kevchess15/deepseek-harness
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1
deepseek-harness/packages/bundle/web-app/package.json

112 lines
4.4 KiB
JSON
Raw Normal View History

feat(bundle): ship dsh-base, dsh-web-app, and dsh-headless profile bundles Profile bundles are npm packages declaring dsh.patch in their manifest: dsh-base carries the former base.cordis.yml rows as one insert over the empty profile root; dsh-web-app carries the web overlay plus a runtime glue plugin owning what used to be launcher code (frontend dist resolution via frontend-static, the web-surface prompt section, bash runtime variables, the readiness-gated URL line); dsh-headless carries the one-shot runner driving a task turn through the in-process API carrier under the launcher-provided ctx.headlessIo seam.
2026-08-06 04:40:11 +08:00
{
"name": "@deepseek-ai/dsh-web-app",
"description": "The dsh browser-surface bundle: the web patch layer over dsh-base plus the runtime glue plugin (frontend dist serving, web-surface prompt, bash runtime variables, URL line)",
release(dsh): 0.0.1-rc.1
2026-08-11 03:04:47 +08:00
"version": "0.0.1-rc.1",
build(release): make the release set publishable under the private scope Every package under packages/, apps/, and vendor/ drops "private": true and declares publishConfig.access "restricted": the repository now states which packages it publishes instead of deciding it at publish time. Each one also declares its repository and directory, which is how a consumer of a private package reaches its source. The Landlock packages move to restricted with them. They have never been published, so nothing anonymous depends on them today, and the whole @deepseek-ai scope stays private. The workspace constraint that required every package to be private now applies to non-members only, and asserts the publishable trio on each release member.
2026-08-11 00:02:53 +08:00
"publishConfig": {
"access": "restricted"
},
"repository": {
"type": "git",
"url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
"directory": "packages/bundle/web-app"
},
feat(bundle): ship dsh-base, dsh-web-app, and dsh-headless profile bundles Profile bundles are npm packages declaring dsh.patch in their manifest: dsh-base carries the former base.cordis.yml rows as one insert over the empty profile root; dsh-web-app carries the web overlay plus a runtime glue plugin owning what used to be launcher code (frontend dist resolution via frontend-static, the web-surface prompt section, bash runtime variables, the readiness-gated URL line); dsh-headless carries the one-shot runner driving a task turn through the in-process API carrier under the launcher-provided ctx.headlessIo seam.
2026-08-06 04:40:11 +08:00
"type": "module",
"main": "lib/index.js",
"types": "lib/types/index.d.ts",
"exports": {
".": {
"types": "./lib/types/index.d.ts",
"default": "./lib/index.js"
},
feat(bundle): the web and one-shot apps own their own flags dsh-web-app owns --host/--port/--dev/--workspace-root/--trusted-host and its --help in a web-startup row; the rows it configures wait for the webStartup service, and the client-plugin HMR receiver now ships disabled so --dev is a row toggle rather than a runtime insert (the Loader cannot resolve a row inserted from inside a mounting plugin). dsh-headless owns the task positional and rejects a missing task as its own usage error. Its runner ships disabled, not merely waiting: the schema requires the task, and a row's config is validated when its fiber is created, before the startup row can supply one. A composition has exactly one command-line owner, so the patch disables the web startup row and this one provides webStartup too, leaving the web rows on their composed one-shot values. The keyless web scaffold provides the same three values with no arguments, which is what an embedding host with no command line does.
2026-08-06 20:52:26 +08:00
"./startup": {
"types": "./lib/types/startup.d.ts",
"default": "./lib/startup.js"
},
feat(bundle): ship dsh-base, dsh-web-app, and dsh-headless profile bundles Profile bundles are npm packages declaring dsh.patch in their manifest: dsh-base carries the former base.cordis.yml rows as one insert over the empty profile root; dsh-web-app carries the web overlay plus a runtime glue plugin owning what used to be launcher code (frontend dist resolution via frontend-static, the web-surface prompt section, bash runtime variables, the readiness-gated URL line); dsh-headless carries the one-shot runner driving a task turn through the in-process API carrier under the launcher-provided ctx.headlessIo seam.
2026-08-06 04:40:11 +08:00
"./invariant": {
"types": "./lib/types/invariant.d.ts",
"default": "./lib/invariant.js"
},
"./cordis.patch.yml": "./cordis.patch.yml",
"./src/*": "./src/*",
"./package.json": "./package.json"
},
"files": [
"lib/index.js",
"lib/invariant.js",
feat(bundle): the web and one-shot apps own their own flags dsh-web-app owns --host/--port/--dev/--workspace-root/--trusted-host and its --help in a web-startup row; the rows it configures wait for the webStartup service, and the client-plugin HMR receiver now ships disabled so --dev is a row toggle rather than a runtime insert (the Loader cannot resolve a row inserted from inside a mounting plugin). dsh-headless owns the task positional and rejects a missing task as its own usage error. Its runner ships disabled, not merely waiting: the schema requires the task, and a row's config is validated when its fiber is created, before the startup row can supply one. A composition has exactly one command-line owner, so the patch disables the web startup row and this one provides webStartup too, leaving the web rows on their composed one-shot values. The keyless web scaffold provides the same three values with no arguments, which is what an embedding host with no command line does.
2026-08-06 20:52:26 +08:00
"lib/startup.js",
feat(bundle): ship dsh-base, dsh-web-app, and dsh-headless profile bundles Profile bundles are npm packages declaring dsh.patch in their manifest: dsh-base carries the former base.cordis.yml rows as one insert over the empty profile root; dsh-web-app carries the web overlay plus a runtime glue plugin owning what used to be launcher code (frontend dist resolution via frontend-static, the web-surface prompt section, bash runtime variables, the readiness-gated URL line); dsh-headless carries the one-shot runner driving a task turn through the in-process API carrier under the launcher-provided ctx.headlessIo seam.
2026-08-06 04:40:11 +08:00
"cordis.patch.yml",
"lib/types/**/*.d.ts"
],
"license": "BSD-3-Clause",
"dsh": {
refactor(cli)!: namespace the profile and bundle manifests under dsh.profile and dsh.bundle A profile manifest and a bundle manifest are different kinds and shared one flat `dsh` section: `dsh.plugins` listed bundles (not plugins) and `dsh.patch` declared a bundle's layer. Each kind now names its role — a bundle declares `dsh.bundle.patch`, a profile declares `dsh.profile.bundles` — so a package.json states which role it plays and the list name matches its contents. `DEFAULT_PROFILE_PLUGINS` becomes `DEFAULT_PROFILE_BUNDLES`, and `DshManifestSection` splits into `DshBundleManifest`/`DshProfileManifest`. Pre-release: no compatibility shim; turtle-ui moved with it (bd5ff10).
2026-08-06 17:28:30 +08:00
"bundle": {
"patch": "./cordis.patch.yml"
}
feat(bundle): ship dsh-base, dsh-web-app, and dsh-headless profile bundles Profile bundles are npm packages declaring dsh.patch in their manifest: dsh-base carries the former base.cordis.yml rows as one insert over the empty profile root; dsh-web-app carries the web overlay plus a runtime glue plugin owning what used to be launcher code (frontend dist resolution via frontend-static, the web-surface prompt section, bash runtime variables, the readiness-gated URL line); dsh-headless carries the one-shot runner driving a task turn through the in-process API carrier under the launcher-provided ctx.headlessIo seam.
2026-08-06 04:40:11 +08:00
},
"dependencies": {
fix(web): correct the preset-layer contracts review found stale None of these change behavior; each said something that was not true. `SessionCwdConflict`'s doc block had been left stranded above the `AgentPresetConflict` inserted under it, so one class carried a comment about the other and the second carried none. The roster comment named a `.system` directory that does not exist; the shipped root is `config/agent-presets/`, and `system` is the trust its entries carry. The real-composition test attributed the disabled `api-gateway` row to "side effects outside this process" alongside the port and the exporter. It is disabled for a different reason — the api-proxy cannot mount in this layer at all — and hiding that behind the same phrase would leave a later layer unable to tell whether the line can come out. One test claimed to refuse an adoption while asserting only that the header records the preset; it now says what it checks. `PERSONA_SECTION`/`PERSONA_ORDER` existed twice, once in the registry that declares the slot and once restated in the row that replaces it — a drift that would land a preset's persona beside the deployment's instead of shadowing it. The registry exports them now. The preset conflict message read "already runs agent preset undefined" for a session that records none, which is the shape a deployment with no roster produces; it names that case instead, with the regression that reaches it through the gateway. Finally, `PresetTree.write()` drops the `loader/config-update` the inherited method emits — recorded on the override, since a future edit-while-running flow needs its own persistence path.
2026-08-06 13:43:32 +08:00
"@deepseek-ai/dsh-agent-presets": "workspace:^",
feat(client): configure host-plane plugins from a settings section The section knows no namespace: it declares `settings.plugin.item` and renders whatever cards were registered into it, so a plugin that ships a browser half owns its card and its controls. The three cards here cover the host-plane sections this deployment exposes. A field shows its effective value and, when the raw user layer carries it, an override badge and a reset that clears it back to the composition layer. Controls commit on blur and Enter rather than per keystroke, which would burn namespace revisions and race its own reads. The search key is the one value that never rides a response: the card reports only whether one is configured and writes it through the credentials domain, addressed by the reference the section names. A card renders nothing while its namespace is unavailable — a deployment that does not compose the owning plugin should show no trace of it rather than a disabled card the user cannot act on.
2026-08-10 19:14:59 +08:00
"@deepseek-ai/dsh-api-remotes": "workspace:^",
refactor(cli)!: complete app-owned profile startup
2026-08-09 18:23:25 +08:00
"@deepseek-ai/dsh-app-boot": "workspace:^",
feat(bundle): ship dsh-base, dsh-web-app, and dsh-headless profile bundles Profile bundles are npm packages declaring dsh.patch in their manifest: dsh-base carries the former base.cordis.yml rows as one insert over the empty profile root; dsh-web-app carries the web overlay plus a runtime glue plugin owning what used to be launcher code (frontend dist resolution via frontend-static, the web-surface prompt section, bash runtime variables, the readiness-gated URL line); dsh-headless carries the one-shot runner driving a task turn through the in-process API carrier under the launcher-provided ctx.headlessIo seam.
2026-08-06 04:40:11 +08:00
"@deepseek-ai/dsh-client-connection": "workspace:^",
"@deepseek-ai/dsh-client-hmr": "workspace:^",
"@deepseek-ai/dsh-client-locale": "workspace:^",
"@deepseek-ai/dsh-client-modules": "workspace:^",
"@deepseek-ai/dsh-client-runtime": "workspace:^",
fix(scripts): point the plane-separation gate at the bundle patches The shipped host composition moved: `base.cordis.yml` and `web.cordis.yml` are the dsh-base and dsh-web-app patch layers now. The gate still opened the old paths and crashed on ENOENT — a gate that cannot read its inputs proves nothing, loudly or otherwise. Retargeting it also surfaced what the move implies for ownership: the web bundle carries the roster and its browser plugin rows now, so the bundle's own manifest is what must declare them. The gate's existing bare-plugin check said so as soon as it could parse the file again.
2026-08-06 21:23:30 +08:00
"@deepseek-ai/dsh-client-ui-agent-preset": "workspace:^",
feat(bundle): ship dsh-base, dsh-web-app, and dsh-headless profile bundles Profile bundles are npm packages declaring dsh.patch in their manifest: dsh-base carries the former base.cordis.yml rows as one insert over the empty profile root; dsh-web-app carries the web overlay plus a runtime glue plugin owning what used to be launcher code (frontend dist resolution via frontend-static, the web-surface prompt section, bash runtime variables, the readiness-gated URL line); dsh-headless carries the one-shot runner driving a task turn through the in-process API carrier under the launcher-provided ctx.headlessIo seam.
2026-08-06 04:40:11 +08:00
"@deepseek-ai/dsh-client-ui-command": "workspace:^",
"@deepseek-ai/dsh-client-ui-conversation": "workspace:^",
Merge remote-tracking branch 'upstream/master' into feat/web-workspace-file-links # Conflicts: # apps/cli/package.json # pnpm-lock.yaml
2026-08-06 06:24:53 -07:00
"@deepseek-ai/dsh-client-ui-deliverables": "workspace:^",
feat(bundle): ship dsh-base, dsh-web-app, and dsh-headless profile bundles Profile bundles are npm packages declaring dsh.patch in their manifest: dsh-base carries the former base.cordis.yml rows as one insert over the empty profile root; dsh-web-app carries the web overlay plus a runtime glue plugin owning what used to be launcher code (frontend dist resolution via frontend-static, the web-surface prompt section, bash runtime variables, the readiness-gated URL line); dsh-headless carries the one-shot runner driving a task turn through the in-process API carrier under the launcher-provided ctx.headlessIo seam.
2026-08-06 04:40:11 +08:00
"@deepseek-ai/dsh-client-ui-goal": "workspace:^",
"@deepseek-ai/dsh-client-ui-layout": "workspace:^",
"@deepseek-ai/dsh-client-ui-model": "workspace:^",
"@deepseek-ai/dsh-client-ui-models": "workspace:^",
"@deepseek-ai/dsh-client-ui-permission": "workspace:^",
"@deepseek-ai/dsh-client-ui-plan": "workspace:^",
feat(client): configure host-plane plugins from a settings section The section knows no namespace: it declares `settings.plugin.item` and renders whatever cards were registered into it, so a plugin that ships a browser half owns its card and its controls. The three cards here cover the host-plane sections this deployment exposes. A field shows its effective value and, when the raw user layer carries it, an override badge and a reset that clears it back to the composition layer. Controls commit on blur and Enter rather than per keystroke, which would burn namespace revisions and race its own reads. The search key is the one value that never rides a response: the card reports only whether one is configured and writes it through the credentials domain, addressed by the reference the section names. A card renders nothing while its namespace is unavailable — a deployment that does not compose the owning plugin should show no trace of it rather than a disabled card the user cannot act on.
2026-08-10 19:14:59 +08:00
"@deepseek-ai/dsh-client-ui-plugin-config": "workspace:^",
feat(bundle): ship dsh-base, dsh-web-app, and dsh-headless profile bundles Profile bundles are npm packages declaring dsh.patch in their manifest: dsh-base carries the former base.cordis.yml rows as one insert over the empty profile root; dsh-web-app carries the web overlay plus a runtime glue plugin owning what used to be launcher code (frontend dist resolution via frontend-static, the web-surface prompt section, bash runtime variables, the readiness-gated URL line); dsh-headless carries the one-shot runner driving a task turn through the in-process API carrier under the launcher-provided ctx.headlessIo seam.
2026-08-06 04:40:11 +08:00
"@deepseek-ai/dsh-client-ui-question": "workspace:^",
"@deepseek-ai/dsh-client-ui-settings": "workspace:^",
"@deepseek-ai/dsh-client-ui-settings-general": "workspace:^",
"@deepseek-ai/dsh-client-ui-sidebar": "workspace:^",
"@deepseek-ai/dsh-client-ui-skill": "workspace:^",
"@deepseek-ai/dsh-client-ui-slash": "workspace:^",
"@deepseek-ai/dsh-client-ui-subagent": "workspace:^",
feat(web): list background tasks in the session header The task registry has run every background bash, pwsh, pty-send, and one-shot subagent since it landed, but only the model could read it: a human at the Web client could not see that a build was running, tell a finished task from a stuck one, or find its outcome anywhere but the `run_in_background` tool card that printed an id and never updated. Task state now reaches the browser as one whole-snapshot `session/tasks` mux frame per session, pushed at every registry commit that changes what that session can see. `TaskService` gains `onTasksChanged`, which is owner-granular because owner-disposal removal is a change no per-task record can express. The carrier reads the exact owner the listener hands it, so a push stays correct while that scope tears down, and reads the baseline through the non-resuming `ctx.agents.get` so listing never revives a cold session. The client keeps a last-wins mirror on `SessionListState`, and a new `dsh-client-ui-task` package renders it beside the subagent catalog — rendering nothing at all until the session has a task, so an ordinary conversation grows no new chrome. Streamed per-task output and human-initiated cancellation are separate phases; the note records why neither has to undo this channel, and why no Web path may call the consuming `ctx.tasks.read()`.
2026-08-08 23:29:41 +08:00
"@deepseek-ai/dsh-client-ui-task": "workspace:^",
feat(bundle): ship dsh-base, dsh-web-app, and dsh-headless profile bundles Profile bundles are npm packages declaring dsh.patch in their manifest: dsh-base carries the former base.cordis.yml rows as one insert over the empty profile root; dsh-web-app carries the web overlay plus a runtime glue plugin owning what used to be launcher code (frontend dist resolution via frontend-static, the web-surface prompt section, bash runtime variables, the readiness-gated URL line); dsh-headless carries the one-shot runner driving a task turn through the in-process API carrier under the launcher-provided ctx.headlessIo seam.
2026-08-06 04:40:11 +08:00
"@deepseek-ai/dsh-client-ui-theme": "workspace:^",
cleanup(client): extract Tool presentation into ui-tool
2026-08-08 15:18:52 +08:00
"@deepseek-ai/dsh-client-ui-tool": "workspace:^",
feat(workflow): show durable run records in Chat
2026-08-10 18:37:30 +08:00
"@deepseek-ai/dsh-client-ui-workflow-run": "workspace:^",
feat(bundle): ship dsh-base, dsh-web-app, and dsh-headless profile bundles Profile bundles are npm packages declaring dsh.patch in their manifest: dsh-base carries the former base.cordis.yml rows as one insert over the empty profile root; dsh-web-app carries the web overlay plus a runtime glue plugin owning what used to be launcher code (frontend dist resolution via frontend-static, the web-surface prompt section, bash runtime variables, the readiness-gated URL line); dsh-headless carries the one-shot runner driving a task turn through the in-process API carrier under the launcher-provided ctx.headlessIo seam.
2026-08-06 04:40:11 +08:00
"@deepseek-ai/dsh-client-ui-trajectory": "workspace:^",
"@deepseek-ai/dsh-client-ui-workspace": "workspace:^",
feat(bundle): the web and one-shot apps own their own flags dsh-web-app owns --host/--port/--dev/--workspace-root/--trusted-host and its --help in a web-startup row; the rows it configures wait for the webStartup service, and the client-plugin HMR receiver now ships disabled so --dev is a row toggle rather than a runtime insert (the Loader cannot resolve a row inserted from inside a mounting plugin). dsh-headless owns the task positional and rejects a missing task as its own usage error. Its runner ships disabled, not merely waiting: the schema requires the task, and a row's config is validated when its fiber is created, before the startup row can supply one. A composition has exactly one command-line owner, so the patch disables the web startup row and this one provides webStartup too, leaving the web rows on their composed one-shot values. The keyless web scaffold provides the same three values with no arguments, which is what an embedding host with no command line does.
2026-08-06 20:52:26 +08:00
"@deepseek-ai/dsh-cmdline": "workspace:^",
feat(bundle): ship dsh-base, dsh-web-app, and dsh-headless profile bundles Profile bundles are npm packages declaring dsh.patch in their manifest: dsh-base carries the former base.cordis.yml rows as one insert over the empty profile root; dsh-web-app carries the web overlay plus a runtime glue plugin owning what used to be launcher code (frontend dist resolution via frontend-static, the web-surface prompt section, bash runtime variables, the readiness-gated URL line); dsh-headless carries the one-shot runner driving a task turn through the in-process API carrier under the launcher-provided ctx.headlessIo seam.
2026-08-06 04:40:11 +08:00
"@deepseek-ai/dsh-code-runtime-worker": "workspace:^",
"@deepseek-ai/dsh-frontend": "workspace:^",
"@deepseek-ai/dsh-frontend-static": "workspace:^",
"@deepseek-ai/dsh-host-apiproxy": "workspace:^",
"@deepseek-ai/dsh-host-directory-picker-auto": "workspace:^",
"@deepseek-ai/dsh-host-directory-picker-browse": "workspace:^",
"@deepseek-ai/dsh-host-directory-picker-native": "workspace:^",
"@deepseek-ai/dsh-host-webserver": "workspace:^",
feat(feedback): add durable message feedback backend
2026-08-10 11:28:38 -07:00
"@deepseek-ai/dsh-message-feedback": "workspace:^",
feat(bundle): ship dsh-base, dsh-web-app, and dsh-headless profile bundles Profile bundles are npm packages declaring dsh.patch in their manifest: dsh-base carries the former base.cordis.yml rows as one insert over the empty profile root; dsh-web-app carries the web overlay plus a runtime glue plugin owning what used to be launcher code (frontend dist resolution via frontend-static, the web-surface prompt section, bash runtime variables, the readiness-gated URL line); dsh-headless carries the one-shot runner driving a task turn through the in-process API carrier under the launcher-provided ctx.headlessIo seam.
2026-08-06 04:40:11 +08:00
"@deepseek-ai/dsh-session-projection-cache": "workspace:^",
"@deepseek-ai/dsh-storage": "workspace:^",
"@deepseek-ai/dsh-storage-domain": "workspace:^",
"@deepseek-ai/dsh-storage-json": "workspace:^",
"@deepseek-ai/dsh-workspace": "workspace:^",
build(release): reference workspace members through the workspace protocol 1504 hand-written ranges pointing at workspace members become workspace:^, so pnpm pack substitutes each member's real version at publication: sibling peerDependencies follow the family version instead of being pinned at ^0.0.1, and a reference to a vendored package follows that package's own line. Without this, publishing 0.0.2 ships peer ranges naming a version that does not exist, and 0.0.1-rc.1 does not satisfy ^0.0.1 either. It also retires ranges that had gone stale against the workspace: ^4.0.0-rc.6 for a 4.0.0-rc.7 checkout, ^3.17.0 for schemastery 3.18.0. workspace:* stays where an exact published version is the point, which is how the Landlock entry pins its platform packages. A workspace constraint now requires the protocol, so a new package cannot reintroduce a hand-written range. The same constraint caught packages/boot/cmdline arriving on master without the publishable trio, which this change completes.
2026-08-11 00:16:45 +08:00
"@deepseek-ai/schemastery": "workspace:^",
feat(bundle): the web and one-shot apps own their own flags dsh-web-app owns --host/--port/--dev/--workspace-root/--trusted-host and its --help in a web-startup row; the rows it configures wait for the webStartup service, and the client-plugin HMR receiver now ships disabled so --dev is a row toggle rather than a runtime insert (the Loader cannot resolve a row inserted from inside a mounting plugin). dsh-headless owns the task positional and rejects a missing task as its own usage error. Its runner ships disabled, not merely waiting: the schema requires the task, and a row's config is validated when its fiber is created, before the startup row can supply one. A composition has exactly one command-line owner, so the patch disables the web startup row and this one provides webStartup too, leaving the web rows on their composed one-shot values. The keyless web scaffold provides the same three values with no arguments, which is what an embedding host with no command line does.
2026-08-06 20:52:26 +08:00
"commander": "^15.0.0"
feat(bundle): ship dsh-base, dsh-web-app, and dsh-headless profile bundles Profile bundles are npm packages declaring dsh.patch in their manifest: dsh-base carries the former base.cordis.yml rows as one insert over the empty profile root; dsh-web-app carries the web overlay plus a runtime glue plugin owning what used to be launcher code (frontend dist resolution via frontend-static, the web-surface prompt section, bash runtime variables, the readiness-gated URL line); dsh-headless carries the one-shot runner driving a task turn through the in-process API carrier under the launcher-provided ctx.headlessIo seam.
2026-08-06 04:40:11 +08:00
},
"peerDependencies": {
build(release): reference workspace members through the workspace protocol 1504 hand-written ranges pointing at workspace members become workspace:^, so pnpm pack substitutes each member's real version at publication: sibling peerDependencies follow the family version instead of being pinned at ^0.0.1, and a reference to a vendored package follows that package's own line. Without this, publishing 0.0.2 ships peer ranges naming a version that does not exist, and 0.0.1-rc.1 does not satisfy ^0.0.1 either. It also retires ranges that had gone stale against the workspace: ^4.0.0-rc.6 for a 4.0.0-rc.7 checkout, ^3.17.0 for schemastery 3.18.0. workspace:* stays where an exact published version is the point, which is how the Landlock entry pins its platform packages. A workspace constraint now requires the protocol, so a new package cannot reintroduce a hand-written range. The same constraint caught packages/boot/cmdline arriving on master without the publishable trio, which this change completes.
2026-08-11 00:16:45 +08:00
"@deepseek-ai/cordis-plugin-loader": "workspace:^",
"@deepseek-ai/dsh-bash-env": "workspace:^",
"@deepseek-ai/dsh-invariants": "workspace:^",
"@deepseek-ai/dsh-system-prompt": "workspace:^",
"@deepseek-ai/cordis": "workspace:^"
feat(bundle): ship dsh-base, dsh-web-app, and dsh-headless profile bundles Profile bundles are npm packages declaring dsh.patch in their manifest: dsh-base carries the former base.cordis.yml rows as one insert over the empty profile root; dsh-web-app carries the web overlay plus a runtime glue plugin owning what used to be launcher code (frontend dist resolution via frontend-static, the web-surface prompt section, bash runtime variables, the readiness-gated URL line); dsh-headless carries the one-shot runner driving a task turn through the in-process API carrier under the launcher-provided ctx.headlessIo seam.
2026-08-06 04:40:11 +08:00
},
"devDependencies": {
feat(bundle): the web and one-shot apps own their own flags dsh-web-app owns --host/--port/--dev/--workspace-root/--trusted-host and its --help in a web-startup row; the rows it configures wait for the webStartup service, and the client-plugin HMR receiver now ships disabled so --dev is a row toggle rather than a runtime insert (the Loader cannot resolve a row inserted from inside a mounting plugin). dsh-headless owns the task positional and rejects a missing task as its own usage error. Its runner ships disabled, not merely waiting: the schema requires the task, and a row's config is validated when its fiber is created, before the startup row can supply one. A composition has exactly one command-line owner, so the patch disables the web startup row and this one provides webStartup too, leaving the web rows on their composed one-shot values. The keyless web scaffold provides the same three values with no arguments, which is what an embedding host with no command line does.
2026-08-06 20:52:26 +08:00
"@deepseek-ai/cordis-plugin-loader": "workspace:^",
feat(bundle): ship dsh-base, dsh-web-app, and dsh-headless profile bundles Profile bundles are npm packages declaring dsh.patch in their manifest: dsh-base carries the former base.cordis.yml rows as one insert over the empty profile root; dsh-web-app carries the web overlay plus a runtime glue plugin owning what used to be launcher code (frontend dist resolution via frontend-static, the web-surface prompt section, bash runtime variables, the readiness-gated URL line); dsh-headless carries the one-shot runner driving a task turn through the in-process API carrier under the launcher-provided ctx.headlessIo seam.
2026-08-06 04:40:11 +08:00
"@deepseek-ai/dsh-bash-env": "workspace:^",
"@deepseek-ai/dsh-invariants": "workspace:^",
"@deepseek-ai/dsh-system-prompt": "workspace:^",
build(release): reference workspace members through the workspace protocol 1504 hand-written ranges pointing at workspace members become workspace:^, so pnpm pack substitutes each member's real version at publication: sibling peerDependencies follow the family version instead of being pinned at ^0.0.1, and a reference to a vendored package follows that package's own line. Without this, publishing 0.0.2 ships peer ranges naming a version that does not exist, and 0.0.1-rc.1 does not satisfy ^0.0.1 either. It also retires ranges that had gone stale against the workspace: ^4.0.0-rc.6 for a 4.0.0-rc.7 checkout, ^3.17.0 for schemastery 3.18.0. workspace:* stays where an exact published version is the point, which is how the Landlock entry pins its platform packages. A workspace constraint now requires the protocol, so a new package cannot reintroduce a hand-written range. The same constraint caught packages/boot/cmdline arriving on master without the publishable trio, which this change completes.
2026-08-11 00:16:45 +08:00
"@deepseek-ai/cordis": "workspace:^"
feat(bundle): ship dsh-base, dsh-web-app, and dsh-headless profile bundles Profile bundles are npm packages declaring dsh.patch in their manifest: dsh-base carries the former base.cordis.yml rows as one insert over the empty profile root; dsh-web-app carries the web overlay plus a runtime glue plugin owning what used to be launcher code (frontend dist resolution via frontend-static, the web-surface prompt section, bash runtime variables, the readiness-gated URL line); dsh-headless carries the one-shot runner driving a task turn through the in-process API carrier under the launcher-provided ctx.headlessIo seam.
2026-08-06 04:40:11 +08:00
}
}
Reference in a new issue Copy permalink