dsh-code-server-app 0.3.59 → 0.3.65

package/LICENSE-Apache-2.0.txt

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.en.md

@@ -23,7 +23,7 @@ A static profile plugin (npm package with host + client bundle) that ships the *
 
 | DSH version | Carrier | Entry points |
 |---|---|---|
-| **>= 0.1.5-alpha.1** (has `sidebarRight` / `sidebarRightTabs`) | **Right-sidebar tab** (kind `code-server`, chip `Code Server`), which also **claims file addresses** (see below) | ① DSH's own **produced-file chips / presented-file card previews / inline file names in prose** (since 0.2.5, via the official `openFile` → file address → this tab); ② the **Code Server box** on the sidebar's guide ("开始") page; ③ Settings → Plugins → Code Server → **"Open in right sidebar"** |
+| **rc line** `0.1.5-rc.x` (latest `0.1.5-rc.3` = npm `latest`/`next`)**and alpha line** `>= 0.1.6-alpha.2` (latest `0.1.7-alpha.1`) — detected by the presence of `sidebarRight` / `sidebarRightTabs`, never by version comparison | **Right-sidebar tab** (kind `code-server`, chip `Code Server`), which also **claims file addresses** (see below) | ① DSH's own **produced-file chips / presented-file card previews / inline file names in prose** (since 0.2.5, via the official `openFile` → file address → this tab); ② the **Code Server box** on the sidebar's guide ("开始") page; ③ Settings → Plugins → Code Server → **"Open in right sidebar"** |
 | older (no sidebar service) | **Unsupported**: nothing but one notice on the settings page | none (Settings → Plugins → Code Server shows an upgrade notice) |
 
 - Detection: first a synchronous `ctx.get('sidebarRightTabs') / ctx.get('sidebarRight')` probe; because the services may come up after this plugin, `ctx.inject(['sidebarRightTabs','sidebarRight'], …)` is awaited and a **2.5 s timeout marks the DSH as legacy** (no version comparison, and the plugin's own activation is never blocked).
@@ -50,7 +50,7 @@ A static profile plugin (npm package with host + client bundle) that ships the *
     the narrow-viewport handling). When the button is missing it keeps the current mode and logs one `console.warn` — panel
     rendering is never affected.
 - **Resident IDE (0.2.2, on by default)**: switching to another tab or collapsing the sidebar and coming back **no longer reloads** code-server — unsaved editor buffers, terminals and debug sessions all stay put (see "Why switching tabs no longer reloads" below).
-- The settings card has exactly **three settings**: "**Claim types**", "**Fullscreen on open**" and "Resident in background" — no other rows (0.2.7 removed the "Entry", "dependency install" and "environment check" rows).
+- The settings card has exactly **four settings**: "**Claim types**", "**Fullscreen on open**", "Resident in background" and "**FIM completion (experimental, off by default)**" — no other rows (0.2.7 removed the "Entry", "dependency install" and "environment check" rows).
   Open the IDE from the **Code Server box** on the sidebar's guide page, or by clicking DSH's own produced-file chips / delivered-file previews / inline file names;
   diagnostics stay out of the UI — the `[code-server]` lines in the DSH host log are the place to look (`/api/code-server/status` still returns `env` for scripts).
   The old `windowedOpen` (open in a window) and `reserveComposer` were **removed in 0.2.6**: leftover keys in an old settings document neither fail nor apply (they are no longer part of the schema).
@@ -354,10 +354,15 @@ Regression: the "push → take → clear, twice" case in `scripts/test-bridge-ro
 The token lives in `<extensionsDir>/.dshcs-bridge/bridge.json`, **readable by any process of the same local
 user**, so:
 
-1. **`/code-server-bridge/*` is read-only, with `/approve` as the single exception.** No route writes files,
+1. **`/code-server-bridge/*` is read-only, with two bounded exceptions.** No route writes files,
    edits documents, runs commands, or spawns processes. A leaked token is therefore bounded to "sees information
    that is in the editor" and **can never** become arbitrary file writes or command execution. A whitelist
    assertion in `scripts/test-bridge-routes.mjs` guards this.
+   `/complete` (0.3.61, **experimental FIM completion, off by default**) is the one route that makes a **model
+   call**: it takes two strings (the text before/after the cursor) and returns one string. It still writes
+   nothing and runs nothing, is disabled unless the setting is on (403 otherwise), and is bounded by
+   length/rate/concurrency/timeout caps — so the worst case for a leaked token grows only to "spends a little
+   completion budget and reads back one completion".
    `/old` (added in 0.3.55) lives under the same invariant: it only reads the bounded cache of "pre-write copies of
    the last few agent writes" (≤8 entries, ≤1 MB each, ≤4 MB total, 5-minute TTL) by **opaque key**, 404s when it
    is gone, takes no path argument (so it cannot read arbitrary files) and does not consume (repeat polls get the
@@ -394,6 +399,64 @@ as stated for the loopback port.
 Diagnostics: `GET /api/code-server/status` exposes
 `bridge: { enabled, live, toolsRegistered, supported, url, file }` — **never the token** (that only exists in the file).
 
+## FIM completion (experimental, since 0.3.61, **off by default**)
+
+When you pause while typing, a grey continuation appears after the cursor (Tab accepts, Esc discards).
+It is **off by default**; turn it on with that row in the settings card — it takes effect immediately
+(no host restart, no reinstall).
+
+| Item | Value |
+|---|---|
+| Endpoint | DeepSeek **FIM (Beta)**: `POST https://api.deepseek.com/beta/completions`, params `prompt` (prefix) + `suffix` (suffix) |
+| Model | `deepseek-flash` (the model the official FIM doc uses — also this deployment's default) |
+| Credential | Reuses the `DEEPSEEK_API_KEY` DSH already has: `ctx.get('credentials').resolve(...)`, the same path the official adapter takes (falling back to the launch environment) |
+| Measured latency | **112–416 ms** (non-streaming; streaming was *slower*, hence non-streaming on purpose) |
+| When it fires | After a ≥250 ms pause and only past the gates: non-empty selection / non-`file` document / empty context / document >20k lines — those **never send a request** |
+
+**How it is wired in (option A)**: FIM speaks the Completions API, while `ctx.llm.stream(GenerateOptions)`
+only knows `messages` (no `prompt`/`suffix`; `purpose` is a closed union of `'compaction' | 'session-title'`).
+So the plugin **registers its own LLM adapter route** `dshcs-fim`: the prefix/suffix travel inside a
+`messages` envelope with a fixed marker (`dshcs-fim/1 `), and the adapter decodes it before hitting that
+endpoint. The call therefore still goes **through DSH's LLM service** — cancellation, timeouts, terminal
+chunks and stable error codes all follow the service contract (instead of the plugin bypassing it with a
+raw fetch). Evidence and measurements: B6/B7 of `docs/analysis-continuedev-reuse.md`.
+
+**Three knobs (0.3.62, all in the settings card, effective immediately)**:
+
+| Setting | Default | Effect |
+|---|---|---|
+| Pause in ms | `250` | How long typing must stop before a request. Range 100–3000 ms (clamped on save); the endpoint round trip measured **112–416 ms**, so the pause *is* the perceived latency |
+| Allow multi-line | on | Off ⇒ the host returns the first line only; an empty first line means no completion. Turn it off to be less intrusive |
+| Disable by glob | empty | In these files **no request is sent at all**. Semantics: `*` does not cross directories, `**` does, a pattern without `/` matches the basename, a pattern with `/` matches any path suffix (so `vendor/**` and `src/*.ts` work at any depth), a trailing `/` means `/**`. Example: `*.md;vendor/**;**/dist/**` |
+
+> Both sides implement these semantics independently (the extension is a static file shipped with the package
+> and cannot import host code); `scripts/test-fim.mjs` pins their equivalence with one shared (pattern, path)
+> corpus.
+
+**Safety and bounds** (this is the only capability of the plugin that sends content out):
+
+- **Still read-only**: the extension never writes files and never runs commands — it only *proposes* text;
+  insertion happens when you press Tab;
+- The bridge gains its fifth route `POST /complete` (**the only route that makes a model call**) only while
+  the setting is on; with it off the route answers 403 and no request is made;
+- Bounded: prefix/suffix ≤6000/2000 chars (120/40 lines, whichever comes first), output ≤2000 chars,
+  4 s timeout, 120 ms minimum interval, concurrency 1, 60 calls/minute; over-limit requests are rejected
+  (409/429) and the extension simply shows no completion for that beat;
+- One more layer in the extension: turning the setting off disposes the provider immediately (no requests at
+  all), and identical context hits a local 2-minute cache;
+
+**Usage is visible in exactly two places**: these calls are **not session requests**, so they are not written
+to the session log and DSH's own token accounting (per-turn usage, context pressure, telemetry) **excludes
+them**. Usage therefore shows up in ① the IDE status bar's DSH item — a `$(zap) 1.2k` counter when on, with
+input/output/cache-read/last-latency/last-error on hover, and ② the `fim` field of
+`GET /api/code-server/status` (same snapshot).
+
+**Known limits**: the model occasionally invents an insertion where nothing is needed (2/2 reproduced at a
+cursor position that needed none); the filter pipeline strips code fences and control markers, but "should
+this be completed at all" stays your call — Esc or typing on makes it disappear. A more reliable shape needs
+a faster completion route, or DSH making completion a first-class request (at which point only the adapter's
+data call changes; the caller stays as it is).
+
 ## Legacy DSH (unsupported since 0.2.3)
 
 **Behaviour**: when `sidebarRightTabs` / `sidebarRight` cannot be found, the plugin registers a single settings card:
@@ -402,7 +465,7 @@ Diagnostics: `GET /api/code-server/status` exposes
 > Since 0.2.3 this plugin no longer supports older DSH versions.
 > The right-sidebar plugin services `sidebarRightTabs` / `sidebarRight` were not detected, so the plugin exposes no
 > entry point at all (the old floating ball and floating window have been removed) and will not start the IDE in the
-> background. Upgrade DSH to a version with the right sidebar (>= 0.1.5-alpha.1): Code Server then appears as a
+> background. Upgrade DSH to the rc line (0.1.5-rc.x) or the alpha line from 0.1.6-alpha.2 on: Code Server then appears as a
 > right-sidebar tab, this page shows the full settings again, and no reinstall is needed — a page refresh is enough.
 
 - **No other UI**: no `shell.overlay` registration (floating ball), no file-address claim, no resident preload.
@@ -418,8 +481,8 @@ Diagnostics: `GET /api/code-server/status` exposes
 
 - code-server's workspace **follows the active DSH session/workspace**: switching sessions/workspaces while the IDE is open moves code-server to the new directory
   (resolution order: current session cwd → session's `workspace.path` → workspace of the most recently active session → first workspace.path;
-  **where "the current session" comes from depends on the DSH version**: ≥ 0.1.6-alpha.2 reads the session-scoped standard prop `sessionId`,
-  ≤ 0.1.6-alpha.1 falls back to `current` on the session-list snapshot — see the 0.3.48 bullet below; the logic is inlined in `lib/client.js`
+  **where "the current session" comes from depends on the DSH version**: the alpha line (≥ 0.1.6-alpha.2) reads the session-scoped standard prop `sessionId`,
+  the rc line (≤ 0.1.5-rc.3) falls back to `current` on the session-list snapshot — see the 0.3.48 bullet below; the logic is inlined in `lib/client.js`
   (the "workspace resolution" section) and the contract for both shapes is pinned by `scripts/test-client-bundle-cwd.mjs` directly against the entry file);
   the opened directory is shown inside code-server (`?folder=<cwd>`, the page reloads when following a switch);
   implementation note: the iframe `src` must carry `?folder=<cwd>` — code-server's front-end remembers the "last workspace" and restores it by itself;
@@ -457,7 +520,7 @@ Diagnostics: `GET /api/code-server/status` exposes
   committed hand-written source: there is no build step anywhere on that chain).
 
 > Verified locally (BM: Windows 11 ARM64): the whole tree/dependency chain hangs directly off the plugin's
-> dependency table — the tree package `@jinsiyu/dshcs-vscode-server` (currently 4.137.0, a 50.8 MB tarball),
+> dependency table — the tree package `@jinsiyu/dshcs-vscode-server` (currently 4.138.0, a 50.9 MB tarball),
 > the pure-JS inner dependencies plus the 8 platform-independent repacks in `dependencies`, and the 8
 > platform-specific repacks (win32-arm64 / win32-x64) in `optionalDependencies` with their own os/cpu gates;
 > the original names are restored by junctions created at runtime (`lib/native.js`)
@@ -505,7 +568,7 @@ pnpm run promote -- <version>
 | Goal | Command |
 |---|---|
 | **Build from the latest upstream release** | `pnpm run vendor:latest` (= `--force`): pulls `code-server@latest`'s tree into `vendor/vscode`; afterwards you **must** re-run `repack:build` and republish every sub-package |
-| **Pin a version** | `pnpm run vendor:vscode -- --version 4.137.0` |
+| **Pin a version** | `pnpm run vendor:vscode -- --version 4.138.0` |
 | **Snapshot from an existing tree** | `pnpm run vendor:vscode -- --from <code-server dir>` (seconds) |
 | **Rebuild every sub-package** | `pnpm run repack:build -- --target win32-arm64,win32-x64 --pack` (without `--from` it npm-installs and compiles the source tree itself — slow) |
 | **Rebuild only the tree + dependency table** | `node scripts/vendor-repacks.mjs --reuse --target win32-arm64,win32-x64 --pack` (reuses the natives already in `repack/build`; also rewrites `lib/vendored.json` and the plugin dependency table) |
@@ -629,11 +692,11 @@ pnpm test:bridge-extension   # extension-side pure logic (dirty buffers, diagnos
 pnpm test:ask-dialog         # ask-dialog wiring: no artifacts/build chain left, the host's four ask routes, the extension only reporting editor state, the four approval constraints, the bridge's safety invariants
 pnpm test:launcher-routes    # launcher HTTP surface (spawns a real process; slow)
 pnpm test:workspace-switch   # switching workspaces does not restart the process
-pnpm test:workspace-cwd      # "current workspace directory" resolution (DSH 0.1.6-alpha.2 sessionId vs. the older current)
+pnpm test:workspace-cwd      # "current workspace directory" resolution (alpha line: sessionId vs. rc line: the snapshot's current)
 pnpm test:client-cwd         # the same contract, but asserted against the **client entry** lib/client.js
 pnpm test:client-tabs        # "one code-server tab on the DSH side": a new tab closes the old one in the same pane
 pnpm test:client-entry       # client-entry guard: classic script + factory wrapper, require whitelist, src/ gone, parity with lib/claim-types.js
-pnpm test:client-seat        # which seat the settings card uses: plugins.bundle.config (DSH ≥ 0.1.6-alpha.2) vs settings.plugin.item (≤ alpha.1)
+pnpm test:client-seat        # which seat the settings card uses: plugins.bundle.config (alpha line >= 0.1.6-alpha.2) vs settings.plugin.item (rc line <= 0.1.5-rc.3)
 pnpm test:fullscreen         # opening the tab goes fullscreen
 pnpm test:vendored           # repack table ↔ plugin dependency table (no npm: aliases, no aggregator)
 pnpm test:installed          # install smoke: assert on what was **installed into a profile**
@@ -956,7 +1019,7 @@ dsh plugin --profile web add C:\Users\User\Desktop\dsh-code-server-app
 ### Upgrading the VS Code tree (upstream = a code-server release)
 
 - **The version is decided at pack time**: `pnpm run vendor:latest` (= `--force`) pulls the tree of the npm **latest**
-  release; or use `pnpm run vendor:vscode -- --version 4.137.0` / `DSHCS_CODE_SERVER_VERSION`.
+  release; or use `pnpm run vendor:vscode -- --version 4.138.0` / `DSHCS_CODE_SERVER_VERSION`.
   With an existing `vendor/vscode`, a plain `pnpm pack` never upgrades (it is a no-op).
   **Source-tree precedence (fixed in 0.2.13)**: an explicit `--from` uses that tree, while an explicit
   `--force`/`--version` now **always goes to the registry** — before the fix a local source tree won
@@ -971,13 +1034,14 @@ dsh plugin --profile web add C:\Users\User\Desktop\dsh-code-server-app
 - **A version bump means rebuilding and republishing the sub-packages** (all with the same script):
   1. `pnpm run repack:build -- --target win32-arm64,win32-x64 --pack` → the new tree package
      (`@jinsiyu/dshcs-vscode-server@<new version>`) and the natives rebuilt against the new inner dependencies (the
-     script also rewrites the plugin's pure-JS `dependencies` and both aggregator versions);
-  2. `pnpm run republish:repacks` (`pnpm run publish:repacks`) → publish; then bump the plugin version → `pnpm pack`
+     script also rewrites the plugin's pure-JS `dependencies`, writes the 16 repacks under their real names into
+     `dependencies` / `optionalDependencies`, and rewrites `lib/vendored.json`);
+  2. `pnpm run publish:repacks` → publish; then bump the plugin version → `pnpm pack`
      → publish the plugin.
 - `productPath` (`<quality>-<commit>`, part of the client WebSocket path) is **computed from `lib/vscode/product.json`**,
   so upgrading the tree needs no code change — but the routes are registered at activation, so restart `dsh web` afterwards.
 - **No runtime auto-upgrade anymore**: nothing fetches latest at startup; the version is fully determined by the bundled artifact.
-- Bundled locally right now: the tree of `code-server@4.137.0` (VS Code 1.137.0, `productPath=stable-b11dabda…`).
+- Bundled locally right now: the tree of `code-server@4.138.0` (VS Code 1.138.0, `productPath=stable-59c988c7…`).
 
 ### Compatibility with the old install locations
 
@@ -996,8 +1060,12 @@ persisted via the official settings domain (`settingsScope`, namespace `code-ser
 | `claimExtensions` | `*` + three exclusion groups (preview-friendly / executables / Office; full lists in the "Claim types" section) | **Claim types** (0.2.11, replaces 0.2.5's `fileOpenScope`): decides by extension which files go to VS Code, semicolon-separated; `*` claims every other type, `!ext` excludes (exclusion wins). The default leaves the four categories DSH's preview renders well (markdown/html/images/PDF) to DSH and sends everything else to the IDE; an empty value claims nothing. **Scope (session vs absolute) is no longer distinguished** |
 | `fullscreenOnOpen` | `true` | **Fullscreen on open** (0.2.9): opening the Code Server tab (including clicking a file) switches the right sidebar to fullscreen (fills the window); off keeps DSH's default push mode (side by side with the conversation). Only the moment of opening is affected — a manual "Exit fullscreen" is never fought back |
 | `keepResident` | `true` | **Resident in background**: on, the host preloads the IDE into a parked surface right after start — switching tabs or collapsing the sidebar never reloads it and the first open needs no cold start; off loads it only when the panel is opened (saves memory) |
+| `fim` | `false` | **FIM completion (experimental, 0.3.61)**: when on, pausing while typing shows a grey inline continuation (Tab accepts, Esc discards). **Off by default** — it is the only capability of this plugin that sends content out (a bounded slice of code around the cursor, per completion), and those calls **do not enter DSH's token accounting**, so usage is visible only in the IDE status bar. See the "FIM completion" section |
+| `fimDebounceMs` | `250` | **FIM · pause in milliseconds** (0.3.62): how long typing must stop before one completion request is sent. Effective range **100–3000 ms**, clamped on save (same rule as the host); empty/invalid falls back to 250 |
+| `fimMultiline` | `true` | **FIM · allow multi-line completions** (0.3.62): off means the host returns the first line only (an empty first line = no completion this time). The model does invent insertions where none are needed, and multi-line amplifies that noise |
+| `fimDisableGlobs` | empty | **FIM · disable by glob** (0.3.62): semicolon/newline separated. `*` does not cross directories, `**` does, a pattern without `/` matches the basename, a pattern with `/` matches any path suffix, and a trailing `/` means `/**`. Examples: `*.md`, `vendor/**`, `**/dist/**`. **Checked on both sides**: the extension first (no request at all), the host again |
 
-(Since 0.2.9 the card keeps only those three settings; `windowedOpen` and `reserveComposer` are gone — leftover keys in an old
+(Since 0.2.9 the card keeps only those settings (0.3.61 added FIM completion, 0.3.62 its three sub-rows); `windowedOpen` and `reserveComposer` are gone — leftover keys in an old
 settings document neither fail nor apply. `serve` remains a key in the settings namespace (usable from a settings document) but
 has **no card row** — see "Serving mode".)
 
@@ -1130,6 +1198,22 @@ What remains on the plugin side:
   **built-in** extension (in `lib/vscode/extensions`), so users cannot remove it from the extensions panel, and the
   installer re-syncs it whenever its content changes.
 
+## Third-party and license
+
+This project is **MIT**-licensed (see [`LICENSE`](LICENSE)). Its experimental **FIM completion** feature was
+**designed with reference to** [continuedev/continue](https://github.com/continuedev/continue)
+(Apache License 2.0, Copyright 2023 Continue) — specifically the settings taxonomy of upstream
+`tabAutocompleteOptions` (`debounceDelay`, `useAutocompleteMultilineCompletions`, `disableInFiles`) and its
+debounce / cursor-window / filtering / bounded-cache approach.
+
+**No source code, template strings or files from continuedev/continue are included here** (completion
+requests target DeepSeek's official FIM (Beta) endpoint; the prompt shape comes from DeepSeek's docs and
+local measurement). The standard Apache License 2.0 text ships as
+[`LICENSE-Apache-2.0.txt`](LICENSE-Apache-2.0.txt), and the per-location reference log is
+[`THIRD_PARTY_NOTICES.md`](THIRD_PARTY_NOTICES.md) — so Apache-2.0's obligations (notices, marking modified
+files, keeping an upstream NOTICE if one appears) are already satisfied should a code fragment ever be ported
+in. Apache-2.0 grants no trademark rights; this project does not use "Continue" as a name or in promotion.
+
 ## Known limitations
 
 - **~~The editor bridge needs DSH to provide `webServer`~~ no longer true (fixed in 0.3.13)**: the bridge now runs
@@ -1175,7 +1259,7 @@ What remains on the plugin side:
 - **`serve: dsh` shares DSH's origin**, so the iframe is not sandboxed there (same-origin plus `allow-same-origin` is
   escapable by the frame itself); in `loopback` mode the iframe is cross-origin and `sandbox` stays as real protection.
 - **Single instance across sessions**: one shared IDE per host; switching cwd only re-navigates the workbench (since 0.2.12 no process restart, so the old directory's background terminals are not collected).
-- **Older DSH versions are unsupported (since 0.2.3)**: on a DSH without `sidebarRightTabs` / `sidebarRight` the plugin
+- **Older DSH versions are unsupported (since 0.2.3).** Exactly two lines are supported (converged 2026-09-22): the **rc line** `0.1.5-rc.x` (old seat + `current` on the snapshot) and the **alpha line** `>= 0.1.6-alpha.2` (new seat + the `sessionId` standard prop). Earlier alphas (`0.1.5-alpha.x`, `0.1.6-alpha.1`) are **not separate targets** — they share the rc line's shapes, so the code happens to work, but they are not verified. Detail: on a DSH without `sidebarRightTabs` / `sidebarRight` the plugin
   offers nothing but an upgrade notice on the settings page; older-DSH users should stay on `0.2.2`
   (`dsh plugin --profile web add dsh-code-server-app@0.2.2`).
 - **Sidebar tab switching** (no longer reloads since 0.2.2): DSH's right sidebar renders only the active tab's body, and