@evegoodevening/dsh-llmwiki 0.0.3 → 0.0.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/CHANGELOG.md +20 -0
  2. package/README.md +9 -6
  3. package/README.zh.md +9 -6
  4. package/package.json +20 -20
package/CHANGELOG.md CHANGED
@@ -1,5 +1,25 @@
1
1
  # Changelog
2
2
 
3
+ ## [0.0.5] - 2026-10-31
4
+
5
+ ### Changed
6
+
7
+ - Declare the five DSH service peers as the proven exact older versions plus `>=0.2.1-rc.5 <0.3.0-0`, so later DSH `0.2.x` releases (including prereleases) are admitted without a package update. Widen Cordis to `4.0.1 || >=4.0.4 <4.1.0-0`, which still excludes `4.0.2`/`4.0.3`. DSH admission and pnpm match prereleases inside ranges; npm's strict semver accepts stable `0.2.x` from `0.2.1` but, among prereleases, only `0.2.1-rc.5` and later `0.2.1-*`. The scheduled compatibility monitor remains the check for new upstream releases.
8
+
9
+ ## [0.0.4] - 2026-10-31
10
+
11
+ ### Security
12
+
13
+ - Patch the isolated agent-smoke runner lock against Zod `<4.6.6` (GHSA-mrhx-c7xc-m3w5) and body-parser `<2.4.0` (GHSA-27r3-jxmh-p828) with `zod@^4: 4.6.6` and `body-parser: 2.4.0` overrides, and pin `qs` `6.16.1` (required by body-parser `^6.16.1`) instead of a release younger than the seven-day age window. Exact legacy Cordis `4.0.1`, Loader `1.0.2`, and DSH `0.1.1-rc.2` pins are retained, and the runner's integrity digest is updated in both agent preflight and the read-only-policy E2E.
14
+
15
+ ### Added
16
+
17
+ - Add exact DSH `0.2.1-rc.5` support for the five service peers. Upstream `0.2.1-rc.2` → `0.2.1-rc.5` changed only exact sibling versions in these packages' manifests (code, types and exports are identical), but DSH rejected `0.0.3` during `dsh plugin add` because its peer lists ended at `0.2.1-rc.2`. Keep `0.2.1-rc.2` and the previously supported hosts; the intermediate `0.2.1-rc.3`/`rc.4` are not admitted, and add a native-dependency `0.2.1-rc.5` packed-profile row with strict standalone peer/type checks.
18
+
19
+ ### Changed
20
+
21
+ - Move the root development baseline to DSH `0.2.1-rc.5` (Cordis `4.0.5`, Loader `1.0.6`, Schemastery `3.18.5` unchanged). Only DSH package versions changed in the root lockfile; the independent agent-smoke runner keeps its legacy DSH `0.1.1-rc.2`/Cordis `4.0.1`/Loader `1.0.2` closure apart from the security overrides above.
22
+
3
23
  ## [0.0.3] - 2026-10-26
4
24
 
5
25
  ### Security
package/README.md CHANGED
@@ -16,7 +16,9 @@ The plugin makes no model or network calls. The calling agent handles synthesis
16
16
 
17
17
  | DSH (`@deepseek-ai/dsh`) | Cordis (`@deepseek-ai/cordis`) | Status |
18
18
  | --- | --- | --- |
19
- | **`0.2.1-rc.2`** | **`4.0.5`** | **Recommended** |
19
+ | **`0.2.1-rc.5`** | **`4.0.5`** | **Recommended** (tested) |
20
+ | Later `0.2.x` (`>=0.2.1-rc.5 <0.3.0-0`) | As required by the host (currently `~4.0.5`) | Admitted by range; not individually tested |
21
+ | `0.2.1-rc.2` | `4.0.5` | Supported |
20
22
  | `0.2.0-rc.2` | `4.0.4` or `4.0.5` | Supported |
21
23
  | `0.1.7-rc.2` | `4.0.4` | Supported |
22
24
  | `0.1.1-rc.2` | `4.0.1` | Supported legacy |
@@ -25,8 +27,9 @@ The plugin makes no model or network calls. The calling agent handles synthesis
25
27
  - **Node.js:** `^22.23.4 || ^24.22.1 || >=26.12.1`. CI pins `24.22.1`; earlier 24.x and odd-numbered 23/25 releases are not supported. Use npm `12.2.1` for the release/pack probes and pnpm below for dependency management.
26
28
  - **pnpm:** `11.7.0`, on `PATH` for `dsh plugin` and development.
27
29
  - Use a coherent DSH service family, not mixed release candidates. The `0.1.0-rc.6` host resolves its five DSH service peers to `0.1.0-rc.8`; the other rows use same-version services.
30
+ - **Peer ranges.** Older hosts are listed exactly; newer DSH `0.2.x` releases, including prereleases, are admitted by `>=0.2.1-rc.5 <0.3.0-0`, so they need no package update. DSH admission and pnpm match prereleases inside a range. npm uses strict semver: it accepts stable `0.2.x` releases from `0.2.1` on, but among prereleases only `0.2.1-rc.5` and later `0.2.1-*`, so npm consumers get `ERESOLVE` on a new prerelease line such as `0.2.2-rc.1`. Cordis `4.0.2`/`4.0.3` remain excluded. The scheduled compatibility monitor tests each new npm `latest` and opens an issue on failure; `alpha`/`next`-tagged prereleases (for example `0.2.2-alpha.2`) are admitted but not monitored. `0.3.0` and later require an explicit update.
28
31
  - Cordis `4.0.5` requires Loader `~1.0.6` and Include `~1.0.10`; update the host's companion packages together rather than forcing Cordis onto older companions.
29
- - Direct Cordis loading also needs DSH `tools`, `commands`, and `systemPrompt` services and one shared `@deepseek-ai/schemastery@^3.18.1` installation. See [exact peer ranges](package.json) and the [standalone example](examples/README.md).
32
+ - Direct Cordis loading also needs DSH `tools`, `commands`, and `systemPrompt` services and one shared `@deepseek-ai/schemastery@^3.18.1` installation. See [peer ranges](package.json) and the [standalone example](examples/README.md).
30
33
 
31
34
  The plugin's version in [package.json](package.json) is independent of the DSH and dependency versions above.
32
35
 
@@ -34,12 +37,12 @@ The plugin's version in [package.json](package.json) is independent of the DSH a
34
37
 
35
38
  Use **`@evegoodevening/dsh-llmwiki`**. The unscoped `dsh-llmwiki` package belongs to a different project.
36
39
 
37
- From this checkout, pack and install `0.0.3` with a supported DSH host on `PATH` (`web` is the example profile):
40
+ From this checkout, pack and install `0.0.5` with a supported DSH host on `PATH` (`web` is the example profile):
38
41
 
39
42
  ```sh
40
43
  pnpm install --frozen-lockfile
41
44
  pnpm pack
42
- dsh plugin --profile web add ./evegoodevening-dsh-llmwiki-0.0.3.tgz
45
+ dsh plugin --profile web add ./evegoodevening-dsh-llmwiki-0.0.5.tgz
43
46
  ```
44
47
 
45
48
  When the package is available on npm, the equivalent registry command is `dsh plugin --profile web add @evegoodevening/dsh-llmwiki@latest`.
@@ -158,9 +161,9 @@ pnpm run smoke
158
161
 
159
162
  The Linux unit suite's read-only tmpfs test requires root and mount-namespace capability. E2E builds first and exercises packed packages across the supported host matrix; run it separately from other builds because it temporarily hides shared checkout paths. Ordinary smoke uses the development baseline below.
160
163
 
161
- The development baseline is DSH `0.2.1-rc.2`, Cordis `4.0.5`, Loader `1.0.6`, Schemastery `3.18.5`, and `node-addon-require-builtin` `0.1.9`. The root graph uses `dsh-ptc-runtime` instead of the retired `dsh-code-runtime` and no longer includes `dsh-invariants`. Supported legacy hosts and the independent agent-smoke runner remain unchanged. The fixed `0.2.1-rc.2` E2E row uses native host dependencies and a strict standalone consumer, independently of the rolling latest-version probes.
164
+ The development baseline is DSH `0.2.1-rc.5`, Cordis `4.0.5`, Loader `1.0.6`, Schemastery `3.18.5`, and `node-addon-require-builtin` `0.1.9`. The root graph uses `dsh-ptc-runtime` instead of the retired `dsh-code-runtime` and no longer includes `dsh-invariants`. Supported legacy hosts remain unchanged; the independent agent-smoke runner keeps its legacy DSH `0.1.1-rc.2` closure with security overrides only. The fixed `0.2.1-rc.2` and `0.2.1-rc.5` E2E rows use native host dependencies and a strict standalone consumer, independently of the rolling latest-version probes.
162
165
 
163
- - **Upstream compatibility:** `pnpm run check:compatibility` probes latest DSH with native dependencies and, separately, forced latest Cordis. Disposable hosts and consumers apply the repository's `@deepseek-ai/*` release-age exception so fresh vendor companions can resolve together; other dependency age settings are unchanged. Networked, model-free; probes do not automatically extend the support table. See the [scheduled workflow](.github/workflows/compatibility.yml).
166
+ - **Upstream compatibility:** `pnpm run check:compatibility` probes latest DSH with native dependencies and, separately, forced latest Cordis. Disposable hosts and consumers apply the repository's `@deepseek-ai/*` release-age exception so fresh vendor companions can resolve together; other dependency age settings are unchanged. Networked, model-free; new `0.2.x` releases are already admitted by the peer range, so this probe is the test that catches a breaking upstream change. See the [scheduled workflow](.github/workflows/compatibility.yml).
164
167
  - **Real-agent smoke:** set `DEEPSEEK_API_KEY`, `LLMWIKI_AGENT_SMOKE_MODEL`, and `LLMWIKI_AGENT_SMOKE_NETWORK=allow`, then run `pnpm run smoke:agent`. This separate, credentialed check uses a pinned DSH `0.1.1-rc.2` runner; offline checks do not prove model behavior.
165
168
  - **Publishing:** the [release workflow](.github/workflows/publish.yml) uses npm Trusted Publishing for a `v*` tag matching `package.json`.
166
169
 
package/README.zh.md CHANGED
@@ -16,7 +16,9 @@
16
16
 
17
17
  | DSH（`@deepseek-ai/dsh`） | Cordis（`@deepseek-ai/cordis`） | 状态 |
18
18
  | --- | --- | --- |
19
- | **`0.2.1-rc.2`** | **`4.0.5`** | **推荐** |
19
+ | **`0.2.1-rc.5`** | **`4.0.5`** | **推荐**（已测试） |
20
+ | 更新的 `0.2.x`（`>=0.2.1-rc.5 <0.3.0-0`） | 按宿主要求（当前为 `~4.0.5`） | 由版本范围接纳；未逐一测试 |
21
+ | `0.2.1-rc.2` | `4.0.5` | 支持 |
20
22
  | `0.2.0-rc.2` | `4.0.4` 或 `4.0.5` | 支持 |
21
23
  | `0.1.7-rc.2` | `4.0.4` | 支持 |
22
24
  | `0.1.1-rc.2` | `4.0.1` | 支持的旧版本 |
@@ -25,8 +27,9 @@
25
27
  - **Node.js：** `^22.23.4 || ^24.22.1 || >=26.12.1`。CI 固定使用 `24.22.1`；不支持更早的 24.x 和 23/25 系列。发布及打包探针使用 npm `12.2.1`，依赖管理仍使用下述 pnpm。
26
28
  - **pnpm：** `11.7.0`，执行 `dsh plugin` 和开发时需确保其位于 `PATH` 中。
27
29
  - 使用相互兼容的同一系列 DSH 服务，不要混用不同的候选发布版本。`0.1.0-rc.6` 宿主会将其五个 DSH 服务对等依赖解析为 `0.1.0-rc.8`；表中其他宿主使用与自身版本相同的服务。
30
+ - **对等依赖版本范围。** 旧宿主以精确版本列出；更新的 DSH `0.2.x` 版本（含预发布版本）由 `>=0.2.1-rc.5 <0.3.0-0` 接纳，无需更新本包。DSH 的插件准入检查和 pnpm 会在范围内匹配预发布版本。npm 使用严格的 semver：接受 `0.2.1` 及以上的正式 `0.2.x` 版本，但预发布版本只接受 `0.2.1-rc.5` 及之后的 `0.2.1-*`，因此 npm 消费者在 `0.2.2-rc.1` 这类新的预发布系列上会遇到 `ERESOLVE`。Cordis `4.0.2`/`4.0.3` 仍被排除。定时兼容性监控会测试 npm 上每个新的 `latest` 版本，失败时创建 issue；`alpha`/`next` 标签的预发布版本（例如 `0.2.2-alpha.2`）会被接纳，但不在监控范围内。`0.3.0` 及以上版本需要显式更新。
28
31
  - Cordis `4.0.5` 需要 Loader `~1.0.6` 和 Include `~1.0.10`；请一并更新宿主的配套依赖，不要将新版 Cordis 强行搭配旧版配套包。
29
- - 直接通过 Cordis 加载时，还需要 DSH 的 `tools`、`commands` 和 `systemPrompt` 服务，以及一份共享的 `@deepseek-ai/schemastery@^3.18.1` 安装。参见[准确的对等依赖版本范围](package.json)和[独立加载示例](examples/README.md)。
32
+ - 直接通过 Cordis 加载时，还需要 DSH 的 `tools`、`commands` 和 `systemPrompt` 服务，以及一份共享的 `@deepseek-ai/schemastery@^3.18.1` 安装。参见[对等依赖版本范围](package.json)和[独立加载示例](examples/README.md)。
30
33
 
31
34
  [package.json](package.json) 中的插件版本独立于上表中的 DSH 和依赖版本。
32
35
 
@@ -34,12 +37,12 @@
34
37
 
35
38
  请使用 **`@evegoodevening/dsh-llmwiki`**。不带作用域的 `dsh-llmwiki` 包属于另一个项目。
36
39
 
37
- 在当前检出的仓库中打包并安装 `0.0.3`，同时确保受支持的 DSH 宿主位于 `PATH` 中（以下以 `web` profile 为例）：
40
+ 在当前检出的仓库中打包并安装 `0.0.5`，同时确保受支持的 DSH 宿主位于 `PATH` 中（以下以 `web` profile 为例）：
38
41
 
39
42
  ```sh
40
43
  pnpm install --frozen-lockfile
41
44
  pnpm pack
42
- dsh plugin --profile web add ./evegoodevening-dsh-llmwiki-0.0.3.tgz
45
+ dsh plugin --profile web add ./evegoodevening-dsh-llmwiki-0.0.5.tgz
43
46
  ```
44
47
 
45
48
  当该包在 npm 上可用时，等效的仓库安装命令为 `dsh plugin --profile web add @evegoodevening/dsh-llmwiki@latest`。
@@ -158,9 +161,9 @@ pnpm run smoke
158
161
 
159
162
  Linux 单元测试套件中的只读 tmpfs 测试需要 root 权限和挂载命名空间能力。E2E 会先构建，再在受支持的宿主版本矩阵中测试打包后的包；请与其他构建分开运行，因为它会临时隐藏共享的仓库检出路径。常规 smoke 使用下述开发基线。
160
163
 
161
- 开发基线为 DSH `0.2.1-rc.2`、Cordis `4.0.5`、Loader `1.0.6`、Schemastery `3.18.5` 和 `node-addon-require-builtin` `0.1.9`。根依赖图使用 `dsh-ptc-runtime` 替代已退役的 `dsh-code-runtime`，不再包含 `dsh-invariants`。旧宿主支持和独立的 agent-smoke 运行器保持不变。固定的 `0.2.1-rc.2` E2E 用例使用宿主原生依赖和严格的独立消费者检查，与滚动的最新版探测相互独立。
164
+ 开发基线为 DSH `0.2.1-rc.5`、Cordis `4.0.5`、Loader `1.0.6`、Schemastery `3.18.5` 和 `node-addon-require-builtin` `0.1.9`。根依赖图使用 `dsh-ptc-runtime` 替代已退役的 `dsh-code-runtime`，不再包含 `dsh-invariants`。旧宿主支持保持不变；独立的 agent-smoke 运行器保留其旧版 DSH `0.1.1-rc.2` 依赖闭包，仅增加安全覆盖。固定的 `0.2.1-rc.2` 和 `0.2.1-rc.5` E2E 用例使用宿主原生依赖和严格的独立消费者检查，与滚动的最新版探测相互独立。
162
165
 
163
- - **上游兼容性：** `pnpm run check:compatibility` 分别检查使用原生依赖的最新版 DSH，以及强制使用最新版 Cordis 的情况。临时宿主和消费者项目沿用仓库的 `@deepseek-ai/*` 最低发布年龄例外，使新发布的配套包能够一起解析；其他依赖的发布年龄设置保持不变。此检查需要联网，但不调用模型；检查结果不会自动扩展支持表。参见[定时工作流](.github/workflows/compatibility.yml)。
166
+ - **上游兼容性：** `pnpm run check:compatibility` 分别检查使用原生依赖的最新版 DSH，以及强制使用最新版 Cordis 的情况。临时宿主和消费者项目沿用仓库的 `@deepseek-ai/*` 最低发布年龄例外，使新发布的配套包能够一起解析；其他依赖的发布年龄设置保持不变。此检查需要联网，但不调用模型；新的 `0.2.x` 版本已由对等依赖范围接纳，因此由该检查发现上游的破坏性变更。参见[定时工作流](.github/workflows/compatibility.yml)。
164
167
  - **真实智能体 smoke：** 设置 `DEEPSEEK_API_KEY`、`LLMWIKI_AGENT_SMOKE_MODEL` 和 `LLMWIKI_AGENT_SMOKE_NETWORK=allow`，然后运行 `pnpm run smoke:agent`。这项独立且需要凭据的检查使用固定的 DSH `0.1.1-rc.2` 运行器；离线检查不能证明模型行为。
165
168
  - **发布：** [发布工作流](.github/workflows/publish.yml)使用 npm Trusted Publishing，针对与 `package.json` 版本匹配的 `v*` 标签执行发布。
166
169
 
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@evegoodevening/dsh-llmwiki",
3
- "version": "0.0.3",
3
+ "version": "0.0.5",
4
4
  "description": "Third-party, local-first, source-linked Markdown wiki storage and retrieval plugin for DeepSeek Harness",
5
5
  "author": "EveGoodEvening",
6
6
  "license": "MIT",
@@ -58,30 +58,30 @@
58
58
  }
59
59
  },
60
60
  "peerDependencies": {
61
- "@deepseek-ai/cordis": "4.0.1 || 4.0.4 || 4.0.5",
62
- "@deepseek-ai/dsh-brand": "0.1.0-rc.6 || 0.1.0-rc.8 || 0.1.1-rc.2 || 0.1.7-rc.2 || 0.2.0-rc.2 || 0.2.1-rc.2",
63
- "@deepseek-ai/dsh-commands": "0.1.0-rc.6 || 0.1.0-rc.8 || 0.1.1-rc.2 || 0.1.7-rc.2 || 0.2.0-rc.2 || 0.2.1-rc.2",
64
- "@deepseek-ai/dsh-session": "0.1.0-rc.6 || 0.1.0-rc.8 || 0.1.1-rc.2 || 0.1.7-rc.2 || 0.2.0-rc.2 || 0.2.1-rc.2",
65
- "@deepseek-ai/dsh-system-prompt": "0.1.0-rc.6 || 0.1.0-rc.8 || 0.1.1-rc.2 || 0.1.7-rc.2 || 0.2.0-rc.2 || 0.2.1-rc.2",
66
- "@deepseek-ai/dsh-tools": "0.1.0-rc.6 || 0.1.0-rc.8 || 0.1.1-rc.2 || 0.1.7-rc.2 || 0.2.0-rc.2 || 0.2.1-rc.2",
61
+ "@deepseek-ai/cordis": "4.0.1 || >=4.0.4 <4.1.0-0",
62
+ "@deepseek-ai/dsh-brand": "0.1.0-rc.6 || 0.1.0-rc.8 || 0.1.1-rc.2 || 0.1.7-rc.2 || 0.2.0-rc.2 || 0.2.1-rc.2 || >=0.2.1-rc.5 <0.3.0-0",
63
+ "@deepseek-ai/dsh-commands": "0.1.0-rc.6 || 0.1.0-rc.8 || 0.1.1-rc.2 || 0.1.7-rc.2 || 0.2.0-rc.2 || 0.2.1-rc.2 || >=0.2.1-rc.5 <0.3.0-0",
64
+ "@deepseek-ai/dsh-session": "0.1.0-rc.6 || 0.1.0-rc.8 || 0.1.1-rc.2 || 0.1.7-rc.2 || 0.2.0-rc.2 || 0.2.1-rc.2 || >=0.2.1-rc.5 <0.3.0-0",
65
+ "@deepseek-ai/dsh-system-prompt": "0.1.0-rc.6 || 0.1.0-rc.8 || 0.1.1-rc.2 || 0.1.7-rc.2 || 0.2.0-rc.2 || 0.2.1-rc.2 || >=0.2.1-rc.5 <0.3.0-0",
66
+ "@deepseek-ai/dsh-tools": "0.1.0-rc.6 || 0.1.0-rc.8 || 0.1.1-rc.2 || 0.1.7-rc.2 || 0.2.0-rc.2 || 0.2.1-rc.2 || >=0.2.1-rc.5 <0.3.0-0",
67
67
  "@deepseek-ai/schemastery": "^3.18.1"
68
68
  },
69
69
  "devDependencies": {
70
70
  "@deepseek-ai/cordis": "4.0.5",
71
71
  "@deepseek-ai/cordis-plugin-loader": "1.0.6",
72
- "@deepseek-ai/dsh-agent": "0.2.1-rc.2",
73
- "@deepseek-ai/dsh-attachment": "0.2.1-rc.2",
74
- "@deepseek-ai/dsh-brand": "0.2.1-rc.2",
75
- "@deepseek-ai/dsh-commands": "0.2.1-rc.2",
76
- "@deepseek-ai/dsh-llm": "0.2.1-rc.2",
77
- "@deepseek-ai/dsh-ptc-runtime": "0.2.1-rc.2",
78
- "@deepseek-ai/dsh-scope": "0.2.1-rc.2",
79
- "@deepseek-ai/dsh-session": "0.2.1-rc.2",
80
- "@deepseek-ai/dsh-system-prompt": "0.2.1-rc.2",
81
- "@deepseek-ai/dsh-timeout": "0.2.1-rc.2",
82
- "@deepseek-ai/dsh-tools": "0.2.1-rc.2",
83
- "@deepseek-ai/dsh-typert-protocol": "0.2.1-rc.2",
84
- "@deepseek-ai/dsh-user-approval": "0.2.1-rc.2",
72
+ "@deepseek-ai/dsh-agent": "0.2.1-rc.5",
73
+ "@deepseek-ai/dsh-attachment": "0.2.1-rc.5",
74
+ "@deepseek-ai/dsh-brand": "0.2.1-rc.5",
75
+ "@deepseek-ai/dsh-commands": "0.2.1-rc.5",
76
+ "@deepseek-ai/dsh-llm": "0.2.1-rc.5",
77
+ "@deepseek-ai/dsh-ptc-runtime": "0.2.1-rc.5",
78
+ "@deepseek-ai/dsh-scope": "0.2.1-rc.5",
79
+ "@deepseek-ai/dsh-session": "0.2.1-rc.5",
80
+ "@deepseek-ai/dsh-system-prompt": "0.2.1-rc.5",
81
+ "@deepseek-ai/dsh-timeout": "0.2.1-rc.5",
82
+ "@deepseek-ai/dsh-tools": "0.2.1-rc.5",
83
+ "@deepseek-ai/dsh-typert-protocol": "0.2.1-rc.5",
84
+ "@deepseek-ai/dsh-user-approval": "0.2.1-rc.5",
85
85
  "@deepseek-ai/schemastery": "3.18.5",
86
86
  "@types/node": "22.20.0",
87
87
  "@typescript-eslint/eslint-plugin": "8.67.0",