@dsh-enhanced/assistant-policy 0.1.12 → 0.1.14

package/README.md

@@ -127,9 +127,9 @@ DSH 原生 `user-approval` 仍只负责 open turn 内的即时询问；本插件
 - 文件系统：创建一个 SQLite 数据库及 WAL/SHM 辅助文件；新目录权限 `0700`，主数据库 `0600`。数据库使用 WAL、`busy_timeout`、外键、FULL synchronous 和前向 schema 版本。
 - 网络：插件不直接打开 socket；启用隔离自动 reviewer 时会调用宿主 `dsh-llm`，所选 provider route 可能使用网络。provider 的认证与传输仍由宿主拥有，本插件不直接读取其凭据。
 - 子进程：无。
-- 凭据：不读取或保存凭据值。审计按敏感 key/value、shell `command`、授权头、token、password、path/cwd 做脱敏，资源 id 仅保存 SHA-256。自动 reviewer 输入只要需要任何 secret 脱敏就失去自动放行资格并转人工。
+- 凭据：运行时的 Policy service 不读取或保存凭据值。审计按敏感 key/value、shell `command`、授权头、token、password、path/cwd 做脱敏，资源 id 仅保存 SHA-256。自动 reviewer 输入只要需要任何 secret 脱敏就失去自动放行资格并转人工。包另附带两个安装期 CLI（`dsh-permission-setup`、`dsh-model-setup`），仅供安装器/部署者手动调用，不在 Cordis 运行时加载：`dsh-permission-setup` 只原子改写 `settings.yaml` 的 `permission.defaultPreset`；`dsh-model-setup` 原子写入 `agent-default-model`（自定义网关另写 `llm-pi-ai.providers.<route>`），并在显式 `--store-key` 时把仅从环境变量读取的 API Key 原子写入 `$DSH_HOME/.credentials.yaml`（`0600`，目录 `0700`），密钥绝不作为命令行参数、缺失时 fail-closed。`dsh-model-setup` 还支持 agent route（如 `traex-agent`）：这类 route 不涉及 API Key，`--enable-in-profile <profile>` 只在该 profile 的 `cordis.patch.yml` 原子改写对应 provider 行的 `enabled`（保留其它行/注释/`!!js`），非 YAML 序列的 patch 会 fail-closed 而非被覆盖。
 - 浏览器：无。
-- 安装脚本：无。
+- 安装脚本：无 npm 生命周期脚本；上述 CLI 仅在被显式调用时运行。
 
 审批展示预算由包根的 frozen `APPROVAL_DISPLAY_BUDGET` 统一公开：Delivery 默认文本上限 64 KiB，summary 最多 120 UTF-8 bytes，diff 最多 60 KiB，预留 4 KiB 给渠道渲染。原始 diff 只在 routed dispatch 仍为 pending 时存在；成功 enqueue、批准、拒绝或过期都会在同一状态事务中清除，v2→v3 迁移也会清除无路由、已 enqueue 和终态记录的遗留原文。业务域仍不得把 credential、token 或其他秘密写进 diff。`proposalMaintenanceIntervalMs` 默认每 15 秒有界地过期 stale proposal，设为 `0` 可关闭，最大值为 `2147483647`。审计是 append-only；当前版本不会自动删除记录，部署者应根据自己的隐私与合规周期备份或轮换整个数据库。SQLite 提供单机多连接并发安全，不承诺多主机共享文件系统上的一致性。
 

package/bin/dsh-model-setup.js

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+
+import { runModelSetup } from '../lib/model-setup.js'
+
+void runModelSetup().catch(error => {
+  process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`)
+  process.exitCode = 1
+})

package/lib/model-setup.d.ts

@@ -0,0 +1,65 @@
+export type ModelApiProtocol = 'openai-completions' | 'openai-responses' | 'anthropic-messages';
+export interface ModelSetupArgs {
+    dshHome: string;
+    provider: string;
+    model: string;
+    apiKeyEnv: string;
+    baseURL?: string;
+    api?: ModelApiProtocol;
+    displayName?: string;
+    storeKey: boolean;
+    keyEnvVar: string;
+    enableInProfile?: string;
+    help: boolean;
+}
+export interface ResolvedModelSetup {
+    dshHome: string;
+    provider: string;
+    model: string;
+    apiKeyEnv: string;
+    kind: 'deepseek' | 'gateway' | 'agent';
+    custom?: {
+        baseURL: string;
+        api: ModelApiProtocol;
+        displayName?: string;
+    };
+    agent?: {
+        rowId: string;
+        packageName: string;
+        requiredConfig: {
+            key: string;
+            value: string;
+            jsExpression: boolean;
+        }[];
+    };
+    storeKey: boolean;
+    keyEnvVar: string;
+    enableInProfile?: string;
+}
+export interface ModelSetupResult {
+    settingsPath: string;
+    credentialsPath?: string;
+    profilePatchPath?: string;
+}
+export declare const DEEPSEEK_OFFICIAL_ROUTE = "deepseek-official";
+export declare const DEFAULT_DEEPSEEK_MODEL = "deepseek-v4-flash";
+export declare const DEFAULT_CUSTOM_API: ModelApiProtocol;
+export declare const DEFAULT_KEY_ENV_VAR = "DSH_ENHANCED_MODEL_API_KEY";
+export interface AgentRouteDefinition {
+    model: string;
+    rowId: string;
+    packageName: string;
+    requiredConfig: {
+        key: string;
+        value: string;
+        jsExpression: boolean;
+    }[];
+}
+export declare const AGENT_ROUTES: Readonly<Record<string, AgentRouteDefinition>>;
+export declare function deriveApiKeyEnv(provider: string): string;
+export declare function parseModelSetupArgs(argv: readonly string[]): ModelSetupArgs;
+export declare function resolveModelSetup(args: ModelSetupArgs): ResolvedModelSetup;
+export declare function applyModelSetup(resolved: ResolvedModelSetup): Promise<ModelSetupResult>;
+export declare function modelSetupUsage(): string;
+export declare function runModelSetup(argv?: string[]): Promise<void>;
+//# sourceMappingURL=model-setup.d.ts.map

package/lib/model-setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-setup.d.ts","sourceRoot":"","sources":["../src/model-setup.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,gBAAgB,GAAG,oBAAoB,GAAG,kBAAkB,GAAG,oBAAoB,CAAA;AAE/F,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,GAAG,CAAC,EAAE,gBAAgB,CAAA;IACtB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,OAAO,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,IAAI,EAAE,OAAO,CAAA;CACd;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,UAAU,GAAG,SAAS,GAAG,OAAO,CAAA;IACtC,MAAM,CAAC,EAAE;QACP,OAAO,EAAE,MAAM,CAAA;QACf,GAAG,EAAE,gBAAgB,CAAA;QACrB,WAAW,CAAC,EAAE,MAAM,CAAA;KACrB,CAAA;IACD,KAAK,CAAC,EAAE;QACN,KAAK,EAAE,MAAM,CAAA;QACb,WAAW,EAAE,MAAM,CAAA;QACnB,cAAc,EAAE;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,OAAO,CAAA;SAAE,EAAE,CAAA;KACxE,CAAA;IACD,QAAQ,EAAE,OAAO,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,MAAM,CAAA;IACpB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,eAAO,MAAM,uBAAuB,sBAAsB,CAAA;AAC1D,eAAO,MAAM,sBAAsB,sBAAsB,CAAA;AACzD,eAAO,MAAM,kBAAkB,EAAE,gBAAuC,CAAA;AACxE,eAAO,MAAM,mBAAmB,+BAA+B,CAAA;AAM/D,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,cAAc,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,OAAO,CAAA;KAAE,EAAE,CAAA;CACxE;AAED,eAAO,MAAM,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAOtE,CAAA;AAiBF,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAKxD;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,cAAc,CAgC3E;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,cAAc,GAAG,kBAAkB,CAgF1E;AAkJD,wBAAsB,eAAe,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAkB7F;AAED,wBAAgB,eAAe,IAAI,MAAM,CAoBxC;AAED,wBAAsB,aAAa,CAAC,IAAI,WAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkC/E"}

package/lib/model-setup.js

@@ -0,0 +1,364 @@
+import { randomUUID } from 'node:crypto';
+import { chmod, mkdir, readFile, rename, writeFile } from 'node:fs/promises';
+import { isAbsolute, join } from 'node:path';
+import { isMap, isSeq, parseDocument, Scalar, YAMLSeq } from 'yaml';
+export const DEEPSEEK_OFFICIAL_ROUTE = 'deepseek-official';
+export const DEFAULT_DEEPSEEK_MODEL = 'deepseek-v4-flash';
+export const DEFAULT_CUSTOM_API = 'openai-completions';
+export const DEFAULT_KEY_ENV_VAR = 'DSH_ENHANCED_MODEL_API_KEY';
+export const AGENT_ROUTES = Object.freeze({
+    'traex-agent': {
+        model: 'default',
+        rowId: 'dsh-enhanced-traex-acp-provider',
+        packageName: '@dsh-enhanced/traex-acp-provider',
+        requiredConfig: [{ key: 'cwd', value: "dshHomePath('assistant-workspace')", jsExpression: true }],
+    },
+});
+const allowedApis = new Set(['openai-completions', 'openai-responses', 'anthropic-messages']);
+// A provider route is a config key; keep it a conservative kebab/snake token.
+const routePattern = /^[A-Za-z][A-Za-z0-9._-]*$/u;
+// A credential reference and the source env var must be POSIX shell identifiers,
+// matching what dsh-credentials-local accepts as a stored key.
+const posixIdentifierPattern = /^[A-Za-z_][A-Za-z0-9_]*$/u;
+// A DSH profile name, matching the installer's own profile validation.
+const profileNamePattern = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/u;
+function argumentValue(argv, index, option) {
+    const value = argv[index + 1];
+    if (value === undefined || value.startsWith('--'))
+        throw new Error(`assistant-policy model setup: ${option} requires a value`);
+    return value;
+}
+export function deriveApiKeyEnv(provider) {
+    if (provider === DEEPSEEK_OFFICIAL_ROUTE)
+        return 'DEEPSEEK_API_KEY';
+    let identifier = provider.toUpperCase().replace(/[^A-Z0-9]/gu, '_');
+    if (!/^[A-Z_]/u.test(identifier))
+        identifier = `_${identifier}`;
+    return identifier.endsWith('_API_KEY') ? identifier : `${identifier}_API_KEY`;
+}
+export function parseModelSetupArgs(argv) {
+    const result = {
+        dshHome: process.env.DSH_HOME ?? join(process.env.HOME ?? '', '.dsh'),
+        provider: DEEPSEEK_OFFICIAL_ROUTE,
+        model: '',
+        apiKeyEnv: '',
+        storeKey: false,
+        keyEnvVar: DEFAULT_KEY_ENV_VAR,
+        help: false,
+    };
+    for (let index = 0; index < argv.length; index += 1) {
+        const option = argv[index];
+        if (option === '--help' || option === '-h') {
+            result.help = true;
+            continue;
+        }
+        if (option === '--store-key') {
+            result.storeKey = true;
+            continue;
+        }
+        if (option === '--dsh-home')
+            result.dshHome = argumentValue(argv, index++, option);
+        else if (option === '--provider')
+            result.provider = argumentValue(argv, index++, option);
+        else if (option === '--model')
+            result.model = argumentValue(argv, index++, option);
+        else if (option === '--api-key-env')
+            result.apiKeyEnv = argumentValue(argv, index++, option);
+        else if (option === '--base-url')
+            result.baseURL = argumentValue(argv, index++, option);
+        else if (option === '--api')
+            result.api = argumentValue(argv, index++, option);
+        else if (option === '--display-name')
+            result.displayName = argumentValue(argv, index++, option);
+        else if (option === '--key-env-var')
+            result.keyEnvVar = argumentValue(argv, index++, option);
+        else if (option === '--enable-in-profile')
+            result.enableInProfile = argumentValue(argv, index++, option);
+        else
+            throw new Error(`assistant-policy model setup: unknown option: ${option}`);
+    }
+    return result;
+}
+export function resolveModelSetup(args) {
+    if (!isAbsolute(args.dshHome))
+        throw new Error('assistant-policy model setup: DSH home must be an absolute path');
+    if (!routePattern.test(args.provider)) {
+        throw new Error('assistant-policy model setup: provider route must start with a letter and use letters, digits, dot, dash, or underscore');
+    }
+    if (args.api !== undefined && !allowedApis.has(args.api)) {
+        throw new Error('assistant-policy model setup: api must be openai-completions, openai-responses, or anthropic-messages');
+    }
+    if (args.enableInProfile !== undefined && !profileNamePattern.test(args.enableInProfile)) {
+        throw new Error('assistant-policy model setup: --enable-in-profile must be a valid profile name');
+    }
+    const apiKeyEnv = args.apiKeyEnv.length > 0 ? args.apiKeyEnv : deriveApiKeyEnv(args.provider);
+    if (!posixIdentifierPattern.test(apiKeyEnv)) {
+        throw new Error('assistant-policy model setup: --api-key-env must be a POSIX shell identifier');
+    }
+    if (!posixIdentifierPattern.test(args.keyEnvVar)) {
+        throw new Error('assistant-policy model setup: --key-env-var must be a POSIX shell identifier');
+    }
+    const agentRoute = AGENT_ROUTES[args.provider];
+    if (agentRoute !== undefined) {
+        // An agent route carries no API key and no gateway transport: it is a local
+        // ACP provider whose credentials and endpoint belong to the coding agent.
+        if (args.baseURL !== undefined || args.api !== undefined || args.displayName !== undefined) {
+            throw new Error(`assistant-policy model setup: --base-url/--api/--display-name do not apply to the agent route ${args.provider}`);
+        }
+        if (args.storeKey) {
+            throw new Error(`assistant-policy model setup: --store-key does not apply to the agent route ${args.provider}; its credentials belong to the local agent`);
+        }
+        return {
+            dshHome: args.dshHome,
+            provider: args.provider,
+            model: args.model.length > 0 ? args.model : agentRoute.model,
+            apiKeyEnv,
+            kind: 'agent',
+            agent: { rowId: agentRoute.rowId, packageName: agentRoute.packageName, requiredConfig: agentRoute.requiredConfig },
+            storeKey: false,
+            keyEnvVar: args.keyEnvVar,
+            ...(args.enableInProfile !== undefined ? { enableInProfile: args.enableInProfile } : {}),
+        };
+    }
+    if (args.enableInProfile !== undefined) {
+        throw new Error('assistant-policy model setup: --enable-in-profile only applies to an agent route');
+    }
+    const base = {
+        dshHome: args.dshHome,
+        provider: args.provider,
+        apiKeyEnv,
+        storeKey: args.storeKey,
+        keyEnvVar: args.keyEnvVar,
+    };
+    if (args.provider === DEEPSEEK_OFFICIAL_ROUTE) {
+        // The built-in deepseek-official route is served by dsh-llm-deepseek, not by
+        // the pi-ai gateway, so transport fields have no place here.  Reject them
+        // instead of writing a provider block that the route would never read.
+        if (args.baseURL !== undefined || args.api !== undefined || args.displayName !== undefined) {
+            throw new Error('assistant-policy model setup: --base-url/--api/--display-name only apply to a custom gateway route, not deepseek-official');
+        }
+        return { ...base, kind: 'deepseek', model: args.model.length > 0 ? args.model : DEFAULT_DEEPSEEK_MODEL };
+    }
+    if (args.model.length === 0) {
+        throw new Error('assistant-policy model setup: a custom gateway route requires --model');
+    }
+    if (args.baseURL === undefined || !/^https?:\/\//u.test(args.baseURL)) {
+        throw new Error('assistant-policy model setup: a custom gateway route requires --base-url starting with http:// or https://');
+    }
+    return {
+        ...base,
+        kind: 'gateway',
+        model: args.model,
+        custom: {
+            baseURL: args.baseURL,
+            api: args.api ?? DEFAULT_CUSTOM_API,
+            ...(args.displayName !== undefined ? { displayName: args.displayName } : {}),
+        },
+    };
+}
+function resolveSecret(resolved) {
+    const candidate = process.env[resolved.keyEnvVar] ?? process.env[resolved.apiKeyEnv];
+    if (candidate === undefined || candidate.trim().length === 0) {
+        throw new Error(`assistant-policy model setup: no API key found; export ${resolved.keyEnvVar} `
+            + `(or ${resolved.apiKeyEnv}) before requesting key storage. The key is never passed as an argument.`);
+    }
+    return candidate;
+}
+async function atomicWriteYaml(path, serialized) {
+    const temporaryPath = `${path}.${randomUUID()}.tmp`;
+    await writeFile(temporaryPath, serialized, { encoding: 'utf8', mode: 0o600 });
+    await chmod(temporaryPath, 0o600);
+    await rename(temporaryPath, path);
+}
+async function loadMappingDocument(path, description) {
+    let source = '';
+    try {
+        source = await readFile(path, 'utf8');
+    }
+    catch (error) {
+        if (!(error instanceof Error) || !('code' in error) || error.code !== 'ENOENT')
+            throw error;
+    }
+    const document = parseDocument(source.length === 0 ? '{}' : source);
+    if (document.errors.length > 0) {
+        throw new Error(`assistant-policy model setup: ${description} is invalid YAML: ${document.errors[0]?.message}`);
+    }
+    if (!isMap(document.contents)) {
+        throw new Error(`assistant-policy model setup: ${description} must contain a YAML mapping`);
+    }
+    // An absent file is parsed from '{}', which yields a flow-style root map that
+    // serializes to a single `{ a: { b: c } }` line. Downstream block-style
+    // readers (the installer's awk agent-default-model parser) expect the key on
+    // its own line, so force block style. Nested maps created via setIn default
+    // to block style already; this only fixes the root of a freshly created file.
+    if (document.contents.flow) {
+        document.contents.flow = false;
+    }
+    return document;
+}
+function jsScalar(value) {
+    const scalar = new Scalar(value);
+    scalar.tag = '!!js';
+    scalar.type = Scalar.PLAIN;
+    return scalar;
+}
+async function writeCredential(dshHome, apiKeyEnv, secret) {
+    const credentialsPath = join(dshHome, '.credentials.yaml');
+    const document = await loadMappingDocument(credentialsPath, '.credentials.yaml');
+    document.set(apiKeyEnv, secret);
+    await mkdir(dshHome, { recursive: true });
+    await atomicWriteYaml(credentialsPath, document.toString({ lineWidth: 0 }));
+    return credentialsPath;
+}
+async function writeSettings(resolved) {
+    const settingsPath = join(resolved.dshHome, 'settings.yaml');
+    const document = await loadMappingDocument(settingsPath, 'settings.yaml');
+    const agentDefault = document.get('agent-default-model', true);
+    if (agentDefault !== undefined && !isMap(agentDefault)) {
+        throw new Error('assistant-policy model setup: settings.agent-default-model must be a YAML mapping');
+    }
+    document.setIn(['agent-default-model', 'provider'], resolved.provider);
+    document.setIn(['agent-default-model', 'model'], resolved.model);
+    if (resolved.custom !== undefined) {
+        const piAi = document.get('llm-pi-ai', true);
+        if (piAi !== undefined && !isMap(piAi)) {
+            throw new Error('assistant-policy model setup: settings.llm-pi-ai must be a YAML mapping');
+        }
+        const base = ['llm-pi-ai', 'providers', resolved.provider];
+        if (resolved.custom.displayName !== undefined) {
+            document.setIn([...base, 'displayName'], resolved.custom.displayName);
+        }
+        document.setIn([...base, 'apiKeyEnv'], resolved.apiKeyEnv);
+        document.setIn([...base, 'api'], resolved.custom.api);
+        document.setIn([...base, 'baseURL'], resolved.custom.baseURL);
+        document.setIn([...base, 'models'], [{ id: resolved.model, name: resolved.model }]);
+    }
+    await mkdir(resolved.dshHome, { recursive: true });
+    await atomicWriteYaml(settingsPath, document.toString({ lineWidth: 0 }));
+    return settingsPath;
+}
+// Flip an agent route's bundle row to enabled:true in the profile's user patch
+// layer, preserving every other row, comment, and !!js expression.  The patch
+// layer is a top-level YAML sequence; a fresh profile may be comment-only (null
+// contents), which we upgrade to an empty sequence.  Any other shape fails
+// closed rather than clobbering an unrecognised document.
+async function enableAgentRouteInProfile(resolved) {
+    const agent = resolved.agent;
+    const patchPath = join(resolved.dshHome, 'profiles', resolved.enableInProfile, 'cordis.patch.yml');
+    let source = '';
+    try {
+        source = await readFile(patchPath, 'utf8');
+    }
+    catch (error) {
+        if (!(error instanceof Error) || !('code' in error) || error.code !== 'ENOENT')
+            throw error;
+    }
+    const document = parseDocument(source.length === 0 ? '' : source);
+    if (document.errors.length > 0) {
+        throw new Error(`assistant-policy model setup: profile patch is invalid YAML: ${document.errors[0]?.message}`);
+    }
+    if (document.contents === null) {
+        document.contents = new YAMLSeq();
+    }
+    else if (!isSeq(document.contents)) {
+        throw new Error('assistant-policy model setup: profile patch must be a top-level YAML sequence of loader entries');
+    }
+    const sequence = document.contents;
+    const existing = sequence.items.find(item => isMap(item) && item.get('id') === agent.rowId);
+    if (existing === undefined) {
+        const created = document.createNode({ id: agent.rowId });
+        const config = document.createNode({ enabled: true });
+        for (const field of agent.requiredConfig) {
+            config.set(field.key, field.jsExpression ? jsScalar(field.value) : field.value);
+        }
+        created.set('config', config);
+        sequence.add(created);
+    }
+    else {
+        const currentConfig = existing.get('config', true);
+        if (currentConfig === undefined || !isMap(currentConfig)) {
+            existing.set('config', document.createNode({}));
+        }
+        existing.setIn(['config', 'enabled'], true);
+        // Re-add required non-defaulted config only when the row is missing it, so
+        // we never overwrite an operator's explicit override.
+        for (const field of agent.requiredConfig) {
+            if (existing.getIn(['config', field.key]) === undefined) {
+                existing.setIn(['config', field.key], field.jsExpression ? jsScalar(field.value) : field.value);
+            }
+        }
+    }
+    await mkdir(join(resolved.dshHome, 'profiles', resolved.enableInProfile), { recursive: true });
+    await atomicWriteYaml(patchPath, document.toString({ lineWidth: 0 }));
+    return patchPath;
+}
+export async function applyModelSetup(resolved) {
+    // Resolve (and fail on) a missing secret before touching any file, so a
+    // stored-key request never leaves settings pointing at an unconfigured route.
+    let credentialsPath;
+    if (resolved.storeKey) {
+        const secret = resolveSecret(resolved);
+        credentialsPath = await writeCredential(resolved.dshHome, resolved.apiKeyEnv, secret);
+    }
+    const settingsPath = await writeSettings(resolved);
+    let profilePatchPath;
+    if (resolved.kind === 'agent' && resolved.enableInProfile !== undefined) {
+        profilePatchPath = await enableAgentRouteInProfile(resolved);
+    }
+    return {
+        settingsPath,
+        ...(credentialsPath !== undefined ? { credentialsPath } : {}),
+        ...(profilePatchPath !== undefined ? { profilePatchPath } : {}),
+    };
+}
+export function modelSetupUsage() {
+    return [
+        'Usage: dsh-model-setup [--dsh-home <absolute-path>] [--provider <route>] [--model <id>]',
+        '                       [--api-key-env <VAR>] [--store-key] [--key-env-var <VAR>]',
+        '                       [--base-url <url>] [--api <openai-completions|openai-responses|anthropic-messages>]',
+        '                       [--display-name <name>] [--enable-in-profile <profile>]',
+        '',
+        'Writes the deployment default model into DSH settings.yaml (section agent-default-model),',
+        'and, for a custom gateway route, its provider profile under section llm-pi-ai.',
+        'With --store-key it also persists the API key into $DSH_HOME/.credentials.yaml (0600).',
+        '',
+        `Agent routes (${Object.keys(AGENT_ROUTES).join(', ')}) carry no API key; they are backed by a local coding`,
+        'agent.  Pass --enable-in-profile <profile> to flip the route bundle row to enabled:true in that',
+        "profile's patch layer.",
+        '',
+        `The key value is read only from the environment variable named by --key-env-var (default ${DEFAULT_KEY_ENV_VAR})`,
+        'or the credential reference; it is never accepted as a command-line argument.',
+        '',
+        `Default provider is ${DEEPSEEK_OFFICIAL_ROUTE} with model ${DEFAULT_DEEPSEEK_MODEL}; a custom route requires --model and --base-url.`,
+    ].join('\n');
+}
+export async function runModelSetup(argv = process.argv.slice(2)) {
+    const args = parseModelSetupArgs(argv);
+    if (args.help) {
+        process.stdout.write(`${modelSetupUsage()}\n`);
+        return;
+    }
+    const resolved = resolveModelSetup(args);
+    const result = await applyModelSetup(resolved);
+    process.stdout.write(`Updated ${result.settingsPath}: agent-default-model provider=${resolved.provider} model=${resolved.model}\n`);
+    if (resolved.custom !== undefined) {
+        process.stdout.write(`Configured llm-pi-ai route ${resolved.provider}: api=${resolved.custom.api} baseURL=${resolved.custom.baseURL} apiKeyEnv=${resolved.apiKeyEnv}\n`);
+    }
+    if (resolved.kind === 'agent') {
+        if (result.profilePatchPath !== undefined) {
+            process.stdout.write(`Enabled agent route ${resolved.provider} (${resolved.agent.rowId}) in ${result.profilePatchPath}\n`);
+        }
+        else {
+            process.stdout.write(`Set agent route ${resolved.provider} as the default model; enable ${resolved.agent.packageName} in the profile `
+                + '(add the bundle and set enabled: true, e.g. via --enable-in-profile) before it can serve requests.\n');
+        }
+        return;
+    }
+    if (result.credentialsPath !== undefined) {
+        process.stdout.write(`Stored API key ${resolved.apiKeyEnv} in ${result.credentialsPath} (value not shown)\n`);
+    }
+    else {
+        process.stdout.write(`API key not stored; ensure the credential reference ${resolved.apiKeyEnv} resolves at runtime (environment or .credentials.yaml).\n`);
+    }
+}
+//# sourceMappingURL=model-setup.js.map

package/lib/model-setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-setup.js","sourceRoot":"","sources":["../src/model-setup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAC5E,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAC5C,OAAO,EAAiB,KAAK,EAAE,KAAK,EAAa,aAAa,EAAE,MAAM,EAAgB,OAAO,EAAE,MAAM,MAAM,CAAA;AA6C3G,MAAM,CAAC,MAAM,uBAAuB,GAAG,mBAAmB,CAAA;AAC1D,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAAmB,CAAA;AACzD,MAAM,CAAC,MAAM,kBAAkB,GAAqB,oBAAoB,CAAA;AACxE,MAAM,CAAC,MAAM,mBAAmB,GAAG,4BAA4B,CAAA;AAa/D,MAAM,CAAC,MAAM,YAAY,GAAmD,MAAM,CAAC,MAAM,CAAC;IACxF,aAAa,EAAE;QACb,KAAK,EAAE,SAAS;QAChB,KAAK,EAAE,iCAAiC;QACxC,WAAW,EAAE,kCAAkC;QAC/C,cAAc,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,oCAAoC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;KAClG;CACF,CAAC,CAAA;AAEF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAmB,CAAC,oBAAoB,EAAE,kBAAkB,EAAE,oBAAoB,CAAC,CAAC,CAAA;AAC/G,8EAA8E;AAC9E,MAAM,YAAY,GAAG,4BAA4B,CAAA;AACjD,iFAAiF;AACjF,+DAA+D;AAC/D,MAAM,sBAAsB,GAAG,2BAA2B,CAAA;AAC1D,uEAAuE;AACvE,MAAM,kBAAkB,GAAG,oCAAoC,CAAA;AAE/D,SAAS,aAAa,CAAC,IAAuB,EAAE,KAAa,EAAE,MAAc;IAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;IAC7B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,MAAM,mBAAmB,CAAC,CAAA;IAC9H,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,IAAI,QAAQ,KAAK,uBAAuB;QAAE,OAAO,kBAAkB,CAAA;IACnE,IAAI,UAAU,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAA;IACnE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,UAAU,GAAG,IAAI,UAAU,EAAE,CAAA;IAC/D,OAAO,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,UAAU,CAAA;AAC/E,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAuB;IACzD,MAAM,MAAM,GAAmB;QAC7B,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,MAAM,CAAC;QACrE,QAAQ,EAAE,uBAAuB;QACjC,KAAK,EAAE,EAAE;QACT,SAAS,EAAE,EAAE;QACb,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,mBAAmB;QAC9B,IAAI,EAAE,KAAK;KACZ,CAAA;IACD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAE,CAAA;QAC3B,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YAC3C,MAAM,CAAC,IAAI,GAAG,IAAI,CAAA;YAClB,SAAQ;QACV,CAAC;QACD,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;YAC7B,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAA;YACtB,SAAQ;QACV,CAAC;QACD,IAAI,MAAM,KAAK,YAAY;YAAE,MAAM,CAAC,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,MAAM,CAAC,CAAA;aAC7E,IAAI,MAAM,KAAK,YAAY;YAAE,MAAM,CAAC,QAAQ,GAAG,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,MAAM,CAAC,CAAA;aACnF,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,CAAC,KAAK,GAAG,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,MAAM,CAAC,CAAA;aAC7E,IAAI,MAAM,KAAK,eAAe;YAAE,MAAM,CAAC,SAAS,GAAG,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,MAAM,CAAC,CAAA;aACvF,IAAI,MAAM,KAAK,YAAY;YAAE,MAAM,CAAC,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,MAAM,CAAC,CAAA;aAClF,IAAI,MAAM,KAAK,OAAO;YAAE,MAAM,CAAC,GAAG,GAAG,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,MAAM,CAAqB,CAAA;aAC7F,IAAI,MAAM,KAAK,gBAAgB;YAAE,MAAM,CAAC,WAAW,GAAG,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,MAAM,CAAC,CAAA;aAC1F,IAAI,MAAM,KAAK,eAAe;YAAE,MAAM,CAAC,SAAS,GAAG,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,MAAM,CAAC,CAAA;aACvF,IAAI,MAAM,KAAK,qBAAqB;YAAE,MAAM,CAAC,eAAe,GAAG,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,MAAM,CAAC,CAAA;;YACnG,MAAM,IAAI,KAAK,CAAC,iDAAiD,MAAM,EAAE,CAAC,CAAA;IACjF,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAoB;IACpD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;IACjH,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,yHAAyH,CAAC,CAAA;IAC5I,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,uGAAuG,CAAC,CAAA;IAC1H,CAAC;IACD,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;QACzF,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAA;IACnG,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC7F,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAA;IACjG,CAAC;IACD,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAA;IACjG,CAAC;IAED,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC9C,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,4EAA4E;QAC5E,0EAA0E;QAC1E,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YAC3F,MAAM,IAAI,KAAK,CAAC,iGAAiG,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;QACnI,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,+EAA+E,IAAI,CAAC,QAAQ,6CAA6C,CAAC,CAAA;QAC5J,CAAC;QACD,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK;YAC5D,SAAS;YACT,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,UAAU,CAAC,WAAW,EAAE,cAAc,EAAE,UAAU,CAAC,cAAc,EAAE;YAClH,QAAQ,EAAE,KAAK;YACf,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,GAAG,CAAC,IAAI,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzF,CAAA;IACH,CAAC;IAED,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAA;IACrG,CAAC;IAED,MAAM,IAAI,GAA0D;QAClE,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,SAAS;QACT,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAA;IAED,IAAI,IAAI,CAAC,QAAQ,KAAK,uBAAuB,EAAE,CAAC;QAC9C,6EAA6E;QAC7E,0EAA0E;QAC1E,uEAAuE;QACvE,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YAC3F,MAAM,IAAI,KAAK,CAAC,2HAA2H,CAAC,CAAA;QAC9I,CAAC;QACD,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,sBAAsB,EAAE,CAAA;IAC1G,CAAC;IAED,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAA;IAC1F,CAAC;IACD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,4GAA4G,CAAC,CAAA;IAC/H,CAAC;IACD,OAAO;QACL,GAAG,IAAI;QACP,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,MAAM,EAAE;YACN,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,kBAAkB;YACnC,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7E;KACF,CAAA;AACH,CAAC;AAED,SAAS,aAAa,CAAC,QAA4B;IACjD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;IACpF,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CACb,0DAA0D,QAAQ,CAAC,SAAS,GAAG;cAC7E,OAAO,QAAQ,CAAC,SAAS,0EAA0E,CACtG,CAAA;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,UAAkB;IAC7D,MAAM,aAAa,GAAG,GAAG,IAAI,IAAI,UAAU,EAAE,MAAM,CAAA;IACnD,MAAM,SAAS,CAAC,aAAa,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC7E,MAAM,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,CAAA;IACjC,MAAM,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,CAAA;AACnC,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,IAAY,EAAE,WAAmB;IAClE,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACvC,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAA;IAC7F,CAAC;IACD,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;IACnE,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,iCAAiC,WAAW,qBAAqB,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;IACjH,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,iCAAiC,WAAW,8BAA8B,CAAC,CAAA;IAC7F,CAAC;IACD,8EAA8E;IAC9E,wEAAwE;IACxE,6EAA6E;IAC7E,4EAA4E;IAC5E,8EAA8E;IAC9E,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC3B,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,KAAK,CAAA;IAChC,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAC7B,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,CAAA;IAChC,MAAM,CAAC,GAAG,GAAG,MAAM,CAAA;IACnB,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,KAAK,CAAA;IAC1B,OAAO,MAAM,CAAA;AACf,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,OAAe,EAAE,SAAiB,EAAE,MAAc;IAC/E,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAA;IAC1D,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAA;IAChF,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;IAC/B,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACzC,MAAM,eAAe,CAAC,eAAe,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;IAC3E,OAAO,eAAe,CAAA;AACxB,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,QAA4B;IACvD,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC,CAAA;IAC5D,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,YAAY,EAAE,eAAe,CAAC,CAAA;IAEzE,MAAM,YAAY,GAAG,QAAQ,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAA;IAC9D,IAAI,YAAY,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,mFAAmF,CAAC,CAAA;IACtG,CAAC;IACD,QAAQ,CAAC,KAAK,CAAC,CAAC,qBAAqB,EAAE,UAAU,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAA;IACtE,QAAQ,CAAC,KAAK,CAAC,CAAC,qBAAqB,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAA;IAEhE,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;QAC5C,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAA;QAC5F,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAU,CAAA;QACnE,IAAI,QAAQ,CAAC,MAAM,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9C,QAAQ,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,EAAE,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;QACvE,CAAC;QACD,QAAQ,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,EAAE,WAAW,CAAC,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAA;QAC1D,QAAQ,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QACrD,QAAQ,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,EAAE,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAC7D,QAAQ,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;IACrF,CAAC;IAED,MAAM,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAClD,MAAM,eAAe,CAAC,YAAY,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;IACxE,OAAO,YAAY,CAAA;AACrB,CAAC;AAED,+EAA+E;AAC/E,8EAA8E;AAC9E,gFAAgF;AAChF,2EAA2E;AAC3E,0DAA0D;AAC1D,KAAK,UAAU,yBAAyB,CAAC,QAA4B;IACnE,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAM,CAAA;IAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,eAAgB,EAAE,kBAAkB,CAAC,CAAA;IACnG,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;IAC5C,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAA;IAC7F,CAAC;IACD,MAAM,QAAQ,GAAa,aAAa,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;IAC3E,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,gEAAgE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;IAChH,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC/B,QAAQ,CAAC,QAAQ,GAAG,IAAI,OAAO,EAAE,CAAA;IACnC,CAAC;SAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,iGAAiG,CAAC,CAAA;IACpH,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAmB,CAAA;IAC7C,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,KAAK,CAAwB,CAAA;IAClH,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,KAAK,EAAE,CAAY,CAAA;QACnE,MAAM,MAAM,GAAG,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAY,CAAA;QAChE,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;YACzC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACjF,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;QAC7B,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACvB,CAAC;SAAM,CAAC;QACN,MAAM,aAAa,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAqB,CAAA;QACtE,IAAI,aAAa,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;YACzD,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;QACjD,CAAC;QACD,QAAQ,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,IAAI,CAAC,CAAA;QAC3C,2EAA2E;QAC3E,sDAAsD;QACtD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;YACzC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;gBACxD,QAAQ,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACjG,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,eAAgB,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/F,MAAM,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;IACrE,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAA4B;IAChE,wEAAwE;IACxE,8EAA8E;IAC9E,IAAI,eAAmC,CAAA;IACvC,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAA;QACtC,eAAe,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;IACvF,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAA;IAClD,IAAI,gBAAoC,CAAA;IACxC,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,IAAI,QAAQ,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QACxE,gBAAgB,GAAG,MAAM,yBAAyB,CAAC,QAAQ,CAAC,CAAA;IAC9D,CAAC;IACD,OAAO;QACL,YAAY;QACZ,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChE,CAAA;AACH,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO;QACL,yFAAyF;QACzF,kFAAkF;QAClF,4GAA4G;QAC5G,gFAAgF;QAChF,EAAE;QACF,2FAA2F;QAC3F,gFAAgF;QAChF,wFAAwF;QACxF,EAAE;QACF,iBAAiB,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,uDAAuD;QAC5G,iGAAiG;QACjG,wBAAwB;QACxB,EAAE;QACF,4FAA4F,mBAAmB,GAAG;QAClH,+EAA+E;QAC/E,EAAE;QACF,uBAAuB,uBAAuB,eAAe,sBAAsB,mDAAmD;KACvI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAA;IACtC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,eAAe,EAAE,IAAI,CAAC,CAAA;QAC9C,OAAM;IACR,CAAC;IACD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAA;IACxC,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAA;IAC9C,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,WAAW,MAAM,CAAC,YAAY,kCAAkC,QAAQ,CAAC,QAAQ,UAAU,QAAQ,CAAC,KAAK,IAAI,CAC9G,CAAA;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAClC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,8BAA8B,QAAQ,CAAC,QAAQ,SAAS,QAAQ,CAAC,MAAM,CAAC,GAAG,YAAY,QAAQ,CAAC,MAAM,CAAC,OAAO,cAAc,QAAQ,CAAC,SAAS,IAAI,CACnJ,CAAA;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC9B,IAAI,MAAM,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;YAC1C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,KAAM,CAAC,KAAK,QAAQ,MAAM,CAAC,gBAAgB,IAAI,CAAC,CAAA;QAC7H,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,mBAAmB,QAAQ,CAAC,QAAQ,iCAAiC,QAAQ,CAAC,KAAM,CAAC,WAAW,kBAAkB;kBAChH,sGAAsG,CACzG,CAAA;QACH,CAAC;QACD,OAAM;IACR,CAAC;IACD,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QACzC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,QAAQ,CAAC,SAAS,OAAO,MAAM,CAAC,eAAe,sBAAsB,CAAC,CAAA;IAC/G,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,uDAAuD,QAAQ,CAAC,SAAS,4DAA4D,CACtI,CAAA;IACH,CAAC;AACH,CAAC"}

package/lib/version.d.ts

@@ -1,2 +1,2 @@
-export declare const version = "0.1.12";
+export declare const version = "0.1.14";
 //# sourceMappingURL=version.d.ts.map

package/lib/version.js

@@ -1,2 +1,2 @@
-export const version = '0.1.12';
+export const version = '0.1.14';
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,13 +1,14 @@
 {
   "name": "@dsh-enhanced/assistant-policy",
-  "version": "0.1.12",
+  "version": "0.1.14",
   "description": "A DeepSeek Harness plugin for Assistant Policy.",
   "license": "MIT",
   "type": "module",
   "main": "./lib/index.js",
   "types": "./lib/index.d.ts",
   "bin": {
-    "dsh-permission-setup": "./bin/dsh-permission-setup.js"
+    "dsh-permission-setup": "./bin/dsh-permission-setup.js",
+    "dsh-model-setup": "./bin/dsh-model-setup.js"
   },
   "exports": {
     ".": {
@@ -19,6 +20,10 @@
       "types": "./lib/permission-setup.d.ts",
       "default": "./lib/permission-setup.js"
     },
+    "./model-setup": {
+      "types": "./lib/model-setup.d.ts",
+      "default": "./lib/model-setup.js"
+    },
     "./package.json": "./package.json"
   },
   "files": [