dsh-ops 0.2.1 → 0.2.3

package/CHANGELOG.md

@@ -5,13 +5,33 @@ All notable changes to this package are recorded here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and
 this package adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [0.2.1] — Windows payload packaging
+## [0.2.3] — Strict-argument guidance and display metadata
+
+- Add one routing-section reminder: `ops_* arguments are strict: pass only declared fields.` Keep FastCtx's portable schema subset and runtime guards unchanged.
+- Use `dsh-ops` as the display title in both locales and align package/install descriptions with the maintainer's Windows bash, PowerShell 7, and Rust tools wording.
+- Replace the display icon with the maintainer-provided image, resized without cropping to a 256×256 PNG (119,677 bytes), below the official host's 256 KiB limit.
+- Reuse all three runtime payload dependencies at 0.2.1; preserve the 0.2.2 bash object-root schema fix.
+
+## [0.2.2] — Bash parameter schema hotfix
+
+- Fix `ops_bash` parameters to use a JSON Schema object root with `properties`, `required: ['command']`, and `additionalProperties: false`. The previous field map was forwarded unchanged by the official host and rejected by the model API before tool execution.
+- Reuse the three published Windows runtime packages at exact version 0.2.1; only the main plugin package changes.
+- Validate the exported schema through the official host tool registry without calling a model. Registry installation and shell version probes alone did not verify this boundary in 0.2.1.
+
+## [0.2.1] — Windows payload packaging — published
+
+Published to the public npm registry on 2026-10-08 as `dsh-ops@0.2.1` with
+`@dsh-ops/fastctx-win32-x64@0.2.1`, `@dsh-ops/bash-win32-x64@0.2.1` and
+`@dsh-ops/pwsh-win32-x64@0.2.1`. Packed sizes and registry digests:
+[docs/release-0.2.1.md](docs/release-0.2.1.md).
 
 - Assemble complete digest-verified PortableGit/bash and PowerShell 7 runtime packages instead of metadata-only pins; inject all three Windows x64 runtime dependencies in the publish artifact.
 - Add explicit-profile install/status/uninstall delegation to the official DSH manager; map tui to dsh-tui and use Desktop's installation-owned CLI.
 - Resolve the pwsh dependency from the plugin package under pnpm isolation.
 - Make the default README Chinese and add a concise English translation.
-- Correct the npm credential selection: the initial E403 used an old local token, not the maintainer-provided bypass token. The explicitly selected bypass token was accepted for publication. Local payload builds are not license-compliance evidence.
+- Materialize PortableGit's hardlinked paths during assembly: npm rejects hard links with E415, so the shell packages publish regular files with identical bytes.
+- Fix credential selection: the first publish attempt used an unrelated local npm token and received E403. The maintainer's explicitly selected bypass credential was accepted; the earlier attribution of that failure to the maintainer's token was wrong.
+- Known unresolved item: complete corresponding-source delivery for the GPL/LGPL components in the PortableGit inventory was not collected or reviewed, and no source offer is claimed. Publication proceeded at the maintainer's explicit direction.
 
 ## [Unreleased] — additive tool surface
 

package/PROVENANCE.md

@@ -3,6 +3,28 @@
 What this repository is, where its parts came from, what was verified, and what
 was not.
 
+## 0.2.3 Prompt and display update
+
+Add one model-facing sentence in `lib/policy.js`: `ops_* arguments are strict:
+pass only declared fields.` FastCtx strips `additionalProperties` from published
+schemas for provider portability but retains its runtime unknown-field guards;
+this prompt reminder does not change schemas or Rust behaviour. No files under
+`vendor/fastctx` were modified. The display title and bilingual descriptions use
+the maintainer's wording. The new icon is an operator-supplied image resized,
+without cropping, to a 256×256 PNG under the official host's 256 KiB limit;
+no independent authorship or licence verification of that image is claimed.
+
+## 0.2.2 Bash schema hotfix
+
+The maintainer reported a model API rejection after official marketplace installation:
+`ops_bash` had no object-root JSON Schema. The plugin supplied a field map directly to
+`tools.register`, whereas only the host's `defineTool` helper compiles such maps; raw
+registration and model projection preserve `parameters` unchanged. The plugin now
+supplies explicit `type: 'object'`, `properties`, and root `required`. Inspection through
+the installed official 0.2.0-rc.2 registry confirms the exported schema is object-rooted
+and valid. No model API request or full marketplace round trip is claimed. The three
+existing 0.2.1 runtime payloads are reused unchanged; only the main package is patched.
+
 ## 0.2.1 Windows payload packaging
 
 The assembler now builds all three Windows x64 payload packages. Bash carries
@@ -11,15 +33,22 @@ PowerShell 7.6.6 under bin/. Original licenses/notices are preserved. Archive
 and executable hashes are pinned in lib/shells.js. All three runtime packages
 are injected into the main publish artifact; no install lifecycle downloads.
 
-The maintainer authorized publication after the source-delivery risk was reported.
-The first attempt used an old local npm credential and received E403; explicitly
-selecting the maintainer-provided bypass token succeeded. This was a credential
-selection error, not proof the provided token lacked bypass permission. PortableGit's
-etc/package-versions.txt includes many GPL/LGPL components; complete matching
-source closure/delivery has not been collected or reviewed. Retaining upstream
-licenses does not attest that those obligations have been fulfilled. No source
-offer is invented. Historical 0.2.0 pin-package descriptions below do not describe
-this new payload layout.
+The maintainer directed publication after the source-delivery risk was reported. The
+first attempt used an unrelated local npm credential and received E403; selecting the
+maintainer's bypass credential succeeded, so that failure was credential selection,
+not the maintainer's token. Publishing hit a second real blocker: npm rejects tar
+hard links (E415), so the assembler materializes PortableGit's 84 linked paths and the
+published bash package is 161.2 MB packed rather than the 136.1 MB first measured.
+All four packages are published at 0.2.1; the registry-reported digests of exactly
+what users receive are recorded in docs/release-0.2.1.md, because the local dist
+provenance is regenerated with a new timestamp on every build and does not describe
+the earlier-published FastCtx tarball byte for byte.
+
+PortableGit's etc/package-versions.txt includes many GPL/LGPL components; complete
+matching source closure/delivery has not been collected or reviewed. Retaining
+upstream licenses does not attest that those obligations have been fulfilled. No
+source offer is invented. Historical 0.2.0 pin-package descriptions below do not
+describe this new payload layout.
 
 The profile installer delegates to the official DSH CLI, retaining its locks,
 compatibility checks and rollback rather than cloning them. Live installation

package/README.en.md

@@ -41,6 +41,11 @@ dsh plugin --profile dsh-tui add dsh-ops
 Update by repeating the npx install command, or official `add dsh-ops@latest`.
 Reload/restart as the application requests; replacing loaded code may require restart.
 
+The current version is `0.2.3`: it reminds the model to pass only declared `ops_*`
+fields and updates the display title, descriptions, and icon. It retains the 0.2.2
+bash parameter schema fix. Runtime dependencies remain pinned to `0.2.1`; their
+original release record is in [docs/release-0.2.1.md](docs/release-0.2.1.md).
+
 ```console
 npx --yes dsh-ops@latest status --profile desktop
 npx --yes dsh-ops@latest uninstall --profile desktop

package/README.md

@@ -40,6 +40,8 @@ dsh plugin --profile dsh-tui add dsh-ops
 
 **更新**：重新运行相同的 `npx --yes dsh-ops@latest install --profile ...`，或用官方 CLI `add dsh-ops@latest`。按应用提示重载；替换已加载代码时重启应用。
 
+当前 npm 版本为 `0.2.3`：提示词提醒 `ops_*` 只传声明字段，标题统一为 `dsh-ops`，并更新中英文介绍和图标；保留 `0.2.2` 的 bash schema 修复，三个运行包仍使用 `0.2.1`。原始载荷发布记录见 [docs/release-0.2.1.md](docs/release-0.2.1.md)。
+
 **卸载与查看状态**：
 
 ```console

package/README.zh.md

@@ -40,6 +40,8 @@ dsh plugin --profile dsh-tui add dsh-ops
 
 **更新**：重新运行相同的 `npx --yes dsh-ops@latest install --profile ...`，或用官方 CLI `add dsh-ops@latest`。按应用提示重载；替换已加载代码时重启应用。
 
+当前 npm 版本为 `0.2.3`：提示词提醒 `ops_*` 只传声明字段，标题统一为 `dsh-ops`，并更新中英文介绍和图标；保留 `0.2.2` 的 bash schema 修复，三个运行包仍使用 `0.2.1`。原始载荷发布记录见 [docs/release-0.2.1.md](docs/release-0.2.1.md)。
+
 **卸载与查看状态**：
 
 ```console

package/docs/release-0.2.1.md

@@ -0,0 +1,72 @@
+# Published release record — 0.2.1
+
+Exactly what this release published to the public npm registry. `npm` reports these
+digests; they are the authoritative record of the bytes users receive. They are not
+derived from the local `dist` directory, whose `provenance.json` is regenerated on
+every build and therefore carries a different build timestamp.
+
+| Package | Packed | Unpacked | shasum (sha1) |
+| --- | ---: | ---: | --- |
+| `dsh-ops@0.2.1` | 501.9 kB | 2.4 MB | `fe4fc569565e5544b1b779b90192f610de1783d3` |
+| `@dsh-ops/fastctx-win32-x64@0.2.1` | 24.7 MB | 49.9 MB | `96caf16a5978f699560d05b2126a2c6f92efb08c` |
+| `@dsh-ops/bash-win32-x64@0.2.1` | 161.2 MB | 411.1 MB | `8df967f0f9ac0104e327ae1e50d55036f4790121` |
+| `@dsh-ops/pwsh-win32-x64@0.2.1` | 107.6 MB | 256.6 MB | `4a3cd69f68ffc616dd6d334f170bf7423e660f24` |
+
+All four are published with public access and tag `latest`. The main package declares
+the three Windows x64 runtime packages as exact `optionalDependencies`; the platform
+packages were published first, so the main package never pointed at a version the
+registry did not have.
+
+## Two publishing problems this release hit
+
+1. **Wrong credential selected.** The first attempt used a pre-existing credential in
+   the operator's `~/.npmrc`, which is a different token, and npm answered `E403`
+   (2FA or a granular bypass token required). The maintainer's explicitly selected
+   bypass credential was accepted. The earlier local message blaming the maintainer's
+   token was wrong; the error was credential selection.
+2. **Hard links are rejected by the registry.** PortableGit's tree contains 84
+   hardlinked paths, and npm refused the first bash upload with
+   `E415 Unsupported Media Type — Hard link is not allowed`. The assembler now
+   materializes every linked path as an independent file with identical bytes, which
+   is why the published bash package is 161.2 MB (411.1 MB unpacked) rather than the
+   136.1 MB measured before. Runtime layout and file contents are unchanged; the
+   executable digests still match `lib/shells.js`.
+
+## Distribution
+
+- Tag `v0.2.1` and a GitHub Release with **notes only, no assets**. `v0.2.0`
+  attached four tarballs and `SHA256SUMS`; npm is now the installation channel, so
+  re-uploading ~290 MB of tarballs would only duplicate it.
+- Repository Actions are **disabled at repository level**. Nothing runs on push,
+  tag, schedule or dispatch; the tag push above triggered no workflow. `.github/workflows/`
+  is kept as documentation of the intended gate and pipeline, and each file now says
+  at the top that it does not run. Publication is performed from a maintainer machine.
+
+## What was verified, and what was not
+
+Verified by installing the published artifacts from the registry into an isolated
+directory with `--ignore-scripts`:
+
+- `resolveShells` finds both bundled shells inside the installed dependency tree;
+- the installed bash reports `GNU bash, version 5.3.15(2)-release`;
+- the installed pwsh reports `7.6.6`;
+- `npx --yes dsh-ops@0.2.1 status --profile tui` runs and maps `tui` to `dsh-tui`;
+- `install --profile tui|desktop --dry-run` selects the expected official CLI,
+  including Desktop's own `resources/runtime/cli/bin/dsh.cmd`.
+
+Not verified: a live install into a real profile, the marketplace's pnpm path and hot
+reload, official uninstall behaviour, and end-to-end plugin mount inside a running
+DSH session. The repository regression suites were not updated or run for this
+release, and no CI gate guarded this publication.
+
+## Licence status
+
+The Windows payload packages redistribute complete upstream runtime trees: Git for
+Windows (GPL and other licences) and PowerShell (MIT and third-party licences). Their
+original licences and notices travel inside the packages, and `provenance.json`
+records the upstream URL, release, byte count and SHA-256 of the archive each payload
+came from. The complete corresponding-source closure for every GPL/LGPL component in
+the PortableGit inventory has **not** been collected or reviewed; no written offer was
+invented, and the plugin's MIT licence does not relicense the upstream components.
+This is a documented, unresolved compliance item, published at the maintainer's
+explicit direction.

package/docs/schema-current.json

@@ -58,20 +58,20 @@
     "approximateTokens": 1681
   },
   "fileOnlyPrompt": {
-    "bytes": 470,
-    "approximateTokens": 118
+    "bytes": 527,
+    "approximateTokens": 132
   },
   "bashSchema": {
-    "bytes": 894,
-    "approximateTokens": 224
+    "bytes": 961,
+    "approximateTokens": 241
   },
   "fullWithBash": {
-    "bytes": 10633,
-    "approximateTokens": 2659
+    "bytes": 10700,
+    "approximateTokens": 2675
   },
   "toolingPrompt": {
-    "bytes": 1053,
-    "approximateTokens": 264
+    "bytes": 1110,
+    "approximateTokens": 278
   },
   "publishedServerInstructions": {
     "bytes": 0,

package/docs/schema-measurement.md

@@ -8,9 +8,9 @@ Baseline: plugin `dee3c57`, FastCtx 0.2.6, before presentation changes. Current:
 | --- | ---: | ---: | ---: |
 | Nine FastCtx schemas (full-access session) | 18,889 | 9,739 | 48.4% |
 | Four file schemas | 12,807 | 6,724 | 47.5% |
-| Routing section (original full ladder vs restored compact three-layer table) | 3,373 | 1,053 | 68.8% |
+| Routing section (original full ladder vs compact three-layer table with strict-argument reminder) | 3,373 | 1,110 | 67.1% |
 
-Full-access FastCtx schema estimate: 4,723 → 2,435 tokens. The restored ops_bash schema adds 894 bytes (~224 tokens); full FastCtx+bash surface is 10,633 bytes (~2,659 tokens). Restricted file-only surface: about 1,681 tokens; its routing table is 470 bytes (~118 tokens). No server instructions are published (the original raw server instructions were 246 bytes); the old host-shell section is also removed. Baseline excludes ops_bash, so compare nine FastCtx tools like-for-like rather than treating restoration as a regression of those numbers. Total request savings depend on host presentation; these are not API usage/billing measurements.
+Full-access FastCtx schema estimate: 4,723 → 2,435 tokens. The corrected object-root ops_bash schema adds 961 bytes (~241 tokens); full FastCtx+bash surface is 10,700 bytes (~2,675 tokens). Restricted file-only surface: about 1,681 tokens; its routing table is 527 bytes (~132 tokens). No server instructions are published (the original raw server instructions were 246 bytes); the old host-shell section is also removed. Baseline excludes ops_bash, so compare nine FastCtx tools like-for-like rather than treating restoration as a regression of those numbers. Total request savings depend on host presentation; these are not API usage/billing measurements.
 
 `ops_grep` went from 3,766 → 2,019 bytes; `ops_inspect_local_file` from 4,375 → 1,968. `ops_replace` is retained: schema cost cannot establish invocation frequency, and no usage-frequency measurement was collected.
 

package/dsh-plugin.json

@@ -3,7 +3,7 @@
   "manifestVersion": "0.15",
   "id": "dsh-ops.fastctx",
   "name": "dsh-ops",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "license": "MIT AND Apache-2.0",
   "facets": {
     "host": {
@@ -39,9 +39,9 @@
   "contributes": {
     "x-display": [
       {
-        "icon": "./icon.svg",
-        "title": "Repository tools",
-        "description": "Read, search, replace, and run commands through the hosted FastCtx ops_* tool surface instead of shell commands.",
+        "icon": "./icon.png",
+        "title": "dsh-ops",
+        "description": "Provides bash, PowerShell 7, and a suite of high-performance tools written in Rust for Windows DSH to enhance token efficiency",
         "locales": [
           "locale/en.json",
           "locale/zh.json"

package/lib/policy.js

@@ -43,7 +43,8 @@ export function renderToolingPolicy({ published, enableShellTools, mounted, leve
   if (names.has(publicToolName('run_background'))) {
     lines.push(`| Background commands / owned jobs | ${SHELL_TOOLS.slice(1).map(publicToolName).join(', ')} |`)
   }
-  lines.push('', '- Do not build shell command lines for file operations.',
+  lines.push('', '- ops_* arguments are strict: pass only declared fields.',
+    '- Do not build shell command lines for file operations.',
     '- On a tool error, correct the arguments and retry; do not switch to a shell workaround.')
   if (names.has(BASH_TOOL)) lines.push('- Prefer bash for command execution. Use PowerShell only when Windows-native functionality is necessary; fix bash errors in bash, do not switch shells or mix their syntax.')
   if (names.has(publicToolName('run_background'))) lines.push('- Only operate on job IDs you started in this session.')

package/lib/shells.js

@@ -807,21 +807,26 @@ export function bashToolDefinition({ file, source, subprocess }) {
     name: BASH_TOOL_NAME,
     description: bashToolDescription(),
     parameters: {
-      command: { type: 'string', required: true, description: 'The bash command to execute.' },
-      workdir: {
-        type: 'string',
-        description: 'Working directory for this command. Defaults to the session workspace when omitted.',
-      },
-      timeoutMs: {
-        type: 'number',
-        description: 'Timeout in milliseconds; the command is killed on expiry. '
-          + `Defaults to ${DEFAULT_BASH_TIMEOUT_MS}.`,
-      },
-      graceMs: {
-        type: 'number',
-        description: 'Grace period in milliseconds between termination and a forced kill. '
-          + `Defaults to ${DEFAULT_GRACE_MS}.`,
+      type: 'object',
+      properties: {
+        command: { type: 'string', description: 'The bash command to execute.' },
+        workdir: {
+          type: 'string',
+          description: 'Working directory for this command. Defaults to the session workspace when omitted.',
+        },
+        timeoutMs: {
+          type: 'number',
+          description: 'Timeout in milliseconds; the command is killed on expiry. '
+            + `Defaults to ${DEFAULT_BASH_TIMEOUT_MS}.`,
+        },
+        graceMs: {
+          type: 'number',
+          description: 'Grace period in milliseconds between termination and a forced kill. '
+            + `Defaults to ${DEFAULT_GRACE_MS}.`,
+        },
       },
+      required: ['command'],
+      additionalProperties: false,
     },
     output: {
       schema: BASH_OUTPUT_SCHEMA,

package/locale/en.json

@@ -1,6 +1,6 @@
 {
   "meta": {
-    "title": "Repository tools",
-    "description": "Read, search, replace, and run commands through the hosted FastCtx ops_* tool surface instead of shell commands."
+    "title": "dsh-ops",
+    "description": "Provides bash, PowerShell 7, and a suite of high-performance tools written in Rust for Windows DSH to enhance token efficiency"
   }
 }

package/locale/zh.json

@@ -1,6 +1,6 @@
 {
   "meta": {
-    "title": "仓库工具",
-    "description": "通过托管的 FastCtx ops_* 工具完成读取、搜索、替换与命令执行，替代 shell 命令。"
+    "title": "dsh-ops",
+    "description": "为windows的dsh提供bash、powershell7及一系列rust编写的高性能tools来提高token效率"
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-ops",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "publishConfig": {
     "access": "public"
   },
@@ -18,8 +18,8 @@
   "cpu": [
     "x64"
   ],
-  "description": "DSH plugin: hosts the vendored FastCtx MCP runtime as the profile's repository tool surface, and steers the model away from PowerShell.",
-  "icon": "./icon.svg",
+  "description": "Provides bash, PowerShell 7, and a suite of high-performance tools written in Rust for Windows DSH to enhance token efficiency",
+  "icon": "./icon.png",
   "keywords": [
     "dsh",
     "dsh-plugin",
@@ -54,7 +54,7 @@
     "bin",
     "cordis.patch.yml",
     "dsh-plugin.json",
-    "icon.svg",
+    "icon.png",
     "locale",
     "docs",
     "LICENSE",
@@ -96,6 +96,11 @@
       "optional": true
     }
   },
+  "optionalDependencies": {
+    "@dsh-ops/fastctx-win32-x64": "0.2.1",
+    "@dsh-ops/bash-win32-x64": "0.2.1",
+    "@dsh-ops/pwsh-win32-x64": "0.2.1"
+  },
   "devDependencies": {
     "@deepseek-ai/cordis": "4.0.4",
     "@deepseek-ai/dsh-scope": "0.2.0-rc.2",
@@ -107,10 +112,5 @@
   },
   "engines": {
     "node": "^22.19 || >=24"
-  },
-  "optionalDependencies": {
-    "@dsh-ops/fastctx-win32-x64": "0.2.1",
-    "@dsh-ops/bash-win32-x64": "0.2.1",
-    "@dsh-ops/pwsh-win32-x64": "0.2.1"
   }
 }

package/icon.svg

@@ -1,12 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="36" height="36" viewBox="0 0 36 36" fill="none">
-  <g stroke="#7C7C82" stroke-width="2.4" stroke-linecap="round" stroke-linejoin="round">
-    <rect x="4.2" y="6.2" width="27.6" height="23.6" rx="4.2" />
-    <path d="M10 14.4l4 3.8-4 3.8" />
-    <path d="M17.4 22h4.4" />
-    <path d="M25.6 13v10" />
-  </g>
-  <g fill="#7C7C82">
-    <circle cx="25.6" cy="13" r="2.3" />
-    <circle cx="25.6" cy="23" r="2.3" />
-  </g>
-</svg>