dsh-fonttune 0.2.3 → 0.2.5

package/CHANGELOG.en.md

@@ -2,6 +2,24 @@
 
 All notable changes to **dsh-fonttune** are documented here. Chinese version: [CHANGELOG.md](CHANGELOG.md).
 
+## [0.2.5] - 2026-09-23
+
+### Fixed
+- **Installed as a link to the source directory, the card and the fonts disappeared together on 0.1.5-rc.x**: the plugin used the copy of the schema library in its own directory instead of the one DSH provides, and the newer copy marked the configuration in a way the rc line's settings controller cannot handle — the settings namespace was therefore never registered: no card in the settings sheet, an empty injected stylesheet, no typography change at all. It now always uses the copy DSH ships, so a linked install and a normal install behave identically.
+
+## [0.2.4] - 2026-09-23
+
+### Added
+- **One package for both host lines**: it installs and works as-is on **DSH 0.1.5-rc.1 – rc.3** and on **0.1.7-alpha.1 – alpha.2**, with no version to pick. At runtime the plugin uses whichever settings interface the host offers (the rc line's and the alpha's are different); when neither is there it only injects the font and shows no card.
+- **A configuration entry point on the alpha**: on 0.1.7-alpha.x the card lives in the sidebar's Plugins page, under the plugin entry "Font tune"; on rc.x it stays in Settings → Plugins → Plugin configuration.
+
+### Fixed
+- **On the alpha the card's first render was a column of empty controls**: it was reading the host's internal references instead of the values, so the injected stylesheet came out empty; the first frame now carries the right family and readouts.
+- **On the alpha an edit reported "The setting was not saved"**: the plugin could write to a place that was not its own; it now writes only after confirming the configuration is its own.
+
+### Changed
+- The compatibility statement and the compatibility table in both READMEs are updated to 0.2.4, listing the five host lines that were actually tested (0.1.5-rc.1 / rc.2 / rc.3 and 0.1.7-alpha.1 / alpha.2) and where each line's settings live.
+
 ## [0.2.3] - 2026-09-22
 
 ### Fixed

package/CHANGELOG.md

@@ -2,6 +2,24 @@
 
 **dsh-fonttune** 的重要变更都记录在这里。英文版见 [CHANGELOG.en.md](CHANGELOG.en.md)。
 
+## [0.2.5] - 2026-09-23
+
+### 修复
+- **以「链接到源码目录」的方式安装时，0.1.5-rc.x 上的配置卡片与字体一起消失**：插件会用自己目录里的 schema 库副本，而不是 DSH 自带的那一份；副本的较新版本给配置加了 rc 线宿主处理不了的标记，设置命名空间因此根本没有注册出去——设置页看不到卡片、注入的样式是空的、字体毫无变化。现在插件始终使用 DSH 自带的那一份，链接安装与正常安装在行为上完全一致。
+
+## [0.2.4] - 2026-09-23
+
+### 新增
+- **同一个安装包同时支持两条宿主线**：DSH **0.1.5-rc.1 – rc.3** 与 **0.1.7-alpha.1 – alpha.2** 上都能直接安装使用，不需要挑版本。插件在运行时按宿主实际提供的那一套设置接口工作（rc 线一套、alpha 线一套），两条都不在时只注入字体、不显示卡片。
+- **alpha 上的配置入口**：在 0.1.7-alpha.x 上，卡片出现在侧栏「插件」页的插件条目「字体增强」里；rc.x 上仍在 设置 → 插件 → 插件配置。
+
+### 修复
+- **alpha 上卡片第一次打开是一排空控件**：此前读到的是宿主的内部引用而不是配置值，注入的样式因此为空；现在首帧就是正确的字体与读数。
+- **alpha 上改设置提示「设置没有保存成功」**：插件有几率把改动写到不属于自己的位置；现在只在确认是自己的配置之后才写入。
+
+### 变更
+- 兼容声明与中英 README 的兼容表更新到 0.2.4，逐条列出五条实测过的宿主线（0.1.5-rc.1 / rc.2 / rc.3、0.1.7-alpha.1 / alpha.2），并写清两条线各自的设置入口。
+
 ## [0.2.3] - 2026-09-22
 
 ### 修复

package/README.en.md

@@ -22,14 +22,25 @@
 
 ## Compatibility
 
+**One package serves both host lines, 0.1.5-rc.x and 0.1.7-alpha.x**, and the install is the same on either: both were verified for "the settings card opens, the stylesheet really reaches the page, and a change made in the card is written through".
+
 | Plugin version | Supported DSH versions |
 | --- | --- |
-| **0.2.3** (latest) | 0.1.5-rc.2 |
+| **0.2.4** (latest) | 0.1.5-rc.1 / rc.2 / rc.3, 0.1.7-alpha.1 / alpha.2 |
+| 0.2.3 | 0.1.5-rc.2 |
 | 0.2.2 | 0.1.5-rc.2 |
 | 0.2.1 | 0.1.5-rc.2 |
 | 0.2.0 | 0.1.5-rc.2 |
 
-`engines.dsh` requires **0.1.5-rc.2** or newer, and the compatibility declaration lists only the **latest release of the 0.1.5 line**: it carries every fix in that line, which makes it the most stable build of the major version, while older builds of the same major version stay compatible per semantic versioning. Earlier or newer DSH versions are untested and not declared. The market entry also states these requirements (`engines.dsh`, `dsh.compatibility.dshReleases` and `peerDependencies` in `package.json`), so the host a version needs can be checked before installing.
+`engines.dsh` is declared as **`>=0.1.5-rc.1 <0.1.7-0 || >=0.1.7-alpha.1 <0.2.0-0`** (a prerelease needs its own branch: node-semver admits one only when some comparator in the range sits on that version's exact `major.minor.patch` tuple and carries a prerelease tag of its own, so a plain `>=0.1.5-rc.1` never matches `0.1.7-alpha.1`). Every difference between the lines is settled at runtime rather than by version number:
+
+- **The settings service**: up to 0.1.5-rc.x it is `settingsScope.bind({namespace})` (by namespace); from 0.1.7-alpha.x it is `configForms.get(<profile entry id>)` (by entry id, which the installing profile's patch decides — so the plugin claims the form whose served schema names its own fields). Both expose the same `getSnapshot`/`subscribe`/`set`/`unset` face, so one implementation covers them.
+- **The configuration card's seat**: the rc line has a keyed cell under Settings → Plugins → Plugin configuration (`settings.plugin.item`); the alpha line dropped that slot and instead contributes an entry to the Plugins page's official list (`plugins.item`, which is how the built-in settings pages are added there), plus a per-package page for a profile that installed this plugin as a bundle (`plugins.bundle.config`). All three are registered; the one a host never declares is inert.
+- **The host half's config values**: once the alpha marks the schema `.volatile()`, the fields the host half receives are cosmokit volatile references (`{get(),[write]}`) rather than plain values, which left the first-frame stylesheet row empty; the references are unwrapped before use.
+- **`inject` declares only services both lines have** (`slots`, `locale`): declaring one a host does not provide parks the whole package — on the alpha a declared `settingsScope` kept the entire Web UI from booting. The settings service is looked up with `ctx.get(name)` instead.
+- **The alpha's form is addressed by entry id**: while the host's `describe()` view has not arrived, the plugin does not guess a name (a wrong guess means every write is refused) — it stands in with a pending scope, adopts the real form as soon as the view is served, and re-reads immediately.
+
+The market entry also states these requirements (`engines.dsh`, `dsh.compatibility.dshReleases` and `peerDependencies` in `package.json`), so the host a version needs can be checked before installing.
 
 ## Install
 
@@ -73,8 +84,9 @@ Restart DSH once afterwards and open the Web UI; changing settings needs no rest
 - `src/index.mjs` — host half: registers the `dsh-fonttune` settings namespace (schemastery schema with length and range validation) and ships a **stamped** `<style>` into the served index through `webserver/index-inject`, so the first paint already uses the saved values; the browser half then **adopts and keeps that element** (there is only ever one copy of the stylesheet, so rules can be added *and* removed)
 - `src/client.js` — browser half: the settings card, the font picker panel, font enumeration and style injection
 - `build.mjs` — zero-dependency build: inlines the shared core, wraps the bundle in the `window.__ModuleLoader__.load({id, factory})` shell, copies the host half, and enforces that the client bundle only requires shell-held modules
-- `test/run.mjs` — offline checks (hand-built DOM / cordis / settings-surface doubles, the real schemastery schema, CSS generation and injection, sanitizer adversarial cases, dictionary key parity, the picker's grouping rules, the token-refresh power gate); `test/render-card.mjs` renders the card component through a mini React hooks runtime (including forced-open and forced-state renders, covering the 0.1.0 release-blocking crash class), fires **every control's callback** (an unwired handler only fails when someone actually clicks it) and **renders a second time** to cover a hook order that changes with state; `test/artifacts.mjs` proves `lib/` matches the current `src/` byte for byte (`npm run verify` runs all three)
-- Checks that need a real page run through `npm run verify:browser -- "<url-with-token>"` (start a managed instance first: `dsh web --port 0 --no-open` prints the URL). The default group is read-only (`browser-probe` / `ui-walk` / `style-verify`); `--writers` adds the scripts that **write the settings namespace** (`slider-walk` / `split-walk` / `split-verify` / `weight-verify`, each snapshots the user layer first and restores it before exiting), and `--only a,b` picks a subset. Every script's exit code is its verdict; `test/set-user-layer.mjs <url> '<json>'` puts the layer back after an interrupted run
+- `test/run.mjs` — offline checks (hand-built DOM / cordis / settings-surface doubles, the real schemastery schema, CSS generation and injection, sanitizer adversarial cases, dictionary key parity, the picker's grouping rules, the token-refresh power gate); `test/render-card.mjs` renders the card component through a mini React hooks runtime (including forced-open and forced-state renders, covering the 0.1.0 release-blocking crash class), fires **every control's callback** (an unwired handler only fails when someone actually clicks it) and **renders a second time** to cover a hook order that changes with state; `test/artifacts.mjs` proves `lib/` matches the current `src/` byte for byte (`npm run verify` runs all three). The devDependency is the **newest** schemastery (`^3.18.4`) — the alpha's dialect, whose `.volatile()` makes a resolved field a **reference** rather than a value — so these suites read values through the `plainConfigValue` the host half exports, the same path the plugin takes; at runtime the **host's own copy** is used (3.18.2 on rc.2 / rc.3, with no such modifier, a shape the live probe covers)
+- Checks that need a real page run through `npm run verify:browser -- "<url-with-token>"` (start a managed instance first: `dsh web --port 0 --no-open` prints the URL). The default group is read-only (`browser-probe` / `ui-walk` / `host-line-probe` / `style-verify`); `--writers` adds the scripts that **write the settings namespace** (`slider-walk` / `split-walk` / `split-verify` / `weight-verify`, each snapshots the user layer first and restores it before exiting), and `--only a,b` picks a subset. Every script's exit code is its verdict; `test/set-user-layer.mjs <url> '<json>'` puts the layer back after an interrupted run
+- `test/host-line-probe.mjs` is the **host-line-independent** check: it asserts only what must hold on every supported line — the page boots without errors, the plugin owns exactly ONE stylesheet element, the settings really reach the document (`DFP_EXPECT_FAMILY` / `DFP_EXPECT_WEIGHT` also assert the computed values when set), the configuration card is reachable from the settings sheet and renders (`.dfp-card`, whichever seat that line declares), and changing a control there really writes through. Run it first after switching host lines (rc ↔ alpha); set `DFP_PROBE=1` when debugging "the card's writes do not stick on the alpha" — the plugin then logs one `[dfp-probe]` line (which namespaces are served, which one was claimed, and what state the seat is in)
 - `test/weight-verify.mjs` measures all three weight axes (interface / conversation / code) in a live page, including that there is only one stylesheet element and that switching following off drops the followed weight without a reload; `test/split-verify.mjs` measures the conversation and code size axes plus the **retired interface size axis moving nothing**; `test/slider-walk.mjs` and `test/split-walk.mjs` drive the real card (a drag writes nothing, a release does; the simple-mode slots and the whole stack round-trip); the market-entry tooling is `test/market-pr.mjs` (status / update / refresh / reopen / open / about) and the diagnostic `test/market-inspect.mjs` (PR state, comments, CI and branch diff)
 - `docs/` — the 0.2.0 [research](docs/research-0.2.0.md) and [specification](docs/spec-0.2.0.md) records (written during design, with the trade-offs of that moment; where they differ from what shipped, README/CHANGELOG win — see the note at the top of each). **Not part of the npm `files` list, so they are not published**
 - The client bundle may only require modules from the shell's static table (`react`, `react/jsx-runtime`, `react-dom`, `@deepseek-ai/cordis`, `@deepseek-ai/dsh-client-*`…); `dsh.client.inject` declares load order, not require permission

package/README.md

@@ -22,14 +22,25 @@
 
 ## 兼容性
 
+**一份包同时支持 0.1.5-rc.x 与 0.1.7-alpha.x 两条宿主线**，安装方式与宿主线无关：两条线都验证过「设置卡片可用、样式真的作用到页面、卡片上的改动写得进去」。
+
 | 插件版本 | 支持的 DSH 版本 |
 | --- | --- |
-| **0.2.3**（最新） | 0.1.5-rc.2 |
+| **0.2.4**（最新） | 0.1.5-rc.1 / rc.2 / rc.3、0.1.7-alpha.1 / alpha.2 |
+| 0.2.3 | 0.1.5-rc.2 |
 | 0.2.2 | 0.1.5-rc.2 |
 | 0.2.1 | 0.1.5-rc.2 |
 | 0.2.0 | 0.1.5-rc.2 |
 
-`engines.dsh` 下限为 **0.1.5-rc.2**，兼容声明只列 **0.1.5 线的最新版本**：它包含这条线的全部修复，是同一大版本里最稳的一版，而同一大版本内的旧版本按语义化版本约定向上兼容。更早或更新的 DSH 未经验证，不作声明。市场条目同时声明这些兼容信息（`package.json` 的 `engines.dsh`、`dsh.compatibility.dshReleases` 与 `peerDependencies`），安装前可据此判断这一版需要的宿主版本。
+`engines.dsh` 声明为 **`>=0.1.5-rc.1 <0.1.7-0 || >=0.1.7-alpha.1 <0.2.0-0`**（预发布版本必须显式留分支：node-semver 只在一个范围的某个比较符与该版本落在同一个 `major.minor.patch` 元组、且自身带预发布标签时才放行，写成 `>=0.1.5-rc.1` 匹配不到 `0.1.7-alpha.1`）。两条线的差别**全部在运行时二选一，不看版本号**：
+
+- **设置服务**：0.1.5-rc.x 是 `settingsScope.bind({namespace})`（按命名空间），0.1.7-alpha.x 换成了 `configForms.get(<profile 条目 id>)`（按条目 id，id 由安装方的 profile patch 决定，所以插件靠「宿主服务的那份 schema 里有没有本插件自己的字段」来认领）。两者都是 `getSnapshot/subscribe/set/unset` 同一张脸，插件只写一套。
+- **配置卡片座位**：rc 线是 设置 → 插件 → 插件配置 里的一个 keyed 单元（`settings.plugin.item`）；alpha 线删掉了这个槽位，改成在「插件」页的官方插件列表里贡献一个条目（`plugins.item`，内置那些设置页就是这么挂的），并另外提供「已安装成 bundle 时」的每包页面（`plugins.bundle.config`）。三个座位都注册，宿主不声明的那个是惰性的。
+- **宿主半的配置来源**：alpha 把 schema 标成 `.volatile()` 之后，宿主半拿到的配置字段是 cosmokit 的 volatile 引用（`{get(),[write]}`）而不是普通值，首帧样式行会因此变空；插件先把引用解出来再用。
+- **`inject` 只声明两条线都有的服务**（`slots`、`locale`）：声明一个宿主没有的服务会把整包 park 住——alpha 上声明 `settingsScope` 会让整个 Web 界面起不来。设置服务一律用 `ctx.get(name)` 现查。
+- **alpha 的表单是「条目 id + 描述视图」**：宿主 `describe()` 还没答话时，插件不会去猜一个条目名（猜错的话每次写入都会被告主拒绝），而是先用一个等待态座位顶住，等宿主把视图发出来再接管并立刻重读。
+
+市场条目同时声明这些兼容信息（`package.json` 的 `engines.dsh`、`dsh.compatibility.dshReleases` 与 `peerDependencies`），安装前可据此判断这一版需要的宿主版本。
 
 ## 安装
 
@@ -73,8 +84,9 @@ dsh plugin --profile web add <插件目录路径>
 - `src/index.mjs` —— 宿主半：注册 `dsh-fonttune` 设置命名空间（schemastery schema，含长度与取值范围校验），并通过 `webserver/index-inject` 把一个打过标记的 `<style>` 随首页下发，首帧即是设置里的字体；那个元素随后由浏览器半**认领并接管**（页面里只有这一份样式表，规则可增可删）
 - `src/client.js` —— 浏览器半：设置卡片、选字体面板、字体枚举与样式注入
 - `build.mjs` —— 零依赖构建：内联共享核心、套上 `window.__ModuleLoader__.load({id, factory})` 外壳、拷贝宿主半，并校验客户端 bundle 只 require shell 预注入的模块
-- `test/run.mjs` —— 离线检查（自建 DOM / cordis / 设置面替身、真实 schemastery schema、CSS 生成与注入、消毒对抗用例、双语文案键一致性、选字体面板的分组规则、令牌轮询的省电闸门）；`test/render-card.mjs` 用 mini React hooks 运行时真实渲染卡片组件（含强制展开态与强制状态，覆盖 0.1.0 那类发布阻断崩溃），把**每个控件的回调都点一遍**（未接线的回调只有真点下去才会暴露），并**渲染第二次**覆盖「状态变化后 hook 顺序改变」这一类崩溃；`test/artifacts.mjs` 校验 `lib/` 与当前 `src/` 逐字节一致（`npm run verify` 跑全部三套）
-- 需要真实页面的检查走 `npm run verify:browser -- "<带 token 的地址>"`（先起一个受管实例：`dsh web --port 0 --no-open`，它会打印地址）。默认只跑**只读**的几支（`browser-probe` / `ui-walk` / `style-verify`）；加 `--writers` 再跑会**写设置命名空间**的几支（`slider-walk` / `split-walk` / `split-verify` / `weight-verify`，各自先快照用户层、退出前还原），`--only a,b` 挑子集；每支的退出码就是判定。`test/set-user-layer.mjs <url> '<json>'` 是在被中断的运行之后还原用户层的工具
+- `test/run.mjs` —— 离线检查（自建 DOM / cordis / 设置面替身、真实 schemastery schema、CSS 生成与注入、消毒对抗用例、双语文案键一致性、选字体面板的分组规则、令牌轮询的省电闸门）；`test/render-card.mjs` 用 mini React hooks 运行时真实渲染卡片组件（含强制展开态与强制状态，覆盖 0.1.0 那类发布阻断崩溃），把**每个控件的回调都点一遍**（未接线的回调只有真点下去才会暴露），并**渲染第二次**覆盖「状态变化后 hook 顺序改变」这一类崩溃；`test/artifacts.mjs` 校验 `lib/` 与当前 `src/` 逐字节一致（`npm run verify` 跑全部三套）。devDependency 钉的是**最新的** schemastery（`^3.18.4`），也就是 alpha 那套方言——它带 `.volatile()`，解析出来的字段是**引用**而不是值，所以这几套检查都通过宿主半导出的 `plainConfigValue` 取值（和插件读配置同一条路）；运行时用的是**宿主自带的那份**（rc.2/rc.3 是 3.18.2，没有该修饰符，那条形态由真机探针覆盖）
+- 需要真实页面的检查走 `npm run verify:browser -- "<带 token 的地址>"`（先起一个受管实例：`dsh web --port 0 --no-open`，它会打印地址）。默认只跑**只读**的几支（`browser-probe` / `ui-walk` / `host-line-probe` / `style-verify`）；加 `--writers` 再跑会**写设置命名空间**的几支（`slider-walk` / `split-walk` / `split-verify` / `weight-verify`，各自先快照用户层、退出前还原），`--only a,b` 挑子集；每支的退出码就是判定。`test/set-user-layer.mjs <url> '<json>'` 是在被中断的运行之后还原用户层的工具
+- `test/host-line-probe.mjs` 是**与宿主线无关**的那一支：只断言两条线都必须成立的事——页面无报错、插件只维护**一份**样式表、设置真的作用到文档（`DFP_EXPECT_FAMILY` / `DFP_EXPECT_WEIGHT` 给了就顺带断言计算样式）、设置页里能找到并渲染出 `.dfp-card`（哪条线的座位都行）、以及从卡片上改一个值真的写进去。换宿主线（rc ↔ alpha）后先跑它；调试「alpha 上卡片写不进去」这类问题时设 `DFP_PROBE=1`，插件会往控制台打一行 `[dfp-probe]`（服务了哪些命名空间、认领了哪个、座位当前是什么状态）
 - `test/weight-verify.mjs` 在真实页面里量三条字重轴（界面 / 对话 / 代码）的独立性与「样式表只有一份、不刷新关掉跟随立即回落」；`test/split-verify.mjs` 量对话/代码两条字号轴的独立性，外加**退役的界面字号轴什么都不动**；`test/slider-walk.mjs` 与 `test/split-walk.mjs` 驱动真实卡片（拖动不写、松手才写；简单模式两格与整条栈的往返）；另有市场条目的维护脚本 `test/market-pr.mjs`（status / update / refresh / reopen / open / about）与诊断脚本 `test/market-inspect.mjs`（PR 状态、评论、CI 与分支差异）
 - `docs/` —— 0.2.0 的[背景调研](docs/research-0.2.0.md)与[功能规格](docs/spec-0.2.0.md)（设计阶段的记录，含当时的取舍理由；与最终实现不同的地方以 README/CHANGELOG 为准，两份文件文首都有说明）。**不在 npm `files` 清单内，不随包发布**
 - 客户端模块能 require 的只有 shell 静态表里的模块（`react`、`react/jsx-runtime`、`react-dom`、`@deepseek-ai/cordis`、`@deepseek-ai/dsh-client-*` 等）；`dsh.client.inject` 只是加载顺序声明，不是 require 许可

package/lib/client.js

@@ -2266,7 +2266,6 @@ if (typeof module !== "undefined" && module.exports) module.exports = shared;
 
 var React = require("react");
 var createPortal = require("react-dom").createPortal;
-var primitives = require("@deepseek-ai/dsh-client-ui-primitives");
 
 var h = React.createElement;
 var useCallback = React.useCallback;
@@ -2334,8 +2333,24 @@ var setWestEntry = shared.setWestEntry;
 var setEastEntry = shared.setEastEntry;
 var removeStackEntry = shared.removeStackEntry;
 
-/** Services this bundle waits for before it applies. */
-var inject = ["slots", "locale", "settingsScope"];
+/**
+ * Services this bundle waits for before it applies.
+ *
+ * `settingsScope` is deliberately absent: a host that does not provide a
+ * declared service parks the whole package until it appears, and DSH
+ * 0.1.7-alpha.x replaced that service with `configForms` — a plugin asking for
+ * it never activates there. Both settings dialects are looked up at apply time
+ * with `ctx.get` instead (see `pickSettingsScope`).
+ */
+var inject = ["slots", "locale"];
+
+/**
+ * The settings scope and translator `apply` bound, for the seat that renders
+ * the card without handing it either: the alpha line's bundle page renders the
+ * registered component with its own props, so the card falls back to these.
+ */
+var cardScope = null;
+var cardT = null;
 
 /** The weight DSH uses for body text; choosing it means "leave it alone". */
 var NEUTRAL_WEIGHT = 400;
@@ -2364,6 +2379,80 @@ var CHEVRON_PATH =
 /** Panel height cap, used to decide whether it opens up or down. */
 var PANEL_HEIGHT = 380;
 
+/**
+ * The translator the card falls back to when the host hands it no `t`: the
+ * built-in English table says something useful where the key alone would not.
+ * @param {string} key - dictionary key.
+ * @param {Record<string, string>} [params] - `{name}` substitutions.
+ * @returns {string} the text.
+ */
+function fallbackTranslate(key, params) {
+  return translate("en", key, params);
+}
+
+/**
+ * The settings seat a host without any settings service leaves the card: every
+ * control renders disabled over an empty document, exactly like a read-only
+ * deployment. It keeps the card — and therefore the whole configuration page —
+ * from failing to render on a composition this plugin does not know.
+ */
+var MEMORY_SCOPE = {
+  getSnapshot: function () {
+    return {
+      status: "ready",
+      value: {},
+      base: {},
+      user: {},
+      revision: 0,
+      writable: false,
+      mode: "memory",
+    };
+  },
+  subscribe: function () {
+    return function () {};
+  },
+  set: function () {
+    return Promise.reject(new Error("settings are not available in this deployment"));
+  },
+  unset: function () {
+    return Promise.reject(new Error("settings are not available in this deployment"));
+  },
+};
+
+/* ------------------------------------------------------------------ *
+ * inline icons
+ * ------------------------------------------------------------------ */
+
+/**
+ * The 16px "plus" glyph of the "add a font" button.
+ *
+ * Drawn here rather than taken from `@deepseek-ai/dsh-client-ui-primitives`
+ * because that module's icon names are not stable across the host lines this
+ * plugin supports: up to 0.1.5-rc.x the shell exports `IconPlusOutline16`,
+ * while 0.1.7-alpha.x ships the same artwork as `IconPlusOutlineRegular` /
+ * `IconPlusOutlineMedium` — and requiring a name the shell does not have turns
+ * the whole card into a render error. The path is the shipped one, byte for
+ * byte, so the button looks identical on both.
+ * @returns {object} the svg element.
+ */
+function plusIcon() {
+  return h(
+    "svg",
+    {
+      width: 16,
+      height: 16,
+      viewBox: "0 0 16 16",
+      fill: "none",
+      xmlns: "http://www.w3.org/2000/svg",
+      "aria-hidden": "true",
+    },
+    h("path", {
+      d: "M8.64453 1.5V7.34961H14.5V8.65039H8.64453V14.5H7.34473V8.65039H1.5V7.34961H7.34473V1.5H8.64453Z",
+      fill: "currentColor",
+    })
+  );
+}
+
 /* ------------------------------------------------------------------ *
  * copy
  * ------------------------------------------------------------------ */
@@ -4013,7 +4102,7 @@ function StackPicker(props) {
               setOpen(!open);
             },
           },
-          h(primitives.IconPlusOutline16, null),
+          plusIcon(),
           h("span", null, t("stack.add"))
         )
       )
@@ -4186,6 +4275,24 @@ function firstFamily(stack) {
  * the card
  * ------------------------------------------------------------------ */
 
+/**
+ * The card as DSH 0.1.7-alpha.x's Plugins page renders it.
+ *
+ * That page contributes one entry per plugin (`plugins.item`) and asks that one
+ * component for two different views: a one-line `summary` for the card in the
+ * list, and the `page` body once the entry is opened. The summary is answered
+ * with the card's own description, and every other view is the card itself, so
+ * the same UI serves the rc line's configuration cell and the alpha's plugin
+ * page without a second implementation.
+ * @param {object} props - the view asked for plus the injected face.
+ * @returns {object|string} the card, or the one-line summary.
+ */
+function FontCardPage(props) {
+  var t = typeof props.t === "function" ? props.t : cardT || fallbackTranslate;
+  if (props.view === "summary") return t("card.description");
+  return h(FontCard, { scope: props.scope || cardScope || MEMORY_SCOPE, t: t });
+}
+
 /**
  * Render the plugin's card: the settings section dispatches this component
  * under the namespace key, and the host has to serve that namespace for it to
@@ -4203,8 +4310,11 @@ function firstFamily(stack) {
  * @returns {object} the card element.
  */
 function FontCard(props) {
-  var t = props.t;
-  var scope = props.scope;
+  // The registration hands the card its face on the line that supports
+  // `inject`; the alpha's bundle page renders it with its own props, so the
+  // values `apply` bound are the fallback.
+  var t = typeof props.t === "function" ? props.t : cardT || fallbackTranslate;
+  var scope = props.scope || cardScope || MEMORY_SCOPE;
   var [open, setOpen] = useState(false);
   var [view, setView] = useState(readViewMode);
   var [expanded, setExpanded] = useState(null);
@@ -4306,13 +4416,48 @@ function FontCard(props) {
    * Report a write the settings document refused. A silent failure is the
    * worst outcome here: the control goes back to showing the stored value and
    * the user is left believing the change was saved.
-   * @param {unknown} error - the rejection reason.
+   * @param {unknown} error - the rejection reason, or a boolean refusal.
    */
   var writeFailed = function (error) {
-    var message = error && error.message ? String(error.message) : String(error);
+    var message =
+      error === false || error === undefined
+        ? "the host refused the write"
+        : error && error.message
+          ? String(error.message)
+          : String(error);
     if (message.length > 160) message = message.slice(0, 160) + "…";
     showStatus(t("preset.writeFailed", { message: message }));
   };
+  /**
+   * Follow one queued settings write.
+   *
+   * The two host lines answer differently: up to 0.1.5-rc.x the scope resolves
+   * a promise that rejects on a transport failure, while 0.1.7-alpha.x resolves
+   * `false` for a write the host refused (a stale revision, say). Both are
+   * reported, and a refused write is never left looking saved.
+   * @param {unknown} result - what the scope returned.
+   */
+  var followWrite = function (result) {
+    if (result === false) {
+      writeFailed(result);
+      return;
+    }
+    if (result && typeof result.then === "function") {
+      result.then(function (accepted) {
+        if (accepted === false) writeFailed(accepted);
+      }, function (error) {
+        // The scope reloads the Host state itself; the status row is what
+        // keeps the user from thinking the change stuck.
+        writeFailed(error);
+      });
+      return;
+    }
+    if (result && typeof result.catch === "function") {
+      result.catch(function (error) {
+        writeFailed(error);
+      });
+    }
+  };
   var submit = function (field, value) {
     var result;
     try {
@@ -4321,13 +4466,7 @@ function FontCard(props) {
       writeFailed(error);
       return;
     }
-    if (result && typeof result.catch === "function") {
-      result.catch(function (error) {
-        // The scope reloads the Host state itself; the status row is what
-        // keeps the user from thinking the change stuck.
-        writeFailed(error);
-      });
-    }
+    followWrite(result);
   };
   var clear = function (field) {
     var result;
@@ -4337,11 +4476,7 @@ function FontCard(props) {
       writeFailed(error);
       return;
     }
-    if (result && typeof result.catch === "function") {
-      result.catch(function (error) {
-        writeFailed(error);
-      });
-    }
+    followWrite(result);
   };
   var overridden = function (field) {
     return Object.prototype.hasOwnProperty.call(user, field);
@@ -5282,7 +5417,231 @@ function apply(ctx) {
   var applyCss = createStylesheet(function () {
     return tokens;
   });
-  var scope = ctx.settingsScope.bind({ namespace: NAMESPACE });
+
+  /**
+   * Look a service up without declaring it.
+   *
+   * Declaring a name the running host does not provide parks the whole package
+   * until it appears — on DSH 0.1.7-alpha.x a declared `settingsScope` left the
+   * Web UI waiting on a service that no longer exists. Both routes are tried:
+   * `ctx.get(name)` first, then the service property older lines also expose.
+   * @param {string} name - the service name.
+   * @returns {object|null} the service, or null when this host has none.
+   */
+  var getService = function (name) {
+    try {
+      if (typeof ctx.get === "function") {
+        var found = ctx.get(name);
+        if (found) return found;
+      }
+    } catch (error) {
+      // fall through to the property read
+    }
+    try {
+      return ctx[name] || null;
+    } catch (error) {
+      return null;
+    }
+  };
+
+  /**
+   * Whether one served namespace is THIS plugin's form.
+   *
+   * The alpha keys a form by profile entry id, which the installing profile's
+   * patch decides, so the entry's own fields are what identify us: either the
+   * served schema or the values it carries name them.
+   * @param {object} entry - one namespace from the describe view.
+   * @returns {boolean} true when the entry is this plugin's.
+   */
+  var isOurNamespace = function (entry) {
+    var schema = "";
+    try {
+      schema = JSON.stringify((entry && entry.schema) || {});
+    } catch (error) {
+      schema = "";
+    }
+    if (schema.indexOf(UI_FOLLOWS_FIELD) >= 0 && schema.indexOf(STACK_DIALOG_FIELD) >= 0) {
+      return true;
+    }
+    var values = (entry && (entry.value || entry.user || entry.base)) || {};
+    return (
+      Object.prototype.hasOwnProperty.call(values, UI_FOLLOWS_FIELD) &&
+      Object.prototype.hasOwnProperty.call(values, STACK_DIALOG_FIELD)
+    );
+  };
+
+  /**
+   * The profile entry id the `configForms` dialect addresses settings by.
+   *
+   * Up to 0.1.5-rc.x a namespace is a name the plugin registers; from
+   * 0.1.7-alpha.x the settings service derives a form per composed entry and
+   * keys it by that entry's id — which the installing profile's patch decides,
+   * so nothing here may hard-code it. The served view is the only honest
+   * answer: while it has not arrived this returns null, and the caller waits
+   * for it instead of guessing a name whose form could never be written.
+   * @param {object} forms - the `configForms` service.
+   * @returns {string|null} the entry id, or null while the host has not served it.
+   */
+  var formsNamespace = function (forms) {
+    var view = null;
+    try {
+      view = forms.describe ? forms.describe().getSnapshot().view : null;
+    } catch (error) {
+      view = null;
+    }
+    var served = (view && view.namespaces) || [];
+    if (globalThis.__DFP_PROBE__ === true) {
+      console.log(
+        "[dfp-probe] served namespaces " +
+          JSON.stringify(
+            served.map(function (item) {
+              return item && item.ns;
+            })
+          )
+      );
+    }
+    for (var index = 0; index < served.length; index += 1) {
+      if (isOurNamespace(served[index])) {
+        if (globalThis.__DFP_PROBE__ === true) {
+          console.log("[dfp-probe] matched by served schema: " + String(served[index].ns));
+        }
+        return served[index].ns;
+      }
+    }
+    return null;
+  };
+
+  /**
+   * A scope that adopts the host's scope the moment the host serves it.
+   *
+   * The alpha's `configForms` can be asked for a form before its describe view
+   * has arrived — `get(id)` then answers with a not-ready controller for that
+   * id, and every write through it is refused. This stands in for the scope
+   * until the real one is identifiable, forwards the card's subscription to it
+   * on adoption, and lets the card re-read immediately afterwards.
+   * @returns {object} the pending scope, with an `adopt` seat for the caller.
+   */
+  var createPendingScope = function () {
+    var target = null;
+    var listeners = [];
+    return {
+      getSnapshot: function () {
+        return target === null
+          ? {
+              status: "loading",
+              value: undefined,
+              base: undefined,
+              user: undefined,
+              revision: undefined,
+              writable: false,
+              mode: "pending",
+            }
+          : target.getSnapshot();
+      },
+      subscribe: function (listener) {
+        if (target !== null) return target.subscribe(listener);
+        listeners.push(listener);
+        return function () {
+          var at = listeners.indexOf(listener);
+          if (at >= 0) listeners.splice(at, 1);
+        };
+      },
+      set: function (field, value) {
+        if (target === null) {
+          return Promise.reject(new Error("the settings service is still starting"));
+        }
+        return target.set(field, value);
+      },
+      unset: function (field) {
+        if (target === null) {
+          return Promise.reject(new Error("the settings service is still starting"));
+        }
+        return target.unset(field);
+      },
+      /** Hand over the real scope once it is identifiable; true when taken. */
+      adopt: function (next) {
+        if (target !== null || next === null || next === undefined) return false;
+        target = next;
+        var pending = listeners.slice();
+        listeners.length = 0;
+        for (var index = 0; index < pending.length; index += 1) {
+          target.subscribe(pending[index]);
+          pending[index]();
+        }
+        return true;
+      },
+    };
+  };
+
+  /**
+   * Bind the settings scope in whichever dialect the running host speaks: the
+   * `settingsScope` service up to 0.1.5-rc.x (`bind({namespace})`), the
+   * `configForms` service from 0.1.7-alpha.x (`get(entryId)`). Both expose the
+   * same snapshot/`set`/`unset` face, so one card covers them.
+   * @returns {object|null} the bound scope, or null when neither dialect answered.
+   */
+  var pickSettingsScope = function () {
+    var settingsScope = getService("settingsScope");
+    if (settingsScope && typeof settingsScope.bind === "function") {
+      try {
+        var bound = settingsScope.bind({ namespace: NAMESPACE });
+        if (bound) return bound;
+      } catch (error) {
+        // fall through to the newer dialect
+      }
+    }
+    var forms = getService("configForms");
+    if (forms && typeof forms.get === "function") {
+      var bindAlphaForm = function () {
+        var ns = formsNamespace(forms);
+        if (ns === null) return null;
+        try {
+          var form = forms.get(ns);
+          return form && typeof form.getSnapshot === "function" ? form : null;
+        } catch (error) {
+          return null;
+        }
+      };
+      var immediate = bindAlphaForm();
+      if (immediate !== null) return immediate;
+      var pending = createPendingScope();
+      var mirror = null;
+      try {
+        mirror = typeof forms.describe === "function" ? forms.describe() : null;
+      } catch (error) {
+        mirror = null;
+      }
+      var offMirror = null;
+      var adopt = function () {
+        var form = bindAlphaForm();
+        if (form === null) return;
+        if (!pending.adopt(form)) return;
+        if (typeof offMirror === "function") offMirror();
+      };
+      if (mirror && typeof mirror.subscribe === "function") {
+        offMirror = mirror.subscribe(adopt);
+        if (typeof mirror.ensure === "function") mirror.ensure();
+      }
+      adopt();
+      return pending;
+    }
+    return null;
+  };
+
+  var scope = pickSettingsScope() || MEMORY_SCOPE;
+  if (globalThis.__DFP_PROBE__ === true) {
+    var probeSnapshot = scope.getSnapshot ? scope.getSnapshot() : {};
+    console.log(
+      "[dfp-probe] scope " +
+        JSON.stringify({
+          mode: probeSnapshot.mode,
+          status: probeSnapshot.status,
+          revision: probeSnapshot.revision,
+          writable: probeSnapshot.writable,
+          value: probeSnapshot.value,
+        })
+    );
+  }
   var appliedOverrides = "";
 
   /**
@@ -5436,6 +5795,9 @@ function apply(ctx) {
     }
     return translate(locale, key, params);
   };
+  // The card reads these when a seat renders it without the injected face.
+  cardScope = scope;
+  cardT = t;
   ctx.effect(
     function () {
       return ctx.locale.register(NAMESPACE, DICTS);
@@ -5443,18 +5805,59 @@ function apply(ctx) {
     "dsh-fonttune: dictionaries"
   );
 
-  ctx.slots.inject("settings.plugin.item", function () {
-    return ctx.slots.register(
-      {
-        name: "settings.plugin.item",
-        key: NAMESPACE,
+  /**
+   * Offer the card in one slot seat.
+   *
+   * Which seat a host declares is a line difference, not a preference, and the
+   * three are not alternatives to pick from — each is simply inert where a host
+   * never declares it:
+   *
+   *  * `settings.plugin.item` — up to 0.1.5-rc.x, a keyed cell under
+   *    Settings → Plugins → Plugin configuration (keyed by the namespace);
+   *  * `plugins.item` — 0.1.7-alpha.x's own entry in the Plugins page's
+   *    official list, which is how EVERY plugin page is contributed there (the
+   *    built-in settings pages do the same), and the seat that needs no
+   *    installed package behind it;
+   *  * `plugins.bundle.config` — the alpha's per-package page, keyed by the npm
+   *    package name, for a profile that installed this plugin as a bundle.
+   *
+   * @param {string} seat - the slot name.
+   * @param {object} options - the registration options that seat looks up.
+   * @param {Function} [component] - the component to register; the card itself
+   *   unless a seat hands it props the card does not read.
+   */
+  var offerCard = function (seat, options, component) {
+    ctx.slots.inject(seat, function () {
+      var registration = {
+        name: seat,
+        locale: NAMESPACE,
         inject: function () {
           return { scope: scope, t: t };
         },
+      };
+      for (var field in options) {
+        if (Object.prototype.hasOwnProperty.call(options, field)) {
+          registration[field] = options[field];
+        }
+      }
+      return ctx.slots.register(registration, component === undefined ? FontCard : component);
+    });
+  };
+  if (scope !== MEMORY_SCOPE) {
+    offerCard("settings.plugin.item", { key: NAMESPACE });
+    offerCard("plugins.bundle.config", { key: "dsh-fonttune" });
+    offerCard(
+      "plugins.item",
+      {
+        id: "fonttune",
+        order: 40,
+        label: function () {
+          return t("card.title");
+        },
       },
-      FontCard
+      FontCardPage
     );
-  });
+  }
 }
 
 exports.apply = apply;

package/lib/index.js

@@ -20,12 +20,54 @@
  *
  * @module dsh-fonttune
  */
-import z from "@deepseek-ai/schemastery";
+import { createRequire } from "node:module";
+import { dirname, sep } from "node:path";
+import { fileURLToPath } from "node:url";
 // Default import, not named: `shared.cjs` is a CommonJS module, and Node's
 // CJS-to-ESM interop only guarantees `module.exports` as the default binding
 // (statically-detected named exports would break this half at boot).
 import shared from "./shared.cjs";
 
+/**
+ * The schema library, taken from the HOST whenever the host can be reached.
+ *
+ * `@deepseek-ai/schemastery` is an optional peer dependency — DSH supplies the
+ * schema library, this package never ships its own copy into a profile. Node's
+ * bare-specifier resolution does not know that: when this package is linked or
+ * junctioned into a profile (the development setup) the specifier resolves
+ * inside this package's own `node_modules`, i.e. to the devDependency. That is
+ * a SECOND instance of the library, and — worse — a newer one than the running
+ * host may carry: its `.volatile()` marking lands on a schema the rc line's
+ * settings controller cannot digest, so the namespace is never served (no card
+ * in the settings sheet, an empty first-frame stylesheet). Measured on
+ * 0.1.5-rc.3: linked → nothing, installed → works.
+ *
+ * Resolving from the host first keeps one instance and one dialect, which is
+ * exactly what an installed package gets. `process.argv[1]` is the host's own
+ * entry (its `node_modules` holds the authoritative copy); anything resolving
+ * back inside THIS package is skipped, so the offline suites — which have no
+ * host — still fall through to the devDependency.
+ * @returns {object} the schemastery export.
+ */
+function loadSchemastery() {
+  const own = dirname(dirname(fileURLToPath(import.meta.url))) + sep;
+  const bases = [process.argv[1], fileURLToPath(import.meta.url)];
+  for (const base of bases) {
+    if (typeof base !== "string" || base === "") continue;
+    try {
+      const from = createRequire(base);
+      if (!from.resolve("@deepseek-ai/schemastery").startsWith(own)) {
+        return from("@deepseek-ai/schemastery");
+      }
+    } catch {
+      // Not resolvable from that anchor: try the next one.
+    }
+  }
+  return createRequire(import.meta.url)("@deepseek-ai/schemastery");
+}
+
+const z = loadSchemastery();
+
 const {
   buildFontCss,
   CODE_LINE_HEIGHT_FIELD,
@@ -71,6 +113,30 @@ const MAX_STACK = 200;
  */
 const SAFE_FEATURES = /^[a-zA-Z0-9"' ,]*$/;
 
+/**
+ * Mark a schema editable without reloading, where the running schemastery
+ * knows the modifier.
+ *
+ * DSH 0.1.7-alpha.x derives a settings page from one form per composed entry
+ * and only projects the fields under a node marked `.volatile()` — an entry
+ * whose schema has no such node is skipped entirely, so the plugin would have
+ * no configuration page there. The modifier arrived in schemastery 3.18.x for
+ * the alpha line; the 0.1.5-rc.x line ships 3.18.2, where calling it while
+ * this module is imported would throw. Feature-detecting it is therefore the
+ * whole compatibility shim: the rc line keeps the plain schema it has always
+ * used, and the alpha gets the marking it needs.
+ *
+ * Marking the ROOT object makes every field below it live-editable; schemastery
+ * refuses a volatile node nested inside another volatile one, so nothing below
+ * may carry the modifier as well.
+ *
+ * @param {object} schema - the object schema.
+ * @returns {object} the schema, marked when the modifier exists.
+ */
+function volatileWhenSupported(schema) {
+  return typeof schema.volatile === "function" ? schema.volatile() : schema;
+}
+
 /**
  * The durable settings section.
  *
@@ -82,7 +148,7 @@ const SAFE_FEATURES = /^[a-zA-Z0-9"' ,]*$/;
  * value. Installing the plugin therefore changes nothing until the user asks
  * for something.
  */
-export const Config = z.object({
+export const Config = volatileWhenSupported(z.object({
   [SANS_FIELD]: z
     .string()
     .max(MAX_STACK)
@@ -220,13 +286,46 @@ export const Config = z.object({
     .max(shared.MAX_PRESET_NAME)
     .default("")
     .description("Name of the preset the card currently edits (edits auto-save into it)"),
-});
+}));
 
 /**
  * One row of the structured index injection table.
  * @typedef {{kind: "style", text: string} | {kind: "html", placement: "head", html: string}} StyleRow
  */
 
+/**
+ * The cosmokit volatile-reference protocol: a parsed config field may be a
+ * frozen `{ get(), [write](value) }` reference rather than a plain value.
+ *
+ * DSH 0.1.7-alpha.x marks the plugin's whole schema `.volatile()` so a settings
+ * write can land without remounting the entry, and the loader then hands this
+ * plugin a config whose fields ARE those references. Reading them as plain data
+ * (which `normalizeConfig` expects) would see objects where strings belong and
+ * emit nothing, so the references are unwrapped first. On the 0.1.5-rc.x line
+ * no field is a reference and this is a plain deep copy.
+ */
+const VOLATILE_WRITE = Symbol.for("cosmokit.volatile.write");
+
+/**
+ * Replace every volatile reference in a parsed config with its current value.
+ *
+ * Exported because it is half of this plugin's host-line contract: a caller that
+ * wants to read a resolved config — a test, or a later composition — has to go
+ * through it, since on the alpha a parsed field is a reference rather than data.
+ * @param {unknown} value - a parsed config value, or a reference to one.
+ * @returns {unknown} the same shape, references unwrapped.
+ */
+export function plainConfigValue(value) {
+  if (value === null || typeof value !== "object") return value;
+  if (VOLATILE_WRITE in value && typeof value.get === "function") {
+    return plainConfigValue(value.get());
+  }
+  if (Array.isArray(value)) return value.map(plainConfigValue);
+  const out = {};
+  for (const [key, child] of Object.entries(value)) out[key] = plainConfigValue(child);
+  return out;
+}
+
 /**
  * The style row carrying one configuration.
  *
@@ -240,7 +339,7 @@ export const Config = z.object({
  * @returns {StyleRow} the row the web server renders into `<head>`.
  */
 function styleRow(resolved) {
-  const cfg = normalizeConfig(resolved);
+  const cfg = normalizeConfig(plainConfigValue(resolved));
   // 0.2.0 ships the per-theme editor out; light and dark stay one value set
   // (the dark fields remain in the schema, dormant, for a future release).
   cfg[PER_THEME_FIELD] = false;
@@ -258,20 +357,47 @@ function styleRow(resolved) {
 
 /**
  * Register the settings section and keep the index in sync with it.
+ *
+ * TWO HOST DIALECTS. Up to DSH 0.1.5-rc.x the settings service registers a
+ * named section with a schema and reads it back by that name
+ * (`settings.installSection`), and the section name is what the browser half
+ * binds. From 0.1.7-alpha.x the service derives one form per composed entry and
+ * addresses it by the PROFILE ENTRY ID — there is no `installSection` at all,
+ * and an instance announces its page policy with `settings.configure` instead.
+ * Both are pure registrations that the browser half then reads through its own
+ * service, so which one ran does not change anything else here.
+ *
  * @param {object} ctx - host cordis context.
  * @param {unknown} config - the plugin entry's composition config (base layer).
  */
 export function apply(ctx, config) {
   let current = () => config;
   ctx.inject(["settings"], (settingsCtx) => {
-    settingsCtx.settings.installSection(ctx, NAMESPACE, Config, config ?? {}, {
-      setSource: (source) => {
-        current = source;
-      },
-      // The row table is rebuilt on every index render and every worker boot
-      // payload, so each read is already fresh; nothing to invalidate here.
-      onChange: () => {},
-    });
+    const settings = settingsCtx.settings;
+    if (settings && typeof settings.installSection === "function") {
+      settings.installSection(ctx, NAMESPACE, Config, config ?? {}, {
+        setSource: (source) => {
+          current = source;
+        },
+        // The row table is rebuilt on every index render and every worker boot
+        // payload, so each read is already fresh; nothing to invalidate here.
+        onChange: () => {},
+      });
+      return;
+    }
+    if (settings && typeof settings.configure === "function") {
+      // `auto: true` keeps the host's generated page as the fallback wherever
+      // no custom page of ours is reachable.
+      settingsCtx.effect(() => settings.configure({ auto: true }, ctx.fiber));
+      // This dialect has no registered reader: the entry's live, merged value
+      // is the fiber's own resolved config, which is what the settings service
+      // shows a form as well. The browser half adopts and rewrites the served
+      // element on activation either way, so this only decides the first frame.
+      current = () => {
+        const live = ctx.fiber && ctx.fiber.config;
+        return live === undefined || live === null ? config : live;
+      };
+    }
   });
   ctx.on("webserver/index-inject", (table) => {
     table.push(styleRow(current()));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-fonttune",
-  "version": "0.2.3",
+  "version": "0.2.5",
   "description": "Font plugin for the DeepSeek Harness Web GUI: the conversation gets its own font, size, line height and weight, the interface font and weight follow it, code keeps its own axis with ligature control, and whole setups save as presets.",
   "type": "module",
   "main": "lib/index.js",
@@ -19,7 +19,7 @@
     "LICENSE"
   ],
   "engines": {
-    "dsh": ">=0.1.5-rc.2"
+    "dsh": ">=0.1.5-rc.1 <0.1.7-0 || >=0.1.7-alpha.1 <0.2.0-0"
   },
   "dsh": {
     "bundle": {
@@ -30,13 +30,17 @@
     },
     "compatibility": {
       "dshReleases": {
-        "0.1.5-rc.2": "compatible"
+        "0.1.5-rc.1": "compatible",
+        "0.1.5-rc.2": "compatible",
+        "0.1.5-rc.3": "compatible",
+        "0.1.7-alpha.1": "compatible",
+        "0.1.7-alpha.2": "compatible"
       }
     }
   },
   "peerDependencies": {
-    "react": "^18.2.0",
-    "@deepseek-ai/schemastery": "^3.18.0"
+    "@deepseek-ai/schemastery": "^3.18.0",
+    "react": "^18.2.0"
   },
   "peerDependenciesMeta": {
     "@deepseek-ai/schemastery": {
@@ -44,7 +48,7 @@
     }
   },
   "devDependencies": {
-    "@deepseek-ai/schemastery": "^3.18.0"
+    "@deepseek-ai/schemastery": "^3.18.4"
   },
   "scripts": {
     "build": "node build.mjs",