@cofy-x/dsh-console 0.1.0-alpha.16 → 0.1.0-alpha.18

package/README.md

@@ -6,14 +6,18 @@
 
 ## Install
 
-DSH Console requires Node.js 24 or newer, supports DeepSeek Harness `0.1.6-alpha.1`, and needs a working DSH provider configuration. Compatibility is verified against the immutable Harness release commit; install DSH normally without pinning the command to a version.
+DSH Console requires Node.js 24 or newer, supports DeepSeek Harness `0.1.7-rc.1` through the maximum tested version `0.1.7-rc.1`, and needs a working DSH provider configuration. Console follows audited DSH releases; the compatible prerelease can differ from npm `latest`, so install the exact audited pair:
+
+Plugin admission on newer releases is still governed by DSH compatibility checks; Console never grants version exemptions or bypasses Host restrictions.
 
 ```sh
-npm install --global @deepseek-ai/dsh @cofy-x/dsh-console
+npm install --global @deepseek-ai/dsh@0.1.7-rc.1 @cofy-x/dsh-console@0.1.0-alpha.18
 dsh-console --prompt "hello"
 ```
 
-Public Alpha releases retain prerelease versions while the current published Console remains available through npm's default install path.
+The launcher resolves the actual `dsh` executable on `PATH` and validates its version before changing the Console profile. Check it with `dsh --version` and `command -v dsh` on macOS/Linux, `(Get-Command dsh).Source` in PowerShell, or `where dsh` in Command Prompt. Older DSH releases are blocked with the exact repair command; newer unaudited releases receive a non-blocking warning.
+
+Public Alpha releases retain prerelease versions while the current published Console remains available through npm's default install path. The published launcher reconciles its package into the DSH profile; `pnpm start` from a source checkout resolves that checkout and is a separate development path.
 
 ## Use
 

package/THIRD_PARTY_NOTICES.md

@@ -1,5 +1,21 @@
 # Third-Party Notices
 
+## DeepSeek Harness preset resources
+
+The generated `dist/presets/*.patch.yml` files are copied unchanged from the public exports of the audited `@deepseek-ai/dsh-web-app` package. Their license follows.
+
+MIT License
+
+Copyright (c) 2026 DeepSeek
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+## Other dependencies
+
 DSH Console retains and adapts portions of the terminal UI and supporting
 utilities from [Gemini CLI](https://github.com/google-gemini/gemini-cli),
 Copyright 2025 Google LLC, licensed under Apache-2.0. Files derived from that
@@ -9,37 +25,37 @@ original work are Copyright cofy-x.
 The npm package keeps third-party runtime packages external. They are resolved
 by the package manager and retain their own license files and notices.
 
-| Dependency | License |
-| --- | --- |
-| `@deepseek-ai/dsh-cmdline` | MIT |
-| `@deepseek-ai/schemastery` | MIT |
-| `@xterm/headless` | MIT |
-| `ansi-escapes` | MIT |
-| `ansi-regex` | MIT |
-| `chalk` | MIT |
-| `chardet` | MIT |
-| `clipboardy` | MIT |
-| `commander` | MIT |
-| `comment-json` | MIT |
-| `diff` | BSD-3-Clause |
-| `dotenv` | BSD-2-Clause |
-| `fdir` | MIT |
-| `fzf` | BSD-3-Clause |
-| `ignore` | MIT |
-| `ink` (`@jrichman/ink`) | MIT |
-| `ink-gradient` | MIT |
-| `ink-spinner` | MIT |
-| `lowlight` | MIT |
-| `mnemonist` | MIT |
-| `picomatch` | MIT |
-| `react` | MIT |
-| `string-width` | MIT |
-| `strip-ansi` | MIT |
-| `strip-json-comments` | MIT |
-| `tinygradient` | MIT |
-| `undici` | MIT |
-| `yargs` | MIT |
-| `zod` | MIT |
+| Dependency                 | License      |
+| -------------------------- | ------------ |
+| `@deepseek-ai/dsh-cmdline` | MIT          |
+| `@deepseek-ai/schemastery` | MIT          |
+| `@xterm/headless`          | MIT          |
+| `ansi-escapes`             | MIT          |
+| `ansi-regex`               | MIT          |
+| `chalk`                    | MIT          |
+| `chardet`                  | MIT          |
+| `clipboardy`               | MIT          |
+| `commander`                | MIT          |
+| `comment-json`             | MIT          |
+| `diff`                     | BSD-3-Clause |
+| `dotenv`                   | BSD-2-Clause |
+| `fdir`                     | MIT          |
+| `fzf`                      | BSD-3-Clause |
+| `ignore`                   | MIT          |
+| `ink` (`@jrichman/ink`)    | MIT          |
+| `ink-gradient`             | MIT          |
+| `ink-spinner`              | MIT          |
+| `lowlight`                 | MIT          |
+| `mnemonist`                | MIT          |
+| `picomatch`                | MIT          |
+| `react`                    | MIT          |
+| `string-width`             | MIT          |
+| `strip-ansi`               | MIT          |
+| `strip-json-comments`      | MIT          |
+| `tinygradient`             | MIT          |
+| `undici`                   | MIT          |
+| `yargs`                    | MIT          |
+| `zod`                      | MIT          |
 
 DeepSeek Harness services are supplied by the active DSH profile through the
 optional peer dependencies declared in `@cofy-x/dsh-console`. Those packages

package/bin/dsh-console.js

@@ -6,11 +6,19 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-import { existsSync, readFileSync, realpathSync } from 'node:fs';
+import {
+  accessSync,
+  constants,
+  existsSync,
+  readFileSync,
+  realpathSync,
+  statSync,
+} from 'node:fs';
 import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
+import { delimiter, dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import crossSpawn from 'cross-spawn';
+import semver from 'semver';
 
 const packageRoot = dirname(dirname(fileURLToPath(import.meta.url)));
 const manifest = JSON.parse(
@@ -20,6 +28,7 @@ const packageName = '@cofy-x/dsh-console';
 const profile = 'dsh-console';
 const RESTART_EXIT_CODE = 199;
 const forwardedArgs = process.argv.slice(2);
+const compatibility = manifest.dsh?.compatibility;
 
 // Package managers preserve the conventional argument separator when running
 // scripts. It separates package-manager options and is not part of the CLI's
@@ -31,6 +40,131 @@ if (forwardedArgs[0] === '--version' || forwardedArgs[0] === '-V') {
   process.exit(0);
 }
 
+function fail(lines) {
+  process.stderr.write(`${lines.join('\n')}\n`);
+  process.exit(1);
+}
+
+const minimumDshVersion = semver.valid(compatibility?.minimum);
+const maximumTestedDshVersion = semver.valid(compatibility?.maximumTested);
+if (
+  !minimumDshVersion ||
+  !maximumTestedDshVersion ||
+  semver.gt(minimumDshVersion, maximumTestedDshVersion)
+) {
+  fail(['dsh-console: invalid DSH compatibility metadata in package.json.']);
+}
+
+const installDshCommand = `npm install --global @deepseek-ai/dsh@${minimumDshVersion}`;
+
+function environmentValue(name) {
+  const entry = Object.entries(process.env).find(
+    ([key]) => key.toLowerCase() === name.toLowerCase(),
+  );
+  return entry?.[1];
+}
+
+function resolveDshExecutable() {
+  const searchPath = environmentValue('PATH');
+  if (!searchPath) return undefined;
+
+  const names = ['dsh'];
+  if (process.platform === 'win32') {
+    const extensions = (environmentValue('PATHEXT') || '.COM;.EXE;.BAT;.CMD')
+      .split(delimiter)
+      .filter(Boolean);
+    names.push(...extensions.map((extension) => `dsh${extension}`));
+  }
+
+  let inaccessible;
+  for (const directory of searchPath.split(delimiter)) {
+    const root = resolve(directory || process.cwd());
+    for (const name of names) {
+      const candidate = join(root, name);
+      try {
+        if (!statSync(candidate).isFile()) continue;
+        if (process.platform !== 'win32') accessSync(candidate, constants.X_OK);
+        return candidate;
+      } catch (error) {
+        if (existsSync(candidate) && error?.code === 'EACCES') {
+          inaccessible ||= candidate;
+        }
+      }
+    }
+  }
+  return inaccessible;
+}
+
+function parseDshVersion(output) {
+  const match = output.match(
+    /(?:^|[^0-9A-Za-z-])v?(\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?)(?=$|[^0-9A-Za-z-])/,
+  );
+  return match ? semver.valid(match[1]) : null;
+}
+
+function remediation(executable = 'not found on PATH') {
+  return [
+    `DSH executable: ${executable}`,
+    `Minimum supported version: ${minimumDshVersion}`,
+    `Install the compatible release: ${installDshCommand}`,
+    'Then verify: dsh --version',
+  ];
+}
+
+const dshExecutable = resolveDshExecutable();
+if (!dshExecutable) {
+  fail([
+    'dsh-console: DeepSeek Harness is required but dsh was not found.',
+    ...remediation(),
+  ]);
+}
+
+const versionResult = crossSpawn.sync(dshExecutable, ['--version'], {
+  encoding: 'utf8',
+  env: process.env,
+  stdio: ['ignore', 'pipe', 'pipe'],
+});
+if (versionResult.error) {
+  fail([
+    'dsh-console: unable to execute DeepSeek Harness.',
+    ...remediation(dshExecutable),
+    `Reason: ${versionResult.error.message}`,
+  ]);
+}
+if (versionResult.signal || versionResult.status !== 0) {
+  fail([
+    'dsh-console: dsh --version did not complete successfully.',
+    ...remediation(dshExecutable),
+    `Exit: ${versionResult.signal || String(versionResult.status)}`,
+  ]);
+}
+
+const versionOutput = `${versionResult.stdout || ''}\n${versionResult.stderr || ''}`;
+const detectedDshVersion = parseDshVersion(versionOutput);
+if (!detectedDshVersion) {
+  const summary = versionOutput.trim().replace(/\s+/g, ' ').slice(0, 160);
+  fail([
+    'dsh-console: dsh --version returned an unrecognized version.',
+    ...remediation(dshExecutable),
+    `Output: ${summary ? JSON.stringify(summary) : '(empty)'}`,
+  ]);
+}
+if (semver.lt(detectedDshVersion, minimumDshVersion)) {
+  fail([
+    'dsh-console: the selected DeepSeek Harness release is too old.',
+    `DSH executable: ${dshExecutable}`,
+    `Detected version: ${detectedDshVersion}`,
+    `Minimum supported version: ${minimumDshVersion}`,
+    `Install the compatible release: ${installDshCommand}`,
+    'Then verify: dsh --version',
+  ]);
+}
+if (semver.gt(detectedDshVersion, maximumTestedDshVersion)) {
+  process.stderr.write(
+    `dsh-console: warning: DSH ${detectedDshVersion} at ${dshExecutable} is newer than the maximum tested version ${maximumTestedDshVersion}; continuing without a formal compatibility guarantee.\n`,
+  );
+}
+
 const dshHome = process.env.DSH_HOME || join(homedir(), '.dsh');
 const profileRoot = join(dshHome, 'profiles', profile);
 const profileManifest = join(profileRoot, 'package.json');
@@ -93,7 +227,7 @@ const packageSpec =
   (localCheckout ? packageRoot : `${packageName}@${manifest.version}`);
 
 if (profileNeedsInstall({ explicitPackageSpec, localCheckout })) {
-  const status = run('dsh', [
+  const status = run(dshExecutable, [
     'plugin',
     '--profile',
     profile,
@@ -105,6 +239,6 @@ if (profileNeedsInstall({ explicitPackageSpec, localCheckout })) {
 
 let status;
 do {
-  status = run('dsh', ['--profile', profile, ...forwardedArgs]);
+  status = run(dshExecutable, ['--profile', profile, ...forwardedArgs]);
 } while (status === RESTART_EXIT_CODE);
 process.exit(status);

package/cordis.patch.yml

@@ -17,8 +17,8 @@
 
     # Console owns a per-Session Agent composition, including its scoped Skills.
     # dsh-base does not mount the preset roster, so the Console bundle must.
-    - id: agent-presets
-      name: '@deepseek-ai/dsh-agent-presets'
+    - id: agent-preset-registry
+      name: '@deepseek-ai/dsh-agent-preset-registry'
       config:
         default: standard
 

package/dist/CHANGELOG.md

@@ -6,6 +6,30 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
+## [0.1.0-alpha.18] - 2026-09-24
+
+### Changed
+
+- Advance the audited DeepSeek Harness baseline to `0.1.7-rc.1` at immutable release commit `a60af51e809d008d89af3ade60ee107547b175bf`.
+- Use the public declarative Agent preset registry and package the exported Harness preset resources unchanged, preserving Host-owned selection and composition policy.
+- Consume Session format 4 tool-role results and header-only projection-cache reads through public DSH APIs; persistence and historical migration remain Harness-owned.
+- Follow the Session-ID-based Job registry and its public lifecycle event stream without consuming model-owned output.
+
+### Fixed
+
+- Recheck live Harness preset policy before selection and deferred Session creation, cancel closed picker requests, reject cross-Session selection races, and verify exported preset resources in the installed package rather than only the build directory.
+
+## [0.1.0-alpha.17] - 2026-09-18
+
+### Added
+
+- Validate the exact `dsh` executable selected from `PATH` against package compatibility metadata before profile changes, with actionable missing, old, invalid, and failed-version diagnostics plus a non-blocking warning for newer unaudited releases.
+
+### Changed
+
+- Pin installation documentation to the audited DSH and Console prerelease pair and mechanically check those examples against the public package manifest.
+- Advance the audited DeepSeek Harness baseline to `0.1.6-alpha.2` at immutable release commit `6b1808f432adfa96ab6c2f033e158ca230422e16`, retaining Host ownership of model modality, Plan review identity, and Subagent capacity policy.
+
 ## [0.1.0-alpha.16] - 2026-09-15
 
 ### Changed
@@ -199,7 +223,9 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 - Keep debug diagnostics aligned within the existing footer row and preserve structured logs in the debug console.
 - Address initial CodeQL findings, dependency advisories, CI concurrency issues, and release build ordering.
 
-[Unreleased]: https://github.com/cofy-x/dsh-console/compare/v0.1.0-alpha.16...HEAD
+[Unreleased]: https://github.com/cofy-x/dsh-console/compare/v0.1.0-alpha.18...HEAD
+[0.1.0-alpha.18]: https://github.com/cofy-x/dsh-console/compare/v0.1.0-alpha.17...v0.1.0-alpha.18
+[0.1.0-alpha.17]: https://github.com/cofy-x/dsh-console/compare/v0.1.0-alpha.16...v0.1.0-alpha.17
 [0.1.0-alpha.16]: https://github.com/cofy-x/dsh-console/compare/v0.1.0-alpha.15...v0.1.0-alpha.16
 [0.1.0-alpha.15]: https://github.com/cofy-x/dsh-console/compare/v0.1.0-alpha.14...v0.1.0-alpha.15
 [0.1.0-alpha.14]: https://github.com/cofy-x/dsh-console/compare/v0.1.0-alpha.13...v0.1.0-alpha.14