@fotor-ai/dsh-fotor-plugin 0.6.0-test.2 → 0.6.0-test.3

package/INSTALL.md

@@ -2,7 +2,9 @@
 
 > Requires stable Node 24.2.0 or later within 24.x, or stable Node 26.x. The fixed DeepSeek Harness 0.2.1-rc.2 launcher needs `import.meta.main`, introduced in Node 24.2.0. Earlier Node 24 releases are outside the supported range. Use the release's recorded runtime results for the exact tested versions.
 
-DeepSeek Harness is abbreviated as `dsh` in commands and native identifiers. This guide is self-contained for the independent package. Source 0.6.0 is unpublished: use public commands below only after the selected GitHub or npm channel contains that version. Existing 0.5.1 installations retain their original installation procedure until migrated.
+DeepSeek Harness is abbreviated as `dsh` in commands and native identifiers. This guide is self-contained for the independent 0.6.0 package. Test distributions are available; stable availability is separate. Check the selected GitHub revision or npm version before installing. Existing 0.5.1 installations retain their original guide until migrated to the scoped identity.
+
+During the 0.6.0 test rollout, GitHub's default branch still supplies 0.5.1 and npm `latest` retains the accepted first-publication exception, `0.6.0-test.1`. Bare-name npm installation therefore selects a prerelease until the formal rollout replaces it. Use the GitHub test branch or a verified npm test version during that interval; use production examples only after the selected channel contains the intended stable release.
 
 ## 1. Check prerequisites and select a profile
 
@@ -16,7 +18,7 @@ dsh plugin --profile web root
 
 Git sources additionally require Git. Follow the [host quickstart](https://deepseek-harness.github.io/deepseek-harness/en/guide/quickstart) or [Node downloads](https://nodejs.org/en/download/) for missing prerequisites. Node is not bundled. Preserve daily installations; do not upgrade them to satisfy an acceptance run.
 
-Select one profile, working directory and Fotor-only credential directory outside the installed package. Inspect existing Fotor components before changing anything. A model-provider account is separate from Fotor OAuth.
+Select one profile, working directory and Fotor-only credential directory outside the installed package. Inspect existing Fotor components before changing anything. A model-provider account is separate from Fotor OAuth. If installation uses a custom `--store-dir /absolute/path/to/store`, record it and pass that same argument on later add, update and remove commands. Retain the original profile and source as well.
 
 **Done when:** the host and Node versions are known, the native package manager works, and the profile and external storage locations are selected.
 
@@ -31,7 +33,7 @@ Choose exactly one command after its channel is published:
 dsh plugin --profile web add "git+https://github.com/fotor-ai/dsh-fotor-plugin.git" --ignore-scripts
 # GitHub test channel.
 dsh plugin --profile web add "git+https://github.com/fotor-ai/dsh-fotor-plugin.git#release/test" --ignore-scripts
-# npm production: latest dist-tag.
+# npm production: only after latest is the intended stable release.
 dsh plugin --profile web add "@fotor-ai/dsh-fotor-plugin" --ignore-scripts
 # npm test channel.
 dsh plugin --profile web add "@fotor-ai/dsh-fotor-plugin@next" --ignore-scripts
@@ -136,19 +138,21 @@ Example requests:
 - Website: “Connect to Fotor and introduce its capabilities.” Prepare the daily browser before requesting the one-use handoff; report website success only after user confirmation.
 - Explicit skill: select `/fotor-image` and describe a task. Every successful `submit_*_task` may consume credits; preserve the existing authorization and retry rules.
 
-Update the selected source, then repeat path and resource verification in a new process:
+Stop Fotor components and record their source, profile, store and external configuration before updating. Choose one command for the recorded source. For npm, replace `<target-version>` with an explicitly published and approved version, such as the exact version in the selected release notes:
 
 ```bash
 # Recorded Git source only.
 dsh plugin --profile "$FOTOR_PROFILE" update @fotor-ai/dsh-fotor-plugin --ignore-scripts
-# Recorded npm test source: explicitly select its channel.
-dsh plugin --profile "$FOTOR_PROFILE" update @fotor-ai/dsh-fotor-plugin@next --ignore-scripts
-# Recorded npm production source: explicitly select its channel.
-dsh plugin --profile "$FOTOR_PROFILE" update @fotor-ai/dsh-fotor-plugin@latest --ignore-scripts
+# Recorded npm source: select an exact published target, not a moving tag.
+dsh plugin --profile "$FOTOR_PROFILE" update "@fotor-ai/dsh-fotor-plugin@<target-version>" --ignore-scripts
 dsh plugin --profile "$FOTOR_PROFILE" why @fotor-ai/dsh-fotor-plugin
 ```
 
-Choose one update command for the recorded source. The accepted host/package-manager baseline saves npm additions as exact versions: an unqualified update can remain on that exact version even after the tag moves. Explicitly select the intended npm tag or approved exact target; do not apply npm tag selectors to Git installations. A failed native update is not a pass after reinstalling. Stop Fotor components before updating paths; preserve the external credential store, model settings and security parameters.
+For a custom store, append the original `--store-dir` argument to the selected update command. An unqualified update can remain on the saved npm version. In the recorded test.1-to-test.2 acceptance, immediate `update ...@next` returned success but retained test.1 on both Node 24.2.0 and 26.0.0, even after an approved exception for that exact version's release age. Exact-version native updates passed. The guide therefore uses exact versions for npm updates; this does not establish that `@latest` updates work or that waiting 24 hours always resolves tag updates. Keep Git installations on their recorded Git source: applying an npm version selector is a source change, not a Git update.
+
+Keep the package manager's release-age policy. If it blocks a newly published version, report the target and wait, or obtain separate approval for an exception limited to that exact version and isolated profile. The earlier test.2 approval does not cover later versions. Do not disable the policy globally, clear metadata caches or reinstall to manufacture an update pass.
+
+**Done when:** the installed version and source match the selected target, files and managed bridge are complete, and a new process discovers one copy of each skill at the re-resolved paths. A zero exit code alone is insufficient. Update complete configuration rows if paths moved; preserve the external credential store, model settings and security parameters. Record a failed native update separately from any later reinstall.
 
 ### Migrate from the legacy package or switch sources
 
@@ -164,7 +168,7 @@ For GitHub/npm switching or scoped-package removal, use:
 dsh plugin --profile "$FOTOR_PROFILE" remove @fotor-ai/dsh-fotor-plugin --config.ignore-scripts=true
 ```
 
-This host baseline rejects `--ignore-scripts` on removal; use the configuration form above. After adding the new source, resolve package and managed bridge paths again and restore a complete override. Keep one scoped installation and one component pair. Keep the credential directory, model settings and all connection/security parameters unchanged. Do not automatically delete the old external bridge directory or claim real credential reuse from an offline migration rehearsal.
+This host baseline rejects `--ignore-scripts` on removal; use the configuration form above and append the original `--store-dir` argument when a custom store was used. After adding the new source, resolve package and managed bridge paths again and restore a complete override. Keep one scoped installation and one component pair. Keep the credential directory, model settings and all connection/security parameters unchanged. Do not automatically delete the old external bridge directory or claim real credential reuse from an offline migration rehearsal.
 
 ### Troubleshooting
 

package/README.md

@@ -5,7 +5,7 @@
 <p align="center"><img src="assets/logo.svg" width="72" alt="Fotor logo" /></p>
 
 <p align="center">
-  <img src="https://img.shields.io/static/v1?label=version&amp;message=0.6.0-test.2&amp;color=087f8c&amp;style=flat-square" alt="Version" />
+  <img src="https://img.shields.io/static/v1?label=version&amp;message=0.6.0-test.3&amp;color=087f8c&amp;style=flat-square" alt="Version" />
   <img src="https://img.shields.io/static/v1?label=channel&amp;message=test&amp;color=a56800&amp;style=flat-square" alt="Release channel" />
   <a href="LICENSE"><img src="https://img.shields.io/static/v1?label=license&amp;message=Apache-2.0&amp;color=57606a&amp;style=flat-square" alt="Apache-2.0 license" /></a>
 </p>
@@ -18,7 +18,7 @@ Use Fotor's shared skills with DeepSeek Harness Web and an automatically install
 | Field | Value |
 | --- | --- |
 | Bundle | `@fotor-ai/dsh-fotor-plugin` |
-| Version | `0.6.0-test.2` |
+| Version | `0.6.0-test.3` |
 | Release channel | `test` |
 | Service environment | `production` |
 | MCP endpoint | `https://mcp.fotor.com/mcp` |
@@ -54,7 +54,7 @@ dsh plugin --profile web add "git+https://github.com/fotor-ai/dsh-fotor-plugin.g
 
 This is the standalone root Bundle for [https://github.com/fotor-ai/dsh-fotor-plugin](https://github.com/fotor-ai/dsh-fotor-plugin). Use its root Git source only after the selected channel contains this version. The [multi-platform repository](https://github.com/fotor-ai/fotor-agent-plugins) documents this external source; it no longer distributes new DeepSeek Harness packages. Existing subdirectory installations require a one-way native source migration.
 
-The Bundle identity is `@fotor-ai/dsh-fotor-plugin`. After the corresponding npm channel is published, its alternative is `dsh plugin --profile web add "@fotor-ai/dsh-fotor-plugin" --ignore-scripts` (production) or `dsh plugin --profile web add "@fotor-ai/dsh-fotor-plugin@next" --ignore-scripts` (test). Select one source only.
+The Bundle identity is `@fotor-ai/dsh-fotor-plugin`. After the corresponding npm channel is published, its alternative is `dsh plugin --profile web add "@fotor-ai/dsh-fotor-plugin" --ignore-scripts` (production) or `dsh plugin --profile web add "@fotor-ai/dsh-fotor-plugin@next" --ignore-scripts` (test). Verify the resolved version and select one source only. Bare-name npm installation follows `latest`; until the formal 0.6.0 rollout, that tag retains the accepted test.1 bootstrap exception and does not mean stable 0.6.0.
 
 Installation automatically obtains **mcp-remote 0.15.1**. Git sources download it through the host package manager; npm artifacts carry its complete locked runtime tree. Fotor skills remain script-free. No installation hook starts the bridge or OAuth, and Node is not bundled.
 
@@ -64,7 +64,7 @@ Follow the [complete installation guide](INSTALL.md):
 2. Install one source with lifecycle scripts disabled.
 3. Query actual package and dependency paths; verify both bridge entrypoints.
 4. Apply full external configuration and enable only skills first.
-5. Complete separate bridge-client authorization before enabling MCP.
+5. Configure the model account separately; complete bridge-client Fotor authorization and actual tool discovery, stop that client, then enable MCP. Website access is a separate request.
 
 The declared host range is `>=0.2.1-rc.2 <0.3.0-0`; matching versions are not automatically verified. Desktop, headless and ACP require separate acceptance.
 
@@ -89,9 +89,15 @@ dsh plugin --profile web update @fotor-ai/dsh-fotor-plugin --ignore-scripts
 dsh plugin --profile web why @fotor-ai/dsh-fotor-plugin
 ```
 
-For a recorded npm source, explicitly select its channel with `dsh plugin --profile web update @fotor-ai/dsh-fotor-plugin@next --ignore-scripts` for test, or `dsh plugin --profile web update @fotor-ai/dsh-fotor-plugin@latest --ignore-scripts` for production. This host may save npm additions as exact versions, so unqualified update can retain the old version. Never apply an npm tag selector to a Git source.
+For a recorded npm source, replace `<target-version>` with the approved, published version:
 
-Verify the source, version, files and actual skill/bridge directories in a new process. Preserve profile/store, credentials and connection parameters. An unsuccessful update remains a failure; reinstall is a separately recorded operation.
+```bash
+dsh plugin --profile web update "@fotor-ai/dsh-fotor-plugin@<target-version>" --ignore-scripts
+```
+
+Immediate `@next` updates retained test.1 during test.2 acceptance; exact-version native updates passed. An unqualified update can also retain the saved version. Neither `@latest` update success nor eventual success after 24 hours is established. Use the [maintenance procedure](INSTALL.md#7-use-update-or-remove-fotor); keep release-age protection and request separate approval for any exact-version exception. Never apply an npm selector to a Git source as an ordinary update.
+
+Verify the source, version, files and actual skill/bridge directories in a new process. Preserve profile/store, credentials and connection parameters. If installation used a custom `--store-dir`, pass that same argument to updates and removal. A zero exit code with the old version is not an upgrade; cache clearing or reinstall does not turn it into a pass.
 
 <a id="dsh-source-selection-and-removal"></a>
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fotor-ai/dsh-fotor-plugin",
-  "version": "0.6.0-test.2",
+  "version": "0.6.0-test.3",
   "description": "Connect to Fotor's production MCP service.",
   "author": {
     "name": "Fotor"

package/skills/fotor-connect/references/authentication.md

@@ -16,6 +16,8 @@ Use this guide with the [shared runtime workflow](mcp-integration.md#runtime-wor
 
 Installation declares two disabled components. The package manager automatically obtains the pinned bridge dependency. Installation does not register a working connection, scan unconfigured skill roots or start OAuth. For first installation, a missing bridge, unconfigured paths or missing skills, open the installed package's README and follow its `INSTALL.md` guide before continuing. That guide covers GitHub/npm installation, native dependency-path queries and complete configuration; no internal development document is required. The user or an Agent acting on their installation request completes those steps before connection.
 
+For an update or source change, read the same guide's maintenance section before changing the installation. npm updates use an explicit published target version; preserve the original profile/store and verify actual installed files before declaring success. Immediate tag updates have a recorded limitation. Updating paths is distinct from authorizing Fotor or opening its website; preserve the existing external credential directory.
+
 Copy `configuration.example.yml` outside the package. Inspect the effective profile, home patch and launch overlays before changing them. Stop on a conflicting `fotor` service or duplicate skill provider; preserve the existing configuration.
 
 Fill every path with its actual absolute location. Only the installed Fotor skill directory belongs in `customSkillDirs`; retain `includeDefaultRoots: false`. Use the independent Fotor provider name. Configure the external Node executable, bridge proxy, working directory and Fotor-only `MCP_REMOTE_CONFIG_DIR`. Keep the bridge store separate from model-provider credentials and other clients. Preserve it across package updates. Overrides replace the entire `config` object, including security and reconnect settings; they do not deep-merge individual fields.

package/skills/fotor-credits/references/authentication.md

@@ -16,6 +16,8 @@ Use this guide with the [shared runtime workflow](mcp-integration.md#runtime-wor
 
 Installation declares two disabled components. The package manager automatically obtains the pinned bridge dependency. Installation does not register a working connection, scan unconfigured skill roots or start OAuth. For first installation, a missing bridge, unconfigured paths or missing skills, open the installed package's README and follow its `INSTALL.md` guide before continuing. That guide covers GitHub/npm installation, native dependency-path queries and complete configuration; no internal development document is required. The user or an Agent acting on their installation request completes those steps before connection.
 
+For an update or source change, read the same guide's maintenance section before changing the installation. npm updates use an explicit published target version; preserve the original profile/store and verify actual installed files before declaring success. Immediate tag updates have a recorded limitation. Updating paths is distinct from authorizing Fotor or opening its website; preserve the existing external credential directory.
+
 Copy `configuration.example.yml` outside the package. Inspect the effective profile, home patch and launch overlays before changing them. Stop on a conflicting `fotor` service or duplicate skill provider; preserve the existing configuration.
 
 Fill every path with its actual absolute location. Only the installed Fotor skill directory belongs in `customSkillDirs`; retain `includeDefaultRoots: false`. Use the independent Fotor provider name. Configure the external Node executable, bridge proxy, working directory and Fotor-only `MCP_REMOTE_CONFIG_DIR`. Keep the bridge store separate from model-provider credentials and other clients. Preserve it across package updates. Overrides replace the entire `config` object, including security and reconnect settings; they do not deep-merge individual fields.

package/skills/fotor-image/references/authentication.md

@@ -16,6 +16,8 @@ Use this guide with the [shared runtime workflow](mcp-integration.md#runtime-wor
 
 Installation declares two disabled components. The package manager automatically obtains the pinned bridge dependency. Installation does not register a working connection, scan unconfigured skill roots or start OAuth. For first installation, a missing bridge, unconfigured paths or missing skills, open the installed package's README and follow its `INSTALL.md` guide before continuing. That guide covers GitHub/npm installation, native dependency-path queries and complete configuration; no internal development document is required. The user or an Agent acting on their installation request completes those steps before connection.
 
+For an update or source change, read the same guide's maintenance section before changing the installation. npm updates use an explicit published target version; preserve the original profile/store and verify actual installed files before declaring success. Immediate tag updates have a recorded limitation. Updating paths is distinct from authorizing Fotor or opening its website; preserve the existing external credential directory.
+
 Copy `configuration.example.yml` outside the package. Inspect the effective profile, home patch and launch overlays before changing them. Stop on a conflicting `fotor` service or duplicate skill provider; preserve the existing configuration.
 
 Fill every path with its actual absolute location. Only the installed Fotor skill directory belongs in `customSkillDirs`; retain `includeDefaultRoots: false`. Use the independent Fotor provider name. Configure the external Node executable, bridge proxy, working directory and Fotor-only `MCP_REMOTE_CONFIG_DIR`. Keep the bridge store separate from model-provider credentials and other clients. Preserve it across package updates. Overrides replace the entire `config` object, including security and reconnect settings; they do not deep-merge individual fields.

package/skills/fotor-upload/references/authentication.md

@@ -16,6 +16,8 @@ Use this guide with the [shared runtime workflow](mcp-integration.md#runtime-wor
 
 Installation declares two disabled components. The package manager automatically obtains the pinned bridge dependency. Installation does not register a working connection, scan unconfigured skill roots or start OAuth. For first installation, a missing bridge, unconfigured paths or missing skills, open the installed package's README and follow its `INSTALL.md` guide before continuing. That guide covers GitHub/npm installation, native dependency-path queries and complete configuration; no internal development document is required. The user or an Agent acting on their installation request completes those steps before connection.
 
+For an update or source change, read the same guide's maintenance section before changing the installation. npm updates use an explicit published target version; preserve the original profile/store and verify actual installed files before declaring success. Immediate tag updates have a recorded limitation. Updating paths is distinct from authorizing Fotor or opening its website; preserve the existing external credential directory.
+
 Copy `configuration.example.yml` outside the package. Inspect the effective profile, home patch and launch overlays before changing them. Stop on a conflicting `fotor` service or duplicate skill provider; preserve the existing configuration.
 
 Fill every path with its actual absolute location. Only the installed Fotor skill directory belongs in `customSkillDirs`; retain `includeDefaultRoots: false`. Use the independent Fotor provider name. Configure the external Node executable, bridge proxy, working directory and Fotor-only `MCP_REMOTE_CONFIG_DIR`. Keep the bridge store separate from model-provider credentials and other clients. Preserve it across package updates. Overrides replace the entire `config` object, including security and reconnect settings; they do not deep-merge individual fields.

package/skills/fotor-video/references/authentication.md

@@ -16,6 +16,8 @@ Use this guide with the [shared runtime workflow](mcp-integration.md#runtime-wor
 
 Installation declares two disabled components. The package manager automatically obtains the pinned bridge dependency. Installation does not register a working connection, scan unconfigured skill roots or start OAuth. For first installation, a missing bridge, unconfigured paths or missing skills, open the installed package's README and follow its `INSTALL.md` guide before continuing. That guide covers GitHub/npm installation, native dependency-path queries and complete configuration; no internal development document is required. The user or an Agent acting on their installation request completes those steps before connection.
 
+For an update or source change, read the same guide's maintenance section before changing the installation. npm updates use an explicit published target version; preserve the original profile/store and verify actual installed files before declaring success. Immediate tag updates have a recorded limitation. Updating paths is distinct from authorizing Fotor or opening its website; preserve the existing external credential directory.
+
 Copy `configuration.example.yml` outside the package. Inspect the effective profile, home patch and launch overlays before changing them. Stop on a conflicting `fotor` service or duplicate skill provider; preserve the existing configuration.
 
 Fill every path with its actual absolute location. Only the installed Fotor skill directory belongs in `customSkillDirs`; retain `includeDefaultRoots: false`. Use the independent Fotor provider name. Configure the external Node executable, bridge proxy, working directory and Fotor-only `MCP_REMOTE_CONFIG_DIR`. Keep the bridge store separate from model-provider credentials and other clients. Preserve it across package updates. Overrides replace the entire `config` object, including security and reconnect settings; they do not deep-merge individual fields.