The web-editor conflict resolution renamed the cordis snapshot keys to
rc.7 but left the mcp-client importer pointing at the deleted
cordis@4.0.0-rc.6(...rc.4) key, so every CI lane failed at
'pnpm install --frozen-lockfile' with ERR_PNPM_LOCKFILE_MISSING_DEPENDENCY.
Align the mcp-client cordis range with the repo-wide ^4.0.0-rc.7 sweep
from master and re-resolve the lockfile with pnpm.
Master advanced from be363166e to b06e3e9c6 immediately after the lockfile-repair run completed. The new parent change hides internal filesystem implementation helpers and updates its focused tests and generated configuration catalog.
Merge that exact tip so PR #251 remains based on current master rather than publishing an already-behind branch. The filesystem change is disjoint from the managed-environment fix; Git only needed to combine the generated config catalog and did so without a manual semantic choice.
The normal pre-push gate validates the combined documentation, filesystem tests, package surfaces, build, and snapshots before publication.
Master advanced from 5143fac7f to be363166e with the Cordis and loader vendor update after the previous PR merge was validated. GitHub therefore tested a new synthetic merge where packages/util/home still selected Cordis rc.6 with loader rc.4 while the updated workspace graph requires Cordis rc.7 with loader rc.5.
That stale importer made pnpm-lock.yaml semantically incomplete even though Git merged it without a textual conflict, so every Node, sandbox, and real-API job failed during immutable install before running tests. Merge the exact current master tip and regenerate the lockfile so the home package resolves the same peer graph as the updated workspace.
Verified the repaired merge with pnpm install --frozen-lockfile; the full pre-push gate runs on the committed merge before it is published.
The managed DSH_* runtime path was correct, but its public extension and documentation contracts were incomplete. A contributor following the README could access ctx.bashEnv without declaring an injection, the new environment types had no drift-checked catalog entries, and the capability graph omitted three packages that now query sessionPersistence.
Declare the README injection, catalog DshEnvironmentKey and DshEnvironment, and add tool-bash plus both hook bridges to the generated persistence consumer graph. Keep BashEnvRegistry.list() contributor-only for now because no production caller treats it as exhaustive, but record the built-in enumeration gap before diagnostics, prompt, or UI code depends on it.
Validated on the exact resulting tree with typecheck, lint, coverage, snapshot, documentation, module-graph, build, hygiene, demo-smoke, and built-artifact checks.
