dsh-plugin-wsl-env 0.13.0 → 0.13.2

package/CHANGELOG.md

@@ -16,6 +16,114 @@ were part of the record.
 
 ## [Unreleased]
 
+## [0.13.2] - 2026-10-26
+
+This release tracks DeepSeek Harness `0.2.1-rc.3`: the peer declarations become
+floor ranges so a newer harness installs the plugin unchanged, and the
+lockfile's transitive `undici` moves past a security advisory that Dependabot
+could not clear on its own.
+
+### Fixed
+
+- **`undici` in the lockfile moves to the security-fixed `8.12.3` via a pnpm
+  override.** `undici` rides in only as an exact transitive pin of
+  `@deepseek-ai/dsh-http-proxy` — a package upstream controls — so Dependabot's
+  security job could resolve no patched version (it reports "the latest
+  possible version … is 8.11.2" and fails). `pnpm-workspace.yaml` now carries
+  `overrides: { undici: '>=8.12.3' }` (the pnpm 11 settings home; the
+  `package.json` `pnpm` field is no longer read), the lockfile swaps the one
+  package, and the override comment records that it is retired when upstream
+  moves the pin. Nothing under `src/` reads `undici`; the check chain is
+  unaffected.
+
+### Changed
+
+- **The peer declarations become floor ranges, so a newer harness installs
+  the plugin unchanged.** The `@deepseek-ai/dsh-*` entries in
+  `peerDependencies` move from the exact pin to `>=0.2.1-rc.3`, and
+  `@deepseek-ai/cordis` / `@deepseek-ai/schemastery` widen from `~` to `^`
+  (`^4.0.5`, `^3.18.5`). An app that ships a newer harness release now
+  satisfies the peers without waiting for a plugin release — same-line rc
+  bumps and every stable release install cleanly; only a brand-new
+  prerelease line (`0.2.2-rc.1` against `>=0.2.1-rc.3`) still warns, because
+  semver admits a prerelease only against a comparator on its own tuple and
+  no range can promise an unpublished line. That residue is what the weekly
+  peer-canary is for: it still resolves the `next` dist-tag into a scratch
+  tree and flags when the line moves past a floor — the signal to re-run the
+  `docs/PEER-PARITY.md` comparison and raise the floor in the commit that
+  matches the harness release. The devDependencies keep their exact pins, so
+  the gates stay reproducible and the parity audit keeps naming one line.
+  `scripts/doctor.mjs` learned the new shapes (`peerSatisfied` now reads `>=`
+  and `^`, and its `compareVersions` orders prerelease identifiers by semver
+  §11 — `rc.10` above `rc.9`), `scripts/peer-canary.mjs` parses and preserves
+  the shapes, and `AGENTS.md`, `CONTRIBUTING.md`, `SUPPORT.md` and
+  `docs/PEER-PARITY.md` state the new policy.
+
+- **The dev pin line moves to DeepSeek Harness `0.2.1-rc.3`.** Every
+  `@deepseek-ai/dsh-*` pin in `devDependencies` goes from `0.2.1-rc.2` to
+  `0.2.1-rc.3` — the release the `next` dist-tag resolves to — and
+  `pnpm-lock.yaml` refreshes with it. `@deepseek-ai/cordis` and
+  `@deepseek-ai/schemastery` stay at `4.0.5` / `3.18.5`: upstream's `vendor/`
+  did not change on this line.
+
+  No module under `src/` changed, and that is the finding. The three peers
+  this plugin subclasses or replicates ship byte-identical `lib/index.js`
+  files on rc.3 — `dsh-fs-local` (the fsio dialect, still 909 lines), `dsh-fs`
+  (the `FsVersion` brand) and `dsh-bash-local` (the spill machinery) — so
+  every line reference in `docs/PEER-PARITY.md` still names the same code;
+  only the tarballs' digests changed, and the parity doc now carries the
+  `0.2.1-rc.3` ones with the re-check dated 2026-10-26. That byte-identity is
+  also the evidence behind the new peer floor: the same code answers above
+  rc.3. Upstream's release notes for the line are UI- and LLM-side
+  (navigation entry customization, analytics, the official `/models`
+  listing): the one composition-visible change is a new `entry-customization`
+  UI row in the app's own `cordis.patch.yml`, which rides with the app's
+  bundle rather than this plugin's layer. `preset-wsl` needed no
+  regeneration — `packages/bundle/web-app/presets/standard.patch.yml` is
+  byte-identical on rc.3 — and the provenance comment in `cordis.patch.yml`
+  now names the rc.3 tree.
+
+## [0.13.1] - 2026-10-19
+
+A patch release restoring `wsl-shell-env`: the component mounts again, and the
+managed `DSH_*` facts it contributes now reach commands on the default
+resident-agent path.
+
+### Changed
+
+- **Upstream proposals filed.** The session-notice seam
+  ([#10263](https://github.com/deepseek-ai/deepseek-harness/discussions/10263)),
+  the `spawnSpec` seam (#10261), the fsio export (#10262), the UNC-workspace bug
+  (#10260) and the WSL-workspaces RFC (#10264) now point at their discussions;
+  the local drafts carry the links.
+
+### Fixed
+
+- **`wsl-shell-env` no longer fails to activate.** The row sweeps the
+  live-agent list at mount to warm facts for sessions that opened before it,
+  but declared only `shellEnv` in `inject` and read `ctx.agents` as a property.
+  Cordis 4 refuses that read — `cannot get property "agents" without inject` —
+  so `apply()` rejected and the plugin manager listed the component as 异常
+  (`包含的组件 → 异常`), with the whole contribution missing from shell calls.
+  The sweep now reads the service through `ctx.get("agents")`, the sanctioned
+  access for a service this row does not inject: activation no longer depends
+  on an agent loop, and the sweep still runs when one is composed.
+  `wsl-preflight` carried the same property read inside a `try`/`catch`, where
+  the throw silently disabled its mount sweep; it gets the same fix.
+  `test/shell-env.test.mjs` and the real-cordis check in
+  `test/preflight.test.mjs` mount both rows against the guard.
+
+- **The managed `DSH_*` namespace now reaches commands on the default
+  resident-agent path.** `ShellExecSpec.dshEnv` was forwarded only by the
+  one-shot `wsl.exe` fallback; `executeViaAgent` dropped it before
+  `agent.exec` — after the mount fix above, the row registered its facts but
+  no model shell call could see `DSH_HOME`, `DSH_SESSION_ID` or any
+  `DSH_WSL_*` value (`env | grep '^DSH_'` was empty). The handle now carries
+  the merged map (`env` first, `dshEnv` last — the same order the one-shot
+  path uses) into the agent's `SETENV` frames. `test/agent-exec.test.mjs` and
+  `test/provider.test.mjs` pin the frame, and both checks fail against the
+  previous build.
+
 ## [0.13.0] - 2026-10-19
 
 This release ships the P0/P1 hardening batch: session-scoped `auto`

package/CONTRIBUTING.md

@@ -23,13 +23,24 @@ Developing and running the gates do have dependencies. The tests import pinned
 algorithm, and the boot test starts a row through the real Loader — so a fresh
 checkout needs one `pnpm install` before the gates pass.
 
-Those pins are deliberate, and they move with the harness rather than on their
-own: the `@deepseek-ai/dsh-*` peers sit at `0.2.1-rc.2`, `@deepseek-ai/cordis`
-at `~4.0.5` and `@deepseek-ai/schemastery` at `~3.18.5`. The plugin subclasses
-peer classes and mirrors peer protocol, so raising one pin alone is how the
-seams drift: bump them in the commit that matches a harness release, re-run the
-comparison `docs/PEER-PARITY.md` describes, and let the gate chain and the
-probes confirm the result.
+Those pins are deliberate, and they split by role. The `devDependencies` stay
+exact so the gates and the `docs/PEER-PARITY.md` audit name one reproducible
+line. The `peerDependencies` are floors — `>=` for the `@deepseek-ai/dsh-*`
+packages, caret for `@deepseek-ai/cordis` and `@deepseek-ai/schemastery` — so
+an app that ships a newer harness keeps installing the plugin without waiting
+for a plugin release. A floor is still raised on purpose, not by drift: it
+moves in the commit that matches a harness release, with the parity comparison
+and the gate chain re-run, and the weekly peer-canary
+(`.github/workflows/peer-canary.yml`) resolves the `next` dist-tag into a
+scratch tree and flags when the line has moved past the floor. One semver
+limit is worth knowing: a floor range cannot name future prerelease lines —
+`0.2.2-rc.1` does not satisfy `>=0.2.1-rc.3`, because the spec admits a
+prerelease only against a comparator on its own `[major, minor, patch]` tuple
+— so a brand-new rc line warns until the floor rises; same-line rcs and every
+stable release never do.
+
+The plugin subclasses peer classes and mirrors peer protocol, so the range
+says nothing about the parity claims: those are re-verified per floor raise.
 
 pnpm runs the scripts in this repository, pinned through the `packageManager`
 field (corepack resolves it). Treat `pnpm run <script>` as the reference

package/SUPPORT.md

@@ -6,7 +6,7 @@
 |---|---|
 | Operating system | Windows 10 and Windows 11 |
 | Linux side | WSL2 with at least one distro, and systemd as PID 1 with a lingering user manager (`loginctl enable-linger`) for the shipped session runtime. Set `sessionSandbox: false` on the preset's `wsl-shell` to keep the per-command sandbox instead |
-| DSH packages | the `0.2.1-rc.2`-era packages listed in `peerDependencies` |
+| DSH packages | the `0.2.1-rc.3`-or-newer packages the `peerDependencies` floors declare; an app on a newer harness installs unchanged |
 
 The DSH row is checked weekly: `.github/workflows/peer-canary.yml` resolves the
 `next` dist-tag of every pinned peer, installs that line into a scratch copy and

package/cordis.patch.yml

@@ -185,7 +185,8 @@
     # Generated from the shipped standard preset so the embedded plan-mode
     # section and every nested group survive byte-for-byte: this copy is
     # `packages/bundle/web-app/presets/standard.patch.yml` of the
-    # `dsh-v0.2.1-rc.2` source tree, changed in exactly three ways —
+    # `dsh-v0.2.1-rc.3` source tree (unchanged since `0.2.1-rc.2`), changed
+    # in exactly three ways —
     #   1. every shipped row mounts inside `wsl-env`, so the preset's tools see
     #      the distro's shell and fs (the realm is declared on the group);
     #   2. `tool-bash` is enabled and `tool-pwsh` disabled outright, where the

package/docs/PEER-PARITY.md

@@ -7,18 +7,20 @@ same refusal dialect on both substrates. The **read path** holds end to end;
 the **edit path** carries two declared divergences, listed at the end. This
 file records the verification against the real peers.
 
-- Peers: `@deepseek-ai/dsh-fs-local@0.2.1-rc.2` (the exact version
-  `package.json` pins), plus `@deepseek-ai/dsh-fs@0.2.1-rc.2` for the
+- Peers: `@deepseek-ai/dsh-fs-local@0.2.1-rc.3` (the exact version the
+  devDependencies pin, and the floor the peer range `>=0.2.1-rc.3` was
+  verified against), plus `@deepseek-ai/dsh-fs@0.2.1-rc.3` for the
   `FsVersion` brand the local package imports. Divergence 2 is measured
-  against a third peer, `@deepseek-ai/dsh-bash-local@0.2.1-rc.2` — the shell
+  against a third peer, `@deepseek-ai/dsh-bash-local@0.2.1-rc.3` — the shell
   executor carries the collect-budget/spill machinery; `spill` and
   `maxSpillBytes` do not appear in `dsh-fs-local` at all.
-- The `0.2.1-rc.2` move leaves every line reference below intact: all three
-  peers' shipped `lib/index.js` are **byte-identical** to the `0.2.0-rc.2`
+- The `0.2.1-rc.3` move leaves every line reference below intact: all three
+  peers' shipped `lib/index.js` are **byte-identical** to the `0.2.1-rc.2`
   ones (`cmp` clean; `dsh-fs-local`'s is still 909 lines), so only the
-  tarballs' digests changed. `dsh-fs@0.2.1-rc.2` did drop its unpublished
-  `./invariant` export subpath; this plugin imports neither it nor
-  `dsh-invariants`.
+  tarballs' digests changed — upstream shipped the manifests' version fields
+  and nothing else in these packages. `dsh-fs@0.2.1-rc.3` still has no
+  `./invariant` export subpath (dropped back at `0.2.1-rc.2`); this plugin
+  imports neither it nor `dsh-invariants`.
 - What "not imported" means: the peer's **fsio module** is not reachable from
   the package's exports, so `lib/fsio-text.js` reimplements it and imports
   nothing from it (the export is proposed in `docs/UPSTREAM-FSIO-EXPORT.md`).
@@ -33,24 +35,24 @@ file records the verification against the real peers.
 
 ```sh
 mkdir -p /tmp/peer-audit && cd /tmp/peer-audit
-npm pack @deepseek-ai/dsh-fs-local@0.2.1-rc.2 @deepseek-ai/dsh-fs@0.2.1-rc.2 --pack-destination .
-openssl dgst -sha512 -binary deepseek-ai-dsh-fs-local-0.2.1-rc.2.tgz | base64 -w0
-tar xzf deepseek-ai-dsh-fs-local-0.2.1-rc.2.tgz   # -> package/lib/index.js
+npm pack @deepseek-ai/dsh-fs-local@0.2.1-rc.3 @deepseek-ai/dsh-fs@0.2.1-rc.3 --pack-destination .
+openssl dgst -sha512 -binary deepseek-ai-dsh-fs-local-0.2.1-rc.3.tgz | base64 -w0
+tar xzf deepseek-ai-dsh-fs-local-0.2.1-rc.3.tgz   # -> package/lib/index.js
 wc -l package/lib/index.js                        # expect 909
 ```
 
 The tarballs this audit compared, by content — the same values
-`npm view <pkg>@0.2.1-rc.2 dist.integrity` reports:
+`npm view <pkg>@0.2.1-rc.3 dist.integrity` reports:
 
 ```
-@deepseek-ai/dsh-fs-local@0.2.1-rc.2  sha512-IZPJ12/EpV6fu3CCWtW4w4GthXAKLFjplm4Feoep2HAum7J1aGzHZwiw7ipsPCZiA5/TyK3lDUUAGZ/pcXgRcw==
-@deepseek-ai/dsh-fs@0.2.1-rc.2        sha512-Z6d2ZKsAiJc0FaiES8wC66vuUQMGohl9tCc2p3bAsPFYkJ0+L2zTViQ9Y5BArtRe9Br8qhNjNgLlN0jb/uwv1g==
+@deepseek-ai/dsh-fs-local@0.2.1-rc.3  sha512-bB2CwCqvYAdAKl28+5XXMRRq1NBtRmYX3wNOpJ2JlGBm7uj2Aix9Vl9rFig4AQcXXd5Bk738b5KNsOIkbXy+XQ==
+@deepseek-ai/dsh-fs@0.2.1-rc.3        sha512-tENLWe471WlAXMc13J4cns8xU6lFyu1smwpkSKR85vhGr6FyWZhTlpVohZYm66LbwKTmSWiDhd9Urk7VxN9B9w==
 ```
 
 Each row of the table below names the peer's `lib/index.js` line and the
 literal both sides must produce. Verified 2026-10-03; the read/edit split
 re-verified 2026-10-06; the whole table re-checked against `0.2.1-rc.2`,
-2026-10-17.
+2026-10-17 and against `0.2.1-rc.3`, 2026-10-26.
 
 ## Verdict
 
@@ -93,7 +95,7 @@ declared extensions, listed at the end.
 2. **Per-stream truncation flags.** The EXEC frame carries an output budget;
    the RES line reports which streams the agent cut, surfaced as honest
    `truncated` flags. The collect-budget/spill machinery of the shell peer,
-   `@deepseek-ai/dsh-bash-local@0.2.1-rc.2` (`lib/index.js:30`, `:110`), is the
+   `@deepseek-ai/dsh-bash-local@0.2.1-rc.3` (`lib/index.js:30`, `:110`), is the
    spill-file path we deliberately do not run.
 3. **The transport around the ops** (ACK, KILL, the confined resident) is
    protocol this package owns; the peer has no agent.
@@ -120,9 +122,12 @@ declared extensions, listed at the end.
 
 ## Maintenance
 
-When `package.json` bumps the peer pins, re-run the comparison above — pack the
-new tarballs, check the sha512, and walk the table's peer line references
-against the replicas. The fastest canary: stat a file, list its directory, and
+When a peer floor or dev pin moves in `package.json`, re-run the comparison
+above — pack the new tarballs, check the sha512, and walk the table's peer line
+references against the replicas. The weekly peer-canary resolves the `next`
+dist-tag into a scratch tree and runs the gate chain against it, so the signal
+to raise the floor arrives before a user reports a drift. The fastest canary:
+stat a file, list its directory, and
 compare the versions (`test/fsio-agent.test.mjs` asserts the intra-distro half
 of this); the strings above are the other half. The split dialect has its own
 regression: `test/fs-substrate.test.mjs` asserts the missing-file refusal, and

package/docs/ROADMAP-1.0.md

@@ -339,9 +339,9 @@ command.
 - [x] The preflight checks bwrap, systemd PID 1, `systemd-run` and Linger.
 - [x] The warning is visibly attached to the session through the
       runtime-context entry (not only logs).
-- [ ] A GUI notice/banner renders it: upstream seam missing; the filing payload
-      is ready at [proposal-session-notice.md](upstream/proposal-session-notice.md)
-      and has not been submitted (a maintainer action).
+- [ ] A GUI notice/banner renders it: filed upstream as
+      [#10263](https://github.com/deepseek-ai/deepseek-harness/discussions/10263);
+      until a seam lands, the advisory stays in the log and runtime context.
 - [x] The warning never installs anything and never changes fail-closed
       behavior.
 - [x] A session with a usable environment produces no warning.

package/docs/UPSTREAM-FSIO-EXPORT.md

@@ -1,7 +1,8 @@
 # Upstream proposal: export the fsio text helpers from `dsh-fs-local`
 
-Status: draft, not yet filed upstream — no discussion link yet (the filing
-convention is [UPSTREAM-TERMINAL-TITLE.md](UPSTREAM-TERMINAL-TITLE.md)).
+Status: filed upstream as
+[deepseek-ai/deepseek-harness#10262](https://github.com/deepseek-ai/deepseek-harness/discussions/10262)
+(Ideas); the filing convention is [UPSTREAM-TERMINAL-TITLE.md](UPSTREAM-TERMINAL-TITLE.md).
 Targeting `deepseek-harness` @ `packages/fs/fs-local`, the `0.2.1-rc.x` line
 this plugin pins exactly (`@deepseek-ai/dsh-fs-local@0.2.1-rc.2`, in both the
 dev and peer dependency blocks of `package.json`). This is the Shape-A

package/lib/agent-exec.d.ts

@@ -129,10 +129,10 @@ export interface AgentExecutionHandle {
  * @returns the execution handle (`status`, `exitCode`, `signal`, `observed`,
  *   `done`, `readOutput`, `kill`, `result`).
  */
-export declare function agentExecutionHandle({ agent, cwd, argv, timeoutMs, maxOutputBytes, signal, onStarted }: {
+export declare function agentExecutionHandle({ agent, cwd, argv, timeoutMs, maxOutputBytes, env, signal, onStarted }: {
     /**
      * The {@link WslAgent}-like runner: `exec` accepting
-     * `{cwd, argv, timeoutMs, signal}` and resolving `{exitCode, stdout, stderr}`;
+     * `{cwd, argv, timeoutMs, env, signal}` and resolving `{exitCode, stdout, stderr}`;
      * throws `AgentUnavailableError` when out.
      */
     agent: AgentExecRunner;
@@ -150,6 +150,13 @@ export declare function agentExecutionHandle({ agent, cwd, argv, timeoutMs, maxO
      * stream as `truncated: true`.
      */
     maxOutputBytes?: number;
+    /**
+     * Environment for this command: the caller's entries with the managed
+     * `DSH_*` snapshot merged last. The agent applies it as `SETENV` frames
+     * immediately before the command's `EXEC` (see `WslAgent.exec`); dropping it
+     * here is what kept every managed fact out of the resident-agent path.
+     */
+    env?: Record<string, string>;
     /** The caller's cancellation. */
     signal?: AbortSignal;
     /**

package/lib/agent-exec.js

@@ -54,7 +54,7 @@ function memoryReader(buffer) {
  * @returns the execution handle (`status`, `exitCode`, `signal`, `observed`,
  *   `done`, `readOutput`, `kill`, `result`).
  */
-export function agentExecutionHandle({ agent, cwd, argv, timeoutMs = 0, maxOutputBytes = 0, signal, onStarted }) {
+export function agentExecutionHandle({ agent, cwd, argv, timeoutMs = 0, maxOutputBytes = 0, env, signal, onStarted }) {
     // Our own controller is the kill channel; the caller's signal races it.
     const controller = new AbortController();
     let timedOut = false;
@@ -72,7 +72,7 @@ export function agentExecutionHandle({ agent, cwd, argv, timeoutMs = 0, maxOutpu
             controller.abort(new Error(BASH_TIMEOUT_REASON));
         }, timeoutMs).unref?.();
     }
-    const settle = agent.exec({ cwd, argv, timeoutMs, maxOutputBytes, signal: controller.signal }).then((result) => ({ ok: true, result }), (error) => {
+    const settle = agent.exec({ cwd, argv, timeoutMs, maxOutputBytes, env, signal: controller.signal }).then((result) => ({ ok: true, result }), (error) => {
         // A workdir the distro cannot enter is the command's own failure, not
         // the agent's: synthesize the relay-shaped stderr the one-shot path
         // produces, so the executor's `workdirFailure` check reports it the

package/lib/index.js

@@ -831,6 +831,13 @@ export class WslShellExecutor extends LocalBashExecutor {
         const argv = runtime !== undefined
             ? this.distroArgv(resolved, shell)
             : confined !== undefined ? confined.argv : this.distroArgv(resolved, shell);
+        // The managed `DSH_*` snapshot merges last, exactly as the one-shot path's
+        // spawn env does (`ShellExecSpec`: `dshEnv` wins over `env`). The agent
+        // applies these as SETENV frames immediately before the command's EXEC, so
+        // the resident path now carries `DSH_HOME`, `DSH_SESSION_ID` and the
+        // `DSH_WSL_*` facts too — without this the whole registry was invisible on
+        // the default path while the one-shot fallback forwarded it.
+        const env = { ...resolved.env, ...resolved.dshEnv };
         const execution = agentExecutionHandle({
             agent,
             // The one-shot path converts the spec's workdir into the distro's
@@ -839,6 +846,7 @@ export class WslShellExecutor extends LocalBashExecutor {
             // reach `chdir` (that is the bug this line fixes).
             cwd: toLinuxPath(resolved.workdir, { distro }),
             argv,
+            env: Object.keys(env).length > 0 ? env : undefined,
             timeoutMs: resolved.timeoutMs,
             // The agent enforces the collect budget distro-side (the EXEC frame
             // carries it); `maxSpillBytes` stays one-shot-only — the agent path has

package/lib/preflight.js

@@ -176,8 +176,14 @@ export async function apply(ctx, config = {}) {
     // Mount order is not a guarantee: a session created during startup can finish
     // before this service mounts and miss the event entirely (dsh-headless does
     // exactly that, and auto-preset sweeps for the same reason).
+    //
+    // `agents` is optional (this row injects nothing), so read it with `ctx.get`:
+    // a property read of an undeclared service throws in cordis 4, and the catch
+    // below would turn that into a silent no-op — exactly the sweep this block
+    // exists to perform.
     try {
-        for (const agent of ctx.agents?.list() ?? [])
+        const agents = ctx.get("agents");
+        for (const agent of agents?.list() ?? [])
             void check(agent);
     }
     catch (error) {

package/lib/shell-env.js

@@ -157,7 +157,14 @@ export async function apply(ctx, config = {}) {
         ensurePorts(parsed.distro);
     };
     const off = lifecycle.on?.("agent/created", (payload) => consider(payload?.agent));
-    for (const agent of lifecycle.agents?.list?.() ?? [])
+    // The live-agent sweep is a convenience, not a dependency: `inject` names
+    // only `shellEnv`, so reading `ctx.agents` as a property makes cordis 4
+    // throw "cannot get property \"agents\" without inject" and marks the whole
+    // component failed. `ctx.get` is the sanctioned read for a service this
+    // plugin did not inject, and it answers undefined when no agent loop is
+    // composed — the row still activates and resolves facts per shell call.
+    const live = ctx.get("agents");
+    for (const agent of live?.list?.() ?? [])
         consider(agent);
     const dispose = ctx.shellEnv.register({
         name: "dsh-plugin-wsl-env",

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-plugin-wsl-env",
-  "version": "0.13.0",
-  "description": "\u8ba9 DeepSeek Harness \u4ee5 WSL \u5b50\u7cfb\u7edf\u4f5c\u4e3a\u4f1a\u8bdd\u7684\u6267\u884c\u73af\u5883\uff1ashell\u3001\u6587\u4ef6\u8bfb\u5199\u4e0e\u547d\u4ee4\u6267\u884c\u5747\u5728\u5b50\u7cfb\u7edf\u5185\u5b8c\u6210\uff0c\u76ee\u5f55\u9009\u62e9\u5668\u4e0e GUI \u7ec8\u7aef\u540c\u6837\u5b9a\u4f4d\u5230\u5b50\u7cfb\u7edf\u8def\u5f84\uff0c\u5e76\u901a\u8fc7\u5b50\u7cfb\u7edf\u5185\u7684 bubblewrap \u5bf9\u547d\u4ee4\u8fdb\u884c\u6c99\u7bb1\u9694\u79bb",
+  "version": "0.13.2",
+  "description": "让 DeepSeek Harness 以 WSL 子系统作为会话的执行环境：shell、文件读写与命令执行均在子系统内完成，目录选择器与 GUI 终端同样定位到子系统路径，并通过子系统内的 bubblewrap 对命令进行沙箱隔离",
   "keywords": [
     "deepseek-harness",
     "dsh",
@@ -125,9 +125,9 @@
     "lint:types": "tsc --noEmit",
     "build": "node scripts/build.mjs",
     "lint:build": "node test/build-freshness.mjs",
-    "test:coverage": "node --test --experimental-test-coverage --test-coverage-lines=85 --test-coverage-branches=84 --test-coverage-functions=70 --test-coverage-exclude='scripts/**' test/agent-exec.test.mjs test/agent-fs-script.test.mjs test/agent-protocol.test.mjs test/agent.test.mjs test/fs-substrate.test.mjs test/fs.boot.test.mjs test/composition.test.mjs test/provider.test.mjs test/file-reference-wsl.test.mjs test/fsio-agent.test.mjs test/fsio-text.test.mjs test/git-route.test.mjs test/listing.test.mjs test/paths.test.mjs test/ports.test.mjs test/preset-choice.test.mjs test/probe-cache.test.mjs test/preflight.test.mjs test/sandbox.test.mjs test/search-exec.test.mjs test/search-route.test.mjs test/shell.test.mjs test/terminal-activity.test.mjs test/terminal.test.mjs test/watcher.test.mjs test/wsl.test.mjs test/fs-decisions.test.mjs test/session-scope.test.mjs test/session-runtime.test.mjs test/native-agent.test.mjs test/peers.test.mjs test/agent-shared.test.mjs test/distro-route.test.mjs test/fs-routing.test.mjs test/doctor.test.mjs test/profile-preset.test.mjs test/packaging.test.mjs test/peer-canary.test.mjs",
+    "test:coverage": "node --test --experimental-test-coverage --test-coverage-lines=85 --test-coverage-branches=84 --test-coverage-functions=70 --test-coverage-exclude='scripts/**' test/agent-exec.test.mjs test/agent-fs-script.test.mjs test/agent-protocol.test.mjs test/agent.test.mjs test/fs-substrate.test.mjs test/fs.boot.test.mjs test/composition.test.mjs test/provider.test.mjs test/file-reference-wsl.test.mjs test/fsio-agent.test.mjs test/fsio-text.test.mjs test/git-route.test.mjs test/listing.test.mjs test/paths.test.mjs test/ports.test.mjs test/preset-choice.test.mjs test/probe-cache.test.mjs test/preflight.test.mjs test/sandbox.test.mjs test/search-exec.test.mjs test/search-route.test.mjs test/shell.test.mjs test/shell-env.test.mjs test/terminal-activity.test.mjs test/terminal.test.mjs test/watcher.test.mjs test/wsl.test.mjs test/fs-decisions.test.mjs test/session-scope.test.mjs test/session-runtime.test.mjs test/native-agent.test.mjs test/peers.test.mjs test/agent-shared.test.mjs test/distro-route.test.mjs test/fs-routing.test.mjs test/doctor.test.mjs test/profile-preset.test.mjs test/packaging.test.mjs test/peer-canary.test.mjs",
     "test:syntax": "node test/syntax.mjs",
-    "test:unit": "node --test test/fs.boot.test.mjs test/fsio-text.test.mjs test/composition.test.mjs test/provider.test.mjs test/file-reference-wsl.test.mjs test/paths.test.mjs test/listing.test.mjs test/shell.test.mjs test/terminal.test.mjs test/probe-cache.test.mjs test/preflight.test.mjs test/preset-choice.test.mjs test/sandbox.test.mjs test/agent-protocol.test.mjs test/agent.test.mjs test/agent-fs-script.test.mjs test/fsio-agent.test.mjs test/fs-substrate.test.mjs test/agent-exec.test.mjs test/ports.test.mjs test/watcher.test.mjs test/wsl.test.mjs test/fs-decisions.test.mjs test/git-route.test.mjs test/search-route.test.mjs test/search-exec.test.mjs test/terminal-activity.test.mjs test/session-scope.test.mjs test/session-runtime.test.mjs test/native-agent.test.mjs test/peers.test.mjs test/agent-shared.test.mjs test/distro-route.test.mjs test/fs-routing.test.mjs test/doctor.test.mjs test/profile-preset.test.mjs test/packaging.test.mjs test/peer-canary.test.mjs",
+    "test:unit": "node --test test/fs.boot.test.mjs test/fsio-text.test.mjs test/composition.test.mjs test/provider.test.mjs test/file-reference-wsl.test.mjs test/paths.test.mjs test/listing.test.mjs test/shell.test.mjs test/shell-env.test.mjs test/terminal.test.mjs test/probe-cache.test.mjs test/preflight.test.mjs test/preset-choice.test.mjs test/sandbox.test.mjs test/agent-protocol.test.mjs test/agent.test.mjs test/agent-fs-script.test.mjs test/fsio-agent.test.mjs test/fs-substrate.test.mjs test/agent-exec.test.mjs test/ports.test.mjs test/watcher.test.mjs test/wsl.test.mjs test/fs-decisions.test.mjs test/git-route.test.mjs test/search-route.test.mjs test/search-exec.test.mjs test/terminal-activity.test.mjs test/session-scope.test.mjs test/session-runtime.test.mjs test/native-agent.test.mjs test/peers.test.mjs test/agent-shared.test.mjs test/distro-route.test.mjs test/fs-routing.test.mjs test/doctor.test.mjs test/profile-preset.test.mjs test/packaging.test.mjs test/peer-canary.test.mjs",
     "lint:style": "node test/style.mjs",
     "lint:links": "node scripts/check-links.mjs",
     "prepublishOnly": "pnpm test",
@@ -179,32 +179,32 @@
     "@deepseek-ai/cordis": "4.0.5",
     "@deepseek-ai/cordis-plugin-include": "*",
     "@deepseek-ai/cordis-plugin-loader": "*",
-    "@deepseek-ai/dsh-bash-local": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-fs": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-fs-local": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-fs-sandbox": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-host-directory-picker": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-sandbox": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-sandbox-policy": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-subprocess": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-subprocess-local": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-typert-protocol": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-bash-local": "0.2.1-rc.3",
+    "@deepseek-ai/dsh-fs": "0.2.1-rc.3",
+    "@deepseek-ai/dsh-fs-local": "0.2.1-rc.3",
+    "@deepseek-ai/dsh-fs-sandbox": "0.2.1-rc.3",
+    "@deepseek-ai/dsh-host-directory-picker": "0.2.1-rc.3",
+    "@deepseek-ai/dsh-sandbox": "0.2.1-rc.3",
+    "@deepseek-ai/dsh-sandbox-policy": "0.2.1-rc.3",
+    "@deepseek-ai/dsh-subprocess": "0.2.1-rc.3",
+    "@deepseek-ai/dsh-subprocess-local": "0.2.1-rc.3",
+    "@deepseek-ai/dsh-typert-protocol": "0.2.1-rc.3",
     "@types/js-yaml": "^4.0.9",
     "@types/node": "~22.20.5",
     "js-yaml": "4.3.2",
     "typescript": "~6.0.3"
   },
   "peerDependencies": {
-    "@deepseek-ai/cordis": "~4.0.5",
-    "@deepseek-ai/dsh-bash-local": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-fs": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-fs-local": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-host-directory-picker": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-sandbox": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-subprocess": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-subprocess-local": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-typert-protocol": "0.2.1-rc.2",
-    "@deepseek-ai/schemastery": "~3.18.5"
+    "@deepseek-ai/cordis": "^4.0.5",
+    "@deepseek-ai/dsh-bash-local": ">=0.2.1-rc.3",
+    "@deepseek-ai/dsh-fs": ">=0.2.1-rc.3",
+    "@deepseek-ai/dsh-fs-local": ">=0.2.1-rc.3",
+    "@deepseek-ai/dsh-host-directory-picker": ">=0.2.1-rc.3",
+    "@deepseek-ai/dsh-sandbox": ">=0.2.1-rc.3",
+    "@deepseek-ai/dsh-subprocess": ">=0.2.1-rc.3",
+    "@deepseek-ai/dsh-subprocess-local": ">=0.2.1-rc.3",
+    "@deepseek-ai/dsh-typert-protocol": ">=0.2.1-rc.3",
+    "@deepseek-ai/schemastery": "^3.18.5"
   },
   "peerDependenciesMeta": {
     "@deepseek-ai/cordis": {

package/scripts/doctor.mjs

@@ -145,19 +145,24 @@ function parseArgs(argv) {
 }
 
 /**
- * Whether an installed version satisfies one peer range. The plugin's pins are
- * exact or tilde ranges, so those two shapes are all this understands; anything
- * else is reported as unchecked rather than guessed at.
+ * Whether an installed version satisfies one peer range. The manifest's peer
+ * ranges are floor ranges (`>=`) and caret ranges (`^`), and the
+ * devDependencies carry exact pins — those three shapes are all this
+ * understands; anything else is reported as unchecked rather than guessed at.
+ * The floor is the plugin's own compatibility claim, so it compares plainly
+ * against the floor version; the semver gate that excludes other lines'
+ * prereleases is an installer concern, not this check's.
  * @param {string} installed - the installed version.
  * @param {string} range - the declared peer range.
  * @returns {boolean | undefined} true/false, or undefined for an unsupported shape.
  */
 export function peerSatisfied(installed, range) {
-  if (range.startsWith("~")) {
+  if (range.startsWith(">=")) return compareVersions(installed, range.slice(2)) >= 0;
+  if (range.startsWith("^")) {
     const [major, minor, patch] = range.slice(1).split(".");
     return compareVersions(installed, `${major}.${minor}.${patch ?? "0"}`) >= 0
       && installed.split(".")[0] === major
-      && installed.split(".")[1] === minor;
+      && (major !== "0" || installed.split(".")[1] === minor);
   }
   if (/^[0-9]/.test(range)) return installed === range;
   return undefined;
@@ -188,7 +193,35 @@ export function compareVersions(left, right) {
   if (a.pre === b.pre) return 0;
   if (a.pre === "") return 1;
   if (b.pre === "") return -1;
-  return a.pre.localeCompare(b.pre);
+  return comparePrerelease(a.pre, b.pre);
+}
+
+/**
+ * Compare two prerelease strings by semver §11: dot-separated identifiers,
+ * numeric ones numerically and below alphanumeric ones, the rest lexically,
+ * a longer list above its own prefix. Plain `localeCompare` would order
+ * `rc.10` below `rc.9`.
+ * @param {string} left - the first prerelease.
+ * @param {string} right - the second prerelease.
+ * @returns {number} negative, zero or positive like a comparator.
+ */
+function comparePrerelease(left, right) {
+  const a = left.split(".");
+  const b = right.split(".");
+  for (let i = 0; i < Math.max(a.length, b.length); i += 1) {
+    const x = a[i];
+    const y = b[i];
+    if (x === undefined) return -1;
+    if (y === undefined) return 1;
+    if (x === y) continue;
+    const numericX = /^\d+$/.test(x);
+    const numericY = /^\d+$/.test(y);
+    if (numericX && numericY) return Number(x) - Number(y);
+    if (numericX) return -1;
+    if (numericY) return 1;
+    return x < y ? -1 : 1;
+  }
+  return 0;
 }
 
 /**