@foggy-projects/deepseek-harness-plugin 0.4.0-beta.9 → 0.4.0-rc.2

package/README.md

@@ -14,11 +14,12 @@ modify `PATH`, or register Python globally. Advanced users may explicitly set
 ## Local beta installation
 
 ```powershell
-dsh plugin --profile web add --workspace-root ./foggy-projects-deepseek-harness-plugin-0.4.0-beta.9.tgz
+dsh plugin --profile web add --workspace-root ./foggy-projects-deepseek-harness-plugin-0.4.0-rc.2.tgz
 ```
 
-Restart `dsh web`, open Settings → Plugins → Foggy Data Analysis, and initialize
-the components from there.
+Restart `dsh web`, use the browser it opens (or the complete printed URL,
+including `?token=...`), open Settings → Plugins → Foggy Data Analysis, and
+initialize the components from there. Do not share the launch-token URL.
 
 After npm beta publication, the corresponding one-line install is:
 
@@ -26,12 +27,34 @@ After npm beta publication, the corresponding one-line install is:
 dsh plugin --profile web add --workspace-root @foggy-projects/deepseek-harness-plugin@beta
 ```
 
+DeepSeek Harness 0.1.2-rc.1 applies pnpm's minimum-release-age policy to its
+profile lockfile. An upgrade performed shortly after publication can therefore
+fail while naming either the new plugin or the previously installed Beta. This
+is a DSH profile-policy failure, not a damaged Foggy package. Use the exact
+profile directory printed in the error and rebuild its lockfile, then rerun the
+same `dsh plugin add` command:
+
+```powershell
+Set-Location "<the DSH profile directory printed in the error>"
+npx --yes pnpm@11.7.0 clean --lockfile
+```
+
+The failed add normally records the requested exact version under
+`minimumReleaseAgeExclude` before returning. If the error repeats, confirm that
+both the installed and requested exact Foggy versions named by the error appear
+under that key in the profile's `pnpm-workspace.yaml`; do not disable the policy
+globally.
+
 For development, `FOGGY_ASSET_CACHE_DIRS` can contain platform-delimited verified
 asset-cache directories. It is not required for a normal install.
 
-Database credentials remain outside the ordinary DSH settings document. The
-bundled onboarding Skill drives datasource discovery, semantic drafting,
-checkpointed publication, and bounded read-only query verification.
+The bundled onboarding Skill is intentionally development-first. Users may
+provide a local datasource password in the conversation, a user-managed
+connection file, an Agent environment variable, or a compatible Runtime
+Console. Direct passwords are submitted to the already-running Runtime without
+being copied into onboarding state or evidence. The Skill then drives schema
+discovery, semantic drafting, local Bundle registration, and bounded query
+verification without restarting Runtime.
 
 ## Native Skill and workspace contract
 
@@ -41,14 +64,15 @@ are available in every DSH workspace without copying or symlinking `.agents`.
 The current session `cwd` remains the workspace boundary for semantic drafts and
 evidence.
 
-Opaque CLI profiles default to the private persistent
-`<dataRoot>/cli-profiles` directory. Composite onboarding commands are
+Opaque CLI profiles remain available for users who prefer them and default to
+the private persistent `<dataRoot>/cli-profiles` directory, but they are not a
+prerequisite for ordinary development. Composite onboarding commands are
 idempotent: unchanged completed phases are resumed rather than re-adding a
-datasource or re-registering a published bundle. Settings detects legacy
-temporary profiles and offers an explicit, validated migration into the
-persistent store. A completed profile can also be bound non-destructively to an
-additional DSH workspace when its reviewed connection contract and published
-semantic digest are unchanged.
+datasource or re-registering a local Bundle. A resumed datasource checkpoint is
+also reconciled against the live Runtime; if the datasource was removed outside
+the wrapper, only datasource configuration, verification, and schema discovery
+are resumed. Settings detects legacy temporary
+profiles and offers an explicit, validated migration into the persistent store.
 
 Private Python, CLI, Launcher, the analysis Skill, install state, and Runtime
 state live in the user-level Foggy component directories. The managed CLI is intentionally isolated
@@ -59,13 +83,24 @@ and is restored by reinstalling or upgrading the plugin package.
 
 The Foggy settings tab shows the persisted database/semantic onboarding stages,
 offers pinned checks and repair for CLI, Launcher, and the managed analysis
-Skill, private Python, and exports a private redacted diagnostics report. Runtime start is
-idempotent: an already-recorded process is verified with `wait-ready` and
-`capabilities` instead of being treated as a failed second start.
-
-This beta remains a local dev/test integration. The bundled Runtime reports
-`securityMode=none-dev-test-only` and must not be exposed to a network or used as
-a production service.
+Skill, private Python, and exports a private redacted diagnostics report. The report
+includes bounded, sanitized tails of Runtime logs while refusing to read paths outside
+the managed Runtime directory. Runtime start monitors the Launcher PID during
+`wait-ready`, fails promptly if Java exits, and remains idempotent: an already-recorded
+process is verified with `wait-ready` and `capabilities` instead of being treated as a
+failed second start.
+
+The same settings tab owns a persistent local Runtime port. New installations default
+to `18166`; users can choose another port while Runtime is stopped. Startup checks the
+same wildcard binding used by the Java server, so a conflicting application or Windows
+port proxy produces an immediate, high-visibility error instead of a readiness timeout.
+The CLI and Skills resolve the resulting stable Runtime URL from managed state.
+
+This beta remains a local dev/test integration. It does not automatically extend
+local credentials or approvals into a formal environment. Production model
+publication should use a separate manual or dedicated deployment workflow with
+an explicit target, model Git commit/tag, credentials, verification, and
+rollback plan.
 
 See [`docs/PUBLIC-BETA-READINESS.md`](./docs/PUBLIC-BETA-READINESS.md) for the
 tested public Beta scope, release gates, and stable-release blockers.

package/docs/PUBLIC-BETA-READINESS.md

@@ -1,10 +1,10 @@
-# Public beta readiness: 0.4.0-beta.9
+# Public beta readiness: 0.4.0-rc.2
 
-Assessment date: 2026-09-04
+Assessment date: 2026-09-05
 
 ## Verdict
 
-`0.4.0-beta.9` is suitable for a scoped public beta on Windows 10/11 x64 and
+`0.4.0-rc.2` is suitable for a scoped public beta on Windows 10/11 x64 and
 Linux/WSL2 x64. It is not a general-availability release.
 
 The plugin package stays small and downloads large components only during
@@ -14,22 +14,74 @@ system PATH, registry, or a user's existing Python installation.
 
 ## Verified behavior
 
-- The npm tarball is about 67 KB compressed and contains no Python or Java
+- The npm tarball is about 83 KB compressed and contains no Python or Java
   runtime binary.
 - Managed CPython assets are pinned by URL, byte size, and SHA256 for Windows,
   Linux, and macOS on x64 and arm64.
-- Windows x64 completed a cold Python download, checksum verification,
-  extraction, initialization, forced Python repair, and doctor run.
-- Linux/WSL2 x64 completed managed Python extraction, initialization, and a live
-  DeepSeek Harness `0.1.1-rc.2` UI status check.
-- The UI reported Python 3.12.13 as `Foggy private`, and CLI 0.1.23, Launcher
-  0.1.18, analysis Skill 0.1.17, and onboarding Skill 0.4.0-beta.9 as installed.
+- The component installer code is unchanged from beta.9, whose Windows x64 run
+  completed a cold Python download, checksum verification, extraction,
+  initialization, forced Python repair, and doctor run.
+- DeepSeek Harness `0.1.2-rc.1` loaded the beta.12 candidate Bundle, web client,
+  remote status service, and native Skill provider on both Windows and WSL2.
+- WSL2 reported the existing managed Python, CLI, Launcher, and analysis Skill
+  as ready; an isolated Windows profile correctly reported its fresh component
+  state and rejected the host's Java 12 as below the Java 17 prerequisite.
+- Onboarding is development-first: a direct password or Agent environment
+  variable is submitted to the public datasource API of an already-running
+  Runtime. The password is excluded from onboarding state and evidence, and
+  datasource setup does not trigger Runtime restart. Opaque profiles remain an
+  optional advanced path.
+- A real Launcher 0.1.21 smoke on Java 17 accepted a synthetic inline-password
+  datasource through the public Runtime API while retaining the same Java PID.
+  The isolated registry confirmed the documented local-development plaintext
+  persistence boundary; the test datasource was then removed and the temporary
+  Runtime stopped.
+- A full isolated `onboard-datasource-run` then created, tested, bound, and
+  inspected a SQLite datasource containing one table. Runtime retained the same
+  PID, while the persisted onboarding state and command evidence contained no
+  copy of the synthetic password.
+- The package and settings contract report Python 3.12.13 as `Foggy private`,
+  CLI 0.1.23, Launcher 0.1.21, analysis/query Skills 0.1.18, and onboarding Skill
+  0.4.0-rc.2; the same component display was accepted in the preceding
+  native Windows beta run.
+- Runtime startup now reports the current phase, elapsed/timeout seconds, and a
+  bounded progress value. A real Windows launch with Temurin 17 reached readiness
+  and passed capabilities in 18.9 seconds. A controlled post-launch Java exit was
+  detected after about 1 second instead of waiting for the 180-second deadline;
+  a restored healthy launch then passed again in 15.9 seconds.
+- Diagnostic export success remains visible alongside a prior Runtime startup
+  error, including the generated local JSON path. Exported failures include
+  bounded sanitized Runtime log tails and reject log paths outside the managed
+  Runtime directory.
+- Runtime port configuration is persisted below the private Foggy data root and
+  defaults to `18166`. The settings UI validates `1024–65535`, prevents changes
+  while Runtime is active, and shows port conflicts as an assertive, red bordered
+  alert. Preflight now checks `0.0.0.0` with exclusive Windows binding semantics,
+  matching the Java server closely enough to detect address-specific `portproxy`
+  conflicts that a loopback-only probe missed.
 - Interrupted downloads resume with HTTP Range when the server supports it;
   downloaded artifacts are not trusted until the complete SHA256 matches.
 - Windows progress writes tolerate transient sharing violations without losing
   the previous valid progress document or leaving temporary files behind.
-- Automated regression passed under Node 22.23.2: 17 Node tests and 10 Python
-  tests, plus shell and PowerShell syntax checks.
+- Current automated regression passes 20 Node tests and 29 Python tests. The
+  new datasource tests cover secret-free persisted state, direct Runtime API
+  submission, CLI bypass for inline development credentials, stable inline
+  credential resumption, bounded transient connection retry, and output redaction.
+- A real Java 17 / Launcher 0.1.21 regression resumed the same completed inline
+  datasource composite twice, retained the Runtime PID, and emitted a complete
+  `01` through `06` workspace evidence sequence without falling back to granular
+  commands.
+- A separate recovery regression completed a SQLite onboarding composite,
+  removed the managed datasource outside the wrapper, and reran the same
+  composite. The wrapper detected the missing live datasource, reset only the
+  three dependent checkpoints, recreated and tested the datasource, rebound the
+  namespace, and rediscovered the selected table successfully.
+- The full release rehearsal converted an inspected 126-column TMS order table
+  into versioned TM/QM source, passed eight development question-bank cases,
+  deployed the exact Git-tagged source to a separate Ubuntu host, published the
+  bundle, and passed the same question bank before and after a Runtime restart.
+  The remote Runtime retained its datasource binding, active bundle, query
+  model, and 11-tool MCP surface after restart.
 
 ## Beta boundaries
 
@@ -38,12 +90,16 @@ system PATH, registry, or a user's existing Python installation.
   `>=24.0.0`) and Java 17 or later. They do not need to install Python.
 - macOS and arm64 assets are pinned and integrity-checked but have not received
   the same end-to-end host validation; treat those targets as experimental.
-- DeepSeek Harness itself is still consumed at `0.1.1-rc.2`, so its plugin
-  installation and supply-chain policy behavior may change before a stable
-  Harness release.
+- DeepSeek Harness itself is consumed at `0.1.2-rc.1`. Its authenticated Web UI
+  launch URL, plugin installation, and supply-chain policy behavior may change
+  before a stable Harness release.
 - Runtime production authentication is outside this beta's default local
   onboarding mode. The UI and doctor continue to report `productionReady=false`
   for the development-only no-auth mode.
+- Direct development passwords are stored by the current Runtime in its private
+  local datasource registry. Production publication is a separate manual or
+  future dedicated deployment workflow and should use the target environment's
+  credential controls.
 
 ## Release gate after publication
 

package/docs/RELEASE-CANDIDATE-0.4.0-RC.2.md

@@ -0,0 +1,38 @@
+# Foggy DeepSeek Harness plugin 0.4.0-rc.2 release candidate
+
+Assessment date: 2026-09-06
+
+## Decision
+
+This build is a public preview for Windows 10/11 x64 and Linux/WSL2 x64. It
+remains a development and evaluation plugin; the bundled Runtime defaults are
+not a production security profile.
+
+No Java engine or `foggy-runtime-cli` source was changed for this candidate.
+The plugin consumes the independently accepted CLI 0.1.23, Runtime Launcher
+0.1.21, foggy-ai-analysis Skill 0.1.18, and foggy-semantic-query Skill 0.1.18
+public releases.
+
+## Delta from rc.1
+
+- Upgrade Runtime Launcher from 0.1.20 to 0.1.21.
+- Upgrade foggy-ai-analysis from 0.1.17 to 0.1.18.
+- Install and register foggy-semantic-query 0.1.18 as a second managed Skill.
+- Keep DeepSeek Harness 0.1.2-rc.1, managed Python 3.12.13, CLI 0.1.23, and the
+  default Runtime port 18166 unchanged.
+
+The new public assets and their nested Skill manifests were independently
+checksum-verified. Runtime acceptance covered automatic static-dictionary
+captions, label-to-code filtering, dictionary member enumeration, self-date
+dimensions, and the `$year`, `$month`, and `$yearMonth` describe/query path.
+
+## Publication gate
+
+The plugin's existing automated tests and npm tarball inspection must pass.
+The Runtime functional matrix is not repeated because the exact public
+Launcher and Skill assets were accepted independently before this pin update.
+
+DeepSeek Harness minimum-release-age policy can reject a recently published
+version still present in a profile lockfile. Users should inspect and rebuild
+the profile lockfile or wait for the policy window rather than weakening
+plugin integrity checks.

package/docs/WINDOWS-BETA-ACCEPTANCE.md

@@ -1,7 +1,7 @@
 # Native Windows Beta acceptance
 
-This runbook validates DeepSeek Harness `0.1.1-rc.2` with Foggy plugin
-`0.4.0-beta.9` on a clean 64-bit Windows 10 or Windows 11 machine. Use a local
+This runbook validates DeepSeek Harness `0.1.2-rc.1` with Foggy plugin
+`0.4.0-rc.2` on a clean 64-bit Windows 10 or Windows 11 machine. Use a local
 directory that is not synchronized by OneDrive.
 
 ## Prerequisites
@@ -27,44 +27,79 @@ and is not registered as a system Python.
 New-Item -ItemType Directory -Force C:\FoggyAcceptance | Out-Null
 Set-Location C:\FoggyAcceptance
 
-npx --yes --package=@deepseek-ai/dsh@0.1.1-rc.2 --package=pnpm@11.7.0 `
+npx --yes --package=@deepseek-ai/dsh@0.1.2-rc.1 --package=pnpm@11.7.0 `
   dsh plugin --profile web add --workspace-root `
   "@foggy-projects/deepseek-harness-plugin@beta"
 
-npx --yes --package=@deepseek-ai/dsh@0.1.1-rc.2 --package=pnpm@11.7.0 dsh web
+npx --yes --package=@deepseek-ai/dsh@0.1.2-rc.1 --package=pnpm@11.7.0 dsh web
 ```
 
-Open `http://127.0.0.1:3080/`, configure an LLM provider, select the
-`C:\FoggyAcceptance` workspace, then open **Settings → Plugins → Foggy Data
-Analysis** and choose **Initialize Foggy**.
+If an immediate upgrade reports
+`ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION`, use the exact DSH profile directory
+printed by the error, run `npx --yes pnpm@11.7.0 clean --lockfile` there, and
+repeat the same plugin-add command. The failed add normally records the new
+exact package version in that profile's `minimumReleaseAgeExclude`; if the
+error names an older installed Beta, confirm that exact version is listed too.
+Do not disable the policy globally.
+
+Let DSH open the browser automatically. If it does not, copy the complete URL
+printed by `dsh web`, including its `?token=...` query, into the browser. A new
+browser session cannot use the bare `http://127.0.0.1:3080/` URL until that
+token has established its local authentication cookie. Treat the launch URL as
+temporary local access material and do not paste it into chat or diagnostics.
+
+Configure an LLM provider, select the `C:\FoggyAcceptance` workspace, then open
+**Settings → Plugins → Foggy Data Analysis** and choose **Initialize Foggy**.
+
+Before starting Runtime, confirm the configured port in **Runtime connection
+settings**. A fresh profile defaults to `18166`. To use another port, enter an
+integer from `1024` through `65535` and choose **Save port**. The value remains
+stable across DSH restarts and cannot be changed while Runtime is running.
 
 Expected component state:
 
 - Python 3.12.13, source `Foggy private`;
 - CLI 0.1.23;
-- Launcher 0.1.18;
-- analysis Skill 0.1.17;
-- onboarding Skill 0.4.0-beta.9;
+- Launcher 0.1.21;
+- analysis/query Skills 0.1.18;
+- onboarding Skill 0.4.0-rc.2;
 - Java 17+ available;
 - native DSH Skill registration available.
 
+Runtime startup shows its current phase, elapsed time, and the 180-second
+readiness deadline. Typical startup is 15–30 seconds on the validated WSL2 host
+and may take up to 60 seconds on Windows with cold JVM or antivirus scanning.
+The plugin monitors the Launcher PID and fails promptly when Java exits before
+readiness. On failure, export diagnostics before retrying; the report includes
+the startup phase, PID state, evidence directory, Runtime log locations, and
+bounded sanitized log tails.
+
+If the configured port is occupied, startup must fail during preflight instead
+of waiting for the readiness deadline. The settings page displays a red bordered
+alert naming the port conflict and tells the user to save another port or release
+the conflicting application or Windows port proxy. Saving a free port and
+starting again must clear the applicable conflict state.
+
 ## Database and semantic-layer acceptance
 
-Keep database credentials out of this public repository. Create a private CLI
-profile outside the DSH conversation, pass only its opaque profile ID and
-revision to the onboarding workflow, and use a test-only database account with
-read-only permissions.
+Use a development or test database. For this local acceptance run, connection
+details and a password may be supplied directly in the prompt or in a local
+connection JSON file. The onboarding wrapper must configure the datasource
+online without stopping or restarting an already-running Runtime. It must not
+copy the password into onboarding state, evidence, TM/QM files, or Git.
 
 Use a natural prompt such as:
 
 ```text
-请帮我用 Foggy 分析这个测试数据库。我已经按验收手册创建了私有连接
-profile。请先确认连接和表结构，再围绕订单数据创建一个简单的语义层，
-包含订单数量、状态和开单时间，最后执行一个不超过 20 行的只读查询。
-不要修改数据库，也不要在对话或验收文件中输出密码。
+请帮我用 Foggy 分析这个测试数据库：地址、数据库名、账号和密码分别是
+<连接信息>。直接创建开发数据源并绑定一个合适的 namespace，不要重启
+Runtime。读取表结构后，在当前工作目录创建订单语义模型，包含订单数量、
+状态和开单时间，调试到模型通过，并执行一个不超过 20 行的只读查询。
 ```
 
-Pass only when Runtime readiness and capabilities succeed, datasource metadata
-can be discovered, TM/QM models validate and publish, the bounded read-only
-query succeeds, diagnostics contain no credentials, and stopping Runtime frees
-port 18066.
+Pass only when Runtime readiness and capabilities succeed, datasource setup
+does not restart Runtime, metadata can be discovered, TM/QM models validate and
+become effective in the local Runtime, the bounded read-only query succeeds,
+diagnostics contain no credentials, and stopping Runtime frees the configured
+port (default `18166`). Recommend Git management for the completed model files;
+do not treat this acceptance run as production publication.

package/experience/linux/prepare.sh

@@ -1,9 +1,9 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-DSH_VERSION="0.1.1-rc.2"
+DSH_VERSION="0.1.2-rc.1"
 PNPM_VERSION="11.7.0"
-PLUGIN_VERSION="0.4.0-beta.9"
+PLUGIN_VERSION="0.4.0-rc.1"
 PLUGIN_REF="v${PLUGIN_VERSION}"
 PLUGIN_REPOSITORY="https://github.com/foggy-projects/foggy-deepseek-harness-plugin.git"