dsh-office-tools 0.2.0 → 1.0.2

package/lib/types/asciizip.d.ts

@@ -0,0 +1,95 @@
+/**
+ * Self-contained OOXML zip container (1.0.0).
+ *
+ * Two halves:
+ *
+ *  - `buildAsciiZip` WRITES a package whose every byte is at most 0x7F. All
+ *    entries are STOREd and the planner pads each XML part with trailing
+ *    newlines (legal after the root element) until every CRC-32, size, and
+ *    offset field of the archive is itself ASCII-safe. That makes the whole
+ *    document a pure-ASCII string, so it can travel through any UTF-8 text
+ *    channel — specifically the official `ctx.fs.writeText` service — and land
+ *    on disk byte-identical. No compression, no binary parts: this is the
+ *    contract that keeps the plugin free of direct file-system access while
+ *    still producing real .docx/.xlsx/.pptx files every Office suite opens.
+ *
+ *  - `readZip` READS any real-world OOXML package: STORE and DEFLATE entries
+ *    (via node:zlib), bounded by the same declared-size budgets the jszip
+ *    guard enforced in <=0.6.x — per-entry, total, and entry-count caps are
+ *    checked against the central directory BEFORE anything is inflated.
+ */
+/** Hard cap for reading an existing Office file into memory. */
+export declare const MAX_OFFICE_FILE_BYTES: number;
+/** Declared uncompressed ceiling for one zip entry inside an Office file. */
+export declare const MAX_ZIP_ENTRY_BYTES: number;
+/** Declared uncompressed ceiling summed over all entries of one archive. */
+export declare const MAX_ZIP_TOTAL_BYTES: number;
+/** Maximum entries (files + directories) in one archive. */
+export declare const MAX_ZIP_ENTRIES = 100000;
+/** Overridable budgets so tests can trip the guard with tiny values. */
+export interface ZipGuardLimits {
+    maxEntryBytes?: number;
+    maxTotalBytes?: number;
+    maxEntries?: number;
+}
+/** ASCII-safe = every byte at most 0x7F, so UTF-8 encoding is the identity. */
+export declare function assertAscii(value: string, label: string): void;
+export interface ZipPart {
+    name: string;
+    content: string;
+}
+/**
+ * Build the whole package as one ASCII-safe string: local STORE entries in
+ * order, the central directory, and the end-of-central-directory record.
+ */
+export declare function buildAsciiZip(parts: ZipPart[]): string;
+export interface ZipEntryInfo {
+    name: string;
+    method: number;
+    compressedSize: number;
+    uncompressedSize: number;
+    localOffset: number;
+}
+export declare class ZipArchive {
+    private readonly bytes;
+    readonly entries: ReadonlyMap<string, ZipEntryInfo>;
+    constructor(bytes: Uint8Array, entries: Map<string, ZipEntryInfo>);
+    has(name: string): boolean;
+    entryNames(): string[];
+    entryCount(): number;
+    /**
+     * Raw (still compressed) bytes of one entry, located through its own local
+     * header so central-directory offsets are never trusted for slicing.
+     */
+    entryBytes(name: string): Uint8Array;
+    /** Inflated (stored or decompressed) bytes of one entry, bounded by its declared size. */
+    private entryData;
+    /** Decode one entry as UTF-8 text after inflating it when needed. */
+    entryText(name: string): string;
+    /** True when an entry's INFLATED content can round-trip an ASCII-safe rewrite. */
+    entryIsAsciiSafe(name: string): boolean;
+}
+/**
+ * Parse and guard one archive: the end-of-central-directory record is found
+ * by scanning backwards, every entry's DECLARED uncompressed size is checked
+ * against the budgets before anything is inflated, and every local slice is
+ * re-derived from the entry's own local header.
+ */
+export declare function readZip(bytes: Uint8Array, limits?: ZipGuardLimits): ZipArchive;
+/**
+ * OOXML parts are plain element trees; a DOCTYPE/ENTITY declaration is never
+ * legitimate in one. Our extractors never resolve entities, but we refuse to
+ * look at such a part at all so entity-expansion payloads die at the door.
+ */
+export declare function assertNoXmlDtd(xml: string, label: string): void;
+/**
+ * Read one zip part as text and refuse DTD/entity-bearing XML before any
+ * caller parses it. Returns null when the archive has no such part.
+ */
+export declare function readZipXmlPart(zip: ZipArchive, name: string): string | null;
+/**
+ * Materialize every file entry as text for an ASCII-safe re-emit. Any entry
+ * with binary (non-ASCII) bytes throws: the re-publish path goes through the
+ * official UTF-8 text channel and cannot round-trip binary parts.
+ */
+export declare function asciiPartsOf(zip: ZipArchive): ZipPart[];

package/lib/types/fschannel.d.ts

@@ -0,0 +1,91 @@
+/**
+ * The official file-system channel (1.0.0).
+ *
+ * Every byte this plugin reads or writes goes through the host's `ctx.fs`
+ * service (`@deepseek-ai/dsh-fs`): reads arrive as raw byte arrays via
+ * `readBytes`, writes leave as UTF-8 text via `writeText` — which is exactly
+ * why `buildAsciiZip` keeps generated packages pure ASCII. The plugin itself
+ * never touches the file system directly: workspace containment, symlink
+ * resolution, and atomic publication all belong to the backend, and this
+ * module only adds the Office-tool path policy on top (extension allow-lists,
+ * size caps, overwrite refusal, display paths). Writes carry the per-call
+ * sandbox policy (`ctx.sandboxPolicy.resolve({ session })` when a confining
+ * backend is mounted) so sandboxing backends fence them by the session's
+ * effective policy rather than the deployment default.
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import type { FileSystem, FsTarget } from '@deepseek-ai/dsh-fs';
+import type { ToolRunContext } from '@deepseek-ai/dsh-tools';
+/** Cap for text materialized into a single tool result. */
+export declare const MAX_TEXT_CHARS = 200000;
+/** Cap for worksheet cells materialized into a single tool result. */
+export declare const MAX_READ_CELLS = 200000;
+/** Cap for worksheet cells accepted by one create/update call. */
+export declare const MAX_WRITE_CELLS = 200000;
+/** The slice of the Cordis context this suite consumes: the official fs service. */
+export interface FsContext {
+    fs: FileSystem;
+}
+/**
+ * The per-call sandbox execution policy `ctx.fs.writeText` accepts as its
+ * fifth parameter (`SandboxExecutionPolicy` from `@deepseek-ai/dsh-sandbox`):
+ * a sandboxing backend fences the write by it, the bare backend ignores it,
+ * and omitting it leaves the backend its deployment default — whose writable
+ * roots need not include this session's workspace. Derived from the official
+ * `writeText` signature so the plugin never depends on `@deepseek-ai/dsh-sandbox`
+ * directly.
+ */
+export type OfficeWritePolicy = NonNullable<Parameters<FileSystem['writeText']>[4]>;
+/**
+ * Resolve the per-call write policy the way the official fs tool layer does:
+ * skip when the mounted backend does not confine (`fs.sandboxMode` undefined),
+ * otherwise ask the shared `sandboxPolicy` service for the calling session.
+ */
+export declare function resolveWritePolicy(ctx: Context & FsContext, exec: ToolRunContext): Promise<OfficeWritePolicy | undefined>;
+export interface ResolvedOfficePath {
+    /** The path exactly as the model passed it. */
+    input: string;
+    /** The backend's stable target for every subsequent operation. */
+    target: FsTarget;
+    /** The backend's canonical absolute process path (display and extension source). */
+    absolute: string;
+    /** Path rendered back to the model (workspace-relative when possible). */
+    display: string;
+    /** Lowercased extension including the leading dot. */
+    ext: string;
+}
+/**
+ * Resolve one model-supplied path to a workspace-confined backend target.
+ *
+ * @param exec - the running tool call (carries the session cwd + abort signal).
+ * @param rawPath - the model-supplied path string.
+ * @param allowedExts - acceptable lowercased extensions WITH dots (e.g. `.docx`).
+ * @param mustExist - when true, stat the target and refuse anything but a regular file.
+ * @param writePolicy - the per-call write policy, when a sandbox controller is
+ *   mounted; its `workspaceRoot` is the authoritative workspace the write is
+ *   fenced to, so relative paths resolve against it exactly like the official
+ *   fs tools do. Omitted (reads, bare backends) keeps the session cwd.
+ */
+export declare function resolveOfficePath(exec: ToolRunContext, ctx: FsContext, rawPath: string, allowedExts: readonly string[], mustExist: boolean, writePolicy?: OfficeWritePolicy): Promise<ResolvedOfficePath>;
+/**
+ * Read a bounded Office file through the backend, observing tool-call
+ * cancellation and refusing files above the hard cap before any transfer.
+ */
+export declare function readOfficeBytes(exec: ToolRunContext, ctx: FsContext, target: FsTarget): Promise<{
+    bytes: Uint8Array;
+    sizeBytes: number;
+}>;
+/**
+ * Publish one generated package: the text is pure ASCII (asserted by the zip
+ * planner), so the backend's atomic UTF-8 write lands it on disk
+ * byte-identical. The per-call write policy rides along as `writeText`'s
+ * fifth parameter so a sandboxing backend fences the write by the session's
+ * effective policy instead of its deployment default. Returns the on-disk size.
+ */
+export declare function saveOfficeText(exec: ToolRunContext, ctx: FsContext, target: FsTarget, text: string, writePolicy?: OfficeWritePolicy): Promise<number>;
+/**
+ * Reject an overwrite when `overwrite` is false and the target already
+ * exists. Callers use this BEFORE doing expensive generation so the model
+ * gets a fast refusal instead of wasted work.
+ */
+export declare function assertMayCreate(exec: ToolRunContext, ctx: FsContext, target: FsTarget, overwrite: boolean): Promise<void>;

package/lib/types/imgsize.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Intrinsic image dimensions from file headers (1.0.0). PNG, JPEG, and GIF
+ * expose their pixel size in the first few hundred of bytes, so the linked
+ * image placement can default to natural size — and compute contain/cover
+ * crops — by reading the workspace file through the official fs channel and
+ * inspecting bytes directly. No image decoder, no dependency, no signal.
+ */
+/** Returned dimensions in pixels; undefined when the bytes are not a recognized image. */
+export interface ImageSize {
+    width: number;
+    height: number;
+}
+/** Sniff the pixel size of a PNG/JPEG/GIF byte buffer; undefined otherwise. */
+export declare function sniffImageSize(bytes: Uint8Array): ImageSize | undefined;

package/lib/types/index.d.ts

@@ -1,18 +1,20 @@
 /**
  * dsh-office-tools host plugin.
  *
- * Registers seven model-facing tools on `ctx.tools`:
+ * Registers eight model-facing tools on `ctx.tools`:
  *
- *   word_create / word_read
+ *   word_create / word_read / word_update
  *   excel_create / excel_read / excel_update
  *   ppt_create / ppt_read
  *
  * All file access is confined to the calling agent's session workspace and
- * every registration is wrapped in `ctx.effect` so Cordis disposes the tools
- * with the plugin fiber.
+ * flows exclusively through the official `ctx.fs` service — reads as raw
+ * bytes, writes as UTF-8 text (generated packages are pure ASCII by
+ * construction). Every registration is wrapped in `ctx.effect` so Cordis
+ * disposes the tools with the plugin fiber.
  *
- * The PowerPoint pair is config-gated: dedicated presentation plugins such as
- * dsh-ppt register a colliding `ppt_create`, and DSH refuses duplicate tool
+ * The PowerPoint pair is config-gated: dedicated presentation plugins such
+ * as dsh-ppt register a colliding `ppt_create`, and DSH refuses duplicate tool
  * names at startup, so profiles running one of those set `enablePptTools: false`
  * to load this plugin for Word/Excel only.
  */
@@ -20,7 +22,7 @@ import type { Context } from '@deepseek-ai/cordis';
 import z from '@deepseek-ai/schemastery';
 /** Plugin identity for cordis.yml rows. */
 export declare const name = "dsh-office-tools";
-/** The tool registry is the only runtime service this plugin requires. */
+/** The tool registry and the official filesystem service are the only runtime services required. */
 export declare const inject: string[];
 /** Host plugin configuration, validated at load by the Loader. */
 export interface Config {

package/lib/types/paths.d.ts

@@ -8,9 +8,21 @@
  * inside it, and a realpath check on the nearest existing ancestor closes the
  * symlink escape hatch.
  */
+import JSZip from 'jszip';
 import type { ToolRunContext } from '@deepseek-ai/dsh-tools';
 /** Hard cap for reading an existing Office file into memory. */
 export declare const MAX_OFFICE_FILE_BYTES: number;
+/**
+ * Declared uncompressed ceiling for one zip entry inside an Office file. The
+ * 50 MiB read cap only bounds the COMPRESSED bytes; deflate can expand a file
+ * a thousandfold, so {@link loadZipGuarded} also checks the archive's own
+ * declared sizes before any entry is inflated.
+ */
+export declare const MAX_ZIP_ENTRY_BYTES: number;
+/** Declared uncompressed ceiling summed over all entries of one archive. */
+export declare const MAX_ZIP_TOTAL_BYTES: number;
+/** Maximum entries (files + directories) in one archive. */
+export declare const MAX_ZIP_ENTRIES = 100000;
 /** Cap for text materialized into a single tool result. */
 export declare const MAX_TEXT_CHARS = 200000;
 /** Cap for worksheet cells materialized into a single tool result. */
@@ -43,6 +55,30 @@ export declare function readOfficeBuffer(path: string, signal: AbortSignal): Pro
     buffer: Buffer;
     sizeBytes: number;
 }>;
+/** Overridable budgets so tests can trip the guard with tiny values. */
+export interface ZipGuardLimits {
+    maxEntryBytes?: number;
+    maxTotalBytes?: number;
+    maxEntries?: number;
+}
+/**
+ * Load a zip-backed Office file with jszip and refuse archives whose central
+ * directory already declares more uncompressed content than we are ever
+ * willing to inflate (the zip-bomb guard), or more entries than we will walk.
+ * Returns the loaded instance so callers never parse the buffer twice.
+ */
+export declare function loadZipGuarded(buffer: Buffer, signal: AbortSignal, limits?: ZipGuardLimits): Promise<JSZip>;
+/**
+ * OOXML parts are plain element trees; a DOCTYPE/ENTITY declaration is never
+ * legitimate in one. Our extractors never resolve entities, but we refuse to
+ * look at such a part at all so entity-expansion payloads die at the door.
+ */
+export declare function assertNoXmlDtd(xml: string, label: string): void;
+/**
+ * Read one zip part as text and refuse DTD/entity-bearing XML before any
+ * caller parses it. Returns null when the archive has no such part.
+ */
+export declare function readZipXmlPart(zip: JSZip, name: string, signal: AbortSignal): Promise<string | null>;
 /**
  * Write a buffer through a same-directory temp file + rename so a failed
  * generation never leaves a half-written Office document behind.

package/lib/types/tools/excel.d.ts

@@ -1,8 +1,13 @@
 /**
- * Excel (.xlsx) tools over SheetJS: `excel_create` writes a new workbook,
- * `excel_read` materializes sheets as rows of scalar cells, and
- * `excel_update` replaces/creates whole sheets and/or writes individual cell
- * values into an existing workbook.
+ * Excel (.xlsx) tools over the self-contained OOXML container (1.0.0):
+ * `excel_create` writes a new workbook, `excel_read` materializes sheets as
+ * rows of scalar cells, and `excel_update` replaces/creates whole sheets
+ * and/or writes individual cell values into an existing workbook. Reads
+ * accept any real-world package (STORE and DEFLATE); writes and rewrites are
+ * ASCII-safe STORE packages published through the official fs channel, with
+ * strings written inline and '=…' strings materialized as real `<f>` formula
+ * cells exactly like the SheetJS-era behavior the tests pin.
  */
 import type { Context } from '@deepseek-ai/cordis';
-export declare function registerExcelTools(ctx: Context): () => void;
+import type { FsContext } from '../fschannel.ts';
+export declare function registerExcelTools(ctx: Context & FsContext): () => void;

package/lib/types/tools/ppt.d.ts

@@ -1,8 +1,69 @@
 /**
- * PowerPoint (.pptx) tools: `ppt_create` builds slide decks with pptxgenjs
- * (text, bullets, speaker notes, and PNG/JPG/GIF images); `ppt_read` unzips a
- * deck with JSZip and extracts paragraph text, speaker notes, and per-slide
- * image counts without any native dependency.
+ * PowerPoint (.pptx) tools over the self-contained OOXML container (1.0.0).
+ *
+ * `ppt_create` builds a widescreen deck as an ASCII-safe STORE package
+ * published through the official fs channel — no third-party library, no
+ * binary package parts. Pictures are LINKED (`a:blip r:link`): the model
+ * fully controls placement (x/y/w/h inches, contain/cover cropping, alt
+ * text), the image file stays a workspace artifact, and intrinsic sizes are
+ * sniffed from PNG/JPEG/GIF headers so omitted dimensions default to natural
+ * size. The create result echoes every element's landing geometry, and both
+ * tools render a text wireframe sketch so the model can SEE the composition.
+ *
+ * `ppt_read` reads any real-world deck and returns, per slide in document
+ * order: paragraphs, tables, notes, image counts/alt texts — plus an
+ * `elements` array with every shape's bounding box in inches and the deck's
+ * canvas size. True raster rendering stays out of scope on purpose: it would
+ * need a headless renderer (a subprocess plus a binary dependency), which is
+ * exactly what the dependency-free, no-commands contract forbids.
  */
 import type { Context } from '@deepseek-ai/cordis';
-export declare function registerPptTools(ctx: Context): () => void;
+import type { ToolRunContext } from '@deepseek-ai/dsh-tools';
+import type { FsContext, ResolvedOfficePath } from '../fschannel.ts';
+interface SlideImageSpec {
+    path: string;
+    x?: number;
+    y?: number;
+    w?: number;
+    h?: number;
+    sizing?: 'contain' | 'cover';
+    alt?: string;
+}
+interface SlideSpec {
+    title?: string;
+    paragraphs?: string[];
+    bullets?: string[];
+    notes?: string;
+    images?: SlideImageSpec[];
+}
+interface PptCreateArgs {
+    path: string;
+    title?: string;
+    slides?: SlideSpec[];
+    overwrite?: boolean;
+}
+/** One placed element, echoed by create and parsed back by read. */
+export interface SlideElementBox {
+    type: 'text' | 'bullets' | 'image' | 'table';
+    xIn: number;
+    yIn: number;
+    wIn: number;
+    hIn: number;
+    text?: string;
+    items?: string[];
+    alt?: string;
+    path?: string;
+    sizing?: 'contain' | 'cover';
+}
+/** Build the whole deck as an ASCII-safe package plus the layout echo. */
+export declare function buildPptxText(args: PptCreateArgs, exec: ToolRunContext, ctx: FsContext, deck: ResolvedOfficePath): Promise<{
+    text: string;
+    layout: Array<{
+        index: number;
+        elements: SlideElementBox[];
+    }>;
+}>;
+/** Render one slide as an ASCII wireframe: the canvas frame plus boxes. */
+export declare function sketchSlide(widthIn: number, heightIn: number, elements: Array<Pick<SlideElementBox, 'type' | 'xIn' | 'yIn' | 'wIn' | 'hIn' | 'text'>>): string;
+export declare function registerPptTools(ctx: Context & FsContext): () => void;
+export {};

package/lib/types/tools/shared.d.ts

@@ -1,6 +1,9 @@
 /**
- * Shared schema fragments and cell types for the Office tool suite. Keeping
- * the schemas in one place keeps the seven tool contracts consistent.
+ * Shared schema fragments, cell types, and the ASCII-safe XML encoders for
+ * the Office tool suite. Keeping the schemas in one place keeps the eight
+ * tool contracts consistent; the encoders guarantee that generated XML stays
+ * pure ASCII (non-ASCII text becomes decimal character references), which is
+ * the invariant the ASCII-safe zip writer builds on.
  */
 /** One cell value accepted by the Excel tools. */
 export declare const CELL_VALUE_SCHEMA: {
@@ -46,3 +49,12 @@ export declare const FILE_RESULT_SCHEMA: {
 };
 export type CellValue = string | number | boolean | null;
 export type CellRow = CellValue[];
+/** Escape text for XML element content, keeping the output pure ASCII. */
+export declare function encodeXmlText(value: string): string;
+/** Escape text for a double-quoted XML attribute value, keeping it pure ASCII. */
+export declare function encodeXmlAttribute(value: string): string;
+/**
+ * Decode the XML entities that can legally appear in OOXML text content: the
+ * five predefined names plus decimal/hex character references.
+ */
+export declare function decodeXmlEntities(value: string): string;

package/lib/types/tools/word-update.d.ts

@@ -0,0 +1,13 @@
+/**
+ * `word_update`: append paragraphs, bullets, and one table to an existing
+ * .docx (1.0.0). The appended body children are generated by the same part
+ * builder word_create uses, then spliced into the document's body right
+ * before its trailing `<w:sectPr>`. The archive is re-emitted as an
+ * ASCII-safe STORE package through the official fs channel, so updates are
+ * limited to packages whose every part can round-trip as ASCII text — always
+ * true for files these tools write, and for any OOXML package that carries
+ * no binary media.
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import type { FsContext } from '../fschannel.ts';
+export declare function registerWordUpdate(ctx: Context & FsContext): () => void;

package/lib/types/tools/word.d.ts

@@ -1,6 +1,66 @@
 /**
- * Word (.docx) tools: `word_create` builds a styled document with the `docx`
- * package; `word_read` extracts plain text with `mammoth`.
+ * Word (.docx) tools over the self-contained OOXML container (1.0.0):
+ * `word_create` builds a styled document part set directly (no third-party
+ * library — the package is an ASCII-safe STORE zip written through the
+ * official fs channel); `word_read` extracts plain text or markdown with the
+ * same in-house regex extractor whose behavior is pinned to mammoth 1.11.0's
+ * raw-text output by `tests/word-parity.spec.ts`.
  */
 import type { Context } from '@deepseek-ai/cordis';
-export declare function registerWordTools(ctx: Context): () => void;
+import type { FsContext } from '../fschannel.ts';
+export interface WordCreateArgs {
+    path: string;
+    title?: string;
+    paragraphs?: string[];
+    bullets?: string[];
+    table?: {
+        headers: string[];
+        rows: string[][];
+    };
+    overwrite?: boolean;
+}
+export interface WordUpdateArgs {
+    path: string;
+    paragraphs?: string[];
+    bullets?: string[];
+    table?: {
+        headers: string[];
+        rows: string[][];
+    };
+}
+export declare function wordCreateCounts(args: WordUpdateArgs & {
+    title?: string;
+}): {
+    paragraphs: number;
+    cells: number;
+};
+/** Build the complete .docx package as an ASCII-safe zip string. */
+export declare function buildDocxText(args: WordUpdateArgs & {
+    title?: string;
+}): string;
+/**
+ * Extract mammoth-compatible plain text from a `word/document.xml` string:
+ * every paragraph — body, table cell, hyperlink, or textbox — contributes its
+ * runs followed by `\n\n`, including the final and empty paragraphs.
+ */
+export declare function extractDocxText(documentXml: string): string;
+/**
+ * Extract structured markdown from a `word/document.xml` string: Title and
+ * Heading1-6 render as `#`..`######`, numbered/bullet paragraphs as indented
+ * `- ` items, tables as markdown tables, everything else as plain blocks —
+ * inline rules identical to {@link extractDocxText}.
+ */
+export declare function extractDocxMarkdown(documentXml: string): string;
+/**
+ * Body children for an append, generated by the same part builder
+ * word_create uses (so paragraphs, bullets, and tables come out identical)
+ * and extracted from the throwaway document minus its trailing `<w:sectPr>`.
+ */
+export declare function buildAppendFragment(args: WordUpdateArgs): string;
+/**
+ * Splice new body children into `word/document.xml`: appended content goes
+ * right before the trailing `<w:sectPr>` (page setup must stay the last body
+ * child), or before `</w:body>` when the document has no section properties.
+ */
+export declare function appendBeforeSectPr(documentXml: string, addition: string): string;
+export declare function registerWordTools(ctx: Context & FsContext): () => void;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-office-tools",
-  "version": "0.2.0",
-  "description": "DSH model-facing Office tools: create, read, and update Word (.docx), Excel (.xlsx), and PowerPoint (.pptx) files inside the session workspace.",
+  "version": "1.0.2",
+  "description": "DSH model-facing Office tools: create, read, and update Word (.docx), Excel (.xlsx), and PowerPoint (.pptx) files inside the session workspace, entirely through the official DSH filesystem service.",
   "license": "MIT",
   "type": "module",
   "main": "lib/index.js",
@@ -16,10 +16,20 @@
   "dsh": {
     "bundle": {
       "patch": "./cordis.patch.yml"
+    },
+    "compatibility": {
+      "dsh": ">=0.1.0-rc.6",
+      "dshReleases": {
+        "0.1.1-rc.2": "compatible",
+        "0.1.2-alpha.4": "compatible",
+        "0.1.2-alpha.5": "compatible",
+        "0.1.2-rc.1": "compatible"
+      }
     }
   },
   "files": [
-    "lib",
+    "lib/*.js",
+    "lib/types",
     "cordis.patch.yml",
     "dsh.plugin.json",
     "README.md",
@@ -28,16 +38,18 @@
   ],
   "scripts": {
     "build": "node build.mjs",
-    "typecheck": "tsc --noEmit",
+    "types": "tsc -p tsconfig.json",
+    "typecheck": "tsc --noEmit -p tsconfig.json",
     "test": "vitest run",
-    "check": "pnpm run typecheck && pnpm run test && pnpm run build"
+    "check": "pnpm run typecheck && pnpm run types && pnpm run test && pnpm run build"
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-agent": "^0.1.0-rc.6",
-    "@deepseek-ai/dsh-llm": "^0.1.0-rc.6",
-    "@deepseek-ai/dsh-session": "^0.1.0-rc.6",
-    "@deepseek-ai/dsh-tools": "^0.1.0-rc.6"
+    "@deepseek-ai/dsh-agent": "^0.1.0-rc.6 || ^0.1.1-rc.0 || ^0.1.2-alpha.0",
+    "@deepseek-ai/dsh-fs": "^0.1.0-rc.6 || ^0.1.1-rc.0 || ^0.1.2-alpha.0",
+    "@deepseek-ai/dsh-llm": "^0.1.0-rc.6 || ^0.1.1-rc.0 || ^0.1.2-alpha.0",
+    "@deepseek-ai/dsh-session": "^0.1.0-rc.6 || ^0.1.1-rc.0 || ^0.1.2-alpha.0",
+    "@deepseek-ai/dsh-tools": "^0.1.0-rc.6 || ^0.1.1-rc.0 || ^0.1.2-alpha.0"
   },
   "peerDependenciesMeta": {
     "@deepseek-ai/cordis": {
@@ -46,6 +58,9 @@
     "@deepseek-ai/dsh-agent": {
       "optional": true
     },
+    "@deepseek-ai/dsh-fs": {
+      "optional": true
+    },
     "@deepseek-ai/dsh-llm": {
       "optional": true
     },
@@ -58,20 +73,18 @@
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-agent": "^0.1.0-rc.6",
-    "@deepseek-ai/dsh-llm": "^0.1.0-rc.6",
-    "@deepseek-ai/dsh-session": "^0.1.0-rc.6",
-    "@deepseek-ai/dsh-tools": "^0.1.0-rc.6",
-    "@deepseek-ai/schemastery": "^3.18.1",
+    "@deepseek-ai/dsh-agent": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-fs": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-llm": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-session": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-tools": "0.1.2-rc.1",
+    "@deepseek-ai/schemastery": "^3.18.2",
     "@types/node": "^24.0.0",
-    "docx": "^9.5.1",
     "esbuild": "^0.25.0",
     "jszip": "^3.10.1",
-    "mammoth": "^1.11.0",
-    "pptxgenjs": "^4.0.1",
     "typescript": "^5.6.0",
     "vitest": "^4.1.8",
-    "xlsx": "https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz"
+    "xlsx": "^0.18.5"
   },
   "author": "kw78",
   "homepage": "https://github.com/kw78/dsh-office-tools#readme",
@@ -101,5 +114,47 @@
   "publishConfig": {
     "access": "public"
   },
-  "packageManager": "pnpm@11.7.0"
+  "packageManager": "pnpm@10.34.5",
+  "dshWorkshop": {
+    "schema": "omdsh-workshop-package/v1",
+    "type": "plugin",
+    "integration": {
+      "protocol": "harness-profile",
+      "artifact": "cordis.patch.yml"
+    },
+    "install": {
+      "mode": "transactional",
+      "adapter": "profile-bundle",
+      "failurePolicy": "generation-rollback",
+      "touchesCurrentBeforeActivation": false
+    },
+    "lifecycle": {
+      "activation": "restart-profile",
+      "dispose": "supported"
+    },
+    "permissions": [
+      "files:workspace-read",
+      "files:workspace-write"
+    ],
+    "compatibility": {
+      "dshVersions": [
+        "0.1.1-rc.2",
+        "0.1.2-alpha.4",
+        "0.1.2-alpha.5",
+        "0.1.2-rc.1"
+      ]
+    },
+    "capability": {
+      "id": "word_create",
+      "kind": "tool",
+      "invocation": "word_create({\"path\": \"hub-check.docx\", \"paragraphs\": [\"dsh-hub intake check\"]}) in a session with workspace cwd",
+      "expected": "a real .docx (first two bytes PK) exists at the workspace path; the result reports sizeBytes > 0; word_read returns 'dsh-hub intake check'"
+    },
+    "evidence": {
+      "install": null,
+      "failureIsolation": null,
+      "hotReload": null,
+      "remove": null
+    }
+  }
 }