chore(integration): combine reviewed issue fixes

.github/required-ci-ruleset.json

@@ -0,0 +1,33 @@
+{
+  "name": "Require validated pull requests",
+  "target": "branch",
+  "enforcement": "active",
+  "bypass_actors": [],
+  "conditions": {
+    "ref_name": {
+      "include": ["refs/heads/main", "refs/heads/0.3.2", "refs/heads/release/0.4.0"],
+      "exclude": []
+    }
+  },
+  "rules": [
+    {
+      "type": "pull_request",
+      "parameters": {
+        "dismiss_stale_reviews_on_push": false,
+        "require_code_owner_review": false,
+        "require_last_push_approval": false,
+        "required_approving_review_count": 0,
+        "required_review_thread_resolution": false
+      }
+    },
+    {
+      "type": "required_status_checks",
+      "parameters": {
+        "required_status_checks": [{ "context": "CI required", "integration_id": 15368 }],
+        "strict_required_status_checks_policy": true,
+        "do_not_enforce_on_create": false
+      }
+    },
+    { "type": "non_fast_forward" }
+  ]
+}

.github/workflows/ci.yml

@@ -6,11 +6,9 @@ on:
   # staging branch before the final release PR.
   push:
     branches: [main, 0.3.2, release/0.4.0]
-  # And a pull request has to show its result before it is merged, not after. GitHub reads this
-  # file from the pull request's own head, so listing the release branch here is what makes a
-  # pull request against a release branch run the gate at all.
+  # Every PR needs evidence, including stacked changes targeting a feature branch.
+  # No target-branch or path filter: an omitted run cannot satisfy CI required.
   pull_request:
-    branches: [main, 0.3.2, release/0.4.0]
   # A merge queue builds the queued commits before they reach `main`, and it only accepts a group
   # whose required checks passed there. Without this trigger the workflow simply never runs for a
   # queued group, so enabling a merge queue would silently un-gate every merge.
@@ -37,8 +35,8 @@ concurrency:
   # because a half-built release branch is worse than a queued one.
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 jobs:
-  # The POSIX legs are the gate: a red Linux or macOS run fails `ci-required` and blocks the merge.
-  # Windows is split into its own, non-blocking job directly below (#316).
+  # The blocking POSIX legs are Linux x64 and macOS arm64: a red one fails `ci-required`.
+  # macOS Intel and Windows are separate non-blocking signals below (#316).
   validate-posix:
     strategy:
       fail-fast: false
@@ -103,6 +101,56 @@ jobs:
           if-no-files-found: error
           retention-days: 7
 
+  # macOS Intel is a signal, not a gate: this leg measured 318 s on the PR run that added
+  # it, past the approved ">300 s -> non-blocking" line (#316). It still runs on every push,
+  # pull request and merge group, and uploads the darwin-x64 artifact for the release job.
+  validate-macos-intel:
+    runs-on: macos-15-intel
+    continue-on-error: true
+    timeout-minutes: 35
+    env:
+      CARGO_BUILD_JOBS: '3'
+      DSH_OPS_SUITE_TIMEOUT_MS: '300000'
+      DSH_OPS_RETRY_TIMEOUTS: '1'
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          # The provenance regression verifies exact blobs from the pinned 0.3.1 commit.
+          fetch-depth: 0
+      - uses: actions/setup-node@v7
+        with:
+          node-version: '24'
+      - name: Verify runner identity
+        run: node -e "if(process.platform+'-'+process.arch!=='darwin-x64')throw Error('Unexpected runner'); console.log(process.platform,process.arch)"
+      - name: Set up pinned Rust
+        shell: bash
+        run: rustup toolchain install 1.97.1 --profile minimal && rustup default 1.97.1
+      - name: Reuse exact locked Rust build cache
+        uses: actions/cache@v6
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            native/target
+          key: ops-031-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('native/Cargo.lock') }}
+          restore-keys: ops-031-${{ runner.os }}-${{ runner.arch }}-
+      - name: Install locked dependencies
+        run: npm ci --ignore-scripts --registry=https://registry.npmjs.org
+      - name: Functional gate (skips, suite inventory, packed artifact)
+        shell: bash
+        run: node scripts/verify-gate.mjs --skip-install
+      - name: Verify native staged closure
+        run: node bin/native-runtime.mjs check --platform darwin-x64
+      - name: Check shell payload platform filtering
+        shell: bash
+        run: node -e "const fs=require('fs');if(process.platform!=='win32'){for(const n of ['bash','pwsh'])if(fs.existsSync('node_modules/@dsh-ops/'+n+'-win32-x64'))throw Error('Windows shell installed on POSIX')}"
+      - uses: actions/upload-artifact@v7
+        with:
+          name: native-darwin-x64
+          path: runtime/darwin-x64/
+          if-no-files-found: error
+          retention-days: 7
+
   # Windows still runs on every push, pull request and merge group — it is never skipped — but its
   # result is a **signal, not a gate**. The job is `continue-on-error: true`, and `ci-required` does
   # not list it in `needs`, so the aggregate neither waits for it nor fails with it. That is what
@@ -238,8 +286,9 @@ jobs:
           retention-days: 7
 
   # The bench smoke: `workflow_dispatch` only, off by default, and informational (like `tools-trial`
-  # above). One platform is enough, because it exercises the harness rather than the platform — the
-  # `validate-posix` matrix is the gate and `validate-windows` its non-blocking counterpart. Both
+  # above). Three host platforms exercise the portable harness; the
+  # `validate-posix` matrix is the gate, with `validate-windows` and `validate-macos-intel` as
+  # non-blocking counterparts. Both
   # sides are the *same* staged worker, so the run
   # proves only what a harness self-check can prove: the corpus builds and is removed, the worker
   # answers identically twice, and every query lands on `MATCH` or a declared `EXPECTED_*`. It cannot
@@ -248,7 +297,20 @@ jobs:
   # **never** run in CI.
   bench-smoke:
     if: ${{ github.event_name == 'workflow_dispatch' && inputs.bench }}
-    runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-24.04
+            target: linux-x64
+            worker: dsh-ops-worker
+          - os: windows-latest
+            target: win32-x64
+            worker: dsh-ops-worker.exe
+          - os: macos-latest
+            target: darwin-arm64
+            worker: dsh-ops-worker
+    runs-on: ${{ matrix.os }}
     continue-on-error: true
     timeout-minutes: 30
     env:
@@ -293,7 +355,7 @@ jobs:
       - name: Tool-level comparison, one binary on both sides
         shell: bash
         run: |
-          worker="runtime/linux-x64/dsh-ops-worker"
+          worker="runtime/${{ matrix.target }}/${{ matrix.worker }}"
           mkdir -p bench/runs/smoke/fixtures
           node bench/cli.mjs tools \
             --baseline "$worker" --candidate "$worker" \
@@ -309,7 +371,7 @@ jobs:
       - uses: actions/upload-artifact@v7
         if: always()
         with:
-          name: bench-smoke-report
+          name: bench-smoke-${{ matrix.target }}-report
           path: |
             bench/runs/smoke/**
             bench/runs/*/run.json
@@ -383,7 +445,8 @@ jobs:
   # names in sync — and silently losing the gate when a runner label changes. This job collapses them.
   #
   # It waits **only** on blocking jobs. Every `continue-on-error: true` job — `validate-windows`,
-  # `tools-trial`, `bench-smoke` — is deliberately absent from `needs` and from the loop below:
+  # `validate-macos-intel`, `tools-trial`, `bench-smoke` — is deliberately absent from `needs` and
+  # from the loop below:
   # listing one here would keep the required check pending until that job finished, which is a gate
   # in everything but name. `scripts/check-workflows.mjs` enforces both halves of that rule.
   ci-required:
@@ -410,7 +473,7 @@ jobs:
           done
           # Not in `needs` on purpose: this check must never wait for them, so their result is not
           # available here. Read them on their own jobs; a red one is a signal, not a merge blocker.
-          echo "validate-windows, tools-trial, bench-smoke: non-blocking (continue-on-error), not waited on by this check"
+          echo "validate-windows, validate-macos-intel, tools-trial, bench-smoke: non-blocking (continue-on-error), not waited on by this check"
           if [ "$failed" != 0 ]; then
             echo "::error::a blocking job did not succeed; read the failing job above"
             exit 1

.github/workflows/release.yml

@@ -26,8 +26,8 @@ name: Release
 # checksum manifest (docs/PROVENANCE.md), not a second, unmaintained mechanism, and an
 # attestation would need `id-token: write` / `attestations: write` on the repository.
 #
-# SCOPE: exactly the three declared targets in lib/ptc/runtime.js — win32-x64,
-# linux-x64, darwin-arm64. Intel macOS, Windows arm64 and Linux arm64 are outside the
+# SCOPE: exactly the four declared targets in lib/ptc/runtime.js — win32-x64,
+# linux-x64, darwin-arm64 and darwin-x64. Windows arm64 and Linux arm64 are outside the
 # matrix; `bin/native-runtime.mjs` refuses them, and `bin/check-release.mjs` fails the
 # run if any other target appears under `runtime/`.
 on:
@@ -57,6 +57,7 @@ jobs:
           - { runner: windows-latest, target: win32-x64, triple: x86_64-pc-windows-msvc }
           - { runner: ubuntu-24.04, target: linux-x64, triple: x86_64-unknown-linux-gnu }
           - { runner: macos-latest, target: darwin-arm64, triple: aarch64-apple-darwin }
+          - { runner: macos-15-intel, target: darwin-x64, triple: x86_64-apple-darwin }
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 45
     env:
@@ -166,6 +167,11 @@ jobs:
           name: native-darwin-arm64
           path: runtime/darwin-arm64
 
+      - uses: actions/download-artifact@v8
+        with:
+          name: native-darwin-x64
+          path: runtime/darwin-x64
+
       - name: Prepare the host worker for functional suites
         # Boundary suites intentionally resolve their checkout-local host build.
         # This build is test-only; the staged release runtimes remain the cold matrix artifacts.
@@ -184,7 +190,7 @@ jobs:
         # Publishing must not start before this step is green — it is the only reason
         # the `publish` job sits behind `needs`. `verify:release` is
         # `validate-manifest` + the full repository suite + `bin/check-release.mjs`,
-        # which demands all three declared targets, matches every receipt hash against
+        # which demands all four declared targets, matches every receipt hash against
         # the staged bytes, and re-checks the Windows IPC binary and source digests.
         # A partial download, a foreign-architecture binary, a stale receipt or a
         # manifest/target disagreement fails here instead of shipping.

README.en.md

@@ -25,6 +25,9 @@ OPS adds bounded file and document tools to DSH. Native mode returns compact, li
 PTC code receives typed Outcome values from the same one-shot Rust worker. Host integration is
 strict TypeScript, compiled to the existing JavaScript package paths.
 
+Supported: Windows x64, Linux x64, and macOS 13+ on Apple Silicon or Intel
+(`darwin-arm64`, `darwin-x64`). See [macOS](docs/macos.md).
+
 > [!IMPORTANT]
 > This branch is the **0.4.0 release candidate**, not a published release. Approved acceptance requires
 > at least 40% less BM-01 output than OPS 0.3.x; the official reader is a separate comparison.
@@ -97,6 +100,10 @@ A regular DSH CLI cannot manage the reserved `desktop` profile; do not confuse i
 
 #### Update
 
+Host compatibility is declared for DSH **0.2.0-rc.2 and 0.2.1-rc.2**. See
+[host versions and display metadata](docs/usage.md#host-compatibility-and-display-metadata)
+for component icon exports, profile refresh and config/schema checks.
+
 Re-run the same `npx --yes dsh-ops@latest install --profile ...`, or use the official CLI `add dsh-ops@latest`. Reload when the app asks; restart the app when replacing code that is already loaded.
 
 #### Uninstall and status
@@ -166,4 +173,4 @@ Versions before 0.3.2 bundled and distributed [yc-duan](https://github.com/yc-du
 
 ## Star trend
 
-[![Star trend chart](https://api.star-history.com/svg?repos=T-Auto/dsh-ops&type=Date)](https://star-history.com/#T-Auto/dsh-ops&Date)
+[![Star trend chart](https://api.star-history.com/svg?repos=T-Auto/dsh-ops&type=Date)](https://star-history.com/#T-Auto/dsh-ops&Date)

README.md

@@ -75,6 +75,10 @@ dsh plugin --profile dsh-tui add dsh-ops
 
 #### 更新方法
 
+宿主兼容范围明确声明为 DSH **0.2.0-rc.2 与 0.2.1-rc.2**。
+组件图标导出、profile 刷新及配置/schema 检查见
+[宿主兼容范围与展示元数据](docs/使用指南.md#宿主兼容范围与展示元数据)。
+
 重新运行相同的 `npx --yes dsh-ops@latest install --profile ...`，或用官方 CLI `add dsh-ops@latest`。按应用提示重载；替换已加载代码时重启应用。
 
 #### 卸载与查看状态

README.zh.md

@@ -23,6 +23,8 @@
 
 OPS 为 DSH 增加有界文件与文档工具。Native 模式返回紧凑、带行号的文本；PTC 代码从同一个按调用启动的 Rust worker 获取类型化 Outcome。宿主集成使用严格 TypeScript，编译后保持已有 JavaScript 包路径。
 
+支持：Windows x64、Linux x64，以及 macOS 13+ 的 Apple Silicon 与 Intel（`darwin-arm64`、`darwin-x64`）。见 [macOS](docs/macos.zh.md)。
+
 > [!IMPORTANT]
 > 本分支是 **0.4.0 发布候选**，尚未发布。已批准的验收范围为：BM-01 相比 OPS 0.3.x 输出减少至少 40%，官方读取另列对照；BM-03 对文件/发现 schema 执行 400 token 上限，同时保留 Bash 启动常驻并单列完整总数。最终实测证据与功能 CI 缺一不可。
 > 详情见[发布状态与限制](docs/0.4.0发布候选.md)。下方 `@latest` 命令安装已发布版本；评估候选版本需自行构建本检出目录并打包。
@@ -77,6 +79,10 @@ dsh plugin --profile dsh-tui add dsh-ops
 
 #### 更新方法
 
+宿主兼容范围明确声明为 DSH **0.2.0-rc.2 与 0.2.1-rc.2**。
+组件图标导出、profile 刷新及配置/schema 检查见
+[宿主兼容范围与展示元数据](docs/使用指南.md#宿主兼容范围与展示元数据)。
+
 重新运行相同的 `npx --yes dsh-ops@latest install --profile ...`，或用官方 CLI `add dsh-ops@latest`。按应用提示重载；替换已加载代码时重启应用。
 
 #### 卸载与查看状态