@fotor-ai/dsh-fotor-plugin 0.6.0 → 0.6.1-test.2

package/INSTALL.md

@@ -1,181 +1,100 @@
 # Install and use Fotor with DeepSeek Harness
 
-> Requires stable Node 24.2.0 or later within 24.x, or stable Node 26.x. The fixed DeepSeek Harness 0.2.1-rc.2 launcher needs `import.meta.main`, introduced in Node 24.2.0. Earlier Node 24 releases are outside the supported range. Use the release's recorded runtime results for the exact tested versions.
+DeepSeek Harness is abbreviated as `dsh` in commands and native identifiers. This guide describes automatic configuration in Fotor 0.6.1. Version 0.6.0 uses its documented manual configuration. Read the package README's version and channel, and choose a source that actually contains the target version. A candidate snapshot does not publish the npm package or change either default branch.
 
-DeepSeek Harness is abbreviated as `dsh` in commands and native identifiers. This guide is self-contained for the independent 0.6.0 package. Test distributions are available; stable availability is separate. This internal refresh pins mcp-remote 0.15.2; published test.3 retains 0.15.1 until a refreshed channel is released. Check the selected GitHub revision or npm version before installing. Existing 0.5.1 installations retain their original guide until migrated to the scoped identity.
+## 1. Check prerequisites
 
-During the 0.6.0 test rollout, GitHub's default branch still supplies 0.5.1 and npm `latest` retains the accepted first-publication exception, `0.6.0-test.1`. Bare-name npm installation therefore selects a prerelease until the formal rollout replaces it. Use the GitHub test branch or a verified npm test version during that interval; use production examples only after the selected channel contains the intended stable release.
+The current acceptance baseline is Linux DeepSeek Harness Web `0.2.1-rc.3` and stable Node `>=24.2.0 <25.0.0 || 26.x`. Earlier rc.2 results retain their original scope; the declared host range remains `>=0.2.1-rc.2 <0.3.0-0`. Node is not bundled. Check `dsh --version` and `node --version`; do not upgrade a daily installation implicitly. See the official [DeepSeek Harness repository](https://github.com/deepseek-ai/deepseek-harness) and [Node downloads](https://nodejs.org/en/download). Desktop, headless and ACP require separate acceptance.
 
-## 1. Check prerequisites and select a profile
+## 2. Choose one source
 
-Use Linux DeepSeek Harness Web `0.2.1-rc.2` (source `687f282e8625c6b8d11ff58211a90524be2e4317`), its available native package manager, and a stable Node **24.2.0 or later within 24.x, or 26.x**. Node 24.0.x, 24.1.x, 25.x, 27.x and prereleases are outside the declared range. The host range remains `>=0.2.1-rc.2 <0.3.0-0`; admission is not evidence that every host/runtime combination has been tested. Consult the installed release's acceptance record. Desktop, headless and ACP require separate acceptance.
+GitHub downloads the pinned **mcp-remote 0.15.2** dependency through the host package manager. npm artifacts carry its complete reviewed runtime tree. Neither path needs a separate bridge installation. Skills remain script-free; the package has no installation lifecycle hook.
 
-```bash
-dsh --version
-node --version
-dsh plugin --profile web root
-```
-
-Git sources additionally require Git. Follow the [host quickstart](https://deepseek-harness.github.io/deepseek-harness/en/guide/quickstart) or [Node downloads](https://nodejs.org/en/download/) for missing prerequisites. Node is not bundled. Preserve daily installations; do not upgrade them to satisfy an acceptance run.
-
-Select one profile, working directory and Fotor-only credential directory outside the installed package. Inspect existing Fotor components before changing anything. A model-provider account is separate from Fotor OAuth. If installation uses a custom `--store-dir /absolute/path/to/store`, record it and pass that same argument on later add, update and remove commands. Retain the original profile and source as well.
-
-**Done when:** the host and Node versions are known, the native package manager works, and the profile and external storage locations are selected.
-
-## 2. Install one Bundle source
-
-The package name is **`@fotor-ai/dsh-fotor-plugin`** for both sources. Installing it automatically obtains the pinned **mcp-remote 0.15.2** runtime. There is no separate bridge installation command. Git installation downloads the dependency through the host package manager; npm artifacts already carry the bridge and its complete runtime dependency tree. Installation starts neither the bridge nor OAuth.
-
-Choose exactly one command after its channel is published:
+Choose one source and a profile. Test channels must actually contain the requested version before use:
 
 ```bash
-# GitHub production: default branch.
-dsh plugin --profile web add "git+https://github.com/fotor-ai/dsh-fotor-plugin.git" --ignore-scripts
-# GitHub test channel.
-dsh plugin --profile web add "git+https://github.com/fotor-ai/dsh-fotor-plugin.git#release/test" --ignore-scripts
-# npm production: only after latest is the intended stable release.
-dsh plugin --profile web add "@fotor-ai/dsh-fotor-plugin" --ignore-scripts
-# npm test channel.
-dsh plugin --profile web add "@fotor-ai/dsh-fotor-plugin@next" --ignore-scripts
+FOTOR_PROFILE=web
+# GitHub default branch, after the target version is published:
+dsh plugin --profile "$FOTOR_PROFILE" add "git+https://github.com/fotor-ai/dsh-fotor-plugin.git" --ignore-scripts
+# GitHub test branch:
+dsh plugin --profile "$FOTOR_PROFILE" add "git+https://github.com/fotor-ai/dsh-fotor-plugin.git#release/test" --ignore-scripts
+# npm default or test channel:
+dsh plugin --profile "$FOTOR_PROFILE" add "@fotor-ai/dsh-fotor-plugin" --ignore-scripts
+dsh plugin --profile "$FOTOR_PROFILE" add "@fotor-ai/dsh-fotor-plugin@next" --ignore-scripts
+# A complete local package for development:
+dsh plugin --profile "$FOTOR_PROFILE" add /absolute/path/to/fotor-package --ignore-scripts
 ```
 
-For an internal or local rehearsal, replace the source with the absolute path to the complete independent package. The multi-platform repository root is Pi's facade and is not a DeepSeek Harness package. Never install both sources, aliases, or the legacy `fotor` alongside the scoped package.
-
-**Done when:** native installation succeeds and reports the scoped identity and expected version. Preserve a failed dependency download as a failed installation; do not continue with a missing bridge or use an unpinned `npx` workaround.
+Run only the command for the chosen source. The Web **Plugins → Add plugin** entry accepts the same npm or GitHub source. After installation, click the host's **Enable now** button (or the Bundle switch). This selects the Bundle; its two components then activate automatically. The package cannot enable a Bundle the host has not loaded. Package name is `@fotor-ai/dsh-fotor-plugin` for both. Keep the original custom `--store-dir` argument for every later update/removal.
 
-## 3. Resolve the installed package and bridge
-
-Use the original profile and package-manager store. Set variables from native output and verified absolute paths:
+## 3. Verify installation
 
 ```bash
-FOTOR_PROFILE=web
-dsh plugin --profile "$FOTOR_PROFILE" why @fotor-ai/dsh-fotor-plugin
 dsh plugin --profile "$FOTOR_PROFILE" root
-FOTOR_INSTALLED="$(realpath "$(dsh plugin --profile "$FOTOR_PROFILE" root)/@fotor-ai/dsh-fotor-plugin")"
-dsh plugin --profile "$FOTOR_PROFILE" list mcp-remote --depth Infinity --parseable
-dsh plugin --profile "$FOTOR_PROFILE" why mcp-remote --json
+dsh plugin --profile "$FOTOR_PROFILE" list --depth Infinity --json
+dsh plugin --profile "$FOTOR_PROFILE" why @fotor-ai/dsh-fotor-plugin
 ```
 
-Choose the resolution route matching the installed manifest:
+Use the returned package root and actual dependency resolution for diagnosis, not a guessed pnpm store directory. Bundled npm dependencies can be absent from the ordinary dependency list; the installed package carries `node_modules/mcp-remote/package.json` and its `dist/client.js` and `dist/proxy.js`. Git installations use package-manager-owned links. Verify the bridge is 0.15.2.
 
-- **Git source:** the dependency query can return multiple paths. Select the mcp-remote 0.15.2 dependency owned by this exact Fotor installation; stop on ambiguity. pnpm can place it beside the package rather than inside it. Set `FOTOR_BRIDGE` to that verified absolute dependency path.
-- **npm artifact:** after verifying `bundleDependencies` names mcp-remote, resolve the bundled directory below. The native dependency list may omit bundled packages; an empty list alone is not a missing bridge.
+Installation success is the expected version/source and complete files. It does not prove MCP connection. Never read the bridge's token files to diagnose installation.
 
-```bash
-# npm artifact only, after inspecting its manifest.
-FOTOR_BRIDGE="$(realpath "$FOTOR_INSTALLED/node_modules/mcp-remote")"
-```
+## 4. Load the Bundle and resolve configuration
 
-For either source, verify the selected location before configuring it:
+New installations require **no manual path configuration**. Start the chosen profile or allow the running Web host to load the Bundle:
 
 ```bash
-FOTOR_NODE=/absolute/path/to/node
-cat "$FOTOR_INSTALLED/package.json"
-cat "$FOTOR_BRIDGE/package.json"
-test -f "$FOTOR_BRIDGE/dist/client.js"
-test -f "$FOTOR_BRIDGE/dist/proxy.js"
+dsh --profile "$FOTOR_PROFILE"
 ```
 
-Git pins the direct bridge version; its transitive graph is resolved by the host and should be recorded when reproducing a result. The packaged lock file is the npm release-build input, not a promise that pnpm honors it during Git installation.
-
-**Done when:** the scoped package/version, bridge 0.15.2, both bridge entrypoints and all selected absolute paths are verified. A `why` result alone does not establish file completeness or the Git commit.
+The package declares both adapters enabled. A saved explicit disabled override still wins. Skills are resolved relative to the installed Fotor package; Node comes from the running Web host; the bridge is resolved from the package's dependencies. Only this package's skill root is scanned.
 
-## 4. Prepare complete configuration
+The adapter creates complete native `command`, `args`, `env` and `cwd` values in memory. Credentials default to `<active-profile-directory>/fotor/mcp-auth`, outside the installation. The default callback is loopback port 3335. A conflicting listener produces a diagnosis; stop the conflicting task or configure an unused port without changing an existing authorization's parameters casually.
 
-Copy [configuration.example.yml](configuration.example.yml) outside the installation and fill every placeholder:
+Optional MCP settings include `endpoint` (production Fotor by default; a loopback service is for isolated acceptance), `callbackPort`, and existing native stdio fields. A supplied `args` array is complete, not an append. Explicit `env.MCP_REMOTE_CONFIG_DIR` is preserved. The [full legacy configuration example](configuration.example.yml) remains available for advanced overrides; it is never auto-applied. Overrides replace the complete `config` object, not a deep merge.
 
-| Parameter | Source and lifetime |
-| --- | --- |
-| Profile | The native profile selected for installation; keep it for updates/removal |
-| Skill directory | Actual `FOTOR_INSTALLED` plus `/skills`; re-resolve after updates |
-| Node command | Absolute executable for the selected supported Node version |
-| Proxy/client entry | Actual `FOTOR_BRIDGE` plus `/dist/proxy.js` or `/dist/client.js`; re-resolve after updates |
-| Home and agents home | Actual host locations; dedicated directories during acceptance |
-| Working directory | Selected existing absolute workspace |
-| `MCP_REMOTE_CONFIG_DIR` | Fotor-only external directory, separate from model credentials; retain across updates and source changes |
-| Callback | One available port; example `3335`, host copied unchanged from `configuration.example.yml`; identical for client and proxy |
-| Endpoint/resource | Both `https://mcp.fotor.com/mcp`; retain production and OAuth security parameters |
+## 5. Verify skills and existing overrides
 
-Overrides replace whole `config` objects, not individual nested fields. Retain both complete rows and all arguments. Keep native reconnect disabled. Do not copy credentials into the package, command arguments or documentation.
+For ordinary use, verify the native skill menu/provider discovers the actual Fotor skills and their own `references` directories. A green component indicator without discovered entries is insufficient. Read known references through native `read`; the Shell sandbox may hide an otherwise readable host path.
 
-**Done when:** the full override is external, all paths are real and no conflicting `fotor` service or duplicate provider exists.
+Old complete configuration is accepted. If an old skill or bridge path no longer exists, preserve the record and remove only the obsolete override using native profile configuration to adopt automatic resolution, or supply the corrected path. Do not edit package caches, reset unrelated settings or clear credentials. Resolve duplicate Fotor providers/services before enabling another copy.
 
-## 5. Apply complete configuration and load skills
+<a id="6-authorize-then-enable-the-connection"></a>
 
-Use the selected profile's native patch mechanism or an explicit external patch:
+## 6. Authorize and verify the connection
 
-```bash
-dsh --profile "$FOTOR_PROFILE" --patch /absolute/path/to/fotor.local.yml
-```
+In 0.6.1 this sequence is managed automatically after host activation. The independent bridge client reuses authorization or opens the daily browser. Complete login/consent there. It must connect and discover tools, then exit with its callback listener closed before the proxy starts. Model account login remains a separate user action.
 
-The installed Bundle declares both components disabled. The example enables only skills; its MCP row stays disabled. Keep `includeDefaultRoots: false` and scan only the actual installed Fotor skill directory.
+Connection diagnostics are `preparing`, `waiting-authorization`, `connected`, `failed` or `stopped`. The adapter being active is not a connected MCP. Authorization waits at most ten minutes and can be cancelled by disabling the MCP component. Failure does not loop through browser prompts; deliberately disable/enable to retry. Use the [authentication guide](skills/fotor-connect/references/authentication.md) for bounded recovery and browser handling.
 
-In the native menu, select `/fotor-connect`; ask it to read its instructions without authorizing or calling MCP. Confirm the resource path and one discovered copy of each actual Fotor skill. Each skill has four local reference documents.
+Once connected, ask for a read-only model query. Website access is a separate request; preserve browser login and open each original handoff once. Never infer website login from MCP success.
 
-Use the host's native `read` tool for those files. The Linux Shell sandbox can hide a `/tmp` installation while native reading still works; a failed Shell `ls` is not proof of a broken package. If native reading fails, stop and report the actual path/error rather than searching other installations.
+## 7. Use, update, or remove Fotor
 
-**Done when:** the native provider discovers the package's actual skills and their local references, and MCP is still disabled.
+Examples: “Use Fotor's existing connection to list image models”; “Connect to the Fotor website”; or explicitly choose `/fotor-connect`. Media requests follow their own skill and credit notice rules.
 
-## 6. Authorize then enable the connection
-
-Read [this package's authentication guide](skills/fotor-connect/references/authentication.md) before connecting. Confirm the opener targets the user's daily ordinary browser, preserve its login state, and keep the proxy stopped while the independent authorization client runs.
+For the recorded Git source:
 
 ```bash
-MCP_REMOTE_CONFIG_DIR=/absolute/path/to/dsh-home/mcp-auth/fotor "$FOTOR_NODE" "$FOTOR_BRIDGE/dist/client.js" https://mcp.fotor.com/mcp 3335 --host "$FOTOR_CALLBACK_HOST" --transport http-only --resource https://mcp.fotor.com/mcp --auth-timeout 600 --connect-timeout 20 --headers-timeout 20 --body-timeout 20
+dsh plugin --profile "$FOTOR_PROFILE" update @fotor-ai/dsh-fotor-plugin --ignore-scripts
 ```
 
-Set `FOTOR_CALLBACK_HOST` to the callback host verified in the configuration example. Run in an interactive terminal that keeps stdin open. After the user selects Continue, require successful connection and actual tool discovery. A callback page or exit code alone is insufficient. Stop the client and callback listener before enabling the MCP row and restarting the profile. Keep the same endpoint, resource, callback and credential directory. Cancel/timeout stops the flow; human waiting is limited to ten minutes.
-
-The bridge owns OAuth; this is not native remote OAuth in DeepSeek Harness. Model login, package installation, skills, Fotor authorization and website login are separate steps.
-
-**Done when:** authorization-client discovery completes, that client/listener exits, and the enabled native stdio connection discovers actual Fotor tools.
-
-## 7. Use, update or remove Fotor
-
-Example requests:
-
-- MCP-only: “Connect only to Fotor MCP and list image models. Do not open the website.”
-- Website: “Connect to Fotor and introduce its capabilities.” Prepare the daily browser before requesting the one-use handoff; report website success only after user confirmation.
-- Explicit skill: select `/fotor-image` and describe a task. Every successful `submit_*_task` may consume credits; preserve the existing authorization and retry rules.
-
-Stop Fotor components and record their source, profile, store and external configuration before updating. Choose one command for the recorded source. For npm, replace `<target-version>` with an explicitly published and approved version, such as the exact version in the selected release notes:
+For npm, select an explicitly published target:
 
 ```bash
-# Recorded Git source only.
-dsh plugin --profile "$FOTOR_PROFILE" update @fotor-ai/dsh-fotor-plugin --ignore-scripts
-# Recorded npm source: select an exact published target, not a moving tag.
 dsh plugin --profile "$FOTOR_PROFILE" update "@fotor-ai/dsh-fotor-plugin@<target-version>" --ignore-scripts
-dsh plugin --profile "$FOTOR_PROFILE" why @fotor-ai/dsh-fotor-plugin
 ```
 
-For a custom store, append the original `--store-dir` argument to the selected update command. An unqualified update can remain on the saved npm version. In the recorded test.1-to-test.2 acceptance, immediate `update ...@next` returned success but retained test.1 on both Node 24.2.0 and 26.0.0, even after an approved exception for that exact version's release age. Exact-version native updates passed. The guide therefore uses exact versions for npm updates; this does not establish that `@latest` updates work or that waiting 24 hours always resolves tag updates. Keep Git installations on their recorded Git source: applying an npm version selector is a source change, not a Git update.
-
-Keep the package manager's release-age policy. If it blocks a newly published version, report the target and wait, or obtain separate approval for an exception limited to that exact version and isolated profile. The earlier test.2 approval does not cover later versions. Do not disable the policy globally, clear metadata caches or reinstall to manufacture an update pass.
-
-**Done when:** the installed version and source match the selected target, files and managed bridge are complete, and a new process discovers one copy of each skill at the re-resolved paths. A zero exit code alone is insufficient. Update complete configuration rows if paths moved; preserve the external credential store, model settings and security parameters. Record a failed native update separately from any later reinstall.
+During historical 0.6.0-test.2 acceptance, immediate `@next` updates retained 0.6.0-test.1; exact-version updates passed. Neither `@latest` success nor success after 24 hours is established. Keep release-age protection; an acceptance-only exception needs separate approval for the exact target version. Do not treat reinstall or cache clearing as a successful upgrade. Verify installed version/files and restart the host so its module generation and paths are refreshed. Preserve the profile and custom store.
 
-### Migrate from the legacy package or switch sources
+Before upgrading 0.6.0, record the native source, profile, store, enabled state and explicit configuration without reading token files. With no overrides, 0.6.1 resolves paths when the host loads the Bundle. Existing complete configuration and explicit disabled settings remain authoritative: upgrading does not reopen a component the user disabled. Preserve valid custom paths and connection parameters; use native configuration only to correct or remove an obsolete path override. An npm version selector is not a Git-source update; source changes use the deliberate remove/add procedure below.
 
-Legacy 0.5.1 and older packages are named `fotor`. A normal update does not rename them. Record source/profile/store/path and the external configuration, stop both components, and remove only their override rows. Remove the old identity, then install one scoped source from step 2:
-
-```bash
-dsh plugin --profile "$FOTOR_PROFILE" remove fotor --config.ignore-scripts=true
-```
-
-For GitHub/npm switching or scoped-package removal, use:
+For removal:
 
 ```bash
 dsh plugin --profile "$FOTOR_PROFILE" remove @fotor-ai/dsh-fotor-plugin --config.ignore-scripts=true
 ```
 
-This host baseline rejects `--ignore-scripts` on removal; use the configuration form above and append the original `--store-dir` argument when a custom store was used. After adding the new source, resolve package and managed bridge paths again and restore a complete override. Keep one scoped installation and one component pair. Keep the credential directory, model settings and all connection/security parameters unchanged. Do not automatically delete the old external bridge directory or claim real credential reuse from an offline migration rehearsal.
-
-### Troubleshooting
-
-- Missing bridge: inspect native install/download results and this package's dependency tree; finish installation before connecting.
-- Changed installation path: re-query the native root/dependency paths and replace complete override rows.
-- pnpm store mismatch: use the original profile/store; do not edit caches or move package-manager links manually.
-- Duplicate skills/components: inspect selected sources and override rows before enabling either component.
-- Authorization failure: follow the authentication guide's single-client bounded recovery sequence. Installation or restart success does not prove recovery from rejected credentials.
+Stop the components first. Removal stops their processes but leaves credentials and explicit user configuration. Source switching uses deliberate removal/addition in the same profile/store; keep one source and one component pair. For the older unscoped `fotor` identity, remove that exact name before adding the scoped package. Keep old external bridge directories unless separately authorized to remove them.
 
-Uninstalling the Bundle does not revoke server-side consent. Delete only explicitly authorized temporary state after its processes stop; retain daily client configuration, credentials and browser login.
+Uninstall does not revoke server-side consent. Reinstalling in the same profile and credential directory can reuse accepted authorization; enabling still establishes a new connection. Verify that connection with an actual read-only query. A different `DSH_HOME`, profile, explicit `MCP_REMOTE_CONFIG_DIR` or connection parameters can select a different cache, and expired or rejected authorization can require new consent. Automatic configuration never migrates or copies tokens. Isolated acceptance cleanup may remove only that task's temporary state after all owned processes stop.

package/README.md

@@ -1,12 +1,12 @@
 # Fotor for DeepSeek Harness
 
-> Requires stable Node 24.2.0 or later within 24.x, or stable Node 26.x. The fixed DeepSeek Harness 0.2.1-rc.2 launcher needs `import.meta.main`, introduced in Node 24.2.0. Earlier Node 24 releases are outside the supported range. Use the release's recorded runtime results for the exact tested versions.
+> Requires stable Node 24.2.0 or later within 24.x, or stable Node 26.x. Current acceptance uses Linux DeepSeek Harness Web 0.2.1-rc.3. Earlier rc.2 results retain their original scope. Use the release's recorded results for the exact tested host, runtime and installation route.
 
 <p align="center"><img src="assets/logo.svg" width="72" alt="Fotor logo" /></p>
 
 <p align="center">
-  <img src="https://img.shields.io/static/v1?label=version&amp;message=0.6.0&amp;color=087f8c&amp;style=flat-square" alt="Version" />
-  <img src="https://img.shields.io/static/v1?label=channel&amp;message=production&amp;color=238636&amp;style=flat-square" alt="Release channel" />
+  <img src="https://img.shields.io/static/v1?label=version&amp;message=0.6.1-test.2&amp;color=087f8c&amp;style=flat-square" alt="Version" />
+  <img src="https://img.shields.io/static/v1?label=channel&amp;message=test&amp;color=a56800&amp;style=flat-square" alt="Release channel" />
   <a href="LICENSE"><img src="https://img.shields.io/static/v1?label=license&amp;message=Apache-2.0&amp;color=57606a&amp;style=flat-square" alt="Apache-2.0 license" /></a>
 </p>
 <p align="center">
@@ -18,12 +18,12 @@ Use Fotor's shared skills with DeepSeek Harness Web and an automatically install
 | Field | Value |
 | --- | --- |
 | Bundle | `@fotor-ai/dsh-fotor-plugin` |
-| Version | `0.6.0` |
-| Release channel | `production` |
+| Version | `0.6.1-test.2` |
+| Release channel | `test` |
 | Service environment | `production` |
 | MCP endpoint | `https://mcp.fotor.com/mcp` |
 | Declared host range | `>=0.2.1-rc.2 <0.3.0-0` |
-| Host baseline | Linux DeepSeek Harness Web 0.2.1-rc.2 |
+| Host baseline | Linux DeepSeek Harness Web 0.2.1-rc.3 |
 | Bridge | mcp-remote 0.15.2 |
 | Node range | `>=24.2.0 <25.0.0 \|\| 26.x`, stable versions |
 | License | Apache-2.0 |
@@ -32,7 +32,7 @@ Use Fotor's shared skills with DeepSeek Harness Web and an automatically install
 
 Package checks cover files, references, and configuration. Verify installation, MCP authorization and calls, website login, credit links, uploads, and media execution separately in the selected host and environment. A release or model query does not establish successful website login or completed media results.
 
-The Bundle only declares host-owned components and resources. The bridge is acquired by the package manager and owns OAuth. npm artifacts carry its full runtime dependency tree; Git installs download the dependency. Complete support requires real controlled reauthorization recovery as well as installation, calls, website access and restart reuse; consult the evidence for the installed release. Media execution and expiry-driven refresh are not established by static checks.
+The Bundle supplies two small native Host adapters that configure the host-owned components automatically. The bridge is acquired by the package manager and owns OAuth. npm artifacts carry its full runtime dependency tree; Git installs download the dependency. Complete support requires real controlled reauthorization recovery as well as installation, calls, website access and restart reuse; consult the evidence for the installed release. Media execution and expiry-driven refresh are not established by static checks.
 
 <a id="dsh"></a>
 
@@ -44,27 +44,27 @@ DeepSeek Harness is abbreviated as `dsh` in commands and native identifiers.
 
 ### DeepSeek Harness installation
 
-#### Production release
+#### Test release
 
-First verify that the selected revision contains the DeepSeek Harness Bundle. Install this scoped package and its pinned bridge dependency to the chosen profile. Both components stay disabled until local setup.
+First verify that the selected revision contains the DeepSeek Harness Bundle. Install this scoped package and its pinned bridge dependency to the chosen profile. Select Web **Enable now** or load the CLI profile; both components then configure automatically unless explicit user settings disable them.
 
 ```bash
-dsh plugin --profile web add "git+https://github.com/fotor-ai/dsh-fotor-plugin.git" --ignore-scripts
+dsh plugin --profile web add "git+https://github.com/fotor-ai/dsh-fotor-plugin.git#release/test" --ignore-scripts
 ```
 
 This is the standalone root Bundle for [https://github.com/fotor-ai/dsh-fotor-plugin](https://github.com/fotor-ai/dsh-fotor-plugin). Use its root Git source only after the selected channel contains this version. The [multi-platform repository](https://github.com/fotor-ai/fotor-agent-plugins) documents this external source; it no longer distributes new DeepSeek Harness packages. Existing subdirectory installations require a one-way native source migration.
 
-The Bundle identity is `@fotor-ai/dsh-fotor-plugin`. After the corresponding npm channel is published, its alternative is `dsh plugin --profile web add "@fotor-ai/dsh-fotor-plugin" --ignore-scripts` (production) or `dsh plugin --profile web add "@fotor-ai/dsh-fotor-plugin@next" --ignore-scripts` (test). Verify the resolved version and select one source only. Bare-name npm installation follows `latest`; until the formal 0.6.0 rollout, that tag retains the accepted test.1 bootstrap exception and does not mean stable 0.6.0.
+The Bundle identity is `@fotor-ai/dsh-fotor-plugin`. After the corresponding npm channel is published, its alternative is `dsh plugin --profile web add "@fotor-ai/dsh-fotor-plugin" --ignore-scripts` (production) or `dsh plugin --profile web add "@fotor-ai/dsh-fotor-plugin@next" --ignore-scripts` (test). Verify the resolved version and select one source only. Bare-name npm installation follows `latest`.
 
-Installation automatically obtains **mcp-remote 0.15.2**. Git sources download it through the host package manager; npm artifacts carry its complete locked runtime tree. Fotor skills remain script-free. No installation hook starts the bridge or OAuth, and Node is not bundled.
+Installation automatically obtains **mcp-remote 0.15.2**. Git sources download it through the host package manager; npm artifacts carry its complete locked runtime tree. Fotor skills remain script-free. No installation hook runs code; host activation starts connection and may open browser consent. Node is not bundled.
 
 Follow the [complete installation guide](INSTALL.md):
 
-1. Check Linux DeepSeek Harness Web `0.2.1-rc.2` and stable Node **24.2.0 or later within 24.x, or 26.x**.
+1. Check Linux DeepSeek Harness Web `0.2.1-rc.3` and stable Node **24.2.0 or later within 24.x, or 26.x**.
 2. Install one source with lifecycle scripts disabled.
-3. Query actual package and dependency paths; verify both bridge entrypoints.
-4. Apply full external configuration and enable only skills first.
-5. Configure the model account separately; complete bridge-client Fotor authorization and actual tool discovery, stop that client, then enable MCP. Website access is a separate request.
+3. In Web, click **Enable now** after installation; in CLI, start the selected profile. Both enabled-by-default adapters resolve their paths automatically.
+4. Complete browser consent when required; existing valid authorization is reused.
+5. Verify actual skill and tool discovery. Configure the model account separately; website access is a separate request.
 
 The declared host range is `>=0.2.1-rc.2 <0.3.0-0`; matching versions are not automatically verified. Desktop, headless and ACP require separate acceptance.
 
@@ -72,9 +72,9 @@ The declared host range is `>=0.2.1-rc.2 <0.3.0-0`; matching versions are not au
 
 ### DeepSeek Harness configuration and connection
 
-Installation adds two disabled components. Use native `root`, `list` and `why` queries as described in the guide; do not guess pnpm storage paths. A bundled npm dependency can be absent from the ordinary native list; follow the guide to verify the declared bundle under the actual installed package. Copy the [full configuration example](configuration.example.yml) outside the package and fill every absolute path. Overrides replace complete `config` objects. Keep default skill roots and native MCP reconnect disabled.
+The native adapters resolve skills, Node and the pinned bridge at activation. Existing explicit overrides and disabled states take precedence. The [full configuration example](configuration.example.yml) is optional and never auto-applied. Overrides replace complete `config` objects. Keep default skill roots and native MCP reconnect disabled.
 
-The native client directly runs the installed dependency using structured `command`, `args`, `env` and `cwd`. Keep `MCP_REMOTE_CONFIG_DIR` dedicated to Fotor and outside updates. Follow [authentication instructions](skills/fotor-connect/references/authentication.md), retaining independent-client discovery, user Continue / Wait / Cancel and client shutdown before the proxy starts. The bridge owns OAuth.
+Credentials remain outside the installation, in the configured `MCP_REMOTE_CONFIG_DIR` or the active profile's dedicated Fotor directory. Follow [authentication instructions](skills/fotor-connect/references/authentication.md). The adapter runs client discovery, closes that client and its callback, then starts the native MCP proxy. User consent remains required; disabling MCP cancels its connection task.
 
 Use the user's confirmed daily ordinary browser. MCP-only requests do not request website links; website requests prepare the browser, open the original handoff once through native permission controls, and wait for actual page confirmation. An existing login is not a first-login result.
 
@@ -95,7 +95,7 @@ For a recorded npm source, replace `<target-version>` with the approved, publish
 dsh plugin --profile web update "@fotor-ai/dsh-fotor-plugin@<target-version>" --ignore-scripts
 ```
 
-Immediate `@next` updates retained test.1 during test.2 acceptance; exact-version native updates passed. An unqualified update can also retain the saved version. Neither `@latest` update success nor eventual success after 24 hours is established. Use the [maintenance procedure](INSTALL.md#7-use-update-or-remove-fotor); keep release-age protection and request separate approval for any exact-version exception. Never apply an npm selector to a Git source as an ordinary update.
+During historical 0.6.0-test.2 acceptance, immediate `@next` updates retained 0.6.0-test.1; exact-version native updates passed. An unqualified update can also retain the saved version. Neither `@latest` update success nor eventual success after 24 hours is established. Use the [maintenance procedure](INSTALL.md#7-use-update-or-remove-fotor); keep release-age protection and request separate approval for any exact-version exception. Never apply an npm selector to a Git source as an ordinary update.
 
 Verify the source, version, files and actual skill/bridge directories in a new process. Preserve profile/store, credentials and connection parameters. If installation used a custom `--store-dir`, pass that same argument to updates and removal. A zero exit code with the old version is not an upgrade; cache clearing or reinstall does not turn it into a pass.
 
@@ -105,7 +105,7 @@ Verify the source, version, files and actual skill/bridge directories in a new p
 
 #### Production release
 
-First verify that the selected revision contains the DeepSeek Harness Bundle. Install this scoped package and its pinned bridge dependency to the chosen profile. Both components stay disabled until local setup. Record the old source and scope, remove only this Fotor Bundle through native controls, then add the selected source. Preserve the external credential directory; resolve both bridge and installed skill paths before enabling the new package.
+First verify that the selected revision contains the DeepSeek Harness Bundle. Install this scoped package and its pinned bridge dependency to the chosen profile. Select Web **Enable now** or load the CLI profile; both components then configure automatically unless explicit user settings disable them. Record the old source and scope, remove only this Fotor Bundle through native controls, then add the selected source. Preserve the external credential directory and valid overrides; verify automatically resolved paths when enabling the new package.
 
 ```bash
 dsh plugin --profile web add "git+https://github.com/fotor-ai/dsh-fotor-plugin.git" --ignore-scripts
@@ -113,16 +113,18 @@ dsh plugin --profile web add "git+https://github.com/fotor-ai/dsh-fotor-plugin.g
 
 #### Test release
 
-First verify that the selected revision contains the DeepSeek Harness Bundle. Install this scoped package and its pinned bridge dependency to the chosen profile. Both components stay disabled until local setup. Record the old source and scope, remove only this Fotor Bundle through native controls, then add the selected source. Preserve the external credential directory; resolve both bridge and installed skill paths before enabling the new package.
+First verify that the selected revision contains the DeepSeek Harness Bundle. Install this scoped package and its pinned bridge dependency to the chosen profile. Select Web **Enable now** or load the CLI profile; both components then configure automatically unless explicit user settings disable them. Record the old source and scope, remove only this Fotor Bundle through native controls, then add the selected source. Preserve the external credential directory and valid overrides; verify automatically resolved paths when enabling the new package.
 
 ```bash
 dsh plugin --profile web add "git+https://github.com/fotor-ai/dsh-fotor-plugin.git#release/test" --ignore-scripts
 ```
 
-Legacy `fotor` and scoped packages are different identities. Stop Fotor components, record old source/profile/store/paths, remove only their override rows, then remove the old Bundle with `dsh plugin --profile web remove fotor --config.ignore-scripts=true`. Add one scoped source and resolve both installed skill and bridge paths again. Preserve model settings, the external credential directory, callback/security parameters and daily browser state; do not automatically remove the old external bridge.
+Legacy `fotor` and scoped packages are different identities. Stop Fotor components and record old source/profile/store/paths and explicit overrides, then remove the old Bundle with `dsh plugin --profile web remove fotor --config.ignore-scripts=true`. Add one scoped source. Version 0.6.1 resolves its runtime paths automatically unless explicit overrides apply; preserve valid values and correct or remove only obsolete path overrides through native configuration. Preserve disabled settings, model settings, the external credential directory, callback/security parameters and daily browser state; do not automatically remove the old external bridge.
 
 GitHub/npm switching uses the same explicit remove/add sequence, with `@fotor-ai/dsh-fotor-plugin` as the removal target. Keep one installed source and one component pair. Ordinary update does not rename packages or switch sources. See [maintenance](INSTALL.md#7-use-update-or-remove-fotor).
 
+Uninstall retains external credentials but does not revoke server consent. Same-profile reinstall can reuse accepted authorization; enabling still establishes a new connection that requires actual discovery/query verification. Expired or rejected credentials may need new consent. Reinstall is not evidence of a successful native upgrade.
+
 
 ## Workflows
 
@@ -130,10 +132,11 @@ Start with [connection and model discovery](skills/fotor-connect/references/mcp-
 
 ## Bundle contents
 
-- `package.json` and `cordis.patch.yml`: the declarative Bundle and two initially disabled components.
-- `configuration.example.yml`: complete local setup example; never auto-applied.
+- `package.json` and `cordis.patch.yml`: the Bundle and two enabled-by-default adapters.
+- `configuration.example.yml`: optional complete legacy override; never auto-applied.
 - `INSTALL.md`: self-contained setup and migration guide.
 - `package-lock.json`: reviewed npm release-build input in Git snapshots; not a host-level Git dependency lock.
+- `runtime/`: automatic configuration and cancellable connection ownership; no installation hooks.
 - npm artifacts additionally contain the pinned third-party runtime; Fotor skills remain script-free.
 - `.github/`: Git snapshot publication tooling, excluded from installed packages.
 - `skills/`, including each skill's `references/`: shared workflows and DeepSeek Harness bridge/browser guidance.

package/configuration.example.yml

@@ -1,5 +1,6 @@
-# Copy outside the installed package and fill every absolute path.
-# Select a free callback port; use the same connection arguments for the client.
+# Optional legacy full override. New installations need no path configuration.
+# Copy outside the package only when intentionally overriding automatic values.
+# The adapter runs its client with the same connection arguments before the proxy.
 # Overrides replace the complete config object; fields are not deep-merged.
 - id: fotor-skills
   disabled: false

package/cordis.patch.yml

@@ -1,18 +1,10 @@
-# Installation declares inert host-owned components. Configure before enabling.
+# Host activation resolves local paths; package installation has no lifecycle hook.
 - insert:
     - id: fotor-skills
-      name: '@deepseek-ai/dsh-skill-filesystem'
-      disabled: true
-      config:
-        providerName: fotor
-        includeDefaultRoots: false
-        customSkillDirs: []
+      name: '@fotor-ai/dsh-fotor-plugin/skills'
+      disabled: false
+      config: {}
     - id: fotor-mcp
-      name: '@deepseek-ai/dsh-mcp-client'
-      disabled: true
-      config:
-        serverName: fotor
-        transport: stdio
-        failOnStartupError: false
-        reconnect:
-          enabled: false
+      name: '@fotor-ai/dsh-fotor-plugin/mcp'
+      disabled: false
+      config: {}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fotor-ai/dsh-fotor-plugin",
-  "version": "0.6.0",
+  "version": "0.6.1-test.2",
   "description": "Connect to Fotor's production MCP service.",
   "author": {
     "name": "Fotor"
@@ -20,7 +20,8 @@
     "skills",
     "assets",
     "README.md",
-    "LICENSE"
+    "LICENSE",
+    "runtime"
   ],
   "dsh": {
     "bundle": {
@@ -30,6 +31,11 @@
   "dependencies": {
     "mcp-remote": "0.15.2"
   },
+  "type": "module",
+  "exports": {
+    "./skills": "./runtime/skills.mjs",
+    "./mcp": "./runtime/mcp.mjs"
+  },
   "bundleDependencies": [
     "mcp-remote"
   ],

package/runtime/client.mjs

@@ -0,0 +1,84 @@
+/** Bound the pinned bridge CLI without exposing its OAuth output or token files. */
+import { spawn } from 'node:child_process';
+import { createServer } from 'node:net';
+import { childEnvironment } from './config.mjs';
+
+export function toolsDiscovered(text) {
+  const marker = text.indexOf('Tools:');
+  if (marker < 0) return false;
+  const start = text.indexOf('{', marker);
+  if (start < 0) return false;
+  let depth = 0, quoted = false, escaped = false;
+  for (let index = start; index < text.length; index++) {
+    const char = text[index];
+    if (quoted) {
+      if (escaped) escaped = false;
+      else if (char === '\\') escaped = true;
+      else if (char === '"') quoted = false;
+    } else if (char === '"') quoted = true;
+    else if (char === '{') depth++;
+    else if (char === '}' && --depth === 0) {
+      try { const value = JSON.parse(text.slice(start, index + 1)); return Array.isArray(value.tools) && value.tools.every(tool => typeof tool.name === 'string'); }
+      catch { return false; }
+    }
+  }
+  return false;
+}
+export async function checkCallbackPort(args) {
+  if (!/^\d+$/.test(args[2] ?? '')) return;
+  const port = Number(args[2]);
+  const hostIndex = args.indexOf('--host');
+  const host = hostIndex < 0 ? 'localhost' : args[hostIndex + 1];
+  await new Promise((resolve, reject) => {
+    const probe = createServer(socket => socket.destroy());
+    probe.once('error', () => reject(new Error('Fotor callback port is unavailable; stop the conflicting task before retrying')));
+    probe.listen({port, host, exclusive:true}, () => probe.close(resolve));
+  });
+}
+export function authorize(connection, { signal, status, automaticMs = 90000, humanMs = 600000, spawnProcess = spawn } = {}) {
+  return new Promise((resolve, reject) => {
+    if (signal.aborted) return reject(new Error('Fotor connection cancelled'));
+    const config = connection.native;
+    const child = spawnProcess(config.command, [connection.client, ...config.args.slice(1)], {
+      cwd: config.cwd, env: childEnvironment(config.env), stdio: ['pipe', 'pipe', 'pipe'], shell: false,
+    });
+    let output = '', waiting = false, waited = false, failure, killTimer;
+    let started = Date.now(), remaining = automaticMs;
+    const finish = error => { failure ??= error; child.kill('SIGTERM'); killTimer ??= setTimeout(() => child.kill('SIGKILL'), 1500); };
+    const aborted = () => finish(new Error('Fotor connection cancelled'));
+    signal.addEventListener('abort', aborted, { once: true });
+    let timer = setTimeout(() => finish(new Error('Fotor automatic connection budget exceeded')), remaining);
+    const receive = chunk => {
+      output += chunk.toString('utf8');
+      if (Buffer.byteLength(output) > 1024 * 1024) return finish(new Error('Fotor bridge output exceeded its bound'));
+      if (/EADDRINUSE|address already in use/i.test(output)) return finish(new Error('Fotor callback port is already in use; stop the conflicting task or preserve and adjust its explicit configuration'));
+      if (/Could not open a browser automatically/.test(output)) return finish(new Error('Fotor browser unavailable; configure the ordinary browser before retrying'));
+      if (!waited && /Please authorize this client by visiting:|Authentication required\. Waiting for authorization/.test(output)) {
+        remaining = Math.max(1, remaining - (Date.now() - started));
+        clearTimeout(timer); waiting = true; waited = true;
+        status('waiting-authorization');
+        timer = setTimeout(() => finish(new Error('Fotor authorization wait expired')), humanMs);
+      }
+      if (waiting && /Connected successfully!/.test(output)) {
+        waiting = false; started = Date.now(); clearTimeout(timer);
+        timer = setTimeout(() => finish(new Error('Fotor automatic connection budget exceeded')), remaining);
+        status('preparing');
+      }
+    };
+    child.stdout.on('data', receive); child.stderr.on('data', receive);
+    child.on('error', () => { failure = new Error('Fotor authorization client could not start'); });
+    child.on('close', code => {
+      clearTimeout(timer); clearTimeout(killTimer); signal.removeEventListener('abort', aborted);
+      const discovered = toolsDiscovered(output);
+      const connected = /Connected successfully!/.test(output);
+      const transient = !waited && /EAI_AGAIN|ENOTFOUND|ECONNRESET|ETIMEDOUT|ECONNREFUSED/.test(output);
+      output = '';
+      if (failure) reject(failure);
+      else if (code === 0 && connected && discovered) resolve({ automaticMsUsed: automaticMs - remaining + (waiting ? 0 : Date.now() - started) });
+      else {
+        const error = new Error(waited ? 'Fotor authorization did not complete; disable and enable MCP to try again' : 'Fotor client did not connect and discover tools');
+        error.transient = transient; reject(error);
+      }
+    });
+  });
+}