fix: dsh 0.1.5 compatibility — auth endpoints 405, /fast menu crash, tool-name collisions

[krfalcon]

Summary

Integrated compatibility pass for the dsh 0.1.5 line (rc.1/rc.2), resolving every currently-open blocker issue and folding in the community fixes that were already proposed:

• DSH Desktop 2.0.9（dsh 0.1.5-rc.1）上 /subscriptions-auth 通道注册抛 cannot get property "webServer" without inject，设置页 HTTP 405 #77 / 0.8.0 on dsh 0.1.5-rc.1: every /subscriptions-auth/* RPC returns 405, login impossible #80 — every /subscriptions-auth/* RPC returns 405 (login impossible): dsh 0.1.5 removed the webServer inject from client-connection, so connection.rpc.handle throws cannot get property "webServer" without inject and the channel never mounts. The endpoints are now served as the exact /api/subscriptions-auth Fetch route (registry present since 0.1.2-alpha.1), with a fallback to the legacy channel on the rc.2 line; the browser half reroutes its calls by the same feature detection. Based on PR fix(transport): serve settings endpoints as an /api Fetch route on dsh 0.1.5+ #82 by @Sunyata-Anatta (its codec, tests, and transport-pick logic are applied nearly verbatim).
• [Bug] /fast contribution uses a string description; on DSH core 0.1.5 the command trigger source throws and the whole "/" command menu disappears #79 — the whole "/" command menu disappears: CommandContribution.description became a thunk in 0.1.5-alpha.1 and the registry calls it per candidate pass, so the plain string threw and aborted the source. description is now a function (older lines render it as empty copy, no crash). From PR fix(client): follow the 0.1.5 command description resolver #75 by @kaijia323.
• x_search 与 @liustack/modsearch 重名导致 apply 整体失败，插件完全不可用（0.8.0 / DSH Desktop 2.0.9） #76 — a foreign x_search owner aborts the whole apply (e.g. @liustack/modsearch in the same profile): each tool now probes the registry and falls back to a namespaced alias (grok_x_search, grok_video_generate, subscriptions_image_generate), degrading to a skip-with-warning when even the alias is taken. The Settings-page switches keep keying on the canonical names; the per-agent deny list uses the name that actually registered. (new in this PR, with tests)
• PR fix: empty credentials no longer poison the auth store or blind every provider #59 by @CHENHUI-X — corrupt/empty credential entries no longer poison the auth store or blind every provider's status read (import gate, skip-with-warning on load, per-provider degradation, write-path validation). The spec conflict with the fix(transport): serve settings endpoints as an /api Fetch route on dsh 0.1.5+ #82 fetch-route test was resolved by keeping both tests.
• PR fix(grok): 兼容账单接口缺省 creditUsagePercent 时正常解析配额周期与重置时间 #64 by @Frost2026 — grok billing windows parse when creditUsagePercent is absent but currentPeriod is present.
• PR fix(claude): detect the CLI version on Windows instead of pinning the stale fallback #74 by @w3a11y — Claude CLI version detection works on Windows (claude.cmd via cmd.exe, 10s probe timeout) instead of pinning the stale fallback.

peerDependencies now admit the 0.1.3 and 0.1.5 lines (^0.1.3-alpha.1 || ^0.1.5-alpha.1), which the feature-detecting registration already serves. Version bumped to 0.8.1 — happy to drop that commit if releases are cut separately.

Testing

• pnpm build clean; pnpm test: 432 pass / 0 fail (was 413 before; +19 from the integrated fixes, incl. a new test/tool-collision.spec.ts driving the real plugin wiring against a registry that already owns x_search).
• End-to-end on a throwaway DSH_HOME with dsh 0.1.5-rc.2: plugin 0.8.1 installed into a fresh profile, dsh web booted, cookie minted from the token URL, then:
  • POST /api/subscriptions-auth {endpoint: "status"} → {"ok":true,"value":{"providers":{...}}} (the exact path that 405'd in 0.8.0 on dsh 0.1.5-rc.1: every /subscriptions-auth/* RPC returns 405, login impossible #80)
  • setSpeed without tier → bad-request: payload.tier must be "standard" or "fast" (validation intact)
  • proxyGet → {"ok":true,...} (proxy panel path intact)
  • startup log clean, no load errors
• The tool-collision path was additionally exercised with all four names (canonical + alias) pre-owned: apply survives, image_generate still mounts.

Notes for reviewers

This is one integrated branch because the four blocking issues compound (e.g. #76's crash also presents as the #77/#80 405). If focused PRs are preferred, each commit is self-contained and credits its source PR — cherry-picks are safe. Closes #76, #77, #79, #80; supersedes #75, #59, #64, #74 and the transport half of #82 (credit retained in both the commits and above).

[V1ki]

感谢你的贡献和完整的兼容性分析，尤其是对 DSH 0.1.5 认证通道问题、/fast 命令菜单问题以及工具名称冲突的定位和修复建议。

我们已将其中的 /fast 修复（来源于 PR #75）合并到当前 main，并在今天补充了回归测试；认证路由部分此前已由独立实现覆盖。由于本 PR 涉及范围较多，同时包含与现有实现及其他 PR 重复的内容，为避免重复合并和后续维护分叉，现关闭本 PR，不直接合并其整体分支。

预计今天会整体收敛现有 issue 和 PR；其中仍有价值但未被覆盖的部分会拆分后单独评估。感谢你的工作和测试验证。