feat!: @refkit/dsh-plugin 0.2.0 — port to DeepSeek Harness 0.1.7

[MyPrototypeWhat]

Ports the plugin to DeepSeek Harness 0.1.7-rc.2 and releases it as 0.2.0.

What changes

• dsh 0.1.7 toolchain. Peers are ^0.1.7-rc.2 and the 0.1.5 pnpm.overrides are gone. dsh-client-runtime is removed and the client externals match the web shell's seed table exactly. The README states the range honestly: dsh refuses the plugin on older releases and on the 0.2.0 pre-releases (next).

• Live configuration. All 18 config fields are .volatile(). An edit re-resolves the config on loader/volatile-update and rebuilds the client lazily, with no restart and no re-apply. sources is validated in the schema against the 23 provider ids, and validateConfig is gone. REFKIT_* and the other env names still act as a fallback for empty keys.

• Settings page on the Plugins page. The row config slot uses the same SettingsFormModel as dsh's own pages. It has two groups:

  • API keys: 10 secret fields showing a Set / Not set marker, plus Remove.
  • Search: the numbers, sources and User-Agent, plus two switches.

  Invalid drafts block Save. The page registers only while dsh serves the refkit namespace.

• Plugin display metadata. locale/en.json and locale/zh.json set the title refkit and a localized description, and icon.svg adds an icon. The settings location in the copy now matches the screen: "Plugins (sidebar) → refkit → Components → refkit" / 「插件（侧边栏）→ refkit → 包含的组件 → refkit」.

• Card. It dispatches on the call phase: preparing shows one line, start shows the skeleton grid, result shows the card. Wikimedia thumbnails are requested at 500 px instead of 1024 px.

• refkit provider patches. @refkit/provider-openverse is now ^0.5.1: anonymous page_size is capped at 20, because the plugin's default pool of 24 used to fail with 401. @refkit/provider-artic is now ^0.4.1: limit is capped at 100. Both come from fix(provider-openverse,provider-artic): respect upstream page-size ceilings refkit#29.

Testing

• 115 unit tests. The gate passes clean: typecheck, lint, test, build, client bundle check, host smoke. lib/ matches a fresh build.
• Live acceptance on dsh 0.1.7-rc.2 in a web profile:
  • The Plugins page shows the title, description and icon.
  • The settings page is populated.
  • An invalid bound (limit 99) shows an inline error and disables Save.
  • Setting limit to 5 applied to the next search without a restart and survived a host restart.
  • A test key flipped its field to Set without echoing the value, and Remove flipped it back.
  • The result card shows thumbnails (Wikimedia at 500 px), license chips and source chips.
  • Openverse returned results.
  • Not observed live: the preparing line. The model provider sends the tool arguments in one chunk, so the phase never appears on screen.
• Provider patches:
  • Request level. With 0.5.1 installed, a default search asks Openverse for its pool of 24 and sends page_size=20.
  • Same code as the tested builds. The npm tarballs of provider-openverse 0.5.1 and provider-artic 0.4.1 contain the same code as the locally packed builds tested against the live APIs: on the old version Openverse returned 401 at 24 and 100 results, on the new one it returned 20.
  • Not rerun live today. Openverse was unreachable from the test machine's network, so the check against the live API was not repeated.
• Every task was reviewed and a final whole-branch review was run. The final review found no Critical or Important issues.

Known upstream issue (not in this PR)

The Met Collection API retired /public/collection/v1/search on 2026-10-01, and that endpoint now returns 410. The fix is refkitjs/refkit#31, which moves @refkit/provider-met to /v1.1/search. It will ship as provider-met 0.4.1, and this plugin's existing ^0.4.0 range already picks it up on install. Until it ships, the Met source shows as failed in the card. The other sources are unaffected.

Follow-ups (not in this PR)

• Add an explicit RETIRED_IDS list so a removed provider id stays valid in sources.
• Add automated tests for the client wiring and for the card's phase dispatch.
• Keep a single externals table shared by tsdown.config.ts and the bundle check.