dsh-enhancement-suite 0.1.3 → 0.2.0

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 Scorp1o117
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 Scorp1o117
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -2,11 +2,20 @@
 
 [![中文文档](https://img.shields.io/badge/%E4%B8%AD%E6%96%87%E6%96%87%E6%A1%A3-blue)](README.zh.md) [![License](https://img.shields.io/badge/license-MIT-blue)](LICENSE) [![Node](https://img.shields.io/badge/node-%3E%3D22.18-green)](package.json)
 
-**Vision · Soul / Persona · Long-term Memory · Plugin Marketplace**
+**Vision · Soul / Persona · Long-term Memory · Plugin Marketplace · Reasoning Options**
 
-The official entry point and one-command installer for the four Scorp1o117 plugins that enhance [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) (DSH). This suite is a real installer — not a link collection: it drives the official `dsh plugin` CLI, mounts what needs mounting, and checks the result.
+The official entry point and one-command installer for the Scorp1o117 plugins that enhance [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) (DSH). This suite is a real installer — not a link collection: it drives the official `dsh plugin` CLI, mounts what needs mounting, and checks the result.
 
-Version 0.1.3 is validated with DSH `0.1.1-rc.1` and reports pnpm native-build policy failures explicitly.
+Version 0.1.4 and newer require DSH `0.1.0-rc.7` or newer and are validated
+with `0.1.0-rc.7`, `0.1.0-rc.8`, and `0.1.1-rc.1`. They also report pnpm
+native-build policy failures explicitly.
+
+DSH `0.1.0-rc.6` users must install the last compatible plugin releases
+directly: `dsh-tool-vision@0.6.1`, `dsh-soul-md@0.5.6`,
+`dsh-tdai-memory@0.2.11`, and `dsh-plugin-marketplace@0.2.6`. Do not use the
+suite's unpinned `install` command on rc.6 because it intentionally resolves
+the current releases. `dsh-reasoning-options` requires DSH `0.1.0-rc.7` or
+newer (no rc.6-compatible release exists).
 
 > **This repository does not vendor or replace the individual plugins.**
 > **Each plugin remains independently maintained in its own upstream repository.**
@@ -45,6 +54,14 @@ Version 0.1.3 is validated with DSH `0.1.1-rc.1` and reports pnpm native-build p
 
 [→ upstream repository](https://github.com/Scorp1o117/dsh-plugin-marketplace)
 
+## 🎚️ dsh-reasoning-options
+
+为所有第三方（pi-ai）模型自动添加推理强度选项（off → max 七档，默认 high）。
+
+[![npm](https://img.shields.io/npm/v/dsh-reasoning-options)](https://www.npmjs.com/package/dsh-reasoning-options) [![license](https://img.shields.io/npm/l/dsh-reasoning-options)](https://github.com/Scorp1o117/dsh-reasoning-options/blob/main/LICENSE)
+
+[→ upstream repository](https://github.com/Scorp1o117/dsh-reasoning-options)
+
 ---
 
 ## Requirements
@@ -76,12 +93,12 @@ dsh-enhance install
 
 ```
 dsh-enhance list                          Show the plugin registry (installed state per profile)
-dsh-enhance install                       Install all four plugins into a profile
+dsh-enhance install                       Install all plugins into a profile
 dsh-enhance update                        Update installed plugins to the latest versions
 dsh-enhance doctor                        Check Node, dsh CLI, profile and per-plugin state
 
   --profile <name>     target profile (default: web)
-  --only <keys>        comma-separated selection: vision,soul,memory,marketplace (or package names)
+  --only <keys>        comma-separated selection: vision,soul,memory,marketplace,reasoning (or package names)
   --dry-run            print what would run without executing anything
 ```
 
@@ -95,8 +112,8 @@ dsh-enhance update --profile headless
 
 ## How it installs
 
-1. Every plugin is installed through the **official CLI**: `dsh plugin --profile <profile> add <package>`. This suite never loads the plugins through its own dependency graph or its own cordis patch — the four upstream packages stay independent in the profile.
-2. All four plugins now declare `dsh.bundle.patch` (as of vision 0.3.9 / soul-md 0.5.4 / tdai-memory 0.2.9 / marketplace 0.2.4), so `dsh plugin add` reconciles each into `dsh.profile.bundles` and its own bundle layer auto-mounts it.
+1. Every plugin is installed through the **official CLI**: `dsh plugin --profile <profile> add <package>`. This suite never loads the plugins through its own dependency graph or its own cordis patch — the upstream packages stay independent in the profile.
+2. All plugins declare `dsh.bundle.patch` (as of vision 0.3.9 / soul-md 0.5.4 / tdai-memory 0.2.9 / marketplace 0.2.4 / reasoning-options 0.1.0), so `dsh plugin add` reconciles each into `dsh.profile.bundles` and its own bundle layer auto-mounts it.
 3. For profiles that mounted a plugin manually before it gained its bundle manifest, the suite **removes the stale manual row** from `cordis.patch.yml` — two mounts of the same entry id would abort boot. (Non-bundle third-party plugins still get the safe idempotent mount logic: empty `[]` patches are replaced correctly, duplicates are skipped, flow-style arrays are refused instead of corrupted.)
 4. Restart `dsh web` and the plugins load.
 

package/README.zh.md

@@ -2,11 +2,18 @@
 
 [![English](https://img.shields.io/badge/English-blue)](README.md) [![License](https://img.shields.io/badge/license-MIT-blue)](LICENSE) [![Node](https://img.shields.io/badge/node-%3E%3D22.18-green)](package.json)
 
-**Vision · Soul / Persona · Long-term Memory · Plugin Marketplace**
+**Vision · Soul / Persona · Long-term Memory · Plugin Marketplace · Reasoning Options**
 
-四个 Scorp1o117 插件的官方总入口和一键安装套件，为 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness)（DSH）增强能力。这是一个真正可用的一键安装器，而不是链接合集：它驱动官方 `dsh plugin` CLI、自动处理挂载、并检查结果。
+Scorp1o117 DSH 插件（增强 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness)）的官方总入口和一键安装套件。这是一个真正可用的一键安装器，而不是链接合集：它驱动官方 `dsh plugin` CLI、自动处理挂载、并检查结果。
 
-0.1.3 已针对 DSH `0.1.1-rc.1` 验证，并会明确识别 pnpm 原生依赖构建策略导致的安装失败。
+从 `0.1.4` 起最低支持 DSH `0.1.0-rc.7`，已针对 `0.1.0-rc.7`、
+`0.1.0-rc.8` 和 `0.1.1-rc.1` 验证，并会明确识别 pnpm 原生依赖构建策略导致的安装失败。
+
+仍使用 DSH `0.1.0-rc.6` 的用户请直接安装最后兼容的插件版本：
+`dsh-tool-vision@0.6.1`、`dsh-soul-md@0.5.6`、`dsh-tdai-memory@0.2.11`
+和 `dsh-plugin-marketplace@0.2.6`。不要在 rc.6 上使用套件不锁版本的 `install`
+命令，因为它会按设计安装当前最新版。`dsh-reasoning-options` 要求 DSH
+`0.1.0-rc.7` 或更高（没有 rc.6 兼容版本）。
 
 > **本仓库不复制、不替代任何独立插件。**
 > **每个插件都在各自的 upstream 仓库独立维护。**
@@ -45,6 +52,14 @@
 
 [→ upstream 仓库](https://github.com/Scorp1o117/dsh-plugin-marketplace)
 
+## 🎚️ dsh-reasoning-options
+
+为所有第三方（pi-ai）模型自动添加推理强度选项（off → max 七档，默认 high）。
+
+[![npm](https://img.shields.io/npm/v/dsh-reasoning-options)](https://www.npmjs.com/package/dsh-reasoning-options) [![license](https://img.shields.io/npm/l/dsh-reasoning-options)](https://github.com/Scorp1o117/dsh-reasoning-options/blob/main/LICENSE)
+
+[→ upstream 仓库](https://github.com/Scorp1o117/dsh-reasoning-options)
+
 ---
 
 ## 环境要求
@@ -76,12 +91,12 @@ dsh-enhance install
 
 ```
 dsh-enhance list                          查看插件清单（含 profile 内的安装状态）
-dsh-enhance install                       把四个插件安装进 profile
+dsh-enhance install                       把全部插件安装进 profile
 dsh-enhance update                        更新已安装插件到最新版本
 dsh-enhance doctor                        检查 Node、dsh CLI、profile 与各插件状态
 
   --profile <name>     目标 profile（默认：web）
-  --only <keys>        逗号分隔的选择：vision,soul,memory,marketplace（或包名）
+  --only <keys>        逗号分隔的选择：vision,soul,memory,marketplace,reasoning（或包名）
   --dry-run            只打印将要执行的操作，不实际执行
 ```
 
@@ -95,9 +110,9 @@ dsh-enhance update --profile headless
 
 ## 安装方式
 
-1. 每个插件都通过**官方 CLI** 安装：`dsh plugin --profile <profile> add <package>`。本套件绝不通过自身的依赖图或自己的 cordis patch 间接加载插件——四个 upstream 包在 profile 中保持独立。
-2. `dsh-plugin-marketplace` 声明了 `dsh.bundle.patch`，`dsh plugin add` 会把它对账进 `dsh.profile.bundles`，由 bundle 层自动挂载。
-3. 其余三个是普通依赖；套件用与 marketplace 一键安装相同的安全、幂等逻辑，把挂载行追加到 profile 的 `cordis.patch.yml`（空 `[]` 补丁会被正确替换、重复挂载会被跳过、流式数组会被拒绝而不是损坏）。
+1. 每个插件都通过**官方 CLI** 安装：`dsh plugin --profile <profile> add <package>`。本套件绝不通过自身的依赖图或自己的 cordis patch 间接加载插件——各 upstream 包在 profile 中保持独立。
+2. 所有插件都声明了 `dsh.bundle.patch`（vision 0.3.9 / soul-md 0.5.4 / tdai-memory 0.2.9 / marketplace 0.2.4 / reasoning-options 0.1.0 起），`dsh plugin add` 会把它对账进 `dsh.profile.bundles`，由各自的 bundle 层自动挂载。
+3. 对于在获得 bundle 声明前就已手动挂载的插件，套件会**移除 cordis.patch.yml 里的过期手动行**——同一 entry id 挂两次会启动失败。（非 bundle 第三方插件仍会用安全、幂等的挂载逻辑处理：空 `[]` 补丁会被正确替换、重复挂载会被跳过、流式数组会被拒绝而不是损坏。）
 4. 重启 `dsh web` 即可加载。
 
 每一步都有清晰的 `✓` / `✗` 反馈，失败绝不吞掉，且不读取、不打印任何 API Key。

package/bin/dsh-enhance.mjs

@@ -3,12 +3,13 @@
  * dsh-enhance — DeepSeek Harness Enhancement Suite CLI.
  *
  * Zero-dependency, cross-platform (Windows / Linux / macOS) installer and
- * registry for the four Scorp1o117 DSH plugins:
+ * registry for the Scorp1o117 DSH plugins (see plugins.json):
  *
  *   vision      dsh-tool-vision          Vision
  *   soul        dsh-soul-md              Persona
  *   memory      dsh-tdai-memory          Memory
  *   marketplace dsh-plugin-marketplace   Marketplace
+ *   reasoning   dsh-reasoning-options    Model
  *
  * Install always prefers the official DeepSeek Harness plugin CLI
  * (`dsh plugin --profile <profile> add <package>`); this suite never loads
@@ -35,6 +36,7 @@ const DEFAULT_PROFILE = MANIFEST.defaultProfile ?? "web";
 /** Short keys and full package names are both accepted for --only. */
 const KEY_ALIASES = new Map(PLUGINS.map((p) => [p.key, p.name]));
 const NODE_MIN = MANIFEST.node ?? ">=22.18";
+const DSH_MIN = MANIFEST.dsh ?? ">=0.1.0-rc.7";
 
 const ok = (msg) => console.log(`  ✓ ${msg}`);
 const bad = (msg) => console.log(`  ✗ ${msg}`);
@@ -364,7 +366,7 @@ Usage:
 
 Commands:
   list                          Show the plugin registry (installed state per profile)
-  install                       Install all four plugins into a profile
+  install                       Install all ${PLUGINS.length} plugins into a profile
   update                        Update installed plugins to the latest versions
   doctor                        Check Node, dsh CLI, profile and per-plugin state
 
@@ -383,6 +385,7 @@ Examples:
 
 Notes:
   - Install prefers the official CLI: dsh plugin --profile <profile> add <package>
+  - Requires DSH ${DSH_MIN}; rc.6 users must install the pinned legacy releases documented in the README
   - Requires Node ${NODE_MIN} (dsh-tdai-memory constraint)
   - This suite never loads plugins through its own dependency graph`);
 }
@@ -401,6 +404,7 @@ function cmdList(profile) {
   }
   head("");
   console.log(`Node requirement: ${NODE_MIN} (running ${process.version})`);
+  console.log(`DSH requirement: ${DSH_MIN}`);
 }
 
 async function cmdInstall(profile, only, dryRun) {

package/bin/validate-manifest.mjs

@@ -2,7 +2,7 @@
 /**
  * validate-manifest — validates plugins.json for the suite.
  *
- * Checks: exactly four plugins, no duplicate names/keys, all required
+ * Checks: at least one plugin, no duplicate names/keys, all required
  * fields present, repo URLs are https github.com links. Exits non-zero on
  * any violation. Used by CI and `npm run check`.
  */
@@ -20,19 +20,23 @@ const fail = (message) => {
 };
 
 const manifest = JSON.parse(readFileSync(join(ROOT, "plugins.json"), "utf8"));
+if (manifest.dsh !== ">=0.1.0-rc.7") fail(`expected dsh requirement >=0.1.0-rc.7, got ${manifest.dsh ?? "missing"}`);
 if (!Array.isArray(manifest.plugins)) {
   fail("plugins.json: missing plugins array");
 } else {
-  if (manifest.plugins.length !== 4) fail(`expected exactly 4 plugins, got ${manifest.plugins.length}`);
+  if (manifest.plugins.length < 1) fail("plugins.json: plugins array is empty");
   const names = manifest.plugins.map((p) => p.name);
   const keys = manifest.plugins.map((p) => p.key);
   if (new Set(names).size !== names.length) fail("duplicate plugin names");
   if (new Set(keys).size !== keys.length) fail("duplicate plugin keys");
+  const rc6Pins = manifest.rc6Pins ?? {};
   for (const p of manifest.plugins) {
     for (const field of REQUIRED) {
       if (typeof p[field] !== "string" || p[field].length === 0) fail(`${p.name ?? "?"}: missing required field ${field}`);
     }
     if (!/^https:\/\/github\.com\//.test(p.repo ?? "")) fail(`${p.name ?? "?"}: repo must be an https github.com URL`);
+    const pin = rc6Pins[p.name];
+    if (pin !== "none" && !/^\d+\.\d+\.\d+$/.test(pin ?? "")) fail(`${p.name ?? "?"}: missing rc6 compatibility pin (semver, or "none" when the plugin requires DSH rc.7+)`);
   }
 }
 

package/docs/architecture.md

@@ -1,102 +1,102 @@
-# Architecture — dsh-enhancement-suite
-
-## Positioning
-
-`dsh-enhancement-suite` is the **official entry point and installer** for the four
-Scorp1o117 DeepSeek Harness plugins. It is deliberately **not** a wrapper that
-owns the plugins:
-
-- The four upstream repositories are the single source of truth for each plugin.
-- This repository vendors **no plugin source code**.
-- The suite's only runtime artifact is a zero-dependency CLI plus a manifest.
-
-```
-┌─────────────────────────────────────────────────────────────┐
-│ dsh-enhancement-suite (this repo)                            │
-│   README / docs / manifest / CLI                            │
-│   └── bin/dsh-enhance.mjs  ── spawns ──▶  dsh plugin CLI    │
-│                                              │              │
-│   plugins.json (registry metadata only)      │ installs     │
-└──────────────────────────────────────────────│──────────────┘
-                                               ▼
-        ┌───────────────┬───────────────┬───────────────┬──────────────────┐
-        │ dsh-tool-vision│ dsh-soul-md   │ dsh-tdai-memory│ dsh-plugin-      │
-        │ (upstream)     │ (upstream)    │ (upstream)     │ marketplace      │
-        └───────────────┴───────────────┴───────────────┴──────────────────┘
-```
-
-## Why the official CLI, and why not transitive dependencies
-
-Installing through `dsh plugin --profile <p> add <pkg>` (which forwards to pnpm
-inside the profile and reconciles `dsh.profile.bundles`) keeps the plugins
-resolvable from the **profile root**, exactly as if the user installed them by
-hand. Loading the plugins as dependencies of this suite package would make them
-resolve through the suite's `node_modules` chain, which pnpm may place outside
-the profile — plugins then fail to load at boot. Hence:
-
-- `package.json` has **zero dependencies**.
-- The suite never emits its own cordis patch for the four plugins.
-- Mounting (when required) is written into the **profile's own**
-  `cordis.patch.yml`, with the same idempotent logic the marketplace uses.
-
-## Plugin manifest (`plugins.json`)
-
-| Field | Meaning |
-|---|---|
-| `key` | Short CLI key (`vision`, `soul`, `memory`, `marketplace`) |
-| `name` | npm package name (also the `dsh plugin add` argument) |
-| `displayName` | Display name |
-| `emoji` | Card emoji used by the CLI/README |
-| `category` | Suite category |
-| `repo` | Upstream GitHub repository (source of truth) |
-| `description` / `descriptionEn` | Bilingual one-line descriptions |
-
-CI validates: exactly four plugins, no duplicate names/keys, all required
-fields present, `repo` is an https GitHub URL.
-
-## Install flow
-
-1. `dsh plugin --profile <profile> add <package>` (official CLI).
-2. If the installed package declares `dsh.bundle.patch` (currently only
-   `dsh-plugin-marketplace`) → the reconcile step already registered it in
-   `dsh.profile.bundles`; the bundle layer auto-mounts it. **No patch edit.**
-3. Otherwise (plain dependency) → append a mount row to the profile's
-   `cordis.patch.yml`:
-   - idempotent (scans for `name: '<pkg>'`);
-   - an empty `[]` patch (optionally after comment lines) is **replaced**
-     with a block-style `- insert:` list — appending after `[]` would create
-     two top-level YAML documents and crash boot;
-   - a non-empty flow-style array is **refused** with a manual-mount message;
-   - a package already in `dsh.profile.bundles` is skipped.
-4. `update` maps to `dsh plugin --profile <profile> update <package>`, then
-   re-runs the idempotent mount check.
-
-## Safety rules
-
-- **No shell string concatenation.** Every subprocess is spawned with an
-  argument array; on Windows the `.cmd` shim is executed with Node's
-  per-argument quoting (`shell: true` + args array, never a joined command
-  string).
-- **No secrets.** The CLI never reads, prints, or forwards API keys; it does
-  not touch environment secrets or the credentials store.
-- **No swallowed failures.** Each plugin's install/update reports its own
-  `✓`/`✗`; failures are collected, summarized, and reflected in the exit code
-  (non-zero on any failure). Partial state is never hidden.
-- **`--dry-run`** prints the exact commands and patch edits without executing.
-
-## Doctor checks
-
-- Node version ≥ `22.18` (suite-wide requirement inherited from
-  `dsh-tdai-memory`).
-- `dsh` CLI present on `PATH` (override with `DSH_ENHANCE_DSH_BIN`).
-- Target profile directory exists.
-- Per plugin: installed version, mount state (bundles / patch / own bundle
-  layer).
-
-## Versioning and release
-
-- Suite version follows semver; the README badges query npm **live** for the
-  four plugins, so version numbers are never hard-coded.
-- npm publishing is intentionally not automated yet; CI only syntax-checks the
-  CLI, validates the manifest, and optionally cross-checks npm availability
-  (network failures are informational, `continue-on-error`).
+# Architecture — dsh-enhancement-suite
+
+## Positioning
+
+`dsh-enhancement-suite` is the **official entry point and installer** for the four
+Scorp1o117 DeepSeek Harness plugins. It is deliberately **not** a wrapper that
+owns the plugins:
+
+- The four upstream repositories are the single source of truth for each plugin.
+- This repository vendors **no plugin source code**.
+- The suite's only runtime artifact is a zero-dependency CLI plus a manifest.
+
+```
+┌─────────────────────────────────────────────────────────────┐
+│ dsh-enhancement-suite (this repo)                            │
+│   README / docs / manifest / CLI                            │
+│   └── bin/dsh-enhance.mjs  ── spawns ──▶  dsh plugin CLI    │
+│                                              │              │
+│   plugins.json (registry metadata only)      │ installs     │
+└──────────────────────────────────────────────│──────────────┘
+                                               ▼
+        ┌───────────────┬───────────────┬───────────────┬──────────────────┐
+        │ dsh-tool-vision│ dsh-soul-md   │ dsh-tdai-memory│ dsh-plugin-      │
+        │ (upstream)     │ (upstream)    │ (upstream)     │ marketplace      │
+        └───────────────┴───────────────┴───────────────┴──────────────────┘
+```
+
+## Why the official CLI, and why not transitive dependencies
+
+Installing through `dsh plugin --profile <p> add <pkg>` (which forwards to pnpm
+inside the profile and reconciles `dsh.profile.bundles`) keeps the plugins
+resolvable from the **profile root**, exactly as if the user installed them by
+hand. Loading the plugins as dependencies of this suite package would make them
+resolve through the suite's `node_modules` chain, which pnpm may place outside
+the profile — plugins then fail to load at boot. Hence:
+
+- `package.json` has **zero dependencies**.
+- The suite never emits its own cordis patch for the four plugins.
+- Mounting (when required) is written into the **profile's own**
+  `cordis.patch.yml`, with the same idempotent logic the marketplace uses.
+
+## Plugin manifest (`plugins.json`)
+
+| Field | Meaning |
+|---|---|
+| `key` | Short CLI key (`vision`, `soul`, `memory`, `marketplace`) |
+| `name` | npm package name (also the `dsh plugin add` argument) |
+| `displayName` | Display name |
+| `emoji` | Card emoji used by the CLI/README |
+| `category` | Suite category |
+| `repo` | Upstream GitHub repository (source of truth) |
+| `description` / `descriptionEn` | Bilingual one-line descriptions |
+
+CI validates: exactly four plugins, no duplicate names/keys, all required
+fields present, `repo` is an https GitHub URL.
+
+## Install flow
+
+1. `dsh plugin --profile <profile> add <package>` (official CLI).
+2. If the installed package declares `dsh.bundle.patch` (currently only
+   `dsh-plugin-marketplace`) → the reconcile step already registered it in
+   `dsh.profile.bundles`; the bundle layer auto-mounts it. **No patch edit.**
+3. Otherwise (plain dependency) → append a mount row to the profile's
+   `cordis.patch.yml`:
+   - idempotent (scans for `name: '<pkg>'`);
+   - an empty `[]` patch (optionally after comment lines) is **replaced**
+     with a block-style `- insert:` list — appending after `[]` would create
+     two top-level YAML documents and crash boot;
+   - a non-empty flow-style array is **refused** with a manual-mount message;
+   - a package already in `dsh.profile.bundles` is skipped.
+4. `update` maps to `dsh plugin --profile <profile> update <package>`, then
+   re-runs the idempotent mount check.
+
+## Safety rules
+
+- **No shell string concatenation.** Every subprocess is spawned with an
+  argument array; on Windows the `.cmd` shim is executed with Node's
+  per-argument quoting (`shell: true` + args array, never a joined command
+  string).
+- **No secrets.** The CLI never reads, prints, or forwards API keys; it does
+  not touch environment secrets or the credentials store.
+- **No swallowed failures.** Each plugin's install/update reports its own
+  `✓`/`✗`; failures are collected, summarized, and reflected in the exit code
+  (non-zero on any failure). Partial state is never hidden.
+- **`--dry-run`** prints the exact commands and patch edits without executing.
+
+## Doctor checks
+
+- Node version ≥ `22.18` (suite-wide requirement inherited from
+  `dsh-tdai-memory`).
+- `dsh` CLI present on `PATH` (override with `DSH_ENHANCE_DSH_BIN`).
+- Target profile directory exists.
+- Per plugin: installed version, mount state (bundles / patch / own bundle
+  layer).
+
+## Versioning and release
+
+- Suite version follows semver; the README badges query npm **live** for the
+  four plugins, so version numbers are never hard-coded.
+- npm publishing is intentionally not automated yet; CI only syntax-checks the
+  CLI, validates the manifest, and optionally cross-checks npm availability
+  (network failures are informational, `continue-on-error`).

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-enhancement-suite",
-  "version": "0.1.3",
-  "description": "Enhancement suite for DeepSeek Harness — the official installer and registry for Scorp1o117's Vision, Soul/Persona, Memory & Marketplace plugins.",
+  "version": "0.2.0",
+  "description": "Enhancement suite for DeepSeek Harness — the official installer and registry for Scorp1o117's Vision, Soul/Persona, Memory, Marketplace & Reasoning plugins.",
   "type": "module",
   "license": "MIT",
   "engines": {

package/plugins.json

@@ -1,7 +1,15 @@
 {
   "suite": "dsh-enhancement-suite",
   "node": ">=22.18",
+  "dsh": ">=0.1.0-rc.7",
   "defaultProfile": "web",
+  "rc6Pins": {
+    "dsh-tool-vision": "0.6.1",
+    "dsh-soul-md": "0.5.6",
+    "dsh-tdai-memory": "0.2.11",
+    "dsh-plugin-marketplace": "0.2.6",
+    "dsh-reasoning-options": "none"
+  },
   "plugins": [
     {
       "key": "vision",
@@ -42,6 +50,16 @@
       "repo": "https://github.com/Scorp1o117/dsh-plugin-marketplace",
       "description": "直接在 DSH Web UI 中发现和浏览插件。",
       "descriptionEn": "Discover and browse plugins directly inside the DSH Web UI."
+    },
+    {
+      "key": "reasoning",
+      "name": "dsh-reasoning-options",
+      "displayName": "dsh-reasoning-options",
+      "emoji": "🎚️",
+      "category": "Model",
+      "repo": "https://github.com/Scorp1o117/dsh-reasoning-options",
+      "description": "为所有第三方（pi-ai）模型自动添加推理强度选项（off→max 七档，默认 high）。",
+      "descriptionEn": "Auto-adds reasoning-effort levels (off→max, default high) to every pi-ai third-party model."
     }
   ]
 }