@chengxianglibra/dsh-data-analysis 0.1.2 → 0.2.0

package/lib/types/presentation/export-html.d.ts

@@ -0,0 +1,13 @@
+import type { Context } from '@deepseek-ai/cordis';
+import type { Session } from '@deepseek-ai/dsh-session';
+export declare const MARIVO_EXPORT_HTML_TOOL_NAME = "marivo_export_html";
+export type ExportWorkspaceSource = () => {
+    id: string;
+    path: string;
+} | Promise<{
+    id: string;
+    path: string;
+}>;
+export declare function parseHtmlOutputPath(value: unknown): string;
+export declare function createMarivoExportHtmlTool(source: ExportWorkspaceSource, session: Session): import("@deepseek-ai/dsh-tools").ToolDefinition;
+export declare function registerMarivoExportHtmlTool(ctx: Context, source: ExportWorkspaceSource, session: Session): () => Promise<void>;

package/lib/types/presentation/reports.d.ts

@@ -1,5 +1,10 @@
+import { type PublicationSource, type ReportCatalog, type ReportHistory } from './contracts/catalog.ts';
 import { type PresentationDocument, type PresentationReceipt } from './contracts/index.ts';
 export declare function readReceiptDocument(root: string, receipt: PresentationReceipt, signal?: AbortSignal): Promise<PresentationDocument>;
+/** Current and its publication history become visible through one atomic rename. */
+export declare function readReportHistory(root: string, workspaceId: string, reportId: string, signal?: AbortSignal): Promise<ReportHistory>;
 export declare function resolvePresentation(root: string, workspaceId: string, reportId: string, signal?: AbortSignal): Promise<PresentationReceipt>;
+/** Enumerate only publication pointers, never completed-but-unpublished build directories. */
+export declare function listReports(root: string, workspaceId: string, signal?: AbortSignal): Promise<ReportCatalog>;
 /** The mutable pointer is the publication boundary; completed builds are never overwritten. */
-export declare function publishPresentation(root: string, document: PresentationDocument, expectedBuildId: string | null, assertOwner: () => Promise<void>, signal?: AbortSignal): Promise<PresentationReceipt>;
+export declare function publishPresentation(root: string, document: PresentationDocument, expectedBuildId: string | null, assertOwner: () => Promise<void>, signal?: AbortSignal, source?: PublicationSource | null): Promise<PresentationReceipt>;

package/lib/types/presentation/rpc.d.ts

@@ -7,8 +7,9 @@ export interface PresentationWorkspace {
 export type PresentationWorkspaceResolver = (sessionId: string) => PresentationWorkspace | undefined | Promise<PresentationWorkspace | undefined>;
 export declare class MarivoPresentationFileService {
     #private;
-    constructor(resolve: PresentationWorkspaceResolver);
-    close(): void;
+    constructor(resolve: PresentationWorkspaceResolver, resolveId?: PresentationWorkspaceResolver);
+    catalog(endpoint: 'reports/list' | 'reports/history', payload: unknown, caller?: AbortSignal): Promise<import("./contracts/catalog.ts").ReportHistory | import("./contracts/catalog.ts").ReportCatalog>;
+    close(): Promise<void>;
     report(endpoint: 'reports/resolve' | 'reports/save', payload: unknown, caller?: AbortSignal): Promise<import("./contracts/types.ts").PresentationReceipt>;
     read(payload: unknown, caller?: AbortSignal): Promise<{
         workspaceId: string;

package/lib/types/presentation/tool.d.ts

@@ -7,6 +7,6 @@ export interface PresentationBinding {
     projection: MarivoPresentationProjection;
 }
 export type PresentationBindingSource = () => PresentationBinding | Promise<PresentationBinding>;
-/** One call projects a draft, builds both assets, commits them, then emits the receipt. */
+/** One call projects a draft, builds the document, commits them, then emits the receipt. */
 export declare function createMarivoPresentTool(source: PresentationBindingSource, session: Session, lifecycleSignal?: AbortSignal): ToolDefinition;
-export declare function registerMarivoPresentTool(ctx: Context, source: PresentationBindingSource, session: Session): () => void;
+export declare function registerMarivoPresentTool(ctx: Context, source: PresentationBindingSource, session: Session): () => Promise<void>;

package/lib/types/report-publishing/adapters.d.ts

@@ -0,0 +1,6 @@
+import type { Context } from '@deepseek-ai/cordis';
+import type { HostConnectionHandle } from '@deepseek-ai/dsh-client-connection';
+import type { ReportPublishingService } from './service.ts';
+export declare const PUBLISHING_CHANNEL = "/dsh-report-publishing";
+export declare function registerPublishingCredentials(connection: HostConnectionHandle, service: ReportPublishingService, workspaceExists: (id: string) => boolean): () => Promise<void>;
+export declare function registerReportPublishTool(ctx: Context, service: ReportPublishingService, sessionId: string): () => Promise<void>;

package/lib/types/report-publishing/config.d.ts

@@ -0,0 +1,22 @@
+import { z } from 'zod';
+export declare const publishingConfigSchema: z.ZodObject<{
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    storage: z.ZodObject<{
+        name: z.ZodString;
+        protocol: z.ZodDefault<z.ZodLiteral<"s3">>;
+        endpoint: z.ZodString;
+        region: z.ZodString;
+        bucket: z.ZodString;
+        forcePathStyle: z.ZodDefault<z.ZodBoolean>;
+        accessKeyIdRef: z.ZodString;
+        secretAccessKeyRef: z.ZodString;
+        sessionTokenRef: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+    pathPrefix: z.ZodDefault<z.ZodString>;
+    publicBaseUrl: z.ZodString;
+}, z.core.$strict>;
+export type ReportPublishingConfig = z.input<typeof publishingConfigSchema> | {
+    enabled?: false;
+};
+export type EnabledPublishingConfig = z.output<typeof publishingConfigSchema>;
+export declare function resolvePublishingConfig(value?: ReportPublishingConfig): EnabledPublishingConfig | undefined;

package/lib/types/report-publishing/service.d.ts

@@ -0,0 +1,68 @@
+import { type CredentialProvider } from '@deepseek-ai/dsh-credentials';
+import type { MarivoPresentationFileService } from '../presentation/rpc.ts';
+import type { EnabledPublishingConfig } from './config.ts';
+export declare function publishingPathName(value: string, fallback: string): string;
+export type PublishingField = 'accessKeyId' | 'secretAccessKey' | 'sessionToken';
+export interface PublishingCredentialField {
+    field: PublishingField;
+    reference: string;
+    required: boolean;
+    configured: boolean;
+    writable: boolean;
+    source?: string;
+}
+export interface PublishingCredentialView {
+    enabled: boolean;
+    configId?: string;
+    name?: string;
+    bucket?: string;
+    fields: PublishingCredentialField[];
+}
+type Store = Pick<CredentialProvider, 'describe' | 'set' | 'unset' | 'resolve'>;
+export interface UploadInput {
+    config: EnabledPublishingConfig;
+    credentials: {
+        accessKeyId: string;
+        secretAccessKey: string;
+        sessionToken?: string;
+    };
+    key: string;
+    bytes: Buffer;
+    signal: AbortSignal;
+}
+export declare function uploadReport(input: UploadInput): Promise<void>;
+export declare class ReportPublishingService {
+    readonly configId: `${string}-${string}-${string}-${string}-${string}`;
+    readonly config: EnabledPublishingConfig | undefined;
+    readonly store: Store;
+    readonly files: Pick<MarivoPresentationFileService, 'catalog' | 'read'>;
+    readonly upload: (input: UploadInput) => Promise<void>;
+    readonly workspaceName: (id: string) => string;
+    constructor(config: EnabledPublishingConfig | undefined, store: Store, files: Pick<MarivoPresentationFileService, 'catalog' | 'read'>, upload?: (input: UploadInput) => Promise<void>, workspaceName?: (id: string) => string);
+    assertConfig(configId: string): void;
+    references(): Array<{
+        field: PublishingField;
+        reference: string;
+        required: boolean;
+    }>;
+    describe(): Promise<PublishingCredentialView>;
+    change(field: PublishingField, value: string | undefined, signal: AbortSignal): Promise<void>;
+    publish(scope: {
+        sessionId: string;
+    } | {
+        workspaceId: string;
+    }, reportId: string, buildId: string, signal: AbortSignal, viewHtml?: string): Promise<{
+        storage: string;
+        bucket: string;
+        key: string;
+        url: string;
+        workspaceId: string;
+        reportId: string;
+        buildId: string;
+        sha256: string;
+        bytes: number;
+        kind: string;
+        publishedAt: string;
+    }>;
+}
+export {};

package/lib/types/rpc.d.ts

@@ -0,0 +1,3 @@
+/** Dedicated plugin RPC envelopes over Harness-owned authenticated exact Fetch routes. */
+import { type ConnectionRpcHandler, type HostConnectionHandle } from '@deepseek-ai/dsh-client-connection';
+export declare function registerPluginRpc(connection: Pick<HostConnectionHandle, 'fetch'>, channel: string, endpoints: readonly string[], handler: ConnectionRpcHandler): () => Promise<void>;

package/lib/types/semantic-browser/contracts.d.ts

@@ -2,6 +2,7 @@ import { type SemanticRef } from '../semantic-reference/contracts.ts';
 import { type ComputationDefinition } from './definition.ts';
 export declare const BROWSER_ENDPOINT = "semantic-browser/catalog";
 export declare const CATALOG_MAX_BYTES: number;
+export declare const CATALOG_ERROR_SCHEMA = "marivo.semantic_catalog_error/v1";
 export interface DisplayField {
     readonly name: string;
     readonly value: string;
@@ -30,6 +31,11 @@ export interface CatalogProjection {
     readonly kinds: readonly string[];
     readonly objects: readonly SemanticObjectView[];
 }
+export interface CatalogFailure {
+    readonly schema: typeof CATALOG_ERROR_SCHEMA;
+    readonly kind: 'semantic';
+    readonly message: string;
+}
 export interface CatalogSnapshot extends CatalogProjection {
     readonly workspaceId: string;
     readonly projectRoot: string;
@@ -37,4 +43,5 @@ export interface CatalogSnapshot extends CatalogProjection {
     readonly loadedAt: string;
 }
 export declare function parseCatalogProjection(value: unknown): CatalogProjection;
+export declare function parseCatalogFailure(value: unknown): CatalogFailure | undefined;
 export declare function parseCatalogSnapshot(value: unknown): CatalogSnapshot;

package/lib/types/semantic-browser/service.d.ts

@@ -9,12 +9,18 @@ export interface BrowserHost {
     projectRoot(workspace: BrowserWorkspace): string;
     resolve(root: string): Promise<MarivoCheckedRunner>;
 }
+export declare class SemanticCatalogLoadError extends Error {
+    readonly code = "catalog-load-failed";
+    readonly diagnostic: string;
+    constructor(diagnostic: string);
+}
 /** Workspace-addressed read service; intentionally has no Agent or credential dependency. */
 export declare class SemanticBrowserService {
     #private;
     constructor(host: BrowserHost);
     read(payload: unknown, caller: AbortSignal): Promise<CatalogSnapshot>;
+    close(): Promise<void>;
     dispose(): void;
 }
-/** Fixed diagnostics only: Python errors may contain model code or datasource secrets. */
+/** Preserve Marivo semantic diagnostics; keep unknown Python failures behind a fixed fallback. */
 export declare function browserFailure(error: unknown): string;

package/lib/types/semantic-reference/bridge.d.ts

@@ -6,6 +6,7 @@ export declare class SemanticReferenceBridge {
     #private;
     constructor(clock?: () => number);
     candidates(runner: MarivoCheckedRunner, signal: AbortSignal): Promise<Projection>;
+    close(): Promise<void>;
     invalidate(key: string): void;
     dispose(): void;
 }

package/lib/types/semantic-reference/contracts.d.ts

@@ -1,7 +1,6 @@
 /** Browser-safe wire contracts. These bounds do not reimplement Marivo's domain grammar. */
 export declare const CHANNEL = "/dsh-data-analysis";
 export declare const SOURCE = "marivo-semantic";
-export declare const LIMIT = 40;
 export declare const MAX_WIRE_BYTES: number;
 export interface SemanticRef {
     readonly schema: 'marivo.semantic_ref/v1';
@@ -46,6 +45,10 @@ export declare function parseCandidatesRequest(value: unknown): {
     sessionId: string;
     query: string;
     quoted: boolean;
-    limit: number;
 };
 export declare function parseCandidatesResponse(value: unknown): CandidatesResponse;
+/** Browser selection identity only; preparation never reloads semantic content. */
+export declare function parsePrepareRequest(value: unknown): {
+    workspaceId: string;
+    envelope: Envelope;
+};

package/lib/types/semantic-reference/environment.d.ts

@@ -0,0 +1,22 @@
+import type { MarivoCheckedRunner } from '../environment/types.ts';
+import type { EnvironmentResolver } from './rpc.ts';
+interface Workspace {
+    id: string;
+    path: string;
+}
+interface Binding {
+    root: string;
+    environment: Promise<MarivoCheckedRunner>;
+}
+export interface ReferenceEnvironmentHost<A extends object> {
+    agent(sessionId: string): A | undefined;
+    binding(agent: A): Binding | undefined;
+    projectRoot(agent: A): string;
+    resolve(agent: A): Promise<MarivoCheckedRunner>;
+    workspace(sessionId: string): Workspace;
+}
+/** Reference identity includes Harness ownership; the underlying Runtime stays unchanged. */
+export declare function semanticEnvironmentFingerprint(workspaceId: string, runtimeFingerprint: string): string;
+/** Explicit selection establishes ownership; serialization never repairs it. */
+export declare function referenceEnvironmentResolver<A extends object>(host: ReferenceEnvironmentHost<A>): EnvironmentResolver;
+export {};

package/lib/types/semantic-reference/labels.d.ts

@@ -0,0 +1,16 @@
+/** Shared display labels and search aliases; object kinds still come from the live Catalog. */
+export declare const semanticKindLabels: {
+    readonly domain: "业务域";
+    readonly datasource: "数据源";
+    readonly entity: "实体";
+    readonly dimension: "维度";
+    readonly measure: "度量";
+    readonly time_dimension: "时间维度";
+    readonly metric: "指标";
+    readonly relationship: "关系";
+    readonly event: "事件";
+    readonly state_model: "状态模型";
+    readonly period_calendar: "周期日历";
+    readonly temporal_set: "时间集合";
+    readonly work_schedule: "工作日程";
+};

package/lib/types/semantic-reference/rpc.d.ts

@@ -2,7 +2,7 @@ import type { ConnectionRpcHandler, HostConnectionHandle } from '@deepseek-ai/ds
 import type { MarivoCheckedRunner } from '../environment/types.ts';
 import { SemanticReferenceBridge } from './bridge.ts';
 import { type SemanticReferenceUsage } from './usage.ts';
-export type EnvironmentResolver = (sessionId: string, purpose: 'candidates' | 'reference') => Promise<MarivoCheckedRunner>;
+export type EnvironmentResolver = (sessionId: string, purpose: 'candidates' | 'reference' | 'prepare', workspaceId?: string) => Promise<MarivoCheckedRunner>;
 /** Abort the caller's wait, without pretending to cancel the shared Environment resolver. */
 export declare function abortable<T>(promise: Promise<T>, signal: AbortSignal): Promise<T>;
 export declare class SemanticReferenceService {

package/lib/types/semantic-reference/search.d.ts

@@ -1,4 +1,4 @@
-import { type Projection, type RankedCandidate } from './contracts.ts';
+import type { Projection, RankedCandidate } from './contracts.ts';
 export interface UsageScore {
     readonly count: number;
     readonly last: number;

package/lib/types/tool-lifecycle.d.ts

@@ -0,0 +1,4 @@
+import type { Context } from '@deepseek-ai/cordis';
+import type { ToolDefinition } from '@deepseek-ai/dsh-tools';
+/** A plugin tool owns its execution promises; withdrawing its schema is not a drain. */
+export declare function registerMarivoTool(ctx: Context, tool: ToolDefinition): () => Promise<void>;

package/lib/types/workspace-identity.d.ts

@@ -0,0 +1,6 @@
+import type { Context } from '@deepseek-ai/cordis';
+/** Resolve only Harness-owned, header-validated Workspace membership; never infer it from a path. */
+export declare function resolvePresentationWorkspace(ctx: Context, sessionId: string): {
+    id: string;
+    path: string;
+};

package/lib/workspace-identity.js

@@ -0,0 +1,9 @@
+/** Resolve only Harness-owned, header-validated Workspace membership; never infer it from a path. */
+export function resolvePresentationWorkspace(ctx, sessionId) {
+    const matches = ctx.workspaceRegistry
+        .list()
+        .filter((workspace) => workspace.sessionIds.some((id) => String(id) === sessionId));
+    if (matches.length !== 1)
+        throw new Error('Presentation requires one current Session Workspace');
+    return { id: String(matches[0].id), path: matches[0].path };
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@chengxianglibra/dsh-data-analysis",
   "description": "Marivo runtime, live Help, secure datasource execution and presentation delivery for DeepSeek Harness",
-  "version": "0.1.2",
+  "version": "0.2.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/chengxianglibra/dsh-data-analysis.git",
@@ -14,7 +14,7 @@
   "license": "MIT",
   "type": "module",
   "engines": {
-    "node": ">=24"
+    "node": "^22.19.0 || >=24.0.0"
   },
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",
@@ -54,6 +54,7 @@
     "lib/**/*.js",
     "lib/types/**/*.d.ts",
     "skills/dsh-data-analysis-presentation/**",
+    "skills/dsh-data-analysis-files/**",
     "python/presentation-kit/dist/dsh_data_analysis_presentation_kit-1.1.0-py3-none-any.whl",
     "cordis.patch.yml",
     "README.md"
@@ -72,11 +73,11 @@
     "schema": "dsh-data-analysis-compatibility/v2",
     "dsh": {
       "distribution": "@deepseek-ai/dsh",
-      "peerRange": "0.1.1-rc.2"
+      "peerRange": ">=0.1.5-rc.1"
     },
     "marivo": {
-      "version": "0.5.4",
-      "packageSpec": "marivo[duckdb,trino,clickhouse]==0.5.4"
+      "version": "0.5.5",
+      "packageSpec": "marivo[duckdb,trino,clickhouse]==0.5.5"
     },
     "contracts": {
       "runtimeInstallation": "dsh-data-analysis-runtime/v3",
@@ -87,13 +88,17 @@
     "client": {
       "inject": [
         "@deepseek-ai/dsh-client-connection",
+        "@deepseek-ai/dsh-api-gateway",
         "@deepseek-ai/dsh-client-locale",
-        "@deepseek-ai/dsh-client-runtime",
+        "@deepseek-ai/dsh-api-session-controller",
+        "@deepseek-ai/dsh-api-workspace-controller",
+        "@deepseek-ai/dsh-client-ui-chat",
         "@deepseek-ai/dsh-client-ui-conversation",
         "@deepseek-ai/dsh-client-ui-tool",
         "@deepseek-ai/dsh-client-ui-input-trigger",
         "@deepseek-ai/dsh-client-ui-sidebar",
-        "@deepseek-ai/dsh-client-ui-layout"
+        "@deepseek-ai/dsh-client-ui-layout",
+        "@deepseek-ai/dsh-client-ui-sidebar-right"
       ],
       "platform": "web"
     },
@@ -102,72 +107,89 @@
     }
   },
   "dependencies": {
+    "@aws-sdk/client-s3": "^3.1129.0",
     "@deepseek-ai/schemastery": "^3.18.1",
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@deepseek-ai/dsh-agent-loop": "^0.1.1-rc.2",
-    "@deepseek-ai/dsh-anonymous-user-id": "^0.1.1-rc.2",
-    "@deepseek-ai/dsh-bash-local": "^0.1.1-rc.2",
-    "@deepseek-ai/dsh-client-ui-primitives": "^0.1.1-rc.2",
-    "@deepseek-ai/dsh-client-ui-slots": "^0.1.1-rc.2",
-    "@deepseek-ai/dsh-code-runtime": "^0.1.1-rc.2",
-    "@deepseek-ai/dsh-code-runtime-worker-thread": "^0.1.1-rc.2",
-    "@deepseek-ai/dsh-credentials-local": "^0.1.1-rc.2",
-    "@deepseek-ai/dsh-fs-local": "^0.1.1-rc.2",
-    "@deepseek-ai/dsh-fs-observation-policy": "^0.1.1-rc.2",
-    "@deepseek-ai/dsh-llm-deepseek": "^0.1.1-rc.2",
-    "@deepseek-ai/dsh-scope": "^0.1.1-rc.2",
-    "@deepseek-ai/dsh-skill": "^0.1.1-rc.2",
-    "@deepseek-ai/dsh-subprocess-local": "^0.1.1-rc.2",
-    "@deepseek-ai/dsh-tool-bash": "^0.1.1-rc.2",
-    "@deepseek-ai/dsh-tool-fs": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-agent-loop": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-anonymous-user-id": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-bash-local": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-store": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-primitives": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-renderer": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-sidebar-right": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-slots": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-code-runtime": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-code-runtime-worker-thread": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-credentials-local": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-fs-local": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-fs-observation-policy": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-launch-environment": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-llm-deepseek": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-scope": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-session-persistence": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-session-persistence-jsonl": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-session-projection": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-skill": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-storage": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-storage-json": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-subprocess-local": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-tool-bash": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-tool-fs": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-tool-present": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-tool-skill": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-util-workspace-path": "0.1.5-rc.1",
+    "@shikijs/core": "4.4.3",
+    "@shikijs/engine-javascript": "4.4.3",
+    "@shikijs/langs": "4.4.3",
     "@types/react": "^18.3.31",
-    "react": "^18.3.1",
-    "typescript": "^6.0.3",
-    "esbuild": "^0.28.2",
-    "@deepseek-ai/dsh-storage": "^0.1.1-rc.2",
-    "@deepseek-ai/dsh-storage-json": "^0.1.1-rc.2",
-    "@deepseek-ai/dsh-session-persistence-jsonl": "0.1.1-rc.2",
     "@types/react-dom": "18.3.7",
+    "@wasm-fmt/ruff_fmt": "0.15.20",
+    "esbuild": "^0.28.2",
+    "immer": "10.1.1",
     "playwright": "1.63.0",
+    "react": "^18.3.1",
     "react-dom": "18.3.1",
     "react-is": "18.3.1",
     "recharts": "3.8.1",
-    "@deepseek-ai/dsh-launch-environment": "^0.1.1-rc.2",
-    "@deepseek-ai/dsh-tool-skill": "^0.1.1-rc.2",
-    "@shikijs/core": "4.4.3",
-    "@shikijs/engine-javascript": "4.4.3",
-    "@shikijs/langs": "4.4.3",
-    "@wasm-fmt/ruff_fmt": "0.15.20",
-    "sql-formatter": "15.8.2"
+    "sql-formatter": "15.8.2",
+    "typescript": "^6.0.3",
+    "zustand": "4.4.7"
   },
   "peerDependencies": {
-    "@deepseek-ai/dsh-agent": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-client-connection": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-client-locale": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-client-runtime": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-client-ui-conversation": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-client-ui-primitives": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-client-ui-tool": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-credentials": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-home-paths": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-llm": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-session": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-shell-env": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-skill-filesystem": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-scope": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-system-prompt": "0.1.1-rc.2",
     "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-tools": "0.1.1-rc.2",
-    "react": "^18.3.1",
-    "@deepseek-ai/dsh-storage-domain": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-client-ui-input-trigger": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-workspace": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-client-ui-sidebar": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-client-ui-layout": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-shell": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-sandbox": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-atomic-write": "0.1.1-rc.2"
+    "@deepseek-ai/dsh-agent": ">=0.1.5-rc.1",
+    "@deepseek-ai/dsh-api-gateway": ">=0.1.5-rc.1",
+    "@deepseek-ai/dsh-api-session-controller": ">=0.1.5-rc.1",
+    "@deepseek-ai/dsh-api-workspace-controller": ">=0.1.5-rc.1",
+    "@deepseek-ai/dsh-atomic-write": ">=0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-connection": ">=0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-locale": ">=0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-chat": ">=0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-conversation": ">=0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-input-trigger": ">=0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-layout": ">=0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-primitives": ">=0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-sidebar": ">=0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-sidebar-right": ">=0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-tool": ">=0.1.5-rc.1",
+    "@deepseek-ai/dsh-credentials": ">=0.1.5-rc.1",
+    "@deepseek-ai/dsh-home-paths": ">=0.1.5-rc.1",
+    "@deepseek-ai/dsh-llm": ">=0.1.5-rc.1",
+    "@deepseek-ai/dsh-sandbox": ">=0.1.5-rc.1",
+    "@deepseek-ai/dsh-scope": ">=0.1.5-rc.1",
+    "@deepseek-ai/dsh-session": ">=0.1.5-rc.1",
+    "@deepseek-ai/dsh-shell": ">=0.1.5-rc.1",
+    "@deepseek-ai/dsh-shell-env": ">=0.1.5-rc.1",
+    "@deepseek-ai/dsh-skill-filesystem": ">=0.1.5-rc.1",
+    "@deepseek-ai/dsh-storage-domain": ">=0.1.5-rc.1",
+    "@deepseek-ai/dsh-system-prompt": ">=0.1.5-rc.1",
+    "@deepseek-ai/dsh-tools": ">=0.1.5-rc.1",
+    "@deepseek-ai/dsh-typert-protocol": ">=0.1.5-rc.1",
+    "@deepseek-ai/dsh-typert-registry": ">=0.1.5-rc.1",
+    "@deepseek-ai/dsh-util-values": ">=0.1.5-rc.1",
+    "@deepseek-ai/dsh-workspace": ">=0.1.5-rc.1",
+    "react": "^18.3.1"
   }
 }

package/skills/dsh-data-analysis-files/SKILL.md

@@ -0,0 +1,32 @@
+---
+name: dsh-data-analysis-files
+description: 分析已上传或 Workspace 中的 CSV、JSON、Parquet、Excel 文件，使用 pandas 或 DuckDB 计算，按需导出 CSV、JSON、PNG 等普通文件或接入报告。无需先建立 Marivo datasource 或语义模型。
+---
+
+# 文件分析
+
+使用 Harness 提供的当前附件可读路径，或用户指定的 Workspace 文件；同名附件按消息和完整路径区分。路径不可读时报告实际问题，不猜测 Host 缓存位置。
+
+文件读取、计算和最终文件生成（包括 CSV、JSON、PNG）均通过 `marivo_python` 在绑定 Runtime 中执行，不改走 Bash 的 `python`／`python3` 或其他解释器。纯本地文件分析可直接使用 pandas 或原生 `duckdb`，传 `datasources: []`；按任务选择或组合使用，无需 `md.raw_sql`、Marivo 分析 Skill、live Help 或语义建模。只有实际访问 Marivo datasource 时才声明其精确名称并查询相关契约。
+
+使用现有 reader，保留回答所需的 sheet、字段和解析范围；区分样本与全量。Excel `.xlsx` 可用 DuckDB `read_xlsx`，首次使用可能联网获取官方扩展；不承诺旧 `.xls` 或冷缓存离线读取，不临时安装 Python 依赖。
+
+每次 `marivo_python` 都是独立进程。原生 DuckDB 连接可在本次调用内复用、创建临时表，并及时关闭；后续追问重新读取原文件或已有结果，不依赖上次内存状态。按问题控制读取和输出规模，SQL `LIMIT` 不代表仅扫描这些行。
+
+## 按用户目标交付
+
+普通答案直接用文字，不为结论额外创建文件。用户要求 CSV、JSON、PNG 等实际文件时，先通过 `marivo_python` 生成最终文件，优先写入当前绑定 Workspace；确认执行成功、文件存在后，调用当前实际可用的 Harness 原生 `present`，再回复用户。回复前分别核对文件生成与原生声明状态：生成文件、回复路径或展示代码块均不能替代原生交付。缺少 `present` 时，最终回复必须说明“文件已生成，原生交付能力不可用”，并提供准确路径；不能只说文件已生成。不猜测附件缓存或 Shell 私有临时目录。
+
+需要交互图表、表格、报告或看板时加载 `dsh-data-analysis-presentation`，将 DataFrame 交给现有 writer，并关联实际返回的 `codeRef`，使用 `marivo_present` 保存固定 Build。在正文说明文件名与分析范围，不将文件结果冒充 Marivo Artifact 或 Evidence。普通 `present` 不赋予文件 Report/Build 或 Evidence 身份。
+
+报告内部的 `presentation.json`、computed 数据和 receipt 不作为默认附件；只有用户另行要求实际文件且文件已经存在于 Session 文件系统可访问位置时，才调用 `present`。阅读器下载／发布 HTML 沿用现有流程，浏览器内生成的下载不伪装成 Session 文件。
+
+## 能力与失败
+
+遵循 Harness [present 契约](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-rc.1/packages/fs/tool-present/README.md)，由工具验证路径和文件类型。当前工具集中缺少 `present` 时，明确说明“文件已生成，原生交付能力不可用”，提供实际准确路径供手动使用，不虚构卡片，不安装工具或改写 profile。
+
+生成失败不声明成功；声明失败区分“文件已生成”和“交付未完成”，修复路径或可见性后只重试交付，不为补卡片重跑分析。响应不确定时先核对已有调用结果和事件，不盲目重复声明。原生打开失败时使用 Host 的预览或错误反馈，不绕过权限。
+
+卡片打开当前源文件，不保存内容版本；修改、移动或删除会影响后续读取。成功声明的持久事件属于 Harness，即使 PTC 外层程序随后失败，也不撤销已成功的声明。子代理产物属于其调用 Session；父 Agent 如需交付，先确认自己能访问文件，再在父 Session 显式调用 `present`，不自动跨 Session 转投递。
+
+需要起步代码时读[简短示例](references/examples.md)；其中提供无需额外依赖的 PNG 写入代码，也通过 `marivo_python` 执行。