@deepseek-ai/dsh-tool-fs 0.1.2-alpha.5 → 0.1.3-alpha.2

package/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/fs/tool-fs/README.md
-README.md: 79c09032d27db008fc65a082361f33afb495b653
-README.zh.md: a60728c6ebf0fdd9f4beafcb6f566635687cadfa
+README.md: 6da984ff436f3515b4798ddb47e3a15466672f9e
+README.zh.md: e4d1ef8483c2e644f2e6308e1965d87773278515

package/README.md

@@ -71,7 +71,7 @@ With the policy plugin mounted, `write` and `edit` obtain their guard from the `
 
 ### Failures and recovery
 
-Failures are normalized as `Error: <message>` with a structured code preserved for callers. Stable messages include `file_path must be a non-empty string`, `limit must be less than or equal to <max>`, `cannot read "<path>": not found`, `cannot read "<path>": not a regular file`, and the image-route refusal `cannot read "<path>" as an image: model "<model>" does not declare image input; switch to an image-capable model to read images`. Guarded-mutation failures append their remedy: `FS_STALE_VERSION` gets `— re-read the file, then retry`, `FS_NOT_OBSERVED` gets `— read the file, then retry`. After the reread confirms absence, `edit` reports `FS_NOT_FOUND` instead of repeating a stale remedy, while `write` uses guarded creation.
+Failures are normalized as `Error: <message>` with a structured code preserved for callers. Stable messages include `file_path must be a non-empty string`, `limit must be less than or equal to <max>`, `cannot read "<path>": not found`, `cannot read "<path>": not a regular file`, and the image-route refusal `cannot read "<path>" as an image: model "<model>" does not declare image input; switch to an image-capable model to read images`. `FS_NOT_OBSERVED` is normalized to `cannot modify "<path>": file has not been read — read the file, then retry`, independent of whether the policy or provider rejected the operation; `FS_STALE_VERSION` retains the provider's reason and appends `— re-read the file, then retry`. After the reread confirms absence, `edit` reports `FS_NOT_FOUND` instead of repeating a stale remedy, while `write` uses guarded creation.
 
 -----
 
@@ -98,7 +98,7 @@ The tools are the executor; policy is an event gate. The tools inject no policy
 | [`src/edit.ts`](src/edit.ts) | `edit` executor: intent waterfall, literal edit, observation |
 | [`src/read-render.ts`](src/read-render.ts) | Cordis-free windowing and envelope formatting |
 | [`src/sandbox.ts`](src/sandbox.ts) | Escalation API shared by `write`/`edit`: policy resolution and denial-marker mapping |
-| [`src/error.ts`](src/error.ts) | Model-facing remedy appended to `FS_STALE_VERSION` and `FS_NOT_OBSERVED` |
+| [`src/error.ts`](src/error.ts) | Stable model-facing diagnostics for guarded-mutation failures |
 
 ### Per-tool flow
 
@@ -221,7 +221,7 @@ Append-only; newly visible content follows the reusable request prefix and does
 
 #### What the model sees
 
-Failures are normalized as `Error: <message>`. This package's stable validation and read messages are `file_path must be a non-empty string`, `limit must be less than or equal to <max>`, `old_string must be a non-empty string`, `old_string and new_string must differ`, `cannot read "<path>": not found`, `cannot read "<path>": not a regular file`, `offset <offset> is out of range for "<path>" (<total> lines)`, `cannot read "<path>": the <ext> extension does not declare a supported image format; read_image accepts PNG/JPEG/WebP/GIF files, including extension-less files in those formats`, `cannot read "<path>": the file content is not a supported image format; read_image accepts PNG/JPEG/WebP/GIF`, `cannot read "<path>": the bytes do not decode as a supported PNG/JPEG/WebP/GIF image; the file may be truncated or corrupt`, `cannot read "<path>" as an image: model "<model>" does not declare image input; switch to an image-capable model to read images`, and the mismatch repair `cannot read "<path>": the <ext> extension declares <type>, but the bytes use a different image format; rename the file to match its actual format if it is PNG/JPEG/WebP/GIF, or convert it to one of those formats` (an extension-less mismatch reports `cannot read "<path>": the file signature claims <type>, but the bytes decode as a different image format; the file may be corrupt`). A failed 16-bit conversion reports `cannot read "<path>": the 16-bit PNG could not be converted to the normalized 8-bit sRGB form; convert it to an 8-bit PNG/JPEG/WebP and retry`. Provider and policy templates are quoted in their package READMEs. Guarded-mutation failures additionally carry their recovery instruction in the message, appended by this package's model-facing error wrapper: `FS_STALE_VERSION` gets `— re-read the file, then retry`, and `FS_NOT_OBSERVED` gets `— read the file, then retry`; the structured code is preserved. After that reread confirms absence, `edit` reports `FS_NOT_FOUND` instead of repeating a stale remedy, while `write` uses guarded creation.
+Failures are normalized as `Error: <message>`. This package's stable validation and read messages are `file_path must be a non-empty string`, `limit must be less than or equal to <max>`, `old_string must be a non-empty string`, `old_string and new_string must differ`, `cannot read "<path>": not found`, `cannot read "<path>": not a regular file`, `offset <offset> is out of range for "<path>" (<total> lines)`, `cannot read "<path>": the <ext> extension does not declare a supported image format; read_image accepts PNG/JPEG/WebP/GIF files, including extension-less files in those formats`, `cannot read "<path>": the file content is not a supported image format; read_image accepts PNG/JPEG/WebP/GIF`, `cannot read "<path>": the bytes do not decode as a supported PNG/JPEG/WebP/GIF image; the file may be truncated or corrupt`, `cannot read "<path>" as an image: model "<model>" does not declare image input; switch to an image-capable model to read images`, and the mismatch repair `cannot read "<path>": the <ext> extension declares <type>, but the bytes use a different image format; rename the file to match its actual format if it is PNG/JPEG/WebP/GIF, or convert it to one of those formats` (an extension-less mismatch reports `cannot read "<path>": the file signature claims <type>, but the bytes decode as a different image format; the file may be corrupt`). A failed 16-bit conversion reports `cannot read "<path>": the 16-bit PNG could not be converted to the normalized 8-bit sRGB form; convert it to an 8-bit PNG/JPEG/WebP and retry`. Provider and policy templates are quoted in their package READMEs. The model-facing error wrapper normalizes every `FS_NOT_OBSERVED` source to `cannot modify "<path>": file has not been read — read the file, then retry`; `FS_STALE_VERSION` keeps the provider's reason and adds `— re-read the file, then retry`. Both retain the structured error code and original cause. After that reread confirms absence, `edit` reports `FS_NOT_FOUND` instead of repeating a stale remedy, while `write` uses guarded creation.
 
 #### Token effect
 
@@ -242,7 +242,7 @@ These limits define when the tool suite is a poor fit or needs special operation
 - **`read` handles UTF-8 text files only** — images use the separate `read_image` tool; PDF, audio, and video remain deferred. A directory target is `FS_NOT_REGULAR_FILE`.
 - **Extension-declared media type** — an extension selects the declared type and the attachment store's magic-byte validation stays authoritative; a correctly formatted image under a wrong extension is refused with the rename remedy rather than sniffed. Only a path with no extension is identified from its file signature.
 - **Object paths re-enter source admission** — `read_image` on a normalized attachment object re-admits its bytes as a new source, so a deployment whose `maxImageBytes`/`maxMessageImageBytes` sit below the normalized-image byte budget can refuse an object path that `ctx.attachments.readImage` still serves; shipped defaults keep the normalized budget (4 MiB) far under the source caps (20 MiB).
-- **No inline image preview on the tool-result card** — UI surfaces render the image result generically (the durable reference, not pixels); inline rendering is deferred to the UI packages.
+- **Inline image preview rides the UI composition** — the tool-result card renders the image through the browser's `tool.call.images` slot, which the attachment presentation plugin fills; a UI without that plugin shows the result's envelope text instead.
 - **No attachment-region tool** — an agent may crop an image through another available tool when it has a filesystem path; a pasted or dragged image without a path cannot be re-read at higher resolution.
 - **No timeout surface** — `read`/`write`/`edit` take no timeout argument and declare no timeout budget; cancellation rides `exec.signal` only ([provider rationale](../README.md)).
 

package/README.zh.md

@@ -71,7 +71,7 @@ kind: "package-reference"
 
 ### 失败与恢复
 
-失败被规范化为 `Error: <message>`，并为调用方保留结构化错误码。稳定消息包括 `file_path must be a non-empty string`、`limit must be less than or equal to <max>`、`cannot read "<path>": not found`、`cannot read "<path>": not a regular file`，以及图像路由拒绝 `cannot read "<path>" as an image: model "<model>" does not declare image input; switch to an image-capable model to read images`。防护变更失败会追加恢复指令：`FS_STALE_VERSION` 追加 `— re-read the file, then retry`，`FS_NOT_OBSERVED` 追加 `— read the file, then retry`。该次重新读取确认缺失后，`edit` 报告 `FS_NOT_FOUND` 而不会重复陈旧恢复指令，`write` 则使用防护创建。
+失败被规范化为 `Error: <message>`，并为调用方保留结构化错误码。稳定消息包括 `file_path must be a non-empty string`、`limit must be less than or equal to <max>`、`cannot read "<path>": not found`、`cannot read "<path>": not a regular file`，以及图像路由拒绝 `cannot read "<path>" as an image: model "<model>" does not declare image input; switch to an image-capable model to read images`。无论拒绝来自策略还是提供方，`FS_NOT_OBSERVED` 都规范化为 `cannot modify "<path>": file has not been read — read the file, then retry`；`FS_STALE_VERSION` 保留提供方原因并追加 `— re-read the file, then retry`。该次重新读取确认缺失后，`edit` 报告 `FS_NOT_FOUND` 而不会重复陈旧恢复指令，`write` 则使用防护创建。
 
 -----
 
@@ -98,7 +98,7 @@ kind: "package-reference"
 | [`src/edit.ts`](src/edit.ts) | `edit` 执行器：意图 waterfall、字面量编辑、观察 |
 | [`src/read-render.ts`](src/read-render.ts) | 不依赖 Cordis 的窗口构建与信封格式化 |
 | [`src/sandbox.ts`](src/sandbox.ts) | `write`/`edit` 共享的升权 API：策略解析与拒绝标记映射 |
-| [`src/error.ts`](src/error.ts) | 追加到 `FS_STALE_VERSION` 与 `FS_NOT_OBSERVED` 的面向模型恢复指令 |
+| [`src/error.ts`](src/error.ts) | 防护变更失败的稳定模型侧诊断 |
 
 ### 各工具流程
 
@@ -221,7 +221,7 @@ Use the edit tool for targeted changes to existing UTF-8 text files. It replaces
 
 #### 模型看到的内容
 
-失败会规范化为 `Error: <message>`。本包稳定的校验和读取消息是 `file_path must be a non-empty string`、`limit must be less than or equal to <max>`、`old_string must be a non-empty string`、`old_string and new_string must differ`、`cannot read "<path>": not found`、`cannot read "<path>": not a regular file`、`offset <offset> is out of range for "<path>" (<total> lines)`、`cannot read "<path>": the <ext> extension does not declare a supported image format; read_image accepts PNG/JPEG/WebP/GIF files, including extension-less files in those formats`、`cannot read "<path>": the file content is not a supported image format; read_image accepts PNG/JPEG/WebP/GIF`、`cannot read "<path>": the bytes do not decode as a supported PNG/JPEG/WebP/GIF image; the file may be truncated or corrupt`、`cannot read "<path>" as an image: model "<model>" does not declare image input; switch to an image-capable model to read images`，以及类型不匹配的修复消息 `cannot read "<path>": the <ext> extension declares <type>, but the bytes use a different image format; rename the file to match its actual format if it is PNG/JPEG/WebP/GIF, or convert it to one of those formats`（无扩展名路径的不匹配报告 `cannot read "<path>": the file signature claims <type>, but the bytes decode as a different image format; the file may be corrupt`）。16-bit 转换失败会报告 `cannot read "<path>": the 16-bit PNG could not be converted to the normalized 8-bit sRGB form; convert it to an 8-bit PNG/JPEG/WebP and retry`。提供方和策略模板在各自包的 README 中逐字列出。防护变更失败还会在消息中携带恢复指令，由本包面向模型的错误包装追加：`FS_STALE_VERSION` 追加 `— re-read the file, then retry`，`FS_NOT_OBSERVED` 追加 `— read the file, then retry`；结构化错误码保持不变。该次重新读取确认缺失后，`edit` 会报告 `FS_NOT_FOUND`，而不会重复陈旧恢复指令；`write` 则使用带防护的创建。
+失败会规范化为 `Error: <message>`。本包稳定的校验和读取消息是 `file_path must be a non-empty string`、`limit must be less than or equal to <max>`、`old_string must be a non-empty string`、`old_string and new_string must differ`、`cannot read "<path>": not found`、`cannot read "<path>": not a regular file`、`offset <offset> is out of range for "<path>" (<total> lines)`、`cannot read "<path>": the <ext> extension does not declare a supported image format; read_image accepts PNG/JPEG/WebP/GIF files, including extension-less files in those formats`、`cannot read "<path>": the file content is not a supported image format; read_image accepts PNG/JPEG/WebP/GIF`、`cannot read "<path>": the bytes do not decode as a supported PNG/JPEG/WebP/GIF image; the file may be truncated or corrupt`、`cannot read "<path>" as an image: model "<model>" does not declare image input; switch to an image-capable model to read images`，以及类型不匹配的修复消息 `cannot read "<path>": the <ext> extension declares <type>, but the bytes use a different image format; rename the file to match its actual format if it is PNG/JPEG/WebP/GIF, or convert it to one of those formats`（无扩展名路径的不匹配报告 `cannot read "<path>": the file signature claims <type>, but the bytes decode as a different image format; the file may be corrupt`）。16-bit 转换失败会报告 `cannot read "<path>": the 16-bit PNG could not be converted to the normalized 8-bit sRGB form; convert it to an 8-bit PNG/JPEG/WebP and retry`。提供方和策略模板在各自包的 README 中逐字列出。模型侧错误包装把所有 `FS_NOT_OBSERVED` 来源规范化为 `cannot modify "<path>": file has not been read — read the file, then retry`；`FS_STALE_VERSION` 保留提供方原因并追加 `— re-read the file, then retry`。两者都保留结构化错误码和原始原因。该次重新读取确认缺失后，`edit` 会报告 `FS_NOT_FOUND`，而不会重复陈旧恢复指令；`write` 则使用带防护的创建。
 
 #### Token 影响
 
@@ -242,7 +242,7 @@ Use the edit tool for targeted changes to existing UTF-8 text files. It replaces
 - **`read` 只处理 UTF-8 文本文件**：图像使用独立的 `read_image` 工具；PDF、音频和视频仍延期处理。目录目标为 `FS_NOT_REGULAR_FILE`。
 - **媒体类型按扩展名声明**：扩展名选择声明类型，附件存储的魔数校验保持权威；扩展名错误但格式正确的图像会得到改名修复提示，而不是被嗅探接受。只有没有扩展名的路径按文件签名识别格式。
 - **对象路径重新走源准入**：对规范化附件对象调用 `read_image` 会把其字节作为新来源重新准入，因此把 `maxImageBytes`/`maxMessageImageBytes` 配置得低于规范化图片字节预算的部署可能拒绝 `ctx.attachments.readImage` 仍可读取的对象路径；默认配置下规范化预算（4 MiB）远低于源上限（20 MiB）。
-- **工具结果卡片没有内嵌图像预览**：UI 表面以通用形式渲染图像结果（持久引用而非像素）；内嵌渲染延后到 UI 包处理。
+- **内嵌图像预览依赖 UI 组合**：工具结果卡片经由浏览器的 `tool.call.images` 槽位渲染图像，由附件呈现插件填充；未组合该插件的 UI 改为显示结果的信封文本。
 - **没有附件区域工具**：agent 在拥有文件系统路径时可以通过其他可用工具裁剪图片；没有路径的粘贴或拖入图片无法按更高分辨率重新读取。
 - **没有超时接口**：`read`/`write`/`edit` 不接受超时参数，也不声明超时预算；取消只通过 `exec.signal` 传递（见[提供方理由](../README.zh.md)）。
 

package/lib/index.js

@@ -526,33 +526,27 @@ function diffsFromMeta(meta) {
 //#endregion
 //#region lib/types/error.js
 /**
-* Model-facing remediation for guarded-mutation failures. The provider's
-* `FS_STALE_VERSION` and `FS_NOT_OBSERVED` messages state the condition but
-* not the only correct recovery (re-read / read the file), so this package
-* appends the remedy at the model boundary; provider messages stay
-* machine-oriented and unchanged.
+* Model-facing diagnostics for guarded-mutation failures. Providers and
+* policies retain operation-specific causes, while this package owns the
+* stable message shown to the model.
 * @module @deepseek-ai/dsh-tool-fs/src/error
 */
-/** The remedy appended to each remediable failure code's message. */
-const REMEDIES = {
-	FS_STALE_VERSION: "re-read the file, then retry",
-	FS_NOT_OBSERVED: "read the file, then retry"
-};
 /**
-* Append the correct recovery instruction to a guarded-mutation failure's
-* message. `FS_STALE_VERSION` (the file changed since this session's last
-* observation, including a missing target) recovers only by re-reading;
-* `FS_NOT_OBSERVED` (no prior read by this session) by reading. The `FsError`
-* code is preserved so retry/permission/UI layers keep routing on it, and the
-* original error chains as `cause`. Anything else passes through untouched.
+* Render the stable model-facing diagnostic for a guarded-mutation failure.
+* `FS_STALE_VERSION` keeps the provider's reason and appends its re-read
+* remedy. `FS_NOT_OBSERVED` replaces operation-specific policy/provider text
+* with one path-aware reason and read remedy. The original error remains the
+* cause, and both diagnostics preserve its code for machine routing. Anything
+* else passes through untouched.
 * @param error - the caught value from a write/edit execution.
+* @param displayPath - the resolved target path shown to the model.
 * @returns a remediated `FsError` for the two guarded-mutation codes, else the original value.
 */
-function remediateFsError(error) {
+function remediateFsError(error, displayPath) {
 	if (!(error instanceof FsError)) return error;
-	const remedy = REMEDIES[error.code];
-	if (!remedy) return error;
-	return new FsError(`${error.message} — ${remedy}`, error.code, { cause: error });
+	if (error.code === "FS_NOT_OBSERVED") return new FsError(`cannot modify "${displayPath}": file has not been read — read the file, then retry`, error.code, { cause: error });
+	if (error.code === "FS_STALE_VERSION") return new FsError(`${error.message} — re-read the file, then retry`, error.code, { cause: error });
+	return error;
 }
 //#endregion
 //#region lib/types/write.js
@@ -658,7 +652,7 @@ function applyWriteTool(ctx, sandbox) {
 			try {
 				outcome = await ctx.fs.writeText(target, input.content, intent, exec.signal, sandboxPolicy);
 			} catch (error) {
-				throw remediateFsError(sandbox.mapError(error, sandboxPolicy));
+				throw remediateFsError(sandbox.mapError(error, sandboxPolicy), target.displayPath);
 			}
 			ctx.emit("fs/observed", target, {
 				kind: "present",
@@ -811,7 +805,7 @@ function applyEditTool(ctx, sandbox) {
 					replaceAll: input.replaceAll
 				}, intent, exec.signal, sandboxPolicy);
 			} catch (error) {
-				throw remediateFsError(sandbox.mapError(error, sandboxPolicy));
+				throw remediateFsError(sandbox.mapError(error, sandboxPolicy), target.displayPath);
 			}
 			ctx.emit("fs/observed", target, {
 				kind: "present",
@@ -1064,7 +1058,8 @@ function applyReadImageTool(ctx) {
 					image: IMAGE_VALUE_SCHEMA
 				}
 			},
-			render: (_args, value) => imageReadContent(value)
+			render: (_args, value) => imageReadContent(value),
+			presentationMeta: (_args, value) => ({ path: value.path })
 		},
 		isConcurrencySafe: () => true,
 		async execute(args, exec) {

package/lib/types/error.d.ts

@@ -1,20 +1,19 @@
 /**
- * Model-facing remediation for guarded-mutation failures. The provider's
- * `FS_STALE_VERSION` and `FS_NOT_OBSERVED` messages state the condition but
- * not the only correct recovery (re-read / read the file), so this package
- * appends the remedy at the model boundary; provider messages stay
- * machine-oriented and unchanged.
+ * Model-facing diagnostics for guarded-mutation failures. Providers and
+ * policies retain operation-specific causes, while this package owns the
+ * stable message shown to the model.
  * @module @deepseek-ai/dsh-tool-fs/src/error
  */
 /**
- * Append the correct recovery instruction to a guarded-mutation failure's
- * message. `FS_STALE_VERSION` (the file changed since this session's last
- * observation, including a missing target) recovers only by re-reading;
- * `FS_NOT_OBSERVED` (no prior read by this session) by reading. The `FsError`
- * code is preserved so retry/permission/UI layers keep routing on it, and the
- * original error chains as `cause`. Anything else passes through untouched.
+ * Render the stable model-facing diagnostic for a guarded-mutation failure.
+ * `FS_STALE_VERSION` keeps the provider's reason and appends its re-read
+ * remedy. `FS_NOT_OBSERVED` replaces operation-specific policy/provider text
+ * with one path-aware reason and read remedy. The original error remains the
+ * cause, and both diagnostics preserve its code for machine routing. Anything
+ * else passes through untouched.
  * @param error - the caught value from a write/edit execution.
+ * @param displayPath - the resolved target path shown to the model.
  * @returns a remediated `FsError` for the two guarded-mutation codes, else the original value.
  */
-export declare function remediateFsError(error: unknown): unknown;
+export declare function remediateFsError(error: unknown, displayPath: string): unknown;
 //# sourceMappingURL=error.d.ts.map

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@deepseek-ai/dsh-tool-fs",
   "description": "Model-facing filesystem tools (read, write, edit) over the DeepSeek Harness filesystem seam (ctx.fs)",
-  "version": "0.1.2-alpha.5",
+  "version": "0.1.3-alpha.2",
   "publishConfig": {
     "access": "public"
   },
@@ -31,34 +31,34 @@
     "@deepseek-ai/schemastery": "^3.18.2"
   },
   "peerDependencies": {
-    "@deepseek-ai/dsh-attachment": "^0.1.2-alpha.5",
-    "@deepseek-ai/dsh-fs": "^0.1.2-alpha.5",
-    "@deepseek-ai/dsh-llm": "^0.1.2-alpha.5",
-    "@deepseek-ai/dsh-sandbox": "^0.1.2-alpha.5",
-    "@deepseek-ai/dsh-sandbox-policy": "^0.1.2-alpha.5",
-    "@deepseek-ai/dsh-session": "^0.1.2-alpha.5",
-    "@deepseek-ai/dsh-tools": "^0.1.2-alpha.5",
-    "@deepseek-ai/dsh-user-approval": "^0.1.2-alpha.5",
-    "@deepseek-ai/cordis": "^4.0.2",
-    "@deepseek-ai/dsh-system-prompt": "^0.1.2-alpha.5"
+    "@deepseek-ai/dsh-attachment": "^0.1.3-alpha.2",
+    "@deepseek-ai/dsh-fs": "^0.1.3-alpha.2",
+    "@deepseek-ai/dsh-llm": "^0.1.3-alpha.2",
+    "@deepseek-ai/dsh-sandbox": "^0.1.3-alpha.2",
+    "@deepseek-ai/dsh-sandbox-policy": "^0.1.3-alpha.2",
+    "@deepseek-ai/dsh-system-prompt": "^0.1.3-alpha.2",
+    "@deepseek-ai/dsh-session": "^0.1.3-alpha.2",
+    "@deepseek-ai/dsh-tools": "^0.1.3-alpha.2",
+    "@deepseek-ai/dsh-user-approval": "^0.1.3-alpha.2",
+    "@deepseek-ai/cordis": "^4.0.2"
   },
   "devDependencies": {
-    "@deepseek-ai/dsh-agent-loop": "^0.1.2-alpha.5",
-    "@deepseek-ai/dsh-agent-loop-testkit": "^0.1.2-alpha.5",
-    "@deepseek-ai/dsh-attachment": "^0.1.2-alpha.5",
-    "@deepseek-ai/dsh-agent": "^0.1.2-alpha.5",
-    "@deepseek-ai/dsh-fs": "^0.1.2-alpha.5",
-    "@deepseek-ai/dsh-fs-local": "^0.1.2-alpha.5",
-    "@deepseek-ai/dsh-llm": "^0.1.2-alpha.5",
-    "@deepseek-ai/dsh-fs-observation-policy": "^0.1.2-alpha.5",
-    "@deepseek-ai/dsh-llm-deepseek": "^0.1.2-alpha.5",
-    "@deepseek-ai/dsh-sandbox": "^0.1.2-alpha.5",
-    "@deepseek-ai/dsh-sandbox-policy": "^0.1.2-alpha.5",
-    "@deepseek-ai/dsh-session": "^0.1.2-alpha.5",
-    "@deepseek-ai/dsh-system-prompt": "^0.1.2-alpha.5",
-    "@deepseek-ai/dsh-tools": "^0.1.2-alpha.5",
-    "@deepseek-ai/dsh-session-projection": "^0.1.2-alpha.5",
+    "@deepseek-ai/dsh-agent": "^0.1.3-alpha.2",
+    "@deepseek-ai/dsh-attachment": "^0.1.3-alpha.2",
+    "@deepseek-ai/dsh-agent-loop": "^0.1.3-alpha.2",
+    "@deepseek-ai/dsh-fs": "^0.1.3-alpha.2",
+    "@deepseek-ai/dsh-agent-loop-testkit": "^0.1.3-alpha.2",
+    "@deepseek-ai/dsh-fs-observation-policy": "^0.1.3-alpha.2",
+    "@deepseek-ai/dsh-fs-local": "^0.1.3-alpha.2",
+    "@deepseek-ai/dsh-llm": "^0.1.3-alpha.2",
+    "@deepseek-ai/dsh-llm-deepseek": "^0.1.3-alpha.2",
+    "@deepseek-ai/dsh-sandbox": "^0.1.3-alpha.2",
+    "@deepseek-ai/dsh-sandbox-policy": "^0.1.3-alpha.2",
+    "@deepseek-ai/dsh-session": "^0.1.3-alpha.2",
+    "@deepseek-ai/dsh-system-prompt": "^0.1.3-alpha.2",
+    "@deepseek-ai/dsh-tools": "^0.1.3-alpha.2",
     "@deepseek-ai/cordis": "^4.0.2",
-    "@deepseek-ai/dsh-user-approval": "^0.1.2-alpha.5"
+    "@deepseek-ai/dsh-user-approval": "^0.1.3-alpha.2",
+    "@deepseek-ai/dsh-session-projection": "^0.1.3-alpha.2"
   }
 }