fix: support DSH 0.2.1 alpha and refresh the shared Pi submodule

[LIghtJUNction]

Changes

• Provider 0.1.0-alpha.6; regenerated npm lockfile and synchronized vendor/pi-lmm-provider to e38af2a4e96500b29c473a9f6395911bf8a9cb55 (Pi PR #13).
• Explicit semver support for DSH 0.2.0-rc.2 and 0.2.1-alpha.1 with the matching Cordis peer. DSH's own pi-ai runtime stays on the supported 0.87 line.
• Resolve the CLI tag once and select matching DSH services for each test, rather than mixing independently published library latest tags.
• Test source and real npm tarballs across stable, alpha and latest; discover the tarball filename dynamically.

Packaged-install regression found and fixed

The first expanded matrix exposed a real failure: ordinary runtime dependency ranges installed alpha authorization/pi-ai services into stable DSH. DSH correctly disabled those incompatible services, leaving the auth route unavailable (404). Source-link tests did not reveal the issue because they reused the development dependency tree.

Authorization, home paths and the pi-ai adapter now use host-owned peerDependencies with exact stable devDependencies. No allow-version exemptions, disabled compatibility checks or skipped assertions are used. A new manifest regression test prevents host-owned services from returning to independently installed runtime dependencies. Native failures now include redacted diagnostics.

Validation

The final dependency fix passed typecheck, all 14 unit tests, package checks, actual Web-host OAuth/RPC/catalog/streaming/sign-out tests, and the built tarball on BOTH stable 0.2.0-rc.2 and alpha 0.2.1-alpha.1 under Node 24:
https://github.com/TokenNotIncluded/dsh-lmm-provider/actions/runs/37469603779

The permanent Node 22.19 matrix rechecks stable/alpha/latest on the final commit. All temporary writer workflows have been removed.

Production OAuth, billable inference, Desktop GUI acceptance and package publication were not performed. Existing release asset URLs remain unchanged rather than referencing an unpublished alpha.6 release.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-10-06T13:09:04.618920Z	5add994	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Copilot]

Copilot review overview

🟢 Approval recommended

The compatibility ranges, dependency alignment, packaging workflow, and documentation are consistent with the stated validation goals.

Review effort: Balanced
Findings: None

What changed in this PR

Updates provider compatibility for DSH 0.2.1 alpha while preserving the existing release baseline.

Changes:

• Expands DSH and Cordis prerelease compatibility ranges.
• Aligns CI dependencies to each tested host version.
• Refreshes package metadata, documentation, tarball discovery, and the Pi submodule.

File	Description
scripts/​select-host.mjs	Installs a consistent DSH service set for testing.
README.md	Documents expanded host compatibility.
package.json	Bumps the release and updates semver ranges.
package-lock.json	Synchronizes package metadata and ranges.
.github/​workflows/​ci.yml	Tests baseline, alpha, and latest hosts.
vendor/​pi-lmm-provider	Advances the shared Pi integration commit.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.