zhu1090093659/dsh-web v0.4.8

dsh-web v0.4.8

on GitHub

This release mounts the aggregate's family rows on their real packages so the compat layer no longer ships with the aggregate and its client bundle drops from 2.9 MB to 22 KB, makes the remote bridge a row of the aggregate and keeps extending protocol v1 with forking, incremental roster and board answers, frame compression, background jobs and subagent threads, adds dsh-task-board-remote to put the task board on the remote surface, ships a family-wide telemetry switch, gives the skill center filtering, folding and importing, adds a daily token cap and a settled-execution record to the task board, brings opt-in per-host SSH agent forwarding, and marks the DeepSeek peak and off-peak clock on the usage card. The plugin manager closes three boundaries of the update path in this version: the stale row-name repair, the layer order of a replaced bundle, and telling "cannot verify" apart from "DSH too low".

Only one entry point really migrates: updating through the plugin manager (including the legacy aggregate-name migration branch) preflights, asserts the resulting version and can roll back, and it is the only path with all three. This release still has no Doctor pre-launch migration — the doctor package is only a tombstone today and the launcher consumer legacy-migration.ts refers to does not exist here — and starting the host with a direct dsh web performs no install and no preflight, so an old profile stays exactly as it is. Update through the plugin manager, or run dsh plugin --profile <name> add @linxin666/dsh-web-all@0.4.8 by hand. The dsh-update family plugin is the fourth path: it moves versions and verifies the result, but it has no backup, no preflight, no rollback and it does not repair row names.
The row-name rewrite happens on its own at startup: the 0.4.8 family rows mount under their real package names (for example @linxin666/dsh-client-ui-task-board instead of @linxin666/dsh-web-all/task-board). A profile row still carrying the old name is skipped whole for that boot, so the disabled and config the user saved stop applying — a plugin they had switched off can mount again. The plugin manager rewrites the name 1.5 s after the boot settles, and the same repair runs inside the update job; it backs the file up to cordis.patch.yml.bak-plugin-manager first, writes only on a real difference, and repeats safely. Whether a running host re-reads the file is not guaranteed, so restart once to complete the repair; nothing on disk is lost and no second row appears.
Residual warning: the plugin manager prunes the retired web-ui-model-capabilities override automatically only when the profile's bundle declarations resolve; a CLI-created profile lists @deepseek-ai/dsh-base and @deepseek-ai/dsh-web-app in dsh.profile.bundles without installing them, so the check answers unknown and the prune deletes nothing. Such a profile therefore keeps that override row on every upgrade route, a plugin-manager update included: the composition itself stays correct, and the only symptom is the repeated patch: entry "web-ui-model-capabilities" not found line on each dsh --dump-config and in CLI logs. To do it by hand: back the file up, then edit $DSH_HOME/profiles/<profile>/cordis.patch.yml and remove the entry whose id is web-ui-model-capabilities.
@linxin666/dsh-client-ui-model-capabilities stays retired with no replacement package: a custom model's input types and reasoning levels are edited on the official Models settings page. Its cordis row no longer fails the composition, it mounts nothing; the retired-plugin roster is generated from aggregate.yml's retiredPlugins: section (generated in this version instead of hand-written), the matching specifiers are skipped before loading, and the inventory shows a "Removed ..." line for each.
The remote bridge is now a row of the aggregate (web-ui-remote-bridge): a profile that finds the aggregate already carries a protocol v1 listener after the upgrade, listening on /ios/v1, plus a pairing-token endpoint on /remote-bridge/pair/token admitted only from this machine, with no separate install needed. It is single-instance against a standalone @linxin666/dsh-remote-bridge (mountOnce), so the routes are never registered twice.
The fault unit got bigger: now that family rows mount their real packages, a family plugin that fails to import or start is no longer contained as one degraded row by the fault-isolation shell; it rolls the whole loader group back. That is a deliberate trade (see the decision record for issue #1901), and the boot-audit behaviour the host owns is unchanged.
pnpm supply-chain limit: a pnpm configuration that enables minimumReleaseAge (24 hours by common default) holds an update that runs soon after publication. The remedy is minimumReleaseAgeExclude for @linxin666/* in the profile's pnpm-workspace.yaml.
The satellite ranges move in the same batch: the four satellite repositories publish 0.4.8 first, and only once the registry resolves them does the aggregate's dependency range move from ^0.4.7 to ^0.4.8:

• Skin center (dsh-skins): @linxin666/dsh-client-ui-skin-center@0.4.8
• Pet (dsh-pet): @linxin666/dsh-pet@0.4.8
• Community plugin index (dsh-community-plugins): @linxin666/dsh-client-ui-community-plugins@0.4.8
• Preset center (dsh-presets): @linxin666/dsh-client-ui-preset-center@0.4.8

New Features

• [remote-bridge] A generic protocol extension seam: a mounted plugin can answer methods outside KNOWN_METHODS once the client declares the capability that plugin requires
• [remote-bridge] A question request publishes the host deadline as expiresAt
• [remote-bridge] session.fork lands with the session.fork.v1 capability, so a phone can fork a new session from an existing one
• [remote-bridge] An agent channel covering preset enumeration and session creation
• [remote-bridge] Incremental roster and board answers: session.list and board.snapshot answer a reset or a delta against a since token
• [remote-bridge] Archived sessions stay out of the roster
• [remote-bridge] A reconnect is answered with only what it missed instead of the whole baseline again
• [remote-bridge] A session's durable history pages back to its first entry
• [remote-bridge] Host frames ship compressed behind frame.deflate.v1
• [remote-bridge] A slimmer roster payload behind session.list.compact.v1
• [remote-bridge] Background jobs ride the protocol: a client may call jobs.list and receives jobs.changed
• [remote-bridge] Message deltas carry their actors, and a subagent thread arrives as its own delta
• [remote-bridge] The session roster, history and prompting reach a paired phone over protocol v1, pairing by a one-shot token plus a P-256 challenge-response (the channel 0.4.7 opened, completed with the capabilities above)
• [remote-bridge] The bridge package ships the family icon and locale display metadata, so its row has its own title and description in the plugin inventory
• [task-board-remote] New dsh-task-board-remote package: binds the task board's capability face to the bridge's extension seam, so a paired phone reads the same ledger (snapshot, acceptance options, idempotent actions and revision events) through the host's own gates
• [task-board] The board's read/write face is exposed to in-process consumers
• [task-board] A card can carry a daily token cap, off by default
• [task-board] A settled execution records what it left behind
• [skill-explorer] The skill center filters, folds and imports skills
• [ssh] Opt-in per-host SSH agent forwarding (#1851)
• [usage] The usage card marks the DeepSeek peak and off-peak clock in red and green
• [web-settings] A family-wide telemetry switch, stored in localStorage under dsh-web-ui-telemetry-opt-out
• [web-settings] The telemetry switch renders through the family card chrome
• [web-all] Each family row appears in the plugin inventory under its own title and description

Bug Fixes

• [plugin-manager] A profile row whose package name went stale is repaired: it reads the old value, proves the live name the installed bundle declares, writes only on a real difference, and backs the file up first
• [plugin-manager] The update prune no longer removes a row override that is still mounted
• [plugin-manager] The update gate tells "cannot verify" apart from "DSH too low" instead of treating an unverifiable target as incompatible (#1903)
• [plugin-manager] The declared dsh range is evaluated the way the host gate evaluates it
• [plugin-manager] A replaced bundle keeps its layer order instead of moving to the end through remove-then-install (#1905)
• [plugin-manager] The host stops killing itself when the desktop shell guarantees no restart
• [remote-bridge] A board base is dropped when its capability is withdrawn
• [remote-bridge] Unsettled approvals are replayed to the declaring connection
• [remote-bridge] A subagent thread's catalog entry and its spawn are tied together in the baseline
• [remote-bridge] A peer that stops answering its liveness ping is closed
• [remote-web-ui] A forwarded request is no longer treated as loopback (#1906)
• [remote-web-ui] The bind is pinned to an address the installed host accepts (#1893)
• [remote-web-ui] The next start reaps the tunnel child a crashed host left behind
• [dsh-update] The release-age override uses pnpm's kebab-case key, so pnpm 12 no longer ignores it (#1897)
• [win-bash] Tool output is rendered without terminal escapes
• [git-graph] The branch chip seats before the row options group, inside the leading chip group
• [git-graph] The branch chip mounts only on the composer input dock
• [task-board] An action kind this build does not implement is refused
• [market] market/dist stays byte-exact so the deploy lane matches the pins

Other Changes

• [perf] Aggregate family rows mount their real packages, so the compat layer stops inlining every client (lib/client.js shrinks from 2.9 MB to 22 KB) (#1901)
• [refactor] The retired-plugin roster is generated from aggregate.yml instead of hand-written, so it cannot drift from the manifest
• [refactor] The git-graph branch chip mounts by composer dock
• [refactor] The bridge joins the family aggregate behind a single-instance mount guard
• [market] Follow the satellites' merges in the skin, pet, community-plugin and preset pins
• [satellites] Move the four satellites' gitlinks to their 0.4.8 release commits
• [libs] Rebuild the aggregate bundles and refresh the recorded fingerprints
• [test] Pin the bridge extension-seam suite naming, the catalog entry sequence and the board suite count
• [test] Assert the aggregate's shell metadata content instead of its existence
• [test] Cover the usage card's weekend and holiday off-peak marker
• [test] Skip the process-table tunnel cases where they cannot run
• [test] Record the test-standards ratchet-down baseline
• [docs] Record the 0.4.8 auto-upgrade audit, the protocol v1 session fork and thread anchors, the aggregate decision, and why market/dist skips newline normalization; sync the bridge README
• [ci] Fold main and the feature branches into dev, keeping the history readable