dsh-completion-guard 0.9.0 → 0.11.0

package/docs/HOST_LOCK_UPGRADE.md

@@ -1,23 +1,23 @@
 # Upgrading the core host lock
 
-Version 0.9.0 requires DSH `>=0.2.0-rc.2` and qualified Cordis `>=4.0.4`. Fresh installations have no old-mode inventory to adopt; existing installations must preserve their old mode sources before any replacement. Follow this order:
+Version 0.11.0 requires DSH `>=0.2.1-rc.3` and qualified Cordis `>=4.0.4`. Fresh installations have no old-mode inventory to adopt; existing installations must preserve their old mode sources before any replacement. Follow this order:
 
 1. Stop the relevant host/session writers. For an **existing installation**, preserve the old installed package and sanitized effective-mode sources, then prepare the public persistence inventory and frozen receipt with the [prepared-candidate migration toolkit](ACTIVATION_MIGRATION.md), **before replacing DSH or Guard**. Unresolved old provenance stays pending. A **fresh installation with no old Guard sessions** skips this old-mode preparation.
-2. Upgrade DSH to `0.2.0-rc.2` or a later version, then install this Guard version, keeping writers stopped.
+2. Upgrade DSH to `0.2.1-rc.3` or a later version, then install this Guard version, keeping writers stopped.
 3. Rebuild the host lock for each profile with `inspect`, `inject` and `verify-dump` from the accepted package or matching prepared source. For a POSIX shell, the entry is `node /absolute/prepared-package/bin/dsh-completion-guard-host-lock.mjs`; pass the actual runtime/profile roots. A successful rebuild reads back `supported` with `audit_provenance` stating how the graph was established.
 4. For an **existing installation**, run mode `adopt` and `verify` with its frozen old receipt while writers remain stopped, **before starting any host**. Host-lock rebuilding does not perform adoption. For a fresh installation there is no old receipt to adopt.
 5. Start each Web/Headless/Desktop profile only after the applicable mode and host-lock checks pass. These checks do not require a running host.
 
-0.9.0 的全新安装没有旧模式需要采纳；已有安装必须在替换前保留旧来源。顺序为：先停相关写者，保存旧安装包和脱敏有效模式来源，以独立准备的候选工具冻结公开库存及旧收据；再升级 DSH、安装 Guard、重建宿主锁；保持写者停止，在启动任何宿主前完成旧收据 `adopt` 和 `verify`；最后按需启动。全新安装跳过旧模式准备与 adoption，未知旧来源仍保持 pending，宿主锁不替代模式核验。
+0.11.0 的全新安装没有旧模式需要采纳；已有安装必须在替换前保留旧来源。顺序为：先停相关写者，保存旧安装包和脱敏有效模式来源，以独立准备的候选工具冻结公开库存及旧收据；再升级 DSH、安装 Guard、重建宿主锁；保持写者停止，在启动任何宿主前完成旧收据 `adopt` 和 `verify`；最后按需启动。全新安装跳过旧模式准备与 adoption，未知旧来源仍保持 pending，宿主锁不替代模式核验。
 
 Failure readbacks distinguish these cases:
 
 - `host_lock_migration_required`: the configuration lacks the policy or source roots. Supply `--runtime-root` and `--profile-root` when rebuilding the lock.
-- `host_lock_version_below_minimum`: DSH is older than `0.2.0-rc.2`. Upgrade DSH first.
+- `host_lock_version_below_minimum`: DSH is older than `0.2.1-rc.3`. Upgrade DSH first.
 - `host_lock_version_mismatch`: the installed graph differs from the reviewed baseline in version or integrity. For a later compatible version, use `--rebind-registry` to acquire and qualify the published graph. For the baseline, restore the recorded identities.
 - `host_lock_installed_graph_drift`: installed bytes or routes changed after the audit. Inspect the change before rebuilding the lock.
 
-The floor is `>=0.2.0-rc.2` with no upper bound. Passing the version check does not establish native validation; validated versions are recorded separately. Guard's exact DSH core is separate from optional market versions.
+The floor is `>=0.2.1-rc.3` with no upper bound. Passing the version check does not establish native validation; validated versions are recorded separately. Guard's exact DSH core is separate from optional market versions.
 A normal market update no longer changes the core digest. A plugin that changes
 which core packages actually resolve still invalidates the lock.
 
@@ -58,6 +58,14 @@ protected entry. Order: stop the host, upgrade DSH and install Guard, inspect/in
 managed block in that file. Back the file up first. The same file is the one
 `docs/LOCAL_ACCEPTANCE.md` tells you to preserve.
 
+The patch must be one YAML array of mapping entries. `inject` preserves user entries in ordinary block YAML (including inline flow values) and JSON-shaped flow sequences. For a JSON sequence, the managed entry is inserted inside the closing bracket with YAML comment markers; the result remains a `.yml` flow sequence, not a strict JSON document. User entries are not reserialized. The reserved begin/end markers must each occupy their own line and occur only once.
+
+Before writing a temporary file, `inject` parses the original, unmanaged base and proposed output, then checks that the output preserves the base entries and adds exactly its managed entry. Invalid syntax, duplicate mapping keys, ambiguous Guard configurations, mismatched names, malformed markers and boundaries that prevent safe insertion are refused without changing the profile or an existing temporary file. Parsing uses the SDK's non-executing YAML dialect: `!!js` scalars remain expression data and are never evaluated by `inject`. This is syntax and injection-safety validation; plugin configuration, full composition and actual host loading still require the later checks below.
+
+配置文件须为由 mapping 条目组成的单个 YAML 数组。`inject` 保留普通 block YAML（包括字段内的 flow 对象和数组）及 JSON 形式的 flow 序列。输入为 JSON 序列时，受管条目连同 YAML 注释标记插入右方括号内；输出仍是 `.yml` flow 序列，不再是严格 JSON 文档。用户条目不会重新序列化。保留的起止标记须独占一行，且各出现一次。
+
+`inject` 在创建临时文件前解析原文件、移除受管区后的内容和拟写入结果，并核对结果只在原有条目后加入受管条目。语法错误、重复 mapping key、歧义 Guard 配置、包名不符、标记损坏或无法安全插入的文档边界都会在写入前拒绝；profile 和已有临时文件均保持不变。解析沿用 SDK 的非执行 YAML 方言，`!!js` 标量只保留为表达式数据，`inject` 不执行它。该步骤只核验语法与注入安全，插件配置、完整组合配置和真实宿主载入仍须经过下述检查。
+
 **Check both the JSON verdict and the exit status.** Accepted commands print `status: "supported"`. A missing graph, drift, incompatible implementation or untrusted registry description reports a specific `reason_code` on stderr and exits 1. `inspect-graph` is a pre-install graph check; it does not grant runtime authority.
 
 For Headless, use its profile path for the host-lock commands and `dsh --profile headless --dump-config` for the dump. On Windows, use the
@@ -76,7 +84,7 @@ The result labels `inspection_scope: pre_install_target` and `profile_graph.stat
 ## What changes in the lock
 
 The generator writes `hostLockPolicy: dsh-core/v1`, the actual runtime/profile
-source roots, platform/profile kind and the actual core package graph (46 rows in the reviewed baseline). The
+source roots, platform/profile kind and the actual core package graph (47 rows in the reviewed baseline). The
 core manifest is version 2. Each session mount validates those graph sources
 exactly once; ordinary replay (resume, compaction, step and command refresh)
 consumes that result without rescanning, and every entry that grants
@@ -84,7 +92,7 @@ certificate authority — completion certificates, mutation authorization,
 release pre-effect decisions and Goal/Stop boundaries — validates the lock
 freshly at the moment of its own decision.
 
-Version 0.9.0 registers `dsh-0.2.0-rc.2-core-v1` as the audited baseline cohort and derives graph cohorts for compatible hosts above the version floor (see the compatibility guide). Runtime checks authenticate the mapped files and verify that each critical dependency resolves to the mapped instance. Installation imports use native Node resolution; Profile imports use the host's local-first routing and installation fallback only when no local package is selected. A nearer shadow, missing edge, wrong export target or escaped path is rejected even when the recorded versions match.
+Version 0.11.0 uses `dsh-0.2.1-rc.3-core-v1` as the current audited baseline cohort and derives graph cohorts for compatible hosts above the version floor (see the compatibility guide). Runtime checks authenticate the mapped files and verify that each critical dependency resolves to the mapped instance. Installation imports use native Node resolution; Profile imports use the host's local-first routing and installation fallback only when no local package is selected. A nearer shadow, missing edge, wrong export target or escaped path is rejected even when the recorded versions match.
 
 The manifest's `registry-derived-pending-native-audit` provenance and empty `auditedPlatforms` list describe its immutable source audit, which is part of the lock digest. Native acceptance belongs to each exact artifact's separate Release annexes; it does not rewrite that digest. Inspection, injection and dump verification report `audit_provenance` alongside the cohort and digest.
 
@@ -103,14 +111,14 @@ that matters for deciding whether you are migrating or just drifting:
   a DSH upgrade, and both are cured by re-running inspect, inject and verify against
   the new runtime rather than by editing the lock.
 
-Historical requirements and session records are retained; old certificates do not become certificates for the new lock. Historical host cohorts are test data only and are not accepted by 0.9.0.
+Historical requirements and session records are retained; old certificates do not become certificates for the new lock. Earlier host identities, including rc.2, remain historical evidence and are not accepted below the 0.11.0 floor.
 The shared digest-v3 encoder and its upstream fixtures are unchanged.
 
 ## Official Desktop profile
 
 Stop the Desktop app before installing or rebuilding its lock. Use the CLI carrier shipped with that app: `Contents/Resources/runtime/cli/bin/dsh` on macOS, or `resources\runtime\cli\bin\dsh.cmd` in the Windows installation. A separately installed `dsh` CLI cannot manage the reserved Desktop profile.
 
-For an existing installation, first preserve the old package/effective modes and freeze the inventory/receipt before replacing the carrier or Guard; after replacement, complete adoption/verification before Desktop startup. For a fresh installation there is no old-mode adoption. Install Guard through that carrier with `plugin --profile desktop add dsh-completion-guard@0.9.0`. Use the profile's own host-lock tool and the app's physical `app.asar` as `--runtime-root`. The default profile is `$DSH_HOME/profiles/desktop`, or `.dsh/profiles/desktop` under the user's home when `DSH_HOME` is unset. This POSIX example starts after installation:
+For an existing installation, first preserve the old package/effective modes and freeze the inventory/receipt before replacing the carrier or Guard; after replacement, complete adoption/verification before Desktop startup. For a fresh installation there is no old-mode adoption. Install Guard through that carrier with `plugin --profile desktop add dsh-completion-guard@0.11.0`. Use the profile's own host-lock tool and the app's physical `app.asar` as `--runtime-root`. The default profile is `$DSH_HOME/profiles/desktop`, or `.dsh/profiles/desktop` under the user's home when `DSH_HOME` is unset. This POSIX example starts after installation:
 
 ```sh
 DSH_DESKTOP_ASAR=/absolute/path/to/DeepSeek-Harness.app/Contents/Resources/app.asar
@@ -124,6 +132,8 @@ GUARD_DESKTOP_LOCK="$DSH_DESKTOP_PROFILE/node_modules/.bin/dsh-completion-guard-
 
 On Windows use the `.cmd` host-lock launcher and the installation's `resources\app.asar` path. `dump-desktop` authenticates the carrier and uses the app's bundled configuration APIs to compose the same bundle/profile/home layers, without starting a host. It writes the profile's empty loader anchor as the official dump API does. Preserve any composed output privately because user configuration may contain secrets; it is not a Release attachment.
 
+`verify-dump` checks the injected Guard host-lock fields against the active graph (`verification_scope: guard_host_lock_fields`); it does not parse or validate every other entry in the composed configuration (`configuration_syntax: not_checked`). A supported lock readback cannot certify that the entire YAML is complete or that the host can load it. Keep the composed output private and require the official complete configuration parser and actual host loading as subsequent checks.
+
 Check `supported` on inspect, inject and verify-dump. Keep Desktop stopped until all checks pass, then open the app when needed. Guard never edits the app archive or restarts the graphical app.
 
 The official plugin market (`dshmarket`) can be installed into the same Desktop profile through the official management entry; its package name neither conflicts with the Desktop bundle tuple nor grants any trust. Installing or removing the market changes the profile's importer, so the previous Desktop lock stops matching (`host_lock_installed_graph_drift`) and must be rebuilt with the full four-step flow: `inspect`, then `inject`, then generate a NEW composed dump with `dump-desktop`, then verify that new dump with `verify-dump --dump-config <new file>`. `dump-desktop` only composes a configuration for readback; it never substitutes for `verify-dump`. Verify the dump generated after this rebuild — a dump captured before the market change no longer matches and must be discarded. Rebuild the lock on this machine; a lock or digest copied from another profile or machine is not valid evidence. Desktop restart stays unsupported regardless of coexistence.
@@ -159,7 +169,7 @@ exact artifact and platform; publication is recorded on its GitHub Release.
 
 ## Historical 0.5.1 evidence
 
-Version 0.5.1 registered DSH `0.1.5-rc.1` and `0.1.5-rc.2` with 33 critical packages. Its macOS and Windows results belong only to that artifact and those hosts; see the [0.5.1 release annexes](https://github.com/GreenLv/dsh-completion-guard/releases/tag/v0.5.1). These are historical records, not installation targets for 0.9.0.
+Version 0.5.1 registered DSH `0.1.5-rc.1` and `0.1.5-rc.2` with 33 critical packages. Its macOS and Windows results belong only to that artifact and those hosts; see the [0.5.1 release annexes](https://github.com/GreenLv/dsh-completion-guard/releases/tag/v0.5.1). These are historical records, not installation targets for 0.10.0.
 
 ## Rebinding compatible package versions
 
@@ -179,9 +189,9 @@ Rebinding writes only its qualification receipt and, for `inject`, the managed l
 
 ## 0.9.0 session modes / 会话模式
 
-This is a major default-mode change for new root sessions only. Preserve old effective modes before replacing Guard, then use [activation inspect/adopt/verify](ACTIVATION_MIGRATION.md). Host-lock rebinding does not migrate modes or re-sign certificates. Existing bindings override defaults; explicit conflicts refuse. `standard` and persisted off/on retain their contracts. Missing modes remain unknown. Rollback and the current Windows storage capability gap are described in that guide.
+The default-mode change introduced in 0.9.0 applies only to new root sessions and remains in 0.10.0. Preserve old effective modes before replacing Guard, then use [activation inspect/adopt/verify](ACTIVATION_MIGRATION.md). Host-lock rebinding does not migrate modes or re-sign certificates. Existing bindings override defaults; explicit conflicts refuse. `standard` and persisted off/on retain their contracts. Missing modes remain unknown. Rollback and the current Windows storage capability gap are described in that guide.
 
-本次只改变新建根会话的默认模式。更换 Guard 前保存旧有效模式，再按迁移说明清点、采纳及核验。重绑宿主锁不迁移模式、不重签证书；已有绑定覆盖缺省，显式冲突拒绝。standard 及持久化 off/on 合同不变，缺失模式保持 unknown，回退及 Windows 存储能力缺口见该说明。
+0.9.0 引入的默认模式变化只适用于新建根会话，0.10.0 继续保留该规则。更换 Guard 前保存旧有效模式，再按迁移说明清点、采纳及核验。重绑宿主锁不迁移模式、不重签证书；已有绑定覆盖缺省，显式冲突拒绝。standard 及持久化 off/on 合同不变，缺失模式保持 unknown，回退及 Windows 存储能力缺口见该说明。
 
 ## Old-format migration refusals / 旧格式迁移拒绝
 

package/docs/LOCAL_ACCEPTANCE.md

@@ -1,8 +1,16 @@
 # Local Acceptance
 
-## 0.8.3 RC.2 and Desktop acceptance
+## 0.11.0 / DSH 0.2.1-rc.3 candidate contract
 
-The candidate keeps the 0.8.x task, certificate and data protocols. Its host floor remains DSH `0.2.0-rc.2`; use the [upgrade guide](HOST_LOCK_UPGRADE.md) before establishing a new lock. The historical [RC.2/Desktop development plan](https://github.com/GreenLv/dsh-completion-guard/blob/563f144bf8568793da5017b9ff71395a33dcd265/docs/DEVELOPMENT_PLAN_DSH_0_2_0_RC2_DESKTOP.md) records the original adaptation scope; the current source, portability, exact-package, native, model and reader gates are defined below and in the repository instructions.
+The current source requires DSH `>=0.2.1-rc.3`, with rc.3 as its default audited host graph. The task, certificate and data protocols and the existing Web/Headless and Desktop gate sets remain in force. Use `--desktop-cohort 0.2.1-rc.3` for this candidate's Desktop entry. Follow the [host-lock upgrade](HOST_LOCK_UPGRADE.md) and [old-session migration](ACTIVATION_MIGRATION.md) instructions before replacing an installation.
+
+The floor change creates new package bytes. Source, CI, exact tgz identity, each platform's native installation/lifecycle, real-model and GUI/performance results must name that new subject; earlier rc.2 observations remain attached to their original source and artifact. This section states the contract, not a passing execution or publication. The versioned sections below retain their historical scope, including 0.10.0's rc.2 floor and original command examples.
+
+当前源码的 DSH 下限与默认审查基线为 `0.2.1-rc.3`。旧会话及数据协议保持兼容，Web/Headless 与 Desktop 原有门禁不变；本候选的 Desktop 入口使用 `--desktop-cohort 0.2.1-rc.3`。下限变更产生新的包字节，源码、CI、制品、双平台原生、模型及 UI/性能证据必须分别绑定新身份。下文旧版本记录保留原范围，不改标为本候选通过。
+
+## 0.10.0 / DSH 0.2.1-rc.2 acceptance contract
+
+Guard 0.10.0 retains the existing task, certificate and data protocols. This section defines the current acceptance contract; it does not report a passing native, model or GUI run. Its host floor is DSH `0.2.1-rc.2`; use the [upgrade guide](HOST_LOCK_UPGRADE.md) before establishing a new lock. The historical [RC.2/Desktop development plan](https://github.com/GreenLv/dsh-completion-guard/blob/563f144bf8568793da5017b9ff71395a33dcd265/docs/DEVELOPMENT_PLAN_DSH_0_2_0_RC2_DESKTOP.md) records the original adaptation scope; the current source, portability, exact-package, native, model and reader gates are defined below and in the repository instructions.
 
 Run the repository entrypoint twice for each native platform, always with the same frozen tgz and source commit. `host_bound_v070` covers Web/Headless. `desktop_bound` takes the physical app archive as `--runtime-root` and the exact DSH version as `--desktop-cohort`; it creates an isolated profile and uses the signed app's bundled CLI and actual Electron Node backend. Pass `--preflight` to each intended command before execution, with distinct unused external output and transfer-receipt paths.
 
@@ -12,7 +20,7 @@ pnpm 11.7.0 builds hoisted-location mappings asynchronously and writes their ins
 
 The backend annex also covers carrier/graph authentication, installation parity, injection and real composed readback, loaded Guard behavior, graceful stop, uninstall and cleanup. It expressly skips `graphical_shell` and `real_model_request`. Those skips require separate GUI/model evidence before the complete Desktop release gate closes. Portable tests, source composition against a real archive and a backend annex cannot substitute for those observations.
 
-每个平台分别运行 Web/Headless 与 Desktop 原生入口，绑定同一份最终 tgz、源码提交及摘要。Desktop 使用 `--gate-profile desktop_bound --runtime-root <app.asar> --desktop-cohort 0.2.0-rc.2`，先加 `--preflight` 做同一次调用环境的能力预检，再去掉该参数执行。该入口在隔离 profile 中验证官方载体、安装字节、单包严格字节 no-op、多包 JSON 值等价、组合配置、实际加载与卸载，并输出独立 annex；它不启动图形界面、不请求真实模型，二者须单独补齐。具体结果留在对应制品的外部回执和 Release 附件，避免文档自引用造成制品身份变化。
+每个平台分别运行 Web/Headless 与 Desktop 原生入口，绑定同一份最终 tgz、源码提交及摘要。Desktop 使用 `--gate-profile desktop_bound --runtime-root <app.asar> --desktop-cohort 0.2.1-rc.2`，先加 `--preflight` 做同一次调用环境的能力预检，再去掉该参数执行。该入口在隔离 profile 中验证官方载体、安装字节、单包严格字节 no-op、多包 JSON 值等价、组合配置、实际加载与卸载，并输出独立 annex；它不启动图形界面、不请求真实模型，二者须单独补齐。具体结果留在对应制品的外部回执和 Release 附件，避免文档自引用造成制品身份变化。
 
 ## 0.8.0 rc.2 source-stage snapshot
 

package/docs/PRIVACY.md

@@ -17,12 +17,26 @@ Context Guard stores only bounded, deterministic facts. It does not persist prom
 ## Never stored
 
 - Complete prompts, stdout, stderr, or file contents.
-- Authorization headers, URL query values, credentials, or API keys.
+- Authorization headers, URL query and fragment values, URL `user:password`
+  userinfo, credentials, or API keys.
 - Image bytes or binary contents.
 - Authenticated session state or raw transcripts.
 - Raw Session IDs, local paths, prompts, command output, or credential values in
   the private ledger; those bindings are stored only as SHA-256 values.
 
+## Redaction scope
+
+Before normalized text or URL evidence subjects are stored, the sanitizer
+removes, by structure: `Authorization`-style header values, quoted and bare
+`key=value` secret fields (including unclosed quotes), bearer tokens, the
+`sk-`/`pk-`/`ak-` key family, the GitHub token spellings (`ghp_`/`gho_`/`ghu_`/
+`ghs_`/`ghr_`/`github_pat_`), and URL userinfo plus query/fragment. This is a
+bounded, documented pattern set, NOT a guarantee that every secret format is
+recognized: credentials embedded in ordinary prose, non-listed token families,
+or URL path segments are outside what structural redaction can see. The
+sanitization is deterministic and idempotent; evidence recorded by older
+versions keeps its recorded digests and is not silently recomputed.
+
 ## Failure behavior
 
 - Unknown, failed, or object-mismatched evidence cannot certify completion.

package/docs/README.md

@@ -2,7 +2,7 @@
 
 For installation and upgrades, start with [host-lock upgrades](HOST_LOCK_UPGRADE.md) and [compatibility](COMPATIBILITY.md). [Distribution](distribution.md) lists package channels. [Local acceptance](LOCAL_ACCEPTANCE.md) distinguishes source checks, installed-artifact results and their limits.
 
-For maintenance, use [architecture](ARCHITECTURE.md), [privacy](PRIVACY.md), the [writer-lock protocol](WRITER_LOCK_PROTOCOL.md), and [historical incident coverage](HISTORICAL_INCIDENT_COVERAGE.md). The [core alignment contract](CORE_ALIGNMENT_CONTRACT_V2.md), [semantic compatibility](SEMANTIC_COMPATIBILITY.md), [upstream base](UPSTREAM_BASE.md), and [porting notes](PORTING_NOTES.md) explain shared semantics and product boundaries. [Third-party licenses](THIRD_PARTY_LICENSES.md) records attribution.
+For maintenance, use [architecture](ARCHITECTURE.md), [privacy](PRIVACY.md), the [writer-lock protocol](WRITER_LOCK_PROTOCOL.md), [historical incident coverage](HISTORICAL_INCIDENT_COVERAGE.md), and the [dependency advisory gate](DEPENDENCY_SCAN.md). The [core alignment contract](CORE_ALIGNMENT_CONTRACT_V2.md), [semantic compatibility](SEMANTIC_COMPATIBILITY.md), [upstream base](UPSTREAM_BASE.md), and [porting notes](PORTING_NOTES.md) explain shared semantics and product boundaries. [Third-party licenses](THIRD_PARTY_LICENSES.md) records attribution.
 
 ## Historical development material
 

package/docs/THIRD_PARTY_LICENSES.md

@@ -1,4 +1,4 @@
-# Bundled third-party license
+# Bundled third-party licenses
 
 The runtime bundles Acorn 8.15.0 for ECMAScript program parsing. Its license is reproduced below.
 
@@ -25,3 +25,31 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 ```
+
+## js-yaml 4.3.2
+
+The runtime bundles js-yaml 4.3.2 for non-executing profile-patch parsing during explicit host-lock injection. Its MIT license follows.
+
+```text
+(The MIT License)
+
+Copyright (C) 2011-2015 by Vitaly Puzrin
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+```

package/docs/UI_PERFORMANCE.md

@@ -0,0 +1,75 @@
+# Measure session switching on isolated rc.2/rc.3 frontends
+
+This is repository operator tooling. Run these scripts from the accepted source checkout; they are not commands supplied by the npm plugin. The browser and DSH host must belong to the same disposable acceptance batch. Do not point the driver at your daily browser/profile.
+
+Create a new fixture HOME and manifest before initializing its Web profile:
+
+```sh
+node scripts/create-ui-session-fixture.mjs --home <unused-task-home> \
+  --frontend-url http://127.0.0.1:<assigned-port>/ \
+  --source-commit <full-accepted-commit> --artifact-sha256 <accepted-tgz-sha256> \
+  --output <new-fixture.json> --host-version 0.2.1-rc.3 \
+  --prelude-turns 100 --distribution tool --output-bytes 4096
+```
+
+The producer creates a task-owned plan with two independent session IDs and unique history markers; it refuses existing HOME/output paths. It deliberately leaves session creation to the loaded host. `prelude-turns` accepts 0–10000; `distribution roots` creates independent root requests, while `distribution tool` adds three synthetic tool round trips per prelude turn with one output of `output-bytes` (0–1048576). These are persisted frames; no command is executed. The final marker adds one turn. Each completed history records actual event count, serialized event bytes, root input count/density and tool-result count. Preserve the manifest and producer hash.
+The versioned preparation entrypoint installs the supplied canonical tgz through the official managed CLI, checks its embedded source/version, runs inspect → inject → dump → verify-dump from the installed Guard, and can keep the isolated Web host running. `verify-dump` validates only Guard host-lock fields, not the complete YAML syntax or other plugin entries; the preparation also parses the complete composed configuration through the official boot API before starting a host:
+
+```sh
+node scripts/prepare-ui-session-fixture.mjs --fixture <fixture.json> \
+  --runtime-root <managed-runtime-root> --artifact <accepted.tgz> \
+  --artifact-record <release-artifact.json> --output <new-preflight.json> --preflight
+node scripts/prepare-ui-session-fixture.mjs --fixture <fixture.json> \
+  --runtime-root <managed-runtime-root> --artifact <accepted.tgz> \
+  --artifact-record <release-artifact.json> --output <new-preparation.json> --serve
+```
+
+Use distinct new result paths. Preflight reads the canonical artifact identity and probes a child in that invocation; it does not install or start a host. The actual run uses this fixture's `DSH_HOME/sessions` and `profiles/web`, strips ambient credential environment layers, binds HOME and platform user directories to the task, disables title/account/other-provider routes after checking the actual composed config, disables telemetry/background Goal driving, and points the inert model route at a closed loopback endpoint. Only anonymous HTTP(S) proxies with explicit loopback ports may enter from the invocation environment; credentials, non-loopback routes and conflicting uppercase/lowercase aliases are refused. Proxy variables are canonicalized and NO_PROXY is limited to loopback. No proxy port is discovered and TLS remains enabled. It does not send a model request. After Guard loads, the fixture plugin uses the official AgentRegistry to create both sessions, requires actual `fresh_creation` / `always` bindings and the registered Guard tool, writes history, flushes, disposes the seed agents, and reopens each official persistence reader to verify its ID and marker. It exports `<new-preparation.json>.protected-fixture.json`. The `.ready.json` records these checks; the driver still verifies rendered identities and the live agent after official UI promotion through the task-owned read-only observer. A missing or inactive Guard fails the run rather than measuring a mode-unknown path. Preserve the private host log. Signal the preparation process after measurement; it stops only its owned process tree, reports cleanup failure, and preserves the HOME/results. This preparation record does not replace the repository's native-acceptance/v2 install/no-op/parity/lifecycle annex.
+
+Start a task-owned browser with an explicit loopback CDP endpoint through the native platform's supported launcher. Do not disable its sandbox. The browser owner retains its PID/profile and stops it after measurement. These startup/installation operations remain native steps and do not become passing facts because fixture creation succeeded. Never reuse a daily host, hard-code its port, repack the artifact, or send messages to seed markers.
+
+Then run:
+
+```sh
+node scripts/measure-session-switch.mjs --fixture <new-preparation.json>.protected-fixture.json \
+  --web-preparation <new-preparation.json>.ready.json \
+  --cdp-url http://127.0.0.1:<browser-debug-port>/ \
+  --output <new-measurement.json> --switches 100
+```
+
+For Web, `--web-preparation` must name this live run’s ready receipt. The driver verifies the receipt against the fixture and owned process, reads the unique same-origin startup URL from the private run log, and uses the official token-to-cookie exchange. The driver reads the startup URL from the private host log into memory and does not copy it into measurement reports; the original startup log remains private. Measurement reports retain only the clean frontend URL and receipt hash. Authentication stays enabled. After an observer restart, supply `<new-observer-run.json>.ready.json`, rather than the seed run’s ready receipt. Desktop does not use this option.
+
+The driver creates one browser tab and closes it on success, failure or handled interruption. Web uses a fixed 1440×1000 CDP viewport and records the actual dimensions; Desktop retains and records its native window dimensions. Before the first timed session open, it acknowledges only the reviewed official preview notice through its Continue button, opens the sidebar if needed, and expands the fixture’s Ungrouped row through pointer events. It waits for the exact two session IDs and expanded state; unknown dialogs, duplicate controls and failed transitions fail closed. Readiness actions and epochs are reported separately. An outer host-launch-to-completion measurement includes this preparation time; it is not subtracted from startup latency. It never starts or stops the browser/DSH host. It clicks the official session tree rows (`data-row-key`, `aria-selected`), reads visible history inside `data-chat-flow`, waits for the reviewed loading hint to disappear, and inserts a probe through browser input events into the official `data-composer-input` editor. The fixture must have empty drafts; the probe is removed and the empty draft read back before a sample is accepted. Overall interactivity ends at successful input readback; draft cleanup time is recorded separately. Loading appearance/disappearance and observed duration are separate fields, or null when no indicator appeared. No Enter/send action occurs. The other history's unique marker is a negative control. A missing session row must be refused without changing the active session. Unknown layouts/identity, load errors, unobservable input, failed controls, timeouts and too few samples fail nonzero. Failed runs retain a result; they are not timing passes.
+
+The public attributes and loading/error classes are bound to the reviewed rc.2 and rc.3 workspace, chat and conversation frontend components. Their relevant DOM components/selectors were compared before sharing this adapter; other versions are refused. An unknown new layout requires an explicit adapter review, not a guessed successful field. Protocol/control unit tests are not rendered frontend or native evidence: a real browser smoke run is still required for each applicable host.
+
+For formal performance acceptance, retain the agreed same-host baseline/candidate inputs, fixed A/A noise, paired/interleaved order, at least 30 cold and 100 warm samples per required cell, P50/P95, one-sided 95% bounds, lifecycle/RSS checks, and actual history scales. `--switches` only collects one warm tab's sequence; it does not label samples cold or run those statistical gates. The native owner must stop its own host/browser before removing the owned HOME and report cleanup separately. Desktop GUI acceptance requires its supported isolated carrier/CDP route; a Web result does not certify Desktop.
+
+For the 0.11.0 comparison, use isolated rc.2 hosts for the paired 0.10.0/candidate regression cells: the public 0.10.0 baseline does not qualify rc.3 Desktop. Run rc.3 GUI, latency and lifecycle acceptance separately and retain that missing valid baseline boundary. Do not weaken baseline admission, downgrade daily hosts, or call the separate rc.3 timings a paired regression pass.
+
+The driver also exports `initialOpen`, separate from its warm sequence: the first click's epoch, click-to-input-readback time, input completion epoch, loading observations and whether that target was already live before selection. It never labels this record cold. For a cold run, create and persist the fixture in a separate seed process, stop that process, and start a new observer-only host. Require `initialOpen.preClickTargetLive === false` and the outer launcher's fresh-process evidence; use the recorded completion epoch with the launch epoch for startup-inclusive timing. Do not seed, append, promote, or read the target's full history in that cold process before the GUI opens it.
+
+For Web, reuse the original plan and exact seed receipt in a new preparation run:
+
+```sh
+node scripts/prepare-ui-session-fixture.mjs --fixture <original-plan.json> \
+  --runtime-root <managed-runtime-root> --artifact <accepted.tgz> \
+  --artifact-record <release-artifact.json> --output <new-observer-run.json> \
+  --mode observe --seed-fixture <seed-preparation.json>.protected-fixture.json \
+  --seed-sha256 <sha256-of-that-protected-fixture> --serve
+```
+
+This mode skips installation and injection, rechecks the installed identity, and supplies the probe's explicit `mode: observe`. The probe verifies nonce, source/artifact, HOME/profile, host version, producer/probe bytes and existing fresh-creation bindings; it refuses already-live fixture agents. It registers only the read-only live observer, without creating, appending, promoting or reading either session history. It writes a new observer-ready receipt and preserves the seed receipt. Unknown modes and changed/missing identities or bindings fail closed. Actual process isolation, cold state and restoration remain native observations.
+
+For Desktop, create the plan with `--surface desktop --frontend-url dsh-app://app/`. The Web preparation command does not prepare or launch Desktop. The native acceptance owner supplies a qualified isolated Desktop profile with the same frozen artifact, `activation: always`, and the `scripts/ui-session-host-fixture.mjs` plugin. Its config binds `fixturePath`, `runtimeRoot` (`app.asar/dsh`), the installed injected `guardConfig`, and a new `output` seed receipt. After the separate seed process stops, use explicit `mode: observe`, that same `output`, `seedReceiptSha256`, and a distinct new `runOutput`. The probe checks the physical Desktop carrier lock separately from its SDK namespace. The existing versioned Desktop install/no-op/lock workflow remains the preparation contract; a handwritten profile or fabricated anchors are not equivalent.
+
+The native launcher must use a task-owned `DSH_HOME`, a new `<fixture-home>/desktop-user-data`, the official signed executable and a dedicated loopback CDP endpoint. It must bind actual process ownership and the main renderer before writing a `dsh-ui-desktop-owner/v1` receipt with `fixtureNonce`, `sourceCommit`, `hostVersion`, absolute `home` and `userDataDir`, exact `cdpUrl`, `rendererUrl: "dsh-app://app/"`, `targetId`, `processId` and `carrierSha256`. Keep that native launch evidence with the receipt. The driver validates the receipt's identity fields; it does not claim those declarations independently prove the launcher/process arguments.
+
+```sh
+node scripts/measure-session-switch.mjs --fixture <desktop-protected-fixture.json> \
+  --cdp-url http://127.0.0.1:<owned-desktop-debug-port> \
+  --desktop-ownership <native-owner-receipt.json> \
+  --output <new-desktop-measurement.json> --switches 100
+```
+
+The Desktop driver attaches only to that existing `dsh-app://app/` main renderer, verifies its exact URL and detaches afterwards. It never creates or closes a Desktop window. A new file tab cannot use the application's main-frame IPC and is refused. Custom-protocol URLs are compared explicitly; their `null` URL origins are never treated as equal. The task-owned live observer uses the application's actual protocol handler to reach its registered read-only backend route. The native owner handles any welcome-screen transition through the official UI, verifies that fixture targets were not preopened, and stops only its isolated process tree after measurement. Unit transport controls establish neither a rendered Desktop pass nor native cleanup.

package/manifests/desktop-distribution.v1.json

@@ -0,0 +1,163 @@
+{
+  "schema": "dsh-desktop-distribution-qualification/v1",
+  "provenance": {
+    "repository": "https://github.com/deepseek-ai/deepseek-harness",
+    "sourceCommit": "3dce1c93d04494376118d574b862d51a7d2ec2f1",
+    "removalCommit": "f028f25667dbf378c83da80fbb29685b197d00e3",
+    "compiler": "TypeScript 5.9.3",
+    "compilerOptions": {
+      "target": "ES2024",
+      "module": "ESNext",
+      "sourceMap": true,
+      "rewriteRelativeImportExtensions": true,
+      "verbatimModuleSyntax": false
+    },
+    "scope": "Exact Desktop distribution supplements only; these are not registry package inventories. The declared Desktop build commit is an opaque signed identity, not a claim that it equals the public source pin.",
+    "rc3Acquisition": {
+      "observedDate": "2026-10-25",
+      "method": "official CDN zip downloaded, SHA-512 recorded, codesign --verify --deep --strict passed (TeamIdentifier NAN929V4UM, identifier com.deepseek.dsh), ASAR header recomputed and matched the independently verified local install header, desktop manifest and desktop-runtime.json extracted from the archive",
+      "zipSha256": "599a3ceef4d58f2b82bfd61ca4ef9d55c0f8e055dde60550c92f00d78d0cad2f",
+      "asarHeaderSha256": "84140c5d09050010753077cde3c8e35fc2e050054f1ed69f761fae8b6fdd4b95",
+      "invariantCompanions": "none present in the rc.3 distribution ASAR; `files` remains the rc.2-only supplement set and is consumed only by the rc.2 rows",
+      "windows": "Windows installed carrier and retained official installer Authenticode Valid; signed ElectronAsar/Integrity equals measured header; root/runtime manifests and metadata match signed header integrity; retained installer size and SHA-512 equal official win-x64 nightly updater metadata (2026-10-26). Native Guard install/no-op/lifecycle acceptance is separate."
+    }
+  },
+  "files": [
+    {
+      "package": "@deepseek-ai/dsh-agent",
+      "version": "0.2.1-rc.2",
+      "path": "lib/types/invariant.js",
+      "bytes": 1058,
+      "sha256": "ff96b77450ecd0b7b75d94e7aa07f073e7d378924f2484866a6a04ffe4542bc3",
+      "sourcePath": "packages/core/agent/src/invariant.ts",
+      "sourceSha256": "9ddb2ac93ba30f723d3d80d5ec0c9d5d645c879e6b6c051ec5408e656dd5fec6"
+    },
+    {
+      "package": "@deepseek-ai/dsh-session",
+      "version": "0.2.1-rc.2",
+      "path": "lib/types/invariant.js",
+      "bytes": 8982,
+      "sha256": "975e1640ad5dba930b6031315ee7d98dd01151155d2db7e993021de1feef4f32",
+      "sourcePath": "packages/core/session/src/invariant.ts",
+      "sourceSha256": "f1dda850ed2abad99f773d13dc21aca335a81bbfef86a63a0aa407248eeab000"
+    },
+    {
+      "package": "@deepseek-ai/dsh-tools",
+      "version": "0.2.1-rc.2",
+      "path": "lib/types/invariant.js",
+      "bytes": 5628,
+      "sha256": "955311912d27f945c9298bc2add074b04fd04414312ef4f9dec92635639dd121",
+      "sourcePath": "packages/core/tools/src/invariant.ts",
+      "sourceSha256": "919744eaa6c1e6489a68a4ea3be9831e1e6c576a4a2fce96801d0a3a33ac2a79"
+    },
+    {
+      "package": "@deepseek-ai/dsh-goal",
+      "version": "0.2.1-rc.2",
+      "path": "lib/types/invariant.js",
+      "bytes": 3206,
+      "sha256": "2eda87df2fffc21e2f761b138d54c9be523627e3b41bd1508906be5cf69a410d",
+      "sourcePath": "packages/goal/goal/src/invariant.ts",
+      "sourceSha256": "92b2156e0ca89f98af1cf904bad892bd68efc986951c7697880132e9780155d1"
+    },
+    {
+      "package": "@deepseek-ai/dsh-commands",
+      "version": "0.2.1-rc.2",
+      "path": "lib/types/invariant.js",
+      "bytes": 3034,
+      "sha256": "e4bdb34890eb5b917fb26e5d8987929ef61be4e0587f8975c6cb7692e22be996",
+      "sourcePath": "packages/interaction/commands/src/invariant.ts",
+      "sourceSha256": "bebedf4440f99d6a9f275557edf10081d3ef9e1e22e82e0f3c603313a05c7d8c"
+    },
+    {
+      "package": "@deepseek-ai/dsh-user-approval",
+      "version": "0.2.1-rc.2",
+      "path": "lib/types/invariant.js",
+      "bytes": 4858,
+      "sha256": "0ee679ea1449b99266df9dc3c53606a61573caa432cfca3d44badfdac71a0ef8",
+      "sourcePath": "packages/interaction/user-approval/src/invariant.ts",
+      "sourceSha256": "0d91ae6637974853dbb43088d65495840e96e21667b2ffd8237b7889aa4771c4"
+    },
+    {
+      "package": "@deepseek-ai/dsh-jobs",
+      "version": "0.2.1-rc.2",
+      "path": "lib/types/invariant.js",
+      "bytes": 5474,
+      "sha256": "8d7b9de3a4928849ef504ea379642e4c60826ec0032ff92ff6fe89839f7fb490",
+      "sourcePath": "packages/jobs/jobs/src/invariant.ts",
+      "sourceSha256": "86633d18b1e73ec1667abb39a1a364f1db46cdb6db732ef8f828964db9d42b47"
+    },
+    {
+      "package": "@deepseek-ai/dsh-llm",
+      "version": "0.2.1-rc.2",
+      "path": "lib/types/invariant.js",
+      "bytes": 4401,
+      "sha256": "31e6ab4e29731d461b2bd49fd285666ea1a1fb96fa71ecd5c449c6c27e95d889",
+      "sourcePath": "packages/llm/llm/src/invariant.ts",
+      "sourceSha256": "ba2fd65ba8a0d886b5f21810f5f5d008984ac64387b024de0237ff71a7e483bd"
+    }
+  ],
+  "distributions": [
+    {
+      "id": "desktop-0.2.1-rc.2-darwin-arm64",
+      "platform": "darwin",
+      "arch": "arm64",
+      "version": "0.2.1-rc.2",
+      "runtimeVersion": "0.2.1-rc.2",
+      "pnpmVersion": "11.28.5",
+      "asarHeaderSha256": "4ab76d0724d8124801413e8e939a75c254c8625f9007267bd1531eb3b993e8f8",
+      "desktopManifestSha256": "53ee01d3b1accfbd037d245fb4752fb5fa5f8e2a76b7de634a4223558ee54bb9",
+      "buildCommit": "332895e0f7c9d4dbfb29729f5eb367fa263ff986",
+      "buildDirty": false,
+      "releaseUrl": "https://download.deepseek.com/dsh-desk/bin/mac-arm64/deepseek-harness-0.2.1-rc.2-mac-arm64.zip",
+      "releaseSha512": "vgGV720lZGEd2MnjVFOvhLVafwQH3iUDindQwwSjQ7AJaeZuu6UvjR2Msae2dkGS1SeMxxYCBu5Ks13n+K9Ydw==",
+      "vendorTeam": "NAN929V4UM",
+      "vendorIdentifier": "com.deepseek.dsh"
+    },
+    {
+      "id": "desktop-0.2.1-rc.2-win32-x64",
+      "platform": "win32",
+      "arch": "x64",
+      "version": "0.2.1-rc.2",
+      "runtimeVersion": "0.2.1-rc.2",
+      "pnpmVersion": "11.28.5",
+      "asarHeaderSha256": "487721b329cacfe1a15d206ebc72a096f9ff5b94ba0400c8763c73535429daf2",
+      "desktopManifestSha256": "53ee01d3b1accfbd037d245fb4752fb5fa5f8e2a76b7de634a4223558ee54bb9",
+      "buildCommit": "332895e0f7c9d4dbfb29729f5eb367fa263ff986",
+      "buildDirty": false,
+      "releaseUrl": "https://download.deepseek.com/dsh-desk/bin/win-x64/deepseek-harness-0.2.1-rc.2-win-x64.exe",
+      "releaseSha512": "39POl5osl9PKMqrPXQA52dh/bCV0Z02vOV9cTjOJDHE6gsJwp5bv7lfgB3mVWAKspX7a/w1iTi+8Listdhq45g==",
+      "vendorPublisher": "Hangzhou DeepSeek Artificial Intelligence Co., Ltd."
+    },
+    {
+      "id": "desktop-0.2.1-rc.3-darwin-arm64",
+      "platform": "darwin",
+      "arch": "arm64",
+      "version": "0.2.1-rc.3",
+      "runtimeVersion": "0.2.1-rc.3",
+      "pnpmVersion": "11.28.5",
+      "asarHeaderSha256": "84140c5d09050010753077cde3c8e35fc2e050054f1ed69f761fae8b6fdd4b95",
+      "desktopManifestSha256": "ac5d5922a061519322befb742e8b8285197d6ca975a2a38e8049ef37c67e63d2",
+      "buildCommit": "be72761ee1a6736ebcdf4f3739363b083ae53c98",
+      "buildDirty": false,
+      "releaseUrl": "https://download.deepseek.com/dsh-desk/bin/mac-arm64/deepseek-harness-0.2.1-rc.3-mac-arm64.zip",
+      "releaseSha512": "0tCeP/zLGLtsH+S4BD4TIyRJ8TwRhh7xaJprTMOUoEfj7hYJFC3G5l6nl/2zCTS41MeE9k+KRN19RE9sqX6goQ==",
+      "vendorTeam": "NAN929V4UM",
+      "vendorIdentifier": "com.deepseek.dsh"
+    },
+    {
+      "id": "desktop-0.2.1-rc.3-win32-x64",
+      "platform": "win32",
+      "arch": "x64",
+      "version": "0.2.1-rc.3",
+      "runtimeVersion": "0.2.1-rc.3",
+      "pnpmVersion": "11.28.5",
+      "asarHeaderSha256": "c30a30589e62c5c571f73c27ca22b94bb0d931815f2a2e122ae1c7dc904ab594",
+      "desktopManifestSha256": "ac5d5922a061519322befb742e8b8285197d6ca975a2a38e8049ef37c67e63d2",
+      "buildCommit": "be72761ee1a6736ebcdf4f3739363b083ae53c98",
+      "buildDirty": false,
+      "releaseUrl": "https://download.deepseek.com/dsh-desk/bin/win-x64/deepseek-harness-0.2.1-rc.3-win-x64.exe",
+      "releaseSha512": "q5IGr2Bf+TvvCpagHj49Ypn/ZrqR7kqrYpLjqXP7VfDINmddlqZQmG+YfsdL3q3EdTRMRlKz/a3jDAEzdNdDOw==",
+      "vendorPublisher": "Hangzhou DeepSeek Artificial Intelligence Co., Ltd."
+    }
+  ]
+}