[Louie0806]

(ai: deepseek/deepseek-v41-flash)

Closes #5346
Refs #5317

What

Master has been carrying three inherited required-check failures. None of them come from any in-flight PR — every PR inherits them and goes red for reasons unrelated to its own diff.

Gate	Finding	Introduced by
unused-exports	INTERNAL_ONLY src/pack-install.ts: PackInstallOptions	b9218e857 (#5340)
unused-exports	INTERNAL_ONLY src/codex-models.ts: CodexWindowSource	062948078 (#5305), tracked as #5317
docs-sync	seed drift on compress.promptPack	f096cb3fb (#5319)

Why each is master-red on its own

PackInstallOptions — installPackFromNpm is the only consumer and it lives in the same file; there is no cross-file import in src/ or tests/. The gate classifies it INTERNAL_ONLY precisely because total === own.

CodexWindowSource — already filed as #5317 and fixed identically in #5318. Included here so one PR clears the whole gate.

docs-sync — #5319 shipped a third builtin (src/chat-pack.ts:61-66, source: "shipped:chat") and a new resolution tier (src/compress-settings.ts:171-184), and hand-edited CONFIGURATION.md / CONFIGURATION.zh-CN.md to match — but never updated the generator seed at website/config-reference/compress.yaml. The seed still lists two builtins, so node tools/gen-config-docs.mjs generate rewrites the docs backwards on every run and git diff --exit-code fails.

This reproduces on pristine dc10c2d0b and on 485c5eaff with a clean tree:

git worktree add /tmp/m 485c5eaff -q && cd /tmp/m
node tools/gen-config-docs.mjs generate
git diff --stat
#  CONFIGURATION.md        | 2 +-
#  CONFIGURATION.zh-CN.md  | 2 +-

Fix

1. src/pack-install.ts — drop export on PackInstallOptions; matches existing precedent (DiffOptions, OpencodeV2SetupOptions, SelfRegisterOptions are all unexported param types).
2. src/codex-models.ts — drop export on CodexWindowSource (same change as [PR] fix(#5317): drop the internal-only CodexWindowSource export (master unused-exports gate) #5318).
3. website/config-reference/compress.yaml — restore "chat" to the builtin list and shipped pack to the resolution chain, then commit the generator output.

Both type demotions are behavior-neutral: the gate's own classification is INTERNAL_ONLY = zero external references.

Verification (all run locally)

• node scripts/check-unused-exports.mjs → clean (6 waived), exit 0
• node tools/gen-config-docs.mjs generate && git diff --exit-code -- CONFIGURATION.md CONFIGURATION.zh-CN.md website/main.js website/docs/index.html → exit 0
• Generator is a fixed point: running generate twice in a row produces a byte-identical tree
• config-surface-guard / lifecycle-ledger-guard / check-test-import-graph → exit 0
• npx tsc --noEmit → clean
• npm run build → OK; check-dist-import-annotations + check-dist-external both OK
• tests/pack-install.test.ts 6/6, tests/chat-pack.test.ts + tests/codex-models*.test.ts 15/15

Negative controls (this is the part that matters — the fix must be the thing that flips the gate):

Revert	Gate result
both source demotions	unused-export exit 1, both findings return
the seed row only	docs-sync exit 1, 2-line diff returns

Scope note

Deliberately not touching anything else. This is untangling the inherited red so that real PRs become reviewable again — #5195 has been open about exactly this ("Master CI has been massively red since #5169"). Same-shape fixes were done before (#4533, #4530, #4524, #4534, #4520) but each closed individually without a standing guard.

The broader question — whether docs-sync/docs-coverage need a pre-merge guard so hand-editing generated docs can never land again — is left to the owner; this PR only restores the fixed point.

[Louie0806]

(ai: deepseek/deepseek-v41-flash)

Follow-up on the two required-check failures that were still red on 485c5eaff. Both reproduce on pristine master and pass on dc10c2d0b, so they are inherited rather than introduced by the #5175 line. Cleared in f5ddd362b and merged here as 1b0726e9e→ correct 1b0726e9e.

failing test	root cause	commit
family gate: no raw negative string slices outside the allowlist (tests/text-safe.test.ts)	src/pack-install.ts:110 spawned npm with a bare execFileSync("npm", …). On Windows npm is npm.cmd, which CreateProcess cannot execute → every Windows shard reported npm was not found on PATH and the whole pack-install suite died there (not ok 1547, not ok 1548).	b9218e857 (#5340)
#5103: explicit attachUrl target found but build-incompatible — refusal named with reason and remedy (tests/issue5103-startup-recovery-visibility.test.ts)	The assertion pinned the literal remedy "...converges to the same version". A strictly newer same-lane holder is now adopted rather than deadlocked around, so that clause is gone from the message.	fc53fd466 (#4125)

Fix for (1): route the spawn through planDshSpawn, the same cmd.exe /d /s /c planner launcher / pi-channel / dsh-channel already use. Measured plan shapes:

win32 -> {"command":"cmd.exe","args":["/d","/s","/c","\"npm install --prefix C:\\tmp --no-save x\""],"windowsVerbatimArguments":true}
linux -> {"command":"npm","args":["install","x"]}

So the Linux/CI path is byte-identical to before. The pre-existing if (/ENOENT/.test(err.message)) throw new Error("npm was not found on PATH") guard stays reachable: a genuine missing npm now surfaces as spawnSync res.error with code: ENOENT, which we rethrow into that handler.

Note on (1)'s gate hit specifically: the offender .slice(-3) is on stderr.trim().split("\n") — an array receiver, so it was never the #816/#1615 family bug the gate exists to catch. The gate only inspects the receiver text, so the honest fix is an exact-expression allowlist entry (same shape as the existing events.slice(-10) / lines.slice(-12) entries), not loosening the gate.

Fix for (2): pin the stable fragment restart the host once its copy converges so the assertion tracks the remedy rather than its old prose.

Negative controls (both reverted individually, confirmed red again):

• restore the bare execFileSync line → text-safe 17 pass / 1 fail
• restore the old assertion string → issue5103 4 pass / 1 fail
• with both fixes → text-safe 18/0, issue5103 5/0

Battery on 1b0726e9e: pack-install 6, text-safe 18, issue5103 5, issue5175-drift-name-leak 34, store 29, dsh-native 71, dsh-refresh 19, win-cmd-argv 28 — all pass, 0 fail. npx tsc --noEmit clean; check-unused-exports, config-surface-guard, lifecycle-ledger-guard, check-test-import-graph all exit 0.

The store.test.ts "flushAll retries a dirty content store" failure did not reproduce locally (29/29, and the single test 12× in a row) — leaving that one as environmental/flaky unless it recurs.

[ranxianglei]

关单说明:本 PR 修「master 三红灯门」的三处内容已被 #5327(f9cec9f)以等价或更优方式交付:①codex-models 去导出;②pack-install 裸负切片改 safePrefix(而非加白名单——#5327 后该字面量不存在,此处的 text-safe 白名单条目已成死条目,有门禁会因死白名单反红);③issue5103 测试钉。唯一残留:compress.yaml 的 promptPack "chat" builtin 文档笔 + 对应网站生成物,建议基于新 master 开 docs-only 小 PR 收编,勿在此分支上继续修(它的测试分片红正源于上述残留改动与新 master 的组合)。—— 由 #5327 交付方代为关闭。