dsh-edge 0.1.0 → 0.1.3

package/package.json

@@ -1,7 +1,8 @@
 {
   "name": "dsh-edge",
-  "version": "0.1.0",
-  "description": "Install and run DeepSeek Harness on Cloudflare Workers",
+  "version": "0.1.3",
+  "description": "Run DeepSeek Harness on Cloudflare Workers as an independent community project",
+  "author": "pawaca",
   "license": "MIT",
   "type": "module",
   "bin": {
@@ -9,7 +10,7 @@
   },
   "files": [
     "dist",
-    "src",
+    "worker",
     "scripts/*.d.mts",
     "scripts/*.mjs",
     "wrangler.jsonc",
@@ -44,52 +45,54 @@
   },
   "dependencies": {
     "@clack/prompts": "1.7.0",
-    "@cloudflare/computer": "0.2.0",
-    "just-bash": "3.3.0",
     "execa": "^10.0.0",
     "jsonc-parser": "^3.3.1",
-    "wrangler": "4.123.0",
+    "wrangler": "4.123.0"
+  },
+  "devDependencies": {
+    "@cloudflare/computer": "0.2.0",
+    "@cloudflare/workers-types": "5.20260812.1",
+    "just-bash": "3.3.0",
+    "playwright": "^1.49.0",
+    "typescript": "^6.0.3",
+    "vitest": "^4.1.8",
+    "ws": "^8.21.0",
     "@deepseek-ai/dsh-brand": "0.1.0-rc.7",
     "@deepseek-ai/cordis": "4.0.1",
-    "@deepseek-ai/dsh-anonymous-user-id": "0.1.0-rc.7",
-    "@deepseek-ai/dsh-host-apiproxy": "0.1.0-rc.7",
+    "@deepseek-ai/dsh-agent": "0.1.0-rc.7",
+    "@deepseek-ai/dsh-agent-loop": "0.1.0-rc.7",
     "@deepseek-ai/dsh-credentials": "0.1.0-rc.7",
+    "@deepseek-ai/dsh-host-apiproxy": "0.1.0-rc.7",
+    "@deepseek-ai/dsh-anonymous-user-id": "0.1.0-rc.7",
     "@deepseek-ai/dsh-launch-environment": "0.1.0-rc.7",
-    "@deepseek-ai/dsh-agent-loop": "0.1.0-rc.7",
     "@deepseek-ai/dsh-llm": "0.1.0-rc.7",
-    "@deepseek-ai/dsh-agent": "0.1.0-rc.7",
     "@deepseek-ai/dsh-llm-deepseek": "0.1.0-rc.7",
     "@deepseek-ai/dsh-session": "0.1.0-rc.7",
     "@deepseek-ai/dsh-session-persistence": "0.1.0-rc.7",
-    "@deepseek-ai/dsh-system-prompt": "0.1.0-rc.7",
     "@deepseek-ai/dsh-session-query": "0.1.0-rc.7",
-    "@deepseek-ai/dsh-tool-call-timeout-policy": "0.1.0-rc.7",
     "@deepseek-ai/dsh-settings": "0.1.0-rc.7",
-    "@deepseek-ai/dsh-tools": "0.1.0-rc.7",
-    "@deepseek-ai/dsh-tool-web": "0.1.0-rc.7",
+    "@deepseek-ai/dsh-system-prompt": "0.1.0-rc.7",
     "@deepseek-ai/dsh-session-title": "0.1.0-rc.7",
+    "@deepseek-ai/dsh-tool-web": "0.1.0-rc.7",
+    "@deepseek-ai/dsh-tool-call-timeout-policy": "0.1.0-rc.7",
+    "@deepseek-ai/dsh-tools": "0.1.0-rc.7",
     "@deepseek-ai/dsh-web": "0.1.0-rc.7",
     "@deepseek-ai/dsh-web-search-deepseek": "0.1.0-rc.7"
   },
-  "devDependencies": {
-    "@cloudflare/workers-types": "5.20260812.1",
-    "playwright": "^1.49.0",
-    "typescript": "^6.0.3",
-    "vitest": "^4.1.8",
-    "ws": "^8.21.0"
-  },
   "scripts": {
     "bundle:direct": "pnpm run web:build && node scripts/bundle.mjs direct",
     "bundle:isolated": "pnpm run web:build && node scripts/bundle.mjs isolated",
+    "bundle:workers": "node scripts/bundle.mjs direct && node scripts/bundle.mjs isolated",
     "dev": "pnpm run web:build && wrangler dev --env=\"\"",
     "dev:isolated": "pnpm run web:build && wrangler dev --env isolated",
     "dsh-edge": "node scripts/cli.mjs",
     "example:install": "node examples/install-keyless.mjs",
-    "install:cloudflare": "pnpm run web:build && node scripts/cli.mjs install",
+    "install:cloudflare": "pnpm run web:build && pnpm run bundle:workers && node scripts/cli.mjs install",
+    "legal:write": "node scripts/legal-files.mjs write",
     "pack:verify": "node scripts/verify-packed.mjs",
     "web:assemble": "node scripts/assemble-web.mjs",
     "web:build": "pnpm --workspace-root run build:lib:host && pnpm --workspace-root run build:lib:client && pnpm --workspace-root run build:web && pnpm run web:assemble",
-    "test": "vitest run --root ../.. apps/dsh-edge/tests/agent.spec.ts apps/dsh-edge/tests/auth.spec.ts apps/dsh-edge/tests/cli.spec.ts apps/dsh-edge/tests/deployment-health.spec.ts apps/dsh-edge/tests/deployment.spec.ts apps/dsh-edge/tests/direct-shell.spec.ts apps/dsh-edge/tests/do-session-persistence.spec.ts apps/dsh-edge/tests/edge-api.spec.ts apps/dsh-edge/tests/edge-credentials.spec.ts apps/dsh-edge/tests/edge-remotes.spec.ts apps/dsh-edge/tests/installer.spec.ts apps/dsh-edge/tests/sse.spec.ts apps/dsh-edge/tests/web-search.spec.ts apps/dsh-edge/tests/workspace.spec.ts",
+    "test": "vitest run --root ../.. apps/dsh-edge/tests/agent.spec.ts apps/dsh-edge/tests/auth.spec.ts apps/dsh-edge/tests/cli.spec.ts apps/dsh-edge/tests/deployment-health.spec.ts apps/dsh-edge/tests/deployment.spec.ts apps/dsh-edge/tests/direct-shell.spec.ts apps/dsh-edge/tests/do-session-persistence.spec.ts apps/dsh-edge/tests/edge-api.spec.ts apps/dsh-edge/tests/edge-credentials.spec.ts apps/dsh-edge/tests/edge-remotes.spec.ts apps/dsh-edge/tests/installer.spec.ts apps/dsh-edge/tests/sse.spec.ts apps/dsh-edge/tests/verify-packed.spec.ts apps/dsh-edge/tests/web-search.spec.ts apps/dsh-edge/tests/workspace.spec.ts",
     "test:integration": "pnpm run web:build && node tests/session.integration.mjs",
     "test:snapshot": "vitest run --config vitest.snapshot.config.ts",
     "typecheck": "tsc --noEmit"

package/scripts/assemble-web.mjs

@@ -23,7 +23,7 @@ const deploymentPatches = [
 ]
 // Deployment-owned browser features use the same client-plugin contract but
 // intentionally stay out of upstream's generic Web composition.
-const edgeClientPackages = ['@deepseek-ai/dsh-client-ui-edge']
+const edgeClientPackages = ['dsh-edge-client-ui']
 
 // HMR is useful only when the upstream Node host also runs its bundle watcher.
 // Edge deploys immutable, content-addressed static assets instead.

package/scripts/bundle.mjs

@@ -1,11 +1,15 @@
 import { createRequire } from 'node:module'
-import { mkdtemp, rm } from 'node:fs/promises'
+import { lstat, mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { execa } from 'execa'
+import edgePackage from '../package.json' with { type: 'json' }
 import { requireGzipBudget } from './bundle-size.mjs'
-import { writeModeWranglerConfig } from './wrangler-config.mjs'
+import {
+  workerArtifactPath,
+  writeSourceModeWranglerConfig,
+} from './wrangler-config.mjs'
 
 const DIRECT_GZIP_BUDGET_BYTES = 900 * 1024
 const appDirectory = fileURLToPath(new URL('..', import.meta.url))
@@ -21,12 +25,14 @@ if (mode !== 'direct' && mode !== 'isolated') {
   try {
     const configFile = join(directory, 'wrangler.json')
     const outputDirectory = join(directory, 'worker')
-    await writeModeWranglerConfig(mode, configFile)
+    await writeSourceModeWranglerConfig(mode, configFile)
     const result = await execa(process.execPath, [
       wranglerCli,
       'deploy',
       '--config', configFile,
       '--env', mode === 'direct' ? '' : 'isolated',
+      '--define',
+      `__DSH_EDGE_DEPLOYMENT_ID__:${JSON.stringify(`dsh-edge@${edgePackage.version}/${mode}`)}`,
       '--dry-run',
       '--outdir', outputDirectory,
     ], {
@@ -38,11 +44,14 @@ if (mode !== 'direct' && mode !== 'isolated') {
     process.stdout.write(output.endsWith('\n') ? output : `${output}\n`)
     if (result.exitCode !== 0) {
       process.exitCode = result.exitCode
-    } else if (mode === 'direct') {
-      const bytes = requireGzipBudget(output, DIRECT_GZIP_BUDGET_BYTES)
-      process.stdout.write(
-        `Direct Worker gzip budget: ${bytes}/${DIRECT_GZIP_BUDGET_BYTES} bytes.\n`,
-      )
+    } else {
+      if (mode === 'direct') {
+        const bytes = requireGzipBudget(output, DIRECT_GZIP_BUDGET_BYTES)
+        process.stdout.write(
+          `Direct Worker gzip budget: ${bytes}/${DIRECT_GZIP_BUDGET_BYTES} bytes.\n`,
+        )
+      }
+      await publishArtifact(mode, join(outputDirectory, 'index.js'))
     }
   } catch (error) {
     process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`)
@@ -51,3 +60,27 @@ if (mode !== 'direct' && mode !== 'isolated') {
     await rm(directory, { recursive: true, force: true })
   }
 }
+
+async function publishArtifact(runtimeMode, source) {
+  const destination = workerArtifactPath(runtimeMode)
+  const destinationDirectory = fileURLToPath(new URL(`../worker/${runtimeMode}`, import.meta.url))
+  await removeGeneratedDirectory(destinationDirectory)
+  await mkdir(destinationDirectory, { recursive: true, mode: 0o755 })
+  const bundle = (await readFile(source, 'utf8'))
+    .replace(/\n\/\/# sourceMappingURL=index\.js\.map\s*$/u, '\n')
+  await writeFile(destination, bundle, { encoding: 'utf8', mode: 0o644, flag: 'wx' })
+  process.stdout.write(`Wrote ${runtimeMode} Worker artifact to ${destination}.\n`)
+}
+
+async function removeGeneratedDirectory(directory) {
+  try {
+    const entry = await lstat(directory)
+    if (!entry.isDirectory() || entry.isSymbolicLink()) {
+      throw new Error(`Refusing to replace non-directory Worker artifact path: ${directory}`)
+    }
+  } catch (error) {
+    if (error?.code === 'ENOENT') return
+    throw error
+  }
+  await rm(directory, { recursive: true })
+}

package/scripts/cli.d.mts

@@ -35,5 +35,6 @@ export function runInstaller(options?: {
   }
   stderr?: import('node:stream').Writable
   stdout?: import('node:stream').Writable
+  verbose?: boolean
   wranglerRunner?: typeof import('./install.mjs').executeWrangler
 }): Promise<unknown>

package/scripts/cli.mjs

@@ -28,10 +28,14 @@ export class InstallInterruptedError extends InstallCancelledError {
 }
 
 export function parseCommand(args) {
-  if (args.length === 1 && (args[0] === 'install' || args[0] === 'upgrade')) return args[0]
+  if (args.filter(arg => arg === '--verbose').length > 1) throw usageError()
+  const operation = args.filter(arg => arg !== '--verbose')
+  if (operation.length === 1 && (operation[0] === 'install' || operation[0] === 'upgrade')) {
+    return operation[0]
+  }
   if (args.length === 0 || (args.length === 1 && ['--help', '-h'].includes(args[0]))) return 'help'
   if (args.length === 1 && ['--version', '-v'].includes(args[0])) return 'version'
-  throw new Error('Usage: dsh-edge <install|upgrade>')
+  throw usageError()
 }
 
 export function createInstallerUi(
@@ -49,6 +53,7 @@ export function createInstallerUi(
   const note = (message, title) => output === undefined
     ? clack.note(message, title)
     : clack.note(message, title, { output })
+  let deploymentSpinner
   return {
     intro: message => log(clack.intro, message),
     step: message => log(clack.log.step, message),
@@ -149,6 +154,25 @@ export function createInstallerUi(
         signal,
       })))
     },
+    deploymentStart(message) {
+      deploymentSpinner = clack.spinner(withOutput({ indicator: 'timer', signal }))
+      deploymentSpinner.start(message)
+    },
+    deploymentFinish(succeeded) {
+      if (deploymentSpinner === undefined) return
+      if (succeeded) deploymentSpinner.stop('Cloudflare accepted the Worker upload.')
+      else deploymentSpinner.error('Cloudflare did not accept the Worker upload.')
+      deploymentSpinner = undefined
+    },
+    failedDeployment(result) {
+      note([
+        `Worker: ${result.workerName}`,
+        'Status: the Worker was not installed.',
+        `Temporary account claim URL: ${result.claimUrl}`,
+        '',
+        'You may claim the temporary account within 60 minutes, then retry the installation.',
+      ].join('\n'), 'Installation did not complete')
+    },
     cleanupFailure(message) {
       log(clack.log.warn, message)
     },
@@ -189,7 +213,7 @@ export function createInstallerUi(
           '2. Enter the owner access key when prompted.',
         )
       }
-      note(lines.join('\n'), command === 'upgrade' ? 'Worker upgraded' : 'Worker uploaded')
+      note(lines.join('\n'), command === 'upgrade' ? 'dsh-edge upgraded' : 'dsh-edge installed')
       log(clack.outro, command === 'upgrade' ? 'Upgrade handoff complete.' : 'Installation handoff complete.')
     },
   }
@@ -224,6 +248,7 @@ function requireAnswer(value) {
 
 export async function runInstaller({
   command = 'install',
+  verbose = false,
   install,
   installEdgeImpl = installEdge,
   installerUi,
@@ -271,6 +296,7 @@ export async function runInstaller({
     ...options,
     runWrangler: (args, runOptions) => wranglerRunner(args, {
       ...runOptions,
+      forwardOutput: verbose || (runOptions?.forwardOutput ?? runOptions?.interactive ?? false),
       stderrDestination: stderrBoundary.output,
       stdoutDestination: stdoutBoundary.output,
     }),
@@ -457,16 +483,21 @@ function createInstallerOutput(destination, onFailure) {
 }
 
 async function main() {
-  const command = parseCommand(process.argv.slice(2))
+  const args = process.argv.slice(2)
+  const command = parseCommand(args)
   if (command === 'help') {
-    process.stdout.write('Usage: dsh-edge <install|upgrade>\n\nCommands:\n  install   Create or update an instance\n  upgrade   Upgrade an existing instance without deleting its data\n')
+    process.stdout.write('Usage: dsh-edge <install|upgrade> [--verbose]\n\nCommands:\n  install   Create or update an instance\n  upgrade   Upgrade an existing instance without deleting its data\n\nOptions:\n  --verbose  Show Wrangler deployment output\n')
     return
   }
   if (command === 'version') {
     process.stdout.write(`${edgePackage.version}\n`)
     return
   }
-  await runInstaller({ command })
+  await runInstaller({ command, verbose: args.includes('--verbose') })
+}
+
+function usageError() {
+  return new Error('Usage: dsh-edge <install|upgrade> [--verbose]')
 }
 
 if (process.argv[1] !== undefined

package/scripts/install.d.mts

@@ -32,6 +32,9 @@ export interface InstallerUi {
     paid: boolean
   }): Promise<boolean>
   acceptTemporaryTerms(): Promise<boolean>
+  deploymentStart?(message: string): void
+  deploymentFinish?(succeeded: boolean): void
+  failedDeployment?(result: { claimUrl: string; workerName: string }): void
   cleanupFailure(message: string): void
   recovery(result: InstallRecovery): void
   outputFailureRecovery(
@@ -53,14 +56,12 @@ export interface InstallResult {
   versionId?: string
   account?: CloudflareAccount
   claimUrl?: string
-  deploymentId: string
   mode: RuntimeMode
   ownerSecret: string
   temporary: boolean
   workerName: string
 }
 
-export const DEPLOYMENT_ID_DEFINE: string
 export const DEFAULT_WORKER_NAME: string
 export const LOGIN_PROFILE: string
 export const RUNTIME_MODES: Readonly<Record<RuntimeMode, Readonly<{
@@ -85,7 +86,6 @@ export function generateOwnerSecret(): string
 export function wranglerEnvironment(environment?: NodeJS.ProcessEnv): NodeJS.ProcessEnv
 export function unauthenticatedEnvironment(environment?: NodeJS.ProcessEnv): NodeJS.ProcessEnv
 export function wranglerDeployArgs(options: {
-  deploymentId: string
   mode: RuntimeMode
   workerName: string
   secretsFile: string
@@ -127,7 +127,6 @@ export function installEdge(options: {
     capture?: boolean
     signal?: AbortSignal
   }) => Promise<CommandResult>
-  deploymentId?: string
   environment?: NodeJS.ProcessEnv
   createTemporaryDirectory?: () => Promise<string>
   removePath?: typeof import('node:fs/promises').rm
@@ -138,8 +137,9 @@ export function wranglerProcessInvocation(args: string[], options?: {
   wranglerCli?: string
 }): { command: string; args: string[] }
 export function executeWrangler(args: string[], options?: {
-  environment?: NodeJS.ProcessEnv
-  interactive?: boolean
+    environment?: NodeJS.ProcessEnv
+    interactive?: boolean
+    forwardOutput?: boolean
   capture?: boolean
   forceKillAfterDelay?: number
   invocation?: { command: string; args: string[] }

package/scripts/install.mjs

@@ -1,4 +1,4 @@
-import { randomBytes, randomUUID } from 'node:crypto'
+import { randomBytes } from 'node:crypto'
 import { execFile } from 'node:child_process'
 import { chmod, mkdtemp, open, readFile, rm, writeFile } from 'node:fs/promises'
 import { createRequire } from 'node:module'
@@ -7,9 +7,8 @@ import { join } from 'node:path'
 import { setTimeout as sleep } from 'node:timers/promises'
 import { fileURLToPath } from 'node:url'
 import { execa } from 'execa'
-import { writeModeWranglerConfig } from './wrangler-config.mjs'
+import { writePrebuiltModeWranglerConfig } from './wrangler-config.mjs'
 
-export const DEPLOYMENT_ID_DEFINE = '__DSH_EDGE_DEPLOYMENT_ID__'
 export const DEFAULT_WORKER_NAME = 'dsh-edge'
 export const LOGIN_PROFILE = 'dsh-edge-install'
 export const RUNTIME_MODES = Object.freeze({
@@ -207,7 +206,6 @@ export function unauthenticatedEnvironment(environment = process.env) {
 
 /** Build an exact, secret-free Wrangler deployment command. */
 export function wranglerDeployArgs({
-  deploymentId,
   mode,
   workerName,
   secretsFile,
@@ -227,8 +225,6 @@ export function wranglerDeployArgs({
     workerName,
     '--config',
     configFile,
-    '--define',
-    `${DEPLOYMENT_ID_DEFINE}:${JSON.stringify(deploymentId)}`,
     '--secrets-file',
     secretsFile,
   ]
@@ -286,7 +282,6 @@ export async function installEdge({
   command = 'install',
   ui,
   runWrangler = executeWrangler,
-  deploymentId = randomUUID(),
   environment = process.env,
   createTemporaryDirectory = createPrivateTemporaryDirectory,
   removePath = rm,
@@ -391,13 +386,16 @@ export async function installEdge({
     const secretsFile = join(temporaryDirectory, 'secrets.json')
     const configFile = join(temporaryDirectory, 'wrangler.json')
     const outputFile = join(temporaryDirectory, 'wrangler-output.ndjson')
-    await writeModeWranglerConfig(mode, configFile)
+    await writePrebuiltModeWranglerConfig(mode, configFile)
     await writeFile(secretsFile, JSON.stringify({
       DEEPSEEK_API_KEY: deepSeekKey,
       DSH_EDGE_ACCESS_KEY: ownerSecret,
     }), { encoding: 'utf8', mode: 0o600, flag: 'wx' })
 
-    ui.step(command === 'upgrade' ? 'Upgrading the Worker…' : 'Installing the Worker…')
+    const deploymentMessage = command === 'upgrade'
+      ? 'Uploading the tested Worker release…'
+      : 'Installing the tested Worker release…'
+    ui.deploymentStart?.(deploymentMessage)
     const commandEnvironment = temporary
       ? unauthenticatedEnvironment(environment)
       : accountEnvironment(profileEnvironment ?? environment, account.id)
@@ -406,10 +404,10 @@ export async function installEdge({
     commandEnvironment.WRANGLER_OUTPUT_FILE_PATH = outputFile
     commandEnvironment.FORCE_COLOR = '0'
     let deployResult
+    let deploySucceeded = false
     let credentialCleanupError
     try {
       deployResult = await runWrangler(wranglerDeployArgs({
-        deploymentId,
         mode,
         workerName,
         secretsFile,
@@ -419,26 +417,30 @@ export async function installEdge({
       }), {
         environment: commandEnvironment,
         interactive: true,
+        forwardOutput: false,
         capture: true,
         signal,
       })
+      deploySucceeded = deployResult.status === 0
     } finally {
+      ui.deploymentFinish?.(deploySucceeded)
       try {
         await removePath(secretsFile, { force: true })
       } catch (error) {
         credentialCleanupError = error
       }
     }
+    const claimUrl = temporary
+      ? parseClaimUrl(`${deployResult.stdout}\n${deployResult.stderr}`)
+      : undefined
     if (deployResult.status !== 0) {
+      if (claimUrl !== undefined) ui.failedDeployment?.({ claimUrl, workerName })
       const cleanupDetail = credentialCleanupError === undefined
         ? ''
         : `\nTemporary credential cleanup also failed: ${describeError(credentialCleanupError)}`
       throw new Error(`${formatDeployFailure(mode, deployResult)}${cleanupDetail}`)
     }
 
-    const claimUrl = temporary
-      ? parseClaimUrl(`${deployResult.stdout}\n${deployResult.stderr}`)
-      : undefined
     const recoverUploadedWorker = () => {
       const recovery = { claimUrl, ownerSecret, workerName }
       if (deployResult.outputFailure !== undefined) {
@@ -483,7 +485,6 @@ export async function installEdge({
       ...deployment,
       account,
       claimUrl,
-      deploymentId,
       mode,
       ownerSecret,
       temporary,
@@ -535,6 +536,7 @@ export function wranglerProcessInvocation(args, {
 export async function executeWrangler(args, {
   environment = wranglerEnvironment(),
   interactive = false,
+  forwardOutput = interactive,
   capture = true,
   forceKillAfterDelay = 2_000,
   invocation = wranglerProcessInvocation(args),
@@ -576,21 +578,21 @@ export async function executeWrangler(args, {
   }
   const stdoutTerminal = createTerminalSanitizer()
   const stderrTerminal = createTerminalSanitizer()
-  stdoutForwarder = interactive && child.stdout
+  stdoutForwarder = forwardOutput && child.stdout
     ? createOutputForwarder(child.stdout, stdoutDestination, error => failOutput('stdout', error))
     : undefined
-  stderrForwarder = interactive && child.stderr
+  stderrForwarder = forwardOutput && child.stderr
     ? createOutputForwarder(child.stderr, stderrDestination, error => failOutput('stderr', error))
     : undefined
   child.stdout?.setEncoding('utf8')
   child.stderr?.setEncoding('utf8')
   child.stdout?.on('data', (chunk) => {
-    const terminalChunk = interactive ? stdoutTerminal.push(chunk) : ''
+    const terminalChunk = forwardOutput ? stdoutTerminal.push(chunk) : ''
     if (terminalChunk !== '') stdoutForwarder?.write(terminalChunk)
     if (capture) stdout = appendBounded(stdout, chunk)
   })
   child.stderr?.on('data', (chunk) => {
-    const terminalChunk = interactive ? stderrTerminal.push(chunk) : ''
+    const terminalChunk = forwardOutput ? stderrTerminal.push(chunk) : ''
     if (terminalChunk !== '') stderrForwarder?.write(terminalChunk)
     if (capture) stderr = appendBounded(stderr, chunk)
   })
@@ -937,7 +939,22 @@ function describeError(error) {
 }
 
 function formatDeployFailure(mode, result) {
-  const failure = commandFailure('Cloudflare installation failed', result)
+  const diagnostic = stripAnsi(result.stderr || result.stdout).trim()
+  const code = /\[code:\s*(\d+)\]/u.exec(diagnostic)?.[1]
+  let detail
+  if (code === '10021') {
+    detail = 'Cloudflare rejected the Worker module during validation (code 10021).'
+  } else if (code === '10027') {
+    detail = 'Cloudflare rejected the Worker because it exceeds the account size limit (code 10027).'
+  } else {
+    const firstError = diagnostic.split(/\r?\n/u)
+      .map(line => line.trim())
+      .find(line => line !== '' && !line.startsWith('(node:'))
+    detail = firstError === undefined
+      ? 'Cloudflare did not accept the Worker upload.'
+      : `Cloudflare did not accept the Worker upload${code === undefined ? '' : ` (code ${code})`}: ${firstError}`
+  }
+  const failure = `${detail} Run the command again with --verbose to inspect Wrangler output.`
   if (mode !== 'isolated') return failure
   return `${failure}\nThe isolated runtime requires the Workers Paid plan (starting at $5/month). `
     + 'Enable Workers Paid for this account or install the Free direct runtime.'

package/scripts/legal-files.mjs

@@ -1,7 +1,8 @@
-import { readFileSync } from 'node:fs'
+import { readFileSync, writeFileSync } from 'node:fs'
 import { fileURLToPath } from 'node:url'
 
-const legalFiles = ['LICENSE', 'THIRD_PARTY_NOTICES.md']
+const upstreamCopyright = 'Copyright (c) 2026 DeepSeek'
+const edgeCopyright = 'Copyright (c) 2026 pawaca'
 
 function paths(name) {
   return {
@@ -10,15 +11,72 @@ function paths(name) {
   }
 }
 
+function renderLicense() {
+  const upstream = readFileSync(paths('LICENSE').source, 'utf8')
+  if (!upstream.includes(upstreamCopyright)) {
+    throw new Error('repository-root LICENSE no longer contains the expected DeepSeek copyright')
+  }
+  return upstream.replace(upstreamCopyright, edgeCopyright)
+}
+
+function renderNotices() {
+  const upstreamLicense = readFileSync(paths('LICENSE').source, 'utf8').trim()
+  const repositoryNotices = readFileSync(paths('THIRD_PARTY_NOTICES.md').source, 'utf8')
+  const inventoryStart = repositoryNotices.indexOf('## Vendored source')
+  if (inventoryStart < 0) {
+    throw new Error('repository-root THIRD_PARTY_NOTICES.md has no dependency inventory')
+  }
+  const upstreamInventory = repositoryNotices
+    .slice(inventoryStart)
+    .replace(/^## /gmu, '### ')
+    .trim()
+
+  return `<!-- Generated by apps/dsh-edge/scripts/legal-files.mjs — do not edit by hand.
+     Run \`pnpm --filter dsh-edge run legal:write\` to regenerate. -->
+
+# Third-Party Notices
+
+\`dsh-edge\` is an independent community project and is not affiliated with or endorsed by DeepSeek.
+
+## DeepSeek Harness
+
+\`dsh-edge\` includes and adapts DeepSeek Harness. DeepSeek Harness retains its upstream copyright and MIT license:
+
+\`\`\`text
+${upstreamLicense}
+\`\`\`
+
+## DeepSeek Harness dependency notices
+
+The following inventory is reproduced from the DeepSeek Harness source distribution. Each project remains under its own license; nothing in this file changes those terms.
+
+${upstreamInventory}
+`
+}
+
+function expectedFiles() {
+  return new Map([
+    ['LICENSE', renderLicense()],
+    ['THIRD_PARTY_NOTICES.md', renderNotices()],
+  ])
+}
+
 function verify() {
-  for (const name of legalFiles) {
-    const { source, target } = paths(name)
-    if (!readFileSync(target).equals(readFileSync(source))) {
-      throw new Error(`${name} differs from the repository-root authority`)
+  for (const [name, expected] of expectedFiles()) {
+    const { target } = paths(name)
+    if (readFileSync(target, 'utf8') !== expected) {
+      throw new Error(`${name} is stale; run \`pnpm --filter dsh-edge run legal:write\``)
     }
   }
 }
 
+function write() {
+  for (const [name, content] of expectedFiles()) {
+    writeFileSync(paths(name).target, content)
+  }
+}
+
 const action = process.argv[2]
 if (action === 'verify') verify()
-else throw new Error('Usage: node scripts/legal-files.mjs verify')
+else if (action === 'write') write()
+else throw new Error('Usage: node scripts/legal-files.mjs <verify|write>')

package/scripts/smoke-installed.mjs

@@ -0,0 +1,47 @@
+import assert from 'node:assert/strict'
+import { mkdtemp, rm, stat } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { unstable_dev } from 'wrangler'
+import edgePackage from '../package.json' with { type: 'json' }
+import {
+  workerArtifactPath,
+  writePrebuiltModeWranglerConfig,
+} from './wrangler-config.mjs'
+
+const ACCESS_KEY = 'packed-installer-owner-key-32-bytes'
+const directory = await mkdtemp(join(tmpdir(), 'dsh-edge-installed-smoke-'))
+let worker
+
+try {
+  for (const mode of ['direct', 'isolated']) {
+    const artifact = workerArtifactPath(mode)
+    assert.equal((await stat(artifact)).isFile(), true, `missing ${mode} Worker artifact`)
+  }
+
+  const configFile = join(directory, 'wrangler.json')
+  await writePrebuiltModeWranglerConfig('direct', configFile)
+  worker = await unstable_dev(workerArtifactPath('direct'), {
+    config: configFile,
+    vars: {
+      DEEPSEEK_API_KEY: 'packed-installer-test-key',
+      DSH_EDGE_ACCESS_KEY: ACCESS_KEY,
+    },
+    logLevel: 'error',
+    experimental: {
+      disableExperimentalWarning: true,
+      showInteractiveDevSession: false,
+      watch: false,
+    },
+  })
+  const response = await worker.fetch('http://dsh-edge.test/api/health')
+  assert.equal(response.status, 200)
+  const health = await response.json()
+  assert.equal(health.service, 'dsh-edge')
+  assert.equal(health.shell, 'just-bash-direct')
+  assert.equal(health.deploymentId, `dsh-edge@${edgePackage.version}/direct`)
+  process.stdout.write('Installed direct Worker artifact started successfully.\n')
+} finally {
+  await worker?.stop()
+  await rm(directory, { recursive: true, force: true })
+}