dsh-keepalive v0.2.9
fix: the repair scope resolver previously treated the web profile's official @deepseek-ai/* link: dependencies as user dev checkouts. That made the snapshot copy 38 official packages (large, and wrongly writable by the repair agent) and broke the repair workspace root (install tree vs user code share only the drive letter, so the common parent fell back to the web profile and the agent could not write any link-target source).
Now:
- link:/file: targets whose package.json name starts with @deepseek-ai/ are excluded from link roots, snapshots, and source-edit scope.
- The headless repair agent's workspace root is the common parent of the remaining user dev checkouts (e.g. D:\Code), so the sanctioned minimal source edits (v0.2.8) actually land; writes stay bounded by the snapshot audit.
- The repair prompt names the workspace root and the exact allowed link-target dirs.
Verified end-to-end on a real failure: injected a syntax error into D:\Code\dialog-optimize\index.js -> web boot failed -> repair status page served on :3080 -> headless agent removed the injected line (node --check pass, byte-compared to backup) -> gates passed -> web relaunched and the page redirected back to the UI. Snapshot shrank from 1234 to 436 files.
Tests: new scenario for official-link exclusion (snapshot-rollback: 31 passed), full suite green.