@fotor-ai/dsh-fotor-plugin 0.0.0-stage → 0.6.0-test.2

package/INSTALL.md

@@ -0,0 +1,177 @@
+# Install and use Fotor with DeepSeek Harness
+
+> Requires stable Node 24.2.0 or later within 24.x, or stable Node 26.x. The fixed DeepSeek Harness 0.2.1-rc.2 launcher needs `import.meta.main`, introduced in Node 24.2.0. Earlier Node 24 releases are outside the supported range. Use the release's recorded runtime results for the exact tested versions.
+
+DeepSeek Harness is abbreviated as `dsh` in commands and native identifiers. This guide is self-contained for the independent package. Source 0.6.0 is unpublished: use public commands below only after the selected GitHub or npm channel contains that version. Existing 0.5.1 installations retain their original installation procedure until migrated.
+
+## 1. Check prerequisites and select a profile
+
+Use Linux DeepSeek Harness Web `0.2.1-rc.2` (source `687f282e8625c6b8d11ff58211a90524be2e4317`), its available native package manager, and a stable Node **24.2.0 or later within 24.x, or 26.x**. Node 24.0.x, 24.1.x, 25.x, 27.x and prereleases are outside the declared range. The host range remains `>=0.2.1-rc.2 <0.3.0-0`; admission is not evidence that every host/runtime combination has been tested. Consult the installed release's acceptance record. Desktop, headless and ACP require separate acceptance.
+
+```bash
+dsh --version
+node --version
+dsh plugin --profile web root
+```
+
+Git sources additionally require Git. Follow the [host quickstart](https://deepseek-harness.github.io/deepseek-harness/en/guide/quickstart) or [Node downloads](https://nodejs.org/en/download/) for missing prerequisites. Node is not bundled. Preserve daily installations; do not upgrade them to satisfy an acceptance run.
+
+Select one profile, working directory and Fotor-only credential directory outside the installed package. Inspect existing Fotor components before changing anything. A model-provider account is separate from Fotor OAuth.
+
+**Done when:** the host and Node versions are known, the native package manager works, and the profile and external storage locations are selected.
+
+## 2. Install one Bundle source
+
+The package name is **`@fotor-ai/dsh-fotor-plugin`** for both sources. Installing it automatically obtains the pinned **mcp-remote 0.15.1** runtime. There is no separate bridge installation command. Git installation downloads the dependency through the host package manager; npm artifacts already carry the bridge and its complete runtime dependency tree. Installation starts neither the bridge nor OAuth.
+
+Choose exactly one command after its channel is published:
+
+```bash
+# GitHub production: default branch.
+dsh plugin --profile web add "git+https://github.com/fotor-ai/dsh-fotor-plugin.git" --ignore-scripts
+# GitHub test channel.
+dsh plugin --profile web add "git+https://github.com/fotor-ai/dsh-fotor-plugin.git#release/test" --ignore-scripts
+# npm production: latest dist-tag.
+dsh plugin --profile web add "@fotor-ai/dsh-fotor-plugin" --ignore-scripts
+# npm test channel.
+dsh plugin --profile web add "@fotor-ai/dsh-fotor-plugin@next" --ignore-scripts
+```
+
+For an internal or local rehearsal, replace the source with the absolute path to the complete independent package. The multi-platform repository root is Pi's facade and is not a DeepSeek Harness package. Never install both sources, aliases, or the legacy `fotor` alongside the scoped package.
+
+**Done when:** native installation succeeds and reports the scoped identity and expected version. Preserve a failed dependency download as a failed installation; do not continue with a missing bridge or use an unpinned `npx` workaround.
+
+## 3. Resolve the installed package and bridge
+
+Use the original profile and package-manager store. Set variables from native output and verified absolute paths:
+
+```bash
+FOTOR_PROFILE=web
+dsh plugin --profile "$FOTOR_PROFILE" why @fotor-ai/dsh-fotor-plugin
+dsh plugin --profile "$FOTOR_PROFILE" root
+FOTOR_INSTALLED="$(realpath "$(dsh plugin --profile "$FOTOR_PROFILE" root)/@fotor-ai/dsh-fotor-plugin")"
+dsh plugin --profile "$FOTOR_PROFILE" list mcp-remote --depth Infinity --parseable
+dsh plugin --profile "$FOTOR_PROFILE" why mcp-remote --json
+```
+
+Choose the resolution route matching the installed manifest:
+
+- **Git source:** the dependency query can return multiple paths. Select the mcp-remote 0.15.1 dependency owned by this exact Fotor installation; stop on ambiguity. pnpm can place it beside the package rather than inside it. Set `FOTOR_BRIDGE` to that verified absolute dependency path.
+- **npm artifact:** after verifying `bundleDependencies` names mcp-remote, resolve the bundled directory below. The native dependency list may omit bundled packages; an empty list alone is not a missing bridge.
+
+```bash
+# npm artifact only, after inspecting its manifest.
+FOTOR_BRIDGE="$(realpath "$FOTOR_INSTALLED/node_modules/mcp-remote")"
+```
+
+For either source, verify the selected location before configuring it:
+
+```bash
+FOTOR_NODE=/absolute/path/to/node
+cat "$FOTOR_INSTALLED/package.json"
+cat "$FOTOR_BRIDGE/package.json"
+test -f "$FOTOR_BRIDGE/dist/client.js"
+test -f "$FOTOR_BRIDGE/dist/proxy.js"
+```
+
+Git pins the direct bridge version; its transitive graph is resolved by the host and should be recorded when reproducing a result. The packaged lock file is the npm release-build input, not a promise that pnpm honors it during Git installation.
+
+**Done when:** the scoped package/version, bridge 0.15.1, both bridge entrypoints and all selected absolute paths are verified. A `why` result alone does not establish file completeness or the Git commit.
+
+## 4. Prepare complete configuration
+
+Copy [configuration.example.yml](configuration.example.yml) outside the installation and fill every placeholder:
+
+| Parameter | Source and lifetime |
+| --- | --- |
+| Profile | The native profile selected for installation; keep it for updates/removal |
+| Skill directory | Actual `FOTOR_INSTALLED` plus `/skills`; re-resolve after updates |
+| Node command | Absolute executable for the selected supported Node version |
+| Proxy/client entry | Actual `FOTOR_BRIDGE` plus `/dist/proxy.js` or `/dist/client.js`; re-resolve after updates |
+| Home and agents home | Actual host locations; dedicated directories during acceptance |
+| Working directory | Selected existing absolute workspace |
+| `MCP_REMOTE_CONFIG_DIR` | Fotor-only external directory, separate from model credentials; retain across updates and source changes |
+| Callback | One available port; example `3335`, host copied unchanged from `configuration.example.yml`; identical for client and proxy |
+| Endpoint/resource | Both `https://mcp.fotor.com/mcp`; retain production and OAuth security parameters |
+
+Overrides replace whole `config` objects, not individual nested fields. Retain both complete rows and all arguments. Keep native reconnect disabled. Do not copy credentials into the package, command arguments or documentation.
+
+**Done when:** the full override is external, all paths are real and no conflicting `fotor` service or duplicate provider exists.
+
+## 5. Apply complete configuration and load skills
+
+Use the selected profile's native patch mechanism or an explicit external patch:
+
+```bash
+dsh --profile "$FOTOR_PROFILE" --patch /absolute/path/to/fotor.local.yml
+```
+
+The installed Bundle declares both components disabled. The example enables only skills; its MCP row stays disabled. Keep `includeDefaultRoots: false` and scan only the actual installed Fotor skill directory.
+
+In the native menu, select `/fotor-connect`; ask it to read its instructions without authorizing or calling MCP. Confirm the resource path and one discovered copy of each actual Fotor skill. Each skill has four local reference documents.
+
+Use the host's native `read` tool for those files. The Linux Shell sandbox can hide a `/tmp` installation while native reading still works; a failed Shell `ls` is not proof of a broken package. If native reading fails, stop and report the actual path/error rather than searching other installations.
+
+**Done when:** the native provider discovers the package's actual skills and their local references, and MCP is still disabled.
+
+## 6. Authorize then enable the connection
+
+Read [this package's authentication guide](skills/fotor-connect/references/authentication.md) before connecting. Confirm the opener targets the user's daily ordinary browser, preserve its login state, and keep the proxy stopped while the independent authorization client runs.
+
+```bash
+MCP_REMOTE_CONFIG_DIR=/absolute/path/to/dsh-home/mcp-auth/fotor "$FOTOR_NODE" "$FOTOR_BRIDGE/dist/client.js" https://mcp.fotor.com/mcp 3335 --host "$FOTOR_CALLBACK_HOST" --transport http-only --resource https://mcp.fotor.com/mcp --auth-timeout 600 --connect-timeout 20 --headers-timeout 20 --body-timeout 20
+```
+
+Set `FOTOR_CALLBACK_HOST` to the callback host verified in the configuration example. Run in an interactive terminal that keeps stdin open. After the user selects Continue, require successful connection and actual tool discovery. A callback page or exit code alone is insufficient. Stop the client and callback listener before enabling the MCP row and restarting the profile. Keep the same endpoint, resource, callback and credential directory. Cancel/timeout stops the flow; human waiting is limited to ten minutes.
+
+The bridge owns OAuth; this is not native remote OAuth in DeepSeek Harness. Model login, package installation, skills, Fotor authorization and website login are separate steps.
+
+**Done when:** authorization-client discovery completes, that client/listener exits, and the enabled native stdio connection discovers actual Fotor tools.
+
+## 7. Use, update or remove Fotor
+
+Example requests:
+
+- MCP-only: “Connect only to Fotor MCP and list image models. Do not open the website.”
+- Website: “Connect to Fotor and introduce its capabilities.” Prepare the daily browser before requesting the one-use handoff; report website success only after user confirmation.
+- Explicit skill: select `/fotor-image` and describe a task. Every successful `submit_*_task` may consume credits; preserve the existing authorization and retry rules.
+
+Update the selected source, then repeat path and resource verification in a new process:
+
+```bash
+# Recorded Git source only.
+dsh plugin --profile "$FOTOR_PROFILE" update @fotor-ai/dsh-fotor-plugin --ignore-scripts
+# Recorded npm test source: explicitly select its channel.
+dsh plugin --profile "$FOTOR_PROFILE" update @fotor-ai/dsh-fotor-plugin@next --ignore-scripts
+# Recorded npm production source: explicitly select its channel.
+dsh plugin --profile "$FOTOR_PROFILE" update @fotor-ai/dsh-fotor-plugin@latest --ignore-scripts
+dsh plugin --profile "$FOTOR_PROFILE" why @fotor-ai/dsh-fotor-plugin
+```
+
+Choose one update command for the recorded source. The accepted host/package-manager baseline saves npm additions as exact versions: an unqualified update can remain on that exact version even after the tag moves. Explicitly select the intended npm tag or approved exact target; do not apply npm tag selectors to Git installations. A failed native update is not a pass after reinstalling. Stop Fotor components before updating paths; preserve the external credential store, model settings and security parameters.
+
+### Migrate from the legacy package or switch sources
+
+Legacy 0.5.1 and older packages are named `fotor`. A normal update does not rename them. Record source/profile/store/path and the external configuration, stop both components, and remove only their override rows. Remove the old identity, then install one scoped source from step 2:
+
+```bash
+dsh plugin --profile "$FOTOR_PROFILE" remove fotor --config.ignore-scripts=true
+```
+
+For GitHub/npm switching or scoped-package removal, use:
+
+```bash
+dsh plugin --profile "$FOTOR_PROFILE" remove @fotor-ai/dsh-fotor-plugin --config.ignore-scripts=true
+```
+
+This host baseline rejects `--ignore-scripts` on removal; use the configuration form above. After adding the new source, resolve package and managed bridge paths again and restore a complete override. Keep one scoped installation and one component pair. Keep the credential directory, model settings and all connection/security parameters unchanged. Do not automatically delete the old external bridge directory or claim real credential reuse from an offline migration rehearsal.
+
+### Troubleshooting
+
+- Missing bridge: inspect native install/download results and this package's dependency tree; finish installation before connecting.
+- Changed installation path: re-query the native root/dependency paths and replace complete override rows.
+- pnpm store mismatch: use the original profile/store; do not edit caches or move package-manager links manually.
+- Duplicate skills/components: inspect selected sources and override rows before enabling either component.
+- Authorization failure: follow the authentication guide's single-client bounded recovery sequence. Installation or restart success does not prove recovery from rejected credentials.
+
+Uninstalling the Bundle does not revoke server-side consent. Delete only explicitly authorized temporary state after its processes stop; retain daily client configuration, credentials and browser login.

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -1,3 +1,142 @@
-# Temporary Holding Version
+# Fotor for DeepSeek Harness
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+> Requires stable Node 24.2.0 or later within 24.x, or stable Node 26.x. The fixed DeepSeek Harness 0.2.1-rc.2 launcher needs `import.meta.main`, introduced in Node 24.2.0. Earlier Node 24 releases are outside the supported range. Use the release's recorded runtime results for the exact tested versions.
+
+<p align="center"><img src="assets/logo.svg" width="72" alt="Fotor logo" /></p>
+
+<p align="center">
+  <img src="https://img.shields.io/static/v1?label=version&amp;message=0.6.0-test.2&amp;color=087f8c&amp;style=flat-square" alt="Version" />
+  <img src="https://img.shields.io/static/v1?label=channel&amp;message=test&amp;color=a56800&amp;style=flat-square" alt="Release channel" />
+  <a href="LICENSE"><img src="https://img.shields.io/static/v1?label=license&amp;message=Apache-2.0&amp;color=57606a&amp;style=flat-square" alt="Apache-2.0 license" /></a>
+</p>
+<p align="center">
+  <a href="#dsh"><img src="https://img.shields.io/static/v1?label=agent&amp;message=DeepSeek+Harness&amp;color=24292f&amp;style=flat-square" alt="DeepSeek Harness" /></a>
+</p>
+
+Use Fotor's shared skills with DeepSeek Harness Web and an automatically installed MCP bridge dependency.
+
+| Field | Value |
+| --- | --- |
+| Bundle | `@fotor-ai/dsh-fotor-plugin` |
+| Version | `0.6.0-test.2` |
+| Release channel | `test` |
+| Service environment | `production` |
+| MCP endpoint | `https://mcp.fotor.com/mcp` |
+| Declared host range | `>=0.2.1-rc.2 <0.3.0-0` |
+| Host baseline | Linux DeepSeek Harness Web 0.2.1-rc.2 |
+| Bridge | mcp-remote 0.15.1 |
+| Node range | `>=24.2.0 <25.0.0 \|\| 26.x`, stable versions |
+| License | Apache-2.0 |
+
+## Verification scope
+
+Package checks cover files, references, and configuration. Verify installation, MCP authorization and calls, website login, credit links, uploads, and media execution separately in the selected host and environment. A release or model query does not establish successful website login or completed media results.
+
+The Bundle only declares host-owned components and resources. The bridge is acquired by the package manager and owns OAuth. npm artifacts carry its full runtime dependency tree; Git installs download the dependency. Complete support requires real controlled reauthorization recovery as well as installation, calls, website access and restart reuse; consult the evidence for the installed release. Media execution and expiry-driven refresh are not established by static checks.
+
+<a id="dsh"></a>
+
+## DeepSeek Harness
+
+DeepSeek Harness is abbreviated as `dsh` in commands and native identifiers.
+
+<a id="dsh-installation"></a>
+
+### DeepSeek Harness installation
+
+#### Test release
+
+First verify that the selected revision contains the DeepSeek Harness Bundle. Install this scoped package and its pinned bridge dependency to the chosen profile. Both components stay disabled until local setup.
+
+```bash
+dsh plugin --profile web add "git+https://github.com/fotor-ai/dsh-fotor-plugin.git#release/test" --ignore-scripts
+```
+
+This is the standalone root Bundle for [https://github.com/fotor-ai/dsh-fotor-plugin](https://github.com/fotor-ai/dsh-fotor-plugin). Use its root Git source only after the selected channel contains this version. The [multi-platform repository](https://github.com/fotor-ai/fotor-agent-plugins) documents this external source; it no longer distributes new DeepSeek Harness packages. Existing subdirectory installations require a one-way native source migration.
+
+The Bundle identity is `@fotor-ai/dsh-fotor-plugin`. After the corresponding npm channel is published, its alternative is `dsh plugin --profile web add "@fotor-ai/dsh-fotor-plugin" --ignore-scripts` (production) or `dsh plugin --profile web add "@fotor-ai/dsh-fotor-plugin@next" --ignore-scripts` (test). Select one source only.
+
+Installation automatically obtains **mcp-remote 0.15.1**. Git sources download it through the host package manager; npm artifacts carry its complete locked runtime tree. Fotor skills remain script-free. No installation hook starts the bridge or OAuth, and Node is not bundled.
+
+Follow the [complete installation guide](INSTALL.md):
+
+1. Check Linux DeepSeek Harness Web `0.2.1-rc.2` and stable Node **24.2.0 or later within 24.x, or 26.x**.
+2. Install one source with lifecycle scripts disabled.
+3. Query actual package and dependency paths; verify both bridge entrypoints.
+4. Apply full external configuration and enable only skills first.
+5. Complete separate bridge-client authorization before enabling MCP.
+
+The declared host range is `>=0.2.1-rc.2 <0.3.0-0`; matching versions are not automatically verified. Desktop, headless and ACP require separate acceptance.
+
+<a id="dsh-configuration-and-connection"></a>
+
+### DeepSeek Harness configuration and connection
+
+Installation adds two disabled components. Use native `root`, `list` and `why` queries as described in the guide; do not guess pnpm storage paths. A bundled npm dependency can be absent from the ordinary native list; follow the guide to verify the declared bundle under the actual installed package. Copy the [full configuration example](configuration.example.yml) outside the package and fill every absolute path. Overrides replace complete `config` objects. Keep default skill roots and native MCP reconnect disabled.
+
+The native client directly runs the installed dependency using structured `command`, `args`, `env` and `cwd`. Keep `MCP_REMOTE_CONFIG_DIR` dedicated to Fotor and outside updates. Follow [authentication instructions](skills/fotor-connect/references/authentication.md), retaining independent-client discovery, user Continue / Wait / Cancel and client shutdown before the proxy starts. The bridge owns OAuth.
+
+Use the user's confirmed daily ordinary browser. MCP-only requests do not request website links; website requests prepare the browser, open the original handoff once through native permission controls, and wait for actual page confirmation. An existing login is not a first-login result.
+
+<a id="dsh-updates"></a>
+
+### DeepSeek Harness updates
+
+For a recorded Git source:
+
+```bash
+dsh plugin --profile web update @fotor-ai/dsh-fotor-plugin --ignore-scripts
+dsh plugin --profile web why @fotor-ai/dsh-fotor-plugin
+```
+
+For a recorded npm source, explicitly select its channel with `dsh plugin --profile web update @fotor-ai/dsh-fotor-plugin@next --ignore-scripts` for test, or `dsh plugin --profile web update @fotor-ai/dsh-fotor-plugin@latest --ignore-scripts` for production. This host may save npm additions as exact versions, so unqualified update can retain the old version. Never apply an npm tag selector to a Git source.
+
+Verify the source, version, files and actual skill/bridge directories in a new process. Preserve profile/store, credentials and connection parameters. An unsuccessful update remains a failure; reinstall is a separately recorded operation.
+
+<a id="dsh-source-selection-and-removal"></a>
+
+### DeepSeek Harness source selection and removal
+
+#### Production release
+
+First verify that the selected revision contains the DeepSeek Harness Bundle. Install this scoped package and its pinned bridge dependency to the chosen profile. Both components stay disabled until local setup. Record the old source and scope, remove only this Fotor Bundle through native controls, then add the selected source. Preserve the external credential directory; resolve both bridge and installed skill paths before enabling the new package.
+
+```bash
+dsh plugin --profile web add "git+https://github.com/fotor-ai/dsh-fotor-plugin.git" --ignore-scripts
+```
+
+#### Test release
+
+First verify that the selected revision contains the DeepSeek Harness Bundle. Install this scoped package and its pinned bridge dependency to the chosen profile. Both components stay disabled until local setup. Record the old source and scope, remove only this Fotor Bundle through native controls, then add the selected source. Preserve the external credential directory; resolve both bridge and installed skill paths before enabling the new package.
+
+```bash
+dsh plugin --profile web add "git+https://github.com/fotor-ai/dsh-fotor-plugin.git#release/test" --ignore-scripts
+```
+
+Legacy `fotor` and scoped packages are different identities. Stop Fotor components, record old source/profile/store/paths, remove only their override rows, then remove the old Bundle with `dsh plugin --profile web remove fotor --config.ignore-scripts=true`. Add one scoped source and resolve both installed skill and bridge paths again. Preserve model settings, the external credential directory, callback/security parameters and daily browser state; do not automatically remove the old external bridge.
+
+GitHub/npm switching uses the same explicit remove/add sequence, with `@fotor-ai/dsh-fotor-plugin` as the removal target. Keep one installed source and one component pair. Ordinary update does not rename packages or switch sources. See [maintenance](INSTALL.md#7-use-update-or-remove-fotor).
+
+
+## Workflows
+
+Start with [connection and model discovery](skills/fotor-connect/references/mcp-integration.md#runtime-workflow), then select the skill matching the request. Follow [media preparation](skills/fotor-connect/references/media-upload.md) for local references and [credits](skills/fotor-connect/references/credits.md) for balance/pricing requests. These instructions do not establish host acceptance of every media operation.
+
+## Bundle contents
+
+- `package.json` and `cordis.patch.yml`: the declarative Bundle and two initially disabled components.
+- `configuration.example.yml`: complete local setup example; never auto-applied.
+- `INSTALL.md`: self-contained setup and migration guide.
+- `package-lock.json`: reviewed npm release-build input in Git snapshots; not a host-level Git dependency lock.
+- npm artifacts additionally contain the pinned third-party runtime; Fotor skills remain script-free.
+- `.github/`: Git snapshot publication tooling, excluded from installed packages.
+- `skills/`, including each skill's `references/`: shared workflows and DeepSeek Harness bridge/browser guidance.
+- `assets/logo.svg`, `README.md` and `LICENSE`: package-local documentation and branding.
+
+## License
+
+[Apache-2.0](LICENSE)
+
+## Skill-local references
+
+Every packaged skill carries four generated documents in its own `references/` directory, including this platform's authentication guide. Read them as needed; complete runtime documentation does not install or configure MCP.

package/assets/logo.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" fill="none" version="1.1" width="800.00048828125" height="800.302001953125" viewBox="0 0 800.00048828125 800.302001953125"><defs><linearGradient x1="0.5" y1="0" x2="0.5" y2="1" id="master_svg0_1_811"><stop offset="0%" stop-color="#6100DF" stop-opacity="1"/><stop offset="100%" stop-color="#8C00F3" stop-opacity="1"/></linearGradient><linearGradient x1="0.8578860759735107" y1="0.8597633242607117" x2="-0.23903035406462583" y2="-0.2774550827255907" id="master_svg1_1_819"><stop offset="0%" stop-color="#B200BB" stop-opacity="1"/><stop offset="100%" stop-color="#7F00D4" stop-opacity="1"/></linearGradient><linearGradient x1="2.4512760639190674" y1="1.268548846244812" x2="-2.4938022839569345" y2="0.395056098230695" id="master_svg2_1_827"><stop offset="0%" stop-color="#F61B4A" stop-opacity="1"/><stop offset="100%" stop-color="#FF1365" stop-opacity="1"/></linearGradient><linearGradient x1="1" y1="-2.9802322387695312e-8" x2="0.828499219516546" y2="1.3743264510043631" id="master_svg3_1_831"><stop offset="0%" stop-color="#1A31FD" stop-opacity="1"/><stop offset="99.99992251396179%" stop-color="#4677FD" stop-opacity="1"/></linearGradient><linearGradient x1="-0.035017237067222595" y1="1.0188000202178955" x2="1.1167137964012022" y2="-0.055563892826051786" id="master_svg4_1_803"><stop offset="0%" stop-color="#1BA7FF" stop-opacity="1"/><stop offset="100%" stop-color="#0953FF" stop-opacity="1"/></linearGradient><linearGradient x1="-0.16657708585262299" y1="-1.6673908233642578" x2="0.44433419866897683" y2="2.9181498526788814" id="master_svg5_1_799"><stop offset="0%" stop-color="#F9F26E" stop-opacity="1"/><stop offset="100%" stop-color="#FFF350" stop-opacity="1"/></linearGradient><linearGradient x1="0.010019190609455109" y1="0.009814964607357979" x2="1.181058370202419" y2="1.1812435910469938" id="master_svg6_1_823"><stop offset="0%" stop-color="#F3F314" stop-opacity="1"/><stop offset="100%" stop-color="#D8DC05" stop-opacity="1"/></linearGradient><linearGradient x1="0.9001821279525757" y1="0.0966641902923584" x2="-0.27007320155881137" y2="1.3099159941504328" id="master_svg7_1_815"><stop offset="0%" stop-color="#FFCD50" stop-opacity="1"/><stop offset="98.57142567634583%" stop-color="#FFBE22" stop-opacity="1"/></linearGradient><linearGradient x1="2.3266992568969727" y1="1.8836963176727295" x2="0.02175865580334219" y2="-1.77780992725093" id="master_svg8_1_807"><stop offset="0%" stop-color="#FAD522" stop-opacity="1"/><stop offset="100%" stop-color="#FAE11C" stop-opacity="1"/></linearGradient><linearGradient x1="1.0316925048828125" y1="3.13677716255188" x2="-2.3948093740759657" y2="0.8406521586363014" id="master_svg9_1_787"><stop offset="0%" stop-color="#FF8637" stop-opacity="1"/><stop offset="100%" stop-color="#FD6E1B" stop-opacity="1"/></linearGradient><linearGradient x1="-1.9736230373382568" y1="1.1028505563735962" x2="1.8747306845584262" y2="0.7108481294751279" id="master_svga_1_791"><stop offset="0%" stop-color="#01CB75" stop-opacity="1"/><stop offset="100%" stop-color="#02AA6B" stop-opacity="1"/></linearGradient><linearGradient x1="-1.7581160068511963" y1="-0.4311377704143524" x2="2.596531409577855" y2="0.3379709760635894" id="master_svgb_1_795"><stop offset="0%" stop-color="#97E723" stop-opacity="1"/><stop offset="100%" stop-color="#7ACD00" stop-opacity="1"/></linearGradient></defs><g><g><g><g><g><path d="M400.1642542324844,800.3015666503907C400.1642542324844,800.3015666503907,631.1672542324843,800.3015666503907,631.1672542324843,800.3015666503907C631.1672542324843,800.3015666503907,400.1642542324844,400.1495666503906,400.1642542324844,400.1495666503906C400.1642542324844,400.1495666503906,400.1642542324844,800.3015666503907,400.1642542324844,800.3015666503907Z" fill-rule="evenodd" fill="url(#master_svg0_1_811)" fill-opacity="1"/></g></g><g><g><path d="M631.3342542324843,800.3015666503907C631.3342542324843,800.3015666503907,634.5002542324844,800.3015666503907,634.5002542324844,800.3015666503907C725.4982542324844,800.3015666503907,800.0002542324844,725.7755666503906,800.0002542324844,634.7385666503906C800.0002542324844,634.7385666503906,800.0002542324844,631.0715666503907,800.0002542324844,631.0715666503907C800.0002542324844,631.0715666503907,400.1642542324844,400.1495666503906,400.1642542324844,400.1495666503906C400.1642542324844,400.1495666503906,631.3342542324843,800.3015666503907,631.3342542324843,800.3015666503907Z" fill-rule="evenodd" fill="url(#master_svg1_1_819)" fill-opacity="1"/></g></g><g><g><path d="M400.1642542324844,400.1495666503906C400.1642542324844,400.1495666503906,800.0002542324844,631.0715666503907,800.0002542324844,631.0715666503907C800.0002542324844,631.0715666503907,800.0002542324844,400.1495666503906,800.0002542324844,400.1495666503906C800.0002542324844,400.1495666503906,400.1642542324844,400.1495666503906,400.1642542324844,400.1495666503906Z" fill-rule="evenodd" fill="url(#master_svg2_1_827)" fill-opacity="1"/></g></g><g><g><path d="M169.34415207870188,800.3015666503907C169.34415207870188,800.3015666503907,400.17715207870185,800.3015666503907,400.17715207870185,800.3015666503907C400.17715207870185,800.3015666503907,400.17715207870185,400.1495666503906,400.17715207870185,400.1495666503906C400.17715207870185,400.1495666503906,169.34415207870188,800.3015666503907,169.34415207870188,800.3015666503907Z" fill-rule="evenodd" fill="url(#master_svg3_1_831)" fill-opacity="1"/></g></g><g><g><path d="M0.0008498556562699378,631.2375666503906C0.0008498556562699378,631.2375666503906,0.0008498556562699378,634.7385666503906,0.0008498556562699378,634.7385666503906C0.0008498556562699378,725.7755666503906,74.50124985565627,800.3015666503907,165.66884985565628,800.3015666503907C165.66884985565628,800.3015666503907,169.33484985565627,800.3015666503907,169.33484985565627,800.3015666503907C169.33484985565627,800.3015666503907,400.1688498556563,400.1495666503906,400.1688498556563,400.1495666503906C400.1688498556563,400.1495666503906,0.0008498556562699378,631.2375666503906,0.0008498556562699378,631.2375666503906Z" fill-rule="evenodd" fill="url(#master_svg4_1_803)" fill-opacity="1"/></g></g><g><g><path d="M169.16373543365626,0C169.16373543365626,0,400.16373543365626,400.152,400.16373543365626,400.152C400.16373543365626,400.152,400.16373543365626,0,400.16373543365626,0C400.16373543365626,0,169.16373543365626,0,169.16373543365626,0Z" fill-rule="evenodd" fill="url(#master_svg5_1_799)" fill-opacity="1"/></g></g><g><g><path d="M165.66884985565628,0C74.50124985565627,0,0.0008498556562699378,74.5302,0.0008498556562699378,165.563C0.0008498556562699378,165.563,0.0008498556562699378,169.064,0.0008498556562699378,169.064C0.0008498556562699378,169.064,400.1688498556563,400.152,400.1688498556563,400.152C400.1688498556563,400.152,169.16784985565627,0,169.16784985565627,0C169.16784985565627,0,165.66884985565628,0,165.66884985565628,0Z" fill-rule="evenodd" fill="url(#master_svg6_1_823)" fill-opacity="1"/></g></g><g><g><path d="M631.3342542324843,0C631.3342542324843,0,400.1642542324844,400.152,400.1642542324844,400.152C400.1642542324844,400.152,800.0002542324844,169.398,800.0002542324844,169.398C800.0002542324844,169.398,800.0002542324844,165.73,800.0002542324844,165.73C800.0002542324844,74.5302,725.4982542324844,0,634.5002542324844,0C634.5002542324844,0,631.3342542324843,0,631.3342542324843,0Z" fill-rule="evenodd" fill="url(#master_svg7_1_815)" fill-opacity="1"/></g></g><g><g><path d="M400.1642542324844,0C400.1642542324844,0,400.1642542324844,400.152,400.1642542324844,400.152C400.1642542324844,400.152,631.1672542324843,0,631.1672542324843,0C631.1672542324843,0,400.1642542324844,0,400.1642542324844,0Z" fill-rule="evenodd" fill="url(#master_svg8_1_807)" fill-opacity="1"/></g></g><g><g><path d="M400.1642542324844,400.144404296875C400.1642542324844,400.144404296875,800.0002542324844,400.144404296875,800.0002542324844,400.144404296875C800.0002542324844,400.144404296875,800.0002542324844,169.389404296875,800.0002542324844,169.389404296875C800.0002542324844,169.389404296875,400.1642542324844,400.144404296875,400.1642542324844,400.144404296875Z" fill-rule="evenodd" fill="url(#master_svg9_1_787)" fill-opacity="1"/></g></g><g><g><path d="M0.0008498556562699378,400.1495666503906C0.0008498556562699378,400.1495666503906,0.0008498556562699378,631.2375666503906,0.0008498556562699378,631.2375666503906C0.0008498556562699378,631.2375666503906,400.1688498556563,400.1495666503906,400.1688498556563,400.1495666503906C400.1688498556563,400.1495666503906,0.0008498556562699378,400.1495666503906,0.0008498556562699378,400.1495666503906Z" fill-rule="evenodd" fill="url(#master_svga_1_791)" fill-opacity="1"/></g></g><g><g><path d="M0.0008498556562699378,400.1466700439453C0.0008498556562699378,400.1466700439453,400.1688498556563,400.1466700439453,400.1688498556563,400.1466700439453C400.1688498556563,400.1466700439453,0.0008498556562699378,169.0586700439453,0.0008498556562699378,169.0586700439453C0.0008498556562699378,169.0586700439453,0.0008498556562699378,400.1466700439453,0.0008498556562699378,400.1466700439453Z" fill-rule="evenodd" fill="url(#master_svgb_1_795)" fill-opacity="1"/></g></g></g></g></g></svg>

package/configuration.example.yml

@@ -0,0 +1,44 @@
+# Copy outside the installed package and fill every absolute path.
+# Select a free callback port; use the same connection arguments for the client.
+# Overrides replace the complete config object; fields are not deep-merged.
+- id: fotor-skills
+  disabled: false
+  config:
+    providerName: fotor
+    includeDefaultRoots: false
+    dshHome: /absolute/path/to/dsh-home
+    agentsHome: /absolute/path/to/agents-home
+    customSkillDirs:
+      - /absolute/path/to/installed/scoped-fotor/skills
+    watch: false
+- id: fotor-mcp
+  disabled: true
+  config:
+    serverName: fotor
+    transport: stdio
+    failOnStartupError: false
+    reconnect:
+      enabled: false
+    command: /absolute/path/to/node
+    args:
+      - /absolute/path/from/dependency-query/mcp-remote/dist/proxy.js
+      - https://mcp.fotor.com/mcp
+      - '3335'
+      - --host
+      - 127.0.0.1
+      - --transport
+      - http-only
+      - --resource
+      - https://mcp.fotor.com/mcp
+      - --auth-timeout
+      - '600'
+      - --connect-timeout
+      - '20'
+      - --headers-timeout
+      - '20'
+      - --body-timeout
+      - '20'
+    env:
+      MCP_REMOTE_CONFIG_DIR: /absolute/path/to/dsh-home/mcp-auth/fotor
+    cwd: /absolute/path/to/workspace
+    toolCallTimeoutMs: 25000

package/cordis.patch.yml

@@ -0,0 +1,18 @@
+# Installation declares inert host-owned components. Configure before enabling.
+- insert:
+    - id: fotor-skills
+      name: '@deepseek-ai/dsh-skill-filesystem'
+      disabled: true
+      config:
+        providerName: fotor
+        includeDefaultRoots: false
+        customSkillDirs: []
+    - id: fotor-mcp
+      name: '@deepseek-ai/dsh-mcp-client'
+      disabled: true
+      config:
+        serverName: fotor
+        transport: stdio
+        failOnStartupError: false
+        reconnect:
+          enabled: false