v0.2.30 [DSH v0.2.1-rc.2]

Security & Bug Fixes

• LAN Authentication Bypass & Critical Endpoint Fencing (#384):
  • Eliminated authentication bypass where LAN clients forging Sec-Fetch-Site: same-origin or without credentials could reach /dsh-kanban/batch to execute agent sessions with arbitrary prompt text, as well as read session lists and mutate project tasks.
  • Implemented getRejectionStatus(req, options) and rejectUntrustedRequest(req, res, options) in lib/routes.js, integrating DSH session authentication via ctx.connection.requestRejection(req).
  • Non-loopback calls (including LAN and remote IP addresses) require valid DSH session authentication; unauthenticated requests fail-closed with HTTP 401 Unauthorized.
  • Socket calls with unknown remote addresses fail-closed with HTTP 403 Forbidden.
  • Fenced all 19 plugin HTTP endpoints and the SSE events stream with dynamic connection resolution.
  • Added connection session verification to lib/updater.js.
  • Updated Request Trust Policy in docs/design/DESIGN.md and added test coverage in test/routes.test.mjs and test/index-load.test.mjs.

Verification & Compatibility

• Verified on DeepSeek Harness v0.2.1-rc.2.
• 775 automated tests passing (100% pass, 0 regressions).

v0.2.29

Fixed

• Agent Prompt & Board Tools Availability Alignment (#1):
  • Replaced unconditional system prompt injection with dynamic helper buildPromptSectionText(cfg).
  • Suppressed prompt section on stock configurations where neither board tools nor progress dumps are active (boardToolEnabled: false, progressDumpEnabled: false), preventing model hallucinations and saving context tokens.
  • Strictly gated tool usage guidance (board_move, board_plan) on boardToolEnabled === true.
  • Gated PROGRESSDUMP guidance on progressDumpEnabled === true.
  • Updated CONFIG_HINTS.announceToAgent description in lib/config.js.

v0.2.16 - SQLite Database and Backup Permissions Hardening

🇬🇧 English

Highlights in v0.2.16

• Database & Backup Filesystem Permissions Hardening: Enforced strict 0700 (rwx------) permissions on the task store directory and backups/ directory, and 0600 (rw-------) on all SQLite database, WAL, SHM, and backup files (lib/store.js).
• Automatic Legacy Repair: Added automatic filesystem permission remediation during openStore before serving any HTTP routes, preventing local data exposure from legacy 0755/0644 directories and files.
• Backup Isolation: Backups created by store.backupDatabase() are isolated into a 0700 directory with 0600 file permissions.

---

🇨🇳 中文

v0.2.16 更新亮点

• 数据库与备份文件权限加固：对任务存储目录及 backups/ 目录强制执行 0700（rwx------）权限，对所有 SQLite 数据库、WAL、SHM 及备份文件强制执行 0600（rw-------）权限（lib/store.js）。
• 旧版安装自动修复：在 openStore 初始化阶段、对外提供任何 HTTP 路由服务之前，自动检测并修复历史遗留的 0755/0644 权限，杜绝本地数据泄露。
• 备份文件隔离：由 store.backupDatabase() 创建的备份自动存放于 0700 目录中，且文件权限设为 0600。

---

🇷🇺 Русский

Главные изменения в v0.2.16

• Ужесточение прав доступа к SQLite и резервным копиям: Каталог базы задач <DSH_HOME>/kanban и подкаталог backups/ создаются и принудительно ограничиваются правами 0700 (rwx------), а файлы базы (kanban.db, kanban.db-wal, kanban.db-shm) и файлы бэкапов — правами 0600 (rw-------).
• Автоматическая починка существующих установок: При открытии хранилища (openStore) до запуска HTTP-маршрутов существующие директории и файлы с правами 0755/0644 автоматически приводятся к безопасным 0700/0600, предотвращая локальную утечку данных задач и промптов другим пользователям ОС (#298).
• Изоляция бэкапов: Все резервные копии, создаваемые в backupDatabase(), гарантированно изолируются правами 0700/0600.

---

Release Details:

• Gitea commit: 221be5357d7208de5d72bc8b7054d01f1272a7c7
• Mirror commit: 70eaf1302c2f7d2f6b538e825075f1feb35ac484

v0.2.15 - Full GitHub Integration and Multi-Forge Support

🇬🇧 English

Highlights in v0.2.15

• Full GitHub Integration: Native GitHub REST API v3 client (lib/github.js) with conditional ETag caching (If-None-Match / HTTP 304), protecting GitHub API rate limits.
• Composite Git Provider: Seamless routing between Gitea and GitHub via lib/git-provider.js based on task provider, issue URL, or configuration (auto, gitea, github).
• Dual Webhook Verification: Unified webhook listener supporting GitHub HMAC-SHA256 signatures (x-hub-signature-256, sha256=) and Gitea hex signatures.
• Multi-Forge Settings & Badges: Settings schema and UI card with live forge connection status (GitHub Configured / No Token) and credential reference management.
• Multi-Forge SQLite Storage: SQLite storage schema updated with provider tracking and github task sources.

---

🇨🇳 中文

v0.2.15 更新亮点

• 完整的 GitHub 深度集成：内置原生 GitHub REST API v3 客户端（lib/github.js），支持条件 ETag 缓存（If-None-Match / HTTP 304），有效保护 5000 次/小时的速率限制。
• 复合 Git 平台路由器：通过 lib/git-provider.js 统一路由 Gitea 与 GitHub 操作，根据任务归属、Issue URL 或配置（auto、gitea、github）无缝切换。
• 双向 Webhook 验证：全面支持 GitHub HMAC-SHA256 签名（x-hub-signature-256、sha256=）及 Gitea hex 签名。
• 多平台配置与状态徽章：设置卡片新增 Git 平台与 GitHub 配置项，实时显示连接状态（GitHub Configured），并通过 DSH 凭据系统安全管理令牌。
• 多平台 SQLite 存储：任务存储模型新增 provider 字段及 github 任务来源支持。

---

🇷🇺 Русский

Главные изменения в v0.2.15

• Полноценная интеграция с GitHub: Встроенный клиент GitHub REST API v3 (lib/github.js) с ETag-кэшированием (If-None-Match / HTTP 304) для защиты лимитов GitHub API (5000 запросов/час).
• Композитный Git-провайдер: Роутер lib/git-provider.js для прозрачного переключения между Gitea и GitHub по провайдеру задачи, URL issue или режиму (auto, gitea, github).
• Двойная проверка вебхуков: Единый приёмник вебхуков с поддержкой HMAC-SHA256 подписи GitHub (x-hub-signature-256, sha256=) и hex-подписи Gitea.
• Настройки и статусные бейджи: Секция настроек Git Forge и GitHub в карточке настроек со статусом готовности (GitHub Configured / No Token).
• Хранилище SQLite: Поддержка поля provider и источника задач github в базе данных задач и импорте.

---

Release Details:

• Gitea commit: 193d77d1e79b7bf0d944f5999d6e0fe5f4e1bc6d
• Mirror commit: 21bba650328988e2b9025e6e675e28b29cb98d0a

v0.2.12

English

Settings no longer wait on the removed settingsScope service. The client reads its namespace from configForms.

中文

设置不再等待已移除的 settingsScope 服务。客户端通过 configForms 读取自己的命名空间。

Русский

Настройки больше не ждут удалённый сервис settingsScope. Клиент читает свой namespace через configForms.

v0.2.11

Full Changelog: v0.2.9...v0.2.11

v0.2.10

Full Changelog: v0.2.9...v0.2.10

v0.2.7 — Vector 5 Suite: Epic Triage, Atomic DoD, Quick Filters, Live Console & One-Click PR

What's Changed in v0.2.7 (Vector 5 Suite)

1. Epic Triage & Task Decomposition (#248)

• Added database schema migration and store queries for parentId and isEpic.
• Added endpoints POST /task/:id/triage, GET /task/:id/subtasks, POST /task/:id/subtask.
• Added board_decompose tool for autonomous agent planning and breakdown.
• Visual Epic cards with Epic badge, subtask counts ({done}/{total}), progress bars, and dedicated Subtasks panel in Task Drawer.

2. Atomic DoD Checklist Tool (#248)

• Added POST /task/:id/checklist-toggle and board_checklist_item agent tool for atomic DoD item toggling by text substring or index.

3. Live Monospace Agent Console (#248)

• Monospace dark-themed live terminal view in Task Drawer for active in-progress agent sessions.

4. Quick Filter Bar (#248)

• Segmented filter chips on the main toolbar: All, Active, Review, Epics, Silent for instant client-side filtering.

5. One-Click Gitea PR Integration (#248)

• Added createPullRequest in Gitea client, POST /task/:id/pr endpoint, and one-click PR button with link in Review Acceptance Gate.

6. Reliability & Bugfixes (#250, #252)

• Fixed ReferenceError: MAX_BODY_BYTES is not defined on POST body read (#250).
• Fixed ReferenceError: defineTool is not defined when boardToolEnabled: true (#252).
• Unit tests: 670 / 670 passing (100%).
• Full core compatibility verified.

v0.1.35

Release Vector 4 (Operator UX, Reasoning Effort, CSV Export, Adaptive Rail)

• #217: Reasoning effort selector (low, medium, high) for reasoning models (DeepSeek-R1, OpenAI o1/o3).
• #218: Autocomplete slash commands and skills in prompt fields.
• #221: Clickable Markdown image previews and full-screen lightbox modal in TaskDrawer.
• #223: Excel-compatible CSV export with UTF-8 BOM (/dsh-kanban/export.csv).
• #228: Adaptive 36x36 rail icon geometry when left sidebar is collapsed.

v0.1.34

Release Vector 3 (In-Drawer Git Diff & Commit Viewer, One-Click Worktree Merge)

• #211: Integrated commit history and unified diff viewer inside TaskDrawer (GET /tasks/:id/diff, GET /tasks/:id/commits).
• #212: One-click worktree branch merge upon acceptance (--no-ff) with automated cleanup (POST /tasks/:id/merge).