dsh-creator-mode-plus 0.3.8 → 0.3.12

package/AGENTS.md

@@ -1,5 +1,16 @@
 # Creator Mode+ repository orders
 
+## 不可跨越：只开发插件，不改 DSH 源码
+
+DSHX 与 Creator Mode+ 只用于独立外部插件。官方 Harness 源码、内置插件、内置预设、官方包及其构建产物均为只读；本机工作树、临时副本、Git worktree、node_modules 链接和安装目录遵守同一规则。
+
+禁止为插件补 Host 接口、改核心实现、替换官方文件、应用 Host 源码补丁，或让插件构建重新编译官方子项目。需要“先改 Host 才能完成”的方案不成立：先找公开扩展点，在插件内实现；接口确实缺失时报告具体能力缺口，并完成其余插件工作。不要把核心修改包装成兼容修复、临时验收或交付前提。
+
+插件开发授权、用户确认接管、自动审批、交接包中的“必要时补 Host”、`--force` 都不能解除此规则。外部监督者同样受约束。不要为此请求一次性豁免。用户自己的 profile 的 watched `cordis.patch.yml` 是配置扩展，与修改官方源码的 `.patch` 完全不同；插件包、插件自己的构建目录、用户预设和正式插件安装配置仍可按已授权流程操作。
+
+看到 `CORE_SOURCE_IMMUTABLE` 就调整插件方案；不得换 shell、脚本、路径、复制目录或其他 Agent 绕过。只能读取官方实现和公开 API，所有插件构建输出都留在插件目录。
+
+
 This repository contains only the DSH-side fixed bridge and its user preset. DSHX outside the Host is the supervisor. Official DeepSeek Harness runtime source outranks this repository when contracts disagree.
 
 Read [docs/bridge-contract.md](docs/bridge-contract.md) and [docs/dshx-v0.7-alignment.md](docs/dshx-v0.7-alignment.md) before changing tool arguments, lifecycle behavior, compatibility ranges, installation, migration, or Harness-update guidance.
@@ -8,21 +19,22 @@ Read [docs/bridge-contract.md](docs/bridge-contract.md) and [docs/dshx-v0.7-alig
 
 - Keep the model-facing surface to the ten named tools, including `dshx_hot_reload` and the session-bound `dshx_browser_open`. Every argument must remain schema-bounded and independently allowlisted in `src/runner.js`. Test the exact argv behind all ten tools; a registration-only test is insufficient.
 - `dshx_hot_reload` accepts only a claimed plugin id. Derive Host/profile/port and session provenance inside the bridge. Require checked same-PID replacement and disposal evidence; it grants no shell, arbitrary path, or process-control authority. Module replacement never proves feature behavior.
-- Require the complete stable DSHX `>=0.7.8 <0.8.0` contract, not only a matching version string. Atomic same-Home Host discovery/attach, identity-bound start/restart/update gates, isolated verification Home, Creator, watched-plugin removal, external safe profile-bundle removal, proactive Guardian integrity quarantine, RC2 boot-manifest activation, managed-shell, Harness Update Assistant, and their knowledge contracts must be present before the bridge or installer mutates anything.
+- Require the complete stable DSHX `>=0.9.1 <0.10.0` contract, not only a matching version string. The desk pin is official `dsh-v0.2.0-rc.2` at `639ed015397290b3745d163aafe02ffee4aa3f84`. DSHX 0.9.0 and 0.7.9 stay outside this gate. Atomic same-Home Host discovery/attach, identity-bound start/restart/update gates, isolated verification Home, Creator, watched-plugin removal, external safe profile-bundle removal, proactive Guardian integrity quarantine, RC2 profile/manifest activation, managed-shell, Harness Update Assistant, and their knowledge contracts must be present before the bridge or installer mutates anything.
 - Preserve bridge-v2 provenance: session id comes from `exec.agent.id`, not model input. Claim one plugin per session before any named operation; different plugins may run concurrently, while the same plugin fails closed for a second owner.
 - Preserve workspace provenance: scaffold destination comes from `exec.agent.session.header.cwd`, never model input. If the Harness plugin path is outside that workspace, DSHX owns the atomic source-plus-symlink transaction.
-- Preserve automatic session-start Guardian arm, agent-dispose claim release, adopted-launcher lifetime tracking, exact-session recovery steering, and incident acknowledgement. Never register or wrap Host signal handlers.
+- Preserve automatic `agent/created` Guardian arm (the replacement for the removed `agent/session-start`), agent-dispose claim release, adopted-launcher lifetime tracking, exact-session recovery steering, and incident acknowledgement. Recovery stays fire-and-forget so a failure cannot reject session creation. Never register or wrap Host signal handlers.
 - Keep Host start, stop, restart, arbitrary shell, arbitrary argv, paths, profile selection, and ports outside model input.
 - Treat App, direct CLI, and dshx as launchers for one long-lived Web Host per `DSH_HOME`. Duplicate/unknown Host visibility fails closed; isolated verification must never be retained.
 - Keep Harness `update prepare`, `verify`, `apply`, and `rollback` outside the Creator session. DSHX v0.7 permits only read-only `update plan` from a managed shell; this does not become a bridge update tool.
 - Preserve the ordered `activate-new-client` DSHX operation; profile linking and resolution happen before watched-patch mutation.
 - Preserve the `dshx_remove_plugin` order: quarantine/remove the watched Host row, prove same-PID absence, use the official profile remover while the dependency exists, prove dependency/link absence, and detach only target-verified plugin-owned symlinks. Partial attempts resume from durable quarantine without rerunning package removal for an already-absent dependency. Preserve source and never expose recursive source deletion.
 - Keep boot-captured bundle removal outside the ten-tool bridge. Creator Mode+ may hand it to external `dshx plugin remove`, but must never expose that command through the managed shell or reinterpret it as `dshx_remove_plugin` watched-row success.
-- Keep the preset-scoped bash guard narrow: block claimed plugin-root, Harness-link, and active-profile teardown while allowing ordinary file/component cleanup inside a plugin. Guardian must independently quarantine a claimed watched row when its profile link disappears.
+- Keep the teardown guard narrow, alongside the independent core-source write guard: block claimed plugin-root, Harness-link, and active-profile teardown while allowing ordinary file/component cleanup inside a plugin. Guardian must independently quarantine a claimed watched row when its profile link disappears.
 - Keep Host recovery outside DSH and bounded to one restart plus a crash-loop fuse. Official client-Loader recovery must remain same-origin, Host-stamped, uniquely attributed, quarantined before reload, and separate from arbitrary render/visual/function failures. Never expose internal `creator watch/release/disarm/client-failure/recovery` argv as model inputs.
 - Treat preset generations as concurrent. Any process-global route or resource must use a Host-scoped lease shared across independently loaded module generations, and must have a regression test that mounts two generations before either is disposed.
 - A managed upgrade that does not change `agent.cordis.yml` bytes must preserve that file's exact filesystem stamp. Do not retrigger preset generation for skill, metadata, or bundled-asset-only changes.
 - Route structured outcomes by scope. A checked server with only module-HMR evidence pending returns HOT_RELOAD_READY and its next fixed action. Browser-adapter failures block browser verification, not independent activation. Real source, ownership, authentication and Host-identity failures block their dependent operation.
+- Keep the undeployed sealed-executor integration explicitly opt-in with developmentExecution; the shipped preset uses the established fixed bridge and existing Host approval stack. An opted-in integration retains all of its provenance, cancellation and fail-closed behavior.
 - Edit only this package and user-owned presets. Never patch Harness core or shipped presets.
 - Retain source, Host, client-manifest, page-load, and visual evidence internally. User-facing updates state plugin completion, verified features and remaining work; expose operational details only for a user question or required user action.
 
@@ -38,3 +50,7 @@ boolean is not confirmation. A Host-lifetime, durable ownership fence blocks
 all tools in revoked old sessions except status and a new takeover request;
 this is separate from the narrow destructive-shell guard. It persists across
 preset generations, and never deletes session locks or restarts the Host.
+
+## Release and local synchronization
+
+A formal release includes matching main/tag/GitHub Release and npm version/dist-tag, downloaded artifact verification, and intended local plugin/preset installation. Verify DSHX CLI/skill targets and Creator bridge compatibility. Preserve unchanged preset composition stamps and running Hosts; new skill bytes require existing Agent conversations to re-read their guidance.

package/CHANGELOG.md

@@ -1,5 +1,46 @@
+# Unreleased
+
+## 0.3.12 — 2026-09-30
+
+- Align Creator+ guidance with DSHX 0.9.5 and RC2 profile/client graph HMR.
+- Explain local bundle installation without npm and preserve the claimed plain-plugin fixed-tool path for Web/Desktop.
+- Keep bridge arguments, claims, Desktop tickets and Guardian recovery unchanged; verify the existing fixed tools against DSHX 0.9.5.
+
+
+## Unreleased
+
+- Align the desk pin with Harness `dsh-v0.2.0-rc.1` (SHA `4878cdabd87d4041bdaff61d04c966883b9fd07a`). Keep DSHX `>=0.9.1 <0.10.0`; 0.9.2 fits, and 0.9.0 and 0.7.9 stay rejected.
+- Set `@deepseek-ai/dsh`, `@deepseek-ai/dsh-app-boot`, and `@deepseek-ai/dsh-plugin-manager` peers to `>=0.2.0-rc.1 <0.2.1`. That range accepts `0.2.0-rc.1` and stable `0.2.0`, rejects `0.2.0` alphas, and rejects `0.1.7-rc.2`.
+- Keep the ten fixed tools and the runner allowlist. Package version stays 0.3.10 until a release.
+- Fix Creator shell guards reading sandbox policy and shell capabilities through undeclared Agent contexts. Resolve them through live injected service scopes and keep failing closed when dependencies disappear.
+- Report `CREATOR_SANDBOX_UNAVAILABLE` for unavailable policy wiring instead of mislabeling normal plugin commands as official-source writes.
+- Add native Agent + real sandbox Git commit/tag/push regression tests, including protected core writes, policy changes and dependency replacement.
+
+- Add user-confirmed plugin takeover in the current conversation, durable old-session fencing, owned job/terminal draining, and atomic DSHX ownership transfer.
+
 # Changelog
 
+## 0.3.10 - 2026-09-24
+
+- Align Creator Mode+ with Harness `dsh-v0.1.7-rc.2` (SHA `477b4f420553e8a52c2fbccc464d7561b239c443`) and DSHX `>=0.9.1 <0.10.0`. Reject DSHX 0.9.0 and 0.7.9; those pins stay on `dsh-v0.1.7-rc.1`.
+- Keep the optional peer `@deepseek-ai/dsh` at `>=0.1.7-rc.1 <0.1.8`. That range accepts `0.1.7-rc.2`.
+- Keep the ten fixed tools. Read-only `dshx update plan` passes `--target dsh-v0.1.7-rc.2`. An omitted target on DSHX 0.9.1 stays on that tag and does not follow a later alpha.
+- Attest `DESK_HARNESS_TAG` and `DESK_HARNESS_SHA` before the bridge or installer mutates anything.
+
+## 0.3.9 - 2026-09-23
+
+- Align Creator Mode+ with Harness `dsh-v0.1.7-rc.1` and DSHX `>=0.7.9 <0.8.0`. Declare optional peer `@deepseek-ai/dsh` `>=0.1.7-rc.1 <0.1.8`.
+- Deliver recovery on `agent/created`. The listener stays fire-and-forget so a recovery failure cannot reject session creation. `agent/session-start` is gone.
+- Install the user preset as a Web profile include of an `@deepseek-ai/dsh-agent-preset` declaration derived from `packages/bundle/web-app/presets/standard.patch.yml`. Leave the shipped patch unchanged. `$DSH_HOME/.agent-presets` is no longer the install target.
+- Keep managed upgrades stamp-stable when `agent.cordis.yml` bytes do not change. Read-only `dshx update plan` passes `--target dsh-v0.1.7-rc.1`.
+- Address background jobs by session id. Harness 0.1.7-rc.1 lists, kills, and waits with a session id, and a job view names its owner as `owner`.
+- Replace the official empty `[]` web profile patch with the Creator Mode+ include. A sequence item after that array is not a patch entry.
+## Unreleased — plugin-only boundary
+
+- Treat official DSH source, installed packages, worktrees and artifacts as read-only. Reject core targets, symlink escapes, Host patches and compiler output outside the plugin.
+- Enforce Creator filesystem/shell write guards after approval and add the rule to the runtime prompt. Keep normal plugin writes and read-only Host inspection.
+- Keep `update plan`; disable source-changing Harness update stages inside and outside DSHX.
+
 ## 0.3.8 - 2026-09-21
 
 - Add `dshx_request_takeover`: show the actual claim owner in the current conversation and transfer only after an explicit answer through the native user-question service. Cancellation is the default.
@@ -17,7 +58,7 @@
 - Continue checked server activation through an explicit HOT_RELOAD_READY state and fixed next action; preserve the original CLI code for old evidence-only plans.
 - Scope browser-adapter failures to verification and retain independent activation actions.
 - Rewrite the Agent workflow with branch references, persistent installation authorization and concrete feature acceptance.
-- Preserve the established fixed bridge and native approval guards for ordinary Creator sessions.
+- Keep the undeployed sealed execution integration opt-in while preserving the existing fixed bridge and native approval guards for ordinary Creator sessions.
 
 ## 0.3.6 - 2026-09-11
 

package/README.en.md

@@ -2,9 +2,11 @@
 
 [中文](README.md)
 
+**Plugin-only boundary:** official DSH source and artifacts are read-only, including copies and worktrees. Use public extension points; missing APIs never authorize a Host patch. Takeover, approval and `--force` cannot override `CORE_SOURCE_IMMUTABLE`.
+
 Pick Creator Mode+ in a normal DeepSeek Harness Web session. Ten fixed tools scaffold, check, mount, and uninstall a file-backed plugin in a safe order.
 
-Creator Mode+ 0.3.8 is paired with DSHX 0.7.8 and adds user-confirmed claim takeover in the current conversation. New-client activation, server hot reload within the same conversation, and removal have been verified on DSH `dsh-v0.1.5-rc.2`. The bridge compatibility range remains [DSHX](https://github.com/aa2246740/dsh-external-plugin-devkit) `>=0.7.8 <0.8.0`; both the version range and the human-confirmed takeover capability are checked before use.
+This source is paired with Harness `dsh-v0.2.0-rc.2` (SHA `639ed015397290b3745d163aafe02ffee4aa3f84`). The plugin peer range is `>=0.2.0-rc.1 <0.2.1`. It accepts `0.2.0-rc.2` and stable `0.2.0`, rejects `0.2.0` alphas, and rejects `0.1.7-rc.2`. The bridge compatibility range stays [DSHX](https://github.com/aa2246740/dsh-external-plugin-devkit) `>=0.9.1 <0.10.0`; 0.9.2 fits, and 0.9.0 and 0.7.9 are rejected. The desk pin, peer range, and human-confirmed takeover capability are checked before use. Session recovery listens on `agent/created`. The ten fixed tools are unchanged.
 
 ![Open Creator Mode+ in the official WebUI](docs/screenshots/mode-picker.gif)
 
@@ -22,7 +24,29 @@ The Agent creates source, builds, checks, selects activation and continues. Serv
 
 ## Install
 
-Do this outside an Agent session, in your Harness checkout:
+### DSH Studio desktop app (recommended)
+
+Open **Settings → Plugins → Add plugin** and enter this in “Package name or address”:
+
+```text
+github:aa2246740/dsh-creator-mode-plus#v0.3.10
+```
+
+The desktop plugin manager owns the Desktop profile and bundled package manager. This release includes built artifacts; normal use needs no clone, build, or DSHX installation. Follow the app if it asks you to reload or reopen after installation. Then choose Creator Mode+ in a new session.
+
+### Web CLI
+
+```sh
+dsh plugin --profile web add github:aa2246740/dsh-creator-mode-plus#v0.3.10
+```
+
+This official CLI command writes only the `web` profile; it cannot modify the Desktop App profile. For an already-running Web Host, reopen that Host once and reload the page.
+
+Creator Mode+ uses DSHX inside a conversation to develop, check, and activate **the user's own plugins**. That capability is not a prerequisite to install Creator Mode+, and it never permits modifying official DSH source.
+
+### Source-development install
+
+Only when editing this repository, use a local link and installer in a separate Harness checkout:
 
 ```sh
 cd /path/to/deepseek-harness
@@ -31,7 +55,7 @@ pnpm dsh plugin --profile web add link:./tools/dsh-creator-mode-plus
 node tools/dsh-creator-mode-plus/scripts/install.mjs --harness "$PWD"
 ```
 
-The installer writes a user preset. It leaves the shipped Standard and Creator presets alone. Open the official WebUI, confirm Creator Mode+ is in the mode list, and try it in a new session. Adding a profile dependency is not by itself a reason to restart the Host.
+The installer derives a user preset from the shipped Standard patch, writes `profiles/web/creator-mode-plus/agent.cordis.yml`, and includes that file from the Web profile `cordis.patch.yml`. It leaves the shipped Standard and Creator presets alone and does not write `.agent-presets`. Open the official WebUI, confirm Creator Mode+ is in the mode list, and try it in a new session. Adding a profile dependency is not by itself a reason to restart the Host.
 
 Contracts: [Bridge v2](docs/bridge-contract.md) and [DSHX v0.7 alignment](docs/dshx-v0.7-alignment.md).
 
@@ -55,9 +79,9 @@ Whole-plugin removal goes through `dshx_remove_plugin` only. Running the install
 
 ![Duplicate install refused](docs/screenshots/already-installed.png)
 
-Harness `update prepare` / `verify` / `apply` / `rollback` are not among the ten tools. They stay with an external DSHX supervisor. Inside the session, managed shell may only read `update plan`.
+Harness inventory is read-only through `update plan`. DSHX disables `prepare`, `verify`, `apply` and `rollback` for every caller, including the external supervisor.
 
-## Upgrade
+## Source-development upgrade
 
 ```sh
 cd /path/to/deepseek-harness/tools/dsh-creator-mode-plus

package/README.md

@@ -2,9 +2,11 @@
 
 [English](README.en.md)
 
+**插件开发红线：DSH 官方源码只读。** 不为插件修改 Host、内置包或官方构建产物，临时副本和 worktree 也不例外。缺少公开接口时调整插件方案；`CORE_SOURCE_IMMUTABLE` 不可通过接管、审批或 `--force` 绕过。
+
 在 DeepSeek Harness 的普通 Web 会话里选 Creator Mode+，用十个固定工具把一个文件化插件搭起来、检查、挂载，也能按安全顺序卸载。
 
-Creator Mode+ 0.3.8 配套 DSHX 0.7.8，新增当前对话内的用户确认接管。此前已在 DSH `dsh-v0.1.5-rc.2` 上验证新插件加载、同一会话内服务端热更新和卸载。底层桥接兼容范围为 [DSHX](https://github.com/aa2246740/dsh-external-plugin-devkit) `>=0.7.8 <0.8.0`，并在使用前核对用户确认接管能力。
+当前源码配套 Harness `dsh-v0.2.0-rc.2`（SHA `639ed015397290b3745d163aafe02ffee4aa3f84`）。插件 peer 范围是 `>=0.2.0-rc.1 <0.2.1`，接受 `0.2.0-rc.2` 和稳定版 `0.2.0`，拒绝 `0.2.0` alpha，也拒绝 `0.1.7-rc.2`。底层桥接兼容范围仍是 [DSHX](https://github.com/aa2246740/dsh-external-plugin-devkit) `>=0.9.1 <0.10.0`；0.9.2 落在这个范围内，0.9.0 和 0.7.9 被拒绝。使用前核对桌面钉、peer 范围和用户确认接管能力。会话恢复挂在 `agent/created` 上。十个固定工具不变。
 
 ![在官方 WebUI 里打开 Creator Mode+](docs/screenshots/mode-picker.gif)
 
@@ -22,7 +24,29 @@ Agent 会创建源码、构建检查、选择激活方式并继续执行。服
 
 ## 安装
 
-在 Agent 会话外面做。进你的 Harness 仓库：
+### DSH Studio 桌面 App（推荐）
+
+打开 **设置 → 插件 → 添加插件**，在“包名或地址”中输入：
+
+```text
+github:aa2246740/dsh-creator-mode-plus#v0.3.10
+```
+
+桌面端插件管理器负责 Desktop profile 和内置包管理器。本发布已包含编译产物；普通使用不需要 clone、构建或安装 DSHX。若应用提示刷新或重新打开，请按提示完成。安装后在新会话中选择 Creator Mode+。
+
+### Web CLI
+
+```sh
+dsh plugin --profile web add github:aa2246740/dsh-creator-mode-plus#v0.3.10
+```
+
+这条官方 CLI 命令只写入 `web` profile，不能修改 Desktop App 的 profile。对于已经运行的 Web Host，请重新打开该 Host 一次，再刷新网页。
+
+Creator Mode+ 在对话中调用 DSHX 来开发、检查和激活**用户自己的插件**；这项功能不是安装 Creator Mode+ 的前置条件，也不允许它修改 DSH 官方源码。
+
+### 源码开发安装
+
+只有在编辑本仓库源码时，才在独立 Harness checkout 中使用本地链接和安装器：
 
 ```sh
 cd /path/to/deepseek-harness
@@ -31,7 +55,7 @@ pnpm dsh plugin --profile web add link:./tools/dsh-creator-mode-plus
 node tools/dsh-creator-mode-plus/scripts/install.mjs --harness "$PWD"
 ```
 
-安装器只写用户 preset，不动随仓库带的 Standard / Creator。打开官方 WebUI，检查 Creator Mode+ 是否出现在模式列表，并在新会话验收。不要仅因增加 profile 依赖就重启 Host。
+安装器从仓库自带的 Standard patch 派生用户 preset，写入 `profiles/web/creator-mode-plus/agent.cordis.yml`，并在 Web profile 的 `cordis.patch.yml` 里 include 它。它不改随仓库带的 Standard / Creator，也不再写 `.agent-presets`。打开官方 WebUI，检查 Creator Mode+ 是否出现在模式列表，并在新会话验收。不要仅因增加 profile 依赖就重启 Host。
 
 合同见 [Bridge v2](docs/bridge-contract.md) 和 [DSHX v0.7 alignment](docs/dshx-v0.7-alignment.md)。
 
@@ -56,9 +80,9 @@ node tools/dsh-creator-mode-plus/scripts/install.mjs --harness "$PWD"
 
 ![重复安装被拒绝](docs/screenshots/already-installed.png)
 
-Harness 更新的 `prepare` / `verify` / `apply` / `rollback` 不在这十个工具里，交给外部 DSHX supervisor。会话内只允许通过 managed shell 读 `update plan`。
+Harness 更新只保留只读 `update plan`。`prepare` / `verify` / `apply` / `rollback` 已由 DSHX 禁用，外部 supervisor 也不能通过插件工具修改官方源码。
 
-## 升级
+## 源码开发升级
 
 ```sh
 cd /path/to/deepseek-harness/tools/dsh-creator-mode-plus

package/cordis.patch.yml

@@ -0,0 +1,3 @@
+- insert:
+    - id: dsh-creator-mode-plus
+      name: dsh-creator-mode-plus

package/docs/bridge-contract.md

@@ -1,12 +1,15 @@
 # Creator Bridge v2
 
+> 当前强制规则：DSH 官方源码与构建产物只读。插件工作不允许 Host patch、修改临时官方副本或重建官方子项目。`update prepare/verify/apply/rollback` 已禁用，仅保留 `update plan`；后文历史版本说明不解除该规则。
+
+
 Creator Mode+ is a user preset plus one DSH plugin. It brings ten fixed DSHX
 operations into an ordinary DSH session without giving that session control of
-its Host process. Stable DSHX `>=0.7.8 <0.8.0` supplies atomic single-Home Host
+its Host process. Stable DSHX `>=0.9.1 <0.10.0` supplies atomic single-Home Host
 discovery/attachment, temporary-Home cold-boot verification, workspace-aware
 scaffolding, source-preserving watched-plugin removal, external safe profile-bundle
 removal, proactive integrity quarantine, the external Guardian, durable recovery state, the seven-surface
-activation contract, and the transactional Harness Update Assistant.
+activation contract, and the read-only Harness version inventory and plugin-only source boundary.
 
 ## Roles
 
@@ -56,14 +59,7 @@ pull, and recovery acknowledgement argv. Tests must execute every row and every
 internal lifecycle shape through the allowlist; registering a tool name does not
 prove its child argv is reachable.
 
-DSHX v0.7.2 adds `dshx_remove_plugin` as the seventh Creator tool. `update prepare`, `verify`,
-`apply`, and `rollback` remain outside the bridge because they can replace or restore the process that owns the session,
-so the fixed bridge cannot expose them. Read-only `update plan` is available only
-through DSHX's managed-shell gate and remains inventory rather than activation.
-DSHX v0.7.3 adds the external `dshx plugin remove` transaction for boot-captured
-profile bundles. It also stays outside the fixed bridge: it requires current
-profile/port authority and may own a tombstone across App boots, so Creator
-sessions may hand off to it but never execute it as a bridge tool or raw shell.
+`dshx_remove_plugin` provides bounded source-preserving removal. Harness version inventory is read-only; source-changing update stages are disabled for every caller.
 
 DSHX v0.7.4 makes App, direct CLI, and dshx launchers for one long-lived Web
 Host per real `DSH_HOME`. `start` attaches to one existing Host, while duplicate
@@ -101,7 +97,7 @@ exec.agent.id + callId + rootCallId
   + Host pid + Host parent pid + current Web port + bridge version
 ```
 
-At `agent/session-start`, the bridge arms Guardian and pulls recovery incidents
+At `agent/created` (the session-start event; `agent/session-start` is gone), the bridge arms Guardian and pulls recovery incidents. The listener does not return that promise, so a recovery failure cannot reject serial session creation.
 for that exact persisted session. Once a plugin id is known, the session calls
 `dshx_claim_plugin`; every other named-plugin operation refreshes the claim.
 
@@ -119,7 +115,7 @@ The standalone package does not accept `0.7.x` by string alone. Before any fixed
 operation or installer mutation it requires:
 
 - package identity `dsh-external-plugin-devkit` and stable version
-  `>=0.7.8 <0.8.0`;
+  `>=0.9.1 <0.10.0` (0.9.0 and 0.7.9 are rejected; 0.9.2 fits; the desk pin must be `dsh-v0.2.0-rc.2`, SHA `639ed015397290b3745d163aafe02ffee4aa3f84`);
 - same-Home Web Host discovery/attach, three-state PID/port probes, and
   temporary-Home verification teardown;
 - Creator claim/scaffold commands and Bridge v2 context validation;
@@ -127,7 +123,7 @@ operation or installer mutation it requires:
   removal, and proactive claimed-link integrity quarantine;
 - external Guardian and official Loader-failure recovery implementation;
 - check, activation-plan, and bounded new-client command surfaces;
-- the managed-shell gate and the transactional Harness Update Assistant;
+- the managed-shell gate and the read-only Harness version inventory and plugin-only source boundary;
 - Creator+, Guardian, live-activation, and Harness-update knowledge contracts.
 
 Missing or prerelease surfaces fail closed. Release verification also probes the
@@ -167,7 +163,8 @@ scaffold -> implement/build -> dshx check / SOURCE_BUILT
   -> insert or semantically retrigger one watched-patch row
   -> poll the current Host manifest and served client.js
   -> HOST_TREE_ACTIVE + CLIENT_MANIFEST_PRESENT
-  -> browser reload remains separate
+  -> observe RC2 client graph sync on the current page
+  -> verify actual behavior; reload only if graph transport is unavailable
 ```
 
 The order is invariant. A failed new row is rolled back by DSHX. A nonzero
@@ -289,7 +286,7 @@ A stale Host identity, unknown id, or multiple candidates is ambiguous and
 changes no plugin row. After quarantine, the bridge waits for the current Host
 manifest to prove the id absent. Only then does the browser reload once. The
 incident remains durable and is steered to its owning session. A failed report
-gets one delayed retry to cover session-start/Guardian arm races; the browser
+gets one delayed retry to cover `agent/created`/Guardian arm races; the browser
 fuse prevents an unbounded reload loop.
 
 The POST route is a Host-scoped leased resource, not a generation-scoped side
@@ -301,34 +298,15 @@ generation, and only the last lease unregisters the route. The installer also
 preserves the exact composition-file stamp when its bytes are unchanged so
 metadata-only upgrades do not manufacture a new generation.
 
-## Harness Update Assistant boundary
-
-The v0.7 update state machine is `plan → prepare → verify → apply`; `rollback`
-requires an existing apply transaction. Creator Mode+ may inspect `plan` from a
-managed shell after `dshx_status` proves one checkout. All later stages are
-external-supervisor work.
-
-The evidence labels are deliberately non-transitive:
-
-- `plan` inventories tag/SHA, dirty state, and plugins; it proves no build.
-- `prepare` proves an isolated candidate installed and built; it does not update
-  the current checkout.
-- `verify` proves candidate static/cold-boot gates; it does not activate the
-  production Host or page.
-- `apply` updates local source and artifacts transactionally; it does not restart
-  or establish user-visible acceptance.
-- `rollback` restores the recorded checkout, dependencies, and artifacts; it
-  does not promise reversal of product-data migrations outside this contract.
+## Harness version inventory boundary
 
-The update assistant never silently stops or restarts a production Host. Creator
-Mode+ must report candidate verified, applied locally, real runtime accepted, and
-production activated as separate states.
+Only `update plan` is available. It inventories versions, dirty state and plugins without proving a build or runtime behavior. DSHX rejects `prepare`, `verify`, `apply` and `rollback` with `CORE_SOURCE_IMMUTABLE` for every caller. The external supervisor has no exception. A plugin requiring a new Host API must report that capability gap or use another public extension point.
 
 ## Compatibility and evidence boundary
 
 Supported: the official DSH browser WebUI, public Cordis plugin forms, public
 client runtime, and public UI slots across the RC8 Creator/Guardian contract and
-the RC2 package/update line and the authenticated Web line through 0.1.5-rc.2.
+the RC2 package/update line and the authenticated Web line through `dsh-v0.2.0-rc.2` (SHA `639ed015397290b3745d163aafe02ffee4aa3f84`). The plugin peer range is `>=0.2.0-rc.1 <0.2.1`. It accepts `0.2.0-rc.2` and stable `0.2.0`, rejects `0.2.0` alphas, and rejects `0.1.7-rc.2`. User presets are profile includes of an `@deepseek-ai/dsh-agent-preset` declaration derived from the shipped Standard patch; `$DSH_HOME/.agent-presets` is not read.
 
 Outside acceptance: native menus, window chrome, App IPC, desktop bridges, and
 shell-specific refresh behavior. A wrapper may work when it embeds the same
@@ -415,8 +393,11 @@ action. Current-Host authentication errors still block dependent live proof.
 An already-authenticated, task-authorized UI or a plugin command/service can
 supply feature evidence without configuring this optional browser adapter.
 
-This release uses the ten fixed tools and the native approval/guard stack.
-Separate local sealed-executor experiments are not part of this package.
+The sealed executor code is a development integration, enabled only by an
+explicit `developmentExecution: true` composition. The ordinary preset keeps
+the established ten fixed tools and native approval/guard stack. Enabling the
+experimental path retains its strict executor/provenance requirements; absence
+of that optional service is not a default-mode prerequisite.
 
 ## 用户确认后接管
 
@@ -429,3 +410,10 @@ Separate local sealed-executor experiments are not part of this package.
 正在激活、持有者状态无法核实、停止失败、确认取消或超时，都不会授予新会话权限。已开始的停止操作不会被自动恢复。可用外部 `dshx creator inspect <plugin> --json` 查看原认领及待处理交接；不要手删 claims 或 session.lock。`creator takeover` 是固定桥内部提交协议，缺少一次性凭据会拒绝，不能通过 `--force` 调用。
 
 租约到期只表示认领需要重新核验，不再自动授权第二个写入者。正常 `agent/disposed` 仍释放认领；移交中的 dispose 不得破坏正在比较的原认领。
+
+
+## Official Desktop profile support (local compatibility update)
+
+The fixed bridge derives `desktop`, its port, Home, and runtime root from the public `profileContext`; none becomes model input. The CLI preserves Web behavior. For Desktop, a per-invocation private capability returns only config entry identities, or authorizes one install/remove for the current claimed plain plugin. The owning Host calls the public `@deepseek-ai/dsh-plugin-manager/operations` `runPluginCommand` with its bundled package manager and official profile lock. New bundle activation is disabled; the existing checked watched-patch transaction still owns activation and removal. Capabilities expire, are revoked at operation completion and generation disposal, and are never returned in tool text.
+
+Guardian validates the Electron child identity and monitors the Desktop Host. It may quarantine an attributed plugin failure, but never stops, replaces, or restarts the Desktop Host. Electron owns that recovery and normal quit. Desktop HMR binds the discovered application root independently of the plugin-development checkout. Package imports, checked artifacts, claims, same-PID proof, and feature acceptance remain required.

package/docs/development-compilation.md

@@ -0,0 +1,100 @@
+# 私有编译输入：固定登记目标（source-only）
+
+2026-09-14。`src/development-target.js` 的增量只提供受限数据，不提供来源证明、人工授权、通用 Loader 解析或执行能力。`src/index.js`、manifest 和 Host 未接线／未激活。
+
+## API
+
+```js
+createDevelopmentTargetResolver({
+  getHarnessRoot,                       // 原有 Host 私有读源
+  readRegisteredTarget,                // opaqueLease -> 固定物理登记描述，严格同步
+  readCompilationSignals,              // 原 exec -> { ownerSignal, policySignal }，严格同步
+  producerSignal,                      // C producer 的私有生命周期
+  compilationTtlMs: 300000,             // 可更短，不可超过五分钟
+  compilationNow: () => performance.now(), // 单调时钟；另有真实到期 timer
+})
+
+captureCompilation(exec, opaqueLease)  // -> 冻结空 opaque handle
+compilationSnapshot(handle, exec)     // -> 冻结公开 metadata，无 code
+compilationInput(handle, exec)        // -> 私有冻结输入（再次安全重验）
+releaseCompilation(handle)            // -> boolean；幂等、立即清缓存
+dispose()                            // 停止编译捕获、清全部待办；原观察 API 不改变
+```
+
+原 `capture(exec, pluginId)` / `revalidate(snapshot, exec)` 不依赖三个新增生命周期／registry 配置，不增加代码或 Loader 推断。编译 snapshot 也可以交给 `revalidate(snapshot, exec)`，但会走其更严格的原 exec／登记 lease／生命周期校验。
+
+新增 callback 不存在于任何模型参数或 HTTP 接口。构造器未提供它们，编译入口直接关闭。不得把它们包装成可选模型字段。
+
+### 可信接线形态
+
+```js
+// 仅在真实 C execute 中 authority.enter + policy.capture 后写入。
+const invocations = new WeakMap() // exact original exec -> { owner, policyHandle }
+const lifetime = new AbortController()
+ctx.effect(() => () => lifetime.abort())
+const targets = createDevelopmentTargetResolver({
+  getHarnessRoot: trustedHarnessRoot,
+  readRegisteredTarget: lease => preparedExecutor.readRegisteredTarget(lease),
+  readCompilationSignals(exec) {
+    const call = invocations.get(exec)
+    if (!call) return undefined
+    return {
+      ownerSignal: authority.inspect(call.owner).signal,
+      policySignal: policy.inspect(call.policyHandle).signal,
+    }
+  },
+  producerSignal: lifetime.signal,
+})
+ctx.effect(() => () => targets.dispose())
+```
+
+不得按 agent.id/sessionId 选择最新 owner。读取方法始终还检查原 `exec.signal`；owner signal 应来自同一 exec 已 enter 的 C owner，包含 caller/body timeout。旧调用、换 Agent／Session／token／参数对象、换 body/owner/policy signal、取消、异步／缺失读源，均不能借用代码句柄。
+
+## 登记目标与 binding
+
+`readRegisteredTarget(opaqueLease)` 返回冻结的物理描述：
+
+```js
+{ harnessRoot, sourceRoot, pluginId, sourceDirectoryIdentity: { dev, ino }, runtimeEntry }
+```
+
+- 只信任私有 registry reader 对原 opaque lease 的回答，不读 lease 自带的 JSON 字段。
+- `runtimeEntry` 是已经外部固定登记的精确包内 JS/CJS/MJS 路径；不是模型参数，不根据 package.main/exports、Node resolver 或项目脚本推断。
+- 每遍读取都校验实际 `locate()` 的物理目标与登记描述完全相符；lease 撤销、目标／runtimeEntry 改变、依赖信号变更时失效，不切换到新目标。外部 registry 应按不可复活 lease 管理代际。
+- 登记物理描述 **没有 workspaceRoot**。实际 workspaceRoot 仍从原 Agent 的真实 Session cwd 取得。
+- 私有 input 返回完整冻结 `binding`（engine/harnessRoot/workspaceRoot/sourceRoot/pluginId/sourceDirectoryIdentity）。该 binding 与本次编译 snapshot 的 binding 是**同一个对象**，来自同一次双遍 locate；不能之后另做一次普通 capture 拼入另一个时刻的 binding。
+
+外部候选 `PreparedExecutor.readRegisteredTarget()` 的字段已按用户指定源码只读核对；这不是对生产 registry 挂载或执行的验证。当前执行候选仅支持明确登记且真实 ACTIVE 的 fixed-entry managed hot-reload，其它目标继续关闭。
+
+## 读取和代码边界
+
+- 保留既有 no-follow / nonblocking FD、regular-file、inode/size/time/trail、目录身份、目标保护和两遍一致性检查。
+- 编译要求 manifest 显式 `hotReload.artifacts` JS 闭包。原 `declaredEntry` 与登记 `resolvedRuntimeEntry` 分开记录；实际入口即使未列在 artifacts 中，也加入两遍读取、hash、预算和 metadata 文件清单。
+- 项目 TS/JSX、隐式依赖、Node loader 绑定或 build 脚本不在本轮读取／编译支持范围。该模块不运行源码；实际编译器仍必须拒绝未列相对依赖、动态 require 和不支持的环境绑定。
+- `compilationInput` 形态：
+
+```js
+{
+  binding,
+  declaredEntry,
+  resolvedRuntimeEntry,
+  files: [{ path, code, sha256, bytes }],
+  evidenceBoundary: 'parent-observation-only',
+}
+```
+
+- `code` 只在批准前双遍 FD 读取时生成并保存于私有 WeakMap。后续 input/revalidate 会重新安全核对文件和登记状态，但**不重新生成或替换已保存字符串**；变更即拒绝。
+- UTF-8 code 解码使用 `fatal:true, ignoreBOM:true`，明确保留原 BOM、CRLF 和多字节字符；sha256/bytes 仍是原始文件字节，不把去 BOM 字符串冒充原文件。无效 UTF-8 拒绝。
+- 公开 snapshot 不含 code，且保留 `parent-observation-only` 标签。所有这些对象都不是 grant 或 sourceVerified 证据。
+
+## 生命周期与预算
+
+- 每遍仍最多 16 MiB 总读取，单 artifact 4 MiB、metadata 256 KiB；32 个运行文件包括新增实际入口。
+- 每个 resolver/producer 最多 64 个待办，并额外保守限制聚合保留代码为 16 MiB（按原 UTF-8 字节计数）。拒绝重入捕获／重入校验。
+- TTL 不超过五分钟，单调时钟校验加真实 `unref` timer；系统时钟回退／无效时关闭。timer 从最初捕获期限扣除已用时间，不因读取耗时额外延长。
+- 原 exec、owner、policy、producer 任一取消，即删除待办／代码／真实对象关联，只留轻量失效 tombstone。release/dispose/过期也清除；超容量不会挤出或复活旧句柄。
+- 这只能回收 resolver 持有的引用，不能擦除已交给可信编译器的 JS 字符串副本。外部 compiled capsule／prepared ticket／消费端仍须绑定其独立生命周期；该数据 API 不能保证一个拿到明文的同进程调用者忘记内容。
+
+## 回归范围
+
+`tests/development-compilation.spec.mjs` 使用真实临时文件和实际安全 FD 读取器，验证原字节／实际入口、登记匹配、exec 身份、信号换代、取消、双遍变更、symlink、预算、64 待办、回收和真实 TTL。其 exec/registry/lifetime 是明确测试夹具，不冒充真实 C 来源或外部生产挂载。真实 Native source、policy、task 生命周期由相应独立回归覆盖；跨组件生产接线仍待验证。