All notable changes to this project are documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

• Compatibility wording: note that host 0.1.2-alpha.1 mounts storage-domain in the shipped dsh-base bundle (since 3a4232a8fa), while the published 0.1.1-rc.2 line does not; storageDomain stays deliberately optional so the plugin boots on either line (docs/comments only, no behavior change).

• Test harness: derive synthetic tool-call ids from tools.execute's input type instead of importing CallId (renamed to ToolCallId on host HEAD), keeping typecheck (checkout) and typecheck:ci (published 0.1.1-rc.2) both green.

• score_badge tool: an embeddable README badge (self-contained shields.io flat-style SVG, paste-ready endpoint URL, and Markdown embed snippet) plus a compact five-dimension JSON envelope (schema: "dsh-score/badge/v1") for one scored target, from either a fresh target score or a stored score card id with an optional refresh cache bypass. A no-evidence dimension keeps its honest status and score 0 — the badge and JSON never fabricate a number.

• Upgrade all @deepseek-ai/dsh-* peers to the DSH 0.1.1-rc.2 release: devDependencies pin 0.1.1-rc.2 exactly (including dsh-attachment), the dshWorkshop.compatibility.dshVersions marker and the README compatibility tables follow, and the compat workflow installs @deepseek-ai/dsh@0.1.1-rc.2 with dsh-base/dsh-headless at 0.1.1-rc.2. Peer dependencies stay >=0.1.0-rc.8 <0.2.0 because the plugin uses no rc2-only API.
• typecheck/typecheck:ci and the test harness now validate against the published 0.1.1-rc.2 types.

• Upgrade all @deepseek-ai/dsh-* peers to the DSH 0.1.0-rc.8 release: peerDependencies now declare >=0.1.0-rc.8 <0.2.0, devDependencies pin 0.1.0-rc.8 exactly, and the dshWorkshop.compatibility.dshVersions marker and README compatibility tables follow.
• typecheck/typecheck:ci and the test harness now validate against the published 0.1.0-rc.8 types.

• score tool: multi-dimensional quality scoring of one repo or npm package from real gh/npm CLI evidence (install success, maintenance, documentation, security, protocol compliance), with a risk card, weighted total, letter grade, and per-dimension audit links.
• /score slash command: batch scoring over ctx.jobs producing a leaderboard snapshot (JSON + Markdown).
• score_report tool: fetch score cards (sc_...), leaderboards (lb_...), or the latest leaderboard.
• Structured result contract dsh-score/v1 stored in the score storage domain, with a deterministic score cache keyed by target.
• Reserved dsh-test-drive consumer: the install dimension reads the already-open test_drive domain (best-effort; no-evidence when absent — no hard dependency).
• Evidence discipline: every conclusion carries a source, sanitized detail, and audit timestamp; dimensions without evidence report no-evidence and are excluded from the weighted total.
• Pure sanitizers and detectors for token literals, URL credentials, bearer headers, secret-leak patterns, and malicious install scripts.
• Five-language README, cordis.patch.yml with per-key comments, CI/compat/release workflows, issue forms, pull request template, and the full gate chain.