dsh-deeppilot 0.9.7 → 0.9.9

package/COMPATIBILITY.md

@@ -1,8 +1,9 @@
 # Compatibility
 
-This branch targets exactly **four DSH releases**: `0.2.0-rc.2`, which the npm
-`latest`/`next` channels point at, and `0.2.1-alpha.3`, `0.2.1-alpha.4`, and
-`0.2.1-alpha.5`, which the `alpha` channel has pointed at in turn. All four are
+This branch targets exactly **five DSH releases**: `0.2.0-rc.2`, which the npm
+`latest` channel points at; `0.2.1-alpha.3`, `0.2.1-alpha.4`, and
+`0.2.1-alpha.5`, which the `alpha` channel has pointed at in turn; and
+`0.2.1-rc.2`, which the `next` channel points at. All five are
 named in both `engines.dsh` and `peerDependencies`; no other version is accepted.
 DSH evaluates that declaration before composing a profile — on every start, not
 only on install — so a newly published DSH release deactivates this plugin until
@@ -13,13 +14,14 @@ The decision and the reversal it represents are recorded in
 [`docs/DSH_RELEASE_MEMORY.md`](./docs/DSH_RELEASE_MEMORY.md).
 
 The development packages this branch builds and typechecks against stay pinned
-to the exact release-candidate baseline, currently `0.2.0-rc.2`; the alpha host
-is covered by the isolated compose and live-runs recorded in the release memory.
+to the exact release-candidate baseline, currently `0.2.0-rc.2`; the audited
+`alpha` and `rc` hosts are covered by the isolated composes and live runs
+recorded in the release memory.
 
 | Component | Current contract | Evidence |
 |---|---|---|
 | Node.js | 22 or newer | Package engine and CI |
-| DSH CLI and Host API | `engines.dsh` and `peerDependencies` both name `0.2.0-rc.2 \|\| 0.2.1-alpha.3 \|\| 0.2.1-alpha.4 \|\| 0.2.1-alpha.5` (dev pins `0.2.0-rc.2`) | Peer metadata, source typecheck, unit tests, bundle build, and config schema projection against a real 0.2.0-rc.2 CLI, plus isolated composes and live phone-protocol runs with the published 0.2.1-alpha.2, 0.2.1-alpha.3, and 0.2.1-alpha.4 CLIs, and an isolated 0.2.1-alpha.5 host where this plugin now composes, starts, and answers `/phone/health` with 200 on its own LAN listener (audit below) |
+| DSH CLI and Host API | `engines.dsh` and `peerDependencies` both name `0.2.0-rc.2 \|\| 0.2.1-alpha.3 \|\| 0.2.1-alpha.4 \|\| 0.2.1-alpha.5 \|\| 0.2.1-rc.2` (dev pins `0.2.0-rc.2`) | Peer metadata, source typecheck, unit tests, bundle build, and config schema projection against a real 0.2.0-rc.2 CLI, plus isolated composes and live phone-protocol runs with the published 0.2.1-alpha.2, 0.2.1-alpha.3, and 0.2.1-alpha.4 CLIs, an isolated 0.2.1-alpha.5 host where this plugin now composes, starts, and answers `/phone/health` with 200 on its own LAN listener, and a pre-widening 0.2.1-rc.2 host run where the unchanged declaration is refused at compose time (audits below) |
 | iOS bridge | DeepPilot protocol v2 | Bridge protocol tests; device behavior must be checked with the running Host and app |
 | Remote access | Tailscale Funnel on ports 443, 8443, or 10000 | Helper and supervisor tests |
 
@@ -71,6 +73,66 @@ carries the old top-level `debug: true` is accepted but that value is ignored:
 verbose logging must be turned on again from the settings page. No other config
 field changed shape, and the old key is not read anywhere in this version.
 
+## 0.2.1-rc.2 audit outcome
+
+The artifact-level audit of `dsh-v0.2.1-rc.2` against `dsh-v0.2.1-alpha.5` found
+no change that reaches this plugin's call surface. Fifteen packages were compared
+as whole trees rather than by `lib/` alone: all ten peer packages carry
+**byte-identical `lib/` trees**, and across 137 modules **no export symbol is
+added or removed**. The 245 dependency differences are spec-value moves only,
+with zero structural difference: 78 `@deepseek-ai/dsh*` entries are pinned to
+`0.2.1-rc.2`, and five vendor ranges are promoted from prerelease to GA —
+`cordis ~4.0.5-alpha.2` → `~4.0.5`, `schemastery ~3.18.5-alpha.2` → `~3.18.5`,
+plus `cordis-plugin-include`, `cordis-plugin-loader`, and `cordis-plugin-timer`.
+No dependency package name is added or removed.
+
+**One file outside `package.json` differs, and it is additive.**
+`@deepseek-ai/dsh-web-app/cordis.patch.yml` gained one hunk / +3−0 that inserts
+the `ui-deepseek-model-label-1017` bundle (the DeepSeek-V4.1-Flash-1017
+adaptation named in the rc.2 release notes). It cannot reach this plugin: the
+patch anchor this plugin targets, `id: directory-picker`, is byte-identical at
+lines 113–114 on both sides, the new entry sits at lines 412–417, and the new
+package name appears zero times in this plugin's `cordis.patch.yml` and
+`package.json`.
+
+That file is also why the audit method changed: **comparing only `lib/` would
+have missed it**, and it is exactly the surface this plugin's own patch layer
+acts on. Whole-tree comparison is now a required step of every future audit, not
+a fallback.
+
+The vendor peers need no widening either. `0.2.1-rc.2` vendors the same GA pair
+as `0.2.1-alpha.5` — `cordis 4.0.5` and `schemastery 3.18.5` — and four
+independent solver paths (host-tree and repository `semver`, each with and
+without `includePrerelease`) agree that both already satisfy the existing
+`~4.0.4 || ~4.0.5-alpha.1` / `~3.18.4 || ~3.18.5-alpha.1` ranges.
+
+The activation verdict is the same shape as alpha.5: rc.2 resolves the
+requirements path from a declared `engines.dsh` alone, so its refusal names that
+single requirement rather than the ten peers, and `exempted` is false because no
+profile exemption file exists on the audit machine. Before the widening, a real
+rc.2 CLI refused the unchanged declaration —
+
+```text
+dsh: skipping profile bundle "dsh-deeppilot": … Plugin dsh-deeppilot@0.9.7 is incompatible with dsh 0.2.1-rc.2: requirements {"engines.dsh":"0.2.0-rc.2 || 0.2.1-alpha.3 || 0.2.1-alpha.4 || 0.2.1-alpha.5"}. … Exact-version exemption: not active.
+```
+
+— while the host itself still booted and served its web port. Three published
+evaluators agree on all 14 candidates, and the widened declaration admits
+`0.2.1-rc.2` while adding no other acceptance. **`0.2.1-rc.1` is deliberately not
+added and remains refused**: the rc line reached this plugin one release later, so
+admitting the earlier rc would extend support to a host that was never audited as
+its own. `0.2.1-alpha.1`, `0.2.1-alpha.2`, `0.2.0-rc.1`, `0.2.0`, `0.2.1`,
+`0.2.1-rc.3`, `0.3.0-rc.1`, `0.3.0`, `1.0.0`, and `0.1.7-rc.2` remain refused.
+
+**Audit limits, stated rather than implied.** Loading this plugin on a real
+isolated `0.2.1-rc.2` host — the positive half of the rc.2 verification — had
+**not** been completed when this entry was written; the rc.2 evidence here is the
+pre-widening refusal log plus the published evaluators' verdict on the widened
+declaration. Until the positive load and the full release check set run against
+that host, this release is recorded as audited at the declaration and
+artifact-diff level only; no plugin release has been made from this tree, and
+nothing here claims one.
+
 ## 0.2.1-alpha.5 audit outcome
 
 The source-level audit of `dsh-v0.2.1-alpha.5` against `dsh-v0.2.1-alpha.4` found
@@ -210,9 +272,12 @@ needs a documentation update, not a peer-range widening.
 > 0.2.1-alpha.3 outcome above and `docs/决策记录.md` (章节一). The paragraphs in
 > this historical entry describe the policy as it stood on 2026-09-29.
 > **This note is in turn superseded:** `0.2.1-alpha.4` was added the next day by
-> the same deliberate audit step, `0.2.1-alpha.5` on 2026-10-16, and the closed
-> four-release list now lives in `engines.dsh` as well as in `peerDependencies`.
-> See the 0.2.1-alpha.5 outcome above.
+> the same deliberate audit step, `0.2.1-alpha.5` on 2026-10-16, and
+> `0.2.1-rc.2` on 2026-10-17 — each one its own audit, never an automatic
+> consequence of a new DSH tag. The closed five-release list now lives in
+> `engines.dsh` as well as in `peerDependencies`. `0.2.1-rc.1` shows zero code
+> delta on this plugin's call surface but is deliberately left out, because it
+> was never audited as its own host. See the 0.2.1-rc.2 outcome above.
 
 ## 0.2.0-rc.1 audit outcome
 

package/README.md

@@ -32,18 +32,19 @@ Host on your own computer and does not replace or modify the DSH Web UI.
 
 ## Install from npm
 
-This source checkout targets Node.js 22+ and the four DSH releases it has been
-audited against — `0.2.0-rc.2` (the `latest`/`next` channels) and the `alpha`
-channel releases `0.2.1-alpha.3`, `0.2.1-alpha.4`, and `0.2.1-alpha.5` — with a
-`web` profile. DSH checks a plugin's declared requirements before composing a
-profile, on every start rather than only on install, so any other host version
-refuses to activate this plugin. From DSH `0.2.1-alpha.4` on, that check reads
-`engines.dsh` and ignores `peerDependencies`; older hosts know only the peer
-range, so both name the same four releases. The package includes Funnel helpers
+This source checkout targets Node.js 22+ and the five DSH releases it has been
+audited against — `0.2.0-rc.2` (the `latest` channel), the `alpha` channel
+releases `0.2.1-alpha.3`, `0.2.1-alpha.4`, and `0.2.1-alpha.5`, and `0.2.1-rc.2`
+(the `next` channel) — with a `web` profile. DSH checks a plugin's declared
+requirements before composing a profile, on every start rather than only on
+install, so any other host version refuses to activate this plugin. From DSH
+`0.2.1-alpha.4` on, that check reads `engines.dsh` and ignores
+`peerDependencies`; older hosts know only the peer range, so both name the same
+five releases. The package includes Funnel helpers
 for macOS, Linux, and Windows on amd64/arm64; trusted-LAN mode does not require
 the helper.
 
-The current working tree names exactly those four versions in `engines.dsh` and
+The current working tree names exactly those five versions in `engines.dsh` and
 `peerDependencies` and is built/typechecked against `0.2.0-rc.2`. A previously
 published plugin package may still carry its own older compatibility
 declaration until a release is made from this tree.
@@ -124,10 +125,30 @@ system-reported name; saving an empty value restores the iPhone-reported
 default.
 
 The settings page's **Testing & troubleshooting** group has a `debug` toggle.
-Turning it on prints handshake and push diagnostics to the DSH host's terminal
+Turning it on prints per-frame and push diagnostics to the DSH host's terminal
 output (for example, the actual capability bits sent in `s2c.welcome`); it
-never prints pairing tokens, APNs tokens, or message content, and takes effect
-immediately without restarting DSH.
+never prints pairing tokens, APNs tokens, or message content. The toggle is
+snapshotted per connection, so an already-open connection only picks up the new
+value after it reconnects.
+
+**Connection failures do not need that toggle.** The plugin always records
+admission rejections, authentication failures (4401 distinguishes an unknown
+device, a revoked device, a bad signature, an expired challenge and clock skew),
+TLS handshake failures and pairing failures. They show up in the terminal as
+`[deeppilot] <time> WARN <event> <reason> src=<source hash> attempt=<attempt ID>`
+and are appended under `diagnostics/` in the plugin data directory (7 days,
+5 MB cap). The settings page's **Connection diagnostics** group lists the most
+recent failures with a copy button, and `/phone/health` additionally returns the
+local transport phase and port, the data-plane phase, whether the TLS identity
+was rebuilt, the start time and the last failure, so the phone can locate the
+cause even while it cannot connect. Records contain only source hashes — never
+raw IPs, pairing codes, keys, APNs tokens or message content.
+
+Each connection attempt from the phone carries a random `attemptId` (the `?at=`
+query parameter on the WebSocket upgrade, or the `X-DeepPilot-Attempt` header on
+pairing and health checks). The plugin writes it into the log lines and
+diagnostic events above, so a user reporting that ID lets you find the exact
+attempt in the host log.
 
 Offline push is optional. Relay mode sends only the target APNs device token
 and a limited notification payload; full conversation history and live output

package/README.zh-CN.md

@@ -30,16 +30,17 @@
 
 ## 从 npm 安装
 
-当前源码面向 Node.js 22+ 与带 `web` profile 的**四个已审计 DSH 版本**：
-`0.2.0-rc.2`（`latest`/`next` 通道），以及 `alpha` 通道的 `0.2.1-alpha.3`、
-`0.2.1-alpha.4` 与 `0.2.1-alpha.5`。DSH 在组合 profile 前会校验插件声明的
+当前源码面向 Node.js 22+ 与带 `web` profile 的**五个已审计 DSH 版本**：
+`0.2.0-rc.2`（`latest` 通道）、`alpha` 通道的 `0.2.1-alpha.3`、
+`0.2.1-alpha.4` 与 `0.2.1-alpha.5`，以及 `0.2.1-rc.2`（`next` 通道）。
+DSH 在组合 profile 前会校验插件声明的
 兼容要求，且**每次启动都会校验**（不只是安装时），因此其他宿主版本会拒绝
 激活本插件。从 DSH `0.2.1-alpha.4` 起，该校验只读 `engines.dsh` 并忽略
-`peerDependencies`；更早的宿主只认 peer 范围，因此两处列出同一组四个版本。
+`peerDependencies`；更早的宿主只认 peer 范围，因此两处列出同一组五个版本。
 npm 包内置 macOS、Linux、Windows 的 amd64/arm64 Funnel helper；可信局域网
 模式不依赖 helper。
 
-当前工作树的 `engines.dsh` 与 `peerDependencies` 精确列出这四个版本，构建与
+当前工作树的 `engines.dsh` 与 `peerDependencies` 精确列出这五个版本，构建与
 类型检查针对 `0.2.0-rc.2`。从此工作树发布新版本前，已发布的旧插件包仍可能
 带有各自旧的兼容声明。
 
@@ -107,8 +108,21 @@ DeepPilot 设置页提供“每个公网来源的连接上限”，默认 `8`，
 也不会被覆盖。留空保存可恢复 iPhone 上报的默认名称。
 
 设置页的“测试与故障排查”分组下有一个 `debug` 开关，打开后会在 DSH host 的
-终端输出里打印握手、推送等诊断信息（例如 `s2c.welcome` 里实际发出的能力位），
-不会打印配对令牌、APNs token 或消息内容；改这个开关立即生效，不需要重启 DSH。
+终端输出里打印逐帧与推送等诊断信息（例如 `s2c.welcome` 里实际发出的能力位），
+不会打印配对令牌、APNs token 或消息内容。该开关按连接快照，已建立的连接需要
+重连一次才按新值工作。
+
+**连不上时不需要打开这个开关**：插件会无条件记录准入拒绝、认证失败（4401 会区分
+设备不存在、已撤销、签名错、挑战过期、时钟偏差等原因）、TLS 握手失败与配对失败，
+在终端输出为 `[deeppilot] <时间> WARN <事件> <原因> src=<来源哈希> attempt=<尝试 ID>`，
+并落盘到插件数据目录的 `diagnostics/`（保留 7 天、上限 5 MB）。设置页“连接诊断”
+分组可查看最近失败并一键复制；`/phone/health` 额外返回本地传输相位与端口、数据面
+相位、是否重建过 TLS 身份、启动时间与最近一次失败，手机端在连不上时也能据此定位。
+记录只含来源哈希，不含原始 IP、配对码、密钥、APNs token 或消息内容。
+
+手机端每次连接尝试会带一个随机的 `attemptId`（WebSocket 升级的 `?at=` 查询参数，
+或配对/健康检查的 `X-DeepPilot-Attempt` 请求头）。插件把它写进上面的日志与诊断
+事件；用户反馈时报告这个 ID，就能在主机日志里定位到同一次尝试。
 
 离线推送是可选功能。中继模式只发送目标 APNs 设备 Token 和有限的通知内容；
 完整会话历史与实时输出不会经过中继。启用远程访问或推送前，请阅读

package/bin/SHA256SUMS

@@ -1,6 +1,6 @@
-c70401fd9530f2fae6abe7aec5eacacca239ba315cedc7197db530df8c6f97bd  ./darwin-amd64/dsh-deeppilot-tunnel
-45ff6b53d3e27fe6242e4904055d647d8b220a5c56ca76e542ffcd861ad3bbad  ./darwin-arm64/dsh-deeppilot-tunnel
-8d4937de90564327dcf8392dba6241e4facc30044a48447b22de99f3e62c9808  ./linux-amd64/dsh-deeppilot-tunnel
-cd4638f9aa3e60340d4f446301b2b6f6452f5cb89fc012884e5a893ab8dbd577  ./linux-arm64/dsh-deeppilot-tunnel
-d5435d4e0c02056b3fac39a5f289acb404e6f060dc566e5dea724ee2b86a4296  ./windows-amd64/dsh-deeppilot-tunnel.exe
-7d79c848b2b74286764bd284005edbcfdf539be90ce0b160ea464ae3af70e005  ./windows-arm64/dsh-deeppilot-tunnel.exe
+4e83f82d5c623115d121f58264ca84706e5fc935dadc0747b37ae886d102dc6a  ./darwin-amd64/dsh-deeppilot-tunnel
+7707999a5b745d11afeb4ab1868c85680e4ff5567202d97015d72d810817a134  ./darwin-arm64/dsh-deeppilot-tunnel
+8a83351568cb223854efbe8f54ca9a403fc2b152382d4e7c952d372b0b0cb3e9  ./linux-amd64/dsh-deeppilot-tunnel
+dfa4eb4dd50b386aadf40d9767ac0df8151308b620fa395d0a560498f01eb0cb  ./linux-arm64/dsh-deeppilot-tunnel
+9c734ea42bc6dd5763930991db52f910d5138e9b12df0e826d6964ceb271e215  ./windows-amd64/dsh-deeppilot-tunnel.exe
+e7db4a0e62f04266d97a5bad38e1a21961474440e7231fd5b24980053589faa0  ./windows-arm64/dsh-deeppilot-tunnel.exe

package/docs/DSH_RELEASE_MEMORY.md

@@ -3,10 +3,126 @@
 > This is the durable audit record for DeepPilot's public DSH plugin. Re-audit
 > the next DSH release instead of assuming that an rc upgrade is runtime-safe.
 
-## Current decision — `dsh-v0.2.1-alpha.5`
+## Current decision — `dsh-v0.2.1-rc.2`
+
+- **Audited release:** `dsh-v0.2.1-rc.2`, published 2026-10-17T08:36:31.655Z. It is
+  **not** `latest`: `latest` still points at `0.2.0-rc.2`, and `alpha` still points
+  at `0.2.1-alpha.5`. It **is** the npm **`next`** channel release — this is the
+  first release on the rc line to enter the supported list.
+- **Comparison baseline:** `dsh-v0.2.1-alpha.5` (the previous audited tag).
+- **Plugin runtime verdict: no break, and no `src/` change was needed.** Fifteen
+  packages were compared **as whole trees, not by `lib/` alone**: all ten peer
+  packages ship a byte-identical `lib/` tree, and across 137 modules **no export
+  symbol is added or removed**, so every earlier fix still holds unchanged.
+- **The one file outside `package.json` that differs is additive.**
+  `@deepseek-ai/dsh-web-app/cordis.patch.yml` gained one hunk / +3−0 inserting the
+  `ui-deepseek-model-label-1017` bundle (the DeepSeek-V4.1-Flash-1017 adaptation
+  named in the release notes). The patch anchor this plugin targets,
+  `id: directory-picker`, is byte-identical at lines 113–114 on both sides, the new
+  entry sits at lines 412–417, and the new package name appears zero times in this
+  plugin's `cordis.patch.yml` and `package.json`, so the change cannot reach any
+  patch this plugin applies.
+- **Methodology change, now mandatory.** Comparing only `lib/` would have missed
+  exactly that file — and it is the surface this plugin's own patch layer acts on.
+  Whole-tree comparison is a required step of every future audit; do not fall back
+  to a `lib/`-only diff. See "Re-audit rule" below.
+- **Activation verdict: the new release is admitted by both declarations, and the
+  earlier rc on the same line is deliberately left out.** This is the fourth
+  consecutive release on this line to trip the closed-list policy: rc.2 was refused
+  before the widening. rc.2 reads a declared `engines.dsh` alone, so its refusal
+  reported a **single** `engines.dsh` requirement rather than ten peers, and
+  `exempted: false` — the list is the only thing that admits a host, and no
+  exemption fallback exists on this machine (no profile `compatibility.json` under
+  `DSH_HOME`). Widening admits `0.2.1-rc.2` and nothing else. `0.2.1-rc.1` stays
+  refused even though it shows **zero code delta on this plugin's call surface**:
+  it was never audited as its own host, and the rc line reached this plugin one
+  release later.
+- **Evidence: the published artifacts, the published evaluators, and a real rc.2
+  CLI run — all taken before any declaration changed.**
+  - **Change surface:** `.rc2-verify/CHANGE_SURFACE.md`. Raw logs:
+    `.rc2-verify/logs/lib-hash-compare.txt` and `lib-diff-exitcodes.txt` (10 of 10
+    peer `lib/` trees byte-identical), `whole-tree-compare.txt` (the 15-package
+    whole-tree fallback, which is what surfaced the `dsh-web-app` patch file),
+    `export-symbol-diff.out.json` (137 modules, zero symbol changes),
+    `pkg-manifest-delta.out.json` (245 spec-value differences, zero structural
+    differences), `webapp-cordis-patch-diff.txt` and `patch-anchor-verification.txt`
+    (the one differing file and its anchor), `rc1-delta.txt` (`0.2.1-rc.1` has zero
+    code delta on this plugin's call surface), and `evaluator-repro.out.json`
+    (three published evaluators × 14 candidates, all agreeing).
+  - **Activation decision, reproduced against rc.2's own published evaluator
+    before any edit:** `.rc2-verify/ACTIVATION.md` and `rc2-matrix.out.json`.
+    Unchanged, rc.2 was refused with a single `engines.dsh` requirement and
+    `exempted: false`; deleting `engines.dsh` from a copy of the manifest fell back
+    to all ten peers, confirming the short-circuit is unchanged. Projecting the
+    widening in memory admitted exactly `0.2.1-rc.2` with zero new refusals, while
+    `0.2.1-rc.3`, `0.2.1-rc.20`, `0.2.1-rc.2.1`, `0.2.1-RC.2`, and `0.2.1-rc.10`
+    stayed refused (`rc2-matrix-projected.out.json`).
+  - **Real CLI refusal, captured while the declaration was still unchanged:**
+    `.rc2-verify/PRECHANGE-BOOT.md`. Under an isolated `DSH_HOME` the real rc.2 CLI
+    printed `dsh: skipping profile bundle "dsh-deeppilot": … incompatible with dsh
+    0.2.1-rc.2: requirements {"engines.dsh":…}` plus `Exact-version exemption: not
+    active.`, `--dump-config` exited 0 with no plugin row in the composed tree, and
+    the host itself still booted (web port answered, while the plugin's own port
+    3098 had no listener). Raw logs: `PRECHANGE-dumpconfig.stderr.txt`,
+    `PRECHANGE-dumpconfig.stdout.txt`, `PRECHANGE-host.log`, `PRECHANGE-probes.txt`.
+    A control run of the same profile under the `0.2.1-alpha.5` CLI — which admits
+    `0.9.7` — loaded the plugin and answered `200` on port 3098
+    (`PRECHANGE-control-alpha5-host.log`, `PRECHANGE-control-alpha5-probes.txt`),
+    showing the negative probe has discriminating power.
+- **Vendor pins: no range change needed.** rc.2 vendors the same GA pair as
+  alpha.5 — `cordis 4.0.5` and `schemastery 3.18.5` — and four independent solver
+  paths (host-tree and repository `semver`, each with and without
+  `includePrerelease`) agree both already satisfy the existing `~4.0.4 ||
+  ~4.0.5-alpha.1` / `~3.18.4 || ~3.18.5-alpha.1` ranges
+  (`.rc2-verify/rc2-vendor.out.json`). Neither vendor published a new
+  per-DSH-release dist-tag for rc.2; their `latest` is already `4.0.5` / `3.18.5`.
+- **Install verdict: the two declarations now agree on five releases.**
+  `engines.dsh` and all ten `@deepseek-ai/dsh*` peers name `0.2.0-rc.2 ||
+  0.2.1-alpha.3 || 0.2.1-alpha.4 || 0.2.1-alpha.5 || 0.2.1-rc.2`, mirrored in
+  `tests/compatibility-metadata.test.ts`, `package-lock.json` (root entry only),
+  both READMEs, `COMPATIBILITY.md`, `AGENTS.md`, and the local
+  `docs/决策记录.md` (章节一, 条目5). The tests now also pin `0.2.1-rc.1` and
+  `0.2.1-rc.3` as negative probes, so neither the skipped rc nor the next rc can be
+  admitted by accident. The dev pins and `DSH_BASELINE` stay at the exact
+  `0.2.0-rc.2` this branch builds and typechecks against.
+- **Protocol verdict: no phone-protocol change.** Protocol v2, pairing state, and
+  device records are untouched by this release; no phone needs to re-pair.
+- **The limits this entry originally stated are now closed.** The positive half of
+  the rc.2 verification ran before publication: on an isolated `0.2.1-rc.2` host
+  carrying the widened declaration, `--dump-config` wrote nothing to stderr, the
+  composed tree contained `# == dsh-deeppilot` (line 1233) together with
+  `# == @deepseek-ai/dsh-web-app, patched by dsh-deeppilot` (line 449), the running
+  host logged four `[deeppilot]` lines, and the plugin's own LAN listener on port
+  3098 answered `/phone/health` with `200` and `serverVersion` `0.9.8`. A tamper
+  control removed the `0.2.1-rc.2` token from a copy of `engines.dsh`: the host
+  refused again with the single `engines.dsh` requirement (`exempted: false`) and
+  accepted it once restored. Independent verification of the whole release tree —
+  `npm ci`, 581 tests (580 pass, 0 fail, 1 pre-existing TODO), typecheck, build
+  with a byte-identical regenerated `lib/`, `check:config-schema`, the Go helper
+  tests, and all six `bin/SHA256SUMS` entries — is recorded in
+  `.rc2-verify/VERIFICATION.md`; that pass also caught a real defect, a version
+  bump that had left `tests/apply-baseline.snapshot.json` stale.
+- **Published as 0.9.8 on 2026-10-18.** The annotated tag `v0.9.8` dereferences to
+  `f4551b61602e5e60b11565ae31ccba3257d3dc9e` on `main`, CI and CodeQL were green on
+  that commit, and `publish.yml` ran on the tag (run `39048037503`, 24/24 steps).
+  The registry records `latest: 0.9.8`, published `2026-10-17T16:12:59.699Z`, with a
+  `https://slsa.dev/provenance/v1` attestation naming that commit as its source. The
+  published tarball's SHA1 `8288977711e04679d077b970f863e726631fc309` and its SHA512
+  match the registry, its 68 entries and 130,945,335 unpacked bytes match the
+  pre-publication pack, and every packaged file compared byte-identically with the
+  verified tree. A clean isolated profile then installed `dsh-deeppilot@0.9.8` from
+  npm, composed it on a real `0.2.1-rc.2` host, and answered `/phone/health` with
+  `200` and `serverVersion: "0.9.8"`; the GitHub Release was made public only after
+  that install verification. The same release shipped the mobile skills, host
+  commands, and catalog-cache work recorded below.
+
+### Previous decision — `dsh-v0.2.1-alpha.5`
 
 - **Audited release:** `dsh-v0.2.1-alpha.5`, the newest `alpha` channel release.
   It is **not** `latest`; `latest`/`next` still point at `0.2.0-rc.2`.
+  *(Superseded 2026-10-17 by `dsh-v0.2.1-rc.2`: `next` now points at
+  `0.2.1-rc.2`. `alpha` still points at `0.2.1-alpha.5` and `latest` still points
+  at `0.2.0-rc.2`. See the current decision above.)*
 - **Comparison baseline:** `dsh-v0.2.1-alpha.4` (the previous audited tag).
 - **Plugin runtime verdict: no break, and no `src/` change was needed.** Nine of
   the ten peer packages ship a byte-identical `lib/` tree, including
@@ -91,10 +207,12 @@
     committed tree), `npm run check:config-schema` against the pinned
     `0.2.0-rc.2` CLI, `go test ./...` for the helper, and all six
     `bin/SHA256SUMS` entries verified.
-- **Nothing has been published from this tree yet.** `package.json` reads `0.9.7`
-  on the release branch; no tag, registry version, or GitHub release corresponds
-  to it yet. This entry records an audit, a declaration sync, and the local
-  preparation of 0.9.7 — **not** a published release.
+- **Published as 0.9.7 on 2026-10-17.** `npm view dsh-deeppilot dist-tags` reads
+  `latest: 0.9.7`, and the version carries an npm provenance attestation
+  (`https://slsa.dev/provenance/v1`). The release commit `bf18755` is on `main`,
+  the annotated tag `v0.9.7` dereferences to it, and the GitHub release was made
+  public only after a clean-profile install had been verified — see the publish
+  verification section below.
 
 ### Previous decision — `dsh-v0.2.1-alpha.4`
 
@@ -588,9 +706,13 @@ close that gap rather than assume it.
   `npm run typecheck`, `npm run build` with a byte-identical regenerated `lib/`,
   `npm run check:config-schema` against the pinned `0.2.0-rc.2` CLI, the Go helper
   tests, and the six `bin/SHA256SUMS` entries.
-- **No release action yet.** `package.json` reads `0.9.7` on the release branch;
-  nothing was published, tagged, or pushed. The widened list reaches users only
-  through that release.
+- **Release action completed — 0.9.7 published on 2026-10-17.** The annotated tag
+  `v0.9.7` points at `bf18755` on `main`; the publish workflow ran on that tag and
+  all of its steps passed, including the post-publish registry check whose retry
+  window this release widened. Registry `latest` reads `0.9.7` with provenance,
+  and a clean isolated profile installed `dsh-deeppilot@0.9.7` from npm, composed
+  it on a real `0.2.1-alpha.5` host, and answered `/phone/health` with `200` and
+  `serverVersion: "0.9.7"`.
 - **The declaration mirrors have drifted historically.** `README.md`,
   `README.zh-CN.md`, `COMPATIBILITY.md`, and `AGENTS.md` all said "three
   releases" while `package.json` already named four; that contradiction was
@@ -1644,3 +1766,30 @@ For every future DSH release, compare the new tag against the last audited tag,
 inspect the package/service surfaces actually imported by this repository,
 classify install/runtime/protocol risk separately, and append a dated decision
 here. Do not treat a release-note summary as proof of compatibility.
+
+Compare **whole package trees**, not just `lib/`. The rc.2 audit found its only
+non-`package.json` difference in `@deepseek-ai/dsh-web-app/cordis.patch.yml`, a
+file outside every `lib/` directory and the exact surface this plugin's own patch
+layer acts on; a `lib/`-only diff would have reported "no difference" and missed
+it. Take the published registry tarballs as the source of truth, enumerate the
+package set explicitly (peers, plus every package raw `dsh` dependencies add or
+remove, plus any peer that is not hoisted into the host tree), and only then read
+release notes.
+
+## 2026-10-15 — 移动端技能发现扩展
+
+新增可选的 `skills` 手机能力，使用官方 `sessionSkillCatalog.list({sessionId}, AbortSignal)` 服务，已对照本机 `0.2.0-rc.2` 和 `0.2.1-alpha.3` 发行声明。缺少服务只关闭该特性，晚挂载服务会重新探测，不缓存缺席。未修改宿主版本范围、鉴权、包版本或命令派发契约。手机只接收元数据，技能注册表和会话预设、工作目录变化触发目录失效。完整文档清单与四类差异表见《技能提示对接说明》。此源码改动随 0.9.8（2026-10-18）发布；主机侧集成已在本机隔离真实宿主上验收，真机技能加载仍未验收。
+
+## 2026-10-16 — 移动端系统指令扩展
+
+1. 安装：本轮命令改动未调整依赖范围、包版本或发布状态。命令接口核对基于 `0.2.0-rc.2` 与 `0.2.1-alpha.3`；工作区并行的 `alpha.4` 兼容改动以其独立审计为准，不把本轮合成测试算作新版本真实业务验收。
+2. 运行：对照两版生成声明和实现，使用公开 `typertGateway.invoke` 的 `commands/list`、`commands/execute`、`fileUploads/upload`、`permissionPresets/catalog`、`sessionFeedback/record`；当前权限来自会话投影，日志复用官方共享 Fetch 归档路由。alpha.3 创建不参与审批的 owner Peer，rc.2 回退既有 operator。详情及上游全接口清单见[移动端命令对接说明](移动端命令对接说明.md)。
+3. 手机协议：v2 可选 `commands` 能力和五个新请求；读取使用 `sessions.read`，执行/反馈使用 `prompt.send`，小组件默认拒绝。旧手机忽略新字段，旧桥接不展示新增入口。导出分块不重放，接收方完整校验后分享。
+4. 验证：576 项测试通过、1 项原有待办；类型检查、构建和配置检查通过。新增逻辑为合成服务测试，未在两版真实 Host 会话执行系统指令，不据此声称运行验收或发布完成。
+
+## 2026-10-16 — 移动端目录缓存
+
+1. 安装与主机 API：本轮不改安装范围或依赖；读取沿用现有技能、命令和模型接口。工作区另有 alpha.4 兼容改动，命令对接已重新枚举该版 29 包、144 个接口，相关主机实现与 alpha.3 相同；不据此宣称真实业务验收。
+2. 手机协议：模型当前选择投影新增 `s2c.models.changed`，受 `sessions.read` 控制；原生权限执行可附加 `expectedDefinitionId`，重读目录核对来源，旧客户端字段缺省兼容。无新增周期轮询或第二层主机时间缓存。
+3. 客户端：内存五分钟、磁盘最长七天，重启旧目录先展示并校验，按配对身份/主机/会话隔离；当前模型、权限和执行结果不落盘。具体约定和格式重建见[移动端目录缓存](移动端目录缓存.md)。
+4. 验证：插件 577 项通过、1 项原有待办，类型检查、生成产物构建和使用本机固定版本的离线配置校验通过；两端缓存单元与模拟器证据见各自文档。随 0.9.8（2026-10-18）发布；真机与系统分享仍未验收。

package/docs/NPM_PUBLISHING.md

@@ -87,6 +87,35 @@
    线性递增并封顶 20 秒（约 7 分钟），仍然只读元数据、不重复上传包。这样既避免
    「上传成功 + 核对延迟」在 Actions 页留下误导性的红色结论，也不会把真正的失败
    伪装成成功——超出窗口依旧抛错。
+6. `0.9.7` 是放宽窗口后的第一次发布，也是首次全绿的发布：工作流在附注标签
+   `v0.9.7`（提交 `bf18755`）上运行，19 个步骤全部成功，包含此前两次失败的末尾
+   核对。发布后核验：注册表 `latest = 0.9.7`、来源证明类型为
+   `https://slsa.dev/provenance/v1`；在全新隔离 profile 中从 npm 安装该版本，并在
+   真实 `0.2.1-alpha.5` 宿主上启动，`/phone/health` 返回 200 且 `serverVersion`
+   为 `0.9.7`。公开 GitHub Release 之前先完成了这一步安装验证。
+7. `0.9.8` 的本地发布清单在**待发布工作树**上执行并通过（详细数字见
+   `docs/RELEASE_NOTES-0.9.8.md` 第三节）：`npm ci`、单元测试 581 项
+   （580 通过、0 失败、1 项既有待办）、类型检查、构建前后 `lib/` 逐文件
+   sha256 一致、`check:config-schema`（仍针对锁定的 `0.2.0-rc.2` CLI）、
+   helper 的 Go 测试、`bin/SHA256SUMS` 6/6。宿主侧本轮改用
+   **`0.2.1-rc.2`**：隔离 `DSH_HOME` 下改动前被拒绝激活（单键 `engines.dsh`
+   要求 + `Exact-version exemption: not active`），扩围后组合树含插件与
+   web-app 补丁、真实启动出现 4 条 `[deeppilot]`，插件自有端口 3098 的
+   `/phone/health` 返回 200 且 `serverVersion` 为 `0.9.8`。打包为 68 个条目。
+   本轮还确认了一个易漏点：升版本号必须同步重录
+   `tests/apply-baseline.snapshot.json`，否则 `npm test` 会失败——已写入
+   `AGENTS.md` 的发布流程第 1 步。
+8. `0.9.8` 的实际发布结果（2026-10-18）：附注标签 `v0.9.8` 指向
+   `f4551b61602e5e60b11565ae31ccba3257d3dc9e`，该提交的 CI 与 CodeQL 均为绿；
+   `publish.yml` 在该标签上运行（运行号 `39048037503`，24 个步骤全部成功），
+   注册表 `latest` 为 `0.9.8`。逐项核验：来源证明类型为
+   `https://slsa.dev/provenance/v1`，其 `gitCommit` 正是该提交；压缩包 SHA1
+   `8288977711e04679d077b970f863e726631fc309` 与 SHA512 与注册表一致；注册表
+   条目数 68、解包 130,945,335 字节与发布前的打包核对一致，包内逐个文件与已验证
+   的工作树逐字节相同。随后在全新隔离 profile 中从 npm 安装
+   `dsh-deeppilot@0.9.8`，在真实 `0.2.1-rc.2` 宿主上完成组合与启动，插件自有端口
+   3098 的 `/phone/health` 返回 200 且 `serverVersion` 为 `0.9.8`；GitHub Release
+   在这一步通过后才公开并标记 Latest。
 
 ## 五、官方资料