@chengxianglibra/dsh-data-analysis 0.2.0 → 0.2.2

package/lib/presentation/execution-policy.js

@@ -0,0 +1,5 @@
+/** Report-specific wall-clock budgets; leave time after source reads for publication. */
+export const PRESENTATION_EXECUTION_BUDGETS = Object.freeze({
+    sourceReadTimeoutMs: 120_000,
+    toolTimeoutMs: 180_000,
+});

package/lib/presentation/projection/index.js

@@ -1,6 +1,7 @@
 import { MarivoEnvironmentError } from "../../environment/errors.js";
 import { readPythonExecution } from "../../python-execution.js";
 import { PRESENTATION_BUDGETS, PresentationContractError, parsePresentationDocument, parsePresentationDraft, parseTypedDataset, } from "../contracts/index.js";
+import { PRESENTATION_EXECUTION_BUDGETS } from "../execution-policy.js";
 import { readWorkspaceJson } from "./files.js";
 import { MARIVO_PRESENTATION_READ_PROGRAM } from "./program.js";
 export { readWorkspaceJson } from "./files.js";
@@ -60,16 +61,32 @@ export class MarivoPresentationProjection {
         let diagnostics = [];
         const artifactData = new Map();
         if (draft.sources.length > 0) {
-            const result = await this.#runner.runChecked({
-                program: MARIVO_PRESENTATION_READ_PROGRAM,
-                args: [JSON.stringify({ sources: draft.sources, datasets: artifactSelections })],
-                limits: {
-                    timeoutMs: 30_000,
-                    stdoutMaxBytes: PRESENTATION_BUDGETS.documentBytes,
-                    stderrMaxBytes: 65_536,
-                },
-                signal: options.signal,
-            });
+            const startedAt = performance.now();
+            let result;
+            try {
+                result = await this.#runner.runChecked({
+                    program: MARIVO_PRESENTATION_READ_PROGRAM,
+                    args: [JSON.stringify({ sources: draft.sources, datasets: artifactSelections })],
+                    limits: {
+                        timeoutMs: PRESENTATION_EXECUTION_BUDGETS.sourceReadTimeoutMs,
+                        stdoutMaxBytes: PRESENTATION_BUDGETS.documentBytes,
+                        stderrMaxBytes: 65_536,
+                    },
+                    signal: options.signal,
+                });
+            }
+            catch (error) {
+                if (!(error instanceof MarivoEnvironmentError) || error.code !== 'subprocess-timeout')
+                    throw error;
+                // Construct only safe operation metadata; upstream messages/details may contain secrets.
+                throw new MarivoEnvironmentError('subprocess-timeout', 'Presentation source reading timed out. Source projection did not complete; report submission has not started. Keep the draft and source declarations for retry; do not remove sources or rerun analysis to repair presentation.', {
+                    phase: 'presentation-source-read',
+                    timeoutMs: PRESENTATION_EXECUTION_BUDGETS.sourceReadTimeoutMs,
+                    durationMs: Math.max(0, Math.round(performance.now() - startedAt)),
+                    sourceCount: draft.sources.length,
+                    sessionCount: new Set(draft.sources.map((source) => source.ref.sessionId)).size,
+                });
+            }
             this.#assertReady(options.signal);
             if (result.exitCode !== 0)
                 throw new MarivoEnvironmentError('subprocess-failed', 'The bound Marivo presentation read failed.', { exitCode: result.exitCode });

package/lib/presentation/tool.js

@@ -2,6 +2,7 @@ import { randomUUID } from 'node:crypto';
 import { defineTool } from '@deepseek-ai/dsh-tools';
 import { registerMarivoTool } from "../tool-lifecycle.js";
 import { parsePresentationBuildId } from "./contracts/index.js";
+import { PRESENTATION_EXECUTION_BUDGETS } from "./execution-policy.js";
 import { MARIVO_PRESENT_TOOL_NAME, MARIVO_PRESENTATION_DELIVERY_KIND, parsePresentationDelivery, presentationReceiptText, } from "./receipt.js";
 import { publishPresentation, resolvePresentation } from "./reports.js";
 /** One call projects a draft, builds the document, commits them, then emits the receipt. */
@@ -38,7 +39,7 @@ export function createMarivoPresentTool(source, session, lifecycleSignal) {
             ],
             presentationMeta: (_args, value) => JSON.parse(value.deliveryJson),
         },
-        timeoutMs: 120_000,
+        timeoutMs: PRESENTATION_EXECUTION_BUDGETS.toolTimeoutMs,
         async execute(args, exec) {
             const signal = lifecycleSignal ? AbortSignal.any([exec.signal, lifecycleSignal]) : exec.signal;
             if (typeof args.draft_path !== 'string' ||

package/lib/settings.js

@@ -0,0 +1,17 @@
+import { resolvePythonOptions } from "./datasource/python-options.js";
+export const PYTHON_SETTINGS_NAMESPACE = 'dsh-data-analysis';
+export function currentPythonOptions(options) {
+    const value = options.pythonTimeoutMs;
+    return resolvePythonOptions({
+        pythonTimeoutMs: value !== null && typeof value === 'object' && typeof value.get === 'function'
+            ? value.get()
+            : value,
+    });
+}
+/** Config is projected by the Host settings service; a headless composition reads its live entry. */
+export function installPythonSettings(ctx, options) {
+    const dispose = ctx.inject(['settings'], (settingsCtx) => {
+        settingsCtx.effect(() => settingsCtx.settings.configure({ auto: false }, ctx.fiber));
+    });
+    return { get: () => currentPythonOptions(options), dispose: () => dispose.dispose() };
+}

package/lib/types/client/i18n/copy.d.ts

@@ -4,14 +4,29 @@ import * as navigation from './navigation.ts';
 import * as presentation from './presentation.ts';
 import * as python from './python.ts';
 import * as semantic from './semantic.ts';
+import * as settings from './settings.ts';
 export declare const dictionaries: {
     credentials: typeof credentials;
     navigation: typeof navigation;
     presentation: typeof presentation;
     semantic: typeof semantic;
     python: typeof python;
+    settings: typeof settings;
 };
 export declare const zh: {
+    'marivo.settings.title': "数据分析";
+    'marivo.settings.timeout': "Python 默认执行超时（秒）";
+    'marivo.settings.hint': "默认 120 秒。保存后对所有 Workspace 的下一次 Python 调用生效，不改变已开始调用的时限。单次调用可指定其他时限；仍受 Harness 执行限制约束。";
+    'marivo.settings.description': "Python 执行设置。";
+    'marivo.settings.expand': "展开设置";
+    'marivo.settings.collapse': "收起设置";
+    'marivo.settings.save': "保存";
+    'marivo.settings.saving': "保存中…";
+    'marivo.settings.discard': "放弃修改";
+    'marivo.settings.unsaved': "未保存";
+    'marivo.settings.invalid': "请输入 0.001 至 2147483.647 秒，最多三位小数。";
+    'marivo.settings.read-only': "当前连接的设置只读。";
+    'marivo.settings.failed': "保存失败或设置已被其他页面修改。草稿已保留；可放弃修改以读取最新值，再重试。";
     'marivo.python.input': "输入";
     'marivo.python.output': "输出";
     'marivo.python.raw': "原始输入／输出";

package/lib/types/client/i18n/host.d.ts

@@ -8,6 +8,7 @@ declare module '@deepseek-ai/dsh-client-ui-slots' {
         'marivo.presentation': keyof typeof dictionaries.presentation.zh;
         'marivo.semantic': keyof typeof dictionaries.semantic.zh;
         'marivo.python': keyof typeof dictionaries.python.zh;
+        'marivo.settings': keyof typeof dictionaries.settings.zh;
     }
 }
 export declare function installCopy(ctx: Context): void;

package/lib/types/client/i18n/settings.d.ts

@@ -0,0 +1,16 @@
+export declare const zh: {
+    readonly 'marivo.settings.title': "数据分析";
+    readonly 'marivo.settings.timeout': "Python 默认执行超时（秒）";
+    readonly 'marivo.settings.hint': "默认 120 秒。保存后对所有 Workspace 的下一次 Python 调用生效，不改变已开始调用的时限。单次调用可指定其他时限；仍受 Harness 执行限制约束。";
+    readonly 'marivo.settings.description': "Python 执行设置。";
+    readonly 'marivo.settings.expand': "展开设置";
+    readonly 'marivo.settings.collapse': "收起设置";
+    readonly 'marivo.settings.save': "保存";
+    readonly 'marivo.settings.saving': "保存中…";
+    readonly 'marivo.settings.discard': "放弃修改";
+    readonly 'marivo.settings.unsaved': "未保存";
+    readonly 'marivo.settings.invalid': "请输入 0.001 至 2147483.647 秒，最多三位小数。";
+    readonly 'marivo.settings.read-only': "当前连接的设置只读。";
+    readonly 'marivo.settings.failed': "保存失败或设置已被其他页面修改。草稿已保留；可放弃修改以读取最新值，再重试。";
+};
+export declare const en: Record<keyof typeof zh, string>;

package/lib/types/client/settings/card.d.ts

@@ -0,0 +1,9 @@
+import type { ConfigForm } from '@deepseek-ai/dsh-client-ui-settings/client';
+export interface PythonSettingsValue {
+    pythonTimeoutMs: number;
+}
+/** Seconds in the form, exact integer milliseconds at the Host boundary. */
+export declare function timeoutMilliseconds(text: string): number | undefined;
+export declare function PythonSettingsCard({ scope }: {
+    scope: ConfigForm<PythonSettingsValue>;
+}): import("react").JSX.Element | null;

package/lib/types/client/settings/install.d.ts

@@ -0,0 +1,2 @@
+import type { Context } from '@deepseek-ai/cordis';
+export declare function installSettings(ctx: Context): void;

package/lib/types/client.d.ts

@@ -1,9 +1,9 @@
 import type { Context } from '@deepseek-ai/cordis';
-import { inject, installRightTabs } from './client/right-tabs/install.tsx';
+import { installRightTabs } from './client/right-tabs/install.tsx';
 export { marivoPresentationDeliveryDefinition, parsePresentationDurableContent, presentationDeliveryFromEvent, presentationsForNode, } from './client/presentation/delivery.ts';
 export { PresentationDeliveryModel } from './client/presentation/delivery-model.ts';
 export { HostPresentationReader } from './client/presentation/host-entry.tsx';
-export { inject };
+export declare const inject: string[];
 export declare function apply(ctx: Context, options?: {
     diagnostics?: boolean;
     onInstalled?: (controller: ReturnType<typeof installRightTabs>) => void;

package/lib/types/datasource/python-options.d.ts

@@ -1,9 +1,8 @@
 export declare const DEFAULT_PYTHON_TIMEOUT_MS = 120000;
-export declare const DEFAULT_PYTHON_MAX_TIMEOUT_MS = 600000;
 export interface MarivoPythonOptions {
     pythonTimeoutMs?: number;
-    pythonMaxTimeoutMs?: number;
 }
+export type MarivoPythonOptionsSource = MarivoPythonOptions | (() => MarivoPythonOptions);
 /** Do not echo rejected inputs: tool arguments and configuration are not trusted diagnostics. */
 export declare function pythonTimeout(value: unknown, name: string): number;
 export declare function resolvePythonOptions(options: MarivoPythonOptions): Required<MarivoPythonOptions>;

package/lib/types/datasource/python.d.ts

@@ -1,6 +1,6 @@
 import type { Context } from '@deepseek-ai/cordis';
 import { type MarivoDatasourceBridgeSource } from './bridge.ts';
-import { type MarivoPythonOptions } from './python-options.ts';
+import { type MarivoPythonOptionsSource } from './python-options.ts';
 import { type MarivoCredentialService } from './service.ts';
 export interface MarivoPythonExecutionSummary {
     phase: 'preparing' | 'executing' | 'capturing-code';
@@ -16,4 +16,4 @@ export declare class MarivoPythonExecutionError extends Error {
     readonly execution: MarivoPythonExecutionSummary;
     constructor(message: string, execution: MarivoPythonExecutionSummary);
 }
-export declare function registerMarivoPythonTool(ctx: Context, source: MarivoDatasourceBridgeSource, service: MarivoCredentialService, options?: MarivoPythonOptions): () => Promise<void>;
+export declare function registerMarivoPythonTool(ctx: Context, source: MarivoDatasourceBridgeSource, service: MarivoCredentialService, options?: MarivoPythonOptionsSource): () => Promise<void>;

package/lib/types/disclosure/execution-guidance.d.ts

@@ -1,5 +1,13 @@
 import type { Agent } from '@deepseek-ai/dsh-agent';
 import type { MarivoDisclosureController } from './activation.ts';
+declare module '@deepseek-ai/dsh-llm' {
+    interface MessageSourceMap {
+        plugin: {
+            kind: 'plugin';
+            plugin: string;
+        };
+    }
+}
 export declare const MARIVO_DATASOURCE_CREDENTIAL_PROMPT: string;
 export declare const MARIVO_ANALYSIS_CLOSEOUT_PROMPT: string;
 /** Full-plugin seam: requires its execution tools, credentials service and system sections. */

package/lib/types/plugin-agents.d.ts

@@ -17,6 +17,8 @@ export declare function createMarivoAgentInstallation(ctx: Context, environmentO
     credentials?: CredentialStore;
     credentialService?: MarivoCredentialService;
     credentialInteraction?: 'web' | 'none';
+    /** Read once at call admission so saved settings affect existing Agents. */
+    pythonOptionsSource?: () => MarivoPythonOptions;
     /** Runtime-scoped Help source; normal plugin installation never binds Help to a Workspace. */
     helpBridgeSource?: MarivoHelpBridgeSource;
 }): {

package/lib/types/plugin.d.ts

@@ -1,17 +1,17 @@
 import { type ReportPublishingConfig } from './report-publishing/config.ts';
+import { type PythonTimeoutConfig } from './settings.ts';
 export { installMarivoPlugin, type MarivoPluginEnvironmentResolver } from './plugin-agents.ts';
 export { resolvePresentationWorkspace } from './workspace-identity.ts';
 import type { Context } from '@deepseek-ai/cordis';
 import z from '@deepseek-ai/schemastery';
 import type { DatasourceDefaults } from './datasource/defaults.ts';
-import { type MarivoPythonOptions } from './datasource/python-options.ts';
 export { MARIVO_DATASOURCE_CREDENTIAL_PROMPT } from './disclosure/execution-guidance.ts';
 /** Cordis plugin name used by loader diagnostics and lifecycle logs. */
 export declare const name = "dsh-data-analysis";
 /** Services that must exist before the plugin binds and watches Agent scopes. */
 export declare const inject: string[];
 /** Loader-safe configuration for the shared Runtime and per-Workspace bindings. */
-export interface Config extends MarivoPythonOptions {
+export interface Config extends PythonTimeoutConfig {
     readonly reportPublishing?: ReportPublishingConfig;
     /** Non-secret creation defaults by backend; checked against each live Runtime schema. */
     readonly datasourceDefaults?: DatasourceDefaults;
@@ -28,6 +28,26 @@ export interface Config extends MarivoPythonOptions {
     readonly installTimeoutMs?: number;
 }
 /** Cordis loader schema. Runtime defaults are resolved in {@link apply}. */
-export declare const Config: z<Config>;
+export declare const Config: z<Schemastery.ObjectS<NoInfer<{
+    datasourceDefaults: z<any, any, "plain">;
+    reportPublishing: z<any, any, "plain">;
+    pythonTimeoutMs: z<number, number, "volatile-defined">;
+    credentialInteraction: z<"none" | "web", "none" | "web", "defined">;
+    projectRoot: z<string, string, "plain">;
+    pythonExecutable: z<string, string, "plain">;
+    runtimeRoot: z<string, string, "plain">;
+    bootstrapPythonExecutable: z<string, string, "plain">;
+    installTimeoutMs: z<number, number, "defined">;
+}>>, Schemastery.ObjectT<NoInfer<{
+    datasourceDefaults: z<any, any, "plain">;
+    reportPublishing: z<any, any, "plain">;
+    pythonTimeoutMs: z<number, number, "volatile-defined">;
+    credentialInteraction: z<"none" | "web", "none" | "web", "defined">;
+    projectRoot: z<string, string, "plain">;
+    pythonExecutable: z<string, string, "plain">;
+    runtimeRoot: z<string, string, "plain">;
+    bootstrapPythonExecutable: z<string, string, "plain">;
+    installTimeoutMs: z<number, number, "defined">;
+}>>, "plain">;
 /** Ensure the shared Runtime once, mount its skills, then bind each Workspace lazily. */
 export declare function apply(ctx: Context, config?: Config): Promise<() => Promise<void>>;

package/lib/types/presentation/execution-policy.d.ts

@@ -0,0 +1,5 @@
+/** Report-specific wall-clock budgets; leave time after source reads for publication. */
+export declare const PRESENTATION_EXECUTION_BUDGETS: Readonly<{
+    sourceReadTimeoutMs: 120000;
+    toolTimeoutMs: 180000;
+}>;

package/lib/types/rpc.d.ts

@@ -1,3 +1,3 @@
 /** Dedicated plugin RPC envelopes over Harness-owned authenticated exact Fetch routes. */
-import { type ConnectionRpcHandler, type HostConnectionHandle } from '@deepseek-ai/dsh-client-connection';
-export declare function registerPluginRpc(connection: Pick<HostConnectionHandle, 'fetch'>, channel: string, endpoints: readonly string[], handler: ConnectionRpcHandler): () => Promise<void>;
+import { type ConnectionRpcHandlerResult, type HostConnectionHandle } from '@deepseek-ai/dsh-client-connection';
+export declare function registerPluginRpc(connection: Pick<HostConnectionHandle, 'fetch'>, channel: string, endpoints: readonly string[], handler: (endpoint: string, payload: unknown, signal: AbortSignal) => Promise<ConnectionRpcHandlerResult>): () => Promise<void>;

package/lib/types/semantic-reference/rpc.d.ts

@@ -1,4 +1,4 @@
-import type { ConnectionRpcHandler, HostConnectionHandle } from '@deepseek-ai/dsh-client-connection';
+import type { ConnectionRpcHandlerResult, HostConnectionHandle } from '@deepseek-ai/dsh-client-connection';
 import type { MarivoCheckedRunner } from '../environment/types.ts';
 import { SemanticReferenceBridge } from './bridge.ts';
 import { type SemanticReferenceUsage } from './usage.ts';
@@ -12,4 +12,4 @@ export declare class SemanticReferenceService {
     stop(): void;
     close(): Promise<void>;
 }
-export declare function registerSemanticReferenceRpc(connection: HostConnectionHandle, service: SemanticReferenceService, browser?: ConnectionRpcHandler): () => Promise<void>;
+export declare function registerSemanticReferenceRpc(connection: HostConnectionHandle, service: SemanticReferenceService, browser?: (endpoint: string, payload: unknown, signal: AbortSignal) => Promise<ConnectionRpcHandlerResult>): () => Promise<void>;

package/lib/types/settings.d.ts

@@ -0,0 +1,14 @@
+import type { Context } from '@deepseek-ai/cordis';
+import { type MarivoPythonOptions } from './datasource/python-options.ts';
+export declare const PYTHON_SETTINGS_NAMESPACE = "dsh-data-analysis";
+export interface PythonTimeoutConfig {
+    pythonTimeoutMs?: number | {
+        get(): number;
+    };
+}
+export declare function currentPythonOptions(options: PythonTimeoutConfig): Required<MarivoPythonOptions>;
+/** Config is projected by the Host settings service; a headless composition reads its live entry. */
+export declare function installPythonSettings(ctx: Context, options: PythonTimeoutConfig): {
+    get: () => Required<MarivoPythonOptions>;
+    dispose: () => Promise<void>;
+};

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@chengxianglibra/dsh-data-analysis",
   "description": "Marivo runtime, live Help, secure datasource execution and presentation delivery for DeepSeek Harness",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/chengxianglibra/dsh-data-analysis.git",
@@ -57,7 +57,8 @@
     "skills/dsh-data-analysis-files/**",
     "python/presentation-kit/dist/dsh_data_analysis_presentation_kit-1.1.0-py3-none-any.whl",
     "cordis.patch.yml",
-    "README.md"
+    "README.md",
+    "README.en.md"
   ],
   "scripts": {
     "build": "npm run clean && tsc -p tsconfig.build.json && node scripts/finalize-build.mjs",
@@ -73,7 +74,7 @@
     "schema": "dsh-data-analysis-compatibility/v2",
     "dsh": {
       "distribution": "@deepseek-ai/dsh",
-      "peerRange": ">=0.1.5-rc.1"
+      "peerRange": ">=0.1.7-rc.1"
     },
     "marivo": {
       "version": "0.5.5",
@@ -98,7 +99,11 @@
         "@deepseek-ai/dsh-client-ui-input-trigger",
         "@deepseek-ai/dsh-client-ui-sidebar",
         "@deepseek-ai/dsh-client-ui-layout",
-        "@deepseek-ai/dsh-client-ui-sidebar-right"
+        "@deepseek-ai/dsh-client-ui-sidebar-right",
+        "@deepseek-ai/dsh-client-ui-settings",
+        "@deepseek-ai/dsh-client-ui-settings-plugins",
+        "@deepseek-ai/dsh-client-ui-plugin-manager",
+        "@deepseek-ai/dsh-client-ui-workspace"
       ],
       "platform": "web"
     },
@@ -109,37 +114,42 @@
   "dependencies": {
     "@aws-sdk/client-s3": "^3.1129.0",
     "@deepseek-ai/schemastery": "^3.18.1",
+    "@noble/hashes": "2.4.0",
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@deepseek-ai/dsh-agent-loop": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-anonymous-user-id": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-bash-local": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-store": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-ui-primitives": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-ui-renderer": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-ui-sidebar-right": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-ui-slots": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-code-runtime": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-code-runtime-worker-thread": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-credentials-local": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-fs-local": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-fs-observation-policy": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-launch-environment": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-llm-deepseek": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-scope": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-session-persistence": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-session-persistence-jsonl": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-session-projection": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-skill": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-storage": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-storage-json": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-subprocess-local": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-tool-bash": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-tool-fs": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-tool-present": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-tool-skill": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-util-workspace-path": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-app-boot": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-config-editor": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-agent-loop": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-anonymous-user-id": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-bash-local": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-store": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-ui-primitives": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-ui-plugin-manager": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-ui-workspace": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-ui-renderer": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-ui-sidebar-right": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-ui-slots": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-credentials-local": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-fs-local": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-sandbox-local": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-sandbox-policy": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-fs-observation-policy": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-launch-environment": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-llm-deepseek": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-scope": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-session-persistence": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-session-persistence-jsonl": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-session-projection": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-skill": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-storage": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-storage-json": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-subprocess-local": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-tool-bash": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-tool-fs": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-tool-present": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-tool-skill": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-util-workspace-path": "0.1.7-rc.1",
     "@shikijs/core": "4.4.3",
     "@shikijs/engine-javascript": "4.4.3",
     "@shikijs/langs": "4.4.3",
@@ -155,41 +165,51 @@
     "recharts": "3.8.1",
     "sql-formatter": "15.8.2",
     "typescript": "^6.0.3",
-    "zustand": "4.4.7"
+    "zustand": "4.4.7",
+    "@deepseek-ai/dsh-settings": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-ui-settings": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-ui-settings-plugins": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-ptc-runtime-node": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-ptc-runtime": "0.1.7-rc.1"
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-agent": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-api-gateway": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-api-session-controller": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-api-workspace-controller": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-atomic-write": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-connection": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-locale": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-ui-chat": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-ui-conversation": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-ui-input-trigger": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-ui-layout": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-ui-primitives": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-ui-sidebar": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-ui-sidebar-right": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-ui-tool": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-credentials": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-home-paths": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-llm": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-sandbox": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-scope": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-session": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-shell": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-shell-env": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-skill-filesystem": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-storage-domain": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-system-prompt": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-tools": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-typert-protocol": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-typert-registry": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-util-values": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-workspace": ">=0.1.5-rc.1",
-    "react": "^18.3.1"
+    "@deepseek-ai/dsh-agent": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-api-gateway": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-api-session-controller": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-api-workspace-controller": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-atomic-write": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-connection": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-locale": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-ui-chat": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-ui-conversation": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-ui-input-trigger": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-ui-layout": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-ui-primitives": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-ui-plugin-manager": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-ui-workspace": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-ui-sidebar": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-ui-sidebar-right": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-ui-tool": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-credentials": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-home-paths": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-llm": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-sandbox": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-scope": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-session": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-shell": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-shell-env": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-skill-filesystem": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-storage-domain": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-system-prompt": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-tools": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-typert-protocol": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-typert-registry": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-util-values": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-workspace": ">=0.1.7-rc.1",
+    "react": "^18.3.1",
+    "@deepseek-ai/dsh-settings": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-ui-settings": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-ui-settings-plugins": ">=0.1.7-rc.1"
   }
 }

package/skills/dsh-data-analysis-files/SKILL.md

@@ -1,32 +1,44 @@
 ---
 name: dsh-data-analysis-files
-description: 分析已上传或 Workspace 中的 CSV、JSON、Parquet、Excel 文件，使用 pandas 或 DuckDB 计算，按需导出 CSV、JSON、PNG 等普通文件或接入报告。无需先建立 Marivo datasource 或语义模型。
+description: 分析附件或 Workspace 中的 CSV、JSON、Parquet、Excel 数据，回答问题或交付 CSV、TSV、XLSX、JSON、PNG 文件并使用原生表格预览。可接续报告展示，无需先建立 Marivo datasource 或语义模型。
 ---
 
 # 文件分析
 
+本 Skill 负责文件读取、计算、分析核对与普通文件交付。按用户问题选择方法；需要保存报告或交互展示时，完成分析后交给 `dsh-data-analysis-presentation`。
+
+## 确认输入与执行
+
 使用 Harness 提供的当前附件可读路径，或用户指定的 Workspace 文件；同名附件按消息和完整路径区分。路径不可读时报告实际问题，不猜测 Host 缓存位置。
+在实际读取代码中使用该完整路径，使执行记录保留输入身份；不为缩短路径而复制成 Workspace 同名文件，以免覆盖或在后续追问中读到旧副本。
 
-文件读取、计算和最终文件生成（包括 CSV、JSON、PNG）均通过 `marivo_python` 在绑定 Runtime 中执行，不改走 Bash 的 `python`／`python3` 或其他解释器。纯本地文件分析可直接使用 pandas 或原生 `duckdb`，传 `datasources: []`；按任务选择或组合使用，无需 `md.raw_sql`、Marivo 分析 Skill、live Help 或语义建模。只有实际访问 Marivo datasource 时才声明其精确名称并查询相关契约。
+文件读取、计算和最终文件生成均通过 `marivo_python` 在绑定 Runtime 中执行，不改走 Bash 的 `python`／`python3` 或其他解释器。纯本地文件分析可直接使用 pandas 或原生 `duckdb`，传 `datasources: []`；无需 `md.raw_sql`、Marivo 分析 Skill、live Help 或语义建模。只有实际访问 Marivo datasource 时才声明其精确名称并查询相关契约。
 
 使用现有 reader，保留回答所需的 sheet、字段和解析范围；区分样本与全量。Excel `.xlsx` 可用 DuckDB `read_xlsx`，首次使用可能联网获取官方扩展；不承诺旧 `.xls` 或冷缓存离线读取，不临时安装 Python 依赖。
 
 每次 `marivo_python` 都是独立进程。原生 DuckDB 连接可在本次调用内复用、创建临时表，并及时关闭；后续追问重新读取原文件或已有结果，不依赖上次内存状态。按问题控制读取和输出规模，SQL `LIMIT` 不代表仅扫描这些行。
 
-## 按用户目标交付
+## 计算与核对
+
+按问题确认粒度、单位、时间范围与比较基准；检查会影响计算的解析类型、缺失值、重复记录及连接基数。合并同名文件、筛选或去重时说明实际规则，不把缺失值当零，不把样本当全量。
 
-普通答案直接用文字，不为结论额外创建文件。用户要求 CSV、JSON、PNG 等实际文件时，先通过 `marivo_python` 生成最终文件，优先写入当前绑定 Workspace；确认执行成功、文件存在后，调用当前实际可用的 Harness 原生 `present`，再回复用户。回复前分别核对文件生成与原生声明状态：生成文件、回复路径或展示代码块均不能替代原生交付。缺少 `present` 时，最终回复必须说明“文件已生成，原生交付能力不可用”，并提供准确路径；不能只说文件已生成。不猜测附件缓存或 Shell 私有临时目录。
+完成文字答案或生成交付物前，逐项核对用户问题及各比较分支。保留比较两侧、变化方向和比例分母，从原值核对差值、比例与合计；Top N 或子集不能替代全量结论。观测和数值贡献不自动证明原因；结论措辞应体现实际证据强度。
+最后核对解释文字中的比较名称与涨跌方向是否和表中同一项一致；基准不同可以解释比率差异，本身不能证明业务变化的原因。
 
-需要交互图表、表格、报告或看板时加载 `dsh-data-analysis-presentation`，将 DataFrame 交给现有 writer，并关联实际返回的 `codeRef`，使用 `marivo_present` 保存固定 Build。在正文说明文件名与分析范围，不将文件结果冒充 Marivo Artifact 或 Evidence。普通 `present` 不赋予文件 Report/Build 或 Evidence 身份。
+某个基准或分支缺数据时，交付已有支持的答案，并明确缺失范围及影响，不用另一项成功比较替代。所需答案已有支持或已明确阻塞时结束，不为完善展示额外扩展分析。
 
-报告内部的 `presentation.json`、computed 数据和 receipt 不作为默认附件；只有用户另行要求实际文件且文件已经存在于 Session 文件系统可访问位置时，才调用 `present`。阅读器下载／发布 HTML 沿用现有流程，浏览器内生成的下载不伪装成 Session 文件。
+## 可复用语义与停止条件
 
-## 能力与失败
+分析中发现可供后续任务复用的业务定义或语义缺口时，先区分共享口径与本次结果：指标定义、维度含义或业务关系可作为语义候选；观测数值、临时筛选与未验证假设保留在当前分析中，不自动成为共享定义。
 
-遵循 Harness [present 契约](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-rc.1/packages/fs/tool-present/README.md)，由工具验证路径和文件类型。当前工具集中缺少 `present` 时，明确说明“文件已生成，原生交付能力不可用”，提供实际准确路径供手动使用，不虚构卡片，不安装工具或改写 profile。
+仅当当前问题需要该共享定义，或用户已授权语义沉淀时，加载 `marivo-semantic`，携带复用用途、已有依据、适用范围和未决含义，按其 Skill 与实时 Help 检查并优先复用已有对象。需要新增或修正时只处理最小必要缺口；业务含义与授权已明确则继续，实质歧义按语义 Skill 澄清，不自行猜测定义，也不重复请求已有授权。
+
+收到经验证的对象引用后继续原问题；必要对象已完成且原问题已回答，或阻塞已明确时停止。不递归扩展相邻指标、实体或业务域。顺带发现的范围外机会只在答复中简要说明用途与依据，不自动建模、另建记录文件或继续探索。普通文件计算仍无需语义建模；展示流程不承担语义沉淀。
+
+## 按用户目标交付
 
-生成失败不声明成功；声明失败区分“文件已生成”和“交付未完成”，修复路径或可见性后只重试交付，不为补卡片重跑分析。响应不确定时先核对已有调用结果和事件，不盲目重复声明。原生打开失败时使用 Host 的预览或错误反馈，不绕过权限。
+普通答案和简短比较表格直接在聊天中回答，不额外创建文件。用户要查看或交付已有的 CSV、TSV、XLSX 表格文件时，确认当前 Session 可访问该文件后，按[文件交付](references/delivery.md)调用实际可用的 Harness 原生 `present`；交付卡片由 Harness 在右侧打开只读表格预览。用户要求生成 CSV、TSV、JSON、PNG 等实际文件时，通过 `marivo_python` 生成最终文件，优先写入当前绑定 Workspace；确认执行成功、文件存在后再调用 `present`。文件生成和原生声明分别核对，路径或代码块不能替代交付。不承诺插件能写入 XLSX，也不把 Harness 对旧 `.xls` 的预览当作插件可分析 `.xls`。
 
-卡片打开当前源文件，不保存内容版本；修改、移动或删除会影响后续读取。成功声明的持久事件属于 Harness，即使 PTC 外层程序随后失败，也不撤销已成功的声明。子代理产物属于其调用 Session；父 Agent 如需交付，先确认自己能访问文件，再在父 Session 显式调用 `present`，不自动跨 Session 转投递。
+需要在报告中筛选或联动分析结果的图表、表格、报告或看板时加载 `dsh-data-analysis-presentation`，将 DataFrame 交给现有 writer，关联实际返回的 `codeRef`，用 `marivo_present` 保存固定 Build。在正文说明文件名与分析范围，不将文件结果冒充 Marivo Artifact 或 Evidence。普通 `present` 不赋予文件 Report/Build 或 Evidence 身份。
 
 需要起步代码时读[简短示例](references/examples.md)；其中提供无需额外依赖的 PNG 写入代码，也通过 `marivo_python` 执行。

package/skills/dsh-data-analysis-files/references/delivery.md

@@ -0,0 +1,15 @@
+# 文件交付与恢复
+
+用户要求查看或交付 CSV、TSV、XLSX、JSON、PNG 等实际文件时读取本页。生成或确认文件后，按当前 Harness 原生 `present` 工具契约交付；不猜测附件缓存或 Shell 私有临时目录。工具拥有路径与类型校验，契约见 Harness `dsh-v0.1.7-rc.1/packages/deliverables/tool-present/README.zh.md`。
+
+## 生成与声明
+
+只交付用户要求的最终文件。报告内部的 `presentation.json`、computed 数据和 receipt 不作为默认附件；用户另行要求时，先确认实际文件已经存在且当前 Session 可访问。浏览器内生成的下载不伪装成 Session 文件；报告 HTML 交给展示 Skill 的导出或发布流程。
+
+文件生成成功，或用户要求预览且已有文件确认可访问后，调用 `present`，分别核对生成与声明结果。CSV、TSV、XLSX 由 Harness 原生表格预览读取文件，契约见 `dsh-v0.1.7-rc.1/packages/client/ui-sidebar-documentpreview/README.zh.md`；这是只读文件视图，不是 Marivo Report/Build，也不代表插件支持写入 XLSX 或分析旧 `.xls`。当前缺少 `present` 时，说明文件实际状态和原生交付能力不可用，并提供准确路径；不虚构卡片，不安装工具或改写 profile。
+
+## 失败与再次交付
+
+生成失败不声明成功；声明失败区分“文件已生成”和“交付未完成”。修复路径或可见性后只重试交付，不为补卡片重跑分析。响应不确定时先核对已有调用结果和事件，不盲目重复声明。原生打开失败时使用 Host 的预览或错误反馈，不绕过权限。
+
+卡片读取当前源文件，不保存内容版本；修改、移动或删除会影响后续读取。成功声明的持久事件属于 Harness，即使 PTC 外层程序随后失败，也不撤销已成功的声明。子代理产物属于其调用 Session；父 Agent 如需交付，先确认自己能访问文件，再在父 Session 显式调用 `present`，不自动跨 Session 转投递。