dsh-packycode-api 1.2.10 → 1.2.11

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 1.2.11
+
+- **Gemini tool continuations send no real thought signature.** Gemini 4 Argon long tasks ended in HTTP 400 `Invalid thought signature.` (`packy_upstream_error`) after DSH's retries. PackyCode support attributes this to its native Gemini route not handling the signature field in tool calls. It advises against resending through that route and recommends that clients ignore the field. Requests for both Gemini models now replace every thought signature with Google's documented `skip_thought_signature_validator`, which also fills the first function call of each step whose response came back unsigned. Only the signature field changes: the protocol (`google-generative-ai`), base URL, model IDs, thinking levels and DSH's stored replay state are unchanged, and no request is routed elsewhere. Google notes that skipped signatures can weaken reasoning continuity across tool steps. Flash keeps its one resend after an HTTP 400 signature refusal; such a refusal still never disables or rotates a key.
+- Validation, 2026-10-16: 458 offline tests (one new; four failed without the change), both rebuilt bundles and the versioned tarball. Live, only the signature field changed between runs.
+  - Before: a 14-step Argon tool chain at low effort got 2 `Corrupted thought signature` refusals in 17 requests. A captured request was still accepted after pruning a tool result, editing call arguments or editing the user text, so DSH's history rewriting does not cause the refusals.
+  - After: 95 long-chain requests through the built route, carrying up to 26 skip-signed parts and no real signature, all returned HTTP 200 with no refusal. The runs covered Argon at low (14 steps plus a second turn), Argon at high (8 steps), Flash at low (12 steps plus a second turn), and Argon and Flash at high (24 steps plus a second turn each). Every answer was correct.
+  - `scripts/gemini-tool-check.mjs` passed 3/3 rounds at high for both models with no resend. `scripts/live-check.mjs` passed for every HTTP model, key rotation and the RPC projections. No DSH restart.
+- **The release job receives the published tarball.** The v1.2.10 tag run published to npm, then its hand-off step found no tarball: `actions/upload-artifact@v4` skips files under a dot directory such as `.artifacts/` unless `include-hidden-files` is set. The release job was therefore skipped, and the v1.2.10 Release was made by hand with the tarball npm serves (its SHA-512 matched `dist.integrity`). The hand-off now sets `include-hidden-files: true`; its glob still matches only the published tarball.
+
 ## 1.2.10
 
 - **OpenAI's transient server error is retried instead of failing the turn.** On the Codex group, a `gpt-6.1-sol` turn sometimes ended in 本轮运行失败 "An error occurred while processing your request. You can retry your request, or contact us through our help center at help.openai.com if the error persists." with `PI_AI_ERROR`. The gateway had already answered HTTP 200 and started the stream when the upstream failed: an SSE `error` event carrying a 503 `server_error`, then `response.failed`, before any output. The OpenAI SDK raises that without an HTTP status, so DSH's adapter, which reads a failure's category from status words, filed it as `PI_AI_ERROR`, a code no retry policy re-runs. The same failure sent as an HTTP 500 is `SERVER` and was already retried. The route now files OpenAI's `server_error` (its sentence, or pi-ai's `server_error:` prefix) as `SERVER` when the adapter left it unclassified, on prepared and direct calls alike, so the route's existing policy (up to 20 retries with backoff) resends the request. Only the code changes: if every retry fails, the upstream sentence still reaches the user, after up to about three minutes, as for an HTTP 500. The key stays enabled and is not rotated. The official Codex client also retries this failure (`ApiError::Retryable`).

package/README.en.md

@@ -48,10 +48,10 @@ You need **DeepSeek Harness** and a **PackyCode (PackyAPI) API key**. For DSH se
 Open the desktop application's **Plugins** page, click **Add plugin**, and enter the package name **with a version** as the **package name or address**:
 
 ```text
-dsh-packycode-api@1.2.10
+dsh-packycode-api@1.2.11
 ```
 
-Choose the **official** install source, then click **Install**. `1.2.10` was the latest release when this was written; the [npm page](https://www.npmjs.com/package/dsh-packycode-api) shows the current one.
+Choose the **official** install source, then click **Install**. `1.2.11` was the latest release when this was written; the [npm page](https://www.npmjs.com/package/dsh-packycode-api) shows the current one.
 
 > **Always include the version.** With a bare `dsh-packycode-api`, the install prompt shows the newest version on npm, but DSH's bundled pnpm by default installs only versions published at least 24 hours ago, so you can end up several releases behind with no sign of it in the prompt. With an exact version, pnpm installs that version and adds it to the profile's `minimumReleaseAgeExclude` itself. Afterwards, check **Current version** under **Settings → PackyCode → Plugin version**.
 
@@ -72,7 +72,7 @@ Choose a model from the `PackyCode` group. `deepseek-flash`, `gpt-6.1-sol`, `gpt
 
 The **Plugins** page shows the installed state and version, and is also where you enable, disable, or uninstall.
 
-**For non-desktop profiles only:** `dsh plugin --profile <name> add dsh-packycode-api@1.2.10`. Do not use it for `desktop` — the CLI refuses it (`profile "desktop" is managed exclusively by the Electron application`).
+**For non-desktop profiles only:** `dsh plugin --profile <name> add dsh-packycode-api@1.2.11`. Do not use it for `desktop` — the CLI refuses it (`profile "desktop" is managed exclusively by the Electron application`).
 
 For a local checkout, keep the `link:` prefix: `dsh plugin --profile <name> add link:/path/to/dsh-packycode-api`. **Do not pass a bare path or `file:`** — that install copies the whole checkout, `node_modules` included, into the profile, where it then shadows the packages the DSH installation itself provides and the plugin looks uninstalled; see the FAQ. If you already installed that way, uninstall first and reinstall as above.
 
@@ -184,7 +184,7 @@ All nine models in the current catalog declare text and image input. DeepSeek Fl
 
 Gemini capabilities and limits follow Google's model pages: [Gemini 4 Argon](https://ai.google.dev/gemini-api/docs/models/gemini-4-argon), [Gemini 3.8 Flash](https://ai.google.dev/gemini-api/docs/models/gemini-3.8-flash). Both models use the native Gemini protocol through `/v1beta/models/{model}:streamGenerateContent`, streaming text, thinking and tool calls; images are read through DSH's attachment service. Thinking levels are sent with `thinkingLevel`. Both routes use the single-stream output limit without automatic continuation beyond 65,536 tokens. Available endpoints and groups follow the [PackyAPI live model catalog](https://www.packyapi.com/api/pricing).
 
-**Flash native tool continuation:** The gateway sometimes refuses an unchanged valid signature with `Corrupted thought signature` / `Invalid thought signature`. For a current signed tool continuation returning HTTP 400 before any stream event, the plugin waits one second and resends once with the same key, signature and request. A second failure is returned unchanged; the protocol and model stay the same. Text, images and tool continuation passed live checks. This mitigates intermittent gateway refusals, rather than repairing persistent upstream signature errors.
+**Gemini tool continuation and thought signatures:** PackyCode's native Gemini route does not handle thought signatures in tool calls correctly. It answers HTTP 400 `Invalid thought signature` / `Corrupted thought signature`, and resending the same request does not help (PackyCode support's answer). For Gemini 4 Argon and Gemini 3.8 Flash the plugin therefore sends none of the signatures the model returned. Wherever a signature is required, it sends Google's documented validator-skip value `skip_thought_signature_validator` ([Google's guide](https://ai.google.dev/gemini-api/docs/thought-signatures)). The protocol, endpoint and model stay the same, and DSH's replay record keeps the original signatures. Google notes that skipped signatures can weaken reasoning continuity across tool steps. Flash keeps its earlier safeguard: after an HTTP 400 signature refusal before any stream event, it waits one second and resends once. Such a 400 is never treated as a failed key.
 
 Grok 4.7's context and reasoning levels follow the [official guide](https://docs.x.ai/developers/grok-4-7). There is no separate text-output limit; the plugin uses the context size as its numeric output ceiling, bounded by the remaining context per request.
 
@@ -213,7 +213,7 @@ Only GPT Responses requests keep `prompt_cache_key`; other Responses models omit
 
 ## Update and uninstall
 
-**Update:** open **Settings → PackyCode** and, when a newer version is listed, click **Update plugin**. It installs that exact version into the owning profile with DSH's bundled pnpm and reads `package.json` back before reporting success. A local `link:` checkout does not get the button. Then quit and reopen the desktop application. A page refresh does not reload the Host. Reinstalling from the **Plugins** page works too, again with the version in the package name (for example `dsh-packycode-api@1.2.10`); without it you may get a version that is merely the newest one published at least 24 hours ago.
+**Update:** open **Settings → PackyCode** and, when a newer version is listed, click **Update plugin**. It installs that exact version into the owning profile with DSH's bundled pnpm and reads `package.json` back before reporting success. A local `link:` checkout does not get the button. Then quit and reopen the desktop application. A page refresh does not reload the Host. Reinstalling from the **Plugins** page works too, again with the version in the package name (for example `dsh-packycode-api@1.2.11`); without it you may get a version that is merely the newest one published at least 24 hours ago.
 
 **Coming back from a local-path install, uninstall first.** An update is a `pnpm add`: it rewrites the files inside the package directory and leaves a `node_modules` that an earlier local-path install left there. That older tree keeps shadowing the packages the DSH installation provides, so the plugin row fails to load with no visible reason. **Uninstall** runs `pnpm remove`, which deletes the package directory outright — only a reinstall after that is clean. `node scripts/install-check.mjs` reports whether a profile is in that state.
 
@@ -229,7 +229,7 @@ ls ~/.dsh/profiles/desktop/node_modules/dsh-packycode-api/node_modules
 
 Output means a leftover tree: a registry install ships no `node_modules`, so this one usually comes from an earlier local-path install (`file:`, or a bare path instead of `link:`). It sits inside the profile directory, and DSH resolves a plugin's imports from inside the profile first, so the plugin gets those old copies — for example `@deepseek-ai/schemastery` 3.18.2, which has no `Schema.volatile()`, so the module throws while it is imported. When an import fails the Loader creates no fiber for that row and no client bundle is composed either, so the model route, the RPC channel, and the settings panel all stay absent.
 
-Recovery: **uninstall** the plugin on the **Plugins** page, **install** it again with the version in the package name (for example `dsh-packycode-api@1.2.10`), then quit and reopen the desktop application. Uninstall runs `pnpm remove` and deletes the whole package directory; reinstalling or clicking **Update** only rewrites files and keeps the leftover tree. Deleting that `node_modules` by hand and restarting works too.
+Recovery: **uninstall** the plugin on the **Plugins** page, **install** it again with the version in the package name (for example `dsh-packycode-api@1.2.11`), then quit and reopen the desktop application. Uninstall runs `pnpm remove` and deletes the whole package directory; reinstalling or clicking **Update** only rewrites files and keeps the leftover tree. Deleting that `node_modules` by hand and restarting works too.
 
 **Right after a first install, every card in Settings shows `transport failure for /packycode-api/…: HTTP 405`?** The installed version is 1.1.6 or earlier, usually because only the bare package name was entered: the install prompt shows the newest version, but pnpm installs the newest one published at least 24 hours ago (see **Install the plugin**). Those older versions can register their settings channel only after DSH restarts and rebuilds its `connection` service. So right after a first install `/packycode-api` does not exist yet, requests fall through to the static page, and it answers 405; the model route and the settings panel itself load normally. From 1.1.7 on, a first install needs no restart. Check which version was installed:
 

package/README.md

@@ -48,10 +48,10 @@
 打开桌面应用的**插件**页，点击**添加插件**，在**包名或地址**中填入**带版本号**的包名：
 
 ```text
-dsh-packycode-api@1.2.10
+dsh-packycode-api@1.2.11
 ```
 
-在**安装源**中选择**官方源**，然后点击**安装**。`1.2.10` 是写这份说明时的最新版，当前最新版本号以 [npm 页面](https://www.npmjs.com/package/dsh-packycode-api) 为准。
+在**安装源**中选择**官方源**，然后点击**安装**。`1.2.11` 是写这份说明时的最新版，当前最新版本号以 [npm 页面](https://www.npmjs.com/package/dsh-packycode-api) 为准。
 
 > **一定要带版本号。** 只填 `dsh-packycode-api` 时，安装前的提示显示的是 npm 上的最新版，但 DSH 自带的 pnpm 默认只安装发布满 24 小时的版本，实际装上的可能是好几个版本之前的旧版，而安装提示里看不出这一点。填写精确版本时，pnpm 会直接安装这个版本，并自动把它加入 profile 的 `minimumReleaseAgeExclude`。装好后可以在 **设置 → PackyCode → 插件版本** 核对「当前版本」。
 
@@ -72,7 +72,7 @@ dsh-packycode-api@1.2.10
 
 桌面应用的**插件**页可以看到已安装状态与版本，也可以在那里启用、停用或卸载。
 
-**仅用于非 desktop profile：** `dsh plugin --profile <name> add dsh-packycode-api@1.2.10`。不要对 `desktop` 使用它 —— CLI 会直接拒绝（`profile "desktop" is managed exclusively by the Electron application`）。
+**仅用于非 desktop profile：** `dsh plugin --profile <name> add dsh-packycode-api@1.2.11`。不要对 `desktop` 使用它 —— CLI 会直接拒绝（`profile "desktop" is managed exclusively by the Electron application`）。
 
 本地开发要加 `link:` 前缀：`dsh plugin --profile <name> add link:/path/to/dsh-packycode-api`。**不要直接写路径（或 `file:`）** —— 那样的安装会把整个仓库目录（连同 `node_modules`）复制进 profile，之后它会在 profile 内部挡住 DSH 自带的包，插件看起来像没装，见「常见问题」。已经那样装过的话，先卸载再按上面的方式重装。
 
@@ -184,7 +184,7 @@ Claude Code CLI → 本机临时 MCP web_search → 插件选定的 DeepSeek/GPT
 
 Gemini 的能力与限制来自 Google 官方模型页：[Gemini 4 Argon](https://ai.google.dev/gemini-api/docs/models/gemini-4-argon)、[Gemini 3.8 Flash](https://ai.google.dev/gemini-api/docs/models/gemini-3.8-flash)。两款模型统一使用 Gemini 原生协议，通过 `/v1beta/models/{model}:streamGenerateContent` 流式返回文字、思考和工具调用，图片仍由 DSH 附件服务读取。思考档位通过 `thinkingLevel` 传入。两者均使用单次流式输出上限，不执行超过 65,536 token 的自动续写。可用端点与分组以 [PackyAPI 实时模型目录](https://www.packyapi.com/api/pricing) 为准。
 
-**Flash 原生工具续聊：** 网关偶尔会拒绝原样回传的有效签名，返回 `Corrupted thought signature` / `Invalid thought signature`。插件仅在当前工具续聊、HTTP 400 且尚未输出任何流事件时，等待 1 秒，用相同 Key、签名及请求原样重发一次；再次失败时仍返回原错误，不更换协议或模型。文字、图片和工具续聊均已实测；该处理缓解网关的间歇性拒绝，不能保证修复持续性的上游签名错误。
+**Gemini 工具续聊的思维签名：** PackyCode 的 Gemini 原生通道在工具调用场景下不能正确处理思维签名，会返回 HTTP 400 `Invalid thought signature` / `Corrupted thought signature`，原样重发也无济于事（PackyCode 客服的答复）。因此插件对 Gemini 4 Argon 和 Gemini 3.8 Flash 不再回传模型返回的签名，而是按 [Google 文档](https://ai.google.dev/gemini-api/docs/thought-signatures) 在需要签名的位置填入跳过校验的值 `skip_thought_signature_validator`。协议、端点和模型都不变，DSH 的回放记录仍保留原始签名。Google 提示跳过签名可能削弱多步工具调用之间的推理连贯性。Flash 仍保留原有兜底：HTTP 400 签名拒绝且尚未输出任何流事件时，等待 1 秒原样重发一次。这类 400 不会被当作 Key 失效。
 
 Grok 4.7 的上下文与推理档位来自 [官方文档](https://docs.x.ai/developers/grok-4-7)。官方没有单独限制文字输出长度；插件将输出上限设为上下文大小，并按每次请求的剩余上下文收紧。
 
@@ -213,7 +213,7 @@ Responses 请求只有 GPT 模型保留 `prompt_cache_key`，其他 Responses
 
 ## 更新与卸载
 
-**更新：** 打开 **设置 → PackyCode**，有新版本时点「更新插件」。它会在当前 profile 目录里用 DSH 自带的 pnpm 安装精确版本，并读回 `package.json` 确认版本落地。本地 `link:` 开发安装不会出现这个按钮。完成后完全退出并重新打开桌面应用。只刷新页面不会重载 Host。也可以在**插件**页重新安装，同样要填写带版本号的包名（例如 `dsh-packycode-api@1.2.10`），否则装上的可能是发布满 24 小时的旧版。
+**更新：** 打开 **设置 → PackyCode**，有新版本时点「更新插件」。它会在当前 profile 目录里用 DSH 自带的 pnpm 安装精确版本，并读回 `package.json` 确认版本落地。本地 `link:` 开发安装不会出现这个按钮。完成后完全退出并重新打开桌面应用。只刷新页面不会重载 Host。也可以在**插件**页重新安装，同样要填写带版本号的包名（例如 `dsh-packycode-api@1.2.11`），否则装上的可能是发布满 24 小时的旧版。
 
 **从本地路径安装切回官方源时，必须先卸载。** 「更新」是 `pnpm add`，它只重写包目录里的文件，不会删除更早一次本地路径安装留在包目录内的 `node_modules`；那份旧依赖会继续挡住 DSH 自带的包，插件行加载失败且看不出原因。「卸载」执行的是 `pnpm remove`，会删掉整个包目录，重装才是干净的。用 `node scripts/install-check.mjs` 可以确认当前 profile 是否处于这个状态。
 
@@ -229,7 +229,7 @@ ls ~/.dsh/profiles/desktop/node_modules/dsh-packycode-api/node_modules
 
 有输出就是残留：从 npm 安装的包不会自带 `node_modules`，这一份通常来自更早一次「本地路径」安装（`file:` 或直接写路径，而不是 `link:`）。它位于 profile 目录内部，而 DSH 解析插件导入时优先使用 profile 内的副本，所以插件拿到的仍是那份旧依赖 —— 例如 `@deepseek-ai/schemastery` 3.18.2 没有 `Schema.volatile()`，模块在导入阶段就抛错。导入失败时 Loader 不会为这一行创建 fiber，客户端 bundle 也不会被组合，于是模型路由、RPC 通道和设置页全都不会出现。
 
-修复：到**插件**页**卸载**本插件，再用带版本号的包名重新**安装**（例如 `dsh-packycode-api@1.2.10`），然后完全退出并重新打开桌面应用。卸载执行的是 `pnpm remove`，会删掉整个包目录；直接重装或点「更新」只重写文件，不会清掉这份残留。也可以手动删掉上面那个 `node_modules` 再重启。
+修复：到**插件**页**卸载**本插件，再用带版本号的包名重新**安装**（例如 `dsh-packycode-api@1.2.11`），然后完全退出并重新打开桌面应用。卸载执行的是 `pnpm remove`，会删掉整个包目录；直接重装或点「更新」只重写文件，不会清掉这份残留。也可以手动删掉上面那个 `node_modules` 再重启。
 
 **首次安装后，设置页每张卡片都显示 `transport failure for /packycode-api/…: HTTP 405`？** 实际装上的是 1.1.6 或更早的版本，通常是因为安装时只填了包名：安装提示显示的是最新版，pnpm 实际装的却是发布满 24 小时的旧版（见「安装插件」）。这些旧版要等 DSH 重启、重建它的 `connection` 服务之后，才能注册设置通道。所以首次安装后 `/packycode-api` 通道还不存在，请求落到静态页面，返回 405；模型路由和设置页本身照常加载。1.1.7 起首次安装不需要重启。先确认装上的版本：
 

package/lib/index.js

@@ -6980,37 +6980,90 @@ function guardGeminiReplay(open, { model, context, signal, wait = waitForRetry }
 //#endregion
 //#region src/gemini-api.js
 /** Gemini's native API, including level-based thinking on older pi-ai hosts. */
+const GEMINI_MODELS = ["gemini-4-argon", "gemini-3.8-flash"];
+/**
+* Google's documented thought signature for a function call whose real one
+* cannot be sent: the API skips signature validation for it.
+*/
+const SKIP_THOUGHT_SIGNATURE = "skip_thought_signature_validator";
+/**
+* Send no real thought signature.
+*
+* PackyCode's native Gemini route refuses signed tool continuations with
+* HTTP 400 "Invalid thought signature" / "Corrupted thought signature", and
+* its support attributes this to the route not handling the signature field
+* in tool calls: resending does not help, and clients should ignore the field.
+* Every signature in the request therefore becomes Google's skip value. Gemini
+* 3 and later still require a signature on the first function call of each
+* step, so that part carries the skip value even when its response had none.
+* DSH's replay state keeps the signatures the model returned; only the wire
+* request changes.
+* @param contents - the request's `contents`.
+* @returns contents without a real signature.
+*/
+function skipThoughtSignatures(contents) {
+	if (!Array.isArray(contents)) return contents;
+	return contents.map((content) => {
+		if (!Array.isArray(content?.parts)) return content;
+		let stepStart = content.role === "model";
+		return {
+			...content,
+			parts: content.parts.map((part) => {
+				const firstCall = stepStart && part?.functionCall !== void 0;
+				if (firstCall) stepStart = false;
+				return firstCall || typeof part?.thoughtSignature === "string" ? {
+					...part,
+					thoughtSignature: SKIP_THOUGHT_SIGNATURE
+				} : part;
+			})
+		};
+	});
+}
+/** Run `rewrite` on the request payload ahead of any caller hook. */
+function withPayload(options, rewrite) {
+	return {
+		...options,
+		onPayload: async (payload, descriptor) => {
+			const rewritten = rewrite(payload);
+			return await options?.onPayload?.(rewritten, descriptor) ?? rewritten;
+		}
+	};
+}
+const skipped = (payload) => ({
+	...payload,
+	contents: skipThoughtSignatures(payload.contents)
+});
 /**
 * pi-ai 0.85 treats Argon as a budget-based model, and defaults Flash to
 * MINIMAL when reasoning is omitted. Both models support LOW/MEDIUM/HIGH,
 * default to MEDIUM and cannot disable thinking. Keep the native SDK stream,
-* credentials, tools and replay signatures; correct only that config.
+* credentials and tools; correct that config and send no real signature.
 */
 function createGeminiApi() {
 	const api = googleGenerativeAIApi();
 	return {
 		...api,
+		stream(model, context, options) {
+			if (!GEMINI_MODELS.includes(model.id)) return api.stream(model, context, options);
+			return api.stream(model, context, withPayload(options, skipped));
+		},
 		streamSimple(model, context, options) {
-			if (!["gemini-4-argon", "gemini-3.8-flash"].includes(model.id)) return api.streamSimple(model, context, options);
+			if (!GEMINI_MODELS.includes(model.id)) return api.streamSimple(model, context, options);
 			const level = options?.reasoning === void 0 ? "medium" : clampThinkingLevel(model, options.reasoning);
 			const wireLevel = (model.thinkingLevelMap?.[level] ?? level).toUpperCase();
-			return api.streamSimple(model, context, {
-				...options,
-				onPayload: async (payload, descriptor) => {
-					const { thinkingBudget: _budget, ...thinking } = payload.config?.thinkingConfig ?? {};
-					const normalized = {
-						...payload,
-						config: {
-							...payload.config,
-							thinkingConfig: {
-								...thinking,
-								thinkingLevel: wireLevel
-							}
+			return api.streamSimple(model, context, withPayload(options, (payload) => {
+				const { thinkingBudget: _budget, ...thinking } = payload.config?.thinkingConfig ?? {};
+				return skipped({
+					...payload,
+					config: {
+						...payload.config,
+						thinkingConfig: {
+							...thinking,
+							thinkingLevel: wireLevel
 						}
-					};
-					return await options?.onPayload?.(normalized, descriptor) ?? normalized;
-				}
-			});
+					}
+				});
+			}));
 		}
 	};
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-packycode-api",
-  "version": "1.2.10",
+  "version": "1.2.11",
   "description": "Use PackyCode API keys in DeepSeek Harness with multi-protocol models, image generation and editing, separate key rings, and balance display",
   "type": "module",
   "main": "./lib/index.js",