Codex-DSH-Orchestrator v0.1.0-alpha.6

Codex-DSH-Orchestrator connects Codex to the official DeepSeek Harness Desktop on Windows and macOS. Codex can delegate a bounded task, observe its result and continue the same DSH session.

Changes

• Add optional authenticated Gateway transport, Desktop discovery through owned loopback listeners and in-memory caller authorization.
• Provide operator-controlled Windows/macOS startup instructions and a native Windows pipeline. Keep approvals and Desktop lifecycle control with the user.
• Handle observation bursts with bounded backpressure and validate model catalogs, provider boundaries and advertised reasoning efforts.
• Update MCP SDK/Zod and reviewed transitive dependencies, with contract regressions.
• Add maintainer-author checks and squash-only contribution rules. Dependabot security updates remain enabled, with the original dependency PRs retained as provenance.

Validation

Windows and Apple Silicon Mac each completed an inherited read-only task and a same-root follow-up with unchanged workspace files. The tested Desktop installations were rc.2.

The released source passed all nine Ubuntu/Windows/macOS CI jobs with Node 22/24/26, in both public main and the private Review snapshot. Windows passed 308 tests; Ubuntu/macOS passed 307 with one Windows-only skip. Both public CodeQL analyses reported zero results, and the maintainer-author gate passed. One earlier Windows PR job exceeded a two-second mock-reconciliation wait and passed unchanged on a single-job retry.

Validation records distinguish runtime evidence from automated checks and list the tested builds.

Installation and limits

Follow the English or Chinese installation guide. Use Node.js 22+ and a stable tools directory. Review setup replacements and keep backups before updating an existing installation.

Caller authorization requires an operator-controlled launch of Desktop and Codex after active work has finished. Keep the startup terminal open; see the Gateway guide.

A real rc.3 product run, Intel Mac live parity and current native vision/ModLens execution remain unverified. Windows direct startup can use a separate taskbar group. Historical-task lock warnings require diagnosis; the bridge does not remove old locks automatically.

This MIT-licensed source release derives from dsh-Agentlink, with upstream LICENSE/NOTICE attribution retained. The npm package remains private.

Source: f68966db8471aa30513825364005f6805699beef.

Codex–DSH Orchestrator v0.1.0-alpha.4

Highlights

• Align package.json, package-lock root metadata, and runtime-reported version to 0.1.0-alpha.4.
• Add portability and installation-boundary guidance for fresh clones, Codex skill setup, Node.js 22/24 coverage, DSH_BRIDGE_HOME, and Windows desktop-auto.
• Preserve the upstream MIT license, copyright attribution, NOTICE, runtime package names, and compatibility identifiers.

Validation

• Local npm pack --dry-run --ignore-scripts passed.
• Local npm run check passed: 176/176 tests.
• Private Review CI #11 passed on Ubuntu/Windows × Node.js 22/24.
• Public merge CI #12 passed on Ubuntu/Windows × Node.js 22/24.
• Public CodeQL / Push on main run #7 passed for Actions and JavaScript/TypeScript.

Scope and limitations

• This is a prerelease source release; no npm package was published and package.json remains private.
• Clean-build CI and package dry-run do not claim fresh-machine Codex skill installation or live DSH Desktop/login/plugin end-to-end acceptance.
• The existing v0.1.0-alpha.3 tag and release remain unchanged.

Codex–DSH Orchestrator v0.1.0-alpha.3

Summary

• Public maintenance release after the initial v0.1.0-alpha.2 source snapshot.
• Removes the stale !.env.example exception from .gitignore.
• Retains the upstream dsh-Agentlink MIT license, copyright, and NOTICE attribution.

Validation

• GitHub Actions CI: passed
• CodeQL workflow: passed
• Local npm run check: 176/176 tests passed
• npm pack --dry-run: passed

Distribution

• This is a GitHub source release only.
• npm publication is not included; the package remains private.

Known issues

• Two CodeQL js/stack-trace-exposure alerts remain in test-only mock helpers; they were reviewed and intentionally left open.