.dsh-version.json

{
  "comment": "The DeepSeek Harness version line this plugin pack is built and tested against. Plugins are shipped as alpha until the owner promotes them to stable. The installer pins this exact dsh version when driving the CLI. 'vendoredFrom' records the harness line whose client bundles dsh-rightbar / dsh-rightbar-files / dsh-open-in-app were forked from. dsh-vn-master is the pack's master: the bundle layer alone - the pack's final word per row, no browser half.",
  "dsh": "0.2.0-rc.2",
  "vendoredFrom": "0.2.0-rc.2",
  "platforms": [
    "win32",
    "darwin",
    "linux"
  ],
  "comment_platforms": "The plugins are plain JavaScript and platform-neutral; the only OS-specific code is a launcher choosing the right command for the host: dsh-open-in-app's file-browser launcher (explorer.exe / open / xdg-open, WSL-aware), the run launcher's browser hand-off (Chrome on PATH / the standard install folders / the App Paths registry entry, 'open -a Google Chrome', google-chrome or chromium, else the platform default). The launchers run on Windows (install.bat / uninstall.bat, PowerShell 5.1 or 7, and the run launcher: the double-clickable batch run-web.bat at the root plus its worker scripts/run-web.ps1, because cmd's for /f reads a child's output only up to EOF and cannot watch a running harness) and on macOS/Linux (install.sh / uninstall.sh / run-web.sh, POSIX sh - never PowerShell). The run launcher is run-web.bat + run-web.sh at the repo root, and run-web.sh does the whole job itself. The ready URL reaches the browser as ONE ARGV ELEMENT - Start-Process -ArgumentList on Windows, an argument of open/xdg-open on macOS/Linux - never through a command string.",
  "packages": {
    "dsh-vn-master": {
      "version": "0.1.0-alpha.3",
      "rows": [
        "master"
      ],
      "role": "Master: the pack base bundle and its final profile layer - it installs last, so a later layer wins per row, and it adds one no-op `master` host row. It carries the pack-wide row decisions: the four feedback/telemetry rows are disabled, and the pack's own `browser` row is disabled too (built and shipped, deliberately off). See packages/dsh-vn-master/README.md.",
      "rowOverrides": []
    },
    "dsh-rightbar": {
      "version": "0.1.0-alpha.7",
      "rows": [
        "rightbar"
      ],
      "disablesRows": [
        "ui-sidebar-right",
        "ui-sidebar-files"
      ],
      "vendors": [
        "@deepseek-ai/dsh-client-ui-sidebar-right"
      ],
      "vendoredPatches": 14,
      "role": "Right bar: the tab strip, docking panel, expand button, Start page and the `sidebarRightTabs` / `sidebarRight` services every tab type registers into. A GENERATED fork of the shipped bar whose layer disables `ui-sidebar-right` / `ui-sidebar-files`, rendering the kit's recursive `DockSurface` through its own `vendor/dock-tree.js`. See packages/dsh-rightbar/README.md."
    },
    "dsh-rightbar-files": {
      "version": "0.1.0-alpha.1",
      "rows": [
        "rightbar-files"
      ],
      "vendors": [
        "@deepseek-ai/dsh-client-ui-sidebar-files"
      ]
    },
    "dsh-editor": {
      "version": "0.1.0-alpha.14",
      "rows": [
        "editor"
      ],
      "rowOverrides": [],
      "role": "Editor: the tab type for text and code - a vendored CodeMirror 6 fetched lazily - with create-on-save inside the session workspace through this package's own authenticated routes. Markdown is claimed too, and hands off to the shipped preview. See packages/dsh-editor/README.md.",
      "uses": [
        "dsh-modal",
        "@deepseek-ai/dsh-client-ui-theme",
        "@deepseek-ai/dsh-client-ui-sidebar-documentpreview"
      ],
      "shadowsSlots": [
        {
          "slot": "sidebar.right.tab.document",
          "key": "@deepseek-ai/dsh-client-ui-sidebar-documentpreview/markdown",
          "priority": -10,
          "why": "the rendered Markdown body carries the Edit toggle back into the editor (lower priority renders) and undoes what the preview's plain-text scrollport imposes on its contents (white-space:pre and the mono font stack)"
        }
      ]
    },
    "dsh-gittree": {
      "version": "0.1.0-alpha.5",
      "rows": [
        "gittree"
      ],
      "rowOverrides": [],
      "role": "History: a read-only tab showing the workspace's commit graph, each commit's message and the files it touched. Three read-only routes spawn `git` with argv arrays under a pinned env; nothing here can write, stage or check out. See packages/dsh-gittree/README.md.",
      "uses": [
        "dsh-rightbar",
        "git on PATH"
      ]
    },
    "dsh-image": {
      "version": "0.1.0-alpha.2",
      "rows": [
        "image"
      ],
      "rowOverrides": [],
      "role": "Image: a viewer tab for PNG/JPEG/GIF/WebP/AVIF/BMP/ICO/SVG/TIFF that fits the pane on open, zooms by moving the LAYOUT (never a transform), pans by drag and reads the pixel under the pointer. Client-only: the bytes come from the harness's own `remote.workspaceFiles`. See packages/dsh-image/README.md.",
      "uses": [
        "dsh-rightbar",
        "@deepseek-ai/dsh-api-workspace-files (the workspaceFiles remote)"
      ]
    },
    "dsh-audio": {
      "version": "0.1.0-alpha.8",
      "rows": [
        "audio"
      ],
      "rowOverrides": [],
      "role": "Audio + Media: the `audio` tab draws WAV/AIFF/FLAC as a waveform (one row per channel, an adaptive ruler, a min/max envelope with the RMS core, zoom down to samples, selection, playback on the audio clock), and the left column's **Media** panel (alpha.5, one row above Plugins) scans the conversation workspace for every audio, image, video and GIF file it can reach - bounded, grouped by kind, previewed inline through the harness's own `/api/file` route, and handed to the tab that owns the type on one click. It is about files only: no microphone, no device enumeration and no output routing. Client-only, read in 2 MiB windows. See packages/dsh-audio/README.md.",
      "uses": [
        "dsh-rightbar",
        "dsh-modal (the pack's shared dialog surface: the panel's seat opens it lazily through ctx.get and never injects it, so a profile without it draws the panel inline as a page instead; the package also publishes the `media` service the left bar's Media button opens, which keeps the conversation in the main column)",
        "@deepseek-ai/dsh-api-workspace-files (the workspaceFiles remote: readBytes windows, list, stat)"
      ]
    },
    "dsh-docker": {
      "version": "0.1.0-alpha.1",
      "rows": [
        "docker"
      ],
      "rowOverrides": [],
      "role": "Docker + Podman as a surface: nine `docker_*` tools (state, ps, images, inspect, logs, pull, run, action, start) over the machine's own CLI, argv-only and with every removal confirmed by repeating the target; a `docker_start` that launches Docker Desktop or a podman machine and then waits for the DAEMON; and a Docker tab in the right bar listing containers and images with start/stop/remove, pull and run, plus a container's facts and logs. No `exec`, no `system prune`, no free-form `run`: the schema has no spelling for `--privileged`. Zero npm dependencies, no bundled engine, no socket. See packages/dsh-docker/README.md.",
      "uses": [
        "dsh-rightbar",
        "docker or podman on PATH (the engine this row drives; `DSH_DOCKER_CLI` pins a binary PATH does not cover)",
        "Docker Desktop, for `docker_start` on Windows and macOS (launched, then its daemon polled)"
      ]
    },
    "dsh-ollama": {
      "version": "0.1.0-alpha.1",
      "rows": [
        "ollama"
      ],
      "rowOverrides": [],
      "role": "Ollama as a measured surface: five `ollama_*` tools (status, run, bench, models, embed) over the machine's own daemon at 127.0.0.1:11434 - the models on disk and what is loaded now, ONE bounded inference with the daemon's own token counts and nanosecond durations, a benchmark that refuses fewer than 3 runs and reports a median with spread (cold vs warm stated at the FIRST TOKEN, because eval_duration excludes the load), A/B and num_ctx sweeps, models with pull/delete behind a confirmation that repeats the tag, and embeddings with cosine similarity - plus three bundled skills (the REST API, the metric arithmetic, the Python client) whose examples the package check parses. The loopback fence refuses an OLLAMA_HOST on another machine before any request is made (DSH_OLLAMA_ALLOW_REMOTE=1 allows one explicitly). Host-only: one row, no route, no browser half. Zero npm dependencies, no bundled engine, nothing started on its own. See packages/dsh-ollama/README.md.",
      "uses": [
        "@deepseek-ai/dsh-tools (the registry the five tools are registered into)",
        "@deepseek-ai/dsh-skill (ctx.skills, resolved lazily; the three skills are also copied into $DSH_HOME/skills by both installers)",
        "the Ollama daemon on this machine (its HTTP API at 127.0.0.1:11434; OLLAMA_HOST may move it)"
      ],
      "requires": [
        "Ollama installed and its daemon RUNNING (`ollama serve`, or the desktop app) - this row starts nothing and names the command",
        "a pulled model for ollama_run / ollama_bench, and an embedding model (e.g. nomic-embed-text) for ollama_embed"
      ],
      "vendors": [
        "NOTHING is vendored, downloaded or installed: the daemon is the user's own service, and this package ships the HTTP client, one argv for `ollama --version`, and the arithmetic"
      ]
    },
    "dsh-media": {
      "version": "0.1.0-alpha.4",
      "rows": [
        "media"
      ],
      "rowOverrides": [],
      "role": "The pack's media engine and the only owner of ffmpeg (host-only, no browser half): `media_probe`, `media_run` and `media_frames`, the Range-capable file route, remux jobs, and the pinned hash-verified ffmpeg provisioning that dsh-video's tab streams through. See packages/dsh-media/README.md.",
      "uses": [
        "@deepseek-ai/dsh-client-ui-tool",
        "the host's own `tar` for unpacking a pinned archive",
        "optional (only when provisioning): the pinned static builds from BtbN/FFmpeg-Builds and evermeet.cx"
      ],
      "vendors": [
        "NOT a vendored engine: lib/binaries.json is a PIN (official URL + SHA-256 per platform-arch) whose bytes are downloaded to $DSH_HOME/dsh-media/bin only on a machine with no ffmpeg of its own (BtbN/FFmpeg-Builds autobuild-2026-09-26-13-03 for win32/linux, evermeet.cx 9.0.2 for darwin-x64)"
      ]
    },
    "dsh-supercollider": {
      "version": "0.1.0-alpha.3",
      "rows": [
        "supercollider"
      ],
      "rowOverrides": [],
      "role": "SuperCollider the agent can play (host half plus a deliberately small console tab): eleven `sc_*` tools over ONE long-lived sclang session and a hand-written OSC client to scsynth, the installed .schelp reference indexed for sc_help, the .scd file workflow, and five bundled skills that teach the language, SynthDefs and live coding. Zero npm dependencies and no MCP server; `mcp/stdio.js` is the same engine over stdio for a client without the harness. See packages/dsh-supercollider/README.md.",
      "uses": [
        "@deepseek-ai/dsh-client-ui-tool (the tool cards, resolved lazily)",
        "the harness's own `ctx.tools`, `ctx.skills` and `connection.fetch` registries",
        "SuperCollider 3.13+ installed on the machine (sclang and scsynth) - nothing is bundled"
      ],
      "vendors": [
        "NOTHING is vendored and NOTHING is downloaded: the engine is hand-written JavaScript, and it finds the machine's own SuperCollider or tells the user how to install one"
      ],
      "requires": [
        "SuperCollider 3.13+ on PATH or at the platform's standard install locations (including the versioned folders a real install uses), else DSH_SC_SCLANG / DSH_SC_SCSYNTH"
      ]
    },
    "dsh-video": {
      "version": "0.1.0-alpha.2",
      "rows": [
        "video"
      ],
      "rowOverrides": [],
      "role": "Video: a player tab for MP4/MOV/WebM/MKV/AVI/WMV/FLV/OGV/TS/3GP that fits the pane, with the ffprobe facts, chapters as jump targets and one-click remux/convert. The bytes never enter the tab: the `<video>` is handed a URL to dsh-media's Range route. See packages/dsh-video/README.md.",
      "uses": [
        "dsh-rightbar (the tab registry and the keyed pane seats)",
        "dsh-media (the file/report/remux/job routes and the ffmpeg behind them - resolved over HTTP, so a profile without it still loads and says so)"
      ]
    },
    "dsh-browser": {
      "version": "0.1.0-alpha.1",
      "rows": [
        "browser"
      ],
      "disablesRows": [
        "ui-sidebar-browser"
      ],
      "role": "Browser: the pack's own web surface, which fetches and renders a page on the HOST in a disposable sandboxed engine behind an egress gate instead of framing it remotely - three tools and three routes. Currently disabled by dsh-vn-master's `browser` row; re-enabling it is deleting those two lines. See packages/dsh-browser/README.md."
    },
    "dsh-diagrams": {
      "version": "0.1.0-alpha.8",
      "rows": [
        "diagrams"
      ],
      "rowOverrides": [],
      "role": "Diagrams: Mermaid, TikZ and the Diagram Design kit in one bundle - seven `diagram_*` tools whose writes are validated on the host before they are stored, a conversation store plus a shared library, a tab per diagram with an export menu, an index page that also browses the kit's 71 example keys, and browser render reports. See packages/dsh-diagrams/README.md.",
      "uses": [
        "dsh-rightbar",
        "@deepseek-ai/dsh-client-ui-tool",
        "a TeX engine on PATH (pdflatex/xelatex/lualatex) for TikZ"
      ],
      "vendors": [
        "mermaid@11.17.2 (lib/vendor/mermaid.min.js, GENERATED by vendor/build.mjs)",
        "the Diagram Design kit at cathrynlavery/diagram-design@7a2e221 (lib/vendor/design: 204 examples, 62 references, 277 files, GENERATED by vendor/design/build.mjs; VERSION.json records every file's bytes+sha256 plus the motion controller's, and --check re-hashes the tree offline)",
        "the three skills copied into $DSH_HOME/skills by both installers"
      ]
    },
    "dsh-frontend-craft": {
      "version": "0.1.0-alpha.2",
      "rows": [
        "frontend-craft"
      ],
      "rowOverrides": [],
      "role": "Frontend craft: Impeccable's Apache-2.0 corpus vendored at a pinned commit - the 24 commands, 41 references, the craft floor, the modes and the native platform references - plus its 61-rule detector built to a WebAssembly module that ships inside the package, and an 18-world local direction deck of our own. Five tools (`fe_context`, `fe_detect`, `fe_direction`, `fe_render`, `fe_artifact`), six routes, the bundled `frontend-craft` skill, and a Frontend tab with findings, artifacts, the direction round and a rendered preview. `fe_render` is the one process it starts: the machine's own headless Chrome/Edge, argv-only, throwaway profile, no network but loopback, for the measured `render-*` rules. No install, no engine download. See packages/dsh-frontend-craft/README.md.",
      "uses": [
        "@deepseek-ai/dsh-client-ui-tool (the tool cards, resolved lazily)",
        "dsh-rightbar (the tab registry and the keyed pane seats)",
        "@deepseek-ai/dsh-skill (ctx.skills, resolved lazily; the frontend-craft skill is also copied into $DSH_HOME/skills by both installers)",
        "the harness's own `connection.fetch` registry for the four routes"
      ],
      "requires": [
        "nothing: the detector is a wasm module committed in the package, and the corpus is markdown committed in the package"
      ],
      "vendors": [
        "Impeccable 4.6.0 @ 2f46b7a8b059af00d20dd13b64dbe165e7c6a742 (Apache-2.0): the skill corpus under skills/frontend-craft (SKILL.md assembled from our head + upstream, 41 references), the 61-rule registry, and lib/vendor/impeccable/detect (detect_bg.wasm 4,558,054 bytes + detect.cjs, GENERATED by vendor/impeccable/build-engine.mjs from crates/core + crates/foundation with wasm-bindgen 0.2.127; VERSION.json records every byte and sha256, and --check re-hashes the tree offline)"
      ]
    },
    "dsh-pdf": {
      "version": "0.1.0-alpha.9",
      "rows": [
        "pdf"
      ],
      "rowOverrides": [],
      "role": "PDF: five `pdf_*` tools (info, read, find, render, scan) over a vendored pdf.js, plus the reader tab (zoom, search, thumbnails, outline) and a workspace index. Read-only, with extraction in a child process that never evaluates a document's JavaScript. See packages/dsh-pdf/README.md.",
      "uses": [
        "dsh-rightbar",
        "@deepseek-ai/dsh-client-ui-tool",
        "@deepseek-ai/dsh-client-ui-session",
        "optional: poppler pdftoppm / mutool / Ghostscript for pdf_render and pdf_scan, tesseract (+ language data) for OCR"
      ],
      "vendors": [
        "pdfjs-dist@6.3.289 (lib/vendor/pdf.min.mjs + pdf.worker.min.mjs + cmaps/ + standard_fonts/ + wasm/ + LICENSE, GENERATED by vendor/build.mjs; VERSION.json records every file's bytes+sha256 and a digest per tree, --check re-hashes it offline, and .gitattributes pins its text files to LF)",
        "the pdf-analysis skill copied into $DSH_HOME/skills by both installers"
      ]
    },
    "dsh-ocr": {
      "version": "0.1.0-alpha.1",
      "rows": [
        "ocr"
      ],
      "rowOverrides": [],
      "role": "OCR: one `ocr` tool that reads the TEXT in a picture, a scan or a PDF page with a REAL engine - tesseract from PATH on any platform, or the OCR engine Windows itself ships (Windows.Media.Ocr), which needs no install at all and rasterizes a PDF page itself through Windows.Data.Pdf. The answer names the engine, the language and the page count, refuses a language the host has no data for with the list of what it CAN read, and carries the transcription caveat. Host-only: one row, no browser half, no route. See packages/dsh-ocr/README.md.",
      "uses": [
        "@deepseek-ai/dsh-tools (the registry the one `ocr` tool is registered into)",
        "tesseract on PATH where it is installed (any platform; raster images only - a PDF stays dsh-pdf's pdf_scan route)",
        "on Windows: the OCR engine built into Windows 10/11, driven through lib/win-ocr.ps1 and powershell.exe 5.1 (no install; reads raster images AND PDF pages)"
      ],
      "requires": [
        "an OCR engine on the host: tesseract with the traineddata for the languages to read, or the recognizer Windows 10/11 ships - with neither, the tool says what to install and what this host CAN read instead of failing"
      ],
      "vendors": [
        "NOTHING is vendored, downloaded or bundled: the engines are the machine's own (resolved from PATH or from the OS install), and lib/win-ocr.ps1 is written here"
      ]
    },
    "dsh-wsl": {
      "version": "0.1.0-alpha.1",
      "rows": [
        "wsl"
      ],
      "rowOverrides": [],
      "role": "WSL bridge: three tools over the machine's own Windows Subsystem for Linux - `wsl_status` (the launcher's table decoded from UTF-16, the default distribution marked, and with `probe` whether a distribution can actually run a check), `wsl_run` (ONE argv array in a distribution through `wsl.exe -d <distro> --cd <dir> -- <argv...>`, argv-only so there is no shell, with a deadline, a tree kill on timeout, a 1 MB cap per stream and the exit code in the answer) and `wsl_path` (`C:\\...` <-> `/mnt/c/...` in both directions). It exists so the pack's POSIX half - `scripts/run-web.sh`, `scripts/setup/install.sh` and the sh branches of the checks - can be tested on the Windows machine that writes it. Host-only: one row, no route, no browser half. Zero npm dependencies and no network egress; it runs Windows' own launcher and the user's own distribution. See packages/dsh-wsl/README.md.",
      "uses": [
        "@deepseek-ai/dsh-tools (the registry the three tools are registered into)",
        "wsl.exe on the machine (WSL 0.58+ for `--cd`)",
        "at least one distribution the user installed"
      ],
      "requires": [
        "Windows with WSL: install it from an elevated terminal with `wsl --install` (this row cannot install a distribution and says so)",
        "a distribution that can run a program - on a machine with Docker Desktop the launcher's DEFAULT is `docker-desktop-data`, which cannot, so the tools name the distribution they used"
      ],
      "vendors": [
        "NOTHING is vendored, downloaded or bundled: the launcher is Windows' own program and the distribution is the user's. The package ships the argv builder, the UTF-16 decoder and the parser for the launcher's table"
      ]
    },
    "dsh-cmdbar": {
      "version": "0.1.0-alpha.17",
      "rows": [
        "cmdbar"
      ],
      "rowOverrides": [],
      "role": "Command bar: a read-only transcript of the agent's own commands in a bottom dock, fed by one bounded read-only route. One view, and no shell of its own. See packages/dsh-cmdbar/README.md.",
      "uses": [
        "@deepseek-ai/dsh-client-ui-conversation"
      ]
    },
    "dsh-modal": {
      "version": "0.1.0-alpha.4",
      "rows": [
        "modal"
      ],
      "provides": [
        "modals"
      ],
      "rowOverrides": [],
      "role": "Modal: the pack's shared dialog surface, published as the `modals` service - `open` / `alert` / `confirm` / `prompt` with async submit work that keeps the dialog open, plus a rich `content` dialog whose mask click deliberately does not close it unless the caller opts in with `dismissOnMask`. See packages/dsh-modal/README.md."
    },
    "dsh-skills": {
      "version": "0.1.0-alpha.4",
      "rows": [
        "skills"
      ],
      "rowOverrides": [],
      "uses": [
        "@deepseek-ai/dsh-skill (ctx.skills, the host skill registry - NOT injected, resolved lazily per request)",
        "dsh-modal (the shared dialog surface, opened in its rich `content` form; resolved lazily so a profile without it still loads)"
      ],
      "role": "Skills browser: the left bar's Skills button (and, in a profile without dsh-themes, one header seat) opens a modal listing every skill the harness loads for this conversation, closable by clicking outside it, with three routes to read and save the markdown behind it. The client names a skill, never a path. See packages/dsh-skills/README.md."
    },
    "dsh-ui-state": {
      "version": "0.1.0-alpha.2",
      "rows": [
        "ui-state"
      ],
      "rowOverrides": [],
      "provides": [
        "uiState"
      ],
      "owns": [
        "the profile's own Cordis patch -> the `ui-state` entry's `config` (pageZoom, theme, dockHeight, sidebarWidth, rightbarWidth), through the five `.volatile()` fields this row declares"
      ],
      "role": "UI state that outlives the process: the page zoom, an extension theme, the dock height and the two column widths, kept in one durable settings section and applied before first paint for the zoom. See packages/dsh-ui-state/README.md.",
      "uses": [
        "@deepseek-ai/dsh-settings (ctx.settings.configure, the page-policy seam)",
        "@deepseek-ai/dsh-client-ui-settings (ctx.configForms on the browser side)",
        "@deepseek-ai/schemastery, resolved at runtime through $DSH_HOME/profiles"
      ]
    },
    "dsh-proto-lab": {
      "version": "0.1.0-alpha.1",
      "rows": [
        "proto-lab"
      ],
      "rowOverrides": [],
      "role": "The prototyping lab: five `lab_*` tools that write a run into the lab root (`~/Desktop/vncode-lab/runs/<runtime>/<slug>/` on a machine with a Desktop, `<workspace>/lab` otherwise, `DSH_PROTO_LAB_ROOT` to move it) - p5.js sketches a browser opens, and openFrameworks projects that are three real C++ files (src/main.cpp, src/ofApp.h, src/ofApp.cpp) built with the user's own projectGenerator and `make`. A runtime registry makes a third language one module and one line, a committed and check-driven example library sits beside each skill, and verification is organised as an explicit tier ladder (structure, parse, compile, render, measure) whose answer always names the tier that was actually reached. The lab itself is gitignored: the bundle ships the generator and the examples, never the runs. See packages/dsh-proto-lab/README.md.",
      "uses": [
        "@deepseek-ai/dsh-tools (the registry the five tools are registered into)",
        "@deepseek-ai/dsh-skill (ctx.skills, resolved lazily; the three skills are also copied into $DSH_HOME/skills by both installers)",
        "the harness's own `connection.fetch` registry for the three routes",
        "a Chromium-family browser for tier 3/4 verification only (the render check); nothing at run time needs one",
        "openFrameworks installed by the user (found through DSH_OF_ROOT / OF_ROOT or the standard locations) for tier 2 of the native runtime - never downloaded"
      ],
      "requires": [
        "nothing to WRITE a run: p5.js is vendored in the package and an openFrameworks run is plain source",
        "to COMPILE an openFrameworks run: that machine's own openFrameworks install and C++ toolchain",
        "to RENDER/MEASURE a p5.js run: a Chromium-family browser (Chrome, Chromium or Edge)"
      ],
      "vendors": [
        "p5.js 1.11.13 (lib/vendor/p5.min.js, GENERATED by vendor/build.mjs; 1.x is the last line with a self-contained classic-script browser build, which a run opened off the filesystem needs). VERSION.json records the bytes and sha256; `node vendor/build.mjs --check` re-hashes it offline. LGPL-2.1, with the upstream LICENSE beside the bytes."
      ]
    },
    "dsh-research": {
      "version": "0.1.0-alpha.5",
      "rows": [
        "research"
      ],
      "rowOverrides": [],
      "role": "Research: a run is a FOLDER - `RUN.json` (what it is) plus a `passport.json` that records the user's instructions and every gate answer VERBATIM - that stays findable from any session through a library pointer at `$DSH_HOME/dsh-research/library.json`. Nine `rs_*` tools (rs_open / rs_new / rs_plan / rs_read / rs_write / rs_cite / rs_verify / rs_review / rs_build) work over an append-only claim and source ledger; the document dialect adds exactly one thing to Pandoc Markdown (`[sentence]{#c0142}` for a claim, `[@key]` for a citation) and `rs_write` REFUSES a claim nothing tracks; a claim that rests on a NUMBER carries a validated `statistic` ({ test, statistic, df, p, effect, ci, n }, refused at `p = .000` and cleared like a wording change) which the build prints as the document's own Statistics table; a structured METHOD RECORD (`plan/method.json`: databases, date of access, search string, criteria, PRISMA-shaped screening counts) is validated on the way in and by r0, whose counts must not increase, and is printed as the document's search-and-screening flow; a DISCLOSURE RECORD (`plan/disclosure.json`: authors with CRediT roles, ethics approval that must name the approving body and its reference, consent, funding, conflicts, data availability, AI use) is validated the same way and printed as `disclosure.md` in the submission folder - never into the anonymized manuscript; `rs_verify action=calibrate` measures the READER against a 25-item gold set and reports FNR/FPR against stated bars; six citation styles are one module each behind a registry, with the reference list computed from the ledger rather than typed by the model; `rs_build` writes a watermarked draft or a gated clean document in md/docx/html/tex/ris/bib/enw plus the gated submission folder; and eight bundled skills teach the tool surface, the method layer, the ethics layer and the review. The Research tab is where a PERSON answers the gates and edits their own `doc/` and `plan/` files in place, with the structure verdict returned on every save. Host half plus UI; no vendored engine, no npm dependency, no bundled binary, no socket, no child process.",
      "uses": [
        "@deepseek-ai/dsh-tools (the registry the nine tools are registered into)",
        "the harness's own `connection.fetch` registry for the eight routes, all behind the session check",
        "@deepseek-ai/dsh-skill (ctx.skills, resolved lazily; the eight bundled skills are also copied into $DSH_HOME/skills by both installers)",
        "dsh-rightbar (the tab registry and the two keyed pane seats)"
      ],
      "requires": [
        "nothing: the engine is hand-written JavaScript and a run is a folder this package creates"
      ],
      "vendors": [
        "NOTHING is vendored, downloaded or installed, and this row opens NO socket and spawns NO process: literature arrives as a file the person or the agent already has (fetched with the harness's own web_fetch / web_search, or read with the pdf_* and ocr tools), and the DOCX writer is written rather than wrapped because calling pandoc would be a child process"
      ]
    },
    "dsh-themes": {
      "version": "0.1.0-alpha.31",
      "rows": [
        "themes"
      ],
      "rowOverrides": [],
      "uses": [
        "@deepseek-ai/dsh-client-ui-theme",
        "@deepseek-ai/dsh-session-log-export",
        "dsh-ui-state (the uiState service, resolved lazily through ctx.get, for the durable page zoom and extension theme)"
      ],
      "role": "Themes and header dress: the conversation header's own controls (page zoom, Screenshot, Themes, session-log download), the Nord/Monokai/Hacker/Cyber palettes, and the pack's appearance overrides - Markdown paper, the branding band, the band lines and the top row's centre, the account menu's Feedback row removed, the right bar's resize seam, and the band's four action buttons (Settings, Plugins, Media, Skills), where Media opens dsh-audio's `media` dialog instead of swapping the main column and the header's duplicate Skills seat is hidden. See packages/dsh-themes/README.md.",
      "overrides": [
        "markdown paper: re-declares ui-theme's light declarations on the rendered Markdown root, so the page stays white in the dark theme",
        "markdown chrome: hides the preview header's viewer menu on Markdown tabs (the page has exactly one renderer; the editor's Edit button is the way back to editing)",
        "left top bar: the sidebar branding row becomes the 76px band the middle and right columns open with - the row spanning the frame's top edge, the sidebar's own 6px top padding folded into its height so the hairline at y=76 does not move - with the mark, brand name and collapse control centred on the frame's y=20, the middle of the band's 40px top row, and the core's 8px/12px gap kept under the line; pinned to the sidebar's hashed class names",
        "branding: the left bar brand row drops the shipped mark and wordmark - whatever occupies the single-occupant sidebar.brand.mark / sidebar.brand.name slots, including the layout fallback - and draws a 24px black disc plus the product text vncode in their place (alpha.14; the draw string read VN Harness through alpha.13), in the wide row and in the collapsed rail",
        "branding type: the vncode text wears the conversation title's own type - 14px/20px at weight 500, the size of ui-conversation's current crumb - instead of the shipped brand name's 18px/600, which sat in the same 30px strip",
        "branding mark: the drawn disc is replaced by the app icon itself - assets/vncode.svg at the pack root, a black circle centred on (12,12) with a 1px transparent margin inside its box - inlined as a data URI so no route or request is needed, and painted at 24px in the left bar (wide row and rail) and 26px in the empty conversation hero, where the shipped whale is also hidden",
        "header ring: the right bar's own collapse/expand toggle in the header corner wears the same .5px round hairline outline as this package's own header icon buttons, keyed on the header's stable data-conversation-header-corner marker rather than a hashed class",
        "session-log download seat: the shipped @deepseek-ai/dsh-session-log-export browser half's three-dot button - whose one menu item was Download session log - is shadowed by registering the SAME occupant id (session-log-download) at priority -10, which is a list slot's own lowest-renders rule, so the seat draws one plain download icon button that starts the export on the first click; nothing shipped is disabled, because that row owns the host half (/api/session.export and the /export command) and publishes the sessionLogDownload controller this button drives, and the seat's preparing/success/error dialog is rendered here from that same store so /export keeps its feedback",
        "capture rule: for the one frame the Screenshot control grabs, html[data-dsh-screenshot] hides the OPEN TOOLTIP BUBBLE (keyed on the shipped Tooltip's own role=\"tooltip\" marker, never a hashed class) and nothing else - since alpha.11 the picture is the interface as it stands, this package's header controls included, because a shot that dropped the buttons that took it was a hole in the record; the clicked button also passes disabled to its own Tooltip while the capture runs, so its hover card is closed rather than merely hidden",
        "page zoom: one inline `zoom` on <html> - removed again at 100% - along Chrome's own zoom ladder (50% to 200%, cut at 200% for the reason recorded with the ladder: the control is inside the page it zooms, and a browser zoom reflows the shell, so a rung past that puts the header's utilities row outside the shrunken layout viewport). The menu keeps itself open over a step, like the browser's own zoom submenu, and closes on a pointer press outside it or on Escape (the shipped Menu's own behaviour); the button carries the level in `data-dsh-page-zoom` and in its tooltip, and the level is remembered per origin in localStorage (`dsh-themes.page-zoom`) and re-applied before the control's first render",
        "right bar seam under a zoom: the frame places the right bar's outer resize seam with `left: viewport - rightbar`, where `viewport` is the SCALED `getBoundingClientRect().width` a root zoom produces while `left` is layout pixels - so with a level in force the seam slid off the edge it belongs on (288px at 80% on a 1440px frame) and the bar could no longer be dragged, which in the desktop window reads as 'the right bar stops being resizable after I zoom'; the LEFT bar's seam was never affected, its `left` being a layout-pixel width with no measurement folded into it. Two rules, gated on `html[data-dsh-page-zoomed]` - the marker `applyZoom` writes beside the declaration it belongs to, so they are inert at 100% and the frame's own inline `left` still governs. Alpha.16 anchored the right COLUMN (`data-rightbar-col`) and alpha.28 corrected that, because the column is only the same place as the seam while the panel and the grid track agree and at a zoom they do not: the solve reads the scaled rect, so on a 1440px frame at 90% the track takes 648 layout px while the solve returns 616 and the panel is drawn 616 wide against the frame's right edge - the seam at x=824, the track at x=792 and the frame's own inline `left` at x=680, and the handle sat on the middle one, which is exactly the report \"the visible seam line is offset from the bar's edge, so I have to reposition it\". The anchor is therefore the OPEN PANEL (`[data-sidebar-right-panel][data-sidebar-right-open]`, the box that draws the seam with its `right:0` and its inline width) and the handle rule is guarded by `:has()` on that panel, because `anchor()` against an undeclared name makes `left` fall back to `auto` instead of the inline value. Measured against a replica of the frame in a real browser at 90% and 125%: the handle's centre and the panel's left edge agree to 0.00px, where the column anchor was 32px and the inline `left` 144px away at 90%. No fork, no core row disabled, nothing for sync-vendored.ps1; a browser without anchor positioning drops the declarations and leaves the behaviour of before",
        "account menu: the account menu's shipped **Feedback** row is HIDDEN (alpha.21), because vncode does not ask its users for feedback and that row is the only control in the app that opens an EXTERNAL form in a new window - @deepseek-ai/dsh-client-ui-settings-account's contactUrl() builds it with the uid, the locale, the harness version, the screen size and the device info attached (the default is a Feishu questionnaire at trtgsjkv6r.feishu.cn). There is no row to disable: the item is hardcoded in that package's AccountMenu and registered into the settings.launcher slot whole, so the alternatives were a fork of 4.5k lines (sign-in, sign-out, quota notices, billing pages, onboarding) or one rule. The rule keys on the ICON - the paper-plane path data the row draws - rather than on a hashed class, since the primitive renders rows with no id or data attribute and the artwork outlives the class names a rebuild renames; it hides the row's wrapper AND its button (the primitive's shape today and the bare-button fallback), and it is scoped to `[role=\"menu\"]` so the same artwork drawn by the chat's turn-trigger notice and by the Session-export header button is untouched. Hiding is enough: a display:none row cannot take focus or be clicked, while the Menu's keyboard walk still advances past it, so Settings and Sign out stay reachable. Accepted failure mode, the same one the top-bar and branding pins carry: a future harness that redraws the artwork makes the rule match nothing and the item returns - and a `config` override of contactFormUrl was rejected because a row with `volatile` fields loses its whole config on the next volatile write. No fork, no core row disabled, nothing for sync-vendored.ps1",
        "band lines (alpha.25/alpha.26) and the top row's centre (alpha.27): the band's own `.5px` hairline drawn a SECOND time, at y=40, plus the 38px bar the right bar's Start tab was missing and the surface that row needs. That line divides every band into a 40px top row and a 36px one below it, so alpha.27 centres all three columns' top-row furniture on the frame's y=20 - centring it in the last 30px above the rule instead (the strip the conversation's own title row used to define) is what measures as furniture RESTING on the line, a 28px control ending 1px above it with 11px of air over it. The middle column does it by handing the header's own 10px `padding-top` to the conversation title row, which takes `min-height:40px`, so the title and its 28px controls run y=6..34; the sessionless header, whose empty title row IS that 10px of padding, is scoped out of both rules and keeps its shipped height. The dock strip's own padding puts the right bar's 28px tab chips on the same y=6..34 while keeping the strip's 38px total (6px above the chips, 4px below), so the tab body below it keeps its top. The left column's branding row carries the mark, the product text and the collapse toggle on that same y=20 (the 24px mark y=8..32, the wide row's 28px toggle y=6..34, the rail's 36px one y=2..38). The middle column's line is a `.5px` top border on a zero-height pseudo at the tabs row's top edge, with the row's 10px `margin-top` moved into `padding-top` so not a pixel of the tab text moves and the negative inline margins (against the header's own 20px/28px padding) run the line to both column edges; the left column's is the same border on a pseudo 40px into the branding row (the row now spans the band from the frame's top edge, its 6px of root padding folded into its own 76px height, so 0 + 40 = the same y=40), scoped to the WIDE column because the rail's icon button is a 36px square that fills its whole 36px strip (y=2..38) and a line at 40 would cross it; the right bar's is the same border on the tab body's own box, 2px into the row below that column's 38px tab strip (6px of strip padding above 28px of tab chips, 4px below), because that band's own rows divide at 38 and not at 40 - the same border, at the same y=40, is what makes all three columns' lines one height, and the band under it then measures 40 + 36 like the other two columns'. The right bar's other half is the row below that line: the shipped guide tab (the Start tab) is the only tab whose body draws no tool bar - every other type draws a 38px one with that hairline at y=76, which is why the guide's content started 38px higher and no line was drawn - so it is given a top border in the BAR'S OWN SURFACE (`--dsw-alias-bg-base`, the dark palette's `#151517` as the literal) that pushes its content down to y=76, with the same `.5px` border on the pseudo whose containing block begins at that border's bottom edge; and because the right bar is an OVERLAY on the frame whose surface is painted by the forked bar's own stylesheet on the dock box, the tab body's own box (`.P3OORG_tabBody`, the one that spans that row on every tab) is given that same surface - the row under the line was a REAL HOLE with the conversation behind it, and the guide's empty bar is where a reader saw it. Every line is the same token and the same border the band's existing hairline is, so all of them weigh the same; no `:has()`, nothing a browser would drop, and the whole override is inert on a harness that renames the hashed classes it keys on. Measured in a real browser against the extracted core CSS: the conversation header stays exactly 76px (a `border-top` on the tabs row made it 76.5 and pushed everything below it down half a pixel), the first tab stays on y=50, the tabs row spans the full column, the right bar's strip line lands at y=37.5..38 with the tab chips ending at 38, the guide keeps filling its pane (302px of 302px) with its own line on y=76, and the row below the strip - transparent before - is the bar's `#151517` after. The alignment is measured too: the three mid-band lines read 40..41 / 40..41 / 37..38 before and 40..41 / 40..41 / 40..41 after, i.e. the right bar's line was the one out of place by two pixels",
        "theme extensions: the Themes control's menu is the SHIPPED registry's own list (snapshot.themes, with the system preference last), and this package registers its palettes into it through ctx.theme.register - ui-theme's documented third-party surface, whose alias-token overrides ui-layout writes as inline body variables over the base palette colorScheme selects. The first registered theme is Nord (alpha.12): the Nord palette's Polar Night surfaces (nord0 page and sidebar alike), Snow Storm text, Frost accents and Aurora states as 93 token overrides (73 alias, 11 specific, 9 shiki) on the DARK base. Monokai follows it (alpha.13), in the same 93-token shape on the DARK base: the classic TextMate palette's near-black warm page (#272822), off-white body (#f8f8f2), pink keywords (#f92672) as the brand, cyan types (#66d9ef) as links and the info state, yellow strings, green functions, orange parameters and purple constants in the syntax tokens, the theme's line highlight and selection as the surface steps, and the olive comment grey (#75715e) as the quietest text tier. Hacker follows Monokai (alpha.19), again in the same 93-token shape on the DARK base: the phosphor terminal, with a near-black green-cast page (#0a0e0a) shared by the conversation and the sidebar, the phosphor body (#d8ffe0), the signal green (#00ff41) as the brand, success and primary button, amber (#ffb000) for warnings and strings, cyan (#00d9ff) for links and the info state, a plain red for errors, and the dim green (#3f6b4a) as the quietest text tier and the comment token - with every hover and pressed step DERIVED from the palette's own colours by the arithmetic Monokai documents rather than invented. Cyber follows Hacker (alpha.24), once more in the same 93-token shape on the DARK base and the pack's SECOND high-contrast programmer palette: the neon city, with a blue-cast near-black page (#04060d) shared by the conversation and the sidebar, a near-white body (#f0f6ff, about 19:1 on that page, with the secondary tier at #d3d8e0 and the tertiary at #9da8c3 so the quiet tiers stay readable), the neon magenta (#ff2e88) as the brand, the primary button and the keywords, the electric cyan (#00e5ff) for links, the info state and functions, violet (#b388ff) for constants, amber (#ffd54d) for strings and warnings, a lifted slate (#6b7ea8) for comments - readable rather than the invisible dim, unlike Hacker's - and the slate (#4a5a86) as the quietest text tier; every hover and pressed step is DERIVED from the palette's own colours by the same arithmetic. It is deliberately not Hacker's twin: a different cast (blue against green), a different brand hue (magenta against green) and different syntax roles, and the tracked check pins both pages and both brands so the two cannot converge. The header button wears one static appearance mark instead of the active preference's sun/moon, and the theme stays in-process because the durable preference schema accepts light/dark/system only. Adding a theme is one entry in THEME_EXTENSIONS plus its theme.<id> copy in both dictionaries and its own menu glyph",
        "band actions (alpha.29/alpha.30): the left column's band is 76px, and its SECOND ROW - the 36px strip under the mid-band hairline, the row the conversation header spends on its title - was empty. The theme mounts FOUR buttons there, in this order: Settings, Plugins, Media, Skills, left-aligned in one 28px strip at y=44. Each is the SAME `.dst-button` the header's controls are - 28x28, the same `.5px` outline, 28px radius, a 15px glyph - so the app has ONE button size instead of a band that invented a second, and each names itself in a tooltip on hover. It is a MOUNT and not a slot because ui-sidebar declares no hole for that row: its six are the brand mark, the brand name, the toggle badge, the panel-icon list, the workspaces region and the foot, and the two at the top are single-occupant aria-hidden decoration this package already hides. The strip is a sibling of the branded identity (so the buttons are in the accessibility tree), it is additive (nothing shipped is moved or wrapped), and each button does what the row of the same name does: Settings clicks the shipped panel's own trigger scoped to this column - ui-settings exposes no service for it, the panel is the seat's own state, and the `settings.open` shortcut exposes resolve but not invoke - Plugins and Media call `ctx.layout.selectPanel` with the same ids the shell's rows use, Skills clicks the header's own `[data-dsh-skills=\"button\"]` so the dialog keeps the session id it resolves its project folder from, and Media is only drawn when its panel is registered, so a profile without dsh-audio gets three buttons. Once the strip mounts, the rows it mirrors are HIDDEN at the foot - `panelList` whole, and the Settings trigger button but not the connection/update indicators that share its row - gated on `:has([data-dsh-themes-band])` so a profile without this package keeps the shell's own navigation; the hidden trigger stays mounted, which is what the band's Settings button clicks. Classes are the package's own `dst-` prefix; the only hashed name is ui-sidebar's `hHd-Xa_` prefix every band override here already pins. Mounted once and kept mounted by `ctx.effect` plus the sidebar column's child list (a remount) and the panel list (dsh-audio arriving later); never a timer; skipped whole without a document or react-dom/client."
      ]
    },
    "dsh-open-in-app": {
      "version": "0.1.0-alpha.1",
      "rows": [
        "native-open-in-app"
      ],
      "disablesRows": [
        "ui-open-in-app"
      ],
      "vendors": [
        "@deepseek-ai/dsh-client-ui-open-in-app"
      ],
      "vendoredPatches": 2
    }
  }
}