@tokensapi/dsh-progressive-tools 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,124 @@
+# Changelog
+
+All notable changes to this project are documented here. The format follows
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and releases follow
+[Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [Tokens 0.1.0] - 2026-08-28
+
+### Added
+
+- Tokens-owned package and Cordis identities for marketplace distribution.
+- A product-tuned stable direct surface for common file, shell, Skill, task,
+  interaction, and file-return tools.
+- Exact DSH `0.1.0-rc.8` development and peer compatibility, including a
+  fully pinned rc.8 test graph.
+- Package identity tests and retained upstream MIT attribution.
+
+### Based on
+
+- Upstream `dsh-progressive-tools` 0.3.0 at commit
+  `8d516b9933d5b7812ab39c929fd9ee5df66d5221`.
+
+## [0.3.0] - 2026-08-25
+
+Upgrading changes the stable discovery prompt text, so every deployment pays
+one context-cache cold start on the first request after the upgrade; the
+prefix is byte-stable again from the second request onward.
+
+### Added
+
+- Family-wide discovery: each stable search match lists every member tool name
+  of its family (`groupTools`), and the whole family becomes dispatchable from
+  that one search, so a plugin's tool surface is no longer truncated to the
+  top-ranked slice.
+- Stable-proxy `status` action lists every deferred family with member tool
+  names, giving the model a catalog-browsing fallback when a search query has
+  no lexical overlap.
+- `statusGrantsDiscovery` option (default `false`): when enabled, one `status`
+  listing makes every cataloged name dispatchable. The default keeps dispatch
+  behind a seen schema and the rejection message points to the deterministic
+  exact-name recovery search.
+- Generic verb prefixes (`get`, `list`, `create`, ...) never merge into
+  automatic families, so unrelated plugins sharing a prefix stay separate.
+- The built-in image-generation family covers generation task helpers such as
+  `get_image_generation_task` and `cancel_image_generation_task`.
+- CJK character-bigram tokenization so queries without space-delimited words
+  match deferred definitions and family metadata without configured aliases.
+- `tool_dispatch` delegates its parallel-scheduling classification to the
+  target tool, so concurrency-safe deferred tools keep overlapping execution.
+- Documentation: an ecosystem onboarding checklist (`alwaysVisible` for
+  high-frequency tools, `skillBindings` for Skill-shipping packages, explicit
+  `groups` for unconventional names).
+
+### Changed
+
+- Search results now record per-call discovery increments in the rendered
+  text, plus a cumulative `discoveredCount`; the cumulative name list moved to
+  presentation metadata, so conversation growth stays bounded and resume
+  restores full state from the latest surviving entry.
+- The stable discovery prompt clarifies that names mentioned elsewhere in the
+  prompt still require discovery, and points to `status` for catalog browsing.
+- `max_results` values outside the configured range are clamped instead of
+  rejected, matching upstream tool-search semantics.
+
+### Fixed
+
+- The routing guard prepares per-agent state on demand, closing a
+  direct-call window before the first assembly or session-start event.
+- Discovered-tool state survives registry refreshes such as provider
+  reconnects; dispatch validates catalog membership at call time.
+- Dispatch failures preserve the real tool's structured error code instead of
+  collapsing it into an unstructured message.
+
+## [0.2.0] - 2026-08-25
+
+### Added
+
+- Cache-stable `stable-proxy` mode as the new default.
+- Fixed first-request surface with `tool_search`, `tool_dispatch`, and
+  configurable common direct tools.
+- Exact definition search with BM25-style lexical ranking over nested schema
+  text and multilingual family aliases.
+- Nested real-tool dispatch through the complete DSH execution pipeline.
+- Monotonic routing guard for direct-call and Code Mode bypass prevention.
+- Stable Code Mode SDK projection and conservative tool-guidance deferral.
+- Real AgentLoop request regression test for first-request and prefix stability.
+
+### Fixed
+
+- First request no longer sends the full tool catalog before progressive state
+  takes effect.
+- Dynamic-mode search and Skill activation now affect the immediately following
+  request instead of lagging one request boundary.
+- Request lifecycle documentation now matches the official assembly order.
+
+### Changed
+
+- Search returns exact tool definitions in stable mode instead of activating a
+  whole family.
+- Agent-scoped tools can be deferred in stable mode.
+- `dynamic` is now an explicit compatibility mode.
+
+## [0.1.0] - 2026-08-25
+
+### Added
+
+- Per-agent progressive tool discovery through the official scoped restriction
+  API.
+- Configurable family rules, multilingual aliases, and automatic fallback
+  grouping.
+- Token-budget, LRU, family-cap, and turn-TTL retention controls.
+- Optional skill-to-family activation bindings.
+- Dynamic registry refresh and reversible lifecycle cleanup.
+- Resume restoration for top-level and nested discovery calls.
+- Bundle manifest, GitHub source-install build path, documentation, tests, and
+  continuous integration.
+
+[Unreleased]: https://github.com/TokensAPI/tokens_DshProgressiveTools_code/compare/v0.1.0...HEAD
+[Tokens 0.1.0]: https://github.com/TokensAPI/tokens_DshProgressiveTools_code/releases/tag/v0.1.0
+[0.3.0]: https://github.com/everclear077/dsh-progressive-tools/compare/v0.2.0...v0.3.0
+[0.2.0]: https://github.com/everclear077/dsh-progressive-tools/compare/v0.1.0...v0.2.0
+[0.1.0]: https://github.com/everclear077/dsh-progressive-tools/releases/tag/v0.1.0

package/CONTRIBUTING.md

@@ -0,0 +1,32 @@
+# Contributing
+
+Contributions are welcome through focused issues and pull requests.
+
+## Development setup
+
+Requirements:
+
+- Node.js `^22.19.0` or `>=24.0.0`
+- pnpm 11
+
+```sh
+pnpm install
+pnpm run check
+```
+
+## Change guidelines
+
+- Keep runtime behavior on public DeepSeek Harness services and events.
+- Preserve per-agent isolation and reversible Cordis cleanup.
+- Keep prompt projection and execution routing aligned. Any newly deferred path
+  must be covered by the monotonic routing guard and an end-to-end request test.
+- Add tests for behavior changes, including resume or unload behavior when
+  relevant.
+- Update README, configuration reference, architecture notes, and changelog when
+  public behavior changes.
+- Keep commits focused and use Conventional Commit subjects.
+
+## Pull requests
+
+Describe the user-visible problem, the chosen behavior, compatibility impact,
+and verification performed. Keep unrelated refactors out of the same change.

package/LICENSE

@@ -0,0 +1,22 @@
+MIT License
+
+Copyright (c) 2026 everclear077
+Copyright (c) 2026 TokensAPI contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,246 @@
+# Tokens Progressive Tools
+
+[![CI](https://github.com/TokensAPI/tokens_DshProgressiveTools_code/actions/workflows/ci.yml/badge.svg)](https://github.com/TokensAPI/tokens_DshProgressiveTools_code/actions/workflows/ci.yml)
+[![version](https://img.shields.io/badge/version-0.1.0-blue.svg)](./CHANGELOG.md)
+[![license](https://img.shields.io/badge/license-MIT-green.svg)](./LICENSE)
+
+TokensCowork's cache-stable progressive tool discovery for DeepSeek Harness. The default mode
+sends a small, fixed tool surface on the first request, keeps the complete
+catalog in process memory, and executes discovered tools through the ordinary
+Harness pipeline.
+
+[中文文档](./README.zh-CN.md)
+
+## Why
+
+Every visible tool definition consumes input tokens on every request. Changing
+that definition list later also changes the request prefix and reduces context
+cache reuse. Progressive disclosure needs both properties at once:
+
+- a small first request;
+- a byte-stable tool and system prefix across later requests.
+
+The default `stable-proxy` mode provides that contract:
+
+```text
+complete registry (process memory)
+        │
+        ├── exact searchable definitions
+        │
+        └── fixed request surface
+              ├── tool_search
+              ├── tool_dispatch
+              └── common direct tools
+                       │
+tool_search result ────┴──► append exact matches to conversation history
+                                  │
+                                  └── tool_dispatch ──► normal DSH execution pipeline
+```
+
+Search changes conversation history, not the top-level tool list. Approval,
+guards, argument validation, timeout wrappers, result policy, deferred context,
+and cancellation still run for the selected real tool.
+
+## Features
+
+- Minimal tool definitions on the actual first AgentLoop request.
+- Byte-stable native tool list and Code Mode SDK across discovery calls.
+- Exact tool matches with full name, description, and parameter schema.
+- Family-wide discovery: each match names every sibling tool of its family, so
+  one search opens a plugin's complete dispatchable surface.
+- Browsable `status` catalog listing, with an optional
+  `statusGrantsDiscovery` grant for trusted deployments.
+- Bounded conversation growth: search results record per-call discovery
+  increments while resume state travels in presentation metadata.
+- Deterministic BM25-style lexical ranking over names, descriptions, nested
+  parameter descriptions, enums, family metadata, and multilingual aliases.
+- Stable `tool_dispatch` transport with runtime schema validation through the
+  original tool definition.
+- Monotonic guard that rejects direct calls to deferred tools and permits only
+  dispatcher-owned nested execution trees.
+- Support for inherited and agent-scoped tools.
+- Durable discovery reconstruction for top-level and Code Mode search calls.
+- Optional skill-to-family discovery bindings.
+- `dynamic` compatibility mode for deployments that require native definitions
+  after activation.
+- Reversible Cordis effects for unload and configuration reload.
+
+## Requirements
+
+- Node.js `^22.19.0` or `>=24.0.0`
+- DeepSeek Harness `0.1.0-rc.8`
+- pnpm for source installation and development
+
+## Install
+
+```sh
+dsh plugin --profile web add @tokensapi/dsh-progressive-tools
+```
+
+Source installs run the package `prepare` script. If pnpm asks for build
+authorization, add the exact package key it reports to the profile's
+`pnpm-workspace.yaml`:
+
+```yaml
+allowBuilds:
+  '@tokensapi/dsh-progressive-tools': true
+```
+
+Verify the composed layer before starting the profile:
+
+```sh
+dsh --profile web --dump-config
+```
+
+The dump should contain the `tokens-progressive-tools` row contributed by this bundle.
+
+## Use
+
+The default direct surface contains:
+
+- `tool_search`;
+- `tool_dispatch`;
+- `read`, `write`, `edit`, `glob`, `grep`, `bash`, `skill`,
+  `ask_user_question`, `todo_write`, `dsh_im_return_file`, `report`,
+  `submit_*`, and `structured_output*` when registered;
+- reserved Harness presentation transports when the active tool mode needs
+  them.
+
+No special wording is required in an ordinary conversation. A stable system
+instruction tells the agent to search before declaring a capability
+unavailable.
+
+Discovery returns exact definitions:
+
+```json
+{
+  "query": "browser navigation",
+  "max_results": 3
+}
+```
+
+The next call uses one returned definition:
+
+```json
+{
+  "name": "browser_open",
+  "arguments": {
+    "url": "https://example.com"
+  }
+}
+```
+
+Each match also lists every member tool name of its family, and the whole
+family becomes dispatchable from that one search — siblings that did not make
+the top-ranked slice can be dispatched by name or schema-loaded with one
+exact-name query.
+
+`tool_search` also accepts `{"action":"status"}`, which lists every deferred
+family with its member tool names alongside catalog and savings estimates. By
+default the listing is browse-only: dispatching an unseen name still requires
+one exact-name search, and the rejection message says so. Deployments that
+prefer immediate access can set `statusGrantsDiscovery: true`. Search results
+are append-only conversation content; they never add native definitions to the
+top-level request.
+
+## Configure
+
+The default configuration is intentionally small:
+
+```yaml
+- id: tokens-progressive-tools
+  config:
+    mode: stable-proxy
+    toolName: tool_search
+    dispatchToolName: tool_dispatch
+    maxResults: 5
+    requireDiscovery: true
+    statusGrantsDiscovery: false
+    deferToolGuidance: true
+    alwaysVisible:
+      - read
+      - write
+      - edit
+      - glob
+      - grep
+      - bash
+      - skill
+      - ask_user_question
+      - todo_write
+      - dsh_im_return_file
+      - report
+      - submit_*
+      - structured_output*
+```
+
+Family rules improve search without changing the stable request surface:
+
+```yaml
+- id: tokens-progressive-tools
+  config:
+    groups:
+      - id: browser
+        description: Browser navigation and page interaction
+        aliases: [browser, web page, 浏览器]
+        include: [browser_*]
+      - id: database
+        description: Database inspection and queries
+        aliases: [database, sql, 数据库]
+        include: [db_*, sql_*]
+```
+
+See [configuration](./docs/configuration.md) for every option, the
+plugin-ecosystem onboarding checklist (`alwaysVisible` for high-frequency
+tools, `skillBindings` for Skill-shipping packages, explicit `groups` for
+unconventional names), and the migration notes for `dynamic` mode. The
+[progressive disclosure model](./docs/progressive-disclosure.md) maps Skills,
+exact tool definitions, execution, and provider capability gaps.
+
+## Execution and security semantics
+
+Stable mode filters the authoritative prompt assembly instead of changing the
+registry view. A direct call to a deferred name is then denied by a monotonic
+tool guard. `tool_dispatch` creates a nested execution with the original agent,
+signal, root call identity, arguments, and real tool name, so normal DSH policy
+continues to apply to that real tool.
+
+The guard is a routing invariant, not a replacement for approval or sandbox
+policy. Security-sensitive deployments should keep their existing controls
+enabled.
+
+## Trade-offs
+
+- Deferred tools lose provider-native argument grammar at the outer request.
+  Their original schema is validated at dispatch time by DSH.
+- A task may need one discovery call before execution.
+- Family siblings become dispatchable before their schemas were shown; the
+  pipeline still validates every call, but complex or side-effectful siblings
+  are best schema-loaded first with one exact-name search.
+- Search is deterministic lexical ranking, not an embedding service.
+- Search results add only matched definitions to conversation history, but those
+  definitions remain there until normal compaction.
+- A registry or composition change can legitimately alter the next prompt.
+  Discovery alone does not.
+
+## Development
+
+```sh
+pnpm install
+pnpm run check
+```
+
+The test suite includes a real AgentLoop request test that captures the first
+wire-ready tool array and verifies that discovery leaves both tools and system
+text unchanged.
+
+The implementation follows the public references for
+[architecture](https://deepseek-harness.github.io/deepseek-harness/reference/),
+[system prompt assembly](https://deepseek-harness.github.io/deepseek-harness/reference/subsystems/system-prompt),
+[tool execution](https://deepseek-harness.github.io/deepseek-harness/reference/subsystems/tools),
+[skills](https://deepseek-harness.github.io/deepseek-harness/reference/subsystems/skills),
+and [plugin packaging](https://deepseek-harness.github.io/deepseek-harness/develop/basic/publish).
+
+## License
+
+[MIT](./LICENSE). The upstream origin and retained attribution are recorded in
+[THIRD_PARTY_NOTICES.md](./THIRD_PARTY_NOTICES.md).

package/README.zh-CN.md

@@ -0,0 +1,216 @@
+# Tokens 渐进式工具
+
+为 TokensCowork 提供缓存稳定的渐进式工具发现。默认模式从真实首个请求
+开始只发送固定的小工具面，完整目录保留在进程内，搜索到的工具仍通过 DSH
+原有执行管线完成调用。
+
+[English](./README.md)
+
+## 解决的问题
+
+每个可见工具的名称、描述和参数 schema 都会重复占用请求 token。如果后续
+再动态改变工具列表，请求前缀也会变化，导致上下文缓存无法继续复用。
+
+默认的 `stable-proxy` 模式同时保证：
+
+- 第一次请求就是精简工具面；
+- 搜索前后顶层工具定义和系统文本保持逐字节稳定。
+
+```text
+完整工具注册表（仅进程内）
+        │
+        ├── 可搜索的精确工具定义
+        │
+        └── 固定请求工具面
+              ├── tool_search
+              ├── tool_dispatch
+              └── 少量高频直连工具
+                       │
+tool_search 结果 ─────┴──► 把命中的精确定义追加到对话历史
+                                  │
+                                  └── tool_dispatch ──► DSH 原有执行管线
+```
+
+搜索只追加对话历史，不改变顶层 `tools` 数组。真实工具原有的审批、guard、
+参数校验、超时、结果策略、延迟上下文和取消信号仍然生效。
+
+## 主要能力
+
+- 真实 AgentLoop 第一次请求即发送最小工具定义。
+- 搜索前后原生工具数组和 Code Mode SDK 保持稳定。
+- 返回精确工具名称、完整描述和参数 schema，不再激活整个工具族。
+- 工具族级发现：每条命中同时列出所属工具族的全部成员名，一次搜索即可
+  铺开一个插件的完整可分发工具面。
+- `status` 动作可浏览完整目录；可选 `statusGrantsDiscovery` 供受信任部署
+  一次性解锁全部名字。
+- 对话体量有界增长：搜索结果只记录本次新增的发现名单，恢复所需的累积
+  状态走呈现元数据，不占对话 token。
+- 确定性的 BM25 风格词法排序，覆盖工具名、描述、嵌套参数说明、枚举、
+  工具族元数据及多语言别名。
+- `tool_dispatch` 使用原始工具定义进行运行时参数校验和执行。
+- 单调 guard 阻止隐藏工具被直接调用，只允许分发器拥有的嵌套调用树进入。
+- 同时支持继承工具和 Agent 自有工具的渐进式隐藏。
+- 从顶层结果和 Code Mode 日志恢复已发现工具。
+- 可选 Skill 到工具族的发现联动。
+- 保留 `dynamic` 兼容模式，供必须动态暴露原生 schema 的场景使用。
+- Cordis effect 完整可逆，支持卸载和配置重载。
+
+## 安装
+
+```sh
+dsh plugin --profile web add @tokensapi/dsh-progressive-tools
+```
+
+如果 pnpm 要求授权源码构建，把错误信息中给出的精确包名加入对应 profile 的
+`pnpm-workspace.yaml`：
+
+```yaml
+allowBuilds:
+  '@tokensapi/dsh-progressive-tools': true
+```
+
+安装后检查组合结果：
+
+```sh
+dsh --profile web --dump-config
+```
+
+输出中应包含本 bundle 提供的 `tokens-progressive-tools` 配置行。
+
+## 使用
+
+默认直连工具面包括：
+
+- `tool_search`；
+- `tool_dispatch`；
+- 已注册的 `read`、`write`、`edit`、`glob`、`grep`、`bash`、`skill`、
+  `ask_user_question`、`todo_write`、`dsh_im_return_file`、`report`、
+  `submit_*` 和 `structured_output*`；
+- 当前工具呈现模式所需的 Harness 保留传输工具。
+
+正常对话不需要用户强制说明先调用 `tool_search`。插件会提供一段固定系统
+说明，要求在判断能力不可用前先搜索。
+
+搜索工具定义：
+
+```json
+{
+  "query": "浏览器页面操作",
+  "max_results": 3
+}
+```
+
+按搜索返回的精确 schema 分发：
+
+```json
+{
+  "name": "browser_open",
+  "arguments": {
+    "url": "https://example.com"
+  }
+}
+```
+
+每条命中还会列出所属工具族的全部成员名，整个工具族在同一次搜索后即可
+分发——没进入 Top-N 的兄弟工具可以直接按名字分发，或用一次精确名搜索
+先取回它的 schema。
+
+`tool_search` 也支持 `{"action":"status"}`，会列出全部延迟工具族及其成员
+工具名，并附带目录规模和 token 估算。status 默认只用于浏览：分发未见过
+的名字仍需一次精确名搜索，拒绝信息会明确指路。需要即时放行的部署可以
+开启 `statusGrantsDiscovery: true`。搜索结果不会把命中工具加入下一次
+请求的顶层工具数组。
+
+## 配置
+
+默认配置：
+
+```yaml
+- id: tokens-progressive-tools
+  config:
+    mode: stable-proxy
+    toolName: tool_search
+    dispatchToolName: tool_dispatch
+    maxResults: 5
+    requireDiscovery: true
+    statusGrantsDiscovery: false
+    deferToolGuidance: true
+    alwaysVisible:
+      - read
+      - write
+      - edit
+      - glob
+      - grep
+      - bash
+      - skill
+      - ask_user_question
+      - todo_write
+      - dsh_im_return_file
+      - report
+      - submit_*
+      - structured_output*
+```
+
+工具族只参与搜索排序，不会改变稳定请求工具面：
+
+```yaml
+- id: tokens-progressive-tools
+  config:
+    groups:
+      - id: browser
+        description: 浏览器导航与页面交互
+        aliases: [browser, web page, 浏览器]
+        include: [browser_*]
+      - id: database
+        description: 数据库检查与查询
+        aliases: [database, sql, 数据库]
+        include: [db_*, sql_*]
+```
+
+完整字段、既有插件生态的接入清单（高频工具配 `alwaysVisible`、带 Skill
+的插件配 `skillBindings`、命名不规范的插件写显式 `groups` 规则）以及
+`dynamic` 迁移说明见[配置参考](./docs/configuration.md)。
+[渐进式披露模型](./docs/progressive-disclosure.md)进一步说明 Skills、工具定义、
+执行层和供应方能力边界之间的关系。
+
+## 执行与安全语义
+
+稳定模式在官方 `system-prompt/assemble` 边界过滤最终请求，不改变注册表本身。
+如果直接调用被延迟的工具名，单调工具 guard 会拒绝它。`tool_dispatch` 使用
+原 Agent、取消信号、根调用标识、真实工具名和参数创建嵌套执行，因此真实
+工具仍会经过 DSH 的完整策略链。
+
+该 guard 只维护调用路由，不替代 approval、sandbox 或其他安全策略。
+
+## 取舍
+
+- 延迟工具不会出现在顶层请求的原生参数 grammar 中；DSH 会在分发时使用原始
+  schema 校验。
+- 一项任务可能先增加一次搜索调用。
+- 同族兄弟工具在 schema 展示之前即可分发；执行管线仍会校验每次调用，但
+  参数复杂或有副作用的兄弟工具建议先用一次精确名搜索取回 schema。
+- 搜索是确定性词法排序，不依赖向量服务。
+- 只有命中的定义进入对话，但会一直保留到常规 compaction。
+- 工具注册或插件组合发生真实变化时，下一次系统前缀仍可能变化；普通搜索
+  不会引起变化。
+
+## 开发
+
+```sh
+pnpm install
+pnpm run check
+```
+
+测试包含真实 AgentLoop 请求捕获，验证首个请求已经精简，并验证搜索后
+`tools` 数组和系统文本完全不变。
+
+实现依据官方的[架构参考](https://deepseek-harness.github.io/deepseek-harness/reference/)、
+[系统提示子系统](https://deepseek-harness.github.io/deepseek-harness/reference/subsystems/system-prompt)、
+[工具子系统](https://deepseek-harness.github.io/deepseek-harness/reference/subsystems/tools)、
+[Skills 子系统](https://deepseek-harness.github.io/deepseek-harness/reference/subsystems/skills)
+和[插件发布规范](https://deepseek-harness.github.io/deepseek-harness/develop/basic/publish)。
+
+## 许可证
+
+[MIT](./LICENSE)。上游来源和保留的版权归属记录在
+[THIRD_PARTY_NOTICES.md](./THIRD_PARTY_NOTICES.md)。

package/SECURITY.md

@@ -0,0 +1,22 @@
+# Security policy
+
+## Supported versions
+
+Security fixes are provided for the latest released minor version.
+
+## Reporting a vulnerability
+
+Use GitHub's private vulnerability reporting for this repository. Do not open a
+public issue containing exploit details, credentials, or sensitive logs.
+
+Include the affected version, deployment shape, reproduction steps, impact, and
+any suggested mitigation. Acknowledgement and next-step timing will be provided
+after the report is reproduced and scoped.
+
+## Security model
+
+This plugin controls tool presentation and routing through the Harness
+composition layer. Its monotonic guard prevents deferred names from bypassing
+the dispatcher, but it is not an authorization boundary for the underlying
+capability. Deployments must retain appropriate approval, sandbox, credential,
+network, and policy controls.

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,8 @@
+# Third-party notices
+
+This package is derived from `everclear077/dsh-progressive-tools` at commit
+`8d516b9933d5b7812ab39c929fd9ee5df66d5221`.
+
+The original work is Copyright (c) 2026 everclear077 and is distributed under
+the MIT License reproduced in `LICENSE`. TokensAPI modifications retain that
+license and attribution.

package/cordis.patch.yml

@@ -0,0 +1,3 @@
+- insert:
+    - id: tokens-progressive-tools
+      name: '@tokensapi/dsh-progressive-tools'