dsh-deeppilot 0.8.1 → 0.8.3

package/COMPATIBILITY.md

@@ -1,154 +1,35 @@
 # Compatibility
 
-This file separates tested evidence from intended behavior. Passing unit tests does not prove every DSH build, network, Mac, or iPhone combination.
+This branch targets **DSH 0.1.7-rc.2**. The DSH peer dependencies and the development packages are pinned to that exact release. Earlier DSH builds and later release candidates are outside this branch's support scope.
 
-## Public-beta baseline
-
-| Component | Baseline | Evidence |
+| Component | Current contract | Evidence |
 |---|---|---|
-| Node.js | 22 or newer | package engine and CI |
-| DSH CLI and Host API | the `0.1.5-rc.*` and `0.1.6-*`/`0.1.6` lines, `0.1.5-rc.1` minimum, for plugin `0.7.x` | plugin source typecheck, unit suite (301 tests) and `tsdown` build run against the `0.1.5-rc.2`, `0.1.6-alpha.1` and `0.1.6-alpha.2` package families; the `deeppilot/report` contribution registered through both the `0.1.6-alpha.1` and the `0.1.6-alpha.2` `TypertRegistry`; bridge and `/phone` protocol tests |
-| Host OS | macOS, Linux, Windows on packaged amd64/arm64 helper targets | helper checksums plus user-confirmed Windows/Linux Funnel launch and connection; local LAN validation remains part of alpha testing |
-| Remote access | Tailscale Funnel, ports 443/8443/10000 | helper and supervisor tests |
-| iOS | native DeepPilot client, protocol v2 | simulator build and v2 pairing/challenge evidence |
+| Node.js | 22 or newer | Package engine and CI |
+| DSH CLI and Host API | `0.1.7-rc.2` | Peer metadata, source typecheck, unit tests, bundle build, and config schema projection against rc.2 |
+| iOS bridge | DeepPilot protocol v2 | Bridge protocol tests; device behavior must be checked with the running Host and app |
+| Remote access | Tailscale Funnel on ports 443, 8443, or 10000 | Helper and supervisor tests |
+
+## DSH interfaces used here
+
+- The Host adapter uses Session and Workspace controllers, Gateway Remote Events, and `typertGateway.wireStream.open(endpoint, payload, uplink, peer, signal)`. Its in-process carrier passes `undefined` for `uplink` and `peer` and the cancellation signal in argument five.
+- The resident Client sends relative RPC paths such as `api/$events/result`. The in-process transport resolves those paths to a local URL before constructing a Node `Request`; the shared Fetch handler dispatches it without a network request. This is required for iOS approval and question answers to settle at the Gateway.
+- The client settings page binds `configForms.get('deeppilot')` when the service becomes available. The Host reads volatile config references from its profile entry and reconciles transports on `loader/volatile-update`.
+- Typert strict codecs publish `create()` factories. Session opening reads `session.projections` for a complete baseline.
+- The Host adapter retains a stable bridge-facing API so the phone protocol does not depend directly on DSH controller shapes. This adapter is an internal design boundary, not support for an older DSH Host.
+
+## Separate protocol and data boundaries
+
+- Protocol v2 is the only supported phone wire version. Protocol-v1 devices must pair again. The LAN listener uses its own TLS identity and certificate pinning; old LAN pairings without a fingerprint must also pair again.
+- The current app accepts the `deeppilot://pair` link and the JSON pairing payload. Bearer authentication, URL credentials, and first-frame shared tokens are rejected; devices register a P-256 public key and sign each WebSocket challenge.
+- The plugin's persisted device and Funnel state migration remains separate from DSH API version support. Session logs written by earlier DSH builds are readable only when the current Host's own history reader accepts them; this plugin does not rewrite those logs.
+- An unavailable optional OS facility, transport, or controller disables its dependent capability without crashing the Host.
 
-## Protocol boundary
+## rc.2 feature planning
 
-- Protocol v2 is the only supported wire version. Existing protocol-v1 devices must pair again after upgrading.
-- The pairing QR now encodes a `deeppilot://pair` link, and the settings page shows that same string in one copy field. An app build that predates the link only parses the JSON payload, so it must be updated before pairing against this plugin; a link pasted into an older app is rejected instead of being half-applied. The current app still accepts the JSON payload.
-- Plugin `0.7.x` serves the LAN listener over self-signed TLS only; devices paired over LAN with `0.6.x` or older must pair again so the app receives the certificate fingerprint. The DSH web server no longer carries `/phone` compatibility routes. Funnel pairings are unaffected.
-- Bearer authentication, URL credentials, and first-frame shared tokens are rejected. A supported client registers a P-256 public key through `/phone/pair` and signs each WebSocket challenge.
-- Without a compatible embedded helper, the core bridge and trusted-LAN mode can still run; remote Funnel reports `unavailable`.
-- If a DSH Host API is missing, only the dependent capability should be disabled. The plugin must not crash the Host.
-- Plugin `0.7.x` requires DSH `0.1.5-rc.1` or newer within the `0.1.x` line.
-  Older plugin versions used developer-preview DSH builds and remain historical
-  artifacts.
-- The declared peer range is a disjunction,
-  `^0.1.5-rc.1 || >=0.1.6-alpha.1 <0.2.0-0 || >=0.1.7-alpha.1 <0.2.0-0`,
-  because npm's prerelease rule only
-  lets a prerelease version satisfy a range whose comparators carry a
-  prerelease on the same `major.minor.patch` tuple. Neither `^0.1.5-rc.1` nor
-  `>=0.1.5-rc.1` alone admits a `0.1.6` prerelease, and the `0.1.7-alpha.*`
-  line is likewise rejected by `>=0.1.6-alpha.1 <0.2.0-0` because no
-  comparator there carries a prerelease on the `0.1.7` tuple — every new
-  prerelease line needs its own disjunct.
-  `tests/compatibility-metadata.test.ts`
-  asserts the range admits `0.1.5-rc.1`, `0.1.5-rc.2`, `0.1.6-alpha.1`,
-  `0.1.6-beta.1`, `0.1.6`, `0.1.7-alpha.1` and `0.1.7`,
-  and rejects `0.2.0`.
-- DSH `0.1.6-alpha.1` replaced `agent/session-start` with `agent/created`,
-  deprecated the synchronous `snapshotEvents`/`eventAt`/`ownEvents` history
-  readers, and renamed the PTC packages to the `ptc-runtime` family. The plugin
-  uses none of those surfaces: every host dependency is resolved structurally
-  from the Cordis context (`sessionController`, `workspaceController`,
-  `directoryPickerController`, `sessionProjections`) and the `session/event`
-  and `api-session/*` events, all of which kept their `0.1.5-rc` shape.
-- DSH `0.1.6-alpha.2` changed the strict codec shape carried by an
-  `InvocationDescriptor`. Through `0.1.6-alpha.1` a descriptor published the
-  schema value itself and every consumer called `codec.schema.parse(value)`;
-  `alpha.2` instead validates a lazy `create()` factory at registration and the
-  Gateway parses through `codec.create().parse(value)`. A codec carrying only
-  `schema` is rejected by the `alpha.2` registry
-  (`typert: … strict codec has no create() factory`), which aborts plugin
-  activation. One `strictCodec()` helper in `src/report-wire.ts` emits both
-  keys — the same hand-written, dependency-free codec — so a single published
-  package registers and parses on either generation, and
-  `tests/report-wire.test.ts` pins both access paths.
-  The other `alpha.2` Typert change — a contributed schema's materialized
-  `schema` becoming a lazy `create()` factory — does not apply here: this
-  Remote contributes no schemas, which the same test asserts.
-- DSH `0.1.7-alpha.1` reordered the Host `typertGateway.wireStream.open`
-  parameters from `(endpoint, payload, signal)` to
-  `(endpoint, payload, uplink, peer, signal)`. The reorder is not additive: a
-  3-argument call lands the `AbortSignal` in the `uplink` slot, leaves `signal`
-  undefined, and the Host fails every stream inside
-  `AbortSignal.any([signal, …])` with
-  `TypeError [ERR_INVALID_ARG_TYPE]: The "signals[0]" argument must be an
-  instance of AbortSignal`. The resident Client's Connection treats that dead
-  generation as a lost connection and prints an endless
-  `[connection] connection lost, retry #N` loop with exponential backoff while
-  the phone's approval and question round-trips stay broken.
-  `openHostStream()` in `src/dsh012-remote-interactions.ts` selects the
-  contract from the published arity (`open.length`) and passes `undefined` for
-  both `uplink` and `peer` on 0.1.7 — the documented "operator's in-process
-  carrier" case, since DeepPilot's carrier owns the Host in process and has no
-  Client-to-Host uplink. `tests/dsh012-wire-stream-contract.test.ts` pins the
-  argument binding for a 3-arity and a 5-arity Host, and asserts the signal
-  lands in each contract's declared slot.
-- DSH `0.1.7-alpha.1` rewrote the settings subsystem: `installSection`,
-  `SettingsSectionHooks`, and the client `settingsScope` service are gone,
-  section values persist in this plugin own profile config entry, and the
-  settings UI refuses writes to fields the schema does not declare
-  `.volatile()`. The plugin adapts across both generations: `live()` in
-  `src/config.ts` feature-detects the volatile method and, on schemastery
-  3.18.2, writes the same metadata through `extra('volatile', true)` (an
-  unconditional `.volatile()` throws at import on ≤ 0.1.6 and kills
-  activation); volatile fields are exactly the ones the settings surface
-  writes (`enabled`, `local`, `remote`, plus read-time `debug`) while
-  `devicesPath`, `historyBufferMax`, and `push` keep remount-on-edit
-  semantics; `normalizeOptions` unwraps the `{ get() }`
-  references 0.1.7 carries in `apply()` options (a surviving reference fails
-  every plain-value comparison the bridge makes), the host re-runs its
-  transport reconciles on `loader/volatile-update`, and the client binds
-  `ctx.configForms.get('deeppilot')` through `src/client/settings-scope.ts`
-  when `settingsScope` is absent. Neither seam is declared in the client
-  entry's `inject`: a service name no running host provides keeps the whole
-  entry pending (`dsh-deeppilot: pending (waiting for service: settingsScope)`
-  on the first 0.1.7 boot), so both are awaited as optional injections, and
-  both are read through `ctx.get()` because a Cordis context proxy throws
-  `cannot get property "settingsScope" without inject` on an undeclared
-  service read; `tests/client-entry.test.ts` activates the real entry against
-  a Cordis context shaped like each generation and pins that audit. The same
-  release added
-  `session.projections`; the bridge feature-detects it via
-  `supportsProjections` and refreshes a session projection baseline on open,
-  while older hosts keep list-row projection hints. Plugin-manager display
-  metadata (`locale/*.json`, `package.json.icon`) and `--dump-config-schema`
-  are additive and inert on older hosts; `npm run check:config-schema`
-  projects this package Config through the pinned 0.1.7 CLI in CI and pins
-  the volatile annotations on the four live fields (devDependency floor:
-  `@deepseek-ai/schemastery` 3.18.3, which is also what a profile install
-  resolves through the `^3.18.2` peer range).
-- `icon.svg` is a vector recreation of the iOS app icon, built from the
-  private app's own Icon Composer sources (`ios/DeepPilot.icon/icon.json`
-  plus `Assets/deepseek.svg`) and the in-app composition its
-  `AppIconArtwork` applies: a white field, the DeepSeek brand glyph fitted
-  with 13% padding, and a `Color(white: 0.25)` → black vertical gradient.
-  The app's `.icon` bundle is not distributable through npm — the host
-  inlines a single relative SVG, PNG, JPEG, or WebP file under 256 KiB as a
-  `data:` URI — so the recreation is the only way to keep the two icons
-  visually identical. `tests/package-meta.test.ts` pins the host's reader
-  rules; regenerate the SVG from the app sources whenever the app icon
-  changes.
-- DSH `0.1.6-alpha.2` made runtime plugin removal real, through both the
-  Plugin Manager and the client entry reconciler. Every long-lived resource is
-  registered through `ctx.effect`, and the settings-page stylesheet stamps
-  `data-plugin="dsh-deeppilot"` so the module system's `removeOwnedStyles()`
-  can delete it; the module system only auto-claims styles present during
-  factory materialization, while this sheet is injected from `apply()`.
-  Without that stamp, disabling the plugin would leave its sheet styling the
-  page.
-- The compatibility facade converts the
-  current Session controller's raw event arrays into the stable wrapped
-  history entries consumed by the phone bridge. Sessions persisted by earlier
-  Hosts can therefore be listed and opened when the rc.1 Host's own
-  persistence reader accepts their log vocabulary. Unsupported persisted
-  formats still fail closed in the Host without modifying the original log.
+The source-level audit of `dsh-v0.1.7-rc.2` found no breaking change in the DSH service surfaces currently used by the plugin. The exact rc.2 package pins, corrected registry lockfile, compatibility assertions, generated output, unit tests, typecheck, build, and config-schema check now pass locally. A real rc.2 `web` profile smoke test and the clean-install release gate remain before publishing. The planned phone additions for durable schedules and session forking are specified in [`docs/DEEPPILOT_FEATURE_PLAN.md`](./docs/DEEPPILOT_FEATURE_PLAN.md); they are not advertised until the protocol, iOS mirror, and integration tests land.
 
-## Not yet claimed
+The complete audit evidence and re-audit procedure remain in [`docs/DSH_RELEASE_MEMORY.md`](./docs/DSH_RELEASE_MEMORY.md).
 
-- Intel macOS support for the embedded helper;
-- signed/notarized helper distribution;
-- validation against the `0.1.7-*` package line: the peer range admits
-  `0.1.7-alpha.1` and later `0.1.7` releases, and the `wireStream.open`
-  reorder that release introduced is adapted and pinned by
-  `tests/dsh012-wire-stream-contract.test.ts`, but the unit suite still runs
-  against the `0.1.5-rc.1`/`0.1.6-*` package families and no `0.1.7`
-  typecheck or full-suite evidence has been produced yet;
-- repair or migration of persisted history rejected by the Host's own session
-  reader;
-- every DSH developer-preview revision;
-- physical-device performance and every carrier/network combination;
-- production APNs delivery without a real provider credential and device.
+## Evidence limits
 
-When reporting an issue, include `node --version`, the exact DSH package version, plugin commit/tag, macOS version and architecture, connection mode, and sanitized status output. Never include pairing codes, key material, APNs tokens, or message content.
+Unit tests and config schema projection do not prove every network, Mac, Linux, Windows, or iPhone combination. In particular, physical-device performance, signed helper distribution, and production APNs delivery need their own checks. Include the exact DSH version, plugin commit, Node version, OS, connection mode, and sanitized status output when reporting a compatibility issue; never include credentials or message content.

package/README.md

@@ -32,30 +32,16 @@ Host on your own Mac and does not replace or modify the DSH Web UI.
 
 ## Install from npm
 
-Requirements: Node.js 22+ and DSH with a `web` profile. The package includes
+This source checkout targets Node.js 22+ and **DSH 0.1.7-rc.2** with a `web` profile. The package includes
 Funnel helpers for macOS, Linux, and Windows on amd64/arm64; trusted-LAN mode
 does not require the helper.
 
-| Plugin version | Required DSH | How to install |
-|---|---|---|
-| `0.8.x` (current stable, `latest`) | DSH `0.1.5-rc.1` or newer | `dsh plugin --profile web add dsh-deeppilot` |
-| `0.7.x` (previous stable) | DSH `0.1.5-rc.1` or newer | `dsh plugin --profile web add dsh-deeppilot@0.7.1` |
-| `0.6.x` (legacy) | DSH `0.1.5-rc.1` or newer | `dsh plugin --profile web add dsh-deeppilot@0.6.2` |
-
-`0.8.x` is built and typechecked against the DSH
-[0.1.5-rc.1](https://www.npmjs.com/package/@deepseek-ai/dsh/v/0.1.5-rc.1)
-and [0.1.7-alpha.1](https://www.npmjs.com/package/@deepseek-ai/dsh/v/0.1.7-alpha.1)
-Host and client package families — the config-schema release check projects the
-plugin's Config through the pinned 0.1.7 CLI. It uses the Gateway multi-client
-Remote Events routing that keeps Web and DeepPilot independently answerable.
-Earlier plugin alphas remain historical artifacts; users installing the `alpha`
-tag for pre-release testing should update DSH to `0.1.5-rc.1` or newer.
+The current working tree pins its DSH packages and compatibility checks to
+`0.1.7-rc.2`. A previously published plugin package may still carry its own
+older compatibility declaration until a release is made from this tree.
 
 ```sh
-# DSH 0.1.5-rc.1 or newer (recommended):
 dsh plugin --profile web add dsh-deeppilot
-# DSH 0.1.1-rc.2 through 0.1.2-alpha.1 (previous stable):
-dsh plugin --profile web add dsh-deeppilot@0.5.0
 dsh web
 ```
 
@@ -94,16 +80,12 @@ DeepPilot state under `$DSH_HOME/deeppilot/`.
 
 ## Publishing (maintainers)
 
-`0.8.x` targets DSH `0.1.5-rc.1`+ and adapts to the DSH 0.1.7 settings rewrite;
-`0.7.x` keeps the pre-0.1.7 settings API during the migration window, `0.6.x`
-keeps the pre-TLS LAN transport for the same DSH family, and `0.5.x` stays
-compatible with DSH `0.1.1-rc.2`–`0.1.2-alpha.1`. Keep them published:
+Release from this branch only after validating against DSH `0.1.7-rc.2`:
 
 1. Bump `version` in `package.json` and in the root `""` entry of
    `package-lock.json`, then run `npm test && npm run typecheck && npm run build`
-   and inspect `npm pack --dry-run --json` (the check
-   `tests/compatibility-metadata.test.ts` enforces the peer range and asserts it
-   admits the `0.1.5-rc.*`, the `0.1.6-*`, and the `0.1.7-*` lines).
+   and inspect `npm pack --dry-run --json`. The compatibility metadata test
+   enforces the exact rc.2 peer and development dependency versions.
 2. Commit the release and push it. `npm publish` runs `prepack` (build) and
    `prepublishOnly` (test + typecheck) automatically.
 3. Publish pre-releases without touching `latest`:
@@ -112,10 +94,8 @@ compatible with DSH `0.1.1-rc.2`–`0.1.2-alpha.1`. Keep them published:
    npm publish --tag alpha
    ```
 
-   After a successful publish, `npm view dsh-deeppilot dist-tags --json` shows
-   `"latest": "0.8.x"` and `"alpha": "0.8.x-alpha.y"`. Verify the published
-   package by installing it into a DSH `0.1.5-rc.1` profile before pointing
-   users at it.
+   After a successful publish, verify the dist tag and install the package in
+   a DSH `0.1.7-rc.2` profile before pointing users at it.
 4. Tag the release commit `vX.Y.Z` and prepare a GitHub Release
    (English + 简体中文 notes) that links this README section.
 5. Publish stable releases with `npm publish --tag latest`, which moves
@@ -137,7 +117,10 @@ connection, one-time pairing, and health endpoints, not the complete DSH Web UI.
 The DeepPilot settings page exposes **Connections per public source** under
 the collapsed **Advanced settings** section. It defaults to `8`, accepts
 `1`–`16`, and briefly restarts the Funnel helper when changed, so connected
-remote clients reconnect once.
+remote clients reconnect once. The device list also supports a custom name for
+each paired device. Names are stored in the host registry and survive iPhone
+reconnects or changes to the system-reported name; saving an empty value restores
+the iPhone-reported default.
 
 Offline push is optional. Relay mode sends only the target APNs device token
 and a limited notification payload; full conversation history and live output

package/README.zh-CN.md

@@ -30,28 +30,14 @@
 
 ## 从 npm 安装
 
-需要 Node.js 22+ 和带 `web` profile 的 DSH。npm 包内置 macOS、Linux、Windows
+当前源码仅面向 Node.js 22+ 与带 `web` profile 的 **DSH 0.1.7-rc.2**。npm 包内置 macOS、Linux、Windows
 的 amd64/arm64 Funnel helper；可信局域网模式不依赖 helper。
 
-| 插件版本 | 所需 DSH | 安装命令 |
-|---|---|---|
-| `0.8.x`（当前稳定版，`latest`） | DSH `0.1.5-rc.1` 或更高 | `dsh plugin --profile web add dsh-deeppilot` |
-| `0.7.x`（旧版稳定版） | DSH `0.1.5-rc.1` 或更高 | `dsh plugin --profile web add dsh-deeppilot@0.7.1` |
-| `0.6.x`（历史版本） | DSH `0.1.5-rc.1` 或更高 | `dsh plugin --profile web add dsh-deeppilot@0.6.2` |
-
-`0.8.x` 基于 DSH
-[0.1.5-rc.1](https://www.npmjs.com/package/@deepseek-ai/dsh/v/0.1.5-rc.1)
-与 [0.1.7-alpha.1](https://www.npmjs.com/package/@deepseek-ai/dsh/v/0.1.7-alpha.1)
-的 Host 与 client 包族构建并完成类型检查 —— 发布前的 config-schema 检查会通过
-固定的 0.1.7 CLI 投影本插件的 Config。它使用 Gateway 多 Client Remote Events
-路由，使 Web 与 DeepPilot 能独立处理同一交互。旧 alpha 仅保留为历史产物；安装
-`alpha` tag 进行预发布测试的用户应先把 DSH 更新到 `0.1.5-rc.1` 或更高版本。
+当前工作树的 DSH 包和兼容性检查均固定为 `0.1.7-rc.2`。从此工作树发布新版本前，
+已发布的旧插件包仍可能带有各自的旧兼容声明。
 
 ```sh
-# DSH 0.1.5-rc.1 或更高（推荐）：
 dsh plugin --profile web add dsh-deeppilot
-# DSH 0.1.1-rc.2 至 0.1.2-alpha.1（旧版稳定）：
-dsh plugin --profile web add dsh-deeppilot@0.5.0
 dsh web
 ```
 
@@ -82,14 +68,12 @@ dsh plugin --profile web remove dsh-deeppilot
 
 ## 发布说明（维护者）
 
-`0.8.x` 面向 DSH `0.1.5-rc.1`+ 并适配 DSH 0.1.7 的设置系统重写；迁移期内
-`0.7.x` 保留 0.1.7 之前的设置 API，`0.6.x` 在同一 DSH 版本族上保留 TLS 化之前的
-局域网传输，`0.5.x` 保持兼容 DSH `0.1.1-rc.2`–`0.1.2-alpha.1`，各版本线都要保持发布：
+此分支仅在 DSH `0.1.7-rc.2` 下完成验证后发布：
 
 1. 同步修改 `package.json` 与 `package-lock.json` 根 `""` 条目中的
    `version`，然后运行 `npm test && npm run typecheck && npm run build`，
-   并检查 `npm pack --dry-run --json`（`tests/compatibility-metadata.test.ts`
-   会强制校验 peer 范围，并断言它同时接纳 `0.1.5-rc.*`、`0.1.6-*` 与 `0.1.7-*` 三条线）。
+   并检查 `npm pack --dry-run --json`。兼容性元数据测试会校验 peer 与开发依赖
+   均固定为 rc.2。
 2. 提交发布并推送。`npm publish` 会自动执行 `prepack`（构建）与
    `prepublishOnly`（测试 + 类型检查）。
 3. 发布预发布版本，不要动 `latest`：
@@ -98,9 +82,7 @@ dsh plugin --profile web remove dsh-deeppilot
    npm publish --tag alpha
    ```
 
-   发布成功后，`npm view dsh-deeppilot dist-tags --json` 应显示
-   `"latest": "0.8.x"` 与 `"alpha": "0.8.x-alpha.y"`。向用户推荐前，请先在
-   DSH `0.1.5-rc.1` profile 中安装验证发布的包。
+   发布成功后检查 dist tag，并在 DSH `0.1.7-rc.2` profile 中安装验证发布的包。
 4. 为发布提交打 `vX.Y.Z` tag，并准备包含英文与简体中文说明的
    GitHub Release，链接本 README 的发布说明。
 5. 稳定版用 `npm publish --tag latest` 发布，使 `latest` 切换到新版本。
@@ -119,7 +101,9 @@ DSH Web UI。
 
 DeepPilot 设置页在默认折叠的“高级设置”中提供“每个公网来源的连接上限”，默认
 `8`，可设置为 `1`–`16`。修改后 Funnel helper 会短暂重启，已连接的远程客户端
-会自动重连一次。
+会自动重连一次。设备列表支持为每台已配对设备设置自定义名称；名称会保存在主机
+设备注册表中，即使 iPhone 重连或上报了新的系统名称也不会被覆盖。留空保存可恢复
+iPhone 上报的默认名称。
 
 离线推送是可选功能。中继模式只发送目标 APNs 设备 Token 和有限的通知内容；
 完整会话历史与实时输出不会经过中继。启用远程访问或推送前，请阅读

package/SKILL.md

@@ -0,0 +1,87 @@
+---
+name: dsh-release-audit
+description: Audit DeepSeek Harness releases for the dsh-deeppilot plugin. Use when a DSH version changes, when checking plugin compatibility, or when looking for new DSH capabilities that could become safe DeepPilot features.
+---
+
+# DSH release audit for DeepPilot
+
+Use this skill to keep the public `dsh-deeppilot` plugin aligned with DeepSeek
+Harness without repeatedly rediscovering the compatibility rules.
+
+## Source of truth
+
+Read these files before making a compatibility decision:
+
+- `docs/DSH_RELEASE_MEMORY.md` — the last audited release, risk decisions,
+  feature opportunities, and the re-audit rule;
+- `COMPATIBILITY.md` — the currently supported DSH baseline and validation
+  limitations;
+- `AGENTS.md` — repository contracts and validation requirements;
+- `package.json` and `package-lock.json` — the exact DSH peer/development pins.
+
+Treat the official DSH release page and tagged source as evidence, not the
+release-note summary alone.
+
+## Audit workflow
+
+1. Identify the new DSH tag and the last audited tag. Fetch the official
+   release page and the complete tag-to-tag comparison.
+2. Read this repository's `package.json`, lockfile, compatibility assertions,
+   and DSH adapter source. Identify the exact Host services, Events, Remote
+   methods, Gateway carriers, and Client bundles that the plugin imports.
+3. Inspect the corresponding tagged DSH source for each used surface. Check
+   method presence, argument/result shapes, stream envelopes, lifecycle
+   behavior, and package version constraints.
+4. Classify the result separately as:
+   - **install/deployment**: package metadata, peer constraints, loader and
+     profile compatibility;
+   - **runtime**: Host service, Gateway, Cordis lifecycle, and event behavior;
+   - **phone protocol**: DeepPilot `PROTOCOL.md` v2, iOS mirror, pairing,
+     replay, and authorization boundaries.
+5. Identify new capabilities. For each candidate, state the user value, the
+   DSH API it would use, the required DeepPilot protocol/UI work, the
+   authorization scope, and the tests needed before shipping it.
+6. Update `docs/DSH_RELEASE_MEMORY.md` with the tag, date, evidence links,
+   decision, risks, feature backlog, and upgrade gate. Update
+   `COMPATIBILITY.md` when the supported baseline changes.
+7. Never claim a release is supported until the dependency pins, generated
+   output, automated checks, and a real DSH Host smoke test have passed.
+
+## DeepPilot-specific rules
+
+- Keep `/phone` and `/phone/health` compatible with the current iOS app.
+- Treat `PROTOCOL.md` as normative. Any phone wire change must update the
+  TypeScript mirror and coordinate with the private iOS repository.
+- Protocol v2 is the current baseline. New optional capabilities should be
+  capability-gated; do not silently change existing frame meanings.
+- A DSH controller change belongs behind the stable `ApiProxyLike` boundary;
+  do not leak DSH controller shapes into the phone protocol.
+- Reminder prompts, message bodies, pairing tokens, APNs tokens, relay
+  credentials, and tool arguments must not be written to logs.
+- New file-open or shell-like behavior must use DSH's verified Host path seam
+  and explicit user confirmation. Never add arbitrary remote command execution.
+- Scheduled tasks must remain bound to their original DSH Session and use a
+  dedicated authorization scope when exposed to phones.
+
+## Required validation
+
+For documentation-only audits, run `git diff --check` and verify every link.
+For an actual DSH dependency upgrade, run the repository's full release
+checklist, including tests, typecheck, build, config schema projection, Go
+helper tests, and binary checksums. Add a real DSH `web` profile smoke test for
+sessions, history, prompts, models, workspaces, approvals, questions, replay,
+and any newly exposed capability.
+
+## Output format
+
+When reporting an audit, lead with one of these verdicts:
+
+- **compatible** — tested and ready to support;
+- **source-compatible, upgrade required** — no code break found, but pins or
+  validation still block release;
+- **runtime risk** — a used service or event needs an integration change;
+- **protocol impact** — DeepPilot/iOS wire coordination is required;
+- **unsupported** — a confirmed incompatibility remains.
+
+Never turn a source-level review into a false claim of runtime or iPhone
+compatibility.

package/docs/DSH_RELEASE_MEMORY.md

@@ -0,0 +1,98 @@
+# DSH release compatibility memory
+
+> This is the durable audit record for DeepPilot's public DSH plugin. Re-audit
+> the next DSH release instead of assuming that an rc upgrade is runtime-safe.
+
+## Current decision
+
+- **Audited release:** `dsh-v0.1.7-rc.2` (official release page: <https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.1.7-rc.2>).
+- **Comparison baseline:** `dsh-v0.1.7-rc.1` (the previous plugin baseline).
+- **Plugin runtime verdict:** **no confirmed breaking change in the DSH APIs
+  that DeepPilot currently calls**.
+- **Install/deployment verdict:** the exact peer/dev pins and lockfile are now
+  updated to `0.1.7-rc.2`; `npm test`, `npm run typecheck`, `npm run build`, and
+  the rc.2 config-schema check pass locally. Support still awaits a real rc.2
+  `web` profile smoke test and the release checklist's clean-install gate.
+- **Protocol verdict:** no required DeepPilot phone-protocol break was found in
+  the rc.2 release notes or the inspected rc.2 source. This does not waive the
+  normal integration test against a real rc.2 Host.
+- **Current implementation:** the optional DSH Schedule facade, schedule phone
+  frames, `schedule.manage` authorization, DSH `schedule/changed` projection,
+  a prompt-free persistent mutation journal, and the DSH Session fork facade
+  with fork idempotency are implemented and locally tested. The private iOS
+  protocol mirror, BridgeClient/AppModel integration, reminder list/editor/
+  history UI, and message “Branch from here” action are implemented; real
+  Host/iPhone integration remains pending.
+
+## Evidence and risk assessment
+
+| Area | rc.2 finding | DeepPilot impact |
+| --- | --- | --- |
+| Session controller | The rc.2 source still exposes the methods used by the adapter: `list`, `inspect`, `create`, `modelCatalog`, `selectModel`, `rename`, `prompt`, `attachment`, `cancel`, and `projections`. It adds `search`, `page`, `follow`, `fork`, `updateQueue`, `initializeDefaultModel`, and native workspace-path operations. | Existing calls are source-compatible at the inspected API level. New calls must remain optional and capability-gated. |
+| Workspace controller | `create`, `archiveSession`, `unarchiveSession`, and `follow` remain. rc.2 adds rename/delete/order/pin operations and archive activity handling. | Existing bridge behavior is source-compatible. Archive behavior is stricter when a Session has active work, including scheduled reminders. |
+| Gateway / Typert | The in-process `typertGateway.wireStream.open(endpoint, payload, uplink, peer, signal)` seam used by the resident approval/question Client remains. Typert registration still exposes `register(contribution)`. | No confirmed break in the resident Remote Events path. Re-run the approval/question tests on rc.2 because this is the highest-risk integration seam. |
+| Release metadata | The plugin's peer/dev pins and lockfile now target rc.2 with real rc.2 integrity metadata. | Keep `package.json`, `package-lock.json`, compatibility assertions, generated `lib/`, and release documentation synchronized before claiming rc.2 support. |
+| DSH event/history internals | rc.2 continues to evolve session projections, history paging, and assistant stream presentation. The plugin currently consumes the older `session/event`/`inspect` projection seam rather than the newer Remote `page`/`follow` surface. | Treat as a compatibility risk requiring a real Host smoke test, not as a confirmed wire break. Keep the phone protocol independent of DSH controller shapes. |
+
+Official comparison: <https://github.com/deepseek-ai/deepseek-harness/compare/dsh-v0.1.7-rc.1...dsh-v0.1.7-rc.2>.
+
+## New rc.2 capabilities worth using
+
+Prioritized for DeepPilot, in this order:
+
+1. **Durable reminders and schedules (highest value).** DSH now has
+   `schedule_create`, `schedule_list`, `schedule_delete`, and
+   `schedule_update`, persistent one-shot/fixed-rate/daily/weekly/cron tasks,
+   restart survival, delivery history, and a minimum one-minute interval. Add
+   an optional, session-bound schedule surface to the phone: list tasks, create
+   or edit a task, delete it, and show delivery history. Keep all operations
+   behind `sessions.manage` plus a dedicated schedule scope; never log reminder
+   prompts. A reminder must remain bound to its original Host Session.
+2. **Host Session search.** `sessionController.search(query)` returns bounded
+   snippets without activating an Agent. This maps naturally to a phone search
+   screen and can reduce the amount of history transferred over a mobile link.
+   Return only the bounded snippet/session identity and keep it in the
+   `sessions.read` authorization domain.
+3. **Conversation forking.** `sessionController.fork({ sessionId, atSeq? })`
+   enables a phone action such as “branch from this turn”. It is additive to
+   the phone protocol but needs an iOS mirror, cursor/ownership tests, and a
+   deliberate policy for subagent and archived Sessions.
+4. **Queue editing.** `sessionController.updateQueue` supports editing,
+   removing, or steering a pending queue item. This is useful for a phone when
+   a turn is already running, but it needs first-class queue UI and conflict
+   handling rather than silently changing the existing prompt path.
+5. **Open/reveal on the Mac.** rc.2 adds verified native workspace-path opening
+   and application discovery. This could power a deliberate “Reveal in Finder /
+   Open associated app” action. Keep the Host's path verification and show an
+   explicit confirmation on the phone; do not expose arbitrary shell access.
+
+Features that are primarily Web/Desktop UX (onboarding, keyboard shortcut
+management, archived-only filters, account/API-key model entry separation, and
+background continuation) should not be copied into the phone plugin unless
+they solve a mobile-specific need.
+
+## Required rc.2 upgrade gate
+
+Do not call the rc.2 baseline fully supported until all of these are true:
+
+1. The exact DSH peer/dev pins and lockfile remain on `0.1.7-rc.2`.
+2. The plugin's full release checklist passes: `npm ci`, `npm test`,
+   `npm run typecheck`, `npm run build`, `npm run check:config-schema`, Go helper
+   tests, and the binary checksum verification.
+3. A real DSH rc.2 `web` profile smoke test covers: session list/open, history,
+   prompt, model selection, workspace list/create/archive/unarchive, approval,
+   question, and disconnect/reconnect replay.
+4. A phone-visible schedule create/list/update/delete/history flow is tested
+   after the schedule surface is implemented; a passing plugin build alone does
+   not prove mobile protocol compatibility.
+5. Fork is tested for exact event-prefix behavior, idempotent retries, and
+   original-session immutability after the fork surface is implemented.
+6. `COMPATIBILITY.md`, README compatibility text, generated `lib/`, and this
+   file are updated with the tested DSH version and intentional support range.
+
+## Re-audit rule
+
+For every future DSH release, compare the new tag against the last audited tag,
+inspect the package/service surfaces actually imported by this repository,
+classify install/runtime/protocol risk separately, and append a dated decision
+here. Do not treat a release-note summary as proof of compatibility.