本次发布包含 13 项新功能、23 项修复、17 项其他改动。
新功能
- [remote-web-ui] 设备在线时，通过宠物自身可见开关隐藏宠物
- [remote-web-ui] 以无 Cookie 方式交付已配对的应用壳——/pair-app 落地页
- [remote-web-ui] 隐藏不适配移动端的插件界面，加强 lan-bind 与文档
- 在社区插件索引中新增 dsh-free-search（排名 44，基于最新 dev）（#1249）
- [task-board] 新增续接卡片与交接包（#1152）
- [dsh-usage] 新增使用统计插件，并与宠物公告联动
- [task-board] 领卡执行污点包裹与来源审计——冻结卡指令强制来源声明、发起方会话入账本可追溯（工单#6）
- [task-board] 交接包与权限人工确认门——高于会话默认的绑定待确认才可执行，cron 拒绝调度待确认卡片（工单#5）
- [task-board] 续接卡片数据面——create/update 冻结快照过 T2 安全门、v3 账本持久化、看板可见可搜可归档（工单#4）
- [task-board] 账本 schema v3 迁移机制——v2 加载无损迁移写回、失败显式报错保留原文件
- [task-board] 新增冻结请求解析器与脱敏污点安全门（工单#3）
- 新增脚本将预览版 SDK cohort tarball 物化并规范化，用于本地 workspace 覆盖
- [community-plugins] 在社区索引注册 dsh-passwords（#1224）
修复
- [dsh-task-board] 在不注入 remote.agentPresets 的 cohort 上探测 agent-preset roster 且不抛错
- [remote-web-ui] 让防火墙摘要显式以后端为来源
- [skin-center] 壁纸下保留侧栏与详情面板的玻璃背景
- [remote-web-ui] 紧凑模型选择器、对话区不再裁切、抑制 workbench、带校验的鲸鱼开关
- [remote-web-ui] 手机端承受临时性远程启动失败
- [pet] 将精灵外观传送到插件根内，移动端抑制才能真正隐藏它
- [remote-web-ui] 在移动端远程界面保持宠物隐藏
- [remote-web-ui] 将网关流复用经由门控通道，并在手机镜像上保留宠物
- [remote-web-ui] 在启动 patch 中惰性读取无 Cookie 的设备凭据
- [market] 增强对 scoped 包已安装插件检测
- [dsh-usage] 校正官方路由 id，播报高峰/低谷消费，保持宠物气泡连续
- [remote-web-ui] 在窗口期内保持配对链接可复用，避免移动端上下文切分
- [remote-web-ui] 当预取消耗了令牌时恢复配对流程
- [remote-web-ui] 用说明页替代配对失败的重定向死路
- [dsh-usage] 提供商/模型区间图表、套餐页签筛选、Codex 订阅适配器
- [remote-web-ui] 将快速隧道固定到 http2——fake-ip TUN 代理后 QUIC 会卡死
- [remote-web-ui] 恢复远程通道数据路径，并按评审加强 lan-bind
- [dsh-usage] 按评审加固账本、探测与服务生命周期
- [dsh-desktop-launcher] 从桌面快捷方式稳定启动浏览器
- [task-board] 封死 import 确认门绕过与来源声明定界串伪造（审查 C1/H1）
- [perf] 在 session-persistence-jsonl patch 行保留 required 根
- 修复构建、服务、渲染与皮肤的一批核心 bug
- [scripts] 在缺少 better-session 构建产物时跳过其核心测试
其他改动
- [notes] 记录市场 turnstile 密钥配对故障与修复
- [archive] 官方 ui-model-selection「selecting」卡死的交接补丁
- [notes] 记录防火墙解封运行与排名 45 奖励
- [deps] 刷新本地 SDK cohort 的 lockfile 完整性
- [readme] 将移动端远程截图刷新为适配后的官方 UI
- [readme] 从 GitHub API 同步贡献者列表
- [dsh-usage] 通过 prepare 发布、typecheck 测试、在 CI 中门禁共享拷贝
- [dsh-usage] 覆盖宿主半边、公告契约与宠物 TTL
- [remote-web-ui] 为移动端适配官方 UI，移除独立 /m 界面（wip）
- [notes] 记录 free-search 合并与四项注册裁决维护运行
- [dsh-usage] 声明 0.1.2-alpha.1 DSH cohort 要求
- [notes] 记录 dsh-usage 的独立 npm 发布
- [readme] 从 GitHub API 同步贡献者列表
- [notes] 记录 passwords 合并与 free-search 批准维护运行
- [notes] 记录未构建 better-session 产物时跳过脚本测试
- [readme] 将 DSH 兼容徽章升级到 alpha.1 cohort
- [release] 在发布技能中记录暂停的 npm 发布通道
English
This release contains 13 new features, 23 bug fixes, 17 other changes.
New Features
- [remote-web-ui] hide the pet through its own visibility switch while a device is online
- [remote-web-ui] deliver the paired app shell cookieless — the /pair-app landing
- [remote-web-ui] hide mobile-unsuitable plugin surfaces, lan-bind hardening, docs
- add dsh-free-search to the community plugin index (rank 44, based on latest dev) (#1249)
- [task-board] add continuation cards and handover packages (#1152)
- [dsh-usage] add the usage statistics plugin with pet announcement linkage
- [task-board] taint-wrap claim execution and source audit — frozen-card instructions require a source declaration, and the originating session is traceable in the ledger (work item #6)
- [task-board] handover package and manual permission confirmation gate — bindings above the session default run only after confirmation, and cron refuses to schedule unconfirmed cards (work item #5)
- [task-board] continuation-card data plane — create/update frozen snapshots pass the T2 security gate, persist into the v3 ledger, and are visible/searchable/archivable on the board (work item #4)
- [task-board] ledger schema v3 migration — lossless v2 upgrade with write-back, explicit failure that leaves the original file untouched
- [task-board] new frozen-request parser with a redacting taint security gate (work item #3)
- add a script to materialize and normalize preview SDK cohort tarballs for local workspace overrides
- [community-plugins] register dsh-passwords in the community index (#1224)
Bug Fixes
- [dsh-task-board] probe the agent-preset roster without throwing on cohorts that do not inject remote.agentPresets
- [remote-web-ui] make the firewall summary take the backend explicitly
- [skin-center] preserve the glass backdrop for sidebar and details panels under wallpaper
- [remote-web-ui] compact model picker, clip-free conversation, workbench suppression, verified whale toggle
- [remote-web-ui] survive transient remote boot failures on the phone surface
- [pet] portal the sprite chrome into the plugin root so the mobile suppressor really hides it
- [remote-web-ui] keep the pet hidden on the mobile remote surface
- [remote-web-ui] route the gateway stream mux through the gated channel and keep the pet on the phone mirror
- [remote-web-ui] read the cookieless device credential lazily in the boot patch
- [market] enhance installed-plugin detection for scoped packages
- [dsh-usage] reconcile the official-route id, announce peak/off-peak spend, keep the pet bubble continuous
- [remote-web-ui] keep the pair link re-usable within its window for mobile context splits
- [remote-web-ui] recover the pair flow when a prefetch consumed the token
- [remote-web-ui] replace the failed-pair redirect dead end with an explanation page
- [dsh-usage] provider/model range chart, plan-tab filter, Codex subscription adapter
- [remote-web-ui] pin the quick tunnel to http2 — QUIC wedges behind fake-ip TUN proxies
- [remote-web-ui] restore the remote channel data path and harden lan-bind from the review round
- [dsh-usage] harden ledger, probes, and lifecycle per review
- [dsh-desktop-launcher] reliably launch the browser from the desktop shortcut
- [task-board] seal the import confirmation-gate bypass and source-declaration delimiter forgery (review C1/H1)
- [perf] keep the required root in the session-persistence-jsonl patch row
- resolve a batch of core bugs across build, service, rendering, and skins
- [scripts] skip the better-session core tests without their build artifact
Other Changes
- [notes] record the market turnstile secret-pairing outage and repair
- [archive] handoff patch for the official ui-model-selection "selecting" lockup
- [notes] record the firewall-unblock run and the rank-45 award
- [deps] refresh lockfile integrity for the local SDK cohort
- [readme] refresh the mobile remote screenshots to the adapted official UI
- [readme] sync the contributor list from the GitHub API
- [dsh-usage] publish via prepare, typecheck tests, gate shared copies in CI
- [dsh-usage] cover the host half, announce contract, and pet TTL
- [remote-web-ui] adapt the official UI for mobile, drop the standalone /m surface (wip)
- [notes] record the free-search merge and four-registration verdicts maintenance run
- [dsh-usage] state the 0.1.2-alpha.1 DSH cohort requirement
- [notes] record the standalone npm publish of dsh-usage
- [readme] sync the contributor list from the GitHub API
- [notes] record the passwords merge and free-search approval maintenance run
- [notes] record the script-test skip for the unbuilt better-session artifact
- [readme] bump the DSH compatibility badge to the alpha.1 cohort
- [release] record the paused npm publish lane in the release skill
Generated automatically by the release pipeline (scripts/release-notes.mjs).
由发布管线自动生成（scripts/release-notes.mjs）。