@fotor-ai/dsh-fotor-plugin 0.6.0-test.3 → 0.6.0

package/INSTALL.md

@@ -2,7 +2,7 @@
 
 > Requires stable Node 24.2.0 or later within 24.x, or stable Node 26.x. The fixed DeepSeek Harness 0.2.1-rc.2 launcher needs `import.meta.main`, introduced in Node 24.2.0. Earlier Node 24 releases are outside the supported range. Use the release's recorded runtime results for the exact tested versions.
 
-DeepSeek Harness is abbreviated as `dsh` in commands and native identifiers. This guide is self-contained for the independent 0.6.0 package. Test distributions are available; stable availability is separate. Check the selected GitHub revision or npm version before installing. Existing 0.5.1 installations retain their original guide until migrated to the scoped identity.
+DeepSeek Harness is abbreviated as `dsh` in commands and native identifiers. This guide is self-contained for the independent 0.6.0 package. Test distributions are available; stable availability is separate. This internal refresh pins mcp-remote 0.15.2; published test.3 retains 0.15.1 until a refreshed channel is released. Check the selected GitHub revision or npm version before installing. Existing 0.5.1 installations retain their original guide until migrated to the scoped identity.
 
 During the 0.6.0 test rollout, GitHub's default branch still supplies 0.5.1 and npm `latest` retains the accepted first-publication exception, `0.6.0-test.1`. Bare-name npm installation therefore selects a prerelease until the formal rollout replaces it. Use the GitHub test branch or a verified npm test version during that interval; use production examples only after the selected channel contains the intended stable release.
 
@@ -24,7 +24,7 @@ Select one profile, working directory and Fotor-only credential directory outsid
 
 ## 2. Install one Bundle source
 
-The package name is **`@fotor-ai/dsh-fotor-plugin`** for both sources. Installing it automatically obtains the pinned **mcp-remote 0.15.1** runtime. There is no separate bridge installation command. Git installation downloads the dependency through the host package manager; npm artifacts already carry the bridge and its complete runtime dependency tree. Installation starts neither the bridge nor OAuth.
+The package name is **`@fotor-ai/dsh-fotor-plugin`** for both sources. Installing it automatically obtains the pinned **mcp-remote 0.15.2** runtime. There is no separate bridge installation command. Git installation downloads the dependency through the host package manager; npm artifacts already carry the bridge and its complete runtime dependency tree. Installation starts neither the bridge nor OAuth.
 
 Choose exactly one command after its channel is published:
 
@@ -58,7 +58,7 @@ dsh plugin --profile "$FOTOR_PROFILE" why mcp-remote --json
 
 Choose the resolution route matching the installed manifest:
 
-- **Git source:** the dependency query can return multiple paths. Select the mcp-remote 0.15.1 dependency owned by this exact Fotor installation; stop on ambiguity. pnpm can place it beside the package rather than inside it. Set `FOTOR_BRIDGE` to that verified absolute dependency path.
+- **Git source:** the dependency query can return multiple paths. Select the mcp-remote 0.15.2 dependency owned by this exact Fotor installation; stop on ambiguity. pnpm can place it beside the package rather than inside it. Set `FOTOR_BRIDGE` to that verified absolute dependency path.
 - **npm artifact:** after verifying `bundleDependencies` names mcp-remote, resolve the bundled directory below. The native dependency list may omit bundled packages; an empty list alone is not a missing bridge.
 
 ```bash
@@ -78,7 +78,7 @@ test -f "$FOTOR_BRIDGE/dist/proxy.js"
 
 Git pins the direct bridge version; its transitive graph is resolved by the host and should be recorded when reproducing a result. The packaged lock file is the npm release-build input, not a promise that pnpm honors it during Git installation.
 
-**Done when:** the scoped package/version, bridge 0.15.1, both bridge entrypoints and all selected absolute paths are verified. A `why` result alone does not establish file completeness or the Git commit.
+**Done when:** the scoped package/version, bridge 0.15.2, both bridge entrypoints and all selected absolute paths are verified. A `why` result alone does not establish file completeness or the Git commit.
 
 ## 4. Prepare complete configuration
 

package/README.md

@@ -5,8 +5,8 @@
 <p align="center"><img src="assets/logo.svg" width="72" alt="Fotor logo" /></p>
 
 <p align="center">
-  <img src="https://img.shields.io/static/v1?label=version&amp;message=0.6.0-test.3&amp;color=087f8c&amp;style=flat-square" alt="Version" />
-  <img src="https://img.shields.io/static/v1?label=channel&amp;message=test&amp;color=a56800&amp;style=flat-square" alt="Release channel" />
+  <img src="https://img.shields.io/static/v1?label=version&amp;message=0.6.0&amp;color=087f8c&amp;style=flat-square" alt="Version" />
+  <img src="https://img.shields.io/static/v1?label=channel&amp;message=production&amp;color=238636&amp;style=flat-square" alt="Release channel" />
   <a href="LICENSE"><img src="https://img.shields.io/static/v1?label=license&amp;message=Apache-2.0&amp;color=57606a&amp;style=flat-square" alt="Apache-2.0 license" /></a>
 </p>
 <p align="center">
@@ -18,13 +18,13 @@ Use Fotor's shared skills with DeepSeek Harness Web and an automatically install
 | Field | Value |
 | --- | --- |
 | Bundle | `@fotor-ai/dsh-fotor-plugin` |
-| Version | `0.6.0-test.3` |
-| Release channel | `test` |
+| Version | `0.6.0` |
+| Release channel | `production` |
 | Service environment | `production` |
 | MCP endpoint | `https://mcp.fotor.com/mcp` |
 | Declared host range | `>=0.2.1-rc.2 <0.3.0-0` |
 | Host baseline | Linux DeepSeek Harness Web 0.2.1-rc.2 |
-| Bridge | mcp-remote 0.15.1 |
+| Bridge | mcp-remote 0.15.2 |
 | Node range | `>=24.2.0 <25.0.0 \|\| 26.x`, stable versions |
 | License | Apache-2.0 |
 
@@ -44,19 +44,19 @@ DeepSeek Harness is abbreviated as `dsh` in commands and native identifiers.
 
 ### DeepSeek Harness installation
 
-#### Test release
+#### Production release
 
 First verify that the selected revision contains the DeepSeek Harness Bundle. Install this scoped package and its pinned bridge dependency to the chosen profile. Both components stay disabled until local setup.
 
 ```bash
-dsh plugin --profile web add "git+https://github.com/fotor-ai/dsh-fotor-plugin.git#release/test" --ignore-scripts
+dsh plugin --profile web add "git+https://github.com/fotor-ai/dsh-fotor-plugin.git" --ignore-scripts
 ```
 
 This is the standalone root Bundle for [https://github.com/fotor-ai/dsh-fotor-plugin](https://github.com/fotor-ai/dsh-fotor-plugin). Use its root Git source only after the selected channel contains this version. The [multi-platform repository](https://github.com/fotor-ai/fotor-agent-plugins) documents this external source; it no longer distributes new DeepSeek Harness packages. Existing subdirectory installations require a one-way native source migration.
 
 The Bundle identity is `@fotor-ai/dsh-fotor-plugin`. After the corresponding npm channel is published, its alternative is `dsh plugin --profile web add "@fotor-ai/dsh-fotor-plugin" --ignore-scripts` (production) or `dsh plugin --profile web add "@fotor-ai/dsh-fotor-plugin@next" --ignore-scripts` (test). Verify the resolved version and select one source only. Bare-name npm installation follows `latest`; until the formal 0.6.0 rollout, that tag retains the accepted test.1 bootstrap exception and does not mean stable 0.6.0.
 
-Installation automatically obtains **mcp-remote 0.15.1**. Git sources download it through the host package manager; npm artifacts carry its complete locked runtime tree. Fotor skills remain script-free. No installation hook starts the bridge or OAuth, and Node is not bundled.
+Installation automatically obtains **mcp-remote 0.15.2**. Git sources download it through the host package manager; npm artifacts carry its complete locked runtime tree. Fotor skills remain script-free. No installation hook starts the bridge or OAuth, and Node is not bundled.
 
 Follow the [complete installation guide](INSTALL.md):
 

package/node_modules/mcp-remote/dist/{chunk-KJCT2FXL.js → chunk-UZ6Y4QJH.js}

@@ -31556,7 +31556,7 @@ var StreamableHTTPClientTransport = class {
 };
 
 // package.json
-var version2 = "0.15.1";
+var version2 = "0.15.2";
 
 // src/lib/protocol-era.ts
 var FIRST_MODERN_PROTOCOL_VERSION2 = "2026-07-28";
@@ -35433,6 +35433,7 @@ ${authorizationUrl.toString()}
         await deleteConfigFile(this.serverUrlHash, "client_info.json");
         this._clientInfo = void 0;
         this.clientRegistrationSource = void 0;
+        this.pendingFlow = null;
         debugLog("Client information invalidated");
         break;
       case "tokens":

package/node_modules/mcp-remote/dist/client.js

@@ -14,7 +14,7 @@ import {
   serverIssuesAuthChallenge,
   setupSignalHandlers,
   version
-} from "./chunk-KJCT2FXL.js";
+} from "./chunk-UZ6Y4QJH.js";
 import "./chunk-MLKGABMK.js";
 
 // src/client.ts

package/node_modules/mcp-remote/dist/proxy.js

@@ -221,7 +221,7 @@ import {
   union,
   unknown,
   url
-} from "./chunk-KJCT2FXL.js";
+} from "./chunk-UZ6Y4QJH.js";
 import "./chunk-MLKGABMK.js";
 
 // src/proxy.ts

package/node_modules/mcp-remote/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-remote",
-  "version": "0.15.1",
+  "version": "0.15.2",
   "description": "Remote proxy for Model Context Protocol, allowing local-only clients to connect to remote servers using oAuth",
   "keywords": [
     "mcp",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fotor-ai/dsh-fotor-plugin",
-  "version": "0.6.0-test.3",
+  "version": "0.6.0",
   "description": "Connect to Fotor's production MCP service.",
   "author": {
     "name": "Fotor"
@@ -28,7 +28,7 @@
     }
   },
   "dependencies": {
-    "mcp-remote": "0.15.1"
+    "mcp-remote": "0.15.2"
   },
   "bundleDependencies": [
     "mcp-remote"

package/skills/fotor-connect/references/authentication.md

@@ -8,7 +8,7 @@ DeepSeek Harness is abbreviated as `dsh` in commands and native identifiers.
 
 ## Ownership and baseline
 
-This Bundle targets Linux DeepSeek Harness Web `0.2.1-rc.2`, with package-manager-owned `mcp-remote 0.15.1` and stable Node `>=24.2.0 <25.0.0 || 26.x`. DeepSeek Harness owns the stdio client and tool permissions; the bridge owns OAuth and its credential store. Do not describe this as native remote OAuth in DeepSeek Harness. Desktop, headless and ACP have separate acceptance scopes.
+This Bundle targets Linux DeepSeek Harness Web `0.2.1-rc.2`, with package-manager-owned `mcp-remote 0.15.2` and stable Node `>=24.2.0 <25.0.0 || 26.x`. DeepSeek Harness owns the stdio client and tool permissions; the bridge owns OAuth and its credential store. Do not describe this as native remote OAuth in DeepSeek Harness. Desktop, headless and ACP have separate acceptance scopes.
 
 Use this guide with the [shared runtime workflow](mcp-integration.md#runtime-workflow). Installation, authorization, actual calls, website access, restart reuse and reauthorization recovery are distinct outcomes. Do not infer full support from one successful call.
 
@@ -28,7 +28,7 @@ Use DeepSeek Harness's native `read` tool for the known package references. Its
 
 ## First authorization
 
-Verify this installed package owns mcp-remote 0.15.1, and resolve its actual client/proxy paths using the installation guide: native dependency queries for Git, or the declared bundled directory for npm. Never download or upgrade it during connection with an unpinned `npx` command. Keep the stdio proxy stopped while the standalone authorization client runs.
+Verify this installed package owns mcp-remote 0.15.2, and resolve its actual client/proxy paths using the installation guide: native dependency queries for Git, or the declared bundled directory for npm. Never download or upgrade it during connection with an unpinned `npx` command. Keep the stdio proxy stopped while the standalone authorization client runs.
 
 Confirm the actual opener in this launch environment uses the user's daily ordinary browser. A task-specific desktop routing override may be needed; do not change the system default, create an incognito or headless session, or clear browser data. The model-provider login is independent of Fotor OAuth.
 

package/skills/fotor-connect/references/mcp-integration.md

@@ -2,7 +2,7 @@
 
 ## Connection
 
-This **test release channel** package connects to the **production service** at `https://mcp.fotor.com/mcp` using Streamable HTTP. Both release channels use the production account, website, and credits. Preserve this service throughout a task and its assets.
+This **production release channel** package connects to the **production service** at `https://mcp.fotor.com/mcp` using Streamable HTTP. Both release channels use the production account, website, and credits. Preserve this service throughout a task and its assets.
 
 | Environment | MCP endpoint | Website target | Login handoff endpoint |
 | --- | --- | --- | --- |

package/skills/fotor-credits/references/authentication.md

@@ -8,7 +8,7 @@ DeepSeek Harness is abbreviated as `dsh` in commands and native identifiers.
 
 ## Ownership and baseline
 
-This Bundle targets Linux DeepSeek Harness Web `0.2.1-rc.2`, with package-manager-owned `mcp-remote 0.15.1` and stable Node `>=24.2.0 <25.0.0 || 26.x`. DeepSeek Harness owns the stdio client and tool permissions; the bridge owns OAuth and its credential store. Do not describe this as native remote OAuth in DeepSeek Harness. Desktop, headless and ACP have separate acceptance scopes.
+This Bundle targets Linux DeepSeek Harness Web `0.2.1-rc.2`, with package-manager-owned `mcp-remote 0.15.2` and stable Node `>=24.2.0 <25.0.0 || 26.x`. DeepSeek Harness owns the stdio client and tool permissions; the bridge owns OAuth and its credential store. Do not describe this as native remote OAuth in DeepSeek Harness. Desktop, headless and ACP have separate acceptance scopes.
 
 Use this guide with the [shared runtime workflow](mcp-integration.md#runtime-workflow). Installation, authorization, actual calls, website access, restart reuse and reauthorization recovery are distinct outcomes. Do not infer full support from one successful call.
 
@@ -28,7 +28,7 @@ Use DeepSeek Harness's native `read` tool for the known package references. Its
 
 ## First authorization
 
-Verify this installed package owns mcp-remote 0.15.1, and resolve its actual client/proxy paths using the installation guide: native dependency queries for Git, or the declared bundled directory for npm. Never download or upgrade it during connection with an unpinned `npx` command. Keep the stdio proxy stopped while the standalone authorization client runs.
+Verify this installed package owns mcp-remote 0.15.2, and resolve its actual client/proxy paths using the installation guide: native dependency queries for Git, or the declared bundled directory for npm. Never download or upgrade it during connection with an unpinned `npx` command. Keep the stdio proxy stopped while the standalone authorization client runs.
 
 Confirm the actual opener in this launch environment uses the user's daily ordinary browser. A task-specific desktop routing override may be needed; do not change the system default, create an incognito or headless session, or clear browser data. The model-provider login is independent of Fotor OAuth.
 

package/skills/fotor-credits/references/mcp-integration.md

@@ -2,7 +2,7 @@
 
 ## Connection
 
-This **test release channel** package connects to the **production service** at `https://mcp.fotor.com/mcp` using Streamable HTTP. Both release channels use the production account, website, and credits. Preserve this service throughout a task and its assets.
+This **production release channel** package connects to the **production service** at `https://mcp.fotor.com/mcp` using Streamable HTTP. Both release channels use the production account, website, and credits. Preserve this service throughout a task and its assets.
 
 | Environment | MCP endpoint | Website target | Login handoff endpoint |
 | --- | --- | --- | --- |

package/skills/fotor-image/references/authentication.md

@@ -8,7 +8,7 @@ DeepSeek Harness is abbreviated as `dsh` in commands and native identifiers.
 
 ## Ownership and baseline
 
-This Bundle targets Linux DeepSeek Harness Web `0.2.1-rc.2`, with package-manager-owned `mcp-remote 0.15.1` and stable Node `>=24.2.0 <25.0.0 || 26.x`. DeepSeek Harness owns the stdio client and tool permissions; the bridge owns OAuth and its credential store. Do not describe this as native remote OAuth in DeepSeek Harness. Desktop, headless and ACP have separate acceptance scopes.
+This Bundle targets Linux DeepSeek Harness Web `0.2.1-rc.2`, with package-manager-owned `mcp-remote 0.15.2` and stable Node `>=24.2.0 <25.0.0 || 26.x`. DeepSeek Harness owns the stdio client and tool permissions; the bridge owns OAuth and its credential store. Do not describe this as native remote OAuth in DeepSeek Harness. Desktop, headless and ACP have separate acceptance scopes.
 
 Use this guide with the [shared runtime workflow](mcp-integration.md#runtime-workflow). Installation, authorization, actual calls, website access, restart reuse and reauthorization recovery are distinct outcomes. Do not infer full support from one successful call.
 
@@ -28,7 +28,7 @@ Use DeepSeek Harness's native `read` tool for the known package references. Its
 
 ## First authorization
 
-Verify this installed package owns mcp-remote 0.15.1, and resolve its actual client/proxy paths using the installation guide: native dependency queries for Git, or the declared bundled directory for npm. Never download or upgrade it during connection with an unpinned `npx` command. Keep the stdio proxy stopped while the standalone authorization client runs.
+Verify this installed package owns mcp-remote 0.15.2, and resolve its actual client/proxy paths using the installation guide: native dependency queries for Git, or the declared bundled directory for npm. Never download or upgrade it during connection with an unpinned `npx` command. Keep the stdio proxy stopped while the standalone authorization client runs.
 
 Confirm the actual opener in this launch environment uses the user's daily ordinary browser. A task-specific desktop routing override may be needed; do not change the system default, create an incognito or headless session, or clear browser data. The model-provider login is independent of Fotor OAuth.
 

package/skills/fotor-image/references/mcp-integration.md

@@ -2,7 +2,7 @@
 
 ## Connection
 
-This **test release channel** package connects to the **production service** at `https://mcp.fotor.com/mcp` using Streamable HTTP. Both release channels use the production account, website, and credits. Preserve this service throughout a task and its assets.
+This **production release channel** package connects to the **production service** at `https://mcp.fotor.com/mcp` using Streamable HTTP. Both release channels use the production account, website, and credits. Preserve this service throughout a task and its assets.
 
 | Environment | MCP endpoint | Website target | Login handoff endpoint |
 | --- | --- | --- | --- |

package/skills/fotor-upload/references/authentication.md

@@ -8,7 +8,7 @@ DeepSeek Harness is abbreviated as `dsh` in commands and native identifiers.
 
 ## Ownership and baseline
 
-This Bundle targets Linux DeepSeek Harness Web `0.2.1-rc.2`, with package-manager-owned `mcp-remote 0.15.1` and stable Node `>=24.2.0 <25.0.0 || 26.x`. DeepSeek Harness owns the stdio client and tool permissions; the bridge owns OAuth and its credential store. Do not describe this as native remote OAuth in DeepSeek Harness. Desktop, headless and ACP have separate acceptance scopes.
+This Bundle targets Linux DeepSeek Harness Web `0.2.1-rc.2`, with package-manager-owned `mcp-remote 0.15.2` and stable Node `>=24.2.0 <25.0.0 || 26.x`. DeepSeek Harness owns the stdio client and tool permissions; the bridge owns OAuth and its credential store. Do not describe this as native remote OAuth in DeepSeek Harness. Desktop, headless and ACP have separate acceptance scopes.
 
 Use this guide with the [shared runtime workflow](mcp-integration.md#runtime-workflow). Installation, authorization, actual calls, website access, restart reuse and reauthorization recovery are distinct outcomes. Do not infer full support from one successful call.
 
@@ -28,7 +28,7 @@ Use DeepSeek Harness's native `read` tool for the known package references. Its
 
 ## First authorization
 
-Verify this installed package owns mcp-remote 0.15.1, and resolve its actual client/proxy paths using the installation guide: native dependency queries for Git, or the declared bundled directory for npm. Never download or upgrade it during connection with an unpinned `npx` command. Keep the stdio proxy stopped while the standalone authorization client runs.
+Verify this installed package owns mcp-remote 0.15.2, and resolve its actual client/proxy paths using the installation guide: native dependency queries for Git, or the declared bundled directory for npm. Never download or upgrade it during connection with an unpinned `npx` command. Keep the stdio proxy stopped while the standalone authorization client runs.
 
 Confirm the actual opener in this launch environment uses the user's daily ordinary browser. A task-specific desktop routing override may be needed; do not change the system default, create an incognito or headless session, or clear browser data. The model-provider login is independent of Fotor OAuth.
 

package/skills/fotor-upload/references/mcp-integration.md

@@ -2,7 +2,7 @@
 
 ## Connection
 
-This **test release channel** package connects to the **production service** at `https://mcp.fotor.com/mcp` using Streamable HTTP. Both release channels use the production account, website, and credits. Preserve this service throughout a task and its assets.
+This **production release channel** package connects to the **production service** at `https://mcp.fotor.com/mcp` using Streamable HTTP. Both release channels use the production account, website, and credits. Preserve this service throughout a task and its assets.
 
 | Environment | MCP endpoint | Website target | Login handoff endpoint |
 | --- | --- | --- | --- |

package/skills/fotor-video/references/authentication.md

@@ -8,7 +8,7 @@ DeepSeek Harness is abbreviated as `dsh` in commands and native identifiers.
 
 ## Ownership and baseline
 
-This Bundle targets Linux DeepSeek Harness Web `0.2.1-rc.2`, with package-manager-owned `mcp-remote 0.15.1` and stable Node `>=24.2.0 <25.0.0 || 26.x`. DeepSeek Harness owns the stdio client and tool permissions; the bridge owns OAuth and its credential store. Do not describe this as native remote OAuth in DeepSeek Harness. Desktop, headless and ACP have separate acceptance scopes.
+This Bundle targets Linux DeepSeek Harness Web `0.2.1-rc.2`, with package-manager-owned `mcp-remote 0.15.2` and stable Node `>=24.2.0 <25.0.0 || 26.x`. DeepSeek Harness owns the stdio client and tool permissions; the bridge owns OAuth and its credential store. Do not describe this as native remote OAuth in DeepSeek Harness. Desktop, headless and ACP have separate acceptance scopes.
 
 Use this guide with the [shared runtime workflow](mcp-integration.md#runtime-workflow). Installation, authorization, actual calls, website access, restart reuse and reauthorization recovery are distinct outcomes. Do not infer full support from one successful call.
 
@@ -28,7 +28,7 @@ Use DeepSeek Harness's native `read` tool for the known package references. Its
 
 ## First authorization
 
-Verify this installed package owns mcp-remote 0.15.1, and resolve its actual client/proxy paths using the installation guide: native dependency queries for Git, or the declared bundled directory for npm. Never download or upgrade it during connection with an unpinned `npx` command. Keep the stdio proxy stopped while the standalone authorization client runs.
+Verify this installed package owns mcp-remote 0.15.2, and resolve its actual client/proxy paths using the installation guide: native dependency queries for Git, or the declared bundled directory for npm. Never download or upgrade it during connection with an unpinned `npx` command. Keep the stdio proxy stopped while the standalone authorization client runs.
 
 Confirm the actual opener in this launch environment uses the user's daily ordinary browser. A task-specific desktop routing override may be needed; do not change the system default, create an incognito or headless session, or clear browser data. The model-provider login is independent of Fotor OAuth.
 

package/skills/fotor-video/references/mcp-integration.md

@@ -2,7 +2,7 @@
 
 ## Connection
 
-This **test release channel** package connects to the **production service** at `https://mcp.fotor.com/mcp` using Streamable HTTP. Both release channels use the production account, website, and credits. Preserve this service throughout a task and its assets.
+This **production release channel** package connects to the **production service** at `https://mcp.fotor.com/mcp` using Streamable HTTP. Both release channels use the production account, website, and credits. Preserve this service throughout a task and its assets.
 
 | Environment | MCP endpoint | Website target | Login handoff endpoint |
 | --- | --- | --- | --- |