dsh-codex-connect 0.1.0-alpha.4.32 → 0.1.0-alpha.4.34

package/INSTALL.md

@@ -1,6 +1,6 @@
 # Installation Runbook for CLI Agents
 
-Alpha 4.31 is verified with DSH `0.1.2-rc.1` and its declared pi-ai range `^0.84.2`.
+Alpha 4.33 is verified with DSH `0.1.2-rc.1` and pi-ai `0.84.4` within `^0.84.2`, and with DSH `0.1.5-alpha.1` and pi-ai `0.85.1`.
 
 Install `dsh-codex-connect` into one requested DeepSeek Harness profile without changing its current default model, search route, global configuration, or OAuth state.
 
@@ -23,14 +23,15 @@ Check `dsh --version` before changing the requested profile. Use `dsh --help` to
 | `0.1.0-rc.7` | `0.1.0-alpha.4.14` |
 | `0.1.1-rc.2` | `0.1.0-alpha.4.21` |
 | `0.1.2-alpha.2` | `0.1.0-alpha.4.23` |
-| `0.1.2-rc.1` | `0.1.0-alpha.4.31` |
+| `0.1.2-rc.1` | `0.1.0-alpha.4.33` |
 | `0.1.2-alpha.5` | `0.1.0-alpha.4.25` |
+| `0.1.5-alpha.1` | `0.1.0-alpha.4.33` |
 
-If your exact DSH version is unknown or not listed, stop and verify the combination before installing. Do not blindly install `dsh-codex-connect@alpha`: `alpha` is a moving tag, not a compatibility guarantee. Do not infer support for newer DSH versions from these rows.
+If your exact DSH version is unknown or not listed, preserve the installed host, report that the combination is unverified, and verify it before making installation changes. A missing record does not prove incompatibility, and the catalog's latest verified DSH version is not the latest upstream release. Do not recommend upgrading or downgrading DSH merely to match a row. Investigate any specific failure and seek verification of the installed combination. Do not blindly install `dsh-codex-connect@alpha`: `alpha` is a moving tag, not a compatibility guarantee. Do not infer support for newer DSH versions from these rows.
 
-Alpha 4.31's verified contract is DSH plugin API packages `0.1.2-rc.1`, `@earendil-works/pi-ai` `^0.84.2`, and Node.js `^22.19.0 || >=24.0.0`. Alpha 4.25 remains the verified choice for DSH `0.1.2-alpha.5`, Alpha 4.23 remains the verified choice for DSH `0.1.2-alpha.2`, Alpha 4.21 remains the verified choice for DSH `0.1.1-rc.2`, and staying on DSH `0.1.0-rc.7` means selecting Alpha 4.14. Upgrading DSH is a separate decision: upgrade the DSH API packages and pi-ai together, then rerun `dsh-codex-connect doctor --json` and `pnpm --silent run check:compatibility` for the selected combination.
+Alpha 4.33 requires one consistent DSH plugin API version: `0.1.2-rc.1` with `@earendil-works/pi-ai` `^0.84.2`, or `0.1.5-alpha.1` with pi-ai `0.85.1`; Node.js remains `^22.19.0 || >=24.0.0`. Mixed host versions and other DSH/pi-ai combinations remain unverified. Alpha 4.25 remains the verified choice for DSH `0.1.2-alpha.5`, Alpha 4.23 remains the verified choice for DSH `0.1.2-alpha.2`, Alpha 4.21 remains the verified choice for DSH `0.1.1-rc.2`, and staying on DSH `0.1.0-rc.7` means selecting Alpha 4.14. Changing DSH is a separate operation requiring the user's explicit request; a plugin update request does not authorize it. The repository's `pnpm --silent run check:compatibility` remains a strict development/release dependency gate, not a recommendation to change a user's host.
 
-The Alpha 4.31 row reflects a fresh isolated installation and runtime probe. Historical rows remain the repository's existing verification record. This guidance does not change upstream DSH behavior or resolve [Issue #64](https://github.com/franksong2702/dsh-codex-connect/issues/64).
+The Alpha 4.33 rows reflect same-artifact isolated installation and runtime checks, bounded real-account calls, and isolated upgrades from Alpha 4.32. Fresh OAuth and manual callback acceptance used the real implementation through a temporary acceptance page. See [.github/ALPHA_433_RELEASE_READINESS.md](https://github.com/franksong2702/dsh-codex-connect/blob/main/.github/ALPHA_433_RELEASE_READINESS.md) for commands and verification limits. Historical rows remain the repository's existing verification record. This guidance does not change upstream DSH behavior or resolve [Issue #64](https://github.com/franksong2702/dsh-codex-connect/issues/64).
 
 ### Install the selected version and validate
 
@@ -53,10 +54,10 @@ The Alpha 4.31 row reflects a fresh isolated installation and runtime probe. His
    dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.23
    ```
 
-   For DSH `0.1.2-rc.1`, use Alpha 4.31:
+   For DSH `0.1.2-rc.1` or `0.1.5-alpha.1`, use Alpha 4.33:
 
    ```sh
-   dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.31
+   dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.33
    ```
 
    For DSH `0.1.2-alpha.5`, use Alpha 4.25:
@@ -65,7 +66,7 @@ The Alpha 4.31 row reflects a fresh isolated installation and runtime probe. His
    dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.25
    ```
 
-   If npm is unavailable after the matching GitHub prerelease is created, use `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.21'` only for the DSH `0.1.1-rc.2` combination, `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.23'` only for the DSH `0.1.2-alpha.2` combination, `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.25'` only for the DSH `0.1.2-alpha.5` combination, or `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.31'` only for the DSH `0.1.2-rc.1` combination.
+   If npm is unavailable after the matching GitHub prerelease is created, use `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.21'` only for the DSH `0.1.1-rc.2` combination, `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.23'` only for the DSH `0.1.2-alpha.2` combination, `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.25'` only for the DSH `0.1.2-alpha.5` combination, or `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.33'` only for the DSH `0.1.2-rc.1` or `0.1.5-alpha.1` combinations.
 
 3. Run `dsh web --help` once to compose the installed profile without starting the server. DSH `0.1.2-rc.1` prepares profile plugin dependency fallback during this step.
 4. Run `dsh --profile web --dump-config` and require exactly one `llm-openai-codex` row loading `dsh-codex-connect`.
@@ -122,6 +123,8 @@ Do not add a separate `web` row for this UI action. Do not add the `agent-defaul
 
 ## Update and removal
 
+The update card checks Codex Connect releases only. It does not assess the installed host or recommend a DSH upgrade or downgrade. Run `doctor --json` explicitly for local dependency diagnostics; an `unverified` result (and its nonzero exit code) means the installed combination is outside the declared support set, not that it is known to fail. See the [diagnostic statuses](docs/reference.md#local-installation-diagnostics).
+
 Before updating, repeat the exact-version selection above. Use `@alpha` only after verifying that the version it currently resolves to is compatible with the installed DSH; otherwise pin the selected version in the update command.
 
 ```sh

package/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   git hash-object README.md docs/README.zh.md
-README.md: b3d0bdd487da3988c277f9d6ed0cdd0ef3f62023
-docs/README.zh.md: 75b42211584eeaa14dfcc1b2aee451052d3c874f
+README.md: abaac5cb3f80c204f01c6b804fff06e649a75298
+docs/README.zh.md: fe1383a7deaeaf355782ee6cf79f296e0f3cbaad

package/README.md

@@ -16,15 +16,15 @@ This guide describes the published pairing below. Check `dsh --version` first; f
 
 | Requirement | Verified pairing |
 |---|---|
-| Codex Connect | `0.1.0-alpha.4.31` |
-| DeepSeek Harness | `0.1.2-rc.1` |
+| Codex Connect | `0.1.0-alpha.4.33` |
+| DeepSeek Harness | `0.1.2-rc.1` or `0.1.5-alpha.1` |
 | Node.js | `^22.19.0 \|\| >=24.0.0` |
 | Account | ChatGPT OAuth with access to the requested Codex model; availability is decided by OpenAI |
 
 ### 1. Install
 
 ```sh
-dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.31
+dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.33
 dsh web
 ```
 
@@ -34,7 +34,7 @@ Replace `web` with your existing profile name; use that same profile when starti
 
 Open **Settings → Models → Openai-Codex → Authorize**, then complete approval yourself in the browser. If an embedded window is blocked, select **Open ChatGPT sign-in page**. Choose an `openai-codex` model in the normal Harness model picker.
 
-Never paste an authorization URL, code, token, or account identifier into an issue, log, chat, or configuration file. For a browser on another device, follow [Remote browser authorization](docs/reference.md#remote-browser-authorization).
+Never paste an authorization URL, code, token, or account identifier into an issue, log, chat, or configuration file. For a browser on another device, the optional manual callback form can complete the pending login without forwarding the localhost callback port; follow [Remote browser authorization](docs/reference.md#remote-browser-authorization).
 
 ### 3. Check the installation
 
@@ -52,10 +52,10 @@ dsh plugin --profile web exec dsh-codex-connect doctor --json
 ## Core capabilities
 
 - **Accounts:** save up to 16 accounts on the DSH host and manually select the active account for subsequent requests. Account selection is not a per-session binding. Requests keep their captured account; the plugin does not rotate accounts or silently fail over.
-- **Models and Astra support:** the currently verified DSH and plugin combination supports `gpt-6-astra`. The plugin supplies its missing model definition with Low, Medium, High, Xhigh, and Max reasoning levels; Default preserves the provider default. Saved Off/Minimal selections require an [explicit update](MIGRATION.md#astra-reasoning-selections). When the installed dependency catalog includes Astra, the plugin prefers its native definition. A model appearing in the list does not mean the current account has permission to use it; overall compatibility with new dependency versions still requires separate verification.
+- **Models and Astra support:** the currently verified DSH and plugin combination supports `gpt-6-astra`. The plugin supplies its missing model definition with Low, Medium, High, Xhigh, and Max reasoning levels; Default preserves the provider default. Saved Off/Minimal selections require an [explicit update](MIGRATION.md#astra-reasoning-selections). When the installed dependency catalog includes Astra, the plugin preserves its native metadata while retaining these five calibrated reasoning choices. A model appearing in the list does not mean the current account has permission to use it; overall compatibility with new dependency versions still requires separate verification.
 - **Fast Mode:** request priority service for one conversation, off by default. Actual speed and quota consumption depend on the service; no fixed speed multiplier is guaranteed.
 - **Quota:** show the server-returned `5h` and `7d` windows and reset times, normally refreshed every 60 seconds while signed in. Missing windows are not invented; Spark uses its separate quota bucket.
-- **Update guidance:** compare the installed DSH/plugin pair with the public verification record without installing an upgrade.
+- **Plugin updates:** check for newer Codex Connect releases without installing anything or recommending changes to DSH. Host compatibility is available through explicit local diagnostics.
 
 <p align="center">
   <img src="https://raw.githubusercontent.com/franksong2702/dsh-codex-connect/main/docs/assets/composer-capabilities.jpg" alt="Fast Mode and quota controls in the DeepSeek Harness Composer" width="820">

package/VERSIONING.md

@@ -56,7 +56,7 @@ Follow [RELEASING.md](RELEASING.md) for the complete procedure. Run the frozen i
 pnpm install --frozen-lockfile
 pnpm run check
 pnpm run test:browser
-pnpm run check:dsh-install
+pnpm run check:dsh-matrix
 npm pack --dry-run
 ```
 

package/compatibility.json

@@ -5,6 +5,7 @@
   },
   "dshPluginApi": {
     "version": "0.1.2-rc.1",
+    "versions": ["0.1.2-rc.1", "0.1.5-alpha.1", "0.1.5-rc.1", "0.1.5-rc.2"],
     "packages": [
       "@deepseek-ai/dsh-agent",
       "@deepseek-ai/dsh-atomic-write",
@@ -24,6 +25,6 @@
   },
   "piAi": {
     "package": "@earendil-works/pi-ai",
-    "version": "^0.84.2"
+    "version": "^0.84.2 || 0.85.1"
   }
 }

package/docs/README.zh.md

@@ -16,15 +16,15 @@ Codex Connect 为标准 Harness agent loop 添加 `openai-codex` 模型提供方
 
 | 要求 | 已验证组合 |
 |---|---|
-| Codex Connect | `0.1.0-alpha.4.31` |
-| DeepSeek Harness | `0.1.2-rc.1` |
+| Codex Connect | `0.1.0-alpha.4.33` |
+| DeepSeek Harness | `0.1.2-rc.1` 或 `0.1.5-alpha.1` |
 | Node.js | `^22.19.0 \|\| >=24.0.0` |
 | 账户 | 通过 ChatGPT OAuth 使用所请求的 Codex 模型；可用性由 OpenAI 决定 |
 
 ### 1. 安装
 
 ```sh
-dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.31
+dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.33
 dsh web
 ```
 
@@ -34,7 +34,7 @@ dsh web
 
 打开 **设置 → 模型 → Openai-Codex → 授权**，然后亲自在浏览器中完成批准。如果内嵌窗口被拦截，请用 **打开 ChatGPT 登录页面**。在 Harness 的常规模型选择器中选择一个 `openai-codex` 模型。
 
-不要把授权 URL、code、token 或账户标识粘贴到 issue、日志、聊天或配置文件中。在另一台设备上使用浏览器时，请遵循[远程浏览器授权](reference.zh.md#远程浏览器授权)说明。
+不要把授权 URL、code、token 或账户标识粘贴到 issue、日志、聊天或配置文件中。在另一台设备上使用浏览器时，可通过默认收起的手动回调表单完成当前登录，无需转发 localhost 回调端口；请遵循[远程浏览器授权](reference.zh.md#远程浏览器授权)说明。
 
 ### 3. 检查安装
 
@@ -52,10 +52,10 @@ dsh plugin --profile web exec dsh-codex-connect doctor --json
 ## 核心能力
 
 - **账户：**在 DSH 主机上保存最多 16 个账户，手动选择后续请求使用的活动账户，不按会话绑定。请求保持已固定的账户，插件不会自动轮换或静默故障切换。
-- **模型与 Astra 支持：**当前已验证的 DSH 与插件组合已支持 `gpt-6-astra`。插件补充缺失的模型定义，提供 Low、Medium、High、Xhigh 和 Max 五档推理强度；Default 保持提供方默认值。已保存的 Off/Minimal 选择需要[明确更新](../MIGRATION.md#astra-reasoning-selections)。未来使用的依赖目录包含 Astra 时，插件会优先采用其原生定义。模型出现在列表中，不代表当前账户具有调用权限；新依赖版本的整体兼容性仍需单独验证。
+- **模型与 Astra 支持：**当前已验证的 DSH 与插件组合已支持 `gpt-6-astra`。插件补充缺失的模型定义，提供 Low、Medium、High、Xhigh 和 Max 五档推理强度；Default 保持提供方默认值。已保存的 Off/Minimal 选择需要[明确更新](../MIGRATION.md#astra-reasoning-selections)。安装的依赖目录包含 Astra 时，插件保留其原生元数据，同时维持这五档已校准的推理选择。模型出现在列表中，不代表当前账户具有调用权限；新依赖版本的整体兼容性仍需单独验证。
 - **Fast Mode：**为单个对话请求优先服务，默认关闭。实际速度和额度消耗取决于服务端，不保证固定提速倍数。
 - **额度：**显示服务端返回的 `5h`、`7d` 窗口及重置时间，已登录时通常每 60 秒刷新一次。不虚构缺失窗口；Spark 使用独立额度桶。
-- **更新指引：**将已安装的 DSH/plugin 组合与公开验证记录比较，但不会自动执行升级。
+- **插件更新：**检查 Codex Connect 新版本，不自动安装，也不建议更改 DSH。宿主兼容性信息通过主动运行的本地诊断查看。
 
 <p align="center">
   <img src="https://raw.githubusercontent.com/franksong2702/dsh-codex-connect/main/docs/assets/composer-capabilities.jpg" alt="DeepSeek Harness Composer 中的 Fast Mode 与额度控件" width="820">

package/docs/VERSIONING.zh.md

@@ -56,7 +56,7 @@ V1 亮点条目按 SemVer 递增排列，版本唯一，能力类别必须已知
 pnpm install --frozen-lockfile
 pnpm run check
 pnpm run test:browser
-pnpm run check:dsh-install
+pnpm run check:dsh-matrix
 npm pack --dry-run
 ```
 

package/docs/agent-notes/canary-unverified-doctor.md

@@ -0,0 +1,9 @@
+# Unverified candidate diagnostics
+
+Issues #164 and #169 stopped at the installed doctor before runtime validation. PR #168 changed out-of-range dependencies from `incompatible` to `unverified` while retaining doctor exit code 1. The candidate checker still classified that exit as a compatibility failure, so a version outside declared support could receive a bug tracker without runtime evidence.
+
+Only explicit undeclared-candidate checks accept a validated `unverified` report with exit code 1 and continue to the existing runtime check. Required package metadata, exact installed DSH candidate versions, compatible Node, credential checks, privacy checks, network classification, and unexpected process failures remain enforced. Declared checks, doctor behavior, supported dependencies, and the verification catalog are unchanged. Passing this bounded check still requires full test-profile validation before support can be declared.
+
+The checker regression reproduces the candidate warning and rejects missing or unknown dependencies, incorrect installed versions, Node mismatch, credential failures, private paths, unexpected exits, and network failures. Existing subprocess and tracker checks retain actual compatibility and infrastructure failure classifications.
+
+Validation on Node 26.5.0: the regression first failed on the valid unverified candidate, then `pnpm run check:canary-workflow` passed 49 workflow and 59 checker assertions. `pnpm run check` passed 715 tests, lint, typechecking, build, CLI checks, declared compatibility, and package checks; the final additional rejection cases passed the focused checker rerun. Real isolated checks of DSH `0.1.5-alpha.1` and `0.1.3-alpha.2` each passed with eight models, eight reasoning-model projections, unchanged defaults, and verified disposal. No model-provider request or real-account OAuth validation was performed.

package/docs/agent-notes/dual-dsh-release.md

@@ -0,0 +1,9 @@
+# One plugin artifact for two DSH targets
+
+Alpha 4.33 is prepared as one plugin release for DSH `0.1.2-rc.1` with pi-ai `^0.84.2` and DSH `0.1.5-alpha.1` with pi-ai `0.85.1`. The public compatibility record and installation recommendation are separate from these intended dependency targets and remain unchanged until release acceptance. The baseline `dshPluginApi.version` remains available to upstream discovery; its additive `versions` list names the exact declared installation targets. Package peers accept only those DSH versions, not an interval of untested releases. Runtime diagnostics reject mixed DSH package versions and mismatched DSH/pi-ai pairs.
+
+The alpha dependency probe found that native pi-ai Astra metadata reintroduced Minimal, bypassing the plugin's calibrated five-level fallback. Native names, limits, and other metadata are retained while the same reasoning exclusions and upper levels apply to both sources. A synthetic native catalog reproduces the regression under the baseline dependencies as well. The image restoration fixture transfers detached snapshots through the public SessionStore preparation API with the ownership metadata accepted by each target; production session persistence remains upstream-owned. Vendored OAuth verification uses a separately pinned development alias for pi-ai `0.84.4`, independent of the runtime provider version; the vendored files, local security patches, and source-version rejection remain unchanged.
+
+Both declared and undeclared installation checks use packed artifacts. The declared matrix requires every exact target, matching package versions and SHA-256 digests, unchanged host defaults, model reasoning metadata, and successful provider disposal. The weekly canary calls this matrix instead of its obsolete fixed host override. Future upstream discovery remains independent and does not certify a release.
+
+Release evidence and remaining acceptance gates are tracked in the repository's `.github/ALPHA_433_RELEASE_READINESS.md`. Automated checks and existing-token requests do not substitute for fresh OAuth login, cancellation, or complete optional-capability acceptance. No existing profile, account setting, deployment, or release is changed by these checks.

package/docs/agent-notes/oauth-manual-callback-validation.md

@@ -0,0 +1,44 @@
+# Manual OAuth callback validation (#170)
+
+## Scope
+
+Add an opt-in, initially collapsed full callback URL form to both Web account entries and forward it to the pending provider-native manual prompt. Keep the localhost listener, PKCE flow, trusted-origin policy, credential storage and cancellation semantics intact.
+
+## Maintainer follow-up (2026-09-09)
+
+Reviewed contributor commit `a6f671ac436446eda9e40e9f1a019acc169684a8` in an isolated checkout. The OAuth implementation and UI were retained. On macOS with Node.js 26.5.0 and pnpm 10.30.3, all 17 new client tests initially failed during cleanup because Vitest's `window` aliases the Node global and bare `localStorage` resolves to Node's unavailable storage. The test now explicitly installs jsdom's storage and clears it before restoring globals; its privacy assertion spies on the browser Storage prototype.
+
+- `pnpm install --frozen-lockfile`: exit 0.
+- `pnpm exec vitest run tests/account-callback.client.spec.tsx -t 'posts the full URL once'`: reproduced the cleanup failure before the fix (exit 1).
+- `pnpm exec vitest run tests/account-callback.client.spec.tsx`: exit 0 after the fix; 17 passed.
+- `pnpm run check`: exit 0 after the fix; 83 files / 715 tests passed, followed by build, environment-proxy import, capability CLI, compatibility and package checks. Initial sandbox socket restrictions were separated from the test failure by rerunning with host permissions.
+- `pnpm run test:browser`: exit 0; 8 files / 26 tests passed, including both manual callback entries. It ran against the unchanged contributor UI and synthetic network fixtures, after retrying a sandbox listener denial with host permissions.
+- Rebuilding produced no tracked `lib/` differences. No production profile, live account, or real OAuth credential was used.
+
+The contributor commit's [CI run](https://github.com/franksong2702/dsh-codex-connect/actions/runs/34332542206) passed both Node 22.19.0 / 24.x validation jobs, browser UI regressions and the Windows canary contract. Its [dependency review](https://github.com/franksong2702/dsh-codex-connect/actions/runs/34332542283) also passed. These links describe that exact contributor commit; the PR checks provide the subsequent maintainer commit's result.
+
+Real-account authorization from a remote browser remains a user acceptance step. Passing synthetic provider, HTTP and browser tests does not claim that acceptance occurred.
+
+## Contributor execution
+
+Environment: Windows, Node.js 24.18.0, pnpm 11.24.0, locked dependencies.
+
+- `pnpm install --frozen-lockfile`: exit 0.
+- `pnpm exec vitest run tests/oauth-manual-callback.spec.ts`: exit 0; 4 tests passed, exercising the real provider bridge with synthetic credentials and mocked network/listener boundaries.
+- `pnpm run check`: exit 1; workflow contracts, metadata/source lint and both TypeScript projects passed. Vitest reported **707 passed, 7 failed, 1 skipped** across 83 test files.
+  - All new non-browser regressions passed: `tests/auth-manual-callback.spec.ts` (65), `tests/account-callback.client.spec.tsx` (17), `tests/oauth-manual-callback.spec.ts` (4).
+  - Existing `tests/auth-routes.spec.ts` passed (38), as did the existing account and OAuth cancellation/socket suites.
+  - Four failures were in `tests/history-migration.spec.ts`: the implementation explicitly refuses apply-mode migration on Windows, while those cases expect apply behavior. That implementation and those tests were not changed.
+  - One failure was the unchanged versioning-policy bilingual hash check against CRLF working-tree bytes.
+  - Two failures were the README/reference bilingual hash records. Both records were subsequently refreshed to the reviewed, Git-normalized English/Chinese content. They were not rerun.
+  - Build, post-build import/CLI/compatibility and packaging stages were not reached by this command.
+- `pnpm run test:browser`: exit 1 before running tests; the required Playwright Chromium executable was absent. Browser download was not completed. The requester then asked to stop automatic testing; no further tests were run.
+- `pnpm run build`: exit 0 after the final edits. Generated `lib/` files came exclusively from this command. The `undici-runtime` split-chunk path matcher was made portable to Windows separators so rebuilding retains the existing dispatcher initialization boundary.
+
+Early attempts also encountered sandbox child-process restrictions and Windows checkout line-ending differences. Workflow files and pinned vendor source were restored to their upstream byte representation; neither has a content change in the PR.
+
+## Coverage and limits
+
+The added tests cover invalid/missing/duplicate state, redirect URI validation, one-shot submission, malformed/oversized requests, existing origin checks, timeout/cancellation/disposal, stale retry callbacks, automatic callback fallback, PKCE verifier continuity, transient UI input cleanup, fixed error feedback, and preservation of existing accounts. Browser test source additionally covers the English Models and Chinese Plugins entries, but was not executed.
+
+No real-account OAuth acceptance was performed. Network/token fixtures are synthetic and nonfunctional; no live authorization URL, code, token, account identifier or credential file was used as evidence. The contributor execution did **not** pass the complete check or browser suite. The contributor stopped automated testing as requested, including after the documentation-record and build-path adjustments; the later maintainer validation is recorded separately above.

package/docs/agent-notes/plugin-update-scope.md

@@ -0,0 +1,9 @@
+# Plugin update scope
+
+Issue #163 reported a newer installed DSH version alongside an update warning based on an older compatibility record. The public record tracks verified combinations, not the latest upstream DSH release. Absence from that record cannot establish runtime failure.
+
+Normal update checks now fetch only plugin release metadata and summaries. The update response, browser cache projection, and reminder contain no host version or compatibility verdict. Existing cached host fields are ignored. Successful plugin checks retain their original timestamp for up to 24 hours; unavailable checks retry every five minutes while mounted. Disposal still cancels retries and prevents late cache writes. This supersedes the host-verdict behavior described in `compatibility-refresh.md`.
+
+Explicit local doctor diagnostics distinguish declared matches, unverified package versions, missing metadata, and Node engine mismatches. Unverified diagnostics retain exit code 1 without claiming runtime failure or recommending host changes. Dependency declarations, the verification catalog, and the strict development/release gate are unchanged; this change does not certify newer DSH versions.
+
+Regression coverage exercises plugin-only requests and responses, old cache projection, manual retry and disposal, bilingual reminder behavior, and the diagnostic distinction for DSH 0.1.3-alpha.1. No host deployment or account operation is required.

package/docs/reference.i18n.yaml

@@ -1,4 +1,4 @@
 # Bilingual-pair consistency record for the operational reference. Re-record with:
 #   git hash-object docs/reference.md docs/reference.zh.md
-docs/reference.md: 591dd20f574fc5d79ebd0692d8b531b052390ee9
-docs/reference.zh.md: dee2a8a867fb72c9f324f76a7ec8a4fa55717f2d
+docs/reference.md: d3e3af704f0a40f35f8f99b422cb2606877b3861
+docs/reference.zh.md: 9b976d9b005c36a561d7a7fca74bb5250d518fb5

package/docs/reference.md

@@ -10,7 +10,7 @@ OAuth credentials are stored on the DSH host and used there to authenticate and
 
 Choose an `openai-codex` model in the normal Harness model picker. Model names remain canonical in every UI language. **More settings → Models** controls which models appear in discovery; hiding a model does not disable routing by its exact id.
 
-The Codex catalog comes from the installed `@earendil-works/pi-ai` package, not a live query of the account's available models. The verified DSH `0.1.2-rc.1` and Codex Connect `0.1.0-alpha.4.29` combination uses `pi-ai@0.84.4`, which lacks `gpt-6-astra`; Codex Connect supplies that definition. Upstream [pi-ai `0.85.1`](https://github.com/earendil-works/pi/releases/tag/v0.85.1) includes Astra, but it is outside the `^0.84.2` range declared by the corresponding DSH adapter and this plugin. Users do not need to upgrade pi-ai separately to select Astra. Adopting newer dependencies requires compatibility verification and updated dependency declarations; once the installed catalog supplies Astra, the plugin preserves that definition instead of adding its own. Neither catalog entry proves account access.
+The Codex catalog comes from the installed `@earendil-works/pi-ai` package, not a live query of the account's available models. DSH `0.1.2-rc.1` uses pi-ai `^0.84.2`, which lacks `gpt-6-astra`; Codex Connect supplies that definition. Alpha 4.33 is also verified with DSH `0.1.5-alpha.1` and pi-ai `0.85.1`. Mixed host package versions and other DSH/pi-ai combinations remain unverified. With a native Astra entry, the plugin preserves its metadata and retains Low, Medium, High, Xhigh, and Max reasoning choices without modifying the installed catalog. Users do not need to upgrade pi-ai separately to select Astra. The exact verified pairs and acceptance limits are recorded in the release notes; dependency declarations alone do not establish verification. Neither catalog source proves account access.
 
 - Adding an account leaves the current account usable while authorization is pending.
 - Cancelling or timing out a new authorization preserves every existing account and closes accepted callback connections, including incomplete HTTP requests. After cancellation, the browser reads account labels and quota together before updating the view. Pending authorization expires after 10 minutes by default; `oauthTimeoutMs` accepts 1,000–1,800,000 milliseconds and is applied when the plugin loads.
@@ -62,6 +62,7 @@ Direct connection is the default. An enabled credential-free HTTP(S) proxy appli
 - Search has a 30-second total deadline covering authentication, response headers and body reading. Responses larger than 1 MiB are rejected, and unfinished response bodies are cancelled on failure. Caller cancellation can end a search sooner.
 - `enableImageTool: true` registers `view_image` on vision-capable models. Remote reads accept credential-free public HTTP(S) only and revalidate DNS and redirects.
 - `enableImageGeneration: true` registers prompt-only GPT Image generation. Use the image generation capability included with your current GPT subscription. Availability, dimensions, and quota remain account- and service-controlled.
+- `imageModelHint` is an optional profile-scoped setting in Plugin configuration or the profile config. Empty uses `gpt-image-2`; a custom value accepts 1–128 ASCII letters, digits, dots, underscores, or hyphens and must start with a letter or digit. Saving changes the `model` field of subsequent image requests to the same fixed endpoint; clearing restores the default. The tool still accepts only `prompt`. This is an unverified route hint: the service may ignore or reject it, and it does not guarantee the returned model.
 
 Generated originals are stored under `$DSH_HOME/dsh-codex-connect/images/v1`; the conversation receives a separate DSH attachment preview. The result card reports dimensions and file sizes and can download either representation. Originals are owner-only, integrity-checked, and available only to the creating session and forks that inherited the result. Disabling or uninstalling the plugin does not delete those files automatically.
 
@@ -102,6 +103,7 @@ The main plugin options are:
 | `enableSearch` | `false` | Register Codex search and select it when the setting is saved |
 | `enableImageTool` | `false` | Register `view_image` |
 | `enableImageGeneration` | `false` | Register GPT Image generation |
+| `imageModelHint` | empty | Optional unverified image route hint; empty keeps the default request |
 | `enableAutoReview` | `false` | Review eligible approval requests with Codex |
 | `searchModel` | `gpt-5.6-sol` | Model used by standalone search |
 | `searchMode` | `cached` | `cached`, `indexed`, or `live` |
@@ -112,6 +114,14 @@ The main plugin options are:
 
 ## Diagnostics and recovery
 
+### Local installation diagnostics
+
+Published Alpha 4.33 can fail to list or prepare Codex models on DSH `0.1.5-rc.1` with `Cannot read properties of undefined (reading 'get')`. That host requires a per-model error index absent from the older plugin profile. Builds containing [the Issue #178 fix](https://github.com/franksong2702/dsh-codex-connect/issues/178) initialize the index; re-authorizing does not supply it. Choose an exact plugin release verified with your host version, not merely one with the same Alpha series.
+
+Run `dsh plugin --profile web exec dsh-codex-connect doctor --json` to inspect local installation metadata without a network request. Compatibility statuses mean: `compatible` matches the declared version requirements, not a behavioral test; `unverified` identifies package versions outside the declared support set; `unknown` means required version metadata is missing or unreadable; `incompatible` identifies a Node version outside the declared engine requirement. The aggregate prioritizes `incompatible`, then `unknown`, then `unverified`. Doctor exits `1` for any non-compatible result or unsafe credential-file metadata; this does not authorize or recommend changing DSH.
+
+The normal update card checks only Codex Connect releases. It reuses successful plugin-version checks for up to 24 hours and retries unavailable checks every five minutes while mounted; a manual check bypasses the cache. It neither queries host compatibility nor recommends host upgrades or downgrades. An unlisted DSH/plugin combination requires verification, not an assumption of failure.
+
 ### Capability probes
 
 The local capability report performs no network request. With valid local credentials and a supported invocation, `capabilities --probe` sends one fixed short request and may consume quota. `auto-review-probe` checks the OAuth reviewer route and its structured response only; it does not exercise the full Harness approval integration or execute the reviewed action. It may also send a request and consume quota when its preconditions are met:
@@ -136,6 +146,15 @@ dsh plugin --profile web exec dsh-codex-connect untrust-origin http://192.168.1.
 
 Include the scheme and port, never a path, query, or fragment. Do not expose the OAuth route to the public Internet; use an SSH tunnel when the network is not trusted. The Web client displays these commands but never edits the allowlist.
 
+The origin allowlist controls access to DSH; it does not forward OpenAI's localhost callback from your browser device to the DSH host. To finish a pending login without forwarding port 1455:
+
+1. Start **Authorize** (or **Add account**) in the Models or plugin account settings and complete approval in the opened browser tab.
+2. When redirected to `http://localhost:1455/auth/callback`, the remote browser may show a connection error. Copy the **complete URL from its address bar**, including the query string. Do not copy the initial authorization link or only the code.
+3. Return to the same DSH account view, expand the optional manual callback form, paste the URL into its callback URL field, and submit it. The form is collapsed by default; normal automatic callback login is unchanged.
+4. Wait for the account status to update. An invalid URL does not cancel the pending login; paste the correct current callback and retry. If authorization expired or was cancelled, start again and use the new flow's callback. After reloading the DSH page, use **Continue authorization** to rejoin a still-pending login.
+
+The callback must match the pending flow's redirect URI and OAuth state; code-only input, missing or mismatched state, duplicate parameters, and reused callbacks are rejected. Submission uses the existing same-origin/trusted-origin checks and a bounded JSON POST. The pasted URL is not fetched, logged, or persisted by the plugin, and the input is cleared on submission. Tokens remain on the DSH host. Only paste into this dedicated field: the URL contains a short-lived credential and must not be shared in chat, issues, logs, or configuration. Use an SSH tunnel for untrusted networks; manual callback entry does not make an unauthenticated public DSH deployment safe or relax its origin policy.
+
 ### Migration and conflicts
 
 If startup reports an `openai-codex` collision, inspect the effective configuration and remove only the confirmed legacy `dsh-codex` bundle or manual provider row. Do not delete credentials or unrelated providers. See [MIGRATION.md](../MIGRATION.md) for package migration and repair of Alpha 4.10 search histories.

package/docs/reference.zh.md

@@ -10,7 +10,7 @@ OAuth 凭据保存在运行 DSH 的主机上，由该主机用于向 OpenAI 认
 
 在 Harness 的常规模型选择器中选择一个 `openai-codex` 模型。所有界面语言均保留模型的规范名称。**更多设置 → 模型** 控制发现列表中显示哪些模型；隐藏模型不会禁用按精确 ID 路由。
 
-Codex 目录来自已安装的 `@earendil-works/pi-ai` 包，不是实时查询账户可用模型的结果。已验证的 DSH `0.1.2-rc.1` 与 Codex Connect `0.1.0-alpha.4.29` 组合使用 `pi-ai@0.84.4`，其中尚无 `gpt-6-astra`，因此由 Codex Connect 补充定义。上游 [pi-ai `0.85.1`](https://github.com/earendil-works/pi/releases/tag/v0.85.1) 已包含 Astra，但超出了对应 DSH 适配器和本插件声明的 `^0.84.2` 范围。用户无需单独升级 pi-ai 即可选择 Astra。采用新依赖需要验证兼容性并更新依赖声明；安装的目录提供 Astra 后，插件会保留该定义，不再补入自己的定义。两种来源的目录条目都不能证明账户具有调用权限。
+Codex 目录来自已安装的 `@earendil-works/pi-ai` 包，不是实时查询账户可用模型的结果。DSH `0.1.2-rc.1` 使用 pi-ai `^0.84.2`，其中尚无 `gpt-6-astra`，因此由 Codex Connect 补充定义。Alpha 4.33 也已验证 DSH `0.1.5-alpha.1` 与 pi-ai `0.85.1` 的组合；混装的宿主包以及其他 DSH/pi-ai 组合仍属未验证。遇到原生 Astra 条目时，插件保留其元数据，并维持 Low、Medium、High、Xhigh 和 Max 推理选择，不修改已安装的目录。用户无需单独升级 pi-ai 即可选择 Astra。发布说明记录了准确的已验证组合和验收限制；依赖声明本身不代表已验证。两种来源的目录条目都不能证明账户具有调用权限。
 
 - 添加账户期间，当前账户仍可继续使用。
 - 取消新的授权或等待超时，不会删除任何已有账户，并会关闭已接受的回调连接，包括未完成的 HTTP 请求。取消后，浏览器会一起读取账户标签与额度，再更新显示。待处理授权默认 10 分钟后过期；`oauthTimeoutMs` 接受 1,000–1,800,000 毫秒，并在插件加载时应用。
@@ -62,6 +62,7 @@ GPT Codex 对话的 Composer 会显示 Fast Mode 与额度：
 - 搜索从认证开始到读完响应共用 30 秒总期限。超过 1 MiB 的响应会被拒绝，失败时会取消尚未读完的响应体。调用方也可以提前取消搜索。
 - `enableImageTool: true` 为具备视觉能力的模型注册 `view_image`。远程读取只接受不带凭据的公网 HTTP(S)，并重新检查 DNS 与重定向。
 - `enableImageGeneration: true` 注册只接受提示词的 GPT Image 图片生成。使用你当前 GPT 订阅计划提供的图片生成能力。可用性、尺寸和额度仍由账户及服务端控制。
+- `imageModelHint` 是“插件配置”或 profile config 中的可选设置，按 profile 保存。留空使用 `gpt-image-2`；自定义值接受 1–128 个 ASCII 字母、数字、点、下划线或连字符，且必须以字母或数字开头。保存后会修改后续图片请求的 `model` 字段，仍使用同一固定端点；清空可恢复默认值。工具仍只接受 `prompt`。这是未经验证的路由提示：服务端可能忽略或拒绝，也不保证返回指定模型。
 
 生成的原文件保存在 `$DSH_HOME/dsh-codex-connect/images/v1`；对话会收到另一份 DSH 附件预览。结果卡片会报告尺寸和文件大小，并可下载任一版本。原文件仅允许所有者访问，下载前会校验完整性，并且只对创建会话及继承了该结果的 fork 开放。关闭能力或卸载插件不会自动删除这些文件。
 
@@ -102,6 +103,7 @@ GPT Codex 对话的 Composer 会显示 Fast Mode 与额度：
 | `enableSearch` | `false` | 注册 Codex 搜索，并在保存时将它选为搜索提供方 |
 | `enableImageTool` | `false` | 注册 `view_image` |
 | `enableImageGeneration` | `false` | 注册 GPT Image 图片生成 |
+| `imageModelHint` | 空字符串 | 可选的未验证图片路由提示；留空保持默认请求 |
 | `enableAutoReview` | `false` | 使用 Codex 审查符合条件的审批请求 |
 | `searchModel` | `gpt-5.6-sol` | 独立搜索使用的模型 |
 | `searchMode` | `cached` | `cached`、`indexed` 或 `live` |
@@ -112,6 +114,14 @@ GPT Codex 对话的 Composer 会显示 Fast Mode 与额度：
 
 ## 诊断与恢复
 
+### 本地安装诊断
+
+已发布的 Alpha 4.33 在 DSH `0.1.5-rc.1` 上列出或准备 Codex 模型时，可能报 `Cannot read properties of undefined (reading 'get')`。新宿主要求按模型记录错误的索引，旧插件 profile 没有提供。包含 [Issue #178 修复](https://github.com/franksong2702/dsh-codex-connect/issues/178)的构建会初始化该索引；重新授权不能补齐这个字段。请选择与宿主版本完成验证的精确插件版本，不能仅凭属于同一 Alpha 系列判断。
+
+运行 `dsh plugin --profile web exec dsh-codex-connect doctor --json` 可检查本地安装元数据，不会联网。兼容性状态含义：`compatible` 表示符合声明的版本要求，不是行为测试通过；`unverified` 表示包版本超出声明的支持集合；`unknown` 表示缺少必要版本元数据或无法读取；`incompatible` 表示 Node 版本不满足声明的 engine 要求。汇总状态依次优先采用 `incompatible`、`unknown`、`unverified`。任何非 compatible 结果或不安全的凭据文件元数据都会让 doctor 返回 `1`，但这并不授权或建议更改 DSH。
+
+常规更新卡片只检查 Codex Connect 发布版本。插件版本检查成功后最多缓存 24 小时，页面挂载期间每五分钟重试不可用的检查；手动检查会绕过缓存。它不会查询宿主兼容性，也不会建议升级或降级宿主。未列入记录的 DSH/plugin 组合需要验证，不能据此认定无法运行。
+
 ### 能力探针
 
 本地能力报告不发送网络请求。本地凭据有效且调用受支持时，`capabilities --probe` 会发送一条固定短请求，并可能消耗额度。`auto-review-probe` 只检查 OAuth reviewer 路由及结构化响应，不验证完整 Harness 审批集成，也不执行被审查的动作；满足前置条件时，它也可能发起请求并消耗额度：
@@ -136,6 +146,15 @@ dsh plugin --profile web exec dsh-codex-connect untrust-origin http://192.168.1.
 
 必须包含协议和端口，不能包含路径、query 或 fragment。不要把 OAuth 路由暴露到公网；网络不可信时请使用 SSH tunnel。Web 客户端只显示这些命令，不会自行修改 allowlist。
 
+origin allowlist 只控制访问 DSH 的权限，不会把 OpenAI 跳转到浏览器设备的 localhost 回调转发给 DSH 主机。不转发 1455 端口时，可这样完成当前登录：
+
+1. 在模型或插件账户设置中点击 **授权**（或 **添加账户**），在打开的浏览器标签页中完成批准。
+2. 跳转到 `http://localhost:1455/auth/callback` 后，远程浏览器可能显示连接错误。复制**地址栏中的完整 URL**，包括 query string。不要复制初始授权链接，也不要只复制 code。
+3. 返回同一个 DSH 账户界面，展开可选的手动回调表单，将 URL 粘贴到回调 URL 输入框并提交。表单默认收起；原有自动回调登录行为不变。
+4. 等待账户状态更新。URL 无效不会取消当前登录，可粘贴本次授权的正确回调并重试。若授权过期或已取消，请重新开始，并使用新流程的回调。刷新 DSH 页面后，可点击 **继续授权** 重新加入仍在等待的登录。
+
+回调必须匹配当前流程的 redirect URI 和 OAuth state；仅 code、缺少或不匹配的 state、重复参数及重复使用的回调都会被拒绝。提交使用现有同源／可信 origin 检查以及大小受限的 JSON POST。插件不会访问、记录或持久化粘贴的 URL，提交时会清空输入。token 仍保存在 DSH 主机上。只应粘贴到此专用输入框：URL 包含短期凭据，不能分享至聊天、issue、日志或配置中。网络不可信时请使用 SSH tunnel；手动回调不代表可以安全地公开无认证的 DSH 服务，也不会放宽 origin 策略。
+
 ### 迁移与冲突
 
 如果启动报告 `openai-codex` 冲突，请检查有效配置，只移除已经确认的旧 `dsh-codex` bundle 或手动 provider 条目。不要删除凭据或无关 provider。包迁移及 Alpha 4.10 搜索历史修复见 [MIGRATION.md](../MIGRATION.md)。

package/docs/versioning.i18n.yaml

@@ -1,4 +1,4 @@
 # Bilingual-pair consistency record for the versioning policy. Re-record with:
 #   git hash-object VERSIONING.md docs/VERSIONING.zh.md
-VERSIONING.md: ce7541eae424c1f9a61fa29a0ca94e5c7b99f162
-docs/VERSIONING.zh.md: c9a5ea8119aaaaa0acf369cc994a988399db715d
+VERSIONING.md: 53c3c96541e2ac96c54314fff68aa1b0768d3ad8
+docs/VERSIONING.zh.md: 8ee76b6b299342b0797e3ed292a18b32deb961fb

package/lib/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { At as loginOpenAICodex, Bt as openAICodexAuthPath, H as DSH_PLUGIN_API_PACKAGES, Mt as openAICodexAuthStatus, N as CODEX_CONNECT_VERSION, Nt as publicAuthError, Rt as OPENAI_CODEX_PROVIDER, Tt as normalizeTrustedOrigin, X as readInstalledPackageVersion, Y as evaluateCompatibility, c as migrateOpenAICodexSearchHistory, d as OPENAI_CODEX_BASE_URL, gt as normalizeOpenAICodexProxyUrl, j as diagnoseOpenAICodex, jt as logoutOpenAICodex, kt as openAICodexModelCatalog, l as CODEX_AUTO_REVIEW_MODEL, u as probeCodexAutoReview, wt as OpenAICodexTrustedOriginsStore, zt as OpenAICodexCredentialStore } from "./src-K61G4PZz.js";
+import { $ as readInstalledPackageVersion, At as normalizeTrustedOrigin, Ft as loginOpenAICodex, Gt as openAICodexAuthPath, H as DSH_PLUGIN_API_PACKAGES, It as logoutOpenAICodex, Lt as openAICodexAuthStatus, N as CODEX_CONNECT_VERSION, Pt as openAICodexModelCatalog, Q as isSupportedDshPluginApiVersion, Rt as publicAuthError, Ut as OPENAI_CODEX_PROVIDER, Wt as OpenAICodexCredentialStore, Z as evaluateCompatibility, c as migrateOpenAICodexSearchHistory, d as OPENAI_CODEX_BASE_URL, j as diagnoseOpenAICodex, kt as OpenAICodexTrustedOriginsStore, l as CODEX_AUTO_REVIEW_MODEL, u as probeCodexAutoReview, xt as normalizeOpenAICodexProxyUrl } from "./src-rxlwLWWN.js";
 import { i as fetch, r as ProxyAgent, t as Agent } from "./undici-runtime-H2uktiw6.js";
 import { createHash } from "node:crypto";
 import { realpathSync } from "node:fs";
@@ -207,7 +207,8 @@ var CodexCapabilityDiagnostics = class {
 			packageVersions: versions
 		});
 		const missing = Object.values(versions).some((value) => value === null) || !/^v?\d+\.\d+\.\d+$/u.test(versions["node"] ?? "");
-		const runtime = DSH_PLUGIN_API_PACKAGES.some((name) => versions[name] !== null && versions[name] !== "0.1.2-rc.1") || compatibility.status === "incompatible" ? result("rejected", "declared-version-mismatch", "Use DSH API 0.1.2-rc.1 and pi-ai ^0.84.2 together. DSH 0.1.0-rc.7 requires Codex Connect 0.1.0-alpha.4.14.") : missing || compatibility.status === "unknown" ? result("unknown", "version-metadata-unavailable", "Run this command from the plugin installation in the intended profile.") : result("supported", "declared-host-versions-match", "Host package versions satisfy the declared requirements; this is not a live profile or browser compatibility test.");
+		const dshVersion = versions["@deepseek-ai/dsh-llm"];
+		const runtime = DSH_PLUGIN_API_PACKAGES.some((name) => versions[name] !== null && (!isSupportedDshPluginApiVersion(versions[name]) || versions[name] !== dshVersion)) || compatibility.status === "incompatible" || compatibility.status === "unverified" ? result("rejected", "declared-version-mismatch", "Use one declared DSH API version consistently: 0.1.2-rc.1 with pi-ai ^0.84.2, or 0.1.5-alpha.1 with pi-ai 0.85.1. DSH 0.1.0-rc.7 requires Codex Connect 0.1.0-alpha.4.14. Other combinations require verification.") : missing || compatibility.status === "unknown" ? result("unknown", "version-metadata-unavailable", "Run this command from the plugin installation in the intended profile.") : result("supported", "declared-host-versions-match", "Host package versions satisfy the declared requirements; this is not a live profile or browser compatibility test.");
 		const model = this.deps.catalog().find((item) => item.id === request.model)?.id ?? null;
 		const unknownNetwork = result("unknown", "not-probed", "Run capabilities --model <catalog-id> --probe explicitly; this sends a fixed short request and may consume quota.");
 		const checks = {