coding-tool-x 3.9.0 → 3.9.2

package/src/platforms/drivers/dsh/api-operations.js

@@ -3,7 +3,7 @@
 const { createDriver: createNativeConfigDriver } = require('./native-config');
 const { createDriver: createProjectsDriver } = require('./projects');
 const { createDriver: createSessionsDriver } = require('./sessions');
-const { listProfiles, listProfilePlugins, listProfileCapabilities, listProfileMcp, listProfilePrompts, listPlugins, upsertProfilePatchRow, deleteProfilePatchRow } = require('./common');
+const { listProfiles, listManageableProfilePlugins, listProfileCapabilities, listProfileMcp, listProfilePrompts, listProfileAgentPresets, restoreAgentPresetRedactions, listPlugins, upsertProfilePatchRow, deleteProfilePatchRow } = require('./common');
 const { listSkills, getSkill, createSkill, updateSkill, deleteSkill } = require('./resources');
 const { installPlugin, uninstallPlugin, updatePlugin } = require('./plugin-manager');
 const { createDriver: createChannelsDriver } = require('./channels');
@@ -53,6 +53,25 @@ function promptConfigFromRequest(request = {}) {
   return config;
 }
 
+function agentPresetConfigFromRequest(request = {}) {
+  const body = request.body || {};
+  const source = body.config && typeof body.config === 'object' && !Array.isArray(body.config) ? body.config : body;
+  const id = String(source.id || '').trim();
+  if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(id)) throw new Error('Agent preset id must use lowercase letters, numbers, and hyphens');
+  if (!Array.isArray(source.plugins) || source.plugins.some(plugin => !plugin || typeof plugin !== 'object' || Array.isArray(plugin))) {
+    throw new Error('Agent preset plugins must be an array of plugin declarations');
+  }
+  const config = {
+    id,
+    plugins: source.plugins
+  };
+  for (const key of ['name', 'description']) {
+    if (typeof source[key] === 'string' && source[key].trim()) config[key] = source[key].trim();
+  }
+  if (Number.isFinite(Number(source.order))) config.order = Number(source.order);
+  return config;
+}
+
 function patchResult(context, request, profileName, operation, patch) {
   return {
     profile: profileName,
@@ -211,7 +230,7 @@ function createDriver(context = {}) {
   driver.listPlugins = request => resultFor(request, 'ok', listPlugins(context));
   driver.listProfilePlugins = async (request = {}) => {
     const profile = request.params?.profileName;
-    const result = listProfilePlugins(context, profile);
+    const result = listManageableProfilePlugins(context, profile);
     return result ? resultFor(request, 'ok', result) : resultFor(request, 'unsupported');
   };
   driver.listProfileCapabilities = async (request = {}) => {
@@ -229,6 +248,45 @@ function createDriver(context = {}) {
     const result = listProfilePrompts(context, profile);
     return result ? resultFor(request, 'ok', result) : resultFor(request, 'unsupported');
   };
+  driver.listProfileAgentPresets = async (request = {}) => {
+    const result = listProfileAgentPresets(context, request.params?.profileName);
+    return result ? resultFor(request, 'ok', result) : resultFor(request, 'unsupported');
+  };
+  driver.upsertAgentPreset = async (request = {}) => {
+    const profileName = request.params?.profileName;
+    const requestedConfig = agentPresetConfigFromRequest(request);
+    const config = restoreAgentPresetRedactions(context, profileName, `preset-${requestedConfig.id}`, requestedConfig);
+    const id = `preset-${config.id}`;
+    const patch = requirePatchResult(upsertProfilePatchRow(context, profileName, {
+      id,
+      name: '@deepseek-ai/dsh-agent-preset',
+      config
+    }, profilePatchOptions(request)), profileName);
+    return resultFor(request, 'ok', {
+      profile: profileName,
+      operation: 'upsertAgentPreset',
+      patch,
+      ...listProfileAgentPresets(context, profileName)
+    });
+  };
+  driver.deleteAgentPreset = async (request = {}) => {
+    const profileName = request.params?.profileName;
+    const id = requiredId(request.params?.presetId, 'Agent preset id');
+    const current = listProfileAgentPresets(context, profileName);
+    if (!current) return resultFor(request, 'unsupported');
+    const preset = current.presets.find(item => item.id === id);
+    if (!preset) return resultFor(request, 'ok', current);
+    if (preset.builtIn) {
+      return resultFor(request, 'failed', undefined, 'Built-in Agent presets can be customized but cannot be deleted');
+    }
+    const patch = requirePatchResult(deleteProfilePatchRow(context, profileName, preset.patchId, profilePatchOptions(request)), profileName);
+    return resultFor(request, 'ok', {
+      profile: profileName,
+      operation: 'deleteAgentPreset',
+      patch,
+      ...listProfileAgentPresets(context, profileName)
+    });
+  };
   driver.installPlugin = async (request = {}) => {
     const result = await installPlugin(context, request);
     return resultFor(request, 'ok', result);

package/src/platforms/drivers/dsh/common.js

@@ -34,6 +34,45 @@ function clone(value) {
   return JSON.parse(JSON.stringify(value));
 }
 
+function resolveDshInstallRoot(context = {}) {
+  const command = String(
+    context.dshCommand
+      || context.dependencies?.dshCommand
+      || process.env.DSH_COMMAND
+      || 'dsh'
+  ).trim();
+  if (!command) return null;
+  const commandHasPath = path.isAbsolute(command) || command.includes(path.sep);
+  if (!commandHasPath && /\s/.test(command)) return null;
+
+  const candidates = commandHasPath
+    ? [path.resolve(command)]
+    : String(context.dshEnv?.PATH || process.env.PATH || '')
+      .split(path.delimiter)
+      .filter(Boolean)
+      .map(directory => path.join(directory, command));
+
+  for (const candidate of candidates) {
+    let executablePath;
+    try {
+      fs.accessSync(candidate, fs.constants.X_OK);
+      executablePath = fs.realpathSync(candidate);
+    } catch (_) {
+      continue;
+    }
+
+    let directory = path.dirname(executablePath);
+    for (let depth = 0; depth < 8; depth += 1) {
+      const packageJson = readJsonFile(path.join(directory, 'package.json'), null);
+      if (packageJson?.name === '@deepseek-ai/dsh') return directory;
+      const parent = path.dirname(directory);
+      if (parent === directory) break;
+      directory = parent;
+    }
+  }
+  return null;
+}
+
 function resolvePaths(context = {}) {
   const paths = context.paths || context.pathContext?.native || {};
   const home = path.resolve(paths.dir || paths.home || context.pathContext?.home || process.env.DSH_HOME || path.join(require('os').homedir(), '.dsh'));
@@ -46,7 +85,7 @@ function resolvePaths(context = {}) {
     patch: paths.patch || path.join(home, 'cordis.patch.yml')
   };
   const installAnchor = paths.installAnchor || context.installAnchor || process.env.DSH_INSTALL_ANCHOR;
-  const installRoot = paths.installRoot || context.installRoot || process.env.DSH_INSTALL_ROOT;
+  const installRoot = paths.installRoot || context.installRoot || process.env.DSH_INSTALL_ROOT || resolveDshInstallRoot(context);
   if (installAnchor) resolved.installAnchor = installAnchor;
   if (installRoot) resolved.installRoot = installRoot;
   return resolved;
@@ -246,13 +285,19 @@ function listProfilePlugins(context = {}, profileName) {
   const bundleNames = Array.isArray(profileConfig.bundles) ? profileConfig.bundles : [];
   const dependencyNames = Object.keys(isObject(manifest.dependencies) ? manifest.dependencies : {});
   const names = [...new Set([...bundleNames, ...dependencyNames])];
-  const plugins = names.map(name => {
+  const describePlugin = name => {
     const packageDir = resolvePackageDir(profile.profileDir, name, paths);
     const packageJsonPath = packageDir ? path.join(packageDir, 'package.json') : null;
     const packageJson = packageJsonPath ? readJsonFile(packageJsonPath, {}) : {};
     const bundle = isObject(packageJson.dsh?.bundle) ? packageJson.dsh.bundle : null;
-    const patchPath = bundle?.patch && packageDir ? path.resolve(packageDir, bundle.patch) : null;
-    const patchExists = Boolean(patchPath && fs.existsSync(patchPath));
+    const declaredPatches = Array.isArray(bundle?.patch)
+      ? bundle.patch
+      : bundle?.patch ? [bundle.patch] : [];
+    const patchPaths = packageDir
+      ? declaredPatches.filter(item => typeof item === 'string' && item.trim()).map(item => path.resolve(packageDir, item))
+      : [];
+    const patchPath = patchPaths[0] || null;
+    const patchExists = patchPaths.length > 0 && patchPaths.every(filePath => fs.existsSync(filePath));
     return {
       name,
       requestedVersion: manifest.dependencies?.[name] || manifest.devDependencies?.[name] || null,
@@ -261,11 +306,31 @@ function listProfilePlugins(context = {}, profileName) {
       bundle: Boolean(bundle),
       patch: bundle?.patch || null,
       patchPath,
+      patchPaths,
       patchExists,
+      description: packageJson.description || '',
       inBundleList: bundleNames.includes(name),
+      builtIn: isBuiltInProfilePackage(packageDir, name, profile.profileDir, paths),
       management: 'ctx+dsh-plugin'
     };
-  });
+  };
+  const declaredPlugins = names.map(describePlugin);
+  const builtinNames = bundledPluginNames(declaredPlugins);
+  const plugins = [...declaredPlugins];
+  for (const name of builtinNames) {
+    if (names.includes(name)) continue;
+    const plugin = describePlugin(name);
+    plugin.installed = true;
+    if (!plugin.builtIn) {
+      const packageDir = resolvePackageDir(profile.profileDir, name, paths);
+      const profileModules = path.join(profile.profileDir, 'node_modules');
+      const sharedProfileModules = path.join(paths.profiles, 'node_modules');
+      if (!packageDir || (!isPathInside(profileModules, packageDir) && !isPathInside(sharedProfileModules, packageDir))) {
+        plugin.builtIn = true;
+      }
+    }
+    plugins.push(plugin);
+  }
   return {
     profile: profile.name,
     profilePath: profile.profileDir,
@@ -276,14 +341,57 @@ function listProfilePlugins(context = {}, profileName) {
   };
 }
 
+function isPathInside(parentPath, targetPath) {
+  if (!parentPath || !targetPath) return false;
+  const parent = path.resolve(parentPath);
+  const target = path.resolve(targetPath);
+  return target === parent || target.startsWith(`${parent}${path.sep}`);
+}
+
+function isBuiltInProfilePackage(packageDir, packageName, profileDir, paths) {
+  const profileModules = path.join(profileDir, 'node_modules');
+  const sharedProfileModules = path.join(paths.profiles, 'node_modules');
+  if (packageDir && (isPathInside(profileModules, packageDir) || isPathInside(sharedProfileModules, packageDir))) return false;
+  if (/^@deepseek-ai\/dsh-/.test(packageName)) return true;
+  if (!packageDir) return false;
+  return true;
+}
+
+function bundledPluginNames(plugins) {
+  const names = new Set();
+  for (const plugin of plugins) {
+    if (!plugin.inBundleList || !plugin.builtIn) continue;
+    for (const filePath of plugin.patchPaths || []) {
+      if (!fs.existsSync(filePath)) continue;
+      const rows = collectPatchRows(readYamlFile(filePath, []), [], filePath);
+      for (const row of rows) {
+        const match = typeof row.name === 'string'
+          ? row.name.match(/^(@deepseek-ai\/[a-z0-9._-]+)(?:\/[a-z0-9._-]+)*$/i)
+          : null;
+        if (match) names.add(match[1]);
+      }
+    }
+  }
+  return names;
+}
+
+function listManageableProfilePlugins(context = {}, profileName) {
+  const result = listProfilePlugins(context, profileName);
+  if (!result) return null;
+  return {
+    ...result,
+    plugins: result.plugins.filter(plugin => !plugin.builtIn)
+  };
+}
+
 function profilePatchFiles(context = {}, profileName) {
   const paths = resolvePaths(context);
   const pluginInfo = listProfilePlugins(context, profileName);
   if (!pluginInfo) return null;
   const profile = readProfileManifest(paths, profileName);
   const bundleFiles = pluginInfo.plugins
-    .filter(plugin => plugin.inBundleList && plugin.patchPath)
-    .map(plugin => plugin.patchPath);
+    .filter(plugin => plugin.inBundleList)
+    .flatMap(plugin => plugin.patchPaths || (plugin.patchPath ? [plugin.patchPath] : []));
   const files = [...new Set([
     ...bundleFiles,
     path.join(profile.profileDir, 'cordis.patch.yml'),
@@ -399,9 +507,11 @@ function upsertProfilePatchRow(context = {}, profileName, entry, options = {}) {
   const id = patchEntryId(entry);
   if (!id) throw new Error('DSH patch entry id is required');
   return updateProfilePatch(context, profileName, (document, meta) => {
-    const hasComposedRow = meta.composedRows.some(row => patchEntryId(row.entry) === id);
+    const hasComposedRowOutsideProfile = meta.composedRows.some(row => (
+      patchEntryId(row.entry) === id && path.resolve(row.source) !== path.resolve(meta.patchPath)
+    ));
     const withoutOwn = removeManagedRows(document, row => patchEntryId(row) === id);
-    if (hasComposedRow) withoutOwn.push(entry);
+    if (hasComposedRowOutsideProfile) withoutOwn.push(entry);
     else withoutOwn.push({ insert: [entry] });
     return withoutOwn;
   }, options);
@@ -428,6 +538,7 @@ function collectPatchRows(value, rows = [], source = null, options = {}) {
       id: entry.id || null,
       name: entry.name || null,
       disabled: entry.disabled === true,
+      hasDisabled: Object.prototype.hasOwnProperty.call(entry, 'disabled'),
       hasConfig: Object.prototype.hasOwnProperty.call(entry, 'config'),
       source
     };
@@ -462,7 +573,20 @@ function effectivePatchRows(info) {
       if (row.operation === 'delete') {
         byId.delete(row.id);
       } else {
-        byId.set(row.id, row);
+        const current = byId.get(row.id);
+        if (row.operation === 'insert' || !current) {
+          byId.set(row.id, row);
+        } else {
+          byId.set(row.id, {
+            ...current,
+            ...row,
+            name: row.name || current.name,
+            disabled: row.hasDisabled ? row.disabled : current.disabled,
+            hasDisabled: row.hasDisabled || current.hasDisabled,
+            config: row.hasConfig ? row.config : current.config,
+            hasConfig: row.hasConfig || current.hasConfig
+          });
+        }
       }
     }
   }
@@ -545,10 +669,94 @@ function listPlugins(context = {}) {
   return {
     profiles: listProfiles(context).map(profile => listProfilePlugins(context, profile.name)).filter(Boolean),
     management: 'ctx+dsh-plugin',
-    note: 'ctx 通过 dsh plugin 管理插件依赖；插件运行生命周期和 profile 重启仍由 dsh 负责。'
+    note: '内置插件只读展示；仅 Profile 安装的外置插件由此处管理。'
   };
 }
 
+function listProfileAgentPresets(context = {}, profileName) {
+  const info = readProfilePatchContributions(context, profileName);
+  if (!info) return null;
+  const patchPath = path.join(info.profile.profileDir, 'cordis.patch.yml');
+  const bundledPatchPaths = new Set(info.pluginInfo.plugins
+    .filter(plugin => plugin.inBundleList && plugin.builtIn && plugin.patchPath)
+    .flatMap(plugin => plugin.patchPaths || [plugin.patchPath])
+    .map(filePath => path.resolve(filePath)));
+  const bundledPresetIds = new Set(info.contributions
+    .filter(contribution => bundledPatchPaths.has(path.resolve(contribution.path)))
+    .flatMap(contribution => contribution.rows)
+    .filter(row => row.name === '@deepseek-ai/dsh-agent-preset')
+    .map(row => row.id));
+  const presets = effectivePatchRows(info)
+    .filter(row => row.name === '@deepseek-ai/dsh-agent-preset' && isObject(row.config))
+    .map(row => ({
+      id: String(row.config.id || String(row.id || '').replace(/^preset-/, '')),
+      patchId: row.id,
+      name: typeof row.config.name === 'string' ? row.config.name : '',
+      description: typeof row.config.description === 'string' ? row.config.description : '',
+      order: Number.isFinite(row.config.order) ? row.config.order : 0,
+      plugins: Array.isArray(row.config.plugins) ? redactPatchConfig(row.config.plugins) : [],
+      builtIn: bundledPresetIds.has(row.id),
+      source: row.source
+    }))
+    .filter(preset => /^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(preset.id));
+  return {
+    profile: info.pluginInfo.profile,
+    revision: fileRevision(patchPath),
+    presets,
+    management: 'ctx-profile-patch'
+  };
+}
+
+function effectiveRawPatchEntry(context = {}, profileName, entryId) {
+  const info = profilePatchFiles(context, profileName);
+  if (!info) return null;
+  const byId = new Map();
+  for (const filePath of info.files) {
+    if (!fs.existsSync(filePath)) continue;
+    for (const { operation, entry } of patchRowsFromDocument(readYamlFile(filePath, []))) {
+      const id = patchEntryId(entry);
+      if (!id) continue;
+      if (operation === 'delete') {
+        byId.delete(id);
+        continue;
+      }
+      const current = byId.get(id);
+      if (operation === 'insert' || !current) {
+        byId.set(id, { ...entry, source: filePath });
+      } else {
+        byId.set(id, { ...current, ...entry, id, source: filePath });
+      }
+    }
+  }
+  return byId.get(entryId) || null;
+}
+
+function restoreRedactedValues(value, original) {
+  if (value === '[REDACTED]' || value === '[EXPRESSION]') return clone(original);
+  if (Array.isArray(value)) {
+    const originalArray = Array.isArray(original) ? original : [];
+    return value.map((entry, index) => {
+      const entryId = isObject(entry) ? entry.id : null;
+      const originalEntry = entryId
+        ? originalArray.find(candidate => isObject(candidate) && candidate.id === entryId)
+        : originalArray[index];
+      return restoreRedactedValues(entry, originalEntry);
+    });
+  }
+  if (!isObject(value)) return value;
+  const originalObject = isObject(original) ? original : {};
+  return Object.fromEntries(Object.entries(value).map(([key, entry]) => [
+    key,
+    restoreRedactedValues(entry, originalObject[key])
+  ]));
+}
+
+function restoreAgentPresetRedactions(context = {}, profileName, presetId, config) {
+  const original = effectiveRawPatchEntry(context, profileName, presetId);
+  if (!original || !isObject(original.config)) return config;
+  return restoreRedactedValues(config, original.config);
+}
+
 module.exports = {
   clone,
   resolvePaths,
@@ -562,9 +770,12 @@ module.exports = {
   credentialMetadata,
   listProfiles,
   listProfilePlugins,
+  listManageableProfilePlugins,
   listProfileCapabilities,
   listProfileMcp,
   listProfilePrompts,
+  listProfileAgentPresets,
+  restoreAgentPresetRedactions,
   listPlugins,
   profilePatchFiles,
   readProfilePatchContributions,

package/src/platforms/drivers/dsh/native-config.js

@@ -2,7 +2,7 @@
 
 const fs = require('fs');
 const { writeYamlFile } = require('../../../utils/native-config-patcher');
-const { resolvePaths, readYamlFile, mergeSettings, fileRevision, credentialMetadata, redactSecrets, listProfiles, listProfilePlugins, listProfileMcp, listProfilePrompts, DSH_YAML_SOURCE_TAGS } = require('./common');
+const { resolvePaths, readYamlFile, mergeSettings, fileRevision, credentialMetadata, redactSecrets, listProfiles, listManageableProfilePlugins, listProfileMcp, listProfilePrompts, DSH_YAML_SOURCE_TAGS } = require('./common');
 const { resolveSkillRoots } = require('./resources');
 
 function createDriver(context = {}) {
@@ -62,7 +62,7 @@ function createDriver(context = {}) {
         cwd: request.query?.cwd
       });
       const profiles = listProfiles(context).map(profile => {
-        const plugins = listProfilePlugins(context, profile.name);
+        const plugins = listManageableProfilePlugins(context, profile.name);
         const mcp = listProfileMcp(context, profile.name);
         const prompts = listProfilePrompts(context, profile.name);
         return {

package/src/platforms/drivers/dsh/native-logs.js

@@ -37,6 +37,20 @@ function extractUsage(record = {}) {
   );
 }
 
+function hasCacheUsage(usage = {}) {
+  const aliases = [
+    'cached', 'cached_tokens', 'cachedTokens', 'cached_input_tokens', 'cachedInputTokens',
+    'cache_read_input_tokens', 'cacheReadInputTokens', 'cacheRead', 'cache_read', 'cachedContentTokenCount'
+  ];
+  const hasField = source => aliases.some(key => (
+    source && Object.prototype.hasOwnProperty.call(source, key) && source[key] !== undefined && source[key] !== null
+  ));
+  if (hasField(usage)) return true;
+
+  return [usage.input_tokens_details, usage.inputTokensDetails, usage.prompt_tokens_details, usage.promptTokensDetails, usage.usageMetadata]
+    .some(hasField) || Boolean(usage.cache && (usage.cache.read !== undefined || usage.cache.readTokens !== undefined));
+}
+
 function normalizeTimestamp(value) {
   if (typeof value === 'number' && Number.isFinite(value)) {
     if (value > 1e11) return value;
@@ -75,6 +89,7 @@ function normalizeDshEvent(record = {}, filePath = '', index = 0) {
     provider,
     model,
     tokens,
+    cacheUsageAvailable: hasCacheUsage(usage),
     cost,
     channelId: record.channelId || data.channelId || message.channelId || source.channelId,
     channel: record.channel || data.channel || message.channel || provider
@@ -113,4 +128,4 @@ function createDriver({ nativeRoot, pathContext, paths, fsImpl = fs } = {}) {
   };
 }
 
-module.exports = { createDriver, extractUsage, normalizeDshEvent };
+module.exports = { createDriver, extractUsage, hasCacheUsage, normalizeDshEvent };

package/src/platforms/drivers/dsh/plugin-manager.js

@@ -3,7 +3,7 @@
 const { execFile } = require('child_process');
 const path = require('path');
 const { promisify } = require('util');
-const { resolvePaths, listProfilePlugins, safeProfileName } = require('./common');
+const { resolvePaths, listProfilePlugins, listManageableProfilePlugins, safeProfileName } = require('./common');
 
 const execFileAsync = promisify(execFile);
 
@@ -25,6 +25,40 @@ function normalizeSpecs(value) {
   return specs;
 }
 
+function packageNameFromSpec(spec) {
+  const value = String(spec || '').trim();
+  if (!value || /^(?:https?:|git\+|github:|file:)/i.test(value)) return null;
+  const slash = value.lastIndexOf('/');
+  const versionSeparator = value.lastIndexOf('@');
+  if (versionSeparator > slash) return value.slice(0, versionSeparator);
+  return value;
+}
+
+function profilePluginInventory(context, profileName) {
+  const plugins = listProfilePlugins(context, profileName);
+  if (!plugins) {
+    const error = new Error(`DSH profile not found: ${profileName}`);
+    error.statusCode = 404;
+    throw error;
+  }
+  return plugins.plugins;
+}
+
+function requireExternalPluginSpecs(context, profileName, specs, { allowNew = false } = {}) {
+  const plugins = profilePluginInventory(context, profileName);
+  const byName = new Map(plugins.map(plugin => [plugin.name, plugin]));
+  const builtinNames = new Set(plugins.filter(plugin => plugin.builtIn).map(plugin => plugin.name));
+  for (const spec of specs) {
+    const name = packageNameFromSpec(spec);
+    if (name && builtinNames.has(name)) {
+      throw new Error(`DSH built-in plugin cannot be managed here: ${name}`);
+    }
+    if (!allowNew && (!name || !byName.has(name) || byName.get(name).builtIn)) {
+      throw new Error(`Only installed external DSH plugins can be managed here: ${spec}`);
+    }
+  }
+}
+
 function resolveWorkingDirectory(paths, value) {
   if (value === undefined || value === null || value === '') return paths.dir;
   const cwd = path.resolve(String(value));
@@ -85,13 +119,16 @@ async function runDshPlugin(context = {}, profileName, args, options = {}) {
     exitCode: 0,
     stdout: redactCommandOutput(result.stdout),
     stderr: redactCommandOutput(result.stderr),
-    plugins: listProfilePlugins(context, profile)
+    plugins: listManageableProfilePlugins(context, profile)
   };
 }
 
 async function installPlugin(context = {}, request = {}) {
   const body = request.body || {};
-  return runDshPlugin(context, request.params?.profileName, ['add', ...normalizeSpecs(body.specs || body.spec || body.package)], {
+  const profileName = request.params?.profileName;
+  const specs = normalizeSpecs(body.specs || body.spec || body.package);
+  requireExternalPluginSpecs(context, profileName, specs, { allowNew: true });
+  return runDshPlugin(context, profileName, ['add', ...specs], {
     cwd: body.cwd
   });
 }
@@ -99,14 +136,35 @@ async function installPlugin(context = {}, request = {}) {
 async function uninstallPlugin(context = {}, request = {}) {
   const body = request.body || {};
   const specs = normalizeSpecs(body.specs || body.spec || request.params?.pluginName);
-  return runDshPlugin(context, request.params?.profileName, ['remove', ...specs], { cwd: body.cwd });
+  const profileName = request.params?.profileName;
+  requireExternalPluginSpecs(context, profileName, specs);
+  return runDshPlugin(context, profileName, ['remove', ...specs], { cwd: body.cwd });
 }
 
 async function updatePlugin(context = {}, request = {}) {
   const body = request.body || {};
   const specs = body.specs || body.spec || body.package;
-  const args = ['update', ...(specs === undefined ? [] : normalizeSpecs(specs))];
-  return runDshPlugin(context, request.params?.profileName, args, { cwd: body.cwd });
+  const profileName = request.params?.profileName;
+  const inventory = profilePluginInventory(context, profileName);
+  let targets;
+  if (specs === undefined) {
+    targets = inventory.filter(plugin => !plugin.builtIn).map(plugin => plugin.name);
+  } else {
+    targets = normalizeSpecs(specs);
+    requireExternalPluginSpecs(context, profileName, targets);
+  }
+  if (!targets.length) {
+    const profile = safeProfileName(profileName);
+    return {
+      profile,
+      exitCode: 0,
+      stdout: '',
+      stderr: '',
+      skipped: 'No installed external DSH plugins to update',
+      plugins: listManageableProfilePlugins(context, profile)
+    };
+  }
+  return runDshPlugin(context, profileName, ['update', ...targets], { cwd: body.cwd });
 }
 
 module.exports = {

package/src/platforms/drivers/omp/channels-implementation.js

@@ -24,7 +24,7 @@ const {
   upsertSyncedChannels
 } = require('../../../server/services/channel-sync-utils');
 
-const OMP_THINKING_SUFFIX_RE = /:(minimal|low|medium|high|xhigh|off)$/;
+const OMP_THINKING_SUFFIX_RE = /:(minimal|low|medium|high|xhigh|max|off)$/i;
 
 let configuredState = {
   channels: PATHS.channels?.omp,

package/src/platforms/drivers/omp/gateway.js

@@ -9,6 +9,7 @@ const { allocateChannel, releaseChannel } = require('../../../server/services/ch
 const { recordSuccess, recordFailure } = require('../../../server/services/channel-health');
 const { attachServerShutdownHandling, expediteServerShutdown } = require('../../../server/services/server-shutdown');
 const { resolveOmpGatewayRoute } = require('./gateway-routing');
+const { persistProxyRequestSnapshot } = require('../../../server/services/request-logger');
 
 const RETRYABLE_STATUS = new Set([401, 403, 429, 502, 503, 504]);
 const MAX_REQUEST_BYTES = 100 * 1024 * 1024;
@@ -157,7 +158,7 @@ function extractModelId(body, contentType = '') {
 }
 
 function normalizeModelId(value) {
-  return String(value || '').trim().replace(/:(minimal|low|medium|high|xhigh|off)$/, '');
+  return String(value || '').trim().replace(/:(minimal|low|medium|high|xhigh|max|off)$/i, '');
 }
 
 function channelSupportsModel(channel, modelId) {
@@ -183,6 +184,17 @@ function writeJson(res, statusCode, payload) {
   res.end(body);
 }
 
+function redactSensitiveQuery(path) {
+  const url = new URL(String(path || '/'), 'http://127.0.0.1');
+  for (const key of [...url.searchParams.keys()]) {
+    const normalizedKey = key.toLowerCase().replace(/_/g, '-');
+    if (/(^|[-])(api-?key|key|auth|authorization|oauth|access-token|token|secret|credential|password|signature|jwt|cookie|session)([-]|$)/i.test(normalizedKey)) {
+      url.searchParams.delete(key);
+    }
+  }
+  return `${url.pathname}${url.search}`;
+}
+
 function constantTimeEqual(left, right) {
   const leftBuffer = Buffer.from(String(left || ''));
   const rightBuffer = Buffer.from(String(right || ''));
@@ -465,6 +477,19 @@ function createOmpGateway(options = {}) {
     }
     route.upstreamPath = `${route.upstreamPath}${parsed.search}`;
 
+    persistProxyRequestSnapshot('omp', {
+      timestamp: Date.now(),
+      source: 'omp',
+      request: {
+        method: req.method,
+        headers: req.headers
+      },
+      route: {
+        providerApi: route.providerApi,
+        path: redactSensitiveQuery(route.upstreamPath)
+      }
+    });
+
     inflightRequests++;
     const abortController = new AbortController();
     const abortDownstream = () => abortController.abort();
@@ -685,5 +710,6 @@ function createOmpGateway(options = {}) {
 }
 
 module.exports = {
-  createOmpGateway
+  createOmpGateway,
+  redactSensitiveQuery
 };