dsh-github-copilot 0.4.0-alpha.18

package/lib/types/failure.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Failure classification for the inline wire path. The codes must land in
+ * the harness vocabulary dsh-llm-retry understands (AUTH, RATE_LIMIT,
+ * INVALID_REQUEST, SERVER, TIMEOUT, TRANSPORT, QUOTA,
+ * CONTEXT_WINDOW_EXCEEDED, UNKNOWN) so the standard retry policy applies.
+ * Also owns the finish-chunk constructors the two wires share.
+ * @module dsh-github-copilot/failure
+ */
+import type { LlmFailure, StreamChunk } from '@deepseek-ai/dsh-llm';
+/**
+ * Classify a non-OK HTTP response into the harness failure vocabulary.
+ * @param status - the HTTP status code.
+ * @param retryAfterMs - optional provider-requested delay in milliseconds.
+ * @param requestId - optional provider request id for diagnostics.
+ * @param apiLabel - the API family named in the diagnostic, e.g. `Messages API`.
+ * @returns the failure object for a finish chunk.
+ */
+export declare function classifyHttpStatus(status: number, retryAfterMs?: number, requestId?: string, apiLabel?: string): LlmFailure;
+/**
+ * Parse an HTTP `Retry-After` header value into milliseconds. Only a
+ * non-negative seconds integer is accepted; an HTTP-date or any other value
+ * yields `undefined` rather than a `NaN` delay.
+ * @param retryAfter - the raw header value, or `null` when absent.
+ * @returns the delay in milliseconds, or `undefined`.
+ */
+export declare function parseRetryAfterMs(retryAfter: string | null): number | undefined;
+/**
+ * Classify a transport-level error (fetch throw, timeout, malformed body)
+ * into the harness failure vocabulary.
+ * @param error - the thrown value.
+ * @returns the failure object for a finish chunk.
+ */
+export declare function classifyWireError(error: unknown): LlmFailure;
+/** The finish chunk for any failure; the generator never throws it. */
+export declare function errorFinish(failure: LlmFailure): StreamChunk;
+/** The finish chunk for a caller-aborted request. */
+export declare function abortedFinish(): StreamChunk;
+//# sourceMappingURL=failure.d.ts.map

package/lib/types/http.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Shared HTTP plumbing for the capability probe and the inline wires:
+ * bounded response reading, caller-cancellation races for preflight steps,
+ * and the stable {@link WebError} translations. The patterns mirror the
+ * harness `dsh-web` package family (web-search-deepseek, model discovery) so
+ * every credentialed request rejects redirects before a `Location` target can
+ * be contacted.
+ * @module dsh-github-copilot/http
+ */
+/**
+ * Endpoint replies larger than this are refused. The endpoint is whatever
+ * base URL the configuration named, so the ceiling holds on the bytes
+ * actually read rather than on the length the server claims.
+ */
+export declare const MAX_RESPONSE_BYTES: number;
+/**
+ * Read a response body with a hard byte cap, refusing one that outgrows it.
+ * A declared length is checked first so an honest server is turned away
+ * without transferring anything; the accumulated total is what actually
+ * enforces the bound, because a server that under-declares (or streams) tells
+ * us nothing up front.
+ * @param response - the HTTP response whose body is read to completion.
+ * @param url - the requested URL, named in the refusal message.
+ * @returns the decoded body text.
+ * @throws WebError `WEB_PROVIDER_ERROR` when the body exceeds the cap.
+ */
+export declare function readBounded(response: Response, url: string): Promise<string>;
+/** Whether an error is the fetch/`AbortSignal` abort signal. */
+export declare function isAbortError(error: unknown): boolean;
+/**
+ * Race a same-process asynchronous preflight (credential resolution) against
+ * a cancellation signal. The attached settlement handlers keep observing an
+ * uncooperative operation after the race is lost, so a later rejection cannot
+ * become unhandled.
+ * @param operation - the preflight promise.
+ * @param signal - the cancellation signal (request abort or idle watchdog).
+ * @returns the operation's value, or a rejection once the signal fires.
+ */
+export declare function abortable<T>(operation: Promise<T>, signal: AbortSignal | undefined): Promise<T>;
+/**
+ * Extract a provider error message from an error envelope whose shape varies
+ * by protocol and vendor: `{ error: { message } }`, `{ error: "text" }`, or
+ * `{ message }`. Returns `undefined` when nothing usable is present.
+ * @param body - the parsed non-2xx response body.
+ * @returns the provider message, or `undefined`.
+ */
+export declare function providerErrorMessage(body: unknown): string | undefined;
+//# sourceMappingURL=http.d.ts.map

package/lib/types/index.d.ts

@@ -0,0 +1,39 @@
+/**
+ * The inline web-search plugin: short-circuits agent-loop model calls on
+ * the `llm/stream` waterfall, injecting the server-side `web_search` tool
+ * into the wire request so search executes inside the model's own turn.
+ * The narrow gate keeps every other request on the normal adapter path.
+ * @module dsh-github-copilot
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import type { SettingsNamespace } from '@deepseek-ai/dsh-settings';
+import type { InlineConfig } from './config.ts';
+export { COPILOT_HOSTED_SEARCH_PROVIDER_ID, GITHUB_COPILOT_HOSTED_SEARCH_PROVIDER_ID, } from './traditional-search.ts';
+/** Cordis plugin name used by loader diagnostics. */
+export declare const name = "github-copilot";
+/**
+ * Bootstrap dependency. The integration itself is mounted below only after
+ * every service in {@link integrationInject}, including authorization, is
+ * active.
+ */
+export declare const inject: string[];
+/** Settings namespace carrying this plugin's section. */
+export declare const GITHUB_COPILOT_SETTINGS_NAMESPACE: SettingsNamespace;
+/** Schema of the plugin's settings section, exported for composition consumers. */
+export { Config } from './config.ts';
+export type { InlineConfig } from './config.ts';
+export { NO_DEFAULT_SEARCH_PROVIDER, WEB_SEARCH_ROUTING_SETTINGS_NAMESPACE, WebSearchRoutingConfigSchema, } from './web-search-routing-config.ts';
+export type { WebSearchRoutingConfig } from './web-search-routing-config.ts';
+export { assertDshCompatibility, DSH_COMPATIBILITY } from './compatibility.ts';
+export { GITHUB_COPILOT_CREDENTIAL_KEY, GitHubCopilotAuthorizationController, describeGitHubCopilotProviderProfile, ensureGitHubCopilotProviderProfile, LLM_PI_AI_SETTINGS_NAMESPACE, } from './authorization-controller.ts';
+export type { AuthorizationNoticeView, GitHubCopilotAuthorizationPhase, GitHubCopilotAuthorizationView, GitHubCopilotRouteView, } from './authorization-controller.ts';
+/**
+ * Register the inline short-circuit. The plan (candidates plus probe
+ * verdict) follows the settings section; the listener reads the CURRENT
+ * plan and config per request.
+ * @param ctx - context whose `llm` events and `systemPrompt` receive the
+ *   registrations; both are effect-scoped and unregister on dispose.
+ * @param config - the composition entry config, used as the settings base layer.
+ */
+export declare function apply(ctx: Context, config: InlineConfig): void;
+//# sourceMappingURL=index.d.ts.map

package/lib/types/migration-status.d.ts

@@ -0,0 +1,50 @@
+/** Read-only, synchronous evidence for an independently authorized Ops migration. */
+import type { Context } from '@deepseek-ai/cordis';
+export interface MigrationSelection {
+    readonly provider: string;
+    readonly model: string;
+    readonly reasoningEffort?: string;
+}
+export interface MigrationSession {
+    readonly id: string;
+    readonly status: 'idle' | 'running';
+    readonly effectiveSelection: MigrationSelection | null;
+    readonly selectionSource: 'pending' | 'request-header' | 'default' | 'unknown';
+    /** Latest recorded request config for running Agents, not proof of an in-flight model call. */
+    readonly activeRequestSelection: MigrationSelection | null;
+}
+/** Loaded plugin identity is not Desktop/Core byte attestation. Cold histories are not inspected. */
+export interface GitHubCopilotMigrationStatus {
+    readonly plugin: {
+        readonly name: string;
+        readonly version: string;
+    };
+    readonly protocolVersion: 1;
+    readonly historyScope: 'live-agents-only';
+    readonly observedAt: number;
+    readonly capabilities: {
+        readonly agentsList: boolean;
+        readonly sessionProjections: boolean;
+        readonly settingsCas: boolean;
+        readonly providerRegistry: boolean;
+        readonly defaultSelection: boolean;
+    };
+    readonly complete: {
+        readonly sessions: boolean;
+        readonly defaultSelection: boolean;
+        readonly routes: boolean;
+    };
+    readonly defaultSelection: MigrationSelection | null;
+    readonly sessions: readonly MigrationSession[];
+    readonly routes: {
+        readonly nativeConfigured: boolean | null;
+        readonly nativeRegistered: boolean | null;
+        readonly managedRegistered: boolean | null;
+    };
+}
+/**
+ * Observe only public live leaves in one synchronous stack, without writes or network.
+ * This is not a cross-namespace transaction; callers must recheck immediately before CAS.
+ */
+export declare function migrationStatus(ctx: Context): GitHubCopilotMigrationStatus;
+//# sourceMappingURL=migration-status.d.ts.map

package/lib/types/model-protocol.d.ts

@@ -0,0 +1,31 @@
+import type { Context } from '@deepseek-ai/cordis';
+import type { Api, Model } from '@earendil-works/pi-ai';
+/** Public facts from this plugin's pi-ai dependency, not a claim about another Core copy. */
+export interface CopilotModelFacts {
+    readonly id: string;
+    readonly provider: string;
+    readonly api: string;
+    readonly name: string;
+    readonly baseUrl: string;
+    readonly contextWindow: number;
+    readonly maxTokens: number;
+    readonly input: readonly ('text' | 'image')[];
+    readonly reasoning: boolean;
+    readonly supportsReasoningOff: boolean;
+    readonly reasoningEfforts: Readonly<Record<string, string>>;
+    readonly headers?: Readonly<Record<string, string | null>>;
+}
+export interface CopilotCatalogSnapshot {
+    readonly models: readonly CopilotModelFacts[];
+    /** True only for models whose actual native provider is built by this plugin. */
+    readonly authoritative: boolean;
+}
+/** Project only public leaves and the same pi library's supported wire efforts. */
+export declare function projectModelFacts(model: Model<Api>): CopilotModelFacts;
+/** Stock Core owns its own catalog; local metadata must not retire corrections on its behalf. */
+export declare function readCopilotCatalog(_ctx: Context): CopilotCatalogSnapshot;
+/** The preview uses this exact pi provider instance family, so local model facts are authoritative there. */
+export declare function readPreviewCatalog(): CopilotCatalogSnapshot;
+/** Scope optional preview contributions to this plugin's successfully mounted route service. */
+export declare function isPluginPreviewProvider(ctx: Context, provider: string): boolean;
+//# sourceMappingURL=model-protocol.d.ts.map

package/lib/types/pi-provider-bridge.d.ts

@@ -0,0 +1,22 @@
+import type { Provider, AssistantMessageEventStream } from '@earendil-works/pi-ai';
+import type { ResolvedPiAiProviderProfile } from '@deepseek-ai/dsh-llm-pi-ai';
+export type CoreCompatibleProvider = ResolvedPiAiProviderProfile['piProvider'];
+export type SimpleNativeProvider = Pick<Provider, 'id' | 'name' | 'baseUrl' | 'headers' | 'auth' | 'getModels' | 'filterModels' | 'streamSimple'>;
+type CoreStream = ReturnType<CoreCompatibleProvider['streamSimple']>;
+type PublicCoreStream = Pick<CoreStream, keyof CoreStream>;
+type PublicNativeStream = Pick<AssistantMessageEventStream, keyof AssistantMessageEventStream>;
+type Assert<Condition extends true> = Condition;
+/** Compile-time, bidirectional proof; a future real public event change must fail this gate. */
+export type PiStreamPublicCompatibility = [
+    Assert<PublicNativeStream extends PublicCoreStream ? true : false>,
+    Assert<PublicCoreStream extends PublicNativeStream ? true : false>
+];
+/** Retain the same stream object after proving its public surface; only SDK-private nominal identity differs. */
+export declare function coreEventStream(stream: AssistantMessageEventStream): CoreStream;
+/**
+ * The published Core adapter consumes streamSimple. Do not pretend its older
+ * protocol-specific clients are interchangeable with a newer SDK's clients.
+ */
+export declare function coreProviderView(provider: SimpleNativeProvider): CoreCompatibleProvider;
+export {};
+//# sourceMappingURL=pi-provider-bridge.d.ts.map

package/lib/types/plan.d.ts

@@ -0,0 +1,148 @@
+/**
+ * Search-plan resolution: which protocol and endpoint native search runs
+ * through. The initiating Agent's captured chat route (selection plus the
+ * `llm-pi-ai` settings section) is detected and probed — its own protocol
+ * when that can search. The {@link SearchPlan} class owns the probe lifecycle so
+ * `available()` stays synchronous while the verdict lands in the background.
+ * @module dsh-github-copilot/plan
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import type { ProbeOutcome } from './probe.ts';
+import type { CurrentChatRoute } from './current-provider.ts';
+/** The two search-capable wire protocols this package speaks. */
+export type SearchProtocol = 'openai-responses' | 'anthropic-messages';
+/** Credential record that owns GitHub Copilot OAuth state and refresh. */
+export declare const GITHUB_COPILOT_CREDENTIAL_KEY = "llm-pi-ai/github-copilot";
+/** Default `anthropic-version` header value. */
+export declare const DEFAULT_API_VERSION = "2023-06-01";
+/**
+ * The server-side Responses web tool spellings. The standard `web_search`
+ * is the preferred Copilot spelling; `web_search_2025_08_26` is retained as
+ * a probe fallback for provider-side protocol variation.
+ */
+export type ResponsesWebSearchToolType = 'web_search' | 'web_search_2025_08_26';
+/** Standard server-side web search tool type (OpenAI/DeepSeek official). */
+export declare const WEB_SEARCH_TOOL_TYPE: ResponsesWebSearchToolType;
+/**
+ * Versioned Responses spelling retained as a capability-probe fallback.
+ */
+export declare const RESPONSES_WEB_SEARCH_TOOL_TYPE: ResponsesWebSearchToolType;
+/** Anthropic server-side web search tool type (versioned). */
+export declare const ANTHROPIC_WEB_SEARCH_TOOL_TYPE = "web_search_20250305";
+/**
+ * Fully defaulted endpoint facts one search (or probe) operation runs with.
+ * Every field is resolved once at plan build time so the adapters never fall
+ * back mid-operation.
+ */
+export interface SearchPlanCandidate {
+    readonly protocol: SearchProtocol;
+    /** Endpoint base; `/responses` or `/messages` is appended by the adapter. */
+    readonly baseURL: string;
+    readonly model: string;
+    /** Credential reference resolved through the credentials seam. */
+    readonly apiKeyEnv: string;
+    /** `anthropic-version` header value (anthropic-messages only). */
+    readonly apiVersion: string;
+    /** Static provider/model headers inherited from pi-ai's catalog. */
+    readonly headers?: Readonly<Record<string, string | null>>;
+    /**
+     * The Responses web tool spelling this candidate serves with (probe-verified;
+     * openai-responses only). The probe may settle on the fallback spelling, in
+     * which case the chosen candidate carries the verified one.
+     */
+    readonly webSearchToolType?: ResponsesWebSearchToolType;
+}
+/** The plugin-config fields the plan reads; `apply` projects the full section onto this. */
+export interface PlanConfig {
+    /** Whether a live capability probe verifies each candidate before use. */
+    readonly probe: boolean;
+    /** Bound on one probe request, in milliseconds. */
+    readonly probeTimeoutMs: number;
+}
+/**
+ * Normalize an anthropic-messages base so appending `/messages` reaches the
+ * Messages endpoint under either base convention: the SDK-style root
+ * (`https://api.anthropic.com` → `/v1/messages`) and the v1-included base
+ * (`https://api.deepseek.com/anthropic/v1` → `/messages`).
+ * @param baseURL - the configured or catalog base.
+ * @returns the base `/messages` is appended to.
+ */
+export declare function ensureV1Base(baseURL: string): string;
+/**
+ * Return the selected Copilot model's native search protocol. No endpoint or
+ * cross-provider sibling is guessed.
+ * @param route - the current chat route facts.
+ * @returns the single native candidate, or none for an unsupported route.
+ */
+export declare function siblingCandidates(route: CurrentChatRoute): readonly {
+    protocol: SearchProtocol;
+    baseURL: string;
+}[];
+/**
+ * Resolve the candidate set for one plan from the current chat route. An
+ * empty result means the plugin auto-disables — nothing to probe, nothing to
+ * register.
+ * @param ctx - plugin context for route detection.
+ * @param config - the currently authoritative plan config.
+ * @returns the candidates in probe order.
+ */
+export declare function resolveCandidates(ctx: Context, _config: PlanConfig): readonly SearchPlanCandidate[];
+/**
+ * Build only from the route captured by the caller, without rereading selection.
+ * @param route - operation-local route facts.
+ * @returns native Copilot candidates, or none without supported facts.
+ */
+export declare function candidatesForRoute(route: CurrentChatRoute | undefined): readonly SearchPlanCandidate[];
+/** Lifecycle state of one search plan. */
+export type SearchPlanStatus = 'probing' | 'ready' | 'failed';
+/**
+ * One candidate set plus its probe lifecycle. The probe runs in the
+ * background so plugin load never blocks on a provider round-trip;
+ * `available()` stays synchronous and `settle()` awaits the verdict. A
+ * failed plan keeps its reason so the first search (or tool call) surfaces
+ * the auto-disable diagnostic instead of a bare "no provider" error.
+ */
+export declare class SearchPlan {
+    private readonly probe;
+    /** Captured owner/proof lifetime, shared by probes and every served operation. */
+    readonly signal?: AbortSignal | undefined;
+    readonly candidates: readonly SearchPlanCandidate[];
+    /** Resolves when the probe verdict (or the immediate decision) lands. */
+    readonly settled: Promise<void>;
+    private status;
+    private chosen;
+    private reason;
+    /**
+     * @param candidates - the candidates in probe order; empty disables the plan.
+     * @param probe - verifies one candidate; called sequentially until one passes.
+     * @param probeEnabled - when false the first candidate is trusted outright.
+     * @param signal - captured owner/proof cancellation, retained through final HTTP.
+     */
+    constructor(candidates: readonly SearchPlanCandidate[], probe: (candidate: SearchPlanCandidate) => Promise<ProbeOutcome>, probeEnabled: boolean, 
+    /** Captured owner/proof lifetime, shared by probes and every served operation. */
+    signal?: AbortSignal | undefined);
+    /** Probe candidates in order; the first supported verdict wins. */
+    private runProbe;
+    /**
+     * Cheap synchronous usability check for the listener gate. While probing
+     * the plan is PROVISIONALLY available — the first gated request may enter
+     * and await {@link settle} — so the probe verdict and the stream start in
+     * parallel; only a failed (or candidate-less) plan is unavailable and keeps
+     * the request on the normal adapter path.
+     * @returns whether a search can currently be served.
+     */
+    available(): boolean;
+    /**
+     * Await the probe verdict and return the winning candidate.
+     * @returns the candidate whose probe passed (or the first, when probing is off).
+     * @throws WebError `WEB_PROVIDER_UNAVAILABLE` naming the auto-disable reason.
+     */
+    settle(): Promise<SearchPlanCandidate>;
+    /** The candidate currently serving searches, once the plan settled on one. */
+    chosenCandidate(): SearchPlanCandidate | undefined;
+    /** The auto-disable reason, once a probe failed (or no candidate existed). */
+    failureReason(): string | undefined;
+}
+/** Whether two candidate sets are identical (skips re-probing on no-op settings changes). */
+export declare function sameCandidates(left: readonly SearchPlanCandidate[], right: readonly SearchPlanCandidate[]): boolean;
+//# sourceMappingURL=plan.d.ts.map

package/lib/types/preview-provider.d.ts

@@ -0,0 +1,35 @@
+import type { Api, Model, StreamOptions } from '@earendil-works/pi-ai';
+import type { AccountModelApi, AccountModelDescriptor } from './account-model-catalog.ts';
+import type { CoreCompatibleProvider } from './pi-provider-bridge.ts';
+import type { GitHubCopilotOAuthCredential } from './copilot-grant.ts';
+/** Per-call authorization/lifetime checks supplied by the owning route. */
+export interface PreviewProviderGuard {
+    readonly signal: AbortSignal;
+    assertActive(): void;
+    assertAccount(credential: GitHubCopilotOAuthCredential): void;
+    beforeWire(model: Model<Api>, options?: StreamOptions): Promise<{
+        signal: AbortSignal;
+        release(): void;
+    }>;
+}
+/** Guard for one selected model in an account-bound descriptor snapshot. */
+export interface AccountProviderGuard extends PreviewProviderGuard {
+    readonly selectedModelId?: string;
+    assertEntitled(credential: GitHubCopilotOAuthCredential, modelId: string): void;
+}
+/** The independent prompt limit is retained for the route's budget guard, not folded into context capacity. */
+export type AccountPiModel = Model<AccountModelApi> & {
+    readonly maxInputTokens?: number;
+    readonly unmappedReasoningEfforts: readonly string[];
+    readonly minThinkingBudget?: number;
+    readonly maxThinkingBudget?: number;
+};
+export declare function copilotPublicHeaders(): Readonly<Record<string, string>>;
+/** Materialize advertised capabilities only; model names and the local static catalog never select the API. */
+export declare function accountModelFromDescriptor(descriptor: AccountModelDescriptor, baseURL: string): AccountPiModel;
+/** Create a descriptor-driven, OAuth-only provider using native SDK serialization for all supported endpoints. */
+export declare function createAccountProvider(descriptors: readonly AccountModelDescriptor[], guard: AccountProviderGuard, baseURL: string): {
+    provider: CoreCompatibleProvider;
+    models: readonly AccountPiModel[];
+};
+//# sourceMappingURL=preview-provider.d.ts.map

package/lib/types/preview-route.d.ts

@@ -0,0 +1,63 @@
+import type { Context } from '@deepseek-ai/cordis';
+import type { PiAiProviderProfile } from '@deepseek-ai/dsh-llm-pi-ai';
+import { GITHUB_COPILOT_PREVIEW_PROVIDER_ID } from './copilot-identity.ts';
+import type { AccountModelLoadOptions } from './account-model-source.ts';
+import type { AccountModelRejection } from './account-model-catalog.ts';
+import type { InlineConfig } from './config.ts';
+/** Safe request knobs; identities, model tables, endpoints and credentials are not configurable. */
+export type PreviewRouteConfig = Pick<PiAiProviderProfile, 'reasoning' | 'cacheRetention' | 'transport' | 'timeoutMs' | 'websocketConnectTimeoutMs' | 'streamIdleTimeoutMs' | 'maxRequestImageBytes' | 'requestImagePixelBudget' | 'requestImageMaxBytes' | 'retryPolicy'> & Pick<InlineConfig, 'accountModelTtlMs' | 'accountModelFailureCooldownMs'> & {
+    readonly accountModelSettings?: () => Pick<InlineConfig, 'accountModelTtlMs' | 'accountModelFailureCooldownMs'>;
+};
+export interface GitHubCopilotPreviewView {
+    readonly provider: typeof GITHUB_COPILOT_PREVIEW_PROVIDER_ID;
+    readonly configured: boolean;
+    readonly available: boolean;
+    readonly correctionActive: boolean;
+    readonly state: 'idle' | 'loading' | 'ready' | 'stale' | 'unconfigured' | 'unavailable' | 'error' | 'disposed';
+    readonly models: readonly {
+        readonly id: string;
+        readonly name: string;
+        readonly api: string;
+    }[];
+    readonly rejected: readonly AccountModelRejection[];
+    readonly warnings: readonly {
+        readonly id: string;
+        readonly code: string;
+    }[];
+    readonly discoveredAt?: number;
+    readonly error?: string;
+}
+export interface GitHubCopilotPreview {
+    getView(): GitHubCopilotPreviewView;
+    /** Host-only current endpoint facts; no discovery and no credential material. */
+    routeFacts(modelId: string): {
+        readonly api: string;
+        readonly baseURL: string;
+    } | undefined;
+    /** Capture credential-proof continuity, independent of ordinary metadata cache TTL. */
+    captureSearchProof(): () => boolean;
+    /** Host-only credential resolution for an independent, account-scoped search request. */
+    resolveRequestAuth(modelId: string, signal?: AbortSignal): Promise<{
+        readonly apiKey: string;
+        readonly baseURL: string;
+        readonly headers: Readonly<Record<string, string>>;
+    }>;
+    /** Read stored credentials/status only; never starts native refresh or discovery. */
+    refresh(): Promise<GitHubCopilotPreviewView>;
+    /** Explicit account model discovery. May refresh native OAuth and GET /models. */
+    discover(options?: AccountModelLoadOptions): Promise<GitHubCopilotPreviewView>;
+}
+declare module '@deepseek-ai/cordis' {
+    interface Context {
+        githubCopilotPreview: GitHubCopilotPreview;
+    }
+}
+/** Register one stable account route; attach/status remain network-free. */
+export declare function apply(ctx: Context, config?: PreviewRouteConfig): void;
+declare const _default: {
+    name: string;
+    inject: string[];
+    apply: typeof apply;
+};
+export default _default;
+//# sourceMappingURL=preview-route.d.ts.map

package/lib/types/probe.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Capability probe: one bounded operation per candidate protocol that forces
+ * the server-side web tool to run and checks the reply for the structured
+ * evidence that it did. A protocol claim is trusted only after this passes —
+ * several "Responses-compatible" gateways accept the `web_search` tool field
+ * and silently ignore it (DeepSeek documents that unknown tool types are
+ * ignored), which is exactly the failure mode static protocol detection
+ * cannot see. The probe is what makes the auto-disable decision honest.
+ * @module dsh-github-copilot/probe
+ */
+import type { ResponsesWebSearchToolType, SearchPlanCandidate } from './plan.ts';
+import type { ResolvedRequestAuth } from './copilot-request.ts';
+/** The outcome of probing one candidate. */
+export interface ProbeOutcome {
+    readonly supported: boolean;
+    /** Why the candidate failed, for the auto-disable diagnostic. */
+    readonly detail: string;
+    /**
+     * The Responses tool spelling the probe verified (openai-responses only).
+     * May differ from the candidate's primary spelling when the fallback won;
+     * the wire must use this verified value.
+     */
+    readonly webSearchToolType?: ResponsesWebSearchToolType;
+}
+/**
+ * Probe one candidate protocol with a bounded request sequence. The verdict is
+ * structural: a Responses reply must contain a `web_search_call` item and a
+ * Messages reply must contain a `web_search_tool_result` block; anything else
+ * — HTTP error, unparseable body, silent tool ignore — is "not supported".
+ * The timeout bounds the WHOLE probe, including credential resolution; the
+ * probe never throws — every failure becomes a verdict.
+ * @param candidate - the resolved endpoint facts to verify.
+ * @param resolveApiKey - resolves the candidate's credential reference.
+ * @param timeoutMs - bound on the whole probe.
+ * @param signal - optional owner lifecycle cancellation; abort forbids later attempts.
+ * @returns the verdict and a diagnostic detail.
+ */
+export declare function probeCandidate(candidate: SearchPlanCandidate, resolveApiKey: (candidate: SearchPlanCandidate) => Promise<string | ResolvedRequestAuth | undefined>, timeoutMs: number, signal?: AbortSignal): Promise<ProbeOutcome>;
+//# sourceMappingURL=probe.d.ts.map

package/lib/types/reasoning-presentation.d.ts

@@ -0,0 +1,55 @@
+/** Plugin-owned, Step-scoped provenance; never a model route or durable message. */
+export declare const ASSISTANT_ORIGIN_KEY = "github-copilot-assistant-origin";
+type Dispose = () => void;
+export interface AssistantOrigin {
+    readonly seq: number;
+    readonly provider: string;
+    readonly model: string;
+}
+interface OriginState {
+    readonly turn: number;
+    readonly step: number;
+    readonly origin: AssistantOrigin | undefined;
+}
+interface OriginMatch {
+    readonly event: unknown;
+}
+interface OriginContext {
+    readonly state?: OriginState | undefined;
+    readonly matches: readonly OriginMatch[];
+}
+interface OriginLocationData {
+    readonly kind: 'step';
+    readonly turn: number;
+    readonly step: number;
+    readonly key: typeof ASSISTANT_ORIGIN_KEY;
+    readonly value: AssistantOrigin;
+}
+/** Targetless Definition: registration rebuilds existing bindings, including cold history. */
+export declare const assistantOriginDefinition: {
+    kind: string;
+    match(event: unknown): {
+        id: string;
+        role: "start" | "update";
+    } | null;
+    start(_context: OriginContext, match: OriginMatch): OriginState;
+    update(context: OriginContext & {
+        readonly state: OriginState;
+    }, match: OriginMatch): OriginState;
+    buildLocationData(context: OriginContext, scope: string, previous: OriginLocationData | null): OriginLocationData | null;
+};
+/** Shallow UI-only projection. Unchanged input retains its exact props identity. */
+export declare function projectReasoningPresentation<Props extends object>(props: Props, origin: unknown): Props;
+export interface ReasoningPresentationCapabilities {
+    readonly slots: unknown;
+    readonly uiConversation: unknown;
+    /** Receives stable codes only, never message text, model payloads or error bodies. */
+    readonly diagnostic: (code: string) => void;
+}
+/**
+ * Optional Client enhancement. The caller owns the returned disposer in its
+ * dependency-scoped effect; missing older-Core seams leave native UI alone.
+ */
+export declare function installReasoningPresentation(capabilities: ReasoningPresentationCapabilities): Dispose;
+export {};
+//# sourceMappingURL=reasoning-presentation.d.ts.map