fix: widen the DSH peer ranges to the tested 0.1.x line / v0.2.0-rc.1

[christianschmidt]

The exact peers on 0.1.0-rc.6 no longer match any current release. Since DeepSeek Harness 0.1.7-rc.1 a preflight evaluates plugin manifests before loading them, so the bundle is refused and web_search/web_fetch never reach Firecrawl:

dsh: skipping profile bundle "@firecrawl/dsh-firecrawl": Error: Plugin @firecrawl/dsh-firecrawl@0.1.0 is incompatible with dsh 0.1.7-rc.1: peerDependencies {"@deepseek-ai/dsh-launch-environment":"0.1.0-rc.6","@deepseek-ai/dsh-web":"0.1.0-rc.6"}.
Running it may cause crashes or data loss. … To accept this risk explicitly, grant the exact-version exemption for @firecrawl/dsh-firecrawl@0.1.0 on dsh 0.1.7-rc.1 with `dsh plugin allow-version` or the plugin manager, then retry the installation or restart dsh.

The profile still boots, so the symptom is a search that quietly no longer uses Firecrawl rather than a failed start.

Change

   "peerDependencies": {
     "@deepseek-ai/cordis": "4.0.1",
-    "@deepseek-ai/dsh-launch-environment": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-web": "0.1.0-rc.6"
+    "@deepseek-ai/dsh-launch-environment": ">=0.1.0-rc.6 <0.1.8-0",
+    "@deepseek-ai/dsh-web": ">=0.1.0-rc.6 <0.1.8-0"
   },

The range admits 0.1.0-rc.6 through 0.1.7 (including the 0.1.7 prereleases and the final release) and stops before 0.1.8, including its prereleases. Three semver details it hinges on, verified against DSH's own comparison (semver.satisfies(..., { includePrerelease: true })):

• ^0.1.7 does not match 0.1.7-rc.1: a prerelease sorts below its release.
• A cap at the prerelease (<=0.1.7-rc.1) would refuse 0.1.7 itself, so the same failure would
  return with the very next release.
• The -0 bound is what keeps 0.1.8-alpha.1 out; a plain <0.1.8 would still admit it. Claiming
  the next minor is a deliberate follow-up release, not a default.

Why no code change

The provider code is unaffected and demonstrably works on the refused runtime:

• The whole DSH-facing surface is ctx.web.registerSearchProvider(...), ctx.web.registerFetchProvider(...), launchEnvironmentOf(ctx) and config on the web/tool-web rows, all present in 0.1.7-rc.1 with the same signatures.
• packages/web and packages/util/launch-environment carry no code change between dsh-v0.1.7-alpha.2 and dsh-v0.1.7-rc.1 (only the version string in each package.json).
• With the peers widened, the bundle composes without a warning on 0.1.7-rc.1 and a real web_search returns Firecrawl results.

Verification

pnpm install --frozen-lockfile && pnpm run check on Node 24: 96 unit tests pass, build, manifest and package guards pass, lockfile unchanged.

Scope

Only the two peer ranges. No runtime code, no tests, no README. devDependencies stay on 0.1.0-rc.6: they are development-only, are not published, and the unit suite exercises the plugin against that runtime. Bumping them to the current line is a separate change (it moves the lockfile and may require test updates). A follow-up can widen the range for 0.1.8 once it is tested, and modernize the credential handling (apiKeyEnv with credential-ref plus a lazy per-request resolver, so a key from the credentials store is visible to the plugin); see the notes in #2.

[christianschmidt]

Heads-up: DeepSeek Harness 0.2.0-rc.1 shipped on 2026-09-28. The range in this PR (<0.1.8-0) stops short of it, so the bundle is refused again, same silent symptom as described in the description, with web_search/web_fetch falling back to other providers while the profile still boots.

I've pushed a second commit widening both peers to >=0.1.0-rc.6 <0.2.1-0. That is a superset of the range proposed here, covering the 0.1.x line and 0.2.0 including its prereleases, not a replacement scoped down to 0.2.0.

Verified against 0.2.0-rc.1: the bundle composes without a compatibility warning and a real web_search returns Firecrawl results. The provider code is untouched; this is still only the two manifest ranges. Capped at <0.2.1-0 rather than <0.3.0-0 for the same reason as before, the next minor is a deliberate follow-up, not a default.