dsh-plugin-debug v0.8.4

Full Changelog: v0.8.3...v0.8.4

dsh-plugin-debug v0.8.3

dsh-plugin-debug v0.8.3

This is a GitHub source release for the single dsh-plugin-debug package.

• Tag: v0.8.3
• Evidence commit: 8033796e50d20b246bb8dd92e21cde3753a88fd0
• Source commit verified from an exact remote fresh clone: 591ca0da959465a1207030cd7eb91372d8e90b2a
• npm pack reported 102 files; the real prepack tarball was extracted and passed package-only Standalone plus offline consumer export smoke.
• Deterministic SPDX 2.3 and CycloneDX 1.5 SBOMs are committed under packages/dsh-plugin-debug/sbom/ and attached to this release. Each contains 584 components/packages.
• Runtime lockfile checks cover lock metadata and the installed tree (587 locked entries); the pinned runtime and plugin audit gates reported 0 high-or-higher vulnerabilities.
• CI run 31997733993 passed Node 22/24, Windows PowerShell, fresh-clone publication, pack/extract smoke and required checks. CodeQL run 31997733927 passed for this evidence commit.
• The real DSH Host/Web compatibility lane is manual and opt-in. It is fail-closed and does not claim a pass when no real instance is available.

This release is not published to the npm registry. npm provenance, signing, npm installation compatibility and future registry distribution gates are intentionally separate work.

The offline and isolated rc.6 evidence proves source contracts, Web/Host loading and tool registration/dispatch layers only. It does not prove a data-bearing Session, real model request, third-party plugin installation or cross-platform production compatibility.

v0.8.2：运行时守护与维护门禁加固

dsh-plugin-debug v0.8.2（历史说明）

这是保留在 v0.8.2 tag 上的历史 GitHub source release。旧 tag 没有移动或重写，仍指向 source commit b234e79dfe7b349568f7f3e3c63504979f0e74e0。

历史验证边界

• Node、Windows debug suite、fresh-clone publication gate 和 CodeQL 在当时的 workflow 中通过。
• Standalone 是离线/合成 fixture 套件；历史报告为 59 个文件、55 个 PowerShell 文件、51 个 fixture checks。
• 这些结果不证明真实 DSH Host/Web、浏览器、模型请求、数据 Session、第三方插件安装或跨平台兼容。

版本证据说明

v0.8.2 tag/source archive 保留了当时的 RELEASE-MANIFEST.json 和 SOURCE-SNAPSHOT.md candidate/null 发布字段；后来的 main 证据记录不能回写到旧 tag。因此不要把旧 tag archive 当成当前发布证据，也不要用它替代 v0.8.3。

当前维护版本是 v0.8.3，它使用新的 source/evidence commit，并附带 SPDX/CycloneDX SBOM、runtime lock 漂移门禁和更完整的 fresh-clone/tarball 检查。

安装边界

这是 GitHub source release；dsh-plugin-debug 当时和现在都没有发布到 npm registry。请从 GitHub 下载源码或 clone 后按对应版本的中文 README 操作。真实 DSH Web/Host/浏览器服务仍需在使用者本机显式验证。