dsh-github-copilot 0.4.0-alpha.18 → 0.4.0-alpha.19

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (12) hide show
  1. package/AGENTS.md +6 -5
  2. package/CHANGELOG.md +18 -0
  3. package/CONTRIBUTING.md +1 -1
  4. package/README.md +15 -10
  5. package/README.zh.md +15 -10
  6. package/deployment-baseline.json +33 -7
  7. package/docs/agent-readiness.md +8 -0
  8. package/docs/npm-distribution.md +20 -22
  9. package/docs/session-search-routing.md +1 -1
  10. package/lib/index.js +5 -4
  11. package/lib/types/compatibility.d.ts +3 -3
  12. package/package.json +19 -17
package/AGENTS.md CHANGED
@@ -29,7 +29,7 @@ Use native DSH tools for goals, background jobs and scoped subagents. Use local
29
29
 
30
30
  ## Product and architecture
31
31
 
32
- `dsh-github-copilot` is a companion to official DSH `0.1.5-rc.2`, DSH `0.1.5-rc.1`, DSH `0.1.5-alpha.2`, DSH `0.1.5-alpha.1`, DSH `0.1.3-alpha.1`, DSH `0.1.2-rc.1`, and the controlled DSH Desktop `0.1.1-rc.2` Core baseline. It does not own a general Copilot chat adapter. DSH's built-in `llm-pi-ai` mount owns the GitHub Copilot provider, catalog, OAuth method and grant format, token exchange, refresh, and normal model transport.
32
+ `dsh-github-copilot` is a companion to official DSH `0.1.6-alpha.1`, DSH `0.1.5-rc.2`, DSH `0.1.5-rc.1`, DSH `0.1.5-alpha.2`, DSH `0.1.5-alpha.1`, DSH `0.1.3-alpha.1`, DSH `0.1.2-rc.1`, and the controlled DSH Desktop `0.1.1-rc.2` Core baseline. It does not own a general Copilot chat adapter. DSH's built-in `llm-pi-ai` mount owns the GitHub Copilot provider, catalog, OAuth method and grant format, token exchange, refresh, and normal model transport.
33
33
 
34
34
  This repository owns eight narrow surfaces:
35
35
 
@@ -113,12 +113,13 @@ The supported upstream baselines are:
113
113
  - Official tag `dsh-v0.1.5-alpha.2`, commit `b2e3b2a0125854567a4a5fcba75782e42fe84901`.
114
114
  - Official tag `dsh-v0.1.5-rc.1`, commit `183f08e9c6dde7e36cd2318eaee70b0da08fb35e`.
115
115
  - Official tag `dsh-v0.1.5-rc.2`, commit `fb2c4b9e698e30edb738bca4cf0618587db7d203`.
116
+ - Official tag `dsh-v0.1.6-alpha.1`, commit `0a15e36e7f82b6ed45af6fa9759f29b40dcd965d`.
116
117
 
117
- The current target is official `0.1.5-alpha.2`; retain all six earlier pins and exact `0.1.2-rc.1` development dependencies. All five tagged-source targets use unchanged tagged-source runtime fixtures, not standalone npm-artifact certification. Compatibility metadata and synthetic tests do not prove live endpoints, installed Desktop bytes, release publication or loaded runtime state. Public Host, Client and Remote seams remain available; this baseline update does not authorize implementation rewrites.
118
+ The current target is official `0.1.6-alpha.1`; retain all seven earlier pins and exact `0.1.2-rc.1` development dependencies. All six tagged-source targets use unchanged tagged-source runtime fixtures, not standalone npm-artifact certification. The 0.1.6 fixture must await serialized `agent/created`, avoid new synchronous Session-history reads, and verify MCP resource cursors, PTC/workflow names, cancellable Sandbox/Shell preparation, optional-plugin startup policy, attachment cache separation, durable `IMAGE_OFFLOAD_REQUIRED` projection/retry and Team pagination without taking ownership of those services. Compatibility metadata and synthetic tests do not prove live endpoints, installed Desktop bytes, release publication or loaded runtime state. Public Host, Client and Remote seams remain available; this baseline update does not authorize implementation rewrites.
118
119
 
119
120
  These pins document compatibility evidence. They do not authorize creating another controlled Core patch or making one a prerequisite for new plugin fixes.
120
121
 
121
- - Models UI: `0.1.2-rc.1`, `0.1.3-alpha.1`, `0.1.5-alpha.1`, `0.1.5-alpha.2`, `0.1.5-rc.1` and `0.1.5-rc.2` use `settings.models.provider-card`, keyed by settings namespace `llm-pi-ai`, to embed login/status/Refresh/Manage in a mounted configured canonical `github-copilot` row and suppress the separate footer controller. With no such row mounted, retain footer fallback; rc.2 uses a dedicated `settings.section`. Preserve the shared account-state owner across transfer only while another eligible surface remains mounted. Unmounting the last surface or replacing declarations without overlapping mounts stops polling; a later controller reads status and separately non-forcing ensures missing/idle/stale/error/loading signed-in metadata, without replaying the old forced-login action. Manual Refresh models lives inside Manage; errors expose Retry. Opening Models is no longer guaranteed network-free, but status/details themselves remain pure. This additive slot cannot replace Core Edit/Delete: retain the native editor, while normal plugin discovery needs no manual model definitions. UI integration must not merge/remove actual canonical and `github-copilot-preview` routes or rewrite credentials, configuration, history or selection.
122
+ - Models UI: `0.1.2-rc.1`, `0.1.3-alpha.1`, `0.1.5-alpha.1`, `0.1.5-alpha.2`, `0.1.5-rc.1`, `0.1.5-rc.2` and `0.1.6-alpha.1` use `settings.models.provider-card`, keyed by settings namespace `llm-pi-ai`, to embed login/status/Refresh/Manage in a mounted configured canonical `github-copilot` row and suppress the separate footer controller. With no such row mounted, retain footer fallback; rc.2 uses a dedicated `settings.section`. Preserve the shared account-state owner across transfer only while another eligible surface remains mounted. Unmounting the last surface or replacing declarations without overlapping mounts stops polling; a later controller reads status and separately non-forcing ensures missing/idle/stale/error/loading signed-in metadata, without replaying the old forced-login action. Manual Refresh models lives inside Manage; errors expose Retry. Opening Models is no longer guaranteed network-free, but status/details themselves remain pure. This additive slot cannot replace Core Edit/Delete: retain the native editor, while normal plugin discovery needs no manual model definitions. UI integration must not merge/remove actual canonical and `github-copilot-preview` routes or rewrite credentials, configuration, history or selection.
122
123
  - Authorization flow key: `llm-pi-ai/github-copilot`.
123
124
  - Authorization service: rc.1 Core provides it; the rc.2 web/headless profiles rely on this package's runtime dependency and conditional bootstrap.
124
125
  - Credentials: use record description/read/modify/delete APIs on the Host. Never read records in the browser.
@@ -143,7 +144,7 @@ When upgrading DSH or pi-ai, inspect the exact tagged public exports and update
143
144
 
144
145
  ## Distribution and release invariants
145
146
 
146
- - GitHub Releases and npm are the default distribution channels for every new version. This supersedes the Release-only decision in #43 at the user's request. Publish the same verified original tarball to both; never repack an existing release or silently skip npm. First package bootstrap and OIDC setup require an authorized maintainer; see [npm distribution](./docs/npm-distribution.md). Never bypass organizational registry restrictions.
147
+ - GitHub Releases and npm are the default distribution channels for every new version. This supersedes the Release-only decision in #43 at the user's request. Publish the same verified original tarball to both; never repack an existing release or silently skip npm. The initial package bootstrap is complete; subsequent publication requires the configured OIDC Trusted Publisher. Registry readback may lag a successful write, so uncertain outcomes must reconcile exact existing bytes after visibility converges and must never trigger an automatic republish. See [npm distribution](./docs/npm-distribution.md). Never bypass organizational registry restrictions.
147
148
  - User-facing install commands must include the required DSH `--profile` option and derive the versioned Release URL from `package.json`.
148
149
  - Package version, deployment-baseline version, README URLs, and the annotated `v<version>` tag must agree.
149
150
  - New versions use standard SemVer prerelease identifiers (`alpha`, `beta`, `rc`); do not add owner/user names to new version strings.
@@ -185,7 +186,7 @@ Then run `pnpm verify:tarball -- artifacts/dsh-github-copilot-<package-version>.
185
186
 
186
187
  `pnpm verify` checks the Agent contract, source and local test types, baseline markers, a clean build, Vitest tests, Node tooling tests, and real built Host import/Client-loader/Remote smoke. `tests/fixtures` are intentionally excluded from local test typecheck because they import source from a separate pinned Core checkout. The checked-in code must pass; never suppress compiler errors or weaken a test to get a green report.
187
188
 
188
- CI runs on Windows/Linux against all seven exact Core baselines, with unchanged tagged-source runtime checks for `0.1.3-alpha.1`, `0.1.5-alpha.1`, `0.1.5-alpha.2`, `0.1.5-rc.1` and `0.1.5-rc.2`. Optional native Chat fixtures also cover all five tagged-source targets and `0.1.2-rc.1`. `verify:upstream` is static seam-marker evidence. `verify:controlled-core` exclusively installs a temporary config fixture, refuses an existing target, and removes only its own file; it is not full plugin activation. The published rc.2 adapter test covers model materialization, not live provider transport. The release job must wait for the complete reusable CI matrix on the tagged revision, then verify its own packed bytes before publishing.
189
+ CI runs on Windows/Linux against all eight exact Core baselines, with unchanged tagged-source runtime checks for `0.1.3-alpha.1`, `0.1.5-alpha.1`, `0.1.5-alpha.2`, `0.1.5-rc.1`, `0.1.5-rc.2` and `0.1.6-alpha.1`. Optional native Chat fixtures also cover all six tagged-source targets and `0.1.2-rc.1`. `verify:upstream` is static seam-marker evidence. `verify:controlled-core` exclusively installs a temporary config fixture, refuses an existing target, and removes only its own file; it is not full plugin activation. The published rc.2 adapter test covers model materialization, not live provider transport. The release job must wait for the complete reusable CI matrix on the tagged revision, then verify its own packed bytes before publishing.
189
190
 
190
191
  ### Evidence and side effects
191
192
 
package/CHANGELOG.md ADDED
@@ -0,0 +1,18 @@
1
+ # Changelog
2
+
3
+ ## 0.4.0-alpha.19
4
+
5
+ - Adapt the plugin compatibility contract to DSH `0.1.6-alpha.1` at
6
+ `0a15e36e7f82b6ed45af6fa9759f29b40dcd965d`.
7
+ - Exercise awaited, serialized `agent/created` initialization before reading
8
+ live Session state in the unchanged tagged-source fixture.
9
+ - Verify the 0.1.6 Session projection/history boundary, MCP v2 resource
10
+ pagination, PTC runtime and `workflow-ptc` names, cancellable Sandbox/Shell
11
+ preparation, optional-plugin startup policy, attachment cache separation,
12
+ and Team task pagination without taking ownership of those Core services.
13
+ - Follow the 0.1.6 image-budget contract: preserve `IMAGE_OFFLOAD_REQUIRED`,
14
+ apply the Core durable `image/offload` projection, and prove the retried
15
+ Copilot request uses the mapped read-only normalized path without image bytes.
16
+ - Preserve provider-scoped Copilot tool-schema filtering and the existing
17
+ immutable GitHub Release plus npm OIDC distribution design. This version is
18
+ prepared for a Draft compatibility PR only; it is not published by this change.
package/CONTRIBUTING.md CHANGED
@@ -29,7 +29,7 @@ Core inspection is read-only. Isolated tests may use unchanged pinned Core artif
29
29
  Validate the resulting exact path with `pnpm verify:tarball -- artifacts/dsh-github-copilot-<package-version>.tgz`. The release task plan supplies that path automatically. Never run broad cleanup on an existing artifacts directory just to package again.
30
30
  6. Inspect the complete diff, compare expected versus actual results, and report what was NOT checked. Source markers, stubbed unit tests, built module imports, upstream config fixtures, authenticated API calls, installation, and loaded UI are different evidence layers.
31
31
  7. Commit with the issue reference and accurate attribution. For work assisted by DSH use `Assisted-by: DeepSeek Harness (DSH)`. Other agents must name the actual tool; do not infer authorship from the model vendor or copy a bot identity. Add `Co-authored-by` only for real verified collaborators. No fabricated email, author replacement or published-history rewrite.
32
- 8. Push the feature branch and open a PR containing `Fixes #<issue>`, verification, risks and rollback. Merge only with explicit approval and after all Windows/Linux x controlled-rc.2/rc.1/0.1.3-alpha.1/0.1.5-alpha.1/0.1.5-alpha.2/0.1.5-rc.1/0.1.5-rc.2 CI jobs pass.
32
+ 8. Push the feature branch and open a PR containing `Fixes #<issue>`, verification, risks and rollback. Merge only with explicit approval and after all Windows/Linux x controlled-rc.2/rc.1/0.1.3-alpha.1/0.1.5-alpha.1/0.1.5-alpha.2/0.1.5-rc.1/0.1.5-rc.2/0.1.6-alpha.1 CI jobs pass.
33
33
 
34
34
  Generated `lib/` output, archives, `.env`, tokens, local credentials, machine state and production screenshots with real authorization codes must not be committed. Use synthetic fixtures for screenshots and report staged UI honestly.
35
35
 
package/README.md CHANGED
@@ -17,11 +17,12 @@ A focused DSH companion for GitHub Copilot sign-in, account-aware model profiles
17
17
  | DSH `0.1.2-rc.1` | Tag commit [`a66e470`](https://github.com/deepseek-ai/deepseek-harness/commit/a66e4702047846cdaa10c66c9d3df3951f5ea70d) | **Settings → Models** provider card |
18
18
  | DSH `0.1.3-alpha.1` | Tag commit [`d347e70`](https://github.com/deepseek-ai/deepseek-harness/commit/d347e703908d0406b7a7ef80e3a0e594d86b2215) | **Settings → Models** provider card |
19
19
  | Official DSH `0.1.5-alpha.1` | Tag commit [`5dda764`](https://github.com/deepseek-ai/deepseek-harness/commit/5dda764ed3aa172535a7967b06ff95d9cbfe536a) | **Settings → Models** provider card |
20
- | Official DSH `0.1.5-alpha.2` (current target) | Tag commit [`b2e3b2a`](https://github.com/deepseek-ai/deepseek-harness/commit/b2e3b2a0125854567a4a5fcba75782e42fe84901) | **Settings → Models** provider card |
20
+ | Official DSH `0.1.5-alpha.2` | Tag commit [`b2e3b2a`](https://github.com/deepseek-ai/deepseek-harness/commit/b2e3b2a0125854567a4a5fcba75782e42fe84901) | **Settings → Models** provider card |
21
21
  | Official DSH `0.1.5-rc.1` | Tag commit [`183f08e`](https://github.com/deepseek-ai/deepseek-harness/commit/183f08e9c6dde7e36cd2318eaee70b0da08fb35e) | **Settings → Models** provider card |
22
22
  | Official DSH `0.1.5-rc.2` | Tag commit [`fb2c4b9`](https://github.com/deepseek-ai/deepseek-harness/commit/fb2c4b9e698e30edb738bca4cf0618587db7d203) | **Settings → Models** provider card |
23
+ | Official DSH `0.1.6-alpha.1` (current target) | Tag commit [`0a15e36`](https://github.com/deepseek-ai/deepseek-harness/commit/0a15e36e7f82b6ed45af6fa9759f29b40dcd965d) | **Settings → Models** provider card |
23
24
 
24
- The table retains historical source pins; it does not imply the account-model route has been verified on every baseline. Published-artifact synthetic transport tests use the **rc.1 adapter with pi 0.85.1**; development dependencies remain pinned to `0.1.2-rc.1`. The controlled rc.2 pin is historical regression evidence only. DSH `0.1.3-alpha.1`, official `0.1.5-alpha.1`, `0.1.5-alpha.2`, `0.1.5-rc.1` and `0.1.5-rc.2` are unchanged tagged-source targets: CI exercises each through an isolated test resolver, without building or patching Core. These source-runtime checks must pass before claiming their compatibility; they do not establish standalone npm-artifact, live endpoint, installed Desktop or loaded-runtime proof. The `0.1.3-alpha.1` standalone npm artifacts were not published; no standalone-artifact claim is made for the new target. Existing public Host, Client and Remote seams are retained, so this certification does not rewrite those implementations. Stock Core model-entry `api` support is not a prerequisite for the plugin-owned route. Package peer ranges are admission constraints, not live compatibility proof. No Core patch is installed by this plugin.
25
+ The table retains historical source pins; it does not imply the account-model route has been verified on every baseline. Published-artifact synthetic transport tests use the **rc.1 adapter with pi 0.85.1**; development dependencies remain pinned to `0.1.2-rc.1`. The controlled rc.2 pin is historical regression evidence only. DSH `0.1.3-alpha.1`, official `0.1.5-alpha.1`, `0.1.5-alpha.2`, `0.1.5-rc.1`, `0.1.5-rc.2`, and `0.1.6-alpha.1` are unchanged tagged-source targets: CI exercises each through an isolated test resolver, without building or patching Core. These source-runtime checks must pass before claiming compatibility; they do not establish standalone npm-artifact, live endpoint, installed Desktop, or loaded-runtime proof. Existing public Host, Client, and Remote seams are retained. Stock Core model-entry `api` support is not a prerequisite for the plugin-owned route. Package peer and `engines.dsh` ranges are admission declarations, not live compatibility proof. No Core patch is installed by this plugin.
25
26
 
26
27
  ### Alpha.11 compatibility correction (#105)
27
28
 
@@ -37,9 +38,13 @@ The first alpha.11 publication attempt stopped before packing: the tagged Sessio
37
38
 
38
39
  The bundle routes search through a plugin-owned Models-page policy: `auto` prefers eligible native Copilot search and otherwise uses the configured default provider; `fixed` always uses that provider. A separately selected account model lets Volcengine and other non-Copilot chat Sessions use Copilot hosted search. The implementation uses public web-service composition without Core or preset edits. Source and synthetic tests are not proof of live Copilot search, release publication or local activation; see [routing evidence](docs/session-search-routing.md).
39
40
 
41
+ ### Alpha.19 DSH 0.1.6 compatibility adaptation (#125)
42
+
43
+ The exact `dsh-v0.1.6-alpha.1` source fixture now awaits serialized `agent/created` initialization before reading live Session projections. Static and runtime gates also verify the retained request-header/projection path instead of adding synchronous history reads; MCP SDK v2 resource cursors; the `dsh-ptc-runtime` and `dsh-workflow-ptc` contracts; empty model environment for isolated Node PTC; asynchronous cancellable Sandbox/Shell preparation; consumer-owned optional-plugin startup failures; attachment request caches under DSH cache while normalized attachment paths remain stable; and provider-owned Team task pagination. For image-budget recovery, the adapter's first `IMAGE_OFFLOAD_REQUIRED` result remains an error; the fixture records the Core `image/offload` projection and proves the retried Copilot request sends the mapped read-only normalized path as placeholder text without image bytes. The plugin does not import or own MCP, PTC, Workflow, Sandbox, Shell, or Team services. Upstream exposes no generic `HostGrant`/`hostGrants` API in this tag, and the plugin registers no such coupling. Copilot schema compatibility continues to remove unsupported escalation controls from `pwsh`, filesystem, and `run_code` schemas while preserving Team pagination fields. This compatibility version is prepared as a Draft and is not a release claim.
44
+
40
45
  ## Install and sign in
41
46
 
42
- The commands below target the package version `0.4.0-alpha.18`. Versioned URLs describe the intended release artifacts, not proof that publication or local activation has completed; use them only once that Release and its checksums are available. Install into the profile you use (replace `web` when targeting another profile):
47
+ The commands below target the package version `0.4.0-alpha.19`. Versioned URLs describe the intended release artifacts, not proof that publication or local activation has completed; use them only once that Release and its checksums are available. Install into the profile you use (replace `web` when targeting another profile):
43
48
 
44
49
  Before installing/updating, unpack the **checksum-verified** archive into a temporary directory and run its read-only composition preflight (replace all paths with absolute paths for the intended profile):
45
50
 
@@ -50,7 +55,7 @@ node package/scripts/check-search-composition.mjs --profile-dir /absolute/profil
50
55
  Include any launcher patch files with repeated `--patch /absolute/file` arguments. Require `supported: true`; otherwise do not install the routing bundle. The preflight rejects custom, disabled, nested or already-isolated web-service layouts and reserved routing collisions before any mutation. It parses through public Core APIs and never boots plugins, resolves credentials or rewrites configuration. **`dsh plugin add` does not automatically run this preflight.** It is a required installer/operator step, not a universal compatibility guarantee.
51
56
 
52
57
  ```sh
53
- dsh plugin --profile web add https://github.com/cloga/dsh-github-copilot/releases/download/v0.4.0-alpha.18/dsh-github-copilot-0.4.0-alpha.18.tgz
58
+ dsh plugin --profile web add https://github.com/cloga/dsh-github-copilot/releases/download/v0.4.0-alpha.19/dsh-github-copilot-0.4.0-alpha.19.tgz
54
59
  ```
55
60
 
56
61
  Then open the Models UI listed above, find **GitHub Copilot**, select **Sign in**, and complete the GitHub device-code flow. Plugin installation changes the selected profile; activation follows that profile's normal reload/restart policy.
@@ -113,7 +118,7 @@ Agents should treat the browser authorization as a human handoff, not as a token
113
118
  5. Confirm **Signed in** and inspect the automatic discovery result before asking the user to choose a model. Already-signed-in Models opening ensures missing/stale metadata automatically; fresh ready cache makes no request. Use visible **Retry** for errors or **Manage → Refresh models** for an intentional forced update, not routine setup. Status alone does not discover, and login, metadata and successful model calls remain separate evidence.
114
119
  6. Use **Sign out** only when the user explicitly asks to disconnect the account. It deletes the Copilot credential record but preserves route settings.
115
120
 
116
- GitHub Releases and npm are the default distribution channels for each new version, using the same verified tarball. Pin the version and verify the Release `SHA256SUMS` and npm `dist.integrity`; package preparation is not proof of publication. After npm publication is verified, the official Desktop package manager can use `dsh-github-copilot@0.4.0-alpha.18` rather than a URL or file. The required search-composition preflight below still applies before installation; do not use the CLI to modify a Desktop-managed profile. See [npm distribution and first-package prerequisites](./docs/npm-distribution.md).
121
+ GitHub Releases and npm are the default distribution channels for each new version, using the same verified tarball. Pin the version and verify the Release `SHA256SUMS` and npm `dist.integrity`; package preparation is not proof of publication. After npm publication is verified, the official Desktop package manager can use `dsh-github-copilot@0.4.0-alpha.19` rather than a URL or file. The required search-composition preflight below still applies before installation; do not use the CLI to modify a Desktop-managed profile. See [npm distribution and first-package prerequisites](./docs/npm-distribution.md).
117
122
 
118
123
  No `copilot2api` process, external gateway, placeholder API key, pasted GitHub token, or separate `dsh-web-search-provider` installation is required.
119
124
 
@@ -315,9 +320,9 @@ pnpm verify
315
320
  pnpm pack --pack-destination artifacts
316
321
  ```
317
322
 
318
- Use Node 24 LTS for development and the pinned pnpm version; runtime dependencies require Node >=22.19.0. `pnpm verify` runs the Agent contract check, source and local test typechecking, baseline markers, clean build, Vitest and Node tooling tests, and a real built Host import plus Client/Remote smoke. After packing, run `pnpm verify:tarball -- artifacts/dsh-github-copilot-<package-version>.tgz` to verify archive exports, media, allowed contents and equality to that build. CI checks all seven exact Core sources/config fixtures on Windows and Linux: controlled `0.1.1-rc.2`, `0.1.2-rc.1`, `0.1.3-alpha.1`, official `0.1.5-alpha.1`, `0.1.5-alpha.2`, `0.1.5-rc.1` and `0.1.5-rc.2`. The five tagged-source targets also run unchanged tagged-source runtime fixtures; release publication depends on that full matrix.
323
+ Use Node 24 LTS for development and the pinned pnpm version; runtime dependencies require Node >=22.19.0. `pnpm verify` runs the Agent contract check, source and local test typechecking, baseline markers, clean build, Vitest and Node tooling tests, and a real built Host import plus Client/Remote smoke. After packing, run `pnpm verify:tarball -- artifacts/dsh-github-copilot-<package-version>.tgz` to verify archive exports, media, allowed contents and equality to that build. CI checks all eight exact Core sources/config fixtures on Windows and Linux: controlled `0.1.1-rc.2`, `0.1.2-rc.1`, `0.1.3-alpha.1`, official `0.1.5-alpha.1`, `0.1.5-alpha.2`, `0.1.5-rc.1`, `0.1.5-rc.2`, and `0.1.6-alpha.1`. The six tagged-source targets also run unchanged tagged-source runtime fixtures; release publication depends on that full matrix.
319
324
 
320
- For the optional reasoning UI integration, `pnpm verify:reasoning-ui -- <Core checkout>` runs a synthetic native-renderer, Slot registry and history-assembly fixture against a clean pinned `0.1.2-rc.1`, `0.1.3-alpha.1`, `0.1.5-alpha.1`, `0.1.5-alpha.2`, `0.1.5-rc.1` or `0.1.5-rc.2` checkout with its Chat dependencies installed. It exclusively creates one temporary test file and removes it only if unchanged. This is local integration/static-render evidence, not a live browser or Copilot API test; CI runs it on all six supported Chat baselines.
325
+ For the optional reasoning UI integration, `pnpm verify:reasoning-ui -- <Core checkout>` runs a synthetic native-renderer, Slot registry and history-assembly fixture against a clean pinned `0.1.2-rc.1`, `0.1.3-alpha.1`, `0.1.5-alpha.1`, `0.1.5-alpha.2`, `0.1.5-rc.1`, `0.1.5-rc.2`, or `0.1.6-alpha.1` checkout with its Chat dependencies installed. It exclusively creates one temporary test file and removes it only if unchanged. This is local integration/static-render evidence, not a live browser or Copilot API test; CI runs it on all seven supported Chat baselines.
321
326
 
322
327
  ### Agent-driven development
323
328
 
@@ -349,8 +354,8 @@ Report the published Release URL, version, tag/commit and verified asset SHA-256
349
354
  `package.json` declares public npm distribution. A release tag must equal `v${package.json.version}`. Versions use standard SemVer prerelease labels (`alpha`, `beta`, or `rc`), each with its matching npm dist-tag; only stable versions use `latest`. The Release workflow performs the frozen install and complete verification gate, packs once (or recovers the original archive on retry), verifies `SHA256SUMS`, publishes the immutable GitHub Release and then publishes those same bytes to npm through OIDC. Either channel failing means delivery is incomplete. First package creation needs an authorized maintainer; staging requires an existing package and is not a first-package bootstrap. Historical releases are not republished.
350
355
 
351
356
  ```sh
352
- curl -LO https://github.com/cloga/dsh-github-copilot/releases/download/v0.4.0-alpha.18/dsh-github-copilot-0.4.0-alpha.18.tgz
353
- curl -LO https://github.com/cloga/dsh-github-copilot/releases/download/v0.4.0-alpha.18/SHA256SUMS
357
+ curl -LO https://github.com/cloga/dsh-github-copilot/releases/download/v0.4.0-alpha.19/dsh-github-copilot-0.4.0-alpha.19.tgz
358
+ curl -LO https://github.com/cloga/dsh-github-copilot/releases/download/v0.4.0-alpha.19/SHA256SUMS
354
359
  sha256sum --check SHA256SUMS
355
360
  ```
356
361
 
@@ -358,7 +363,7 @@ PowerShell can verify the same two downloaded files with:
358
363
 
359
364
  ```powershell
360
365
  $expected = (Get-Content .\SHA256SUMS).Split()[0]
361
- $actual = (Get-FileHash .\dsh-github-copilot-0.4.0-alpha.18.tgz -Algorithm SHA256).Hash.ToLowerInvariant()
366
+ $actual = (Get-FileHash .\dsh-github-copilot-0.4.0-alpha.19.tgz -Algorithm SHA256).Hash.ToLowerInvariant()
362
367
  if ($actual -cne $expected) { throw 'Release checksum mismatch' }
363
368
  ```
364
369
 
package/README.zh.md CHANGED
@@ -9,7 +9,7 @@
9
9
 
10
10
  一个聚焦 GitHub Copilot 登录、通用账号模型发现、Copilot 专用 Tool 兼容与供应方托管搜索的 DSH companion。插件根据供应方返回的端点和能力元数据组装模型，复用公开的 `@deepseek-ai/dsh-llm-pi-ai` adapter 与 pi-ai SDK，不另写一套通用传输／序列化器，也不维护需要逐个添加新模型 ID 的静态目录。
11
11
 
12
- > 下文自动维护账号模型元数据与 provider 集成控件描述目标版本 `0.4.0-alpha.18`；这不代表已有的两条真实路由被合并或移除。版本化 URL 不表示 Release 已发布或本机已加载；仅在该 Release 与校验和可用后使用安装命令。源码、发布制品、已安装版本和实际加载运行时需分别确认，本地升级和中断会话的重启仍需用户批准。
12
+ > 下文自动维护账号模型元数据与 provider 集成控件描述目标版本 `0.4.0-alpha.19`；这不代表已有的两条真实路由被合并或移除。版本化 URL 不表示 Release 已发布或本机已加载；仅在该 Release 与校验和可用后使用安装命令。源码、发布制品、已安装版本和实际加载运行时需分别确认，本地升级和中断会话的重启仍需用户批准。
13
13
 
14
14
  ## 已测试基线
15
15
 
@@ -19,11 +19,12 @@
19
19
  | DSH `0.1.2-rc.1` | Tag commit [`a66e470`](https://github.com/deepseek-ai/deepseek-harness/commit/a66e4702047846cdaa10c66c9d3df3951f5ea70d) | **Settings → Models** provider card |
20
20
  | DSH `0.1.3-alpha.1` | Tag commit [`d347e70`](https://github.com/deepseek-ai/deepseek-harness/commit/d347e703908d0406b7a7ef80e3a0e594d86b2215) | **Settings → Models** provider card |
21
21
  | 官方 DSH `0.1.5-alpha.1` | Tag commit [`5dda764`](https://github.com/deepseek-ai/deepseek-harness/commit/5dda764ed3aa172535a7967b06ff95d9cbfe536a) | **Settings → Models** provider card |
22
- | 官方 DSH `0.1.5-alpha.2`（当前目标） | Tag commit [`b2e3b2a`](https://github.com/deepseek-ai/deepseek-harness/commit/b2e3b2a0125854567a4a5fcba75782e42fe84901) | **Settings → Models** provider card |
22
+ | 官方 DSH `0.1.5-alpha.2` | Tag commit [`b2e3b2a`](https://github.com/deepseek-ai/deepseek-harness/commit/b2e3b2a0125854567a4a5fcba75782e42fe84901) | **Settings → Models** provider card |
23
23
  | 官方 DSH `0.1.5-rc.1` | Tag commit [`183f08e`](https://github.com/deepseek-ai/deepseek-harness/commit/183f08e9c6dde7e36cd2318eaee70b0da08fb35e) | **Settings → Models** provider card |
24
24
  | 官方 DSH `0.1.5-rc.2` | Tag commit [`fb2c4b9`](https://github.com/deepseek-ai/deepseek-harness/commit/fb2c4b9e698e30edb738bca4cf0618587db7d203) | **Settings → Models** provider card |
25
+ | 官方 DSH `0.1.6-alpha.1`（当前目标） | Tag commit [`0a15e36`](https://github.com/deepseek-ai/deepseek-harness/commit/0a15e36e7f82b6ed45af6fa9759f29b40dcd965d) | **Settings → Models** provider card |
25
26
 
26
- 上表保留历史源码 pin，不表示账号模型路由在所有基线上都已验收。已发布制品的合成 transport 测试使用 **rc.1 adapter 与 pi `0.85.1`**，开发依赖继续精确固定为 `0.1.2-rc.1`；受控 rc.2 仅为历史回归证据。原始 rc.2 tag 不能解析逐模型 `api`，不能用版本号证明混合协议可用；插件通过已发布的 adapter 接口传入经校验的模型数据，不以新增 Core 服务或修改 Core 为前提。`0.1.3-alpha.1`、官方 `0.1.5-alpha.1`、`0.1.5-alpha.2`、`0.1.5-rc.1` 与 `0.1.5-rc.2` 均作为未修改的标签源码目标，由 CI 使用隔离测试解析器运行，不构建或给 Core 打补丁。对应源码运行检查通过前不宣称兼容性已验收；这些检查不是独立 npm 制品、真实端点、已安装 Desktop 或已加载运行时的证明。`0.1.3-alpha.1` 没有发布独立 npm 制品；新目标不作独立制品验收声明。已有公开 Host、Client 与 Remote 接口保留，因此本次认证不重写这些实现。Peer range 只约束包准入，不是真实兼容性证明；插件不安装 Core 补丁。
27
+ 上表保留历史源码 pin，不表示账号模型路由在所有基线上都已验收。已发布制品的合成 transport 测试使用 **rc.1 adapter 与 pi `0.85.1`**，开发依赖继续精确固定为 `0.1.2-rc.1`；受控 rc.2 仅为历史回归证据。`0.1.3-alpha.1`、官方 `0.1.5-alpha.1`、`0.1.5-alpha.2`、`0.1.5-rc.1`、`0.1.5-rc.2` 与 `0.1.6-alpha.1` 均作为未修改的标签源码目标，由 CI 使用隔离测试解析器运行，不构建或给 Core 打补丁。对应源码运行检查通过前不宣称兼容性已验收；这些检查不是独立 npm 制品、真实端点、已安装 Desktop 或已加载运行时的证明。已有公开 Host、Client 与 Remote 接口保留。Peer range 与 `engines.dsh` 只声明包准入，不是真实兼容性证明；插件不安装 Core 补丁。
27
28
 
28
29
  ### Alpha.11 兼容修复（#105）
29
30
 
@@ -39,6 +40,10 @@ Core `0.1.5-alpha.2` 新增必需的 `ResolvedPiAiProviderProfile.modelErrors`
39
40
 
40
41
  bundle 通过插件自有的 Models 页策略分流搜索：`auto` 优先合格的 Copilot 原生搜索，否则使用配置的默认 Provider；`fixed` 始终使用该 Provider。单独选择账号模型后，火山方舟等非 Copilot 聊天会话也能使用 Copilot 托管搜索。全部通过公开 web 服务组合实现，不改 Core 或预设。源码和合成测试不代表真实 Copilot 搜索、已发布或本机已生效；详见[分流验收范围](docs/session-search-routing.md)。
41
42
 
43
+ ### Alpha.19 DSH 0.1.6 兼容适配（#125）
44
+
45
+ 精确固定的 `dsh-v0.1.6-alpha.1` 源码 fixture 现在会等待串行 `agent/created` 初始化完成后，再读取 live Session projection。静态与运行时 gate 同时核对：继续通过 request-header/projection 取状态而不新增同步历史读取；MCP SDK v2 resource cursor；`dsh-ptc-runtime` 与 `dsh-workflow-ptc` 名称；隔离 Node PTC 的空模型环境；异步可取消的 Sandbox/Shell 准备；由应用消费者决定的可选插件启动失败；请求图片缓存移入 DSH cache 但 normalized attachment 路径保持独立；以及 Team task 的 provider-owned 分页。图片预算恢复不会把首个 `IMAGE_OFFLOAD_REQUIRED` 当作成功；fixture 会记录 Core `image/offload` projection，并证明重试后的 Copilot 请求仅发送带映射只读 normalized 路径的占位文本，不再发送图片字节。插件不导入或接管 MCP、PTC、Workflow、Sandbox、Shell、Team 服务。该 tag 没有通用 `HostGrant`／`hostGrants` API，插件也不注册此类耦合。Copilot tool schema 过滤继续移除 `pwsh`、文件与 `run_code` 的不可用提权参数，同时保留 Team 分页字段。本版本仅准备 Draft 兼容 PR，不表示已发布。
46
+
42
47
  ## 安装与登录
43
48
 
44
49
  将当前 release 安装到你实际使用的 profile（其它 profile 请替换 `web`）：
@@ -52,7 +57,7 @@ node package/scripts/check-search-composition.mjs --profile-dir /absolute/profil
52
57
  若启动时还有额外 patch，用重复的 `--patch /absolute/file` 参数一并提供。必须得到 `supported: true` 才继续安装；自定义、已禁用、嵌套、已有隔离映射的 web 服务或路由保留名称冲突会在修改前拒绝。预检只用 Core 公开解析接口，不启动插件、不读取认证凭据、不改配置。**`dsh plugin add` 不会自动执行这项预检**；这是安装者必做步骤，不是对任意第三方组合的兼容保证。
53
58
 
54
59
  ```sh
55
- dsh plugin --profile web add https://github.com/cloga/dsh-github-copilot/releases/download/v0.4.0-alpha.18/dsh-github-copilot-0.4.0-alpha.18.tgz
60
+ dsh plugin --profile web add https://github.com/cloga/dsh-github-copilot/releases/download/v0.4.0-alpha.19/dsh-github-copilot-0.4.0-alpha.19.tgz
56
61
  ```
57
62
 
58
63
  随后打开上表对应的 Models UI，找到 **GitHub Copilot**，点击 **Sign in** 并完成 GitHub device-code 流程。安装会修改指定 profile；是否立即激活取决于该 profile 的常规 reload/restart 策略。
@@ -115,7 +120,7 @@ Agent 应把浏览器授权视为需要用户完成的 handoff，而不是自行
115
120
  5. 确认 **Signed in** 并检查自动发现结果，再请用户选择模型。已登录时打开 Models 会自动确保缺失／过期元数据，新鲜 ready 缓存不发请求。错误可使用 **Retry**，有意强制更新时使用 **Manage → Refresh models**，不作为常规设置步骤。状态读取本身不发现；登录、元数据与真实调用成功是独立证据。
116
121
  6. 只有用户明确要求断开账号时才使用 **Sign out**；它会删除 Copilot credential record，但保留 route settings。
117
122
 
118
- 每个新版本默认同时分发到 GitHub Releases 和 npm，两个渠道使用同一份已验证 tarball。应固定版本并核对 Release 的 `SHA256SUMS` 与 npm 的 `dist.integrity`；准备好包不表示已发布。确认 npm 发布后，官方 Desktop 包管理器使用 `dsh-github-copilot@0.4.0-alpha.18`，不是 URL 或本地文件。安装前仍须完成下述 search-composition 预检；不要使用 CLI 修改 Desktop 管理的 profile。首次建包及后续 OIDC 前置条件见 [npm 分发说明](./docs/npm-distribution.md)。
123
+ 每个新版本默认同时分发到 GitHub Releases 和 npm，两个渠道使用同一份已验证 tarball。应固定版本并核对 Release 的 `SHA256SUMS` 与 npm 的 `dist.integrity`；准备好包不表示已发布。确认 npm 发布后，官方 Desktop 包管理器使用 `dsh-github-copilot@0.4.0-alpha.19`，不是 URL 或本地文件。安装前仍须完成下述 search-composition 预检；不要使用 CLI 修改 Desktop 管理的 profile。首次建包及后续 OIDC 前置条件见 [npm 分发说明](./docs/npm-distribution.md)。
119
124
 
120
125
  不需要运行 `copilot2api`，不需要外部 gateway、placeholder API key、原始 GitHub token 或单独安装 `dsh-web-search-provider`。
121
126
 
@@ -326,9 +331,9 @@ pnpm verify
326
331
  pnpm pack --pack-destination artifacts
327
332
  ```
328
333
 
329
- 开发建议使用 Node 24 LTS 和固定的 pnpm 版本；运行时依赖要求 Node >=22.19.0。`pnpm verify` 检查 Agent contract、源码与本地测试类型、baseline marker、干净构建、Vitest 与 Node 工具测试，以及真实构建 Host 导入和 Client/Remote smoke。打包后执行 `pnpm verify:tarball -- artifacts/dsh-github-copilot-<package-version>.tgz`，检查归档 export、图片、允许的文件以及与本次构建的一致性。CI 在 Windows/Linux 上验证七个精确 Core 源码与配置 fixture：受控 `0.1.1-rc.2`、`0.1.2-rc.1`、`0.1.3-alpha.1`、官方 `0.1.5-alpha.1`、`0.1.5-alpha.2`、`0.1.5-rc.1` 与 `0.1.5-rc.2`；五个标签源码目标还运行未修改的标签源码运行时 fixture。发布必须等待完整矩阵通过。
334
+ 开发建议使用 Node 24 LTS 和固定的 pnpm 版本；运行时依赖要求 Node >=22.19.0。`pnpm verify` 检查 Agent contract、源码与本地测试类型、baseline marker、干净构建、Vitest 与 Node 工具测试，以及真实构建 Host 导入和 Client/Remote smoke。打包后执行 `pnpm verify:tarball -- artifacts/dsh-github-copilot-<package-version>.tgz`，检查归档 export、图片、允许的文件以及与本次构建的一致性。CI 在 Windows/Linux 上验证八个精确 Core 源码与配置 fixture：受控 `0.1.1-rc.2`、`0.1.2-rc.1`、`0.1.3-alpha.1`、官方 `0.1.5-alpha.1`、`0.1.5-alpha.2`、`0.1.5-rc.1`、`0.1.5-rc.2` 与 `0.1.6-alpha.1`；六个标签源码目标还运行未修改的标签源码运行时 fixture。发布必须等待完整矩阵通过。
330
335
 
331
- 对于可选的思考显示集成，`pnpm verify:reasoning-ui -- <Core checkout>` 会在已安装 Chat 依赖的干净、精确 pin 的 `0.1.2-rc.1`、`0.1.3-alpha.1`、`0.1.5-alpha.1`、`0.1.5-alpha.2`、`0.1.5-rc.1` 或 `0.1.5-rc.2` checkout 中，执行合成的原生渲染器、Slot 注册器与历史组装 fixture。它只会独占创建一个临时测试文件，并仅在文件未被修改时清理。这是本地集成／静态渲染证据，不是真实浏览器或 Copilot API 测试；CI 在六个支持该 Chat 接口的基线上运行此项。
336
+ 对于可选的思考显示集成，`pnpm verify:reasoning-ui -- <Core checkout>` 会在已安装 Chat 依赖的干净、精确 pin 的 `0.1.2-rc.1`、`0.1.3-alpha.1`、`0.1.5-alpha.1`、`0.1.5-alpha.2`、`0.1.5-rc.1`、`0.1.5-rc.2` 或 `0.1.6-alpha.1` checkout 中，执行合成的原生渲染器、Slot 注册器与历史组装 fixture。它只会独占创建一个临时测试文件，并仅在文件未被修改时清理。这是本地集成／静态渲染证据，不是真实浏览器或 Copilot API 测试；CI 在七个支持该 Chat 接口的基线上运行此项。
332
337
 
333
338
  ### Agent 驱动开发
334
339
 
@@ -360,8 +365,8 @@ node scripts/agent.mjs attribution "DeepSeek Harness (DSH)"
360
365
  `package.json` 声明公开 npm 分发。Release tag 必须严格等于 `v${package.json.version}`。预发布使用 `alpha`、`beta` 或 `rc` 及对应 npm dist-tag，只有稳定版使用 `latest`。Release workflow 执行 frozen install 和完整门禁，只打包一次（重试恢复原始归档），验证 `SHA256SUMS`，发布不可变 GitHub Release，再通过 OIDC 将同一份字节发布到 npm。任一渠道失败都表示交付未完成。首次建包须由获准环境中的维护者完成；staging 要求包已存在，不能代替首次建包。不会批量补发历史版本。
361
366
 
362
367
  ```sh
363
- curl -LO https://github.com/cloga/dsh-github-copilot/releases/download/v0.4.0-alpha.18/dsh-github-copilot-0.4.0-alpha.18.tgz
364
- curl -LO https://github.com/cloga/dsh-github-copilot/releases/download/v0.4.0-alpha.18/SHA256SUMS
368
+ curl -LO https://github.com/cloga/dsh-github-copilot/releases/download/v0.4.0-alpha.19/dsh-github-copilot-0.4.0-alpha.19.tgz
369
+ curl -LO https://github.com/cloga/dsh-github-copilot/releases/download/v0.4.0-alpha.19/SHA256SUMS
365
370
  sha256sum --check SHA256SUMS
366
371
  ```
367
372
 
@@ -369,7 +374,7 @@ PowerShell 可以对已下载的同一组文件执行：
369
374
 
370
375
  ```powershell
371
376
  $expected = (Get-Content .\SHA256SUMS).Split()[0]
372
- $actual = (Get-FileHash .\dsh-github-copilot-0.4.0-alpha.18.tgz -Algorithm SHA256).Hash.ToLowerInvariant()
377
+ $actual = (Get-FileHash .\dsh-github-copilot-0.4.0-alpha.19.tgz -Algorithm SHA256).Hash.ToLowerInvariant()
373
378
  if ($actual -cne $expected) { throw 'Release checksum mismatch' }
374
379
  ```
375
380
 
package/deployment-baseline.json CHANGED
@@ -8,7 +8,7 @@
8
8
  },
9
9
  "package": {
10
10
  "name": "dsh-github-copilot",
11
- "version": "0.4.0-alpha.18"
11
+ "version": "0.4.0-alpha.19"
12
12
  },
13
13
  "evidence": {
14
14
  "kind": "source-and-synthetic-test-inventory",
@@ -19,11 +19,11 @@
19
19
  "platforms": ["windows", "linux"],
20
20
  "node": ">=22.19.0",
21
21
  "dsh": {
22
- "release": "0.1.5-alpha.2",
23
- "tag": "dsh-v0.1.5-alpha.2",
24
- "commit": "b2e3b2a0125854567a4a5fcba75782e42fe84901",
22
+ "release": "0.1.6-alpha.1",
23
+ "tag": "dsh-v0.1.6-alpha.1",
24
+ "commit": "0a15e36e7f82b6ed45af6fa9759f29b40dcd965d",
25
25
  "developmentRelease": "0.1.2-rc.1",
26
- "peerRange": "0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2",
26
+ "peerRange": "0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.6-alpha.1",
27
27
  "baselines": [
28
28
  {
29
29
  "release": "0.1.1-rc.2",
@@ -119,6 +119,32 @@
119
119
  "managedProviderValidation": "synthetic-tagged-source-runtime",
120
120
  "resolvedProfileDiagnostics": "plugin-owned-empty-modelErrors",
121
121
  "runtimeTests": ["tests/preview-route.spec.ts", "tests/published-core.spec.ts", "tests/single-route.spec.ts", "tests/fixtures/session-context-core.fixture.ts", "tests/fixtures/remote-core.fixture.ts"]
122
+ },
123
+ {
124
+ "release": "0.1.6-alpha.1",
125
+ "tag": "dsh-v0.1.6-alpha.1",
126
+ "commit": "0a15e36e7f82b6ed45af6fa9759f29b40dcd965d",
127
+ "source": "https://github.com/deepseek-ai/deepseek-harness",
128
+ "modelsUi": "provider-card",
129
+ "providerHeaders": "fetch-validated-discovery",
130
+ "strictModeCompat": "route-switch",
131
+ "hostGrants": "no-public-api-no-plugin-coupling",
132
+ "fileContentHelper": "contentHasFile",
133
+ "agentCreation": "awaited-serial-agent-created",
134
+ "sessionHistory": "request-header-and-projections-no-new-sync-history",
135
+ "mcpSdk": "client-v2-tools-and-resource-pagination",
136
+ "ptcRuntime": "dsh-ptc-runtime-and-workflow-ptc",
137
+ "sandboxShell": "async-cancellable-preparation",
138
+ "configHotReload": "serialized-coalesced-last-good-recovery",
139
+ "optionalPlugins": "startup-policy-owned-by-consumer",
140
+ "attachmentCache": "request-variants-under-dsh-cache-normalized-path-stable",
141
+ "imageOffload": "durable-projection-then-retry",
142
+ "teamTools": "spawn-teammate-and-provider-owned-task-pagination",
143
+ "evidenceScope": "unchanged-tagged-source-target",
144
+ "standaloneNpmArtifacts": "not-tested",
145
+ "managedProviderValidation": "synthetic-tagged-source-runtime",
146
+ "resolvedProfileDiagnostics": "plugin-owned-empty-modelErrors",
147
+ "runtimeTests": ["tests/preview-route.spec.ts", "tests/published-core.spec.ts", "tests/single-route.spec.ts", "tests/search-routing.spec.ts", "tests/routed-web.spec.ts", "tests/deepseek-search-fallback.spec.ts", "tests/tool-schema-compat.spec.ts", "tests/fixtures/session-context-core.fixture.ts", "tests/fixtures/remote-core.fixture.ts"]
122
148
  }
123
149
  ],
124
150
  "packages": [
@@ -657,11 +683,11 @@
657
683
  "id": "dsh-supported-baselines-fail-loud-guard",
658
684
  "required": true,
659
685
  "sourceMarkers": [
660
- {"file": "src/compatibility.ts", "marker": "peerRange: '0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2'"}
686
+ {"file": "src/compatibility.ts", "marker": "peerRange: '0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.6-alpha.1'"}
661
687
  ],
662
688
  "tests": [
663
689
  {"file": "tests/compatibility.spec.ts", "name": "retains the original three compatibility baselines"},
664
- {"file": "tests/compatibility.spec.ts", "name": "adds 0.1.5-rc.1 and 0.1.5-rc.2 without dropping earlier baselines or advancing development dependencies"},
690
+ {"file": "tests/compatibility.spec.ts", "name": "adds 0.1.6-alpha.1 without dropping earlier baselines or advancing development dependencies"},
665
691
  {"file": "tests/compatibility.spec.ts", "name": "accepts the supported DSH service contract"},
666
692
  {"file": "tests/compatibility.spec.ts", "name": "fails before startup when a required API is absent"}
667
693
  ]
package/docs/agent-readiness.md CHANGED
@@ -84,6 +84,14 @@ The provider integration introduced in `0.4.0-alpha.5` replaces the older indepe
84
84
  - **In-band system authority:** the broader 0.1.5 audit found newer system-role messages would be demoted by the legacy Anthropic inline serializer. The preflight now delegates any such Anthropic request unchanged to Core before auth/probe/wire; leading and nonleading positions are covered. This deliberately limits inline hosted search, does not rewrite histories, and leaves the legacy Responses inline mapping of system content to user input text unchanged (not filtering). Managed requests always delegate to native transport.
85
85
  - **Evidence boundary:** CI extends the Windows/Linux pinned matrix and release rechecks the current tagged runtime before packing. Local tests use synthetic credentials/network and unchanged Core source fixtures only; no Core implementation changes/build, live install, OAuth, provider calls, Desktop restart or GitHub publication is implied. Consult the task's exact command results for passes/skips; documentation and static markers alone cannot certify runtime or live behavior.
86
86
 
87
+ ## DSH 0.1.6 compatibility adaptation (#125, planned alpha.19)
88
+
89
+ - **Exact target:** add official `dsh-v0.1.6-alpha.1` at `0a15e36e7f82b6ed45af6fa9759f29b40dcd965d`, retaining every earlier source pin and the exact `0.1.2-rc.1` development dependency set. The package also declares the same range in `engines.dsh`; neither declaration proves a loaded runtime.
90
+ - **Agent and Session:** the tagged fixture awaits the 0.1.6 `AgentRegistry.register()` publication boundary and verifies that its asynchronous serial `agent/created` listener has completed before migration evidence reads `agents.list()`, `Session.requestHeader()` and model-selection projections. Production code adds no `eventAt()`, `snapshotEvents()` or `ownEvents()` dependency.
91
+ - **Unowned service audit:** static source markers pin MCP SDK v2 resource list/template cursors, the `@deepseek-ai/dsh-ptc-runtime` and `@deepseek-ai/dsh-workflow-ptc` names, isolated Node PTC's empty model environment, cancellable asynchronous Sandbox/Shell preparation, consumer-owned optional-plugin startup failures, attachment request-cache separation from normalized objects, and Team task cursor/limit behavior. The plugin imports none of those service packages.
92
+ - **Tool and attachment behavior:** provider-scoped Copilot filtering removes unavailable `sandbox_permissions` and `justification` fields from the new `run_code` schema as it already does for shell/filesystem tools, while leaving Team pagination untouched. The managed adapter continues to expose only the normalized attachment object's execution-world path; it does not expose DSH request-version cache paths. When the 0.1.6 adapter returns `IMAGE_OFFLOAD_REQUIRED`, the first call remains failed; the exact tagged fixture applies the public durable `image/offload` projection and proves the retry sends mapped placeholder text without image bytes.
93
+ - **Evidence boundary and blocker:** CI and the release workflow use the unchanged exact tagged source on Windows and Linux. This proves source compatibility and synthetic behavior only. The Draft PR remains blocked on the coordinator's Windows Ops 0.1.5 baseline and must not be merged, installed, or published until explicitly unblocked.
94
+
87
95
  ## Remaining limitations and follow-up acceptance criteria
88
96
 
89
97
  - **Initiator compatibility:** planned alpha.8 derives search from the captured initiating Session's effective request-header/config or explicit `GenerateOptions`, never a global default. Without `agents.currentInitiator`, traditional hosted search reports a named unavailable diagnostic. Explicit marked `GenerateOptions` still supports guarded inline routing, possibly uncached when no owner exists. An OAuth credential notification during initial lazy discovery is indistinguishable from external account change via public status: the first search fails closed with `WEB_PROVIDER_UNAVAILABLE` before probe/wire; a later user/driver request may retry, never automatically. Do not claim seamless first-attempt credential refresh. Verify the initiating-context seam on each pinned Core before extending compatibility claims. Capability/probe and route allowlists still gate search; owner isolation is not unrestricted search support.
package/docs/npm-distribution.md CHANGED
@@ -25,27 +25,24 @@ through the normal reviewed PR path. Version changes include package.json,
25
25
  deployment-baseline.json and both README URLs; `publishConfig.tag` must agree
26
26
  with the channel. Do not silently rename a taken package.
27
27
 
28
- ## First package bootstrap is a maintainer operation
29
-
30
- The normal main pipeline publishes the GitHub Release first, then requires npm
31
- publication. Until bootstrap/trusted publishing is configured, the npm step
32
- fails explicitly and the workflow is **not fully delivered**. This is intentional,
33
- not a successful skipped step. The already published GitHub archive is retained.
34
-
35
- 1. From the verified immutable Release, obtain its original versioned tarball
36
- and `SHA256SUMS`. Verify the annotated tag/commit, Release state, asset digest,
37
- archive contents and SHA-256. Do not repack or edit this archive.
38
- 2. In an approved environment, the authorized maintainer verifies `npm whoami`
39
- is the intended account (`cloga`) and performs the first ordinary
40
- `npm publish <original-release.tgz> --access public --tag alpha --ignore-scripts --registry=https://registry.npmjs.org/`
41
- with interactive 2FA or explicitly authorized legitimate publishing
42
- credentials. `<original-release.tgz>` is the exact downloaded real artifact,
43
- not a directory or placeholder. Do not print, copy or commit credentials, or
44
- weaken 2FA to make this succeed.
45
- 3. Read back the exact npm version and compare `dist.integrity` with the
46
- archive's SHA-512 SRI. Configure trusted publishing, then rerun the failed
47
- CI release job on its original revision. It recovers the same bytes and
48
- verifies the existing npm version without another publish.
28
+ ## Initial package publication is complete
29
+
30
+ The initial `dsh-github-copilot@0.4.0-alpha.18` package was published from the
31
+ immutable `v0.4.0-alpha.18` GitHub Release archive. The public registry version,
32
+ SHA-512 SRI, `alpha` tag, tarball size and SHA-256 were independently verified
33
+ against those original Release bytes. The one-time workflow, token-authenticated
34
+ bootstrap script and their focused tests have therefore been removed. No normal
35
+ release workflow references `NPM_TOKEN`; removing any now-unused repository
36
+ secret remains a separate explicit maintainer operation.
37
+
38
+ The successful publish was not immediately visible to a read performed about
39
+ four seconds later, so that workflow run ended as a failure even though the
40
+ package and tag subsequently converged. Treat this as an uncertain write, not
41
+ permission to publish again. npm registry package metadata and dist-tags are
42
+ eventually consistent: after any successful or uncertain publish command, wait
43
+ for the exact version to become observable, verify `dist.integrity` and the
44
+ non-decreasing channel tag, then rerun the normal pipeline to reconcile
45
+ read-only. Never retry a publish merely because immediate readback is stale.
49
46
 
50
47
  **`npm stage publish` cannot bootstrap a nonexistent package.** The
51
48
  [official npm stage prerequisites](https://docs.npmjs.com/cli/v11/commands/npm-stage/)
@@ -104,7 +101,8 @@ The npm step reads package/version state before writing. Only E404 means
104
101
  absence; auth, TLS, timeout, malformed metadata and registry failures stop
105
102
  delivery. An existing exact version is accepted only with matching SHA-512 SRI
106
103
  and a channel tag at that version or a newer one. Conflicting bytes fail closed.
107
- An uncertain write is not retried in-process; rerun the workflow to reconcile.
104
+ An uncertain write is not retried in-process. Allow registry visibility to
105
+ converge, then rerun the workflow to reconcile the exact existing version.
108
106
  A matching version with an older/missing tag requires maintainer review; the
109
107
  workflow does not silently repair it with separate dist-tag writes.
110
108
 
package/docs/session-search-routing.md CHANGED
@@ -48,6 +48,6 @@ The added regressions cover silent expiry/replacement, native final assertions,
48
48
 
49
49
  1. Complete the full verification gate and update deployment/agent evidence inventories, public export smoke and both READMEs.
50
50
  2. Add end-to-end coverage of the main router's managed metadata, fallback credentials/options, cancellations during discovery/fallback, mixed multi-query provenance, and complete unload/reload behavior.
51
- 3. Run retained exact Core-baseline fixtures, not only the development artifact. Do not infer seven-pin runtime compatibility from type checks.
51
+ 3. Run retained exact Core-baseline fixtures, not only the development artifact. Do not infer eight-pin runtime compatibility from type checks.
52
52
  4. Align the new package version, release metadata and package/archive tests.
53
53
  5. Run bounded live Copilot hosted-search and permitted-fallback acceptance separately. A successful chat request does not prove hosted search. No live profile installation, global search selection change or restart has occurred for this work.
package/lib/index.js CHANGED
@@ -15,7 +15,7 @@ import { Config as Config$1, PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
15
15
  import { buildCopilotDynamicHeaders, hasCopilotVisionInput } from "@earendil-works/pi-ai/api/github-copilot-headers";
16
16
  //#region package.json
17
17
  var name$1 = "dsh-github-copilot";
18
- var version = "0.4.0-alpha.18";
18
+ var version = "0.4.0-alpha.19";
19
19
  //#endregion
20
20
  //#region lib/types/probe.js
21
21
  /**
@@ -1929,9 +1929,9 @@ async function createDeepSeekSearchFallback(ctx, owner, canContinue) {
1929
1929
  * @module dsh-github-copilot/compatibility
1930
1930
  */
1931
1931
  const DSH_COMPATIBILITY = {
1932
- release: "0.1.5-alpha.2",
1932
+ release: "0.1.6-alpha.1",
1933
1933
  developmentRelease: "0.1.2-rc.1",
1934
- peerRange: "0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2",
1934
+ peerRange: "0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.6-alpha.1",
1935
1935
  supportedReleases: [
1936
1936
  "0.1.1-rc.2",
1937
1937
  "0.1.2-rc.1",
@@ -1939,7 +1939,8 @@ const DSH_COMPATIBILITY = {
1939
1939
  "0.1.5-alpha.1",
1940
1940
  "0.1.5-alpha.2",
1941
1941
  "0.1.5-rc.1",
1942
- "0.1.5-rc.2"
1942
+ "0.1.5-rc.2",
1943
+ "0.1.6-alpha.1"
1943
1944
  ],
1944
1945
  requiredApis: [
1945
1946
  "agentDefaultModel.currentSelection",
package/lib/types/compatibility.d.ts CHANGED
@@ -6,10 +6,10 @@
6
6
  */
7
7
  import type { Context } from '@deepseek-ai/cordis';
8
8
  export declare const DSH_COMPATIBILITY: {
9
- readonly release: "0.1.5-alpha.2";
9
+ readonly release: "0.1.6-alpha.1";
10
10
  readonly developmentRelease: "0.1.2-rc.1";
11
- readonly peerRange: "0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2";
12
- readonly supportedReleases: readonly ["0.1.1-rc.2", "0.1.2-rc.1", "0.1.3-alpha.1", "0.1.5-alpha.1", "0.1.5-alpha.2", "0.1.5-rc.1", "0.1.5-rc.2"];
11
+ readonly peerRange: "0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.6-alpha.1";
12
+ readonly supportedReleases: readonly ["0.1.1-rc.2", "0.1.2-rc.1", "0.1.3-alpha.1", "0.1.5-alpha.1", "0.1.5-alpha.2", "0.1.5-rc.1", "0.1.5-rc.2", "0.1.6-alpha.1"];
13
13
  readonly requiredApis: readonly ["agentDefaultModel.currentSelection", "authorization.describe", "authorization.begin", "authorization.cancel", "credentials.describeRecord", "credentials.readRecord", "credentials.listRecords", "credentials.modifyRecord", "credentials.deleteRecord", "settings.get", "settings.describe", "settings.mutate", "settings.installSection", "web.registerSearchProvider", "systemPrompt.section", "context.on", "context.effect", "context.plugin"];
14
14
  };
15
15
  /** Assert every required Core service shape before registering any effects. */
package/package.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "dsh-github-copilot",
3
3
  "description": "DSH companion for GitHub Copilot sign-in, account-aware model profiles, tool compatibility, and provider-hosted search.",
4
- "version": "0.4.0-alpha.18",
4
+ "version": "0.4.0-alpha.19",
5
5
  "publishConfig": {
6
6
  "access": "public",
7
7
  "registry": "https://registry.npmjs.org/",
@@ -44,6 +44,7 @@
44
44
  "lib/types/**/*.d.ts",
45
45
  "README.md",
46
46
  "README.zh.md",
47
+ "CHANGELOG.md",
47
48
  "CONTRIBUTING.md",
48
49
  "SECURITY.md",
49
50
  "AGENTS.md",
@@ -70,25 +71,26 @@
70
71
  ],
71
72
  "license": "MIT",
72
73
  "engines": {
73
- "node": ">=22.19.0"
74
+ "node": ">=22.19.0",
75
+ "dsh": "0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.6-alpha.1"
74
76
  },
75
77
  "peerDependencies": {
76
78
  "@deepseek-ai/cordis": "^4.0.2",
77
- "@deepseek-ai/dsh-agent": "0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2",
78
- "@deepseek-ai/dsh-agent-default-model": "0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2",
79
- "@deepseek-ai/dsh-api-remotes": "0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2",
80
- "@deepseek-ai/dsh-authorization": "0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2",
81
- "@deepseek-ai/dsh-client-ui-renderer": "0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2",
82
- "@deepseek-ai/dsh-client-ui-settings-models": "0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2",
83
- "@deepseek-ai/dsh-client-ui-slots": "0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2",
84
- "@deepseek-ai/dsh-credentials": "0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2",
85
- "@deepseek-ai/dsh-launch-environment": "0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2",
86
- "@deepseek-ai/dsh-llm": "0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2",
87
- "@deepseek-ai/dsh-llm-pi-ai": "0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2",
88
- "@deepseek-ai/dsh-settings": "0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2",
89
- "@deepseek-ai/dsh-typert-protocol": "0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2",
90
- "@deepseek-ai/dsh-web": "0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2",
91
- "@deepseek-ai/dsh-web-search-deepseek": "0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2",
79
+ "@deepseek-ai/dsh-agent": "0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.6-alpha.1",
80
+ "@deepseek-ai/dsh-agent-default-model": "0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.6-alpha.1",
81
+ "@deepseek-ai/dsh-api-remotes": "0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.6-alpha.1",
82
+ "@deepseek-ai/dsh-authorization": "0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.6-alpha.1",
83
+ "@deepseek-ai/dsh-client-ui-renderer": "0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.6-alpha.1",
84
+ "@deepseek-ai/dsh-client-ui-settings-models": "0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.6-alpha.1",
85
+ "@deepseek-ai/dsh-client-ui-slots": "0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.6-alpha.1",
86
+ "@deepseek-ai/dsh-credentials": "0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.6-alpha.1",
87
+ "@deepseek-ai/dsh-launch-environment": "0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.6-alpha.1",
88
+ "@deepseek-ai/dsh-llm": "0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.6-alpha.1",
89
+ "@deepseek-ai/dsh-llm-pi-ai": "0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.6-alpha.1",
90
+ "@deepseek-ai/dsh-settings": "0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.6-alpha.1",
91
+ "@deepseek-ai/dsh-typert-protocol": "0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.6-alpha.1",
92
+ "@deepseek-ai/dsh-web": "0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.6-alpha.1",
93
+ "@deepseek-ai/dsh-web-search-deepseek": "0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2 || 0.1.6-alpha.1",
92
94
  "react": "^18.2.0"
93
95
  },
94
96
  "peerDependenciesMeta": {