Merge origin/master into agent/onboarding-modal-flow

2026-08-13 16:57:01 +08:00
parent f8c0bf9186 d8f5b0507d
commit 5c2244cc9c
237 changed files with 266 additions and 247 deletions
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh",
  "description": "dsh CLI: profile boot, plugin management, and the browser UI alias",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write apps/cli/reference/README.md
-README.md: 0b23db293c304807b5959f5eae9a2faf868caa62
+README.md: 0be64fdfc0ad4e81d23f25a26881fa89f37565b0
-README.zh.md: d812c7cd0d1efaa69b135925f3e922668539781b
+README.zh.md: 649bf15df814abf4875fed794c2e76c494bfcc25
@@ -61,7 +61,7 @@ dsh web --dump-config
 dsh web --help
 ```
-The production Web runner needs built package and frontend artifacts (`pnpm run build`). It serves `http://127.0.0.1:3080` by default. Binding all interfaces also trusts the machine's discovered LAN IP literals; `--trusted-host` adds named authorities accepted by the `/api` browser-trust fence.
+The production Web runner needs built package and frontend artifacts (`pnpm run build`). It serves `http://127.0.0.1:3080` by default. The CLI intentionally does not support `--host 0.0.0.0` yet and exits with a usage error; `--trusted-host` adds named authorities accepted by the `/api` browser-trust fence.
 Process shutdown gives the plugin tree up to five seconds to dispose. The first `SIGINT`/`SIGTERM` starts that graceful drain — `SIGTERM` is a supervisor's ordinary stop request and exits 0 on every surface, `SIGINT` reports 130; a second signal forces immediate exit. If one-shot normal completion is already stuck in disposal, the first `Ctrl+C` is the escalation and exits immediately instead of being swallowed.
@@ -61,7 +61,7 @@ dsh web --dump-config
 dsh web --help
 ```
-生产 Web 运行器需要已构建的包和前端产物（`pnpm run build`）。默认服务地址是 `http://127.0.0.1:3080`。绑定所有网络接口时，还会信任机器自动发现的 LAN IP 字面量；`--trusted-host` 可添加 `/api` 浏览器信任围栏接受的具名 authority。
+生产 Web 运行器需要已构建的包和前端产物（`pnpm run build`）。默认服务地址是 `http://127.0.0.1:3080`。CLI 目前有意不支持 `--host 0.0.0.0`，并会以用法错误退出；`--trusted-host` 可添加 `/api` 浏览器信任围栏接受的具名 authority。
 进程关闭时，插件树最多有 5 秒完成 dispose。首次收到 `SIGINT` 或 `SIGTERM` 时会开始优雅排空：`SIGTERM` 是监督进程发出的常规停止请求，在所有运行模式下都以 0 退出；`SIGINT` 则报告 130。第二次收到信号时会立即强制退出。如果一次性运行在正常结束时已经卡在 dispose 阶段，第一次按下 `Ctrl+C` 就会直接升级为强制退出，而不会被忽略。
@@ -36,8 +36,8 @@ describe('parseDshArgs', () => {
      .toEqual({ mode: 'profile', profile: 'tui', patches: [], args: ['--resume', 'abc'] })
    expect(parse(['--profile', 'web', '-h']))
      .toEqual({ mode: 'profile', profile: 'web', patches: [], args: ['-h'] })
-    expect(parse(['web', '--host', '0.0.0.0', '--port', '8080', '--dev']))
+    expect(parse(['web', '--host', '127.0.0.1', '--port', '8080', '--dev']))
-      .toEqual({ mode: 'profile', profile: 'web', patches: [], args: ['--host', '0.0.0.0', '--port', '8080', '--dev'] })
+      .toEqual({ mode: 'profile', profile: 'web', patches: [], args: ['--host', '127.0.0.1', '--port', '8080', '--dev'] })
    expect(parse(['--profile', 'headless', 'run', 'the', 'tests']))
      .toEqual({ mode: 'profile', profile: 'headless', patches: [], args: ['run', 'the', 'tests'] })
    // Launcher flags placed after that boundary belong to the app too.
@@ -339,6 +339,15 @@ describe.skipIf(!existsSync(dshBin))('dsh BUILT bin (node lib/bin.js, no tsx)',
      expect(web.stdout).toContain('--port <port>')
      expect(web.stdout).not.toContain('dsh web: http://')
      const wildcardHost = await runBuiltBin(['web', '--host', '0.0.0.0'], {
        DSH_HOME: home,
        DSH_TELEMETRY_DISABLED: '1',
      })
      expect(wildcardHost.code).toBe(1)
      expect(wildcardHost.stdout).toBe('')
      expect(wildcardHost.stderr).toContain('--host 0.0.0.0 is intentionally not supported yet for safety: it would expose remote code execution to the network; use 127.0.0.1 instead')
      expect(wildcardHost.stderr).not.toContain('dsh web: http://')
      const headlessHelp = await runBuiltBin(['--profile', 'headless', '--help'], {
        DSH_HOME: home,
        DSH_TELEMETRY_DISABLED: '1',
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-web-frontend",
  "description": "Web application entry: vite build over the @deepseek-ai/dsh-client-web shell library; dist/ served by apps/cli's dsh web",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,6 +1,6 @@
 {
  "name": "@deepseek-ai/dsh-root",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "license": "MIT",
  "private": true,
  "type": "module",
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-acp",
  "description": "Automation-only Agent Client Protocol server for driving DeepSeek Harness agents over JSON-RPC stdio",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-api-gateway",
  "description": "Typert Remote Host dispatcher and Client API endpoint",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-api-remotes",
  "description": "Remote BFF assembly and Host Agent/Session lookup policy",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-attachment-local",
  "description": "Private content-addressed DSH_HOME attachment storage",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-attachment",
  "description": "Durable immutable attachment storage seam for the DeepSeek Harness",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-app-boot",
  "description": "Shared boot glue for the app bins: .env loading, fail-loud Loader guards, snapshot-aware config resolution, and the Loader boot sequence",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-cmdline",
  "description": "Immutable command-line handoff from a dsh launcher to any app plugin that injects cmdlineArgs",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-base",
  "description": "The shared dsh core as a profile bundle: every profile's first patch layer, inserting the base plugin rows over the empty profile root",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-headless",
  "description": "The dsh one-shot bundle: a direct core Agent/Session runner over dsh-base with no Host, HTTP, or browser layer",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/bundle/web-app/README.md
-README.md: 3f7fbe7bbbeba2ee753ab2dfa8c945e798dd6a02
+README.md: 90d1566b5a7a25f6a827079c4a8ab776e05cc7a3
-README.zh.md: 357ca9946ed7fef1bf4c691c6666156bb293b5e0
+README.zh.md: b7156bcab66b53964bb2f0e1c87d9e9a806e3f75
@@ -2,7 +2,7 @@
 English | [中文](README.zh.md)
-The dsh browser-surface bundle. [`cordis.patch.yml`](cordis.patch.yml) rides over [`dsh-base`](../base/README.md): it sets the coding persona, inserts the Web host rows (webserver, API gateway, workspace, projection cache, storage) and the browser plugin roster, the always-on client-plugin reload chain ([`dsh-client-hmr`](../../client/hmr/README.md), idle until a rebuild watcher rewrites client bundles), and mounts this package's `web-runtime` glue plugin (config `{printUrl, surfaceContext, trustedHosts}`). That plugin resolves the built frontend dist through `@deepseek-ai/dsh-web-frontend`'s exports, samples bind-dependent LAN trust once, provides it as `webRuntime` to the browser-trust fence and client roster, mounts the [`frontend-static`](../../host/frontend-static/README.md) fallback owner, registers the harness-source and web-surface prompt sections plus the bash-visible `DSH_WEB_URL` runtime variable when `surfaceContext` is true, and prints the `dsh web:` URL line when `printUrl` is true, after its Loader tree settles so a sibling failure cannot announce a dead app. This bundle also owns the app command line: the ordinary `web-startup` provider ([`src/startup.ts`](src/startup.ts)) injects `ctx.cmdlineArgs` ([`dsh-cmdline`](../../boot/cmdline/README.md)), parses `--host`, `--port`, repeatable `--trusted-host`, and the app's `--help`, then provides `webStartup`. Flag-configured rows inject that service and read it directly from lazy config, so nothing binds a port before argument resolution and `dsh --profile web --help` starts no server. [`dsh-headless`](../headless/README.md) is a sibling surface over the same base and does not mount this bundle.
+The dsh browser-surface bundle. [`cordis.patch.yml`](cordis.patch.yml) rides over [`dsh-base`](../base/README.md): it sets the coding persona, inserts the Web host rows (webserver, API gateway, workspace, projection cache, storage) and the browser plugin roster, the always-on client-plugin reload chain ([`dsh-client-hmr`](../../client/hmr/README.md), idle until a rebuild watcher rewrites client bundles), and mounts this package's `web-runtime` glue plugin (config `{printUrl, surfaceContext, trustedHosts}`). That plugin resolves the built frontend dist through `@deepseek-ai/dsh-web-frontend`'s exports, samples bind-dependent LAN trust once, provides it as `webRuntime` to the browser-trust fence and client roster, mounts the [`frontend-static`](../../host/frontend-static/README.md) fallback owner, registers the harness-source and web-surface prompt sections plus the bash-visible `DSH_WEB_URL` runtime variable when `surfaceContext` is true, and prints the `dsh web:` URL line when `printUrl` is true, after its Loader tree settles so a sibling failure cannot announce a dead app. This bundle also owns the app command line: the ordinary `web-startup` provider ([`src/startup.ts`](src/startup.ts)) injects `ctx.cmdlineArgs` ([`dsh-cmdline`](../../boot/cmdline/README.md)), parses `--host`, `--port`, repeatable `--trusted-host`, and the app's `--help`, then provides `webStartup`. It rejects `--host 0.0.0.0` before publishing that service because the CLI intentionally does not support all-interfaces binding yet. Flag-configured rows inject the service and read it directly from lazy config, so nothing binds a port before argument resolution and `dsh --profile web --help` starts no server. [`dsh-headless`](../headless/README.md) is a sibling surface over the same base and does not mount this bundle.
 ## Model Experience
@@ -2,7 +2,7 @@
 [English](README.md) | 中文
-dsh 浏览器表层组合包。[`cordis.patch.yml`](cordis.patch.yml) 叠加在 [`dsh-base`](../base/README.md) 之上：设置 coding persona，插入 Web 宿主行（webserver、API 网关、workspace、投影缓存、存储）、浏览器插件名录与始终挂载的客户端插件重载链（[`dsh-client-hmr`](../../client/hmr/README.md)，在重建 watcher 改写客户端 bundle 之前保持空闲），并挂载本包的 `web-runtime` 粘合插件（配置为 `{printUrl, surfaceContext, trustedHosts}`）。该插件通过 `@deepseek-ai/dsh-web-frontend` 的 exports 解析已构建的前端 dist，只采样一次依赖 bind 的 LAN 信任信息并将其作为 `webRuntime` 提供给浏览器信任栅栏和客户端名录，挂载 [`frontend-static`](../../host/frontend-static/README.md) 回退席位所有者，在 `surfaceContext` 为 true 时注册 Harness 源码与 Web 表层提示词段落，以及 bash 可见的 `DSH_WEB_URL` 运行时变量，并在 `printUrl` 为 true 时等自身的 Loader 配置树结算后再打印 `dsh web:` URL 行，避免兄弟行失败时公告一个已失效的应用。本组合包还持有应用命令行：普通 `web-startup` 提供方（[`src/startup.ts`](src/startup.ts)）注入 `ctx.cmdlineArgs`（[`dsh-cmdline`](../../boot/cmdline/README.md)），解析 `--host`、`--port`、可重复的 `--trusted-host` 以及应用自己的 `--help`，再提供 `webStartup`。由 flag 配置的行会注入该服务，并在惰性配置中直接读取它，因此参数解析完成前不会有任何东西绑定端口，`dsh --profile web --help` 也不会启动服务器。[`dsh-headless`](../headless/README.md) 是同一 base 之上的同级表层，不挂载本组合包。
+dsh 浏览器表层组合包。[`cordis.patch.yml`](cordis.patch.yml) 叠加在 [`dsh-base`](../base/README.md) 之上：设置 coding persona，插入 Web 宿主行（webserver、API 网关、workspace、投影缓存、存储）、浏览器插件名录与始终挂载的客户端插件重载链（[`dsh-client-hmr`](../../client/hmr/README.md)，在重建 watcher 改写客户端 bundle 之前保持空闲），并挂载本包的 `web-runtime` 粘合插件（配置为 `{printUrl, surfaceContext, trustedHosts}`）。该插件通过 `@deepseek-ai/dsh-web-frontend` 的 exports 解析已构建的前端 dist，只采样一次依赖 bind 的 LAN 信任信息并将其作为 `webRuntime` 提供给浏览器信任栅栏和客户端名录，挂载 [`frontend-static`](../../host/frontend-static/README.md) 回退席位所有者，在 `surfaceContext` 为 true 时注册 Harness 源码与 Web 表层提示词段落，以及 bash 可见的 `DSH_WEB_URL` 运行时变量，并在 `printUrl` 为 true 时等自身的 Loader 配置树结算后再打印 `dsh web:` URL 行，避免兄弟行失败时公告一个已失效的应用。本组合包还持有应用命令行：普通 `web-startup` 提供方（[`src/startup.ts`](src/startup.ts)）注入 `ctx.cmdlineArgs`（[`dsh-cmdline`](../../boot/cmdline/README.md)），解析 `--host`、`--port`、可重复的 `--trusted-host` 以及应用自己的 `--help`，再提供 `webStartup`。它会在发布该服务前拒绝 `--host 0.0.0.0`，因为 CLI 目前有意不支持绑定所有网络接口。由 flag 配置的行会注入该服务，并在惰性配置中直接读取它，因此参数解析完成前不会有任何东西绑定端口，`dsh --profile web --help` 也不会启动服务器。[`dsh-headless`](../headless/README.md) 是同一 base 之上的同级表层，不挂载本组合包。
 ## 模型体验
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-web-app",
  "description": "The dsh browser-surface bundle: the web patch layer over dsh-base plus the runtime glue plugin (frontend dist serving, web-surface prompt, bash runtime variables, URL line)",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -45,28 +45,30 @@ function webCommand(): Command {
    .name('dsh --profile web')
    .description('Serve the DeepSeek Harness browser UI.')
    .helpOption('-h, --help', 'show this help')
-    .option('--host <host>', 'bind host; pass 0.0.0.0 to reach it from another machine')
+    .option('--host <host>', 'bind host')
    .option('--port <port>', 'listen port; pass 0 to let the OS pick a free one')
    .option('--trusted-host <authority...>', 'extra authority the /api browser-trust fence accepts (host or host:port; repeatable)')
    .addHelpText('after', `
 Examples:
  dsh --profile web                          serve on the composed host and port
  dsh --profile web --port 8080              serve on another port
  dsh --profile web --host 0.0.0.0           reach it from another machine on the LAN
 `)
 }
 /**
 * Parse and provide the Web invocation as an ordinary Cordis service. The
- * command's action publishes the flags this invocation named; a non-numeric
+ * command's action publishes the flags this invocation named; `--host 0.0.0.0`
- * `--port` is a usage error, so on rejection (and on `--help`) nothing is
+ * or a non-numeric `--port` is a usage error, so on rejection (and on `--help`)
- * provided.
+ * nothing is provided.
 * @param ctx - plugin context carrying the command line.
 */
 export function apply(ctx: Context): void {
  const program = webCommand()
  program.action(() => {
    const options = program.opts<WebOptions>()
    if (options.host === '0.0.0.0') {
      program.error('error: --host 0.0.0.0 is intentionally not supported yet for safety: it would expose remote code execution to the network; use 127.0.0.1 instead')
    }
    if (options.port !== undefined && !/^\d+$/.test(options.port)) {
      program.error(`error: --port must be a number, got ${JSON.stringify(options.port)}`)
    }
@@ -88,13 +88,13 @@ export const apply = ctx => globalThis.__webStartupApply(ctx)
 describe('web command-line provider', () => {
  it('publishes each flag and releases direct service expressions', async () => {
    const { values, observed } = await bootProvider([
-      '--host', '0.0.0.0',
+      '--host', '127.0.0.1',
      '--port', '8080',
      '--trusted-host', 'lab.internal', 'lab-2.internal',
      '--trusted-host', '10.0.0.9',
    ])
    expect(values).toEqual({
-      host: '0.0.0.0',
+      host: '127.0.0.1',
      port: 8080,
      trustedHosts: ['lab.internal', 'lab-2.internal', '10.0.0.9'],
    })
@@ -128,4 +128,12 @@ describe('web command-line provider', () => {
    expect(observed.readerConfig).toBeUndefined()
    expect(observed.exits).toEqual([1])
  })
  it('rejects the intentionally unsupported all-interfaces host before the consumer activates', async () => {
    const { values, observed } = await bootProvider(['--host', '0.0.0.0'])
    expect(observed.out).toContain('--host 0.0.0.0 is intentionally not supported yet for safety: it would expose remote code execution to the network; use 127.0.0.1 instead')
    expect(values).toBeUndefined()
    expect(observed.readerConfig).toBeUndefined()
    expect(observed.exits).toEqual([1])
  })
 })
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/client/connection/README.md
-README.md: 3315552dd0400697d5a96639598c5f5bb2bb4f5b
+README.md: f0a707cc5f3a962c7852f7323c727d0a39a57b10
-README.zh.md: 0dc251f1e5410bd0d74ef450c6d8df3dc9cdab81
+README.zh.md: b529eebf9af93e36b6b92c19964678b7f5a04ea1
@@ -6,7 +6,7 @@ Wire consumer layer: the client plugin's apply mounts `ctx.connection` (shared a
 ## /api browser-trust fence
-The node half guards every entry under `/api` before bridging or upgrading (`src/api-request-trust.ts`). Every request — browser-marked or not — must present a `Host` that is a loopback authority or matches a `trustedHosts` entry: exact on `host:port` entries, any port on port-less entries, both sides compared through WHATWG normalization (DNS-rebinding defense). There is deliberately no shortcut for unmarked HTTP requests: over plain HTTP a browser attaches neither `Origin` nor Fetch-Metadata to image and navigation reads, so an unmarked request may still be a rebound browser read with a readable response, and Host is the one header rebinding cannot forge; a browser WebSocket handshake carries `Origin` and passes the same comparison. Non-browser clients pass the same fence via loopback, the CLI-derived LAN IP literals, or a declared authority. When markers are present, an attached `Origin` must equal the Host authority, and an explicit `sec-fetch-site: cross-site` marker is refused. A `trustedHosts` entry that is not a bare, canonical `host[:port]` authority — one WHATWG parsing reads back exactly as written — fails the plugin load loudly: parsing would otherwise quietly authorize the hostname inside `harness.internal/path`, or broaden a dangling-colon or zero-padded port to an any-port grant. HTTP failures answer plain 403 before any RPC dispatch; upgrade failures reject the handshake before any event stream starts. A non-loopback (`--host 0.0.0.0`) deployment therefore needs its serving authorities trusted: the dsh CLI derives the machine's LAN IP literals itself and its `--trusted-host` flag declares named ones, so `trustedHosts` in cordis.yml is for compositions the CLI does not boot. The fence is a reachability policy, not authentication; the Web carrier provides no authentication layer. Decision record: [the api browser-trust boundary Agent Note](../../../.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.md).
+The node half guards every entry under `/api` before bridging or upgrading (`src/api-request-trust.ts`). Every request — browser-marked or not — must present a `Host` that is a loopback authority or matches a `trustedHosts` entry: exact on `host:port` entries, any port on port-less entries, both sides compared through WHATWG normalization (DNS-rebinding defense). There is deliberately no shortcut for unmarked HTTP requests: over plain HTTP a browser attaches neither `Origin` nor Fetch-Metadata to image and navigation reads, so an unmarked request may still be a rebound browser read with a readable response, and Host is the one header rebinding cannot forge; a browser WebSocket handshake carries `Origin` and passes the same comparison. Non-browser clients pass the same fence via loopback, deployment-derived LAN IP literals, or a declared authority. When markers are present, an attached `Origin` must equal the Host authority, and an explicit `sec-fetch-site: cross-site` marker is refused. A `trustedHosts` entry that is not a bare, canonical `host[:port]` authority — one WHATWG parsing reads back exactly as written — fails the plugin load loudly: parsing would otherwise quietly authorize the hostname inside `harness.internal/path`, or broaden a dangling-colon or zero-padded port to an any-port grant. HTTP failures answer plain 403 before any RPC dispatch; upgrade failures reject the handshake before any event stream starts. Non-loopback compositions must trust their serving authorities explicitly: the Web runtime derives LAN IP literals from an all-interfaces server config, while `trustedHosts` in cordis.yml and the CLI's `--trusted-host` flag declare named authorities. `dsh web --host 0.0.0.0` is intentionally unsupported until remote access has an authentication layer. The fence is a reachability policy, not authentication; the Web carrier provides no authentication layer. Decision record: [the api browser-trust boundary Agent Note](../../../.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.md).
 ## `/api` WebSocket downlinks
@@ -6,7 +6,7 @@
 ## /api 浏览器信任栅栏
-node 半侧在桥接或 upgrade 前守卫 `/api` 下的每个入口（`src/api-request-trust.ts`）。每个请求——无论是否带浏览器标记——`Host` 都必须是回环地址权威，或与某个 `trustedHosts` 条目匹配：带端口的 `host:port` 条目精确匹配，不带端口的条目匹配任意端口，两侧均经 WHATWG 归一化后比较（DNS rebinding 防御）。刻意不为无浏览器标记的 HTTP 请求开捷径：明文 HTTP 下浏览器的图片与导航读取既不带 `Origin` 也不带 Fetch-Metadata，因此无标记请求仍可能是被重绑页面发起的、响应可被读走的读取，而 Host 是重绑唯一伪造不了的请求头；WebSocket 浏览器握手会带 `Origin` 并通过同一道比较。非浏览器客户端经由回环地址、CLI（命令行界面）推导的 LAN IP 字面量或已声明的权威通过同一道栅栏。当标记存在时，如附带 `Origin`，则它必须与 Host 权威完全一致；显式的 `sec-fetch-site: cross-site` 标记一律拒绝。不是纯的、规范形 `host[:port]` 权威的 `trustedHosts` 条目——即 WHATWG 解析读回后与原文不完全一致的——会让插件加载明确报错：否则解析会悄悄授权 `harness.internal/path` 这类笔误里的 hostname，或把悬空冒号、补零端口放大成任意端口授权。HTTP 失败在任何 RPC 分发之前以纯 403 应答，upgrade 失败在启动任何事件流前拒绝握手。因此非回环（`--host 0.0.0.0`）部署需要让自己的服务权威被信任：dsh CLI 会自行推导本机的 LAN IP 字面量，其 `--trusted-host` flag 用于声明具名权威，所以 cordis.yml 中的 `trustedHosts` 面向 CLI 不参与引导的组合。这道栅栏是可达性策略，而不是认证；Web 载体不提供认证层。决策记录：[api 浏览器信任边界 Agent Note](../../../.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.md)。
+node 半侧在桥接或 upgrade 前守卫 `/api` 下的每个入口（`src/api-request-trust.ts`）。每个请求——无论是否带浏览器标记——`Host` 都必须是回环地址权威，或与某个 `trustedHosts` 条目匹配：带端口的 `host:port` 条目精确匹配，不带端口的条目匹配任意端口，两侧均经 WHATWG 归一化后比较（DNS rebinding 防御）。刻意不为无浏览器标记的 HTTP 请求开捷径：明文 HTTP 下浏览器的图片与导航读取既不带 `Origin` 也不带 Fetch-Metadata，因此无标记请求仍可能是被重绑页面发起的、响应可被读走的读取，而 Host 是重绑唯一伪造不了的请求头；WebSocket 浏览器握手会带 `Origin` 并通过同一道比较。非浏览器客户端经由回环地址、部署推导的 LAN IP 字面量或已声明的权威通过同一道栅栏。当标记存在时，如附带 `Origin`，则它必须与 Host 权威完全一致；显式的 `sec-fetch-site: cross-site` 标记一律拒绝。不是纯的、规范形 `host[:port]` 权威的 `trustedHosts` 条目——即 WHATWG 解析读回后与原文不完全一致的——会让插件加载明确报错：否则解析会悄悄授权 `harness.internal/path` 这类笔误里的 hostname，或把悬空冒号、补零端口放大成任意端口授权。HTTP 失败在任何 RPC 分发之前以纯 403 应答，upgrade 失败在启动任何事件流前拒绝握手。非回环组合必须显式信任其服务权威：Web 运行时从全接口服务器配置推导 LAN IP 字面量，cordis.yml 中的 `trustedHosts` 与 CLI（命令行界面）的 `--trusted-host` flag 则声明具名权威。`dsh web --host 0.0.0.0` 在远程访问具备认证层之前有意不受支持。这道栅栏是可达性策略，而不是认证；Web 载体不提供认证层。决策记录：[api 浏览器信任边界 Agent Note](../../../.agents/notes/implemented/architecture/2026-07-28-api-browser-trust-boundary.md)。
 ## `/api` WebSocket 下行
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-client-connection",
  "description": "Wire consumer layer: HTTP-up/WebSocket-down client, ConnectionController dual streams with reconnect, and fixture api",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -7,8 +7,8 @@
 * nor Fetch-Metadata to reads (images and navigations — those
 * headers go only to trustworthy destinations), so an unmarked request may
 * still be a rebound browser read and Host is the one header rebinding cannot
- * forge. Non-browser and remote clients pass the same fence via loopback, the
+ * forge. Non-browser and remote clients pass the same fence via loopback,
- * CLI-derived LAN IP literals, or a declared `trustedHosts` authority.
+ * deployment-derived LAN IP literals, or a declared `trustedHosts` authority.
 * Network reachability and authentication stay out of scope: binding policy
 * belongs to the webserver config, and this fence is not an auth layer.
 */
@@ -199,8 +199,8 @@ describe('connection node half', () => {
    const loopback = fakeResponse()
    await routes[0]!.handler(fakeRequest({ host: '127.0.0.1:3080' }), loopback.response)
    expect(loopback.state.status).toBe(404)
-    // LAN authority declared as a port-less IP literal — the shape the CLI
+    // An all-interfaces composition derives port-less LAN IP literals, which
-    // derives for `--host 0.0.0.0` — passes markerless curl on any port.
+    // pass markerless curl on any port.
    const lan = fakeResponse()
    await routes[0]!.handler(fakeRequest({ host: '192.168.1.5:3080' }), lan.response)
    expect(lan.state.status).toBe(404)
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-client-hmr",
  "description": "Dev-only hot-reload driver for script-loaded client entries: SSE rebuilt frames → invalidate/prefetch → fiber swap through the vendored Loader entry",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-client-locale",
  "description": "Locale plugin: Host-backed zh/en preference, browser-derived fallback, locale snapshots, and typed namespace dictionaries",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-client-modules",
  "description": "Client module system, dual-face: node half composes the __DSH_BOOT__ entry graph (incremental dsh.client scan, bundle route, index tap, webPlugins service); browser half is the lazy-CJS module table the vendored cordis Loader consumes as its internal seam",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-client-runtime",
  "description": "Client core services: SlotRegistry, SessionRuntime (scope tree + object layer)",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-client-schema-form",
  "description": "Schema/draft model layer for settings editors: rehydrates a serialized schemastery schema, validates drafts, and edits them immutably by path",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-client-ui-agent-preset",
  "description": "Agent-preset surfaces: the default for later sessions, this session's seat, and the composition editor",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-client-ui-attachment",
  "description": "Pure React attachment atoms for the dsh web UI: draft-image rail, message image gallery, and original-image lightbox (zero cordis)",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-client-ui-commands",
  "description": "Client command surface: global directory cache, '/' source, three command UI kinds, popupSelect registry",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-client-ui-conversation",
  "description": "Conversation domain: skeleton, ordered chat flow, composer with the Host-backed busy-Enter preference, and details host",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-client-ui-deliverables",
  "description": "Produced-files turn tail and clickable final-response file references for Web",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-client-ui-directory-picker-browse",
  "description": "In-app directory browsing surface: the workspace directory-flow owner rendering the host's listing and creation primitives",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-client-ui-directory-picker-native",
  "description": "Native directory-picker surface: the renderless workspace directory-flow occupant driving the host's OS chooser",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-client-ui-goal",
  "description": "Session goal surface: GoalBar docked above the composer, read from the goal session projection",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-client-ui-input-trigger",
  "description": "Input trigger pipeline: '/' and '@' detection, candidate menu, pick routing to registered sources",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-client-ui-jobs",
  "description": "Session-header background-job list: live registry state mirrored from session/jobs frames",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "type": "module",
  "main": "lib/index.js",
  "types": "lib/types/index.d.ts",
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-client-ui-layout",
  "description": "Shell plugin: three-column AppFrame with drag handles, ctx.layout viewing-state service (navigation + panels)",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-client-ui-message-feedback",
  "description": "Per-message feedback controls contributed to the assistant-message action strip, backed by the messageFeedback Host Remote",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-client-ui-model-selection",
  "description": "Model selection: the /model popupSelect over session.models / session.selectModel",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-client-ui-permission-presets",
  "description": "Permission surfaces: a new-session default in General settings and a current-session /permission popup over the permissions projection",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-client-ui-plan",
  "description": "Plan-mode composer control: the conversation.input.plan seat over the plan projection and the /plan command channel",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-client-ui-primitives",
  "description": "Pure React atoms for the dsh web UI: controls, icons, markdown, and JSON inspectors (zero cordis)",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-client-ui-settings-general",
  "description": "Settings ownerless-copy and product onboarding plugin: the General section, shell trigger/header chrome content, settings dictionaries, and the versioned welcome notice",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-client-ui-settings-models",
  "description": "Models settings and shared product-onboarding dialogs over existing settings and credential joins",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-client-ui-settings-plugin-inventory",
  "description": "Read-only Cordis Loader inventory tab in Web Plugins settings",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-client-ui-settings-plugins",
  "description": "Plugins settings section with feature-owned tabs and configurable host-plane plugin cards",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-client-ui-settings",
  "description": "Settings domain base plugin: the settings-namespace scope service and the canonical settings slot-type contract",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-client-ui-sidebar",
  "description": "Sidebar plugin: session multi-level tree, search, grouping, state dots",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-client-ui-skill",
  "description": "Web skill references and the dedicated skill tool row",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-client-ui-slots",
  "description": "Slot registry pure core: SlotMap declaration merging, single register composition API, four-share props types, store-seat types, renderer install seam",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-client-ui-subagent",
  "description": "Subagent conversation catalog, continuation routing UI, and '@' reference source",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-client-ui-theme",
  "description": "Theme plugin: Host bootstrap for the pre-plugin palette; DOM-free ThemeRuntime for light/dark/system state; --dsw-* token styles and Appearance settings row",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-client-ui-tool",
  "description": "Client Tool call-tree renderer and keyed per-tool presentation slot",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-client-ui-trajectory",
  "description": "Trajectory event ledger with an interactive timing overview: pure-consumer plugin registering into the conversation ViewMap (no service)",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-client-ui-user-questions",
  "description": "Web ask_user_question feature: host tool mount plus composer-takeover question UI",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-client-ui-workflow-run",
  "description": "Durable workflow-run Conversation Node and nested member disclosure for dsh web",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-client-ui-workspace",
  "description": "Workspace picker plugin: one WorkspacePicker registered into the sidebar and empty-state workspace slots",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-client-web-react",
  "description": "Shell-side React glue: createSlotRenderer, SessionProvider, bindSnapshotSelector (uSES bridge), useInvoke",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-client-web",
  "description": "Web shell kernel: bootWebShell (module system holding + seed table + two-stage boot + AppRoot gate + app-shell assembly entry), consumed by the apps/web vite entry",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-code-runtime-worker-thread",
  "description": "Worker-thread implementation of the DeepSeek Harness code-execution seam",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-code-runtime",
  "description": "Abstract code-execution seam (ctx.codeRuntime) for the DeepSeek Harness",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-command-compact",
  "description": "Human-facing slash command for explicit session compaction",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-compaction-basic",
  "description": "Token-meter-driven compaction policy and LLM summarization backend for the DeepSeek Harness",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-compaction-tool-result-pruner",
  "description": "Replay-safe model-free head/middle/tail pruning for tool-result surface nodes",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-compaction",
  "description": "Abstract compaction service seam (ctx.compaction) for the DeepSeek Harness",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-agent-instructions",
  "description": "Workspace context loader for AGENTS.md/CLAUDE.md instruction files",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-session-reference",
  "description": "Cross-session snapshot references and durable untrusted model context (ctx.sessionReferenceResolver)",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-time-context",
  "description": "Opt-in durable per-step context with the current time and elapsed time",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-tmux-context",
  "description": "Opt-in durable per-step context with this agent's tmux pane and window location",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-agent-default-model",
  "description": "Default model selection shared by Agent entry points",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-agent-loop",
  "description": "The concrete agent loop plugin for the DeepSeek Harness",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-agent-tool-presentation",
  "description": "Agent-plane presentation selector: composes one agent's tools as Code Mode, native, or both",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-agent",
  "description": "Agent interface, registry, initiator scope, and event vocabulary for the DeepSeek Harness",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-scope",
  "description": "Scoped-context registration primitive (scope tags, scope-filtered event dispatch) for the DeepSeek Harness",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-session",
  "description": "Event-sourced session store for the DeepSeek Harness",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-system-prompt",
  "description": "System prompt assembly registry for the DeepSeek Harness",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-tools",
  "description": "Tool registry and execution pipeline for the DeepSeek Harness",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-credentials-local",
  "description": "File-backed credentials provider ($DSH_HOME/.env under the live process environment) for the DeepSeek Harness",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-credentials",
  "description": "Abstract credential seam (ctx.credentials): settings carry references to secrets, providers own the values",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-e2b",
  "description": "Shared E2B sandbox lifecycle for DeepSeek Harness provider adapters",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-fs-e2b",
  "description": "E2B filesystem implementation for DeepSeek Harness",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-subprocess-e2b",
  "description": "E2B subprocess implementation for DeepSeek Harness",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-acp-demo",
  "description": "ACP automation server app: agent spine + JSONL persistence + ACP transport, with a JSON-RPC stdio bin",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-agent-spine-demo",
  "description": "The default executor-less/UI-less agent spine with fallback session titles, provider-routed retry, and optional persisted goals",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-sdk-jsonrpc-demo",
  "description": "Bin that boots an external Cordis config for the stdio JSON-RPC SDK runtime",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-cordis-client-runner",
  "description": "Browser half of dynamic dual-half plugin packages: event subscription, closure evaluation, guard facade, and loader entries",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-cordis-host-runner",
  "description": "Dynamic package definition registry, host-half sandbox lifecycle, and invoke handler table for model-mounted dual-half packages",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-tool-cordis",
  "description": "Self-referential cordis toolset: inspect the live runtime, mount and dispose model-written plugins",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-client-ui-cordis",
  "description": "Cordis dynamic-plugin definition card: the keyed cordis_define tool row with its run/stop switch",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-command-feedback",
  "description": "Log-only session feedback producer and human-facing slash command",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-message-feedback",
  "description": "Lifecycle-bound per-message rating and note sidecar for the DeepSeek Harness",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
@@ -1,7 +1,7 @@
 {
  "name": "@deepseek-ai/dsh-fs-local",
  "description": "Local-filesystem implementation of the DeepSeek Harness filesystem seam (ctx.fs)",
-  "version": "0.0.1-rc.5",
+  "version": "0.1.0-rc.1",
  "publishConfig": {
    "access": "restricted"
  },
--- a/Show More
+++ b/Show More