upstream-radar 0.4.0

package/LICENSE

@@ -0,0 +1,176 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS

package/README.md

@@ -0,0 +1,222 @@
+<p align="center">
+  <picture>
+    <source media="(max-width: 600px)" srcset="docs/assets/upstream-radar-hero-mobile.jpg">
+    <img src="docs/assets/upstream-radar-hero.jpg" alt="Upstream Radar watches a dependency graph, highlights one affected path, and routes one signal to a DSH Agent." width="100%">
+  </picture>
+</p>
+
+<h1 align="center">Upstream Radar</h1>
+
+<p align="center"><strong>Dependency changes that wake your DSH Agent only when your project is actually affected.</strong></p>
+
+<p align="center">
+  English · <a href="README.zh-CN.md">简体中文</a>
+</p>
+
+<p align="center">
+  <a href="https://www.npmjs.com/package/upstream-radar"><img alt="npm version" src="https://img.shields.io/npm/v/upstream-radar?style=flat-square&color=2563eb"></a>
+  <a href="https://github.com/MicroMilo/upstream-radar/actions/workflows/ci.yml"><img alt="CI" src="https://img.shields.io/github/actions/workflow/status/MicroMilo/upstream-radar/ci.yml?branch=main&style=flat-square&label=CI"></a>
+  <a href="examples/dsh/README.md"><img alt="Tested with DSH 0.1.0-rc.6" src="https://img.shields.io/badge/tested_with_DSH-0.1.0--rc.6-5b5bd6?style=flat-square"></a>
+  <a href="https://github.com/MicroMilo/upstream-radar/releases"><img alt="GitHub release" src="https://img.shields.io/github/v/release/MicroMilo/upstream-radar?style=flat-square"></a>
+  <a href="LICENSE"><img alt="Apache-2.0 license" src="https://img.shields.io/badge/license-Apache--2.0-0f766e?style=flat-square"></a>
+</p>
+
+<p align="center">
+  <a href="#run-the-proof">Run the proof</a> ·
+  <a href="#install-in-dsh">Install in DSH</a> ·
+  <a href="#how-the-loop-works">How it works</a> ·
+  <a href="ROADMAP.md">Roadmap</a>
+</p>
+
+---
+
+A vulnerability feed can tell you that a package is affected. It usually cannot tell you which DSH plugin brought that exact version into your profile, whether the vulnerable path reaches your project, or whether the available upgrade breaks DSH on the way out.
+
+Upstream Radar closes that loop inside [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness):
+
+- **Exact path, not a package-name guess.** It preserves physical dependency nodes, duplicate versions, and the root-to-package path that actually matched.
+- **An incident, not alert spam.** It stores `new`, `updated`, and `resolved` state and keeps only the current task for each incident.
+- **Program facts before model judgment.** Version matching and compatibility boundaries stay deterministic; the DSH Agent investigates only project-specific reachability and migration impact.
+
+## Run the proof
+
+Boot a real DSH `headless` profile with the packed Upstream Radar bundle installed:
+
+```bash
+git clone https://github.com/MicroMilo/upstream-radar.git
+cd upstream-radar
+corepack enable
+pnpm install --frozen-lockfile
+pnpm run try:dsh
+```
+
+No DeepSeek API key is required. The paid model endpoint is replaced by a deterministic local DeepSeek-compatible stub; the Cordis loader, DSH Agent, Session, persistence stack, bundle installation, and plugin delivery are real.
+
+The command fails unless DSH proves all four facts:
+
+```json
+{
+  "bundleInstalled": true,
+  "radarTaskReachedModel": true,
+  "pluginSourcePreserved": true,
+  "pendingTasksAfterDelivery": 0
+}
+```
+
+This proof runs in CI on Node.js 22. See the executable [showcase contract](examples/dsh/README.md) and its checked-in [result](examples/dsh/reports/headless-smoke.json).
+
+To include a current OSV and npm poll before the DSH handoff:
+
+```bash
+pnpm run try:dsh:live
+```
+
+## Install in DSH
+
+Upstream Radar is an npm-published DSH bundle, so no install-time build permission is required:
+
+```bash
+dsh plugin --profile web add upstream-radar@0.4.0
+```
+
+Point the bundle at an explicit project inventory, choose a durable state file, then boot the profile:
+
+```bash
+export UPSTREAM_RADAR_CONFIG=/absolute/path/radar-config.json
+export UPSTREAM_RADAR_STATE=/absolute/path/radar-state.json
+export UPSTREAM_RADAR_INTERVAL_SECONDS=1800
+
+dsh --profile web --dump-config
+dsh --profile web
+```
+
+Start from [the example inventory](examples/radar/config.json). If `UPSTREAM_RADAR_CONFIG` is not set, the bundle stays dormant and performs no polling.
+
+## How the loop works
+
+1. Read the project inventory and exact installed npm graph.
+2. Query OSV with every installed `name@version` pair.
+3. Watch npm releases for the installed plugin and DSH/Cordis packages.
+4. Create or update one durable incident with the exact dependency path.
+5. Persist a constrained analysis task before delivery.
+6. Send a plugin-originated follow-up to the first live root DSH Agent.
+7. Keep the task on disk when no Agent is available; cancel it when the incident resolves.
+
+The handoff uses `ctx.agents.roots()[0].followup(...)` with:
+
+```json
+{
+  "kind": "plugin",
+  "plugin": "upstream-radar",
+  "form": "notice"
+}
+```
+
+It is a native DSH lifecycle integration—not a chat bridge or a remote-control bot.
+
+## One vulnerable path, not a false-positive package name
+
+Given this installed graph:
+
+```text
+plugin@1.0.0
+├── framework@2.4.7
+│   ├── parser@3.2.1
+│   └── archive@1.8.0
+└── logger@4.0.2
+    └── parser@2.9.0
+```
+
+an advisory affecting only `parser@2.9.0` produces:
+
+```text
+[HIGH][NEW] Dependency vulnerability
+Project: Payments API (payments-api)
+Plugin: plugin@1.0.0
+Affected: parser@2.9.0
+Path: plugin@1.0.0 -> logger@4.0.2 -> parser@2.9.0
+Fixed versions: 3.0.0
+```
+
+The unaffected `parser@3.2.1` remains a distinct node.
+
+## Vulnerabilities are only half the upstream problem
+
+Upstream Radar also watches candidate releases for compatibility boundaries that matter to DSH plugins:
+
+- Node.js engine exclusions;
+- incompatible `@deepseek-ai/dsh-*` or `@deepseek-ai/cordis` peer ranges;
+- changed `main`, `exports`, or DSH bundle patch paths;
+- removed dependencies;
+- major and pre-1.0 breaking version boundaries;
+- publisher-declared breaking changes in supplied release notes.
+
+These are signals for project analysis, not automatic claims that an upgrade is broken.
+
+## The model gets judgment, not control of the facts
+
+Upstream Radar determines facts that a model must not guess:
+
+```text
+parser@2.9.0 is reported as affected
+plugin -> logger -> parser is the installed path
+the project runs Node.js 22
+the candidate requires Node.js >=24
+the installed DSH peer is outside the candidate range
+```
+
+The DSH Agent answers the repository-specific questions:
+
+```text
+is the vulnerable feature reachable here?
+can attacker-controlled input reach it?
+which API or Cordis configuration would the upgrade disturb?
+what is the least disruptive project-specific action?
+```
+
+Advisories, release notes, links, package names, and repository strings remain untrusted data. The generated task requires read-only analysis, project evidence, explicit uncertainty, and a fixed [result schema](schemas/analysis-result.schema.json).
+
+## What works today
+
+- npm lockfile graphs with duplicate versions and bounded dependency paths;
+- exact-version OSV vulnerability and malicious-package matching;
+- npm release monitoring for plugins and DSH/Cordis packages;
+- durable incident state with current-task replacement and resolution;
+- native DSH bundle installation, startup polling, `agent/created` retry, and plugin-source attribution;
+- compatibility signals for Node.js, peers, exports, entrypoints, bundle paths, dependencies, and version boundaries;
+- network-free Radar and real DSH runtime showcases.
+
+The bounded pre-install scanner remains available as a supporting collector:
+
+```bash
+upstream-radar scan /path/to/dsh-plugin
+upstream-radar inspect npm:dsh-cloudflare-browser-run@0.1.1 --deep
+```
+
+## Current boundaries
+
+- Project inventory is explicit JSON; active DSH profile discovery is not implemented yet.
+- npm lock graphs are supported; pnpm and Yarn graph adapters are not implemented.
+- OSV and npm `latest` are the live sources; GitHub release and migration-guide ingestion are deferred.
+- Delivery currently targets the first live root Agent rather than a project-specific session.
+- Agent conclusions stay in the DSH Session; Radar does not ingest them back into incident state yet.
+- No Issue, branch, Pull Request, dependency override, or merge is created automatically.
+
+Upstream Radar is alpha software built for the developer-preview DSH ecosystem. Event schemas and adapter boundaries can change.
+
+## Project guide
+
+- [Architecture](docs/architecture.md)
+- [DSH headless showcase](examples/dsh/README.md)
+- [Radar showcase walkthrough](docs/showcase.md)
+- [Product vision（中文）](docs/vision.zh-CN.md)
+- [Checks and evidence（中文）](docs/checks.zh-CN.md)
+- [Threat model](docs/threat-model.md)
+- [Roadmap](ROADMAP.md)
+- [Changelog](CHANGELOG.md)
+- [Contributing](CONTRIBUTING.md)
+- [Security policy](SECURITY.md)
+
+If DSH plugins are part of your stack, star the repository to follow the upstream safety loop as it grows. Questions and design feedback are welcome in [GitHub Discussions](https://github.com/MicroMilo/upstream-radar/discussions).
+
+<sub>Community project for DeepSeek Harness. Not an official DeepSeek product. Apache-2.0 licensed.</sub>

package/README.zh-CN.md

@@ -0,0 +1,170 @@
+<p align="center">
+  <picture>
+    <source media="(max-width: 600px)" srcset="docs/assets/upstream-radar-hero-mobile.jpg">
+    <img src="docs/assets/upstream-radar-hero.jpg" alt="Upstream Radar 监控依赖图，只高亮真正受影响的路径，并把一个信号交给 DSH Agent。" width="100%">
+  </picture>
+</p>
+
+<h1 align="center">Upstream Radar</h1>
+
+<p align="center"><strong>只有当上游变化真正命中项目时，才唤醒你的 DSH Agent。</strong></p>
+
+<p align="center">
+  <a href="README.md">English</a> · 简体中文
+</p>
+
+<p align="center">
+  <a href="https://www.npmjs.com/package/upstream-radar"><img alt="npm 版本" src="https://img.shields.io/npm/v/upstream-radar?style=flat-square&color=2563eb"></a>
+  <a href="https://github.com/MicroMilo/upstream-radar/actions/workflows/ci.yml"><img alt="CI" src="https://img.shields.io/github/actions/workflow/status/MicroMilo/upstream-radar/ci.yml?branch=main&style=flat-square&label=CI"></a>
+  <a href="examples/dsh/README.md"><img alt="已使用 DSH 0.1.0-rc.6 验证" src="https://img.shields.io/badge/tested_with_DSH-0.1.0--rc.6-5b5bd6?style=flat-square"></a>
+  <a href="LICENSE"><img alt="Apache-2.0 许可证" src="https://img.shields.io/badge/license-Apache--2.0-0f766e?style=flat-square"></a>
+</p>
+
+---
+
+普通漏洞源只能告诉你“某个包有问题”。它通常无法回答：这个精确版本是被哪个 DSH 插件带进来的、真实依赖路径是什么、项目是否会触发漏洞，以及升级时会不会顺手破坏 DSH 兼容性。
+
+Upstream Radar 把这条链路闭合在 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) 内部：
+
+- **看精确路径，不按包名猜。** 保留物理依赖节点、重复版本和真正命中的完整路径。
+- **维护事件状态，不制造告警洪水。** 记录 `new`、`updated`、`resolved`，同一事件只保留当前任务。
+- **程序先确定事实，模型只做判断。** 版本命中和兼容边界由程序计算；DSH Agent 只调查项目可达性和迁移影响。
+
+## 在真实 DSH 中运行证明
+
+```bash
+git clone https://github.com/MicroMilo/upstream-radar.git
+cd upstream-radar
+corepack enable
+pnpm install --frozen-lockfile
+pnpm run try:dsh
+```
+
+这个命令会把打包后的 bundle 安装进全新的 DSH `headless` profile。只有付费模型端点被本地确定性 stub 替代；Cordis loader、DSH Agent、Session、持久化和插件投递都是真实组件。
+
+验证不满足以下四项就会失败：
+
+```json
+{
+  "bundleInstalled": true,
+  "radarTaskReachedModel": true,
+  "pluginSourcePreserved": true,
+  "pendingTasksAfterDelivery": 0
+}
+```
+
+要把当前 OSV 和 npm 数据也加入启动轮询：
+
+```bash
+pnpm run try:dsh:live
+```
+
+## 安装到 DSH
+
+Upstream Radar 发布的是已经构建好的 npm bundle，不需要开放安装期构建权限：
+
+```bash
+dsh plugin --profile web add upstream-radar@0.4.0
+```
+
+指定项目清单和持久化状态文件后启动 profile：
+
+```bash
+export UPSTREAM_RADAR_CONFIG=/absolute/path/radar-config.json
+export UPSTREAM_RADAR_STATE=/absolute/path/radar-state.json
+export UPSTREAM_RADAR_INTERVAL_SECONDS=1800
+
+dsh --profile web --dump-config
+dsh --profile web
+```
+
+可以从[示例清单](examples/radar/config.json)开始。如果没有设置 `UPSTREAM_RADAR_CONFIG`，插件会保持休眠，不发起轮询。
+
+## 闭环如何工作
+
+1. 读取项目清单和实际安装的 npm 依赖图。
+2. 用每一个精确 `name@version` 查询 OSV。
+3. 监听已安装插件和 DSH/Cordis 包的 npm 新版本。
+4. 用真实依赖路径创建或更新一个持久事件。
+5. 先把受约束的分析任务落盘，再尝试投递。
+6. 通过 `ctx.agents.roots()[0].followup(...)` 唤醒在线 DSH Agent。
+7. Agent 不在线时保留任务；事件解决后撤销过期任务。
+
+投递消息保留明确的插件身份：
+
+```json
+{
+  "kind": "plugin",
+  "plugin": "upstream-radar",
+  "form": "notice"
+}
+```
+
+这是 DSH 原生生命周期集成，不是聊天机器人，也不是远程控制入口。
+
+## 一个真实命中的路径
+
+```text
+plugin@1.0.0
+├── framework@2.4.7
+│   ├── parser@3.2.1
+│   └── archive@1.8.0
+└── logger@4.0.2
+    └── parser@2.9.0
+```
+
+如果公告只影响 `parser@2.9.0`，Radar 输出的是：
+
+```text
+[HIGH][NEW] Dependency vulnerability
+Project: Payments API (payments-api)
+Plugin: plugin@1.0.0
+Affected: parser@2.9.0
+Path: plugin@1.0.0 -> logger@4.0.2 -> parser@2.9.0
+Fixed versions: 3.0.0
+```
+
+不受影响的 `parser@3.2.1` 仍然是独立节点。
+
+## 不只监控漏洞，也监控 breaking changes
+
+Radar 还会识别与 DSH 插件直接相关的升级边界：
+
+- Node.js 版本不兼容；
+- `@deepseek-ai/dsh-*` 或 `@deepseek-ai/cordis` peer 范围不兼容；
+- `main`、`exports` 或 DSH bundle patch 路径变化；
+- 依赖被移除；
+- major 和 1.0 前的破坏性版本边界；
+- 发布者在 release notes 中明确声明 breaking change。
+
+这些是交给项目分析的信号，不会被包装成“已经确认升级会坏”。
+
+## 安全边界
+
+版本是否命中、依赖路径和兼容边界由程序确定。漏洞公告、release notes、链接、包名和仓库文字始终是不可信数据。
+
+DSH Agent 收到的任务要求：只读分析、引用项目证据、保留不确定性，并返回固定的[结果结构](schemas/analysis-result.schema.json)。模型无法改写程序已经确认的匹配事实。
+
+## 当前能力与边界
+
+已经支持：npm lock 依赖图、重复版本路径、OSV 精确版本匹配、恶意包记录、npm release 监听、持久事件、DSH 原生投递，以及 Node/peer/exports/入口/bundle/版本边界检查。
+
+暂未支持：自动发现当前 DSH profile、pnpm/Yarn 图适配、GitHub release 与迁移文档源、项目级 Session 精确路由、把 Agent 结论写回事件，以及自动创建 Issue 或 PR。
+
+Upstream Radar 目前是面向 DSH developer preview 生态的 alpha 软件，事件结构和适配边界仍可能变化。
+
+## 项目文档
+
+- [架构](docs/architecture.md)
+- [真实 DSH showcase](examples/dsh/README.md)
+- [产品愿景](docs/vision.zh-CN.md)
+- [检查项与证据](docs/checks.zh-CN.md)
+- [威胁模型](docs/threat-model.md)
+- [Roadmap](ROADMAP.md)
+- [Changelog](CHANGELOG.md)
+- [贡献指南](CONTRIBUTING.md)
+- [安全策略](SECURITY.md)
+
+如果 DSH 插件已经进入你的技术栈，欢迎 Star 并在 [GitHub Discussions](https://github.com/MicroMilo/upstream-radar/discussions) 里讨论真实场景。
+
+<sub>DeepSeek Harness 社区项目，并非 DeepSeek 官方产品。Apache-2.0 许可。</sub>

package/cordis.patch.yml

@@ -0,0 +1,11 @@
+# Upstream Radar stays dormant until an inventory file is configured. This keeps
+# installation side-effect free while letting one DSH profile opt into polling.
+- insert:
+    - id: upstream-radar
+      name: 'upstream-radar/dsh'
+      config:
+        configFile: !!js process.env.UPSTREAM_RADAR_CONFIG
+        stateFile: !!js process.env.UPSTREAM_RADAR_STATE
+        intervalSeconds: !!js Number(process.env.UPSTREAM_RADAR_INTERVAL_SECONDS || 1800)
+        osvBaseUrl: !!js process.env.UPSTREAM_RADAR_OSV_BASE_URL
+        runOnStart: !!js process.env.UPSTREAM_RADAR_RUN_ON_START !== 'false'

package/dist/src/cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/src/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":""}