dsh-creator-mode-plus 0.3.8 → 0.3.11

package/scripts/install.mjs

@@ -27,7 +27,8 @@ const LEGACY_ROWS = [
 ]
 const LEGACY_SIX_TOOL_PERSONA = 'Create file-backed DeepSeek Harness plugins through the six-tool DSHX v0.7 fixed bridge. Treat the official browser WebUI and public Cordis/client extension points as the compatibility target. App-shell APIs and wrapper-specific behavior are outside the supported surface. Harness update planning is read-only inside this session; prepare, verify, apply, rollback, and process control belong to the external DSHX supervisor.'
 const SEVEN_TOOL_PERSONA = 'Create and safely remove file-backed DeepSeek Harness plugins through the seven-tool DSHX v0.7 fixed bridge. Treat the official browser WebUI and public Cordis/client extension points as the compatibility target. App-shell APIs and wrapper-specific behavior are outside the supported surface. Whole-plugin teardown must use dshx_remove_plugin so the live Host deactivates first and source is preserved. Harness update planning is read-only inside this session; prepare, verify, apply, rollback, and process control belong to the external DSHX supervisor.'
-const CURRENT_PERSONA = `${SEVEN_TOOL_PERSONA} DSH.app, direct dsh web, and dshx are launchers for one long-lived Web Host per DSH_HOME; never start a second same-Home Host or keep an isolated verifier alive.`
+const LEGACY_CURRENT_PERSONA = `${SEVEN_TOOL_PERSONA} DSH.app, direct dsh web, and dshx are launchers for one long-lived Web Host per DSH_HOME; never start a second same-Home Host or keep an isolated verifier alive.`
+const CURRENT_PERSONA = 'Create and safely remove external DeepSeek Harness plugins through the fixed DSHX v0.7 bridge and public Cordis/client extension points. Official Harness source, shipped presets, installed official packages and their generated artifacts are read-only, including copies and worktrees. Never add a Host API, patch official files or rebuild official subprojects for a plugin. Report a missing public API or use a plugin-only alternative. User takeover, automatic approval and --force cannot override CORE_SOURCE_IMMUTABLE. Whole-plugin teardown must use dshx_remove_plugin to deactivate the live Host first and preserve source. Harness version inventory is read-only; source-changing update stages are disabled even for external supervisors. DSH.app, direct dsh web, and dshx are launchers for one long-lived Web Host per DSH_HOME; never start a second same-Home Host or keep an isolated verifier alive.'
 const LEGACY_SIX_TOOL_COMMENT = '# Bridge v2: six fixed dshx tools plus external Guardian lifecycle hooks; no shell, arbitrary argv, or model process control.'
 const SEVEN_TOOL_COMMENT = '# Bridge v2: seven fixed dshx tools plus external Guardian lifecycle hooks; no arbitrary argv, raw plugin teardown, or model process control.'
 
@@ -35,6 +36,16 @@ const STANDARD_PRESET_PATHS = [
   'packages/preset/agent-presets/presets/standard',
   'apps/cli/config/agent-presets/standard',
 ]
+const STANDARD_PATCH_PATH = 'packages/bundle/web-app/presets/standard.patch.yml'
+const WEB_PROFILE = 'web'
+const PROFILE_INCLUDE_PATH = 'creator-mode-plus/agent.cordis.yml'
+const PROFILE_INCLUDE = `# Creator Mode+ preset include. The installer owns this block.
+- insert:
+    - id: creator-mode-plus-preset
+      name: cordis:include
+      config:
+        path: ${PROFILE_INCLUDE_PATH}
+`
 
 export function standardPresetAt(root) {
   for (const relative of STANDARD_PRESET_PATHS) {
@@ -44,6 +55,139 @@ export function standardPresetAt(root) {
   throw new Error(`Creator Mode+ installer cannot find the shipped Standard preset under ${root}`)
 }
 
+/** Shipped Standard composition. 0.1.7 stores it as a bundle patch; older lines use a preset directory. */
+export function standardSourceAt(root) {
+  const patch = join(root, STANDARD_PATCH_PATH)
+  if (existsSync(patch)) return Object.freeze({ kind: 'patch', path: patch })
+  return Object.freeze({ kind: 'directory', path: standardPresetAt(root) })
+}
+
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+}
+
+function countManagedRow(text, row) {
+  const exact = exactRowCount(text, row)
+  if (exact > 0) return exact
+  const [idLine, nameLine] = row.split('\n')
+  const pattern = new RegExp(
+    `^[ \\t]*${escapeRegExp(idLine)}\\n[ \\t]*${escapeRegExp(nameLine.trim())}(?=\\n|$)`,
+    'gm',
+  )
+  return [...text.matchAll(pattern)].length
+}
+
+function reindentPlugins(plugins) {
+  const body = plugins.split('\n').map(line => (line.startsWith('    ') ? line.slice(4) : line)).join('\n')
+  return body.endsWith('\n') ? body : `${body}\n`
+}
+
+function rewritePatchPersona(plugins) {
+  const match = /^([ \t]*)prefix: You are a coding agent powered by the \{\{model\}\} model\.$/m.exec(plugins)
+  if (!match) {
+    throw new Error('Creator Mode+ installer expected the shipped Standard persona prefix')
+  }
+  const indent = match[1]
+  const lines = [
+    'You are Creator Mode+, a coding agent powered by the {{model}} model.',
+    '',
+    CURRENT_PERSONA,
+    '',
+    'Load the `creator-mode-plus` skill before creating, activating, removing, hot-reloading, updating Harness, or validating a DSH plugin. Keep Harness core and shipped presets unchanged.',
+  ]
+  const body = lines.map(line => (line.length === 0 ? '' : `${indent}  ${line}`)).join('\n')
+  const replacement = `${indent}prefix: |-\n${body}`
+  return plugins.slice(0, match.index) + replacement + plugins.slice(match.index + match[0].length)
+}
+
+function deriveCreatorDeclaration(standardPatch) {
+  const marker = '\n        plugins:\n'
+  const index = standardPatch.indexOf(marker)
+  if (index < 0 || standardPatch.indexOf(marker, index + marker.length) >= 0) {
+    throw new Error('Creator Mode+ installer expected exactly one Standard preset plugin list')
+  }
+  let plugins = rewritePatchPersona(reindentPlugins(standardPatch.slice(index + marker.length)))
+  plugins = replaceOnce(
+    plugins,
+    `      - id: skill-filesystem\n        name: '@deepseek-ai/dsh-skill-filesystem'`,
+    `      - id: skill-filesystem\n        name: '@deepseek-ai/dsh-skill-filesystem'\n        config:\n          customSkillDirs:\n            - !!js "process.getBuiltinModule('node:url').fileURLToPath(new URL('skills/', baseUrl))"`,
+    'skill filesystem',
+  )
+  plugins = replaceOnce(
+    plugins,
+    `      - id: tool-skill\n        name: '@deepseek-ai/dsh-tool-skill'`,
+    `      - id: tool-skill\n        name: '@deepseek-ai/dsh-tool-skill'\n\n      # Bridge v2: seven fixed dshx tools plus external Guardian lifecycle hooks; no arbitrary argv, raw plugin teardown, or model process control.\n      - id: dsh-creator-mode-plus\n        name: dsh-creator-mode-plus`,
+    'tool skill',
+  )
+  const description = '在 DSH 对话中创建、修改并加载插件，继续验证实际功能；支持保留当前会话的热更新和故障恢复。'
+  return `# Creator Mode+ starts from the shipped Standard preset and adds the fixed dshx bridge.
+- id: preset-creator-mode-plus
+  name: '@deepseek-ai/dsh-agent-preset'
+  config:
+    id: creator-mode-plus
+    name: Creator Mode+
+    description: ${JSON.stringify(description)}
+    order: 20
+    plugins:
+${plugins}`
+}
+
+function profilePresetDir(dshHome) {
+  return join(dshHome, 'profiles', WEB_PROFILE, 'creator-mode-plus')
+}
+
+function withoutPatchComments(text) {
+  return text.replace(/^[ \t]*#.*$/gm, '').trim()
+}
+
+function ensureProfileInclude(profileDir) {
+  mkdirSync(profileDir, { recursive: true })
+  const patchPath = join(profileDir, 'cordis.patch.yml')
+  const existing = existsSync(patchPath) ? readFileSync(patchPath, 'utf8') : ''
+  const body = withoutPatchComments(existing)
+  // Official profile init writes a comment header plus an empty array. A later
+  // sequence item after `[]` is not a patch entry, so replace that array.
+  if (body === '[]' || body.startsWith('[]\n')) {
+    const repaired = existing.replace(/^[ \t]*\[\][ \t]*\r?\n/m, '')
+    const next = repaired.includes(`path: ${PROFILE_INCLUDE_PATH}`)
+      ? repaired
+      : `${repaired.endsWith('\n') || repaired.length === 0 ? repaired : `${repaired}\n`}${PROFILE_INCLUDE}`
+    if (next !== existing) writeFileSync(patchPath, next)
+    return patchPath
+  }
+  if (existing.includes(`path: ${PROFILE_INCLUDE_PATH}`)) return patchPath
+  const prefix = existing.length === 0 || existing.endsWith('\n') ? existing : `${existing}\n`
+  writeFileSync(patchPath, `${prefix}${PROFILE_INCLUDE}`)
+  return patchPath
+}
+
+function writeProfilePreset(target, composition) {
+  const root = dirname(target)
+  mkdirSync(root, { recursive: true })
+  const temporaryRoot = mkdtempSync(join(root, '.dsh-creator-mode-plus-install-'))
+  const staging = join(temporaryRoot, 'creator-mode-plus')
+  try {
+    mkdirSync(staging, { recursive: true })
+    writeFileSync(join(staging, 'agent.cordis.yml'), composition)
+    cpSync(join(packageRoot, 'preset/preset.yml'), join(staging, 'preset.yml'))
+    cpSync(join(packageRoot, 'preset/skills'), join(staging, 'skills'), { recursive: true })
+    tightenTree(staging)
+    renameSync(staging, target)
+  } finally {
+    rmSync(temporaryRoot, { recursive: true, force: true })
+  }
+  ensureProfileInclude(root)
+}
+
+function recognizedLegacyRow(composition) {
+  const matches = LEGACY_ROWS.filter(row => countManagedRow(composition, row) === 1)
+  const legacyCount = LEGACY_ROWS.reduce((count, row) => count + countManagedRow(composition, row), 0)
+  if (legacyCount !== 1 || matches.length !== 1) {
+    throw new Error('Creator Mode+ preset does not contain exactly one recognized managed plugin row; refusing an unsafe update')
+  }
+  return matches[0]
+}
+
 function replaceOnce(text, search, replacement, label) {
   const first = text.indexOf(search)
   if (first < 0 || text.indexOf(search, first + search.length) >= 0) {
@@ -116,11 +260,11 @@ function creatorComposition(standard) {
 function migrateManagedSafetyCopy(text) {
   let next = migratePersona015(text)
   for (const [before, after] of [
-    [LEGACY_SIX_TOOL_PERSONA, SEVEN_TOOL_PERSONA],
+    [LEGACY_CURRENT_PERSONA, CURRENT_PERSONA],
+    [LEGACY_SIX_TOOL_PERSONA, CURRENT_PERSONA],
     [SEVEN_TOOL_PERSONA, CURRENT_PERSONA],
     [LEGACY_SIX_TOOL_COMMENT, SEVEN_TOOL_COMMENT],
   ]) {
-    if (before === SEVEN_TOOL_PERSONA && next.includes(CURRENT_PERSONA)) continue
     const first = next.indexOf(before)
     if (first < 0) continue
     if (next.indexOf(before, first + before.length) >= 0) {
@@ -135,9 +279,9 @@ function refreshManagedAssets(target, root, migrateLegacy) {
   const compositionPath = join(target, 'agent.cordis.yml')
   const originalComposition = existsSync(compositionPath) ? readFileSync(compositionPath, 'utf8') : ''
   let composition = originalComposition
-  const currentCount = exactRowCount(composition, CURRENT_ROW)
-  const matchingLegacyRows = LEGACY_ROWS.filter(row => exactRowCount(composition, row) === 1)
-  const legacyCount = LEGACY_ROWS.reduce((count, row) => count + exactRowCount(composition, row), 0)
+  const currentCount = countManagedRow(composition, CURRENT_ROW)
+  const matchingLegacyRows = LEGACY_ROWS.filter(row => countManagedRow(composition, row) === 1)
+  const legacyCount = LEGACY_ROWS.reduce((count, row) => count + countManagedRow(composition, row), 0)
 
   if (currentCount === 1 && legacyCount === 0) {
     // Current composition remains user-owned; only managed assets are refreshed.
@@ -185,6 +329,70 @@ function refreshManagedAssets(target, root, migrateLegacy) {
   }
 }
 
+function installFromStandardPatch({ sourcePath, dshHome, compatibility, upgrade, migrateLegacy }) {
+  const target = profilePresetDir(dshHome)
+  const legacyDirs = [
+    join(dshHome, '.agent-presets', CURRENT_PRESET_ID),
+    join(dshHome, '.agent-presets', LEGACY_PRESET_ID),
+  ].filter(path => existsSync(path))
+  const currentExists = existsSync(target)
+  const result = (action) => ({
+    target,
+    action,
+    dshxVersion: compatibility.dshxVersion,
+    creatorBridgeVersion: compatibility.creatorBridgeVersion,
+    dshxContract: compatibility.contractId,
+    layout: 'profile-include',
+  })
+
+  if (currentExists && legacyDirs.length > 0) {
+    throw new Error(`both ${target} and a legacy .agent-presets Creator Mode+ exist; refusing to choose or overwrite either preset`)
+  }
+  if (currentExists) {
+    if (!upgrade && !migrateLegacy) {
+      throw new Error(`Creator Mode+ already exists at ${target}; pass --upgrade to refresh only managed assets`)
+    }
+    refreshManagedAssets(target, dirname(target), false)
+    ensureProfileInclude(dirname(target))
+    return result('updated')
+  }
+  if (legacyDirs.length > 0) {
+    if (!migrateLegacy) {
+      throw new Error(`legacy Creator Mode+ exists at ${legacyDirs[0]}; pass --migrate-legacy after adding the standalone package`)
+    }
+    if (legacyDirs.length > 1) {
+      throw new Error(`both ${legacyDirs[0]} and ${legacyDirs[1]} exist; refusing to choose or overwrite either preset`)
+    }
+    const compositionPath = join(legacyDirs[0], 'agent.cordis.yml')
+    let composition = readFileSync(compositionPath, 'utf8')
+    if (countManagedRow(composition, CURRENT_ROW) !== 1) {
+      composition = composition.replace(recognizedLegacyRow(composition), CURRENT_ROW)
+    }
+    composition = migrateManagedSafetyCopy(composition)
+    const indented = composition.replace(/[ \t]+$/gm, '').replace(/\n$/, '').split('\n')
+      .map(line => (line.length === 0 ? '' : `      ${line}`))
+      .join('\n')
+    const description = '在 DSH 对话中创建、修改并加载插件，继续验证实际功能；支持保留当前会话的热更新和故障恢复。'
+    writeProfilePreset(target, `# Creator Mode+ preset migrated from .agent-presets. The legacy directory is preserved.
+- id: preset-creator-mode-plus
+  name: '@deepseek-ai/dsh-agent-preset'
+  config:
+    id: creator-mode-plus
+    name: Creator Mode+
+    description: ${JSON.stringify(description)}
+    order: 20
+    plugins:
+${indented}
+`)
+    return result('migrated')
+  }
+  if (upgrade || migrateLegacy) {
+    throw new Error('no existing Creator Mode+ preset found to update or migrate')
+  }
+  writeProfilePreset(target, deriveCreatorDeclaration(readFileSync(sourcePath, 'utf8')))
+  return result('installed')
+}
+
 /** Install or safely refresh the user-owned Creator Mode+ preset. */
 export function installCreatorModePlus(options = {}) {
   const harnessRoot = resolveHarnessRoot({
@@ -195,8 +403,18 @@ export function installCreatorModePlus(options = {}) {
     moduleDir: options.moduleDir,
   })
   const compatibility = inspectDshxCompatibility(harnessRoot)
-  const source = standardPresetAt(harnessRoot)
+  const sourceInfo = standardSourceAt(harnessRoot)
   const dshHome = resolve(options.dshHome || process.env.DSH_HOME || join(homedir(), '.dsh'))
+  if (sourceInfo.kind === 'patch') {
+    return installFromStandardPatch({
+      sourcePath: sourceInfo.path,
+      dshHome,
+      compatibility,
+      upgrade: options.upgrade,
+      migrateLegacy: options.migrateLegacy,
+    })
+  }
+  const source = sourceInfo.path
   const root = join(dshHome, '.agent-presets')
   const currentTarget = join(root, CURRENT_PRESET_ID)
   const legacyTarget = join(root, LEGACY_PRESET_ID)

package/scripts/verify-dshx.mjs

@@ -67,7 +67,7 @@ if (process.argv[1] && import.meta.url === pathToFileURL(resolve(process.argv[1]
       process.stdout.write('Usage: node scripts/verify-dshx.mjs [--harness /absolute/path/to/deepseek-harness]\n')
     } else {
       const result = verifyDshxAlignment(options)
-      process.stdout.write('CREATOR_MODE_PLUS_DSHX_V078_COMPATIBILITY_PASS\n')
+      process.stdout.write('CREATOR_MODE_PLUS_DSHX_V091_COMPATIBILITY_PASS\n')
       process.stdout.write(`${JSON.stringify(result, null, 2)}\n`)
     }
   } catch (error) {

package/scripts/verify-harness-install.mjs

@@ -9,7 +9,7 @@ import {
 import { tmpdir } from 'node:os'
 import { join, resolve } from 'node:path'
 import { pathToFileURL } from 'node:url'
-import { installCreatorModePlus, standardPresetAt } from './install.mjs'
+import { installCreatorModePlus, standardSourceAt } from './install.mjs'
 
 function digest(path) {
   return createHash('sha256').update(readFileSync(path)).digest('hex')
@@ -36,12 +36,11 @@ function parseArguments(argv) {
 
 /** Exercise the real shipped Standard preset in an isolated disposable DSH_HOME. */
 export function verifyHarnessInstall(harnessRoot) {
-  const standardPreset = standardPresetAt(harnessRoot)
-  const sourceComposition = join(standardPreset, 'agent.cordis.yml')
-  const sourcePreset = join(standardPreset, 'preset.yml')
+  const standard = standardSourceAt(harnessRoot)
+  const sourcePreset = standard.kind === 'directory' ? join(standard.path, 'preset.yml') : undefined
   const before = {
-    composition: digest(sourceComposition),
-    preset: digest(sourcePreset),
+    composition: digest(standard.path),
+    ...(sourcePreset ? { preset: digest(sourcePreset) } : {}),
   }
   const dshHome = mkdtempSync(join(tmpdir(), 'creator-mode-plus-rc2-install-'))
   try {
@@ -54,7 +53,7 @@ export function verifyHarnessInstall(harnessRoot) {
     if (!composition.includes('name: dsh-creator-mode-plus')) throw new Error('isolated preset is missing the standalone bridge row')
     if (!skill.includes('dshx_status') || !skill.includes('dshx_hot_reload')) throw new Error('isolated preset is missing the Creator delivery workflow')
     const maintenance = readFileSync(join(installed.target, 'skills/creator-mode-plus/maintenance.md'), 'utf8')
-    if (!skill.includes('(maintenance.md#harness-and-launcher-maintenance)') || !maintenance.includes('update plan → prepare → verify → apply')) throw new Error('isolated preset is missing the referenced Harness maintenance branch')
+    if (!skill.includes('(maintenance.md#harness-and-launcher-maintenance)') || !maintenance.includes('Only `update plan` remains available')) throw new Error('isolated preset is missing the referenced Harness maintenance branch')
     if (!existsSync(join(installed.target, 'skills/creator-mode-plus/verification-recovery.md'))) throw new Error('isolated preset is missing the referenced verification branch')
 
     const firstStamp = statSync(compositionPath)
@@ -64,7 +63,10 @@ export function verifyHarnessInstall(harnessRoot) {
       throw new Error('managed asset refresh changed the unchanged agent.cordis.yml stamp')
     }
     if (!existsSync(skillPath)) throw new Error('managed upgrade removed the Creator Mode+ skill')
-    if (digest(sourceComposition) !== before.composition || digest(sourcePreset) !== before.preset) {
+    if (digest(standard.path) !== before.composition) {
+      throw new Error('isolated install changed a shipped Harness preset')
+    }
+    if (sourcePreset && digest(sourcePreset) !== before.preset) {
       throw new Error('isolated install changed a shipped Harness preset')
     }
 

package/src/client.js

@@ -49,7 +49,7 @@ window.__ModuleLoader__.load({
         try {
           const response = await fetch(endpoint, {
             method: 'POST',
-            headers: { 'content-type': 'application/json' },
+            headers: { 'content-type': 'application/json', 'x-dsh-creator-client': '1' },
             body: JSON.stringify({ failedIds, message: String(message || '').slice(0, 8000) }),
           })
           const result = await response.json()

package/src/compatibility.js

@@ -5,11 +5,12 @@ export const CREATOR_BRIDGE_VERSION = 2
 
 export const DSHX_CONTRACT = Object.freeze({
   id: 'dshx-v0.7/creator-bridge-v2',
-  release: 'v0.7.8',
-  minimum: '0.7.8',
-  maximumExclusive: '0.8.0',
+  release: 'v0.9.1',
+  minimum: '0.9.1',
+  maximumExclusive: '0.10.0',
   capabilities: Object.freeze([
     'creator-session-claims',
+    'plugin-only-core-immutability',
     'human-confirmed-creator-takeover',
     'workspace-scaffold',
     'bounded-new-client-activation',
@@ -24,7 +25,7 @@ export const DSHX_CONTRACT = Object.freeze({
     'bounded-same-pid-server-hot-reload',
     'single-home-web-host',
     'isolated-verify-home',
-    'transactional-harness-update-assistant',
+    'read-only-harness-update-plan',
   ]),
 })
 
@@ -47,6 +48,7 @@ export const CREATOR_MODEL_TOOLS = Object.freeze([
 ])
 
 export const DSHX_SURFACE_MARKERS = Object.freeze({
+  'src/core-boundary.js': Object.freeze(['CORE_SOURCE_IMMUTABLE', 'assertPluginSource', 'creatorCoreMutationReason']),
   'src/internal/creator-claims.mjs': Object.freeze(['beginTakeover', 'commitTakeover', 'CREATOR_TAKEOVER_GRANT_REQUIRED', 'revocations']),
   'src/creator-plus/takeover.js': Object.freeze(['userQuestions', 'ensureTakeoverFence', 'CREATOR_OWNER_NOT_QUIESCENT']),
   'src/internal/browser-access.ts': Object.freeze(['bindBrowserAccess', 'assertSameBrowserHost', 'BROWSER_ADAPTER_REQUIRED', 'configureSessionBrowserAdapter', 'sessionBrowserAdapter']),
@@ -87,9 +89,19 @@ export const DSHX_SURFACE_MARKERS = Object.freeze({
     'PROFILE_DEPENDENCY_REMOVED',
   ]),
   'src/commands/update.ts': Object.freeze([
-    'dshx update plan|prepare|verify|apply|rollback',
-    "action === 'apply' || action === 'rollback'",
+    'dshx update plan',
+    "action !== 'plan'",
+    'CORE_SOURCE_IMMUTABLE',
   ]),
+  'src/internal/types.ts': Object.freeze([
+    'DESK_HARNESS_TAG',
+    'dsh-v0.2.0-rc.2',
+    'DESK_HARNESS_SHA',
+    '639ed015397290b3745d163aafe02ffee4aa3f84',
+    'DSH_PEER_RANGE',
+    '>=0.2.0-rc.1 <0.2.1',
+  ]),
+  'src/creator-plus/runner.js': Object.freeze(["ctx.on('agent/created'"]),
   'src/internal/creator.ts': Object.freeze(['bridgeVersion !== 2', 'workspaceRoot']),
   'src/internal/guardian.ts': Object.freeze([
     'export function armGuardian',
@@ -174,7 +186,7 @@ export const DSHX_SURFACE_MARKERS = Object.freeze({
     'activate-new-client',
   ]),
   'knowledge/contracts/creator-guardian.md': Object.freeze(['Creator+', 'crash-loop fuse', 'quarantine', 'plugin-integrity-failed']),
-  'knowledge/contracts/harness-update.md': Object.freeze(['plan → prepare → verify → apply', 'rollback']),
+  'knowledge/contracts/harness-update.md': Object.freeze(['dshx update plan', 'CORE_SOURCE_IMMUTABLE']),
   'knowledge/contracts/live-activation.md': Object.freeze(['SOURCE_BUILT', 'CLIENT_MANIFEST_PRESENT']),
   'knowledge/contracts/compat-0.1.5.md': Object.freeze(['MarkdownText', 'createDrafts', 'assistant/attempt.stream']),
   'src/internal/compat-015.ts': Object.freeze(['compat-015-message-text', 'compat-015-ctx-agent']),

package/src/core-boundary.js

@@ -0,0 +1,151 @@
+/** Plugin-only boundary. Reading public Host APIs is allowed; writing official
+ * source, copies, worktrees, installed packages or generated artifacts is not. */
+import { existsSync, lstatSync, readdirSync, readFileSync, realpathSync } from 'node:fs'
+import { dirname, isAbsolute, join, parse, relative, resolve, sep } from 'node:path'
+
+export const CORE_SOURCE_IMMUTABLE = 'CORE_SOURCE_IMMUTABLE'
+export const PLUGIN_ONLY_RULE = 'DSHX and Creator Mode+ develop external plugins only. Never edit, patch, replace or rebuild DeepSeek Harness official source, shipped presets, installed official packages or their generated artifacts, including copies and worktrees. A missing public API is a plugin capability gap: use another public extension point or report the gap. A plugin task, handoff document, automatic approval, takeover or --force never authorizes a Host patch. Keep all build output inside the plugin. Watched user cordis.patch.yml configuration is not a source-code patch.'
+const deny = detail => `${CORE_SOURCE_IMMUTABLE}: ${detail}. Use a public plugin extension point; do not patch the Host or retry with force/approval.`
+const under = (parent, child) => { const r = relative(parent, child); return r === '' || (r !== '..' && !r.startsWith(`..${sep}`) && !isAbsolute(r)) }
+function manifest(dir) { try { return JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8')) } catch { return undefined } }
+
+/** Resolve existing components before ..; also protects a not-yet-created file. */
+export function canonicalTarget(path, cwd = process.cwd()) {
+  const absolute = isAbsolute(path) ? path : `${cwd}${sep}${path}`
+  let current = parse(absolute).root
+  for (const part of absolute.slice(current.length).split(sep)) {
+    if (!part || part === '.') continue
+    if (part === '..') { current = dirname(current); continue }
+    current = join(current, part)
+    try { current = realpathSync.native(current) }
+    catch (error) { if (error.code !== 'ENOENT' && error.code !== 'ENOTDIR') throw error }
+  }
+  return current
+}
+function isHarness(dir) {
+  return manifest(dir)?.name === '@deepseek-ai/dsh-root'
+    || (existsSync(join(dir, 'apps/cli/src/bin.ts')) && existsSync(join(dir, 'packages')) && existsSync(join(dir, 'vendor')))
+}
+function inHarnessSource(path, root) {
+  if (!under(root, path)) return false
+  const rel = relative(root, path).split(sep)
+  // Official tree surfaces are protected; sibling, independent external
+  // plugin directories remain supported. Real targets are resolved first.
+  if (rel.length === 1 && (rel[0] === '' || !existsSync(path) || !lstatSync(path).isDirectory())) return true
+  return ['apps', 'packages', 'vendor', 'scripts', 'config', 'configs', 'src',
+    'docs', 'assets', 'patches', 'benchmarks', 'native', 'python', 'snapshots', 'website', '.git', '.agents', '.github'].includes(rel[0])
+}
+export function coreWriteReason(path, harnessRoot, cwd) {
+  const target = canonicalTarget(path, cwd)
+  if (harnessRoot && inHarnessSource(target, canonicalTarget(harnessRoot))) return deny(`protected Harness path ${target}`)
+  let cursor = target
+  while (true) {
+    const pkg = manifest(cursor)
+    if (typeof pkg?.name === 'string' && pkg.name.startsWith('@deepseek-ai/') && pkg.name !== '@deepseek-ai/dsh-root') return deny(`official package ${pkg.name}: ${target}`)
+    if (isHarness(cursor) && inHarnessSource(target, cursor)) return deny(`official checkout or worktree ${cursor}: ${target}`)
+    const parent = dirname(cursor)
+    if (parent === cursor) return undefined
+    cursor = parent
+  }
+}
+export function assertPluginSource(harnessRoot, dir, entry) {
+  const reason = coreWriteReason(dir, harnessRoot)
+  if (reason) throw new Error(reason)
+  if (entry) {
+    const target = canonicalTarget(entry)
+    const denied = coreWriteReason(target, harnessRoot)
+    if (denied) throw new Error(denied)
+    if (!under(canonicalTarget(dir), target)) throw new Error(deny(`plugin entry escapes its source directory: ${entry}`))
+  }
+}
+const PATCH_TARGET = /^(?:\+\+\+|---)\s+(?:[ab]\/)?(?:packages|apps|vendor|scripts|config)\/|^\*\*\* (?:Update|Add|Delete) File:\s*(?:[ab]\/)?(?:packages|apps|vendor|scripts|config)\//m
+const SKIP = new Set(['node_modules', 'lib', 'dist', 'out', 'coverage', 'tests', 'test', 'fixtures'])
+/** Release gate for concrete Host patches and compiler writes; not a proof that
+ * arbitrary third-party programs are safe. Never executes plugin scripts. */
+export function auditPluginSource(harnessRoot, dir) {
+  const findings = []
+  assertPluginSource(harnessRoot, dir)
+  let count = 0
+  function walk(folder) {
+    for (const entry of readdirSync(folder, { withFileTypes: true })) {
+      if (entry.name.startsWith('.') || SKIP.has(entry.name)) continue
+      if (++count > 10000) throw new Error(deny('plugin boundary inventory exceeds 10000 files'))
+      const path = join(folder, entry.name)
+      if (entry.isSymbolicLink()) {
+        const reason = coreWriteReason(path, harnessRoot)
+        if (reason) findings.push({ path, message: reason })
+        continue
+      }
+      if (entry.isDirectory()) { walk(path); continue }
+      if (!entry.isFile() || lstatSync(path).size > 1024 * 1024) continue
+      if (/\.(patch|diff)$/.test(entry.name) && PATCH_TARGET.test(readFileSync(path, 'utf8'))) {
+        findings.push({ path, message: deny('plugin contains a patch targeting official Host files') })
+      }
+      if (/^tsconfig.*\.json$/.test(entry.name)) {
+        // Conservative JSONC extraction: relevant path strings only, no code.
+        const source = readFileSync(path, 'utf8')
+        for (const match of source.matchAll(/"(?:outDir|outFile|declarationDir|tsBuildInfoFile)"\s*:\s*"([^"\n]+)"/g)) {
+          const output = canonicalTarget(match[1], folder)
+          if (!under(canonicalTarget(dir), output)) findings.push({ path, message: deny(`TypeScript output escapes the plugin: ${match[1]}`) })
+        }
+        const refs = source.match(/"references"\s*:\s*\[([\s\S]*?)\]/)?.[1] ?? ''
+        for (const match of refs.matchAll(/"path"\s*:\s*"([^"\n]+)"/g)) {
+          const reason = coreWriteReason(match[1], harnessRoot, folder)
+          if (reason) findings.push({ path, message: deny(`TypeScript project reference can rebuild official source: ${match[1]}`) })
+        }
+      }
+    }
+  }
+  walk(dir)
+  return findings
+}
+
+function readOnlyShell(command) {
+  if (/[;&|`$><\n]/.test(command)) return false
+  if (/^\s*(?:cat|head|tail|ls|pwd|stat|realpath|readlink|rg)\b/.test(command)) return !/--pre\b/.test(command)
+  return /^\s*git\s+(?:(?:-C\s+(?:"[^"]+"|'[^']+'|\S+)\s+))?(?:status|diff|show|log|ls-files|rev-parse)\b/.test(command)
+    && !/--(?:ext-diff|textconv|output|exec-path)\b/.test(command)
+}
+export function creatorCoreMutationReason(exec, harnessRoot, policy) {
+  const args = exec?.arguments ?? {}, cwd = exec?.agent?.session?.header?.cwd ?? process.cwd()
+  if (['write', 'edit', 'write_file', 'edit_file', 'delete_file', 'move_file', 'copy_file'].includes(exec?.name)) {
+    for (const key of ['file_path', 'path', 'destination', 'source', 'target']) {
+      if (typeof args[key] === 'string') { const reason = coreWriteReason(args[key], harnessRoot, cwd); if (reason) return reason }
+    }
+    return undefined
+  }
+  if (exec?.name === 'apply_patch') {
+    const patch = args.patch ?? args.input ?? ''
+    for (const match of patch.matchAll(/^\*\*\* (?:(?:Update|Add|Delete) File|Move to):\s*(.+)$/gm)) {
+      const reason = coreWriteReason(match[1], harnessRoot, cwd); if (reason) return reason
+    }
+    return undefined
+  }
+  if (!['bash', 'terminal_open', 'terminal_send'].includes(exec?.name)) return undefined
+  const command = args.command ?? args.text ?? ''
+  if (readOnlyShell(command)) return undefined
+  if (args.sandbox_permissions === 'danger-full-access') return deny('unconfined shell execution cannot protect official source')
+  if (!policy || !['read-only', 'workspace-write', 'danger-full-access'].includes(policy.mode)) {
+    return `CREATOR_SANDBOX_UNAVAILABLE: cannot verify a confined shell policy${policy?.unavailableReason ? ` (${policy.unavailableReason})` : ''}. The command was not executed. Repair Creator Mode+ sandbox service wiring; this is not evidence of an official-source write.`
+  }
+  if (exec.name === 'bash' && policy.shellConfined === false) return deny('the active shell executor does not enforce the sandbox policy')
+  if (policy?.mode === 'danger-full-access') return deny('switch Creator shell to workspace-write so the Host sandbox confines build scripts')
+  if (policy?.mode === 'workspace-write' && harnessRoot && under(canonicalTarget(policy.workspaceRoot), canonicalTarget(harnessRoot))) return deny('the shell workspace contains the official Harness; use a plugin-only workspace')
+  const workdir = canonicalTarget(args.workdir ?? args.cwd ?? cwd, cwd)
+  const atCore = coreWriteReason(workdir, harnessRoot)
+  if (atCore) return atCore
+  if (/\b(?:install-host-seam|patch-host|host-patches)(?:[/.\s]|$)/.test(command)) return deny('Host patch installation is outside plugin development')
+  for (const match of command.matchAll(/\/(?:[^\s"'`()[\]{};,<>|]+)/g)) {
+    const reason = coreWriteReason(match[0], harnessRoot, workdir)
+    if (reason) return reason
+  }
+  // This catches direct shell/REPL targets and git -C. The Host sandbox remains
+  // responsible for code that assembles a path dynamically.
+  for (const match of command.matchAll(/"([^"\n]+)"|'([^'\n]+)'|([^\s;|&()<>]+)/g)) {
+    const token = match[1] ?? match[2] ?? match[3]
+    if (!token.includes('/') || token.includes('://')) continue
+    const reason = coreWriteReason(token.replace(/^[\w]+=/, ''), harnessRoot, workdir)
+    if (reason) return reason
+  }
+  return undefined
+}

package/src/delivery.js

@@ -90,7 +90,7 @@ function validatedHotReload(result, pluginId, expectedPid, expectedPort) {
   }
   if (report?.command !== 'hot-reload' || report?.ok !== true
     || !evidence.includes('HOST_MODULE_RELOADED') || data?.hostRestart !== false || data?.behaviorVerified !== false
-    || value?.pluginId !== pluginId || value?.profile !== 'web'
+    || value?.pluginId !== pluginId || !['web', 'desktop'].includes(value?.profile)
     || value?.hostPid !== expectedPid || value?.hostPort !== expectedPort || value?.hostRestart !== false
     || typeof value?.transactionId !== 'string' || !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value.transactionId)
     || typeof value?.hmrEntryId !== 'string' || !/^dshx-hot-reload-hmr-[a-z0-9-]+$/.test(value.hmrEntryId)