dsh-redline v1.0.16

Fix

Update now now works on profiles that enforce a package age policy. The in-app update runs pnpm add in the user's profile, and a profile with a minimum release age (or a lockfile entry for a package published in the last 24 hours) made that install fail with a supply-chain policy error. The update now passes minimumReleaseAge=0 and minimumReleaseAgeStrict=false for its own install, so it updates the plugin it was asked to update and nothing else.

Full Changelog: v1.0.15...v1.0.16

dsh-redline v1.0.15

Fix

The overlay loads the vendored html2canvas with a plain <script src>, which cannot carry the instance secret — with v1.0.14 that request was rejected and every screenshot failed to capture.

The vendored library under /.lr/vendor/ is a public MIT asset with no review data in it, so it is served without the secret again. Every other /.lr/* route keeps the instance-secret requirement and the restricted origins.

The smoke suite now covers the vendor route, so this cannot regress again.

Full Changelog: v1.0.14...v1.0.15

dsh-redline v1.0.14

Security

The loopback server no longer serves review data and screenshots to anyone who can reach 127.0.0.1.

• Instance secret: the host creates a random 32-byte secret on first boot and keeps it in the profile (~/.dsh/profiles/<profile>/dsh-redline/instance.secret, mode 0600). Every /.lr/* route except the public health probe requires it — as the x-dsh-redline-secret header, a Bearer token, or a key query parameter for image loads. Requests without it get 401 and no CORS headers, so a page on any other site can neither read the review data nor drive the control routes.
• The secret travels over the authenticated Harness connection: the client reads it from GET /api/dsh-redline.secret, the same authenticated channel the dsh uses for plugin routes, and hands it to the overlay it injects into the harness browser. The secret file itself stays inside the profile and is not served.
• Origins restricted: no more access-control-allow-origin: *. A response echoes the caller's origin only when the request carries the valid secret (the overlay keeps working on whatever site the harness browser renders); unauthenticated answers carry no CORS headers at all, so the browser blocks the read.
• The overlay authenticates every call, and attachment images are fetched with the secret and shown as blob URLs instead of putting the secret in a URL.

The smoke suite covers the new contract: 401 without a secret, 401 with a wrong secret, 200 with the right one, and no CORS headers for an unauthenticated third-party origin.

Full Changelog: v1.0.13...v1.0.14

dsh-redline v1.0.13

Security

The loopback server no longer serves review data and screenshots to anyone who can reach 127.0.0.1.

• Instance secret: the host creates a random 32-byte secret on first boot and keeps it in the profile (~/.dsh/profiles/<profile>/dsh-redline/instance.secret, mode 0600). Every /.lr/* route except the public health probe now requires it — as the x-dsh-redline-secret header, a bearer token, or a key query parameter for image loads. Requests without it get 401 and no CORS headers, so a browser on another site cannot read the answer.
• The secret travels over the authenticated Harness connection: the client reads it from GET /api/dsh-redline.secret, the same authenticated channel the dsh uses for plugin routes, and hands it to the injected overlay. It never crosses the loopback server unauthenticated.
• Origins restricted: no more access-control-allow-origin: *. The response echoes the caller's origin only for authenticated requests (so the overlay still works on any site the harness browser renders); unauthenticated answers carry no CORS headers at all.
• The overlay now authenticates every call, and attachment images are fetched with the secret and shown as blob URLs instead of putting the secret in a URL.

Full Changelog: v1.0.12...v1.0.13

dsh-redline v1.0.12

dsh-redline v1.0.12

Fixed

• The updates row no longer overflows the settings panel. A long release
  note pushed the row past the panel width. The row wraps now, and the release
  notes open inside the same panel instead of under the row.

What this release ships

The npm package dsh-redline@1.0.12 — install with dsh plugin --profile web add dsh-redline.
This GitHub release is what the plugin's update checker resolves from releases/latest.
After updating, restart the DeepSeek Harness: the host caches the built overlay and the vendored bundle, so a running app keeps serving the previous build until it restarts.

dsh-redline v1.0.11

dsh-redline v1.0.11

Fixed

• The plugin manager shows the name and the description. The plugin did not
  declare the locale service, so the metadata carried by
  locale/<lang>.json never reached the manager and the entry showed up
  blank.

What this release ships

The npm package dsh-redline@1.0.11 — install with dsh plugin --profile web add dsh-redline.
This GitHub release is what the plugin's update checker resolves from releases/latest.
After updating, restart the DeepSeek Harness: the host caches the built overlay and the vendored bundle, so a running app keeps serving the previous build until it restarts.

dsh-redline v1.0.10

dsh-redline v1.0.10

Fixed

• A profile install resolves the locale files and the manifest. The package
  only exported its main entry, so dsh-redline/locale/<lang>.json and
  dsh-redline/package.json could not be read from an installed copy. Both
  subpaths are exported now.

What this release ships

The npm package dsh-redline@1.0.10 — install with dsh plugin --profile web add dsh-redline.
This GitHub release is what the plugin's update checker resolves from releases/latest.
After updating, restart the DeepSeek Harness: the host caches the built overlay and the vendored bundle, so a running app keeps serving the previous build until it restarts.

dsh-redline v1.0.9

dsh-redline v1.0.9

Fixed

• The inspector rows and the pending counter follow the language. They
  looked up their translation by passing the Portuguese label as the key, so
  they fell back to the untranslated text. They resolve through the prop.*
  and pending keys now, which every language carries.

What this release ships

The npm package dsh-redline@1.0.9 — install with dsh plugin --profile web add dsh-redline.
This GitHub release is what the plugin's update checker resolves from releases/latest.
After updating, restart the DeepSeek Harness: the host caches the built overlay and the vendored bundle, so a running app keeps serving the previous build until it restarts.

dsh-redline v1.0.8

dsh-redline v1.0.8

Fixed

• The draft comment placeholder follows the language setting. It was hardcoded
  in English while the rest of the overlay translated.

What this release ships

The npm package dsh-redline@1.0.8 — install with dsh plugin --profile web add dsh-redline.
This GitHub release is what the plugin's update checker resolves from releases/latest.
After updating, restart the DeepSeek Harness: the host caches the built overlay and the vendored bundle, so a running app keeps serving the previous build until it restarts.

dsh-redline v1.0.7

dsh-redline v1.0.7

Added

• In-app updates, Composer Plus style. When a newer release exists, the
  Updates row offers Update now: the host fetches the release files from the
  version tag, stages and verifies them, swaps them into the plugin directory
  and reports installed — restart the dsh to load it. Local development copies
  (a .git in the plugin directory) are refused with a git-pull note.

Fixed

• Settings actually load from disk now. The host used readFileSync without
  importing it, so every boot silently fell back to defaults and the language,
  hotkeys and screenshot padding reset on each restart.

What this release ships

The npm package dsh-redline@1.0.7 — install with dsh plugin --profile web add dsh-redline.
This GitHub release is what the plugin's update checker resolves from releases/latest.
After updating, restart the DeepSeek Harness: the host caches the built overlay and the vendored bundle, so a running app keeps serving the previous build until it restarts.