dsh-edge 0.24.0 → 0.26.0-alpha.2

package/README.i18n.yaml

@@ -2,5 +2,5 @@
 # last confirmed-consistent state. Both languages carry equal authority.
 # After editing either side, update both and re-record every pair with:
 #   pnpm run doc-pairs -- --write
-README.md: efb4b53db167097078b8f4877d69025cc3b90bcf
-README.zh.md: a16df51c6e92cf0f2a7de50aa98099d98084be00
+README.md: 042c276a82bd851de5e1c901afffb90fa29c19e1
+README.zh.md: 81cbb1e4b5064432c299d92316fece9000d6981e

package/README.md

@@ -140,7 +140,7 @@ This reference separates code that runs natively in Workers, code adapted at an
 | --- | --- | --- | --- |
 | DeepSeek transport | Fetch, SSE parsing, wire translation, retry metadata | Reused | Construct the upstream `DeepSeekAdapter` per request. `nodejs_compat` supplies its compatible Node APIs. |
 | Provider attribution | Package version loaded with Node `createRequire` | Reused after portability fix | Import package metadata statically so bundlers preserve the same version source without requiring `import.meta.url` at runtime. |
-| LLM protocol | DSH messages, content blocks, stream chunks, tool calls, usage, and finish reasons | Reused | Let upstream `LlmRuntime` and `ReactLoopAgent` assemble, stream, and log the model exchange. |
+| LLM protocol | DSH messages, content blocks, stream chunks, tool calls, usage, and finish reasons | Reused | Let upstream `LlmRuntime` and `ReactLoopAgent` assemble, stream, and log the model exchange. DeepSeek is served by `dsh-llm-deepseek-api-key` (`llm-deepseek`). Other providers are added on the Settings → Models page as upstream does it, through `dsh-llm-pi-ai` (`llm-pi-ai`): OpenAI chat completions, OpenAI responses, or Anthropic messages, any HTTP(S) Base URL without credentials, a query, or a fragment (OpenRouter, Cloudflare Workers AI or AI Gateway, a self-hosted gateway), and model discovery from the endpoint. A saved route serves turns without a restart and can be picked in the model menu, as a new-session default, and for subagents. Providers that sign in through a local login or read local credential files (GitHub Copilot, OpenAI Codex, and Amazon Bedrock or Google Vertex through local credentials) are not offered. |
 | Agent loop | Cordis-composed `ReactLoopAgent` with hooks, guards, sessions, and tools | Reused | Create and cold-resume agents through `AgentRegistry`. Context compaction, token metering, tool-result pruning, automatic session title generation, the repeated-tool-call reminder (after 3, 5, and 8 identical consecutive calls), model-request retry (a rate limit, server error, timeout, transport error, or empty response is retried up to five times within the turn, with 0.5–10 s backoff or the provider's `Retry-After`), and durability checkpoints (the session log is stored before each model request, each top-level tool call, and each step) run as upstream cordis plugins. The upstream `/compact` command (`dsh-command-compact`) compacts the session's history on request. |
 | Bash tool | Node subprocess, sandbox, terminal, and job services | Adapted at the native tool seam | Register an upstream `ToolDefinition`, but execute its body through the configured Computer workspace backend and just-bash. The default direct backend runs inside the owner Durable Object with hardened interpreter limits and no network command; adding a `LOADER` binding selects Computer's isolated Worker Shell backend. Native tool cancellation sends `SIGINT` through the Computer execution handle. Deployment configuration supplies an explicit default timeout and caller-selectable ceiling, while `timedOut` reports the deadline independently from exit and cancellation status. Native binaries, background processes, PTYs, and arbitrary Linux behavior are unavailable. |
 | Workspace filesystem | Local filesystem services and host paths | Adapted | Store `/workspace` in the owner's SQLite-backed Durable Object VFS. |
@@ -152,7 +152,7 @@ This reference separates code that runs natively in Workers, code adapted at an
 | Directory picker | `ctx.directoryPicker` seam with the `-native` OS chooser or the `-browse` filesystem backend, chosen at boot by `dsh-host-directory-picker-auto`, plus the Web browse dialog | Reused with an Edge browse backend | Install the upstream seam and pin the upstream `dsh-client-ui-directory-picker-browse` dialog in the Web roster; Edge answers the `browse` capability from the `/workspace` Computer VFS one level per call, rooted at `/workspace` with the upstream hidden, bound, and failure vocabulary, so the upstream `DirectoryPickerController` serves `directoryPicker/list` and `createDirectory` and refuses the native `pick`. |
 | Conversation file links | `session/openWorkspacePath` hands a clicked path to the Host desktop opener through `dsh-native-command`; `session/canOpenWorkspacePath` gates the affordance | Adapted at the upstream `SessionControllerInternals` seam plus a Web download fallback | Compose `SessionController` with Edge internals so the native probe answers false and an open attempt fails with a readable reason instead of a `child_process` error. The V3 Web client opens file links in its right-sidebar preview. Edge composes the upstream `workspaceFiles` controller over request-scoped VFS reads, including bounded text/byte windows and metadata subscriptions. The legacy `ctx.remote.session.openWorkspacePath` fallback and owner-authenticated `GET /api/workspace/file` download remain available. |
 | Existing Web UI | Runtime-loaded shell and `dsh.client` plugin graph | Reused with generic composition fallbacks | Assemble the upstream shell and supported upstream client bundles as Worker assets. Shared slot-occupancy rules hide actions whose provider is absent; Cloudflare serves ordinary assets directly, while `/`, `/login`, and `/api/*` enter the Worker for owner access control. The assembled asset policy prevents every direct or SPA-fallback shell alias from being framed. |
-| Other tools | Web Search, filesystem editor tools, MCP, skills, workflows, jobs, and subagents | Search, file, glob/grep, goal, todo, skill, subagent, and MCP tools ported; workflow and run_code ported for the isolated build | Reuse upstream DeepSeek Web Search with its 30-second tool-call timeout. The upstream `workflow` tool is offered only by the Dynamic Worker runtime (the isolated, Paid-plan build); the Direct build does not register it. Each run loads its script into its own Dynamic Worker with no outbound network and a 30-second Worker Loader `cpuMs` limit (enforced by the Cloudflare runtime, not by local development), because workerd forbids in-process `eval`/`new Function`/`node:vm`; `agent()`, `phase()`, and `log()` cross an RPC bridge to the Durable Object, which enforces the caps: at most 4 children run at once (below the Workers six-connection limit) and one run starts at most 100 children to bound child-session row writes. The upstream `run_code` tool (`dsh-tools` PTC mode) is offered by the same runtime, but only to sessions started in the upstream `ptc` agent preset (PTC mode), which isolated deployments offer under its upstream id so the Web client shows its built-in bilingual name. That preset presents every tool through the generated SDK and, as upstream does, does not offer `workflow`, because `run_code` is its only orchestration surface. The default upstream `standard` preset (Standard mode; sessions recorded under the earlier `dsh-edge` id read as `standard`) presents tools natively and keeps `workflow`. As upstream, Settings → Agent presets writes the `agent-presets` settings namespace to choose which offered preset new sessions start on. In PTC mode, each program is type-stripped with sucrase and runs in its own Dynamic Worker with a 30-second `cpuMs` limit and no outbound network; its `tools.*` calls cross an RPC bridge where the Durable Object caps them at 200 per run (each is a nested tool dispatch with its own session events), 256 KiB of arguments, and 2 MiB per result, and nested calls stay approval-gated. File tools (read/write/edit/read_image) adapted via `EdgeFileSystem` backed by Computer VFS. `glob` and `grep` keep upstream `dsh-tool-fs-search`'s names, schemas, result text, search cards, and spill of results over 100 paths or 250 matches, but Workers cannot spawn its ripgrep binary, so Edge runs them over the VFS: both skip VCS metadata, `grep` also skips hidden files, binary files, and files over 4 MiB, and neither applies `.gitignore`. `grep` patterns use RE2 syntax (no lookaround or backreferences) through re2js, which matches in linear time, so a pathological pattern cannot stall the Durable Object. A search walks at most 20,000 entries, and `grep` collects at most 20,000 matching lines or 20 MB of their text; past a cap it fails and asks for a narrower path or pattern. Glob syntax that ripgrep 15 rejects (an unclosed `[` or `{`, a reversed range such as `[z-a]`, a dangling `\`) fails as an invalid pattern; nested alternates such as `a{b,{c,d}}` work. A search checks for cancellation before and after each directory listing, so the 30-second tool timeout stops a long walk. As upstream, the file observation policy (`dsh-fs-observation-policy`) guards them: `write` may not overwrite a file the session has not read, `edit` requires a prior read, and a file changed since it was read (by `bash` or the Linux container, for example) fails as stale until it is read again; a restarted session starts with no reads recorded. Goal tools (`ToolGoal`) composed directly with `GoalService` as upstream cordis plugins. Subagents follow upstream's standard composition: `subagent` starts a fresh child and `subagent_fork` one that starts from the parent's completed turns (`dsh-subagent-spawn-in-process`, `dsh-subagent-fork-in-process`). Both run the child in the background by default as a continuable subagent, and the parent continues it with `send_message`, stops its current turn with `interrupt_agent`, and finds it with `list_agents` (`dsh-tool-subagent-control`). A child keeps working after the parent's turn ends, and its closing message wakes the parent for another turn; as upstream, Stop on the parent does not stop running children. A child that is not running resumes from storage when messaged, also after a restart. The upstream `todo_write` tool (`dsh-tool-todo`) keeps the session's task list, with several tasks allowed in progress as in upstream's composition; its `todos` projection drives the Web client's todo dock. The upstream `present` tool (`dsh-tool-present`) declares workspace files as a turn's deliverables, which the Web client shows as file cards with a sidebar preview; the Edge has no desktop, so it answers the cards' Host check (`/api/present.host`) as unavailable and they offer no native opening. As upstream, `dsh-agent-instructions` loads `AGENTS.md` and `CLAUDE.md` (and their `.local.md` overlays) from the project root (the nearest ancestor directory containing `.git`, or else the session's working directory) down to the working directory, through the workspace VFS, into a 64 KiB baseline message before the first request; a `read`, `write`, or `edit` that reaches a deeper directory adds its instructions to the next request. Workers have no home directory, so the user-global file is `/.dsh/AGENTS.md`. Skill tool via `SkillRegistry`. As upstream `dsh-skill-filesystem`, skills are `<name>/SKILL.md` or `<name>.md` files with `name` and `description` frontmatter under the project's `.dsh/skills` and `.agents/skills` and the user roots `/.dsh/skills` and `/.agents/skills` (Workers have no home directory), read through the workspace VFS, up to 100 entries per root and 64 KiB per skill file; an added or edited skill applies from the next turn, and the `/` menu of a session opened after the change lists it; as upstream, the Web client keeps an open session's `/` list until the page reloads. Skills stored through the owner API `GET/PUT/DELETE /api/skills` (`EdgeSkillProvider`, DO KV) rank below them. MCP client (`dsh-mcp-client`) installed; Streamable HTTP transport only (stdio unavailable on Workers). Configure servers in Settings → DSH Edge → MCP Servers; tools appear as `mcp__<serverName>__<tool>`. Add the remaining tools individually against Worker-compatible capabilities; do not advertise unavailable host behavior. |
+| Other tools | Web Search, filesystem editor tools, MCP, skills, workflows, jobs, and subagents | Search, file, glob/grep, goal, todo, skill, subagent, and MCP tools ported; workflow and run_code ported for the isolated build | Reuse upstream DeepSeek Web Search with its 30-second tool-call timeout. The upstream `workflow` tool is offered only by the Dynamic Worker runtime (the isolated, Paid-plan build); the Direct build does not register it. Each run loads its script into its own Dynamic Worker with no outbound network and a 30-second Worker Loader `cpuMs` limit (enforced by the Cloudflare runtime, not by local development), because workerd forbids in-process `eval`/`new Function`/`node:vm`; `agent()`, `phase()`, and `log()` cross an RPC bridge to the Durable Object, which enforces the caps: at most 4 children run at once (below the Workers six-connection limit) and one run starts at most 100 children to bound child-session row writes. The upstream `run_code` tool (`dsh-tools` PTC mode) is offered by the same runtime, but only to sessions started in the upstream `ptc` agent preset (PTC mode), which isolated deployments offer under its upstream id so the Web client shows its built-in bilingual name. That preset presents every tool through the generated SDK and, as upstream does, does not offer `workflow`, because `run_code` is its only orchestration surface. The default upstream `standard` preset (Standard mode; sessions recorded under the earlier `dsh-edge` id read as `standard`) presents tools natively and keeps `workflow`. As upstream, Settings → Agent presets writes `selectedDefault` in the `agent-preset-registry` settings namespace to choose which offered preset new sessions start on; a default saved by an earlier release under `agent-presets` moves there on start. In PTC mode, each program is type-stripped with sucrase and runs in its own Dynamic Worker with a 30-second `cpuMs` limit and no outbound network; its `tools.*` calls cross an RPC bridge where the Durable Object caps them at 200 per run (each is a nested tool dispatch with its own session events), 256 KiB of arguments, and 2 MiB per result, and nested calls stay approval-gated. File tools (read/write/edit/read_image) adapted via `EdgeFileSystem` backed by Computer VFS. `glob` and `grep` keep upstream `dsh-tool-fs-search`'s names, schemas, result text, search cards, and spill of results over 100 paths or 250 matches, but Workers cannot spawn its ripgrep binary, so Edge runs them over the VFS: both skip VCS metadata, `grep` also skips hidden files, binary files, and files over 4 MiB, and neither applies `.gitignore`. `grep` patterns use RE2 syntax (no lookaround or backreferences) through re2js, which matches in linear time, so a pathological pattern cannot stall the Durable Object. A search walks at most 20,000 entries, and `grep` collects at most 20,000 matching lines or 20 MB of their text; past a cap it fails and asks for a narrower path or pattern. Glob syntax that ripgrep 15 rejects (an unclosed `[` or `{`, a reversed range such as `[z-a]`, a dangling `\`) fails as an invalid pattern; nested alternates such as `a{b,{c,d}}` work. A search checks for cancellation before and after each directory listing, so the 30-second tool timeout stops a long walk. As upstream, the file observation policy (`dsh-fs-observation-policy`) guards them: `write` may not overwrite a file the session has not read, `edit` requires a prior read, and a file changed since it was read (by `bash` or the Linux container, for example) fails as stale until it is read again; a restarted session starts with no reads recorded. Goal tools (`ToolGoal`) composed directly with `GoalService` as upstream cordis plugins. Subagents follow upstream's standard composition: `subagent` starts a fresh child and `subagent_fork` one that starts from the parent's completed turns (`dsh-subagent-spawn-in-process`, `dsh-subagent-fork-in-process`). Both run the child in the background by default as a continuable subagent, and the parent continues it with `send_message`, stops its current turn with `interrupt_agent`, and finds it with `list_agents` (`dsh-tool-subagent-control`). A child keeps working after the parent's turn ends, and its closing message wakes the parent for another turn; as upstream, Stop on the parent does not stop running children. A child that is not running resumes from storage when messaged, also after a restart. The upstream `todo_write` tool (`dsh-tool-todo`) keeps the session's task list, with several tasks allowed in progress as in upstream's composition; its `todos` projection drives the Web client's todo dock. The upstream `present` tool (`dsh-tool-present`) declares workspace files as a turn's deliverables, which the Web client shows as file cards with a sidebar preview; the Edge has no desktop, so it answers the cards' Host check (`/api/present.host`) as unavailable and they offer no native opening. As upstream, `dsh-agent-instructions` loads `AGENTS.md` and `CLAUDE.md` (and their `.local.md` overlays) from the project root (the nearest ancestor directory containing `.git`, or else the session's working directory) down to the working directory, through the workspace VFS, into a 64 KiB baseline message before the first request; a `read`, `write`, or `edit` that reaches a deeper directory adds its instructions to the next request. Workers have no home directory, so the user-global file is `/.dsh/AGENTS.md`. Skill tool via `SkillRegistry`. As upstream `dsh-skill-filesystem`, skills are `<name>/SKILL.md` or `<name>.md` files with `name` and `description` frontmatter under the project's `.dsh/skills` and `.agents/skills` and the user roots `/.dsh/skills` and `/.agents/skills` (Workers have no home directory), read through the workspace VFS, up to 100 entries per root and 64 KiB per skill file; an added or edited skill applies from the next turn, and the `/` menu of a session opened after the change lists it; as upstream, the Web client keeps an open session's `/` list until the page reloads. Skills stored through the owner API `GET/PUT/DELETE /api/skills` (`EdgeSkillProvider`, DO KV) rank below them. MCP client (`dsh-mcp-client`) installed; Streamable HTTP transport only (stdio unavailable on Workers). Configure servers in Settings → DSH Edge → MCP Servers; tools appear as `mcp__<serverName>__<tool>`. Add the remaining tools individually against Worker-compatible capabilities; do not advertise unavailable host behavior. |
 | Attachments | Local attachment storage, upstream image references, composer, gallery, lightbox, and provider conversion | Adapted at the native storage seam | Reuse upstream `AttachmentStore`, admission, protocol, authorization, UI, and DeepSeek conversion unchanged. Store immutable PNG/JPEG bytes under their SHA-256 identities in a 64 MiB, 512 KiB-chunked DO backend for new and pre-attachment deployments, or in private R2 for deployments already pinned to it; session events retain only upstream refs. The first backend is pinned per owner instance so claiming or upgrading cannot strand existing references. |
 | Goal tracking | `GoalService` with create/edit/pause/resume/complete/clear mutations and GoalBar UI | Reused | Install upstream `GoalService` and `ToolGoal` as cordis plugins (direct composition). Browser GoalBar mutations route through `TypertGatewayService` at `/api/goals/<method>`. `SessionProjectionCache` persists goal state across DO restart. The upstream `/goal` command (`dsh-command-goal`) shows, sets, edits, pauses, resumes, or clears the session's goal. Every goal round runs inside an Edge turn, with its workspace, deadline, and live events: a turn stays open while upstream's round driver queues the next round, and a call that arms a goal outside a turn (`/goal`, GoalBar Resume) runs inside a new one. |
 | Context compaction | Token metering, automatic compaction, and session title generation | Reused | Install upstream cordis plugins directly. Context compaction, token metering, tool-result pruning, and automatic session title generation run unchanged. Upstream image offload (`dsh-compaction-image-offload`) keeps a turn going when its images exceed the route's budget (600 images per request by default): it marks the oldest occurrences offloaded with an `image/offload` session event and the request is retried. |
@@ -210,6 +210,8 @@ A focused failure test proves that post-enqueue durability failure blocks model
 
 `DEEPSEEK_API_KEY` may be set as a Worker secret at deployment or entered later through the Settings → Models page. The Edge credential provider checks Durable Object KV first, then falls back to the Worker environment variable; resolved values remain request-scoped and are never written to session events or responses. Surrounding whitespace is removed; a blank value is unconfigured.
 
+An API key for another provider is entered on the same Models page, which stores it under the credential name the provider's route names (for example `OPENROUTER_API_KEY`) in Durable Object KV. These keys are not read from Worker variables: only `DEEPSEEK_API_KEY` keeps that fallback, for deployments from before the Models page. A route's extra headers are stored in the settings document in plain text, so only headers that never carry a secret are accepted: `HTTP-Referer`, `Referer`, `X-Title`, `OpenAI-Organization`, `OpenAI-Project`, and `anthropic-beta`. A gateway that needs a second credential header, such as an authenticated Cloudflare AI Gateway's `cf-aig-authorization`, cannot be configured yet. A route's key name may not be one that belongs to DeepSeek or another Edge feature (`DEEPSEEK_*`, `MCP_TOKEN_*`, `DSH_EDGE_*`), so the deployment's DeepSeek key is never sent to another endpoint. Every route needs its own key name: without one pi-ai would look for a key in the process environment, where Workers expose the deployment's secrets.
+
 | Variable | Purpose and validation |
 | --- | --- |
 | `DEEPSEEK_BASE_URL` | Anthropic-compatible Messages endpoint. Defaults to `https://api.deepseek.com/anthropic`. DeepSeek's former OpenAI-compatible root (`https://api.deepseek.com`, `/v1`, or `/beta`), here or saved as the Models page Base URL, is moved to that default on start; a 404 from another endpoint keeps its message and adds that the endpoint may not serve the Messages API and where to change it. Must be HTTP(S) without URL userinfo. The browser projection omits query and fragment components that may carry gateway credentials. |
@@ -252,7 +254,7 @@ Direct mode is lighter isolation than a separate Worker; do not expose the singl
 - Isolated preserves that shell core and replaces the unreachable Direct backend with a fail-closed module. Each artifact therefore carries only its selected command runtime.
 - The installer generates a private mode-specific config, points it at the selected artifact, and uploads with `no_bundle`. The user's machine does not rebuild dsh-edge or resolve Harness packages into a new Worker.
 - Container mode deploys the isolated artifact with `docker.io/pawaca/dsh-edge-computer:<version>`, which the release workflow builds from `container/Dockerfile` and pushes once per version before npm publication. Installing it needs no local Docker; `pnpm dev:container` and `pnpm test:container` build the Dockerfile locally and do.
-- CI starts the Direct artifact from an installed tarball and rejects gzip output above 900 KiB, preserving headroom below the 1 MiB anonymous temporary-account limit.
+- CI starts the Direct artifact from an installed tarball. Bundling rejects a Worker above Cloudflare's 64 MiB uncompressed limit (Cloudflare has no compressed-size limit, temporary accounts included), and CI profiles each artifact's startup against Cloudflare's 1 s startup limit.
 
 ### Install and upgrade
 
@@ -304,7 +306,7 @@ The installer asks in this order: account, Worker name, then what to change. Eve
 - If upload succeeds but handoff fails, a recovery card prints the active owner key and all known URLs before the command exits unsuccessfully.
 - Installation uploads directly through Wrangler; it does not create or bind a GitHub repository, Cloudflare Builds project, or source-build pipeline.
 
-Contributors working from a checkout can reproduce the two release artifacts locally with `pnpm --filter dsh-edge bundle:direct` and `pnpm --filter dsh-edge bundle:isolated`. The first command also enforces the compressed-size budget.
+Contributors working from a checkout can reproduce the two release artifacts locally with `pnpm --filter dsh-edge bundle:direct` and `pnpm --filter dsh-edge bundle:isolated`. Both commands enforce Cloudflare's 64 MiB uncompressed Worker size limit (Cloudflare has no compressed-size limit), and `pnpm --filter dsh-edge check:startup` profiles the promoted artifacts' startup against Cloudflare's 1 s startup limit.
 
 Contributors can replay the complete Free temporary-account journey without a key or network call. This example runs the shipped bin, real prompts, Wrangler subprocess, structured deployment-output parsing, public-activation observation, and final handoff while replacing the external Cloudflare boundaries:
 

package/README.zh.md

@@ -140,7 +140,7 @@ curl -b /tmp/dsh-edge-cookie -N -X POST -H 'content-type: application/json' \
 | --- | --- | --- | --- |
 | DeepSeek transport | Fetch、SSE 解析、wire translation 和 retry metadata | 复用 | 每个请求构造一个上游 `DeepSeekAdapter`；其兼容的 Node API 由 `nodejs_compat` 提供。 |
 | Provider attribution | 用 Node `createRequire` 加载 package version | 完成可移植修复后复用 | 静态导入 package metadata，让 bundler 保留同一个版本来源，运行时不再依赖 `import.meta.url`。 |
-| LLM protocol | DSH messages、content blocks、stream chunks、tool calls、usage 和 finish reasons | 复用 | 由上游 `LlmRuntime` 和 `ReactLoopAgent` 组装、流式处理并记录 model exchange。 |
+| LLM protocol | DSH messages、content blocks、stream chunks、tool calls、usage 和 finish reasons | 复用 | 由上游 `LlmRuntime` 和 `ReactLoopAgent` 组装、流式处理并记录 model exchange。 DeepSeek 由 `dsh-llm-deepseek-api-key`（`llm-deepseek`）提供。其他服务商与上游一样在"设置 → Models"页面添加，通过 `dsh-llm-pi-ai`（`llm-pi-ai`）接入：支持 OpenAI chat completions、OpenAI responses 和 Anthropic messages 协议，Base URL 可以是任意不带账号密码、查询参数或片段的 HTTP(S) 地址（OpenRouter、Cloudflare Workers AI 或 AI Gateway、自建网关），并可从端点发现模型。保存的路由无需重启即可用于对话，可以在模型菜单中选择，可以作为新会话的默认模型，也可以给子 agent 使用。依赖本地登录或读取本地凭据文件的服务商（GitHub Copilot、OpenAI Codex，以及通过本地凭据使用的 Amazon Bedrock 或 Google Vertex）不提供。 |
 | Agent loop | 由 Cordis 组合、带 hooks、guards、sessions 和 tools 的 `ReactLoopAgent` | 复用 | 通过 `AgentRegistry` 创建和冷恢复 agent。上下文压缩、token 计量、工具结果修剪、自动 session 标题生成、重复工具调用提醒（连续 3、5、8 次完全相同的调用时提醒）、模型请求重试（遇到限流、服务端错误、超时、网络错误或空响应时，在同一轮内最多重试 5 次，等待 0.5–10 秒，或按服务端的 `Retry-After`），以及持久化检查点（每次模型请求、每次顶层工具调用和每一步之前先保存 session 日志），作为上游 cordis 插件运行。上游的 `/compact` 命令（`dsh-command-compact`）按需压缩会话历史。 |
 | Bash tool | Node subprocess、sandbox、terminal 和 job services | 在原生 tool seam 上适配 | 注册上游 `ToolDefinition`，但通过配置的 Computer workspace backend 和 just-bash 执行其 body。默认 direct backend 在 owner Durable Object 内运行，启用 hardened interpreter limits 且不提供网络命令；添加 `LOADER` binding 后会选择 Computer 的 isolated Worker Shell backend。原生 tool cancellation 会通过 Computer execution handle 发送 `SIGINT`。部署配置提供明确的默认 timeout 与调用方可选值上限，`timedOut` 则独立于 exit 与 cancellation status 报告 deadline。不支持原生二进制、后台进程、PTY 和任意 Linux 行为。 |
 | Workspace filesystem | 本地 filesystem services 和 host paths | 适配 | 在 owner 基于 SQLite 的 Durable Object VFS 中保存 `/workspace`。 |
@@ -152,7 +152,7 @@ curl -b /tmp/dsh-edge-cookie -N -X POST -H 'content-type: application/json' \
 | Directory picker | `ctx.directoryPicker` seam，由 `dsh-host-directory-picker-auto` 在启动时选择 `-native` OS 选择器或 `-browse` 文件系统 backend，加 Web browse 对话框 | 复用并提供 Edge browse backend | 安装上游 seam，并把上游 `dsh-client-ui-directory-picker-browse` 对话框固定进 Web roster；Edge 从 `/workspace` Computer VFS 按每次一层回答 `browse` capability，以 `/workspace` 为根并沿用上游的 hidden、bound 与失败词汇，因此上游 `DirectoryPickerController` 提供 `directoryPicker/list` 与 `createDirectory`，并拒绝原生 `pick`。 |
 | 对话文件链接 | `session/openWorkspacePath` 经 `dsh-native-command` 把点击的路径交给宿主桌面打开器；`session/canOpenWorkspacePath` 决定是否展示该入口 | 在上游 `SessionControllerInternals` seam 适配，加 Web 端下载回退 | 用 Edge internals 组合 `SessionController`，让原生探测返回 false、打开尝试以可读原因失败而不是 `child_process` 错误。V3 Web 客户端在右侧栏预览文件链接。Edge 将上游 `workspaceFiles` 控制器接入请求作用域内的 VFS 读取，支持有界文本/字节分页和元数据订阅。旧版 `ctx.remote.session.openWorkspacePath` 回退以及经 owner 鉴权的 `GET /api/workspace/file` 下载仍然可用。 |
 | Existing Web UI | 运行时加载的 shell 和 `dsh.client` 插件 graph | 复用并采用通用 composition fallback | 把上游 shell 和受支持的上游客户端包组装成 Worker 静态资源；共享的 slot occupancy 规则会隐藏缺少 provider 的 action。Cloudflare 直接提供普通资源，`/`、`/login` 与 `/api/*` 则进入 Worker 执行 owner access control。组装后的 asset policy 会阻止所有直接或 SPA-fallback shell alias 被嵌入 frame。 |
-| Other tools | Web Search、filesystem editor tools、MCP、skills、workflows、jobs 和 subagents | Search、文件、glob/grep、goal、todo、skill、subagent 和 MCP 工具已移植；workflow 与 run_code 已在 isolated 构建中移植 | 复用上游 DeepSeek Web Search 及其 30 秒 tool-call timeout。上游 `workflow` 工具仅由 Dynamic Worker 运行时提供（isolated、Paid 计划构建）；Direct 构建不注册该工具。由于 workerd 禁止在进程内使用 `eval`/`new Function`/`node:vm`，每次运行都会把脚本加载到独立的 Dynamic Worker 中执行，该 Worker 无出站网络，并受 30 秒 Worker Loader `cpuMs` 上限约束（由 Cloudflare 运行时强制执行，本地开发环境不执行）；`agent()`、`phase()`、`log()` 经 RPC 桥回到 Durable Object，由其执行各项上限：同时最多运行 4 个子 agent（低于 Workers 六连接上限），单次运行最多启动 100 个子 agent，以限制子会话的行写入。上游 `run_code` 工具（`dsh-tools` PTC 模式）由同一运行时提供，但只提供给以上游 `ptc` agent 预设（PTC 模式）开始的会话。isolated 部署沿用上游 id 提供该预设，因此 Web 客户端显示其内置的双语名称。该预设通过生成的 SDK 呈现全部工具，并与上游一样不提供 `workflow`，因为 `run_code` 是它唯一的编排方式。默认使用上游的 `standard` 预设（标准模式；以早先 `dsh-edge` id 记录的会话按 `standard` 读取），以原生方式呈现工具，并保留 `workflow`。与上游一致，Settings → Agent presets 写入 `agent-presets` 设置命名空间，从可用预设中选择新会话的起始预设。在 PTC 模式下，每个程序先用 sucrase 去除类型，再在独立 Dynamic Worker 中运行，受 30 秒 `cpuMs` 上限约束且无出站网络；其中的 `tools.*` 调用经 RPC 桥回到 Durable Object，由其限制为每次运行最多 200 次（每次都是一次写入 session 事件的嵌套工具派发）、参数最多 256 KiB、单次结果最多 2 MiB，嵌套调用仍走审批。文件工具（read/write/edit/read_image）通过 `EdgeFileSystem` 适配 Computer VFS。`glob` 和 `grep` 保持上游 `dsh-tool-fs-search` 的工具名、参数结构、结果文本、搜索卡片，以及超过 100 条路径或 250 条匹配时把完整结果另存为文件；但 Workers 无法启动它所需的 ripgrep 程序，所以 Edge 在 VFS 上运行它们：两者都跳过版本控制元数据目录，`grep` 还跳过隐藏文件、二进制文件和超过 4 MiB 的文件，两者都不应用 `.gitignore`。`grep` 的正则使用 RE2 语法（不支持环视和反向引用），由 re2js 以线性时间匹配，所以病态正则不会卡住 Durable Object。一次搜索最多遍历 20,000 个条目，`grep` 最多收集 20,000 行匹配或 20 MB 文本；超出上限时会失败，并提示缩小路径或模式。ripgrep 15 会拒绝的 glob 语法（未闭合的 `[` 或 `{`、`[z-a]` 这样的反向范围、末尾悬空的 `\`）会作为无效模式报错；`a{b,{c,d}}` 这样的嵌套分组可以使用。搜索在每次列出目录前后检查是否已取消，所以 30 秒的工具超时能中止耗时的遍历。与上游一致，文件观察策略（`dsh-fs-observation-policy`）为它们把关：`write` 不能覆盖本会话尚未读过的文件，`edit` 必须先读过目标文件，读取之后被改动过的文件（例如被 `bash` 或 Linux 容器改动）在重新读取之前会作为过期而失败；会话重启后不保留读取记录。Goal 工具（`ToolGoal`）作为上游 cordis 插件直接与 `GoalService` 组合。子 agent 沿用上游标准组合：`subagent` 启动一个全新的子 agent，`subagent_fork` 启动一个从父 agent 已完成的 turn 开始的子 agent（`dsh-subagent-spawn-in-process`、`dsh-subagent-fork-in-process`）。两者默认都在后台以可续接子 agent 运行，父 agent 用 `send_message` 继续它、用 `interrupt_agent` 停止它当前的 turn、用 `list_agents` 找到它（`dsh-tool-subagent-control`）。父 agent 的 turn 结束后子 agent 仍继续工作，它的结束消息会唤醒父 agent 再跑一个 turn；与上游一致，停止父 agent 不会停止正在运行的子 agent。未在运行的子 agent 收到消息时会从存储恢复，重启后也一样。上游 `todo_write` 工具（`dsh-tool-todo`）维护会话的任务列表，与上游的组合一样允许多个任务同时进行；它的 `todos` projection 驱动 Web 客户端的待办面板。上游 `present` 工具（`dsh-tool-present`）把工作区文件声明为本 turn 的交付物，Web 客户端将其显示为可在侧边栏预览的文件卡片；Edge 没有桌面，所以对卡片的 Host 检查（`/api/present.host`）回答不可用，卡片不提供用本机应用打开。与上游一样，`dsh-agent-instructions` 在第一次请求前，通过工作区 VFS 从项目根目录（最近一个包含 `.git` 的上级目录，没有则为会话工作目录）到工作目录逐级加载 `AGENTS.md` 和 `CLAUDE.md`（以及它们的 `.local.md` 覆盖文件），合成一条不超过 64 KiB 的基线消息；`read`、`write` 或 `edit` 进入更深的目录时，下一次请求会加入该目录的说明。Workers 没有用户主目录，所以用户全局文件是 `/.dsh/AGENTS.md`。Skill 工具通过 `SkillRegistry` 提供。与上游 `dsh-skill-filesystem` 一致，skill 是带 `name` 和 `description` frontmatter 的 `<name>/SKILL.md` 或 `<name>.md` 文件，位于项目的 `.dsh/skills`、`.agents/skills`，以及用户目录 `/.dsh/skills`、`/.agents/skills`（Workers 没有用户主目录），通过工作区 VFS 读取，每个目录最多读取 100 个条目，每个 skill 文件不超过 64 KiB；新增或修改的 skill 从下一个 turn 起生效，变更后打开的会话的 `/` 菜单也会列出它；与上游一致，Web 客户端在页面刷新前保留已打开会话的 `/` 列表。通过 owner 接口 `GET/PUT/DELETE /api/skills` 存储的 skill（`EdgeSkillProvider`，DO KV）优先级低于它们。MCP client（`dsh-mcp-client`）已安装；仅支持 Streamable HTTP transport（Workers 上不可用 stdio）。在 Settings → DSH Edge → MCP Servers 中配置服务器；工具名格式为 `mcp__<serverName>__<tool>`。逐个针对 Worker-compatible capabilities 增加其余工具，不宣称不可用的 host 行为。 |
+| Other tools | Web Search、filesystem editor tools、MCP、skills、workflows、jobs 和 subagents | Search、文件、glob/grep、goal、todo、skill、subagent 和 MCP 工具已移植；workflow 与 run_code 已在 isolated 构建中移植 | 复用上游 DeepSeek Web Search 及其 30 秒 tool-call timeout。上游 `workflow` 工具仅由 Dynamic Worker 运行时提供（isolated、Paid 计划构建）；Direct 构建不注册该工具。由于 workerd 禁止在进程内使用 `eval`/`new Function`/`node:vm`，每次运行都会把脚本加载到独立的 Dynamic Worker 中执行，该 Worker 无出站网络，并受 30 秒 Worker Loader `cpuMs` 上限约束（由 Cloudflare 运行时强制执行，本地开发环境不执行）；`agent()`、`phase()`、`log()` 经 RPC 桥回到 Durable Object，由其执行各项上限：同时最多运行 4 个子 agent（低于 Workers 六连接上限），单次运行最多启动 100 个子 agent，以限制子会话的行写入。上游 `run_code` 工具（`dsh-tools` PTC 模式）由同一运行时提供，但只提供给以上游 `ptc` agent 预设（PTC 模式）开始的会话。isolated 部署沿用上游 id 提供该预设，因此 Web 客户端显示其内置的双语名称。该预设通过生成的 SDK 呈现全部工具，并与上游一样不提供 `workflow`，因为 `run_code` 是它唯一的编排方式。默认使用上游的 `standard` 预设（标准模式；以早先 `dsh-edge` id 记录的会话按 `standard` 读取），以原生方式呈现工具，并保留 `workflow`。与上游一致，Settings → Agent presets 写入 `agent-preset-registry` 设置命名空间的 `selectedDefault`，从可用预设中选择新会话的起始预设；早期版本保存在 `agent-presets` 下的默认值会在启动时迁移过来。在 PTC 模式下，每个程序先用 sucrase 去除类型，再在独立 Dynamic Worker 中运行，受 30 秒 `cpuMs` 上限约束且无出站网络；其中的 `tools.*` 调用经 RPC 桥回到 Durable Object，由其限制为每次运行最多 200 次（每次都是一次写入 session 事件的嵌套工具派发）、参数最多 256 KiB、单次结果最多 2 MiB，嵌套调用仍走审批。文件工具（read/write/edit/read_image）通过 `EdgeFileSystem` 适配 Computer VFS。`glob` 和 `grep` 保持上游 `dsh-tool-fs-search` 的工具名、参数结构、结果文本、搜索卡片，以及超过 100 条路径或 250 条匹配时把完整结果另存为文件；但 Workers 无法启动它所需的 ripgrep 程序，所以 Edge 在 VFS 上运行它们：两者都跳过版本控制元数据目录，`grep` 还跳过隐藏文件、二进制文件和超过 4 MiB 的文件，两者都不应用 `.gitignore`。`grep` 的正则使用 RE2 语法（不支持环视和反向引用），由 re2js 以线性时间匹配，所以病态正则不会卡住 Durable Object。一次搜索最多遍历 20,000 个条目，`grep` 最多收集 20,000 行匹配或 20 MB 文本；超出上限时会失败，并提示缩小路径或模式。ripgrep 15 会拒绝的 glob 语法（未闭合的 `[` 或 `{`、`[z-a]` 这样的反向范围、末尾悬空的 `\`）会作为无效模式报错；`a{b,{c,d}}` 这样的嵌套分组可以使用。搜索在每次列出目录前后检查是否已取消，所以 30 秒的工具超时能中止耗时的遍历。与上游一致，文件观察策略（`dsh-fs-observation-policy`）为它们把关：`write` 不能覆盖本会话尚未读过的文件，`edit` 必须先读过目标文件，读取之后被改动过的文件（例如被 `bash` 或 Linux 容器改动）在重新读取之前会作为过期而失败；会话重启后不保留读取记录。Goal 工具（`ToolGoal`）作为上游 cordis 插件直接与 `GoalService` 组合。子 agent 沿用上游标准组合：`subagent` 启动一个全新的子 agent，`subagent_fork` 启动一个从父 agent 已完成的 turn 开始的子 agent（`dsh-subagent-spawn-in-process`、`dsh-subagent-fork-in-process`）。两者默认都在后台以可续接子 agent 运行，父 agent 用 `send_message` 继续它、用 `interrupt_agent` 停止它当前的 turn、用 `list_agents` 找到它（`dsh-tool-subagent-control`）。父 agent 的 turn 结束后子 agent 仍继续工作，它的结束消息会唤醒父 agent 再跑一个 turn；与上游一致，停止父 agent 不会停止正在运行的子 agent。未在运行的子 agent 收到消息时会从存储恢复，重启后也一样。上游 `todo_write` 工具（`dsh-tool-todo`）维护会话的任务列表，与上游的组合一样允许多个任务同时进行；它的 `todos` projection 驱动 Web 客户端的待办面板。上游 `present` 工具（`dsh-tool-present`）把工作区文件声明为本 turn 的交付物，Web 客户端将其显示为可在侧边栏预览的文件卡片；Edge 没有桌面，所以对卡片的 Host 检查（`/api/present.host`）回答不可用，卡片不提供用本机应用打开。与上游一样，`dsh-agent-instructions` 在第一次请求前，通过工作区 VFS 从项目根目录（最近一个包含 `.git` 的上级目录，没有则为会话工作目录）到工作目录逐级加载 `AGENTS.md` 和 `CLAUDE.md`（以及它们的 `.local.md` 覆盖文件），合成一条不超过 64 KiB 的基线消息；`read`、`write` 或 `edit` 进入更深的目录时，下一次请求会加入该目录的说明。Workers 没有用户主目录，所以用户全局文件是 `/.dsh/AGENTS.md`。Skill 工具通过 `SkillRegistry` 提供。与上游 `dsh-skill-filesystem` 一致，skill 是带 `name` 和 `description` frontmatter 的 `<name>/SKILL.md` 或 `<name>.md` 文件，位于项目的 `.dsh/skills`、`.agents/skills`，以及用户目录 `/.dsh/skills`、`/.agents/skills`（Workers 没有用户主目录），通过工作区 VFS 读取，每个目录最多读取 100 个条目，每个 skill 文件不超过 64 KiB；新增或修改的 skill 从下一个 turn 起生效，变更后打开的会话的 `/` 菜单也会列出它；与上游一致，Web 客户端在页面刷新前保留已打开会话的 `/` 列表。通过 owner 接口 `GET/PUT/DELETE /api/skills` 存储的 skill（`EdgeSkillProvider`，DO KV）优先级低于它们。MCP client（`dsh-mcp-client`）已安装；仅支持 Streamable HTTP transport（Workers 上不可用 stdio）。在 Settings → DSH Edge → MCP Servers 中配置服务器；工具名格式为 `mcp__<serverName>__<tool>`。逐个针对 Worker-compatible capabilities 增加其余工具，不宣称不可用的 host 行为。 |
 | Attachments | 本地 attachment storage、上游 image reference、composer、gallery、lightbox 与 provider conversion | 在原生 storage seam 上适配 | 原样复用上游 `AttachmentStore`、admission、协议、授权、UI 与 DeepSeek conversion。PNG/JPEG 不可变字节按 SHA-256 identity 存入新部署与 pre-attachment 部署使用的 64 MiB、按 512 KiB 分块的 DO backend，或存入已固定使用私有 R2 的部署的 R2；session event 只保留上游 ref。每个 owner instance 首次选择的 backend 会被固定，认领或升级不会让既有引用失联。 |
 | Goal tracking | `GoalService` 提供 create/edit/pause/resume/complete/clear mutation 与 GoalBar UI | 复用 | 作为 cordis 插件安装上游 `GoalService` 和 `ToolGoal`（直接组合）。浏览器 GoalBar mutation 通过 `TypertGatewayService` 路由到 `/api/goals/<method>`。`SessionProjectionCache` 在 DO 重启后持久化 goal 状态。上游的 `/goal` 命令（`dsh-command-goal`）可以查看、设定、编辑、暂停、恢复或清除会话的目标。每一轮目标都在 Edge 的 turn 内运行，带有工作区、时限和实时事件：上游的轮次驱动排入下一轮期间，turn 保持打开；在 turn 之外启用目标的调用（`/goal`、GoalBar 的恢复）在一个新的 turn 内运行。 |
 | Context compaction | Token 计量、自动压缩和 session 标题生成 | 复用 | 直接安装上游 cordis 插件。上下文压缩、token 计量、工具结果修剪和自动 session 标题生成原样运行。上游的图片卸载（`dsh-compaction-image-offload`）在请求中的图片超出路由预算（默认每个请求 600 张）时让 turn 继续：它用一条 `image/offload` 会话事件把最早的图片标记为已卸载，然后重试请求。 |
@@ -210,6 +210,8 @@ Cloudflare static assets -> upstream Web shell + client plugin graph
 
 `DEEPSEEK_API_KEY` 可以在部署时作为 Worker secret 设置，也可以之后通过 Settings → Models 页面输入。Edge credential provider 先查 Durable Object KV，再降级到 Worker 环境变量；解析值保持请求级作用域，绝不写入 session event 或 response。首尾空白会被移除；空白值视为未配置。
 
+其他服务商的 API key 也在同一个 Models 页面填写，按该服务商路由所指定的凭据名（例如 `OPENROUTER_API_KEY`）存入 Durable Object KV。这些 key 不从 Worker 变量读取：只有 `DEEPSEEK_API_KEY` 为了兼容 Models 页面出现之前的部署而保留这一兜底。路由的附加请求头以明文存在设置文档里，所以只接受不会携带密钥的请求头：`HTTP-Referer`、`Referer`、`X-Title`、`OpenAI-Organization`、`OpenAI-Project` 和 `anthropic-beta`。需要第二个认证头的网关（例如开启认证的 Cloudflare AI Gateway 所需的 `cf-aig-authorization`）暂时无法配置。路由的 key 名不能使用属于 DeepSeek 或其他 Edge 功能的名字（`DEEPSEEK_*`、`MCP_TOKEN_*`、`DSH_EDGE_*`），因此部署的 DeepSeek 密钥不会被发到其他地址。每个路由都必须有自己的 key 名：没有的话，pi-ai 会到进程环境里找 key，而 Workers 会把部署的 secret 暴露在那里。
+
 | 变量 | 用途与校验 |
 | --- | --- |
 | `DEEPSEEK_BASE_URL` | Anthropic-compatible Messages endpoint。默认为 `https://api.deepseek.com/anthropic`。DeepSeek 以前的 OpenAI-compatible 根地址（`https://api.deepseek.com`、`/v1` 或 `/beta`），无论设在这里还是保存为 Models 页的 Base URL，启动时都会改成该默认值；其他地址返回 404 时，保留原报错并补充提示：该地址可能不支持 Messages API，以及在哪里修改。必须是不含 URL userinfo 的 HTTP(S) URL。Browser 投影会省略可能携带 gateway credential 的 query 与 fragment。 |
@@ -252,7 +254,7 @@ Direct 模式比独立 Worker 的隔离更轻；不要把 single-owner 部署暴
 - Isolated 保留该 shell core，并把不可达的 Direct backend 替换成 fail-closed module。因此每个 artifact 只携带所选 command runtime。
 - 安装器生成私有 mode-specific config，指向所选 artifact，并通过 `no_bundle` 上传。用户机器不会重新构建 dsh-edge，也不会把 Harness package 解析进新 Worker。
 - Container 模式部署 isolated 产物，并使用 `docker.io/pawaca/dsh-edge-computer:<version>` 镜像。该镜像由发版流程从 `container/Dockerfile` 构建，每个版本在 npm 发布前推送一次。安装时不需要本地 Docker；`pnpm dev:container` 和 `pnpm test:container` 会在本地构建 Dockerfile，因此需要。
-- CI 从已安装 tarball 启动 Direct artifact，并拒绝 gzip 后超过 900 KiB 的产物，为 Cloudflare 匿名临时账户的 1 MiB 上限保留余量。
+- CI 从已安装 tarball 启动 Direct artifact。打包时会拒绝超过 Cloudflare 未压缩 64 MiB 上限的 Worker（Cloudflare 不限制压缩后体积，临时账户也一样），CI 还会对照 Cloudflare 1 秒的启动上限检查每个产物的启动耗时。
 
 ### 安装与升级
 
@@ -304,7 +306,7 @@ npx dsh-edge upgrade
 - 上传成功但交接失败时，恢复卡片会在命令按失败退出前输出已生效 owner key 与所有已知 URL。
 - 安装直接通过 Wrangler 上传；不会创建或绑定 GitHub 仓库、Cloudflare Builds 项目或源码构建流水线。
 
-从 checkout 开发的贡献者可以用 `pnpm --filter dsh-edge bundle:direct` 和 `pnpm --filter dsh-edge bundle:isolated` 在本地复现两种 release artifact。第一条命令还会执行压缩体积预算检查。
+从 checkout 开发的贡献者可以用 `pnpm --filter dsh-edge bundle:direct` 和 `pnpm --filter dsh-edge bundle:isolated` 在本地复现两种 release artifact。两条命令都会检查 Cloudflare 未压缩 64 MiB 的 Worker 体积上限（Cloudflare 不限制压缩后体积），`pnpm --filter dsh-edge check:startup` 会对照 Cloudflare 1 秒的启动上限分析已提升产物的启动耗时。
 
 贡献者可以在没有 key 且不发起网络请求的情况下重放完整的 Free 临时账户流程。这个 example 会运行实际交付的 bin、真实 prompt、Wrangler 子进程、结构化部署输出解析、公开激活观察与最终交接，并替换外部 Cloudflare 边界：
 

package/THIRD_PARTY_NOTICES.md

@@ -37,13 +37,12 @@ SOFTWARE.
 
 `dsh-edge` also applies a version-bound fix to `@cloudflare/computer@0.3.1`, recorded with its reason in `standalone/patches/audit.json`; the component's license below is unchanged.
 
-The following 674 package versions form the conservative, platform-neutral production closure used to assemble the Web and Worker artifacts in this distribution. Platform-specific build binaries that are not distributed in those artifacts are excluded; tree shaking can omit additional code. The inventory and legal texts are generated during packaging rather than referring recipients to a source checkout. License expressions are SPDX identifiers supplied by each package. Dependencies installed separately by npm remain declared in this package's `package.json`.
+The following 665 package versions form the conservative, platform-neutral production closure used to assemble the Web and Worker artifacts in this distribution. Platform-specific build binaries that are not distributed in those artifacts are excluded; tree shaking can omit additional code. The inventory and legal texts are generated during packaging rather than referring recipients to a source checkout. License expressions are SPDX identifiers supplied by each package. Dependencies installed separately by npm remain declared in this package's `package.json`.
 
 | Component | License |
 | --- | --- |
 | `@anthropic-ai/sdk@0.124.0` | `MIT` |
 | `@aws-sdk/client-bedrock-runtime@3.1127.0` | `Apache-2.0` |
-| `@aws-sdk/core@3.977.9` | `Apache-2.0` |
 | `@aws-sdk/core@3.978.1` | `Apache-2.0` |
 | `@aws-sdk/credential-provider-env@3.972.72` | `Apache-2.0` |
 | `@aws-sdk/credential-provider-http@3.972.74` | `Apache-2.0` |
@@ -56,15 +55,11 @@ The following 674 package versions form the conservative, platform-neutral produ
 | `@aws-sdk/eventstream-handler-node@3.972.34` | `Apache-2.0` |
 | `@aws-sdk/middleware-eventstream@3.972.29` | `Apache-2.0` |
 | `@aws-sdk/middleware-websocket@3.972.52` | `Apache-2.0` |
-| `@aws-sdk/nested-clients@3.997.44` | `Apache-2.0` |
 | `@aws-sdk/nested-clients@3.997.46` | `Apache-2.0` |
-| `@aws-sdk/signature-v4-multi-region@3.996.46` | `Apache-2.0` |
 | `@aws-sdk/signature-v4-multi-region@3.996.47` | `Apache-2.0` |
 | `@aws-sdk/token-providers@3.1127.0` | `Apache-2.0` |
 | `@aws-sdk/token-providers@3.1138.0` | `Apache-2.0` |
-| `@aws-sdk/types@3.974.5` | `Apache-2.0` |
 | `@aws-sdk/types@3.974.6` | `Apache-2.0` |
-| `@aws-sdk/xml-builder@3.972.40` | `Apache-2.0` |
 | `@aws-sdk/xml-builder@3.972.41` | `Apache-2.0` |
 | `@aws/lambda-invoke-store@0.3.0` | `Apache-2.0` |
 | `@babel/code-frame@7.29.7` | `MIT` |
@@ -380,15 +375,11 @@ The following 674 package versions form the conservative, platform-neutral produ
 | `@sec-ant/readable-stream@0.4.1` | `MIT` |
 | `@sindresorhus/is@7.2.0` | `MIT` |
 | `@sindresorhus/merge-streams@4.0.0` | `MIT` |
-| `@smithy/core@3.33.3` | `Apache-2.0` |
 | `@smithy/core@3.35.1` | `Apache-2.0` |
 | `@smithy/credential-provider-imds@4.5.2` | `Apache-2.0` |
-| `@smithy/fetch-http-handler@5.7.2` | `Apache-2.0` |
 | `@smithy/fetch-http-handler@5.8.0` | `Apache-2.0` |
-| `@smithy/node-http-handler@4.11.3` | `Apache-2.0` |
 | `@smithy/node-http-handler@4.12.1` | `Apache-2.0` |
 | `@smithy/signature-v4@5.7.3` | `Apache-2.0` |
-| `@smithy/types@4.17.2` | `Apache-2.0` |
 | `@smithy/types@4.19.0` | `Apache-2.0` |
 | `@speed-highlight/core@1.2.24` | `CC0-1.0` |
 | `@stablelib/base64@1.0.1` | `MIT` |
@@ -2018,11 +2009,8 @@ Applies to:
 - `@aws-sdk/credential-provider-web-identity@3.972.78` (`LICENSE`)
 - `@aws-sdk/eventstream-handler-node@3.972.34` (`LICENSE`)
 - `@aws-sdk/middleware-websocket@3.972.52` (`LICENSE`)
-- `@aws-sdk/signature-v4-multi-region@3.996.46` (`LICENSE`)
 - `@aws-sdk/signature-v4-multi-region@3.996.47` (`LICENSE`)
-- `@smithy/core@3.33.3` (`LICENSE`)
 - `@smithy/core@3.35.1` (`LICENSE`)
-- `@smithy/types@4.17.2` (`LICENSE`)
 - `@smithy/types@4.19.0` (`LICENSE`)
 
 ```text
@@ -10830,14 +10818,10 @@ Applies to:
 - `@aws-sdk/middleware-eventstream@3.972.29` (`LICENSE`)
 - `@aws-sdk/token-providers@3.1127.0` (`LICENSE`)
 - `@aws-sdk/token-providers@3.1138.0` (`LICENSE`)
-- `@aws-sdk/types@3.974.5` (`LICENSE`)
 - `@aws-sdk/types@3.974.6` (`LICENSE`)
-- `@aws-sdk/xml-builder@3.972.40` (`LICENSE`)
 - `@aws-sdk/xml-builder@3.972.41` (`LICENSE`)
 - `@smithy/credential-provider-imds@4.5.2` (`LICENSE`)
-- `@smithy/fetch-http-handler@5.7.2` (`LICENSE`)
 - `@smithy/fetch-http-handler@5.8.0` (`LICENSE`)
-- `@smithy/node-http-handler@4.11.3` (`LICENSE`)
 - `@smithy/node-http-handler@4.12.1` (`LICENSE`)
 - `@smithy/signature-v4@5.7.3` (`LICENSE`)
 
@@ -11862,7 +11846,6 @@ SOFTWARE.
 
 Applies to:
 
-- `@aws-sdk/core@3.977.9` (`LICENSE`)
 - `@aws-sdk/core@3.978.1` (`LICENSE`)
 
 ```text
@@ -12135,218 +12118,6 @@ FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TOR
 ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 ```
 
-### License/notice f1aac97cee45
-
-Applies to:
-
-- `@aws-sdk/nested-clients@3.997.44` (`package metadata fallback`)
-
-```text
-The published @aws-sdk/nested-clients@3.997.44 package declared Apache-2.0 but did not include a license or notice file. Attribution from its package metadata: AWS SDK for JavaScript Team. Repository: https://github.com/aws/aws-sdk-js-v3.git.
-
-Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "{}"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright 2018-2023 Amazon.com, Inc. or its affiliates. All Rights Reserved.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-```
-
 ### License/notice f2b90afb27a6
 
 Applies to: