v0.1.7

This release includes the Desktop preview repairs across 0.1.5–0.1.7. Later native acceptance found two edge cases fixed in 0.1.8 and 0.1.9; use the latest release for those fixes.

• Authenticate native dsh-app://app preview loads and local redirects with a per-preview navigation capability while retaining loopback and request-origin guards.
• Remove the capability before application scripts run and before URLs or Referer headers reach the upstream.
• Preserve original query encoding and annotation URL identities.
• Fetch current HTML, CSS and JavaScript on reload despite immutable upstream caching.
• Treat Cordis supplied by Harness as an optional external peer, eliminating missing-peer installation warnings in Desktop and web profiles.

Upgrade the active profile:

dsh plugin --profile desktop add dsh-annotate@0.1.7
# Browser profile:
dsh plugin --profile web add dsh-annotate@0.1.7

Fully quit and reopen Desktop, or restart the web profile and refresh its browser after the current task finishes. Legacy 0.1.2-or-earlier manual installations should follow the migration steps in the README.

Validation: all four CI checks and the release workflow passed. The public npm tarball passed integrity and runtime-file comparison, carries provenance, and passed an isolated real-Harness web-profile test with Desktop CLI 0.2.0-rc.2 on macOS Apple Silicon. Annotation context reached the local model fixture while an unrelated composer draft remained unsent. Existing Desktop/web profiles upgraded to 0.1.7 with one bundle each and no peer dependency issues. Subsequent native macOS acceptance completed a full quit/restart, HTTP and workspace-file previews, a real DeepSeek provider receipt, composer-draft preservation, exact redirected query/hash URLs, and edited CSS/JavaScript after refresh. This native check found an undeclared-document-encoding issue fixed in 0.1.8. A repeated-redirect annotation-state issue was subsequently fixed in 0.1.9. Windows/Linux native UI was not exercised.