dsh-packycode-api 1.4.9 → 1.4.10

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 1.4.10
+
+- **Auto review works again on DSH 0.2.2.** DSH 0.2.2-rc.2 changed the official reviewer's model request: the system prompt is still `REVIEW_POLICY`, but the user message is now the environment followed by one JSON Session item per message, with the pending tool call last, instead of 0.2.1's one message holding four labelled sections. The plugin recognized only the old layout, so on 0.2.2 it passed every review through to the session model: a chosen Jev or DeepSeek Flash reviewer was never used, and a session model that rejects `temperature` failed the review with `Unsupported parameter: temperature` (GPT-6.1 Terra and GPT-5.6 Sol do; DeepSeek accepts it). The plugin now recognizes the official reviewer by its fixed policy prompt, reads both layouts, and fails a review it cannot read instead of silently passing it through. Jev's state is built from the 0.2.2 items too (the environment, `user-instruction` and other roles, tool schemas, and the pending call with its arguments and schema), and its authorization question names both role spellings.
+- **The route drops the review's `temperature`.** Some models behind the gateway reject the official request's `temperature: 0` outright, and a review's answer does not depend on sampling. The route removes it from official review requests only (recognized by `purpose: 'auto-review'` or the fixed policy prompt), so the `session` reviewer also works on those models; ordinary turns keep their temperature.
+- Validation, 2026-11-13:
+  - **Offline:** 576 tests (new: 0.2.2's request is recognized and read into its environment, items and pending call; Jev's state is built from it; the controller answers it with `jev-1.14.0` and re-addresses it to DeepSeek Flash; an unreadable layout fails closed instead of passing through; the route strips temperature from both 0.2.1- and 0.2.2-shaped review requests and keeps it on ordinary turns), both rebuilt bundles and the versioned tarball.
+  - **Live, `scripts/live-check.mjs` with the test key:** 0.2.1 and 0.2.2 review requests were answered by `jev-1.14.0` (allow: 1.8 s and 2.6 s; deny: 1.3 s and 1.5 s) and by DeepSeek Flash (allow: 1.8 s and 2.4 s; deny: 1.9 s and 1.7 s), all eight decisions correct. All other catalog models answered except `gemini-4-argon`, which the gateway failed upstream with `Publisher model ...` before this change's code ran; key rotation, the rejected-key classification, the RPC projections and the Claude CLI route were unchanged.
+  - **Not checked:** the desktop app's own 0.2.2 review flow end to end (its request is reproduced from the 0.2.2-rc.2 source), and the settings card in the desktop app.
+
 ## 1.4.9
 
 - **Auto review asks `jev-1.14.0`.** PackyCode retired the `jev-latest` alias: on 2026-11-13 `/api/pricing` lists `jev-1.14.0` and `jev-1.13.0` in `typesafe-officially` and no `jev-latest`, and a `/v1/systemone` request naming `jev-latest` is refused before any upstream (`400 model_not_found`, `当前令牌未覆盖供应商`), while `jev-1.14.0` answered in about 1.3 s. The reviewer, the classifier descriptor whose group coverage the settings read, the denial reasons and every failure sentence now use `jev-1.14.0`.

package/README.en.md

@@ -48,10 +48,10 @@ You need **DeepSeek Harness** and a **PackyCode (PackyAPI) API key**. For DSH se
 Open the desktop application's **Plugins** page, click **Add plugin**, and enter the package name **with a version** as the **package name or address**:
 
 ```text
-dsh-packycode-api@1.4.9
+dsh-packycode-api@1.4.10
 ```
 
-Choose the **official** install source, then click **Install**. `1.4.9` was the latest release when this was written; the [npm page](https://www.npmjs.com/package/dsh-packycode-api) shows the current one.
+Choose the **official** install source, then click **Install**. `1.4.10` was the latest release when this was written; the [npm page](https://www.npmjs.com/package/dsh-packycode-api) shows the current one.
 
 > **Always include the version.** With a bare `dsh-packycode-api`, the install prompt shows the newest version on npm, but DSH's bundled pnpm by default installs only versions published at least 24 hours ago, so you can end up several releases behind with no sign of it in the prompt. With an exact version, pnpm installs that version and adds it to the profile's `minimumReleaseAgeExclude` itself. Afterwards, check **Current version** under **Settings → PackyCode → Plugin version**.
 
@@ -72,7 +72,7 @@ Choose a model from the `PackyCode` group. Of the thirteen models, Claude runs t
 
 The **Plugins** page shows the installed state and version, and is also where you enable, disable, or uninstall.
 
-**For non-desktop profiles only:** `dsh plugin --profile <name> add dsh-packycode-api@1.4.9`. Do not use it for `desktop` — the CLI refuses it (`profile "desktop" is managed exclusively by the Electron application`).
+**For non-desktop profiles only:** `dsh plugin --profile <name> add dsh-packycode-api@1.4.10`. Do not use it for `desktop` — the CLI refuses it (`profile "desktop" is managed exclusively by the Electron application`).
 
 For a local checkout, keep the `link:` prefix: `dsh plugin --profile <name> add link:/path/to/dsh-packycode-api`. **Do not pass a bare path or `file:`** — that install copies the whole checkout, `node_modules` included, into the profile, where it then shadows the packages the DSH installation itself provides and the plugin looks uninstalled; see the FAQ. If you already installed that way, uninstall first and reinstall as above.
 
@@ -204,8 +204,8 @@ The card shows whether DSH's plugin is on, how many reviews this plugin answered
 
 - DSH's reviewer sends one model request per review:
   - its fixed `REVIEW_POLICY` as the system prompt;
-  - four JSON sections as the user message: ENVIRONMENT, PROJECT_INSTRUCTIONS, FILTERED_HISTORY, PENDING_ACTION;
-  - and it expects one `{"risk","decision","reason"?}` object back.
+  - DSH 0.2.1 puts the review in one user message holding four JSON sections: ENVIRONMENT, PROJECT_INSTRUCTIONS, FILTERED_HISTORY, PENDING_ACTION; DSH 0.2.2 sends the environment first and then one JSON Session item per message, the pending tool call last. The plugin reads both layouts;
+  - and it expects one `{"risk","decision","reason"?}` object back. Its `temperature: 0` is dropped before a PackyCode model sees it: GPT-6.1 Terra and GPT-5.6 Sol reject it with `Unsupported parameter: temperature`, and the review's answer does not depend on sampling.
 - Every model request passes DSH's `llm/stream` waterfall. The plugin recognizes only this request there; conversation turns and everything else go on untouched.
 - **DeepSeek Flash** gets the same request, re-addressed to the PackyCode route; DSH still reads its answer.
 - **jev-1.14.0** cannot write that object. The plugin passes the four sections and the official policy text to System One as the state and asks two questions: the risk, and whether you explicitly asked for this action.
@@ -215,8 +215,8 @@ The card shows whether DSH's plugin is on, how many reviews this plugin answered
 - What is reviewed, the rules, and what an allow or a denial does all stay DSH's. DSH refuses a call whose review failed (for example, no key reaches jev-1.14.0), and the plugin keeps that.
 - Measured on 37 scenarios with the official request format and the official parser: both reviewers matched all 35 scenarios that have a clear answer.
   - jev-1.14.0's median was 0.35 s, DeepSeek Flash's 2.3 s.
-- If a later DSH changes the review request:
-  - a request the plugin no longer recognizes goes on untouched, reviewed by the conversation model;
+- If a later DSH changes the review request again:
+  - as long as the system prompt is still `REVIEW_POLICY`, the plugin still takes the request over; a layout it cannot read fails that review (so DSH refuses the call) instead of silently falling back to the conversation model;
   - a format jev-1.14.0 cannot read fails that review, which shows in the card's counts.
 - The description under Auto review in the menu says the same model reviews; that is DSH's text. With jev-1.14.0 or DeepSeek Flash chosen, that model reviews.
 
@@ -282,9 +282,9 @@ DeepSeek Flash uses the gateway's Responses endpoint (`/api/pricing` lists `open
 
 ## Update and uninstall
 
-> **Upgrading from 1.3.2 or earlier:** install `dsh-packycode-api@1.4.9` on the Plugins page instead of clicking **Update plugin** in the old settings card. The old button bypasses pnpm's release-age policy: if the version it installs is less than 24 hours old, the profile refuses every other plugin install until that version is 24 hours old. After the install and a restart, the button is the fixed one, and later updates can use it.
+> **Upgrading from 1.3.2 or earlier:** install `dsh-packycode-api@1.4.10` on the Plugins page instead of clicking **Update plugin** in the old settings card. The old button bypasses pnpm's release-age policy: if the version it installs is less than 24 hours old, the profile refuses every other plugin install until that version is 24 hours old. After the install and a restart, the button is the fixed one, and later updates can use it.
 
-**Update:** open **Settings → PackyCode** and, when a newer version is listed, click **Update plugin**. It installs that exact version into the owning profile with DSH's bundled pnpm and reads `package.json` back before reporting success. The install keeps pnpm's release-age policy instead of overriding it: by default pnpm installs the version at once and records it in the profile's `minimumReleaseAgeExclude`; under a stricter pnpm policy the button says when the update can run. The newer version is read from npm, while pnpm downloads it from the profile's own install source: right after a release that source (a regional mirror in particular) may not have it yet, and the button asks you to update again in a few minutes; when the source cannot be reached, it asks you to check the network or proxy. A local `link:` checkout does not get the button. Then quit and reopen the desktop application. A page refresh does not reload the Host. Reinstalling from the **Plugins** page works too, again with the version in the package name (for example `dsh-packycode-api@1.4.9`); without it you may get a version that is merely the newest one published at least 24 hours ago.
+**Update:** open **Settings → PackyCode** and, when a newer version is listed, click **Update plugin**. It installs that exact version into the owning profile with DSH's bundled pnpm and reads `package.json` back before reporting success. The install keeps pnpm's release-age policy instead of overriding it: by default pnpm installs the version at once and records it in the profile's `minimumReleaseAgeExclude`; under a stricter pnpm policy the button says when the update can run. The newer version is read from npm, while pnpm downloads it from the profile's own install source: right after a release that source (a regional mirror in particular) may not have it yet, and the button asks you to update again in a few minutes; when the source cannot be reached, it asks you to check the network or proxy. A local `link:` checkout does not get the button. Then quit and reopen the desktop application. A page refresh does not reload the Host. Reinstalling from the **Plugins** page works too, again with the version in the package name (for example `dsh-packycode-api@1.4.10`); without it you may get a version that is merely the newest one published at least 24 hours ago.
 
 **Coming back from a local-path install, uninstall first.** An update is a `pnpm add`: it rewrites the files inside the package directory and leaves a `node_modules` that an earlier local-path install left there. That older tree keeps shadowing the packages the DSH installation provides, so the plugin row fails to load with no visible reason. **Uninstall** runs `pnpm remove`, which deletes the package directory outright — only a reinstall after that is clean. `node scripts/install-check.mjs` reports whether a profile is in that state.
 
@@ -300,7 +300,7 @@ ls ~/.dsh/profiles/desktop/node_modules/dsh-packycode-api/node_modules
 
 Output means a leftover tree: a registry install ships no `node_modules`, so this one usually comes from an earlier local-path install (`file:`, or a bare path instead of `link:`). It sits inside the profile directory, and DSH resolves a plugin's imports from inside the profile first, so the plugin gets those old copies — for example `@deepseek-ai/schemastery` 3.18.2, which has no `Schema.volatile()`, so the module throws while it is imported. When an import fails the Loader creates no fiber for that row and no client bundle is composed either, so the model route, the RPC channel, and the settings panel all stay absent.
 
-Recovery: **uninstall** the plugin on the **Plugins** page, **install** it again with the version in the package name (for example `dsh-packycode-api@1.4.9`), then quit and reopen the desktop application. Uninstall runs `pnpm remove` and deletes the whole package directory; reinstalling or clicking **Update** only rewrites files and keeps the leftover tree. Deleting that `node_modules` by hand and restarting works too.
+Recovery: **uninstall** the plugin on the **Plugins** page, **install** it again with the version in the package name (for example `dsh-packycode-api@1.4.10`), then quit and reopen the desktop application. Uninstall runs `pnpm remove` and deletes the whole package directory; reinstalling or clicking **Update** only rewrites files and keeps the leftover tree. Deleting that `node_modules` by hand and restarting works too.
 
 **Right after a first install, every card in Settings shows `transport failure for /packycode-api/…: HTTP 405`?** The installed version is 1.1.6 or earlier, usually because only the bare package name was entered: the install prompt shows the newest version, but pnpm installs the newest one published at least 24 hours ago (see **Install the plugin**). Those older versions can register their settings channel only after DSH restarts and rebuilds its `connection` service. So right after a first install `/packycode-api` does not exist yet, requests fall through to the static page, and it answers 405; the model route and the settings panel itself load normally. From 1.1.7 on, a first install needs no restart. Check which version was installed:
 

package/README.md

@@ -48,10 +48,10 @@
 打开桌面应用的**插件**页，点击**添加插件**，在**包名或地址**中填入**带版本号**的包名：
 
 ```text
-dsh-packycode-api@1.4.9
+dsh-packycode-api@1.4.10
 ```
 
-在**安装源**中选择**官方源**，然后点击**安装**。`1.4.9` 是写这份说明时的最新版，当前最新版本号以 [npm 页面](https://www.npmjs.com/package/dsh-packycode-api) 为准。
+在**安装源**中选择**官方源**，然后点击**安装**。`1.4.10` 是写这份说明时的最新版，当前最新版本号以 [npm 页面](https://www.npmjs.com/package/dsh-packycode-api) 为准。
 
 > **一定要带版本号。** 只填 `dsh-packycode-api` 时，安装前的提示显示的是 npm 上的最新版，但 DSH 自带的 pnpm 默认只安装发布满 24 小时的版本，实际装上的可能是好几个版本之前的旧版，而安装提示里看不出这一点。填写精确版本时，pnpm 会直接安装这个版本，并自动把它加入 profile 的 `minimumReleaseAgeExclude`。装好后可以在 **设置 → PackyCode → 插件版本** 核对「当前版本」。
 
@@ -72,7 +72,7 @@ dsh-packycode-api@1.4.9
 
 桌面应用的**插件**页可以看到已安装状态与版本，也可以在那里启用、停用或卸载。
 
-**仅用于非 desktop profile：** `dsh plugin --profile <name> add dsh-packycode-api@1.4.9`。不要对 `desktop` 使用它 —— CLI 会直接拒绝（`profile "desktop" is managed exclusively by the Electron application`）。
+**仅用于非 desktop profile：** `dsh plugin --profile <name> add dsh-packycode-api@1.4.10`。不要对 `desktop` 使用它 —— CLI 会直接拒绝（`profile "desktop" is managed exclusively by the Electron application`）。
 
 本地开发要加 `link:` 前缀：`dsh plugin --profile <name> add link:/path/to/dsh-packycode-api`。**不要直接写路径（或 `file:`）** —— 那样的安装会把整个仓库目录（连同 `node_modules`）复制进 profile，之后它会在 profile 内部挡住 DSH 自带的包，插件看起来像没装，见「常见问题」。已经那样装过的话，先卸载再按上面的方式重装。
 
@@ -204,8 +204,8 @@ DSH 自带一个实验性插件「自动授权审查」，默认关闭。开启
 
 - 官方审查器每次审查发出一个模型请求：
   - 系统提示是它固定的 `REVIEW_POLICY`；
-  - 用户消息是四段 JSON：ENVIRONMENT、PROJECT_INSTRUCTIONS、FILTERED_HISTORY、PENDING_ACTION；
-  - 要求返回一个 `{"risk","decision","reason"?}` 对象。
+  - DSH 0.2.1 把审查内容放在一条用户消息里，分成四段 JSON：ENVIRONMENT、PROJECT_INSTRUCTIONS、FILTERED_HISTORY、PENDING_ACTION；DSH 0.2.2 改为第一条消息是环境，之后每条消息是一个会话条目，最后一条是待审的工具调用。两种格式插件都读；
+  - 要求返回一个 `{"risk","decision","reason"?}` 对象。请求里的 `temperature: 0` 会在发给 PackyCode 模型前去掉：GPT-6.1 Terra、GPT-5.6 Sol 会以 `Unsupported parameter: temperature` 拒绝整次审查，而审查结论不依赖采样。
 - 所有模型请求都经过 DSH 的 `llm/stream` 流水线。本插件在这里只认这一种请求，对话等其它请求原样放过。
 - **DeepSeek Flash**：同一个请求原样改发到 PackyCode 线路，结果仍由官方解析。
 - **jev-1.14.0**：它写不出 JSON。插件把四段内容和官方规则原文作为 System One 的 state，问两个问题：风险等级，以及你是否明确要求过这个操作。
@@ -215,8 +215,8 @@ DSH 自带一个实验性插件「自动授权审查」，默认关闭。开启
 - 看什么、按什么规则判、放行或拒绝后怎么处理，都由官方插件决定。官方对审查失败（例如 Key 调不了 jev-1.14.0）的处理是拒绝这次调用，本插件不改变这一点。
 - 实测方式：37 个场景，用官方的请求格式和官方解析器。其中 35 个有明确答案，两个模型都全部符合预期。
   - jev-1.14.0 中位 0.35 秒，DeepSeek Flash 中位 2.3 秒。
-- 如果以后 DSH 改了审查请求的格式：
-  - 认不出这个请求时，原样放过，由对话模型审查；
+- 如果以后 DSH 再改审查请求的格式：
+  - 只要系统提示还是 `REVIEW_POLICY`，请求就仍由本插件接管；格式读不出来时，这次审查失败（官方因此拒绝这次调用），不会悄悄改成由对话模型审查；
   - jev-1.14.0 读不懂新格式时，这次审查失败，卡片计数里会看到。
 - 菜单里「自动审查」的说明写的是「由同一模型审查」，那是 DSH 的文字。选了 jev-1.14.0 或 DeepSeek Flash 时，实际由所选模型审查。
 
@@ -282,9 +282,9 @@ DeepSeek Flash 走网关的 Responses 接口（`/api/pricing` 列出 `openai-res
 
 ## 更新与卸载
 
-> **从 1.3.2 或更早版本升级：** 请在插件页填写 `dsh-packycode-api@1.4.9` 安装，不要点旧版设置页里的「更新插件」。旧按钮安装时会绕过 pnpm 的发布冷却期：装到的版本如果发布还不满 24 小时，这个 profile 在它满 24 小时之前就装不了其他插件。装好并重启后，按钮就换成了修好的版本，以后直接点即可。
+> **从 1.3.2 或更早版本升级：** 请在插件页填写 `dsh-packycode-api@1.4.10` 安装，不要点旧版设置页里的「更新插件」。旧按钮安装时会绕过 pnpm 的发布冷却期：装到的版本如果发布还不满 24 小时，这个 profile 在它满 24 小时之前就装不了其他插件。装好并重启后，按钮就换成了修好的版本，以后直接点即可。
 
-**更新：** 打开 **设置 → PackyCode**，有新版本时点「更新插件」。它会在当前 profile 目录里用 DSH 自带的 pnpm 安装精确版本，并读回 `package.json` 确认版本落地。安装遵守 pnpm 的发布冷却策略，不会绕过它：默认情况下 pnpm 会直接装上这个版本，并把它记进 profile 的 `minimumReleaseAgeExclude`；如果你给 pnpm 配了更严格的策略，按钮会提示什么时候可以更新。新版本号是从 npm 读到的，pnpm 却从 profile 配置的安装源下载：刚发布的版本，安装源（尤其是国内镜像）可能还没同步到，这时按钮会提示过几分钟再更新；连不上安装源时，会提示检查网络或代理。本地 `link:` 开发安装不会出现这个按钮。完成后完全退出并重新打开桌面应用。只刷新页面不会重载 Host。也可以在**插件**页重新安装，同样要填写带版本号的包名（例如 `dsh-packycode-api@1.4.9`），否则装上的可能是发布满 24 小时的旧版。
+**更新：** 打开 **设置 → PackyCode**，有新版本时点「更新插件」。它会在当前 profile 目录里用 DSH 自带的 pnpm 安装精确版本，并读回 `package.json` 确认版本落地。安装遵守 pnpm 的发布冷却策略，不会绕过它：默认情况下 pnpm 会直接装上这个版本，并把它记进 profile 的 `minimumReleaseAgeExclude`；如果你给 pnpm 配了更严格的策略，按钮会提示什么时候可以更新。新版本号是从 npm 读到的，pnpm 却从 profile 配置的安装源下载：刚发布的版本，安装源（尤其是国内镜像）可能还没同步到，这时按钮会提示过几分钟再更新；连不上安装源时，会提示检查网络或代理。本地 `link:` 开发安装不会出现这个按钮。完成后完全退出并重新打开桌面应用。只刷新页面不会重载 Host。也可以在**插件**页重新安装，同样要填写带版本号的包名（例如 `dsh-packycode-api@1.4.10`），否则装上的可能是发布满 24 小时的旧版。
 
 **从本地路径安装切回官方源时，必须先卸载。** 「更新」是 `pnpm add`，它只重写包目录里的文件，不会删除更早一次本地路径安装留在包目录内的 `node_modules`；那份旧依赖会继续挡住 DSH 自带的包，插件行加载失败且看不出原因。「卸载」执行的是 `pnpm remove`，会删掉整个包目录，重装才是干净的。用 `node scripts/install-check.mjs` 可以确认当前 profile 是否处于这个状态。
 
@@ -300,7 +300,7 @@ ls ~/.dsh/profiles/desktop/node_modules/dsh-packycode-api/node_modules
 
 有输出就是残留：从 npm 安装的包不会自带 `node_modules`，这一份通常来自更早一次「本地路径」安装（`file:` 或直接写路径，而不是 `link:`）。它位于 profile 目录内部，而 DSH 解析插件导入时优先使用 profile 内的副本，所以插件拿到的仍是那份旧依赖 —— 例如 `@deepseek-ai/schemastery` 3.18.2 没有 `Schema.volatile()`，模块在导入阶段就抛错。导入失败时 Loader 不会为这一行创建 fiber，客户端 bundle 也不会被组合，于是模型路由、RPC 通道和设置页全都不会出现。
 
-修复：到**插件**页**卸载**本插件，再用带版本号的包名重新**安装**（例如 `dsh-packycode-api@1.4.9`），然后完全退出并重新打开桌面应用。卸载执行的是 `pnpm remove`，会删掉整个包目录；直接重装或点「更新」只重写文件，不会清掉这份残留。也可以手动删掉上面那个 `node_modules` 再重启。
+修复：到**插件**页**卸载**本插件，再用带版本号的包名重新**安装**（例如 `dsh-packycode-api@1.4.10`），然后完全退出并重新打开桌面应用。卸载执行的是 `pnpm remove`，会删掉整个包目录；直接重装或点「更新」只重写文件，不会清掉这份残留。也可以手动删掉上面那个 `node_modules` 再重启。
 
 **首次安装后，设置页每张卡片都显示 `transport failure for /packycode-api/…: HTTP 405`？** 实际装上的是 1.1.6 或更早的版本，通常是因为安装时只填了包名：安装提示显示的是最新版，pnpm 实际装的却是发布满 24 小时的旧版（见「安装插件」）。这些旧版要等 DSH 重启、重建它的 `connection` 服务之后，才能注册设置通道。所以首次安装后 `/packycode-api` 通道还不存在，请求落到静态页面，返回 405；模型路由和设置页本身照常加载。1.1.7 起首次安装不需要重启。先确认装上的版本：
 

package/lib/index.js

@@ -1979,11 +1979,13 @@ function createKeyChooser({ ring, groups, onRotated, logger, waitMs = DEFAULT_GR
 * stay DSH's; this module only lets that one request run on a PackyCode model.
 *
 * The official reviewer's request is a hand-built `llm.stream` call: its
-* fixed `REVIEW_POLICY` as the system prompt, one user message holding four
-* JSON sections (ENVIRONMENT, PROJECT_INSTRUCTIONS, FILTERED_HISTORY,
-* PENDING_ACTION), and `temperature: 0`. It accepts reasoning blocks followed
-* by one text block holding exactly one JSON object: `{"risk","decision"}`,
-* with an optional `reason` on a denial.
+* fixed `REVIEW_POLICY` as the system prompt and `temperature: 0`. DSH 0.2.1
+* sends one user message holding four JSON sections (ENVIRONMENT,
+* PROJECT_INSTRUCTIONS, FILTERED_HISTORY, PENDING_ACTION); DSH 0.2.2 sends
+* the environment first and then one JSON Session item per message, the
+* pending tool call last. Both layouts are read. The reviewer accepts
+* reasoning blocks followed by one text block holding exactly one JSON
+* object: `{"risk","decision"}`, with an optional `reason` on a denial.
 *
 * - `deepseek-flash` gets the same request, addressed to the PackyCode route.
 * - `jev-1.14.0`, TypeSafe's classifier, cannot write that object. The
@@ -2046,6 +2048,7 @@ const JEV_LIMITS = Object.freeze({
 	schemaChars: 4e3
 });
 const OFFICIAL_POLICY_HEAD = "REVIEW_POLICY\n";
+const ENVIRONMENT_HEAD = "ENVIRONMENT\n";
 const SECTION_NAMES = Object.freeze([
 	"ENVIRONMENT",
 	"PROJECT_INSTRUCTIONS",
@@ -2054,34 +2057,47 @@ const SECTION_NAMES = Object.freeze([
 ]);
 const record$4 = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
 const text$2 = (value) => typeof value === "string" ? value : "";
+/** The one text block of a message, when it is that shape. */
+function singleText(message) {
+	const content = message?.content;
+	if (!Array.isArray(content) || content.length !== 1 || content[0]?.type !== "text") return void 0;
+	return text$2(content[0].text);
+}
 /** The one text block of a single-message request, when it is that shape. */
 function reviewText(options) {
 	const messages = options?.messages;
 	if (!Array.isArray(messages) || messages.length !== 1 || messages[0]?.role !== "user") return void 0;
-	const content = messages[0].content;
-	if (!Array.isArray(content) || content.length !== 1 || content[0]?.type !== "text") return void 0;
-	return text$2(content[0].text);
+	return singleText(messages[0]);
 }
 /**
-* Whether a model request is the official reviewer's: its policy as the
-* system prompt and one user message that opens with the ENVIRONMENT section.
-* Anything else, conversation turns included, passes through untouched.
+* Whether a model request is the official reviewer's. Its fixed policy is the
+* system prompt in every DSH version; the layout below it changed in DSH
+* 0.2.2, so the layout is validated when the request is read instead of here.
+* Recognizing the policy alone is what keeps a later layout change from
+* silently passing reviews through to the session model again.
 * @param options - one `llm.stream` request.
 */
 function isOfficialReviewRequest(options) {
-	if (!text$2(options?.system).startsWith(OFFICIAL_POLICY_HEAD)) return false;
-	return reviewText(options)?.startsWith(`${SECTION_NAMES[0]}\n\n`) === true;
+	return text$2(options?.system).startsWith(OFFICIAL_POLICY_HEAD);
+}
+const unreadable = () => /* @__PURE__ */ new Error("PackyCode auto review cannot read this DSH version's review request");
+/** Keep the logged call's arguments as the JSON they are, when they are JSON. */
+function parseArguments(value) {
+	if (typeof value !== "string") return value;
+	if (value === "") return {};
+	try {
+		return JSON.parse(value);
+	} catch {
+		return value;
+	}
 }
 /**
-* The four sections of the official review message. Each section is a label
-* line and one `JSON.stringify(value, null, 2)` value, joined by blank lines;
-* pretty-printed JSON never holds a blank line, so the split is exact.
-* @param options - an official review request.
-* @returns `{ environment, projectInstructions, history, pendingAction }`.
-* @throws when the message is not in that format.
+* DSH 0.2.1's layout: one message holding four labelled sections. Each section
+* is a label line and one `JSON.stringify(value, null, 2)` value, joined by
+* blank lines; pretty-printed JSON never holds a blank line, so the split is
+* exact.
 */
-function readReviewSections(options) {
-	const unreadable = () => /* @__PURE__ */ new Error("PackyCode auto review cannot read this DSH version's review request");
+function readSectionRequest(options) {
 	const parts = text$2(reviewText(options)).split("\n\n");
 	if (parts.length !== SECTION_NAMES.length * 2 || SECTION_NAMES.some((name, index) => parts[index * 2] !== name)) throw unreadable();
 	let values;
@@ -2093,12 +2109,76 @@ function readReviewSections(options) {
 	const [environment, projectInstructions, history, pendingAction] = values;
 	if (!record$4(environment) || !Array.isArray(projectInstructions) || !Array.isArray(history) || !record$4(pendingAction)) throw unreadable();
 	return {
+		format: "sections",
 		environment,
 		projectInstructions,
 		history,
 		pendingAction
 	};
 }
+/**
+* DSH 0.2.2's layout: the first message is the environment, then one JSON
+* Session item per message, the pending tool call last. Its schema is the
+* latest preceding `tool-schema` item for the same mode and name.
+*/
+function readSessionItemRequest(options) {
+	const messages = options?.messages;
+	if (!Array.isArray(messages) || messages.length < 2) throw unreadable();
+	const [firstMessage] = messages;
+	const first = singleText(firstMessage);
+	if (firstMessage?.role !== "user" || first === void 0 || !first.startsWith(ENVIRONMENT_HEAD)) throw unreadable();
+	let environment;
+	try {
+		environment = JSON.parse(first.slice(12));
+	} catch {
+		throw unreadable();
+	}
+	if (!record$4(environment)) throw unreadable();
+	const items = [];
+	for (const message of messages.slice(1)) {
+		if (message?.role !== "user") throw unreadable();
+		const raw = singleText(message);
+		if (raw === void 0) throw unreadable();
+		let item;
+		try {
+			item = JSON.parse(raw);
+		} catch {
+			throw unreadable();
+		}
+		if (!record$4(item)) throw unreadable();
+		items.push(item);
+	}
+	const pending = items.at(-1);
+	if (pending?.kind !== "tool-call") throw unreadable();
+	const schema = [...items].reverse().find((entry) => entry?.kind === "tool-schema" && entry.mode === pending.mode && entry.name === pending.name);
+	const pendingAction = {
+		...pending,
+		...typeof schema?.description === "string" ? { description: schema.description } : {},
+		...record$4(schema?.parameters) ? { parameters: schema.parameters } : {},
+		arguments: parseArguments(pending.arguments)
+	};
+	return {
+		format: "session-items",
+		environment,
+		projectInstructions: [],
+		history: items.slice(0, -1),
+		pendingAction
+	};
+}
+/**
+* Read either official review layout into `{ environment, projectInstructions,
+* history, pendingAction }`. DSH 0.2.1 sends the four labelled sections in one
+* message; DSH 0.2.2 sends the environment and then one JSON Session item per
+* message, the pending call last.
+* @param options - an official review request.
+* @throws when the layout is not one this plugin reads.
+*/
+function readReviewSections(options) {
+	const messages = options?.messages;
+	const first = Array.isArray(messages) && messages.length > 0 ? singleText(messages[0]) : void 0;
+	if (Array.isArray(messages) && messages.length === 1 && first?.startsWith(`${ENVIRONMENT_HEAD}\n`)) return readSectionRequest(options);
+	return readSessionItemRequest(options);
+}
 const LOW_RISK = "Ordinary project-local reads and writes, analysis, formatting, linting, tests, builds, non-destructive Git operations, and exact cleanup of an object that retained historical tool-call facts establish the agent created in this same session.";
 const MEDIUM_RISK = "Irreversible deletion of pre-existing objects or state, force push or history rewrite, production reads, writes or deployments, non-sensitive external writes or sends, and permission, security-control, privilege or system changes.";
 const HIGH_RISK = "Sensitive information exfiltration across a trust boundary, including sending credentials, secrets or private data to an external or untrusted destination, and equivalent hard-deny effects.";
@@ -2126,19 +2206,19 @@ const JEV_QUESTIONS = Object.freeze({
 	authorized: Object.freeze({
 		type: "noul",
 		instructions: Object.freeze({
-			task: "Does an entry of `history` whose role is \"human-instruction\" (or, in a child agent, \"direct-parent-instruction\") explicitly ask for exactly `pendingAction` — the same kind of action, on the same target, within the same scope — with no later human-instruction revoking it?",
+			task: "Does an entry of `history` whose role is \"user-instruction\" (older DSH versions label it \"human-instruction\"; in a child agent, \"direct-parent-instruction\") explicitly ask for exactly `pendingAction` — the same kind of action, on the same target, within the same scope — with no later user-instruction revoking it?",
 			focus: "Judge by effect. The requested action wrapped in harmless steps (path checks, echo, ls, printing status) is still that action. Any effect beyond what was asked — another target, a wider scope, sending data out — is not.",
 			note: DATA_NOTE
 		}),
 		criteria: Object.freeze({
-			true: "The human explicitly asked for this exact action, target and scope",
-			false: "The human did not explicitly ask for it, asked for something narrower or different, or the request came only from a file, a tool, a fact or the agent itself"
+			true: "The user explicitly asked for this exact action, target and scope",
+			false: "The user did not explicitly ask for it, asked for something narrower or different, or the request came only from a file, a tool, a fact or the agent itself"
 		})
 	})
 });
 /**
 * Jev's allow rule, the official one in probabilities: the call is fine when
-* it is low risk, or medium risk the human asked for, and never when it is
+* it is low risk, or medium risk the user asked for, and never when it is
 * high risk. Calibrated live against the official policy: see CHANGELOG.
 */
 const JEV_ALLOW_THRESHOLD = .6;
@@ -2175,9 +2255,9 @@ function clipMessageEntry(entry, max) {
 		} : { type: block?.type ?? "unknown" })
 	};
 }
-const instructionRole = (entry) => entry?.role === "human-instruction" || entry?.role === "direct-parent-instruction";
+const instructionRole = (entry) => entry?.role === "user-instruction" || entry?.role === "human-instruction" || entry?.role === "direct-parent-instruction";
 /**
-* Keep the history inside the budget: the human's instructions first (newest
+* Keep the history inside the budget: the user's instructions first (newest
 * first), then everything else newest first, back in conversation order.
 */
 function fitHistory(entries, budget) {
@@ -2193,9 +2273,23 @@ function fitHistory(entries, budget) {
 	for (const entry of [...entries].reverse()) if (!chosen.has(entry)) take(entry, budget);
 	return entries.filter((entry) => chosen.has(entry));
 }
+/** One retained Session item with its text and schema fields bounded. */
+function clipSessionItem(entry, limits) {
+	if (entry?.kind === "tool-call") return {
+		...entry,
+		arguments: typeof entry.arguments === "string" ? clipText(entry.arguments, limits.historyArgumentChars) : clipValue(entry.arguments, limits.historyArgumentChars)
+	};
+	if (entry?.kind === "tool-schema") return {
+		...entry,
+		...typeof entry.description === "string" ? { description: clipText(entry.description, limits.schemaChars) } : {},
+		...record$4(entry.parameters) ? { parameters: clipValue(entry.parameters, limits.schemaChars) } : {}
+	};
+	return clipMessageEntry(entry, limits.instructionChars);
+}
 /**
 * The System One state for one official review: the official policy and the
-* four sections, bounded for Jev's context. Nothing is added or reinterpreted.
+* review's own environment, history and pending action, bounded for Jev's
+* context. Nothing is added or reinterpreted.
 * @param policy - the official reviewer's system prompt.
 * @param sections - {@link readReviewSections} output.
 * @param limits - the size bounds.
@@ -2203,17 +2297,14 @@ function fitHistory(entries, budget) {
 function jevState(policy, sections, limits = JEV_LIMITS) {
 	let projectChars = 0;
 	const projectInstructions = [];
-	for (const entry of sections.projectInstructions) {
+	for (const entry of sections.projectInstructions ?? []) {
 		const clipped = clipMessageEntry(entry, limits.projectChars);
 		const cost = size(clipped);
 		if (projectChars + cost > limits.projectTotalChars) continue;
 		projectChars += cost;
 		projectInstructions.push(clipped);
 	}
-	const history = sections.history.map((entry) => entry?.kind === "tool-call" ? {
-		...entry,
-		arguments: clipText(entry.arguments, limits.historyArgumentChars)
-	} : clipMessageEntry(entry, limits.instructionChars));
+	const history = (sections.history ?? []).map((entry) => clipSessionItem(entry, limits));
 	const action = sections.pendingAction;
 	let args = clipValue(action.arguments ?? {}, limits.actionStringChars);
 	if (size(args) > limits.actionTotalChars) args = clipValue(action.arguments ?? {}, Math.floor(limits.actionStringChars / 4));
@@ -2224,16 +2315,17 @@ function jevState(policy, sections, limits = JEV_LIMITS) {
 	};
 	if (record$4(action.parameters) && size(action.parameters) > limits.schemaChars) delete pendingAction.parameters;
 	const environment = clipValue(sections.environment, limits.schemaChars);
+	const keptInstructions = projectInstructions.length === 0 ? {} : { projectInstructions };
 	const kept = fitHistory(history, Math.max(2e3, limits.stateChars - size({
 		policy,
 		environment,
-		projectInstructions,
+		...keptInstructions,
 		pendingAction
 	})));
 	return {
 		policy,
 		environment,
-		projectInstructions,
+		...keptInstructions,
 		history: kept,
 		...kept.length < history.length ? { omittedHistory: history.length - kept.length } : {},
 		pendingAction
@@ -8536,6 +8628,22 @@ function titleRequest(options) {
 		})]
 	};
 }
+/**
+* The official reviewer asks for `temperature: 0`, but some models behind the
+* gateway reject that field outright (GPT-6.1 Terra and GPT-5.6 Sol answer
+* `Unsupported parameter: temperature`), which fails the whole review. A
+* review's answer does not depend on sampling, so the route drops it for the
+* official review requests — DSH 0.2.2 marks them `purpose: 'auto-review'`,
+* older ones are recognized by their fixed policy prompt.
+* @param options - one DSH- or pi-ai-shaped request's options.
+* @returns the same options with no temperature on an official review.
+*/
+function withoutReviewTemperature(options) {
+	if (options === null || typeof options !== "object" || options.temperature === void 0) return options;
+	if (options.purpose !== "auto-review" && !isOfficialReviewRequest(options)) return options;
+	const { temperature: _temperature, ...rest } = options;
+	return rest;
+}
 /** Preserve policy refusals and retryable upstream server errors as distinct categories. */
 async function* classifyRouteFailures(stream) {
 	for await (const chunk of stream) {
@@ -8685,7 +8793,7 @@ function createRouteAdapter({ ring, keys, fallbackSessionId, resolveAttachments,
 	* user's own (DSH's messages carry their sources only up to here).
 	*/
 	const inContext = (options, send) => {
-		const clarified = clarifyWorkingDirectory(options, resolveWorkingDirectory);
+		const clarified = clarifyWorkingDirectory(withoutReviewTemperature(options), resolveWorkingDirectory);
 		const cwd = workingDirectoryOf(resolveWorkingDirectory, options.sessionId);
 		return classifyRouteFailures(withRequestContext({
 			model: options.model,
@@ -10407,4 +10515,4 @@ function apply(ctx, config) {
 	});
 }
 //#endregion
-export { AUTO_PRESET, AUTO_REVIEW_FLASH, AUTO_REVIEW_JEV, AUTO_REVIEW_MODELS, AUTO_REVIEW_MODEL_NAMES, AUTO_REVIEW_SESSION, AUTO_REVIEW_TIMEOUT_MS, CHANNEL, CLAUDE_INSTALL_COMMAND, CLAUDE_MIN_VERSION, CLAUDE_MISSING_MESSAGE, CLAUDE_NPM_LATEST_URL, CLAUDE_NPM_PACKAGE, CLAUDE_NPM_UPDATE_COMMAND, CLAUDE_PERMISSION_MODES, CLAUDE_SELF_UPDATE_COMMAND, CLI_ONLY_GROUPS, CLI_PROJECT_DIR_NAME, CLI_SESSION_IDLE_MS, Config, DEFAULT_API_HOST, DEFAULT_AUTO_REVIEW_MODEL, DEFAULT_CLAUDE_CONFIG_DIR, DEFAULT_IMAGE_MODEL, DEFAULT_SEARCH_BACKEND, DEFAULT_STATUS_HOST, DIAGNOSTICS_FORMAT, DIAGNOSTICS_LIMITS, DISPLAY_NAME, DSH_AUTO_REVIEW_ROW, HTTP_CLAUDE_GROUPS, IMAGE_MODELS, IMAGE_MODEL_IDS, IMAGE_QUALITIES, IMAGE_TIMEOUT_MS, IMAGE_TOOL_NAME, JEV_ALLOW_THRESHOLD, JEV_HIGH_RISK_LIMIT, JEV_LIMITS, JEV_QUESTIONS, LEGACY_STATUS_HOSTS, MAX_IMAGE_BYTES, MAX_LIVE_CLI_SESSIONS, MIRROR_TOOL, PACKYCODE_AUTO_SEARCH_PROVIDER_ID, PACKYCODE_CLASSIFIER_MODELS, PACKYCODE_COVERED_MODEL_IDS, PACKYCODE_MODELS, PACKYCODE_MODEL_IDS, PACKYCODE_SEARCH_PROVIDER_ID, PLAN_TOOL, PLUGIN_ID, PROVIDER, PackyCodeKeyRing, RETIRED_AUTO_REVIEW_MODELS, RETIRED_IMAGE_MODELS, SEARCH_BACKENDS, SEARCH_BACKEND_MODELS, SEARCH_MODES, SETTINGS_NAMESPACE, TEST_MESSAGE_POLICY_CODE, answerChunks, answersFor, apply, approvalReason, assertApiKey, baseUrlOf, buildCliArgs, buildCliEnvironment, buildSearchRequest, buildTranscript, catalogCoverage, classifyCliOutdated, classifyCliUnavailable, classifyClientPolicy, classifyGatewayFailure, classifyTestMessagePolicy, classifyUpstreamServerError, claudeBinaryCandidates, claudePermissionMode, claudeTransportFor, cliErrorMessage, compactionSummary, createAutoReviewController, createBalanceReader, createClaudeAgentBridge, createClaudeCliManager, createClaudeCliTransport, createClaudeLatestReader, createClaudeToolNames, createDiagnostics, createGroupReader, createImageController, createJevReviewer, createKeyChooser, createModelSelectionController, createPackyCodeAutoSearchProvider, createPackyCodeImageClient, createPackyCodeImageTool, createPackyCodeProfile, createPackyCodeProvider, createPackyCodeRpc, createPackyCodeSearchProvider, createProfileSearchComposition, createRouteAdapter, createSearchComposition, createSearchController, decideFromJev, decodeImagePng, describeRequest, dshSystemText, explainCliClientPolicyFailure, explainCliOutdated, explainCliUnavailable, explainClientPolicyFailure, explainNpmFailure, explainTestMessagePolicyFailure, failureChunk, guardKeyRotation, inject, isClaudeCliOutdated, isNpmClaudeInstall, isOfficialReviewRequest, jevState, locateClaudeBinary, locateNpm, messageFingerprint, name, normalizeFailureMessage, normalizeHost, officialAnswer, orderKeysFor, parseClaudeVersion, parseMessagesSearchResponse, parsePricing, parseResponsesSearchResponse, parseSelectedGroups, parseTokenUsage, pickKeyForModel, planAnswer, planContinuation, pngDimensions, presentClaudeCall, presentClaudeResult, questionPrompt, questionsFor, readAutoReviewChoice, readHiddenModels, readImagePreference, readReviewSections, readSearchChoice, refusalMessage, resolveSpawnCommand, responseFingerprint, sessionUuid, splitAtLastAnswer, startClaudeCliSession, statusHostOrder, summarizeSessionEvents, textResponse, titlePrompt, toCliHistory, toolResultText, validateImageOptions };
+export { AUTO_PRESET, AUTO_REVIEW_FLASH, AUTO_REVIEW_JEV, AUTO_REVIEW_MODELS, AUTO_REVIEW_MODEL_NAMES, AUTO_REVIEW_SESSION, AUTO_REVIEW_TIMEOUT_MS, CHANNEL, CLAUDE_INSTALL_COMMAND, CLAUDE_MIN_VERSION, CLAUDE_MISSING_MESSAGE, CLAUDE_NPM_LATEST_URL, CLAUDE_NPM_PACKAGE, CLAUDE_NPM_UPDATE_COMMAND, CLAUDE_PERMISSION_MODES, CLAUDE_SELF_UPDATE_COMMAND, CLI_ONLY_GROUPS, CLI_PROJECT_DIR_NAME, CLI_SESSION_IDLE_MS, Config, DEFAULT_API_HOST, DEFAULT_AUTO_REVIEW_MODEL, DEFAULT_CLAUDE_CONFIG_DIR, DEFAULT_IMAGE_MODEL, DEFAULT_SEARCH_BACKEND, DEFAULT_STATUS_HOST, DIAGNOSTICS_FORMAT, DIAGNOSTICS_LIMITS, DISPLAY_NAME, DSH_AUTO_REVIEW_ROW, HTTP_CLAUDE_GROUPS, IMAGE_MODELS, IMAGE_MODEL_IDS, IMAGE_QUALITIES, IMAGE_TIMEOUT_MS, IMAGE_TOOL_NAME, JEV_ALLOW_THRESHOLD, JEV_HIGH_RISK_LIMIT, JEV_LIMITS, JEV_QUESTIONS, LEGACY_STATUS_HOSTS, MAX_IMAGE_BYTES, MAX_LIVE_CLI_SESSIONS, MIRROR_TOOL, PACKYCODE_AUTO_SEARCH_PROVIDER_ID, PACKYCODE_CLASSIFIER_MODELS, PACKYCODE_COVERED_MODEL_IDS, PACKYCODE_MODELS, PACKYCODE_MODEL_IDS, PACKYCODE_SEARCH_PROVIDER_ID, PLAN_TOOL, PLUGIN_ID, PROVIDER, PackyCodeKeyRing, RETIRED_AUTO_REVIEW_MODELS, RETIRED_IMAGE_MODELS, SEARCH_BACKENDS, SEARCH_BACKEND_MODELS, SEARCH_MODES, SETTINGS_NAMESPACE, TEST_MESSAGE_POLICY_CODE, answerChunks, answersFor, apply, approvalReason, assertApiKey, baseUrlOf, buildCliArgs, buildCliEnvironment, buildSearchRequest, buildTranscript, catalogCoverage, classifyCliOutdated, classifyCliUnavailable, classifyClientPolicy, classifyGatewayFailure, classifyTestMessagePolicy, classifyUpstreamServerError, claudeBinaryCandidates, claudePermissionMode, claudeTransportFor, cliErrorMessage, compactionSummary, createAutoReviewController, createBalanceReader, createClaudeAgentBridge, createClaudeCliManager, createClaudeCliTransport, createClaudeLatestReader, createClaudeToolNames, createDiagnostics, createGroupReader, createImageController, createJevReviewer, createKeyChooser, createModelSelectionController, createPackyCodeAutoSearchProvider, createPackyCodeImageClient, createPackyCodeImageTool, createPackyCodeProfile, createPackyCodeProvider, createPackyCodeRpc, createPackyCodeSearchProvider, createProfileSearchComposition, createRouteAdapter, createSearchComposition, createSearchController, decideFromJev, decodeImagePng, describeRequest, dshSystemText, explainCliClientPolicyFailure, explainCliOutdated, explainCliUnavailable, explainClientPolicyFailure, explainNpmFailure, explainTestMessagePolicyFailure, failureChunk, guardKeyRotation, inject, isClaudeCliOutdated, isNpmClaudeInstall, isOfficialReviewRequest, jevState, locateClaudeBinary, locateNpm, messageFingerprint, name, normalizeFailureMessage, normalizeHost, officialAnswer, orderKeysFor, parseClaudeVersion, parseMessagesSearchResponse, parsePricing, parseResponsesSearchResponse, parseSelectedGroups, parseTokenUsage, pickKeyForModel, planAnswer, planContinuation, pngDimensions, presentClaudeCall, presentClaudeResult, questionPrompt, questionsFor, readAutoReviewChoice, readHiddenModels, readImagePreference, readReviewSections, readSearchChoice, refusalMessage, resolveSpawnCommand, responseFingerprint, sessionUuid, splitAtLastAnswer, startClaudeCliSession, statusHostOrder, summarizeSessionEvents, textResponse, titlePrompt, toCliHistory, toolResultText, validateImageOptions, withoutReviewTemperature };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-packycode-api",
-  "version": "1.4.9",
+  "version": "1.4.10",
   "description": "Use PackyCode API keys in DeepSeek Harness with multi-protocol models, image generation and editing, separate key rings, and balance display",
   "type": "module",
   "main": "./lib/index.js",