dsh-agent-plugins-market 0.7.2 → 0.8.1

package/lib/types/runtime/mcp-backend.d.ts

@@ -22,19 +22,26 @@ export type McpBackend = 'builtin' | 'host';
  * belong to {@link MARKET_SETTINGS_DEFAULTS}; this schema states them, it does
  * not own them.
  */
-export declare const MarketSettingsSchema: z<Schemastery.ObjectS<{
-    mcpEnhanced: z<boolean, boolean>;
-    scanProjectLayouts: z<boolean, boolean>;
-    downloadRegion: z<"auto" | "global" | "china", "auto" | "global" | "china">;
-    feedbackEnabled: z<boolean, boolean>;
-    autoUpdateSources: z<boolean, boolean>;
-}>, Schemastery.ObjectT<{
-    mcpEnhanced: z<boolean, boolean>;
-    scanProjectLayouts: z<boolean, boolean>;
-    downloadRegion: z<"auto" | "global" | "china", "auto" | "global" | "china">;
-    feedbackEnabled: z<boolean, boolean>;
-    autoUpdateSources: z<boolean, boolean>;
-}>>;
+export declare const MarketSettingsFields: {
+    readonly mcpEnhanced: z<boolean, boolean, "defined">;
+    readonly scanProjectLayouts: z<boolean, boolean, "defined">;
+    readonly downloadRegion: z<"auto" | "global" | "china", "auto" | "global" | "china", "defined">;
+    readonly feedbackEnabled: z<boolean, boolean, "defined">;
+    readonly autoUpdateSources: z<boolean, boolean, "defined">;
+};
+export declare const MarketSettingsSchema: z<Schemastery.ObjectS<NoInfer<{
+    readonly mcpEnhanced: z<boolean, boolean, "defined">;
+    readonly scanProjectLayouts: z<boolean, boolean, "defined">;
+    readonly downloadRegion: z<"auto" | "global" | "china", "auto" | "global" | "china", "defined">;
+    readonly feedbackEnabled: z<boolean, boolean, "defined">;
+    readonly autoUpdateSources: z<boolean, boolean, "defined">;
+}>>, Schemastery.ObjectT<NoInfer<{
+    readonly mcpEnhanced: z<boolean, boolean, "defined">;
+    readonly scanProjectLayouts: z<boolean, boolean, "defined">;
+    readonly downloadRegion: z<"auto" | "global" | "china", "auto" | "global" | "china", "defined">;
+    readonly feedbackEnabled: z<boolean, boolean, "defined">;
+    readonly autoUpdateSources: z<boolean, boolean, "defined">;
+}>>, "plain">;
 /** Path of the legacy persisted settings file under the plugin data root. */
 export declare function marketSettingsPath(dataRoot: string): string;
 /** Read the legacy persisted backend; absent or invalid values read as the default. */

package/lib/types/runtime/mcp-direct-config.d.ts

@@ -2,11 +2,7 @@ import { type McpSuiteConfig, type Suite } from '../model/types.js';
 export declare const USER_MCP_SOURCE = "@user-mcp";
 export declare const USER_MCP_SUITE = "user-mcp";
 /**
- * User-created services reuse the owned bridge lifecycle without changing host configuration.
- *
- * The declarations live in the shared Agent layout root
- * (`~/.agents/mcp.json`), so a service the user adds by hand is ordinary
- * `mcpServers` JSON in the same place other Agent tools look.
+ * Load the user's own MCP declaration file.
  *
  * The suite always carries an `mcp` document — an absent or malformed
  * `mcp.json` leaves an empty one — so callers read `.mcp.servers` directly

package/lib/types/runtime/plugin-message-source.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Message source this plugin declares for the bodies it injects as follow-up
+ * messages: suite command bodies and user command bodies ride the receiving
+ * agent's inbox with their producer identity attached. The host's message
+ * sources are merge-extensible — each producer declares its own kind through a
+ * module augmentation, and consumers fall through unknown kinds.
+ * @module runtime/plugin-message-source
+ */
+import type { UserMessage } from '@deepseek-ai/dsh-llm';
+/** Producer identity of every follow-up message this plugin injects. */
+export interface PluginMarketSource {
+    kind: 'plugin-market';
+    /** The injected body is author-written instruction text: a suite or user command body. */
+    form: 'instructions';
+}
+declare module '@deepseek-ai/dsh-llm' {
+    interface MessageSourceMap {
+        'plugin-market': PluginMarketSource;
+    }
+}
+/** Build the source for one follow-up message; fresh per message, no shared state. */
+export declare function pluginMarketSource(): PluginMarketSource;
+/** A follow-up message this plugin injects. */
+export type PluginMarketMessage = UserMessage;

package/lib/types/runtime/settings-namespace.d.ts

@@ -1,25 +1,39 @@
 /**
- * The host settings namespace this plugin registers.
+ * The market settings the host carries in this plugin's own config: the loader
+ * projects the entry's `Config` schema into the `dsh-agent-plugins-market`
+ * settings namespace, so the Plugins panel's configuration page reads and
+ * writes these five switches, and the host updates the volatile references in
+ * place on every change (emitting `loader/volatile-update`).
  *
- * The registration is also what makes the host's plugin-config tab serve this
- * plugin's card, and it carries the MCP mount backend, the download region,
- * the project-layout switch, the experience-feedback tool switch, and the
- * background source-update switch. `settings.register`
- * throws on a duplicate namespace, so there is exactly one inject block and one
- * registration.
- *
- * The whole callback is failure-contained on purpose: a throw inside it is
- * INVISIBLE in the UI (the inject resolves asynchronously and cordis only logs
- * it) and silently removes the namespace from `settings.describe`, which is
- * what hides the plugin-config card. Every failure mode lands in the logger
- * with a loud prefix instead.
+ * Every consumer reads through {@link MarketSettingsNamespace.settings} so
+ * "the field is absent" has exactly one answer —
+ * {@link resolveMarketSettings} — instead of each caller inventing its own
+ * fallback for the window before the host applies its first value.
  *
  * @module runtime/settings-namespace
  */
 import type { Context } from '@deepseek-ai/cordis';
 import { type DownloadRegionSetting } from '../contracts/settings.js';
 import type { HostTranslate } from './host-locale.js';
-import { type McpBackend } from './mcp-backend.js';
+import type { McpBackend } from './mcp-backend.js';
+/** The five volatile references the entry's config carries for this namespace. */
+export interface MarketSettingRefs {
+    mcpEnhanced: {
+        get(): boolean | undefined;
+    };
+    scanProjectLayouts: {
+        get(): boolean | undefined;
+    };
+    downloadRegion: {
+        get(): DownloadRegionSetting | undefined;
+    };
+    feedbackEnabled: {
+        get(): boolean | undefined;
+    };
+    autoUpdateSources: {
+        get(): boolean | undefined;
+    };
+}
 /** Runtime reactions the namespace drives. */
 export interface SettingsNamespaceHost {
     /** Apply the project-layout discovery switch; rejection is logged and contained. */
@@ -31,10 +45,10 @@ export interface SettingsNamespaceHost {
 }
 export declare class MarketSettingsNamespace {
     private readonly ctx;
+    private readonly refs;
     private readonly dataRoot;
     private readonly locale;
     private readonly host;
-    private scope;
     private readonly watchers;
     private feedbackDisposer;
     /**
@@ -44,31 +58,27 @@ export declare class MarketSettingsNamespace {
      * switch, or skipped because the host has no tools registry to register on.
      */
     private feedbackMountState;
-    constructor(ctx: Context, dataRoot: string, locale: {
+    constructor(ctx: Context, refs: MarketSettingRefs, dataRoot: string, locale: {
         t: HostTranslate;
     }, host: SettingsNamespaceHost);
-    /** Register the namespace; the host resolves it whenever the settings service mounts. */
+    /** Subscribe the runtime reactions to live settings updates. */
     mount(): void;
-    /** The persisted MCP backend choice; the built-in client until registration lands. */
+    /** Release every watcher and unmount the feedback tool. */
+    dispose(): void;
+    /**
+     * The resolved settings, from the volatile references the host updates in place.
+     */
+    private settings;
+    /** The persisted MCP backend choice; the built-in client until the host applies a value. */
     backend(): Promise<McpBackend>;
     /**
-     * Persist a backend choice.
-     * @throws when the settings service is not mounted.
+     * Legacy write path for the backend choice: the value now lives in the host
+     * settings document, edited from the Plugins panel's configuration page, so
+     * this accepts the request and lets the volatile reference decide.
      */
     setBackend(backend: McpBackend): Promise<void>;
     /** The persisted download-region setting. */
     downloadRegion(): Promise<DownloadRegionSetting>;
-    /**
-     * The resolved settings, whether or not the namespace is registered yet.
-     *
-     * Every reader goes through here so "the field is absent" has exactly one
-     * answer — {@link resolveMarketSettings} — instead of each caller inventing
-     * its own fallback for the window before registration lands.
-     */
-    private settings;
-    /** Release every watcher and unmount the feedback tool. */
-    dispose(): void;
-    private register;
     /** Apply the background source-update switch. */
     private syncAutoUpdateSources;
     private syncProjectLayouts;

package/lib/types/runtime/user-commands.d.ts

@@ -2,8 +2,11 @@
  * User command mounting: every enabled entry of the user commands panel
  * registers as a dsh slash command, so user-authored quick replies behave
  * exactly like suite commands — the body with `$ARGUMENTS` substituted rides
- * one follow-up message on the receiving agent. Reconciled on every catalog
- * change, keyed `user/<name>`.
+ * one follow-up message on the receiving agent. A nested entry registers
+ * under its flattened call name (`git/commit` → `git-commit`) while the panel
+ * keeps addressing it by path; when two entries flatten to one call name the
+ * first registers and the other is reported. Reconciled on every catalog
+ * change, keyed by the call name.
  * @module runtime/user-commands
  */
 import type { Context } from '@deepseek-ai/cordis';

package/lib/types/runtime/user-hooks.d.ts

@@ -0,0 +1,22 @@
+import { type Suite } from '../model/types.js';
+export declare const USER_HOOKS_SOURCE = "@user-hooks";
+export declare const USER_HOOKS_SUITE = "user-hooks";
+/**
+ * The Agent layout root's hook documents, relative to that root and read in
+ * order. Later files merge additively over earlier ones, the same order and
+ * semantics the project `.agents` layout applies. The first entry is also the
+ * suite's manifest path and the file a suite with no documents is addressed by.
+ */
+export declare const USER_HOOK_FILES: readonly [string, string];
+/** Resolve one Agent-layout-relative hook document against the layout root. */
+export declare function userHookPath(agentsRoot: string, file: string): string;
+/**
+ * Load the user's Agent layout hooks as one synthetic suite.
+ *
+ * The suite is always built, so one call answers with both the events and the
+ * reasons a document was rejected: an absent, malformed, or event-free set of
+ * hook files leaves `surfaces.hooks` at 0 and carries the diagnostics.
+ * {@link ../application/catalog.ts} merges the suite into the enabled set only
+ * when it declares events.
+ */
+export declare function loadUserHooksSuite(agentsRoot: string): Promise<Suite>;

package/lib/types/runtime/user-panels.d.ts

@@ -12,15 +12,21 @@
  * personas follow Claude Code agents frontmatter (`name`, `description`,
  * optional `whenToUse`, `tools`, `model`, `disabled`).
  *
- * Only the skills panel serves the cross-tool `<name>/SKILL.md` directory
- * spelling beside its own flat entries; commands and personas stay flat.
+ * Every panel reads the flat `<name>.md` children of its directory. The
+ * commands and agent-persona panels also read every `.md` document at any
+ * depth, addressing a nested entry by its path relative to the panel
+ * directory (`git/commit`, `review/code`), so subdirectories another Agent
+ * tool writes are picked up. The skills panel keeps the cross-tool
+ * `<name>/SKILL.md` directory spelling and reads it from the top level only,
+ * matching the harness's own reader of `~/.agents/skills`.
  *
  * An entry's name is the one its document declares — the same name the
- * harness reader derives from that file — and the panel addresses, edits, and
- * deletes the entry by that name. A document that reader would reject is
- * listed disabled with the reason instead of joining the catalog, and a skill
- * is switched off by writing that reader's own invocation controls, so the off
- * state lives in the file rather than in this provider.
+ * harness reader derives from that file — else its document name, and the
+ * panel addresses, edits, and deletes the entry by that name. A document that
+ * reader would reject is listed disabled with the reason instead of joining
+ * the catalog, and a skill is switched off by writing that reader's own
+ * invocation controls, so the off state lives in the file rather than in this
+ * provider.
  * @module runtime/user-panels
  */
 import type { SkillCandidate, SkillDefinition, SkillLookupOptions, SkillProvider } from '@deepseek-ai/dsh-skill';
@@ -29,7 +35,11 @@ import { type EntryShape, type UserEntryFile } from './user-store.js';
 export declare const USER_PANEL_SKILL_SOURCE = "user-panel";
 /** A user panel entry as the HTTP layer serializes it. */
 export interface UserPanelEntry {
-    /** Entry name: the name its document declares, else the file's base name (or the skill directory's). */
+    /**
+     * Entry name: the name its document declares, else its document name — the
+     * file's base name, or, on a nested panel, the document's path relative to
+     * the panel directory (`git/commit`).
+     */
     name: string;
     description: string;
     /** True when the entry is disabled, either by its `disabled` frontmatter key or by a failed validation. */
@@ -47,10 +57,16 @@ export interface UserPanelEntry {
 }
 /** How one panel store treats names and on-disk spellings. */
 export interface UserPanelStoreOptions {
-    /** Extra name grammar for this panel (runs after USER_ENTRY_NAME). */
+    /** Extra grammar one path segment must satisfy (runs after USER_ENTRY_NAME on each segment). */
     extraNameCheck?: (name: string) => boolean;
     /** The document spellings this panel serves, most preferred first. */
     shapes?: readonly EntryShape[];
+    /**
+     * Read every subdirectory of the panel directory and address an entry by its
+     * path relative to that directory. Off for the skills panel, whose reader
+     * sees top-level documents only.
+     */
+    nested?: boolean;
     /**
      * Rejection for a document this panel must not register, or `undefined` when
      * it may. Skills validate against the harness reader that shares their
@@ -72,17 +88,20 @@ export declare class UserPanelStore {
     private readonly kind;
     private readonly shapes;
     private readonly extraNameCheck;
+    private readonly namePattern;
+    private readonly nested;
     private readonly validate;
     private readonly honorInvocationControls;
     constructor(agentsRoot: string, kind: 'skills' | 'commands' | 'agents', options?: UserPanelStoreOptions);
     /** The panel's directory under the Agent layout root. */
     dirPath(): string;
     private get dir();
+    /** The path grammar plus the panel's per-segment extra grammar. */
     private validName;
     /**
      * Resolve the document one entry name addresses. The name a panel entry
-     * carries is the one its document declares, which is only the file name by
-     * convention, so a name that matches no path is matched against the
+     * carries is the one its document declares, which is only the document path
+     * by convention, so a name that matches no path is matched against the
      * declared names of the served documents.
      */
     private document;
@@ -101,7 +120,7 @@ export declare class UserPanelStore {
      * find or fix it.
      */
     private serialize;
-    /** Create an entry; refuses an occupied name. New entries use the flat spelling. */
+    /** Create an entry; refuses an occupied name. New entries use the flat `<name>.md` spelling, creating any parent directories. */
     create(name: string, text: string): Promise<UserPanelEntry>;
     /** Replace one entry's content wholesale, keeping the spelling it already has. */
     update(name: string, text: string): Promise<void>;
@@ -115,11 +134,12 @@ export declare function createUserPanelStores(agentsRoot: string): {
     agents: UserPanelStore;
 };
 /**
- * The skills/agents panels accept only harness skill-grammar names
+ * The skills/agents panels accept only harness skill-grammar path segments
  * (`[a-z0-9-]`, no underscores): a candidate name reaching the skill
  * registry's `get()` with an invalid name is dropped there, and several
- * consumers validate strictly, so `_`-named entries would be dead weight.
- * Commands keep the looser command grammar (`_` allowed).
+ * consumers validate strictly, so `_`-named entries would be dead weight. A
+ * nested persona applies this to each segment. Commands keep the looser
+ * command grammar (`_` allowed).
  */
 export declare function isUserSkillEntryName(name: string): boolean;
 /**

package/lib/types/runtime/user-store.d.ts

@@ -5,15 +5,25 @@
  * frontmatter rules the catalog uses, so user entries look exactly like suite
  * entries to the runtime mounts.
  *
- * An entry is one document. Skills also accept the cross-tool directory
- * spelling (`<name>/SKILL.md`) that other Agent tools and the harness's own
- * reader of `~/.agents/skills` author; commands and personas are flat only.
+ * An entry is one document. A flat panel reads the immediate `<name>.md`
+ * children of its directory; a nested panel (commands and agent personas)
+ * reads every `.md` document at any depth and names each by its path relative
+ * to that directory. Skills also accept the cross-tool directory spelling
+ * (`<name>/SKILL.md`) that other Agent tools and the harness's own reader of
+ * `~/.agents/skills` author, and read it from the top level only.
  * @module runtime/user-store
  */
 /** Where user panel entries persist: `<agentsRoot>/<kind>/`. */
 export declare function userEntryDir(agentsRoot: string, kind: 'skills' | 'commands' | 'agents'): string;
-/** `[a-z][a-z0-9_-]*` — the grammar every panel entry name must satisfy. */
+/** `[a-z][a-z0-9_-]*` — one segment of a panel entry name. */
 export declare const USER_ENTRY_NAME: RegExp;
+/**
+ * The path grammar a nested panel entry name satisfies: one or more
+ * {@link USER_ENTRY_NAME} segments joined by `/`. It rejects `..`, leading or
+ * trailing separators, empty segments, backslashes, and uppercase, so the name
+ * stays a path relative to the panel directory.
+ */
+export declare const USER_ENTRY_PATH: RegExp;
 /** The file name of a directory-shaped skill's document. */
 export declare const SKILL_ENTRY_FILE = "SKILL.md";
 /**
@@ -42,11 +52,18 @@ export interface EntryDocument {
 }
 /**
  * Resolve one entry name to its document, taking the first shape the path
- * exists in. Names outside the entry grammar never touch the filesystem.
+ * exists in. A nested panel accepts a path name (`git/commit`); a flat panel
+ * accepts a single segment. Names outside the panel's grammar never touch the
+ * filesystem.
+ */
+export declare function resolveEntryDocument(dir: string, name: string, shapes: readonly EntryShape[], strict?: boolean, nested?: boolean): Promise<EntryDocument | undefined>;
+/**
+ * Every entry document the served shapes expose. A flat panel reads immediate
+ * children only; a nested panel walks every subdirectory to any depth and
+ * names each entry by its path relative to `dir`. Entries are deduplicated by
+ * name at the first shape that has it.
  */
-export declare function resolveEntryDocument(dir: string, name: string, shapes: readonly EntryShape[], strict?: boolean): Promise<EntryDocument | undefined>;
-/** Every entry document the served shapes expose, deduplicated by name at the first shape that has it. */
-export declare function listEntryDocuments(dir: string, strict?: boolean, shapes?: readonly EntryShape[]): Promise<EntryDocument[]>;
+export declare function listEntryDocuments(dir: string, strict?: boolean, shapes?: readonly EntryShape[], nested?: boolean): Promise<EntryDocument[]>;
 /** Parse full YAML metadata without flattening arrays, mappings, or multiline strings. */
 export declare function parseFrontmatterRecord(text: string): Record<string, unknown>;
 /** Read one resolved entry; strict runtime snapshots throw on I/O errors other than a vanished file. */
@@ -79,7 +96,7 @@ export interface UserEntryFile {
     };
 }
 /** List entries across the served shapes; strict runtime snapshots propagate I/O errors instead of publishing partial inventories. */
-export declare function listEntryFiles(dir: string, strict?: boolean, shapes?: readonly EntryShape[]): Promise<UserEntryFile[]>;
+export declare function listEntryFiles(dir: string, strict?: boolean, shapes?: readonly EntryShape[], nested?: boolean): Promise<UserEntryFile[]>;
 /** Create one panel entry's document from its name: `<name>.md`, or `<name>/SKILL.md` in the directory shape. */
 export declare function writeEntryFile(dir: string, name: string, text: string, shape?: EntryShape): Promise<void>;
 /** Replace one resolved entry's document in place, wherever it lives. */
@@ -93,6 +110,6 @@ export declare function writeEntryDocument(document: EntryDocument, text: string
  */
 export declare function deleteEntryDocument(document: EntryDocument): Promise<void>;
 /** Whether an entry document with that name exists in any served shape. */
-export declare function entryExists(dir: string, name: string, shapes?: readonly EntryShape[]): Promise<boolean>;
+export declare function entryExists(dir: string, name: string, shapes?: readonly EntryShape[], nested?: boolean): Promise<boolean>;
 /** Serialize a frontmatter block from a shallow record (deterministic key order). */
 export declare function serializeFrontmatter(meta: Record<string, unknown>): string;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-agent-plugins-market",
-  "description": "The standard way to install Claude Code / Codex / Cursor / Kimi plugin marketplace suites in DeepSeek Harness (DSH) — zero conversion, zero file copying. Skills, MCP servers, hooks and slash commands are injected into your dsh sessions at runtime.",
-  "version": "0.7.2",
+  "description": "One-stop skills, subagent, MCP and LSP manager inside DeepSeek Harness (DSH), compatible with Claude Code, Codex, Cursor, Kimi and other agent plugin layouts.",
+  "version": "0.8.1",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",
@@ -74,16 +74,17 @@
     "ai-agents"
   ],
   "peerDependencies": {
-    "@deepseek-ai/cordis": "^4.0.2",
-    "@deepseek-ai/dsh-attachment": "^0.1.5-rc.2",
-    "@deepseek-ai/dsh-credentials": "^0.1.5-rc.2",
-    "@deepseek-ai/dsh-hooks-claude-code": "^0.1.5-rc.2",
-    "@deepseek-ai/dsh-llm": "^0.1.5-rc.2",
-    "@deepseek-ai/dsh-mcp-client": "^0.1.5-rc.2",
-    "@deepseek-ai/dsh-skill": "^0.1.5-rc.2",
-    "@deepseek-ai/dsh-subprocess": "^0.1.5-rc.2",
-    "@deepseek-ai/dsh-timeout": "^0.1.5-rc.2",
-    "@deepseek-ai/dsh-tools": "^0.1.5-rc.2"
+    "@deepseek-ai/cordis": "~4.0.4",
+    "@deepseek-ai/dsh-attachment": "^0.1.7-rc.1",
+    "@deepseek-ai/dsh-credentials": "^0.1.7-rc.1",
+    "@deepseek-ai/dsh-hooks-claude-code": "^0.1.7-rc.1",
+    "@deepseek-ai/dsh-llm": "^0.1.7-rc.1",
+    "@deepseek-ai/dsh-mcp-client": "^0.1.7-rc.1",
+    "@deepseek-ai/dsh-skill": "^0.1.7-rc.1",
+    "@deepseek-ai/dsh-subprocess": "^0.1.7-rc.1",
+    "@deepseek-ai/dsh-timeout": "^0.1.7-rc.1",
+    "@deepseek-ai/dsh-tools": "^0.1.7-rc.1",
+    "@deepseek-ai/dsh-util-workspace-path": "^0.1.7-rc.1"
   },
   "peerDependenciesMeta": {
     "@deepseek-ai/dsh-hooks-claude-code": {
@@ -97,12 +98,12 @@
     }
   },
   "dependencies": {
-    "@deepseek-ai/dsh-atomic-write": "^0.1.5-rc.2",
-    "@deepseek-ai/dsh-home-paths": "^0.1.5-rc.2",
-    "@deepseek-ai/dsh-lsp": "^0.1.5-rc.2",
-    "@deepseek-ai/dsh-lsp-stdio": "^0.1.5-rc.2",
-    "@deepseek-ai/dsh-tool-lsp": "^0.1.5-rc.2",
-    "@deepseek-ai/schemastery": "^3.18.2",
+    "@deepseek-ai/dsh-atomic-write": "^0.1.7-rc.1",
+    "@deepseek-ai/dsh-home-paths": "^0.1.7-rc.1",
+    "@deepseek-ai/dsh-lsp": "^0.1.7-rc.1",
+    "@deepseek-ai/dsh-lsp-stdio": "^0.1.7-rc.1",
+    "@deepseek-ai/dsh-tool-lsp": "^0.1.7-rc.1",
+    "@deepseek-ai/schemastery": "^3.18.4",
     "@modelcontextprotocol/sdk": "^1.30.0",
     "ajv": "^8.17.1",
     "fflate": "^0.8.3",
@@ -117,19 +118,23 @@
     "@codemirror/language": "^6.12.4",
     "@codemirror/state": "^6.7.5",
     "@codemirror/view": "^6.43.12",
-    "@deepseek-ai/cordis": "^4.0.2",
-    "@deepseek-ai/dsh-attachment": "0.1.5-rc.2",
-    "@deepseek-ai/dsh-client-store": "0.1.5-rc.2",
-    "@deepseek-ai/dsh-client-ui-primitives": "0.1.5-rc.2",
-    "@deepseek-ai/dsh-client-ui-settings": "0.1.5-rc.2",
-    "@deepseek-ai/dsh-credentials": "0.1.5-rc.2",
-    "@deepseek-ai/dsh-hooks-claude-code": "0.1.5-rc.2",
-    "@deepseek-ai/dsh-llm": "0.1.5-rc.2",
-    "@deepseek-ai/dsh-mcp-client": "0.1.5-rc.2",
-    "@deepseek-ai/dsh-skill": "0.1.5-rc.2",
-    "@deepseek-ai/dsh-subprocess": "0.1.5-rc.2",
-    "@deepseek-ai/dsh-timeout": "0.1.5-rc.2",
-    "@deepseek-ai/dsh-tools": "0.1.5-rc.2",
+    "@deepseek-ai/cordis": "~4.0.4",
+    "@deepseek-ai/dsh-attachment": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-store": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-ui-plugin-manager": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-ui-primitives": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-ui-settings": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-ui-slots": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-credentials": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-hooks-claude-code": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-llm": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-mcp-client": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-skill": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-subprocess": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-timeout": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-tools": "0.1.7-rc.1",
+    "@deepseek-ai/dsh-util-workspace-path": "0.1.7-rc.1",
+    "@deepseek-ai/cosmokit": "^1.8.5",
     "@eslint/js": "^10.0.1",
     "@shikijs/langs": "^4.4.3",
     "@tsdown/css": "^0.22.14",
@@ -140,6 +145,7 @@
     "anser": "^2.3.5",
     "clsx": "^2.1.1",
     "dependency-cruiser": "^18.4.0",
+    "diff": "^9.0.0",
     "eslint": "^10.9.1",
     "immer": "^11.1.18",
     "jsdom": "^30.0.1",
@@ -159,6 +165,7 @@
     "react": "^18.3.1",
     "react-dom": "~18.3.1",
     "shiki": "^4.4.3",
+    "simple-icons": "^16.31.0",
     "tsdown": "^0.22.14",
     "typescript": "^5.8.3",
     "typescript-eslint": "^8.67.0",

package/schemas/com.deepseek.harness/spec.md

@@ -27,7 +27,7 @@ Namespace values are the suite's defaults rather than a ceiling the user cannot
 
 ## User-owned declarations
 
-`~/.agents/mcp.json` is local data rather than a distributable package. Keys this client does not know are stored back exactly as written, and the package-only rules — a closed server shape, bare command names, plugin-relative paths — do not apply to it. A suite's packaged `mcp.json` keeps every one of them, because a package carrying fields this client cannot honour is one it cannot promise to mount.
+`~/.agents/mcp.json` is local data rather than a distributable package. Keys this client does not know are stored back exactly as written, and the package-only rules — a closed server shape, bare command names, plugin-relative paths — do not apply to it. A suite's packaged `mcp.json` keeps every one of them, because a package carrying fields this client cannot honour is one it cannot promise to mount. `$schema` is optional here: a file another Agent tool wrote is read as this release's dialect when the key is absent, and a declared version this client does not recognize is rejected.
 
 The editor reads the same two seats a suite declares, for one server at a time: the portable definition under `mcpServers` and this client's policy under `com.deepseek.harness`. The form writes only the half it owns, so a field it has no control for — a key another client introduced, a policy entry the form does not show — survives both a form edit and a JSON edit. Only the policy entries the user changed are sent on save; an entry the document drops asks for inheritance.