Harniverse Plugin Inventory
September 5, 2026 ยท View on GitHub
This document records the exact DeepSeek Harness plugin baseline imported by Harniverse and the downstream plugin changes made on top of it. It distinguishes npm package inventory, Cordis plugin roles, capability seams, and shipped composition changes; package count alone does not describe the architecture.
Comparison Baseline
| Item | Value |
|---|---|
| DeepSeek Harness commit | 47f943859bef60e4160492346772ded9b24f765a |
| Harniverse import commit | 440d2ae5a426613bd14c4c601a90f79e4b01c149 |
| Shared tree | f904efab9ef435201d6ba4da88a34d6366568272 |
| Current Harniverse commit at document creation | 795f93ba8409686add70978d86b56a4e9b6caae0 |
Official packages/*/* package count | 219 |
The two baseline commits have the same Git tree. All downstream statements therefore describe 440d2ae5a4..HEAD without upstream-version ambiguity. The official inventory below covers first-party packages under packages/*/*; vendored Cordis packages are framework dependencies, while apps/* are launchers and assembled application hosts.
Workspace workbench implementation tracking: 9a74618b20; real-browser interaction hardening: f986355714; navigation, preview, and glob integration: 6fdf45691a; session-control work-status response baseline: fd4a04a42cc08ca07ccb09143ffdc2870b3cad5f; native macOS shell and Intel runtime coverage: 97a196e925; native macOS process-path portability: bcc4186fb5; native macOS resource-bound portability: 71befd15fe; native Windows lease-cleanup contention: 277be8ca8a; global compaction controls: 5a794a57bd; client-aborted HTTP request handling: 2b8ee0cc0f.
Official Plugin Inventory
The inventory is grouped by package directory. Every listed package is an official first-party workspace package at the baseline tree; a package may expose a Service Definition, Service Provider, Consumer, bundle, UI plugin, support plugin, or more than one tightly coupled role.
| Group | Count | Packages |
|---|---|---|
acp | 1 | acp |
api | 2 | gateway, remotes |
attachment | 2 | attachment, attachment-local |
boot | 2 | app-boot, cmdline |
bundle | 3 | base, headless, web-app |
client | 39 | connection, hmr, locale, modules, runtime, schema-form, ui-agent-preset, ui-attachment, ui-commands, ui-conversation, ui-deliverables, ui-directory-picker-browse, ui-directory-picker-native, ui-goal, ui-input-trigger, ui-jobs, ui-layout, ui-message-feedback, ui-model-selection, ui-permission-presets, ui-plan, ui-primitives, ui-settings, ui-settings-general, ui-settings-models, ui-settings-plugin-inventory, ui-settings-plugins, ui-sidebar, ui-skill, ui-slots, ui-subagent, ui-theme, ui-tool, ui-trajectory, ui-user-questions, ui-workflow-run, ui-workspace, web, web-react |
code-runtime | 2 | code-runtime, code-runtime-worker-thread |
compaction | 4 | command-compact, compaction, compaction-basic, compaction-tool-result-pruner |
context | 4 | agent-instructions, session-reference, time-context, tmux-context |
core | 10 | agent, agent-default-model, agent-loop, agent-tool-presentation, model-policy, model-policy-fallback, scope, session, system-prompt, tools |
credentials | 2 | credentials, credentials-local |
e2b | 3 | e2b, fs-e2b, subprocess-e2b |
examples | 3 | acp-demo, agent-spine-demo, jsonrpc-demo |
extensions | 4 | cordis-client-runner, cordis-host-runner, tool-cordis, ui-cordis |
feedback | 2 | command-feedback, message-feedback |
fs | 7 | fs, fs-local, fs-observation-policy, fs-sandbox, tool-fs, tool-fs-search, tool-str-replace-editor |
goal | 4 | command-goal, goal, goal-round-driver, tool-goal |
guard | 2 | repeat-tool-reminder, timeout-policy |
hooks | 3 | hook-protocol, hooks-claude-code, hooks-codex |
host | 8 | apiproxy, directory-picker, directory-picker-auto, directory-picker-browse, directory-picker-native, frontend-static, plugin-inventory, webserver |
identity | 1 | anonymous-user-id |
interaction | 5 | commands, permission-presets, tool-ask-user, user-approval, user-questions |
jobs | 3 | jobs, jobs-local, tool-jobs |
llm | 5 | llm, llm-deepseek, llm-pi-ai, llm-retry, token-meter |
lsp | 3 | lsp, lsp-stdio, tool-lsp |
mcp | 1 | mcp-client |
plan | 1 | plan-mode |
preset | 2 | agent-presets, persona |
runtime-diagnostics | 1 | invariants |
sandbox | 4 | sandbox, sandbox-local, sandbox-policy, sandbox-windows-acl |
schedule | 1 | schedule |
sdk | 3 | client, protocol, server |
session-query | 4 | session-log-export, session-query, session-query-sqlite, tool-session-query |
session | 13 | session-checkpoint-policy, session-persistence, session-persistence-jsonl, session-persistence-sqlite, session-projection, session-projection-cache, session-stats, session-telemetry, session-telemetry-otel, session-title, session-title-all-prompts-llm, session-title-first-prompt-llm, session-title-llm |
settings | 2 | settings, settings-file |
shell | 9 | bash-local, bash-sandbox, pwsh-local, pwsh-sandbox, shell, shell-env, tool-bash, tool-bash-persistent, tool-pwsh |
skill | 4 | skill, skill-badge, skill-filesystem, tool-skill |
spill | 3 | spill, spill-local, spill-policy |
storage | 4 | storage, storage-domain, storage-json, storage-sqlite |
subagent | 11 | subagent, subagent-acp, subagent-claude-code, subagent-codex, subagent-dsh-sdk, subagent-fork-in-process, subagent-in-process-driver, subagent-spawn-in-process, tool-subagent, tool-subagent-control, tool-subagent-report |
subprocess | 2 | subprocess, subprocess-local |
terminal | 3 | terminal, terminal-bash, tool-terminal |
test-support | 6 | acp-snapshot, agent-loop-testkit, client-runtime, llm-mock-server, llm-replay, loader-smoke |
todo | 1 | tool-todo |
typert | 4 | generator, loader, protocol, registry |
util | 7 | atomic-write, brand, home-paths, launch-environment, native-command, output-retention, timeout |
web | 6 | tool-web, web, web-fetch-http, web-search-deepseek, web-search-exa, web-search-perplexity |
workflow | 4 | tool-ralph, tool-workflow, workflow, workflow-worker-thread |
workspace | 1 | workspace |
Harniverse Capability Changes
Harniverse groups downstream package manifests by complete capability family rather than presenting each package as an independent capability.
| Capability | Service Definition | Service Provider | Consumer | Current downstream status |
|---|---|---|---|---|
| Per-session supervision mode | dsh-supervision (new; durable mode owner and model-context Consumer) | dsh-supervision | dsh-user-questions, dsh-user-approval, dsh-plan-mode, dsh-agent-presets, dsh-subagent, dsh-client-ui-conversation | Complete independent session policy; supervised preserves human questions, approval, and plan review, while unsupervised fails new human-dependent requests before provider/pending state, prevents non-plan entry, and allows existing plans to exit autonomously. Profile and Child Profile selection pins the mode in durable Session events at publication/delegation boundaries. |
| Session Model Profiles and Routes | dsh-model-policy (new; settings, durable Profile snapshots, and target authorization) | dsh-model-policy, dsh-model-policy-fallback (new; ordered cross-model recovery) | dsh-host-apiproxy, dsh-client-ui-model-selection, dsh-client-ui-settings-models, dsh-compaction-basic, dsh-session-title-llm | Implemented in the current worktree; Profile snapshots preserve existing Session permissions, model/Route/Profile API mutations are server-authorized, and fallback transitions are durable. Tracking SHA is pending the explicitly deferred local commit. |
| Inbound authentication and authorization | dsh-authentication (new) | dsh-authentication-local (new) | dsh-client-connection (official, modified), dsh-auth-app (new management bundle), dsh-sdk-client (official, modified) | Complete seam; public-key Grants produce short credentials bounded by Grant deadlines, browser sessions renew through device possession at half-life and on lifecycle recovery, human-readable enrollment is bounded, loss of the final owner seals every business transport, declared Host/Origin trust precedes authentication, endpoint metadata defaults unknown operations to deny, and concurrent admissions share durable registry and audit I/O without merging per-request decisions or records. |
| Outbound notification | dsh-notification (new; Definition + coordinator Consumer) | dsh-notification-http (new) | Coordinator folded into dsh-notification | Complete opt-in seam following the official session-telemetry pattern. |
| Durable result artifacts | dsh-spill (official, modified) | dsh-spill-local (official, modified) | dsh-tool-result-artifacts (new), dsh-spill-policy | Complete seam; one Consumer owns retention, recovery marker, failure semantics, and artifact_read. |
| Recallable and model-directed compaction | dsh-compaction (official, modified) plus dsh-compaction-lossless summary-DAG service (new) | dsh-compaction-lossless (new; inherits the official basic Provider transaction) | dsh-command-compact (official, modified), dsh-tool-compaction (new), dsh-tool-compaction-history (new) | Complete shipped seam; automatic, human-requested, and direct model-requested compaction share the Provider transaction and committed checkpoints over the canonical Session log. The root-only dsh-compaction-settings plugin owns one live global pressure-threshold override while exact model policy and Profile-scoped Provider ownership remain intact; bounded current-session tools search summaries and expand parent/source history. |
| Read-only plugin diagnostics | dsh-plugin-diagnostics (new) | dsh-plugin-diagnostics-cordis (new) | dsh-host-plugin-inventory, dsh-api-remotes, dsh-client-ui-settings-plugin-inventory (official, modified) | Complete shipped advisory seam; effect-scoped checks observe Host Loader, standing preset, and dynamic Cordis lifecycle state, while the authorized Remote and existing Settings tab expose structured findings and textual hints without a repair operation. |
| Read-only workspace inspection | dsh-api-remotes and dsh-workspace (modified) | dsh-host-apiproxy (modified) | dsh-client-connection, dsh-client-runtime, dsh-client-ui-layout, dsh-client-ui-slots, dsh-client-ui-workspace (modified) | Complete read-only seam; authenticated bounded file, search, binary-preview, and Git RPCs feed a root-scoped per-Workspace Workbench whose browser-memory content state shares one mutually exclusive right region with Session details. Files, Changes, and Search are top-level peer tabs with Search third; include/exclude glob filters compile once at the Host boundary and travel through the typed Client/runtime wire. The non-modal desktop preview occupies only the conversation track through shell.overlay, while the responsive modal drawer switches the same preview surface into the whole right panel. POSIX file and Git reads bind to validated descriptors, Git rejects work-tree or metadata escapes, and both placements preserve keyboard and accessibility boundaries. |
| LLM wire-attempt diagnostics | dsh-llm and dsh-session (modified) | dsh-llm-deepseek, dsh-llm-pi-ai (modified) | dsh-agent-loop (modified) | Complete session-indexed transport record; each adapter attempt records compact protocol/request fingerprints, status, diagnostic headers, timing, and normalized failures while the append-only Session log remains the sole owner of conversation content. |
| Agent Profile plugin composition | dsh-capabilities (new; recipe/member catalog, typed override store, conflict-checked planner) | dsh-agent-presets (official, modified; static recipe/config compiler and generation runtime), dsh-host-capability-management (new; authorized Remote) | dsh-tools, dsh-skill, dsh-mcp-client, dsh-mcp-user-config (new), dsh-client-ui-settings-capabilities (new) | Complete composition seam for Tool, Skill, MCP-server, and Subagent-provider recipes; catalog reads mount no Profile, global/Profile selection, immutable-member allowlist, and owner-declared configuration inheritance drive native Loader patches and registry restrictions, hard dependencies auto-load, running Sessions stay pinned, and each live Session exposes its immutable generation and resolved members. Standard, Code, and Cordis load user MCP consumers by default while Minimal omits them. Global defaults do not union Profile-native rows, Code Mode is opt-in, and run_code is exposed as a selectable member. Two selected recipes claiming one member name are refused as a plan blocker, and an already-stored conflict compiles with the opted-in row owning the name so the generation still mounts. |
| User Hook compatibility | dsh-hook-protocol (official, modified) | dsh-hooks-claude-code, dsh-hooks-codex (official, modified) | Standard, Code, and Cordis Profile compositions | Complete generic discovery path; dialect bridges remain available for explicit opt-in, but are disabled in every shipped composition and remain absent from Minimal by default. When enabled, they load per-event immutable snapshots from user/project/plugin/policy sources and honor disabled entries. |
| Parent-private Child Profiles | dsh-subagent (official, modified; resolved profile contract, parent-private registry, durable descriptor snapshot, fallback routes, priority gate, and unified sync/async Invocation entry) | dsh-subagent-in-process-driver, dsh-subagent-dsh-sdk (official, modified; native/SDK workspace, route, Tool, Skill/MCP setup) | dsh-tool-subagent and dsh-tool-subagent-control (official, modified; optional define/list, child_profile_id delegation, and bounded authorized child-history reads) | Active seam: Host-resolved profiles carry only opaque harness/model-route/capability references, reject requests outside the parent grant, enforce descendant workspace paths and profile-bounded Tool filters, resolve primary routes with ordered failure fallback, gate lower-priority child steps behind active higher-priority children, persist immutable revision/digest snapshots, and cross the SDK initialize handshake. The service returns one Invocation vocabulary for synchronous result waits and asynchronous durable child turns; native results render a child Session id, inspection accepts both modes, and later-turn delivery accepts continuable asynchronous children. Ordinary Host list/search/increment surfaces and the all-session mux baseline exclude child Sessions; parent-only descendant catalog/history remains the trace surface, including live workflow-member navigation through catalog-derived direct-parent addresses. Loaded catalogs project child metadata into keyed Client state for authorized descendant aggregation without adding child ids to the ordinary list. An authorized subagent.prompt adds only the matching authenticated principal's mux streams to that addressed child, with prefix replay closing the cold-to-live event gap. Hidden child Sessions are deleted child-first with their cold parent, while ordinary fork descendants retain the explicit deletion refusal. Shipped Web standard, Code, and Cordis Agent presets bind Profile management and expose the current parent grant beside its private in-memory revisions. |
Added Packages
| Package | Role | Default composition |
|---|---|---|
@deepseek-ai/dsh-authentication | Inbound authentication Service Definition | Type/service dependency; the concrete Web row loads its Provider. |
@deepseek-ai/dsh-authentication-local | Local public-key Grant, challenge, Access Token, and browser-session Service Provider | Enabled by dsh-web-app. |
@deepseek-ai/dsh-auth-app | One-shot authentication management bundle and Consumer | Shipped as the standalone auth profile; dsh auth is its alias. |
@deepseek-ai/dsh-notification | Notification Service Definition plus lifecycle projection Consumer | Not mounted alone. |
@deepseek-ai/dsh-notification-http | Durable HTTP/HTTPS notification Service Provider | Opt-in examples only. |
@deepseek-ai/dsh-tool-result-artifacts | Finalized-result retention and model-facing retrieval Consumer | Enabled in base/headless scopes and per-agent Web presets. |
@deepseek-ai/dsh-compaction-lossless | Automatic compaction Provider plus committed summary-DAG projection | Enabled in base, the standalone headless example, and the standard, code, and Cordis presets. |
@deepseek-ai/dsh-compaction-settings | Root-owned live compaction Settings namespace for an optional global pressure threshold | Enabled by dsh-base; registers no compaction service and leaves Profile thresholds intact while unset. |
@deepseek-ai/dsh-tool-compaction | Direct model-facing Consumer for one retained-tail compaction request | Enabled beside dsh-compaction-lossless in base, standalone headless, standard, and Cordis; omitted by minimal and Code presets. |
@deepseek-ai/dsh-tool-compaction-history | Bounded current-session summary search and expansion Consumer | Enabled beside dsh-compaction-lossless; omitted by the minimal preset. The headless overflow snapshot pins its model-visible names and safety guidance. |
@deepseek-ai/dsh-plugin-diagnostics | Effect-scoped read-only diagnostic registry and report coordinator | Enabled by dsh-web-app before diagnostic Providers and the Host Remote. |
@deepseek-ai/dsh-plugin-diagnostics-cordis | Host Loader, standing preset, and dynamic Cordis diagnostic Provider | Enabled by dsh-web-app; contributes observations only and owns no repair operation. |
@deepseek-ai/dsh-capabilities | Scoped recipe registry, inherited Agent composition, dependency planner, and generation selection coordinator | Enabled by dsh-base; registers no model-facing capability by itself. |
@deepseek-ai/dsh-host-capability-management | Static Profile-recipe and Host-provider adapters plus authorized catalog/plan/apply/Session Remote | Enabled by dsh-web-app; observation requires harniverse.observe, mutation requires harniverse.administer. |
@deepseek-ai/dsh-mcp-user-config | Settings-owned multi-server MCP Provider/Consumer bridge | Provider enabled by dsh-base; scoped consumers enabled by the Standard, Code, and Cordis Profiles; Minimal omits the consumer. |
@deepseek-ai/dsh-supervision | Durable per-session supervision mode Service and model-context/UI projection | Enabled by dsh-base; Profile and Child Profile metadata select the initial mode. |
@deepseek-ai/dsh-model-policy | Independent Model Profile/Route settings service, Session snapshots, and concrete-target authorization | Enabled by dsh-base; built-in unrestricted covers legacy Sessions. |
@deepseek-ai/dsh-model-policy-fallback | Session-aware ordered cross-model fallback executor | Enabled by dsh-base; same-model retry remains owned by dsh-llm-retry. |
@deepseek-ai/dsh-client-ui-settings-capabilities | Global/Profile assembly editor, plan preview, and read-only Session capability view | Enabled by dsh-web-app as a Plugins Settings tab and conversation view. |
@deepseek-ai/dsh-client-ui-reference | Web file/session @ candidate Consumer | Enabled by dsh-web-app. |
@deepseek-ai/dsh-code-runtime-python | Fresh-process CPython CodeRuntime Provider | Opt-in; no shipped Profile selects it. |
@deepseek-ai/dsh-file-reference | Bounded path-discovery Definition and Remote export | Enabled by dsh-web-app through the local Provider. |
@deepseek-ai/dsh-file-reference-local | Local workspace-indexing file-reference Provider | Enabled by dsh-web-app. |
@deepseek-ai/dsh-session-delivery | Provider-neutral session create/message/unload Definition | Enabled by dsh-base through the local Provider. |
@deepseek-ai/dsh-session-delivery-local | Local ordinary/direct-child session-delivery Provider | Enabled by dsh-base. |
@deepseek-ai/dsh-tool-session-delivery | Model-facing session create/message/unload Consumer | Enabled by dsh-base; shipped Standard, Code, and Cordis Profiles expose its tools. |
@deepseek-ai/dsh-tool-pwsh-persistent | Persistent PowerShell tool Consumer over the Terminal service | Opt-in examples only; no shipped base/Profile composition. |
@deepseek-ai/dsh-web-search-tavily | Tavily Search provider for ctx.web | Mounted by dsh-base; model-facing tools remain disabled there by default. |
@deepseek-ai/dsh-web-search-brave | Brave Search provider for ctx.web | Mounted by dsh-base; model-facing tools remain disabled there by default. |
@deepseek-ai/dsh-web-search-kagi | Kagi Search provider for ctx.web | Mounted by dsh-base; model-facing tools remain disabled there by default. |
@deepseek-ai/dsh-web-firecrawl | Firecrawl aggregate Search/Scrape provider for ctx.web | Mounted by dsh-base; model-facing tools remain disabled there by default. |
Modified Official Plugin Families
| Area | Official packages changed by Harniverse |
|---|---|
| Model and Web defaults | dsh-base, dsh-web, dsh-web-fetch-http, dsh-web-firecrawl, dsh-web-search-brave, dsh-web-search-deepseek, dsh-web-search-exa, dsh-web-search-kagi, dsh-web-search-perplexity, dsh-web-search-tavily, dsh-client-ui-settings-models, dsh-client-ui-settings-plugins |
| Session control and reconnect | dsh-agent, dsh-agent-loop, dsh-session, dsh-host-apiproxy, dsh-client-connection, dsh-client-runtime, dsh-session-persistence, dsh-session-persistence-jsonl, dsh-session-persistence-sqlite, dsh-session-projection-cache, dsh-workspace |
| Agent Profile identity and composition | dsh-agent-presets, dsh-host-apiproxy, dsh-permission-presets, dsh-client-runtime, dsh-client-ui-agent-preset, session persistence/query Providers, and in-process subagent composition |
| Result retention and bounded file access | dsh-tools, dsh-spill, dsh-spill-local, dsh-spill-policy, dsh-tool-fs, dsh-tool-fs-search, dsh-tool-str-replace-editor, dsh-client-ui-tool, dsh-compaction, dsh-token-meter |
| Compaction composition, proactive trigger, and recall | dsh-compaction, dsh-compaction-basic, dsh-command-compact, dsh-base, dsh-web-app, dsh-host-apiproxy, dsh-client-ui-settings-plugins, and the standalone headless example; standard and Cordis Agent presets select both model Consumers, Code keeps automatic compaction and recall without the direct-only trigger, and Minimal selects only the internal Provider/summary-DAG projection. Request pressure snapshots exact-model/global/Profile threshold priority before capacity lookup, reserves output capacity before provider dispatch, retries reduced output caps before forced compaction, and manual compaction waits for active agent turns to settle. The global command remains cold-discoverable while execution and teardown follow the invoking Profile's scoped Provider. Auxiliary summary calls project matching Provider usage onto the selected prefix and bound output by policy, conversation cap, model output capability, configured request default, remaining context, and a safety reserve. |
| Authenticated Web and automation surface | dsh-web-app, dsh-client-connection, dsh-client-modules, dsh-client-hmr, dsh-client-web, dsh-host-webserver, dsh-host-frontend-static, dsh-sdk-client, dsh-api-gateway, dsh-typert-protocol, dsh-typert-generator, dsh-typert-loader, dsh-typert-registry; the browser shell renews short sessions at half-life, retries transient exchange failures across Cookie expiry, wakes on focus/visibility/network recovery, and admits ordinary authenticated pages only with a renewable device key or explicit loopback bypass. |
| Workspace inspection transport and UI | dsh-host-apiproxy, dsh-api-remotes, dsh-client-connection, dsh-client-runtime, dsh-client-ui-conversation, dsh-client-ui-layout, dsh-client-ui-slots, dsh-client-ui-workspace, dsh-test-support-client-runtime |
| DeepSeek provider-local multimodal requests | dsh-attachment, dsh-attachment-local, dsh-llm-deepseek |
| Derived runtime catalogs | dsh-cordis-client-runner, dsh-tool-cordis |
| Test support projection | dsh-acp-snapshot normalization only |
| Local process confinement | dsh-sandbox-local, dsh-bash-sandbox |
| Platform-native shell defaults and runtime packaging | dsh-shell, dsh-bash-local, dsh-bash-sandbox, dsh-terminal-bash, dsh-tool-bash-persistent, and Python runtime packaging scripts |
| Plugin operations and diagnostics | dsh-host-plugin-inventory, dsh-api-remotes, dsh-client-ui-settings-plugin-inventory, dsh-web-app |
| Agent Profile capability composition | dsh-agent-presets, dsh-tools, dsh-mcp-client, dsh-cordis-host-runner, dsh-tool-cordis, dsh-api-remotes, dsh-web-app |
| Supervision policy and Profile selection | dsh-supervision, dsh-agent-presets, dsh-host-apiproxy, dsh-subagent, dsh-user-questions, dsh-user-approval, dsh-plan-mode, dsh-client-ui-conversation |
| User extension defaults and Hook bridges | dsh-hooks-claude-code, dsh-hooks-codex, dsh-hook-protocol, dsh-mcp-user-config, dsh-mcp-client, dsh-web-fetch-http, dsh-web-firecrawl |
| Parent-private Child Profile foundation | dsh-subagent, dsh-subagent-in-process-driver, dsh-subagent-dsh-sdk, dsh-tool-subagent, dsh-tool-subagent-control, dsh-client-ui-trajectory |
| Shared workspace storage compatibility | dsh-storage, dsh-storage-domain, dsh-storage-json, dsh-storage-sqlite, dsh-workspace |
Shipped Composition Changes
| Composition surface | Current Harniverse change |
|---|---|
| Vendored Cordis namespace | Vendored framework packages publish under the @deepseek-ai scope, and harness module specifiers use those names. Stable product and protocol identifiers remain independent: the cordis Agent Profile id, cordis/* events, diagnostics ids, and translation keys are not npm subpaths. The rescope gate preserves those distinctions while requiring every actual package reference to use the downstream namespace. |
dsh-base model adapters | Native dsh-llm-deepseek remains installed but defaults disabled; official dsh-llm-pi-ai is the enabled vendor-neutral adapter. |
dsh-base Web providers | DeepSeek, Exa, Perplexity, Tavily, Brave, and Kagi provide search; Firecrawl provides aggregate Search/Scrape; HTTP provides fetch. Search and fetch defaults are live settings-backed and explicit operation provider ids never fall back. |
dsh-base model Web tools | dsh-tool-web remains loaded with both search and fetch disabled by default. |
dsh-base result policy | Legacy dsh-spill-policy and dsh-compaction-tool-result-pruner rows default disabled; dsh-tool-result-artifacts handles finalized-result retention and artifact_read. |
dsh-base compaction | dsh-compaction-lossless replaces the official basic row while inheriting its automatic transaction policy; dsh-tool-compaction exposes one direct retained-tail request and dsh-tool-compaction-history exposes bounded recall. The base owns the global /compact registration and root compaction Settings namespace; command execution resolves the scoped Provider selected by each Profile, and the Web Plugins page exposes the live global threshold as an integer percentage. Web moves the Provider and history Consumer behind standard, code, and Cordis Agent presets, moves the direct-only Consumer behind standard and Cordis, and gives Minimal only the hidden Provider/summary-DAG projection. Shipped compaction summaries use a 32,768-token cap and expose transient reasoning/summary progress to the authorized Web UI without adding progress records to Session history. |
dsh-base user MCP settings | dsh-mcp-user-config owns the mcp settings namespace once. Standard, Code, and Cordis mount scoped consumers that actively load and disclose enabled user servers; disabled entries create no child client or model tool, and Minimal mounts no consumer. |
| Standard-family Hook defaults | Standard, Code, and Cordis keep both dialect bridges available but disabled by default. Explicitly enabled rows discover global and dialect-specific project Hook files per session event, merge configured layers, apply disabled entries, and refresh on the next event; Minimal mounts neither bridge. |
| Standard-family Web tools | Standard, Code, and Cordis explicitly enable web_search and hardened web_fetch. The local HTTP Provider rejects non-public DNS/literal targets and redirects using direct pinned transport; Firecrawl fetch remains opt-in, while the base host Web tool layer remains disabled. |
| Standalone headless example | The runnable headless composition selects the same lossless Provider, proactive Consumer, and history Consumer; its keyless overflow snapshot verifies committed replacement plus model-visible recall tools and untrusted-history guidance. |
dsh-web-app authentication | dsh-authentication-local initializes before WebServer bind; connection injects the provider-neutral service. |
dsh-web-app transport | Non-loopback listeners require direct TLS; authentication bypass is loopback-only. The Web startup provider carries explicit Host and exact-Origin trust into dsh-client-connection, while the composition prints the effective trust policy and mounts the Cordis console exporter for privacy-minimal connection and authentication diagnostics. Client-aborted request bodies close quietly; route failures that still have a response peer remain warnings. |
dsh-web-app browser entry paths | The static fallback renders the shell only for /, the built index path, and the composition-owned /auth/manage entry. Missing assets and undeclared pathnames return an empty 404 rather than successful HTML. |
dsh-web-app client plugin delivery | Initial browser boot registers every independent plugin factory through one revision-addressed, gzip-capable /plugins/bootstrap.js resource; per-plugin scripts and source maps remain available for aggregate fallback and HMR, preserving the plugin-native Loader/fiber lifecycle. |
dsh-web-app transport encoding | The Host /api bridge negotiates content-encoding for buffered replies (Brotli, else gzip, else verbatim; q=0 counts as refused), declaring vary: accept-encoding on every buffered reply while preserving an upstream vary, and a content-length matching the bytes written. Replies under 1 KiB stay verbatim, encoding runs on the zlib thread pool, and Brotli quality is pinned below its default so network time is not converted into Host event-loop time. Only application/json is buffered: event streams and the streaming session-log ZIP export pass through untouched, so any streaming content type stays correct by default. The transport-agnostic Fetch handler is unchanged, so the in-process carrier pays nothing. |
dsh-web-app cold history presentation | Ordinary initial history prefers the latest compact checkpoint transaction and all later events, searching past the message quota by a bounded message budget so a compaction-free session still reads only its tail; older raw history remains reachable through explicit paging, while Chat does not automatically prefetch across a compaction boundary. The click response omits projection restoration, then an idle, generation-fenced projection-only request restores the authoritative baseline after any live-gap repair; a deployment without the projection registry still serves no baseline block. Window-replacing gap repair reuses the same first-screen request. Concurrent command discovery addresses a Session id and applies Agent-scoped shadows only when an Agent is already live, so it never resumes a cold Session merely for a scope key. Model-directory observation preserves a live in-process pick, otherwise reads the latest stored request header through a non-mutating persistence observation that runs beside detached history rather than behind its per-id mutation chain. Batch replay keeps every raw Session Event and Match; Definition-owned skipHistoryUpdates() policies may omit only their own superseded State transitions. Chat and Trajectory preserve first-token timing and usage while skipping finalized text reconstruction. Addressed subagents, Definitions without a policy, interrupted streams, live append, ordinary boundary prefetch, paging continuity, and registry rebuild semantics remain unchanged. |
| Source container/Tailscale launcher | pnpm run web:container persists a development CA and leaf certificate under $DSH_HOME, maps certificate SAN hosts to the same authenticated Web profile's Host trust, optionally carries exact advanced Origins, and leaves browser enrollment and owner approval intact; it is not a separate profile or plugin composition. |
auth profile | dsh-auth-app parses device, Grant, and API-client management arguments inside the plugin tree and exits without mounting an Agent, WebServer, or authentication runtime Provider. |
| Notification | No shipped bundle mounts dsh-notification-http; explicit examples compose Storage plus the Provider. |
dsh-web-app plugin diagnostics | Mounts the diagnostics registry and Cordis lifecycle Provider before the existing authorized plugin-inventory Remote; the existing Plugins Settings tab displays each current report without repair controls. |
dsh-base Agent capability composition | Mounts the generic recipe/member composition registry; global Agent structured overrides inherit into Profile values, while source YAML rows supply native selection, member, and configuration defaults. |
dsh-web-app capability management | Mounts the authorized recipe/member Remote, a Profile Assembly Settings tab, and a read-only Session Capabilities view. Catalog reads parse Profile files and discover Skills without starting a Profile. The next standing generation compiles selection and owner-declared configuration into Loader patches, applies Tool/Skill/MCP member allowlists through native registries, and records resolved members; running Sessions stay pinned, Host-shared MCP connections remain live, compatible read-only Cordis Inspect providers hold shared generation leases, and shared Subagent providers remain read-only. The Session read answers a live Agent from its own generation and a cold listed Session from the standing generation of the Profile its log recorded, starting no agent, session, or turn; a Session persistence does not list stays an error. |
| Opt-in SQLite session persistence | Uses schema 17 packed physical rows for compatible streamed text, reasoning, and tool-call deltas, selective Zstandard payload compression, compact provenance encoding, packed-range suffix/history reads, and write-locked tail repair. Logical SessionEvent semantics and the default JSONL composition remain unchanged; unsupported older SQLite schemas are refused rather than migrated. |
dsh-workspace storage | Keeps the shared workspace domain at official DSH version 2, isolates the Harniverse-only deletion journal in workspace_deletion version 1, and explicitly migrates legacy version 3 workspace media. |
dsh-tool-todo continuation | Optionally queues a system-injected continuation at agent/turn-stopping while the latest TODO snapshot remains unfinished. The Session surface keeps it as a user-role message for wire compatibility, while its source carries form: 'system-injection'; consecutive-turn caps and competing-input suppression remain enforced. |
| Cross-session query and delivery | Separates current-title/creation/raw-activity discovery from content search and exposes exact status, folded messages, complete raw history and windows, and session or event lineage through one session_inspect contract; cwd remains an optional filter rather than exact-target authority. The delivery Definition, local Provider, and Consumer expose session_create(agent_profile_id), non-waiting session_message, and safe idle-only session_unload; ordinary targets use the Agent inbox, while direct subagent targets retain parent authorization and cold recovery through ctx.subagents.followup(). Native synchronous and asynchronous delegation results render the child Session id and direct the model to session_inspect; asynchronous continuable results additionally direct later turns to session_message. The shared base, ACP example baseline, and Web Agent Profiles expose the unified delivery tools beside one continuable spawn-backed subagent tool and keep fork/spawn providers mounted as runtime capabilities; the fork alias, global control/list/history tools, and child report tool remain optional plugins outside shipped model rosters. session.workStatus folds one admitted message through queued, claimed, settled, and discarded lifecycle states with its effective queue/steer delivery when known, while session.updateQueue returns that post-mutation status with the exact message id. Indexed discovery/search opens lazily on first use. |
dsh-web-app Workspace composition | Registers the Workbench navigation and the independent shell.overlay preview contribution through the plugin slot system. The shared Workspace store keeps tabs and preview state across placements, while rightMode, rightOpen, and rightDrawer owner facts prevent duplicate surfaces and clear stale preview visibility on right-region changes. |
| Archived Session Web management | Web Archive requires an idle session, closes an idle attached Agent before committing the archive set, makes archived Sessions read-only at Host mutation boundaries, supports durable workspace.unarchiveSession, paged read-only browser previews, and single or dependency-ordered batch deletion over the existing journaled session.delete transaction. Legacy archived Agents are closed when they reach quiescence; shared attachments remain retained for global garbage collection. |
| Web Agent Profiles | session.create({ agentProfile }) creates a distinct Agent instance with immutable durable Profile identity. Profile metadata selects the pre-publication permission preset; resume, fork, cold presentation, delivery, child inheritance, and browser summaries preserve the same identity. The four shipped Profiles default to workspace-write, and no Profile-switch method remains. |
| Native Child Profile foundation | Native child creation accepts a host-resolved childProfile, applies its bounded workspace cwd and Tool allowlist, and persists the profile snapshot in descriptor version 3. Standard, Code, and Cordis expose child_profile_define and child_profile_list; custom Profile member selection gates the read and write tools independently. The list returns the exact live parent's grant and private revisions, while each child keeps the selected immutable snapshot after that in-memory registry ends. |
| Web Child Profile and history surface | Standard, Code, and Cordis Web Agent presets enable Profile management with host-bound grants and default model routes. Delegation results render the durable child Session id to native models and carry the same identity into Trajectory; session_message continues an asynchronous continuable direct child, while session_inspect reads either mode's folded messages, raw history, event windows, or lineage without cold-resuming it. The optional subagent_history Consumer remains available to custom compositions. |
| Web and Profile supervision | The base bundle mounts the supervision Service. Standard, Code, Cordis, and Minimal Profile metadata may pin supervised or unsupervised independently of permission presets; the Host applies that value before Agent publication, the Web selector changes the live Session through /supervision, and Child Profile delegation captures the effective mode in its durable descriptor. |
| Session deletion with private descendants | session.delete keeps ordinary fork deletion leaf-safe while deleting cold origin: subagent descendants child-first with a cold parent, refusing any still-live hidden child before mutating persistence. |
Downstream Commit Ledger
| Commit | Plugin-level effect |
|---|---|
4c31133a0a | Absorbs three official Windows fixes at contract level: true two-byte-NUL UTF-16 termination in the native directory picker, windowsHide on non-terminal subprocess spawns and both taskkill helpers, and bounded transient-rename retry inside writeFileAtomic (Windows-only; POSIX unchanged). |
de672a15e2 | Generates the committed API catalog (docs/api-catalog.json) from the compile-locked unary/carrier/error registries, wires verify-api-catalog into doc-sync, locks RPC_ERROR_CODES to the error-details map, and replaces the host FrameQueue and client WebSocket inbox Array.shift backing with ring buffers. |
ae7c9b6d5b | Makes the shipped model-provider composition vendor-neutral and removes the DeepSeek-specific onboarding occupant. |
e054be808c | Adds explicit Agent/Session close, cold deletion, resumable event cursors, projection-cache deletion, and workspace cleanup across existing plugins. |
27f702fac1 | Adds explicit all-interface Web startup acknowledgement; later superseded by authentication and TLS requirements. |
313a859200 | Mounts configurable DeepSeek/Exa/Perplexity search providers and adds live settings/UI selection. |
fd707f8b78 | Disables the model-facing native Web tool surface in shipped defaults. |
a9fab6b33b | Adds the outbound notification Definition/coordinator and durable HTTP Provider. |
7b11e67e00 | Adds durable final-result artifacts, artifact_read, bounded readers/search, stronger compaction evidence, and accurate auxiliary usage. |
5dde5cdc6f | Adds inbound authentication Definition/Provider, Web transport enforcement, browser login, and token management. |
c44c47bbba | Makes the read-result UI accept bounded pages without an exact total line count. |
795f93ba84 | Requires TLS for non-loopback Web serving, adds secure cookies and peer-aware auth failure limiting, and fixes auth lock teardown. |
6ba41ae8ef | Replaces named-token inbound authentication with plugin-native public-key Enrollment/Grant/Access lifecycle, capability-total endpoint enforcement, bounded enrollment and per-Grant credentials, browser/API-client flows, and sealed owner admission. |
22c9c1b9a9 | Adds automatic lossless-style compaction over a committed summary DAG, bounded current-session history tools, and shipped bundle, preset, and headless composition. |
827dc083d5 | Adds the read-only plugin diagnostics Definition, Cordis Provider, authorized Remote projection, and Plugins Settings report. |
955ab7323a | Adds the source container TLS launcher, Tailscale Host/SAN wiring, exact Origin trust configuration, human-readable enrollment errors, and privacy-minimal Web connection and authentication diagnostics. |
5158dec7a0 | Keeps the shared workspace domain compatible with official DSH, isolates Harniverse deletion recovery state, and migrates legacy workspace media explicitly. |
5816aa6d30 | Adds optional TODO-driven continuation turns with a bounded consecutive-turn policy and competing-input suppression. |
093c319309 | Adds cross-session ID-bound query, runtime status and message tails, ordinary-session message delivery with cold resume, and safe idle-only unload. |
baafb40c0d | Makes Agent Profile identity immutable at Session creation, applies Profile default permissions before publication, and removes blank-Session Profile switching. |
7e38080de9 | Mounts cross-session query and delivery in shipped compositions, with Profile-scoped Web Consumers and lazy first-search SQLite activation. |
b2016ed5f2 | Adds current-title, creation-time, and raw-activity session discovery plus complete raw-log tail and window reads while preserving content-search hit semantics. |
995b34867c | Adds inherited Agent Profile capability composition, static recipe planning, immutable Session generations, Host-shared MCP restrictions, and Web management/read-only runtime views. |
1dfeaaaea5 | Adds Profile-level Tool, Skill, and MCP member allowlists, owner-declared Persona configuration, native registry enforcement, and immutable generation member projections in the Web UI. |
44956e699b | Batches concurrent authentication admissions and registers initial browser plugin factories through one revision-addressed aggregate while preserving independent fallback and HMR. |
8719eabfa4 | Adds direct model-requested retained-tail context compaction through the existing Provider transaction and lossless summary DAG. |
dcd0413ffa | Splits browser plugin startup into authenticated critical/deferred bootstrap phases, adds a lightweight auth entry, Brotli/immutable static asset delivery, Web-profile cold-summary probe suppression, and restored-history/baseline overlap without weakening plugin-route authorization. |
868883546d | Adds provider-local bounded DeepSeek request-image projection, model-level explicit image modality opt-in, Files API upload reuse with scoped owner-only index, quota cleanup, stale-file inline retry, and all-inline fallback. Default catalogs and shipped Profiles remain text-only; no durable Session schema changes. |
2157a1d84f | Replaces scalar SQLite session-event rows with schema-17 batch-local packed rows, selective Zstandard payloads, compact provenance, bounded packed-range reads, and stale-safe physical-tail repair while preserving logical persistence semantics. |
f0807f6c08 | Serves ordinary initial session history from the latest compact checkpoint transaction and later events under a bounded checkpoint-search budget, moves projection restoration off the click path onto an idle generation-fenced request, threads AbortSignal into persistence reads, and keeps Chat from automatically paging across a compaction boundary. Batch replay preserves every raw Session Event and Match; only Definition-owned superseded State transitions are omitted. |
87ffb7eb28 | Negotiates content-encoding for buffered Host /api replies (Brotli, else gzip, else verbatim; q=0 refused) on the zlib thread pool with Brotli quality pinned below its default, buffering only application/json so event streams and the streaming session-log ZIP export keep their incremental delivery. The transport-agnostic Fetch handler is unchanged. |
f4b03623f6 | Keeps global capability defaults separate from Profile-native rows, exposes Code Mode's run_code as a selectable member, and proves Standard remains native while Code remains run_code-only through the real Web composition. |
57db49dcf0 | Keeps cold-session command discovery and model-directory observation off Agent resume: discovery applies scoped shadows only for an already-live Agent, while detached model selection reads a validated stored request-header prefix beside history rather than behind its per-id mutation chain, preserving publication, subagent, close, delete, format, and disposal fences. |
d5caac49c1 | Ports official 82db1515fb: every bwrap profile uses a private PID namespace and matching procfs, while the functional probe uses the same profile so unsupported hosts fall through the existing fail-closed Linux ladder instead of accepting weaker confinement. |
000275810e | Ports official 583894f7ae: the DeepSeek adapter replays exact reasoning content on every reasoned assistant turn, including plain answers, so compatible gateways can recover upstream thinking signatures. |
40882c1c4f | Adapts official 92723cafeb and 600f3a3110: the authenticated Web composition declares /auth/manage as an exact shell entry while missing assets and undeclared paths return empty 404 responses. |
b3db1057f5 | Ports official 47399764c5 and 7b973e27c8: publication ordering preserves installed edges and best-effort peer edges, while Host and Client source gates reject module-scope loads of optional dependencies. |
444d9f3326, cb84b86324, 35d28a024a | Adapts official 93cbb3799d, 66a7081c15, and 738dcced9b: the harniverse build profile titles the shipped browser application Harniverse, feeds identical public DSH_CLIENT_* values to the Web shell and every dynamic client bundle, and binds one complete build to its artifacts so release:pack --family dsh refuses a missing, foreign, or stale client build record. Authentication and authorization remain runtime plugin decisions. |
38e82f9667 | Adapts official large-history pagination hardening: shared, JSONL, Zstandard, and SQLite history reads scan provenance minima iteratively, so a finalized message with an unusually large sourceEventSeqs list cannot overflow the JavaScript argument stack. |
f4023b90a8 | Adapts official composer transaction and cache-display fixes: one cancellable operation owns reference preparation and send settlement, unresolved drafts and image reservations cannot be submitted twice or erase later input, and near-complete cache hits remain distinguishable from an exact 100 percent hit. |
86f340a1ea | Adapts official bounded multi-query Web search: one model call accepts a bounded queries array, runs scalar providers concurrently with sibling cancellation and quiescence, deduplicates queries and URLs, merges sources round-robin under one cap, and records query-labelled durable output. |
034ea62b3f | Adapts the official shared Settings description mirror to Harniverse ownership: one generation-fenced read feeds all Settings Consumers, Host topology events invalidate exposed descriptions, and unary plus stream transport identities prevent stale or cross-principal snapshots, writes, and secret-bearing model discovery from crossing authentication generations. |
614a79d862 | Keeps authenticated browser transport values inside the inline-safe API wire layer: connection and Fetch carriers import only authentication types, principal identity schemas retain wire validation without runtime branding, the source purity regression scans client and inline-safe carrier edges, and build failures identify the importing module. |
ba26e84caf | Makes the public unit-test workflow build the complete artifact tree before Vitest, keeps check:all on one dependency-ordered build, and lets third-party notice generation ignore pnpm virtual-store entries whose platform-optional package was not materialized. |
132d22be25 | Records build-before-unit verification as a repository-level requirement and removes obsolete host-agent sandbox escalation guidance without changing the product sandbox's plugin-owned confinement and approval rules. |
af1ef802d0 | Adds idle-only Archived Session Web management, read-only archive previews, unarchive, and dependency-ordered deletion. |
7a9f18df5e | Carries the admitted identity in every connection server-response envelope so authenticated browser Remotes validate, and reads a cold listed Session's capability assembly from the standing generation of its recorded Profile without starting an agent, session, or turn. |
6ef9ea1bc1 | Makes the Archived Sessions entry reachable from the collapsed sidebar rail and expands the rail before opening the archive panel. |
2c925a4f50 | Reserves the full width of the three desktop sidebar header actions so the archive control is not clipped or covered by the adjacent conversation column. |
f7c1bc1308 | Refuses a composition plan whose selected recipes claim one member name, and compiles an already-stored tool-name conflict into a mountable generation so a Profile carrying one can still start a Session. |
02ff1b54f8 | Keeps the vendored logger-console timestamp visible on dark terminals by using ANSI palette index 7 instead of dark index 8; log thresholds and message content remain unchanged. |
ac8d0ffdfa | Recovers unusable pi-ai replay metadata as provider-neutral history, aligns replay envelopes with max-token block pruning, and persists visible text/reasoning prefixes from cancelled streams as interrupted assistant messages for replay and UI projections. |
44ac9c5d23 | Adds bounded provider-authored diagnostics to one-shot subagent results, preserves safe Claude Code failure and unattended-interaction facts, classifies Codex protocol/process/permission failures without retaining raw payloads, and presents diagnostics separately from partial assistant output. |
60fd18012c | Adds capability-gated Host file-reference discovery, bounded local Agent-workspace indexing, authenticated Session-reference candidates and pre-step preparation, and the unified Web @ completion with quoted paths, directories, and canonical Session mentions. |
fa35fa4edc | Adds the opt-in Python CodeRuntime provider: fresh shell-free CPython subprocesses, hostile fd-3 JSONL validation, async bindings, resource/time/output limits, lossless JSON, cancellation, and quiescent disposal without changing shipped Profiles. |
18fe061761 | Adds creation-time-fenced Windows process inspection and PTY teardown plus the opt-in owner-scoped persistent PowerShell tool, preserving existing POSIX behavior and leaving default Profile composition unchanged. |
644e92524d | Carries typed image attachments through slash-command adjudication, transport, and Host admission; commands must opt into images, handlers receive durable ImageBlock references, and failed or cancelled submissions retain draft resources. |
64ed2f1efc | Aligns the accepted upstream feature contracts in regression fixtures: Web reference rows insert into the actual Web layer, interrupted output remains visible after cancellation, command image arguments are explicit, and provider diagnostics are asserted separately from failure output. |
8926dce6ff | Classifies the new fileReferences capability seam in generated service and event graphs, covering its Host implementation and Web consumer. |
113785ea1f | Synchronizes the bilingual LLM streaming and Session type-equivalence contracts for replay envelopes, interrupted blocks, and cancellation-finalized assistant messages. |
b7f4473eb4 | Keeps the Client TypeScript face isolated from Host Context.sessions: Client project references no longer pull Host-only projects, the API contract barrel leaves runtime schemas on their dedicated subpaths, and Session-reference type declarations use Client-safe /types entries. This restores the full Host/Client/Web build without widening the Client program into the Host service graph. |
f7131338e2 | Declares zod as a runtime dependency of Session-reference so generated Host and Remote Typert artifacts load through their public exports in a fresh install, with regression coverage for both exports and the real Web startup path. |
b9524bb737 | Moves Session-reference public typert and remote export coverage into the post-build built-bin smoke gate, preventing clean-build TypeScript ordering failures while proving both subpaths through plain Node; the repository rule now requires clean-build evidence for build/export changes. |
6e5b88ca23 | Adds the parent-private Child Profile foundation: immutable resolved profile types, grant intersection and workspace boundary validation, native Tool/workspace application, and descriptor version 3 persistence. |
966538a150 | Ensures omitted Child Profile depth/token limits inherit the parent's granted ceilings instead of becoming unbounded. |
db0274419c | Adds the parent-private Profile registry and revisioning, model-facing define/list plus profile_id delegation, opaque primary model-route resolution, native Skill/MCP setup enforcement, and SDK initialize-handshake propagation. |
2723f9fe58 | Hides origin: subagent sessions from ordinary Host list/search summaries and Host session increments while preserving the parent-owned subagent catalog and descendant APIs. |
230a59d2d9 | Makes hidden subagent descendants deletable with their cold parent while preserving leaf-only deletion for ordinary fork descendants. |
8810402740 | Adds Web Trajectory child-history navigation and native raw-event paging for authorized subagent_history reads, with SQLite/JSONL bounded readers and documented third-party fallback behavior. |
1b0ddfe6a8 | Adds the service-owned unified sync/async Invocation contract, routes tool-owned foreground and continuable paths through it, makes Agent teardown tolerate best-effort final flush failures, and corrects the cold-resume replacement regression fixture. |
70516f51b5 | Adds the model-facing session_inspect Consumer with unified summary, message, raw-history, event-window, and lineage views, and updates shipped composition, generated catalog, and bilingual package documentation. |
4904050e1c | Adds the unified session_message naming alias for ordinary-session delivery, mounts it through Agent Profile composition, and updates generated catalog and bilingual package documentation. |
71ebc17a96 | Changes the subagent presentation metadata to expose caller wait mode as sync or async instead of provider lifecycle terminology. |
946c9f7e24 | Adds the model-facing `mode: sync |
4b4c4bf5be | Refreshes the generated model-facing tool catalog for the invocation-mode schema. |
64d85fe2f9 | Removes the legacy model-facing run_in_background field from subagent delegation; `mode: sync |
19b40e2c7b | Adds session_create through the existing Session Delivery Definition/Provider/Consumer seam; creation uses ctx.agents.create, resolves the deployment model, mounts the requested Profile before publication, and returns the durable session identity. |
1cd0fb8b59 | Normalizes sync and persistent async subagent results to Invocation receipts carrying mode, invocationId, and sessionId; the legacy receipt remains only for the internal one-shot Task route. |
47b1dc525f | Changes the shipped fork delegation tool to the persistent Invocation lifecycle, removing the last shipped backgroundMode: one-shot composition. |
270fa008e0 | Unifies sync and async subagent waits on the durable continuable Session lifecycle, removes obsolete continuable-mode composition flags, and retains explicitly configured one-shot behavior as deprecated legacy compatibility. |
e5dde45a8d | Narrows the async Invocation receipt regression fixture through its public JSON boundary before reading the durable child Session id, restoring strict Host compilation. |
60b37766c2 | Restores parseable shipped fork composition and lets private Agent-preset compaction history attach from the first published Session event when its realm did not observe the creation edge. |
694662e3a3 | Consolidates shipped Session reads under session_inspect, keeps only session_create, session_message, and session_unload for Session mutation, routes direct-child messages through the persistent Subagent runtime, and reduces shipped delegation to one spawn-backed subagent tool while retaining fork/spawn providers and optional control/report plugins. |
e3ceb12389 | Adds session-indexed LLM wire-attempt diagnostics: adapters record compact request fingerprints, transport status, diagnostic headers, timing, and normalized failures without duplicating Session conversation content. |
64a19c1f41 | Publishes adapter-resolved model output capacity separately from request defaults and makes compaction summary calls combine matching Provider usage with model-aware output and remaining-context bounds. |
06b0506f77 | Renews browser sessions through repeated device-possession exchange with half-life scheduling, bounded retry, lifecycle wakeups, quiescent logout, and renewable-key admission for ordinary authenticated pages. |
6fdf45691a | Adds the plugin-native Workspace navigation/preview redesign: top-level Files/Changes/Search tabs, Host-compiled include/exclude glob filters, shared docked/drawer preview state, shell.overlay composition, sidebar-safe geometry, focus lifecycle, semantic-token enforcement, and authenticated browser ARIA/interaction coverage. |
7db5712690 | Adds the independent per-session supervision mode plugin, Profile and Child Profile selection, human-dependent operation enforcement, plan-mode policy, Web selector, persistence catalog entry, assembled Web replay coverage, and bilingual package/architecture documentation. |
aa98bbf729 | Completes supervision's deploy-root runtime closure, config and service catalog contracts, public JSDoc, subsystem documentation, and regression-safe Child Profile supervision lookup. |
094f2004af | Adds the provider-neutral WebRuntime registry and explicit search/fetch selection, Tavily/Brave/Kagi/Firecrawl providers, Firecrawl Search/Scrape mapping, HTTP fetch defaults, Web Settings provider controls, and model-facing untrusted Web-content boundaries. |
03cfedff74 | Admits each new Web provider's settings namespace to the api-proxy configuration allowlist, so the Settings card serves live Tavily/Brave/Kagi/Firecrawl forms instead of the unavailable notice, and realigns the provider-selection, tool-schema, and untrusted-artifact regression fixtures with the shipped contracts. |
1a0d968c4d | Ships the four Profile capability defaults: Minimal's hidden lossless recovery, Standard-family user Skills/Hooks/MCP loading and disclosure, settings-owned scoped MCP consumers, dialect-specific Hook discovery, hardened public-only Web fetch, and corresponding real-composition, generated-catalog, and bilingual documentation updates. |
552a78fbc5 | Unifies all built-in Profile prompt assembly around static Harniverse identity plus dynamic persona, checkout, and Web contexts; disables shipped Claude Code/Codex Hook bridges by default, rejects CLAUDE instruction candidates, and marks automatic TODO continuation with the durable system-injection form. |
e55e384ae3 | Aligns the moved checkout, Web GUI, and Cordis persona wording with Harniverse branding, identifies Harniverse as a downstream of DeepSeek Harness (DSH), and adds the independent-product and retained-DSH-license notice to the checkout context. |
48bdd0860fd5123f6ceb852f3a68c8e0d09c1939 | Exposes the authenticated Web API through the private-profile composition used by the Cordis Web example. |
4e5467e4ccf983f4021dff8f7ae061e14865db5a | Accepts the stock macOS /var and /tmp aliases only when their real paths remain under /private, while retaining ownership, permission, directory, and containment checks for spill roots. |
58957069a3d70090b98927b9aa4bf90937af2123 | Restores the validation baseline across CI, vendored plugin rescoping, built artifacts, snapshot fixtures, authenticated Web runtime behavior, and principal-bound hidden-subagent projections while preserving stable product and protocol identifiers. |
855388feaf307236cc42271f73394e08536f2ea9 | Treats Windows EPERM from an existing authentication lease directory as ordinary contention, preserving the single network-instance contract across platforms; the accompanying fixture-only CI repairs do not alter shipped plugin composition. |
98bb7b0a3c2546e47b92afa19a01a29951ea7a77 | Splits the opt-in CPython runtime control transport between stdin for Host frames and fd 3 for child frames, preserving stdout/stderr log capture while making the fresh-process provider portable to native Windows; the accompanying snapshot and platform-fixture repairs do not alter shipped composition. |
41e52f248d5465f412643f10e265b95f40ce62b2 | Treats Windows EPERM from an existing Grant-registry lock directory as ordinary writer contention and gives the opt-in CPython reply-reader thread enough Windows stack for deeply nested lossless JSON; the accompanying snapshot and test-fixture repairs do not alter shipped composition. |
c9a2b0579b7ed9cca63cec4e625e7d16a25581ee | Prioritizes authenticated Workspace Git cancellation over a racing successful process exit and raises the opt-in CPython reply-reader stack reserve for deeply nested lossless JSON on native Windows; the accompanying cross-platform test-fixture repairs do not alter shipped composition. |
145d486c5e | Raises the opt-in CPython native-Windows reply-reader stack reserve again for the observed 3,000-level JSON boundary and hardens real Loader-composition timing/scrollback budgets for slow Windows CI; these test-fixture changes do not alter shipped composition. |
bcc4186fb5 | Resolves the opt-in CPython executable through the Host PATH before clearing the model process environment, and keeps authenticated Workspace directory and Git inspection portable by reserving descriptor-path traversal for Linux while revalidating canonical paths on macOS and Windows. |
71befd15fe | Applies the opt-in CPython address-space bound only where the platform measures address space, skipping it on macOS where RLIMIT_AS aliases resident memory, and tolerates individually refused resource requests. CPU and Host wall-clock ceilings remain enforced on every platform. |
277be8ca8a | Treats Windows EPERM from removing a vacated inbound-authentication lease as ordinary cleanup contention, preserving the single network-instance contract across platforms, and bounds lease acquisition so an unremovable lease fails loudly. |
Architecture Refactor Ledger
Status: refactor implemented.
| Refactor | Problem | Target state | Status |
|---|---|---|---|
| Auth management App | Universal launcher parsed provider-specific token grammar and imported dsh-authentication-local outside the plugin tree. | The minimal dsh-auth-app bundle/profile owns parsing and execution; dsh auth is only a profile alias. | Complete |
| Tool final-result extension | dsh-tools owned spill policy and hardcoded a separately composed Consumer after definition finalization. | dsh-tools exposes the generic asynchronous tools/finalize-result waterfall before immutable commit. | Complete |
| Result artifact Consumer | Retention and artifact_read could be composed independently even though successful retention promised the tool existed. | dsh-tool-result-artifacts owns retention, marker, failure semantics, and retrieval tool in one plugin. | Complete |
| Spill reference contract | SpillRef.retrievalHint let a storage Provider own model-facing wording. | SpillRef carries only opaque locator and exact bytes; Consumers own presentation. | Complete |
| Notification role projection | Generated capability tables showed no Consumer even though the Definition package folds the coordinator Consumer. | Generated graphs explicitly label the bundled coordinator role for notification and session telemetry. | Complete |
The base bundle, four Web agent presets, standalone auth profile, package manifests, and generated catalogs use these final package boundaries.
Maintenance Rules
- Update this file in the same change that adds, removes, renames, combines, or splits a first-party plugin package.
- Record a capability as the complete Service Definition / Service Provider / Consumer relationship; never present constituent packages as independent capabilities unless they actually are.
- Record bundle, profile, preset, and scope changes separately from package inventory changes.
- Mark generated catalogs, tests, and documentation as supporting projections rather than runtime plugin packages.
- Keep the baseline immutable. Upstream synchronization must add a new dated baseline section rather than silently replacing the imported tree.