upstream-radar 0.43.4 → 0.44.0

package/README-zh-CN.md

@@ -1,118 +1,133 @@
 <h1 align="center">Upstream Radar</h1>
 
-<p align="center"><strong>每次 DeepSeek Harness 发布后，在用户踩坑前找出哪些插件坏了。</strong></p>
-
-<p align="center">
-  <a href="README.md">English</a> · 简体中文
-</p>
+<p align="center"><strong>持续验证 DeepSeek Harness 插件兼容性——覆盖 headless、Web 和 TUI。</strong></p>
 
 <p align="center">
+  <a href="README.md">English</a> ·
   <a href="https://github.com/MicroMilo/upstream-radar/actions/workflows/ci.yml"><img alt="CI" src="https://github.com/MicroMilo/upstream-radar/actions/workflows/ci.yml/badge.svg"></a>
   <a href="https://www.npmjs.com/package/upstream-radar"><img alt="npm" src="https://img.shields.io/npm/v/upstream-radar"></a>
-  <a href="https://github.com/MicroMilo/upstream-radar/stargazers"><img alt="GitHub stars" src="https://img.shields.io/github/stars/MicroMilo/upstream-radar"></a>
+  <a href="https://github.com/MicroMilo/upstream-radar/stargazers"><img alt="GitHub Stars" src="https://img.shields.io/github/stars/MicroMilo/upstream-radar"></a>
   <a href="LICENSE"><img alt="Apache-2.0" src="https://img.shields.io/badge/license-Apache--2.0-blue.svg"></a>
 </p>
 
-Upstream Radar 持续把一批真实插件发布物放到一次性隔离环境中，与不断变化的
-[DeepSeek Harness（DSH）](https://github.com/deepseek-ai/deepseek-harness)
-版本重新配对测试。某个组合坏了，就生成一条可复现的 Issue；作者发布修复后，
-Radar 会再次检查并关闭闭环。
+Upstream Radar 把精确的插件发布物、DSH 宿主和运行环境绑定在一起，让 Agent 根据仓库说明和
+已有失败证据推导受限环境，再放进一次性 GitHub VM 中实际验证。生态发生变化或证据过期后都会
+重跑，因此它检查的是**当前版本是否仍然可用**，而不只是比较一次 diff。
 
-**维护 100 个安装/加载目标 · 已提出 13 条 domain 报告 · 4 条已关闭 · 9 条开放或持续观察**
+它面向 [DeepSeek Harness（DSH）](https://github.com/deepseek-ai/deepseek-harness) 插件生态。
+静态检查是关于发布包的证据；隔离运行检查是关于某个精确的
+`插件 × DSH × Node/profile` 组合的证据。两者都不会被包装成永久有效的“兼容”徽章或安全证书。
 
-[最近一次 Agent 驱动的 headless 运行](https://github.com/MicroMilo/upstream-radar/actions/runs/32684879130)：
-**观测 96 个可执行目录插件 · 74 个兼容 · 22 个需要复核 · 0 个复现不兼容 · 4 个仅源码目标**。
-需要复核的信号不会被宣传成插件故障。
+> 已被 DSH 生态目录
+> [awesome-dsh-plugin](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin/blob/main/data/plugins/MicroMilo__upstream-radar.yml)、
+> [awesome-deepseek-harness](https://github.com/0xsline/awesome-deepseek-harness) 和
+> [awesome-deepseek-harness-plugins](https://github.com/imsai-sh/awesome-deepseek-harness-plugins/blob/main/catalog/plugins/micromilo--upstream-radar.json)
+> 收录。
 
-第一轮真实闭环从 29 个待复核插件开始。Agent 选择了 9 个受限重试，其中 7 个转为
-兼容；另 2 个明确停在 Web 客户端依赖边界，没有被误报成插件坏了。
+## 为什么需要它
 
-一句话：`DSH/插件变化 → Agent → 一次性 headless 虚拟机 → 精确证据 → 复测或可修复 Issue`。
+插件源码仓库看起来正常，但用户真正安装的发布物可能还没有适配当前 DSH 宿主：
 
-## 为什么需要它
+- README 宣传的版本根本没有发布；
+- 插件实际导入了比 peer range 更新的 DSH 包；
+- `package.json` 和 lockfile 描述的不是同一个版本；
+- 安装阶段需要构建工具或依赖脚本，而用户环境没有；
+- DSH 宿主依赖没有发布，完整依赖图无法建立。
 
-仓库看起来正常，不代表用户实际安装的插件仍然可用。真实发布物必须同时适配某个
-DSH 版本、Node 运行时、profile 和依赖组合；其中任何一项更新，都可能让插件一夜
-之间失效。
+这些是生态关系问题。分别检查两个仓库，很容易漏掉它们。
 
-Upstream Radar 检查的是这层真实关系，而不只是分别看两个仓库。本地发布前检查
-回答“这个插件今天能不能过”；Radar 回答“生态变化后，维护中的哪些插件不再能过”。
+## Radar 做什么
 
-## 完整闭环
+1. **建立统一兼容记录（IR）。** 对齐 npm 发布物、源码 commit、DSH 宿主、运行环境/profile、依赖路径和漏洞情报。
+2. **推导运行环境。** Agent 读取作者声明的安装说明和失败证据，只输出边界明确的安装计划。
+3. **验证不同执行平面。** 全新、无密钥的 runner 分别验证 headless 加载、Chromium Web 启动或真实 PTY TUI 交互。
+4. **让结果持续有效。** DSH/插件/依赖变化以及证据过期都会触发复测；确认的问题变成可修报告，干净复测后完成闭环。
 
 ```mermaid
 flowchart TB
-  Change["定时运行 / DSH 或插件变化"] --> Agent["Agent 规划受限的 headless 重试"]
-  Agent --> Runtime["一次性虚拟机：安装 → 注册 → 加载"]
-  Runtime -->|"出现下一层门槛"| Agent
-  Runtime -->|"兼容 / 超出 headless"| Evidence["发布精确证据"]
-  Runtime -->|"复现真实失败"| Issue["创建一条可修复的 Issue"]
-  Issue -->|"作者发布修复"| Change
+  Trigger["定时运行 / 上游变化 / 证据过期"] --> IR["精确 IR：插件字节 ↔ DSH ↔ 运行环境 ↔ 依赖"]
+  IR --> Agent["Agent 推导受限安装计划"]
+  Agent --> VM{"全新、无密钥的 GitHub VM"}
+  VM --> Headless["Headless：安装 → 注册 → 加载"]
+  VM --> Web["Web：Chromium → 启动交接 → 客户端包"]
+  VM --> TUI["TUI：PTY → 画面 → 输入 → 声明的退出方式"]
+  Headless --> Ledger["版本化证据账本 + 反向影响索引"]
+  Web --> Ledger
+  TUI --> Ledger
+  Ledger --> Decision{"能归责于插件吗？"}
+  Decision -->|"能"| Issue["生成一条可修复的维护者报告"]
+  Decision -->|"不能 / 检测器缺口"| Hold["暂扣报告并校准"]
+  Issue -->|"作者发布修复"| Trigger
+  Hold --> Trigger
 ```
 
-Agent 读取仓库说明和最新运行证据，决定 headless 是否重试、重试时允许哪些安装条件。
-真正的结果由一次性虚拟机执行得出，而不是模型判断。模型不能凭空增加安装包、不能
-进入目标虚拟机执行，也不能把缺失证据说成通过。
+Agent 可以选择作者声明的构建包、profile 设置和下一次受限重试。精确指纹决定一份报告能填入
+哪个测试格子；真正的结果由一次性虚拟机执行得出，而不是模型判断。缺失证据永远不能变成通过。
+
+## 试试一个真实检查
+
+第一次检查不需要本地 DSH profile，也不会执行插件代码：
 
-## 你会得到什么
+```bash
+npx --yes upstream-radar@0.44.0 inspect \
+  @sanqi-normal/dsh-webui-market-plugin@0.5.4 \
+  --deep --fail-on never
+```
 
-- `插件版本 × DSH 版本 × Node/profile` 的精确结果，而不是永不过期的“兼容”标签。
-- 把 Agent 规划的后续动作，与真实发布物的安装、注册、加载结果放在一起判断。
-- DSH 或插件变化后自动重新检查，而不是只生成一次报告。
-- 同一问题持续更新；回归时重新打开；干净复测通过后自动关闭。
+这个历史 DSH 插件版本会返回 `review / incomplete`，因为它发布的宿主依赖链指向了一个不可用的包。
+这是可复现的发布/宿主契约问题，不是恶意行为指控。查看[完整证据报告](examples/dsh/reports/sanqi-market-plugin-dependency-resolution.md)。
 
-## 我们闭环中提出的 domain 报告
+如果要检查自己的公开仓库，而不安装它：
 
-以下是 Upstream Radar 提出的 13 条面向维护者的报告。它们不全都表示
-“插件坏了”：第一组是运行时兼容性，第二组是精确发布物/安装边界，第三组是
-持续监控所依赖的依赖图是否可信。
+```bash
+npx --yes upstream-radar@0.44.0 scan \
+  https://github.com/owner/dsh-plugin \
+  --fail-on never
+```
 
-### DSH 宿主/插件契约 · 2 条
+仓库扫描会读取源码 manifest、DSH 元数据和 lockfile；不会安装依赖、执行 lifecycle script、加载插件、启动 DSH 或调用 LLM。
 
-- **已关闭** · [Sanqi-normal/dsh-webui-market-plugin#5](https://github.com/Sanqi-normal/dsh-webui-market-plugin/issues/5)
-- **开放** · [shaoshi20/dshscan#1](https://github.com/shaoshi20/dshscan/issues/1)
+## 让它持续运行
 
-### 发布物与安装契约 · 7 条
+把下面任意一个维护好的 workflow 复制到你的仓库：
 
-- **已关闭** · [1na-ko/dsh-hdc-bridge#3](https://github.com/1na-ko/dsh-hdc-bridge/issues/3)
-- **已关闭** · [6Mikao9/dsh-wsl-workspace#6](https://github.com/6Mikao9/dsh-wsl-workspace/issues/6)
-- **已关闭** · [3274375092/dsh-voice#2](https://github.com/3274375092/dsh-voice/issues/2)
-- **开放** · [AmeKrance/anan-thermal-monitor#1](https://github.com/AmeKrance/anan-thermal-monitor/issues/1)
-- **开放** · [AbcdefgXW/dsh-msg-hub#3](https://github.com/AbcdefgXW/dsh-msg-hub/issues/3)
-- **开放** · [030611/dsh-verification-receipt#3](https://github.com/030611/dsh-verification-receipt/issues/3)
-- **开放** · [0xsline/dsh-spotlight#5](https://github.com/0xsline/dsh-spotlight/issues/5)
+- [跨多个 DSH 版本检查一个精确插件](examples/github-actions/dsh-plugin-review-minimal.yml)：手动触发，得到发布物证据和隔离加载矩阵。
+- [每天观察一个插件仓库](examples/github-actions/upstream-observer-minimal.yml)：比较 commit、发布版本、manifest 和依赖图，只有发生重要变化才唤起 Agent。
+- [在 CI 中运行依赖门禁](examples/github-actions/upstream-radar.yml)：在合并前检查 lockfile 或审查过的 Radar 配置。
 
-### 依赖图与源码/发布版本对齐 · 4 条
+隔离的 [headless](.github/workflows/observe-dsh-plugin-install.yml) 和
+[Web/TUI](.github/workflows/observe-dsh-plugin-surface.yml) workflow 都使用全新的 GitHub 托管 runner。
+它们不是你的电脑，也不会接收项目或模型密钥。
 
-- **开放** · [lninghaha/dsh-coding-subscription-oauth#14](https://github.com/lninghaha/dsh-coding-subscription-oauth/issues/14)
-- **开放** · [AbcdefgXW/dsh-msg-hub#1](https://github.com/AbcdefgXW/dsh-msg-hub/issues/1)
-- **开放** · [AbcdefgXW/dsh-toolbox-web#1](https://github.com/AbcdefgXW/dsh-toolbox-web/issues/1)
-- **开放** · [13071301808/dsh-composer-expand#1](https://github.com/13071301808/dsh-composer-expand/issues/1)
+## 来自真实生态的结果
 
-你记得的 browser/web 案例——[`dsh-web-ui#35`](https://github.com/zhu1090093659/dsh-web-ui/issues/35)
-和 [`dsh-web-ui#71`](https://github.com/zhu1090093659/dsh-web-ui/issues/71)——是有价值的历史兼容性
-对照，且目前已关闭；但它们不是 Upstream Radar 提出的报告，所以不计入上面的 13 条。
-当前维护中的 `dsh-browser` 条目也都观测为兼容，不应被列成问题。
+当前的[100 插件兼容性 feed](feeds/dsh-plugin-compatibility.md)记录了 74 个精确 headless
+通过、22 个仅待复核结果、0 个已复现不兼容和 4 个仅仓库条目。在真正观测所需的
+Web/client 或仓库安装平面之前，待复核项不会被包装成插件故障。
 
-查看[完整分类与证据索引](docs/domain-reports.md)，其中区分了动态复现、源码/发布物证据，
-以及仍需维护者确认的弱结论。
+首批非 headless 测试已经在 GitHub 托管 VM 中跑通：
 
-## 检查一个插件
+| 精确测试格子 | 实际证据 | 结果 |
+| --- | --- | --- |
+| [`dsh-univer-office@0.2.9 × DSH 0.1.1-rc.2 × Web`](https://github.com/MicroMilo/upstream-radar/actions/runs/32823035297/job/97726205358) | HTTP 200、DSH 启动完成交接、客户端下载成功、浏览器和页面无错误 | **兼容** |
+| [`@deepseek-harness-tui/dsh-tui@0.9.2 × DSH 0.1.1-rc.2 × TUI`](https://github.com/MicroMilo/upstream-radar/actions/runs/32823035297/job/97726205289) | 真实 PTY 画面、键盘输入、按文档双击 Ctrl-C 后以 code 0 退出 | **兼容** |
+| [`@linxin666/dsh-web-all@0.3.3 × DSH 0.1.1-rc.2 × Web`](https://github.com/MicroMilo/upstream-radar/actions/runs/32828788296/job/97742850608) | Agent 批准 4 个依赖构建；聚合客户端包返回 200；启动清单、应用挂载和插件实体相互吻合 | **兼容** |
 
-```bash
-npx --yes upstream-radar@0.43.4 review dsh-plugin \
-  <包名>@<版本> \
-  --dsh-version <DSH版本>
-```
+两次首次测试都被 Radar 暂扣，没有提交给作者：TUI 检测器只发送了一次 Ctrl-C，而插件文档要求
+连按两次；Web 检测器把 Cordis 内部加载行误当成公开 npm 模块 ID。我们修正两份测试契约，并用
+相同精确发布物复测。聚合 Web 案例仍如实保留一个非阻塞的 `/status` 探测 404，但不会把这条可选
+请求误判为插件启动失败。
+
+截至 2026-08-25，Radar 共向维护者提交了 13 条报告。比数量更重要的是处理结果：
 
-需要执行插件代码时，请使用仓库维护的
-[隔离观察工作流](.github/workflows/observe-dsh-plugin-install.yml)：每个组合都会获得
-一台全新的、无密钥的 GitHub 托管虚拟机和受限容器。
+| 结果 | 报告 |
+| --- | --- |
+| **已发布修复并复核（5）** | [Sanqi #5](https://github.com/Sanqi-normal/dsh-webui-market-plugin/issues/5)（`0.5.5`）、[HDC #3](https://github.com/1na-ko/dsh-hdc-bridge/issues/3)（`0.7.3`）、[Voice #2](https://github.com/3274375092/dsh-voice/issues/2)（`0.2.6`）、[Msg Hub #1](https://github.com/AbcdefgXW/dsh-msg-hub/issues/1)、[Toolbox Web #1](https://github.com/AbcdefgXW/dsh-toolbox-web/issues/1) |
+| **维护者复核或补充契约（3）** | [Msg Hub #3](https://github.com/AbcdefgXW/dsh-msg-hub/issues/3)、[Spotlight #5 / PR #7](https://github.com/0xsline/dsh-spotlight/pull/7)、[WSL Workspace #6](https://github.com/6Mikao9/dsh-wsl-workspace/issues/6)——均已关闭，但不冒充运行时修复 |
+| **仍开放（5）** | [Anan #1](https://github.com/AmeKrance/anan-thermal-monitor/issues/1)、[Verification Receipt #3](https://github.com/030611/dsh-verification-receipt/issues/3)、[dshscan #1](https://github.com/shaoshi20/dshscan/issues/1)、[OAuth #14](https://github.com/lninghaha/dsh-coding-subscription-oauth/issues/14)、[Composer Expand #1](https://github.com/13071301808/dsh-composer-expand/issues/1) |
 
-你还可以查看[实时兼容性矩阵](examples/dsh/install-observer/README.md)、
-[可供目录消费的兼容性结果](feeds/dsh-plugin-compatibility.md)、
-[第一批 50 个插件](examples/dsh/first-batch/README.md)和
-[架构说明](docs/architecture.md)。
+“关闭”不自动等于“修复”。[完整的 domain 报告索引](docs/domain-reports.md)逐条保留了证据、
+验证等级、PR 覆盖和剩余边界。
 
 <p align="center">
   <strong>如果 Upstream Radar 对 DSH 生态有帮助，欢迎<a href="https://github.com/MicroMilo/upstream-radar">点一个 Star</a> ⭐</strong>

package/README.md

@@ -1,129 +1,160 @@
 <h1 align="center">Upstream Radar</h1>
 
-<p align="center"><strong>Know which DeepSeek Harness plugins break after every release—before users do.</strong></p>
-
-<p align="center">
-  English · <a href="README-zh-CN.md">简体中文</a>
-</p>
+<p align="center"><strong>Always-on compatibility testing for DeepSeek Harness plugins—across headless, Web, and TUI.</strong></p>
 
 <p align="center">
+  <a href="README-zh-CN.md">简体中文</a> ·
   <a href="https://github.com/MicroMilo/upstream-radar/actions/workflows/ci.yml"><img alt="CI" src="https://github.com/MicroMilo/upstream-radar/actions/workflows/ci.yml/badge.svg"></a>
   <a href="https://www.npmjs.com/package/upstream-radar"><img alt="npm" src="https://img.shields.io/npm/v/upstream-radar"></a>
   <a href="https://github.com/MicroMilo/upstream-radar/stargazers"><img alt="GitHub stars" src="https://img.shields.io/github/stars/MicroMilo/upstream-radar"></a>
   <a href="LICENSE"><img alt="Apache-2.0" src="https://img.shields.io/badge/license-Apache--2.0-blue.svg"></a>
 </p>
 
-Upstream Radar continuously retests a maintained fleet of exact published
-plugins against changing
-[DeepSeek Harness (DSH)](https://github.com/deepseek-ai/deepseek-harness)
-releases in disposable runners. When a pair breaks, it produces a reproducible
-issue; when the author ships a fix, it retests and closes the loop.
+Upstream Radar binds exact plugin bytes to an exact DSH host and runtime, lets an
+Agent derive a bounded environment from repository instructions and prior
+evidence, then proves the relationship in disposable GitHub VMs. It runs again
+when the ecosystem changes **or evidence expires**, so it tests the current
+version—not only the diff.
 
-**100 maintained install/load targets · 13 domain reports filed · 4 closed · 9 open or under watch**
+It is built for the [DeepSeek Harness (DSH)](https://github.com/deepseek-ai/deepseek-harness)
+plugin ecosystem. A static review is evidence about a package; an isolated
+runtime review is evidence about one exact `plugin × DSH × Node/profile` pair.
+Neither is presented as a timeless compatibility badge or a security certificate.
 
-[Latest Agent-driven headless run](https://github.com/MicroMilo/upstream-radar/actions/runs/32684879130):
-**96 executable catalog cells observed · 74 compatible · 22 need review · 0 reproduced incompatibilities · 4 source-only**.
-Review signals are never advertised as plugin failures.
+> Listed by the DSH ecosystem in
+> [awesome-dsh-plugin](https://github.com/awesome-dsh-plugin/awesome-dsh-plugin/blob/main/data/plugins/MicroMilo__upstream-radar.yml),
+> [awesome-deepseek-harness](https://github.com/0xsline/awesome-deepseek-harness), and
+> [awesome-deepseek-harness-plugins](https://github.com/imsai-sh/awesome-deepseek-harness-plugins/blob/main/catalog/plugins/micromilo--upstream-radar.json).
 
-The first live loop started with 29 review cells. The Agent selected nine
-bounded retries; seven became compatible, while two stopped at an explicit Web
-client dependency boundary instead of being mislabeled as broken.
+## The problem
 
-In one line: `DSH/plugin change → Agent → disposable headless VM → exact evidence → retest or fixable issue`.
+A source repository can be green while the package users install is not ready
+for the current DSH host:
 
-## Why it exists
+- the README advertises a version that was never published;
+- a plugin imports a newer DSH package than its peer range allows;
+- `package.json` and the lockfile describe different releases;
+- an install-time build or dependency script needs tools the user does not have;
+- a DSH host dependency is missing, so the dependency graph cannot be completed.
 
-A healthy repository does not prove that its published plugin still works.
-The artifact users install must resolve against a specific DSH host, Node
-runtime, profile, and dependency set—and any of them can change overnight.
+These are ecosystem relationship problems. They are easy to miss when the two
+repositories are checked separately.
 
-Upstream Radar checks the relationship, not just the two repositories. A local
-pre-publish check asks, “does this plugin pass today?” Radar asks, “which
-maintained plugins stopped passing after the ecosystem changed?”
+## What Radar does
 
-## The loop
+1. **Build one exact compatibility record (IR).** Align the npm artifact,
+   source commit, DSH host, runtime/profile, dependency paths, and advisories.
+2. **Derive the environment.** An Agent reads declared installation guidance
+   and failed evidence, then emits only a bounded install plan.
+3. **Prove each execution plane.** Fresh, secret-free runners exercise headless
+   load, Chromium Web boot, or a real PTY TUI interaction.
+4. **Keep the result alive.** DSH/plugin/dependency changes and evidence expiry
+   trigger retests; confirmed failures become fixable reports and clean retests
+   close the loop.
 
 ```mermaid
 flowchart TB
-  Change["Schedule / DSH or plugin change"] --> Agent["Agent plans a bounded headless retry"]
-  Agent --> Runtime["Disposable VM: install → register → load"]
-  Runtime -->|"next observed gate"| Agent
-  Runtime -->|"compatible / outside headless"| Evidence["Publish exact evidence"]
-  Runtime -->|"reproduced failure"| Issue["Open one fixable issue"]
-  Issue -->|"author ships a fix"| Change
+  Trigger["Schedule / upstream change / evidence expiry"] --> IR["Exact IR: plugin bytes ↔ DSH ↔ runtime ↔ dependencies"]
+  IR --> Agent["Agent derives a bounded install plan"]
+  Agent --> VM{"Fresh secret-free GitHub VM"}
+  VM --> Headless["Headless: install → register → load"]
+  VM --> Web["Web: Chromium → boot handoff → client bundle"]
+  VM --> TUI["TUI: PTY → frame → input → declared shutdown"]
+  Headless --> Ledger["Versioned evidence ledger + reverse impact index"]
+  Web --> Ledger
+  TUI --> Ledger
+  Ledger --> Decision{"Plugin-attributable failure?"}
+  Decision -->|"yes"| Issue["Produce one fixable maintainer report"]
+  Decision -->|"no / detector gap"| Hold["Hold the report and calibrate"]
+  Issue -->|"author ships a fix"| Trigger
+  Hold --> Trigger
 ```
 
-The Agent interprets repository instructions and the latest runtime evidence,
-then chooses whether and how headless should retry. The disposable runner—not
-the model—establishes the result. A model cannot invent a build package, execute
-inside the target VM, or turn missing evidence into a pass.
-
-## What you get
-
-- An exact result for `plugin version × DSH version × Node/profile`, not a
-  timeless “compatible” badge.
-- Agent-planned follow-ups joined with real install/register/load evidence from
-  the published artifact.
-- A maintained result that is retested when DSH or the plugin changes.
-- One managed issue that is updated on repeat failures, reopened on regression,
-  and closed after a clean retest.
-
-## Domain reports from our loop
-
-These are the 13 maintainer-facing reports filed by Upstream Radar. They are
-not all “the plugin is broken”: the first group is runtime compatibility, the
-second is the exact package/install boundary, and the third is whether a
-dependency graph can be trusted for continuous monitoring.
+The Agent may choose declared build packages, profile setup, and the next bounded
+retry. Exact fingerprints decide which cell a report can satisfy, and the
+disposable runner—not the model—establishes the result. Missing evidence can
+never become a pass.
 
-### DSH host/plugin contract · 2
+## Try a real check
 
-- **closed** · [Sanqi-normal/dsh-webui-market-plugin#5](https://github.com/Sanqi-normal/dsh-webui-market-plugin/issues/5)
-- **open** · [shaoshi20/dshscan#1](https://github.com/shaoshi20/dshscan/issues/1)
+No local DSH profile is needed for this first check. It reviews one exact
+published artifact without executing plugin code:
 
-### Published artifact and install contract · 7
-
-- **closed** · [1na-ko/dsh-hdc-bridge#3](https://github.com/1na-ko/dsh-hdc-bridge/issues/3)
-- **closed** · [6Mikao9/dsh-wsl-workspace#6](https://github.com/6Mikao9/dsh-wsl-workspace/issues/6)
-- **closed** · [3274375092/dsh-voice#2](https://github.com/3274375092/dsh-voice/issues/2)
-- **open** · [AmeKrance/anan-thermal-monitor#1](https://github.com/AmeKrance/anan-thermal-monitor/issues/1)
-- **open** · [AbcdefgXW/dsh-msg-hub#3](https://github.com/AbcdefgXW/dsh-msg-hub/issues/3)
-- **open** · [030611/dsh-verification-receipt#3](https://github.com/030611/dsh-verification-receipt/issues/3)
-- **open** · [0xsline/dsh-spotlight#5](https://github.com/0xsline/dsh-spotlight/issues/5)
-
-### Dependency graph and source/release alignment · 4
-
-- **open** · [lninghaha/dsh-coding-subscription-oauth#14](https://github.com/lninghaha/dsh-coding-subscription-oauth/issues/14)
-- **open** · [AbcdefgXW/dsh-msg-hub#1](https://github.com/AbcdefgXW/dsh-msg-hub/issues/1)
-- **open** · [AbcdefgXW/dsh-toolbox-web#1](https://github.com/AbcdefgXW/dsh-toolbox-web/issues/1)
-- **open** · [13071301808/dsh-composer-expand#1](https://github.com/13071301808/dsh-composer-expand/issues/1)
-
-The browser/web cases you may remember—[`dsh-web-ui#35`](https://github.com/zhu1090093659/dsh-web-ui/issues/35)
-and [`dsh-web-ui#71`](https://github.com/zhu1090093659/dsh-web-ui/issues/71)—are
-useful historical compatibility references and are closed, but they were not
-filed by Upstream Radar and are therefore not counted above. The maintained
-`dsh-browser` entries currently observed compatible are also not findings.
+```bash
+npx --yes upstream-radar@0.44.0 inspect \
+  @sanqi-normal/dsh-webui-market-plugin@0.5.4 \
+  --deep --fail-on never
+```
 
-See the [full classification and evidence index](docs/domain-reports.md) for
-validation level, impact, and the boundary between a confirmed runtime issue
-and a report that only needs maintainer confirmation.
+This historical DSH plugin release returns `review / incomplete` because its
+published host dependency chain reaches an unavailable package. That is a
+useful, reproducible release/host-contract report—not a claim of malicious
+behavior. See the [full evidence report](examples/dsh/reports/sanqi-market-plugin-dependency-resolution.md).
 
-## Run one check
+To review your own public repository without installing it:
 
 ```bash
-npx --yes upstream-radar@0.43.4 review dsh-plugin \
-  <package>@<version> \
-  --dsh-version <dsh-version>
+npx --yes upstream-radar@0.44.0 scan \
+  https://github.com/owner/dsh-plugin \
+  --fail-on never
 ```
 
-For code-executing checks, use the maintained
-[isolated observer workflow](.github/workflows/observe-dsh-plugin-install.yml):
-each pair receives a fresh, secret-free GitHub-hosted VM and restricted
-container.
-
-Inspect the [live compatibility matrix](examples/dsh/install-observer/README.md),
-the [directory-consumable evidence feed](feeds/dsh-plugin-compatibility.md),
-the [first 50-plugin corpus](examples/dsh/first-batch/README.md), or the
-[architecture notes](docs/architecture.md).
+The repository scan reads source manifests, DSH metadata, and lockfiles. It does
+not install dependencies, run lifecycle scripts, load the plugin, start DSH, or
+call an LLM.
+
+## Run it on every change
+
+Copy one of the maintained workflows into your repository:
+
+- [Review one exact plugin across DSH versions](examples/github-actions/dsh-plugin-review-minimal.yml)
+  — a manual check with artifact evidence and an isolated load matrix.
+- [Observe one plugin repository every day](examples/github-actions/upstream-observer-minimal.yml)
+  — compares commits, published versions, manifests, and dependency graphs, then
+  wakes an Agent only when there is a meaningful change.
+- [Run the dependency gate in CI](examples/github-actions/upstream-radar.yml)
+  — checks the lockfile or reviewed Radar configuration before merge.
+
+The isolated [headless](.github/workflows/observe-dsh-plugin-install.yml) and
+[Web/TUI](.github/workflows/observe-dsh-plugin-surface.yml) observers use fresh
+GitHub-hosted runners. They are not your workstation and receive no project or
+model secrets.
+
+## Evidence from the ecosystem
+
+The current [100-plugin compatibility feed](feeds/dsh-plugin-compatibility.md)
+records 74 exact headless passes, 22 review-only results, zero reproduced
+incompatibilities, and four repository-only entries. The review-only group is
+kept separate from failures until the required Web/client or repository install
+plane is actually observed.
+
+The first non-headless cells now run in GitHub-hosted VMs:
+
+| Exact cell | Observed proof | Result |
+| --- | --- | --- |
+| [`dsh-univer-office@0.2.9 × DSH 0.1.1-rc.2 × Web`](https://github.com/MicroMilo/upstream-radar/actions/runs/32823035297/job/97726205358) | HTTP 200, DSH boot handoff, declared client bundle fetched, no browser/page errors | **Compatible** |
+| [`@deepseek-harness-tui/dsh-tui@0.9.2 × DSH 0.1.1-rc.2 × TUI`](https://github.com/MicroMilo/upstream-radar/actions/runs/32823035297/job/97726205289) | Real PTY frame, keyboard input, documented double-Ctrl-C exit, code 0 | **Compatible** |
+| [`@linxin666/dsh-web-all@0.3.3 × DSH 0.1.1-rc.2 × Web`](https://github.com/MicroMilo/upstream-radar/actions/runs/32828788296/job/97742850608) | Agent-approved four dependency builds; aggregate client bundle returned 200; boot manifest, app mount, and plugin materialization matched | **Compatible** |
+
+Two first attempts were held by Radar rather than reported to authors. The TUI
+observer sent one Ctrl-C while the plugin documents a double press. The Web
+observer confused an internal Cordis loader row with the public npm module ID.
+Radar corrected both contracts and reran the same exact artifacts. The aggregate
+Web case still records a non-blocking `/status` probe returning 404, without
+mistaking that optional request for a failed plugin boot.
+
+As of 2026-08-25, Radar has filed 13 maintainer-facing reports. The outcome is
+more useful than the raw count:
+
+| Outcome | Reports |
+| --- | --- |
+| **Fix shipped and rechecked (5)** | [Sanqi #5](https://github.com/Sanqi-normal/dsh-webui-market-plugin/issues/5) (`0.5.5`), [HDC #3](https://github.com/1na-ko/dsh-hdc-bridge/issues/3) (`0.7.3`), [Voice #2](https://github.com/3274375092/dsh-voice/issues/2) (`0.2.6`), [Msg Hub #1](https://github.com/AbcdefgXW/dsh-msg-hub/issues/1), [Toolbox Web #1](https://github.com/AbcdefgXW/dsh-toolbox-web/issues/1) |
+| **Boundary reviewed or documented (3)** | [Msg Hub #3](https://github.com/AbcdefgXW/dsh-msg-hub/issues/3), [Spotlight #5 / PR #7](https://github.com/0xsline/dsh-spotlight/pull/7), [WSL Workspace #6](https://github.com/6Mikao9/dsh-wsl-workspace/issues/6) — closed without claiming a runtime fix |
+| **Still open (5)** | [Anan #1](https://github.com/AmeKrance/anan-thermal-monitor/issues/1), [Verification Receipt #3](https://github.com/030611/dsh-verification-receipt/issues/3), [dshscan #1](https://github.com/shaoshi20/dshscan/issues/1), [OAuth #14](https://github.com/lninghaha/dsh-coding-subscription-oauth/issues/14), [Composer Expand #1](https://github.com/13071301808/dsh-composer-expand/issues/1) |
+
+“Closed” is not automatically “fixed.” The [full domain report index](docs/domain-reports.md)
+records the evidence, validation level, PR coverage, and remaining boundary for
+every report.
 
 <p align="center">
   <strong>If Upstream Radar helps the DSH ecosystem stay compatible, <a href="https://github.com/MicroMilo/upstream-radar">please give it a Star</a> ⭐</strong>