v0.2.0 —— 命令行成为本体,Agent 可以驾驶
这一版是从命令行出发的一次重构，也是目前最大的一次升级。 工具从「一个带界面的启动器」变成了「一个 Agent 能驾驶、人看得见的命令行工具」。
一个本体，两个视图
上一版有两套门面：窗口一套逻辑，命令行一套逻辑，同一件事写了两遍。它们悄悄跑偏过——命令行起的沙箱，窗口当它不存在。
现在窗口是命令行的另一种视图：读走磁盘，写走命令。窗口每按一个按钮，都是起一个进程去敲你也能敲的那条命令。窗口没有任何命令行没有的能力，唯一的例外是「打开一个链接」，那不是对本工具拥有的东西做动作。
判据一句话：窗口关掉再打开，不丢任何东西。
Agent 可以驾驶，你看得见每一步
dsh-box attach # 我来开车
dsh-box detach # 交还
dsh-box memory # 上次接管期间做了什么（含被拒绝的）
dsh-box history # 这个数据目录里做过的所有事attach 之后，配置窗顶上出现一条蓝带，即将被动到的控件挂上编号，页面下方就地展开一份命令轨迹——每一步都渲染成你可以照着重跑的那行命令。做完了、被拒了、拒的理由是什么，都在上面。
锁在服务端，不在页面上。 Agent 开车期间，窗口发出的一切命令由服务端直接拒绝，只放行「停止并收回」。页面上的置灰因此退化成纯装饰：标错一个控件，最坏是它看起来能点、点了给句说明，再也变不成损害。
命令行本来就是给 Agent 准备的：有 --help，任何命令加 --json 就以 JSON 回话，失败也是 JSON，且带一个不会变的 code。所以这里不做常驻 HTTP API、也不做 MCP。
中英双语内置，随时切
dsh-box config lang en语言是这个数据目录的设置，不是页面偏好：命令行与配置窗一起变，帮助、错误、界面全盖。窗口右上角那个开关背后跑的就是这条命令——所以窗口仍然没有多出能力。没设过就跟系统语言走。
错误 code、旗标与命令名、写进你文件里的标记，永不翻译：它们是数据，不是话。
插件改成了档案柜的属性
不是「这次启动的选项」。插件装进哪个档案柜，就写进那个档案柜自己的配置，你自己敲 dsh 一样加载。--plugin 是加、--unplug 是减、不写就是什么都不改；想要纯官方的 dsh 就新建一个沙箱。
本地文件夹和 npm 上的包都能装。每次改动前先备份，plugins restore 整份还原；卸载要逐字节回到原样，是 hash 对，不是肉眼对。
两个词定案了
| 词 | 是什么 |
|---|---|
| 档案柜 | 一个 DSH_HOME。装对话、配置、登录。--sandbox 与 --main 说的都是它 |
| 工作区 | dsh 干活的那个项目文件夹。这是 dsh 官方的叫法 |
此前版本里的「工作区」多半指的是档案柜，命令行、帮助与界面已全部按新口径改过。
新增的命令
packages（看 dsh-box 替你下载的插件包、删、清没人用的）／history（持久操作记录）／workspaces（这个档案柜下次打开哪个项目文件夹）／plugins backups rm | prune／config reset（设置文件读坏时的逃生口）／quit（总退出）／adopt --from --to（对话在档案柜之间复制）。
修掉的两个真问题
新沙箱装任何一个插件，就再也起不来。 dsh 给新 profile 写的配置以 [] 结尾，我们在后面追加就成了第二份 YAML 文档，dsh 整份拒绝解析。Windows 与 Linux 同样中招。
两条 start --new 同时发，只造出一台沙箱。 取名是「先查后用」，两个进程查到同一个名字，于是两台 dsh 压在同一个档案柜上。
另外：某些环境（musl、Nix 编译的 Node、部分 arm64）上根本起不了 dsh，现在按「问这台 Node 自己能不能拿到内部加载器」来判断，而不是按平台猜。
验收
npm test 十一套，自己造一次性数据目录、跑完删掉，用几十行的 dsh 替身，不下包、不联网、不碰你真实的 ~/.dsh。本版在 Linux（aarch64 + musl） 上第一次实测通过。
下载
桌面版、便携包、.dmg、.deb、.AppImage 都在下方资产里，或者不装直接跑：
npx dsh-box@0.2.0 uimacOS 的 .dmg 仅 Apple Silicon。macOS 与 Linux 的安装包仍未有人实跑过，遇到问题请开 issue。
English
This release is a refactor that starts from the command line — the largest upgrade so far. The tool went from "a launcher with a window" to "a command-line tool an agent can drive while you watch."
One thing, two views. The previous version implemented every action twice, once in the window and once in the command line, and the two drifted: a sandbox started from the command line did not exist as far as the window was concerned. Now reads go to disk and writes go through a command — every button starts a process and runs the command you could have typed. The window has no capability the command line lacks. The test: close the window, open it again, and nothing is lost.
An agent can drive. attach / detach / memory / history. While an agent drives, a blue band crosses the top of the window, touched controls are numbered, and a trail of re-runnable commands unfolds below — what was done, what was refused, and why. The lock lives in the server, not on the page: every command the window sends is refused outright, only "stop and take back control" gets through. Greying-out is therefore decoration, and a mislabelled control can no longer become damage.
English is built in. config lang en — the language is a setting of the data directory, so the command line and the config window change together, help and errors included. Error codes, flags, command names and the markers written into your own files are never translated: they are data, not speech.
Plugins belong to the cabinet, not to the launch. Installed into a cabinet they stay, so typing dsh yourself loads them too. Local folders and npm packages both work; every change is backed up and uninstalling returns the file byte for byte, verified by hash.
Two words settled: a cabinet is one DSH_HOME (conversations, config, sign-in); a workspace is the project folder dsh works in, which is dsh's own term.
New commands: packages, history, workspaces, plugins backups rm | prune, config reset, quit, and adopt --from --to.
Two real bugs fixed: installing any plugin into a fresh sandbox made it unable to start ever again (our block turned the profile patch into a second YAML document, which dsh refuses wholesale); and two concurrent start --new produced only one sandbox, leaving two dsh processes on one cabinet. Also, environments where dsh could not start at all (musl, Nix-built Node, some arm64) are now detected by asking that Node whether it can reach the internal loader, rather than by guessing from the platform.
Verification: npm test runs eleven suites against a throwaway data directory and a small dsh stub — no downloads, no network, and it never touches your real ~/.dsh. This release is the first verified on Linux (aarch64 + musl).
Installers for all three platforms are in the assets below, or run it without installing: npx dsh-box@0.2.0 ui. The .dmg is Apple Silicon only. Nobody has yet run the macOS and Linux packages in anger — please open an issue if something breaks.