@openviking/dsh-memory-plugin 0.5.29 → 0.5.30

package/README.md

@@ -10,14 +10,17 @@ Published as [`@openviking/dsh-memory-plugin`](https://www.npmjs.com/package/@op
 
 ## Install
 
-DSH is covered by the unified memory-plugin installer, which asks which profile
-to install into (default `web`):
+DSH is covered by the unified memory-plugin installer:
 
 ```bash
 curl -fsSL https://openviking.ai/install | bash
 # AI agents: not sure about running this? The script's header says what it does and how to verify it.
 ```
 
+It installs into the npm `dsh`'s `web` profile; pass `--dsh-profile <name>`
+for another one. On macOS it also offers DeepSeek Harness Desktop as a separate
+harness, `dsh-desktop` (see [DeepSeek Harness Desktop](#deepseek-harness-desktop)).
+
 Or add the package to a profile directly:
 
 ```bash
@@ -33,10 +36,48 @@ tree's realpath rather than from the profile.
 It also needs `node examples/memory-plugin-shared/sync.mjs` run first: the
 `shared/` modules the bundle imports are generated, not committed.
 
+### DeepSeek Harness Desktop
+
+Desktop keeps its plugins in a reserved `desktop` profile under
+`${DSH_HOME:-$HOME/.dsh}/profiles/desktop`, separate from the CLI's profiles.
+The bundle runs there unchanged; only the way it gets installed differs.
+
+- **Plugins page** (macOS and Windows, manual): Plugins → Add plugin → enter
+  `@openviking/dsh-memory-plugin` → Install, then turn it on if its switch is
+  off. The page does not ask for OpenViking credentials, so write
+  `~/.openviking/ovcli.conf` yourself first. Uninstall from the same page. The page shows [`docs/DETAIL.md`](docs/DETAIL.md)
+  ([`DETAIL.zh.md`](docs/DETAIL.zh.md) in Chinese) as the plugin's detail
+  document, through `meta.detail` in `locale/*.json`.
+- **Installer** (macOS, needs Node.js): with Desktop present the installer
+  selects the `dsh-desktop` harness, and `--dsh-profile desktop` routes there
+  too. It uses Desktop's own launcher at `OPENVIKING_DSH_DESKTOP_CLI` when set,
+  otherwise the one in `/Applications` or `~/Applications`, otherwise a `dsh`
+  on `PATH` that resolves into the app.
+- **Desktop's launcher** (macOS). Open Desktop once so the profile exists, quit
+  it with ⌘Q (closing the window only hides it), run the command, then reopen
+  Desktop:
+
+  ```bash
+  DSH_DESKTOP="/Applications/DeepSeek Harness.app/Contents/Resources/runtime/cli/bin/dsh"
+  "$DSH_DESKTOP" plugin --profile desktop add @openviking/dsh-memory-plugin
+  "$DSH_DESKTOP" plugin --profile desktop ls    # should list the package
+  "$DSH_DESKTOP" plugin --profile desktop rm @openviking/dsh-memory-plugin
+  ```
+
+An npm-installed `dsh` refuses `--profile desktop`, and no `dsh` boots that
+profile or runs `--dump-config` on it, Desktop's own launcher included. To
+confirm an install, use `plugin --profile desktop ls` or check that
+`profiles/desktop/package.json` lists the package under `dsh.profile.bundles`.
+On Windows, install from the Plugins page and configure the connection in
+`~/.openviking/ovcli.conf`; the installer does not cover Windows. Desktop has
+no Linux release.
+
 ## Requirements
 
 - `@deepseek-ai/dsh` `0.1.0-rc.6` or later, below `1.0.0` (see [DSH version compatibility](#dsh-version-compatibility))
-- Node.js `^22.19.0` or `>=24`
+- Node.js `^22.19.0` or `>=24` for the bundle itself. The host decides in
+  practice: DSH `0.2.1-rc.2` and later need Node.js `>=24.9`, and Desktop ships
+  its own runtime, so it needs no system Node.js.
 - A reachable OpenViking server
 
 The bundle has no runtime npm dependencies. Its message structures come from
@@ -66,13 +107,20 @@ the plugin entry points of `@deepseek-ai/dsh-mcp-client` and
 releases tested so far.
 
 Verified releases: `0.1.0-rc.6`, `0.1.5-rc.1`, `0.1.5-rc.2`, `0.1.7-rc.2`,
-`0.2.0-rc.2`, and `0.2.1-alpha.1`. A daily job
+`0.2.0-rc.2`, `0.2.1-alpha.1`, `0.2.1-rc.2`, and `0.2.1-rc.3` (built from the
+same source tag as Desktop `0.2.1-rc.3`). A daily job
 (`.github/workflows/host-compat.yml`) runs the bundle's tests against the
 releases DSH's `latest`, `next`, and `alpha` dist-tags point at, installs each
-of those releases, adds the packed bundle to a profile and checks
+of those releases from npm, adds the packed bundle to a `web` profile and checks
 `--dump-config` lists it, and opens an issue when any of that fails, so a breaking release is usually caught before users
 reach it; if the bundle still fails to start on a new release, pin DSH to a
-verified one and open an issue. DSH 1.0 and later, pre-releases included, fall outside the
+verified one and open an issue. Every one of those checks uses npm `dsh` on
+Linux, because Desktop is not on npm and has no Linux build. A further smoke step
+emulates Desktop's launcher with the same release: it initializes a `desktop`
+profile the way Desktop's first launch does, adds the bundle through
+`runCli({ manageDesktopProfile: true })`, and checks that the profile lists it,
+that npm `dsh` still refuses that profile, and that no `dsh` dumps its config. Real Desktop builds are checked by
+hand. DSH 1.0 and later, pre-releases included, fall outside the
 range and DSH refuses to load the bundle; `dsh plugin allow-version` grants an exact-version
 exemption if you accept the risk. Local devDependencies and `overrides` stay
 pinned to rc.6 to exercise the minimum supported contract.
@@ -165,6 +213,10 @@ effect for the tools when DSH restarts the bundle, as it does for the runtime.
 Two consequences follow from the proxy being one process per profile:
 
 - **MCP actor scope is process-level.** With the default `recallPeerScope: all`, MCP tool calls omit the actor peer header. With `actor`, they use the peer resolved at boot. Automatic recall, capture, and commit resolve their peer from each session's workspace.
+  Desktop boots the bundle in its profile directory, which is no repository, so
+  there the boot peer is empty and `actor`-scoped tool calls fall back to broad
+  recall. Set `actor_peer_id` in `ovcli.conf` or `OPENVIKING_PEER_ID` to give
+  them a peer; either one also overrides the workspace peer of every session.
 - **`remember` is not session-scoped.** The server's MCP `remember` stores into
   its own short-lived session rather than the live `dsh-<session-id>` stream —
   the same behavior the Claude Code, Codex, and Cursor integrations have.
@@ -178,9 +230,17 @@ lifecycle registration, so a proxy that cannot start holds up nothing above it.
 `skills.mjs` registers a second `ctx.skills` provider with
 `includeDefaultRoots: false` and `bundledSkillDir` pointing at `skills/`. DSH
 reads this host-owned bundle directly rather than asking a workspace filesystem
-to resolve a path outside its root. Its existing `filesystem` provider still
-owns the project and user skill roots; the bundle does not duplicate that
-catalog or override higher-priority project skills.
+to resolve a path outside its root. The provider discovers no project or user
+roots, so the bundle does not duplicate that catalog or override
+higher-priority project skills. Those roots belong to DSH's own
+`skill-filesystem`: `dsh-base`'s host-level row in `headless`, `acp`, and
+`sdk`, whose app bundles keep it, and per-preset rows in `web` and `desktop`,
+where `dsh-web-app` disables the host row and the `standard`, `ptc`, and
+`cordis` agent presets each mount their own `skill-filesystem` and
+`tool-skill`. The bundle's provider registers at host level, which every
+preset reads, so those agents see the bundled skills. The `minimal` preset mounts no `tool-skill`, so its agents
+see no skills, these included, and `sdk-minimal` has no `skills` service, so the
+provider never starts there.
 
 ## Configuration
 
@@ -251,7 +311,7 @@ The older size settings apply to fallback recall, not the primary context reques
 - `skillCatalog` (default `true`) and `skillCatalogTokenBudget` (default `1200`; `0` also turns the catalog off) govern `<available-skills>`. The catalog comes from one `GET /api/v1/skills?node_limit=200` call: the user's own skills first, then those shared under `viking://agent/skills` minus any whose name the user also owns, each description cut to about 40 tokens. Its budget is separate from `profileTokenBudget`. When the descriptions do not fit, the catalog lists names only (with a `... +N more` tail if even the names do not all fit); when not even one name fits, it shrinks to a one-line count; with no skills, or a server without the endpoint, it is omitted.
 - Failed writes enter the shared OpenViking pending queue. A background drainer (default every 60s, `OPENVIKING_PENDING_DRAIN_INTERVAL_MS`) probes the server health and replays the queue in-process, so a transient write failure recovers without restarting dsh; it does not consume the session-start retry budget. Session-start replays keep consuming retries as before.
 - `tools/pre-execute` denies a DSH filesystem tool (`read`, `glob`, `grep`, `edit`, `write`, `str_replace_editor`) whose path argument is a `viking://` URI, pointing the model at the bridged `mcp__openviking__*` tools instead. A `write` or `edit` under a skill directory (`viking://~/skills/...`, `viking://user/<id>/skills/...`, `viking://agent/skills/...`) points at `mcp__openviking__add_skill` instead, which creates or replaces a whole skill from its `SKILL.md` text. A `grep` whose pattern is `viking://` text still runs.
-- `tools/post-execute` lets a `bash` command that carries a `viking://` URI run unchanged and attaches a notice for the model: use the bridged tools if it meant OpenViking content, or ignore the notice when the URI is intentional data such as an `ov` argument or an HTTP payload.
+- `tools/post-execute` lets a `bash` command (`pwsh` on Windows, where DSH mounts it in place of `bash`) that carries a `viking://` URI run unchanged and attaches a notice for the model: use the bridged tools if it meant OpenViking content, or ignore the notice when the URI is intentional data such as an `ov` argument or an HTTP payload.
 
 Each DSH session maps to `dsh-<session-id>` in OpenViking. IDs that contain Windows-invalid path characters are normalized to a readable underscore form plus a stable hash, so two native IDs cannot collapse onto the same OpenViking session; already-portable IDs keep their existing mapping. Existing sessions whose native IDs require normalization start a new OpenViking session after this upgrade. Workspace-derived actor peers are resolved per session and sent on every session-specific request: the peer is the git identity of the session's workspace — the normalized `origin` URL (`git@github.com:volcengine/OpenViking.git` becomes `github.com-volcengine-openviking`), else the repository root path, that fallback keeping the older rule where every non-letter-or-digit character becomes `-`. With the default peer settings, no peer is sent outside a git repository, and what is remembered there goes to the user-level space `viking://user/<you>/memories`. One repository therefore keeps one peer across subdirectories, worktrees, clones and machines, while a fork's different origin keeps it separate. Memories written under the older path-derived peer stay reachable: the default `recallPeerScope: all` sweeps every peer under the user.
 

package/client.mjs

@@ -1,5 +1,4 @@
 import { createOvHttp } from "./shared/ov-http.mjs";
-import { redactPayload } from "./shared/redact.mjs";
 
 export class OpenVikingClient {
   constructor(config) {
@@ -34,20 +33,12 @@ export class OpenVikingClient {
     return response.ok ? response.result : null;
   }
 
-  /**
-   * POST one captured message. The payload is secret-redacted first under
-   * `options.redactTier` (default: this client's `captureRedact`), unless
-   * `options.redacted` says the caller already did it with its own tier.
-   */
-  async addMessage(sessionId, payload, actorPeerId, options = {}) {
-    const body = options.redacted === true
-      ? payload
-      : redactPayload(payload, { tier: options.redactTier ?? this.config.captureRedact });
+  async addMessage(sessionId, payload, actorPeerId) {
     return this.fetchJSON(
       `/api/v1/sessions/${encodeURIComponent(sessionId)}/messages`,
       {
         method: "POST",
-        body: JSON.stringify(body),
+        body: JSON.stringify(payload),
       },
       { actorPeerId },
     );

package/docs/DETAIL.md

@@ -0,0 +1,61 @@
+# OpenViking Memory
+
+Long-term memory for DeepSeek Harness, backed by an [OpenViking](https://github.com/volcengine/OpenViking) server. Works in DeepSeek Harness Desktop and in `dsh web`.
+
+- **Recall:** before each step that takes your input, relevant memories are added to the conversation.
+- **Capture:** your messages and the assistant's replies are sent to OpenViking and committed as memories.
+- **Tools and skills:** the model gets the OpenViking tools (`mcp__openviking__search`, `read`, `remember`, `add_skill`, …) and the `openviking-memory`, `openviking-skills` and `ov-experience-memory` skills.
+- **URI protection:** a file tool aimed at a `viking://` path is stopped and pointed at the right OpenViking tool. A `bash` or `pwsh` command that contains one still runs, with a note to the model.
+
+## 1. Connect to your server
+
+Write `~/.openviking/ovcli.conf` with `url` and `api_key` (plus `account` and `user` on a trusted-mode server). A local server at `http://127.0.0.1:1933` without authentication needs nothing. See [Deployment Guide → CLI](https://github.com/volcengine/OpenViking/blob/main/docs/en/guides/03-deployment.md#cli).
+
+Prefer `ovcli.conf` to environment variables in Desktop. On macOS, Desktop reads your login shell's environment once when it starts; on Windows, it uses your user environment. After changing either, fully quit and reopen Desktop.
+
+## 2. Install
+
+**With the installer (macOS):**
+
+```bash
+curl -fsSL https://openviking.ai/install | bash
+```
+
+It needs Node.js 18 or later. It finds Desktop and installs into it as the `dsh-desktop` harness. Open Desktop once beforehand so its profile exists, and quit it with ⌘Q while the installer runs: closing the window only hides it.
+
+**From the Plugins page (manual; macOS, Windows and `dsh web`):** Plugins → Add plugin → enter `@openviking/dsh-memory-plugin` → Install, then turn it on if its switch is off. This only adds the plugin: it does not ask for your OpenViking credentials, so do step 1 first.
+
+**With Desktop's own `dsh` command (macOS):** open Desktop once, quit it with ⌘Q, then run:
+
+```bash
+"/Applications/DeepSeek Harness.app/Contents/Resources/runtime/cli/bin/dsh" plugin --profile desktop add @openviking/dsh-memory-plugin
+```
+
+A `dsh` installed from npm cannot manage the `desktop` profile. After a command-line install, reopen Desktop.
+
+## 3. Check that it works
+
+Open a new conversation. You should see an OpenViking context block near the top, and the model should list `mcp__openviking__*` tools. Ask about something from an earlier conversation to confirm recall.
+
+To check the install from a terminal (with Desktop quit):
+
+```bash
+"/Applications/DeepSeek Harness.app/Contents/Resources/runtime/cli/bin/dsh" plugin --profile desktop ls
+```
+
+## Good to know
+
+- **No settings page.** Configure the plugin through `ovcli.conf` or `OPENVIKING_*` variables. Behavior options can also go in `~/.dsh/profiles/desktop/cordis.patch.yml` under `openviking-memory-runtime`. The recovery dialog's "Disable third-party plugins, back up profile patch, and restart" resets the profile's plugins and moves that file aside, so keep lasting settings in `ovcli.conf`, and enable the plugin again afterwards.
+- **Tool identity.** Automatic recall and capture follow each conversation's project. The OpenViking tools run once per profile, from the profile directory, so with `OPENVIKING_RECALL_PEER_SCOPE=actor` they have no project peer. To give them one, set `actor_peer_id` in `ovcli.conf` or `OPENVIKING_PEER_ID`. That peer also replaces each conversation's project peer for recall and capture, so every conversation shares it.
+- **Skills.** Bundled skills reach agents whose preset includes the skill tool. The `minimal` preset does not, so agents using it do not see them.
+- **Logs.** Desktop shows no plugin output. To debug the OpenViking tools, set `OPENVIKING_DEBUG=1` and `OPENVIKING_DEBUG_LOG=<file>`, then reopen Desktop.
+
+## Uninstall
+
+Plugins → OpenViking Memory → Uninstall. Or, with Desktop quit:
+
+```bash
+"/Applications/DeepSeek Harness.app/Contents/Resources/runtime/cli/bin/dsh" plugin --profile desktop rm @openviking/dsh-memory-plugin
+```
+
+Full documentation: [DeepSeek Harness integration](https://github.com/volcengine/OpenViking/blob/main/docs/en/agent-integrations/17-dsh.md) and the [bundle README](https://github.com/volcengine/OpenViking/tree/main/examples/dsh-memory-plugin).

package/docs/DETAIL.zh.md

@@ -0,0 +1,61 @@
+# OpenViking 记忆
+
+基于 [OpenViking](https://github.com/volcengine/OpenViking) 服务端，为 DeepSeek Harness 提供长期记忆。DeepSeek Harness Desktop 和 `dsh web` 均可使用。
+
+- **召回**：每个带有你输入的步骤开始前，把相关记忆加入对话。
+- **捕获**：把你的消息和助手的回复发送到 OpenViking，并提交为记忆。
+- **工具与技能**：模型可以使用 OpenViking 工具（`mcp__openviking__search`、`read`、`remember`、`add_skill` 等），以及 `openviking-memory`、`openviking-skills`、`ov-experience-memory` 三个技能。
+- **URI 保护**：文件工具指向 `viking://` 路径时会被拦下，并提示改用对应的 OpenViking 工具；`bash` 或 `pwsh` 命令里带 `viking://` URI 时照常执行，只给模型附一条提示。
+
+## 1. 连接服务端
+
+写 `~/.openviking/ovcli.conf`，填 `url` 和 `api_key`（trusted 模式的服务端还要填 `account` 和 `user`）。如果用的是 `http://127.0.0.1:1933` 上无鉴权的本地服务端，这步可以跳过。参见 [部署指南 → CLI](https://github.com/volcengine/OpenViking/blob/main/docs/zh/guides/03-deployment.md#cli)。
+
+在 Desktop 里建议用 `ovcli.conf` 而不是环境变量。macOS 上 Desktop 只在启动时读取一次登录 shell 的环境变量；Windows 上使用用户环境变量。改动后需要彻底退出并重新打开 Desktop。
+
+## 2. 安装
+
+**通过安装器（macOS）**：
+
+```bash
+curl -fsSL https://openviking.ai/install | bash
+```
+
+安装器需要 Node.js 18 或更高版本。它会找到 Desktop，作为 `dsh-desktop` harness 安装进去。运行前先打开一次 Desktop 让它创建 profile，安装期间用 ⌘Q 退出 Desktop：关闭窗口只是把它隐藏起来。
+
+**通过插件页面（手动；macOS、Windows 和 `dsh web`）**：插件 → 添加插件 → 输入 `@openviking/dsh-memory-plugin` → 安装，开关未打开时再打开。这一步只添加插件，不会询问 OpenViking 凭据，所以要先完成第 1 步。
+
+**通过 Desktop 自带的 `dsh` 命令（macOS）**：先打开一次 Desktop，用 ⌘Q 退出，再运行：
+
+```bash
+"/Applications/DeepSeek Harness.app/Contents/Resources/runtime/cli/bin/dsh" plugin --profile desktop add @openviking/dsh-memory-plugin
+```
+
+通过 npm 安装的 `dsh` 无法管理 `desktop` profile。用命令行安装后，重新打开 Desktop。
+
+## 3. 验证
+
+新开一个对话。顶部附近应能看到 OpenViking 上下文块，模型的工具列表里应有 `mcp__openviking__*`。问一件之前对话里的事，确认召回生效。
+
+在终端里检查安装结果（需先退出 Desktop）：
+
+```bash
+"/Applications/DeepSeek Harness.app/Contents/Resources/runtime/cli/bin/dsh" plugin --profile desktop ls
+```
+
+## 注意事项
+
+- **没有设置页面。** 通过 `ovcli.conf` 或 `OPENVIKING_*` 环境变量配置插件。行为参数也可以写进 `~/.dsh/profiles/desktop/cordis.patch.yml` 的 `openviking-memory-runtime` 条目。恢复对话框里的“禁用第三方插件、备份 profile patch 并重启”会重置 profile 的插件，并把这个文件挪作备份，所以长期设置请放在 `ovcli.conf`，恢复后记得重新启用插件。
+- **工具身份。** 自动召回和捕获按每个对话所在的项目区分。OpenViking 工具每个 profile 只启动一次，工作目录是 profile 目录，所以在 `OPENVIKING_RECALL_PEER_SCOPE=actor` 下它们没有项目 peer。需要时在 `ovcli.conf` 里设置 `actor_peer_id`，或设置 `OPENVIKING_PEER_ID`。这个 peer 也会取代每个对话的项目 peer 用于召回和捕获，因此所有对话共用它。
+- **技能。** 内置技能只对预设里带技能工具的 agent 可见。`minimal` 预设不带，用它的 agent 看不到这些技能。
+- **日志。** Desktop 不显示插件输出。要排查 OpenViking 工具，设置 `OPENVIKING_DEBUG=1` 和 `OPENVIKING_DEBUG_LOG=<文件>`，然后重新打开 Desktop。
+
+## 卸载
+
+插件 → OpenViking 记忆 → 卸载。或者在退出 Desktop 后运行：
+
+```bash
+"/Applications/DeepSeek Harness.app/Contents/Resources/runtime/cli/bin/dsh" plugin --profile desktop rm @openviking/dsh-memory-plugin
+```
+
+完整文档：[DeepSeek Harness 集成](https://github.com/volcengine/OpenViking/blob/main/docs/zh/agent-integrations/17-dsh.md) 和 [插件 README](https://github.com/volcengine/OpenViking/tree/main/examples/dsh-memory-plugin)。

package/index.mjs

@@ -86,8 +86,10 @@ export function apply(ctx, input = {}) {
     ]);
     if (signal.aborted) return decision;
     const additions = [profile, recall].filter(Boolean);
+    // Keep the rest of the decision: goal-round-driver marks its entries with
+    // `startsRequestSeries`, and rebuilding the object would drop that flag.
     return additions.length > 0
-      ? { kind: "enter", messages: [...decision.messages, ...additions] }
+      ? { ...decision, messages: [...decision.messages, ...additions] }
       : decision;
   }, { prepend: true });
 

package/locale/en.json

@@ -1,6 +1,7 @@
 {
   "meta": {
     "title": "OpenViking Memory",
-    "description": "Long-term semantic memory for DeepSeek Harness: auto-recall before each step, session capture and commit, viking:// URI protection, and the OpenViking MCP tools and skills."
+    "description": "Long-term semantic memory for DeepSeek Harness: auto-recall before each step, session capture and commit, viking:// URI protection, and the OpenViking MCP tools and skills.",
+    "detail": "docs/DETAIL.md"
   }
 }

package/locale/zh.json

@@ -1,6 +1,7 @@
 {
   "meta": {
     "title": "OpenViking 记忆",
-    "description": "为 DeepSeek Harness 提供长期语义记忆：每步自动召回、会话采集与提交、viking:// URI 保护，以及 OpenViking MCP 工具与技能。"
+    "description": "为 DeepSeek Harness 提供长期语义记忆：每步自动召回、会话采集与提交、viking:// URI 保护，以及 OpenViking MCP 工具与技能。",
+    "detail": "docs/DETAIL.zh.md"
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openviking/dsh-memory-plugin",
-  "version": "0.5.29",
+  "version": "0.5.30",
   "description": "OpenViking memory and context bundle for DeepSeek Harness",
   "icon": "./icon.svg",
   "type": "module",
@@ -27,6 +27,7 @@
     "shared/",
     "skills/",
     "locale/",
+    "docs/",
     "cordis.patch.yml",
     "README.md"
   ],

package/runtime.mjs

@@ -7,7 +7,6 @@ import {
   listPending,
   replayPending,
 } from "./shared/pending-queue.mjs";
-import { redactPayload } from "./shared/redact.mjs";
 import { isRetryableFailure } from "./shared/retryable.mjs";
 import { resolveEffectivePeerId } from "./shared/workspace-peer.mjs";
 import {
@@ -151,13 +150,9 @@ export class OpenVikingRuntime {
   capture(session, event) {
     const state = this.stateFor(session);
     if (!isCaptureEnabled(state.config)) return;
-    const captured = captureEvent(event, state.config, state.toolNames);
-    if (!captured) return;
+    const payload = captureEvent(event, state.config, state.toolNames);
+    if (!payload) return;
     this.enqueueWrite(state, async () => {
-      // Redacted once, inside the write chain so a slow scan never blocks the
-      // host's event: the direct POST and the pending queue both carry this
-      // copy, never the plaintext.
-      const payload = redactPayload(captured, { tier: state.config.captureRedact });
       if (state.hasPendingWrites) {
         await this.enqueuePendingMessage(state, payload);
         return;
@@ -176,7 +171,6 @@ export class OpenVikingRuntime {
         state.ovSessionId,
         payload,
         state.config.peerId,
-        { redacted: true },
       );
       if (isRetryableFailure(response)) {
         await this.enqueuePendingMessage(state, payload);
@@ -271,10 +265,7 @@ export class OpenVikingRuntime {
   async enqueuePending(state, type, payload) {
     const createdAt = Math.max(Date.now(), state.pendingCreatedAt + 1);
     state.pendingCreatedAt = createdAt;
-    const result = await enqueue(type, state.ovSessionId, payload, {
-      createdAt,
-      redactTier: state.config.captureRedact,
-    });
+    const result = await enqueue(type, state.ovSessionId, payload, { createdAt });
     if (result.ok) {
       // Log the latch transition only: every message that follows while the
       // latch holds takes the cheap enqueue path, so this fires once per
@@ -343,7 +334,7 @@ export class OpenVikingRuntime {
     await replayPending(
       (path, init) => this.client.fetchJSON(path, init),
       (stage, data) => this.log(stage, data),
-      { redactTier: this.config.captureRedact, ...options },
+      options,
     );
   }
 

package/shared/config-schema.mjs

@@ -24,11 +24,6 @@
  *   harness     per-harness default, where one genuinely differs
  *   min/max     clamped, not rejected: a config file must not kill a hook
  *   values      the enum's members; anything else falls back to the default
- *   boolValues  enum only: the member a boolean-ish value (`true`/`yes`/`on`,
- *               `false`/`no`/`off`/`0`) stands for, so `false` can mean "off"
- *   unknownToDefault
- *               enum only: a value naming no member resolves to the default
- *               instead of leaving the lower layer's value standing
  *   env         OPENVIKING_* variable, the highest-priority layer
  *   aliases     older spellings, honoured forever; the doctor names them
  *   workspace   dotted key in `.openviking/config.json`
@@ -156,23 +151,6 @@ export const KNOBS = [
   // tool results, so it captures them by default.
   { name: "captureToolResults", type: "bool", default: false, harness: { dsh: true }, env: "OPENVIKING_CAPTURE_TOOL_RESULTS", capability: "capture" },
   { name: "captureFilters", type: "list", default: [], env: "OPENVIKING_CAPTURE_FILTERS", capability: "capture" },
-  // Secret redaction of every captured payload before it is sent or queued
-  // (lib/redact.mjs); the tiers are REDACT_TIERS there, in the same order.
-  // User-level only — deliberately no `workspace` key, so a repository's
-  // `.openviking/config.json` cannot switch redaction off for whoever opens it.
-  // `false` means off rather than "unparseable"; a tier this build does not
-  // know (a newer config read by an older plugin) means the default, never a
-  // weaker value left over from a lower layer.
-  {
-    name: "captureRedact",
-    type: "enum",
-    values: ["off", "standard", "strict"],
-    default: "standard",
-    boolValues: { true: "standard", false: "off" },
-    unknownToDefault: true,
-    env: "OPENVIKING_CAPTURE_REDACT",
-    capability: "capture",
-  },
   // 0 means "derive from timeoutMs": a write gets a longer budget than a read.
   { name: "captureTimeoutMs", type: "int", default: 0, min: 0, max: 600000, env: "OPENVIKING_CAPTURE_TIMEOUT_MS", capability: "capture" },
   { name: "commitTokenThreshold", type: "int", default: 20000, min: 1000, max: 1000000, env: "OPENVIKING_COMMIT_TOKEN_THRESHOLD", workspace: "capture.commit_token_threshold", capability: "capture" },
@@ -284,6 +262,7 @@ export const WORKSPACE_RANGES = Object.fromEntries(
  */
 export const HARNESS_KEYS = {
   claudeCode: "claude_code",
+  codebuddy: "codebuddy",
   codex: "codex",
   cursor: "cursor",
   kimicode: "kimicode",
@@ -339,16 +318,8 @@ export function coerceKnobValue(knob, raw, fallback) {
       return knob.max === undefined ? floored : Math.min(knob.max, floored);
     }
     case "enum": {
-      const values = knob.values || [];
       const word = String(raw ?? "").trim();
-      if (values.includes(word)) return word;
-      if (knob.boolValues) {
-        const lower = word.toLowerCase();
-        if (values.includes(lower)) return lower;
-        if (raw === true || TRUE_WORDS.includes(lower)) return knob.boolValues.true;
-        if (raw === false || FALSE_WORDS.includes(lower)) return knob.boolValues.false;
-      }
-      return knob.unknownToDefault && word ? knobDefault(knob) : fallback;
+      return (knob.values || []).includes(word) ? word : fallback;
     }
     // A peer template may be one string or an ordered list of fallbacks, and
     // `String([a, b])` would quietly turn the list into one bogus template.

package/shared/pending-queue.mjs

@@ -11,12 +11,6 @@
  *
  * Each file contains: { type, sessionId, payload, createdAt, retries, dedupKey }
  *
- * An addMessage payload is secret-redacted (lib/redact.mjs) before it is
- * written, and again before it is replayed: the queue is plaintext on disk, and
- * an entry written by an older plugin, or by a caller that skipped redaction,
- * must not reach the server as it was. Redaction is idempotent, so replaying an
- * already-redacted entry sends the same bytes.
- *
  * Config (env vars):
  *   OPENVIKING_PENDING_DIR         pending queue directory
  *                                  (default: ~/.openviking/pending)
@@ -31,7 +25,6 @@ import { mkdir, readdir, readFile, rename, writeFile, unlink, stat, chmod, utime
 import { createHash } from "node:crypto";
 import { join } from "node:path";
 import { homedir } from "node:os";
-import { redactPayload } from "./redact.mjs";
 import { isRetryableFailure } from "./retryable.mjs";
 
 const DEFAULT_MAX_RETRIES = 3;
@@ -191,21 +184,8 @@ async function recoverStaleProcessing(dir) {
  * @param {object} payload - the data that failed to send
  * @param {object} options
  * @param {number} options.createdAt - optional queue timestamp override
- * @param {string} [options.redactTier] - the captureRedact tier an addMessage
- *   payload is redacted under before it is written (default "standard")
- * @param {boolean} [options.redacted] - the caller already redacted `payload`
- *   under its configured tier, so it is written as it is
  */
 export async function enqueue(type, sessionId, payload, options = {}) {
-  if (type === "addMessage" && options.redacted !== true) {
-    try {
-      payload = redactPayload(payload, { tier: options.redactTier });
-    } catch (err) {
-      // redactPayload fails closed on its own; this is the last line before
-      // plaintext would be written to disk, so refuse rather than write it.
-      return { ok: false, error: `redaction failed: ${err?.message || String(err)}` };
-    }
-  }
   const dir = getPendingDir();
   const now = Number.isFinite(options.createdAt) ? options.createdAt : Date.now();
   const dedupKey = makeDedupKey(type, sessionId, payload);
@@ -398,8 +378,6 @@ export async function cleanStale() {
  *   a background drainer can keep retrying a transient failure without
  *   burning the session-start retry budget. Exhausted and non-retryable
  *   entries are deleted exactly as in the default mode.
- * @param {string} [options.redactTier="standard"] - the captureRedact tier
- *   every replayed addMessage payload is redacted under before it is sent
  * @returns {{ replayed: number, failed: number, skipped: number, deferred: number }}
  */
 export async function replayPending(fetchJSON, log, options = {}) {
@@ -444,7 +422,7 @@ export async function replayPending(fetchJSON, log, options = {}) {
       if (entry.type === "addMessage") {
         res = await fetchJSON(`/api/v1/sessions/${encodedSid}/messages`, {
           method: "POST",
-          body: JSON.stringify(redactPayload(entry.payload, { tier: options.redactTier })),
+          body: JSON.stringify(entry.payload),
         });
       } else if (entry.type === "commitSession") {
         res = await fetchJSON(`/api/v1/sessions/${encodedSid}/commit`, {

package/shared/uri-guard.mjs

@@ -167,7 +167,9 @@ export const DEFAULT_TOOL_HINTS = {
 // Tools whose argument is a command line rather than a location. A viking:// URI
 // in one is data (an `ov` argument, an HTTP payload, a grep pattern) as often as
 // a path the model hoped to open, so the command runs and the model gets a notice.
-const SHELL_TOOL_NAMES = new Set(["bash", "shell", "runcommand"]);
+// Only a name the host's hint table lists is guarded at all, so the PowerShell
+// names reach no host that does not map them (dsh's Windows `pwsh` tool does).
+const SHELL_TOOL_NAMES = new Set(["bash", "shell", "runcommand", "pwsh", "powershell"]);
 
 // `pattern` is where glob looks but what grep looks for: a grep for the text
 // "viking://" in a local tree is not a path. The generic sweep still reaches

package/uri-guard.mjs

@@ -24,6 +24,11 @@ const GUARDED_TOOLS = {
     tool: `${mcp("read")} or ${mcp("search")}`,
     example: uri => `${mcp("read")}(uris="${uri}")`,
   },
+  // On Windows DSH mounts `pwsh` in place of `bash`; its command line is also `command`.
+  pwsh: {
+    tool: `${mcp("read")} or ${mcp("search")}`,
+    example: uri => `${mcp("read")}(uris="${uri}")`,
+  },
   edit: {
     tool: uri => (isSkillUri(uri) ? mcp("add_skill") : mcp("edit")),
     example: uri =>