@chengxianglibra/dsh-data-analysis 0.2.1 → 0.2.2

package/lib/datasource/changes-contract.js

@@ -18,14 +18,18 @@ const descriptor = {
             name: 'sessionId',
             wire: 'sessionId',
             source: 'json',
-            codec: { mode: 'strict', typeSymbol: `${owner}#CredentialSessionId`, schema: sessionId },
+            codec: {
+                mode: 'strict',
+                typeSymbol: `${owner}#CredentialSessionId`,
+                create: () => sessionId,
+            },
         },
     ],
     cancellation: { parameter: 'signal' },
     result: {
         mode: 'strict',
         typeSymbol: `${owner}#CredentialRevision`,
-        schema: credentialRevisionSchema,
+        create: () => credentialRevisionSchema,
     },
 };
 export const credentialChangesHost = {

package/lib/datasource/python.js

@@ -116,6 +116,7 @@ export function registerMarivoPythonTool(ctx, source, service, options = {}) {
                     command: `${process.platform === 'win32' ? '& ' : ''}${quote(binding.pythonExecutable)} -c ${quote(PYTHON_LAUNCHER)}`,
                     workdir: binding.projectRoot,
                     timeoutMs: requestedTimeoutMs,
+                    onExpiry: 'kill',
                     signal: prepared.signal,
                     stdin: JSON.stringify({
                         identity: binding,
@@ -135,7 +136,8 @@ export function registerMarivoPythonTool(ctx, source, service, options = {}) {
                 const startedAt = new Date().toISOString();
                 phase = 'executing';
                 shellStartedAt = performance.now();
-                const result = await service.track(shell.run(spec));
+                const execution = await service.track(shell.execute(spec));
+                const result = await service.track(execution.result());
                 executionElapsedMs = performance.now() - shellStartedAt;
                 const finishedAt = new Date().toISOString();
                 const credentialValues = prepared.values;

package/lib/plugin.js

@@ -5,7 +5,7 @@ import { createMarivoAgentInstallation } from "./plugin-agents.js";
 import { registerPublishingCredentials } from "./report-publishing/adapters.js";
 import { resolvePublishingConfig } from "./report-publishing/config.js";
 import { ReportPublishingService } from "./report-publishing/service.js";
-import { installPythonSettings } from "./settings.js";
+import { currentPythonOptions, installPythonSettings, } from "./settings.js";
 import { resolvePresentationWorkspace } from "./workspace-identity.js";
 export { installMarivoPlugin } from "./plugin-agents.js";
 export { resolvePresentationWorkspace } from "./workspace-identity.js";
@@ -17,7 +17,7 @@ import { apply as installSkillFilesystem } from '@deepseek-ai/dsh-skill-filesyst
 import { WorkspaceId } from '@deepseek-ai/dsh-workspace';
 import z from '@deepseek-ai/schemastery';
 import { MarivoDatasourceBridge } from "./datasource/bridge.js";
-import { DEFAULT_PYTHON_TIMEOUT_MS, resolvePythonOptions, } from "./datasource/python-options.js";
+import { DEFAULT_PYTHON_TIMEOUT_MS } from "./datasource/python-options.js";
 import { registerCredentialRpc } from "./datasource/rpc.js";
 import { MarivoCredentialService } from "./datasource/service.js";
 import { registerMarivoRuntimeShellEnvironment } from "./datasource/shell-env.js";
@@ -47,7 +47,13 @@ export const Config = z.object({
     // Defer validation to authoring so loader errors cannot echo configured values.
     datasourceDefaults: z.any(),
     reportPublishing: z.any(),
-    pythonTimeoutMs: z.number().default(DEFAULT_PYTHON_TIMEOUT_MS),
+    pythonTimeoutMs: z
+        .number()
+        .min(1)
+        .max(2_147_483_647)
+        .step(1)
+        .default(DEFAULT_PYTHON_TIMEOUT_MS)
+        .volatile(),
     credentialInteraction: z.union(['web', 'none']).default('web'),
     projectRoot: z.string(),
     pythonExecutable: z.string(),
@@ -65,7 +71,7 @@ function configuredProjectRoot(config, agent) {
 /** Ensure the shared Runtime once, mount its skills, then bind each Workspace lazily. */
 export async function apply(ctx, config = {}) {
     const publishingConfig = resolvePublishingConfig(config.reportPublishing);
-    const pythonOptions = resolvePythonOptions(config);
+    const pythonOptions = currentPythonOptions(config);
     const pythonExecutable = config.pythonExecutable ?? process.env.DSH_DATA_ANALYSIS_PYTHON;
     const runtimeRoot = config.runtimeRoot ?? process.env.DSH_DATA_ANALYSIS_RUNTIME_ROOT;
     const bootstrapPythonExecutable = config.bootstrapPythonExecutable ?? process.env.DSH_DATA_ANALYSIS_BOOTSTRAP_PYTHON;
@@ -134,7 +140,7 @@ export async function apply(ctx, config = {}) {
         return closing;
     };
     try {
-        pythonSettings = installPythonSettings(ctx, pythonOptions);
+        pythonSettings = installPythonSettings(ctx, config);
         unregisterChanges = ctx.typert.register(credentialChangesHost);
         installSkillFilesystem(ctx, {
             providerName: 'dsh-data-analysis-marivo',

package/lib/presentation/execution-policy.js

@@ -0,0 +1,5 @@
+/** Report-specific wall-clock budgets; leave time after source reads for publication. */
+export const PRESENTATION_EXECUTION_BUDGETS = Object.freeze({
+    sourceReadTimeoutMs: 120_000,
+    toolTimeoutMs: 180_000,
+});

package/lib/presentation/projection/index.js

@@ -1,6 +1,7 @@
 import { MarivoEnvironmentError } from "../../environment/errors.js";
 import { readPythonExecution } from "../../python-execution.js";
 import { PRESENTATION_BUDGETS, PresentationContractError, parsePresentationDocument, parsePresentationDraft, parseTypedDataset, } from "../contracts/index.js";
+import { PRESENTATION_EXECUTION_BUDGETS } from "../execution-policy.js";
 import { readWorkspaceJson } from "./files.js";
 import { MARIVO_PRESENTATION_READ_PROGRAM } from "./program.js";
 export { readWorkspaceJson } from "./files.js";
@@ -60,16 +61,32 @@ export class MarivoPresentationProjection {
         let diagnostics = [];
         const artifactData = new Map();
         if (draft.sources.length > 0) {
-            const result = await this.#runner.runChecked({
-                program: MARIVO_PRESENTATION_READ_PROGRAM,
-                args: [JSON.stringify({ sources: draft.sources, datasets: artifactSelections })],
-                limits: {
-                    timeoutMs: 30_000,
-                    stdoutMaxBytes: PRESENTATION_BUDGETS.documentBytes,
-                    stderrMaxBytes: 65_536,
-                },
-                signal: options.signal,
-            });
+            const startedAt = performance.now();
+            let result;
+            try {
+                result = await this.#runner.runChecked({
+                    program: MARIVO_PRESENTATION_READ_PROGRAM,
+                    args: [JSON.stringify({ sources: draft.sources, datasets: artifactSelections })],
+                    limits: {
+                        timeoutMs: PRESENTATION_EXECUTION_BUDGETS.sourceReadTimeoutMs,
+                        stdoutMaxBytes: PRESENTATION_BUDGETS.documentBytes,
+                        stderrMaxBytes: 65_536,
+                    },
+                    signal: options.signal,
+                });
+            }
+            catch (error) {
+                if (!(error instanceof MarivoEnvironmentError) || error.code !== 'subprocess-timeout')
+                    throw error;
+                // Construct only safe operation metadata; upstream messages/details may contain secrets.
+                throw new MarivoEnvironmentError('subprocess-timeout', 'Presentation source reading timed out. Source projection did not complete; report submission has not started. Keep the draft and source declarations for retry; do not remove sources or rerun analysis to repair presentation.', {
+                    phase: 'presentation-source-read',
+                    timeoutMs: PRESENTATION_EXECUTION_BUDGETS.sourceReadTimeoutMs,
+                    durationMs: Math.max(0, Math.round(performance.now() - startedAt)),
+                    sourceCount: draft.sources.length,
+                    sessionCount: new Set(draft.sources.map((source) => source.ref.sessionId)).size,
+                });
+            }
             this.#assertReady(options.signal);
             if (result.exitCode !== 0)
                 throw new MarivoEnvironmentError('subprocess-failed', 'The bound Marivo presentation read failed.', { exitCode: result.exitCode });

package/lib/presentation/tool.js

@@ -2,6 +2,7 @@ import { randomUUID } from 'node:crypto';
 import { defineTool } from '@deepseek-ai/dsh-tools';
 import { registerMarivoTool } from "../tool-lifecycle.js";
 import { parsePresentationBuildId } from "./contracts/index.js";
+import { PRESENTATION_EXECUTION_BUDGETS } from "./execution-policy.js";
 import { MARIVO_PRESENT_TOOL_NAME, MARIVO_PRESENTATION_DELIVERY_KIND, parsePresentationDelivery, presentationReceiptText, } from "./receipt.js";
 import { publishPresentation, resolvePresentation } from "./reports.js";
 /** One call projects a draft, builds the document, commits them, then emits the receipt. */
@@ -38,7 +39,7 @@ export function createMarivoPresentTool(source, session, lifecycleSignal) {
             ],
             presentationMeta: (_args, value) => JSON.parse(value.deliveryJson),
         },
-        timeoutMs: 120_000,
+        timeoutMs: PRESENTATION_EXECUTION_BUDGETS.toolTimeoutMs,
         async execute(args, exec) {
             const signal = lifecycleSignal ? AbortSignal.any([exec.signal, lifecycleSignal]) : exec.signal;
             if (typeof args.draft_path !== 'string' ||

package/lib/settings.js

@@ -1,21 +1,17 @@
-import z from '@deepseek-ai/schemastery';
 import { resolvePythonOptions } from "./datasource/python-options.js";
 export const PYTHON_SETTINGS_NAMESPACE = 'dsh-data-analysis';
-export const PythonSettings = z.object({
-    pythonTimeoutMs: z.number().min(1).max(2_147_483_647).step(1).required(),
-});
-/** Follow the Host settings provider; headless compositions retain their entry configuration. */
+export function currentPythonOptions(options) {
+    const value = options.pythonTimeoutMs;
+    return resolvePythonOptions({
+        pythonTimeoutMs: value !== null && typeof value === 'object' && typeof value.get === 'function'
+            ? value.get()
+            : value,
+    });
+}
+/** Config is projected by the Host settings service; a headless composition reads its live entry. */
 export function installPythonSettings(ctx, options) {
-    const entry = resolvePythonOptions(options);
-    let source = () => entry;
     const dispose = ctx.inject(['settings'], (settingsCtx) => {
-        settingsCtx.settings.installSection(ctx, PYTHON_SETTINGS_NAMESPACE, PythonSettings, entry, {
-            validate: resolvePythonOptions,
-            setSource: (current) => {
-                source = current;
-            },
-            onChange: () => { },
-        });
+        settingsCtx.effect(() => settingsCtx.settings.configure({ auto: false }, ctx.fiber));
     });
-    return { get: () => source(), dispose: () => dispose.dispose() };
+    return { get: () => currentPythonOptions(options), dispose: () => dispose.dispose() };
 }

package/lib/types/client/settings/card.d.ts

@@ -1,9 +1,9 @@
-import type { SettingsScope } from '@deepseek-ai/dsh-client-ui-settings/client';
+import type { ConfigForm } from '@deepseek-ai/dsh-client-ui-settings/client';
 export interface PythonSettingsValue {
     pythonTimeoutMs: number;
 }
 /** Seconds in the form, exact integer milliseconds at the Host boundary. */
 export declare function timeoutMilliseconds(text: string): number | undefined;
 export declare function PythonSettingsCard({ scope }: {
-    scope: SettingsScope<PythonSettingsValue>;
+    scope: ConfigForm<PythonSettingsValue>;
 }): import("react").JSX.Element | null;

package/lib/types/disclosure/execution-guidance.d.ts

@@ -1,5 +1,13 @@
 import type { Agent } from '@deepseek-ai/dsh-agent';
 import type { MarivoDisclosureController } from './activation.ts';
+declare module '@deepseek-ai/dsh-llm' {
+    interface MessageSourceMap {
+        plugin: {
+            kind: 'plugin';
+            plugin: string;
+        };
+    }
+}
 export declare const MARIVO_DATASOURCE_CREDENTIAL_PROMPT: string;
 export declare const MARIVO_ANALYSIS_CLOSEOUT_PROMPT: string;
 /** Full-plugin seam: requires its execution tools, credentials service and system sections. */

package/lib/types/plugin.d.ts

@@ -1,17 +1,17 @@
 import { type ReportPublishingConfig } from './report-publishing/config.ts';
+import { type PythonTimeoutConfig } from './settings.ts';
 export { installMarivoPlugin, type MarivoPluginEnvironmentResolver } from './plugin-agents.ts';
 export { resolvePresentationWorkspace } from './workspace-identity.ts';
 import type { Context } from '@deepseek-ai/cordis';
 import z from '@deepseek-ai/schemastery';
 import type { DatasourceDefaults } from './datasource/defaults.ts';
-import { type MarivoPythonOptions } from './datasource/python-options.ts';
 export { MARIVO_DATASOURCE_CREDENTIAL_PROMPT } from './disclosure/execution-guidance.ts';
 /** Cordis plugin name used by loader diagnostics and lifecycle logs. */
 export declare const name = "dsh-data-analysis";
 /** Services that must exist before the plugin binds and watches Agent scopes. */
 export declare const inject: string[];
 /** Loader-safe configuration for the shared Runtime and per-Workspace bindings. */
-export interface Config extends MarivoPythonOptions {
+export interface Config extends PythonTimeoutConfig {
     readonly reportPublishing?: ReportPublishingConfig;
     /** Non-secret creation defaults by backend; checked against each live Runtime schema. */
     readonly datasourceDefaults?: DatasourceDefaults;
@@ -28,6 +28,26 @@ export interface Config extends MarivoPythonOptions {
     readonly installTimeoutMs?: number;
 }
 /** Cordis loader schema. Runtime defaults are resolved in {@link apply}. */
-export declare const Config: z<Config>;
+export declare const Config: z<Schemastery.ObjectS<NoInfer<{
+    datasourceDefaults: z<any, any, "plain">;
+    reportPublishing: z<any, any, "plain">;
+    pythonTimeoutMs: z<number, number, "volatile-defined">;
+    credentialInteraction: z<"none" | "web", "none" | "web", "defined">;
+    projectRoot: z<string, string, "plain">;
+    pythonExecutable: z<string, string, "plain">;
+    runtimeRoot: z<string, string, "plain">;
+    bootstrapPythonExecutable: z<string, string, "plain">;
+    installTimeoutMs: z<number, number, "defined">;
+}>>, Schemastery.ObjectT<NoInfer<{
+    datasourceDefaults: z<any, any, "plain">;
+    reportPublishing: z<any, any, "plain">;
+    pythonTimeoutMs: z<number, number, "volatile-defined">;
+    credentialInteraction: z<"none" | "web", "none" | "web", "defined">;
+    projectRoot: z<string, string, "plain">;
+    pythonExecutable: z<string, string, "plain">;
+    runtimeRoot: z<string, string, "plain">;
+    bootstrapPythonExecutable: z<string, string, "plain">;
+    installTimeoutMs: z<number, number, "defined">;
+}>>, "plain">;
 /** Ensure the shared Runtime once, mount its skills, then bind each Workspace lazily. */
 export declare function apply(ctx: Context, config?: Config): Promise<() => Promise<void>>;

package/lib/types/presentation/execution-policy.d.ts

@@ -0,0 +1,5 @@
+/** Report-specific wall-clock budgets; leave time after source reads for publication. */
+export declare const PRESENTATION_EXECUTION_BUDGETS: Readonly<{
+    sourceReadTimeoutMs: 120000;
+    toolTimeoutMs: 180000;
+}>;

package/lib/types/rpc.d.ts

@@ -1,3 +1,3 @@
 /** Dedicated plugin RPC envelopes over Harness-owned authenticated exact Fetch routes. */
-import { type ConnectionRpcHandler, type HostConnectionHandle } from '@deepseek-ai/dsh-client-connection';
-export declare function registerPluginRpc(connection: Pick<HostConnectionHandle, 'fetch'>, channel: string, endpoints: readonly string[], handler: ConnectionRpcHandler): () => Promise<void>;
+import { type ConnectionRpcHandlerResult, type HostConnectionHandle } from '@deepseek-ai/dsh-client-connection';
+export declare function registerPluginRpc(connection: Pick<HostConnectionHandle, 'fetch'>, channel: string, endpoints: readonly string[], handler: (endpoint: string, payload: unknown, signal: AbortSignal) => Promise<ConnectionRpcHandlerResult>): () => Promise<void>;

package/lib/types/semantic-reference/rpc.d.ts

@@ -1,4 +1,4 @@
-import type { ConnectionRpcHandler, HostConnectionHandle } from '@deepseek-ai/dsh-client-connection';
+import type { ConnectionRpcHandlerResult, HostConnectionHandle } from '@deepseek-ai/dsh-client-connection';
 import type { MarivoCheckedRunner } from '../environment/types.ts';
 import { SemanticReferenceBridge } from './bridge.ts';
 import { type SemanticReferenceUsage } from './usage.ts';
@@ -12,4 +12,4 @@ export declare class SemanticReferenceService {
     stop(): void;
     close(): Promise<void>;
 }
-export declare function registerSemanticReferenceRpc(connection: HostConnectionHandle, service: SemanticReferenceService, browser?: ConnectionRpcHandler): () => Promise<void>;
+export declare function registerSemanticReferenceRpc(connection: HostConnectionHandle, service: SemanticReferenceService, browser?: (endpoint: string, payload: unknown, signal: AbortSignal) => Promise<ConnectionRpcHandlerResult>): () => Promise<void>;

package/lib/types/settings.d.ts

@@ -1,14 +1,14 @@
 import type { Context } from '@deepseek-ai/cordis';
-import z from '@deepseek-ai/schemastery';
 import { type MarivoPythonOptions } from './datasource/python-options.ts';
 export declare const PYTHON_SETTINGS_NAMESPACE = "dsh-data-analysis";
-export declare const PythonSettings: z<Schemastery.ObjectS<{
-    pythonTimeoutMs: z<number, number>;
-}>, Schemastery.ObjectT<{
-    pythonTimeoutMs: z<number, number>;
-}>>;
-/** Follow the Host settings provider; headless compositions retain their entry configuration. */
-export declare function installPythonSettings(ctx: Context, options: MarivoPythonOptions): {
+export interface PythonTimeoutConfig {
+    pythonTimeoutMs?: number | {
+        get(): number;
+    };
+}
+export declare function currentPythonOptions(options: PythonTimeoutConfig): Required<MarivoPythonOptions>;
+/** Config is projected by the Host settings service; a headless composition reads its live entry. */
+export declare function installPythonSettings(ctx: Context, options: PythonTimeoutConfig): {
     get: () => Required<MarivoPythonOptions>;
     dispose: () => Promise<void>;
 };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@chengxianglibra/dsh-data-analysis",
   "description": "Marivo runtime, live Help, secure datasource execution and presentation delivery for DeepSeek Harness",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/chengxianglibra/dsh-data-analysis.git",
@@ -74,7 +74,7 @@
     "schema": "dsh-data-analysis-compatibility/v2",
     "dsh": {
       "distribution": "@deepseek-ai/dsh",
-      "peerRange": ">=0.1.5-rc.1"
+      "peerRange": ">=0.1.7-rc.1"
     },
     "marivo": {
       "version": "0.5.5",
@@ -101,7 +101,9 @@
         "@deepseek-ai/dsh-client-ui-layout",
         "@deepseek-ai/dsh-client-ui-sidebar-right",
         "@deepseek-ai/dsh-client-ui-settings",
-        "@deepseek-ai/dsh-client-ui-settings-plugins"
+        "@deepseek-ai/dsh-client-ui-settings-plugins",
+        "@deepseek-ai/dsh-client-ui-plugin-manager",
+        "@deepseek-ai/dsh-client-ui-workspace"
       ],
       "platform": "web"
     },
@@ -112,37 +114,42 @@
   "dependencies": {
     "@aws-sdk/client-s3": "^3.1129.0",
     "@deepseek-ai/schemastery": "^3.18.1",
+    "@noble/hashes": "2.4.0",
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@deepseek-ai/dsh-agent-loop": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-anonymous-user-id": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-bash-local": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-store": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-ui-primitives": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-ui-renderer": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-ui-sidebar-right": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-ui-slots": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-code-runtime": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-code-runtime-worker-thread": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-credentials-local": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-fs-local": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-fs-observation-policy": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-launch-environment": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-llm-deepseek": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-scope": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-session-persistence": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-session-persistence-jsonl": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-session-projection": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-skill": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-storage": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-storage-json": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-subprocess-local": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-tool-bash": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-tool-fs": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-tool-present": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-tool-skill": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-util-workspace-path": "0.1.5-rc.1",
+    "@deepseek-ai/dsh-app-boot": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-config-editor": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-agent-loop": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-anonymous-user-id": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-bash-local": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-store": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-ui-primitives": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-ui-plugin-manager": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-ui-workspace": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-ui-renderer": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-ui-sidebar-right": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-ui-slots": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-credentials-local": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-fs-local": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-sandbox-local": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-sandbox-policy": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-fs-observation-policy": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-launch-environment": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-llm-deepseek": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-scope": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-session-persistence": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-session-persistence-jsonl": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-session-projection": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-skill": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-storage": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-storage-json": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-subprocess-local": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-tool-bash": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-tool-fs": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-tool-present": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-tool-skill": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-util-workspace-path": "0.1.7-rc.1",
     "@shikijs/core": "4.4.3",
     "@shikijs/engine-javascript": "4.4.3",
     "@shikijs/langs": "4.4.3",
@@ -159,47 +166,50 @@
     "sql-formatter": "15.8.2",
     "typescript": "^6.0.3",
     "zustand": "4.4.7",
-    "@deepseek-ai/dsh-settings": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-ui-settings": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-ui-settings-plugins": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-settings-file": "0.1.5-rc.1"
+    "@deepseek-ai/dsh-settings": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-ui-settings": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-ui-settings-plugins": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-ptc-runtime-node": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-ptc-runtime": "0.1.7-rc.1"
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-agent": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-api-gateway": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-api-session-controller": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-api-workspace-controller": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-atomic-write": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-connection": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-locale": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-ui-chat": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-ui-conversation": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-ui-input-trigger": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-ui-layout": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-ui-primitives": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-ui-sidebar": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-ui-sidebar-right": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-ui-tool": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-credentials": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-home-paths": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-llm": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-sandbox": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-scope": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-session": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-shell": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-shell-env": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-skill-filesystem": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-storage-domain": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-system-prompt": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-tools": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-typert-protocol": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-typert-registry": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-util-values": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-workspace": ">=0.1.5-rc.1",
+    "@deepseek-ai/dsh-agent": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-api-gateway": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-api-session-controller": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-api-workspace-controller": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-atomic-write": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-connection": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-locale": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-ui-chat": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-ui-conversation": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-ui-input-trigger": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-ui-layout": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-ui-primitives": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-ui-plugin-manager": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-ui-workspace": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-ui-sidebar": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-ui-sidebar-right": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-ui-tool": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-credentials": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-home-paths": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-llm": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-sandbox": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-scope": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-session": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-shell": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-shell-env": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-skill-filesystem": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-storage-domain": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-system-prompt": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-tools": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-typert-protocol": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-typert-registry": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-util-values": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-workspace": ">=0.1.7-rc.1",
     "react": "^18.3.1",
-    "@deepseek-ai/dsh-settings": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-ui-settings": ">=0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-ui-settings-plugins": ">=0.1.5-rc.1"
+    "@deepseek-ai/dsh-settings": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-ui-settings": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-ui-settings-plugins": ">=0.1.7-rc.1"
   }
 }

package/skills/dsh-data-analysis-files/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: dsh-data-analysis-files
-description: 分析附件或 Workspace 中的 CSV、JSON、Parquet、Excel 数据，回答问题或交付 CSV、JSON、PNG 文件。可接续报告展示，无需先建立 Marivo datasource 或语义模型。
+description: 分析附件或 Workspace 中的 CSV、JSON、Parquet、Excel 数据，回答问题或交付 CSV、TSV、XLSX、JSON、PNG 文件并使用原生表格预览。可接续报告展示，无需先建立 Marivo datasource 或语义模型。
 ---
 
 # 文件分析
@@ -37,8 +37,8 @@ description: 分析附件或 Workspace 中的 CSV、JSON、Parquet、Excel 数
 
 ## 按用户目标交付
 
-普通答案和简短比较表格直接在聊天中回答，不额外创建文件。用户要求 CSV、JSON、PNG 等实际文件时，先读[文件交付](references/delivery.md)，通过 `marivo_python` 生成最终文件，优先写入当前绑定 Workspace；确认执行成功、文件存在后，调用实际可用的 Harness 原生 `present`，再回复用户。文件生成和原生声明分别核对，路径或代码块不能替代交付。
+普通答案和简短比较表格直接在聊天中回答，不额外创建文件。用户要查看或交付已有的 CSV、TSV、XLSX 表格文件时，确认当前 Session 可访问该文件后，按[文件交付](references/delivery.md)调用实际可用的 Harness 原生 `present`；交付卡片由 Harness 在右侧打开只读表格预览。用户要求生成 CSV、TSV、JSON、PNG 等实际文件时，通过 `marivo_python` 生成最终文件，优先写入当前绑定 Workspace；确认执行成功、文件存在后再调用 `present`。文件生成和原生声明分别核对，路径或代码块不能替代交付。不承诺插件能写入 XLSX，也不把 Harness 对旧 `.xls` 的预览当作插件可分析 `.xls`。
 
-需要交互图表、表格、报告或看板时加载 `dsh-data-analysis-presentation`，将 DataFrame 交给现有 writer，关联实际返回的 `codeRef`，用 `marivo_present` 保存固定 Build。在正文说明文件名与分析范围，不将文件结果冒充 Marivo Artifact 或 Evidence。普通 `present` 不赋予文件 Report/Build 或 Evidence 身份。
+需要在报告中筛选或联动分析结果的图表、表格、报告或看板时加载 `dsh-data-analysis-presentation`，将 DataFrame 交给现有 writer，关联实际返回的 `codeRef`，用 `marivo_present` 保存固定 Build。在正文说明文件名与分析范围，不将文件结果冒充 Marivo Artifact 或 Evidence。普通 `present` 不赋予文件 Report/Build 或 Evidence 身份。
 
 需要起步代码时读[简短示例](references/examples.md)；其中提供无需额外依赖的 PNG 写入代码，也通过 `marivo_python` 执行。

package/skills/dsh-data-analysis-files/references/delivery.md

@@ -1,12 +1,12 @@
 # 文件交付与恢复
 
-用户要求 CSV、JSON、PNG 等实际文件时读取本页。生成最终文件后，按当前 Harness 原生 `present` 工具契约交付；不猜测附件缓存或 Shell 私有临时目录。工具拥有路径与类型校验，详见 Harness [present 契约](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-rc.1/packages/fs/tool-present/README.md)。
+用户要求查看或交付 CSV、TSV、XLSX、JSON、PNG 等实际文件时读取本页。生成或确认文件后，按当前 Harness 原生 `present` 工具契约交付；不猜测附件缓存或 Shell 私有临时目录。工具拥有路径与类型校验，契约见 Harness `dsh-v0.1.7-rc.1/packages/deliverables/tool-present/README.zh.md`。
 
 ## 生成与声明
 
 只交付用户要求的最终文件。报告内部的 `presentation.json`、computed 数据和 receipt 不作为默认附件；用户另行要求时，先确认实际文件已经存在且当前 Session 可访问。浏览器内生成的下载不伪装成 Session 文件；报告 HTML 交给展示 Skill 的导出或发布流程。
 
-文件生成成功后调用 `present`，分别核对生成与声明结果。当前缺少 `present` 时，说明“文件已生成，原生交付能力不可用”，并提供准确路径；不虚构卡片，不安装工具或改写 profile。
+文件生成成功，或用户要求预览且已有文件确认可访问后，调用 `present`，分别核对生成与声明结果。CSV、TSV、XLSX 由 Harness 原生表格预览读取文件，契约见 `dsh-v0.1.7-rc.1/packages/client/ui-sidebar-documentpreview/README.zh.md`；这是只读文件视图，不是 Marivo Report/Build，也不代表插件支持写入 XLSX 或分析旧 `.xls`。当前缺少 `present` 时，说明文件实际状态和原生交付能力不可用，并提供准确路径；不虚构卡片，不安装工具或改写 profile。
 
 ## 失败与再次交付