yugoo-design 0.2.0 → 0.2.3

package/README.md

@@ -1,6 +1,6 @@
 # Yugoo Design
 
-Package: `yugoo-design@0.2.0`.
+Package: `yugoo-design@0.2.3`.
 
 Yugoo Design (语构设计系统) is an interactive design plugin for native Agent Hosts.
 It combines domain methods, Design Projects, versioned Design Files and shared
@@ -55,7 +55,7 @@ from another operating system requires an explicit Windows path and reports that
 locator as unverified; it does not establish target runtime acceptance.
 
 ```sh
-ONNXRUNTIME_NODE_INSTALL_CUDA=skip npm install --ignore-scripts=false --save-exact yugoo-design@0.2.0 --registry=https://registry.npmjs.org
+ONNXRUNTIME_NODE_INSTALL_CUDA=skip npm install --ignore-scripts=false --save-exact yugoo-design@0.2.3 --registry=https://registry.npmjs.org
 npx --no-install yugoo-design --help
 ```
 
@@ -72,7 +72,7 @@ allowBuilds:
 ```
 
 ```sh
-ONNXRUNTIME_NODE_INSTALL_CUDA=skip pnpm add --save-exact yugoo-design@0.2.0 --registry=https://registry.npmjs.org
+ONNXRUNTIME_NODE_INSTALL_CUDA=skip pnpm add --save-exact yugoo-design@0.2.3 --registry=https://registry.npmjs.org
 pnpm exec yugoo-design --help
 ```
 
@@ -121,7 +121,7 @@ process value:
 $previousOrtCuda = [Environment]::GetEnvironmentVariable('ONNXRUNTIME_NODE_INSTALL_CUDA', 'Process')
 try {
   $env:ONNXRUNTIME_NODE_INSTALL_CUDA = 'skip'
-  npm install --ignore-scripts=false --save-exact yugoo-design@0.2.0 --registry=https://registry.npmjs.org
+  npm install --ignore-scripts=false --save-exact yugoo-design@0.2.3 --registry=https://registry.npmjs.org
 } finally {
   [Environment]::SetEnvironmentVariable('ONNXRUNTIME_NODE_INSTALL_CUDA', $previousOrtCuda, 'Process')
 }

package/bin/npm-agent-installation.mjs

@@ -73,7 +73,7 @@ export function installationResult(host, result, packageIdentity, { disableEmbed
       activation: failed ? 'not-performed' : 'required', usability: 'unverified',
       embedding: { status: disableEmbedding ? 'disabled' : 'unverified', blocksBasicDesign: false },
       nextActions: failed ? [{ action: 'inspect-retained-state', automatic: false, path: result.receiptFile,
-        message: 'Inspect the owning receipt and retained DSH state before another operation. No automatic rollback or retry was attempted.' }]
+        message: result.failure?.recovery ?? 'Inspect the owning receipt and retained DSH state before another operation. No automatic rollback or retry was attempted.' }]
         : activationActions(host, result, disableEmbedding) } }
 }
 

package/bin/npm-installer-dsh.mjs

@@ -6,7 +6,8 @@ import { createHash, randomUUID } from 'node:crypto'
 import { lstat, readFile, realpath, writeFile } from 'node:fs/promises'
 import { dirname, isAbsolute, join, resolve } from 'node:path'
 import { pathToFileURL } from 'node:url'
-import { promisify } from 'node:util'
+import { isDeepStrictEqual, promisify } from 'node:util'
+import { createRequire } from 'node:module'
 
 const exec = promisify(execFile)
 const admitted = new WeakMap()
@@ -15,6 +16,7 @@ const canonical = value => Array.isArray(value) ? value.map(canonical) : value &
   ? Object.fromEntries(Object.keys(value).sort().map(key => [key, canonical(value[key])])) : value
 const digest = value => sha(JSON.stringify(canonical(value)))
 const beneath = isPathWithin
+const exactVersion = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/u
 export const DSH_INSTALL_MAX_OUTPUT_BYTES = 1024 * 1024
 
 /** Install duration belongs to the native package manager, not a probe timer. */
@@ -181,7 +183,7 @@ async function readOwnedReceipt(path, state, profile, currentProduct) {
   assert.match(receipt.id ?? '', /^[0-9a-f-]{36}$/u)
   assert.equal(receipt.receiptPath, path)
   assert.equal(join(dirname(path), receipt.id + '.dsh-result.json'), path)
-  assert.equal(receipt.status, 'registered-config-parsed', 'Successful owned installation required')
+  assert.equal(receipt.status, 'registered-config-parsed', 'Successful owned installation required; inspect failed DSH state in the official host plugin manager instead of reapplying its plan or receipt')
   assert.equal(receipt.ownershipEstablished, true, 'Previous installation ownership was not established')
   assert.equal(receipt.exitCode, 0); assert.equal(receipt.partialStateRetained, false)
   assert.equal(receipt.userConfigurationPreserved, true)
@@ -448,6 +450,91 @@ export async function inspectDshInstallation(options) {
     runtimeMounted: false, bundleCycleVerified: false, releaseValidated: false }
 }
 
+async function workspaceSettings(bytes) {
+  if (bytes === null) return null
+  const { parseDocument } = await import('yaml')
+  const document = parseDocument(bytes.toString('utf8'), { uniqueKeys: true })
+  if (document.errors.length || document.warnings.length) return null
+  const value = document.toJS({ maxAliasCount: 100 })
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return null
+  const { minimumReleaseAgeExclude = [], ...settings } = value
+  if (!Array.isArray(minimumReleaseAgeExclude) || !minimumReleaseAgeExclude.every(item => typeof item === 'string')) return null
+  return { settings, exclusions: minimumReleaseAgeExclude }
+}
+
+// pnpm can merge pkg@old and pkg@new into pkg@old || new. Expand
+// only exact versions; keep user ranges and other rules opaque and unchanged.
+function releaseAgeSelectors(exclusions) {
+  const counts = new Map(), opaque = []
+  for (const value of exclusions) {
+    const match = /^(?<name>(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*)@(?<versions>.+)$/u.exec(value)
+    const versions = match?.groups.versions.split(/\s*\|\|\s*/u)
+    if (!versions?.every(version => exactVersion.test(version))) { opaque.push(value); continue }
+    for (const version of versions) {
+      const selector = `${match.groups.name}@${version}`
+      counts.set(selector, (counts.get(selector) ?? 0) + 1)
+    }
+  }
+  return { counts, opaque }
+}
+
+// Follow only exact runtime declarations in the selected installed aggregate.
+// Reading package metadata must not execute code or depend on package.json exports.
+async function installedExactSelectors(installed) {
+  const selectors = new Set(), visited = new Set()
+  async function visit(path, name, version) {
+    path = await realpath(path)
+    if (visited.has(path)) return
+    visited.add(path)
+    const bytes = await boundedFile(path), manifest = JSON.parse(bytes)
+    if (manifest.name !== name || manifest.version !== version) return
+    selectors.add(`${name}@${version}`)
+    const require = createRequire(path)
+    for (const [dependency, pin] of Object.entries({ ...manifest.dependencies, ...manifest.optionalDependencies })) {
+      if (!/^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/u.test(dependency) || !exactVersion.test(pin)) continue
+      for (const search of require.resolve.paths(dependency) ?? []) {
+        const candidate = join(search, dependency, 'package.json')
+        if (await regular(candidate, true) === null) continue
+        await visit(candidate, dependency, pin)
+        break
+      }
+    }
+  }
+  const path = join(installed.realPackageDir, 'package.json')
+  assert.equal(sha(await regular(path)), installed.manifestSha256, 'Installed aggregate metadata changed')
+  await visit(path, installed.name, installed.version)
+  return selectors
+}
+
+async function preservedConfigPins(before, after, workspaceBefore) {
+  const changedFiles = [...new Set([...Object.keys(before.configPins), ...Object.keys(after.configPins)])]
+    .filter(path => before.configPins[path] !== after.configPins[path])
+  const result = { preserved: changedFiles.length === 0, changedFiles, releaseAgeExclusionsAdded: [],
+    reason: changedFiles.length === 0 ? 'unchanged' : 'configuration-file-changed' }
+  const workspace = join(before.dir, 'pnpm-workspace.yaml')
+  if (changedFiles.length !== 1 || changedFiles[0] !== workspace || !after.installed) return result
+  try {
+    const bytes = await regular(workspace, true)
+    if (bytes === null || sha(bytes) !== after.configPins[workspace]) return result
+    const old = await workspaceSettings(workspaceBefore), current = await workspaceSettings(bytes)
+    if (!old || !current) return { ...result, reason: 'workspace-policy-unverified' }
+    if (!isDeepStrictEqual(old.settings, current.settings)) return { ...result, reason: 'workspace-settings-changed' }
+    const retained = releaseAgeSelectors(old.exclusions), observed = releaseAgeSelectors(current.exclusions)
+    if (!isDeepStrictEqual(retained.opaque, observed.opaque)
+      || [...retained.counts.keys()].some(selector => !observed.counts.has(selector)))
+      return { ...result, reason: 'existing-release-age-exclusions-changed' }
+    if ([...observed.counts].some(([selector, count]) => count > Math.max(1, retained.counts.get(selector) ?? 0))) return result
+    const added = [...observed.counts.keys()].filter(selector => !retained.counts.has(selector))
+    if (!added.length) return result
+    const exact = await installedExactSelectors(after.installed)
+    if (added.some(value => !exact.has(value))) return { ...result, reason: 'release-age-exclusion-outside-exact-dependencies' }
+    return { ...result, preserved: true, releaseAgeExclusionsAdded: added, reason: 'exact-dependency-release-age-exclusions-added' }
+  } catch {
+    // Unreadable or unsupported policy/metadata cannot justify a changed pin.
+    return { ...result, reason: 'workspace-policy-unverified' }
+  }
+}
+
 /** Runs only the pinned public CLI; retains partial state on failure, never rolls back. */
 export async function applyDshInstallation(plan, { adapter, signal, timeoutMs = 0, logDirectory } = {}) {
   plan = structuredClone(plan)
@@ -456,6 +543,9 @@ export async function applyDshInstallation(plan, { adapter, signal, timeoutMs =
   const state = await protocol(adapter)
   const fresh = await planDshInstallation({ ...plan, adapter })
   assert.equal(fresh.planSha256, plan.planSha256, 'Plan or profile changed; replan before execution')
+  const workspace = join(fresh.before.dir, 'pnpm-workspace.yaml')
+  const workspaceBefore = await regular(workspace, true)
+  assert.equal(workspaceBefore === null ? null : sha(workspaceBefore), fresh.before.configPins[workspace], 'Workspace changed; replan before execution')
   if (logDirectory !== undefined) {
     await safeDirectory(logDirectory)
     for (const root of [state.dshHome, plan.product?.npmRoot, plan.previous?.product.npmRoot,
@@ -475,20 +565,37 @@ export async function applyDshInstallation(plan, { adapter, signal, timeoutMs =
     catch (error) { diagnosticError = String(error.code ?? error.name) }
   }
   let readback = null, readbackError = null, userConfigurationPreserved = false
+  let configurationChanges = { preserved: false, changedFiles: [], releaseAgeExclusionsAdded: [], reason: 'readback-unverified' }
   try {
     readback = await inspectDshInstallation({ ...plan, adapter })
+    configurationChanges = await preservedConfigPins(plan.before, readback, workspaceBefore)
     userConfigurationPreserved = readback.foreignSha256 === plan.before.foreignSha256
-      && digest(readback.patches) === digest(plan.before.patches) && digest(readback.configPins) === digest(plan.before.configPins)
+      && digest(readback.patches) === digest(plan.before.patches) && configurationChanges.preserved
       && (plan.action !== 'update' || digest(readback.bundles) === digest(plan.before.bundles))
   } catch (error) { readbackError = error.message }
   const succeeded = exitCode === 0 && diagnosticError === null && userConfigurationPreserved && readback?.configurationParsed === true
+  const reasons = []
+  if (exitCode !== 0) reasons.push('native-command-' + execution.state)
+  if (diagnosticError !== null) reasons.push('command-log-unavailable')
+  if (readback === null) reasons.push('configuration-readback-failed')
+  else {
+    if (!userConfigurationPreserved) reasons.push('user-configuration-changed')
+    if (!readback.packageInstalled) reasons.push('package-not-installed')
+    if (!readback.bundleRegistered) reasons.push('bundle-not-registered')
+    if (!readback.configurationParsed) reasons.push('configuration-not-parsed')
+  }
+  const failure = succeeded ? null : { reasons, automaticRetry: false,
+    recovery: 'Inspect this receipt, its command logs and the retained profile in the official DSH Plugins interface. '
+      + 'Use the existing host plugin manager to inspect or repair package/bundle state after reviewing the cause. '
+      + 'Do not reapply this saved plan or use a failed receipt as previous ownership. DSH has no installer recover/adopt route; '
+      + 'a restart or an already-registered observation cannot repair failed transaction ownership. Keep existing projects and configuration.' }
   const ownershipEstablished = Boolean(succeeded && plan.product?.releaseSelection && (plan.previous
     || plan.action === 'install' && !plan.before.installed && !plan.before.registered && execution.state === 'completed'))
   return { schemaVersion: 2, kind: 'dsh-installation', host: 'dsh', route: 'official-dsh-bundle',
     product: plan.product, planSnapshot: plan, planSha256: plan.planSha256, operation: plan.action,
     ownershipEstablished, source: { expected: expectedSource(plan), observed: readback === null ? null : ownedState(readback) },
     registryAcquisitionVerified: false, scope: adapter.scope, status: succeeded ? 'registered-config-parsed' : 'failed-partial-state-retained',
-    exitCode, executionError, execution, diagnosticError, readbackError, readback, userConfigurationPreserved,
+    exitCode, executionError, execution, diagnosticError, readbackError, readback, userConfigurationPreserved, configurationChanges, failure,
     userConfigurationStatus: readback === null ? 'unverified' : userConfigurationPreserved ? 'observed-matching' : 'changed',
     rollbackAttempted: false, rollbackScope: 'adapter-only; official CLI may perform limited compatibility restoration', partialStateRetained: !succeeded,
     runtimeMounted: false, bundleCycleVerified: false, releaseValidated: false }

package/package.json

@@ -49,7 +49,8 @@
     "@huggingface/transformers": "3.8.1",
     "onnxruntime-common": "1.21.0",
     "undici": "8.10.2",
-    "trash": "10.1.1"
+    "trash": "10.1.1",
+    "yaml": "2.9.1"
   },
   "x-design-release-review": {
     "fixture": false,
@@ -78,5 +79,5 @@
     }
   },
   "name": "yugoo-design",
-  "version": "0.2.0"
+  "version": "0.2.3"
 }

package/payload/desktop-preparation/materials.json

@@ -14,7 +14,7 @@
     "qwenwork-template/NOTICE": "6b4eec391144fcbd96ec7b45a28764ab1932722a96325248377c3e28aac2c62d",
     "qwenwork-template/THIRD_PARTY_NOTICES.md": "bfcab921c6c15ccc47f9b1a6cc5941675c95962de5ea5b0edc50fbfa2aef136a",
     "qwenwork-template/authoring/studio-creators/index.md": "01eb453e4bcbd7cd104bdd9032a1c1d09c3a4de5b69982eaf18ae528c6a7ea37",
-    "qwenwork-template/authoring/studio-creators/material.json": "2a8c1ebe8b6fed2cea583f162ddbe5ec17350ed3a981d97d0cb395cbc5673466",
+    "qwenwork-template/authoring/studio-creators/material.json": "c2fdb30666942a942157c7f1e1a9ecfe542b87bf35b30412a6a541e584fac216",
     "qwenwork-template/authoring/studio-creators/source/.agents/skills/design-bundle-creator/SKILL.md": "99c0ddca35a9a65ca9b097ee9072994a1ca2a4848ef6fe3ca07f5f29956806ed",
     "qwenwork-template/authoring/studio-creators/source/.agents/skills/design-bundle-creator/agents/openai.yaml": "60da07d566f3c27a4f9d373d14473db1bbae82fa36f1ada035c6f9128d74bb00",
     "qwenwork-template/authoring/studio-creators/source/.agents/skills/design-bundle-creator/assets/skill.template.yaml": "d7a6c63460403c981a7a107f9a4a715919b8653ce5aa268ce6aecf100b925b59",
@@ -38,7 +38,7 @@
     "qwenwork-template/authoring/studio-creators/source/docs/bundle-contract.md": "aa4da3d9be862de30f70f5539061c7018144047e8bef9bcc37e54ca119a1767f",
     "qwenwork-template/authoring/studio-creators/source/docs/dsl-spec.md": "9d2897f48ff470d1a51d93af0b1d90b8173052f1a6e0380ba4629470dfdcfc5e",
     "qwenwork-template/authoring/studio-creators/source/docs/panel-uiux-standard.md": "37d3f5095fd4e7b62fb46a13375bc5b265e5ca4798f5016a0cba42ba9129c9b8",
-    "qwenwork-template/authoring/studio-creators/source/docs/system-design-baseline.md": "cb34d1c68576ada8d8626a653c46ac875e651e365f2db39e0ca305b6275f4e9a",
+    "qwenwork-template/authoring/studio-creators/source/docs/system-design-baseline.md": "eecd569936892c90d32d7822547972913d373ef42af2970ffdac9d38abb2cbe7",
     "qwenwork-template/authoring/studio-creators/source/docs/wiki/extending.md": "2774e855d86104dcf49559cbcf868b1083da0d39c669cec4d914c56b82852b3d",
     "qwenwork-template/authoring/studio-creators/source/docs/wiki/terminology.md": "e17ac6fd530861295dbf8f6fd7bc742f93fb32707cc19f377632c2352f9385a0",
     "qwenwork-template/authoring/studio-creators/source/examples/community-workshop-delivery/mindset.md": "647002e93e0ca4700ad167f08990a7360da148a46c0830b862769840c0dc93d8",
@@ -127,7 +127,7 @@
     "src/workbuddy-relay-service.mjs": "44d60d6956250417507fb76c71c3030a01bc38e565e4572a761b46f255f8e669",
     "src/workbuddy-ui-probes.mjs": "a91d4651248125769254755bdf66a44bbc9e5a793dad0a137c35acbb10a89a88",
     "studio-authoring-template/authoring/studio-creators/index.md": "01eb453e4bcbd7cd104bdd9032a1c1d09c3a4de5b69982eaf18ae528c6a7ea37",
-    "studio-authoring-template/authoring/studio-creators/material.json": "2a8c1ebe8b6fed2cea583f162ddbe5ec17350ed3a981d97d0cb395cbc5673466",
+    "studio-authoring-template/authoring/studio-creators/material.json": "c2fdb30666942a942157c7f1e1a9ecfe542b87bf35b30412a6a541e584fac216",
     "studio-authoring-template/authoring/studio-creators/source/.agents/skills/design-bundle-creator/SKILL.md": "99c0ddca35a9a65ca9b097ee9072994a1ca2a4848ef6fe3ca07f5f29956806ed",
     "studio-authoring-template/authoring/studio-creators/source/.agents/skills/design-bundle-creator/agents/openai.yaml": "60da07d566f3c27a4f9d373d14473db1bbae82fa36f1ada035c6f9128d74bb00",
     "studio-authoring-template/authoring/studio-creators/source/.agents/skills/design-bundle-creator/assets/skill.template.yaml": "d7a6c63460403c981a7a107f9a4a715919b8653ce5aa268ce6aecf100b925b59",
@@ -151,7 +151,7 @@
     "studio-authoring-template/authoring/studio-creators/source/docs/bundle-contract.md": "aa4da3d9be862de30f70f5539061c7018144047e8bef9bcc37e54ca119a1767f",
     "studio-authoring-template/authoring/studio-creators/source/docs/dsl-spec.md": "9d2897f48ff470d1a51d93af0b1d90b8173052f1a6e0380ba4629470dfdcfc5e",
     "studio-authoring-template/authoring/studio-creators/source/docs/panel-uiux-standard.md": "37d3f5095fd4e7b62fb46a13375bc5b265e5ca4798f5016a0cba42ba9129c9b8",
-    "studio-authoring-template/authoring/studio-creators/source/docs/system-design-baseline.md": "cb34d1c68576ada8d8626a653c46ac875e651e365f2db39e0ca305b6275f4e9a",
+    "studio-authoring-template/authoring/studio-creators/source/docs/system-design-baseline.md": "eecd569936892c90d32d7822547972913d373ef42af2970ffdac9d38abb2cbe7",
     "studio-authoring-template/authoring/studio-creators/source/docs/wiki/extending.md": "2774e855d86104dcf49559cbcf868b1083da0d39c669cec4d914c56b82852b3d",
     "studio-authoring-template/authoring/studio-creators/source/docs/wiki/terminology.md": "e17ac6fd530861295dbf8f6fd7bc742f93fb32707cc19f377632c2352f9385a0",
     "studio-authoring-template/authoring/studio-creators/source/examples/community-workshop-delivery/mindset.md": "647002e93e0ca4700ad167f08990a7360da148a46c0830b862769840c0dc93d8",