v0.6.20 — subagent-aware reporting, natural translations, always-on-top pet

0.6.20 (2026-10-31) — subagent-aware reporting, natural translations, always-on-top pet

• The green Turn complete tick only belongs to the main chat. Delegated subagent sessions that finish (or fail, or get cancelled) used to report themselves as a completed turn, so the bubble announced Turn complete — sometimes saying 1 still running — while the main chat was still working. Only root sessions can now claim a finished result: a headless Turn complete / Run cancelled / Run failed headline appears only once no main chat is running; while one is live, the running headline wins even if another chat ended in the meantime.
• Running subagents are visible while they work. The headline on both surfaces now names them — ⏳ 1 running · 2 subagents — <chat> — and, while the main chat has no fresh assistant text yet, the collapsed detail line says 🤖 2 subagents running. When they finish the count drops and their progress milestones take over. Localized across all ten languages.
• Subagent progress is reported instead. A finishing delegated agent becomes a milestone in the bubble details — ✅ Subagent finished, ⚠️ Subagent failed, ⏹ Subagent cancelled with the session title — shown in the expanded log and, when the main chat has no fresh assistant text yet, as the collapsed detail line. Starting a new main-chat turn clears the previous turn's progress entries; the desktop companion shows the same milestones.
• Host /activity now distinguishes roots from delegates: runningCount counts main chats only, subagentCount counts delegated runs, running rows carry subagent/parent flags and a bounded progress list carries delegated finishes. Rows without session metadata keep the old behaviour (treated as main chats), so a DSH build that does not expose session.header.origin degrades gracefully.
• Unit tests 66 (three new activity tests plus a host-route test for a delegated finish) and the Chromium/Electron smoke suites now assert that a delegated finish never replaces the running headline on either surface.
• Every supported language got a copy-editing pass, including the bubble buttons and the desktop companion labels. Awkward literal translations were replaced with the wording a native speaker would expect: German Seiten-Pet → Pet der Seite, Japanese チャットへ → チャットを開く and 閉じる → 非表示 (the bubble Dismiss is a hide action, not a close action), Hindi खारिज करें → छिपाएँ, Chinese 置顶桌面窗口 → 宠物跨窗口置顶 and the subagent milestones now consistently say 子代理, plus 启用/重试宠物置顶, 仅用网页宠物, 前往会话.
• The desktop companion is named for what it is: the pet kept above other windows. In every language the settings row reads Always-on-top pet (Chinese 宠物跨窗口置顶), the buttons are Enable always-on-top pet / Retry always-on-top pet / Use page pet, and the hint that said the page pet stays available while the companion starts is gone. The companion is still on by default — an install without saved preferences starts the always-on-top pet immediately; turning it off is the user's choice.
• "Healthy renderer" jargon is gone. English, Spanish, Portuguese, French, German, Hindi and Arabic no longer describe the companion as healthy/sano/gesund/स्वस्थ/سليم: the status line now says it is ready, running correctly, or will be available once it is ready (the underlying desktopStatus values are unchanged).
• Smaller consistency fixes: Russian Повторить рабочий стол → Повторить запуск питомца and Включить рабочий стол → Включить питомца поверх окон; Spanish/Portuguese Reactivar → Quitar silencio / Tirar silêncio, French Réactiver → Quitter le silence; German Jetzt stumm → Jetzt stummschalten and Stummschaltung aus → Stummschaltung aufheben; Arabic desktop row gained its missing definite article and blocked runs is now الحظر instead of التعطّل; Japanese and Chinese labels name the always-on-top pet instead of a window.
• No API, layout or behaviour changes; the settings Language row, RTL handling, desktop companion synchronisation and the /language persistence contract are untouched. The Chromium smoke suite asserts the reworded Chinese bubble buttons (前往会话, 静音 30 分钟) and the always-on-top row (宠物跨窗口置顶).

v0.1.6 — audit hardening + latest-DSH compatibility

0.1.6 (2026-10-19) — audit hardening + latest-DSH compatibility

• Re-verified against DeepSeek Harness 0.2.1-alpha.1: webServer prefix routes, slots.inject/register, the combo client-bundle contract (exports["./client"]), and the agent/status, agent/disposed, session/event, session/disposed payloads still match. Removed the obsolete @deepseek-ai/dsh-client-runtime client inject/peer, added the @deepseek-ai/dsh peer, and bumped the version.
• Consume real nested DSH events, retain token spacing, and distinguish authoritative turn outcomes from idle. Preserve unread results independently across parallel sessions and seed already-running agents on activation.
• Reject cross-origin/non-loopback reads, GET mutations, malformed/aborted/oversized JSON and non-PNG/unbounded artwork. Remove wildcard CORS. Save settings atomically with visible failures. Browser authorisation accepts Chromium's sec-fetch-site: same-origin fetch metadata when a strict referrer policy strips Origin/Referer; cross-site, same-site and opaque requests remain rejected.
• Isolate activation state, subscriptions and child lifecycle. Derive the actual host port, scrub child environment secrets (keeping common OS variables case-insensitively), require desktop readiness/heartbeat before suppressing the page, and await shutdown. A cold Electron start gets a 60 s grace period; 20 s once a heartbeat proves liveness.
• Sandbox the desktop renderer, restrict CSP/navigation/permissions, validate IPC sender's main frame, and proxy an explicit request allowlist through Electron main with a private capability.
• Fix image replacement cache keys, async settings/poll races, portrait sizing feedback, secondary-display resize anchors, and preserve same-size/fractional-DPI and OS-cursor drag fixes. The helper re-anchors its window after monitor add/remove/metrics changes so the pet cannot stay off-screen while the page pet is suppressed.
• Share cancellable, deadline-bound browser polling; surface disconnects; clean up listeners/styles; separate drag/click, add keyboard controls and reduced-motion styling. Away notifications are explicitly opt-in, no longer rely solely on throttled background timers, and already-notified completions survive a reload via sessionStorage. The size slider keeps keyboard focus after stepping and redundant scale writes are skipped.
• Expand 13 helper tests to 54 host/activity/security/manifest tests plus real Chromium/Electron smoke coverage, including slot metadata, same-origin authorisation and bundle-contract assertions; add an architecture/comparison audit and correct installation/control/security documentation.