@eduwork/dsh-oidc 0.3.0-dev.1 → 0.3.0

package/CHANGELOG.en.md

@@ -4,6 +4,18 @@
 
 All notable changes are documented here. The format follows Keep a Changelog principles and the project uses Semantic Versioning with pre-1.0 qualifications described in `docs/compatibility.en.md`.
 
+## [0.3.0] — 2026-10-19
+
+- Target DSH 0.2.1-rc.2 and compatible 0.2.x stable Hosts with pi-ai 1.1.0; remove retired DSH dependency declarations.
+- Publish the Web-first OIDC/token-model integration, explicit extension-service authorization and typed model capabilities already used by EduWork.
+- Preserve refresh-token rotation, logout isolation and reasoning replay handling. The removed legacy Key Binding/native backend must be migrated before upgrading.
+
+## [0.3.0-dev.2] - 2026-09-21
+
+- Explicitly allow HTTP test services through the single `allowInsecureDevelopment` flag, disabled by default; HTTPS behavior is unchanged.
+- Accept the legacy `insecureDevelopmentOrigin` field without requiring a duplicate origin setting.
+- Align transport policy across OIDC, OIDC-LLM, LiteLLM and model requests, with documented examples and regression tests.
+
 ## [0.2.0] - 2026-09-11
 
 - Target DSH 0.1.5-rc.1 and keep enterprise identity, managed keys and model integration independent of institution services.

package/CHANGELOG.md

@@ -4,6 +4,18 @@
 
 所有重要变更均记录于此。格式遵循 Keep a Changelog 原则；项目使用语义化版本，并遵循[兼容性与发布策略](docs/compatibility.md)中对 1.0 之前版本的说明。
 
+## [0.3.0] — 2026-10-19
+
+- 适配 DSH 0.2.1-rc.2 与兼容的 0.2.x 正式版，采用 pi-ai 1.1.0，移除已退役的 DSH 依赖声明。
+- 发布已在 EduWork 使用的 Web 优先 OIDC／Token 模型接入、额外服务显式授权及模型能力声明。
+- 保留刷新令牌轮换、退出登录隔离和思考历史回放处理；升级前须迁移已删除的旧 Key Binding/native backend 配置。
+
+## [0.3.0-dev.2] - 2026-09-21
+
+- 使用 `allowInsecureDevelopment` 单一开关显式允许 HTTP 测试服务，默认关闭；HTTPS 行为不变。
+- 兼容读取旧 `insecureDevelopmentOrigin` 字段，但不再要求重复配置地址。
+- 统一 OIDC、OIDC-LLM、LiteLLM 与模型请求的传输策略，并补齐配置示例和回归测试。
+
 ## [0.2.0] - 2026-09-11
 
 - 适配 DSH 0.1.5-rc.1，企业身份、托管 Key 和模型接入独立于机构专属服务。

package/README.md

@@ -6,7 +6,13 @@
 
 当前源码提供 LiteLLM native OAuth 和显式启用的 oidc-llm 0.1 实验接入。两者共用浏览器/loopback、PKCE、Host 会话、刷新、退出与 DSH Provider；模型请求使用当前 Access Token，客户端不再申请或保存机构模型 API Key。个人 API Key 设置独立保留。
 
-本分支尚未发布 npm 或桌面版本；已发布版本的行为以对应版本文档为准。旧 OIDC + Key Binding 配置在本源码中会被明确拒绝，迁移见[旧方案迁移](docs/key-binding-protocol.md)。服务端可继续保留旧接口供旧客户端使用。
+版本 `@eduwork/dsh-oidc@0.3.0` 面向 Node.js 24.18+ 和 DSH 0.2.1-rc.2，可独立安装到本机 DSH Web Profile；Web 后端不依赖 EduWork 桌面桥接。机构模型接入需要部署者提供兼容网关和公开 Profile 配置。
+
+```sh
+dsh plugin --profile web add @eduwork/dsh-oidc@0.3.0
+```
+
+启动 DSH 前，将 `EDUWORK_OIDC_PROFILE` 设为 Profile JSON 文件的绝对路径。默认 bundle 使用 Web 后端；EduWork 桌面用户继续使用发行配置。旧 Key Binding 配置需要先[迁移](docs/key-binding-protocol.md)。
 
 ## 开始接入
 
@@ -15,6 +21,8 @@
 3. 在桌面 Host 使用 backend: desktop，本机 Web 使用 backend: web。仅身份登录仍可使用[纯身份示例](examples/identity-only.example.json)；该模式不提供企业模型。
 4. 登录后自动读取当前授权的模型目录。账户刷新不应覆盖用户后来选择的个人模型。
 
+当前源码按模型 `type` 注册，仅 `llm` 进入对话。服务器只返回 ID 时，升级前须按实际模型 ID 补充 `provider.models[].type`；服务端类型优先，专用及类型未知的模型不进入对话。仅返回 ID 的服务端需同时补齐配置中的模型类型。详见[模型说明](docs/enterprise-profile.md)。
+
 从源码验证：
 
 ~~~sh

package/README_EN.md

@@ -6,7 +6,13 @@ Sign in with an organization and use its authorized models directly.
 
 The current source supports LiteLLM native OAuth and explicitly enabled experimental oidc-llm 0.1. Both reuse browser/loopback transport, PKCE, Host sessions, refresh, logout and the DSH Provider. Model requests use the current Access Token; this client no longer provisions or stores organization model API keys. Personal API-key settings remain independent.
 
-This branch has not been published to npm or a desktop release. Published versions retain their documented behavior. The current source rejects old OIDC + Key Binding profiles; see [migration](docs/key-binding-protocol.en.md). Servers may retain legacy endpoints for older clients.
+Version `@eduwork/dsh-oidc@0.3.0` targets Node.js 24.18+ and DSH 0.2.1-rc.2. It supports a standalone local DSH Web profile; no EduWork desktop bridge is required for that backend. Organization model access requires a compatible gateway and a public profile configured by its operator.
+
+```sh
+dsh plugin --profile web add @eduwork/dsh-oidc@0.3.0
+```
+
+Set `EDUWORK_OIDC_PROFILE` to the absolute path of your profile JSON before starting DSH. The default bundle uses the Web backend. EduWork desktop users continue to use their distribution configuration. Legacy Key Binding profiles require [migration](docs/key-binding-protocol.en.md).
 
 ## Getting started
 
@@ -15,6 +21,8 @@ This branch has not been published to npm or a desktop release. Published versio
 3. Use backend: desktop for desktop Hosts or backend: web for local Web. [Identity-only OIDC](examples/identity-only.example.json) remains available without organization models.
 4. Sign-in discovers the current authorization's model catalog. Passive account refresh must not replace a personal model selected later.
 
+The current source classifies discovered models by `type`; only `llm` enters chat. If the server returns only IDs, supply `provider.models[].type` using actual model IDs before upgrading. Server type metadata takes precedence; specialist and unresolved types remain outside chat. For servers returning only IDs, update the profile model types before enabling the provider. See the [model reference](docs/enterprise-profile.en.md).
+
 Validate from source:
 
 ~~~sh

package/THIRD_PARTY_NOTICES.en.md

@@ -6,8 +6,8 @@
 
 ## Runtime peers (not copied into this repository)
 
-- DeepSeek Harness packages `0.1.5-rc.1` and `@deepseek-ai/cordis` `4.0.2` — MIT, Copyright (c) 2026 DeepSeek, <https://github.com/deepseek-ai/deepseek-harness>
-- `@earendil-works/pi-ai` `0.85.1` — MIT, <https://github.com/earendil-works/pi>
+- DeepSeek Harness packages `0.2.1-rc.2` and `@deepseek-ai/cordis` `4.0.5` — MIT, Copyright (c) 2026 DeepSeek, <https://github.com/deepseek-ai/deepseek-harness>
+- `@earendil-works/pi-ai` `1.1.0` — MIT, <https://github.com/earendil-works/pi>
 - React `18.x` — MIT, Copyright (c) Facebook, Inc. and its affiliates, <https://github.com/facebook/react>
 
 This repository uses public package APIs and does not vendor their source. Their presence as peer dependencies does not imply endorsement of this project.
@@ -44,10 +44,11 @@ Source: <https://github.com/colinhacks/zod>
 
 ## Development-only tools
 
-The lock pins the RC.1 DSH test closure plus tsdown (MIT), TypeScript and Playwright Core (Apache-2.0), Ajv (MIT), YAML (ISC), and React types (MIT). Development tools are not copied into the published runtime files. Playwright Core does not download browser binaries during installation.
+The lock pins the DSH 0.2.1-rc.2 test closure plus tsdown (MIT), TypeScript and Playwright Core (Apache-2.0), Ajv (MIT), YAML (ISC), and React types (MIT). Development tools are not copied into the published runtime files. Playwright Core does not download browser binaries during installation.
 
 The current lock flags two lifecycle scripts: `@google/genai@1.52.0` has an echo-only preinstall; `protobufjs@7.6.6` reads local package manifests and may emit version-scheme warnings. Its reviewed postinstall contains no download or process execution. The local npm allow-scripts policy left these scripts unapproved; review them again when the lock changes. A successful install is not a security-audit result.
 
 `fast-sha256@1.3.0`, reached through pi-ai → Anthropic SDK → standardwebhooks, declares Unlicense. Its distributed LICENSE grants copying, modification and distribution and disclaims warranty. The license check records a package/version-specific exception, not a blanket waiver for unknown licenses; no source is copied into this repository.
 
-The reviewed lock has 260 licensed package entries: 0BSD (1), Apache-2.0 (46), BSD-3-Clause (12), ISC (2), MIT (197), Python-2.0 (1), Unlicense (1). Regenerate this inventory for the final release lock.
+
+The development-only official DSH Host includes LibreOffice Kit (MPL-2.0) and sharp/libvips native packages (Apache-2.0 / LGPL-3.0-or-later). These packages are installed separately for Host tests and are not bundled in this plugin archive; their own license files remain with their packages.

package/THIRD_PARTY_NOTICES.md

@@ -6,8 +6,8 @@
 
 ## 运行时 Peer（源码未复制进本仓库）
 
-- DeepSeek Harness `0.1.5-rc.1` 软件包和 `@deepseek-ai/cordis` `4.0.2`——MIT，Copyright (c) 2026 DeepSeek，<https://github.com/deepseek-ai/deepseek-harness>
-- `@earendil-works/pi-ai` `0.85.1`——MIT，<https://github.com/earendil-works/pi>
+- DeepSeek Harness `0.2.1-rc.2` 软件包和 `@deepseek-ai/cordis` `4.0.5`——MIT，Copyright (c) 2026 DeepSeek，<https://github.com/deepseek-ai/deepseek-harness>
+- `@earendil-works/pi-ai` `1.1.0`——MIT，<https://github.com/earendil-works/pi>
 - React `18.x`——MIT，Copyright (c) Facebook, Inc. and its affiliates，<https://github.com/facebook/react>
 
 本仓库使用这些软件包的公开 API，不 vendor 其源码。它们作为 peer dependency 出现，不表示其作者认可本项目。
@@ -46,10 +46,10 @@ SOFTWARE.
 
 ## 仅开发使用的工具
 
-锁文件固定 RC.1 DSH 测试闭包及 tsdown（MIT）、TypeScript/Playwright Core（Apache-2.0）、Ajv（MIT）、YAML（ISC）、React 类型（MIT）。开发工具不复制到发布的运行文件。Playwright Core 安装时不下载浏览器二进制。
+锁文件固定 DSH 0.2.1-rc.2 测试闭包及 tsdown（MIT）、TypeScript/Playwright Core（Apache-2.0）、Ajv（MIT）、YAML（ISC）、React 类型（MIT）。开发工具不复制到发布的运行文件。Playwright Core 安装时不下载浏览器二进制。
 
-当前锁标记两个生命周期脚本：`@google/genai@1.52.0` 只有 echo 的 preinstall；`protobufjs@7.6.6` 读取本地 package manifest，必要时输出版本约定提醒，所审查 postinstall 没有下载和进程执行。此次本机 npm allow-scripts 策略仍未批准这两项；锁变化后应重新审查。安装成功不代表已完成安全审计。
 
 `fast-sha256@1.3.0` 经 pi-ai → Anthropic SDK → standardwebhooks 引入，声明 Unlicense。已核对其分发 LICENSE 中复制、修改、分发授权与免责条款；许可证检查只为该包的该版本记录例外，不放开其他未知许可证。其源码不复制进本仓库。
 
-当前已审查锁共有 260 个声明许可证的软件包条目：0BSD (1), Apache-2.0 (46), BSD-3-Clause (12), ISC (2), MIT (197), Python-2.0 (1), Unlicense (1)。正式发布锁应重新生成清单。
+
+仅开发使用的官方 DSH Host 包括 LibreOffice Kit（MPL-2.0）与 sharp/libvips 原生包（Apache-2.0 / LGPL-3.0-or-later）。这些包单独安装用于宿主测试，不打入本插件压缩包，许可证随各自的包保留。

package/docs/account-extensions.en.md

@@ -16,7 +16,13 @@ This Host-only method has no Remote decorator and never exposes credentials. It
 
 Logout or reauthorization during response reading invalidates the result. The extension MUST also subscribe to `oidc/accounts-changed` and `credentials/reference-updated`, invalidate its generation, and check that generation after async operations. Abort requests on disposal. The public package does not cache extension data.
 
-For identity-token services, use the separate `authorizedFetch(profileID, endpoint, init)` method with approved origins, token refresh and at most one 401 retry for safe reads; generation is never replayed. See [the public protocol](public-resource-protocol.en.md). Neither transport schedules business requests itself.
+For OAuth Access Token services, use `authorizedFetch(profileID, endpoint, init, authorization?)`. Requests check expiry first and refresh up to 30 minutes early, capped at half the token's advertised lifetime: a ten-minute token refreshes with five minutes remaining. This avoids repeatedly refreshing newly issued short-lived tokens. The refresh timestamp is stored with Host credentials and survives restarts. Older sessions with only an expiry use the default margin until their first refresh adds the timestamp, without requiring sign-in. In `auth` mode, GET/HEAD also refresh and retry at most once after a 401.
+
+Reviewed Host extensions calling an issuer service outside the model API prefix can specify one exact `authorization.issuerServicePath`, for example `/user/active`. Only POST is allowed, on the verified issuer origin and exact path, without queries, fragments, URL credentials or redirects. Path segments accept letters, digits, underscores and hyphens. The Host must fix this value in code rather than forward a renderer or model input; no persistent allowlist changes. The same account refresh, cancellation and response isolation apply. Replayable text bodies may use `retryUnauthorized: true` for at most one retry.
+
+Trusted Host services may pass `{ retryUnauthorized: true }` as the fourth argument for safely repeatable POST requests such as activity heartbeats. The body must be a buffered string or absent, never a stream. This option stays out of HTTP requests and client RPC, and does not broaden the allowed origins or paths. Model generation does not opt in and is never automatically replayed. Normal token rotation or natural expiry within the same authorization does not make the client cancel an active stream; the next request checks authorization again. The refresh margin is not a maximum generation duration or a substitute for correct server handling of long streams. See [the public protocol](public-resource-protocol.en.md). Neither transport schedules business requests itself.
+
+Completed sign-in and sign-out emit `oidc/accounts-changed` with `authorizationChanged: true`, even when both sessions have state `connected`. Extensions must invalidate previous authorization failures and in-flight results instead of deduplicating by state name. Ordinary status polling still notifies only when the state changes.
 
 ## Client account menu
 

package/docs/account-extensions.md

@@ -16,7 +16,13 @@ const response = await ctx.oidcAccounts.modelResourceFetch(profileID, '/quota',
 
 读取响应期间注销或替换 Key 会拒绝结果。扩展还必须在自身层订阅 `oidc/accounts-changed` 和 `credentials/reference-updated`，失效正在请求的账户快照；每次异步操作结束后检查世代编号，不能将旧用户结果写入新用户状态。扩展卸载时中止请求。公版不缓存扩展资源。
 
-需要 OIDC 身份 Token 的机构服务仍用 `authorizedFetch(profileID, endpoint, init)`：它遵循已批准的 origin、令牌刷新及一次 401 重试，与上述模型 Key 运输不同。见 [公共身份与资源协议](public-resource-protocol.md)。这两个方法都不会自动触发业务请求。
+需要 OAuth Access Token 的机构服务使用 `authorizedFetch(profileID, endpoint, init, authorization?)`。请求前检查到期时间，默认提前 30 分钟刷新；提前量不超过该 Token 实际有效期的一半（例如有效期 10 分钟时，剩余 5 分钟开始刷新），避免短有效期 Token 刚获取就反复刷新。刷新时间随凭据保存在 Host，重启后仍生效；只有到期时间的旧会话先按默认余量处理，首次刷新后自动补齐，无须重新登录。`auth` 模式 GET/HEAD 收到 401 后最多刷新并重试一次。
+
+已审查的 Host 扩展如需调用模型 API 前缀之外的发行者服务，可在单次请求的 `authorization.issuerServicePath` 中指定精确路径，例如 `/user/active`。仅允许 POST，目标必须与已验证 issuer 同源且路径完全一致，不接受查询串、片段、URL 凭据和重定向。路径各段只允许字母、数字、下划线和连字符。该选项由 Host 代码固定，不得转发浏览器或模型给出的值；它不修改持久化白名单。请求继续复用账号刷新、取消与响应隔离；可重复的正文可配合 `retryUnauthorized: true` 最多重试一次。
+
+可安全重复提交的机构请求（例如活跃心跳）可显式传入第四个参数 `{ retryUnauthorized: true }`，为 POST 启用相同的一次恢复；请求正文须为已缓冲的字符串或为空，不接受流式正文。该选项只供受信 Host 代码使用，不进入 HTTP 请求或客户端 RPC，也不扩大目标 origin/路径白名单。模型生成请求不启用此选项，不自动重放；同一授权的正常 Token 刷新或自然到期不会由客户端取消已开始的流，下一次请求重新检查授权。刷新提前量不是最长生成时间，也不能替代服务端对长流式请求的正确处理。见 [公共身份与资源协议](public-resource-protocol.md)。这两个方法都不会自动触发业务请求。
+
+成功重新登录或注销会发出带 `authorizationChanged: true` 的 `oidc/accounts-changed` 事件，即使前后 `state` 都是 `connected`。扩展必须清理旧授权的失败状态及在途结果，不能仅按状态名称去重；普通状态轮询仍只在状态变化时发通知。
 
 ## 客户端账户菜单
 

package/docs/compatibility.en.md

@@ -6,7 +6,9 @@ Runtime and DSH compatibility follow package.json, dependency locks and measured
 
 The current source supports LiteLLM native contract 1, explicitly enabled experimental oidc-llm 0.1 and standard identity-only OIDC. oidc-llm remains a draft and is disabled by default.
 
-This branch removes Key Binding model flows and backend: native account bridging; old profiles fail explicitly. New clients use Tokens while servers may retain legacy endpoints for released clients. This breaking change is unpublished. Choose an appropriate new package version and reviewed product locks before publication; never overwrite an existing npm version.
+`@eduwork/dsh-oidc@0.3.0-dev.2` removes Key Binding model flows and backend: native account bridging; old profiles fail explicitly. EduWork `0.3.6-dev.20260921.1` uses this package. New clients use Tokens, so confirm server support and migrate old profiles before upgrading. Servers may retain legacy endpoints for older clients. Future distributions must pin reviewed package versions and product locks; never overwrite an existing npm version.
+
+Current npm 0.3.0 requires Node.js 24.18+ and DSH `>=0.2.1-rc.2 <0.3.0-0`. The tested development baseline is 0.2.1-rc.2; other prerelease lines require separate verification. The default Web backend does not require EduWork desktop bridges.
 
 ## Validation
 

package/docs/compatibility.md

@@ -6,7 +6,9 @@
 
 当前源码支持 LiteLLM native contract 1、显式启用的 oidc-llm 0.1 实验模型接入，以及不附带模型资源的标准 OIDC 身份登录。oidc-llm 尚未定稿，默认关闭。
 
-本分支已删除旧 Key Binding 模型流程和 backend: native 账户桥，旧配置会报错。新客户端使用 Token；服务端可保留旧接口兼容已经发布的老客户端。此次破坏性变更尚未发布，发布前需选择合适的新包版本并同步已审查的产品锁，不能覆盖旧 npm 版本。
+`@eduwork/dsh-oidc@0.3.0-dev.2` 已删除旧 Key Binding 模型流程和 backend: native 账户桥，旧配置会报错；EduWork `0.3.6-dev.20260921.1` 使用此版本。新客户端使用 Token，升级旧配置前应先确认服务端支持并完成迁移；服务端可保留旧接口兼容老客户端。后续发行应固定已审查的包版本与产品锁，不能覆盖旧 npm 版本。
+
+当前 npm 0.3.0 要求 Node.js 24.18+、DSH `>=0.2.1-rc.2 <0.3.0-0`，开发验收基线为 0.2.1-rc.2。其他预发布分支须单独验证。默认 Web backend 不依赖 EduWork 桌面桥接。
 
 ## 验证要求
 

package/docs/development.en.md

@@ -2,7 +2,7 @@
 
 [简体中文](development.md) | **English**
 
-The plugin version is `0.2.3`. Its development baseline is DSH `0.1.5-rc.1`, Cordis `4.0.2`, and pi-ai `0.85.1`. Product versions do not determine plugin versions; consult the registry for npm publication status. Source is maintained in EduWork; migration does not overwrite published npm packages.
+The plugin version is `0.3.0`. Its development baseline is DSH `0.2.1-rc.2`, Cordis `4.0.5`, and pi-ai `1.1.0`. Product versions do not determine plugin versions; consult the registry for npm publication status. Source is maintained in EduWork; migration does not overwrite published npm packages.
 
 ## Verify a clean checkout
 

package/docs/development.md

@@ -2,7 +2,7 @@
 
 **简体中文** | [English](development.en.md)
 
-当前插件版本为 `0.2.3`，开发基线是 DSH `0.1.5-rc.1`、Cordis `4.0.2`、pi-ai `0.85.1`。产品版本不决定插件版本；npm 发布状态以 registry 为准。源码位于 EduWork 的 `packages/dsh-oidc`。
+当前插件版本为 `0.3.0`，开发基线是 DSH `0.2.1-rc.2`、Cordis `4.0.5`、pi-ai `1.1.0`。产品版本不决定插件版本；npm 发布状态以 registry 为准。源码位于 EduWork 的 `packages/dsh-oidc`。
 
 ## 从干净 checkout 验证
 

package/docs/dsh-integration.en.md

@@ -4,7 +4,7 @@
 
 ## Supported host baseline
 
-Current `0.2.0` uses the registry-published DSH `0.1.5-rc.1` development/CI closure. Historical stable `0.1.0` targets `0.1.2-rc.1`; older candidate evidence is recorded separately in the [compatibility matrix](compatibility.en.md). Never mix DSH lines. See [development preparation](development.en.md) for clean installation.
+Current `0.3.0` uses registry-published DSH `0.2.1-rc.2` dependencies for package development/CI; complete EduWork distributions use their product Runtime lock. Do not mix DSH dependency versions. See [compatibility](compatibility.en.md) and [development preparation](development.en.md).
 
 The plugin uses public package exports rather than copied DSH source:
 
@@ -62,10 +62,10 @@ The client descriptor uses strict Zod codecs. Configuration sent to the browser
 
 `dsh-oidc` declares its own default local-Web Bundle patch. Install it directly from npm into the official Web profile without authoring a wrapper Bundle:
 
-Install exact `0.2.0` with a coherent DSH `0.1.5-rc.1` host. If the registry does not yet provide this version during release preparation, use the reviewed source/frozen artifact below.
+Install exact `0.3.0` with the package's declared DSH `0.2.1-rc.2` dependency baseline. EduWork desktop distributions already include the package; desktop users only edit configuration and do not run the plugin installation command below.
 
 ```bash
-dsh plugin --profile web add @eduwork/dsh-oidc@0.2.0
+dsh plugin --profile web add @eduwork/dsh-oidc@0.3.0
 ```
 
 For auditing, development, or validating unpublished changes, install a reviewed local checkout instead:

package/docs/dsh-integration.md

@@ -4,7 +4,7 @@
 
 ## 支持的宿主基线
 
-当前 `0.2.0`以 npm 已发布的 DSH `0.1.5-rc.1` 闭包作为开发/CI 基线。历史稳定版 `0.1.0` 对应 `0.1.2-rc.1`；其他旧候选证据分别记在[兼容性矩阵](compatibility.md)。不要混装 DSH 版本。干净安装见[开发准备](development.md)。
+当前 `0.3.0` 以 npm 已发布的 DSH `0.2.1-rc.2` 依赖作为包开发/CI 基线；完整 EduWork 发行的 Runtime 以产品锁为准。不要混装 DSH 依赖版本。参见[兼容性说明](compatibility.md)和[开发准备](development.md)。
 
 插件只使用公开 package export，不复制 DSH 源码：
 
@@ -62,10 +62,10 @@ Client 描述符使用严格 Zod codec。发送给浏览器的配置不包含 is
 
 `dsh-oidc` 自带默认的 local-Web Bundle patch，可以直接从 npm 安装到官方 Web Profile，无需再编写 wrapper Bundle：
 
-安装精确的 `0.2.0`，宿主 DSH 依赖应统一为 `0.1.5-rc.1`。发布准备期间若 registry 尚未提供该版本，使用下方源码或已核验的冻结产物。
+安装精确的 `0.3.0`，宿主 DSH 依赖应统一为包声明的 `0.2.1-rc.2` 基线。EduWork 桌面发行已装配此包，桌面用户只需编辑配置，无需执行以下插件安装命令。
 
 ```bash
-dsh plugin --profile web add @eduwork/dsh-oidc@0.2.0
+dsh plugin --profile web add @eduwork/dsh-oidc@0.3.0
 ```
 
 需要审计、开发或验证尚未发布的改动时，可以安装经过审查的本地 checkout：

package/docs/enterprise-profile.en.md

@@ -12,6 +12,8 @@ The canonical machine-readable schema is [`schema/enterprise-profile.v1alpha1.sc
 
 ## Trust model
 
+`auth.additionalScopes` explicitly requests additional service scopes for oidc-llm integrations, such as institution search. No additional scopes are requested by default. Each must be advertised in discovery's `scopes_supported`; token and refresh responses must retain the requested scopes. Changing scope configuration requires a new sign-in rather than expanding an existing token's authority.
+
 Profiles are trusted deployment configuration, not user input. Nevertheless, the parser is fail-closed:
 
 - unknown keys are rejected at the root and at every executable-relevant nested object;
@@ -32,8 +34,8 @@ A remote administration system MAY distribute profile JSON only if the host auth
 | `id` | yes | Profile ID matching `^[a-z][a-z0-9-]{0,63}$`. |
 | `displayName` | yes | Human-readable integration name. |
 | `organization` | no | Organization label; defaults to `displayName`. |
-| `allowInsecureDevelopment` | no | Enables loopback HTTP for local development. Network HTTP additionally requires `insecureDevelopmentOrigin`. |
-| `insecureDevelopmentOrigin` | no | Exact non-TLS development origin. It is accepted only together with `allowInsecureDevelopment: true`, and every HTTP OIDC/gateway endpoint must use this exact origin. Never ship it in a production profile. |
+| `allowInsecureDevelopment` | Optional boolean; `false` (default) accepts HTTPS only, `true` also accepts HTTP service URLs. |
+| `insecureDevelopmentOrigin` | Deprecated; accepted in old files but ignored. Omit from new configurations. |
 | `brand` | no | Bounded presentational values. |
 | `oidc` | identity-only | OIDC public-client facts; cannot include auth or provider. |
 | `auth` | models | Full discovery URL; see the gateway guide for explicit protocol fields. |
@@ -51,6 +53,7 @@ Branding changes only approved presentation surfaces. It does not alter authenti
 | `logoURL` | HTTPS URL or base64 PNG/WebP, at most 128 KiB as text. Remote images use `referrerPolicy=no-referrer`. |
 | `primaryColor` | Six-digit hex color. Only a bounded DSH token set is overridden. |
 | `loginTitle` | 120 characters. |
+| `loginButtonLabel` | 40 characters. Sign-in button text in onboarding, settings and the account menu; omitted values use the client's default wording. |
 | `loginDescription` | 500 characters. |
 | `supportURL` | Absolute HTTPS URL opened with `noopener noreferrer`. |
 
@@ -99,6 +102,49 @@ The Provider object is data interpreted by a local audited adapter.
 | `modelSource` | no | Only discovery, the default; fetches /models with the current Access Token. |
 | `models` | no | Reviewed model capabilities; cannot expose models absent from the authorized catalog. |
 
+Model purpose uses `type`: `llm`, `embedding`, `rerank`, `image`, `tts` or `unknown`. Only `llm` registers with the DSH conversation provider. The full resource catalog retains specialist types; media services keep their own model and endpoint configuration. Classifying a model does not enable a service or grant access.
+
+An explicit `data[].type` from the authorized `/models` response takes precedence. When absent, `provider.models[].type` supplies it. Missing, invalid or unsupported server types resolve to `unknown` and stay out of chat; the resources result reports `model_types_unresolved`. The client never guesses purpose from model names, the OpenAI `object` field or input modalities. An image-capable LLM is still `llm`.
+
+Example provider metadata for a gateway returning only model IDs (replace IDs with authorized server IDs):
+
+```json
+{
+  "models": [
+    {
+      "id": "example-chat",
+      "type": "llm"
+    },
+    {
+      "id": "example-vision-chat",
+      "type": "llm",
+      "input": [
+        "text",
+        "image"
+      ]
+    },
+    {
+      "id": "example-embedding",
+      "type": "embedding"
+    },
+    {
+      "id": "example-rerank",
+      "type": "rerank"
+    },
+    {
+      "id": "example-image",
+      "type": "image"
+    },
+    {
+      "id": "example-tts",
+      "type": "tts"
+    }
+  ]
+}
+```
+
+This is an optional EduWork resource extension, not a standard OpenAI field or a claim that existing LiteLLM/oidc-llm servers provide it. ID-only deployments must supply local types before enabling this client behavior. Distribute typed configuration only to upgraded clients: older clients reject unknown model fields. Local declarations are intersected with the authorized server catalog; unavailable IDs are never registered. Personal API-key providers are unchanged.
+
 `retryPolicy.mode` is `normal` or `always`. `always` can retry indefinitely until success, cancellation, or disposal and SHOULD NOT be enabled without an explicit product decision. The policy is validated again by DSH.
 
 `compat` accepts only the keys enumerated in the JSON Schema. Operators MUST describe provider facts accurately; a compatibility override can change request semantics, though it cannot execute code.
@@ -108,6 +154,7 @@ The Provider object is data interpreted by a local audited adapter.
 Each model has:
 
 - required `id`;
+- optional purpose `type`; unresolved types are `unknown` and only `llm` is conversational;
 - optional display `name`;
 - `input` containing `text`, `image`, or both (default `text`);
 - optional positive `contextWindow` and `maxTokens`;

package/docs/enterprise-profile.md

@@ -12,6 +12,8 @@
 
 ## 信任模型
 
+`auth.additionalScopes` 可为 oidc-llm 接入显式申请额外服务授权，例如机构提供的搜索。默认不申请额外范围；每个范围必须出现在 discovery 的 `scopes_supported` 中，Token 与刷新响应必须保持申请的范围。修改授权范围后需要重新登录取得新授权，不扩大已有 Token 权限。
+
 Profile 是受信任的部署配置，不是用户输入。即便如此，解析器仍以失败关闭方式工作：
 
 - 根对象和所有涉及可执行行为的嵌套对象都会拒绝未知字段；
@@ -32,8 +34,8 @@ Profile 是受信任的部署配置，不是用户输入。即便如此，解析
 | `id` | 是 | 匹配 `^[a-z][a-z0-9-]{0,63}$` 的 Profile ID。 |
 | `displayName` | 是 | 面向用户的集成名称。 |
 | `organization` | 否 | 机构名称；默认使用 `displayName`。 |
-| `allowInsecureDevelopment` | 否 | 为本地开发启用 loopback HTTP。网络 HTTP 还必须配置 `insecureDevelopmentOrigin`。 |
-| `insecureDevelopmentOrigin` | 否 | 精确的非 TLS 开发 origin。只有与 `allowInsecureDevelopment: true` 一起使用时才有效，且所有 HTTP OIDC/网关 endpoint 必须使用该 origin。不得放入生产 Profile。 |
+| `allowInsecureDevelopment` | 可选布尔值，默认 `false` 仅接受 HTTPS；`true` 也接受 HTTP 服务地址。 |
+| `insecureDevelopmentOrigin` | 已废弃，仅兼容旧文件；不再参与校验，新配置无需填写。 |
 | `brand` | 否 | 有边界的展示配置。 |
 | `oidc` | 纯身份模式 | OIDC public client 信息，不得同时配置 auth 或 provider。 |
 | `auth` | 模型模式 | 完整发现地址，协议字段见网关指南。 |
@@ -51,6 +53,7 @@ Profile 是受信任的部署配置，不是用户输入。即便如此，解析
 | `logoURL` | HTTPS URL 或 base64 PNG/WebP；文本最多 128 KiB。远程图片使用 `referrerPolicy=no-referrer`。 |
 | `primaryColor` | 六位十六进制颜色；只覆盖一组受限 DSH 主题 token。 |
 | `loginTitle` | 最多 120 字符。 |
+| `loginButtonLabel` | 最多 40 字符。首次登录、设置页和账户菜单的登录按钮文字；省略时使用客户端默认文案。 |
 | `loginDescription` | 最多 500 字符。 |
 | `supportURL` | 使用 `noopener noreferrer` 打开的绝对 HTTPS URL。 |
 
@@ -99,6 +102,49 @@ Provider 对象是由本地、经过审查的 adapter 解释的数据。
 | `modelSource` | 否 | 仅支持 discovery，默认值；使用当前 Access Token 读取 /models。 |
 | `models` | 否 | 已审查的模型能力元数据，不得扩大获授权目录。 |
 
+模型用途用 `type` 区分：`llm`、`embedding`、`rerank`、`image`、`tts` 或 `unknown`。只有 `llm` 注册到 DSH 对话 Provider；完整资源目录保留专用模型分类，媒体服务仍使用各自的模型和接口配置。标注类型不会自动启用服务，也不会扩大授权。
+
+服务端授权目录 `/models` 的 `data[].type` 优先；未提供时使用 `provider.models[].type`。两边都缺失、服务端类型无效或尚不支持时归为 `unknown`，不进入对话，资源结果包含 `model_types_unresolved`。不按模型名称、OpenAI 的 `object` 字段或输入模态猜类型；能看图的 LLM 仍是 `llm`。
+
+只返回模型 ID 的网关可在 Provider 中补充以下元数据（替换为服务端授权的实际 ID）：
+
+```json
+{
+  "models": [
+    {
+      "id": "example-chat",
+      "type": "llm"
+    },
+    {
+      "id": "example-vision-chat",
+      "type": "llm",
+      "input": [
+        "text",
+        "image"
+      ]
+    },
+    {
+      "id": "example-embedding",
+      "type": "embedding"
+    },
+    {
+      "id": "example-rerank",
+      "type": "rerank"
+    },
+    {
+      "id": "example-image",
+      "type": "image"
+    },
+    {
+      "id": "example-tts",
+      "type": "tts"
+    }
+  ]
+}
+```
+
+这是 EduWork 的可选资源扩展，不是 OpenAI 标准字段，也不代表现有 LiteLLM/oidc-llm 服务已提供它。仅返回 ID 的部署必须在启用此客户端行为前补齐本地类型。类型配置只下发给已升级客户端，旧客户端会拒绝未知模型字段。本地声明仍与服务端授权目录取交集，不注册未授权 ID；个人 API Key 提供方不受影响。
+
 `retryPolicy.mode` 可以是 `normal` 或 `always`。`always` 可能一直重试，直到成功、取消或销毁；没有明确产品决策时不应启用。该策略还会由 DSH 再次校验。
 
 `compat` 只接受 JSON Schema 中列出的字段。部署方必须准确描述 Provider 事实；兼容性覆盖可能改变请求语义，但不能执行代码。
@@ -108,6 +154,7 @@ Provider 对象是由本地、经过审查的 adapter 解释的数据。
 每个模型包含：
 
 - 必需的 `id`；
+- 可选用途 `type`；无法确定时为 `unknown`，仅 `llm` 用于对话；
 - 可选显示名称 `name`；
 - `input` 可包含 `text`、`image` 或两者，默认 `text`；
 - 可选的正数 `contextWindow` 和 `maxTokens`；

package/docs/gateway-auth/README.md

@@ -2,17 +2,18 @@
 
 **简体中文** | [English](README_EN.md)
 
-本分支新增 LiteLLM native OAuth 支持，以及默认关闭的 [oidc-llm 实验适配器](experimental-oidc-llm.md)，尚未发布 npm 或桌面版本。仅身份 oidc 配置保留；旧 Key Binding 模型流程已移除，迁移见[说明](../key-binding-protocol.md)。新的 **oidc-llm** 仍是[协议草案](oidc-llm-draft.md)，实验实现不代表协议已定稿。
+LiteLLM native OAuth 和默认关闭的 [oidc-llm 实验适配器](experimental-oidc-llm.md) 已随 `@eduwork/dsh-oidc@0.3.0-dev.2` 发布，并包含在 EduWork `0.3.6-dev.20260921.1` 中。仅身份 oidc 配置保留；旧 Key Binding 模型流程已移除，迁移见[说明](../key-binding-protocol.md)。**oidc-llm** 仍是[协议草案](oidc-llm-draft.md)，实验实现不代表协议已定稿。
 
 ## 选择接入方式
 
-配置已有 LiteLLM 网关请从 [LiteLLM 接入指南](litellm-setup.md)开始；本页描述底层协议和宿主集成要求。
+模型接入有两条路线：机构模型平台可参考 [oidc-llm 草案与实验接入](experimental-oidc-llm.md)，已有 LiteLLM 网关可从 [LiteLLM 接入指南](litellm-setup.md)开始。本页描述底层协议和宿主集成要求。
 
 | 服务端 | 配置 | 模型凭据 | 客户端注册 |
 | --- | --- | --- | --- |
-| 纯身份 OIDC | 仅 oidc，不配置 provider | 无机构模型凭据 | 预注册 public client |
-| LiteLLM 1.101.0 native contract 1 | `auth.discoveryUrl` | 登录返回的 Access Token | 每次登录动态注册实际本机回调 |
 | oidc-llm 0.1 实验 | `auth` + 显式实验开关与身份模式 | Access Token | 已实现预注册 public client |
+| LiteLLM 1.101.0 native contract 1 | `auth.discoveryUrl` | 登录返回的 Access Token | 每次登录动态注册实际本机回调 |
+
+另保留纯身份 OIDC：仅配置 `oidc`，不配置 `provider`，使用预注册 public client。该模式只验证身份、不提供机构模型，故不计入上述两条模型接入路线。oidc-llm 内部的 `oidc` / `oauth` 则是同一草案的身份模式。
 
 LiteLLM 不需要实现 EduWork 的 Key Binding。普通 OIDC 的 Access Token 也不会因为配置了模型 URL 就获得推理权限；须配置明确的 Token 网关契约。配额和团队管理不纳入本次统一协议；LiteLLM 自己的团队选择留在网关网页，客户端仅保存不透明的授权上下文用于防止刷新串号。
 
@@ -32,7 +33,7 @@ LiteLLM 不需要实现 EduWork 的 Key Binding。普通 OIDC 的 Access Token
 }
 ```
 
-`discoveryUrl` 是完整地址，不由客户端猜路径。`expectedIssuer` 可省略，但部署方建议填写；LiteLLM 适配器始终要求 issuer、resource、认证端点与发现地址同源，且 resource 与 issuer 完整字符串一致。生产使用 HTTPS；实验只允许显式设置 `allowInsecureDevelopment: true` 后的 loopback HTTP。不允许通过 `insecureDevelopmentOrigin` 放宽此新协议到任意明文地址。
+`allowInsecureDevelopment` 是唯一的 HTTP 开关，放在企业对象中，与 `auth`/`oidc` 同级；默认 `false` 仅接受 HTTPS，改为 `true` 也接受 HTTP 服务地址。旧 `insecureDevelopmentOrigin` 已废弃并忽略。issuer 身份、资源同源关系及 OAuth/PKCE 校验仍按协议执行。`discoveryUrl` 填完整发现地址，`expectedIssuer` 可选，填写后必须与发现文档完全一致。
 
 `auth` 与 `oidc`、`keyBinding` 互斥；LiteLLM 配置不填写固定 `clientId`、secret、scope 或 `provider.baseURL`。模型 API 基址由已校验的 issuer 追加 `/v1`，保留部署路径前缀。可选 `provider` 支持唯一的 `id`、显示名、上下文/输出限制和经管理员核实的 `models` 能力；只能使用 `modelSource: "discovery"`。模型能否出现由当前账户的 `/v1/models` 决定，配置里的模型信息只是能力补充，不会绕过授权。
 
@@ -159,7 +160,7 @@ POST revocation endpoint，表单 `token=<refresh_token>&client_id=<registered_c
 
 纯身份 OIDC 与 oidc-llm 的 OIDC 模式共用 Discovery issuer、PKCE S256、state、nonce、RS256 ID Token 和 UserInfo sub 一致性校验。Key Binding 与旧凭据引用迁移已移除，模型授权改用网关 Token。相关接口见[服务端契约](../server-integration-contract.md)、[Profile 规范](../enterprise-profile.md)。没有为兼容 LiteLLM 放松这些检查。
 
-新 oidc-llm 的 UserInfo 从发现的 `userinfo_endpoint` 获取，复用标准主体和资料字段。实验配置及实际限制见[实验接入](experimental-oidc-llm.md)，尚待讨论的 scope、生命周期和撤销保证见[草案](oidc-llm-draft.md)。真实服务完成验收前，不迁移已有机构配置。
+oidc-llm 已实现 Token 直连模型与可选的完整 OIDC 身份校验，ChatECNU 是采用该草案的参考部署。配置及客户端边界见[实验接入](experimental-oidc-llm.md)；[草案](oidc-llm-draft.md)明确当前 scopes、静态注册、按服务端有效期提前刷新和退出撤销行为，并将动态注册、刷新家族及长流到期契约列为后续扩展。其他服务仍需单独验收，已有机构配置须显式迁移。
 
 ## 开发验证
 

package/docs/gateway-auth/README_EN.md

@@ -2,17 +2,18 @@
 
 [简体中文](README.md) | **English**
 
-This branch adds LiteLLM native OAuth and an [experimental oidc-llm adapter](experimental-oidc-llm.en.md), disabled by default. Neither is included in a published npm package or desktop Release yet. Identity-only oidc profiles remain supported. Key Binding model flows are removed; see [migration](../key-binding-protocol.en.md). **oidc-llm** remains a [draft](oidc-llm-draft.en.md); the experiment does not finalize the protocol.
+LiteLLM native OAuth and the opt-in [experimental oidc-llm adapter](experimental-oidc-llm.en.md) are published in `@eduwork/dsh-oidc@0.3.0-dev.2` and included in EduWork `0.3.6-dev.20260921.1`. Identity-only oidc profiles remain supported. Key Binding model flows are removed; see [migration](../key-binding-protocol.en.md). **oidc-llm** remains a [draft](oidc-llm-draft.en.md); the experiment does not finalize the protocol.
 
 ## Choose a connection
 
-Start with the [LiteLLM setup guide](litellm-setup.en.md) to configure an existing gateway. This page describes the underlying protocol and Host integration requirements.
+There are two model-access routes: institution model platforms can consult the [oidc-llm draft and experimental adapter](experimental-oidc-llm.en.md); existing LiteLLM deployments can start with the [LiteLLM setup guide](litellm-setup.en.md). This page describes the underlying protocol and Host integration requirements.
 
 | Server | Configuration | Model credential | Client registration |
 | --- | --- | --- | --- |
-| Identity-only OIDC | oidc without provider | No organization model credential | Pre-registered public client |
-| LiteLLM 1.101.0 native contract 1 | `auth.discoveryUrl` | Login Access Token | Dynamically register the actual callback on each login |
 | Experimental oidc-llm 0.1 | `auth` with explicit opt-in and identity mode | Access Token | Static public client implemented |
+| LiteLLM 1.101.0 native contract 1 | `auth.discoveryUrl` | Login Access Token | Dynamically register the actual callback on each login |
+
+Identity-only OIDC is retained separately: configure `oidc` without `provider`, using a pre-registered public client. It authenticates identity without providing institution models, so it is not counted as a third model-access route. The `oidc` and `oauth` options within oidc-llm are identity modes of the same draft.
 
 Quota standardization and team management are outside this integration. LiteLLM handles its own team choice in the gateway page; the adapter retains its opaque authorization context solely to detect an unexpected identity change during refresh. An ordinary OIDC Access Token does not automatically authorize model inference.
 
@@ -32,7 +33,7 @@ In a build containing this feature, add this object to `organizations` in `confi
 }
 ```
 
-See the [complete Profile example](../../examples/litellm.enterprise-profile.example.json). `discoveryUrl` is the complete configured URL. `expectedIssuer` is optional but recommended. Native discovery requires issuer, resource and auth endpoints on the discovery origin; resource must exactly equal issuer. Production uses HTTPS. Explicit `allowInsecureDevelopment: true` permits loopback HTTP only; `insecureDevelopmentOrigin` does not relax this new protocol to arbitrary HTTP hosts.
+`allowInsecureDevelopment` is the only HTTP switch, at the profile root beside `auth`/`oidc`. Its default is `false` (HTTPS only); `true` also accepts HTTP service URLs. `insecureDevelopmentOrigin` is obsolete and ignored. Issuer identity, resource-origin validation and OAuth/PKCE checks still apply. `discoveryUrl` is the complete discovery URL; `expectedIssuer` is optional and pins the exact issuer when provided.
 
 `auth` is mutually exclusive with `oidc` and `keyBinding`. Do not supply a static `clientId`, secret, scopes or `provider.baseURL`. The adapter appends `/v1` to the validated issuer, preserving any deployment prefix. An optional `provider` may supply a distinct `id`, display name, context/output limits and reviewed per-model capabilities in `models`; only `modelSource: "discovery"` is supported. The current account's model list determines visibility. Local model metadata cannot grant access to an absent model.
 
@@ -61,7 +62,7 @@ Model calls bind to the current authorization when prepared. After logout or acc
 
 Identity-only OIDC and the oidc-llm OIDC mode share issuer, PKCE, state, nonce, RS256 ID Token and matching UserInfo subject validation. Key Binding and legacy credential-name migration have been removed; model authorization uses gateway Tokens. See the [existing server contract](../server-integration-contract.md) and [Profile reference](../enterprise-profile.md). These checks were not weakened for LiteLLM.
 
-The oidc-llm adapter discovers `userinfo_endpoint` and reuses standard subject and identity claims. See [experimental integration](experimental-oidc-llm.en.md) for configuration and actual limits. Scope, lifetimes and revocation guarantees remain under review in the [draft](oidc-llm-draft.en.md). Do not migrate an existing institution configuration before real-server acceptance.
+The oidc-llm adapter implements Token-based model access and optional full OIDC identity validation, with ChatECNU as a reference deployment adopting the draft. See [experimental integration](experimental-oidc-llm.en.md) for configuration and client limits. The [draft](oidc-llm-draft.en.md) documents current scopes, static registration, early refresh based on server-provided expiry and logout revocation, while leaving dynamic registration, refresh families and stream behavior at expiry to future contracts. Other servers need separate acceptance, and existing deployments require explicit migration.
 
 ## Validation