@foggy-projects/deepseek-harness-plugin 0.4.0-beta.6 → 0.4.0-beta.8

package/skills/foggy-deepseek-onboarding/SKILL.md

@@ -20,9 +20,13 @@ copy this Skill into the current workspace.
   workspace as `--project-root`. The absence of `foggy-runtime` from `PATH` is not evidence that the
   managed CLI is missing; the plugin intentionally installs it in an isolated environment and records
   its absolute command in the global install state.
+- The plugin downloads and verifies a pinned private Python runtime before running this Skill. Do not
+  search for, install, or repair a system Python. Wrappers resolve the interpreter recorded in the
+  global install state. If private Python is missing, use the plugin's Python repair action. Only use
+  `FOGGY_PYTHON` or `FOGGY_ONBOARDING_PYTHON` when the user explicitly supplied an advanced override.
 - Do not independently download or reinstall the CLI. If the global install state, managed marker, or
   analysis Skill is missing or invalid, ask the user to open the Foggy plugin settings and use
-  **Re-download / Repair**. Repair restores the global managed analysis Skill and invalidates the
+  the matching component repair action. Repair restores managed components and invalidates the
   native DSH Skill catalog. Reinstall or upgrade the plugin itself to restore this bundled Skill.
 - Treat the current DSH session workspace as the authoritative `projectRoot` for the whole onboarding
   run. Do not redirect semantic drafts or contracts to a different repository merely because another
@@ -71,11 +75,15 @@ For every new-database onboarding session, this Skill is the orchestration autho
 
 1. Run `scripts/doctor.ps1 --project-root <current-session-workspace>` on Windows or
    `bash scripts/doctor.sh --project-root <current-session-workspace>` on Linux.
-2. If the pinned CLI, Launcher, or global managed analysis Skill is missing, use the Foggy
-   plugin's Repair action. Use the matching install script only when the plugin UI is unavailable;
-   use `--dry-run` first when paths or permissions are uncertain.
+2. If private Python, the pinned CLI, Launcher, or global managed analysis Skill is missing, use the
+   Foggy plugin's matching Repair action. First-time Python bootstrap requires the plugin UI unless
+   the user explicitly supplies `FOGGY_ONBOARDING_PYTHON`. Use a matching install script only after
+   private Python exists and the plugin UI is unavailable; use `--dry-run` first when paths or
+   permissions are uncertain.
 3. Run `runtime-start` and require successful `wait-ready` plus `capabilities`. Record engine,
-   Runtime API version, schema version, security mode, URL, namespace, PID, and evidence path.
+   Runtime API version, schema version, security mode, URL, namespace, PID, and evidence path. If the
+   recorded Runtime is already running, `runtime-start` verifies and reuses it instead of starting a
+   second process.
 4. Load `foggy-ai-analysis` from the native DSH Skill registry. Do not require a workspace copy.
 5. For a new business database, read [references/onboarding-workflow.md](references/onboarding-workflow.md)
    and prefer its two composite `onboard-datasource-run` / `onboard-semantic-run` commands. Require the
@@ -84,6 +92,9 @@ For every new-database onboarding session, this Skill is the orchestration autho
    (`<dataRoot>/cli-profiles`), never `/tmp`. Accept only the opaque profile
    ID, exact revision, datasource name/type, and namespace; never request JDBC URL, username,
    password, or password environment-variable name in Harness.
+   If plugin settings report a legacy temporary profile, use the explicit migration action before
+   onboarding. It moves only validated connection metadata and environment-variable references; it
+   never copies a password value and leaves a recoverable private backup below the Foggy data root.
 6. After schema discovery, use `foggy-ai-analysis` only to author TM/QM files in the standard project-local
    draft directory. Register, validate, publish, and verify them through this Skill's wrapper using the deterministic commands in
    [references/onboarding-workflow.md](references/onboarding-workflow.md). Do not publish, prune, replace
@@ -114,5 +125,13 @@ publication, and verification phases when the approved contract and draft digest
 query payload in place and rerun the same semantic composite command; do not remove a successfully
 published bundle merely to recover from a later query-validation failure.
 
+An already-completed profile may be reused from another DSH workspace when the approved connection
+contract is byte-for-byte equivalent. Run the datasource composite in the new workspace first; it adds
+that workspace as a non-destructive binding and reuses datasource/schema checkpoints. Then pass the
+current workspace explicitly as `--project-root` to the semantic composite. A secondary workspace may
+reuse an identical published semantic digest and run its own bounded verification query, but it cannot
+replace the published semantic layer; changes must be published from the original workspace or a new
+profile.
+
 Keep user business data separate from the sales-drop SQLite demo. Prefer a read-only database account,
 opaque CLI profile references, and bounded query limits.

package/skills/foggy-deepseek-onboarding/assets/onboarding-state.schema.json

@@ -13,6 +13,26 @@
     "installRoot": {"type": "string"},
     "dataRoot": {"type": "string"},
     "projectRoot": {"type": "string"},
+    "workspaceBindings": {
+      "type": "array",
+      "items": {"type": "string"},
+      "uniqueItems": true
+    },
+    "workspaceVerifications": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["projectRoot", "queryModel", "queryPayloadDigest", "verifiedAt"],
+        "properties": {
+          "projectRoot": {"type": "string"},
+          "queryModel": {"type": "string"},
+          "queryPayloadDigest": {"type": "string", "pattern": "^[a-f0-9]{64}$"},
+          "rowCount": {"type": ["integer", "null"], "minimum": 0},
+          "verifiedAt": {"type": "string", "format": "date-time"}
+        },
+        "additionalProperties": false
+      }
+    },
     "runtime": {"type": "object"},
     "connection": {"$ref": "connection.schema.json"},
     "semantic": {"type": "object"},

package/skills/foggy-deepseek-onboarding/assets/versions.json

@@ -1,12 +1,56 @@
 {
   "schemaVersion": "foggy-deepseek-onboarding-versions/v1",
-  "packageVersion": "0.4.0-beta.6",
-  "validatedAt": "2026-09-01",
+  "packageVersion": "0.4.0-beta.8",
+  "validatedAt": "2026-09-03",
   "components": {
     "deepseekHarness": {
       "version": "0.1.1-rc.2",
       "minimumNodeVersion": "22.19.0"
     },
+    "python": {
+      "version": "3.12.13",
+      "distribution": "astral-sh/python-build-standalone",
+      "buildRelease": "20260718",
+      "license": "Python-2.0 AND MPL-2.0",
+      "assets": {
+        "win32-x64": {
+          "file": "cpython-3.12.13+20260718-x86_64-pc-windows-msvc-install_only_stripped.tar.gz",
+          "url": "https://github.com/astral-sh/python-build-standalone/releases/download/20260718/cpython-3.12.13%2B20260718-x86_64-pc-windows-msvc-install_only_stripped.tar.gz",
+          "sha256": "0d422a1439ec308e03f47df551bc30f5994727c456e414b026d202bcda9b7c1c",
+          "size": 21932298
+        },
+        "win32-arm64": {
+          "file": "cpython-3.12.13+20260718-aarch64-pc-windows-msvc-install_only_stripped.tar.gz",
+          "url": "https://github.com/astral-sh/python-build-standalone/releases/download/20260718/cpython-3.12.13%2B20260718-aarch64-pc-windows-msvc-install_only_stripped.tar.gz",
+          "sha256": "596808d2592a282c45921a324d5503ef0d4f488d104c1c1f12a1d5e7dea9d463",
+          "size": 20652311
+        },
+        "linux-x64": {
+          "file": "cpython-3.12.13+20260718-x86_64-unknown-linux-gnu-install_only_stripped.tar.gz",
+          "url": "https://github.com/astral-sh/python-build-standalone/releases/download/20260718/cpython-3.12.13%2B20260718-x86_64-unknown-linux-gnu-install_only_stripped.tar.gz",
+          "sha256": "5854aa6ec71cad00334d5065633c210b2e7feb40956767a59a91791cadcf0b79",
+          "size": 34199823
+        },
+        "linux-arm64": {
+          "file": "cpython-3.12.13+20260718-aarch64-unknown-linux-gnu-install_only_stripped.tar.gz",
+          "url": "https://github.com/astral-sh/python-build-standalone/releases/download/20260718/cpython-3.12.13%2B20260718-aarch64-unknown-linux-gnu-install_only_stripped.tar.gz",
+          "sha256": "f226576b91491ffa5739aa85726521e9031f4d87f80627d64ed348ac77cb31e9",
+          "size": 29195696
+        },
+        "darwin-x64": {
+          "file": "cpython-3.12.13+20260718-x86_64-apple-darwin-install_only_stripped.tar.gz",
+          "url": "https://github.com/astral-sh/python-build-standalone/releases/download/20260718/cpython-3.12.13%2B20260718-x86_64-apple-darwin-install_only_stripped.tar.gz",
+          "sha256": "8e6b7e6533bdf746287008edf91102e7bee0a6ca1d24f16c4514237cafd706c5",
+          "size": 24685843
+        },
+        "darwin-arm64": {
+          "file": "cpython-3.12.13+20260718-aarch64-apple-darwin-install_only_stripped.tar.gz",
+          "url": "https://github.com/astral-sh/python-build-standalone/releases/download/20260718/cpython-3.12.13%2B20260718-aarch64-apple-darwin-install_only_stripped.tar.gz",
+          "sha256": "9a1e9e06175c10efd8378b904b07fa21bd791ab3345d7cdffeb4a76c9ff55903",
+          "size": 25000146
+        }
+      }
+    },
     "cli": {
       "version": "0.1.23",
       "minimumPythonVersion": "3.11.0",

package/skills/foggy-deepseek-onboarding/references/onboarding-workflow.md

@@ -33,6 +33,12 @@ The wrapper defaults `FOGGY_RUNTIME_PROFILE_STORE` to the private persistent dir
 `<dataRoot>/cli-profiles`. An explicit operator-provided value still wins. Do not use `/tmp` for a profile
 that must survive a WSL or Harness restart.
 
+If plugin settings detect profiles in the legacy temporary store, use **Move to persistent store**.
+Migration validates the opaque profile schema, rejects embedded passwords and conflicts, writes the
+destination with private permissions, verifies it, and moves the legacy JSON to a recoverable private
+backup below the Foggy data root.
+Do not manually copy or edit opaque profile JSON.
+
 Treat every user-supplied identifier and bound as immutable input: profile, datasource, namespace,
 models directory, bundle name, TM/QM name, query fields, and limit. Do not swap in demo names, add
 fields, raise the limit, or introduce replacement flags. If one of these inputs is missing, pause for
@@ -52,11 +58,13 @@ For Harness-driven onboarding, use the two composite commands below. Each writes
 evidence internally and refuses to cross an unapproved mutation gate:
 
 ```text
-onboard-datasource-run --connection-file <approved-json> \
+onboard-datasource-run --project-root <current-session-workspace> \
+  --connection-file <approved-json> \
   --approve-configure --approve-bind --include-indexes
 
 # After authoring the registered TM/QM draft from schema metadata:
-onboard-semantic-run --semantic-plan <approved-json> --query-payload <approved-json> \
+onboard-semantic-run --project-root <current-session-workspace> \
+  --semantic-plan <approved-json> --query-payload <approved-json> \
   --approve-validate --approve-publish --approve-execute
 ```
 
@@ -70,6 +78,12 @@ payload and rerun `onboard-semantic-run`; it resumes at query verification and l
 place. A same-name datasource is accepted idempotently only when its public name and database type match
 the approved plan; otherwise replacement still requires explicit approval.
 
+When a completed profile already belongs to another workspace, the datasource composite may add the
+current workspace as a binding only if the approved connection contract is identical and the datasource,
+schema, and semantic publication checkpoints are complete. The semantic composite then accepts the same
+published draft digest from the bound workspace and performs a workspace-specific bounded verification
+query. It refuses semantic replacement from the secondary workspace.
+
 The granular commands below remain available for manual troubleshooting and resumption. Do not expand
 the composite commands into this list during a normal Harness turn.
 
@@ -85,8 +99,8 @@ semantic-validate --profile <profile>
 semantic-validate --profile <profile> --apply
 semantic-publish --profile <profile>
 semantic-publish --profile <profile> --apply
-semantic-verify --profile <profile> --query-payload <json>
-semantic-verify --profile <profile> --query-payload <json> --execute
+semantic-verify --profile <profile> --project-root <current-session-workspace> --query-payload <json>
+semantic-verify --profile <profile> --project-root <current-session-workspace> --query-payload <json> --execute
 onboard-status --profile <profile>
 ```
 

package/skills/foggy-deepseek-onboarding/scripts/doctor.ps1

@@ -1,4 +1,4 @@
 $ErrorActionPreference = "Stop"
-$pythonCommand = if ($env:FOGGY_ONBOARDING_PYTHON) { $env:FOGGY_ONBOARDING_PYTHON } else { "python" }
-& $pythonCommand (Join-Path $PSScriptRoot "onboarding.py") doctor @args
+& (Join-Path $PSScriptRoot 'invoke-onboarding.ps1') doctor @args
+exit $LASTEXITCODE
 exit $LASTEXITCODE

package/skills/foggy-deepseek-onboarding/scripts/doctor.sh

@@ -1,5 +1,4 @@
 #!/usr/bin/env bash
 set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-PYTHON_COMMAND="${FOGGY_ONBOARDING_PYTHON:-python3}"
-exec "$PYTHON_COMMAND" "$SCRIPT_DIR/onboarding.py" doctor "$@"
+exec bash "$SCRIPT_DIR/invoke-onboarding.sh" doctor "$@"

package/skills/foggy-deepseek-onboarding/scripts/install.ps1

@@ -1,4 +1,4 @@
 $ErrorActionPreference = "Stop"
-$pythonCommand = if ($env:FOGGY_ONBOARDING_PYTHON) { $env:FOGGY_ONBOARDING_PYTHON } else { "python" }
-& $pythonCommand (Join-Path $PSScriptRoot "onboarding.py") install @args
+& (Join-Path $PSScriptRoot 'invoke-onboarding.ps1') install @args
+exit $LASTEXITCODE
 exit $LASTEXITCODE

package/skills/foggy-deepseek-onboarding/scripts/install.sh

@@ -1,5 +1,4 @@
 #!/usr/bin/env bash
 set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-PYTHON_COMMAND="${FOGGY_ONBOARDING_PYTHON:-python3}"
-exec "$PYTHON_COMMAND" "$SCRIPT_DIR/onboarding.py" install "$@"
+exec bash "$SCRIPT_DIR/invoke-onboarding.sh" install "$@"

package/skills/foggy-deepseek-onboarding/scripts/invoke-onboarding.ps1

@@ -0,0 +1,30 @@
+param(
+    [Parameter(ValueFromRemainingArguments = $true)]
+    [string[]]$OnboardingArgs
+)
+
+$pythonCommand = $env:FOGGY_ONBOARDING_PYTHON
+if (-not $pythonCommand) {
+    $installRoot = if ($env:FOGGY_INSTALL_ROOT) {
+        $env:FOGGY_INSTALL_ROOT
+    } elseif ($env:LOCALAPPDATA) {
+        Join-Path $env:LOCALAPPDATA 'Foggy\DeepSeekHarness'
+    }
+    if ($installRoot) {
+        $statePath = Join-Path $installRoot 'install-state.json'
+        if (Test-Path -LiteralPath $statePath) {
+            try {
+                $state = Get-Content -Raw -LiteralPath $statePath | ConvertFrom-Json
+                $pythonCommand = $state.python.command
+            } catch {}
+        }
+    }
+}
+
+if (-not $pythonCommand -or -not (Test-Path -LiteralPath $pythonCommand)) {
+    Write-Error 'Foggy private Python is unavailable. Initialize or repair it in DeepSeek Harness plugin settings, or set FOGGY_ONBOARDING_PYTHON explicitly.'
+    exit 1
+}
+
+& $pythonCommand (Join-Path $PSScriptRoot 'onboarding.py') @OnboardingArgs
+exit $LASTEXITCODE

package/skills/foggy-deepseek-onboarding/scripts/invoke-onboarding.sh

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+python_command="${FOGGY_ONBOARDING_PYTHON:-}"
+if [[ -z "$python_command" ]]; then
+  if [[ -n "${FOGGY_INSTALL_ROOT:-}" ]]; then
+    install_root="$FOGGY_INSTALL_ROOT"
+  elif [[ -n "${XDG_DATA_HOME:-}" ]]; then
+    install_root="$XDG_DATA_HOME/foggy/deepseek-harness"
+  else
+    install_root="$HOME/.local/share/foggy/deepseek-harness"
+  fi
+  state_path="$install_root/install-state.json"
+  if [[ -f "$state_path" ]]; then
+    python_command="$(node -e 'const fs=require("node:fs"); const state=JSON.parse(fs.readFileSync(process.argv[1],"utf8")); process.stdout.write(state.python?.command || "")' "$state_path")"
+  fi
+fi
+
+if [[ -z "$python_command" || ! -x "$python_command" ]]; then
+  echo 'Foggy private Python is unavailable. Initialize or repair it in DeepSeek Harness plugin settings, or set FOGGY_ONBOARDING_PYTHON explicitly.' >&2
+  exit 1
+fi
+
+exec "$python_command" "$(dirname "$0")/onboarding.py" "$@"

package/skills/foggy-deepseek-onboarding/scripts/onboard.ps1

@@ -1,4 +1,4 @@
 $ErrorActionPreference = "Stop"
-$pythonCommand = if ($env:FOGGY_ONBOARDING_PYTHON) { $env:FOGGY_ONBOARDING_PYTHON } else { "python" }
-& $pythonCommand (Join-Path $PSScriptRoot "onboarding.py") @args
+& (Join-Path $PSScriptRoot 'invoke-onboarding.ps1') @args
+exit $LASTEXITCODE
 exit $LASTEXITCODE

package/skills/foggy-deepseek-onboarding/scripts/onboard.sh

@@ -1,5 +1,4 @@
 #!/usr/bin/env bash
 set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-PYTHON_COMMAND="${FOGGY_ONBOARDING_PYTHON:-python3}"
-exec "$PYTHON_COMMAND" "$SCRIPT_DIR/onboarding.py" "$@"
+exec bash "$SCRIPT_DIR/invoke-onboarding.sh" "$@"