dsh-copilot-catalog 0.0.0-stage → 0.2.0

package/CHANGELOG.md

@@ -0,0 +1,33 @@
+# Changelog
+
+## 0.2.0 — General discovery and Enterprise routing
+
+- Remove the model-ID allowlist and sibling templates. Construct any newly
+  discovered chat model from its advertised endpoint, limits, vision, reasoning,
+  and billing metadata.
+- Support Responses, Chat Completions, and native Anthropic Messages with
+  conservative protocol defaults and deterministic endpoint preference.
+- Stop guessing another model's pricing or reasoning capabilities. Preserve
+  upstream descriptors for IDs the bundled catalog already knows.
+- Remove discovery's dependency on a particular model's headers.
+- Derive Enterprise endpoints for OAuth grants and API-key access tokens, honor
+  explicit API-key URLs/references, and overlay routing defaults in memory for
+  new and bundled models even when listing fails.
+- Add actual DSH-adapter/SDK discovery and inference regressions with synthetic
+  Enterprise credentials and SSE responses; no live account calls or secret writes.
+
+## 0.1.0 — Initial release preparation
+
+- Convert the local Copilot catalog wrapper to strict TypeScript with ESM output
+  and generated type declarations.
+- Resolve the original adapter and its own pi-ai catalog using installed npm peers,
+  without platform-specific application paths or private OAuth imports.
+- Preserve upstream configuration, credential ownership, and model descriptors.
+- Add two explicit Responses-compatible sibling templates and account filtering.
+- Bound discovery end-to-end and prevent late responses from committing.
+- Harden catalog lookups, HTTP endpoint/redirect handling, and diagnostics.
+- Add DSH bundle metadata, regression tests, peer integration tests, npm package
+  allowlist checks, cross-platform CI, and a trusted-publishing release workflow.
+
+These entries describe prepared versions; source is available on GitHub, but no
+npm publication is implied.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 dsh-copilot-catalog contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,332 @@
-# Temporary Holding Version
+# dsh-copilot-catalog
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Account-aware **GitHub Copilot model discovery for DeepSeek Harness (DSH)**.
+Written in strict TypeScript; published as ESM JavaScript with type declarations.
+
+This experimental, third-party plugin wraps `@deepseek-ai/dsh-llm-pi-ai`. Before the
+adapter mounts, it reads your existing Copilot OAuth grant, fetches your account's
+`/models` catalog, and updates the **same in-memory pi-ai catalog** the adapter uses.
+No hard-coded application paths, credential-file edits, or signed-app modifications.
+
+## What it does
+
+- Shows picker-enabled models whose policy is enabled or absent and which do not
+  explicitly reject tool calls.
+- Preserves upstream descriptors for known IDs, including mixed API protocols.
+- Builds descriptors for **any newly discovered model ID**, without a model-name
+  allowlist, sibling template, or vendor-name heuristic. Transport selection uses
+  the advertised `supported_endpoints`:
+
+  | Advertised endpoint | pi-ai transport |
+  | --- | --- |
+  | `/responses` | `openai-responses` |
+  | `/v1/messages` | `anthropic-messages` |
+  | `/chat/completions` | `openai-completions` |
+
+  When multiple supported endpoints are offered, preference is Responses, native
+  Messages, then Chat Completions, independent of array order or model name.
+- Uses live positive context/output limits, vision support, advertised reasoning
+  efforts, and validated pricing for new models. Only unknown protocols, invalid
+  request IDs, non-chat/non-streaming models, or insufficient limits are skipped.
+  Missing pricing uses zero-valued **unknown rates**, not another model's prices.
+- Keeps **Enterprise routing for discovery and inference**, including known
+  bundled models and API-key auth. A validated account endpoint is applied as an
+  in-memory provider default even if the model listing later fails. Explicit
+  configured API-key endpoints are preserved; no profile setting is rewritten.
+- Leaves the current catalog untouched if discovery fails or yields no supported
+  models. On first startup this means all bundled defaults remain available.
+- Bounds the whole attempt to **10 seconds**, including credential reads, refresh,
+  auth resolution, fetch, and body parsing. Timed-out work cannot commit later.
+- Makes no credential-store writes. Expiring grants are refreshed only in memory;
+  the original adapter owns normal persisted refresh and its cross-process lock.
+- Requires HTTPS Copilot subdomains, refuses redirects and unusual ports, and
+  logs controlled error codes instead of potentially sensitive exception messages.
+
+## Compatibility
+
+| Component | Supported version |
+| --- | --- |
+| DSH and `@deepseek-ai/dsh-llm-pi-ai` | `0.2.0-rc.2` |
+| `@earendil-works/pi-ai` | `0.87.1` |
+| Node.js | `>=22.19.0` |
+| Runtime format | ESM only; no CommonJS entry |
+
+DSH and pi-ai are **peer dependencies**, not vendored copies. Runtime resolution
+starts from the adapter's location, so nested or pnpm layouts do not cause the
+plugin to update a different pi-ai instance. Type-only imports are erased by the
+compiler. The public Copilot provider supplies OAuth hooks; private auth modules
+are not imported. Version ranges are deliberately conservative: verify a new DSH
+or pi-ai version before widening them.
+
+## Enterprise authentication and endpoint routing
+
+This plugin also works around pi-ai's API-key path: an explicit API key bypasses
+OAuth `toAuth()`, so upstream otherwise retains the bundled Individual endpoint.
+The wrapper discovers an account endpoint and supplies it to the original adapter
+as a **runtime-only `baseURL` default**, covering new and bundled models.
+
+- **Stored Copilot OAuth grant:** use the provider's public `toAuth()` to derive
+  the account endpoint. The original adapter still owns persisted refresh and
+  derives request auth normally; Enterprise grants do not become Individual keys.
+- **Copilot access token supplied as an API key:** use its `proxy-ep` metadata to
+  derive the endpoint through the same read-only OAuth hook. This applies to stored
+  API-key records, explicit `apiKeyEnv` references, and ambient `COPILOT_GITHUB_TOKEN`.
+  An explicit reference wins over a different stored OAuth account, as in pi-ai.
+- **Opaque token:** no account endpoint can be inferred safely. Set the existing
+  provider `baseURL` field explicitly, or use DSH's normal Copilot OAuth sign-in.
+  Discovery reports `MISSING_ENDPOINT` rather than assuming the Individual API.
+- **GitHub PAT:** it is not a Copilot access token. The wrapper does not guess the
+  Enterprise GitHub domain or implement a second sign-in/exchange flow; use OAuth.
+
+For an explicit Enterprise API-key route, use a credential reference, not a literal
+key in your profile:
+
+```yaml
+- id: llm-pi-ai-catalog
+  name: dsh-copilot-catalog
+  config:
+    providers:
+      github-copilot:
+        apiKeyEnv: COPILOT_ACCESS_TOKEN
+        baseURL: https://api.enterprise.githubcopilot.com
+```
+
+Use the endpoint belonging to **your** account; do not assume Enterprise seats all
+share a GitHub Enterprise Server domain. Discovery only trusts HTTPS
+`*.githubcopilot.com` origins. Inferred API-key routing is a startup snapshot;
+restart after changing accounts or moving a key to a different endpoint. If no
+endpoint can be identified, the original adapter remains mounted with its original
+configuration, so an opaque Enterprise key still needs an explicit `baseURL`.
+
+## Installation
+
+> **Adapter replacement, not an add-on adapter.** The included DSH bundle disables
+> the standard `llm-pi-ai` entry and inserts `llm-pi-ai-catalog`, configured for
+> `github-copilot`. Do not enable another adapter for the same provider route.
+>
+> **Existing custom routes/settings are not copied automatically.** Before enabling
+> the bundle, back up your profile patch and copy every provider and override you
+> want to retain to the replacement entry. Its settings namespace is
+> `llm-pi-ai-catalog`; your OAuth grant keeps the original `llm-pi-ai/github-copilot`
+> key. A later profile/home patch that re-enables the original adapter must be fixed.
+
+### From npm, after publication
+
+Install the bundle through DSH's Plugins page, or use the CLI for your chosen
+profile (for example `desktop` or `web`):
+
+```sh
+dsh plugin --profile <profile> add dsh-copilot-catalog
+```
+
+Restart DSH after installing or changing this host-side plugin. The code has no
+browser component and does not modify or rebuild DSH's web UI.
+
+### From GitHub, after pushing this repository
+
+The Git repository includes the TypeScript source and build configuration. Its
+`prepare` script builds the ESM output when the package manager installs from Git.
+Use your actual repository URL in DSH's Plugins page or the CLI:
+
+```sh
+dsh plugin --profile <profile> add 'git+https://github.com/1yefuwang1/dsh-copilot-catalog.git'
+```
+
+### Local development
+
+```sh
+npm ci --ignore-scripts
+npm run build
+npm run verify
+# Only if you choose to enable it in an actual DSH profile:
+dsh plugin --profile <profile> add -w .
+```
+
+Local linking affects that profile; it is not part of the automated test suite.
+Neither this repository nor its tests automatically edit your active profile.
+
+### Preserve additional provider configuration
+
+Add a higher-priority override to your own profile patch before enabling the bundle.
+Copy the **full provider configuration** from your original adapter, including
+custom URLs, models, headers and overrides, as needed:
+
+```yaml
+- id: llm-pi-ai-catalog
+  name: dsh-copilot-catalog
+  config:
+    providers:
+      github-copilot: {}
+      openai:
+        apiKeyEnv: OPENAI_API_KEY
+```
+
+All original adapter configuration fields remain valid. The wrapper exports the
+original `Config` schema unchanged; it adds no secret or custom discovery settings.
+An inferred endpoint is overlaid only while the adapter reads the configuration;
+settings persistence, explicit URLs, and other providers are left untouched.
+If your original adapter has a different entry ID, adjust the disabling override
+in your profile accordingly.
+
+### Check startup
+
+Successful discovery logs `Copilot catalog synced` with the supported model count
+and JSON-escaped unsupported IDs. Failures log one of `TIMEOUT`, `HTTP_ERROR`,
+`INVALID_CATALOG`, `UNTRUSTED_ENDPOINT`, `INVALID_AUTH`, `MISSING_ENDPOINT`,
+`IMMUTABLE_CATALOG`, or `DISCOVERY_FAILED`; startup still delegates to the original
+adapter. Missing Copilot credentials keep the defaults. A validated runtime
+endpoint is logged separately without any token or credential value. Sign in through DSH's normal Copilot authorization
+flow, then restart to perform account discovery.
+
+### Rollback
+
+Disable or remove this bundle with DSH's Plugins page, remove any profile overrides
+that still enable the replacement, and re-enable the standard `llm-pi-ai` entry if
+your own profile has disabled it. Restore your backed-up provider configuration and
+restart the **whole DSH process** to reset its in-memory catalog. Do not delete the
+OAuth grant. The wrapper does not patch the signed application or store a catalog
+on disk.
+
+## Development and tests
+
+```sh
+npm ci --ignore-scripts
+npm run check:secrets   # scan Git candidates; never print suspected secret values
+npm run typecheck       # strict TypeScript, no emit
+npm run build           # dist/*.js plus dist/*.d.ts
+npm test                # synthetic unit/lifecycle/security regression tests
+npm run test:integration # real npm peers; no account or network requests
+npm run test:types      # a strict TS consumer checks the published declarations
+npm run test:pack       # exact npm tarball allowlist, including declarations
+npm run verify         # all of the above
+npm pack --dry-run
+```
+
+The tests use synthetic credentials and response/SSE fixtures. They cover arbitrary
+new IDs, three advertised protocols, prototype-sensitive IDs, reasoning metadata,
+unknown pricing, read-only refresh, endpoint restrictions, deadlines, late responses,
+fail-open delegation, and safe diagnostics. Integration tests mount the **actual DSH
+adapter** and exercise real SDK request construction for OAuth Enterprise grants,
+API-key overrides, stored access tokens, explicit URLs, and failed model listing.
+Every mocked discovery/inference request is asserted to target the Enterprise origin.
+No live Copilot request or authentication flow is run automatically.
+
+- [`src/index.ts`](src/index.ts): DSH entry point.
+- [`src/runtime.ts`](src/runtime.ts): shared adapter/pi-ai resolution.
+- [`src/catalog.ts`](src/catalog.ts): pure selection and pricing.
+- [`src/discovery.ts`](src/discovery.ts): bounded read-only discovery.
+- [`src/plugin.ts`](src/plugin.ts): adapter lifecycle and safe logging.
+- [`src/types.ts`](src/types.ts): public interfaces and upstream type integration.
+
+For scripts that only need model selection, the `dsh-copilot-catalog/catalog`
+subpath is side-effect-free. Pass an explicit bundled catalog:
+
+```ts
+import { selectAccountModels } from 'dsh-copilot-catalog/catalog';
+import { GITHUB_COPILOT_MODELS } from '@earendil-works/pi-ai/providers/github-copilot.models';
+
+const { models, unsupported } = selectAccountModels(response, GITHUB_COPILOT_MODELS);
+```
+
+The package root loads the adapter peers but does not read credentials or perform
+network I/O until `apply()` or `syncCopilotCatalog()` is called. The
+`dsh-copilot-catalog/discovery` helper takes explicit injected dependencies for tests
+and tooling.
+
+## Publish to GitHub and npm
+
+The package name is `dsh-copilot-catalog`; availability can change before npm
+publication. The GitHub repository is
+[`1yefuwang1/dsh-copilot-catalog`](https://github.com/1yefuwang1/dsh-copilot-catalog),
+and its repository, homepage, and issue-tracker metadata are configured. Personal
+author details remain intentionally unset.
+
+1. If publishing a fork, update its repository metadata before publishing:
+
+   ```sh
+   npm pkg set 'repository.type=git' \
+     'repository.url=git+https://github.com/OWNER/REPOSITORY.git' \
+     'homepage=https://github.com/OWNER/REPOSITORY#readme' \
+     'bugs.url=https://github.com/OWNER/REPOSITORY/issues'
+   # Optional: npm pkg set 'author=Your Name'
+   npm install --package-lock-only --ignore-scripts
+   ```
+
+2. Review the MIT license, package name, compatibility pins, bundle replacement,
+   and tarball contents. Update the changelog and run `npm run verify`.
+3. Commit and push the source and lockfile. If you have not initialized Git yet:
+
+   ```sh
+   git init -b main
+   git add .
+   git commit -m 'Initial TypeScript Copilot catalog plugin'
+   git remote add origin https://github.com/1yefuwang1/dsh-copilot-catalog.git
+   git push -u origin main
+   ```
+
+4. The unclaimed package has no npm settings page yet, so the first GitHub Actions
+   release needs a one-time granular npm token. Because the package does not yet
+   exist, grant the shortest-lived token the minimum package read/write permission
+   that can stage a public package. A stage-only token is sufficient; no 2FA bypass
+   is needed. Store it as the `NPM_TOKEN` secret in the GitHub `npm` environment.
+   Never commit or paste the token into an issue, log, workflow, or configuration.
+5. Push a matching `vX.Y.Z` tag and publish a GitHub Release for it. The workflow
+   validates tag/version and repository metadata, runs the credential audit,
+   tests, peer integration, declarations, and tarball allowlist, then runs
+   `npm stage publish` from GitHub Actions with provenance. For a new package, npm
+   exposes a `0.0.0-stage` placeholder; version contents remain private.
+6. Review `0.2.0` in npm's **Staged Packages** page and approve it with 2FA. Then
+   configure npm **Trusted Publisher** for GitHub user `1yefuwang1`, repository
+   `dsh-copilot-catalog`, workflow `publish.yml`, environment `npm`, allowing
+   `npm stage publish`. Delete the GitHub `NPM_TOKEN` environment secret. Later
+   releases authenticate through short-lived GitHub OIDC and still require staged
+   review/approval; npm detects OIDC before token fallback.
+
+CI runs on Linux, macOS and Windows, on Node 22 and 24. The publish workflow requires
+Node 24/npm 11.5.1+ for trusted publishing and only runs for a published GitHub
+Release, not for pull requests. The workflow stages rather than directly publishes;
+a maintainer approves each release with 2FA. The `NPM_TOKEN` fallback is only for
+the first staging operation and should be deleted after trusted publishing is configured.
+Generated `dist/` files stay out of Git; only the
+compiled runtime, declarations, DSH bundle patch, README, changelog and license
+enter the npm tarball. Review files, tests, dependencies and credentials do not.
+
+## Limitations
+
+- Discovery is a startup/mount snapshot, not continuous sync. Restart after login,
+  account changes, upgrades or rollback. Avoid hot-reloading this wrapper: a
+  process-wide catalog mutation can outlive its plugin mount.
+- Account discovery deliberately uses strict picker semantics. Individual accounts
+  that mark every picker flag false fall back to bundled defaults; the wrapper
+  does not broaden access using policy-only heuristics.
+- A successful sync mutates a shared Copilot catalog in memory. Mount only one
+  adapter instance. A failed later mount keeps the current process's catalog, not
+  necessarily the original defaults; a full restart resets it.
+- Existing upstream model descriptors are intentionally preserved, not refreshed
+  field-by-field. Newly discovered IDs use live metadata and conservative per-protocol
+  defaults. Unknown pricing is zero-valued metadata, not a claim that access is free.
+- New models require advertised supported endpoints and valid positive context/output
+  limits. No endpoint, family, or protocol is guessed from a model name. Optional
+  strict tools, developer-role support, long cache retention and advanced features
+  are not assumed; correct a model with the original adapter's `modelOverrides` if
+  its gateway needs additional compatibility settings.
+- Only recognized advertised reasoning-effort values are selectable (`none` maps to
+  `off`). Absent/unrecognized effort metadata does not invent reasoning settings;
+  native Anthropic `thinking: true` without an effort list uses standard budget
+  levels. Native Messages effort lists use adaptive thinking. Endpoint metadata is
+  not a guarantee that every optional feature works identically on every gateway.
+- Original adapter credential filtering, explicit `models` lists, and
+  `modelOverrides` still apply. This plugin neither enables account policies nor
+  changes stored `availableModelIds`; an upstream credential allowlist can still
+  hide a model until normal refresh/sign-in updates it.
+- Enterprise OAuth endpoints outside HTTPS `*.githubcopilot.com` are rejected by
+  discovery; normal adapter behavior remains available as fallback.
+- Upstream catalog structure, protocol compatibility and Copilot billing metadata
+  are not stable public contracts. Re-test protocol defaults and Enterprise routing
+  after updates. This package is not affiliated with DeepSeek, GitHub, or the pi-ai
+  maintainers.
+
+## License
+
+[MIT](LICENSE). Original DSH and pi-ai packages retain their own licenses; they are
+not redistributed in this tarball.

package/cordis.patch.yml

@@ -0,0 +1,11 @@
+# This bundle replaces the original adapter; never enable both for the same route.
+# Copy any other provider configuration into the replacement before enabling.
+- id: llm-pi-ai
+  name: '@deepseek-ai/dsh-llm-pi-ai'
+  disabled: true
+- insert:
+    - id: llm-pi-ai-catalog
+      name: dsh-copilot-catalog
+      config:
+        providers:
+          github-copilot: {}

package/dist/catalog.d.ts

@@ -0,0 +1,15 @@
+import type { ModelCost } from '@earendil-works/pi-ai';
+import { type AccountSelection, type ModelCatalog } from './types.js';
+export declare const DEFAULT_COPILOT_BASE_URL = "https://api.individual.githubcopilot.com";
+export interface AccountModelOptions {
+    /** Trusted account API root. Startup discovery supplies the validated OAuth origin. */
+    baseUrl?: string;
+}
+/** Copy only provider identity headers; never inherit Authorization or API keys. */
+export declare function copilotHeaders(catalog: ModelCatalog): Record<string, string>;
+/** Convert cents per million tokens only when every required price is valid. */
+export declare function liveCost(billing: unknown, fallback: ModelCost): ModelCost;
+/** Pure selection: preserve known descriptors; build any new ID from endpoint/capability metadata. */
+export declare function selectAccountModels(response: unknown, catalog: ModelCatalog, { baseUrl, }?: AccountModelOptions): AccountSelection;
+/** Validate mutability before touching a shared upstream catalog. */
+export declare function replaceCatalog(catalog: ModelCatalog, models: ModelCatalog): void;

package/dist/catalog.js

@@ -0,0 +1,191 @@
+import { asRecord } from './types.js';
+export const DEFAULT_COPILOT_BASE_URL = 'https://api.individual.githubcopilot.com';
+// Provider identity defaults match the supported pi-ai Copilot OAuth client.
+// These are protocol defaults, not metadata borrowed from a particular model.
+const DEFAULT_HEADERS = Object.freeze({
+    'User-Agent': 'GitHubCopilotChat/0.35.0',
+    'Editor-Version': 'vscode/1.107.0',
+    'Editor-Plugin-Version': 'copilot-chat/0.35.0',
+    'Copilot-Integration-Id': 'vscode-chat',
+});
+const ENDPOINTS = [
+    ['/responses', 'openai-responses'],
+    ['/v1/messages', 'anthropic-messages'],
+    ['/chat/completions', 'openai-completions'],
+];
+const THINKING_LEVELS = ['off', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max'];
+const PRICE_PARTS = ['input_price', 'output_price', 'cache_price', 'cache_write_price'];
+const positiveInteger = (value) => Number.isSafeInteger(value) && value > 0;
+const own = (object, key) => Object.hasOwn(object, key) ? object[key] : undefined;
+/** Copy only provider identity headers; never inherit Authorization or API keys. */
+export function copilotHeaders(catalog) {
+    const headers = { ...DEFAULT_HEADERS };
+    for (const model of Object.values(catalog)) {
+        if (model.provider !== 'github-copilot' || !model.headers)
+            continue;
+        let found = false;
+        for (const [name, fallback] of Object.entries(DEFAULT_HEADERS)) {
+            const entry = Object.entries(model.headers).find(([key]) => key.toLowerCase() === name.toLowerCase());
+            if (entry && entry[1].trim() && !/[\r\n]/.test(entry[1])) {
+                headers[name] = entry[1];
+                found = true;
+            }
+            else {
+                headers[name] = fallback;
+            }
+        }
+        if (found)
+            break;
+    }
+    return headers;
+}
+function validPrices(value) {
+    const record = asRecord(value);
+    return record !== undefined && PRICE_PARTS.every((key) => typeof record[key] === 'number' &&
+        Number.isFinite(record[key]) && record[key] >= 0);
+}
+/** Convert cents per million tokens only when every required price is valid. */
+export function liveCost(billing, fallback) {
+    const prices = asRecord(asRecord(billing)?.token_prices);
+    const regular = asRecord(prices?.default);
+    if (prices?.batch_size !== 1_000_000 || !validPrices(regular))
+        return fallback;
+    const convert = (value) => ({
+        input: value.input_price / 100,
+        output: value.output_price / 100,
+        cacheRead: value.cache_price / 100,
+        cacheWrite: value.cache_write_price / 100,
+    });
+    const cost = convert(regular);
+    if (positiveInteger(regular.context_max) && validPrices(prices.long_context)) {
+        cost.tiers = [{ inputTokensAbove: regular.context_max, ...convert(prices.long_context) }];
+    }
+    return cost;
+}
+function reasoningMetadata(api, supports) {
+    const efforts = supports?.reasoning_effort;
+    if (Array.isArray(efforts)) {
+        const map = {};
+        for (const level of THINKING_LEVELS) {
+            const wire = level === 'off' && efforts.includes('none') ? 'none' : level;
+            map[level] = efforts.includes(wire) ? wire : null;
+        }
+        const reasoning = THINKING_LEVELS.some((level) => level !== 'off' && typeof map[level] === 'string');
+        // A native Messages effort list describes adaptive output_config.effort.
+        return { reasoning, thinkingLevelMap: map, adaptiveThinking: api === 'anthropic-messages' && reasoning };
+    }
+    if (api === 'anthropic-messages' && supports?.thinking === true) {
+        // Legacy native thinking advertises a budget rather than effort spellings.
+        // Use pi-ai's standard budget levels, without inventing xhigh/max support.
+        return { reasoning: true, thinkingLevelMap: { xhigh: null, max: null }, adaptiveThinking: false };
+    }
+    // Missing/unknown effort metadata must not invent user-selectable reasoning.
+    return { reasoning: false, adaptiveThinking: false };
+}
+function protocolCompat(api, reasoning, adaptiveThinking) {
+    switch (api) {
+        case 'openai-responses': return {
+            supportsDeveloperRole: false,
+            supportsStrictMode: false,
+            supportsLongCacheRetention: false,
+        };
+        case 'openai-completions': return {
+            supportsDeveloperRole: false,
+            supportsStrictMode: false,
+            supportsStore: false,
+            supportsUsageInStreaming: false,
+            supportsLongCacheRetention: false,
+            supportsReasoningEffort: reasoning,
+            thinkingFormat: 'openai',
+        };
+        case 'anthropic-messages': return {
+            forceAdaptiveThinking: adaptiveThinking,
+            supportsStrictTools: false,
+            supportsTemperature: false,
+            supportsLongCacheRetention: false,
+            supportsCacheControlOnTools: false,
+            supportsEagerToolInputStreaming: false,
+        };
+    }
+}
+function createNewModel(item, headers, baseUrl) {
+    // IDs are opaque; reject malformed request IDs, never infer a vendor/family.
+    const endpoints = item.supported_endpoints;
+    if (/[\s\u0000-\u001f\u007f]/u.test(item.id) || !Array.isArray(endpoints))
+        return undefined;
+    const api = ENDPOINTS.find(([endpoint]) => endpoints.includes(endpoint))?.[1];
+    if (!api)
+        return undefined;
+    const capabilities = asRecord(item.capabilities);
+    if (capabilities?.type !== undefined && capabilities.type !== 'chat')
+        return undefined;
+    const limits = asRecord(capabilities?.limits);
+    if (!positiveInteger(limits?.max_context_window_tokens) || !positiveInteger(limits.max_output_tokens) ||
+        limits.max_output_tokens > limits.max_context_window_tokens)
+        return undefined;
+    const supports = asRecord(capabilities?.supports);
+    if (supports?.streaming === false)
+        return undefined;
+    const { reasoning, thinkingLevelMap, adaptiveThinking } = reasoningMetadata(api, supports);
+    return {
+        id: item.id,
+        name: typeof item.name === 'string' && item.name.trim() ? item.name : item.id,
+        api,
+        provider: 'github-copilot',
+        baseUrl,
+        contextWindow: limits.max_context_window_tokens,
+        maxTokens: limits.max_output_tokens,
+        input: supports?.vision === true ? ['text', 'image'] : ['text'],
+        // Unknown pricing is represented by zero, never a guessed sibling's rates.
+        cost: liveCost(item.billing, { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 }),
+        reasoning,
+        ...(thinkingLevelMap ? { thinkingLevelMap } : {}),
+        compat: protocolCompat(api, reasoning, adaptiveThinking),
+        headers: { ...headers },
+    };
+}
+/** Pure selection: preserve known descriptors; build any new ID from endpoint/capability metadata. */
+export function selectAccountModels(response, catalog, { baseUrl = DEFAULT_COPILOT_BASE_URL, } = {}) {
+    const data = asRecord(response)?.data;
+    if (!Array.isArray(data))
+        throw new Error('Invalid Copilot /models response');
+    if (!catalog || typeof catalog !== 'object')
+        throw new TypeError('A bundled model catalog is required');
+    const headers = copilotHeaders(catalog);
+    const models = Object.create(null);
+    const unsupported = new Set();
+    for (const raw of data) {
+        const item = asRecord(raw);
+        const policy = asRecord(item?.policy);
+        const supports = asRecord(asRecord(item?.capabilities)?.supports);
+        if (!item || typeof item.id !== 'string' || !item.id.trim() || item.model_picker_enabled !== true ||
+            (policy?.state !== undefined && policy.state !== 'enabled') || supports?.tool_calls === false ||
+            Object.hasOwn(models, item.id))
+            continue;
+        // Own-property lookup prevents Object.prototype members becoming descriptors.
+        const model = own(catalog, item.id) ?? createNewModel({ ...item, id: item.id }, headers, baseUrl);
+        if (model) {
+            models[item.id] = model;
+            unsupported.delete(item.id);
+        }
+        else {
+            unsupported.add(item.id);
+        }
+    }
+    if (Object.keys(models).length === 0)
+        throw new Error('No supported enabled Copilot models found');
+    return { models, unsupported: [...unsupported] };
+}
+/** Validate mutability before touching a shared upstream catalog. */
+export function replaceCatalog(catalog, models) {
+    const descriptors = Object.getOwnPropertyDescriptors(catalog);
+    if (!Object.isExtensible(catalog) || Object.values(descriptors).some((value) => !value.configurable)) {
+        throw new Error('The upstream Copilot catalog is not mutable');
+    }
+    // Plain data properties prevent setters and prototype-sensitive assignment.
+    for (const key of Object.keys(descriptors))
+        delete catalog[key];
+    for (const [key, value] of Object.entries(models)) {
+        Object.defineProperty(catalog, key, { value, enumerable: true, configurable: true, writable: true });
+    }
+}

package/dist/discovery.d.ts

@@ -0,0 +1,12 @@
+import { type CredentialReader, type DiscoveryOptions, type SyncResult } from './types.js';
+export declare const VERSION_HEADER = "2026-06-01";
+export declare const DEFAULT_TIMEOUT_MS = 10000;
+export declare class DiscoveryError extends Error {
+    readonly code: string;
+    readonly name = "DiscoveryError";
+    constructor(code: string, message: string);
+}
+/** Do not forward credentials to redirects, unrelated hosts, or unusual ports. */
+export declare function discoveryUrl(baseUrl: unknown): URL;
+/** One read-only, bounded startup discovery. All dependencies are explicit for tests. */
+export declare function syncCopilotCatalog(credentials: CredentialReader | undefined, { catalog, oauth, recordKey, fetcher, timeoutMs, now, baseUrl, resolveApiKey, resolveAmbientApiKey, onEndpoint, }: DiscoveryOptions): Promise<SyncResult>;

package/dist/discovery.js

@@ -0,0 +1,138 @@
+import { copilotHeaders, replaceCatalog, selectAccountModels } from './catalog.js';
+import { asRecord } from './types.js';
+export const VERSION_HEADER = '2026-06-01';
+export const DEFAULT_TIMEOUT_MS = 10_000;
+export class DiscoveryError extends Error {
+    code;
+    name = 'DiscoveryError';
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+    }
+}
+function oauthGrant(record) {
+    const entry = asRecord(record);
+    const grant = entry?.kind === 'grant' ? asRecord(entry.payload) : undefined;
+    return grant?.type === 'oauth' && typeof grant.refresh === 'string' && grant.refresh.trim() &&
+        typeof grant.access === 'string' && grant.access.trim() && typeof grant.expires === 'number' && Number.isFinite(grant.expires)
+        ? structuredClone(grant) : undefined;
+}
+/** Do not forward credentials to redirects, unrelated hosts, or unusual ports. */
+export function discoveryUrl(baseUrl) {
+    let base;
+    try {
+        if (typeof baseUrl !== 'string')
+            throw new TypeError();
+        base = new URL(baseUrl);
+    }
+    catch {
+        throw new DiscoveryError('UNTRUSTED_ENDPOINT', 'Unexpected Copilot API endpoint');
+    }
+    if (base.protocol !== 'https:' || !base.hostname.endsWith('.githubcopilot.com') ||
+        base.username || base.password || (base.port && base.port !== '443')) {
+        throw new DiscoveryError('UNTRUSTED_ENDPOINT', 'Unexpected Copilot API endpoint');
+    }
+    return new URL('/models', base);
+}
+/** One read-only, bounded startup discovery. All dependencies are explicit for tests. */
+export async function syncCopilotCatalog(credentials, { catalog, oauth, recordKey, fetcher = globalThis.fetch, timeoutMs = DEFAULT_TIMEOUT_MS, now = Date.now, baseUrl, resolveApiKey, resolveAmbientApiKey, onEndpoint, }) {
+    if (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0 || timeoutMs > 60_000) {
+        throw new TypeError('timeoutMs must be an integer between 1 and 60000');
+    }
+    const controller = new AbortController();
+    const { signal } = controller;
+    // Race the entire operation, including credential reads and OAuth hooks that
+    // might not cooperate with abort. A late response may never commit changes.
+    let timer;
+    const timeout = new Promise((_, reject) => {
+        timer = setTimeout(() => {
+            const error = new DiscoveryError('TIMEOUT', 'Copilot discovery timed out');
+            controller.abort(error);
+            reject(error);
+        }, timeoutMs);
+    });
+    const work = async () => {
+        const record = resolveApiKey ? undefined : await credentials?.readRecord(recordKey);
+        signal.throwIfAborted();
+        let credential = resolveApiKey ? undefined : oauthGrant(record);
+        let apiKey;
+        let url;
+        const adoptEndpoint = (value) => {
+            signal.throwIfAborted();
+            const endpoint = discoveryUrl(value);
+            onEndpoint?.(endpoint.origin);
+            return endpoint;
+        };
+        if (credential) {
+            // Capture routing before refresh/listing: fallback must not send an
+            // Enterprise account to the bundled Individual endpoint.
+            let auth = await oauth.toAuth(credential);
+            url = adoptEndpoint(auth.baseUrl);
+            if (now() + 5 * 60_000 >= credential.expires) {
+                // No credential-store writes. The original adapter owns locked refresh.
+                credential = await oauth.refresh(credential, signal);
+                signal.throwIfAborted();
+                auth = await oauth.toAuth(credential);
+                url = adoptEndpoint(auth.baseUrl);
+            }
+            apiKey = auth.apiKey;
+        }
+        else {
+            const entry = asRecord(record);
+            const storedKey = entry?.kind === 'api-key' && typeof entry.key === 'string' ? entry.key : undefined;
+            apiKey = resolveApiKey ? await resolveApiKey()
+                : storedKey ?? (entry?.kind === 'grant' ? undefined : await resolveAmbientApiKey?.());
+            signal.throwIfAborted();
+            if (typeof apiKey !== 'string' || !apiKey.trim())
+                return { status: 'no Copilot credential' };
+            if (baseUrl !== undefined) {
+                url = adoptEndpoint(baseUrl);
+            }
+            else if (/(?:^|;)proxy-ep=[^;]+/.test(apiKey)) {
+                // toAuth is read-only. It can decode an access token's proxy-ep without
+                // requiring a refresh token or synthesizing a persisted OAuth grant.
+                const auth = await oauth.toAuth({ type: 'oauth', access: apiKey, refresh: '', expires: 0 });
+                url = adoptEndpoint(auth.baseUrl);
+            }
+            else {
+                throw new DiscoveryError('MISSING_ENDPOINT', 'API-key auth requires a Copilot proxy endpoint or explicit baseURL');
+            }
+        }
+        signal.throwIfAborted();
+        if (typeof apiKey !== 'string' || !apiKey.trim()) {
+            throw new DiscoveryError('INVALID_AUTH', 'No usable Copilot API token');
+        }
+        const headers = new Headers(copilotHeaders(catalog));
+        headers.set('Accept', 'application/json');
+        headers.set('Authorization', `Bearer ${apiKey}`);
+        headers.set('X-GitHub-Api-Version', VERSION_HEADER);
+        const response = await fetcher(url, { headers, signal, redirect: 'error' });
+        signal.throwIfAborted();
+        if (!response.ok) {
+            throw new DiscoveryError('HTTP_ERROR', `Copilot model discovery returned HTTP ${response.status}`);
+        }
+        const body = await response.json();
+        signal.throwIfAborted();
+        let selected;
+        try {
+            selected = selectAccountModels(body, catalog, { baseUrl: url.origin });
+        }
+        catch {
+            throw new DiscoveryError('INVALID_CATALOG', 'No valid supported account catalog');
+        }
+        signal.throwIfAborted();
+        try {
+            replaceCatalog(catalog, selected.models);
+        }
+        catch {
+            throw new DiscoveryError('IMMUTABLE_CATALOG', 'The upstream Copilot catalog is not mutable');
+        }
+        return { status: 'synced', count: Object.keys(selected.models).length, unsupported: selected.unsupported };
+    };
+    try {
+        return await Promise.race([work(), timeout]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}

package/dist/index.d.ts

@@ -0,0 +1,9 @@
+import type { CopilotAuthOptions, CredentialReader, OriginalAdapter, PluginConfig, PluginContext } from './types.js';
+export declare const name = "llm-pi-ai";
+export declare const Config: OriginalAdapter['Config'];
+export declare const inject: string[];
+export declare const apply: (ctx: PluginContext, config: PluginConfig) => Promise<void>;
+export declare const syncCopilotCatalog: (credentials?: CredentialReader, authOptions?: CopilotAuthOptions) => Promise<import("./types.js").SyncResult>;
+export { selectAccountModels } from './catalog.js';
+export type { AccountModelOptions } from './catalog.js';
+export type { AccountSelection, CopilotAuthOptions, CredentialReader, ModelCatalog, SyncResult } from './types.js';

package/dist/index.js

@@ -0,0 +1,9 @@
+import { createPlugin } from './plugin.js';
+import { loadRuntime } from './runtime.js';
+const plugin = createPlugin(await loadRuntime());
+export const name = plugin.name;
+export const Config = plugin.Config;
+export const inject = plugin.inject;
+export const apply = (ctx, config) => plugin.apply(ctx, config);
+export const syncCopilotCatalog = (credentials, authOptions) => plugin.sync(credentials, authOptions);
+export { selectAccountModels } from './catalog.js';

package/dist/plugin.d.ts

@@ -0,0 +1,5 @@
+import type { CatalogPlugin, PluginConfig, PluginDependencies } from './types.js';
+/** Add an account endpoint as a runtime default, never as a persisted setting. */
+export declare function withCopilotEndpoint(config: PluginConfig, endpoint: string | undefined): PluginConfig;
+/** Keep integration separate from peer loading so lifecycle behavior is testable. */
+export declare function createPlugin({ original, catalog, oauth, fetcher, timeoutMs }: PluginDependencies): CatalogPlugin;

package/dist/plugin.js

@@ -0,0 +1,86 @@
+import { launchEnvironmentOf } from '@deepseek-ai/dsh-launch-environment';
+import { DiscoveryError, syncCopilotCatalog } from './discovery.js';
+/** Add an account endpoint as a runtime default, never as a persisted setting. */
+export function withCopilotEndpoint(config, endpoint) {
+    if (!endpoint)
+        return config;
+    const source = config.providers;
+    let previous;
+    let resolved;
+    const get = () => {
+        const raw = source.get();
+        if (raw === previous && resolved !== undefined)
+            return resolved;
+        const profile = raw['github-copilot'];
+        previous = raw;
+        // Explicit user baseURL wins. Do not overwrite other providers or settings.
+        resolved = !profile || profile.baseURL !== undefined && profile.baseURL !== null
+            ? raw : Object.freeze({ ...raw, 'github-copilot': Object.freeze({ ...profile, baseURL: endpoint }) });
+        return resolved;
+    };
+    return {
+        ...config,
+        // Volatile references are frozen. Copy their protocol (including symbols)
+        // into a detached facade instead of violating frozen-property Proxy rules.
+        providers: Object.freeze({ ...source, get }),
+    };
+}
+/** Keep integration separate from peer loading so lifecycle behavior is testable. */
+export function createPlugin({ original, catalog, oauth, fetcher, timeoutMs }) {
+    if (typeof original?.apply !== 'function' || typeof original.recordKeyFor !== 'function' ||
+        !original.Config || !Array.isArray(original.inject) || !catalog ||
+        typeof oauth?.refresh !== 'function' || typeof oauth.toAuth !== 'function') {
+        throw new Error('Incompatible DSH/pi-ai runtime; see the supported versions in README');
+    }
+    let accountEndpoint;
+    const plugin = {
+        name: original.name,
+        Config: original.Config,
+        inject: [...new Set([...original.inject, 'credentials'])],
+        sync: (credentials, authOptions) => {
+            accountEndpoint = undefined;
+            return syncCopilotCatalog(credentials, {
+                catalog, oauth, recordKey: original.recordKeyFor('github-copilot'), fetcher, timeoutMs,
+                ...authOptions,
+                onEndpoint: (endpoint) => { accountEndpoint = endpoint; },
+            });
+        },
+        async apply(ctx, config) {
+            try {
+                const credentials = ctx.get('credentials');
+                const profile = config.providers.get()['github-copilot'];
+                const ref = profile?.apiKeyEnv;
+                const readReference = async (value) => {
+                    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(value)) {
+                        throw new DiscoveryError('INVALID_AUTH', 'Invalid credential reference');
+                    }
+                    return (await credentials?.resolve(value))?.value;
+                };
+                const authOptions = {
+                    ...(typeof profile?.baseURL === 'string' ? { baseUrl: profile.baseURL } : {}),
+                    ...(typeof ref === 'string' ? { resolveApiKey: () => readReference(ref) } : {}),
+                    resolveAmbientApiKey: async () => (await readReference('COPILOT_GITHUB_TOKEN'))
+                        ?? launchEnvironmentOf(ctx).get('COPILOT_GITHUB_TOKEN')?.value,
+                };
+                const result = await plugin.sync(credentials, authOptions);
+                if (result.status === 'synced') {
+                    // JSON quoting prevents model IDs from injecting log lines.
+                    ctx.logger?.info?.('Copilot catalog synced: %d enabled models; unsupported new IDs: %s', result.count, JSON.stringify(result.unsupported));
+                }
+                else {
+                    ctx.logger?.info?.('Copilot catalog kept bundled defaults: %s', result.status);
+                }
+            }
+            catch (error) {
+                // Arbitrary OAuth/network/credential errors may include tokens or bodies.
+                // Only our controlled code is safe to log; never log the raw exception.
+                const reason = error instanceof DiscoveryError ? error.code : 'DISCOVERY_FAILED';
+                ctx.logger?.warn?.('Copilot model discovery failed; keeping current catalog: %s', reason);
+            }
+            if (accountEndpoint)
+                ctx.logger?.info?.('Copilot runtime endpoint: %s', accountEndpoint);
+            return original.apply(ctx, withCopilotEndpoint(config, accountEndpoint));
+        },
+    };
+    return plugin;
+}

package/dist/runtime.d.ts

@@ -0,0 +1,3 @@
+import type { PluginDependencies } from './types.js';
+/** Resolve pi-ai from the adapter, not the plugin: they must share one catalog. */
+export declare function loadRuntime(): Promise<PluginDependencies>;

package/dist/runtime.js

@@ -0,0 +1,30 @@
+import { createRequire, findPackageJSON } from 'node:module';
+import { dirname, join } from 'node:path';
+import { pathToFileURL } from 'node:url';
+/** Resolve pi-ai from the adapter, not the plugin: they must share one catalog. */
+export async function loadRuntime() {
+    const require = createRequire(import.meta.url);
+    let adapterEntry;
+    try {
+        adapterEntry = require.resolve('@deepseek-ai/dsh-llm-pi-ai');
+    }
+    catch {
+        throw new Error('dsh-copilot-catalog requires @deepseek-ai/dsh-llm-pi-ai@0.2.0-rc.2; install it in the same profile');
+    }
+    const adapterUrl = pathToFileURL(adapterEntry);
+    const piManifest = findPackageJSON('@earendil-works/pi-ai', adapterUrl);
+    if (!piManifest)
+        throw new Error('Cannot resolve the DSH adapter\'s pi-ai dependency');
+    const piRoot = dirname(piManifest);
+    // These are the public providers/* export targets in supported pi-ai 0.87.1.
+    // No private OAuth module or platform-specific application path is imported.
+    const [original, { GITHUB_COPILOT_MODELS: catalog }, { githubCopilotProvider }] = await Promise.all([
+        import(adapterUrl.href),
+        import(pathToFileURL(join(piRoot, 'dist/providers/github-copilot.models.js')).href),
+        import(pathToFileURL(join(piRoot, 'dist/providers/github-copilot.js')).href),
+    ]);
+    const oauth = githubCopilotProvider().auth?.oauth;
+    if (!oauth)
+        throw new Error('The installed pi-ai Copilot provider has no OAuth hooks');
+    return { original, catalog: catalog, oauth };
+}

package/dist/types.d.ts

@@ -0,0 +1,52 @@
+import type { Api, Model, OAuthAuth, OAuthCredential } from '@earendil-works/pi-ai';
+export type OriginalAdapter = Pick<typeof import('@deepseek-ai/dsh-llm-pi-ai'), 'name' | 'Config' | 'inject' | 'apply' | 'recordKeyFor'>;
+export type PluginContext = Parameters<OriginalAdapter['apply']>[0];
+export type PluginConfig = Parameters<OriginalAdapter['apply']>[1];
+export type CredentialKey = ReturnType<OriginalAdapter['recordKeyFor']>;
+export type ModelCatalog = Record<string, Model<Api>>;
+export type CopilotOAuth = Pick<OAuthAuth, 'refresh' | 'toAuth'>;
+export type CopilotGrant = OAuthCredential;
+/** Only the read seam is accepted; discovery has no credential write capability. */
+export interface CredentialReader {
+    readRecord(key: CredentialKey): Promise<unknown>;
+}
+export interface AccountSelection {
+    models: ModelCatalog;
+    unsupported: string[];
+}
+export type SyncResult = {
+    status: 'no Copilot credential';
+} | {
+    status: 'synced';
+    count: number;
+    unsupported: string[];
+};
+export interface CopilotAuthOptions {
+    /** Explicit API-key route endpoint; OAuth grants still own their derived endpoint. */
+    baseUrl?: string;
+    /** An explicit apiKeyEnv reference wins over the stored account grant, as in pi-ai. */
+    resolveApiKey?: () => Promise<string | undefined>;
+    /** Read-only ambient lookup, consulted only when no OAuth grant owns the route. */
+    resolveAmbientApiKey?: () => Promise<string | undefined>;
+}
+export interface DiscoveryOptions extends CopilotAuthOptions {
+    catalog: ModelCatalog;
+    oauth: CopilotOAuth;
+    recordKey: CredentialKey;
+    fetcher?: typeof globalThis.fetch;
+    timeoutMs?: number;
+    now?: () => number;
+    /** Routing may adopt a validated account endpoint even if model listing later fails. */
+    onEndpoint?: (baseUrl: string) => void;
+}
+export interface PluginDependencies extends Omit<DiscoveryOptions, 'recordKey'> {
+    original: OriginalAdapter;
+}
+export interface CatalogPlugin {
+    name: OriginalAdapter['name'];
+    Config: OriginalAdapter['Config'];
+    inject: string[];
+    sync(credentials?: CredentialReader, authOptions?: CopilotAuthOptions): Promise<SyncResult>;
+    apply(ctx: PluginContext, config: PluginConfig): Promise<void>;
+}
+export declare function asRecord(value: unknown): Record<string, unknown> | undefined;

package/dist/types.js

@@ -0,0 +1,4 @@
+export function asRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value)
+        ? value : undefined;
+}

package/package.json

@@ -1,6 +1,77 @@
 {
   "name": "dsh-copilot-catalog",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.2.0",
+  "description": "Account-aware GitHub Copilot model discovery for DeepSeek Harness, wrapping the existing pi-ai adapter.",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": { "types": "./dist/index.d.ts", "import": "./dist/index.js" },
+    "./catalog": { "types": "./dist/catalog.d.ts", "import": "./dist/catalog.js" },
+    "./discovery": { "types": "./dist/discovery.d.ts", "import": "./dist/discovery.js" },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist/",
+    "cordis.patch.yml",
+    "README.md",
+    "CHANGELOG.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "npm run build && node --test test/catalog.test.mjs test/discovery.test.mjs test/plugin.test.mjs test/secrets.test.mjs",
+    "check": "npm run typecheck && node scripts/check.mjs",
+    "verify": "npm run check:secrets && npm run check && npm test && npm run test:integration && npm run test:types && npm run test:pack",
+    "check:secrets": "node scripts/check-secrets.mjs",
+    "test:types": "npm run build && tsc -p test/types/tsconfig.json",
+    "test:integration": "npm run build && node --test test/integration/runtime.test.mjs test/integration/enterprise.test.mjs",
+    "test:pack": "npm run build && node scripts/check-pack.mjs",
+    "prepare": "npm run build",
+    "prepublishOnly": "npm run verify"
+  },
+  "keywords": [
+    "deepseek-harness",
+    "dsh",
+    "cordis-plugin",
+    "github-copilot",
+    "model-catalog",
+    "oauth"
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/1yefuwang1/dsh-copilot-catalog.git"
+  },
+  "homepage": "https://github.com/1yefuwang1/dsh-copilot-catalog#readme",
+  "bugs": {
+    "url": "https://github.com/1yefuwang1/dsh-copilot-catalog/issues"
+  },
+  "engines": {
+    "node": ">=22.19.0",
+    "dsh": "0.2.0-rc.2"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/dsh-llm-pi-ai": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-launch-environment": "0.2.0-rc.2",
+    "@earendil-works/pi-ai": "0.87.1"
+  },
+  "devDependencies": {
+    "@deepseek-ai/dsh-llm-pi-ai": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-launch-environment": "0.2.0-rc.2",
+    "@earendil-works/pi-ai": "0.87.1",
+    "@types/node": "^22.19.0",
+    "typescript": "~5.9.3"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    }
+  }
+}