v0.12.2

Fixes credential and request-data disclosure through HTTP MCP redirects while keeping the exact DSH 0.2.1-rc.2 package family.

• Resolves the official DSH MCP bridge to patched @modelcontextprotocol/client@2.3.0 and its matching core through an exact parent-version-scoped npm security override. The manifest and lock travel through the existing production worker installation.
• Rejects cross-origin MCP redirects before custom headers, MCP session headers or POST bodies reach the other origin. Configure the final MCP endpoint URL when a deployment previously redirected across origins. Normal direct HTTP, same-origin redirects and stdio remain supported.
• Adds actual DSH adapter regressions for 307/308 confidentiality and same-origin authenticated tool calls. This release introduces no replacement MCP implementation, network proxy or Controller/Worker/Gateway/Session refactor.
• Avoids a false Session admission failure when GitHub's attempt job list still reports its active producer as queued. One exact-job read must confirm the same job, run, attempt, workflow SHA and running state; queued, unknown and mismatched jobs remain denied.
• Includes the v0.12.1 local installer GUI and optional model/reasoning controls. Installer create-deepseek-harness-action@0.7.3 will be published separately after this Action's formal canary and the installer checks. The GUI configures local YAML and performs no automatic Git commit, push or Secret setup.

This addresses GHSA-6prh-2h8m-c8cw for the Action's official HTTP MCP bridge. Existing Office-path and development-tool dependency findings remain recorded; this is not a claim that the entire upstream dependency audit is clean. The published v0.12.1 tag remains unchanged.

Validation: new main CI and new main Core E2E passed. Four Session pairs passed with fresh keys and separate workers:

Mode	Save	Resume
Explicit Controlled, with image	39946442949	39947011071
Explicit Native, with image	39947434193	39947837790
Automatic Controlled	39948250895	39948800441
Automatic Native	39949400436	39949923670

v0.12.1

Local workflow configuration, optional model controls, and focused reliability fixes on the pinned DSH 0.2.1-rc.2 runtime.

• Adds optional model and reasoning-effort (off, low, high, max) inputs for controlled and native modes. Omitted inputs preserve existing defaults.
• Adds a local browser GUI to the independently versioned installer: all 48 Action inputs, full YAML editing, preserved custom content, validation and diff before explicit local save, and opt-in plugin migration using exact cloud package pins.
• Fixes natural-language access parsing, valid plugin entry paths, review-summary omissions, and admission of a queued aggregate Session run with an exact active producer job.
• Removes the old TUI/publication flow, unused Agent request fields, duplicate extension checks and unnecessary eager validation. Controller credentials, write authorization, isolation and effect-boundary validation remain enforced.

The independently versioned GUI installer targets create-deepseek-harness-action@0.7.3. Its npm publication is currently on hold pending the HTTP MCP issue below. The GUI generates configuration; GitHub runners execute DSH. It performs no automatic Git commit, push or Secret setup.

Upgrade existing workflows by explicitly selecting the qualified Action version or immutable release SHA. Advanced write, Session, native and extension capabilities remain opt-in.

Known HTTP MCP limitation — 2026-10-23

The pinned DSH 0.2.1-rc.2 runtime requires @modelcontextprotocol/client@2.2.0, affected by GHSA-6prh-2h8m-c8cw. In controlled and native HTTP MCP configurations, a server's cross-origin redirect can forward custom request headers to the second origin; a 307/308 can also forward the request body. A local test using synthetic credentials reproduced this behavior. This is a confirmed supported-path limitation, not evidence of a production credential leak.

Default workflows do not enable MCP, and stdio MCP is unaffected. Until a corrected Action release is qualified, avoid HTTP MCP configurations that send credentials or sensitive tool data. Controller-owned GitHub and DeepSeek credentials remain excluded from extension configuration, but that does not protect independent MCP credentials or tool request contents. The immutable v0.12.1 tag is unchanged. Installer 0.7.3 has not been published; complete MCP confidentiality acceptance remains blocked.

v0.12.0

v0.12.0

Direct natural-language @dsh requests now work in Issue and PR conversations. For example, @dsh 帮我分析这个问题 runs a read-only task without a fixed subcommand. Existing commands remain compatible.

Natural-language tasks are read-only by default. Maintainers may independently enable natural-language-write: true to let a clear change request such as @dsh 修复这个 Bug 并提交 PR request write access. Ambiguous, explanatory and negated requests remain read-only. Code publication still uses the existing Controller write transaction with allow-write, actor trust, validation and fresh authorization. Typed GitHub tool writes retain their Gateway controls.

Quoted text, code examples and bot natural-language comments do not activate requests. Reserved legacy command words keep their existing behavior.

The guided installer adds read-only conversation to automatic PR review. When Review and Commands are both installed, Commands owns interactive events so a mention runs once. English and Chinese setup documentation explains the default and the independent write switch.

Writable-task prompts distinguish Worker tool requests from the Controller's post-final publication of eligible workspace changes. An empty tool catalog does not imply that automatic code publication is unavailable.

Targeted cleanup removes redundant native-manifest readback, duplicate canonical JSON functions, repeated runtime-binding normalization/projection and an unused Session helper. Contract imports now reach their owning modules directly. Controller/Worker, Gateway, Controlled/Native, Session and attachment contracts remain in place; DSH stays exactly pinned to 0.2.1-rc.2.

Relative to the development baseline 12eb41c, hand-maintained runtime/build code and installer templates grow by 149 lines, including the new feature; the cleanup subset removes 106 runtime lines. The main bundle grows by 3,543 bytes (0.106%). The detailed measurement separates tests, docs and repository workflows.

Qualified release commit: 756400445fb97d54fec3127c0a2adf28eeadcfec.

Verification:

• Final-main CI: Linux full checks, Docker integrity/image/native ecosystem regressions and Windows full checks. The final candidate's local Windows run passed 2,188 tests, with 23 platform-specific skips.
• Protected final-main Core E2E: all six jobs, including typed GitHub tools, write guards, cancellation cleanup and final identity binding.
• Real Issue and PR natural read-only requests, inert quoted/code examples and an opted-in natural write request were exercised. The write request produced a verified PR changing only the intended fixture file and passing its independent test.
• Image Session save/resume pairs passed in explicit Controlled (save, resume), explicit Native (save, resume attempt 2), automatic Controlled (save, resume) and automatic Native (save, resume). These verify generation 1→2, current read-only authority, exact image bytes, raw checkpoint continuity and no tool replay.

Known limits: natural-language mutation recognition is deliberately conservative and may leave an unfamiliar request read-only; explicit legacy commands remain available. GitHub quota exhaustion or unstable automatic Session history can stop a run before its Worker starts. Failed qualification attempts remain failed records; the successful automatic pairs above use separately recorded logical Sessions after effect inspection. No history or guard was removed to obtain a pass.

The formal-tag Controlled/Native canary passed both real tasks, their schema/policy assertions and the final gate at this exact release commit. Installer 0.7.2 is published and binds this full immutable Action SHA. Its separately reviewed source tag resolves to d569cf736f33c9bf0c6c262c5bc42b3a65afa1d3.

The official 26,317-byte npm tarball is byte-for-byte identical to the qualified archive (SHA256 8570440dc87ba35ecba3479fba65d7f24e5fe7f4d6cb68eea926adf6240a7a3b). Ten fresh anonymous public consumers, two negative consumers and all twelve independent cached-archive comparisons passed. A fresh public npm create deepseek-harness-action@0.7.2 with no product flags created and published the read-only starter; its first real natural-language task passed and replied, with unchanged main/branches and no PR creation.

v0.11.0

GitHub images, binary files and official DSH Session attachments / GitHub 图片、二进制文件与官方 DSH Session 附件

中文

• 仓库 PNG、JPEG、WebP、GIF 交给官方 DSH read_image。PR、Issue、评论中的受支持 GitHub 上传图片自动下载到隔离 Worker 可读取的位置；无需新增 Action 配置。
• 二进制文件沿用现有 GitHub Blob Base64 和工作区字节处理流程，保持读取、复制和提交时的字节完整性；无效 UTF-8 不再进入 PR 文本上下文。
• Session 检查点携带实际引用的图片和文件字节，通过官方附件存储恢复相同引用。保留原始 DSH v4 JSONL，继续按本次运行重新计算权限，不重放历史 GitHub 写入。
• 保留 v0.10.2 的 Controller/Worker 架构、Controlled 默认模式、Native 选择、Docker 隔离、凭据代理和写入验证。图片使用已有 workspace.read 权限，不自动扩大不可信 PR 的能力。
• DSH 保持精确版本 0.2.1-rc.2。PDF、Word、Excel 支持原样保存和提交；内容解析使用现有官方 Skill/Bundle/Plugin/MCP 扩展路径，本版本不内置文档解析或转换引擎。

GitHub 图片下载上限为 8 次、每张 4 MiB、成功下载合计 16 MiB；仅接受受支持的 GitHub 上传地址。失败和跳过原因写入日志及任务上下文。Session 最多保存 20 个引用、每个 20 MiB、附件合计 50 MiB。

文件支持与限制 · 配置

English

• Repository PNG, JPEG, WebP and GIF use official DSH read_image. Supported GitHub-uploaded images in PRs, Issues and comments are downloaded into the isolated Worker with no new Action input.
• Binary materialization, copies and Git Blob Base64 publication preserve exact bytes. Invalid UTF-8 is omitted from PR text context.
• Session checkpoints carry referenced image/file bytes and restore the same references through the official attachment store. The raw DSH v4 JSONL remains unchanged, current permissions are recalculated, and historical GitHub writes are not replayed.
• The v0.10.2 Controller/Worker architecture, Controlled default, Native opt-in, Docker isolation, credential proxy and write validation remain in place. Images use existing workspace.read authority and do not expand untrusted PR permissions.
• DSH remains pinned to 0.2.1-rc.2. PDF, Word and Excel are preserved as opaque files; document processing uses existing official Skill/Bundle/Plugin/MCP extension paths. No document parser or conversion engine is added.

GitHub image downloads allow 8 attempts, 4 MiB per image and 16 MiB total successful bytes, restricted to supported GitHub upload locations. Failures and skipped references include reasons in logs and task context. Session checkpoints allow 20 references, 20 MiB each and 50 MiB total attachment bytes.

File support and limits · Configuration

Verification / 验证

Immutable Action commit: 24618e72a7a9154142a601f3181ccdaef0ddf84c.

• Exact-main CI and Core E2E, 6/6 jobs passed. The local complete check passed 2,037 tests with 23 platform/conditional skips. CI includes actual Linux Docker image reads in Controlled and Native modes.
• All four image Session pairs passed on that same commit. Each pair uses independent Actions Runs and checks attachment bytes/identity, the unchanged raw-log prefix, current permissions and no replay of historical tools or writes.

Session	Mode	Save	Resume
Explicit	Controlled	39108050113	39108247267
Explicit	Native	39111192419	39111350183
Automatic	Controlled	39111324562	39111498174
Automatic	Native	39111327472	39111501334

The save runs also verify an actual GitHub-uploaded image download. Binary byte preservation was checked against a real Git Blob commit, without updating a branch. Earlier quota-blocked runs remain failures and are not included in the successful matrix.

正式标签的 Controlled/Native canary 首次运行通过。安装器 0.7.1 已发布并绑定上述不可变 Action SHA。其独立源码 CI、首次真实 Review、10 个公开匿名安装正例及 2 个拒绝测试均通过；公开归档与发布前验证的 tarball 逐字节一致。公开交互恢复验证了不重复写入工作流、提交或推送；一次 Git 读取失败保留记录，随后恢复运行通过。

The formal-tag Controlled/Native canary passed on its first attempt. Installer 0.7.1 is published and binds the immutable Action SHA above. Its exact-source CI, first real Review, ten anonymous public consumers and two negative cases passed. The public archive is byte-identical to the qualified tarball. Public guided recovery preserved the workflow and commit without another push; an earlier Git read failure remains recorded, and the subsequent recovery run passed.

npm create deepseek-harness-action@0.7.1

Installer source: 12eb41c14122378c3b1308e7890db01563b91ffd (source tag).

Installer tarball SHA-256: 6227150d05f30e03efdc3b5ffbbae4c53be084037a2b34a77dd82d93980973cf.

v0.10.3

v0.10.3

This release upgrades DeepSeek Harness to the exact official 0.2.1-rc.2 package family and publishes create-deepseek-harness-action@0.7.0.

• Adapt Headless credentials, managed Subagents and Session integration. Controlled Subagent tasks can wait for completion without spawning placeholder children.
• Support the new DeepSeek Search and Fetch APIs through the existing credential proxy. Controlled Fetch requires an explicit native.web-fetch grant; custom Messages-search endpoints remain supported.
• Add optional local DSH Bundle import with installed version and compatibility display, selection and confirmation. Native composition uses the imported Bundle configuration; Controlled Review/Session requires exact read-only tool names. Local credentials and settings are not copied. Unsupported/local-only plugins and Controlled command workflows receive manual setup guidance.
• Rewrite English and Chinese quick starts for Windows, local versus cloud DSH, API key configuration and the first PR Review.
• Include the fixes from #431 and #432.

Validation: local full check passed with 2003 tests passed and 21 skipped. Release-commit CI and complete exact-main Core E2E passed on 70aa68ce3fd529fb20161bf0a3498cbdb456709f, including Docker/native smoke, guarded writes, GitHub integration and cleanup.

Session cloud matrix and natural-expiry long tests: USER_DIRECTED_NOT_WAITED_NOT_PASSED. The maintainer explicitly chose to publish without waiting for these gates. Local real-worker Session creation/resume and permission-downgrade tests passed; the attempted cloud Session runs were blocked by GitHub quota before worker/model execution. These cloud gates are not counted as passed. Formal-tag Controlled/Native canary passed. The first real PR Review also passed and posted the expected finding.

Existing Controller/Gateway permissions and Controlled/Native composition boundaries remain intact. Session checkpoints bind to the DSH version; use a new Session key after upgrading. npm audit retains 8 moderate affected entries in the upstream Office/fflate chain, with no high or critical entries.

Installer 0.7.0 is published as npm latest. The public 25,005-byte tarball is byte-identical to the qualified archive (SHA256 32b7ae52d41c5d016d297e2c4202235fd10de9d1863ea58fcae65e691bd1c683). Ten anonymous installs with separate fresh caches passed, generating twelve workflows; the missing-mode and existing-file overwrite rejection cases also passed.

Windows PowerShell, from your local GitHub repository:

npm.cmd create deepseek-harness-action@0.7.0

Public-package interactive recovery passed: it preserved the existing workflow and commit, recognized the configured Secret by name, verified the same commit on GitHub, and performed no duplicate commit or push. During the original fresh setup, Git HTTPS transport failed after the local workflow commit; that same commit was published through the GitHub API before the successful first Review. Automatic first-time push is therefore not claimed as passed.

v0.10.2

This release simplifies lifecycle ownership, validation, runtime composition and Session persistence while preserving public inputs, schema-v1 results and exact DSH 0.2.0-rc.2 pins.

• Replaces shared mutable RunState with responsibility-specific owners and read-only result snapshots.
• Shares revision-specific workspace validation and retains confirmed publication receipts through later failures.
• Keeps the DSH engine and controlled Profile together in the runtime adapter.
• Removes unused Session abstractions, duplicate tool bookkeeping, repeated admission code and source-wording checks.
• Recovers one artifact pagination shift caused by concurrent uploads from other Session keys, without repeating a task or upload.

Qualified source: c3d4d2ffce891dfd55c84086c68b86078fe0e9f8.

Validation: main CI, exact-main Core E2E, and controlled / native automatic Session followups with verified different-key overlap and same-key serialization. The Session-tested candidate and merged release have identical Git trees. Full CI passed 1,910 tests plus Docker checks.

The unchanged historical-error matrix is covered by existing regression tests and was not repeated remotely for this refactor. Natural 24-hour manifest-expiry verification remains incomplete and was explicitly made non-blocking for this release. The formal controlled/native canary passed on the immutable release SHA. Installer 0.6.1 is published as latest. Its qualified archive matches the public registry and fresh anonymous consumers; guided setup, first Review and public guided recovery passed. The dependency graph retains its previously reported npm audit findings.

v0.10.1

v0.10.1 improves maintainability and lifecycle ownership while retaining the Controller, isolated worker, Gateway and validation architecture and exact DSH 0.2.0-rc.2 pins.

• Separates DSH/Agent lifecycle, cleanup, input validation, error classification, Action outputs and Markdown into cohesive modules.
• Shares validation, fresh authority checks, write effects and reconciliation across fix, implementation and task paths. Completed operations cannot authorize a different workspace or replay writes.
• Fixes Docker bridge proxy routing, descendant-held output pipes, cleanup ordering and reports for validation commands that did not run. Proxy listeners have no wildcard-address fallback.
• Enables unsafe-assertion lint by default, improves focused public-interface regressions and documents resource limits.
• Confirms acknowledged Session uploads through bounded reads of the same artifact ID. Uploads and writes are never retried; permission, provenance, digest and deadline checks remain active.

Release commit: d711196d0e5608d5ac699e375383829731c3ecdd. Its tree is identical to tested candidate f27963bfc11db4829c580dbff86ebedfe9a8537b.

Completed validation:

• Full local check: 1843 passed, 0 failed, 4 existing Windows skips.
• Candidate CI.
• Complete candidate Core E2E, including real task/fix/implementation effects and verified cleanup.
• Exact release main CI and formal-tag canary, with actual controlled and native execution.
• Controlled Session save and resume: both passed all 15 checks, including current permissions, isolation, memory continuity, a fresh worker and no replay.

Publication follows the maintainer's immediate-release decision. The remaining Session matrix and full post-merge Core qualification were not completed before publication and are not reported as passed. Exact-main push CI and formal-tag canary status are reported separately. The real long-TTL natural-expiry rerun was waived, not passed. Earlier GitHub quota failures remain recorded.

Guided installer 0.6.0 is published on npm. It defaults to read-only PR Review, detects Git/GitHub configuration and existing Secrets, checks the generated workflow, and separately confirms workflow creation, commit and push. Manual installation and advanced modes remain available.

Run npm create deepseek-harness-action@0.6.0 --yes inside your repository. Installation guide.

The installer has its own immutable source tag, with 1883 local tests passed and exact-source main CI. The qualified archive was published without repacking; official version/latest metadata and fresh anonymous npm consumers verified the same archive bytes and 12 workflows across 10 directories.

The guided installer was exercised in a previously unconfigured private repository, including safe cancellation, unrelated staged changes, missing Git author recovery, separate commit/push confirmations and idempotent recovery. Its first real PR Review succeeded and published a Controller summary. A fresh clone then completed guided recovery using the public npm package, preserving the existing workflow/commit and retrieving the same qualified archive bytes.

The unchanged pinned dependency graph retains known audit advisories; this release does not claim a clean npm audit.

v0.10.0 — 按 key 自动创建和续接 Session

v0.10.0：按 key 自动创建和续接 Session

生产 DSH 保持精确锁定 0.2.0-rc.2。正式 Action 提交为 9c52f682bbeed1b7752a9e21273e6c13b01e79b1，与 PR #346 已验证候选的 Git tree 完全一致。使用完整 SHA 固定生产引用。

新增可选 session-mode: auto：维护者指定 session-key，首次自动创建，后续独立 run 自动定位最新成功且兼容的检查点，无需填写 session-source-run-id。现有 off/save/resume 显式用法保留。自动模式以同一 key 绑定可信 workflow 的 run-name、根级 concurrency 和 Action 输入；同 key 串行，不同 key 可以并行。

有界历史扫描区分首次无历史、失败或状态不明的历史、缺失、过期、损坏和不兼容检查点。发现这些历史状态时会在启动任务前拒绝，不能静默回退到旧代或重新执行旧任务；旧 run 的 rerun 同样拒绝。保存前重新核对最新来源和 generation，防止队列顺序或并发造成旧代覆盖。采用 auto 时使用新的 workflow 路径及新的 key，避免把既有无 key 历史误当首次；若管理员删除全部历史 run 和 artifacts，系统无法重建已消失的历史。

继续复用现有 Controller、公开 DSH Session APIs、完整 settled raw v4 log、严格 archive/manifest 校验与 Gateway。恢复使用全新 worker，按当前请求重新计算权限及 approval，历史指令、工具和 GitHub 写入不会重放。controlled/native、凭据隔离、来源绑定、代次冲突检查和 Gateway 写入保证保留。仍限便携文本 Session，图片、子会话迁移及 Mods 不包含在此版本。

rc.2 pruner 通过真实生产 Profile/launcher 和独立 Node workers 触发成功文本及真实读取错误路径，两种模式都观察到实际 pruning，并验证保存、严格解码、独立恢复及再次严格解码。被剪除的输出从 45,118–45,408 字符降至 5,159 字符，call/source 元数据、isError 标志及可选 error 字段不变；篡改的 prune 记录被拒绝。所触发路径未证明本 Action 存在缺陷，因此未修改生产 runtime 或放宽日志校验。这项验证使用确定性 provider，不声称覆盖 provider-confirmed overflow、Docker 或 live provider。

独立上游 alpha canary 仍为非阻塞 advisory，生产依赖不变。实际解析版本 0.2.1-alpha.1 因 @deepseek-ai/dsh-invariants@0.2.1-alpha.1 返回 HTTP 404 而在 resolution 阶段失败，兼容测试未到达；原 alpha job 保留 failure，stable/rc job 成功。不能把整个 advisory workflow 的 success 当作 alpha 兼容成功。

本地完整 npm run check 退出 0：1,629 项通过、3 项平台跳过，生成文件与 dist 检查通过。候选 CI、main CI 成功。候选 Core attempt 2 六个 job 全部成功；原配额失败及唯一有界恢复保留。

候选版真实运行完成 controlled/native 自动首次创建、跨 run 续接，两个不同 key 的 Action 实际重叠 53 秒。同 key 旧 run 重跑、失败历史、缺失和不兼容检查点实际拒绝且没有 worker/turn/tool 执行。候选 native 续接 Action 成功并保存第二代，但取证 workflow 的 archive GET 失败，其 workflow conclusion 保持 failure；独立读取同一原始 artifact 后，严格 codec、manifest/来源、前缀、当前权限和无重放证明通过。这份补充证据不将失败来源变成可续接的成功历史。

main 分支保护要求 PR 和最新 test CI，通过管理员强制执行，禁止强推及删除；没有单人维护无法满足的他人审批要求。

公开工具及固定上游依赖的既有剩余风险继续见 runtime audit 与 本轮验证范围。

exact-main Core 37637852347 attempt 3 已 canonical 确认全部六个 job 成功。四个只读场景复用 attempt 2 的成功结果，write 与后续取消/集成门禁在针对 write job 的有限恢复中通过；真实 Bash 写入 PR 的身份核验和专属清理成功。main gate 的候选、workflow、dispatch SHA 均为上述正式目标提交。原 attempt 1 配额失败、attempt 2 context 连接关闭，以及最早响应不明的恢复请求均保留原状态；没有无差别重跑已通过场景。
exact-main 自动 Session 实跑全部通过：controlled gen1 → gen2 → gen3，native gen1 → gen2。五个原 workflow、Action 和原始严格证明全部成功；5次保存、3次新worker恢复，完整raw前缀、当前readonly/never、记忆与新任务挑战及无旧任务重放均通过。gen3派发前gen1/gen2两份旧checkpoint同时存在且未过期，实际source是gen2而非gen1。最后批次零quota/取证wrapper失败；此前配额失败、已执行但未保存的测试及调度纠正证据仍保留，未复用失败key或重复执行旧run。

正式发布后的 controlled/native canary 在正式 SHA 上通过，两种实际 smoke、各自严格 schema/权限断言与最终绑定门禁全部成功，生产 DSH 仍为精确 rc.2。

安装器 create-deepseek-harness-action 0.5.0 已正式发布为 latest。独立源码 PR #357 合并提交为 2f589e4c0c51561741b8720f3916f3595179587a，固定源码标签 create-deepseek-harness-action-v0.5.0，与 exact-main 源码 CI 完全一致；Linux 完整 check 1,631 通过、1 跳过，并通过 Docker Integrity 与 native rc.2 smoke。安装器生成的六份模板均精确绑定正式 Action SHA 9c52f682bbeed1b7752a9e21273e6c13b01e79b1。

发布使用已通过验收的同一份 9,331 字节 tarball，SHA256 326a8e13b263ef6f15a501aaf2762ed5def7575fe7c42bfbe106b200d900c0ef，SHA1 7e657633144bf71d735b7b6cb39495789675f80e。公网验收使用官方 registry、全新缓存和空白 npm 配置，实际执行 npm create deepseek-harness-action@0.5.0；8 个消费目录生成 10 份 workflow，覆盖 review/commands/both、controlled/native、显式 argv/image、两种自动 Session 及覆盖拒绝。独立取证确认公网缓存的真实 tarball 字节与本地已验收包 SHA1/SHA512/SHA256 完全一致，12 个归档文件、六份模板及本地/公网合计 20 份 YAML 均通过严格检查；无重打包，也未执行消费仓库的测试命令。

安装命令：npm create deepseek-harness-action@0.5.0 -- --mode session；native 增加 --dsh-mode native。将生成的 workflow 提交至默认分支，维护者以小写 session_key 和本次新 prompt 派发；相同 key 自动续接。

v0.9.3: opt-in portable text Session save/resume

v0.9.3：显式保存与恢复便携文本 Session

发布目标：e7da1b33a043b4e2e26daa7e731c266817677a4a。main 与已验证候选 fac951673e7a4a4632f4d88d1afc79fd7324b10e 的 Git tree 完全一致：65a9e97a3bb9a51d910a8a494d10ec2a07842027。

发布前门禁已完成：exact-main Core 37169407743 attempt 2 全部六个 job 成功，包括最终 main 绑定。原始 quota 失败及一次有界续跑记录保留。

新增默认关闭的 session-mode: save|resume。维护者用相同 session-key 和明确成功来源 session-source-run-id，在独立新 Actions run 中继续同一任务；session-retention-days 默认 3 天，支持 1–7 天。复用固定 DSH 0.2.0-rc.2 的公开 persistence/query、--session-id 和官方 Headless，保存完整、已结算的原始 v4 日志；NDJSON 投影或拼接评论历史不等于完整会话。使用方法见中文文档与dispatch 示例，生产引用使用本版本完整 SHA。

核心 Controller / DSH / Gateway / validation 架构不变，controlled 默认、native 显式 Docker opt-in 和扩展组合规则保持兼容，未升级 DSH、修改上游或另造会话引擎。恢复启动新 worker，重新计算本轮权限、指令及工具，在 driver 前替换历史 permission/sandbox/approval；旧输入、工具调用及 Controller GitHub 写入不重放。写入继续经过授权、验证、即时重新校验与结果核对，Controller 真凭据不进入 worker。

Session 要求固定 /workspace、digest 镜像、受信同仓库默认分支 workflow、唯一静态 producer job/Action step，以及根级 group: dsh-session、cancel-in-progress: false。来源、任务、运行时、最新成功 generation 与期限在线核验；whole-workflow 是信任边界，artifact 不提供独立 job 级发行者证明。只保存 raw（最多 4 MiB）和 manifest（16 KiB），不导出完整 home；损坏、过期、不兼容、未结算、冲突、child/额外 Session 和异常路径 fail closed。已知凭据及其已知编码命中即拒绝，不保证排除第三方任意未知秘密。

初版只恢复便携文本 Session。发布前发现并修复 raw 中图片/文件引用缺少真实字节的便携性缺口：新增 24 个回归，在 10 类公开解释型内容记录中拒绝 typed image/file，包括当前工具生成的附件、assistant 流、compaction 和嵌套 PTC 结果；普通业务 JSON、纯文本和 opaque metadata 不按相似字段误判。native 工具图不禁用，raw 不改写，诊断不泄漏文件名或 attachment ID。

保存/发布失败保留已确认的外部结果及 artifact 回执，不自动重复原任务请求、重试写入或恢复失败 worker。已经执行却未保存的 turn 不在最新成功检查点中，后续恢复不会补回其记忆；应先核对诊断和副作用，再明确提出新请求。此前 native RESUME 37166117089 的 publication 配额失败、无 checkpoint 记录保留，未改写为成功。

已完成本地 npm run check：1,556 通过、3 平台跳过、退出 0；候选 CI 与 exact-main CI 37169175869 success，包含 Docker/native ecosystem 验证。真实 controlled SAVE 37165813728 → RESUME 37166114999，native SAVE 37165815569 → 新独立 RESUME 37168588274，均 qualified、15/15 断言通过，验证新 worker、同一 Session、完整 raw 前缀、当前只读权限及无重放。

图片与 Office 附件继续暂缓：DSH 已有真实图片工具及附件 store，但本 Action 使用的公开 Headless 输入缺结构化附件入口；Action 的字节传输、proxy Files 权限、内容预算、生命周期和新 worker hydration 工程也未完成。文本 Session 不代表原生附件支持，不直传真实密钥绕过边界。Agent Teams、Browser/Computer Use、桌面插件管理和新 GitHub backend 不在本轮范围。

依赖审计仍有 15 项 finding：6 moderate、9 high、0 critical。兼容 glob@10.5.0 可修问题已处理，固定上游图的嵌套 fflate@0.8.2 与 http-cache-semantics@4.2.0 风险仍存在；默认未启用 Office/telemetry 路径不等于漏洞已修复。没有强制安装、peer 绕过、关闭审计或删除测试，详见剩余风险。

正式 controlled/native canary 37172280127 已通过。安装器 create-deepseek-harness-action@0.4.1 已正式发布到官方 npm registry，latest 为 0.4.1。独立 PR #344、精确源码 CI 37173109375 与 source tag 对应源码 SHA 891570ef2254334dff8de22af948f3f0105e933e，生成工作流绑定本版正式 Action 完整 SHA。已在无凭据、全新缓存和 6 个新目录中完成官方公网安装验证，共 8 份工作流，包含 controlled/native、显式 validation argv/image、占位符和覆盖保护；16 份本地/公网 YAML 及 npm cache 中实际 archive 字节独立核验通过。发布的是同一份已校验 tarball，SHA256 d5963f5ff5d9a5d42ed2b731cc837407f38d913a1601f13301cf675af2e1fef0，未重新打包。历史 v0.9.2、安装器 0.4.0 及旧标签保持原身份。

v0.9.2

v0.9.2：文本任务、配置预检与 GitHub 请求恢复

v0.9.2 基于 v0.9.1，继续精确锁定 DSH 0.2.0-rc.2。controlled 保持默认，
native 保持明确选择、Docker-only；Controller / DSH / Gateway / validation 分层、
Controller 凭据隔离与既有公开契约保持兼容。

新增与修复

• 文件化任务与文本上下文：prompt-file 从维护者明确选定的同仓默认分支加载
  指令，固定完整 SHA；context-files 将显式选定的不可变 PR head/基线文件作为不可信
  文本上下文。两种模式均支持，prompt 与 prompt-file 互斥，交互命令保持既有
  优先级。校验路径、Git 文件类型、符号链接、UTF-8、数量与大小，不读取任意 runner
  路径或自动搜集文件。任务文件最多 32 KiB，上下文最多 8 个文件、合计 64 KiB，
  文件输入总计最多 96 KiB；最终完整 prompt 另受 Linux 96 KiB / Windows 24 KiB
  上限约束，进一步截断会标记。这是文本文件上下文。
• 配置预检与首次使用：新增 npm run check:config -- --config examples/config-check.json，
  不启动模型、不执行仓库代码、不联网、不修改远端。不能静态判断的环境和在线权限
  明确标记未检查。正常运行提前发现凭据、固定版本、Docker 与写验证配置问题；
  已知写策略拒绝保留 POLICY_DENIED/denied，不自动信任仓库脚本或跳过验证。
  README、中英文文档及示例同步展示最短使用路径。
• GitHub 体验与限流：复用 sticky 评论、结果、去重与 Gateway，记录接受状态、阶段、
  错误、运行链接和已确认副作用；部分评论发布后遇 quota 立即停止后续发布。只有
  显式选中的不可变文本使用单 run 缓存和并发合并，授权、写前重验和未知副作用核对
  始终新鲜。GET 最多重试两次、累计等待 15 秒并受任务预算约束，写请求与模型任务
  不重放。生产 Action、E2E fixture 和发布监控分别判断凭据与配额。
• Review 证据预算：36 KiB 共享预算公平分配各文件 patch，再分配 source，避免早期
  大型文档耗尽后续源码证据。预算按 JSON 字符串 UTF-8 开销计量，记录 coverage 与
  截断；原始 snapshot、发布 anchors 和授权不变。coverage 不等于模型完整审查证明。

有限验证后暂缓

Session/Resume：固定 rc.2 的 persistence/query、--session-id 与新 worker 真正恢复
已验证，上游有公开接口；恢复仍保留旧权限意图。Action 尚未完成可信存储导入/导出、
仓库/任务/来源绑定、当前授权重算、跨 run 并发、凭据排除、TTL 和旧写操作不重放，
因此暂缓属于 Action 工程缺口。本版继续新建 Session，不提供假 Resume 输入。

图片与二进制/Office 附件：固定 Headless 入口没有结构化图片/附件输入，虽然底层
image/file API 存在；Action 的 Files 代理、安全 admission 与存储生命周期也未完成
可靠验证。文本文件和路径文字不是原生附件，不绕过 Controller 将真实密钥交给 worker。
Agent Teams、Browser/Computer Use、桌面插件管理和新 GitHub backend 不在本版范围内。

依赖与剩余风险

正式发布后的官方 registry 复审仍为 15 findings（6 moderate、9 high、0 critical），包括两条底层公告
及其受影响祖先，npm audit 仍非零退出：

• GHSA-px8p-9vwx-vf98：fflate ZIP64 无限循环：
  根 fflate@0.8.3 已修复，libreoffice-kit@0.1.5 精确嵌套依赖的 fflate@0.8.2
  仍受影响，约束内不能替换。
• GHSA-ch52-4w7c-c8xp：HTTP 跨用户缓存泄露：
  固定链包含 http-cache-semantics@4.2.0，审计时无兼容的已发布修复。

普通约束内更新没有改变依赖图；未升级 DSH 或使用 force、override、peer 放宽、关闭
审计等绕过。相关路径默认未启用不等于漏洞修复。Windows 元数据安装仍有两个
extraneous optional package。未知写入与其核对同时失败时原始 transport cause 会被
读错误取代；已验证写入仍只发送一次，quota 分类与外部副作用记录正确。外部扩展
自身凭据和副作用仍属于独立责任范围。

身份与资格证据

Action 正式 commit：c184872f309ebfc5e57a0c5c1397c59e774709e0。
不可变 annotated tag v0.9.2 对应上述正式 commit；tag object 5412500eba3ae41851ae159d21b4c552b36da658。
GitHub Release
于 2026-10-03 16:02:07 UTC 正式发布。

• PR #289 已合并；候选
  b55f8579305ad67989f91ac4e142117c9addf190 与 merge main 的 tree 均为
  54533b9320382203d47a17e193b604b1f6d8dc32。
• 候选 CI
  成功，包含完整 check 和实际 Linux Docker/native ecosystem smoke；
  候选 Review
  成功，高置信 findings 0。本地完整 check：1274 passed / 3 skipped。
• 完整候选 Core E2E
  六 jobs 全部成功，trusted harness SHA cf53a5705a6670403177b1927b51727d8c7b31ff。
• exact-main CI
  与 exact-main Core E2E
  均通过同一正式 Action commit 的资格；Core attempt 1 被 installation quota 中断，配额恢复后仅续跑失败 jobs 一次，attempt 2 六 jobs 全部成功。
  exact-main Core 日志 SHA256：23e9bb733c04cc9497c899daa39140d32ceb2175b4ae24eebf0ce9cab1f96949。

正式双模式 canary 37135372034
已在 Release 后通过 controlled/native Action 执行与各自断言，使用同一正式 SHA。两模式
均记录了实际加载的任务文件和上下文文件 provenance，以及主 Controller 的请求统计；
不把模型摘要作为执行证明。canary 日志 SHA256：
dc68ace3df75e1599cebda23bb68fd4a9788945360bb812106474a519c7c37fe。

独立安装器进度：npm 发布仍受阻

create-deepseek-harness-action@0.4.0 源码已完成独立资格：
PR #307 与
PR #308 的 CI/Review 均通过并合并；
最终 source SHA f0b4e113fdb5b6d25d49b4dc73a2adc4b8d996c2，
exact-source CI 37138857494 成功。
source tag create-deepseek-harness-action-v0.4.0 的 annotated object 为
94a1e436017fd4de6e0dd8fe1a5a1f5c450fc6d0。

安装器提供显式 --test-commands 和 digest-pinned --container-image，生成工作流绑定
正式 Action 完整 SHA；不发现、执行或自动信任仓库脚本。镜像规则修复覆盖三个实际
反例，与 Action 的 15 组 grammar parity 均通过。最终普通 npm run check：
1298 passed / 3 skipped / 0 errors；日志 SHA256
dc8dda0ef921fbe94ba5385441404c1f1e499a716d1c4bf83092454b8d1d3c58。
旧 Windows worker 异常未复现、根因尚未定位；最终正常检查无异常不等于该问题已修复。

实际 tarball 已通过 6 个本地消费者、8 份 YAML、显式 argv/image、验证命令未执行、
覆盖拒绝和源码清洁检查。这是本地 tarball 资格，不能代替官方 registry 公网安装验证。
包身份：

• SHA256：91addea9bf9d96e4a5e202907d5b2f6490b482bad242056d7588e25eec19237a
• npm shasum：20369562dfce394a2cdf131418a293f5b4729189
• integrity：sha512-khucxp8k5eeNaIzwxLtYUzP6K9PHCxRvWderKwNVx/Ctn8iS073OQ7n36iMu6vkq1YbpjjnBSKzFvMfshbPuvQ==

npm 发布与公网安装已完成。 create-deepseek-harness-action@0.4.0 已发布至官方 registry，latest 为 0.4.0；维护者完成一次性发布认证后发布的是上述已 qualified 的同一 tarball。全新缓存、六个公网消费者目录、八份 YAML、controlled/native 显式 argv/image、覆盖拒绝和验证命令未执行全部通过。独立 proof 再次直接读取归档字节并核对官方 metadata、模板、本地与公网消费者；SHA256/integrity/shasum 全部一致，proof 结果 pass。

固定运行时与依赖审计 ·
文本文件契约 ·
请求与恢复边界