v0.1.3 — use v0.1.2 instead (dmg reported damaged)

v0.1.3 — do not use this dmg

The first .dmg on this tag was an unsigned disk-image wrapper. macOS reports that as damaged.

Use v0.1.2 instead — that is the Developer ID / notarized Apple Silicon build that opens.

Working files
0.1.2 dmg	447a52e1ffc96a7e53f63aa1deed5ce253c9dee16bf10827b282ee921d389de8
0.1.2 zip	e881b1784a78ff2f2a660636335e7fbf3a124ca6d4cf984758265942424dc788

v0.1.2 preview — macOS, Developer ID notarized

v0.1.2 — first macOS preview (Developer ID, notarized)

Preview only — not a stable or security-supported release. The upstream kernel is still 0.1.0-rc.6.

Signed with Developer ID Application: wenxing hu (446BLT75JZ) and notarized by Apple. Gatekeeper should accept a downloaded .app without right-click Open or xattr.

Built from bfd3278 (PR #14).

Downloads

File	Size	SHA-256
DeepSeek-Harness-Desktop-0.1.2-arm64.dmg	181 MB	447a52e1ffc96a7e53f63aa1deed5ce253c9dee16bf10827b282ee921d389de8
DeepSeek-Harness-Desktop-0.1.2-arm64.zip	189 MB	e881b1784a78ff2f2a660636335e7fbf3a124ca6d4cf984758265942424dc788

Apple Silicon only. Intel (darwin-x64) is pinned in upstream.lock.json but is not in this drop.

These assets replace the earlier ad-hoc unsigned build that was attached to this tag.

What changed

• Bundled, SHA-256-checked Node for darwin-arm64 and darwin-x64
• Unix kernel is spawned as its own process-group leader
• Dock/Finder launches prepend Homebrew's usual PATH
• .dmg + .zip packaging; this drop is Developer ID signed and notarized

Evidence

• source unit tests 70/70 after the CI pin; kernel e2e 5/5 on Ubuntu, Windows, and macOS in PR #15
• packaged .app: codesign --verify --deep --strict passes; spctl reports accepted / Notarized Developer ID; notarization ticket stapled to the .app

Not in this drop

• No Windows installer (Release workflow could not start until #15; Windows assets remain on older prereleases, or build with npm run dist:win)
• DMG itself is not separately stapled; the .app inside is
• Not a universal binary
• Linux is still unbuilt

v0.1.1 preview — DO NOT DEPLOY

Preview only — do not deploy or treat as stable/security-supported.

This prerelease was published from 5c26accbd3401c506fe4aa6d5c52abdb50fbd301 before its review finished and with zero CI checks. The merged change has unresolved blockers:

• P1: pruning follows the builder host architecture rather than the configured x64 package target; an ARM64 Windows builder can delete the x64 native binaries the shipped app needs.
• P1: the credential-history scan was narrowed to reachable HEAD, so secrets on another publicly fetchable branch can be missed.
• P2: package.json says 0.1.1 while the committed lockfile root metadata remains 0.1.0.
• P2: pruning bytes are counted before deletion succeeds, so reported size reduction can exceed the actual artifact change.
• The earlier runtime lifecycle/security blockers remain under correction in Draft PR #11; no Electron lifecycle E2E has passed for this release.

Assets are retained only for provenance and diagnosis. A corrected build must use a new reviewed commit and new version; these binaries must not be relabeled as fixed.

Historical publisher notes (not a GO statement)

The assets were intended to reduce installed size by removing development-only kernel material. Their recorded hashes are preserved below:

File	Size	SHA-256
DeepSeek-Harness-Desktop-0.1.1-x64.exe	137 MB	c1b266c16a7121086244bf21d3126a91b7fe8b527885a4723b6432ca70df9d57
DeepSeek-Harness-Desktop-0.1.1-x64.zip	188 MB	f28fb3ccd3f66c06e14ca2704fc4c77d5438f616cc67086d261ac7e027df7279

Unsigned; Windows SmartScreen may warn.

v0.1.0 - first preview

v0.1.0 — first preview (known-issues build)

Preview only — not a stable or security-supported release. This build predates completion of the repository governance and release gates. Do not treat its source tests or one launch observation as proof that all shutdown, renderer-permission, crash, cross-platform, or artifact controls are closed.

Packaged preview of the public DeepSeek Harness (dsh) runtime. The kernel (@deepseek-ai/dsh 0.1.0-rc.6) and its Node runtime are included.

Downloads

File	Size	SHA-256
DeepSeek-Harness-Desktop-0.1.0-x64.exe	172 MB	8be954622799ca1efe0d45fd1ea0b54af24dfeb4d51f2cf7b85b18e0c53cb4f9
DeepSeek-Harness-Desktop-0.1.0-x64.zip	236 MB	2f0e929f1c5ae30047e7b78f479db169adac3b295e6acbad4c59bab886a025bc

Unsigned; Windows SmartScreen may warn.

Evidence actually obtained

• source unit tests reported 48/48 and kernel E2E reported 5/5 at the tagged source
• an installer was built, installed, launched, and observed serving the upstream UI
• the Node archive and top-level kernel package were checked against their declared hashes

These observations do not close the known issues below.

Known release blockers

• application quit does not await complete process-tree shutdown
• renderer permission requests are not default-denied
• a kernel exit between readiness and window assignment can leave a dead-origin window
• redirect navigation is not covered by the exact-origin policy
• POSIX process-group cleanup is not correctly established
• macOS/Linux runtime fallback is incompatible with the documented runtime requirement
• log redaction can miss secrets split across stream chunks and log retention is not byte-bounded
• part of the Node 23 range is incorrectly accepted
• PowerShell extraction paths are not apostrophe-safe
• public-boundary governance and artifact-level SBOM/identity gates were not complete when this preview was published

Tracked in Phase 1 issue #3. Built from PR #7, tag target f6c642a930e086d88e009e3f6f82ff1cfa238583.