DeepShell Agent v0.1.1

Language: English | 简体中文

DeepShell Agent v0.1.1 Release-Hardening Closeout

Product: DeepShell Agent

Tagline: A desktop agent powered by DeepSeek Harness.

Version: v0.1.1

Status: Source closeout complete; macOS arm64 developer-preview binary publication authorized. Windows installer validation and formal signed/notarized distribution remain separate gates.

Date: 2026-09-10

1. Summary

v0.1.1 hardens the public v0.1.0 MVP baseline for outside testers and publishes a macOS arm64 developer-preview binary. It does not expand the architecture boundary: Tauri still owns the desktop shell and process lifecycle, the official DSH Web UI owns the base interaction, and the DSH Runtime owns Agent semantics.

This version adds release staging, diagnostics, package reporting, SBOM generation, vulnerability-audit entrypoints, a Windows x64 packaging route, and a clearer General/Coding/Work Mode surface.

2. Implemented scope

Area	Status	Notes
Version metadata	Implemented	App, Tauri, Rust package, runtime lock, and first-party DSH Bundle now use 0.1.1.
General Preset mapping	Implemented	Added deepshell-general beside deepshell-coding, deepshell-work, and legacy deepshell.
Agent Mode entry	Implemented	Reuses the official DSH Agent Preset UI for selection and adds a DeepShell Mode header indicator through a public Slot.
Diagnostics bundle	Implemented	pnpm diagnostics:collect exports local, redacted diagnostics under ignored staging.
Package report	Implemented	pnpm package:report records aggregate package/runtime metrics without local absolute paths.
Release staging	Implemented	pnpm release:stage prepares checksums, release-note draft, package report, SBOM, security-audit report, and support assets for release publication.
SBOM baseline	Implemented	pnpm sbom:generate derives a machine-readable baseline from the license inventory.
Vulnerability audit baseline	Implemented	pnpm security:audit scans Node/DSH/Rust where tools are available; --dry-run is available for deterministic checks.
GitHub Release route	Implemented for macOS arm64 developer preview	The release process publishes the verified macOS arm64 DMG and supporting reports as a GitHub prerelease.
Windows x64 route	Implemented as route/checklist	Added pnpm release:windows:check and a manual GitHub Actions packaging workflow. Real Windows installer acceptance and Windows artifact publication remain pending.
Install/upgrade/uninstall checklist	Implemented as checklist	Local process checklists exist under docs/plans/; public release notes should only carry summary status.

3. Explicit non-scope and remaining gates

This closeout does not claim:

• macOS Developer ID signing;
• Apple notarization;
• Windows code signing;
• Windows installer pass on real hardware or CI;
• formal signed/notarized public binary distribution;
• Windows binary publication before real Windows acceptance;
• telemetry or remote diagnostic upload;
• runtime slimming by removing DSH runtime capabilities.

Windows x64 installer validation remains a separate Roadmap item (REL-017). Signed binary distribution remains a separate Roadmap item (REL-018). The macOS arm64 package in this closeout is a developer-preview build: it is locally signed for packaging, but it is not Developer ID signed or Apple-notarized.

4. Validation summary

Validation run during development:

Command / check	Result	Notes
pnpm test:unit	Pass	Includes diagnostics, package report, release staging, SBOM, audit dry-run, and Windows route checks.
pnpm profile:prepare	Pass	Regenerated the ignored profile template with deepshell-general.
pnpm profile:verify	Pass	Verified Bundle/Profile/Preset relationships and fingerprints.
pnpm test:contract	Pass	Covers official UI Slots, Mode indicator registration, Preset mapping, and upstream boundary rules.
pnpm licenses:collect	Pass	Regenerated staging license inventory after Rust lockfile synchronization.
pnpm sbom:generate	Pass	Generated SBOM baseline.
pnpm package:report	Pass	Generated aggregate package report.
pnpm package:verified	Pass	Rebuilt E2E and Release artifacts, regenerated the macOS arm64 DMG as DeepShell Agent_0.1.1_aarch64.dmg, and compared E2E/Release security boundaries.
codesign --verify --deep --strict	Pass	Verified the generated macOS .app is valid on disk and satisfies its designated requirement. This is local packaging signing, not Developer ID notarization.
hdiutil verify	Pass	Verified the generated macOS arm64 DMG locally.
pnpm release:stage	Pass	Generated local staging for v0.1.1; macOS DMG, license inventory, SBOM, package report, security audit report, checksums, release manifest, and release-note draft are present. Windows installer remains missing until Windows validation.
pnpm diagnostics:collect -- --line-limit 20	Pass	Generated local redacted diagnostics.
pnpm release:windows:check	Pass with expected pending status	Current platform is macOS arm64; Windows installer pass is not claimed.
pnpm security:audit -- --dry-run	Pass	Verified audit report generation without external audit execution.
pnpm security:audit	Pass with non-blocking warnings	Production root dependencies: 0 vulnerabilities. DSH runtime dependencies: 0 vulnerabilities. Root all-dependency audit reports 4 high and 1 moderate advisories through the development/test WebdriverIO toolchain. Rust audit is marked tool-missing because cargo-audit is not installed locally.

The maintainer has authorized publishing the current macOS arm64 developer-preview package for v0.1.1. Windows binary release and formal signed/notarized distribution are not claimed by this closeout.

5. Public/private artifact boundary

Committed public materials may include:

• source scripts;
• tests;
• public Roadmap and release closeout documents;
• README / third-party notice updates;
• manual GitHub Actions workflow configuration.

Ignored/local materials remain outside the public source repository by default:

• docs/plans/;
• runtime/staging/;
• runtime/node/;
• runtime/dsh/;
• runtime/profile-template/;
• local .app, .dmg, .exe, logs, screenshots, diagnostics, and evidence files.

6. Release outcome and recommendation

v0.1.1 is closed as a source release plus macOS arm64 developer-preview binary release. Keep the GitHub Release marked as prerelease/developer preview until the remaining distribution gates are complete.

Before promoting the release to a formal general-availability binary:

1. manually verify macOS install/upgrade/uninstall behavior again when switching to Developer ID signing and notarization;
2. run the Windows workflow or validate on a Windows x64 machine before attaching any Windows installer;
3. install cargo-audit and rerun pnpm security:audit if Rust advisory coverage is required for release sign-off;
4. keep the release marked as Developer Preview until signing/notarization gates are complete.