@deepseek-ai/dsh-tool-workspace-dependencies 0.1.7-alpha.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 DeepSeek
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.i18n.yaml

@@ -0,0 +1,6 @@
+# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
+# side as of the last confirmed-consistent state. Both languages carry equal authority;
+# after editing either side, bring the other along and re-record with:
+#   pnpm run verify-translation-pairing --write packages/skill/tool-workspace-dependencies/README.md
+README.md: 1f7147a1febeb0210befe64dc462e2527013dab3
+README.zh.md: f2a1934256776ef97d414be4709a6b918989ae35

package/README.md

@@ -0,0 +1,128 @@
+---
+description: "The load_workspace_dependencies tool: absolute paths into a bundled Python, Node.js, and pnpm payload, used in place or installed under the Harness home."
+kind: "package-reference"
+---
+
+# @deepseek-ai/dsh-tool-workspace-dependencies
+
+English | [中文](README.zh.md)
+
+## Summary
+
+Deployments that ship their own script runtimes (Desktop's primary runtime, or a container image layer) mount this tool so the agent can ask where the bundled Python, Node.js, and pnpm live instead of discovering a system interpreter. The tool returns absolute paths and recorded distribution versions; it changes neither `PATH` nor package-manager settings. The payload is either copied under the Harness home on first use (Desktop) or used where it lies (read-only carriers).
+
+## Table of Contents
+
+- [Use this package](#use-this-package)
+- [Understand the implementation](#understand-the-implementation)
+- [Further Exploration](#further-exploration)
+- [Model Experience](#model-experience)
+- [Known Limitations and Deferred Work](#known-limitations-and-deferred-work)
+- [Dev Note](#dev-note)
+
+-----
+
+<a id="use-this-package"></a>
+## Use this package
+
+Mount the plugin beside the tool registry with the payload directory. Configuration validation requires a nonempty `source` and rejects empty `root` values before activation; both paths must be absolute. The bundled Office skills (`@deepseek-ai/dsh-skill-office`) reference this tool by name for their default interpreter.
+
+### Minimal configuration
+
+```yaml
+- name: '@deepseek-ai/dsh-tool-workspace-dependencies'
+  config:
+    source: /path/to/primary-runtime
+```
+
+| Field | Default | Meaning |
+|---|---|---|
+| `source` | required | Absolute payload directory carrying `runtime.json` and `dependencies/`. |
+| `root` | unset | Absolute installation directory under the Harness home. Set: the payload is copied there on the first call and reused while `runtime.json` is unchanged. Unset: the payload is validated and used in place; nothing is copied. |
+
+### Payload layout
+
+`runtime.json` records `desktopVersion`, `platform` (`win32`, `darwin`, or `linux`), `arch`, optional `payloadDigest`, top-level `python`, optional `node`/`pnpm` versions, and the complete `pythonPackages` distribution-version map. A pnpm entry requires Node.js. Python libraries, including numpy and pandas, appear only in `pythonPackages`. Entries live under `dependencies/`: `python/bin/python3` (`python/python.exe` on Windows) with `site-packages` beneath it, and, when declared, `node/bin/node` with `node/node_modules` and `pnpm/bin/pnpm.mjs`. A manifest whose platform or architecture differs from the running process is rejected.
+
+The packaged `sdk` profile uses its bundled Python and Office skills by default; `DSH_PRIMARY_RUNTIME` overrides the resource location, and an empty value opts out. Source launches without a carrier default remain opt-in. See [runtime configuration](../../../python/sdk-runtime/README.md) for independent skill selection. Missing skill resources produce a startup warning; invalid or incomplete external runtime payloads fail the first tool call. Profile configuration changes require restarting the SDK process.
+
+### Build a carrier payload
+
+From a repository checkout with dependencies installed, `CI=true pnpm run prepare:primary-runtime --target linux-x64 --output /tmp/dsh-office` writes `primary-runtime/` and `office-skills/`. The shared [download lock](../../../scripts/primary-runtime/lock.json) also covers `linux-arm64`, `mac-arm64`, `mac-x64`, and `win-x64`. `--python-only` omits Node.js and pnpm; `--cache` selects the hash-verified archive cache. The entry executes interpreter and Office read/write checks only for a native target. Cross-target builds require those checks on the target host before deployment.
+
+A container can copy both directories into an immutable image layer and set `DSH_PRIMARY_RUNTIME` to the absolute `primary-runtime/` path. The SDK queries that payload in place. Desktop uses the same builder and retains its Harness-home installation and signing checks.
+
+-----
+
+<a id="understand-the-implementation"></a>
+## Understand the implementation
+
+<details>
+<summary>Implementation internals — click to expand</summary>
+
+`readPrimaryRuntime` and build smoke checks share `parsePrimaryRuntime`. It validates the flat manifest and rejects duplicate normalized distribution names. Legacy `components` metadata is normalized in memory, retaining its consistency checks; a missing legacy distribution map becomes empty. Mixed flat and legacy version fields are rejected. Reads do not rewrite metadata, and equivalent normalized manifests can reuse an installed payload. `workspaceDependencyPaths` derives the platform-specific entries. `installPrimaryRuntime` copies into a staging directory, requires declared interpreters and scripts to be files and package roots to be directories, and swaps it into place while retaining the previous tree on failure; `resolvePrimaryRuntime` verifies the same entries without copying. The tool memoizes the first successful preparation for the plugin's lifetime.
+
+| File | Responsibility |
+|---|---|
+| [`src/index.ts`](src/index.ts) | Manifest validation, path derivation, in-place and installed preparation, tool registration. |
+| — | No runtime invariant companion is published: the payload manifest is validated on every preparation, and the tool registry owns registration lifecycle. |
+
+</details>
+
+-----
+
+<a id="further-exploration"></a>
+## Further Exploration
+
+- [Office skills](../skill-office/README.md) — the workflows that call this tool for their interpreter.
+- [Tool registry](../../core/tools/README.md) — registration and schemas.
+
+-----
+
+<a id="model-experience"></a>
+## Model Experience
+
+### Tool schema
+
+#### What the model sees
+
+The model sees the generated [`load_workspace_dependencies` schema](../../../docs/tool-catalog.md#deepseek-aidsh-tool-workspace-dependencies).
+
+#### Token effect
+
+Fixed schema cost per request where the tool is visible; the description names the bundled Office libraries so the model can choose the interpreter without loading a skill first.
+
+#### KV Cache effect
+
+Prefix-stable while the tool definition and visibility are unchanged.
+
+### Tool result
+
+#### What the model sees
+
+One JSON object with absolute `python` and `pythonPackages` paths, `pythonDistributions` from `runtime.json`, and `node`, `nodePackages`, and `pnpm` when the payload declares them. Repeated calls return the same object.
+
+#### Token effect
+
+A few hundred characters per call; paths dominate.
+
+#### KV Cache effect
+
+Append-only tool result in the turn history; no prompt section is added.
+
+## Known Limitations and Deferred Work
+
+<a id="known-limitations-and-deferred-work"></a>
+
+- Linux targets require glibc; musl payloads are not locked.
+- Windows payloads used in place must already be executable from their carrier; the in-place mode performs no permission repair.
+
+<a id="dev-note"></a>
+### Dev Note
+
+<details>
+<summary>Working context for maintainers — click to expand</summary>
+
+Placement and carrier choices are recorded in the [shared-runtime Agent Note](../../../.agents/notes/implemented/architecture/2026-09-17-shared-office-runtime.md).
+
+</details>

package/README.zh.md

@@ -0,0 +1,128 @@
+---
+description: "load_workspace_dependencies 工具：返回随包附带的 Python、Node.js 与 pnpm 的绝对路径，payload 可原地使用或安装到 Harness home。"
+kind: "package-reference"
+---
+
+# @deepseek-ai/dsh-tool-workspace-dependencies
+
+[English](README.md) | 中文
+
+## 概述
+
+自带脚本运行时的部署（Desktop 的 primary runtime，或容器镜像层）挂载本工具，让 agent 询问随包的 Python、Node.js 与 pnpm 在哪里，而不是自行寻找系统解释器。工具返回绝对路径与记录的发行版版本，不改 `PATH`，不改包管理器设置。payload 或在首次调用时复制到 Harness home 下（Desktop），或原地使用（只读载体）。
+
+## 目录
+
+- [使用本包](#use-this-package)
+- [了解实现](#understand-the-implementation)
+- [延伸阅读](#further-exploration)
+- [模型体验](#model-experience)
+- [已知限制与暂缓事项](#known-limitations-and-deferred-work)
+- [开发备注](#dev-note)
+
+-----
+
+<a id="use-this-package"></a>
+## 使用本包
+
+与工具注册表一起挂载，给出 payload 目录。配置校验在激活前要求非空 `source` 并拒绝空 `root`；两条路径都必须为绝对路径。内置 Office skills（`@deepseek-ai/dsh-skill-office`）按名字引用本工具取默认解释器。
+
+### 最小配置
+
+```yaml
+- name: '@deepseek-ai/dsh-tool-workspace-dependencies'
+  config:
+    source: /path/to/primary-runtime
+```
+
+| 字段 | 默认值 | 含义 |
+|---|---|---|
+| `source` | 必填 | 含 `runtime.json` 与 `dependencies/` 的 payload 绝对目录。 |
+| `root` | 未设置 | Harness home 下的绝对安装目录。设置时首次调用把 payload 复制过去，`runtime.json` 不变则复用；未设置时校验后原地使用，不复制。 |
+
+### payload 布局
+
+`runtime.json` 记录 `desktopVersion`、`platform`（`win32`、`darwin` 或 `linux`）、`arch`、可选的 `payloadDigest`、顶层 `python` 与可选的 `node`/`pnpm` 版本，以及完整的 `pythonPackages` 分发包版本表。声明 pnpm 时必须同时声明 Node.js。numpy、pandas 等 Python 库只出现在 `pythonPackages` 中。条目位于 `dependencies/`：`python/bin/python3`（Windows 为 `python/python.exe`）及其下的 `site-packages`；声明了才有的 `node/bin/node`、`node/node_modules` 与 `pnpm/bin/pnpm.mjs`。平台或架构与当前进程不符的清单被拒绝。
+
+打包的 `sdk` profile 默认使用随包 Python 和 Office skills；`DSH_PRIMARY_RUNTIME` 覆盖资源位置，空值表示禁用。没有载体默认路径的源码启动仍需显式启用。独立选择 skills 的方式见[运行时配置](../../../python/sdk-runtime/README.zh.md)。缺少 skill 资源会产生启动警告；无效或不完整的外部运行时 payload 在首次工具调用时失败。profile 配置变更需要重启 SDK 进程。
+
+### 构建载体 payload
+
+在已安装依赖的仓库 checkout 中运行 `CI=true pnpm run prepare:primary-runtime --target linux-x64 --output /tmp/dsh-office`，会生成 `primary-runtime/` 和 `office-skills/`。[共享下载锁](../../../scripts/primary-runtime/lock.json)还覆盖 `linux-arm64`、`mac-arm64`、`mac-x64` 和 `win-x64`。`--python-only` 省略 Node.js 和 pnpm；`--cache` 选择经过哈希校验的归档缓存。入口仅对本机目标执行解释器与 Office 读写检查。跨目标构建必须在部署前到目标主机执行这些检查。
+
+容器可将这两个目录复制到不可变镜像层，并将 `DSH_PRIMARY_RUNTIME` 设为 `primary-runtime/` 的绝对路径。SDK 原位查询该 payload。Desktop 使用同一构建器，并保留 Harness-home 安装与签名检查。
+
+-----
+
+<a id="understand-the-implementation"></a>
+## 了解实现
+
+<details>
+<summary>实现细节——点击展开</summary>
+
+`readPrimaryRuntime` 与构建冒烟检查共用 `parsePrimaryRuntime`。它校验扁平清单，拒绝归一化后重名的分发包。旧 `components` 元数据在内存中归一化，并保留旧格式的一致性校验；旧分发包版本表缺失时转换为空表。混用顶层与旧组件版本字段会被拒绝。读取不改写元数据，归一化后等价的清单可复用已安装产物。`workspaceDependencyPaths` 推导各平台的条目路径。`installPrimaryRuntime` 复制到暂存目录、要求声明的解释器和脚本为文件、库路径为目录、再换入正式位置，失败时保留旧树；`resolvePrimaryRuntime` 做同样的校验但不复制。工具在插件生命周期内记住首次成功的结果。
+
+| 文件 | 职责 |
+|---|---|
+| [`src/index.ts`](src/index.ts) | 清单校验、路径推导、原地与安装两种准备方式、工具注册。 |
+| — | 不发布运行时不变量伴随入口：每次准备都校验 payload 清单，工具注册表负责注册生命周期。 |
+
+</details>
+
+-----
+
+<a id="further-exploration"></a>
+## 延伸阅读
+
+- [Office skills](../skill-office/README.zh.md)——调用本工具取解释器的工作流。
+- [工具注册表](../../core/tools/README.zh.md)——注册与 schema。
+
+-----
+
+<a id="model-experience"></a>
+## 模型体验
+
+### 工具 schema
+
+#### 模型看到什么
+
+模型看到生成的 [`load_workspace_dependencies` schema](../../../docs/tool-catalog.zh.md#deepseek-aidsh-tool-workspace-dependencies)。
+
+#### Token 影响
+
+工具可见的每个请求固定一份 schema 开销；描述里列出了随包的 Office 库，模型不必先加载 skill 就能选择解释器。
+
+#### KV 缓存影响
+
+工具定义与可见性不变时前缀稳定。
+
+### 工具结果
+
+#### 模型看到什么
+
+一个 JSON 对象：绝对路径 `python` 与 `pythonPackages`、来自 `runtime.json` 的 `pythonDistributions`，以及 payload 声明了才有的 `node`、`nodePackages` 与 `pnpm`。重复调用返回同一对象。
+
+#### Token 影响
+
+每次调用几百个字符，以路径为主。
+
+#### KV 缓存影响
+
+作为工具结果追加进轮次历史；不增加提示词分区。
+
+## 已知限制与暂缓事项
+
+<a id="known-limitations-and-deferred-work"></a>
+
+- Linux 目标需要 glibc；尚未锁定 musl payload。
+- Windows 上原地使用的 payload 须在载体里已可执行；原地模式不修复权限。
+
+<a id="dev-note"></a>
+### 开发备注
+
+<details>
+<summary>维护者的工作上下文——点击展开</summary>
+
+包归属与载体选择记录在[共享运行时 Agent Note](../../../.agents/notes/implemented/architecture/2026-09-17-shared-office-runtime.zh.md) 中。
+
+</details>

package/lib/index.js

@@ -0,0 +1,252 @@
+import { cp, lstat, mkdir, mkdtemp, readFile, rename, rm, stat } from "node:fs/promises";
+import { dirname, isAbsolute, join } from "node:path";
+import z from "@deepseek-ai/schemastery";
+import { defineTool } from "@deepseek-ai/dsh-tools";
+//#region lib/types/index.js
+/** Model-facing query for a bundled Python, Node.js, and pnpm payload, in place or installed under the Harness home. */
+/** Cordis plugin identity. */
+const name = "tool-workspace-dependencies";
+/** Registry the tool registers into. */
+const inject = ["tools"];
+/** Require a named payload source before the Loader activates the tool. */
+const Config = z.object({
+	source: z.string().min(1).required(),
+	root: z.string().min(1)
+});
+const VERSION = /^\d+\.\d+\.\d+(?:[-+][\w.-]+)?$/u;
+const PLATFORMS = [
+	"win32",
+	"darwin",
+	"linux"
+];
+function isVersion(value) {
+	return typeof value === "string" && VERSION.test(value);
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isDistributionMap(value) {
+	return isRecord(value) && Object.entries(value).every(([name, version]) => /^[A-Za-z0-9][A-Za-z0-9._-]*$/u.test(name) && typeof version === "string" && /^\d[\w.!+-]*$/u.test(version));
+}
+/**
+* Validate payload JSON and normalize legacy component fields to top-level versions.
+* @param value - Untrusted decoded runtime.json contents.
+* @returns Canonical metadata with one Python distribution map and no components field.
+* @throws For malformed or mixed formats, duplicate distribution names, or inconsistent legacy metadata.
+*/
+function parsePrimaryRuntime(value) {
+	if (!isRecord(value)) throw new Error("primary runtime: invalid metadata");
+	const legacy = value.components !== void 0;
+	const versions = legacy ? value.components : value;
+	if (!isRecord(versions) || legacy && [
+		"python",
+		"node",
+		"pnpm"
+	].some((key) => value[key] !== void 0)) throw new Error("primary runtime: invalid metadata");
+	const { desktopVersion, platform, arch, payloadDigest } = value;
+	const { python, node, pnpm } = versions;
+	const pythonPackages = value.pythonPackages === void 0 && legacy ? {} : value.pythonPackages;
+	if (typeof desktopVersion !== "string" || desktopVersion.length === 0 || typeof platform !== "string" || !PLATFORMS.includes(platform) || typeof arch !== "string" || !["x64", "arm64"].includes(arch) || !isVersion(python) || node !== void 0 && !isVersion(node) || pnpm !== void 0 && (!isVersion(pnpm) || node === void 0) || payloadDigest !== void 0 && (typeof payloadDigest !== "string" || !/^[a-f0-9]{64}$/u.test(payloadDigest)) || !isDistributionMap(pythonPackages)) throw new Error("primary runtime: invalid metadata");
+	const entries = Object.entries(pythonPackages);
+	const distributions = new Map(entries.map(([name, version]) => [name.toLowerCase().replace(/[-_.]+/gu, "-"), version]));
+	if (distributions.size !== entries.length) throw new Error("primary runtime: invalid metadata");
+	if (legacy) for (const name of ["numpy", "pandas"]) {
+		if (!isVersion(versions[name])) throw new Error("primary runtime: invalid metadata");
+		const version = distributions.get(name);
+		if (version !== void 0 && version !== versions[name]) throw new Error(`primary runtime: conflicting ${name} distribution version`);
+	}
+	return {
+		desktopVersion,
+		platform,
+		arch,
+		...payloadDigest === void 0 ? {} : { payloadDigest },
+		python,
+		...node === void 0 ? {} : { node },
+		...pnpm === void 0 ? {} : { pnpm },
+		pythonPackages
+	};
+}
+/**
+* Read and normalize build metadata without rewriting the source file.
+* @param root - Installed or bundled primary runtime directory.
+* @returns Validated top-level versions and target identifiers, including for legacy components manifests.
+*/
+async function readPrimaryRuntime(root) {
+	return parsePrimaryRuntime(JSON.parse(await readFile(join(root, "runtime.json"), "utf8")));
+}
+/**
+* Resolve platform-specific interpreter and library locations without changing the environment.
+* @param root - Absolute payload or installation directory.
+* @param manifest - Validated runtime metadata.
+* @returns Absolute paths for explicit script execution and recorded bundled Python versions.
+*/
+function workspaceDependencyPaths(root, manifest) {
+	const dependencies = join(root, "dependencies");
+	const windows = manifest.platform === "win32";
+	const node = manifest.node === void 0 ? {} : {
+		node: join(dependencies, "node", "bin", windows ? "node.exe" : "node"),
+		nodePackages: join(dependencies, "node", "node_modules")
+	};
+	const pnpm = manifest.pnpm === void 0 ? {} : { pnpm: join(dependencies, "pnpm", "bin", "pnpm.mjs") };
+	return {
+		python: join(dependencies, "python", ...windows ? ["python.exe"] : ["bin", "python3"]),
+		...node,
+		...pnpm,
+		pythonPackages: join(dependencies, "python", ...windows ? ["Lib"] : ["lib", `python${manifest.python.split(".").slice(0, 2).join(".")}`], "site-packages"),
+		pythonDistributions: manifest.pythonPackages
+	};
+}
+async function validatePayloadEntries(paths) {
+	for (const [path, kind] of [
+		[paths.python, "file"],
+		[paths.node, "file"],
+		[paths.pnpm, "file"],
+		[paths.pythonPackages, "directory"],
+		[paths.nodePackages, "directory"]
+	]) {
+		if (path === void 0) continue;
+		const entry = await stat(path);
+		if (!(kind === "file" ? entry.isFile() : entry.isDirectory())) throw new Error(`primary runtime: expected ${kind} at ${path}`);
+	}
+}
+async function exists(path) {
+	try {
+		if ((await lstat(path)).isSymbolicLink()) throw new Error(`primary runtime: installation path is a filesystem link: ${path}`);
+		return true;
+	} catch (error) {
+		if (error.code === "ENOENT") return false;
+		throw error;
+	}
+}
+async function compatibleManifest(source) {
+	const manifest = await readPrimaryRuntime(source);
+	if (manifest.platform !== process.platform || manifest.arch !== process.arch) throw new Error("primary runtime: incompatible platform or architecture");
+	return manifest;
+}
+/**
+* Use a payload where it lies: validate its metadata and entries, copying nothing.
+* @param source - Payload directory, typically a read-only carrier.
+* @returns Paths into the payload itself.
+*/
+async function resolvePrimaryRuntime(source) {
+	const paths = workspaceDependencyPaths(source, await compatibleManifest(source));
+	await validatePayloadEntries(paths);
+	return paths;
+}
+/**
+* Install the application-owned payload locally, retaining a complete previous tree on copy failure.
+* @param source - Payload carried by the current installation.
+* @param root - Fixed primary runtime directory under the Harness home.
+* @returns Paths into the installed payload; no PATH or package-manager configuration is changed.
+*/
+async function installPrimaryRuntime(source, root) {
+	const manifest = await compatibleManifest(source);
+	await mkdir(dirname(root), { recursive: true });
+	const previous = `${root}.previous`;
+	const previousExists = await exists(previous);
+	if (!await exists(root) && previousExists) await rename(previous, root);
+	if (await exists(join(root, "runtime.json")) && JSON.stringify(await readPrimaryRuntime(root)) === JSON.stringify(manifest)) {
+		const paths = workspaceDependencyPaths(root, manifest);
+		await validatePayloadEntries(paths);
+		return paths;
+	}
+	const staging = await mkdtemp(join(dirname(root), ".primary-runtime-"));
+	try {
+		await cp(source, staging, {
+			recursive: true,
+			dereference: true
+		});
+		await validatePayloadEntries(workspaceDependencyPaths(staging, manifest));
+		await rm(previous, {
+			recursive: true,
+			force: true
+		});
+		const replacing = await exists(root);
+		if (replacing) await rename(root, previous);
+		try {
+			await rename(staging, root);
+		} catch (error) {
+			if (replacing) await rename(previous, root);
+			throw error;
+		}
+		await rm(previous, {
+			recursive: true,
+			force: true
+		});
+	} finally {
+		await rm(staging, {
+			recursive: true,
+			force: true
+		});
+	}
+	return workspaceDependencyPaths(root, manifest);
+}
+/**
+* Register the read-only path query; the first invocation prepares (or merely validates) the payload.
+* @param ctx - Tool registry owner.
+* @param config - Payload location and optional installation directory.
+*/
+function apply(ctx, config) {
+	if (!isAbsolute(config.source) || config.root !== void 0 && !isAbsolute(config.root)) throw new Error("workspace dependencies: source and root must be absolute paths");
+	let preparation;
+	ctx.effect(() => async () => {
+		await preparation?.catch(() => void 0);
+	});
+	ctx.tools.register(defineTool({
+		name: "load_workspace_dependencies",
+		description: "Get absolute paths to bundled Python and library directories, plus bundled Python distribution versions. Node.js and pnpm paths are included when the payload provides them. Python includes numpy, pandas, python-docx, python-pptx, openpyxl, Pillow, lxml, and XlsxWriter. Use these libraries for Office files unless the user or workspace instructions select another environment. When Node.js and pnpm paths are returned, run pnpm with that Node executable and pnpm script path. This does not change PATH or package-manager settings.",
+		parameters: {},
+		output: {
+			schema: {
+				type: "object",
+				additionalProperties: false,
+				properties: {
+					python: {
+						type: "string",
+						required: true
+					},
+					node: {
+						type: "string",
+						description: "Absent when the payload ships no Node.js."
+					},
+					pnpm: {
+						type: "string",
+						description: "Absent when the payload ships no pnpm."
+					},
+					pythonPackages: {
+						type: "string",
+						required: true
+					},
+					nodePackages: {
+						type: "string",
+						description: "Absent when the payload ships no Node.js."
+					},
+					pythonDistributions: {
+						type: "object",
+						additionalProperties: true,
+						required: true,
+						description: "Bundled distribution names and versions recorded in runtime.json; excludes user-installed additions."
+					}
+				}
+			},
+			render: (_args, value) => [{
+				type: "text",
+				text: JSON.stringify(value, void 0, 2)
+			}]
+		},
+		execute: () => {
+			preparation ??= (config.root === void 0 ? resolvePrimaryRuntime(config.source) : installPrimaryRuntime(config.source, config.root)).catch((error) => {
+				preparation = void 0;
+				throw error;
+			});
+			return preparation;
+		},
+		presentCall: () => ({
+			card: "generic",
+			title: "Load workspace dependencies",
+			kind: "read"
+		})
+	}));
+}
+//#endregion
+export { Config, apply, inject, installPrimaryRuntime, name, parsePrimaryRuntime, readPrimaryRuntime, resolvePrimaryRuntime, workspaceDependencyPaths };

package/lib/types/index.d.ts

@@ -0,0 +1,86 @@
+/** Model-facing query for a bundled Python, Node.js, and pnpm payload, in place or installed under the Harness home. */
+import type { Context } from '@deepseek-ai/cordis';
+import z from '@deepseek-ai/schemastery';
+/** Cordis plugin identity. */
+export declare const name = "tool-workspace-dependencies";
+/** Registry the tool registers into. */
+export declare const inject: string[];
+/** Payload location and optional installation directory. */
+export interface Config {
+    /** Payload directory carrying `runtime.json` and `dependencies/`. */
+    readonly source: string;
+    /**
+     * Installation directory under the Harness home. When set, the payload is copied there on the
+     * first call (the Desktop behavior); when omitted, the payload is used in place without copying,
+     * which suits read-only carriers such as container image layers.
+     */
+    readonly root?: string;
+}
+/** Require a named payload source before the Loader activates the tool. */
+export declare const Config: z<Config>;
+/** Canonical build metadata, independent of user-installed packages; legacy files are normalized on read. */
+export interface PrimaryRuntimeManifest {
+    readonly desktopVersion: string;
+    readonly platform: string;
+    readonly arch: string;
+    /** Locked payload identity; absent only in installations made before payload hashing. */
+    readonly payloadDigest?: string;
+    /** Bundled Python interpreter version. */
+    readonly python: string;
+    /** Absent when the payload ships no Node.js. */
+    readonly node?: string;
+    /** Bundled pnpm version; requires a bundled Node.js executable. */
+    readonly pnpm?: string;
+    /** All recorded Python distribution versions; empty for legacy files without a distribution map. */
+    readonly pythonPackages: Readonly<Record<string, string>>;
+}
+/** Absolute entry points and bundled versions; pnpm runs through the returned Node executable. */
+export interface WorkspaceDependencies {
+    readonly python: string;
+    readonly node?: string;
+    readonly pnpm?: string;
+    readonly pythonPackages: string;
+    readonly nodePackages?: string;
+    /** Locked distribution versions; excludes packages users add to the installed environment. */
+    readonly pythonDistributions: Readonly<Record<string, string>>;
+}
+/**
+ * Validate payload JSON and normalize legacy component fields to top-level versions.
+ * @param value - Untrusted decoded runtime.json contents.
+ * @returns Canonical metadata with one Python distribution map and no components field.
+ * @throws For malformed or mixed formats, duplicate distribution names, or inconsistent legacy metadata.
+ */
+export declare function parsePrimaryRuntime(value: unknown): PrimaryRuntimeManifest;
+/**
+ * Read and normalize build metadata without rewriting the source file.
+ * @param root - Installed or bundled primary runtime directory.
+ * @returns Validated top-level versions and target identifiers, including for legacy components manifests.
+ */
+export declare function readPrimaryRuntime(root: string): Promise<PrimaryRuntimeManifest>;
+/**
+ * Resolve platform-specific interpreter and library locations without changing the environment.
+ * @param root - Absolute payload or installation directory.
+ * @param manifest - Validated runtime metadata.
+ * @returns Absolute paths for explicit script execution and recorded bundled Python versions.
+ */
+export declare function workspaceDependencyPaths(root: string, manifest: PrimaryRuntimeManifest): WorkspaceDependencies;
+/**
+ * Use a payload where it lies: validate its metadata and entries, copying nothing.
+ * @param source - Payload directory, typically a read-only carrier.
+ * @returns Paths into the payload itself.
+ */
+export declare function resolvePrimaryRuntime(source: string): Promise<WorkspaceDependencies>;
+/**
+ * Install the application-owned payload locally, retaining a complete previous tree on copy failure.
+ * @param source - Payload carried by the current installation.
+ * @param root - Fixed primary runtime directory under the Harness home.
+ * @returns Paths into the installed payload; no PATH or package-manager configuration is changed.
+ */
+export declare function installPrimaryRuntime(source: string, root: string): Promise<WorkspaceDependencies>;
+/**
+ * Register the read-only path query; the first invocation prepares (or merely validates) the payload.
+ * @param ctx - Tool registry owner.
+ * @param config - Payload location and optional installation directory.
+ */
+export declare function apply(ctx: Context, config: Config): void;
+//# sourceMappingURL=index.d.ts.map

package/package.json

@@ -0,0 +1,44 @@
+{
+  "name": "@deepseek-ai/dsh-tool-workspace-dependencies",
+  "description": "The load_workspace_dependencies tool: absolute paths into a bundled Python, Node.js, and pnpm payload",
+  "version": "0.1.7-alpha.1",
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/skill/tool-workspace-dependencies"
+  },
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/types/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/types/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib/index.js",
+    "lib/types/**/*.d.ts"
+  ],
+  "license": "MIT",
+  "peerDependencies": {
+    "@deepseek-ai/dsh-tools": "^0.1.7-alpha.1",
+    "@deepseek-ai/cordis": "^4.0.3"
+  },
+  "devDependencies": {
+    "@deepseek-ai/dsh-tools": "^0.1.7-alpha.1",
+    "@deepseek-ai/cordis": "^4.0.3",
+    "@deepseek-ai/cordis-plugin-loader": "^1.0.4",
+    "@deepseek-ai/cordis-plugin-include": "^1.0.8",
+    "@deepseek-ai/dsh-agent": "^0.1.7-alpha.1",
+    "@deepseek-ai/dsh-llm": "^0.1.7-alpha.1",
+    "@deepseek-ai/dsh-system-prompt": "^0.1.7-alpha.1"
+  },
+  "dependencies": {
+    "@deepseek-ai/schemastery": "^3.18.3"
+  }
+}