@zaalipro/dsh-workflows 0.1.0-rc.12

package/package.json

@@ -0,0 +1,291 @@
+{
+  "name": "@zaalipro/dsh-workflows",
+  "version": "0.1.0-rc.12",
+  "description": "Installable saved-workflow and supervised-run product for DeepSeek Harness",
+  "type": "module",
+  "license": "MIT",
+  "engines": {
+    "node": "^22.19.0 || >=24.0.0"
+  },
+  "packageManager": "pnpm@11.7.0",
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "lib/types",
+    "lib/compat-engine",
+    "lib/client-types",
+    "lib/client.js",
+    "lib/client.js.map",
+    "lib/typert.host.js",
+    "lib/typert.host.d.ts",
+    "lib/typert.remote-client.js",
+    "lib/typert.remote-client.d.ts",
+    "skills",
+    "cordis.patch.yml",
+    "README.md",
+    "README.zh.md",
+    "README.i18n.yaml",
+    "docs",
+    "LICENSE",
+    "NOTICE.md",
+    "vendor/workflow-engine/LICENSE",
+    "vendor/workflow-engine/README.md",
+    "package.json"
+  ],
+  "main": "./lib/types/index.js",
+  "types": "./lib/types/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/types/index.d.ts",
+      "import": "./lib/types/index.js",
+      "default": "./lib/types/index.js"
+    },
+    "./registry": {
+      "types": "./lib/types/registry/index.d.ts",
+      "default": "./lib/types/registry/index.js"
+    },
+    "./supervisor": {
+      "types": "./lib/types/supervisor/index.d.ts",
+      "default": "./lib/types/supervisor/index.js"
+    },
+    "./run-recorder": {
+      "types": "./lib/types/run-recorder.d.ts",
+      "default": "./lib/types/run-recorder.js"
+    },
+    "./user-questions": {
+      "types": "./lib/types/user-questions.d.ts",
+      "default": "./lib/types/user-questions.js"
+    },
+    "./commands": {
+      "types": "./lib/types/commands/index.d.ts",
+      "default": "./lib/types/commands/index.js"
+    },
+    "./tool": {
+      "types": "./lib/types/tool/index.d.ts",
+      "default": "./lib/types/tool/index.js"
+    },
+    "./client": {
+      "types": "./lib/client-types/index.d.ts",
+      "default": "./lib/client.js"
+    },
+    "./types": {
+      "types": "./lib/types/types.d.ts",
+      "default": "./lib/types/types.js"
+    },
+    "./invariant": {
+      "types": "./lib/types/invariant.d.ts",
+      "default": "./lib/types/invariant.js"
+    },
+    "./typert": {
+      "types": "./lib/typert.host.d.ts",
+      "default": "./lib/typert.host.js"
+    },
+    "./remote": {
+      "types": "./lib/typert.remote-client.d.ts",
+      "default": "./lib/typert.remote-client.js"
+    },
+    "./cordis.patch.yml": "./cordis.patch.yml",
+    "./skills/create-workflow/SKILL.md": "./skills/create-workflow/SKILL.md",
+    "./package.json": "./package.json"
+  },
+  "sideEffects": false,
+  "scripts": {
+    "typecheck:host": "node node_modules/typescript/bin/tsc -p tsconfig.host.json --noEmit",
+    "typecheck": "node node_modules/typescript/bin/tsc -b --pretty false && node node_modules/typescript/bin/tsc -p tsconfig.compat-engine.json --pretty false",
+    "lint": "node node_modules/typescript/bin/tsc -b --pretty false",
+    "test:unit": "vitest run --exclude=\"tests/packed-consumer.spec.ts\"",
+    "test": "vitest run --exclude=\"tests/packed-consumer.spec.ts\"",
+    "test:browser": "vitest run tests/browser-smoke.spec.ts --reporter=dot",
+    "test:stress": "vitest run tests/race-stress.spec.ts tests/storage-stress.spec.ts tests/client-race-stress.client.spec.ts --reporter=dot",
+    "test:packed-consumer": "vitest run tests/packed-consumer.spec.ts --reporter=dot",
+    "test:e2e": "vitest run tests/real-provider.spec.ts --reporter=dot",
+    "test:snapshot": "vitest run tests/keyless-snapshot.spec.ts tests/dashboard-snapshot.client.spec.tsx --reporter=dot",
+    "build": "node scripts/build.mjs",
+    "verify:package": "node scripts/verify-package.mjs --source .",
+    "verify:docs": "node scripts/verify-docs.mjs",
+    "doc-sync": "node scripts/verify-docs.mjs",
+    "check:release": "node scripts/check-release.mjs",
+    "test:coverage": "vitest run --exclude=\"tests/keyless-snapshot.spec.ts\" --exclude=\"tests/dashboard-snapshot.client.spec.tsx\" --exclude=\"tests/packed-consumer.spec.ts\" --exclude=\"tests/browser-smoke.spec.ts\" --exclude=\"tests/race-stress.spec.ts\" --exclude=\"tests/storage-stress.spec.ts\" --exclude=\"tests/client-race-stress.client.spec.ts\" --exclude=\"tests/real-provider.spec.ts\" --coverage.enabled=true --coverage.provider=v8 --coverage.thresholds.statements=80 --coverage.thresholds.branches=80 --coverage.thresholds.functions=80 --coverage.thresholds.lines=80"
+  },
+  "dependencies": {
+    "@deepseek-ai/schemastery": "3.18.2",
+    "chokidar": "4.0.3",
+    "clsx": "2.1.1",
+    "fs-native-extensions": "1.5.0",
+    "zod": "4.4.3"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": ">=4.0.2",
+    "@deepseek-ai/dsh-agent": "0.1.6-alpha.1",
+    "@deepseek-ai/dsh-api-remotes": "0.1.6-alpha.1",
+    "@deepseek-ai/dsh-client-connection": "0.1.6-alpha.1",
+    "@deepseek-ai/dsh-client-locale": "0.1.6-alpha.1",
+    "@deepseek-ai/dsh-client-ui-chat": "0.1.6-alpha.1",
+    "@deepseek-ai/dsh-client-ui-commands": "0.1.6-alpha.1",
+    "@deepseek-ai/dsh-client-ui-conversation": "0.1.6-alpha.1",
+    "@deepseek-ai/dsh-client-ui-input-trigger": "0.1.6-alpha.1",
+    "@deepseek-ai/dsh-client-ui-layout": "0.1.6-alpha.1",
+    "@deepseek-ai/dsh-commands": "0.1.6-alpha.1",
+    "@deepseek-ai/dsh-fs": "0.1.6-alpha.1",
+    "@deepseek-ai/dsh-llm": "0.1.6-alpha.1",
+    "@deepseek-ai/dsh-session": "0.1.6-alpha.1",
+    "@deepseek-ai/dsh-skill": "0.1.6-alpha.1",
+    "@deepseek-ai/dsh-subagent": "0.1.6-alpha.1",
+    "@deepseek-ai/dsh-tools": "0.1.6-alpha.1",
+    "@deepseek-ai/dsh-typert-protocol": "0.1.6-alpha.1",
+    "@deepseek-ai/dsh-user-questions": "0.1.6-alpha.1",
+    "@deepseek-ai/dsh-util-values": "0.1.6-alpha.1",
+    "@deepseek-ai/dsh-workflow": "0.1.6-alpha.1",
+    "@deepseek-ai/dsh-workflow-ptc": "0.1.6-alpha.1",
+    "react": ">=18.2.0"
+  },
+  "peerDependenciesMeta": {
+    "@deepseek-ai/cordis": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-agent": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-api-remotes": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-client-connection": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-client-locale": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-client-ui-chat": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-client-ui-commands": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-client-ui-conversation": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-client-ui-input-trigger": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-client-ui-layout": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-commands": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-fs": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-llm": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-session": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-util-values": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-skill": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-subagent": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-tools": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-typert-protocol": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-user-questions": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-workflow": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-workflow-ptc": {
+      "optional": true
+    },
+    "react": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "4.0.2",
+    "@deepseek-ai/cordis-plugin-group": "1.0.2",
+    "@deepseek-ai/cordis-plugin-hmr": "1.0.17",
+    "@deepseek-ai/cordis-plugin-include": "1.0.7",
+    "@deepseek-ai/cordis-plugin-loader": "1.0.3",
+    "@deepseek-ai/dsh": "0.1.6-alpha.1",
+    "@deepseek-ai/dsh-agent": "0.1.6-alpha.1",
+    "@deepseek-ai/dsh-anonymous-user-id": "0.1.6-alpha.1",
+    "@deepseek-ai/dsh-api-remotes": "0.1.6-alpha.1",
+    "@deepseek-ai/dsh-client-connection": "0.1.6-alpha.1",
+    "@deepseek-ai/dsh-client-locale": "0.1.6-alpha.1",
+    "@deepseek-ai/dsh-client-ui-chat": "0.1.6-alpha.1",
+    "@deepseek-ai/dsh-client-ui-commands": "0.1.6-alpha.1",
+    "@deepseek-ai/dsh-client-ui-conversation": "0.1.6-alpha.1",
+    "@deepseek-ai/dsh-client-ui-input-trigger": "0.1.6-alpha.1",
+    "@deepseek-ai/dsh-client-ui-layout": "0.1.6-alpha.1",
+    "@deepseek-ai/dsh-commands": "0.1.6-alpha.1",
+    "@deepseek-ai/dsh-fs": "0.1.6-alpha.1",
+    "@deepseek-ai/dsh-invariants": "0.1.6-alpha.1",
+    "@deepseek-ai/dsh-jobs": "0.1.6-alpha.1",
+    "@deepseek-ai/dsh-llm": "0.1.6-alpha.1",
+    "@deepseek-ai/dsh-output-retention": "0.1.6-alpha.1",
+    "@deepseek-ai/dsh-sandbox": "0.1.6-alpha.1",
+    "@deepseek-ai/dsh-session": "0.1.6-alpha.1",
+    "@deepseek-ai/dsh-session-persistence": "0.1.6-alpha.1",
+    "@deepseek-ai/dsh-settings": "0.1.6-alpha.1",
+    "@deepseek-ai/dsh-skill": "0.1.6-alpha.1",
+    "@deepseek-ai/dsh-spill": "0.1.6-alpha.1",
+    "@deepseek-ai/dsh-spill-local": "0.1.6-alpha.1",
+    "@deepseek-ai/dsh-spill-policy": "0.1.6-alpha.1",
+    "@deepseek-ai/dsh-subagent": "0.1.6-alpha.1",
+    "@deepseek-ai/dsh-tools": "0.1.6-alpha.1",
+    "@deepseek-ai/dsh-typert-generator": "0.1.6-alpha.1",
+    "@deepseek-ai/dsh-typert-protocol": "0.1.6-alpha.1",
+    "@deepseek-ai/dsh-user-questions": "0.1.6-alpha.1",
+    "@deepseek-ai/dsh-util-values": "0.1.6-alpha.1",
+    "@deepseek-ai/dsh-workflow": "0.1.6-alpha.1",
+    "@deepseek-ai/dsh-workflow-ptc": "0.1.6-alpha.1",
+    "@types/node": "^22.19.0",
+    "@types/react": "^19.0.0",
+    "@types/react-dom": "^19.0.0",
+    "@vitest/coverage-v8": "3.2.7",
+    "jsdom": "^30.0.1",
+    "lightningcss": "1.33.0",
+    "react": "^19.0.0",
+    "react-dom": "^19.0.0",
+    "tsdown": "0.22.14",
+    "tsx": "^4.19.0",
+    "typescript": "^5.8.0",
+    "vitest": "^3.2.0",
+    "yaml": "2.8.1"
+  },
+  "dsh": {
+    "compatibility": {
+      "host": "@deepseek-ai/dsh",
+      "versions": [
+        "0.1.6-alpha.1"
+      ],
+      "evaluator": "plugin-compat-engine-v1"
+    },
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "inject": [
+        "@deepseek-ai/dsh-api-remotes",
+        "@deepseek-ai/dsh-client-ui-chat",
+        "@deepseek-ai/dsh-client-locale",
+        "@deepseek-ai/dsh-client-ui-commands",
+        "@deepseek-ai/dsh-client-ui-conversation",
+        "@deepseek-ai/dsh-client-ui-input-trigger",
+        "@deepseek-ai/dsh-client-ui-layout"
+      ],
+      "platform": "web"
+    }
+  }
+}

package/skills/create-workflow/SKILL.md

@@ -0,0 +1,166 @@
+---
+name: create-workflow
+description: Author, smoke-check, and save a new saved workflow (invoke via /create-workflow).
+user-invocable: true
+model-invocable: true
+---
+
+# create-workflow
+
+Author a saved workflow: a deterministic JavaScript orchestration script that fans out subagents. The script — not the model turn — holds the loop, the fan-out, the branching, and the intermediate results; child agents do the judgment, the script shards work and verifies. Do not write Rhai.
+
+**This turn fails unless `.dsh/workflows/<name>.workflow.json` exists.** Chat, repo walks, interviews, and live child launches are not a saved workflow.
+
+## Fast path (default)
+
+If `/create-workflow` already states a usable objective (what to do, and optionally how many agents / what fans out), skip the interview. Do not call `ask_user_question`. Do not explore the workspace first — child agents inspect the code at run time.
+
+In this same turn after the skill is loaded:
+
+1. Infer a kebab `meta.name`, project save scope (`.dsh/workflows/`) unless the user asks for a global/user workflow, and a simple fan-out. If they named an agent count, stay at or under it (default 8). Add adversarial verification only when it still fits that budget; otherwise skip it and say so.
+2. Author the `{ meta, script }` envelope as **plain JavaScript** (commas in object/array literals, never semicolons — `{ a: 1, b: 2 }` not `{ a: 1; b: 2 }`). `Unexpected token ';'` means you put `;` inside `{ ... }`. Prefer `complete(value)`. When output cardinality matters, declare it with the supported inclusive `minItems`/`maxItems` array bounds instead of relying only on prompt wording or clipping.
+3. Call the workflow tool with inline `script` + `meta`. Inline script **defaults to `validate_only`** (canned stubs, no live children) and **SAVES** after a passing smoke. Omit `save_scope` for project scope, or pass `save_scope: "user"` for `<dshHome>/workflows/`; user scope works even when the Session has no cwd. Do not pass `validate_only: false`. Do not launch `/workflow <name>` yet.
+4. If smoke fails with a parse error, fix commas and retry once. A successful inline authoring result always includes `saved_path`. If validation or saving fails (including a missing project cwd), report the error and fix or retry it; do not claim success or write a second, unvalidated copy manually. Use `save_scope: "user"` when a cwd-independent save is intended.
+5. Report the path, smoke limits, and `/workflow <name>`. Offer a live launch; do not start children until the user agrees.
+
+Copy this call shape (plain JS, commas, no `validate_only: false`):
+
+```js
+workflow({
+  meta: { name: "review-changes", description: "Review a diff and verify findings" },
+  script: "phase(\"Review\");\ncomplete({ ok: true });",
+  save_scope: "project",
+})
+```
+
+Ask in ordinary chat (not a picker) only when the objective is empty or contradictory. One short question max.
+
+## Required seven-stage procedure
+
+Use this only when the fast path cannot run because the objective is missing. Do not interview a user who already gave a brief.
+
+1. **Gather intent.** If the user already stated the objective, fan-out, and agent budget, skip this stage. Otherwise ask in chat for the missing piece only.
+2. **Design fan-out.** Identify independent agents, concurrency, labels, phase grouping, and maximum fan-out.
+3. **Design verification.** Add an adversarial or independent verification stage when the budget allows; missing, failed, or unusable verification is not a confirming vote. Require concrete evidence.
+4. **Choose the artifact and tolerance.** Decide whether results live inline or in scratch files and how `null` child failures affect the result. Optional advice may fail open; a proof gate fails closed.
+5. **Choose identity and scope.** Pick a lowercase kebab name (at most 64 UTF-16 code units, `^[a-z](?:[a-z0-9]*)(?:-[a-z0-9]+)*$`) and project (`.dsh/workflows/`, default, shareable) or user (`<dshHome>/workflows/`) save scope. Do not use `pause`, `resume`, `save`, `stop`, `workflow`, `workflows`, `create-workflow`, or a Windows device basename. When a name collides with another slash command, the existing command keeps `/<name>` and the saved workflow is advertised as `/workflow-<name>`; the host repeats the `workflow-` prefix if that name is also occupied. Canonical `/workflow <name>` always works.
+6. **Author and validate.** Write the strict envelope, then run inline `validate_only` with representative args and the chosen `save_scope` (`project` or `user`). Validation parses the entire script, then executes one args-selected canned path; it does not exercise all branches, live tools, or every possible agent output. A gate ends the smoke as `would pause: <message>`.
+7. **Publish and report.** Save only after validation succeeds. Report the file path, smoke result and its limits, launch syntax (`/<name>` or `/workflow <name> ...`), and maximum fan-out. Offer, but do not force, a real background launch watched in `/workflows`. If they decline, say only the path-specific smoke check ran.
+
+## File format
+
+A flat `<name>.workflow.json` file contains exactly `meta` and `script`. Metadata contains only `name`, `description`, optional `whenToUse`, and optional `phases`; a phase contains only `title`, optional `detail`, `provider`, and `model`. Metadata is JSON data beside the script and is never evaluated. Filename must equal `<meta.name>.workflow.json`. Unknown envelope, meta, or phase fields fail the whole observation.
+
+```json
+{
+  "meta": {
+    "name": "review-changes",
+    "description": "Review a diff across dimensions, adversarially verify each finding",
+    "whenToUse": "After a large diff, before merge",
+    "phases": [
+      { "title": "Review", "detail": "one reviewer per dimension" },
+      { "title": "Verify", "detail": "one skeptic per finding" }
+    ]
+  },
+  "script": "// plain JS body, top-level await, complete(value) or return value"
+}
+```
+
+## JavaScript hooks
+
+- `agent(prompt, { label?, phase?, schema?, provider?, model? })` returns final text or a schema-validated JSON object; an ordinary child failure returns `null`.
+- `parallel(thunksOrJobs)` is a barrier and preserves slot order. Items are zero-arg functions or job maps `{ prompt, label?, phase?, schema?, provider?, model? }`. Declarative job panels preflight the unreplayed panel atomically; arbitrary thunks use per-call admission. Failed slots resolve `null`.
+- `pipeline(items, ...stages)` advances items independently and preserves input order.
+- `phase(title)` and `log(message)` publish bounded progress.
+- `complete(jsonValue)` settles the first valid JSON result and stops later hooks. Prefer `complete()` over falling through. Stock workers have no native `complete`; this package injects one. `return jsonValue` also settles the run.
+- `await await_user(kind, message)` commits an acknowledged gate; `await pause(kind, message)` repeats after resume while its condition is unchanged. Both hooks are asynchronous and must be awaited.
+- `budget()` returns `{ total, spent, reserved: 0, remaining }`.
+- `write_scratch_file(name, content)` and `read_scratch_file(name)` use one safe filename.
+
+Supported schemas use `type`, `properties`, `required`, `additionalProperties`, `items`, `minItems`, `maxItems`, `enum`, `const`, and `oneOf`. `minItems` and `maxItems` are inclusive array-length bounds. Each must be a non-negative safe integer (not `-0`), may appear only on a `type: "array"` node, must satisfy `minItems <= maxItems`, and is forbidden beside `oneOf`. The package validates the authored schema before any child starts, removes only these two keywords from the provider-facing copy for stock RC2, and post-validates the returned structured value against the authored bounds.
+
+Replay uses immutable script, args, and a committed checkpoint. Replayed and schema-correction calls spend zero, but an external effect whose result was not committed can repeat. Keep prompts and external operations idempotent. Replay-capable scripts cannot use `Date`, `Math.random`, `Atomics`, `SharedArrayBuffer`, `WeakRef`, or `FinalizationRegistry`. There is no nested workflow hook.
+
+Default scratch quotas are 4,096 operations, 64 pending operations, 64 files, 1 MiB per file, and 8 MiB total. Default agent budget is 128 and the hard maximum is 1,024.
+
+## Good patterns
+
+- Build the fan-out work-list the simplest deterministic way (a fixed list, `args`, a file walk). Spend agents on judgment, not on deciding scope.
+- If an agent discovers the work-list, treat it as untrusted: re-filter it in plain JavaScript against the invariant (for example, keep only paths under `args.root`) before sharding.
+- Plan → parallel fan-out → synthesize.
+- Adversarial verification: independent skeptics prompted to refute each finding. Missing, failed, or unusable verification is not a confirming vote; require concrete evidence.
+- Loop until dry: spawn finders until two consecutive rounds surface nothing new; fingerprint each round to detect stalls.
+- Vote panels: N skeptics per item in one flat `parallel()`, regroup by index arithmetic.
+- Failure policy by purpose: optional advice may fail open; a proof gate fails closed.
+
+## Pitfalls that actually happen
+
+- Terse prompts return empty structured objects without using tools. Command tool use; say what a valid empty answer requires.
+- Guard every agent output against the schema value itself: for example, `r != null && Array.isArray(r.findings)`. A schema-backed `agent()` returns that structured object directly; failed `parallel()` slots are `null`.
+- Meta is pure data — no computed meta.
+- Keep `meta.phases` titles in sync with `phase()` calls.
+- `pause()` in a result-derived branch re-fires forever; use `await_user` for resumable human gates.
+- Silent truncation is not coverage; `log()` whatever a `MAX_*` cap dropped.
+- Agents do not enforce invariants — the script does. Filter and assert in JavaScript.
+- A complete `/create-workflow` brief is enough — do not stall on `ask_user_question` or a repo walk.
+- Do not pass `validate_only: false` while authoring. That launches live children and the parent tool call can sit for tens of minutes. Inline script already defaults to smoke + save.
+- When an array count is an invariant, use valid `minItems`/`maxItems`; prompt wording may guide generation but is not enforcement.
+- Do not put `meta` in JavaScript, use TypeScript/export syntax, add unsupported agent options such as `fork_context`, mix thunk and declarative parallel forms in one call, assume `null` is success, omit verification, hide truncation, use nondeterministic globals, use nested workflows, or claim validate-only exhaustively proves the workflow.
+
+## Example (review-changes)
+
+Meta is JSON data beside this body in the `{ "meta", "script" }` envelope:
+
+```json
+{
+  "name": "review-changes",
+  "description": "Review a diff across dimensions, adversarially verify each finding",
+  "whenToUse": "After a large diff, before merge",
+  "phases": [
+    { "title": "Review", "detail": "one reviewer per dimension" },
+    { "title": "Verify", "detail": "one skeptic per finding" }
+  ]
+}
+```
+
+```js
+const findingsSchema = { type: "object", required: ["findings"],
+  properties: { findings: { type: "array", maxItems: 8,
+    items: { type: "object", required: ["file", "issue"],
+      properties: { file: { type: "string" }, issue: { type: "string" } } } } } };
+const verdictSchema = { type: "object", required: ["real", "reason", "evidence"],
+  properties: { real: { type: "boolean" }, reason: { type: "string" },
+    evidence: { type: "string" } } };
+
+const target = args && args.target;
+if (target == null) await pause("verification", "Pass args.target — the diff, branch, or path to review.");
+
+phase("Review");
+const dimensions = ["correctness bugs", "error handling gaps", "performance problems"];
+const results = await parallel(dimensions.map((d) => async () => await agent(
+  "Review " + target + " for " + d + ". Use read-only tools to inspect the actual code — " +
+  "do not answer from memory. Report at most 8 concrete findings as {file, issue}; " +
+  "an empty list is valid only after you have read the code.",
+  { label: "review:" + d, schema: findingsSchema })));
+
+const findings = [];
+for (const r of results) {
+  if (r != null && Array.isArray(r.findings)) for (const f of r.findings) findings.push(f);
+}
+if (findings.length === 0) complete({ summary: "No findings.", confirmed: [] });
+
+phase("Verify");
+const verdicts = await parallel(findings.map((f) => async () => await agent(
+  "Adversarially verify this review finding by reading the shipped code: \"" +
+  f.issue + "\" in " + f.file + ". Set real=true only with concrete evidence you " +
+  "independently inspected. Otherwise default real=false.",
+  { label: "verify:" + f.file, schema: verdictSchema })));
+
+const confirmed = [];
+for (let i = 0; i < verdicts.length; i++) {
+  const v = verdicts[i];
+  if (v != null && v.real === true && v.evidence) confirmed.push(findings[i]);
+}
+log(String(confirmed.length) + "/" + String(findings.length) + " findings survived verification");
+complete({ summary: String(confirmed.length) + " confirmed findings", confirmed });
+```

package/vendor/workflow-engine/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 DeepSeek
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/vendor/workflow-engine/README.md

@@ -0,0 +1 @@
+Vendored from DeepSeek Harness workflow-worker-thread (MIT), enhanced workflow implementation commit 391c829343. Adapted for @zaalipro/dsh-workflows stock-host compatibility.