v0.1.7

Added

• Portable distribution for macOS arm64 and Linux x64 (glibc): self-contained
  archives embed an exact official Node.js runtime, a hoisted production
  dependency closure, and immutable build identity (distribution.json,
  distribution-files.json, SPDX SBOM). No system Node.js, npm, or root
  access is required.
• Bootstrap installer (install.sh): downloads the stable-channel release
  manifest, verifies SHA-256 digests, extracts atomically, runs a health
  check without system Node.js on PATH, and links ~/.local/bin/omd.
• omd update: foreground portable update through the stable channel with
  exclusive locking, digest verification, health check, and atomic current
  switch. Already-current installs exit without mutation.
• omd rollback: switches current to the retained previous version after
  validating embedded distribution identity. Reversible and offline; never
  modifies DSH_HOME.
• omd doctor --verify: verifies every file in the selected portable version
  against the embedded SHA-256 manifest in distribution-files.json.
• Dual-channel releases: npm package (developer/composition channel) and
  portable artifacts (end-user channel) share the same OMD version from one tag.
• Curated plugin catalog: admitted the first community entry,
  dsh-pkg-info@0.1.1, after reviewing the exact npm artifact and source
  commit. An approved session load adds the read-only pkg_info tool for
  npm and PyPI registry metadata queries; unload removes it through the
  real Cordis effect chain. The curation ledger records the rejected
  candidates and their concrete SSRF, containment, mount-side-effect, or
  runtime-schema failures.

Changed

• Upstream compatibility: upgraded all @deepseek-ai/dsh* dependencies to
  0.1.0-rc.7, and updated @deepseek-ai/dsh-skill-badge in the curated
  catalog to 0.1.0-rc.7 with its reviewed npm integrity hash.
• README quick start leads with the portable installer at
  releases/latest/download/install.sh. Pins use OMD_VERSION instead of a
  versioned raw git URL. Capability tiers (Core, Bundled Optional, Curated
  Integrations, User Growth) are documented explicitly.
• Community catalog entries now require machine-readable repository,
  publisher, npm SHA-512 integrity, and optional reviewed-commit provenance.
  The same evidence is copied into the load proposal for approval.
• Portable omd setup symlinks profile node_modules to the immutable
  closure instead of calling npm. npm-mode setup behavior is unchanged.

v0.1.6

Added

• Plugin forge: plugin_forge prepare_forge lets the agent author a small dsh
  plugin for itself and stage the complete source inside an approval-gated
  proposal. Only an approved proposal_control apply persists the source
  (digest-pinned, atomic, containment-checked, stale-guarded — the skill-forge
  write discipline) under $DSH_HOME/forged-plugins/ or
  <workspace>/.dsh/forged-plugins/ and mounts it through the plugin-control
  controller. Static discipline before any proposal exists: valid ESM verified
  by node --check without executing, static imports only from
  @deepseek-ai/cordis and @deepseek-ai/dsh-tools (review clarity, not a
  sandbox), no dynamic import()/require, source ≤ 32 KiB, required
  name/apply exports verified against the declared manifest at mount.
  prepare_load remounts a forged revision in later sessions under the same
  digest pin; prepare_unload reverses its Cordis effects; /omd-forged
  lists revisions, digests, and session state. The commit result reports
  observed Cordis effect labels next to the declared intended effects.

Changed

• Plugin control now says "plugin" everywhere the model or the user can see it
  (system prompt, tool and command descriptions, proposal titles and effects,
  error messages, and the plugin-instance-N id prefix), finishing the
  organ-bank → curated-plugin-catalog rename that the READMEs already adopted.
  Internal identifiers such as OrganController are unchanged, and no tool
  names, actions, or schemas changed.

v0.1.5

Added

• Bundled browser-use-cli skill: script-mode browsing through the ordinary
  shell tool. The agent pipes Python to the browser-use CLI (audited at
  0.13.8 / browser-harness 0.1.9), so every browser action rides existing
  command approval instead of adding a new tool surface. The skill defaults to
  an isolated throwaway-profile browser, mandates ANONYMIZED_TELEMETRY=false
  (which also disables default vendor cloud sync), forbids private-network and
  cloud-metadata navigation, forbids automated MFA entry and vendor cloud
  browsers, and permits attaching to the user's logged-in Chrome only through
  Chrome's own per-session consent popup.

• Skill forge: skill_control prepare_save distills a session-verified
  procedure into a durable SKILL.md, and /omd-distill [focus] queues a
  drafting turn. Saves flow through the proposal plane — the proposal carries
  the exact before/after file content and secret-content warnings, and only an
  approved proposal_control apply writes the file (atomic temp+rename,
  containment-checked after path resolution, SHA-256 stale guard against
  concurrent edits, symlinked targets rejected). Scope project writes
  <workspace>/.dsh/skills/<slug>/SKILL.md, scope user writes
  $DSH_HOME/skills/<slug>/SKILL.md; the upstream skill watcher picks new
  files up live. Content bounds: slug ≤ 41 chars, single-line description
  ≤ 500 chars, body ≤ 32 KiB.

• Plugin control and its curated organ bank: plugin_control lists and inspects
  exact-pinned entries, then prepares session-scoped load/unload proposals.
  Discovery and proposal preparation import no plugin code; approved load
  rechecks the installed version and reviewed name/provide/inject
  manifest before agent.ctx.plugin() mounts it. Unload and agent teardown
  await Cordis effect reversal. Arbitrary packages and runtime installation
  are unrepresentable in v1. The first bank entry is the upstream
  dsh-skill-badge@0.1.0-rc.6.

• Capability discovery plane: capability_search and /omd-capabilities
  search model-visible tools, skills, slash commands, MCP servers, and curated
  session plugins through stable refs (tool:…, mcp:…, plugin:…). Hits
  return status and an exact next action; activation still requires the
  existing mcp_control / plugin_control prepare path plus an approved
  proposal_control apply. Discovery itself never starts processes, imports
  packages, expands credentials, or creates proposals.