v0.1.8

v0.1.8 — Workspace grouping + community feedback

This release lands all three feature requests from the community plus a defensive fix for the dsh rc.6 scope bug.

What's new

• Workspace grouping — new agent sessions auto-attach to the workspace matching their cwd, keeping the session list tidy (issue #2)
• Session resume — agent_run / task_inbox accept an optional sessionId to continue an existing session (long tasks in multiple rounds, or resume after interruption)
• Model follows user settings — model is no longer hard-coded; omit it to let dsh use the user's/default model, or set config.model to override

Fixes

• dsh rc.6 unscoped context crash (issue #1) — setup now detects an unscoped agent ctx and skips the preset mount instead of crashing agent_run

Security & hardening (v0.1.2–v0.1.4)

• Default host changed to 127.0.0.1 (no more open 0.0.0.0 RCE surface)
• Optional Bearer token auth (config.authToken)
• Optional cwd whitelist (config.workspaceRoots)
• Remote MCP calls marked as plugin source, not user (privilege fix)
• Full session routing (GET/POST/DELETE) + on-close cleanup
• Configurable provider/model/preset, queue caps, LRU eviction, TTL cleanup

Thanks to @xybstone and @jjsjjtwo-del for the detailed reports and feature requests!