dsh-deeppilot 0.9.8 → 0.9.11

package/COMPATIBILITY.md

@@ -1,9 +1,10 @@
 # Compatibility
 
-This branch targets exactly **five DSH releases**: `0.2.0-rc.2`, which the npm
-`latest` channel points at; `0.2.1-alpha.3`, `0.2.1-alpha.4`, and
-`0.2.1-alpha.5`, which the `alpha` channel has pointed at in turn; and
-`0.2.1-rc.2`, which the `next` channel points at. All five are
+This branch targets exactly **six DSH releases**: `0.2.0-rc.2`; the `alpha`
+channel releases `0.2.1-alpha.3`, `0.2.1-alpha.4`, and `0.2.1-alpha.5`; and the
+`next` channel releases `0.2.1-rc.2` and `0.2.1-rc.3`. The npm channels have
+moved since: `latest` now points at `0.2.1-rc.2`, promoted from `next`, and
+`next` at `0.2.1-rc.3`. All six are
 named in both `engines.dsh` and `peerDependencies`; no other version is accepted.
 DSH evaluates that declaration before composing a profile — on every start, not
 only on install — so a newly published DSH release deactivates this plugin until
@@ -21,9 +22,10 @@ recorded in the release memory.
 | Component | Current contract | Evidence |
 |---|---|---|
 | Node.js | 22 or newer | Package engine and CI |
-| DSH CLI and Host API | `engines.dsh` and `peerDependencies` both name `0.2.0-rc.2 \|\| 0.2.1-alpha.3 \|\| 0.2.1-alpha.4 \|\| 0.2.1-alpha.5 \|\| 0.2.1-rc.2` (dev pins `0.2.0-rc.2`) | Peer metadata, source typecheck, unit tests, bundle build, and config schema projection against a real 0.2.0-rc.2 CLI, plus isolated composes and live phone-protocol runs with the published 0.2.1-alpha.2, 0.2.1-alpha.3, and 0.2.1-alpha.4 CLIs, an isolated 0.2.1-alpha.5 host where this plugin now composes, starts, and answers `/phone/health` with 200 on its own LAN listener, and a pre-widening 0.2.1-rc.2 host run where the unchanged declaration is refused at compose time (audits below) |
+| DSH CLI and Host API | `engines.dsh` and `peerDependencies` both name `0.2.0-rc.2 \|\| 0.2.1-alpha.3 \|\| 0.2.1-alpha.4 \|\| 0.2.1-alpha.5 \|\| 0.2.1-rc.2 \|\| 0.2.1-rc.3` (dev pins `0.2.0-rc.2`) | Peer metadata, source typecheck, unit tests, bundle build, and config schema projection against a real 0.2.0-rc.2 CLI, plus isolated composes and live phone-protocol runs with the published 0.2.1-alpha.2, 0.2.1-alpha.3, and 0.2.1-alpha.4 CLIs, an isolated 0.2.1-alpha.5 host where this plugin now composes, starts, and answers `/phone/health` with 200 on its own LAN listener, a pre-widening 0.2.1-rc.2 host run where the unchanged declaration is refused at compose time, and an isolated 0.2.1-rc.3 host where the widened declaration composes, starts, and answers `/phone/health` with 200 (audits below) |
 | iOS bridge | DeepPilot protocol v2 | Bridge protocol tests; device behavior must be checked with the running Host and app |
 | Remote access | Tailscale Funnel on ports 443, 8443, or 10000 | Helper and supervisor tests |
+| Funnel helper platforms | macOS 13 Ventura or later, Linux, and Windows, each on amd64/arm64; built with Go 1.27, which dropped macOS 12 | CI starts the committed helper on a native runner for each of the six targets (`helper-smoke`); no runner covers macOS 13 itself |
 
 ## DSH interfaces used here
 
@@ -73,6 +75,77 @@ carries the old top-level `debug: true` is accepted but that value is ignored:
 verbose logging must be turned on again from the settings page. No other config
 field changed shape, and the old key is not read anywhere in this version.
 
+## 0.2.1-rc.3 audit outcome
+
+The artifact-level audit of `dsh-v0.2.1-rc.3` (published to the npm registry
+2026-10-23T07:54:30Z, the `next` channel release; `latest` points at `0.2.1-rc.2`)
+against `dsh-v0.2.1-rc.2` found **no change that reaches this plugin's call
+surface**. Nineteen packages were compared as whole trees rather than by `lib/`
+alone — eighteen from the two installed trees plus
+`@deepseek-ai/dsh-client-ui-slots` (the seventh declared `dsh-*` peer, absent from
+both trees) through its registry tarball:
+
+- **Fourteen packages differ only in `package.json`** — version and dependency
+  specs — so every file those hosts read at runtime is byte-identical.
+- **Three packages carry one non-`package.json` change each** — `dsh-api-remotes`,
+  `dsh-api-session-controller`, and `dsh-web-app` — detailed below.
+- **`cordis 4.0.5` and `schemastery 3.18.5` are byte-identical including
+  `package.json`**, so the vendor peer ranges need no widening again.
+- **The tree gains one package**: `rc.2` ships 306 packages and `rc.3` 307; the
+  addition is `@deepseek-ai/dsh-client-ui-entry-customization@0.2.1-rc.3`, the
+  bundle behind the More menus. This plugin neither references it nor depends on
+  it through its own patch.
+
+Of 3,302 shared files, 3,275 are byte-identical and 20 differ: 16 `package.json`
+files, the three code/config files above, and the `dsh-client-ui-slots`
+`package.json`. Across 274 analysed modules **no export symbol is added or
+removed** (18 entry modules compared), so every earlier fix still holds
+unchanged. The manifest delta over 19 packages covers 585 paths — 17 version
+bumps and 568 dependency-spec moves, **zero structural differences** — with no
+package added or removed by dependency resolution.
+
+**The one file outside `package.json` that could reach this plugin's patch layer
+is additive.** `@deepseek-ai/dsh-web-app/cordis.patch.yml` gained one hunk that
+inserts the `ui-entry-customization` bundle (the More menus named in the rc.3
+release notes). The patch anchor this plugin targets, `id: directory-picker`, is
+byte-identical on both sides at the same offsets, and neither the new package
+name nor `entry-customization` appears in this plugin's `cordis.patch.yml` or
+`package.json`, so the change cannot reach any patch this plugin applies.
+
+The other two non-`package.json` files are equally out of reach:
+`@deepseek-ai/dsh-api-remotes/lib/client.js` only widens the client telemetry
+event schema (`is_new_session`, `agent_preset`, and the More-menu and
+agent-preset switch events), which this plugin neither emits nor validates, and
+`@deepseek-ai/dsh-api-session-controller`'s
+`lib/types/client/sessions/service.d.ts` changes a doc comment only.
+
+The activation verdict repeats the rc.2 shape: rc.3 also reads `engines.dsh`
+alone. Before the widening, the published rc.3 evaluator refused `0.2.1-rc.3`
+with a single `engines.dsh` requirement and `exempted: false`, and a real rc.3
+CLI reproduced the refusal at compose time (`skipping profile bundle
+"dsh-deeppilot"`) while the host itself still booted and served its web port.
+After the widening, the same evaluator admits exactly `0.2.1-rc.3` and adds no
+other acceptance: the five earlier hosts stay admitted, and `0.2.1-rc.1`,
+`0.2.1-rc.3.1`, `0.2.1-rc.30`, `0.2.1-RC.3`, `0.2.1`, `0.2.1-rc.2.1`, `0.2.0`,
+`0.3.0`, and `1.0.0` remain refused. Deleting `engines.dsh` from a copy of the
+manifest falls back to the ten peers and still admits the same six hosts, so the
+short-circuit is unchanged.
+
+**The positive half is complete this time.** An isolated `0.2.1-rc.3` host — its
+own `DSH_HOME`, the plugin linked from this working tree, and no other plugin —
+composes the plugin into the tree, starts it, and answers `/phone/health` with
+200 on the plugin's own LAN listener (`serverVersion` `0.9.10`, protocol v2),
+while the isolated home gains the plugin's data directory. The same profile run
+with the declaration unchanged shows the skip line instead and no listener,
+which is what makes the pair discriminative.
+
+Evidence: `.rc3-verify/AUDIT.md` and `.rc3-verify/CHANGE_SURFACE.md` with the raw
+logs under `.rc3-verify/logs/`, the evaluator reproduction in
+`.rc3-verify/evaluator-repro.out.json`, the acceptance matrix in
+`.rc3-verify/matrix.out.json`, the export-symbol diff in
+`.rc3-verify/export-symbol-diff.out.json`, and the host run in
+`.rc3-verify/HOST-BOOT.md`.
+
 ## 0.2.1-rc.2 audit outcome
 
 The artifact-level audit of `dsh-v0.2.1-rc.2` against `dsh-v0.2.1-alpha.5` found

package/README.md

@@ -32,19 +32,23 @@ Host on your own computer and does not replace or modify the DSH Web UI.
 
 ## Install from npm
 
-This source checkout targets Node.js 22+ and the five DSH releases it has been
-audited against — `0.2.0-rc.2` (the `latest` channel), the `alpha` channel
-releases `0.2.1-alpha.3`, `0.2.1-alpha.4`, and `0.2.1-alpha.5`, and `0.2.1-rc.2`
-(the `next` channel) — with a `web` profile. DSH checks a plugin's declared
+This source checkout targets Node.js 22+ and the six DSH releases it has been
+audited against — `0.2.0-rc.2`, the `alpha` channel releases `0.2.1-alpha.3`,
+`0.2.1-alpha.4`, and `0.2.1-alpha.5`, and the two `next` channel releases it has
+admitted in turn, `0.2.1-rc.2` and `0.2.1-rc.3` — with a `web` profile. (The
+npm channels move: `latest` now points at `0.2.1-rc.2`, which was promoted
+from `next`, and `next` at `0.2.1-rc.3`.) DSH checks a plugin's declared
 requirements before composing a profile, on every start rather than only on
 install, so any other host version refuses to activate this plugin. From DSH
 `0.2.1-alpha.4` on, that check reads `engines.dsh` and ignores
 `peerDependencies`; older hosts know only the peer range, so both name the same
-five releases. The package includes Funnel helpers
+six releases. The package includes Funnel helpers
 for macOS, Linux, and Windows on amd64/arm64; trusted-LAN mode does not require
-the helper.
+the helper. The helper is built with Go 1.27, which requires **macOS 13 Ventura
+or later**: on macOS 12 and earlier, Funnel mode cannot start, while
+trusted-LAN mode keeps working.
 
-The current working tree names exactly those five versions in `engines.dsh` and
+The current working tree names exactly those six versions in `engines.dsh` and
 `peerDependencies` and is built/typechecked against `0.2.0-rc.2`. A previously
 published plugin package may still carry its own older compatibility
 declaration until a release is made from this tree.
@@ -125,10 +129,30 @@ system-reported name; saving an empty value restores the iPhone-reported
 default.
 
 The settings page's **Testing & troubleshooting** group has a `debug` toggle.
-Turning it on prints handshake and push diagnostics to the DSH host's terminal
+Turning it on prints per-frame and push diagnostics to the DSH host's terminal
 output (for example, the actual capability bits sent in `s2c.welcome`); it
-never prints pairing tokens, APNs tokens, or message content, and takes effect
-immediately without restarting DSH.
+never prints pairing tokens, APNs tokens, or message content. The toggle is
+snapshotted per connection, so an already-open connection only picks up the new
+value after it reconnects.
+
+**Connection failures do not need that toggle.** The plugin always records
+admission rejections, authentication failures (4401 distinguishes an unknown
+device, a revoked device, a bad signature, an expired challenge and clock skew),
+TLS handshake failures and pairing failures. They show up in the terminal as
+`[deeppilot] <time> WARN <event> <reason> src=<source hash> attempt=<attempt ID>`
+and are appended under `diagnostics/` in the plugin data directory (7 days,
+5 MB cap). The settings page's **Connection diagnostics** group lists the most
+recent failures with a copy button, and `/phone/health` additionally returns the
+local transport phase and port, the data-plane phase, whether the TLS identity
+was rebuilt, the start time and the last failure, so the phone can locate the
+cause even while it cannot connect. Records contain only source hashes — never
+raw IPs, pairing codes, keys, APNs tokens or message content.
+
+Each connection attempt from the phone carries a random `attemptId` (the `?at=`
+query parameter on the WebSocket upgrade, or the `X-DeepPilot-Attempt` header on
+pairing and health checks). The plugin writes it into the log lines and
+diagnostic events above, so a user reporting that ID lets you find the exact
+attempt in the host log.
 
 Offline push is optional. Relay mode sends only the target APNs device token
 and a limited notification payload; full conversation history and live output

package/README.zh-CN.md

@@ -30,17 +30,20 @@
 
 ## 从 npm 安装
 
-当前源码面向 Node.js 22+ 与带 `web` profile 的**五个已审计 DSH 版本**：
-`0.2.0-rc.2`（`latest` 通道）、`alpha` 通道的 `0.2.1-alpha.3`、
-`0.2.1-alpha.4` 与 `0.2.1-alpha.5`，以及 `0.2.1-rc.2`（`next` 通道）。
+当前源码面向 Node.js 22+ 与带 `web` profile 的**六个已审计 DSH 版本**：
+`0.2.0-rc.2`、`alpha` 通道的 `0.2.1-alpha.3`、
+`0.2.1-alpha.4` 与 `0.2.1-alpha.5`，以及先后两版 `next` 通道的
+`0.2.1-rc.2` 与 `0.2.1-rc.3`（npm 通道会移动：`latest` 现指向由 `next` 转正的
+`0.2.1-rc.2`，`next` 指向 `0.2.1-rc.3`）。
 DSH 在组合 profile 前会校验插件声明的
 兼容要求，且**每次启动都会校验**（不只是安装时），因此其他宿主版本会拒绝
 激活本插件。从 DSH `0.2.1-alpha.4` 起，该校验只读 `engines.dsh` 并忽略
-`peerDependencies`；更早的宿主只认 peer 范围，因此两处列出同一组五个版本。
+`peerDependencies`；更早的宿主只认 peer 范围，因此两处列出同一组六个版本。
 npm 包内置 macOS、Linux、Windows 的 amd64/arm64 Funnel helper；可信局域网
-模式不依赖 helper。
+模式不依赖 helper。helper 用 Go 1.27 编译，要求 **macOS 13 Ventura 或更高版本**：
+macOS 12 及更早版本无法启动 Funnel 模式，可信局域网模式不受影响。
 
-当前工作树的 `engines.dsh` 与 `peerDependencies` 精确列出这五个版本，构建与
+当前工作树的 `engines.dsh` 与 `peerDependencies` 精确列出这六个版本，构建与
 类型检查针对 `0.2.0-rc.2`。从此工作树发布新版本前，已发布的旧插件包仍可能
 带有各自旧的兼容声明。
 
@@ -108,8 +111,21 @@ DeepPilot 设置页提供“每个公网来源的连接上限”，默认 `8`，
 也不会被覆盖。留空保存可恢复 iPhone 上报的默认名称。
 
 设置页的“测试与故障排查”分组下有一个 `debug` 开关，打开后会在 DSH host 的
-终端输出里打印握手、推送等诊断信息（例如 `s2c.welcome` 里实际发出的能力位），
-不会打印配对令牌、APNs token 或消息内容；改这个开关立即生效，不需要重启 DSH。
+终端输出里打印逐帧与推送等诊断信息（例如 `s2c.welcome` 里实际发出的能力位），
+不会打印配对令牌、APNs token 或消息内容。该开关按连接快照，已建立的连接需要
+重连一次才按新值工作。
+
+**连不上时不需要打开这个开关**：插件会无条件记录准入拒绝、认证失败（4401 会区分
+设备不存在、已撤销、签名错、挑战过期、时钟偏差等原因）、TLS 握手失败与配对失败，
+在终端输出为 `[deeppilot] <时间> WARN <事件> <原因> src=<来源哈希> attempt=<尝试 ID>`，
+并落盘到插件数据目录的 `diagnostics/`（保留 7 天、上限 5 MB）。设置页“连接诊断”
+分组可查看最近失败并一键复制；`/phone/health` 额外返回本地传输相位与端口、数据面
+相位、是否重建过 TLS 身份、启动时间与最近一次失败，手机端在连不上时也能据此定位。
+记录只含来源哈希，不含原始 IP、配对码、密钥、APNs token 或消息内容。
+
+手机端每次连接尝试会带一个随机的 `attemptId`（WebSocket 升级的 `?at=` 查询参数，
+或配对/健康检查的 `X-DeepPilot-Attempt` 请求头）。插件把它写进上面的日志与诊断
+事件；用户反馈时报告这个 ID，就能在主机日志里定位到同一次尝试。
 
 离线推送是可选功能。中继模式只发送目标 APNs 设备 Token 和有限的通知内容；
 完整会话历史与实时输出不会经过中继。启用远程访问或推送前，请阅读

package/bin/SHA256SUMS

@@ -1,6 +1,6 @@
-c70401fd9530f2fae6abe7aec5eacacca239ba315cedc7197db530df8c6f97bd  ./darwin-amd64/dsh-deeppilot-tunnel
-45ff6b53d3e27fe6242e4904055d647d8b220a5c56ca76e542ffcd861ad3bbad  ./darwin-arm64/dsh-deeppilot-tunnel
-8d4937de90564327dcf8392dba6241e4facc30044a48447b22de99f3e62c9808  ./linux-amd64/dsh-deeppilot-tunnel
-cd4638f9aa3e60340d4f446301b2b6f6452f5cb89fc012884e5a893ab8dbd577  ./linux-arm64/dsh-deeppilot-tunnel
-d5435d4e0c02056b3fac39a5f289acb404e6f060dc566e5dea724ee2b86a4296  ./windows-amd64/dsh-deeppilot-tunnel.exe
-7d79c848b2b74286764bd284005edbcfdf539be90ce0b160ea464ae3af70e005  ./windows-arm64/dsh-deeppilot-tunnel.exe
+0e49860ffd7b6fd9ba5918481cbfa2fc0a788f0c16d500de69a162d31451d526  ./darwin-amd64/dsh-deeppilot-tunnel
+16e0b6235cb097401dc52840f11c0dcf405925d23449934cdfea93ec89c071e9  ./darwin-arm64/dsh-deeppilot-tunnel
+ed3d60db2da2f3c17a5f7d04834faf4623a955ecc48a3aa0497c3903df8a2bce  ./linux-amd64/dsh-deeppilot-tunnel
+b5e85cd9f9f928f4204cfc15067588d1c3dcdc683a5f5b85759d5454bce2110e  ./linux-arm64/dsh-deeppilot-tunnel
+836126376d0da12abc6bafb3ed163138436f812b201bd254eb1c7cae3f8a34c7  ./windows-amd64/dsh-deeppilot-tunnel.exe
+6b74d0f4b73f9f53b01829a84abd178c17a64950c1e9949b8fae15ef274fb99f  ./windows-arm64/dsh-deeppilot-tunnel.exe

package/docs/DSH_RELEASE_MEMORY.md

@@ -3,7 +3,97 @@
 > This is the durable audit record for DeepPilot's public DSH plugin. Re-audit
 > the next DSH release instead of assuming that an rc upgrade is runtime-safe.
 
-## Current decision — `dsh-v0.2.1-rc.2`
+## Current decision — `dsh-v0.2.1-rc.3`
+
+- **Audited release:** `dsh-v0.2.1-rc.3`, published to the npm registry
+  2026-10-23T07:54:30Z (GitHub Release 2026-10-23T15:26:39Z), and the **`next`**
+  channel release — `next` moved from `0.2.1-rc.2` to it, so this is the second
+  consecutive rc on that line to enter the supported list, each on its own audit.
+  It is **not** `latest`: the registry currently reads `latest = 0.2.1-rc.2`
+  (rc.2, promoted from `next`) and `alpha = 0.2.1-alpha.5`. This audit therefore also
+  corrected the older channel attribution that called `0.2.0-rc.2` the `latest`
+  channel in `AGENTS.md` and both READMEs — the list of six admitted hosts is
+  unchanged by that correction, only its description.
+- **Comparison baseline:** `dsh-v0.2.1-rc.2` (the previous audited tag).
+- **Plugin runtime verdict: no break, and no `src/` change was needed.**
+  Nineteen packages were compared **as whole trees, not by `lib/` alone** —
+  eighteen from the two installed trees plus `dsh-client-ui-slots` (the seventh
+  declared `dsh-*` peer, absent from both) through its registry tarball. Fourteen
+  differ only in `package.json`, three carry one further file each, and
+  `cordis 4.0.5` / `schemastery 3.18.5` are byte-identical including
+  `package.json`. Of 3,302 shared files, 3,275 are byte-identical and 20 differ.
+  The tree count moves 306 → 307 with the new
+  `@deepseek-ai/dsh-client-ui-entry-customization@0.2.1-rc.3`, the More-menu bundle
+  the web-app patch now references; this plugin neither references it nor depends
+  on it. Across 274 modules **no export symbol is added or removed** (18 entry
+  modules compared), so every earlier fix still holds unchanged. The manifest
+  delta over 19 packages covers 585 paths — 17 version bumps and 568
+  dependency-spec moves — with **zero structural differences**.
+- **The three non-`package.json` files are additive or comment-only.**
+  `@deepseek-ai/dsh-api-remotes/lib/client.js` widens the client telemetry event
+  schema (`is_new_session`, `agent_preset`, and the More-menu / agent-preset
+  switch events), data this plugin neither emits nor validates.
+  `@deepseek-ai/dsh-api-session-controller`'s
+  `lib/types/client/sessions/service.d.ts` changes a doc comment only.
+  `@deepseek-ai/dsh-web-app/cordis.patch.yml` gains one hunk inserting the
+  `ui-entry-customization` bundle (the More menus named in the rc.3 release
+  notes); the patch anchor this plugin targets, `id: directory-picker`, is
+  byte-identical on both sides at the same offsets, and neither the new package
+  name nor `entry-customization` appears in this plugin's `cordis.patch.yml` or
+  `package.json`.
+- **Activation verdict: the new release is admitted by both declarations, and the
+  earlier rc stays out.** rc.3, like rc.2, reads a declared `engines.dsh` alone,
+  so before the widening its refusal reported a **single** `engines.dsh`
+  requirement and `exempted: false` — no profile exemption file exists on this
+  machine — and a real rc.3 CLI reproduced it (`skipping profile bundle
+  "dsh-deeppilot"`) while the host itself still booted and served its web port.
+  Widening admits `0.2.1-rc.3` and nothing else: `0.2.1-rc.1` was never audited as
+  its own host, so it stays refused, as do `0.2.1-rc.3.1`, `0.2.1-rc.30`,
+  `0.2.1-RC.3`, `0.2.1`, `0.2.1-rc.2.1`, `0.2.0`, `0.3.0`, and `1.0.0`. Deleting
+  `engines.dsh` from a copy of the manifest falls back to the ten peers and admits
+  the same six hosts, so the short-circuit is unchanged.
+- **Evidence: the published artifacts, the published evaluator, and a real rc.3
+  CLI run — all taken before any declaration changed.**
+  - **Change surface:** `.rc3-verify/CHANGE_SURFACE.md` and
+    `.rc3-verify/AUDIT.md`, with raw logs under `.rc3-verify/logs/`
+    (`master-table.txt`, `file-hash-compare.txt`, `diff-rq.all.txt`,
+    `patch-anchor-check.stdout.txt`), plus `tree-compare.out.json` (the
+    16-package whole-tree comparison), `export-symbol-diff.out.json` (274
+    modules, zero surface deltas), `pkg-manifest-delta.out.json` (585 paths, all
+    version or dependency-spec values) and `patch-anchor-check.out.json` (the one
+    patch-file change and its anchor).
+  - **Activation decision, reproduced against rc.3's own published evaluator
+    before any edit:** `.rc3-verify/evaluator-repro.out.json` shows the unchanged
+    manifest refused with one `engines.dsh` requirement and `exempted: false`, and
+    the worktree manifest admitted; `.rc3-verify/matrix.out.json` projects the
+    widening over 15 candidates — before accepted 5, after accepted 6, **newly
+    accepted exactly `0.2.1-rc.3`, newly rejected 0**.
+  - **Real CLI refusal and real CLI load.** The refusal was captured from the
+    installed rc.3 CLI before the declaration changed; after the widening the same
+    CLI composes the plugin (`--dump-config`, exit 0, no skip line).
+- **Positive load verified this time.** An isolated `0.2.1-rc.3` host — its own
+  `DSH_HOME` in a one-off scratch directory (since deleted), the plugin linked
+  from this working tree, and no other plugin — composed the plugin into the
+  tree, started it, and answered `https://127.0.0.1:3098/phone/health` with `200`:
+  `{"ok":true,"enabled":true,"protocolVersion":2,"serverVersion":"0.9.10","dataPlane":true}`
+  while the isolated home gained `deeppilot/host-id` and `deeppilot/lan-tls/`.
+  Evidence: `.rc3-verify/HOST-BOOT.md` (written after the audit directory was
+  handed over) with the raw log and probe output beside it.
+- **Check set run (nothing published).** `npm test` (609 pass, 0 fail),
+  `typecheck`, `build` (committed `lib/` unchanged), `check:config-schema`, and
+  `smoke:helper` (darwin-arm64). One environment note carries forward: the
+  default npm cache on this machine holds root-owned files, so the
+  `check:config-schema` script's `npx` invocation fails with `EPERM` until
+  `npm_config_cache` points at a writable directory; with that variable set the
+  check passes. No `npm ci`, no commit, no push, no tag, and no npm publish: the
+  release is prepared but not shipped.
+- **Not covered / limits.** No real iPhone run, no Funnel end-to-end, no
+  model-backed turn against this host. `npm ci` and the helper-matrix rebuild
+  steps were skipped because no helper, dependency, or source input changed; CI
+  rebuilds the matrix and fails on any `bin/` drift. The widening is a metadata
+  and documentation change only.
+
+### Previous decision — `dsh-v0.2.1-rc.2`
 
 - **Audited release:** `dsh-v0.2.1-rc.2`, published 2026-10-17T08:36:31.655Z. It is
   **not** `latest`: `latest` still points at `0.2.0-rc.2`, and `alpha` still points
@@ -87,12 +177,61 @@
   `0.2.0-rc.2` this branch builds and typechecks against.
 - **Protocol verdict: no phone-protocol change.** Protocol v2, pairing state, and
   device records are untouched by this release; no phone needs to re-pair.
-- **Audit limits, stated rather than implied.** The positive half of the rc.2
-  verification — loading this plugin on a real isolated `0.2.1-rc.2` host after the
-  widening — had **not** been completed when this entry was written, and neither had
-  the full release check set against that host. Until they run, rc.2 is recorded as
-  audited at the artifact-diff and declaration level only; no plugin release has
-  been made from this tree.
+- **The limits this entry originally stated are now closed.** The positive half of
+  the rc.2 verification ran before publication: on an isolated `0.2.1-rc.2` host
+  carrying the widened declaration, `--dump-config` wrote nothing to stderr, the
+  composed tree contained `# == dsh-deeppilot` (line 1233) together with
+  `# == @deepseek-ai/dsh-web-app, patched by dsh-deeppilot` (line 449), the running
+  host logged four `[deeppilot]` lines, and the plugin's own LAN listener on port
+  3098 answered `/phone/health` with `200` and `serverVersion` `0.9.8`. A tamper
+  control removed the `0.2.1-rc.2` token from a copy of `engines.dsh`: the host
+  refused again with the single `engines.dsh` requirement (`exempted: false`) and
+  accepted it once restored. Independent verification of the whole release tree —
+  `npm ci`, 581 tests (580 pass, 0 fail, 1 pre-existing TODO), typecheck, build
+  with a byte-identical regenerated `lib/`, `check:config-schema`, the Go helper
+  tests, and all six `bin/SHA256SUMS` entries — is recorded in
+  `.rc2-verify/VERIFICATION.md`; that pass also caught a real defect, a version
+  bump that had left `tests/apply-baseline.snapshot.json` stale.
+- **Published as 0.9.8 on 2026-10-18.** The annotated tag `v0.9.8` dereferences to
+  `f4551b61602e5e60b11565ae31ccba3257d3dc9e` on `main`, CI and CodeQL were green on
+  that commit, and `publish.yml` ran on the tag (run `39048037503`, 24/24 steps).
+  The registry records `latest: 0.9.8`, published `2026-10-17T16:12:59.699Z`, with a
+  `https://slsa.dev/provenance/v1` attestation naming that commit as its source. The
+  published tarball's SHA1 `8288977711e04679d077b970f863e726631fc309` and its SHA512
+  match the registry, its 68 entries and 130,945,335 unpacked bytes match the
+  pre-publication pack, and every packaged file compared byte-identically with the
+  verified tree. A clean isolated profile then installed `dsh-deeppilot@0.9.8` from
+  npm, composed it on a real `0.2.1-rc.2` host, and answered `/phone/health` with
+  `200` and `serverVersion: "0.9.8"`; the GitHub Release was made public only after
+  that install verification. The same release shipped the mobile skills, host
+  commands, and catalog-cache work recorded below.
+- **Published as 0.9.9 on 2026-10-21.** The annotated tag `v0.9.9` dereferences to
+  `feee5c5854cd598af7b7827c53ddffdec3199573` on `main`, with CI and CodeQL green on
+  that commit. The DSH compatibility declaration did not change (the same five
+  audited hosts). The first CI run on the release commit failed in the helper job:
+  `govulncheck` reported GO-2026-6809 in Go 1.26.9's `crypto/x509`, reachable
+  through `http.Server.Serve`; the helper moved to Go 1.26.10 and the
+  `build-helpers` workflow refreshed all six binaries (PR #30, six `go1.26.10`
+  binaries, `bin/SHA256SUMS` 6/6) before the tag was cut. `publish.yml` ran on the
+  tag (run `39612245054`): the upload and provenance steps succeeded, but its last
+  step (registry verification) exhausted its 24 retries with `HTTP 404` — the
+  registry-visibility delay already seen in 0.9.5 and 0.9.6, not an upload failure.
+  Checked by hand instead: `npm view --prefer-online` gives `latest: 0.9.9` with a
+  `https://slsa.dev/provenance/v1` attestation whose `gitCommit` is that commit and
+  whose workflow ref is `refs/tags/v0.9.9`; the published tarball's SHA1
+  `bfea9ade6be9eb07f209e0e76f5ea20326dc0ddb` and its SHA512 match the registry and
+  the attestation subject; it holds 68 entries (the pre-publication pack count) and
+  every packaged file compared byte-identically with the verified tree. A clean
+  isolated `DSH_HOME` then installed `dsh-deeppilot@0.9.9` from npm on a real
+  `0.2.1-rc.2` host (`dsh web --no-open --port 0`) and `/phone/health` answered `200`
+  with `serverVersion: "0.9.9"`, `protocolVersion: 2` and the data plane active.
+  The first start attempt failed because DSH's own web server could not bind
+  `127.0.0.1:3080`, which another running DSH instance held; that is an environment
+  conflict, not a plugin fault, and the plugin's own listener had come up. The
+  GitHub Release was made public only after that install verification. The release
+  ships connection-failure diagnostics, the `failed` Live Activity phase, the
+  optional `toolName` / `detail` approval fields and `mutable-content`; it must run
+  against a Relay that already accepts them.
 
 ### Previous decision — `dsh-v0.2.1-alpha.5`
 
@@ -1756,7 +1895,7 @@ release notes.
 
 ## 2026-10-15 — 移动端技能发现扩展
 
-新增可选的 `skills` 手机能力，使用官方 `sessionSkillCatalog.list({sessionId}, AbortSignal)` 服务，已对照本机 `0.2.0-rc.2` 和 `0.2.1-alpha.3` 发行声明。缺少服务只关闭该特性，晚挂载服务会重新探测，不缓存缺席。未修改宿主版本范围、鉴权、包版本或命令派发契约。手机只接收元数据，技能注册表和会话预设、工作目录变化触发目录失效。完整文档清单与四类差异表见《技能提示对接说明》。此源码改动尚未发布，真实主机与真机技能加载仍未验收。
+新增可选的 `skills` 手机能力，使用官方 `sessionSkillCatalog.list({sessionId}, AbortSignal)` 服务，已对照本机 `0.2.0-rc.2` 和 `0.2.1-alpha.3` 发行声明。缺少服务只关闭该特性，晚挂载服务会重新探测，不缓存缺席。未修改宿主版本范围、鉴权、包版本或命令派发契约。手机只接收元数据，技能注册表和会话预设、工作目录变化触发目录失效。完整文档清单与四类差异表见《技能提示对接说明》。此源码改动随 0.9.8（2026-10-18）发布；主机侧集成已在本机隔离真实宿主上验收，真机技能加载仍未验收。
 
 ## 2026-10-16 — 移动端系统指令扩展
 
@@ -1770,4 +1909,4 @@ release notes.
 1. 安装与主机 API：本轮不改安装范围或依赖；读取沿用现有技能、命令和模型接口。工作区另有 alpha.4 兼容改动，命令对接已重新枚举该版 29 包、144 个接口，相关主机实现与 alpha.3 相同；不据此宣称真实业务验收。
 2. 手机协议：模型当前选择投影新增 `s2c.models.changed`，受 `sessions.read` 控制；原生权限执行可附加 `expectedDefinitionId`，重读目录核对来源，旧客户端字段缺省兼容。无新增周期轮询或第二层主机时间缓存。
 3. 客户端：内存五分钟、磁盘最长七天，重启旧目录先展示并校验，按配对身份/主机/会话隔离；当前模型、权限和执行结果不落盘。具体约定和格式重建见[移动端目录缓存](移动端目录缓存.md)。
-4. 验证：插件 577 项通过、1 项原有待办，类型检查、生成产物构建和使用本机固定版本的离线配置校验通过；两端缓存单元与模拟器证据见各自文档。未发布。
+4. 验证：插件 577 项通过、1 项原有待办，类型检查、生成产物构建和使用本机固定版本的离线配置校验通过；两端缓存单元与模拟器证据见各自文档。随 0.9.8（2026-10-18）发布；真机与系统分享仍未验收。

package/docs/NPM_PUBLISHING.md

@@ -105,6 +105,36 @@
    本轮还确认了一个易漏点：升版本号必须同步重录
    `tests/apply-baseline.snapshot.json`，否则 `npm test` 会失败——已写入
    `AGENTS.md` 的发布流程第 1 步。
+8. `0.9.8` 的实际发布结果（2026-10-18）：附注标签 `v0.9.8` 指向
+   `f4551b61602e5e60b11565ae31ccba3257d3dc9e`，该提交的 CI 与 CodeQL 均为绿；
+   `publish.yml` 在该标签上运行（运行号 `39048037503`，24 个步骤全部成功），
+   注册表 `latest` 为 `0.9.8`。逐项核验：来源证明类型为
+   `https://slsa.dev/provenance/v1`，其 `gitCommit` 正是该提交；压缩包 SHA1
+   `8288977711e04679d077b970f863e726631fc309` 与 SHA512 与注册表一致；注册表
+   条目数 68、解包 130,945,335 字节与发布前的打包核对一致，包内逐个文件与已验证
+   的工作树逐字节相同。随后在全新隔离 profile 中从 npm 安装
+   `dsh-deeppilot@0.9.8`，在真实 `0.2.1-rc.2` 宿主上完成组合与启动，插件自有端口
+   3098 的 `/phone/health` 返回 200 且 `serverVersion` 为 `0.9.8`；GitHub Release
+   在这一步通过后才公开并标记 Latest。
+
+9. `0.9.9` 的实际发布结果（2026-10-21）：附注标签 `v0.9.9` 指向
+   `feee5c5854cd598af7b7827c53ddffdec3199573`，该提交的 CI 与 CodeQL 均为绿。发布
+   提交的首次 CI 曾因 helper 的 `govulncheck` 报 GO-2026-6809（Go 1.26.9 的
+   `crypto/x509`，调用链可达）而失败，处理方式是 helper 升到 Go 1.26.10，由
+   `build-helpers` 工作流重建六个二进制并合并刷新 PR（#30），之后才打标签。
+   `publish.yml` 在该标签上运行（运行号 `39612245054`）：**上传与来源证明步骤成功，
+   但最后的核对步骤在 24 次重试后仍抛 `读取 npm 发布信息失败（HTTP 404）`，整次运行
+   结论为失败**——与 `0.9.5`、`0.9.6` 同一形态，说明 `0.9.7` 放宽的约 7 分钟窗口并非
+   总是足够，注册表元数据的可见性延迟仍会超出它。事后人工核验：
+   `npm view --prefer-online` 得到 `latest = 0.9.9`；来源证明类型为
+   `https://slsa.dev/provenance/v1`，`gitCommit` 正是该提交，工作流引用为
+   `refs/tags/v0.9.9`；压缩包 SHA1 `bfea9ade6be9eb07f209e0e76f5ea20326dc0ddb` 与 SHA512
+   同注册表和来源证明主体一致，共 68 个条目，包内每个文件与已验证的工作树逐字节相同。
+   随后在全新隔离 `DSH_HOME` 中从 npm 安装 `dsh-deeppilot@0.9.9`，在真实
+   `0.2.1-rc.2` 宿主上用 `dsh web --no-open --port 0` 启动，`/phone/health` 返回 200，
+   `serverVersion` 为 `0.9.9`；首次启动因另一个正在运行的 DSH 占用了宿主自己的 3080
+   端口而失败，属环境冲突，不是插件问题。GitHub Release 在这一步通过后才公开并标记
+   Latest。是否再放宽核对窗口，留待下次发布前决定，本次未改工作流。
 
 ## 五、官方资料