@evegoodevening/dsh-llmwiki 0.0.3 → 0.0.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/CHANGELOG.md +14 -0
  2. package/README.md +5 -4
  3. package/README.zh.md +5 -4
  4. package/package.json +19 -19
package/CHANGELOG.md CHANGED
@@ -1,5 +1,19 @@
1
1
  # Changelog
2
2
 
3
+ ## [0.0.4] - 2026-10-31
4
+
5
+ ### Security
6
+
7
+ - Patch the isolated agent-smoke runner lock against Zod `<4.6.6` (GHSA-mrhx-c7xc-m3w5) and body-parser `<2.4.0` (GHSA-27r3-jxmh-p828) with `zod@^4: 4.6.6` and `body-parser: 2.4.0` overrides, and pin `qs` `6.16.1` (required by body-parser `^6.16.1`) instead of a release younger than the seven-day age window. Exact legacy Cordis `4.0.1`, Loader `1.0.2`, and DSH `0.1.1-rc.2` pins are retained, and the runner's integrity digest is updated in both agent preflight and the read-only-policy E2E.
8
+
9
+ ### Added
10
+
11
+ - Add exact DSH `0.2.1-rc.5` support for the five service peers. Upstream `0.2.1-rc.2` → `0.2.1-rc.5` changed only exact sibling versions in these packages' manifests (code, types and exports are identical), but DSH rejected `0.0.3` during `dsh plugin add` because its peer lists ended at `0.2.1-rc.2`. Keep `0.2.1-rc.2` and the previously supported hosts; the intermediate `0.2.1-rc.3`/`rc.4` are not admitted, and add a native-dependency `0.2.1-rc.5` packed-profile row with strict standalone peer/type checks.
12
+
13
+ ### Changed
14
+
15
+ - Move the root development baseline to DSH `0.2.1-rc.5` (Cordis `4.0.5`, Loader `1.0.6`, Schemastery `3.18.5` unchanged). Only DSH package versions changed in the root lockfile; the independent agent-smoke runner keeps its legacy DSH `0.1.1-rc.2`/Cordis `4.0.1`/Loader `1.0.2` closure apart from the security overrides above.
16
+
3
17
  ## [0.0.3] - 2026-10-26
4
18
 
5
19
  ### Security
package/README.md CHANGED
@@ -16,7 +16,8 @@ The plugin makes no model or network calls. The calling agent handles synthesis
16
16
 
17
17
  | DSH (`@deepseek-ai/dsh`) | Cordis (`@deepseek-ai/cordis`) | Status |
18
18
  | --- | --- | --- |
19
- | **`0.2.1-rc.2`** | **`4.0.5`** | **Recommended** |
19
+ | **`0.2.1-rc.5`** | **`4.0.5`** | **Recommended** |
20
+ | `0.2.1-rc.2` | `4.0.5` | Supported |
20
21
  | `0.2.0-rc.2` | `4.0.4` or `4.0.5` | Supported |
21
22
  | `0.1.7-rc.2` | `4.0.4` | Supported |
22
23
  | `0.1.1-rc.2` | `4.0.1` | Supported legacy |
@@ -34,12 +35,12 @@ The plugin's version in [package.json](package.json) is independent of the DSH a
34
35
 
35
36
  Use **`@evegoodevening/dsh-llmwiki`**. The unscoped `dsh-llmwiki` package belongs to a different project.
36
37
 
37
- From this checkout, pack and install `0.0.3` with a supported DSH host on `PATH` (`web` is the example profile):
38
+ From this checkout, pack and install `0.0.4` with a supported DSH host on `PATH` (`web` is the example profile):
38
39
 
39
40
  ```sh
40
41
  pnpm install --frozen-lockfile
41
42
  pnpm pack
42
- dsh plugin --profile web add ./evegoodevening-dsh-llmwiki-0.0.3.tgz
43
+ dsh plugin --profile web add ./evegoodevening-dsh-llmwiki-0.0.4.tgz
43
44
  ```
44
45
 
45
46
  When the package is available on npm, the equivalent registry command is `dsh plugin --profile web add @evegoodevening/dsh-llmwiki@latest`.
@@ -158,7 +159,7 @@ pnpm run smoke
158
159
 
159
160
  The Linux unit suite's read-only tmpfs test requires root and mount-namespace capability. E2E builds first and exercises packed packages across the supported host matrix; run it separately from other builds because it temporarily hides shared checkout paths. Ordinary smoke uses the development baseline below.
160
161
 
161
- The development baseline is DSH `0.2.1-rc.2`, Cordis `4.0.5`, Loader `1.0.6`, Schemastery `3.18.5`, and `node-addon-require-builtin` `0.1.9`. The root graph uses `dsh-ptc-runtime` instead of the retired `dsh-code-runtime` and no longer includes `dsh-invariants`. Supported legacy hosts and the independent agent-smoke runner remain unchanged. The fixed `0.2.1-rc.2` E2E row uses native host dependencies and a strict standalone consumer, independently of the rolling latest-version probes.
162
+ The development baseline is DSH `0.2.1-rc.5`, Cordis `4.0.5`, Loader `1.0.6`, Schemastery `3.18.5`, and `node-addon-require-builtin` `0.1.9`. The root graph uses `dsh-ptc-runtime` instead of the retired `dsh-code-runtime` and no longer includes `dsh-invariants`. Supported legacy hosts remain unchanged; the independent agent-smoke runner keeps its legacy DSH `0.1.1-rc.2` closure with security overrides only. The fixed `0.2.1-rc.2` and `0.2.1-rc.5` E2E rows use native host dependencies and a strict standalone consumer, independently of the rolling latest-version probes.
162
163
 
163
164
  - **Upstream compatibility:** `pnpm run check:compatibility` probes latest DSH with native dependencies and, separately, forced latest Cordis. Disposable hosts and consumers apply the repository's `@deepseek-ai/*` release-age exception so fresh vendor companions can resolve together; other dependency age settings are unchanged. Networked, model-free; probes do not automatically extend the support table. See the [scheduled workflow](.github/workflows/compatibility.yml).
164
165
  - **Real-agent smoke:** set `DEEPSEEK_API_KEY`, `LLMWIKI_AGENT_SMOKE_MODEL`, and `LLMWIKI_AGENT_SMOKE_NETWORK=allow`, then run `pnpm run smoke:agent`. This separate, credentialed check uses a pinned DSH `0.1.1-rc.2` runner; offline checks do not prove model behavior.
package/README.zh.md CHANGED
@@ -16,7 +16,8 @@
16
16
 
17
17
  | DSH（`@deepseek-ai/dsh`） | Cordis（`@deepseek-ai/cordis`） | 状态 |
18
18
  | --- | --- | --- |
19
- | **`0.2.1-rc.2`** | **`4.0.5`** | **推荐** |
19
+ | **`0.2.1-rc.5`** | **`4.0.5`** | **推荐** |
20
+ | `0.2.1-rc.2` | `4.0.5` | 支持 |
20
21
  | `0.2.0-rc.2` | `4.0.4` 或 `4.0.5` | 支持 |
21
22
  | `0.1.7-rc.2` | `4.0.4` | 支持 |
22
23
  | `0.1.1-rc.2` | `4.0.1` | 支持的旧版本 |
@@ -34,12 +35,12 @@
34
35
 
35
36
  请使用 **`@evegoodevening/dsh-llmwiki`**。不带作用域的 `dsh-llmwiki` 包属于另一个项目。
36
37
 
37
- 在当前检出的仓库中打包并安装 `0.0.3`，同时确保受支持的 DSH 宿主位于 `PATH` 中（以下以 `web` profile 为例）：
38
+ 在当前检出的仓库中打包并安装 `0.0.4`，同时确保受支持的 DSH 宿主位于 `PATH` 中（以下以 `web` profile 为例）：
38
39
 
39
40
  ```sh
40
41
  pnpm install --frozen-lockfile
41
42
  pnpm pack
42
- dsh plugin --profile web add ./evegoodevening-dsh-llmwiki-0.0.3.tgz
43
+ dsh plugin --profile web add ./evegoodevening-dsh-llmwiki-0.0.4.tgz
43
44
  ```
44
45
 
45
46
  当该包在 npm 上可用时，等效的仓库安装命令为 `dsh plugin --profile web add @evegoodevening/dsh-llmwiki@latest`。
@@ -158,7 +159,7 @@ pnpm run smoke
158
159
 
159
160
  Linux 单元测试套件中的只读 tmpfs 测试需要 root 权限和挂载命名空间能力。E2E 会先构建，再在受支持的宿主版本矩阵中测试打包后的包；请与其他构建分开运行，因为它会临时隐藏共享的仓库检出路径。常规 smoke 使用下述开发基线。
160
161
 
161
- 开发基线为 DSH `0.2.1-rc.2`、Cordis `4.0.5`、Loader `1.0.6`、Schemastery `3.18.5` 和 `node-addon-require-builtin` `0.1.9`。根依赖图使用 `dsh-ptc-runtime` 替代已退役的 `dsh-code-runtime`，不再包含 `dsh-invariants`。旧宿主支持和独立的 agent-smoke 运行器保持不变。固定的 `0.2.1-rc.2` E2E 用例使用宿主原生依赖和严格的独立消费者检查，与滚动的最新版探测相互独立。
162
+ 开发基线为 DSH `0.2.1-rc.5`、Cordis `4.0.5`、Loader `1.0.6`、Schemastery `3.18.5` 和 `node-addon-require-builtin` `0.1.9`。根依赖图使用 `dsh-ptc-runtime` 替代已退役的 `dsh-code-runtime`，不再包含 `dsh-invariants`。旧宿主支持保持不变；独立的 agent-smoke 运行器保留其旧版 DSH `0.1.1-rc.2` 依赖闭包，仅增加安全覆盖。固定的 `0.2.1-rc.2` 和 `0.2.1-rc.5` E2E 用例使用宿主原生依赖和严格的独立消费者检查，与滚动的最新版探测相互独立。
162
163
 
163
164
  - **上游兼容性：** `pnpm run check:compatibility` 分别检查使用原生依赖的最新版 DSH，以及强制使用最新版 Cordis 的情况。临时宿主和消费者项目沿用仓库的 `@deepseek-ai/*` 最低发布年龄例外，使新发布的配套包能够一起解析；其他依赖的发布年龄设置保持不变。此检查需要联网，但不调用模型；检查结果不会自动扩展支持表。参见[定时工作流](.github/workflows/compatibility.yml)。
164
165
  - **真实智能体 smoke：** 设置 `DEEPSEEK_API_KEY`、`LLMWIKI_AGENT_SMOKE_MODEL` 和 `LLMWIKI_AGENT_SMOKE_NETWORK=allow`，然后运行 `pnpm run smoke:agent`。这项独立且需要凭据的检查使用固定的 DSH `0.1.1-rc.2` 运行器；离线检查不能证明模型行为。
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@evegoodevening/dsh-llmwiki",
3
- "version": "0.0.3",
3
+ "version": "0.0.4",
4
4
  "description": "Third-party, local-first, source-linked Markdown wiki storage and retrieval plugin for DeepSeek Harness",
5
5
  "author": "EveGoodEvening",
6
6
  "license": "MIT",
@@ -59,29 +59,29 @@
59
59
  },
60
60
  "peerDependencies": {
61
61
  "@deepseek-ai/cordis": "4.0.1 || 4.0.4 || 4.0.5",
62
- "@deepseek-ai/dsh-brand": "0.1.0-rc.6 || 0.1.0-rc.8 || 0.1.1-rc.2 || 0.1.7-rc.2 || 0.2.0-rc.2 || 0.2.1-rc.2",
63
- "@deepseek-ai/dsh-commands": "0.1.0-rc.6 || 0.1.0-rc.8 || 0.1.1-rc.2 || 0.1.7-rc.2 || 0.2.0-rc.2 || 0.2.1-rc.2",
64
- "@deepseek-ai/dsh-session": "0.1.0-rc.6 || 0.1.0-rc.8 || 0.1.1-rc.2 || 0.1.7-rc.2 || 0.2.0-rc.2 || 0.2.1-rc.2",
65
- "@deepseek-ai/dsh-system-prompt": "0.1.0-rc.6 || 0.1.0-rc.8 || 0.1.1-rc.2 || 0.1.7-rc.2 || 0.2.0-rc.2 || 0.2.1-rc.2",
66
- "@deepseek-ai/dsh-tools": "0.1.0-rc.6 || 0.1.0-rc.8 || 0.1.1-rc.2 || 0.1.7-rc.2 || 0.2.0-rc.2 || 0.2.1-rc.2",
62
+ "@deepseek-ai/dsh-brand": "0.1.0-rc.6 || 0.1.0-rc.8 || 0.1.1-rc.2 || 0.1.7-rc.2 || 0.2.0-rc.2 || 0.2.1-rc.2 || 0.2.1-rc.5",
63
+ "@deepseek-ai/dsh-commands": "0.1.0-rc.6 || 0.1.0-rc.8 || 0.1.1-rc.2 || 0.1.7-rc.2 || 0.2.0-rc.2 || 0.2.1-rc.2 || 0.2.1-rc.5",
64
+ "@deepseek-ai/dsh-session": "0.1.0-rc.6 || 0.1.0-rc.8 || 0.1.1-rc.2 || 0.1.7-rc.2 || 0.2.0-rc.2 || 0.2.1-rc.2 || 0.2.1-rc.5",
65
+ "@deepseek-ai/dsh-system-prompt": "0.1.0-rc.6 || 0.1.0-rc.8 || 0.1.1-rc.2 || 0.1.7-rc.2 || 0.2.0-rc.2 || 0.2.1-rc.2 || 0.2.1-rc.5",
66
+ "@deepseek-ai/dsh-tools": "0.1.0-rc.6 || 0.1.0-rc.8 || 0.1.1-rc.2 || 0.1.7-rc.2 || 0.2.0-rc.2 || 0.2.1-rc.2 || 0.2.1-rc.5",
67
67
  "@deepseek-ai/schemastery": "^3.18.1"
68
68
  },
69
69
  "devDependencies": {
70
70
  "@deepseek-ai/cordis": "4.0.5",
71
71
  "@deepseek-ai/cordis-plugin-loader": "1.0.6",
72
- "@deepseek-ai/dsh-agent": "0.2.1-rc.2",
73
- "@deepseek-ai/dsh-attachment": "0.2.1-rc.2",
74
- "@deepseek-ai/dsh-brand": "0.2.1-rc.2",
75
- "@deepseek-ai/dsh-commands": "0.2.1-rc.2",
76
- "@deepseek-ai/dsh-llm": "0.2.1-rc.2",
77
- "@deepseek-ai/dsh-ptc-runtime": "0.2.1-rc.2",
78
- "@deepseek-ai/dsh-scope": "0.2.1-rc.2",
79
- "@deepseek-ai/dsh-session": "0.2.1-rc.2",
80
- "@deepseek-ai/dsh-system-prompt": "0.2.1-rc.2",
81
- "@deepseek-ai/dsh-timeout": "0.2.1-rc.2",
82
- "@deepseek-ai/dsh-tools": "0.2.1-rc.2",
83
- "@deepseek-ai/dsh-typert-protocol": "0.2.1-rc.2",
84
- "@deepseek-ai/dsh-user-approval": "0.2.1-rc.2",
72
+ "@deepseek-ai/dsh-agent": "0.2.1-rc.5",
73
+ "@deepseek-ai/dsh-attachment": "0.2.1-rc.5",
74
+ "@deepseek-ai/dsh-brand": "0.2.1-rc.5",
75
+ "@deepseek-ai/dsh-commands": "0.2.1-rc.5",
76
+ "@deepseek-ai/dsh-llm": "0.2.1-rc.5",
77
+ "@deepseek-ai/dsh-ptc-runtime": "0.2.1-rc.5",
78
+ "@deepseek-ai/dsh-scope": "0.2.1-rc.5",
79
+ "@deepseek-ai/dsh-session": "0.2.1-rc.5",
80
+ "@deepseek-ai/dsh-system-prompt": "0.2.1-rc.5",
81
+ "@deepseek-ai/dsh-timeout": "0.2.1-rc.5",
82
+ "@deepseek-ai/dsh-tools": "0.2.1-rc.5",
83
+ "@deepseek-ai/dsh-typert-protocol": "0.2.1-rc.5",
84
+ "@deepseek-ai/dsh-user-approval": "0.2.1-rc.5",
85
85
  "@deepseek-ai/schemastery": "3.18.5",
86
86
  "@types/node": "22.20.0",
87
87
  "@typescript-eslint/eslint-plugin": "8.67.0",