dsh-coding-subscription-oauth 0.6.0 → 0.6.2

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-coding-subscription-oauth",
   "description": "DeepSeek Harness coding-subscription OAuth: SuperGrok/Grok Build, ChatGPT Plus Codex, Kimi Code, Claude Code. Fixes AUTH API key is invalid, INVALID_REPLAY_STATE, grok-4.6 xhigh, Kimi Bearer vs x-api-key.",
-	"version": "0.6.0",
+	"version": "0.6.2",
   "publishConfig": {
     "access": "public",
     "registry": "https://registry.npmjs.org/"
@@ -110,20 +110,20 @@
       "diagnostics": "standalone",
       "bom": {
         "@deepseek-ai/cordis": "4.0.1",
-        "@deepseek-ai/dsh-atomic-write": "0.1.0-rc.6",
-        "@deepseek-ai/dsh-attachment": "0.1.0-rc.6",
-        "@deepseek-ai/dsh-client-locale": "0.1.0-rc.6",
-        "@deepseek-ai/dsh-client-runtime": "0.1.0-rc.6",
-        "@deepseek-ai/dsh-client-ui-settings": "0.1.0-rc.6",
-        "@deepseek-ai/dsh-client-ui-slots": "0.1.0-rc.6",
-        "@deepseek-ai/dsh-client-web": "0.1.0-rc.6",
-        "@deepseek-ai/dsh-credentials": "0.1.0-rc.6",
-        "@deepseek-ai/dsh-home-paths": "0.1.0-rc.6",
-        "@deepseek-ai/dsh-host-webserver": "0.1.0-rc.6",
-        "@deepseek-ai/dsh-invariants": "0.1.0-rc.6",
-        "@deepseek-ai/dsh-llm": "0.1.0-rc.6",
-        "@deepseek-ai/dsh-llm-pi-ai": "0.1.0-rc.6",
-        "@deepseek-ai/dsh-tools": "0.1.0-rc.6",
+        "@deepseek-ai/dsh-atomic-write": "0.1.1-rc.2",
+        "@deepseek-ai/dsh-attachment": "0.1.1-rc.2",
+        "@deepseek-ai/dsh-client-locale": "0.1.1-rc.2",
+        "@deepseek-ai/dsh-client-runtime": "0.1.1-rc.2",
+        "@deepseek-ai/dsh-client-ui-settings": "0.1.1-rc.2",
+        "@deepseek-ai/dsh-client-ui-slots": "0.1.1-rc.2",
+        "@deepseek-ai/dsh-client-web": "0.1.1-rc.2",
+        "@deepseek-ai/dsh-credentials": "0.1.1-rc.2",
+        "@deepseek-ai/dsh-home-paths": "0.1.1-rc.2",
+        "@deepseek-ai/dsh-host-webserver": "0.1.1-rc.2",
+        "@deepseek-ai/dsh-invariants": "0.1.1-rc.2",
+        "@deepseek-ai/dsh-llm": "0.1.1-rc.2",
+        "@deepseek-ai/dsh-llm-pi-ai": "0.1.1-rc.2",
+        "@deepseek-ai/dsh-tools": "0.1.1-rc.2",
         "@deepseek-ai/schemastery": "3.18.1",
         "@earendil-works/pi-ai": "0.84.2",
         "react": "18.3.1",
@@ -148,15 +148,15 @@
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "4.0.1",
-    "@deepseek-ai/dsh-atomic-write": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-attachment": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-credentials": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-home-paths": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-host-webserver": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-invariants": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-llm": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-llm-pi-ai": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-tools": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-atomic-write": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-attachment": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-credentials": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-home-paths": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-host-webserver": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-invariants": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-llm": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-llm-pi-ai": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-tools": "0.1.1-rc.2",
     "@deepseek-ai/schemastery": "3.18.1",
     "@earendil-works/pi-ai": "0.84.2",
     "react": "18.3.1",
@@ -191,20 +191,20 @@
   "devDependencies": {
     "@biomejs/biome": "^2.5.8",
     "@deepseek-ai/cordis": "4.0.1",
-    "@deepseek-ai/dsh-atomic-write": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-attachment": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-client-locale": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-client-runtime": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-client-ui-settings": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-client-ui-slots": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-client-web": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-credentials": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-home-paths": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-host-webserver": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-invariants": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-llm": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-llm-pi-ai": "0.1.0-rc.6",
-    "@deepseek-ai/dsh-tools": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-atomic-write": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-attachment": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-client-locale": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-client-runtime": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-settings": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-client-ui-slots": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-client-web": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-credentials": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-home-paths": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-host-webserver": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-invariants": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-llm": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-llm-pi-ai": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-tools": "0.1.1-rc.2",
     "@deepseek-ai/schemastery": "3.18.1",
     "@earendil-works/pi-ai": "0.84.2",
     "@types/node": "^22.20.0",

package/src/adapter.ts

@@ -3,7 +3,7 @@
 import type { AttachmentStore } from "@deepseek-ai/dsh-attachment";
 import type { RetryPolicyConfig } from "@deepseek-ai/dsh-llm";
 import { type LlmAdapter, LlmError, resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
-import type { ResolvedPiAiProviderProfile } from "@deepseek-ai/dsh-llm-pi-ai";
+import type { PiAiAdapterOptions, ResolvedPiAiProviderProfile } from "@deepseek-ai/dsh-llm-pi-ai";
 import { PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
 import type { AliasLlmRoutePolicy } from "./alias-adapter.ts";
 import { AliasLlmAdapter } from "./alias-adapter.ts";
@@ -25,7 +25,60 @@ import {
 import type { OAuthProviderSession } from "./oauth-session.ts";
 import { grokBuildBaselineModels, grokBuildFingerprintHeaders } from "./provider.ts";
 import { safeMessage } from "./redact.ts";
-import type { GrokBuildSession } from "./session.ts";
+import type { GrokBuildSession } from "./session.ts";
+
+type PiAiAuthInjection = PiAiAdapterOptions["auth"];
+type PiAiCredentialStore = PiAiAuthInjection["credentials"];
+
+const REQUEST_IMAGE_POLICY = {
+	maxRequestImageBytes: 20 * 1024 * 1024,
+	requestImagePixelBudget: 2048 * 2048,
+	requestImageMaxBytes: 1024 * 1024,
+} as const;
+
+/**
+ * Route pi-ai credential operations to the already owner-locked OAuth files.
+ * The adapter may ask its collection about every profile, so an unknown id is
+ * never allowed to reach a writable store. Reads are empty and writes fail
+ * closed, preserving the existing per-provider refresh lock and file policy.
+ */
+function oauthAuthInjection(grok: GrokBuildSession, subscriptions: readonly OAuthProviderSession[]): PiAiAuthInjection {
+	const stores = new Map<string, PiAiCredentialStore>([
+		[XAI_PI_PROVIDER, grok.store],
+		...subscriptions.map((session) => [session.definition.nativeProviderId, session.store] as const),
+	]);
+	const storeFor = (providerId: string): PiAiCredentialStore | undefined => stores.get(providerId);
+	return {
+		credentials: {
+			async read(providerId, options) {
+				return storeFor(providerId)?.read(providerId, options);
+			},
+			async list(options) {
+				const entries = await Promise.all([...stores.values()].map((store) => store.list(options)));
+				return entries.flat();
+			},
+			async modify(providerId, fn, options) {
+				const store = storeFor(providerId);
+				if (store === undefined)
+					throw new Error(`refusing credential write for unknown OAuth provider "${providerId}"`);
+				return store.modify(providerId, fn, options);
+			},
+			async delete(providerId, options) {
+				const store = storeFor(providerId);
+				if (store === undefined)
+					throw new Error(`refusing credential deletion for unknown OAuth provider "${providerId}"`);
+				await store.delete(providerId, options);
+			},
+		},
+		authContext: {
+			// Subscription adapters obtain request credentials only from their
+			// owner-scoped stores. Do not let a foreign environment/file credential
+			// silently change a selected OAuth route.
+			env: async () => undefined,
+			fileExists: async () => false,
+		},
+	};
+}
 
 /** Prefer grok-4.6 when the current (live or baseline) list has it. */
 export function preferredGrokBuildModel(models: readonly { id: string }[] = grokBuildBaselineModels()): string {
@@ -86,7 +139,8 @@ function profile(
 			retryPolicy ?? CODING_OAUTH_RETRY_POLICY,
 			"dsh-coding-subscription-oauth retryPolicy",
 		),
-		configuredMaxTokens: new Map(),
+		configuredMaxTokens: new Map(),
+		...REQUEST_IMAGE_POLICY,
 		...(headers === undefined ? {} : { headers }),
 		piProvider,
 	};
@@ -97,7 +151,7 @@ export function createGrokBuildAdapter(
 	session: GrokBuildSession,
 	resolveAttachments: () => AttachmentStore | undefined,
 ): PiAiAdapter {
-	return new PiAiAdapter({
+	return new PiAiAdapter({
 		profiles: () =>
 			new Map<string, ResolvedPiAiProviderProfile>([
 				[
@@ -105,12 +159,13 @@ export function createGrokBuildAdapter(
 					profile(GROK_BUILD_ROUTE, "xAI Grok Build", session.provider(), undefined, grokBuildFingerprintHeaders()),
 				],
 			]),
-		resolveApiKey: async () =>
+		resolveApiKey: async () =>
 			resolveOAuthToken("Grok Build", async () => {
 				const auth = await session.models.getAuth(XAI_PI_PROVIDER, { minOAuthValidityMs: MIN_OAUTH_VALIDITY_MS });
 				return auth?.auth.apiKey;
-			}),
-		resolveAttachments,
+			}),
+		auth: oauthAuthInjection(session, []),
+		resolveAttachments,
 	});
 }
 
@@ -201,7 +256,7 @@ export function createCodingOAuthAdapter(
 		});
 	}
 
-	const inner = new PiAiAdapter({
+	const inner = new PiAiAdapter({
 		profiles: () => {
 			const profiles = new Map<string, ResolvedPiAiProviderProfile>();
 			profiles.set(
@@ -244,7 +299,7 @@ export function createCodingOAuthAdapter(
 			}
 			return profiles;
 		},
-		resolveApiKey: async (provider) => {
+		resolveApiKey: async (provider) => {
 			if (provider === GROK_BUILD_ROUTE) {
 				return resolveOAuthToken("Grok Build", async () => {
 					const auth = await grok.models.getAuth(XAI_PI_PROVIDER, { minOAuthValidityMs: MIN_OAUTH_VALIDITY_MS });
@@ -254,13 +309,19 @@ export function createCodingOAuthAdapter(
 			const session =
 				provider === CODEX_OAUTH_FAST_ROUTE ? byNativeId.get(CODEX_PI_PROVIDER) : byNativeId.get(provider);
 			if (session === undefined) throw new LlmError(`Unknown OAuth provider "${provider}"`, "NO_ADAPTER");
-			return resolveOAuthToken(session.definition.displayName, () => session.resolveAccessToken());
-		},
-		resolveAttachments,
+			return resolveOAuthToken(session.definition.displayName, () => session.resolveAccessToken());
+		},
+		auth: oauthAuthInjection(grok, subscriptions),
+		resolveAttachments,
 	});
 
-	return new AliasLlmAdapter(inner, aliases, policies);
-}
+	// The Fast wrapper restores wire/replay model identity to openai-codex.
+	// Keep the opaque envelope untouched and map public Fast source identity to
+	// that native replay provider before PiAiAdapter validates it.
+	const replayProviders = new Map(aliases);
+	replayProviders.set(CODEX_OAUTH_FAST_ROUTE, CODEX_PI_PROVIDER);
+	return new AliasLlmAdapter(inner, aliases, policies, replayProviders);
+}
 
 /**
  * Resolve an OAuth access token for one route, translating a failed refresh

package/src/alias-adapter.ts

@@ -36,16 +36,10 @@ export interface AliasLlmRoutePolicy {
 	onAuthFailure?: () => Promise<void>;
 }
 
-function routePiAiReplayState(value: unknown, route: string): unknown {
-	if (typeof value !== "object" || value === null || Array.isArray(value)) return value;
-	const state = value as Record<string, unknown>;
-	if (state["kind"] !== "pi-ai" || state["provider"] === route) return value;
-	return { ...state, provider: route };
-}
-
-function normalizeReplayForRoute(
-	message: GenerateOptions["messages"][number],
-	route: string,
+export function normalizeReplayForRoute(
+	message: GenerateOptions["messages"][number],
+	route: string,
+	nativeReplayProvider: string,
 ): GenerateOptions["messages"][number] {
 	if (message.role !== "assistant" || message.source.kind !== "model") return message;
 	if (message.source.provider !== route) {
@@ -53,9 +47,10 @@ function normalizeReplayForRoute(
 		const { replayState: _foreignReplay, ...source } = message.source;
 		return { ...message, source };
 	}
-	const replayState = routePiAiReplayState(message.source.replayState, route);
-	if (replayState === message.source.replayState) return message;
-	return { ...message, source: { ...message.source, replayState } };
+	// The rc.2 envelope stays entirely opaque. PiAiAdapter only keys replay
+	// validation from source.provider, so restore the native provider identity
+	// without inspecting or changing replayState.
+	return { ...message, source: { ...message.source, provider: nativeReplayProvider } };
 }
 
 /**
@@ -63,10 +58,11 @@ function normalizeReplayForRoute(
  * Harness route names. Every public operation translates exactly once.
  */
 export class AliasLlmAdapter extends LlmAdapter {
-	constructor(
-		private readonly inner: LlmAdapter,
-		private readonly aliases: ReadonlyMap<string, string>,
-		private readonly policies: ReadonlyMap<string, AliasLlmRoutePolicy> = new Map(),
+	constructor(
+		private readonly inner: LlmAdapter,
+		private readonly aliases: ReadonlyMap<string, string>,
+		private readonly policies: ReadonlyMap<string, AliasLlmRoutePolicy> = new Map(),
+		private readonly replayProviders: ReadonlyMap<string, string> = aliases,
 	) {
 		super();
 	}
@@ -113,7 +109,9 @@ export class AliasLlmAdapter extends LlmAdapter {
 	async *stream(options: GenerateOptions): AsyncIterable<StreamChunk> {
 		const route = options.provider;
 		const native = this.nativeProvider(route);
-		const messages = options.messages.map((message) => normalizeReplayForRoute(message, route));
+		const messages = options.messages.map((message) =>
+			normalizeReplayForRoute(message, route, this.replayProviders.get(route) ?? native),
+		);
 		let authFailureNotified = false;
 		for await (const raw of this.inner.stream({ ...options, provider: native, messages })) {
 			const chunk =
@@ -143,11 +141,7 @@ export class AliasLlmAdapter extends LlmAdapter {
 					}
 				}
 			}
-			if (chunk.type === "finish" && chunk.replayState !== undefined) {
-				yield { ...chunk, replayState: routePiAiReplayState(chunk.replayState, route) };
-			} else {
-				yield chunk;
-			}
+			yield chunk;
 		}
 	}
 }

package/src/client/constants.ts

@@ -221,4 +221,4 @@ export const CONSUMED_PREVIEW_CODES = new Set([
 	"unsafe_destination",
 ]);
 
-export const PLUGIN_VERSION = "0.6.0";
+export const PLUGIN_VERSION = "0.6.2";

package/src/client/dshClientAdapter.ts

@@ -12,15 +12,32 @@ export interface DshClientCompatibilityDiagnostic {
 	readonly actual: string;
 }
 
-function hasSlots(context: unknown): context is ClientContext {
-	if (typeof context !== "object" || context === null) return false;
-	const slots = (context as { readonly slots?: unknown }).slots;
-	return (
+type SlotsApi = ClientContext["slots"];
+
+function slotsOf(context: unknown): SlotsApi | undefined {
+	if (typeof context !== "object" || context === null) return undefined;
+	let slots: unknown;
+	try {
+		const get = (context as { readonly get?: unknown }).get;
+		if (typeof get === "function") slots = get.call(context, "slots");
+	} catch {
+		// Older client runtimes may not expose the Cordis reflection helper.
+	}
+	if (slots === undefined) {
+		try {
+			slots = (context as { readonly slots?: unknown }).slots;
+		} catch {
+			// Strict Cordis rejects optional service reads outside an inject scope.
+		}
+	}
+	if (
 		typeof slots === "object" &&
 		slots !== null &&
 		typeof (slots as { readonly inject?: unknown }).inject === "function" &&
 		typeof (slots as { readonly register?: unknown }).register === "function"
-	);
+	)
+		return slots as SlotsApi;
+	return undefined;
 }
 
 export interface DshClientAdapter {
@@ -30,7 +47,7 @@ export interface DshClientAdapter {
 	diagnostics(): readonly DshClientCompatibilityDiagnostic[];
 	assertCompatible(): void;
 	installSlots(options: {
-		readonly register: (context: ClientContext) => () => void;
+		readonly register: (slots: SlotsApi) => () => void;
 		readonly mountFallback: () => () => void;
 	}): void;
 }
@@ -40,11 +57,12 @@ type InstallSlotsOptions = Parameters<DshClientAdapter["installSlots"]>[0];
 export function createDshClientAdapter(context: ClientContext): DshClientAdapter {
 	const candidate = context as unknown as Record<string, unknown>;
 	const locale = candidate["locale"] as Record<string, unknown> | undefined;
+	const slots = slotsOf(context);
 	const checks: Array<[string, unknown, DshClientCompatibilityDiagnostic["level"]]> = [
 		["client.effect", candidate["effect"], "error"],
 		["client.locale.register", locale?.["register"], "error"],
 		["client.locale.bind", locale?.["bind"], "error"],
-		["client.slots.inject", (candidate["slots"] as Record<string, unknown> | undefined)?.["inject"], "warning"],
+		["client.slots.inject", slots?.inject, "warning"],
 	];
 	const diagnostics = checks.flatMap(([id, value, level]): DshClientCompatibilityDiagnostic[] =>
 		typeof value === "function"
@@ -78,21 +96,21 @@ export function createDshClientAdapter(context: ClientContext): DshClientAdapter
 			let disposed = false;
 			let installed = false;
 			let disposeCurrent: () => void = () => undefined;
-			const install = (slotContext: ClientContext): void => {
-				if (disposed || installed) return;
+			const install = (slotContext: ClientContext): boolean => {
+				const slots = slotsOf(slotContext);
+				if (disposed || installed || slots === undefined) return false;
 				installed = true;
 				disposeCurrent();
-				disposeCurrent = options.register(slotContext);
+				disposeCurrent = options.register(slots);
+				return true;
 			};
 
-			if (hasSlots(context)) {
-				install(context);
-			} else {
+			if (!install(context)) {
 				disposeCurrent = options.mountFallback();
 				const inject = candidate["inject"];
 				if (typeof inject === "function") {
 					(inject as ClientContext["inject"]).call(context, ["slots"], (slotContext) => {
-						if (hasSlots(slotContext)) install(slotContext);
+						install(slotContext);
 					});
 				}
 			}

package/src/client/index.tsx

@@ -139,9 +139,9 @@ export function apply(ctx: ClientContext): void {
 	const t = dsh.locale.bind(namespace) as GrokBuildSettingsInjected["t"];
 	dsh.installSlots({
 		mountFallback: () => mountIndependentEntry(t),
-		register: (slotContext) =>
-			slotContext.slots.inject("settings.section", () =>
-				slotContext.slots.register(
+		register: (slots) =>
+			slots.inject("settings.section", () =>
+				slots.register(
 					{
 						name: "settings.section",
 						id: "grok-build",

package/src/compatibility.ts

@@ -28,20 +28,20 @@ export interface DshCompatibility {
 
 export const DSH_EXACT_BOM = Object.freeze({
 	"@deepseek-ai/cordis": "4.0.1",
-	"@deepseek-ai/dsh-atomic-write": "0.1.0-rc.6",
-	"@deepseek-ai/dsh-attachment": "0.1.0-rc.6",
-	"@deepseek-ai/dsh-client-locale": "0.1.0-rc.6",
-	"@deepseek-ai/dsh-client-runtime": "0.1.0-rc.6",
-	"@deepseek-ai/dsh-client-ui-settings": "0.1.0-rc.6",
-	"@deepseek-ai/dsh-client-ui-slots": "0.1.0-rc.6",
-	"@deepseek-ai/dsh-client-web": "0.1.0-rc.6",
-	"@deepseek-ai/dsh-credentials": "0.1.0-rc.6",
-	"@deepseek-ai/dsh-home-paths": "0.1.0-rc.6",
-	"@deepseek-ai/dsh-host-webserver": "0.1.0-rc.6",
-	"@deepseek-ai/dsh-invariants": "0.1.0-rc.6",
-	"@deepseek-ai/dsh-llm": "0.1.0-rc.6",
-	"@deepseek-ai/dsh-llm-pi-ai": "0.1.0-rc.6",
-	"@deepseek-ai/dsh-tools": "0.1.0-rc.6",
+	"@deepseek-ai/dsh-atomic-write": "0.1.1-rc.2",
+	"@deepseek-ai/dsh-attachment": "0.1.1-rc.2",
+	"@deepseek-ai/dsh-client-locale": "0.1.1-rc.2",
+	"@deepseek-ai/dsh-client-runtime": "0.1.1-rc.2",
+	"@deepseek-ai/dsh-client-ui-settings": "0.1.1-rc.2",
+	"@deepseek-ai/dsh-client-ui-slots": "0.1.1-rc.2",
+	"@deepseek-ai/dsh-client-web": "0.1.1-rc.2",
+	"@deepseek-ai/dsh-credentials": "0.1.1-rc.2",
+	"@deepseek-ai/dsh-home-paths": "0.1.1-rc.2",
+	"@deepseek-ai/dsh-host-webserver": "0.1.1-rc.2",
+	"@deepseek-ai/dsh-invariants": "0.1.1-rc.2",
+	"@deepseek-ai/dsh-llm": "0.1.1-rc.2",
+	"@deepseek-ai/dsh-llm-pi-ai": "0.1.1-rc.2",
+	"@deepseek-ai/dsh-tools": "0.1.1-rc.2",
 	"@deepseek-ai/schemastery": "3.18.1",
 	"@earendil-works/pi-ai": "0.84.2",
 	react: "18.3.1",

package/src/dsh-host-adapter.ts

@@ -44,9 +44,13 @@ function record(value: unknown): Record<string, unknown> | undefined {
 
 function service(context: Context, name: string): unknown {
 	try {
-		return context.get(name);
-	} catch {
+		const value = context.get(name);
+		if (value !== undefined && value !== null) return value;
+	} catch {}
+	try {
 		return record(context)?.[name];
+	} catch {
+		return undefined;
 	}
 }
 
@@ -92,7 +96,7 @@ export function createDshHostAdapter(context: Context): DshHostAdapter {
 			});
 		}
 	}
-	const llm = record(service(context, "llm")) ?? (candidate["llm"] as Record<string, unknown> | undefined);
+	const llm = record(service(context, "llm"));
 	if (llm === undefined || typeof llm["registerAdapter"] !== "function") {
 		diagnostics.push({
 			id: "host.api.llm.registerAdapter",
@@ -120,9 +124,7 @@ export function createDshHostAdapter(context: Context): DshHostAdapter {
 				webServer: capability(service(context, "webServer"), "exact-route-v1", ["register"]),
 				settings: capability(service(context, "settings"), "settings-register-v1", ["register"]),
 				credentials: capability(service(context, "credentials"), "credential-resolver-v1", ["resolve"]),
-				llm: capability(service(context, "llm") ?? record(context)?.["llm"], "llm-adapter-registry-v1", [
-					"registerAdapter",
-				]),
+				llm: capability(service(context, "llm"), "llm-adapter-registry-v1", ["registerAdapter"]),
 				ownerRequestPolicy: capability(service(context, "ownerRequestPolicy"), "owner-request-policy-v1", [
 					"authorize",
 					"diagnostics",