dsh-code 1.0.4 → 1.0.6

package/README.md

@@ -7,7 +7,7 @@
 <p align="center"><img alt="Typing SVG" src="https://readme-typing-svg.herokuapp.com?font=JetBrains+Mono&amp;weight=500&amp;size=22&amp;duration=4000&amp;pause=700&amp;color=4176E6&amp;center=true&amp;vCenter=true&amp;width=680&amp;lines=DeepSeek+Harness+Code;DSH+%E5%86%85%E6%A0%B8%E7%9A%84%E7%BB%88%E7%AB%AF%E7%BC%96%E7%A0%81%E7%95%8C%E9%9D%A2"></p>
 <p align="center">
   <a href="https://github.com/deepseek-ai/deepseek-harness"><img alt="DeepSeek Harness" src="https://img.shields.io/badge/DeepSeek-Harness-4176E6?style=for-the-badge&amp;logo=deepseek&amp;logoColor=white&amp;labelColor=1c1917"></a>
-  <a href="https://www.npmjs.com/package/@deepseek-ai/dsh"><img alt="dsh version" src="https://img.shields.io/badge/dsh-0.1.1--rc.2-4176E6?style=for-the-badge&amp;logo=deepseek&amp;logoColor=white&amp;labelColor=1c1917"></a>
+  <a href="https://www.npmjs.com/package/@deepseek-ai/dsh"><img alt="dsh version" src="https://img.shields.io/badge/dsh-0.1.5--rc.1-4176E6?style=for-the-badge&amp;logo=deepseek&amp;logoColor=white&amp;labelColor=1c1917"></a>
   <a href="https://github.com/UNLINEARITY/dsh-code/stargazers"><img alt="GitHub stars" src="https://img.shields.io/github/stars/UNLINEARITY/dsh-code?label=Stars&amp;style=for-the-badge&amp;logo=github&amp;logoColor=white&amp;color=4176E6&amp;labelColor=1c1917"></a>
   <a href="https://www.npmjs.com/package/dsh-code"><img alt="npm version" src="https://img.shields.io/npm/v/dsh-code?label=npm&amp;style=for-the-badge&amp;logo=npm&amp;color=cb3837&amp;labelColor=1c1917"></a>
   <a href="https://github.com/UNLINEARITY/dsh-code/blob/main/LICENSE"><img alt="License" src="https://img.shields.io/github/license/UNLINEARITY/dsh-code?label=License&amp;style=for-the-badge&amp;logo=opensourceinitiative&amp;color=4176E6&amp;labelColor=1c1917"></a>
@@ -25,21 +25,23 @@ DeepSeek Harness 将模型、工具、存储、策略和界面作为插件，通
 
 ## 二、快速开始
 
-需要 Node `^22.19 || >=24` 和预览版 `dsh` CLI（当前版本线：`@deepseek-ai/dsh@0.1.1-rc.2`）。未配置模型时仍可进入 TUI、查看会话和使用非模型功能；在 `/model` 中按 `a` 可管理 API key、OAuth 与设备码登录。
+需要 Node `^22.19 || >=24` 和预览版 `dsh` CLI（当前版本线：`@deepseek-ai/dsh@0.1.5-rc.1`）。未配置模型时仍可进入 TUI、查看会话和使用非模型功能；在 `/model` 中按 Tab 进入供应商管理，配置 API key、OAuth 与设备码登录。
 
 ### 1. 安装与更新
 
 初次安装和更新使用同一组指令：
 
 ```sh
-npm install -g @deepseek-ai/dsh@0.1.1-rc.2 dsh-code@1.0.3
+npm install -g @deepseek-ai/dsh@0.1.5-rc.1 dsh-code@1.0.6
 npm install -g pnpm
-dsh plugin --profile cli add dsh-code@1.0.3
+dsh plugin --profile cli add dsh-code@1.0.6
 ```
 
-> 提示：pnpm 会忽略发布不足 24 小时的包，因此发布首日请使用精确版本 `dsh-code@1.0.3`；24 小时后可省略版本号。npm 安装不受此限制。
+> 提示：pnpm 会忽略发布不足 24 小时的包，因此发布首日请使用精确版本 `dsh-code@1.0.6`；24 小时后可省略版本号。npm 安装不受此限制。
 >
-> 版本对齐：dsh-code 1.0.3 面向 dsh `0.1.1-rc.2` 构建，全部 Harness 依赖均精确锁定为 `0.1.1-rc.2`。请保持全局 dsh 与 dsh-code 同步，避免宿主与插件混用候选版本。rc.2 已删除旧的 DeepSeek 配置项 `maxRequestImageBytes`。
+> 版本对齐：dsh-code 面向 dsh `0.1.5-rc.1` 构建，全部 Harness 依赖均精确锁定为 `0.1.5-rc.1`。已安装的用户运行 `deepseek update --apply` 即可按同一条版本线一起升级全局宿主与 cli profile 中的插件，本地开发挂载（`link:`）不受影响。
+>
+> 升级说明：旧会话与旧参数中记录的 `code` 预设会自动映射到上游已改名的 `ptc`，无需手动迁移。会话日志读取端随上游升级到格式 v3：旧格式日志在读取时由内核自动迁移，磁盘上的原始文件保持不变。
 
 ### 2. 启动指令
 
@@ -77,7 +79,7 @@ DSH-Code 的重点是让 DSH 的 Agent、模型、工具和持久会话可以直
 ### 2. Agent、模型与扩展
 
 - 每个会话可以选择独立的 Agent Preset，用于组合工具、提示词、技能、上下文压缩、plan mode 和 subagent 能力
-- 使用 `/mode` 选择 `standard`、`code`、`minimal`、`cordis` 或用户自定义 Preset
+- 使用 `/mode` 选择 `standard`、`ptc`、`minimal`、`cordis` 或用户自定义 Preset（旧名称 `code` 自动映射到 `ptc`）
 - 使用 `/model` 切换模型，管理 provider、API key、OAuth/设备码登录、endpoint、可用模型和上下文窗口；`Tab` 进入 provider 管理（已配置供应商置顶分组），任意阶段 `Ctrl+C` 直接退出整个 /model 流程
 - 在 provider 列表中，Enter 进入统一配置页：同页填写 API key 与 endpoint（留空即官方默认）、编辑已添加模型的上下文/输出窗口，`Tab` 进入发现页拉取端点真实可用模型并勾选添加
 - 在统一配置页的模型行上按 `e` 编辑推理档位声明（格式 `low:low high:high max:max`，`false` 禁用、留空恢复继承），按 `c` 从其他已声明模型逐字复制——例如 GLM 系列按官方三档写 `low:low high:high max:max`，新模型（如 gpt-6）可一键复制 gpt-5.6 的映射
@@ -109,7 +111,7 @@ DSH-Code 的重点是让 DSH 的 Agent、模型、工具和持久会话可以直
 ### 4. 编码工作流
 
 - 使用 `@` 引用工作区文件或已有会话；选择 PNG、JPEG、WebP、GIF 时会自动作为真实图片附件
-- 支持启动 prompt、多个 `--image` 参数，以及从终端拖入一张或多张图片
+- 支持启动 prompt、多个 `--image` 参数，以及从终端拖入或粘贴附件：图片按图片附件发送，其他文件按原样文件附件发送（单文件 8 MiB、每条消息 8 个以内）
 - 使用 `/diff` 按文件检查改动，使用 `/review` 发起只读代码审查
 - 使用 `/copy` 复制最近一条完整回复，使用 Ctrl+O 查看完整历史和工具详情
 - 支持工具审批、结构化提问、plan review、多选和自定义答案
@@ -121,7 +123,7 @@ DSH-Code 的重点是让 DSH 的 Agent、模型、工具和持久会话可以直
 
 ```sh
 dsh --profile cli                    # 新建 standard 会话
-dsh --profile cli --mode code        # 使用指定 Agent Preset 启动
+dsh --profile cli --mode ptc         # 使用指定 Agent Preset 启动（standard/minimal/cordis/ptc）
 dsh --profile cli --continue         # 恢复当前目录最新会话
 dsh --profile cli --resume abc123    # 按 id 或唯一前缀恢复会话
 dsh --profile cli --session my-id    # 使用指定 id 新建会话
@@ -158,7 +160,7 @@ dsh --profile cli --session my-id    # 使用指定 id 新建会话
 | 命令 | 用途 |
 | --- | --- |
 | `/diff [--staged\|ref]` | 按文件查看工作区、暂存区或指定 ref 的 Git diff |
-| `/review [--staged\|ref]` | 使用只读权限审查 Git 改动 |
+| `/review [--staged\|ref]` | 使用只读权限审查 Git 改动；新会话中可直接使用，审查提示词作为首条消息建立会话 |
 | `/todos` | 查看当前会话的完整 todo 列表 |
 | `/agents` | 查看当前会话创建的 subagent 会话 |
 | `/jobs` | 查看后台任务及其运行状态 |
@@ -172,6 +174,7 @@ dsh --profile cli --session my-id    # 使用指定 id 新建会话
 | `/statusline` | 选择状态栏显示的项目 |
 | `/vscode-keys` | 将 Ctrl+R 放行进 VS Code 系终端（幂等写入用户级 keybindings.json） |
 | `/theme` | 切换终端配色主题 |
+| `/animation` | 开关计时动画（shimmer/追逐/闪烁/切换波浪），`/animation [on\|off]` |
 | `/help` | 查看快捷键、内置命令、Harness 命令和用户技能 |
 | `/quit` | 退出 DSH-Code |
 
@@ -214,8 +217,8 @@ DSH-Code 读取 Harness 的实时注册表，不在本地维护另一套副本
 Host 持有共享基础设施——注册表、持久化、会话查询、权限和 sandbox 策略；每个会话则获得一个隔离的 Agent scope，并由 **Agent Preset** 进行组合：
 
 - `standard`——功能完整的通用编码 Agent
-- `code`——面向 Code Mode / PTC 的多操作工作流
-- `minimal`——只保留持久 shell 和 `str_replace_editor`
+- `ptc`——面向 PTC（原 Code Mode）的多操作工作流；旧名称 `code` 仍可使用
+- `minimal`——仅保留持久 shell 的单工具精简组合
 - `cordis`——完整 Agent，加上运行时检查与 Preset 编写指导
 - 用户预设——自行定义工具、提示词段落、技能、上下文压缩、plan mode 与 subagent 行为
 
@@ -223,7 +226,7 @@ Host 持有共享基础设施——注册表、持久化、会话查询、权限
 
 ### 3. 会话记录与恢复
 
-提示词、流式 chunk、工具调用与结果、模型选择、plan 状态、权限、标题和 preset 选择都由持久 Session 事件投影得到。会话恢复、导出、历史检查、上下文统计和终端重放使用同一份记录。
+提示词、工具调用与结果、模型选择、plan 状态、权限、标题和 preset 选择都由持久 Session 事件投影得到；会话恢复、导出、历史检查、上下文统计和终端重放使用同一份记录。实时流式文本经进程内流帧呈现，落盘日志只保留装配完成的回复（内嵌计时流），两者在重放时得到同一视图。
 
 React state 只保存输入草稿、光标、当前面板、选中项和滚动位置等临时界面状态。
 

package/bin/deepseek.mjs

@@ -4,7 +4,7 @@ import { spawn, spawnSync } from 'node:child_process'
 import { existsSync, readFileSync, realpathSync } from 'node:fs'
 import { createRequire } from 'node:module'
 import { homedir } from 'node:os'
-import { join, resolve } from 'node:path'
+import { dirname, join, resolve } from 'node:path'
 import { fileURLToPath, pathToFileURL } from 'node:url'
 
 const packageRequire = createRequire(import.meta.url)
@@ -49,6 +49,165 @@ export function profileHasDshCode(profileDir = cliProfileDir(), fileExists = exi
   }
 }
 
+/** The dsh-code dependency the cli profile declares (e.g. '1.0.5' or 'link:C:/repo'). */
+export function profileDependencySpec(profileDir = cliProfileDir(), fileExists = existsSync, readFile = readFileSync) {
+  const manifest = join(profileDir, 'package.json')
+  if (!fileExists(manifest)) return undefined
+  try {
+    const raw = JSON.parse(readFile(manifest, 'utf8'))
+    const spec = raw?.dependencies?.['dsh-code']
+    return typeof spec === 'string' ? spec : undefined
+  } catch {
+    return undefined
+  }
+}
+
+/** The dsh-code version the cli profile actually resolves and boots. */
+export function profileMountedVersion(profileDir = cliProfileDir(), fileExists = existsSync, readFile = readFileSync) {
+  const manifest = join(profileDir, 'node_modules', 'dsh-code', 'package.json')
+  if (!fileExists(manifest)) return undefined
+  try {
+    return JSON.parse(readFile(manifest, 'utf8'))?.version ?? undefined
+  } catch {
+    return undefined
+  }
+}
+
+/**
+ * Profile-installed harness plugins that a line upgrade must carry along:
+ * every `@deepseek-ai/dsh-*` dependency except the dsh-code target itself
+ * and local checkouts (`link:`/`file:` stay untouched). Users install these
+ * through `dsh plugin add` once; without this pass `update --apply` would
+ * move the host and dsh-code forward and silently leave every other plugin
+ * pinned to the old line.
+ * @param profileDir - the cli profile root.
+ * @returns dependency entries as `{ name, spec }` in manifest order.
+ */
+export function profilePluginDependencies(profileDir = cliProfileDir(), fileExists = existsSync, readFile = readFileSync) {
+  const manifest = join(profileDir, 'package.json')
+  if (!fileExists(manifest)) return []
+  let dependencies
+  try {
+    dependencies = JSON.parse(readFile(manifest, 'utf8'))?.dependencies
+  } catch {
+    return []
+  }
+  if (typeof dependencies !== 'object' || dependencies === null) return []
+  const plugins = []
+  for (const [name, spec] of Object.entries(dependencies)) {
+    if (typeof spec !== 'string') continue
+    if (!name.startsWith('@deepseek-ai/dsh-')) continue
+    if (name === 'dsh-code' || name === '@deepseek-ai/dsh-base') continue
+    if (/^(link|file):/iu.test(spec)) continue
+    plugins.push({ name, spec })
+  }
+  return plugins
+}
+
+/** The harness release line a dsh-code release expects, read from its peers. */
+export function harnessLineFromPeers(peers) {
+  if (typeof peers !== 'object' || peers === null) return undefined
+  const anchor = peers['@deepseek-ai/dsh-session']
+  if (typeof anchor === 'string' && anchor !== '') return anchor
+  for (const [name, spec] of Object.entries(peers)) {
+    if (name.startsWith('@deepseek-ai/dsh-') && typeof spec === 'string' && spec !== '') return spec
+  }
+  return undefined
+}
+
+/**
+ * Decide what `update --apply` installs. The global DSH launcher is pinned
+ * to the harness line the target dsh-code release declares in its peers,
+ * so the launcher can never move ahead of the plugin it must boot. A
+ * profile that mounts a local checkout (link:/file:) keeps its mount.
+ */
+export function updatePlan({ latestCode, peers, profileSpec, profilePlugins = [] }) {
+  const line = harnessLineFromPeers(peers)
+  const profileStep = !(typeof profileSpec === 'string' && /^(link|file):/iu.test(profileSpec))
+  return {
+    dshSpec: line === undefined ? '@deepseek-ai/dsh@latest' : `@deepseek-ai/dsh@${line}`,
+    line: line === undefined ? undefined : line,
+    lineLocked: line !== undefined,
+    codeSpec: `dsh-code@${latestCode}`,
+    profileStep,
+    // Companion plugins the profile installed through `dsh plugin add`:
+    // carried to the same line so one command moves the whole profile.
+    pluginSpecs: line === undefined || !profileStep ? [] : profilePlugins
+      .filter(plugin => plugin.spec !== line)
+      .map(plugin => `${plugin.name}@${line}`),
+  }
+}
+
+/**
+ * Compare two @deepseek-ai/dsh release-line versions (`0.1.x`, `0.1.x-rc.N`,
+ * `0.1.x-alpha.N`). Positive when `left` is newer, negative when older, and 0
+ * on equality or an unparseable value (an unreadable version never blocks an
+ * update — release semantics follow semver prerelease ordering: final > rc >
+ * beta > alpha).
+ */
+export function compareHarnessLines(left, right) {
+  const parse = (value) => {
+    const match = /^(\d+)\.(\d+)\.(\d+)(?:-(alpha|beta|rc)\.(\d+))?$/.exec(String(value))
+    if (match === null) return undefined
+    return {
+      core: [Number(match[1]), Number(match[2]), Number(match[3])],
+      tag: match[4] === undefined ? 3 : { alpha: 0, beta: 1, rc: 2 }[match[4]],
+      num: match[5] === undefined ? 0 : Number(match[5]),
+    }
+  }
+  const a = parse(left)
+  const b = parse(right)
+  if (a === undefined || b === undefined) return 0
+  for (let index = 0; index < 3; index += 1) {
+    if (a.core[index] !== b.core[index]) return a.core[index] - b.core[index]
+  }
+  if (a.tag !== b.tag) return a.tag - b.tag
+  return a.num - b.num
+}
+
+/**
+ * The globally installed @deepseek-ai/dsh version, when one exists across the
+ * npm global roots this launcher may boot from. An update whose plan targets a
+ * line OLDER than this would silently downgrade the booted host.
+ */
+export function installedGlobalDshVersion(roots = globalDshRoots(), fileExists = existsSync, readFile = readFileSync) {
+  for (const root of roots) {
+    const manifest = join(root, 'node_modules', '@deepseek-ai', 'dsh', 'package.json')
+    if (!fileExists(manifest)) continue
+    try {
+      const version = JSON.parse(readFile(manifest, 'utf8'))?.version
+      if (typeof version === 'string' && version !== '') return version
+    } catch {
+      // Unreadable manifest: try the next root.
+    }
+  }
+  return undefined
+}
+
+/** Run wrapper-owned child steps in order, stopping at the first failure. */
+export function runSequence(steps, spawnProcess = spawn) {
+  return new Promise(resolve => {
+    const run = index => {
+      const step = steps[index]
+      if (step === undefined) {
+        resolve(0)
+        return
+      }
+      const needsShell = process.platform === 'win32' && /\.(cmd|bat)$/iu.test(step.command)
+      const child = spawnProcess(step.command, step.args, { stdio: 'inherit', ...(needsShell ? { shell: true } : {}) })
+      child.once('error', error => {
+        console.error(`dsh-code: ${step.label} failed: ${error.message}`)
+        resolve(1)
+      })
+      child.once('exit', (code, signal) => {
+        if (code === 0) run(index + 1)
+        else resolve(code ?? 1)
+      })
+    }
+    run(0)
+  })
+}
+
 /** Npm global-prefix roots that may contain DSH when this launcher is globally linked to a checkout. */
 export function globalDshRoots() {
   return [...new Set([
@@ -133,6 +292,175 @@ function launchChild(command, args) {
   return child
 }
 
+/**
+ * How to invoke npm. The JavaScript entrypoint is preferred: running it
+ * with this process's node avoids the Windows .cmd shim, whose shell
+ * workaround draws a Node deprecation warning on every call.
+ */
+export function npmInvocation({
+  fileExists = existsSync,
+  roots = globalDshRoots(),
+  resolvePackage = packageRequire.resolve,
+} = {}) {
+  const besideNode = join(dirname(process.execPath), 'node_modules', 'npm', 'bin', 'npm-cli.js')
+  if (fileExists(besideNode)) return { command: process.execPath, args: [besideNode] }
+  for (const root of roots) {
+    try {
+      const cli = resolvePackage('npm/bin/npm-cli.js', { paths: [root] })
+      return { command: process.execPath, args: [cli] }
+    } catch {
+      // The next configured global prefix may own npm instead.
+    }
+  }
+  return { command: process.platform === 'win32' ? 'npm.cmd' : 'npm', args: [] }
+}
+
+/**
+ * Read one `npm view` field as JSON, or undefined when the query fails.
+ * The subject arrives as argument parts: without a shell, a space inside
+ * one argument would reach npm as a single selector and fail.
+ */
+function viewJson(subjectParts, spawnCommand = spawnSync, invocation = npmInvocation()) {
+  const needsShell = process.platform === 'win32' && /\.(cmd|bat)$/iu.test(invocation.command)
+  const result = spawnCommand(invocation.command, [...invocation.args, 'view', ...subjectParts, '--json'], { encoding: 'utf8', windowsHide: true, ...(needsShell ? { shell: true } : {}) })
+  if (result.status !== 0) return undefined
+  try {
+    return JSON.parse(result.stdout)
+  } catch {
+    return undefined
+  }
+}
+
+/**
+ * The version of @deepseek-ai/dsh this launcher would boot, when present.
+ * Probes the same surfaces rawDshCommand resolves: the adjacent global
+ * install first, then every configured npm global prefix.
+ */
+function installedDshVersion({
+  platform = process.platform,
+  moduleUrl = import.meta.url,
+  fileExists = existsSync,
+  roots = globalDshRoots(),
+  resolvePackage = packageRequire.resolve,
+} = {}) {
+  const readVersion = path => {
+    try {
+      return JSON.parse(readFileSync(path, 'utf8')).version
+    } catch {
+      return undefined
+    }
+  }
+  if (platform === 'win32') {
+    const adjacent = fileUrlToWindowsPath(new URL('../../@deepseek-ai/dsh/package.json', moduleUrl))
+    if (fileExists(adjacent)) return readVersion(adjacent)
+  } else {
+    try {
+      const adjacent = fileURLToPath(new URL('../../@deepseek-ai/dsh/package.json', moduleUrl))
+      if (fileExists(adjacent)) return readVersion(adjacent)
+    } catch {
+      // A non-file URL or an unreadable sibling falls through to the roots.
+    }
+  }
+  for (const root of roots) {
+    try {
+      return readVersion(resolvePackage('@deepseek-ai/dsh/package.json', { paths: [root] }))
+    } catch {
+      // The next configured global prefix may own DSH instead.
+    }
+  }
+  return undefined
+}
+
+/** Show what is installed, what is latest, and what the cli profile boots. */
+function printUpdateStatus() {
+  const codeLatest = viewJson(['dsh-code', 'version'])
+  const dshLatest = viewJson(['@deepseek-ai/dsh', 'version'])
+  const dshInstalled = installedDshVersion()
+  const spec = profileDependencySpec()
+  const mounted = profileMountedVersion()
+  console.log(`dsh-code: ${packageVersion} (this launcher), latest ${codeLatest ?? 'unknown'}`)
+  console.log(`@deepseek-ai/dsh: ${dshInstalled ?? 'not found'} (global), latest ${dshLatest ?? 'unknown'}`)
+  console.log(`cli profile: ${mounted !== undefined ? `dsh-code ${mounted}` : spec ?? 'not mounted'}`)
+  console.log('Run `deepseek update --apply` to upgrade the global packages and the cli profile together.')
+}
+
+/**
+ * Upgrade the global launcher and the cli profile plugin together. The
+ * global install is pinned to the harness line the new dsh-code release
+ * declares, the profile follows through `dsh plugin add` with the same
+ * pinned spec, and the mounted version is verified at the end.
+ */
+async function applyUpdate({
+  view = viewJson,
+  resolveCommand = rawDshCommand,
+  spawnProcess = spawn,
+} = {}) {
+  const npm = npmInvocation()
+  const latestCode = view(['dsh-code', 'version'], undefined, npm)
+  if (latestCode === undefined) {
+    console.error('dsh-code: could not read the latest dsh-code version from npm')
+    process.exitCode = 1
+    return
+  }
+  const peers = view([`dsh-code@${latestCode}`, 'peerDependencies'], undefined, npm)
+  const plan = updatePlan({
+    latestCode,
+    peers,
+    profileSpec: profileDependencySpec(),
+    profilePlugins: profilePluginDependencies(),
+  })
+  if (!plan.lineLocked) {
+    console.log('dsh-code: could not read the compatible harness line; installing @deepseek-ai/dsh@latest')
+  }
+  // Downgrade guard: the latest published dsh-code may still pin an older
+  // harness line than the host already installed globally (a release-ordering
+  // window). Installing would silently downgrade every existing session's
+  // booted host, and a link-mounted profile would end up on a mismatched pair
+  // with no warning — refuse instead and name the manual command.
+  const installed = installedGlobalDshVersion()
+  if (plan.line !== undefined && installed !== undefined && compareHarnessLines(plan.line, installed) < 0) {
+    console.error(`dsh-code: dsh-code@${latestCode} needs @deepseek-ai/dsh@${plan.line}, but ${installed} is already installed globally`)
+    console.error(`dsh-code: refusing to downgrade the host; to proceed anyway run: npm install -g @deepseek-ai/dsh@${plan.line} dsh-code@${latestCode}`)
+    process.exitCode = 1
+    return
+  }
+  const steps = [{ command: npm.command, args: [...npm.args, 'install', '-g', plan.dshSpec, plan.codeSpec], label: 'npm install' }]
+  if (plan.profileStep) {
+    const command = resolveCommand(['plugin', '--profile', 'cli', 'add', plan.codeSpec])
+    if (command === undefined) {
+      console.error('dsh-code: could not resolve the dsh command for the profile update')
+      process.exitCode = 1
+      return
+    }
+    steps.push({ command: command.command, args: command.args, label: 'dsh plugin add' })
+    // Companion plugins ride the same line: without this, `dsh plugin add`-ed
+    // extras stay pinned to the old harness line after an upgrade.
+    for (const pluginSpec of plan.pluginSpecs) {
+      const pluginCommand = resolveCommand(['plugin', '--profile', 'cli', 'add', pluginSpec])
+      if (pluginCommand === undefined) {
+        console.error(`dsh-code: could not resolve the dsh command for ${pluginSpec}`)
+        process.exitCode = 1
+        return
+      }
+      steps.push({ command: pluginCommand.command, args: pluginCommand.args, label: `dsh plugin add ${pluginSpec}` })
+    }
+    if (plan.pluginSpecs.length > 0) {
+      console.log(`carrying ${plan.pluginSpecs.length} profile plugin${plan.pluginSpecs.length === 1 ? '' : 's'} to the same line: ${plan.pluginSpecs.join(', ')}`)
+    }
+  } else {
+    console.log('cli profile mounts a local checkout; leaving the profile untouched')
+  }
+  const code = await runSequence(steps, spawnProcess)
+  const mounted = profileMountedVersion()
+  if (mounted !== undefined) console.log(`cli profile now mounts dsh-code ${mounted}`)
+  if (code === 0 && plan.profileStep && mounted !== latestCode) {
+    console.error(`dsh-code: the cli profile still mounts ${mounted ?? 'nothing'}; run: dsh plugin --profile cli add ${plan.codeSpec}`)
+    process.exitCode = 1
+    return
+  }
+  process.exitCode = code
+}
+
 /** Run one wrapper-owned operational command. */
 export function launchOperation(args = process.argv.slice(2)) {
   const operation = operationName(args)
@@ -161,17 +489,14 @@ export function launchOperation(args = process.argv.slice(2)) {
     }
     return launchChild(command.command, command.args)
   }
-  if (args.includes('--apply')) {
-    return launchChild(process.platform === 'win32' ? 'npm.cmd' : 'npm', ['install', '-g', '@deepseek-ai/dsh', 'dsh-code'])
-  }
-  const npm = process.platform === 'win32' ? 'npm.cmd' : 'npm'
-  const needsShell = process.platform === 'win32' && /\.(cmd|bat)$/iu.test(npm)
-  for (const name of ['@deepseek-ai/dsh', 'dsh-code']) {
-    const result = spawnSync(npm, ['view', name, 'version'], { encoding: 'utf8', windowsHide: true, ...(needsShell ? { shell: true } : {}) })
-    console.log(`${name}: ${result.status === 0 ? String(result.stdout).trim() : 'version check failed'}`)
+  if (operation === 'update') {
+    if (args.includes('--apply')) {
+      void applyUpdate()
+      return true
+    }
+    printUpdateStatus()
+    return true
   }
-  console.log('Run `deepseek update --apply` to install the latest versions.')
-  return true
 }
 
 /** Launch the installed DSH CLI while preserving its exit status and stdio. */

package/cordis.patch.yml

@@ -7,9 +7,12 @@
 # dispatches slash commands through the shared registry, and folds submitted
 # prompts back into the same durable session until the user quits.
 
+# 0.1.5 split the deployment persona into a prefix and a suffix template
+# around the first-party guidance sections; this terminal keeps its identity
+# line as the prefix ({{variable}} interpolation stays strict upstream).
 - id: system-prompt
   config:
-    persona: >-
+    personaPrefix: >-
       You are a coding agent powered by the {{model}} model. Your working directory is {{cwd}}.
 
 # The shared module-reload HMR row stays off; the launcher's watch-only
@@ -34,12 +37,18 @@
   disabled: true
 - id: tool-fs-search
   disabled: true
-- id: tool-str-replace-editor
-  disabled: true
+# skill-filesystem stays ENABLED on the host: it only feeds the skill
+# REGISTRY (local-root discovery), never the model-facing tool surface —
+# tool-skill below stays disabled and presets mount it per session. The
+# terminal offers skills in the slash menu before any session exists, and a
+# bare launch has no preset layer yet, so the registry's global layer needs
+# this provider; presets shadow it with the same discovery on their scope.
 - id: skill-filesystem
-  disabled: true
+  disabled: false
 - id: tool-skill
   disabled: true
+- id: command-goal
+  disabled: true
 - id: tool-goal
   disabled: true
 - id: plan-mode
@@ -68,15 +77,11 @@
   disabled: true
 - id: tool-todo
   disabled: true
-- id: tool-web
-  config:
-    # web_fetch is a core TUI capability, not an opt-in: the fetch provider
-    # (web-fetch-http below) needs no API key. The per-preset tool-web rows
-    # keep `fetch: false` on the agent plane; through the scope-layered tool
-    # registry the preset's web_search shadows the host's same-name tool while
-    # the host's web_fetch stays visible, so every model still sees both.
-    fetch: true
-    searchTimeoutMs: 60000
+# tool-web keeps the 0.1.5-rc.1 base default (web_fetch enabled over the
+# bundled web-fetch-http provider): the host row exposes web_fetch while the
+# per-preset agent-plane rows keep their own fetch stance. The upstream base
+# bundle dropped tool-str-replace-editor entirely in 0.1.5 (the minimal
+# preset became a single-tool composition), so this patch no longer lists it.
 
 - insert:
     # Code Mode is a core execution capability, not a Web component.
@@ -111,11 +116,14 @@
     - id: cordis-host-runner
       name: '@deepseek-ai/dsh-cordis-host-runner'
 
-    # Anonymous public HTTP(S) fetch provider for web_fetch (no key): the web
-    # service and its search provider stay on the host plane (dsh-base), and
-    # this row is what makes fetching real URLs work out of the box.
-    - id: web-fetch-http
-      name: '@deepseek-ai/dsh-web-fetch-http'
+    # Host-owned opt-in the preset delegation tools sample: standard/ptc's
+    # tool-subagent rows set `modelSelectionSettings: true`, whose start
+    # resolves this service and fails the whole preset mount when absent
+    # ("failed to apply loader entry delegation (cordis:group)"). The upstream
+    # web-app bundle carries this host row in 0.1.5-rc.1; dsh-base still does
+    # not ship it.
+    - id: subagent-model-selection-settings
+      name: '@deepseek-ai/dsh-tool-subagent/model-selection-settings'
 
     # Interactive provider authorization. The base bundle supplies the
     # credential store; mounting the neutral authorization seam wakes the