0.3.7 - tracks DSH 0.2.1-rc.3 (client-UI-only release; wire registry byte-identical)

Tracking release for DSH 0.2.1-rc.3 (upstream tagged 2026-10-23, PR #6999 merge).

What rc.3 is

Six commits, all client-UI-side: navigation entry customization (#6247), nav pins / menu icons (#6883), analytics nav/preset tracking (#6600), the llm /models listing re-home (#6944), and the release bump. No wire method or namespace was added, removed, or re-spelled — scripts/dump-wire-surface.mjs run at the rc.3 tag produces the same 146-method registry, byte-identical to the committed rc.2 snapshot. No new admin-only community client bundle either.

What changed in 0.3.7

• The 10 @deepseek-ai/dsh-* devDependencies retarget ^0.2.1-rc.2 → ^0.2.1-rc.3. peerDependencies are unchanged — the >=0.2.1-alpha.1 <0.3.0-0 branch already admits rc.3.
• WIRE_SURFACE_DSH_VERSION pin → 0.2.1-rc.3; tests/fixtures/wire-surface.json re-stamped (method list unchanged).
• No other source changes. src/api-filter.ts metadata only; dist/client.js byte-identical after rebuild.

Multi-user re-evaluation

DSH 0.2.1-rc.3 still has no native multi-user accounts and no per-identity UI gate (packages/client/modules/src/index.ts — the boot graph — is zero-diff, so uiRoleGate is unaffected). rc.3's navigation-entry customization is content-level configuration, not a permission axis. dsh-login's role-based whole-UI gating (0.3.0+) remains the answer.

Verification

• vitest run: 21 files / 267 tests green — run before the retarget (on rc.2 node_modules) and again after (on rc.3).
• npm run build exit 0; npm run verify:imports ok.

Full write-up: docs/adapt-dsh-0.2.1-rc.3.md.

0.3.6 - issue #4: ordinary-user allow-list re-derived from the real 0.2.1-rc.2 wire surface

Bug-fix release for issue #4: on 0.3.5 ordinary (non-admin) users were silently locked out of a large part of the UI.

The bug

USER_ALLOWED in src/api-filter.ts was written against a pre-0.2 spelling set. On DSH 0.2.1-rc.2 every entry in it was a name that no longer exists, and every name that does exist was missing. The /api bridge checks that set per request (src/api-bridge-auth.ts), so a non-admin's first touch of any real method got the quiet "not permitted for this user" envelope. Admins short-circuit the gate, which is why only non-admins saw it.

Reported symptoms and the method behind each:

Symptom	Method
composer model dialog spins / forbidden	session.modelCatalog
"add workspace" refused	directoryPicker.pick / directoryPicker.list
Settings → Models: "failed to load provider catalog"	llm.listProviders / llm.discoverModels

The fix

The allow-list is no longer hand-maintained. The full wire surface is now classified exhaustively, and a test fails the build if the classification drifts from the DSH release it targets:

• 146 wire methods → 92 user-reachable, 53 admin-only, 1 host-internal (workspace.initializeDefault).
• WIRE_SURFACE_DSH_VERSION pins the release the snapshot describes (0.2.1-rc.2); tests/fixtures/wire-surface.json holds the registry.
• tests/wire-surface.spec.ts asserts the three buckets are disjoint and cover the surface, that no entry is dead, and — when a DSH checkout is present — cross-checks the snapshot against the live registry. A rename upstream becomes a red test instead of a silent lockout.
• scripts/dump-wire-surface.mjs regenerates the snapshot from a checkout (node scripts/dump-wire-surface.mjs --checkout ../deepseek-harness). It ships in the tarball.
• An unknown method that a non-admin is denied on is now logged once per method, with the target DSH version and the re-sync command. The quiet envelope is kept (no information leak), but a future rename is diagnosable instead of invisible.

Knock-on corrections: QUIET_DENY_METHODS re-spelled; USER_DOMAINS / adminOnlyMethods() / allDomains() derived from the buckets instead of duplicated; ADMIN_ONLY_NAMESPACES gains pluginInventory, pluginRegistryProbe, dynamicCordisRunner, claudeCodeMods; isReadProbe() matches read verbs as prefixes, so listProviders / listIndexes / discoverModels / getState stop being treated as writes.

directoryPicker.* is admitted (issue recommendation)

The reporter asked for the directory picker to be user-reachable, and it is: pick, list, createDirectory. The privilege boundary is the next hop — workspace.create — which stays confined to workspaceRoot/<username>. It also adds no capability class a user lacks: terminal.* already lets them run a shell as the same system user.

Verification

• vitest run: 21 files / 267 tests green (0.3.5 baseline: 20 / 256).
• Live cross-check against E:\code\deepseek-harness at 0.2.1-rc.2: snapshot 146 == live 146, zero unclassified, zero vanished.
• Wall-level regression: the five endpoints behind the three reported symptoms are asserted to reach the inner handler for an ordinary user, and a retired spelling (credentials.list) is asserted to be reported while a real admin method (credentials.describe) is not.
• npm run build exit 0 (dist/index.js 96 448 chars, contains the new surface); npm run verify:imports ok.

Full write-up: docs/adapt-dsh-0.2.1-rc.2-issue-4.md.

0.3.5 — DSH 0.2.1-rc.2 compatibility

Compatibility release for DSH 0.2.1-rc.2 (the release that went through alpha.5 → rc.1 → rc.2, 49 upstream commits).

What changed

• devDependencies: the 10 @deepseek-ai/dsh-* packages move from ^0.2.1-alpha.4 to ^0.2.1-rc.2.
• Vendor packages moved to their stable re-release (upstream PR #6388): cordis ~4.0.5, schemastery ~3.18.5, cordis-plugin-include ~1.0.10, cordis-plugin-loader ~1.0.6 (the dsh-0-2-1-alpha-3 npm dist-tags still point at the alpha vintages — do not pin those).
• No source changes. Own peerDependencies are unchanged: the existing >=0.2.1-alpha.1 <0.3.0-0 branch already admits alpha.5 / rc.1 / rc.2, and ~4.0.5-alpha.1 admits stable 4.0.5. The rebuilt dist/ is byte-identical to 0.3.4.

Compatibility notes

• Every integration point of this plugin (host/webserver, client/connection, settings, host/frontend-static, the client/modules boot graph, client/runtime + ui-slots, web-app, app-boot, gateway/remotes, plugin-manager/-market) changed only in package.json between alpha.4 and rc.2.
• All /api controllers have zero source diff, so the wire method registry is unchanged — USER_ALLOWED / ADMIN_ONLY_* and the pluginMarket admin-only remapping (0.3.4) need no edits.
• api/terminal-controller only gained client-side modules; its wire surface is untouched.
• New upstream packages (web/web-deepseek-api, client/ui-deepseek-model-label-1017, client/ui-settings-web-search) add no typert/wire namespace this plugin has to gate.
• dsh-client-connection's peers are now cordis ~4.0.5 + dsh-scope 0.2.1-rc.2; its client bundle is unchanged, so dist/client.js needs no re-stamp.

Multi-user & role gating (re-evaluated, unchanged)

Still no native multi-user support upstream: the recurring search yields only the same packages/api/remote-access substrate hit (authorize-only for non-owner peers; dsh-login users are owner principals), and client/runtime / ui-slots still carry no identity or role concept. Per-role whole-UI gating is therefore still not natively implementable — this plugin's uiRoleGate (boot-graph filtering, 0.3.0) remains the mechanism, and the boot-graph lever is intact at rc.2.

Verification

• npm install: no ERESOLVE; resolved to 0.2.1-rc.2 × 10 + cordis 4.0.5 / schemastery 3.18.5 / include 1.0.10 / loader 1.0.6.
• vitest run: 20 files / 256 tests green (baseline on alpha.4: also 256/256).
• npm run build exit 0; npm run verify:imports ok.
• Two-browser per-user isolation sign-off stays deployment-side.

Full analysis: docs/adapt-dsh-0.2.1-rc.2.md.

0.3.4 — track DSH 0.2.1-alpha.4 (pluginMarket admin-only, release stamp preserved)

Full Changelog: v0.3.3...v0.3.4

v0.3.2 — DSH 0.2.1-alpha.2 adaptation (TLS / webStartup / webRuntime retirement)

Full Changelog: v0.3.1...v0.3.2

v0.3.1 — bridge-wall per-user enforcement + deployment glue

Full Changelog: v0.3.0...v0.3.1

dsh-login v0.3.0

Added

• Per-role whole-UI gating (uiRoleGate, default on). For an ordinary (non-admin) session the gateway filters the window.__DSH_BOOT__ boot graph in the rendered index: entries in the ADMIN_ONLY_UI_PLUGINS deny-list are dropped, their batches patched or removed, and those admin-only client bundles never mount in the user's shell. Admins and uiRoleGate: false get the full graph. Presentation-only: the /api allow-list (apiBridgeAuth + USER_ALLOWED) remains the security boundary. Fail-open: any unexpected graph or HTML shape serves the original page unchanged. (No upstream DSH changes required - this is the boot-graph lever documented in docs/adapt-dsh-0.2.0-rc.2.md sec.6.5, now implemented.)

Verified

• Against DSH 0.2.1-alpha.1 builds from npm: full suite 19 files / 232 tests green (16 new ui-gate tests incl. 4 gateway integration tests on a real webserver boot), verify:imports ok, host build clean (client bundle byte-identical).

dsh-login v0.2.7 — DSH 0.2.1-alpha.1 compatibility

["Adaptation release for DSH 0.2.1-alpha.1 (npm dist-tag alpha, 266 commits after dsh-v0.2.0-rc.2).", "", "### Changed", "- Peer retarget onto the 0.2.1 tuple line: the six dsh peers gain || >=0.2.1-alpha.1 <0.3.0-0; @deepseek-ai/cordis gains || ~4.0.5-alpha.1; @deepseek-ai/schemastery gains || ~3.18.5-alpha.1 (node-semver prerelease tuple rule).", "- devDeps retargeted to the 0.2.1-alpha.1 builds (9 dsh packages, cordis ~4.0.5-alpha.1, include ~1.0.10-alpha.1, loader ~1.0.6-alpha.1, schemastery ~3.18.5-alpha.1).", "- The retired @deepseek-ai/dsh-invariants references removed (devDep, tsconfig path, two test-runner PACKAGE_MAP entries) — DSH 0.2.1-alpha.1 deleted the runtime invariant plugins and every ./invariant export (f028f25667).", "- No source change.", "", "### Verified", "- npm test: 18 files / 216 tests green on real 0.2.1-alpha.1 builds (fresh node_modules reinstall required — the stale rc.2 tree wedges ERESOLVE).\n- npm run build: exit 0; dist/client.js byte-identical (37134 chars).", "- Upstream re-check at 0.2.1-alpha.1: still no native multi-user, no per-role UI gate (isAdmin|isAllowed zero hits under packages/client); the new claudeCodeMods wire namespace rides the default deny.", "", "Details: docs/adapt-dsh-0.2.1-alpha.1.md. Full change set: https://github.com/islibaodong/dsh-login/compare/v0.2.6...v0.2.7"]

dsh-login v0.2.6

Full Changelog: v0.2.5...v0.2.6

dsh-login v0.2.5

Full Changelog: v0.2.4...v0.2.5