@evegoodevening/dsh-llmwiki 0.0.2 → 0.0.4

package/CHANGELOG.md

@@ -1,6 +1,43 @@
 # Changelog
 
-## [Unreleased]
+## [0.0.4] - 2026-10-31
+
+### Security
+
+- Patch the isolated agent-smoke runner lock against Zod `<4.6.6` (GHSA-mrhx-c7xc-m3w5) and body-parser `<2.4.0` (GHSA-27r3-jxmh-p828) with `zod@^4: 4.6.6` and `body-parser: 2.4.0` overrides, and pin `qs` `6.16.1` (required by body-parser `^6.16.1`) instead of a release younger than the seven-day age window. Exact legacy Cordis `4.0.1`, Loader `1.0.2`, and DSH `0.1.1-rc.2` pins are retained, and the runner's integrity digest is updated in both agent preflight and the read-only-policy E2E.
+
+### Added
+
+- Add exact DSH `0.2.1-rc.5` support for the five service peers. Upstream `0.2.1-rc.2` → `0.2.1-rc.5` changed only exact sibling versions in these packages' manifests (code, types and exports are identical), but DSH rejected `0.0.3` during `dsh plugin add` because its peer lists ended at `0.2.1-rc.2`. Keep `0.2.1-rc.2` and the previously supported hosts; the intermediate `0.2.1-rc.3`/`rc.4` are not admitted, and add a native-dependency `0.2.1-rc.5` packed-profile row with strict standalone peer/type checks.
+
+### Changed
+
+- Move the root development baseline to DSH `0.2.1-rc.5` (Cordis `4.0.5`, Loader `1.0.6`, Schemastery `3.18.5` unchanged). Only DSH package versions changed in the root lockfile; the independent agent-smoke runner keeps its legacy DSH `0.1.1-rc.2`/Cordis `4.0.1`/Loader `1.0.2` closure apart from the security overrides above.
+
+## [0.0.3] - 2026-10-26
+
+### Security
+
+- Require patched Node.js `^22.23.4 || ^24.22.1 || >=26.12.1` in the package and isolated agent runner, enforce the same range in agent preflight, pin CI to Node `24.22.1` and release npm to `12.2.1`, and migrate pack-result consumers to npm 12's package-keyed JSON.
+- Update Vitest/coverage to `4.1.12`; pin patched Vite `8.3.4`, js-yaml `4.3.2`, brace-expansion `1.1.21`/`5.0.12`, and source-map-js `1.2.2` without weakening the seven-day dependency age policy.
+- Keep the retained DSH `0.2.0-rc.2` profile's expected Group `1.0.4` closure explicit in its isolated fixture instead of accepting fresh `1.0.5` resolution; latest-upstream compatibility lanes remain native.
+- Audit the isolated agent-runner lock as well as the root graph; patch its MCP SDK `1.32.0`, proxy-addr `2.0.8`, fast-uri `3.1.8`, sharp `0.35.5`, ip-address `10.7.4`, and Hono `4.13.11`, retaining exact legacy Cordis/Loader pins and updating the runner's integrity digest.
+- Keep the upgraded development graph on patched Zod `4.6.6` instead of DSH `0.2.1-rc.2`'s vulnerable `4.4.3` pin; preserve the seven-day release-age policy and the independent legacy runner.
+
+### Added
+
+- Add exact DSH `0.2.1-rc.2` support for the five service peers, retaining every previously supported version and the pinned legacy agent-smoke runner. Keep the new host in the packed-profile regression matrix with native dependencies and strict standalone peer/type checks.
+
+### Changed
+
+- Upgrade the root development baseline to DSH `0.2.1-rc.2`, Cordis `4.0.5`, Loader `1.0.6`, Schemastery `3.18.5`, and `node-addon-require-builtin` `0.1.9`; regenerate the lockfile, replace `dsh-code-runtime` with `dsh-ptc-runtime`, and remove `dsh-invariants`. Migrate ordinary smoke to `ToolCallId` and Loader tests to returned entry IDs, synchronous removal plus lifecycle waiting, and import-failure diagnostics rather than rejected creation promises.
+- Validate the separately pinned agent-smoke version against its own runner manifest rather than the root development dependency; preserve its exact frozen lock, integrity checks, and legacy host fixtures.
+
+### Fixed
+
+- Pin the upstream-compatibility workflow to npm `12.2.1`, matching the release workflow and package-keyed pack-result parser. The runner's bundled older npm returned array metadata and stopped both probes at `build-and-pack` before host compatibility could be checked.
+- Align the read-only-policy E2E runner digest with the already committed security-patched lock and agent-smoke preflight, preserving the exact-lock checks and legacy runtime without changing either dependency graph.
+- Keep isolated agent preflight aligned with the development toolchain: honor the copied workspace's frozen-install policies and pinned pnpm version, parse machine-readable stdout separately from stderr while retaining the combined output limit, and explicitly activate llmwiki only in the disposable profile. The package remains disabled by default.
 
 ## [0.0.2] - 2026-10-17
 

package/README.md

@@ -16,12 +16,14 @@ The plugin makes no model or network calls. The calling agent handles synthesis
 
 | DSH (`@deepseek-ai/dsh`) | Cordis (`@deepseek-ai/cordis`) | Status |
 | --- | --- | --- |
-| **`0.2.0-rc.2`** | **`4.0.4` or `4.0.5`** | **Recommended** |
+| **`0.2.1-rc.5`** | **`4.0.5`** | **Recommended** |
+| `0.2.1-rc.2` | `4.0.5` | Supported |
+| `0.2.0-rc.2` | `4.0.4` or `4.0.5` | Supported |
 | `0.1.7-rc.2` | `4.0.4` | Supported |
 | `0.1.1-rc.2` | `4.0.1` | Supported legacy |
 | `0.1.0-rc.6` | `4.0.1` | Supported legacy |
 
-- **Node.js:** `^22.19.0 || >=24`.
+- **Node.js:** `^22.23.4 || ^24.22.1 || >=26.12.1`. CI pins `24.22.1`; earlier 24.x and odd-numbered 23/25 releases are not supported. Use npm `12.2.1` for the release/pack probes and pnpm below for dependency management.
 - **pnpm:** `11.7.0`, on `PATH` for `dsh plugin` and development.
 - Use a coherent DSH service family, not mixed release candidates. The `0.1.0-rc.6` host resolves its five DSH service peers to `0.1.0-rc.8`; the other rows use same-version services.
 - Cordis `4.0.5` requires Loader `~1.0.6` and Include `~1.0.10`; update the host's companion packages together rather than forcing Cordis onto older companions.
@@ -33,12 +35,12 @@ The plugin's version in [package.json](package.json) is independent of the DSH a
 
 Use **`@evegoodevening/dsh-llmwiki`**. The unscoped `dsh-llmwiki` package belongs to a different project.
 
-From this checkout, pack and install `0.0.2` with a supported DSH host on `PATH` (`web` is the example profile):
+From this checkout, pack and install `0.0.4` with a supported DSH host on `PATH` (`web` is the example profile):
 
 ```sh
 pnpm install --frozen-lockfile
 pnpm pack
-dsh plugin --profile web add ./evegoodevening-dsh-llmwiki-0.0.2.tgz
+dsh plugin --profile web add ./evegoodevening-dsh-llmwiki-0.0.4.tgz
 ```
 
 When the package is available on npm, the equivalent registry command is `dsh plugin --profile web add @evegoodevening/dsh-llmwiki@latest`.
@@ -155,7 +157,9 @@ pnpm run check:determinism
 pnpm run smoke
 ```
 
-The Linux unit suite's read-only tmpfs test requires root and mount-namespace capability. E2E builds first and exercises packed packages across the supported host matrix; run it separately from other builds because it temporarily hides shared checkout paths. Ordinary smoke uses the pinned legacy development dependencies, not the recommended host.
+The Linux unit suite's read-only tmpfs test requires root and mount-namespace capability. E2E builds first and exercises packed packages across the supported host matrix; run it separately from other builds because it temporarily hides shared checkout paths. Ordinary smoke uses the development baseline below.
+
+The development baseline is DSH `0.2.1-rc.5`, Cordis `4.0.5`, Loader `1.0.6`, Schemastery `3.18.5`, and `node-addon-require-builtin` `0.1.9`. The root graph uses `dsh-ptc-runtime` instead of the retired `dsh-code-runtime` and no longer includes `dsh-invariants`. Supported legacy hosts remain unchanged; the independent agent-smoke runner keeps its legacy DSH `0.1.1-rc.2` closure with security overrides only. The fixed `0.2.1-rc.2` and `0.2.1-rc.5` E2E rows use native host dependencies and a strict standalone consumer, independently of the rolling latest-version probes.
 
 - **Upstream compatibility:** `pnpm run check:compatibility` probes latest DSH with native dependencies and, separately, forced latest Cordis. Disposable hosts and consumers apply the repository's `@deepseek-ai/*` release-age exception so fresh vendor companions can resolve together; other dependency age settings are unchanged. Networked, model-free; probes do not automatically extend the support table. See the [scheduled workflow](.github/workflows/compatibility.yml).
 - **Real-agent smoke:** set `DEEPSEEK_API_KEY`, `LLMWIKI_AGENT_SMOKE_MODEL`, and `LLMWIKI_AGENT_SMOKE_NETWORK=allow`, then run `pnpm run smoke:agent`. This separate, credentialed check uses a pinned DSH `0.1.1-rc.2` runner; offline checks do not prove model behavior.

package/README.zh.md

@@ -16,12 +16,14 @@
 
 | DSH（`@deepseek-ai/dsh`） | Cordis（`@deepseek-ai/cordis`） | 状态 |
 | --- | --- | --- |
-| **`0.2.0-rc.2`** | **`4.0.4` 或 `4.0.5`** | **推荐** |
+| **`0.2.1-rc.5`** | **`4.0.5`** | **推荐** |
+| `0.2.1-rc.2` | `4.0.5` | 支持 |
+| `0.2.0-rc.2` | `4.0.4` 或 `4.0.5` | 支持 |
 | `0.1.7-rc.2` | `4.0.4` | 支持 |
 | `0.1.1-rc.2` | `4.0.1` | 支持的旧版本 |
 | `0.1.0-rc.6` | `4.0.1` | 支持的旧版本 |
 
-- **Node.js：** `^22.19.0 || >=24`。
+- **Node.js：** `^22.23.4 || ^24.22.1 || >=26.12.1`。CI 固定使用 `24.22.1`；不支持更早的 24.x 和 23/25 系列。发布及打包探针使用 npm `12.2.1`，依赖管理仍使用下述 pnpm。
 - **pnpm：** `11.7.0`，执行 `dsh plugin` 和开发时需确保其位于 `PATH` 中。
 - 使用相互兼容的同一系列 DSH 服务，不要混用不同的候选发布版本。`0.1.0-rc.6` 宿主会将其五个 DSH 服务对等依赖解析为 `0.1.0-rc.8`；表中其他宿主使用与自身版本相同的服务。
 - Cordis `4.0.5` 需要 Loader `~1.0.6` 和 Include `~1.0.10`；请一并更新宿主的配套依赖，不要将新版 Cordis 强行搭配旧版配套包。
@@ -33,12 +35,12 @@
 
 请使用 **`@evegoodevening/dsh-llmwiki`**。不带作用域的 `dsh-llmwiki` 包属于另一个项目。
 
-在当前检出的仓库中打包并安装 `0.0.2`，同时确保受支持的 DSH 宿主位于 `PATH` 中（以下以 `web` profile 为例）：
+在当前检出的仓库中打包并安装 `0.0.4`，同时确保受支持的 DSH 宿主位于 `PATH` 中（以下以 `web` profile 为例）：
 
 ```sh
 pnpm install --frozen-lockfile
 pnpm pack
-dsh plugin --profile web add ./evegoodevening-dsh-llmwiki-0.0.2.tgz
+dsh plugin --profile web add ./evegoodevening-dsh-llmwiki-0.0.4.tgz
 ```
 
 当该包在 npm 上可用时，等效的仓库安装命令为 `dsh plugin --profile web add @evegoodevening/dsh-llmwiki@latest`。
@@ -155,7 +157,9 @@ pnpm run check:determinism
 pnpm run smoke
 ```
 
-Linux 单元测试套件中的只读 tmpfs 测试需要 root 权限和挂载命名空间能力。E2E 会先构建，再在受支持的宿主版本矩阵中测试打包后的包；请与其他构建分开运行，因为它会临时隐藏共享的仓库检出路径。常规 smoke 使用固定的旧版开发依赖，而非推荐宿主。
+Linux 单元测试套件中的只读 tmpfs 测试需要 root 权限和挂载命名空间能力。E2E 会先构建，再在受支持的宿主版本矩阵中测试打包后的包；请与其他构建分开运行，因为它会临时隐藏共享的仓库检出路径。常规 smoke 使用下述开发基线。
+
+开发基线为 DSH `0.2.1-rc.5`、Cordis `4.0.5`、Loader `1.0.6`、Schemastery `3.18.5` 和 `node-addon-require-builtin` `0.1.9`。根依赖图使用 `dsh-ptc-runtime` 替代已退役的 `dsh-code-runtime`，不再包含 `dsh-invariants`。旧宿主支持保持不变；独立的 agent-smoke 运行器保留其旧版 DSH `0.1.1-rc.2` 依赖闭包，仅增加安全覆盖。固定的 `0.2.1-rc.2` 和 `0.2.1-rc.5` E2E 用例使用宿主原生依赖和严格的独立消费者检查，与滚动的最新版探测相互独立。
 
 - **上游兼容性：** `pnpm run check:compatibility` 分别检查使用原生依赖的最新版 DSH，以及强制使用最新版 Cordis 的情况。临时宿主和消费者项目沿用仓库的 `@deepseek-ai/*` 最低发布年龄例外，使新发布的配套包能够一起解析；其他依赖的发布年龄设置保持不变。此检查需要联网，但不调用模型；检查结果不会自动扩展支持表。参见[定时工作流](.github/workflows/compatibility.yml)。
 - **真实智能体 smoke：** 设置 `DEEPSEEK_API_KEY`、`LLMWIKI_AGENT_SMOKE_MODEL` 和 `LLMWIKI_AGENT_SMOKE_NETWORK=allow`，然后运行 `pnpm run smoke:agent`。这项独立且需要凭据的检查使用固定的 DSH `0.1.1-rc.2` 运行器；离线检查不能证明模型行为。

package/lib/types/service.d.ts

@@ -6,7 +6,7 @@ import type { PageId, SourceId } from './ids.ts';
 import type { AddSourceInput, ByteRange, CatalogRequest, LintReport, PageCatalogPage, PageRead, PageReceipt, ReindexReceipt, SearchHit, SourceCatalogPage, SourceRead, SourceReceipt, UpsertPageInput, WikiStatus } from './types.ts';
 declare const configKey: unique symbol;
 export declare class LlmWikiService extends Service {
-    static Config: Schemastery<ConfigSchema, ResolvedConfig>;
+    static Config: Schemastery<ConfigSchema, ResolvedConfig, "plain">;
     private readonly [configKey];
     private pathsValue;
     private queue;

package/lib/types/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/service.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EAAE,MAAM,IAAI,YAAY,EAAiB,MAAM,aAAa,CAAA;AACnE,OAAO,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAIzD,OAAO,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AAiBhD,OAAO,KAAK,EACV,cAAc,EACd,SAAS,EACT,cAAc,EAEd,UAAU,EAEV,eAAe,EACf,QAAQ,EACR,WAAW,EACX,cAAc,EACd,SAAS,EAET,iBAAiB,EAEjB,UAAU,EACV,aAAa,EACb,eAAe,EACf,UAAU,EACX,MAAM,YAAY,CAAA;AAyUnB,QAAA,MAAM,SAAS,EAAE,OAAO,MAAiC,CAAA;AAEzD,qBAAa,cAAe,SAAQ,OAAO;IACzC,MAAM,CAAC,MAAM,4CAAe;IAE5B,OAAO,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,CAAgB;IAC5C,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,KAAK,CAAmC;IAChD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA2C;IAClE,OAAO,CAAC,QAAQ,CAAQ;gBAEZ,GAAG,EAAE,OAAO,EAAE,MAAM,GAAE,MAAW;IAa7C,OAAO,CAAC,OAAO;YAwDD,UAAU;IAkBlB,MAAM,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;IA4BjD,SAAS,CAAC,KAAK,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,aAAa,CAAC;IA2F9E,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;IActF,WAAW,CAAC,OAAO,GAAE,cAAmB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAoE3F,SAAS,CAAC,OAAO,GAAE,cAAmB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC;YAyD/E,gBAAgB;IAkCxB,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC;IAmB7D,UAAU,CAAC,KAAK,EAAE,eAAe,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAgC9E,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;IAI/C,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,SAA6B,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IAoB1G,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,cAAc,CAAC;YAc9C,mBAAmB;YAQnB,WAAW;YAqBX,WAAW;CAsC1B;AAED,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,OAAO;QACf,OAAO,EAAE,cAAc,CAAA;KACxB;CACF"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/service.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EAAE,MAAM,IAAI,YAAY,EAAiB,MAAM,aAAa,CAAA;AACnE,OAAO,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAIzD,OAAO,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AAiBhD,OAAO,KAAK,EACV,cAAc,EACd,SAAS,EACT,cAAc,EAEd,UAAU,EAEV,eAAe,EACf,QAAQ,EACR,WAAW,EACX,cAAc,EACd,SAAS,EAET,iBAAiB,EAEjB,UAAU,EACV,aAAa,EACb,eAAe,EACf,UAAU,EACX,MAAM,YAAY,CAAA;AAyUnB,QAAA,MAAM,SAAS,EAAE,OAAO,MAAiC,CAAA;AAEzD,qBAAa,cAAe,SAAQ,OAAO;IACzC,MAAM,CAAC,MAAM,qDAAe;IAE5B,OAAO,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,CAAgB;IAC5C,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,KAAK,CAAmC;IAChD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA2C;IAClE,OAAO,CAAC,QAAQ,CAAQ;gBAEZ,GAAG,EAAE,OAAO,EAAE,MAAM,GAAE,MAAW;IAa7C,OAAO,CAAC,OAAO;YAwDD,UAAU;IAkBlB,MAAM,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;IA4BjD,SAAS,CAAC,KAAK,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,aAAa,CAAC;IA2F9E,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;IActF,WAAW,CAAC,OAAO,GAAE,cAAmB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAoE3F,SAAS,CAAC,OAAO,GAAE,cAAmB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC;YAyD/E,gBAAgB;IAkCxB,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC;IAmB7D,UAAU,CAAC,KAAK,EAAE,eAAe,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAgC9E,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;IAI/C,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,SAA6B,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IAoB1G,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,cAAc,CAAC;YAc9C,mBAAmB;YAQnB,WAAW;YAqBX,WAAW;CAsC1B;AAED,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,OAAO;QACf,OAAO,EAAE,cAAc,CAAA;KACxB;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@evegoodevening/dsh-llmwiki",
-  "version": "0.0.2",
+  "version": "0.0.4",
   "description": "Third-party, local-first, source-linked Markdown wiki storage and retrieval plugin for DeepSeek Harness",
   "author": "EveGoodEvening",
   "license": "MIT",
@@ -14,7 +14,7 @@
   },
   "packageManager": "pnpm@11.7.0",
   "engines": {
-    "node": "^22.19.0 || >=24"
+    "node": "^22.23.4 || ^24.22.1 || >=26.12.1"
   },
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",
@@ -59,40 +59,39 @@
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "4.0.1 || 4.0.4 || 4.0.5",
-    "@deepseek-ai/dsh-brand": "0.1.0-rc.6 || 0.1.0-rc.8 || 0.1.1-rc.2 || 0.1.7-rc.2 || 0.2.0-rc.2",
-    "@deepseek-ai/dsh-commands": "0.1.0-rc.6 || 0.1.0-rc.8 || 0.1.1-rc.2 || 0.1.7-rc.2 || 0.2.0-rc.2",
-    "@deepseek-ai/dsh-session": "0.1.0-rc.6 || 0.1.0-rc.8 || 0.1.1-rc.2 || 0.1.7-rc.2 || 0.2.0-rc.2",
-    "@deepseek-ai/dsh-system-prompt": "0.1.0-rc.6 || 0.1.0-rc.8 || 0.1.1-rc.2 || 0.1.7-rc.2 || 0.2.0-rc.2",
-    "@deepseek-ai/dsh-tools": "0.1.0-rc.6 || 0.1.0-rc.8 || 0.1.1-rc.2 || 0.1.7-rc.2 || 0.2.0-rc.2",
+    "@deepseek-ai/dsh-brand": "0.1.0-rc.6 || 0.1.0-rc.8 || 0.1.1-rc.2 || 0.1.7-rc.2 || 0.2.0-rc.2 || 0.2.1-rc.2 || 0.2.1-rc.5",
+    "@deepseek-ai/dsh-commands": "0.1.0-rc.6 || 0.1.0-rc.8 || 0.1.1-rc.2 || 0.1.7-rc.2 || 0.2.0-rc.2 || 0.2.1-rc.2 || 0.2.1-rc.5",
+    "@deepseek-ai/dsh-session": "0.1.0-rc.6 || 0.1.0-rc.8 || 0.1.1-rc.2 || 0.1.7-rc.2 || 0.2.0-rc.2 || 0.2.1-rc.2 || 0.2.1-rc.5",
+    "@deepseek-ai/dsh-system-prompt": "0.1.0-rc.6 || 0.1.0-rc.8 || 0.1.1-rc.2 || 0.1.7-rc.2 || 0.2.0-rc.2 || 0.2.1-rc.2 || 0.2.1-rc.5",
+    "@deepseek-ai/dsh-tools": "0.1.0-rc.6 || 0.1.0-rc.8 || 0.1.1-rc.2 || 0.1.7-rc.2 || 0.2.0-rc.2 || 0.2.1-rc.2 || 0.2.1-rc.5",
     "@deepseek-ai/schemastery": "^3.18.1"
   },
   "devDependencies": {
-    "@deepseek-ai/cordis": "4.0.1",
-    "@deepseek-ai/cordis-plugin-loader": "1.0.2",
-    "@deepseek-ai/dsh-agent": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-attachment": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-brand": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-code-runtime": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-commands": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-invariants": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-llm": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-scope": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-session": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-system-prompt": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-timeout": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-tools": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-typert-protocol": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-user-approval": "0.1.1-rc.2",
-    "@deepseek-ai/schemastery": "3.18.1",
+    "@deepseek-ai/cordis": "4.0.5",
+    "@deepseek-ai/cordis-plugin-loader": "1.0.6",
+    "@deepseek-ai/dsh-agent": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-attachment": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-brand": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-commands": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-llm": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-ptc-runtime": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-scope": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-session": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-system-prompt": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-timeout": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-tools": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-typert-protocol": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-user-approval": "0.2.1-rc.5",
+    "@deepseek-ai/schemastery": "3.18.5",
     "@types/node": "22.20.0",
     "@typescript-eslint/eslint-plugin": "8.67.0",
     "@typescript-eslint/parser": "8.67.0",
-    "@vitest/coverage-v8": "4.1.8",
+    "@vitest/coverage-v8": "4.1.12",
     "eslint": "9.39.2",
-    "node-addon-require-builtin": "0.1.4",
+    "node-addon-require-builtin": "0.1.9",
     "tsdown": "0.22.2",
     "tsx": "4.22.4",
     "typescript": "6.0.3",
-    "vitest": "4.1.8"
+    "vitest": "4.1.12"
   }
 }