@eduwork/dsh-oidc 0.3.2 → 0.3.4

package/CHANGELOG.en.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.3.4 — Unreleased
+
+- Support DSH 0.2.2-rc.2 and the qualified 0.2.2 prerelease API family while retaining previously supported hosts.
+
+## 0.3.3 — Unreleased
+
+- Accept qualified DSH 0.2.2-rc.1 and Cordis 4.1 peers, retaining existing behavior, configuration and supported older hosts.
+
 [简体中文](CHANGELOG.md) | **English**
 
 All notable changes are documented here. The format follows Keep a Changelog principles and the project uses Semantic Versioning with pre-1.0 qualifications described in `docs/compatibility.en.md`.

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # 变更日志
 
+## 0.3.4 — Unreleased
+
+- 兼容 DSH 0.2.2-rc.2；将已验证的 0.2.2 预发布 API 系列纳入有界兼容范围，保留原有受支持的宿主。
+- Support DSH 0.2.2-rc.2 and the qualified 0.2.2 prerelease API family while retaining previously supported hosts.
+
+## 0.3.3 — Unreleased
+
+- 兼容声明接纳已验证的 DSH 0.2.2-rc.1 与 Cordis 4.1；保留原有功能、配置及受支持的旧宿主范围。
+- Accept qualified DSH 0.2.2-rc.1 and Cordis 4.1 peers, retaining existing behavior, configuration and supported older hosts.
+
 **简体中文** | [English](CHANGELOG.en.md)
 
 所有重要变更均记录于此。格式遵循 Keep a Changelog 原则；项目使用语义化版本，并遵循[兼容性与发布策略](docs/compatibility.md)中对 1.0 之前版本的说明。

package/CONTRIBUTING.en.md

@@ -53,4 +53,4 @@ Changes to OIDC, Key Binding, credentials, Profile validation, the native accoun
 - `lib/` is generated by `npm run build`; review the source and tarball, not only minified output.
 - Prefer protected tags and the approved Trusted Publishing workflow. Until that path is configured, the initial maintainer may publish the frozen, verified tarball with the npm CLI and browser 2FA, but must not claim provenance. Record provenance only after npm actually creates an attestation.
 
-By participating, contributors agree to follow [`CODE_OF_CONDUCT.en.md`](CODE_OF_CONDUCT.en.md) and certify that they have the right to submit their contribution under the MIT license.
+By participating, contributors agree to follow [`CODE_OF_CONDUCT.en.md`](CODE_OF_CONDUCT.en.md) and certify that they are entitled to submit new original contributions under Mulan PSL v2; historical and third-party code retains its original grants. See [LICENSING.md](LICENSING.md).

package/CONTRIBUTING.md

@@ -53,4 +53,4 @@ npm run check
 - `lib/` 由 `npm run build` 生成；审查源码和 tarball，而不只是压缩产物。
 - 优先通过受保护 tag 和批准的 Trusted Publishing 工作流发布。该流程尚未配置时，初始维护者可以用 npm CLI 和浏览器 2FA 发布已冻结并核验的 tarball，但不得声称 provenance；只有 npm 实际生成 attestation 后才能记录 provenance。
 
-参与贡献即表示同意遵守[行为准则](CODE_OF_CONDUCT.md)，并确认你有权按 MIT 许可证提交相关贡献。
+参与贡献即表示同意遵守[行为准则](CODE_OF_CONDUCT.md)，并确认你有权按木兰宽松许可证第 2 版提交新增原创贡献；历史及第三方代码保留原授权，见 [LICENSING.md](LICENSING.md)。

package/GOVERNANCE.en.md

@@ -38,4 +38,4 @@ The current roster is in [`MAINTAINERS.en.md`](MAINTAINERS.en.md). One maintaine
 
 ## Branding and neutrality
 
-The project may document ECNU as a reference implementation while keeping the protocol institution-neutral. Merging another organization's example does not imply endorsement. Trademarks and logos require their owners' permission and are not granted by the MIT code license.
+The project may document ECNU as a reference implementation while keeping the protocol institution-neutral. Merging another organization's example does not imply endorsement. Trademarks and logos require their owners' permission and are not granted by the code license.

package/GOVERNANCE.md

@@ -38,4 +38,4 @@
 
 ## 品牌与中立性
 
-项目可以记录 ECNU 参考实现，但协议必须保持机构中立。合并其他机构示例不代表背书。商标和 Logo 的使用需要权利人许可，MIT 代码许可证不授予商标权。
+项目可以记录 ECNU 参考实现，但协议必须保持机构中立。合并其他机构示例不代表背书。商标和 Logo 的使用需要权利人许可，代码许可证不授予商标权。

package/LICENSE

@@ -1,21 +1,130 @@
-MIT License
-
-Copyright (c) 2026 dsh-oidc contributors
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+
+木兰宽松许可证, 第2版
+
+木兰宽松许可证， 第2版
+
+2020年1月 http://license.coscl.org.cn/MulanPSL2
+
+您对“软件”的复制、使用、修改及分发受木兰宽松许可证，第2版（“本许可证”）的如下条款的约束：
+
+0.   定义
+
+“软件” 是指由“贡献”构成的许可在“本许可证”下的程序和相关文档的集合。
+
+“贡献” 是指由任一“贡献者”许可在“本许可证”下的受版权法保护的作品。
+
+“贡献者” 是指将受版权法保护的作品许可在“本许可证”下的自然人或“法人实体”。
+
+“法人实体” 是指提交贡献的机构及其“关联实体”。
+
+“关联实体” 是指，对“本许可证”下的行为方而言，控制、受控制或与其共同受控制的机构，此处的控制是指有受控方或共同受控方至少50%直接或间接的投票权、资金或其他有价证券。
+
+1.   授予版权许可
+
+每个“贡献者”根据“本许可证”授予您永久性的、全球性的、免费的、非独占的、不可撤销的版权许可，您可以复制、使用、修改、分发其“贡献”，不论修改与否。
+
+2.   授予专利许可
+
+每个“贡献者”根据“本许可证”授予您永久性的、全球性的、免费的、非独占的、不可撤销的（根据本条规定撤销除外）专利许可，供您制造、委托制造、使用、许诺销售、销售、进口其“贡献”或以其他方式转移其“贡献”。前述专利许可仅限于“贡献者”现在或将来拥有或控制的其“贡献”本身或其“贡献”与许可“贡献”时的“软件”结合而将必然会侵犯的专利权利要求，不包括对“贡献”的修改或包含“贡献”的其他结合。如果您或您的“关联实体”直接或间接地，就“软件”或其中的“贡献”对任何人发起专利侵权诉讼（包括反诉或交叉诉讼）或其他专利维权行动，指控其侵犯专利权，则“本许可证”授予您对“软件”的专利许可自您提起诉讼或发起维权行动之日终止。
+
+3.   无商标许可
+
+“本许可证”不提供对“贡献者”的商品名称、商标、服务标志或产品名称的商标许可，但您为满足第4条规定的声明义务而必须使用除外。
+
+4.   分发限制
+
+您可以在任何媒介中将“软件”以源程序形式或可执行形式重新分发，不论修改与否，但您必须向接收者提供“本许可证”的副本，并保留“软件”中的版权、商标、专利及免责声明。
+
+5.   免责声明与责任限制
+
+“软件”及其中的“贡献”在提供时不带任何明示或默示的担保。在任何情况下，“贡献者”或版权所有者不对任何人因使用“软件”或其中的“贡献”而引发的任何直接或间接损失承担责任，不论因何种原因导致或者基于何种法律理论，即使其曾被建议有此种损失的可能性。
+
+6.   语言
+
+“本许可证”以中英文双语表述，中英文版本具有同等法律效力。如果中英文版本存在任何冲突不一致，以中文版为准。
+
+条款结束
+
+如何将木兰宽松许可证，第2版，应用到您的软件
+
+如果您希望将木兰宽松许可证，第2版，应用到您的新软件，为了方便接收者查阅，建议您完成如下三步：
+
+1， 请您补充如下声明中的空白，包括软件名、软件的首次发表年份以及您作为版权人的名字；
+
+2， 请您在软件包的一级目录下创建以“LICENSE”为名的文件，将整个许可证文本放入该文件中；
+
+3， 请将如下声明文本放入每个源文件的头部注释中。
+
+Copyright (c) [Year] [name of copyright holder]
+[Software Name] is licensed under Mulan PSL v2.
+You can use this software according to the terms and conditions of the Mulan PSL v2.
+You may obtain a copy of Mulan PSL v2 at:
+         http://license.coscl.org.cn/MulanPSL2
+THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND,
+EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO NON-INFRINGEMENT,
+MERCHANTABILITY OR FIT FOR A PARTICULAR PURPOSE.
+See the Mulan PSL v2 for more details.
+
+Mulan Permissive Software License，Version 2
+
+Mulan Permissive Software License，Version 2 (Mulan PSL v2)
+
+January 2020 http://license.coscl.org.cn/MulanPSL2
+
+Your reproduction, use, modification and distribution of the Software shall be subject to Mulan PSL v2 (this License) with the following terms and conditions:
+
+0. Definition
+
+Software means the program and related documents which are licensed under this License and comprise all Contribution(s).
+
+Contribution means the copyrightable work licensed by a particular Contributor under this License.
+
+Contributor means the Individual or Legal Entity who licenses its copyrightable work under this License.
+
+Legal Entity means the entity making a Contribution and all its Affiliates.
+
+Affiliates means entities that control, are controlled by, or are under common control with the acting entity under this License, ‘control’ means direct or indirect ownership of at least fifty percent (50%) of the voting power, capital or other securities of controlled or commonly controlled entity.
+
+1. Grant of Copyright License
+
+Subject to the terms and conditions of this License, each Contributor hereby grants to you a perpetual, worldwide, royalty-free, non-exclusive, irrevocable copyright license to reproduce, use, modify, or distribute its Contribution, with modification or not.
+
+2. Grant of Patent License
+
+Subject to the terms and conditions of this License, each Contributor hereby grants to you a perpetual, worldwide, royalty-free, non-exclusive, irrevocable (except for revocation under this Section) patent license to make, have made, use, offer for sale, sell, import or otherwise transfer its Contribution, where such patent license is only limited to the patent claims owned or controlled by such Contributor now or in future which will be necessarily infringed by its Contribution alone, or by combination of the Contribution with the Software to which the Contribution was contributed. The patent license shall not apply to any modification of the Contribution, and any other combination which includes the Contribution. If you or your Affiliates directly or indirectly institute patent litigation (including a cross claim or counterclaim in a litigation) or other patent enforcement activities against any individual or entity by alleging that the Software or any Contribution in it infringes patents, then any patent license granted to you under this License for the Software shall terminate as of the date such litigation or activity is filed or taken.
+
+3. No Trademark License
+
+No trademark license is granted to use the trade names, trademarks, service marks, or product names of Contributor, except as required to fulfill notice requirements in section 4.
+
+4. Distribution Restriction
+
+You may distribute the Software in any medium with or without modification, whether in source or executable forms, provided that you provide recipients with a copy of this License and retain copyright, patent, trademark and disclaimer statements in the Software.
+
+5. Disclaimer of Warranty and Limitation of Liability
+
+THE SOFTWARE AND CONTRIBUTION IN IT ARE PROVIDED WITHOUT WARRANTIES OF ANY KIND, EITHER EXPRESS OR IMPLIED. IN NO EVENT SHALL ANY CONTRIBUTOR OR COPYRIGHT HOLDER BE LIABLE TO YOU FOR ANY DAMAGES, INCLUDING, BUT NOT LIMITED TO ANY DIRECT, OR INDIRECT, SPECIAL OR CONSEQUENTIAL DAMAGES ARISING FROM YOUR USE OR INABILITY TO USE THE SOFTWARE OR THE CONTRIBUTION IN IT, NO MATTER HOW IT’S CAUSED OR BASED ON WHICH LEGAL THEORY, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
+
+6. Language
+
+THIS LICENSE IS WRITTEN IN BOTH CHINESE AND ENGLISH, AND THE CHINESE VERSION AND ENGLISH VERSION SHALL HAVE THE SAME LEGAL EFFECT. IN THE CASE OF DIVERGENCE BETWEEN THE CHINESE AND ENGLISH VERSIONS, THE CHINESE VERSION SHALL PREVAIL.
+
+END OF THE TERMS AND CONDITIONS
+
+How to Apply the Mulan Permissive Software License，Version 2 (Mulan PSL v2) to Your Software
+
+To apply the Mulan PSL v2 to your work, for easy identification by recipients, you are suggested to complete following three steps:
+
+i. Fill in the blanks in following statement, including insert your software name, the year of the first publication of your software, and your name identified as the copyright owner;
+ii. Create a file named "LICENSE" which contains the whole context of this License in the first directory of your software package;
+iii. Attach the statement to the appropriate annotated syntax at the beginning of each source file.
+
+Copyright (c) [Year] [name of copyright holder]
+[Software Name] is licensed under Mulan PSL v2.
+You can use this software according to the terms and conditions of the Mulan PSL v2.
+You may obtain a copy of Mulan PSL v2 at:
+         http://license.coscl.org.cn/MulanPSL2
+THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND,
+EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO NON-INFRINGEMENT,
+MERCHANTABILITY OR FIT FOR A PARTICULAR PURPOSE.
+See the Mulan PSL v2 for more details.

package/LICENSE-MIT

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 dsh-oidc contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/LICENSING.en.md

@@ -0,0 +1,11 @@
+# Licensing scope
+
+[简体中文](LICENSING.md) | **English**
+
+The primary license for this directory is Mulan Permissive Software License v2 (`MulanPSL-2.0`); see [LICENSE](LICENSE). This policy applies to new original project contributions after the commit introducing this notice. More specific file, directory, and third-party notices retain their own terms.
+
+The [pre-transition MIT source baseline](https://github.com/ECNU/EduWork/tree/a43a4d424c9d25668589dfe94a3871318ce299ff/packages/dsh-oidc) retains its original MIT grants and rightsholders; the complete notice is preserved in [LICENSE-MIT](LICENSE-MIT). Attribution in Git history and existing notices remains effective. An institutional copyright notice does not assign other contributors' copyrights. Previously distributed versions and npm archives keep their existing licenses.
+
+Distributions combining new Mulan-licensed contributions and historical MIT code must retain both licenses and their notices. The source-module SPDX expression `MulanPSL-2.0 AND MIT` describes these separately licensed portions, not a choice of license for all code. This change does not make historical MIT contributors grant additional patent rights under Mulan.
+
+New original contributions are submitted under MulanPSL-2.0 by contributors entitled to grant the relevant copyright and patent rights. Third-party code retains its existing license and provenance. No trademark or artwork permission is inferred from this code-license policy.

package/LICENSING.md

@@ -0,0 +1,11 @@
+# 许可范围
+
+**简体中文** | [English](LICENSING.en.md)
+
+本目录的主许可证为木兰宽松许可证第 2 版（`MulanPSL-2.0`），全文见 [LICENSE](LICENSE)。许可切换以引入本说明的提交为界，面向此后的项目原创贡献；文件、子目录或第三方声明另有规定的，按其独立许可执行。
+
+切换前的 MIT 源码基线见 [@eduwork/dsh-oidc 历史源码](https://github.com/ECNU/EduWork/tree/a43a4d424c9d25668589dfe94a3871318ce299ff/packages/dsh-oidc)。该基线中的贡献仍保留原 MIT 授权及权利人，原许可全文保留在 [LICENSE-MIT](LICENSE-MIT)。历史 Git 记录和已有文件声明中的作者归属继续有效；根目录的机构版权声明不表示其他贡献者转让了版权。既有版本及 npm 发布包不因本次切换改变许可。
+
+后续分发如果同时包含木兰许可贡献与历史 MIT 代码，须保留两份许可证及相关声明。因此对应源码模块的 SPDX 表达式为 `MulanPSL-2.0 AND MIT`，表示不同来源代码各自适用的义务，并非所有代码可任选一种许可。历史 MIT 贡献者不会仅因本次切换被视为作出了新的木兰专利授权。
+
+新增原创贡献按木兰许可提交；投稿者应确认自己有权授予其贡献中涉及的版权和专利许可。引入的第三方代码继续保留原许可证、版权及来源，不适用此默认规则。

package/THIRD_PARTY_NOTICES.en.md

@@ -2,11 +2,11 @@
 
 [简体中文](THIRD_PARTY_NOTICES.md) | **English**
 
-`dsh-oidc` is MIT-licensed and interoperates with the following directly declared packages. Exact versions are recorded in `package-lock.json`; transitive dependency license files remain in their distributed packages.
+`dsh-oidc` uses Mulan PSL v2 for original contributions and preserves historical MIT grants ([scope](LICENSING.md)) and interoperates with the following directly declared packages. Exact versions are recorded in `package-lock.json`; transitive dependency license files remain in their distributed packages.
 
 ## Runtime peers (not copied into this repository)
 
-- DeepSeek Harness packages `0.2.1-rc.2` and `@deepseek-ai/cordis` `4.0.5` — MIT, Copyright (c) 2026 DeepSeek, <https://github.com/deepseek-ai/deepseek-harness>
+- DeepSeek Harness packages and `@deepseek-ai/cordis` — MIT; development baseline `0.2.2-rc.2` / `4.1.0`, with supported host ranges in `package.json`. Copyright (c) 2026 DeepSeek, <https://github.com/deepseek-ai/deepseek-harness>
 - `@earendil-works/pi-ai` `1.1.0` — MIT, <https://github.com/earendil-works/pi>
 - React `18.x` — MIT, Copyright (c) Facebook, Inc. and its affiliates, <https://github.com/facebook/react>
 
@@ -44,11 +44,10 @@ Source: <https://github.com/colinhacks/zod>
 
 ## Development-only tools
 
-The lock pins the DSH 0.2.1-rc.2 test closure plus tsdown (MIT), TypeScript and Playwright Core (Apache-2.0), Ajv (MIT), YAML (ISC), and React types (MIT). Development tools are not copied into the published runtime files. Playwright Core does not download browser binaries during installation.
+The lock pins the DSH 0.2.2-rc.2 test closure plus tsdown (MIT), TypeScript and Playwright Core (Apache-2.0), Ajv (MIT), YAML (ISC), and React types (MIT). Development tools are not copied into the published runtime files. Playwright Core does not download browser binaries during installation.
 
-The current lock flags two lifecycle scripts: `@google/genai@1.52.0` has an echo-only preinstall; `protobufjs@7.6.6` reads local package manifests and may emit version-scheme warnings. Its reviewed postinstall contains no download or process execution. The local npm allow-scripts policy left these scripts unapproved; review them again when the lock changes. A successful install is not a security-audit result.
 
 `fast-sha256@1.3.0`, reached through pi-ai → Anthropic SDK → standardwebhooks, declares Unlicense. Its distributed LICENSE grants copying, modification and distribution and disclaims warranty. The license check records a package/version-specific exception, not a blanket waiver for unknown licenses; no source is copied into this repository.
 
 
-The development-only official DSH Host includes LibreOffice Kit (MPL-2.0) and sharp/libvips native packages (Apache-2.0 / LGPL-3.0-or-later). These packages are installed separately for Host tests and are not bundled in this plugin archive; their own license files remain with their packages.
+The development-only official DSH Host includes LibreOffice Kit 0.2.3 (MPL-2.0), sharp/libvips native packages (Apache-2.0 / LGPL-3.0-or-later), and lru-cache 11.5.3 ([Blue Oak Model License 1.0.0](https://blueoakcouncil.org/license/1.0.0)). These packages are installed separately for Host tests and are not bundled in this plugin archive; their own license files remain with their packages. Checks accept only the reviewed development-dependency versions.

package/THIRD_PARTY_NOTICES.md

@@ -2,11 +2,11 @@
 
 **简体中文** | [English](THIRD_PARTY_NOTICES.en.md)
 
-`dsh-oidc` 使用 MIT 许可证，并与以下直接声明的软件包互操作。精确版本记录在 `package-lock.json` 中；间接依赖的许可证文件保留在各自发布包内。
+`dsh-oidc` 的原创贡献使用木兰 PSL v2，历史 MIT 授权保留，详见 [许可范围](LICENSING.md)，并与以下直接声明的软件包互操作。精确版本记录在 `package-lock.json` 中；间接依赖的许可证文件保留在各自发布包内。
 
 ## 运行时 Peer（源码未复制进本仓库）
 
-- DeepSeek Harness `0.2.1-rc.2` 软件包和 `@deepseek-ai/cordis` `4.0.5`——MIT，Copyright (c) 2026 DeepSeek，<https://github.com/deepseek-ai/deepseek-harness>
+- DeepSeek Harness 软件包和 `@deepseek-ai/cordis`——MIT；开发基线为 `0.2.2-rc.2` / `4.1.0`，支持的宿主范围见 `package.json`。Copyright (c) 2026 DeepSeek，<https://github.com/deepseek-ai/deepseek-harness>
 - `@earendil-works/pi-ai` `1.1.0`——MIT，<https://github.com/earendil-works/pi>
 - React `18.x`——MIT，Copyright (c) Facebook, Inc. and its affiliates，<https://github.com/facebook/react>
 
@@ -46,10 +46,10 @@ SOFTWARE.
 
 ## 仅开发使用的工具
 
-锁文件固定 DSH 0.2.1-rc.2 测试闭包及 tsdown（MIT）、TypeScript/Playwright Core（Apache-2.0）、Ajv（MIT）、YAML（ISC）、React 类型（MIT）。开发工具不复制到发布的运行文件。Playwright Core 安装时不下载浏览器二进制。
+锁文件固定 DSH 0.2.2-rc.2 测试闭包及 tsdown（MIT）、TypeScript/Playwright Core（Apache-2.0）、Ajv（MIT）、YAML（ISC）、React 类型（MIT）。开发工具不复制到发布的运行文件。Playwright Core 安装时不下载浏览器二进制。
 
 
 `fast-sha256@1.3.0` 经 pi-ai → Anthropic SDK → standardwebhooks 引入，声明 Unlicense。已核对其分发 LICENSE 中复制、修改、分发授权与免责条款；许可证检查只为该包的该版本记录例外，不放开其他未知许可证。其源码不复制进本仓库。
 
 
-仅开发使用的官方 DSH Host 包括 LibreOffice Kit（MPL-2.0）与 sharp/libvips 原生包（Apache-2.0 / LGPL-3.0-or-later）。这些包单独安装用于宿主测试，不打入本插件压缩包，许可证随各自的包保留。
+仅开发使用的官方 DSH Host 包括 LibreOffice Kit 0.2.3（MPL-2.0）与 sharp/libvips 原生包（Apache-2.0 / LGPL-3.0-or-later），以及 lru-cache 11.5.3（[Blue Oak Model License 1.0.0](https://blueoakcouncil.org/license/1.0.0)）。这些包单独安装用于宿主测试，不打入本插件压缩包，许可证随各自的包保留。检查仅接纳已核对的开发依赖版本。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eduwork/dsh-oidc",
-  "version": "0.3.2",
+  "version": "0.3.4",
   "description": "Standards-based OIDC identity, token-authorized model access, declarative branding, and OpenAI-compatible model integration for DeepSeek Harness",
   "keywords": [
     "deepseek-harness",
@@ -50,7 +50,10 @@
     "THIRD_PARTY_NOTICES.md",
     "THIRD_PARTY_NOTICES.en.md",
     "CHANGELOG.md",
-    "CHANGELOG.en.md"
+    "CHANGELOG.en.md",
+    "LICENSE-MIT",
+    "LICENSING.md",
+    "LICENSING.en.md"
   ],
   "dsh": {
     "bundle": {
@@ -106,100 +109,100 @@
     "url": "https://github.com/ECNU/EduWork/issues"
   },
   "homepage": "https://github.com/ECNU/EduWork/tree/main/packages/dsh-oidc#readme",
-  "license": "MIT",
+  "license": "MulanPSL-2.0 AND MIT",
   "dependencies": {
     "zod": "4.4.3"
   },
   "peerDependencies": {
-    "@deepseek-ai/cordis": ">=4.0.5 <4.1.0",
-    "@deepseek-ai/dsh-api-remotes": ">=0.2.1-rc.2 <0.3.0-0",
-    "@deepseek-ai/dsh-attachment": ">=0.2.1-rc.2 <0.3.0-0",
-    "@deepseek-ai/dsh-authorization": ">=0.2.1-rc.2 <0.3.0-0",
-    "@deepseek-ai/dsh-brand": ">=0.2.1-rc.2 <0.3.0-0",
-    "@deepseek-ai/dsh-client-ui-conversation": ">=0.2.1-rc.2 <0.3.0-0",
-    "@deepseek-ai/dsh-client-ui-renderer": ">=0.2.1-rc.2 <0.3.0-0",
-    "@deepseek-ai/dsh-client-ui-settings": ">=0.2.1-rc.2 <0.3.0-0",
-    "@deepseek-ai/dsh-client-ui-settings-general": ">=0.2.1-rc.2 <0.3.0-0",
-    "@deepseek-ai/dsh-client-ui-settings-models": ">=0.2.1-rc.2 <0.3.0-0",
-    "@deepseek-ai/dsh-client-ui-sidebar": ">=0.2.1-rc.2 <0.3.0-0",
-    "@deepseek-ai/dsh-client-ui-theme": ">=0.2.1-rc.2 <0.3.0-0",
-    "@deepseek-ai/dsh-credentials": ">=0.2.1-rc.2 <0.3.0-0",
-    "@deepseek-ai/dsh-fs": ">=0.2.1-rc.2 <0.3.0-0",
-    "@deepseek-ai/dsh-host-webserver": ">=0.2.1-rc.2 <0.3.0-0",
-    "@deepseek-ai/dsh-launch-environment": ">=0.2.1-rc.2 <0.3.0-0",
-    "@deepseek-ai/dsh-llm": ">=0.2.1-rc.2 <0.3.0-0",
-    "@deepseek-ai/dsh-llm-pi-ai": ">=0.2.1-rc.2 <0.3.0-0",
-    "@deepseek-ai/dsh-sandbox": ">=0.2.1-rc.2 <0.3.0-0",
-    "@deepseek-ai/dsh-scope": ">=0.2.1-rc.2 <0.3.0-0",
-    "@deepseek-ai/dsh-session": ">=0.2.1-rc.2 <0.3.0-0",
-    "@deepseek-ai/dsh-settings": ">=0.2.1-rc.2 <0.3.0-0",
-    "@deepseek-ai/dsh-timeout": ">=0.2.1-rc.2 <0.3.0-0",
-    "@deepseek-ai/dsh-typert-protocol": ">=0.2.1-rc.2 <0.3.0-0",
+    "@deepseek-ai/cordis": ">=4.0.5 <4.1.0 || 4.1.0",
+    "@deepseek-ai/dsh-api-remotes": ">=0.2.1-rc.2 <0.3.0-0 || >=0.2.2-rc.1 <0.2.3-0",
+    "@deepseek-ai/dsh-attachment": ">=0.2.1-rc.2 <0.3.0-0 || >=0.2.2-rc.1 <0.2.3-0",
+    "@deepseek-ai/dsh-authorization": ">=0.2.1-rc.2 <0.3.0-0 || >=0.2.2-rc.1 <0.2.3-0",
+    "@deepseek-ai/dsh-brand": ">=0.2.1-rc.2 <0.3.0-0 || >=0.2.2-rc.1 <0.2.3-0",
+    "@deepseek-ai/dsh-client-ui-conversation": ">=0.2.1-rc.2 <0.3.0-0 || >=0.2.2-rc.1 <0.2.3-0",
+    "@deepseek-ai/dsh-client-ui-renderer": ">=0.2.1-rc.2 <0.3.0-0 || >=0.2.2-rc.1 <0.2.3-0",
+    "@deepseek-ai/dsh-client-ui-settings": ">=0.2.1-rc.2 <0.3.0-0 || >=0.2.2-rc.1 <0.2.3-0",
+    "@deepseek-ai/dsh-client-ui-settings-general": ">=0.2.1-rc.2 <0.3.0-0 || >=0.2.2-rc.1 <0.2.3-0",
+    "@deepseek-ai/dsh-client-ui-settings-models": ">=0.2.1-rc.2 <0.3.0-0 || >=0.2.2-rc.1 <0.2.3-0",
+    "@deepseek-ai/dsh-client-ui-sidebar": ">=0.2.1-rc.2 <0.3.0-0 || >=0.2.2-rc.1 <0.2.3-0",
+    "@deepseek-ai/dsh-client-ui-theme": ">=0.2.1-rc.2 <0.3.0-0 || >=0.2.2-rc.1 <0.2.3-0",
+    "@deepseek-ai/dsh-credentials": ">=0.2.1-rc.2 <0.3.0-0 || >=0.2.2-rc.1 <0.2.3-0",
+    "@deepseek-ai/dsh-fs": ">=0.2.1-rc.2 <0.3.0-0 || >=0.2.2-rc.1 <0.2.3-0",
+    "@deepseek-ai/dsh-host-webserver": ">=0.2.1-rc.2 <0.3.0-0 || >=0.2.2-rc.1 <0.2.3-0",
+    "@deepseek-ai/dsh-launch-environment": ">=0.2.1-rc.2 <0.3.0-0 || >=0.2.2-rc.1 <0.2.3-0",
+    "@deepseek-ai/dsh-llm": ">=0.2.1-rc.2 <0.3.0-0 || >=0.2.2-rc.1 <0.2.3-0",
+    "@deepseek-ai/dsh-llm-pi-ai": ">=0.2.1-rc.2 <0.3.0-0 || >=0.2.2-rc.1 <0.2.3-0",
+    "@deepseek-ai/dsh-sandbox": ">=0.2.1-rc.2 <0.3.0-0 || >=0.2.2-rc.1 <0.2.3-0",
+    "@deepseek-ai/dsh-scope": ">=0.2.1-rc.2 <0.3.0-0 || >=0.2.2-rc.1 <0.2.3-0",
+    "@deepseek-ai/dsh-session": ">=0.2.1-rc.2 <0.3.0-0 || >=0.2.2-rc.1 <0.2.3-0",
+    "@deepseek-ai/dsh-settings": ">=0.2.1-rc.2 <0.3.0-0 || >=0.2.2-rc.1 <0.2.3-0",
+    "@deepseek-ai/dsh-timeout": ">=0.2.1-rc.2 <0.3.0-0 || >=0.2.2-rc.1 <0.2.3-0",
+    "@deepseek-ai/dsh-typert-protocol": ">=0.2.1-rc.2 <0.3.0-0 || >=0.2.2-rc.1 <0.2.3-0",
     "@earendil-works/pi-ai": "^1.1.0",
     "react": "^18.2.0",
     "react-dom": "^18.2.0",
-    "@deepseek-ai/dsh-client-locale": ">=0.2.1-rc.2 <0.3.0-0"
+    "@deepseek-ai/dsh-client-locale": ">=0.2.1-rc.2 <0.3.0-0 || >=0.2.2-rc.1 <0.2.3-0"
   },
   "devDependencies": {
-    "@deepseek-ai/cordis": "4.0.5",
-    "@deepseek-ai/dsh-agent": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-agent-default-model": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-api-gateway": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-api-remotes": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-api-session-controller": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-atomic-write": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-attachment": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-authorization": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-brand": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-chunked-list": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-client-connection": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-client-file-upload": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-client-ui-conversation": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-client-ui-model-selection": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-client-ui-renderer": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-client-ui-settings": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-client-ui-settings-general": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-client-ui-settings-models": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-client-ui-sidebar": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-client-ui-theme": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-commands": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-credentials": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-deque": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-file-reference": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-fs": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-home-paths": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-host-webserver": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-jobs": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-launch-environment": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-llm": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-llm-pi-ai": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-native-command": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-sandbox": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-sandbox-policy": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-scope": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-session": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-session-persistence": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-session-projection": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-session-projection-cache": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-session-query": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-session-title": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-settings": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-skill": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-storage": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-storage-domain": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-subagent": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-system-prompt": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-timeout": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-tool-todo": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-tools": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-typert-protocol": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-typert-registry": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-user-approval": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-util-crypto": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-util-time": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-util-values": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-util-workspace-path": "0.2.1-rc.2",
-    "@deepseek-ai/dsh-workspace": "0.2.1-rc.2",
+    "@deepseek-ai/cordis": "4.1.0",
+    "@deepseek-ai/dsh-agent": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-agent-default-model": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-api-gateway": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-api-remotes": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-api-session-controller": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-atomic-write": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-attachment": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-authorization": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-brand": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-chunked-list": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-client-connection": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-client-file-upload": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-client-ui-conversation": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-client-ui-model-selection": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-client-ui-renderer": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-client-ui-settings": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-client-ui-settings-general": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-client-ui-settings-models": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-client-ui-sidebar": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-client-ui-theme": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-commands": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-credentials": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-deque": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-file-reference": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-fs": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-home-paths": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-host-webserver": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-jobs": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-launch-environment": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-llm": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-llm-pi-ai": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-native-command": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-sandbox": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-sandbox-policy": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-scope": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-session": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-session-persistence": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-session-projection": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-session-projection-cache": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-session-query": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-session-title": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-settings": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-skill": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-storage": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-storage-domain": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-subagent": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-system-prompt": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-timeout": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-tool-todo": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-tools": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-typert-protocol": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-typert-registry": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-user-approval": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-util-crypto": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-util-time": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-util-values": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-util-workspace-path": "0.2.2-rc.2",
+    "@deepseek-ai/dsh-workspace": "0.2.2-rc.2",
     "@earendil-works/pi-ai": "1.1.0",
     "@types/react": "^18.3.28",
     "@types/react-dom": "^18.3.7",
@@ -210,9 +213,9 @@
     "tsdown": "0.22.14",
     "typescript": "^5.9.3",
     "yaml": "^2.8.1",
-    "@deepseek-ai/dsh-client-locale": "0.2.1-rc.2",
-    "@deepseek-ai/dsh": "0.2.1-rc.2",
-    "@deepseek-ai/schemastery": "3.18.5",
+    "@deepseek-ai/dsh-client-locale": "0.2.2-rc.2",
+    "@deepseek-ai/dsh": "0.2.2-rc.2",
+    "@deepseek-ai/schemastery": "3.19.0",
     "semver": "7.7.4"
   },
   "peerDependenciesMeta": {