dsh-qoder-connect 0.2.0 → 0.2.1

package/README.en.md

@@ -64,6 +64,8 @@ Each variant card's *Context window* tab lists capacities per model under the *
 
 Both variant cards provide a *Model Toggles* tab (located between *Context window* and *Credit details*): search models on the fly, toggle individual models on or off, and use *Enable all* / *Disable all* batch buttons; hidden models will not appear in the session model picker.
 
+![Model toggles & batch controls](assets/8.png)
+
 ### Daily Auto Check-In & Check-In Log
 
 Enable daily automatic check-in in the settings card and set each variant's own moment (10:00 UTC+8 by default), then inspect check-in history logs, trigger a manual check-in, or clear logs in the *Check-in log* tab:
@@ -74,19 +76,30 @@ Enable daily automatic check-in in the settings card and set each variant's own
 
 Prerequisites:
 
-- DSH core `0.1.5-rc.1` or newer (this plugin peers on the `@deepseek-ai/*` `^0.1.5-rc.1` line);
+- DSH core `0.1.7-rc.1` or newer (this plugin peers on the `@deepseek-ai/*` `>=0.1.7-rc.1` line);
 - Node.js `^22.19.0 || >=24.0.0` (per `package.json` engines);
 - your own Qoder account and at least one Personal Access Token.
 
 ```sh
 # From GitHub (recommended)
 dsh plugin --profile web add github:masknull/dsh-qoder-connect
-# Or from npm, once published
+# Or from npm
 dsh plugin --profile web add dsh-qoder-connect
 ```
 
 Swap the `--profile` value for the profile you use (`web` / `desktop` / `tui`, e.g. `dsh plugin --profile desktop add dsh-qoder-connect`) — data stays inside that profile, so web / desktop / tui never collide. On a terminal-only profile (TUI) there is no browser card: manage the PAT and check status through the bundled CLI instead; the settings card and sidebar widgets require Web or Desktop.
 
+> **DSH older than `0.1.7-rc.1`?** Use **[v0.2.0](https://github.com/masknull/dsh-qoder-connect/releases/tag/v0.2.0)** instead — the last release supporting the 0.1.5 line (DSH ≥ `0.1.5-rc.2`):
+>
+> ```sh
+> # From GitHub (recommended, pin the tag)
+> dsh plugin --profile web add github:masknull/dsh-qoder-connect#v0.2.0
+> # Or from npm
+> dsh plugin --profile web add dsh-qoder-connect@0.2.0
+> ```
+>
+> Upgrading from 0.1.5? This release removed the automatic migration of the old host's `settings.yaml`. To carry your old configuration over, migrate through **[v0.1.9](https://github.com/masknull/dsh-qoder-connect/releases/tag/v0.1.9)** (the first release with the data migration) first, then upgrade to this release.
+
 ## Configuration
 
 ### Mint a PAT
@@ -98,7 +111,7 @@ Swap the `--profile` value for the profile you use (`web` / `desktop` / `tui`, e
 
 ### Save it on the card
 
-DSH → Settings → Plugins → the variant's card: paste the PAT into the password field and press *Save* (*“Validating and saving…”* while it runs). The token is validated against that variant's region first — a refusal saves nothing and the card says *“That PAT was rejected — generate a new one in your account settings and try again.”*. Do this on both cards to run both groups side by side.
+DSH → Settings → Plugin Settings (插件设置) → the Qoder card: paste the PAT into the password field and press *Save* (*“Validating and saving…”* while it runs). The token is validated against that variant's region first — a refusal saves nothing and the card says *“That PAT was rejected — generate a new one in your account settings and try again.”*. Do this on both cards to run both groups side by side.
 
 ### Environment-variable fallback
 

package/README.md

@@ -64,6 +64,8 @@
 
 两张变体卡片均提供「模型开关」页（位于「上下文窗口」与「额度明细」之间）：支持即时搜索模型、单独开启/关闭指定模型，以及全选后一键「批量开启」或「批量关闭」；关闭的模型不会出现在模型选择器中。
 
+![模型开关与批量控制](assets/8.png)
+
 ### 每日自动签到与签到日志
 
 支持在设置卡片中开启每日自动签到，并自定义各版本的签到时刻（默认 10:00，按 UTC+8）；在卡片底部的「签到日志」面板中查看签到流水、立即签到或清空日志：
@@ -74,19 +76,30 @@
 
 前置条件：
 
-- DSH 核心 `0.1.5-rc.1` 及以上（本插件 peer 依赖 `@deepseek-ai/*` `^0.1.5-rc.1` 线）；
+- DSH 核心 `0.1.7-rc.1` 及以上（本插件 peer 依赖 `@deepseek-ai/*` `>=0.1.7-rc.1` 线）；
 - Node.js `^22.19.0 || >=24.0.0`（`package.json` engines）；
 - 你自己的 Qoder 账号，以及至少一枚个人访问令牌。
 
 ```sh
 # 从 GitHub 安装（推荐）
 dsh plugin --profile web add github:masknull/dsh-qoder-connect
-# 或已发布 npm 后从 npm 安装
+# 或从 npm 安装
 dsh plugin --profile web add dsh-qoder-connect
 ```
 
 按你使用的 profile 换 `--profile` 的值（`web` / `desktop` / `tui`，如 `dsh plugin --profile desktop add dsh-qoder-connect`）。装到哪个 profile，数据就落在哪个 profile 目录里，web / desktop / tui 各自独立。没有浏览器卡片的终端环境（TUI）下依旧可用 CLI 保存 PAT 并驱动模型；设置卡片与侧栏额度卡需要 Web/Desktop 界面。
 
+> **DSH 低于 `0.1.7-rc.1`？** 请改用最后一个支持 0.1.5 线的版本 **[v0.2.0](https://github.com/masknull/dsh-qoder-connect/releases/tag/v0.2.0)**（要求 DSH ≥ `0.1.5-rc.2`）：
+>
+> ```sh
+> # GitHub（推荐，指定 tag）
+> dsh plugin --profile web add github:masknull/dsh-qoder-connect#v0.2.0
+> # 或从 npm 安装
+> dsh plugin --profile web add dsh-qoder-connect@0.2.0
+> ```
+>
+> 从 0.1.5 升级上来的老用户：本版本已移除旧宿主 `settings.yaml` 的自动迁移；如需保留旧配置，请先经 **[v0.1.9](https://github.com/masknull/dsh-qoder-connect/releases/tag/v0.1.9)**（首个带数据迁移的版本）完成迁移后，再升级本版本。
+
 ## 配置与使用
 
 ### 生成 PAT
@@ -98,7 +111,7 @@ dsh plugin --profile web add dsh-qoder-connect
 
 ### 在卡片上保存
 
-DSH → 设置 → 插件 → 对应卡片，展开后把 PAT 粘贴进密码输入框，点「保存」（期间显示「校验并保存中…」）。保存动作会先经 Qoder 校验令牌对该变体的区域有效，失败则不落盘并提示「PAT 无效或已过期 — 请到账号设置重新生成后再试。」两版各填各的卡片即可两组并存。
+DSH → 设置 → 插件设置 → Qoder 卡片，展开后把 PAT 粘贴进密码输入框，点「保存」（期间显示「校验并保存中…」）。保存动作会先经 Qoder 校验令牌对该变体的区域有效，失败则不落盘并提示「PAT 无效或已过期 — 请到账号设置重新生成后再试。」两版各填各的卡片即可两组并存。
 
 ### 环境变量兜底
 
@@ -119,13 +132,13 @@ DSH → 设置 → 插件 → 对应卡片，展开后把 PAT 粘贴进密码输
 
 ```text
 <profile>/.dsh-qoder-connect/
-├── .qoder-auth.json              # 中国版 PAT（{version:2, pat, region, savedAt}）
+├── .qoder-auth.json              # 国内版 PAT（{version:2, pat, region, savedAt}）
 ├── .qoder-global-auth.json       # 国际版 PAT
 ├── checkin-status.json           # 签到状态与历史日志记录
 └── state/
-    ├── .qoder-catalog.json       # 中国版按账号保存的模型目录
+    ├── .qoder-catalog.json       # 国内版按账号保存的模型目录
     ├── .qoder-global-catalog.json
-    ├── .qoder-probe.json         # 中国版推理档位探测记录
+    ├── .qoder-probe.json         # 国内版推理档位探测记录
     ├── .qoder-global-probe.json
     ├── .qoder-host-heartbeat.json    # host 心跳（doctor 判断宿主是否在跑）
     └── .qoder-machine-id         # 传输层机器标识种子（不落 ~/.qoder）

package/lib/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { D as FALLBACK_QODER_MODELS, E as qoderCatalogPath, T as QoderCatalogStore, V as qoderCredentialIdentity, b as createQoderTransport, f as QODER_CONNECT_VERSION, i as variantFor, l as qoderHostHeartbeatPath, m as QoderUpstreamClient, r as QODER_VARIANTS, s as isHeartbeatProcessAlive, t as CHINA_VARIANT, u as readHostHeartbeat, y as validateApiKey, z as QoderCredentialStore } from "./variants-DuEgaUad.js";
+import { D as FALLBACK_QODER_MODELS, E as qoderCatalogPath, T as QoderCatalogStore, V as qoderCredentialIdentity, b as createQoderTransport, f as QODER_CONNECT_VERSION, i as variantFor, l as qoderHostHeartbeatPath, m as QoderUpstreamClient, r as QODER_VARIANTS, s as isHeartbeatProcessAlive, t as CHINA_VARIANT, u as readHostHeartbeat, y as validateApiKey, z as QoderCredentialStore } from "./variants-CjWW4lVI.js";
 import { readFile } from "node:fs/promises";
 import { realpathSync } from "node:fs";
 import { fileURLToPath } from "node:url";

package/lib/client.js

@@ -4047,13 +4047,6 @@ window.__ModuleLoader__.load({
 		* (`settings.plugin.item`) is declared by
 		* `@deepseek-ai/dsh-client-ui-settings-plugins`. Those packages are named in
 		* the package's `dsh.client.inject` list.
-		*
-		* NOT declared here: the settings services. `settingsScope` (0.1.5) does not
-		* exist at all on 0.1.7 — a static service dependency on it is what left this
-		* plugin's client activation pending forever — and `configForms` (0.1.7) does
-		* not exist on 0.1.5. Both are waited for with `ctx.inject([...], callback)`
-		* below, where a missing service simply never calls back instead of holding
-		* activation.
 		*/
 		const inject = [
 			"slots",
@@ -4164,21 +4157,15 @@ window.__ModuleLoader__.load({
 					applySnapshot();
 					scope.subscribe(applySnapshot);
 				};
-				const registerUnifiedCard = (slot) => {
+				const registerUnifiedCard = () => {
 					const inject = () => ({
 						t,
 						scope: quotaScope,
 						signedIn: () => quotaSignInState(),
 						unified: true
 					});
-					if (slot === "settings.plugin.item") return ctx.slots.inject(slot, () => ctx.slots.register({
-						name: slot,
-						key: "qoder",
-						priority: 50,
-						inject
-					}, QoderPluginCard));
-					return ctx.slots.inject(slot, () => ctx.slots.register({
-						name: slot,
+					return ctx.slots.inject(SHARED_ITEM_SLOT, () => ctx.slots.register({
+						name: SHARED_ITEM_SLOT,
 						id: SHARED_ITEM_ID,
 						order: 30,
 						inject
@@ -4214,7 +4201,7 @@ window.__ModuleLoader__.load({
 						} catch (error) {
 							console.error("[dsh-qoder-connect] shared plugin-settings block lost the race; attaching to the winner:", error);
 						}
-						const disposeItem = registerUnifiedCard(SHARED_ITEM_SLOT);
+						const disposeItem = registerUnifiedCard();
 						return () => {
 							disposeItem();
 							disposeContainer?.();

package/lib/index.d.ts

@@ -2,10 +2,10 @@ import z from "@deepseek-ai/schemastery";
 import "@earendil-works/pi-ai";
 import { GenerateOptions, StreamChunk } from "@deepseek-ai/dsh-llm";
 import { PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
+import { AttachmentStore } from "@deepseek-ai/dsh-attachment";
 import { IncomingMessage, ServerResponse } from "node:http";
 import { Context } from "@deepseek-ai/cordis";
 import { SettingsNamespace } from "@deepseek-ai/dsh-settings";
-import { AttachmentStore } from "@deepseek-ai/dsh-attachment";
 //#region src/paths.d.ts
 /**
  * The plugin's data directory — the ONE place every file the plugin owns
@@ -1448,16 +1448,14 @@ declare const QUOTA_POLL_DEFAULT_MS = 300000;
 declare const QUOTA_POLL_MIN_MS = 60000;
 declare const Config: z<Config>;
 /**
- * Every field each settings section owns, and therefore every field the live
- * configuration has to carry through.
+ * The field groups the configuration is merged from, one list per card.
  *
- * One list per section, shared by the merge and by the test that pins it to
- * the schema. Writing the merge out by hand is what broke auto check-in: the
- * `qoder-quota` section grew four fields (`autoCheckInCN`, `autoCheckInGlobal`,
- * `checkInMinuteCN`, `checkInMinuteGlobal`) while the merge kept copying only
- * the three that predated them, so `current().autoCheckInCN` read `undefined`
- * forever and the scheduler saw the toggle as permanently off. The card saved
- * it, the file held it, and nothing ever acted on it.
+ * Writing the merge out by hand is what broke auto check-in: the quota group
+ * grew four fields (`autoCheckInCN`, `autoCheckInGlobal`, `checkInMinuteCN`,
+ * `checkInMinuteGlobal`) while the merge kept copying only the three that
+ * predated them, so `current().autoCheckInCN` read `undefined` forever and the
+ * scheduler saw the toggle as permanently off. The card saved it, the file
+ * held it, and nothing ever acted on it.
  */
 declare const CN_SECTION_KEYS: readonly ["probeConsent", "useMaximumContextWindowCN", "modelContextWindowsCN", "disabledModelsCN"];
 declare const GLOBAL_SECTION_KEYS: readonly ["useMaximumContextWindow", "modelContextWindows", "disabledModels"];

package/lib/index.js

@@ -1,4 +1,4 @@
-import { A as QODER_GLOBAL_AUTH_PATH, B as patTail, C as probeModel, D as FALLBACK_QODER_MODELS, E as qoderCatalogPath, F as QODER_STATUS_PATH, G as qoderMachineIdPath, H as qoderOwnAuthPath, I as QODER_AUTH_FILENAME, K as qoderPluginDataDir, L as QODER_PAT_ENV_CN, M as QODER_GLOBAL_STATUS_PATH, N as QODER_PROBE_PATH, O as QoderCatalog, P as QODER_SETTINGS_FACE_PATH, R as QODER_PAT_ENV_GLOBAL, S as PROBE_EFFORT_CANDIDATES, T as QoderCatalogStore, U as QODER_DATA_DIR_ENV, V as qoderCredentialIdentity, W as QODER_DATA_DIR_NAME, _ as modelInfoOf, a as QODER_HOST_HEARTBEAT_FILENAME, b as createQoderTransport, c as processStartTimeMs, d as writeHostHeartbeat, f as QODER_CONNECT_VERSION, g as kindFromQoderFailure, h as classifyUpstreamError, i as variantFor, j as QODER_GLOBAL_PROBE_PATH, k as QODER_AUTH_PATH, l as qoderHostHeartbeatPath, m as QoderUpstreamClient, n as GLOBAL_VARIANT, o as clearHostHeartbeat, p as KIND_STATUS, q as qoderStateDir, r as QODER_VARIANTS, s as isHeartbeatProcessAlive, t as CHINA_VARIANT, u as readHostHeartbeat, v as normalizeCredits, w as randomSentinel, x as getMachineId, y as validateApiKey, z as QoderCredentialStore } from "./variants-DuEgaUad.js";
+import { A as QODER_GLOBAL_AUTH_PATH, B as patTail, C as probeModel, D as FALLBACK_QODER_MODELS, E as qoderCatalogPath, F as QODER_STATUS_PATH, G as qoderMachineIdPath, H as qoderOwnAuthPath, I as QODER_AUTH_FILENAME, K as qoderPluginDataDir, L as QODER_PAT_ENV_CN, M as QODER_GLOBAL_STATUS_PATH, N as QODER_PROBE_PATH, O as QoderCatalog, P as QODER_SETTINGS_FACE_PATH, R as QODER_PAT_ENV_GLOBAL, S as PROBE_EFFORT_CANDIDATES, T as QoderCatalogStore, U as QODER_DATA_DIR_ENV, V as qoderCredentialIdentity, W as QODER_DATA_DIR_NAME, _ as modelInfoOf, a as QODER_HOST_HEARTBEAT_FILENAME, b as createQoderTransport, c as processStartTimeMs, d as writeHostHeartbeat, f as QODER_CONNECT_VERSION, g as kindFromQoderFailure, h as classifyUpstreamError, i as variantFor, j as QODER_GLOBAL_PROBE_PATH, k as QODER_AUTH_PATH, l as qoderHostHeartbeatPath, m as QoderUpstreamClient, n as GLOBAL_VARIANT, o as clearHostHeartbeat, p as KIND_STATUS, q as qoderStateDir, r as QODER_VARIANTS, s as isHeartbeatProcessAlive, t as CHINA_VARIANT, u as readHostHeartbeat, v as normalizeCredits, w as randomSentinel, x as getMachineId, y as validateApiKey, z as QoderCredentialStore } from "./variants-CjWW4lVI.js";
 import z from "@deepseek-ai/schemastery";
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
 import { dirname, join, resolve } from "node:path";
@@ -7,10 +7,8 @@ import { createProvider } from "@earendil-works/pi-ai";
 import { openAICompletionsApi } from "@earendil-works/pi-ai/api/openai-completions.lazy";
 import { resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
 import { PiAiAdapter } from "@deepseek-ai/dsh-llm-pi-ai";
-import { homedir } from "node:os";
 import { createServer } from "node:http";
 import { Readable } from "node:stream";
-import yamlModule from "js-yaml";
 //#region src/loopback.ts
 /**
 * Shared loopback gates for the plugin's local HTTP surfaces: the loopback
@@ -1660,8 +1658,6 @@ function appendHintRow(agent, kind, text) {
 *
 * @module dsh-qoder-connect/settings-store
 */
-const yaml = yamlModule;
-const loadYaml = typeof yaml.load === "function" ? yaml.load : yaml.default?.load;
 /** Settings file name inside the plugin data directory. */
 const SETTINGS_FILE_NAME = "settings.json";
 /** This plugin's data directory (shared with the credential and caches). */
@@ -1691,61 +1687,11 @@ function writeSettings(values) {
 	writeFileSync(tmp, `${JSON.stringify(values, null, 2)}\n`, "utf8");
 	renameSync(tmp, path);
 }
-/** Resolve `$DSH_HOME` the way the Host does, without importing a Host package. */
-function dshHome() {
-	const fromEnv = process.env.DSH_HOME?.trim() || void 0;
-	if (fromEnv !== void 0) return fromEnv;
-	return join(homedir(), ".dsh");
-}
-/**
-* Read this plugin's sections out of the legacy settings document.
-*
-* The 0.1.5 host kept every plugin's settings in `$DSH_HOME/settings.yaml`;
-* 0.1.7 renames it to `settings.yaml.imported` once, on the first boot, and
-* imports only the sections whose names match a profile entry id. This
-* plugin's 0.1.5 sections were keyed by its SERVED NAMESPACES (`qoder`,
-* `qoder-global`, `qoder-quota`), which name no entry in the profile — the row
-* is `llm-qoder` — so the platform refuses them and their data survives only
-* in the renamed document. Reading it here recovers that data independently of
-* the platform's import, its section-name mapping, and its timing.
-*
-* @param namespaces - the section names the 0.1.5 host keyed this plugin's
-*   settings under (one per served section).
-* @returns the union of those sections' fields, or undefined when the document
-*   is absent, unreadable, or holds none of them.
-*/
-function readLegacySections(namespaces) {
-	let path;
-	for (const name of ["settings.yaml", "settings.yaml.imported"]) {
-		const candidate = join(dshHome(), name);
-		if (existsSync(candidate)) {
-			path = candidate;
-			break;
-		}
-	}
-	if (path === void 0 || loadYaml === void 0) return void 0;
-	let document;
-	try {
-		document = loadYaml(readFileSync(path, "utf8"));
-	} catch {
-		return;
-	}
-	if (document === null || typeof document !== "object") return void 0;
-	const merged = {};
-	let found = false;
-	for (const ns of namespaces) {
-		const section = document[ns];
-		if (section === null || typeof section !== "object" || Array.isArray(section)) continue;
-		Object.assign(merged, section);
-		found = true;
-	}
-	return found ? merged : void 0;
-}
 /**
 * Reserved bookkeeping key: how many writes the settings card has made through
-* this store. Its presence separates "the file holds migration seed" from "the
-* file holds the user's live edits" — see the seed rule in ./index.ts. Field
-* readers address their fields by name and never collide with it.
+* this store. Its presence separates "the file holds the startup seed" from
+* "the file holds the user's live edits" — see the seed rule in ./index.ts.
+* Field readers address their fields by name and never collide with it.
 */
 const WRITE_MARK = "__writes";
 /**
@@ -1765,12 +1711,10 @@ var SettingsStore = class {
 	/**
 	* Whether the settings card has ever written through this store.
 	*
-	* False during the migration window — the window where a 0.1.5 settings.yaml
-	* import (which lands only after the Loader settles, i.e. AFTER this plugin's
-	* first apply) can still deliver the user's real values, and where a first
-	* seed may have been taken before that import. While false the entry config
-	* stays authoritative; once the card writes, the file is — a runtime edit
-	* must never be regressed by a stale profile row.
+	* Until it has, the entry config stays the fallback layer (a hand-edited
+	* profile row can still seed a fresh install); once the card writes, the
+	* file is authoritative — a runtime edit must never be regressed by a stale
+	* profile row.
 	*/
 	get edited() {
 		return typeof this.user[WRITE_MARK] === "number" && this.user[WRITE_MARK] > 0;
@@ -1996,37 +1940,15 @@ const Config = z.object({
 	checkInMinuteGlobal: CHECK_IN_MINUTE_FIELD,
 	quotaPollMs: QUOTA_POLL_FIELD
 });
-z.object({
-	probeConsent: PROBE_CONSENT_FIELD,
-	useMaximumContextWindowCN: MAXIMUM_CONTEXT_WINDOW_CN_FIELD,
-	modelContextWindowsCN: MODEL_CONTEXT_WINDOWS_FIELD,
-	disabledModelsCN: DISABLED_MODELS_FIELD
-});
-z.object({
-	useMaximumContextWindow: MAXIMUM_CONTEXT_WINDOW_FIELD,
-	modelContextWindows: MODEL_CONTEXT_WINDOWS_FIELD,
-	disabledModels: DISABLED_MODELS_FIELD
-});
-z.object({
-	sidebarQuotaCN: QUOTA_TOGGLE_FIELD,
-	sidebarQuotaGlobal: QUOTA_TOGGLE_FIELD,
-	autoCheckInCN: AUTO_CHECK_IN_FIELD,
-	autoCheckInGlobal: AUTO_CHECK_IN_FIELD,
-	checkInMinuteCN: CHECK_IN_MINUTE_FIELD,
-	checkInMinuteGlobal: CHECK_IN_MINUTE_FIELD,
-	quotaPollMs: QUOTA_POLL_FIELD
-});
 /**
-* Every field each settings section owns, and therefore every field the live
-* configuration has to carry through.
-*
-* One list per section, shared by the merge and by the test that pins it to
-* the schema. Writing the merge out by hand is what broke auto check-in: the
-* `qoder-quota` section grew four fields (`autoCheckInCN`, `autoCheckInGlobal`,
-* `checkInMinuteCN`, `checkInMinuteGlobal`) while the merge kept copying only
-* the three that predated them, so `current().autoCheckInCN` read `undefined`
-* forever and the scheduler saw the toggle as permanently off. The card saved
-* it, the file held it, and nothing ever acted on it.
+* The field groups the configuration is merged from, one list per card.
+*
+* Writing the merge out by hand is what broke auto check-in: the quota group
+* grew four fields (`autoCheckInCN`, `autoCheckInGlobal`, `checkInMinuteCN`,
+* `checkInMinuteGlobal`) while the merge kept copying only the three that
+* predated them, so `current().autoCheckInCN` read `undefined` forever and the
+* scheduler saw the toggle as permanently off. The card saved it, the file
+* held it, and nothing ever acted on it.
 */
 const CN_SECTION_KEYS = [
 	"probeConsent",
@@ -2081,10 +2003,6 @@ function readConfig(config) {
 }
 /** Stable identity key used by credentials, probe records, and catalog entries. */
 const credentialIdentity = qoderCredentialIdentity;
-/** The settings namespace a variant's card and provider directory entry use. */
-function settingsNamespaceFor(variant) {
-	return variant.id === CHINA_VARIANT.id ? QODER_SETTINGS_NS : QODER_GLOBAL_SETTINGS_NS;
-}
 /**
 * The static catalog a variant serves before its first successful fetch.
 *
@@ -2314,15 +2232,7 @@ async function startVariant(ctx, runtime, seedCatalog) {
 		let releaseDirectory;
 		try {
 			releaseAdapter = ctx.llm.registerAdapter([variant.id], qoder.adapter);
-			const host017 = (() => {
-				try {
-					return ctx.get?.("configEditor") !== void 0;
-				} catch {
-					return false;
-				}
-			})();
-			const entryId = ctx.fiber?.entry?.options?.id;
-			const settingsNs = host017 && entryId !== void 0 ? entryId : settingsNamespaceFor(variant);
+			const settingsNs = ctx.fiber?.entry?.options?.id ?? variant.id;
 			releaseDirectory = ctx.llm.registerConfigurableProviders([{
 				provider: variant.id,
 				displayName: variant.displayName,
@@ -2558,43 +2468,22 @@ function validateSettingsPatch(patch) {
 	}
 }
 /**
-* When the profile tree last recomposed, module-level so every apply sees it.
-*
-* The legacy settings.yaml import writes the profile patch one section at a
-* time for seconds after the Loader settles, emitting this event on every
-* write. Cleaning up our row in that window is futile — the import's next
-* section simply writes it back — so the cleanup waits for the tree to fall
-* quiet first.
-*/
-let lastConfigReloadAt = Date.now();
-/** Wait until the profile tree has been quiet (the legacy import finished). */
-async function waitForProfileQuiet() {
-	const deadline = Date.now() + 12e4;
-	for (;;) {
-		if (Date.now() - lastConfigReloadAt >= 5e3) return;
-		if (Date.now() >= deadline) return;
-		await new Promise((resolve) => setTimeout(resolve, 1e3));
-	}
-}
-/**
 * Delete this plugin's own fields from the profile entry config, leaving every
 * other key of the row untouched.
 *
 * One-time, right after the settings file has been seeded: the entry returns to
-* its shipped state, so no second source of truth remains. Both write APIs are
-* probed — `configEditor` (0.1.7) first, then the settings service's namespace
-* `replace` (0.1.5), which rebuilds each of this plugin's three sections from
-* the foreign keys alone.
+* its shipped state, so no second source of truth remains. The write rides
+* `configEditor` — the 0.1.7 profile-patch editor — probed on the plugin
+* context first and on the settings service's owner context second, because
+* that is where the host root mounts it.
 *
 * @param ctx - plugin context.
 * @param ownKeys - this plugin's declared config fields.
-* @param namespaces - the 0.1.5 section namespaces this plugin owns.
 */
-async function cleanupEntryConfig(ctx, ownKeys, namespaces) {
+async function cleanupEntryConfig(ctx, ownKeys) {
 	const attempts = 10;
 	for (let attempt = 0; attempt < attempts; attempt++) try {
-		if (attempt === 0) await waitForProfileQuiet();
-		else await new Promise((resolve) => setTimeout(resolve, 2e3 + Math.random() * 1e3));
+		if (attempt > 0) await new Promise((resolve) => setTimeout(resolve, 2e3 + Math.random() * 1e3));
 		const probe = ctx;
 		const editor = (typeof probe.get === "function" ? (() => {
 			try {
@@ -2626,16 +2515,6 @@ async function cleanupEntryConfig(ctx, ownKeys, namespaces) {
 			});
 			return;
 		}
-		await new Promise((resolve) => {
-			ctx.inject(["settings"], (settingsCtx) => {
-				const settings = settingsCtx.settings;
-				if (typeof settings?.replace !== "function" || typeof settings.installSection !== "function") {
-					resolve(void 0);
-					return;
-				}
-				Promise.all(namespaces.map((ns) => Promise.resolve(settings.replace(ns, {})).catch(() => void 0))).then(() => resolve(void 0));
-			});
-		});
 		return;
 	} catch (error) {
 		if (attempt === 9) {
@@ -2672,63 +2551,41 @@ function apply(ctx, config) {
 		...store.values()
 	});
 	/**
-	* One-time migration: per field — the file never held it → take the entry;
-	* the card HAS written this file → keep the file; the entry carries a
-	* NON-DEFAULT value → take the entry (the legacy settings.yaml import lands
-	* only after the Loader settles, i.e. after this plugin's first apply, and a
-	* seed taken inside that window can hold a stale or mis-encoded value); the
-	* entry only carries the schema default → keep the file.
+	* One-time seed: per field — the file never held it → take the entry; the
+	* card HAS written this file → keep the file; the entry carries a
+	* NON-DEFAULT value → take the entry; the entry only carries the schema
+	* default → keep the file.
 	*
 	* That last clause is load-bearing: a bundle layer's insert config does NOT
 	* reach the composition (verified with `dsh --dump-config`), so once the
 	* one-time cleanup has emptied the entry row the entry answers pure defaults —
 	* treating those as authoritative would erase the user's values on the next
-	* boot. Re-checked on every apply, which is also what closes the legacy
-	* import's timing window.
+	* boot. Re-checked on every apply, which is also what closes the volatile
+	* commit timing window.
 	*
 	* When the entry is authoritative, its own fields are then deleted from the
 	* profile row, so no second source of truth remains.
 	*/
 	const migrateOwnSettings = () => {
-		const legacy = readLegacySections([
-			QODER_SETTINGS_NS,
-			QODER_GLOBAL_SETTINGS_NS,
-			QODER_QUOTA_SETTINGS_NS
-		]);
 		const seeded = {};
 		for (const key of CONFIG_KEYS) {
 			const entryValue = readField(config, key);
-			const legacyValue = legacy === void 0 ? void 0 : legacy[key];
 			if (!Object.hasOwn(store.user, key)) {
 				if (entryValue !== void 0 && JSON.stringify(entryValue) !== JSON.stringify(DEFAULT_FOR_FIELD[key])) seeded[key] = entryValue;
-				else if (legacyValue !== void 0 && JSON.stringify(legacyValue) !== JSON.stringify(DEFAULT_FOR_FIELD[key])) seeded[key] = legacyValue;
 				else if (entryValue !== void 0) seeded[key] = entryValue;
-				else if (legacyValue !== void 0) seeded[key] = legacyValue;
 				continue;
 			}
 			if (store.edited) continue;
-			if (entryValue !== void 0 && JSON.stringify(entryValue) !== JSON.stringify(DEFAULT_FOR_FIELD[key])) {
-				seeded[key] = entryValue;
-				continue;
-			}
-			if (legacyValue !== void 0 && JSON.stringify(legacyValue) !== JSON.stringify(DEFAULT_FOR_FIELD[key])) seeded[key] = legacyValue;
+			if (entryValue !== void 0 && JSON.stringify(entryValue) !== JSON.stringify(DEFAULT_FOR_FIELD[key])) seeded[key] = entryValue;
 		}
 		if (Object.keys(seeded).length === 0) return;
 		store.patch(seeded);
-		cleanupEntryConfig(ctx, CONFIG_KEYS, [
-			QODER_SETTINGS_NS,
-			QODER_GLOBAL_SETTINGS_NS,
-			QODER_QUOTA_SETTINGS_NS
-		]);
+		cleanupEntryConfig(ctx, CONFIG_KEYS);
 	};
 	migrateOwnSettings();
-	const eventSink = ctx;
-	eventSink.on("loader/volatile-update", () => {
+	ctx.on("loader/volatile-update", () => {
 		migrateOwnSettings();
 	});
-	eventSink.on("app-boot/config-reload", () => {
-		lastConfigReloadAt = Date.now();
-	});
 	/** Timers and in-flight work belonging to this plugin instance. */
 	let stopped = false;
 	const timers = [];

package/lib/{variants-DuEgaUad.js → variants-CjWW4lVI.js}

@@ -7,6 +7,8 @@ import { fileURLToPath } from "node:url";
 import { resolveDshHome } from "@deepseek-ai/dsh-home-paths";
 import { EMPTY_RESPONSE_CODE, LlmError, ProviderRequestId, ReasoningEffortId, ToolCallId, attributionHeaders, contentHasImage, createAssistantMessage, createToolResultMessage, createUserMessage } from "@deepseek-ai/dsh-llm";
 import { homedir } from "node:os";
+import { brotliDecompressSync, gunzipSync, inflateSync } from "node:zlib";
+import { requestImageDimensions } from "@deepseek-ai/dsh-attachment";
 import { execFileSync } from "node:child_process";
 //#region src/paths.ts
 /**
@@ -1035,10 +1037,40 @@ function getQoderClaimCampaignUrl(region = "global", campaignId) {
 }
 //#endregion
 //#region src/qoder/transport/machine-id.ts
+/**
+* The machine id Qoder's own desktop CLI keeps at
+* `$HOME/.qoder/.auth/machine_id`.
+*
+* Strictly a read source for this plugin: when the official client generated
+* one, the transport reuses it so the same device presents one stable
+* identity upstream. The plugin never writes there — that tree belongs to
+* the official CLI.
+*/
+function officialMachineIdPath() {
+	return join(homedir(), ".qoder", ".auth", "machine_id");
+}
+/**
+* The trusted locations consulted when a caller nominates no chain: the
+* official Qoder CLI's id first, this plugin's own seed second.
+*
+* A freshly created id is saved ONLY at the end of the chain, which is now
+* always inside the plugin's data directory. An earlier default ended the
+* chain at `~/.dsh/qoder/machine_id`, derived from `os.homedir()` rather
+* than the resolved harness home, so any host with `DSH_HOME` pointed at
+* another location got a device credential scattered into the wrong `$HOME`
+* — outside every profile, with no owner deleting it. That fallback is
+* gone.
+*/
 function defaultMachineIdPaths() {
-	return [join(homedir(), ".qoder", ".auth", "machine_id"), join(homedir(), ".dsh", "qoder", "machine_id")];
+	return [officialMachineIdPath(), qoderMachineIdPath()];
 }
-/** Read Qoder's machine id or create the DSH-owned fallback. */
+/**
+* Read Qoder's machine id, or create this plugin's seed at the chain's end.
+*
+* `paths` is the read chain; its last entry doubles as the create point.
+* Passing no chain defaults to {@link defaultMachineIdPaths}; passing an
+* empty array nominates no save location, which keeps the id process-local.
+*/
 function getMachineId(paths = defaultMachineIdPaths()) {
 	for (const path of paths) {
 		if (!existsSync(path)) continue;
@@ -1049,7 +1081,8 @@ function getMachineId(paths = defaultMachineIdPaths()) {
 	}
 	const machineId = crypto.randomUUID();
 	const savePath = paths.at(-1);
-	if (savePath !== void 0) try {
+	if (savePath === void 0) return machineId;
+	try {
 		mkdirSync(dirname(savePath), { recursive: true });
 		writeFileSync(savePath, machineId, {
 			encoding: "utf8",
@@ -1262,22 +1295,34 @@ async function readLimitedText(response, maxBytes, label) {
 	}
 	if (!response.body) return "";
 	const reader = response.body.getReader();
-	const decoder = new TextDecoder();
+	const chunks = [];
 	let bytes = 0;
-	let text = "";
 	try {
 		while (true) {
 			const { done, value } = await reader.read();
 			if (done) break;
 			bytes += value.byteLength;
 			if (bytes > maxBytes) throw new QoderLlmError(`${label} exceeded its response size limit.`, "MALFORMED_RESPONSE");
-			text += decoder.decode(value, { stream: true });
+			chunks.push(value);
 		}
-		return text + decoder.decode();
 	} finally {
 		await reader.cancel().catch(() => void 0);
 		reader.releaseLock();
 	}
+	let payload = Buffer.concat(chunks.map((chunk) => Buffer.from(chunk)));
+	const encoding = (response.headers.get("content-encoding") ?? "").toLowerCase();
+	const looksGzipped = payload.length >= 2 && payload[0] === 31 && payload[1] === 139;
+	if (encoding !== "" || looksGzipped) {
+		try {
+			if (encoding.includes("gzip") || encoding === "" && looksGzipped) payload = gunzipSync(payload);
+			else if (encoding.includes("br")) payload = brotliDecompressSync(payload);
+			else if (encoding.includes("deflate")) payload = inflateSync(payload);
+		} catch {
+			throw new QoderLlmError(`${label} arrived compressed but could not be decompressed.`, "MALFORMED_RESPONSE");
+		}
+		if (payload.byteLength > maxBytes) throw new QoderLlmError(`${label} exceeded its response size limit.`, "MALFORMED_RESPONSE");
+	}
+	return new TextDecoder().decode(payload);
 }
 var SingleFlight = class {
 	flights = /* @__PURE__ */ new Map();
@@ -1330,6 +1375,7 @@ async function openApiJsonRequest(fetchImpl, options) {
 	try {
 		const headers = {
 			accept: "application/json",
+			"accept-encoding": "identity",
 			"user-agent": options.userAgent ?? defaultUserAgent,
 			"cosy-version": "1.0.1",
 			"cosy-clienttype": "5",
@@ -1647,6 +1693,7 @@ async function fetchQoderModels(credentials, options = {}) {
 			method: "GET",
 			headers: {
 				accept: "application/json",
+				"accept-encoding": "identity",
 				...buildAuthHeaders(null, url, credentials)
 			},
 			signal: deadline.signal
@@ -1686,9 +1733,16 @@ async function fetchQoderModels(credentials, options = {}) {
 function unsupported(message) {
 	return new QoderLlmError(message, "UNSUPPORTED_CONTENT");
 }
-function toolResultText(block) {
+/**
+* Flatten one tool-result message's content to wire text.
+*
+* DSH 0.1.7 models a tool result as a first-class `role: 'tool'` message
+* (before 0.1.6 it was a `tool-result` block inside a user message); either
+* way the payload is a content array whose text/图像 blocks this flattens.
+*/
+function toolResultText(content) {
 	let text = "";
-	for (const nested of block.content) {
+	for (const nested of content) {
 		if (nested.type === "image") continue;
 		if (nested.type !== "text") throw unsupported(`Qoder tool results support text only; received nested ${String(nested.type)} content.`);
 		text += nested.text;
@@ -1699,16 +1753,19 @@ function toolResultText(block) {
 * Check message shapes without performing any provider I/O.
 *
 * Callers run this before resolving credentials so an invalid request never
-* consumes a Qoder subscription.
+* consumes a Qoder subscription. The input is DSH's request shape — durable
+* messages and one-shot user inputs alike; only `role` and `content` are read.
 */
 function validateMessageShapes(messages) {
 	for (const message of messages) {
-		const toolResults = message.content.filter((block) => block.type === "tool-result");
-		if (toolResults.length > 0) {
-			if (message.role !== "user" || toolResults.length !== message.content.length) throw unsupported("Qoder tool-result messages cannot contain sibling content or use a non-user role.");
-			for (const result of toolResults) toolResultText(result);
+		if (message.role === "tool") {
+			for (const block of message.content) {
+				if (block.type === "text" || block.type === "image") continue;
+				throw unsupported(`Qoder tool results support text and image content only; received ${String(block.type)}.`);
+			}
 			continue;
 		}
+		if (message.role === "developer") throw unsupported("Qoder transport does not support developer messages (dynamic tool addition/removal).");
 		for (const block of message.content) {
 			if (block.type === "text") continue;
 			if (block.type === "image") {
@@ -1737,10 +1794,12 @@ async function resolveImagePart(block, context) {
 	if (attachments === void 0) throw new QoderLlmError("Qoder image input requires the DSH attachment service.", "ATTACHMENT");
 	let image;
 	try {
-		const limits = attachments.imageLimits;
+		const { width: sourceWidth, height: sourceHeight } = block.attachment;
+		const projected = requestImageDimensions(sourceWidth, sourceHeight, attachments.imageLimits.maxImagePixels);
 		image = await attachments.readImageRequest(block.attachment, {
-			maxPixels: limits.maxImagePixels,
-			maxBytes: limits.maxImageBytes
+			width: projected.width,
+			height: projected.height,
+			maxBytes: attachments.imageLimits.maxImageBytes
 		}, signal);
 	} catch (error) {
 		if (signal?.aborted) throw new QoderLlmError("Qoder image preparation was aborted.", "ABORTED", { cause: error });
@@ -1781,26 +1840,22 @@ async function validateAndTranslateMessages(messages, systemPrompt, attachments,
 		content: systemPrompt
 	});
 	for (const message of messages) {
-		const toolResults = message.content.filter((block) => block.type === "tool-result");
-		if (toolResults.length > 0) {
-			if (message.role !== "user" || toolResults.length !== message.content.length) throw unsupported("Qoder tool-result messages cannot contain sibling content or use a non-user role.");
-			for (const result of toolResults) {
+		if (message.role === "tool") {
+			output.push({
+				role: "tool",
+				tool_call_id: String(message.toolCallId),
+				content: toolResultText(message.content)
+			});
+			const images = message.content.filter((block) => block.type === "image");
+			if (images.length > 0) {
+				if (attachments !== void 0) enforceImageLimits(images, attachments);
 				output.push({
-					role: "tool",
-					tool_call_id: String(result.toolCallId),
-					content: toolResultText(result)
+					role: "user",
+					content: [{
+						type: "text",
+						text: `[${images.length} image${images.length === 1 ? "" : "s"} returned by the previous tool call]`
+					}, ...await Promise.all(images.map((image) => resolveImagePart(image, context)))]
 				});
-				const images = result.content.filter((block) => block.type === "image");
-				if (images.length > 0) {
-					if (attachments !== void 0) enforceImageLimits(images, attachments);
-					output.push({
-						role: "user",
-						content: [{
-							type: "text",
-							text: `[${images.length} image${images.length === 1 ? "" : "s"} returned by the previous tool call]`
-						}, ...await Promise.all(images.map((image) => resolveImagePart(image, context)))]
-					});
-				}
 			}
 			continue;
 		}
@@ -1843,6 +1898,7 @@ async function validateAndTranslateMessages(messages, systemPrompt, attachments,
 				if (message.role === "assistant") reasoningText += block.text;
 				continue;
 			}
+			throw unsupported(`Qoder transport encountered unsupported block type: ${String(block.type)}`);
 		}
 		if (message.role === "assistant") {
 			const hasReasoning = preserveThinking && reasoningText.length > 0;
@@ -1861,6 +1917,7 @@ async function validateAndTranslateMessages(messages, systemPrompt, attachments,
 				userContent[pending.slot] = await resolveImagePart(pending.block, context);
 			}));
 		}
+		if (message.role === "developer") continue;
 		output.push({
 			role: message.role,
 			content: hasImage ? userContent.filter((part) => part !== void 0) : text
@@ -4388,7 +4445,7 @@ const DEFAULT_MAX_TOKENS = 32768;
 const DEFAULT_CONTEXT_WINDOW = 18e4;
 //#endregion
 //#region src/version.ts
-const QODER_CONNECT_VERSION = "0.2.0";
+const QODER_CONNECT_VERSION = "0.2.1";
 //#endregion
 //#region src/host-heartbeat.ts
 /**

package/package.json

@@ -2,7 +2,7 @@
   "name": "dsh-qoder-connect",
   "displayName": "DSH Qoder Connect",
   "description": "将 Qoder（国内版 / 国际版）的模型接入 DeepSeek Harness — bring Qoder (CN & international) models into DeepSeek Harness.",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "author": "corrinehu",
   "keywords": [
     "dsh-plugin",
@@ -13,7 +13,7 @@
   ],
   "type": "module",
   "engines": {
-    "dsh": ">=0.1.5-rc.2",
+    "dsh": ">=0.1.7-rc.1",
     "node": "^22.19.0 || >=24.0.0"
   },
   "main": "lib/index.js",
@@ -76,35 +76,35 @@
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.2",
-    "@deepseek-ai/dsh-atomic-write": "^0.1.5-rc.1",
-    "@deepseek-ai/dsh-attachment": "^0.1.5-rc.1",
-    "@deepseek-ai/dsh-home-paths": "^0.1.5-rc.1",
-    "@deepseek-ai/dsh-host-webserver": "^0.1.5-rc.1",
-    "@deepseek-ai/dsh-llm": "^0.1.5-rc.1",
-    "@deepseek-ai/dsh-llm-pi-ai": "^0.1.5-rc.1",
-    "@deepseek-ai/dsh-settings": "^0.1.5-rc.1",
+    "@deepseek-ai/dsh-atomic-write": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-attachment": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-home-paths": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-host-webserver": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-llm": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-llm-pi-ai": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-settings": ">=0.1.7-rc.1",
     "@deepseek-ai/schemastery": "^3.18.2",
     "@earendil-works/pi-ai": "^0.85.1",
     "react": "^18.2.0"
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "^4.0.2",
-    "@deepseek-ai/dsh-atomic-write": "^0.1.5-rc.1",
-    "@deepseek-ai/dsh-attachment": "^0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-locale": "^0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-ui-conversation": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-ui-model-selection": "0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-ui-renderer": "^0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-ui-settings": "^0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-ui-settings-plugins": "^0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-ui-sidebar": "^0.1.5-rc.1",
-    "@deepseek-ai/dsh-client-ui-slots": "^0.1.5-rc.1",
-    "@deepseek-ai/dsh-credentials": "^0.1.5-rc.1",
-    "@deepseek-ai/dsh-home-paths": "^0.1.5-rc.1",
-    "@deepseek-ai/dsh-host-webserver": "^0.1.5-rc.1",
-    "@deepseek-ai/dsh-llm": "^0.1.5-rc.1",
-    "@deepseek-ai/dsh-llm-pi-ai": "^0.1.5-rc.1",
-    "@deepseek-ai/dsh-settings": "^0.1.5-rc.1",
+    "@deepseek-ai/dsh-atomic-write": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-attachment": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-locale": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-ui-conversation": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-ui-model-selection": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-ui-renderer": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-ui-settings": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-ui-settings-plugins": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-ui-sidebar": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-client-ui-slots": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-credentials": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-home-paths": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-host-webserver": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-llm": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-llm-pi-ai": ">=0.1.7-rc.1",
+    "@deepseek-ai/dsh-settings": ">=0.1.7-rc.1",
     "@deepseek-ai/schemastery": "^3.18.2",
     "@earendil-works/pi-ai": "^0.85.1",
     "@types/node": "^22.20.0",
@@ -116,8 +116,5 @@
     "typescript": "^5.9.3",
     "vitest": "^4.1.8"
   },
-  "dependencies": {
-    "js-yaml": "^4.1.0"
-  },
   "icon": "./assets/icon.svg"
 }