@deepseek-ai/dsh-subagent-acp 0.2.1-alpha.1 → 0.2.1-alpha.3

package/README.i18n.yaml

@@ -18,11 +18,11 @@
   en: 78623be74507229d
   zh: b0ed9c9d0c6eb040
 /deepseek-ai-dsh-subagent-acp/use-this-package/when-to-choose-it:
-  en: 56946ab7637bb8f9
-  zh: c54c4da98092dd9c
+  en: d18adbe82d4a362d
+  zh: 3b9c0cca1f67a587
 /deepseek-ai-dsh-subagent-acp/use-this-package/configuration:
-  en: 6f5fdf9a955841ce
-  zh: 7193a3c07fc54199
+  en: 8d725f040ad14301
+  zh: 379664b42a38b3e5
 /deepseek-ai-dsh-subagent-acp/use-this-package/what-you-get:
   en: 0a809bd7b8cebddc
   zh: e2c1edf8f485e8f8
@@ -39,8 +39,8 @@
   en: c98e6bcd784bbf8a
   zh: b96218f6e639755c
 /deepseek-ai-dsh-subagent-acp/understand-the-implementation/start-and-ownership-flow:
-  en: c0f7f78468f84c3b
-  zh: c9cb417d84d868ce
+  en: 4a857c21457f917d
+  zh: ef980a48deb2fca0
 /deepseek-ai-dsh-subagent-acp/understand-the-implementation/stop-reason-mapping:
   en: 88bb2b62c6e2f114
   zh: f6b720ca8ce90343
@@ -57,8 +57,8 @@
   en: 05e6180f1498fdf9
   zh: 2b05d2b97bfa67da
 /deepseek-ai-dsh-subagent-acp/model-experience/child-agent-request/what-the-model-sees:
-  en: f7f619ca78d74c6f
-  zh: f642dc7b4ff69a10
+  en: 5d8a1acb2e0510ce
+  zh: 34b446c2770f35ff
 /deepseek-ai-dsh-subagent-acp/model-experience/child-agent-request/token-effect:
   en: c0b78d334d5d0a9c
   zh: d54bf504933e132d
@@ -69,17 +69,17 @@
   en: 75d061c2151624a7
   zh: 71e58e020b60ff90
 /deepseek-ai-dsh-subagent-acp/model-experience/parent-tool-result-indirectly/what-the-model-sees:
-  en: 6779463ffe1c724c
-  zh: 9797d5910039fd3a
+  en: 5e4e3efe7517f782
+  zh: 0465e164583f6bc3
 /deepseek-ai-dsh-subagent-acp/model-experience/parent-tool-result-indirectly/token-effect:
-  en: 600ac97cdd163650
-  zh: cd26bb541f56699b
+  en: 4fae54e2ff0c4874
+  zh: 1574bfe874f66a1f
 /deepseek-ai-dsh-subagent-acp/model-experience/parent-tool-result-indirectly/kv-cache-effect:
   en: f5d5f97a153f7c70
   zh: 3d6bc05b9eadfbc2
 /deepseek-ai-dsh-subagent-acp/known-limitations-and-deferred-work:
-  en: 53a0e7fb49fe6e23
-  zh: 51096d4eb51fb4ba
+  en: eb44a9bebc00b3f7
+  zh: 6e65866e85086207
 /deepseek-ai-dsh-subagent-acp/known-limitations-and-deferred-work/dev-note:
   en: d8323b3200db6ac9
   zh: f8a5273b887b9552

package/README.md

@@ -29,7 +29,7 @@ Mount this provider when a composition needs a fully isolated, out-of-process ch
 
 ### When to choose it
 
-Choose this backend when the child must run with its own runtime, model, and tools in a separate process — for example an ACP agent from another project — or when you want delegation that cannot touch the parent harness. Choose an in-process backend when the child must share the parent's composition or honor parent-enforced capabilities: this provider advertises no optional start-time capabilities, so the seam rejects requests for `agentOptions`, structured output, depth caps, tool filters, or personas rather than silently omitting them.
+Choose this backend when the child must run with its own runtime, model, and tools in a separate process — for example an ACP agent from another project — or when you want delegation that cannot touch the parent harness. Choose an in-process backend when the child must share the parent's composition or honor parent-enforced capabilities: this provider advertises no optional start-time capabilities, so the seam rejects requests for `agentPreset`, `agentOptions`, structured output, or depth caps rather than silently omitting them.
 
 ### Configuration
 
@@ -38,7 +38,6 @@ Choose this backend when the child must run with its own runtime, model, and too
 | `providerName` | `acp` | Registry name on `ctx.subagents` |
 | `command` | required | Executable spawned for each run (the child ACP agent) |
 | `args` | `[]` | Command arguments |
-| `cwd` | parent session cwd | Working-directory override for the child process and its ACP session |
 | `permission` | `reject` | Auto-answer permission requests by rejecting, or choosing the first `allow_once` or `allow_always` option (`allow`) |
 | `env` | `{}` | Explicit child environment layered over the credential-scrubbed parent environment |
 | `disposeEofGraceMs` | `6000` | Grace after stdin EOF before platform termination |
@@ -91,7 +90,7 @@ This section explains how the backend drives a child over ACP and where the obse
 
 ### Start and ownership flow
 
-A start resolves the child's working directory (the configured `cwd` override, else the parent session's cwd), spawns the command through the subprocess seam, performs the ACP `initialize` and `newSession` handshake, and only then publishes the run. Fulfillment means a remote session is ready and ownership has transferred to the caller. Disposal is idempotent: it closes stdin and waits a configured grace for cooperative quiescence, then escalates through SIGTERM to SIGKILL and awaits whole-range exit. Cleanup failures remain observable as ordered safe facts and never claim quiescence.
+Startup uses the manager-resolved child directory (the request override, else the parent's current effective directory), spawns the command through the subprocess seam, performs the ACP `initialize` and `newSession` handshake, and only then publishes the run. Fulfillment transfers the external run to the activation manager. The startup signal detaches after acceptance; the activation receipt cancels execution and awaits cleanup. Each activation runs one task and cannot receive follow-up input. Disposal is idempotent: it closes stdin and waits a configured grace for cooperative quiescence, then escalates through SIGTERM to SIGKILL and awaits whole-range exit. Cleanup failures remain observable as ordered safe facts and never claim quiescence.
 
 ### Stop-reason mapping
 
@@ -125,7 +124,7 @@ Read these pages when the package-level contract is not enough. They move from t
 
 #### What the model sees
 
-The remote child receives the standalone task content through ACP plus its own process's configured system prompt, tools, and fresh session. It receives no parent conversation. This provider advertises no optional start-time capabilities, so the local service rejects requests for `agentOptions`, persona, tool filtering, depth enforcement, or structured output instead of silently omitting them.
+The remote child receives the standalone task content through ACP plus its own process's configured system prompt, tools, and fresh session. It receives no parent conversation. This provider advertises no optional start-time capabilities, so the local service rejects requests for `agentPreset`, `agentOptions`, depth enforcement, or structured output instead of silently omitting them.
 
 #### Token effect
 
@@ -139,11 +138,11 @@ Independent of the parent request cache. Each ACP child can reuse only prefixes
 
 #### What the model sees
 
-Through `dsh-tool-subagent`, the parent receives only the child's final streamed assistant text or that consumer's exact stop-reason error, not intermediate messages or tool traffic. Non-completed results present the safe diagnostic before separately preserved partial assistant output. A request already cancelled before publication becomes exactly `Error: subagent request was aborted before the ACP child started`; another start failure contains only the fixed `Subagent failure (...)` line.
+Through `dsh-tool-subagent`, the parent model first receives a child id, then a completion notice containing final or partial assistant text, the stop reason, and safe diagnostic. The parent Session independently retains the external task identity and complete terminal result. Intermediate messages and tool traffic do not enter the parent Session.
 
 #### Token effect
 
-Parent input grows only by the final result or error, which is data-dependent and retained until compaction. This provider adds no parent schema itself.
+Parent input grows by the start acknowledgement and completion notice, whose size depends on the result data and persists until compaction. This provider adds no parent schema by itself.
 
 #### KV Cache effect
 
@@ -158,7 +157,7 @@ These limits define when this backend is a poor fit or needs special operational
 
 - **A fresh process per run** — there is no process pooling; each delegation pays the full spawn and ACP handshake cost.
 - **Local workspaces only** — the resolved working directory is a local path handed to a child on the same machine; remote workspace mapping is not designed.
-- **No optional start-time capabilities** — this provider cannot apply `agentOptions`, `outputSchema`, a depth cap, a tool filter, or a persona inside the remote process, so the seam rejects requests that require them.
+- **No optional start-time capabilities** — this provider cannot apply `agentPreset`, `agentOptions`, `outputSchema`, or a depth cap inside the remote process, so the seam rejects requests that require them.
 - **Only committed `agent_message_chunk` text is collected** — the automation server keeps reasoning, tool activity, plans, and other trace data in the child session log rather than emitting them on ACP.
 - **Permission prompts are auto-answered** (`permission: allow | reject`) — no human is surfaced a child's `session/request_permission`.
 

package/README.zh.md

@@ -29,7 +29,7 @@ kind: "package-reference"
 
 ### 何时选择
 
-当子 agent 必须在独立进程中运行、拥有自己的运行时、模型和工具时选择此后端——例如来自其他项目的 ACP agent——或者你希望委派完全无法触及父 harness 时。当子 agent 必须共享父级组合或遵守父级强制执行的能力约束时，请选择进程内后端：本提供方不声明任何可选启动时能力，因此 seam 会拒绝要求 `agentOptions`、结构化输出、深度上限、工具过滤或 persona 的请求，而不是静默省略。
+当子 agent 必须在独立进程中运行、拥有自己的运行时、模型和工具时选择此后端——例如来自其他项目的 ACP agent——或者你希望委派完全无法触及父 harness 时。当子 agent 必须共享父级组合或遵守父级强制执行的能力约束时，请选择进程内后端：本提供方不声明任何可选启动时能力，因此 seam 会拒绝要求 `agentPreset`、`agentOptions`、结构化输出或深度上限 的请求，而不是静默省略。
 
 ### 配置
 
@@ -38,7 +38,6 @@ kind: "package-reference"
 | `providerName` | `acp` | `ctx.subagents` 上的注册表名称 |
 | `command` | 必填 | 每次运行时 spawn 的可执行文件（子 ACP agent） |
 | `args` | `[]` | 命令参数 |
-| `cwd` | 父会话 cwd | 子进程及其 ACP 会话的工作目录覆盖值 |
 | `permission` | `reject` | 自动应答权限请求：拒绝，或选择第一个 `allow_once` 或 `allow_always` 选项（`allow`） |
 | `env` | `{}` | 叠加在已清理凭据的父环境之上的显式子环境 |
 | `disposeEofGraceMs` | `6000` | stdin EOF 之后、平台终止之前的宽限 |
@@ -91,7 +90,7 @@ spawn、初始化或新建会话失败会在发布前拒绝，通常先证明 ma
 
 ### 启动与所有权流程
 
-一次启动先解析子 agent 的工作目录（配置的 `cwd` 覆盖值，否则取父会话 cwd），经子进程 seam spawn 命令，完成 ACP `initialize` 与 `newSession` 握手，然后才发布运行。兑现意味着远程会话已就绪、所有权已转移给调用方。dispose（资源释放）是幂等的：先关闭 stdin 并按配置的宽限等待协作式完全停稳，再经 SIGTERM 升级到 SIGKILL，并等待整个 managed range 退出。清理失败会作为有序的安全事实保持可观察，且绝不声称已经完全停稳。
+一次启动使用管理器解析的子 agent 工作目录（请求覆盖值，否则取父级当前有效目录），经子进程 seam spawn 命令，完成 ACP `initialize` 与 `newSession` 握手，然后才发布运行。兑现后，外部运行由 activation 管理器接管。任务接受后会解除启动信号的绑定；activation 凭据用于取消执行并等待清理。每个 activation 只运行一个任务，不能接收追加输入。dispose（资源释放）是幂等的：先关闭 stdin 并按配置的宽限等待协作式完全停稳，再经 SIGTERM 升级到 SIGKILL，并等待整个 managed range 退出。清理失败会作为有序的安全事实保持可观察，且绝不声称已经完全停稳。
 
 ### 停止原因映射
 
@@ -125,7 +124,7 @@ spawn、初始化或新建会话失败会在发布前拒绝，通常先证明 ma
 
 #### 模型看到什么
 
-远程子 agent 通过 ACP 接收独立任务内容，并使用其自身进程配置的系统提示词、工具和全新会话。它不接收父级对话。本提供方不声明可选启动时能力，因此本地服务会拒绝要求 `agentOptions`、persona、工具过滤、深度强制或结构化输出的请求，而不是静默省略。
+远程子 agent 通过 ACP 接收独立任务内容，并使用其自身进程配置的系统提示词、工具和全新会话。它不接收父级对话。本提供方不声明可选启动时能力，因此本地服务会拒绝要求 `agentPreset`、`agentOptions`、深度强制或结构化输出的请求，而不是静默省略。
 
 #### Token 影响
 
@@ -139,11 +138,11 @@ spawn、初始化或新建会话失败会在发布前拒绝，通常先证明 ma
 
 #### 模型看到什么
 
-通过 `dsh-tool-subagent`，父级只接收子 agent 最终的流式 assistant 文本或该消费方给出的精确停止原因错误，不接收中间消息或工具流量。未完成的结果会先呈现安全诊断，再单独保留部分 assistant 输出。发布前已经取消的请求会精确变为 `Error: subagent request was aborted before the ACP child started`；其他启动失败只包含固定的 `Subagent failure (...)` 行。
+通过 `dsh-tool-subagent`，父模型先收到 child id，随后收到含最终或部分 assistant 文本、停止原因与安全诊断的完成通知。父会话独立保存外部任务身份和完整终态结果。中间消息与工具通信不进入父会话。
 
 #### Token 影响
 
-父级输入只增加最终结果或错误，其内容依赖数据，并保留到压缩（compaction）为止。本提供方自身不会添加父级 schema。
+父级输入增加启动确认与完成通知，内容大小取决于数据，并保留到压缩（compaction）为止。本提供方自身不会向父级添加任何 schema。
 
 #### KV Cache 影响
 
@@ -158,7 +157,7 @@ spawn、初始化或新建会话失败会在发布前拒绝，通常先证明 ma
 
 - **每次运行使用全新进程**——没有进程池；每次委派都要付出完整的 spawn 与 ACP 握手成本。
 - **仅支持本地工作区**——解析后的工作目录是交给同一台机器上子进程的本地路径；远程工作区映射尚未设计。
-- **不支持可选启动时能力**——本提供方无法在远程进程内应用 `agentOptions`、`outputSchema`、深度上限、工具过滤器或 persona，因此 seam 会拒绝需要它们的请求。
+- **不支持可选启动时能力**——本提供方无法在远程进程内应用 `agentPreset`、`agentOptions`、`outputSchema` 或深度上限，因此 seam 会拒绝需要它们的请求。
 - **只收集已提交的 `agent_message_chunk` 文本**——自动化服务器把推理（reasoning）、工具活动、计划和其他 trace 数据保留在子 agent 会话日志中，不通过 ACP 发出。
 - **权限提示自动应答**（`permission: allow | reject`）——不会把子 agent 的 `session/request_permission` 呈现给人。
 

package/lib/index.js

@@ -1,12 +1,10 @@
-import { accessSync, constants, statSync } from "node:fs";
-import { isAbsolute, resolve } from "node:path";
 import z from "@deepseek-ai/schemastery";
+import { AssistantOutputFold, assertUsableCwd, settleRunResult, subprocessRunHandle } from "@deepseek-ai/dsh-subagent";
 import { MAX_TIMER_DELAY_MS } from "@deepseek-ai/dsh-timeout";
 import { randomUUID } from "node:crypto";
 import { Readable, Writable } from "node:stream";
 import { PROTOCOL_VERSION, client, methods, ndJsonStream } from "@agentclientprotocol/sdk";
 import { brandString } from "@deepseek-ai/dsh-brand";
-import { AssistantOutputFold, settleRunResult, subprocessRunHandle } from "@deepseek-ai/dsh-subagent";
 //#region lib/types/run.js
 /**
 * Fresh-process ACP subagent client. Drives one child session and owns cancellation and
@@ -434,8 +432,8 @@ async function startAcpRun(request, spec) {
 /**
 * Out-of-process ACP subagent backend. Each child has its own process, session, model, and
 * tools, so it shares no Cordis context and advertises no parent-enforced start capabilities;
-* the ONE thing it reads off `request.parent` is the session's workspace cwd (see
-* {@link resolveCwd}). This plugin uses named exports only; a default would hide its
+* the subagent service supplies the captured child working directory. This plugin uses
+* named exports only; a default would hide its
 * loader metadata (see `docs/postmortem/0001-acp-default-export-drops-inject.md`).
 * @module @deepseek-ai/dsh-subagent-acp
 */
@@ -445,7 +443,6 @@ const Config = z.object({
 	providerName: z.string().default("acp"),
 	command: z.string().required(),
 	args: z.array(z.string()).default([]),
-	cwd: z.string(),
 	permission: z.union(["allow", "reject"]).default("reject"),
 	env: z.dict(z.string()).default({}),
 	disposeEofGraceMs: z.number().default(DEFAULT_DISPOSE_EOF_GRACE_MS),
@@ -456,51 +453,9 @@ function assertPositiveFinite(name, value) {
 	if (!Number.isFinite(value) || value <= 0 || value > MAX_TIMER_DELAY_MS) throw new Error(`subagent-acp: ${name} must be a positive finite number no greater than ${MAX_TIMER_DELAY_MS}`);
 }
 /**
-* Whether `path` names an existing directory the harness can ENTER. The
-* search-permission probe matters: `statSync().isDirectory()` is true for a
-* mode-600 directory, but a subprocess cwd needs `X_OK` or spawn fails EACCES.
-*/
-function isDirectory(path) {
-	try {
-		if (!statSync(path).isDirectory()) return false;
-		accessSync(path, constants.X_OK);
-		return true;
-	} catch {
-		return false;
-	}
-}
-/**
-* Assert `cwd` can actually host the child: absolute (it doubles as the ACP
-* session workspace, and a relative path would be re-anchored to the server
-* process's launch directory) and an existing directory (fail here, before the
-* process boundary, instead of as an ambiguous spawn ENOENT).
-* @param label - which source supplied the value, for the diagnostic.
-* @param cwd - the candidate working directory.
-* @returns `cwd`, validated.
-*/
-function assertUsableCwd(label, cwd) {
-	if (!isAbsolute(cwd)) throw new Error(`subagent-acp: ${label} must be an absolute path: ${cwd}`);
-	if (!isDirectory(cwd)) throw new Error(`subagent-acp: ${label} is not an accessible directory: ${cwd}`);
-	return cwd;
-}
-/**
-* Resolve the child's working directory: the deployment `cwd` override when
-* configured (already validated at load), else the parent session's workspace
-* cwd (validated here, its earliest resolvable point). Fails loud when neither
-* exists — falling back to the harness process cwd would silently bind the
-* child to the server's launch directory instead of the delegating session's
-* workspace (one server process serves many sessions, each with its own cwd).
-*/
-function resolveCwd(configured, request) {
-	if (configured !== void 0) return configured;
-	const parentCwd = request.parent.session.header.cwd;
-	if (parentCwd === void 0) throw new Error("subagent-acp: no working directory for the child — configure `cwd` or delegate from a parent session that has one");
-	return assertUsableCwd("parent session cwd", parentCwd);
-}
-/**
 * The ACP provider. Advertises NO start-time capabilities: an out-of-process
-* child cannot honor `agentOptions`/`outputSchema`/`maxDepth`/`toolFilter`/
-* `persona` (the service rejects a request needing any before `start` runs).
+* child cannot honor `agentOptions`/`agentPreset`/`outputSchema`/`maxDepth`.
+* The service rejects a request needing any before execution starts.
 */
 var AcpProvider = class {
 	name;
@@ -508,10 +463,9 @@ var AcpProvider = class {
 	config;
 	capabilities = {
 		agentOptions: false,
+		agentPreset: false,
 		outputSchema: false,
-		depthLimit: false,
-		toolFilter: false,
-		persona: false
+		depthLimit: false
 	};
 	inheritsParentContext = false;
 	constructor(name, ctx, config) {
@@ -523,7 +477,7 @@ var AcpProvider = class {
 		if (request.signal.aborted) throw new Error("subagent request was aborted before the ACP child started");
 		let cwd;
 		try {
-			cwd = resolveCwd(this.config.cwd, request);
+			cwd = assertUsableCwd("subagent-acp", "child cwd", request.cwd);
 		} catch (error) {
 			const failure = acpConfigurationFailure(error);
 			this.ctx.logger.warn(`subagent-acp "${this.name}": child start failed: %o`, error);
@@ -548,12 +502,7 @@ function apply(ctx, config) {
 	const resolved = config;
 	assertPositiveFinite("disposeEofGraceMs", resolved.disposeEofGraceMs);
 	assertPositiveFinite("disposeGraceMs", resolved.disposeGraceMs);
-	if (resolved.cwd === "") throw new Error("subagent-acp: config cwd must not be empty — omit the key to inherit the parent session cwd");
-	const validated = resolved.cwd === void 0 ? resolved : {
-		...resolved,
-		cwd: assertUsableCwd("config cwd", resolve(resolved.cwd))
-	};
-	ctx.subagents.registerProvider(new AcpProvider(validated.providerName, ctx, validated));
+	ctx.subagents.registerProvider(new AcpProvider(resolved.providerName, ctx, resolved));
 }
 //#endregion
 export { Config, apply, inject, name };

package/lib/types/index.d.ts

@@ -1,8 +1,8 @@
 /**
  * Out-of-process ACP subagent backend. Each child has its own process, session, model, and
  * tools, so it shares no Cordis context and advertises no parent-enforced start capabilities;
- * the ONE thing it reads off `request.parent` is the session's workspace cwd (see
- * {@link resolveCwd}). This plugin uses named exports only; a default would hide its
+ * the subagent service supplies the captured child working directory. This plugin uses
+ * named exports only; a default would hide its
  * loader metadata (see `docs/postmortem/0001-acp-default-export-drops-inject.md`).
  * @module @deepseek-ai/dsh-subagent-acp
  */
@@ -19,14 +19,6 @@ export interface Config {
     command: string;
     /** Arguments passed to {@link command}. */
     args: string[];
-    /**
-     * Working directory override for the child process and its ACP session.
-     * Must be non-empty; a relative path resolves against the harness launch
-     * directory at load, and the result must be an existing directory. When
-     * omitted, each child inherits its delegating parent session's cwd — and
-     * starting one from a parent session that has no cwd fails.
-     */
-    cwd?: string;
     /**
      * How to auto-answer the child's `session/request_permission` prompts:
      * `reject` (default — decline every prompt) or `allow` (approve via the first

package/lib/types/run.d.ts

@@ -18,8 +18,7 @@ export interface AcpRunSpec {
     args: string[];
     /**
      * Absolute working directory for the child process AND its ACP session
-     * `cwd`. The provider resolves it before this spec exists: config override,
-     * else the delegating parent session's workspace.
+     * `cwd`, selected before provider startup.
      */
     cwd: string;
     /** How to auto-answer the child's permission prompts. */

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@deepseek-ai/dsh-subagent-acp",
   "description": "Out-of-process ACP subagent backend: drives a child agent in a spawned subprocess over the Agent Client Protocol",
-  "version": "0.2.1-alpha.1",
+  "version": "0.2.1-alpha.3",
   "publishConfig": {
     "access": "public"
   },
@@ -27,34 +27,34 @@
   ],
   "license": "MIT",
   "peerDependencies": {
-    "@deepseek-ai/cordis": "~4.0.5-alpha.1",
-    "@deepseek-ai/dsh-agent": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-session": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-subagent": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-subprocess": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-timeout": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-llm": "0.2.1-alpha.1"
+    "@deepseek-ai/cordis": "~4.0.5-alpha.2",
+    "@deepseek-ai/dsh-agent": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-llm": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-session": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-subagent": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-subprocess": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-timeout": "0.2.1-alpha.3"
   },
   "dependencies": {
     "@agentclientprotocol/sdk": "1.4.0",
-    "@deepseek-ai/schemastery": "~3.18.5-alpha.1",
-    "@deepseek-ai/dsh-brand": "0.2.1-alpha.1"
+    "@deepseek-ai/dsh-brand": "0.2.1-alpha.3",
+    "@deepseek-ai/schemastery": "~3.18.5-alpha.2"
   },
   "devDependencies": {
-    "@deepseek-ai/cordis": "~4.0.5-alpha.1",
-    "@deepseek-ai/cordis-plugin-loader": "~1.0.6-alpha.1",
-    "@deepseek-ai/dsh-agent": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-app-boot": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-llm": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-loader-smoke": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-session": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-session-checkpoint-policy": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-session-persistence-jsonl": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-session-projection": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-subagent": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-subprocess": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-subprocess-local": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-tool-subagent": "0.2.1-alpha.1",
-    "@deepseek-ai/dsh-timeout": "0.2.1-alpha.1"
+    "@deepseek-ai/cordis": "~4.0.5-alpha.2",
+    "@deepseek-ai/cordis-plugin-loader": "~1.0.6-alpha.2",
+    "@deepseek-ai/dsh-agent": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-app-boot": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-llm": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-loader-smoke": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-session": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-session-checkpoint-policy": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-session-persistence-jsonl": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-session-projection": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-subagent": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-subprocess": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-subprocess-local": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-timeout": "0.2.1-alpha.3",
+    "@deepseek-ai/dsh-tool-subagent": "0.2.1-alpha.3"
   }
 }