package: declare the entry file the market's update check requires (1.0.7)

The market's update path asks whether package.json points at an existing entry and rolls back when it does not; this manifest declared none, exactly as 2.0.5 fixed on main. index.mjs is a real but deliberately empty cordis plugin: the working row is still inserted by cordis.patch.yml. Not published - 1.x has no update path to trigger this - but the branch no longer carries the defect.

.github/workflows/validate.yml

@@ -25,10 +25,14 @@ jobs:
             const fail = (m) => { console.error('FAIL: ' + m); process.exit(1) };
             if (!p.dsh || !p.dsh.bundle || !p.dsh.bundle.patch) fail('package.json is missing dsh.bundle.patch');
             if (p.private) fail('package.json must not be private to be publishable');
-            for (const f of ['cordis.patch.yml', 'README.md', 'LICENSE', 'check-updates.ps1']) {
+            for (const f of ['cordis.patch.yml', 'index.mjs', 'README.md', 'LICENSE', 'check-updates.ps1']) {
               if (!p.files.includes(f)) fail('files[] must ship ' + f);
             }
             if (!require('fs').existsSync(p.dsh.bundle.patch)) fail('dsh.bundle.patch target does not exist');
+            // The market's update path rolls a build back when package.json points
+            // at no existing entry; this manifest declared none until 1.0.7.
+            if (typeof p.main !== 'string') fail('package.json must declare main');
+            if (!require('fs').existsSync(p.main)) fail('main points at no shipped file: ' + p.main);
             console.log('manifest ok');
           "
 
@@ -51,7 +55,7 @@ jobs:
             const meta = JSON.parse(execSync('npm pack --dry-run --json', { encoding: 'utf8' }))[0];
             const files = meta.files.map((f) => f.path);
             const need = [
-              'cordis.patch.yml', 'README.md', 'README.zh-CN.md', 'LICENSE', 'CHANGELOG.md', 'check-updates.ps1',
+              'cordis.patch.yml', 'index.mjs', 'README.md', 'README.zh-CN.md', 'LICENSE', 'CHANGELOG.md', 'check-updates.ps1',
               'screenshots.json', 'assets/screenshot-1.png', 'assets/screenshot-2.png',
               'examples/cordis.patch.posix.yml', 'examples/cordis.patch.with-env.yml',
             ];

CHANGELOG.md

@@ -2,6 +2,24 @@
 
 本插件遵循语义化版本。版本号变化说明「配置组合」这层的变化，与 REA 自身的版本无关。
 
+## 未发布（Unreleased）
+
+**1.0.7：补上入口文件，无运行时行为变更；待本线需要发版时一并发出。**
+
+- **清单声明 `main: ./index.mjs`**：市场的更新路径用包自身的入口（`main`/`exports`，都没有则回落
+  `index.js`）判断新构建能否加载，答案是否就回滚。本线同样是纯 bundle，从未声明入口，所以这层判定对 1.x
+  一样是 false —— 只是 1.x 已停更、没有「更新」这一步，问题没被触发。2.x 的 2.0.5 已核实并修掉同一个缺陷
+  （详见 main 分支 CHANGELOG），本分支同步结构修复。`index.mjs` 是真空插件：不注册行、不起进程，真正起作用
+  的行仍由 `cordis.patch.yml` 插入。
+
+**文档跟进，无行为变更，本分支不重新发版。**
+
+- 上游 REA 已发布 **6.5.0**（`rea doctor --json` 在真机实测 207 个工具；6.4.0 时为 170）。1.x 通过
+  `npm i -g rea-agents@latest` 使用 REA，**代码无需改动**：版本钉在一体包线（2.x）的 manifest 里，
+  那条线才是「装一个插件就自带运行时」的形态。
+- 两份 README 与 `assets/make-screenshots.ps1` 里的版本号/工具数已按上述实测更新。两张展示图**未重新生成**
+  （本分支不再发布，图仍是 1.0.6 时渲染的；脚本正文已是新数字，将来真要出图时跑一次即可）。
+
 ## 1.0.6 — 2026-10-13
 
 文档结构调整，无行为变更。

README.md

@@ -4,6 +4,12 @@
 
 **English** · [简体中文](README.zh-CN.md)
 
+> **2.x is the default line.** This `v1` branch is the configuration-only adapter, kept for people
+> who already manage REA and Ghidra themselves. The self-provisioning line lives on
+> [`main`](https://github.com/czcdr/dsh-plugin-rea/tree/main), and that is what `npm i dsh-plugin-rea`
+> installs. Upstream REA 6.5.0 can also register itself with dsh (`rea setup --client dsh`) — the same
+> configuration-only model, maintained upstream. Pick one of the three, never two at once.
+
 Brings the upstream **[REA — Reverse Engineer Anything](https://github.com/morluto/rea)** MCP server into
 **DeepSeek Harness** (dsh), so its tools show up in a session as `mcp__rea__*`.
 ![dsh-plugin-rea: a session calls the local rea mcp through the official MCP client row, and the Evidence comes back](assets/screenshot-1.png)
@@ -49,7 +55,7 @@ Author's machine, 2026-10-12/13:
 
 | Component | Version |
 |---|---|
-| REA (`rea-agents`) | **6.4.0** |
+| REA (`rea-agents`) | **6.5.0** |
 | DeepSeek Harness | desktop runtime **0.2.0-rc.2**, with its bundled dsh CLI 0.1.7-rc.2 |
 | `@deepseek-ai/dsh-mcp-client` (row provider) | bundled by the harness; npm latest `0.0.1-rc.1` |
 | Ghidra | 12.1.4 (REA currently accepts 12.1.x) |
@@ -119,7 +125,7 @@ Ask for a `mcp__rea__*` call — `binary_session` reports the engine checks
 
 ## Scope and caveats
 
-REA exposes 170+ tools at 6.4.0, so every session's tool list grows; the row sets
+REA exposes 207 tools at 6.5.0, so every session's tool list grows; the row sets
 `failOnStartupError: false` so a missing REA never blocks harness startup. Some REA tools launch processes,
 write files and access the network — DSH's permission policy applies. Analyse only artifacts you are
 authorized to inspect.

README.zh-CN.md

@@ -4,6 +4,11 @@
 
 [English](README.md) · **简体中文**
 
+> **2.x 才是默认线。** 这条 `v1` 分支是纯配置适配器，留给已经自己管理 REA 与 Ghidra 的人。自供给线在
+> [`main`](https://github.com/czcdr/dsh-plugin-rea/tree/main)，`npm i dsh-plugin-rea` 装到的也是它。
+> 上游 REA 6.5.0 起也能自己注册进 dsh（`rea setup --client dsh`）—— 同一种纯配置模式，由上游维护。
+> 三条路选一条，不要同时用两条。
+
 把上游 **[REA — Reverse Engineer Anything](https://github.com/morluto/rea)** 的 MCP 服务接入
 **DeepSeek Harness**（dsh），让它的工具在会话里以 `mcp__rea__*` 出现。
 
@@ -48,7 +53,7 @@
 
 | 组件 | 版本 |
 |---|---|
-| REA（`rea-agents`） | **6.4.0** |
+| REA（`rea-agents`） | **6.5.0** |
 | DeepSeek Harness | 桌面运行时 **0.2.0-rc.2**，自带 dsh CLI 0.1.7-rc.2 |
 | `@deepseek-ai/dsh-mcp-client`（行提供方） | 由 harness 自带；npm 最新 `0.0.1-rc.1` |
 | Ghidra | 12.1.4（REA 当前接受 12.1.x） |
@@ -116,7 +121,7 @@ dsh plugin --profile <profile> add dsh-plugin-rea
 
 ## 范围与注意
 
-REA 在 6.4.0 暴露 170+ 个工具，注入后每个会话的工具列表都会变大；行内设置
+REA 在 6.5.0 暴露 207 个工具，注入后每个会话的工具列表都会变大；行内设置
 `failOnStartupError: false`，因此 REA 缺失也不会阻塞 harness 启动。部分 REA 工具会启动进程、
 写文件、访问网络，按 DSH 的权限策略执行。请仅分析你已获得授权的目标。
 

assets/make-screenshots.ps1

@@ -78,7 +78,7 @@ Draw-Text $g '第三方适配 · 自身不做逆向分析 · 只插入一条 MCP
 $rowY = 180; $boxH = 158; $boxW = 250
 Draw-Box $g 60 $rowY $boxW $boxH $([System.Drawing.Color]::White) $line
 Draw-Text $g 'DeepSeek Harness 会话' $fBox $ink 80 ($rowY + 18)
-Draw-Text $g "mcp__rea__* 工具`n（6.4.0 暴露 170+）`n工具随会话注入`n按 DSH 权限策略执行" $fBody $muted 80 ($rowY + 50)
+Draw-Text $g "mcp__rea__* 工具`n（6.5.0 暴露 207）`n工具随会话注入`n按 DSH 权限策略执行" $fBody $muted 80 ($rowY + 50)
 
 Draw-Box $g 360 $rowY $boxW $boxH $([System.Drawing.Color]::FromArgb(255,239,246,255)) $accent
 Draw-Text $g '官方 MCP 客户端行' $fBox $accent 380 ($rowY + 18)
@@ -106,7 +106,7 @@ Draw-Line  $g 358 446 150 446 $muted
 Draw-Arrow $g 150 446 150 342 $muted
 
 Draw-Text $g '上游 REA（MIT）：github.com/morluto/rea      本插件：github.com/czcdr/dsh-plugin-rea' $fSmall $muted 60 620
-Draw-Text $g '实测 REA 6.4.0 + DSH 桌面运行时 0.2.0-rc.2 + Ghidra 12.1.4 + Node 24.21.0（Windows 11 x64，2026-10-12）' $fSmall $muted 60 646
+Draw-Text $g '实测 REA 6.5.0 + DSH 桌面运行时 0.2.0-rc.2 + Ghidra 12.1.4 + Node 24.21.0（Windows 11 x64，2026-10-16）' $fSmall $muted 60 646
 Draw-Text $g 'Ghidra 为 Apache-2.0（NSA）；REA 为 MIT。本仓库不分发上游代码。' $fSmall $muted 60 672
 Save-Png $bmp $g (Join-Path $OutDir 'screenshot-1.png')
 

index.mjs

@@ -0,0 +1,24 @@
+/**
+ * Package entry — the smallest thing that makes this adapter a *loadable* package.
+ *
+ * Everything the 1.x line does is in `cordis.patch.yml`: it inserts one row of
+ * `@deepseek-ai/dsh-mcp-client` that launches the `rea mcp` you installed
+ * yourself. This file registers nothing and starts nothing.
+ *
+ * It exists because a package that declares no `main`/`exports` is judged by its
+ * consumers as "has no entry file", whether or not the loader ever needs one. On
+ * 2.x that judgement broke market updates outright (see that branch's CHANGELOG);
+ * the same check applies here, so this manifest declares the same entry rather
+ * than repeating the defect. The harness still never loads this file for its own
+ * sake — the row is inserted by the patch, not by this module.
+ */
+
+/** Cordis plugin name. Also the package name, which is what the loader expects. */
+export const name = 'dsh-plugin-rea'
+
+/**
+ * Intentionally empty: registering the MCP client here would add a second
+ * `serverName: rea` row on top of the one the patch inserts, and the harness
+ * refuses duplicates. Doing nothing is the contract.
+ */
+export function apply() {}

package.json

@@ -1,8 +1,9 @@
 {
   "name": "dsh-plugin-rea",
-  "version": "1.0.6",
+  "version": "1.0.7",
   "description": "Registers the upstream REA MCP server into DeepSeek Harness as mcp__rea__* tools — a third-party adapter, analysis is upstream's. · 把上游 REA 的 MCP 服务接入 DeepSeek Harness，提供 mcp__rea__* 工具（第三方适配，分析能力属上游）。",
   "type": "module",
+  "main": "./index.mjs",
   "license": "MIT",
   "author": "czcdr",
   "homepage": "https://github.com/czcdr/dsh-plugin-rea",
@@ -29,6 +30,7 @@
   ],
   "files": [
     "cordis.patch.yml",
+    "index.mjs",
     "README.md",
     "README.zh-CN.md",
     "LICENSE",