dsh-git-worktree 0.7.1 → 0.7.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-git-worktree",
-  "version": "0.7.1",
+  "version": "0.7.2",
   "description": "Experimental Git worktree Session Targets for DeepSeek Harness with isolated sessions, review checkpoints, human-confirmed delivery, and safe recovery.",
   "type": "module",
   "main": "lib/index.js",
@@ -79,29 +79,38 @@
     "prepublishOnly": "pnpm run check:sidebar-version && pnpm run build && pnpm run check:publish:release && pnpm run test"
   },
   "dependencies": {
-    "@deepseek-ai/cordis": "4.0.1",
-    "@deepseek-ai/dsh-agent": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-commands": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-session": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-subprocess": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-system-prompt": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-tools": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-typert-protocol": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-typert-registry": "0.1.1-rc.2",
     "@deepseek-ai/schemastery": "3.18.1",
     "zod": "4.4.3"
   },
   "peerDependencies": {
+    "@deepseek-ai/cordis": "^4.0.1",
+    "@deepseek-ai/dsh-agent": "^0.1.1-rc.2",
     "@deepseek-ai/dsh-client-locale": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-commands": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-session": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-subprocess": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-system-prompt": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-tools": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-typert-protocol": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-typert-registry": "^0.1.1-rc.2",
     "react": "^18.2.0"
   },
   "devDependencies": {
+    "@deepseek-ai/cordis": "4.0.1",
+    "@deepseek-ai/dsh-agent": "0.1.1-rc.2",
     "@deepseek-ai/dsh-api-gateway": "0.1.1-rc.2",
     "@deepseek-ai/dsh-client-connection": "0.1.1-rc.2",
     "@deepseek-ai/dsh-client-locale": "0.1.1-rc.2",
     "@deepseek-ai/dsh-client-runtime": "0.1.1-rc.2",
     "@deepseek-ai/dsh-client-ui-workspace": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-commands": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-session": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-subprocess": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-system-prompt": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-tools": "0.1.1-rc.2",
     "@deepseek-ai/dsh-typert-loader": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-typert-protocol": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-typert-registry": "0.1.1-rc.2",
     "@testing-library/react": "^16.3.2",
     "@types/node": "^22.0.0",
     "@types/react": "~18.3.31",

package/scripts/check-publish.mjs

@@ -35,7 +35,32 @@ function includedByFiles(target) {
   })
 }
 
-// 1. Host bundle declaration and patch.
+// 1. Host singleton packages must resolve from DSH instead of a plugin-private dependency tree.
+const hostSingletonPackages = [
+  '@deepseek-ai/cordis',
+  '@deepseek-ai/dsh-agent',
+  '@deepseek-ai/dsh-commands',
+  '@deepseek-ai/dsh-session',
+  '@deepseek-ai/dsh-subprocess',
+  '@deepseek-ai/dsh-system-prompt',
+  '@deepseek-ai/dsh-tools',
+  '@deepseek-ai/dsh-typert-protocol',
+  '@deepseek-ai/dsh-typert-registry',
+]
+for (const packageName of hostSingletonPackages) {
+  if (manifest.dependencies?.[packageName] !== undefined) {
+    fail(`${packageName} must be a peerDependency; a private copy breaks Host service identity`)
+  }
+  if (typeof manifest.peerDependencies?.[packageName] !== 'string') {
+    fail(`${packageName} is missing from peerDependencies`)
+  }
+  if (typeof manifest.devDependencies?.[packageName] !== 'string') {
+    fail(`${packageName} is missing from devDependencies`)
+  }
+}
+ok(`${hostSingletonPackages.length} Host singleton packages are peer-provided and locally testable`)
+
+// 2. Host bundle declaration and patch.
 const patchRel = manifest.dsh?.bundle?.patch
 if (typeof patchRel !== 'string' || patchRel.length === 0) {
   fail('package.json lacks "dsh".bundle.patch — dsh plugin add would install a plain dependency without mounting it')
@@ -58,7 +83,7 @@ if (!manifest.files?.includes('NOTICE') || !existsSync(resolve(root, 'NOTICE')))
 }
 ok(`Host mount patch ${patchRel} replaces official ui-workspace with one gated derivative`)
 
-// 2. Every package export must exist and be included in the tarball.
+// 3. Every package export must exist and be included in the tarball.
 const exportsMap = manifest.exports
 if (!exportsMap || typeof exportsMap !== 'object' || Array.isArray(exportsMap)) fail('package.json lacks an exports map')
 let exportCount = 0
@@ -83,7 +108,7 @@ for (const stale of [
 }
 ok('removed Diff UI has no stale publish artifact')
 
-// 3. Manual strict Typert artifacts: one descriptor identity feeds Host Loader and Client mount.
+// 4. Manual strict Typert artifacts: one descriptor identity feeds Host Loader and Client mount.
 if (manifest.dependencies?.['@deepseek-ai/dsh-typert-generator'] || manifest.devDependencies?.['@deepseek-ai/dsh-typert-generator']) {
   fail('manual contribution package must not depend on @deepseek-ai/dsh-typert-generator')
 }
@@ -116,7 +141,7 @@ for (const descriptor of hostContribution.invocations) {
 }
 ok(`manual strict ./typert + ./remote contribution (${expectedRemoteMethods.length} methods)`)
 
-// 4. Host entry metadata required by the Cordis loader.
+// 5. Host entry metadata required by the Cordis loader.
 const entryRel = exportsMap['.']?.default ?? manifest.main
 if (typeof entryRel !== 'string') fail('exports["."].default is not a path')
 const entry = readFileSync(resolve(root, entryRel), 'utf8')
@@ -124,7 +149,7 @@ if (!/export\s+function\s+apply\b/.test(entry)) fail(`${entryRel} does not expor
 if (!/export\s+const\s+inject\b/.test(entry)) fail(`${entryRel} does not export const inject`)
 ok(`${entryRel} exports Host apply + inject`)
 
-// 5. Browser ToolView declaration and executable ModuleLoader closure.
+// 6. Browser ToolView declaration and executable ModuleLoader closure.
 const client = manifest.dsh?.client
 if (!client || client.platform !== 'web' || !Array.isArray(client.inject) || client.inject.length === 0) {
   fail('package.json must declare dsh.client { platform: "web", inject: [...] }')
@@ -192,7 +217,7 @@ if (!clientExports.inject.includes('remote')) fail('client bundle must inject th
 if (!clientExports.inject.includes('conversation')) fail('client bundle must inject the public conversation service for pre-session draft transfer')
 ok(`${clientRel} registers ${manifest.name} through the browser ModuleLoader contract`)
 
-// 6. Release CI and npm's prepublish lifecycle require committed source identity;
+// 7. Release CI and npm's prepublish lifecycle require committed source identity;
 // local review builds intentionally run against a dirty managed Worktree.
 const requireClean = process.env.CHECK_PUBLISH_REQUIRE_CLEAN === '1'
   || process.argv.includes('--require-clean')