chore: alpha.2 batch upgrade (held for browser verification)

.github/workflows/compat.yml

@@ -1,6 +1,6 @@
 name: Compat
 
-# dshbase-style compatibility verification (monthly + on demand):
+# dshbase-style compatibility verification (weekly + per PR + on demand):
 #   1. bare-import: install the packed tarball into an empty project (native
 #      builds allowlisted) and import its entry - catches devDependencies
 #      mistaken for dependencies and native-build gate regressions.
@@ -13,8 +13,9 @@ name: Compat
 # Platform guard: every assertion here is platform-neutral. Platform-specific
 # behavior (Windows/macOS-only rows) is never asserted on this Linux runner.
 on:
+  pull_request:
   schedule:
-    - cron: '0 4 1 * *'
+    - cron: '0 4 * * 1'
   workflow_dispatch:
 
 jobs:
@@ -81,7 +82,7 @@ jobs:
           pnpm run build
           pnpm pack --pack-destination "$RUNNER_TEMP"
       - name: Install dsh CLI
-        run: npm install -g @deepseek-ai/dsh@0.1.5-rc.2
+        run: npm install -g @deepseek-ai/dsh@0.1.6-alpha.2
 
       - name: Install into a scratch profile (builds allowlisted)
         run: |
@@ -93,6 +94,7 @@ jobs:
           packages:
             - .
           nodeLinker: hoisted
+          minimumReleaseAge: 0
           autoInstallPeers: false
           allowBuilds:
             '@deepseek-ai/dsh-subprocess-local': true
@@ -101,7 +103,7 @@ jobs:
             protobufjs: true
             '@google/genai': true
           YAML
-          dsh plugin --profile compat add '@deepseek-ai/dsh-base@0.1.5-rc.2' '@deepseek-ai/dsh-headless@0.1.5-rc.2' "$TARBALL"
+          dsh plugin --profile compat add '@deepseek-ai/dsh-base@0.1.6-alpha.2' '@deepseek-ai/dsh-headless@0.1.6-alpha.2' "$TARBALL"
 
       - name: Row-mount assertion
         run: |

CHANGELOG.md

@@ -4,6 +4,21 @@ All notable changes to this project are documented in this file. The format
 is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+### Changed
+
+- Move the settings card from the Settings→plugins tab to the **Plugins page** (Official group): the `0.1.6-alpha.2` host deletes the `settings.plugin.item` slot, so the card registered there silently disappears. The card now registers on the keyed `plugins.item` slot (`id: dsh-github`, `order: 100`, `label` as a function, `locale`) and renders one component in two states — a one-line summary (description + token badge) and the full editable form (`view: 'summary' | 'page'`) — with the built `lib/client.js` rebuilt and committed.
+- Default the CI composite action model to `deepseek-flash`: the `deepseek-v4-flash` id the action, its patch script, and the local test script referenced is removed from the harness catalog, which would silently downgrade GitHub Actions users to a text-only model.
+- Drive the CI review bot's polling through `ctx.jobs.start` (kind `github-ci`) instead of `setInterval`, with a one-time-warn `setInterval` fallback when no job controller serves the agent.
+- Auto-approve CI-driver writes through the official policy seam: `ctx.approval.setPolicy(agent, 'never')` pins the calling agent instead of the previous gate-only bypass.
+- Consume the official `@deepseek-ai/dsh-jobs` (`JobId`, `JobStart`, `JobHooks`, `JobOutcome`, `JobSnapshot`, `JobRegistry`) and `@deepseek-ai/dsh-subagent` (`SubagentRun`, `SubagentStartRequest`) type faces instead of the hand-copied mirrors, and drop the plugin's own `subagents` context augmentation (the official package augments it).
+- Declare `dshWorkshop.manifestVersion: 1` and the `engines.dsh` range `>=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0` (the added third clause keeps the `0.1.6` alpha line accepted).
+
+### Fixed
+
+- Close the type gate over the client half: `src/client.ts` is no longer excluded from `tsconfig.json` (react dev deps and the DOM lib added), and the new `tsconfig.ci.json` + `typecheck:ci` ruler covers the published line. The `lib/client.d.ts` / `lib/client.d.ts.map` / `lib/client.js.map` build artifacts are now committed alongside `lib/client.js`.
+
 ## [0.7.10] - 2026-09-12
 
 ### Changed

README-es.md

@@ -46,7 +46,7 @@
 
 | Superficie | Estado |
 |---|---|
-| Harness | DeepSeek Harness `dsh-v0.1.5-rc.2` (compatibilidad declarada para `0.1.5-rc.2`) 0.1.2-rc.1 (adaptado el 2026-09-09): el sobre de sesión conserva su campo ignorable solo para compatibilidad de lectura de logs almacenados - Session.append aún no puede estamparlo, por lo que el comportamiento de la puerta no cambia. Verificado el 2026-09-11 contra el checkout master de dsh-v0.1.5-rc.2 (cadena de puertas completa + smoke de instalación de profile). |
+| Harness | DeepSeek Harness `dsh-v0.1.6-alpha.2` (compatibilidad declarada para `>=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0`; 0.1.2-rc.1 adaptado el 2026-09-09): la tarjeta de configuración ahora se registra en la **página Plugins** (grupo Official, slot `plugins.item`) en lugar de la pestaña eliminada Settings→plugins; el controlador de CI autoaprueba mediante la costura oficial `ctx.approval.setPolicy`; el bot de revisión sondea como tarea en segundo plano `ctx.jobs` con respaldo por temporizador. Actualizado en lote el 2026-09-18 (typecheck + typecheck:ci + 183 pruebas unitarias en verde). |
 | Node | `^22.19.0 \|\| >=24.0.0` |
 | Plataformas | Todas (plugin host; red saliente a GitHub) |
 | Modelo | Cualquiera (la revisión estática es determinista; `reviewMode: "model"` es opcional) |
@@ -87,7 +87,7 @@ dsh --profile web --dump-config | grep -A3 'id: dsh-github'
 
 ## Configuración
 
-Todos los ajustes son campos `Config` de Schemastery (modificables desde cordis.yml). Una anulación dirigida por id reemplaza toda la fila — vuelve a indicar cada clave que necesites. `cordis.patch.yml` documenta cada clave en línea.
+Todos los ajustes son campos `Config` de Schemastery (modificables desde cordis.yml). Una anulación dirigida por id reemplaza toda la fila — vuelve a indicar cada clave que necesites. `cordis.patch.yml` documenta cada clave en línea. En la GUI, esas mismas claves se editan en la **tarjeta de configuración de la página Plugins** (grupo Official) — la tarjeta se movió allí desde la pestaña Settings→plugins, que el host `0.1.6-alpha.2` ya no declara.
 
 | Clave | Por defecto | Significado |
 |---|---|---|

README-hi.md

@@ -46,7 +46,7 @@
 
 | सतह | स्थिति |
 |---|---|
-| Harness | DeepSeek Harness `dsh-v0.1.5-rc.2` (`0.1.5-rc.2` के लिए compat घोषित) 0.1.2-rc.1 (2026-09-09 को अनुकूलित): सत्र लिफ़ाफ़ा अपना ignorable फ़ील्ड केवल संग्रहीत-लॉग पठन संगतता के लिए रखता है - Session.append अभी भी इसे स्टैम्प नहीं कर सकता, इसलिए गेट व्यवहार अपरिवर्तित है। 2026-09-11 को dsh-v0.1.5-rc.2 master checkout के विरुद्ध सत्यापित (पूर्ण गेट श्रृंखला + profile इंस्टॉल smoke)। |
+| Harness | DeepSeek Harness `dsh-v0.1.6-alpha.2` (`>=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0` के लिए compat घोषित; 0.1.2-rc.1 2026-09-09 को अनुकूलित): settings card अब **Plugins पेज** (Official समूह, `plugins.item` slot) पर पंजीकृत होता है, हटाए गए Settings→plugins टैब की जगह; CI driver आधिकारिक `ctx.approval.setPolicy` नीति सीम से ऑटो-अनुमोदन करता है; review bot `ctx.jobs` पृष्ठभूमि job के रूप में टाइमर फ़ॉलबैक के साथ पोल करता है। 2026-09-18 को बैच-अपग्रेड किया गया (typecheck + typecheck:ci + 183 यूनिट टेस्ट हरे)। |
 | Node | `^22.19.0 \|\| >=24.0.0` |
 | Platforms | सभी (host plugin; GitHub की ओर outbound network) |
 | Model | कोई भी (static review deterministic है; `reviewMode: "model"` वैकल्पिक है) |
@@ -87,7 +87,7 @@ dsh --profile web --dump-config | grep -A3 'id: dsh-github'
 
 ## कॉन्फ़िगरेशन
 
-सभी tunables Schemastery `Config` fields हैं (cordis.yml से बदले जा सकते हैं)। एक id-लक्षित override पूरी row को बदल देता है — जो key आपको चाहिए उसे दोबारा लिखें। `cordis.patch.yml` हर key को inline दस्तावेज़ित करता है।
+सभी tunables Schemastery `Config` fields हैं (cordis.yml से बदले जा सकते हैं)। एक id-लक्षित override पूरी row को बदल देता है — जो key आपको चाहिए उसे दोबारा लिखें। `cordis.patch.yml` हर key को inline दस्तावेज़ित करता है। GUI में, वही keys **Plugins पेज settings card** (Official समूह) के ज़रिए संपादित होती हैं — कार्ड Settings→plugins टैब से यहाँ ले जाया गया है, क्योंकि `0.1.6-alpha.2` host उस slot को अब declare नहीं करता।
 
 | कुंजी | डिफ़ॉल्ट | अर्थ |
 |---|---|---|

README-pt.md

@@ -46,7 +46,7 @@
 
 | Superfície | Status |
 |---|---|
-| Harness | DeepSeek Harness `dsh-v0.1.5-rc.2` (compatibilidade declarada para `0.1.5-rc.2`) 0.1.2-rc.1 (adaptado em 2026-09-09): o envelope de sessão mantém seu campo ignorable apenas para compatibilidade de leitura de logs armazenados - o Session.append ainda não consegue estampá-lo, então o comportamento da porta não muda. Verificado em 2026-09-11 contra o checkout master do dsh-v0.1.5-rc.2 (cadeia de portas completa + smoke de instalação de profile). |
+| Harness | DeepSeek Harness `dsh-v0.1.6-alpha.2` (compatibilidade declarada para `>=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0`; 0.1.2-rc.1 adaptado em 2026-09-09): o cartão de configurações agora se registra na **página Plugins** (grupo Official, slot `plugins.item`) em vez da aba removida Settings→plugins; o driver de CI autoaprova pela costura oficial `ctx.approval.setPolicy`; o bot de revisão pesquisa como job em segundo plano `ctx.jobs` com fallback por temporizador. Atualizado em lote em 2026-09-18 (typecheck + typecheck:ci + 183 testes unitários verdes). |
 | Node | `^22.19.0 \|\| >=24.0.0` |
 | Plataformas | Todas (plugin host; rede de saída para o GitHub) |
 | Modelo | Qualquer (a revisão estática é determinística; `reviewMode: "model"` é opcional) |
@@ -87,7 +87,7 @@ dsh --profile web --dump-config | grep -A3 'id: dsh-github'
 
 ## Configuração
 
-Todos os ajustes são campos `Config` do Schemastery (modificáveis a partir do cordis.yml). Uma substituição direcionada por id troca toda a linha — redeclare cada chave de que você precisa. O `cordis.patch.yml` documenta cada chave em linha.
+Todos os ajustes são campos `Config` do Schemastery (modificáveis a partir do cordis.yml). Uma substituição direcionada por id troca toda a linha — redeclare cada chave de que você precisa. O `cordis.patch.yml` documenta cada chave em linha. Na GUI, as mesmas chaves são editáveis pelo **cartão de configurações da página Plugins** (grupo Official) — o cartão foi movido para lá a partir da aba Settings→plugins, que o host `0.1.6-alpha.2` não declara mais.
 
 | Chave | Padrão | Significado |
 |---|---|---|

README-zh.md

@@ -48,7 +48,7 @@
 
 | 界面 | 状态 |
 |---|---|
-| Harness | DeepSeek Harness `dsh-v0.1.5-rc.2`（兼容声明覆盖 `0.1.5-rc.2`） 0.1.2-rc.1（2026-09-09 已适配）：会话信封保留 ignorable 字段但仅用于存量日志读取兼容——Session.append 仍无法盖章，门控行为不变。 2026-09-11 已对照 dsh-v0.1.5-rc.2 master checkout 核验（完整门禁链 + profile 安装冒烟）。 |
+| Harness | DeepSeek Harness `dsh-v0.1.6-alpha.2`（兼容声明覆盖 `>=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0`；0.1.2-rc.1 于 2026-09-09 已适配）：设置卡现注册在 **Plugins 页**（Official 组，`plugins.item` 槽），不再使用已删除的 Settings→插件 tab；CI 驱动器通过官方 `ctx.approval.setPolicy` 策略缝自动放行；评审机器人以 `ctx.jobs` 后台任务轮询，并带定时器降级。批量升级于 2026-09-18（typecheck + typecheck:ci + 183 项单元测试全绿）。 |
 | Node | `^22.19.0 \|\| >=24.0.0` |
 | Platforms | 全部（host 插件；出站网络访问 GitHub） |
 | Model | 任意（静态审查是确定性的；`reviewMode: "model"` 为可选） |
@@ -89,7 +89,7 @@ dsh --profile web --dump-config | grep -A3 'id: dsh-github'
 
 ## 配置
 
-所有可调项都是 Schemastery `Config` 字段（可从 cordis.yml 修改）。以 id 定位的覆盖会替换整行 —— 需要重新声明你所需的每个键。`cordis.patch.yml` 逐键内联说明。
+所有可调项都是 Schemastery `Config` 字段（可从 cordis.yml 修改）。以 id 定位的覆盖会替换整行 —— 需要重新声明你所需的每个键。`cordis.patch.yml` 逐键内联说明。在图形界面中，同一批键可在 **Plugins 页设置卡**（Official 组）中编辑——该卡已从 Settings→插件 tab 迁出（`0.1.6-alpha.2` 宿主不再声明该槽）。
 
 | 键 | 默认值 | 含义 |
 |---|---|---|

README.md

@@ -48,7 +48,7 @@
 
 | Surface | Status |
 |---|---|
-| Harness | DeepSeek Harness `dsh-v0.1.5-rc.2` (compat declared for `>=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0`; 0.1.2-rc.1 adapted 2026-09-09): the session envelope keeps its ignorable field for stored-log read compatibility only - Session.append still cannot stamp it, so audit-gate behavior is unchanged. Verified 2026-09-11 against the dsh-v0.1.5-rc.2 master checkout (full gate chain + profile install smoke). |
+| Harness | DeepSeek Harness `dsh-v0.1.6-alpha.2` (compat declared for `>=0.1.2-rc.1 <0.2.0 || >=0.1.5-alpha.1 <0.2.0 || >=0.1.6-0 <0.2.0`; 0.1.2-rc.1 adapted 2026-09-09): the settings card now registers on the **Plugins page** (Official group, `plugins.item` slot) instead of the removed Settings→plugins tab; the CI driver auto-approves through the official `ctx.approval.setPolicy` policy seam; the review bot polls as a `ctx.jobs` background job with a timer fallback. Batch-upgraded 2026-09-18 (typecheck + typecheck:ci + 183 unit tests green). |
 | Node | `^22.19.0 \|\| >=24.0.0` |
 | Platforms | All (host plugin; outbound network to GitHub) |
 | Model | Any (static review is deterministic; `reviewMode: "model"` is optional) |
@@ -89,7 +89,7 @@ dsh --profile web --dump-config | grep -A3 'id: dsh-github'
 
 ## Configuration
 
-All tunables are Schemastery `Config` fields (changeable from cordis.yml). An id-targeted override replaces the whole row — restate every key you need. `cordis.patch.yml` documents each key inline.
+All tunables are Schemastery `Config` fields (changeable from cordis.yml). An id-targeted override replaces the whole row — restate every key you need. `cordis.patch.yml` documents each key inline. In the GUI, the same keys are editable through the **Plugins page settings card** (Official group) — the card moved there from the Settings→plugins tab, which the `0.1.6-alpha.2` host no longer declares.
 
 | Key | Default | Meaning |
 |---|---|---|

action.yml

@@ -36,7 +36,7 @@ inputs:
   model:
     description: 'DeepSeek model id for the headless session.'
     required: false
-    default: 'deepseek-v4-flash'
+    default: 'deepseek-flash'
   engine:
     description: "Review engine: 'static' (deterministic analyzer, zero review tokens) or 'model' (the agent authors the review body)."
     required: false