dsh-continual-evolve 0.13.0 → 0.14.1

package/lib/card-routes.d.ts

@@ -1,7 +1,8 @@
-import type { KnownWorkspaces } from "./known-workspaces.js";
+import type { WorkspaceCatalog } from "./workspace-catalog.js";
 /** URL prefix of the card API (kind-exact routes registered under it). */
 export declare const CARD_API_WORKSPACES_PATH = "/dsh-continual-evolve/api/v1/workspaces";
 export declare const CARD_API_MEMORY_PATH = "/dsh-continual-evolve/api/v1/memory";
+export declare const CARD_API_MEMORY_FILE_PATH = "/dsh-continual-evolve/api/v1/memory/file";
 /** Minimal request shape the handlers touch (Node IncomingMessage subset). */
 export interface CardRequest {
     method?: string;
@@ -28,5 +29,5 @@ export interface CardWebServer {
  * shape the host hands back (or none, as on some host versions), the
  * disposer calls only the functions among them.
  */
-export declare function mountCardRoutes(webServer: CardWebServer, workspaces: KnownWorkspaces): () => void;
+export declare function mountCardRoutes(webServer: CardWebServer, catalog: WorkspaceCatalog): () => void;
 //# sourceMappingURL=card-routes.d.ts.map

package/lib/card-routes.js

@@ -3,17 +3,21 @@
  *
  * Mounted through the host's `webServer` service (same registration shape
  * dshmarket uses: `kind: "exact"` routes on the profile's web server), the
- * two endpoints are GET-only projections: the workspace allowlist and, for a
- * known root, the memory snapshot. The allowlist IS the security fence — the
- * memory endpoint resolves its `root` parameter only against roots the
- * running process has actually served, so the API cannot read arbitrary
- * paths. Handlers are synchronous and never throw past the response.
+ * three endpoints are GET-only projections: the workspace catalogue, the
+ * memory snapshot for a known root, and one memory file's body for the card's
+ * content preview. The catalogue IS the security fence — the memory endpoints
+ * resolve their `root` parameter only against workspaces the host's registry
+ * (or, on hosts without one, a root this process has served) knows about, and
+ * the file endpoint additionally accepts only plain .md entries of that
+ * workspace's memory directory, so the API cannot read arbitrary paths.
+ * Handlers are synchronous and never throw past the response.
  */
 import { resolve } from "node:path";
-import { memorySnapshot } from "./memory-snapshot.js";
+import { memoryFileContent, memorySnapshot } from "./memory-snapshot.js";
 /** URL prefix of the card API (kind-exact routes registered under it). */
 export const CARD_API_WORKSPACES_PATH = "/dsh-continual-evolve/api/v1/workspaces";
 export const CARD_API_MEMORY_PATH = "/dsh-continual-evolve/api/v1/memory";
+export const CARD_API_MEMORY_FILE_PATH = "/dsh-continual-evolve/api/v1/memory/file";
 function sendJson(response, status, body) {
     response.writeHead(status, { "content-type": "application/json; charset=utf-8" });
     response.end(JSON.stringify(body));
@@ -27,7 +31,7 @@ function isGet(request) {
  * shape the host hands back (or none, as on some host versions), the
  * disposer calls only the functions among them.
  */
-export function mountCardRoutes(webServer, workspaces) {
+export function mountCardRoutes(webServer, catalog) {
     const disposers = [];
     disposers.push(webServer.register({
         kind: "exact",
@@ -38,7 +42,9 @@ export function mountCardRoutes(webServer, workspaces) {
                 response.end();
                 return;
             }
-            sendJson(response, 200, { workspaces: workspaces.list() });
+            // The listed set is the display projection (workspaces with a
+            // memory directory); the read fence is `known` below.
+            sendJson(response, 200, { workspaces: catalog.list() });
         },
     }));
     disposers.push(webServer.register({
@@ -55,16 +61,66 @@ export function mountCardRoutes(webServer, workspaces) {
                 sendJson(response, 400, { error: "root query parameter is required and must be an absolute path" });
                 return;
             }
-            const known = workspaces.list().find((workspace) => workspace.root === resolve(root));
+            const known = knownEntryOf(catalog, root);
             if (known === undefined) {
-                // The allowlist answers 404 without distinguishing "never
-                // served" from "wrong path": no filesystem oracle here.
+                // The catalogue answers 404 without distinguishing "not a
+                // workspace here" from "wrong path": no filesystem oracle.
                 sendJson(response, 404, { error: "unknown workspace root" });
                 return;
             }
             sendJson(response, 200, memorySnapshot(known.root));
         },
     }));
+    disposers.push(webServer.register({
+        kind: "exact",
+        path: CARD_API_MEMORY_FILE_PATH,
+        handler(request, response) {
+            if (!isGet(request)) {
+                response.writeHead(405, { allow: "GET" });
+                response.end();
+                return;
+            }
+            const root = rootParamOf(request);
+            if (root === null) {
+                sendJson(response, 400, { error: "root query parameter is required and must be an absolute path" });
+                return;
+            }
+            const file = fileParamOf(request);
+            if (file === null) {
+                sendJson(response, 400, { error: "file query parameter is required" });
+                return;
+            }
+            const known = knownEntryOf(catalog, root);
+            if (known === undefined) {
+                // Same fence as the snapshot route: 404 without distinguishing
+                // "not a workspace here" from "wrong path".
+                sendJson(response, 404, { error: "unknown workspace root" });
+                return;
+            }
+            const content = memoryFileContent(known.root, file);
+            if (!content.ok) {
+                // The fence reasons stay indistinguishable from absence in status
+                // terms only where safe: "outside" answers 400 (a client bug),
+                // absence 404, oversized 413 — never a body leak either way.
+                if (content.reason === "outside") {
+                    sendJson(response, 400, { error: "file must be a plain .md entry of the memory directory" });
+                }
+                else if (content.reason === "too-large") {
+                    sendJson(response, 413, { error: "memory file exceeds the 5 MiB preview limit" });
+                }
+                else {
+                    sendJson(response, 404, { error: "memory file not found" });
+                }
+                return;
+            }
+            sendJson(response, 200, {
+                file: content.file,
+                content: content.content,
+                mtimeMs: content.mtimeMs,
+                changed: content.changed,
+            });
+        },
+    }));
     return () => {
         for (const disposer of disposers) {
             if (typeof disposer === "function") {
@@ -73,6 +129,11 @@ export function mountCardRoutes(webServer, workspaces) {
         }
     };
 }
+/** The catalogued workspace a `root` query parameter resolves to, if any. */
+function knownEntryOf(catalog, root) {
+    const target = resolve(root);
+    return catalog.known().find((workspace) => workspace.root === target);
+}
 /** The decoded `root` query parameter, or null when absent/relative. */
 function rootParamOf(request) {
     try {
@@ -89,4 +150,19 @@ function rootParamOf(request) {
         return null;
     }
 }
+/** The decoded `file` query parameter, or null when absent. */
+function fileParamOf(request) {
+    try {
+        const url = new URL(request.url ?? "/", "http://dsh-card.invalid");
+        const file = url.searchParams.get("file");
+        if (file === null || file.trim().length === 0) {
+            return null;
+        }
+        return file;
+    }
+    catch (error) {
+        void error;
+        return null;
+    }
+}
 //# sourceMappingURL=card-routes.js.map

package/lib/index.d.ts

@@ -9,12 +9,13 @@
  * background extraction, and no governance. See
  * .agents/notes/implemented/architecture/2026-10-04-zcode-alignment-teardown.md.
  *
- * The 2026-10-04 plugin-management card adds a read-only surface: the
- * workspace roots the section has served feed an in-memory allowlist, and a
- * `webServer` route pair projects any known workspace's store for the card
- * in the official plugin manager (`plugins.bundle.config`, client bundle in
- * client/client.js). The card is a viewer — see
- * .agents/notes/implemented/feature/2026-10-04-plugin-management-card.md.
+ * The 2026-10-04 plugin-management card adds a read-only surface: the host's
+ * workspace registry feeds a catalogue, and a `webServer` route triple projects
+ * any catalogued workspace's store for the card in the official plugin manager
+ * (`plugins.bundle.config`, client bundle in client/client.js). The card is a
+ * viewer — see
+ * .agents/notes/implemented/feature/2026-10-04-plugin-management-card.md and
+ * .agents/notes/implemented/feature/2026-10-05-zcode-workspace-switcher.md.
  *
  * The host API surface is declared locally (the minimal shape this plugin
  * touches) instead of importing the DSH type packages — the section call is

package/lib/index.js

@@ -9,12 +9,13 @@
  * background extraction, and no governance. See
  * .agents/notes/implemented/architecture/2026-10-04-zcode-alignment-teardown.md.
  *
- * The 2026-10-04 plugin-management card adds a read-only surface: the
- * workspace roots the section has served feed an in-memory allowlist, and a
- * `webServer` route pair projects any known workspace's store for the card
- * in the official plugin manager (`plugins.bundle.config`, client bundle in
- * client/client.js). The card is a viewer — see
- * .agents/notes/implemented/feature/2026-10-04-plugin-management-card.md.
+ * The 2026-10-04 plugin-management card adds a read-only surface: the host's
+ * workspace registry feeds a catalogue, and a `webServer` route triple projects
+ * any catalogued workspace's store for the card in the official plugin manager
+ * (`plugins.bundle.config`, client bundle in client/client.js). The card is a
+ * viewer — see
+ * .agents/notes/implemented/feature/2026-10-04-plugin-management-card.md and
+ * .agents/notes/implemented/feature/2026-10-05-zcode-workspace-switcher.md.
  *
  * The host API surface is declared locally (the minimal shape this plugin
  * touches) instead of importing the DSH type packages — the section call is
@@ -24,6 +25,7 @@ import z from "@deepseek-ai/schemastery";
 import { mountCardRoutes } from "./card-routes.js";
 import { createKnownWorkspaces } from "./known-workspaces.js";
 import { createFrozenMemorySection, cwdOf, DEFAULT_MAX_CHARS, DEFAULT_MEMORY_SECTION_ORDER, MEMORY_SECTION_NAME, memorySectionText, } from "./memory-section.js";
+import { createWorkspaceCatalog } from "./workspace-catalog.js";
 export const name = "continual-evolve";
 export const inject = ["systemPrompt"];
 export const Config = z.object({
@@ -53,9 +55,12 @@ export const Config = z.object({
 /**
  * Mount the card routes on the host web server through a nested inject, so
  * the plugin stays mountable on hosts without that service. Called only when
- * the card is enabled.
+ * the card is enabled. The workspace registry is looked up inside the scoped
+ * context (nothing else injects it: a host without the service must still get
+ * the card) and read per request, so a workspace created while the card is
+ * open appears on the next refresh.
  */
-function mountCardWhenAvailable(host, workspaces) {
+function mountCardWhenAvailable(host, served) {
     const nested = host;
     if (typeof nested.inject !== "function") {
         host.logger("continual-evolve").warn("host context exposes no inject — memory card routes not mounted (memory section unaffected)");
@@ -67,9 +72,36 @@ function mountCardWhenAvailable(host, workspaces) {
             host.logger("continual-evolve").warn("webServer service present but empty — memory card routes not mounted (memory section unaffected)");
             return;
         }
-        mountCardRoutes(webServer, workspaces);
+        const catalog = createWorkspaceCatalog({
+            registry: registryLookup(scoped),
+            served: served,
+            homeDir: process.env.DSH_HOME,
+        });
+        mountCardRoutes(webServer, catalog);
     });
 }
+/**
+ * A live `ctx.workspaceRegistry` getter over the scoped context. The service
+ * is a sibling, so it is reached with `ctx.get` (property access only walks
+ * fiber ancestors) and treated as optional: an absent, foreign or throwing
+ * service degrades the catalogue to its fallback sources instead of taking the
+ * card down.
+ */
+function registryLookup(scoped) {
+    const context = scoped;
+    return () => {
+        if (typeof context.get !== "function") {
+            return undefined;
+        }
+        try {
+            const service = context.get("workspaceRegistry");
+            return service === undefined || service === null ? undefined : service;
+        }
+        catch {
+            return undefined;
+        }
+    };
+}
 export function apply(host, config) {
     if (config.memoryIndex?.enabled === false) {
         return;

package/lib/memory-snapshot.d.ts

@@ -1,11 +1,18 @@
 /** The index file name (same store contract as the injection path). */
 export declare const MEMORY_SNAPSHOT_INDEX_FILE = "MEMORY.md";
+/**
+ * Preview size cap for the file content endpoint — files above it answer
+ * `too-large` instead of their body (ZCode's memory viewer uses the same 5 MiB).
+ */
+export declare const MEMORY_FILE_PREVIEW_LIMIT: number;
 /** One memory file with its frontmatter fields ("" when absent). */
 export interface MemoryFileInfo {
     file: string;
     name: string;
     description: string;
     type: string;
+    /** File modification time in epoch milliseconds (the card's "updated" line). */
+    updatedAt: number;
 }
 /** One parsed index row: `- [title](file.md) — hook`. */
 export interface MemoryIndexRow {
@@ -51,4 +58,25 @@ export declare function parseMemoryFrontmatter(text: string): MemoryFrontmatter;
  * card must observe, never break.
  */
 export declare function memorySnapshot(root: string): MemorySnapshot;
+/** The content endpoint's outcomes: the body, or why there is none. */
+export type MemoryFileContent = {
+    ok: true;
+    file: string;
+    content: string;
+    mtimeMs: number;
+    changed: boolean;
+} | {
+    ok: false;
+    reason: "outside" | "absent" | "too-large";
+};
+/**
+ * Read one memory file's body for the card's content preview — the viewer
+ * side of the same read-only fence as `memorySnapshot`. The requested file
+ * name must be a plain entry of the workspace's memory directory (no path
+ * separators, no traversal, resolved location stays inside the directory);
+ * anything else answers `outside` without touching the filesystem, so the
+ * endpoint cannot become a path oracle. Oversized files answer `too-large`
+ * with the body unread.
+ */
+export declare function memoryFileContent(root: string, file: string): MemoryFileContent;
 //# sourceMappingURL=memory-snapshot.d.ts.map

package/lib/memory-snapshot.js

@@ -4,11 +4,16 @@
  * card is a viewer, never a second store: no caching, no writes, no bootstrap
  * (unlike the injection path, a missing store is reported, not created).
  */
-import { existsSync, readdirSync, readFileSync } from "node:fs";
-import { join, resolve } from "node:path";
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { basename, join, resolve } from "node:path";
 import { memoryDirFor } from "./memory-section.js";
 /** The index file name (same store contract as the injection path). */
 export const MEMORY_SNAPSHOT_INDEX_FILE = "MEMORY.md";
+/**
+ * Preview size cap for the file content endpoint — files above it answer
+ * `too-large` instead of their body (ZCode's memory viewer uses the same 5 MiB).
+ */
+export const MEMORY_FILE_PREVIEW_LIMIT = 5 * 1024 * 1024;
 /**
  * Parse `- [title](file.md) …` rows out of an index text. Anything else
  * (headings, the bootstrap hint comment, blank lines) is ignored.
@@ -67,7 +72,8 @@ function readStoreState(memoryDir) {
     const diskFiles = listStoreFiles(memoryDir);
     const files = diskFiles.map((file) => {
         const frontmatter = parseMemoryFrontmatter(readFileSync(join(memoryDir, file), "utf8"));
-        return { file, name: frontmatter.name, description: frontmatter.description, type: frontmatter.type };
+        const updatedAt = statSync(join(memoryDir, file)).mtimeMs;
+        return { file, name: frontmatter.name, description: frontmatter.description, type: frontmatter.type, updatedAt };
     });
     return { indexRows: parseMemoryIndexRows(indexText), diskFiles, files };
 }
@@ -122,4 +128,52 @@ export function memorySnapshot(root) {
         readError: null,
     };
 }
+/**
+ * Read one memory file's body for the card's content preview — the viewer
+ * side of the same read-only fence as `memorySnapshot`. The requested file
+ * name must be a plain entry of the workspace's memory directory (no path
+ * separators, no traversal, resolved location stays inside the directory);
+ * anything else answers `outside` without touching the filesystem, so the
+ * endpoint cannot become a path oracle. Oversized files answer `too-large`
+ * with the body unread.
+ */
+export function memoryFileContent(root, file) {
+    const memoryDir = memoryDirFor(resolve(root));
+    if (file.length === 0 ||
+        !file.endsWith(".md") ||
+        file.includes("/") ||
+        file.includes("\\") ||
+        basename(file) !== file) {
+        return { ok: false, reason: "outside" };
+    }
+    const target = resolve(memoryDir, file);
+    if (!target.startsWith(memoryDir + "/") && target !== memoryDir) {
+        return { ok: false, reason: "outside" };
+    }
+    let before;
+    try {
+        before = statSync(target);
+    }
+    catch {
+        return { ok: false, reason: "absent" };
+    }
+    if (!before.isFile()) {
+        return { ok: false, reason: "absent" };
+    }
+    if (before.size > MEMORY_FILE_PREVIEW_LIMIT) {
+        return { ok: false, reason: "too-large" };
+    }
+    let content;
+    try {
+        content = readFileSync(target, "utf8");
+    }
+    catch {
+        return { ok: false, reason: "absent" };
+    }
+    // The file may have been rewritten between stat and read — surface that
+    // instead of silently showing stale bytes (same guard shape as ZCode's
+    // memory viewer's "changed during read" state).
+    const after = statSync(target);
+    return { ok: true, file, content, mtimeMs: after.mtimeMs, changed: after.mtimeMs !== before.mtimeMs };
+}
 //# sourceMappingURL=memory-snapshot.js.map

package/lib/workspace-catalog.d.ts

@@ -0,0 +1,30 @@
+import type { KnownWorkspaces } from "./known-workspaces.js";
+/** One workspace the card knows: canonical root plus its display label. */
+export interface CatalogEntry {
+    root: string;
+    /** Display title from the registry, else the directory name. */
+    label: string;
+}
+/** The read fence (`known`) and the listed set (`list`). */
+export interface WorkspaceCatalog {
+    /** Every workspace the card may read, in registry order. */
+    known(): CatalogEntry[];
+    /** The known workspaces that currently have a memory directory. */
+    list(): CatalogEntry[];
+}
+/** The slice of `ctx.workspaceRegistry` this plugin consumes. */
+export interface WorkspaceRegistryLike {
+    list(): unknown;
+}
+/** Where the catalog gets its workspace records, in precedence order. */
+export interface WorkspaceCatalogOptions {
+    /** Live registry lookup; undefined when the host exposes no registry. */
+    registry?: (() => WorkspaceRegistryLike | undefined) | undefined;
+    /** The roots this process served — the last-resort source. */
+    served: KnownWorkspaces;
+    /** Harness home; enables the `storages/workspace.json` fallback when set. */
+    homeDir?: string | undefined;
+}
+/** Create the catalog over the given sources. */
+export declare function createWorkspaceCatalog(options: WorkspaceCatalogOptions): WorkspaceCatalog;
+//# sourceMappingURL=workspace-catalog.d.ts.map

package/lib/workspace-catalog.js

@@ -0,0 +1,149 @@
+/**
+ * The card's workspace catalog — which workspaces the card may read, and which
+ * of them it lists.
+ *
+ * The list comes from the host's workspace registry (`ctx.workspaceRegistry`,
+ * the durable records the workspace picker itself renders), not from the
+ * sessions this process happened to serve: a card that only knows its own
+ * session history can never offer ZCode's workspace switching — with one
+ * served root the selector has nothing to switch to. The served-roots map
+ * stays as a source (a session in a workspace the registry does not know about
+ * still shows up), and `storages/workspace.json` is read only when the
+ * registry service yields nothing: that file is an internal format, so it is a
+ * fallback, never the primary.
+ *
+ * Two questions, deliberately answered by two methods. `known()` is the read
+ * fence: can this root be read at all? `list()` is the display projection:
+ * which workspaces have a memory directory right now? ZCode's viewer lists
+ * only workspaces that have one, but the fence cannot be that filter — a store
+ * deleted between listing and read must degrade to the empty state on its own
+ * entry, not turn the read into a 404.
+ */
+import { lstatSync, readFileSync, realpathSync } from "node:fs";
+import { basename, join, resolve } from "node:path";
+import { memoryDirFor } from "./memory-section.js";
+/** The registry stores `fs.realpath` already; resolve the rest the same way. */
+function canonicalPath(path) {
+    try {
+        return realpathSync(path);
+    }
+    catch {
+        // A vanished or unreadable directory keeps its resolved spelling: the
+        // registry itself never rewrites a record when its directory disappears.
+        return resolve(path);
+    }
+}
+/** One catalogue entry from a path/title pair, or undefined when unusable. */
+function entryOf(path, title) {
+    if (typeof path !== "string" || path.trim().length === 0) {
+        return undefined;
+    }
+    const root = canonicalPath(path);
+    const label = typeof title === "string" && title.trim().length > 0 ? title.trim() : basename(root);
+    return { root, label };
+}
+/** Records from the live registry service. */
+function registryEntries(registry) {
+    if (registry === undefined) {
+        return [];
+    }
+    let records;
+    try {
+        records = registry.list();
+    }
+    catch {
+        // A registry that throws is a host fault the card must not inherit:
+        // the next source still fills the list.
+        return [];
+    }
+    if (!Array.isArray(records)) {
+        return [];
+    }
+    const entries = [];
+    for (const record of records) {
+        if (typeof record !== "object" || record === null) {
+            continue;
+        }
+        const entry = entryOf(record.path, record.title);
+        if (entry !== undefined) {
+            entries.push(entry);
+        }
+    }
+    return entries;
+}
+/** Records from the registry's own durable file, for hosts without the service. */
+function fileEntries(homeDir) {
+    if (homeDir === undefined || homeDir.trim().length === 0) {
+        return [];
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(join(homeDir, "storages", "workspace.json"), "utf8"));
+    }
+    catch {
+        // Missing or unreadable file: no workspaces from this source, no throw.
+        return [];
+    }
+    const table = parsed?.tables?.workspaces;
+    if (typeof table !== "object" || table === null || Array.isArray(table)) {
+        return [];
+    }
+    const entries = [];
+    for (const record of Object.values(table)) {
+        if (typeof record !== "object" || record === null) {
+            continue;
+        }
+        const entry = entryOf(record.path, record.title);
+        if (entry !== undefined) {
+            entries.push(entry);
+        }
+    }
+    return entries;
+}
+/** Records from the roots this process served, most recent first. */
+function servedEntries(served) {
+    return served.list().map(({ root }) => {
+        const canonical = canonicalPath(root);
+        return { root: canonical, label: basename(canonical) };
+    });
+}
+/** ZCode's memory-directory rule: a plain directory, never a symlink. */
+function hasMemoryDirectory(root) {
+    try {
+        const stat = lstatSync(memoryDirFor(root));
+        return stat.isDirectory() && !stat.isSymbolicLink();
+    }
+    catch {
+        return false;
+    }
+}
+/** Deduplicate by canonical root, keeping the first (highest-precedence) entry. */
+function dedupe(entries) {
+    const seen = new Set();
+    const unique = [];
+    for (const entry of entries) {
+        if (seen.has(entry.root)) {
+            continue;
+        }
+        seen.add(entry.root);
+        unique.push(entry);
+    }
+    return unique;
+}
+/** Create the catalog over the given sources. */
+export function createWorkspaceCatalog(options) {
+    const known = () => {
+        const live = registryEntries(options.registry?.());
+        if (live.length > 0) {
+            return dedupe([...live, ...servedEntries(options.served)]);
+        }
+        return dedupe([...fileEntries(options.homeDir), ...servedEntries(options.served)]);
+    };
+    return {
+        known,
+        list() {
+            return known().filter((entry) => hasMemoryDirectory(entry.root));
+        },
+    };
+}
+//# sourceMappingURL=workspace-catalog.js.map

package/locale/en.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "Workspace Memory",
+    "description": "Per-workspace markdown memory store with session-start index injection."
+  }
+}

package/locale/zh.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "工作区记忆",
+    "description": "每个工作区一个 markdown 记忆库，会话开局注入索引，模型原生读写。"
+  }
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-continual-evolve",
-  "version": "0.13.0",
-  "description": "DSH 工作区记忆：每个工作区一个 markdown 记忆库，会话开局注入索引，模型原生读写 / ZCode-style workspace memory for DeepSeek Harness: a per-workspace markdown store with session-start index injection.",
+  "version": "0.14.1",
+  "description": "ZCode-style workspace memory for DeepSeek Harness: a per-workspace markdown store with session-start index injection.",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -20,13 +20,15 @@
       "default": "./lib/index.js"
     },
     "./client": "./client/client.js",
-    "./package.json": "./package.json"
+    "./package.json": "./package.json",
+    "./locale/*.json": "./locale/*.json"
   },
   "files": [
     "lib/**/*.js",
     "lib/**/*.d.ts",
     "client/client.js",
     "cordis.patch.yml",
+    "locale/*.json",
     "README.md",
     "LICENSE"
   ],
@@ -58,7 +60,7 @@
     "test": "vitest run",
     "test:coverage": "vitest run --coverage",
     "test:watch": "vitest",
-    "lint": "oxlint src test",
+    "lint": "oxlint src test client",
     "clean": "rm -rf lib",
     "check:docs": "tsx scripts/run-gates.ts docs",
     "check:handoff": "tsx scripts/verify-handoff-structure.ts --self-test && tsx scripts/verify-handoff-structure.ts",