v0.2.26 [DSH v0.2.0-rc.2]

Fixed & Hardened (Critical Security Hotfix: Connection Authentication & Fail-Closed Boundary)

• Canonical DSH Connection Authentication Gate (#172): Integrated ctx.connection.requestRejection(req) in getRequestRejection across all plugin HTTP and SSE endpoints, delegating session authentication to DSH core cookie session engine.
• Fail-Closed LAN Authentication Boundary (#172): Eliminated unauthenticated LAN access shortcut. Unauthenticated remote LAN callers lacking valid DSH browser session or explicit auth token are rejected fail-closed with HTTP 401 Unauthorized or 403 Forbidden.
• Loopback & Token Exemption Preservation (#172): Retained loopback peer validation (127.0.0.1, ::1) for local CLI monitoring and deployment verification (deploy.sh verify web); preserved explicit auth token support.
• CSRF & DNS Rebinding Secondary Defense (#172): Maintained secondary CSRF defense and strict private host validation.
• Design Contract & Security Suite (#172): Updated docs/design/DESIGN.md Section 5.1 and expanded test suites to 100% pass across all 138 tests.

Gitea commit: dff03ed
Mirror commit: be62419

v0.2.25 [DSH v0.2.0-rc.2]

Release Purpose

Hardens caller trust verification against DNS rebinding attacks and external WAN clients by enforcing private host validation.

What Changed & Why

• DNS Rebinding Guard (#160): Added isTrustedHost helper verifying hostnames and IP addresses against local loopback (127.0.0.0/8, ::1), RFC1918 private subnets (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), and local domains (.local, .lan, localhost).
• Fail-Closed Private Host Enforcing (#160): isTrustedCaller in lib/routes.js now validates that remoteAddress, Host, and parsed Origin/Referer belong to trusted private hosts. External WAN callers and public domain names (e.g. evil.com pointing to a local IP) are rejected fail-closed (403 Forbidden).
• Security Architecture Contract (#160): Updated docs/design/DESIGN.md section 5.1 detailing DNS rebinding prevention and WAN IP filtering.
• Security Regression Suite (#160): Added unit test cases in test/security-sanitization-batch.test.mjs verifying isTrustedHost across IP subnets, loopback formats, and blocking simulated DNS rebinding attacks.

User & Service Impact

• Operators accessing DeepSeek Harness via browser on local LAN or loopback continue to function seamlessly.
• Mitigates unauthorized execution of state-changing routes (rollback_milestone, clear, autonomous runs) via malicious web pages attempting DNS rebinding.

Compatibility

• Tested with DeepSeek Harness v0.2.0-rc.2 (compatible with 0.1.7 and 0.2.0 lines).

Verification

• npm test: 137/137 tests pass (0 failures).
• deploy.sh check: preflight FAIL=0, client bundle drift check passed.

Commit Correspondence

• Gitea commit: d9ceeb10dae1341f13d58bf3a9af732c58d9b068
• Mirror commit: 7cea7cb079830534459a64673a602c1d475d8132

v0.2.24 [DSH v0.2.0-rc.2]

Release Purpose

Resolves Git branch merge/discard checkout regression and restores comprehensive unit test coverage for all 10 client settings fields.

What Changed & Why

• Git Branch Checkout Fix (#157): Removed erroneous -- before targetBranch in git checkout <targetBranch> inside mergeGoalBranch and discardGoalBranch (lib/engine-git-branch.js). In Git, -- forces arguments to be interpreted as file pathspecs rather than branch refs, which previously caused merge/discard actions to fail with exit code 1.
• Root Confinement & Deprecation Fix (#157): Forwarded allowedRoots to isGitRepository and getSafeCwd and added null-checks before fs.existsSync, eliminating DEP0187 deprecation warnings.
• Git Branch Lifecycle Test (#157): Added test/git-branch-lifecycle.test.mjs verifying branch creation, commits, merge into main, and branch discard on a real temporary Git repository.
• Client Settings Form Tests (#158, #145): Restored test/card-form.test.mjs testing src/client/80-settings-logic.js across all 10 canonical settings fields (DEFAULT_SETTINGS, parseNumberField, getFieldStatus, computeSavePlan).
• LAN Caller Trust & Auth Token Support (#158, #148): Added optional authToken (DSH_GOAL_AUTH_TOKEN / x-dsh-auth-token / Authorization: Bearer) support to isTrustedCaller in lib/routes.js and documented the LAN same-origin operator UI security trade-off in docs/design/DESIGN.md.

User & Service Impact

• Goal branch merge and discard operations from the UI and REST API now complete reliably without 500 errors.
• Zero breaking changes or configuration migrations required.

Compatibility

• Tested with DeepSeek Harness v0.2.0-rc.2 (compatible with 0.1.7 and 0.2.0 lines).

Verification

• npm test: 136/136 tests pass (0 failures).
• deploy.sh check: preflight FAIL=0, client bundle drift check passed.

Commit Correspondence

• Gitea commit: aaab732c784367daff472da33839708ebf86762a
• Mirror commit: d5a036b3a4e4f76ca72444426f6cf817d940a285

v0.2.23: Client decomposition and build drift verification

Release v0.2.23 decomposes monolithic client.js into 12 single-responsibility modules in src/client/, adds scripts/build-client.mjs with drift check, and adds regression tests (#150).

Correspondence:

• Gitea commit: ad185a1
• Mirror commit: 79e498b

v0.2.22: Repository hygiene and dead code elimination

Release v0.2.22 removes dead legacy modules, resolves peerDependencies self-referencing, and establishes DEV navigation standards (#149, #147, #131, #151).

Correspondence:

• Gitea commit: 4b4e30c
• Mirror commit: c682d1a

v0.2.21: Runtime logic and engine integrity fixes

Release v0.2.21 resolves runtime logic, callback wiring, and state integrity issues (#127, #129, #130, #132, #133, #134, #135, #136, #137, #138, #139, #140, #141, #142, #143).

Correspondence:

• Gitea commit: 19c80d5
• Mirror commit: ed6783b

v0.2.20: Security and sanitization fixes

Release v0.2.20 includes fixes for credentials leaks, host header validation, origin spoofing, and git ref sanitization (#120, #122, #123, #124, #125, #126, #144, #148). Mirror commit: 3d1ee60

v0.2.19: Security & Sanitization Batch

Fixed & Hardened (Security & Sanitization Batch)

• Credential Path & Host Sanitation (#120, #126): Purged hardcoded developer credentials path (/mnt/external/...) and default internal port 3005 from lib/engine-issue-sync.js; credentials and baseUrl are now resolved strictly via environment variables or explicit options; removed fallback default repository name.
• Fail-Closed Caller Trust & Anti-Spoofing (#122, #144, #148): Hardened isTrustedCaller in lib/routes.js to reject non-browser LAN clients spoofing Origin/Host headers without browser Sec-Fetch-Site: same-origin; requests permitted strictly for loopback clients or verified same-origin browser operator UI.
• Git Ref & Branch Sanitization (#123): Added isValidGitRef to reject flag injection (-f, --upload-pack), path traversal (..), and invalid characters in git operations; added isValidGitRef check to branch_action HTTP route (400 Bad Request); added -- separator before refs in git commands.
• Working Directory Confinement & Tool Milestone Signature (#124, #128): Enforced safe cwd resolution via getSafeCwd across goal-start, tools, and git branch helpers; corrected completeMilestone invocation in lib/tools.js to pass notes and workspaceRoot as distinct arguments.
• Safe Milestone Checkpoints (#125): Replaced git add -A with git add -u in lib/engine-reports.js to prevent staging untracked files or secrets; purged banned --no-verify flag from milestone checkpoint commits.

Correspondence:

• Gitea commit: 78d9e57
• GitHub commit: 4ac828b

v0.2.18: Settings Data Loss & Volatile Fix Batch

Fixed & Hardened (Settings Data Loss & Schemastery Volatile Batch)

• Volatile Schema Data Loss (#117): Added runtime polyfill fallback for Schema.prototype.volatile and defensive config unwrapping, preventing DSH 0.2 from silently dropping plugin settings.
• Schemastery Boxed Objects unwrapping (#121): Sanitized boxed Schemastery primitives at runtime entry and inside applySettings, preventing boolean flags from forcing true and numbers from remaining boxed objects.
• Settings Save Plan Coverage (#145): Synchronized computeSavePlan and getFieldStatus across all 9 plugin configuration keys (maxTokenBudget, budgetWarningThreshold, autoCheckpointOnMilestone, etc.) so client configuration updates apply cleanly.
• Card Form State Synchronization (#146): Unified form definitions between lib/card-form-state.js and lib/client.js, eliminating duplicate and diverging state management logic.

Correspondence:

• Gitea commit: 3d02966
• GitHub commit: 36160f2

v0.2.14

Fixed

• Cordis optional service resolution: removed unsupported optional syntax goals? from top-level inject array.
• Safe service resolution: added safeService(ctx, name) using ctx.reflect.get(name, false) for ctx.goals, ctx.agents, and ctx.tokenMeter.
• Peer dependencies: marked @deepseek-ai/dsh-goal optional in peerDependenciesMeta.