dsh-ops 0.2.1 → 0.2.2

package/CHANGELOG.md

@@ -5,13 +5,26 @@ All notable changes to this package are recorded here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and
 this package adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [0.2.1] — Windows payload packaging
+## [0.2.2] — Bash parameter schema hotfix
+
+- Fix `ops_bash` parameters to use a JSON Schema object root with `properties`, `required: ['command']`, and `additionalProperties: false`. The previous field map was forwarded unchanged by the official host and rejected by the model API before tool execution.
+- Reuse the three published Windows runtime packages at exact version 0.2.1; only the main plugin package changes.
+- Validate the exported schema through the official host tool registry without calling a model. Registry installation and shell version probes alone did not verify this boundary in 0.2.1.
+
+## [0.2.1] — Windows payload packaging — published
+
+Published to the public npm registry on 2026-10-08 as `dsh-ops@0.2.1` with
+`@dsh-ops/fastctx-win32-x64@0.2.1`, `@dsh-ops/bash-win32-x64@0.2.1` and
+`@dsh-ops/pwsh-win32-x64@0.2.1`. Packed sizes and registry digests:
+[docs/release-0.2.1.md](docs/release-0.2.1.md).
 
 - Assemble complete digest-verified PortableGit/bash and PowerShell 7 runtime packages instead of metadata-only pins; inject all three Windows x64 runtime dependencies in the publish artifact.
 - Add explicit-profile install/status/uninstall delegation to the official DSH manager; map tui to dsh-tui and use Desktop's installation-owned CLI.
 - Resolve the pwsh dependency from the plugin package under pnpm isolation.
 - Make the default README Chinese and add a concise English translation.
-- Correct the npm credential selection: the initial E403 used an old local token, not the maintainer-provided bypass token. The explicitly selected bypass token was accepted for publication. Local payload builds are not license-compliance evidence.
+- Materialize PortableGit's hardlinked paths during assembly: npm rejects hard links with E415, so the shell packages publish regular files with identical bytes.
+- Fix credential selection: the first publish attempt used an unrelated local npm token and received E403. The maintainer's explicitly selected bypass credential was accepted; the earlier attribution of that failure to the maintainer's token was wrong.
+- Known unresolved item: complete corresponding-source delivery for the GPL/LGPL components in the PortableGit inventory was not collected or reviewed, and no source offer is claimed. Publication proceeded at the maintainer's explicit direction.
 
 ## [Unreleased] — additive tool surface
 

package/PROVENANCE.md

@@ -3,6 +3,17 @@
 What this repository is, where its parts came from, what was verified, and what
 was not.
 
+## 0.2.2 Bash schema hotfix
+
+The maintainer reported a model API rejection after official marketplace installation:
+`ops_bash` had no object-root JSON Schema. The plugin supplied a field map directly to
+`tools.register`, whereas only the host's `defineTool` helper compiles such maps; raw
+registration and model projection preserve `parameters` unchanged. The plugin now
+supplies explicit `type: 'object'`, `properties`, and root `required`. Inspection through
+the installed official 0.2.0-rc.2 registry confirms the exported schema is object-rooted
+and valid. No model API request or full marketplace round trip is claimed. The three
+existing 0.2.1 runtime payloads are reused unchanged; only the main package is patched.
+
 ## 0.2.1 Windows payload packaging
 
 The assembler now builds all three Windows x64 payload packages. Bash carries
@@ -11,15 +22,22 @@ PowerShell 7.6.6 under bin/. Original licenses/notices are preserved. Archive
 and executable hashes are pinned in lib/shells.js. All three runtime packages
 are injected into the main publish artifact; no install lifecycle downloads.
 
-The maintainer authorized publication after the source-delivery risk was reported.
-The first attempt used an old local npm credential and received E403; explicitly
-selecting the maintainer-provided bypass token succeeded. This was a credential
-selection error, not proof the provided token lacked bypass permission. PortableGit's
-etc/package-versions.txt includes many GPL/LGPL components; complete matching
-source closure/delivery has not been collected or reviewed. Retaining upstream
-licenses does not attest that those obligations have been fulfilled. No source
-offer is invented. Historical 0.2.0 pin-package descriptions below do not describe
-this new payload layout.
+The maintainer directed publication after the source-delivery risk was reported. The
+first attempt used an unrelated local npm credential and received E403; selecting the
+maintainer's bypass credential succeeded, so that failure was credential selection,
+not the maintainer's token. Publishing hit a second real blocker: npm rejects tar
+hard links (E415), so the assembler materializes PortableGit's 84 linked paths and the
+published bash package is 161.2 MB packed rather than the 136.1 MB first measured.
+All four packages are published at 0.2.1; the registry-reported digests of exactly
+what users receive are recorded in docs/release-0.2.1.md, because the local dist
+provenance is regenerated with a new timestamp on every build and does not describe
+the earlier-published FastCtx tarball byte for byte.
+
+PortableGit's etc/package-versions.txt includes many GPL/LGPL components; complete
+matching source closure/delivery has not been collected or reviewed. Retaining
+upstream licenses does not attest that those obligations have been fulfilled. No
+source offer is invented. Historical 0.2.0 pin-package descriptions below do not
+describe this new payload layout.
 
 The profile installer delegates to the official DSH CLI, retaining its locks,
 compatibility checks and rollback rather than cloning them. Live installation

package/README.en.md

@@ -41,6 +41,11 @@ dsh plugin --profile dsh-tui add dsh-ops
 Update by repeating the npx install command, or official `add dsh-ops@latest`.
 Reload/restart as the application requests; replacing loaded code may require restart.
 
+The patch version is `0.2.2`: it fixes the malformed `ops_bash` parameter schema
+that caused model requests to fail after marketplace installation. All three runtime
+dependencies remain pinned to `0.2.1`; their original release record is in
+[docs/release-0.2.1.md](docs/release-0.2.1.md).
+
 ```console
 npx --yes dsh-ops@latest status --profile desktop
 npx --yes dsh-ops@latest uninstall --profile desktop

package/README.md

@@ -40,6 +40,8 @@ dsh plugin --profile dsh-tui add dsh-ops
 
 **更新**：重新运行相同的 `npx --yes dsh-ops@latest install --profile ...`，或用官方 CLI `add dsh-ops@latest`。按应用提示重载；替换已加载代码时重启应用。
 
+当前 npm 补丁版本为 `0.2.2`，修复官方市场安装后 `ops_bash` 参数 schema 缺少对象根导致模型请求失败的问题；三个运行包仍使用 `0.2.1`。原始载荷发布记录见 [docs/release-0.2.1.md](docs/release-0.2.1.md)。
+
 **卸载与查看状态**：
 
 ```console

package/README.zh.md

@@ -40,6 +40,8 @@ dsh plugin --profile dsh-tui add dsh-ops
 
 **更新**：重新运行相同的 `npx --yes dsh-ops@latest install --profile ...`，或用官方 CLI `add dsh-ops@latest`。按应用提示重载；替换已加载代码时重启应用。
 
+当前 npm 补丁版本为 `0.2.2`，修复官方市场安装后 `ops_bash` 参数 schema 缺少对象根导致模型请求失败的问题；三个运行包仍使用 `0.2.1`。原始载荷发布记录见 [docs/release-0.2.1.md](docs/release-0.2.1.md)。
+
 **卸载与查看状态**：
 
 ```console

package/docs/release-0.2.1.md

@@ -0,0 +1,72 @@
+# Published release record — 0.2.1
+
+Exactly what this release published to the public npm registry. `npm` reports these
+digests; they are the authoritative record of the bytes users receive. They are not
+derived from the local `dist` directory, whose `provenance.json` is regenerated on
+every build and therefore carries a different build timestamp.
+
+| Package | Packed | Unpacked | shasum (sha1) |
+| --- | ---: | ---: | --- |
+| `dsh-ops@0.2.1` | 501.9 kB | 2.4 MB | `fe4fc569565e5544b1b779b90192f610de1783d3` |
+| `@dsh-ops/fastctx-win32-x64@0.2.1` | 24.7 MB | 49.9 MB | `96caf16a5978f699560d05b2126a2c6f92efb08c` |
+| `@dsh-ops/bash-win32-x64@0.2.1` | 161.2 MB | 411.1 MB | `8df967f0f9ac0104e327ae1e50d55036f4790121` |
+| `@dsh-ops/pwsh-win32-x64@0.2.1` | 107.6 MB | 256.6 MB | `4a3cd69f68ffc616dd6d334f170bf7423e660f24` |
+
+All four are published with public access and tag `latest`. The main package declares
+the three Windows x64 runtime packages as exact `optionalDependencies`; the platform
+packages were published first, so the main package never pointed at a version the
+registry did not have.
+
+## Two publishing problems this release hit
+
+1. **Wrong credential selected.** The first attempt used a pre-existing credential in
+   the operator's `~/.npmrc`, which is a different token, and npm answered `E403`
+   (2FA or a granular bypass token required). The maintainer's explicitly selected
+   bypass credential was accepted. The earlier local message blaming the maintainer's
+   token was wrong; the error was credential selection.
+2. **Hard links are rejected by the registry.** PortableGit's tree contains 84
+   hardlinked paths, and npm refused the first bash upload with
+   `E415 Unsupported Media Type — Hard link is not allowed`. The assembler now
+   materializes every linked path as an independent file with identical bytes, which
+   is why the published bash package is 161.2 MB (411.1 MB unpacked) rather than the
+   136.1 MB measured before. Runtime layout and file contents are unchanged; the
+   executable digests still match `lib/shells.js`.
+
+## Distribution
+
+- Tag `v0.2.1` and a GitHub Release with **notes only, no assets**. `v0.2.0`
+  attached four tarballs and `SHA256SUMS`; npm is now the installation channel, so
+  re-uploading ~290 MB of tarballs would only duplicate it.
+- Repository Actions are **disabled at repository level**. Nothing runs on push,
+  tag, schedule or dispatch; the tag push above triggered no workflow. `.github/workflows/`
+  is kept as documentation of the intended gate and pipeline, and each file now says
+  at the top that it does not run. Publication is performed from a maintainer machine.
+
+## What was verified, and what was not
+
+Verified by installing the published artifacts from the registry into an isolated
+directory with `--ignore-scripts`:
+
+- `resolveShells` finds both bundled shells inside the installed dependency tree;
+- the installed bash reports `GNU bash, version 5.3.15(2)-release`;
+- the installed pwsh reports `7.6.6`;
+- `npx --yes dsh-ops@0.2.1 status --profile tui` runs and maps `tui` to `dsh-tui`;
+- `install --profile tui|desktop --dry-run` selects the expected official CLI,
+  including Desktop's own `resources/runtime/cli/bin/dsh.cmd`.
+
+Not verified: a live install into a real profile, the marketplace's pnpm path and hot
+reload, official uninstall behaviour, and end-to-end plugin mount inside a running
+DSH session. The repository regression suites were not updated or run for this
+release, and no CI gate guarded this publication.
+
+## Licence status
+
+The Windows payload packages redistribute complete upstream runtime trees: Git for
+Windows (GPL and other licences) and PowerShell (MIT and third-party licences). Their
+original licences and notices travel inside the packages, and `provenance.json`
+records the upstream URL, release, byte count and SHA-256 of the archive each payload
+came from. The complete corresponding-source closure for every GPL/LGPL component in
+the PortableGit inventory has **not** been collected or reviewed; no written offer was
+invented, and the plugin's MIT licence does not relicense the upstream components.
+This is a documented, unresolved compliance item, published at the maintainer's
+explicit direction.

package/docs/schema-current.json

@@ -62,12 +62,12 @@
     "approximateTokens": 118
   },
   "bashSchema": {
-    "bytes": 894,
-    "approximateTokens": 224
+    "bytes": 961,
+    "approximateTokens": 241
   },
   "fullWithBash": {
-    "bytes": 10633,
-    "approximateTokens": 2659
+    "bytes": 10700,
+    "approximateTokens": 2675
   },
   "toolingPrompt": {
     "bytes": 1053,

package/docs/schema-measurement.md

@@ -10,7 +10,7 @@ Baseline: plugin `dee3c57`, FastCtx 0.2.6, before presentation changes. Current:
 | Four file schemas | 12,807 | 6,724 | 47.5% |
 | Routing section (original full ladder vs restored compact three-layer table) | 3,373 | 1,053 | 68.8% |
 
-Full-access FastCtx schema estimate: 4,723 → 2,435 tokens. The restored ops_bash schema adds 894 bytes (~224 tokens); full FastCtx+bash surface is 10,633 bytes (~2,659 tokens). Restricted file-only surface: about 1,681 tokens; its routing table is 470 bytes (~118 tokens). No server instructions are published (the original raw server instructions were 246 bytes); the old host-shell section is also removed. Baseline excludes ops_bash, so compare nine FastCtx tools like-for-like rather than treating restoration as a regression of those numbers. Total request savings depend on host presentation; these are not API usage/billing measurements.
+Full-access FastCtx schema estimate: 4,723 → 2,435 tokens. The corrected object-root ops_bash schema adds 961 bytes (~241 tokens); full FastCtx+bash surface is 10,700 bytes (~2,675 tokens). Restricted file-only surface: about 1,681 tokens; its routing table is 470 bytes (~118 tokens). No server instructions are published (the original raw server instructions were 246 bytes); the old host-shell section is also removed. Baseline excludes ops_bash, so compare nine FastCtx tools like-for-like rather than treating restoration as a regression of those numbers. Total request savings depend on host presentation; these are not API usage/billing measurements.
 
 `ops_grep` went from 3,766 → 2,019 bytes; `ops_inspect_local_file` from 4,375 → 1,968. `ops_replace` is retained: schema cost cannot establish invocation frequency, and no usage-frequency measurement was collected.
 

package/dsh-plugin.json

@@ -3,7 +3,7 @@
   "manifestVersion": "0.15",
   "id": "dsh-ops.fastctx",
   "name": "dsh-ops",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "license": "MIT AND Apache-2.0",
   "facets": {
     "host": {

package/lib/shells.js

@@ -807,21 +807,26 @@ export function bashToolDefinition({ file, source, subprocess }) {
     name: BASH_TOOL_NAME,
     description: bashToolDescription(),
     parameters: {
-      command: { type: 'string', required: true, description: 'The bash command to execute.' },
-      workdir: {
-        type: 'string',
-        description: 'Working directory for this command. Defaults to the session workspace when omitted.',
-      },
-      timeoutMs: {
-        type: 'number',
-        description: 'Timeout in milliseconds; the command is killed on expiry. '
-          + `Defaults to ${DEFAULT_BASH_TIMEOUT_MS}.`,
-      },
-      graceMs: {
-        type: 'number',
-        description: 'Grace period in milliseconds between termination and a forced kill. '
-          + `Defaults to ${DEFAULT_GRACE_MS}.`,
+      type: 'object',
+      properties: {
+        command: { type: 'string', description: 'The bash command to execute.' },
+        workdir: {
+          type: 'string',
+          description: 'Working directory for this command. Defaults to the session workspace when omitted.',
+        },
+        timeoutMs: {
+          type: 'number',
+          description: 'Timeout in milliseconds; the command is killed on expiry. '
+            + `Defaults to ${DEFAULT_BASH_TIMEOUT_MS}.`,
+        },
+        graceMs: {
+          type: 'number',
+          description: 'Grace period in milliseconds between termination and a forced kill. '
+            + `Defaults to ${DEFAULT_GRACE_MS}.`,
+        },
       },
+      required: ['command'],
+      additionalProperties: false,
     },
     output: {
       schema: BASH_OUTPUT_SCHEMA,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-ops",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "publishConfig": {
     "access": "public"
   },
@@ -96,6 +96,11 @@
       "optional": true
     }
   },
+  "optionalDependencies": {
+    "@dsh-ops/fastctx-win32-x64": "0.2.1",
+    "@dsh-ops/bash-win32-x64": "0.2.1",
+    "@dsh-ops/pwsh-win32-x64": "0.2.1"
+  },
   "devDependencies": {
     "@deepseek-ai/cordis": "4.0.4",
     "@deepseek-ai/dsh-scope": "0.2.0-rc.2",
@@ -107,10 +112,5 @@
   },
   "engines": {
     "node": "^22.19 || >=24"
-  },
-  "optionalDependencies": {
-    "@dsh-ops/fastctx-win32-x64": "0.2.1",
-    "@dsh-ops/bash-win32-x64": "0.2.1",
-    "@dsh-ops/pwsh-win32-x64": "0.2.1"
   }
 }