dsh-codex-connect 0.1.0-alpha.4.46 → 0.1.0-alpha.4.47

package/INSTALL.md

@@ -1,10 +1,10 @@
 # Installation Runbook for CLI Agents
 
-Published Alpha 4.43 is verified with the exact DSH `0.1.7-rc.1` model-runtime pairing and pi-ai `0.85.1`. Earlier DSH pairings retain their separately published plugin versions below.
+Published Alpha 4.46 is verified with the exact DSH `0.1.7-rc.1` model-runtime pairing and pi-ai `0.85.1`. Earlier DSH pairings retain their separately published plugin versions below.
 
 Install `dsh-codex-connect` into one requested DeepSeek Harness profile without changing its current default model, search route, global configuration, or OAuth state.
 
-Channel snapshot on 2026-09-24: npm `alpha` and `latest` both point to `0.1.0-alpha.4.45`. Use the exact-version command for the installed DSH version. Publishing an Alpha and promoting the default installation channel are separate actions.
+Channel snapshot on 2026-09-24: npm `alpha` points to `0.1.0-alpha.4.46` while `latest` remains on `0.1.0-alpha.4.45`. Use the exact-version command for the installed DSH version. Publishing an Alpha and promoting the default installation channel are separate actions.
 
 ## Safety requirements
 
@@ -30,13 +30,15 @@ Check `dsh --version` before changing the requested profile. Use `dsh --help` to
 | `0.1.5-alpha.1` | `0.1.0-alpha.4.41` |
 | `0.1.5-rc.1` | `0.1.0-alpha.4.41` |
 | `0.1.5-rc.2` | `0.1.0-alpha.4.41` |
-| `0.1.7-rc.1` | `0.1.0-alpha.4.45` |
+| `0.1.7-rc.1` | `0.1.0-alpha.4.46` |
 
 If your exact DSH version is unknown or not listed, preserve the installed host, report that the combination is unverified, and verify it before making installation changes. A missing record does not prove incompatibility, and the catalog's latest verified DSH version is not the latest upstream release. Do not recommend upgrading or downgrading DSH merely to match a row. Investigate any specific failure and seek verification of the installed combination. Do not blindly install `dsh-codex-connect@alpha`: `alpha` is a moving tag, not a compatibility guarantee. Do not infer support for newer DSH versions from these rows.
 
-Alpha 4.43 requires one consistent DSH `0.1.7-rc.1` plugin API and pi-ai `0.85.1`; Node.js remains `^22.19.0 || >=24.0.0`. It does not support the older DSH rows. Alpha 4.41 remains the choice for DSH `0.1.2-rc.1` with pi-ai `^0.84.2`, or `0.1.5-alpha.1`, `0.1.5-rc.1`, and `0.1.5-rc.2` with pi-ai `0.85.1`. Mixed host versions and other DSH/pi-ai combinations remain unverified. Alpha 4.25 remains the verified choice for DSH `0.1.2-alpha.5`, Alpha 4.23 for DSH `0.1.2-alpha.2`, Alpha 4.21 for DSH `0.1.1-rc.2`, and Alpha 4.14 for DSH `0.1.0-rc.7`. Changing DSH is a separate operation requiring the user's explicit request; a plugin update request does not authorize it. The repository's `pnpm --silent run check:compatibility` remains a strict development/release dependency gate, not a recommendation to change a user's host.
+Alpha 4.46 requires one consistent DSH `0.1.7-rc.1` plugin API and pi-ai `0.85.1`; Node.js remains `^22.19.0 || >=24.0.0`. It does not support the older DSH rows. Alpha 4.41 remains the choice for DSH `0.1.2-rc.1` with pi-ai `^0.84.2`, or `0.1.5-alpha.1`, `0.1.5-rc.1`, and `0.1.5-rc.2` with pi-ai `0.85.1`. Mixed host versions and other DSH/pi-ai combinations remain unverified. Alpha 4.25 remains the verified choice for DSH `0.1.2-alpha.5`, Alpha 4.23 for DSH `0.1.2-alpha.2`, Alpha 4.21 for DSH `0.1.1-rc.2`, and Alpha 4.14 for DSH `0.1.0-rc.7`. Changing DSH is a separate operation requiring the user's explicit request; a plugin update request does not authorize it. The repository's `pnpm --silent run check:compatibility` remains a strict development/release dependency gate, not a recommendation to change a user's host.
 
-The Alpha 4.43 recommendation follows [exact-release main CI](https://github.com/franksong2702/dsh-codex-connect/actions/runs/35887810404) on Node 22/24, Chromium and Windows checks, plus the stock DSH `0.1.7-rc.1` same-artifact installation matrix. The [original publish run](https://github.com/franksong2702/dsh-codex-connect/actions/runs/35888766215) uploaded the verified npm package but timed out waiting for public registry readback; do not rerun publication. Once npm exposed the exact version and `alpha` tag, the [recovery-only run](https://github.com/franksong2702/dsh-codex-connect/actions/runs/35889959811) verified the archive against that original artifact and created the matching Git tag and prerelease without republishing. These checks used synthetic providers, not a real ChatGPT account. Stock rc.1 keeps Task controls paused; migration of old Task grants across a Harness upgrade remains unverified.
+The Alpha 4.46 recommendation follows [exact-release main CI](https://github.com/franksong2702/dsh-codex-connect/actions/runs/35982530538) on Node 22/24, browser and keyless Windows checks, plus the stock DSH `0.1.7-rc.1` same-artifact installation matrix. The [original publish run](https://github.com/franksong2702/dsh-codex-connect/actions/runs/35983101557) uploaded the verified package but timed out waiting for npm's public readback; it must not be rerun. After the exact version and `alpha` tag appeared, the [recovery-only run](https://github.com/franksong2702/dsh-codex-connect/actions/runs/35984180679) matched the public npm archive byte-for-byte to the original artifact and created the Git tag and prerelease without republishing. The fix's real Chrome OAuth and quota refresh on the original Windows PC remain unverified; these checks do not promote npm `latest` or establish real-account acceptance. Stock rc.1 keeps Task controls paused; migration of old Task grants across a Harness upgrade remains unverified.
+
+The historical Alpha 4.43 recommendation followed [exact-release main CI](https://github.com/franksong2702/dsh-codex-connect/actions/runs/35887810404) on Node 22/24, Chromium and Windows checks, plus the stock DSH `0.1.7-rc.1` same-artifact installation matrix. The [original publish run](https://github.com/franksong2702/dsh-codex-connect/actions/runs/35888766215) uploaded the verified npm package but timed out waiting for public registry readback; do not rerun publication. Once npm exposed the exact version and `alpha` tag, the [recovery-only run](https://github.com/franksong2702/dsh-codex-connect/actions/runs/35889959811) verified the archive against that original artifact and created the matching Git tag and prerelease without republishing. These checks used synthetic providers, not a real ChatGPT account. Stock rc.1 keeps Task controls paused; migration of old Task grants across a Harness upgrade remains unverified.
 
 The Alpha 4.41 recommendation follows successful [exact-release main CI](https://github.com/franksong2702/dsh-codex-connect/actions/runs/35817909046) on Node 22 and 24 (1,282 unit tests each), 52 Chromium tests, and a four-host same-artifact installation matrix. After npm processing completed, the [recovery verification](https://github.com/franksong2702/dsh-codex-connect/actions/runs/35819017165) matched the public npm archive byte-for-byte to the original verified release artifact, then created the matching Git tag and GitHub prerelease. The [original release run](https://github.com/franksong2702/dsh-codex-connect/actions/runs/35818489220) remains failed because npm's public readback was not available within its bounded retry period; do not rerun publication. These are synthetic-provider installation/lifecycle checks, not new real-account acceptance or a newly exercised published-package upgrade. Task-level model control remains opt-in; a new grant preselects only GPT-5.6 Sol / Medium and displays its scope and request limit before Start. Existing grants are not silently narrowed. Stock DSH 0.1.6-alpha.1 and alpha.2 remain undeclared; their separate compatibility trackers are not broadened by this release.
 
@@ -73,10 +75,10 @@ Alpha 4.33 omits the `modelErrors` profile field required by RC model packages,
    dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.41
    ```
 
-   For the exact DSH `0.1.7-rc.1` pairing, use Alpha 4.43:
+   For the exact DSH `0.1.7-rc.1` pairing, use Alpha 4.46:
 
    ```sh
-   dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.45
+   dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.46
    ```
 
    For DSH `0.1.2-alpha.5`, use Alpha 4.25:
@@ -85,7 +87,7 @@ Alpha 4.33 omits the `modelErrors` profile field required by RC model packages,
    dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.25
    ```
 
-   If npm is unavailable after the matching GitHub prerelease is created, use `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.21'` only for the DSH `0.1.1-rc.2` combination, `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.23'` only for the DSH `0.1.2-alpha.2` combination, `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.25'` only for the DSH `0.1.2-alpha.5` combination, `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.41'` only for the DSH `0.1.2-rc.1`, `0.1.5-alpha.1`, `0.1.5-rc.1`, and `0.1.5-rc.2` combinations, or `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.45'` only for DSH `0.1.7-rc.1`.
+   If npm is unavailable after the matching GitHub prerelease is created, use `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.21'` only for the DSH `0.1.1-rc.2` combination, `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.23'` only for the DSH `0.1.2-alpha.2` combination, `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.25'` only for the DSH `0.1.2-alpha.5` combination, `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.41'` only for the DSH `0.1.2-rc.1`, `0.1.5-alpha.1`, `0.1.5-rc.1`, and `0.1.5-rc.2` combinations, or `dsh plugin --profile web add 'github:franksong2702/dsh-codex-connect#v0.1.0-alpha.4.46'` only for DSH `0.1.7-rc.1`.
 
 3. Run `dsh web --help` once to compose the installed profile without starting the server. DSH `0.1.2-rc.1` prepares profile plugin dependency fallback during this step.
 4. Run `dsh --profile web --dump-config` and require exactly one `llm-openai-codex` row loading `dsh-codex-connect`.

package/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   git hash-object README.md docs/README.zh.md
-README.md: 3dd09c3af313022796d95809cad3b53130eb6a1a
-docs/README.zh.md: 3c5b9bf71227a795131522821424574b72d24088
+README.md: 34ba6dec074368808fbec56353955a8264c5aa9f
+docs/README.zh.md: 8265735a5582f9038f439165db5cf11fc1e62f2d

package/README.md

@@ -16,19 +16,19 @@ This guide describes the published pairing below. Check `dsh --version` first an
 
 | Requirement | Verified pairing |
 |---|---|
-| Codex Connect | `0.1.0-alpha.4.45` |
+| Codex Connect | `0.1.0-alpha.4.46` |
 | DeepSeek Harness | `0.1.7-rc.1` |
 | Node.js | `^22.19.0 \|\| >=24.0.0` |
 | Account | ChatGPT OAuth with access to the requested Codex model; availability is decided by OpenAI |
 
-As of 2026-09-24, npm `alpha` points to 4.43 while `latest` remains on 4.41. Use the exact version below for this DSH pairing; publishing an Alpha and changing the default installation channel are separate actions.
+As of 2026-09-24, npm `alpha` points to 4.46 while `latest` remains on 4.45. Use the exact version below for this DSH pairing; publishing an Alpha and changing the default installation channel are separate actions.
 
 On stock DSH `0.1.7-rc.1`, ordinary Composer works, but Task controls remain paused: activation is rejected and fresh Sessions do not show them. Migration of earlier Task grants across a Harness upgrade is not verified. Older supported pairings and their task behavior are documented in [Installation and upgrades](INSTALL.md).
 
 ### 1. Install
 
 ```sh
-dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.45
+dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.46
 dsh web
 ```
 

package/docs/README.zh.md

@@ -16,19 +16,19 @@ Codex Connect 为标准 Harness agent loop 添加 `openai-codex` 模型提供方
 
 | 要求 | 已验证组合 |
 |---|---|
-| Codex Connect | `0.1.0-alpha.4.45` |
+| Codex Connect | `0.1.0-alpha.4.46` |
 | DeepSeek Harness | `0.1.7-rc.1` |
 | Node.js | `^22.19.0 \|\| >=24.0.0` |
 | 账户 | 通过 ChatGPT OAuth 使用所请求的 Codex 模型；可用性由 OpenAI 决定 |
 
-截至 2026-09-24，npm `alpha` 指向 4.43，`latest` 仍指向 4.41。安装此 DSH 组合请使用下方精确版本命令；发布 Alpha 与提升默认安装渠道是两项独立操作。
+截至 2026-09-24，npm `alpha` 指向 4.46，`latest` 仍指向 4.45。安装此 DSH 组合请使用下方精确版本命令；发布 Alpha 与提升默认安装渠道是两项独立操作。
 
 在原版 DSH `0.1.7-rc.1` 上，普通 Composer 可用，但 Task 控件仍暂停：激活请求会被拒绝，新 Session 不显示这些控件。跨 Harness 升级迁移旧任务授权尚未验证。较旧组合及其任务行为见[安装与升级](../INSTALL.md)。
 
 ### 1. 安装
 
 ```sh
-dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.45
+dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.46
 dsh web
 ```
 

package/docs/agent-notes/issue-264-isolated-import.md

@@ -0,0 +1,7 @@
+# Install libraries imported by the runtime bundle
+
+The Cordis bundle's `lib/index.js` imports `@deepseek-ai/schemastery` and `@earendil-works/pi-ai` at module load. Alpha 4.46 declared both only as peers, so a profile that supplied the DSH host packages but not these two libraries could fail before plugin activation. Resolving an older host-level schemastery also exposed a `.volatile()` method mismatch. A profile-local dependency workaround confirmed that the missing libraries, not credentials or plugin configuration, caused the reported failure.
+
+The plugin now declares exact, plugin-owned runtime dependencies for schemastery `3.18.4` and pi-ai `0.85.1`. DSH, Cordis, and React remain peers because they are host-owned APIs whose module identity must remain shared. The runtime bundle continues to externalize these imports; the package manager installs the two direct dependencies beside the plugin instead of relying on incidental profile hoisting.
+
+`check:isolated-import` copies the built package into a disposable profile, exposes the declared host peers except these two libraries, links only the plugin's declared direct dependencies beside its package, and imports the real built entry point in a fresh Node process. Before the manifest change, the same check failed on missing schemastery. The DSH install matrix exercises the packed artifact with the declared host version and remains the compatibility gate; the isolated import check does not claim a real-account or Windows acceptance run.

package/docs/release-notes/alpha-4.47.md

@@ -0,0 +1,21 @@
+# Codex Connect Alpha 4.47 — isolated plugin import
+
+## English
+
+Alpha 4.46 could fail to load as a Cordis bundle when a DSH profile did not independently install `@deepseek-ai/schemastery` and `@earendil-works/pi-ai`. Depending on which libraries happened to be visible, activation failed with a missing-package import or `z.union(...).volatile is not a function`. Alpha 4.47 declares the exact compatible versions as plugin-owned runtime dependencies so a normal plugin install supplies them. DSH, Cordis, and React remain host-owned peers.
+
+This release targets DeepSeek Harness `0.1.7-rc.1`. The missing-library import was reproduced with the built bundle in a disposable profile before the fix and passed after it. The keyless DSH install matrix checks the packed candidate, but real-account and user-profile upgrade acceptance remain separate. Publishing to `alpha` does not promote npm `latest` or install this release into an existing profile.
+
+After npm publication is independently confirmed, install this exact version with:
+
+```sh
+dsh plugin --profile web add dsh-codex-connect@0.1.0-alpha.4.47
+```
+
+## 中文
+
+Alpha 4.46 在 DSH profile 没有另外安装 `@deepseek-ai/schemastery` 和 `@earendil-works/pi-ai` 时，作为 Cordis bundle 加载可能失败。根据环境里偶然可见的库，错误表现为找不到依赖，或 `z.union(...).volatile is not a function`。Alpha 4.47 把兼容的精确版本列为插件自身的运行依赖，正常安装插件时即可一并安装；DSH、Cordis 和 React 仍由宿主提供。
+
+本版针对 DeepSeek Harness `0.1.7-rc.1`。修复前已在一次性 profile 中用构建后的 bundle 复现缺依赖导入失败，修复后同一检查通过。无凭据的 DSH 安装矩阵会检查打包候选版；真实账号和已有用户 profile 的升级验收仍是独立事项。发布到 `alpha` 不会同步提升 npm `latest`，也不会自动安装到现有 profile。
+
+独立确认 npm 发布后，可使用上面的精确版本命令安装。

package/lib/bin.js

@@ -765,7 +765,7 @@ async function detectCompatibility(options = {}) {
 }
 //#endregion
 //#region src/version.ts
-const CODEX_CONNECT_VERSION = "0.1.0-alpha.4.46";
+const CODEX_CONNECT_VERSION = "0.1.0-alpha.4.47";
 //#endregion
 //#region src/doctor.ts
 /** Secret-free diagnostics and duplicate-provider guidance. */

package/lib/client.js

@@ -6526,7 +6526,7 @@ window.__ModuleLoader__.load({
 		}
 		//#endregion
 		//#region src/version.ts
-		const CODEX_CONNECT_VERSION = "0.1.0-alpha.4.46";
+		const CODEX_CONNECT_VERSION = "0.1.0-alpha.4.47";
 		//#endregion
 		//#region src/client/OpenAICodexModelsCard.tsx
 		/** Compact Models account entry with quota disclosure and shared configuration. */

package/lib/index.js

@@ -5330,7 +5330,7 @@ function registerOpenAICodexOriginalImageRoute(ctx, trustedOrigins, assets) {
 }
 //#endregion
 //#region src/version.ts
-const CODEX_CONNECT_VERSION = "0.1.0-alpha.4.46";
+const CODEX_CONNECT_VERSION = "0.1.0-alpha.4.47";
 //#endregion
 //#region src/doctor.ts
 /** Secret-free diagnostics and duplicate-provider guidance. */

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-codex-connect",
   "displayName": "Codex Connect",
   "description": "ChatGPT OAuth and Codex models for DeepSeek Harness.",
-  "version": "0.1.0-alpha.4.46",
+  "version": "0.1.0-alpha.4.47",
   "author": "Frank Song",
   "contributors": [
     "Yan-Zero (original dsh-codex author)"
@@ -54,7 +54,8 @@
     "check:dsh-next": "node scripts/check-dsh-next.mjs",
     "check:release-workflow": "node scripts/check-release-workflow.mjs",
     "check:env-proxy-import": "node scripts/check-env-proxy-import.mjs",
-    "check": "pnpm run check:release-workflow && pnpm run check:canary-workflow && pnpm run lint && pnpm run typecheck && pnpm run test && pnpm run build && pnpm run check:env-proxy-import && pnpm run check:capability-cli && pnpm --silent run check:compatibility && pnpm run pack:check",
+    "check:isolated-import": "node scripts/check-isolated-import.mjs",
+    "check": "pnpm run check:release-workflow && pnpm run check:canary-workflow && pnpm run lint && pnpm run typecheck && pnpm run test && pnpm run build && pnpm run check:env-proxy-import && pnpm run check:isolated-import && pnpm run check:capability-cli && pnpm --silent run check:compatibility && pnpm run pack:check",
     "prepublishOnly": "pnpm --config.minimum-release-age=0 run check"
   },
   "exports": {
@@ -83,6 +84,8 @@
     "NOTICE"
   ],
   "dependencies": {
+    "@deepseek-ai/schemastery": "3.18.4",
+    "@earendil-works/pi-ai": "0.85.1",
     "undici": "^8.10.0"
   },
   "license": "Apache-2.0",
@@ -129,8 +132,6 @@
     "@deepseek-ai/dsh-tools": "0.1.7-rc.1",
     "@deepseek-ai/dsh-util-values": "0.1.7-rc.1",
     "@deepseek-ai/dsh-web": "0.1.7-rc.1",
-    "@deepseek-ai/schemastery": "^3.18.2",
-    "@earendil-works/pi-ai": "0.85.1",
     "react": "^18.2.0"
   },
   "peerDependenciesMeta": {
@@ -201,8 +202,6 @@
     "@deepseek-ai/dsh-util-values": "0.1.7-rc.1",
     "@deepseek-ai/dsh-web": "0.1.7-rc.1",
     "@deepseek-ai/dsh-workspace": "0.1.7-rc.1",
-    "@deepseek-ai/schemastery": "3.18.4",
-    "@earendil-works/pi-ai": "0.85.1",
     "@testing-library/react": "^16.3.2",
     "@shikijs/langs": "^4.3.1",
     "@types/node": "^22.20.0",