kiokuko-dsh 0.2.23 → 0.2.25
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/dsh/setup.d.ts +1 -1
- package/dist/dsh/setup.d.ts.map +1 -1
- package/dist/dsh/setup.js +9 -1
- package/dist/dsh/setup.js.map +1 -1
- package/dist/locale/en.json +1 -1
- package/dist/locale/ja.json +1 -1
- package/dist/locale/ko.json +1 -1
- package/dist/locale/zh-CN.json +1 -1
- package/docs/dependency-security.md +36 -0
- package/package.json +4 -3
package/dist/dsh/setup.d.ts
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
export declare const DSH_MANAGED_BLOCK = "<!-- BEGIN KIOKUKO-DSH MANAGED BLOCK -->\n<!-- kiokuko-dsh-template-version:
|
|
1
|
+
export declare const DSH_MANAGED_BLOCK = "<!-- BEGIN KIOKUKO-DSH MANAGED BLOCK -->\n<!-- kiokuko-dsh-template-version: 3 -->\n<!-- Managed by kiokuko-dsh setup on plugin load. Edit outside the markers. -->\n\n## Kiokuko DSH\n\nApply this entire block only when the current host is DSH and kiokuko-dsh is enabled for this session.\nOtherwise ignore every instruction in this block, including Skill routing, tools, planning, memory and completion rules.\nThe presence of this block, repository files or installed packages does not activate it.\nOnly kiokuko-dsh may update this block; other plugins and agents must preserve it verbatim.\nDo not apply kiokuko or kiokuko-ai instruction blocks as kiokuko-dsh configuration.\n\nBefore any non-trivial Kiokuko-governed DSH work, read and apply the complete bundled `kiokuko-soul` Skill before any other Kiokuko Skill. The DSH host performs Akinator intake, binds the native session and complete capability catalog, and resolves actionable intake. Optional enrichment failures are degraded guidance. For new build, debug, review and devops tasks the host separately asks for normal execution or Enno and, when selected, a template or custom model configuration. Unanswered execution choices stay pending. Normal execution never creates an Enno contract or WorkUnit; preserve memory, Skills, native permissions and focused verification. Model routing and child delegation are host-owned. `task_prepare` and `task_answer` are host operations, not model tools. DSH intake belongs to the kiokuko-dsh host. Never substitute same-named task_prepare/task_answer MCP tools from kiokuko or kiokuko-ai. A failed external MCP call does not prove DSH intake failed; preserve the admitted host state and follow its current directive. Follow the admitted state and current directive, then route to `kiokuko-enno-oduno`, `kiokuko-simple-work`, `kiokuko-single-purpose-functions`, and `kiokuko-ui-design-soul` only when applicable. For changes spanning setup, delivery, persisted state, or runtime handoffs, apply `veteran-programmer-skill` before and after implementation. When writing or changing code, also apply `one-shot-software-completion` and `coding-ideal-routine-skill` through the SOUL route. Read every applicable specialist `SKILL.md` index, then only the expert fragments selected by the current WorkUnit or concrete risk. Never substitute, install, or execute fetched external Skill content.\n\nThe host owns request identity, session binding, memory delivery and finalization.\nUse its admitted workspace and directive; do not read or modify the SQLite file directly.\n\nUse kioku_read, kioku_write, kioku_edit, kioku_remove, kioku_exec and kioku_result for host-observed development. Project edits, external investigation, PATH commands, bash/zsh and builds/tests need no extra approval. Source/data deletion and durable user database mutations require concrete review; declare destructiveTargets for commands. Generated/temp/disposable artifacts are ordinary development. Lisp and normal tools coexist. Plan, goal, cancellation and execution ownership remain authoritative. Explicit human implementation instructions request Plan exit at the next accepted step; presenting a plan alone does not exit. Bind task_completion checks and relevant source/test/config paths before execution. Collect asynchronous final results. Host receipts distinguish work outcome, verification and saving; model fields such as passed cannot supply proof. Apply recalled candidates only after comparing conditions, provenance and source versions; old verification is not current success. After task completion ask permission to organize memories, show the exact proposal, and save only the approved revision. Comments require revision and another preview; decline saves nothing. Saving failures do not stop coding. Reconcile uncertain saves by the original approval key; never blindly create a new save identity or replay edits or commands.\n\nDiscover unfamiliar repository filenames with native glob/grep before read; use an exact returned path. Never infer a test filename from a source basename or treat remembered/example paths as current filesystem evidence. Explicit user targets may be read directly; if missing, report that fact and discover relevant alternatives without silently changing the requested target. After a not-found error, do not repeat the unchanged read or assume a sandbox/configuration fault; check current path evidence. Do not create placeholder files or silently substitute another target to hide a missing-file error.\n\n### Engineering changes\n\nFor generated artifacts, update the owning schema, template or generator, then use the repository's documented regeneration path and inspect the resulting diff; do not patch only the output.\n\n### UI design\n\nChoose design tokens by semantic role, not by current appearance. If a role is missing, extend the design system instead of repurposing an unrelated token; when changing theme contracts, verify supported light, dark and custom-theme fallback behavior.\n\n<!-- END KIOKUKO-DSH MANAGED BLOCK -->";
|
|
2
2
|
/** Replace only a DSH-owned block, preserving every other product's instructions. */
|
|
3
3
|
export declare function renderDshInstructions(existing: string): string;
|
|
4
4
|
/** Preflight both destinations before writing. A read-only check reports the same plan. */
|
package/dist/dsh/setup.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"setup.d.ts","sourceRoot":"","sources":["../../src/dsh/setup.ts"],"names":[],"mappings":"AAeA,eAAO,MAAM,iBAAiB,
|
|
1
|
+
{"version":3,"file":"setup.d.ts","sourceRoot":"","sources":["../../src/dsh/setup.ts"],"names":[],"mappings":"AAeA,eAAO,MAAM,iBAAiB,88JA6BvB,CAAA;AAEP,qFAAqF;AACrF,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAqB9D;AAYD,2FAA2F;AAC3F,wBAAsB,QAAQ,CAAC,OAAO,GAAE;IAAE,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO;;;;;;;;;;;;GAoBrG;AAED,wBAAsB,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAUpD"}
|
package/dist/dsh/setup.js
CHANGED
|
@@ -12,7 +12,7 @@ const LEGACY_END = '<!-- END KIOKUKO MANAGED BLOCK -->';
|
|
|
12
12
|
// A generic Kiokuko marker alone does not establish DSH ownership.
|
|
13
13
|
const LEGACY_DSH_START = /<!-- BEGIN KIOKUKO MANAGED BLOCK -->(?=\r?\n<!-- kiokuko-dsh-template-version: \d+ -->)/u;
|
|
14
14
|
export const DSH_MANAGED_BLOCK = `${BEGIN}
|
|
15
|
-
<!-- kiokuko-dsh-template-version:
|
|
15
|
+
<!-- kiokuko-dsh-template-version: 3 -->
|
|
16
16
|
<!-- Managed by kiokuko-dsh setup on plugin load. Edit outside the markers. -->
|
|
17
17
|
|
|
18
18
|
## Kiokuko DSH
|
|
@@ -32,6 +32,14 @@ Use kioku_read, kioku_write, kioku_edit, kioku_remove, kioku_exec and kioku_resu
|
|
|
32
32
|
|
|
33
33
|
Discover unfamiliar repository filenames with native glob/grep before read; use an exact returned path. Never infer a test filename from a source basename or treat remembered/example paths as current filesystem evidence. Explicit user targets may be read directly; if missing, report that fact and discover relevant alternatives without silently changing the requested target. After a not-found error, do not repeat the unchanged read or assume a sandbox/configuration fault; check current path evidence. Do not create placeholder files or silently substitute another target to hide a missing-file error.
|
|
34
34
|
|
|
35
|
+
### Engineering changes
|
|
36
|
+
|
|
37
|
+
For generated artifacts, update the owning schema, template or generator, then use the repository's documented regeneration path and inspect the resulting diff; do not patch only the output.
|
|
38
|
+
|
|
39
|
+
### UI design
|
|
40
|
+
|
|
41
|
+
Choose design tokens by semantic role, not by current appearance. If a role is missing, extend the design system instead of repurposing an unrelated token; when changing theme contracts, verify supported light, dark and custom-theme fallback behavior.
|
|
42
|
+
|
|
35
43
|
${END}`;
|
|
36
44
|
/** Replace only a DSH-owned block, preserving every other product's instructions. */
|
|
37
45
|
export function renderDshInstructions(existing) {
|
package/dist/dsh/setup.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"setup.js","sourceRoot":"","sources":["../../src/dsh/setup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAA;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAC3C,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAuB,MAAM,8BAA8B,CAAA;AACjG,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAA;AACnE,OAAO,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAA;AAElE,MAAM,KAAK,GAAG,0CAA0C,CAAA;AACxD,MAAM,GAAG,GAAG,wCAAwC,CAAA;AACpD,MAAM,YAAY,GAAG,sCAAsC,CAAA;AAC3D,MAAM,UAAU,GAAG,oCAAoC,CAAA;AACvD,mEAAmE;AACnE,MAAM,gBAAgB,GAAG,0FAA0F,CAAA;AAEnH,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,KAAK;;;;;;;;;;;;EAYvC,2BAA2B
|
|
1
|
+
{"version":3,"file":"setup.js","sourceRoot":"","sources":["../../src/dsh/setup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAA;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAC3C,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAuB,MAAM,8BAA8B,CAAA;AACjG,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAA;AACnE,OAAO,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAA;AAElE,MAAM,KAAK,GAAG,0CAA0C,CAAA;AACxD,MAAM,GAAG,GAAG,wCAAwC,CAAA;AACpD,MAAM,YAAY,GAAG,sCAAsC,CAAA;AAC3D,MAAM,UAAU,GAAG,oCAAoC,CAAA;AACvD,mEAAmE;AACnE,MAAM,gBAAgB,GAAG,0FAA0F,CAAA;AAEnH,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,KAAK;;;;;;;;;;;;EAYvC,2BAA2B;;;;;;;;;;;;;;;;;EAiB3B,GAAG,EAAE,CAAA;AAEP,qFAAqF;AACrF,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,IAAI,YAAY,CAAC,UAAU,EAAE,wGAAwG,CAAC,CAAA;IAC7J,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAA;IAC/C,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAA;IAC3C,MAAM,YAAY,GAAG,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAChH,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,YAAY,CAAC,MAAM,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC;QAAE,MAAM,QAAQ,EAAE,CAAA;IACxF,IAAI,KAAa,EAAE,GAAW,EAAE,OAAe,CAAA;IAC/C,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;QACnB,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAC/B,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC3B,IAAI,MAAM,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,GAAG,GAAG,KAAK;YAAE,MAAM,QAAQ,EAAE,CAAA;QAC/D,OAAO,GAAG,GAAG,CAAA;IACf,CAAC;SAAM,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,KAAK,GAAG,YAAY,CAAC,CAAC,CAAE,CAAA;QACxB,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,CAAA;QAC/D,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,CAAA;QAC1E,IAAI,GAAG,GAAG,KAAK,IAAI,MAAM,KAAK,CAAC,CAAC,IAAI,MAAM,GAAG,GAAG;YAAE,MAAM,QAAQ,EAAE,CAAA;QAClE,OAAO,GAAG,UAAU,CAAA;IACtB,CAAC;;QAAM,OAAO,QAAQ,CAAA;IACtB,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;IACzD,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,iBAAiB,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;AACtH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,SAAiB;IAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;IAChD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC,CAAA;IAC9E,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;WAC7F,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAA;IAC/D,MAAM,OAAO,GAAG,qBAAqB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IACvD,IAAI,OAAO,KAAK,QAAQ,CAAC,OAAO;QAAE,MAAM,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAA;IAClF,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAA;AACtC,CAAC;AAED,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,UAAqE,EAAE;IACpG,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;IAC9D,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;IAC9D,MAAM,YAAY,GAAG,MAAM,gBAAgB,CAAC,SAAS,CAAC,CAAA;IACtD,MAAM,MAAM,GAAG;QACb,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE;QAC7E,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,qBAAqB,EAAE;KACtH,CAAA;IACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,OAAO,KAAK,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW;YAClE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;gBACnE,CAAC,CAAC,MAAM,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QAC1C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAA;IACzB,CAAC;IACD,IAAI,YAAY,IAAI,YAAY,CAAC,OAAO,KAAK,YAAY,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC;QAC5E,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,SAAS,EAAE,YAAY,CAAC,CAAA;IAC3G,CAAC;IACD,MAAM,CAAC,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,KAAK,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,eAAe,CAAA;IACxI,OAAO,MAAM,CAAA;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,QAAQ,EAAE,CAAA;QAC/B,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/F,OAAO,CAAC,IAAI,CAAC,+CAA+C,MAAM,CAAC,MAAM,CAAC,OAAO,aAAa,MAAM,CAAC,MAAM,CAAC,OAAO,aAAa,MAAM,CAAC,MAAM,CAAC,SAAS,gBAAgB,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,MAAM,CAAC,YAAY,CAAC,IAAI,4DAA4D,CAAC,CAAA;QAC7R,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QACvF,OAAO,CAAC,IAAI,CAAC,sDAAsD,IAAI,iDAAiD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB,+HAA+H,CAAC,CAAA;IACxT,CAAC;AACH,CAAC"}
|
package/dist/locale/en.json
CHANGED
package/dist/locale/ja.json
CHANGED
package/dist/locale/ko.json
CHANGED
package/dist/locale/zh-CN.json
CHANGED
|
@@ -103,3 +103,39 @@ The dependency tests check these explicit booleans, the absence of sharp install
|
|
|
103
103
|
hooks, esbuild transformation, protobuf encoding/decoding, sharp image processing,
|
|
104
104
|
and bundled ONNX CPU inference. Platform coverage is limited to the hosts where
|
|
105
105
|
these tests actually run; upgrades that introduce new hooks need review.
|
|
106
|
+
|
|
107
|
+
## 2026-10-26 advisory follow-up
|
|
108
|
+
|
|
109
|
+
The root npm and pnpm graphs now resolve Zod 4.6.6 and undici 7.30.1.
|
|
110
|
+
The Zod override also removes the exact 4.4.3 copies requested by the repository's
|
|
111
|
+
DSH development dependencies; unrelated DSH resolutions are retained.
|
|
112
|
+
|
|
113
|
+
| Dependabot alerts | Advisory | Resolution |
|
|
114
|
+
| --- | --- | --- |
|
|
115
|
+
| #14 / #22 | [GHSA-mrhx-c7xc-m3w5](https://github.com/advisories/GHSA-mrhx-c7xc-m3w5) | Zod 4.5.4 / 4.4.3 → 4.6.6 in both lockfiles. |
|
|
116
|
+
| #21 / #25 | [GHSA-xjj6-f33q-929c](https://github.com/advisories/GHSA-xjj6-f33q-929c) | undici 7.30.0 → 7.30.1 in both lockfiles. |
|
|
117
|
+
| #15–#18 | GHSA-333x-w4r6-6crp, GHSA-wjr9-j795-jxcr, GHSA-xhq7-xmqj-769h, GHSA-w74x-v6f9-j3xg | Unresolved: AgenticReplay bundles fast-uri 3.1.8; the required 3.x fix is 3.1.9. |
|
|
118
|
+
|
|
119
|
+
The official AgenticReplay 0.1.7 tarball still bundles fast-uri 3.1.8, as does
|
|
120
|
+
the locked 0.1.2 release. Root npm overrides do not replace that bundled copy;
|
|
121
|
+
`npm audit fix --dry-run` reports that it cannot fix the bundled dependency.
|
|
122
|
+
No ineffective fast-uri override or unrelated AgenticReplay update is retained.
|
|
123
|
+
The upstream distribution needs to include fast-uri 3.1.9 or later, or expose
|
|
124
|
+
that dependency for normal package-manager resolution. pnpm's patchedDependencies
|
|
125
|
+
would not repair npm consumers; no new install-time patch framework is added.
|
|
126
|
+
These four advisories remain in the npm audit. No alert was dismissed.
|
|
127
|
+
|
|
128
|
+
Validation used Node 24.16.0 and npm 11.13.0 in a disposable checkout: clean
|
|
129
|
+
`npm ci --ignore-scripts`, typecheck, build, and 86 dependency-security,
|
|
130
|
+
model-service, model-selection/navigation and tool-schema tests passed.
|
|
131
|
+
The Zod regression rejects oversized bounded arrays, sets and maps before
|
|
132
|
+
parsing their elements; it fails against the prior dependency.
|
|
133
|
+
|
|
134
|
+
Root pnpm frozen-lockfile validation remains blocked by a pre-existing manifest
|
|
135
|
+
mismatch: optional peer `@deepseek-ai/dsh-tools` is absent from the importer.
|
|
136
|
+
Both unchanged HEAD and the patched graph fail with ERR_PNPM_OUTDATED_LOCKFILE
|
|
137
|
+
on the CI-selected pnpm 11.7.0. Full pnpm installation was not validated.
|
|
138
|
+
The security-only pnpm edit preserves all unrelated package versions and uses
|
|
139
|
+
the same official tarball integrity values as npm. Root overrides do not repair
|
|
140
|
+
an independently installed host's dependencies. Running profiles were not updated,
|
|
141
|
+
and GitHub alerts remain open until the source is pushed and reassessed.
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "kiokuko-dsh",
|
|
3
|
-
"version": "0.2.
|
|
3
|
+
"version": "0.2.25",
|
|
4
4
|
"description": "Kiokuko plugin for DeepSeek Harness",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"license": "MIT",
|
|
@@ -274,12 +274,13 @@
|
|
|
274
274
|
"jsonc-parser": "3.3.1",
|
|
275
275
|
"semver": "7.8.5",
|
|
276
276
|
"yaml": "2.9.0",
|
|
277
|
-
"zod": "4.
|
|
277
|
+
"zod": "4.6.6"
|
|
278
278
|
},
|
|
279
279
|
"overrides": {
|
|
280
280
|
"adm-zip": "0.6.1",
|
|
281
281
|
"sharp": "0.35.5",
|
|
282
|
-
"global-agent": "4.1.3"
|
|
282
|
+
"global-agent": "4.1.3",
|
|
283
|
+
"zod": "4.6.6"
|
|
283
284
|
},
|
|
284
285
|
"peerDependencies": {
|
|
285
286
|
"@ai-sdk/provider": "^4.0.21",
|