dsh-cindy-host 0.1.41 → 0.1.42

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 0.1.42 — 2026-11-13
+
+- Accept the reviewed DSH `0.2.2-rc.2` Agent/Session/Settings carrier without bundling a DSH runtime or enabling unreviewed prereleases. Preserve the existing supported carriers and Cindy handshake identity.
+- Revalidate native Session observers and controller/subagent reads against the RC.2 carrier; batched appends still publish the existing per-event observation API. Real handset, relay, OAuth and model calls remain separate acceptance requirements.
+
 ## 0.1.41 — 2026-11-08
 
 - Accept the exact DSH `0.2.2-rc.1` Agent/Session/Settings carrier alongside the existing 0.2.1 RC and 0.2.2-alpha.2 peers. Keep DSH packages host-provided and preserve 0.1.40's complete feature set, including credentials without keytar.

package/README.md

@@ -4,12 +4,14 @@ A Host-side adapter connecting current Cindy clients to DeepSeek Harness.
 
 ## Requirements and installation
 
-Version **0.1.41** adds DSH `0.2.2-rc.1` compatibility and keeps historical ordinary forks visible by classifying subagents through `origin`, not parent lineage. It retains 0.1.40's task provenance, system credential storage, image delivery, thumbnails, work titles, history stability and interruption controls. Handset re-entry, rendering and white-screen acceptance remain separate.
+Version **0.1.42** adds exact DSH `0.2.2-rc.2` compatibility, retaining 0.1.41's historical ordinary-fork handling, task provenance, credential storage, image delivery, thumbnails, work titles, history stability and interruption controls. Cindy's handshake identity is unchanged. Handset re-entry, rendering and white-screen acceptance remain separate.
 
-It supports the exact **DSH 0.2.2-rc.1** carrier, while retaining `0.2.2-alpha.2`, `0.2.1-rc.3`, `0.2.1-rc.4` and `0.2.1-rc.5`. DSH 0.2.2 requires **Node.js >=24.9** (RC tested with 24.18); the older carriers retain this plugin's Node.js >=22.16 minimum. Agent/session/settings peers and alpha Schemastery are explicitly allowed, not a blanket promise for future prereleases. RC validation covers isolated Web installation and runtime smoke; the prior alpha checks cover core contracts. Neither establishes relay or handset acceptance. Install through the Desktop DSH plugin manager. CLI-managed profiles can use:
+It supports the exact **DSH 0.2.2-rc.1 and 0.2.2-rc.2** carriers, while retaining `0.2.2-alpha.2`, `0.2.1-rc.3`, `0.2.1-rc.4` and `0.2.1-rc.5`. DSH 0.2.2 requires **Node.js >=24.9**; older carriers retain this plugin's Node.js >=22.16 minimum. Agent/session/settings peers are explicitly allowed, not a blanket promise for future prereleases. RC.2 automated validation uses the actual native SDK, including Cordis/Gateway question arbitration, without a real account or handset. Installation, UI, relay and handset acceptance are distinct checks.
+
+The 0.1.42 candidate is distributed as a verified tarball until separately published. Add that tarball through the Desktop plugin manager; CLI-managed profiles can use:
 
 ```sh
-dsh plugin --profile <profile> add dsh-cindy-host@0.1.41
+dsh plugin --profile <profile> add <path-to-dsh-cindy-host-0.1.42.tgz>
 ```
 
 Reload the Host plugin after installation. A full DSH restart is separate. Keep existing Cindy sign-in, device identity and settings; do not run two Host processes with the same identity.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-cindy-host",
-  "version": "0.1.41",
+  "version": "0.1.42",
   "private": false,
   "description": "Cindy 手机客户端连接 DSH 的 Host 侧插件：会话/消息/审批/todo/goal 的手机通道，以及配套的设置卡片",
   "license": "MIT",
@@ -43,6 +43,23 @@
       "platform": "web"
     }
   },
+  "//dependencies": "只放宿主不提供的库。凭据存储不依赖原生 npm 模块：Linux/macOS 使用系统钥匙串，Windows 使用系统 DPAPI 加密并由 DSH 原生凭据服务持久化密文。",
+  "dependencies": {
+    "werift": "0.24.4",
+    "ws": "^8.21.3"
+  },
+  "//peerDependencies": "DSH 自己的包必须由宿主提供，绝不能声明成 dependency/optionalDependency：pnpm 会把它们**连同整代依赖图**装进 profile，宿主再组合这个混合体就起不来（实测：`^0.1.1-rc.2` 会把 28 个 0.1.1-rc.2 的包装进一个 0.1.5-rc.2 的宿主，profile 启动失败于 dsh-client-file-upload / dsh-session）。区间必须覆盖宿主那一代（semver 的预发布规则：`^0.1.1-rc.2` 匹配不到 `0.1.5-rc.2`），与生态里 dsh-codex / dsh-cost-meter 的写法一致；`0.2.0-rc.2` 需要 `>=0.2.0-rc.1 <0.3.0-0`。",
+  "peerDependencies": {
+    "@deepseek-ai/dsh-agent": "0.2.1-rc.3 || 0.2.1-rc.4 || 0.2.1-rc.5 || 0.2.2-alpha.2 || 0.2.2-rc.1 || 0.2.2-rc.2",
+    "@deepseek-ai/dsh-session": "0.2.1-rc.3 || 0.2.1-rc.4 || 0.2.1-rc.5 || 0.2.2-alpha.2 || 0.2.2-rc.1 || 0.2.2-rc.2",
+    "@deepseek-ai/dsh-settings": "0.2.1-rc.3 || 0.2.1-rc.4 || 0.2.1-rc.5 || 0.2.2-alpha.2 || 0.2.2-rc.1 || 0.2.2-rc.2",
+    "@deepseek-ai/schemastery": "^3.18.1 || 3.18.6-alpha.1"
+  },
+  "//peerDependenciesMeta": "**故意没有这个字段。** `@deepseek-ai/dsh-host-apiproxy` 曾经在这里标 optional，但 0.2 已经删掉了这个包，而 `evaluatePluginCompatibility` 会遍历 `peerDependencies` 的**每一个键且不查 `peerDependenciesMeta`**，所以只要它出现在 peers 里，`dsh plugin add` 就会直接拒绝安装（`installation rejected`），启动时 bundle 也会被静默跳过、`dsh-cindy-host` 行根本不会出现。该适配器本来就走惰性 `require` + 失败降级（见 src/dsh-plugin.js 的 apiProxy 分支），从 peers 里移除不改变任何运行时行为，只是让两道门禁都能正确判定。",
+  "devDependencies": {
+    "react": "^18.3.1",
+    "react-dom": "^18.3.1"
+  },
   "scripts": {
     "acceptance": "node tools/acceptance.mjs",
     "acceptance:sandbox": "node tools/acceptance.mjs --base http://127.0.0.1:3081",
@@ -60,22 +77,5 @@
     "test": "node --test",
     "test:file-peer": "node --test test/file-peer-rtc.test.js test/host-file-peer.test.js test/host-file-ice.test.js test/host-media-fetch.test.js test/file-peer-integration.test.js",
     "smoke:file-peer": "node tools/file-peer-rtc-smoke.mjs --manager"
-  },
-  "//dependencies": "只放宿主不提供的库。凭据存储不依赖原生 npm 模块：Linux/macOS 使用系统钥匙串，Windows 使用系统 DPAPI 加密并由 DSH 原生凭据服务持久化密文。",
-  "dependencies": {
-    "werift": "0.24.4",
-    "ws": "^8.21.3"
-  },
-  "//peerDependencies": "DSH 自己的包必须由宿主提供，绝不能声明成 dependency/optionalDependency：pnpm 会把它们**连同整代依赖图**装进 profile，宿主再组合这个混合体就起不来（实测：`^0.1.1-rc.2` 会把 28 个 0.1.1-rc.2 的包装进一个 0.1.5-rc.2 的宿主，profile 启动失败于 dsh-client-file-upload / dsh-session）。区间必须覆盖宿主那一代（semver 的预发布规则：`^0.1.1-rc.2` 匹配不到 `0.1.5-rc.2`），与生态里 dsh-codex / dsh-cost-meter 的写法一致；`0.2.0-rc.2` 需要 `>=0.2.0-rc.1 <0.3.0-0`。",
-  "peerDependencies": {
-    "@deepseek-ai/dsh-agent": "0.2.1-rc.3 || 0.2.1-rc.4 || 0.2.1-rc.5 || 0.2.2-alpha.2 || 0.2.2-rc.1",
-    "@deepseek-ai/dsh-session": "0.2.1-rc.3 || 0.2.1-rc.4 || 0.2.1-rc.5 || 0.2.2-alpha.2 || 0.2.2-rc.1",
-    "@deepseek-ai/dsh-settings": "0.2.1-rc.3 || 0.2.1-rc.4 || 0.2.1-rc.5 || 0.2.2-alpha.2 || 0.2.2-rc.1",
-    "@deepseek-ai/schemastery": "^3.18.1 || 3.18.6-alpha.1"
-  },
-  "//peerDependenciesMeta": "**故意没有这个字段。** `@deepseek-ai/dsh-host-apiproxy` 曾经在这里标 optional，但 0.2 已经删掉了这个包，而 `evaluatePluginCompatibility` 会遍历 `peerDependencies` 的**每一个键且不查 `peerDependenciesMeta`**，所以只要它出现在 peers 里，`dsh plugin add` 就会直接拒绝安装（`installation rejected`），启动时 bundle 也会被静默跳过、`dsh-cindy-host` 行根本不会出现。该适配器本来就走惰性 `require` + 失败降级（见 src/dsh-plugin.js 的 apiProxy 分支），从 peers 里移除不改变任何运行时行为，只是让两道门禁都能正确判定。",
-  "devDependencies": {
-    "react": "^18.3.1",
-    "react-dom": "^18.3.1"
   }
-}
+}

package/src/host-version.js

@@ -4,4 +4,4 @@
  */
 export const HOST_APP_VERSION = '0.1.82';
 /** Actual npm release, separate from the Cindy compatibility identity. */
-export const HOST_PLUGIN_VERSION = '0.1.41';
+export const HOST_PLUGIN_VERSION = '0.1.42';