build(sdk): 改为锁定官方发布的 Node.js SDK 0.3.0 并发布 0.1.3 预发布

.github/workflows/ci.yml

@@ -33,7 +33,7 @@ jobs:
           LITHE_CARGO_INTEGRATION: '1'
         run: |
           mkdir -p .artifacts
-          node scripts/verify-sdk.mjs
+          node scripts/verify-sdk.mjs --download
           node scripts/test.mjs
       - name: Assemble package
         run: node scripts/package.mjs

.github/workflows/release.yml

@@ -44,7 +44,7 @@ jobs:
         env:
           LITHE_CARGO_INTEGRATION: '1'
         run: |
-          node scripts/verify-sdk.mjs
+          node scripts/verify-sdk.mjs --download
           if [ -f scripts/test.mjs ]; then
             node scripts/test.mjs
           else
@@ -69,15 +69,33 @@ jobs:
           cat > "$RUNNER_TEMP/notes.md" <<'NOTES'
           macOS Cargo integration for a Lithe preview with API 3 buildSystems 1, executableResolution 1, settings 2, buildProviders 1, serverProcess 1 and structured plugin diagnostics (litheLogging 1). Stable Lithe 0.6.7 does not offer litheLogging 1 and cannot start this version; keep using 0.1.1 there.
 
-          Changes in 0.1.2:
-          - Structured diagnostics: the bundled Node SDK records one INFO for each successful metadata request and one ERROR for each failure on the plugins/io.github.lithe-idea.cargo-build/host channel of Lithe's log window, with duration and a stable failure code. Cargo output, metadata JSON, source and environment values never enter the log. The duplicate raw stderr and JSON error logging is removed.
-          - The Cargo path setting becomes the first of the host's ordered executable candidates (executableResolution 1), ahead of PATH discovery. A missing, non-executable or too-old selection still fails instead of falling back.
+          Changes in 0.1.3:
+          - The bundled Node.js SDK is now the officially released SDK 0.3.0, pinned by tag (sdk-node-v0.3.0) and SHA-256 in sdk.lock.json instead of a local copy. The vendored files are the release's files without local edits. Plugin behavior is unchanged.
+          - It still requires a Lithe preview build offering litheLogging 1; stable Lithe 0.6.7 users stay on 0.1.1.
 
           Requires Cargo 1.70+ and Node.js 20.3+. Not listed in Lithe Store yet; download the ZIP and install it from disk.
 
           Preview status: automated integration and contract checks pass; native installation and full UI acceptance are pending. Windows is not supported. Published ZIP bytes must not be replaced.
           NOTES
           gh release create "$RELEASE_TAG" dist/*.zip dist/*.sha256 --verify-tag --prerelease --title "Cargo $RELEASE_TAG" --notes-file "$RUNNER_TEMP/notes.md"
+      - name: Require the release to be a prerelease
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          # Every release of this workflow needs a host offering litheLogging 1,
+          # so it must stay a prerelease: Lithe Store skips prereleases. A
+          # release has ended up as a normal one despite --prerelease before,
+          # so read the flag back, correct it, and fail if it still is not set.
+          is_prerelease() { gh release view "$RELEASE_TAG" --json isPrerelease --jq .isPrerelease; }
+          if [ "$(is_prerelease)" != "true" ]; then
+            echo "::warning::Release $RELEASE_TAG is not marked as a prerelease; correcting it."
+            gh release edit "$RELEASE_TAG" --prerelease
+            if [ "$(is_prerelease)" != "true" ]; then
+              echo "::error::Release $RELEASE_TAG is still not marked as a prerelease."
+              exit 1
+            fi
+          fi
+          echo "Release $RELEASE_TAG is a prerelease."
       - uses: actions/upload-artifact@v4
         if: always()
         with:

NOTICE

@@ -2,10 +2,12 @@ Cargo build plugin for Lithe
 Copyright 2026 Lithe contributors
 
 This project includes the Apache-2.0 licensed Lithe Node plugin SDK and
-test support. The SDK comes from Lithe-IDEA/lithe-plugin-docs; historical
-test support comes from 1lck/Lithe-IDEA. Exact upstream paths, Git revisions
-and SHA-256 hashes are recorded in sdk.lock.json. The SDK is copied into
-the plugin at build time; test support is never shipped in the package.
+test support. The SDK is the released Node.js SDK 0.3.0 from
+Lithe-IDEA/lithe-plugin-docs (tag sdk-node-v0.3.0); test support comes from
+the Lithe host repository. Exact upstream paths, release archive SHA-256, Git
+revisions and per-file SHA-256 hashes are recorded in sdk.lock.json. The SDK is
+copied into the plugin at build time; test support is never shipped in the
+package.
 
 Cargo, Rust and Node.js are user-provided tools and are not redistributed.
 

README.md

@@ -3,25 +3,27 @@
 Cargo is a community build plugin for Lithe. It uses Lithe's native Cargo
 tool window and Build Output to build, check, test, clean, and run Rust projects.
 
-**0.1.2 is a preview release.** Native disk-installation and full UI acceptance
+**0.1.3 is a preview release.** Native disk-installation and full UI acceptance
 are still pending. Automated integration and host compatibility run in this
 repository's CI.
 The plugin requires a Lithe preview with API 3 `buildSystems: 1`, `executableResolution: 1`, `settings: 2`,
 `buildProviders: 1`, `serverProcess: 1` and structured plugin diagnostics (`litheLogging: 1`).
-Stable Lithe 0.6.7 does not offer `litheLogging: 1` and cannot start 0.1.2. Windows is not supported yet.
+Stable Lithe 0.6.7 does not offer `litheLogging: 1` and cannot start 0.1.3. Windows is not supported yet.
+It uses the released Node.js SDK 0.3.0, pinned by tag and SHA-256 in `sdk.lock.json`;
+that SDK reports structured diagnostics and so needs a Lithe build offering `litheLogging: 1`.
 
 ## Install
 
 Install Rust/Cargo 1.70+ and Node.js 20.3+ first. Node runs the metadata provider;
 Cargo and rust-analyzer are not bundled. Existing Rust language intelligence
 continues to use Lithe's Rust language service.
 
-Download `cargo-build-0.1.2-darwin.zip` from [Releases](https://github.com/Lithe-IDEA/lithe-plugin-cargo/releases).
+Download `cargo-build-0.1.3-darwin.zip` from [Releases](https://github.com/Lithe-IDEA/lithe-plugin-cargo/releases).
 Hosts without `litheLogging: 1` can keep using the 0.1.1 preview, which keeps its older host requirements.
 In Lithe, choose Settings → Plugins → Install from Disk, select the ZIP,
 review Cargo/Node and its permissions, and restart. Enable Cargo, open the
 Cargo workspace root, then open the Cargo tool window and load the project model.
-0.1.2 is not listed in [Lithe Store](https://github.com/Lithe-IDEA/Lithe-store) yet: the Store cannot
+0.1.3 is not listed in [Lithe Store](https://github.com/Lithe-IDEA/Lithe-store) yet: the Store cannot
 tell stable hosts without `litheLogging: 1` apart, so install it from disk.
 
 ## Cargo path
@@ -34,7 +36,7 @@ same executable. A missing, non-executable or too-old selection fails visibly
 instead of silently choosing a different Cargo installation. The executable's
 parent directory is placed first on PATH for companion tools.
 
-Version 0.1.2 requires a preview host with `buildSystems: 1`, `executableResolution: 1`, `settings: 2` and `litheLogging: 1`.
+Version 0.1.3 requires a preview host with `buildSystems: 1`, `executableResolution: 1`, `settings: 2` and `litheLogging: 1`.
 Its exact tested host revision is recorded in `sdk.lock.json`; older hosts keep
 using the compatible 0.1.0 release through the Store. Existing published ZIPs
 are immutable and are never replaced.
@@ -60,8 +62,8 @@ members or target sources outside the selected build root are refused. The host'
 
 ## Diagnostic logs
 
-Version 0.1.2 requires a host offering `litheLogging: 1`. The vendored official
-Node SDK sends typed `lithe/log` notifications to the host's v2 catalog and
+Version 0.1.3 requires a host offering `litheLogging: 1`. The vendored official
+Node SDK 0.3.0 sends typed `lithe/log` notifications to the host's v2 catalog and
 writer, in the current session's
 `plugins/io.github.lithe-idea.cargo-build/host` channel. The SDK records one
 INFO terminal on a successful metadata request and one ERROR on a failed
@@ -73,9 +75,9 @@ or raw exceptions into logs.
 Build, check, test and run process outcomes use the host's `run` channel;
 their output stays in Build Output. Use Lithe's log window and diagnostic
 export for host evidence. No plugin writer, log directory or idle task is
-added. The SDK source base revision and local logging changes are identified
-by `sdk.lock.json`, including exact file hashes; they do not claim a released
-SDK artifact. Windows still uses v1 logging; no Windows v2 acceptance is claimed.
+added. The vendored SDK files are byte-identical to the released Node.js SDK
+0.3.0 archive, as pinned by `sdk.lock.json`. Windows still uses v1 logging; no
+Windows v2 acceptance is claimed.
 
 ## Develop and verify
 
@@ -88,11 +90,14 @@ node scripts/test.mjs
 node scripts/package.mjs
 ```
 
+`node scripts/verify-sdk.mjs --download` additionally downloads the released SDK
+archive, checks its SHA-256 against `sdk.lock.json` and requires every vendored
+SDK file to match the archive byte for byte. CI and release verification run it.
+
 Full integration compiles a test-only bridge to Lithe's public `execute_json`
 API. CI uses the host repository and `preview` ref in `sdk.lock.json.coreSource`,
-then records the exact resolved commit and source digest. The companion host
-logging change must land first. See **Core integration source** below for
-verified local working-tree preparation and the complete command.
+then records the exact resolved commit and source digest. See **Core integration
+source** below for verified local working-tree preparation and the complete command.
 
 Cargo downloads the host's locked Rust dependencies on the first build;
 the Cargo fixture itself runs offline. `.artifacts/core-target` contains only
@@ -113,13 +118,21 @@ is `dist/io.github.lithe-idea.cargo-build/`. The archive serves both Apple Silic
 and Intel Macs. CI builds on Linux to conserve native runner usage; the local
 integration suite was also run on macOS.
 
-The zero-dependency Node SDK comes from `Lithe-IDEA/lithe-plugin-docs` at the
-base revision and local structured logging changes recorded in `sdkSource`.
-Historical test helpers retain their original source identity. Every vendor
-file has an exact SHA-256; packaging refuses changed or unpinned inputs and
-symbolic links. The separate `coreSource` chooses the integration host preview,
-so SDK provenance is never confused with the host's current source identity.
-No SDK or runtime is downloaded when the installed plugin starts.
+The zero-dependency Node SDK is the released Node.js SDK 0.3.0 from
+`Lithe-IDEA/lithe-plugin-docs`: `sdk.lock.json.sdk` pins its tag
+`sdk-node-v0.3.0`, commit, release asset URL and SHA-256, and vendors the files
+unchanged. The SDK test harness is not part of the release asset; it is pinned
+to the same tagged commit. Test-support helpers keep their own source revision
+(`testSupport`). Every vendor file has an exact SHA-256; packaging refuses
+changed or unpinned inputs and symbolic links. The separate `coreSource` chooses
+the integration host preview, so SDK provenance is never confused with the
+host's current source identity. No SDK or runtime is downloaded when the
+installed plugin starts.
+
+To update the SDK, take a newer released Node.js SDK archive, replace the
+vendored files with its contents (no local edits), update the `sdk` release
+fields and every file hash in `sdk.lock.json`, and run
+`node scripts/verify-sdk.mjs --download`.
 
 ## Runtime and build ownership
 
@@ -140,29 +153,31 @@ runs in the read-only plugin package.
 ## Release
 
 Update `plugin.json`, commit, and push `v<version>` matching the manifest.
-The release workflow verifies the SDK, runs the offline fixture integration,
-builds the ZIP and SHA-256, and publishes a **pre-release**. Native UI acceptance
+The release workflow verifies the SDK (including the released archive download),
+runs the offline fixture integration, builds the ZIP and SHA-256, and publishes a
+**pre-release**, then reads the release back and corrects the pre-release flag if
+GitHub did not apply it. Native UI acceptance
 must be completed before changing the workflow to publish stable releases.
 Published ZIP bytes are immutable: fixes require a new version.
 
 The Store index records the repository URL, API requirements, release URL and
 archive SHA-256. First inclusion and pre-releases use a reviewed Store pull request.
 
 Version 0.1.2 migrates custom Cargo selection to the shared ordered executable
-candidates. Published 0.1.0/0.1.1 preview archives remain immutable. A compatible
+candidates. Published 0.1.0 to 0.1.2 preview archives remain immutable. A compatible
 host must advertise `executableResolution: 1`; the setting is a candidate ahead
 of automatic PATH discovery, with empty values skipped and explicit failures
 reported by the host. Maven/Gradle-style automatic candidates need no path setting.
 
 ## Core integration source
 
 CI and release verification explicitly check out `sdk.lock.json.coreSource.ref`
-(`preview`) from the verified host repository. **Merge the companion host
-structured logging change into preview before this plugin change**; preparation
-rejects a host missing the typed operation catalog rather than attempting an
-old-protocol fallback. It records the resolved commit and exact source SHA-256;
-this moving test ref is not presented as a pinned release artifact. SDK vendor
-hashes and the historical test-support source remain independently pinned.
+(`preview`) from the verified host repository. The host must offer
+`litheLogging: 1`; preparation rejects a host missing the typed operation
+catalog rather than attempting an old-protocol fallback. It records the resolved
+commit and exact source SHA-256; this moving test ref is not presented as a
+pinned release artifact. SDK vendor hashes and the test-support source remain
+independently pinned.
 
 Local validation can select a particular real host checkout and revision:
 

io.github.lithe-idea.cargo-build/backend/main.mjs

@@ -2,6 +2,6 @@
 import { createBackend, PluginError } from './vendor/lithe-plugin-sdk/index.mjs';
 import { registerCargoProvider } from './provider.mjs';
 
-const backend = createBackend({ name: 'cargo-build', version: '0.1.2' });
+const backend = createBackend({ name: 'cargo-build', version: '0.1.3' });
 registerCargoProvider(backend, PluginError);
 await backend.listen();

io.github.lithe-idea.cargo-build/plugin.json

@@ -2,7 +2,7 @@
   "schemaVersion": 2,
   "id": "io.github.lithe-idea.cargo-build",
   "displayName": "Cargo",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "pluginAPIVersion": 3,
   "requires": { "buildProviders": 1, "buildSystems": 1, "executableResolution": 1, "serverProcess": 1, "settings": 2 },
   "vendor": { "id": "io.github.lithe-idea", "displayName": "Lithe Community", "signatureRequirement": "none" },