@jayyuen66/dsh-quality-gate 0.1.3 → 0.1.4

package/docs/DETAIL.md

@@ -0,0 +1,24 @@
+# Quality gate
+
+Runs the project's own checks when a turn ends and hands the failure back to the model, so a turn does not close with a red gate.
+
+## What the card changes
+
+- **Gate** — `enabled` (on) off means the gate never runs and the model may close a broken turn. `maxInjectsPerTurn` (1–5, default 2) caps how many repair instructions one session receives across turns, which is the runaway brake. `gateBudgetMs` (10000–600000, default 300000, shown in seconds) is the whole-gate budget: exceeding it is injected as "could not run", never treated as a pass.
+- **Memory feedback** — `memoryFeedback` (off by default) writes failing-gate evidence to the memory gateway's L0 layer; lesson-bus reporting is unaffected by it. `memoryGatewayUrl` (empty) has no shipped default — with it empty the plugin falls back to the `TDAI_GATEWAY_URL` environment variable, and if both are empty the feedback is simply unconfigured. `memoryGatewayKeyRef` (default `TDAI_GATEWAY_KEY`) stores only the credential **name**; the secret lives in the host's credential service and never in settings. Clearing the field restores the default name rather than turning feedback off.
+
+These are read per turn, so a change applies on the next turn without restarting the host. Feedback reaches the gateway only when the switch is on, the URL resolves, and the credential service holds a value under the referenced name.
+
+## Restart-only values
+
+`maxRootDepth` (default 10, how far up a file's directory tree the plugin looks for the project root) and `gateStdoutMaxBytes` (65536) are deployment assumptions kept off the card. Set them in the `config:` block of this plugin's row in `cordis.patch.yml`; they take effect on restart.
+
+Also worth knowing: after a host restart the turn cursor resets to the fork point, so the first turn after a restart re-runs the gates.
+
+## What it needs from outside
+
+The gate commands are resolved per project root and never invented: `pnpm check` only when that root's `package.json` declares a `check` script, otherwise `cargo check`, `ruff check .` only with a `ruff.toml` or a `[tool.ruff]` section, otherwise `tsc --noEmit`. They run through the host sandbox, so `SANDBOX_UNAVAILABLE` means the command never ran rather than that it passed. Talking to a memory gateway needs a reachable URL and a credential under the referenced name.
+
+## Further detail
+
+The detection precedence and why a wrong pick looks like a false failure, the edit ledger and spill mechanics are in the package README (`README.md` / `README.zh-CN.md`).

package/docs/DETAIL.zh.md

@@ -0,0 +1,24 @@
+# 回合收口质量门禁
+
+回合结束时跑项目自己的检查，把失败证据交回模型，让回合不会带着红灯收口。
+
+## 设置卡上改的是什么
+
+- **门禁** — `enabled`（默认开）关掉后门禁完全不跑，模型可能带着坏检查收回合。`maxInjectsPerTurn`（1–5，默认 2）限制一个会话跨回合最多收到几次修复指令，这是防失控的闸。`gateBudgetMs`（10000–600000，默认 300000，卡上按秒显示）是整趟门禁的预算：超时按「未能执行」注入，绝不当成通过。
+- **记忆反馈** — `memoryFeedback`（默认关）开了才会把失败证据写进记忆网关的 L0 层；教训总线的上报不受这一位影响。`memoryGatewayUrl` 没有随包默认值：留空时回落到环境变量 `TDAI_GATEWAY_URL`，两者都空就是未配置，功能不跑。`memoryGatewayKeyRef`（默认 `TDAI_GATEWAY_KEY`）存的只是凭据**引用名**，密钥留在宿主凭据服务里，不进设置。清空这一格是恢复默认引用名，不是关掉反馈。
+
+这些值每回合现读，改完下一回合生效，不用重启宿主。反馈要真正送出去，需要开关打开、地址能解析出值，并且凭据服务里确实存着引用名指向的那份值。
+
+## 要重启的值
+
+`maxRootDepth`（默认 10，决定从被改文件往上找项目根的最深层数）与 `gateStdoutMaxBytes`（65536）属于部署假定值，刻意不进设置卡：写在本插件注册行的 `config:` 块，改值随重启生效。
+
+还有一条要提前知道：宿主重启后回合游标回到 fork 点，所以重启后的第一个回合会把门禁重跑一遍。
+
+## 需要外部提供什么
+
+门禁命令按项目根现场探测，绝不虚构：该根 `package.json` 声明了 `check` 脚本才用 `pnpm check`，否则依次试 `cargo check`、只有存在 `ruff.toml` 或 `[tool.ruff]` 时才用 `ruff check .`、再否则 `tsc --noEmit`。命令经宿主沙箱执行，所以 `SANDBOX_UNAVAILABLE` 说的是「根本没跑成」，不是「跑过了」。要连记忆网关还得有可达地址与被引用名指向的凭据。
+
+## 更完整的说明
+
+探测优先次序与它为什么会造成假失败、编辑台账与溢出落盘机制，都写在随包的 README（`README.md` / `README.zh-CN.md`）。

package/host.js

@@ -7,9 +7,10 @@ import Schema from "@deepseek-ai/schemastery";
 import { credentialRef, isCredentialRefName } from "@deepseek-ai/dsh-credentials";
 import { LOCALE_SETTINGS_NAMESPACE, messagesFor, resolveLocalePreference } from "@jayyuen66/dsh-plugin-shared/lib/locale";
 import { deriveProjectKey } from "@jayyuen66/dsh-plugin-shared/lib/project-key";
-import { editPathOf, scanToolEvents } from "@jayyuen66/dsh-plugin-shared/lib/tool-events";
+import { editPathOf, scanToolEvents, toolEventRowsOf } from "@jayyuen66/dsh-plugin-shared/lib/tool-events";
 import { settleLessonCall } from "@jayyuen66/dsh-plugin-shared/lib/lesson-bus";
 import { fieldOf, isRecord } from "@jayyuen66/dsh-plugin-shared/lib/record";
+import { z } from "zod";
 // lib/accumulator.ts
 /**
 * 需要过门禁的扩展名（代码与配置；md/txt/图片等免检）。
@@ -226,6 +227,9 @@ function buildFeedbackText({ command, root, failure }, messages) {
 	});
 }
 // lib/gateway-target.ts
+/** 基址末尾斜杠与 IPv4 单段。 */
+const TRAILING_SLASHES$1 = /\/+$/u;
+const IPV4_OCTET = /^\d{1,3}$/u;
 /** env 值 trim 后非空则用之，否则回到 fallback（保留原 `||` 语义，
 *  又以显式比较规避 prefer-nullish-coalescing 与 strict-boolean-expressions）。 */
 function envOr(key, fallback) {
@@ -247,7 +251,7 @@ function resolveGatewayUrl(settingUrl) {
 	const configured = settingUrl.trim();
 	const candidate = configured === "" ? envOr("TDAI_GATEWAY_URL", "") : configured;
 	if (candidate === "") return "";
-	const normalized = candidate.replace(/\/+$/u, "");
+	const normalized = candidate.replace(TRAILING_SLASHES$1, "");
 	let parsed;
 	try {
 		parsed = new URL(normalized);
@@ -261,7 +265,7 @@ function resolveGatewayUrl(settingUrl) {
 function isIpv4Loopback(host) {
 	const parts = host.split(".");
 	if (parts.length !== 4 || parts[0] !== "127") return false;
-	return parts.every((part) => /^\d{1,3}$/u.test(part) && Number(part) <= 255);
+	return parts.every((part) => IPV4_OCTET.test(part) && Number(part) <= 255);
 }
 /**
 * 凭据只允许发往 https 或回环地址：明文 http 到远端会把 Bearer 令牌暴露给同网段
@@ -292,7 +296,7 @@ function isCredentialSafeUrl(url) {
 /** `x-tdai-service-id` 的合法形状：网关侧按服务名路由，空白与控制字符会让请求头
 *  在 fetch 处直接抛 TypeError（undici 拒收含换行的头值），把一次投递变成一条异常。
 *  不合规的值一律回落到默认服务名，而不是把用户的笔误送上网关。 */
-const SERVICE_ID_RE = /^[A-Za-z0-9._-]{1,64}$/u;
+const SERVICE_ID_RE = /^[\w.-]{1,64}$/u;
 /** 默认服务名：网关协议的匿名服务名（不含任何机器信息）。 */
 const DEFAULT_SERVICE_ID = "default";
 /** x-tdai-service-id：env 可覆盖，形状不合规时回落默认值。 */
@@ -324,11 +328,13 @@ function deriveAgentId(cwd) {
 	return deriveProjectKey(cwd);
 }
 // lib/gateway-feedback.ts
+/** 基址末尾斜杠。 */
+const TRAILING_SLASHES = /\/+$/u;
 /** 反馈尽力而为：5s 封顶，超时/失败只 warn（不吃掉门禁主流程）。 */
 const FEEDBACK_TIMEOUT_MS = 5e3;
 /** 沉淀门禁失败到 L0 记忆（role=assistant：这是 agent 自身行为教训，归顺 assistant 提炼面）。 */
 async function pushGateFeedback(input, target, messages) {
-	const base = target.url.trim().replace(/\/+$/u, "");
+	const base = target.url.trim().replace(TRAILING_SLASHES, "");
 	if (base === "" || target.key.trim() === "") throw new Error("投递目标不完整：url 与 key 都必须非空（目标面应由调用方解析后传入）");
 	const agentId = deriveAgentId(input.cwd);
 	const content = buildFeedbackText(input, messages);
@@ -356,6 +362,91 @@ async function pushGateFeedback(input, target, messages) {
 		throw new Error(detail === "" ? `gateway feedback HTTP ${res.status}` : `gateway feedback HTTP ${res.status}：${detail}`, { cause: drained });
 	}
 }
+// lib/edit-ledger.ts
+/** 会话编辑台账投影：折叠与回退扫描共用 `toolEventRowsOf`，两处不会各自演化。 */
+const EDIT_LEDGER_KEY = "quality-gate.edit-ledger";
+/** 台账上限：超过即丢最旧的（门禁游标每回合推到末端；防的是从没跑成门禁的长会话）。 */
+const EDIT_LEDGER_MAX = 1024;
+const entrySchema = z.strictObject({
+	seq: z.int().nonnegative(),
+	callId: z.string(),
+	name: z.string(),
+	path: z.string(),
+	failed: z.boolean()
+});
+const editLedgerSchema = z.object({ edits: z.array(entrySchema) });
+/** 把最近一条同 callId 的记录标记为失败（tool/result 的 isError）；找不到就不动。 */
+function failEntry(state, callId) {
+	let index = -1;
+	for (let at = state.length - 1; at >= 0; at -= 1) if (state[at]?.callId === callId) {
+		index = at;
+		break;
+	}
+	return index < 0 ? state : state.map((entry, at) => at === index ? {
+		...entry,
+		failed: true
+	} : entry);
+}
+const editLedgerProjection = {
+	key: EDIT_LEDGER_KEY,
+	stateVersion: 1,
+	stateSchema: editLedgerSchema,
+	init: () => ({ edits: [] }),
+	apply: (state, event) => {
+		const { call, result } = toolEventRowsOf(event, event.seq);
+		let { edits } = state;
+		if (call !== void 0 && EDIT_TOOLS.has(call.name) && !call.badArguments) {
+			const target = editPathOf(call);
+			if (target.kind === "write") edits = [...edits, {
+				seq: call.seq,
+				callId: call.callId ?? "",
+				name: call.name,
+				path: target.path ?? "",
+				failed: false
+			}];
+		}
+		if (result !== void 0 && result.isError && result.callId !== void 0) edits = failEntry(edits, result.callId);
+		const bounded = edits.length > 1024 ? edits.slice(edits.length - EDIT_LEDGER_MAX) : edits;
+		return bounded === state.edits ? state : { edits: bounded };
+	}
+};
+// lib/edit-ledger-reader.ts
+const isDisposer = (value) => typeof value === "function";
+const isProjectionHandle = (value) => value !== null && typeof value === "object" && typeof value.stateOf === "function" && typeof value.dispose === "function";
+/** 把原始状态校验成台账：形状不合约定的持久行按「不可读」处理。 */
+function asLedger(raw) {
+	const parsed = editLedgerProjection.stateSchema.safeParse(raw);
+	return parsed.success ? parsed.data.edits : void 0;
+}
+/**
+* 注册投影并发布读口；失败（同步抛错或异步拒绝）只报告、不发布。
+* @param registry - 官方 sessionProjections 服务
+* @param face - 读口发布位与释放登记位
+*/
+async function mountEditLedgerReader(registry, face) {
+	let read;
+	let release;
+	try {
+		const ready = await registry.register(editLedgerProjection);
+		if (isDisposer(ready)) {
+			read = (session) => asLedger(registry.stateOf(session, EDIT_LEDGER_KEY));
+			release = ready;
+		} else if (isProjectionHandle(ready)) {
+			read = (session) => asLedger(ready.stateOf(session));
+			release = () => {
+				ready.dispose();
+			};
+		} else throw new TypeError("sessionProjections.register returned neither a disposer nor a handle");
+	} catch (error) {
+		face.onError(error);
+		return;
+	}
+	face.publish(read);
+	face.effect(() => () => {
+		face.publish(void 0);
+		release();
+	});
+}
 // host.ts
 /**
 * 常见项目根标记文件：向上找最近的含清单目录。
@@ -508,10 +599,12 @@ function gateCommandArgs(gate) {
 	正常安装不可达，而那一路由 126/127 报成未执行。 */
 	return [tscEntry(gate.root) ?? "tsc", "--noEmit"];
 }
+/** shell 里无需加引号的参数形状。 */
+const SHELL_SAFE_ARG = /^[\w./:=@+-]+$/u;
 /** 拼 shell 串：路径可能带空格，含空白或元字符的参数加单引号。
 *  导出只为直接测这段引号处理：tsc 入口是绝对路径，它所在目录未必没有空格。 */
 function shellArg(part) {
-	return /^[\w./:=@+-]+$/u.test(part) ? part : `'${part.replaceAll("'", `'\\''`)}'`;
+	return SHELL_SAFE_ARG.test(part) ? part : `'${part.replaceAll("'", `'\\''`)}'`;
 }
 /** 门禁命令的展示/执行串（与 gateCommandArgs 同源）。 */
 function gateCommandText(gate) {
@@ -643,16 +736,26 @@ function interruptedRunOutcome(messages, budgetMs, res) {
 	}
 	return outcome;
 }
+/** 门禁工具不可用的 stderr 措辞。 */
+const TOOL_UNAVAILABLE_TEXT = /command not found|not recognised|not recognized|permission denied|not executable/u;
 /**
-* 门禁工具本身不可用（exit 126/127 = 不可执行/未找到）→ not-run，并 warn 给运维。
-*
-* 环境问题非代码问题：走失败注入会让模型去"修"装不了的工具（配合配额环更糟）。
-* 但它同样是"没跑成的检查"，所以按 not-run 注入"请手动确认"，不再算作通过
-* ——没跑成 ≠ 通过。
+* exit 126/127 只有在 stderr 点名门禁命令自己的首 token 时才算「工具不可用」：
+* `pnpm check` 的脚本里缺命令 pnpm 同样回 127（`[ELIFECYCLE] Command failed with exit code 127`），
+* 混判会把项目自己的坏脚本当成环境问题放掉。判据按行：同一行既有「不可用」措辞又出现该 token。
+*/
+function gateToolUnavailable(gate, res) {
+	if (res.exitCode !== 126 && res.exitCode !== 127) return false;
+	const token = gate.command[0].toLowerCase();
+	return res.stderr.text.toLowerCase().split("\n").some((line) => line.includes(token) && TOOL_UNAVAILABLE_TEXT.test(line));
+}
+/**
+* 门禁工具本身不可用（exit 126/127 且 stderr 点名门禁命令）→ not-run，并 warn 给运维。
+* 环境问题非代码问题：失败注入会逼模型去修装不了的工具；但没跑成 ≠ 通过。
+* 脚本内部的 126/127 不走这支（见 gateToolUnavailable），按代码失败。
 */
 function unavailableToolOutcome(messages, gate, res, log) {
 	let outcome;
-	if (res.exitCode === 126 || res.exitCode === 127) {
+	if (gateToolUnavailable(gate, res)) {
 		log.warn(`[quality-gate] gate tool unavailable (exit ${res.exitCode}): ${gateCommandText(gate)} — reported as not-run, not as pass`);
 		const cause = res.exitCode === 127 ? messages.toolMissing : messages.toolNotExecutable;
 		outcome = {
@@ -763,8 +866,9 @@ function ruffConfiguredOf(root) {
 */
 async function resolveEventWindow(query, sessionId, lastSeq) {
 	let window;
+	let observation;
 	try {
-		const observation = await query.observeSession(sessionId, { projectionMode: "none" });
+		observation = await query.observeSession(sessionId, { projectionMode: "none" });
 		const forkCut = observation.inheritedEventCount ?? 0;
 		const from = Math.max(forkCut, lastSeq.get(sessionId) ?? forkCut);
 		if (isArrayDelivery(observation.events)) window = {
@@ -773,6 +877,8 @@ async function resolveEventWindow(query, sessionId, lastSeq) {
 		};
 	} catch {
 		window = void 0;
+	} finally {
+		observation?.[Symbol.dispose]();
 	}
 	return window;
 }
@@ -1000,14 +1106,26 @@ function isGateHost(value) {
 	return typeof get === "function" && typeof on === "function" && typeof effect === "function" && typeof inject === "function" && isRecord(fiber) && typeof fieldOf(settings, "describe") === "function" && typeof fieldOf(settings, "configure") === "function";
 }
 /**
-* 一个文件的最近清单根 → 实际要跑的根：workspace 根优先，**但只在外层真能产出门禁时**才升级。
+* 子包自己就产得出 `pnpm check`（自带 `pnpm-workspace.yaml` 且声明了 check）时，它就是离
+* 文件最近、又真能跑的那一层门禁；再上溯外层工作区只会把「改一个子包」放大成「跑整棵
+* workspace 的全套检查」——门禁的作用域应当止步于最近的 workspace 根。
+*/
+function hasPnpmCheckGate(root) {
+	return detectGate([root]).some((gate) => gate.command[0] === "pnpm");
+}
+/**
+* 一个文件的最近清单根 → 实际要跑的根：最近的 workspace 根优先，**但只在外层真能产出门禁时**才升级。
 *
 * 只判「上面有没有 pnpm-workspace.yaml」就升级是漏门禁的一条路：外层若是"有 workspace 清单、
 * 却没有 check 脚本也没有 tsconfig"的根，gate-detect 对它返回空表，子包本来有的
 * `npx tsc --noEmit` / `ruff check` 会被这次上溯抹掉，且没有任何输出。
+*
+* 反方向也一样：子包本身就是 workspace 根且能出门禁时不再上溯——否则「本仓自己的门禁」
+* 会被外层伞工作区的全套 `pnpm check` 顶掉，单仓改动要等着跑九个仓。
 */
 function rootForFile(useRoot, maxDepth) {
 	const inner = probeProjectRoot(useRoot);
+	if (hasPnpmCheckGate(inner)) return inner;
 	const upgraded = workspaceRootUpgrade(useRoot, maxDepth);
 	if (upgraded === useRoot) return inner;
 	const outer = probeProjectRoot(upgraded);
@@ -1138,6 +1256,26 @@ function accumulatorOf(rt, sessionId) {
 * Session.inheritedEventCount（0.1.2-rc.1 起公开只读）给出 fork 切点——首读下限
 * 取切点而非 0，父前缀天然跳过；缺属性退回 0（旧行为，保守不漏门禁）。
 */
+/**
+* 只用投影台账记本回合编辑。返回 false = 走不了投影（读口缺席、fork 会话、读数不可信、
+* 或会话交不出日志长度），调用方回退观察面。
+*
+* fork 会话（isSeeded）不进这条路：继承前缀的精确长度只有观察面的 `inheritedEventCount`
+* 给得出，投影的 `apply` 看不到那条边界。读口交回 undefined 同样回退，且**不推游标**——
+* 把一次不可读当成「没有编辑」会静默跳过本回合的门禁。
+*/
+function noteLedgerEdits(rt, session, note) {
+	const reader = rt.editLedger.value;
+	const directSeq = session.seq;
+	if (reader === void 0 || session.header.isSeeded || typeof directSeq !== "number") return false;
+	const ledger = reader(session);
+	if (ledger === void 0) return false;
+	const from = rt.lastSeqBySession.get(session.id) ?? 0;
+	for (const entry of ledger) if (entry.seq >= from && !entry.failed) note(entry.name, entry.path === "" ? void 0 : entry.path);
+	rt.lastSeqBySession.set(session.id, directSeq);
+	pruneToSessionBudget(rt.lastSeqBySession, session.id);
+	return true;
+}
 async function readEditedFiles(rt, agent, acc) {
 	const { session } = agent;
 	const sessionId = session.id;
@@ -1149,6 +1287,13 @@ async function readEditedFiles(rt, agent, acc) {
 		}
 		return;
 	}
+	const { cwd } = session.header;
+	const note = (name, pathValue) => {
+		let resolvedPath = pathValue;
+		if (resolvedPath !== void 0 && cwd !== void 0 && !path.isAbsolute(resolvedPath)) resolvedPath = path.resolve(cwd, resolvedPath);
+		acc.note(name, resolvedPath);
+	};
+	if (noteLedgerEdits(rt, session, note)) return;
 	const window = await resolveEventWindow(query, sessionId, rt.lastSeqBySession);
 	if (window === void 0) {
 		if (!rt.queryReadWarned) {
@@ -1160,12 +1305,6 @@ async function readEditedFiles(rt, agent, acc) {
 	rt.lastSeqBySession.set(sessionId, window.from + window.events.length);
 	pruneToSessionBudget(rt.lastSeqBySession, sessionId);
 	const edits = collectEdits(window.events);
-	const { cwd } = session.header;
-	const note = (name, pathValue) => {
-		let resolvedPath = pathValue;
-		if (resolvedPath !== void 0 && cwd !== void 0 && !path.isAbsolute(resolvedPath)) resolvedPath = path.resolve(cwd, resolvedPath);
-		acc.note(name, resolvedPath);
-	};
 	for (const entry of edits.noCallId) note(entry.name, entry.path);
 	for (const [callId, entry] of edits.pending) if (!edits.failed.has(callId)) note(entry.name, entry.path);
 }
@@ -1398,8 +1537,20 @@ function apply(ctx, config) {
 		shellWarned: false,
 		queryMissingWarned: false,
 		queryReadWarned: false,
+		editLedger: { value: void 0 },
 		disposed: false
 	};
+	svc.inject(["sessionProjections"], (child) => {
+		mountEditLedgerReader(child.sessionProjections, {
+			publish: (reader) => {
+				rt.editLedger.value = reader;
+			},
+			effect: (factory) => child.effect(factory),
+			onError: (error) => {
+				log.warn(`[quality-gate] sessionProjections register failed, falling back to full scan: ${String(error)}`);
+			}
+		});
+	});
 	svc.on("agent/turn-stopping", async (payload) => {
 		try {
 			await handleTurnGate(rt, payload);

package/locale/en.json

@@ -0,0 +1,7 @@
+{
+  "meta": {
+    "title": "Quality gate",
+    "description": "Runs the project's own checks when a turn ends and feeds failures back to the model, so a turn does not close with a red gate.",
+    "detail": "docs/DETAIL.md"
+  }
+}

package/locale/zh.json

@@ -0,0 +1,7 @@
+{
+  "meta": {
+    "title": "回合收口质量门禁",
+    "description": "回合结束时按项目形态跑它自己的门禁命令，失败证据回灌给模型，不让回合带着红灯收尾。",
+    "detail": "docs/DETAIL.zh.md"
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jayyuen66/dsh-quality-gate",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "dsh 插件：回合收口质量门禁（在 agent/turn-stopping 按项目形态跑 pnpm check / cargo check / ruff check / tsc，未过则注入修复指令开新轮）",
   "keywords": [
     "ci",
@@ -21,6 +21,9 @@
     "host.js",
     "client.js",
     "cordis.patch.yml",
+    "locale/zh.json",
+    "locale/en.json",
+    "docs",
     "README.md",
     "README.zh-CN.md",
     "CHANGELOG.md",
@@ -32,6 +35,7 @@
     ".": "./host.js",
     "./client": "./client.js",
     "./cordis.patch.yml": "./cordis.patch.yml",
+    "./locale/*.json": "./locale/*.json",
     "./package.json": "./package.json"
   },
   "publishConfig": {
@@ -39,40 +43,44 @@
     "registry": "https://registry.npmjs.org"
   },
   "dependencies": {
-    "@jayyuen66/dsh-plugin-shared": "0.1.9",
-    "typescript": "7.0.2"
+    "@jayyuen66/dsh-plugin-shared": "0.2.1",
+    "typescript": "7.0.2",
+    "zod": "4.6.7"
   },
   "devDependencies": {
-    "@deepseek-ai/cordis": "4.0.5",
-    "@deepseek-ai/dsh-agent": "0.2.1-rc.3",
-    "@deepseek-ai/dsh-api-remotes": "0.2.1-rc.3",
-    "@deepseek-ai/dsh-client-locale": "0.2.1-rc.3",
-    "@deepseek-ai/dsh-client-store": "0.2.1-rc.3",
-    "@deepseek-ai/dsh-client-ui-layout": "0.2.1-rc.3",
-    "@deepseek-ai/dsh-client-ui-plugin-manager": "0.2.1-rc.3",
-    "@deepseek-ai/dsh-client-ui-renderer": "0.2.1-rc.3",
-    "@deepseek-ai/dsh-client-ui-settings": "0.2.1-rc.3",
-    "@deepseek-ai/dsh-client-ui-slots": "0.2.1-rc.3",
-    "@deepseek-ai/dsh-credentials": "0.2.1-rc.3",
-    "@deepseek-ai/dsh-llm": "0.2.1-rc.3",
-    "@deepseek-ai/dsh-package-manifest": "0.2.1-rc.3",
-    "@deepseek-ai/dsh-sandbox": "0.2.1-rc.3",
-    "@deepseek-ai/dsh-sandbox-policy": "0.2.1-rc.3",
-    "@deepseek-ai/dsh-scope": "0.2.1-rc.3",
-    "@deepseek-ai/dsh-session": "0.2.1-rc.3",
-    "@deepseek-ai/dsh-session-projection": "0.2.1-rc.3",
-    "@deepseek-ai/dsh-session-query": "0.2.1-rc.3",
-    "@deepseek-ai/dsh-session-title": "0.2.1-rc.3",
-    "@deepseek-ai/dsh-settings": "0.2.1-rc.3",
-    "@deepseek-ai/dsh-shell": "0.2.1-rc.3",
-    "@deepseek-ai/dsh-subprocess": "0.2.1-rc.3",
-    "@deepseek-ai/schemastery": "3.18.5",
-    "@types/node": "26.6.5",
+    "@deepseek-ai/cordis": "4.0.6-alpha.1",
+    "@deepseek-ai/dsh-agent": "0.2.2-alpha.2",
+    "@deepseek-ai/dsh-api-remotes": "0.2.2-alpha.2",
+    "@deepseek-ai/dsh-client-locale": "0.2.2-alpha.2",
+    "@deepseek-ai/dsh-client-store": "0.2.2-alpha.2",
+    "@deepseek-ai/dsh-client-ui-layout": "0.2.2-alpha.2",
+    "@deepseek-ai/dsh-client-ui-plugin-manager": "0.2.2-alpha.2",
+    "@deepseek-ai/dsh-client-ui-renderer": "0.2.2-alpha.2",
+    "@deepseek-ai/dsh-client-ui-settings": "0.2.2-alpha.2",
+    "@deepseek-ai/dsh-client-ui-slots": "0.2.2-alpha.2",
+    "@deepseek-ai/dsh-credentials": "0.2.2-alpha.2",
+    "@deepseek-ai/dsh-llm": "0.2.2-alpha.2",
+    "@deepseek-ai/dsh-package-manifest": "0.2.2-alpha.2",
+    "@deepseek-ai/dsh-sandbox": "0.2.2-alpha.2",
+    "@deepseek-ai/dsh-sandbox-policy": "0.2.2-alpha.2",
+    "@deepseek-ai/dsh-scope": "0.2.2-alpha.2",
+    "@deepseek-ai/dsh-session": "0.2.2-alpha.2",
+    "@deepseek-ai/dsh-session-projection": "0.2.2-alpha.2",
+    "@deepseek-ai/dsh-session-query": "0.2.2-alpha.2",
+    "@deepseek-ai/dsh-session-title": "0.2.2-alpha.2",
+    "@deepseek-ai/dsh-settings": "0.2.2-alpha.2",
+    "@deepseek-ai/dsh-shell": "0.2.2-alpha.2",
+    "@deepseek-ai/dsh-subprocess": "0.2.2-alpha.2",
+    "@deepseek-ai/schemastery": "3.18.6-alpha.1",
+    "@e18e/eslint-plugin": "0.8.1",
+    "@types/node": "26.6.6",
     "@types/react": "19.3.0",
     "@vitest/coverage-v8": "5.0.5",
+    "eslint-plugin-regexp": "3.3.2",
     "eslint-plugin-sonarjs": "4.2.2",
-    "oxfmt": "0.74.0",
-    "oxlint": "1.89.0",
+    "eslint-plugin-zod": "5.2.2",
+    "oxfmt": "0.75.0",
+    "oxlint": "1.90.0",
     "oxlint-tsgolint": "7.0.2005",
     "react": "^19.3.0",
     "rolldown": "1.2.15",
@@ -82,8 +90,8 @@
   },
   "peerDependencies": {
     "@deepseek-ai/dsh": "^0.2.1-rc.3",
-    "@deepseek-ai/dsh-credentials": "0.2.1-rc.3",
-    "@deepseek-ai/schemastery": "3.18.5"
+    "@deepseek-ai/dsh-credentials": "^0.2.1-rc.3",
+    "@deepseek-ai/schemastery": "3.18.6-alpha.1"
   },
   "peerDependenciesMeta": {
     "@deepseek-ai/dsh": {