dsh-deeppilot 0.9.4 → 0.9.5

package/docs/DSH_RELEASE_MEMORY.md

@@ -5,6 +5,78 @@
 
 ## Current decision
 
+- **Audited release:** `dsh-v0.2.1-alpha.3` (official release page:
+  <https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.2.1-alpha.3>),
+  published to npm 2026-10-14T13:32:15Z on the `alpha` dist-tag. It is **not**
+  `latest`; `latest`/`next` still point at `0.2.0-rc.2`. Baseline commit
+  `2fbf4359b82fb94c03dcce0b831660d87f12ea5c`, compared against alpha.2's
+  `d743267388641bc76f17c45ce8b4c231aed1d32c` (**852 commits, 3311 changed files,
+  120,978 insertions, 16,632 deletions**).
+- **Comparison baseline:** `dsh-v0.2.1-alpha.2` (the previous audited tag).
+- **Plugin runtime verdict: four confirmed breaks with one root cause — the
+  alpha.3 Peer model — and the resident interaction client does not start.**
+  **Fixed in this audit; see "The fix" below.**
+  This release makes every in-process carrier name a `PeerScope`
+  (`principal` / `signal` / `interactions`) explicitly; nothing defaults to the
+  operator any more. The four landing points, each with its own evidence:
+
+  | # | Upstream change | Plugin seam | Evidence |
+  | --- | --- | --- | --- |
+  | 1 | `TypertGatewayWireStream.open`'s 4th parameter `peer` is required; `assertPeerLive()` reads `peer.signal.aborted` before anything else | `src/dsh-remote-interactions.ts:180` passes `undefined, undefined` | Reproduced against the published bundles: alpha.2 returns normally, alpha.3 throws `TypeError: Cannot read properties of undefined (reading 'signal')` |
+  | 2 | `$events` additionally requires `peer.interactions === 'answer'` (`requireInteractions`) | same call | Reproduced: a peer with `interactions: 'none'` gets `gateway/interactions-forbidden`; a full owner/answer peer passes on **both** versions |
+  | 3 | `ConnectionFetchHandler.fetch(request, peer)` now takes a required Peer | `src/dsh-remote-interactions.ts:204` calls `fetchHandler.fetch(request)` | `lib/types/rpc.d.ts` declares `peer: PeerScope` required, "never defaulted" |
+  | 4 | `./client` gained `node`/`browser` conditions; Node now resolves `lib/client.node.js`, which carries **no** `window.__ModuleLoader__.load` banner | `loadClientFaces()` (`src/dsh-remote-interactions.ts:117`) builds its module table from that banner | `grep -c __ModuleLoader__` is 0 in `client.node.js`, 1 in `client.browser.js` and 1 in alpha.2's `client.js` |
+
+  A fifth, latent one: `installConnection` derives
+  `interactions ?? (location === undefined ? 'none' : 'answer')`, and the
+  plugin's Node context has no `location`, so `apply(ctx)` alone always selects
+  `'none'`. Passing an explicit Peer is not enough by itself — the install call
+  must name `interactions: 'answer'` too.
+- **Failure mode is degradation, not a crash — but only partly contained.**
+  `src/dsh-api-proxy.ts:316` wraps `startDshRemoteInteractions` in `try/catch`
+  and logs `[deeppilot] DSH Remote interaction client unavailable`. Breaks 3 and
+  4 surface while the resident client is being assembled, so they land in that
+  catch. Whether break 1/2 (the Gateway opens its Remote Events generation
+  asynchronously) also lands there is **not confirmed** — an uncaught rejection
+  there would be fatal under Node's default `--unhandled-rejections=throw`.
+  The phone loses approval/question delivery either way.
+- **Fix direction (verified compatible with both hosted versions):** build one
+  owner/answer Peer (`new Peer(ownerCtx, { principal: { kind: 'owner' },
+  interactions: 'answer' })`, falling back to `connection.operator` on alpha.2)
+  and name it in every carrier call — alpha.2 ignores a second `fetch` argument
+  and defaults an absent `open` peer to the operator, so one call form serves
+  both. `loadClientFaces` additionally has to accept the Node bundle's named
+  exports when the banner did not fire; both shapes export `apply`/`inject`
+  (`installConnection`/`transportError` are extra on Node).
+- **Install verdict: the peer range now names this release explicitly.** It moved
+  from the open-ended `>=0.2.0-rc.2 <0.3.0-0` to `0.2.0-rc.2 || 0.2.1-alpha.3`
+  across all ten `@deepseek-ai/dsh*` peers, and the two vendor peers widened to
+  `~4.0.4 || ~4.0.5-alpha.1` and `~3.18.4 || ~3.18.5-alpha.1`. Because DSH
+  evaluates that range on every start, the next DSH release deactivates this
+  plugin until the list is widened deliberately — see `docs/决策记录.md`
+  (章节一, 条目2), which records this as a reversal of the 2026-09-29 policy.
+  The published CLI composed the plugin's patch cleanly before the change (see
+  the 2026-10-14 entry). The plugin's own `lib/client.js` shape was not
+  re-verified against the alpha.3 client-modules scanner.
+- **Protocol verdict: no phone-protocol change.** Protocol v2, pairing state,
+  and device records are untouched by this release; no phone needs to re-pair.
+- **Two host-side migrations this machine must apply** (independent of the
+  plugin): `~/.dsh/profiles/web/cordis.patch.yml` carries
+  `llm-deepseek-account.config.models: []`, and alpha.3 throws on any residual
+  `models` key — **including an empty array** (`resolveAccountOptions`). Also
+  `dsh --profile <name> --from-default-profile <template>` now *replaces* an
+  existing profile directory (it deletes the old `node_modules` and
+  `cordis.patch.yml`); the audit procedure recorded below used that flag.
+- **Capability gaps, not regressions:** the `contextBreakdown` projection was
+  reshaped (`nodes[]` → `systems[]` + `surfaceTokens` + `claim`, stateVersion
+  5→6) and the plugin forwards it by key, so the phone may render empty values;
+  the model catalog shrank (account routes return only the version-gated
+  `offered` subset, pi-ai routes without a resolvable key return `[]`); and
+  `CLIENT_UPGRADE_REQUIRED` / `MODEL_UNSUPPORTED` are new codes with no mapping
+  in `src/wire-errors.ts` yet.
+
+### Previous decision — `dsh-v0.2.1-alpha.2`
+
 - **Audited release:** `dsh-v0.2.1-alpha.2` (official release page:
   <https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.2.1-alpha.2>),
   published to npm 2026-10-09T08:18:00Z on the `alpha` dist-tag. It is **not**
@@ -43,9 +115,21 @@
 
 ### Plugin release verdicts
 
-- **Release verdict (`0.9.4`, prepared 2026-10-10, NOT published):** carries the
-  `projections` adapter fix and the Automation tasks documentation correction
-  described in the 2026-10-09 entry below. `package.json`, both root
+- **Release candidate (`0.9.5`, 2026-10-15):** carries the alpha.3 Peer/client
+  compatibility repair, the exact two-host peer policy, cross-language auth
+  vectors and recovery guidance, and the manual OIDC/provenance workflow.
+  The package and both lockfile version entries are `0.9.5`; the apply baseline
+  records that version. Clean install, 562 passing unit tests (zero failures,
+  one existing TODO), typecheck, build, the real pinned-host schema loader,
+  Go tests, all six helper checksums, and package inspection pass locally.
+  The altered-challenge test now mutates the challenge from its own socket,
+  eliminating the timestamp collision, and passes 20 consecutive focused runs.
+  Registry/provenance and clean published-profile checks remain release gates;
+  no physical-iPhone validation is claimed. Notes: `docs/RELEASE_NOTES-0.9.5.md`.
+
+- **Release verdict (`0.9.4`, published 2026-10-10, tag `v0.9.4` @ `e2f77af`):**
+  carries the `projections` adapter fix and the Automation tasks documentation
+  correction described in the 2026-10-09 entry below. `package.json`, both root
   `package-lock.json` version entries, and `tests/apply-baseline.snapshot.json`
   are on `0.9.4`, and `lib/` is regenerated. The full checklist passed locally:
   `npm ci`, 538 unit tests, typecheck, build, the config-schema check against a
@@ -53,9 +137,24 @@
   `npm pack --dry-run` (65 files, 50,916,470 bytes packed). The fix was also
   verified on a live `0.2.1-alpha.2` host against the published `0.9.3` as an
   A/B control (25 pass / 0 fail either way, with the `sessions.projections
-  failed: internal` diagnostic present only on `0.9.3`). Nothing was
-  published, tagged, or pushed; npm `latest` still points at `0.9.3`, so users on
-  `0.2.1-alpha.2` keep hitting the projections defect until this ships.
+  failed: internal` diagnostic present only on `0.9.3`).
+  - **Registry verification after publishing.** `dist-tags.latest` moved off
+    `0.9.3`; `dist.shasum` `85b3c71a802e45e42f5fb1b23444ed2e396d39dc` is
+    byte-identical to the local `npm pack` output at the tag; 65 files,
+    `dist.unpackedSize` 130,789,604. **`gitHead` is `e2f77af`, the tag commit** —
+    the 0.9.3 ordering deviation did not repeat, because the release notes and
+    every other documentation change were committed before the pack. The publish
+    itself needed the maintainer's one-time password, as in 0.9.3; everything up
+    to and after it was done here.
+  - **Clean-profile verification.** A fresh isolated home, built from the shipped
+    Web template and installed with the published `0.2.1-alpha.2` CLI
+    (`dsh plugin --profile verify add dsh-deeppilot@0.9.4`), composed a real
+    profile: `--dump-config` printed the plugin's three rows
+    (`deeppilot-directory-picker-browse`, `…-browse-client`, `deeppilot`) with no
+    missing-module or load error, the installed package's six helper checksums
+    verified, every helper binary embedded `go1.26.9`, and the installed
+    `lib/index.js` carried the projections fix. Only then was the GitHub Release
+    taken out of draft and marked Latest.
   - **The release also had to fix the helper's toolchain and its refresh
     workflow.** CI's `govulncheck` job reported 11 reachable Go standard-library
     vulnerabilities for the pinned `go 1.26.6`; this is time-triggered, not
@@ -207,6 +306,224 @@
   bundle" below. The plugin needs no code change; the phone's copy now points
   at the bundle.
 
+## 2026-10-14 — audit of `dsh-v0.2.1-alpha.3`
+
+### Scope and method
+
+Compared `dsh-v0.2.1-alpha.2...dsh-v0.2.1-alpha.3` (**852 commits, 3311 changed
+files, 120,978 insertions, 16,632 deletions**) by fetching the new tag into the
+existing blobless clone (`.audit-dsh-alpha2`, whose HEAD was already the alpha.2
+audit's target SHA `d7432673`), then `git diff --name-status` and per-path
+content diffs into `.audit-alpha3/diffs/`. Four parallel read-only passes
+covered `packages/api` + `apps/cli` + `packages/typert` + `packages/settings` +
+`vendor`, `packages/client/{connection,locale,ui-settings,ui-slots}` +
+`packages/boot` + `packages/bundle`, `packages/{credentials,subagent,session,
+schedule}`, and `packages/{core,host,skill,llm}`. All **14** upgrade guides
+added by this release (under `docs/upgrade-guide/v0.2.0-rc.2/`,
+`v0.2.1-alpha.1/`, `v0.2.1-alpha.2/`) were read in Chinese in full.
+
+The alpha.2 audit's lesson — judge the seams reached through `ctx.get`, not just
+the peer list — is what caught this one: the peer list is *not* where the breaks
+are. `@deepseek-ai/dsh-api-remote-access` is new, `packages/schedule/schedule`
+has **zero** changed source files, and the peer packages' own exported surfaces
+moved far less than the carrier contracts around them.
+
+### The four confirmed breaks
+
+Every one is the same root cause: alpha.3 makes the Peer explicit. `PeerScope`
+(`@deepseek-ai/dsh-typert-protocol`) gained required `principal`, `signal`, and
+`interactions`; `client/connection` added a `Peer` class and deleted
+`OperatorPeer`; the Gateway deleted `operatorPeer()` and its
+`request.peer ?? this.operatorPeer()` fallback.
+
+Reproduction used the **published** bundles, the same technique as the alpha.2
+`projections` break, with the plugin's exact argument list
+(`open('$events', payload, undefined, peer, signal)`):
+
+```sh
+# .audit-alpha3/repro-peer-contract.mjs, against
+#   alpha.2: ~/.npm/_npx/b5c6312874079fe8/node_modules/@deepseek-ai/dsh-api-gateway/lib/index.js
+#   alpha.3: .audit-alpha3/cli-install/node_modules/@deepseek-ai/dsh-api-gateway/lib/index.js
+# A. peer = undefined                       (what the plugin sends today)
+alpha.2: 未抛错
+alpha.3: 抛错 TypeError: Cannot read properties of undefined (reading 'signal')
+# B. peer = { principal: owner, signal, interactions: 'none' }
+alpha.2: 未抛错
+alpha.3: 抛错 TypertGatewayError: $events: forwarded Remote events require interactions=answer
+# C. peer = { principal: owner, signal, interactions: 'answer' }
+alpha.2: 未抛错
+alpha.3: 未抛错
+```
+
+Break 4 was settled by reading the shipped artifacts rather than by inference:
+`@deepseek-ai/dsh-client-connection`'s `./client` now maps `node` →
+`lib/client.node.js`, and that file contains **zero** `__ModuleLoader__`
+occurrences while `client.browser.js` and alpha.2's `client.js` each contain
+one. `loadClientFaces` builds its module table *only* from that banner, so on
+Node the table stays empty. Both shapes export `apply` and `inject`, which is
+what makes a banner-optional fallback possible.
+
+### The fix
+
+One call form serves both audited hosts, because alpha.2 ignores a second
+`fetch` argument and defaults an absent `open` peer to the operator Peer it
+holds:
+
+- `src/dsh-remote-interactions.ts` mints one Peer through
+  `connection.createPeer({ principal: { kind: 'owner' }, interactions: 'answer' })`
+  and falls back to `connection.operator` on a Host without that entry point.
+  The same Peer is named on `fetch` and on `wireStream.open`.
+- The Connection install prefers the explicit
+  `installConnection(ctx, { transport, interactions: 'answer' })`, because
+  `apply(ctx)` cannot name the participation and therefore always selects
+  `'none'` for this caller; `apply` remains the fallback for a host that predates
+  the installer.
+- `loadClientFaces` accepts a Node bundle's named exports when the browser
+  banner did not register them. A banner registration still wins, because the
+  bundle's own internal `require()` resolves against it.
+
+Six regression tests in `tests/dsh-wire-stream-contract.test.ts` pin the
+contract: the operator fallback, the alpha.3 `createPeer` request shape and the
+Peer reaching `wireStream.open`, both installer branches, and both module-table
+branches. The file fails against the previous call form — verified by restoring
+the source and re-running (1 failure) — and passes after the fix.
+
+### Peer range narrowed to the two audited hosts
+
+By explicit user direction the DSH peer range stopped being open-ended:
+`>=0.2.0-rc.2 <0.3.0-0` became `0.2.0-rc.2 || 0.2.1-alpha.3` across all ten
+`@deepseek-ai/dsh*` peers, with `@deepseek-ai/cordis` widened to
+`~4.0.4 || ~4.0.5-alpha.1` and `@deepseek-ai/schemastery` to
+`~3.18.4 || ~3.18.5-alpha.1`. The two vendor peers are outside DSH's own peer
+check — it reads only `@deepseek-ai/dsh` and `@deepseek-ai/dsh-*` — so their
+ranges matter only to npm's install-time resolution, which runs without
+`includePrerelease`; naming both vendored prereleases keeps a clean install on
+either host. `devDependencies` stay pinned to `0.2.0-rc.2`.
+
+The consequence is deliberate: `evaluatePluginCompatibility` runs before a
+profile is composed on every start, so the next DSH release will refuse to
+activate this plugin until the list is widened by an audit. That reversal of the
+2026-09-29 policy is recorded in `docs/决策记录.md` (章节一, 条目2).
+`tests/compatibility-metadata.test.ts` now asserts both admissions, fifteen
+rejections, and the two vendor ranges.
+
+### Host-side changes with no plugin impact
+
+`packages/schedule/schedule/**` has no changed source; the schedule error-code
+table is identical, so `src/wire-errors.ts`'s twelve mappings (including
+`subagent_session → E_PROTOCOL`) stay correct. No session-log format migration
+exists — `session-format*`, `v0-to-v1`…`v3-to-v4`, `session-persistence`,
+`session-projection*`, `session-log-deepseek` changed only their version and
+locale files — so phone history rendering is unaffected. The subagent descriptor
+is still version 3. `host/webserver`'s `port` widening, the macOS directory
+picker, the PTC call registry, and the new `job/registered` / `job/settled`
+events are all unreachable or safely skipped by this plugin (`projectEvent`'s
+`default: return null`). Settings surfaces are unchanged at the contract level:
+`ui-settings`'s `settings.section` slot has the same SHA as alpha.2, and
+`configForms.get()` kept its name. The Web composition still mounts
+`schedule`/`ui-schedule`, and `directory-picker` is still disabled in place, so
+the plugin's three `cordis.patch.yml` rows still land.
+
+### Validation evidence
+
+- **Config schema on the published CLI:** isolated `DSH_HOME`, `dsh
+  --profile deeppilot-audit --from-default-profile sdk-minimal
+  --dump-config-schema --patch cordis.patch.yml` against
+  `@deepseek-ai/dsh@0.2.1-alpha.3` → exit 0, 179,851 bytes, the plugin entry at
+  `/37` reports `status: 'schema'` with `configRef: #/$defs/config24`, all seven
+  volatile assertions pass, no `deeppilot`-attributed diagnostic, and the only
+  warning is the `sdk-minimal` template's own missing `directory-picker` row.
+- **Web composition:** the same CLI composed a real Web profile with the plugin
+  patch → **1225 rows versus 1214 without it**, the plugin's three rows present
+  at `deeppilot-directory-picker-browse` / `…-browse-client` / `deeppilot`, and
+  zero `unrecognized Loader tree carrier` entries on either side.
+- **Plugin unit tests:** `npx tsx --test tests/*.test.ts` → **562 tests, 561
+  pass, 0 fail, 1 todo**, including the six new contract tests. `npm run
+  typecheck`, `npm run build`, and `npm run check:config-schema` (against the
+  pinned `0.2.0-rc.2` CLI) all pass with regenerated `lib/`.
+- **Live A/B on a real `0.2.1-alpha.3` host — the evidence that matters.** An
+  isolated `DSH_HOME` profile built from the shipped Web template and linked to
+  this working tree booted under the published alpha.3 CLI (`--port 3180`; the
+  default 3080 was already held by this machine's own Host). The **unfixed**
+  `0.9.4` build printed
+  `[deeppilot] DSH Remote interaction client unavailable:
+  @deepseek-ai/dsh-typert-registry/client Client bundle returned no exports`
+  and the fixed build printed no such line. The checklist itself scored
+  **23 pass / 1 fail / 4 skipped in both runs** — see the blind spot below.
+- **The regression checklist does not cover this seam.** `scripts/smoke-live.mts`
+  scored identically before and after the fix, because the resident Client it
+  exercises is only reachable through the approval/question waterfall, and step
+  10 is skipped without `--interactions`. The observable difference is the Host
+  log line and the phone's approval/question delivery, not a checklist step. A
+  future revision should assert on that diagnostic directly.
+- **Backward compatibility, same working tree:** the same profile booted under
+  the published `0.2.1-alpha.2` CLI (`--port 3181`) scored **25 pass / 0 fail /
+  0 warn / 3 skipped** with no interaction-client diagnostic — the same result
+  the alpha.2 audit recorded, so the fix does not regress the host users run
+  today.
+- **One checklist difference between the two host versions is real.**
+  `模型目录可读` passes on alpha.2 and fails on alpha.3 in the same isolated
+  home (`0 provider / 0 model, routable=true`): this release stops listing a
+  pi-ai route before its credential resolves and returns only the version-gated
+  subset for the account route. The home has no model credential, so the phone's
+  model list is empty there. That is the documented behavior change, not a
+  plugin defect.
+- **Artifact inspection:** the `node`/`browser` conditional exports and the
+  banner counts above were read from the installed alpha.3 packages, not from
+  the diff.
+
+### Host-side migrations this machine must apply
+
+Neither is a plugin defect, and neither is fixed by the plugin change:
+
+1. **`llm-deepseek-account`'s retired `models` key.**
+   `~/.dsh/profiles/web/cordis.patch.yml:77-79` sets `models: []`.
+   `resolveAccountOptions` throws for *any* own `models` key
+   (`llm-deepseek-account: models is no longer configurable…`), and the
+   upstream test pins `[{ models: [] }, /models is no longer configurable/]`.
+   The empty array is not exempt. The `desktop` profile's row carries no
+   `config` and is unaffected. Whether the throw takes the whole Host down or
+   only retires that route was **not** measured — the guide says the account
+   models stop appearing either way.
+2. **`--from-default-profile` now replaces.** It stages a fresh copy over the
+   target and deletes the previous directory, including `node_modules` and the
+   user's own `cordis.patch.yml`. The re-audit procedure below and the alpha.2
+   entry's schema command both use that flag; from now on it must be pointed at
+   a scratch name.
+
+Checked and **not** required: Azure provider rename (no `azure` /
+`azure-openai-responses` key exists under `~/.dsh/profiles`), credential-file
+extra keys (the file's top level is already `version`/`refs`/`records`), and
+the stored-credential precedence flip (no `refs` name is exported in the shell,
+and the stored value won precedence over `.env` on both sides of the change).
+
+### Still unverified
+
+- Whether breaks 1 and 2 surface inside `dsh-api-proxy.ts`'s catch or escape it
+  as an unhandled rejection — the Gateway opens its Remote Events generation
+  asynchronously, after `startDshRemoteInteractions` has already returned.
+- Whether an old profile that predates `@deepseek-ai/dsh-api-remote-access`
+  still gets the row (the shipped Web template does; `dsh-base` carries it).
+- How the reshaped `contextBreakdown` renders on iOS, and what the phone shows
+  for the unmapped `CLIENT_UPGRADE_REQUIRED` / `MODEL_UNSUPPORTED` codes.
+- Whether the plugin's own `lib/client.js` (banner shape, `dsh.client.inject`,
+  `platform: web`) is still accepted by alpha.3's client-modules scanner; that
+  scanner lives in `packages/client/modules` and `packages/client/web`, which
+  were not read in full.
+
+### Re-audit procedure used
+
+Fetch the new tag into the existing blobless clone at `.audit-dsh-alpha2`
+(`git fetch --filter=blob:none --no-tags origin
+'+refs/tags/<tag>:refs/tags/<tag>'`, ~3 s), slice
+`git diff --name-status` per package, and write each slice's content diff to a
+file before parallel reading — blobless clones fetch blobs on demand, so one
+`git diff` per region is far cheaper than many small reads. Reproduce a
+suspected carrier break against the **published** `lib/` bundles with a stub
+`this`, as above, rather than trusting either the diff or the release notes.
+`npm --cache <workspace dir>` is still required; `~/.npm/_cacache` holds
+root-owned files and fails `npm view` with `EPERM`.
+
 ## 2026-10-09 — audit of `dsh-v0.2.1-alpha.2`
 
 ### Scope and method
@@ -316,12 +633,12 @@ the mirror's `signal` is required, so the compiler keeps it that way.
 own, so a dedicated long-lived controller is not warranted; following the
 existing convention in the same file is enough. `lib/index.js` was regenerated.
 
-The fix ships in `0.9.4`, which is prepared but not published (see "Plugin release
-verdicts"); until it is published, a host on `0.2.1-alpha.2` running the
-published `0.9.3` still loses the on-open projection baseline. That was observed
-directly: on a live `0.2.1-alpha.2` host running published `0.9.3` the diagnostic
-appeared, and on the same host version running this build it did not (see "Live
-run on a real `0.2.1-alpha.2` host" under Validation evidence).
+The fix ships in `0.9.4`, published 2026-10-10 (see "Plugin release verdicts").
+A host on `0.2.1-alpha.2` left on the published `0.9.3` still loses the on-open
+projection baseline. That was observed directly: on a live `0.2.1-alpha.2` host
+running published `0.9.3` the diagnostic appeared, and on the same host version
+running this build it did not (see "Live run on a real `0.2.1-alpha.2` host"
+under Validation evidence).
 
 `tests/dsh-api-proxy.test.ts` adds "projection baseline reads pass the
 AbortSignal the Host now requires": a controller stub that calls

package/docs/NPM_PUBLISHING.md

@@ -0,0 +1,83 @@
+# npm 可信发布说明
+
+## 一、发布方式
+
+1. `.github/workflows/publish.yml` 使用 GitHub 托管的运行器，通过
+   OpenID Connect（OIDC，开放身份连接）向 npm 获取临时发布凭据；无需配置
+   `NPM_TOKEN` 或 `NODE_AUTH_TOKEN`。来源证明（Provenance）将关联公开仓库、
+   工作流和本次运行的源码提交。
+2. 工作流仅由 `workflow_dispatch`（手动触发）启动；推送提交、标签或创建
+   GitHub Release（发布页）不会自动上传 npm 包。手动运行须使用对应版本标签，
+   不能在 `main` 上运行后另行检出标签，否则来源证明的提交会与源码不一致。
+3. 发布环境使用 Node.js 22 与固定的 npm `11.21.0`；npm 官方要求可信发布至少使用
+   npm `11.5.1` 和 Node.js `22.14.0`。稳定版使用 `latest`（稳定分发标签），
+   预发布版使用 `alpha`（预发布分发标签），与原有发布策略一致。
+
+## 二、npm 网站绑定
+
+1. 将工作流合入默认分支 `main` 后，打开
+   [dsh-deeppilot 包设置](https://www.npmjs.com/package/dsh-deeppilot/access)，
+   在 Trusted Publisher（可信发布者）区域选择 GitHub Actions（GitHub 工作流）。
+2. 按下表配置，字段大小写必须一致：
+
+   | npm 字段 | 含义 | 填写值 |
+   | --- | --- | --- |
+   | Organization or user | GitHub 组织或用户 | `Mars-Sea` |
+   | Repository | 仓库名称 | `dsh-deeppilot` |
+   | Workflow filename | 工作流文件名 | `publish.yml` |
+   | Environment name | 部署环境名称 | 留空，本工作流未使用部署环境 |
+   | Allow npm publish | 允许直接发布 | 勾选 |
+   | Allow npm dist-tag | 允许独立修改分发标签 | 无需勾选，工作流通过发布命令设置标签 |
+
+3. 工作流文件名只填 `publish.yml`，不填 `.github/workflows/` 前缀。
+   新建绑定默认只允许暂存发布（`npm stage publish`），须明确允许 `npm publish`。
+   npm 不在保存配置时验证绑定；首次发布成功才证明认证可用。
+4. 新绑定必须在 **2 天内完成首次成功发布**。因此准备好新版本后再绑定；若过期，
+   删除过期绑定并重新创建。先验证可信发布成功，再按需调整原有令牌发布权限。
+
+## 三、每次发布
+
+1. 按项目 `AGENTS.md` 的发布清单完成验证，同时更新 `package.json`、
+   `package-lock.json` 顶层与根包条目的版本；提交并推送，等待持续集成（CI）通过。
+   版本提交必须已经进入 `main`，且该提交包含 `publish.yml`。
+2. 经用户授权发布该版本后，从精确的发布提交创建并推送附注标签 `v<版本>`，
+   准备包含英文与简体中文说明的 GitHub 发布草稿。
+3. 在对应标签上手动运行工作流。下例的 `0.9.5` 仅为示例，替换为已授权发布的版本：
+
+   ```sh
+   gh workflow run publish.yml --repo Mars-Sea/dsh-deeppilot --ref v0.9.5 \
+     -f version=0.9.5 -f dist_tag=latest
+   ```
+
+   预发布示例：
+
+   ```sh
+   gh workflow run publish.yml --repo Mars-Sea/dsh-deeppilot --ref v0.9.5-alpha.1 \
+     -f version=0.9.5-alpha.1 -f dist_tag=alpha
+   ```
+
+4. 工作流验证输入、标签、两处锁文件版本、包仓库与运行提交一致；拒绝轻量标签、
+   尚未合入 `main` 的提交、分发标签错配和构建元数据。随后执行依赖安全检查、
+   插件测试、类型检查、构建产物一致性检查、DSH 配置校验、Go 测试和辅助程序校验和。
+5. 工作流检查包内容并生成压缩包，再发布该压缩包，显式要求来源证明。
+   压缩包发布跳过生命周期脚本（`--ignore-scripts`）；测试、类型检查和构建已在前序
+   步骤执行，打包仍执行 `prepack`（打包前构建）。发布后核对版本、分发标签、
+   压缩包完整性和来源证明元数据。
+6. 确认 npm 包可安装，在全新 DSH 配置中完成安装验证后，再公开 GitHub 发布草稿。
+   工作流不自动公开发布草稿；npm 上传和发布后的核对分别记录在步骤中。
+
+## 四、失败处理与证据边界
+
+1. 认证失败先核对 npm 绑定中的仓库、大小写、`publish.yml` 和直接发布权限。
+   `npm whoami`（当前账号查询）不能验证 OIDC 发布权限。
+2. 若 npm 上传成功而后续核对失败，先检查注册表；已存在的版本不能通过重跑覆盖。
+   排查来源证明或分发标签后再决定下一步，禁止把核对失败直接当作上传失败。
+3. 本地语法检查、测试和打包不能证明 npm 绑定已生效；真实 OIDC 认证与来源证明
+   需要首次获授权的新版本发布才能验证。已有旧版本的认证状态不因新增工作流改变。
+
+## 五、官方资料
+
+1. [npm 可信发布配置与限制](https://docs.npmjs.com/trusted-publishers/)
+2. [npm 来源证明要求](https://docs.npmjs.com/generating-provenance-statements/)
+3. [GitHub 手动运行工作流](https://docs.github.com/en/actions/how-tos/manage-workflow-runs/manually-run-a-workflow)
+4. [GitHub 工作流调度接口：运行引用支持分支或标签](https://docs.github.com/en/rest/actions/workflows#create-a-workflow-dispatch-event)

package/docs/SECURITY_ROADMAP.md

@@ -14,11 +14,16 @@ Status: implemented on the development branch. `PROTOCOL.md` is normative. Proto
 - minimal unauthenticated health response; no Bearer or URL credentials;
 - privacy-preserving audit identifiers, a global connection switch, and per-device deletion; scopes remain enforced at the protocol layer.
 
+- shared canonical/signature vectors (`tests/fixtures/auth-vectors.json`) read by both the TypeScript tests and the iOS tests, with signatures from Node and from CryptoKit;
+- abuse tests for malformed requests, connection churn, replay, expired and altered challenges, and many-source pressure (`tests/auth-hardening.test.ts`);
+- documented local recovery when `devices-v2.json` is lost ([DEVICE_REGISTRY_RECOVERY.md](./DEVICE_REGISTRY_RECOVERY.md)).
+
+## Decided
+
+- High-impact approval responses do **not** require a fresh local biometric/user-presence confirmation (decided 2026-10-12). Revisit if the threat model changes, for example a phone shared between people.
+
 ## Remaining release validation
 
-- share fixed canonical/signature vectors between TypeScript and Swift tests;
 - exercise pairing, reconnect/resume, and per-device deletion through both real LAN and Funnel paths;
-- add abuse tests for malformed requests, connection churn, replay, and many-source pressure;
-- document local recovery when `devices-v2.json` is lost;
-- decide whether high-impact approval responses should require fresh local biometric/user-presence confirmation;
+- an authenticated socket still accepts a second `c2s.auth.prove` and answers it with another welcome and resume replay; the gate should answer `E_PROTOCOL` instead (tracked as a `todo` test);
 - keep dependency scanning and CodeQL green, then sign and notarize every distributed helper before claiming production readiness.

package/docs/SECURITY_ROADMAP.zh-CN.md

@@ -14,11 +14,16 @@
 - 最小化匿名探活响应，不接受 Bearer 或 URL 凭据；
 - 隐私化审计标识、全局连接开关和逐设备删除入口；scope 继续由协议层强制执行。
 
+- TypeScript 与 Swift 测试共用的固定规范化编码/签名向量（`tests/fixtures/auth-vectors.json`），签名分别来自 Node 与 CryptoKit；
+- 畸形请求、连接抖动、重放、挑战过期/被篡改和多来源压力的滥用测试（`tests/auth-hardening.test.ts`）；
+- `devices-v2.json` 丢失后的本机恢复流程（[DEVICE_REGISTRY_RECOVERY.zh-CN.md](./DEVICE_REGISTRY_RECOVERY.zh-CN.md)）。
+
+## 已决定
+
+- 高影响审批响应**不**要求新的本地生物识别/用户在场确认（2026-10-12 决定）。如威胁模型变化（例如手机多人共用）再重新评估。
+
 ## 发布前剩余验证
 
-- 在 TypeScript 与 Swift 测试间共享固定的规范化编码/签名向量；
 - 通过真实 LAN 与 Funnel 验证配对、重连/恢复和逐设备删除；
-- 补充畸形请求、连接抖动、重放和多来源压力测试；
-- 记录 `devices-v2.json` 丢失后的本机恢复流程；
-- 决定高影响审批是否要求新的本地生物识别/用户在场确认；
+- 已认证的 socket 仍会接受第二次 `c2s.auth.prove`，并再回一次 welcome 与重放；门应改为回 `E_PROTOCOL`（以 `todo` 测试跟踪）；
 - 保持依赖扫描与 CodeQL 通过，并在宣称生产可用前签名、公证所有分发 helper。

package/lib/client.js

@@ -545,7 +545,7 @@ window.__ModuleLoader__.load({
 				"push.testPush": "发送测试通知",
 				"push.relayTesting": "测试中…",
 				"push.pushSending": "发送中…",
-				"push.relayDefault": "验证 Mac 到推送中继的连通性与自动注册是否正常。",
+				"push.relayDefault": "验证这台电脑到推送中继的连通性与自动注册是否正常。",
 				"push.pushDefault": "向所有已注册设备强制发送一条真实推送（不受在线状态与分类开关影响）。",
 				"push.relayOk": "通过",
 				"push.relayBad": "存在问题",
@@ -656,7 +656,7 @@ window.__ModuleLoader__.load({
 			en: {
 				"nav": "DeepPilot",
 				"meta.title": "DeepPilot",
-				"meta.intro": "Connect your iPhone to DeepSeek Harness (DSH) on this Mac (protocol v2).",
+				"meta.intro": "Connect your iPhone to DeepSeek Harness (DSH) on this computer (protocol v2).",
 				"meta.refresh": "Refresh",
 				"master.title": "DeepPilot connection",
 				"master.loading": "Loading settings…",
@@ -763,7 +763,7 @@ window.__ModuleLoader__.load({
 				"push.testPush": "Send test notification",
 				"push.relayTesting": "Testing…",
 				"push.pushSending": "Sending…",
-				"push.relayDefault": "Verify Mac → push relay connectivity and zero-touch enrollment.",
+				"push.relayDefault": "Verify this computer → push relay connectivity and zero-touch enrollment.",
 				"push.pushDefault": "Force one real push to every registered device (ignores online state and category switches).",
 				"push.relayOk": "OK",
 				"push.relayBad": "Issues found",
@@ -814,7 +814,7 @@ window.__ModuleLoader__.load({
 				"help.step2": "When the status shows \"Awaiting Tailscale authorization\", click \"Open authorization page\".",
 				"help.step3": "Sign in with an account that can manage this Tailnet and follow the on-page prompts to enable Funnel. Owner / Admin / Network admin is usually required.",
 				"help.step4": "Come back to this page and click \"Refresh\". When a green dot appears next to the remote title, scan the QR code below to add your phone.",
-				"help.funnelHint": "The plugin bundles the Tailscale networking stack, so neither this Mac nor the phone needs the Tailscale app — but a Tailnet administrator must approve first-time use.",
+				"help.funnelHint": "The plugin bundles the Tailscale networking stack, so neither this computer nor the phone needs the Tailscale app — but a Tailnet administrator must approve first-time use.",
 				"help.httpsTitle": "If authorization does not complete: enable HTTPS",
 				"help.httpsStep1": "Open the Tailscale admin console → Network → DNS.",
 				"help.httpsStep2": "Confirm MagicDNS is enabled.",
@@ -826,7 +826,7 @@ window.__ModuleLoader__.load({
 				"help.faqTitle": "Frequently asked questions",
 				"help.faq1": "\"HTTPS must be enabled\" — finish the HTTPS Certificates steps above.",
 				"help.faq2": "\"Funnel not available\" — make sure the nodeAttrs snippet is saved and this node is in the rule's target.",
-				"help.faq3": "Public URL exists but the phone times out: wait a few minutes, confirm the Mac is awake and DSH is running, then re-scan the latest QR code.",
+				"help.faq3": "Public URL exists but the phone times out: wait a few minutes, confirm the computer is awake and DSH is running, then re-scan the latest QR code.",
 				"help.faq4": "No public URL: check that Tailscale authorization completed, then click \"Refresh\" or restart DSH.",
 				"help.securityTitle": "Security notes",
 				"help.security1": "A Funnel URL is public, but every connection requires a signature from a paired device P-256 private key. Do not share a pairing QR while it is valid.",