meshy-dsh 0.1.0 → 0.1.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "meshy-dsh",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Meshy skills for DeepSeek Harness: textured, rigged and animated 3D models or print-ready files from text or images, through meshy-cli.",
   "keywords": [
     "dsh-plugin",
@@ -44,7 +44,7 @@
     "smoke": "node scripts/smoke.mjs"
   },
   "meshy": {
-    "skills": "meshy-dev/meshy-3d-agent#v0.8.0"
+    "skills": "meshy-dev/meshy-3d-agent#v0.8.1"
   },
   "dsh": {
     "bundle": {

package/skills/meshy-3d-generation/SKILL.md

@@ -2,12 +2,12 @@
 name: meshy-3d-generation
 description: "Generates and edits digital 3D assets with the Meshy CLI: text-to-3D and image-to-3D models, texturing, remeshing and LODs, UV unwrapping, format conversion (GLB, FBX, OBJ, USDZ, STL, 3MF, Blender), rigging, animation, motion clips from text and reference images. Use when the user asks to make, texture, rig, animate or convert a 3D model or game asset. For physical 3D printing use meshy-3d-printing."
 license: MIT
-compatibility: "Needs Node.js 22.12+ and the Meshy CLI 0.7.x, 0.7.1 or later (npm install -g meshy-cli@0.7); network access to the Meshy API."
+compatibility: "Needs Node.js 22.12+ and the Meshy CLI 0.7.x, 0.7.3 or later (npm install -g meshy-cli@0.7); network access to the Meshy API."
 ---
 
 # Meshy 3D Generation
 
-Use Meshy CLI **0.7** (0.7.1 or later) to turn the user's request into a delivered asset. Completion means
+Use Meshy CLI **0.7** (0.7.3 or later) to turn the user's request into a delivered asset. Completion means
 saving the requested files in the requested location, inspecting an available preview, and
 finishing any project integration the user requested. Login or task submission alone is not
 completion. Choose the shortest suitable pipeline and reuse existing assets for follow-ups.
@@ -29,13 +29,14 @@ existing GLB needs no extra format conversion. Use command help when parameters
 ## First use and authorization
 
 Before the first command run `meshy --version`; no need to ask. When `meshy` is missing or
-older than 0.7.1, install the newest 0.7.x with `npm install -g meshy-cli@0.7` and say so in
+older than 0.7.3, install the newest 0.7.x with `npm install -g meshy-cli@0.7` and say so in
 one line; Setup covers a refused install and a CLI of 0.8 or newer. Reuse a verified session. If login is
 needed, follow Setup and run `auth login --device` (adding `--region cn` for a user in mainland
 China) in a persistent tool session. Show its
 verification URL and user code in **commentary/progress, not a final answer**. Await that same
 session in this turn until it exits, verify `auth status`, then continue the original request.
-A background process cannot resume a finished turn; do not require a "done" chat message.
+A background process cannot resume a finished turn; do not require a "done" chat message, except in
+Setup's two-step sign-in for a user on a remote chat (a phone through a chat bot).
 Browser approval stays with the user; credentials never belong in chat.
 
 ## Execution boundaries

package/skills/meshy-3d-generation/references/delivery.md

@@ -99,7 +99,9 @@ Deliver four things, every time:
 
 1. **The model file**, at the path the user asked for, written as a plain path in backticks.
    Do not present it as a clickable link: hosts open such links in a text/preview pane that
-   cannot render a binary mesh, and it looks broken. Offer the next real action instead —
+   cannot render a binary mesh, and it looks broken. A host with a tool that delivers files to the
+   user (dsh's `present`) gets the model through that tool as well, so it opens from the
+   conversation. Offer the next real action instead —
    reveal it in the file manager (`open -R <path>` on macOS, `explorer /select,<path>` on
    Windows), open it in a local 3D tool, or wire it into the project.
 2. **The preview**, shown inline when one exists, or an explicit note that none does.

package/skills/meshy-3d-generation/references/setup.md

@@ -2,7 +2,7 @@
 
 Shared by the generation and print workflows. Three things are settled before any job
 starts: **how to run the CLI**, **whether a session already exists**, and **where files go**.
-The supported CLI is **0.7.x, from 0.7.1,** on **Node.js 22.12 or newer**. No Python, request wrapper or
+The supported CLI is **0.7.x, from 0.7.3,** on **Node.js 22.12 or newer**. No Python, request wrapper or
 separate token store is involved.
 
 Contents: 1 runner · 2 reuse a session · 3 first login · 4 where files go · 5 one session
@@ -17,26 +17,29 @@ meshy --version
 
 | Observation | What to do |
 |---|---|
-| `meshy --version` prints 0.7.1 or a later 0.7.x | run `meshy` |
-| no `meshy` command, or a version older than 0.7.1 | install the newest 0.7.x (below), then run `meshy` |
-| 0.8 or newer | keep it, since something else may rely on it, and run the temporary 0.7 package |
+| `meshy --version` prints 0.7.3 or a later 0.7.x | run `meshy` |
+| no `meshy` command, or a version older than 0.7.3 | install the newest 0.7.x (below), then run `meshy` |
+| 0.8 or newer | keep it, since something else may rely on it, and run the temporary package |
 | no Node.js, or Node older than 22.12 | stop and report it: the user installs Node.js 22.12+ |
 
 ```bash
 npm install -g meshy-cli@0.7
 ```
 
-Check and install without asking first; say in one line that you are installing it. Never use `sudo` or change system policy: when the
-install is refused (permissions, a managed machine, a sandbox), use the temporary 0.7 package
+Check and install without asking first; say in one line that you are installing it. Install at
+most once: when `meshy --version` still reports a version older than 0.7.3 afterwards, the
+registry this machine uses lags npm, so report that instead of installing again. Never use `sudo`
+or change system policy: when the install is refused (permissions, a managed machine, a sandbox), use the temporary package
 instead. It runs the same CLI without installing anything: put `npm exec --yes
---package=meshy-cli@0.7 --` in front of the same arguments, and the exit code and the JSON on
+--package=meshy-cli@0.7.3 --` in front of the same arguments, and the exit code and the JSON on
 stdout are forwarded unchanged. Recipes are written as `meshy …`; example:
 
 ```bash
-npm exec --yes --package=meshy-cli@0.7 -- meshy auth status --format json --no-update-check
+npm exec --yes --package=meshy-cli@0.7.3 -- meshy auth status --format json --no-update-check
 ```
 
-The first such call downloads the package into the npm cache; later calls reuse it. On Windows
+The first such call downloads the package into the npm cache; later calls reuse it. It names an
+exact version because `npm exec` keeps reusing whatever matching version it cached first. On Windows
 both commands go through `npm.cmd`. A missing `npm` with a working Node.js means the host
 stripped npm: report that and ask the user to install the CLI themselves.
 
@@ -138,12 +141,35 @@ Failure branches — each is a different recovery, so read the error rather than
 - **`device_flow_not_supported`**: this API host has no device endpoint. Ask the user to run
   `meshy auth login` in their own desktop terminal (loopback + browser), or to store their own
   key with `meshy auth login --with-key <key>` privately. Never ask for the key in chat.
-- **Host cannot keep a process alive at all**: fall back to the user running the login command
-  in their own terminal, then re-check `auth status` and resume. This is the only case where a
-  manual terminal step is acceptable.
+- **Host cannot keep a process alive at all**: use the two-step sign-in below.
 
-Do not use `--no-wait`: its JSON contains a `device_code`, which is a bearer secret. Do not use
-`--manual` from an agent — it prompts on stdin for a pasted code. Never show a token, a device
+### Remote chat: sign in across two turns
+
+When the user talks to you through a chat bridge from another device (a phone in QQ, WeChat,
+Slack or Telegram), progress messages may arrive late or only when the turn ends, so a link shown
+while the login waits never reaches them. Sign in in two steps instead (add `--region cn` to the
+first for the China site):
+
+```bash
+meshy auth login --device --no-wait --format json --no-update-check
+```
+
+It returns at once with `result.verification_url` (the code is already in the link),
+`result.user_code` and `result.flow_id`. Keep FLOW_ID in your notes and end the turn with the link
+and the code: ask the user to open it in the phone's own browser rather than the chat app's (an
+in-app browser may not keep the sign-in), approve, and reply when done. When they reply:
+
+```bash
+meshy auth login --device-flow FLOW_ID --format json --no-update-check
+```
+
+It waits while the approval is still pending, saves the session and prints
+`result.status: "logged_in"`; verify `auth status` and continue the original request. An expired
+or unknown flow means running step one again. A host whose question tool reaches the user
+(dsh's `ask_user_question` is forwarded by its chat bridges) can instead ask with the link and
+wait for the answer in the same turn, then run step two.
+
+Do not use `--manual` from an agent — it prompts on stdin for a pasted code. Never show a token, a device
 code or a signed URL to the user or copy one into chat or a file: task results and sidecars
 carry signed URLs, so report paths and task IDs instead of pasting them.
 

package/skills/meshy-3d-generation/references/troubleshooting.md

@@ -11,11 +11,11 @@ timeout · deleting a task · local files.
 
 ## Runner problems
 
-- **`meshy: command not found`** or **a version older than 0.7.1**: install the newest 0.7.x as
-  Setup describes. If the install is refused, use the temporary 0.7 package
-  (`npm exec --yes --package=meshy-cli@0.7 -- meshy …`) and carry on with the same job.
+- **`meshy: command not found`** or **a version older than 0.7.3**: install the newest 0.7.x as
+  Setup describes. If the install is refused, use the temporary package
+  (`npm exec --yes --package=meshy-cli@0.7.3 -- meshy …`) and carry on with the same job.
 - **A global 0.8 or newer** answers `--version`. Do not uninstall or downgrade it; use the
-  temporary 0.7 package for this work and mention the mismatch once.
+  temporary package for this work and mention the mismatch once.
 - **Node older than 22.12** fails the CLI's own runtime gate. Report the required version and the
   installed one; do not try to relax it or run an older CLI.
 - **`npm exec` cannot reach the registry**: report the network/proxy error. A cached package

package/skills/meshy-3d-printing/SKILL.md

@@ -2,12 +2,12 @@
 name: meshy-3d-printing
 description: "Generates and prepares models for physical 3D printing with the Meshy CLI: white and multicolor prints (3MF, STL, OBJ), printability analysis and repair, splitting into parts, Creative Lab products such as figures, lamps and keychains, sizing, and slicer handoff (Bambu Studio, OrcaSlicer, PrusaSlicer, Cura). Use when the user wants something 3D-printed or asks for print or slicer files."
 license: MIT
-compatibility: "Needs Node.js 22.12+ and the Meshy CLI 0.7.x, 0.7.1 or later (npm install -g meshy-cli@0.7); network access to the Meshy API."
+compatibility: "Needs Node.js 22.12+ and the Meshy CLI 0.7.x, 0.7.3 or later (npm install -g meshy-cli@0.7); network access to the Meshy API."
 ---
 
 # Meshy 3D Printing
 
-Use Meshy CLI **0.7** (0.7.1 or later) to deliver the requested print files at the intended size, with
+Use Meshy CLI **0.7** (0.7.3 or later) to deliver the requested print files at the intended size, with
 analysis/repair results where applicable and a slicer handoff when requested. This skill is
 self-contained. Ordinary digital assets belong to meshy-3d-generation.
 
@@ -48,13 +48,14 @@ local dimension check cannot establish full printability.
 ## Cloud authorization
 
 Before the first command run `meshy --version`; no need to ask. When `meshy` is missing or
-older than 0.7.1, install the newest 0.7.x with `npm install -g meshy-cli@0.7` and say so in
+older than 0.7.3, install the newest 0.7.x with `npm install -g meshy-cli@0.7` and say so in
 one line; Setup covers a refused install and a CLI of 0.8 or newer. Local-only work stops at runner setup.
 Cloud work reuses a verified session. If login is needed, keep `auth login --device` running (with `--region cn` for a
 user in mainland China),
 show its URL and user code in **commentary/progress, never a final answer**, and await the
 same tool session in this turn. After it exits, verify `auth status` and resume the print job.
-Do not ask for a "done" message or credentials in chat; Setup has the host wait procedure.
+Never ask for credentials in chat, nor for a "done" message except in Setup's two-step sign-in for a
+user on a remote chat (a phone through a chat bot); Setup has the host wait procedure.
 
 ## Printing-specific constraints
 

package/skills/meshy-3d-printing/references/delivery.md

@@ -99,7 +99,9 @@ Deliver four things, every time:
 
 1. **The model file**, at the path the user asked for, written as a plain path in backticks.
    Do not present it as a clickable link: hosts open such links in a text/preview pane that
-   cannot render a binary mesh, and it looks broken. Offer the next real action instead —
+   cannot render a binary mesh, and it looks broken. A host with a tool that delivers files to the
+   user (dsh's `present`) gets the model through that tool as well, so it opens from the
+   conversation. Offer the next real action instead —
    reveal it in the file manager (`open -R <path>` on macOS, `explorer /select,<path>` on
    Windows), open it in a local 3D tool, or wire it into the project.
 2. **The preview**, shown inline when one exists, or an explicit note that none does.

package/skills/meshy-3d-printing/references/setup.md

@@ -2,7 +2,7 @@
 
 Shared by the generation and print workflows. Three things are settled before any job
 starts: **how to run the CLI**, **whether a session already exists**, and **where files go**.
-The supported CLI is **0.7.x, from 0.7.1,** on **Node.js 22.12 or newer**. No Python, request wrapper or
+The supported CLI is **0.7.x, from 0.7.3,** on **Node.js 22.12 or newer**. No Python, request wrapper or
 separate token store is involved.
 
 Contents: 1 runner · 2 reuse a session · 3 first login · 4 where files go · 5 one session
@@ -17,26 +17,29 @@ meshy --version
 
 | Observation | What to do |
 |---|---|
-| `meshy --version` prints 0.7.1 or a later 0.7.x | run `meshy` |
-| no `meshy` command, or a version older than 0.7.1 | install the newest 0.7.x (below), then run `meshy` |
-| 0.8 or newer | keep it, since something else may rely on it, and run the temporary 0.7 package |
+| `meshy --version` prints 0.7.3 or a later 0.7.x | run `meshy` |
+| no `meshy` command, or a version older than 0.7.3 | install the newest 0.7.x (below), then run `meshy` |
+| 0.8 or newer | keep it, since something else may rely on it, and run the temporary package |
 | no Node.js, or Node older than 22.12 | stop and report it: the user installs Node.js 22.12+ |
 
 ```bash
 npm install -g meshy-cli@0.7
 ```
 
-Check and install without asking first; say in one line that you are installing it. Never use `sudo` or change system policy: when the
-install is refused (permissions, a managed machine, a sandbox), use the temporary 0.7 package
+Check and install without asking first; say in one line that you are installing it. Install at
+most once: when `meshy --version` still reports a version older than 0.7.3 afterwards, the
+registry this machine uses lags npm, so report that instead of installing again. Never use `sudo`
+or change system policy: when the install is refused (permissions, a managed machine, a sandbox), use the temporary package
 instead. It runs the same CLI without installing anything: put `npm exec --yes
---package=meshy-cli@0.7 --` in front of the same arguments, and the exit code and the JSON on
+--package=meshy-cli@0.7.3 --` in front of the same arguments, and the exit code and the JSON on
 stdout are forwarded unchanged. Recipes are written as `meshy …`; example:
 
 ```bash
-npm exec --yes --package=meshy-cli@0.7 -- meshy auth status --format json --no-update-check
+npm exec --yes --package=meshy-cli@0.7.3 -- meshy auth status --format json --no-update-check
 ```
 
-The first such call downloads the package into the npm cache; later calls reuse it. On Windows
+The first such call downloads the package into the npm cache; later calls reuse it. It names an
+exact version because `npm exec` keeps reusing whatever matching version it cached first. On Windows
 both commands go through `npm.cmd`. A missing `npm` with a working Node.js means the host
 stripped npm: report that and ask the user to install the CLI themselves.
 
@@ -138,12 +141,35 @@ Failure branches — each is a different recovery, so read the error rather than
 - **`device_flow_not_supported`**: this API host has no device endpoint. Ask the user to run
   `meshy auth login` in their own desktop terminal (loopback + browser), or to store their own
   key with `meshy auth login --with-key <key>` privately. Never ask for the key in chat.
-- **Host cannot keep a process alive at all**: fall back to the user running the login command
-  in their own terminal, then re-check `auth status` and resume. This is the only case where a
-  manual terminal step is acceptable.
+- **Host cannot keep a process alive at all**: use the two-step sign-in below.
 
-Do not use `--no-wait`: its JSON contains a `device_code`, which is a bearer secret. Do not use
-`--manual` from an agent — it prompts on stdin for a pasted code. Never show a token, a device
+### Remote chat: sign in across two turns
+
+When the user talks to you through a chat bridge from another device (a phone in QQ, WeChat,
+Slack or Telegram), progress messages may arrive late or only when the turn ends, so a link shown
+while the login waits never reaches them. Sign in in two steps instead (add `--region cn` to the
+first for the China site):
+
+```bash
+meshy auth login --device --no-wait --format json --no-update-check
+```
+
+It returns at once with `result.verification_url` (the code is already in the link),
+`result.user_code` and `result.flow_id`. Keep FLOW_ID in your notes and end the turn with the link
+and the code: ask the user to open it in the phone's own browser rather than the chat app's (an
+in-app browser may not keep the sign-in), approve, and reply when done. When they reply:
+
+```bash
+meshy auth login --device-flow FLOW_ID --format json --no-update-check
+```
+
+It waits while the approval is still pending, saves the session and prints
+`result.status: "logged_in"`; verify `auth status` and continue the original request. An expired
+or unknown flow means running step one again. A host whose question tool reaches the user
+(dsh's `ask_user_question` is forwarded by its chat bridges) can instead ask with the link and
+wait for the answer in the same turn, then run step two.
+
+Do not use `--manual` from an agent — it prompts on stdin for a pasted code. Never show a token, a device
 code or a signed URL to the user or copy one into chat or a file: task results and sidecars
 carry signed URLs, so report paths and task IDs instead of pasting them.
 

package/skills/meshy-3d-printing/references/troubleshooting.md

@@ -11,11 +11,11 @@ timeout · deleting a task · local files.
 
 ## Runner problems
 
-- **`meshy: command not found`** or **a version older than 0.7.1**: install the newest 0.7.x as
-  Setup describes. If the install is refused, use the temporary 0.7 package
-  (`npm exec --yes --package=meshy-cli@0.7 -- meshy …`) and carry on with the same job.
+- **`meshy: command not found`** or **a version older than 0.7.3**: install the newest 0.7.x as
+  Setup describes. If the install is refused, use the temporary package
+  (`npm exec --yes --package=meshy-cli@0.7.3 -- meshy …`) and carry on with the same job.
 - **A global 0.8 or newer** answers `--version`. Do not uninstall or downgrade it; use the
-  temporary 0.7 package for this work and mention the mismatch once.
+  temporary package for this work and mention the mismatch once.
 - **Node older than 22.12** fails the CLI's own runtime gate. Report the required version and the
   installed one; do not try to relax it or run an older CLI.
 - **`npm exec` cannot reach the registry**: report the network/proxy error. A cached package