Skip to content

v0.3.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 02 Sep 15:06
v0.3.0
f7127a8

DSH Forge v0.3.0

中文

DSH Forge v0.3.0 将官方发行组合升级到 DSH 0.1.2-alpha.4 与 Cordis 4.0.2：窗口必须加载 Host 签发的带 token loopback URL，官方 agent preset 改从独立包注入，旧会话投影缓存和死进程 credentials 锁不再阻断启动。

本版本包含

  • 固定 runtime 组合升级为 DSH 0.1.2-alpha.4、Cordis 4.0.2；dsh-forge-official 与 developer 两个 profile、工具链 RUNTIME_MATRIX 和根锁文件同步到同一精确版本。
  • 官方外部 bundle 升级为 dsh-better-sidebar@0.18.0-alpha.0 与 dsh-dream-skin@8.30.1，catalog 同步版本、integrity、依赖摘要和 2026-09-02 的 darwin-arm64 审核事实。sidebar 不使用 npm latest 0.17.1，因为该版本无法加载当前 Host。
  • 官方 agent preset 从 @deepseek-ai/dsh-agent-presets 的 presets/ 注入；启动器不再读取 @deepseek-ai/dsh/config/agent-presets。缺少该包或 standard 组合文件时，Host 启动前失败。
  • 窗口只加载 Host connection.authenticatedUrl() 返回的当前 loopback 根 URL，且必须带且仅带一个非空 token。无 token 的 http://127.0.0.1:<port>/ 会被上游鉴权成 401，启动器拒绝离开当前 origin、缺少 token 或无效 URL。
  • Host boot 前把 DSH_HOME 对齐到本次 generation 的 Home。检测到仍被存活进程持有的 .credentials.yaml.lock 时立即以 DSH_HOME_BUSY 失败，不删除活锁；死进程锁和对应临时文件会在 boot 前清理。
  • 0.1.2 的 session_projcache 新增 identity 字段后，旧缓存会使 Host 无法加载。启动器在该 schema 失败时把 storages/session_projcache 移出运行路径并重试一次；会话正文仍在 sessions/，缓存可从日志重建。
  • 文档站与根 README 重写项目定位、安装路径和核心分层说明，并增加中英文总览图。仓库新增 dsh-forge-add-plugin skill，以及 GitHub star-history 工作流（浅色/深色 SVG）。

升级与安全边界

  • 本版本绑定的是 DSH 预发布 0.1.2-alpha.4，不是把 npm latest（仍指向 0.1.1-rc.2）写成当前发行事实。
  • 当前发行包仍不提供页面端插件市场、在线下载或运行时安装。dsh-better-sidebar 的“添加插件”只复制安装命令并打开仓库链接，不改变该边界。
  • catalog 的 verifiedOn 只记录本次实际验证的 darwin-arm64。未覆盖 darwin-x64、Windows 和 Linux，不得视为已通过。
  • Electron 43.4.0、pnpm 11.7.0 和 Node 引擎要求未变。插件执行模式仍是 trusted-in-process。
  • 窗口仍只允许当前 generation 的 loopback authority；token 只用于加载鉴权根 URL，页面不会因此获得安装包路径、helper 命令或升级重启 token。

感谢所有参与 DSH 0.1.2-alpha.4 适配与文档整理的贡献者。

English

DSH Forge v0.3.0 upgrades the official distribution to DSH 0.1.2-alpha.4 and Cordis 4.0.2. The window must load a Host-issued loopback URL with a token, official agent presets come from a dedicated package, and stale session projection caches or dead credential locks no longer block startup.

What's included

  • The pinned runtime set is now DSH 0.1.2-alpha.4 and Cordis 4.0.2. Both dsh-forge-official and developer profiles, the toolchain RUNTIME_MATRIX, and the root lockfile move to the same exact versions.
  • Official external bundles are now dsh-better-sidebar@0.18.0-alpha.0 and dsh-dream-skin@8.30.1. Catalog records version, integrity, dependency summaries, and the 2026-09-02 darwin-arm64 audit facts. Sidebar does not use npm latest 0.17.1, which cannot load the current Host.
  • Official agent presets are injected from @deepseek-ai/dsh-agent-presets presets/. The launcher no longer reads @deepseek-ai/dsh/config/agent-presets. Missing that package or the standard composition fails before Host start.
  • The window loads only the current loopback root URL from Host connection.authenticatedUrl(), which must include exactly one non-empty token. Unauthenticated http://127.0.0.1:<port>/ is rejected by upstream as 401. The launcher rejects URLs that leave the current origin, omit the token, or are invalid.
  • Host boot aligns DSH_HOME with this generation’s Home. A .credentials.yaml.lock still held by a live process fails immediately with DSH_HOME_BUSY and is not deleted. Dead-process locks and matching temp files are cleaned before boot.
  • 0.1.2 adds identity fields to session_projcache; an old cache prevents Host load. On that schema failure the launcher moves storages/session_projcache off the runtime path and retries once. Session bodies remain in sessions/; the cache can be rebuilt from logs.
  • Root README and the docs site rewrite project positioning, install paths, and layering, with new Chinese and English overview images. The repo adds the dsh-forge-add-plugin skill and a GitHub star-history workflow (light/dark SVG).

Upgrade and security boundaries

  • This release pins DSH prerelease 0.1.2-alpha.4. npm latest still points at 0.1.1-rc.2 and is not the current distribution fact.
  • Packaged apps still have no in-page plugin marketplace, online download, or runtime install. dsh-better-sidebar “add plugin” only copies an install command and opens the repository link; it does not change that boundary.
  • Catalog verifiedOn records only the platform actually verified this time: darwin-arm64. darwin-x64, Windows, and Linux were not covered and must not be treated as passed.
  • Electron 43.4.0, pnpm 11.7.0, and the Node engine requirement are unchanged. Plugin execution remains trusted-in-process.
  • The window still allows only the current generation’s loopback authority. The token is used only to load the authenticated root URL; the page still does not receive package paths, helper commands, or upgrade restart tokens.

Thank you to everyone who contributed to the DSH 0.1.2-alpha.4 adaptation and documentation updates.

Assets 9
Loading