dsh-cindy-host 0.1.31 → 0.1.32

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 0.1.32 — 2026-11-03
+
+- Remove keytar and its native npm build chain. Linux/macOS keep system credential vaults through secret-tool/security; Windows encrypts with built-in DPAPI CurrentUser and persists ciphertext through the native DSH credential record service. Login, renewal and logout share one installation-scoped store; failures never fall back to plaintext or pretend a stored login is absent. Windows upgrades may require one explicit login; legacy vault entries are left untouched.
+
+- Add exact DSH `0.2.2-alpha.2` session/settings peers and its Schemastery `3.18.6-alpha.1` peer, retaining the existing rc.3/rc.4/rc.5 carriers. Alpha's own Node.js >=24.9 requirement still applies.
+- Replace removed `standingKeyFor` draft discovery with the current preset revision lease (`acquireScope`), released after successful or failed reads; prefer isolated live-Agent skill services and retain older-carrier fallback.
+- Add lease-lifecycle regressions and a reproducible isolated-alpha core-contract smoke covering real compatibility admission, Loader activation, Session message/input identity and preset skill visibility. Controller/settings/archive method checks are structural only; alpha Web, persistent settings, relay and handset acceptance remain separate gates. The core-contract smoke does not modify or reload a production profile.
+
+- Connect archive/restore metadata to native DSH workspace-registry durability, with native activity checks, cross-device committed archive updates, list-cache invalidation, and explicit unpin acknowledgements. Preserve legacy controller archive flags until an explicit operation retires them; deletion remains non-destructive and Host-local.
+
+- Delegate remote model switching to native DSH when its selection API is composed. The Host now advertises model-window authority so Cindy does not reject DSH selections with its legacy Pi/unknown-capacity precheck. Running-turn selections and selecting the original model again use the same DSH next-request API; no Cindy or DSH core patch is required.
+- Keep missing native selection unavailable and preserve native refusal propagation. Regression coverage includes capability/catalog degradation, all three client aliases, switching back, and the unmodified Cindy consumer guard.
+
 ## 0.1.31 — 2026-10-31
 
 - Merge `main` into the DSH 0.2.1 carrier. `main` was a single working-tree snapshot that had diverged since the 0.2.1 peers landed; every conflict was resolved by keeping the newer, functionally wider side and re-taking `main`'s unique fixes rather than picking a whole file.

package/README.md

@@ -4,14 +4,57 @@ A Host-side adapter connecting current Cindy clients to DeepSeek Harness.
 
 ## Requirements and installation
 
-Version 0.1.31 targets the verified **DSH 0.2.1-rc.5** service contracts (also accepting `0.2.1-rc.3` and `0.2.1-rc.4`), with **Node.js >=22.16**. Its DSH peer versions are pinned to those carrier versions to prevent an installer from mixing a newer prerelease SDK into the running host. The verified Desktop runtime includes Node.js 24.21. Install through the Desktop DSH plugin manager. CLI-managed profiles can use:
+Version **0.1.32** additionally supports **DSH 0.2.2-alpha.2**, while retaining `0.2.1-rc.3`, `0.2.1-rc.4` and `0.2.1-rc.5`. Alpha requires **Node.js >=24.9** (tested with 24.12); the older carriers retain this plugin's Node.js >=22.16 minimum. Session/settings peers and alpha Schemastery are explicitly allowed, not a blanket promise for future prereleases. Install through the Desktop DSH plugin manager. CLI-managed profiles can use:
 
 ```sh
-dsh plugin --profile <profile> add dsh-cindy-host@0.1.31
+dsh plugin --profile <profile> add dsh-cindy-host@0.1.32
 ```
 
 Reload the Host plugin after installation. A full DSH restart is separate. Keep existing Cindy sign-in, device identity and settings; do not run two Host processes with the same identity.
 
+## 0.1.32: credentials without keytar
+
+No native npm credential module or C++ build toolchain is required. Linux uses `secret-tool` with an unlocked Secret Service (headless sessions need their own DBus/keyring setup); macOS uses the system Keychain through `/usr/bin/security`. Both keep the existing `DSH Cindy Host` service and installation-specific account.
+
+Windows uses built-in Windows PowerShell/.NET DPAPI (CurrentUser), then stores **only encrypted ciphertext** in DSH’s native `credentials` record service. DSH owns the private file, atomic writes and record removal; tokens never enter settings, child-process arguments or logs. No Cindy/Electron integration is required. DSH without the record API, blocked PowerShell, a locked keychain, missing `secret-tool`, or damaged ciphertext produces a storage error, not a missing login or a plaintext fallback.
+
+Windows users upgrading from keytar may need to sign in once through the **DSH settings card**. Old Windows Credential Manager entries are not automatically read or deleted; rollback can still see them, and users can remove them manually after confirming the new login. Windows standalone `npm run login/logout/host` has no DSH credential context: use the settings card instead. Linux/macOS standalone commands keep using the same system keychain. Different DSH homes remain isolated. DPAPI ciphertext is not a portable backup: another OS user/machine generally cannot decrypt it.
+
+Native Windows persistence smoke (fake credentials and an isolated temporary DSH document only):
+
+```sh
+node tools/credential-store-native-smoke.mjs --runtime <DSH-runtime-root>
+```
+
+The runtime root must contain compiled DSH SDK packages under node_modules. This checks real DPAPI encryption, native DSH atomic persistence, fresh-context restore, renewal and logout without accessing a daily profile. Linux/macOS command adapters have mock-contract tests; live keychain acceptance must run on those operating systems.
+
+## 0.1.32: DSH 0.2.2-alpha.2 compatibility
+
+- Accept the exact alpha session/settings carrier and `@deepseek-ai/schemastery@3.18.6-alpha.1` without installing another DSH runtime as a dependency.
+- Draft skill discovery uses `agentPresets.acquireScope()` and releases the revision after success or failure. Live Agents prefer their isolated preset skill service; older standing-key carriers retain their fallback.
+- Isolated alpha core-contract smoke exercises the real compatibility evaluator, Cordis Loader, Session message folding, and preset-scoped skill discovery. It also checks controller/settings/archive method presence. This is **not** full Web/profile-persistence/relay/handset acceptance; those remain unverified on alpha. No daily profile is modified or restarted.
+
+Reproduce without installing into a DSH profile:
+
+```sh
+npm install --prefix <isolated-npm-project> --ignore-scripts \
+  @deepseek-ai/dsh-sdk-minimal@0.2.2-alpha.2 \
+  @deepseek-ai/dsh-api-session-controller@0.2.2-alpha.2 \
+  @deepseek-ai/dsh-settings@0.2.2-alpha.2 \
+  @deepseek-ai/dsh-agent-preset-registry@0.2.2-alpha.2 \
+  @deepseek-ai/dsh-skill@0.2.2-alpha.2 \
+  @deepseek-ai/dsh-workspace@0.2.2-alpha.2 \
+  @deepseek-ai/dsh-home-paths@0.2.2-alpha.2 ws@8.21.3 werift@0.24.4
+```
+
+Unpack `npm pack` output beneath that npm project's directory, so its imports use the alpha peers, then run (the smoke asserts that resolution):
+
+```sh
+node tools/dsh-compat-smoke.mjs --runtime <isolated-npm-project> --plugin <unpacked-package>
+```
+
+For a full alpha-dependency regression, additionally copy the repository's test-only `test`, `tools`, `fixtures` directories and the root lockfile into that unpacked package and run `node --test` from it. These fixtures are intentionally not distributed in the npm tarball.
+
 ## 0.1.31: merged `main`, native rootless media fetch
 
 Absorbs the `main` branch on top of the 0.2.1 carrier. The one behavioral change that came from it: media and file-peer fetch now accept Cindy's **native URL shape**, where a project-folder export sends only `path` plus an optional `v` and no directory roots. Directory containment is therefore enforced only when the controller actually names roots; the never-serve denylist, the regular-file check, the 25 MiB cap and the separate authenticated-controller policy are unchanged. Also carried over: the native-contract fixture matrix (15 extensions × POSIX/Windows), the repository/docs snapshot, and a test that pins the rootless file-peer transfer end to end.
@@ -36,6 +79,18 @@ The ledger lives under the active DSH profile state directory. Pending payloads
 
 All changes are Host-only: no Cindy or DSH core patch is required. The handshake compatibility stamp is separate from the actual plugin version and explicit v1 capability. Unsupported optional features are refused; this is not a promise of all native Cindy features or exactly-once external tool effects.
 
+## Model switching follows DSH
+
+When native `sessionController.selectModel` is composed, the Host tells Cindy to delegate model-window decisions to DSH. Users may select another model during a running turn and select the original model again. DSH validates the provider/model/effort and records the selection for the **next model request**; an already-issued request is not interrupted. DSH owns context preparation and compaction, not Cindy's legacy 90%-window precheck or a Host-side summary/rebuild implementation.
+
+Missing capacity metadata is not a Host-side veto. Native DSH refusals still propagate (an unavailable route is reported as `NOT_AVAILABLE`), and no switch capability is advertised when the native selection API is absent. This is not a guarantee that every model request will succeed or that compaction is lossless. Re-selecting the original model does not undo any compaction already performed by DSH.
+
+## Native DSH session archive
+
+Controller archive/restore metadata now calls the same durable `workspaceRegistry.archiveSession` / `unarchiveSession` operations as DSH itself. Lists, exact reads and activity badges fold the native archive set; committed desktop changes invalidate controller lists and publish row patches. Archiving drops the pin without deleting history or changing workspace membership.
+
+The existing archive gesture does not request `stopActivity`, so DSH refuses sessions with running work; stop the work explicitly before archiving. Missing native archive services and storage failures are not downgraded to local-only success. Old controller-only archive flags remain visible until an explicit archive/restore retires that session's flag; upgrades do not bulk-archive native sessions. Delete remains a controller-only hide, and pin timestamps remain Host metadata.
+
 ## Previous release and rollback
 
 0.1.26 added editable, locally persistent Host names and desktop-safe plain-text queue content. Reinstalling 0.1.26 is possible, but pause input first and preserve the 0.1.27 ledger: downgrading disables durable-input recovery until 0.1.27 is restored.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-cindy-host",
-  "version": "0.1.31",
+  "version": "0.1.32",
   "private": false,
   "description": "Cindy 手机客户端连接 DSH 的 Host 侧插件：会话/消息/审批/todo/goal 的手机通道，以及配套的设置卡片",
   "license": "MIT",
@@ -61,19 +61,16 @@
     "test:file-peer": "node --test test/file-peer-rtc.test.js test/host-file-peer.test.js test/host-file-ice.test.js test/host-media-fetch.test.js test/file-peer-integration.test.js",
     "smoke:file-peer": "node tools/file-peer-rtc-smoke.mjs --manager"
   },
-  "//dependencies": "只放宿主不提供的库。DSH 自己的包一律不进 dependencies —— 见下面 peerDependencies 的说明。`keytar` 放 optionalDependencies：它是**原生**模块，没有 C++ 工具链的机器上必然编译失败，而 pnpm 会把普通 dependency 的构建失败当成安装失败（exit 1）—— DSH 随后就不会把这个 bundle 写进 `dsh.profile.bundles`，行也就永远不会出现。可选依赖的构建失败是允许的，与我们本来就有的惰性 require + 降级（凭据能力不可用，插件照常 mount）语义一致。",
+  "//dependencies": "只放宿主不提供的库。凭据存储不依赖原生 npm 模块：Linux/macOS 使用系统钥匙串，Windows 使用系统 DPAPI 加密并由 DSH 原生凭据服务持久化密文。",
   "dependencies": {
     "werift": "0.24.4",
     "ws": "^8.21.3"
   },
-  "optionalDependencies": {
-    "keytar": "^7.9.0"
-  },
   "//peerDependencies": "DSH 自己的包必须由宿主提供，绝不能声明成 dependency/optionalDependency：pnpm 会把它们**连同整代依赖图**装进 profile，宿主再组合这个混合体就起不来（实测：`^0.1.1-rc.2` 会把 28 个 0.1.1-rc.2 的包装进一个 0.1.5-rc.2 的宿主，profile 启动失败于 dsh-client-file-upload / dsh-session）。区间必须覆盖宿主那一代（semver 的预发布规则：`^0.1.1-rc.2` 匹配不到 `0.1.5-rc.2`），与生态里 dsh-codex / dsh-cost-meter 的写法一致；`0.2.0-rc.2` 需要 `>=0.2.0-rc.1 <0.3.0-0`。",
   "peerDependencies": {
-    "@deepseek-ai/dsh-session": "0.2.1-rc.3 || 0.2.1-rc.4 || 0.2.1-rc.5",
-    "@deepseek-ai/dsh-settings": "0.2.1-rc.3 || 0.2.1-rc.4 || 0.2.1-rc.5",
-    "@deepseek-ai/schemastery": "^3.18.1"
+    "@deepseek-ai/dsh-session": "0.2.1-rc.3 || 0.2.1-rc.4 || 0.2.1-rc.5 || 0.2.2-alpha.2",
+    "@deepseek-ai/dsh-settings": "0.2.1-rc.3 || 0.2.1-rc.4 || 0.2.1-rc.5 || 0.2.2-alpha.2",
+    "@deepseek-ai/schemastery": "^3.18.1 || 3.18.6-alpha.1"
   },
   "//peerDependenciesMeta": "**故意没有这个字段。** `@deepseek-ai/dsh-host-apiproxy` 曾经在这里标 optional，但 0.2 已经删掉了这个包，而 `evaluatePluginCompatibility` 会遍历 `peerDependencies` 的**每一个键且不查 `peerDependenciesMeta`**，所以只要它出现在 peers 里，`dsh plugin add` 就会直接拒绝安装（`installation rejected`），启动时 bundle 也会被静默跳过、`dsh-cindy-host` 行根本不会出现。该适配器本来就走惰性 `require` + 失败降级（见 src/dsh-plugin.js 的 apiProxy 分支），从 peers 里移除不改变任何运行时行为，只是让两道门禁都能正确判定。",
   "devDependencies": {

package/src/auth-session.js

@@ -92,14 +92,14 @@ export async function refreshOwnedCredential(captured, ports = {}) {
  */
 export async function restoreSession(ports = {}) {
   const load = ports.loadSession ?? loadSession;
-  // A missing native dependency says nothing about whether the OS holds a login.
-  // Injected stores do not depend on this machine's keytar unless they opt in.
+  // An unavailable backend says nothing about whether a stored login exists.
+  // Injected stores own their availability check.
   const available = ports.credentialStoreAvailable ?? (load === loadSession ? credentialStoreAvailable : undefined);
   if (available && !available()) {
     return {
       ok: false,
       reason: 'CREDENTIAL_STORE_UNAVAILABLE',
-      message: '本机 Cindy 凭据存储不可用，无法读取已有登录态。请修复当前 DSH 配置中的 keytar 原生模块（允许安装构建脚本或重新构建），然后重启 DSH；请勿因此清除登录态或重复登录。',
+      message: '本机 Cindy 凭据存储不可用。Linux 请检查 secret-tool 和已解锁的 Secret Service；macOS 请检查钥匙串授权；Windows 请检查系统 PowerShell 和 DSH 原生凭据服务，然后重启 DSH。请勿因此清除已有登录态。',
     };
   }
   const save = ports.saveSession ?? saveSession;
@@ -181,6 +181,7 @@ export async function forgetSession(ports = {}) {
 export async function getAuthenticatedSession() {
   const restored = await restoreSession();
   if (restored.ok) return restored.session;
+  if (restored.reason === 'CREDENTIAL_STORE_UNAVAILABLE') throw Object.assign(new Error(restored.message), { code: restored.reason });
   const session = await loginWithPhone({ clientType: 'desktop' });
   await adoptSession(session);
   return session;

package/src/cindy-channels.js

@@ -530,7 +530,7 @@ export function createChannelRouter({
     return row;
   }
 
-  return async function handleInvoke(request) {
+  const handleInvoke = async function handleInvoke(request) {
     // A reply is addressed by `id` + `src`; without both there is nothing the
     // relay could route, so this answers nothing rather than fabricating a frame.
     if (request === null || typeof request !== 'object') return null;
@@ -754,8 +754,13 @@ export function createChannelRouter({
       // The catalog is a live read, not a constant: it is what the picker lists,
       // and answering from a frozen copy would keep offering models that this
       // Host can no longer route to.
-      const readCatalog = capabilitiesNow().modelCatalog;
-      if (typeof readCatalog !== 'function') return invokeResult(request, DSH_AGENT_CAPABILITIES);
+      const composed = capabilitiesNow();
+      // DSH, not the controller's legacy Pi/90%-window heuristic, owns whether
+      // a model may be selected. Advertise only when that native path is composed.
+      const nativeModelSelection = typeof composed.selectModel === 'function';
+      const fallback = { ...DSH_AGENT_CAPABILITIES, supportsModelWindowSwitchGuard: nativeModelSelection };
+      const readCatalog = composed.modelCatalog;
+      if (typeof readCatalog !== 'function') return invokeResult(request, fallback);
       let catalog;
       try {
         catalog = await readCatalog();
@@ -764,13 +769,13 @@ export function createChannelRouter({
         agentCatalog = null;
         catalogDefaultModel = null;
         invalidateSessionRows();
-        return invokeResult(request, DSH_AGENT_CAPABILITIES);
+        return invokeResult(request, fallback);
       }
       agentCatalog = catalog;
       const defaultModel = catalog?.default?.model;
       catalogDefaultModel = typeof defaultModel === 'string' && defaultModel !== '' ? defaultModel : null;
       invalidateSessionRows();
-      const capabilities = toAgentCapabilities(catalog);
+      const capabilities = toAgentCapabilities(catalog, { nativeModelSelection });
       // These two fields are what make the controls appear at all: the controller
       // draws the permission picker only when presets are advertised, and the
       // plan-mode switch only when support is — and DSH documents a missing
@@ -1055,9 +1060,9 @@ export function createChannelRouter({
       // therefore not a refusal — it is an instruction to revert the user's edit,
       // which is how these three actions used to look like dead buttons.
       //
-      // Only the title has a DSH counterpart; the other three are this Host's own
-      // bookkeeping (`session-flags.js`), so the reply is built from the source row
-      // with the flags folded back on — the same fold every read path uses.
+      // The runtime delegates archive/restore to native DSH and keeps delete/pin
+      // compatibility metadata. The reply uses that same effective projection
+      // as every list/get read, never just the requested status.
       const capabilities = capabilitiesNow();
       const rename = capabilities.renameSession;
       let wrote = false;
@@ -1071,7 +1076,13 @@ export function createChannelRouter({
       if (writesMeta) {
         const applyFlags = capabilities.applySessionFlags;
         if (typeof applyFlags !== 'function') return invokeError(request, 'NOT_AVAILABLE', 'This DSH Host cannot archive, delete or pin sessions');
-        const applied = await applyFlags(sessionId, { status: patch.status, pinnedAt: patch.pinnedAt });
+        let applied;
+        try {
+          applied = await applyFlags(sessionId, { status: patch.status, pinnedAt: patch.pinnedAt });
+        } catch (error) {
+          if (error?.refusalCode !== undefined) return invokeError(request, refusalCodeOf(error), String(error.message));
+          throw error;
+        }
         wrote = true;
         // Echo only what was written, with this Host's effective value: that is the
         // same patch the controller applied optimistically, so other devices converge
@@ -1771,4 +1782,6 @@ export function createChannelRouter({
     // Fail closed and say so. The controller degrades on CHANNEL_NOT_ALLOWED.
     return invokeError(request);
   };
+  handleInvoke.invalidateSessionRows = invalidateSessionRows;
+  return handleInvoke;
 }

package/src/cindy-session-row.js

@@ -81,10 +81,9 @@ export function toCindySessionListRow(item, { now = () => new Date(), device, de
     // `'active' | 'archived' | 'deleted'`; the controller's default status filter
     // is `'active'`, so this field decides whether a row is visible at all.
     //
-    // DSH has no archived or deleted state, so the value can only come from this
-    // Host's own flags (`session-flags.js`), folded onto the source row before it
-    // reaches here. A row that carries none is active, which is what every row was
-    // before the flags existed.
+    // Native DSH archives and legacy controller metadata are folded together
+    // before reaching this wire adapter. A row with no status is active; delete
+    // remains a Host-only hide and never destroys DSH history.
     status: item.status === 'archived' || item.status === 'deleted' ? item.status : 'active',
     agentKind: agentKindForModel({ model: item.model ?? defaultModel, provider: item.providerId, catalog }),
     // The controller looks the current model up by id in the catalog it fetched
@@ -134,11 +133,11 @@ export function toCindySessionListRow(item, { now = () => new Date(), device, de
     // moment the user selects this Host — which is the only way to see it.
     deviceLinkDeviceId: device?.deviceId ?? null,
     deviceLinkDeviceName: device?.deviceName ?? null,
-    // Present only when a controller pinned this session here (the flag store's
-    // doing, not DSH's). The controller reads a missing field as "not pinned" — and
-    // on a write reply it reads a missing field as "keep what I have", which is
-    // exactly how an unpin stays applied without this row asserting `null`.
-    ...(typeof item.pinnedAt === 'string' && item.pinnedAt !== '' ? { pinnedAt: item.pinnedAt } : {}),
+    // Preserve a known unpin (including native archival). A missing field is
+    // 'keep what I have' on a write reply, so dropping explicit null can retain
+    // the controller's old pin even though DSH has archived the session.
+    ...(item.pinnedAt === null ? { pinnedAt: null }
+      : typeof item.pinnedAt === 'string' && item.pinnedAt !== '' ? { pinnedAt: item.pinnedAt } : {}),
   };
 }
 

package/src/credential-command.js

@@ -0,0 +1,59 @@
+import { spawn } from 'node:child_process';
+
+export class CredentialStoreUnavailableError extends Error {
+  constructor(message = '本机凭据存储不可用。Linux 请检查 secret-tool 和已解锁的 Secret Service；macOS 请检查钥匙串授权；Windows 请检查系统 PowerShell 和 DSH 原生凭据服务。') {
+    super(message);
+    this.name = 'CredentialStoreUnavailableError';
+    this.code = 'CREDENTIAL_STORE_UNAVAILABLE';
+  }
+}
+
+/** No shell, no secret argv, bounded time/output, and never expose child diagnostics. */
+export function runCredentialCommand(file, args, input = '', { timeoutMs = 15_000, maxBytes = 1024 * 1024 } = {}) {
+  return new Promise((resolve, reject) => {
+    let child;
+    try { child = spawn(file, args, { shell: false, windowsHide: true, stdio: ['pipe', 'pipe', 'pipe'] }); }
+    catch { reject(new CredentialStoreUnavailableError()); return; }
+    let done = false;
+    let bytes = 0;
+    const stdout = [];
+    const stderr = [];
+    const fail = () => {
+      if (done) return;
+      done = true;
+      clearTimeout(timer);
+      child.kill();
+      reject(new CredentialStoreUnavailableError());
+    };
+    const timer = setTimeout(fail, timeoutMs);
+    child.on('error', fail);
+    child.stdin.on('error', fail);
+    for (const [stream, chunks] of [[child.stdout, stdout], [child.stderr, stderr]]) {
+      stream.on('error', fail);
+      stream.on('data', chunk => {
+        bytes += chunk.length;
+        if (bytes > maxBytes) { fail(); return; }
+        chunks.push(chunk);
+      });
+    }
+    child.on('close', code => {
+      if (done) return;
+      done = true;
+      clearTimeout(timer);
+      resolve({ code, stdout: Buffer.concat(stdout).toString('utf8'), stderr: Buffer.concat(stderr).toString('utf8') });
+    });
+    child.stdin.end(input);
+  });
+}
+
+// System .NET assembly, not C# compilation. All data (including entropy) travels on stdin.
+export const DPAPI_SCRIPT = [
+  "$ErrorActionPreference = 'Stop'",
+  'Add-Type -AssemblyName System.Security',
+  '$r = [Console]::In.ReadToEnd() | ConvertFrom-Json',
+  '$data = [Convert]::FromBase64String($r.data)',
+  '$entropy = [Convert]::FromBase64String($r.entropy)',
+  "$scope = [System.Security.Cryptography.DataProtectionScope]::CurrentUser",
+  "if ($r.operation -eq 'protect') { $result = [System.Security.Cryptography.ProtectedData]::Protect($data, $entropy, $scope) } elseif ($r.operation -eq 'unprotect') { $result = [System.Security.Cryptography.ProtectedData]::Unprotect($data, $entropy, $scope) } else { throw 'Invalid operation' }",
+  '[Console]::Out.Write([Convert]::ToBase64String($result))',
+].join('; ');

package/src/credential-store.js

@@ -1,55 +1,12 @@
-import { createRequire } from 'node:module';
 import { createHash } from 'node:crypto';
 import { homedir } from 'node:os';
-import { resolve as resolvePath } from 'node:path';
+import { resolve as resolvePath, win32 } from 'node:path';
+import { runCredentialCommand, DPAPI_SCRIPT, CredentialStoreUnavailableError } from './credential-command.js';
+export { CredentialStoreUnavailableError } from './credential-command.js';
 
 const SERVICE = 'DSH Cindy Host';
+const FORMAT = 'dpapi-current-user-v1';
 
-/**
- * `keytar` is a **native** module, so it is loaded lazily and its absence is not fatal.
- *
- * Measured on a clean install (a packed tarball into a fresh `DSH_HOME`): pnpm 10 does not run
- * dependency build scripts by default, so `keytar.node` was never built, and a top-level import
- * here made the whole plugin fail to load — the profile would not boot over a *credential store*
- * it may never need. An optional capability must not be able to break mounting, so the module is
- * required the moment it is used and a failure degrades to "no credential store": a read answers
- * "no stored session" (the card asks for a login), and a write throws a named error instead of
- * pretending to have saved.
- *
- * @returns the keytar module, or null when it cannot be loaded on this machine.
- */
-let keytarModule;
-function keytar() {
-  if (keytarModule === undefined) {
-    try {
-      keytarModule = createRequire(import.meta.url)('keytar');
-    } catch {
-      keytarModule = null;
-    }
-  }
-  return keytarModule;
-}
-
-/** Whether a credential store is usable here, for callers that want to say so. */
-export function credentialStoreAvailable() {
-  return keytar() !== null;
-}
-
-/** The error a write raises when this machine has no usable credential store. */
-export class CredentialStoreUnavailableError extends Error {
-  constructor() {
-    super('this machine has no usable credential store (keytar is not built; on pnpm 10 approve the keytar build script)');
-    this.code = 'CREDENTIAL_STORE_UNAVAILABLE';
-  }
-}
-
-/**
- * The credential-store entry the default installation has always used.
- *
- * The OS keeps these per (service, account), and the account is what separates two DSH
- * installations on one machine — not a folder, because there is no folder: one machine,
- * one credential store.
- */
 export const DEFAULT_ACCOUNT = 'session-v1';
 
 /** DSH's own default home: `~/.dsh` (the same precedence `dsh-home-paths` documents). */
@@ -92,7 +49,7 @@ function sameHome(left, right) {
  *
  * @param env - environment to read (injectable for tests).
  * @param defaultHome - the home treated as the default installation.
- * @returns the keytar account name for this process.
+ * @returns the OS credential account name for this process.
  */
 export function credentialAccount(env = process.env, defaultHome = defaultDshHome()) {
   const home = typeof env?.DSH_HOME === 'string' ? env.DSH_HOME.trim() : '';
@@ -103,26 +60,122 @@ export function credentialAccount(env = process.env, defaultHome = defaultDshHom
   return `${DEFAULT_ACCOUNT}@${digest}`;
 }
 
-export async function loadSession(ports = {}) {
-  const account = ports.account ?? credentialAccount();
-  const store = keytar();
-  if (store === null) return null; // no store here: "no stored session", never a crash
-  const value = await store.getPassword(SERVICE, account);
-  return value ? JSON.parse(value) : null;
+
+function parseSession(text) {
+  const value = JSON.parse(text);
+  if (!value || typeof value !== 'object' || Array.isArray(value)
+    || !['deviceId', 'authBaseUrl', 'accessToken', 'refreshToken'].every(key => typeof value[key] === 'string' && value[key].length > 0)) {
+    throw new CredentialStoreUnavailableError();
+  }
+  return value;
 }
 
-export async function saveSession(session, ports = {}) {
-  const account = ports.account ?? credentialAccount();
-  const store = keytar();
-  if (store === null) throw new CredentialStoreUnavailableError();
-  await store.setPassword(SERVICE, account, JSON.stringify(session));
+function base64(value) {
+  if (typeof value !== 'string' || !value || value.length % 4 !== 0 || !/^[A-Za-z0-9+/]+={0,2}$/.test(value)) throw new CredentialStoreUnavailableError();
+  return value;
 }
 
-export async function clearSession(ports = {}) {
-  const account = ports.account ?? credentialAccount();
-  const store = keytar();
-  // Clearing what does not exist is the outcome the caller wanted, so a missing store is not an
-  // error here — unlike a save, which must not report success it cannot deliver.
-  if (store === null) return;
-  await store.deletePassword(SERVICE, account);
+// security's interactive command parser accepts quoted arguments. Secrets stay off argv.
+const securityQuote = value => '"' + value.replace(/\\/g, '\\\\').replace(/"/g, '\\"') + '"';
+
+/** One installation's store. No process-global registration and no native npm modules.
+ * Linux/macOS keep the historical service/account, so existing keychain records remain readable.
+ * Windows stores ONLY DPAPI ciphertext in DSH's native record service, never in settings.
+ */
+export function createCredentialStore({ platform = process.platform, env = process.env, account = credentialAccount(env),
+  getCredentials = () => undefined, run = runCredentialCommand } = {}) {
+  if (!/^session-v1(?:@[0-9a-f]{12})?$/.test(account)) throw new TypeError('Invalid credential account');
+  const recordKey = 'dsh-cindy-host/' + account.replace('@', '-home-');
+  const attributes = ['service', SERVICE, 'account', account];
+  function provider() {
+    const value = getCredentials();
+    if (!value || !['readRecord', 'modifyRecord', 'deleteRecord'].every(key => typeof value[key] === 'function')) throw new CredentialStoreUnavailableError();
+    return value;
+  }
+  async function command(file, args, input = '') {
+    return run(file, args, input);
+  }
+  async function dpapi(operation, data) {
+    if (!env.SystemRoot) throw new CredentialStoreUnavailableError();
+    const file = win32.join(env.SystemRoot, 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe');
+    const result = await command(file, ['-NoLogo', '-NoProfile', '-NonInteractive', '-Command', DPAPI_SCRIPT], JSON.stringify({
+      operation, data, entropy: Buffer.from(SERVICE + '/' + account).toString('base64'),
+    }));
+    if (result.code !== 0) throw new CredentialStoreUnavailableError();
+    return base64(result.stdout.trim());
+  }
+  async function read() {
+    if (platform === 'win32') {
+      const record = await provider().readRecord(recordKey);
+      if (record === undefined) return null;
+      if (record?.kind !== 'grant' || record.payload?.format !== FORMAT) throw new CredentialStoreUnavailableError();
+      const clear = await dpapi('unprotect', base64(record.payload.ciphertext));
+      return parseSession(Buffer.from(clear, 'base64').toString('utf8'));
+    }
+    if (platform === 'linux') {
+      const result = await command('secret-tool', ['lookup', ...attributes]);
+      if (result.code === 1 && !result.stdout && !result.stderr.trim()) return null;
+      if (result.code !== 0) throw new CredentialStoreUnavailableError();
+      return parseSession(result.stdout.trimEnd());
+    }
+    if (platform === 'darwin') {
+      const result = await command('/usr/bin/security', ['find-generic-password', '-s', SERVICE, '-a', account, '-w']);
+      if (result.code === 44) return null; // errSecItemNotFound, not a locked/denied keychain
+      if (result.code !== 0) throw new CredentialStoreUnavailableError();
+      return parseSession(result.stdout.trimEnd());
+    }
+    throw new CredentialStoreUnavailableError();
+  }
+  async function write(session) {
+    const text = JSON.stringify(session);
+    parseSession(text);
+    if (Buffer.byteLength(text) > 512 * 1024) throw new CredentialStoreUnavailableError();
+    if (platform === 'win32') {
+      const credentials = provider();
+      const ciphertext = await dpapi('protect', Buffer.from(text).toString('base64'));
+      await credentials.modifyRecord(recordKey, () => ({ kind: 'grant', payload: { format: FORMAT, ciphertext } }));
+      return;
+    }
+    let result;
+    if (platform === 'linux') result = await command('secret-tool', ['store', '--label=' + SERVICE, ...attributes], text);
+    else if (platform === 'darwin') {
+      const args = ['add-generic-password', '-U', '-s', SERVICE, '-a', account, '-w', text];
+      result = await command('/usr/bin/security', ['-i'], args.map(securityQuote).join(' ') + '\n');
+      // security -i may exit zero after a failed subcommand. Its diagnostics must still fail closed.
+      if ([result.stdout, result.stderr].some(text => text.replace(/security>\s*/g, '').trim())) throw new CredentialStoreUnavailableError();
+    } else throw new CredentialStoreUnavailableError();
+    if (result.code !== 0) throw new CredentialStoreUnavailableError();
+  }
+  async function clear() {
+    if (platform === 'win32') { await provider().deleteRecord(recordKey); return; }
+    let result;
+    if (platform === 'linux') {
+      result = await command('secret-tool', ['clear', ...attributes]);
+      if (result.code === 1 && !result.stderr.trim()) return;
+    } else if (platform === 'darwin') {
+      result = await command('/usr/bin/security', ['delete-generic-password', '-s', SERVICE, '-a', account]);
+      if (result.code === 44) return;
+    } else throw new CredentialStoreUnavailableError();
+    if (result.code !== 0) throw new CredentialStoreUnavailableError();
+  }
+  // Neither child diagnostics nor JSON parse errors may carry credentials into logs/UI.
+  const guarded = action => async (...args) => {
+    try { return await action(...args); }
+    catch { throw new CredentialStoreUnavailableError(); }
+  };
+  return {
+    loadSession: guarded(read), saveSession: guarded(write), clearSession: guarded(clear),
+    credentialStoreAvailable: () => {
+      if (platform === 'linux' || platform === 'darwin') return true;
+      if (platform !== 'win32' || !env.SystemRoot) return false;
+      try { provider(); return true; } catch { return false; }
+    },
+  };
 }
+
+// Standalone Linux/macOS CLIs use the same system keychain. Windows needs a DSH
+// credential service; without a host context fail explicitly, never write plaintext.
+export const loadSession = (ports = {}) => createCredentialStore(ports).loadSession();
+export const saveSession = (session, ports = {}) => createCredentialStore(ports).saveSession(session);
+export const clearSession = (ports = {}) => createCredentialStore(ports).clearSession();
+export const credentialStoreAvailable = (ports = {}) => createCredentialStore(ports).credentialStoreAvailable();

package/src/dsh-plugin.js

@@ -6,6 +6,7 @@ import { createDshInputDeliveryBackend } from './dsh-input-delivery.js';
 import { DEFAULT_HOST_SETTINGS, SETTINGS_NAMESPACE, validateHostSettings } from './host-settings.js';
 import { DshHostSource } from './dsh-host-source.js';
 import { createSessionControllerSource } from './dsh-session-source.js';
+import { createDshSessionArchive } from './dsh-session-archive.js';
 import { readActiveSessionSummaries } from './dsh-active-sessions.js';
 import { createMessageCounter, createMessageReader, foldSessionEvent, isHarnessNotice, promptRpcIdOf } from './dsh-message-fold.js';
 import { createHistoryViewController } from './host-history-view.js';
@@ -18,6 +19,7 @@ import { refusalError } from './cindy-channels.js';
 import { enrichModelCatalog } from './host-model-catalog.js';
 import { hydrateImageAttachments } from './cindy-message-row.js';
 import { API_PREFIX, createHostRoutes } from './host-routes.js';
+import { createCredentialStore } from './credential-store.js';
 
 export const name = 'dsh-cindy-host';
 export const inject = ['settings'];
@@ -42,8 +44,8 @@ function settingsNamespace(value) {
   return value;
 }
 const ControllerSchema = Schema.object({ state: Schema.union(['authorized', 'revoked']), displayName: Schema.string(), grantedAt: Schema.string(), revokedAt: Schema.string(), grantRevision: Schema.natural() });
-// The archive/delete/pin flags a controller writes: this Host's own answer to three
-// actions DSH has no concept of. `pinnedAt: ''` is a remembered unpin (settings
+// Legacy archive and controller-only delete/pin metadata. Native DSH owns new
+// archive writes. `pinnedAt: ''` is a remembered unpin (settings
 // reject `null`, and an absent field cannot be told apart from "never pinned").
 const SessionFlagSchema = Schema.object({ status: Schema.union(['active', 'archived', 'deleted']), pinnedAt: Schema.string() });
 
@@ -151,7 +153,15 @@ export function buildDshSource(ctx, serviceName, options = {}) {
      * same trap the original `apiProxy` seam fell into. Neither is required, so
      * each keeps its own availability instead of failing the whole Host.
      */
-    const controls = { planMode: undefined, permissionPresets: undefined, fileUploads: undefined, tokenMeter: undefined, llm: undefined, sessionTitle: undefined, skills: undefined };
+    const controls = { planMode: undefined, permissionPresets: undefined, fileUploads: undefined, tokenMeter: undefined, llm: undefined, sessionTitle: undefined, skills: undefined, workspaceRegistry: undefined };
+    ctx.inject(['workspaceRegistry'], (workspaceCtx) => {
+      controls.workspaceRegistry = workspaceCtx.get('workspaceRegistry');
+      return () => { controls.workspaceRegistry = undefined; };
+    });
+    const sessionArchive = createDshSessionArchive({
+      getRegistry: () => controls.workspaceRegistry,
+      subscribe: (event, listener) => ctx.on(event, listener),
+    });
     ctx.inject(['planMode'], (planCtx) => {
       controls.planMode = planCtx.get('planMode');
       return () => { controls.planMode = undefined; };
@@ -214,33 +224,43 @@ export function buildDshSource(ctx, serviceName, options = {}) {
      * answered `skills: 6` once it was live. Both lists describe one session; two
      * different answers there is not purity, it is a missing menu the user sees.
      *
-     * A request naming **no** session is the new-task composer, and there the honest
-     * answer is what a new session would offer: `agentPresets.standingKeyFor()`,
-     * which DSH documents as "the standing scope key of one preset, for a host
-     * reader with no agent … ensuring the mount composes plugins but starts no
-     * agent, no session, and no turn". A session that *is* named but cannot be
-     * resolved answers nothing: inventing the default composition's skills for an
-     * unknown session would be a claim about a session this Host cannot see.
+     * A request naming **no** session is the new-task composer. Current DSH
+     * supplies `agentPresets.acquireScope()` instead of `standingKeyFor()`:
+     * keep that revision lease until the asynchronous catalog read settles,
+     * then release it even when the read fails. Neither path starts an Agent.
+     * Older carriers may still supply the non-owning standing key.
      * @param sessionId - the session whose agent to use as a viewing scope, if any.
-     * @returns the viewing scope key, or undefined when none can be named.
+     * @param read - the scoped catalog operation; must settle before lease disposal.
+     * @returns the catalog operation's result.
      */
-    async function agentScopeFor(sessionId) {
+    async function withAgentScope(sessionId, read) {
       const named = typeof sessionId === 'string' && sessionId !== '';
       const live = liveAgentFor(sessionId);
-      if (live !== undefined) return live;
+      if (live !== undefined) return read(live);
       if (named) {
         const resolved = await sessionController.resolveAgent(sessionId);
-        return resolved?.error === undefined ? resolved.agent : undefined;
+        return read(resolved?.error === undefined ? resolved.agent : undefined);
       }
       const presets = ctx.get('agentPresets');
-      if (typeof presets?.standingKeyFor !== 'function') return undefined;
-      try {
-        return await presets.standingKeyFor();
-      } catch {
-        // An unusable default composition is not a reason to fail a menu; the
-        // caller then reads the global layer.
-        return undefined;
+      if (typeof presets?.acquireScope === 'function') {
+        let lease;
+        try {
+          lease = await presets.acquireScope();
+        } catch {
+          // An unusable default composition retains the global-only palette.
+          return read(undefined);
+        }
+        try {
+          return await read(lease.key);
+        } finally {
+          await lease[Symbol.asyncDispose]();
+        }
       }
+      let scope;
+      if (typeof presets?.standingKeyFor === 'function') {
+        try { scope = await presets.standingKeyFor(); } catch { /* Global-only fallback. */ }
+      }
+      return read(scope);
     }
 
     /**
@@ -719,8 +739,11 @@ export function buildDshSource(ctx, serviceName, options = {}) {
         }
       },
     });
+    // The runtime observes native archive commits even when the relay is offline.
+    sessionSource.archive = sessionArchive;
     return {
       kind: 'session-controller',
+      sessionArchive,
       readMessages,
       readAllMessages: readMessages === undefined ? undefined : committedRows,
       inputDeliveryBackend,
@@ -1011,9 +1034,12 @@ export function buildDshSource(ctx, serviceName, options = {}) {
        * the read that can be trusted. The lease is always released.
        */
       readSessionState: readSessionStateNow,
-      /** Apply the controller's model choice to one session. */
-      selectModel: async ({ sessionId, provider, model, reasoningEffort }) =>
-        applyModelSelection({ sessionId, provider, model, reasoningEffort }),
+      /** Native DSH validates and records selections for the next model request,
+       * including during a turn. Do not advertise that authority when absent. */
+      selectModel: typeof sessionController.selectModel === 'function'
+        ? async ({ sessionId, provider, model, reasoningEffort }) =>
+          applyModelSelection({ sessionId, provider, model, reasoningEffort })
+        : undefined,
       /**
        * Change one session's reasoning effort.
        *
@@ -1061,17 +1087,20 @@ export function buildDshSource(ctx, serviceName, options = {}) {
          * empty while its command list was not).
          *
          * The scope comes from the session's own agent, which is the only way a
-         * preset's layer is visible at all — see `agentScopeFor`.
+         * preset's layer is visible at all — see `withAgentScope`.
          */
-        skills: async ({ cwd, sessionId }) => {
-          const skills = controls.skills;
+        skills: async ({ cwd, sessionId }) => withAgentScope(sessionId, async (scope) => {
+          const presets = ctx.get('agentPresets');
+          // A live Agent's preset may isolate its skill service from the Host.
+          const scoped = scope?.ctx !== undefined && typeof presets?.serviceFor === 'function'
+            ? presets.serviceFor(scope, 'skills') : undefined;
+          const skills = scoped ?? controls.skills;
           if (skills === undefined || typeof skills.list !== 'function') return [];
-          const scope = await agentScopeFor(sessionId);
           return skills.list({
             ...(scope === undefined ? {} : { scope }),
             ...(cwd === undefined ? {} : { cwd }),
           });
-        },
+        }),
         commands: async ({ sessionId }) => {
           const commands = ctx.get('commands');
           if (commands === undefined || typeof commands.list !== 'function') return [];
@@ -1389,6 +1418,7 @@ export function capabilityProvider(sources) {
     ensureAgent: sources.ensureAgent,
     palette: sources.palette,
     sessionControls: sources.sessionControls,
+    sessionArchive: sources.sessionArchive,
     fileBrowser: sources.fileBrowser,
   };
 }
@@ -1618,6 +1648,8 @@ export async function arbitrateInteraction({ request, next, begin, settleLocal }
 export function apply(ctx, config) {
   const scope = createSettingsScope(ctx, settingsNamespace(SETTINGS_NAMESPACE), config);
   let runtime;
+  let nativeCredentials;
+  const credentialPorts = createCredentialStore({ getCredentials: () => nativeCredentials });
   // The source can arrive before OR after the runtime: `startHost` awaits a
   // Cindy session before resolving, while `ctx.inject` fires the moment the DSH
   // service activates. Holding it here and re-applying after the await covers
@@ -1728,8 +1760,22 @@ export function apply(ctx, config) {
     }));
   }
 
+  // Only Windows needs DSH persistence; missing/late service must not break mounting.
+  ctx.inject(['credentials'], (credentialCtx) => {
+    credentialCtx.effect(() => {
+      const provider = credentialCtx.get?.('credentials') ?? credentialCtx.credentials;
+      nativeCredentials = provider;
+      if (runtime && scope.get().transportEnabled) {
+        void Promise.resolve().then(() => runtime.reconnectNow())
+          .catch(error => noteBoundaryError('credential-store-ready', error));
+      }
+      return () => { if (nativeCredentials === provider) nativeCredentials = undefined; };
+    });
+  });
+
   ctx.effect(async () => {
     runtime = await startHost(undefined, scope.get(), {
+      credentialPorts,
       // A provider, not a snapshot: these callbacks come from the injected
       // session service, which activates after `startHost` already awaited a
       // Cindy session. Capturing them here would freeze an empty set and make a
@@ -1741,8 +1787,8 @@ export function apply(ctx, config) {
         files: currentFiles,
         goalWrite: currentGoalWrite,
       }),
-      // The controller's archive/delete/pin writes go straight to this plugin's
-      // settings section, so the whole flag store reloads with the process.
+      // Delete/pin and old archive overlays persist here; new archives live in
+      // DSH's native workspace registry, not this plugin's settings section.
       persistSessionFlags: sessionFlagsWriter(ctx.settings, settingsNamespace(SETTINGS_NAMESPACE)),
       inputDeliveryDirectory: join(process.env.DSH_PROFILE_DIR || join(process.env.DSH_HOME || join(homedir(), '.dsh'), 'profiles', process.env.DSH_PROFILE || 'desktop'), 'state', 'dsh-cindy-host'),
     });
@@ -1949,6 +1995,7 @@ export function apply(ctx, config) {
   // in headless compositions, so the row is injected optionally: the runtime and
   // its settings still work, only the browser surface is missing.
   const routes = createHostRoutes({
+    credentialPorts,
     getRuntime: () => runtime,
     getDiagnostics: () => buildDiagnostics({ runtime, sourceKind, seam: currentSeam, listingDiagnostics: currentListingDiagnostics, boundaries: boundaryState() }),
     // The Host's own relay identity outlives the credential: a phone links to the

package/src/dsh-session-archive.js

@@ -0,0 +1,49 @@
+import { refusalError } from './cindy-channels.js';
+
+/** Adapt the same durable registry operations used by DSH's workspace controller.
+ * Registry availability is resolved per call; no private file or shadow archive is written. */
+export function createDshSessionArchive({ getRegistry, subscribe }) {
+  function ids() {
+    const value = getRegistry()?.archivedSessionIds;
+    return Array.isArray(value) ? new Set(value.map(String)) : null;
+  }
+  function isArchived(sessionId) {
+    const current = ids();
+    return current === null ? null : current.has(String(sessionId));
+  }
+  async function setArchived(sessionId, archived) {
+    const registry = getRegistry();
+    const method = archived ? 'archiveSession' : 'unarchiveSession';
+    if (typeof registry?.[method] !== 'function' || ids() === null) {
+      throw refusalError('NOT_AVAILABLE', 'This DSH profile exposes no native session archive API');
+    }
+    try {
+      // No stopActivity: the existing client gesture does not authorize stopping work.
+      await registry[method](sessionId);
+    } catch (error) {
+      if (error?.name === 'WorkspaceUnknownSessionError' || error?.code === 'session/not-found') {
+        throw refusalError('NOT_FOUND', String(error.message));
+      }
+      if (error?.name === 'WorkspaceActiveSessionError' || error?.code === 'workspace/session-active') {
+        throw refusalError('NOT_AVAILABLE', String(error.message));
+      }
+      throw error; // Persistence/transport failures must never become local-only success.
+    }
+    if (isArchived(sessionId) !== archived) throw new Error('DSH archive state did not match the completed operation');
+    return archived;
+  }
+  function onChange(listener) {
+    if (typeof subscribe !== 'function') return () => {};
+    let previous = ids();
+    return subscribe('domain/changed', (change) => {
+      if (change?.domain !== 'workspace' || change.table !== '' || change.operation !== 'put') return;
+      const next = ids();
+      if (next === null) return;
+      const changed = [...new Set([...(previous ?? []), ...next])]
+        .filter(id => previous?.has(id) !== next.has(id));
+      previous = next;
+      if (changed.length > 0) listener(changed);
+    });
+  }
+  return { snapshot: ids, isArchived, setArchived, onChange };
+}

package/src/host-models.js

@@ -93,9 +93,10 @@ export function toEffortLevels(availableModels) {
 /**
  * The capability payload for one agent kind.
  * @param catalog - a DSH `ModelCatalog`, or undefined when none loaded.
+ * @param options - whether the composed Host forwards model changes to native DSH.
  * @returns the payload `maker:get-capabilities` answers with.
  */
-export function toAgentCapabilities(catalog) {
+export function toAgentCapabilities(catalog, { nativeModelSelection = false } = {}) {
   const availableModels = toAvailableModels(catalog);
   return {
     availableModels,
@@ -107,7 +108,11 @@ export function toAgentCapabilities(catalog) {
     // Read as an object by the controller; a boolean here is silently ignored.
     planMode: { supported: false },
     supportsSessionAgentSwitch: false,
-    supportsModelWindowSwitchGuard: false,
+    // On the wire this delegates window decisions to the Host. DSH accepts a
+    // selection for the next model request and owns context handling itself;
+    // Cindy must not impose its legacy Pi/unknown-window veto ahead of DSH.
+    // This does not claim Cindy-style remote summary/rebuild support.
+    supportsModelWindowSwitchGuard: nativeModelSelection === true,
   };
 }
 

package/src/host-routes.js

@@ -63,10 +63,10 @@ export async function readJsonBody(req) {
  * @param options - the runtime accessor and an optional diagnostics producer.
  * @returns one handler per route, each owning its own response.
  */
-export function createHostRoutes({ getRuntime, getDiagnostics, getSettings, rememberDeviceId, auth = {} }) {
-  const loadCredential = auth.loadSession ?? loadSession;
-  const saveCredential = auth.adoptSession ?? adoptSession;
-  const forgetCredential = auth.forgetSession ?? forgetSession;
+export function createHostRoutes({ getRuntime, getDiagnostics, getSettings, rememberDeviceId, credentialPorts, auth = {} }) {
+  const loadCredential = auth.loadSession ?? credentialPorts?.loadSession ?? loadSession;
+  const saveCredential = auth.adoptSession ?? (session => adoptSession(session, credentialPorts));
+  const forgetCredential = auth.forgetSession ?? (() => forgetSession(credentialPorts));
   const verifyCredential = auth.verifyLoginCode ?? verifyLoginCode;
   const selectCredential = auth.selectLoginAccount ?? selectLoginAccount;
   /**

package/src/host-settings.js

@@ -2,9 +2,9 @@ export const SETTINGS_NAMESPACE = 'dsh-cindy-host';
 
 // Network access is opt-in. A newly mounted bundle only projects local DSH data.
 //
-// `sessionFlags` is the one section a *controller* writes: DSH has no archived,
-// deleted or pinned session state, so the phone's 删除/归档/置顶 are this Host's own
-// bookkeeping and they have to survive a restart (see `session-flags.js`).
+// Controller-only delete/pin metadata and legacy archive flags survive restart.
+// New archive/unarchive operations persist in DSH's native workspace registry;
+// legacy archived flags are retained until explicitly retired (see `session-flags.js`).
 export const DEFAULT_HOST_SETTINGS = Object.freeze({ transportEnabled: false, remoteControlEnabled: false, controllers: {}, deviceId: '', deviceName: '', sessionFlags: {} });
 
 /**

package/src/host-version.js

@@ -4,4 +4,4 @@
  */
 export const HOST_APP_VERSION = '0.1.82';
 /** Actual npm release, separate from the Cindy compatibility identity. */
-export const HOST_PLUGIN_VERSION = '0.1.31';
+export const HOST_PLUGIN_VERSION = '0.1.32';

package/src/host.js

@@ -26,7 +26,7 @@ import { createInputDeliveryCoordinator } from './host-input-delivery.js';
 import { realpath as realpathImpl, stat as statImpl } from 'node:fs/promises';
 import { extname as extnameImpl, resolve as resolvePathImpl } from 'node:path';
 import { restoreSession } from './auth-session.js';
-import { createChannelRouter, invokeError } from './cindy-channels.js';
+import { createChannelRouter, invokeError, refusalError } from './cindy-channels.js';
 import { createApprovalRegistry } from './host-approvals.js';
 import { createInputQueueTracker, queuedRowFromController } from './host-input-queue.js';
 import { createProjectionTracker, toGoalStatusPayload } from './host-goals.js';
@@ -121,7 +121,7 @@ async function fetchDeviceDirectory(session, relayUrl) {
  */
 export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS, options = {}) {
   const {
-    resolveSession = restoreSession,
+    resolveSession = () => restoreSession(options.credentialPorts),
     openSocket = openRelaySocket,
     listDevices = fetchDeviceDirectory,
     relayUrl = RELAY_WS_URL,
@@ -186,7 +186,7 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
         sessionRefreshedAt = Date.now();
         return renewed !== null;
       }
-      const result = await restoreSession();
+      const result = await restoreSession(options.credentialPorts);
       sessionRefreshedAt = Date.now();
       if (stopped || callerGeneration !== generation || exportOwner.capture()) return false;
       if (result?.ok === true && result.session !== undefined) {
@@ -305,7 +305,7 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
    */
   const remoteOwnedSessions = new Set();
   /**
-   * The session metadata DSH has no concept of: archived, deleted, pinned.
+   * Controller-only delete/pin metadata and compatibility archive flags.
    *
    * Owned by the runtime rather than the plugin because it is per-process state the
    * channel layer and the row projection must agree on, and it is persisted through
@@ -347,6 +347,69 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
         (current?.transportEnabled || current?.remoteControlEnabled) && status.ownDeviceId ? session : null, deviceId: status.ownDeviceId });
   }
   let source = initialSource;
+  let disposeArchiveObservation = null;
+  const sessionMetaWrites = new Map();
+  function serializeSessionMeta(sessionId, operation) {
+    const pending = (sessionMetaWrites.get(sessionId) ?? Promise.resolve()).then(operation);
+    const settled = pending.then(() => {}, () => {});
+    sessionMetaWrites.set(sessionId, settled);
+    void settled.then(() => { if (sessionMetaWrites.get(sessionId) === settled) sessionMetaWrites.delete(sessionId); });
+    return pending;
+  }
+  function projectSessionRows(rows) {
+    const archived = source?.archive?.snapshot(); // Read the native set once per page, not once per row.
+    return sessionFlags.projectAll(rows).map(row => archived?.has(String(row.id)) === true
+      ? { ...row, status: row.status === 'deleted' ? 'deleted' : 'archived', pinnedAt: null }
+      : row);
+  }
+  function sessionIsHidden(sessionId) {
+    return sessionFlags.isHidden(sessionId) || source?.archive?.isArchived(sessionId) === true;
+  }
+  function observeArchiveSource() {
+    disposeArchiveObservation?.();
+    disposeArchiveObservation = null;
+    const observedSource = source;
+    if (typeof observedSource?.archive?.onChange !== 'function') return;
+    disposeArchiveObservation = observedSource.archive.onChange(ids => {
+      routeInvoke.invalidateSessionRows(); // A committed desktop edit invalidates warm phone lists immediately.
+      for (const sessionId of ids) {
+        void serializeSessionMeta(sessionId, async () => {
+          if (stopped || source !== observedSource) return;
+          // DSH drops its pin on archive; retire the Host's legacy pin too.
+          if (source.archive.isArchived(sessionId) === true && sessionFlags.flagsFor(sessionId)?.pinnedAt) {
+            await sessionFlags.apply(sessionId, { pinnedAt: null });
+          }
+          if (stopped || source !== observedSource) return;
+          const cached = sessionRowCache.get(sessionId);
+          const [row] = projectSessionRows([{ ...cached, id: sessionId, status: 'active' }]);
+          if (cached) sessionRowCache.set(sessionId, row);
+          routeInvoke.invalidateSessionRows();
+          publishSessionMeta(sessionId, { status: row.status, ...(row.status === 'archived' ? { pinnedAt: null } : {}) });
+        }).catch(error => recordHandlerError('native-session-archive', error));
+      }
+    });
+  }
+  function applySessionMetadataFlags(sessionId, patch) {
+    const owner = source;
+    return serializeSessionMeta(sessionId, async () => {
+      if (stopped || source !== owner) throw refusalError('NOT_AVAILABLE', 'The DSH session source changed before the metadata write');
+      const archive = owner?.archive;
+      if (archive && (patch.status === 'archived' || patch.status === 'active')) {
+        // Validate other fields before the native write, so malformed metadata has no side effect.
+        if (patch.pinnedAt !== undefined && patch.pinnedAt !== null && typeof patch.pinnedAt !== 'string') {
+          throw refusalError('BAD_REQUEST', 'pinnedAt must be an ISO string or null');
+        }
+        const archived = patch.status === 'archived';
+        await archive.setArchived(sessionId, archived);
+        if (stopped || source !== owner) throw refusalError('NOT_AVAILABLE', 'The DSH session source changed during the archive write');
+        // Native state owns new archives; clear old archived/deleted overlays only
+        // after success. Keep unrelated legacy flags and never mutate other sessions.
+        const local = await sessionFlags.apply(sessionId, { status: 'active', pinnedAt: archived ? null : patch.pinnedAt });
+        return { ...local, status: archived ? 'archived' : 'active' };
+      }
+      return sessionFlags.apply(sessionId, patch);
+    });
+  }
   let active = false;
   let connecting = null; // Generation owning the in-flight connect, not a global latch.
   let session = null;
@@ -376,6 +439,7 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
   let fileExports;
   const exportOwner = createExportOwner({
     ...options.exportCredentialOptions, now: () => Number(now()),
+    ports: { ...options.credentialPorts, ...options.exportCredentialOptions?.ports },
     onSession: (next) => { session = next; },
     onInvalidate: () => { void fileExports?.invalidateOwner(); transferDiagnostics.clear(); },
   });
@@ -572,6 +636,9 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
   async function setSource(next) {
     source = next === undefined ? undefined : next;
     if (stopped) return;
+    routeInvoke.invalidateSessionRows();
+    sessionRowCache.clear();
+    observeArchiveSource();
     if (projection !== null) {
       const closing = projection;
       projection = null;
@@ -1227,7 +1294,7 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
         ? await source.getSession(sessionId)
         : (await source.listSessions()).find((candidate) => String(candidate.id) === sessionId);
       if (row == null) return undefined;
-      const [flagged] = sessionFlags.projectAll([row]);
+      const [flagged] = projectSessionRows([row]);
       if (flagged !== undefined) sessionRowCache.set(String(flagged.id), flagged);
       return flagged;
     },
@@ -1237,7 +1304,7 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
       // The archive/delete/pin flags ride the source row's `status`/`pinnedAt`, which
       // is how they reach the wire row (`cindy-session-row.js`) at every read path —
       // list, get, and the row echoed back to a writer.
-      const flagged = sessionFlags.projectAll(rows);
+      const flagged = projectSessionRows(rows);
       sessionRowCache.clear();
       for (const row of flagged) sessionRowCache.set(String(row.id), row);
       return flagged;
@@ -1256,7 +1323,7 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
     listSessionStates: async (requestedSessionId) => {
       if (source === undefined || source === null) throw new Error('no DSH session source is attached');
       const rows = typeof source.listSessionStates === 'function' ? await source.listSessionStates(requestedSessionId) : await source.listSessions();
-      return sessionFlags.projectAll(rows);
+      return projectSessionRows(rows);
     },
     // Resolved per request. The approval pair lives here because the registry is
     // this runtime's own; everything else comes from the plugin, whose DSH
@@ -1268,8 +1335,8 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
         resolveInteraction: (requestId, decision) => approvals.settle(requestId, decision),
         // The archive/delete/pin writes, and the one reader that decides whether a
         // session still belongs on the controller's live surfaces.
-        applySessionFlags: (sessionId, patch) => sessionFlags.apply(sessionId, patch),
-        sessionHidden: (sessionId) => sessionFlags.isHidden(sessionId),
+        applySessionFlags: applySessionMetadataFlags,
+        sessionHidden: sessionIsHidden,
         publishSessionMeta,
         // The controller's only way to *see* a file that lives on this machine: an image
         // the agent produced, or one picked in the file browser. Host-owned because the
@@ -1621,7 +1688,7 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
     } catch {
       return;
     }
-    const running = rows.filter((row) => row?.running === true && !sessionFlags.isHidden(row.id));
+    const running = rows.filter((row) => row?.running === true && !sessionIsHidden(row.id));
     if (running.length === 0) return;
     for (const row of running) {
       const payload = { sessionId: String(row.id), event: runningStatusEvent() };
@@ -2199,8 +2266,10 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
       let resolved;
       try {
         resolved = await serializeCredentialOperation(() => resolveSession());
-      } catch {
-        resolved = { ok: false, message: '读取本机 Cindy 登录态失败' };
+      } catch (error) {
+        resolved = error?.code === 'CREDENTIAL_STORE_UNAVAILABLE'
+          ? { ok: false, reason: error.code, message: error.message }
+          : { ok: false, message: '读取本机 Cindy 登录态失败' };
       }
       if (stopped || !active || myGeneration !== generation) return;
 
@@ -2354,6 +2423,8 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
   /** Full stop: used by plugin teardown, not by the switch. */
   async function stop() {
     stopped = true;
+    disposeArchiveObservation?.();
+    disposeArchiveObservation = null;
     active = false;
     await disconnect();
     await fileExports.stop();
@@ -2363,6 +2434,8 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
     status.setState('disconnected');
   }
 
+  /** Follow native metadata even while transport is off; reconnect reads the same registry. */
+  observeArchiveSource();
   /** Start if the resolved settings already ask for transport. */
   await updateSettings(settings);
 

package/src/login.js

@@ -1,5 +1,5 @@
 import { loginWithPhone } from "./cindy-login.js";
-import { saveSession } from "./credential-store.js";
+import { loadSession, saveSession } from "./credential-store.js";
 
 if (process.argv.includes("--help")) {
   console.log("Usage: CINDY_AUTH_BASE_URL=https://auth.example npm run login");
@@ -10,14 +10,11 @@ const authBaseUrl = process.env.CINDY_AUTH_BASE_URL || readFlag("--auth-base-url
 const clientType = process.env.CINDY_CLIENT_TYPE || "desktop";
 
 try {
+  // Fail before contacting auth when persistence is unavailable. Windows CLI
+  // has no DSH context: use the DSH settings card, not a plaintext fallback.
+  await loadSession();
   const session = await loginWithPhone({ authBaseUrl, clientType });
-  // Persist so the settings card sees the same session the terminal just made.
-  // Best-effort: a host with no OS credential store still gets a usable handle.
-  try {
-    await saveSession(session);
-  } catch {
-    console.error("Cindy logged in, but the OS credential store is unavailable; the settings card will not see this session");
-  }
+  await saveSession(session);
   // Deliberately expose only the non-secret local device handle.
   console.log(JSON.stringify({ status: "authenticated", deviceId: session.deviceId }, null, 2));
 } catch (error) {

package/src/session-flags.js

@@ -1,12 +1,13 @@
 /**
- * The three session actions DSH itself has no concept of: archive, delete, pin.
+ * Legacy controller-only archive/delete/pin metadata. New archives use native DSH.
  *
  * A controller's session list offers 删除 / 归档 / 置顶 / 重命名, and all four are
  * the *same* write (`local-db:sessions:patch-meta`, see
  * `Cindy/apps/desktop/src/renderer/lib/sessionService.ts` and
- * `Cindy/apps/mobile/src/session/useSessionListActions.ts`). Only 重命名 has a DSH
- * counterpart — DSH sessions are a log-backed store with no archived, hidden or
- * pinned state — so this module is the Host's own bookkeeping for the other three.
+ * `Cindy/apps/mobile/src/session/useSessionListActions.ts`). Native DSH now owns
+ * archive/unarchive; this store preserves old archived flags until an explicit
+ * operation retires them. Delete remains a non-destructive hide, and controller
+ * pin timestamps remain local metadata.
  *
  * Three consequences are deliberate and must stay visible:
  *