dsh-workbuddy-connect 0.2.1

package/lib/index.js

@@ -0,0 +1,556 @@
+import { _ as WorkBuddyCredentialStore, a as readHostHeartbeat, b as workbuddyOwnAuthPath, d as prepareChatBody, f as regionOf, g as WORKBUDDY_AUTH_FILE_ENV, h as WORKBUDDY_AUTH_FILENAME, i as processStartTimeMs, l as WorkBuddyUpstreamClient, m as WorkBuddyCatalog, n as clearHostHeartbeat, o as workbuddyHostHeartbeatPath, p as FALLBACK_WORKBUDDY_MODELS, r as isHeartbeatProcessAlive, s as writeHostHeartbeat, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, u as classifyUpstreamError, v as defaultDesktopAuthPath, y as parseWorkBuddyAuth } from "./host-heartbeat-DehQgrb9.js";
+import z from "@deepseek-ai/schemastery";
+import { installSettingsSection, settingsNamespace } from "@deepseek-ai/dsh-settings";
+import { createProvider } from "@earendil-works/pi-ai";
+import { openAICompletionsApi } from "@earendil-works/pi-ai/api/openai-completions.lazy";
+import { resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
+import { PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { createServer } from "node:http";
+import { Readable } from "node:stream";
+//#region src/adapter.ts
+/**
+* The `workbuddy` pi-ai provider: one loopback-backed adapter registered
+* into the Harness LLM seam, assembled from public `dsh-llm-pi-ai`
+* extension points the way `dsh-codex-connect` assembles its Codex route.
+*
+* @module dsh-workbuddy-connect/adapter
+*/
+/** Provider route this bundle owns. */
+const WORKBUDDY_PROVIDER = "workbuddy";
+/** Provider idle ceiling while one stream read is outstanding. */
+const WORKBUDDY_STREAM_IDLE_TIMEOUT_MS = 3e5;
+/**
+* Image-request budgets at the dsh-llm-pi-ai defaults; the profile type made
+* them required in 0.1.1-rc.2. WorkBuddy routes are text-only today, so these
+* bounds never bite unless image input is added to the catalog.
+*/
+const REQUEST_IMAGE_BUDGETS = {
+	maxRequestImageBytes: 20971520,
+	requestImagePixelBudget: 4194304,
+	requestImageMaxBytes: 1048576
+};
+/**
+* Inert pi-ai auth plane. The workbuddy route authenticates only through the
+* shim shared secret resolved per request by `resolveApiKey`, so pi-ai's own
+* credential lifecycle and ambient discovery must never manufacture a
+* credential for it. `PiAiAdapterOptions.auth` is required since 0.1.1-rc.2;
+* every ambient question here answers "nothing stored, nothing set".
+*/
+const INERT_AUTH = {
+	credentials: {
+		async read() {},
+		async list() {
+			return [];
+		},
+		async modify() {
+			throw new Error("dsh-workbuddy-connect: the workbuddy route has no pi-ai credential lifecycle");
+		},
+		async delete() {}
+	},
+	authContext: {
+		async env() {},
+		async fileExists() {
+			return false;
+		}
+	}
+};
+/** No per-token pricing is knowable for a subscription quota; report zero. */
+const NO_COST = {
+	input: 0,
+	output: 0,
+	cacheRead: 0,
+	cacheWrite: 0
+};
+/** Build one pi-ai model descriptor pointing at the loopback shim. */
+function toPiModel(info, baseUrl) {
+	return {
+		id: info.id,
+		name: info.name,
+		api: "openai-completions",
+		provider: WORKBUDDY_PROVIDER,
+		baseUrl,
+		input: ["text"],
+		cost: NO_COST,
+		contextWindow: info.contextWindow,
+		maxTokens: info.maxTokens
+	};
+}
+/**
+* Assemble the adapter. The provider's `getModels` reads the live catalog,
+* and every model's `baseUrl` is re-resolved per read so the shim's
+* ephemeral port applies from the first snapshot after startup.
+*/
+function createWorkBuddyAdapter(options) {
+	const { shim, store, catalog, resolveAttachments } = options;
+	const buildModels = () => {
+		const baseUrl = `${shim.baseUrl()}/v1`;
+		return catalog.current().map((info) => toPiModel(info, baseUrl));
+	};
+	const provider = {
+		...createProvider({
+			id: WORKBUDDY_PROVIDER,
+			name: "WorkBuddy",
+			auth: { apiKey: {
+				name: "WorkBuddy OAuth bearer token",
+				async resolve({ credential }) {
+					const apiKey = credential?.key;
+					return apiKey === void 0 || apiKey.length === 0 ? void 0 : {
+						auth: { apiKey },
+						source: "WorkBuddy"
+					};
+				}
+			} },
+			models: buildModels(),
+			api: openAICompletionsApi()
+		}),
+		getModels: () => buildModels()
+	};
+	const profile = {
+		provider: WORKBUDDY_PROVIDER,
+		displayName: "WorkBuddy",
+		streamIdleTimeoutMs: WORKBUDDY_STREAM_IDLE_TIMEOUT_MS,
+		retryPolicy: resolveRetryPolicy(void 0, "dsh-workbuddy-connect retryPolicy"),
+		configuredMaxTokens: /* @__PURE__ */ new Map(),
+		...REQUEST_IMAGE_BUDGETS,
+		piProvider: provider
+	};
+	let profiles = /* @__PURE__ */ new Map([[WORKBUDDY_PROVIDER, profile]]);
+	return {
+		adapter: new PiAiAdapter({
+			profiles: () => profiles,
+			auth: INERT_AUTH,
+			resolveApiKey: async () => shim.token(),
+			...resolveAttachments === void 0 ? {} : { resolveAttachments }
+		}),
+		invalidate: () => {
+			profiles = /* @__PURE__ */ new Map([[WORKBUDDY_PROVIDER, profile]]);
+		}
+	};
+}
+//#endregion
+//#region src/shim.ts
+/**
+* Loopback OpenAI-compatible endpoint. The pi-ai provider points here; the
+* shim applies the WorkBuddy wire quirks (forced streaming, string
+* `tool_choice`, CLI-shaped headers) and forwards to the real upstream.
+* It binds 127.0.0.1 only and never serves another interface.
+*
+* Inbound hardening: the loopback bind alone is not a trust boundary (any
+* local process or a DNS-rebinding page can reach 127.0.0.1), so every
+* request must carry a loopback Host header, browser-sent Origins must be
+* loopback, chat POSTs must be application/json, and the Authorization
+* header must carry the shim's per-process shared secret. The plugin's
+* own client satisfies all four by construction; local attackers cannot
+* read the secret out of the plugin process's memory.
+*
+* @module dsh-workbuddy-connect/shim
+*/
+const REQUEST_BODY_LIMIT = 67108864;
+/** Loopback hostnames the shim's own in-process client uses. */
+const LOOPBACK_HOSTS = /* @__PURE__ */ new Set([
+	"127.0.0.1",
+	"localhost",
+	"[::1]"
+]);
+/** Strip the optional :port from a Host header value, IPv6-bracket aware. */
+function hostnameOfHost(host) {
+	let hostname = host.trim().toLowerCase();
+	if (hostname.startsWith("[")) {
+		const end = hostname.indexOf("]");
+		return end === -1 ? hostname : hostname.slice(0, end + 1);
+	}
+	const colon = hostname.lastIndexOf(":");
+	if (colon !== -1 && /^\d+$/.test(hostname.slice(colon + 1))) hostname = hostname.slice(0, colon);
+	return hostname;
+}
+/**
+* The request's Host header must name the loopback interface. A DNS-rebinding
+* page (attacker domain re-resolved to 127.0.0.1) sends its own domain in
+* Host, so this check drops those before any routing happens.
+*/
+function hostIsLoopback(host) {
+	if (host === void 0 || host.trim() === "") return false;
+	return LOOPBACK_HOSTS.has(hostnameOfHost(host));
+}
+/**
+* A browser-sent Origin (present header) must be loopback. Non-browser
+* clients (the plugin's own fetch calls) send no Origin at all and pass.
+*/
+function originIsLoopback(origin) {
+	if (origin === void 0 || origin.trim() === "") return true;
+	try {
+		const { hostname } = new URL(origin);
+		return LOOPBACK_HOSTS.has(hostname) || hostname === "::1";
+	} catch {
+		return false;
+	}
+}
+/** Chat-completion POSTs must carry a JSON body type (simple-request CSRF drops here). */
+function isJsonContentType(req) {
+	const type = req.headers["content-type"];
+	return typeof type === "string" && type.trim().toLowerCase().startsWith("application/json");
+}
+/** HTTP status each upstream failure class surfaces as. */
+const KIND_STATUS = {
+	hard_credit: 402,
+	soft_rate: 429,
+	session_dead: 401,
+	not_found: 502,
+	server: 502,
+	client: 400
+};
+function writeJson(res, status, body) {
+	const payload = JSON.stringify(body);
+	res.writeHead(status, {
+		"Content-Type": "application/json",
+		"Content-Length": Buffer.byteLength(payload)
+	});
+	res.end(payload);
+}
+function writeOpenAIError(res, status, kind, message) {
+	writeJson(res, status, { error: {
+		message,
+		type: kind,
+		code: kind
+	} });
+}
+/** Read a request body with a size cap; over-limit bodies fail the request. */
+function readBody(req) {
+	return new Promise((resolve, reject) => {
+		const chunks = [];
+		let size = 0;
+		req.on("data", (chunk) => {
+			size += chunk.length;
+			if (size > REQUEST_BODY_LIMIT) {
+				reject(/* @__PURE__ */ new Error("request body too large"));
+				req.destroy();
+				return;
+			}
+			chunks.push(chunk);
+		});
+		req.on("end", () => resolve(Buffer.concat(chunks)));
+		req.on("error", reject);
+	});
+}
+/**
+* Start the loopback endpoint. Requests carry any bearer; the loopback bind
+* is the boundary, and the upstream credential comes from the store alone.
+*/
+function createWorkBuddyShim(options) {
+	const { store, client, catalog } = options;
+	const logger = options.logger;
+	const SHARED_SECRET = randomBytes(32).toString("base64url");
+	/** Constant-time bearer check; absent or mismatched bearers are rejected. */
+	function bearerOk(req) {
+		const header = req.headers.authorization;
+		if (typeof header !== "string") return false;
+		const match = /^Bearer\s+(.+)$/i.exec(header.trim());
+		if (match === null) return false;
+		const presented = match[1];
+		const expected = SHARED_SECRET;
+		const a = Buffer.from(presented);
+		const b = Buffer.from(expected);
+		if (a.length !== b.length) return false;
+		return timingSafeEqual(a, b);
+	}
+	const server = createServer((req, res) => {
+		handle(req, res);
+	});
+	const ready = new Promise((resolve, reject) => {
+		server.once("listening", () => resolve());
+		server.once("error", reject);
+	});
+	server.listen(0, "127.0.0.1");
+	const baseUrl = () => {
+		const address = server.address();
+		if (address === null || typeof address === "string") throw new Error("workbuddy shim has no listening address");
+		return `http://127.0.0.1:${address.port}`;
+	};
+	async function handle(req, res) {
+		try {
+			if (!hostIsLoopback(req.headers.host)) {
+				writeOpenAIError(res, 403, "host_not_allowed", "Host header must name the loopback interface");
+				return;
+			}
+			if (!originIsLoopback(req.headers.origin)) {
+				writeOpenAIError(res, 403, "origin_not_allowed", "Origin must be a loopback origin");
+				return;
+			}
+			if (!bearerOk(req)) {
+				writeOpenAIError(res, 401, "unauthorized", "missing or invalid Authorization bearer");
+				return;
+			}
+			const url = req.url ?? "/";
+			if (req.method === "GET" && (url === "/healthz" || url === "/healthz/")) {
+				writeJson(res, 200, { ok: true });
+				return;
+			}
+			if (req.method === "GET" && (url === "/v1/models" || url === "/v1/models/")) {
+				writeJson(res, 200, {
+					object: "list",
+					data: catalog.current().map((model) => ({
+						id: model.id,
+						object: "model",
+						created: 0,
+						owned_by: "workbuddy"
+					}))
+				});
+				return;
+			}
+			if (req.method === "POST" && (url === "/v1/chat/completions" || url === "/v1/chat/completions/")) {
+				await chatCompletions(req, res);
+				return;
+			}
+			writeOpenAIError(res, 404, "not_found", `no such route: ${req.method} ${url}`);
+		} catch (error) {
+			if (!res.headersSent) writeOpenAIError(res, 500, "internal", String(error));
+			else res.end();
+		}
+	}
+	async function chatCompletions(req, res) {
+		if (!isJsonContentType(req)) {
+			writeOpenAIError(res, 415, "unsupported_media_type", "Content-Type must be application/json");
+			return;
+		}
+		let credential;
+		try {
+			credential = await store.resolve();
+		} catch (error) {
+			writeOpenAIError(res, 401, "not_signed_in", String(error));
+			return;
+		}
+		const raw = (await readBody(req)).toString("utf8");
+		const prepared = prepareChatBody(raw);
+		const controller = new AbortController();
+		req.on("close", () => controller.abort());
+		const result = await client.chatStream(credential, prepared, controller.signal);
+		if (!result.ok) {
+			writeOpenAIError(res, KIND_STATUS[result.kind], result.kind, `workbuddy upstream ${result.kind} (http ${result.status}): ${result.message.slice(0, 400)}`);
+			return;
+		}
+		res.writeHead(200, {
+			"Content-Type": "text/event-stream",
+			"Cache-Control": "no-cache",
+			"Connection": "keep-alive",
+			"X-Accel-Buffering": "no"
+		});
+		let sawDone = false;
+		const body = Readable.fromWeb(result.response.body);
+		body.on("data", (chunk) => {
+			if (chunk.includes("[DONE]")) sawDone = true;
+		});
+		body.on("error", (error) => {
+			logger?.warn("dsh-workbuddy-connect: upstream stream failed mid-flight", error);
+			if (!sawDone && res.writable) res.end("data: [DONE]\n\n");
+		});
+		body.pipe(res);
+	}
+	return {
+		ready,
+		baseUrl,
+		token: () => SHARED_SECRET,
+		close: () => new Promise((resolve, reject) => {
+			server.close(() => resolve());
+			server.closeAllConnections();
+			server.once("error", reject);
+		})
+	};
+}
+//#endregion
+//#region src/status-paths.ts
+/** Node-free constants and types shared by the Host and browser halves. */
+/** Plugin-owned status endpoint consumed by its browser half. */
+const WORKBUDDY_STATUS_PATH = "/plugins/dsh-workbuddy-connect/status";
+//#endregion
+//#region src/web-status.ts
+/** Redact token-like content before it crosses to the browser. */
+function safeMessage(error) {
+	return (error instanceof Error ? error.message : String(error)).replace(/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/gu, "[redacted token]").replace(/(\b(?:code|token|refresh_token|access_token)=)[^&\s]+/giu, "$1[redacted]").slice(0, 500);
+}
+function json(res, status, body) {
+	const payload = JSON.stringify(body);
+	res.writeHead(status, {
+		"Content-Type": "application/json",
+		"Content-Length": Buffer.byteLength(payload)
+	});
+	res.end(payload);
+}
+/** Loopback browser origins only; other devices are refused until trusted origins exist. */
+function loopbackOrigin(req) {
+	const origin = req.headers.origin;
+	if (origin === void 0) return true;
+	try {
+		const { hostname } = new URL(origin);
+		return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]" || hostname === "::1";
+	} catch {
+		return false;
+	}
+}
+/**
+* Assemble the card's status document. Sign-in state is read-only; credit is
+* a live billing answer whose failure degrades to `creditsError` rather than
+* failing the whole document.
+*/
+async function workBuddyWebStatus(deps) {
+	const authStatus = await deps.store.status();
+	if (authStatus.state !== "signed-in") return { status: "signed-out" };
+	const status = {
+		status: "signed-in",
+		...authStatus.nickname === void 0 ? {} : { nickname: authStatus.nickname },
+		...authStatus.domain === void 0 || authStatus.domain === "" ? {} : { domain: authStatus.domain },
+		...authStatus.source === void 0 ? {} : { source: authStatus.source },
+		...authStatus.expiresAtMs === void 0 ? {} : { expiresAt: authStatus.expiresAtMs }
+	};
+	try {
+		const credential = await deps.store.current();
+		if (credential !== void 0) {
+			const credits = await deps.client.fetchCredits(credential);
+			return {
+				...status,
+				credits
+			};
+		}
+	} catch (error) {
+		return {
+			...status,
+			creditsError: safeMessage(error)
+		};
+	}
+	return status;
+}
+/** Mount the GET status route on an optional webServer context. */
+function registerWorkBuddyStatusRoute(ctx, deps) {
+	ctx.effect(() => {
+		const dispose = ctx.webServer.register({
+			kind: "exact",
+			path: WORKBUDDY_STATUS_PATH,
+			handler: async (req, res) => {
+				if (req.method !== "GET") {
+					json(res, 405, { error: "method not allowed" });
+					return;
+				}
+				if (!loopbackOrigin(req)) {
+					json(res, 403, { error: "origin-not-trusted" });
+					return;
+				}
+				try {
+					json(res, 200, await workBuddyWebStatus(deps));
+				} catch (error) {
+					json(res, 500, { error: safeMessage(error) });
+				}
+			}
+		});
+		return () => {
+			dispose();
+		};
+	}, "dsh-workbuddy-connect: Web status route");
+}
+//#endregion
+//#region src/index.ts
+/** Stable Cordis plugin name. */
+const name = "llm-workbuddy";
+/** The model registry required before the provider can register. */
+const inject = ["llm"];
+/** Settings namespace reserved for the future configuration card. */
+const WORKBUDDY_SETTINGS_NS = settingsNamespace("workbuddy");
+const Config = z.object({ authFile: z.string().description("WorkBuddy desktop auth file (defaults to the app's own location)") });
+/**
+* Start the loopback endpoint, register the `workbuddy` provider, and
+* refresh the model catalog from the upstream once credentials allow it.
+* The static fallback catalog serves from the first moment, so an offline
+* upstream never leaves the provider empty.
+*/
+function apply(ctx, config) {
+	const client = new WorkBuddyUpstreamClient();
+	const store = new WorkBuddyCredentialStore({
+		...config.authFile === void 0 ? {} : { desktopPath: config.authFile },
+		refresh: (credential) => client.refreshToken(credential)
+	});
+	const catalog = new WorkBuddyCatalog();
+	const shim = createWorkBuddyShim({
+		store,
+		client,
+		catalog,
+		logger: ctx.logger
+	});
+	ctx.inject(["webServer"], (webCtx) => registerWorkBuddyStatusRoute(webCtx, {
+		store,
+		client
+	}));
+	let current = () => config;
+	installSettingsSection(ctx, WORKBUDDY_SETTINGS_NS, Config, config, {
+		setSource(source) {
+			current = source;
+		},
+		onChange() {
+			const next = current().authFile;
+			store.setDesktopPath(next);
+		}
+	});
+	let stopped = false;
+	ctx.effect(() => () => {
+		stopped = true;
+		shim.close();
+		clearHostHeartbeat();
+	});
+	shim.ready.then(() => {
+		if (stopped) return;
+		let invalidate;
+		try {
+			const workbuddy = createWorkBuddyAdapter({
+				shim,
+				store,
+				catalog,
+				resolveAttachments: () => ctx.get("attachments")
+			});
+			invalidate = workbuddy.invalidate;
+			let releaseAdapter;
+			let releaseDirectory;
+			try {
+				releaseAdapter = ctx.llm.registerAdapter([WORKBUDDY_PROVIDER], workbuddy.adapter);
+				releaseDirectory = ctx.llm.registerConfigurableProviders([{
+					provider: WORKBUDDY_PROVIDER,
+					displayName: "WorkBuddy",
+					settingsNs: WORKBUDDY_SETTINGS_NS,
+					settingsPath: [],
+					declared: false
+				}]);
+			} finally {
+				if (releaseAdapter === void 0 || releaseDirectory === void 0) {
+					releaseAdapter?.();
+					releaseDirectory?.();
+				}
+			}
+			try {
+				ctx.effect(() => () => {
+					releaseAdapter?.();
+					releaseDirectory?.();
+				});
+			} catch {
+				releaseAdapter?.();
+				releaseDirectory?.();
+			}
+			writeHostHeartbeat();
+		} catch (error) {
+			ctx.logger.error("dsh-workbuddy-connect: provider registration failed", error);
+			return;
+		}
+		(async () => {
+			try {
+				const credential = await store.current();
+				if (credential === void 0 || stopped) return;
+				const models = await client.fetchModels(credential);
+				if (stopped) return;
+				catalog.set([...models]);
+				invalidate?.();
+			} catch (error) {
+				ctx.logger.warn("dsh-workbuddy-connect: dynamic model catalog unavailable; serving the static fallback list", error);
+			}
+		})();
+	}).catch((error) => {
+		ctx.logger.error("dsh-workbuddy-connect: loopback endpoint failed to start; provider not registered", error);
+	});
+}
+//#endregion
+export { Config, FALLBACK_WORKBUDDY_MODELS, WORKBUDDY_AUTH_FILENAME, WORKBUDDY_AUTH_FILE_ENV, WORKBUDDY_HOST_HEARTBEAT_FILENAME, WORKBUDDY_PROVIDER, WORKBUDDY_SETTINGS_NS, WORKBUDDY_STREAM_IDLE_TIMEOUT_MS, WorkBuddyCatalog, WorkBuddyCredentialStore, WorkBuddyUpstreamClient, apply, classifyUpstreamError, clearHostHeartbeat, createWorkBuddyAdapter, createWorkBuddyShim, defaultDesktopAuthPath, inject, isHeartbeatProcessAlive, name, parseWorkBuddyAuth, prepareChatBody, processStartTimeMs, readHostHeartbeat, regionOf, workbuddyHostHeartbeatPath, workbuddyOwnAuthPath };

package/package.json

@@ -0,0 +1,102 @@
+{
+  "name": "dsh-workbuddy-connect",
+  "displayName": "DSH WorkBuddy Connect",
+  "description": "将 WorkBuddy 桌面 App 包含的模型自动接入 DeepSeek Harness — bring WorkBuddy desktop app models into DeepSeek Harness with zero configuration.",
+  "version": "0.2.1",
+  "author": "corrinehu",
+  "keywords": [
+    "dsh-plugin",
+    "deepseek-harness",
+    "deepseek",
+    "workbuddy",
+    "model-provider"
+  ],
+  "type": "module",
+  "engines": {
+    "node": "^22.19.0 || >=24.0.0"
+  },
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "bin": {
+    "dsh-workbuddy-connect": "lib/bin.js"
+  },
+  "scripts": {
+    "build": "tsdown",
+    "test": "vitest run",
+    "typecheck": "tsc -p tsconfig.json && tsc -p tsconfig.client.json",
+    "check": "pnpm run typecheck && pnpm run test && pnpm run build"
+  },
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./client": "./lib/client.js",
+    "./cordis.patch.yml": "./cordis.patch.yml",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib",
+    "cordis.patch.yml",
+    "README.md",
+    "README.en.md",
+    "LICENSE"
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/corrinehu/dsh-workbuddy-connect.git"
+  },
+  "homepage": "https://github.com/corrinehu/dsh-workbuddy-connect#readme",
+  "bugs": "https://github.com/corrinehu/dsh-workbuddy-connect/issues",
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "inject": [
+        "@deepseek-ai/dsh-client-runtime",
+        "@deepseek-ai/dsh-client-ui-slots",
+        "@deepseek-ai/dsh-client-ui-settings-plugins",
+        "@deepseek-ai/dsh-client-locale"
+      ],
+      "platform": "web"
+    }
+  },
+  "peerDependencies": {
+    "@earendil-works/pi-ai": "0.82.1",
+    "@deepseek-ai/cordis": "^4.0.1-rc.1",
+    "@deepseek-ai/dsh-atomic-write": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-attachment": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-home-paths": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-host-webserver": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-llm": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-llm-pi-ai": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-settings": "^0.1.1-rc.2",
+    "@deepseek-ai/schemastery": "^3.18.1-rc.1",
+    "react": "^18.2.0"
+  },
+  "devDependencies": {
+    "@earendil-works/pi-ai": "0.82.1",
+    "@deepseek-ai/cordis": "^4.0.1",
+    "@deepseek-ai/dsh-atomic-write": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-attachment": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-client-locale": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-client-runtime": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-settings-plugins": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-slots": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-credentials": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-home-paths": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-host-webserver": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-llm": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-llm-pi-ai": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-settings": "^0.1.1-rc.2",
+    "@deepseek-ai/schemastery": "3.18.1",
+    "@types/node": "^22.20.0",
+    "@types/react": "~18.3.1",
+    "react": "^18.2.0",
+    "tsdown": "^0.22.2",
+    "typescript": "^5.9.3",
+    "vitest": "^4.1.8"
+  }
+}