@deepseek-ai/dsh-spill-policy 0.1.2-alpha.5 → 0.1.3-alpha.2

package/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/spill/spill-policy/README.md
-README.md: 4e7d83e81c865952c14af31cf13b7094e7e5f071
-README.zh.md: ef6036478a8d751f9de853df096397e216d4163a
+README.md: 1ccf250bacd0b896e6f140393fd3447de3af1ab0
+README.zh.md: e6c537a1c9bd0c24a09063898638a12bfe84466d

package/README.md

@@ -86,11 +86,17 @@ The policy is deliberately narrow: it only decides **when** to spill and compose
 
 A `tools/post-execute` waterfall listener (registered with `prepend`, delegating via `next()`) bounds the model-facing result; a `tools/ptc-dispatch-log` listener bounds the durable log copy of each `run_code` sub-call. Both share one replacement helper so the two projections are byte-identical. The post-execute arm skips `read` to avoid a read → spill → read loop; the dispatch-log arm bounds `read` sub-calls because a log copy is not model context.
 
+<a id="shared-notice-ownership"></a>
+### Shared notice ownership
+
+The browser-safe `@deepseek-ai/dsh-spill-policy/notice` entry owns both `formatSpillNotice(omitted, ref)`, used by the producer, and `hasSpillNotice(text)`, used by presentation consumers. Formatting and recognition share the notice delimiters; omission validation uses the existing `describeOmitted` formatter rather than a second copy of its prose. Recognition accepts a complete final notice after a preview or by itself and preserves the persisted notice spelling. It reads recorded text without rewriting it.
+
 ### Source map
 
 | File | Role |
 |---|---|
 | [`src/index.ts`](src/index.ts) | Plugin entry: `Config` validation, the two waterfall listeners, the shared replacement helper |
+| [`src/notice.ts`](src/notice.ts) | Browser-safe notice formatting and recognition, published as `./notice` |
 | [`src/types.ts`](src/types.ts) | `SpillPolicyExec`: the minimal structural view of a tool execution the policy reads for the owning session id |
 | — | No runtime invariant companion is published; this package exposes no independent event sequence or mutable data relation beyond contracts enforced at its owning seam. |
 
@@ -111,7 +117,6 @@ Read these pages when the package-level contract is not enough.
 - [dsh-spill-local](../spill-local/README.md) — the local backend that stores the spilled text.
 - [dsh-output-retention](../../util/output-retention/README.md) — the preview mechanics (`TextRetainer`) the policy composes.
 - [Tool output spill decision](../../../.agents/notes/implemented/architecture/2026-07-08-tool-output-spill-files.md) — the capability boundary and design rationale.
-- [PTC dispatch-log spill decision](../../../.agents/notes/implemented/feature/2026-07-26-ptc-dispatch-log-spill.md) — why the durable log copy is bounded too.
 
 -----
 
@@ -139,6 +144,7 @@ Append-only; newly visible content follows the reusable request prefix and does
 
 These limits define when the policy cannot help. They are current package constraints.
 
+- **Text recognition cannot authenticate output** — a tool can print the same notice text; `hasSpillNotice` identifies a text convention, not proof that the policy saved a result.
 - **Only final plain-text results are spillable** — mixed-content results, blocked feedback, and `read` pass through; provider truncation or tool-owned retention that happened earlier cannot be recovered here.
 - **A notice that cannot fit disables replacement for that call** — a tiny cap or long locator leaves the oversized original inline after the backend has already saved an unreferenced spill.
 

package/README.zh.md

@@ -86,11 +86,17 @@ kind: "package-reference"
 
 `tools/post-execute` waterfall（瀑布式事件）监听器（以 `prepend` 注册、通过 `next()` 委托）约束面向模型的结果；`tools/ptc-dispatch-log` 监听器约束每个 `run_code` 子调用的持久日志副本。两者共享同一个替换辅助函数，因此两个投影字节一致。post-execute 分支跳过 `read` 以避免 read → spill → read 循环；dispatch-log 分支约束 `read` 子调用，因为日志副本不是模型上下文。
 
+<a id="shared-notice-ownership"></a>
+### 共享通知的所有权
+
+浏览器安全入口 `@deepseek-ai/dsh-spill-policy/notice` 同时负责生产方使用的 `formatSpillNotice(omitted, ref)` 和展示消费方使用的 `hasSpillNotice(text)`。格式化与识别共用通知分隔符；省略信息通过现有的 `describeOmitted` 格式化函数校验，而非复制一套文案。识别支持预览之后或单独出现的完整末尾通知，并保留持久化通知的原有拼写。它只读取已记录的文本，不改写文本。
+
 ### 源码地图
 
 | 文件 | 职责 |
 |---|---|
 | [`src/index.ts`](src/index.ts) | 插件入口：`Config` 校验、两个 waterfall 监听器、共享替换辅助函数 |
+| [`src/notice.ts`](src/notice.ts) | 浏览器安全的通知格式化与识别，以 `./notice` 发布 |
 | [`src/types.ts`](src/types.ts) | `SpillPolicyExec`：策略读取所属会话 id 所需的最小结构化工具执行视图 |
 | — | 不发布运行时不变式伴生入口；约定在 seam 处强制执行。 |
 
@@ -111,7 +117,6 @@ kind: "package-reference"
 - [dsh-spill-local](../spill-local/README.zh.md)——保存 spill 文本的本地后端。
 - [dsh-output-retention](../../util/output-retention/README.zh.md)——策略组合的预览机制（`TextRetainer`）。
 - [工具输出 spill 决策](../../../.agents/notes/implemented/architecture/2026-07-08-tool-output-spill-files.zh.md)——能力边界与设计依据。
-- [PTC dispatch-log spill 决策](../../../.agents/notes/implemented/feature/2026-07-26-ptc-dispatch-log-spill.zh.md)——为何持久日志副本同样设界。
 
 -----
 
@@ -139,6 +144,7 @@ kind: "package-reference"
 
 这些限制说明策略在哪些情况下无法提供帮助。它们是当前的包约束。
 
+- **文本识别无法认证输出来源**——工具也能打印相同的通知文本；`hasSpillNotice` 识别的是文本约定，不能证明策略保存过结果。
 - **只能对最终纯文本结果执行 spill**——混合内容结果、阻止反馈与 `read` 会原样通过；此前已经发生的提供方截断或工具自有保留无法在此恢复。
 - **通知无法容纳时会禁用该次调用的替换**——上限极小或定位信息很长时，后端已经保存了无引用的 spill，但过大的原始结果仍留在内联位置。
 

package/lib/index.js

@@ -1,5 +1,27 @@
 import z from "@deepseek-ai/schemastery";
 import { TextRetainer, describeOmitted } from "@deepseek-ai/dsh-output-retention";
+//#region lib/types/notice.js
+/** Browser-safe formatting and recognition of persisted spill-policy notices. */
+const OPEN = "(";
+const CLOSE = ")";
+const LOCATION = " Full formatted result stored at: ";
+const GUIDANCE_SEPARATOR = ". ";
+const EXACT_OMISSION = describeOmitted({
+	kind: "exact",
+	count: 0
+}, "bytes");
+const COUNT_OFFSET = EXACT_OMISSION.indexOf("0");
+EXACT_OMISSION.slice(COUNT_OFFSET + 1);
+/**
+* Format the notice appended to a retained preview, preserving its persisted spelling.
+* @param omitted - bytes omitted by the retention policy.
+* @param ref - saved text locator and retrieval guidance.
+* @returns the complete notice without a leading preview separator.
+*/
+function formatSpillNotice(omitted, ref) {
+	return `${OPEN}${describeOmitted(omitted, "bytes")}${LOCATION}${ref.locator}${GUIDANCE_SEPARATOR}${ref.retrievalHint}${CLOSE}`;
+}
+//#endregion
 //#region lib/types/index.js
 /**
 * The spill-policy PLUGIN: a `tools/post-execute` result transformer that keeps
@@ -77,10 +99,6 @@ function preview(text, budget) {
 		omitted: kept.omittedBytes
 	};
 }
-/** The spill-notice line for a given omission + saved reference (no preview, no leading blank line). */
-function spillNotice(omitted, ref) {
-	return `(${describeOmitted(omitted, "bytes")} Full formatted result stored at: ${ref.locator}. ${ref.retrievalHint})`;
-}
 function apply(ctx, config) {
 	const maxInlineBytes = config.maxInlineBytes;
 	if (maxInlineBytes === void 0) return;
@@ -106,6 +124,7 @@ function apply(ctx, config) {
 		const save = {
 			owner: { sessionId },
 			source: {
+				kind: "tool",
 				toolName,
 				callId,
 				label
@@ -120,12 +139,12 @@ function apply(ctx, config) {
 			ctx.logger.warn(`spill-policy: saveText failed for ${toolName}: ${String(error)}; keeping the inline content`);
 			return;
 		}
-		const reserve = Buffer.byteLength(spillNotice({
+		const reserve = Buffer.byteLength(formatSpillNotice({
 			kind: "exact",
 			count: totalBytes
 		}, ref), "utf8") + 2;
 		const { text: previewText, omitted } = preview(text, Math.max(0, cap - reserve));
-		const notice = spillNotice(omitted, ref);
+		const notice = formatSpillNotice(omitted, ref);
 		const replacedText = previewText.length > 0 ? `${previewText}\n\n${notice}` : notice;
 		if (Buffer.byteLength(replacedText, "utf8") > cap) {
 			ctx.logger.warn(`spill-policy: spill notice for ${toolName} exceeds maxInlineBytes; keeping the inline content`);

package/lib/types/index.js

@@ -0,0 +1,195 @@
+/**
+ * The spill-policy PLUGIN: a `tools/post-execute` result transformer that keeps
+ * oversized plain-text tool results out of the model's context. When a final
+ * result's UTF-8 size exceeds `maxInlineBytes`, it saves the FULL text to a
+ * session-scoped spill artifact (`ctx.spillStore`) and replaces the
+ * model-facing result with a bounded head/tail preview plus the backend's
+ * locator and retrieval guidance.
+ *
+ * It registers NO service and owns NO storage or preview mechanics: preview is
+ * `@deepseek-ai/dsh-output-retention` (`TextRetainer`), storage is `ctx.spillStore`.
+ * The policy only decides WHEN to spill and composes the notice.
+ *
+ * A second arm applies the SAME cap to the durable log: the
+ * `tools/ptc-dispatch-log` waterfall bounds the `tool/code-dispatch` event's
+ * copy of an oversized `run_code` sub-call result (the program's value is
+ * untouched; UIs and replay read the full text through the spill artifact).
+ *
+ * ## Deliberately narrow
+ *
+ * - Omitted `maxInlineBytes` ⇒ the plugin registers nothing (a true no-op).
+ * - Plain-text results only: a result carrying any non-text block is left
+ *   untouched (the policy knows only the final formatted text, not tool
+ *   internals).
+ * - Nested composite calls skip the MODEL-facing arm; their durable log copy
+ *   is bounded by the dispatch-log arm instead.
+ * - Accepted value replacements pass through for registry revalidation and
+ *   rendering; this presentation policy cannot also replace content in the
+ *   same mutually exclusive decision.
+ * - `read` is skipped by the model-facing arm to avoid a
+ *   `read → spill → read again` loop; the dispatch-log arm bounds `read`
+ *   sub-calls too (a log copy is not model context, and `read` is precisely
+ *   the tool that produces huge logs).
+ * - Best-effort: no session owner, no `ctx.spillStore` backend, or a save
+ *   failure ⇒ log and return the original result. A spill failure must NEVER
+ *   turn a successful tool call into an `isError` or hide the inline result.
+ *
+ * It COMPOSES with other post-execute listeners: its prepended listener
+ * delegates via `next()` and bounds the resulting content projection, so
+ * tool-owned asynchronous projection runs before generic bounding, a hook that
+ * replaced content still has its replacement bounded, and value replacements
+ * and `block` decisions pass through unchanged.
+ *
+ * @module @deepseek-ai/dsh-spill-policy
+ */
+import z from '@deepseek-ai/schemastery';
+import { TextRetainer } from '@deepseek-ai/dsh-output-retention';
+import { formatSpillNotice } from "./notice.js";
+/** Cordis plugin name used by loader diagnostics. */
+export const name = 'spill-policy';
+/** Require the tool registry (its `tools/post-execute` waterfall is the extension point we transform). */
+export const inject = ['tools'];
+export const Config = z.object({
+    maxInlineBytes: z.number(),
+});
+/** All-text content flattened to one UTF-8 string, or `undefined` if any block is non-text. */
+function flattenPlainText(content) {
+    let text = '';
+    for (const block of content) {
+        if (block.type !== 'text')
+            return undefined;
+        text += block.text;
+    }
+    return text;
+}
+/** The owning session id, or `undefined` for a call with no agent (a direct/test call). */
+function ownerSessionId(exec) {
+    return exec.agent?.session.header.id;
+}
+/** Build the bounded head/tail preview for `text`, splitting `budget` bytes across the two ends. */
+function preview(text, budget) {
+    const headBytes = Math.ceil(budget / 2);
+    const tailBytes = Math.floor(budget / 2);
+    const retainer = new TextRetainer({ kind: 'headTail', headBytes, tailBytes });
+    retainer.push(text);
+    const kept = retainer.finish();
+    return { text: kept.text, omitted: kept.omittedBytes };
+}
+export function apply(ctx, config) {
+    const maxInlineBytes = config.maxInlineBytes;
+    // Omitted ⇒ no automatic spill policy: register nothing at all.
+    if (maxInlineBytes === undefined)
+        return;
+    // Validate at LOAD, not per call: a negative/fractional cap would reach
+    // TextRetainer's assertBudget and throw, turning every oversized-result call
+    // into an isError. A bad config must fail the deployment, not the tool.
+    if (!Number.isInteger(maxInlineBytes) || maxInlineBytes < 0) {
+        throw new Error(`spill-policy: maxInlineBytes must be a non-negative integer (got ${maxInlineBytes})`);
+    }
+    // Narrowed once for the nested arms (closure narrowing does not survive awaits).
+    const cap = maxInlineBytes;
+    /**
+     * Spill `text` and build the bounded replacement (preview + notice), or
+     * return `undefined` when the policy must keep the original (no session
+     * owner, no backend, storage failure, or no within-cap replacement).
+     * Shared verbatim by the model-facing post-execute arm and the durable
+     * dispatch-log arm so both produce byte-identical projections.
+     */
+    async function spillReplacement(text, totalBytes, sessionId, toolName, callId, label) {
+        if (sessionId === undefined) {
+            ctx.logger.warn(`spill-policy: no session owner for ${toolName} ${label}; keeping the inline content`);
+            return undefined;
+        }
+        const spillStore = ctx.get('spillStore');
+        if (!spillStore) {
+            ctx.logger.warn('spill-policy: no ctx.spillStore backend loaded; keeping the inline content');
+            return undefined;
+        }
+        const save = {
+            owner: { sessionId },
+            source: { kind: 'tool', toolName, callId, label },
+            suggestedName: `${toolName}.txt`,
+            content: text,
+        };
+        let ref;
+        try {
+            ref = await spillStore.saveText(save);
+        }
+        catch (error) {
+            // Best-effort: a storage failure (permissions, ENOSPC, backend down) must
+            // never fail the call or hide the content — keep the original inline.
+            ctx.logger.warn(`spill-policy: saveText failed for ${toolName}: ${String(error)}; keeping the inline content`);
+            return undefined;
+        }
+        // Reserve the notice's byte cost INSIDE maxInlineBytes so the replacement
+        // (preview + blank line + notice) never exceeds the documented cap — a naive
+        // preview that spent the whole budget then appended the notice could be
+        // larger than the cap, and for a marginally-over result even larger than the
+        // original. The reservation uses a notice priced at the worst-case omission
+        // count (the full byte total): its digit count bounds the real count's, so
+        // the reserved size is a safe upper bound and the final notice is never
+        // longer than what we reserved. `\n\n` is the 2-byte join.
+        const reserve = Buffer.byteLength(formatSpillNotice({ kind: 'exact', count: totalBytes }, ref), 'utf8') + 2;
+        const previewBudget = Math.max(0, cap - reserve);
+        const { text: previewText, omitted } = preview(text, previewBudget);
+        const notice = formatSpillNotice(omitted, ref);
+        const replacedText = previewText.length > 0 ? `${previewText}\n\n${notice}` : notice;
+        // Invariant: the policy NEVER emits a replacement larger than the cap. When
+        // the notice alone exceeds maxInlineBytes (a tiny cap or a long spill root),
+        // there is no within-cap replacement, so keep the inline content — spilling
+        // would break the advertised cap. (A within-cap replacement is always
+        // smaller than the original, which is > cap by the entry condition, so this
+        // one check subsumes "not smaller than the original" too. The spill file
+        // already written is a harmless orphan; cleanup is deferred.)
+        if (Buffer.byteLength(replacedText, 'utf8') > cap) {
+            ctx.logger.warn(`spill-policy: spill notice for ${toolName} exceeds maxInlineBytes; keeping the inline content`);
+            return undefined;
+        }
+        return replacedText;
+    }
+    ctx.on('tools/post-execute', async (exec, result, next) => {
+        // Delegate first so a downstream listener (e.g. a hook) settles the result;
+        // we bound whatever it accepted. A block passes through — spill only shapes
+        // accepted plain-text results, never corrective feedback.
+        const decision = await next();
+        // Skip `read` to avoid a read → spill → read again loop.
+        if (decision.kind !== 'accept' || Object.hasOwn(decision, 'value')
+            || exec.parent !== undefined || exec.name === 'read')
+            return decision;
+        const content = decision.content ?? result.content;
+        const text = flattenPlainText(content);
+        if (text === undefined)
+            return decision;
+        const totalBytes = Buffer.byteLength(text, 'utf8');
+        if (totalBytes <= maxInlineBytes)
+            return decision;
+        const replacedText = await spillReplacement(text, totalBytes, ownerSessionId(exec), exec.name, exec.callId, 'result');
+        if (replacedText === undefined)
+            return decision;
+        const replaced = [{ type: 'text', text: replacedText }];
+        return { kind: 'accept', content: replaced, ...decision.additionalContexts ? { additionalContexts: decision.additionalContexts } : {} };
+    }, { prepend: true });
+    // The durable-log arm: bound the `tool/code-dispatch` event's copy of an
+    // oversized sub-call result the same way the model-facing arm bounds an
+    // outer result. The program's returned value is untouched (it already
+    // crossed the worker boundary whole); only the session log's copy shrinks
+    // to preview + locator, so replay and UIs read the full text through the
+    // spill artifact exactly as they do for spilled native results.
+    ctx.on('tools/ptc-dispatch-log', async (dispatch, next) => {
+        const content = await next();
+        // `read` sub-calls spill too: the log copy is not model context, so the
+        // read → spill → read-again loop the post-execute arm avoids cannot
+        // happen here, and read is precisely the tool that produces huge logs.
+        const text = flattenPlainText(content);
+        if (text === undefined)
+            return content;
+        const totalBytes = Buffer.byteLength(text, 'utf8');
+        if (totalBytes <= maxInlineBytes)
+            return content;
+        const replacedText = await spillReplacement(text, totalBytes, ownerSessionId(dispatch.exec), dispatch.name, dispatch.subCallId, 'dispatch');
+        if (replacedText === undefined)
+            return content;
+        return [{ type: 'text', text: replacedText }];
+    }, { prepend: true });
+}
+//# sourceMappingURL=index.js.map

package/lib/types/notice.d.ts

@@ -0,0 +1,18 @@
+/** Browser-safe formatting and recognition of persisted spill-policy notices. */
+import { type Omitted } from '@deepseek-ai/dsh-output-retention';
+import type { SpillRef } from '@deepseek-ai/dsh-spill';
+/**
+ * Format the notice appended to a retained preview, preserving its persisted spelling.
+ * @param omitted - bytes omitted by the retention policy.
+ * @param ref - saved text locator and retrieval guidance.
+ * @returns the complete notice without a leading preview separator.
+ */
+export declare function formatSpillNotice(omitted: Omitted, ref: Pick<SpillRef, 'locator' | 'retrievalHint'>): string;
+/**
+ * Recognize a final spill-policy notice in persisted text, including notice-only output.
+ * This identifies the text convention, not authenticated provenance of tool output.
+ * @param text - complete recorded text result.
+ * @returns whether a complete notice occupies the end of the result.
+ */
+export declare function hasSpillNotice(text: string): boolean;
+//# sourceMappingURL=notice.d.ts.map

package/lib/types/notice.js

@@ -0,0 +1,51 @@
+/** Browser-safe formatting and recognition of persisted spill-policy notices. */
+import { describeOmitted } from '@deepseek-ai/dsh-output-retention';
+const OPEN = '(';
+const CLOSE = ')';
+const LOCATION = ' Full formatted result stored at: ';
+const GUIDANCE_SEPARATOR = '. ';
+const SEPARATOR = '\n\n';
+const EXACT_OMISSION = describeOmitted({ kind: 'exact', count: 0 }, 'bytes');
+const COUNT_OFFSET = EXACT_OMISSION.indexOf('0');
+const COUNT_SUFFIX = EXACT_OMISSION.slice(COUNT_OFFSET + 1);
+/**
+ * Format the notice appended to a retained preview, preserving its persisted spelling.
+ * @param omitted - bytes omitted by the retention policy.
+ * @param ref - saved text locator and retrieval guidance.
+ * @returns the complete notice without a leading preview separator.
+ */
+export function formatSpillNotice(omitted, ref) {
+    return `${OPEN}${describeOmitted(omitted, 'bytes')}${LOCATION}${ref.locator}${GUIDANCE_SEPARATOR}${ref.retrievalHint}${CLOSE}`;
+}
+function isOmission(text) {
+    if (text === describeOmitted({ kind: 'none' }, 'bytes')
+        || text === describeOmitted({ kind: 'unknown' }, 'bytes'))
+        return true;
+    const count = Number(text.slice(COUNT_OFFSET, text.length - COUNT_SUFFIX.length));
+    return Number.isSafeInteger(count) && count >= 0
+        && text === describeOmitted({ kind: 'exact', count }, 'bytes');
+}
+/**
+ * Recognize a final spill-policy notice in persisted text, including notice-only output.
+ * This identifies the text convention, not authenticated provenance of tool output.
+ * @param text - complete recorded text result.
+ * @returns whether a complete notice occupies the end of the result.
+ */
+export function hasSpillNotice(text) {
+    if (!text.endsWith(CLOSE))
+        return false;
+    let start = 0;
+    while (true) {
+        const next = text.indexOf(`${SEPARATOR}${OPEN}`, start);
+        const candidate = text.slice(start, next < 0 ? -CLOSE.length : next);
+        const location = candidate.indexOf(LOCATION, OPEN.length);
+        if (candidate.startsWith(OPEN) && location >= 0
+            && isOmission(candidate.slice(OPEN.length, location))) {
+            return text.indexOf(GUIDANCE_SEPARATOR, start + location + LOCATION.length) >= 0;
+        }
+        if (next < 0)
+            return false;
+        start = next + SEPARATOR.length;
+    }
+}
+//# sourceMappingURL=notice.js.map

package/lib/types/types.js

@@ -0,0 +1,13 @@
+/**
+ * Vocabulary for the spill-policy plugin: the minimal structural view of a tool
+ * execution the policy needs to derive the owning session for a spill artifact.
+ *
+ * `@deepseek-ai/dsh-tools`' `ToolExecution` satisfies this shape, so the policy
+ * reads `exec` straight through without importing `dsh-tools` or `dsh-agent`.
+ * Only the session HEADER id is read — the same identity every other subsystem
+ * keys off (see `dsh-tool-bash`'s owner derivation).
+ *
+ * @module @deepseek-ai/dsh-spill-policy/types
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@deepseek-ai/dsh-spill-policy",
   "description": "Tool-result spill policy for the DeepSeek Harness — replaces oversized plain-text tool results with a retained preview plus a spill-file path (no service API)",
-  "version": "0.1.2-alpha.5",
+  "version": "0.1.3-alpha.2",
   "publishConfig": {
     "access": "public"
   },
@@ -18,33 +18,38 @@
       "types": "./lib/types/index.d.ts",
       "default": "./lib/index.js"
     },
+    "./notice": {
+      "types": "./lib/types/notice.d.ts",
+      "default": "./lib/types/notice.js"
+    },
     "./src/*": "./src/*",
     "./package.json": "./package.json"
   },
   "files": [
     "lib/index.js",
+    "lib/types/**/*.js",
     "lib/types/**/*.d.ts"
   ],
   "license": "MIT",
   "peerDependencies": {
-    "@deepseek-ai/dsh-llm": "^0.1.2-alpha.5",
-    "@deepseek-ai/dsh-output-retention": "^0.1.2-alpha.5",
-    "@deepseek-ai/dsh-session": "^0.1.2-alpha.5",
-    "@deepseek-ai/dsh-spill": "^0.1.2-alpha.5",
-    "@deepseek-ai/dsh-tools": "^0.1.2-alpha.5",
+    "@deepseek-ai/dsh-llm": "^0.1.3-alpha.2",
+    "@deepseek-ai/dsh-output-retention": "^0.1.3-alpha.2",
+    "@deepseek-ai/dsh-spill": "^0.1.3-alpha.2",
+    "@deepseek-ai/dsh-session": "^0.1.3-alpha.2",
+    "@deepseek-ai/dsh-tools": "^0.1.3-alpha.2",
     "@deepseek-ai/cordis": "^4.0.2"
   },
   "dependencies": {
     "@deepseek-ai/schemastery": "^3.18.2"
   },
   "devDependencies": {
-    "@deepseek-ai/dsh-agent": "^0.1.2-alpha.5",
-    "@deepseek-ai/dsh-code-runtime-worker-thread": "^0.1.2-alpha.5",
-    "@deepseek-ai/dsh-llm": "^0.1.2-alpha.5",
-    "@deepseek-ai/dsh-output-retention": "^0.1.2-alpha.5",
-    "@deepseek-ai/dsh-session": "^0.1.2-alpha.5",
-    "@deepseek-ai/dsh-spill": "^0.1.2-alpha.5",
-    "@deepseek-ai/dsh-tools": "^0.1.2-alpha.5",
+    "@deepseek-ai/dsh-agent": "^0.1.3-alpha.2",
+    "@deepseek-ai/dsh-code-runtime-worker-thread": "^0.1.3-alpha.2",
+    "@deepseek-ai/dsh-llm": "^0.1.3-alpha.2",
+    "@deepseek-ai/dsh-session": "^0.1.3-alpha.2",
+    "@deepseek-ai/dsh-spill": "^0.1.3-alpha.2",
+    "@deepseek-ai/dsh-output-retention": "^0.1.3-alpha.2",
+    "@deepseek-ai/dsh-tools": "^0.1.3-alpha.2",
     "@deepseek-ai/cordis": "^4.0.2"
   }
 }