dsh-workbuddy-connect 0.3.0 → 0.3.2

package/README.en.md

@@ -34,11 +34,14 @@ Prerequisite: the WorkBuddy desktop app is installed and signed in (the plugin r
 
 | Plugin | Required DSH core | Desktop app |
 |---|---|---|
-| **0.3.0+** | `0.1.2-rc.1` or newer | `2.0.5`+ recommended |
+| **0.3.2+** | `0.1.5-rc.1` or newer | wait for the app's bundled core to follow |
+| **0.3.0 – 0.3.1** | `0.1.2-rc.1` | `2.0.5`+ recommended |
 | **0.2.6** | `0.1.1-rc.2` (older line) | `2.0.3` / `2.0.4` |
 
-- On DSH `0.1.2-rc.1` or newer, just install the latest: `dsh plugin --profile web add dsh-workbuddy-connect`
+- On DSH `0.1.5-rc.1` or newer, just install the latest: `dsh plugin --profile web add dsh-workbuddy-connect`
+- Still on DSH `0.1.2-rc.1`? Stay on `0.3.1`: `dsh plugin --profile web add dsh-workbuddy-connect@0.3.1`
 - Still on DSH `0.1.1-rc.2`? Stay on the older release: `dsh plugin --profile web add dsh-workbuddy-connect@0.2.6`
+- The desktop app (`2.0.5` today, bundled core still `0.1.2-rc.1`) should stay on `0.3.1` until its bundled core reaches `0.1.5`
 
 The plugin runs under all three DSH interfaces: **Web**, **Desktop**, and **TUI**. Pick the install command that matches the profile you use.
 
@@ -64,7 +67,7 @@ dsh plugin --profile dsh-tui add dsh-workbuddy-connect
 dsh --profile dsh-tui
 ```
 
-> **TUI users should stay on 0.2.6**: in our testing, installing this plugin 0.3.0 on the TUI profile crashes startup with `events is not iterable` — the terminal UI package (`@deepseek-harness-tui/dsh-tui`) has not been adapted to the new DSH core yet (the fix is committed upstream, unreleased). We recommend TUI users keep DSH `0.1.1-rc.2` and plugin `0.2.6` for now, and upgrade to 0.3.0 once the terminal UI ships an adapted release.
+> **TUI users, check the version pairing**: the terminal UI package (`@deepseek-harness-tui/dsh-tui`) must be **`0.10.0-beta.5` or newer** — older versions fail at startup with `events is not iterable` when this plugin is installed. Update the shell first (via its built-in update command or a fresh install), then add this plugin; the newest release is a beta, and a stable one will work the same way.
 
 > Note: the `dsh-tui` profile requires pnpm 11 to install packages (a different pnpm on PATH fails with `ERR_PNPM_UNEXPECTED_STORE` — use `npx pnpm@11`).
 
@@ -76,7 +79,7 @@ After installing, switch to a WorkBuddy model in the model picker of the interfa
 
 ## Known limitations
 
-- Verified on macOS with the DSH Web / Desktop profiles (`0.1.2-rc.1`+, Node 22+); TUI pending a terminal-UI release adapted to 0.1.2 (see the Install section). Windows probes Local and Roaming AppData in order; WSL first reads credentials from the mounted Windows user profile. If the Windows and Linux user names differ and Windows environment variables are not forwarded into WSL, point `WORKBUDDY_AUTH_FILE` at the actual file.
+- Verified on macOS with the DSH Web / Desktop / TUI profiles (as of 0.3.2 this requires `0.1.5-rc.1`+ and Node 22+; TUI requires the terminal UI package `0.10.0-beta.5` or newer — see the Install section). Windows probes Local and Roaming AppData in order; WSL first reads credentials from the mounted Windows user profile. If the Windows and Linux user names differ and Windows environment variables are not forwarded into WSL, point `WORKBUDDY_AUTH_FILE` at the actual file.
 - Relies on WorkBuddy client interfaces (not a public API); the plugin may need updates as WorkBuddy changes.
 
 ## Disclaimer

package/README.md

@@ -44,11 +44,14 @@
 
 | 插件版本 | 要求的 DSH 核心 | 桌面 App |
 |---|---|---|
-| **0.3.0+** | `0.1.2-rc.1` 及以上 | 建议 `2.0.5`+ |
+| **0.3.2+** | `0.1.5-rc.1` 及以上 | 待 App 内置核心跟进 |
+| **0.3.0 – 0.3.1** | `0.1.2-rc.1` | `2.0.5`+ |
 | **0.2.6** | `0.1.1-rc.2`（旧线） | `2.0.3` / `2.0.4` |
 
-- DSH `0.1.2-rc.1` 及以上的用户，正常安装最新版即可：`dsh plugin --profile web add dsh-workbuddy-connect`
-- 还在用 DSH `0.1.1-rc.2` 的用户，请安装旧版本并停留在 `0.2.6`：`dsh plugin --profile web add dsh-workbuddy-connect@0.2.6`
+- DSH `0.1.5-rc.1` 及以上的用户，正常安装最新版即可：`dsh plugin --profile web add dsh-workbuddy-connect`
+- 还在用 DSH `0.1.2-rc.1` 的用户，请停留在 `0.3.1`：`dsh plugin --profile web add dsh-workbuddy-connect@0.3.1`
+- 还在用 DSH `0.1.1-rc.2` 的用户，请停留在 `0.2.6`：`dsh plugin --profile web add dsh-workbuddy-connect@0.2.6`
+- 桌面 App（当前 `2.0.5`，内置核心仍为 `0.1.2-rc.1`）请在 App 内核跟进 `0.1.5` 前继续使用 `0.3.1`
 
 插件在三种 DSH 界面下均可运行：**Web**、**Desktop**、**TUI**。根据你使用的 profile 选对应命令安装。
 
@@ -74,7 +77,7 @@ dsh plugin --profile dsh-tui add dsh-workbuddy-connect
 dsh --profile dsh-tui
 ```
 
-> **TUI 用户请先留在 0.2.6**：实测在 TUI 上安装本插件 0.3.0 会导致启动崩溃（报 `events is not iterable`），原因是终端界面插件 `@deepseek-harness-tui/dsh-tui` 还没适配 DSH 新核心（修复已提交，尚未发版）。建议 TUI 用户暂时继续使用 DSH `0.1.1-rc.2` 和本插件 `0.2.6`，等终端界面插件发布适配版本后再升级 0.3.0。
+> **TUI 用户请注意版本搭配**：终端界面插件 `@deepseek-harness-tui/dsh-tui` 需要 **`0.10.0-beta.5` 及以上**（更早的版本装了本插件会启动失败，报 `events is not iterable`）。请先用 TUI 自带的更新方式把壳升到 beta.5 及以上，再安装本插件；当前最新的是 beta 版，正式版发布后同样可用。
 
 > 提示：`dsh-tui` profile 需用 pnpm 11 安装（PATH 里是其他版本会报 `ERR_PNPM_UNEXPECTED_STORE`，用 `npx pnpm@11` 即可）。
 
@@ -86,7 +89,7 @@ dsh --profile dsh-tui
 
 ## 已知限制
 
-- 在 macOS 的 DSH Web / Desktop profile（`0.1.2-rc.1`+、Node 22+）下验证通过；TUI 待终端界面插件发布 0.1.2 适配版后验证（见安装章节说明）。Windows 会依次探测 Local 与 Roaming AppData；WSL 会优先从挂载的 Windows 用户目录读取登录凭据。若 Windows 与 Linux 用户名不同且 Windows 环境变量未传入 WSL，请通过 `WORKBUDDY_AUTH_FILE` 指定实际位置。
+- 在 macOS 的 DSH Web / Desktop / TUI 下验证通过（0.3.2 起要求 `0.1.5-rc.1`+、Node 22+；TUI 需终端界面插件 `0.10.0-beta.5` 及以上，见安装章节说明）。Windows 会依次探测 Local 与 Roaming AppData；WSL 会优先从挂载的 Windows 用户目录读取登录凭据。若 Windows 与 Linux 用户名不同且 Windows 环境变量未传入 WSL，请通过 `WORKBUDDY_AUTH_FILE` 指定实际位置。
 - 依赖 WorkBuddy 客户端接口（非官方开放 API），WorkBuddy 更新后插件可能需要随之调整。
 
 ## 免责声明

package/lib/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { S as workbuddyOwnAuthPath, a as readHostHeartbeat, c as WORKBUDDY_CONNECT_VERSION, l as WorkBuddyUpstreamClient, m as FALLBACK_WORKBUDDY_MODELS, o as workbuddyHostHeartbeatPath, r as isHeartbeatProcessAlive, v as WorkBuddyCredentialStore } from "./host-heartbeat-CM7AW7vZ.js";
+import { S as workbuddyOwnAuthPath, a as readHostHeartbeat, c as WORKBUDDY_CONNECT_VERSION, l as WorkBuddyUpstreamClient, m as FALLBACK_WORKBUDDY_MODELS, o as workbuddyHostHeartbeatPath, r as isHeartbeatProcessAlive, v as WorkBuddyCredentialStore } from "./host-heartbeat-BSsKUoB8.js";
 import { realpathSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 //#region src/bin.ts

package/lib/{host-heartbeat-CM7AW7vZ.js → host-heartbeat-BSsKUoB8.js}

@@ -142,10 +142,21 @@ function parseOwnDocument(text) {
 	const document = parsed;
 	if (document["version"] !== OWN_FORMAT_VERSION) return void 0;
 	if (typeof document["credential"] !== "object" || document["credential"] === null) return void 0;
-	const credential = parseWorkBuddyAuth(JSON.stringify({ auth: document["credential"] }));
-	if (credential === void 0) return void 0;
+	const stored = document["credential"];
+	const accessToken = typeof stored["accessToken"] === "string" ? stored["accessToken"] : "";
+	if (accessToken === "") return void 0;
+	const refreshExpiresAtMs = typeof stored["refreshExpiresAtMs"] === "number" ? stored["refreshExpiresAtMs"] : void 0;
+	const enterpriseId = optionalString(stored["enterpriseId"]);
+	const nickname = optionalString(stored["nickname"]);
 	return {
-		...credential,
+		accessToken,
+		refreshToken: typeof stored["refreshToken"] === "string" ? stored["refreshToken"] : "",
+		expiresAtMs: typeof stored["expiresAtMs"] === "number" ? stored["expiresAtMs"] : 0,
+		...refreshExpiresAtMs === void 0 ? {} : { refreshExpiresAtMs },
+		domain: optionalString(stored["domain"]) ?? "",
+		uid: optionalString(stored["uid"]) ?? "",
+		...enterpriseId === void 0 ? {} : { enterpriseId },
+		...nickname === void 0 ? {} : { nickname },
 		source: "dsh"
 	};
 }
@@ -1041,7 +1052,7 @@ var WorkBuddyUpstreamClient = class {
 };
 //#endregion
 //#region src/version.ts
-const WORKBUDDY_CONNECT_VERSION = "0.3.0";
+const WORKBUDDY_CONNECT_VERSION = "0.3.2";
 //#endregion
 //#region src/host-heartbeat.ts
 /**

package/lib/index.d.ts

@@ -335,6 +335,13 @@ interface WorkBuddyAdapter {
  * Assemble the adapter. The provider's `getModels` reads the live catalog,
  * and every model's `baseUrl` is re-resolved per read so the shim's
  * ephemeral port applies from the first snapshot after startup.
+ *
+ * The profile is constructed by hand rather than through dsh-llm-pi-ai's
+ * internal `resolveProfiles()`: that helper is not part of the package's
+ * public export surface (root entry, `lib/` deep imports blocked by the
+ * exports map, `src/` not shipped), so hand-assembly is the only supported
+ * path and every newly required field must be adopted here explicitly —
+ * `modelErrors` since 0.1.5-alpha.2 (#12).
  */
 declare function createWorkBuddyAdapter(options: WorkBuddyAdapterOptions): WorkBuddyAdapter;
 //#endregion

package/lib/index.js

@@ -1,4 +1,4 @@
-import { S as workbuddyOwnAuthPath, _ as WORKBUDDY_AUTH_FILE_ENV, a as readHostHeartbeat, b as defaultDesktopAuthPath, d as normalizeCredits, f as prepareChatBody, g as WORKBUDDY_AUTH_FILENAME, h as WorkBuddyCatalog, i as processStartTimeMs, l as WorkBuddyUpstreamClient, m as FALLBACK_WORKBUDDY_MODELS, n as clearHostHeartbeat, o as workbuddyHostHeartbeatPath, p as regionOf, r as isHeartbeatProcessAlive, s as writeHostHeartbeat, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, u as classifyUpstreamError, v as WorkBuddyCredentialStore, x as parseWorkBuddyAuth, y as defaultDesktopAuthCandidates } from "./host-heartbeat-CM7AW7vZ.js";
+import { S as workbuddyOwnAuthPath, _ as WORKBUDDY_AUTH_FILE_ENV, a as readHostHeartbeat, b as defaultDesktopAuthPath, d as normalizeCredits, f as prepareChatBody, g as WORKBUDDY_AUTH_FILENAME, h as WorkBuddyCatalog, i as processStartTimeMs, l as WorkBuddyUpstreamClient, m as FALLBACK_WORKBUDDY_MODELS, n as clearHostHeartbeat, o as workbuddyHostHeartbeatPath, p as regionOf, r as isHeartbeatProcessAlive, s as writeHostHeartbeat, t as WORKBUDDY_HOST_HEARTBEAT_FILENAME, u as classifyUpstreamError, v as WorkBuddyCredentialStore, x as parseWorkBuddyAuth, y as defaultDesktopAuthCandidates } from "./host-heartbeat-BSsKUoB8.js";
 import z from "@deepseek-ai/schemastery";
 import { createProvider } from "@earendil-works/pi-ai";
 import { openAICompletionsApi } from "@earendil-works/pi-ai/api/openai-completions.lazy";
@@ -158,6 +158,13 @@ function toPiModel(info, baseUrl) {
 * Assemble the adapter. The provider's `getModels` reads the live catalog,
 * and every model's `baseUrl` is re-resolved per read so the shim's
 * ephemeral port applies from the first snapshot after startup.
+*
+* The profile is constructed by hand rather than through dsh-llm-pi-ai's
+* internal `resolveProfiles()`: that helper is not part of the package's
+* public export surface (root entry, `lib/` deep imports blocked by the
+* exports map, `src/` not shipped), so hand-assembly is the only supported
+* path and every newly required field must be adopted here explicitly —
+* `modelErrors` since 0.1.5-alpha.2 (#12).
 */
 function createWorkBuddyAdapter(options) {
 	const { shim, store, catalog, resolveAttachments } = options;
@@ -190,6 +197,7 @@ function createWorkBuddyAdapter(options) {
 		streamIdleTimeoutMs: WORKBUDDY_STREAM_IDLE_TIMEOUT_MS,
 		retryPolicy: resolveRetryPolicy(void 0, "dsh-workbuddy-connect retryPolicy"),
 		configuredMaxTokens: /* @__PURE__ */ new Map(),
+		modelErrors: /* @__PURE__ */ new Map(),
 		...REQUEST_IMAGE_BUDGETS,
 		piProvider: provider
 	};
@@ -253,25 +261,15 @@ var WorkBuddyPiAiAdapter = class extends PiAiAdapter {
 	}
 };
 //#endregion
-//#region src/shim.ts
+//#region src/loopback.ts
 /**
-* Loopback OpenAI-compatible endpoint. The pi-ai provider points here; the
-* shim applies the WorkBuddy wire quirks (forced streaming, string
-* `tool_choice`, CLI-shaped headers) and forwards to the real upstream.
-* It binds 127.0.0.1 only and never serves another interface.
-*
-* Inbound hardening: the loopback bind alone is not a trust boundary (any
-* local process or a DNS-rebinding page can reach 127.0.0.1), so every
-* request must carry a loopback Host header, browser-sent Origins must be
-* loopback, chat POSTs must be application/json, and the Authorization
-* header must carry the shim's per-process shared secret. The plugin's
-* own client satisfies all four by construction; local attackers cannot
-* read the secret out of the plugin process's memory.
+* Shared loopback gates for the plugin's local HTTP surfaces: the loopback
+* shim and the same-origin web-status route. Both are only ever meant to be
+* addressed through the machine's loopback interface.
 *
-* @module dsh-workbuddy-connect/shim
+* @module dsh-workbuddy-connect/loopback
 */
-const REQUEST_BODY_LIMIT = 67108864;
-/** Loopback hostnames the shim's own in-process client uses. */
+/** Loopback hostnames a local plugin surface may be addressed by. */
 const LOOPBACK_HOSTS = /* @__PURE__ */ new Set([
 	"127.0.0.1",
 	"localhost",
@@ -285,7 +283,7 @@ function hostnameOfHost(host) {
 		return end === -1 ? hostname : hostname.slice(0, end + 1);
 	}
 	const colon = hostname.lastIndexOf(":");
-	if (colon !== -1 && /^\d+$/.test(hostname.slice(colon + 1))) hostname = hostname.slice(0, colon);
+	if (colon !== -1 && !hostname.slice(0, colon).includes(":") && /^\d+$/.test(hostname.slice(colon + 1))) hostname = hostname.slice(0, colon);
 	return hostname;
 }
 /**
@@ -310,6 +308,25 @@ function originIsLoopback(origin) {
 		return false;
 	}
 }
+//#endregion
+//#region src/shim.ts
+/**
+* Loopback OpenAI-compatible endpoint. The pi-ai provider points here; the
+* shim applies the WorkBuddy wire quirks (forced streaming, string
+* `tool_choice`, CLI-shaped headers) and forwards to the real upstream.
+* It binds 127.0.0.1 only and never serves another interface.
+*
+* Inbound hardening: the loopback bind alone is not a trust boundary (any
+* local process or a DNS-rebinding page can reach 127.0.0.1), so every
+* request must carry a loopback Host header, browser-sent Origins must be
+* loopback, chat POSTs must be application/json, and the Authorization
+* header must carry the shim's per-process shared secret. The plugin's
+* own client satisfies all four by construction; local attackers cannot
+* read the secret out of the plugin process's memory.
+*
+* @module dsh-workbuddy-connect/shim
+*/
+const REQUEST_BODY_LIMIT = 67108864;
 /** Chat-completion POSTs must carry a JSON body type (simple-request CSRF drops here). */
 function isJsonContentType(req) {
 	const type = req.headers["content-type"];
@@ -500,16 +517,14 @@ function json(res, status, body) {
 	});
 	res.end(payload);
 }
-/** Loopback browser origins only; other devices are refused until trusted origins exist. */
-function loopbackOrigin(req) {
-	const origin = req.headers.origin;
-	if (origin === void 0) return true;
-	try {
-		const { hostname } = new URL(origin);
-		return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]" || hostname === "::1";
-	} catch {
-		return false;
-	}
+/**
+* The request must be addressed to the loopback interface, and a
+* browser-attached Origin must be loopback too. The Host check drops
+* DNS-rebinding pages (their Host is the attacker's domain, not loopback);
+* the card's same-origin fetches carry no Origin and pass on Host alone.
+*/
+function loopbackRequest(req) {
+	return hostIsLoopback(req.headers.host) && originIsLoopback(req.headers.origin);
 }
 /**
 * Assemble the card's status document. Sign-in state is read-only; credit is
@@ -557,27 +572,31 @@ async function workBuddyWebStatus(deps) {
 	}
 	return statusWithModels;
 }
+/** The status route's request handler, extracted so tests can mount it on a bare server. */
+function workBuddyStatusHandler(deps) {
+	return async (req, res) => {
+		if (req.method !== "GET") {
+			json(res, 405, { error: "method not allowed" });
+			return;
+		}
+		if (!loopbackRequest(req)) {
+			json(res, 403, { error: "request-not-trusted" });
+			return;
+		}
+		try {
+			json(res, 200, await workBuddyWebStatus(deps));
+		} catch (error) {
+			json(res, 500, { error: safeMessage(error) });
+		}
+	};
+}
 /** Mount the GET status route on an optional webServer context. */
 function registerWorkBuddyStatusRoute(ctx, deps) {
 	ctx.effect(() => {
 		const dispose = ctx.webServer.register({
 			kind: "exact",
 			path: WORKBUDDY_STATUS_PATH,
-			handler: async (req, res) => {
-				if (req.method !== "GET") {
-					json(res, 405, { error: "method not allowed" });
-					return;
-				}
-				if (!loopbackOrigin(req)) {
-					json(res, 403, { error: "origin-not-trusted" });
-					return;
-				}
-				try {
-					json(res, 200, await workBuddyWebStatus(deps));
-				} catch (error) {
-					json(res, 500, { error: safeMessage(error) });
-				}
-			}
+			handler: workBuddyStatusHandler(deps)
 		});
 		return () => {
 			dispose();

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-workbuddy-connect",
   "displayName": "DSH WorkBuddy Connect",
   "description": "将 WorkBuddy 桌面 App 包含的模型自动接入 DeepSeek Harness — bring WorkBuddy desktop app models into DeepSeek Harness with zero configuration.",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "author": "corrinehu",
   "keywords": [
     "dsh-plugin",
@@ -64,32 +64,32 @@
     }
   },
   "peerDependencies": {
-    "@earendil-works/pi-ai": "^0.84.2",
+    "@earendil-works/pi-ai": "^0.85.1",
     "@deepseek-ai/cordis": "^4.0.2",
-    "@deepseek-ai/dsh-atomic-write": "^0.1.2-rc.1",
-    "@deepseek-ai/dsh-attachment": "^0.1.2-rc.1",
-    "@deepseek-ai/dsh-home-paths": "^0.1.2-rc.1",
-    "@deepseek-ai/dsh-host-webserver": "^0.1.2-rc.1",
-    "@deepseek-ai/dsh-llm": "^0.1.2-rc.1",
-    "@deepseek-ai/dsh-llm-pi-ai": "^0.1.2-rc.1",
-    "@deepseek-ai/dsh-settings": "^0.1.2-rc.1",
+    "@deepseek-ai/dsh-atomic-write": "^0.1.5-rc.1",
+    "@deepseek-ai/dsh-attachment": "^0.1.5-rc.1",
+    "@deepseek-ai/dsh-home-paths": "^0.1.5-rc.1",
+    "@deepseek-ai/dsh-host-webserver": "^0.1.5-rc.1",
+    "@deepseek-ai/dsh-llm": "^0.1.5-rc.1",
+    "@deepseek-ai/dsh-llm-pi-ai": "^0.1.5-rc.1",
+    "@deepseek-ai/dsh-settings": "^0.1.5-rc.1",
     "@deepseek-ai/schemastery": "^3.18.2",
     "react": "^18.2.0"
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "^0.84.2",
+    "@earendil-works/pi-ai": "^0.85.1",
     "@deepseek-ai/cordis": "^4.0.2",
-    "@deepseek-ai/dsh-atomic-write": "^0.1.2-rc.1",
-    "@deepseek-ai/dsh-attachment": "^0.1.2-rc.1",
-    "@deepseek-ai/dsh-client-locale": "^0.1.2-rc.1",
-    "@deepseek-ai/dsh-client-ui-settings-plugins": "^0.1.2-rc.1",
-    "@deepseek-ai/dsh-client-ui-slots": "^0.1.2-rc.1",
-    "@deepseek-ai/dsh-credentials": "^0.1.2-rc.1",
-    "@deepseek-ai/dsh-home-paths": "^0.1.2-rc.1",
-    "@deepseek-ai/dsh-host-webserver": "^0.1.2-rc.1",
-    "@deepseek-ai/dsh-llm": "^0.1.2-rc.1",
-    "@deepseek-ai/dsh-llm-pi-ai": "^0.1.2-rc.1",
-    "@deepseek-ai/dsh-settings": "^0.1.2-rc.1",
+    "@deepseek-ai/dsh-atomic-write": "^0.1.5-rc.1",
+    "@deepseek-ai/dsh-attachment": "^0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-locale": "^0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-settings-plugins": "^0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-slots": "^0.1.5-rc.1",
+    "@deepseek-ai/dsh-credentials": "^0.1.5-rc.1",
+    "@deepseek-ai/dsh-home-paths": "^0.1.5-rc.1",
+    "@deepseek-ai/dsh-host-webserver": "^0.1.5-rc.1",
+    "@deepseek-ai/dsh-llm": "^0.1.5-rc.1",
+    "@deepseek-ai/dsh-llm-pi-ai": "^0.1.5-rc.1",
+    "@deepseek-ai/dsh-settings": "^0.1.5-rc.1",
     "@deepseek-ai/schemastery": "^3.18.2",
     "@types/node": "^22.20.0",
     "@types/react": "~18.3.1",
@@ -97,6 +97,6 @@
     "tsdown": "^0.22.2",
     "typescript": "^5.9.3",
     "vitest": "^4.1.8",
-    "@deepseek-ai/dsh-client-ui-renderer": "^0.1.2-rc.1"
+    "@deepseek-ai/dsh-client-ui-renderer": "^0.1.5-rc.1"
   }
 }