dsh-better-copilot 0.1.0 → 0.1.1

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 0.1.1 — DSH 0.2.2-rc.1 compatibility
+
+- Retarget the manifest, peer ranges and development pins to DSH `0.2.2-rc.1`
+  with `cordis ~4.1.0` and `schemastery ~3.19.0`.
+- Move the Gemini tool-declaration guard from the `system-prompt/assemble`
+  waterfall to the Copilot wire. `0.2.2-rc.1` assembles tool declarations
+  outside the presentation waterfall, so the guard now rewrites the serialized
+  request body inside the same refcounted interceptor that carries the wire
+  identity. It still adds only a missing root `properties` bucket, still matches
+  configured providers and model families, keeps `SKIPPED_*` reason codes and
+  `logFixes` summaries, and now runs even when `DSH_COPILOT_WIRE_IDENTITY=off`.
+- Export `installCopilotRequestTransform`, `guardCopilotRequestBody`,
+  `GuardedBody` and `MAX_GUARDED_BODY_BYTES`; `./guard` keeps exporting
+  `matchesRoute`, `normalizeToolSchemas`, `classifyParameters`,
+  `TOOL_SCHEMA_SKIPPED` and their types.
+- Follow the adapter's `1_000_000`/`128_000` profile defaults, its
+  `llm-pi-ai/request-headers` waterfall and the branded reasoning-effort id.
+
 ## 0.1.0 — consolidated Copilot plugin
 
 First release of `dsh-better-copilot`, merging three independently installable

package/README.md

@@ -19,7 +19,7 @@ packages. Their behaviour is consolidated here; see the migration notes below.
 
 ## Compatibility
 
-- DSH and DSH peer packages: `0.2.1-rc.5`.
+- DSH and DSH peer packages: `0.2.2-rc.1`.
 - `@earendil-works/pi-ai`: `^1.1.0` (host-aligned peer range; tested at `1.1.0` and `1.3.0`).
 - Node.js: `>=22.19.0`.
 
@@ -92,11 +92,14 @@ existing Web search settings card is DeepSeek-specific and is not a chooser.
 
 ## Guard
 
-The guard is an additive `system-prompt/assemble` listener. For a route whose
-provider is listed and whose model id contains one of the configured families it
-adds an empty root `properties` bucket to object tool schemas that lack one, and
-leaves every other schema byte-identical. It never replaces an adapter or
-another plugin's settings.
+The guard is a Copilot wire-body transform. `0.2.2-rc.1` assembles tool
+declarations outside the presentation waterfall and treats them as
+provider-owned, so the last supported seam is the serialized request the adapter
+dispatches. Inside the same refcounted, trusted-path-checked interceptor that
+carries the wire identity, it adds an empty root `properties` bucket to object
+tool schemas that lack one for a configured Copilot route and model family, and
+leaves every other byte of the request untouched. It never replaces an adapter or
+another plugin's settings, and a guard failure dispatches the original body.
 
 ## Migration from the three predecessor packages
 

package/dist/guard.d.ts

@@ -1,3 +1,38 @@
-export { matchesRoute, normalizeToolSchemas, TOOL_SCHEMA_SKIPPED } from './schema.js';
-export type { NormalizeResult } from './schema.js';
+import type { GuardSettings, SkippedTool } from './guard-types.js';
+export { classifyParameters, matchesRoute, normalizeToolSchemas, TOOL_SCHEMA_SKIPPED } from './schema.js';
+export type { NormalizeResult, ParameterDecision } from './schema.js';
 export type { GuardSettings, PromptAssembly, SkippedTool, ToolSchema } from './guard-types.js';
+/**
+ * The largest serialized Copilot request this guard will parse. A request that
+ * carries tool declarations is far smaller; anything past this bound is left
+ * byte-identical rather than copied and re-parsed.
+ */
+export declare const MAX_GUARDED_BODY_BYTES: number;
+/** One rewritten request body plus what the guard changed and refused to change. */
+export interface GuardedBody {
+    /** The re-serialized body, or `undefined` when the request stays byte-identical. */
+    readonly body: string | undefined;
+    /** True only when at least one declaration gained a properties bucket. */
+    readonly changed: boolean;
+    /** Tool names whose declaration gained an empty properties bucket. */
+    readonly fixed: string[];
+    /** Tools left byte-identical, with a controlled reason. */
+    readonly skipped: readonly SkippedTool[];
+}
+/**
+ * Normalize tool declarations on one serialized Copilot inference request.
+ *
+ * The Gemini route measures this at the HTTP boundary: it rejects a request whose
+ * tool declaration carries an object parameter schema with no properties bucket.
+ * The presentation assembly no longer exposes declarations to listeners, so the
+ * guard rewrites the exact serialized body instead — lexically the last point
+ * before dispatch, and the same place the failure is measured.
+ *
+ * Nothing is invented: a body that is not JSON, carries no tool array, exceeds
+ * the bound, or targets another route or model family is returned untouched.
+ *
+ * @param body - the serialized request body as the adapter built it.
+ * @param settings - one configuration snapshot for this request.
+ * @returns the rewrite result; `body` stays `undefined` unless something changed.
+ */
+export declare function guardCopilotRequestBody(body: string, settings: GuardSettings): GuardedBody;

package/dist/guard.js

@@ -1 +1,82 @@
-export { matchesRoute, normalizeToolSchemas, TOOL_SCHEMA_SKIPPED } from './schema.js';
+import { classifyParameters, matchesRoute } from './schema.js';
+// The guard subpath keeps publishing its classification primitives: they are the
+// same rules the wire rewrite applies, and consumers may classify a declaration
+// without installing the transform.
+export { classifyParameters, matchesRoute, normalizeToolSchemas, TOOL_SCHEMA_SKIPPED } from './schema.js';
+/**
+ * The largest serialized Copilot request this guard will parse. A request that
+ * carries tool declarations is far smaller; anything past this bound is left
+ * byte-identical rather than copied and re-parsed.
+ */
+export const MAX_GUARDED_BODY_BYTES = 8 * 1024 * 1024;
+/** The route this plugin owns; the wire guard runs only on its endpoints. */
+const COPILOT_ROUTE = 'github-copilot';
+const isRecord = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
+/**
+ * Locate one tool declaration's parameter schema on either Copilot inference surface.
+ *
+ * Chat completions carries `{ type: 'function', function: { name, parameters } }`
+ * while Responses carries `{ type: 'function', name, parameters }`. Both are the
+ * OpenAI-compatible shape the adapter serializes; anything else is not ours.
+ */
+function declarationOf(tool) {
+    if (!isRecord(tool) || tool.type !== 'function')
+        return undefined;
+    const holder = isRecord(tool.function) ? tool.function : tool;
+    return typeof holder.name === 'string' && holder.name.length > 0 ? { holder, name: holder.name } : undefined;
+}
+/**
+ * Normalize tool declarations on one serialized Copilot inference request.
+ *
+ * The Gemini route measures this at the HTTP boundary: it rejects a request whose
+ * tool declaration carries an object parameter schema with no properties bucket.
+ * The presentation assembly no longer exposes declarations to listeners, so the
+ * guard rewrites the exact serialized body instead — lexically the last point
+ * before dispatch, and the same place the failure is measured.
+ *
+ * Nothing is invented: a body that is not JSON, carries no tool array, exceeds
+ * the bound, or targets another route or model family is returned untouched.
+ *
+ * @param body - the serialized request body as the adapter built it.
+ * @param settings - one configuration snapshot for this request.
+ * @returns the rewrite result; `body` stays `undefined` unless something changed.
+ */
+export function guardCopilotRequestBody(body, settings) {
+    const unchanged = { body: undefined, changed: false, fixed: [], skipped: [] };
+    if (typeof body !== 'string' || body.length === 0 || body.length > MAX_GUARDED_BODY_BYTES)
+        return unchanged;
+    // A cheap pre-check keeps message-heavy bodies out of the JSON parser entirely.
+    if (!body.includes('"tools"'))
+        return unchanged;
+    let parsed;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch {
+        return unchanged;
+    }
+    if (!isRecord(parsed) || !Array.isArray(parsed.tools) || parsed.tools.length === 0)
+        return unchanged;
+    if (!matchesRoute(COPILOT_ROUTE, parsed.model, settings))
+        return unchanged;
+    const declarations = parsed.tools.map(declarationOf);
+    if (declarations.every(declaration => declaration === undefined))
+        return unchanged;
+    const fixed = [];
+    const skipped = [];
+    for (const declaration of declarations) {
+        if (declaration === undefined)
+            continue;
+        const decision = classifyParameters(declaration.holder.parameters);
+        if (decision.fix) {
+            fixed.push(declaration.name);
+            declaration.holder.parameters = { ...declaration.holder.parameters, properties: {} };
+            continue;
+        }
+        if (decision.reason !== undefined)
+            skipped.push({ tool: declaration.name, reason: decision.reason });
+    }
+    if (fixed.length === 0)
+        return { body: undefined, changed: false, fixed, skipped };
+    return { body: JSON.stringify(parsed), changed: true, fixed, skipped };
+}

package/dist/identity.d.ts

@@ -49,6 +49,16 @@ export declare function isCopilotRequestPath(pathname: string): boolean;
 export declare function rewriteCopilotRequestHeaders(url: URL, headers: Headers, identity: CopilotWireIdentity): boolean;
 /** `full` is the default; `basic` is the minimal fingerprint fix; `0` disables. */
 export declare function wireIdentityMode(env?: NodeJS.ProcessEnv): WireIdentitySetting;
+/**
+ * Rewrite one serialized Copilot request body before dispatch.
+ *
+ * Returning a string replaces the body; `undefined` keeps it byte-identical.
+ * A throw is contained like every other pre-dispatch normalization failure.
+ */
+export type CopilotRequestTransform = (request: {
+    readonly url: URL;
+    readonly body: string;
+}) => string | undefined;
 /**
  * Install a process-wide Copilot header interceptor.
  *
@@ -59,3 +69,13 @@ export declare function wireIdentityMode(env?: NodeJS.ProcessEnv): WireIdentityS
  * current fetch rather than reusing stale installation state.
  */
 export declare function installCopilotIdentityHeaders(identity?: CopilotWireIdentity): () => void;
+/**
+ * Install a process-wide Copilot request-body normalizer.
+ *
+ * It shares the header interceptor's controller, trust checks and release
+ * discipline, so both halves are installed once and released independently. A
+ * body is normalized only when the request is a trusted Copilot inference call
+ * and the caller passes a serialized string body; every other shape is
+ * delegated untouched.
+ */
+export declare function installCopilotRequestTransform(transform: CopilotRequestTransform): () => void;

package/dist/identity.js

@@ -196,19 +196,29 @@ function createWrapper(state, downstream) {
             return downstream(input, init);
         let url;
         let headers;
+        let body;
         try {
             url = requestUrl(input);
             if (!isTrustedCopilotUrl(url) || !isCopilotRequestPath(url.pathname))
                 return downstream(input, init);
             headers = effectiveHeaders(input, init);
-            rewriteCopilotRequestHeaders(url, headers, state.identity);
+            if (state.identity !== null)
+                rewriteCopilotRequestHeaders(url, headers, state.identity);
+            if (state.transform !== null && typeof init?.body === 'string') {
+                body = state.transform({ url, body: init.body });
+                // A replaced body usually changes length, so its framing cannot be reused.
+                if (body !== undefined) {
+                    headers.delete('content-length');
+                    headers.delete('transfer-encoding');
+                }
+            }
         }
         catch {
             // Only pre-dispatch normalization failures are fail-open; the request is
             // delegated once and its eventual rejection is never caught or retried.
             return downstream(input, init);
         }
-        return downstream(input, { ...init, headers });
+        return downstream(input, body === undefined ? { ...init, headers } : { ...init, headers, body });
     };
     state.wrappers.add(wrapper);
     state.downstreams.set(wrapper, downstream);
@@ -237,34 +247,70 @@ function attach(state) {
  * current fetch rather than reusing stale installation state.
  */
 export function installCopilotIdentityHeaders(identity = createCopilotWireIdentity()) {
+    return install({ identity });
+}
+/**
+ * Install a process-wide Copilot request-body normalizer.
+ *
+ * It shares the header interceptor's controller, trust checks and release
+ * discipline, so both halves are installed once and released independently. A
+ * body is normalized only when the request is a trusted Copilot inference call
+ * and the caller passes a serialized string body; every other shape is
+ * delegated untouched.
+ */
+export function installCopilotRequestTransform(transform) {
+    return install({ transform });
+}
+function install(options) {
     if (typeof globalThis.fetch !== 'function')
         return () => { };
     if (controller === undefined) {
         controller = {
             active: true,
-            identity,
+            identity: null,
+            transform: null,
             installs: 0,
+            transforms: 0,
             wrappers: new WeakSet(),
             downstreams: new WeakMap(),
         };
     }
     const state = controller;
+    const ownsIdentity = options.identity !== undefined, ownsTransform = options.transform !== undefined;
+    // The first live identity install owns it; later concurrent installs share it.
+    if (ownsIdentity && state.installs === 0)
+        state.identity = options.identity;
+    // A body transform is per installer, and the latest live one wins.
+    if (ownsTransform)
+        state.transform = options.transform;
     try {
         attach(state);
     }
     catch (error) {
-        if (state.installs === 0 && controller === state)
+        if (state.installs === 0 && state.transforms === 0 && controller === state)
             controller = undefined;
         throw error;
     }
-    state.installs += 1;
+    if (ownsIdentity)
+        state.installs += 1;
+    if (ownsTransform)
+        state.transforms += 1;
     let released = false;
     return () => {
         if (released)
             return;
         released = true;
-        state.installs -= 1;
-        if (state.installs > 0)
+        if (ownsIdentity) {
+            state.installs -= 1;
+            if (state.installs === 0)
+                state.identity = null;
+        }
+        if (ownsTransform) {
+            state.transforms -= 1;
+            if (state.transforms === 0)
+                state.transform = null;
+        }
+        if (state.installs > 0 || state.transforms > 0)
             return;
         state.active = false;
         if (state.current !== undefined && globalThis.fetch === state.current.wrapper) {

package/dist/index.d.ts

@@ -9,7 +9,9 @@ export declare const syncCopilotCatalog: (credentials?: CredentialReader, authOp
 export { DEFAULT_SEARCH_MODEL } from './config.js';
 export { liveCost, selectAccountModels } from './catalog.js';
 export { DiscoveryError } from './discovery.js';
-export { createCopilotWireIdentity, installCopilotIdentityHeaders, isCopilotRequestPath, isTrustedCopilotUrl, rewriteCopilotRequestHeaders, wireIdentityMode, } from './identity.js';
+export { createCopilotWireIdentity, installCopilotIdentityHeaders, installCopilotRequestTransform, isCopilotRequestPath, isTrustedCopilotUrl, rewriteCopilotRequestHeaders, wireIdentityMode, } from './identity.js';
+export { guardCopilotRequestBody, MAX_GUARDED_BODY_BYTES } from './guard.js';
+export type { GuardedBody } from './guard.js';
 export { COPILOT_SEARCH_PROVIDER_ID, CopilotSearchProvider } from './provider.js';
 export { matchesRoute, normalizeToolSchemas, TOOL_SCHEMA_SKIPPED } from './schema.js';
 export { loadRuntime } from './runtime.js';
@@ -19,6 +21,6 @@ export type { BetterCopilotDependencies, BetterCopilotPlugin } from './plugin.js
 export type { AccountModelOptions } from './catalog.js';
 export type { NormalizeResult } from './schema.js';
 export type { AccountSelection, CopilotAuthOptions as CatalogAuthOptions, CredentialReader, ModelCatalog, SyncResult, } from './catalog-types.js';
-export type { CopilotWireIdentity, CopilotWireIdentityOverrides, WireIdentityMode, WireIdentitySetting, } from './identity.js';
+export type { CopilotRequestTransform, CopilotWireIdentity, CopilotWireIdentityOverrides, WireIdentityMode, WireIdentitySetting, } from './identity.js';
 export type { CopilotAuthOptions as SearchAuthOptions, CopilotSearchOptions, ResolvedCopilotAuth, SearchMode, } from './search-types.js';
 export type { GuardSettings, PromptAssembly, SkippedTool, ToolSchema } from './guard-types.js';

package/dist/index.js

@@ -11,7 +11,8 @@ export const syncCopilotCatalog = (credentials, authOptions) => plugin.sync(cred
 export { DEFAULT_SEARCH_MODEL } from './config.js';
 export { liveCost, selectAccountModels } from './catalog.js';
 export { DiscoveryError } from './discovery.js';
-export { createCopilotWireIdentity, installCopilotIdentityHeaders, isCopilotRequestPath, isTrustedCopilotUrl, rewriteCopilotRequestHeaders, wireIdentityMode, } from './identity.js';
+export { createCopilotWireIdentity, installCopilotIdentityHeaders, installCopilotRequestTransform, isCopilotRequestPath, isTrustedCopilotUrl, rewriteCopilotRequestHeaders, wireIdentityMode, } from './identity.js';
+export { guardCopilotRequestBody, MAX_GUARDED_BODY_BYTES } from './guard.js';
 export { COPILOT_SEARCH_PROVIDER_ID, CopilotSearchProvider } from './provider.js';
 export { matchesRoute, normalizeToolSchemas, TOOL_SCHEMA_SKIPPED } from './schema.js';
 export { loadRuntime } from './runtime.js';

package/dist/plugin.js

@@ -2,9 +2,10 @@ import { launchEnvironmentOf } from '@deepseek-ai/dsh-launch-environment';
 import { createCopilotAuthResolver } from './auth.js';
 import { createConfig } from './config.js';
 import { DiscoveryError, syncCopilotCatalog } from './discovery.js';
-import { createCopilotWireIdentity, installCopilotIdentityHeaders, wireIdentityMode } from './identity.js';
+import { createCopilotWireIdentity, installCopilotIdentityHeaders, installCopilotRequestTransform, wireIdentityMode } from './identity.js';
 import { CopilotSearchProvider } from './provider.js';
-import { matchesRoute, normalizeToolSchemas, TOOL_SCHEMA_SKIPPED } from './schema.js';
+import { TOOL_SCHEMA_SKIPPED } from './schema.js';
+import { guardCopilotRequestBody } from './guard.js';
 export const name = 'better-copilot';
 /** Search and guard are optional capabilities; the adapter requires these two. */
 export const inject = ['llm', 'credentials'];
@@ -89,33 +90,30 @@ export function createPlugin(dependencies) {
                     ctx.effect(() => install(), 'copilot: wire identity headers');
                 });
             }
-            // 2. Gemini tool-declaration guard: an additive, contained global listener.
+            // 2. Gemini tool-declaration guard: one contained wire transform. The
+            //    assembly waterfall no longer sees provider-owned declarations, so the
+            //    guard rewrites the serialized request at the boundary that measures
+            //    the defect. It is installed even when wire identity is opted out.
             contain('tool-schema guard', 'Gemini tool-schema normalization', () => {
-                ctx.on('system-prompt/assemble', async (_assembly, _context, next) => {
-                    // An upstream failure belongs to the downstream chain and propagates unchanged.
-                    const downstream = await next();
+                const transform = ({ body }) => {
                     try {
                         const settings = guardSettings(config.toolSchema);
-                        if (!matchesRoute(downstream.variables.provider, downstream.variables.model, settings))
-                            return downstream;
-                        const result = normalizeToolSchemas(downstream.tools);
+                        const result = guardCopilotRequestBody(body, settings);
                         if (settings.logFixes) {
-                            if (result.fixed.length > 0) {
-                                log('info', 'better-copilot: added a properties bucket to %d tool schema(s) for %s/%s', result.fixed.length, String(downstream.variables.provider), String(downstream.variables.model));
-                            }
-                            if (result.skipped.length > 0) {
+                            if (result.fixed.length > 0)
+                                log('info', 'better-copilot: added a properties bucket to %d tool schema(s) on the Copilot wire', result.fixed.length);
+                            if (result.skipped.length > 0)
                                 log('warn', 'better-copilot: %s left %d tool schema(s) unchanged: %s', TOOL_SCHEMA_SKIPPED, result.skipped.length, JSON.stringify(result.skipped));
-                            }
                         }
-                        if (!result.changed)
-                            return downstream;
-                        return { ...downstream, tools: result.tools };
+                        return result.body;
                     }
                     catch {
-                        log('warn', 'better-copilot: skipped one assembly after an internal error');
-                        return downstream;
+                        // The request is delegated byte-identical; a guard failure never fails a call.
+                        log('warn', 'better-copilot: skipped one request after an internal error');
+                        return undefined;
                     }
-                }, { global: true, prepend: true });
+                };
+                ctx.effect(() => installCopilotRequestTransform(transform), 'copilot: tool-schema wire normalization');
             });
             // 3. Search provider: mounts only when the web service exists.
             contain('search provider', 'Copilot web search', () => {

package/dist/schema.d.ts

@@ -11,14 +11,31 @@ export interface NormalizeResult {
     /** Tools left byte-identical, with a controlled reason. */
     readonly skipped: readonly SkippedTool[];
 }
+/** The verdict for one declaration's parameter schema. */
+export type ParameterDecision = {
+    readonly fix: true;
+} | {
+    readonly fix: false;
+    readonly reason?: string;
+};
 /**
- * Add an empty root properties bucket to object parameter schemas that lack one.
+ * Decide whether one root parameter schema needs an empty properties bucket.
  *
  * The GitHub Copilot Gemini route rejects a request whose tool declaration carries
  * an object parameter schema with no properties bucket (measured: HTTP 400 with a
  * plain-text body). Adding the bucket is JSON-Schema neutral and does not change
  * unions, required fields, additionalProperties or descriptions. Nothing else is
  * rewritten: references, non-object schemas and every nested node stay untouched.
+ *
+ * @param parameters - the root schema exactly as the declaration carries it.
+ * @returns whether to add the bucket, or the controlled reason it stays untouched.
+ */
+export declare function classifyParameters(parameters: unknown): ParameterDecision;
+/**
+ * Add an empty root properties bucket to object parameter schemas that lack one.
+ *
+ * @param tools - the declarations one assembly or request carries.
+ * @returns the rewritten declarations plus every fixed and skipped tool name.
  */
 export declare function normalizeToolSchemas(tools: readonly ToolSchema[]): NormalizeResult;
 /**

package/dist/schema.js

@@ -7,48 +7,51 @@ const isPlainObject = (value) => {
     return prototype === Object.prototype || prototype === null;
 };
 /**
- * Add an empty root properties bucket to object parameter schemas that lack one.
+ * Decide whether one root parameter schema needs an empty properties bucket.
  *
  * The GitHub Copilot Gemini route rejects a request whose tool declaration carries
  * an object parameter schema with no properties bucket (measured: HTTP 400 with a
  * plain-text body). Adding the bucket is JSON-Schema neutral and does not change
  * unions, required fields, additionalProperties or descriptions. Nothing else is
  * rewritten: references, non-object schemas and every nested node stay untouched.
+ *
+ * @param parameters - the root schema exactly as the declaration carries it.
+ * @returns whether to add the bucket, or the controlled reason it stays untouched.
+ */
+export function classifyParameters(parameters) {
+    if (parameters === undefined)
+        return { fix: false, reason: 'SKIPPED_MISSING_PARAMETERS' };
+    if (!isPlainObject(parameters))
+        return { fix: false, reason: 'SKIPPED_NOT_OBJECT' };
+    if (Object.hasOwn(parameters, '$ref') || Object.hasOwn(parameters, '$dynamicRef'))
+        return { fix: false, reason: 'SKIPPED_REFERENCE' };
+    if (parameters.type !== 'object')
+        return { fix: false, reason: 'SKIPPED_NOT_OBJECT_TYPE' };
+    if (parameters.properties !== undefined) {
+        return isPlainObject(parameters.properties) ? { fix: false } : { fix: false, reason: 'SKIPPED_INVALID_PROPERTIES' };
+    }
+    return { fix: true };
+}
+/**
+ * Add an empty root properties bucket to object parameter schemas that lack one.
+ *
+ * @param tools - the declarations one assembly or request carries.
+ * @returns the rewritten declarations plus every fixed and skipped tool name.
  */
 export function normalizeToolSchemas(tools) {
     const fixed = [];
     const skipped = [];
     const output = [];
     for (const tool of tools) {
-        const parameters = tool.parameters;
-        if (parameters === undefined) {
-            skipped.push({ tool: tool.name, reason: 'SKIPPED_MISSING_PARAMETERS' });
-            output.push(tool);
-            continue;
-        }
-        if (!isPlainObject(parameters)) {
-            skipped.push({ tool: tool.name, reason: 'SKIPPED_NOT_OBJECT' });
-            output.push(tool);
-            continue;
-        }
-        if (Object.hasOwn(parameters, '$ref') || Object.hasOwn(parameters, '$dynamicRef')) {
-            skipped.push({ tool: tool.name, reason: 'SKIPPED_REFERENCE' });
-            output.push(tool);
-            continue;
-        }
-        if (parameters.type !== 'object') {
-            skipped.push({ tool: tool.name, reason: 'SKIPPED_NOT_OBJECT_TYPE' });
-            output.push(tool);
-            continue;
-        }
-        if (parameters.properties !== undefined) {
-            if (!isPlainObject(parameters.properties))
-                skipped.push({ tool: tool.name, reason: 'SKIPPED_INVALID_PROPERTIES' });
-            output.push(tool);
+        const decision = classifyParameters(tool.parameters);
+        if (decision.fix) {
+            fixed.push(tool.name);
+            output.push({ ...tool, parameters: { ...tool.parameters, properties: {} } });
             continue;
         }
-        fixed.push(tool.name);
-        output.push({ ...tool, parameters: { ...parameters, properties: {} } });
+        if (decision.reason !== undefined)
+            skipped.push({ tool: tool.name, reason: decision.reason });
+        output.push(tool);
     }
     return { tools: output, changed: fixed.length > 0, fixed, skipped };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-better-copilot",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Account-aware GitHub Copilot model discovery, Copilot-compatible wire identity, native Responses web search and a Copilot Gemini tool-declaration guard in one DeepSeek Harness plugin.",
   "type": "module",
   "main": "./dist/index.js",
@@ -39,19 +39,6 @@
     "CHANGELOG.md",
     "LICENSE"
   ],
-  "scripts": {
-    "build": "tsc -p tsconfig.json",
-    "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p test/tsconfig.json",
-    "test": "pnpm run build && node --import tsx --test test/catalog.test.ts test/discovery.test.ts test/identity.test.ts test/secrets.test.ts test/catalog-plugin.test.ts test/config.test.ts test/composition.test.ts test/auth.test.ts test/refresh.test.ts test/provider.test.ts test/responses.test.ts test/search-plugin.test.ts test/schema.test.ts test/guard-plugin.test.ts test/patch.test.ts",
-    "test:integration": "pnpm run build && node --import tsx --test test/integration/nested-layout.test.ts test/integration/catalog-runtime.test.ts test/integration/enterprise.test.ts test/integration/identity-wire.test.ts test/integration/search-runtime.test.ts test/integration/guard-runtime.test.ts test/integration/scoped.test.ts test/integration/wire.test.ts",
-    "test:types": "pnpm run build && tsc -p test/types/tsconfig.json",
-    "test:pack": "pnpm run build && tsx ../../scripts/check-pack.ts .",
-    "check": "pnpm run typecheck && tsx ../../scripts/check.ts",
-    "check:secrets": "tsx ../../scripts/check-secrets.ts",
-    "prepare": "pnpm run build",
-    "prepublishOnly": "pnpm run verify",
-    "verify": "pnpm run check:secrets && pnpm run check && pnpm run test && pnpm run test:integration && pnpm run test:types && pnpm run test:pack"
-  },
   "keywords": [
     "deepseek-harness",
     "dsh",
@@ -75,33 +62,33 @@
   },
   "engines": {
     "node": ">=22.19.0",
-    "dsh": "0.2.1-rc.5"
+    "dsh": "0.2.2-rc.1"
   },
   "publishConfig": {
     "access": "public",
     "registry": "https://registry.npmjs.org/"
   },
   "peerDependencies": {
-    "@deepseek-ai/cordis": "~4.0.5",
-    "@deepseek-ai/dsh-credentials": "0.2.1-rc.5",
-    "@deepseek-ai/dsh-launch-environment": "0.2.1-rc.5",
-    "@deepseek-ai/dsh-llm-pi-ai": "0.2.1-rc.5",
-    "@deepseek-ai/dsh-system-prompt": "0.2.1-rc.5",
-    "@deepseek-ai/dsh-web": "0.2.1-rc.5",
-    "@deepseek-ai/schemastery": "~3.18.5",
+    "@deepseek-ai/cordis": "~4.1.0",
+    "@deepseek-ai/dsh-credentials": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-launch-environment": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-llm-pi-ai": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-system-prompt": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-web": "0.2.2-rc.1",
+    "@deepseek-ai/schemastery": "~3.19.0",
     "@earendil-works/pi-ai": "^1.1.0"
   },
   "devDependencies": {
-    "@deepseek-ai/cordis": "4.0.5",
-    "@deepseek-ai/dsh-agent": "0.2.1-rc.5",
-    "@deepseek-ai/dsh-credentials": "0.2.1-rc.5",
-    "@deepseek-ai/dsh-launch-environment": "0.2.1-rc.5",
-    "@deepseek-ai/dsh-llm-pi-ai": "0.2.1-rc.5",
-    "@deepseek-ai/dsh-scope": "0.2.1-rc.5",
-    "@deepseek-ai/dsh-session": "0.2.1-rc.5",
-    "@deepseek-ai/dsh-system-prompt": "0.2.1-rc.5",
-    "@deepseek-ai/dsh-web": "0.2.1-rc.5",
-    "@deepseek-ai/schemastery": "3.18.5",
+    "@deepseek-ai/cordis": "4.1.0",
+    "@deepseek-ai/dsh-agent": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-credentials": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-launch-environment": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-llm-pi-ai": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-scope": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-session": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-system-prompt": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-web": "0.2.2-rc.1",
+    "@deepseek-ai/schemastery": "3.19.0",
     "@earendil-works/pi-ai": "1.3.0"
   },
   "dsh": {
@@ -109,5 +96,16 @@
     "bundle": {
       "patch": "./cordis.patch.yml"
     }
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p test/tsconfig.json",
+    "test": "pnpm run build && node --import tsx --test test/catalog.test.ts test/discovery.test.ts test/identity.test.ts test/secrets.test.ts test/catalog-plugin.test.ts test/config.test.ts test/composition.test.ts test/auth.test.ts test/refresh.test.ts test/provider.test.ts test/responses.test.ts test/search-plugin.test.ts test/schema.test.ts test/guard.test.ts test/guard-plugin.test.ts test/patch.test.ts",
+    "test:integration": "pnpm run build && node --import tsx --test test/integration/nested-layout.test.ts test/integration/catalog-runtime.test.ts test/integration/enterprise.test.ts test/integration/identity-wire.test.ts test/integration/search-runtime.test.ts test/integration/guard-runtime.test.ts test/integration/wire.test.ts",
+    "test:types": "pnpm run build && tsc -p test/types/tsconfig.json",
+    "test:pack": "pnpm run build && tsx ../../scripts/check-pack.ts .",
+    "check": "pnpm run typecheck && tsx ../../scripts/check.ts",
+    "check:secrets": "tsx ../../scripts/check-secrets.ts",
+    "verify": "pnpm run check:secrets && pnpm run check && pnpm run test && pnpm run test:integration && pnpm run test:types && pnpm run test:pack"
   }
-}
+}