# DSHX v0.7 alignment

> 当前强制规则：DSH 官方源码与构建产物只读。插件工作不允许 Host patch、修改临时官方副本或重建官方子项目。`update prepare/verify/apply/rollback` 已禁用，仅保留 `update plan`；后文历史版本说明不解除该规则。


This source is aligned to stable DSHX `>=0.9.1 <0.10.0`, Creator Bridge
v2, and the official browser WebUI lifecycle on Harness `dsh-v0.2.0-rc.2`
(SHA `639ed015397290b3745d163aafe02ffee4aa3f84`).
DSHX v0.7.5 makes same-Home
ownership atomic across checkouts and binds PID, process start time, Home,
profile, and root before lifecycle or update mutation. DSHX 0.9.2 pins omitted
`update plan` targets to `dsh-v0.2.0-rc.2` and peer range
`>=0.2.0-rc.1 <0.2.1`. That range accepts `0.2.0-rc.2` and stable `0.2.0`, rejects `0.2.0` alphas, and rejects `0.1.7-rc.2`. DSHX 0.9.2 fits the existing floor. DSHX 0.9.0 still pins `dsh-v0.1.7-rc.1` and is outside this gate.

This is a contract alignment, not a version-number exception. Before the bridge
or installer mutates anything, it verifies the DSHX package identity, stable
version range, CLI and Creator/Guardian implementation, seven-surface activation
contract, managed-shell gate, and plugin-only source boundary.

The 0.3.10 release required DSHX 0.9.1 for the earlier desk pin `dsh-v0.1.7-rc.2`. This tree keeps that DSHX floor `>=0.9.1 <0.10.0` and moves the desk pin to `dsh-v0.2.0-rc.2` with peer range `>=0.2.0-rc.1 <0.2.1`. It keeps the ten fixed tools from 0.3.9. It retains user-confirmed takeover from 0.3.8 / 0.7.8, plus the corrected client scaffolds, bounded import recovery, and external mixed-mount self-upgrades from 0.3.7 / 0.7.7. Creator+ recovery stays on `agent/created`.

## Ownership matrix

| DSHX v0.7 surface | Creator Mode+ 0.3 behavior | Evidence boundary |
|---|---|---|
| Single-Home Host ownership | `dshx_status` must show one identity-bound attached/supervised same-Home Host and no collision/unknown candidate | App, direct CLI, and dshx are launchers; another port is not isolation |
| Isolated cold boot | external `verify-boot` uses a temporary Home and rejects `--keep` | It leaves the user's Host PID unchanged and does not prove live activation there |
| Session claims | `dshx_claim_plugin`; every named operation refreshes the claim | Claim success is ownership, not build or activation |
| Workspace scaffold | `dshx_scaffold` takes only id/kind; DSHX derives the immutable session workspace and owns any `my-plugins` link | Returned source path is the only edit target |
| Static/client checks | `dshx_check` | Exit 0 proves `SOURCE_BUILT` only |
| Seven activation surfaces | `dshx_activation_plan` selects exactly one of patch, manifest, preset, client, new-client, server, or artifact | Dependency installation is not activation |
| New Web client | `dshx_activate_new_client` owns link → resolution → watched transaction → current manifest | Exit 0 reaches `CLIENT_MANIFEST_PRESENT`; observe the current page; RC2 graph sync can load the entry without reload |
| Safe plugin removal | `dshx_remove_plugin` owns live-row quarantine → same-Host absence → official profile remove → target-verified symlink detach; partial RC8 removals resume from durable quarantine | Exit 0 reaches `HOST_TREE_INACTIVE` and `PROFILE_DEPENDENCY_REMOVED`; `detached-orphan-symlink` is bounded to this claim and source remains preserved |
| External bundle removal | Creator stops at boot-captured bundle evidence and hands off to external `dshx plugin remove`; DSHX owns tombstone → same-PID absence → official remove → later-boot cleanup | External-only operation; current Host is not restarted and old pages may still need refresh |
| Guardian | Session start arms external recovery; Host, official Loader, and claimed-link integrity failures use exact attribution and quarantine | Recovery does not prove render, visual, or functional correctness |
| Harness Update Assistant | A managed shell may inspect read-only `dshx update plan`; `prepare`, `verify`, `apply`, and `rollback` are disabled for every caller | Version inventory is not build or runtime acceptance |

## Why the eighth tool is bounded

The approved eighth tool is `dshx_hot_reload`, not a Harness update or process command. It accepts a single claimed plugin id; the bridge derives Host/profile/port and requires the DSHX bounded-same-pid-server-hot-reload capability. Same-PID module and cleanup evidence advances delivery only to functional verification. Unknown or unsupported targets remain pending without restart authority.

DSHX v0.7.2 adds one bounded tool because whole-plugin teardown previously let a
Creator Agent delete source/profile links before removing the live watched row.
`dshx_remove_plugin` closes that lifecycle gap without accepting paths, shell, or
process control. The read-only Harness version inventory does not widen
Creator Bridge v2: Harness replacement and rollback can change the process that
owns the current session, so they remain external-supervisor operations. Adding
an `update` bridge tool would erase that authority boundary. Read-only
`dshx update plan` is permitted by DSHX's managed-shell gate and is documented in
the preset skill as inventory only.
DSHX v0.7.3's external bundle transaction likewise does not widen the bridge:
it requires supervisor-owned profile/port context and may span a later App boot.
DSHX v0.7.5's Host lock, identity binding, update guard, and verifier teardown stay outside the bridge;
Creator receives status but never gains process or port input.

## Harness compatibility

The source line covers the DSH `dsh-v0.1.0-rc.8` Creator/Guardian contracts and
the DSHX v0.7 update path through `dsh-v0.1.1-rc.2`, `dsh-v0.1.2-rc.1`, `dsh-v0.1.5-rc.2`, and `dsh-v0.1.7-rc.2` to `dsh-v0.2.0-rc.2`.
The RC1 line includes relocated Standard discovery and authenticated Host proof.
`dsh-v0.2.0-rc.2` is the current authenticated Web line (SHA `639ed015397290b3745d163aafe02ffee4aa3f84`). Its peer range is `>=0.2.0-rc.1 <0.2.1`. That range accepts `0.2.0-rc.2` and stable `0.2.0`, rejects `0.2.0` alphas, and rejects `0.1.7-rc.2`. Shipped Standard is `packages/bundle/web-app/presets/standard.patch.yml`. The installer derives a user-owned `profiles/web/creator-mode-plus/agent.cordis.yml` and includes it from the web profile patch; it does not edit the shipped patch, and nothing reads `$DSH_HOME/.agent-presets`. External plugins must pass `dshx check` with no `compat-015-*`.
Read-only `dshx update plan` must pass `--target dsh-v0.2.0-rc.2`. DSHX 0.9.2 uses that tag when `--target` is omitted and does not follow a later alpha.
Release verification against the selected checkout must include:

```sh
npm run check
DSHX_HARNESS=/absolute/path/to/deepseek-harness npm run test:native
npm run verify:dshx -- --harness /absolute/path/to/deepseek-harness
npm run verify:harness-install -- --harness /absolute/path/to/deepseek-harness
/absolute/path/to/deepseek-harness/tools/dshx/skill/dshx/scripts/dshx.sh \
  check /absolute/path/to/dsh-creator-mode-plus \
  --harness /absolute/path/to/deepseek-harness
npm pack --dry-run
```

These commands establish source, contract, and packaged-artifact readiness. They
do not establish that a running profile has loaded this release. The release
report must keep these layers separate:

```text
SOURCE_BUILT
ARTIFACT_SYNCED
NEXT_BOOT_REGISTERED
PRESET_ROSTER_VISIBLE
PRESET_SESSION_ACTIVE
HOST_TREE_ACTIVE
CLIENT_MANIFEST_PRESENT
CLIENT_LOADED
VISUAL_BEHAVIOR_VERIFIED
```

## Upgrade activation

Server changes across these versions need live activation evidence, not a blanket
restart instruction. A checked server plan with `hostRestart: not-decided` returns `HOT_RELOAD_READY`
and names `dshx_hot_reload` as its next action. Unknown/failed evidence remains
pending. Planning does not authorize process control.
Run the installer with `--upgrade` outside the Agent session; unchanged preset
composition bytes retain their stamp. Root Loader module HMR and preset-private
bridge replacement are distinct scopes and need separate proof. A module or
manifest receipt still requires exercising the changed feature. Use launcher
handoff only after an evidence-backed and authorized restart decision.

The local browser-access update additionally attests `private-browser-handoff`:
identity-bound private storage, official Connection input, bounded authentication
transport, and explicit browser-adapter execution. A version string alone does
not prove these capabilities. `HTTP_AUTHENTICATED`, `BROWSER_AUTHENTICATED`, and
feature acceptance remain separate evidence.


`session-browser-open` adds the no-argument `dshx_browser_open` as the ninth
standalone bridge tool. It requires DSHX's externally configured, session-bound
adapter snapshot support. Browser authentication runs privately; Host/process
control, arbitrary paths and credentials remain outside model input.

`dshx_request_takeover({name})` asks through the current conversation’s user-question UI, then drains old work and atomically transfers ownership. This requires the `human-confirmed-creator-takeover` capability in addition to the version range.


## Official Desktop profile support (local compatibility update)

The fixed bridge derives `desktop`, its port, Home, and runtime root from the public `profileContext`; none becomes model input. The CLI preserves Web behavior. For Desktop, a per-invocation private capability returns only config entry identities, or authorizes one install/remove for the current claimed plain plugin. The owning Host calls the public `@deepseek-ai/dsh-plugin-manager/operations` `runPluginCommand` with its bundled package manager and official profile lock. New bundle activation is disabled; the existing checked watched-patch transaction still owns activation and removal. Capabilities expire, are revoked at operation completion and generation disposal, and are never returned in tool text.

Guardian validates the Electron child identity and monitors the Desktop Host. It may quarantine an attributed plugin failure, but never stops, replaces, or restarts the Desktop Host. Electron owns that recovery and normal quit. Desktop HMR binds the discovered application root independently of the plugin-development checkout. Package imports, checked artifacts, claims, same-PID proof, and feature acceptance remain required.