docs: correct the alpha.3 peer note — dsh-attachment is declared as a peer, not missing

Upstream declares its dsh-* siblings (dsh-attachment included) as
peerDependencies provided by the host bundle tree, so the host-side
mount is unaffected. The stale copies only surface in this repo's dev
tree, which installs a subset of the peers directly — making the
overrides a standing shim to extend on each baseline bump, not a
temporary patch awaiting an upstream fix.

AGENTS.md

@@ -37,7 +37,7 @@
 6. **`dsh-subagent` 的 `SUBAGENT_DESCRIPTOR_VERSION` 2 → 3**：sidechat 种子的 `subagent/descriptor` 版本由宿主包盖章，插件不硬编码；测试断言跟随常量（`tests/sidechat-routes.spec.ts`），勿钉字面量。
 7. **`@deepseek-ai/dsh-client-runtime` 包已消亡**（继任 seed 是裸名 `dsh-client-store`，无 `/client` 子路径）：peerDependencies、devDependencies、`dsh.client.inject`、chunk externals 白名单（`src/client/chunk-loader.ts` / `tsdown.config.ts` / `tests/chunk-loader.spec.ts` / `tests/manifest-consistency.spec.ts` 四处同步）均已无该条目。
 8. **e2e scratch profile 的 `minimumReleaseAgeExclude` 含 `'@deepseek-ai/*'`**（`scripts/e2e-mount.sh` / `e2e-aggregate-mount.sh`，与仓库根 `pnpm-workspace.yaml` 同策）：alpha 版本常在发布后 24h 内跑 lane，pnpm 11 的 `minimumReleaseAge` 默认会拒装新鲜包。
-9. **alpha 发布物依赖元数据失配需 overrides 兜底**（alpha.3 首见）：`dsh-subagent@0.1.2-alpha.3` 运行时 import `dsh-attachment` 的 `admitPromptContent` 却未声明该依赖，另有 6 个传递 peer（dsh-scope / dsh-session-projection / dsh-system-prompt / dsh-user-approval / dsh-util-time / dsh-code-runtime）解析到旧版——仓库根 `pnpm-workspace.yaml` 的 `overrides` 统一钉到 alpha 线，上游修复元数据后可移除；`@deepseek-ai/cordis` peer 自 alpha.3 起要求 `^4.0.2`（上游全线 peer 已升）。适配新 alpha 版本时先跑 `pnpm peers check` 复查失配清单。
+9. **插件开发树的 dsh-* 传递 peer 需 overrides 钉齐**（alpha.3 首见）：`dsh-subagent` 等 npm 包把 `dsh-attachment` 等 dsh-* 姊妹包全部声明为 peerDependencies（由宿主 bundle 树统一提供，宿主侧无此问题），插件仓库只直接 devDeps 其中 13 个——其余 peer（dsh-attachment / dsh-code-runtime / dsh-scope / dsh-session-projection / dsh-system-prompt / dsh-user-approval / dsh-util-time）在 pnpm 下会解析到树上残留的旧版，如 `dsh-attachment@0.1.1-rc.1` 缺 `admitPromptContent` 导出、`dsh-subagent` 产物 import 它时测试加载即崩。仓库根 `pnpm-workspace.yaml` 的 `overrides` 将这 7 个钉到 alpha 线——**属长期兜底而非等上游修复的临时补丁**（除非上游改为 dependencies 声明）；`@deepseek-ai/cordis` peer 自 alpha.3 起要求 `^4.0.2`（上游全线 peer 已升）。适配新 alpha 版本时先跑 `pnpm peers check` 复查失配清单并扩充 override 列表。
 
 ---
 

pnpm-workspace.yaml

@@ -8,14 +8,14 @@ allowBuilds:
   node-pty: true
   protobufjs: true
 
-# The 0.1.2-alpha.3 @deepseek-ai/* packages publish with workspace-era
-# dependency metadata that does not fully match their published artifacts:
-# dsh-subagent imports `admitPromptContent` from @deepseek-ai/dsh-attachment
-# without declaring it, and several transitive peers drift to stale versions
-# (0.1.1-rc.1 / 0.1.2-alpha.2) that predate the ^0.1.2-alpha.3 ranges the
-# alpha.3 packages declare. Pin the known stragglers to the alpha.3 line the
-# upstream monorepo actually tests against; revisit when upstream fixes its
-# published metadata.
+# The @deepseek-ai/* packages declare their dsh-* siblings as peerDependencies
+# (the DSH host bundle provides them all at mount time), but this repo installs
+# only a subset as direct devDependencies, so the remaining transitive peers
+# resolve to stale copies under pnpm — e.g. dsh-attachment 0.1.1-rc.1, which
+# predates the `admitPromptContent` export that dsh-subagent's artifacts
+# import. Pin those to the alpha line the upstream monorepo tests against.
+# This is a standing shim, not an upstream bug workaround: extend the list
+# (audit with `pnpm peers check`) whenever the DSH baseline is bumped.
 overrides:
   '@deepseek-ai/dsh-attachment': 0.1.2-alpha.3
   '@deepseek-ai/dsh-code-runtime': 0.1.2-alpha.3