buffer.byteLength(contents) > 256 * 1024 * 1024)
|
|
@@ -161,12 +197,22 @@ export function apply(ctx, config = {}) {
|
|
|
161
197
|
ctx.logger.warn(`upstream-radar: ${error.source}: ${safeMessage(error.message)}`);
|
|
162
198
|
}
|
|
163
199
|
}
|
|
164
|
-
const
|
|
165
|
-
if (
|
|
200
|
+
const agents = ctx.agents.roots();
|
|
201
|
+
if (agents.length === 0 || state.pendingAnalysisTasks.length === 0)
|
|
166
202
|
return;
|
|
167
|
-
const next =
|
|
203
|
+
const next = deliverPendingAnalysisTasksToAgents(state, agents);
|
|
168
204
|
if (next !== state)
|
|
169
205
|
await saveRadarState(stateFile, next);
|
|
206
|
+
const unrouted = groupPendingAnalysisTasks(next.pendingAnalysisTasks).find((group) => {
|
|
207
|
+
const first = group[0];
|
|
208
|
+
return first !== undefined && selectDshAgentForProject(first.event.project, agents) === undefined;
|
|
209
|
+
});
|
|
210
|
+
if (unrouted !== undefined) {
|
|
211
|
+
const first = unrouted[0];
|
|
212
|
+
if (first !== undefined) {
|
|
213
|
+
ctx.logger.warn(`upstream-radar: kept ${unrouted.length} analysis task(s) queued; no DSH root matches project ${first.event.project.name} workspace ${first.event.project.workspace ?? '(not configured)'}`);
|
|
214
|
+
}
|
|
215
|
+
}
|
|
170
216
|
}).catch((error) => {
|
|
171
217
|
ctx.logger.warn(`upstream-radar: cycle failed: ${safeMessage(error)}`);
|
|
172
218
|
});
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"dsh-plugin.js","sourceRoot":"","sources":["../../src/dsh-plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,8BAA8B,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAA;AAC7F,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AACjD,OAAO,EAAE,gCAAgC,EAAE,MAAM,WAAW,CAAA;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AACpC,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAA;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AACtC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAGjE,MAAM,CAAC,MAAM,IAAI,GAAG,gBAAgB,CAAA;AACpC,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,QAAQ,CAAC,CAAA;
|
|
1
|
+
{"version":3,"file":"dsh-plugin.js","sourceRoot":"","sources":["../../src/dsh-plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,8BAA8B,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAA;AAC7F,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AACjD,OAAO,EAAE,gCAAgC,EAAE,MAAM,WAAW,CAAA;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AACpC,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAA;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AACtC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAGjE,MAAM,CAAC,MAAM,IAAI,GAAG,gBAAgB,CAAA;AACpC,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,QAAQ,CAAC,CAAA;AAkDhC,SAAS,WAAW,CAAC,KAAc;IACjC,MAAM,KAAK,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACpE,OAAO,KAAK,CAAC,OAAO,CAAC,+BAA+B,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;AAC5E,CAAC;AAED,SAAS,WAAW,CAAC,IAAkB;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IACpD,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;QACxC,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAA;QAC7C,IAAI,WAAW,KAAK,qBAAqB,IAAI,WAAW,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;YACzF,OAAO,wCAAwC,OAAO,EAAE,CAAA;QAC1D,CAAC;QACD,OAAO,4BAA4B,OAAO,EAAE,CAAA;IAC9C,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,eAAe;QAAE,OAAO,kCAAkC,OAAO,EAAE,CAAA;IAC3F,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,eAAe,QAAQ,OAAO,EAAE,CAAA;AAClG,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY;IACvC,OAAO,IAAI,KAAK,qBAAqB,IAAI,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAA;AAC/E,CAAC;AAED,6GAA6G;AAC7G,MAAM,UAAU,yBAAyB,CAAC,KAA8B;IACtE,MAAM,MAAM,GAAqB,EAAE,CAAA;IACnC,MAAM,SAAS,GAAG,IAAI,GAAG,EAA0B,CAAA;IACnD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAA;QACxB,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YACjF,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;YACnB,SAAQ;QACV,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,kBAAkB,KAAK,CAAC,UAAU,EAAE,CAAA;QACnE,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACnC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACnB,SAAQ;QACV,CAAC;QACD,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,CAAA;QACpB,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QACzB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACpB,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,IAAkB;IACtD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,EAAE,EAAE,UAAU,EAAE;QAChB,IAAI,EAAE,MAAe;QACrB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,yBAAyB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3E,MAAM,EAAE;YACN,IAAI,EAAE,QAAiB;YACvB,MAAM,EAAE,gBAAyB;YACjC,IAAI,EAAE,QAAiB;YACvB,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC;SAC3B;KACF,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,KAA8B;IACxE,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;IACtB,IAAI,KAAK,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;IAC5F,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,EAAE,EAAE,UAAU,EAAE;QAChB,IAAI,EAAE,MAAe;QACrB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,8BAA8B,CAAC,KAAK,CAAC,EAAE,CAAC;QACjF,MAAM,EAAE;YACN,IAAI,EAAE,QAAiB;YACvB,MAAM,EAAE,gBAAyB;YACjC,IAAI,EAAE,QAAiB;YACvB,OAAO,EAAE,sCAAsC,KAAK,CAAC,MAAM,SAAS,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;SAC5G;KACF,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,SAA6B;IACxD,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,SAAS,CAAA;IACxE,OAAO,OAAO,CAAC,SAAS,CAAC,CAAA;AAC3B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAAyB,EACzB,MAA+B;IAE/B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAA;IACzC,MAAM,SAAS,GAAG,mBAAmB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IACxD,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAC7C,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QACtC,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAA;QACtC,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,mBAAmB,CAAC,GAAG,CAAC,KAAK,SAAS,CAAA;IAC1E,CAAC,CAAC,CAAA;IACF,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AACtD,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,mCAAmC,CAAC,KAAiB,EAAE,MAA+B;IACpG,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAA;IACtC,KAAK,MAAM,KAAK,IAAI,yBAAyB,CAAC,KAAK,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAC1E,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACtB,IAAI,KAAK,KAAK,SAAS;YAAE,SAAQ;QACjC,MAAM,KAAK,GAAG,wBAAwB,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACnE,IAAI,KAAK,KAAK,SAAS;YAAE,SAAQ;QACjC,IAAI,CAAC;YACH,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,2BAA2B,CAAC,KAAK,CAAC,CAAC,CAAA;YAC1G,KAAK,MAAM,IAAI,IAAI,KAAK;gBAAE,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;YACtE,kEAAkE;YAClE,SAAQ;QACV,CAAC;IACH,CAAC;IACD,IAAI,YAAY,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACzC,OAAO;QACL,GAAG,KAAK;QACR,oBAAoB,EAAE,KAAK,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;KAC5F,CAAA;AACH,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,2BAA2B,CAAC,KAAiB,EAAE,KAAmB;IAChF,OAAO,mCAAmC,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,CAAA;AAC5D,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAY;IACpC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAC7C,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;IAChH,IAAI,CAAC;QACH,OAAO,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAY,CAAC,CAAA;IAC1D,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,IAAI,KAAK,YAAY,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;QACnF,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC;AAED,gHAAgH;AAChH,MAAM,UAAU,KAAK,CAAC,GAAoB,EAAE,MAAM,GAAW,EAAE;IAC7D,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACvE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAA;QAC1F,OAAM;IACR,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,GAAG,UAAU,aAAa,CAAC,CAAA;IACzE,MAAM,eAAe,GAAG,MAAM,CAAC,eAAe,IAAI,KAAK,CAAA;IACvD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,eAAe,CAAC,IAAI,eAAe,GAAG,GAAG,IAAI,eAAe,GAAG,MAAM,EAAE,CAAC;QAChG,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAA;IACjF,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,EAAE,CAAC,CAAA;IAC5G,MAAM,QAAQ,GAAG,IAAI,gBAAgB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAA;IAClH,MAAM,eAAe,GAAG,MAAM,CAAC,cAAc,KAAK,KAAK;QACrD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAI,uBAAuB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAA;IAC5G,MAAM,YAAY,GAAG,IAAI,mBAAmB,EAAE,CAAA;IAE9C,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE;QACd,IAAI,OAAO,GAAG,KAAK,CAAA;QACnB,IAAI,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAA;QAC9B,MAAM,GAAG,GAAG,CAAC,IAAa,EAAQ,EAAE;YAClC,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;gBAC9B,IAAI,OAAO;oBAAE,OAAM;gBACnB,IAAI,KAAK,GAAG,MAAM,cAAc,CAAC,SAAS,CAAC,CAAA;gBAC3C,IAAI,IAAI,EAAE,CAAC;oBACT,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC,CAAA;oBAC/C,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,cAAc,KAAK,KAAK;wBACjF,CAAC,CAAC,UAAU;wBACZ,CAAC,CAAC,MAAM,gCAAgC,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;oBACtE,IAAI,WAAW,KAAK,UAAU,IAAI,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;wBAC/G,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,mDAAmD,MAAM,CAAC,OAAO,EAAE,CAAC,CAAA;oBACtF,CAAC;oBACD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,IAAI,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,eAAe,CAAC,CAAA;oBACxH,KAAK,GAAG,MAAM,CAAC,KAAK,CAAA;oBACpB,4FAA4F;oBAC5F,MAAM,cAAc,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;oBACtC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBAC7B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,MAAM,CAAC,MAAM,eAAe,MAAM,CAAC,aAAa,CAAC,MAAM,mBAAmB,CAAC,CAAA;oBACvH,CAAC;oBACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;wBACxC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,KAAK,CAAC,MAAM,KAAK,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;oBACnF,CAAC;gBACH,CAAC;gBACD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,CAAA;gBACjC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,oBAAoB,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAM;gBAC1E,MAAM,IAAI,GAAG,mCAAmC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;gBAC/D,IAAI,IAAI,KAAK,KAAK;oBAAE,MAAM,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;gBACzD,MAAM,QAAQ,GAAG,yBAAyB,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;oBACnF,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;oBACtB,OAAO,KAAK,KAAK,SAAS,IAAI,wBAAwB,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,SAAS,CAAA;gBACnG,CAAC,CAAC,CAAA;gBACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;oBAC3B,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAA;oBACzB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;wBACxB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,wBAAwB,QAAQ,CAAC,MAAM,yDAAyD,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,cAAc,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,IAAI,kBAAkB,EAAE,CAAC,CAAA;oBAC9M,CAAC;gBACH,CAAC;YACH,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBAC1B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YACxE,CAAC,CAAC,CAAA;QACJ,CAAC,CAAA;QAED,MAAM,WAAW,GAAG,GAAG,CAAC,EAAE,CAAC,eAAe,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;QACjE,IAAI,MAAM,CAAC,UAAU,KAAK,KAAK;YAAE,GAAG,CAAC,IAAI,CAAC,CAAA;QAC1C,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,CAAA,CAAC,CAAC,EAAE,eAAe,GAAG,KAAK,CAAC,CAAA;QACvE,OAAO,KAAK,IAAI,EAAE;YAChB,OAAO,GAAG,IAAI,CAAA;YACd,aAAa,CAAC,KAAK,CAAC,CAAA;YACpB,WAAW,EAAE,CAAA;YACb,MAAM,MAAM,CAAA;QACd,CAAC,CAAA;IACH,CAAC,EAAE,4BAA4B,CAAC,CAAA;AAClC,CAAC"}
|
package/dist/src/version.d.ts
CHANGED
|
@@ -1,2 +1,2 @@
|
|
|
1
|
-
export declare const TOOL_VERSION = "0.
|
|
1
|
+
export declare const TOOL_VERSION = "0.28.0";
|
|
2
2
|
//# sourceMappingURL=version.d.ts.map
|
package/dist/src/version.js
CHANGED
|
@@ -1,2 +1,2 @@
|
|
|
1
|
-
export const TOOL_VERSION = '0.
|
|
1
|
+
export const TOOL_VERSION = '0.28.0';
|
|
2
2
|
//# sourceMappingURL=version.js.map
|
package/docs/README.zh-CN.md
CHANGED
|
@@ -147,7 +147,7 @@ pnpm dlx --package=upstream-radar@latest upstream-radar doctor ./upstream-radar.
|
|
|
147
147
|
|
|
148
148
|
如果需要手写配置或制作 CI fixture，可以参考[示例清单](../examples/radar/config.json)。如果既没有 `--patch` overlay，也没有设置 `UPSTREAM_RADAR_CONFIG`，插件会保持休眠，不发起轮询。
|
|
149
149
|
|
|
150
|
-
启动后，Radar 会轮询 OSV 与 npm
|
|
150
|
+
启动后，Radar 会轮询 OSV 与 npm，先把事件状态持久化，再把有变化的事件交给项目 workspace 对应的根 DSH Agent。只有一个 root 时保持自动投递；有多个 root 且无法精确匹配 workspace 时，任务会留在队列中，不会误投给另一个项目。
|
|
151
151
|
|
|
152
152
|
每轮发现新版本时，默认还会检查最早的一小段候选依赖图。CLI 可以用 `--no-deep-candidates` 显式关闭；原生 DSH 配置可以设置 `deepCandidates: false`。这项解析在临时目录中运行 `npm install --package-lock-only --ignore-scripts`，只解析 manifest 和 lockfile，不加载或执行候选代码。
|
|
153
153
|
|
|
@@ -181,7 +181,7 @@ pnpm run try:dsh
|
|
|
181
181
|
在把项目接入兼容性门禁前，可以先运行离线规则 benchmark：
|
|
182
182
|
|
|
183
183
|
```bash
|
|
184
|
-
pnpm dlx --package=upstream-radar@0.
|
|
184
|
+
pnpm dlx --package=upstream-radar@0.28.0 upstream-radar benchmark compatibility
|
|
185
185
|
```
|
|
186
186
|
|
|
187
187
|
它覆盖六类契约：安全补丁、只需要项目分析的变化、不兼容的 DSH peer、发布者明确声明 breaking、候选传递依赖漏洞，以及候选依赖图不完整。这个命令不会联网、安装包、加载插件或启动 DSH；它验证的是 Radar 的确定性规则以及 `breaking`/`any` 门禁行为，不是运行时兼容性证明。
|
|
@@ -194,7 +194,7 @@ pnpm dlx --package=upstream-radar@0.27.0 upstream-radar benchmark compatibility
|
|
|
194
194
|
# 打包精确版本，并明确不运行它的 lifecycle script。
|
|
195
195
|
npm pack --ignore-scripts dsh-plugin@1.2.3
|
|
196
196
|
|
|
197
|
-
pnpm dlx --package=upstream-radar@0.
|
|
197
|
+
pnpm dlx --package=upstream-radar@0.28.0 upstream-radar probe dsh-load \
|
|
198
198
|
./dsh-plugin-1.2.3.tgz \
|
|
199
199
|
--dsh-version 0.1.0-rc.6
|
|
200
200
|
```
|
|
@@ -220,7 +220,7 @@ pnpm run showcase:dsh-probe
|
|
|
220
220
|
如果要比较多个 DSH 版本，可以使用矩阵入口：
|
|
221
221
|
|
|
222
222
|
```bash
|
|
223
|
-
pnpm dlx --package=upstream-radar@0.
|
|
223
|
+
pnpm dlx --package=upstream-radar@0.28.0 upstream-radar probe dsh-matrix \
|
|
224
224
|
./dsh-plugin-1.2.3.tgz \
|
|
225
225
|
--dsh-version 0.1.0-rc.3 \
|
|
226
226
|
--dsh-version 0.1.0-rc.6 \
|
|
@@ -238,7 +238,7 @@ JSON 结果结构见[矩阵结果 schema](../schemas/dsh-load-matrix.schema.json
|
|
|
238
238
|
```yaml
|
|
239
239
|
steps:
|
|
240
240
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
241
|
-
- uses: MicroMilo/upstream-radar@v0.
|
|
241
|
+
- uses: MicroMilo/upstream-radar@v0.28.0
|
|
242
242
|
with:
|
|
243
243
|
config: upstream-radar.config.json
|
|
244
244
|
fail-on: high
|
|
@@ -246,12 +246,12 @@ steps:
|
|
|
246
246
|
fail-on-compatibility: breaking
|
|
247
247
|
```
|
|
248
248
|
|
|
249
|
-
这个 Action 只是 `radar check --frozen --state :memory: --fail-on high --fail-on-compatibility breaking --json` 的薄封装。`--frozen` 是有意的：它只使用配置文件里的依赖图，不会尝试读取 runner 上不存在的本地 DSH profile。每次运行彼此独立；发现达到阈值的漏洞或选择的兼容性变化时返回 `2`，运行或漏洞源出错时返回 `1`。`breaking` 只拦截有 confirmed/strong 信号的兼容性事件，`any` 会拦截所有活动兼容性事件，默认值是 `never`。这个入口不会投递 DSH Agent 任务，也不会修改分支；需要持续监控和项目级分析时，仍使用原生 DSH bundle。建议把 Action 固定到类似 `v0.
|
|
249
|
+
这个 Action 只是 `radar check --frozen --state :memory: --fail-on high --fail-on-compatibility breaking --json` 的薄封装。`--frozen` 是有意的：它只使用配置文件里的依赖图，不会尝试读取 runner 上不存在的本地 DSH profile。每次运行彼此独立；发现达到阈值的漏洞或选择的兼容性变化时返回 `2`，运行或漏洞源出错时返回 `1`。`breaking` 只拦截有 confirmed/strong 信号的兼容性事件，`any` 会拦截所有活动兼容性事件，默认值是 `never`。这个入口不会投递 DSH Agent 任务，也不会修改分支；需要持续监控和项目级分析时，仍使用原生 DSH bundle。建议把 Action 固定到类似 `v0.28.0` 的发布标签，并根据团队策略固定 checkout Action。
|
|
250
250
|
|
|
251
251
|
调用方需要先 checkout 仓库。这个 Action 不会安装项目依赖，也不会执行项目的 lifecycle script；它只读取提交到仓库的依赖图并查询配置中的上游漏洞源。如果需要完全显式的底层命令，等价写法是：
|
|
252
252
|
|
|
253
253
|
```bash
|
|
254
|
-
pnpm dlx --package=upstream-radar@0.
|
|
254
|
+
pnpm dlx --package=upstream-radar@0.28.0 upstream-radar radar check \
|
|
255
255
|
./upstream-radar.config.json --frozen --state :memory: --fail-on high \
|
|
256
256
|
--fail-on-compatibility breaking --json
|
|
257
257
|
```
|
|
@@ -259,7 +259,7 @@ pnpm dlx --package=upstream-radar@0.27.0 upstream-radar radar check \
|
|
|
259
259
|
如果还要检查一个已发布插件能否跨多个 DSH 版本加载，可以增加三个 input：
|
|
260
260
|
|
|
261
261
|
```yaml
|
|
262
|
-
- uses: MicroMilo/upstream-radar@v0.
|
|
262
|
+
- uses: MicroMilo/upstream-radar@v0.28.0
|
|
263
263
|
id: radar
|
|
264
264
|
with:
|
|
265
265
|
config: upstream-radar.config.json
|
|
@@ -346,11 +346,11 @@ DSH Agent 收到的任务要求：只读分析、引用项目证据、保留不
|
|
|
346
346
|
|
|
347
347
|
## 当前能力与边界
|
|
348
348
|
|
|
349
|
-
已经支持：DSH profile 实际安装树和 npm lock 依赖图、重复版本路径、未解析依赖的覆盖提示、OSV 精确版本匹配、恶意包记录、npm release 监听（只接受高于当前安装版本的候选；npm 的 `latest` 回退不会制造 breaking 告警；最新版本有确定性阻断时会检查历史候选的 OSV 状态和最早一小段传递依赖图，并筛出第一个没有确定性阻断且没有已知漏洞路径、值得交给 DSH 分析的候选；图不完整、图解析或 OSV 失败时不推荐候选）、公开 GitHub Release 说明、OSV 故障时保留已确认状态、连续失败后的 source-health DSH notice
|
|
349
|
+
已经支持：DSH profile 实际安装树和 npm lock 依赖图、重复版本路径、未解析依赖的覆盖提示、OSV 精确版本匹配、恶意包记录、npm release 监听（只接受高于当前安装版本的候选；npm 的 `latest` 回退不会制造 breaking 告警；最新版本有确定性阻断时会检查历史候选的 OSV 状态和最早一小段传递依赖图，并筛出第一个没有确定性阻断且没有已知漏洞路径、值得交给 DSH 分析的候选；图不完整、图解析或 OSV 失败时不推荐候选）、公开 GitHub Release 说明、OSV 故障时保留已确认状态、连续失败后的 source-health DSH notice、持久事件、按项目 workspace 精确路由到 DSH Agent、DSH 原生投递，以及 Node/peer/exports/入口/bundle/版本边界检查；还包括不联网的 `doctor` 接线检查、默认可提交的相对 workspace、把审查过的图接入 CI 的可复用 GitHub Action、可选的 breaking/any 兼容性门禁、可选的 DSH 版本加载矩阵、离线的 `benchmark compatibility` 规则契约检查，以及基于真实 DSH 插件的 consumer smoke。
|
|
350
350
|
|
|
351
351
|
此外支持一次性的 `probe dsh-load` 和有界的 `probe dsh-matrix`：在临时 DSH profile 中针对一个或多个精确 DSH 版本加载一个精确 tarball，并返回 `compatible`、`incompatible` 或 `unknown`。它是加载兼容性证据，不是安全准入，也不是插件能力 benchmark。
|
|
352
352
|
|
|
353
|
-
`init` 在省略 `--profile` 时可以自动选择唯一一个含第三方 bundle 的 DSH profile；多个候选仍要求显式指定。默认读取实际安装树，因此 pnpm override 和本地解析选择会被纳入；原生解析 pnpm lockfile 以支持安装前/CI 检查仍未实现。加上 `--dsh-patch <path>` 可以生成不依赖环境变量的 DSH overlay。`radar status` 提供离线的首次运行检查、活动事件摘要和下一步提示，但不会替你刷新漏洞源，也不会自动升级插件。暂未支持 Yarn 图适配、changelog/比较 diff
|
|
353
|
+
`init` 在省略 `--profile` 时可以自动选择唯一一个含第三方 bundle 的 DSH profile；多个候选仍要求显式指定。默认读取实际安装树，因此 pnpm override 和本地解析选择会被纳入；原生解析 pnpm lockfile 以支持安装前/CI 检查仍未实现。加上 `--dsh-patch <path>` 可以生成不依赖环境变量的 DSH overlay。`radar status` 提供离线的首次运行检查、活动事件摘要和下一步提示，但不会替你刷新漏洞源，也不会自动升级插件。暂未支持 Yarn 图适配、changelog/比较 diff/迁移文档源、把 Agent 结论写回事件，以及自动创建 Issue 或 PR。多 root Agent 场景下，只有 `project.workspace` 与 DSH 会话的 `cwd` 精确一致才会投递；无法确认时任务会留在队列中。
|
|
354
354
|
|
|
355
355
|
`radar watch` 是 CLI 监控入口，本身不会把任务投递给 DSH；需要 Agent 分析时应使用原生 DSH bundle。
|
|
356
356
|
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "upstream-radar",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.28.0",
|
|
4
4
|
"description": "Always-on dependency security monitoring for DeepSeek Harness (DSH) plugins: find exact installed or candidate transitive vulnerable paths and breaking updates, then route evidence to a DSH Agent.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"license": "Apache-2.0",
|