dsh-github-copilot 0.4.0-alpha.18

package/lib/types/watchdog.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Idle watchdog for the inline wire path: aborts when no data arrives for a
+ * configurable interval. The timeout resets on every `reset()` call, so a
+ * slow but alive stream never trips it.
+ * @module dsh-github-copilot/watchdog
+ */
+/** Abort-triggering idle timer. */
+export declare class IdleWatchdog {
+    private readonly ms;
+    readonly signal: AbortSignal;
+    private readonly controller;
+    private timer;
+    /**
+     * @param ms - the idle bound in milliseconds.
+     */
+    constructor(ms: number);
+    /** Restart the idle window. Call after every received event. */
+    reset(): void;
+    /** Stop the timer and release the signal. */
+    dispose(): void;
+}
+//# sourceMappingURL=watchdog.d.ts.map

package/lib/types/web-delegate.d.ts

@@ -0,0 +1,12 @@
+import type { Context } from '@deepseek-ai/cordis';
+import type { WebRuntime } from '@deepseek-ai/dsh-web';
+declare module '@deepseek-ai/cordis' {
+    interface Context {
+        githubCopilotOriginalWeb: WebRuntime;
+    }
+}
+/** Expose the unchanged official service from the bundle's named web isolate. */
+export declare const name = "github-copilot-web-delegate";
+export declare const inject: string[];
+export declare function apply(ctx: Context): void;
+//# sourceMappingURL=web-delegate.d.ts.map

package/lib/types/web-search-routing-card.d.ts

@@ -0,0 +1,10 @@
+import type { Context as ClientContext } from '@deepseek-ai/cordis';
+import type { ReactElement } from 'react';
+interface SearchRoutingCardProps {
+    readonly settings: ClientContext['remote']['settings'];
+    readonly copilot: ClientContext['remote']['githubCopilot'];
+}
+/** Models-page card for plugin-owned cross-provider search routing. */
+export declare function WebSearchRoutingCard(props: SearchRoutingCardProps): ReactElement;
+export {};
+//# sourceMappingURL=web-search-routing-card.d.ts.map

package/lib/types/web-search-routing-config.d.ts

@@ -0,0 +1,16 @@
+import z from '@deepseek-ai/schemastery';
+import type { SettingsNamespace } from '@deepseek-ai/dsh-settings';
+/** Plugin-owned settings namespace for cross-provider web-search routing. */
+export declare const WEB_SEARCH_ROUTING_SETTINGS_NAMESPACE: SettingsNamespace;
+/** Sentinel that disables the default/fixed search backend. */
+export declare const NO_DEFAULT_SEARCH_PROVIDER = "none";
+/** Cross-provider policy applied by this plugin's routed web facade. */
+export interface WebSearchRoutingConfig {
+    /** Auto prefers the initiating model's native search; fixed always uses the configured provider. */
+    searchMode?: 'auto' | 'fixed';
+    /** Registered search-provider id used by fixed mode and as auto mode's fallback. */
+    defaultSearchProvider?: string;
+}
+/** User-facing routing settings; provider-specific credentials and models remain provider-owned. */
+export declare const WebSearchRoutingConfigSchema: z<WebSearchRoutingConfig>;
+//# sourceMappingURL=web-search-routing-config.d.ts.map

package/lib/types/wire-anthropic.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Anthropic Messages wire for the inline web search plugin: intercepts an
+ * agent-loop model call, builds a Messages streaming request carrying the
+ * server-side `web_search_20250305` tool, and maps the Anthropic event
+ * stream onto the harness StreamChunk contract. Server-side search blocks
+ * (`server_tool_use` / `web_search_tool_result`) are skipped — the gateway
+ * executes the search inside the same request and the model answers from
+ * its results in the same turn. The generator NEVER throws; every failure
+ * becomes a finish chunk.
+ * @module dsh-github-copilot/wire-anthropic
+ */
+import type { GenerateOptions, StreamChunk, TokenUsage } from '@deepseek-ai/dsh-llm';
+import type { SearchPlanCandidate } from './plan.ts';
+import type { InlineConfig } from './config.ts';
+import type { InlineHooks } from './wire.ts';
+/** Map an Anthropic usage object onto the harness TokenUsage shape. */
+export declare function mapAnthropicUsage(usage: {
+    readonly input_tokens?: number;
+    readonly output_tokens?: number;
+    readonly cache_read_input_tokens?: number;
+    readonly cache_creation_input_tokens?: number;
+    readonly output_tokens_details?: {
+        readonly thinking_tokens?: number;
+    };
+}): TokenUsage;
+/**
+ * Run one inline model call through the Anthropic Messages API with the
+ * server-side web search tool injected. Never throws; always ends with a
+ * finish chunk.
+ * @param request - the frozen agent-loop request.
+ * @param candidate - the settled endpoint facts (probe-verified).
+ * @param hooks - credential hooks.
+ * @param cfg - the current plugin configuration.
+ * @returns the StreamChunk stream for the loop's assembler.
+ */
+export declare function inlineAnthropicStream(request: GenerateOptions, candidate: SearchPlanCandidate, hooks: InlineHooks, cfg: InlineConfig): AsyncGenerator<StreamChunk>;
+//# sourceMappingURL=wire-anthropic.d.ts.map

package/lib/types/wire.d.ts

@@ -0,0 +1,56 @@
+/**
+ * The short-circuit wire: intercepts an agent-loop model call, builds a
+ * streaming request carrying the server-side `web_search` tool, and maps the
+ * SSE events onto the harness StreamChunk contract. The generator NEVER
+ * throws — every failure becomes a finish chunk, exactly what the loop's
+ * catch-less `for await` requires. {@link inlineWireStream} settles the plan
+ * first and then dispatches to the protocol the VERIFIED candidate speaks, so
+ * the wire always matches the probe verdict (never the chat route snapshot).
+ *
+ * Server-side `web_search_call` items are skipped: the gateway executes the
+ * search inside the same request and the model answers from its results in
+ * the same turn, so the harness never sees a tool call. (UI search cards
+ * were removed — the added latency outweighed the visual value.)
+ * @module dsh-github-copilot/wire
+ */
+import type { GenerateOptions, StreamChunk } from '@deepseek-ai/dsh-llm';
+import type { SearchPlan, SearchPlanCandidate } from './plan.ts';
+import type { ResponsesReasoningOptions } from './serialize.ts';
+import type { ResolvedRequestAuth } from './copilot-request.ts';
+import type { InlineConfig } from './config.ts';
+/** Credential and cancellation hooks the stream resolves per operation. */
+export interface InlineHooks {
+    /** Resolve one credential reference through the credentials seam. */
+    resolveApiKey: (candidate: SearchPlanCandidate) => Promise<string | ResolvedRequestAuth | undefined>;
+    /** Validate effective model/profile reasoning and return its mapped wire value. */
+    resolveResponsesReasoning?: (request: GenerateOptions, candidate: SearchPlanCandidate) => ResponsesReasoningOptions | undefined;
+}
+/**
+ * Whether the request carries an image attachment. Image blocks retain the
+ * harness attachment object that the official vision channel must consume.
+ */
+export declare function contentHasImageAttachments(request: GenerateOptions): boolean;
+/**
+ * Run one inline model call through whichever wire the settled candidate
+ * speaks. The plan is settled HERE — once — so the protocol choice follows
+ * the probe verdict instead of the chat route snapshot taken before the
+ * probe ran.
+ * @param request - the frozen agent-loop request.
+ * @param plan - the search plan owning endpoint facts.
+ * @param hooks - credential hooks.
+ * @param cfg - the current plugin configuration.
+ * @returns the StreamChunk stream for the loop's assembler.
+ */
+export declare function inlineWireStream(request: GenerateOptions, plan: SearchPlan, hooks: InlineHooks, cfg: InlineConfig): AsyncGenerator<StreamChunk>;
+/**
+ * Run one inline model call: fetch the Responses endpoint with the
+ * server-side web tool injected and translate the SSE stream into harness
+ * chunks. Never throws; always ends with a finish chunk.
+ * @param request - the frozen agent-loop request.
+ * @param candidate - the settled endpoint facts (probe-verified).
+ * @param hooks - credential hooks.
+ * @param cfg - the current plugin configuration.
+ * @returns the StreamChunk stream for the loop's assembler.
+ */
+export declare function inlineStream(request: GenerateOptions, candidate: SearchPlanCandidate, hooks: InlineHooks, cfg: InlineConfig): AsyncGenerator<StreamChunk>;
+//# sourceMappingURL=wire.d.ts.map

package/lib/web-delegate.js

@@ -0,0 +1,9 @@
+//#region lib/types/web-delegate.js
+/** Expose the unchanged official service from the bundle's named web isolate. */
+const name = "github-copilot-web-delegate";
+const inject = ["web"];
+function apply(ctx) {
+	ctx.provide("githubCopilotOriginalWeb", ctx.web);
+}
+//#endregion
+export { apply, inject, name };

package/package.json

@@ -0,0 +1,200 @@
+{
+  "name": "dsh-github-copilot",
+  "description": "DSH companion for GitHub Copilot sign-in, account-aware model profiles, tool compatibility, and provider-hosted search.",
+  "version": "0.4.0-alpha.18",
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/",
+    "tag": "alpha"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/cloga/dsh-github-copilot.git"
+  },
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./lib/types/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./client": {
+      "types": "./lib/types/client.d.ts",
+      "default": "./lib/client.js"
+    },
+    "./remote": {
+      "types": "./lib/types/remote.d.ts",
+      "default": "./lib/remote.js"
+    },
+    "./web-delegate": {
+      "types": "./lib/types/web-delegate.d.ts",
+      "default": "./lib/web-delegate.js"
+    },
+    "./routed-web": {
+      "types": "./lib/types/routed-web.d.ts",
+      "default": "./lib/routed-web.js"
+    },
+    "./deployment-baseline.json": "./deployment-baseline.json",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "cordis.patch.yml",
+    "deployment-baseline.json",
+    "lib/*.js",
+    "lib/*.js.map",
+    "lib/types/**/*.d.ts",
+    "README.md",
+    "README.zh.md",
+    "CONTRIBUTING.md",
+    "SECURITY.md",
+    "AGENTS.md",
+    "docs/agent-readiness.md",
+    "docs/model-compatibility-acceptance.md",
+    "docs/single-route-migration.md",
+    "docs/session-search-routing.md",
+    "docs/npm-distribution.md",
+    "scripts/check-search-composition.mjs",
+    "docs/images/"
+  ],
+  "keywords": [
+    "dsh",
+    "deepseek-harness",
+    "plugin",
+    "cordis",
+    "github-copilot",
+    "oauth",
+    "model-provider",
+    "hosted-search",
+    "web-search",
+    "openai-responses",
+    "typescript"
+  ],
+  "license": "MIT",
+  "engines": {
+    "node": ">=22.19.0"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "^4.0.2",
+    "@deepseek-ai/dsh-agent": "0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2",
+    "@deepseek-ai/dsh-agent-default-model": "0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2",
+    "@deepseek-ai/dsh-api-remotes": "0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2",
+    "@deepseek-ai/dsh-authorization": "0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2",
+    "@deepseek-ai/dsh-client-ui-renderer": "0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2",
+    "@deepseek-ai/dsh-client-ui-settings-models": "0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2",
+    "@deepseek-ai/dsh-client-ui-slots": "0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2",
+    "@deepseek-ai/dsh-credentials": "0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2",
+    "@deepseek-ai/dsh-launch-environment": "0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2",
+    "@deepseek-ai/dsh-llm": "0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2",
+    "@deepseek-ai/dsh-llm-pi-ai": "0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2",
+    "@deepseek-ai/dsh-settings": "0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2",
+    "@deepseek-ai/dsh-typert-protocol": "0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2",
+    "@deepseek-ai/dsh-web": "0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2",
+    "@deepseek-ai/dsh-web-search-deepseek": "0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2",
+    "react": "^18.2.0"
+  },
+  "peerDependenciesMeta": {
+    "@deepseek-ai/dsh-web-search-deepseek": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-launch-environment": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-api-remotes": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-authorization": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-client-ui-renderer": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-client-ui-settings-models": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-client-ui-slots": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-typert-protocol": {
+      "optional": true
+    }
+  },
+  "dependencies": {
+    "@deepseek-ai/dsh-authorization": "0.1.2-rc.1",
+    "@deepseek-ai/schemastery": "^3.18.2",
+    "@earendil-works/pi-ai": "0.85.1",
+    "zod": "^4.4.3"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "^4.0.2",
+    "@deepseek-ai/dsh-agent": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-agent-default-model": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-api-gateway": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-api-remotes": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-app-boot": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-attachment": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-authorization": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-connection": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-renderer": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-settings-models": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-slots": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-credentials": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-fs": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-launch-environment": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-llm": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-llm-pi-ai": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-scope": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-settings": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-system-prompt": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-tool-web": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-tools": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-typert-protocol": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-typert-registry": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-web": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-web-search-deepseek": "0.1.2-rc.1",
+    "@types/node": "^22.0.0",
+    "@types/react": "~18.3.1",
+    "jsdom": "^26.1.0",
+    "react": "^18.2.0",
+    "tsdown": "^0.22.2",
+    "typescript": "^5.9.0",
+    "vitest": "^3.2.0"
+  },
+  "main": "lib/index.js",
+  "types": "lib/types/index.d.ts",
+  "imports": {
+    "#package.json": "./package.json"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "inject": [
+        "@deepseek-ai/dsh-api-remotes",
+        "@deepseek-ai/dsh-client-ui-settings-models"
+      ],
+      "platform": "web"
+    }
+  },
+  "scripts": {
+    "build": "pnpm clean && tsc -p tsconfig.json && tsdown",
+    "clean": "node -e \"require('node:fs').rmSync('lib', { recursive: true, force: true })\"",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "typecheck:tests": "tsc -p tsconfig.tests.json",
+    "test:scripts": "node --test \"tests/scripts/*.test.mjs\"",
+    "agent:describe": "node scripts/agent.mjs describe --json",
+    "agent:doctor": "node scripts/agent.mjs doctor --json",
+    "agent:plan": "node scripts/agent.mjs plan",
+    "preflight:search": "node scripts/check-search-composition.mjs",
+    "verify:agent": "node scripts/verify-agent-contract.mjs",
+    "verify:tarball": "node scripts/verify-tarball.mjs",
+    "verify:baseline": "node scripts/verify-deployment-baseline.mjs",
+    "verify:package": "node scripts/verify-package.mjs",
+    "verify:controlled-core": "node scripts/verify-controlled-core.mjs",
+    "verify:reasoning-ui": "node scripts/verify-reasoning-presentation.mjs",
+    "verify:upstream": "node scripts/verify-upstream-baseline.mjs",
+    "release:check": "node scripts/release-policy.mjs",
+    "verify": "pnpm verify:agent && pnpm typecheck && pnpm typecheck:tests && pnpm verify:baseline && pnpm build && pnpm test && pnpm test:scripts && pnpm verify:package"
+  }
+}

package/scripts/check-search-composition.mjs

@@ -0,0 +1,191 @@
+import { createRequire } from 'node:module'
+import { isDeepStrictEqual } from 'node:util'
+import { readFile } from 'node:fs/promises'
+import { resolve, join, isAbsolute } from 'node:path'
+import { fileURLToPath, pathToFileURL } from 'node:url'
+
+const realm = 'github-copilot-original-web'
+const reserved = new Set(['github-copilot-web-delegate', 'github-copilot-routed-web'])
+
+/** Structural pre-install validation only; never imports/boots configured plugins. */
+export function checkSearchComposition(entries) {
+  const reasons = new Set()
+  const matches = []
+  function walk(rows, depth) {
+    if (!Array.isArray(rows)) { reasons.add('INVALID_ENTRY_LIST'); return }
+    for (const entry of rows) {
+      if (!entry || typeof entry !== 'object' || Array.isArray(entry)) { reasons.add('INVALID_ENTRY'); continue }
+      if (entry.id === 'web') matches.push({ entry, depth })
+      if (entry.name === '@deepseek-ai/dsh-web' && entry.id !== 'web') reasons.add('ADDITIONAL_OFFICIAL_WEB_SERVICE')
+      if (reserved.has(entry.id) || ['dsh-github-copilot/web-delegate', 'dsh-github-copilot/routed-web'].includes(entry.name)) reasons.add('ROUTING_ENTRY_CONFLICT')
+      if (entry.isolate !== undefined) {
+        if (!entry.isolate || typeof entry.isolate !== 'object' || Array.isArray(entry.isolate)) reasons.add('UNKNOWN_ISOLATION')
+        else {
+          if (Object.values(entry.isolate).some(value => value === realm)) reasons.add('ROUTING_REALM_CONFLICT')
+          if (Object.values(entry.isolate).some(value => typeof value !== 'boolean' && typeof value !== 'string')) reasons.add('UNKNOWN_ISOLATION')
+        }
+      }
+      if (entry.group === true) walk(entry.config, depth + 1)
+      else if (entry.group !== undefined && entry.group !== false) reasons.add('UNKNOWN_GROUP')
+    }
+  }
+  walk(entries, 0)
+  if (matches.length !== 1) reasons.add(matches.length === 0 ? 'WEB_ROW_MISSING' : 'MULTIPLE_WEB_ROWS')
+  for (const { entry, depth } of matches) {
+    if (depth !== 0) reasons.add('WEB_NOT_TOP_LEVEL')
+    if (entry.name !== '@deepseek-ai/dsh-web') reasons.add('CUSTOM_WEB_SERVICE')
+    if (entry.group === true || Object.keys(entry).some(key => !['id', 'name', 'config', 'disabled', 'group', 'isolate'].includes(key))) reasons.add('WEB_ENTRY_REQUIRES_REVIEW')
+    if (entry.disabled !== undefined && entry.disabled !== false) reasons.add('WEB_DISABLED_OR_DYNAMIC')
+    if (entry.config !== undefined && (!entry.config || typeof entry.config !== 'object' || Array.isArray(entry.config)
+      || Object.entries(entry.config).some(([key, value]) => !['searchProvider', 'fetchProvider'].includes(key) || typeof value !== 'string'))) reasons.add('WEB_CONFIG_REQUIRES_REVIEW')
+    if (entry.isolate !== undefined && (!entry.isolate || typeof entry.isolate !== 'object' || Array.isArray(entry.isolate) || Object.keys(entry.isolate).length > 0)) reasons.add('PREEXISTING_WEB_ISOLATION')
+  }
+  return { schemaVersion: 1, supported: reasons.size === 0, reasons: [...reasons].sort(), scope: 'pre-install-structural-only; no boot, credentials, network or writes' }
+}
+
+function reportCandidate(reasons) {
+  return { schemaVersion: 1, supported: reasons.size === 0, reasons: [...reasons].sort(), scope: 'candidate-structural-only; no boot, credentials, network or writes' }
+}
+
+function isRecord(value) {
+  return value !== null && typeof value === 'object' && !Array.isArray(value)
+}
+
+function hasExpression(value) {
+  if (!value || typeof value !== 'object') return false
+  return Object.entries(value).some(([key, child]) => key === '__jsExpr' || key === '__js' || hasExpression(child))
+}
+
+function accountRows(entries) {
+  const matches = []
+  for (const entry of entries) {
+    if (!isRecord(entry)) continue
+    if (entry.id === 'github-copilot' || entry.name === 'dsh-github-copilot') matches.push(entry)
+    if (entry.group === true && Array.isArray(entry.config)) matches.push(...accountRows(entry.config))
+  }
+  return matches
+}
+
+/** Only the bundle's reviewed, static service wiring is automatically supported. */
+function routingRowValid(entry, name, isolated, account = false) {
+  if (!entry || entry.name !== name) return false
+  const keys = ['id', 'name', 'disabled', 'group', 'isolate', ...(account ? ['config'] : [])]
+  if (Object.keys(entry).some(key => !keys.includes(key))) return false
+  if (entry.disabled !== undefined && entry.disabled !== false) return false
+  if (entry.group !== undefined && entry.group !== false) return false
+  if (isolated) {
+    if (!isDeepStrictEqual(entry.isolate, { web: realm })) return false
+  } else if (entry.isolate !== undefined && (!isRecord(entry.isolate) || Object.keys(entry.isolate).length !== 0)) return false
+  return entry.config === undefined || (account && isRecord(entry.config) && !hasExpression(entry.config))
+}
+
+function candidateViable(entries, baseline) {
+  const original = baseline.find(entry => entry.id === 'web')
+  const web = entries.find(entry => entry.id === 'web')
+  if (!original || !web || !isDeepStrictEqual(web.isolate, { web: realm })) return false
+  for (const [id, name, isolated, account] of [
+    ['github-copilot-web-delegate', 'dsh-github-copilot/web-delegate', true, false],
+    ['github-copilot-routed-web', 'dsh-github-copilot/routed-web', false, false],
+    ['github-copilot', 'dsh-github-copilot', false, true],
+  ]) {
+    const matches = entries.filter(entry => entry.id === id)
+    if (matches.length !== 1 || !routingRowValid(matches[0], name, isolated, account)) return false
+  }
+  // Apart from the two new service rows and the original web's realm, the
+  // candidate must preserve the entire routing-free tree, including user config.
+  // These are parsed, owned config objects, never live Loader/Service objects.
+  const restored = entries.filter(entry => !reserved.has(entry.id)).map(entry => {
+    if (entry.id !== 'web') return entry
+    const copy = { ...entry }
+    if (Object.hasOwn(original, 'isolate')) copy.isolate = original.isolate
+    else delete copy.isolate
+    return copy
+  })
+  return isDeepStrictEqual(restored, baseline)
+}
+
+/** Read and compose the proposed normal launch without loadProfile's initialization/normalization writes. */
+export async function inspectProfileSearchComposition({ profileDir, home, installAnchor, patches = [] }, suppliedBoot) {
+  const native = suppliedBoot ?? await import(pathToFileURL(createRequire(installAnchor).resolve('@deepseek-ai/dsh-app-boot')).href)
+  const { readProfileManifest, resolveBundleDir, loadOverlayPatches, loadOptionalPatches, composeEntries } = native
+  const bin = 'copilot-search-preflight'
+  const manifest = readProfileManifest(bin, profileDir)
+  const reasons = new Set()
+  // Public CLI prepareProfile rewrites cordis.yml to [] before normal launch.
+  // Never certify rows that only exist in that disposable file, or rewrite it.
+  const root = loadOptionalPatches(bin, join(profileDir, 'cordis.yml'))
+  if (root?.length) return reportCandidate(new Set(['NONEMPTY_DISPOSABLE_PROFILE_ROOT']))
+  const candidate = loadOverlayPatches(bin, fileURLToPath(new URL('../cordis.patch.yml', import.meta.url)))
+  const layers = []
+  const baselineLayers = []
+  let copilotLayers = 0
+  let candidateIndex
+  function addCandidate() {
+    candidateIndex ??= layers.length
+    layers.push(candidate)
+    // The routing-free comparison retains the account row and its user config.
+    baselineLayers.push([{ insert: [{ id: 'github-copilot', name: 'dsh-github-copilot' }] }])
+  }
+  for (const name of manifest.dsh?.profile?.bundles ?? []) {
+    const directory = resolveBundleDir(bin, name, installAnchor, profileDir)
+    const bundle = readProfileManifest(bin, directory)
+    if (bundle.name === 'dsh-github-copilot') {
+      copilotLayers++
+      // Updating replaces our existing slot, not its position in bundle order.
+      addCandidate()
+      continue
+    }
+    if (typeof bundle.dsh?.bundle?.patch !== 'string') throw new Error('INVALID_BUNDLE_MANIFEST')
+    const layer = loadOverlayPatches(bin, resolve(directory, bundle.dsh.bundle.patch))
+    layers.push(layer)
+    baselineLayers.push(layer)
+  }
+  if (copilotLayers === 0) addCandidate()
+  const late = [
+    loadOptionalPatches(bin, join(profileDir, 'cordis.patch.yml')) ?? [],
+    loadOptionalPatches(bin, join(home, 'cordis.patch.yml')) ?? [],
+    ...patches.map(file => loadOverlayPatches(bin, file)),
+  ]
+  const warn = () => reasons.add('UNAPPLIED_PATCH_REQUIRES_REVIEW')
+  // Public composeEntries flattens each complete stack in one pass. Repeatedly
+  // patching a previously composed tree would change the include's id index.
+  const beforeGuard = composeEntries(layers.slice(0, candidateIndex), warn)
+  const baseline = composeEntries([...baselineLayers, ...late], warn)
+  for (const entries of [beforeGuard, baseline]) {
+    for (const reason of checkSearchComposition(entries).reasons) reasons.add(reason)
+  }
+  const entries = composeEntries([...layers, ...late], warn)
+  if (copilotLayers > 1 || accountRows(entries).length !== 1) reasons.add('DUPLICATE_COPILOT_ACCOUNT_ENTRY')
+  if (!candidateViable(entries, baseline)) reasons.add('CANDIDATE_ROUTING_NOT_VIABLE')
+  return reportCandidate(reasons)
+}
+
+function parse(args) {
+  const result = { patches: [] }
+  for (let index = 0; index < args.length; index += 2) {
+    const value = args[index + 1]
+    if (!value || !isAbsolute(value)) throw new Error('INVALID_ARGUMENTS')
+    const names = { '--profile-dir': 'profileDir', '--home': 'home', '--install-anchor': 'installAnchor' }
+    const key = Object.hasOwn(names, args[index]) ? names[args[index]] : undefined
+    if (args[index] === '--patch') result.patches.push(value)
+    else if (!key || result[key]) throw new Error('INVALID_ARGUMENTS')
+    else result[key] = value
+  }
+  if (!result.profileDir || !result.home || !result.installAnchor) throw new Error('INVALID_ARGUMENTS')
+  return result
+}
+
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  try {
+    const options = parse(process.argv.slice(2))
+    // Refuse missing profiles before any public reader could initialize one.
+    await readFile(join(options.profileDir, 'package.json'), 'utf8')
+    const result = await inspectProfileSearchComposition(options)
+    console.log(JSON.stringify(result))
+    if (!result.supported) process.exitCode = 1
+  } catch {
+    // Parse/provider-config errors can contain credentials. Never echo them.
+    console.log(JSON.stringify({ schemaVersion: 1, supported: false, reasons: ['PREFLIGHT_INPUT_OR_PUBLIC_API_FAILED'], scope: 'read-only; no boot/install attempted' }))
+    process.exitCode = 2
+  }
+}