dsh-deeppilot 0.9.5 → 0.9.7

package/COMPATIBILITY.md

@@ -1,13 +1,14 @@
 # Compatibility
 
-This branch targets exactly **two DSH releases**: `0.2.0-rc.2`, which the npm
-`latest`/`next` channels point at, and `0.2.1-alpha.3`, which the `alpha` channel
-points at. Both are named in `peerDependencies`; no other version is accepted.
-DSH evaluates that range before composing a profile — on every start, not only on
-install — so a newly published DSH release deactivates this plugin until the
-range is widened deliberately. That is the intended trade: a plugin that cannot
-run on an unaudited host fails visibly instead of misbehaving quietly. The
-decision and the reversal it represents are recorded in
+This branch targets exactly **four DSH releases**: `0.2.0-rc.2`, which the npm
+`latest`/`next` channels point at, and `0.2.1-alpha.3`, `0.2.1-alpha.4`, and
+`0.2.1-alpha.5`, which the `alpha` channel has pointed at in turn. All four are
+named in both `engines.dsh` and `peerDependencies`; no other version is accepted.
+DSH evaluates that declaration before composing a profile — on every start, not
+only on install — so a newly published DSH release deactivates this plugin until
+the list is widened deliberately. That is the intended trade: a plugin that
+cannot run on an unaudited host fails visibly instead of misbehaving quietly.
+The decision and the reversal it represents are recorded in
 [`docs/决策记录.md`](./docs/决策记录.md) (章节一), with the supporting audit in
 [`docs/DSH_RELEASE_MEMORY.md`](./docs/DSH_RELEASE_MEMORY.md).
 
@@ -18,7 +19,7 @@ is covered by the isolated compose and live-runs recorded in the release memory.
 | Component | Current contract | Evidence |
 |---|---|---|
 | Node.js | 22 or newer | Package engine and CI |
-| DSH CLI and Host API | `0.2.0-rc.2 \|\| 0.2.1-alpha.3` (dev pins `0.2.0-rc.2`) | Peer metadata, source typecheck, unit tests, bundle build, and config schema projection against a real 0.2.0-rc.2 CLI, plus isolated composes and live phone-protocol runs with the published 0.2.1-alpha.2 and 0.2.1-alpha.3 CLIs |
+| DSH CLI and Host API | `engines.dsh` and `peerDependencies` both name `0.2.0-rc.2 \|\| 0.2.1-alpha.3 \|\| 0.2.1-alpha.4 \|\| 0.2.1-alpha.5` (dev pins `0.2.0-rc.2`) | Peer metadata, source typecheck, unit tests, bundle build, and config schema projection against a real 0.2.0-rc.2 CLI, plus isolated composes and live phone-protocol runs with the published 0.2.1-alpha.2, 0.2.1-alpha.3, and 0.2.1-alpha.4 CLIs, and an isolated 0.2.1-alpha.5 host where this plugin now composes, starts, and answers `/phone/health` with 200 on its own LAN listener (audit below) |
 | iOS bridge | DeepPilot protocol v2 | Bridge protocol tests; device behavior must be checked with the running Host and app |
 | Remote access | Tailscale Funnel on ports 443, 8443, or 10000 | Helper and supervisor tests |
 
@@ -70,6 +71,68 @@ carries the old top-level `debug: true` is accepted but that value is ignored:
 verbose logging must be turned on again from the settings page. No other config
 field changed shape, and the old key is not read anywhere in this version.
 
+## 0.2.1-alpha.5 audit outcome
+
+The source-level audit of `dsh-v0.2.1-alpha.5` against `dsh-v0.2.1-alpha.4` found
+no runtime break. Of the ten peer packages, **nine have byte-identical `lib/`
+trees** — including `dsh-api-gateway` and the three Client faces the resident
+interaction client loads — so every alpha.3 fix still holds unchanged. Only
+`dsh-api-remotes/lib/client.js` differs: three hunks / 36 lines, all inside the
+`account/getUnnotifiedBonuses` result schema, where the new optional `title`
+field arrives while `campaign`, `amount`, `currency`, and `grantedAt` become
+optional and are forwarded without validation. The file's exported symbols are
+identical, and this plugin does not consume that endpoint, so the change is
+additive from here.
+
+The vendor peers need no widening either: both hosts' vendor pins moved from
+prerelease to GA — `cordis 4.0.5-alpha.2` → `4.0.5` and `schemastery
+3.18.5-alpha.2` → `3.18.5` — and both GA releases already satisfy the existing
+`~4.0.5-alpha.1` / `~3.18.5-alpha.1` ranges.
+
+The activation verdict is the same shape as alpha.4, with one difference: alpha.5
+resolves the requirements path from a declared `engines.dsh` alone, so its
+refusal names that single requirement rather than the ten peers. Adding
+`0.2.1-alpha.5` to the closed list therefore makes it activate, and the four
+audited hosts pass while `0.2.1-alpha.1`, `0.2.1-alpha.2`, `0.2.0-rc.1`, `0.2.0`,
+`0.2.1-rc.1`, `0.2.1`, `0.3.0-rc.1`, `0.3.0`, `1.0.0`, and `0.1.7-rc.2` remain
+refused.
+
+**Audit limits, stated rather than implied.** Loading this plugin on a real
+isolated `0.2.1-alpha.5` host, and the full release check set (unit tests,
+typecheck, build, config-schema check, helper tests) against that host, had
+**not** been completed when this entry was written. Until they are, this release
+is recorded as audited at the declaration and source-diff level only; no plugin
+release has been made from this tree, and nothing here claims one.
+
+## 0.2.1-alpha.4 audit outcome
+
+The source-level audit of `dsh-v0.2.1-alpha.4` against `dsh-v0.2.1-alpha.3` found
+no runtime break and one deliberate activation break. Of the ten peer packages,
+**eight have byte-identical `lib/` trees** — including `dsh-api-gateway` and the
+three Client faces the resident interaction client loads — so every alpha.3 fix
+still holds unchanged. Only `dsh-api-remotes` changed in code: one additive
+Remote Events entry (`plugin-market/changed`) and the rename of
+`IncompatiblePlugin.peers` to `requirements`, a field this plugin never reads.
+Two packages appear for the first time — `dsh-plugin-market` and
+`dsh-experimental-plugin-market-bundle` — behind the release's custom plugin
+index sources; neither is a dependency of this plugin.
+
+The activation break is the release's own stated migration: DSH now evaluates a
+plugin's `engines.dsh` range **alone**, ignoring `peerDependencies` entirely
+whenever that field is present. A package that declares no `engines.dsh` — as
+this one did — keeps the older peer evaluation, so the previously exact peer
+list rejected `0.2.1-alpha.4` and the plugin would not have activated on it.
+Both declarations were widened from the previous three-release list to the same
+four releases. The audit reproduced that refusal against the published
+`evaluatePluginCompatibility` of both hosts before changing anything, and the
+same harness confirms the four audited hosts pass while `0.2.1-alpha.2`,
+`0.2.1`, and `0.3.0` still fail.
+
+Nothing else moved. Protocol v2, pairing state, and device records are untouched,
+so no paired phone needs to re-pair, and the vendor peers need no widening: both
+hosts still vendor `cordis 4.0.5-alpha.2` and `schemastery 3.18.5-alpha.2`, which
+the existing ranges already admit.
+
 ## 0.2.1-alpha.3 audit outcome
 
 The source-level audit of `dsh-v0.2.1-alpha.3` against `dsh-v0.2.1-alpha.2`
@@ -146,6 +209,10 @@ needs a documentation update, not a peer-range widening.
 > versions actually audited, `0.2.0-rc.2` and `0.2.1-alpha.3`; see the
 > 0.2.1-alpha.3 outcome above and `docs/决策记录.md` (章节一). The paragraphs in
 > this historical entry describe the policy as it stood on 2026-09-29.
+> **This note is in turn superseded:** `0.2.1-alpha.4` was added the next day by
+> the same deliberate audit step, `0.2.1-alpha.5` on 2026-10-16, and the closed
+> four-release list now lives in `engines.dsh` as well as in `peerDependencies`.
+> See the 0.2.1-alpha.5 outcome above.
 
 ## 0.2.0-rc.1 audit outcome
 

package/README.md

@@ -32,15 +32,18 @@ Host on your own computer and does not replace or modify the DSH Web UI.
 
 ## Install from npm
 
-This source checkout targets Node.js 22+ and the two DSH releases it has been
-audited against — `0.2.0-rc.2` (the `latest`/`next` channels) and `0.2.1-alpha.3`
-(the `alpha` channel) — with a `web` profile. DSH checks a plugin's declared peer
-range before composing a profile, on every start rather than only on install, so
-any other host version refuses to activate this plugin. The package includes
-Funnel helpers for macOS, Linux, and Windows on amd64/arm64; trusted-LAN mode
-does not require the helper.
-
-The current working tree names exactly those two versions in
+This source checkout targets Node.js 22+ and the four DSH releases it has been
+audited against — `0.2.0-rc.2` (the `latest`/`next` channels) and the `alpha`
+channel releases `0.2.1-alpha.3`, `0.2.1-alpha.4`, and `0.2.1-alpha.5` — with a
+`web` profile. DSH checks a plugin's declared requirements before composing a
+profile, on every start rather than only on install, so any other host version
+refuses to activate this plugin. From DSH `0.2.1-alpha.4` on, that check reads
+`engines.dsh` and ignores `peerDependencies`; older hosts know only the peer
+range, so both name the same four releases. The package includes Funnel helpers
+for macOS, Linux, and Windows on amd64/arm64; trusted-LAN mode does not require
+the helper.
+
+The current working tree names exactly those four versions in `engines.dsh` and
 `peerDependencies` and is built/typechecked against `0.2.0-rc.2`. A previously
 published plugin package may still carry its own older compatibility
 declaration until a release is made from this tree.

package/README.zh-CN.md

@@ -30,15 +30,18 @@
 
 ## 从 npm 安装
 
-当前源码面向 Node.js 22+ 与带 `web` profile 的**两个已审计 DSH 版本**：
-`0.2.0-rc.2`（`latest`/`next` 通道）与 `0.2.1-alpha.3`（`alpha` 通道）。
-DSH 在组合 profile 前会校验插件声明的 peer 范围，且**每次启动都会校验**（不只是
-安装时），因此其他宿主版本会拒绝激活本插件。npm 包内置 macOS、Linux、Windows
-的 amd64/arm64 Funnel helper；可信局域网模式不依赖 helper。
-
-当前工作树的 `peerDependencies` 精确列出这两个版本，构建与类型检查针对
-`0.2.0-rc.2`。从此工作树发布新版本前，已发布的旧插件包仍可能带有各自旧的
-兼容声明。
+当前源码面向 Node.js 22+ 与带 `web` profile 的**四个已审计 DSH 版本**：
+`0.2.0-rc.2`（`latest`/`next` 通道），以及 `alpha` 通道的 `0.2.1-alpha.3`、
+`0.2.1-alpha.4` 与 `0.2.1-alpha.5`。DSH 在组合 profile 前会校验插件声明的
+兼容要求，且**每次启动都会校验**（不只是安装时），因此其他宿主版本会拒绝
+激活本插件。从 DSH `0.2.1-alpha.4` 起，该校验只读 `engines.dsh` 并忽略
+`peerDependencies`；更早的宿主只认 peer 范围，因此两处列出同一组四个版本。
+npm 包内置 macOS、Linux、Windows 的 amd64/arm64 Funnel helper；可信局域网
+模式不依赖 helper。
+
+当前工作树的 `engines.dsh` 与 `peerDependencies` 精确列出这四个版本，构建与
+类型检查针对 `0.2.0-rc.2`。从此工作树发布新版本前，已发布的旧插件包仍可能
+带有各自旧的兼容声明。
 
 ```sh
 dsh plugin --profile web add dsh-deeppilot

package/docs/DSH_RELEASE_MEMORY.md

@@ -3,7 +3,169 @@
 > This is the durable audit record for DeepPilot's public DSH plugin. Re-audit
 > the next DSH release instead of assuming that an rc upgrade is runtime-safe.
 
-## Current decision
+## Current decision — `dsh-v0.2.1-alpha.5`
+
+- **Audited release:** `dsh-v0.2.1-alpha.5`, the newest `alpha` channel release.
+  It is **not** `latest`; `latest`/`next` still point at `0.2.0-rc.2`.
+- **Comparison baseline:** `dsh-v0.2.1-alpha.4` (the previous audited tag).
+- **Plugin runtime verdict: no break, and no `src/` change was needed.** Nine of
+  the ten peer packages ship a byte-identical `lib/` tree, including
+  `dsh-api-gateway` and the three Client faces the resident interaction client
+  loads, so every alpha.3 fix still holds unchanged.
+- **The one code difference is schema-only and additive.**
+  `@deepseek-ai/dsh-api-remotes/lib/client.js` is the only differing `lib/` file
+  among the ten peers: **three hunks, 36 changed lines** (14 insertions, 22
+  deletions), all inside the `account/getUnnotifiedBonuses` result schema. The
+  new `title` field is added as optional; `campaign`, `amount`, `currency`, and
+  `grantedAt` are relaxed to optional and the first three lose their validation
+  (`campaign` becomes "forwarded without validation", `amount` and `currency`
+  become unconstrained JSON); only the descriptions of `expiresAt` changed.
+  `orderId`, `expiresAt`, and `message` stay required. The module's **exported
+  symbols are identical** — both versions assign exactly `exports.apply` and
+  `exports.inject` — and this plugin does not consume that endpoint, so the
+  change cannot reach any call it makes.
+- **Activation verdict: the new release is admitted by both declarations.** This
+  is the third consecutive release on this line to trip the deliberate
+  closed-list policy: alpha.5 was refused before the widening. alpha.5 reads a
+  declared `engines.dsh` alone, so its refusal reported a **single**
+  `engines.dsh` requirement rather than ten peers, and `exempted: false` — the
+  list is the only thing that admits a host, and no exemption fallback exists on
+  this machine (no profile `compatibility.json`).
+- **Evidence: reproduced against the published evaluator, plus an isolated
+  host run.** The audit called alpha.5's own published
+  `evaluatePluginCompatibility` with empty exemptions against this plugin's real
+  `package.json`, over one candidate list. Raw output:
+  `.alpha5-verify/tmp-matrix-early.out.json` (13 candidates, `matrixAllPass:
+  true`) and `.alpha5-verify/stage1-baseline.out.json` (the pre-change baseline).
+  Accepted after the change: `0.2.1-alpha.5`, `0.2.1-alpha.3`,
+  `0.2.1-alpha.4`, and the stable `latest` host. Still refused:
+  `0.2.1-alpha.1`, `0.2.1-alpha.2`, `0.2.0-rc.1`, `0.2.0`, `0.2.1-rc.1`,
+  `0.2.1`, `0.3.0-rc.1`, `0.3.0`, `1.0.0`, and `0.1.7-rc.2`. The same file
+  confirms declaration sync: `engines.dsh` equals the `@deepseek-ai/dsh` peer
+  range, all ten peers share one range, and the token count is 4.
+  `.alpha5-verify/VERIFICATION.md` separately records the refusal on an isolated
+  alpha.5 host: `dsh: skipping profile bundle "dsh-deeppilot": … incompatible
+  with dsh 0.2.1-alpha.5: requirements {"engines.dsh":…}`, with the host itself
+  still booting (`/phone/health` → 404, so the plugin was genuinely not loaded).
+  `.alpha5-verify/stage1-dumpconfig-phaseA.stderr.txt`,
+  `stage1-dumpconfig-phaseA.stdout.txt`, and `stage1-host-phaseA.log` hold the
+  raw logs.
+- **Vendor pins promoted to GA, with no range change needed.** Both hosts'
+  vendored third parties moved from prerelease to GA — `cordis
+  4.0.5-alpha.2` → `4.0.5`, `schemastery 3.18.5-alpha.2` → `3.18.5`. Both GA
+  releases already satisfy the existing `~4.0.5-alpha.1` / `~3.18.5-alpha.1`
+  ranges, so the two vendor peers stay as they are.
+  `.alpha5-verify/stage1-semver-vendor.out.json` cross-checks that with four
+  independent solver paths (host `semver` and repo `semver`, each with and
+  without `includePrerelease`), all four agreeing.
+- **Install verdict: the two declarations now agree on four releases.**
+  `engines.dsh` and all ten `@deepseek-ai/dsh*` peers name `0.2.0-rc.2 ||
+  0.2.1-alpha.3 || 0.2.1-alpha.4 || 0.2.1-alpha.5`, mirrored in
+  `tests/compatibility-metadata.test.ts`, `package-lock.json` (root entry only),
+  both READMEs, `COMPATIBILITY.md`, `AGENTS.md`, and the local
+  `docs/决策记录.md` (章节一, 条目4). The dev pins and `DSH_BASELINE` stay at the
+  exact `0.2.0-rc.2` this branch builds and typechecks against.
+- **Protocol verdict: no phone-protocol change.** Protocol v2, pairing state, and
+  device records are untouched by this release; no phone needs to re-pair.
+- **Post-widening verification — completed for the 0.9.7 preparation.**
+  - **C7 — real load on an isolated alpha.5 host: passed.** With the widened
+    declaration in place, the profile that used to be refused now composes and
+    starts. `--dump-config` writes nothing to stderr and no longer emits
+    `skipping profile bundle` (the pre-change baseline emitted 21 such lines); the
+    composed tree contains `# == dsh-deeppilot` together with
+    `# == @deepseek-ai/dsh-web-app, patched by dsh-deeppilot`; the running host
+    logs four `[deeppilot]` lines (`device registry loaded`, `data plane active`,
+    `LAN TLS identity created`, `local transport listening on https://0.0.0.0:3098`);
+    and `https://127.0.0.1:3098/phone/health` answers `200` with
+    `{"ok":true,"enabled":true,"protocolVersion":2,"serverVersion":"0.9.6","dataPlane":true}`.
+  - **Probe note — use the plugin's own listener, not DSH's web port.** The
+    pre-change baseline cited `http://127.0.0.1:3281/phone/health = 404` as its
+    refusal evidence. That probe has no discriminating power: `/phone/health` is
+    served by this plugin's own narrow LAN listener (`src/phone-server.ts`), which
+    by design never inherits DSH's wider web/API route surface, so the DSH web
+    port answers 404 whether or not the plugin loaded. The valid refusal evidence
+    was the skip warning; the valid positive evidence is port 3098.
+  - **C5/C6 — the full check set: passed in the release tree.** Clean `npm ci`,
+    repo-wide `npm test` (564 tests, 563 pass, 0 fail, 1 pre-existing TODO),
+    `npm run typecheck`, `npm run build` (regenerated `lib/` byte-identical to the
+    committed tree), `npm run check:config-schema` against the pinned
+    `0.2.0-rc.2` CLI, `go test ./...` for the helper, and all six
+    `bin/SHA256SUMS` entries verified.
+- **Nothing has been published from this tree yet.** `package.json` reads `0.9.7`
+  on the release branch; no tag, registry version, or GitHub release corresponds
+  to it yet. This entry records an audit, a declaration sync, and the local
+  preparation of 0.9.7 — **not** a published release.
+
+### Previous decision — `dsh-v0.2.1-alpha.4`
+
+- **Audited release:** `dsh-v0.2.1-alpha.4` (official release page:
+  <https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.2.1-alpha.4>),
+  published to npm 2026-10-15T13:08:08Z on the `alpha` dist-tag. It is **not**
+  `latest`; `latest`/`next` still point at `0.2.0-rc.2`, exactly as at alpha.3.
+- **Comparison baseline:** `dsh-v0.2.1-alpha.3` (the previous audited tag).
+- **Plugin runtime verdict: no break, and no `src/` change was needed.** Eight of
+  the ten peer packages ship a byte-identical `lib/` tree; only their
+  `package.json` `version` fields moved. That set includes `dsh-api-gateway`,
+  where alpha.3's first two breaks lived, and all three Client faces the resident
+  interaction client loads (`dsh-typert-registry/client`,
+  `dsh-client-connection/client`, `dsh-api-gateway/client`). Every alpha.3 fix
+  therefore still holds unchanged.
+- **Only `dsh-api-remotes` changed in code, additively.** One new Remote Events
+  entry (`plugin-market/changed`) and the rename of `IncompatiblePlugin.peers` to
+  `requirements`. The plugin reads neither: it subscribes to no Remote Events
+  entry of that name, and its own phone-wire frame registry is a separate
+  vocabulary from DSH Remote Events. Its `lib/client.js` shows a 750-line diff
+  that normalises to zero contract changes — the bulk is `TYPERT_REMOTE$N`
+  renumbering plus `sourceLocation` line drift from the one inserted remote.
+- **Two packages exist for the first time** — `@deepseek-ai/dsh-plugin-market`
+  and `@deepseek-ai/dsh-experimental-plugin-market-bundle` — behind this
+  release's custom plugin index sources. Neither is a dependency of this plugin,
+  the plugin does not name either in `inject`, and the bundle is a purely
+  additive entry in `dsh-app-boot`'s default bundle list.
+- **Activation verdict: one break, and it is the release's own stated
+  migration.** alpha.4 changed the compatibility rule so that a plugin's own
+  `engines.dsh` range **decides alone and `peerDependencies` are ignored**
+  whenever that field is present; only a manifest without `engines.dsh` falls
+  back to the old peer evaluation. This plugin declared no `engines.dsh`, so it
+  kept the peer path, and its exact two-version peer list rejected
+  `0.2.1-alpha.4` — the plugin would not have activated on that host.
+- **Evidence: reproduced against the published bundles, not inferred.** The audit
+  ran each host's own published `evaluatePluginCompatibility` (alpha.3 and
+  alpha.4 installed into separate isolated directories) against this plugin's
+  real `package.json`, over one candidate list. Before any edit, both hosts
+  admitted `0.2.0-rc.2` and `0.2.1-alpha.3` and both refused `0.2.1-alpha.4`,
+  reporting all ten peers unmet. With the new `engines.dsh` range in place, both
+  hosts admit all three audited releases; alpha.4 reports a **single**
+  `engines.dsh` requirement instead of ten peers when it refuses; and
+  `0.2.1-alpha.2`, `0.2.1-alpha.5`, `0.2.1`, and `0.3.0` are still refused.
+  *(Historical: `0.2.1-alpha.5` was admitted the next day by the audit above.)*
+  alpha.3 ignores `engines.dsh` entirely — the field did not exist yet — and
+  keeps deciding on `peerDependencies`, which is why both declarations must name
+  the same list.
+- **Install verdict: the two declarations agreed at that point (widened since).**
+  `engines.dsh` and all ten `@deepseek-ai/dsh*` peers named `0.2.0-rc.2 ||
+  0.2.1-alpha.3 || 0.2.1-alpha.4`, mirrored in
+  `tests/compatibility-metadata.test.ts`, `package-lock.json`, both
+  READMEs, `COMPATIBILITY.md`, `AGENTS.md`, and the local `docs/决策记录.md`
+  (章节一, 条目3). The dev pins and `DSH_BASELINE` stay at the exact
+  `0.2.0-rc.2` this branch builds and typechecks against. **Historical note:**
+  `0.2.1-alpha.5` was appended to both lists on 2026-10-16 by the audit above,
+  which now owns the current list; the four documentation mirrors that still
+  said「三个版本」were corrected there.
+- **Vendor peers need no widening.** Both hosts still vendor `cordis
+  4.0.5-alpha.2` and `schemastery 3.18.5-alpha.2`; neither package published a
+  `dsh-0-2-1-alpha-4` dist-tag, and the existing `~4.0.5-alpha.1` /
+  `~3.18.5-alpha.1` ranges already admit them.
+- **Protocol verdict: no phone-protocol change.** Protocol v2, pairing state, and
+  device records are untouched by this release; no phone needs to re-pair.
+- **Unrelated to this plugin, recorded for completeness:** the release also
+  brought per-model reasoning levels for custom API models, discovery and
+  installation from custom plugin index sources, a command/argument input fix, an
+  Office file delivery change, a Developer Tools reload fix, lower Linux command
+  startup overhead, and failed-command status reporting. None of them touches a
+  surface this plugin calls.
+
+### Previous decision — `dsh-v0.2.1-alpha.3`
 
 - **Audited release:** `dsh-v0.2.1-alpha.3` (official release page:
   <https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.2.1-alpha.3>),
@@ -115,17 +277,36 @@
 
 ### Plugin release verdicts
 
-- **Release candidate (`0.9.5`, 2026-10-15):** carries the alpha.3 Peer/client
-  compatibility repair, the exact two-host peer policy, cross-language auth
-  vectors and recovery guidance, and the manual OIDC/provenance workflow.
-  The package and both lockfile version entries are `0.9.5`; the apply baseline
-  records that version. Clean install, 562 passing unit tests (zero failures,
-  one existing TODO), typecheck, build, the real pinned-host schema loader,
-  Go tests, all six helper checksums, and package inspection pass locally.
-  The altered-challenge test now mutates the challenge from its own socket,
-  eliminating the timestamp collision, and passes 20 consecutive focused runs.
-  Registry/provenance and clean published-profile checks remain release gates;
-  no physical-iPhone validation is claimed. Notes: `docs/RELEASE_NOTES-0.9.5.md`.
+- **发布结论（`0.9.5`，2026-10-15，`v0.9.5` @ `6517ad7`）：** 包含 alpha.3
+  对端（Peer）与客户端兼容修复、两个宿主精确列举策略、跨语言认证向量与恢复说明，
+  以及手动 OIDC 身份认证与来源证明发布。包与锁文件两处根版本、基线快照一致。
+  - **发布前验证：** 干净依赖安装；562 项单元测试通过、零失败、一项既有待办；
+    类型检查、构建、固定宿主的真实配置模型加载、Go 测试、六个辅助程序校验和与
+    包内容检查通过。挑战篡改测试基于当前连接生成变更值，消除了时间碰撞，连续
+    20 次重点回归通过。发布提交的持续集成（CI）和 CodeQL 代码安全扫描通过。
+  - **注册表与来源证明：** npm 于 `2026-10-14T23:29:29.605Z` 发布该版本，
+    `latest`（稳定分发标签）指向 `0.9.5`。下载压缩包共 50,934,088 字节，
+    SHA1 `6a2f356efa1e48849d9bf713f88cd0fd67c7999c` 与工作流上传记录一致；
+    SHA512 与注册表及来源证明中的包摘要一致。来源证明精确对应 `v0.9.5`、
+    `6517ad7b6d7022afc9b3d81d6779b434282c9c56` 和 `.github/workflows/publish.yml`。
+    `npm audit signatures`（npm 签名审计）通过，包含本插件的注册表签名和来源证明；
+    npm 可信发布者绑定显示 `Valid`（有效）。压缩包发布不依赖可选的 `gitHead`
+    字段来确认源码，使用已验证签名的来源证明提交。
+  - **已发布包安装：** 两个独立的新 DSH 主目录分别使用 `0.2.0-rc.2` 与
+    `0.2.1-alpha.3`，从注册表执行 `dsh plugin --profile verify add dsh-deeppilot@0.9.5`。
+    三条插件配置组合成功，版本为 `0.9.5`，安装路径未引用源码工作区，六个辅助程序
+    校验和全部一致；实际配置模型导入未出现本插件相关错误。两个 Web 模板仍各有
+    四项宿主配置模型错误，与未安装插件的基线完全一致；不把整个模板核对说成全绿。
+  - **真实宿主边界：** 隔离的 alpha.3 冒烟检查为 24 项通过、1 项失败、3 项跳过。
+    失败项是未配置模型账号的全新主目录中，模型目录非空的断言；模型目录 RPC 正常
+    且可路由。模型切换、真实提问和模型触发的审批问答未验证，iPhone 真机未验证。
+    已认证连接重复提交认证证明的既有待办保留。
+  - **发布后缓存核对修正：** [首次发布运行](https://github.com/Mars-Sea/dsh-deeppilot/actions/runs/38653869533)
+    上传成功，末尾核对短暂命中缓存的 404 而失败。独立注册表、摘要、签名及安装
+    核验通过后才公开 [GitHub 发布页](https://github.com/Mars-Sea/dsh-deeppilot/releases/tag/v0.9.5)。
+    后续仓库修正为刷新查询、要求元数据重新校验并最多读取重试 12 次；修正后的
+    只读核对步骤已对真实注册表执行通过。未重跑上传、未修改已发布包或移动版本标签。
+    发布说明：`docs/RELEASE_NOTES-0.9.5.md`。
 
 - **Release verdict (`0.9.4`, published 2026-10-10, tag `v0.9.4` @ `e2f77af`):**
   carries the `projections` adapter fix and the Automation tasks documentation
@@ -306,6 +487,248 @@
   bundle" below. The plugin needs no code change; the phone's copy now points
   at the bundle.
 
+## 2026-10-16 — audit of `dsh-v0.2.1-alpha.5`
+
+The first release on this line whose entire plugin-facing change surface is
+additive. It is the third consecutive release to trip the closed-list policy: a
+new DSH tag refuses to activate this plugin until the list is widened by an
+audit, which is the behaviour the 2026-10-14 reversal chose on purpose.
+
+### Method
+
+The comparison used the **installed artifacts** of the alpha.4 and alpha.5 hosts
+already unpacked on this machine, not release notes and not the monorepo: every
+`@deepseek-ai/dsh*` peer package's `lib/` directory was compared file by file,
+and the single differing file was then read as a diff. `dsh-client-ui-slots` is
+not hoisted into either host's `node_modules` root (it resolves only inside a
+composed profile), so both of its published versions were pulled from npm
+(`0.2.1-alpha.4` and `0.2.1-alpha.5`, 31,973 bytes each) and compared in full to
+close that gap rather than assume it.
+
+### Change surface
+
+- **Nine of the ten peer packages carry a byte-identical `lib/` tree**:
+  `dsh`, `dsh-api-gateway`, `dsh-client-connection`, `dsh-client-locale`,
+  `dsh-client-ui-settings`, `dsh-client-ui-slots`, `dsh-settings`,
+  `dsh-typert-protocol`, `dsh-typert-registry`. The tenth is `dsh-api-remotes`.
+- **`dsh-api-remotes/lib/client.js` — three hunks, 36 changed lines.** Every
+  hunk is the `account/getUnnotifiedBonuses` result schema:
+  - `title` is added, optional, described as a server-localised plain-text title
+    that absent responses replace with the localised bonus title.
+  - `campaign`, `amount`, `currency`, and `grantedAt` become optional; `campaign`
+    becomes unvalidated pass-through JSON, `amount` and `currency` lose their
+    string / `CNY|USD` constraints, and `grantedAt` loses its description.
+  - The JSON Schema side mirrors that: `title` is added to `properties`, and
+    `campaign`, `amount`, `currency`, and `grantedAt` are dropped from
+    `required`. `orderId`, `expiresAt`, and `message` remain required.
+  - **The exported symbols are unchanged**: the module assigns exactly
+    `exports.apply` and `exports.inject` on both sides.
+  - This plugin does not call `account/getUnnotifiedBonuses`, so even the field
+    that did tighten (`expiresAt`'s documented semantics) cannot reach it.
+- **The vendor pins moved from prerelease to GA.** The `dsh` CLI's vendored
+  third parties went `cordis 4.0.5-alpha.2` → `4.0.5` and `schemastery
+  3.18.5-alpha.2` → `3.18.5`. Both GA releases already satisfy the plugin's
+  existing `~4.0.5-alpha.1` / `~3.18.5-alpha.1` ranges, so **no vendor widening
+  was needed**; the ranges were left untouched.
+- **The activation rule did not change again.** alpha.5 keeps alpha.4's
+  requirements path: a declared `engines.dsh` decides alone and short-circuits the
+  peer loop. That is why the refusal is reported as one requirement instead of
+  ten.
+
+### Validation evidence
+
+- **Compatibility matrix against the published evaluator.** alpha.5's own
+  published `evaluatePluginCompatibility`, called with empty exemptions against
+  this plugin's real `package.json` over 13 candidates →
+  `.alpha5-verify/tmp-matrix-early.out.json`, `matrixAllPass: true`. Accepted:
+  `0.2.1-alpha.5` (the target), `0.2.1-alpha.3`, `0.2.1-alpha.4`, and the stable
+  host. Refused, each with `exempted: false`: `0.2.1-alpha.1`,
+  `0.2.1-alpha.2`, `0.2.0-rc.1`, `0.2.0`, `0.2.1-rc.1`, `0.2.1`, `0.3.0-rc.1`,
+  `0.3.0`, `1.0.0`, `0.1.7-rc.2`. The same file's `declarationSync` block
+  reports `engines.dsh === @deepseek-ai/dsh peer range`, all ten peers on one
+  range, and four unique `engines.dsh` tokens.
+- **Pre-change baseline, the same evaluator.** `.alpha5-verify/stage1-baseline.out.json`
+  shows the unchanged declaration refusing `0.2.1-alpha.5` with
+  `requirements: { "engines.dsh": "0.2.0-rc.2 || 0.2.1-alpha.3 || 0.2.1-alpha.4" }`
+  and `exempted: false` — the failure this audit removes.
+- **Isolated alpha.5 host, pre-change.** `.alpha5-verify/VERIFICATION.md` and
+  `stage1-dumpconfig-phaseA.stderr.txt` record the real CLI refusing the plugin:
+  `dsh: skipping profile bundle "dsh-deeppilot": Error: Plugin
+  dsh-deeppilot@0.9.6 is incompatible with dsh 0.2.1-alpha.5: requirements
+  {"engines.dsh":…}`, `Exact-version exemption: not active`. The host still
+  booted (`stage1-host-phaseA.log`, `--port 3280`) and `/phone/health` returned
+  404, which is what shows the plugin really was not loaded rather than silently
+  active.
+- **Vendor semver, four independent paths.** `.alpha5-verify/stage1-semver-vendor.out.json`
+  resolves the two vendor ranges with the host tree's `semver` and the repo's
+  `semver`, each with and without `includePrerelease`; all four agree that
+  `4.0.5` and `3.18.5` (and the previously audited `4.0.4`, `4.0.5-alpha.2`,
+  `3.18.4`, `3.18.5-alpha.2`) satisfy, and that `9.9.9` does not.
+- **Targeted unit test.** `node --import tsx --test tests/compatibility-metadata.test.ts`
+  → 5 tests, 5 pass, 0 fail, after `DSH_PEER_RANGE`, `DSH_ENGINES_RANGE`,
+  `DSH_ALPHA_HOSTS`, the rejection lists, and the vendor pins were updated. The
+  test file's contrast set still refuses `0.2.1-alpha.1`, `0.2.1-alpha.2`,
+  `0.2.0`, `0.2.1-rc.1`, `0.2.1`, `0.3.0`, and `1.0.0`, so the widening did not
+  turn into an open range.
+
+### Verification status
+
+- **C7 — real load on an isolated alpha.5 host: passed.** The same isolated
+  profile that was refused before the widening now composes and starts: no
+  `skipping profile bundle` warning (0 bytes on stderr, was 21 lines), the tree
+  contains `# == dsh-deeppilot` and the web-app patch, the host logs four
+  `[deeppilot]` lines, and `https://127.0.0.1:3098/phone/health` answers `200`
+  with `serverVersion` matching the tree under test. The run happened before the
+  version bump, so that field read `0.9.6`; the release tree differs from the tree
+  under test only in the declaration documents and the version fields. Port 3098 —
+  not DSH's web port — is the probe with discriminating power; see the note under
+  Current decision.
+- **The full check set for this tree (C5/C6): passed.** Clean `npm ci`, repo-wide
+  `npm test` (564 tests, 563 pass, 0 fail, 1 pre-existing TODO),
+  `npm run typecheck`, `npm run build` with a byte-identical regenerated `lib/`,
+  `npm run check:config-schema` against the pinned `0.2.0-rc.2` CLI, the Go helper
+  tests, and the six `bin/SHA256SUMS` entries.
+- **No release action yet.** `package.json` reads `0.9.7` on the release branch;
+  nothing was published, tagged, or pushed. The widened list reaches users only
+  through that release.
+- **The declaration mirrors have drifted historically.** `README.md`,
+  `README.zh-CN.md`, `COMPATIBILITY.md`, and `AGENTS.md` all said "three
+  releases" while `package.json` already named four; that contradiction was
+  corrected in this pass. Any future widening must update all of them together —
+  the unit test only pins `package.json` and `package-lock.json`.
+
+## 2026-10-15 — audit of `dsh-v0.2.1-alpha.4`
+
+`dsh-v0.2.1-alpha.4` reached npm on 2026-10-15T13:08:08Z, roughly 24 hours after
+alpha.3, with the GitHub release following at 13:40:02Z. It is a small release —
+two features, five fixes, and one compatibility-policy change — and
+`latest`/`next` still point at `0.2.0-rc.2`.
+
+### Method
+
+This audit established the change surface from **released artifacts before
+reading any source**, rather than from the release notes, because those notes are
+under 2 KB and all four of alpha.3's breaks had been invisible in its notes.
+Every `@deepseek-ai/dsh*` peer package was fetched from npm at both
+`0.2.1-alpha.3` and `0.2.1-alpha.4`, unpacked into a scratch tree, and compared
+file by file. The one large diff was then re-compared after normalising
+`TYPERT_REMOTE$N` renumbering and `sourceLocation` line/column drift, so that
+mechanical churn could not hide a contract change.
+
+### Change surface
+
+- **Eight of the ten peer packages carry a byte-identical `lib/` tree**:
+  `dsh-api-gateway`, `dsh-client-connection`, `dsh-client-locale`,
+  `dsh-client-ui-settings`, `dsh-client-ui-slots`, `dsh-settings`,
+  `dsh-typert-protocol`, `dsh-typert-registry`. Only their `package.json`
+  `version` fields moved. That set includes every module alpha.3 broke the
+  plugin through.
+- **`dsh-api-remotes`** gained one Remote Events entry (`plugin-market/changed`),
+  renamed `IncompatiblePlugin.peers` to `requirements`, and added a
+  `pluginMarket` remote. Its `lib/client.js` diff spans 750 lines but normalises
+  to zero contract changes — `TYPERT_REMOTE$N` renumbering, `sourceLocation`
+  drift, and one rewritten `productAnalytics/report` description.
+- **`dsh-app-boot`** rewrote the compatibility evaluator (below) and appended
+  `@deepseek-ai/dsh-experimental-plugin-market-bundle` to its default bundle
+  list, which is additive to `DEFAULT_BUNDLES`.
+- **`dsh-plugin-manager`** carried the same `peers` → `requirements` rename
+  through `IncompatiblePlugin` and its diagnostics.
+- **Two packages are new at this release**: `@deepseek-ai/dsh-plugin-market` and
+  `@deepseek-ai/dsh-experimental-plugin-market-bundle`. Neither resolves at
+  alpha.3. Neither is a dependency of this plugin, and neither appears in its
+  `inject`.
+- The `dsh` CLI's own ten `@deepseek-ai/dsh*` dependencies all moved to alpha.4;
+  the vendor pins did **not** move. Both hosts still vendor `cordis
+  4.0.5-alpha.2` and `schemastery 3.18.5-alpha.2`, and neither vendor published a
+  `dsh-0-2-1-alpha-4` dist-tag, so the existing `~4.0.5-alpha.1` /
+  `~3.18.5-alpha.1` ranges already admit what both hosts ship.
+
+### The one break: `engines.dsh` now decides alone
+
+`dsh-app-boot`'s evaluator grew a requirements path that short-circuits the old
+peer loop:
+
+```js
+function unmetRequirements(fields, runtimeVersion) {
+  const engines = Object.hasOwn(fields, "engines") ? objectOf$1(fields.engines, "Plugin manifest engines") : {};
+  if (Object.hasOwn(engines, "dsh")) {
+    const range = engines.dsh;
+    if (typeof range !== "string") throw new Error("Plugin manifest engines.dsh must be a string");
+    return satisfies(runtimeVersion, range) ? {} : { "engines.dsh": range };
+  }
+  if (!Object.hasOwn(fields, "peerDependencies")) return {};
+  // ...otherwise the previous per-peer loop, unchanged
+}
+```
+
+Three consequences matter here. A plugin that declares `engines.dsh` is judged
+**only** by it, and its `peerDependencies` are never read. A plugin that does not
+declare it keeps the previous behaviour — which is the state this plugin was in,
+so its exact two-version peer list refused `0.2.1-alpha.4`. And `engines.dsh` is
+taken verbatim, with none of the `workspace:^` / `workspace:~` / `workspace:*`
+substitution the peer path performs, so any `workspace:` range there is unmet.
+
+### Validation evidence
+
+- **Compatibility decision, reproduced against the published evaluators — before
+  any edit.** Each host's own `evaluatePluginCompatibility` (alpha.3 and alpha.4,
+  installed into separate isolated directories) judged this plugin's real
+  `package.json` over one candidate list. Unchanged, both hosts admitted
+  `0.2.0-rc.2` and `0.2.1-alpha.3` and refused `0.2.1-alpha.4`, listing all ten
+  peers as unmet. With the added `engines.dsh` range, both hosts admit all three
+  audited releases; alpha.4 reports a **single** `engines.dsh` requirement
+  instead of ten peers when it refuses; and `0.2.1-alpha.2`, `0.2.1-alpha.5`,
+  `0.2.1`, and `0.3.0` remain refused.
+  *(Historical: `0.2.1-alpha.5` was admitted the next day — see the audit of that
+  release above.)* alpha.3 ignores `engines.dsh` entirely and keeps deciding
+  on `peerDependencies`, which is why both declarations must name the same list.
+- **Live A/B install on the published alpha.4 CLI — the evidence that matters.**
+  Under an isolated `DSH_HOME`, the **unchanged** package was rejected outright:
+  `dsh: installation rejected: Plugin dsh-deeppilot@0.9.5 is incompatible with
+  dsh 0.2.1-alpha.4: requirements {…ten peers…}`, `Exact-version exemption: not
+  active`, `dsh: nothing was installed`, exit 1. The **fixed** package installed
+  cleanly, exit 0, linked into the profile manifest's `dsh.profile.bundles`
+  alongside `@deepseek-ai/dsh-sdk-minimal`.
+- **Composed tree:** the same CLI's `--dump-config` produced **162 rows with the
+  plugin and 153 without it**, the plugin's three rows present at
+  `deeppilot-directory-picker-browse`, `deeppilot-directory-picker-browse-client`,
+  and `deeppilot`, with no `skipped`/`incompatible` diagnostic. The single
+  warning is the `sdk-minimal` template's own missing `directory-picker` entry,
+  which alpha.3 recorded as well.
+- **Live boot on a real alpha.4 Web host.** An isolated `DSH_HOME` profile built
+  from the shipped Web template and linked to this working tree booted under the
+  published alpha.4 CLI on `--port 3180` (the default 3080 is held by this
+  machine's own Host). The plugin started fully —
+  `[deeppilot] data plane active (mux + host streams)`,
+  `[deeppilot] LAN TLS identity created`,
+  `[deeppilot] local transport listening on https://0.0.0.0:3098` — and the
+  alpha.3 failure line `DSH Remote interaction client unavailable` **did not
+  appear**. A scan of the whole boot log for `incompatible`, `rejected`,
+  `requirements`, `unavailable`, or `error` returns nothing.
+- **Plugin unit tests:** `npm test` → **564 tests, 563 pass, 0 fail, 1 todo**,
+  including the new `engines.dsh names the same closed host list as the peer
+  range` and the updated peer-range boundary test. `npm run typecheck` passes.
+- **Build and schema:** `npm run build` passes and leaves `lib/` **byte-identical
+  to HEAD** — this fix changes no code, only declarations and documentation, so
+  no host's runtime behaviour can regress. `npm run check:config-schema` passes
+  against the pinned `0.2.0-rc.2` CLI (`/34 → $defs/config19`, volatile fields
+  pinned).
+- **Environment note, not a defect:** `check:config-schema` shells out to
+  `npx --yes @deepseek-ai/dsh@0.2.0-rc.2`, and this machine's `~/.npm/_cacache`
+  contains root-owned files, so the default npm cache fails with `EPERM`. Running
+  it with `npm_config_cache` pointed at a writable directory passes, and the
+  unchanged HEAD build fails identically under the default cache, which is what
+  attributes the failure to the machine rather than to this change.
+
+### Evidence limits
+
+Verified: install admission on alpha.4, profile composition, plugin startup, and
+the full unit/typecheck/build/schema suite. **Not** verified here: a real iPhone
+against this alpha.4 host, the Funnel transport, and a real model turn. The
+phone-side contract is unchanged by this release — protocol v2, pairing state,
+and device records are untouched, so no paired phone needs to re-pair — but that
+is a source-level verdict, not a device run.
+
 ## 2026-10-14 — audit of `dsh-v0.2.1-alpha.3`
 
 ### Scope and method

package/docs/NPM_PUBLISHING.md

@@ -72,8 +72,21 @@
    `npm whoami`（当前账号查询）不能验证 OIDC 发布权限。
 2. 若 npm 上传成功而后续核对失败，先检查注册表；已存在的版本不能通过重跑覆盖。
    排查来源证明或分发标签后再决定下一步，禁止把核对失败直接当作上传失败。
+   发布核对会绕过元数据缓存并有限重试；人工查询使用 `npm view --prefer-online`，
+   以免继续读取发布前的旧版本列表或缓存的 404 响应。
 3. 本地语法检查、测试和打包不能证明 npm 绑定已生效；真实 OIDC 认证与来源证明
    需要首次获授权的新版本发布才能验证。已有旧版本的认证状态不因新增工作流改变。
+4. `0.9.5` 已完成首次 OIDC 身份认证发布；npm 绑定显示 `Valid`（有效），
+   来源证明签名、压缩包摘要与两个支持宿主的注册表安装核验通过。首次运行的末尾
+   核对因缓存失败，其上传步骤成功；发布证据及边界见 `docs/DSH_RELEASE_MEMORY.md`。
+5. `0.9.6` 复现了同一形态：OIDC 上传与来源证明步骤成功，紧随其后的核对步骤在
+   12 次重试后仍抛 `读取 npm 发布信息失败（dsh-deeppilot/0.9.6，HTTP 404）`，
+   整次运行结论因此为失败。事后核验 `npm view dsh-deeppilot dist-tags --prefer-online`
+   得到 `latest = 0.9.6`、发布时间与该版本的来源证明均齐全，确认根因是注册表元数据
+   的可见性延迟，不是上传失败。该窗口已在 0.9.7 放宽：最多 24 次核对、间隔 5 秒
+   线性递增并封顶 20 秒（约 7 分钟），仍然只读元数据、不重复上传包。这样既避免
+   「上传成功 + 核对延迟」在 Actions 页留下误导性的红色结论，也不会把真正的失败
+   伪装成成功——超出窗口依旧抛错。
 
 ## 五、官方资料
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-deeppilot",
-  "version": "0.9.5",
+  "version": "0.9.7",
   "description": "DeepPilot companion plugin for DeepSeek Harness: use DSH from a native iPhone app over an authenticated, direct connection to your own computer.",
   "repository": {
     "type": "git",
@@ -82,7 +82,8 @@
     "test": "tsx --test tests/*.test.ts"
   },
   "engines": {
-    "node": ">=22"
+    "node": ">=22",
+    "dsh": "0.2.0-rc.2 || 0.2.1-alpha.3 || 0.2.1-alpha.4 || 0.2.1-alpha.5"
   },
   "publishConfig": {
     "access": "public"
@@ -94,16 +95,16 @@
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "~4.0.4 || ~4.0.5-alpha.1",
-    "@deepseek-ai/dsh": "0.2.0-rc.2 || 0.2.1-alpha.3",
-    "@deepseek-ai/dsh-api-gateway": "0.2.0-rc.2 || 0.2.1-alpha.3",
-    "@deepseek-ai/dsh-api-remotes": "0.2.0-rc.2 || 0.2.1-alpha.3",
-    "@deepseek-ai/dsh-client-connection": "0.2.0-rc.2 || 0.2.1-alpha.3",
-    "@deepseek-ai/dsh-client-locale": "0.2.0-rc.2 || 0.2.1-alpha.3",
-    "@deepseek-ai/dsh-client-ui-settings": "0.2.0-rc.2 || 0.2.1-alpha.3",
-    "@deepseek-ai/dsh-client-ui-slots": "0.2.0-rc.2 || 0.2.1-alpha.3",
-    "@deepseek-ai/dsh-settings": "0.2.0-rc.2 || 0.2.1-alpha.3",
-    "@deepseek-ai/dsh-typert-protocol": "0.2.0-rc.2 || 0.2.1-alpha.3",
-    "@deepseek-ai/dsh-typert-registry": "0.2.0-rc.2 || 0.2.1-alpha.3",
+    "@deepseek-ai/dsh": "0.2.0-rc.2 || 0.2.1-alpha.3 || 0.2.1-alpha.4 || 0.2.1-alpha.5",
+    "@deepseek-ai/dsh-api-gateway": "0.2.0-rc.2 || 0.2.1-alpha.3 || 0.2.1-alpha.4 || 0.2.1-alpha.5",
+    "@deepseek-ai/dsh-api-remotes": "0.2.0-rc.2 || 0.2.1-alpha.3 || 0.2.1-alpha.4 || 0.2.1-alpha.5",
+    "@deepseek-ai/dsh-client-connection": "0.2.0-rc.2 || 0.2.1-alpha.3 || 0.2.1-alpha.4 || 0.2.1-alpha.5",
+    "@deepseek-ai/dsh-client-locale": "0.2.0-rc.2 || 0.2.1-alpha.3 || 0.2.1-alpha.4 || 0.2.1-alpha.5",
+    "@deepseek-ai/dsh-client-ui-settings": "0.2.0-rc.2 || 0.2.1-alpha.3 || 0.2.1-alpha.4 || 0.2.1-alpha.5",
+    "@deepseek-ai/dsh-client-ui-slots": "0.2.0-rc.2 || 0.2.1-alpha.3 || 0.2.1-alpha.4 || 0.2.1-alpha.5",
+    "@deepseek-ai/dsh-settings": "0.2.0-rc.2 || 0.2.1-alpha.3 || 0.2.1-alpha.4 || 0.2.1-alpha.5",
+    "@deepseek-ai/dsh-typert-protocol": "0.2.0-rc.2 || 0.2.1-alpha.3 || 0.2.1-alpha.4 || 0.2.1-alpha.5",
+    "@deepseek-ai/dsh-typert-registry": "0.2.0-rc.2 || 0.2.1-alpha.3 || 0.2.1-alpha.4 || 0.2.1-alpha.5",
     "@deepseek-ai/schemastery": "~3.18.4 || ~3.18.5-alpha.1",
     "react": "^19.2.8"
   },