# v0.2.0-alpha.4

`v0.2.0-alpha.4` makes AuthInOne installation self-contained. The package now owns an explicit bootstrap command that installs through the official DSH plugin CLI and replaces a standard running DSH Web Host on its original loopback port. No patched DSH core is required.

## Self-contained bootstrap

```sh
pnpm dlx github:Stormycry-cryp/dsh-AuthInOne#v0.2.0-alpha.4 install --profile web
```

- The bootstrap validates the profile, loopback URL, unique listener PID, DSH process identity, working directory, launcher, and exact supported DSH owner fingerprints before stopping the Host.
- Plugin mutation still goes through `dsh plugin --profile web add`; AuthInOne does not edit profile YAML, copy runtime files into DSH, or patch the DSH checkout.
- A package-owned detached supervisor waits for the installer to return, terminates only the validated listener PID, starts standard `dsh web` from the same working directory on the same port, and waits for the original URL.
- There is no alternate-port fallback. Unsupported launch provenance and owner drift fail before interruption.
- Restart status is stored with owner-only permissions under the selected profile. The serialized handoff contains no environment values, credentials, authorization URLs, cookies, Provider responses, or request headers.

Use `--url http://127.0.0.1:<port>/` for a non-default loopback port. A DSH source checkout is inferred from the listener working directory or can be passed as `--source-root /path/to/deepseek-harness`.

## Status and removal

```sh
pnpm dlx github:Stormycry-cryp/dsh-AuthInOne#v0.2.0-alpha.4 status --profile web
pnpm dlx github:Stormycry-cryp/dsh-AuthInOne#v0.2.0-alpha.4 uninstall --profile web
```

Removal uses the official DSH plugin remove path and the same validated same-port replacement. DSH sessions, plugin settings, and credential references remain preserved; deleting user data is outside this command.

## Compatibility

This remains an alpha prerelease for official DSH `47f9438`. The bootstrap supports a standard installed `dsh` launcher and macOS/Linux source-checkout launchers. It rejects unknown/new compatibility-owner artifacts and arbitrary process-manager wrappers instead of replaying unverified shell commands. Provider Auth, vision fallback, Usage, and Kimi authorization behavior are unchanged from `v0.2.0-alpha.3`.