dsh-github-copilot 0.4.0-alpha.18

package/deployment-baseline.json

@@ -0,0 +1,752 @@
+{
+  "schemaVersion": 1,
+  "baseline": {
+    "id": "cloga.dsh-github-copilot",
+    "kind": "standalone-dsh-plugin",
+    "source": "https://github.com/cloga/dsh-github-copilot",
+    "sourceCommitPolicy": "exact-external-pin"
+  },
+  "package": {
+    "name": "dsh-github-copilot",
+    "version": "0.4.0-alpha.18"
+  },
+  "evidence": {
+    "kind": "source-and-synthetic-test-inventory",
+    "peerRangeMeaning": "package-admission-not-runtime-validation",
+    "doesNotProve": ["live-discovery", "live-model-transport", "all-admitted-core-versions", "published-release", "local-upgrade"]
+  },
+  "supportedBaselines": {
+    "platforms": ["windows", "linux"],
+    "node": ">=22.19.0",
+    "dsh": {
+      "release": "0.1.5-alpha.2",
+      "tag": "dsh-v0.1.5-alpha.2",
+      "commit": "b2e3b2a0125854567a4a5fcba75782e42fe84901",
+      "developmentRelease": "0.1.2-rc.1",
+      "peerRange": "0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2",
+      "baselines": [
+        {
+          "release": "0.1.1-rc.2",
+          "tag": "dsh-v0.1.1-rc.2",
+          "commit": "a772dbbde82780bff2b9394427e9f0a24cafa1d5",
+          "basedOnCommit": "b150a551b8d465e31e418e1b2eaf5e79bbb7d28e",
+          "source": "https://github.com/cloga/deepseek-harness",
+          "branch": "cloga-pi-ai-model-api",
+          "modelsUi": "settings-section-fallback",
+          "perModelApi": "model-entry",
+          "strictModeCompat": "route-switch",
+          "evidenceScope": "historical-regression-only",
+          "managedProviderValidation": "not-verified"
+        },
+        {
+          "release": "0.1.2-rc.1",
+          "tag": "dsh-v0.1.2-rc.1",
+          "commit": "a66e4702047846cdaa10c66c9d3df3951f5ea70d",
+          "modelsUi": "provider-card",
+          "providerHeaders": "fetch-validated-discovery",
+          "strictModeCompat": "route-switch",
+          "evidenceScope": "published-api-target",
+          "managedProviderValidation": "synthetic-published-adapter",
+          "managedProviderTests": ["tests/preview-provider.spec.ts", "tests/preview-route.spec.ts", "tests/pi-provider-bridge.spec.ts"]
+        },
+        {
+          "release": "0.1.3-alpha.1",
+          "tag": "dsh-v0.1.3-alpha.1",
+          "commit": "d347e703908d0406b7a7ef80e3a0e594d86b2215",
+          "modelsUi": "provider-card",
+          "providerHeaders": "fetch-validated-discovery",
+          "strictModeCompat": "route-switch",
+          "fileContentHelper": "contentHasFile",
+          "evidenceScope": "unchanged-tagged-source-target",
+          "standaloneNpmArtifacts": "not-published",
+          "managedProviderValidation": "not-verified"
+        },
+        {
+          "release": "0.1.5-alpha.1",
+          "tag": "dsh-v0.1.5-alpha.1",
+          "commit": "5dda764ed3aa172535a7967b06ff95d9cbfe536a",
+          "source": "https://github.com/deepseek-ai/deepseek-harness",
+          "modelsUi": "provider-card",
+          "providerHeaders": "fetch-validated-discovery",
+          "strictModeCompat": "route-switch",
+          "fileContentHelper": "contentHasFile",
+          "evidenceScope": "unchanged-tagged-source-target",
+          "standaloneNpmArtifacts": "not-tested",
+          "managedProviderValidation": "synthetic-tagged-source-runtime",
+          "runtimeTests": ["tests/preview-route.spec.ts", "tests/published-core.spec.ts", "tests/single-route.spec.ts", "tests/fixtures/session-context-core.fixture.ts", "tests/fixtures/remote-core.fixture.ts"]
+        },
+        {
+          "release": "0.1.5-alpha.2",
+          "tag": "dsh-v0.1.5-alpha.2",
+          "commit": "b2e3b2a0125854567a4a5fcba75782e42fe84901",
+          "source": "https://github.com/deepseek-ai/deepseek-harness",
+          "modelsUi": "provider-card",
+          "providerHeaders": "fetch-validated-discovery",
+          "strictModeCompat": "route-switch",
+          "fileContentHelper": "contentHasFile",
+          "evidenceScope": "unchanged-tagged-source-target",
+          "standaloneNpmArtifacts": "not-tested",
+          "managedProviderValidation": "synthetic-tagged-source-runtime",
+          "resolvedProfileDiagnostics": "plugin-owned-empty-modelErrors",
+          "runtimeTests": ["tests/preview-route.spec.ts", "tests/published-core.spec.ts", "tests/single-route.spec.ts", "tests/fixtures/session-context-core.fixture.ts", "tests/fixtures/remote-core.fixture.ts"]
+        },
+        {
+          "release": "0.1.5-rc.1",
+          "tag": "dsh-v0.1.5-rc.1",
+          "commit": "183f08e9c6dde7e36cd2318eaee70b0da08fb35e",
+          "source": "https://github.com/deepseek-ai/deepseek-harness",
+          "modelsUi": "provider-card",
+          "providerHeaders": "fetch-validated-discovery",
+          "strictModeCompat": "route-switch",
+          "fileContentHelper": "contentHasFile",
+          "evidenceScope": "unchanged-tagged-source-target",
+          "standaloneNpmArtifacts": "not-tested",
+          "managedProviderValidation": "synthetic-tagged-source-runtime",
+          "resolvedProfileDiagnostics": "plugin-owned-empty-modelErrors",
+          "runtimeTests": ["tests/preview-route.spec.ts", "tests/published-core.spec.ts", "tests/single-route.spec.ts", "tests/fixtures/session-context-core.fixture.ts", "tests/fixtures/remote-core.fixture.ts"]
+        },
+        {
+          "release": "0.1.5-rc.2",
+          "tag": "dsh-v0.1.5-rc.2",
+          "commit": "fb2c4b9e698e30edb738bca4cf0618587db7d203",
+          "source": "https://github.com/deepseek-ai/deepseek-harness",
+          "modelsUi": "provider-card",
+          "providerHeaders": "fetch-validated-discovery",
+          "strictModeCompat": "route-switch",
+          "fileContentHelper": "contentHasFile",
+          "evidenceScope": "unchanged-tagged-source-target",
+          "standaloneNpmArtifacts": "not-tested",
+          "managedProviderValidation": "synthetic-tagged-source-runtime",
+          "resolvedProfileDiagnostics": "plugin-owned-empty-modelErrors",
+          "runtimeTests": ["tests/preview-route.spec.ts", "tests/published-core.spec.ts", "tests/single-route.spec.ts", "tests/fixtures/session-context-core.fixture.ts", "tests/fixtures/remote-core.fixture.ts"]
+        }
+      ],
+      "packages": [
+        "@deepseek-ai/dsh-agent",
+        "@deepseek-ai/dsh-agent-default-model",
+        "@deepseek-ai/dsh-api-remotes",
+        "@deepseek-ai/dsh-authorization",
+        "@deepseek-ai/dsh-client-ui-renderer",
+        "@deepseek-ai/dsh-client-ui-settings-models",
+        "@deepseek-ai/dsh-client-ui-slots",
+        "@deepseek-ai/dsh-credentials",
+        "@deepseek-ai/dsh-launch-environment",
+        "@deepseek-ai/dsh-llm",
+        "@deepseek-ai/dsh-llm-pi-ai",
+        "@deepseek-ai/dsh-settings",
+        "@deepseek-ai/dsh-typert-protocol",
+        "@deepseek-ai/dsh-web",
+        "@deepseek-ai/dsh-web-search-deepseek"
+      ]
+    },
+    "piAi": "0.85.1",
+    "runtimeDependencies": {
+      "@deepseek-ai/dsh-authorization": "0.1.2-rc.1",
+      "@deepseek-ai/schemastery": "^3.18.2",
+      "@earendil-works/pi-ai": "0.85.1",
+      "zod": "^4.4.3"
+    }
+  },
+  "capabilities": [
+    {
+      "id": "readonly-search-composition-preflight",
+      "required": true,
+      "evidenceScope": "pre-install-structural-only-not-automatic-cli-enforcement",
+      "sourceMarkers": [
+        {"file": "scripts/check-search-composition.mjs", "marker": "checkSearchComposition"},
+        {"file": "scripts/check-search-composition.mjs", "marker": "PREEXISTING_WEB_ISOLATION"},
+        {"file": "README.md", "marker": "does not automatically run this preflight"}
+      ],
+      "tests": [
+        {"file": "tests/scripts/search-composition.test.mjs", "name": "admits a stock top-level official service without mutating or exposing its config"},
+        {"file": "tests/scripts/search-composition.test.mjs", "name": "includes home and launcher layers instead of ignoring a late web override"},
+        {"file": "tests/scripts/search-composition.test.mjs", "name": "CLI rejects disposable root-only web without initialization, normalization or secret output"},
+        {"file": "tests/scripts/search-composition.test.mjs", "name": "real public parsers validate candidate layers and preserve every input file"},
+        {"file": "tests/scripts/search-composition.test.mjs", "name": "rejects a web bundle ordered after the Copilot guard"}
+      ]
+    },
+    {
+      "id": "session-model-search-routing",
+      "required": true,
+      "evidenceScope": "development-real-consumer-and-loader-synthetic",
+      "sourceMarkers": [
+        {"file": "src/routed-web.ts", "marker": "extends WebRuntime"},
+        {"file": "src/index.ts", "marker": "ctx.provide('githubCopilotSearchRouter'"},
+        {"file": "src/web-search-routing-config.ts", "marker": "WEB_SEARCH_ROUTING_SETTINGS_NAMESPACE"},
+        {"file": "src/web-search-routing-card.ts", "marker": "data-dsh-web-search-routing"},
+        {"file": "cordis.patch.yml", "marker": "web: github-copilot-original-web"}
+      ],
+      "tests": [
+        {"file": "tests/routed-web.spec.ts", "name": "keeps the configured provider for DeepSeek and all other model routes"},
+        {"file": "tests/routed-web.spec.ts", "name": "dispatches a router-selected provider by exact registered id"},
+        {"file": "tests/routed-web.spec.ts", "name": "retains pre-execute denial and the surrounding execution middleware"},
+        {"file": "tests/inline/apply.spec.ts", "name": "uses an independently configured account model for a non-Copilot chat session"},
+        {"file": "tests/inline/apply.spec.ts", "name": "discovers an independent search model absent from the static catalog and keeps proof enabled"},
+        {"file": "tests/inline/apply.spec.ts", "name": "rejects independent search when managed proof expires during %s"},
+        {"file": "tests/inline/apply.spec.ts", "name": "uses the configured account model in fixed mode even for a different Copilot chat model"},
+        {"file": "tests/client-bundle.spec.ts", "name": "registers web-search routing as a separate Models footer card"},
+        {"file": "tests/routed-web-loader.spec.ts", "name": "loads the built facade and delegate entries without changing official tools"}
+      ]
+    },
+    {
+      "id": "explicit-deepseek-search-fallback",
+      "required": true,
+      "evidenceScope": "development-synthetic-no-live-search-claim",
+      "sourceMarkers": [
+        {"file": "src/config.ts", "marker": "searchFallback: z.union(['none', 'deepseek']).default('deepseek')"},
+        {"file": "src/deepseek-search-fallback.ts", "marker": "new native.DeepSeekSearchProvider"},
+        {"file": "src/search-routing.ts", "marker": "These are not Copilot search results."}
+      ],
+      "tests": [
+        {"file": "tests/search-routing.spec.ts", "name": "does not spend fallback credits unless explicitly enabled"},
+        {"file": "tests/search-routing.spec.ts", "name": "does not fallback when the primary reports cancellation"},
+        {"file": "tests/routed-web.spec.ts", "name": "preserves fallback provenance in canonical value, rendered content and web-card metadata"},
+        {"file": "tests/deepseek-search-fallback.spec.ts", "name": "checks the actual managed proof after native fallback auth: %s"},
+        {"file": "tests/deepseek-search-fallback.spec.ts", "name": "checks continuity after native literal-key auth (permitted=%s)"}
+      ]
+    },
+    {
+      "id": "account-driven-provider-metadata",
+      "required": true,
+      "activation": "validated-account-endpoints-and-capabilities",
+      "sourceMarkers": [
+        {"file": "src/account-model-catalog.ts", "marker": "normalizeAccountModelCatalog"},
+        {"file": "src/account-model-catalog.ts", "marker": "supported_endpoints"},
+        {"file": "src/account-model-catalog.ts", "marker": "maxInputTokens"},
+        {"file": "src/account-model-catalog.ts", "marker": "DUPLICATE_CONFLICT"},
+        {"file": "src/preview-provider.ts", "marker": "accountModelFromDescriptor"}
+      ],
+      "tests": [
+        {"file": "tests/account-model-catalog.spec.ts", "name": "routes an unseen identifier using %s rather than its model name"},
+        {"file": "tests/account-model-catalog.spec.ts", "name": "uses advertised Responses when an older local catalog says GPT-6 is Completions"},
+        {"file": "tests/account-model-catalog.spec.ts", "name": "accepts new Gemini and Sol Fast IDs without adding model-specific rules"},
+        {"file": "tests/account-model-catalog.spec.ts", "name": "prefers native API only when the server advertises the matching endpoint"},
+        {"file": "tests/account-model-catalog.spec.ts", "name": "uses a caller-proven account ID only for an absent policy and records the evidence source"},
+        {"file": "tests/account-model-catalog.spec.ts", "name": "preserves context, input and output limits as different facts"},
+        {"file": "tests/account-model-catalog.spec.ts", "name": "deduplicates equal IDs but rejects all versions of a conflicting duplicate"},
+        {"file": "tests/account-model-catalog.spec.ts", "name": "keeps only safe endpoint evidence and never extracts supplied URLs, headers, or secrets"},
+        {"file": "tests/account-model-catalog.spec.ts", "name": "normalizes only owned data and freezes all nested public output"},
+        {"file": "tests/account-model-catalog.spec.ts", "name": "keeps image support when valid document media types accompany image types"},
+        {"file": "tests/account-model-catalog.spec.ts", "name": "keeps a text model available without claiming images when only document media types are explicit"}
+      ]
+    },
+    {
+      "id": "account-scoped-discovery-snapshot",
+      "required": true,
+      "activation": "bounded-account-freshness-with-display-only-stale-metadata",
+      "sourceMarkers": [
+        {"file": "src/account-model-source.ts", "marker": "createAccountModelSource"},
+        {"file": "src/account-model-source.ts", "marker": "redirect: 'error'"},
+        {"file": "src/account-model-source.ts", "marker": "assertAuthCurrent"},
+        {"file": "src/account-model-source.ts", "marker": "ACCOUNT_MODEL_CATALOG_LIMITS.maxBytes"}
+      ],
+      "tests": [
+        {"file": "tests/account-model-source.spec.ts", "name": "is lazy, uses exact trusted root GET with non-forwarding redirects, and freezes only public snapshot data"},
+        {"file": "tests/account-model-source.spec.ts", "name": "coalesces force and ordinary callers while one request is in flight"},
+        {"file": "tests/account-model-source.spec.ts", "name": "does not let a cancelled waiter abort another waiter"},
+        {"file": "tests/account-model-source.spec.ts", "name": "cancels orphaned work when all waiters abort and does not publish a late result"},
+        {"file": "tests/account-model-source.spec.ts", "name": "does not fall back to an old cached account after a forced refresh failure"},
+        {"file": "tests/account-model-source.spec.ts", "name": "invalidate is network-free and an invalidated HTTP result cannot overwrite a newer load"},
+        {"file": "tests/account-model-source.spec.ts", "name": "bounds timeout during %s even if the dependency ignores cancellation"},
+        {"file": "tests/account-model-source.spec.ts", "name": "enforces cumulative UTF-8 byte limits rather than trusting content length"},
+        {"file": "tests/account-model-source.spec.ts", "name": "rejects malformed UTF-8 and clears the reader without preserving response contents"},
+        {"file": "tests/account-model-source.spec.ts", "name": "refuses sensitive header override %s"},
+        {"file": "tests/account-model-source.spec.ts", "name": "defaults to a day-long metadata cache and a five-minute passive failure cooldown"},
+        {"file": "tests/account-model-source.spec.ts", "name": "force bypasses the cooldown, concurrent callers coalesce, and invalidation resets it"},
+        {"file": "tests/account-model-source.spec.ts", "name": "retains same-generation display metadata across TTL expiry, loading, and fetch failure without fresh reuse"}
+      ]
+    },
+    {
+      "id": "public-adapter-account-model-route",
+      "required": true,
+      "activation": "published-adapter-and-native-sdk",
+      "sourceMarkers": [
+        {"file": "src/preview-route.ts", "marker": "extends PiAiAdapter"},
+        {"file": "src/preview-route.ts", "marker": "modelErrors: new Map<string, string>()"},
+        {"file": "src/preview-route.ts", "marker": "ctx.llm.registerAdapter"},
+        {"file": "src/preview-route.ts", "marker": "createAccountModelSource"},
+        {"file": "src/preview-provider.ts", "marker": "native.streamSimple"},
+        {"file": "src/pi-provider-bridge.ts", "marker": "PiStreamPublicCompatibility"}
+      ],
+      "tests": [
+        {"file": "tests/preview-provider.spec.ts", "name": "routes an unseen ID through published Core and native %s with Bearer auth"},
+        {"file": "tests/preview-provider.spec.ts", "name": "takes protocol and independent input limits from descriptor evidence rather than the local GPT-6 catalog"},
+        {"file": "tests/preview-provider.spec.ts", "name": "does not infer controls from a name or unfamiliar advertised effort labels"},
+        {"file": "tests/preview-route.spec.ts", "name": "resolves and prepares a validated account model with the actual Core profile diagnostics contract"},
+        {"file": "tests/inline/apply.spec.ts", "name": "delegates Anthropic in-band system authority before probing at position %s"},
+        {"file": "tests/preview-route.spec.ts", "name": "discovers mixed and unseen account models without model-name routing rules"},
+        {"file": "tests/preview-route.spec.ts", "name": "uses unmodified stock LlmRuntime preparation and leaves canonical model registration alone"},
+        {"file": "tests/preview-route.spec.ts", "name": "replays opaque reasoning and tool-call identities through the native adapter on a second turn"},
+        {"file": "tests/pi-provider-bridge.spec.ts", "name": "preserves the stream object rather than copying or replacing its private queue"},
+        {"file": "tests/pi-provider-bridge.spec.ts", "name": "passes the checked simple input through and rejects unsupported advanced entry without I/O"}
+      ]
+    },
+    {
+      "id": "managed-model-generation-and-lifetime",
+      "required": true,
+      "sourceMarkers": [
+        {"file": "src/preview-route.ts", "marker": "COPILOT_PREVIEW_METADATA_STALE"},
+        {"file": "src/preview-route.ts", "marker": "copilotEntitlementKey"},
+        {"file": "src/preview-route.ts", "marker": "credentials/record-updated"},
+        {"file": "src/preview-route.ts", "marker": "renewBeforeLease"},
+        {"file": "src/account-model-auth.ts", "marker": "minOAuthValidityMs: ACCOUNT_MODEL_AUTH_MIN_VALIDITY_MS"}
+      ],
+      "tests": [
+        {"file": "tests/preview-route.spec.ts", "name": "renews warm metadata before native OAuth refresh invalidates a new %s lease"},
+        {"file": "tests/preview-route.spec.ts", "name": "applies the warm renewal boundary with %i milliseconds remaining"},
+        {"file": "tests/preview-route.spec.ts", "name": "joins a warm renewal flight across catalog and model callers"},
+        {"file": "tests/preview-route.spec.ts", "name": "joins an existing metadata HTTP flight when token validity crosses the renewal threshold"},
+        {"file": "tests/preview-route.spec.ts", "name": "bounds a warm renewal %s without model wire or cooldown bypass"},
+        {"file": "tests/preview-route.spec.ts", "name": "persists warm-refresh entitlement removal without dispatching the formerly allowed model"},
+        {"file": "tests/preview-route.spec.ts", "name": "does not rebind or replay an old prepared lease after it crosses the native refresh window"},
+        {"file": "tests/preview-route.spec.ts", "name": "requires rediscovery when an already prepared token rotates without a credential notification"},
+        {"file": "tests/preview-route.spec.ts", "name": "rejects silent same-token entitlement removal before dispatch and requires rediscovery"},
+        {"file": "tests/preview-route.spec.ts", "name": "does not serve expired catalog facts or prepared model snapshots"},
+        {"file": "tests/preview-route.spec.ts", "name": "invalidates prepared model metadata on an explicit force-discovery without changing the selected ID"},
+        {"file": "tests/preview-route.spec.ts", "name": "cancels an in-flight SDK request on disposal without deleting the shared grant"},
+        {"file": "tests/preview-route.spec.ts", "name": "allows Core retry middleware to re-dispatch the same prepared adapter snapshot"},
+        {"file": "tests/preview-route.spec.ts", "name": "does not let a retry cross to another account after its first attempt"},
+        {"file": "tests/preview-route.spec.ts", "name": "refuses a duplicate route through the public registry without taking over the existing adapter"},
+        {"file": "tests/preview-route.spec.ts", "name": "withdraws only its own route and refuses an already-prepared call after disposal"}
+      ]
+    },
+    {
+      "id": "account-discovery-native-oauth",
+      "required": true,
+      "sourceMarkers": [
+        {"file": "src/account-model-auth.ts", "marker": "models.getAuth(GITHUB_COPILOT_PROVIDER_ID"},
+        {"file": "src/account-model-auth.ts", "marker": "auth: { oauth: guardedOAuth }"},
+        {"file": "src/account-model-auth.ts", "marker": "trustedGitHubCopilotBaseUrl"}
+      ],
+      "tests": [
+        {"file": "tests/account-model-auth.spec.ts", "name": "resolves provider OAuth without a model catalog entry or environment fallback"},
+        {"file": "tests/account-model-auth.spec.ts", "name": "refreshes through native Models and persists only the canonical credential"},
+        {"file": "tests/account-model-auth.spec.ts", "name": "rejects account replacement during refresh without overwriting the replacement"},
+        {"file": "tests/account-model-auth.spec.ts", "name": "validates credential-specific Enterprise endpoints and rejects token-controlled foreign origins"},
+        {"file": "tests/account-model-auth.spec.ts", "name": "sanitizes credential backend failures and keeps account identity independent of token rotation"}
+      ]
+    },
+    {
+      "id": "responses-public-reasoning-and-safe-replay-delegation",
+      "required": true,
+      "sourceMarkers": [
+        {"file": "src/wire.ts", "marker": "response.reasoning_summary_text.delta"},
+        {"file": "src/responses-reasoning.ts", "marker": "request.reasoningEffort ?? profile?.reasoning"},
+        {"file": "src/serialize.ts", "marker": "reasoning: { effort: reasoning.effort, summary: reasoning.summary }"},
+        {"file": "src/serialize.ts", "marker": "message.source.replayState"},
+        {"file": "src/index.ts", "marker": "hasResponsesReplayContext(request.messages)"}
+      ],
+      "tests": [
+        {"file": "tests/inline/apply.spec.ts", "name": "transmits the selected effort and preserves the returned public summary"},
+        {"file": "tests/inline/apply.spec.ts", "name": "keeps preview conversations on their registered native adapter before any probe"},
+        {"file": "tests/inline/apply.spec.ts", "name": "delegates opaque assistant replay state without serializing its fields"},
+        {"file": "tests/inline/serialize.spec.ts", "name": "refuses the actual Core source.replayState location without opening its payload"},
+        {"file": "tests/responses-reasoning.spec.ts", "name": "honors request effort before the profile default and asks for a public summary"},
+        {"file": "tests/responses-reasoning.spec.ts", "name": "does not force a reasoning mode without a selection"},
+        {"file": "tests/responses-reasoning.spec.ts", "name": "preserves the Core off omission rather than claiming to disable server reasoning"},
+        {"file": "tests/preview-provider.spec.ts", "name": "does not synthesize none or disabled thinking by default for %s"},
+        {"file": "tests/preview-route.spec.ts", "name": "preserves the native enabled reasoning setting %s and summary request"}
+      ]
+    },
+    {
+      "id": "replay-safe-copilot-reasoning-presentation",
+      "required": true,
+      "activation": "optional-guarded-client-seam",
+      "sourceMarkers": [
+        {"file": "src/client.ts", "marker": "ctx.inject(['uiConversation', 'slots']"},
+        {"file": "src/reasoning-presentation.ts", "marker": "projectReasoningPresentation"},
+        {"file": "src/reasoning-presentation.ts", "marker": "github-copilot-assistant-origin"}
+      ],
+      "tests": [
+        {"file": "tests/reasoning-presentation.spec.ts", "name": "removes fifteen empty rows without reading or changing encrypted durable replay material"},
+        {"file": "tests/reasoning-presentation.spec.ts", "name": "reconstructs cold/prepended history without step/start and never borrows a current route"},
+        {"file": "tests/reasoning-presentation.spec.ts", "name": "retires on any third-party override conflict and resumes only when safe"},
+        {"file": "tests/client.spec.ts", "name": "does not delay authorization while the optional reasoning presentation waits for Core services"},
+        {"file": "tests/fixtures/reasoning-presentation-core.fixture.ts", "name": "renders answers and public summaries without the fifteen empty native Think rows"}
+      ]
+    },
+    {
+      "id": "client-module-loader-handoff",
+      "required": true,
+      "sourceMarkers": [
+        {"file": "tsdown.config.ts", "marker": "window.__ModuleLoader__.load"},
+        {"file": "tsdown.config.ts", "marker": "return module.exports"}
+      ],
+      "tests": [
+        {"file": "tests/client-bundle.spec.ts", "name": "hands off the built client with the exact plugin id and injected require"},
+        {"file": "tests/client-bundle.spec.ts", "name": "materializes the built client apply and inject exports"}
+      ]
+    },
+    {
+      "id": "strict-remote-result-codecs",
+      "required": true,
+      "sourceMarkers": [
+        {"file": "src/remote.ts", "marker": "dsh-github-copilot#GitHubCopilotAuthorizationView"},
+        {"file": "src/remote.ts", "marker": "mode: 'strict'"},
+        {"file": "src/remote.ts", "marker": "accountModels: z.object"}
+      ],
+      "tests": [
+        {"file": "tests/client-bundle.spec.ts", "name": "mounts strict Host result codecs through the published rc.1 client carrier"},
+        {"file": "tests/account-model-remote.spec.ts", "name": "registers %s with the same strict safe authorization view codec"},
+        {"file": "tests/account-model-remote.spec.ts", "name": "rejects private or unrequested discovery field %s"},
+        {"file": "tests/account-model-remote.spec.ts", "name": "rejects secret-bearing model entries and oversized model lists"},
+        {"file": "tests/migration-status.spec.ts", "name": "keeps noargs Remote migration evidence separate and ordinary status unchanged"},
+        {"file": "tests/migration-status.spec.ts", "name": "uses the real public Session projection registry for pending versus old request headers"},
+        {"file": "tests/migration-status.spec.ts", "name": "reads only named public leaves, not private titles history credentials or settings"}
+      ]
+    },
+    {
+      "id": "authorization-service-bootstrap",
+      "required": true,
+      "sourceMarkers": [
+        {"file": "src/index.ts", "marker": "ctx.get('authorization', false)"},
+        {"file": "src/index.ts", "marker": "ctx.plugin(AuthorizationService)"},
+        {"file": "src/index.ts", "marker": "ctx.inject(integrationInject"}
+      ],
+      "tests": [
+        {"file": "tests/loader-composition.spec.ts", "name": "bootstraps authorization in the rc.2 web profile before activating the integration"},
+        {"file": "tests/loader-composition.spec.ts", "name": "reuses the rc.1 authorization service without duplicate registration"}
+      ]
+    },
+    {
+      "id": "models-provider-card-authorization",
+      "required": true,
+      "sourceMarkers": [
+        {"file": "src/client.ts", "marker": "settings.models.provider-card"},
+        {"file": "src/client.ts", "marker": "copyAuthorizationCode"},
+        {"file": "src/client.ts", "marker": "data-dsh-github-copilot-device-code"},
+        {"file": "src/authorization-controller.ts", "marker": "GitHubCopilotAuthorizationController"}
+      ],
+      "tests": [
+        {"file": "tests/client.spec.ts", "name": "exposes a device code only while authorization is in flight"},
+        {"file": "tests/client.spec.ts", "name": "renders the device code prominently with an explicit copy action"},
+        {"file": "tests/client.spec.ts", "name": "announces successful and failed copy outcomes accessibly"},
+        {"file": "tests/client.spec.ts", "name": "copies the exact one-time code through the supplied clipboard writer"},
+        {"file": "tests/client.spec.ts", "name": "mounts its Remote contribution and registers the rc.1 provider-card seat"},
+        {"file": "tests/authorization-controller.spec.ts", "name": "signs in through the built-in flow without recreating a canonical profile"},
+        {"file": "tests/authorization-controller.spec.ts", "name": "clears the one-time device code immediately when sign-in is cancelled"},
+        {"file": "tests/authorization-controller.spec.ts", "name": "clears the one-time device code when authorization fails"}
+      ]
+    },
+    {
+      "id": "canonical-owner-preservation",
+      "required": true,
+      "sourceMarkers": [
+        {"file": "src/authorization-controller.ts", "marker": "Existing Core/user profiles keep"},
+        {"file": "src/authorization-controller.ts", "marker": "path: ['providers', GITHUB_COPILOT_PROVIDER_ID, 'compat', 'supportsStrictMode']"}
+      ],
+      "tests": [
+        {"file": "tests/authorization-controller.spec.ts", "name": "preserves canonical models and all unrelated profile fields instead of projecting the companion catalog"},
+        {"file": "tests/authorization-controller.spec.ts", "name": "keeps a missing canonical profile intentionally absent for new account models"},
+        {"file": "tests/authorization-controller.spec.ts", "name": "does not reorder or replace canonical models when account IDs are duplicated or reordered"},
+        {"file": "tests/authorization-controller.spec.ts", "name": "does not add or remove canonical models based on a conflicting local GPT-6 entry"},
+        {"file": "tests/authorization-controller.spec.ts", "name": "does not judge a user route protocol using another catalog copy"},
+        {"file": "tests/authorization-controller.spec.ts", "name": "signs out by deleting only the llm-pi-ai Copilot record and keeps the route profile"}
+      ]
+    },
+    {
+      "id": "copilot-optional-tool-arguments",
+      "required": true,
+      "sourceMarkers": [
+        {"file": "src/tool-schema-compat.ts", "marker": "assembly.variables.provider !== GITHUB_COPILOT_PROVIDER_ID"},
+        {"file": "src/tool-schema-compat.ts", "marker": "ESCALATION_FIELDS"},
+        {"file": "src/tool-schema-compat.ts", "marker": "GOAL_UPDATE_TOOL_NAME"},
+        {"file": "scripts/verify-upstream-baseline.mjs", "marker": "baseline.strictModeCompat === 'route-switch'"}
+      ],
+      "tests": [
+        {"file": "tests/tool-schema-compat.spec.ts", "name": "removes escalation properties and required entries only for Copilot"},
+        {"file": "tests/tool-schema-compat.spec.ts", "name": "turns update_goal into action-specific schemas only for Copilot"},
+        {"file": "tests/tool-schema-compat.spec.ts", "name": "preserves every schema for non-Copilot providers"},
+        {"file": "tests/tool-schema-compat.spec.ts", "name": "filters a real Cordis waterfall after model selection supplies the provider"},
+        {"file": "tests/authorization-controller.spec.ts", "name": "preserves configured Anthropic and OpenAI models while repairing only strict mode"},
+        {"file": "tests/fixtures/controlled-core-per-model-api.fixture.ts", "name": "applies route strict-mode compatibility only to supported model protocols"}
+      ]
+    },
+    {
+      "id": "selected-account-route-protocol-facts",
+      "required": true,
+      "sourceMarkers": [
+        {"file": "src/current-provider.ts", "marker": "routeFacts"},
+        {"file": "src/preview-route.ts", "marker": "source.readSnapshot()"},
+        {"file": "src/preview-provider.ts", "marker": "api: descriptor.api"}
+      ],
+      "tests": [
+        {"file": "tests/current-provider.spec.ts", "name": "uses the owning account snapshot for an arbitrary new model on %s"},
+        {"file": "tests/current-provider.spec.ts", "name": "does not fall back to the local GPT-6 catalog when account evidence expires"},
+        {"file": "tests/current-provider.spec.ts", "name": "copies only protocol and endpoint leaves without exposing private snapshot fields"},
+        {"file": "tests/current-provider.spec.ts", "name": "does not claim an unmounted route belongs to the plugin"}
+      ]
+    },
+    {
+      "id": "existing-grant-legacy-profile-repair",
+      "required": true,
+      "sourceMarkers": [
+        {"file": "src/index.ts", "marker": "ensureGitHubCopilotProviderProfile(ctx)"},
+        {"file": "src/authorization-controller.ts", "marker": "validateGrant(record)"},
+        {"file": "src/authorization-controller.ts", "marker": "providerSupportsStrictMode"}
+      ],
+      "tests": [
+        {"file": "tests/loader-composition.spec.ts", "name": "repairs an existing valid Copilot grant during Host startup"},
+        {"file": "tests/authorization-controller.spec.ts", "name": "repairs a pre-existing grant with an empty Copilot route"},
+        {"file": "tests/authorization-controller.spec.ts", "name": "is idempotent when the existing resolved Copilot route matches the account catalog"},
+        {"file": "tests/authorization-controller.spec.ts", "name": "does not install global protocols or headers for new account models"}
+      ]
+    },
+    {
+      "id": "read-only-status-and-explicit-discovery",
+      "required": true,
+      "sourceMarkers": [
+        {"file": "src/authorization-controller.ts", "marker": "accountModelsView"},
+        {"file": "src/authorization-controller.ts", "marker": "async discoverModels()"},
+        {"file": "src/remote.ts", "marker": "'status', 'reconcile', 'discoverModels', 'ensureModels', 'start', 'cancel', 'signOut'"}
+      ],
+      "tests": [
+        {"file": "tests/authorization-controller.spec.ts", "name": "reads status repeatedly without repairing, authorizing or making network calls"},
+        {"file": "tests/authorization-controller.spec.ts", "name": "exposes only owned model presentation leaves and never discovers during status"},
+        {"file": "tests/authorization-controller.spec.ts", "name": "discovers account models only on an explicit action without changing selection or settings"},
+        {"file": "tests/authorization-controller.spec.ts", "name": "keeps discovery unavailable or failed separate from sign-in and sanitizes failures"},
+        {"file": "tests/client.spec.ts", "name": "discovers account models only on a click and deduplicates clicks while busy"},
+        {"file": "tests/client.spec.ts", "name": "does not poll or automatically rediscover a loading server snapshot"},
+        {"file": "tests/client.spec.ts", "name": "does not let a previous Remote overwrite a newly mounted discovery result"}
+      ]
+    },
+    {
+      "id": "credential-bound-lazy-search-proof",
+      "required": true,
+      "sourceMarkers": [
+        {"file": "src/index.ts", "marker": "credentials/record-updated"},
+        {"file": "src/index.ts", "marker": "invalidatePlans"},
+        {"file": "src/probe.ts", "marker": "signal?: AbortSignal"}
+      ],
+      "tests": [
+        {"file": "tests/inline/apply.spec.ts", "name": "retries a cached missing-grant failure on a same-route credential event"},
+        {"file": "tests/inline/apply.spec.ts", "name": "evicts a successful proof for revocation/account changes and coalesces event bursts"},
+        {"file": "tests/inline/apply.spec.ts", "name": "ignores unrelated record updates and retains the verified proof"},
+        {"file": "tests/inline/apply.spec.ts", "name": "rejects account replacement during search auth after a successful proof"},
+        {"file": "tests/inline/apply.spec.ts", "name": "makes no network calls at attach, availability checks, settings or credential events"},
+        {"file": "tests/inline/apply.spec.ts", "name": "removes its Fiber listener and makes retained entry points inert on disposal"}
+      ]
+    },
+    {
+      "id": "legacy-route-conflict-protection",
+      "required": true,
+      "activation": "legacy-restoration-only",
+      "sourceMarkers": [
+        {"file": "src/route-ownership.ts", "marker": "postimage"},
+        {"file": "src/route-ownership.ts", "marker": "TEMPORARY_ROUTE_LEGACY_CONFLICT"},
+        {"file": "src/route-ownership.ts", "marker": "sourceEpoch"},
+        {"file": "src/route-ownership.ts", "marker": "redactSecrets: true"}
+      ],
+      "tests": [
+        {"file": "tests/route-ownership.spec.ts", "name": "compares raw model ownership despite schema-materialized defaults"},
+        {"file": "tests/route-ownership.spec.ts", "name": "refuses unsafe preimage extras without copying sensitive data"},
+        {"file": "tests/route-ownership.spec.ts", "name": "uses namespace revisions to reject races after ownership backup commits"},
+        {"file": "tests/route-ownership.spec.ts", "name": "does not guess ownership for legacy or malformed backups"},
+        {"file": "tests/route-ownership.spec.ts", "name": "fails closed on prepared activation retry without registration lifetime evidence"},
+        {"file": "tests/route-ownership.spec.ts", "name": "read-only planning reports ready only after reconciliation"}
+      ]
+    },
+    {
+      "id": "legacy-global-override-restoration",
+      "required": true,
+      "activation": "legacy-restoration-only",
+      "newGlobalProtocolOverrides": false,
+      "sourceMarkers": [
+        {"file": "src/authorization-controller.ts", "marker": "target: { ...backup.preimage }"},
+        {"file": "src/authorization-controller.ts", "marker": "op: 'unset'"},
+        {"file": "src/config.ts", "marker": "temporaryRouteBackup: z.string().hidden()"},
+        {"file": "src/route-ownership.ts", "marker": "wholeProfileOwned"}
+      ],
+      "tests": [
+        {"file": "tests/authorization-controller.spec.ts", "name": "restores the owned canonical override without creating another ownership cycle"},
+        {"file": "tests/authorization-controller.spec.ts", "name": "refuses a legacy prepared activation without replaying its route write"},
+        {"file": "tests/authorization-controller.spec.ts", "name": "retries backup cleanup after route restoration commits first"},
+        {"file": "tests/authorization-controller.spec.ts", "name": "rejects malformed temporary route backup leaves before replay"},
+        {"file": "tests/route-ownership.spec.ts", "name": "restores a historical bounded journal without copying unrelated sensitive leaves"},
+        {"file": "tests/route-ownership.spec.ts", "name": "retains a user-edited formerly owned header during restoration"}
+      ]
+    },
+    {
+      "id": "shared-copilot-credential-refresh",
+      "required": true,
+      "sourceMarkers": [
+        {"file": "src/copilot-auth.ts", "marker": "models.getAuth('github-copilot')"},
+        {"file": "src/copilot-auth.ts", "marker": "GITHUB_COPILOT_CREDENTIAL_KEY"},
+        {"file": "src/index.ts", "marker": "createGitHubCopilotTokenResolver(ctx, async () =>"}
+      ],
+      "tests": [
+        {"file": "tests/copilot-auth.spec.ts", "name": "refreshes the llm-pi-ai grant in-place and returns the Copilot API token"},
+        {"file": "tests/copilot-auth.spec.ts", "name": "does not overwrite request-owned headers with local model metadata"},
+        {"file": "tests/copilot-auth.spec.ts", "name": "rejects logical provider mismatches before touching shared credential storage"},
+        {"file": "tests/copilot-auth.spec.ts", "name": "preserves the canonical grant when a serialized modification declines to change it"},
+        {"file": "tests/copilot-auth.spec.ts", "name": "rechecks model availability after refreshing the credential"},
+        {"file": "tests/preview-route.spec.ts", "name": "serializes canonical and preview refresh through the same credential key"},
+        {"file": "tests/preview-route.spec.ts", "name": "persists token-refresh revocation after preparation but never authorizes it from the earlier live catalog"}
+      ]
+    },
+    {
+      "id": "strict-json-oauth-grant-normalization",
+      "required": true,
+      "sourceMarkers": [
+        {"file": "src/copilot-grant.ts", "marker": "normalizeGitHubCopilotOAuthCredential"},
+        {"file": "src/copilot-grant.ts", "marker": "Number.isFinite(expires)"}
+      ],
+      "tests": [
+        {"file": "tests/copilot-auth.spec.ts", "name": "normalizes cross-module OAuth grants for a strict JSON credential store"},
+        {"file": "tests/copilot-auth.spec.ts", "name": "rejects malformed required OAuth fields without exposing their values"},
+        {"file": "tests/copilot-auth.spec.ts", "name": "rejects nonfinite OAuth expiry timestamps"},
+        {"file": "tests/copilot-auth.spec.ts", "name": "rejects invalid OAuth model id collections"},
+        {"file": "tests/copilot-auth.spec.ts", "name": "requires a non-empty enterprise URL when the OAuth field is present"}
+      ]
+    },
+    {
+      "id": "direct-provider-hosted-search",
+      "required": true,
+      "sourceMarkers": [
+        {"file": "src/plan.ts", "marker": "route.provider !== 'github-copilot'"},
+        {"file": "src/index.ts", "marker": "route.model !== request.model"},
+        {"file": "src/index.ts", "marker": "resolveRequestAuth"},
+        {"file": "src/copilot-request.ts", "marker": "Openai-Intent"},
+        {"file": "src/probe.ts", "marker": "RESPONSES_PROBE_ROUNDS = 2"}
+      ],
+      "tests": [
+        {"file": "tests/inline/apply.spec.ts", "name": "captures an explicit request model instead of substituting a changed Session selection"},
+        {"file": "tests/inline/apply.spec.ts", "name": "routes concurrent hosted tools from real model-selection request headers rather than activation seeds"},
+        {"file": "tests/inline/apply.spec.ts", "name": "disposes only A during final %s HTTP %s while B completes without cross-cancellation"},
+        {"file": "tests/inline/apply.spec.ts", "name": "ensures cold metadata only on actual search and captures selection before discovery awaits"},
+        {"file": "tests/preview-route.spec.ts", "name": "resolves Host-only search auth from the live generic snapshot without exposing it in status"},
+        {"file": "tests/copilot-request.spec.ts", "name": "combines installed catalog headers with provider-required request metadata"},
+        {"file": "tests/copilot-request.spec.ts", "name": "applies a credential-specific Copilot endpoint before request construction"},
+        {"file": "tests/copilot-request.spec.ts", "name": "preserves the Anthropic v1 path on a credential-specific endpoint"},
+        {"file": "tests/copilot-request.spec.ts", "name": "adds dynamic headers for business and enterprise Copilot endpoints"},
+        {"file": "tests/probe.spec.ts", "name": "confirms support via the standard spelling and reports it"},
+        {"file": "tests/probe.spec.ts", "name": "bounds all-transient replies to two complete spelling rounds"},
+        {"file": "tests/probe.spec.ts", "name": "shares one whole-probe deadline and signal across retries"},
+        {"file": "tests/inline/wire.spec.ts", "name": "skips web_search_call events and streams the answer normally"},
+        {"file": "tests/inline/wire.spec.ts", "name": "skips a pass-through function_call named web_search without slotting it"}
+      ]
+    },
+    {
+      "id": "hosted-search-file-context-fail-closed",
+      "required": true,
+      "sourceMarkers": [{"file": "src/index.ts", "marker": "contentHasFileCompat(message.content)"}],
+      "tests": [
+        {"file": "tests/inline/apply.spec.ts", "name": "preserves a top-level user file when bypassing the custom wire"},
+        {"file": "tests/inline/apply.spec.ts", "name": "preserves a file nested in tool-result content when bypassing the custom wire"},
+        {"file": "tests/preview-route.spec.ts", "name": "uses native attachment projection and execution-world mapping when available: %s"},
+        {"file": "tests/preview-route.spec.ts", "name": "keeps the mapped read-only path when Core offloads an image to fit its request budget"}
+      ]
+    },
+    {
+      "id": "traditional-search-bridge",
+      "required": true,
+      "sourceMarkers": [
+        {"file": "src/traditional-search.ts", "marker": "github-copilot-hosted"},
+        {"file": "README.md", "marker": "github-copilot.searchFallback"},
+        {"file": "README.md", "marker": "Fetch is unchanged."},
+        {"file": "README.zh.md", "marker": "github-copilot.searchFallback"},
+        {"file": "README.zh.md", "marker": "网页抓取不变"}
+      ],
+      "tests": [
+        {"file": "tests/traditional-search.spec.ts", "name": "normalizes generated content and deduplicated sources"},
+        {"file": "tests/traditional-search.spec.ts", "name": "honors caller abort before credential or network access"},
+        {"file": "tests/traditional-search.spec.ts", "name": "maps HTTP errors without leaking credentials or provider bodies"}
+      ]
+    },
+    {
+      "id": "dsh-supported-baselines-fail-loud-guard",
+      "required": true,
+      "sourceMarkers": [
+        {"file": "src/compatibility.ts", "marker": "peerRange: '0.1.1-rc.2 || 0.1.2-rc.1 || 0.1.3-alpha.1 || 0.1.5-alpha.1 || 0.1.5-alpha.2 || 0.1.5-rc.1 || 0.1.5-rc.2'"}
+      ],
+      "tests": [
+        {"file": "tests/compatibility.spec.ts", "name": "retains the original three compatibility baselines"},
+        {"file": "tests/compatibility.spec.ts", "name": "adds 0.1.5-rc.1 and 0.1.5-rc.2 without dropping earlier baselines or advancing development dependencies"},
+        {"file": "tests/compatibility.spec.ts", "name": "accepts the supported DSH service contract"},
+        {"file": "tests/compatibility.spec.ts", "name": "fails before startup when a required API is absent"}
+      ]
+    },
+    {
+      "id": "dsh-models-settings-and-managed-discovery-ui",
+      "required": true,
+      "activation": "provider-row-first-shared-account-with-exclusive-fallback",
+      "sourceMarkers": [
+        {"file": "src/client.ts", "marker": "GitHubCopilotSettingsSection"},
+        {"file": "src/client.ts", "marker": "settings.models.footer"},
+        {"file": "src/client.ts", "marker": "settingsSectionActive && !footerActive"}
+      ],
+      "tests": [
+        {"file": "tests/client.spec.ts", "name": "registers a GitHub Copilot settings section on the rc.2 Models surface"},
+        {"file": "tests/client.spec.ts", "name": "registers coordinated provider and fallback seats without starting either controller during registration"},
+        {"file": "tests/client.spec.ts", "name": "leaves authorization active when the optional footer contract is incompatible or registration fails"},
+        {"file": "tests/client.spec.ts", "name": "mounts one compact account lifecycle instead of separate authorization and discovery owners"},
+        {"file": "tests/client.spec.ts", "name": "makes explicit account discovery available in the old-Core settings fallback"},
+        {"file": "tests/client.spec.ts", "name": "explains the initial model list without inferring a completed discovery from sign-in"},
+        {"file": "tests/client.spec.ts", "name": "restores exactly one account fallback when a footer declaration is withdrawn"},
+        {"file": "tests/client.spec.ts", "name": "transfers a pending sign-in to an arriving row and back without stale actions or a second poll owner"},
+        {"file": "tests/client.spec.ts", "name": "keeps one owner across duplicate row instances and footer/settings competition"}
+      ]
+    },
+    {
+      "id": "single-managed-route-native-oauth",
+      "required": true,
+      "sourceMarkers": [
+        {"file": "src/authorization-controller.ts", "marker": "current !== undefined && providerSupportsStrictMode(current) !== false"},
+        {"file": "src/preview-route.ts", "marker": "displayName: 'GitHub Copilot'"},
+        {"file": "src/client.ts", "marker": "GitHubCopilotAccountSurface"}
+      ],
+      "tests": [
+        {"file": "tests/single-route.spec.ts", "name": "keeps the native login flow while exposing only the account-driven provider"},
+        {"file": "tests/single-route.spec.ts", "name": "discovers new IDs and reasoning metadata without a canonical model profile"},
+        {"file": "tests/single-route.spec.ts", "name": "honors an explicit legacy-profile removal without deleting OAuth or rebuilding the route"},
+        {"file": "tests/authorization-controller.spec.ts", "name": "does not recreate an absent canonical profile during status or startup and auth reconciliation helpers"},
+        {"file": "tests/authorization-controller.spec.ts", "name": "keeps absent-profile legacy journal conflicts visible instead of bypassing ownership review"}
+      ]
+    },
+    {
+      "id": "compact-account-row-and-auth-disclosure",
+      "required": true,
+      "sourceMarkers": [
+        {"file": "src/client.ts", "marker": "GitHubCopilotCompactAccount"},
+        {"file": "src/client.ts", "marker": "data-dsh-github-copilot-auto-authorization"},
+        {"file": "src/compact-account.ts", "marker": "createCompactAccount"}
+      ],
+      "tests": [
+        {"file": "tests/compact-account.spec.ts", "name": "renders a neutral checking state then only a compact signed-in row"},
+        {"file": "tests/compact-account.spec.ts", "name": "shows signed-out CTA and automatically reveals authorization without opening Manage"},
+        {"file": "tests/compact-account.spec.ts", "name": "retains manual management and live actions when toggled during authorization"},
+        {"file": "tests/compact-account.spec.ts", "name": "keeps normal refresh inside Manage and visible Retry outside for actual failures"},
+        {"file": "tests/compact-account.spec.ts", "name": "cleans timers and ignores late requests after detach or Remote replacement"},
+        {"file": "tests/compact-account.spec.ts", "name": "keeps cancellation failures visible without reviving a stale code"},
+        {"file": "tests/compact-account.spec.ts", "name": "orders cancellation after pending start so a late Host preflight cannot create an abandoned flow"},
+        {"file": "tests/compact-account.spec.ts", "name": "discovers exactly once after immediate confirmed completion and permits later manual refresh"},
+        {"file": "tests/compact-account.spec.ts", "name": "waits through repeated authorization polls and discovers only on confirmed completion"},
+        {"file": "tests/compact-account.spec.ts", "name": "keeps automatic post-login discovery owned across Manage toggles and shows a retryable error"},
+        {"file": "tests/authorization-controller.spec.ts", "name": "keeps completion pending through post-login repair so the Client discovers exactly once afterwards"},
+        {"file": "tests/compact-account.spec.ts", "name": "keeps stale count visible during initial metadata refresh without a warning or header refresh button"},
+        {"file": "tests/authorization-controller.spec.ts", "name": "ensures account metadata without forcing past the shared cache or cooldown"},
+        {"file": "tests/client.spec.ts", "name": "owns a minute-only UI timer through committed mount, timestamp change and unmount"},
+        {"file": "tests/compact-account.spec.ts", "name": "keeps the Host cache timestamp outside Manage and live regions through refresh and failure"},
+        {"file": "tests/client-bundle.spec.ts", "name": "exports the cache timestamp formatter and isolated clock component in the built Client"}
+      ]
+    }
+  ],
+  "requiredExports": {
+    ".": [
+      "GITHUB_COPILOT_HOSTED_SEARCH_PROVIDER_ID",
+      "GITHUB_COPILOT_CREDENTIAL_KEY",
+      "GitHubCopilotAuthorizationController",
+      "describeGitHubCopilotProviderProfile",
+      "ensureGitHubCopilotProviderProfile",
+      "LLM_PI_AI_SETTINGS_NAMESPACE",
+      "DSH_COMPATIBILITY",
+      "assertDshCompatibility"
+    ],
+    "./client": [],
+    "./remote": [],
+    "./routed-web": ["default"],
+    "./web-delegate": ["name", "inject", "apply"],
+    "./deployment-baseline.json": [],
+    "./package.json": []
+  }
+}