[github-actions]

Closes #1878. Submitted by @AksuRedapple.

Ready for artifact review. The reviewer will resolve the submitted source and complete the registry listing.

Submission: submissions/1878.json.
Git references are optional. Use a supplied reference; otherwise resolve main during review. Git updates are submitted manually.

[AksuRedapple]

Update for the existing listing (pinned at v2.0.0). v2.0.2 is main and addresses the first review's optional notes: prompt text/images are no longer logged, endpoint overrides are disclosed, and a message sent to an already-running DSH session now steers into the current turn instead of failing with a 60s start timeout. Please pin v2.0.2 (commit ef885d7).

[AksuRedapple]

Latest main is now v2.0.3 (commit d9e901d) — it also stops the per-turn snapshot-truncation notice (shown only when replaying history). Please pin v2.0.3 instead of v2.0.2.

[paseo-bot]

DeepSeek Harness 2.0.3 is approved, @AksuRedapple. I pinned the revision requested in your latest reply and removed the intake file, retaining your updated overview and description. Nothing is required from you.

Optional next release: update the warning shown when opening an externally running session. It still says messages will be rejected, while the default now steers them into that turn.

Review data

• Policy: main REVIEW.md blob 3c5e763c9565b93ea33fa48c9aeb83e415c72d67. Reviewed registry head 1656abaa4d5369c9951e458c3384981748f3f5fd; intake head c257cacf8e887ca220560b71ec1427007caae81d. Read all discussion and submission #1878. Original accepted submission #1841 / PR #1842 and current repository owner agree with submitting GitHub account ID 307688720.
• Exact artifact: root of https://github.com/AksuRedapple/dsh-paseo-provider.git, requested commit d9e901dfd8748b37dcf67cf8bd22bb94538b713a, package 2.0.3. Independently fetched and compared published 2.0.0 at ea83d79c7b02c044a01838399e2212c5edd25c62. Whole-tree archive SHA-256: old ac7fe5c5e14a81d4c85165060d67cdcf19669a9a2f0dcced515b0efb4a0761a9, new c4b483477b7c3ad72de856baa8ff19aed4977895fadbe0ea269e5026a15f2de5. Disabled hooks, no submodules, checked archive paths/types before confined extraction.
• Inspected the independent diff, server entry, provider, RPC client, endpoint discovery, WebSocket follow, model catalog and turn state, manifest, package/lock metadata, README, English overview and provider SVG. No custom client interface or translations, so no interface screenshot required. The SVG is a provider registration icon, not listing media.
• Preparation remains npm ci --omit=dev --ignore-scripts. Synchronized npm v3 lock fixes sole production dependency [email protected], unchanged from the published artifact; remaining four packages are development-only. Downloaded its tarball independently and verified npm metadata and lock SHA-512: sha512-oyL6OPYme/CmiFvNuGzeoxCJ4nOrZE2O1FwM9MWM1AsGri6nLXB2pg+lNA8aLeXMSav0J6eIVS1j6vUPzUtK9g==. Checked paths/types and read package metadata, imports, client connection and optional accelerator paths. No acquisition lifecycle script or transitive production tree; optional native accelerators absent from the lock. No plugin or dependency installed, built, imported or run; author tests were read, not executed.
• Changed prompt flow (server/provider.ts, lines 259–368): session/list determines whether the DSH session is running elsewhere. DSH_RUNNING_MODE=fail returns dsh/busy; default starts a synthetic tracked turn and sends session/prompt with mode=steer, then follows events and closes that synthetic turn on completion, cancellation or failure. runTurn forwards the selected mode and suppresses duplicate start events. noticeTruncation=false suppresses repetitive per-turn snapshot notices; history replay retains its explicit truncation notice. Findings are source-derived; live DSH behavior was not exercised.
• The changed session.prompt logs retain session/message IDs, delivery, character and block counts instead of prompt bodies/images. Other request logging remains. Overview now discloses logging and endpoint overrides. Opening a running session still emits an outdated rejection warning; this is optional text advice, not a publication blocker.
• Endpoint module reads the selected DSH web log and explicit DSH environment settings. Default discovery exchanges the last launch token for a cookie on loopback with redirects disabled; cookie is cached in memory. Explicit endpoint overrides skip discovery and use the explicit cookie. HTTP RPC, snapshots and turns use these resolved endpoints; authentication failures refresh discovery once. Prompts/images go to DSH; DSH owns provider transmission and tool execution, as disclosed. No separate telemetry collector, credential-store reader, subprocess/eval, runtime software installer, file write/delete or DSH-profile modification found in inspected runtime. Displayed tool commands and paths become timeline data, not execution in this plugin.
• Registry edits: updated existing artifact/repository commit and review timestamp, removed intake, retained original attribution/dates/category and author's overview/description. No redundant fallback or new media. Updated branch from main, which included the approved Look at me update; final PR diff changes only the intended DeepSeek record.
• Trusted current-main online validation passed: 466 well-formed records, one changed artifact match, zero skipped. All 189 trusted registry tests passed on identical registry machinery during this execution; required exact-head CI checked before merge. Held intake workflow approved; its pending-submission failure is superseded by the completed record head. No factory-policy incompatibility or concrete serious safety concern identified.
• Limits: static review, no independent live provider/UI/platform QA or exhaustive dependency audit. Private DSH protocol compatibility, running-session races and behavior with a live external client remain unverified. Existing turn budget, reconnect and close behavior is unchanged. Publication follows merge.