NanmiCoder/dsh-agent-teams

&& rm -rf /var/lib/apt/lists/*

Executable file

const write = await localExec(`rm -rf '${dir}' && mkdir -p '${dir}' && base64 -d > '${dir}/package.json'`, {

`pkill -f 'profile ${selfSafe}' 2>/dev/null; rm -rf '/root/.dsh/profiles/${profile}' '${tmpDir}' /tmp/${profile}-boot.log; true`,

if (match) {   try {     const r1 = await fetch(match[1], { redirect: "manual" });

try {     const r1 = await fetch(match[1], { redirect: "manual" });     const setCookie = r1.headers.getSetCookie ? r1.headers.getSetCookie() : [r1.headers.get("set-cookie")];

const r1 = await fetch(match[1], { redirect: "manual" });

const setCookie = r1.headers.getSetCookie ? r1.headers.getSetCookie() : [r1.headers.get("set-cookie")];     const cookie = setCookie.filter(Boolean).map((c) => c.split(";")[0]).join("; ");     const r2 = await fetch("http://127.0.0.1:3080/"

const cookie = setCookie.filter(Boolean).map((c) => c.split(";")[0]).join("; ");     const r2 = await fetch("http://127.0.0.1:3080/", { headers: { cookie } });     outcome.html = await r2.text();

const r2 = await fetch("http://127.0.0.1:3080/", { headers: { cookie } });

#!/bin/bash

# rm -f /app/fixture/<legacy-file-that-must-go>

#!/bin/bash

RUN apt-get update && apt-get install -y --no-install-recommends git      && rm -rf /var/lib/apt/lists/*

&& rm -rf /var/lib/apt/lists/*

# 断言最后一行 {"score":100,"max":100,…}；跑完 docker rm -f

version: "3.1.1"   date: "2026-09-06"   reference: "https://github.com/NanmiCoder/dsh-agent-teams"

date: "2026-09-06"   reference: "https://github.com/NanmiCoder/dsh-agent-teams" ---

reference: "https://github.com/NanmiCoder/dsh-agent-teams"

官方仓库 `https://github.com/deepseek-ai/deepseek-harness` 是公开、MIT 许可的可引用证据源。取证须明确目标版本、对应 tag/commit 和 npm 发布状态；不要把默认分支等同于用户安装版本。需要兜底取证时：

git clone --filter=blob:none https://github.com/deepseek-ai/deepseek-harness.git "$SCRATCH/dsh-official"

This skill produces **evidence of host-version compatibility** (report + boundary signature table); [plugin-upgrade](https://github.com/oh-my-dsh/dsh-plugin-upgrade-skill/blob/main/skills/plugin-upgrade/) consumes that evidence (version-cha

本 skill 产出**宿主版本间的兼容性证据**（报告 + 边界签名表）；[plugin-upgrade](https://github.com/oh-my-dsh/dsh-plugin-upgrade-skill/blob/main/skills/plugin-upgrade/) 消费这类证据（版本变更卡片）执行单个插件的迁移。审计发现可直接供给卡片「实战批注」；给 `plugin-upgrade` 补卡时引用本 skill 的报告目录而非凭记忆转述。

Executable file

#!/usr/bin/env node

#!/usr/bin/env node

const range = `dsh-v${a.resolved}...dsh-v${b.resolved}`     try {       const res = await fetch(`https://api.github.com/repos/${owner}/${repo}/compare/${range}`)

try {       const res = await fetch(`https://api.github.com/repos/${owner}/${repo}/compare/${range}`)       if (res.ok) {

const res = await fetch(`https://api.github.com/repos/${owner}/${repo}/compare/${range}`)

> Carries on the release-track choice of [../SKILL.md](../SKILL.md). This document covers the dependency-resolution facts and operational recipes for installing/updating plugins into `$DSH_HOME/profiles/*`, drawn from the continuous migrati

> (tsbuildinfo, oxc parsing, etc.) are covered in [migration-hygiene](https://github.com/oh-my-dsh/dsh-plugin-upgrade-skill/blob/main/skills/plugin-upgrade/references/migration-hygiene.md);

- The profile's own `node_modules` contains only the profile's declared dependencies; when a bare row name fails to resolve, resolution falls back to the shared `$DSH_HOME/profiles/node_modules` (which holds copies of the app's and each bun

- When a directory junction points at a local workspace package, **a workspace source update takes effect once dsh is restarted**; host-half changes require a restart, and only then can the client half hard-refresh (see item 3 of [migration

Since 0.1.2-alpha.1, dsh web uses bootstrap-token + signed-Cookie authentication (see [DSH-0.1.2-A1-08 · Web/API channel authentication](https://github.com/oh-my-dsh/dsh-plugin-upgrade-skill/blob/main/skills/plugin-upgrade/references/v0.1.2

[DSH-0.1.2-A1-08 · Web/API channel authentication](https://github.com/oh-my-dsh/dsh-plugin-upgrade-skill/blob/main/skills/plugin-upgrade/references/v0.1.2-alpha.1.md)).

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

# 3. Call the custom channel with the session → assert 200 $body = @{ type = 'client-request'; rpcId = 'smoke'; method = 'status'; payload = $null } | ConvertTo-Json Invoke-WebRequest 'http://127.0.0.1:3190/tariff/status' -Method POST -Cont

$body = @{ type = 'client-request'; rpcId = 'smoke'; method = 'status'; payload = $null } | ConvertTo-Json Invoke-WebRequest 'http://127.0.0.1:3190/tariff/status' -Method POST -ContentType 'application/json' -Body $body -WebSession $sess # 

Invoke-WebRequest 'http://127.0.0.1:3190/tariff/status' -Method POST -ContentType 'application/json' -Body $body -WebSession $sess

Invoke-WebRequest 'http://127.0.0.1:3190/tariff/status' -Method POST -ContentType 'application/json' -Body $body

curl equivalent (`-c/-b` cookie jar):

[Credential-related source omitted]

curl -s -b jar.txt -X POST -H 'content-type: application/json' \

-d '{"type":"client-request","rpcId":"smoke","method":"status","payload":null}' \   http://127.0.0.1:3190/tariff/status        # expect 200 curl -s -o /dev/null -w '%{http_code}\n' -X POST \

http://127.0.0.1:3190/tariff/status        # expect 200 curl -s -o /dev/null -w '%{http_code}\n' -X POST \   http://127.0.0.1:3190/tariff/status        # expect 401

curl -s -o /dev/null -w '%{http_code}\n' -X POST \

http://127.0.0.1:3190/tariff/status        # expect 401

**Symptom**: installing by the README's pinned tag fails with `Could not resolve vN.N.N to a commit of https://github.com/<org>/<repo>.git`.

`Could not resolve vN.N.N to a commit of https://github.com/<org>/<repo>.git`.

push, so every release tag is synced to all mirrors; 2. Consumers can confirm a tag exists first with    `git ls-remote --tags https://github.com/<org>/<repo>`.

`git ls-remote --tags https://github.com/<org>/<repo>`.

git clone https://github.com/deepseek-ai/deepseek-harness.git /tmp/dsh-build

- Use this compromise only for APIs with **signature drift where the runtime ignores the extra argument**; APIs with semantic changes must be migrated via the version cards of   [plugin-upgrade](https://github.com/oh-my-dsh/dsh-plugin-upgra

[plugin-upgrade](https://github.com/oh-my-dsh/dsh-plugin-upgrade-skill/blob/main/skills/plugin-upgrade/SKILL.md), never silently compromised;

- The host acceptance matrix matches the release channel: the prerelease channel pins alpha-series tags and the stable channel pins rc-series tags — **never follow master/main to masquerade as acceptance**; - Pre-publish smoke for Web Clien

- Pre-publish smoke for Web Client plugins must cover: the bundle entry announced in the host boot manifest (`window.__DSH_BOOT__`) is reachable, the bundle registers successfully, the DOM mount completes, and there are no page errors; `--d

- Auditable reference implementations: [dsh-genui#86](https://github.com/omdsh-dev/dsh-genui/pull/86),

[dsh-annotation#40](https://github.com/omdsh-dev/dsh-annotation/pull/40) (both implement

#!/usr/bin/env node

Executable file

[Credential-related source omitted]

Full case write-up with the forensic chain: [dsh-assembler migration ledger, "empty-table" section](https://github.com/TT-Wang/dsh-assembler/blob/main/docs/research/dsh-alpha2-migration.md).

#!/usr/bin/env node

#!/usr/bin/env node

Executable file

[Credential-related source omitted]

Normative background: [dsh-community-standard](https://github.com/oh-my-dsh/dsh-community-standard)

owns manifests, contract coordinates, and negotiation conventions; this skill handles practical upgrades of existing plugins, reusing that classification without redefining it. The official call for contributions is [deepseek-harness discus

规范背景：[dsh-community-standard](https://github.com/oh-my-dsh/dsh-community-standard)

规范语义。官方征集出处见 [deepseek-harness discussion #5120](https://github.com/deepseek-ai/deepseek-harness/discussions/5120)。

This zero-dependency fixture only prevents the Host/Client planes from being written backwards again; it cannot replace a build from the pinned tag or a real DSH profile. For production-grade validation and positive controls, see [`benchmar

[`benchmark/validation-report-2026-08-30.md`](https://github.com/oh-my-dsh/dsh-plugin-upgrade-skill/blob/main/benchmark/results/validation-report-2026-08-30.md).

- [DSH-0.1.2-A1-01](../references/v0.1.2-alpha.1.md) - [Full container-chain validation](https://github.com/oh-my-dsh/dsh-plugin-upgrade-skill/blob/main/benchmark/results/validation-report-2026-08-30.md)

- [Full container-chain validation](https://github.com/oh-my-dsh/dsh-plugin-upgrade-skill/blob/main/benchmark/results/validation-report-2026-08-30.md)

该依赖零 fixture 只防止 Host/Client 平面再次写反；它不能替代固定 tag 的 build 或真实 DSH profile。产品级实测与正控见 [`benchmark/validation-report-2026-08-30.md`](https://github.com/oh-my-dsh/dsh-plugin-upgrade-skill/blob/main/benchmark/results/validation-report-2026-08-30.m

[`benchmark/validation-report-2026-08-30.md`](https://github.com/oh-my-dsh/dsh-plugin-upgrade-skill/blob/main/benchmark/results/validation-report-2026-08-30.md)。

- [DSH-0.1.2-A1-01](../references/v0.1.2-alpha.1.md) - [容器全链验证](https://github.com/oh-my-dsh/dsh-plugin-upgrade-skill/blob/main/benchmark/results/validation-report-2026-08-30.md)

- [容器全链验证](https://github.com/oh-my-dsh/dsh-plugin-upgrade-skill/blob/main/benchmark/results/validation-report-2026-08-30.md)

- Plugin: `dsh-mnemon`, version `0.3.4` while the compatibility change was developed, then released   in [`v0.3.5`](https://github.com/omdsh-dev/dsh-mnemon/releases/tag/v0.3.5).

in [`v0.3.5`](https://github.com/omdsh-dev/dsh-mnemon/releases/tag/v0.3.5).

- Published baseline: DSH [`dsh-v0.1.1-rc.2`](https://github.com/deepseek-ai/deepseek-harness/tree/dsh-v0.1.1-rc.2)

(commit `b150a551b8d465e31e418e1b2eaf5e79bbb7d28e`), supplied by the npm registry and lockfile. - Source-preview target: DSH [`dsh-v0.1.2-alpha.1`](https://github.com/deepseek-ai/deepseek-harness/tree/dsh-v0.1.2-alpha.1)   (commit `cd5ef814

- Source-preview target: DSH [`dsh-v0.1.2-alpha.1`](https://github.com/deepseek-ai/deepseek-harness/tree/dsh-v0.1.2-alpha.1)

official tag was built for verification. - Plugin evidence: initial adaptation commit   [`30d7476`](https://github.com/omdsh-dev/dsh-mnemon/commit/30d7476ba58f86e417959aae64d4dd3fb80f0434),

- Plugin evidence: initial adaptation commit   [`30d7476`](https://github.com/omdsh-dev/dsh-mnemon/commit/30d7476ba58f86e417959aae64d4dd3fb80f0434),   rc.2 compatibility correction

[`30d7476`](https://github.com/omdsh-dev/dsh-mnemon/commit/30d7476ba58f86e417959aae64d4dd3fb80f0434),

rc.2 compatibility correction   [`b50a504`](https://github.com/omdsh-dev/dsh-mnemon/commit/b50a504dbe738aa359cd6ef8e4fd790ed9c19a10),   and merged [PR #105](https://github.com/omdsh-dev/dsh-mnemon/pull/105).

[`b50a504`](https://github.com/omdsh-dev/dsh-mnemon/commit/b50a504dbe738aa359cd6ef8e4fd790ed9c19a10),

and merged [PR #105](https://github.com/omdsh-dev/dsh-mnemon/pull/105).

Pinned primary sources: rc.2 [`HostConnectionRpc.handle`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.1-rc.2/packages/client/connection/src/rpc.ts)

[`HostConnectionRpc.handle`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.1-rc.2/packages/client/connection/src/rpc.ts)

requires options and [`HostConnectionService.register`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.1-rc.2/packages/client/connection/src/rpc-host.ts) reads `options.authority`; alpha.1

[`HostConnectionService.register`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.1-rc.2/packages/client/connection/src/rpc-host.ts)

reads `options.authority`; alpha.1 [`HostConnectionRpc.handle`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.1/packages/client/connection/src/rpc.ts) and

[`HostConnectionRpc.handle`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.1/packages/client/connection/src/rpc.ts)

and [`HostConnectionService`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.1/packages/client/connection/src/rpc-host.ts) consume only the first two arguments.

[`HostConnectionService`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.1/packages/client/connection/src/rpc-host.ts)

The pinned implementation is in [`src/contracts.ts`](https://github.com/omdsh-dev/dsh-mnemon/blob/b50a504dbe738aa359cd6ef8e4fd790ed9c19a10/src/contracts.ts),

[`src/contracts.ts`](https://github.com/omdsh-dev/dsh-mnemon/blob/b50a504dbe738aa359cd6ef8e4fd790ed9c19a10/src/contracts.ts),

[`src/rpc.ts`](https://github.com/omdsh-dev/dsh-mnemon/blob/b50a504dbe738aa359cd6ef8e4fd790ed9c19a10/src/rpc.ts), and

[`src/settings.ts`](https://github.com/omdsh-dev/dsh-mnemon/blob/b50a504dbe738aa359cd6ef8e4fd790ed9c19a10/src/settings.ts).

[`tests/dsh-connection-compat.spec.ts`](https://github.com/omdsh-dev/dsh-mnemon/blob/b50a504dbe738aa359cd6ef8e4fd790ed9c19a10/tests/dsh-connection-compat.spec.ts).

See the pinned [`scripts/link-dsh-source.mjs`](https://github.com/omdsh-dev/dsh-mnemon/blob/b50a504dbe738aa359cd6ef8e4fd790ed9c19a10/scripts/link-dsh-source.mjs).

[`scripts/link-dsh-source.mjs`](https://github.com/omdsh-dev/dsh-mnemon/blob/b50a504dbe738aa359cd6ef8e4fd790ed9c19a10/scripts/link-dsh-source.mjs).

The incident is distilled into executable task [H11-dual-cohort-rpc](https://github.com/oh-my-dsh/dsh-plugin-upgrade-skill/blob/main/benchmark/tasks/H11-dual-cohort-rpc/README.md). Its grader invokes

[H11-dual-cohort-rpc](https://github.com/oh-my-dsh/dsh-plugin-upgrade-skill/blob/main/benchmark/tasks/H11-dual-cohort-rpc/README.md). Its grader invokes

- 插件：`dsh-mnemon`，迁移代码完成时为 `0.3.4`，随后随   [`v0.3.5`](https://github.com/omdsh-dev/dsh-mnemon/releases/tag/v0.3.5) 发布。

[`v0.3.5`](https://github.com/omdsh-dev/dsh-mnemon/releases/tag/v0.3.5) 发布。

- 已发布基线：DSH [`dsh-v0.1.1-rc.2`](https://github.com/deepseek-ai/deepseek-harness/tree/dsh-v0.1.1-rc.2)

（commit `b150a551b8d465e31e418e1b2eaf5e79bbb7d28e`），由 npm registry 与 lockfile 提供。 - 源码预览目标：DSH [`dsh-v0.1.2-alpha.1`](https://github.com/deepseek-ai/deepseek-harness/tree/dsh-v0.1.2-alpha.1)   （commit `cd5ef8148158c3a752a658978873241fdf8e2b

- 源码预览目标：DSH [`dsh-v0.1.2-alpha.1`](https://github.com/deepseek-ai/deepseek-harness/tree/dsh-v0.1.2-alpha.1)

（commit `cd5ef8148158c3a752a658978873241fdf8e2bbc`）；alpha.1 未发布到 npm，验证时从官方 tag 构建。 - 插件证据：初次适配 commit   [`30d7476`](https://github.com/omdsh-dev/dsh-mnemon/commit/30d7476ba58f86e417959aae64d4dd3fb80f0434)，

- 插件证据：初次适配 commit   [`30d7476`](https://github.com/omdsh-dev/dsh-mnemon/commit/30d7476ba58f86e417959aae64d4dd3fb80f0434)，   rc.2 兼容修正 commit

[`30d7476`](https://github.com/omdsh-dev/dsh-mnemon/commit/30d7476ba58f86e417959aae64d4dd3fb80f0434)，

rc.2 兼容修正 commit   [`b50a504`](https://github.com/omdsh-dev/dsh-mnemon/commit/b50a504dbe738aa359cd6ef8e4fd790ed9c19a10)，   合并记录 [PR #105](https://github.com/omdsh-dev/dsh-mnemon/pull/105)。

[`b50a504`](https://github.com/omdsh-dev/dsh-mnemon/commit/b50a504dbe738aa359cd6ef8e4fd790ed9c19a10)，

合并记录 [PR #105](https://github.com/omdsh-dev/dsh-mnemon/pull/105)。

固定一手来源：rc.2 的 [`HostConnectionRpc.handle`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.1-rc.2/packages/client/connection/src/rpc.ts)

[`HostConnectionRpc.handle`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.1-rc.2/packages/client/connection/src/rpc.ts)

要求 options，且 [`HostConnectionService.register`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.1-rc.2/packages/client/connection/src/rpc-host.ts) 读取 `options.authority`；alpha.1 的

[`HostConnectionService.register`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.1-rc.2/packages/client/connection/src/rpc-host.ts)

读取 `options.authority`；alpha.1 的 [`HostConnectionRpc.handle`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.1/packages/client/connection/src/rpc.ts) 和

[`HostConnectionRpc.handle`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.1/packages/client/connection/src/rpc.ts)

和 [`HostConnectionService`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.1/packages/client/connection/src/rpc-host.ts) 只消费前两个参数。

[`HostConnectionService`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.1/packages/client/connection/src/rpc-host.ts)

固定实现见 [`src/contracts.ts`](https://github.com/omdsh-dev/dsh-mnemon/blob/b50a504dbe738aa359cd6ef8e4fd790ed9c19a10/src/contracts.ts)、

[`src/contracts.ts`](https://github.com/omdsh-dev/dsh-mnemon/blob/b50a504dbe738aa359cd6ef8e4fd790ed9c19a10/src/contracts.ts)、

[`src/rpc.ts`](https://github.com/omdsh-dev/dsh-mnemon/blob/b50a504dbe738aa359cd6ef8e4fd790ed9c19a10/src/rpc.ts) 和

[`src/settings.ts`](https://github.com/omdsh-dev/dsh-mnemon/blob/b50a504dbe738aa359cd6ef8e4fd790ed9c19a10/src/settings.ts)。

[`tests/dsh-connection-compat.spec.ts`](https://github.com/omdsh-dev/dsh-mnemon/blob/b50a504dbe738aa359cd6ef8e4fd790ed9c19a10/tests/dsh-connection-compat.spec.ts)。

固定实现见 [`scripts/link-dsh-source.mjs`](https://github.com/omdsh-dev/dsh-mnemon/blob/b50a504dbe738aa359cd6ef8e4fd790ed9c19a10/scripts/link-dsh-source.mjs)。

[`scripts/link-dsh-source.mjs`](https://github.com/omdsh-dev/dsh-mnemon/blob/b50a504dbe738aa359cd6ef8e4fd790ed9c19a10/scripts/link-dsh-source.mjs)。

该事故已被提炼为可执行的 [H11-dual-cohort-rpc](https://github.com/oh-my-dsh/dsh-plugin-upgrade-skill/blob/main/benchmark/tasks/H11-dual-cohort-rpc/README.md)：

**Sources**: Community migration practice (migration completed 2026-08-28, verified by real boot + unit-test regression) — [deepseek-harness discussion #5120](https://github.com/deepseek-ai/deepseek-harness/discussions/5120#discussioncommen

- https://github.com/lhh010/dsh-ui-whale (migrated at v0.3.5)

- https://github.com/lhh010/dsh-ui-progress (v0.9.4)

- https://github.com/lhh010/dsh-input-history (v0.1.4)

- https://github.com/lhh010/dsh-minigames (v0.3.7)

- https://github.com/lhh010/dsh-paste-input (v0.1.6)

- https://github.com/lhh010/dsh-file-trace (written on 0.1.2-alpha.1)

**素材来源**: 社区迁移实践（2026-08-28 完成迁移，实机 boot 验证 + 单测回归）——[deepseek-harness discussion #5120](https://github.com/deepseek-ai/deepseek-harness/discussions/5120#discussioncomment-18208001)，六个插件仓库见文末。

- https://github.com/lhh010/dsh-ui-whale （v0.3.5 完成迁移）

- https://github.com/lhh010/dsh-ui-progress （v0.9.4）

- https://github.com/lhh010/dsh-input-history （v0.1.4）

- https://github.com/lhh010/dsh-minigames （v0.3.7）

- https://github.com/lhh010/dsh-paste-input （v0.1.6）

- https://github.com/lhh010/dsh-file-trace （基于 0.1.2-alpha.1 新写）

|---|---|---| | 1 Inventory | Record HEAD/remote/baseline per repo; fetch + `--ff-only` audit | Common error 1 below | | 2 Baseline | devDependencies on the npm release line, wide peer ranges, dual-compatible code | [publish-playbook](https

| 1 Inventory | Record HEAD/remote/baseline per repo; fetch + `--ff-only` audit | Common error 1 below | | 2 Baseline | devDependencies on the npm release line, wide peer ranges, dual-compatible code | [publish-playbook](https://github.com/

| 2 Baseline | devDependencies on the npm release line, wide peer ranges, dual-compatible code | [publish-playbook](https://github.com/oh-my-dsh/dsh-plugin-upgrade-skill/blob/main/skills/plugin-release/references/publish-playbook.md) dual-c

| 3 Batch edits | Minimal diff per repo: version bump / doc baseline / touchpoint code | Corridor cards + batch check loop | | 4 Commit and push | Uniform message template; push per repo; on failure rebase then `--force-with-lease` | Common

| 4 Commit and push | Uniform message template; push per repo; on failure rebase then `--force-with-lease` | Common errors 2/3 | | 5 Profile wrap-up | `pnpm update` re-resolves the GitHub install track; keep the three rename sites in sync |

| 5 Profile wrap-up | `pnpm update` re-resolves the GitHub install track; keep the three rename sites in sync | [profile-dependency-management](https://github.com/oh-my-dsh/dsh-plugin-upgrade-skill/blob/main/skills/plugin-release/references

The alpha line is not on npm, so public repositories keep their devDependencies on the npm release line (`^0.1.1-rc.2` at the time) and use wide peer ranges (`<0.2.0`) to cover the unpublished cohort; code against signature-drifted APIs use

Per [profile-dependency-management](https://github.com/oh-my-dsh/dsh-plugin-upgrade-skill/blob/main/skills/plugin-release/references/profile-dependency-management.md): run `pnpm update` to re-resolve dependencies on the GitHub install track

- Technical touchpoints and cards: see [v0.1.1-rc.2](../references/v0.1.1-rc.2.md), [alpha.1](../references/v0.1.2-alpha.1.md), [alpha.2](../references/v0.1.2-alpha.2.md), and [rollup](../references/rollup-0.1.2.md); - Toolchain pitfalls: [

- Release/distribution surface: [publish-playbook](https://github.com/oh-my-dsh/dsh-plugin-upgrade-skill/blob/main/skills/plugin-release/references/publish-playbook.md) and [profile-dependency-management](https://github.com/oh-my-dsh/dsh-pl

|---|---|---| | 1 盘点 | 逐仓记录 HEAD/remote/基线；fetch + `--ff-only` 审计 | 下文常见错误 1 | | 2 基线 | devDependencies 用 npm 发布线、peer 宽范围、代码双兼容 | [publish-playbook](https://github.com/oh-my-dsh/dsh-plugin-upgrade-skill/blob/main/skills/plugin-release/refe

| 1 盘点 | 逐仓记录 HEAD/remote/基线；fetch + `--ff-only` 审计 | 下文常见错误 1 | | 2 基线 | devDependencies 用 npm 发布线、peer 宽范围、代码双兼容 | [publish-playbook](https://github.com/oh-my-dsh/dsh-plugin-upgrade-skill/blob/main/skills/plugin-release/references/publish

| 2 基线 | devDependencies 用 npm 发布线、peer 宽范围、代码双兼容 | [publish-playbook](https://github.com/oh-my-dsh/dsh-plugin-upgrade-skill/blob/main/skills/plugin-release/references/publish-playbook.md) 双兼容节 |

| 3 批量修改 | 逐仓最小 diff：版本 bump / 文档基线 / 触点代码 | 走廊卡片 + 批量 check 循环 | | 4 提交推送 | 统一消息模板；逐仓 push；失败 rebase 后 `--force-with-lease` | 常见错误 2/3 | | 5 profile 收尾 | `pnpm update` 重解析 github 轨、改名三处同步 | [profile-dependency-management](https://github.co

| 4 提交推送 | 统一消息模板；逐仓 push；失败 rebase 后 `--force-with-lease` | 常见错误 2/3 | | 5 profile 收尾 | `pnpm update` 重解析 github 轨、改名三处同步 | [profile-dependency-management](https://github.com/oh-my-dsh/dsh-plugin-upgrade-skill/blob/main/skills/plugin-relea

| 5 profile 收尾 | `pnpm update` 重解析 github 轨、改名三处同步 | [profile-dependency-management](https://github.com/oh-my-dsh/dsh-plugin-upgrade-skill/blob/main/skills/plugin-release/references/profile-dependency-management.md) |

alpha 系不在 npm 上，公开仓库的 devDependencies 保持 npm 发布线（当时为 `^0.1.1-rc.2`），peer 用 宽范围（`<0.2.0`）覆盖未发布 cohort；代码对签名漂移的 API 用双兼容写法（例见 [publish-playbook](https://github.com/oh-my-dsh/dsh-plugin-upgrade-skill/blob/main/skills/plugin-release/references/

宽范围（`<0.2.0`）覆盖未发布 cohort；代码对签名漂移的 API 用双兼容写法（例见 [publish-playbook](https://github.com/oh-my-dsh/dsh-plugin-upgrade-skill/blob/main/skills/plugin-release/references/publish-playbook.md) 的 `rpc.handle` 案例），保证 任意机器 `npm install` 后 typecheck 可

[publish-playbook](https://github.com/oh-my-dsh/dsh-plugin-upgrade-skill/blob/main/skills/plugin-release/references/publish-playbook.md) 的 `rpc.handle` 案例），保证

按 [profile-dependency-management](https://github.com/oh-my-dsh/dsh-plugin-upgrade-skill/blob/main/skills/plugin-release/references/profile-dependency-management.md)：

[alpha.2](../references/v0.1.2-alpha.2.md) 与 [rollup](../references/rollup-0.1.2.md)； - 工具链坑：[migration-hygiene](../references/migration-hygiene.md)（本文不重复）； - 发布/分发面：[publish-playbook](https://github.com/oh-my-dsh/dsh-plugin-upgrade-skill/b

- 工具链坑：[migration-hygiene](../references/migration-hygiene.md)（本文不重复）； - 发布/分发面：[publish-playbook](https://github.com/oh-my-dsh/dsh-plugin-upgrade-skill/blob/main/skills/plugin-release/references/publish-playbook.md) 与   [profile-dependency

- 发布/分发面：[publish-playbook](https://github.com/oh-my-dsh/dsh-plugin-upgrade-skill/blob/main/skills/plugin-release/references/publish-playbook.md) 与

[profile-dependency-management](https://github.com/oh-my-dsh/dsh-plugin-upgrade-skill/blob/main/skills/plugin-release/references/profile-dependency-management.md)。

Executable file

Executable file

Executable file

Executable file

Executable file

Executable file

response.end('legacy')     })     server.listen(43121, '127.0.0.1') // http://localhost:43121/api/legacy

})     server.listen(43121, '127.0.0.1') // http://localhost:43121/api/legacy     return server

server.listen(43121, '127.0.0.1') // http://localhost:43121/api/legacy

- **Source**:   [alpha.2 SessionController actual Remote methods](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.2/packages/api/session-controller/src/index.ts) ·

[alpha.2 SessionController actual Remote methods](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.2/packages/api/session-controller/src/index.ts) ·

[alpha.2 API Remotes Client assembly](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.2/packages/api/remotes/src/client/index.ts) ·

[alpha.2 Workspace Remote owner](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.2/packages/api/workspace-controller/src/index.ts) ·

[alpha.2 actual rename consumer](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.2/packages/api/session-controller/src/client/sessions/session.ts) ·

- **Source**:   [alpha.1 existing `RemoteResult<T>` definition](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.1/packages/typert/protocol/src/types.ts) ·

[alpha.1 existing `RemoteResult<T>` definition](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.1/packages/typert/protocol/src/types.ts) ·

[alpha.2 RemoteError vocabulary decision](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.2/.agents/notes/implemented/architecture/2026-08-28-ctx-remote-failure-vocabulary.md) ·

[alpha.2 `RemoteError` implementation](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.2/packages/typert/protocol/src/remote-error.ts)

- **Source**:   [alpha.1 Settings entry point](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.1/packages/settings/settings/src/index.ts) ·

[alpha.1 Settings entry point](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.1/packages/settings/settings/src/index.ts) ·

[alpha.2 Settings entry point](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.2/packages/settings/settings/src/index.ts) ·

[alpha.2 official Settings README](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.2/packages/settings/settings/README.md)

- **Source**:   [alpha.2 Gateway Client `$host` implementation](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.2/packages/api/gateway/src/client/index.ts) ·

[alpha.2 Gateway Client `$host` implementation](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.2/packages/api/gateway/src/client/index.ts) ·

[Fixed Host facts in the Remote failure vocabulary note](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.2/.agents/notes/implemented/architecture/2026-08-28-ctx-remote-failure-vocabulary.md)

- **Source**:   [alpha.2 `SessionEvent` type](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.2/packages/core/session/src/types.ts) ·

[alpha.2 `SessionEvent` type](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.2/packages/core/session/src/types.ts) ·

[alpha.2 `Session.append()` implementation](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.2/packages/core/session/src/index.ts) ·

[cold-load unknown event guard](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.2/packages/session/session-persistence/src/coordinator.ts) ·

[implementation decision restoring ignorable](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.2/.agents/notes/implemented/architecture/2026-08-30-retain-ignorable-external-session-events.md)

- **Source**:   [alpha.2 Headless README](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.2/packages/bundle/headless/README.md) ·

[alpha.2 Headless README](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.2/packages/bundle/headless/README.md) ·

[rc.2 Headless README](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.1-rc.2/packages/bundle/headless/README.md)

- **Source**:   [alpha.2 ui-conversation package manifest](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.2/packages/client/ui-conversation/package.json)

[alpha.2 ui-conversation package manifest](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.2/packages/client/ui-conversation/package.json)

- **Source**:   [cordis.patch.yml placement in the alpha.2 Headless bundle](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.2/packages/bundle/headless/README.md) ·

[cordis.patch.yml placement in the alpha.2 Headless bundle](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.2/packages/bundle/headless/README.md) ·

[official plugin publishing and patch composition docs](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.2/docs/user/develop/basic/publish.md) ·

[alpha.2 CLI Profile/Bundle layer reference](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.2/apps/cli/reference/README.md)

- **Source**:   [alpha.2 PluginInventorySnapshot type](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.2/packages/host/plugin-inventory/src/types.ts)

[alpha.2 PluginInventorySnapshot type](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.2/packages/host/plugin-inventory/src/types.ts)

**Source**: [rc.2 runtime aggregation exports](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.1-rc.2/packages/client/runtime/src/client/index.ts) · [alpha.2 ChatSnapshot / ChatNodeStore](https://github.com/deepseek-ai/deepsee

- **Verification**: the target configuration accepts the new values; old Session logs still load; every remaining legacy token is explainable as an explicit keep, with no blind global replace. - **Source**:   [alpha.1 PTC rename ledger](htt

[alpha.1 PTC rename ledger](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.1/.agents/notes/implemented/architecture/2026-08-25-rename-code-mode-to-ptc.md)

Builds on [rollup R-02](rollup-0.1.2.md). Host-plane plugins (the TUI kind) do not change artifacts; instead they push the cohort difference into `!!js` probes at the composition layer. Three forms, taken from the real patch in [dsh-TUI #62

"node:child_process|spawn\\(|exec(File)?Sync\\(|execa|Bun\\.spawn",

The first six classes follow the classification of the [dsh-community-standard migration guide](https://github.com/oh-my-dsh/dsh-community-standard/blob/main/guides/migration.md);

rg -n "node:child_process|spawn\(|exec(File)?Sync\(|execa|Bun\.spawn" .

Sources: [alpha.2 renderer declarations and apply](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.2/packages/client/ui-renderer/src/client/index.ts),

[alpha.2 module graph contract](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.2/packages/client/modules/src/client/manifest.ts),

[TypeScript type-only import semantics](https://www.typescriptlang.org/docs/handbook/release-notes/typescript-3-8.html#type-only-imports-and-export).

Sources: [alpha.2 Connection route using the gate](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.2/packages/client/connection/src/index.ts), [alpha.2 requestRejection, Fetch and RPC registries](https://github.com/dee

[alpha.2 requestRejection, Fetch and RPC registries](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.2/packages/client/connection/src/rpc-host.ts).

> Status: based on `dsh-v0.1.2-rc.1` (first release candidate of the 0.1.2 series). The 0.1.2 final release is not out yet — measured on npm dist-tags on 2026-09-04, `next` = `0.1.2-rc.1`, `alpha` = `0.1.2-alpha.5`, and the umbrella `@deeps

Source: [DSH-0.1.2-A2-02](v0.1.2-alpha.2.md) and [ctx-remote-failure-vocabulary](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.2/.agents/notes/implemented/architecture/2026-08-28-ctx-remote-failure-vocabulary.md).

[ctx-remote-failure-vocabulary](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.2/.agents/notes/implemented/architecture/2026-08-28-ctx-remote-failure-vocabulary.md).

The following problems span single versions or fall outside the cards; they come from community practice ([discussion #5120](https://github.com/deepseek-ai/deepseek-harness/discussions/5120), the dsh-web migration of about 20 packages) and 

git clone https://github.com/deepseek-ai/deepseek-harness.git /tmp/dsh-build

- **Note (pending confirmation)**: the pnpm version pin below comes from a single field report and has not been reproduced in other repositories — the report says `11.9.0` bypasses overrides for file: tarball transitive dependencies when th

- **npm reality** (2026-08-31): on npm, the `@deepseek-ai/dsh-*` packages only have `0.1.1-rc.1`, `0.1.1-rc.2`, and `0.1.2-alpha.2`; alpha.1 was never published. rc.2 → alpha.1 can only be built from a GitHub tag; for the alpha.2 target, qu

- **Verify-only, no install** ([dsh-TUI #622](https://github.com/ccch1mneyyy/dsh-TUI/pull/622)): keep the install baseline at rc.2; CI checks out the upstream tag and runs `tsc --noEmit` with the `paths` mapping from its `tsconfig.base.json

- **Source**: item 1 of [#5120](https://github.com/deepseek-ai/deepseek-harness/discussions/5120). Not covered by the official release notes; community practice.

- **Host-plane (Cordis composition) equivalent**: keep the artifact unchanged and put the cohort differences into `!!js` probes in `cordis.patch.yml` — the three forms (subpath resolve, reading preset files, probing package directories) and

- **Rejected alternatives**: per-consumer try/catch duplicated through the source; emitting different artifacts per host cohort (reintroduces stateful builds); hard-waiting on inject wait (old hosts pending forever). - **Verification**: lin

- **Source**: items 3 and 4 of [#5120](https://github.com/deepseek-ai/deepseek-harness/discussions/5120).

- **Migration recipe**: keep `pnpm patch` (`patchedDependencies`) in the repository and rewrite that one require as the same dual-cohort probe. Don't forget the profile's parent-layer link — the link script may point the link back at the un

- **Source**: item 7 of [#5120](https://github.com/deepseek-ai/deepseek-harness/discussions/5120).

- CI mount lanes pin a dsh CLI version matching the target cohort, and write `minimumReleaseAgeExclude` when bootstrapping scratch profiles (see R-08), so CI on the first day after an alpha release does not fail by refusing to install fresh

- **Source**: items 8 and 9 of [#5120](https://github.com/deepseek-ai/deepseek-harness/discussions/5120).

- **List of removed packages** (compared by the `name` in each tag's `packages/*/*/package.json`, 2026-08-31): rc.2 → alpha.1 removes 5 — `@deepseek-ai/dsh-acp-demo`, `dsh-acp-snapshot`, `dsh-client-runtime`, `dsh-host-apiproxy`, `dsh-sdk-j

- **Source**: item 10 of [#5120](https://github.com/deepseek-ai/deepseek-harness/discussions/5120).

- **Source**: the pre-migration baseline stage of the dsh-migrate-bot unattended pipeline (a local extension on top of mechanical pin →   A/B review → fix loop → patch report, dedicated to failure attribution; that stage had not been pushed

A/B review → fix loop → patch report, dedicated to failure attribution; that stage had not been pushed publicly at the time of writing — re-check this   description once it is public; see "Pending confirmation" at the end of this file). [#5

description once it is public; see "Pending confirmation" at the end of this file). [#5120](https://github.com/deepseek-ai/deepseek-harness/discussions/5120)

(entry permanently `pending` on old cohorts, see R-02). - **Verification**: no `service-unavailable` loop in the cold-boot logs; the injected retry policy takes effect in tests. - **Source**: [#5120](https://github.com/deepseek-ai/deepseek-

- **Verification**: no `service-unavailable` loop in the cold-boot logs; the injected retry policy takes effect in tests. - **Source**: [#5120](https://github.com/deepseek-ai/deepseek-harness/discussions/5120)   item 6 (dsh-web migration re

- **Source**: [#5120](https://github.com/deepseek-ai/deepseek-harness/discussions/5120)

3. when the peer floor is written as an old range like `^0.1.0-rc.8`, npm semver's prerelease matching rules (the comparator must share the same tuple and carry a prerelease) judge it **not to match** `0.1.2-alpha.2` — install-time peer war

- **Migration recipe**:   - Mirror lag: both CLI installs and pnpm inside profiles explicitly use the official registry via `export npm_config_registry=https://registry.npmjs.org`;   - Supply-chain rules: prefer **per-scope exemption** over

- Mirror lag: both CLI installs and pnpm inside profiles explicitly use the official registry via `export npm_config_registry=https://registry.npmjs.org`;

- Peer floor: when bumping cohorts, explicitly rewrite it to `^0.1.2-alpha.2` (after the rewrite, the install-time `Issues with peer dependencies` warning disappears and can serve as the landed signal). - **Verification**: `pnpm list --dept

- **Source**: measured (2026-08-30, dsh-better-sidebar [PR #472](https://github.com/omdsh-dev/DSH-better-sidebar/pull/472): mirror E404, CI dependency exemption working on the day of the alpha release, warnings gone after the peer-floor rew

- When a test/controlled surface wants its own same-named preset, add `includeShippedRoot: false` to the agent-presets configuration; otherwise the same-named row in the custom root is shadowed by the shipped row. - **Verification**: a base

- **Source**: [alpha.2 discovery.ts health check](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.2/packages/preset/agent-presets/src/discovery.ts) · [the alpha.2 standard preset's tool-subagent row](https://github.com

- **Verification**: typecheck all green without relying on `@ts-ignore`; locally merged declarations match the official structures field by field; the runtime event flow is the same as rc.2. - **Source**: comparison of each package's `0.1.2

- **Source**: comparison of each package's `0.1.2-alpha.2` tarball exports + [alpha.2 todo tool types.ts](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.2/packages/todo/tool-todo/src/types.ts) · [alpha.2 `dsh-util-val

- **Source**:    The background of the community upgrade discussion in [DeepSeek Harness Discussion #5120](https://github.com/deepseek-ai/deepseek-harness/discussions/5120), plus observations from earlier plugin development and upgrades don

The background of the community upgrade discussion in [DeepSeek Harness Discussion #5120](https://github.com/deepseek-ai/deepseek-harness/discussions/5120), plus observations from earlier plugin development and upgrades done inside DSH itse

4. UI plugins that provide localized resources should register through the host's public language seat instead of a self-built i18n patch — see [DSH-0.1.2-A1-10](v0.1.2-alpha.1.md). - **Verification**: switch to a non-English language and h

- **Source**: [client-locale-full-rollout note](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.2/.agents/notes/implemented/architecture/2026-07-30-client-locale-full-rollout.md) · [alpha.2 `HeaderAction.tsx` (`t('head

2. **Static**: typecheck + build. Note that all-green static checks cannot prove the wire contract — parameter drift at the descriptor layer is silent at this layer ([DSH-0.1.2-A1-01](v0.1.2-alpha.1.md)). 3. **Card-level unit tests**: at le

3. **Card-level unit tests**: at least one assertion per hit touchpoint. Remote call sites cover the known business codes on `ok: false`, the unknown-code fallback, and the gateway-layer catch branch; test doubles encode the same descriptor

4. **Real cold boot**: one full conversation round (send message → tool call → reply). Observe the logs for no `missed the module table`, no `service-unavailable` loop, and no entry `pending`. Web Client plugins additionally follow [DSH-0.1

| 客户端 UI 已出现新功能，但新增的宿主路由对新扩展名返回 404（同路由旧类型 200），且磁盘上的宿主半产物已包含新白名单 | 更新平面不对称：client bundle 每次刷新重新拉取（no-cache），而宿主半在 apply 时一次性注册路由（闭包持有旧白名单），运行中的进程要等**宿主重启**才换新。归因探针：旧类型 200 + 新类型 404 + 磁盘产物含新白名单 ⇒ 运行进程早于改动。「插件热更新」只覆盖 client 面 | benchmark 任务

| 渲染基于会话 payload 的文件出现裂图，但源文件本身完好（XML/语法校验通过），重读后 payload 又是干净的 | 会话日志里的 read 结果文本可能被上游组装环节损坏（真实案例：源 232 行被 247 行尾部在公共前缀 "stro" 处错位拼接，中间 15 行丢失）。插件必须把会话 payload 当**不可信渲染输入**：先 DOMParser/语法校验再渲染；优先走宿主 asset 路由读磁盘原始字节；损坏要上报上游，而不是在插件里「修文件」 | b

| 重启后宿主启动即崩：`duplicate loader entry id: <id>`（`dsh-app-boot` → `cordis-plugin-loader` → `EntryGroup.update`） | 在 profile 的 `cordis.patch.yml` 里手动 `insert` 了一个 bundle 层已提供的插件 id——Cordis 把重复 insert 视为致命错误（非静默覆盖）。0.1.5 系列新增的 `workspace-files` 

- **Source**: real migration of dsh-input-history 0.1.1 → 0.2.0 (2026-08); rows cite their sources individually — the session-payload corruption row comes from [discussion #5120](https://github.com/deepseek-ai/deepseek-harness/discussions/5

- keep the runtime entry (`main`/`exports["."]`) and `dsh.client` declaration intact; update any manager UI/CLI that enumerated repository sources. - **Verification**: cold-boot a profile containing the converted package; the boot graph sho

- **Verification**: cold-boot a profile containing the converted package; the boot graph shows the plugin row; for a Web Client plugin verify the client half enters `__DSH_BOOT__` and its advertised bundle URL returns 200; no `pending (wait

- **Source**: [repository loader removal commit](https://github.com/deepseek-ai/deepseek-harness/commit/993550e6c851e1ae05aa7d587d10ae1626ae1191) · [plugin-registry 0811 console adaptation](https://github.com/vlln/plugin-registry/commit/bfa

- **Field note** (2026-08-12, whale-girl, bundle conversion): moving from the repository-plugin layout (`.dsh-plugin/` with self-executing UI entry injected via `httpServer.tapIndex`) to the standard bundle format (`dsh.bundle` + `cordis.pa

- **Migration recipe**: rename the field to `dsh.client` with the same value shape (platform `web` and the client entry path); check the bundled declaration after packing, not only the source `package.json`; remove any legacy `dsh.plugin.js

- **Verification**: pack the plugin and confirm the packed manifest carries `dsh.client`; after install, the profile's bundle layer or insert row resolves and the client route serves the expected artifact. - **Source**: [dsh-loop 0810 basel

- **Source**: [dsh-loop 0810 baseline migration](https://github.com/vlln/dsh-loop/commit/5b48a4595b1a739631c8a869a432d4571de344b9) · [dsh-task-status 0810 baseline migration](https://github.com/vlln/dsh-task-status/commit/16f6324b0ffb0fdf0f

- **Migration recipe**: declare `dsh.client` (`platform: web` + client entry) in `package.json` even when the client bundle is built into the bundle; verify the packed manifest, not just the source. - **Verification**: install the plugin, r

- **Source**: [dsh-navbar 3e81acd — declare `dsh.client` because client-modules scans it](https://github.com/vlln/dsh-navbar/commit/3e81acdedac111150436a9790ff7b4a4be302e7c) · related scan contract [DSH-0.1.2-A1-26](v0.1.2-alpha.1.md)

- **Migration recipe**: declare every service consumed via `ctx.get(...)`/property access in the plugin's `inject` array; when a service is genuinely optional across profiles, probe it weakly (see [DSH-0.1.1-R1-05](v0.1.1-rc.1.md)) instead 

- **Verification**: cold-boot the target profile and confirm the plugin's effect is registered and the feature works; the error appears at startup only on the real composition, so install/typecheck success is not sufficient evidence. - **So

- **Source**: [whale-girl 0f9e3b5 — inject gets `settings`/`httpServer`](https://github.com/vlln/whale-girl/commit/0f9e3b53cf31f1ce9a9f2e232156618d18a1b8b1)

- **Migration recipe**: use `typeof ctx.get === 'function' ? ctx.get('httpServer') : undefined` for optional services and degrade gracefully; reserve hard `inject` entries for services that are guaranteed by the plugin's profile scope. - **

- **Source**: [whale-girl 8678b13 — weak `ctx.get` for httpServer](https://github.com/vlln/whale-girl/commit/8678b139eaad82decf5b29529c6b91e475851cf5)

- **Migration recipe**: read `event.type` for the event discriminator; keep the `session/event` subscription registered even when the `sessions` service is temporarily absent (subscribe once, degrade per event, not by dropping the subscript

- **Source**: [whale-girl 78a6b70 — session event response fixes](https://github.com/vlln/whale-girl/commit/78a6b703aab16b92cf065d8e7138010e58a02b67) · companion test file in the same commit

- **Migration recipe**: move session aggregation into the Node half: subscribe to session events there, derive the session mood / waiting / completion signal, and expose it through the plugin's own `/state` route (or equivalent) that the cl

- **Verification**: cold-boot the plugin and exercise a session action; the client shows the aggregated state (e.g. thinking/waiting animation) within one poll cycle; no client-side `ctx.sessions` references remain. - **Source**: [whale-gir

- **Source**: [whale-girl d01bccb — session state aggregated by Node half](https://github.com/vlln/whale-girl/commit/d01bccb677fc076e8e90b17a0975a9fb70e220fc)

- **Migration recipe**: read consumed output with `tasks.read`, maintain a per-task shadow buffer with a capped window, and render from the shadow; if multiple consumers must share the stream, layer a tee/observer pattern on `read` so the p

- **Verification**: expand a running task in the UI and confirm tail keeps updating without duplicating or losing lines; run two readers simultaneously and confirm neither starves; cold-boot with no `peek` references. - **Source**: [dsh-tas

- **Source**: [dsh-task-status 29dda2f — tail via `read` + shadow buffer](https://github.com/vlln/dsh-task-status/commit/29dda2f6bec4242700d61e6efdd3b926f084e8c5)

- **Field note** (2026-08-10, dsh-task-status): two follow-up commits hardened the same seam — [ba1d526](https://github.com/vlln/dsh-task-status/commit/ba1d52670495e13c10858b3a2e9e747eb7dd909e) (mirror + direct-read to defeat races, "tail 竞

- **Migration recipe**: rename the injected service identifiers and all `ctx` usages (`httpServer`→`webServer`, `tasks`→`jobs`); rename task-event listeners (`onTaskDone`→`onJobDone`); the route-registration interface (`webServer.register`)

- **Verification**: cold-boot and confirm injection resolves with no `pending (waiting for service: …)`; hit a registered route and exercise one task event end-to-end; grep the packed artifact (not just source) for leftover old identifiers.

- **Source**: [whale-girl 183354b](https://github.com/vlln/whale-girl/commit/183354b9c12272014ec534114622db6a11dfa59e) · [dsh-loop c5bf083](https://github.com/vlln/dsh-loop/commit/c5bf0832af381763697b388826b43da878186821) · [dsh-task-status

- **Migration recipe**: For image refs and `read_image` results, "read known fields, retain unknown optional fields"; if the plugin's own schema uses `additionalProperties: false`, add optional fields for `originalDimensions.width` and `ori

- **Source**: rc.1 type baseline [`types.ts`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.1-rc.1/packages/attachment/attachment/src/types.ts); rc.2 type definitions [`types.ts`](https://github.com/deepseek-ai/deepseek-harn

- **Migration recipe**: Do not do fragile matching on the full `<content>` string; read the structured `path`, `image`, and dimension fields. If snapshots must be kept, cover the "unscaled" and "scaled" outcomes separately, and treat the co

- **Source**: rc.1 implementation [`read-image.ts`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.1-rc.1/packages/fs/tool-fs/src/read-image.ts); rc.2 implementation [`read-image.ts`](https://github.com/deepseek-ai/deepseek-h

- **Migration recipe**: Separate image identity from the provider file ID; use `attachmentId`/request version as the local cache key and treat Files API upload results as temporary mappings that can expire or go stale. Request observation s

- **Source**: rc.2 adapter [`adapter.ts`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.1-rc.2/packages/llm/llm-deepseek/src/adapter.ts); Files API contract [`files-api.ts`](https://github.com/deepseek-ai/deepseek-harness/bl

> actual runtime paths. > > Upstream compare: [dsh-v0.1.1-rc.2...dsh-v0.1.2-alpha.1](https://github.com/deepseek-ai/deepseek-harness/compare/dsh-v0.1.1-rc.2...dsh-v0.1.2-alpha.1)

> > Upstream compare: [dsh-v0.1.1-rc.2...dsh-v0.1.2-alpha.1](https://github.com/deepseek-ai/deepseek-harness/compare/dsh-v0.1.1-rc.2...dsh-v0.1.2-alpha.1) > · Release Notes: [dsh-v0.1.2-alpha.1](https://github.com/deepseek-ai/deepseek-harne

> Upstream compare: [dsh-v0.1.1-rc.2...dsh-v0.1.2-alpha.1](https://github.com/deepseek-ai/deepseek-harness/compare/dsh-v0.1.1-rc.2...dsh-v0.1.2-alpha.1)

> · Release Notes: [dsh-v0.1.2-alpha.1](https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.1.2-alpha.1)

Only the client plane (browser plugins) follows this table's `ctx.remote.*`, and the plugin must declare   `dsh.client` in package.json to enter the browser plugin roster.   The full process is in the repo's [benchmark/validation-report-202

`dsh.client` in package.json to enter the browser plugin roster.   The full process is in the repo's [benchmark/validation-report-2026-08-30.md](https://github.com/oh-my-dsh/dsh-plugin-upgrade-skill/blob/main/benchmark/results/validation-re

The full process is in the repo's [benchmark/validation-report-2026-08-30.md](https://github.com/oh-my-dsh/dsh-plugin-upgrade-skill/blob/main/benchmark/results/validation-report-2026-08-30.md).

- **Field note** (2026-08-30, dsh-better-sidebar e2e, npm 0.1.2-alpha.2 on a real machine): Test harnesses / liveness scripts that hit `/api` directly must also migrate the **wire contract**: dotted endpoints now 404 — always use the slash 

- **Source**: [APIProxy→Remote architecture note (alpha.1)](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.1/.agents/notes/implemented/architecture/2026-08-10-unary-apiproxy-remote-migration.md) · [alpha.1 session-con

- **Migration recipe**: If the target is exactly alpha.1, do not turn unknown persisted events into a consumer whitelist — that would wrongly let required events through. Temporarily stop writing that unknown persisted event, or switch to p

- **Source**: [alpha.2 restore decision explaining the alpha.1 removal](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.2/.agents/notes/implemented/architecture/2026-08-30-retain-ignorable-external-session-events.md)

- **Migration recipe**: Check the host paths one by one against an exact-tag compare; rebuild imports by owning module. Mark capabilities that have no stable public seam as "pending confirmation"; do not guess new paths. Ordinary plugins sh

- **Verification**: Run a patch-surface composition against the target tag source; every old target must map to a target-version file or state an explicit removal reason. - **Source**: [alpha.1 release notes, "Other changes"](https://github

- **Source**: [alpha.1 release notes, "Other changes"](https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.1.2-alpha.1)

- **Field note**: dsh-tui points `DSH_HARNESS_SOURCE_ROOT` at the target tag and validates each patch-surface path by composition. - **Field note** (2026-08-28, [dsh-ui-whale v0.3.5](https://github.com/lhh010/dsh-ui-whale) / dsh-ui-progress

- **Field note** (2026-08-28, [dsh-ui-whale v0.3.5](https://github.com/lhh010/dsh-ui-whale) / dsh-ui-progress v0.9.4 / dsh-input-history v0.1.4, Windows, npm link install): The public snapshot consumption surface is affected too — the old f

- **Verification**: Cold-boot the new profile and upgrade-boot the old profile once each; check cwd, environment variables, plugin mounts, and resolved config. - **Field note** (2026-08-30, alpha.2 container test): `dsh --help` confirms pro

[Credential-related source omitted]

- **Source**: [alpha.1 release notes, "Other changes"](https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.1.2-alpha.1)

- **Verification**: Cover plain-text success, reasoning present, empty final text, direct launch failure, and non-zero exit; confirm sensitive reasoning goes to a controlled stderr sink. - **Field note** (2026-08-30, alpha.2 container test)

- **Source**: [alpha.1 headless README](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.1/packages/bundle/headless/README.md) · [rc.2 headless src (stdout already the final text)](https://github.com/deepseek-ai/deepsee

`tools-code-mode`, and the `:code:` inside sub-call ids. - **Verification**: New configs/presets boot; old session logs still load; preserved identifiers were not wrongly changed. - **Source**: [PTC rename ledger](https://github.com/deepsee

- **Source**: [PTC rename ledger](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.1/.agents/notes/implemented/architecture/2026-08-25-rename-code-mode-to-ptc.md)

- **Migration recipe**: Deployments that need a confirmation step should add a `tools/pre-execute` policy or disable `web_fetch`, and test public/private network events against the target version; the file sandbox does not govern web networ

- **Source**: [alpha.1 Web subsystem, "Fetch network policy"](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.1/docs/subsystems/web.md) · [alpha.1 release notes](https://github.com/deepseek-ai/deepseek-harness/releases

[Credential-related source omitted]

- **Verification**: Wrong Host/Origin returns 403; missing/bad Cookie returns 401; a correct bootstrap token can redeem a Cookie repeatedly within the same process; a valid Cookie can call the official `/api`/WS; custom routes must not be c

[Credential-related source omitted]

- **Field note** (2026-08-31, external Node raw client, macOS/Node 22.22, host running a 0.1.2-alpha.2 source checkout): Three additions for the raw-client lane. ① The cookie outlives the host process: the launch token rotates per process a

- **Field note** (2026-08-28, dsh-mnemon rc.2/alpha.1 dual cohort): Migrating custom RPC registrations to alpha.1's two-argument `handle` shape passed alpha-side mocks but regressed the still-installable rc.2 Host, whose real service reads 

- **Source**: [alpha.1 browser auth](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.1/packages/client/connection/src/browser-auth.ts) · [alpha.1 Connection routes](https://github.com/deepseek-ai/deepseek-harness/blob/

- **Migration recipe**: Before adopting, confirm the registration entry from the target tag's public types/examples; if only an internal UI interface exists, mark it "pending confirmation" and do not patch the settings page. - **Verificatio

- **Source**: [alpha.1 release notes, "New features"](https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.1.2-alpha.1)

- **Migration recipe**: Replace custom i18n patches with the target tag's public language-registration API; when no public entry exists, do not guess the interface. - **Verification**: The language is selectable, takes effect after switchin

- **Source**: [alpha.1 release notes, "New features"](https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.1.2-alpha.1)

- **Migration recipe**: Confirm the exact parameter names and authorization constraints from the target tag's type definitions before passing them through; do not invent object shapes from release notes. - **Verification**: Launch a subagen

- **Source**: [alpha.1 release notes, "New features"](https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.1.2-alpha.1)

- **Migration recipe**: Plugin code usually needs no changes; deployment maintainers should review the target tag's configuration options, decide whether to disable this per their own privacy policy, and explain the host behavior to users a

- **Source**: [alpha.1 release notes, "New features"](https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.1.2-alpha.1)

- **Migration recipe**: Only after reproducing and confirming the fix on the corresponding platform, delete workarounds one by one that evidence shows are no longer needed; do not clean up all compatibility branches at once. - **Verificatio

- **Source**: [alpha.1 release notes, "Bug fixes"](https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.1.2-alpha.1)

- **Migration recipe**: Enable only after the deployment explicitly agrees to log egress. Each time, send the continuous suffix starting after this session's accepted watermark; after an HTTP 2xx, append the `session-log-deepseek/delivery-a

- **Source**: [alpha.1 session-log-deepseek README](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.1/packages/session/session-log-deepseek/README.md) · [alpha.1 release notes](https://github.com/deepseek-ai/deepseek-h

- **Migration recipe**: On an isolated profile, start `dsh web --no-open` at the exact target tag, keep and visit the full URL printed by `dsh web:`, and let the root-path token exchange yield the Cookie. Then read `window.__DSH_BOOT__.entr

- **Verification**: The advertised resource returns 200; the bundle completes `__ModuleLoader__.load` registration under the target package name; wait for a DOM marker owned by the plugin or equivalent core behavior; collect and fail on pag

- **Source**: [alpha.1 Web App startup URL](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.1/packages/bundle/web-app/README.md) · [alpha.1 client modules boot manifest and bundle URLs](https://github.com/deepseek-ai/d

`dsh-v0.1.1-rc.2` and `dsh-v0.1.2-alpha.1` using the same published artifact; the scripts accept both bare and token   URLs and verify the boot entry, resource 200, plugin DOM mount, and page errors. See   [GenUI PR #86](https://github.com/

URLs and verify the boot entry, resource 200, plugin DOM mount, and page errors. See   [GenUI PR #86](https://github.com/omdsh-dev/dsh-genui/pull/86) and   [Annotation PR #40](https://github.com/omdsh-dev/dsh-annotation/pull/40).

[GenUI PR #86](https://github.com/omdsh-dev/dsh-genui/pull/86) and   [Annotation PR #40](https://github.com/omdsh-dev/dsh-annotation/pull/40). - **Field note** (2026-08-31, Node `fetch` e2e): Following the token URL's 303 by default does no

[Annotation PR #40](https://github.com/omdsh-dev/dsh-annotation/pull/40). - **Field note** (2026-08-31, Node `fetch` e2e): Following the token URL's 303 by default does not   store `Set-Cookie` for the test script, so the subsequent boot-ma

**The scope-filtering pitfall**: `ctx.userQuestions.ask()` without `agent` dispatches on the userQuestions service's own ctx. An answerer listener on that same Context can receive the request, but a listener registered by a sibling entry in

- **Verification**: On a real spine: `ask` hangs → the panel renders → a number-key selection resolves it; Esc cancels and rejects with `ASK_ABORTED`; after session switch/dispose, pending questions fail closed and the listener disposer is 

- **Source**: [rc.2 registerProvider definition](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.1-rc.2/packages/interaction/user-questions/src/index.ts) · [alpha.1 user-questions service (no registerProvider, waterfall dispat

- **Field note** (2026-08-28, [dsh-TUI #622](https://github.com/ccch1mneyyy/dsh-TUI/pull/622)): Probe with `typeof service.registerProvider === 'function'` to pick the path; waterfall listeners filter by `request.agent.id`, and requests wit

- **Migration recipe**: Fold it locally with the same semantics: take `data.agentPreset` from the last `agent-preset/selected` event in the session, falling back to `header.agentPreset` when there is none; do not reverse-engineer it from th

- **Verification**: A session with `agent-preset/selected` events resumes with the last selection; a session without events gets the header value; the roster lists `standard` on both the rc.2 and alpha.1 hosts. - **Source**: [rc.2 `resolveS

- **Source**: [rc.2 `resolveSessionPreset`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.1-rc.2/packages/preset/agent-presets/src/session.ts) · [alpha.1 agent-presets service (`includeShippedRoot`)](https://github.com/deeps

- **Field note** (2026-08-28, [dsh-TUI #622](https://github.com/ccch1mneyyy/dsh-TUI/pull/622)): `resolveRecordedPreset` in `preset-resolution.ts` does the folding; `cordis.patch.yml` probes whether the package directory has `presets/` via `

- **Migration recipe**: Narrow locally on the `StreamChunk` discriminator: `text-delta` / `reasoning-delta` non-empty counts as a token; `tool-call-delta` with `argumentsDelta` or `name` counts as a token. Do not import `dsh-client-ui-chat`

- **Verification**: On the same replay log, the first-token timestamp matches rc.2; tool-call deltas count as tokens. - **Source**: [rc.2 re-export from `dsh-llm/message`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.1-rc.2

- **Source**: [rc.2 re-export from `dsh-llm/message`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.1-rc.2/packages/client/runtime/src/client/sessions/assistant-timing.ts) · [alpha.1 only ui-chat's internal implementation re

- **Field note** (2026-08-28, [dsh-TUI #622](https://github.com/ccch1mneyyy/dsh-TUI/pull/622)): local `isTokenDelta(chunk: StreamChunk)` in `src/dsh-adapter/channel.ts`, regression-checked by `scripts/verify-tps.mjs`.

- **Migration recipe**: To keep rc.2's opt-out stance, override in your own `cordis.patch.yml`: `session-telemetry-otel` must restate the whole `config` object (an include patch replaces, it does not merge), with `mode` written as `process.

- **Verification**: In `dsh --profile <p> --dump-config`, the two rows' resolved config matches the expected values; send one real request to confirm no plugin package-manifest field is present (without printing credentials or bodies). - **

- **Source**: [rc.2 base composition (`DISABLED`)](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.1-rc.2/packages/bundle/base/cordis.patch.yml) · [alpha.1 base composition (`FEEDBACK_ONLY` + inventory row)](https://github.com

- **Field note** (2026-08-28, [dsh-TUI #622](https://github.com/ccch1mneyyy/dsh-TUI/pull/622)): two overrides in `cordis.patch.yml`; the telemetry row must restate the entire config.

- **Migration recipe**: Do not depend on pi-ai directly. Resolve from the host adapter: `createRequire(import.meta.resolve('@deepseek-ai/dsh-llm-pi-ai/package.json'))`, then `require.resolve('@earendil-works/pi-ai', { paths })` to get the d

- **Verification**: Install once on each of the rc.2 and alpha.1 hosts; `pnpm why @earendil-works/pi-ai` shows exactly one copy, coming from `dsh-llm-pi-ai`. - **Source**: [rc.2 `dsh-llm-pi-ai` package.json (`^0.82.1`)](https://github.com/d

- **Source**: [rc.2 `dsh-llm-pi-ai` package.json (`^0.82.1`)](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.1-rc.2/packages/llm/llm-pi-ai/package.json) · [alpha.1 `dsh-llm-pi-ai` package.json (`^0.84.2`)](https://github.com/

- **Field note** (2026-08-28, [dsh-TUI #622](https://github.com/ccch1mneyyy/dsh-TUI/pull/622)): dsh-auth's hard bump to `^0.84.2` plus an override installed two copies on rc.2; after switching to resolving from `dsh-llm-pi-ai`, each cohort 

- While the cohort is unpublished, point type dependencies at the official source checkout with `link:`, or use tarball `overrides` per [R-01](rollup-0.1.2.md). - **Verification**: typecheck shows no leftover `dsh-client-runtime` imports; `

- **Verification**: typecheck shows no leftover `dsh-client-runtime` imports; `dsh.client.inject` declares only real service packages; after a cold boot the boot graph contains this plugin with no pending rows. - **Source**: [alpha.1 releas

- **Source**: [alpha.1 release notes](https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.1.2-alpha.1) · [alpha.1's packages/client (no runtime package)](https://github.com/deepseek-ai/deepseek-harness/tree/dsh-v0.1.2-alpha.

3. `dsh --profile <name> --dump-config` to check row names and no pending. - **Verification**: The index page's HTML `window.__DSH_BOOT__.entries` contains `"id":"<package name>"`; the script fetched from the combo route `/plugins/??<packag

- **Verification**: The index page's HTML `window.__DSH_BOOT__.entries` contains `"id":"<package name>"`; the script fetched from the combo route `/plugins/??<package name>/client.js&rev=...` (the URL contains `??`; add `-g` for curl) conta

- **Source**: [modules/src/client/system.ts registration assertion](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.1/packages/client/modules/src/client/system.ts) · [modules/src/client/manifest.ts (`Entry name == pack

Import `SessionEventLikeEntry` and `SessionBinding` from `@deepseek-ai/dsh-api-session-controller/client`; scoped-addressing services still go through `binding.ctx.get(...)`; the input-machine face (`conversation.input.for(actx)` / `setDraf

- **Verification**: Send one user message in a real session and the plugin reads text consistent with the UI; empty sessions / unknown ids return null instead of throwing. - **Source**: [SessionBinding definition](https://github.com/deepsee

- **Source**: [SessionBinding definition](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.1/packages/api/session-controller/src/client/sessions/service.ts) · [SessionEventLikeEntry contract](https://github.com/deepseek

- Other selector-class drift (panel ids, slot names): the official `packages/client/ui-*` source is authoritative; verify the actual 0.1.2 page shape with browser devtools, not from 0.1.1 memory (same verification requirement as [DSH-0.1.2-

- **Verification**: On a 0.1.2 staging page, really perform one draft write + recall (including caret-position restore) with no DOM errors in the console; keep the textarea path only for cross-cohort coexistence ([R-02](rollup-0.1.2.md)). -

- **Source**: [ComposerContentEditable.tsx (new in alpha.1)](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.1/packages/client/ui-conversation/src/client/input/editor/ComposerContentEditable.tsx) · [alpha.1 release not

- **Migration recipe**: Build the nested object through a single shared helper at every render point (copy-button copy comes from the plugin's own locale dictionary; `footnotes` is an sr-only heading — pass an empty string when there is no 

- **Verification**: Render markdown containing a fenced code block on a real host; after switching locale the copy-button copy follows; no console errors; streaming messages are not re-rendered wholesale. - **Source**: [alpha.1 MarkdownText

- **Source**: [alpha.1 MarkdownText.tsx (labels required)](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.1/packages/client/ui-primitives/src/markdown/MarkdownText.tsx) · [alpha.1 render.tsx (MarkdownLabels shape)](ht

- **Field note** (2026-08-30, dsh-better-sidebar, macOS, real machine 0.1.2-alpha.1/alpha.2): The crash was caught by a mount smoke on a real alpha.1 host (devDeps pinned to 0.1.1-rc.1, typecheck all green); the fix routes all four render p

- **Migration recipe**: Branch by session origin first. For ordinary sessions, move history reads to `session/page|follow`. For subagent-origin sessions (side chat, delegated threads), transcript reads have **no usable host RPC** — supply t

- **Verification**: The live and cold (after host restart) paths return consistent transcripts; `afterSeq` deltas do not resurrect the seed; `session/list` shows subagent child sessions; with the route deliberately broken, the UI shows an e

- **Source**: [alpha.1 connection/client/api.ts (old face now only re-exports protocol types)](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.1/packages/client/connection/src/client/api.ts) · [alpha.1 APIProxy→Remote 

- **Field note** (2026-08-30, dsh-better-sidebar, macOS, npm 0.1.2-alpha.2 real machine): the side-chat transcript polling was missed in the migration and the errors were swallowed by catch, so on alpha.1+ hosts the tab rendered an empty tr

- **Migration recipe**: Follow the package-exported constant in assertions — `import { SUBAGENT_DESCRIPTOR_VERSION } from '@deepseek-ai/dsh-subagent'` — instead of hardcoding a literal; build seeds uniformly through `snapshotSubagentDescrip

- **Verification**: After upgrading devDependencies, the relevant unit tests pass; the seed event `subagent/descriptor` has `version === SUBAGENT_DESCRIPTOR_VERSION`. - **Source**: [alpha.1 descriptor.ts (= 3)](https://github.com/deepseek-a

- **Source**: [alpha.1 descriptor.ts (= 3)](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.1/packages/subagent/subagent/src/descriptor.ts) · [rc.2 descriptor.ts (= 2)](https://github.com/deepseek-ai/deepseek-harness/b

- **Verification**: `skipLibCheck: false` typecheck shows no leftover `connectWorkspace` / `pickDirectory` on `IWorkspaces`; a real web cold boot has no pending `uiWorkspace`; one connect and one directory-pick path succeed after both list 

- **Source**: [rc.2 aggregated `IWorkspaces`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.1-rc.2/packages/client/runtime/src/client/contract/workspaces.ts) · [alpha.1 Workspace Controller `IWorkspaces` (no navigation)](htt

- **Field note** (2026-08-28, [dsh-desktop-safe-market](https://github.com/bruc3van/dsh-desktop-safe-market) 0.2.16 → 0.3.0, Web Client): a marketplace plugin that called `workspaces.connectWorkspace` / `pickDirectory` and gated on `baselin

> This file is a curated list of plugin-relevant changes, not a complete API diff. > > Upstream comparison: [dsh-v0.1.2-alpha.1...dsh-v0.1.2-alpha.2](https://github.com/deepseek-ai/deepseek-harness/compare/dsh-v0.1.2-alpha.1...dsh-v0.1.2-al

> > Upstream comparison: [dsh-v0.1.2-alpha.1...dsh-v0.1.2-alpha.2](https://github.com/deepseek-ai/deepseek-harness/compare/dsh-v0.1.2-alpha.1...dsh-v0.1.2-alpha.2) > · Release Notes: [dsh-v0.1.2-alpha.2](https://github.com/deepseek-ai/deeps

> Upstream comparison: [dsh-v0.1.2-alpha.1...dsh-v0.1.2-alpha.2](https://github.com/deepseek-ai/deepseek-harness/compare/dsh-v0.1.2-alpha.1...dsh-v0.1.2-alpha.2)

> · Release Notes: [dsh-v0.1.2-alpha.2](https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.1.2-alpha.2)

- **Migration recipe**: Producers should write `ignorable: true` only for informational events whose semantics an old reader can omit without affecting reconstruction; the marker is not a consumer-side filtering directive, and events remain

- **Source**: [alpha.2 release notes](https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.1.2-alpha.2) · [retain ignorable external session events decision](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alp

Remote calls do not reject on ordinary business/carrier failures; assembly faults should surface rather than be swallowed by a defensive catch. Use `isRemoteFailure` (from `@deepseek-ai/dsh-api-gateway/client`) for structural discrimination

- **Source**: [RemoteError failure vocabulary](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.2/.agents/notes/implemented/architecture/2026-08-28-ctx-remote-failure-vocabulary.md) · [adding a Remote API](https://githu

- **Migration recipe**: Also look at the opposite direction: alpha.2 adds peers as well (`dsh-session-projection` and others), see [DSH-0.1.2-A2-08](v0.1.2-alpha.2.md). First choose the single package manager the repository currently uses, 

- **Verification**: Installation and typecheck succeed; no new peer/missing-package errors related to the target upgrade; the dependency graph and packed artifacts change only as expected. - **Source**: [alpha.2 release notes, "Bug fixes"](

- **Source**: [alpha.2 release notes, "Bug fixes"](https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.1.2-alpha.2)

- **Migration recipe**: Remove only branches with evidence of specifically bypassing this defect (forcing Node 22, skipping `dsh web`, probing the loader by major version); keep other Node compatibility constraints. The verification matrix 

- **Source**: [alpha.2 release notes, "Bug fixes"](https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.1.2-alpha.2) · [alpha.2 vendor/README item 19](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.2/ve

- **Migration recipe**: Parse `agentPresets` as an optional field, keeping the old entries view when it is absent; do not rebuild the whole object in a way that drops future fields. When presets need to be displayed, render from trust, rows

- **Source**: [alpha.2 PluginInventorySnapshot types](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.2/packages/host/plugin-inventory/src/types.ts) · [alpha.2 release notes](https://github.com/deepseek-ai/deepseek-har

- **Migration recipe**: In alpha.2, read `ctx.remote.$host.home` (may be `undefined` before the first ready frame) and `ctx.remote.$host.isLoopback`. `$host` is not a store — it has no subscriptions or generation counter; to react to reconn

- **Source**: [alpha.2 API gateway README](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.2/packages/api/gateway/README.md) · [alpha.2 APIProxy→Remote note](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.

- **Migration recipe**: Users of the shipped bundle are unaffected: `dsh-base` alpha.2 already mounts `session-projection` (`cordis.patch.yml:138`) and `session-projection-cache`. For self-composed profiles, add a `@deepseek-ai/dsh-session-

- **Source**: [alpha.2 tool-todo `inject`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.2/packages/todo/tool-todo/src/index.ts) · [alpha.2 tool-subagent `inject`](https://github.com/deepseek-ai/deepseek-harness/blob

- **Migration recipe**: Namespace validity checking has moved to compile time via the template literal type `SettingsNamespaceInput` (lowercase letter at the start + `[a-z0-9-]` suffix; `SettingsNamespace` is a brand type): on the host side

- **Verification**: Typecheck passes after upgrading devDependencies; unit-test the namespace register/read/write/listen paths; read and write once on a real host settings panel. - **Source**: [alpha.2 settings/src/index.ts (SettingsNamespa

- **Source**: [alpha.2 settings/src/index.ts (SettingsNamespaceInput, no settingsNamespace export)](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.2/packages/settings/settings/src/index.ts) · [alpha.1 settings/src/ind

- **Field note** (2026-08-30, dsh-better-sidebar, devDeps 0.1.1-rc.1 → 0.1.2-alpha.2): After the upgrade, all typecheck failures came from this single semantic change (two call sites: the host side and the smoke-test double); the fix passes

> This file is a curated list of plugin-relevant changes, not a complete API diff. > > Upstream comparison: [dsh-v0.1.2-alpha.2...dsh-v0.1.2-alpha.3](https://github.com/deepseek-ai/deepseek-harness/compare/dsh-v0.1.2-alpha.2...dsh-v0.1.2-al

> > Upstream comparison: [dsh-v0.1.2-alpha.2...dsh-v0.1.2-alpha.3](https://github.com/deepseek-ai/deepseek-harness/compare/dsh-v0.1.2-alpha.2...dsh-v0.1.2-alpha.3) > · Release Notes: [dsh-v0.1.2-alpha.3](https://github.com/deepseek-ai/deeps

> Upstream comparison: [dsh-v0.1.2-alpha.2...dsh-v0.1.2-alpha.3](https://github.com/deepseek-ai/deepseek-harness/compare/dsh-v0.1.2-alpha.2...dsh-v0.1.2-alpha.3)

> · Release Notes: [dsh-v0.1.2-alpha.3](https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.1.2-alpha.3)

- **Migration recipe**: register the plugin's settings namespace through the Node half (`settings` service, same-named namespace the plugin already uses), then have the client render a card into `settings.plugin.item[key = namespace]`; the 

- **Verification**: open Settings → Plugins, find the plugin's card, toggle/change a field, and confirm the running plugin reacts without a web restart; verify the packed client artifact contains the card entry, not just the source. - **Sou

- **Source**: [alpha.2/alpha.3 plugin-owned settings surface design](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.3/.agents/notes/implemented/architecture/2026-08-12-plugin-owned-settings-surface.md) · [whale-girl 4

- **Field note** (2026-08-31, whale-girl): the first integration implemented a high-frequency subset of 7 fields (show-on-page, size, opacity, wandering, sleep delay, feed/play reply pools) as two new client modules (settings-card 298 lines

database receives no migration or salvage writes, and its content is only available   through the pre-upgrade export. - **Source**: [JSONL-only session persistence decision note (pinned dsh-v0.1.2-alpha.3)](https://github.com/deepseek-ai/de

- **Source**: [JSONL-only session persistence decision note (pinned dsh-v0.1.2-alpha.3)](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.2-alpha.3/.agents/notes/implemented/simplification/2026-08-30-jsonl-only-session-persiste

> This file is a curated list of plugin-relevant changes, not a complete API diff. > > Upstream comparison: [dsh-v0.1.2-alpha.3...dsh-v0.1.2-alpha.4](https://github.com/deepseek-ai/deepseek-harness/compare/dsh-v0.1.2-alpha.3...dsh-v0.1.2-al

> > Upstream comparison: [dsh-v0.1.2-alpha.3...dsh-v0.1.2-alpha.4](https://github.com/deepseek-ai/deepseek-harness/compare/dsh-v0.1.2-alpha.3...dsh-v0.1.2-alpha.4) > · Release Notes: [dsh-v0.1.2-alpha.4](https://github.com/deepseek-ai/deeps

> Upstream comparison: [dsh-v0.1.2-alpha.3...dsh-v0.1.2-alpha.4](https://github.com/deepseek-ai/deepseek-harness/compare/dsh-v0.1.2-alpha.3...dsh-v0.1.2-alpha.4)

> · Release Notes: [dsh-v0.1.2-alpha.4](https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.1.2-alpha.4)

3. If a plugin enumerates the child's tool layer by name (a capability filter), check that the filter still lets the child's structured-output tool through — the alpha.4 comment at `packages/core/tools/src/index.ts` was rewritten to say the

- **Source**: [alpha.4 release notes](https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.1.2-alpha.4) ("`send_message` … replacing the one-way `report` tool") · package removal in [compare dsh-v0.1.2-alpha.3...dsh-v0.1.2-al

- **Migration recipe**: rename the dependency and any `name:` row to `@deepseek-ai/dsh-experimental-code-runtime-python`; treat it as experimental (the `experimental/` tree carries no stability promise), so pin the exact cohort version rath

- **Source**: package manifests at both tags — `packages/code-runtime/code-runtime-python/package.json` at `dsh-v0.1.2-alpha.3` (`"name": "@deepseek-ai/dsh-code-runtime-python"`) vs `packages/experimental/code-runtime-python/package.json` a

- Do not cache the array returned by `snapshotEvents()` across appends when you need live data; re-read `seq` and call again. - **Verification**: `tsc --noEmit` of the plugin against `@deepseek-ai/dsh-session` at `dsh-v0.1.2-alpha.4` passes

- **Verification**: `tsc --noEmit` of the plugin against `@deepseek-ai/dsh-session` at `dsh-v0.1.2-alpha.4` passes with no `events` access; a runtime read of a live session through the new API returns the same event count as the projection/

- **Source**: [alpha.4 release notes](https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.1.2-alpha.4) ("Replace `Session.events` with on-demand read APIs") · `packages/core/session/src/index.ts:588-629` (`eventAt` / `snapsh

4. Where you compared `openTurnStartSeq !== null` or `lastStepBoundary.seq`, the comparisons still work (branded numbers are numbers at runtime); only the declared types need updating. - **Verification**: `tsc --noEmit` against the alpha.4 

- **Verification**: `tsc --noEmit` against the alpha.4 packages; at runtime, `SessionSeq(-1)` and `SessionLogOffset(1.5)` throw `TypeError`, and a freshly forked session in the same process shows `session.inheritedEventCount === session.fir

- **Source**: [alpha.4 release notes](https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.1.2-alpha.4) ("Distinguish `SessionSeq` and `SessionLogOffset` with strong types; developers should pay attention to compatibility") ·

- **Migration recipe**: if your preset extends `ptc` and relied on `workflow`, either re-enable `tool-workflow` in your own preset layer or rewrite the instructions around `run_code`; if your preset does not extend `ptc`, nothing changes. D

- **Source**: [alpha.4 release notes](https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.1.2-alpha.4) ("Stop exposing the general-purpose `workflow` tool by default in Web PTC Mode") · `packages/preset/agent-presets/presets

- **Migration recipe**: profiles that must not fetch override the row in their own patch layer (`- id: tool-web` with `config: { fetch: false }`); profiles that previously enabled fetch per preset can drop that override. Treat this as a pol

- **Source**: [alpha.4 release notes](https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.1.2-alpha.4) ("Enable `web_fetch` by default for the Python SDK, Headless, ACP, and custom Profiles") · `packages/bundle/base/cordis.p

> This file is a curated list of plugin-relevant changes, not a complete API diff. > > Upstream comparison: [dsh-v0.1.2-alpha.4...dsh-v0.1.2-alpha.5](https://github.com/deepseek-ai/deepseek-harness/compare/dsh-v0.1.2-alpha.4...dsh-v0.1.2-al

> > Upstream comparison: [dsh-v0.1.2-alpha.4...dsh-v0.1.2-alpha.5](https://github.com/deepseek-ai/deepseek-harness/compare/dsh-v0.1.2-alpha.4...dsh-v0.1.2-alpha.5) > · Release Notes: [dsh-v0.1.2-alpha.5](https://github.com/deepseek-ai/deeps

> Upstream comparison: [dsh-v0.1.2-alpha.4...dsh-v0.1.2-alpha.5](https://github.com/deepseek-ai/deepseek-harness/compare/dsh-v0.1.2-alpha.4...dsh-v0.1.2-alpha.5)

> · Release Notes: [dsh-v0.1.2-alpha.5](https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.1.2-alpha.5)

3. Backend reach: the tolerance is implemented by the json per-record backend and its legacy bootstrap only. A backend without `compatibleVersions` support (the sqlite storage backend implements neither this nor `backupRecord`) keeps strict

- **Verification**: `defineDomain({ version: 5, compatibleVersions: [4] })` passes while `[5]`, `[-1]`, and `[1.5]` throw; open a json per-record unit whose documents are stamped `4` → the records load, stamped `3` without the declaration →

- **Source**: [compare dsh-v0.1.2-alpha.4...dsh-v0.1.2-alpha.5](https://github.com/deepseek-ai/deepseek-harness/compare/dsh-v0.1.2-alpha.4...dsh-v0.1.2-alpha.5) · `DomainSpec.compatibleVersions` and the `defineDomain` validation at [spec.ts

3. Plan the rebuild: after a salvage the record is absent until the owning flow writes it again (the host's cache cold-refolds and checkpoints). Same-minute backups of the same key overwrite each other — the newer bytes win; distinct keys a

- **Verification**: with the policy declared and a schema-failing record present, `open` resolves, the document is renamed to `*.json.bak.*` on disk, `loadAll` shows the key absent, a later `putRecord` recreates the record fresh, and the lo

- **Source**: [compare dsh-v0.1.2-alpha.4...dsh-v0.1.2-alpha.5](https://github.com/deepseek-ai/deepseek-harness/compare/dsh-v0.1.2-alpha.4...dsh-v0.1.2-alpha.5) · `DomainSpec.invalidRecords` contract at [spec.ts:67](https://github.com/deeps

- **Action level**: informational - **Symptoms**: two failure shapes on alpha.4 when an already-used home was upgraded. (1) From a v3 home (shipped by 0.1.1-rc.2, single-file `storages/session_projcache.json`): the per-record bootstrap migr

- **Symptoms**: two failure shapes on alpha.4 when an already-used home was upgraded. (1) From a v3 home (shipped by 0.1.1-rc.2, single-file `storages/session_projcache.json`): the per-record bootstrap migrated the legacy file without check

- **Migration recipe**: upgrade the host to alpha.5 — no plugin code change is required for any of these symptoms. The host's `session_projcache` domain now declares `version: 5, compatibleVersions: [3, 4]` with the two lineage fields optio

- **Verification**: boot the host against `dsh-v0.1.2-alpha.5` on homes of all four shapes (pristine v3, poisoned v3, v4, fresh): the app starts and the SessionList RPC returns the recorded titles verbatim. Upstream's archived-fixture recov

- **Source**: [release notes dsh-v0.1.2-alpha.5](https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.1.2-alpha.5) ("Fix an issue where upgrading from 0.1.1-rc.2 or 0.1.2-alpha.3 could prevent the app from starting or make se

> This file is a curated list of plugin-relevant changes, not a complete API diff. > > Upstream comparison: [dsh-v0.1.2-alpha.5...dsh-v0.1.2-rc.1](https://github.com/deepseek-ai/deepseek-harness/compare/dsh-v0.1.2-alpha.5...dsh-v0.1.2-rc.1)

> > Upstream comparison: [dsh-v0.1.2-alpha.5...dsh-v0.1.2-rc.1](https://github.com/deepseek-ai/deepseek-harness/compare/dsh-v0.1.2-alpha.5...dsh-v0.1.2-rc.1) > · Release Notes: [dsh-v0.1.2-rc.1](https://github.com/deepseek-ai/deepseek-harne

> Upstream comparison: [dsh-v0.1.2-alpha.5...dsh-v0.1.2-rc.1](https://github.com/deepseek-ai/deepseek-harness/compare/dsh-v0.1.2-alpha.5...dsh-v0.1.2-rc.1)

> · Release Notes: [dsh-v0.1.2-rc.1](https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.1.2-rc.1)

~95/~94) out of a 6-session real-history batch (same writer family, all refused). Full   evidence chain (build identity, CDP timing, raw refusal strings, three-leg attribution):   [upstream-0.1.3 adaptation audit, pinned](https://raw.github

evidence chain (build identity, CDP timing, raw refusal strings, three-leg attribution):   [upstream-0.1.3 adaptation audit, pinned](https://raw.githubusercontent.com/alex04130/dsh-forge/8ab0b148b2382b2a33158039fd10d7625b4e145a/docs/audits/

[upstream-0.1.3 adaptation audit, pinned](https://raw.githubusercontent.com/alex04130/dsh-forge/8ab0b148b2382b2a33158039fd10d7625b4e145a/docs/audits/upstream-0.1.3-adaptation-audit.md)

intentionally narrow, treat as a reproduction record pending wider confirmation.   Evidence context:   [upstream-0.1.3 adaptation audit, pinned](https://raw.githubusercontent.com/alex04130/dsh-forge/8ab0b148b2382b2a33158039fd10d7625b4e145a/

[upstream-0.1.3 adaptation audit, pinned](https://raw.githubusercontent.com/alex04130/dsh-forge/8ab0b148b2382b2a33158039fd10d7625b4e145a/docs/audits/upstream-0.1.3-adaptation-audit.md).

- **Verification**: `pnpm install` completes; `require('fs-ext')` loads and the flock callback   path warns once instead of throwing; `dsh web --no-open` boots and answers HTTP 200. - **Source**: [dsh-v0.1.3-alpha.1](https://github.com/deep

path warns once instead of throwing; `dsh web --no-open` boots and answers HTTP 200. - **Source**: [dsh-v0.1.3-alpha.1](https://github.com/deepseek-ai/deepseek-harness/tree/dsh-v0.1.3-alpha.1)   (`d347e70`): `packages/session/session-persis

- **Source**: [dsh-v0.1.3-alpha.1](https://github.com/deepseek-ai/deepseek-harness/tree/dsh-v0.1.3-alpha.1)

- **Applies to**: host deployments and profile wrappers behind corporate proxies (or that   set `http_proxy`/`https_proxy`/`all_proxy`/`no_proxy`); plugins issuing outbound   `fetch()`/`globalThis.fetch` requests inside the host tree; launc

set `http_proxy`/`https_proxy`/`all_proxy`/`no_proxy`); plugins issuing outbound   `fetch()`/`globalThis.fetch` requests inside the host tree; launcher scripts and CI that   previously set `NODE_USE_ENV_PROXY=1`.

`fetch()`/`globalThis.fetch` requests inside the host tree; launcher scripts and CI that

(`apps/cli/src/profile-boot.ts` at `dsh-v0.1.3-alpha.1`); the launcher gains the new   runtime dependency `@deepseek-ai/dsh-http-proxy`. Effect: outbound traffic on   `fetch()`/`globalThis.fetch` (LLM requests, web_search, MCP over HTTP, sa

runtime dependency `@deepseek-ai/dsh-http-proxy`. Effect: outbound traffic on   `fetch()`/`globalThis.fetch` (LLM requests, web_search, MCP over HTTP, sandbox SDK   lanes) honors the proxy environment — lowercase variable names win, `ALL_PR

`fetch()`/`globalThis.fetch` (LLM requests, web_search, MCP over HTTP, sandbox SDK

is honored, while the same name in the invoking directory's `.env` makes the launch   refuse with the bootstrap-only message. - **Source**: [alpha.1 `dsh-http-proxy` README (resolution order, loopback, invalid-value behavior, child-env note

- **Source**: [alpha.1 `dsh-http-proxy` README (resolution order, loopback, invalid-value behavior, child-env notes)](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.3-alpha.1/packages/util/http-proxy/README.md) · [alpha.1 `pr

agentLoop.create(...)` runs a full turn and its log appends persist; using a closed   handle rejects with `SessionHandleClosedError`. - **Source**: [alpha.1 `session-persistence/src/handle.ts` (new)](https://github.com/deepseek-ai/deepseek-

- **Source**: [alpha.1 `session-persistence/src/handle.ts` (new)](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.3-alpha.1/packages/session/session-persistence/src/handle.ts) · [alpha.1 `session-persistence/src/errors.ts`](ht

through the official APIs; a raw-artifact reader using the catalog accepts current   artifacts and deterministically reports the refusal cases in DSH-0.1.3-A1-01/A1-02. - **Source**: [alpha.1 `session-format-catalog/src/current.ts` (new)](h

- **Source**: [alpha.1 `session-format-catalog/src/current.ts` (new)](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.3-alpha.1/packages/session/session-format-catalog/src/current.ts) · [released session-format migrations note

- **Migration recipe**: use the source-launch host recipe — `git fetch <tag>` → clean → build → `pnpm dsh web`, keeping the global npm install as the rollback. - **Verification**: `-V` prints the tag version; the web client boots on the sou

- **Source**: npm registry probe 2026-09-04 ([@deepseek-ai/dsh versions](https://www.npmjs.com/package/@deepseek-ai/dsh?activeTab=versions)); real-host source-launched verification the same day.

- **Migration recipe**: no code change required by the edge; re-verify slot placement at runtime on the source-launched host (paste image/text, open preview/viewer) before declaring support. - **Verification**: manual runtime pass on the so

- **Source**: [0.1.3-alpha.1 release notes](https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.1.3-alpha.1) ("Web 支持上传任意类型的通用文件…", "`read_image` … 在 Web 工具卡中直接渲染图片"); first-hand paste-input verification 2026-09-04.

> This file is a curated list of plugin-relevant changes, not a complete API diff. > > Upstream comparison: [dsh-v0.1.3-alpha.1...dsh-v0.1.3-alpha.2](https://github.com/deepseek-ai/deepseek-harness/compare/dsh-v0.1.3-alpha.1...dsh-v0.1.3-al

> > Upstream comparison: [dsh-v0.1.3-alpha.1...dsh-v0.1.3-alpha.2](https://github.com/deepseek-ai/deepseek-harness/compare/dsh-v0.1.3-alpha.1...dsh-v0.1.3-alpha.2) > · Release Notes: [dsh-v0.1.3-alpha.2](https://github.com/deepseek-ai/deeps

> Upstream comparison: [dsh-v0.1.3-alpha.1...dsh-v0.1.3-alpha.2](https://github.com/deepseek-ai/deepseek-harness/compare/dsh-v0.1.3-alpha.1...dsh-v0.1.3-alpha.2)

> · Release Notes: [dsh-v0.1.3-alpha.2](https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.1.3-alpha.2)

suffix after it (inspect the assembled system prompt); the old-key row shape is   confirmed gone, not silently ignored. - **Source**: [alpha.2 persona plugin source](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.3-alpha.2/pa

- **Source**: [alpha.2 persona plugin source](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.3-alpha.2/packages/preset/persona/src/index.ts) · [alpha.1 persona plugin source (old `text` key)](https://github.com/deepseek-ai/de

normal exit and kill escalation; UI/log surfaces that previously printed the pid show   the new identity or nothing. - **Source**: [alpha.2 subprocess types (no `SubprocessHandle.pid`; terminal handle keeps it)](https://github.com/deepseek-

- **Source**: [alpha.2 subprocess types (no `SubprocessHandle.pid`; terminal handle keeps it)](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.3-alpha.2/packages/subprocess/subprocess/src/types.ts) · [alpha.1 subprocess types 

real edit round-trip through each affected profile's default editor tool succeeds;   sdk-minimal / web-minimal behavior is unchanged where the release notes promise it. - **Source**: [alpha.2 base bundle patch (row removed)](https://github.

- **Source**: [alpha.2 base bundle patch (row removed)](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.3-alpha.2/packages/bundle/base/cordis.patch.yml) · [alpha.1 base bundle patch (row present)](https://github.com/deepseek-a

`node -e "import('@deepseek-ai/dsh/lib/bin.js').then(m => console.log(typeof m.runCli))"`   check prints `function` without running the CLI. - **Source**: [alpha.2 CLI entry](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.3-a

- **Source**: [alpha.2 CLI entry](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.3-alpha.2/apps/cli/src/bin.ts) · [alpha.1 CLI entry (top-level dispatch)](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.3-alpha.

passes; any duplicate-instance symptoms (`instanceof` failures, two copies in the   dependency tree) are gone. - **Source**: [alpha.2 llm-pi-ai package.json (`^0.85.1`)](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.3-alpha.

- **Source**: [alpha.2 llm-pi-ai package.json (`^0.85.1`)](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.3-alpha.2/packages/llm/llm-pi-ai/package.json) · [alpha.1 llm-pi-ai package.json (`^0.84.2`)](https://github.com/deepse

> This file is a curated list of plugin-relevant changes, not a complete API diff. > > Upstream comparison: [dsh-v0.1.3-alpha.2...dsh-v0.1.5-alpha.1](https://github.com/deepseek-ai/deepseek-harness/compare/dsh-v0.1.3-alpha.2...dsh-v0.1.5-al

> > Upstream comparison: [dsh-v0.1.3-alpha.2...dsh-v0.1.5-alpha.1](https://github.com/deepseek-ai/deepseek-harness/compare/dsh-v0.1.3-alpha.2...dsh-v0.1.5-alpha.1) > · Release Notes: [dsh-v0.1.5-alpha.1](https://github.com/deepseek-ai/deeps

> Upstream comparison: [dsh-v0.1.3-alpha.2...dsh-v0.1.5-alpha.1](https://github.com/deepseek-ai/deepseek-harness/compare/dsh-v0.1.3-alpha.2...dsh-v0.1.5-alpha.1)

> · Release Notes: [dsh-v0.1.5-alpha.1](https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.1.5-alpha.1)

`packages/session/session-persistence-jsonl/tests/{v2-ptc-migration,v2-system-migration,migration-refusal,v3-event-admission}.spec.ts`   are the behavior baseline. - **Source**: [alpha.1 `session-format-v2-to-v3` README (single specificatio

- **Source**: [alpha.1 `session-format-v2-to-v3` README (single specification)](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-alpha.1/packages/session/session-format-v2-to-v3/README.md) · [alpha.1 `SESSION_FORMAT_VERSION =

boot work; create/resume with and without `parentAgent` shows the expected ownership   (continuable subagents are not scheduled as roots). - **Source**: [alpha.1 `core/agent/src/index.ts` (no accessor; new `AgentSetup`, `parentAgent`, expli

- **Source**: [alpha.1 `core/agent/src/index.ts` (no accessor; new `AgentSetup`, `parentAgent`, explicit root)](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-alpha.1/packages/core/agent/src/index.ts) · [alpha.2 `core/agent

next-turn/next-step boundary; a client built on the `inbox` projection updates after the   splice commits (not on the raw event) and behaves correctly when no loop is active. - **Source**: [alpha.1 `agent-loop/src/inbox.ts` (driver-owned pr

- **Source**: [alpha.1 `agent-loop/src/inbox.ts` (driver-owned projection, `ReactLoopInbox`)](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-alpha.1/packages/core/agent-loop/src/inbox.ts) · [alpha.2 `core/agent/src/inbox.ts

rejected; a header with `tools: []` is rejected; a client parsing wire events with the   new opaque fields handles unknown-field errors deterministically. - **Source**: [alpha.1 `core/session/src/surface.ts`](https://github.com/deepseek-ai/

- **Source**: [alpha.1 `core/session/src/surface.ts`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-alpha.1/packages/core/session/src/surface.ts) · [alpha.1 `core/session/src/types.ts`](https://github.com/deepseek-ai/deeps

`source.plugin: 'tools-ptc'` and `<parent>:ptc:<n>` ids; a reader handles both old and   new generations without dropping rows. - **Source**: [alpha.1 `core/session/src/known-event-types.ts`](https://github.com/deepseek-ai/deepseek-harness/

- **Source**: [alpha.1 `core/session/src/known-event-types.ts`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-alpha.1/packages/core/session/src/known-event-types.ts) · [alpha.1 `core/tools/src/types.ts` (renamed event keys

surface-node calculation; a pre-upgrade checkpoint row for `contextBreakdown` is   discarded/rebuilt rather than crashing the boot. - **Source**: [alpha.1 `token-meter/src/estimate.ts`](https://github.com/deepseek-ai/deepseek-harness/blob/d

- **Source**: [alpha.1 `token-meter/src/estimate.ts`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-alpha.1/packages/llm/token-meter/src/estimate.ts) · [alpha.2 `token-meter/src/estimate.ts` (old exports)](https://github.c

the cached prefix is preserved; an empty render clears active system nodes; a replace   that targets node 0 without `system/message` is rejected. - **Source**: [alpha.1 `agent-loop/src/runtime-context.ts` (`SystemPromptProjection`)](https:/

- **Source**: [alpha.1 `agent-loop/src/runtime-context.ts` (`SystemPromptProjection`)](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-alpha.1/packages/core/agent-loop/src/runtime-context.ts) · [alpha.1 `llm/src/message.ts` 

an Agent, or with a different Agent, throws `must carry its Agent directly`; gateway   tests read `agentId` from the context. - **Source**: [alpha.1 `api/remotes/src/index.ts` (carrier check)](https://github.com/deepseek-ai/deepseek-harness

- **Source**: [alpha.1 `api/remotes/src/index.ts` (carrier check)](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-alpha.1/packages/api/remotes/src/index.ts) · [alpha.1 `api/gateway/src/index.ts` (`agentId`)](https://github.

`dsh plugin --profile DESKTOP …` all exit 1 with the message; a renamed profile starts   normally. - **Source**: [alpha.1 `apps/cli/src/args.ts` (`rejectElectronProfile`)](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-alph

- **Source**: [alpha.1 `apps/cli/src/args.ts` (`rejectElectronProfile`)](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-alpha.1/apps/cli/src/args.ts) · [alpha.1 `apps/cli/tests/args.spec.ts`](https://github.com/deepseek-ai/

and starts; running it again refuses with EEXIST; an unknown template or a built-in name   fails before writing; `--dump-config` with the flag prints without starting. - **Source**: [alpha.1 `apps/cli/reference/README.md` (flag behavior)](h

- **Source**: [alpha.1 `apps/cli/reference/README.md` (flag behavior)](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-alpha.1/apps/cli/reference/README.md) · [alpha.1 `apps/cli/src/profile-boot.ts` (`initializeProfileFromDe

window without buffering the file; `/api/file` returns an image with the security   headers and rejects non-images with the mapped status. - **Source**: [alpha.1 `api/workspace-files/README.md`](https://github.com/deepseek-ai/deepseek-harne

- **Source**: [alpha.1 `api/workspace-files/README.md`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-alpha.1/packages/api/workspace-files/README.md) · [alpha.1 `session-controller/src/media-references.ts` (`/api/file`)](h

- **Verification**: activating/pausing a goal emits the event through the Remote lane; a   Remote client receives it and `goals.get` returns the expected snapshot. - **Source**: [alpha.1 `api/remotes/src/remote-events.ts`](https://github.co

- **Source**: [alpha.1 `api/remotes/src/remote-events.ts`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-alpha.1/packages/api/remotes/src/remote-events.ts) · [alpha.1 `extensions/tool-cordis/src/api-catalog.ts`](https://gi

session persistence still takes an exclusive lock (two writers on one session fail as   before); CI resolves `native/system` paths. - **Source**: [alpha.1 `session-persistence-jsonl/package.json` (no `fs-ext`)](https://github.com/deepseek-a

- **Source**: [alpha.1 `session-persistence-jsonl/package.json` (no `fs-ext`)](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-alpha.1/packages/session/session-persistence-jsonl/package.json) · [alpha.1 `session-persistence-

`data-rightbar-col` present and no `data-selected`; switching sessions does not leak   right-column state; narrow layouts respect the new 400px centre minimum. - **Source**: [alpha.1 `ui-layout/src/client/index.ts` (`rightbar` seat)](https:

- **Source**: [alpha.1 `ui-layout/src/client/index.ts` (`rightbar` seat)](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-alpha.1/packages/client/ui-layout/src/client/index.ts) · [alpha.1 `ui-layout/src/client/columns.ts`](h

prompt update renders as a "system prompt update" row rather than a duplicate; the   deliverables turn-tail has no show-in-folder branch. - **Source**: [alpha.1 `ui-commands/src/client/contract.ts`](https://github.com/deepseek-ai/deepseek-h

- **Source**: [alpha.1 `ui-commands/src/client/contract.ts`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-alpha.1/packages/client/ui-commands/src/client/contract.ts) · [alpha.1 `ui-conversation/src/client/input/submission

changes; a carrier without `webServer` still loads connection/modules; the new   header-corner slot renders without breaking header padding. - **Source**: [alpha.1 `client/resources/src/client/contract.ts`](https://github.com/deepseek-ai/de

- **Source**: [alpha.1 `client/resources/src/client/contract.ts`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-alpha.1/packages/client/resources/src/client/contract.ts) · [alpha.1 `ui-sidebar-right/src/client/contract/slo

does not invoke an OS opener; a custom `openFile` implementation compiles with the new   signature; tool rows show the line-aware link. - **Source**: [alpha.1 `ui-chat/src/client/contract/slots.ts` (`openFile` signature)](https://github.com

- **Source**: [alpha.1 `ui-chat/src/client/contract/slots.ts` (`openFile` signature)](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-alpha.1/packages/client/ui-chat/src/client/contract/slots.ts) · [alpha.1 `ui-chat/src/clie

`tests/model-selection-settings.spec.ts` and `tests/continuation-inheritance.spec.ts`   are the behavior baseline. - **Source**: [alpha.1 `tool-subagent/src/index.ts`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-alpha.1/

- **Source**: [alpha.1 `tool-subagent/src/index.ts`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-alpha.1/packages/subagent/tool-subagent/src/index.ts) · [alpha.2 `tool-subagent/src/index.ts`](https://github.com/deepseek-

no local apps; a permission or I/O error during project-root discovery surfaces instead   of loading an ancestor's instructions. - **Source**: [alpha.1 `directory-picker-auto/src/resolve.ts` (required `ssh` fact)](https://github.com/deepsee

- **Source**: [alpha.1 `directory-picker-auto/src/resolve.ts` (required `ssh` fact)](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-alpha.1/packages/host/directory-picker-auto/src/resolve.ts) · [alpha.1 `directory-picker-au

- **Action level**: required-if-hit - **Symptoms**: after the in-place upgrade the browser reports `failed to import loader entry <id>`: the combined `/plugins/??…` script executes but never registers modules the boot roster lists — the fir

- **Symptoms**: after the in-place upgrade the browser reports `failed to import loader entry <id>`: the combined `/plugins/??…` script executes but never registers modules the boot roster lists — the first unregistered entry is named (an i

- **Migration recipe**: attribute before touching plugins — fetch one NEW bundle module and one OLD module at the same rev; old 200 + new 404 pins the gap to the host's artifact/rev set, not to the plugin. Then restart the host once: the ob

- **Source**: real-host probes 2026-09-09 (HTTP 200/404 comparison at the same rev; npm-tree artifact file checks); [discussion #5999](https://github.com/deepseek-ai/deepseek-harness/discussions/5999) (comment [18371079](https://github.com/

> This file is a curated list of plugin-relevant changes, not a complete API diff. > > Upstream comparison: [dsh-v0.1.5-alpha.1...dsh-v0.1.5-alpha.2](https://github.com/deepseek-ai/deepseek-harness/compare/dsh-v0.1.5-alpha.1...dsh-v0.1.5-al

> > Upstream comparison: [dsh-v0.1.5-alpha.1...dsh-v0.1.5-alpha.2](https://github.com/deepseek-ai/deepseek-harness/compare/dsh-v0.1.5-alpha.1...dsh-v0.1.5-alpha.2) > · Release Notes: [dsh-v0.1.5-alpha.2](https://github.com/deepseek-ai/deeps

> Upstream comparison: [dsh-v0.1.5-alpha.1...dsh-v0.1.5-alpha.2](https://github.com/deepseek-ai/deepseek-harness/compare/dsh-v0.1.5-alpha.1...dsh-v0.1.5-alpha.2)

> · Release Notes: [dsh-v0.1.5-alpha.2](https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.1.5-alpha.2)

a `reload` reference no longer compiles; `createFileResourceProvider(remote, changes)`   compiles with the two-argument call. - **Source**: [alpha.2 `api/workspace-files/src/index.ts` (scope lookup, `readAll`/`readRelated`)](https://github.

- **Source**: [alpha.2 `api/workspace-files/src/index.ts` (scope lookup, `readAll`/`readRelated`)](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-alpha.2/packages/api/workspace-files/src/index.ts) · [alpha.2 `client/types.t

(no truncated content); the deployment's backend read policy is recorded in the   migration notes. - **Source**: [alpha.2 `api/workspace-files/src/index.ts` (`maxFileBytes`, unconfined `locateFile`)](https://github.com/deepseek-ai/deepseek-

- **Source**: [alpha.2 `api/workspace-files/src/index.ts` (`maxFileBytes`, unconfined `locateFile`)](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-alpha.2/packages/api/workspace-files/src/index.ts) · [alpha.2 `api/workspac

conversation renders at the reserved `conversation` key; selecting an unregistered key   throws and leaves the previous panel selected; zero registrations render no list. - **Source**: [alpha.2 `client/ui-layout/src/client/index.ts` (`main`

- **Source**: [alpha.2 `client/ui-layout/src/client/index.ts` (`main` keyed slot)](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-alpha.2/packages/client/ui-layout/src/client/index.ts) · [alpha.1 `client/ui-layout/src/clien

subagent no longer receives guidance for the removed tools (see   [DSH-0.1.5-A2-07](v0.1.5-alpha.2.md)). - **Source**: [alpha.2 `presets/minimal/agent.cordis.yml` (single-tool composition)](https://github.com/deepseek-ai/deepseek-harness/bl

- **Source**: [alpha.2 `presets/minimal/agent.cordis.yml` (single-tool composition)](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-alpha.2/packages/preset/agent-presets/presets/minimal/agent.cordis.yml) · [alpha.2 `bundle/

`feedback/record` entry; the `subagentCatalog` projection populates after a subagent is   created. - **Source**: [alpha.2 `core/session/src/known-event-types.ts` (two new events)](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.

- **Source**: [alpha.2 `core/session/src/known-event-types.ts` (two new events)](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-alpha.2/packages/core/session/src/known-event-types.ts) · [alpha.2 `session-persistence/src/sto

errors; a request for a broken model fails with `INVALID_CONFIG` while a healthy model   succeeds; a provider-level `error` renders in the settings surface. - **Source**: [alpha.2 `llm-pi-ai/src/config.ts` (`piProvider?`, `modelErrors`, `as

- **Source**: [alpha.2 `llm-pi-ai/src/config.ts` (`piProvider?`, `modelErrors`, `assertServiceable`)](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-alpha.2/packages/llm/llm-pi-ai/src/config.ts) · [alpha.2 `llm-pi-ai/src/ca

tools; an unfiltered agent still gets the full guidance; tool schemas are unchanged   across scopes. - **Source**: [alpha.2 `fs/tool-fs/src/read.ts` (scope-aware guidance)](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-alp

- **Source**: [alpha.2 `fs/tool-fs/src/read.ts` (scope-aware guidance)](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-alpha.2/packages/fs/tool-fs/src/read.ts) · [alpha.2 `fs/tool-fs-search/src/grep.ts`](https://github.com/

the default application; the reveal action opens the containing folder with the file   selected on macOS/Windows/Linux. - **Source**: [alpha.2 `fs/tool-present/README.md`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-alph

- **Source**: [alpha.2 `fs/tool-present/README.md`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-alpha.2/packages/fs/tool-present/README.md) · [alpha.2 `fs/tool-present/src/index.ts`](https://github.com/deepseek-ai/deepse

- **Verification**: the renamed package resolves and the right sidebar renders Markdown,   code, HTML, PDF and image previews; the old package name resolves nowhere. - **Source**: [alpha.2 `client/ui-sidebar-documentpreview/package.json` (r

- **Source**: [alpha.2 `client/ui-sidebar-documentpreview/package.json` (renamed)](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-alpha.2/packages/client/ui-sidebar-documentpreview/package.json) · [alpha.2 `client/ui-sideba

`appendChunkedList`/`iterateChunkedList`; `npm ls fs-ext` is empty in a fresh install;   the Agent Teams profile only appears after an explicit add. - **Source**: [alpha.2 `util/chunked-list/src/index.ts`](https://github.com/deepseek-ai/dee

- **Source**: [alpha.2 `util/chunked-list/src/index.ts`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-alpha.2/packages/util/chunked-list/src/index.ts) · [alpha.2 `fs/tool-present/package.json`](https://github.com/deepseek

- **Verification**: a server that repeats a cursor produces the documented rejection   message and the session continues with the previous tool set. - **Source**: [alpha.2 headless MCP pagination expectation](https://github.com/deepseek-ai/

- **Source**: [alpha.2 headless MCP pagination expectation](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-alpha.2/apps/cli/tests/profiles/headless/tests/mcp-pagination.expected.e2e.ts) · [alpha.2 expected stderr cause](htt

- **Verification**: the status document lists `latestReleasedVersion: 3` and the evidence   tag; the v2-to-v3 README no longer carries the "not released" limitation. - **Source**: [alpha.2 `docs/session-format-status.md` (new)](https://gith

- **Source**: [alpha.2 `docs/session-format-status.md` (new)](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-alpha.2/docs/session-format-status.md) · [alpha.2 `session-format-v2-to-v3/README.md` (limitation removed)](https:

typecheck fails on the old `PropsRuntime<'rightbar'>` usage and on `s.sidebar`; a root-level   panel renders with no Session. - **Source**: [alpha.2 `ui-layout/src/client/index.ts` (`main`/`rightbar` root, `usePanelInfo`)](https://github.co

- **Source**: [alpha.2 `ui-layout/src/client/index.ts` (`main`/`rightbar` root, `usePanelInfo`)](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-alpha.2/packages/client/ui-layout/src/client/index.ts) · [alpha.2 `ui-layout/sr

- **Verification**: typecheck passes without `reload`; the old reference fails; a refresh   through the replacement path updates the rendered value. - **Source**: [alpha.2 `client/resources/src/client/contract.ts` (no `reload`)](https://git

- **Source**: [alpha.2 `client/resources/src/client/contract.ts` (no `reload`)](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-alpha.2/packages/client/resources/src/client/contract.ts) · [alpha.1 `client/resources/src/clien

- **Verification**: no export named `DocumentFileIcon` resolves; the icon renders for a known   extension and honours the colour variable; the deep import compiles from the new package. - **Source**: [alpha.2 `ui-primitives/src/index.ts`](h

- **Source**: [alpha.2 `ui-primitives/src/index.ts`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-alpha.2/packages/client/ui-primitives/src/index.ts) · [alpha.2 `ui-primitives/src/FileTypeIcon.tsx`](https://github.com/dee

roles present; dropping a tab shows the dashed card with `labels.dropZone[zone]`; the sole   guide chip has no close affordance. - **Source**: [alpha.2 `ui-dockkit/src/contract/adapter.ts` (`dropZone`)](https://github.com/deepseek-ai/deepse

- **Source**: [alpha.2 `ui-dockkit/src/contract/adapter.ts` (`dropZone`)](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-alpha.2/packages/client/ui-dockkit/src/contract/adapter.ts) · [alpha.2 `ui-dockkit/src/components/rend

dialog and records an entry with a category; `acknowledge()` shows the toast; a stale   `rate(...)` reference fails to compile. - **Source**: [alpha.2 `ui-message-feedback/src/client/slots.ts`](https://github.com/deepseek-ai/deepseek-harnes

- **Source**: [alpha.2 `ui-message-feedback/src/client/slots.ts`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-alpha.2/packages/client/ui-message-feedback/src/client/slots.ts) · [alpha.2 `ui-message-feedback/src/client/in

Conversation even when a custom panel was selected; `forkSession` opens the fork;   re-selecting the same Session still resets the panel. - **Source**: [alpha.2 `ui-workspace/src/client/navigation.ts`](https://github.com/deepseek-ai/deepsee

- **Source**: [alpha.2 `ui-workspace/src/client/navigation.ts`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-alpha.2/packages/client/ui-workspace/src/client/navigation.ts) · [alpha.2 `ui-workspace/src/client/index.ts` (in

fork Session; a presented file renders as a deliverable card and opens through   `openPresented`; "Files changed" no longer lists presented-but-untouched files. - **Source**: [alpha.2 `ui-chat/src/client/contract/slots.ts` (`forClosing(owne

- **Source**: [alpha.2 `ui-chat/src/client/contract/slots.ts` (`forClosing(owner, sessionId)`)](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-alpha.2/packages/client/ui-chat/src/client/contract/slots.ts) · [alpha.2 `ui-del

the built `lib/client.js` still resolves its bundled imports; a standalone consumer that   needs React declares it itself. - **Source**: [alpha.2 `packages/client/AGENTS.md` (rules 3 and 5)](https://github.com/deepseek-ai/deepseek-harness/b

- **Source**: [alpha.2 `packages/client/AGENTS.md` (rules 3 and 5)](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-alpha.2/packages/client/AGENTS.md) · [alpha.2 `ui-primitives/package.json` (empty `dependencies`)](https://g

above the cap fails with the Host's `too-large` error; HTML preview scripts execute inside   the sandboxed iframe. - **Source**: [alpha.2 `ui-sidebar-documentpreview/src/client/document/registry.ts`](https://github.com/deepseek-ai/deepseek-

- **Source**: [alpha.2 `ui-sidebar-documentpreview/src/client/document/registry.ts`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-alpha.2/packages/client/ui-sidebar-documentpreview/src/client/document/registry.ts) · [alph

- **Verification**: invoking the decorated command opens the UI without appending a user   message; attaching a file to that invocation does not produce the submit-path rejection. - **Source**: [alpha.2 `ui-commands/src/client/contract.ts` 

- **Source**: [alpha.2 `ui-commands/src/client/contract.ts` (`ActionSpec`, `CommandUiSpec`)](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-alpha.2/packages/client/ui-commands/src/client/contract.ts) · [alpha.2 `ui-commands

returns the documented `session-not-found` error; the subpath imports compile; the package   installs with its new `zod` dependency. - **Source**: [alpha.2 `feedback/command-feedback/package.json` (subpath exports, `zod`)](https://github.co

- **Source**: [alpha.2 `feedback/command-feedback/package.json` (subpath exports, `zod`)](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-alpha.2/packages/feedback/command-feedback/package.json) · [alpha.2 `feedback/command-

seeded page; the sole guide has no close route; a corner whose occupant renders nothing   collapses so the tool area reaches the edge. - **Source**: [alpha.2 `ui-sidebar-right/src/client/tab-registry.ts` (no `description`)](https://github.c

- **Source**: [alpha.2 `ui-sidebar-right/src/client/tab-registry.ts` (no `description`)](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-alpha.2/packages/client/ui-sidebar-right/src/client/tab-registry.ts) · [alpha.2 `ui-sid

> This file is a curated list of plugin-relevant changes, not a complete API diff. > > Upstream comparison: [dsh-v0.1.5-alpha.2...dsh-v0.1.5-rc.1](https://github.com/deepseek-ai/deepseek-harness/compare/dsh-v0.1.5-alpha.2...dsh-v0.1.5-rc.1)

> > Upstream comparison: [dsh-v0.1.5-alpha.2...dsh-v0.1.5-rc.1](https://github.com/deepseek-ai/deepseek-harness/compare/dsh-v0.1.5-alpha.2...dsh-v0.1.5-rc.1) > · Release Notes: [dsh-v0.1.5-rc.1](https://github.com/deepseek-ai/deepseek-harne

> Upstream comparison: [dsh-v0.1.5-alpha.2...dsh-v0.1.5-rc.1](https://github.com/deepseek-ai/deepseek-harness/compare/dsh-v0.1.5-alpha.2...dsh-v0.1.5-rc.1)

> · Release Notes: [dsh-v0.1.5-rc.1](https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.1.5-rc.1)

`agent-default-model` row; open a fresh Session and confirm the model id in its header,   then run one real turn. - **Source**: [rc.1 `packages/bundle/base/cordis.patch.yml`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-r

- **Source**: [rc.1 `packages/bundle/base/cordis.patch.yml`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-rc.1/packages/bundle/base/cordis.patch.yml) · [rc.1 release notes](https://github.com/deepseek-ai/deepseek-harness/

turn on an `in-history` model appends a changed system prompt after the cached history   instead of rewriting the leading system message. - **Source**: [rc.1 `packages/llm/llm-deepseek/src/index.ts`](https://github.com/deepseek-ai/deepseek-

- **Source**: [rc.1 `packages/llm/llm-deepseek/src/index.ts`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-rc.1/packages/llm/llm-deepseek/src/index.ts) · [rc.1 `packages/llm/llm-deepseek/README.md`](https://github.com/dee

return — the reading position survives; a renderer that never scrolls does not disturb   the shared body's behavior. - **Source**: [rc.1 `packages/client/ui-sidebar-documentpreview/src/client/document/contract.ts`](https://github.com/deepse

- **Source**: [rc.1 `packages/client/ui-sidebar-documentpreview/src/client/document/contract.ts`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-rc.1/packages/client/ui-sidebar-documentpreview/src/client/document/contract.t

switch the UI language — title and description update without a reload; a crowded guide   degrades to titles only. - **Source**: [rc.1 `packages/client/ui-sidebar-right/src/client/tab-registry.ts`](https://github.com/deepseek-ai/deepseek-ha

- **Source**: [rc.1 `packages/client/ui-sidebar-right/src/client/tab-registry.ts`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-rc.1/packages/client/ui-sidebar-right/src/client/tab-registry.ts) · [rc.1 `packages/client/ui

local patches and are reported against the `0.1.5-alpha.1` edge cards; a deployment at or   above `0.1.5-alpha.1` must account for them until upstream fixes them. - **Source**: [rc.1 compare](https://github.com/deepseek-ai/deepseek-harness/

- **Source**: [rc.1 compare](https://github.com/deepseek-ai/deepseek-harness/compare/dsh-v0.1.5-alpha.2...dsh-v0.1.5-rc.1) · [rc.1 `packages/core/session/src/types.ts`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-rc.1/pa

> This file is a curated list of plugin-relevant changes, not a complete API diff. > > Upstream comparison: [dsh-v0.1.5-rc.1...dsh-v0.1.5-rc.2](https://github.com/deepseek-ai/deepseek-harness/compare/dsh-v0.1.5-rc.1...dsh-v0.1.5-rc.2)

> > Upstream comparison: [dsh-v0.1.5-rc.1...dsh-v0.1.5-rc.2](https://github.com/deepseek-ai/deepseek-harness/compare/dsh-v0.1.5-rc.1...dsh-v0.1.5-rc.2) > · Release Notes: [dsh-v0.1.5-rc.2](https://github.com/deepseek-ai/deepseek-harness/rel

> Upstream comparison: [dsh-v0.1.5-rc.1...dsh-v0.1.5-rc.2](https://github.com/deepseek-ai/deepseek-harness/compare/dsh-v0.1.5-rc.1...dsh-v0.1.5-rc.2)

> · Release Notes: [dsh-v0.1.5-rc.2](https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.1.5-rc.2)

the dialog; clicking an unrecorded rating opens the dialog and writes nothing until   Submit; no stale import of `MessageFeedbackToggleResult` remains. - **Source**: [rc.2 `packages/client/ui-message-feedback/src/client/slots.ts`](https://g

- **Source**: [rc.2 `packages/client/ui-message-feedback/src/client/slots.ts`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-rc.2/packages/client/ui-message-feedback/src/client/slots.ts) · [rc.2 `.../src/client/index.ts`](

the draft, shows the warning toast for its hold window, and closes it through   `dismissFailure` without closing the modal. - **Source**: [rc.2 `packages/client/ui-message-feedback/src/client/MessageFeedbackActions.tsx`](https://github.com/

- **Source**: [rc.2 `packages/client/ui-message-feedback/src/client/MessageFeedbackActions.tsx`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-rc.2/packages/client/ui-message-feedback/src/client/MessageFeedbackActions.tsx)

`dsh-code-icon-` id; `--dsh-file-type-icon-color` still tints a traditional glyph such   as the generic file. - **Source**: [rc.2 `packages/client/ui-primitives/src/CodeFileIcon.tsx`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh

- **Source**: [rc.2 `packages/client/ui-primitives/src/CodeFileIcon.tsx`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-rc.2/packages/client/ui-primitives/src/CodeFileIcon.tsx) · [rc.2 `src/code-file-icon-artwork.ts`](http

default zoom, and a long delivery list stays inside its own section instead of pushing   the footer away. - **Source**: [rc.2 `packages/client/ui-chat/README.md`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-rc.2/packages

- **Source**: [rc.2 `packages/client/ui-chat/README.md`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-rc.2/packages/client/ui-chat/README.md) · [rc.2 `ui-chat/src/client/chat/TurnTailNodeView.module.css`](https://github.c

label in both languages, and a search for the retired strings in your own repository   comes back empty. - **Source**: [rc.2 `packages/client/ui-message-feedback/src/client/locales.ts`](https://github.com/deepseek-ai/deepseek-harness/blob/d

- **Source**: [rc.2 `packages/client/ui-message-feedback/src/client/locales.ts`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-rc.2/packages/client/ui-message-feedback/src/client/locales.ts) · [rc.2 `packages/feedback/comm

`packages/core`, `packages/session`, `packages/skill` and `packages/llm` shows version   strings only. - **Source**: [rc.1...rc.2 compare](https://github.com/deepseek-ai/deepseek-harness/compare/dsh-v0.1.5-rc.1...dsh-v0.1.5-rc.2) · [rc.2 ro

- **Source**: [rc.1...rc.2 compare](https://github.com/deepseek-ai/deepseek-harness/compare/dsh-v0.1.5-rc.1...dsh-v0.1.5-rc.2) · [rc.2 root `package.json` (`engines`)](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.5-rc.2/pac

> This file is a curated list of plugin-relevant changes, not a complete API diff. > > Upstream comparison: [dsh-v0.1.5-rc.2...dsh-v0.1.6-alpha.1](https://github.com/deepseek-ai/deepseek-harness/compare/dsh-v0.1.5-rc.2...dsh-v0.1.6-alpha.1)

> > Upstream comparison: [dsh-v0.1.5-rc.2...dsh-v0.1.6-alpha.1](https://github.com/deepseek-ai/deepseek-harness/compare/dsh-v0.1.5-rc.2...dsh-v0.1.6-alpha.1) > · Release Notes: [dsh-v0.1.6-alpha.1](https://github.com/deepseek-ai/deepseek-ha

> Upstream comparison: [dsh-v0.1.5-rc.2...dsh-v0.1.6-alpha.1](https://github.com/deepseek-ai/deepseek-harness/compare/dsh-v0.1.5-rc.2...dsh-v0.1.6-alpha.1)

> · Release Notes: [dsh-v0.1.6-alpha.1](https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.1.6-alpha.1)

- **Migration recipe**: replace every `ctx.on('agent/session-start', ({ agent, source }) => …)` with `ctx.on('agent/created', ({ agent, source, signal }) => …)`; the in-repo reference migration is `packages/hooks/hooks-claude-code/src/index

- **Source**: [0.1.6-alpha.1 `packages/core/agent/src/runtime-types.ts#L245-L261`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.6-alpha.1/packages/core/agent/src/runtime-types.ts#L245-L261) · [0.1.6-alpha.1 `packages/core/a

- **Migration recipe**: replace `assertEntriesLoaded(ctx, bin)` + `assertEntriesActivated(ctx, bin)` with one `await auditStartupEntries(ctx, bin)`, optionally passing a `warn` sink to capture optional-failure warnings instead of letting th

- **Source**: [0.1.6-alpha.1 `packages/boot/app-boot/src/index.ts#L700-L835`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.6-alpha.1/packages/boot/app-boot/src/index.ts#L700-L835) · [0.1.6-alpha.1 `packages/boot/app-boot/sr

- **Migration recipe**: for "what state does this session have now", read the registered projection instead of scanning history, and for user-requested history use the explicit asynchronous paged read path rather than `snapshotEvents()` ove

- **Source**: [0.1.6-alpha.1 `packages/core/session/src/index.ts#L622-L666`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.6-alpha.1/packages/core/session/src/index.ts#L622-L666) · [0.1.6-alpha.1 `.agents/notes/implemented/a

- **Migration recipe**: if the plugin owns an event that rewrites an existing message's content, tag its `SessionEventMap` member with `@messageProjection`, implement a pure `SessionMessageProjection` (`type` plus `project()`), and register

- **Source**: [0.1.6-alpha.1 `packages/core/session/src/index.ts#L911-L933`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.6-alpha.1/packages/core/session/src/index.ts#L911-L933) · [0.1.6-alpha.1 `packages/core/session/src/s

- **Migration recipe**: stop calling `ctx.hmr.registerConfig(...)` and stop listening for `hmr/config-update-failed` (it can never fire) — use `watchConfig` from `@deepseek-ai/dsh-app-boot` with `ctx.get('hmr')!.config`, or own a watcher, a

- **Source**: [0.1.6-alpha.1 `vendor/hmr/src/index.ts#L20-L23`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.6-alpha.1/vendor/hmr/src/index.ts#L20-L23) · [0.1.6-alpha.1 `packages/boot/app-boot/src/watch-config.ts#L36-L80`](

- **Migration recipe**: decide the policy per deployment and write it down explicitly — add `enabled: false` to the `session-log-deepseek` row in every profile, overlay or test composition that must not contribute the log, which is exactly 

- **Source**: [0.1.6-alpha.1 `packages/session/session-log-deepseek/src/index.ts#L37-L46`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.6-alpha.1/packages/session/session-log-deepseek/src/index.ts#L37-L46) · [0.1.6-alpha.1 

- **Migration recipe**: (1) swap every `@deepseek-ai/dsh-code-runtime*` dependency/import for `@deepseek-ai/dsh-ptc-runtime` / `@deepseek-ai/dsh-ptc-runtime-node`, including `peerDependencies` and profile rows; (2) rename identifiers `CodeR

- **Source**: [0.1.6-alpha.1 `packages/ptc-runtime/ptc-runtime/src/index.ts`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.6-alpha.1/packages/ptc-runtime/ptc-runtime/src/index.ts#L91-L150), [`packages/ptc-runtime/ptc-runtim

- **Migration recipe**: (1) change each `extends SandboxProvider` method to `async confine(argv, policy, signal?): Promise<ConfinedArgv>` and call `signal?.throwIfAborted()` before resolving a runner; (2) convert every call site to `await c

- **Source**: [0.1.6-alpha.1 `packages/sandbox/sandbox/src/index.ts`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.6-alpha.1/packages/sandbox/sandbox/src/index.ts#L164-L181), [`packages/sandbox/sandbox/src/diagnostics.ts`](

- **Migration recipe**: (1) implementors: declare `start(spec): Promise<ShellProcess>`, `await` preparation (sandbox confinement, helper launch) before publishing, reject (never resolve) on cancellation or setup failure, and keep observing 

- **Source**: [0.1.6-alpha.1 `packages/shell/shell/src/index.ts`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.6-alpha.1/packages/shell/shell/src/index.ts#L87-L101), [`packages/shell/tool-bash/src/index.ts`](https://github.

- **Migration recipe**: (1) add `async terminalEnvironment(signal?)` to your `SubprocessRuntime` subclass returning `{ platform: 'posix' | 'windows' }` (plus `defaultShell` when resolvable) and honor the signal; (2) plain `spawn` consumers 

- **Source**: [0.1.6-alpha.1 `packages/subprocess/subprocess/src/index.ts`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.6-alpha.1/packages/subprocess/subprocess/src/index.ts#L138-L143), [`packages/subprocess/subprocess/src

- **Migration recipe**: (1) swap the package name in dependencies and profile rows, and update any patch layer that targets row id `workflow-worker-thread` (a stale id only warns — `patch: entry %C not found`, `vendor/include/src/index.ts:1

- **Source**: [0.1.6-alpha.1 `packages/workflow/workflow-ptc/src/index.ts`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.6-alpha.1/packages/workflow/workflow-ptc/src/index.ts#L102-L174), [`packages/workflow/workflow-ptc/pac

- **Migration recipe**: (1) a server whose instructions exceed ~32 KiB (or a row with `failOnStartupError: true`) now fails to publish — shorten the instructions or raise `maxInstructionBytes` explicitly; (2) if you imported `@modelcontextp

- **Source**: [0.1.6-alpha.1 `packages/mcp/mcp-client/src/index.ts`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.6-alpha.1/packages/mcp/mcp-client/src/index.ts#L20-L27), [`packages/mcp/mcp-client/src/connection.ts`](https:

- **Migration recipe**: (1) existing plugins need nothing — with no configured MCP server there is no prompt section, no tool schema, no PTC declaration and no PTC binding; (2) to offer resources, mount `@deepseek-ai/dsh-mcp-resources` in t

- **Source**: [0.1.6-alpha.1 `packages/mcp/mcp-resources/src/index.ts`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.6-alpha.1/packages/mcp/mcp-resources/src/index.ts#L14-L126), [`packages/mcp/mcp-resources/src/tools.ts`](h

- **Migration recipe**: (1) mount `@deepseek-ai/dsh-ssh` with verified helper coordinates, then mount `dsh-fs-ssh`, `dsh-subprocess-ssh` and `dsh-sandbox-ssh` in place of — not beside — their local counterparts so all consumers share one ex

- **Source**: [0.1.6-alpha.1 `packages/ssh/ssh/src/index.ts`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.6-alpha.1/packages/ssh/ssh/src/index.ts#L17-L104), [`packages/ssh/fs-ssh/src/index.ts`](https://github.com/deepseek-

- **Migration recipe**: delete every use of `offloadRequestImagesWithPolicy`, `RequestImageOffloadPolicy` and `offloadedImagePrefixCount` (grep those three names). Compute each retained occurrence's exact request-version byte length, call `

- **Source**: [0.1.6-alpha.1 `packages/llm/llm/src/content.ts`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.6-alpha.1/packages/llm/llm/src/content.ts) · [0.1.6-alpha.1 `packages/llm/llm/src/types.ts`](https://github.com/de

- **Action level**: required-if-hit - **Symptoms**: the same provider route and the same default model id now speak a different protocol to a different default endpoint.   - On rc.2 `Config` (`packages/llm/llm-deepseek/src/index.ts:134`) ha

- **Symptoms**: the same provider route and the same default model id now speak a different protocol to a different default endpoint.   - On rc.2 `Config` (`packages/llm/llm-deepseek/src/index.ts:134`) had no protocol field, the endpoint de

- On rc.2 `Config` (`packages/llm/llm-deepseek/src/index.ts:134`) had no protocol field, the endpoint default was `PUBLIC_BASE_URL = 'https://api.deepseek.com'` (`:210`), and the adapter appended a fixed path: `fetch(\`${connection.baseURL}

- On 0.1.6-alpha.1 `packages/llm/llm-deepseek/src/config.ts:26-27` adds `protocol?: DeepSeekProtocol` with schema default `'messages'` at `:81`; the type is `DeepSeekProtocol = 'chat-completions' | 'messages'` at `packages/llm/llm-deepseek/

- `packages/bundle/base/cordis.patch.yml` still sets `provider: deepseek-official` / `model: deepseek-flash` unchanged, so an overlay that only overrode `baseURL` at a Chat-Completions-only gateway now posts Anthropic-shaped requests there,

- **Migration recipe**: grep your profile, overlay, plugin and provisioning scripts for `llm-deepseek`, `deepseek-official`, `DEEPSEEK_BASE_URL` and `chat/completions`. If you override the endpoint with a Chat-Completions-only URL, add `pro

- **Verification**: call the plugin's exported `resolveAdapterOptions({}, undefined)` and confirm `baseURL === 'https://api.deepseek.com/anthropic'`; call it with `{ protocol: 'chat-completions' }` and confirm `https://api.deepseek.com`. Po

- **Source**: [0.1.6-alpha.1 `packages/llm/llm-deepseek/src/config.ts`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.6-alpha.1/packages/llm/llm-deepseek/src/config.ts) · [0.1.6-alpha.1 `packages/llm/llm-deepseek/src/protoco

- **Migration recipe**: grep `DEFAULT_REQUEST_IMAGE_PIXEL_BUDGET`, `resolveRequestImagePolicy` and `MAX_CHAT_IMAGE_BYTES`. Replace `resolveRequestImagePolicy(model)` with `resolveRequestImageTarget(model, ref)` (returns `{ width, height, ma

- **Source**: [0.1.6-alpha.1 `packages/llm/llm-deepseek/src/common/request-pricing.ts`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.6-alpha.1/packages/llm/llm-deepseek/src/common/request-pricing.ts) · [0.1.6-alpha.1 `packa

- **Migration recipe**: re-derive any persisted projection state — a version-4 `contextBreakdown` or `contextPressure` checkpoint is a cache miss on 0.1.6-alpha.1 and must not be asserted as current — and update pinned fixtures to `stateVer

- **Source**: [0.1.6-alpha.1 `packages/llm/token-meter/src/index.ts`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.6-alpha.1/packages/llm/token-meter/src/index.ts) · [0.1.6-alpha.1 `packages/llm/token-meter/src/breakdown-pr

- **Migration recipe**: grep `AssistantProvenance` and replace the host import with `AssistantProviderMetadata` from `@deepseek-ai/dsh-llm`. On the client face, replace `AssistantProvenanceView` with `AssistantProviderMetadataView` and the 

- **Source**: [0.1.6-alpha.1 `packages/llm/llm/src/message.ts`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.6-alpha.1/packages/llm/llm/src/message.ts) · [0.1.6-alpha.1 `packages/llm/llm/src/types.ts`](https://github.com/de

- **Migration recipe**: rename every import (`ContextProvenanceView` → `ContextProducerView`, `AssistantProvenanceView` → `AssistantProviderMetadataView`); update field reads (`AssistantMessageNode.providerMetadata`, `ContextMessageNode.pro

- **Source**: [0.1.6-alpha.1 `packages/client/ui-conversation/src/client/contract/context-producer.ts`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.6-alpha.1/packages/client/ui-conversation/src/client/contract/context-prod

- **Migration recipe**: add `name` to every `CommandClaim` you build — the catalog command name without the leading slash, i.e. what `/name args` executes — and keep your existing `token` as the spelling the composer draft shows; if a test 

- **Source**: [0.1.6-alpha.1 `packages/client/ui-conversation/src/client/contract/input.ts`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.6-alpha.1/packages/client/ui-conversation/src/client/contract/input.ts) · [0.1.6-alph

- **Migration recipe**: if you built your own picker from `faceOf('permissions').getSnapshot().options`, stop — read `currentValue` from the projection and fetch the options from `ctx.remote.permissionPresets.catalog()` (declare `remote.per

- **Source**: [0.1.6-alpha.1 `packages/client/ui-conversation/src/client/contract/slots.ts`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.6-alpha.1/packages/client/ui-conversation/src/client/contract/slots.ts) · [0.1.6-alph

- **Migration recipe**: give every guide entry a stable, provider-unique `id`; set `multiple: true` for a kind whose tabs must not collapse into one page; register `ctx.sidebarRight.registerCloseHandler(kind, handler)` (one per kind, effect

- **Source**: [0.1.6-alpha.1 `packages/client/ui-sidebar-right/src/client/tab-registry.ts`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.6-alpha.1/packages/client/ui-sidebar-right/src/client/tab-registry.ts) · [0.1.6-alpha.

- **Migration recipe**: delete `reconnectLabel` from every `<ConnectionIndicator>` call site and make `disconnectedLabel` itself name the retry action (that is the new copy contract: the outage label names what clicking does). No other prop

- **Source**: [0.1.6-alpha.1 `packages/client/ui-primitives/src/ConnectionIndicator.tsx`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.6-alpha.1/packages/client/ui-primitives/src/ConnectionIndicator.tsx) · [0.1.6-alpha.1 `p

- **Migration recipe**: keep passing the raw before/after fragments including unchanged context — do not pre-split them. Refresh pinned `+/-` totals, rendered row strings, DOM snapshots and `diffTotals` expectations: they shrink to the chan

- **Source**: [0.1.6-alpha.1 `packages/client/ui-primitives/src/DiffBlock.tsx`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.6-alpha.1/packages/client/ui-primitives/src/DiffBlock.tsx) · [0.1.6-alpha.1 `packages/client/ui-pr

- **Migration recipe**: stop opening the client with `?fixture`, and drop any CI job that does. For slot/component work keep `SlotTestRuntime.create()` from `@deepseek-ai/dsh-client-test-runtime` (unchanged). For plugin activation, reload, 

- **Source**: [0.1.6-alpha.1 `packages/client/connection/src/client/index.ts`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.6-alpha.1/packages/client/connection/src/client/index.ts) · [0.1.6-alpha.1 `packages/test-support/c

- **Migration recipe**: replace the old row with the two new rows in every overlay/patch you maintain, and move any `provider: spawn` config onto `workflow-ptc`; keep `ptc-runtime` config-free unless the deployment needs a different PTC run

- **Source**: [0.1.6-alpha.1 `packages/bundle/base/cordis.patch.yml`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.6-alpha.1/packages/bundle/base/cordis.patch.yml) · [rc.2 `packages/bundle/base/cordis.patch.yml`](https://gi

- **Migration recipe**: do not widen a plugin's own message handling to assume images always arrive as image blocks — read the projection instead, because a selected occurrence arrives as `offloadedImageText` naming the attachment and its r

- **Source**: [0.1.6-alpha.1 `packages/compaction/compaction-image-offload/src/projection.ts`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.6-alpha.1/packages/compaction/compaction-image-offload/src/projection.ts) · [0.1.6-

- **Migration recipe**: restore the row from an overlay only where the deployment genuinely wants it, by adding `- id: tool-ralph` with `disabled: false` (and the previous `subagentProvider`/`maxRounds` config) to `$DSH_HOME/cordis.patch.ym

- **Source**: [0.1.6-alpha.1 `packages/bundle/base/cordis.patch.yml`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.6-alpha.1/packages/bundle/base/cordis.patch.yml) · [rc.2 `packages/bundle/base/cordis.patch.yml`](https://gi

- **Migration recipe**: drop a hand-added `mcp-resources` row from overlays that inherit base or sdk-minimal, and keep only deployment-specific config in an overlay that overrides the shipped row. Adopt the resource surface through the plug

- **Source**: [0.1.6-alpha.1 `packages/bundle/base/cordis.patch.yml`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.6-alpha.1/packages/bundle/base/cordis.patch.yml) · [0.1.6-alpha.1 `packages/bundle/sdk-minimal/cordis.patch.

- **Migration recipe**: remove `code-runtime` from Web overlays and manifests and let the base's PTC row serve execution; if an overlay pinned the row to keep PTC out of the Web bundle, re-express that intent against the new row ids. Audit 

- **Source**: [0.1.6-alpha.1 `packages/bundle/web-app/cordis.patch.yml`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.6-alpha.1/packages/bundle/web-app/cordis.patch.yml) · [rc.2 `packages/bundle/web-app/cordis.patch.yml`](h

- **Migration recipe**: treat a dependency on a removed package as a broken coordinate, not as a version problem. Move worker-thread code runtime consumers to `@deepseek-ai/dsh-ptc-runtime-node` (composed by the base's `ptc-runtime` row) an

- **Source**: [0.1.6-alpha.1 `packages/`](https://github.com/deepseek-ai/deepseek-harness/tree/dsh-v0.1.6-alpha.1/packages) · [rc.2 `packages/`](https://github.com/deepseek-ai/deepseek-harness/tree/dsh-v0.1.5-rc.2/packages) · [0.1.6-alpha.1

- **Migration recipe**: for machine consumers, switch to `--json` and parse the documented fields instead of scraping text; when continuing existing work, pass `--session-id <id>` and assert the run appends to that session rather than creat

- **Source**: [0.1.6-alpha.1 `packages/bundle/headless/cordis.patch.yml`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.6-alpha.1/packages/bundle/headless/cordis.patch.yml) · [0.1.6-alpha.1 `packages/bundle/headless/src/inde

`dsh.manifestVersion`; a lockfile pinned to the old declaration package passes typecheck   against stale bytes, so reinstall before believing a green build. - **Source**: [0.1.6-alpha.1 `packages/util/package-manifest/src/types.ts`](https:/

- **Source**: [0.1.6-alpha.1 `packages/util/package-manifest/src/types.ts`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.6-alpha.1/packages/util/package-manifest/src/types.ts) · [0.1.6-alpha.1 `packages/util/package-manifes

experimental manifest carries `publishConfig.access == "public"`; then confirm the intended   names resolve from npm at the new version. - **Source**: [0.1.6-alpha.1 `scripts/experimental-package-policy.ts`](https://github.com/deepseek-ai/d

- **Source**: [0.1.6-alpha.1 `scripts/experimental-package-policy.ts`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.6-alpha.1/scripts/experimental-package-policy.ts) · [0.1.6-alpha.1 `scripts/npm-baseline-packages.ts`](http

the profile root), then start the host and mount a shipped profile — the addon load is on the   startup path, so a mismatch surfaces there rather than at first use. - **Source**: [0.1.6-alpha.1 `vendor/loader/package.json`](https://github.c

- **Source**: [0.1.6-alpha.1 `vendor/loader/package.json`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.6-alpha.1/vendor/loader/package.json) · [0.1.6-alpha.1 `apps/cli/package.json`](https://github.com/deepseek-ai/deepseek

rules, and `apps/desktop/tests/profile-mcp.spec.ts` covers the Desktop composition including   its Host overlay. Signed installed-artifact qualification remains a release-environment check. - **Source**: [0.1.6-alpha.1 `apps/desktop/README.

- **Source**: [0.1.6-alpha.1 `apps/desktop/README.md`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.6-alpha.1/apps/desktop/README.md) · [0.1.6-alpha.1 `apps/desktop/src/core-package-set.ts`](https://github.com/deepseek-ai/d

- **Migration recipe**: no source action. Spend the effort on the moved surfaces instead — the PTC runtime replacement, the package ledger, the required-on-read `image/offload` event, and the adapter image-budget seam. - **Verification**: `

- **Source**: [0.1.6-alpha.1 `packages/core/session/src/types.ts`](https://github.com/deepseek-ai/deepseek-harness/blob/dsh-v0.1.6-alpha.1/packages/core/session/src/types.ts) · [rc.2 `packages/core/session/src/types.ts`](https://github.com/

Executable file

#!/usr/bin/env node

if (portArg !== undefined) {     try {       const res = await fetch(`http://127.0.0.1:${portArg}/api/agentPreset.list`, {

try {       const res = await fetch(`http://127.0.0.1:${portArg}/api/agentPreset.list`, {         method: 'POST',

const res = await fetch(`http://127.0.0.1:${portArg}/api/agentPreset.list`, {

#!/usr/bin/env node

Executable file

Executable file

[Credential-related source omitted]

[Credential-related source omitted]

#!/usr/bin/env node

[Credential-related source omitted]

Executable file

assert.equal(classifySpec('@deepseek-ai/dsh-some-plugin'), 'npm-name')   assert.equal(classifySpec('dsh-better-sidebar'), 'npm-name')   assert.equal(classifySpec('https://github.com/user/plugin.git'), 'git-url')

assert.equal(classifySpec('dsh-better-sidebar'), 'npm-name')   assert.equal(classifySpec('https://github.com/user/plugin.git'), 'git-url')   assert.equal(classifySpec('git@github.com:user/plugin.git'), 'git-url')

assert.equal(classifySpec('https://github.com/user/plugin.git'), 'git-url')

assert.equal(listKeyFor('https://github.com/user/plugin.git', 'git-url'), 'plugin')

#!/usr/bin/env node

const DEAD_MODEL_BASE_URL = 'http://127.0.0.1:9/v1' // port 9 (discard): nothing listens -> immediate ECONNREFUSED

* caller's mirror means the verdict was reached on a possibly-stale version. */ function pinNpmSpec(pkgName) {   const view = run('npm', ['view', pkgName, 'dist-tags.latest', '--registry=https://registry.npmjs.org'], { timeoutSeconds: 60 })

function pinNpmSpec(pkgName) {   const view = run('npm', ['view', pkgName, 'dist-tags.latest', '--registry=https://registry.npmjs.org'], { timeoutSeconds: 60 })   const latest = (view.stdout ?? '').trim().replace(/^["']|["']$/g, '')

const view = run('npm', ['view', pkgName, 'dist-tags.latest', '--registry=https://registry.npmjs.org'], { timeoutSeconds: 60 })

[Credential-related source omitted]

{   "$schema": "https://json-schema.org/draft/2020-12/schema",

"$schema": "https://json-schema.org/draft/2020-12/schema",

"$id": "https://github.com/oh-my-dsh/dsh-plugin-upgrade-skill/blob/main/skills/plugin-workflow/references/workflow-selection.schema.json",

Executable file

#!/usr/bin/env node

[Credential-related source omitted]

[Credential-related source omitted]

This is a community compatibility profile, not an official DeepSeek Harness naming standard. It was verified on 2026-08-31 against [`dsh-v0.1.2-alpha.2`](https://github.com/deepseek-ai/deepseek-harness/tree/0a53fb55bea101816fa226bb964ae2bed

Primary sources: [first plugin](https://github.com/deepseek-ai/deepseek-harness/blob/0a53fb55bea101816fa226bb964ae2bed71c343b/docs/user/develop/basic/index.zh.md), [bundle publishing and Loader layers](https://github.com/deepseek-ai/deepsee

"appliesTo": "external-community-plugin",   "officialBaseline": {     "repository": "https://github.com/deepseek-ai/deepseek-harness",

"officialBaseline": {     "repository": "https://github.com/deepseek-ai/deepseek-harness",     "ref": "dsh-v0.1.2-alpha.2",

"repository": "https://github.com/deepseek-ai/deepseek-harness",

},   "centralRegistry": {     "repository": "https://github.com/oh-my-dsh/dsh-plugin-registry",

"centralRegistry": {     "repository": "https://github.com/oh-my-dsh/dsh-plugin-registry",     "contract": "dsh-plugin-registry/v2",

"repository": "https://github.com/oh-my-dsh/dsh-plugin-registry",

"contract": "dsh-plugin-registry/v2",     "indexSchemaUrl": "https://raw.githubusercontent.com/oh-my-dsh/dsh-plugin-registry/main/registry/schema/plugin-index.schema.json",     "defaultIndexUrl": "https://raw.githubusercontent.com/oh-my-dsh

"indexSchemaUrl": "https://raw.githubusercontent.com/oh-my-dsh/dsh-plugin-registry/main/registry/schema/plugin-index.schema.json",

"defaultIndexUrl": "https://raw.githubusercontent.com/oh-my-dsh/dsh-plugin-registry/main/registry/index.json"

{   "$schema": "https://json-schema.org/draft/2020-12/schema",

"$schema": "https://json-schema.org/draft/2020-12/schema",

https://raw.githubusercontent.com/oh-my-dsh/dsh-plugin-registry/main/registry/index.json

https://raw.githubusercontent.com/oh-my-dsh/dsh-plugin-registry/main/registry/schema/plugin-index.schema.json

1. Commit the validated `dsh-plugin.naming.json` to the public plugin repository. 2. Clone or update `https://github.com/oh-my-dsh/dsh-plugin-registry`, then copy its

2. Clone or update `https://github.com/oh-my-dsh/dsh-plugin-registry`, then copy its

Executable file

plugin: {       id: `${namespace}/web-search`,       repository: `https://github.com/${namespace}/dsh-web-search`,

id: `${namespace}/web-search`,       repository: `https://github.com/${namespace}/dsh-web-search`,       package: naming.plugin.packageName,

repository: `https://github.com/${namespace}/dsh-web-search`,

export async function runRegistryQueryChecks() {   const policy = await loadNamingPolicy()   assert.equal(policy.centralRegistry?.repository, 'https://github.com/oh-my-dsh/dsh-plugin-registry')

const policy = await loadNamingPolicy()   assert.equal(policy.centralRegistry?.repository, 'https://github.com/oh-my-dsh/dsh-plugin-registry')   assert.equal(policy.centralRegistry?.contract, REGISTRY_CONTRACT)

assert.equal(policy.centralRegistry?.repository, 'https://github.com/oh-my-dsh/dsh-plugin-registry')

assertInvalidIndex(candidate, (value) => { value.$schema = 'https://example.com/plugin-index.schema.json' }, /index\.\$schema/)

const strict = await runCli(['--manifest', manifestPath, '--index', indexPath, '--harness-version', '0.1.2-alpha.2', '--strict'])     assert.equal(strict.code, 1)     const unavailable = await runCli(['--manifest', manifestPath, '--registry