zhu1090093659/dsh-web v0.4.13

dsh-web v0.4.13

on GitHub

This release delivers core architectural upgrades and new capabilities: the remote access path (remote-bridge) takes over the full network ingress infrastructure with a hardened ingress gate, while the aggregate package officially retires the legacy browser mirror remote-web-ui; the task board introduces team collaboration powered by the standalone Go self-hosted hub team-hub and adds card attachments for images and files; the browser view introduces a real-browser CDP mode; and official plugin page display metadata and built-in plugin grouping are established. The four satellite repositories align to 0.4.13, with the skin center isolating CSS safety transforms in short-lived workers to eliminate plugin installation failures on Windows.

The remote ingress stack moves into remote-bridge, and the aggregate retires remote-web-ui: All network ingress infrastructure (relay registry, cloudflared tunnels, Durable Object connectors, LAN forwarding and firewall controls) converges into packages/dsh-remote-bridge. A loopback-only ingress gateway (ingress-gate) strictly restricts the external attack surface to the /ios/v1 protocol. The aggregate @linxin666/dsh-web-all removes remote-web-ui, with existing profiles smoothly supported via tombstone exports and retiredPlugins registration without launcher interruptions; relay identity and device states keep their historical paths so paired devices remain paired.
Task board team collaboration and the Go standalone service team-hub: Introduces multi-host team collaboration via @linxin666/dsh-task-board-team and the standalone Go service team-hub (SQLite storage, in-memory replay and real-time WebSocket channels, zero external dependencies). The task board extension contract adds optional followUp and rework capabilities, supporting human or Agent assignees, GitHub OAuth login and admin email bootstrap, Host Token node claims with leases, question routing and workspace claim gates.
Task board card attachments and credential isolation: The task board schema upgrades to v7, supporting image and file card attachments. The ledger stores metadata and sha256 digests only—never raw bytes—with bytes validated through official attachment storage (ctx.attachments). Model pickers now display the model provider name, and provider integration credentials stay off the public board wire.
Browser view gains real-browser CDP mode: dsh-browser-view adds an explicit opt-in mode connecting directly to an external Chrome/Edge CDP endpoint (http://127.0.0.1:9222), allowing page inspection and screencasting using real profile logins without altering the default isolated browser mode.
Plugin page display metadata and built-in plugin group: All family packages supply official locale/<lang>.json display metadata (bilingual Chinese/English, with Russian where applicable), rendering localized display titles in the aggregate; the official Plugins page gains a built-in plugin group and an update toolbar; five retired plugin shells are fully removed.
The four satellite repositories align to 0.4.13: All four satellites publish first and align to 0.4.13. The skin center (dsh-skins, 66ec9f1) isolates CSS safety transforms inside short-lived worker processes, resolving Windows plugin install failures caused by native addons; pet (dsh-pet, 9ccb048), community plugin index (dsh-community-plugins, 3b0673d) and preset center (dsh-presets, 92c3154) carry no functional changes and align their version numbers.

Upgrade Notes

• Update Task False Alarms Fixed in 0.4.13: plugin-manager no longer reports a non-zero exit code caused by pnpm 11's build script gate (ERR_PNPM_IGNORED_BUILDS) as a failure; previously this condition was reported as an update failure even though installation had already taken effect. Fixed in this release to align status reporting with actual installation results.

• Remote Access Path Changes: The browser pairing path is retired from the aggregate along with remote-web-ui, and mobile devices connect via remote-bridge's /ios/v1 protocol; if @linxin666/dsh-remote-web-ui was previously installed standalone, it must be uninstalled after upgrading (otherwise it will contend with bridge for the same relay identity and lease). Paired mobile devices do not need to re-pair.

• Two Behavioral Changes: The "Built-in Plugins" section in Settings is taken offline by default by the aggregate (disabling this plugin restores it); the task board wire no longer transmits provider integration credential fields.

• Manual Migration for 0.3.x: There is no Doctor pre-launch migration; the legacy package @linxin666/dsh-web-ui-all is frozen at 0.3.6 and deprecated, and its gateway does not serve under the current runtime (rc.5), making automatic GUI migration impossible. Follow these three executable steps:

  1. dsh plugin remove @linxin666/dsh-web-ui-all
  2. dsh plugin add @linxin666/dsh-web-all@0.4.13
  3. In-place replace the legacy name with the new name @linxin666/dsh-web-all in dsh.profile.bundles (the official CLI only writes dependencies, not bundles; omitting the third step results in skipping profile bundle).

  If migration is interrupted halfway (the profile ends up with empty dependencies while bundles still references the legacy package name), do not run dsh plugin install as prompted (which reinstalls the deprecated 0.3.6); redo the three steps above instead.

• Platform Verification Notice: This release was tested and verified on macOS; Linux and Windows remain unverified. Specific unverified areas comprise: the newly added loopback listener (ingress-gate), new permission bits for $DSH_HOME/remote-bridge/model-efforts.json (directory 0700 / file 0600), and path resolution in task-board-team (including Windows drive letters and ~, read-only).

• Retired Plugin Families Notice: Residual exports for the five families doctor / desktop-launcher / dsh-perf / describe-image / model-capabilities have been cleared; they were already unmounted in 0.4.12, with no loss of functionality; residual lines will be logged as failed import but do not affect host startup.

New Features

• [remote-bridge] Take over the ingress stack and retire remote-web-ui from the aggregate
• [task-board] Add card attachments
• [team-hub] Name members by a mention handle a comment can @
• [team-hub] Bootstrap the first admin by email through the account service
• [team-hub] Invite members by email through the account service
• [team-hub] Expose account_user_id on the member wire shape
• [team-hub] Add the Go self-hosted runtime as a static binary
• [team-hub] Add self-hosted Node runtime
• [plugin-manager] List built-in plugins on the official Plugins page
• [team-hub] Sign members in with account service assertions
• [remote-bridge] Deliver push notifications through the hosted relay
• [remote-bridge] Carry the relay token in the device roster
• [team-hub] Bootstrap the first team and its first admin
• [plugins] Localize plugin page display metadata and remove retired families
• [browser-view] Add real-browser CDP mode
• [remote-bridge] Remember each model's reasoning effort
• [team-hub] Enforce the A4 host contract
• [task-board] Forward execution targets from an extension task draft
• [task-board-team] Add the team-hub provider extension package
• [team-hub] Add the agent roster and reshape questions and activity
• [team-hub] Add the issue state machine, leases, questions, comments, inbox and router
• [team-hub] Add GitHub login, session and host tokens, membership and APNs
• [team-hub] Add the D1 schema, core modules and the team channel
• [task-board] Add optional follow-up and rework provider capabilities

Bug Fixes

• [remote-bridge] Hand the pairing QR a socket URL, not the origin's own scheme
• [remote-bridge] Seat the pairing trigger on the footer's trailing edge
• [market] Support isolated skin CSS transform
• [task-board] Show model provider in pickers
• [team-hub] Read the APNs p8 key through its escaped newlines
• [team-hub] Unify the session key environment name
• [task-board] Keep provider integration credentials off the board wire
• [remote-bridge] Carry the card dismissal across the relay push
• [task-board-team] Claim issues only with a run workspace bound
• [remote-bridge] Drop only the level judged stale, and only a really stale one
• [remote-bridge] Keep readable effort rows and withhold stale levels
• [task-board-team] Probe client services instead of reading them
• [git-graph] Stop the hero chip placement feedback loop (#1972)
• [task-board-team] Keep an owed settlement through a token fix and reconnect like the hub
• [task-board-team] Never claim a card whose settlement is still owed, and match the hub gates
• [task-board-team] Stop retrying a settlement the hub answered as expired
• [task-board-team] Claim a rework through one flight and retry refused settlements
• [team-hub] Mint a new attempt on every fresh claim
• [team-hub] Skip a clashing agent name instead of failing the registration
• [team-hub] Name the host quota test after its limit and list the invite status codes
• [task-board-team] Present the Host Token in the channel upgrade header
• [task-board-team] Conform to the frozen wire samples
• [task-board-team] Pin the member preset through the draft and wait for the hub

Other Changes

• Present remote access as the phone app, not the retired browser path
• [market] Sync assets with pinned inputs
• [satellites] Pin skin CSS worker fix
• [team-hub] Align bootstrap contract, docs, and notes with email lookup
• [team-hub] Retire the Worker and Node implementations, keep the Go hub
• [archive] Replace cross-repo relative links with plain text references
• [archive] Fix assertion jwks endpoint and tighten env matrix
• [archive] Add self-hosted services deployment handoff document
• [task-board] Record team collaboration delivery summary
• Remove empty file
• [remote-bridge,task-board-remote] Meet test-standards BDD rules in two specs
• [task-board-remote] Pin the mirror card's team payload on the wire
• [notes] Record the relay delivery road
• [remote-bridge] Cover the relay road
• [notes] Migrate team collaboration note to implemented and record deployment facts
• [task-board-team] Accept the hub-side bootstrap contract sample
• [archive] Hand off the deployed team hub
• [team-hub] Serve the hub on its workers.dev hostname
• [team-hub] Point the deployment at the created D1 database
• [team-hub] Deploy with cf instead of wrangler
• [team-hub] Deploy through cf instead of wrangler
• [market] Sync assets with pinned inputs
• [sync-shared] Account for browser settings card copies
• [task-board-team] Make ledger path assertion platform aware
• [archive] Add the git-graph hero chip verification image (#1972)
• [task-board-team] List which settlement refusals stay retryable
• [task-board-team] Name the lapsed-lease claim test after what it exercises
• [task-board-team] Describe an expired settlement as final
• [task-board-team] Name the sample the comment-thread comparison reads
• [task-board-team] State the claim, reconnect and settlement behaviour
• [team-hub] State who mints the attempt and how a name clash registers
• [team-hub] Compare every contract sample element and every event
• [team-hub] Point at the one status code the spec text still contradicts
• [team-hub] Record the A4 decisions and the text still to sync
• [team-hub] Settle the host contract, socket auth and token units
• [team-hub] Publish the host contract samples
• Run team-hub typecheck and tests in a path-filtered lane
• [task-board] Record the task draft execution targets
• [team-hub] Fold implementation decisions into the protocol
• [task-board-team] Register the package and add its Russian copy
• [team-hub] Define agent list and question and activity wire shapes
• [team-hub] Record deployment inputs and the protocol deviations
• [team-hub] Scaffold the standalone Workers project
• [team-hub] Add identity, inbox, question and activity reads
• [task-board] List follow-up and rework in the package contract rules
• [task-board] Record follow-up and rework in the extension contract note
• [team-hub] Claim before rework
• [team-hub] Close protocol review gaps
• [team-hub] Add team-hub protocol specification v1
• [notes] Propose task board team collaboration extension
• [plugin-manager] Make the migration map name its one writer
• [readme] Sync contributor list from GitHub API

Generated automatically by the release pipeline (scripts/release-notes.mjs).