DSH Live Voice v0.3.0-preview.3

DSH Live Voice v0.3.0-preview.3

This maintenance preview fixes an exact-Session lifecycle isolation bug in
v0.3.0-preview.2. In DSH client-side navigation, both voice controls could
unmount while the shared controller kept the old Session's socket, browser
capture path, playback, provider turn, and transient state alive. Upgrade
preview.2 installations to this release.

What changed

• Added exact-Session UI leases. Commit-phase unmount releases the final lease
  and schedules same-turn teardown before the next browser task, while remaining
  safe under React StrictMode/HMR replay.
• Added parent/fork-child SessionStore and manual-turn isolation regressions.
• Added an exact-alpha browser regression that switches away from an active
  Session without pagehide and verifies stopped capture, socket, provider,
  and post-cleanup audio before fresh consent in the newly mounted Session.
• Adapted the proof harness to alpha's browser-token authentication,
  remote.mux, Lexical composer, and authenticated nested Session creation.
• Admitted only the source-verified DSH 0.1.2-alpha.1 package graph alongside
  the existing rc line. Later alpha builds are not inferred.
• Narrowed the Node range to Node 22.19 or newer within 22.x, or Node 24.12+;
  the current upstream Web loader fails on Node 24.0 through 24.11.1.

Verified on the exact release commit

Release commit: 10bd8bf504cf17fb24523f2c18e9f8a586a41167

• Node 22.22.2 and Node 24.19.0: both full checks passed with 21 test files / 221
  tests, both TypeScript programs, script checks, Host/client builds, package
  lint, and the 27-file package inventory. The existing non-failing CJS/ESM
  package advisory remains.
• Clean source-built DSH dsh-v0.1.2-alpha.1 at
  cd5ef8148158c3a752a658978873241fdf8e2bbc: authenticated official Web UI,
  real BFCache restore, DSH stream reconnection, active Session A-to-B SPA
  switch, old capture/socket/provider teardown, fresh Session consent, and no
  post-cleanup audio all passed. The run used Chrome 151, Playwright 1.61.1,
  synthetic Web Audio, and a deterministic loopback provider.
• Clean source-built DSH dsh-v0.1.1-rc.2 at
  b150a551b8d465e31e418e1b2eaf5e79bbb7d28e: packed official-CLI composition
  completed exact workspace/Session binding, disclosure, bounded input/output,
  both final transcripts, completed turn, and provider socket disposal.
• Independent exact-diff review found no remaining blocker. The release branch
  excludes the separate, unverified post-preview.2 Desktop-canary work.

Install or upgrade

dsh plugin --profile web add github:Jstn-1g/dsh-live-voice#v0.3.0-preview.3

Restart the Web profile after installation.

Important limitations

This remains a safety-first experimental preview for one bounded manual turn.
Credential-backed Qwen, a live provider, physical microphone/speaker and OS
indicator behavior, packaged Desktop, and file:// + IPC transport remain
unverified. Continuous conversation, barge-in, automatic submission, tool
execution, history export, marketplace readiness, official endorsement, broad
alpha compatibility, and ChatGPT Live parity are not claimed.

Tarball SHA-256:
016ce06f37e635413734cdb2aa814d1714651b92ff8ac92306bd56dfd64af33d

DSH Live Voice v0.3.0-preview.2

DSH Live Voice v0.3.0-preview.2

This is an experimental, safety-first preview of live voice for DeepSeek
Harness. It still provides one explicit, bounded Qwen audio turn after exact
Session disclosure and consent; it is not continuous live conversation.

What changed

• Added an official served-Web BFCache test path covering idle and active
  synthetic-audio navigation, stream reconnection, teardown, draft
  preservation, and fresh Session/consent binding. The recorded receipt remains
  fake-provider evidence pending independent reproduction.
• Adapted custom voice upgrades to Harness browser-session authentication and
  added an exact dsh-v0.1.2-alpha.1 source-build smoke. This one pinned result
  does not widen the published peer range or claim broad alpha support.
• Added a fail-closed Windows Desktop preflight for the exact community v0.9.3
  shell candidate. It performs no installation and makes no packaged-Desktop
  claim.
• Documented the served-Web versus file:// + IPC Desktop transport boundary,
  and added contributor guidance, structured issue forms, a pull-request safety
  checklist, and clearer runtime support evidence.

Verified on the exact release commit

Release commit: 6b973b250c3a28a066c51ddce10da781f69b64de

• Protected CI and the complete local pnpm check passed: 21 test files / 217
  tests, both TypeScript checks, script checks, builds, package lint, and the
  26-file package inventory audit. The known non-failing CJS/ESM package advisory
  remains.
• A clean exact dsh-v0.1.1-rc.2 source build installed the packed plugin through
  the official CLI into a disposable Web profile and completed the deterministic
  fake-Qwen composition: exact workspace/Session binding, disclosure, bounded
  PCM input/output, both final transcripts, completed turn, and socket disposal.
• A clean exact dsh-v0.1.2-alpha.1 source build rejected the unauthenticated
  voice upgrade with 401, exchanged the private launch token for the Harness
  browser cookie, completed authenticated Web/RPC paths, and completed one
  bounded fake-provider turn.
• The audited tarball contains only the intended 26 runtime/documentation files.

Install

dsh plugin --profile web add github:Jstn-1g/dsh-live-voice#v0.3.0-preview.2

Existing v0.2 testers should remove dsh-guarded-live-voice first. The internal
Cordis row id and default /guarded-voice route remain stable for this
transition.

Important limitations

The supported peer range remains the verified rc.2 line. Credential-backed
Qwen, a live provider, physical microphone/speaker and OS indicator behavior,
packaged Desktop restart/uninstall behavior, and file:// + IPC transport remain
unverified. Continuous turns, barge-in, automatic submission, tool execution,
history export, marketplace readiness, official endorsement, and ChatGPT Live
parity are not claimed.

Tarball SHA-256:
531464E9EE54AA2F59D99DD55C2CEC7321DAF2B6506CFC339DCA4DB187306E94

DSH Live Voice v0.3.0-preview.1

DSH Live Voice v0.3.0-preview.1

This is an experimental, safety-first preview of live voice for DeepSeek
Harness. It provides one explicit, bounded Qwen audio turn after exact-session
disclosure and consent. It is not continuous live conversation yet.

Included

• New public product/package name: DSH Live Voice / dsh-live-voice.
• Explicit-gesture microphone capture with bounded PCM16 streaming.
• Ordered bounded audio playback and deterministic lifecycle teardown.
• Exact Session/Workspace binding and one-shot consent before provider access.
• Final user transcript can become an editable draft only through an explicit
  action; the plugin never submits or invokes tools.
• Prebuilt Host and browser artifacts for source-free GitHub-tag installation.

Verified on the release commit

• 191 tests, both typechecks, builds, package lint, and inventory audit passed.
• Packed official-Harness offline fake-Qwen roundtrip passed end to end.
• Chrome 151 raw-unload smoke sent 107 synthetic audio frames before teardown
  and zero afterward; owned audio/transport resources closed cleanly.

Install

dsh plugin --profile web add github:Jstn-1g/dsh-live-voice#v0.3.0-preview.1

Existing v0.2 testers should remove dsh-guarded-live-voice first. Internal
compatibility identifiers and the default /guarded-voice route remain stable
for this transition.

Important limitations

Credential-backed Qwen, a physical microphone/speaker and OS indicator,
BFCache, and packaged Desktop restart/uninstall behavior remain unverified.
Continuous turns, barge-in, automatic submission, tool execution, history
export, marketplace readiness, and ChatGPT Live parity are not claimed.

Tarball SHA-256:
A82B4F4B730EB7E842B12B75E0085CD849D8E32CA0FA6CC7C3BD3185D4D316BB

v0.2.0 — guarded browser consent milestone

Milestone 2 adds the guarded browser-side setup and disclosure path to the exact-session Host authority foundation.

What is included:

• lazy DeepSeek Harness composer control and disclosure-panel contributions
• structured non-secret route injection through the official DSH boot table
• exact live-session/workspace binding with one-shot, expiring client-attested acceptance
• post-acceptance provider configuration and credential-availability validation
• deterministic browser packaging, strict Host/browser schemas, lifecycle cleanup, and adversarial regression coverage
• honest privacy and threat-model documentation

Verification receipts:

• public PR and merged-main CI passed
• 125 tests across 15 files
• 91.92% statement / 89.72% branch / 91.36% function / 94.83% line coverage
• independent adversarial review found no release blockers
• exact attached tarball passed an official DeepSeek Harness packed-install/runtime smoke
• tarball SHA-256: A5BDF9B74E7CC04E0CFA2D00FA00DE81971C8CFBD420672DAB983D4EA5C2B821

Important boundary: this development milestone does not request microphone access, transmit audio or text, connect to Qwen, transcribe, play audio, or insert/submit a composer message. The visible acceptance path is client-attested; it is not cryptographic proof of a human and does not resist a malicious same-user local process without an external trust root.