dsh-plugin-observatory v0.1.0

Install the stable release from npm with dsh plugin --profile demo add dsh-plugin-observatory, or download the attached tarball and verify its SHA-256 checksum before adding it to a profile.

Version 0.1.0 is a stable release of Observatory. It provides bounded static plugin compatibility auditing, Loader lifecycle observation, hardened YAML patch traversal, explicit host-version detection, optional invariant-registry integration, and verified profile activation and removal.

This stable release is validated with @deepseek-ai/dsh 0.1.0-rc.6 on Node.js 22.19.0 and 24. Static compatibility findings do not establish arbitrary plugin execution safety.

dsh-plugin-observatory v0.1.0-rc.3

Install the prerelease from npm with dsh plugin --profile demo add dsh-plugin-observatory@next, or download the attached tarball and verify its SHA-256 checksum before adding it to a profile.

This release fixes profile activation when the optional invariant registry is absent. The companion now activates with Observatory, waits internally for the registry, and registers automatically if that service appears later. The package metadata marks @deepseek-ai/dsh-invariants as an optional peer, and the release gate now includes a real profile boot.

This release candidate is validated with @deepseek-ai/dsh 0.1.0-rc.6 on Node.js 22.19.0 and 24. Static compatibility findings do not establish arbitrary plugin execution safety.

dsh-plugin-observatory v0.1.0-rc.2

Install the prerelease from npm with dsh plugin --profile demo add dsh-plugin-observatory@next, or download the attached tarball and verify its SHA-256 checksum before adding it to a profile.

This release candidate is validated with @deepseek-ai/dsh 0.1.0-rc.6 on Node.js 22.19.0 and 24. Static compatibility findings do not establish arbitrary plugin execution safety.

dsh-plugin-observatory v0.1.0-rc.1

Highlights

• Adds static compatibility auditing for local DSH plugin bundles.
• Adds bounded Loader lifecycle observation and two model-facing audit tools.
• Hardens YAML patch traversal against cyclic aliases, excessive depth, and alias expansion.
• Resolves host DSH versions from the CLI package or a consistent set of mounted core packages.
• Preserves PluginAuditReport reportVersion 1 compatibility.

Validation

• Node.js 22.19.0 and 24
• @deepseek-ai/dsh 0.1.0-rc.6
• 22 unit and composition tests
• Coverage gates: statements 95%, branches 85%, functions 100%, lines 95%
• publint, pack dry-run, and real tarball/profile install-import-uninstall smoke test

Scope and limitations

This release candidate audits local plugin source and bounded host lifecycle behavior. It does not claim execution safety, registry or GitHub discovery, persistent history, Web UI, sandboxing, A/B replay, or token and latency attribution. Unknown host versions require review rather than being treated as verified compatibility.