@perrylink/dsh-github 0.6.2 → 0.6.4

package/lib/types/client.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Browser half of `@perrylink/dsh-github` — the GitHub token configuration
+ * card contributed to the "Plugins" settings section.
+ * @module @perrylink/dsh-github/client
+ */
+import type { ClientContext } from '@deepseek-ai/dsh-client-runtime/client';
+/** Required services (cordis fiber inject). */
+export declare const inject: string[];
+/**
+ * Mount the GitHub configuration card into the plugins settings section.
+ * @param ctx - the browser plugin context.
+ */
+export declare function apply(ctx: ClientContext): void;

package/package.json

@@ -1,121 +1,144 @@
-{
-  "name": "@perrylink/dsh-github",
-  "version": "0.6.2",
-  "description": "Official-grade GitHub CI for DeepSeek Harness: composite action (review PRs / fix CI / report), polling PR review bot with idempotent inline comments, a status-check gate, and approval-gated PR/issue/repo/file tools",
-  "type": "module",
-  "main": "lib/index.js",
-  "types": "lib/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./lib/index.d.ts",
-      "import": "./lib/index.js"
-    }
-  },
-  "files": [
-    "lib",
-    "action.yml",
-    "scripts",
-    "cordis.patch.yml",
-    "README.md",
-    "README.zh.md",
-    "README.es.md",
-    "README.pt.md",
-    "README.hi.md",
-    "LICENSE"
-  ],
-  "scripts": {
-    "build": "tsc --noEmitOnError",
-    "prepare": "node scripts/prepare.mjs",
-    "prepublishOnly": "npm run build && npm test",
-    "test": "vitest run",
-    "typecheck": "tsc --noEmit",
-    "check:readmes": "node scripts/check-readmes.mjs"
-  },
-  "keywords": [
-    "dsh",
-    "dsh-plugin",
-    "deepseek-harness",
-    "github",
-    "github-actions",
-    "pull-request",
-    "code-review",
-    "ci",
-    "issue-tracker"
-  ],
-  "license": "Apache-2.0",
-  "publishConfig": {
-    "access": "public"
-  },
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/PerryLink/dsh-github"
-  },
-  "engines": {
-    "node": "^22.19.0 || >=24.0.0"
-  },
-  "dsh": {
-    "bundle": {
-      "patch": "./cordis.patch.yml"
-    }
-  },
-  "dshWorkshop": {
-    "schema": "omdsh-workshop-package/v1",
-    "type": "plugin",
-    "integration": {
-      "protocol": "harness-profile",
-      "artifact": "cordis.patch.yml"
-    },
-    "install": {
-      "mode": "transactional",
-      "adapter": "profile-bundle",
-      "failurePolicy": "generation-rollback",
-      "touchesCurrentBeforeActivation": false
-    },
-    "lifecycle": {
-      "activation": "restart-profile",
-      "dispose": "supported"
-    },
-    "permissions": [
-      "network:outbound",
-      "filesystem:write"
-    ],
-    "compatibility": {
-      "dshVersions": [
-        "0.1.0-rc.6"
-      ]
-    },
-    "capability": {
-      "id": "gh-ci",
-      "kind": "command",
-      "invocation": "/ci",
-      "expected": "runs the review engine for the requested PR, posts idempotent inline review comments and publishes the status-check verdict (success / changes needed)"
-    },
-    "evidence": {
-      "install": null,
-      "failureIsolation": null,
-      "hotReload": null,
-      "remove": null
-    }
-  },
-  "dependencies": {
-    "@deepseek-ai/schemastery": "^3.18.1"
-  },
-  "peerDependencies": {
-    "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-credentials": "^0.1.0-rc.5",
-    "@deepseek-ai/dsh-llm": "^0.1.0-rc.5",
-    "@deepseek-ai/dsh-session": "^0.1.0-rc.5",
-    "@deepseek-ai/dsh-tools": "^0.1.0-rc.5"
-  },
-  "devDependencies": {
-    "@deepseek-ai/cordis": "4.0.1",
-    "@deepseek-ai/dsh-credentials": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-llm": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-session": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-tools": "0.1.0-rc.6",
-    "@deepseek-ai/schemastery": "3.18.1",
-    "@types/node": "^22.0.0",
-    "typescript": "^5.7.0",
-    "vitest": "^3.2.0"
-  }
-}
+{
+  "name": "@perrylink/dsh-github",
+  "version": "0.6.4",
+  "description": "Official-grade GitHub CI for DeepSeek Harness: composite action (review PRs / fix CI / report), polling PR review bot with idempotent inline comments, a status-check gate, and approval-gated PR/issue/repo/file tools",
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "import": "./lib/index.js"
+    },
+    "./client": {
+      "types": "./lib/types/client.d.ts",
+      "default": "./lib/client.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib",
+    "action.yml",
+    "scripts",
+    "cordis.patch.yml",
+    "README.md",
+    "README.zh.md",
+    "README.es.md",
+    "README.pt.md",
+    "README.hi.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsc --noEmitOnError && node scripts/fix-dts.mjs",
+    "prepare": "node scripts/prepare.mjs",
+    "prepublishOnly": "npm run build && npm test",
+    "test": "vitest run",
+    "test:coverage": "vitest run --coverage",
+    "typecheck": "tsc --noEmit",
+    "lint": "oxlint",
+    "check:readmes": "node scripts/check-readmes.mjs",
+    "verify:self-contained": "node scripts/verify-self-contained.mjs",
+    "verify:artifacts": "node scripts/verify-artifacts.mjs"
+  },
+  "keywords": [
+    "dsh",
+    "dsh-plugin",
+    "deepseek-harness",
+    "github",
+    "github-actions",
+    "pull-request",
+    "code-review",
+    "ci",
+    "issue-tracker"
+  ],
+  "license": "Apache-2.0",
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/PerryLink/dsh-github"
+  },
+  "engines": {
+    "node": "^22.19.0 || >=24.0.0"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "inject": [
+        "@deepseek-ai/dsh-client-connection",
+        "@deepseek-ai/dsh-client-locale",
+        "@deepseek-ai/dsh-client-runtime",
+        "@deepseek-ai/dsh-client-ui-slots"
+      ],
+      "platform": "web"
+    }
+  },
+  "dshWorkshop": {
+    "schema": "omdsh-workshop-package/v1",
+    "type": "plugin",
+    "integration": {
+      "protocol": "harness-profile",
+      "artifact": "cordis.patch.yml"
+    },
+    "install": {
+      "mode": "transactional",
+      "adapter": "profile-bundle",
+      "failurePolicy": "generation-rollback",
+      "touchesCurrentBeforeActivation": false
+    },
+    "lifecycle": {
+      "activation": "restart-profile",
+      "dispose": "supported"
+    },
+    "permissions": [
+      "network:outbound",
+      "filesystem:write"
+    ],
+    "compatibility": {
+      "dshVersions": [
+        "0.1.1-rc.2"
+      ]
+    },
+    "capability": {
+      "id": "gh-ci",
+      "kind": "command",
+      "invocation": "/ci",
+      "expected": "runs the review engine for the requested PR, posts idempotent inline review comments and publishes the status-check verdict (success / changes needed)"
+    },
+    "evidence": {
+      "install": null,
+      "failureIsolation": null,
+      "hotReload": null,
+      "remove": null
+    }
+  },
+  "dependencies": {
+    "@deepseek-ai/schemastery": "^3.18.1"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "^4.0.1",
+    "@deepseek-ai/dsh-credentials": ">=0.1.0-rc.8 <0.2.0",
+    "@deepseek-ai/dsh-llm": ">=0.1.0-rc.8 <0.2.0",
+    "@deepseek-ai/dsh-session": ">=0.1.0-rc.8 <0.2.0",
+    "@deepseek-ai/dsh-settings": ">=0.1.0-rc.8 <0.2.0",
+    "@deepseek-ai/dsh-tools": ">=0.1.0-rc.8 <0.2.0"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "4.0.1",
+    "@deepseek-ai/cordis-plugin-loader": "1.0.2",
+    "@deepseek-ai/dsh-credentials": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-llm": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-session": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-settings": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-tools": "0.1.1-rc.2",
+    "@deepseek-ai/schemastery": "3.18.1",
+    "@types/node": "^22.0.0",
+    "@vitest/coverage-v8": "3.2.0",
+    "oxlint": "0.18.1",
+    "typescript": "^5.7.0",
+    "vitest": "^3.2.0"
+  }
+}

package/scripts/action-patch.mjs

@@ -1,152 +1,152 @@
-// Generates the dsh headless profile overlay and the task text for the
-// composite action. Zero-dependency Node: every input arrives through the
-// runner's INPUT_* environment variables (composite-action inputs), and every
-// value is emitted as a JSON string (a valid YAML scalar) so arbitrary user
-// input can never break the YAML structure.
-//
-// Writes to $INPUT_OUTPUT_DIR:
-//   dsh-github-ci.cordis.yml — the --patch overlay (Minimal persona + role
-//     line, model selection, sandbox, the minimal bash/editor toolset, and
-//     the dsh-github row with the full ci.* configuration).
-//   task.txt — the headless task for the selected mode.
-import { mkdirSync, writeFileSync } from 'node:fs'
-import { join } from 'node:path'
-
-// Local-machine protection: the composite action resolves every path from the
-// runner environment (RUNNER_TEMP for the output directory, GITHUB_WORKSPACE
-// for the sandbox root). Outside a GitHub Actions runner those variables do
-// not exist, and every fallback would silently write the profile overlay and
-// task into the current working directory while a locally spawned `dsh`
-// inherits the developer's real DSH_HOME. Refuse to run instead of guessing.
-const runnerTemp = (process.env.RUNNER_TEMP ?? '').trim()
-const workspace = (process.env.GITHUB_WORKSPACE ?? '').trim()
-if (runnerTemp === '' || workspace === '') {
-  console.error('dsh-github: refusing to run outside a GitHub Actions runner — both RUNNER_TEMP and GITHUB_WORKSPACE must be set.')
-  console.error('dsh-github: to exercise the action locally, use `node scripts/local-test.mjs`; it pins DSH_HOME, DSH_PROFILE_DIR, and the output directory under the system temp directory.')
-  process.exit(1)
-}
-
-const env = (name) => process.env[name] ?? ''
-const boolOf = (value, fallback) => value.trim() === '' ? fallback : value.trim() === 'true' || value.trim() === '1'
-const listOf = (value) => value.split(',').map(item => item.trim()).filter(item => item.length > 0)
-const y = (value) => JSON.stringify(value)
-
-const task = env('INPUT_TASK').trim() || 'review'
-const pr = env('INPUT_PR').trim()
-const ownerRepo = env('INPUT_OWNER_REPO').trim()
-const model = env('INPUT_MODEL').trim() || 'deepseek-v4-flash'
-const engine = env('INPUT_ENGINE').trim() === 'model' ? 'model' : 'static'
-const checkName = env('INPUT_CHECK_NAME').trim() || 'dsh-github-review'
-const blocking = boolOf(env('INPUT_BLOCKING'), true)
-const failOn = env('INPUT_FAIL_ON').trim() === 'warning' ? 'warning' : 'error'
-const labelFilters = listOf(env('INPUT_LABEL_FILTERS'))
-const pathFilters = listOf(env('INPUT_PATH_FILTERS'))
-const maxDiffChars = Number(env('INPUT_MAX_DIFF_CHARS')) > 0 ? Math.floor(Number(env('INPUT_MAX_DIFF_CHARS'))) : 8000
-const postComments = boolOf(env('INPUT_POST_COMMENTS'), true)
-const postCheck = boolOf(env('INPUT_POST_CHECK'), true)
-const requestTimeoutMs = Number(env('INPUT_REQUEST_TIMEOUT_MS')) > 0 ? Math.floor(Number(env('INPUT_REQUEST_TIMEOUT_MS'))) : 30000
-const outputDir = env('INPUT_OUTPUT_DIR').trim() || join(process.env.RUNNER_TEMP ?? '.', 'dsh-github')
-const customTask = env('INPUT_TASK_PROMPT').trim()
-
-if ((task === 'review' || task === 'fix-ci') && pr === '') {
-  console.error('dsh-github: the `pr` input is required for the review and fix-ci tasks (defaults to github.event.pull_request.number on pull_request events)')
-  process.exit(1)
-}
-if (ownerRepo === '') {
-  console.error('dsh-github: the `owner-repo` input is required (defaults to github.repository)')
-  process.exit(1)
-}
-
-mkdirSync(outputDir, { recursive: true })
-
-const callJson = (extra) => JSON.stringify({ task: extra.task, pr, ownerRepo, ...extra })
-
-let taskText
-if (customTask !== '') {
-  taskText = customTask
-} else if (task === 'review' && engine === 'static') {
-  taskText = `You are the dsh-github CI reviewer for this repository. Call the ci_run tool once with ${callJson({ task: 'review' })} and then reply with only the verdict and the summary line from its result.`
-} else if (task === 'review') {
-  taskText = `You are a careful software engineer reviewing a GitHub pull request. First call ci_run with ${callJson({ task: 'analyze' })}. Review the diff yourself: correctness, security, style, and maintainability. Then call ci_run with ${callJson({ task: 'publish' })} plus a "body" holding your review (Markdown, verdict first, findings grouped by file) and a "findings" array for line-anchored problems you found. Finish by replying with only the verdict and the summary line from the publish result.`
-} else if (task === 'fix-ci') {
-  taskText = `You are the dsh-github CI engineer for this repository. Investigate the CI failures of PR #${pr} in ${ownerRepo}: read the failing checks with gh_review (fields "ci"), inspect the code with gh_file and gh_repo, and use the bash tool only to read logs or run read-only diagnostics. Do NOT modify files. Write a fix plan as your final answer and call ci_run with ${callJson({ task: 'publish' })} plus a "body" holding that plan so it is posted as a review comment.`
-} else {
-  taskText = `You are the dsh-github CI reporter for this repository. Generate a concise, factual report about ${ownerRepo}${pr !== '' ? ` PR #${pr}` : ''} using the read tools (gh_repo, gh_file, gh_review, gh_search). Write the report as your final answer and, if a pull request is being analyzed, call ci_run with ${callJson({ task: 'publish' })} plus a "body" holding the report so it is posted as a review comment.`
-}
-
-const personaText = 'You are a helpful software engineer assistant.\nYou are the dsh-github CI assistant for this repository.'
-
-const overlay = `# dsh-github CI overlay — generated by the composite action; every value is
-# emitted by scripts/action-patch.mjs from the action inputs. Do not edit.
-# Rows that already exist in dsh-base are replaced by id; new rows ride an
-# insert block (non-insert patches only replace existing rows).
-- id: persona
-  name: '@deepseek-ai/dsh-persona'
-  config:
-    text: ${y(personaText)}
-    complete: true
-    includeRuntimeContext: false
-
-- id: agent-default-model
-  name: '@deepseek-ai/dsh-agent-default-model'
-  config:
-    provider: deepseek-official
-    model: ${y(model)}
-
-- id: llm-deepseek
-  name: '@deepseek-ai/dsh-llm-deepseek'
-  config:
-    apiKeyEnv: DEEPSEEK_API_KEY
-
-- id: sandbox-policy
-  name: '@deepseek-ai/dsh-sandbox-policy'
-  config:
-    mode: workspace-write
-    workspaceRoot: !!js process.env.GITHUB_WORKSPACE ?? process.cwd()
-
-# The minimal toolset (persistent bash + editor), matching the official
-# minimal preset: enough to investigate CI failures and generate reports,
-# bounded by the workspace-write sandbox above.
-- insert:
-    - id: terminal
-      name: '@deepseek-ai/dsh-terminal'
-
-    - id: terminal-bash
-      name: '@deepseek-ai/dsh-terminal-bash'
-      config:
-        timeoutMs: 300000
-
-    - id: persistent-bash
-      name: '@deepseek-ai/dsh-tool-bash-persistent'
-      config:
-        timeoutMs: 300000
-
-    - id: str-replace-editor
-      name: '@deepseek-ai/dsh-tool-str-replace-editor'
-      config:
-        maxOutputChars: 16000
-
-    - id: dsh-github
-      name: '@perrylink/dsh-github'
-      config:
-        tokenSource: env
-        tokenRef: DSH_GITHUB_TOKEN
-        maxDiffChars: ${maxDiffChars}
-        requestTimeoutMs: ${requestTimeoutMs}
-        ci:
-          enabled: true
-          engine: ${y(engine)}
-          autoApprove: ['ci.run']
-          checkName: ${y(checkName)}
-          blocking: ${blocking}
-          failOn: ${y(failOn)}
-          pollIntervalMs: 0
-          labelFilters: ${y(labelFilters)}
-          pathFilters: ${y(pathFilters)}
-          postComments: ${postComments}
-          reportDir: ${y(outputDir)}
-`
-
-writeFileSync(join(outputDir, 'dsh-github-ci.cordis.yml'), overlay)
-writeFileSync(join(outputDir, 'task.txt'), taskText + '\n')
-console.log(`dsh-github: overlay and task written to ${outputDir} (task: ${task}, engine: ${engine})`)
+// Generates the dsh headless profile overlay and the task text for the
+// composite action. Zero-dependency Node: every input arrives through the
+// runner's INPUT_* environment variables (composite-action inputs), and every
+// value is emitted as a JSON string (a valid YAML scalar) so arbitrary user
+// input can never break the YAML structure.
+//
+// Writes to $INPUT_OUTPUT_DIR:
+//   dsh-github-ci.cordis.yml — the --patch overlay (Minimal persona + role
+//     line, model selection, sandbox, the minimal bash/editor toolset, and
+//     the dsh-github row with the full ci.* configuration).
+//   task.txt — the headless task for the selected mode.
+import { mkdirSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+
+// Local-machine protection: the composite action resolves every path from the
+// runner environment (RUNNER_TEMP for the output directory, GITHUB_WORKSPACE
+// for the sandbox root). Outside a GitHub Actions runner those variables do
+// not exist, and every fallback would silently write the profile overlay and
+// task into the current working directory while a locally spawned `dsh`
+// inherits the developer's real DSH_HOME. Refuse to run instead of guessing.
+const runnerTemp = (process.env.RUNNER_TEMP ?? '').trim()
+const workspace = (process.env.GITHUB_WORKSPACE ?? '').trim()
+if (runnerTemp === '' || workspace === '') {
+  console.error('dsh-github: refusing to run outside a GitHub Actions runner — both RUNNER_TEMP and GITHUB_WORKSPACE must be set.')
+  console.error('dsh-github: to exercise the action locally, use `node scripts/local-test.mjs`; it pins DSH_HOME, DSH_PROFILE_DIR, and the output directory under the system temp directory.')
+  process.exit(1)
+}
+
+const env = (name) => process.env[name] ?? ''
+const boolOf = (value, fallback) => value.trim() === '' ? fallback : value.trim() === 'true' || value.trim() === '1'
+const listOf = (value) => value.split(',').map(item => item.trim()).filter(item => item.length > 0)
+const y = (value) => JSON.stringify(value)
+
+const task = env('INPUT_TASK').trim() || 'review'
+const pr = env('INPUT_PR').trim()
+const ownerRepo = env('INPUT_OWNER_REPO').trim()
+const model = env('INPUT_MODEL').trim() || 'deepseek-v4-flash'
+const engine = env('INPUT_ENGINE').trim() === 'model' ? 'model' : 'static'
+const checkName = env('INPUT_CHECK_NAME').trim() || 'dsh-github-review'
+const blocking = boolOf(env('INPUT_BLOCKING'), true)
+const failOn = env('INPUT_FAIL_ON').trim() === 'warning' ? 'warning' : 'error'
+const labelFilters = listOf(env('INPUT_LABEL_FILTERS'))
+const pathFilters = listOf(env('INPUT_PATH_FILTERS'))
+const maxDiffChars = Number(env('INPUT_MAX_DIFF_CHARS')) > 0 ? Math.floor(Number(env('INPUT_MAX_DIFF_CHARS'))) : 8000
+const postComments = boolOf(env('INPUT_POST_COMMENTS'), true)
+const postCheck = boolOf(env('INPUT_POST_CHECK'), true)
+const requestTimeoutMs = Number(env('INPUT_REQUEST_TIMEOUT_MS')) > 0 ? Math.floor(Number(env('INPUT_REQUEST_TIMEOUT_MS'))) : 30000
+const outputDir = env('INPUT_OUTPUT_DIR').trim() || join(process.env.RUNNER_TEMP ?? '.', 'dsh-github')
+const customTask = env('INPUT_TASK_PROMPT').trim()
+
+if ((task === 'review' || task === 'fix-ci') && pr === '') {
+  console.error('dsh-github: the `pr` input is required for the review and fix-ci tasks (defaults to github.event.pull_request.number on pull_request events)')
+  process.exit(1)
+}
+if (ownerRepo === '') {
+  console.error('dsh-github: the `owner-repo` input is required (defaults to github.repository)')
+  process.exit(1)
+}
+
+mkdirSync(outputDir, { recursive: true })
+
+const callJson = (extra) => JSON.stringify({ task: extra.task, pr, ownerRepo, ...extra })
+
+let taskText
+if (customTask !== '') {
+  taskText = customTask
+} else if (task === 'review' && engine === 'static') {
+  taskText = `You are the dsh-github CI reviewer for this repository. Call the ci_run tool once with ${callJson({ task: 'review' })} and then reply with only the verdict and the summary line from its result.`
+} else if (task === 'review') {
+  taskText = `You are a careful software engineer reviewing a GitHub pull request. First call ci_run with ${callJson({ task: 'analyze' })}. Review the diff yourself: correctness, security, style, and maintainability. Then call ci_run with ${callJson({ task: 'publish' })} plus a "body" holding your review (Markdown, verdict first, findings grouped by file) and a "findings" array for line-anchored problems you found. Finish by replying with only the verdict and the summary line from the publish result.`
+} else if (task === 'fix-ci') {
+  taskText = `You are the dsh-github CI engineer for this repository. Investigate the CI failures of PR #${pr} in ${ownerRepo}: read the failing checks with gh_review (fields "ci"), inspect the code with gh_file and gh_repo, and use the bash tool only to read logs or run read-only diagnostics. Do NOT modify files. Write a fix plan as your final answer and call ci_run with ${callJson({ task: 'publish' })} plus a "body" holding that plan so it is posted as a review comment.`
+} else {
+  taskText = `You are the dsh-github CI reporter for this repository. Generate a concise, factual report about ${ownerRepo}${pr !== '' ? ` PR #${pr}` : ''} using the read tools (gh_repo, gh_file, gh_review, gh_search). Write the report as your final answer and, if a pull request is being analyzed, call ci_run with ${callJson({ task: 'publish' })} plus a "body" holding the report so it is posted as a review comment.`
+}
+
+const personaText = 'You are a helpful software engineer assistant.\nYou are the dsh-github CI assistant for this repository.'
+
+const overlay = `# dsh-github CI overlay — generated by the composite action; every value is
+# emitted by scripts/action-patch.mjs from the action inputs. Do not edit.
+# Rows that already exist in dsh-base are replaced by id; new rows ride an
+# insert block (non-insert patches only replace existing rows).
+- id: persona
+  name: '@deepseek-ai/dsh-persona'
+  config:
+    text: ${y(personaText)}
+    complete: true
+    includeRuntimeContext: false
+
+- id: agent-default-model
+  name: '@deepseek-ai/dsh-agent-default-model'
+  config:
+    provider: deepseek-official
+    model: ${y(model)}
+
+- id: llm-deepseek
+  name: '@deepseek-ai/dsh-llm-deepseek'
+  config:
+    apiKeyEnv: DEEPSEEK_API_KEY
+
+- id: sandbox-policy
+  name: '@deepseek-ai/dsh-sandbox-policy'
+  config:
+    mode: workspace-write
+    workspaceRoot: !!js process.env.GITHUB_WORKSPACE ?? process.cwd()
+
+# The minimal toolset (persistent bash + editor), matching the official
+# minimal preset: enough to investigate CI failures and generate reports,
+# bounded by the workspace-write sandbox above.
+- insert:
+    - id: terminal
+      name: '@deepseek-ai/dsh-terminal'
+
+    - id: terminal-bash
+      name: '@deepseek-ai/dsh-terminal-bash'
+      config:
+        timeoutMs: 300000
+
+    - id: persistent-bash
+      name: '@deepseek-ai/dsh-tool-bash-persistent'
+      config:
+        timeoutMs: 300000
+
+    - id: str-replace-editor
+      name: '@deepseek-ai/dsh-tool-str-replace-editor'
+      config:
+        maxOutputChars: 16000
+
+    - id: dsh-github
+      name: '@perrylink/dsh-github'
+      config:
+        tokenSource: env
+        tokenRef: DSH_GITHUB_TOKEN
+        maxDiffChars: ${maxDiffChars}
+        requestTimeoutMs: ${requestTimeoutMs}
+        ci:
+          enabled: true
+          engine: ${y(engine)}
+          autoApprove: ['ci.run']
+          checkName: ${y(checkName)}
+          blocking: ${blocking}
+          failOn: ${y(failOn)}
+          pollIntervalMs: 0
+          labelFilters: ${y(labelFilters)}
+          pathFilters: ${y(pathFilters)}
+          postComments: ${postComments}
+          reportDir: ${y(outputDir)}
+`
+
+writeFileSync(join(outputDir, 'dsh-github-ci.cordis.yml'), overlay)
+writeFileSync(join(outputDir, 'task.txt'), taskText + '\n')
+console.log(`dsh-github: overlay and task written to ${outputDir} (task: ${task}, engine: ${engine})`)