bkn-dsh plugin 0.2.1-rc.3-openbkn.0.2.1-2 (DSH baseline 0.2.1-rc.3)

DSH versions at or above 0.2.1-rc.3 may now attempt loading the plugin without an upper version ceiling. The legacy 0.2.0-rc.2 exception remains. This revision changes loading declarations, dependency-audit tooling and documentation; production code and declarations match the frozen local -2 candidate.

The maintainer formally accepted this existing revision on 2026-10-30 with two explicit nonblocking items. The package is reused without rebuilding, repacking or changing its version, source tag, registry bytes or five existing release assets.

• #63 — accepted diagnostic-evidence limit: the user-visible neutral guidance and independent diagnostics survive a controlled business-import failure. The actual Remote rejection brand/code/call phase and an observed-shape regression remain UNKNOWN/deferred. The maintainer explicitly revised the release/closure criterion and authorized closing #63 as completed for the UI fix; this does not claim the missing evidence was captured.
• Windows rc.5 diagnostic export — accepted nonblocking observation: two export clicks in the normal instance produced no observed dialog/file, while export from the fault instance succeeded. The cause is untriaged. This is disclosed as an observation, not a confirmed Host/plugin root cause, verified repair or all-scenario export acceptance.

The bounded Windows supplement passes official rc.5 native installation (exit 0, 94/94 files), actual runtime component loading and the controlled fault's neutral UI/diagnostic isolation. Existing Mac/Windows behavior evidence is reused. Diagnostic loaded-version and GUI exit-code fields remain unobserved; installation/loading evidence is not full rc.5 functionality or universal future-Host compatibility. The normal instance's runtime screenshots/AX and registry originals were retained privately and were not retrieved by the main session.

Install the fixed release revision in DSH:

@openbkn/dsh-business-context@0.2.1-rc.3-openbkn.0.2.1-2

• Native loading range: 0.2.0-rc.2 || >=0.2.1-rc.3, including later alpha, rc, stable and major versions. Permission to attempt loading is not a blanket functional-compatibility claim.
• Build and controlled test anchors remain pinned to official DSH 0.2.0-rc.2 / 0.2.1-rc.3. The generator, plugin Zod 4.4.3, actual Cordis/Schemastery physical identity checks, packaged MCP protections and platform-owned semantics are preserved.
• Actual isolated official CLI/profile installation passed on 0.2.1-rc.5 and 0.2.2-alpha.2, with 94/94 installed files matching their reviewed archives and no split Cordis/Schemastery. These are installation/resolution checks, not GUI or full alpha acceptance.
• Installation prerequisites remain: npm/pnpm strict peer policies use their own prerelease semantics and may warn or reject a different-core prerelease even when native DSH loading admission permits it. No peer checks are disabled, no required peers are optionalized, and no Host exemptions are added. Each Host's own Node floor still applies (0.2.2-alpha.2 requires Node >=24.9.0).
• OpenBKN 0.2.1 in the package name is this release identifier. Real platform acceptance remains on OpenBKN 0.2.0; it is not a platform-upgrade or platform-0.2.1 acceptance claim.

Independent non-author approval and CodeQL passed on PR #117. Build-only CI 41039214129 passed: 657 plugin tests plus 1 Windows-only skip, 79 repository checks, companion-preservation checks and the existing controlled host checks. Existing Mac/Windows behavior evidence is reused; no passed live GUI, B1, G6, BOM/CSV or platform cases were replayed.

The frozen local reference is SHA256 0aacc67bbb157c06b8907eeea549d22bd98b4e4639839ba784a233686de88767. The build-only CI archive is SHA256 d342cccae39310fe9b76ad4de9da16a8f7c4aac427af28efcbfd21b5f2902d9f (94 files). Only the two public-install README updates and package.json serialization differ; parsed package metadata, production code, declarations, CLI preload and packaged MCP bytes are identical.

Tag/OIDC publication 41041515570 succeeded at merged commit aa0c43f7e8e45249da312768d458cc9452ca05b2. The tag-build archive is byte-identical to build-only CI. The actual npm registry archive (attached here) has SHA256 6ce96d5bac3bb83e3b75b42cb217954e8b72f5ea7866e7536154cc12f20ae2d7, 258478 bytes and 94 files. It is byte-identical to the release-preparation archive; compared with the frozen local candidate, only the two README files differ (92/94 files identical). Compared with build-only CI, only package.json serialization differs, with identical parsed metadata. All production code, declarations, CLI preload and packaged MCP bytes match. Registry SHA1/SHA512 integrity and the published provenance subject/source/workflow/run fields were checked; independent cryptographic signature validation was not performed.

The attached file inventory, comparison and verification receipt preserve these boundaries. npm rc points to this revision. npm latest remains 0.2.0-rc.2-openbkn.0.2.0-13 and GitHub Latest remains v0.2.0-rc.2-openbkn.0.2.0-13 at publication checks; promotion is reserved for the maintainer. This release is now a formal GitHub release with latest=false. npm latest and GitHub Latest promotion remain exclusively with the maintainer; clearing the GitHub prerelease flag does not promote the npm dist-tag. Existing Hosts, official OpenBKN 0.2.0, data and configuration are unchanged.

bkn-dsh plugin 0.2.1-rc.3-openbkn.0.2.1-1 (DSH 0.2.1-rc.3)

OpenBKN Business Context plugin for DeepSeek Harness dsh-v0.2.1-rc.3. Installing the plugin is all you need:

dsh plugin --profile <desktop|web> add @openbkn/dsh-business-context@0.2.1-rc.3-openbkn.0.2.1-1

Setup: README · 中文. npm: https://www.npmjs.com/package/@openbkn/dsh-business-context/v/0.2.1-rc.3-openbkn.0.2.1-1. The attached .tgz is the published npm tarball.

Changes

• Publish the reviewed automatic-login increment from PR #114 as the first public revision of the already published 0.2.1 pairing. Retain the frozen auto.local.2 reference and its exact Mac/Windows evidence; this revision changes release metadata and installation documentation, not runtime behavior.
• Start official CLI authorization in an owned Chrome/Edge profile, automatically remember the configured private peer, and require fresh browser authorization after origin, observed IP or leaf changes. Ordinary access-token renewal remains with the official CLI.
• Deliver the native MCP fetch/same-origin backport inside the plugin, without a manual companion or Host replacement. Keep MCP and native-reader transports bound to the authorization generation that supplied their credentials; three source and compiled regressions cover the reviewed race correction.
• Show the verified login result in the currently open panel before iterator cleanup. Reuse passed Mac and Windows affected tests; retain the original five-minute lag, unknown unique cause, unobserved Windows exit code and exact-transition limits.
• Preserve the explicitly accepted private-environment trust policy: observed pin authentication replaces public CA/hostname checks and provides no public-PKI first-contact assurance. CodeQL alerts #15/#16 have narrow reviewed accepted-design dispositions. Certificate dates, origin/peer checks and redirect fences remain enabled.
• Retain two nonblocking limits: owned authorization browser profiles and superseded generation directories stay on disk, and discovery/connection TLS handshakes each have a five-second bound independent of the request timeout. No new cleanup framework or retries are added.
• Actual platform/official CLI evidence remains 0.2.0; OpenBKN 0.2.1 is the release identifier. Existing Hosts, formal platform, data and configuration are unchanged. Publish to npm rc and a GitHub prerelease only; latest promotion and local npm CLI setup remain maintainer-owned.

Revision-specific setup and historical guides

Use the README shipped with this exact plugin version for automatic private-platform authorization and packaged MCP setup. The linked illustrated guide and PDF retain screenshots and CA/companion steps from older packages; those steps are not prerequisites for this revision. This Release carries the plugin archive and its verification receipts, without the historical profile companions.

Actual platform/CLI evidence remains on 0.2.0. The OpenBKN 0.2.1 segment is the release identifier. Historical failures, unknown timing/exit-code limits and accepted private-trust boundaries remain in the linked evidence; this rc does not claim every form or a new OpenBKN 0.2.1 platform acceptance.

Published-package verification

• Source tag: v0.2.1-rc.3-openbkn.0.2.1-1, fixed commit 31ea61ecb3778bf889af9b3b7c74916a5bd5640c after independently approved PRs #114 and #115.
• Publication workflow 40966543756 succeeded through npm Trusted Publishing with provenance, using the rc dist-tag.
• Registry archive: 258133 bytes / 94 files, SHA256 7052ce5c6109301381a83768afa47a85f6c5eb5acb14913bc3d7a1bd7c4ffc76. It is byte-identical to the local prepublication archive. Registry SHA1 and SHA512 integrity match; registry gitHead matches the fixed source commit.
• Against verified CI40920391148/archive 7c99d259…, 91/94 files are byte-identical. Only package.json (version only after parsing), README.md and README.zh.md differ. Runtime code, declarations, CLI preload and packaged MCP are unchanged.
• The release-build CI archive differs from the registry archive only in package.json serialization; the parsed manifests are identical. The attached archive is the exact registry archive users install.
• Existing source/compiled and Mac/Windows affected evidence is reused. No new live Host, model, platform or business-acceptance case was run for this metadata/documentation revision.

See package comparison, 94-file inventory, and the publication receipt attached to this Release. npm latest and GitHub Latest remain maintainer-owned and are not promoted by this rc.

bkn-dsh plugin 0.2.1-rc.3-openbkn.0.2.1 (DSH dsh-v0.2.1-rc.3)

OpenBKN Business Context plugin for official DeepSeek Harness 0.2.0-rc.2 and 0.2.1-rc.3. Install the exact plugin version below and the matching profile MCP companion for the reviewed #105 same-origin protection; the plugin does not install that companion automatically:

dsh plugin --profile <desktop|web> add @openbkn/dsh-business-context@0.2.1-rc.3-openbkn.0.2.1

Setup: README · 中文. npm: https://www.npmjs.com/package/@openbkn/dsh-business-context/v/0.2.1-rc.3-openbkn.0.2.1. The attached .tgz is the published npm tarball.

Current publication status (2026-10-29)

• Published version: @openbkn/dsh-business-context@0.2.1-rc.3-openbkn.0.2.1; npm rc points to it. npm latest still points to 0.2.0-rc.2-openbkn.0.2.0-13. Local npm authentication and later latest promotion remain with the maintainer; this notes update performs neither.
• This GitHub Release remains a prerelease. Its classification and npm dist-tags are independent; this update does not change either.
• Feature PR #106 merged as ddbf578b93efca1872e0ae9781dafae5713e9deb. Subsequent PRs #109–#112 deliver documentation/public evidence only. All eleven bkn-dsh issues in OpenBKN 0.2.1 Project 12 are closed, including #93/#97; closed investigations retain their original limits.

Final CI and unchanged artifacts

Existing run	Result
Final candidate 40361613728	Passed, publish=false, source db68c80070f3475a1a460c3c9fca84d26944e198; build, tests, package inspection and controlled checks on both official npm Hosts.
Main rehearsal 40368159024	Passed; 82 files and candidate tgz bytes match the accepted final candidate.
Publication 40369214007	Passed; published this npm version under rc and created this release.

Accepted candidate SHA256: 27ccf15c46e4f71ef850ee481e22556b70f4d4795e89d7d587a2e3210fc6b3e3.
Published npm/GitHub tgz SHA256: 3a877e1fa6ae218b36cfc4d65ca0bb1b6e17363880465ac164c31a89e14ed46d.
Both contain the same 82 paths; only package.json serialization differs and the parsed metadata is equal. Both 12-file companion packages match their accepted manifests. The eight existing release assets, package version, archives and tag are unchanged. This refresh runs no new build, tests or CI and does not republish the package. The package README remains its frozen release-time snapshot.

Exact compatibility and companion requirement

• Runtime peers declare official DSH 0.2.0-rc.2 or 0.2.1-rc.3. DSH 0.2.1-rc.4, 0.2.2-alpha.2 and other versions are outside this artifact's declared and verified scope. The independent build generator remains pinned to 0.2.0-rc.2.
• Actual platform/CLI evidence is OpenBKN 0.2.0 and CLI 0.2.0. The OpenBKN 0.2.1 component is the maintainer-approved release identity, not platform-0.2.1 or unreleased-main acceptance.
• Choose openbkn-mcp-old-same-origin-r1.tgz for DSH 0.2.0-rc.2, or openbkn-mcp-rc3-same-origin-r1.tgz for 0.2.1-rc.3. Follow the attached README and placement/mounted-instance verification/rollback guide. The plugin does not automatically install the profile companion. Keep the official application and its signature. Scope is the reviewed fixed-Bearer business bridge, not stock-Host/global SDK/OAuth repair; dependency cleanup/reinstallation and later Host upgrades may replace it.

Accepted evidence and limits

• #93 API/Studio same-record evidence and #97 Mac npm/Web linkage evidence close their issue-specific gaps. Mac uses public Session/Workspace APIs to recall an existing enterprise record: three claims and eleven current-pair relations were checked. It is not a new model turn or a correctness verdict on the recorded answer.
• The Windows rc.3 Desktop native-UI supplement is PASS_WITH_LIMITS for the specified existing record. Directly constructed storage replay does not validate answer attribution/binding; a forced schema-reference view switch remains UNKNOWN, the initial renderer-crash cause remains UNKNOWN, and that supplement's optional real-business CSV case is NOT_RUN. Earlier packed CSV checks are separate. The coordinating review checked public files/digests, not the private Windows screenshot/AX/crash/registry originals.
• Final-candidate affected Mac/Windows backend/profile/Reader/CSV evidence and earlier GUI/locale/login/B1/MCP-vector evidence retain their exact scopes and artifact identities. This is not a full fresh GUI/model/G6 matrix. Original FAIL/BLOCKED/UNKNOWN and formalAcceptanceEligible=false records remain unchanged.
• #98 and #108 closed as bounded investigations under the maintainer's disposition, not universal fixes. Historical runner/browser/Job/menu and startup identity/window/cleanup qualifications remain disclosed below and in the linked reports.
• Foundry #2573 remains an independent retained-platform evidence-channel issue. Existing enterprise samples do not prove that environment repaired. Platform/model business findings retain their upstream ownership. The plugin preserves platform states, reasons, raw records and native answers without arbitration, corrective turns, fabricated relations or duplicate business calculations.

The current acceptance ledger is the consolidated scope record. Earlier -30/-31/-32 checkpoints and original failures remain historical evidence.

Changes

• Consolidate the 0.2.1 feature commits and local implementation on the latest main history while preserving this release line's verified native provenance, login, focus, locale and scoped CSV-delivery behavior. Do not adopt the parallel -11/-13 package or its different modal-dismissal policy.
• Name the plugin for DSH 0.2.1-rc.3 and the requested OpenBKN 0.2.1 version identity without a republish suffix. Keep both reviewed Host versions and the independent old generator pin; actual retained-platform verification remains OpenBKN 0.2.0/CLI 0.2.0, not an OpenBKN 0.2.1 platform acceptance claim. The maintainer explicitly confirmed this naming interpretation.
• Deliver the unchanged, verified profile MCP same-origin backports and placement/rollback instructions as companion assets. This protects the verified business bridge when the matching companion is loaded; the plugin alone does not install it, and stock Hosts/global SDK OAuth are not declared fixed.
• Keep business answers under model/OpenBKN ownership. The existing-record native API/Studio and Mac linkage gaps in #93/#97 are now closed with scoped evidence. Foundry #2517 closed the Community/extension classification; #2573 remains a separate retained-platform evidence-channel issue. Business/model findings remain tracked upstream, including #2515/#2516 with their actual issue states. Retain original FAIL/BLOCKED verdicts without answer arbitration or corrective turns.
• Record the real restricted-account allow/deny case as scoped PASS. Retain historical runner/browser and menu findings, browser trust and macOS association evidence limits. The Windows rc.3 welcome-window X is accepted only for that owned-tree exit; the original menu FAIL, controller timeout, manual restore and unobserved exit code remain recorded.
• Mitigate GHSA-mrhx-c7xc-m3w5 on this plugin's native reader: check the existing 21 array limits and 64-entry selected-pair-graph limit before validating child values. Preserve accepted data, Zod 4.4.3 and Host pins; oversize failures retain their explicit budget classification. Stock Host/dependency advisories remain open, not globally fixed.
• Refuse missing/malformed executor content with a controlled CSV error and reject Windows-invalid star filenames before dispatch or file creation. Preserve the original CSV bytes and business content.
• Fixed build-only CI 40361613728, main rehearsal 40368159024 and publication 40369214007 passed. The affected final-candidate Mac Node/Electron and Windows backend/profile/Reader/CSV checks have been received within their documented scope. Earlier GUI/UI/B1/MCP-vector evidence retains its original identity. The package is already published on rc; latest promotion remains a separate maintainer-owned action.

All notable changes to this project are documented here.

Final Windows evidence and maintainer closeout (2026-10-27)

• The final CI candidate (run 40361613728, SHA256 27ccf15c46e4f71ef850ee481e22556b70f4d4795e89d7d587a2e3210fc6b3e3, 82 files) completed the affected Windows npm and Desktop-backend business autoload/profile-MCP checks, packed Reader checks and CSV boundary scenarios. Windows receipt. This is scoped affected validation, not full GUI/model/G6 acceptance.
• #108: one old-Windows-npm full start and one no-business control start both applied; this bounded pair did not reproduce the earlier four c...

bkn-dsh plugin 0.2.0-rc.2-openbkn.0.2.0-13 (DSH dsh-v0.2.0-rc.2)

OpenBKN Business Context plugin for DeepSeek Harness dsh-v0.2.0-rc.2. Installing the plugin is all you need:

dsh plugin --profile <desktop|web> add @openbkn/dsh-business-context@0.2.0-rc.2-openbkn.0.2.0-13

Setup: README · 中文. npm: https://www.npmjs.com/package/@openbkn/dsh-business-context/v/0.2.0-rc.2-openbkn.0.2.0-13. The attached .tgz is the published npm tarball.

Changes

Host-adaptive Chinese/English UI and modal-state recovery for official DSH 0.2.0-rc.2 with OpenBKN 0.2.0. This release combines the English UI introduced in -11, the accepted -12 recovery fixes, and the final Chinese provenance-copy correction.

• Follow the DSH language preference across the plugin entry, network directory, settings/CLI setup, diagnostics, context card, session suggestion and existing provenance tabs. Platform-owned text, business values, IDs and model output remain verbatim.
• Preserve unsaved settings, validation errors, network search/expansion, the last diagnostics report and the current provenance tab/selection when a Desktop modal is dismissed to change the Host language. Explicit Back and refresh actions retain their documented behavior.
• Keep one pending CLI login across modal dismissal and synchronize its completion without requiring Refresh status. This does not change the CLI authentication protocol or add automatic login retries.
• Complete plugin-owned Chinese provenance reference labels and the platform-execution explanation; retain the English explanation and fix the space after “Platform URL:”. Keep text and close controls readable on white dialogs under a dark Host theme.
• Retain the DSH 0.2.0-rc.2 pin, runtime dependencies and six Host/Remote JavaScript files from -11. The unfinished 0.2.1 compatibility, native provenance and CSV-export work is not included.

Acceptance: the exact -13 CI candidate was checked on macOS and native Windows, Desktop and npm/Web. Windows target-copy evidence is complete; unchanged -11/-12 behavior reuses its reviewed baseline. See the release acceptance record and release notes. This is not a fresh full business/model G6 run or acceptance of every live-data branch.

Known limitations:

• Windows login command carrier processes may remain until the Host exits; Ctrl+C may leave the npm/Web Host running. These are retained known issues. Stop only the identified test Host tree when needed.
• Desktop overlays remain modal: close the overlay, change the Host language, then reopen. The release does not claim that Host settings can be changed while a modal stays open.
• Live counted-timeline and nonempty-graph selection cases remain BLOCKED where the available data does not exercise them. Web diagnostics may report unknown Host form or unavailable loaded-version metadata; exported nulls are preserved.
• The pinned DSH MCP peer stack uses @modelcontextprotocol/client@2.0.0, with open upstream OAuth issuer-binding and cross-origin redirect advisories. The SDK is supplied by DSH, not bundled in this plugin. This plugin uses an explicit bearer header rather than an SDK OAuth provider, but HTTP transport redirect exposure is not claimed to be fixed. Host/SDK remediation requires a separate reviewed compatibility change; do not silently update this accepted artifact.
• A self-signed platform requires the correct signing CA in the Node trust configuration before starting DSH/CLI. The Windows TLS failure was addressed by correcting the local CA bundle, not by disabling verification or changing plugin code. Device authorization must finish within the platform-provided expiry window.
• The specifically identified A7 duplicate-start error is an expected guard refusal while an interaction is already open. Keep the original error and dispatch=unknown; no guard relaxation is included. Historical unretained response/process details remain unknown.

Release disposition and published-package verification

The maintainer accepted the existing pinned-DSH MCP HTTP redirect risk for this unchanged -13 release. Follow-up is tracked in #105, assigned to @kalias in OpenBKN 0.3.0. No upstream security fix or dependency upgrade is claimed by this release.

The registry-served package and this release's tarball are byte-identical. All 74 unpacked paths match the accepted candidate: 73 files are byte-identical; package.json differs only in the top-level scripts key position and a final newline, with all keys and values unchanged. Published tarball SHA-256: 6c7d2fe49d1a67c807e6fef4ca6623a42da51214d85d5a05a6c6a9c20afb4478. The registry integrity and provenance subject/source/tag/workflow/run fields were checked.

Review: English candidate 13 copy follow-up

Copy-only candidate for official DSH 0.2.0-rc.2. This is an independent review prerelease; no npm publish, dist-tag change, production tag or GitHub Latest promotion.

Includes the Chinese provenance explanation correction made after the accepted -12 artifact. The client JavaScript and its generated locale declaration each change by exactly one sentence; package.json changes only its version. All other 71 files, including the six Host/Remote JavaScript bundles, are byte-identical to -12. Dependencies and compatibility pins are unchanged.

• Candidate: 0.2.0-rc.2-openbkn.0.2.0-13, 74 files.
• CI source: 91b2297b3070277ce0cba25a986bcaec35256f05.
• Build-only CI: https://github.com/openbkn-ai/bkn-dsh/actions/runs/39968315495 (publish=false, successful).
• Candidate SHA-256: 8290a0b89d9af5118b0aeabc09499c5085114047f469fe631835b808f52d3675.
• Windows copy kit SHA-256: a9142588c9b601e6e12c15003c9f1f9549a08b206c72b94a13d2452708cf42d4 (13 files).

macOS Desktop and npm/Web both displayed the corrected Chinese sentence and unchanged English sentence using this exact CI package. A copy of an existing isolated protocol-acceptance session was used; no new model/business turn or device authorization was performed. Windows is pending only the same copy check: one Host/package receipt and one Chinese/English screenshot pair per form, reusing the existing -12 test roots. Use WINDOWS-COPY-HANDOFF.zh.md; do not rerun full D1-D4, E00-E10, G6, authorization or cold-start matrices.

The identified npm/Web A7 event is recorded as an expected duplicate-start guard denial; retain its error event and runtime dispatch=unknown. Its original supplementary ZIP has not yet been independently received on the Mac. Windows runner lifetime and Ctrl+C remain known issues; earlier missing count/nonempty-graph cases remain BLOCKED.

npm remains rc=-11 / latest=-10. The -11 and -12 packages, return archives and review release are retained unchanged. Attachments contain the candidate, minimal tools and summary documents only; no raw session, private log, credentials, business screenshots or Windows return archives are uploaded by this review.

bkn-dsh plugin 0.2.0-rc.2-openbkn.0.2.0-11 (DSH dsh-v0.2.0-rc.2)

OpenBKN Business Context plugin for DeepSeek Harness dsh-v0.2.0-rc.2. Installing the plugin is all you need:

dsh plugin --profile <desktop|web> add @openbkn/dsh-business-context@0.2.0-rc.2-openbkn.0.2.0-11

Setup: README · 中文. npm: https://www.npmjs.com/package/@openbkn/dsh-business-context/v/0.2.0-rc.2-openbkn.0.2.0-11. The attached .tgz is the published npm tarball.

Changes

• Add English translations to the existing OpenBKN entry, network directory, settings and CLI setup, diagnostics, context-tool card, session suggestion and all three existing provenance tabs.
• Follow the native DSH language preference through its public locale registry. Switching Chinese/English updates already-open views and displayed errors without new authentication/platform reads, repeated login, lost form input or reset provenance selection.
• This is a localization-only release based on published v0.2.0-rc.2-openbkn.0.2.0-10 (5b885dd7492fd42951b21729984f0d1e99da8b0d). The six published Host/business/diagnostics/Remote JavaScript files are byte-identical to -10; only the client JavaScript, client declarations, resources, documentation and version metadata change. Runtime dependency and DSH compatibility pins stay unchanged (0.2.0-rc.2).
• Platform-owned text, business facts, identifiers, exported diagnostic JSON and model output remain verbatim. The unfinished development branch's login lifecycle, native provenance, CSV export, access-policy and dual-host changes are not included.
• Verification and candidate identities are recorded in the English release evidence. npm publishes to rc first. Windows acceptance of this exact candidate and promotion of npm latest remain separate gates; this release does not claim a fresh full-platform/model G6 run or new Windows runtime acceptance. Existing -10 limitations, including its historical B1 authentication anomaly, remain applicable.

Verified publication

The accepted CI and main rehearsal packages contain the same 74 files. The published package was compared back to that candidate; all six non-client JavaScript files remain byte-identical to published -10. Published SHA-256: ed29647e30a7e7c91d22217fdd810e0d3a1e7f49ca4a1274c5b4486f7b206f60. Both official macOS Desktop and npm/web language/catalogue/diagnostics checks passed; 443 plugin tests passed with one Windows-only skip, and 60 repository checks passed. The unchanged Host code passed 16/16 no-model live guard checks.

Detailed verification · Package comparison · Registry provenance. npm rc is -11; npm latest remains -10 until this package completes Windows acceptance.

Windows acceptance handoff (pending)

Prepared on 2026-10-22: Windows acceptance kit (zip) · SHA-256 · Chinese operating checklist.

The kit contains the unchanged published -11 tarball, exact-file verification, separate Desktop and npm/Web preparation/launch scripts for official DSH 0.2.0-rc.2, E00–E10 per form, an all-NOT_RUN results template and the maintainer promotion procedure. It covers native Host language hot switching in both directions, retained inputs/search/selection, all three provenance tabs, dynamic counts, unchanged platform/model text and cold starts in both languages. The official Windows installer is fetched from a fixed vendor URL and verified on Windows; it is not included or automatically executed.

Kit SHA-256: 34ff83872b96ad584762cdda4b5b6c99b3573ec26932d56acb6ae6c1e7054d38. Eight local tooling tests and PowerShell 7 helper checks passed on macOS; these are not Windows runtime or visual acceptance. Windows Desktop, npm/Web and PowerShell 5.1 execution remain pending. npm latest remains -10 until both real Windows forms pass and the returned original evidence is reviewed; no kit script changes npm tags.

English -12: Windows review candidate

Current Windows review scope: incremental

Use WINDOWS-DELTA-HANDOFF.zh.md (also the current WINDOWS-HANDOFF.zh.md) and DELTA-RESULTS.template.zh.md. The maintainer requested four affected client groups per form, one combined fresh authorization per form, one current Host/package receipt and cleanup. Existing exact-candidate evidence can be reused. No repeat E00-E10/full business/G6 run, bilingual cold-start matrix, installer roundtrip or no-plugin Ctrl+C control is required when the verified environment is unchanged.

The original ZIP and plugin hashes below are unchanged; no redownload of an already verified copy is needed. The full CHECKLIST and Review-Results.mjs embedded in that ZIP remain reference tools and are not the incremental protocol. Do not feed delta results into the full checker or fabricate the full case/restart records. Preserve baseline-only evidence, historical FAIL/BLOCKED, missing real data and unresolved anomalies. None of this changes the npm publication hold.

Build-only review candidate for native Windows Desktop and npm/Web acceptance on official DSH 0.2.0-rc.2. This prerelease is not GitHub Latest and does not publish the plugin to npm.

• Plugin version: 0.2.0-rc.2-openbkn.0.2.0-12
• Plugin source: 5519645
• Build-only CI: https://github.com/openbkn-ai/bkn-dsh/actions/runs/39791127284
• Plugin tgz SHA-256: 30a94300994296513b8d391acda69933acf1f4a77440e9da53486a0de5bd1a44
• Kit source: f6554e1 (clean)
• Kit ZIP SHA-256: 43abbacd0018763057c540ad823bf229abc33e79e0e0aa0c77ecdad8b34996c0 (24 files, 284571 bytes)

The package fixes retained modal state and pending login completion, supplies an explicit configuration exit, translates owned provenance labels and fixes spacing/dark-theme readability. Six Host/Remote JavaScript files remain byte-identical to published -11.

450 plugin tests, 60 repository tests, typecheck and package checks passed. Eleven kit tests and eight PowerShell parser/helper smoke checks passed on macOS; native Windows execution remains pending. The exact artifact passed real macOS Desktop/npm UI checks and four fresh device authorization flows; full model/provenance-data acceptance is not claimed. Original failures remain preserved.

Download WINDOWS-HANDOFF.zh.md for the forwardable operator prompt and WINDOWS-ENGLISH12-CHECKLIST.zh.md for the full checklist. The ZIP embeds the original CI tgz, fixed official Host pins, package/kit manifests, receipt collectors, process cleanup and result-review tooling. Credentials and CA files are not included.

All npm publication and dist-tag changes remain on hold throughout and after review: rc=-11, latest=-10. Return original evidence and checks for independent maintainer review even if all Windows cases pass. Missing real count/graph data must remain BLOCKED. Do not create a production v* tag or execute npm publish/dist-tag commands.

PR: #103

bkn-dsh plugin 0.2.0-rc.2-openbkn.0.2.0-10 (DSH dsh-v0.2.0-rc.2)

OpenBKN Business Context plugin for DeepSeek Harness dsh-v0.2.0-rc.2. Installing the plugin is all you need:

dsh plugin --profile <desktop|web> add @openbkn/dsh-business-context@0.2.0-rc.2-openbkn.0.2.0-10

Setup: README · 中文. npm: https://www.npmjs.com/package/@openbkn/dsh-business-context/v/0.2.0-rc.2-openbkn.0.2.0-10. The attached .tgz is the published npm tarball.

Changes

• Diagnostics now displays Windows/macOS/Linux names and explains unavailable host-form and version fields. Exported identifiers and nulls remain unchanged; disk and loaded versions are kept separate.
• CLI setup accepts only the fixed 0.1.5 / 0.2.0 installation targets and verifies the selected version. Existing CLIs are retained; mismatch hints appear only after an explicit version choice and require an explicit path change or user-managed update.
• Accept documented large-network navigation shells in the optional profile without presenting omitted indices as zero concepts; malformed responses and network mismatches remain failures.
• Recognize explicitly unrecorded Trace lifecycle results while retaining tool/network/single-turn guards. A successful finish ends governed access even when its result provides no usable provenance ID. No stale Interaction IDs or fabricated receipts; provenance preserves the local timeline and labels Trace disabled/unavailable.
• Add a pinned 0.2.0 preparation-source contract including dynamically built lifecycle/context schemas. The upstream nullable output-schema discrepancy is tracked separately in Foundry #2106.
• Acceptance: the unchanged 70-file CI candidate from source 9a35c0d9d1263b5f39b24d596f07dbcedbf25d04, CI 38209375894, SHA-256 a91adc9e342faa4f763d73487cd56d2f4ead8bb21bf755ca11426f77d90c9bae, passed the user-approved minimum on official DSH 0.2.0-rc.2 Desktop/npm on Mac and Windows. Diagnostics display/export, explicit CLI 0.2.0 selection/detection, sign-in and listing were exercised in the UI; one official tool-runtime probe per OS exercised real scoped CLI/MCP start/read/finish and post-finish refusal. Navigation and Trace-disabled/unavailable cases used controlled fixtures. See Mac results, Windows results, and release readiness.
• SDK acceptance used the user-authorized release/0.2.0 source build c404354793146edab944b7e5a79908bf41ddd591, SHA-256 7391c658e831b9f11bc36fd7fcecfa30e41ecc4123a005bfee811e44b60eb43c. This is not registry automatic-install acceptance. The platform backend reported 0.2.0-release.20261011115044.sha06c5a87; actual local EE image variants and live tool schemas are recorded in the Mac evidence, without claiming every service is an official release binary.
• Retained limits: no live large-network or natural Trace-switch scenario, fresh 0.1.5 real-host run, model/G6 rerun, or non-empty receipt-chain acceptance was performed. Successful empty operations/business-graph reads establish availability of those reads, not complete provenance. On Windows Desktop, the panel closed when starting CLI login; browser authorization and reopening/network listing succeeded, but in-panel progress was not observed. This observation remains unresolved.
• B1 remains an unresolved historical long-running authentication anomaly; short same-owner synchronization passed, without proving natural-expiry recovery or a root cause. No credential rotation or MCP reconnect fix is claimed. If business access remains refused after a completed sign-in, restart DSH and retry. B1 is not a mandatory long-running reproduction for every unchanged release.

bkn-dsh plugin 0.2.0-rc.2-openbkn.0.2.0-9 (DSH dsh-v0.2.0-rc.2)

OpenBKN Business Context plugin for DeepSeek Harness dsh-v0.2.0-rc.2. Installing the plugin is all you need:

dsh plugin --profile <desktop|web> add @openbkn/dsh-business-context@0.2.0-rc.2-openbkn.0.2.0-9

Setup: README · 中文. npm: https://www.npmjs.com/package/@openbkn/dsh-business-context/v/0.2.0-rc.2-openbkn.0.2.0-9. The attached .tgz is the published npm tarball.

Changes

CLI setup inside the existing advanced settings. Same DSH 0.2.0-rc.2 pin and authentication flow.

• Detect an executable CLI on the current Host PATH or in bounded common locations and npm's global prefix; display its version and put its resolved path into the settings draft. Existing usable versions are retained.
• Add an explicit 检测并安装 CLI action. Only when the default openbkn is not detected and prerequisites are usable does it install @openbkn/bkn-sdk@0.1.5 through the user's npm source/global prefix. No automatic install on render, existing-install upgrade, Node/npm installation, PATH editing or privilege escalation.
• Show detection, installation, verification and bounded failures. An installer exit of zero does not count as availability: the resulting executable must pass --version. Closing the panel leaves an accepted installation running on the Host; reopening checks its current state.
• Persist a discovered CLI path only through the existing 保存并继续 action. CLI setup does not read tokens, sign in or reconcile authentication diagnostics. Uninstalling the plugin retains the independently installed CLI.
• Keep the path field editable during automatic read-only detection; lock it only for an explicit setup action or an active Host installation, including polling. Treat bare openbkn.cmd as the Windows default command, while absent custom paths still prevent installation. Exercise command/install timeouts with signal-aware tests.
• Reject directory CLI paths before executable resolution with a clear path-is-directory message. Point missing-CLI recovery to advanced settings and its install progress; request saving only when the resolved CLI path is not already persisted.
• The current build-only candidate (source 6b372ff703d773a4c47ff3cf13972a047fa81ebd, CI 38058120767, SHA-256 dd2d50a2fdda8e55f1ff355b6121113fc6106aeeb6664463bc218cb9b366c887, 69 files) passed the affected macOS npm/Desktop checks and Windows Desktop/npm F90–F97, including actual SDK installation and persisted-path messaging. Windows PS5.1 accepted the canonical verifier with its normal checkout, and the canonical stop helper rejected wrong and empty listener records. The previous full Windows matrix applies to source cf591d7; the current round repeats the affected checks only. The Windows source ledger now covers all 107 archived files: 53 byte-identical and 54 equal after CRLF-to-LF normalization, with source snapshots and synthetic observer files identified separately. Main-branch build-only run 38067339595 reproduced the accepted 69-file payload and exact tarball SHA-256. See CLI setup evidence and release readiness. All retained -8 platform, model, diagnostics and authentication limitations still apply.
• Known Windows uninstall limitation, retained with the user's approval: one official Desktop removal failed when pnpm could not rename pnpm-lock.yaml (EPERM). The plugin was disabled but its dependency/files remained; retrying the same UI action completed removal and retained the user patch and independent SDK. The failure is located in the host's pnpm removal path; the lock owner and root cause are unknown. If removal fails, retry and verify the package is gone. No host repair is included in -9.

bkn-dsh plugin 0.2.0-rc.2-openbkn.0.2.0-8 (DSH dsh-v0.2.0-rc.2)

OpenBKN Business Context plugin for DeepSeek Harness dsh-v0.2.0-rc.2. Installing the plugin is all you need:

dsh plugin --profile <desktop|web> add @openbkn/dsh-business-context@0.2.0-rc.2-openbkn.0.2.0-8

Setup: README · 中文. npm: https://www.npmjs.com/package/@openbkn/dsh-business-context/v/0.2.0-rc.2-openbkn.0.2.0-8. The attached .tgz is the published npm tarball.

Changes

First-use setup for the existing DSH 0.2.0-rc.2 plugin. No runtime or upstream pin change.

• Activate a fresh installation in a pending-configuration state. Until an address is saved, no business capability, CLI authentication or platform connection is started; diagnostics marks downstream checks as not run.

• Add one settings form inside the OpenBKN panel for the platform URL and optional CLI path. Save through DSH's current-profile configuration editor and normal business-entry reload; malformed submissions preserve the existing configuration.

• Keep ordinary sign-in on the OpenBKN CLI path. Remove the incomplete manual-token interface; the historical internal method is unchanged and is not a complete no-CLI mode.

• Ignore stale panel operations after closing, reopening or reloading. Dispose Agent-scoped OpenBKN policy contributions when their business owner reloads, preserve immutable session bindings, and prevent an unverified new platform from receiving an old shared credential.

• Scope passive diagnostics to the configured platform: changing addresses invalidates old observations, while recovery on the same address retains its history.

• Align installation, configuration and uninstall instructions. Ordinary installation uses @latest; uninstall removes the plugin contribution while retaining user configuration and data.

• Acceptance: the fixed build-only candidate (source 23ac2daa6d3538235f33a9627a8178a48f3e1ebf, CI 37725960498, SHA-256 6a946030a6152d2899609fac95c66cd246e36cca5a8ce4e5f87ed379cbe706ea, 66 files) was exercised on macOS official Desktop/npm and Windows official Desktop/npm, plus the Windows source-built web first-use chain. The records distinguish UI, Host API, controlled-runtime and live-platform evidence; unrun subcases remain explicit. See macOS results, Windows results and Windows B1 follow-up.

• Known authentication anomaly (B1): a long-running Windows Desktop Host once rejected business MCP calls after a successful product re-login; restarting that Host restored the same session. One natural-expiry/same-Host re-login follow-up succeeded on the first business call. The earlier failure and its root cause remain unresolved; no stale-token or transport HTTP-status cause is asserted. If the same refusal persists after a completed re-login, restart DSH and retry the existing session.

• Known fault-isolation boundary (B2): the configuration service belongs to the diagnostics component. A broken diagnostics import also prevents first-time configuration. An already-configured business panel can expose its fallback login entry; the complete business chain in that fault state was not accepted. Reinstall an intact plugin package before first-time setup.

• Known cancellation observation (B3): closing the panel cancels its CLI login operation. One Windows source-build run also reported the CLI-opened browser closing; browser process ownership and the cause were not established, and further evidence was deferred by the user. Keep the panel open until CLI authorization completes.

• Other retained limitations: Chrome on the tested Mac did not produce a diagnostic download with “ask where to save” enabled; the unchanged candidate downloaded when that option was temporarily disabled, then the option was restored. The precise browser/OS/operation-channel cause is unknown. Independent npm model evaluation remains 6/8: the no-match answer included unrelated numerical facts, the full BOM/inventory turn was cancelled at the evaluator's 300-second deadline, and an additional procurement distinct-code count differed from its oracle (406 vs 407). No answer arbitration or corrective turns were added. Tool-call timeouts, platform large-result persistence, restricted-account cases, token-refusal root causes and historical evidence gaps remain outside this first-use update.

The main-branch rehearsal, payload reconciliation and retained limitations are documented in release readiness. No DSH alpha-version compatibility or complete G6 acceptance is claimed.

Publication verification

• npm latest and rc both resolve to 0.2.0-rc.2-openbkn.0.2.0-8; the @latest metadata and integrity match the verified public tarball.
• Install through DSH's Add Plugin dialog using @openbkn/dsh-business-context@latest.
• Public tarball SHA-256: fc577a852ab0fcd2124dd94a80a654eae22155a222f9629987e98c88148752bc (175186 bytes, 66 files).
• Verified publication record and retained acceptance boundaries.