dsh-coding-subscription-oauth 0.6.3 → 0.6.5

package/CHANGELOG.md

@@ -4,6 +4,39 @@ All notable changes to `dsh-coding-subscription-oauth` are documented here, foll
 
 ## Unreleased
 
+### Changed
+
+- Mirror Hub’s first shared-runtime extract (`http-json`, `grok-errors`, `kimi-errors`, `gateway-protocol`) under `vendor/runtime-slice/` with build copies in `src/runtime/` and thin facades at the historical module paths. Add `pnpm run assert:runtime-slice` with `SYNC_HASHES.json` so isolated CI can verify the mirror without a Hub checkout; when Hub is present the script also compares live Hub files.
+
+### Documentation
+
+- Document the temporary runtime-slice mirror and the planned drop after the next core npm release in `docs/02-architecture.md` / `docs/02-architecture.zh-CN.md`.
+
+## v0.6.5 - 2026-09-02
+
+### Fixed
+
+- Restrict gateway key reveal/rotate to `accessMode === "loopback"`, matching the Settings UI which already hides those controls on ssh-tunnel and trusted-https-proxy.
+
+### Changed
+
+- Stop shipping `src/` in the npm `files` allowlist. Runtime remains the generated `lib/` bundle.
+- Add `.nvmrc`, `pnpm run assert:node`, `release:inspect`, and `release:publish`. Cloud Agent verification is `pnpm run check` with optional Docker.
+
+### Documentation
+
+- Add `AGENTS.md` (cloud environment as the primary path; Docker optional; isolated `DSH_HOME`; operator-only npm publish).
+- Align `CONTRIBUTING.md` and `docs/00-project-rules.md` so contributors are not Docker-only; Cursor Cloud / isolated `DSH_HOME` is the primary verification path.
+- Localize community README upgrade banners (ja/ko/pt-BR/es/fr/de/ru) so they are not English-only under bilingual headings, keeping Cordis fix in `0.6.2+` and DSH `0.1.1-rc.2` facts accurate.
+
+## v0.6.4 - 2026-08-29
+
+- Pin Subscription, its shared core dependency, and both production/development dispatcher dependencies to `undici@7.29.0` with `dsh-coding-oauth-core@0.1.1`, preventing a co-installed Undici major split while preserving the proxy-store ABI and Grok Imagine's explicit pinned dispatcher.
+
+### Documentation
+
+- Correct the README upgrade callout so Cordis/DSH `0.1.1-rc.2` support is attributed to `0.6.2+`, and name `0.6.3` for default-off `codexImagesAnyModel`; add the any-model route-gate boundary sentence across README translations and an `INSTALL.md` `0.6.2` → `0.6.3` upgrade note.
+
 ## v0.6.3 - 2026-08-28
 
 ### Added

package/CONTRIBUTING.md

@@ -9,7 +9,16 @@ Welcome! `dsh-coding-subscription-oauth` is an open-source coding-subscription O
 
 ## Getting started
 
-Development verification for this plugin runs only in an isolated Docker build sandbox; do not run installs, builds, tests, typechecks, linters or package checks directly on a shared developer host. The tracked `Dockerfile` copies the filtered source into the image (never credentials), downloads dependencies in a dedicated stage, then runs project code with `--network=none`. Do not use privileged mode, credential or host-directory bind mounts, or the Docker socket. Tests use no published ports. The narrowly controlled interactive Web preview below is the only port-publishing exception; host networking remains prohibited unless its documented fallback conditions are all met.
+Primary verification is `pnpm run check` on Node matching `.nvmrc` (Cursor Cloud or an isolated checkout). Do not install into a shared operator DSH profile; use `export DSH_HOME=/tmp/dsh-verify-*` (or `$HOME/.dsh-cloud`) for plugin smoke tests.
+
+Docker sandbox targets remain available for CI and for contributors who prefer a hermetic build. The tracked `Dockerfile` copies the filtered source into the image (never credentials), downloads dependencies in a dedicated stage, then runs project code with `--network=none`. Do not use privileged mode, credential or host-directory bind mounts, or the Docker socket. Tests use no published ports. The narrowly controlled interactive Web preview below is the only port-publishing exception; host networking remains prohibited unless its documented fallback conditions are all met.
+
+```bash
+pnpm install --frozen-lockfile
+pnpm run check
+```
+
+Optional Docker:
 
 ```bash
 docker build --target check --build-arg NODE_VERSION=22.19.0 \
@@ -54,7 +63,7 @@ This repo also ships a Grok Build CLI (`dsh-coding-oauth`, legacy `dsh-grok-buil
 1. Open an issue describing the change (or link an existing one) so scope is agreed first.
 2. Branch from the default branch. Keep commits atomic and conventional — see **Commits & pushes** below.
 3. When you change a capability or add a doc, update `README.md` (and the community translations added in `docs/00-project-rules.md` §2 if user-facing) and the relevant entries in `docs/` (public layer), **and** add a changelog entry under `Unreleased` in `CHANGELOG.md`.
-4. Build the Docker `check` and `verify` targets until green, then commit that passing slice promptly (do not stack later work on an uncommitted green tree).
+4. Run `pnpm run check` until green (or the Docker `check` / `verify` targets if you prefer a hermetic sandbox), then commit that passing slice promptly (do not stack later work on an uncommitted green tree).
 5. Push the branch as a version/milestone checkpoint and open a PR. Describe what changed and how it was verified. Keep the scope of local-only docs (`docs/local/`) out of the PR unless you are a maintainer doing internal investigation.
 
 ## Commits & pushes
@@ -79,7 +88,7 @@ History is part of the review. The maintainer counterpart — tags, clean-tree r
 
 ### Before you commit
 
-- Build the relevant Docker targets (`check`, then `verify`) and wait until green. Do not commit a failing tree.
+- Run `pnpm run check` (or the Docker `check` then `verify` targets) and wait until green. Do not commit a failing tree.
 - Commit promptly once checks pass — do not leave a finished, verified change sitting uncommitted next to later work.
 - Generated `lib/` is a committed release artifact (git installs + the CI `git diff --exit-code -- lib` drift gate). Rebuild it and include it in the **same** commit as the source or build-script change that produced it. Do not land stale `lib/` against newer `src/`, and do not land a `lib/`-only commit unless the only change is a verified rebuild with no source delta.
 - Never commit secrets, tokens, credentials, private keys, `.env` files, host-specific paths, or local-only notes (`docs/local/`, `reference/`). See `docs/00-project-rules.md` §0.3.
@@ -110,7 +119,7 @@ the workflow never publishes a second copy. A missing version or mismatched
 
 The plugin verifies an exact DeepSeek Harness BOM (`compatibility/dsh-bom.json`). A new DSH rc/stable is **unverified by default**, and lifecycle drift has broken activation before (#17), so run this checklist before moving the pin — in order, stopping at the first failure:
 
-1. **Sandbox first.** Edit the hardcoded `@deepseek-ai/dsh@0.1.1-rc.2` pin in `Dockerfile` (`dsh-installed` / `rc2-compatibility` stages — there is no build-arg) to the candidate DSH version, then build those targets green. This catches activation/lifecycle breakage without touching a real profile.
+1. **Sandbox or isolated cloud first.** Prefer `pnpm run check` on Node matching `.nvmrc` in Cursor Cloud / an isolated `DSH_HOME`. Docker remains optional: edit the hardcoded `@deepseek-ai/dsh@0.1.1-rc.2` pin in `Dockerfile` (`dsh-installed` / `rc2-compatibility` stages — there is no build-arg) to the candidate DSH version, then build those targets green. This catches activation/lifecycle breakage without touching a real profile.
 2. **Real profile install (maintainer machine).** Install the candidate tarball into an existing `dsh web` profile and restart that process once; the plugin must activate with only `webServer` required and no Cordis injection failures in the logs.
 3. **Settings surface.** Settings → Coding OAuth renders all four tabs (Accounts / Gateway / Capabilities / About).
 4. **Credentials survive.** Every previously signed-in provider card (Grok / Codex / Kimi / Claude) still shows signed-in — an upgrade must never migrate or reset OAuth credential files.

package/INSTALL.md

@@ -3,7 +3,7 @@
 本仓库原名 **`dsh-grok-build`**。普通用户请使用已发布的 npm 版本：
 
 ```bash
-dsh plugin --profile web add dsh-coding-subscription-oauth@0.6.3
+dsh plugin --profile web add dsh-coding-subscription-oauth@0.6.5
 ```
 
 CLI 新命令是 `dsh-coding-oauth`（旧命令 `dsh-grok-build` 仍可用）。为兼容已有 profile，Cordis id 仍是 `llm-grok-build-oauth`，设置页 HTTP 路径仍是 `/plugins/dsh-grok-build/*`，凭据文件名不变。
@@ -11,7 +11,7 @@ CLI 新命令是 `dsh-coding-oauth`（旧命令 `dsh-grok-build` 仍可用）。
 第一次公开发布是 **`0.4.1`**。`0.6.1` 从未正式发布或打包，其未发布改动已合入当前推荐的 **`0.6.3`**：
 
 ```bash
-dsh plugin --profile web add dsh-coding-subscription-oauth@0.6.3
+dsh plugin --profile web add dsh-coding-subscription-oauth@0.6.5
 dsh plugin --profile web update dsh-coding-subscription-oauth
 ```
 
@@ -26,7 +26,7 @@ dsh plugin --profile web update dsh-coding-subscription-oauth
 
 ```bash
 # 普通用户：当前 npm 发布版
-dsh plugin --profile web add dsh-coding-subscription-oauth@0.6.3
+dsh plugin --profile web add dsh-coding-subscription-oauth@0.6.5
 
 # 开发 / 备用：从 GitHub
 dsh plugin --profile web add github:lninghaha/dsh-coding-subscription-oauth
@@ -44,8 +44,10 @@ dsh plugin --profile web add dsh-agy@0.1.2
 
 - 本版按 DSH `0.1.1-rc.2` 的精确兼容矩阵发布；生产环境应锁定已验证的 BOM，不要用 `*` 或未验证的宽泛 peer range。
 - 从 `0.6.0` 升级到 `0.6.2` 后再重启：`0.6.0` 在严格 Cordis 注入检查下可能因读取尚未注入的可选服务而拖垮插件树。这个补丁不迁移或重置 OAuth 凭据、Gateway、模型/适配器 ID 与缓存。
-- 在同一个 **web profile** 中先保证 `dsh-coding-oauth-core@0.1.0` 可从 npm 解析，再安装 Subscription `0.6.3`（以及需要的 `dsh-hub-oauth-gateway@1.10.0`）。Core 只是共享 npm 依赖，不是单独的 DSH 插件，用户不需要执行 `dsh plugin add dsh-coding-oauth-core`。
-- 共装 Hub 与 Subscription 时，先安装 `dsh-hub-oauth-gateway@1.10.0` 与 Subscription `0.6.3`，完成后只重启一次现有 DSH Web 进程；Hub 提供完整用量中心，Subscription 显示紧凑状态入口。只升级 Subscription 仍可独立工作。
+- 从 `0.6.3` 升级到 `0.6.4`：统一固定 `dsh-coding-oauth-core@0.1.1` 与 `undici@7.29.0`；无配置、凭据、数据或路由迁移。
+- 从 `0.6.4` 升级到 `0.6.5`：Gateway key 的 reveal/rotate 仅限 `accessMode === "loopback"`（与 Settings UI 一致）；无配置、凭据、数据或路由迁移。npm 包不再附带 `src/`，运行时仍为生成的 `lib/`。
+- 在同一个 **web profile** 中先保证 `dsh-coding-oauth-core@0.1.1` 可从 npm 解析，再安装 Subscription `0.6.5`（以及需要的 `dsh-hub-oauth-gateway@1.11.1`）。Core 只是共享 npm 依赖，不是单独的 DSH 插件，用户不需要执行 `dsh plugin add dsh-coding-oauth-core`。
+- 共装 Hub 与 Subscription 时，先安装 `dsh-hub-oauth-gateway@1.11.1` 与 Subscription `0.6.5`，完成后只重启一次现有 DSH Web 进程；Hub 提供完整用量中心，Subscription 显示紧凑状态入口。只升级 Subscription 仍可独立工作。
 - 升级会保留既有 Cordis id、OAuth 凭据文件、模型/适配器 ID、Gateway 配置和模型缓存；不要为了“清理旧版本”删除这些文件。若旧包名 `dsh-grok-build` 仍在 profile 中，只移除那条旧插件记录，再安装当前包，避免重复路由。
 - 回滚时恢复上一个插件版本并重启一次，保留凭据和配置；先查看兼容性诊断与失败原因，不要用清空凭据来代替回滚。
 - DSH Web 与本地 Gateway 继续只绑定 loopback。远程 Settings 只能走 SSH 隧道或满足 owner proof、精确 Origin 和 CSRF proof 的 HTTPS 反向代理；升级不会放宽到 `0.0.0.0`。

package/README.de.md

@@ -4,7 +4,7 @@
 
 # 🔐 dsh-coding-subscription-oauth
 
-**v0.6.3 · früher `dsh-grok-build`
+**v0.6.5 · früher `dsh-grok-build`
 
 **OAuth-Plugin für Coding-Abonnements für [DeepSeek Harness](https://github.com/deepseek-ai/dsh).** Melden Sie sich einmal mit den Abonnements an, die Sie bereits bezahlen, und nutzen Sie die Modelle aus den Einstellungen oder der CLI von dsh. **Keine Tokens in den Chat einfügen.**
 
@@ -17,7 +17,7 @@
 
 ---
 
-> **Upgrade / 升级：** Follow the versioned steps in [`INSTALL.md`](INSTALL.md). Install into the existing `web` profile, keep profile/config/credential files, and restart one existing DSH Web process after all packages are updated. When Hub and Subscription are both used, `dsh-coding-oauth-core@0.1.0` is their shared npm dependency, not a separate DSH plugin.
+> **Upgrade:** Folgen Sie den versionierten Schritten in [`INSTALL.md`](INSTALL.md). `0.6.5` behält die gemeinsame Dispatcher-Laufzeitumgebung bei `dsh-coding-oauth-core@0.1.1` und `undici@7.29.0` und beschränkt Reveal/Rotate des Gateway-Schlüssels auf Loopback-Zugriff; eine Migration von Konfiguration, Anmeldedaten, Daten oder Routen ist nicht erforderlich. Grok Imagine behält seinen explizit gepinnten Dispatcher. Releases ab `0.6.2` enthalten den strengen Cordis-Injection-Startfix und Unterstützung für DSH `0.1.1-rc.2`; behalten Sie Profil-/Konfigurations-/Anmeldedateien und starten Sie den bestehenden DSH-Web-Prozess nach dem Update nur einmal neu. Wenn Hub und Subscription zusammen genutzt werden, sind `dsh-coding-oauth-core@0.1.1` und `undici@7.29.0` ihr gemeinsamer Runtime-Pin, kein separates DSH-Plugin.
 
 ---
 
@@ -27,7 +27,7 @@ Zuerst **`dsh-grok-build`** (nur Grok Build). Jetzt SuperGrok / Codex / Kimi / C
 | | Das verwenden | Funktioniert weiter |
 |---|---|---|
 | GitHub / `dsh plugin add` | [`dsh-coding-subscription-oauth`](https://github.com/lninghaha/dsh-coding-subscription-oauth) | `github:lninghaha/dsh-grok-build` (derselbe `main`) |
-| npm | `dsh-coding-subscription-oauth@0.6.3` (aktuelle Version) | Es gab kein altes npm-Paket |
+| npm | `dsh-coding-subscription-oauth@0.6.5` (aktuelle Version) | Es gab kein altes npm-Paket |
 | CLI | `dsh-coding-oauth` | `dsh-grok-build` |
 | Cordis-Plugin-id | `llm-grok-build-oauth` | unverändert |
 | Settings-HTTP-API | `/plugins/dsh-grok-build/*` | unverändert |
@@ -77,7 +77,7 @@ Diese Suchbegriffe und DSH-Fehler führen meist hierher.
 
 ```bash
 # 1. Plugin in das Web-Profil installieren (aktuelle npm-Version)
-dsh plugin --profile web add dsh-coding-subscription-oauth@0.6.3
+dsh plugin --profile web add dsh-coding-subscription-oauth@0.6.5
 
 # 2. optional — Google Antigravity (gepinnte, geprüfte Version)
 dsh plugin --profile web add dsh-agy@0.1.2
@@ -118,7 +118,7 @@ Erfordert DeepSeek Harness `0.1.1-rc.2` und Node.js 22.19+. Vollständige Detail
 
 ```bash
 # aktuelle npm-Version (empfohlen)
-dsh plugin --profile web add dsh-coding-subscription-oauth@0.6.3
+dsh plugin --profile web add dsh-coding-subscription-oauth@0.6.5
 
 # Entwicklung/Alternativ: von GitHub
 dsh plugin --profile web add github:lninghaha/dsh-coding-subscription-oauth
@@ -177,7 +177,7 @@ Der Wähler listet nur Routen, die die Authentifizierung abgeschlossen haben; ni
 
 ## Optionale Funktionen
 
-Die acht Schalter `codexSearch`, `codexImages`, `codexImageEdits`, `codexImagesAnyModel`, `codexUsage`, `codexFast`, `grokImagineImage` und `grokImagineVideo` sind standardmäßig aus und werden ohne Neustart live angewendet. Die Grenzwerte sind `searchResults` (1–20, Standard 5), `imageCount` (1–4, Standard 1) und `videoArtifactTtlMs` (1 Stunde–7 Tage, Standard 7 Tage; die Oberfläche zeigt 1–168 Stunden). Eine kürzere Aufbewahrung verkürzt und bereinigt vorhandene Artefakte sofort; eine Erhöhung gilt nur für neue Artefakte.
+Die acht Schalter `codexSearch`, `codexImages`, `codexImageEdits`, `codexImagesAnyModel`, `codexUsage`, `codexFast`, `grokImagineImage` und `grokImagineVideo` sind standardmäßig aus und werden ohne Neustart live angewendet. `codexImagesAnyModel` lockert nur die Aufrufmodell-Routenbeschränkung; weiterhin erforderlich sind angemeldetes Codex, `codexImages` (und der Edits-Schalter für Bearbeitung) sowie Sitzungs-Anhangbesitz und Bearbeitungsautorisierung. Die Grenzwerte sind `searchResults` (1–20, Standard 5), `imageCount` (1–4, Standard 1) und `videoArtifactTtlMs` (1 Stunde–7 Tage, Standard 7 Tage; die Oberfläche zeigt 1–168 Stunden). Eine kürzere Aufbewahrung verkürzt und bereinigt vorhandene Artefakte sofort; eine Erhöhung gilt nur für neue Artefakte.
 
 ## Lokales API-Gateway
 

package/README.es.md

@@ -4,7 +4,7 @@
 
 # 🔐 dsh-coding-subscription-oauth
 
-**v0.6.3 · antes `dsh-grok-build`
+**v0.6.5 · antes `dsh-grok-build`
 
 **Plugin OAuth de suscripciones de codificación para [DeepSeek Harness](https://github.com/deepseek-ai/dsh).** Inicia sesión una vez con las suscripciones que ya pagas y luego usa sus modelos desde la página de configuración o la CLI de dsh. **Sin pegar tokens en el chat.**
 
@@ -17,7 +17,7 @@
 
 ---
 
-> **Upgrade / 升级：** Follow the versioned steps in [`INSTALL.md`](INSTALL.md). Install into the existing `web` profile, keep profile/config/credential files, and restart one existing DSH Web process after all packages are updated. When Hub and Subscription are both used, `dsh-coding-oauth-core@0.1.0` is their shared npm dependency, not a separate DSH plugin.
+> **Actualización:** Siga los pasos versionados en [`INSTALL.md`](INSTALL.md). `0.6.5` mantiene el runtime del dispatcher compartido en `dsh-coding-oauth-core@0.1.1` y `undici@7.29.0`, y restringe reveal/rotate de la clave del Gateway al acceso loopback; no se requiere migración de configuración, credenciales, datos o rutas. Grok Imagine conserva su dispatcher pinned explícito. Las versiones desde `0.6.2` incluyen la corrección estricta de inyección Cordis al inicio y compatibilidad con DSH `0.1.1-rc.2`; conserve los archivos de profile/config/credenciales y reinicie el proceso DSH Web existente solo una vez tras actualizar. Cuando se usan Hub y Subscription juntos, `dsh-coding-oauth-core@0.1.1` con `undici@7.29.0` es su pin de runtime compartido, no un plugin DSH aparte.
 
 ---
 
@@ -28,7 +28,7 @@ Empezó como **`dsh-grok-build`** (solo Grok Build). Ahora cubre SuperGrok / Cod
 | | Usa esto | Sigue funcionando |
 |---|---|---|
 | GitHub / `dsh plugin add` | [`dsh-coding-subscription-oauth`](https://github.com/lninghaha/dsh-coding-subscription-oauth) | `github:lninghaha/dsh-grok-build` (el mismo `main`) |
-| npm | `dsh-coding-subscription-oauth@0.6.3` (versión actual) | No se publicó un paquete npm legado |
+| npm | `dsh-coding-subscription-oauth@0.6.5` (versión actual) | No se publicó un paquete npm legado |
 | CLI | `dsh-coding-oauth` | `dsh-grok-build` |
 | Cordis plugin id | `llm-grok-build-oauth` | sin cambios |
 | API HTTP de ajustes | `/plugins/dsh-grok-build/*` | sin cambios |
@@ -77,7 +77,7 @@ Estas búsquedas y errores de DSH suelen traer a la gente hasta aquí.
 
 ```bash
 # 1. instala el plugin en el perfil web (versión actual de npm)
-dsh plugin --profile web add dsh-coding-subscription-oauth@0.6.3
+dsh plugin --profile web add dsh-coding-subscription-oauth@0.6.5
 
 # 2. opcional — Google Antigravity (versión fija revisada)
 dsh plugin --profile web add dsh-agy@0.1.2
@@ -118,7 +118,7 @@ Requiere DeepSeek Harness `0.1.1-rc.2` y Node.js 22.19+. Detalles completos en l
 
 ```bash
 # versión actual de npm (recomendado)
-dsh plugin --profile web add dsh-coding-subscription-oauth@0.6.3
+dsh plugin --profile web add dsh-coding-subscription-oauth@0.6.5
 
 # desarrollo/alternativo: desde GitHub
 dsh plugin --profile web add github:lninghaha/dsh-coding-subscription-oauth
@@ -178,7 +178,7 @@ El selector solo lista rutas que completaron la autenticación; los proveedores
 
 ## Capacidades opcionales
 
-Los ocho controles `codexSearch`, `codexImages`, `codexImageEdits`, `codexImagesAnyModel`, `codexUsage`, `codexFast`, `grokImagineImage` y `grokImagineVideo` empiezan desactivados y se aplican en vivo, sin reinicio. Los límites son `searchResults` (1–20, predeterminado 5), `imageCount` (1–4, predeterminado 1) y `videoArtifactTtlMs` (1 hora–7 días, predeterminado 7 días; la interfaz muestra 1–168 horas). Reducir la retención acorta y limpia los artefactos existentes de inmediato; aumentarla solo afecta a los nuevos.
+Los ocho controles `codexSearch`, `codexImages`, `codexImageEdits`, `codexImagesAnyModel`, `codexUsage`, `codexFast`, `grokImagineImage` y `grokImagineVideo` empiezan desactivados y se aplican en vivo, sin reinicio. `codexImagesAnyModel` solo relaja la restricción de ruta del modelo que llama; sigue exigiendo Codex con sesión iniciada, `codexImages` (y el interruptor de ediciones para editar) y conserva la propiedad de adjuntos de la sesión y la autorización de edición. Los límites son `searchResults` (1–20, predeterminado 5), `imageCount` (1–4, predeterminado 1) y `videoArtifactTtlMs` (1 hora–7 días, predeterminado 7 días; la interfaz muestra 1–168 horas). Reducir la retención acorta y limpia los artefactos existentes de inmediato; aumentarla solo afecta a los nuevos.
 
 ## Gateway de API local
 

package/README.fr.md

@@ -4,7 +4,7 @@
 
 # 🔐 dsh-coding-subscription-oauth
 
-**v0.6.3 · anciennement `dsh-grok-build`
+**v0.6.5 · anciennement `dsh-grok-build`
 
 **Plugin OAuth pour abonnements de codage de [DeepSeek Harness](https://github.com/deepseek-ai/dsh).** Connectez-vous une fois avec les abonnements que vous payez déjà, puis utilisez leurs modèles depuis la page de configuration ou la CLI dsh. **Aucun token collé dans le chat.**
 
@@ -17,7 +17,7 @@
 
 ---
 
-> **Upgrade / 升级：** Follow the versioned steps in [`INSTALL.md`](INSTALL.md). Install into the existing `web` profile, keep profile/config/credential files, and restart one existing DSH Web process after all packages are updated. When Hub and Subscription are both used, `dsh-coding-oauth-core@0.1.0` is their shared npm dependency, not a separate DSH plugin.
+> **Mise à niveau :** Suivez les étapes versionnées dans [`INSTALL.md`](INSTALL.md). `0.6.5` conserve le runtime du dispatcher partagé sur `dsh-coding-oauth-core@0.1.1` et `undici@7.29.0`, et limite reveal/rotate de la clé Gateway à l'accès loopback ; aucune migration de configuration, d'identifiants, de données ou de routes n'est requise. Grok Imagine conserve son dispatcher pinned explicite. Les versions à partir de `0.6.2` incluent la correction stricte d'injection Cordis au démarrage et le support de DSH `0.1.1-rc.2` ; conservez les fichiers profile/config/identifiants et redémarrez une seule fois le processus DSH Web existant après la mise à jour. Lorsque Hub et Subscription sont utilisés ensemble, `dsh-coding-oauth-core@0.1.1` avec `undici@7.29.0` est leur pin de runtime partagé, pas un plugin DSH distinct.
 
 ---
 
@@ -28,7 +28,7 @@ Le projet s'appelait **`dsh-grok-build`** (Grok Build uniquement). Il couvre mai
 | | Utiliser | Toujours valable |
 |---|---|---|
 | GitHub / `dsh plugin add` | [`dsh-coding-subscription-oauth`](https://github.com/lninghaha/dsh-coding-subscription-oauth) | `github:lninghaha/dsh-grok-build` (même `main`) |
-| npm | `dsh-coding-subscription-oauth@0.6.3` (version actuelle) | Aucun ancien paquet npm n'a été publié |
+| npm | `dsh-coding-subscription-oauth@0.6.5` (version actuelle) | Aucun ancien paquet npm n'a été publié |
 | CLI | `dsh-coding-oauth` | `dsh-grok-build` |
 | Cordis plugin id | `llm-grok-build-oauth` | inchangé |
 | API HTTP des réglages | `/plugins/dsh-grok-build/*` | inchangé |
@@ -77,7 +77,7 @@ Ce sont les recherches et erreurs DSH qui mènent le plus souvent ici.
 
 ```bash
 # 1. installez le plugin dans le profil web (version actuelle npm)
-dsh plugin --profile web add dsh-coding-subscription-oauth@0.6.3
+dsh plugin --profile web add dsh-coding-subscription-oauth@0.6.5
 
 # 2. optionnel — Google Antigravity (version épinglée examinée)
 dsh plugin --profile web add dsh-agy@0.1.2
@@ -118,7 +118,7 @@ Nécessite DeepSeek Harness `0.1.1-rc.2` et Node.js 22.19+. Détails complets da
 
 ```bash
 # version actuelle npm (recommandé)
-dsh plugin --profile web add dsh-coding-subscription-oauth@0.6.3
+dsh plugin --profile web add dsh-coding-subscription-oauth@0.6.5
 
 # développement/alternatif : depuis GitHub
 dsh plugin --profile web add github:lninghaha/dsh-coding-subscription-oauth
@@ -178,7 +178,7 @@ Le sélecteur ne liste que les routes ayant terminé l'authentification ; les fo
 
 ## Capacités optionnelles
 
-Les huit options `codexSearch`, `codexImages`, `codexImageEdits`, `codexImagesAnyModel`, `codexUsage`, `codexFast`, `grokImagineImage` et `grokImagineVideo` sont désactivées par défaut et s'appliquent à chaud, sans redémarrage. Les limites sont `searchResults` (1–20, défaut 5), `imageCount` (1–4, défaut 1) et `videoArtifactTtlMs` (1 heure–7 jours, défaut 7 jours ; l'interface affiche 1–168 heures). Réduire la rétention raccourcit et nettoie immédiatement les artefacts existants ; l'augmenter ne concerne que les nouveaux.
+Les huit options `codexSearch`, `codexImages`, `codexImageEdits`, `codexImagesAnyModel`, `codexUsage`, `codexFast`, `grokImagineImage` et `grokImagineVideo` sont désactivées par défaut et s'appliquent à chaud, sans redémarrage. `codexImagesAnyModel` ne relâche que la contrainte de route du modèle appelant ; Codex connecté, `codexImages` (et le commutateur d'édition pour éditer), ainsi que la propriété des pièces jointes de session et l'autorisation d'édition restent requis. Les limites sont `searchResults` (1–20, défaut 5), `imageCount` (1–4, défaut 1) et `videoArtifactTtlMs` (1 heure–7 jours, défaut 7 jours ; l'interface affiche 1–168 heures). Réduire la rétention raccourcit et nettoie immédiatement les artefacts existants ; l'augmenter ne concerne que les nouveaux.
 
 ## Passerelle API locale
 

package/README.ja.md

@@ -4,7 +4,7 @@
 
 # 🔐 dsh-coding-subscription-oauth
 
-**v0.6.3 · 旧名 `dsh-grok-build`
+**v0.6.5 · 旧名 `dsh-grok-build`
 
 **DeepSeek Harness（dsh）のためのコーディングサブスクリプション OAuth プラグイン。** 支払い済みのサブスクリプションで一度きりのサインイン——その後は dsh の設定ページまたは CLI からそのモデルを使えます。**チャットにトークンを貼り付ける必要はありません。**
 
@@ -17,7 +17,7 @@
 
 ---
 
-> **Upgrade / 升级：** Follow the versioned steps in [`INSTALL.md`](INSTALL.md). Install into the existing `web` profile, keep profile/config/credential files, and restart one existing DSH Web process after all packages are updated. When Hub and Subscription are both used, `dsh-coding-oauth-core@0.1.0` is their shared npm dependency, not a separate DSH plugin.
+> **アップグレード：** [`INSTALL.md`](INSTALL.md) のバージョン別手順に従ってください。`0.6.5` は共有 dispatcher ランタイムを `dsh-coding-oauth-core@0.1.1` と `undici@7.29.0` に維持し、Gateway キーの reveal/rotate を loopback アクセスに限定します。設定・資格情報・データ・ルートの移行は不要です。Grok Imagine は明示的にピン留めされた dispatcher を維持します。`0.6.2` 以降のリリースには厳密な Cordis 注入起動修正と DSH `0.1.1-rc.2` 対応が含まれます。profile / 設定 / 資格情報ファイルはそのままにし、更新後に既存の DSH Web プロセスを一度だけ再起動してください。Hub と Subscription を併用する場合、`dsh-coding-oauth-core@0.1.1` と `undici@7.29.0` は共有ランタイムのピンであり、別の DSH プラグインではありません。
 
 ---
 
@@ -27,7 +27,7 @@
 | | これを使う | 互換 |
 |---|---|---|
 | GitHub / `dsh plugin add` | [`dsh-coding-subscription-oauth`](https://github.com/lninghaha/dsh-coding-subscription-oauth) | `github:lninghaha/dsh-grok-build`（同じ `main`） |
-| npm | `dsh-coding-subscription-oauth@0.6.3`（現在のリリース） | 旧 npm パッケージは公開されていない |
+| npm | `dsh-coding-subscription-oauth@0.6.5`（現在のリリース） | 旧 npm パッケージは公開されていない |
 | CLI | `dsh-coding-oauth` | `dsh-grok-build` |
 | Cordis プラグイン id | `llm-grok-build-oauth` | 変更なし |
 | 設定ページ HTTP API | `/plugins/dsh-grok-build/*` | 変更なし |
@@ -77,7 +77,7 @@ DSH にコーディングサブスクを載せるとき、よく次の検索語
 
 ```bash
 # 1. web プロファイルにプラグインをインストール（現在の npm リリース）
-dsh plugin --profile web add dsh-coding-subscription-oauth@0.6.3
+dsh plugin --profile web add dsh-coding-subscription-oauth@0.6.5
 
 # 2. 任意 — Google Antigravity（レビュー済みの固定バージョン）
 dsh plugin --profile web add dsh-agy@0.1.2
@@ -118,7 +118,7 @@ DeepSeek Harness `0.1.1-rc.2` と Node.js 22.19+ が前提です。詳細は[イ
 
 ```bash
 # 現在の npm リリース（推奨）
-dsh plugin --profile web add dsh-coding-subscription-oauth@0.6.3
+dsh plugin --profile web add dsh-coding-subscription-oauth@0.6.5
 
 # 開発／代替：GitHub から
 dsh plugin --profile web add github:lninghaha/dsh-coding-subscription-oauth
@@ -178,7 +178,7 @@ pnpm run smoke:deployed             # 実際の Codex/Kimi ツール呼び出し
 
 ## オプション機能
 
-8 つのスイッチ `codexSearch`、`codexImages`、`codexImageEdits`、`codexImagesAnyModel`、`codexUsage`、`codexFast`、`grokImagineImage`、`grokImagineVideo` はすべて既定でオフで、変更は再起動なしで反映されます。数値設定は `searchResults`（1–20、既定 5）、`imageCount`（1–4、既定 1）、`videoArtifactTtlMs`（1 時間–7 日、既定 7 日、UI は 1–168 時間）です。保持期間を短くすると既存の成果物も直ちに短縮・削除され、長くした場合は以後の成果物にのみ適用されます。
+8 つのスイッチ `codexSearch`、`codexImages`、`codexImageEdits`、`codexImagesAnyModel`、`codexUsage`、`codexFast`、`grokImagineImage`、`grokImagineVideo` はすべて既定でオフで、変更は再起動なしで反映されます。`codexImagesAnyModel` は呼び出しモデルのルート制限のみを緩和します。引き続き Codex へのサインイン、`codexImages`（編集時は edits フラグ）、セッション添付の所有権と編集認可が必要です。数値設定は `searchResults`（1–20、既定 5）、`imageCount`（1–4、既定 1）、`videoArtifactTtlMs`（1 時間–7 日、既定 7 日、UI は 1–168 時間）です。保持期間を短くすると既存の成果物も直ちに短縮・削除され、長くした場合は以後の成果物にのみ適用されます。
 
 ## ローカル API ゲートウェイ
 

package/README.ko.md

@@ -4,7 +4,7 @@
 
 # 🔐 dsh-coding-subscription-oauth
 
-**v0.6.3 · 이전 이름 `dsh-grok-build`
+**v0.6.5 · 이전 이름 `dsh-grok-build`
 
 **[DeepSeek Harness](https://github.com/deepseek-ai/dsh)용 코딩 구독 OAuth 플러그인.** 이미 결제한 구독으로 한 번에 로그인하고, dsh 설정 페이지나 CLI에서 그 모델을 사용하세요. **채팅에 토큰을 붙여넣을 필요가 없습니다.**
 
@@ -17,7 +17,7 @@
 
 ---
 
-> **Upgrade / 升级：** Follow the versioned steps in [`INSTALL.md`](INSTALL.md). Install into the existing `web` profile, keep profile/config/credential files, and restart one existing DSH Web process after all packages are updated. When Hub and Subscription are both used, `dsh-coding-oauth-core@0.1.0` is their shared npm dependency, not a separate DSH plugin.
+> **업그레이드:** [`INSTALL.md`](INSTALL.md)의 버전별 단계를 따르세요. `0.6.5`는 공유 dispatcher 런타임을 `dsh-coding-oauth-core@0.1.1`과 `undici@7.29.0`으로 유지하고, Gateway 키 reveal/rotate를 loopback 접근으로 제한합니다. 설정·자격 증명·데이터·라우트 마이그레이션은 필요 없습니다. Grok Imagine은 명시적으로 고정된 dispatcher를 유지합니다. `0.6.2` 이후 릴리스에는 엄격한 Cordis 주입 시작 수정과 DSH `0.1.1-rc.2` 지원이 포함됩니다. profile/설정/자격 증명 파일은 유지하고, 업데이트 후 기존 DSH Web 프로세스를 한 번만 재시작하세요. Hub와 Subscription을 함께 사용할 때 `dsh-coding-oauth-core@0.1.1`과 `undici@7.29.0`은 공유 런타임 핀이며 별도의 DSH 플러그인이 아닙니다.
 
 ---
 
@@ -27,7 +27,7 @@
 | | 이것을 쓰세요 | 계속 동작 |
 |---|---|---|
 | GitHub / `dsh plugin add` | [`dsh-coding-subscription-oauth`](https://github.com/lninghaha/dsh-coding-subscription-oauth) | `github:lninghaha/dsh-grok-build`（같은 `main`） |
-| npm | `dsh-coding-subscription-oauth@0.6.3`（현재 릴리스） | 레거시 npm 패키지는 게시된 적 없음 |
+| npm | `dsh-coding-subscription-oauth@0.6.5`（현재 릴리스） | 레거시 npm 패키지는 게시된 적 없음 |
 | CLI | `dsh-coding-oauth` | `dsh-grok-build` |
 | Cordis 플러그인 id | `llm-grok-build-oauth` | 그대로 |
 | 설정 페이지 HTTP API | `/plugins/dsh-grok-build/*` | 그대로 |
@@ -77,7 +77,7 @@
 
 ```bash
 # 1. web 프로필에 플러그인 설치 (현재 npm 릴리스)
-dsh plugin --profile web add dsh-coding-subscription-oauth@0.6.3
+dsh plugin --profile web add dsh-coding-subscription-oauth@0.6.5
 
 # 2. 선택 사항 — Google Antigravity (검증된 고정 버전)
 dsh plugin --profile web add dsh-agy@0.1.2
@@ -118,7 +118,7 @@ DeepSeek Harness `0.1.1-rc.2` 및 Node.js 22.19+가 필요합니다. 자세한
 
 ```bash
 # 현재 npm 릴리스 (권장)
-dsh plugin --profile web add dsh-coding-subscription-oauth@0.6.3
+dsh plugin --profile web add dsh-coding-subscription-oauth@0.6.5
 
 # 개발/대안: GitHub에서
 dsh plugin --profile web add github:lninghaha/dsh-coding-subscription-oauth
@@ -178,7 +178,7 @@ pnpm run smoke:deployed             # 실제 Codex/Kimi 도구 호출 + 두 번
 
 ## 선택적 기능
 
-8개 스위치 `codexSearch`, `codexImages`, `codexImageEdits`, `codexImagesAnyModel`, `codexUsage`, `codexFast`, `grokImagineImage`, `grokImagineVideo`는 모두 기본적으로 꺼져 있으며 재시작 없이 즉시 적용됩니다. 숫자 설정은 `searchResults`(1–20, 기본 5), `imageCount`(1–4, 기본 1), `videoArtifactTtlMs`(1시간–7일, 기본 7일, UI에서는 1–168시간)입니다. 보존 시간을 낮추면 기존 아티팩트도 즉시 단축·정리되며, 높인 값은 이후 생성된 아티팩트에만 적용됩니다.
+8개 스위치 `codexSearch`, `codexImages`, `codexImageEdits`, `codexImagesAnyModel`, `codexUsage`, `codexFast`, `grokImagineImage`, `grokImagineVideo`는 모두 기본적으로 꺼져 있으며 재시작 없이 즉시 적용됩니다. `codexImagesAnyModel`은 호출 모델 라우트 게이트만 완화합니다. 여전히 Codex 로그인, `codexImages`(편집 시 edits 플래그), 세션 첨부 소유권 및 편집 인가가 필요합니다. 숫자 설정은 `searchResults`(1–20, 기본 5), `imageCount`(1–4, 기본 1), `videoArtifactTtlMs`(1시간–7일, 기본 7일, UI에서는 1–168시간)입니다. 보존 시간을 낮추면 기존 아티팩트도 즉시 단축·정리되며, 높인 값은 이후 생성된 아티팩트에만 적용됩니다.
 
 ## 로컬 API 게이트웨이
 

package/README.md

@@ -4,7 +4,7 @@
 
 # 🔐 dsh-coding-subscription-oauth
 
-**v0.6.3** · formerly `dsh-grok-build`
+**v0.6.5** · formerly `dsh-grok-build`
 
 **Coding-subscription OAuth for [DeepSeek Harness](https://github.com/deepseek-ai/dsh).** Use SuperGrok / X Premium (Grok Build), ChatGPT Plus/Pro (Codex), Kimi Code, Claude Pro/Max and Google Antigravity inside DSH — without a second API-key bill and **without pasting any token into chat.**
 
@@ -17,7 +17,7 @@
 
 ---
 
-> **Upgrade / 升级：** Follow the versioned steps in [`INSTALL.md`](INSTALL.md). `0.6.3` includes the strict Cordis injection startup fix and DSH `0.1.1-rc.2` support; keep profile/config/credential files and restart one existing DSH Web process only after updating. `dsh-coding-oauth-core@0.1.0` remains a shared npm dependency, not a separate DSH plugin.
+> **Upgrade / 升级：** Follow the versioned steps in [`INSTALL.md`](INSTALL.md). `0.6.5` keeps the shared dispatcher runtime on `dsh-coding-oauth-core@0.1.1` and `undici@7.29.0`, and restricts gateway key reveal/rotate to loopback access; no configuration, credential, data, or route migration is required. Grok Imagine retains its explicit pinned dispatcher. Releases from `0.6.2` onward include the strict Cordis injection startup fix and DSH `0.1.1-rc.2` support; keep profile/config/credential files and restart one existing DSH Web process only after updating.
 
 ---
 
@@ -27,7 +27,7 @@ Published first as **`dsh-grok-build`** when it only covered Grok Build. The cur
 
 | | Use this | Still works |
 |---|---|---|
-| npm (recommended) | Current release is `0.6.3`: `dsh plugin --profile web add dsh-coding-subscription-oauth@0.6.3` | No legacy npm package was published |
+| npm (recommended) | Current release is `0.6.5`: `dsh plugin --profile web add dsh-coding-subscription-oauth@0.6.5` | No legacy npm package was published |
 | GitHub / development | [`dsh-coding-subscription-oauth`](https://github.com/lninghaha/dsh-coding-subscription-oauth) | Previous GitHub repo `dsh-grok-build` was removed |
 | CLI | `dsh-coding-oauth` | `dsh-grok-build` |
 | Cordis plugin id | `llm-grok-build-oauth` | unchanged |
@@ -81,7 +81,7 @@ Grok Build device login, live `/v1/models-v2` and Responses streaming are verifi
 
 ```bash
 # 1. install the current npm release into the web profile
-dsh plugin --profile web add dsh-coding-subscription-oauth@0.6.3
+dsh plugin --profile web add dsh-coding-subscription-oauth@0.6.5
 
 # 2. optional — Google Antigravity (pinned, reviewed version)
 dsh plugin --profile web add dsh-agy@0.1.2
@@ -122,7 +122,7 @@ Requires DeepSeek Harness `0.1.1-rc.2` and Node.js 22.19+. Full details in the [
 
 ```bash
 # current npm release
-dsh plugin --profile web add dsh-coding-subscription-oauth@0.6.3
+dsh plugin --profile web add dsh-coding-subscription-oauth@0.6.5
 
 # development / alternative: from GitHub
 dsh plugin --profile web add github:lninghaha/dsh-coding-subscription-oauth
@@ -184,7 +184,7 @@ The selector only lists routes that completed authentication; unauthenticated pr
 
 ## Optional capabilities
 
-All eight switches start **off** and apply **live** (no restart): `codexSearch`, `codexImages`, `codexImageEdits`, `codexImagesAnyModel`, `codexUsage`, `codexFast`, `grokImagineImage`, and `grokImagineVideo`. Numeric controls are `searchResults` (1–20, default 5), `imageCount` (1–4, default 1), and `videoArtifactTtlMs` (1 hour–7 days, default 7 days; the UI shows 1–168 hours). Lowering video retention shortens and cleans existing artifacts immediately; raising it affects only artifacts created afterward. Administrators may provide secret-free composition defaults under plugin config `capabilities`; live user settings in the `coding-subscription-oauth` settings section override that base, and omitting it keeps every switch off.
+All eight switches start **off** and apply **live** (no restart): `codexSearch`, `codexImages`, `codexImageEdits`, `codexImagesAnyModel`, `codexUsage`, `codexFast`, `grokImagineImage`, and `grokImagineVideo`. `codexImagesAnyModel` only relaxes the calling-model route gate; it still requires signed-in Codex, `codexImages` (and the edits flag for edit), and keeps session attachment ownership and edit authorization. Numeric controls are `searchResults` (1–20, default 5), `imageCount` (1–4, default 1), and `videoArtifactTtlMs` (1 hour–7 days, default 7 days; the UI shows 1–168 hours). Lowering video retention shortens and cleans existing artifacts immediately; raising it affects only artifacts created afterward. Administrators may provide secret-free composition defaults under plugin config `capabilities`; live user settings in the `coding-subscription-oauth` settings section override that base, and omitting it keeps every switch off.
 
 `codex-oauth-fast` is advertised only after a **fresh live catalog** lists at least one `priority`-eligible model. Those requests send `service_tier: priority` plus a routing hint. The UI says **Fast requested** and never guarantees latency or that upstream will honor the request.
 

package/README.pt-BR.md

@@ -4,7 +4,7 @@
 
 # 🔐 dsh-coding-subscription-oauth
 
-**v0.6.3 · antigo `dsh-grok-build`
+**v0.6.5 · antigo `dsh-grok-build`
 
 **Plugin de OAuth para assinaturas de codificação do [DeepSeek Harness](https://github.com/deepseek-ai/dsh).** Entre com as assinaturas que você já paga — depois use os modelos delas a partir da página de configurações do dsh ou da CLI. **Nenhum token colado no chat.**
 
@@ -17,7 +17,7 @@
 
 ---
 
-> **Upgrade / 升级：** Follow the versioned steps in [`INSTALL.md`](INSTALL.md). Install into the existing `web` profile, keep profile/config/credential files, and restart one existing DSH Web process after all packages are updated. When Hub and Subscription are both used, `dsh-coding-oauth-core@0.1.0` is their shared npm dependency, not a separate DSH plugin.
+> **Atualização:** Siga os passos versionados em [`INSTALL.md`](INSTALL.md). `0.6.5` mantém o runtime do dispatcher compartilhado em `dsh-coding-oauth-core@0.1.1` e `undici@7.29.0`, e restringe reveal/rotate da chave do Gateway ao acesso loopback; não é necessária migração de configuração, credenciais, dados ou rotas. Grok Imagine mantém seu dispatcher pinned explícito. Lançamentos a partir de `0.6.2` incluem a correção estrita de injeção Cordis na inicialização e suporte a DSH `0.1.1-rc.2`; conserve os arquivos de profile/config/credenciais e reinicie o processo DSH Web existente apenas uma vez após atualizar. Quando Hub e Subscription são usados juntos, `dsh-coding-oauth-core@0.1.1` com `undici@7.29.0` é o pin de runtime compartilhado, não um plugin DSH separado.
 
 ---
 
@@ -28,7 +28,7 @@ O projeto começou como **`dsh-grok-build`** (só Grok Build). Agora cobre Super
 | | Use isto | Ainda funciona |
 |---|---|---|
 | GitHub / `dsh plugin add` | [`dsh-coding-subscription-oauth`](https://github.com/lninghaha/dsh-coding-subscription-oauth) | `github:lninghaha/dsh-grok-build` (mesmo `main`) |
-| npm | `dsh-coding-subscription-oauth@0.6.3` (versão atual) | Nenhum pacote npm legado foi publicado |
+| npm | `dsh-coding-subscription-oauth@0.6.5` (versão atual) | Nenhum pacote npm legado foi publicado |
 | CLI | `dsh-coding-oauth` | `dsh-grok-build` |
 | Cordis plugin id | `llm-grok-build-oauth` | inalterado |
 | API HTTP das configurações | `/plugins/dsh-grok-build/*` | inalterado |
@@ -77,7 +77,7 @@ Estas são as buscas e erros do DSH que costumam trazer as pessoas até aqui.
 
 ```bash
 # 1. instale o plugin no perfil web (versão atual do npm)
-dsh plugin --profile web add dsh-coding-subscription-oauth@0.6.3
+dsh plugin --profile web add dsh-coding-subscription-oauth@0.6.5
 
 # 2. opcional — Google Antigravity (versão fixa revisada)
 dsh plugin --profile web add dsh-agy@0.1.2
@@ -118,7 +118,7 @@ Requer DeepSeek Harness `0.1.1-rc.2` e Node.js 22.19+. Detalhes completos nas [n
 
 ```bash
 # versão atual do npm (recomendado)
-dsh plugin --profile web add dsh-coding-subscription-oauth@0.6.3
+dsh plugin --profile web add dsh-coding-subscription-oauth@0.6.5
 
 # desenvolvimento/alternativo: do GitHub
 dsh plugin --profile web add github:lninghaha/dsh-coding-subscription-oauth
@@ -178,7 +178,7 @@ O seletor lista apenas rotas que concluíram a autenticação; provedores não a
 
 ## Capacidades opcionais
 
-Os oito controles `codexSearch`, `codexImages`, `codexImageEdits`, `codexImagesAnyModel`, `codexUsage`, `codexFast`, `grokImagineImage` e `grokImagineVideo` começam desativados e mudam ao vivo, sem reinício. Os limites são `searchResults` (1–20, padrão 5), `imageCount` (1–4, padrão 1) e `videoArtifactTtlMs` (1 hora–7 dias, padrão 7 dias; a interface mostra 1–168 horas). Reduzir a retenção encurta e limpa artefatos existentes imediatamente; aumentá-la vale apenas para novos artefatos.
+Os oito controles `codexSearch`, `codexImages`, `codexImageEdits`, `codexImagesAnyModel`, `codexUsage`, `codexFast`, `grokImagineImage` e `grokImagineVideo` começam desativados e mudam ao vivo, sem reinício. `codexImagesAnyModel` só afrouxa o gate de rota do modelo que chama; ainda exige Codex autenticado, `codexImages` (e o flag de edits para editar) e mantém a propriedade de anexos da sessão e a autorização de edição. Os limites são `searchResults` (1–20, padrão 5), `imageCount` (1–4, padrão 1) e `videoArtifactTtlMs` (1 hora–7 dias, padrão 7 dias; a interface mostra 1–168 horas). Reduzir a retenção encurta e limpa artefatos existentes imediatamente; aumentá-la vale apenas para novos artefatos.
 
 ## Gateway de API local
 

package/README.ru.md

@@ -4,7 +4,7 @@
 
 # 🔐 dsh-coding-subscription-oauth
 
-**v0.6.3 · ранее `dsh-grok-build`
+**v0.6.5 · ранее `dsh-grok-build`
 
 **Плагин OAuth для подписок на кодинг для [DeepSeek Harness](https://github.com/deepseek-ai/dsh).** Войдите один раз по уже оплаченным подпискам — и используйте их модели из страницы настроек или CLI dsh. **Никаких вставленных токенов в чат.**
 
@@ -17,7 +17,7 @@
 
 ---
 
-> **Upgrade / 升级：** Follow the versioned steps in [`INSTALL.md`](INSTALL.md). Install into the existing `web` profile, keep profile/config/credential files, and restart one existing DSH Web process after all packages are updated. When Hub and Subscription are both used, `dsh-coding-oauth-core@0.1.0` is their shared npm dependency, not a separate DSH plugin.
+> **Обновление:** Следуйте пошаговым инструкциям по версиям в [`INSTALL.md`](INSTALL.md). `0.6.5` сохраняет общий runtime диспетчера на `dsh-coding-oauth-core@0.1.1` и `undici@7.29.0` и ограничивает reveal/rotate ключа Gateway доступом loopback; миграция конфигурации, учётных данных, данных или маршрутов не требуется. Grok Imagine сохраняет явно закреплённый dispatcher. Релизы начиная с `0.6.2` включают строгое исправление запуска Cordis-инъекции и поддержку DSH `0.1.1-rc.2`; сохраните файлы profile/config/учётных данных и перезапустите существующий процесс DSH Web только один раз после обновления. При совместном использовании Hub и Subscription `dsh-coding-oauth-core@0.1.1` с `undici@7.29.0` — их общий runtime-pin, а не отдельный плагин DSH.
 
 ---
 
@@ -28,7 +28,7 @@
 | | Используйте | По-прежнему работает |
 |---|---|---|
 | GitHub / `dsh plugin add` | [`dsh-coding-subscription-oauth`](https://github.com/lninghaha/dsh-coding-subscription-oauth) | `github:lninghaha/dsh-grok-build` (тот же `main`) |
-| npm | `dsh-coding-subscription-oauth@0.6.3` (текущая версия) | Старого npm-пакета не было |
+| npm | `dsh-coding-subscription-oauth@0.6.5` (текущая версия) | Старого npm-пакета не было |
 | CLI | `dsh-coding-oauth` | `dsh-grok-build` |
 | Cordis plugin id | `llm-grok-build-oauth` | без изменений |
 | HTTP API страницы настроек | `/plugins/dsh-grok-build/*` | без изменений |
@@ -77,7 +77,7 @@
 
 ```bash
 # 1. установите текущую npm-версию в web-профиль
-dsh plugin --profile web add dsh-coding-subscription-oauth@0.6.3
+dsh plugin --profile web add dsh-coding-subscription-oauth@0.6.5
 
 # 2. опционально — Google Antigravity (зафиксированная проверенная версия)
 dsh plugin --profile web add dsh-agy@0.1.2
@@ -118,7 +118,7 @@ dsh plugin --profile web add dsh-agy@0.1.2
 
 ```bash
 # текущая npm-версия (рекомендуется)
-dsh plugin --profile web add dsh-coding-subscription-oauth@0.6.3
+dsh plugin --profile web add dsh-coding-subscription-oauth@0.6.5
 
 # разработка/альтернатива: из GitHub
 dsh plugin --profile web add github:lninghaha/dsh-coding-subscription-oauth
@@ -178,7 +178,7 @@ pnpm run smoke:deployed             # реальные вызовы Codex/Kimi +
 
 ## Дополнительные возможности
 
-Все восемь переключателей `codexSearch`, `codexImages`, `codexImageEdits`, `codexImagesAnyModel`, `codexUsage`, `codexFast`, `grokImagineImage` и `grokImagineVideo` по умолчанию выключены и применяются без перезапуска. Ограничения: `searchResults` (1–20, по умолчанию 5), `imageCount` (1–4, по умолчанию 1) и `videoArtifactTtlMs` (1 час–7 дней, по умолчанию 7 дней; в интерфейсе 1–168 часов). Уменьшение срока сразу сокращает и очищает существующие артефакты; увеличение действует только на новые.
+Все восемь переключателей `codexSearch`, `codexImages`, `codexImageEdits`, `codexImagesAnyModel`, `codexUsage`, `codexFast`, `grokImagineImage` и `grokImagineVideo` по умолчанию выключены и применяются без перезапуска. `codexImagesAnyModel` лишь ослабляет ограничение маршрута вызывающей модели; по-прежнему нужны вход в Codex, `codexImages` (и флаг edits для редактирования), а также сохраняются владение вложениями сессии и авторизация редактирования. Ограничения: `searchResults` (1–20, по умолчанию 5), `imageCount` (1–4, по умолчанию 1) и `videoArtifactTtlMs` (1 час–7 дней, по умолчанию 7 дней; в интерфейсе 1–168 часов). Уменьшение срока сразу сокращает и очищает существующие артефакты; увеличение действует только на новые.
 
 ## Локальный API-шлюз