@lmzhen/dsh-evolution-core 0.3.45 → 0.3.47

package/README.md

@@ -22,15 +22,24 @@ Independent of request-prefix construction. This package does not alter the asse
 
 Skill-library mutations are read-modify-write on one file, so `SkillLibrary`
 serializes them in-process with a `makeSerialQueue` chain: `update`, `patch`,
-`restructure` and `writeSupportFile` run their whole read→validate→write under
-one serial task, so two concurrent mutators on one skill never interleave in
-this process. Single-file writes (`update`, `patch`, `writeSupportFile`)
+`restructure`, `writeSupportFile` and — since 0.3.46 — `consolidate`'s target
+read→merge→commit run their whole read→validate→write under one serial task,
+so two concurrent mutators on one skill never interleave in this process.
+Single-file writes (`update`, `patch`, `writeSupportFile`)
 additionally run the read and the write inside `transactIo` when a caller
 injects a `transact` into the constructor — that is the cross-process lock, so
 two processes sharing `DSH_HOME` cannot interleave their RMW on one file.
 `create` writes a new file and `archive`/`consolidate` already own a two-phase
 commit, so they deliberately stay outside the serial chain.
 
+**0.3.46 residual (documented, per G2.5 precedent):** the low-frequency
+single-file entry points `create`, `archive`, `removeSupportFile` and
+`setPinned` still perform an unlocked read→write (their per-file read is not
+inside the serial/transact task). The race needs a same-process concurrent
+mutator on the SAME skill file, which the serialized entry points above make
+unlikely; the exposure is acknowledged and not locked (收益不抵锁面扩大 —
+adding locks to four low-frequency entry points is not worth the surface).
+
 When the backend provides `transact` (nodeEvolutionIo and the io adapter do),
 the constructor binds it BY DEFAULT since 0.3.27 — the single-file entry points
 (`update`, `patch`, `writeSupportFile`, and each per-file piece of

package/lib/index.js

@@ -63,7 +63,7 @@ function evolutionIoAdapter(provider) {
 * sole gate for the self-pid recycle branch. Exported (read-only in practice)
 * so `io.spec.ts` can drive the self-heal path deterministically.
 */
-const pendingSelfCleanup = /* @__PURE__ */ new Set();
+const pendingSelfCleanup = /* @__PURE__ */ new Map();
 /**
 * Retry a rename that a peer is temporarily holding on Windows (EPERM/EBUSY):
 * a short 50ms backoff, at most 3 retries (~150ms budget), matching the
@@ -170,12 +170,11 @@ function nodeEvolutionIo() {
 					const holder = Number(holderContent.split(":")[0] ?? "");
 					const holderAlive = Number.isInteger(holder) && holder > 0 && isAlive(holder);
 					if (holder === process.pid && pendingSelfCleanup.has(lock)) {
-						if (await readFile(lock, "utf8").catch(() => "") === holderContent) {
-							try {
-								await rm(lock, { force: true });
-							} catch {}
+						const token = pendingSelfCleanup.get(lock);
+						if (await readFile(lock, "utf8").catch(() => "") === token) try {
+							await rm(lock, { force: true });
 							pendingSelfCleanup.delete(lock);
-						}
+						} catch {}
 						continue;
 					}
 					const staleDead = Number.isInteger(holder) && holder > 0 && Date.now() - st.mtimeMs > 1e3 && !holderAlive;
@@ -208,8 +207,9 @@ function nodeEvolutionIo() {
 			try {
 				return await task();
 			} finally {
-				if (await readFile(lock, "utf8").catch(() => null) === myClaim) await rm(lock, { force: true }).catch(() => {
-					pendingSelfCleanup.add(lock);
+				if (await readFile(lock, "utf8").catch(() => null) === myClaim) await rm(lock, { force: true }).catch(async () => {
+					const body = await readFile(lock, "utf8").catch(() => "");
+					pendingSelfCleanup.set(lock, body);
 				});
 			}
 		}
@@ -858,8 +858,9 @@ function parseCuratorNominations(text) {
 * view so the two can never disagree: records failing ANY of these gates are
 * outside the managed scope.
 */
-function lifecycleCandidate(name, record, config, bundled, gates = createGateSet(config)) {
+function lifecycleCandidate(name, record, config, bundled, gates = createGateSet(config), protectedNames) {
 	if (record.pinned) return false;
+	if (protectedNames?.has(name) === true) return false;
 	if (gates.isBlocked(name)) return false;
 	if (!(record.created_by === "agent" || config.manageUnmanaged === true) && !(config.pruneBuiltins === true && bundled)) return false;
 	if (record.state === "archived") return false;
@@ -887,7 +888,7 @@ function computeScopeView(usage, config, protectedNames, gates) {
 		const suppressed = gateSet.suppressed.has(name);
 		const isBuiltin = PROTECTED_BUILTIN_SKILLS.has(name);
 		if (record.pinned || bundled || suppressed || protectedNames?.has(name) === true || isBuiltin) protectedSet.add(name);
-		if (lifecycleCandidate(name, record, config, bundled, gateSet)) {
+		if (lifecycleCandidate(name, record, config, bundled, gateSet, protectedNames)) {
 			managed.push(name);
 			if (record.state === "stale" || record.quality_warn === true) watched.push(name);
 			if (record.quality_warn === true) qualityWarned.push(name);
@@ -904,7 +905,7 @@ function computeScopeView(usage, config, protectedNames, gates) {
 function daysSince(iso, created, now) {
 	return (now - new Date(iso ?? created).getTime()) / 864e5;
 }
-function computeLifecycleTransitions(usage, config, now = /* @__PURE__ */ new Date(), gates) {
+function computeLifecycleTransitions(usage, config, now = /* @__PURE__ */ new Date(), gates, protectedNames) {
 	const result = {
 		transitions: [],
 		archive: [],
@@ -913,7 +914,7 @@ function computeLifecycleTransitions(usage, config, now = /* @__PURE__ */ new Da
 	};
 	const gateSet = gates ?? createGateSet(config);
 	for (const [name, record] of usage) {
-		if (!lifecycleCandidate(name, record, config, config.bundledNames?.has(name) === true, gateSet)) continue;
+		if (!lifecycleCandidate(name, record, config, config.bundledNames?.has(name) === true, gateSet, protectedNames)) continue;
 		const age = daysSince(null, record.created_at, now.getTime());
 		if (record.use_count === 0 && age < config.staleAfterDays) continue;
 		const idle = daysSince(latestActivityAt(record), record.created_at, now.getTime());
@@ -1770,19 +1771,19 @@ const PATTERNS = [
 		label: "exfil_curl",
 		category: "exfiltration",
 		scope: "all",
-		regex: /curl\s+[^\n]{0,512}\$\{?\w*(?:KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL|API)/i
+		regex: /\bcurl\s+[^\n]{0,512}\$\{?\w*(?:KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL|API)/i
 	},
 	{
 		label: "exfil_wget",
 		category: "exfiltration",
 		scope: "all",
-		regex: /wget\s+[^\n]{0,512}\$\{?\w*(?:KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL|API)/i
+		regex: /\bwget\s+[^\n]{0,512}\$\{?\w*(?:KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL|API)/i
 	},
 	{
 		label: "read_secrets",
 		category: "exfiltration",
 		scope: "all",
-		regex: /cat\s+[^\n]{0,512}(?:\.env|credentials|\.netrc|\.pgpass|\.npmrc|\.pypirc)/i
+		regex: /\bcat\s+[^\n]{0,512}(?:\.env|credentials|\.netrc|\.pgpass|\.npmrc|\.pypirc)/i
 	},
 	{
 		label: "ssh_backdoor",
@@ -2158,7 +2159,7 @@ var MemoryStore = class {
 			},
 			write: null
 		};
-		if (hasEntryDelimiter(content)) return {
+		if (hasEntryDelimiter(this.addDatePrefix ? `## ${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}\n${content}` : content)) return {
 			result: {
 				ok: false,
 				message: "Fact contains the entry delimiter (§) and would split into multiple entries; rewrite it as separate facts.",
@@ -2273,7 +2274,8 @@ var MemoryStore = class {
 					},
 					write: null
 				};
-				if (hasEntryDelimiter(body)) return {
+				const entryBody = this.addDatePrefix ? `## ${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}\n${body}` : body;
+				if (hasEntryDelimiter(entryBody)) return {
 					result: {
 						ok: false,
 						message: `Operation ${position} (add): Fact contains the entry delimiter (§) and would split into multiple entries; rewrite it as separate facts.${previewEntries(entries)}`,
@@ -2283,7 +2285,7 @@ var MemoryStore = class {
 					},
 					write: null
 				};
-				if (!working.some((entry) => stripDatePrefix(entry) === body)) working.push(this.addDatePrefix ? `## ${(/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}\n${body}` : body);
+				if (!working.some((entry) => stripDatePrefix(entry) === body)) working.push(entryBody);
 				continue;
 			}
 			const rawAction = op.action;
@@ -2695,7 +2697,7 @@ function computePrefixClusters(names) {
 * Migrated from `evolution-review` so both channels share one implementation.
 */
 const SECRET_PATTERNS = [
-	["openai-style key", /sk-[A-Za-z0-9_-]{16,}/g],
+	["openai-style key", /\bsk-[A-Za-z0-9_-]{16,}/g],
 	["aws access key", /AKIA[0-9A-Z]{16}/g],
 	["github token", /gh[pousr]_[A-Za-z0-9]{20,}/g],
 	["gitlab token", /glpat-[A-Za-z0-9_-]{16,}/g],
@@ -3042,8 +3044,13 @@ const DEFAULT_SKILL_LIMITS = {
 };
 /** Upper bound of moves per restructure proposal (validator and core agree). */
 const MAX_RESTRUCTURE_MOVES = 5;
-/** Restructure targets are plain markdown files under references/ — no subdirectories, no other support kind. */
-const RESTRUCTURE_TARGET_RE = /^references\/[a-z0-9][a-z0-9._-]*\.md$/;
+/** Restructure targets are plain markdown files under references/ — no
+* subdirectories, no other support kind. V8-10 (0.3.47): the regex-level
+* `(?!.*\.\.)` keeps the restructure-created set EXACTLY the set
+* validateSupportPath can reopen — a `references/my..notes.md` target (double
+* dots) used to pass here while every later patch/write/remove on it was
+* refused as traversal (an orphan file the user could not touch). */
+const RESTRUCTURE_TARGET_RE = /^references\/[a-z0-9](?!.*\.\.)[a-z0-9._-]*\.md$/;
 /** Extra file name carried inside a snapshot's `extras/` directory. */
 const SNAPSHOT_EXTRA_NAME_RE = /^[a-z0-9][a-z0-9._-]*$/;
 function skillsRoot(env = process.env) {
@@ -4148,94 +4155,65 @@ var SkillLibrary = class {
 			message: `Invalid skill name "${name}". Use lowercase letters, digits, and hyphens.`
 		};
 		const targetDir = this.dirOf(targetName);
-		const targetMd = await this.io.readText(join(targetDir, "SKILL.md"));
-		if (!targetMd) return {
-			ok: false,
-			message: `Skill "${targetName}" not found.`
-		};
 		const targetProtection = await this.writeProtection(targetName, origin);
 		if (targetProtection) return {
 			ok: false,
 			message: `Skill "${targetName}" is protected (${targetProtection}).`
 		};
-		const writes = [];
-		if (mode === "append") {
-			const parts = [];
-			for (const source of normalizedSources) {
-				const protection = await this.deleteProtection(source);
-				if (protection) return {
-					ok: false,
-					message: `Skill "${source}" is protected (${protection}).`
-				};
-				const sourceMd = await this.io.readText(join(this.dirOf(source), "SKILL.md"));
-				if (!sourceMd) return {
-					ok: false,
-					message: `Skill "${source}" not found.`
-				};
-				const parsed = parseFrontmatter(sourceMd);
-				if (!parsed) return {
-					ok: false,
-					message: `Skill "${source}" has no valid frontmatter; refusing to merge.`
-				};
-				if (await this.countSupportDirs(source) > 0) return {
-					ok: false,
-					message: `Consolidation rejected: source "${source}" carries support files — use mode:'reference' or archive the whole package instead.`
-				};
-				const refs = supportRefs(parsed.body);
-				if (refs.length > 0) return {
-					ok: false,
-					message: `Consolidation rejected: source "${source}" body references support files (${refs.join(", ")}) that would be left behind — use mode:'reference' or archive the whole package instead.`
-				};
-				parts.push(`\n<!-- consolidated from ${source} at ${(/* @__PURE__ */ new Date()).toISOString()} -->\n${parsed.body.trim()}`);
-			}
-			const merged = targetMd.trimEnd() + parts.join("\n") + "\n";
-			const validation = validateFrontmatter(merged, targetName, this.limits);
-			if (validation) return {
+		const referenceWrites = [];
+		const parts = [];
+		if (mode === "append") for (const source of normalizedSources) {
+			const protection = await this.deleteProtection(source);
+			if (protection) return {
 				ok: false,
-				message: `Consolidation rejected: ${validation}`
+				message: `Skill "${source}" is protected (${protection}).`
 			};
-			writes.push({
-				target: join(targetDir, "SKILL.md"),
-				content: merged
-			});
-		} else {
-			for (const source of normalizedSources) {
-				const protection = await this.deleteProtection(source);
-				if (protection) return {
-					ok: false,
-					message: `Skill "${source}" is protected (${protection}).`
-				};
-				const sourceMd = await this.io.readText(join(this.dirOf(source), "SKILL.md"));
-				if (!sourceMd) return {
-					ok: false,
-					message: `Skill "${source}" not found.`
-				};
-				const parsed = parseFrontmatter(sourceMd);
-				if (!parsed) return {
-					ok: false,
-					message: `Skill "${source}" has no valid frontmatter; refusing to demote.`
-				};
-				const refs = supportRefs(parsed.body);
-				if (refs.length > 0) return {
-					ok: false,
-					message: `Consolidation rejected: source "${source}" body references support files (${refs.join(", ")}) that would be left behind — archive the whole package instead.`
-				};
-				const target = join(targetDir, "references", `${source}.md`);
-				writes.push({
-					target,
-					content: `<!-- demoted from ${source} at ${(/* @__PURE__ */ new Date()).toISOString()} -->\n${parsed.body.trim()}\n`
-				});
-			}
-			const pointerLines = normalizedSources.map((source) => `\n${POINTER_LINE_PREFIX}${source}.md`).join("");
-			const extended = targetMd.trimEnd() + pointerLines + "\n";
-			const validation = validateFrontmatter(extended, targetName, this.limits);
-			if (validation) return {
+			const sourceMd = await this.io.readText(join(this.dirOf(source), "SKILL.md"));
+			if (!sourceMd) return {
 				ok: false,
-				message: `Consolidation rejected: ${validation}`
+				message: `Skill "${source}" not found.`
 			};
-			writes.push({
-				target: join(targetDir, "SKILL.md"),
-				content: extended
+			const parsed = parseFrontmatter(sourceMd);
+			if (!parsed) return {
+				ok: false,
+				message: `Skill "${source}" has no valid frontmatter; refusing to merge.`
+			};
+			if (await this.countSupportDirs(source) > 0) return {
+				ok: false,
+				message: `Consolidation rejected: source "${source}" carries support files — use mode:'reference' or archive the whole package instead.`
+			};
+			const refs = supportRefs(parsed.body);
+			if (refs.length > 0) return {
+				ok: false,
+				message: `Consolidation rejected: source "${source}" body references support files (${refs.join(", ")}) that would be left behind — use mode:'reference' or archive the whole package instead.`
+			};
+			parts.push(`\n<!-- consolidated from ${source} at ${(/* @__PURE__ */ new Date()).toISOString()} -->\n${parsed.body.trim()}`);
+		}
+		else for (const source of normalizedSources) {
+			const protection = await this.deleteProtection(source);
+			if (protection) return {
+				ok: false,
+				message: `Skill "${source}" is protected (${protection}).`
+			};
+			const sourceMd = await this.io.readText(join(this.dirOf(source), "SKILL.md"));
+			if (!sourceMd) return {
+				ok: false,
+				message: `Skill "${source}" not found.`
+			};
+			const parsed = parseFrontmatter(sourceMd);
+			if (!parsed) return {
+				ok: false,
+				message: `Skill "${source}" has no valid frontmatter; refusing to demote.`
+			};
+			const refs = supportRefs(parsed.body);
+			if (refs.length > 0) return {
+				ok: false,
+				message: `Consolidation rejected: source "${source}" body references support files (${refs.join(", ")}) that would be left behind — archive the whole package instead.`
+			};
+			const target = join(targetDir, "references", `${source}.md`);
+			referenceWrites.push({
+				target,
+				content: `<!-- demoted from ${source} at ${(/* @__PURE__ */ new Date()).toISOString()} -->\n${parsed.body.trim()}\n`
 			});
 		}
 		const archived = [];
@@ -4245,16 +4223,53 @@ var SkillLibrary = class {
 				if (!result.ok) throw new Error(result.message);
 				archived.push(source);
 			}
-			const result = await this.applyTreeChange({
-				name: targetName,
-				origin,
-				protection: "write",
-				writes,
-				auditAction: "consolidate",
-				auditSummary: `consolidated ${normalizedSources.join(", ")} (${mode}) into ${targetName}`,
-				eventAction: "consolidate"
+			const result = await this.serial(async () => {
+				const freshTargetMd = await this.io.readText(join(targetDir, "SKILL.md"));
+				if (!freshTargetMd) return {
+					ok: false,
+					message: `Skill "${targetName}" not found.`
+				};
+				const writes = [...referenceWrites];
+				if (mode === "append") {
+					const merged = freshTargetMd.trimEnd() + parts.join("\n") + "\n";
+					const validation = validateFrontmatter(merged, targetName, this.limits);
+					if (validation) return {
+						ok: false,
+						message: `Consolidation rejected: ${validation}`
+					};
+					writes.push({
+						target: join(targetDir, "SKILL.md"),
+						content: merged
+					});
+				} else {
+					const pointerLines = normalizedSources.map((source) => `\n${POINTER_LINE_PREFIX}${source}.md`).join("");
+					const extended = freshTargetMd.trimEnd() + pointerLines + "\n";
+					const validation = validateFrontmatter(extended, targetName, this.limits);
+					if (validation) return {
+						ok: false,
+						message: `Consolidation rejected: ${validation}`
+					};
+					writes.push({
+						target: join(targetDir, "SKILL.md"),
+						content: extended
+					});
+				}
+				return await this.applyTreeChange({
+					name: targetName,
+					origin,
+					protection: "write",
+					writes,
+					auditAction: "consolidate",
+					auditSummary: `consolidated ${normalizedSources.join(", ")} (${mode}) into ${targetName}`,
+					eventAction: "consolidate"
+				});
 			});
 			if (!result.ok) throw new Error(result.message);
+			return {
+				ok: true,
+				message: `Consolidated ${normalizedSources.join(", ")} into "${targetName}".`,
+				path: targetDir
+			};
 		} catch (error) {
 			const reason = error instanceof Error ? error.message : String(error);
 			const failedRestores = [];
@@ -4272,11 +4287,6 @@ var SkillLibrary = class {
 				message: `Consolidation failed and was rolled back: ${reason}`
 			};
 		}
-		return {
-			ok: true,
-			message: `Consolidated ${normalizedSources.join(", ")} into "${targetName}".`,
-			path: targetDir
-		};
 	}
 	/**
 	* Content-distribution repair (008 batch B, 009-R kernel): move body
@@ -4842,11 +4852,14 @@ var SkillLibrary = class {
 */
 /**
 * DSH home root: `$DSH_HOME` or `~/.dsh`. Single source of the empty-string
-* fallback (`||`, not `??`) — an EMPTY DSH_HOME resolves to the default home,
-* never to a CWD-relative path (0.3.19 W1.3, 0.3.22 F-207).
+* fallback — an EMPTY or WHITESPACE-ONLY DSH_HOME resolves to the default
+* home, never to a CWD-relative path (0.3.19 W1.3, 0.3.22 F-207);
+* V8-06 (0.3.47) extends the guard to whitespace (upstream home-paths:
+* `trim().length > 0` is the adoption test — `DSH_HOME=" "` must not produce
+* a sidecar under a relative "." path).
 */
 function evolutionRoot(env = process.env) {
-	return env.DSH_HOME || join(homedir(), ".dsh");
+	return env.DSH_HOME?.trim() ? env.DSH_HOME : join(homedir(), ".dsh");
 }
 /** Evolution home path helper: `$DSH_HOME/evolution` for plugin-owned sidecar
 * state (reports, activity store, feedback file, state-domain data). */

package/lib/types/curator.d.ts

@@ -117,7 +117,7 @@ export declare function parseCuratorNominations(text: string): CuratorNomination
  * view so the two can never disagree: records failing ANY of these gates are
  * outside the managed scope.
  */
-export declare function lifecycleCandidate(name: string, record: UsageRecord, config: CuratorConfig, bundled: boolean, gates?: EvolutionGateSet): boolean;
+export declare function lifecycleCandidate(name: string, record: UsageRecord, config: CuratorConfig, bundled: boolean, gates?: EvolutionGateSet, protectedNames?: ReadonlyMap<string, string>): boolean;
 export interface ScopeView {
     /** Skills inside the lifecycle scope right now (candidate gate + active state). */
     managed: string[];
@@ -137,5 +137,5 @@ export interface ScopeView {
  * records lack (bundled / hub-installed / pinned from `SkillLibrary.list()`).
  */
 export declare function computeScopeView(usage: UsageMap, config: CuratorConfig, protectedNames?: ReadonlyMap<string, string>, gates?: EvolutionGateSet): ScopeView;
-export declare function computeLifecycleTransitions(usage: UsageMap, config: CuratorConfig, now?: Date, gates?: EvolutionGateSet): CuratorResult;
+export declare function computeLifecycleTransitions(usage: UsageMap, config: CuratorConfig, now?: Date, gates?: EvolutionGateSet, protectedNames?: ReadonlyMap<string, string>): CuratorResult;
 //# sourceMappingURL=curator.d.ts.map

package/lib/types/io.d.ts

@@ -64,7 +64,7 @@ export declare function evolutionIoAdapter(provider: () => EvolutionIoLike): Evo
  * sole gate for the self-pid recycle branch. Exported (read-only in practice)
  * so `io.spec.ts` can drive the self-heal path deterministically.
  */
-export declare const pendingSelfCleanup: Set<string>;
+export declare const pendingSelfCleanup: Map<string, string>;
 /**
  * Retry a rename that a peer is temporarily holding on Windows (EPERM/EBUSY):
  * a short 50ms backoff, at most 3 retries (~150ms budget), matching the

package/lib/types/skill-store.d.ts

@@ -50,7 +50,12 @@ export interface SkillRestructureMove {
 }
 /** Upper bound of moves per restructure proposal (validator and core agree). */
 export declare const MAX_RESTRUCTURE_MOVES = 5;
-/** Restructure targets are plain markdown files under references/ — no subdirectories, no other support kind. */
+/** Restructure targets are plain markdown files under references/ — no
+ * subdirectories, no other support kind. V8-10 (0.3.47): the regex-level
+ * `(?!.*\.\.)` keeps the restructure-created set EXACTLY the set
+ * validateSupportPath can reopen — a `references/my..notes.md` target (double
+ * dots) used to pass here while every later patch/write/remove on it was
+ * refused as traversal (an orphan file the user could not touch). */
 export declare const RESTRUCTURE_TARGET_RE: RegExp;
 /** Extra file name carried inside a snapshot's `extras/` directory. */
 export declare const SNAPSHOT_EXTRA_NAME_RE: RegExp;

package/lib/types/state-store.d.ts

@@ -4,8 +4,11 @@
  */
 /**
  * DSH home root: `$DSH_HOME` or `~/.dsh`. Single source of the empty-string
- * fallback (`||`, not `??`) — an EMPTY DSH_HOME resolves to the default home,
- * never to a CWD-relative path (0.3.19 W1.3, 0.3.22 F-207).
+ * fallback — an EMPTY or WHITESPACE-ONLY DSH_HOME resolves to the default
+ * home, never to a CWD-relative path (0.3.19 W1.3, 0.3.22 F-207);
+ * V8-06 (0.3.47) extends the guard to whitespace (upstream home-paths:
+ * `trim().length > 0` is the adoption test — `DSH_HOME=" "` must not produce
+ * a sidecar under a relative "." path).
  */
 export declare function evolutionRoot(env?: NodeJS.ProcessEnv): string;
 /** Evolution home path helper: `$DSH_HOME/evolution` for plugin-owned sidecar

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@lmzhen/dsh-evolution-core",
   "description": "Shared stores, prompts, signals and lifecycle logic for the dsh-evolution plugin family (community build)",
-  "version": "0.3.45",
+  "version": "0.3.47",
   "publishConfig": {
     "access": "public"
   },