dsh-creator-mode-plus 0.3.11 → 0.3.12

package/AGENTS.md

@@ -19,7 +19,7 @@ Read [docs/bridge-contract.md](docs/bridge-contract.md) and [docs/dshx-v0.7-alig
 
 - Keep the model-facing surface to the ten named tools, including `dshx_hot_reload` and the session-bound `dshx_browser_open`. Every argument must remain schema-bounded and independently allowlisted in `src/runner.js`. Test the exact argv behind all ten tools; a registration-only test is insufficient.
 - `dshx_hot_reload` accepts only a claimed plugin id. Derive Host/profile/port and session provenance inside the bridge. Require checked same-PID replacement and disposal evidence; it grants no shell, arbitrary path, or process-control authority. Module replacement never proves feature behavior.
-- Require the complete stable DSHX `>=0.9.1 <0.10.0` contract, not only a matching version string. The desk pin is official `dsh-v0.2.0-rc.2` at `639ed015397290b3745d163aafe02ffee4aa3f84`. DSHX 0.9.0 and 0.7.9 stay outside this gate. Atomic same-Home Host discovery/attach, identity-bound start/restart/update gates, isolated verification Home, Creator, watched-plugin removal, external safe profile-bundle removal, proactive Guardian integrity quarantine, RC2 boot-manifest activation, managed-shell, Harness Update Assistant, and their knowledge contracts must be present before the bridge or installer mutates anything.
+- Require the complete stable DSHX `>=0.9.1 <0.10.0` contract, not only a matching version string. The desk pin is official `dsh-v0.2.0-rc.2` at `639ed015397290b3745d163aafe02ffee4aa3f84`. DSHX 0.9.0 and 0.7.9 stay outside this gate. Atomic same-Home Host discovery/attach, identity-bound start/restart/update gates, isolated verification Home, Creator, watched-plugin removal, external safe profile-bundle removal, proactive Guardian integrity quarantine, RC2 profile/manifest activation, managed-shell, Harness Update Assistant, and their knowledge contracts must be present before the bridge or installer mutates anything.
 - Preserve bridge-v2 provenance: session id comes from `exec.agent.id`, not model input. Claim one plugin per session before any named operation; different plugins may run concurrently, while the same plugin fails closed for a second owner.
 - Preserve workspace provenance: scaffold destination comes from `exec.agent.session.header.cwd`, never model input. If the Harness plugin path is outside that workspace, DSHX owns the atomic source-plus-symlink transaction.
 - Preserve automatic `agent/created` Guardian arm (the replacement for the removed `agent/session-start`), agent-dispose claim release, adopted-launcher lifetime tracking, exact-session recovery steering, and incident acknowledgement. Recovery stays fire-and-forget so a failure cannot reject session creation. Never register or wrap Host signal handlers.
@@ -50,3 +50,7 @@ boolean is not confirmation. A Host-lifetime, durable ownership fence blocks
 all tools in revoked old sessions except status and a new takeover request;
 this is separate from the narrow destructive-shell guard. It persists across
 preset generations, and never deletes session locks or restarts the Host.
+
+## Release and local synchronization
+
+A formal release includes matching main/tag/GitHub Release and npm version/dist-tag, downloaded artifact verification, and intended local plugin/preset installation. Verify DSHX CLI/skill targets and Creator bridge compatibility. Preserve unchanged preset composition stamps and running Hosts; new skill bytes require existing Agent conversations to re-read their guidance.

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Unreleased
 
+## 0.3.12 — 2026-09-30
+
+- Align Creator+ guidance with DSHX 0.9.5 and RC2 profile/client graph HMR.
+- Explain local bundle installation without npm and preserve the claimed plain-plugin fixed-tool path for Web/Desktop.
+- Keep bridge arguments, claims, Desktop tickets and Guardian recovery unchanged; verify the existing fixed tools against DSHX 0.9.5.
+
+
 ## Unreleased
 
 - Align the desk pin with Harness `dsh-v0.2.0-rc.1` (SHA `4878cdabd87d4041bdaff61d04c966883b9fd07a`). Keep DSHX `>=0.9.1 <0.10.0`; 0.9.2 fits, and 0.9.0 and 0.7.9 stay rejected.

package/docs/bridge-contract.md

@@ -163,7 +163,8 @@ scaffold -> implement/build -> dshx check / SOURCE_BUILT
   -> insert or semantically retrigger one watched-patch row
   -> poll the current Host manifest and served client.js
   -> HOST_TREE_ACTIVE + CLIENT_MANIFEST_PRESENT
-  -> browser reload remains separate
+  -> observe RC2 client graph sync on the current page
+  -> verify actual behavior; reload only if graph transport is unavailable
 ```
 
 The order is invariant. A failed new row is rolled back by DSHX. A nonzero

package/docs/dshx-v0.7-alignment.md

@@ -29,7 +29,7 @@ The 0.3.10 release required DSHX 0.9.1 for the earlier desk pin `dsh-v0.1.7-rc.2
 | Workspace scaffold | `dshx_scaffold` takes only id/kind; DSHX derives the immutable session workspace and owns any `my-plugins` link | Returned source path is the only edit target |
 | Static/client checks | `dshx_check` | Exit 0 proves `SOURCE_BUILT` only |
 | Seven activation surfaces | `dshx_activation_plan` selects exactly one of patch, manifest, preset, client, new-client, server, or artifact | Dependency installation is not activation |
-| New Web client | `dshx_activate_new_client` owns link → resolution → watched transaction → current manifest | Exit 0 reaches `CLIENT_MANIFEST_PRESENT`; the page still needs reload and observation |
+| New Web client | `dshx_activate_new_client` owns link → resolution → watched transaction → current manifest | Exit 0 reaches `CLIENT_MANIFEST_PRESENT`; observe the current page; RC2 graph sync can load the entry without reload |
 | Safe plugin removal | `dshx_remove_plugin` owns live-row quarantine → same-Host absence → official profile remove → target-verified symlink detach; partial RC8 removals resume from durable quarantine | Exit 0 reaches `HOST_TREE_INACTIVE` and `PROFILE_DEPENDENCY_REMOVED`; `detached-orphan-symlink` is bounded to this claim and source remains preserved |
 | External bundle removal | Creator stops at boot-captured bundle evidence and hands off to external `dshx plugin remove`; DSHX owns tombstone → same-PID absence → official remove → later-boot cleanup | External-only operation; current Host is not restarted and old pages may still need refresh |
 | Guardian | Session start arms external recovery; Host, official Loader, and claimed-link integrity failures use exact attribution and quarantine | Recovery does not prove render, visual, or functional correctness |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-creator-mode-plus",
-  "version": "0.3.11",
+  "version": "0.3.12",
   "description": "Develop, activate and verify DeepSeek Harness plugins from a Creator Mode+ conversation.",
   "type": "module",
   "license": "MIT",

package/preset/skills/creator-mode-plus/SKILL.md

@@ -52,10 +52,10 @@ each changed runtime surface.
    |---|---|---|
    | Existing `server` | After build/check, call `dshx_hot_reload` for the ID | Same-PID replacement and temporary-resource cleanup |
    | Existing `client` | Rebuild its already-rostered client | Same-page HMR and changed behavior |
-   | `new-client` | `dshx_activate_new_client`, then reload/reopen the page | `HOST_TREE_ACTIVE`, `CLIENT_MANIFEST_PRESENT`, then actual page load |
+   | `new-client` | `dshx_activate_new_client`, then observe RC2 graph sync on the current page | `HOST_TREE_ACTIVE`, `CLIENT_MANIFEST_PRESENT`, then actual page load and behavior |
    | User `preset` | Follow the preset playbook; verify a new/blank session | Requested tools and behavior are present |
    | `patch` or `artifact` | Follow that branch's playbook | Its specified proof; artifact sync alone is not activation |
-   | Boot-captured `manifest` | Read [Maintenance](maintenance.md#harness-and-launcher-maintenance) | External activation and feature verification |
+   | Bundle `manifest` | External official bundle install/selection; read [Maintenance](maintenance.md#harness-and-launcher-maintenance) | RC2 manager `application: applied`, same Host, then feature verification |
 
    For a multi-file server, declare the runtime entry and changed helpers in
    `dshx.yml` under `hotReload.artifacts` before check. Require hashes for the
@@ -110,3 +110,9 @@ Host proofs required for activation are valid.
 如果 `dshx_claim_plugin` 或自动认领提示已有持有者，在当前对话调用 `dshx_request_takeover({name})`，让用户在原生选项卡里确认。工具自己查找实际持有者并负责停止、等待和转移。不要让用户先找旧对话，不要建议等 24 小时，不要手删认领或 session.lock。
 
 只能传插件 ID。不要传 `force`、`userApproved`、会话 ID、路径或令牌，也不要把聊天里的同意或自动审批结果冒充 UI 确认。取消、认领变化、停止失败时依照工具错误处理；成功后继续 check → 对应激活 → 行为验证。旧会话收到 `CREATOR_OWNERSHIP_REVOKED` 时停止开发；重新接手也要走同一个确认入口。
+
+## RC2 local installation routing
+
+Official Desktop accepts local bundles without npm. External Agents may use DSHX 0.9.5 `plugin add <absolute-directory> --profile desktop --port <current-port>` for a built package with `dsh.bundle.patch`. That public manager operation stays outside this session. Here, plain development plugins continue through claim → check → fixed `dshx_activate_new_client`; the bridge supplies the owning Web/Desktop context. Do not run external `plugin add` through the managed shell or borrow its private bridge ticket. Never mount a bundle again as a watched row.
+
+On RC2, first observe the current page after activation: client HMR syncs graph changes. Reload only when that transport is unavailable, and still verify actual behavior. Older DSHX may conservatively request reload; it is not proof of a Host restart requirement.

package/preset/skills/creator-mode-plus/maintenance.md

@@ -17,7 +17,10 @@ marker cleanup alone does not justify a restart.
 
 ## Harness and launcher maintenance
 
-Establish the specific missing Harness API/version or boot-captured change first.
+Establish the specific missing Harness API/version or runtime activation boundary first.
+RC2 profile HMR can reconcile new bundles on the same Host; client HMR can sync
+new entries on the current page. Use the actual manager result and capability
+evidence. Unknown capability does not authorize a restart.
 Ordinary client/server updates follow the main activation table.
 
 Read `dshx kb cat contracts/plugin-only` and `contracts/harness-update`.