v0.2.10 [DSH v0.2.0-rc.2]

Highlights / Главное / 亮点

Reliability & Core Lifecycle / Надежность и жизненный цикл ядра / 稳定性与核心生命周期

• Handoff Summary URL Initialization (#73):
  • Fixed an unhandled ReferenceError: url is not defined in /dsh-session-control/handoff-summary. When requests omit body.workspace, the handler now cleanly resolves the workspace context from URL search parameters (?workspace=...) or X-Dsh-Workspace header, preventing HTTP 500 errors.
• Dead Config Listener Cleaned Up (#73):
  • Removed dead ctx.on(\x27config\x27) subscription in plugin initialization, relying purely on the canonical loader/volatile-update lifecycle and lazy plainConfig evaluation.
• Test Coverage Expansion (#73):
  • Added unit test suite in test/workspace-isolation.test.mjs verifying workspace parameter resolution over URL search params and query strings for /handoff-summary.

---

Verification

• npm test: 95/95 tests passing.
• dsh-plugin-preflight: FAIL=0, WARN=3.
• Proven compatibility with DSH v0.2.0-rc.2.

v0.2.9 [DSH v0.2.0-rc.2]

Highlights / Главное / 亮点

Security & Containment / Безопасность и изоляция / 安全与边界隔离

• Workspace Boundary Isolation (#69): Enforces strict session ownership checks across all 6 server endpoints (/transcript, /titles, /export-batch, /sizes, /handoff, /handoff-summary) using host workspace services and registries. Reading transcripts and batch exports require an explicit workspace context (workspace param, X-Dsh-Workspace header, or body field) and reject foreign session traversal with HTTP 403 Forbidden. Export batch is strictly bounded to 50 items and validates every session ID.
• Connection Rejection Normalization (#67): Normalizes host connection.requestRejection(req) return values in lib/guard.js to valid integer HTTP status codes (401/403/5xx), eliminating TypeError: The "statusCode" argument must be an integer when non-numeric rejections are returned by core or proxy layers.
• English Profile Layer Patch Comments (#70): Translated Russian comments in cordis.patch.yml to English, achieving strict zero-Cyrillic policy across published package artifacts.

---

Verification

• npm test: 95/95 tests passing.
• dsh-plugin-preflight: FAIL=0, WARN=3.
• Proven compatibility with DSH v0.2.0-rc.2.

v0.2.8 [DSH v0.2.0-rc.2]

English

Highlights

• Fixed compatibility with DeepSeek Harness 0.2.0 settings architecture: removed obsolete sctx.settings.register call preventing TypeError on startup (#64, #66, #68).
• Added .volatile() markers across all user-configurable fields in Config schema, ensuring settings forms remain accessible and editable in DSH SettingsForms (#64).
• Added lazy plainConfig unwrapping for live setting reads without requiring host restarts (#64).
• Declared configForms in browser half exports.inject and transitioned slot registration to whileServed (#64, #68).
• Removed retired slot settings.plugin.item (#64, #68).

中文

亮点

• 修复与 DeepSeek Harness 0.2.0 设置架构的兼容性：移除废弃的 sctx.settings.register 调用，防止启动时报 TypeError（#64, #66, #68）。
• 在 Config 架构中为所有用户可配置字段添加 .volatile() 标记，确保设置表单在 DSH SettingsForms 中可用且可编辑（#64）。
• 添加延迟 plainConfig 解包，无需重启宿主即可动态读取最新设置（#64）。
• 在浏览器端 exports.inject 中声明 configForms，并将卡片注册转移到 whileServed（#64, #68）。
• 移除已废弃的插槽 settings.plugin.item（#64, #68）。

Русский

Основные изменения

• Совместимость с архитектурой настроек DSH 0.2.0: удален вызов несуществующего метода sctx.settings.register(...), устраняя ошибку TypeError: sctx.settings.register is not a function при активации (#64, #66, #68).
• Добавлен модификатор .volatile() ко всем пользовательским полям схемы Config, предотвращая постоянный статус unavailable в SettingsForms (#64).
• Добавлено ленивое разворачивание volatile-значений через plainConfig для реактивного применения настроек без рестарта рантайма (#64).
• Сервис configForms добавлен в exports.inject на клиенте, регистрация карточек переведена на whileServed (#64, #68).
• Удалена регистрация в снятом слоте settings.plugin.item (#64, #68).

v0.2.7 — Security hardening, safe connection resolution, preflight gate

Release v0.2.7

Security

• Fail-Closed Route Authentication: External (non-loopback) requests reject forged browser headers (Sec-Fetch-Site: same-origin, matching Origin & Host, and unverified regex cookie patterns dsh-auth-*). Route admission delegates to canonical DSH connection.requestRejection(req) or matching Bearer authorization secrets; unauthorized requests fail closed with 403 Forbidden or 401 Unauthorized (#57).

Fixed

• Safe Cordis Connection Resolution: Safe reflection helper for optional connection service preventing Cordis proxy errors in diverse runtime configurations.
• Preflight Gate & Diagnostic Logging: Eliminated all empty catch blocks in client codebase by adding diagnostic logging to console.warn for storage sync, config service failures, and session forking; verified dsh-plugin-preflight passes with FAIL=0 (#61).
• Client Updater Target: Settings card updater target aligned to 0.2.7.

Verification & Provenance

• 82 automated test cases passing (npm test).
• Mandatory preflight: FAIL=0, WARN=3.
• 0 Cyrillic characters in runtime code.
• Gitea source commit: 5d25f06
• GitHub mirror commit: 4a8abbe

v0.2.6 — Enforce core connection auth and eliminate empty catches

Release v0.2.6

Security

• Fail-Closed Route Authentication: External (non-loopback) requests reject forged browser headers (Sec-Fetch-Site: same-origin, matching Origin & Host, and unverified regex cookie patterns dsh-auth-*). Route admission delegates to canonical DSH connection.requestRejection(req) or matching Bearer authorization secrets; unauthorized requests fail closed with 403 Forbidden or 401 Unauthorized (#57).

Fixed

• Preflight Gate & Diagnostic Logging: Eliminated all empty catch blocks in client codebase by adding diagnostic logging to console.warn for storage sync, config service failures, and session forking; verified dsh-plugin-preflight passes with FAIL=0 (#61).
• Client Updater Target: Settings card updater target aligned to 0.2.6.

Verification & Provenance

• 82 automated test cases passing (npm test).
• Mandatory preflight: FAIL=0, WARN=3.
• 0 Cyrillic characters in runtime code.
• Gitea source commit: 630faf6
• GitHub mirror commit: f584a7d

v0.2.5 — Local settings fallback, security hardening, title batching and transcript handling

Release v0.2.5

Fixed

• Seamless localStorage Fallback for Settings: When accessed over LAN or through a proxy where host configuration forms are in memory mode, settings (pins, hidden, labels, size thresholds) gracefully persist and read from localStorage, eliminating the degraded banner and preserving full functionality for remote clients.
• Route Origin Hardening: Reject explicit Sec-Fetch-Site: cross-site requests even from loopback IP; reject unverified arbitrary bearer tokens and cookies.
• Session Title Batching & Cache Integrity: Title batching capped to 30 items per request, unreturned session IDs cleared from pending state to avoid starvation, empty titles excluded from persistent in-memory cache (#53).
• Distinguish Empty Sessions from Unreadable Logs: Empty sessions return { empty: true, unreadable: false } instead of treating empty logs as corrupted, rendering a proper empty state (#54).
• Derived Title Search: Search filter now includes client-derived session titles alongside native session titles (#55).
• Session Export & Documentation: Added Content-Disposition: attachment header to batch markdown export, updated updater target version to 0.2.5, documented offline transcript analyzer (#56).

Verification

• 77 unit and integration tests passing (npm test).
• Verified against production DSH profile web on MiniAI.

v0.2.3

Full Changelog: v0.2.1...v0.2.3

v0.2.2

Full Changelog: v0.2.1...v0.2.2

v0.2.1 — DSH alpha2 session navigation, fail-closed route guard, and worktree isolation

Что нового в v0.2.1

Данный релиз обеспечивает полную совместимость плагина с контрактом DSH alpha2 (0.1.6-alpha.2), внедряет строгую fail-closed защиту серверных маршрутов чтения расшифровок и изолирует каталоги рабочих деревьев в git.

Исправления и улучшения

1. Совместимость с ядром DSH alpha2 (0.1.6-alpha.2) (#46)

   • Переведена навигация, открытие и очистка сессий на современный контракт ядра: методы replaceMain, clearMain, openSession, openWorkspace, forkSession теперь корректно удерживают активную сессию через аренду { source: 'mainView' } и отслеживают состояние через снимок dsh.sessions.current.
   • Устранены устаревшие вызовы sessions.open(id) и sessions.clear().
   • Индикатор активной строки в боковой панели SessionListPanel переведен на наблюдение retainedBy.mainView > 0.
   • Подключен сервис @deepseek-ai/dsh-client-ui-layout для обработки сигналов отмены переходов.

2. Строгая Fail-Closed защита маршрутов чтения (#33)

   • Реализована централизованная защита маршрутов /dsh-session-control/transcript, titles, export-batch, sizes, handoff, handoff-summary через модуль lib/guard.js.
   • Доступ разрешен только для loopback-интерфейса (127.0.0.1, ::1, localhost), валидного Bearer-токена, cookie сессии (token=/dsh_token=), либо браузерного same-origin контекста.
   • Любые неавторизованные внешние запросы отклоняются с кодом 403 Forbidden (untrusted request origin).
   • Ограничены HTTP-методы: маршруты чтения требуют GET, маршрут суммаризации — POST. Нарушение возвращает 405 Method Not Allowed с заголовком Allow.
   • Исключена утечка сессий при выставлении хоста в локальную сеть через dsh-lanmode (defense-in-depth).

3. Изоляция рабочих деревьев и артефактов в .gitignore (#47)

   • Каталоги .worktrees/, .planning/, docs/plans/, docs/superpowers/, coverage/ и *.log зафиксированы в .gitignore.

Проверки и верификация

• Unit-тесты: 66/66 тестов успешно пройдены (npm test).
• Preflight: FAIL=0, WARN=0.
• Тестовый сервер (MiniPC): полный цикл установки, валидация маршрутов (HTTP 200 / 405), чистое удаление.
• Пакет: @goodandready/dsh-session-control@0.2.1 опубликован в npm. Packed size: 66.6 КБ.

v0.2.0 — Session Sizes, Handoffs, Plugin Updater, and Quality Hardening

Added

• Session Size Badges: Warning (yellow) and danger (red) indicators based on event counts, preventing client browser tab hangs on unvirtualized chat lists (#39).
• Size Thresholds: Configurable thresholds sizeWarnEvents (default 1500) and sizeDangerEvents (default 3000) in settings card (#39).
• Session Handoff: Instant conversation handoff ("Continue in new session") via draft staging into conversation.input.dock (#40).
• Model-Assisted Summary: Optional model-written handoff summary with configurable provider, model, token budget, and custom prompt (#41).
• In-App Updater: Built-in one-click plugin updater from settings card via /api/dsh-session-control/update (#32).
• HTTP Endpoints: /dsh-session-control/sizes, /dsh-session-control/handoff, /dsh-session-control/handoff-summary, /api/dsh-session-control/update.
• Expanded Test Suite: Full test coverage for route limits, size calculations, handoff extracts, and plugin updater (55 tests, 100% pass) (#36).

Changed & Hardened

• Package Identity: Aligned to fully qualified scoped name @goodandready/dsh-session-control across all manifests and exports (#31).
• Security Guards: Added fail-closed route guards enforcing HTTP methods (405) and sec-fetch-site validation (403) across all endpoints (#33).
• Theme Variables: Replaced hardcoded CSS colors with native theme variables and color-mix for seamless light/dark mode adaptation (#38).
• Language & Cleanliness: Translated all internal code comments to English and added regression test enforcing zero Cyrillic characters in codebase (#34).
• Architecture: Formalized single-bundle zero-build architecture decision for lib/client.js in design contract (#37).