@eduwork/dsh-oidc 0.3.0-dev.1 → 0.3.0

package/lib/provider/index.js

@@ -16,9 +16,22 @@ import { AuthorizationScopedAdapter } from './authorization-scope.js'
 export const name = 'dsh-oidc-provider'
 export const inject = ['llm']
 export const SETTINGS_NAMESPACE = ENTERPRISE_SETTINGS_NAMESPACE
+export const Config = PiAiConfig
 
 function installEnterpriseSettings(ctx, rawConfig, hooks) {
   ctx.inject(['settings'], (settingsCtx) => {
+    if (typeof settingsCtx.settings.installSection !== 'function') {
+      // Account-managed routes come from the organization profile and its
+      // authorization lease. Never project them into editable API-key forms.
+      if (rawConfig.settingsEnabled !== true) return
+      if (typeof rawConfig.providers?.get !== 'function' || !ctx.fiber.entry) {
+        throw new Error('Editable enterprise providers require a DSH profile entry with live Config')
+      }
+      settingsCtx.effect(() => settingsCtx.settings.configure({ auto: false }, ctx.fiber))
+      hooks.setSource(() => settingsBase(rawConfig))
+      ctx.on('loader/volatile-update', () => hooks.onChange())
+      return
+    }
     settingsCtx.settings.installSection(
       ctx,
       SETTINGS_NAMESPACE,
@@ -147,14 +160,17 @@ export function apply(ctx, rawConfig = {}) {
     : transforming
   let registration
   let directory
+  const nativeSettings = typeof ctx.get('settings')?.installSection !== 'function'
+  const editableDirectory = !nativeSettings || rawConfig.settingsEnabled === true
+  const settingsNs = nativeSettings ? ctx.fiber.entry?.options.id ?? SETTINGS_NAMESPACE : SETTINGS_NAMESPACE
   const replaceProfiles = next => {
     const previous = profiles
     profiles = next
     try {
       if (registration) registration.replace([...next.keys()])
       else if (next.size) registration = ctx.llm.registerAdapter([...next.keys()], adapter)
-      if (directory) directory.replace(configurableEntries(next))
-      else if (next.size) directory = ctx.llm.registerConfigurableProviders(configurableEntries(next))
+      if (directory) directory.replace(configurableEntries(next, settingsNs))
+      else if (next.size && editableDirectory) directory = ctx.llm.registerConfigurableProviders(configurableEntries(next, settingsNs))
     } catch (error) {
       profiles = previous
       registration?.replace([...previous.keys()])

package/lib/provider/transform-adapter.js

@@ -37,6 +37,10 @@ export class TransformingEnterpriseAdapter {
   providerInfo(provider) { return this.inner.providerInfo(provider) }
   providerRetryPolicy(provider) { return this.inner.providerRetryPolicy(provider) }
   imageRequestPricing(provider, model) { return this.inner.imageRequestPricing(provider, model) }
+  imageRequestTarget(provider, model, image) {
+    return this.inner.imageRequestTarget?.(provider, model, image)
+      ?? { width: image.width, height: image.height, maxBytes: image.bytes }
+  }
 
   async listModels(provider) {
     const models = await this.inner.listModels(provider)

package/lib/resources.js

@@ -1,16 +1,24 @@
 import { normalizeModels } from './profile.js'
+import { MODEL_TYPES } from './model-types.js'
 
-// The public resource contract extends the deployed worker wire protocol. OIDC
-// access tokens remain on the management plane; these calls use the model key.
+// A gateway catalog may also contain embedding, ranking and media models.
+// Type metadata classifies authorized rows; it never grants model access.
 export function normalizeResourceModels(raw, profile) {
   if (!Array.isArray(raw?.data) || raw.data.length > 128) throw new Error('invalid model catalog')
   const reviewed = new Map(profile.provider.models.map(model => [model.id, model]))
   const models = raw.data.map(row => {
     const id = typeof row?.id === 'string' ? row.id.trim() : ''
+    const local = reviewed.get(id)
+    // The current server declaration wins. Local metadata fills an absent type,
+    // but cannot turn an explicit unknown/future server type into a chat model.
+    const type = row.type === undefined
+      ? local?.type ?? 'unknown'
+      : MODEL_TYPES.includes(row.type) ? row.type : 'unknown'
     // A plain /models response does not prove reasoning or vision support.
-    return reviewed.get(id) ?? { id, name: id, input: ['text'], reasoning: false }
+    return { ...(local ?? { id, name: id, input: ['text'], reasoning: false }), type }
   })
-  return normalizeModels(models, profile.provider.id)
+  // Keep the full typed catalog; only the DSH conversation projection uses LLMs.
+  return models.length === 0 ? Object.freeze([]) : normalizeModels(models, profile.provider.id)
 }
 
 export function emptyResources(profile) {

package/lib/token-lifetime.js

@@ -0,0 +1,15 @@
+const ACCESS_REFRESH_SECONDS = 30 * 60
+
+// Refresh early without repeatedly renewing tokens whose entire lifetime is
+// shorter than the normal margin. These timestamps stay in the Host vault.
+export function accessTokenTiming(expiresIn, now) {
+  const expiresAt = Math.floor(now() / 1000) + expiresIn
+  return { expiresAt, refreshAt: expiresAt - Math.min(ACCESS_REFRESH_SECONDS, expiresIn / 2) }
+}
+
+export function accessTokenNeedsRefresh(session, now) {
+  // Existing installations have only expiresAt. Their first refresh adds the
+  // lifetime-aware timestamp; no migration or new sign-in is required.
+  const refreshAt = Number.isFinite(session.refreshAt) ? session.refreshAt : session.expiresAt - ACCESS_REFRESH_SECONDS
+  return now() / 1000 >= Math.min(session.expiresAt, refreshAt)
+}

package/lib/transport.js

@@ -0,0 +1,5 @@
+// One transport rule for configured and discovered service URLs.
+// Callback binding, issuer identity and protocol-specific origin checks are separate.
+export function serviceProtocolAllowed(url, allowInsecureDevelopment = false) {
+  return url.protocol === 'https:' || (allowInsecureDevelopment === true && url.protocol === 'http:')
+}

package/lib/typert-schemas.js

@@ -1,4 +1,5 @@
 import { z } from 'zod'
+import { MODEL_TYPES } from './model-types.js'
 
 const pkg = '@eduwork/dsh-oidc'
 export const profileIdSchema = z.string().min(1).max(64)
@@ -8,11 +9,11 @@ export const baseURLSchema = z.string().min(1).max(2048)
 export const modelCatalogModeSchema = z.enum(['discovery', 'manual'])
 export const configurationTargetSchema = z.enum(['config', 'examples'])
 export const openConfigurationResult = Object.freeze({
-  mode: 'strict', typeSymbol: `${pkg}#OpenConfigurationResult`,
+  mode: 'strict', create() { return this.schema }, typeSymbol: `${pkg}#OpenConfigurationResult`,
   schema: z.object({ opened: z.literal(true) }).strict(),
 })
 export const enterpriseSelectionResult = Object.freeze({
-  mode: 'strict', typeSymbol: `${pkg}#EnterpriseSelectionResult`,
+  mode: 'strict', create() { return this.schema }, typeSymbol: `${pkg}#EnterpriseSelectionResult`,
   schema: z.object({ changed: z.boolean(), selection: z.object({ provider: z.string(), model: z.string(), reasoningEffort: z.string().optional() }).strict().optional() }).strict(),
 })
 export const enterpriseSelectionOptionsSchema = z.object({ onlyIfMissing: z.boolean().optional() }).strict()
@@ -20,7 +21,7 @@ export const enterpriseSelectionOptionsSchema = z.object({ onlyIfMissing: z.bool
 const brandSchema = z.object({
   productName: z.string().optional(), organizationName: z.string().optional(), mark: z.string().optional(),
   logoURL: z.string().optional(), primaryColor: z.string().optional(), loginTitle: z.string().optional(),
-  loginDescription: z.string().optional(), supportURL: z.string().optional(),
+  loginDescription: z.string().optional(), loginButtonLabel: z.string().min(1).max(40).optional(), supportURL: z.string().optional(), language: z.enum(['auto', 'zh-CN', 'en']).optional(),
 }).strict()
 
 const publicProfileSchema = z.object({
@@ -50,11 +51,12 @@ export const runtimeModelSchema = z.object({
 }).strict()
 
 export const runtimeModelsSchema = z.array(runtimeModelSchema).max(128)
+export const resourceModelSchema = runtimeModelSchema.extend({ type: z.enum(MODEL_TYPES) })
 
 export const resourcesResult = Object.freeze({
-  mode: 'strict', typeSymbol: `${pkg}#Resources`,
+  mode: 'strict', create() { return this.schema }, typeSymbol: `${pkg}#Resources`,
   schema: z.object({
-    profileID: z.string(), modelSource: z.string(), models: runtimeModelsSchema, issues: z.array(z.string()),
+    profileID: z.string(), modelSource: z.string(), models: z.array(resourceModelSchema).max(128), issues: z.array(z.string()),
   }).strict(),
 })
 
@@ -69,14 +71,14 @@ const managementProfileSchema = z.object({
 }).strict()
 
 export const configurationResult = Object.freeze({
-  mode: 'strict', typeSymbol: `${pkg}#Configuration`,
+  mode: 'strict', create() { return this.schema }, typeSymbol: `${pkg}#Configuration`,
   schema: z.object({ schemaVersion: z.literal('dsh-oidc/v1alpha1'), uiMode: z.enum(['standard', 'models-only', 'external']), profiles: z.array(publicProfileSchema),
     manageProductBrand: z.boolean().optional(), configFile: z.object({ path: z.string(), examplesPath: z.string(), canOpen: z.boolean() }).strict().optional(),
   }).strict(),
 })
 
 export const managementResult = Object.freeze({
-  mode: 'strict', typeSymbol: `${pkg}#ManagementConfiguration`,
+  mode: 'strict', create() { return this.schema }, typeSymbol: `${pkg}#ManagementConfiguration`,
   schema: z.object({
     schemaVersion: z.literal('dsh-oidc/management/v1alpha1'), mode: z.enum(['profile', 'native']),
     activeProfileID: z.string(), restartRequired: z.boolean(),
@@ -86,14 +88,14 @@ export const managementResult = Object.freeze({
 })
 
 export const restartResult = Object.freeze({
-  mode: 'strict', typeSymbol: `${pkg}#RestartResult`,
+  mode: 'strict', create() { return this.schema }, typeSymbol: `${pkg}#RestartResult`,
   schema: z.object({ restarting: z.literal(true) }).strict(),
 })
 
-export const accountResult = Object.freeze({ mode: 'strict', typeSymbol: `${pkg}#AccountStatus`, schema: accountSchema })
+export const accountResult = Object.freeze({ mode: 'strict', create() { return this.schema }, typeSymbol: `${pkg}#AccountStatus`, schema: accountSchema })
 
 export const beginResult = Object.freeze({
-  mode: 'strict', typeSymbol: `${pkg}#BeginResult`,
+  mode: 'strict', create() { return this.schema }, typeSymbol: `${pkg}#BeginResult`,
   schema: z.union([
     z.object({ mode: z.literal('redirect'), authorizationURL: z.string().url() }).strict(),
     z.object({ mode: z.literal('completed'), status: accountSchema }).strict(),
@@ -102,7 +104,7 @@ export const beginResult = Object.freeze({
 })
 
 export const loginResult = Object.freeze({
-  mode: 'strict', typeSymbol: `${pkg}#LoginResult`,
+  mode: 'strict', create() { return this.schema }, typeSymbol: `${pkg}#LoginResult`,
   schema: z.object({
     loginID: loginIdSchema, profileID: profileIdSchema, expiresAt: z.string().datetime(),
     state: z.enum(['pending', 'completed', 'cancelled', 'expired', 'failed']),
@@ -111,5 +113,5 @@ export const loginResult = Object.freeze({
 })
 
 export function jsonParameter(name, schema, typeSymbol) {
-  return Object.freeze({ name, wire: name, source: 'json', codec: Object.freeze({ mode: 'strict', typeSymbol, schema }) })
+  return Object.freeze({ name, wire: name, source: 'json', codec: Object.freeze({ mode: 'strict', create() { return this.schema }, typeSymbol, schema }) })
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eduwork/dsh-oidc",
-  "version": "0.3.0-dev.1",
+  "version": "0.3.0",
   "description": "Standards-based OIDC identity, token-authorized model access, declarative branding, and OpenAI-compatible model integration for DeepSeek Harness",
   "keywords": [
     "deepseek-harness",
@@ -65,7 +65,8 @@
         "@deepseek-ai/dsh-client-ui-settings-general",
         "@deepseek-ai/dsh-client-ui-settings-models",
         "@deepseek-ai/dsh-client-ui-sidebar",
-        "@deepseek-ai/dsh-client-ui-theme"
+        "@deepseek-ai/dsh-client-ui-theme",
+        "@deepseek-ai/dsh-client-locale"
       ],
       "platform": "web",
       "immediately": true
@@ -90,118 +91,115 @@
     "check:lock": "node scripts/check-dependency-lock.mjs"
   },
   "engines": {
-    "node": ">=22.0.0"
+    "node": ">=24.18.0"
   },
   "publishConfig": {
     "access": "public"
   },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/ecnu/EduWork.git",
+    "url": "git+https://github.com/ECNU/EduWork.git",
     "directory": "packages/dsh-oidc"
   },
   "bugs": {
-    "url": "https://github.com/ecnu/EduWork/issues"
+    "url": "https://github.com/ECNU/EduWork/issues"
   },
-  "homepage": "https://github.com/ecnu/EduWork/tree/main/packages/dsh-oidc#readme",
+  "homepage": "https://github.com/ECNU/EduWork/tree/main/packages/dsh-oidc#readme",
   "license": "MIT",
   "dependencies": {
     "zod": "4.4.3"
   },
   "peerDependencies": {
-    "@deepseek-ai/cordis": "4.0.2",
-    "@deepseek-ai/dsh-api-remotes": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
-    "@deepseek-ai/dsh-attachment": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
-    "@deepseek-ai/dsh-authorization": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
-    "@deepseek-ai/dsh-brand": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-ui-conversation": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-ui-renderer": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-ui-settings": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-ui-settings-general": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-ui-settings-models": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-ui-sidebar": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-ui-theme": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
-    "@deepseek-ai/dsh-credentials": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
-    "@deepseek-ai/dsh-fs": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
-    "@deepseek-ai/dsh-host-webserver": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
-    "@deepseek-ai/dsh-invariants": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
-    "@deepseek-ai/dsh-launch-environment": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
-    "@deepseek-ai/dsh-llm": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
-    "@deepseek-ai/dsh-llm-pi-ai": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
-    "@deepseek-ai/dsh-sandbox": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
-    "@deepseek-ai/dsh-scope": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
-    "@deepseek-ai/dsh-session": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
-    "@deepseek-ai/dsh-settings": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
-    "@deepseek-ai/dsh-timeout": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
-    "@deepseek-ai/dsh-typert-protocol": "0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.3-alpha.2 || 0.1.5-alpha.1 || 0.1.5-rc.1",
-    "@earendil-works/pi-ai": "^0.84.2 || ^0.85.1",
+    "@deepseek-ai/cordis": ">=4.0.5 <4.1.0",
+    "@deepseek-ai/dsh-api-remotes": ">=0.2.1-rc.2 <0.3.0-0",
+    "@deepseek-ai/dsh-attachment": ">=0.2.1-rc.2 <0.3.0-0",
+    "@deepseek-ai/dsh-authorization": ">=0.2.1-rc.2 <0.3.0-0",
+    "@deepseek-ai/dsh-brand": ">=0.2.1-rc.2 <0.3.0-0",
+    "@deepseek-ai/dsh-client-ui-conversation": ">=0.2.1-rc.2 <0.3.0-0",
+    "@deepseek-ai/dsh-client-ui-renderer": ">=0.2.1-rc.2 <0.3.0-0",
+    "@deepseek-ai/dsh-client-ui-settings": ">=0.2.1-rc.2 <0.3.0-0",
+    "@deepseek-ai/dsh-client-ui-settings-general": ">=0.2.1-rc.2 <0.3.0-0",
+    "@deepseek-ai/dsh-client-ui-settings-models": ">=0.2.1-rc.2 <0.3.0-0",
+    "@deepseek-ai/dsh-client-ui-sidebar": ">=0.2.1-rc.2 <0.3.0-0",
+    "@deepseek-ai/dsh-client-ui-theme": ">=0.2.1-rc.2 <0.3.0-0",
+    "@deepseek-ai/dsh-credentials": ">=0.2.1-rc.2 <0.3.0-0",
+    "@deepseek-ai/dsh-fs": ">=0.2.1-rc.2 <0.3.0-0",
+    "@deepseek-ai/dsh-host-webserver": ">=0.2.1-rc.2 <0.3.0-0",
+    "@deepseek-ai/dsh-launch-environment": ">=0.2.1-rc.2 <0.3.0-0",
+    "@deepseek-ai/dsh-llm": ">=0.2.1-rc.2 <0.3.0-0",
+    "@deepseek-ai/dsh-llm-pi-ai": ">=0.2.1-rc.2 <0.3.0-0",
+    "@deepseek-ai/dsh-sandbox": ">=0.2.1-rc.2 <0.3.0-0",
+    "@deepseek-ai/dsh-scope": ">=0.2.1-rc.2 <0.3.0-0",
+    "@deepseek-ai/dsh-session": ">=0.2.1-rc.2 <0.3.0-0",
+    "@deepseek-ai/dsh-settings": ">=0.2.1-rc.2 <0.3.0-0",
+    "@deepseek-ai/dsh-timeout": ">=0.2.1-rc.2 <0.3.0-0",
+    "@deepseek-ai/dsh-typert-protocol": ">=0.2.1-rc.2 <0.3.0-0",
+    "@earendil-works/pi-ai": "^1.1.0",
     "react": "^18.2.0",
-    "react-dom": "^18.2.0"
+    "react-dom": "^18.2.0",
+    "@deepseek-ai/dsh-client-locale": ">=0.2.1-rc.2 <0.3.0-0"
   },
   "devDependencies": {
-    "@deepseek-ai/cordis": "4.0.2",
-    "@deepseek-ai/dsh-agent": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-agent-default-model": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-agent-presets": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-api-gateway": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-api-remotes": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-api-session-controller": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-atomic-write": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-attachment": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-authorization": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-brand": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-chunked-list": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-connection": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-file-upload": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-ui-conversation": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-ui-model-selection": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-ui-renderer": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-ui-settings": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-ui-settings-general": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-ui-settings-models": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-ui-sidebar": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-ui-theme": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-code-runtime": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-commands": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-credentials": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-deque": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-file-reference": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-fs": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-home-paths": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-host-webserver": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-invariants": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-jobs": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-launch-environment": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-llm": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-llm-pi-ai": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-native-command": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-sandbox": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-sandbox-policy": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-scope": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-session": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-session-persistence": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-session-projection": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-session-projection-cache": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-session-query": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-session-title": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-settings": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-skill": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-storage": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-storage-domain": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-subagent": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-system-prompt": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-timeout": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-tool-todo": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-tools": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-typert-protocol": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-typert-registry": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-user-approval": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-util-crypto": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-util-time": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-util-values": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-util-workspace-path": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-workspace": "0.1.5-rc.1",
-    "@earendil-works/pi-ai": "0.85.1",
+    "@deepseek-ai/cordis": "4.0.5",
+    "@deepseek-ai/dsh-agent": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-agent-default-model": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-api-gateway": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-api-remotes": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-api-session-controller": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-atomic-write": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-attachment": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-authorization": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-brand": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-chunked-list": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-client-connection": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-client-file-upload": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-conversation": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-model-selection": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-renderer": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-settings": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-settings-general": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-settings-models": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-sidebar": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-theme": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-commands": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-credentials": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-deque": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-file-reference": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-fs": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-home-paths": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-host-webserver": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-jobs": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-launch-environment": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-llm": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-llm-pi-ai": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-native-command": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-sandbox": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-sandbox-policy": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-scope": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-session": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-session-persistence": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-session-projection": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-session-projection-cache": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-session-query": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-session-title": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-settings": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-skill": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-storage": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-storage-domain": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-subagent": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-system-prompt": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-timeout": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-tool-todo": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-tools": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-typert-protocol": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-typert-registry": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-user-approval": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-util-crypto": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-util-time": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-util-values": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-util-workspace-path": "0.2.1-rc.2",
+    "@deepseek-ai/dsh-workspace": "0.2.1-rc.2",
+    "@earendil-works/pi-ai": "1.1.0",
     "@types/react": "^18.3.28",
     "@types/react-dom": "^18.3.7",
     "ajv": "^8.17.1",
@@ -210,6 +208,15 @@
     "react-dom": "18.3.1",
     "tsdown": "0.22.14",
     "typescript": "^5.9.3",
-    "yaml": "^2.8.1"
+    "yaml": "^2.8.1",
+    "@deepseek-ai/dsh-client-locale": "0.2.1-rc.2",
+    "@deepseek-ai/dsh": "0.2.1-rc.2",
+    "@deepseek-ai/schemastery": "3.18.5",
+    "semver": "7.7.4"
+  },
+  "peerDependenciesMeta": {
+    "@deepseek-ai/dsh-client-locale": {
+      "optional": true
+    }
   }
 }

package/protocol/resources.openapi.yaml

@@ -17,7 +17,7 @@ paths:
       operationId: listResourceModels
       responses:
         '200':
-          description: Available model identifiers; reviewed capabilities remain in the client Profile
+          description: Authorized model identifiers and optional purpose metadata; reviewed capabilities remain in the client Profile
           content:
             application/json:
               schema:
@@ -26,13 +26,21 @@ paths:
                 properties:
                   data:
                     type: array
-                    minItems: 1
+                    minItems: 0
                     maxItems: 128
                     items:
                       type: object
                       required: [id]
                       properties:
                         id: { type: string, minLength: 1, maxLength: 256 }
+                        type:
+                          type: string
+                          description: >-
+                            Optional EduWork purpose extension, independent of input modalities and
+                            the OpenAI object field. Known values are llm, embedding, rerank, image,
+                            tts and unknown. Server declarations take precedence over client Profile
+                            metadata; absent types use Profile metadata. Unsupported or unresolved
+                            types normalize to unknown. Only llm registers for conversation.
         '401': { description: Access Token is invalid or expired }
         '403': { description: Model discovery is not permitted }
         '404': { description: Discovery endpoint is unavailable }
@@ -45,6 +53,6 @@ components:
       headers:
         Retry-After: { schema: { type: string }, description: Seconds or HTTP date for a future retry; never a refresh-token grant }
     Unavailable:
-      description: Temporary resource failure; do not clear identity or the model key
+      description: Temporary resource failure; do not clear identity or a still-valid Access Token
   securitySchemes:
     accessToken: { type: http, scheme: bearer, description: Model runtime credential }

package/schema/enterprise-profile.v1alpha1.schema.json

@@ -53,13 +53,12 @@
     },
     "allowInsecureDevelopment": {
       "type": "boolean",
-      "default": false
+      "default": false,
+      "description": "false (default): HTTPS only. true: allow HTTP service URLs too. Does not change issuer or OAuth validation."
     },
     "insecureDevelopmentOrigin": {
-      "type": "string",
-      "minLength": 8,
-      "maxLength": 2048,
-      "pattern": "^http://"
+      "deprecated": true,
+      "description": "Accepted for older configuration files; ignored. Use allowInsecureDevelopment only."
     },
     "brand": {
       "$ref": "#/$defs/brand"
@@ -167,6 +166,16 @@
             "oauth",
             "oidc"
           ]
+        },
+        "additionalScopes": {
+          "type": "array",
+          "maxItems": 64,
+          "uniqueItems": true,
+          "items": {
+            "type": "string",
+            "maxLength": 128,
+            "pattern": "^[\\u0021\\u0023-\\u005b\\u005d-\\u007e]+$"
+          }
         }
       },
       "allOf": [
@@ -195,6 +204,7 @@
             "properties": {
               "clientId": false,
               "identityMode": false,
+              "additionalScopes": false,
               "discoveryUrl": {
                 "$ref": "#/$defs/secureEndpointURL"
               },
@@ -332,6 +342,11 @@
           "minLength": 1,
           "maxLength": 120
         },
+        "loginButtonLabel": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 40
+        },
         "loginDescription": {
           "type": "string",
           "minLength": 1,
@@ -339,6 +354,14 @@
         },
         "supportURL": {
           "$ref": "#/$defs/httpsURL"
+        },
+        "language": {
+          "enum": [
+            "auto",
+            "zh-CN",
+            "en"
+          ],
+          "type": "string"
         }
       }
     },
@@ -496,6 +519,18 @@
           "minLength": 1,
           "maxLength": 256
         },
+        "type": {
+          "type": "string",
+          "enum": [
+            "llm",
+            "embedding",
+            "rerank",
+            "image",
+            "tts",
+            "unknown"
+          ],
+          "description": "Model purpose, independent of input modalities. Server type takes precedence; local metadata fills absent server types. Missing types resolve to unknown; only llm registers for conversation."
+        },
         "name": {
           "type": "string",
           "minLength": 1,