chore(dsh-web): upgrade DSH to 0.1.2-rc.1

.scratch/dsh-alpha5-upgrade/implementation-report.md

@@ -0,0 +1,110 @@
+# DSH Web 0.1.2-rc.1 implementation report
+
+## Scope
+
+- Repository: `guionai/web`
+- Branch: `dsh-alpha5-upgrade`
+- Fixed point: `d65ad78`
+- Delivery boundary: the Target Amendment in `spec.md`, including tickets 01
+  and 02. Code review and deployment were excluded.
+
+The Target Amendment reopened the previously completed tickets and superseded
+their prior target. Ticket 01 was retargeted first, followed by ticket 02's
+documentation and loader guidance. Both tickets and the spec are now recorded
+as complete.
+
+## Ticket outcomes
+
+### 01 — Run Guion DSH Web on the rc.1 package contract
+
+- Replaced every owned DSH peer and development dependency in
+  `packages/dsh-web/package.json` with the exact `0.1.2-rc.1` version. Cordis,
+  Schemastery, React, and the ordinary Web/Pi package contracts were unchanged.
+- Regenerated `pnpm-lock.yaml` atomically. The owned DSH Web importer entries
+  and package snapshots now resolve the rc.1 family, with no alpha.5 entries.
+- Updated the package and provider seam assertions to name rc.1. Existing
+  provider search, credentials, browser rendering, settings, and tool-card
+  behavior required no source migration, compatibility adapter, or runtime
+  override.
+- The packed-artifact smoke continues to exercise host registration, search,
+  HTTP and browser rendering, links, tool registration, patch metadata, and the
+  lazy browser client against the exact rc.1 package contract.
+
+### 02 — Document Guion DSH Web's rc.1 package contract
+
+- Updated the DSH package description, README, profile-patch comment, and
+  package-facing test wording to identify `0.1.2-rc.1`.
+- Updated `AGENTS.md` with the verified official rc.1 CLI/Loader workflow:
+  install the CLI in a disposable directory, use a disposable `DSH_HOME`,
+  invoke its `lib/bin.js` entrypoint with Node 24 `--expose-internals`, and use
+  no live credentials or custom runtime overrides.
+- Inspected the root `README.md`; it makes no DSH release-version promise, so
+  no root README change was needed.
+
+## Verification
+
+All checks passed on Linux:
+
+- `pnpm install --frozen-lockfile --ignore-scripts`
+- `pnpm --filter @guionai/dsh-web run typecheck`
+- `pnpm --filter @guionai/dsh-web run test` — 6 files, 26 tests passed
+- `pnpm --filter @guionai/dsh-web run build`
+- `pnpm --filter @guionai/dsh-web run test:pack` — packed artifact passed
+- `pnpm typecheck`
+- `pnpm format:check`
+- `pnpm test:release`
+- `pnpm test` — 20 files, 153 tests passed
+- `pnpm build` — all four workspace packages built
+- `pnpm test:pack` — Web, Pi, and DSH packed smokes passed
+- `git diff --check`
+
+The official CLI check used an isolated temporary install of
+`@deepseek-ai/dsh@0.1.2-rc.1` (213 DSH packages in its installed graph) and a
+separate disposable `DSH_HOME`. The Node entrypoint reported `0.1.2-rc.1`,
+installed the packed Guion artifact into the disposable `web` profile,
+composed `--dump-config` with the Guion patch and bundle, and booted the web
+profile successfully with `--help` and the local server path. No live
+credentials, deployed profiles, browsers, or production services were used.
+
+Vitest emitted the existing non-failing missing source-map warning from the
+DSH primitives package. Package smokes used injected operations, local
+fixtures, and test-owned temporary package/cache paths.
+
+## Changed paths
+
+- `AGENTS.md`
+- `packages/dsh-web/package.json`
+- `packages/dsh-web/README.md`
+- `packages/dsh-web/cordis.patch.yml`
+- `packages/dsh-web/test/artifact.test.ts`
+- `packages/dsh-web/test/package.test.ts`
+- `pnpm-lock.yaml`
+- `.scratch/dsh-alpha5-upgrade/implementation-report.md`
+
+No DSH product source, ordinary Web package, or Pi Web package contract
+changed. The local spec and issue files were updated in place; they remain
+project scratch records and are ignored by the repository's global scratch
+ignore rule.
+
+## LOC accounting
+
+Against fixed point `d65ad78`, excluding the lockfile, generated artifacts,
+the report, and ignored tracker files:
+
+| Category | Additions | Deletions |
+| --- | ---: | ---: |
+| Product code | 0 | 0 |
+| Tests | 3 | 3 |
+| Configuration and docs | 33 | 33 |
+| **Total** | **36** | **36** |
+
+The 72 touched lines are within the spec's 25–75 changed-LOC estimate. The
+focused size reflects a dependency/documentation contract update that reuses
+the existing provider, UI, artifact, and CLI verification seams.
+
+## Acceptance result
+
+The rc.1 Target Amendment, tickets 01 and 02, and the existing DSH Web
+behavior are implemented and verified. Guion DSH Web now publishes one exact
+`0.1.2-rc.1` peer/dev contract with a refreshed lockfile, package/test/docs
+assertions, and passing packed validation against the official rc.1 CLI graph.

AGENTS.md

@@ -4,6 +4,6 @@
 
 Repository CI and local tests target Linux. Treat Windows behavior as best-effort here: keep Windows runners, Windows-specific smoke scripts, and simulated Windows tests out of this repository. Validate published packages on real Windows only in the downstream project that owns Windows usage.
 
-## DSH alpha.3 Loader validation
+## DSH rc.1 Loader validation
 
-For profile-local packaged plugins on DSH `0.1.2-alpha.3` with Node 24, run Host and browser acceptance through the deployed Node entrypoint with internals enabled: `node --expose-internals /home/neil/.local/share/dsh-runtime/node_modules/@deepseek-ai/dsh/lib/bin.js ...`. The plain shebang `dsh ...` entrypoint is diagnostic-only on this host/version and is not a supported acceptance path because it cannot resolve profile-local bare plugin specifiers. Use a test-owned disposable `DSH_HOME` and no live credentials.
+For profile-local packaged plugins on DSH `0.1.2-rc.1` with Node 24, install the official rc.1 CLI into a test-owned disposable directory and validate its real installed graph through the Node entrypoint with internals enabled: `node --expose-internals <disposable-install>/node_modules/@deepseek-ai/dsh/lib/bin.js ...`. Keep `DSH_HOME` test-owned and disposable, do not use a deployed runtime or live credentials, and do not add custom runtime overrides or compatibility layers.

packages/dsh-web/README.md

@@ -1,6 +1,6 @@
 # @guionai/dsh-web
 
-DeepSeek Harness 0.1.2-alpha.3 Web bundle and browser settings client for Guion Web.
+DeepSeek Harness 0.1.2-rc.1 Web bundle and browser settings client for Guion Web.
 
 Install it into the existing Web profile:
 
@@ -27,7 +27,7 @@ The route is a complete absolute `http:` or `https:` URL; credentials, query
 strings, and fragments are rejected and its path is used exactly as entered.
 
 The published package is a dual host/browser bundle. Its host and client
-artifacts, profile patch, and exact DSH `0.1.2-alpha.3` peer contract are included
+artifacts, profile patch, and exact DSH `0.1.2-rc.1` peer contract are included
 in the npm package. Search, HTTP page rendering, page-link discovery, optional browser rendering,
 Context7 documentation, and Sourcegraph all run in-process through the bundled
 Guion Web core. `web_fetch` has two page-rendering modes: HTTP (the default) and

packages/dsh-web/cordis.patch.yml

@@ -1,4 +1,4 @@
-# Alpha.3 stock Web has one configured search provider and no fetch provider.
+# rc.1 stock Web has one configured search provider and no fetch provider.
 # Replace only that complete service config; the PTC preset remains untouched.
 - id: web
   name: "@deepseek-ai/dsh-web"

packages/dsh-web/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@guionai/dsh-web",
   "version": "0.1.0",
-  "description": "DeepSeek Harness 0.1.2-alpha.3 provider for Exa, Brave, DeepSeek, and Kepos Bridge web research with HTTP and optional browser page-rendering modes.",
+  "description": "DeepSeek Harness 0.1.2-rc.1 provider for Exa, Brave, DeepSeek, and Kepos Bridge web research with HTTP and optional browser page-rendering modes.",
   "homepage": "https://github.com/guionai/web#readme",
   "bugs": {
     "url": "https://github.com/guionai/web/issues"
@@ -59,38 +59,38 @@
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "4.0.2",
-    "@deepseek-ai/dsh-api-remotes": "0.1.2-alpha.3",
-    "@deepseek-ai/dsh-client-connection": "0.1.2-alpha.3",
-    "@deepseek-ai/dsh-client-locale": "0.1.2-alpha.3",
-    "@deepseek-ai/dsh-client-ui-primitives": "0.1.2-alpha.3",
-    "@deepseek-ai/dsh-client-ui-renderer": "0.1.2-alpha.3",
-    "@deepseek-ai/dsh-client-ui-settings": "0.1.2-alpha.3",
-    "@deepseek-ai/dsh-client-ui-settings-plugins": "0.1.2-alpha.3",
-    "@deepseek-ai/dsh-client-ui-slots": "0.1.2-alpha.3",
-    "@deepseek-ai/dsh-client-ui-tool": "0.1.2-alpha.3",
-    "@deepseek-ai/dsh-credentials": "0.1.2-alpha.3",
-    "@deepseek-ai/dsh-settings": "0.1.2-alpha.3",
-    "@deepseek-ai/dsh-tools": "0.1.2-alpha.3",
-    "@deepseek-ai/dsh-web": "0.1.2-alpha.3",
+    "@deepseek-ai/dsh-api-remotes": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-connection": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-locale": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-primitives": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-renderer": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-settings": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-settings-plugins": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-slots": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-tool": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-credentials": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-settings": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-tools": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-web": "0.1.2-rc.1",
     "@deepseek-ai/schemastery": "3.18.2",
     "react": "^18.2.0"
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "4.0.2",
-    "@deepseek-ai/dsh-api-remotes": "0.1.2-alpha.3",
-    "@deepseek-ai/dsh-client-connection": "0.1.2-alpha.3",
-    "@deepseek-ai/dsh-client-locale": "0.1.2-alpha.3",
-    "@deepseek-ai/dsh-client-ui-chat": "0.1.2-alpha.3",
-    "@deepseek-ai/dsh-client-ui-primitives": "0.1.2-alpha.3",
-    "@deepseek-ai/dsh-client-ui-renderer": "0.1.2-alpha.3",
-    "@deepseek-ai/dsh-client-ui-settings": "0.1.2-alpha.3",
-    "@deepseek-ai/dsh-client-ui-settings-plugins": "0.1.2-alpha.3",
-    "@deepseek-ai/dsh-client-ui-slots": "0.1.2-alpha.3",
-    "@deepseek-ai/dsh-client-ui-tool": "0.1.2-alpha.3",
-    "@deepseek-ai/dsh-credentials": "0.1.2-alpha.3",
-    "@deepseek-ai/dsh-settings": "0.1.2-alpha.3",
-    "@deepseek-ai/dsh-tools": "0.1.2-alpha.3",
-    "@deepseek-ai/dsh-web": "0.1.2-alpha.3",
+    "@deepseek-ai/dsh-api-remotes": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-connection": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-locale": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-chat": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-primitives": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-renderer": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-settings": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-settings-plugins": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-slots": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-client-ui-tool": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-credentials": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-settings": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-tools": "0.1.2-rc.1",
+    "@deepseek-ai/dsh-web": "0.1.2-rc.1",
     "@deepseek-ai/schemastery": "3.18.2",
     "@types/react": "^18.3.0",
     "react": "18.3.1",

packages/dsh-web/test/artifact.test.ts

@@ -130,7 +130,7 @@ function manifest(): any {
   return JSON.parse(readFileSync(join(artifactRoot, "package.json"), "utf8"));
 }
 
-describe("DSH 0.1.2-alpha.3 packed package contract", () => {
+describe("DSH 0.1.2-rc.1 packed package contract", () => {
   it("contains valid host ESM, browser client, declarations, patch, and peer-only metadata", async () => {
     const packed = manifest();
     const host = await import(
@@ -179,7 +179,7 @@ describe("DSH 0.1.2-alpha.3 packed package contract", () => {
         name !== "@deepseek-ai/cordis" &&
         name !== "@deepseek-ai/schemastery"
       )
-        expect(version, `${name} peer`).toBe("0.1.2-alpha.3");
+        expect(version, `${name} peer`).toBe("0.1.2-rc.1");
     }
     expect(artifactContents).not.toContain("dsh-client-runtime");
     expect(artifactContents).not.toContain("0.1.1-rc.2");
@@ -364,7 +364,7 @@ describe("DSH 0.1.2-alpha.3 packed package contract", () => {
       name: "@guionai/dsh-web",
       inject: ["web", "credentials", "settings", "tools"],
     });
-  });
+  }, 30_000);
 
   it("loads the packed browser entry through the supported lazy module contract", async () => {
     const previousWindow = (globalThis as any).window;

packages/dsh-web/test/package.test.ts

@@ -43,7 +43,7 @@ describe("DSH Web package composition", () => {
       }),
     ).toThrow();
   });
-  it("works at the supported alpha.3 WebRuntime provider seam for concurrent PTC queries", async () => {
+  it("works at the supported rc.1 WebRuntime provider seam for concurrent PTC queries", async () => {
     const calls: string[] = [];
     const root = new Context();
     await root.plugin(WebRuntime, { searchProvider: SEARCH_PROVIDER_ID });