@fotor-ai/dsh-fotor-plugin 0.6.0-test.2 → 0.6.0-test.4

package/INSTALL.md

@@ -2,7 +2,9 @@
 
 > Requires stable Node 24.2.0 or later within 24.x, or stable Node 26.x. The fixed DeepSeek Harness 0.2.1-rc.2 launcher needs `import.meta.main`, introduced in Node 24.2.0. Earlier Node 24 releases are outside the supported range. Use the release's recorded runtime results for the exact tested versions.
 
-DeepSeek Harness is abbreviated as `dsh` in commands and native identifiers. This guide is self-contained for the independent package. Source 0.6.0 is unpublished: use public commands below only after the selected GitHub or npm channel contains that version. Existing 0.5.1 installations retain their original installation procedure until migrated.
+DeepSeek Harness is abbreviated as `dsh` in commands and native identifiers. This guide is self-contained for the independent 0.6.0 package. Test distributions are available; stable availability is separate. This internal refresh pins mcp-remote 0.15.2; published test.3 retains 0.15.1 until a refreshed channel is released. Check the selected GitHub revision or npm version before installing. Existing 0.5.1 installations retain their original guide until migrated to the scoped identity.
+
+During the 0.6.0 test rollout, GitHub's default branch still supplies 0.5.1 and npm `latest` retains the accepted first-publication exception, `0.6.0-test.1`. Bare-name npm installation therefore selects a prerelease until the formal rollout replaces it. Use the GitHub test branch or a verified npm test version during that interval; use production examples only after the selected channel contains the intended stable release.
 
 ## 1. Check prerequisites and select a profile
 
@@ -16,13 +18,13 @@ dsh plugin --profile web root
 
 Git sources additionally require Git. Follow the [host quickstart](https://deepseek-harness.github.io/deepseek-harness/en/guide/quickstart) or [Node downloads](https://nodejs.org/en/download/) for missing prerequisites. Node is not bundled. Preserve daily installations; do not upgrade them to satisfy an acceptance run.
 
-Select one profile, working directory and Fotor-only credential directory outside the installed package. Inspect existing Fotor components before changing anything. A model-provider account is separate from Fotor OAuth.
+Select one profile, working directory and Fotor-only credential directory outside the installed package. Inspect existing Fotor components before changing anything. A model-provider account is separate from Fotor OAuth. If installation uses a custom `--store-dir /absolute/path/to/store`, record it and pass that same argument on later add, update and remove commands. Retain the original profile and source as well.
 
 **Done when:** the host and Node versions are known, the native package manager works, and the profile and external storage locations are selected.
 
 ## 2. Install one Bundle source
 
-The package name is **`@fotor-ai/dsh-fotor-plugin`** for both sources. Installing it automatically obtains the pinned **mcp-remote 0.15.1** runtime. There is no separate bridge installation command. Git installation downloads the dependency through the host package manager; npm artifacts already carry the bridge and its complete runtime dependency tree. Installation starts neither the bridge nor OAuth.
+The package name is **`@fotor-ai/dsh-fotor-plugin`** for both sources. Installing it automatically obtains the pinned **mcp-remote 0.15.2** runtime. There is no separate bridge installation command. Git installation downloads the dependency through the host package manager; npm artifacts already carry the bridge and its complete runtime dependency tree. Installation starts neither the bridge nor OAuth.
 
 Choose exactly one command after its channel is published:
 
@@ -31,7 +33,7 @@ Choose exactly one command after its channel is published:
 dsh plugin --profile web add "git+https://github.com/fotor-ai/dsh-fotor-plugin.git" --ignore-scripts
 # GitHub test channel.
 dsh plugin --profile web add "git+https://github.com/fotor-ai/dsh-fotor-plugin.git#release/test" --ignore-scripts
-# npm production: latest dist-tag.
+# npm production: only after latest is the intended stable release.
 dsh plugin --profile web add "@fotor-ai/dsh-fotor-plugin" --ignore-scripts
 # npm test channel.
 dsh plugin --profile web add "@fotor-ai/dsh-fotor-plugin@next" --ignore-scripts
@@ -56,7 +58,7 @@ dsh plugin --profile "$FOTOR_PROFILE" why mcp-remote --json
 
 Choose the resolution route matching the installed manifest:
 
-- **Git source:** the dependency query can return multiple paths. Select the mcp-remote 0.15.1 dependency owned by this exact Fotor installation; stop on ambiguity. pnpm can place it beside the package rather than inside it. Set `FOTOR_BRIDGE` to that verified absolute dependency path.
+- **Git source:** the dependency query can return multiple paths. Select the mcp-remote 0.15.2 dependency owned by this exact Fotor installation; stop on ambiguity. pnpm can place it beside the package rather than inside it. Set `FOTOR_BRIDGE` to that verified absolute dependency path.
 - **npm artifact:** after verifying `bundleDependencies` names mcp-remote, resolve the bundled directory below. The native dependency list may omit bundled packages; an empty list alone is not a missing bridge.
 
 ```bash
@@ -76,7 +78,7 @@ test -f "$FOTOR_BRIDGE/dist/proxy.js"
 
 Git pins the direct bridge version; its transitive graph is resolved by the host and should be recorded when reproducing a result. The packaged lock file is the npm release-build input, not a promise that pnpm honors it during Git installation.
 
-**Done when:** the scoped package/version, bridge 0.15.1, both bridge entrypoints and all selected absolute paths are verified. A `why` result alone does not establish file completeness or the Git commit.
+**Done when:** the scoped package/version, bridge 0.15.2, both bridge entrypoints and all selected absolute paths are verified. A `why` result alone does not establish file completeness or the Git commit.
 
 ## 4. Prepare complete configuration
 
@@ -136,19 +138,21 @@ Example requests:
 - Website: “Connect to Fotor and introduce its capabilities.” Prepare the daily browser before requesting the one-use handoff; report website success only after user confirmation.
 - Explicit skill: select `/fotor-image` and describe a task. Every successful `submit_*_task` may consume credits; preserve the existing authorization and retry rules.
 
-Update the selected source, then repeat path and resource verification in a new process:
+Stop Fotor components and record their source, profile, store and external configuration before updating. Choose one command for the recorded source. For npm, replace `<target-version>` with an explicitly published and approved version, such as the exact version in the selected release notes:
 
 ```bash
 # Recorded Git source only.
 dsh plugin --profile "$FOTOR_PROFILE" update @fotor-ai/dsh-fotor-plugin --ignore-scripts
-# Recorded npm test source: explicitly select its channel.
-dsh plugin --profile "$FOTOR_PROFILE" update @fotor-ai/dsh-fotor-plugin@next --ignore-scripts
-# Recorded npm production source: explicitly select its channel.
-dsh plugin --profile "$FOTOR_PROFILE" update @fotor-ai/dsh-fotor-plugin@latest --ignore-scripts
+# Recorded npm source: select an exact published target, not a moving tag.
+dsh plugin --profile "$FOTOR_PROFILE" update "@fotor-ai/dsh-fotor-plugin@<target-version>" --ignore-scripts
 dsh plugin --profile "$FOTOR_PROFILE" why @fotor-ai/dsh-fotor-plugin
 ```
 
-Choose one update command for the recorded source. The accepted host/package-manager baseline saves npm additions as exact versions: an unqualified update can remain on that exact version even after the tag moves. Explicitly select the intended npm tag or approved exact target; do not apply npm tag selectors to Git installations. A failed native update is not a pass after reinstalling. Stop Fotor components before updating paths; preserve the external credential store, model settings and security parameters.
+For a custom store, append the original `--store-dir` argument to the selected update command. An unqualified update can remain on the saved npm version. In the recorded test.1-to-test.2 acceptance, immediate `update ...@next` returned success but retained test.1 on both Node 24.2.0 and 26.0.0, even after an approved exception for that exact version's release age. Exact-version native updates passed. The guide therefore uses exact versions for npm updates; this does not establish that `@latest` updates work or that waiting 24 hours always resolves tag updates. Keep Git installations on their recorded Git source: applying an npm version selector is a source change, not a Git update.
+
+Keep the package manager's release-age policy. If it blocks a newly published version, report the target and wait, or obtain separate approval for an exception limited to that exact version and isolated profile. The earlier test.2 approval does not cover later versions. Do not disable the policy globally, clear metadata caches or reinstall to manufacture an update pass.
+
+**Done when:** the installed version and source match the selected target, files and managed bridge are complete, and a new process discovers one copy of each skill at the re-resolved paths. A zero exit code alone is insufficient. Update complete configuration rows if paths moved; preserve the external credential store, model settings and security parameters. Record a failed native update separately from any later reinstall.
 
 ### Migrate from the legacy package or switch sources
 
@@ -164,7 +168,7 @@ For GitHub/npm switching or scoped-package removal, use:
 dsh plugin --profile "$FOTOR_PROFILE" remove @fotor-ai/dsh-fotor-plugin --config.ignore-scripts=true
 ```
 
-This host baseline rejects `--ignore-scripts` on removal; use the configuration form above. After adding the new source, resolve package and managed bridge paths again and restore a complete override. Keep one scoped installation and one component pair. Keep the credential directory, model settings and all connection/security parameters unchanged. Do not automatically delete the old external bridge directory or claim real credential reuse from an offline migration rehearsal.
+This host baseline rejects `--ignore-scripts` on removal; use the configuration form above and append the original `--store-dir` argument when a custom store was used. After adding the new source, resolve package and managed bridge paths again and restore a complete override. Keep one scoped installation and one component pair. Keep the credential directory, model settings and all connection/security parameters unchanged. Do not automatically delete the old external bridge directory or claim real credential reuse from an offline migration rehearsal.
 
 ### Troubleshooting
 

package/README.md

@@ -5,7 +5,7 @@
 <p align="center"><img src="assets/logo.svg" width="72" alt="Fotor logo" /></p>
 
 <p align="center">
-  <img src="https://img.shields.io/static/v1?label=version&amp;message=0.6.0-test.2&amp;color=087f8c&amp;style=flat-square" alt="Version" />
+  <img src="https://img.shields.io/static/v1?label=version&amp;message=0.6.0-test.4&amp;color=087f8c&amp;style=flat-square" alt="Version" />
   <img src="https://img.shields.io/static/v1?label=channel&amp;message=test&amp;color=a56800&amp;style=flat-square" alt="Release channel" />
   <a href="LICENSE"><img src="https://img.shields.io/static/v1?label=license&amp;message=Apache-2.0&amp;color=57606a&amp;style=flat-square" alt="Apache-2.0 license" /></a>
 </p>
@@ -18,13 +18,13 @@ Use Fotor's shared skills with DeepSeek Harness Web and an automatically install
 | Field | Value |
 | --- | --- |
 | Bundle | `@fotor-ai/dsh-fotor-plugin` |
-| Version | `0.6.0-test.2` |
+| Version | `0.6.0-test.4` |
 | Release channel | `test` |
 | Service environment | `production` |
 | MCP endpoint | `https://mcp.fotor.com/mcp` |
 | Declared host range | `>=0.2.1-rc.2 <0.3.0-0` |
 | Host baseline | Linux DeepSeek Harness Web 0.2.1-rc.2 |
-| Bridge | mcp-remote 0.15.1 |
+| Bridge | mcp-remote 0.15.2 |
 | Node range | `>=24.2.0 <25.0.0 \|\| 26.x`, stable versions |
 | License | Apache-2.0 |
 
@@ -54,9 +54,9 @@ dsh plugin --profile web add "git+https://github.com/fotor-ai/dsh-fotor-plugin.g
 
 This is the standalone root Bundle for [https://github.com/fotor-ai/dsh-fotor-plugin](https://github.com/fotor-ai/dsh-fotor-plugin). Use its root Git source only after the selected channel contains this version. The [multi-platform repository](https://github.com/fotor-ai/fotor-agent-plugins) documents this external source; it no longer distributes new DeepSeek Harness packages. Existing subdirectory installations require a one-way native source migration.
 
-The Bundle identity is `@fotor-ai/dsh-fotor-plugin`. After the corresponding npm channel is published, its alternative is `dsh plugin --profile web add "@fotor-ai/dsh-fotor-plugin" --ignore-scripts` (production) or `dsh plugin --profile web add "@fotor-ai/dsh-fotor-plugin@next" --ignore-scripts` (test). Select one source only.
+The Bundle identity is `@fotor-ai/dsh-fotor-plugin`. After the corresponding npm channel is published, its alternative is `dsh plugin --profile web add "@fotor-ai/dsh-fotor-plugin" --ignore-scripts` (production) or `dsh plugin --profile web add "@fotor-ai/dsh-fotor-plugin@next" --ignore-scripts` (test). Verify the resolved version and select one source only. Bare-name npm installation follows `latest`; until the formal 0.6.0 rollout, that tag retains the accepted test.1 bootstrap exception and does not mean stable 0.6.0.
 
-Installation automatically obtains **mcp-remote 0.15.1**. Git sources download it through the host package manager; npm artifacts carry its complete locked runtime tree. Fotor skills remain script-free. No installation hook starts the bridge or OAuth, and Node is not bundled.
+Installation automatically obtains **mcp-remote 0.15.2**. Git sources download it through the host package manager; npm artifacts carry its complete locked runtime tree. Fotor skills remain script-free. No installation hook starts the bridge or OAuth, and Node is not bundled.
 
 Follow the [complete installation guide](INSTALL.md):
 
@@ -64,7 +64,7 @@ Follow the [complete installation guide](INSTALL.md):
 2. Install one source with lifecycle scripts disabled.
 3. Query actual package and dependency paths; verify both bridge entrypoints.
 4. Apply full external configuration and enable only skills first.
-5. Complete separate bridge-client authorization before enabling MCP.
+5. Configure the model account separately; complete bridge-client Fotor authorization and actual tool discovery, stop that client, then enable MCP. Website access is a separate request.
 
 The declared host range is `>=0.2.1-rc.2 <0.3.0-0`; matching versions are not automatically verified. Desktop, headless and ACP require separate acceptance.
 
@@ -89,9 +89,15 @@ dsh plugin --profile web update @fotor-ai/dsh-fotor-plugin --ignore-scripts
 dsh plugin --profile web why @fotor-ai/dsh-fotor-plugin
 ```
 
-For a recorded npm source, explicitly select its channel with `dsh plugin --profile web update @fotor-ai/dsh-fotor-plugin@next --ignore-scripts` for test, or `dsh plugin --profile web update @fotor-ai/dsh-fotor-plugin@latest --ignore-scripts` for production. This host may save npm additions as exact versions, so unqualified update can retain the old version. Never apply an npm tag selector to a Git source.
+For a recorded npm source, replace `<target-version>` with the approved, published version:
 
-Verify the source, version, files and actual skill/bridge directories in a new process. Preserve profile/store, credentials and connection parameters. An unsuccessful update remains a failure; reinstall is a separately recorded operation.
+```bash
+dsh plugin --profile web update "@fotor-ai/dsh-fotor-plugin@<target-version>" --ignore-scripts
+```
+
+Immediate `@next` updates retained test.1 during test.2 acceptance; exact-version native updates passed. An unqualified update can also retain the saved version. Neither `@latest` update success nor eventual success after 24 hours is established. Use the [maintenance procedure](INSTALL.md#7-use-update-or-remove-fotor); keep release-age protection and request separate approval for any exact-version exception. Never apply an npm selector to a Git source as an ordinary update.
+
+Verify the source, version, files and actual skill/bridge directories in a new process. Preserve profile/store, credentials and connection parameters. If installation used a custom `--store-dir`, pass that same argument to updates and removal. A zero exit code with the old version is not an upgrade; cache clearing or reinstall does not turn it into a pass.
 
 <a id="dsh-source-selection-and-removal"></a>
 

package/node_modules/mcp-remote/dist/{chunk-KJCT2FXL.js → chunk-UZ6Y4QJH.js}

@@ -31556,7 +31556,7 @@ var StreamableHTTPClientTransport = class {
 };
 
 // package.json
-var version2 = "0.15.1";
+var version2 = "0.15.2";
 
 // src/lib/protocol-era.ts
 var FIRST_MODERN_PROTOCOL_VERSION2 = "2026-07-28";
@@ -35433,6 +35433,7 @@ ${authorizationUrl.toString()}
         await deleteConfigFile(this.serverUrlHash, "client_info.json");
         this._clientInfo = void 0;
         this.clientRegistrationSource = void 0;
+        this.pendingFlow = null;
         debugLog("Client information invalidated");
         break;
       case "tokens":

package/node_modules/mcp-remote/dist/client.js

@@ -14,7 +14,7 @@ import {
   serverIssuesAuthChallenge,
   setupSignalHandlers,
   version
-} from "./chunk-KJCT2FXL.js";
+} from "./chunk-UZ6Y4QJH.js";
 import "./chunk-MLKGABMK.js";
 
 // src/client.ts

package/node_modules/mcp-remote/dist/proxy.js

@@ -221,7 +221,7 @@ import {
   union,
   unknown,
   url
-} from "./chunk-KJCT2FXL.js";
+} from "./chunk-UZ6Y4QJH.js";
 import "./chunk-MLKGABMK.js";
 
 // src/proxy.ts

package/node_modules/mcp-remote/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-remote",
-  "version": "0.15.1",
+  "version": "0.15.2",
   "description": "Remote proxy for Model Context Protocol, allowing local-only clients to connect to remote servers using oAuth",
   "keywords": [
     "mcp",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fotor-ai/dsh-fotor-plugin",
-  "version": "0.6.0-test.2",
+  "version": "0.6.0-test.4",
   "description": "Connect to Fotor's production MCP service.",
   "author": {
     "name": "Fotor"
@@ -28,7 +28,7 @@
     }
   },
   "dependencies": {
-    "mcp-remote": "0.15.1"
+    "mcp-remote": "0.15.2"
   },
   "bundleDependencies": [
     "mcp-remote"

package/skills/fotor-connect/references/authentication.md

@@ -8,7 +8,7 @@ DeepSeek Harness is abbreviated as `dsh` in commands and native identifiers.
 
 ## Ownership and baseline
 
-This Bundle targets Linux DeepSeek Harness Web `0.2.1-rc.2`, with package-manager-owned `mcp-remote 0.15.1` and stable Node `>=24.2.0 <25.0.0 || 26.x`. DeepSeek Harness owns the stdio client and tool permissions; the bridge owns OAuth and its credential store. Do not describe this as native remote OAuth in DeepSeek Harness. Desktop, headless and ACP have separate acceptance scopes.
+This Bundle targets Linux DeepSeek Harness Web `0.2.1-rc.2`, with package-manager-owned `mcp-remote 0.15.2` and stable Node `>=24.2.0 <25.0.0 || 26.x`. DeepSeek Harness owns the stdio client and tool permissions; the bridge owns OAuth and its credential store. Do not describe this as native remote OAuth in DeepSeek Harness. Desktop, headless and ACP have separate acceptance scopes.
 
 Use this guide with the [shared runtime workflow](mcp-integration.md#runtime-workflow). Installation, authorization, actual calls, website access, restart reuse and reauthorization recovery are distinct outcomes. Do not infer full support from one successful call.
 
@@ -16,6 +16,8 @@ Use this guide with the [shared runtime workflow](mcp-integration.md#runtime-wor
 
 Installation declares two disabled components. The package manager automatically obtains the pinned bridge dependency. Installation does not register a working connection, scan unconfigured skill roots or start OAuth. For first installation, a missing bridge, unconfigured paths or missing skills, open the installed package's README and follow its `INSTALL.md` guide before continuing. That guide covers GitHub/npm installation, native dependency-path queries and complete configuration; no internal development document is required. The user or an Agent acting on their installation request completes those steps before connection.
 
+For an update or source change, read the same guide's maintenance section before changing the installation. npm updates use an explicit published target version; preserve the original profile/store and verify actual installed files before declaring success. Immediate tag updates have a recorded limitation. Updating paths is distinct from authorizing Fotor or opening its website; preserve the existing external credential directory.
+
 Copy `configuration.example.yml` outside the package. Inspect the effective profile, home patch and launch overlays before changing them. Stop on a conflicting `fotor` service or duplicate skill provider; preserve the existing configuration.
 
 Fill every path with its actual absolute location. Only the installed Fotor skill directory belongs in `customSkillDirs`; retain `includeDefaultRoots: false`. Use the independent Fotor provider name. Configure the external Node executable, bridge proxy, working directory and Fotor-only `MCP_REMOTE_CONFIG_DIR`. Keep the bridge store separate from model-provider credentials and other clients. Preserve it across package updates. Overrides replace the entire `config` object, including security and reconnect settings; they do not deep-merge individual fields.
@@ -26,7 +28,7 @@ Use DeepSeek Harness's native `read` tool for the known package references. Its
 
 ## First authorization
 
-Verify this installed package owns mcp-remote 0.15.1, and resolve its actual client/proxy paths using the installation guide: native dependency queries for Git, or the declared bundled directory for npm. Never download or upgrade it during connection with an unpinned `npx` command. Keep the stdio proxy stopped while the standalone authorization client runs.
+Verify this installed package owns mcp-remote 0.15.2, and resolve its actual client/proxy paths using the installation guide: native dependency queries for Git, or the declared bundled directory for npm. Never download or upgrade it during connection with an unpinned `npx` command. Keep the stdio proxy stopped while the standalone authorization client runs.
 
 Confirm the actual opener in this launch environment uses the user's daily ordinary browser. A task-specific desktop routing override may be needed; do not change the system default, create an incognito or headless session, or clear browser data. The model-provider login is independent of Fotor OAuth.
 

package/skills/fotor-credits/references/authentication.md

@@ -8,7 +8,7 @@ DeepSeek Harness is abbreviated as `dsh` in commands and native identifiers.
 
 ## Ownership and baseline
 
-This Bundle targets Linux DeepSeek Harness Web `0.2.1-rc.2`, with package-manager-owned `mcp-remote 0.15.1` and stable Node `>=24.2.0 <25.0.0 || 26.x`. DeepSeek Harness owns the stdio client and tool permissions; the bridge owns OAuth and its credential store. Do not describe this as native remote OAuth in DeepSeek Harness. Desktop, headless and ACP have separate acceptance scopes.
+This Bundle targets Linux DeepSeek Harness Web `0.2.1-rc.2`, with package-manager-owned `mcp-remote 0.15.2` and stable Node `>=24.2.0 <25.0.0 || 26.x`. DeepSeek Harness owns the stdio client and tool permissions; the bridge owns OAuth and its credential store. Do not describe this as native remote OAuth in DeepSeek Harness. Desktop, headless and ACP have separate acceptance scopes.
 
 Use this guide with the [shared runtime workflow](mcp-integration.md#runtime-workflow). Installation, authorization, actual calls, website access, restart reuse and reauthorization recovery are distinct outcomes. Do not infer full support from one successful call.
 
@@ -16,6 +16,8 @@ Use this guide with the [shared runtime workflow](mcp-integration.md#runtime-wor
 
 Installation declares two disabled components. The package manager automatically obtains the pinned bridge dependency. Installation does not register a working connection, scan unconfigured skill roots or start OAuth. For first installation, a missing bridge, unconfigured paths or missing skills, open the installed package's README and follow its `INSTALL.md` guide before continuing. That guide covers GitHub/npm installation, native dependency-path queries and complete configuration; no internal development document is required. The user or an Agent acting on their installation request completes those steps before connection.
 
+For an update or source change, read the same guide's maintenance section before changing the installation. npm updates use an explicit published target version; preserve the original profile/store and verify actual installed files before declaring success. Immediate tag updates have a recorded limitation. Updating paths is distinct from authorizing Fotor or opening its website; preserve the existing external credential directory.
+
 Copy `configuration.example.yml` outside the package. Inspect the effective profile, home patch and launch overlays before changing them. Stop on a conflicting `fotor` service or duplicate skill provider; preserve the existing configuration.
 
 Fill every path with its actual absolute location. Only the installed Fotor skill directory belongs in `customSkillDirs`; retain `includeDefaultRoots: false`. Use the independent Fotor provider name. Configure the external Node executable, bridge proxy, working directory and Fotor-only `MCP_REMOTE_CONFIG_DIR`. Keep the bridge store separate from model-provider credentials and other clients. Preserve it across package updates. Overrides replace the entire `config` object, including security and reconnect settings; they do not deep-merge individual fields.
@@ -26,7 +28,7 @@ Use DeepSeek Harness's native `read` tool for the known package references. Its
 
 ## First authorization
 
-Verify this installed package owns mcp-remote 0.15.1, and resolve its actual client/proxy paths using the installation guide: native dependency queries for Git, or the declared bundled directory for npm. Never download or upgrade it during connection with an unpinned `npx` command. Keep the stdio proxy stopped while the standalone authorization client runs.
+Verify this installed package owns mcp-remote 0.15.2, and resolve its actual client/proxy paths using the installation guide: native dependency queries for Git, or the declared bundled directory for npm. Never download or upgrade it during connection with an unpinned `npx` command. Keep the stdio proxy stopped while the standalone authorization client runs.
 
 Confirm the actual opener in this launch environment uses the user's daily ordinary browser. A task-specific desktop routing override may be needed; do not change the system default, create an incognito or headless session, or clear browser data. The model-provider login is independent of Fotor OAuth.
 

package/skills/fotor-image/references/authentication.md

@@ -8,7 +8,7 @@ DeepSeek Harness is abbreviated as `dsh` in commands and native identifiers.
 
 ## Ownership and baseline
 
-This Bundle targets Linux DeepSeek Harness Web `0.2.1-rc.2`, with package-manager-owned `mcp-remote 0.15.1` and stable Node `>=24.2.0 <25.0.0 || 26.x`. DeepSeek Harness owns the stdio client and tool permissions; the bridge owns OAuth and its credential store. Do not describe this as native remote OAuth in DeepSeek Harness. Desktop, headless and ACP have separate acceptance scopes.
+This Bundle targets Linux DeepSeek Harness Web `0.2.1-rc.2`, with package-manager-owned `mcp-remote 0.15.2` and stable Node `>=24.2.0 <25.0.0 || 26.x`. DeepSeek Harness owns the stdio client and tool permissions; the bridge owns OAuth and its credential store. Do not describe this as native remote OAuth in DeepSeek Harness. Desktop, headless and ACP have separate acceptance scopes.
 
 Use this guide with the [shared runtime workflow](mcp-integration.md#runtime-workflow). Installation, authorization, actual calls, website access, restart reuse and reauthorization recovery are distinct outcomes. Do not infer full support from one successful call.
 
@@ -16,6 +16,8 @@ Use this guide with the [shared runtime workflow](mcp-integration.md#runtime-wor
 
 Installation declares two disabled components. The package manager automatically obtains the pinned bridge dependency. Installation does not register a working connection, scan unconfigured skill roots or start OAuth. For first installation, a missing bridge, unconfigured paths or missing skills, open the installed package's README and follow its `INSTALL.md` guide before continuing. That guide covers GitHub/npm installation, native dependency-path queries and complete configuration; no internal development document is required. The user or an Agent acting on their installation request completes those steps before connection.
 
+For an update or source change, read the same guide's maintenance section before changing the installation. npm updates use an explicit published target version; preserve the original profile/store and verify actual installed files before declaring success. Immediate tag updates have a recorded limitation. Updating paths is distinct from authorizing Fotor or opening its website; preserve the existing external credential directory.
+
 Copy `configuration.example.yml` outside the package. Inspect the effective profile, home patch and launch overlays before changing them. Stop on a conflicting `fotor` service or duplicate skill provider; preserve the existing configuration.
 
 Fill every path with its actual absolute location. Only the installed Fotor skill directory belongs in `customSkillDirs`; retain `includeDefaultRoots: false`. Use the independent Fotor provider name. Configure the external Node executable, bridge proxy, working directory and Fotor-only `MCP_REMOTE_CONFIG_DIR`. Keep the bridge store separate from model-provider credentials and other clients. Preserve it across package updates. Overrides replace the entire `config` object, including security and reconnect settings; they do not deep-merge individual fields.
@@ -26,7 +28,7 @@ Use DeepSeek Harness's native `read` tool for the known package references. Its
 
 ## First authorization
 
-Verify this installed package owns mcp-remote 0.15.1, and resolve its actual client/proxy paths using the installation guide: native dependency queries for Git, or the declared bundled directory for npm. Never download or upgrade it during connection with an unpinned `npx` command. Keep the stdio proxy stopped while the standalone authorization client runs.
+Verify this installed package owns mcp-remote 0.15.2, and resolve its actual client/proxy paths using the installation guide: native dependency queries for Git, or the declared bundled directory for npm. Never download or upgrade it during connection with an unpinned `npx` command. Keep the stdio proxy stopped while the standalone authorization client runs.
 
 Confirm the actual opener in this launch environment uses the user's daily ordinary browser. A task-specific desktop routing override may be needed; do not change the system default, create an incognito or headless session, or clear browser data. The model-provider login is independent of Fotor OAuth.
 

package/skills/fotor-upload/references/authentication.md

@@ -8,7 +8,7 @@ DeepSeek Harness is abbreviated as `dsh` in commands and native identifiers.
 
 ## Ownership and baseline
 
-This Bundle targets Linux DeepSeek Harness Web `0.2.1-rc.2`, with package-manager-owned `mcp-remote 0.15.1` and stable Node `>=24.2.0 <25.0.0 || 26.x`. DeepSeek Harness owns the stdio client and tool permissions; the bridge owns OAuth and its credential store. Do not describe this as native remote OAuth in DeepSeek Harness. Desktop, headless and ACP have separate acceptance scopes.
+This Bundle targets Linux DeepSeek Harness Web `0.2.1-rc.2`, with package-manager-owned `mcp-remote 0.15.2` and stable Node `>=24.2.0 <25.0.0 || 26.x`. DeepSeek Harness owns the stdio client and tool permissions; the bridge owns OAuth and its credential store. Do not describe this as native remote OAuth in DeepSeek Harness. Desktop, headless and ACP have separate acceptance scopes.
 
 Use this guide with the [shared runtime workflow](mcp-integration.md#runtime-workflow). Installation, authorization, actual calls, website access, restart reuse and reauthorization recovery are distinct outcomes. Do not infer full support from one successful call.
 
@@ -16,6 +16,8 @@ Use this guide with the [shared runtime workflow](mcp-integration.md#runtime-wor
 
 Installation declares two disabled components. The package manager automatically obtains the pinned bridge dependency. Installation does not register a working connection, scan unconfigured skill roots or start OAuth. For first installation, a missing bridge, unconfigured paths or missing skills, open the installed package's README and follow its `INSTALL.md` guide before continuing. That guide covers GitHub/npm installation, native dependency-path queries and complete configuration; no internal development document is required. The user or an Agent acting on their installation request completes those steps before connection.
 
+For an update or source change, read the same guide's maintenance section before changing the installation. npm updates use an explicit published target version; preserve the original profile/store and verify actual installed files before declaring success. Immediate tag updates have a recorded limitation. Updating paths is distinct from authorizing Fotor or opening its website; preserve the existing external credential directory.
+
 Copy `configuration.example.yml` outside the package. Inspect the effective profile, home patch and launch overlays before changing them. Stop on a conflicting `fotor` service or duplicate skill provider; preserve the existing configuration.
 
 Fill every path with its actual absolute location. Only the installed Fotor skill directory belongs in `customSkillDirs`; retain `includeDefaultRoots: false`. Use the independent Fotor provider name. Configure the external Node executable, bridge proxy, working directory and Fotor-only `MCP_REMOTE_CONFIG_DIR`. Keep the bridge store separate from model-provider credentials and other clients. Preserve it across package updates. Overrides replace the entire `config` object, including security and reconnect settings; they do not deep-merge individual fields.
@@ -26,7 +28,7 @@ Use DeepSeek Harness's native `read` tool for the known package references. Its
 
 ## First authorization
 
-Verify this installed package owns mcp-remote 0.15.1, and resolve its actual client/proxy paths using the installation guide: native dependency queries for Git, or the declared bundled directory for npm. Never download or upgrade it during connection with an unpinned `npx` command. Keep the stdio proxy stopped while the standalone authorization client runs.
+Verify this installed package owns mcp-remote 0.15.2, and resolve its actual client/proxy paths using the installation guide: native dependency queries for Git, or the declared bundled directory for npm. Never download or upgrade it during connection with an unpinned `npx` command. Keep the stdio proxy stopped while the standalone authorization client runs.
 
 Confirm the actual opener in this launch environment uses the user's daily ordinary browser. A task-specific desktop routing override may be needed; do not change the system default, create an incognito or headless session, or clear browser data. The model-provider login is independent of Fotor OAuth.
 

package/skills/fotor-video/references/authentication.md

@@ -8,7 +8,7 @@ DeepSeek Harness is abbreviated as `dsh` in commands and native identifiers.
 
 ## Ownership and baseline
 
-This Bundle targets Linux DeepSeek Harness Web `0.2.1-rc.2`, with package-manager-owned `mcp-remote 0.15.1` and stable Node `>=24.2.0 <25.0.0 || 26.x`. DeepSeek Harness owns the stdio client and tool permissions; the bridge owns OAuth and its credential store. Do not describe this as native remote OAuth in DeepSeek Harness. Desktop, headless and ACP have separate acceptance scopes.
+This Bundle targets Linux DeepSeek Harness Web `0.2.1-rc.2`, with package-manager-owned `mcp-remote 0.15.2` and stable Node `>=24.2.0 <25.0.0 || 26.x`. DeepSeek Harness owns the stdio client and tool permissions; the bridge owns OAuth and its credential store. Do not describe this as native remote OAuth in DeepSeek Harness. Desktop, headless and ACP have separate acceptance scopes.
 
 Use this guide with the [shared runtime workflow](mcp-integration.md#runtime-workflow). Installation, authorization, actual calls, website access, restart reuse and reauthorization recovery are distinct outcomes. Do not infer full support from one successful call.
 
@@ -16,6 +16,8 @@ Use this guide with the [shared runtime workflow](mcp-integration.md#runtime-wor
 
 Installation declares two disabled components. The package manager automatically obtains the pinned bridge dependency. Installation does not register a working connection, scan unconfigured skill roots or start OAuth. For first installation, a missing bridge, unconfigured paths or missing skills, open the installed package's README and follow its `INSTALL.md` guide before continuing. That guide covers GitHub/npm installation, native dependency-path queries and complete configuration; no internal development document is required. The user or an Agent acting on their installation request completes those steps before connection.
 
+For an update or source change, read the same guide's maintenance section before changing the installation. npm updates use an explicit published target version; preserve the original profile/store and verify actual installed files before declaring success. Immediate tag updates have a recorded limitation. Updating paths is distinct from authorizing Fotor or opening its website; preserve the existing external credential directory.
+
 Copy `configuration.example.yml` outside the package. Inspect the effective profile, home patch and launch overlays before changing them. Stop on a conflicting `fotor` service or duplicate skill provider; preserve the existing configuration.
 
 Fill every path with its actual absolute location. Only the installed Fotor skill directory belongs in `customSkillDirs`; retain `includeDefaultRoots: false`. Use the independent Fotor provider name. Configure the external Node executable, bridge proxy, working directory and Fotor-only `MCP_REMOTE_CONFIG_DIR`. Keep the bridge store separate from model-provider credentials and other clients. Preserve it across package updates. Overrides replace the entire `config` object, including security and reconnect settings; they do not deep-merge individual fields.
@@ -26,7 +28,7 @@ Use DeepSeek Harness's native `read` tool for the known package references. Its
 
 ## First authorization
 
-Verify this installed package owns mcp-remote 0.15.1, and resolve its actual client/proxy paths using the installation guide: native dependency queries for Git, or the declared bundled directory for npm. Never download or upgrade it during connection with an unpinned `npx` command. Keep the stdio proxy stopped while the standalone authorization client runs.
+Verify this installed package owns mcp-remote 0.15.2, and resolve its actual client/proxy paths using the installation guide: native dependency queries for Git, or the declared bundled directory for npm. Never download or upgrade it during connection with an unpinned `npx` command. Keep the stdio proxy stopped while the standalone authorization client runs.
 
 Confirm the actual opener in this launch environment uses the user's daily ordinary browser. A task-specific desktop routing override may be needed; do not change the system default, create an incognito or headless session, or clear browser data. The model-provider login is independent of Fotor OAuth.