Release v0.4.7

修复

• 兼容宿主工具调用上下文中的会话 ID，避免产物写入错误任务（issue-10-25-artifact-task-binding）：
  • 修复 trellis_artifact_update 在缺省 slug 时的目标任务解析逻辑：除底层直接调用的 exec.sessionId 外，增加对宿主原生工具执行上下文 exec.agent.session.id 的提取兼容；
  • 杜绝在有当前活动会话时因参数层级不同而误判定为“无会话”，进而错误回退至项目级 canonical 任务指针并覆盖历史旧任务产物（如 prd.md）；
  • 补全基于真实注册工具调用的确定性回归测试，严格断言新任务生成产物目标目录准确、显式 slug 不受影响且会话绑定保持不变。

---

Fixed

• Support Host Tool Execution Context for Session ID Resolution in Artifact Updates (issue-10-25-artifact-task-binding):
  • Fixed default target task resolution in trellis_artifact_update when slug is omitted: in addition to low-level exec.sessionId, now properly extracts the session ID from the host's native tool execution context (exec.agent.session.id);
  • Prevents erroneously falling back to the project-level canonical task pointer and overwriting an older task's artifacts (e.g. prd.md) when an active session is present;
  • Added deterministic regression tests using registered tool mounts, strictly asserting that artifacts write to the newly created task directory, explicit slug overrides remain honored, and session bindings stay intact.

---

Release v0.4.6

功能

• 看板与任务选择浮层质感重构（Polish UI）（feat-10-24-task-picker-kanban-polish）：
  • 设计系统阶梯统一：字号全面收敛为 11/12/13/15（TB.T），圆角收敛为 5 档（TB.R），阴影精简为 1px 细线描边 + 双层浅投影，杜绝零散字号与裸数字样式；
  • 当前卡片去嵌套（不叠卡）：当前任务卡精简为单一连续表面，步骤清单与操作按钮通过 1px 细分隔线区分，消除卡内嵌卡；头部 Chip 增加静止细描边；
  • 色彩克制与降噪：状态点、图标与步骤环改用降饱和色调（successSoft / warnSoft / dangerSoft），完成进度条改用中性底色，仅状态点与勾选保留纯绿；
  • 动效稳重化：绑定任务取消无限循环呼吸灯，改为 2px 静态光环 + 仅播一次的 0.6s 入场微脉冲；弹窗仅保留淡入与 ≤4px 微位移，严禁 scale() 缩放；
  • 大看板交互与无障碍对齐：大看板增加严格对齐的表头（共用 GRID_COLUMNS 常量），新增分段式类型筛选控件，支持键盘上下方向键行导航与 aria-activedescendant 无障碍读屏播报；
  • 焦点契约完善：浮层打开时焦点自动移入列表（或主操作卡片），按 Esc 关闭时主动归还焦点至 Chip，外部点击关闭不抢焦点。

修复

• 移除组件设置页，配置只保留插件详情页外层入口（feat-10-24-remove-component-settings）：
  • 删除 plugins.row.config 插槽注册与 ROW_CONFIG_KEY：0.4.5 起两个入口渲染同一张表单，用户会在「插件详情页」与「包含的组件 → trellis-workflow 行详情页」看到同一份设置出现两次，现已收敛为仅外层单一入口；
  • 配置项、TrellisConfigController 与保存通道完全不变，已有配置数据无需迁移；宿主未声明外层座位时不回退注册组件座位（单入口是产品决定，不做防御性兜底）；
  • 客户端行为测试改为单入口断言：外层座位恰好注册一次、组件座位注册数为 0（座位在 stub 中已声明且可用）、注入 face 的 edit / resetField / save / discard 齐全；变异测试确认用例可 falsify。

---

Features

• Task Picker Popover and Kanban Board UI Polish (feat-10-24-task-picker-kanban-polish):
  • Unified design system tokens: Typography scale strictly unified to 11/12/13/15 (TB.T), radius to 5 tiers (TB.R), and shadows refined to a 1px hairline plus two subtle drops; eliminated unscaled font sizes and inline magic numbers;
  • Un-nested current task card: Simplified the active task card into a single continuous surface separated by 1px dividers rather than nested sub-cards; added a subtle resting border to the session chip;
  • Desaturated and calmer color scheme: Softened state dot, icon, and step ring colors (successSoft / warnSoft / dangerSoft); progress bar uses a neutral fill (doneFill), leaving green only for active success dots and checkmarks;
  • Restrained animations: Replaced infinite breathing loops on bound tasks with a static 2px halo and a one-time 0.6s entry pulse; modal transitions use fade and ≤4px nudges without scale();
  • Board grid alignment and accessibility: Added strict column headers sharing the row grid (GRID_COLUMNS), segmented task type filter, keyboard arrow-key navigation, and aria-activedescendant accessibility announcements;
  • Polished focus contract: Focus moves into the list or CTA when the popover opens, Esc returns focus to the trigger chip, and outside clicks dismiss without stealing focus.

Fixed

• Removed the per-component settings page; configuration lives only on the bundle page (feat-10-24-remove-component-settings):
  • Dropped the plugins.row.config registration and ROW_CONFIG_KEY. Since 0.4.5 both seats painted the same form, so the same settings appeared twice (bundle detail page and "Included Components → trellis-workflow" row detail page). The outer seat is now the single entry;
  • Configuration fields, TrellisConfigController, and the save path are untouched, and no stored configuration needs migration. When the host does not declare the bundle seat the plugin does not fall back to the component seat (single entry is a product decision, not a defensive default);
  • Client behaviour tests now assert the single entry: exactly one bundle-seat registration, zero component-seat registrations while that slot is declared and available, and a complete injected face (edit / resetField / save / discard). Mutation checks confirm the tests can fail.

---

Release v0.4.5

功能

• 插件配置面板提升至插件详情页外层（feat-10-24-bundle-settings-ui）：
  • 新增 plugins.bundle.config 插槽注册（key 设为裸包名 @banana-peeljj12/dsh-trellis），将 Trellis 配置表单（生效白名单、注入步数、只读保护、跳过关键词等）直接呈现在插件详情页最外层（标题与图标下方），无需再展开「包含的组件 → trellis-workflow」；
  • 同步保留原 plugins.row.config 插槽，双入口共用同一个 TrellisConfigController 与单一 store 状态实例，无状态分叉与重复保存；
  • 完善客户端行为测试体系：引入基于真实 bundle 的 loadBundle 运行沙箱，严格断言双座位的精确 key、防单座重复注册、控制器 face 单例引用，并通过配置项 id 集合精确比对杜绝假绿灯。

---

Features

• Top-Level Bundle Settings Page (feat-10-24-bundle-settings-ui):
  • Registered the plugins.bundle.config slot (keyed by bare package name @banana-peeljj12/dsh-trellis), rendering the Trellis configuration form (allowlist, inject step, readonly planning, skip keywords, etc.) directly on the bundle's top-level page under the header, eliminating the need to expand "Included Components → trellis-workflow";
  • Retained the existing plugins.row.config slot as a backward-compatible entry point, with both seats sharing a single TrellisConfigController and store instance to prevent state divergence;
  • Hardened client test coverage: introduced a VM-based loadBundle test harness running real bundle code with shell-faithful slot mocks, asserting exact seat keys, single registration per slot, singleton controller faces, and exact configuration field ID set matching.

---

Release v0.4.4

功能

• 项目工程规范自适应注入（无 workflow.md 模式）：实现了无需生成 .trellis/workflow.md 即可自动向模型系统提示词注入 .trellis/spec/ 规范索引的能力。新增边界受控且 fail-open 的规范扫描模块（lib/spec.js），仅注入路径与“先读规范再改代码”约束，杜绝上下文膨胀；新增 injectSpecIndex 插件配置开关，同时在规划、实施阶段的面包屑中按步骤状态精准引导规范阅读。
• 大看板任务类型辨识度强化与已完成分组折叠：
  • 任务类型列由纯文本升级为中性描边胶囊徽标，并为三类任务配备单色图标（feat=火花 / issue=虫子 / refactor=刷新），拓宽列宽防止英文截断，在严格保持单强调色约束的同时显著提升辨识度。
  • 「已完成 · 归档」任务分组默认折叠，减少长列表视觉噪点；支持一键展开/收起，并在有搜索关键字时自动展开。
• 工作流技能路由与问题排查模板优化：完善了 trellis-issue、trellis-break-loop 与 trellis-check 等技能指引，强化缺陷分析模板规范与门禁阶段核验。

---

Features

• Project Spec Index Auto-Injection (Workflow-less Mode): automatically injects .trellis/spec/ indices into the system prompt without requiring .trellis/workflow.md. Added a bounded, fail-open spec scanner (lib/spec.js) that injects only file paths and read-first constraints to prevent token bloat; added the injectSpecIndex plugin setting and step-state-aware spec guidance in breadcrumbs.
• Enhanced Kanban Task Type Badges & Completed Group Folding:
  • Replaced plain text type labels with neutral bordered badges paired with monochrome icons (feat=sparkles, issue=bug, refactor=refresh) and widened the column to prevent ellipsis truncation while respecting single-accent UI guidelines.
  • The "Completed / Archived" section is now collapsed by default to reduce visual clutter; supports manual expand/collapse and auto-expands when searching.
• Skill Routing & Issue Analysis Workflow Optimization: enhanced trellis-issue, trellis-break-loop, and trellis-check skills along with the issue analysis template for stricter spec adherence and verification gates.

---

Release v0.4.2

功能

• 看板和任务条界面大改版（视觉更清爽、突出当前任务）：重新设计了顶栏和底栏的任务状态条（Chip）以及弹出看板。去掉了花花绿绿的彩色标签，改用干净的单色设计；红黄色仅在“任务卡住（blocked）”或“等人工确认”时才会出现；当前会话正在绑定的任务会有呼吸光圈和明确的“当前任务”标识。
• 当前任务置顶卡片与步骤清单：正在做的任务直接固定在弹窗最顶部的焦点卡片里，卡片内自带清晰的步骤清单；当前步骤加粗显示，并直接展示完成条件或卡住原因；做完的步骤会自动折叠起来，不占空间；解绑任务的按钮也直接整合在卡片右上角，切换更顺手。
• 全屏看板改为清晰的三组分类与右侧详情面板：展开的大看板按“进行中 / 规划中 / 已完成”分为三栏列表，点任意任务右侧直接滑出详情抽屉，能一屏看清整个任务的生命周期阶段、完整步骤清单和产物文档。

文档

• 更新使用文档与真实界面截图：在 README.md 与 README_EN.md 中替换了旧版截图，展示了新版看板在明亮、暗色模式下的实际效果，并结合使用流程做了清晰说明。

测试

• 补充新界面的样式与文字清晰度测试：针对新版界面的交互、置顶卡片、步骤展示逻辑补充了测试用例；增加了在明亮、暗色和默认环境下的文字对比度检查，确保文字一眼看得清、不刺眼；全部 152 项自动化测试均通过。

---

Features

• Cleaner Kanban and Task Chip UI (single accent & quiet list): redesigned the top/bottom task status chip and board popup. Replaced rainbow-colored badges with clean typography; reserved red/amber warnings strictly for blocked tasks and manual verification gates; active tasks bound to the current session now feature a gentle breathing halo and a distinct "current" badge.
• Pinned Hero Card with Step Checklist: the currently active task is now pinned in a prominent card at the very top of the popup, complete with a live step checklist that highlights what's being worked on, acceptance criteria, or blockers; completed steps fold away automatically, and the unbind button is built directly into the card.
• Grouped Table and Details Drawer for Full Board: reorganized the full-screen kanban into three clean sections (In Progress, Planning, Completed); clicking any task slides out a side drawer showing full lifecycle progress, all steps, and generated documents.

Docs

• Refreshed Screenshots and Documentation: updated README.md and README_EN.md with new light and dark mode UI screenshots to match the real look and feel.

Tests

• Added UI and Theme Contrast Tests: expanded test coverage for the new card layouts, step rendering rules, and theme contrast checks (light, dark, and default palettes); all 152 automated tests pass.

---

Release v0.4.1

功能

• 内置技能升级自动同步机制：支持插件升级后自动将最新的官方技能与模板内容无损同步至项目的 .agents/skills/ 目录，通过 .trellis-version 标记精确跟踪版本状态，并完整保留用户的自定义技能。
• 内置技能体系与工程规则全面精简与规范化：对全部 14 个内置技能（trellis-feat、trellis-issue、trellis-refactor、trellis-brainstorm、trellis-finish-work 等）进行了提示词净化与规范精简，消除冗长啰嗦的套话，强化防过度工程、单轮提问、复现用例先行、严格行为等价以及硬性卡点。

修复

• 防止陈旧任务更新操作错误篡改当前会话绑定（issue-10-21-fix-stale-task-binding）：将 trellis_task_update 工具与底层的会话绑定逻辑解耦，显式传入 slug 时只更新目标任务的元数据与状态，绝不改变当前会话的任务绑定；同步引入进程级变更轮次（mutation epoch）机制，防止异步旧读取覆盖较新的会话激活状态与看板摘要。

测试

• 新增技能自动同步升级与会话绑定并发隔离测试：新增 task-binding.test.js 与 native-steps.test.js 中的版本升级同步用例，覆盖旧任务延迟写回、跨会话并发绑定隔离及版本递增同步全流程；全量 153 项测试全绿通过。

---

Features

• Automatic synchronization for bundled skills on upgrade: automatically syncs updated bundled skills and templates to .agents/skills/ during plugin upgrades using .trellis-version version tracking, while keeping custom user skills intact.
• Refined and concise engineering guidance across skills: streamlined all 14 bundled skills (trellis-feat, trellis-issue, trellis-refactor, trellis-brainstorm, trellis-finish-work, etc.) with cleaner prompts, anti-overengineering principles, strict behavior equivalence, and crisp phase gates.

Fixed

• Prevent stale task updates from overriding active session binding (issue-10-21-fix-stale-task-binding): decoupled trellis_task_update from session pointer mutation so updating an explicit slug modifies only task data; added mutation epoch fencing to ensure delayed asynchronous reads cannot overwrite fresh session activations or board summaries.

Tests

• Add comprehensive binding concurrency and skill auto-upgrade tests: added test/task-binding.test.js and upgrade regression tests covering delayed writes, session pointer isolation, and .trellis-version synchronization; all 153 tests pass.

---

Release v0.4.0

功能

• 紧凑看板支持行内快捷激活/取消激活：在任务行右侧直接提供一键激活与取消激活按钮，无需下钻详情页即可快速流转任务状态；内置加载等待态防连击逻辑，并完全适配宿主明暗主题配色。
• 裁撤 design-review 冗余阶段并强化防过度工程规范：精简标准 feat 任务生命周期，将架构与设计评审职责收敛至设计与实施前环节，消除形式化阻滞；同步确立简洁设计与最小必要实现守则。
• Trellis 核心技能文档与提示词中文统一：将全部内置技能说明、产物模板与指导原则统一为清晰易读的中文表述，降低多代理协作中的理解成本与术语分歧。

测试

• 新增看板行内交互与状态回归测试：覆盖紧凑看板激活按钮渲染、禁用与点击触发逻辑，验证明暗主题兼容性；确保全量测试通过。

---

Features

• Inline activate/deactivate in compact kanban: add one-click activate and deactivate actions directly to task rows for quick switching without opening task details; includes loading/debounce protection and seamless light/dark theme adaptation.
• Prune design-review stage and enforce anti-overengineering: streamline the standard feat workflow by pruning the separate design review phase, eliminating bureaucratic overhead while reinforcing minimalist design and single-purpose changes.
• Unify Trellis skills and prompt templates in Chinese: convert all bundled skill definitions, artifact templates, and guidance into consistent Chinese for reduced cognitive overhead and clearer multi-agent collaboration.

Tests

• Add board inline interaction and state tests: cover rendering, disabled states, and action dispatch for the compact board activate button, ensuring full regression test suite passes.

---

Release v0.3.7

修复

• 修复暗色模式下任务看板浅底白字、标题与徽章难以辨认的问题（#2）：将不存在的 --dsw-alias-bg-layer-0 改为宿主实际定义的 --dsw-alias-bg-base，并让选中行、类型徽章、步骤计数及阶段圆圈跟随宿主主题。区分强调填充色与文字色，保留深色按钮与白字的明确配对；紧凑看板、泳道、列表和详情在明暗主题间切换时均保持可读，不改变布局与任务交互。

测试

• 新增 28 项主题回归测试：覆盖三类选中任务、三种看板视图及明亮、暗色、无宿主变量三种配色环境；全量 node --test 共 135 项通过。另以隔离浏览器验证真实 CSS 计算与同一 DOM 的明暗切换，受检文字最低对比度为 5.19:1，高于普通文本 4.5:1 标准。

---

Fixed

• Fix unreadable kanban titles and badges in dark mode (#2): replace the nonexistent --dsw-alias-bg-layer-0 with the host-defined --dsw-alias-bg-base, and make selected rows, type badges, step counts, and stage circles follow the host theme. Separate accent fills from readable text colors while keeping explicit dark-button/white-label pairs. The compact board, lanes, list, and details remain readable across light/dark switches without changing layout or task interactions.

Tests

• Add 28 theme regression tests: cover three selected task types, three board views, and light, dark, and no-host-token palettes; all 135 node --test checks pass. Isolated-browser checks also verify computed CSS colors and theme switching on the same mounted DOM, with a minimum measured text contrast of 5.19:1, above the 4.5:1 threshold for normal text.

---

Release v0.3.6

兼容性

• 适配 DSH 0.2.0-rc.2 运行时：peerDependencies / devDependencies 的 6 个 @deepseek-ai/dsh-* 由 ^0.1.7-rc.1 提升到 ^0.2.0-rc.2（@deepseek-ai/cordis 仍 ^4.0.4、@deepseek-ai/schemastery 仍 ^3.18.4，两者在两版运行时间均未变）。这是本次适配的承重改动：DSH 会强制校验插件声明的 DSH peer 范围——dsh-app-boot 的 evaluatePluginCompatibility() 对每个 @deepseek-ai/dsh / @deepseek-ai/dsh-* peer 执行 semver.satisfies(运行时版本, 范围, { includePrerelease: true })，不匹配时 dsh-plugin-manager 会在 pnpm 运行之前直接拒绝安装（installation rejected），并在 profile 启动时拒绝加载该插件。旧的 ^0.1.7-rc.1 在 semver 上不覆盖 0.2.0-rc.2（>=0.1.7-rc.1 <0.2.0-0），因此 6 个 peer 全部不满足，插件在当前桌面版中既装不上也起不来；提升后恢复正常。
• lib/ 零改动：两版之间无破坏性 API 变更（逐字节审计结论）。host 侧插件用到的全部 API 面——agent/pre-step 的 payload 与 PreStepDecision、system-prompt/assemble 的 3 参契约与 AssembleContext（仍不含 agent）、ctx.fs 全部成员（含 5 参 writeText 与 sandboxMode）、ctx.tools.register、defineTool/ToolRunContext、ctx.skills、ctx.agents.currentInitiator、ctx.webServer.register、ctx.sessions.get/Session.header.cwd/session/disposed、ctx.get('sandboxPolicy') + resolve({ session })、createUserMessage 与 ContentBlock、dsh-settings 的 describe()/configure()/volatile 语义、cordis 4.0.4 的 effect/inject/on/fiber.config——在两版之间逐字节相同。client 侧穷举全部外部标识符（6 个 dsh.client.inject 包、5 个服务名、3 个席位、4 个 primitive 导出、locale 命名空间、14 个 CSS token、/trellis-workflow/api 下的 3 条子路径、dsh-resource:// 地址语法）后确认：plugins.row.config 席位的 slot-contract.d.ts、configForms 的 dsh-client-ui-settings/lib/client.js、SettingsFormModel 的 form-model.d.ts（214 行）等关键契约文件逐字节相同，rowConfigKey(<包名>, <行 id>) 的 key 格式与「rowId 取 patch 裸 id、include: 前缀只进 entryId」的分工均未变，主题 token 零删除（377 → 408，仅新增 --dsw-radius-*、--dsw-focus-ring-* 等）。
• 真正有代码改动的 8 个包均为纯增量或插件不调用：dsh-tools（PreToolDecision.ask 新增可选 displayReason）、dsh-llm（新增 ToolUpdate / ToolHistory / projectToolUpdates 与 ACCOUNT_QUOTA_EXCEEDED_CODE）、dsh-session（新增 toolHistory() 投影与失败路径的 ToolCallRecovery）、dsh-agent-loop（失败回合补记 tool/result；startsSeries 新增一道仅在路由声明 toolUpdate 时生效的门）、dsh-sandbox、dsh-user-approval、dsh-util-values（hasIntrinsicConstructor realm 加固；插件依赖的 snapshotJsonValue 未变）、dsh-workspace。其中唯一破坏性签名变更是 dsh-workspace.WorkspaceRegistry.initializeDefault（resolveDirectory 由 Promise<{path,title}> 收窄为 Promise<string>）——该服务属 host 包，本插件使用 client 包 dsh-client-ui-workspace 提供的 uiWorkspace 服务，不受影响。

文档

• 新增 docs/ref/dsh-0.2.0-rc.2-audit.md：记录本次适配的双版本审计方法与证据（含包级变更面、逐字节比对清单、以及仍需真实 GUI 才能确认的运行期项）。
• README.md / README_EN.md 补充安装与兼容性说明：新增「桌面版请用自带 carrier CLI」一节（普通 dsh CLI 会以 profile "desktop" is managed exclusively by the Electron application 拒绝操作 desktop profile，须改用 resources\runtime\cli\bin\dsh.cmd，且安装后须完整退出并重启桌面版），并说明 DSH 会强校验 @deepseek-ai/dsh-* peer 范围、升级 DSH 后若插件失效应先核对 peer 声明。

---

Compatibility

• Adapt to the DSH 0.2.0-rc.2 runtime: the six @deepseek-ai/dsh-* entries in peerDependencies / devDependencies move from ^0.1.7-rc.1 to ^0.2.0-rc.2 (@deepseek-ai/cordis stays ^4.0.4, @deepseek-ai/schemastery stays ^3.18.4; neither changed between the two runtimes). This is the load-bearing change of the adaptation: DSH enforces the DSH peer ranges a plugin declares — dsh-app-boot's evaluatePluginCompatibility() runs semver.satisfies(runtimeVersion, range, { includePrerelease: true }) for every @deepseek-ai/dsh / @deepseek-ai/dsh-* peer, and on a mismatch dsh-plugin-manager rejects the installation before pnpm runs (installation rejected) and profile startup denies the plugin. The old ^0.1.7-rc.1 does not cover 0.2.0-rc.2 (>=0.1.7-rc.1 <0.2.0-0), so all six peers were unsatisfied and the plugin could neither install nor start on the current desktop build; raising the range restores both.
• No lib/ changes: no breaking API change between the two versions (byte-level audit). On the host the complete API surface the plugin uses — the agent/pre-step payload and PreStepDecision, the 3-argument system-prompt/assemble contract and its AssembleContext (still without agent), every ctx.fs member (including the 5-argument writeText and sandboxMode), ctx.tools.register, defineTool/ToolRunContext, ctx.skills, ctx.agents.currentInitiator, ctx.webServer.register, ctx.sessions.get/Session.header.cwd/session/disposed, ctx.get('sandboxPolicy') + resolve({ session }), createUserMessage and ContentBlock, dsh-settings' describe()/configure()/volatile semantics, and cordis 4.0.4's effect/inject/on/fiber.config — is byte-identical across the two versions. On the client, after enumerating every external identifier (six dsh.client.inject packages, five service names, three slots, four primitive exports, the locale namespace, fourteen CSS tokens, the three sub-paths under /trellis-workflow/api, the dsh-resource:// address syntax), the contracts that matter are byte-identical too: the plugins.row.config slot contract (slot-contract.d.ts), configForms (dsh-client-ui-settings/lib/client.js), SettingsFormModel (form-model.d.ts, 214 lines); rowConfigKey(<package>, <row id>) keeps its format and the split where rowId comes from the bare patch id while the include: prefix appears only in entryId; and theme tokens have zero removals (377 → 408, additions only, such as --dsw-radius-* and --dsw-focus-ring-*).
• All eight packages with real code changes are additive or unreachable by this plugin: dsh-tools (optional displayReason added to PreToolDecision.ask), dsh-llm (new ToolUpdate / ToolHistory / projectToolUpdates and ACCOUNT_QUOTA_EXCEEDED_CODE), dsh-session (new toolHistory() projection, plus ToolCallRecovery on failure paths), dsh-agent-loop (failed turns now record a conservative tool/result; startsSeries gained a gate that only applies when a route declares toolUpdate), dsh-sandbox, dsh-user-approval, dsh-util-values (hasIntrinsicConstructor realm hardening; the snapshotJsonValue this plugin relies on is unchanged), and dsh-workspace. The only breaking signature change is dsh-workspace.WorkspaceRegistry.initializeDefault (resolveDirectory narrows from Promise<{path,title}> to Promise<string>); that service belongs to the host package, while this plugin consumes the uiWorkspace service of the client package dsh-client-ui-workspace, so it is unaffected.

Docs

• Added docs/ref/dsh-0.2.0-rc.2-audit.md: records the two-version audit method and evidence for this adaptation (package-level change surface, the byte-identical comparison list, and the runtime-only items that still need a real GUI to confirm).
• Expanded README.md / README_EN.md with install and compatibility notes: a new "desktop app — use the bundled carrier CLI" section (the ordinary dsh CLI refuses the desktop profile with profile "desktop" is managed exclusively by the Electron application, so use resources\runtime\cli\bin\dsh.cmd, and fully quit and relaunch the desktop app afterwards), plus an explanation that DSH strictly validates @deepseek-ai/dsh-* peer ranges and that a plugin failing right after a DSH upgrade should have its peer declarations checked first.

---

Release v0.3.5

兼容性

• 适配 DSH 0.1.7-rc.1 运行时：settings 服务在 0.1.7 被重写为 Loader 条目驱动——ctx.settings.register() 移除、命名空间改为 Loader 条目 id、Web 表单由条目 Config schema 的 volatile 字段投影。host 侧 lib/settings.js 不再注册或 opt-in 任何命名空间（0.1.7 的 autoGenerate 默认即 true；且在 inject 回调里调 configure() 会报 cannot create effect on inactive context），live 值改读 ctx.fiber.config——ctx.config 被 cordis 的 inject 守卫拦截（cannot get property "config" without inject），原写法会让整个 entry 激活失败；lib/meta.js 给全部可配置字段加 .volatile() 并把解析出的 cosmokit volatile 包装解包为纯值（unwrapVolatileConfig）。
• 设置面板迁移到新的插件列表页（lib/client.js）：原 settings.plugins.tab 页签（连同已删除的 settingsScope 服务）改为注册到插件列表页的 plugins.row.config 席位，key 为 @banana-peeljj12/dsh-trellis#trellis-workflow（即 rowConfigKey(<包名>, <patch 行 id>)）。表单改用官方 @deepseek-ai/dsh-client-ui-primitives 的 SettingsFormModel + SettingsForm + SettingsValueField，读写宿主共享的 configForms，条目 id 由 describe 镜像动态解析——bundle 的 insert: 行会被加载成 include:trellis-workflow 这类带前缀的 id，硬编码裸 id 会让门控永不开启、卡片渲染为空白（实测 occupants: []）；编辑暂存、单次保存、支持「已覆盖/恢复默认」。client 依赖改为真实存在的 0.1.7 包（移除已不存在的 @deepseek-ai/dsh-client-runtime，补 dsh-client-ui-plugin-manager/dsh-client-ui-workspace/dsh-client-ui-sidebar-right）。
• 插件配置 schema 必须以 Config（大写）声明（lib/index.js）：cordis 只把插件 schema 暴露在 runtime.Config，而 dsh-settings 的 describe() 正是读 entry.fiber.runtime.Config。原先的小写 config: SCHEMA 使该条目永远不会被 settings 收录——插件其余功能全部正常，唯独插件列表页的配置表单静默消失（渲染为「暂不可配置」）。改为 Config: SCHEMA 后条目被正常收录，volatile 字段也真正参与解析（默认值生效；值以 cosmokit volatile 包装到达 apply，由 unwrapVolatileConfig 解包）。
• system-prompt/assemble 取会话方式修正：0.1.7 的 AssembleContext 不再携带 agent，enforceReadonlyPlanning 改从 ctx.agents.currentInitiator() 解析当前会话 cwd，只读规划强制恢复生效。
• 安装器去除过时 harness 白名单补丁（scripts/install.mjs）：0.1.7 下 Web 设置经 remote.settings 到达，不再需要补丁 dsh-host-apiproxy 的 WEB_SETTINGS_NAMESPACES。
• peer/dev 依赖对齐 0.1.7-rc.1：@deepseek-ai/dsh-* 升至 ^0.1.7-rc.1，@deepseek-ai/cordis 升至 ^4.0.4，@deepseek-ai/schemastery 升至 ^3.18.4。

修复

• 只读规划强制（enforceReadonlyPlanning）恢复生效：此前因 context.agent 为空，cwd 解析恒失败、工具面裁剪从未执行；改为 currentInitiator() 后按授权状态正确裁剪 write/edit 与对应 trellis 工具。

---

Compatibility

• Adapt to the DSH 0.1.7-rc.1 runtime: the settings service was rewritten to be Loader-entry driven in 0.1.7 — ctx.settings.register() is gone, namespaces are now loader entry ids, and the Web form auto-projects the volatile fields of the entry's Config schema. On the host, lib/settings.js registers/opt-ins nothing at all (0.1.7's autoGenerate defaults to true, and calling configure() from an inject callback fails with "cannot create effect on inactive context"), and reads live values from ctx.fiber.config — ctx.config is guard-blocked by cordis ("cannot get property "config" without inject") and the original read made the whole entry fail to activate; lib/meta.js marks every configurable field .volatile() and unwraps the cosmokit volatile wrappers into plain values (unwrapVolatileConfig).
• The plugin config schema must be declared as Config (capital) (lib/index.js): cordis only exposes a plugin's schema at runtime.Config, which is exactly what dsh-settings' describe() reads (entry.fiber.runtime.Config). With the original lowercase config: SCHEMA the entry was never listed by settings — every other feature kept working, and only the Plugins-page form silently vanished ("not available"). Declaring Config: SCHEMA makes the entry listable, and the volatile fields then really take part in resolution (defaults apply; values reach apply as cosmokit volatile wrappers, unwrapped by unwrapVolatileConfig).
• Migrate the settings page into the new Plugins list (lib/client.js): the former settings.plugins.tab tab (along with the removed settingsScope service) now registers into the plugin list page's plugins.row.config seat, keyed @banana-peeljj12/dsh-trellis#trellis-workflow (= rowConfigKey(<package name>, <patch row id>)). The form uses the official @deepseek-ai/dsh-client-ui-primitives SettingsFormModel + SettingsForm + SettingsValueField, reading and writing the shared configForms; the entry id is resolved dynamically from the describe mirror — a bundle-inserted row is loaded as include:trellis-workflow, so a hard-coded bare id left the gate permanently closed and the card rendered blank (observed occupants: []). Edits are staged, written on one save, with "overridden / reset to default" support. Client dependencies switch to real 0.1.7 packages (drop the non-existent @deepseek-ai/dsh-client-runtime; add dsh-client-ui-plugin-manager / dsh-client-ui-workspace / dsh-client-ui-sidebar-right).
• Fix how system-prompt/assemble resolves the session: the 0.1.7 AssembleContext no longer carries agent; enforceReadonlyPlanning now resolves the current session cwd from ctx.agents.currentInitiator(), restoring read-only planning enforcement.
• Drop the obsolete harness allowlist patch from the installer (scripts/install.mjs): on 0.1.7 the Web settings form is reached via remote.settings, so patching dsh-host-apiproxy's WEB_SETTINGS_NAMESPACES is no longer required.
• Align peer/dev dependencies to 0.1.7-rc.1: @deepseek-ai/dsh-* to ^0.1.7-rc.1, @deepseek-ai/cordis to ^4.0.4, @deepseek-ai/schemastery to ^3.18.4.

Fixed

• Read-only planning enforcement (enforceReadonlyPlanning) works again: it previously never ran because context.agent was always undefined, so cwd resolution failed and the tool-surface trim never applied; with currentInitiator() it now trims write/edit and the matching trellis tools per authorization state.

---