@sqdr2/dsh-agent-studio-fusion 1.0.0 → 1.0.1

package/CHANGELOG.md

@@ -20,6 +20,26 @@ own tags and releases.
 Entry format: what changed, then what was actually validated. "Not claimed" lines mark what a release did *not* test —
 read them before assuming a platform is covered.
 
+## 1.0.1 — 2026-11-13
+
+### ACP
+- **A configured ACP route is no longer replaced by a phantom provider named `get`, and its model list is no longer
+  empty.** `acp.agents` is declared volatile so the Host publishes a live-editable settings form, which makes a parsed
+  Config carry a `{ get() }` reference at that key instead of the profile map. `agentsOf()` read it with
+  `Object.entries`, so the reference's only own key — the `get` method — became the route id: the adapter registered a
+  provider literally named `get` whose profile was `undefined`, and the configured route never reached the catalog.
+  The failure surfaced in the model picker as `get failed to load: Cannot read properties of undefined (reading
+  'length')` (from `profile.models.length` in `listModels`) with the real route missing entirely — every ACP agent,
+  Devin included, therefore offered no models. `agentsOf()` now unwraps the reference before reading, and still accepts
+  a plain map for callers that pass raw settings. `AcpConfig` documents the trap so the declared type is not mistaken
+  for the runtime value.
+- Validated against the real agent: a Devin route (`devin acp`) configured only through `acp.agents` now lists
+  `SWE-2 Flash Medium` and `SWE-1.6 Slow` plus the `default` fallback, and `resolveModel` returns context window and
+  reasoning metadata for them. Regression tests in `tests/acp-import.spec.ts` fail on the previous code and pass on
+  this one; the full suite is 648 passed, the host suite 300 passed / 1 skipped.
+- Not claimed: that fix covers reading the route map only. Any other consumer that reads `config.acp.agents` with
+  `Object.entries` would hit the same reference; `lib/types` is rebuilt to ship this one already unwrapped.
+
 ## 1.0.0 — 2026-11-13
 
 ### Naming and upgrade
@@ -35,6 +55,11 @@ read them before assuming a platform is covered.
   `isFusionSourceKind`, so context restored into a session started under an older name is still matched.
 - `docs/MIGRATION-AGY.md` and `docs/MIGRATION-ACP.md` now use the current row id in their copy-paste blocks; they had
   still named `- id: dsh-fusion` / `name: '@sqdr2/dsh-fusion'`, which the loader no longer matches.
+- **Publishing the new name needs staging.** A bypass-2FA granular token cannot create a name that does not exist yet: it
+  answers `E404 Not Found - PUT` (not 401), on npm 11 and 12 alike. The first release of a name is uploaded with
+  `npm stage publish` and approved in the browser with 2FA (`RELEASING.md`, `RELEASING.zh.md`). CI's `publish.yml` then
+  finds the version already on npm and exits successfully without publishing, so the tag run is a build-and-test gate,
+  not the publisher, until a trusted publisher is added for this name.
 
 ### Client
 - **The Fusion panel becomes the combined studio page**, titled `DSH Agent Studio With Fusion` (one constant,

package/RELEASING.md

@@ -37,11 +37,26 @@ Open the **Actions** tab and accept the "I understand my workflows, go ahead and
 ### 2. Add a trusted publisher on npm
 
 OIDC publishing is authorised per package, on the package's own settings page, which a name that has never been
-published does not have. So the very first release of a name can only be done by hand:
+published does not have. So the very first release of a name can only be done by hand.
 
-1. Publish once with a granular token that bypasses 2FA (`bypass_2fa: true`, `package: write` on the right scope).
-   A token without 2FA bypass is rejected with `E403 Two-factor authentication ... is required to publish packages`,
-   and a token scoped to `@sqdr2` cannot publish an unscoped name at all.
+**What actually shipped 1.0.0 (2026-11-13, including the traps):** publishing a *new* name directly with a bypass-2FA
+granular token returns `E404 Not Found - PUT` (not 401), and `npm@12` behaves the same. The first publish of a name has
+to be **staged** and then approved by a maintainer in the browser with 2FA:
+
+```sh
+npx npm@12 stage publish . --access public    # uploads as staged; this is what claims the name
+npx npm@12 stage list                         # take the stage-id; status goes validating → staged
+# then approve it in npmjs.com → avatar → Staged packages (interactive 2FA; a token cannot do this)
+npx npm@12 stage list                         # after approval the entry is gone and 1.0.0 is in the registry
+```
+
+The registry first holds a `0.0.0-stage` placeholder version; once the real version is approved `dist-tags.latest`
+points at it, so the placeholder can be ignored (upstream `@sqdr2/dsh-agy-worker` carries the same `0.0.0-stage`).
+Staging also needs `--registry https://registry.npmjs.org/`: this machine's `~/.npmrc` points at npmmirror, which has no
+`/-/stage` endpoint and answers `404 .../-/stage`.
+
+1. Use the staging path above (or a granular token with 2FA bypass, `bypass_2fa: true`, `package: write`, correct
+   scope) for that first publish. Without bypass it is rejected with `EOTP This operation requires a one-time password`.
 2. On **npmjs.com → the package → Settings → Trusted publishing**, add:
 
    | Field | Value |

package/RELEASING.zh.md

@@ -31,11 +31,26 @@ workflow 会跳过 npm 上已存在的版本，所以同一个 tag 重跑是安
 
 ### 2. 在 npm 上加信任配置
 
-OIDC 发布是按包授权的，配置在包自己的设置页上，而一个从未发布过的包名没有这个页面。所以某个包名的第一版只能手发：
+OIDC 发布是按包授权的，配置在包自己的设置页上，而一个从未发布过的包名没有这个页面。所以某个包名的第一版只能手发。
 
-1. 用一个勾了 2FA bypass 的 granular token 手动发一次（`bypass_2fa: true`，`package: write`，作用域要对）。
-   不勾 bypass 会被拒：`E403 Two-factor authentication ... is required to publish packages`；
-   而作用域是 `@sqdr2` 的 token 根本无法发布无 scope 的包名。
+**1.0.0 的实际首发路径（2026-11-13，踩过的坑都在这）：** 用 bypass-2FA 的 granular token 直接 `npm publish`
+会返回 `E404 Not Found - PUT`（不是 401），换成 `npm@12` 也一样；新包名的首次发布必须先 **staging**，再由维护者
+在网页上用 2FA 批准：
+
+```sh
+npx npm@12 stage publish . --access public    # 上传为 staged，包名此时才被占住
+npx npm@12 stage list                         # 拿到 stage-id，状态 validating → staged
+# 然后在 npmjs.com → 头像 → Staged packages 里批准（这一步必须交互式 2FA，token 做不到）
+npx npm@12 stage list                         # 批准后条目消失，registry 里出现 1.0.0
+```
+
+批准后 registry 里会先出现一个 `0.0.0-stage` 占位版本，正式版本发布后 `dist-tags.latest` 指向正式版本，
+占位版本可以忽略（上游 `@sqdr2/dsh-agy-worker` 也有同样的 `0.0.0-stage`）。另外注意 staging 走的是
+`--registry https://registry.npmjs.org/`：本机 `~/.npmrc` 的默认 registry 是 npmmirror，它没有 `/-/stage` 端点，
+不显式指定会报 `404 .../-/stage`。
+
+1. 用上面那条 staging 路径（或一个勾了 2FA bypass 的 granular token，`bypass_2fa: true`、`package: write`、
+   作用域要对）完成首次发布。不勾 bypass 会被拒：`EOTP This operation requires a one-time password`。
 2. 在 **npmjs.com → 该包 → Settings → Trusted publishing** 添加：
 
    | 字段 | 值 |