dsh-cindy-host 0.1.30 → 0.1.32

package/CHANGELOG.md

@@ -1,11 +1,30 @@
 # Changelog
 
-## 0.1.30 — 2026-10-29
+## 0.1.32 — 2026-11-03
 
-- Match Cindy native local media fetching: baseDir/workdir constraints are optional; absolute file references no longer fail with no-root. Explicit constraints, sensitive-path checks, regular-file checks and byte limits remain enforced.
-- Fix the shared parser/resolver for all file types and original, thumbnail, prepareOnly and file-peer reads; no PNG-specific workaround or controller changes.
-- Add contract regressions for 15 extensions, POSIX/Windows paths, both file/audio schemes, real filesystem preparation and rootless peer bytes/EOF.
-- Minimal patch on published 0.1.29; preserves its runtime and queue/input-delivery behavior. Requires the same DSH 0.2.1-rc.3 carrier and Node >=22.16. Linux handset end-to-end acceptance requires deployment and is not implied by publication.
+- Remove keytar and its native npm build chain. Linux/macOS keep system credential vaults through secret-tool/security; Windows encrypts with built-in DPAPI CurrentUser and persists ciphertext through the native DSH credential record service. Login, renewal and logout share one installation-scoped store; failures never fall back to plaintext or pretend a stored login is absent. Windows upgrades may require one explicit login; legacy vault entries are left untouched.
+
+- Add exact DSH `0.2.2-alpha.2` session/settings peers and its Schemastery `3.18.6-alpha.1` peer, retaining the existing rc.3/rc.4/rc.5 carriers. Alpha's own Node.js >=24.9 requirement still applies.
+- Replace removed `standingKeyFor` draft discovery with the current preset revision lease (`acquireScope`), released after successful or failed reads; prefer isolated live-Agent skill services and retain older-carrier fallback.
+- Add lease-lifecycle regressions and a reproducible isolated-alpha core-contract smoke covering real compatibility admission, Loader activation, Session message/input identity and preset skill visibility. Controller/settings/archive method checks are structural only; alpha Web, persistent settings, relay and handset acceptance remain separate gates. The core-contract smoke does not modify or reload a production profile.
+
+- Connect archive/restore metadata to native DSH workspace-registry durability, with native activity checks, cross-device committed archive updates, list-cache invalidation, and explicit unpin acknowledgements. Preserve legacy controller archive flags until an explicit operation retires them; deletion remains non-destructive and Host-local.
+
+- Delegate remote model switching to native DSH when its selection API is composed. The Host now advertises model-window authority so Cindy does not reject DSH selections with its legacy Pi/unknown-capacity precheck. Running-turn selections and selecting the original model again use the same DSH next-request API; no Cindy or DSH core patch is required.
+- Keep missing native selection unavailable and preserve native refusal propagation. Regression coverage includes capability/catalog degradation, all three client aliases, switching back, and the unmodified Cindy consumer guard.
+
+## 0.1.31 — 2026-10-31
+
+- Merge `main` into the DSH 0.2.1 carrier. `main` was a single working-tree snapshot that had diverged since the 0.2.1 peers landed; every conflict was resolved by keeping the newer, functionally wider side and re-taking `main`'s unique fixes rather than picking a whole file.
+- **Behavioral change from `main`:** media and file-peer fetch accept Cindy's native URL shape — a project-folder export sends only `path` and an optional `v`, with no directory roots. Containment is now enforced only when the controller names roots; the never-serve denylist (`.ssh`, `.aws`, `.gnupg`, `.env`, `id_rsa`, …), the regular-file check, the 25 MiB cap and the authenticated-controller policy are unchanged.
+- Add the native-contract fixture matrix (15 extensions × POSIX/Windows roots, offline) and a file-peer test that pins the rootless transfer and its EOF end to end.
+- Keep DSH 0.2.1-rc.3/rc.4/rc.5 as the accepted peer set; the verified isolated runtime for this release is **DSH 0.2.1-rc.5** on Node.js 24.12.
+- Device deletion keeps the bearer-renewal retry added on this carrier (401 → renew once through the Host owner, then re-validate the target before retrying); `doc/device-management.md` now states that exception instead of claiming deletion never renews anything.
+- `doc/` stays out of the published package, as it has since 0.1.28; `doc/publishing.md` no longer documents the opposite.
+
+## 0.1.30 — 2026-10-31
+
+- Accept `@deepseek-ai/dsh-session` and `@deepseek-ai/dsh-settings` `0.2.1-rc.4` and `0.2.1-rc.5` in addition to `0.2.1-rc.3`. The pinned single-version peers made `dsh plugin add` reject the install on a host that had already moved to rc.5. No runtime behavior change.
 
 ## 0.1.29 — 2026-10-29
 

package/README.md

@@ -4,14 +4,61 @@ A Host-side adapter connecting current Cindy clients to DeepSeek Harness.
 
 ## Requirements and installation
 
-Version 0.1.29 targets the verified **DSH 0.2.1-rc.3** service contracts, with **Node.js >=22.16**. Its DSH peer versions are pinned to this carrier to prevent an installer from mixing a newer prerelease SDK into the running host. The verified Desktop runtime includes Node.js 24.21. Install through the Desktop DSH plugin manager. CLI-managed profiles can use:
+Version **0.1.32** additionally supports **DSH 0.2.2-alpha.2**, while retaining `0.2.1-rc.3`, `0.2.1-rc.4` and `0.2.1-rc.5`. Alpha requires **Node.js >=24.9** (tested with 24.12); the older carriers retain this plugin's Node.js >=22.16 minimum. Session/settings peers and alpha Schemastery are explicitly allowed, not a blanket promise for future prereleases. Install through the Desktop DSH plugin manager. CLI-managed profiles can use:
 
 ```sh
-dsh plugin --profile <profile> add dsh-cindy-host@0.1.29
+dsh plugin --profile <profile> add dsh-cindy-host@0.1.32
 ```
 
 Reload the Host plugin after installation. A full DSH restart is separate. Keep existing Cindy sign-in, device identity and settings; do not run two Host processes with the same identity.
 
+## 0.1.32: credentials without keytar
+
+No native npm credential module or C++ build toolchain is required. Linux uses `secret-tool` with an unlocked Secret Service (headless sessions need their own DBus/keyring setup); macOS uses the system Keychain through `/usr/bin/security`. Both keep the existing `DSH Cindy Host` service and installation-specific account.
+
+Windows uses built-in Windows PowerShell/.NET DPAPI (CurrentUser), then stores **only encrypted ciphertext** in DSH’s native `credentials` record service. DSH owns the private file, atomic writes and record removal; tokens never enter settings, child-process arguments or logs. No Cindy/Electron integration is required. DSH without the record API, blocked PowerShell, a locked keychain, missing `secret-tool`, or damaged ciphertext produces a storage error, not a missing login or a plaintext fallback.
+
+Windows users upgrading from keytar may need to sign in once through the **DSH settings card**. Old Windows Credential Manager entries are not automatically read or deleted; rollback can still see them, and users can remove them manually after confirming the new login. Windows standalone `npm run login/logout/host` has no DSH credential context: use the settings card instead. Linux/macOS standalone commands keep using the same system keychain. Different DSH homes remain isolated. DPAPI ciphertext is not a portable backup: another OS user/machine generally cannot decrypt it.
+
+Native Windows persistence smoke (fake credentials and an isolated temporary DSH document only):
+
+```sh
+node tools/credential-store-native-smoke.mjs --runtime <DSH-runtime-root>
+```
+
+The runtime root must contain compiled DSH SDK packages under node_modules. This checks real DPAPI encryption, native DSH atomic persistence, fresh-context restore, renewal and logout without accessing a daily profile. Linux/macOS command adapters have mock-contract tests; live keychain acceptance must run on those operating systems.
+
+## 0.1.32: DSH 0.2.2-alpha.2 compatibility
+
+- Accept the exact alpha session/settings carrier and `@deepseek-ai/schemastery@3.18.6-alpha.1` without installing another DSH runtime as a dependency.
+- Draft skill discovery uses `agentPresets.acquireScope()` and releases the revision after success or failure. Live Agents prefer their isolated preset skill service; older standing-key carriers retain their fallback.
+- Isolated alpha core-contract smoke exercises the real compatibility evaluator, Cordis Loader, Session message folding, and preset-scoped skill discovery. It also checks controller/settings/archive method presence. This is **not** full Web/profile-persistence/relay/handset acceptance; those remain unverified on alpha. No daily profile is modified or restarted.
+
+Reproduce without installing into a DSH profile:
+
+```sh
+npm install --prefix <isolated-npm-project> --ignore-scripts \
+  @deepseek-ai/dsh-sdk-minimal@0.2.2-alpha.2 \
+  @deepseek-ai/dsh-api-session-controller@0.2.2-alpha.2 \
+  @deepseek-ai/dsh-settings@0.2.2-alpha.2 \
+  @deepseek-ai/dsh-agent-preset-registry@0.2.2-alpha.2 \
+  @deepseek-ai/dsh-skill@0.2.2-alpha.2 \
+  @deepseek-ai/dsh-workspace@0.2.2-alpha.2 \
+  @deepseek-ai/dsh-home-paths@0.2.2-alpha.2 ws@8.21.3 werift@0.24.4
+```
+
+Unpack `npm pack` output beneath that npm project's directory, so its imports use the alpha peers, then run (the smoke asserts that resolution):
+
+```sh
+node tools/dsh-compat-smoke.mjs --runtime <isolated-npm-project> --plugin <unpacked-package>
+```
+
+For a full alpha-dependency regression, additionally copy the repository's test-only `test`, `tools`, `fixtures` directories and the root lockfile into that unpacked package and run `node --test` from it. These fixtures are intentionally not distributed in the npm tarball.
+
+## 0.1.31: merged `main`, native rootless media fetch
+
+Absorbs the `main` branch on top of the 0.2.1 carrier. The one behavioral change that came from it: media and file-peer fetch now accept Cindy's **native URL shape**, where a project-folder export sends only `path` plus an optional `v` and no directory roots. Directory containment is therefore enforced only when the controller actually names roots; the never-serve denylist, the regular-file check, the 25 MiB cap and the separate authenticated-controller policy are unchanged. Also carried over: the native-contract fixture matrix (15 extensions × POSIX/Windows), the repository/docs snapshot, and a test that pins the rootless file-peer transfer end to end.
+
 ## 0.1.29: reproducible repository release
 
 Runtime behavior is unchanged from the phone- and desktop-accepted 0.1.28. This release synchronizes the verified source, dependency lock and offline native-client contract fixtures into Git. The pinned third-party fixtures are test-only and excluded from the npm package.
@@ -32,6 +79,18 @@ The ledger lives under the active DSH profile state directory. Pending payloads
 
 All changes are Host-only: no Cindy or DSH core patch is required. The handshake compatibility stamp is separate from the actual plugin version and explicit v1 capability. Unsupported optional features are refused; this is not a promise of all native Cindy features or exactly-once external tool effects.
 
+## Model switching follows DSH
+
+When native `sessionController.selectModel` is composed, the Host tells Cindy to delegate model-window decisions to DSH. Users may select another model during a running turn and select the original model again. DSH validates the provider/model/effort and records the selection for the **next model request**; an already-issued request is not interrupted. DSH owns context preparation and compaction, not Cindy's legacy 90%-window precheck or a Host-side summary/rebuild implementation.
+
+Missing capacity metadata is not a Host-side veto. Native DSH refusals still propagate (an unavailable route is reported as `NOT_AVAILABLE`), and no switch capability is advertised when the native selection API is absent. This is not a guarantee that every model request will succeed or that compaction is lossless. Re-selecting the original model does not undo any compaction already performed by DSH.
+
+## Native DSH session archive
+
+Controller archive/restore metadata now calls the same durable `workspaceRegistry.archiveSession` / `unarchiveSession` operations as DSH itself. Lists, exact reads and activity badges fold the native archive set; committed desktop changes invalidate controller lists and publish row patches. Archiving drops the pin without deleting history or changing workspace membership.
+
+The existing archive gesture does not request `stopActivity`, so DSH refuses sessions with running work; stop the work explicitly before archiving. Missing native archive services and storage failures are not downgraded to local-only success. Old controller-only archive flags remain visible until an explicit archive/restore retires that session's flag; upgrades do not bulk-archive native sessions. Delete remains a controller-only hide, and pin timestamps remain Host metadata.
+
 ## Previous release and rollback
 
 0.1.26 added editable, locally persistent Host names and desktop-safe plain-text queue content. Reinstalling 0.1.26 is possible, but pause input first and preserve the 0.1.27 ledger: downgrading disables durable-input recovery until 0.1.27 is restored.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-cindy-host",
-  "version": "0.1.30",
+  "version": "0.1.32",
   "private": false,
   "description": "Cindy 手机客户端连接 DSH 的 Host 侧插件：会话/消息/审批/todo/goal 的手机通道，以及配套的设置卡片",
   "license": "MIT",
@@ -61,19 +61,16 @@
     "test:file-peer": "node --test test/file-peer-rtc.test.js test/host-file-peer.test.js test/host-file-ice.test.js test/host-media-fetch.test.js test/file-peer-integration.test.js",
     "smoke:file-peer": "node tools/file-peer-rtc-smoke.mjs --manager"
   },
-  "//dependencies": "只放宿主不提供的库。DSH 自己的包一律不进 dependencies —— 见下面 peerDependencies 的说明。`keytar` 放 optionalDependencies：它是**原生**模块，没有 C++ 工具链的机器上必然编译失败，而 pnpm 会把普通 dependency 的构建失败当成安装失败（exit 1）—— DSH 随后就不会把这个 bundle 写进 `dsh.profile.bundles`，行也就永远不会出现。可选依赖的构建失败是允许的，与我们本来就有的惰性 require + 降级（凭据能力不可用，插件照常 mount）语义一致。",
+  "//dependencies": "只放宿主不提供的库。凭据存储不依赖原生 npm 模块：Linux/macOS 使用系统钥匙串，Windows 使用系统 DPAPI 加密并由 DSH 原生凭据服务持久化密文。",
   "dependencies": {
     "werift": "0.24.4",
     "ws": "^8.21.3"
   },
-  "optionalDependencies": {
-    "keytar": "^7.9.0"
-  },
   "//peerDependencies": "DSH 自己的包必须由宿主提供，绝不能声明成 dependency/optionalDependency：pnpm 会把它们**连同整代依赖图**装进 profile，宿主再组合这个混合体就起不来（实测：`^0.1.1-rc.2` 会把 28 个 0.1.1-rc.2 的包装进一个 0.1.5-rc.2 的宿主，profile 启动失败于 dsh-client-file-upload / dsh-session）。区间必须覆盖宿主那一代（semver 的预发布规则：`^0.1.1-rc.2` 匹配不到 `0.1.5-rc.2`），与生态里 dsh-codex / dsh-cost-meter 的写法一致；`0.2.0-rc.2` 需要 `>=0.2.0-rc.1 <0.3.0-0`。",
   "peerDependencies": {
-    "@deepseek-ai/dsh-session": "0.2.1-rc.3",
-    "@deepseek-ai/dsh-settings": "0.2.1-rc.3",
-    "@deepseek-ai/schemastery": "^3.18.1"
+    "@deepseek-ai/dsh-session": "0.2.1-rc.3 || 0.2.1-rc.4 || 0.2.1-rc.5 || 0.2.2-alpha.2",
+    "@deepseek-ai/dsh-settings": "0.2.1-rc.3 || 0.2.1-rc.4 || 0.2.1-rc.5 || 0.2.2-alpha.2",
+    "@deepseek-ai/schemastery": "^3.18.1 || 3.18.6-alpha.1"
   },
   "//peerDependenciesMeta": "**故意没有这个字段。** `@deepseek-ai/dsh-host-apiproxy` 曾经在这里标 optional，但 0.2 已经删掉了这个包，而 `evaluatePluginCompatibility` 会遍历 `peerDependencies` 的**每一个键且不查 `peerDependenciesMeta`**，所以只要它出现在 peers 里，`dsh plugin add` 就会直接拒绝安装（`installation rejected`），启动时 bundle 也会被静默跳过、`dsh-cindy-host` 行根本不会出现。该适配器本来就走惰性 `require` + 失败降级（见 src/dsh-plugin.js 的 apiProxy 分支），从 peers 里移除不改变任何运行时行为，只是让两道门禁都能正确判定。",
   "devDependencies": {

package/src/auth-session.js

@@ -92,14 +92,14 @@ export async function refreshOwnedCredential(captured, ports = {}) {
  */
 export async function restoreSession(ports = {}) {
   const load = ports.loadSession ?? loadSession;
-  // A missing native dependency says nothing about whether the OS holds a login.
-  // Injected stores do not depend on this machine's keytar unless they opt in.
+  // An unavailable backend says nothing about whether a stored login exists.
+  // Injected stores own their availability check.
   const available = ports.credentialStoreAvailable ?? (load === loadSession ? credentialStoreAvailable : undefined);
   if (available && !available()) {
     return {
       ok: false,
       reason: 'CREDENTIAL_STORE_UNAVAILABLE',
-      message: '本机 Cindy 凭据存储不可用，无法读取已有登录态。请修复当前 DSH 配置中的 keytar 原生模块（允许安装构建脚本或重新构建），然后重启 DSH；请勿因此清除登录态或重复登录。',
+      message: '本机 Cindy 凭据存储不可用。Linux 请检查 secret-tool 和已解锁的 Secret Service；macOS 请检查钥匙串授权；Windows 请检查系统 PowerShell 和 DSH 原生凭据服务，然后重启 DSH。请勿因此清除已有登录态。',
     };
   }
   const save = ports.saveSession ?? saveSession;
@@ -181,6 +181,7 @@ export async function forgetSession(ports = {}) {
 export async function getAuthenticatedSession() {
   const restored = await restoreSession();
   if (restored.ok) return restored.session;
+  if (restored.reason === 'CREDENTIAL_STORE_UNAVAILABLE') throw Object.assign(new Error(restored.message), { code: restored.reason });
   const session = await loginWithPhone({ clientType: 'desktop' });
   await adoptSession(session);
   return session;

package/src/cindy-channels.js

@@ -530,7 +530,7 @@ export function createChannelRouter({
     return row;
   }
 
-  return async function handleInvoke(request) {
+  const handleInvoke = async function handleInvoke(request) {
     // A reply is addressed by `id` + `src`; without both there is nothing the
     // relay could route, so this answers nothing rather than fabricating a frame.
     if (request === null || typeof request !== 'object') return null;
@@ -754,8 +754,13 @@ export function createChannelRouter({
       // The catalog is a live read, not a constant: it is what the picker lists,
       // and answering from a frozen copy would keep offering models that this
       // Host can no longer route to.
-      const readCatalog = capabilitiesNow().modelCatalog;
-      if (typeof readCatalog !== 'function') return invokeResult(request, DSH_AGENT_CAPABILITIES);
+      const composed = capabilitiesNow();
+      // DSH, not the controller's legacy Pi/90%-window heuristic, owns whether
+      // a model may be selected. Advertise only when that native path is composed.
+      const nativeModelSelection = typeof composed.selectModel === 'function';
+      const fallback = { ...DSH_AGENT_CAPABILITIES, supportsModelWindowSwitchGuard: nativeModelSelection };
+      const readCatalog = composed.modelCatalog;
+      if (typeof readCatalog !== 'function') return invokeResult(request, fallback);
       let catalog;
       try {
         catalog = await readCatalog();
@@ -764,13 +769,13 @@ export function createChannelRouter({
         agentCatalog = null;
         catalogDefaultModel = null;
         invalidateSessionRows();
-        return invokeResult(request, DSH_AGENT_CAPABILITIES);
+        return invokeResult(request, fallback);
       }
       agentCatalog = catalog;
       const defaultModel = catalog?.default?.model;
       catalogDefaultModel = typeof defaultModel === 'string' && defaultModel !== '' ? defaultModel : null;
       invalidateSessionRows();
-      const capabilities = toAgentCapabilities(catalog);
+      const capabilities = toAgentCapabilities(catalog, { nativeModelSelection });
       // These two fields are what make the controls appear at all: the controller
       // draws the permission picker only when presets are advertised, and the
       // plan-mode switch only when support is — and DSH documents a missing
@@ -1055,9 +1060,9 @@ export function createChannelRouter({
       // therefore not a refusal — it is an instruction to revert the user's edit,
       // which is how these three actions used to look like dead buttons.
       //
-      // Only the title has a DSH counterpart; the other three are this Host's own
-      // bookkeeping (`session-flags.js`), so the reply is built from the source row
-      // with the flags folded back on — the same fold every read path uses.
+      // The runtime delegates archive/restore to native DSH and keeps delete/pin
+      // compatibility metadata. The reply uses that same effective projection
+      // as every list/get read, never just the requested status.
       const capabilities = capabilitiesNow();
       const rename = capabilities.renameSession;
       let wrote = false;
@@ -1071,7 +1076,13 @@ export function createChannelRouter({
       if (writesMeta) {
         const applyFlags = capabilities.applySessionFlags;
         if (typeof applyFlags !== 'function') return invokeError(request, 'NOT_AVAILABLE', 'This DSH Host cannot archive, delete or pin sessions');
-        const applied = await applyFlags(sessionId, { status: patch.status, pinnedAt: patch.pinnedAt });
+        let applied;
+        try {
+          applied = await applyFlags(sessionId, { status: patch.status, pinnedAt: patch.pinnedAt });
+        } catch (error) {
+          if (error?.refusalCode !== undefined) return invokeError(request, refusalCodeOf(error), String(error.message));
+          throw error;
+        }
         wrote = true;
         // Echo only what was written, with this Host's effective value: that is the
         // same patch the controller applied optimistically, so other devices converge
@@ -1771,4 +1782,6 @@ export function createChannelRouter({
     // Fail closed and say so. The controller degrades on CHANNEL_NOT_ALLOWED.
     return invokeError(request);
   };
+  handleInvoke.invalidateSessionRows = invalidateSessionRows;
+  return handleInvoke;
 }

package/src/cindy-session-row.js

@@ -81,10 +81,9 @@ export function toCindySessionListRow(item, { now = () => new Date(), device, de
     // `'active' | 'archived' | 'deleted'`; the controller's default status filter
     // is `'active'`, so this field decides whether a row is visible at all.
     //
-    // DSH has no archived or deleted state, so the value can only come from this
-    // Host's own flags (`session-flags.js`), folded onto the source row before it
-    // reaches here. A row that carries none is active, which is what every row was
-    // before the flags existed.
+    // Native DSH archives and legacy controller metadata are folded together
+    // before reaching this wire adapter. A row with no status is active; delete
+    // remains a Host-only hide and never destroys DSH history.
     status: item.status === 'archived' || item.status === 'deleted' ? item.status : 'active',
     agentKind: agentKindForModel({ model: item.model ?? defaultModel, provider: item.providerId, catalog }),
     // The controller looks the current model up by id in the catalog it fetched
@@ -134,11 +133,11 @@ export function toCindySessionListRow(item, { now = () => new Date(), device, de
     // moment the user selects this Host — which is the only way to see it.
     deviceLinkDeviceId: device?.deviceId ?? null,
     deviceLinkDeviceName: device?.deviceName ?? null,
-    // Present only when a controller pinned this session here (the flag store's
-    // doing, not DSH's). The controller reads a missing field as "not pinned" — and
-    // on a write reply it reads a missing field as "keep what I have", which is
-    // exactly how an unpin stays applied without this row asserting `null`.
-    ...(typeof item.pinnedAt === 'string' && item.pinnedAt !== '' ? { pinnedAt: item.pinnedAt } : {}),
+    // Preserve a known unpin (including native archival). A missing field is
+    // 'keep what I have' on a write reply, so dropping explicit null can retain
+    // the controller's old pin even though DSH has archived the session.
+    ...(item.pinnedAt === null ? { pinnedAt: null }
+      : typeof item.pinnedAt === 'string' && item.pinnedAt !== '' ? { pinnedAt: item.pinnedAt } : {}),
   };
 }
 

package/src/credential-command.js

@@ -0,0 +1,59 @@
+import { spawn } from 'node:child_process';
+
+export class CredentialStoreUnavailableError extends Error {
+  constructor(message = '本机凭据存储不可用。Linux 请检查 secret-tool 和已解锁的 Secret Service；macOS 请检查钥匙串授权；Windows 请检查系统 PowerShell 和 DSH 原生凭据服务。') {
+    super(message);
+    this.name = 'CredentialStoreUnavailableError';
+    this.code = 'CREDENTIAL_STORE_UNAVAILABLE';
+  }
+}
+
+/** No shell, no secret argv, bounded time/output, and never expose child diagnostics. */
+export function runCredentialCommand(file, args, input = '', { timeoutMs = 15_000, maxBytes = 1024 * 1024 } = {}) {
+  return new Promise((resolve, reject) => {
+    let child;
+    try { child = spawn(file, args, { shell: false, windowsHide: true, stdio: ['pipe', 'pipe', 'pipe'] }); }
+    catch { reject(new CredentialStoreUnavailableError()); return; }
+    let done = false;
+    let bytes = 0;
+    const stdout = [];
+    const stderr = [];
+    const fail = () => {
+      if (done) return;
+      done = true;
+      clearTimeout(timer);
+      child.kill();
+      reject(new CredentialStoreUnavailableError());
+    };
+    const timer = setTimeout(fail, timeoutMs);
+    child.on('error', fail);
+    child.stdin.on('error', fail);
+    for (const [stream, chunks] of [[child.stdout, stdout], [child.stderr, stderr]]) {
+      stream.on('error', fail);
+      stream.on('data', chunk => {
+        bytes += chunk.length;
+        if (bytes > maxBytes) { fail(); return; }
+        chunks.push(chunk);
+      });
+    }
+    child.on('close', code => {
+      if (done) return;
+      done = true;
+      clearTimeout(timer);
+      resolve({ code, stdout: Buffer.concat(stdout).toString('utf8'), stderr: Buffer.concat(stderr).toString('utf8') });
+    });
+    child.stdin.end(input);
+  });
+}
+
+// System .NET assembly, not C# compilation. All data (including entropy) travels on stdin.
+export const DPAPI_SCRIPT = [
+  "$ErrorActionPreference = 'Stop'",
+  'Add-Type -AssemblyName System.Security',
+  '$r = [Console]::In.ReadToEnd() | ConvertFrom-Json',
+  '$data = [Convert]::FromBase64String($r.data)',
+  '$entropy = [Convert]::FromBase64String($r.entropy)',
+  "$scope = [System.Security.Cryptography.DataProtectionScope]::CurrentUser",
+  "if ($r.operation -eq 'protect') { $result = [System.Security.Cryptography.ProtectedData]::Protect($data, $entropy, $scope) } elseif ($r.operation -eq 'unprotect') { $result = [System.Security.Cryptography.ProtectedData]::Unprotect($data, $entropy, $scope) } else { throw 'Invalid operation' }",
+  '[Console]::Out.Write([Convert]::ToBase64String($result))',
+].join('; ');

package/src/credential-store.js

@@ -1,55 +1,12 @@
-import { createRequire } from 'node:module';
 import { createHash } from 'node:crypto';
 import { homedir } from 'node:os';
-import { resolve as resolvePath } from 'node:path';
+import { resolve as resolvePath, win32 } from 'node:path';
+import { runCredentialCommand, DPAPI_SCRIPT, CredentialStoreUnavailableError } from './credential-command.js';
+export { CredentialStoreUnavailableError } from './credential-command.js';
 
 const SERVICE = 'DSH Cindy Host';
+const FORMAT = 'dpapi-current-user-v1';
 
-/**
- * `keytar` is a **native** module, so it is loaded lazily and its absence is not fatal.
- *
- * Measured on a clean install (a packed tarball into a fresh `DSH_HOME`): pnpm 10 does not run
- * dependency build scripts by default, so `keytar.node` was never built, and a top-level import
- * here made the whole plugin fail to load — the profile would not boot over a *credential store*
- * it may never need. An optional capability must not be able to break mounting, so the module is
- * required the moment it is used and a failure degrades to "no credential store": a read answers
- * "no stored session" (the card asks for a login), and a write throws a named error instead of
- * pretending to have saved.
- *
- * @returns the keytar module, or null when it cannot be loaded on this machine.
- */
-let keytarModule;
-function keytar() {
-  if (keytarModule === undefined) {
-    try {
-      keytarModule = createRequire(import.meta.url)('keytar');
-    } catch {
-      keytarModule = null;
-    }
-  }
-  return keytarModule;
-}
-
-/** Whether a credential store is usable here, for callers that want to say so. */
-export function credentialStoreAvailable() {
-  return keytar() !== null;
-}
-
-/** The error a write raises when this machine has no usable credential store. */
-export class CredentialStoreUnavailableError extends Error {
-  constructor() {
-    super('this machine has no usable credential store (keytar is not built; on pnpm 10 approve the keytar build script)');
-    this.code = 'CREDENTIAL_STORE_UNAVAILABLE';
-  }
-}
-
-/**
- * The credential-store entry the default installation has always used.
- *
- * The OS keeps these per (service, account), and the account is what separates two DSH
- * installations on one machine — not a folder, because there is no folder: one machine,
- * one credential store.
- */
 export const DEFAULT_ACCOUNT = 'session-v1';
 
 /** DSH's own default home: `~/.dsh` (the same precedence `dsh-home-paths` documents). */
@@ -92,7 +49,7 @@ function sameHome(left, right) {
  *
  * @param env - environment to read (injectable for tests).
  * @param defaultHome - the home treated as the default installation.
- * @returns the keytar account name for this process.
+ * @returns the OS credential account name for this process.
  */
 export function credentialAccount(env = process.env, defaultHome = defaultDshHome()) {
   const home = typeof env?.DSH_HOME === 'string' ? env.DSH_HOME.trim() : '';
@@ -103,26 +60,122 @@ export function credentialAccount(env = process.env, defaultHome = defaultDshHom
   return `${DEFAULT_ACCOUNT}@${digest}`;
 }
 
-export async function loadSession(ports = {}) {
-  const account = ports.account ?? credentialAccount();
-  const store = keytar();
-  if (store === null) return null; // no store here: "no stored session", never a crash
-  const value = await store.getPassword(SERVICE, account);
-  return value ? JSON.parse(value) : null;
+
+function parseSession(text) {
+  const value = JSON.parse(text);
+  if (!value || typeof value !== 'object' || Array.isArray(value)
+    || !['deviceId', 'authBaseUrl', 'accessToken', 'refreshToken'].every(key => typeof value[key] === 'string' && value[key].length > 0)) {
+    throw new CredentialStoreUnavailableError();
+  }
+  return value;
 }
 
-export async function saveSession(session, ports = {}) {
-  const account = ports.account ?? credentialAccount();
-  const store = keytar();
-  if (store === null) throw new CredentialStoreUnavailableError();
-  await store.setPassword(SERVICE, account, JSON.stringify(session));
+function base64(value) {
+  if (typeof value !== 'string' || !value || value.length % 4 !== 0 || !/^[A-Za-z0-9+/]+={0,2}$/.test(value)) throw new CredentialStoreUnavailableError();
+  return value;
 }
 
-export async function clearSession(ports = {}) {
-  const account = ports.account ?? credentialAccount();
-  const store = keytar();
-  // Clearing what does not exist is the outcome the caller wanted, so a missing store is not an
-  // error here — unlike a save, which must not report success it cannot deliver.
-  if (store === null) return;
-  await store.deletePassword(SERVICE, account);
+// security's interactive command parser accepts quoted arguments. Secrets stay off argv.
+const securityQuote = value => '"' + value.replace(/\\/g, '\\\\').replace(/"/g, '\\"') + '"';
+
+/** One installation's store. No process-global registration and no native npm modules.
+ * Linux/macOS keep the historical service/account, so existing keychain records remain readable.
+ * Windows stores ONLY DPAPI ciphertext in DSH's native record service, never in settings.
+ */
+export function createCredentialStore({ platform = process.platform, env = process.env, account = credentialAccount(env),
+  getCredentials = () => undefined, run = runCredentialCommand } = {}) {
+  if (!/^session-v1(?:@[0-9a-f]{12})?$/.test(account)) throw new TypeError('Invalid credential account');
+  const recordKey = 'dsh-cindy-host/' + account.replace('@', '-home-');
+  const attributes = ['service', SERVICE, 'account', account];
+  function provider() {
+    const value = getCredentials();
+    if (!value || !['readRecord', 'modifyRecord', 'deleteRecord'].every(key => typeof value[key] === 'function')) throw new CredentialStoreUnavailableError();
+    return value;
+  }
+  async function command(file, args, input = '') {
+    return run(file, args, input);
+  }
+  async function dpapi(operation, data) {
+    if (!env.SystemRoot) throw new CredentialStoreUnavailableError();
+    const file = win32.join(env.SystemRoot, 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe');
+    const result = await command(file, ['-NoLogo', '-NoProfile', '-NonInteractive', '-Command', DPAPI_SCRIPT], JSON.stringify({
+      operation, data, entropy: Buffer.from(SERVICE + '/' + account).toString('base64'),
+    }));
+    if (result.code !== 0) throw new CredentialStoreUnavailableError();
+    return base64(result.stdout.trim());
+  }
+  async function read() {
+    if (platform === 'win32') {
+      const record = await provider().readRecord(recordKey);
+      if (record === undefined) return null;
+      if (record?.kind !== 'grant' || record.payload?.format !== FORMAT) throw new CredentialStoreUnavailableError();
+      const clear = await dpapi('unprotect', base64(record.payload.ciphertext));
+      return parseSession(Buffer.from(clear, 'base64').toString('utf8'));
+    }
+    if (platform === 'linux') {
+      const result = await command('secret-tool', ['lookup', ...attributes]);
+      if (result.code === 1 && !result.stdout && !result.stderr.trim()) return null;
+      if (result.code !== 0) throw new CredentialStoreUnavailableError();
+      return parseSession(result.stdout.trimEnd());
+    }
+    if (platform === 'darwin') {
+      const result = await command('/usr/bin/security', ['find-generic-password', '-s', SERVICE, '-a', account, '-w']);
+      if (result.code === 44) return null; // errSecItemNotFound, not a locked/denied keychain
+      if (result.code !== 0) throw new CredentialStoreUnavailableError();
+      return parseSession(result.stdout.trimEnd());
+    }
+    throw new CredentialStoreUnavailableError();
+  }
+  async function write(session) {
+    const text = JSON.stringify(session);
+    parseSession(text);
+    if (Buffer.byteLength(text) > 512 * 1024) throw new CredentialStoreUnavailableError();
+    if (platform === 'win32') {
+      const credentials = provider();
+      const ciphertext = await dpapi('protect', Buffer.from(text).toString('base64'));
+      await credentials.modifyRecord(recordKey, () => ({ kind: 'grant', payload: { format: FORMAT, ciphertext } }));
+      return;
+    }
+    let result;
+    if (platform === 'linux') result = await command('secret-tool', ['store', '--label=' + SERVICE, ...attributes], text);
+    else if (platform === 'darwin') {
+      const args = ['add-generic-password', '-U', '-s', SERVICE, '-a', account, '-w', text];
+      result = await command('/usr/bin/security', ['-i'], args.map(securityQuote).join(' ') + '\n');
+      // security -i may exit zero after a failed subcommand. Its diagnostics must still fail closed.
+      if ([result.stdout, result.stderr].some(text => text.replace(/security>\s*/g, '').trim())) throw new CredentialStoreUnavailableError();
+    } else throw new CredentialStoreUnavailableError();
+    if (result.code !== 0) throw new CredentialStoreUnavailableError();
+  }
+  async function clear() {
+    if (platform === 'win32') { await provider().deleteRecord(recordKey); return; }
+    let result;
+    if (platform === 'linux') {
+      result = await command('secret-tool', ['clear', ...attributes]);
+      if (result.code === 1 && !result.stderr.trim()) return;
+    } else if (platform === 'darwin') {
+      result = await command('/usr/bin/security', ['delete-generic-password', '-s', SERVICE, '-a', account]);
+      if (result.code === 44) return;
+    } else throw new CredentialStoreUnavailableError();
+    if (result.code !== 0) throw new CredentialStoreUnavailableError();
+  }
+  // Neither child diagnostics nor JSON parse errors may carry credentials into logs/UI.
+  const guarded = action => async (...args) => {
+    try { return await action(...args); }
+    catch { throw new CredentialStoreUnavailableError(); }
+  };
+  return {
+    loadSession: guarded(read), saveSession: guarded(write), clearSession: guarded(clear),
+    credentialStoreAvailable: () => {
+      if (platform === 'linux' || platform === 'darwin') return true;
+      if (platform !== 'win32' || !env.SystemRoot) return false;
+      try { provider(); return true; } catch { return false; }
+    },
+  };
 }
+
+// Standalone Linux/macOS CLIs use the same system keychain. Windows needs a DSH
+// credential service; without a host context fail explicitly, never write plaintext.
+export const loadSession = (ports = {}) => createCredentialStore(ports).loadSession();
+export const saveSession = (session, ports = {}) => createCredentialStore(ports).saveSession(session);
+export const clearSession = (ports = {}) => createCredentialStore(ports).clearSession();
+export const credentialStoreAvailable = (ports = {}) => createCredentialStore(ports).credentialStoreAvailable();