v0.6.12 - releases publish themselves over OIDC

Push a tag, GitHub Actions publishes

0.6.12 is the first release published by npm trusted publishing — no token, no 2FA prompt.

• .github/workflows/publish.yml runs on a v* tag: it checks that the tag matches the
  package.json version, runs the test suite, then publishes over OIDC (id-token: write, and
  deliberately no NODE_AUTH_TOKEN and no registry-url).
• PUBLISHING.md documents that flow first and keeps the bypass-2FA access token as a fallback,
  with the traps met while publishing 0.6.11 by hand.
• No code change: the tarball is 0.6.11 plus these two files.

Install

dsh plugin --profile web add @neptune810/dsh-model-router

81 tests.

v0.6.11 - the panel works under the desktop app again

The panel works under the desktop app again

Every control in the panel was dead inside the DeepSeek desktop build: it answered 403 same-origin only to every mutation, so the panel opened and painted correctly and then ignored every click.

That build's own proxy strips origin, host, cookie and sec-fetch-site before it forwards a request to the in-process host server, and injects a signed cookie of its own — so the route guard saw a POST with no Origin at all and ruled it foreign.

• an absent Origin is now accepted: browsers attach it to every POST, same-origin ones included, so its absence means the caller is not a page — the same correction dsh-market shipped for the same trap (its issue #648);
• the guard is otherwise unchanged: a caller stating sec-fetch-site: cross-site is still refused, and a present Origin must still equal the request's Host, which also refuses Origin: null and an empty Origin — present but unusable is not the same as absent;
• 81 tests (node --test; new: a request with the stripped headers passes, Origin: null does not).

Install

dsh plugin --profile web add @neptune810/dsh-model-router

Restart the app after installing or upgrading: the host half of a plugin is loaded at startup, only its browser half hot-reloads.

v0.6.10 — every step shows the model and effort it was routed to

The routed choice is visible again

The composer chip now carries the live decision next to the scope:

全授权 · deepseek-v4-pro · high   ●

• it refreshes every 2.5s while a task runs (hidden tabs skip the poll), so each round's model and reasoning effort are visible without opening anything;
• the tooltip carries the full provider/model, the effort and the step class;
• the panel gained 最近决策 — the last five routed steps as T<turn>.<step> · model · effort · class.

Install

dsh plugin --profile web add @neptune810/dsh-model-router

80 tests (node --test); the panel preview (docs/ui-preview.html) is refreshed.

v0.6.9 — new-conversation scope fix & no more false amber dot

Two bugs from the composer UI

控制范围 was dead in a brand-new conversation

The panel refused to load without a session id, and /state ignored a per-session pick that was saved before the session's first request — so the segmented control snapped back and looked unresponsive.

Now: session-less reads answer with the deployment default, a pick made before the session exists becomes that default, and /state reads the saved per-session scope (and pinned task type). The panel also keeps refreshing without a session and says why.

Amber dot without a manual pick

The modelSelection projection is { lastUsed, pending }. lastUsed is the header of the last request — i.e. the model this router itself just chose — while only pending is a user pick. Comparing the whole projection made the router's own routing look like a hand pick and stood it down.

The router now watches pending only, so the dot means exactly what it says: green = controlling, amber = you picked by hand.

Install

dsh plugin --profile web add @neptune810/dsh-model-router

80 tests (node --test), including three new regressions.

v0.6.8 — the status dot explains itself

What the dot means

dot	meaning
🟢 green	the router is controlling: it changes the model / reasoning effort as needed
🟠 amber	it stood down: you picked a model by hand, so the router holds back — open the panel and click 重新接管 to hand it back

The trigger's dot now carries this as a tooltip, and the panel header repeats the dot with its state in words, so the colour never has to be guessed.

Install

dsh plugin --profile web add @neptune810/dsh-model-router

No behaviour changes; 77 tests via node --test.

v0.6.7 — model pool, click-only panel, vision & session signals

A full model router for DeepSeek Harness

Keep a pool of models and every agent step is routed to one of them with its reasoning effort set. Everything is configured by clicking in the composer: no JSON, no YAML.

What it does

• Model pool — tick the models the router may use (from the host's own catalog) and give each one a role (日常 / 攻坚), a relative price (便宜 / 中 / 贵) and optionally a 视觉 tag.
• Three authorization scopes — 全授权 (model + effort), 思考 (effort only), 模型 (model only). A manual pick always wins: the router stands down and takes over again on your next command or via 重新接管.
• Task presets — keyword packs (写作 / 代码 / 翻译 / 分析) plus per-model weights (不参与 / 低 / 中 / 高), edited with chips and dropdowns.
• Vision routing — a task carrying an image goes to the vision-tagged model.
• Session signals — the active todo feeds task-type matching; context pressure, a session token budget and subagent depth all prefer the cheap tier.
• Thinking stays on — DeepSeek rejects a thinking-enabled request whose history contains a tool call made with thinking off, so the router never turns thinking off by itself.
• /router prints the live decision; classifier: llm adds optional semantic task typing (keyword rules otherwise).

The 0.6 line at a glance

version	what changed
0.4.0	thinking-off poisoning fixed (trivial now maps to low)
0.5.0	model pool, authorization scopes, composer panel
0.6.0	vision, session signals, subagent policy, /router, LLM classifier
0.6.2	the whole configuration became click-only
0.6.3	dark-mode text fixed; the model pool is never empty
0.6.4	panel restyled with the harness's own design tokens
0.6.5	plain wording, hover help, preview ships in the package
0.6.6	panel is opaque by default (更多 → 面板背景 switches it)
0.6.7	package metadata describes the current feature set

Install

dsh plugin --profile web add @neptune810/dsh-model-router

Then restart dsh web (the composer bundle loads at boot).

Panel preview: docs/ui-preview.html — with dark/light captures and a translucent-vs-opaque comparison. 77 tests via node --test.