v1.3.0 — one-command install (profile bundle manifest)

Install collapses to one command

dsh plugin --profile web add dsh-llm-local-token

That is now the whole install. Restart dsh and the openai-codex / anthropic routes appear in the model picker.

What changed

DSH resolves a bundle's loader rows through the dsh.bundle.patch manifest field, never through code. Until 1.2.0 this package declared only dsh.client, so dsh plugin add could not enable it — you had to hand-edit your profile's own cordis.patch.yml, which is exactly what the README used to instruct.

1.3.0 ships a root cordis.patch.yml carrying the llm-local-token row, points dsh.bundle.patch at it, and includes it in files and exports so it reaches the npm tarball.

The manual path stays documented for vendored copies and for pinning config in your own patch layer — that layer is applied after every bundle layer, so restating the id still overrides the bundle's defaults.

Unchanged

Both provider routes behave exactly as in 1.2.0:

Provider route	Credential source
openai-codex	~/.codex/auth.json (ChatGPT OAuth, shared with the codex CLI)
anthropic	~/.claude/.credentials.json, else the macOS Keychain item Claude Code-credentials

Per-request token resolution with refresh near expiry, a missing credential skips its route instead of failing the boot, and subscription usage is surfaced from provider rate-limit headers (read over SSE for Codex).

Full changelog: v1.2.0...v1.3.0