@pure01fx/dsh-collection-hu

A small DSH aggregate bundle that reproduces the Hu Web profile on multiple machines: the package-native OpenAI Codex provider and authentication, Hu's DSH Runbook presets, live statistics, the Harbor skin with its Skin Center, Web UI settings, Better Sidebar, Mermaid rendering, and fixed-route fast/pro subagents.

Collection 0.5.4 targets DeepSeek Harness 0.2.0-rc.2: Codex auth 0.13.4, Runbook 0.12.0, subagent tiers 0.3.1, Better Sidebar 0.24.1, Mermaid 0.4.1, Skin Center/Web UI Settings/Usage 0.4.5, Harbor 0.2.0, and slots/primitives 0.2.0-rc.2. Codex auth 0.13.4 adds a UI context-pressure projection: estimated occupancy includes encrypted replay while measured input stays unchanged, with sessions and model switches isolated. It builds on 0.13.3 token-meter accounting, which includes encrypted reasoning in retained-history pricing and compaction pressure reductions without double-counting. Runbook 0.12.0 adds approval-bound, Full-only parallel milestone scheduling and managed delegation; existing contracts stay sequential. The Task Board and LiangShen rows stay dropped, the Harbor skin and the Skin Center selection stay collection-owned, and the model routes remain unchanged. Mermaid rendering remains enabled through the hu-collection-mermaid row; the optional Web UI group remains disabled by default. This is a local release candidate; its pinned plugin dependencies are published, and collection 0.5.4 must be published before registry-only installation. See COMPATIBILITY.md for validation status. Keep collection 0.4.0 for DSH 0.1.7-rc.2 and 0.3.x for 0.1.5-rc.1.

Local candidate installation

The plugin package versions above are available on npm. Collection 0.5.4 is a local candidate; install the checkout into an isolated profile using the exact DSH 0.2.0-rc.2 dependency graph and launch that profile-local CLI. For npm, add the profile-root override "overrides": { "@deepseek-ai/dsh": "$@deepseek-ai/dsh" }: some third-party peers still say >=0.1.7-rc.1, which npm excludes from the 0.2 prerelease line while DSH evaluates with includePrerelease: true. This aligns the actual host graph; it does not exempt plugins from DSH compatibility checks or change third-party packages. Keep strict peer checking enabled. This update did not create release tarballs or run collection-level browser validation for 0.5.4.

Dependency policy

The collection itself is intended to be installed from GitHub. All of its subdependencies use exact npm registry versions because DSH's pnpm profile rejects exotic Git subdependencies through blockExoticSubdeps.

The three pure01fx plugins use their canonical scoped names and exact versions directly. This collection revision requires these npm registry releases:

• @pure01fx/[email protected];
• @pure01fx/[email protected];
• @pure01fx/[email protected].

Historically, Better Sidebar 0.22.1 passed strict DSH 0.1.7-rc.2 installation and cold legacy preference import under the custom collection entry ID (the 0.19.1 peer-compatibility history still applies to the 0.3.x line). The redundant @linxin666/[email protected] aggregate is removed: it pins the old Skin Center, while this collection already mounts Skin Center and Harbor directly.

Do not wrap browser-facing plugins in npm aliases: their client bundles register through __ModuleLoader__ using the package manifest name, which must match the Cordis loader entry name. The exact registry releases above must be available before distributing this collection revision. The @linxin666/* publication boundary is a selection guard, not by itself a compatibility proof. Their GitHub source is a monorepo whose package subdirectories do not contain the published lib output or a prepare script, so direct github:...#path:/... dependencies would install packages without runnable entry files.

Changes in 0.5.0

• Updates exact SDK dependencies and owned plugins for DSH 0.2.0-rc.2.
• Retains the later Tiers inherited-restriction fix and Codex GPT-6.1 discovery, Retry-After and response-phase improvements.
• Updates third-party pins to target-compatible published candidates; no current host/profile is modified by this source update.

Changes in 0.4.0

• Retargets the collection to DSH 0.1.7-rc.2: the dsh.engines.dsh pin and the SDK UI helpers (@deepseek-ai/dsh-client-ui-slots, @deepseek-ai/dsh-client-ui-primitives) move to 0.1.7-rc.2.
• Pins the migrated pure01fx candidates: Codex auth 0.12.0, Runbook 0.10.0, subagent tiers 0.2.0. Each targets DSH 0.1.7-rc.2 and was rebuilt and revalidated at package level during this migration effort's M2/M3 work; this manifest update does not rerun those suites.
• Selects third-party candidates Better Sidebar 0.22.1 and the five @linxin666 main packages 0.4.3 (Skin Center, Task Board, Web UI Settings, LiangShen, Usage). Harbor stays 0.2.0. The exact third-party artifacts were installed in the target graph and exercised by the M4 browser matrix; coverage and limitations are documented in COMPATIBILITY.md.
• Preserves the exact default model and routes (openai-codex/gpt-5.6-sol), the optional Web UI group disabled by default, every hu-collection-* entry ID and plugin identity, and all composition settings in cordis.patch.yml.
• Runbook 0.10.0 keeps the package-managed runbook-standard and runbook-ptc convenience presets; Runbook itself is composable into any user-owned preset (it is not PTC-only) by adding the @pure01fx/dsh-runbook-hu row documented in the Runbook README.

No npm publication, dependency installation, tarball generation, profile write or browser verification was performed for this update.

Changes in 0.3.7

• Pins Codex auth 0.11.2: dynamic model discovery uses client version 0.155.0, with GPT-6 Sol Lite fallback, unified rate/quota/invalid-prompt errors, and image failure request IDs.
• Retains the DSH target, Runbook 0.9.0, all other dependency pins and existing model defaults. Publish Codex auth 0.11.2 before distributing this collection; see COMPATIBILITY.md for verification limits.

Changes in 0.3.6

• Pins Runbook 0.9.0, adding approval-bound selective Milestone verification inheritance for V3 contract revisions, plus explicit current/inherited/revalidation history labels. Existing revisions are not rewritten; omitted selections retain full revalidation.
• Keeps every other dependency pin, DSH target and composition setting from 0.3.5. Publish Runbook 0.9.0 before distributing this collection; see COMPATIBILITY.md for verification limits.

Changes in 0.3.5

• Pins Runbook 0.8.2, fixing approved-revision Resume ignoring explicit resolved blockers. Existing approved revisions can resume after their actual resolved blocker strings are supplied; approval alone does not clear blockers.
• Keeps every other dependency pin and composition setting from 0.3.4. Publish Runbook 0.8.2 before distributing this collection.

Changes in 0.3.4

• Pins Runbook 0.8.1, fixing the task panel rejecting valid V3 Full Runs as an identity/schema mismatch. Existing V3 Full Runs need no draft rewrite or task-board migration. Owning-session, Run and task-schema checks remain enforced.
• All other dependency pins and composition settings stay unchanged from 0.3.3. Publish Runbook 0.8.1 before distributing this collection.

Changes in 0.3.3

• Updates Skin Center, Task Board, Web UI Settings, LiangShen and Usage from 0.3.20 to the published 0.3.24 releases.
• Pins Runbook 0.8.0: new contracts use agent-managed workspace governance without a Git requirement or implicit project-tree scanning; existing Runs retain legacy semantics.
• Keeps Codex auth 0.11.1, subagent tiers 0.1.1, Harbor 0.2.0, Better Sidebar 0.19.1, the exact DSH 0.1.5-rc.1 helper pins and all composition settings. These plugin pins were already current on npm.
• Runbook 0.8.0 is a local release awaiting npm publication; publish it before distributing this exact-version collection. See COMPATIBILITY.md for validation and registry availability.

Changes in 0.3.2

• Pins Codex auth 0.11.1, adding live network status, request/retry/received-payload statistics, and a recovery indicator in the quota panel. Timeout and retry behavior remain unchanged.
• Pins Runbook 0.7.0, adding default V3 Full contracts, Full task boards, approved Lite-to-Full upgrades, and lightweight investigative draft guidance. Existing V2/Lite contracts remain supported; the continuation-stop issue is not fixed in this release.
• Retains DSH 0.1.5-rc.1, model defaults, composition settings, and all other dependency pins. See COMPATIBILITY.md for registry availability and validation limits.

Changes in 0.3.1

• Pins Codex auth 0.11.0, removing plugin payload byte ceilings and preserving complete search results and image data. WebSocket retains incremental context reuse, full reconnect replay, and HTTP fallback.
• Removes the Codex maxRequestBodyBytes transport option; delete that field from any machine-local overrides. DSH remains 0.1.5-rc.1 and all other dependency pins remain unchanged.
• Publish @pure01fx/[email protected] before publishing or distributing this collection version. Release preparation validates local packages; registry installation of the new pin is pending its publication.

Changes in 0.3.0

• Replaces Live Stats with the maintained Usage statistics plugin, preserving the hu-collection-live-stats row ID for existing enable/disable overrides. Live Stats 0.1.20 imports the deleted installSettingsSection API and cannot load on this target.
• Updates the target SDK, three Hu plugins and the five third-party plugins with explicit target compatibility declarations. All pins are published registry versions.
• Removes the deleted tool-subagent-report override and exposes fast/pro tools in the target ptc preset, while retaining user-defined code bindings.
• Resolves the public Runbook Host export to a file URL through a lifecycle-owned Cordis group so the target client registry discovers its canonical client bundle. Governance remains preset-scoped.
• Retains existing model defaults and the disabled optional Web UI group.

Changes in 0.2.6

• Upgrades Codex auth to 0.10.0, which adds optional Codex cloud search, image generation, image editing, and image inspection tools. The collection retains its existing configuration and model defaults.
• Retains Runbook 0.6.1 and all other dependency pins.

Changes in 0.2.5

• Upgrades Runbook to 0.6.1: the new panel styling is default for every Runbook state, including drafts and Runs without a task board. Eligible executing V2 sessions automatically activate tasks during normal execution; no manual adoption command is needed. Native task history is preserved before migration.

Changes in 0.2.4

• Upgrades Runbook to 0.6.0: explicitly adopted task boards, managed delegation and report review, persistent recovery history, and a responsive Milestone/task panel.
• Includes Runbook session-lineage isolation so unrelated invalid history does not block other sessions.
• Retains the existing Runbook /host mount, DSH 0.1.1-rc.2, model defaults, and other dependency pins. Task adoption remains an explicit per-session operation.

Changes in 0.2.3

• Upgrades Codex auth to 0.9.0: managed multiple accounts, per-account quota snapshots, and GPT-6-Astra / Fast support. The default model remains gpt-5.6-sol.
• Upgrades Runbook to 0.5.0: Lite contracts and a read-only in-session status panel. The collection explicitly mounts the new /host entry because dependency bundle patches are not applied transitively.
• Retains DSH 0.1.1-rc.2 and the existing UI dependency pins.

Before installing over Codex auth 0.7.x, securely back up the machine-local Codex credential file: the new plugin migrates the single-account document to the multi-account format. Rolling back the package alone does not restore the old credential format.

Shared defaults

cordis.patch.yml supplies:

• default provider/model: openai-codex/gpt-5.6-sol;
• exactly one package-native openai-codex owner, with the old pi-ai provider map released first;
• Responses WebSocket v2 by default, environment-proxy CONNECT support, and deterministic HTTP/SSE fallback;
• transport-aware connection, pre-output stream, and durable failed-step recovery owned by the Codex plugin;
• Runbook-managed reports with explicit coordinator review; ordinary messages follow the target host policy;
• subagent_fast (medium, depth 1) and subagent_pro (xhigh, depth 2);
• fast/pro visibility in Standard, PTC, user-defined Code, Cordis, and LiangShen, but not Minimal;
• package-managed runbook-standard and runbook-ptc presets, including Lite and Full contracts, without globally exposing Runbook tools; these two bundled presets are conveniences only — Runbook is composable into any user-owned preset (not PTC-only) by adding the @pure01fx/dsh-runbook-hu row, as documented in the Runbook README and the preset NOTICE files;
• the read-only Runbook session status and Milestone/task panel, mounted through the public @pure01fx/dsh-runbook-hu/host export via runbook-host.js; eligible executing Contract V2 / V3 Full sessions activate task boards automatically during normal execution;
• Better Sidebar's file explorer, editor/preview, terminal, Git, browser, and background-task workbench;
• Mermaid code fences rendered as SVG diagrams with a code/diagram toggle by dsh-mermaid;
• Harbor as the active bundled skin.

Pure DNS/TCP/socket outages use cancellable 5-second exponential waits capped at 60 seconds until recovery. Bounded pre-output retries and post-output durable failed-step recovery remain separate, so this collection does not install the old broad 60-request pi-ai policy or the legacy PI_AI_ERROR workaround.

Keep any machine-specific default reasoning effort in user settings rather than the shared bundle:

agent-default-model:
  reasoningEffort: xhigh

Visual preferences such as skin-background also remain user settings. Credentials, OpenAI login state, task-board localStorage data, and machine-specific paths are never packaged.

Selective plugin overrides

Plugin activation is composition-time configuration, so per-machine enable/disable choices belong in the profile's cordis.patch.yml, not $DSH_HOME/settings.yaml.

Every collection-provided @linxin666/* runtime plugin sits under one cordis:group row. This Web UI family — Skin Center, Harbor, Web UI Settings and Usage — is disabled by default. Enable the whole group per profile with:

- id: hu-collection-web-ui
  disabled: false

Omitting this override keeps all collection-provided @linxin666/* runtime content inactive. A user patch replaces the whole matched config, so enabling only the skins restates the group and marks the rest off:

- id: hu-collection-web-ui
  name: cordis:group
  group: true
  disabled: false
  config:
    - id: hu-collection-live-stats
      name: '@linxin666/dsh-usage'
      disabled: true
    - id: hu-collection-skin-center
      name: '@linxin666/dsh-client-ui-skin-center'
    - id: hu-collection-skin-harbor
      name: '@linxin666/dsh-client-ui-skin-harbor'
    - id: hu-collection-web-ui-settings
      name: '@linxin666/dsh-client-ui-web-ui-settings'
      disabled: true

The group contains these individually addressable rows:

• hu-collection-live-stats
• hu-collection-skin-center
• hu-collection-skin-harbor
• hu-collection-web-ui-settings

Non-@linxin666 rows remain independent:

• hu-collection-openai-codex-auth
• hu-collection-runbook-preset-installer
• hu-collection-runbook-status-host
• hu-collection-subagent-tiers
• hu-collection-mermaid

Better Sidebar is a collection-owned row (hu-collection-better-sidebar) in every line: 0.19.1 in 0.3.x, the 0.22.1 candidate in 0.4.0. Selecting aionui-panel suppresses its UI; selecting Better Sidebar (or leaving AionUI unavailable) mounts its workbench. Do not keep another standalone dsh-better-sidebar bundle or manual row active, or both host and client halves will mount twice.

To replace one pinned row with a different version, disable the nested row and mount the standalone bundle, so only one runtime copy is active:

- id: hu-collection-live-stats
  disabled: true

dsh plugin --profile web add @linxin666/dsh-usage@<version>

Namespaced collection ids allow the standalone bundle to coexist without an id collision. The replacement remains responsible for its own DSH-version compatibility. Restart the existing Web process and refresh after changing browser-facing plugins.

Skins

Harbor is the collection's own skin row: hu-collection-skin-harbor (@linxin666/dsh-client-ui-skin-harbor) mounts a self-contained skin that applies its own stylesheet, so the legacy auto-generated dsh-skin managed block in $DSH_HOME/cordis.patch.yml is superseded and must be removed — keeping both mounts Harbor twice.

hu-collection-skin-center (@linxin666/dsh-client-ui-skin-center) adds the manager and its picker. It persists the selection in $DSH_HOME/skin-center-active.json as {"active": "<skin id>", "initialized": true} (Harbor's id is harbor), discovers installed skin packages, and strips the legacy managed rows from $DSH_HOME/cordis.patch.yml on first activation. Preselect harbor in that file before enabling the manager, or the first activation starts from its bundled default.

Install locally

The collection pins Codex auth 0.13.4, Runbook 0.12.0, subagent tiers 0.3.1, Better Sidebar 0.24.1, and dsh-mermaid 0.4.1. All pinned scoped releases must exist in the registry; for local development before a release, temporarily replace its exact registry version in package.json with a reachable file: spec while keeping the dependency key unchanged.

dsh plugin --profile web add file:/absolute/path/to/dsh-hu-collection

The explicit file: form makes pnpm install the collection's dependencies in the profile; a development-only link: expects those dependencies to be installed beside the linked checkout.

Install from GitHub

dsh plugin --profile web add github:pure01fx/dsh-hu-collection

Pin a release or commit for reproducible machines:

dsh plugin --profile web add 'github:pure01fx/dsh-hu-collection#<release-or-commit>'

After bundle changes, restart the existing dsh web process and refresh http://127.0.0.1:3080. Machine-local Codex transport overrides must target this collection's row id hu-collection-openai-codex-auth (not the standalone bundle id openai-codex-auth).

Migrate an existing profile

Do not keep standalone bundles active beside their collection-owned counterparts unless the matching hu-collection-* row (or the whole Web UI group) is disabled first.

Use DSH 0.1.7-rc.2 for collection 0.4.0; upgrading the collection does not upgrade the DSH executable. Preserve the old profile and a previous collection release (0.2.6 or 0.3.x) for rollback.

1. Back up the profile package.json, pnpm-lock.yaml, cordis.patch.yml, and $DSH_HOME/settings.yaml.
2. Remove the existing standalone dependencies:

dsh plugin --profile web remove \
  @linxin666/dsh-client-ui-task-board \
  @linxin666/dsh-client-ui-web-ui-settings \
  @linxin666/dsh-liangshen \
  @linxin666/dsh-live-stats \
  @linxin666/dsh-skins \
  dsh-better-sidebar \
  @pure01fx/dsh-openai-codex-auth \
  @pure01fx/dsh-runbook-hu \
  @pure01fx/dsh-subagent-tiers-hu

3. Remove the generated dsh-skin managed block from $DSH_HOME/cordis.patch.yml; the collection's Harbor row supersedes it (see Skins above).
4. Install the collection locally or from GitHub.
5. Keep machine-local settings and credentials. Remove any machine-local llm-pi-ai.providers.openai-codex or old pi-ai retry override so the collection's empty pi-ai map and single Native owner remain authoritative. The agent-default-model user section may be reduced to only reasoningEffort: xhigh.
6. Restart the existing Web process and refresh the GUI.

The final profile bundle list should contain the built-ins plus this collection, rather than the old standalone bundles:

[
  "@deepseek-ai/dsh-base",
  "@deepseek-ai/dsh-web-app",
  "@pure01fx/dsh-collection-hu"
]

Verify

Collection 0.4.0 passed M4: strict physical tarball installs, exact target SDK graphs, preserved composition defaults, unique client resources, Auth lifecycle, both Runbook preset draft views, Tiers persistence, Sidebar cold migration, optional settings/task-board/usage/LiangShen interactions and Harbor lifecycle. Seventeen checks bind 432 named inputs. The three owned plugins also passed package and historical-fixture validation in M2/M3. No live provider login/inference, production-history migration, publication or current-GUI cutover is claimed. Install the exact official CLI in the profile dependency graph and explicitly select the intended GUI workspace; COMPATIBILITY.md explains why both matter.

Collection 0.3.3 passed isolated installation with the clean local Runbook 0.8.0 tarball, exact SDK-version checks, public-loader host imports, client-bundle syntax/identity checks and packing. Runbook 0.8.0 still needs npm publication; full browser interaction was not rerun.

Collection 0.3.0 previously passed actual Web composition and Chromium loading/refresh for both default and enabled optional UI configurations, plus Runbook Host reapply and toggle checks. See COMPATIBILITY.md for the environment and validation limits.

npm pack --dry-run
dsh --profile web --dump-config
pnpm --dir "$DSH_HOME/profiles/web" list --depth 0

Confirm that llm-pi-ai.providers is empty, exactly one hu-collection-openai-codex-auth row owns openai-codex with nativeAdapter: true, Codex login, account switching, quota display, and generation work, runbook-standard and runbook-ptc are selectable, exactly one hu-collection-runbook-status-host row mounts the read-only Runbook status panel, live stats render, LiangShen is selectable, Harbor is active, task board and Web UI settings load, exactly one Better Sidebar workbench renders, and fast/pro visibility matches the preset bindings above.

Publishing

Before distributing collection 0.4.0, confirm npm availability of every pin — in particular the three pure01fx candidates Codex auth 0.12.0, Runbook 0.10.0 and subagent tiers 0.2.0, plus Sidebar 0.22.1 and the five @linxin666/*@0.4.3 upgrades. This update performed no registry lookup, npm publication, Git push, dependency installation or profile change; installation, tarballs and release archives are owned by the coordinator. Local validation may substitute clean candidate tarballs in an isolated fixture; that does not prove registry availability. Browser-facing dependencies and Cordis rows use their actual package names. See COMPATIBILITY.md for validation details.

The collection itself can then be tagged and distributed from GitHub. Its package name is also ready for an optional npm release:

npm publish --access public

GitHub remains the primary distribution path for the collection; all scoped runtime dependencies must exist on npm for one-command profile installation.