@nomix-ai/nomix-harness 0.2.5 → 0.2.6

package/dist/kernel/authorization/lib/types/index.js

@@ -0,0 +1,299 @@
+/**
+ * Service Definition for the authorization capability seam (`ctx.authorization`):
+ * obtaining a credential nobody can supply from configuration alone, because
+ * getting it requires a conversation with the human — open this page, paste
+ * that code, pick an account.
+ *
+ * The seam owns the conversation and the lifecycle; it never owns the protocol.
+ * A plugin that knows how to obtain its own credential registers a flow keyed
+ * by the `CredentialKey` that flow writes, and the flow talks to whatever
+ * surface started it through one neutral vocabulary of notices and prompts. So
+ * a second authorization protocol arrives as another flow rather than as
+ * another seam, and a surface that renders one flow renders all of them.
+ *
+ * ```ts
+ * const dispose = ctx.authorization.registerFlow({
+ *   key: credentialKey('llm-pi-ai', 'openai-codex'),
+ *   label: 'ChatGPT (Codex)',
+ *   methods: [{ id: 'oauth', label: 'Sign in with ChatGPT' }],
+ *   async run(session) {
+ *     session.notify({ message: 'Continue in your browser', url })
+ *     await commitThroughCredentials(await exchange(session.signal))
+ *   },
+ * })
+ * ```
+ *
+ * @module @nomix-ai/nomix-authorization
+ */
+import { Service } from '../../../cordis/lib/index.js';
+import { HarnessError } from '../../../llm/lib/index.js';
+/** Stable error taxonomy for authorization failures. */
+export class AuthorizationError extends HarnessError {
+    constructor(message, code, options) {
+        super(message, code, options);
+        this.name = 'AuthorizationError';
+    }
+}
+/**
+ * The rejection an {@link AuthorizationInteraction.prompt} uses to say the
+ * human declined — dismissed the question, chose not to answer — rather than
+ * that the surface broke. An attempt whose flow fails after a prompt was
+ * declined settles as `cancelled`, the same outcome as a withdrawn signal,
+ * because the human saying no is a refusal, not a breakage. Only a human's
+ * "no" may reject with this class: a prompt withdrawn by its own `signal` (a
+ * flow retiring the losing question of a race) must reject with something
+ * else, or a later genuine failure would be misread as a decline.
+ */
+export class AuthorizationDeclinedError extends AuthorizationError {
+    constructor(message = 'the authorization prompt was declined') {
+        super(message, 'DECLINED');
+        this.name = 'AuthorizationDeclinedError';
+    }
+}
+/**
+ * `ctx.authorization`: a registry of credential-obtaining flows, one attempt at
+ * a time per key.
+ */
+export class AuthorizationService extends Service {
+    /** The commit this seam confirms is a credential-record write, so the store is required, not optional. */
+    static inject = ['credentials'];
+    flows = new Map();
+    running = new Map();
+    constructor(ctx) {
+        super(ctx, 'authorization');
+    }
+    /**
+     * Offer a way to obtain one credential. One flow per key: two plugins
+     * claiming the same key would each write a record in their own format, and
+     * whichever ran last would leave the other reading a payload it cannot parse.
+     *
+     * @param flow - the key it writes, its label, its methods, and its runner.
+     * @returns Disposer that withdraws this flow.
+     * @throws {AuthorizationError} code `DUPLICATE_FLOW` when the key is already claimed.
+     */
+    registerFlow(flow) {
+        const dispose = this.ctx.effect(function* () {
+            if (this.flows.has(flow.key)) {
+                throw new AuthorizationError(`an authorization flow for "${flow.key}" is already registered`, 'DUPLICATE_FLOW');
+            }
+            this.flows.set(flow.key, flow);
+            yield () => {
+                this.flows.delete(flow.key);
+                // A flow leaving mid-attempt takes its attempt with it: the runner
+                // belongs to a plugin that is going away, so letting it keep prompting
+                // would outlive the fiber that can answer for it.
+                this.running.get(flow.key)?.controller.abort();
+            };
+        }.bind(this), 'authorization.registerFlow()');
+        return () => void dispose();
+    }
+    /**
+     * Every registered flow, for a surface listing what can be authorized.
+     * @returns one entry per flow, in registration order.
+     */
+    list() {
+        return [...this.flows.values()].map(flow => this.entry(flow));
+    }
+    /**
+     * One registered flow.
+     * @param key - the credential record to ask about.
+     * @returns the entry, or undefined when no flow claims that key.
+     */
+    describe(key) {
+        const flow = this.flows.get(key);
+        return flow === undefined ? undefined : this.entry(flow);
+    }
+    /** The public view of one registered flow. */
+    entry(flow) {
+        return {
+            key: flow.key,
+            label: flow.label,
+            methods: flow.methods,
+            inFlight: this.running.has(flow.key),
+        };
+    }
+    /**
+     * Withdraw the attempt running for a key, if any. Separate from the
+     * request's own signal because a request/response transport answers a Cancel
+     * button on a second call, with no handle on the first one's signal.
+     * @param key - the credential record whose attempt should stop.
+     */
+    cancel(key) {
+        this.running.get(key)?.controller.abort();
+    }
+    /**
+     * Run one attempt to authorize a key, and report how it ended.
+     *
+     * One attempt per key at a time. A second caller is refused rather than
+     * joined: the two would be prompting different humans through the same flow,
+     * and the second would answer questions the first was asked.
+     *
+     * @param request - the key, the method, the surface, and the cancel signal.
+     * @returns `authorized` once the flow's record is committed during this
+     *   attempt and observed, or `cancelled` when the human declined or the
+     *   caller withdrew.
+     * @throws {AuthorizationError} code `NO_FLOW` when nothing claims the key,
+     *   `UNKNOWN_METHOD` when the named method is not one the flow offers,
+     *   `ALREADY_IN_FLIGHT` when an attempt is already running for the key, or
+     *   `NOT_COMMITTED` when the flow resolved without committing a record
+     *   during the attempt.
+     */
+    async begin(request) {
+        const { key } = request;
+        const flow = this.flows.get(key);
+        if (flow === undefined) {
+            throw new AuthorizationError(`no authorization flow is registered for "${key}"`, 'NO_FLOW');
+        }
+        const method = request.method ?? flow.methods[0].id;
+        if (!flow.methods.some(candidate => candidate.id === method)) {
+            throw new AuthorizationError(`authorization flow for "${key}" offers no method "${method}"`, 'UNKNOWN_METHOD');
+        }
+        if (this.running.has(key)) {
+            throw new AuthorizationError(`an authorization attempt for "${key}" is already running`, 'ALREADY_IN_FLIGHT');
+        }
+        // Withdrawn before it began: never claim the slot and never run the flow.
+        // Handing an aborted signal to `run()` would rely on every flow checking it
+        // before its first await, and one that does not would hang holding the key.
+        // Validation still runs first, so a caller naming a key or method that does
+        // not exist hears about it whether or not it also gave up.
+        if (request.signal?.aborted === true)
+            return { status: 'cancelled' };
+        const controller = new AbortController();
+        const withdraw = () => { controller.abort(request.signal?.reason); };
+        request.signal?.addEventListener('abort', withdraw, { once: true });
+        this.running.set(key, { controller });
+        let settlement = 'failed';
+        try {
+            const outcome = await this.attempt(flow, method, controller.signal, request.interaction);
+            settlement = outcome.status;
+            return outcome;
+        }
+        finally {
+            request.signal?.removeEventListener('abort', withdraw);
+            this.running.delete(key);
+            // After the slot is released, so a listener that reacts by starting the
+            // next attempt is not refused by the one that just finished.
+            this.settle(key, settlement);
+        }
+    }
+    /* jscpd:ignore-start -- deliberate symmetry with the credentials seam's
+       commit fan-out (`CredentialProvider`): the contained-dispatch shape is the
+       reviewed listener-lifecycle contract, and extracting it would couple the
+       two seams' event semantics. */
+    /**
+     * Fan `authorization/settled` out with contained listener failures: every
+     * listener runs, and a sync throw or async rejection is logged without
+     * changing the finished attempt's own outcome — except `INVARIANT`-coded
+     * failures, which rethrow after every listener ran. The attempt is already
+     * over and its key released when this fires, so a broken watcher (that
+     * second browser tab) can never turn the caller's settled result into a
+     * failure of its own.
+     */
+    settle(key, settlement) {
+        let invariantFailure;
+        const args = ['authorization/settled', key, settlement];
+        for (const listener of this.ctx.events.dispatch('emit', args)) {
+            try {
+                const returned = listener(key, settlement);
+                if (returned != null && typeof returned.then === 'function') {
+                    void Promise.resolve(returned).then(undefined, (error) => {
+                        this.warnSettledListenerFailure(key, error);
+                    });
+                }
+            }
+            catch (error) {
+                if (error?.code === 'INVARIANT') {
+                    invariantFailure ??= error;
+                    continue;
+                }
+                this.warnSettledListenerFailure(key, error);
+            }
+        }
+        if (invariantFailure !== undefined)
+            throw invariantFailure;
+    }
+    /* jscpd:ignore-end */
+    /** Contained-listener diagnostic shared by the sync and async failure paths. */
+    warnSettledListenerFailure(key, error) {
+        this.ctx.logger.warn('authorization: an authorization/settled listener for "%s" failed', key);
+        this.ctx.logger.warn(error);
+    }
+    /** Run the flow, then hold it to its half of the commit contract. */
+    async attempt(flow, method, signal, interaction) {
+        // Withdrawal settles the attempt whether or not the flow reacts to it. A
+        // flow is supposed to stop when its signal fires, but one that does not
+        // would otherwise hold the key for the life of the process, and a wedged
+        // key is indistinguishable from a busy one from the outside. The orphaned
+        // run is left to finish on its own; nothing waits on it, and a record it
+        // still manages to commit is a record the human did authorize.
+        const withdrawn = new Promise((resolve) => {
+            // `begin()` returns before claiming the key when its caller has already
+            // withdrawn, so this signal cannot already be aborted here.
+            signal.addEventListener('abort', () => { resolve('withdrawn'); }, { once: true });
+        });
+        // What the seam itself witnessed during the run, held as properties
+        // because closure writes do not narrow locals across awaits: the prompt
+        // wrapper sees a decline first-hand (a flow that rewraps the rejection on
+        // its way out cannot hide it), and confirming the commit means confirming
+        // it happened *now* — on a re-auth the record already exists, so presence
+        // alone would let a flow that wrote nothing report the stale credential
+        // as freshly authorized.
+        const observed = { declined: false, committed: false };
+        const unwatch = this.ctx.on('credentials/record-updated', (key) => {
+            if (key === flow.key)
+                observed.committed = true;
+        });
+        try {
+            const running = flow.run({
+                method,
+                signal,
+                notify: (notice) => {
+                    try {
+                        interaction.notify(notice);
+                    }
+                    catch (error) {
+                        // Fire-and-forget is held at the seam: a surface that cannot
+                        // render a notice (a page whose connection just closed) loses the
+                        // notice, never the attempt.
+                        this.ctx.logger.warn('authorization: the interaction surface failed to render a notice');
+                        this.ctx.logger.warn(error);
+                    }
+                },
+                prompt: prompt => interaction.prompt(prompt).catch((error) => {
+                    if (error instanceof AuthorizationDeclinedError)
+                        observed.declined = true;
+                    throw error;
+                }),
+            });
+            try {
+                if (await Promise.race([running.then(() => 'ran'), withdrawn]) === 'withdrawn') {
+                    // Nothing awaits the orphan any more, so its eventual failure has to be
+                    // marked handled or it would take down the process.
+                    void running.catch(() => { this.ctx.logger.debug('authorization: withdrawn flow failed after the fact'); });
+                    return { status: 'cancelled' };
+                }
+            }
+            catch (error) {
+                // A withdrawn attempt and a declined prompt are outcomes, not
+                // failures: the human said no, or closed the page. Anything else is
+                // the flow failing and belongs to the caller, cause chain intact.
+                if (signal.aborted || observed.declined)
+                    return { status: 'cancelled' };
+                throw error;
+            }
+        }
+        finally {
+            unwatch();
+        }
+        if (!observed.committed) {
+            throw new AuthorizationError(`authorization flow for "${flow.key}" resolved without committing a credential record in this attempt`, 'NOT_COMMITTED');
+        }
+        const stored = await this.ctx.credentials.describeRecord(flow.key);
+        if (!stored.configured) {
+            throw new AuthorizationError(`authorization flow for "${flow.key}" deleted its credential record instead of committing one`, 'NOT_COMMITTED');
+        }
+        return { status: 'authorized' };
+    }
+}
+export default AuthorizationService;
+//# sourceMappingURL=index.js.map

package/dist/kernel/authorization/lib/types/invariant.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Package-owned invariant companion for `@nomix-ai/nomix-authorization`.
+ * @module @nomix-ai/nomix-authorization/invariant
+ */
+import type { Context } from '../../../cordis/lib/index.js';
+/** Cordis companion plugin name. */
+export declare const name = "authorization-invariant";
+/** Service required before the companion can reserve package ownership. */
+export declare const inject: string[];
+/**
+ * Register this package's invariant companion.
+ * @param ctx - Cordis context carrying the invariant service.
+ * @returns the installed registration's disposer after setup succeeds.
+ */
+export declare const apply: (ctx: Context) => Promise<() => void>;
+//# sourceMappingURL=invariant.d.ts.map

package/dist/kernel/authorization/lib/types/invariant.js

@@ -0,0 +1,38 @@
+/**
+ * Package-owned invariant companion for `@nomix-ai/nomix-authorization`.
+ * @module @nomix-ai/nomix-authorization/invariant
+ */
+const PACKAGE_NAME = '@nomix-ai/nomix-authorization';
+/** Cordis companion plugin name. */
+export const name = 'authorization-invariant';
+/** Service required before the companion can reserve package ownership. */
+export const inject = ['invariants'];
+/**
+ * Install the single-flight release contract: `authorization/settled` names a
+ * finished attempt, and the seam admits one attempt per key, so the key must
+ * already be free when the event fires. A slot still held at settlement is
+ * unrecoverable — every later `begin()` for that key is refused as
+ * `ALREADY_IN_FLIGHT` until the process restarts — and it is invisible from the
+ * outside, because a wedged key looks exactly like a busy one.
+ */
+const install = (ctx, fail) => {
+    ctx.on('authorization/settled', (key) => {
+        const authorization = ctx.get('authorization');
+        if (authorization === undefined) {
+            fail(`authorization/settled for "${key}" emitted without a live authorization service`);
+            return;
+        }
+        // A flow withdrawn during its own attempt settles with nothing left to
+        // describe, which is the disposer's documented behavior rather than a leak.
+        if (authorization.describe(key)?.inFlight === true) {
+            fail(`authorization/settled for "${key}" left the key in flight, wedging every later attempt`);
+        }
+    });
+};
+/**
+ * Register this package's invariant companion.
+ * @param ctx - Cordis context carrying the invariant service.
+ * @returns the installed registration's disposer after setup succeeds.
+ */
+export const apply = (ctx) => Promise.resolve(ctx.invariants.register(PACKAGE_NAME, install));
+//# sourceMappingURL=invariant.js.map

package/dist/kernel/authorization/lib/types/types.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Wire-safe authorization types, free of cordis/service imports so browser type
+ * chains (apiproxy api → client) can consume them without loading this
+ * package's Context augmentation.
+ * @module @nomix-ai/nomix-authorization/types
+ */
+import type { CredentialKey } from '../../../credentials/lib/types/types.js';
+/** One way a flow can obtain its credential, named by the flow that offers it. */
+export interface AuthorizationMethod {
+    /** Flow-owned identifier, echoed back when a caller picks this method. */
+    id: string;
+    /** User-facing label for a picker. */
+    label: string;
+}
+/** A running flow's report to whoever is watching it. Never carries a secret. */
+export interface AuthorizationNotice {
+    /** What is happening, or what the human must do next. */
+    message: string;
+    /** A page the human must open to continue. */
+    url?: string;
+    /** A short code the human must enter on that page. */
+    code?: string;
+}
+/** One choice offered by a `select` prompt. */
+export interface AuthorizationPromptOption {
+    /** Value returned when this option is chosen. */
+    id: string;
+    /** User-facing label. */
+    label: string;
+    /** Optional extra context rendered by capable surfaces. */
+    description?: string;
+}
+/**
+ * A question a flow must have answered before it can continue. `secret` differs
+ * from `text` only in presentation — a surface masks it and keeps it out of
+ * logs — and `select` answers with the chosen option's `id`.
+ */
+export type AuthorizationPrompt = {
+    /**
+     * Withdraws this prompt alone, leaving the flow running. A flow that races a
+     * typed code against a browser callback aborts the losing prompt here; the
+     * whole authorization is cancelled through the request's signal instead.
+     */
+    signal?: AbortSignal;
+} & ({
+    kind: 'text';
+    message: string;
+    placeholder?: string;
+} | {
+    kind: 'secret';
+    message: string;
+    placeholder?: string;
+} | {
+    kind: 'select';
+    message: string;
+    options: readonly AuthorizationPromptOption[];
+});
+/** How one authorization attempt ended, as its own caller sees it. */
+export type AuthorizationStatus = 'authorized' | 'cancelled';
+/**
+ * How one attempt ended, as an onlooker sees it. A failure reaches its caller
+ * as a thrown error rather than an outcome, so `failed` exists only here — on
+ * the event stream, where a watcher that did not start the attempt has no
+ * other way to tell a refusal from a breakage.
+ */
+export type AuthorizationSettlement = AuthorizationStatus | 'failed';
+/** The result of one `begin()` attempt. */
+export interface AuthorizationOutcome {
+    /** `authorized` once the record is committed and observed; `cancelled` when the human or caller withdrew. */
+    status: AuthorizationStatus;
+}
+/** A registered flow as a surface sees it: what it authorizes and whether it is busy. */
+export interface AuthorizationEntry {
+    /** The credential record this flow writes. */
+    key: CredentialKey;
+    /** User-facing name of what is being authorized. */
+    label: string;
+    /** The methods this flow offers, most preferred first. */
+    methods: readonly AuthorizationMethod[];
+    /** Whether an attempt for this key is running right now. */
+    inFlight: boolean;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/kernel/authorization/lib/types/types.js

@@ -0,0 +1,8 @@
+/**
+ * Wire-safe authorization types, free of cordis/service imports so browser type
+ * chains (apiproxy api → client) can consume them without loading this
+ * package's Context augmentation.
+ * @module @nomix-ai/nomix-authorization/types
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/kernel/{client-web-react → authorization}/package.json

@@ -1,14 +1,14 @@
 {
-  "name": "@nomix-ai/nomix-client-web-react",
-  "description": "Shell-side React glue: createSlotRenderer, SessionProvider, bindSnapshotSelector (uSES bridge), useInvoke",
-  "version": "0.2.5",
+  "name": "@nomix-ai/nomix-authorization",
+  "description": "Authorization seam (ctx.authorization): plugin-owned flows that obtain a credential through a conversation with the human",
+  "version": "0.2.6",
   "publishConfig": {
     "access": "public"
   },
   "repository": {
     "type": "git",
     "url": "git+https://github.com/ditgaldev/nomix-harness.git",
-    "directory": "packages/client/web-react"
+    "directory": "packages/credentials/authorization"
   },
   "type": "module",
   "main": "lib/index.js",
@@ -22,27 +22,30 @@
       "types": "./lib/types/invariant.d.ts",
       "default": "./lib/invariant.js"
     },
+    "./types": {
+      "types": "./lib/types/types.d.ts",
+      "default": "./lib/types/types.js"
+    },
     "./src/*": "./src/*",
     "./package.json": "./package.json"
   },
+  "files": [
+    "lib/index.js",
+    "lib/invariant.js",
+    "lib/types/**/*.js",
+    "lib/types/**/*.d.ts"
+  ],
   "license": "MIT",
-  "dependencies": {
-    "@nomix-ai/nomix-client-ui-slots": "workspace:^",
-    "react": "^18.2.0",
-    "use-sync-external-store": "1.2.0"
-  },
   "peerDependencies": {
+    "@nomix-ai/nomix-credentials": "workspace:^",
     "@nomix-ai/nomix-invariants": "workspace:^",
+    "@nomix-ai/nomix-llm": "workspace:^",
     "@nomix-ai/cordis": "workspace:^"
   },
   "devDependencies": {
+    "@nomix-ai/nomix-credentials": "workspace:^",
     "@nomix-ai/nomix-invariants": "workspace:^",
-    "@types/react": "~18.3.1",
+    "@nomix-ai/nomix-llm": "workspace:^",
     "@nomix-ai/cordis": "workspace:^"
-  },
-  "files": [
-    "lib/index.js",
-    "lib/invariant.js",
-    "lib/types/**/*.d.ts"
-  ]
+  }
 }

package/dist/kernel/base/cordis.patch.yml

@@ -63,8 +63,8 @@
     - id: agent-default-model
       name: '@nomix-ai/nomix-agent-default-model'
       config:
-        provider: unconfigured
-        model: unconfigured
+        provider: deepseek-official
+        model: deepseek-v4-flash
 
     - id: jobs
       name: '@nomix-ai/nomix-jobs-local'
@@ -72,8 +72,9 @@
     - id: llm-retry
       name: '@nomix-ai/nomix-llm-retry'
 
-    # User-settings document (`$NOMIX_HOME/settings.yaml`, hot-reloaded):
-    # provider sections override explicitly registered adapters without a restart.
+    # User-settings document (`$NOMIX_HOME/settings.yaml`, hot-reloaded): a
+    # `llm-deepseek:` or `llm-pi-ai:` section there overrides the adapter entries
+    # below without a restart, and is what the web Models page writes.
     - id: settings
       name: '@nomix-ai/nomix-settings-file'
 
@@ -149,6 +150,10 @@
       config:
         mode: !!js process.env.NOMIX_TELEMETRY_MODE || 'DISABLED'
         shutdownTimeoutMillis: 3000
+        exporter:
+          url: !!js process.env.NOMIX_TELEMETRY_OTLP_URL ?? 'https://harness-telemetry.deepseeksvc.com/v1/logs'
+          compression: gzip
+          timeoutMillis: 1000
         processor:
           scheduledDelayMillis: 10000
           maxQueueSize: 2048
@@ -388,10 +393,23 @@
         thresholds: [3, 5, 8]
         argumentsPreviewChars: 500
 
-    # The base exposes the provider-neutral web tool without selecting a search
-    # provider. Deployments register and select a provider explicitly.
+    # Every mode enables the stable model-facing web_search tool. DeepSeek search
+    # resolves the same DEEPSEEK_API_KEY credential the Models page manages for
+    # chat, at each search; its Messages endpoint is separate from the
+    # chat-completions endpoint, so it takes its own base-URL override. Fetch stays
+    # disabled and no fetch provider is mounted: that provider defers SSRF
+    # protection and the model would choose the request target. Search is a full
+    # auxiliary model request with server-side retrieval, so this shipped DeepSeek
+    # route gets 60s while the provider-neutral tool default remains 30s.
     - id: web
       name: '@nomix-ai/nomix-web'
+      config:
+        searchProvider: deepseek-official
+
+    - id: web-search-deepseek
+      name: '@nomix-ai/nomix-web-search-deepseek'
+      config:
+        apiKeyEnv: DEEPSEEK_API_KEY
 
     - id: tool-web
       name: '@nomix-ai/nomix-tool-web'
@@ -424,3 +442,10 @@
     # overlay can pin another workspace.
     - id: fs-sandbox
       name: '@nomix-ai/nomix-fs-sandbox'
+
+    # The native DeepSeek adapter. No key or endpoint is inlined: both resolve per
+    # request from the `llm-deepseek:` settings section over this entry, with the
+    # key coming from the credential store below. Thinking defaults are a deployment
+    # choice.
+    - id: llm-deepseek
+      name: '@nomix-ai/nomix-llm-deepseek'

package/dist/kernel/base/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@nomix-ai/nomix-base",
   "description": "The shared nomix core as a profile bundle: every profile's first patch layer, inserting the base plugin rows over the empty profile root",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "publishConfig": {
     "access": "public"
   },
@@ -61,6 +61,7 @@
     "@nomix-ai/nomix-goal-round-driver": "workspace:^",
     "@nomix-ai/nomix-api-gateway": "workspace:^",
     "@nomix-ai/nomix-llm": "workspace:^",
+    "@nomix-ai/nomix-llm-deepseek": "workspace:^",
     "@nomix-ai/nomix-llm-pi-ai": "workspace:^",
     "@nomix-ai/nomix-llm-retry": "workspace:^",
     "@nomix-ai/nomix-permission-presets": "workspace:^",
@@ -112,6 +113,7 @@
     "@nomix-ai/nomix-user-approval": "workspace:^",
     "@nomix-ai/nomix-user-questions": "workspace:^",
     "@nomix-ai/nomix-web": "workspace:^",
+    "@nomix-ai/nomix-web-search-deepseek": "workspace:^",
     "@nomix-ai/nomix-workflow-worker-thread": "workspace:^",
     "@nomix-ai/nomix-agent-instructions": "workspace:^"
   },

package/dist/kernel/bash-local/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@nomix-ai/nomix-bash-local",
   "description": "Local-subprocess implementation of the Nomix Harness bash executor seam",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "publishConfig": {
     "access": "public"
   },

package/dist/kernel/bash-sandbox/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@nomix-ai/nomix-bash-sandbox",
   "description": "Sandbox-consuming implementation of the Nomix Harness bash executor seam (confines every command via ctx.sandbox, reports denial/enforcement result facts)",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "publishConfig": {
     "access": "public"
   },

package/dist/kernel/brand/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@nomix-ai/nomix-brand",
   "description": "Type-only Branded<B> nominal-typing primitive for the Nomix Harness",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "publishConfig": {
     "access": "public"
   },