v2.1.5

v2.1.5

DVR 2.1.5 is a compatibility, reliability, and release-hardening patch. It moves the fixed stable evidence to DSH 0.1.5-rc.1, keeps exact preview evidence on 0.1.5-alpha.2, fixes live Vision-twin reconciliation and wrapped-model switching, and modularizes the oversized Core runtime without changing the public 2.1.x routing model or minimum Host floor.

DSH 0.1.5 stable / preview compatibility

• Supports the current npm stable Host 0.1.5-rc.1 while keeping DSH 0.1.0-rc.8 as the public minimum for DVR 2.1.x. Exact 0.1.5-alpha.2 coverage remains preview verification evidence only, not a blanket preview-support promise.
• Admits the exact verified 0.1.5-alpha.1, 0.1.5-alpha.2, and 0.1.5-rc.1 Host peers without using a broad semver range that would silently promise compatibility with future untested DSH releases.
• Moves the required current Host contract, Node 22/24 release-family contracts, exact source checks, and real Host + Chromium browser gates onto 0.1.5-rc.1; the exact preview gates move to 0.1.5-alpha.2.
• Pins exact source evidence to immutable upstream commits and verifies the checkout SHA before running attachment normalization, LLM adapter, session/remotes, and Web compatibility contracts on Ubuntu, macOS, and Windows.
• Keeps the existing Web @deepseek-ai/dsh-client-modules row explicitly waiting for the official webServer carrier. Current 0.1.5-rc.1 and 0.1.5-alpha.2 still require this compatibility overlay.
• Adds a three-state overlay lifecycle contract plus moving upstream watch: shim-required keeps the overlay, retire-ready fails and requires deliberate retirement once DSH owns the dependency, and dangerous-drift fails closed if the upstream row changes incompatibly.

Vision-mode and live-provider reliability

• Preserves Vision mode when the user switches to another model that has a matching hidden Vision Router wrapper in the same visible source provider. Cross-provider switches or targets without a wrapper still leave Vision mode, and DSH's image-session model guards remain authoritative.
• Treats wrappedProviders as configuration intent rather than a snapshot of startup topology. Generated <provider>-vision twins are reconciled against the live provider registry: dormant sources do not materialize twins, newly mounted providers gain them, removed providers withdraw them, and provider/model presentation metadata refreshes atomically.
• Reuses the bounded adapter-update coalescer for synchronous registry events so live provider churn converges without duplicate registrations, re-entrant loops, or stale model filters.
• Keeps the lower twin-image capability compatibility boundary tolerant of out-of-order registration for older Host shapes while preserving fail-closed ownership checks for Vision Router-owned routes.

Runtime architecture

• Splits the oversized root runtime into lib/core-primitives.js and lib/sharp-runtime.js while keeping Config, apply, Host composition, and public exports owned by the existing entry point.
• The modularization is behavior-preserving: no settings migration, route rename, tool-schema change, or public API change is introduced. A permanent architecture contract prevents the extracted primitives from drifting back into a monolithic entry file or creating a second runtime owner.

Security and release hardening

• Updates the development sharp runtime past the libheif advisory while keeping the shared-Host peer contract at sharp >=0.35.3 <1, so the security fix does not raise the public Host floor.
• Reworks the trusted PR impact shadow so pull_request_target never checks out PR code. The classifier is fetched from the trusted base commit, size-bounded, and verified against its Git blob identity before execution; permissions remain read-only.
• Adds deterministic adversarial security fuzzing, dependency review, OpenSSF Scorecard coverage, Private Vulnerability Reporting guidance, and stronger immutable release verification.
• Expands audited browser-impact triggers so client preludes, model-visibility boundaries, Web modules, Settings client surfaces, and exact compatibility modules cannot change without the corresponding browser/source gates running.

Validation

• Release-candidate coverage includes Node 22/24, DSH rc.6/rc.7/rc.8 compatibility contracts, current stable 0.1.5-rc.1, exact preview 0.1.5-alpha.2, Ubuntu/macOS/Windows exact-source contracts, Windows screenshot runtime, host-sharp on all three desktop OSes, routing parity, native multimodal cold resume, large-image resource stress, deterministic hostile-input fuzz, dependency review, CodeQL, and real Chromium lifecycle gates for both exact stable and preview Hosts.
• The moving release-channel canary also resolves npm latest and alpha independently so a newly published DSH train is detected before the fixed release evidence is deliberately advanced.
• No Settings migration is required. Restart DSH Web/Desktop after upgrading so the updated Host and browser compatibility logic is loaded.

Upgrade

Upgrade to 2.1.5 and restart DSH Web/Desktop. Existing Vision Router settings remain compatible.

Commits

• Merge pull request #454 from ysr666/compat/dsh-0.1.5-rc.1-release
• compat: advance DSH 0.1.5 release evidence
• ci: guard Web modules overlay lifecycle (#452)
• fix: reconcile wrapped vision twins with live providers (#451)
• refactor: modularize core runtime primitives (#450)
• Merge pull request #445 from ysr666/release/v2.1.5
• chore: prepare v2.1.5 release
• Merge pull request #444 from ysr666/compat/dsh-0.1.5-alpha.1
• fix: harden DSH 0.1.5 web activation evidence
• compat: verify DSH 0.1.5 alpha preview
• Merge pull request #443 from ysr666/ci/complete-browser-boundary-gates
• ci: complete audited browser boundary gates
• Merge pull request #442 from ysr666/ci/shadow-browser-vocabulary
• ci: classify client preludes as browser impact
• Merge pull request #441 from ysr666/security/scorecard-trusted-shadow
• test: assert private reporting link as exact line
• test: make security policy URL assertion exact
• security: remove checkout from impact shadow
• Merge pull request #440 from ysr666/ci/classify-visibility-browser
• ci: cover model visibility browser boundary
• Merge pull request #439 from ysr666/fix/issue-431-preserve-vision-model-switch
• fix: preserve Vision when switching wrapped models
• Merge pull request #438 from ysr666/ci/cache-action-node24
• ci: run DSH build cache actions on Node 24
• Merge pull request #437 from ysr666/ci/trusted-dsh-build-cache
• ci: cache trusted DSH web builds
• Merge pull request #436 from ysr666/ci/copilot-review-best-effort
• ci: make Copilot review merge-time only
• ci: add trusted-base PR impact shadow classifier (#435)
• ci: make Copilot review best-effort when unavailable (#434)
• fix: update sharp past libheif advisory without raising Host floor (#433)
• chore(deps): bump pnpm/action-setup from 6.0.10 to 6.1.0 (#427)
• ci: cancel stale PR work and stage trusted impact routing (#430)
• ci: require Copilot review before merge (#429)
• ci: harden release security boundaries (#428)
• ci: bound adversarial fuzz and security updates (#425)
• ci: add adversarial security automation (#424)

Supply-chain verification

• Git commit: b03228695f19d8e929198894014da029bf771d9e
• npm tarball SHA-1: 7fd465e5edc8c4bdb3662a2204091cf10768d148
• tarball SHA-256: 71cfec2c9eb954495fa1df33bacef41bcd0f263686d8383f6715ed24e809918d
• packed files: 198
• npm provenance: enabled via trusted publishing (OIDC)