dsh-grok-provider 1.0.4 → 1.0.5

package/CHANGELOG.md

@@ -1,12 +1,19 @@
 # Changelog
 
+## 1.0.5 - 2026-09-13
+
+- Restore Grok account RPC after the DSH 0.1.5-rc.2 upgrade. Custom-channel registration failed with `cannot get property "webServer" without inject`, leaving the visible settings page unable to read account state or CLI versions.
+- Register six exact POST routes on the host-authenticated shared `/api` carrier and use namespaced Connection RPC methods from the browser. Retain host trust/authentication, request-schema validation, cancellation, and fiber-owned disposal.
+- Align Harness peers and locked development dependencies with 0.1.5-rc.2. Add real Connection registry and malformed-envelope regressions.
+- macOS isolated-Harness checks recover status, official CLI 1.0.5, grok-4.6/grok-4.5 and quota. Unauthenticated requests return 401 and foreign Origins return 403. Physical Windows sign-in and live generation were not repeated.
+
 ## 1.0.4 - 2026-09-04
 
 - Stop named-importing the deleted `@deepseek-ai/dsh-settings` helpers `installSettingsSection` and `settingsNamespace`. Register the legal string constant `llm-grok` through `ctx.settings.installSection(...)` so the Host can load on DeepSeek Harness `0.1.2-rc.1`.
 - Keep composition-config fallback when the settings service is missing or reloaded. Enable, disable, and failed-enable rollback still preserve receipts, generations, and account state.
 - Raise required Harness peers to the `0.1.2-rc.1` boundary (`dsh-settings`, `dsh-llm`, `dsh-commands`, `dsh-subprocess`, matching client packages, Cordis `4.0.2`, Schemastery `3.18.2`) and replace the removed Web inject `@deepseek-ai/dsh-client-runtime` with `@deepseek-ai/dsh-client-ui-renderer`. Pass Harness `offloadedImageText` as the required image-offload placeholder.
 - Add a Host import regression against the published `dsh-settings@0.1.2-rc.1` module graph and scan every `dist/**` file so packed artifacts cannot reintroduce the deleted helpers. Authentication recovery, Search protocol, images, fixed endpoints, and the Windows browser-login boundary are unchanged.
-- Code PR #41 merged as `61c80fff0841e44c16dabb2cc803a80c1bdf5456`; main CI run `33870741679` passed on macOS 14 and Windows 2022. Artifact digests and publication evidence remain pending until the release-evidence commit is merged and one tarball is frozen from that exact commit.
+- Code PR #41 merged as `61c80fff0841e44c16dabb2cc803a80c1bdf5456`; release-evidence PR #43 produced final release commit `62df21df08053d293ebb59c6e67597402c2305af`, whose main CI run `33873037630` passed on macOS 14 and Windows 2022. Trusted Publisher run `33873873314` published the explicitly authorized 78-file artifact: 274,332 bytes packed, 850,183 bytes unpacked, SHA-256 `464045290b06ce71b78285571c6968e6268fa403fa2350834d2dc479e88fd001`, and SRI `sha512-axCBVXQ9BI9boYrlIsa+TWURMo8tQ5GdHpcQVfXUz2OLg+5rbg3XUZSv3ZRQVYQNmyXSQ+frIBDMsbZUGaXJ6w==`. Candidate, Release, and Registry bytes match; npm reports `latest=1.0.4`, signatures and attestations verify, and SLSA provenance binds the tag, workflow, final commit, and publish run.
 
 ## 1.0.3 - 2026-08-31
 

package/README.en.md

@@ -4,11 +4,11 @@
 
 Use an already authenticated official Grok Build account from DeepSeek Harness, with dynamic model discovery, streaming reasoning, image input, optional Web/X Search, tool calls, and an account quota/model capability dashboard.
 
-> Unofficial community project; not affiliated with xAI or DeepSeek Harness. This README describes the `dsh-grok-provider@1.0.4` artifact; version `0.1.8` was published and then withdrawn and cannot be reused.
+> Unofficial community project; not affiliated with xAI or DeepSeek Harness. This README describes the `dsh-grok-provider@1.0.5` artifact; version `0.1.8` was published and then withdrawn and cannot be reused.
 
-`1.0.4` repairs the `dsh-grok-provider@1.0.3` startup failure on DeepSeek Harness `0.1.2-rc.1`: the Host no longer named-imports the removed `installSettingsSection` / `settingsNamespace` helpers and instead registers `llm-grok` through `ctx.settings.installSection(...)`. Authentication recovery, partial-output preservation, Search, images, and fixed endpoints are unchanged.
+`1.0.5` repairs unavailable account services and unknown CLI versions after upgrading to DeepSeek Harness `0.1.5-rc.2`. Six account operations now use the host-authenticated shared `/api/grok-auth/*` routes, restoring status, CLI diagnostics, model discovery, and quota reads.
 
-This README is included in the `1.0.4` npm tarball, and the exact installation command below is pinned to `1.0.4`. The previous version with completed supply-chain readback is `1.0.3`.
+This README is included in the `1.0.5` npm tarball, and the exact installation command below is pinned to `1.0.5`. The previous version with completed supply-chain readback is `1.0.4`.
 
 ## What it provides
 
@@ -19,7 +19,7 @@ This README is included in the `1.0.4` npm tarball, and the exact installation c
 | Models | Discovers every model visible to the account at runtime; no static model allowlist |
 | Conversations | Streaming Responses text, reasoning, encrypted reasoning replay, usage, and finish reasons |
 | Images | Only exact `grok-4.6` accepts bounded JPEG/PNG images from Harness attachments; `grok-4.5` and all other models remain text-only |
-| Search | Exact `grok-4.6` provides default-off Web/X Search; `1.0.4` moves settings registration onto Harness `0.1.2-rc.1` `installSection` without changing the Search protocol |
+| Search | Exact `grok-4.6` provides default-off Web/X Search; switches are saved through the live settings service |
 | Tools | Returns function calls to the Harness permission layer; the provider never executes tools, and local `web_search` / `x_search` remain when the corresponding Search setting is off |
 | Account dashboard | Login status, weekly/monthly quota, reset time, dynamic model capabilities and reasoning efforts |
 | Surfaces | Bilingual Web settings and a closed `/grok` TUI command set |
@@ -28,7 +28,7 @@ This README is included in the `1.0.4` npm tarball, and the exact installation c
 
 ### 1. Prerequisites
 
-- DeepSeek Harness `0.1.2-rc.1`
+- DeepSeek Harness `0.1.5-rc.2`
 - Node.js `24.19.0` or newer
 - macOS arm64 or Windows x64
 - Official Grok Build CLI with `login --oauth` support and the default Grok home
@@ -47,7 +47,7 @@ When the network is reachable and OIDC discovery succeeds, the official CLI open
 Install the exact version:
 
 ```sh
-dsh plugin --profile web add dsh-grok-provider@1.0.4
+dsh plugin --profile web add dsh-grok-provider@1.0.5
 dsh web
 ```
 
@@ -74,7 +74,7 @@ The Web settings page shows:
 
 When protobuf-backed billing includes a complete weekly/monthly period but omits a zero-valued percentage, the page restores “0% used / 100% remaining.” Other incomplete responses remain unknown.
 
-Harness `0.1.2-rc.1` does not expose an icon field on `settings.section`. The Provider embeds the MIT-licensed `IconThinkOutline16` path geometry from `@deepseek-ai/dsh-client-ui-primitives@0.1.0-rc.7` and displays it only when the `Grok Build` label and settings-dialog DOM structure produce one exact match; otherwise it safely keeps the Host gear. The compatibility observer, marker, and style are all removed when the plugin unloads.
+Harness `0.1.5-rc.2` does not expose an icon field on `settings.section`. The Provider embeds the MIT-licensed `IconThinkOutline16` path geometry from `@deepseek-ai/dsh-client-ui-primitives@0.1.0-rc.7` and displays it only when the `Grok Build` label and settings-dialog DOM structure produce one exact match; otherwise it safely keeps the Host gear. The compatibility observer, marker, and style are all removed when the plugin unloads.
 
 ## Plugin preview
 
@@ -145,6 +145,13 @@ Directory inclusion is not an endorsement by xAI or DeepSeek Harness. [Listing P
 
 ## Compatibility and scope
 
+### `1.0.5` fix boundary
+
+- Move six account operations to exact POST routes on shared `/api`; the host retains browser-session authentication, Host/Origin checks, and body limits.
+- Validate requests with the host schema, reject malformed or mismatched methods, and remove routes with the plugin.
+- Align dependencies with DSH `0.1.5-rc.2`. An isolated macOS instance verifies status, CLI `1.0.5`, both models, and quota; unauthenticated requests return 401 and foreign Origins return 403.
+- Physical Windows browser sign-in and live generation were not repeated. See [release notes](docs/releases/v1.0.5.md).
+
 ### `1.0.4` repair boundary
 
 - The Host no longer named-imports `installSettingsSection` or `settingsNamespace` from `@deepseek-ai/dsh-settings`; it registers the legal string constant `llm-grok` through the settings service `installSection` API.
@@ -184,11 +191,11 @@ Directory inclusion is not an endorsement by xAI or DeepSeek Harness. [Listing P
 - Two-layer redacted real-account verification passed against the final source: raw Web/X probes each completed one 64-event response, observed the requested Search kind, and reached `completed`; the production adapter completed 5 Responses calls, with direct Web/X both ending in `stop` and a Harness-shaped local `x_search` call/result continuation ending `tool-calls`, `tool-calls`, then `stop`, with one local call in each of the first two turns. That continuation did not place a Harness `x_search` function definition beside an xAI `{ type: "x_search" }` server descriptor in the same wire request; `1.0.1` later isolated that combination as an HTTP 400 conflict. No results, URLs, prompts, identity, or credentials were retained; this is not publication, OAuth, or real-device Windows evidence.
 - The manifest and lockfile are synchronized at `1.0.0`; the Node 24 suite reports 245 tests, 243 pass, 0 fail, and 2 platform skips. Production audit reports zero vulnerabilities, and the deterministic build/bundle comparison, 72-entry dry-run pack, secret scan, and diff check pass. Code PR #28, main CI run [`33308371009`](https://github.com/yoshino-xiao7/dsh-grok-provider/actions/runs/33308371009), the final release commit, dual-platform final CI, unique artifact, exact authorization, and Registry/signature/attestation/provenance readback are complete.
 
-| Item | `1.0.4` compatibility boundary |
+| Item | `1.0.5` compatibility boundary |
 | --- | --- |
-| DeepSeek Harness | Exact support for `0.1.2-rc.1` |
+| DeepSeek Harness | Exact support for `0.1.5-rc.2` |
 | Node.js | `>=24.19.0` |
-| macOS arm64 | Image sending has real-Harness confirmation; `1.0.4` repairs `0.1.2-rc.1` settings registration |
+| macOS arm64 | Image sending has real-Harness confirmation; `1.0.5` validates account RPC on `0.1.5-rc.2` |
 | Windows x64 | The code path and existing slow fakes are unchanged. On a reachable network the official CLI generates the URL and opens the browser, and that path still lacks real-device Windows acceptance |
 | macOS x64 / Linux | Unsupported |
 | Grok CLI | No full-version lock; official path, `login --oauth` capability, and production OIDC credential contract are enforced |

package/README.md

@@ -4,11 +4,11 @@
 
 让 DeepSeek Harness 使用你已登录的官方 Grok Build 账号：动态模型发现、流式推理、图片输入、可选 Web/X Search、工具调用，以及账号额度与模型能力面板。
 
-> 非官方社区项目，与 xAI 或 DeepSeek Harness 官方无隶属关系。本说明对应 `dsh-grok-provider@1.0.4` 制品；`0.1.8` 曾发布后撤回且版本号不可复用。
+> 非官方社区项目，与 xAI 或 DeepSeek Harness 官方无隶属关系。本说明对应 `dsh-grok-provider@1.0.5` 制品；`0.1.8` 曾发布后撤回且版本号不可复用。
 
-`1.0.4` 修复 `dsh-grok-provider@1.0.3` 在 DeepSeek Harness `0.1.2-rc.1` 中启用后 Runtime 无法到达 ready 的问题：Host 不再 named import 已删除的 `installSettingsSection` / `settingsNamespace`，改用 `ctx.settings.installSection(...)` 注册 `llm-grok`。认证恢复、部分输出保留、Search、图片与固定 endpoint 边界不变。
+`1.0.5` 修复更新到 DeepSeek Harness `0.1.5-rc.2` 后账户页面显示“服务不可用”、CLI 版本未知的问题。六个账户操作改用主机认证的共享 `/api/grok-auth/*` 路由，恢复登录状态、CLI 检测、模型目录与额度读取。
 
-本 README 随 `1.0.4` 一起进入 npm tarball，下面的精确安装命令也固定为 `1.0.4`。上一份已完成供应链回读的版本为 `1.0.3`。
+本 README 随 `1.0.5` 一起进入 npm tarball，下面的精确安装命令也固定为 `1.0.5`。上一份已完成供应链回读的版本为 `1.0.4`。
 
 ## 它解决什么问题
 
@@ -19,7 +19,7 @@
 | 模型 | 运行时读取账号可见的全部 Grok Build 模型，不维护静态模型白名单 |
 | 对话 | Responses 流式文本、reasoning、加密 reasoning replay、usage 与 finish reason |
 | 图片 | 仅精确 `grok-4.6` 接收 Harness attachment 中有界的 JPEG/PNG 图片；`grok-4.5` 与其他模型保持 text-only |
-| 搜索 | 精确 `grok-4.6` 提供默认关闭的 Web/X Search；`1.0.4` 把 settings 注册切到 Harness `0.1.2-rc.1` 的 `installSection`，不改变 Search 协议 |
+| 搜索 | 精确 `grok-4.6` 提供默认关闭的 Web/X Search；使用实时 settings service 保存开关 |
 | 工具 | 将 function call 交回 Harness 权限层；Provider 本身不执行工具，关闭对应 Search 开关时保留本地 `web_search` / `x_search` |
 | 账户面板 | 登录状态、每周/月额度、重置时间、动态模型能力与 reasoning 档位 |
 | 界面 | Web 设置页中英文切换；TUI 提供闭合的 `/grok` 命令 |
@@ -28,7 +28,7 @@
 
 ### 1. 准备环境
 
-- DeepSeek Harness `0.1.2-rc.1`
+- DeepSeek Harness `0.1.5-rc.2`
 - Node.js `24.19.0` 或更高版本
 - macOS arm64 或 Windows x64
 - 官方 Grok Build CLI（支持 `login --oauth`，并使用官方默认 Grok home）
@@ -47,7 +47,7 @@ grok models
 安装精确版本：
 
 ```sh
-dsh plugin --profile web add dsh-grok-provider@1.0.4
+dsh plugin --profile web add dsh-grok-provider@1.0.5
 dsh web
 ```
 
@@ -74,7 +74,7 @@ Web 设置页展示：
 
 当 protobuf-backed billing 返回完整的 weekly/monthly 周期但省略零值百分比时，页面会恢复为“已使用 0% / 剩余 100%”；其他不完整响应保持未知，不伪造额度。
 
-当前 Harness `0.1.2-rc.1` 的 `settings.section` 没有插件图标字段。Provider 内嵌来自 `@deepseek-ai/dsh-client-ui-primitives@0.1.0-rc.7`、采用 MIT 许可的 `IconThinkOutline16` 路径几何；仅当设置对话框中的标签与 DOM 结构都精确且唯一匹配时，才用它显示 `Grok Build` 导航项，否则安全保留宿主齿轮。兼容层的观察器、标记和样式均随插件卸载清理。
+Harness `0.1.5-rc.2` 的 `settings.section` 没有插件图标字段。Provider 内嵌来自 `@deepseek-ai/dsh-client-ui-primitives@0.1.0-rc.7`、采用 MIT 许可的 `IconThinkOutline16` 路径几何；仅当设置对话框中的标签与 DOM 结构都精确且唯一匹配时，才用它显示 `Grok Build` 导航项，否则安全保留宿主齿轮。兼容层的观察器、标记和样式均随插件卸载清理。
 
 ## 插件预览
 
@@ -145,6 +145,13 @@ dsh web
 
 ## 兼容性与范围
 
+### `1.0.5` 修复边界
+
+- 六个账户操作迁移到共享 `/api` 精确 POST 路由；主机保留浏览器会话认证、Host/Origin 检查和请求体限制。
+- 使用主机请求 schema，拒绝错误方法、畸形请求和路径不匹配；随插件卸载清理路由。
+- 依赖对齐 DSH `0.1.5-rc.2`。macOS 隔离实例验证状态、CLI `1.0.5`、两个模型和额度；未认证返回 401，跨来源返回 403。
+- Windows 真机浏览器登录和本版真实生成未重测。见 [版本说明](docs/releases/v1.0.5.md)。
+
 ### `1.0.4` 修复边界
 
 - Host 不再从 `@deepseek-ai/dsh-settings` named import `installSettingsSection` 或 `settingsNamespace`；改用 settings service 的 `installSection`，namespace 为合法字符串常量 `llm-grok`。
@@ -184,11 +191,11 @@ dsh web
 - 最终源码完成两层脱敏真实账号复验：原始 Web/X 协议探针各 1 次请求、各 64 events，分别观察到对应 Search 且终态 `completed`；生产 adapter 共完成 5 次 Responses，direct Web/X 均为 `stop`，Harness 形状的本地 `x_search` call/result 续跑三轮依次为 `tool-calls`、`tool-calls`、`stop`，前两轮各 1 次本地调用。该续跑没有在同一 wire request 中同时放入 Harness `x_search` function definition 与 xAI `{ type: "x_search" }` server descriptor；`1.0.1` 后续才隔离出这一 HTTP 400 冲突。未保存结果、URL、prompt、身份或凭据；这些不是发布、OAuth 或 Windows 真机证据。
 - manifest/lock 已同步为 `1.0.0`；Node 24 全量测试为 245 项、243 pass、0 fail、2 项平台跳过，生产依赖审计为 0 漏洞，确定性 build/bundle、72 项 dry-run pack、秘密模式扫描与 diff 检查均通过。代码 PR #28、main CI run [`33308371009`](https://github.com/yoshino-xiao7/dsh-grok-provider/actions/runs/33308371009)、最终 release commit、双平台 final CI、唯一制品、精确授权及 Registry/signature/attestation/provenance 回读均已完成。
 
-| 项目 | `1.0.4` 兼容边界 |
+| 项目 | `1.0.5` 兼容边界 |
 | --- | --- |
-| DeepSeek Harness | 精确支持 `0.1.2-rc.1` |
+| DeepSeek Harness | 精确支持 `0.1.5-rc.2` |
 | Node.js | `>=24.19.0` |
-| macOS arm64 | 图片发送已完成真实 Harness 验证；`1.0.4` 修复 `0.1.2-rc.1` settings 注册 |
+| macOS arm64 | 图片发送已完成真实 Harness 验证；`1.0.5` 验证 `0.1.5-rc.2` 账户 RPC |
 | Windows x64 | 代码路径与现有 slow-fake 保持不变；网络可达时由官方 CLI 生成 URL 并打开浏览器，该路径仍未完成 Windows 真机验收 |
 | macOS x64 / Linux | 不支持 |
 | Grok CLI | 不锁完整版本；严格校验官方路径、`login --oauth` 能力与生产 OIDC 凭据契约 |

package/SECURITY.md

@@ -4,7 +4,7 @@
 
 ## 支持范围
 
-本安全策略对应 `dsh-grok-provider@1.0.4` 制品。它把 Host settings 注册从已删除的 `installSettingsSection` named import 改为 `ctx.settings.installSection(...)`，以便在 DeepSeek Harness `0.1.2-rc.1` 中到达 ready。协议接受域、固定 origin、refresh-token 隔离、Search、模型、图片、工具和 URL 边界均不放宽。`1.0.3` 的流前一次官方 CLI 会话刷新与流后不重放规则保持不变。`0.1.8` 曾发布后撤回且版本号不可复用；网络可达 Windows 真机外部浏览器弹出仍未验收。
+本安全策略对应 `dsh-grok-provider@1.0.5` 制品。账户操作使用 DSH `0.1.5-rc.2` 的共享 `/api` 精确 POST 路由；浏览器会话认证、Host/Origin 检查和请求体限制由主机保留。请求使用主机 schema 校验并拒绝路径/方法不匹配。官方 CLI 凭据、固定 xAI origin、Search、工具权限和流后不重放规则保持不变。Windows 真机外部浏览器弹出仍未验收。
 
 `1.0.3` 不把 HTTP 401/403 解释为 API Key 模式，也不自行刷新 OAuth grant：固定且有界的官方 `grok models` 子进程拥有刷新行为，插件随后重新读取并严格校验共享凭据。第二次拒绝仍为 `AUTH`。SSE source 的无状态 transport failure 和干净过早 EOF 与畸形事件分开；只有前两者能进入安全部分输出保留，status-bearing transport error、工具调用和所有 `INVALID_RESPONSE` 均不得被吞掉。部分内容不生成 replay metadata，提示不包含上游错误正文。
 

package/dist/client/client.js

@@ -243,7 +243,7 @@ window.__ModuleLoader__.load({
         }
       }, [searchSettings])
       const call = React.useCallback(async (endpoint, payload = {}) => {
-        const result = await connection.rpc.call("/grok-auth", endpoint, payload)
+        const result = await connection.rpc.call("/api", `grok-auth/${endpoint}`, payload)
         if (!result || result.ok !== true) throw new Error("Grok account RPC failed")
         return result.value
       }, [connection])

package/dist/host/index.mjs

@@ -5,6 +5,7 @@ import packageJson from "../../package.json" with { type: "json" }
 
 import { attributionHeaders } from "@deepseek-ai/dsh-llm"
 import Schema from "@deepseek-ai/schemastery"
+import { clientRequestSchema } from "@deepseek-ai/dsh-client-connection"
 
 import {
   GROK_PRODUCTION_OIDC_AUTH_CONTRACT,
@@ -14,6 +15,7 @@ import {
 import { createAccountDashboard } from "../internal/account-dashboard.mjs"
 import { createAuthController } from "../internal/auth-controller.mjs"
 import { createAuthRpcHandler } from "../internal/auth-rpc.mjs"
+import { createAuthFetchRoutes } from "../internal/auth-fetch.mjs"
 import { createGrokAdapter } from "../internal/grok-adapter.mjs"
 import { createGrokCommandHandler } from "../internal/grok-command-handler.mjs"
 import { createGrokTransport } from "../internal/grok-transport.mjs"
@@ -157,11 +159,11 @@ export function apply(ctx, config) {
     recordInput: false,
     handler: commandHandler,
   }))
-  ctx.inject(["connection"], (connectionCtx) => connectionCtx.connection.rpc.handle(
-    "/grok-auth",
-    authRpcHandler,
-    { authority: "loopback" },
-  ))
+  ctx.inject(["connection"], (connectionCtx) => {
+    for (const route of createAuthFetchRoutes(authRpcHandler, clientRequestSchema)) {
+      connectionCtx.connection.fetch.register(route)
+    }
+  })
 
   ctx.effect(() => () => runtime.dispose(), "llm-grok runtime")
 }

package/dist/internal/auth-fetch.mjs

@@ -0,0 +1,27 @@
+// Exact routes participate in Connection's authenticated /api carrier, including
+// shell-owned transports. Never register an independent, unguarded HTTP handler.
+export function createAuthFetchRoutes(handler, requestSchema) {
+  return ["status", "dashboard", "diagnostics", "login", "cancel", "logout"].map((endpoint) => ({
+    path: `/api/grok-auth/${endpoint}`,
+    methods: ["POST"],
+    requestBody: "buffered",
+    async fetch(request) {
+      if (request.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase() !== "application/json") {
+        return new Response("content type must be application/json", { status: 415 })
+      }
+      let body
+      try {
+        body = await request.json()
+      } catch {
+        return new Response("invalid request", { status: 400 })
+      }
+      const parsed = requestSchema.safeParse(body)
+      if (!parsed.success || parsed.data.method !== `grok-auth/${endpoint}`) {
+        return new Response("invalid request", { status: 400 })
+      }
+      const message = parsed.data
+      const result = await handler(endpoint, message.payload, request.signal)
+      return Response.json({ type: "server-response", rpcId: message.rpcId, result })
+    },
+  }))
+}

package/docs/06-release-plan.md

@@ -1,8 +1,16 @@
 # npm 发布计划与维护流程
 
+## 1.0.5 / DSH 0.1.5-rc.2
+
+当前制品：`dsh-grok-provider@1.0.5`。账户 RPC 使用主机认证的共享 `/api/grok-auth/*` 路由，修复升级宿主后的状态、CLI 检测、模型目录和额度不可用。依赖对齐 DSH `0.1.5-rc.2`；旧版宿主需先升级。
+
+macOS 隔离宿主已验证状态、CLI `1.0.5`、两个模型和额度读取，以及 401/403 认证边界。真实生成和 Windows 真机浏览器登录未重测。版本说明见 [v1.0.5](releases/v1.0.5.md)，设计见 [ADR-0012](adr/0012-shared-api-auth-routes.md)。发布制品摘要和 Registry 回读记录由发布检查表保存。
+
+## 历史记录
+
 ## 0. 当前状态
 
-`dsh-grok-provider@1.0.4` 正在修复 `1.0.3` 在 DeepSeek Harness `0.1.2-rc.1` 中因 named import 已删除的 `installSettingsSection` 而无法到达 ready 的问题。上一份已完成供应链回读的版本仍是 `1.0.3`。
+`dsh-grok-provider@1.0.4` 已修复 `1.0.3` 在 DeepSeek Harness `0.1.2-rc.1` 中因 named import 已删除的 `installSettingsSection` 而无法到达 ready 的问题。该版已完成供应链回读，见 [v1.0.4](releases/v1.0.4.md)。
 
 `dsh-grok-provider@1.0.3` 已正式发布并完成供应链回读：最终 release commit `07ebd35c56348a1b3296bd46d1a69f5b0f430241` 的 macOS 14 / Windows 2022 final CI run [`33378215345`](https://github.com/yoshino-xiao7/dsh-grok-provider/actions/runs/33378215345) 全绿，annotated tag object `7ec8a8a1086749e7ac1dfb0ef2bd50c821838363` peel 到该提交。仓库所有者明确授权的唯一 77 文件制品为 267,403 bytes packed、829,862 bytes unpacked；SHA-1 `6197c3d30ec1ef5f559371911d612f6236eee2f9`、SHA-256 `7f740c7258ab7eee0c96e1ddae3398b41a25e718cf267e244f8693c3c99aeb0d`、SRI `sha512-kJgN0NKKV7Te3oAgbPnEua/EQCLnj5S0KWAWrhP0ixudJBepplRFARYHCxwxOwbG87bnX07Mz/dxCoBiphWhqQ==`。Trusted Publisher run [`33379149158` attempt 1](https://github.com/yoshino-xiao7/dsh-grok-provider/actions/runs/33379149158/attempts/1) 已完成；npm `latest=1.0.3`，冻结制品、唯一 GitHub Release asset 与 Registry tarball 逐字节一致。Node `24.19.0` / npm `11.5.1` 锁定 Registry 安装通过 Host/client smoke，生产依赖审计为 0 漏洞；1 个 Registry signature、2 个 attestations、安装图 11 个 signed packages / 2 个 attested packages，以及精确绑定 `release.yml` / `refs/tags/v1.0.3` / release commit / publish run 的 SLSA provenance 均已验证。
 

package/docs/08-upstream-cli-1.0.5-evidence.md

@@ -1,5 +1,7 @@
 # Grok CLI 1.0.5 上游契约证据
 
+2026-09-13 兼容性复核：DSH `0.1.5-rc.2` 中通过插件检测到官方 CLI `1.0.5`，账户 RPC、动态 `grok-4.6` / `grok-4.5` 模型目录和额度已验证。没有修改固定 xAI 协议或重新执行浏览器登录；以下为历史协议证据。
+
 状态：**已作为 `0.1.0` 发布绑定证据；残余风险由仓库所有者明确接受**
 核验日期：2026-08-25（Asia/Shanghai）
 

package/docs/09-implementation-status.md

@@ -1,5 +1,13 @@
 # 当前实现与发布状态
 
+## 1.0.5 / DSH 0.1.5-rc.2
+
+当前制品：`dsh-grok-provider@1.0.5`。账户 RPC 使用主机认证的共享 `/api/grok-auth/*` 路由，修复升级宿主后的状态、CLI 检测、模型目录和额度不可用。依赖对齐 DSH `0.1.5-rc.2`；旧版宿主需先升级。
+
+macOS 隔离宿主已验证状态、CLI `1.0.5`、两个模型和额度读取，以及 401/403 认证边界。真实生成和 Windows 真机浏览器登录未重测。版本说明见 [v1.0.5](releases/v1.0.5.md)，设计见 [ADR-0012](adr/0012-shared-api-auth-routes.md)。发布制品摘要和 Registry 回读记录由发布检查表保存。
+
+## 历史记录
+
 `1.0.2` 已正式发布并完成供应链回读。该制品修复严格空 reasoning lifecycle 被投影成多行无内容 `Think` 的显示问题，同时保留普通项既有校验与 Search-backed 复用项的精确 own-data/accessor 校验。
 
 状态日期：2026-08-30
@@ -236,4 +244,6 @@ Windows x64 真机不再是 `0.1.0` 预发布阻断项。首次发布后必须
 - 发布 `1.0.3` 后，在 DeepSeek YukiRyou Desktop `1.0.8` / dsh `0.1.2-rc.1` 中启用插件会导致 Runtime 在 ready 前以 code 1 退出。失败日志为 `@deepseek-ai/dsh-settings` 不再提供 named export `installSettingsSection`。
 - Host 改为 `ctx.inject(["settings"], ...)` 后调用 `settings.installSection`，namespace 使用字符串常量 `llm-grok`；打包 `dist/**` 不得再出现 `installSettingsSection` 或 `settingsNamespace`。
 - required peer 对齐 `0.1.2-rc.1`；Web inject 用 `dsh-client-ui-renderer` 取代已删除的 `dsh-client-runtime`。认证、Search 协议、图片与固定 endpoint 不变。
-- 代码 PR #41 已合并为 `61c80fff0841e44c16dabb2cc803a80c1bdf5456`，main CI run `33870741679` 的 macOS 14 / Windows 2022 全绿。发布证据提交、唯一制品、授权与供应链回读仍未完成。
+- 代码 PR #41 已合并为 `61c80fff0841e44c16dabb2cc803a80c1bdf5456`；分支规范修正后的发布证据 PR #43 形成最终 release commit `62df21df08053d293ebb59c6e67597402c2305af`，main CI run `33873037630` 的 macOS 14 / Windows 2022 全绿。
+- 仓库所有者明确授权的唯一 78 文件制品为 274,332 bytes packed、850,183 bytes unpacked；SHA-1 `000380a4699d4e61d96942bcae5f6a0ce7c76477`、SHA-256 `464045290b06ce71b78285571c6968e6268fa403fa2350834d2dc479e88fd001`、SRI `sha512-axCBVXQ9BI9boYrlIsa+TWURMo8tQ5GdHpcQVfXUz2OLg+5rbg3XUZSv3ZRQVYQNmyXSQ+frIBDMsbZUGaXJ6w==`。
+- Annotated tag object `dfb269fa9ebb3df3282a151d163043f983bc0619` peel 到最终提交；Trusted Publisher run [`33873873314` attempt 1](https://github.com/yoshino-xiao7/dsh-grok-provider/actions/runs/33873873314/attempts/1) 成功。npm `latest=1.0.4`，候选、唯一 Release asset 与 Registry tarball 逐字节一致；Node `24.19.0` / npm `11.5.1` Registry 锁定安装和 Host export smoke 通过。本包 1 个 Registry signature、2 个 attestations，安装图 15 个 signed packages / 2 个 attested packages，SLSA provenance 精确绑定 `release.yml`、`refs/tags/v1.0.4`、最终提交与发布 run。网络可达 Windows 真机外部浏览器弹出仍未验收。

package/docs/10-release-checklist.md

@@ -229,9 +229,11 @@ English summary: every release must close documentation, security, tests, determ
 - [x] 发行契约扫描全部 `dist/**`，禁止打包产物再引用已删除 helper。
 - [x] 精确 Node `24.19.0` 全量测试、生产依赖审计与 `pack:check`。
 - [x] 代码 PR #41 合并为 `61c80fff0841e44c16dabb2cc803a80c1bdf5456`；main CI run [`33870741679`](https://github.com/yoshino-xiao7/dsh-grok-provider/actions/runs/33870741679) 的 macOS 14 / Windows 2022 均通过。
-- [ ] 发布证据 PR、最终 release commit 与唯一 tarball 尚未冻结；冻结前不得给出制品摘要或触发发布。
-- [ ] 仓库所有者需在最终提交、文件数、字节数和摘要明确后授权唯一 `dsh-grok-provider@1.0.4` 制品。
-- [ ] Annotated tag、唯一 GitHub Release asset、Trusted Publisher、Registry 字节、签名、attestations、隔离安装与 provenance 尚待完成。
+- [x] 原发布证据 PR #42 的源分支按全局规范从 `cursor/v1.0.4-release-evidence-afa4` 重命名为 `yukiryou/v1.0.4-release-evidence`；GitHub 自动关闭原 PR 后，同一 head `26cc9a17ace288736ae5ab65386358376bef6b1c` 由替代 PR #43 合入，形成最终 release commit `62df21df08053d293ebb59c6e67597402c2305af`。main CI run [`33873037630`](https://github.com/yoshino-xiao7/dsh-grok-provider/actions/runs/33873037630) 的 macOS 14 / Windows 2022 均通过。
+- [x] 从最终提交冻结唯一 `dsh-grok-provider-1.0.4.tgz`：78 files、274,332 bytes packed、850,183 bytes unpacked；SHA-1 `000380a4699d4e61d96942bcae5f6a0ce7c76477`、SHA-256 `464045290b06ce71b78285571c6968e6268fa403fa2350834d2dc479e88fd001`、SRI `sha512-axCBVXQ9BI9boYrlIsa+TWURMo8tQ5GdHpcQVfXUz2OLg+5rbg3XUZSv3ZRQVYQNmyXSQ+frIBDMsbZUGaXJ6w==`。Node `24.19.0` / npm `11.5.1` 测试为 275 tests、273 pass、0 fail、2 platform skips，生产审计 0 漏洞，隔离安装及 Host export smoke 通过。
+- [x] 仓库所有者看到最终提交、文件数、字节数与摘要后明确授权唯一 `dsh-grok-provider@1.0.4` 制品。授权后发现 Cursor Agent 曾在 npm 发布前预建指向代码提交的同名 tag/Release；Registry 仍为 `notarget` 且没有发布 run。经所有者批准，旧 asset 备份并核对后替换；授权制品未重建。
+- [x] Annotated tag object `dfb269fa9ebb3df3282a151d163043f983bc0619` peel 到最终 release commit；唯一 GitHub Release asset 与 Trusted Publisher run [`33873873314` attempt 1](https://github.com/yoshino-xiao7/dsh-grok-provider/actions/runs/33873873314/attempts/1) 已完成。npm `latest=1.0.4`，冻结制品、Release 与 Registry tarball 逐字节一致；本包 1 个 Registry signature、2 个 attestations，`npm audit signatures` 验证安装图 15 个 signed packages / 2 个 attested packages，SLSA provenance 精确绑定 `release.yml` / `refs/tags/v1.0.4` / final release commit / publish run。
+- [ ] 网络可达 Windows 真机的官方 CLI 外部浏览器弹出仍未完成验收；该独立边界不是本 settings 注册修复的发布门禁，完成前不得声称已验证。
 
 ## `1.0.0` Search 响应协议修复发布门禁
 
@@ -284,3 +286,15 @@ English summary: every release must close documentation, security, tests, determ
 - [x] 仓库所有者看到完整精确 commit、制品、摘要与验证证据后明确授权发布 `dsh-grok-provider@1.0.2`；授权后没有重建或替换制品。
 - [x] Annotated tag object `b7efd3aabb99c73e1747d2d87890cdf9b284c438` peel 到 release commit；不可变 `v1.0.2`、唯一 GitHub Release asset 与 Trusted Publisher run [`33319150964` attempt 1](https://github.com/yoshino-xiao7/dsh-grok-provider/actions/runs/33319150964/attempts/1) 已完成。npm `latest=1.0.2`，冻结候选、Release 与 Registry tarball 逐字节一致；Node `24.19.0` / npm `11.5.1` 锁定 Registry 安装及 0 漏洞生产审计通过，本包 1 个 Registry signature、2 个 attestations，安装图 11 个 signed packages / 2 个 attested packages，以及精确绑定 `release.yml` / `refs/tags/v1.0.2` / release commit / publish run 的 SLSA provenance 均已回读。
 - [ ] 网络可达 Windows 真机浏览器弹出仍是独立未验收边界，不阻断本显示修复，但不得写成已验证。
+
+## 1.0.5 发布准备（2026-09-13）
+
+- [x] 仓库所有者明确要求发布本次 DSH 0.1.5-rc.2 兼容修复；版本冻结为稳定 1.0.5。
+- [x] 从已验证修复 09fc317 建立 `yukiryou/v1.0.5`，保留原工作区及未跟踪文件。
+- [x] manifest、lock、双语 README、CHANGELOG、SECURITY、文档首页/状态/上游证据和双语 release notes 同步。
+- [x] 账户操作使用主机认证的共享 API 精确路由；测试覆盖 schema、路径/方法一致性、取消、路由清理和真实 Connection 注册。
+- [x] macOS 隔离 DSH 0.1.5-rc.2 只读检查恢复登录状态、CLI 1.0.5、grok-4.6/grok-4.5 与额度；无认证为 401、跨来源为 403。
+- [x] GitHub PR/双平台 CI、防强推/删除保护和私密漏洞报告已核对；npm environment 的 Secret 名称列表为空。
+- [ ] 最终双平台 CI、唯一 tarball 摘要、隔离制品安装、GitHub Release、Trusted Publisher、Registry 字节与 provenance 回读在发布完成后登记。
+
+本次未重测真实模型生成或 Windows 真机浏览器登录，也未替换用户桌面的受管插件。

package/docs/README.md

@@ -1,6 +1,14 @@
 # Grok Build Provider 文档索引
 
-- 状态：**`dsh-grok-provider@1.0.4` 正在修复 `0.1.2-rc.1` settings 注册；上一份已完成供应链回读的版本为 `1.0.3`**
+## 1.0.5 / DSH 0.1.5-rc.2
+
+当前制品：`dsh-grok-provider@1.0.5`。账户 RPC 使用主机认证的共享 `/api/grok-auth/*` 路由，修复升级宿主后的状态、CLI 检测、模型目录和额度不可用。依赖对齐 DSH `0.1.5-rc.2`；旧版宿主需先升级。
+
+macOS 隔离宿主已验证状态、CLI `1.0.5`、两个模型和额度读取，以及 401/403 认证边界。真实生成和 Windows 真机浏览器登录未重测。版本说明见 [v1.0.5](releases/v1.0.5.md)，设计见 [ADR-0012](adr/0012-shared-api-auth-routes.md)。发布制品摘要和 Registry 回读记录由发布检查表保存。
+
+## 历史记录
+
+- `1.0.4` 修复 `0.1.2-rc.1` settings 注册；该版已发布并完成供应链回读。
 - 制品范围：Host 改用 `ctx.settings.installSection` 注册 `llm-grok`，peer 对齐 Harness `0.1.2-rc.1`
 - 当前已完成发布回读版本：`1.0.3`
 - `1.0.3` 已发布基线：`yukiryou/main@07ebd35c56348a1b3296bd46d1a69f5b0f430241`

package/docs/adr/0012-shared-api-auth-routes.md

@@ -0,0 +1,36 @@
+# ADR-0012: Account routes on the shared Connection API
+
+- Status: Accepted for dsh-grok-provider 1.0.5
+- Baseline: dsh-grok-provider 1.0.4, commit 693b564
+
+The desktop upgrade to Harness 0.1.5-rc.2 leaves the Grok settings page visible,
+but POST /grok-auth/status returns HTTP 405 and diagnostics cannot return the
+plugin version. The actual HostConnectionService custom-channel registration
+throws `cannot get property "webServer" without inject`. Adding webServer to the
+plugin's injection does not repair the service-owned context access.
+
+Register six exact POST routes below /api/grok-auth through the public
+connection.fetch registry. The browser uses the existing Connection RPC caller
+with channel /api and namespaced methods. The host-owned carrier retains browser
+session authentication, Host/Origin checks and buffered-body limits. The plugin
+uses the host's clientRequestSchema and rejects a method/path mismatch before
+calling any account operation. Credential, login, logout, model and billing
+contracts are unchanged. Routes are removed with the plugin's fiber.
+
+This release targets Harness 0.1.5-rc.2 and replaces the 1.0.4 integration.
+Validation includes the real Connection registry, request correlation,
+malformed input, cancellation, route disposal and the host/client/protocol suite.
+
+## Local verification, 2026-09-13
+
+- Node 24.19.0; fresh locked npm install: 26 audited packages, zero vulnerabilities.
+- `npm test`: 278 tests, 276 passed, 2 skipped, 0 failed. The skips are pre-existing platform-specific checks; this run is macOS only.
+- Real desktop-bundled DSH 0.1.5-rc.2, separate temporary DSH_HOME: status,
+  diagnostics and dashboard all return HTTP 200. Official CLI 1.0.5 is ready;
+  models grok-4.6 and grok-4.5 and quota are available. The first model request
+  failed transiently; a direct catalog read and a repeated dashboard read passed.
+- The shared carrier rejects an unauthenticated request with 401 and a foreign
+  Origin with 403. No login, logout or credential replacement was performed.
+- The installed desktop remains on the original managed plugin generation.
+  Neither npm publication nor current-profile installation was performed.
+- Live model generation and Windows UI/login were not exercised in this fix.

package/docs/releases/v1.0.4.md

@@ -25,7 +25,9 @@ dsh web
 - 打包后的全部 `dist/**` 不得引用已删除的 settings helper。
 - 精确 Node `24.19.0` 全量测试、生产依赖审计与 `pack:check` 在合并前完成。
 - 代码 PR [#41](https://github.com/yoshino-xiao7/dsh-grok-provider/pull/41) 已合并为 `61c80fff0841e44c16dabb2cc803a80c1bdf5456`；main CI run [`33870741679`](https://github.com/yoshino-xiao7/dsh-grok-provider/actions/runs/33870741679) 的 macOS 14 / Windows 2022 均通过。
-- 发布制品、Registry、签名、attestation 与 provenance 证据在发布回读完成后补记；这些证据不替代真实 Web profile 手工对话或 Windows 外部浏览器验收。
+- 发布证据 PR [#43](https://github.com/yoshino-xiao7/dsh-grok-provider/pull/43) 形成最终 release commit `62df21df08053d293ebb59c6e67597402c2305af`；main CI run [`33873037630`](https://github.com/yoshino-xiao7/dsh-grok-provider/actions/runs/33873037630) 的 macOS 14 / Windows 2022 均通过。
+- 仓库所有者授权的唯一制品含 78 个文件，为 274,332 bytes packed、850,183 bytes unpacked；SHA-256 `464045290b06ce71b78285571c6968e6268fa403fa2350834d2dc479e88fd001`，SRI `sha512-axCBVXQ9BI9boYrlIsa+TWURMo8tQ5GdHpcQVfXUz2OLg+5rbg3XUZSv3ZRQVYQNmyXSQ+frIBDMsbZUGaXJ6w==`。
+- Annotated tag `v1.0.4` peel 到最终提交；Trusted Publisher run [`33873873314` attempt 1](https://github.com/yoshino-xiao7/dsh-grok-provider/actions/runs/33873873314/attempts/1) 成功。npm `latest=1.0.4`，候选、Release 与 Registry tarball 逐字节一致；Registry 签名、attestations、锁定安装及精确绑定 tag/workflow/commit/run 的 SLSA provenance 均已回读。这些证据不替代真实 Web profile 手工对话或 Windows 外部浏览器验收。
 
 <details>
 <summary>English</summary>
@@ -55,6 +57,8 @@ Restart any running DeepSeek Harness / DeepSeek YukiRyou process. Runtime should
 - Packed `dist/**` must not mention the deleted settings helpers.
 - The exact Node `24.19.0` suite, production audit, and `pack:check` complete before merge.
 - Code PR [#41](https://github.com/yoshino-xiao7/dsh-grok-provider/pull/41) merged as `61c80fff0841e44c16dabb2cc803a80c1bdf5456`; main CI run [`33870741679`](https://github.com/yoshino-xiao7/dsh-grok-provider/actions/runs/33870741679) passed on macOS 14 and Windows 2022.
-- Artifact, Registry, signature, attestation, and provenance evidence will be appended after publication readback. Those checks do not substitute for a real Web-profile conversation or physical Windows browser-launch acceptance.
+- Release-evidence PR [#43](https://github.com/yoshino-xiao7/dsh-grok-provider/pull/43) produced final release commit `62df21df08053d293ebb59c6e67597402c2305af`; main CI run [`33873037630`](https://github.com/yoshino-xiao7/dsh-grok-provider/actions/runs/33873037630) passed on macOS 14 and Windows 2022.
+- The explicitly authorized unique artifact contains 78 files and is 274,332 bytes packed / 850,183 bytes unpacked; SHA-256 is `464045290b06ce71b78285571c6968e6268fa403fa2350834d2dc479e88fd001`, and SRI is `sha512-axCBVXQ9BI9boYrlIsa+TWURMo8tQ5GdHpcQVfXUz2OLg+5rbg3XUZSv3ZRQVYQNmyXSQ+frIBDMsbZUGaXJ6w==`.
+- Annotated tag `v1.0.4` peels to the final commit; Trusted Publisher run [`33873873314` attempt 1](https://github.com/yoshino-xiao7/dsh-grok-provider/actions/runs/33873873314/attempts/1) succeeded. npm reports `latest=1.0.4`; candidate, Release, and Registry tarballs are byte-identical; Registry signature, attestations, locked installation, and SLSA provenance bindings to the tag, workflow, commit, and run all verify. These checks do not substitute for a real Web-profile conversation or physical Windows browser-launch acceptance.
 
 </details>

package/docs/releases/v1.0.5.md

@@ -0,0 +1,27 @@
+## 中文
+
+修复升级到 DeepSeek Harness `0.1.5-rc.2` 后，Grok Build 设置页显示“账户服务暂时不可用”、插件和 CLI 版本未知的问题。
+
+- 六个账户操作迁移到主机认证的共享 `/api/grok-auth/*` 精确 POST 路由，恢复登录状态、CLI 检测、模型目录和额度读取。
+- 使用主机请求 schema，拒绝畸形请求与路径/方法不匹配，保留取消和插件卸载清理行为。
+- Harness peer 与开发依赖对齐 `0.1.5-rc.2`。旧版 Harness 用户需要先升级宿主。
+- 本地 Node `24.19.0` 测试通过；macOS 隔离实例检测到官方 Grok CLI `1.0.5`，读到 `grok-4.6`、`grok-4.5` 和额度。未认证请求返回 401，跨来源请求返回 403。
+- 本版未重测真实模型生成或 Windows 真机浏览器登录。更新后需要重启正在运行的 DSH。
+
+```sh
+dsh plugin --profile web add dsh-grok-provider@1.0.5
+```
+
+## English
+
+Fix unavailable Grok Build account services and unknown plugin/CLI versions after upgrading to DeepSeek Harness `0.1.5-rc.2`.
+
+- Move six account operations to exact POST routes on the host-authenticated shared `/api/grok-auth/*` carrier, restoring status, CLI diagnostics, model discovery, and quota reads.
+- Validate requests with the host schema, reject malformed or mismatched methods, and preserve cancellation and plugin-owned cleanup.
+- Align Harness peers and development dependencies with `0.1.5-rc.2`. Upgrade older Harness hosts before installing this version.
+- Local Node `24.19.0` tests pass. An isolated macOS Harness detects official Grok CLI `1.0.5`, both `grok-4.6` and `grok-4.5`, and quota. Unauthenticated requests return 401; foreign Origins return 403.
+- Live model generation and physical Windows browser sign-in were not repeated. Restart any running DSH process after updating.
+
+```sh
+dsh plugin --profile web add dsh-grok-provider@1.0.5
+```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-grok-provider",
-  "version": "1.0.4",
+  "version": "1.0.5",
   "description": "Clean-room Grok Build provider for DeepSeek Harness with official CLI browser authentication",
   "type": "module",
   "license": "MIT",
@@ -62,18 +62,17 @@
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "4.0.2",
-    "@deepseek-ai/dsh-client-connection": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-client-locale": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-client-ui-renderer": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-client-ui-settings": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-commands": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-llm": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-settings": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-subprocess": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-connection": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-client-locale": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-client-ui-renderer": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-client-ui-settings": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-commands": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-llm": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-settings": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-subprocess": "0.1.5-rc.2",
     "@deepseek-ai/schemastery": "3.18.2"
   },
   "peerDependenciesMeta": {
-    "@deepseek-ai/dsh-client-connection": { "optional": true },
     "@deepseek-ai/dsh-client-locale": { "optional": true },
     "@deepseek-ai/dsh-client-ui-renderer": { "optional": true },
     "@deepseek-ai/dsh-client-ui-settings": { "optional": true },
@@ -82,11 +81,12 @@
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "4.0.2",
-    "@deepseek-ai/dsh-commands": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-llm": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-settings": "0.1.2-rc.1",
-    "@deepseek-ai/dsh-subprocess": "0.1.2-rc.1",
-    "@deepseek-ai/schemastery": "3.18.2"
+    "@deepseek-ai/dsh-commands": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-llm": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-settings": "0.1.5-rc.2",
+    "@deepseek-ai/dsh-subprocess": "0.1.5-rc.2",
+    "@deepseek-ai/schemastery": "3.18.2",
+    "@deepseek-ai/dsh-client-connection": "0.1.5-rc.2"
   },
   "publishConfig": {
     "access": "public",