dsh-plugin-lcu 0.3.7 → 0.3.8

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 0.3.8
+
+The Codex upgrade script works across DSH Desktop releases again, and its
+baseline now records `@openai/codex` 0.164.0.
+
+- Resolve the app-bundled pnpm from the location current Desktop builds use
+  (`runtime/primary-runtime/dependencies/pnpm/bin/pnpm.mjs`), keeping the old
+  `runtime/pnpm/...` path as a fallback. The 0.2.1-rc.3 release moved it, and the
+  script's stale constant made every install fail with a null status.
+- Keep the two-space indent when rewriting an existing override line. Dropping
+  it turned the key into a top-level entry, so pnpm ignored the override and
+  installed the dependency's own 0.153.4 pin; the script then reported
+  "installed 0.153.4, wanted 0.164.0" instead of applying the target.
+- Include the spawn error when pnpm cannot start, instead of an empty detail.
+- Verified 0.164.0 through all three gates (handshake, protocol schema, real
+  turn) and recorded it in `scripts/codex-baseline.json`; this profile now pins
+  `@deepseek-ai/dsh-subagent-codex>@openai/codex` to 0.164.0.
+
 ## 0.3.7
 
 Documentation only; no behaviour change.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-plugin-lcu",
-  "version": "0.3.7",
+  "version": "0.3.8",
   "description": "Drive the desktop and Chrome from DeepSeek Harness using the computer-use runtime inside the ChatGPT desktop application.",
   "keywords": [
     "dsh-plugin",

package/scripts/codex-baseline.json

@@ -1,6 +1,6 @@
 {
-  "codex": "0.160.1",
-  "verifiedAt": "2026-10-07T09:56:24.427Z",
+  "codex": "0.164.0",
+  "verifiedAt": "2026-10-25T13:28:39.458Z",
   "previous": "0.160.1",
   "gates": {
     "handshake": "ok",

package/scripts/update-codex.mjs

@@ -55,7 +55,16 @@ const CODEX_ENTRY = 'node_modules/@openai/codex/bin/codex.js'
 // fetch every OS/arch payload (~275 MB each).
 const OVERRIDE_KEY = '"@deepseek-ai/dsh-subagent-codex>@openai/codex"'
 const OVERRIDE_RE = /^\s*"@deepseek-ai\/dsh-subagent-codex>@openai\/codex":.*$/m
-const APP_PNPM = '/Applications/DeepSeek Harness.app/Contents/Resources/runtime/pnpm/bin/pnpm.cjs'
+// The Desktop app bundles the pnpm the profile was installed with, and that
+// payload moves between releases: 0.2.1-rc.3 keeps it under primary-runtime,
+// while older builds used runtime/pnpm. Resolve the first one that exists —
+// a PATH pnpm is only a last resort, because a different pnpm may refuse this
+// profile's node_modules without a TTY.
+const APP_PNPM_CANDIDATES = [
+  '/Applications/DeepSeek Harness.app/Contents/Resources/runtime/primary-runtime/dependencies/pnpm/bin/pnpm.mjs',
+  '/Applications/DeepSeek Harness.app/Contents/Resources/runtime/pnpm/bin/pnpm.cjs',
+]
+const APP_PNPM = APP_PNPM_CANDIDATES.find((path) => existsSync(path))
 
 /**
  * The protocol surface dsh-subagent-codex/src/wire.ts actually uses.
@@ -129,7 +138,11 @@ function readOverride(text) {
 function writeOverride(text, version, key = OVERRIDE_KEY) {
   const line = `  ${key}: "${version}"`
   if (OVERRIDE_RE.test(text)) {
-    return text.replace(OVERRIDE_RE, line.trimStart())
+    // Keep the two-space indent: the replacement line lands inside the
+    // `overrides:` mapping. Dropping it (a previous bug) turned the key into a
+    // top-level entry, so pnpm silently ignored the override and installed the
+    // dependency's own pin instead.
+    return text.replace(OVERRIDE_RE, line)
   }
   if (/^overrides:/m.test(text)) {
     return text.replace(/^overrides:\s*$/m, `overrides:\n${line}`)
@@ -399,12 +412,15 @@ function install(profile, runner) {
     env: { ...process.env, CI: 'true' },
   })
   if (result.status !== 0) {
-    const detail = `${result.stdout ?? ''}\n${result.stderr ?? ''}`
+    // spawnSync reports a failure to start (missing executable, EACCES) as a
+    // null status plus `error`; without it the message would be empty.
+    const spawnFailure = result.error === undefined ? '' : `${result.error.message}\n`
+    const detail = `${spawnFailure}${result.stdout ?? ''}\n${result.stderr ?? ''}`
       .split('\n')
       .filter((line) => line.trim() !== '' && !line.includes('NPM_TOKEN'))
       .slice(-25)
       .join('\n')
-    throw new Error(`pnpm install failed (${result.status}):\n${detail}`)
+    throw new Error(`pnpm install failed (${String(result.status)}):\n${detail}`)
   }
 }
 
@@ -417,7 +433,7 @@ function install(profile, runner) {
  */
 function resolvePnpm(explicit) {
   if (explicit !== undefined) return [explicit]
-  if (existsSync(APP_PNPM)) return [process.execPath, APP_PNPM]
+  if (APP_PNPM !== undefined) return [process.execPath, APP_PNPM]
   return ['pnpm']
 }