dsh-zgit v0.2.2

dsh-zgit v0.2.2

Changed

• The prepare script is gone. It was there so a Git install would build
  lib/ on the way in. pnpm will not do that for a git-hosted package unless
  its exact spec is allowlisted under allowBuilds, so the install died with
  ERR_PNPM_GIT_DEP_PREPARE_NOT_ALLOWED before lib/ was ever looked at:

  [ERR_PNPM_GIT_DEP_PREPARE_NOT_ALLOWED] Failed to prepare git-hosted
  package fetched from ".../tar.gz/...": The git-hosted package
  "dsh-zgit@0.2.1" needs to execute build scripts but is not in the
  "allowBuilds" allowlist.
  

  lib/ ships in the repository now, so nothing needs to be built at install
  time. prepack runs the same build for npm publish, where a fresh compile
  is still wanted.

• Default User-Agent bumped to dsh-zgit/0.2.2.

Fixed

• The 0.2.1 notes said prepare still rebuilt lib/ on install. On pnpm it
  never got the chance to; the install was rejected first. Dropping the script
  is what unblocks the one-command install.
• npm test falls back to the project's own @deepseek-ai/* packages when the
  installed DSH profile cannot satisfy the suite's imports (a profile keeps
  cordis under a hashed directory, so aliasing at the profile resolved
  dsh-tools but not cordis).

Install with:

dsh plugin --profile <name> add github:zukunftsholz/dsh-zgit

No allowBuilds entry, no build step, no allowlist.

dsh-zgit v0.2.1

dsh-zgit v0.2.1

Changed

• Default User-Agent bumped to dsh-zgit/0.2.1.

Fixed

• The prebuilt lib/ now ships in the repository. It was gitignored, so
  anything that consumes a Git tag or a tarball without running a build step
  got a package whose main pointed at a file the repository never produced
  and the plugin tree failed to load. prepare still rebuilds lib/ on
  install, so the committed output and a local build agree. If your installer
  blocks build scripts, the tag now works anyway.
• npm test falls back to the project's own @deepseek-ai/* packages when
  the installed DSH profile does not carry the whole peer set the suite
  imports. A profile stores cordis under a hashed directory, so the old
  check (does dsh-tools exist?) picked a profile that could not resolve
  @deepseek-ai/cordis and failed two suites outright. A profile with a
  complete peer set is still preferred.

Install with:

dsh plugin --profile <name> add github:zukunftsholz/dsh-zgit

dsh-zgit v0.2.0

dsh-zgit v0.2.0

Changed

• Adapted to DeepSeek Harness 0.1.5-rc.2 (cordis 4.0.2, schemastery 3.18.2).
• System-prompt guidance now positions zgit against the default-enabled
  web_fetch tool: repository content → zgit, plain web pages → web_fetch.
• Default User-Agent bumped to dsh-zgit/0.2.0.

Added

• SSRF guard: zgit_download and every HTTP fetch refuse private, loopback,
  link-local, and cloud-metadata hosts, re-checked after redirects.
• Header-aware rate-limit detection (x-ratelimit-remaining / retry-after).

Fixed

• MIT LICENSE attribution.
• Git installs build on install (prepare runs the portable build, since
  lib/ is gitignored). If pnpm blocks the build script, allowlist the exact
  key it prints under allowBuilds in the profile's pnpm-workspace.yaml
  and re-run.
• node scripts/build.mjs falls back to local tsc when bash exists but
  cannot run (sandboxed Git Bash), instead of exiting with the shell's crash code.
• Install command corrected to github:zukunftsholz/dsh-zgit.

Install with:

dsh plugin --profile <name> add github:zukunftsholz/dsh-zgit