dsh-deeppilot 0.9.9 → 0.9.11

package/COMPATIBILITY.md

@@ -1,9 +1,10 @@
 # Compatibility
 
-This branch targets exactly **five DSH releases**: `0.2.0-rc.2`, which the npm
-`latest` channel points at; `0.2.1-alpha.3`, `0.2.1-alpha.4`, and
-`0.2.1-alpha.5`, which the `alpha` channel has pointed at in turn; and
-`0.2.1-rc.2`, which the `next` channel points at. All five are
+This branch targets exactly **six DSH releases**: `0.2.0-rc.2`; the `alpha`
+channel releases `0.2.1-alpha.3`, `0.2.1-alpha.4`, and `0.2.1-alpha.5`; and the
+`next` channel releases `0.2.1-rc.2` and `0.2.1-rc.3`. The npm channels have
+moved since: `latest` now points at `0.2.1-rc.2`, promoted from `next`, and
+`next` at `0.2.1-rc.3`. All six are
 named in both `engines.dsh` and `peerDependencies`; no other version is accepted.
 DSH evaluates that declaration before composing a profile — on every start, not
 only on install — so a newly published DSH release deactivates this plugin until
@@ -21,9 +22,10 @@ recorded in the release memory.
 | Component | Current contract | Evidence |
 |---|---|---|
 | Node.js | 22 or newer | Package engine and CI |
-| DSH CLI and Host API | `engines.dsh` and `peerDependencies` both name `0.2.0-rc.2 \|\| 0.2.1-alpha.3 \|\| 0.2.1-alpha.4 \|\| 0.2.1-alpha.5 \|\| 0.2.1-rc.2` (dev pins `0.2.0-rc.2`) | Peer metadata, source typecheck, unit tests, bundle build, and config schema projection against a real 0.2.0-rc.2 CLI, plus isolated composes and live phone-protocol runs with the published 0.2.1-alpha.2, 0.2.1-alpha.3, and 0.2.1-alpha.4 CLIs, an isolated 0.2.1-alpha.5 host where this plugin now composes, starts, and answers `/phone/health` with 200 on its own LAN listener, and a pre-widening 0.2.1-rc.2 host run where the unchanged declaration is refused at compose time (audits below) |
+| DSH CLI and Host API | `engines.dsh` and `peerDependencies` both name `0.2.0-rc.2 \|\| 0.2.1-alpha.3 \|\| 0.2.1-alpha.4 \|\| 0.2.1-alpha.5 \|\| 0.2.1-rc.2 \|\| 0.2.1-rc.3` (dev pins `0.2.0-rc.2`) | Peer metadata, source typecheck, unit tests, bundle build, and config schema projection against a real 0.2.0-rc.2 CLI, plus isolated composes and live phone-protocol runs with the published 0.2.1-alpha.2, 0.2.1-alpha.3, and 0.2.1-alpha.4 CLIs, an isolated 0.2.1-alpha.5 host where this plugin now composes, starts, and answers `/phone/health` with 200 on its own LAN listener, a pre-widening 0.2.1-rc.2 host run where the unchanged declaration is refused at compose time, and an isolated 0.2.1-rc.3 host where the widened declaration composes, starts, and answers `/phone/health` with 200 (audits below) |
 | iOS bridge | DeepPilot protocol v2 | Bridge protocol tests; device behavior must be checked with the running Host and app |
 | Remote access | Tailscale Funnel on ports 443, 8443, or 10000 | Helper and supervisor tests |
+| Funnel helper platforms | macOS 13 Ventura or later, Linux, and Windows, each on amd64/arm64; built with Go 1.27, which dropped macOS 12 | CI starts the committed helper on a native runner for each of the six targets (`helper-smoke`); no runner covers macOS 13 itself |
 
 ## DSH interfaces used here
 
@@ -73,6 +75,77 @@ carries the old top-level `debug: true` is accepted but that value is ignored:
 verbose logging must be turned on again from the settings page. No other config
 field changed shape, and the old key is not read anywhere in this version.
 
+## 0.2.1-rc.3 audit outcome
+
+The artifact-level audit of `dsh-v0.2.1-rc.3` (published to the npm registry
+2026-10-23T07:54:30Z, the `next` channel release; `latest` points at `0.2.1-rc.2`)
+against `dsh-v0.2.1-rc.2` found **no change that reaches this plugin's call
+surface**. Nineteen packages were compared as whole trees rather than by `lib/`
+alone — eighteen from the two installed trees plus
+`@deepseek-ai/dsh-client-ui-slots` (the seventh declared `dsh-*` peer, absent from
+both trees) through its registry tarball:
+
+- **Fourteen packages differ only in `package.json`** — version and dependency
+  specs — so every file those hosts read at runtime is byte-identical.
+- **Three packages carry one non-`package.json` change each** — `dsh-api-remotes`,
+  `dsh-api-session-controller`, and `dsh-web-app` — detailed below.
+- **`cordis 4.0.5` and `schemastery 3.18.5` are byte-identical including
+  `package.json`**, so the vendor peer ranges need no widening again.
+- **The tree gains one package**: `rc.2` ships 306 packages and `rc.3` 307; the
+  addition is `@deepseek-ai/dsh-client-ui-entry-customization@0.2.1-rc.3`, the
+  bundle behind the More menus. This plugin neither references it nor depends on
+  it through its own patch.
+
+Of 3,302 shared files, 3,275 are byte-identical and 20 differ: 16 `package.json`
+files, the three code/config files above, and the `dsh-client-ui-slots`
+`package.json`. Across 274 analysed modules **no export symbol is added or
+removed** (18 entry modules compared), so every earlier fix still holds
+unchanged. The manifest delta over 19 packages covers 585 paths — 17 version
+bumps and 568 dependency-spec moves, **zero structural differences** — with no
+package added or removed by dependency resolution.
+
+**The one file outside `package.json` that could reach this plugin's patch layer
+is additive.** `@deepseek-ai/dsh-web-app/cordis.patch.yml` gained one hunk that
+inserts the `ui-entry-customization` bundle (the More menus named in the rc.3
+release notes). The patch anchor this plugin targets, `id: directory-picker`, is
+byte-identical on both sides at the same offsets, and neither the new package
+name nor `entry-customization` appears in this plugin's `cordis.patch.yml` or
+`package.json`, so the change cannot reach any patch this plugin applies.
+
+The other two non-`package.json` files are equally out of reach:
+`@deepseek-ai/dsh-api-remotes/lib/client.js` only widens the client telemetry
+event schema (`is_new_session`, `agent_preset`, and the More-menu and
+agent-preset switch events), which this plugin neither emits nor validates, and
+`@deepseek-ai/dsh-api-session-controller`'s
+`lib/types/client/sessions/service.d.ts` changes a doc comment only.
+
+The activation verdict repeats the rc.2 shape: rc.3 also reads `engines.dsh`
+alone. Before the widening, the published rc.3 evaluator refused `0.2.1-rc.3`
+with a single `engines.dsh` requirement and `exempted: false`, and a real rc.3
+CLI reproduced the refusal at compose time (`skipping profile bundle
+"dsh-deeppilot"`) while the host itself still booted and served its web port.
+After the widening, the same evaluator admits exactly `0.2.1-rc.3` and adds no
+other acceptance: the five earlier hosts stay admitted, and `0.2.1-rc.1`,
+`0.2.1-rc.3.1`, `0.2.1-rc.30`, `0.2.1-RC.3`, `0.2.1`, `0.2.1-rc.2.1`, `0.2.0`,
+`0.3.0`, and `1.0.0` remain refused. Deleting `engines.dsh` from a copy of the
+manifest falls back to the ten peers and still admits the same six hosts, so the
+short-circuit is unchanged.
+
+**The positive half is complete this time.** An isolated `0.2.1-rc.3` host — its
+own `DSH_HOME`, the plugin linked from this working tree, and no other plugin —
+composes the plugin into the tree, starts it, and answers `/phone/health` with
+200 on the plugin's own LAN listener (`serverVersion` `0.9.10`, protocol v2),
+while the isolated home gains the plugin's data directory. The same profile run
+with the declaration unchanged shows the skip line instead and no listener,
+which is what makes the pair discriminative.
+
+Evidence: `.rc3-verify/AUDIT.md` and `.rc3-verify/CHANGE_SURFACE.md` with the raw
+logs under `.rc3-verify/logs/`, the evaluator reproduction in
+`.rc3-verify/evaluator-repro.out.json`, the acceptance matrix in
+`.rc3-verify/matrix.out.json`, the export-symbol diff in
+`.rc3-verify/export-symbol-diff.out.json`, and the host run in
+`.rc3-verify/HOST-BOOT.md`.
+
 ## 0.2.1-rc.2 audit outcome
 
 The artifact-level audit of `dsh-v0.2.1-rc.2` against `dsh-v0.2.1-alpha.5` found

package/README.md

@@ -32,19 +32,23 @@ Host on your own computer and does not replace or modify the DSH Web UI.
 
 ## Install from npm
 
-This source checkout targets Node.js 22+ and the five DSH releases it has been
-audited against — `0.2.0-rc.2` (the `latest` channel), the `alpha` channel
-releases `0.2.1-alpha.3`, `0.2.1-alpha.4`, and `0.2.1-alpha.5`, and `0.2.1-rc.2`
-(the `next` channel) — with a `web` profile. DSH checks a plugin's declared
+This source checkout targets Node.js 22+ and the six DSH releases it has been
+audited against — `0.2.0-rc.2`, the `alpha` channel releases `0.2.1-alpha.3`,
+`0.2.1-alpha.4`, and `0.2.1-alpha.5`, and the two `next` channel releases it has
+admitted in turn, `0.2.1-rc.2` and `0.2.1-rc.3` — with a `web` profile. (The
+npm channels move: `latest` now points at `0.2.1-rc.2`, which was promoted
+from `next`, and `next` at `0.2.1-rc.3`.) DSH checks a plugin's declared
 requirements before composing a profile, on every start rather than only on
 install, so any other host version refuses to activate this plugin. From DSH
 `0.2.1-alpha.4` on, that check reads `engines.dsh` and ignores
 `peerDependencies`; older hosts know only the peer range, so both name the same
-five releases. The package includes Funnel helpers
+six releases. The package includes Funnel helpers
 for macOS, Linux, and Windows on amd64/arm64; trusted-LAN mode does not require
-the helper.
+the helper. The helper is built with Go 1.27, which requires **macOS 13 Ventura
+or later**: on macOS 12 and earlier, Funnel mode cannot start, while
+trusted-LAN mode keeps working.
 
-The current working tree names exactly those five versions in `engines.dsh` and
+The current working tree names exactly those six versions in `engines.dsh` and
 `peerDependencies` and is built/typechecked against `0.2.0-rc.2`. A previously
 published plugin package may still carry its own older compatibility
 declaration until a release is made from this tree.

package/README.zh-CN.md

@@ -30,17 +30,20 @@
 
 ## 从 npm 安装
 
-当前源码面向 Node.js 22+ 与带 `web` profile 的**五个已审计 DSH 版本**：
-`0.2.0-rc.2`（`latest` 通道）、`alpha` 通道的 `0.2.1-alpha.3`、
-`0.2.1-alpha.4` 与 `0.2.1-alpha.5`，以及 `0.2.1-rc.2`（`next` 通道）。
+当前源码面向 Node.js 22+ 与带 `web` profile 的**六个已审计 DSH 版本**：
+`0.2.0-rc.2`、`alpha` 通道的 `0.2.1-alpha.3`、
+`0.2.1-alpha.4` 与 `0.2.1-alpha.5`，以及先后两版 `next` 通道的
+`0.2.1-rc.2` 与 `0.2.1-rc.3`（npm 通道会移动：`latest` 现指向由 `next` 转正的
+`0.2.1-rc.2`，`next` 指向 `0.2.1-rc.3`）。
 DSH 在组合 profile 前会校验插件声明的
 兼容要求，且**每次启动都会校验**（不只是安装时），因此其他宿主版本会拒绝
 激活本插件。从 DSH `0.2.1-alpha.4` 起，该校验只读 `engines.dsh` 并忽略
-`peerDependencies`；更早的宿主只认 peer 范围，因此两处列出同一组五个版本。
+`peerDependencies`；更早的宿主只认 peer 范围，因此两处列出同一组六个版本。
 npm 包内置 macOS、Linux、Windows 的 amd64/arm64 Funnel helper；可信局域网
-模式不依赖 helper。
+模式不依赖 helper。helper 用 Go 1.27 编译，要求 **macOS 13 Ventura 或更高版本**：
+macOS 12 及更早版本无法启动 Funnel 模式，可信局域网模式不受影响。
 
-当前工作树的 `engines.dsh` 与 `peerDependencies` 精确列出这五个版本，构建与
+当前工作树的 `engines.dsh` 与 `peerDependencies` 精确列出这六个版本，构建与
 类型检查针对 `0.2.0-rc.2`。从此工作树发布新版本前，已发布的旧插件包仍可能
 带有各自旧的兼容声明。
 

package/bin/SHA256SUMS

@@ -1,6 +1,6 @@
-4e83f82d5c623115d121f58264ca84706e5fc935dadc0747b37ae886d102dc6a  ./darwin-amd64/dsh-deeppilot-tunnel
-7707999a5b745d11afeb4ab1868c85680e4ff5567202d97015d72d810817a134  ./darwin-arm64/dsh-deeppilot-tunnel
-8a83351568cb223854efbe8f54ca9a403fc2b152382d4e7c952d372b0b0cb3e9  ./linux-amd64/dsh-deeppilot-tunnel
-dfa4eb4dd50b386aadf40d9767ac0df8151308b620fa395d0a560498f01eb0cb  ./linux-arm64/dsh-deeppilot-tunnel
-9c734ea42bc6dd5763930991db52f910d5138e9b12df0e826d6964ceb271e215  ./windows-amd64/dsh-deeppilot-tunnel.exe
-e7db4a0e62f04266d97a5bad38e1a21961474440e7231fd5b24980053589faa0  ./windows-arm64/dsh-deeppilot-tunnel.exe
+0e49860ffd7b6fd9ba5918481cbfa2fc0a788f0c16d500de69a162d31451d526  ./darwin-amd64/dsh-deeppilot-tunnel
+16e0b6235cb097401dc52840f11c0dcf405925d23449934cdfea93ec89c071e9  ./darwin-arm64/dsh-deeppilot-tunnel
+ed3d60db2da2f3c17a5f7d04834faf4623a955ecc48a3aa0497c3903df8a2bce  ./linux-amd64/dsh-deeppilot-tunnel
+b5e85cd9f9f928f4204cfc15067588d1c3dcdc683a5f5b85759d5454bce2110e  ./linux-arm64/dsh-deeppilot-tunnel
+836126376d0da12abc6bafb3ed163138436f812b201bd254eb1c7cae3f8a34c7  ./windows-amd64/dsh-deeppilot-tunnel.exe
+6b74d0f4b73f9f53b01829a84abd178c17a64950c1e9949b8fae15ef274fb99f  ./windows-arm64/dsh-deeppilot-tunnel.exe

package/docs/DSH_RELEASE_MEMORY.md

@@ -3,7 +3,97 @@
 > This is the durable audit record for DeepPilot's public DSH plugin. Re-audit
 > the next DSH release instead of assuming that an rc upgrade is runtime-safe.
 
-## Current decision — `dsh-v0.2.1-rc.2`
+## Current decision — `dsh-v0.2.1-rc.3`
+
+- **Audited release:** `dsh-v0.2.1-rc.3`, published to the npm registry
+  2026-10-23T07:54:30Z (GitHub Release 2026-10-23T15:26:39Z), and the **`next`**
+  channel release — `next` moved from `0.2.1-rc.2` to it, so this is the second
+  consecutive rc on that line to enter the supported list, each on its own audit.
+  It is **not** `latest`: the registry currently reads `latest = 0.2.1-rc.2`
+  (rc.2, promoted from `next`) and `alpha = 0.2.1-alpha.5`. This audit therefore also
+  corrected the older channel attribution that called `0.2.0-rc.2` the `latest`
+  channel in `AGENTS.md` and both READMEs — the list of six admitted hosts is
+  unchanged by that correction, only its description.
+- **Comparison baseline:** `dsh-v0.2.1-rc.2` (the previous audited tag).
+- **Plugin runtime verdict: no break, and no `src/` change was needed.**
+  Nineteen packages were compared **as whole trees, not by `lib/` alone** —
+  eighteen from the two installed trees plus `dsh-client-ui-slots` (the seventh
+  declared `dsh-*` peer, absent from both) through its registry tarball. Fourteen
+  differ only in `package.json`, three carry one further file each, and
+  `cordis 4.0.5` / `schemastery 3.18.5` are byte-identical including
+  `package.json`. Of 3,302 shared files, 3,275 are byte-identical and 20 differ.
+  The tree count moves 306 → 307 with the new
+  `@deepseek-ai/dsh-client-ui-entry-customization@0.2.1-rc.3`, the More-menu bundle
+  the web-app patch now references; this plugin neither references it nor depends
+  on it. Across 274 modules **no export symbol is added or removed** (18 entry
+  modules compared), so every earlier fix still holds unchanged. The manifest
+  delta over 19 packages covers 585 paths — 17 version bumps and 568
+  dependency-spec moves — with **zero structural differences**.
+- **The three non-`package.json` files are additive or comment-only.**
+  `@deepseek-ai/dsh-api-remotes/lib/client.js` widens the client telemetry event
+  schema (`is_new_session`, `agent_preset`, and the More-menu / agent-preset
+  switch events), data this plugin neither emits nor validates.
+  `@deepseek-ai/dsh-api-session-controller`'s
+  `lib/types/client/sessions/service.d.ts` changes a doc comment only.
+  `@deepseek-ai/dsh-web-app/cordis.patch.yml` gains one hunk inserting the
+  `ui-entry-customization` bundle (the More menus named in the rc.3 release
+  notes); the patch anchor this plugin targets, `id: directory-picker`, is
+  byte-identical on both sides at the same offsets, and neither the new package
+  name nor `entry-customization` appears in this plugin's `cordis.patch.yml` or
+  `package.json`.
+- **Activation verdict: the new release is admitted by both declarations, and the
+  earlier rc stays out.** rc.3, like rc.2, reads a declared `engines.dsh` alone,
+  so before the widening its refusal reported a **single** `engines.dsh`
+  requirement and `exempted: false` — no profile exemption file exists on this
+  machine — and a real rc.3 CLI reproduced it (`skipping profile bundle
+  "dsh-deeppilot"`) while the host itself still booted and served its web port.
+  Widening admits `0.2.1-rc.3` and nothing else: `0.2.1-rc.1` was never audited as
+  its own host, so it stays refused, as do `0.2.1-rc.3.1`, `0.2.1-rc.30`,
+  `0.2.1-RC.3`, `0.2.1`, `0.2.1-rc.2.1`, `0.2.0`, `0.3.0`, and `1.0.0`. Deleting
+  `engines.dsh` from a copy of the manifest falls back to the ten peers and admits
+  the same six hosts, so the short-circuit is unchanged.
+- **Evidence: the published artifacts, the published evaluator, and a real rc.3
+  CLI run — all taken before any declaration changed.**
+  - **Change surface:** `.rc3-verify/CHANGE_SURFACE.md` and
+    `.rc3-verify/AUDIT.md`, with raw logs under `.rc3-verify/logs/`
+    (`master-table.txt`, `file-hash-compare.txt`, `diff-rq.all.txt`,
+    `patch-anchor-check.stdout.txt`), plus `tree-compare.out.json` (the
+    16-package whole-tree comparison), `export-symbol-diff.out.json` (274
+    modules, zero surface deltas), `pkg-manifest-delta.out.json` (585 paths, all
+    version or dependency-spec values) and `patch-anchor-check.out.json` (the one
+    patch-file change and its anchor).
+  - **Activation decision, reproduced against rc.3's own published evaluator
+    before any edit:** `.rc3-verify/evaluator-repro.out.json` shows the unchanged
+    manifest refused with one `engines.dsh` requirement and `exempted: false`, and
+    the worktree manifest admitted; `.rc3-verify/matrix.out.json` projects the
+    widening over 15 candidates — before accepted 5, after accepted 6, **newly
+    accepted exactly `0.2.1-rc.3`, newly rejected 0**.
+  - **Real CLI refusal and real CLI load.** The refusal was captured from the
+    installed rc.3 CLI before the declaration changed; after the widening the same
+    CLI composes the plugin (`--dump-config`, exit 0, no skip line).
+- **Positive load verified this time.** An isolated `0.2.1-rc.3` host — its own
+  `DSH_HOME` in a one-off scratch directory (since deleted), the plugin linked
+  from this working tree, and no other plugin — composed the plugin into the
+  tree, started it, and answered `https://127.0.0.1:3098/phone/health` with `200`:
+  `{"ok":true,"enabled":true,"protocolVersion":2,"serverVersion":"0.9.10","dataPlane":true}`
+  while the isolated home gained `deeppilot/host-id` and `deeppilot/lan-tls/`.
+  Evidence: `.rc3-verify/HOST-BOOT.md` (written after the audit directory was
+  handed over) with the raw log and probe output beside it.
+- **Check set run (nothing published).** `npm test` (609 pass, 0 fail),
+  `typecheck`, `build` (committed `lib/` unchanged), `check:config-schema`, and
+  `smoke:helper` (darwin-arm64). One environment note carries forward: the
+  default npm cache on this machine holds root-owned files, so the
+  `check:config-schema` script's `npx` invocation fails with `EPERM` until
+  `npm_config_cache` points at a writable directory; with that variable set the
+  check passes. No `npm ci`, no commit, no push, no tag, and no npm publish: the
+  release is prepared but not shipped.
+- **Not covered / limits.** No real iPhone run, no Funnel end-to-end, no
+  model-backed turn against this host. `npm ci` and the helper-matrix rebuild
+  steps were skipped because no helper, dependency, or source input changed; CI
+  rebuilds the matrix and fails on any `bin/` drift. The widening is a metadata
+  and documentation change only.
+
+### Previous decision — `dsh-v0.2.1-rc.2`
 
 - **Audited release:** `dsh-v0.2.1-rc.2`, published 2026-10-17T08:36:31.655Z. It is
   **not** `latest`: `latest` still points at `0.2.0-rc.2`, and `alpha` still points
@@ -115,6 +205,33 @@
   `200` and `serverVersion: "0.9.8"`; the GitHub Release was made public only after
   that install verification. The same release shipped the mobile skills, host
   commands, and catalog-cache work recorded below.
+- **Published as 0.9.9 on 2026-10-21.** The annotated tag `v0.9.9` dereferences to
+  `feee5c5854cd598af7b7827c53ddffdec3199573` on `main`, with CI and CodeQL green on
+  that commit. The DSH compatibility declaration did not change (the same five
+  audited hosts). The first CI run on the release commit failed in the helper job:
+  `govulncheck` reported GO-2026-6809 in Go 1.26.9's `crypto/x509`, reachable
+  through `http.Server.Serve`; the helper moved to Go 1.26.10 and the
+  `build-helpers` workflow refreshed all six binaries (PR #30, six `go1.26.10`
+  binaries, `bin/SHA256SUMS` 6/6) before the tag was cut. `publish.yml` ran on the
+  tag (run `39612245054`): the upload and provenance steps succeeded, but its last
+  step (registry verification) exhausted its 24 retries with `HTTP 404` — the
+  registry-visibility delay already seen in 0.9.5 and 0.9.6, not an upload failure.
+  Checked by hand instead: `npm view --prefer-online` gives `latest: 0.9.9` with a
+  `https://slsa.dev/provenance/v1` attestation whose `gitCommit` is that commit and
+  whose workflow ref is `refs/tags/v0.9.9`; the published tarball's SHA1
+  `bfea9ade6be9eb07f209e0e76f5ea20326dc0ddb` and its SHA512 match the registry and
+  the attestation subject; it holds 68 entries (the pre-publication pack count) and
+  every packaged file compared byte-identically with the verified tree. A clean
+  isolated `DSH_HOME` then installed `dsh-deeppilot@0.9.9` from npm on a real
+  `0.2.1-rc.2` host (`dsh web --no-open --port 0`) and `/phone/health` answered `200`
+  with `serverVersion: "0.9.9"`, `protocolVersion: 2` and the data plane active.
+  The first start attempt failed because DSH's own web server could not bind
+  `127.0.0.1:3080`, which another running DSH instance held; that is an environment
+  conflict, not a plugin fault, and the plugin's own listener had come up. The
+  GitHub Release was made public only after that install verification. The release
+  ships connection-failure diagnostics, the `failed` Live Activity phase, the
+  optional `toolName` / `detail` approval fields and `mutable-content`; it must run
+  against a Relay that already accepts them.
 
 ### Previous decision — `dsh-v0.2.1-alpha.5`
 

package/docs/NPM_PUBLISHING.md

@@ -117,6 +117,25 @@
    3098 的 `/phone/health` 返回 200 且 `serverVersion` 为 `0.9.8`；GitHub Release
    在这一步通过后才公开并标记 Latest。
 
+9. `0.9.9` 的实际发布结果（2026-10-21）：附注标签 `v0.9.9` 指向
+   `feee5c5854cd598af7b7827c53ddffdec3199573`，该提交的 CI 与 CodeQL 均为绿。发布
+   提交的首次 CI 曾因 helper 的 `govulncheck` 报 GO-2026-6809（Go 1.26.9 的
+   `crypto/x509`，调用链可达）而失败，处理方式是 helper 升到 Go 1.26.10，由
+   `build-helpers` 工作流重建六个二进制并合并刷新 PR（#30），之后才打标签。
+   `publish.yml` 在该标签上运行（运行号 `39612245054`）：**上传与来源证明步骤成功，
+   但最后的核对步骤在 24 次重试后仍抛 `读取 npm 发布信息失败（HTTP 404）`，整次运行
+   结论为失败**——与 `0.9.5`、`0.9.6` 同一形态，说明 `0.9.7` 放宽的约 7 分钟窗口并非
+   总是足够，注册表元数据的可见性延迟仍会超出它。事后人工核验：
+   `npm view --prefer-online` 得到 `latest = 0.9.9`；来源证明类型为
+   `https://slsa.dev/provenance/v1`，`gitCommit` 正是该提交，工作流引用为
+   `refs/tags/v0.9.9`；压缩包 SHA1 `bfea9ade6be9eb07f209e0e76f5ea20326dc0ddb` 与 SHA512
+   同注册表和来源证明主体一致，共 68 个条目，包内每个文件与已验证的工作树逐字节相同。
+   随后在全新隔离 `DSH_HOME` 中从 npm 安装 `dsh-deeppilot@0.9.9`，在真实
+   `0.2.1-rc.2` 宿主上用 `dsh web --no-open --port 0` 启动，`/phone/health` 返回 200，
+   `serverVersion` 为 `0.9.9`；首次启动因另一个正在运行的 DSH 占用了宿主自己的 3080
+   端口而失败，属环境冲突，不是插件问题。GitHub Release 在这一步通过后才公开并标记
+   Latest。是否再放宽核对窗口，留待下次发布前决定，本次未改工作流。
+
 ## 五、官方资料
 
 1. [npm 可信发布配置与限制](https://docs.npmjs.com/trusted-publishers/)

package/lib/index.d.ts

@@ -971,7 +971,11 @@ declare class HostBridge {
    * push failures must never block or break the WS data plane.
    */
   private fanOutPush;
-  /** Remember the latest assistant text so notifications can quote it. */
+  /**
+   * Remember the latest assistant text so notifications can quote it. 存完整原文：
+   * 按字符数截尾会从链接地址中间切开（横幅只剩 URL 编码的路径），段落选择与
+   * Markdown 清洗统一留到 emitNotify。条目随 sessions.list / 归档清理。
+   */
   private captureAssistantText;
   /**
    * Replay buffered pushes after the given cursor; false when the gap is

package/lib/index.js

@@ -5838,6 +5838,50 @@ function scheduleMutationCodec(persistValues) {
 	};
 }
 //#endregion
+//#region src/notification-text.ts
+/**
+* 通知正文的纯文本投影。
+*
+* 为什么需要：s2c.notify 与 APNs 的 body 是"可直接展示"的文本（PROTOCOL §6），
+* 客户端不得改写；而来源（助手回复、审批原因、提问）都是 Host 给的 Markdown。
+* 直接截原文会把链接地址、URL 编码的中文路径、代码块符号带进锁屏横幅，
+* 所以 Bridge 出站前在这里统一转成纯文本。
+*
+* 只做"去标记、留可读文字"，不追求完整 Markdown 语义；任何无法识别的写法原样保留。
+*/
+/** 把 Markdown 拆成段落并逐段转为单行纯文本；清洗后为空的段落被丢弃。 */
+function notificationParagraphs(markdown) {
+	return stripCodeFences(markdown.replace(/\r\n?/g, "\n")).split(/\n[ \t]*\n/).map(plainParagraph).filter((paragraph) => paragraph.length > 0);
+}
+/**
+* 通知正文：`last` 取最后一个非空段落（任务完成 / 异常结束——回复结尾通常是结论），
+* `all` 把全部段落合成一行（审批原因、提问原文）。长度上限由调用方负责。
+*/
+function notificationPlainText(markdown, pick) {
+	const paragraphs = notificationParagraphs(markdown);
+	return pick === "last" ? paragraphs.at(-1) ?? "" : paragraphs.join(" ");
+}
+/** 围栏代码块整体丢弃：横幅里放不下代码，留一半反而更难读。未闭合的围栏丢到文末。 */
+function stripCodeFences(text) {
+	return text.replace(/^[ \t]*(`{3,}|~{3,})[^\n]*\n[\s\S]*?(?:^[ \t]*\1[ \t]*$|(?![\s\S]))/gm, "\n");
+}
+function plainParagraph(paragraph) {
+	return decodePercentRuns(stripInline(paragraph.split("\n").filter((line) => !(line.includes("|") && line.includes("-") && /^[\s|:-]+$/.test(line))).filter((line) => !/^\s*([*_-])(\s*\1){2,}\s*$/.test(line)).map((line) => line.replace(/^\s*(>\s?)+/, "").replace(/^\s*#{1,6}\s+/, "").replace(/^\s*([-*+]|\d+[.)])\s+(\[[ xX]\]\s+)?/, "").replace(/^\s*\|(.*?)\|?\s*$/, (_row, cells) => cells.replace(/\s*\|\s*/g, "  "))).join(" "))).replace(/\s+/g, " ").trim();
+}
+function stripInline(text) {
+	return text.replace(/!\[[^\]]*\]\((?:[^()]|\([^()]*\))*\)/g, "").replace(/\[([^\]]+)\]\((?:[^()]|\([^()]*\))*\)/g, "$1").replace(/\[([^\]]+)\]\[[^\]]*\]/g, "$1").replace(/<((?:https?|mailto):[^>\s]+)>/g, "$1").replace(/<\/?[A-Za-z][^>]*>/g, "").replace(/(`+)([^`]+?)\1/g, "$2").replace(/(\*\*|__|~~)(?=\S)([\s\S]*?\S)\1/g, "$2").replace(/(^|[^\w*])\*(?=\S)([^*\n]*?\S)\*(?![\w*])/g, "$1$2").replace(/(^|[^\w])_(?=\S)([^_\n]*?\S)_(?!\w)/g, "$1$2");
+}
+/** 正文里残留的 %E6%8F%90 这类编码串解码成原字符；解不开（非法 UTF-8）就保持原样。 */
+function decodePercentRuns(text) {
+	return text.replace(/(?:%[0-9A-Fa-f]{2})+/g, (run) => {
+		try {
+			return decodeURIComponent(run);
+		} catch {
+			return run;
+		}
+	});
+}
+//#endregion
 //#region src/host-api.ts
 /**
 * Subagent sessions are host-internal workers of a parent conversation.
@@ -6020,8 +6064,10 @@ var HostBridge = class {
 	*  PROTOCOL §6 + §7), then fan the same payload out to offline devices
 	*  holding an APNs token. */
 	emitNotify(args) {
-		if ((args.category === "turn.completed" || args.category === "session.error") && this.subagentSessionIds.has(args.sessionId)) return;
-		const body = args.body.length > 120 ? args.body.slice(0, 119) + "…" : args.body;
+		const turnEnd = args.category === "turn.completed" || args.category === "session.error";
+		if (turnEnd && this.subagentSessionIds.has(args.sessionId)) return;
+		const plain = notificationPlainText(args.body, turnEnd ? "last" : "all") || (args.fallbackBody ?? "");
+		const body = plain.length > 120 ? plain.slice(0, 119) + "…" : plain;
 		const approvalExtras = args.category === "approval.required" && args.toolName ? {
 			toolName: args.toolName.slice(0, 80),
 			...args.detail ? { detail: args.detail.slice(0, 600) } : {}
@@ -6049,12 +6095,12 @@ var HostBridge = class {
 		if (this.subagentSessionIds.has(sessionId)) return;
 		const row = this.summaries.get(sessionId);
 		const title = ok ? "任务完成" : "任务异常结束";
-		const body = this.lastAssistantText.get(sessionId) ?? row?.title ?? "";
 		this.emitNotify({
 			sessionId,
 			category: ok ? "turn.completed" : "session.error",
 			title,
-			body,
+			body: this.lastAssistantText.get(sessionId) ?? "",
+			fallbackBody: row?.title ?? "",
 			notificationId: "n-" + (this.cursor + 1)
 		});
 	}
@@ -6067,11 +6113,15 @@ var HostBridge = class {
 			this.pushOutlet?.fanOut(notification);
 		} catch {}
 	}
-	/** Remember the latest assistant text so notifications can quote it. */
+	/**
+	* Remember the latest assistant text so notifications can quote it. 存完整原文：
+	* 按字符数截尾会从链接地址中间切开（横幅只剩 URL 编码的路径），段落选择与
+	* Markdown 清洗统一留到 emitNotify。条目随 sessions.list / 归档清理。
+	*/
 	captureAssistantText(sessionId, event) {
 		if (event.type !== "assistant/message") return;
 		const text = messageText(event.data).trim();
-		if (text.length > 0) this.lastAssistantText.set(sessionId, text.slice(-160));
+		if (text.length > 0) this.lastAssistantText.set(sessionId, text);
 	}
 	/**
 	* Replay buffered pushes after the given cursor; false when the gap is