@kenz1117/dsh-ui-usage-billing 0.9.19 → 0.9.20

package/lib/index.js

@@ -1,7 +1,7 @@
 import { createRequire } from "node:module";
-import { readFile, stat } from "node:fs/promises";
+import { mkdir, readFile, stat } from "node:fs/promises";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 import { defineTool } from "@deepseek-ai/dsh-tools";
 import { withFileLock, writeFileAtomic } from "@deepseek-ai/dsh-atomic-write";
 import { credentialRef } from "@deepseek-ai/dsh-credentials";
@@ -184,7 +184,7 @@ let liveExtraModels;
 * @param pricing - the `/api/billing/pricing` response.
 */
 function applyLivePricing(pricing) {
-	liveRate = pricing.rate;
+	liveRate = typeof pricing.rate === "number" && Number.isFinite(pricing.rate) && pricing.rate > 0 ? pricing.rate : void 0;
 	livePrices = pricing.prices;
 	liveExtraModels = pricing.extraModels;
 }
@@ -742,7 +742,10 @@ const MODEL_KEY_ALIASES = {
 	"step-3.7-flash": "step",
 	"seed-2.0-mini": "doubao-mini",
 	"k3": "kimi-k3",
-	"kimi-k3": "kimi-k3"
+	"kimi-k3": "kimi-k3",
+	"minimax-m1": "minimax",
+	"minimax-m2": "minimax",
+	"minimax-m3": "minimax"
 };
 /**
 * 模型 id 归一化：小写、去括号附注（如 `gpt5.6 luna(go)` 只看主体）、再去所有
@@ -892,7 +895,7 @@ function computeCost(entry, buckets, peakShare = DEFAULT_PEAK_SHARE) {
 * @param buckets - token usage counts.
 * @param timeMs - the call's wall-clock time (epoch ms); null falls back to the peak-share mix.
 * @param peakShare - fallback mix used only when `timeMs` is missing.
-* @returns the estimated cost in the entry's native currency.
+* @returns the estimated cost in CNY（USD 计价模型已按当前汇率折算）。
 */
 function computeCostAt(entry, buckets, timeMs, peakShare = DEFAULT_PEAK_SHARE) {
 	if (entry.price.offPeak === void 0) return priceBandCost(entry.price, buckets, entry.price.currency);
@@ -1457,11 +1460,12 @@ function createUsageAggregator(persistence, options = {}) {
 			console.warn("[usage-billing] failed to load durable usage ledger; rebuilding from current sessions:", error);
 		}
 	};
-	/** 失效键：日志文件的 mtime+size；拿不到（后端无 locate / 文件丢失）时每次重折。 */
+	/** 失效键：日志文件的 mtime+size；拿不到（后端无 locate / 文件丢失 / locate 抛错）时返回 null，
+	*  让调用方每次重折。locate 调用也纳入 try，避免单个会话的 locate 异常把整份聚合拖垮。 */
 	const stampOf = async (meta) => {
-		const location = persistence.locate?.(meta);
-		if (location === void 0) return null;
 		try {
+			const location = persistence.locate?.(meta);
+			if (location === void 0) return null;
 			const info = await stat(location.path);
 			return `${String(info.mtimeMs)}:${String(info.size)}`;
 		} catch {
@@ -2081,9 +2085,20 @@ const QUERIERS = [
 * @returns the balance rows (one per provider).
 */
 async function queryBalances(ctx, providers) {
-	return await Promise.all(QUERIERS.map(({ route, querier, displayName }) => {
+	const byName = /* @__PURE__ */ new Map();
+	for (const { route, querier, displayName } of QUERIERS) {
 		const env = providers[route]?.apiKeyEnv;
-		if (typeof env !== "string" || env === "") return Promise.resolve({
+		const configured = typeof env === "string" && env !== "";
+		const existing = byName.get(displayName);
+		if (existing !== void 0 && existing.env !== void 0) continue;
+		byName.set(displayName, {
+			displayName,
+			querier,
+			env: configured ? env : void 0
+		});
+	}
+	return await Promise.all([...byName.values()].map(({ querier, displayName, env }) => {
+		if (env === void 0) return Promise.resolve({
 			provider: displayName,
 			displayName,
 			error: "unconfigured"
@@ -3213,15 +3228,16 @@ async function collectZai(keys, config, timeoutMs) {
 function goWindow(value, kind) {
 	if (value === null || typeof value !== "object") return null;
 	const record = value;
-	const percentSource = record.usagePercent ?? record.usedPercent ?? record.percentUsed ?? record.percentage ?? record.percent;
-	let usedPercent = clampPercent$1(numberOrNull$1(percentSource));
+	const ratioSource = record.usagePercent ?? record.usedPercent ?? record.percentUsed ?? record.percentage;
+	const fromRatioField = ratioSource !== void 0 && ratioSource !== null;
+	let usedPercent = clampPercent$1(numberOrNull$1(fromRatioField ? ratioSource : record.percent));
 	if (usedPercent === null) {
 		const used = numberOrNull$1(record.used ?? record.consumed);
 		const limit = numberOrNull$1(record.limit ?? record.total ?? record.quota);
 		if (used !== null && limit !== null && limit > 0) usedPercent = clampPercent$1(used / limit * 100);
 	}
 	if (usedPercent === null) return null;
-	if (usedPercent <= 1 && usedPercent >= 0 && record.percent === void 0 && percentSource !== void 0) usedPercent *= 100;
+	if (fromRatioField && usedPercent <= 1 && usedPercent >= 0) usedPercent *= 100;
 	const resetSeconds = numberOrNull$1(record.resetInSec ?? record.resetInSeconds ?? record.resetSeconds);
 	const resetsAt = resetSeconds === null ? toIso(record.resetAt ?? record.resetsAt ?? record.nextReset) : new Date(Date.now() + Math.max(0, resetSeconds) * 1e3).toISOString();
 	return {
@@ -3329,6 +3345,18 @@ function resolveMiniMaxBaseUrl(config) {
 function minmaxDisplayName(provider) {
 	return SUBSCRIPTION_DISPLAY_NAMES[provider] ?? "MiniMax Coding Plan";
 }
+/** MiniMax Token Plan / Coding Plan 的 key 判别：普通按量 API key 以 `sk-` 开头，
+*  Token Plan（订阅套餐）key 以 `sk-cp-` 开头。据此区分一个 key 是订阅还是按量，
+*  供查询失败时给出「key 类型 / region」定向提示，避免把按量 key 误当 token-plan
+*  查询后只剩一句笼统的「响应异常」。 */
+function isMiniMaxTokenPlanKey(apiKey) {
+	return apiKey.startsWith("sk-cp-");
+}
+/** 构造 MiniMax Token Plan 查询端点：避免 base 已含 `/v1` 时拼出 `/v1/v1/...`。 */
+function miniMaxEndpoint(base) {
+	const trimmed = base.replace(/\/+$/, "");
+	return trimmed.endsWith("/v1") ? `${trimmed}/token_plan/remains` : `${trimmed}/v1/token_plan/remains`;
+}
 /** Collect the MiniMax Token Plan quota (CN + INTL). */
 async function collectMiniMax(keys, config, timeoutMs) {
 	const apiKey = keys.minmaxApiKey.trim();
@@ -3340,16 +3368,25 @@ async function collectMiniMax(keys, config, timeoutMs) {
 		status: "not-configured",
 		windows: []
 	};
+	const tokenPlanKey = isMiniMaxTokenPlanKey(apiKey);
 	try {
-		const windows = parseMiniMaxRemains(await requestJson(`${base}/v1/token_plan/remains`, { headers: {
+		const windows = parseMiniMaxRemains(await requestJson(miniMaxEndpoint(base), { headers: {
 			authorization: `Bearer ${apiKey}`,
 			accept: "application/json"
 		} }, timeoutMs));
+		if (windows.length > 0) return {
+			provider: config.provider,
+			displayName,
+			status: "ok",
+			windows,
+			...tokenPlanKey ? {} : { hint: "此 key 未以 sk-cp- 开头（可能为按量 API）；但 Token Plan 接口返回了额度，故按 Token Plan 展示" }
+		};
 		return {
 			provider: config.provider,
 			displayName,
-			status: windows.length > 0 ? "ok" : "invalid-response",
-			windows
+			status: "invalid-response",
+			windows,
+			hint: tokenPlanKey ? "Token Plan key 未返回额度：可能是 region 不匹配，请在 provider 的 baseURL 指向国内 api.minimaxi.com 或国际 api.minimax.io" : "此 key 未以 sk-cp- 开头，可能为按量 API 而非 Token Plan；如需订阅额度请用 sk-cp- 开头的 Token Plan key"
 		};
 	} catch (error) {
 		return {
@@ -3628,6 +3665,19 @@ function endpointOf(baseURL, path) {
 	return new URL(path, baseURL).toString();
 }
 /**
+* 用已知程序类型查询该路由的额度（用当前 key）。额度按 key 独立，因此即便
+* 指纹缓存已识别出站点类型，也仍要实际发一次请求读出本 key 的余额/窗口。
+* @param baseURL - 站点端点。
+* @param apiKey - 已解析的本路由 key。
+* @param kind - 已识别出的程序类型。
+* @returns 解析出的余额/窗口；取不到时返回 null（漂移或端点不可用）。
+*/
+async function readRelayByKind(baseURL, apiKey, kind) {
+	const res = await fetchRelayJson(endpointOf(baseURL, kind === "sub2api" ? "/v1/usage" : "/api/status"), apiKey);
+	if (!res.ok) return null;
+	return kind === "sub2api" ? parseSub2ApiUsage(res.data) : parseNewApiStatus(res.data);
+}
+/**
 * 查询单个中转站路由的额度。先试 Sub2API，再试 New API；任一读出额度即返回。
 * @param ctx - host context carrying the credentials seam.
 * @param route - 待探测的路由（baseURL + apiKeyEnv）。
@@ -3645,19 +3695,43 @@ async function queryRelayQuota(ctx, route) {
 		kind: "unknown",
 		status: "unavailable"
 	};
-	const hit = await ctx.credentials.resolve(credentialRef(route.apiKeyEnv));
+	let hit;
+	try {
+		hit = await ctx.credentials.resolve(credentialRef(route.apiKeyEnv));
+	} catch {
+		return {
+			...base,
+			kind: "unknown",
+			status: "not-configured"
+		};
+	}
 	if (hit === void 0 || hit.value === "") return {
 		...base,
 		kind: "unknown",
 		status: "not-configured"
 	};
 	const cached = fingerprintCache.get(base.origin);
-	if (cached !== void 0 && Date.now() - cached.at < FINGERPRINT_TTL_MS) return {
-		...base,
-		kind: cached.kind,
-		status: "ok"
-	};
+	const knownKind = cached !== void 0 && Date.now() - cached.at < FINGERPRINT_TTL_MS ? cached.kind : void 0;
 	try {
+		if (knownKind === "sub2api" || knownKind === "new-api") {
+			const parsed = await readRelayByKind(route.baseURL, hit.value, knownKind);
+			if (parsed !== null) {
+				relayGate.success(gateKey);
+				return {
+					...base,
+					kind: knownKind,
+					status: "ok",
+					...parsed.balance !== void 0 ? { balance: parsed.balance } : {},
+					...parsed.windows !== void 0 ? { windows: parsed.windows } : {}
+				};
+			}
+			relayGate.fail(gateKey);
+			return {
+				...base,
+				kind: knownKind,
+				status: "invalid-response"
+			};
+		}
 		const sub2 = await fetchRelayJson(endpointOf(route.baseURL, "/v1/usage"), hit.value);
 		if (sub2.ok) {
 			const parsed = parseSub2ApiUsage(sub2.data);
@@ -3682,23 +3756,7 @@ async function queryRelayQuota(ctx, route) {
 				status: "invalid-response"
 			};
 		}
-		if (sub2.status === 401 || sub2.status === 403) {
-			relayGate.fail(gateKey);
-			return {
-				...base,
-				kind: "unknown",
-				status: "unauthorized"
-			};
-		}
 		const na = await fetchRelayJson(endpointOf(route.baseURL, "/api/status"), hit.value);
-		if (na.status === 401 || na.status === 403) {
-			relayGate.fail(gateKey);
-			return {
-				...base,
-				kind: "unknown",
-				status: "unauthorized"
-			};
-		}
 		if (na.ok) {
 			const parsed = parseNewApiStatus(na.data);
 			if (parsed !== null) {
@@ -3728,11 +3786,12 @@ async function queryRelayQuota(ctx, route) {
 			status: "unavailable"
 		};
 	} catch (error) {
-		relayGate.fail(gateKey);
+		const status = statusOf(error);
+		if (status !== "unauthorized") relayGate.fail(gateKey);
 		return {
 			...base,
 			kind: "unknown",
-			status: statusOf(error)
+			status
 		};
 	}
 }
@@ -3779,12 +3838,26 @@ function isLoopbackPeer(req) {
 	if (address === void 0) return false;
 	return address === "::1" || address.startsWith("127.") || address.startsWith("::ffff:127.");
 }
-/** 校验 Host 头是本机回环（127.x / ::1 / localhost 或空，供 curl 不带 Host 的极简请求）。 */
+/** 校验 Host 头是本机回环（精确 127.0.0.0/8 / ::1 / localhost 或空，供 curl 不带 Host 的极简请求）。
+*  拒绝 `127.0.0.1.attacker.com` 这类以 `127.` 开头但解析到外部的 DNS rebinding 域名：
+*  只用 `startsWith('127.')` 会被它穿透，必须精确匹配回环 IP 的字面量。 */
 function isLoopbackHost(req) {
 	const host = req.headers.host;
 	if (host === void 0 || host === "") return true;
 	const name = host.split(":")[0];
-	return name === "localhost" || name === "::1" || name !== void 0 && name.startsWith("127.");
+	return name === "localhost" || name === "::1" || name !== void 0 && /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(name);
+}
+/** 校验 Origin 头是否回环（写操作用，防止跨站表单/fetch 改写设置）。Origin 缺失
+*  （curl 或同源 fetch 不带）视为放行，交给下方的 Content-Type 校验兜底；Origin 存在
+*  但主机非回环则拒绝——跨站脚本发起的写请求必带攻击者域名的 Origin。 */
+function isLoopbackOrigin(origin) {
+	if (origin === void 0 || origin === "") return true;
+	try {
+		const host = new URL(origin).hostname;
+		return host === "localhost" || host === "::1" || /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(host);
+	} catch {
+		return false;
+	}
 }
 /**
 * 回环防护守卫：仅接受回环 GET 请求（peer socket 地址 + Host 头同时校验）。
@@ -3849,6 +3922,10 @@ function createFileUsageLedgerStore(ledgerPath) {
 			} catch {}
 		},
 		async save(document) {
+			await mkdir(dirname(ledgerPath), {
+				recursive: true,
+				mode: 448
+			});
 			await withFileLock(ledgerPath, async () => {
 				try {
 					const existing = await readFile(ledgerPath, "utf8");
@@ -4296,7 +4373,11 @@ function apply(ctx, config = {}) {
 			res.writeHead(200, { "content-type": "application/json; charset=utf-8" });
 			const piProviders = await readPiAiProviders(ctx.settings);
 			const providers = { ...piProviders };
-			if (providers["deepseek"] === void 0) providers["deepseek"] = { apiKeyEnv: config.balanceApiKeyEnv ?? DEFAULT_BALANCE_API_KEY_ENV };
+			const deepseekKey = providers["deepseek"]?.apiKeyEnv;
+			if (deepseekKey === void 0 || deepseekKey === "") providers["deepseek"] = {
+				...providers["deepseek"],
+				apiKeyEnv: config.balanceApiKeyEnv ?? DEFAULT_BALANCE_API_KEY_ENV
+			};
 			const balances = await queryBalances(ctx, providers);
 			const custom = await queryCustomBalances(ctx, config.customBalances ?? []);
 			const declared = await queryDeclaredEndpoints(ctx, piProviders, config.declaredEndpoints ?? []);
@@ -4348,9 +4429,25 @@ function apply(ctx, config = {}) {
 				res.end(JSON.stringify({ error: "method not allowed" }));
 				return;
 			}
+			if (!isLoopbackOrigin(req.headers.origin)) {
+				res.writeHead(403, { "content-type": "application/json; charset=utf-8" });
+				res.end(JSON.stringify({ error: "forbidden: loopback only" }));
+				return;
+			}
+			if (!(req.headers["content-type"] ?? "").toLowerCase().includes("application/json")) {
+				res.writeHead(415, { "content-type": "application/json; charset=utf-8" });
+				res.end(JSON.stringify({ error: "unsupported content-type" }));
+				return;
+			}
 			try {
 				let body = "";
-				for await (const chunk of req) body += String(chunk);
+				for await (const chunk of req) {
+					body += String(chunk);
+					if (body.length > 512) {
+						res.end(JSON.stringify({ error: "body too large" }));
+						return;
+					}
+				}
 				const parsed = JSON.parse(body === "" ? "{}" : body);
 				if (usageSettingsScope === void 0) {
 					res.end(JSON.stringify({ error: "settings unavailable" }));
@@ -4373,10 +4470,15 @@ function apply(ctx, config = {}) {
 	};
 	const refreshQuotas = async () => {
 		const { keys, identified } = await resolveSubscriptionKeys(ctx.settings, ctx.credentials);
-		const rows = [...await collectSubscriptions(keys, identified.filter((item) => item.adapter).map((item) => ({
-			provider: item.provider,
-			...item.region === void 0 ? {} : { region: item.region }
-		})))].map((row) => {
+		const piProviders = await readPiAiProviders(ctx.settings);
+		const rows = [...await collectSubscriptions(keys, identified.filter((item) => item.adapter).map((item) => {
+			const baseURL = piProviders[item.provider]?.baseURL;
+			return {
+				provider: item.provider,
+				...item.region === void 0 ? {} : { region: item.region },
+				...typeof baseURL === "string" && baseURL !== "" ? { baseUrl: baseURL } : {}
+			};
+		}))].map((row) => {
 			const planType = planTypeOf(row.provider);
 			const subscriptionAmount = subscriptionFeeCnyOf(row.provider, live.rate);
 			return {
@@ -4404,7 +4506,11 @@ function apply(ctx, config = {}) {
 		handler: async (req, res) => {
 			if (!guardLoopback(req, res)) return;
 			res.writeHead(200, { "content-type": "application/json; charset=utf-8" });
-			if (Date.now() - quotaCache.at >= SUBSCRIPTION_CACHE_MS) await refreshQuotas();
+			if (Date.now() - quotaCache.at >= SUBSCRIPTION_CACHE_MS) try {
+				await refreshQuotas();
+			} catch (error) {
+				console.warn("[usage-billing] refreshQuotas failed; serving cached quotas:", error);
+			}
 			res.end(JSON.stringify({ quotas: quotaCache.quotas }));
 		}
 	}), "usage-billing: subscriptions route");
@@ -4436,7 +4542,11 @@ function apply(ctx, config = {}) {
 		handler: async (req, res) => {
 			if (!guardLoopback(req, res)) return;
 			res.writeHead(200, { "content-type": "application/json; charset=utf-8" });
-			if (Date.now() - relayCache.at >= SUBSCRIPTION_CACHE_MS) await refreshRelay();
+			if (Date.now() - relayCache.at >= SUBSCRIPTION_CACHE_MS) try {
+				await refreshRelay();
+			} catch (error) {
+				console.warn("[usage-billing] refreshRelay failed; serving cached relay quotas:", error);
+			}
 			const diagnostics = relayCache.quotas.map((row) => ({
 				route: row.route,
 				origin: row.origin,

package/lib/types/client/TokenPanel.d.ts

@@ -6,7 +6,6 @@
  *  3. Token 结构 KPI（缓存命中率 / reasoning 占比 / 输入:输出比 / 峰值日）。
  */
 import type { UsageBillingKey } from './locales.ts';
-import { type CostCurrency } from './pricing.ts';
 import type { UsageStats } from './UsageBilling.tsx';
 /**
  * Token 洞察面板。
@@ -16,7 +15,6 @@ import type { UsageStats } from './UsageBilling.tsx';
  */
 export declare function TokenPanel(props: {
     stats: UsageStats;
-    currency: CostCurrency;
     trendDays: 7 | 30;
     onTrendDays: (d: 7 | 30) => void;
     t: (key: UsageBillingKey) => string;

package/lib/types/client/UsageBilling.d.ts

@@ -223,6 +223,7 @@ export interface UsageStats {
 }
 /**
  * 拉取官方余额差对账提示（drift 时非空），供余额面板展示；失败返回 undefined。
+ * 复用 {@link fetchBalanceDoc} 的同一响应，导出供对账提示渲染测试单独解析。
  * @returns the reconcile notice, or undefined on any failure / no drift.
  */
 export declare function fetchReconcile(): Promise<ReconcileNotice | undefined>;

package/lib/types/client/pricing.d.ts

@@ -225,10 +225,11 @@ export declare function computeCost(entry: ModelEntry, buckets: TokenUsageBucket
  * @param buckets - token usage counts.
  * @param timeMs - the call's wall-clock time (epoch ms); null falls back to the peak-share mix.
  * @param peakShare - fallback mix used only when `timeMs` is missing.
- * @returns the estimated cost in the entry's native currency.
+ * @returns the estimated cost in CNY（USD 计价模型已按当前汇率折算）。
  */
 export declare function computeCostAt(entry: ModelEntry, buckets: TokenUsageBuckets, timeMs: number | null | undefined, peakShare?: number): number;
-/** 人民币 → 美元（显示换算用）：1 USD = {@link USD_TO_CNY} CNY。 */
+/** 人民币 → 美元（显示换算用）：用当前生效汇率（实时优先，缺失回退内置），
+ *  与计价链路的 `currentRate()` 同口径，避免实时汇率生效时 USD 显示与计价不一致。 */
 export declare function cnyToUsd(cny: number): number;
 /**
  * Format an amount with adaptive precision and the given currency symbol.

package/lib/types/client/usage-billing-settings.d.ts

@@ -33,7 +33,8 @@ export interface FloatWindowPrefs {
 export declare const DEFAULT_FLOAT_WINDOW_PREFS: FloatWindowPrefs;
 /** localStorage key（与 budget store 的 `dsh.ui-usage-billing.*` 命名空间一致）。 */
 export declare const FLOAT_WINDOW_STORAGE_KEY = "dsh.ui-usage-billing.float";
-/** 读取浮窗偏好（含损坏/缺失回退到默认）。仅在浏览器半区调用。 */
+/** 读取浮窗偏好（含损坏/缺失回退到默认）。仅在浏览器半区调用。
+ *  返回全新对象（含 targets 数组拷贝），避免调用方就地修改污染共享默认值。 */
 export declare function loadFloatWindowPrefs(): FloatWindowPrefs;
 /** 写入浮窗偏好。失败静默（展示偏好非关键）。 */
 export declare function saveFloatWindowPrefs(prefs: FloatWindowPrefs): void;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@kenz1117/dsh-ui-usage-billing",
   "description": "Usage billing dashboard for DeepSeek Harness: sidebar cost metrics plus a full dashboard modal, priced from a current multi-provider catalog with real usage aggregated from session logs.",
-  "version": "0.9.19",
+  "version": "0.9.20",
   "publishConfig": {
     "access": "public"
   },
@@ -47,42 +47,42 @@
   },
   "license": "MIT",
   "peerDependencies": {
-    "@deepseek-ai/dsh-api-remotes": "workspace:^",
-    "@deepseek-ai/dsh-atomic-write": "workspace:^",
-    "@deepseek-ai/dsh-client-connection": "workspace:^",
-    "@deepseek-ai/dsh-host-webserver": "workspace:^",
-    "@deepseek-ai/dsh-client-locale": "workspace:^",
-    "@deepseek-ai/dsh-client-runtime": "workspace:^",
-    "@deepseek-ai/dsh-client-ui-conversation": "workspace:^",
-    "@deepseek-ai/dsh-client-ui-sidebar": "workspace:^",
-    "@deepseek-ai/dsh-client-ui-primitives": "workspace:^",
-    "@deepseek-ai/dsh-client-ui-slots": "workspace:^",
-    "@deepseek-ai/dsh-credentials": "workspace:^",
-    "@deepseek-ai/dsh-invariants": "workspace:^",
-    "@deepseek-ai/dsh-llm": "workspace:^",
-    "@deepseek-ai/dsh-session": "workspace:^",
-    "@deepseek-ai/dsh-session-persistence": "workspace:^",
-    "@deepseek-ai/dsh-settings": "workspace:^",
-    "@deepseek-ai/dsh-tools": "workspace:^",
-    "@deepseek-ai/schemastery": "workspace:^",
-    "@deepseek-ai/cordis": "workspace:^",
+    "@deepseek-ai/dsh-api-remotes": "*",
+    "@deepseek-ai/dsh-atomic-write": "*",
+    "@deepseek-ai/dsh-client-connection": "*",
+    "@deepseek-ai/dsh-host-webserver": "*",
+    "@deepseek-ai/dsh-client-locale": "*",
+    "@deepseek-ai/dsh-client-runtime": "*",
+    "@deepseek-ai/dsh-client-ui-conversation": "*",
+    "@deepseek-ai/dsh-client-ui-sidebar": "*",
+    "@deepseek-ai/dsh-client-ui-primitives": "*",
+    "@deepseek-ai/dsh-client-ui-slots": "*",
+    "@deepseek-ai/dsh-credentials": "*",
+    "@deepseek-ai/dsh-invariants": "*",
+    "@deepseek-ai/dsh-llm": "*",
+    "@deepseek-ai/dsh-session": "*",
+    "@deepseek-ai/dsh-session-persistence": "*",
+    "@deepseek-ai/dsh-settings": "*",
+    "@deepseek-ai/dsh-tools": "*",
+    "@deepseek-ai/schemastery": "*",
+    "@deepseek-ai/cordis": "*",
     "react": "^18.2.0"
   },
   "dependencies": {
     "clsx": "^2.1.1"
   },
   "devDependencies": {
-    "@deepseek-ai/dsh-client-locale": "workspace:^",
-    "@deepseek-ai/dsh-client-runtime": "workspace:^",
-    "@deepseek-ai/dsh-client-test-runtime": "workspace:^",
-    "@deepseek-ai/dsh-client-ui-conversation": "workspace:^",
-    "@deepseek-ai/dsh-client-ui-primitives": "workspace:^",
-    "@deepseek-ai/dsh-client-ui-slots": "workspace:^",
-    "@deepseek-ai/dsh-invariants": "workspace:^",
+    "@deepseek-ai/dsh-client-locale": "*",
+    "@deepseek-ai/dsh-client-runtime": "*",
+    "@deepseek-ai/dsh-client-test-runtime": "*",
+    "@deepseek-ai/dsh-client-ui-conversation": "*",
+    "@deepseek-ai/dsh-client-ui-primitives": "*",
+    "@deepseek-ai/dsh-client-ui-slots": "*",
+    "@deepseek-ai/dsh-invariants": "*",
     "@testing-library/react": "^16.1.0",
     "@types/react": "~18.3.1",
     "@types/node": "^22.20.0",
-    "@deepseek-ai/cordis": "workspace:^",
+    "@deepseek-ai/cordis": "*",
     "react": "^18.2.0",
     "react-dom": "^18.2.0",
     "lightningcss": "^1.32.0",