# v0.7.0

> Release date: 2026-09-13

## Highlights

- Moved the DSH integration cohort from the `0.1.0-rc.8` era onto the `0.1.5-rc.2` host cohort. Every `@deepseek-ai/dsh-*` peer floor, the devDependency floor, and the regenerated lockfile now sit on one cohort, with no `rc.6`/`rc.8` provider left behind.
- Recomposed the client manifest after `@deepseek-ai/dsh-client-runtime` was removed in `0.1.2-alpha.1`. `dsh.client.inject` now names the packages that actually own the services the client half consumes: `dsh-client-ui-renderer` (`slots`), `dsh-client-ui-settings` (`settingsScope`), and `dsh-client-locale` (`locale`).
- Routed every panel and dashboard HTTP route through the host's Connection auth gate. Raw `webServer.register` routes do not inherit authentication, so all 20 routes now call `connection.requestRejection(req)` before reading memory data or performing a side effect, and `connection` is declared next to `webServer` in the mount. The pre-existing same-origin checks remain as a second layer.
- Reworked the Memory Dashboard list into bounded pages with infinite scroll. The list requests 100 memories at a time, keeps a live status line under the list (`Scroll to load more memories.` / `Loading more memories…` / `All matching memories loaded.`), preserves the active filters and batch selection as pages append, and falls back to a scroll listener where `IntersectionObserver` is unavailable.

## Compatibility and migration

- Supported host cohort is now `0.1.5-rc.2`. The previous peer floor `>=0.1.0-rc.6` could not match a later prerelease cohort under npm's prerelease matching rules, so installations on the new host produced peer warnings even though the plugin loaded.
- Unauthenticated requests to plugin routes now answer `401` where they previously served data on loopback. Browser sessions are unaffected: the panel and dashboard run with the host's signed `dsh-auth-*` cookie.
- `dsh-better-sidebar` is now a `^0.19.1` optional peer, matching the version the dashboard tab is verified against. Without it the core plugin and the Settings panel continue to work and the dashboard tab is unavailable.
- The dashboard memory list now loads in pages of 100 instead of one 150-row request, so batch actions apply to the rows loaded so far; use the filters to narrow the set before selecting all.
- No memory data, configuration key, tool name, or route path changed. The `mnemosyne` settings namespace and `~/.dsh/mnemosyne` store are untouched.

## Validation

- `pnpm install`: resolves the whole graph on `0.1.5-rc.2` with no peer-dependency warnings.
- `node scripts/inject-lint.mjs` (dsh-plugin-upgrade-skill): verdict `OK` — no removed-package residue, no missing peer for a declared client inject, Cordis peer at `^4.0.1`.
- `pnpm test`: 157 tests passed (140 focused unit/client/identity tests and 17 integration tests), against a pre-migration baseline of 153 passing with no pre-existing failures.
- Isolated staging cold boot on the target cohort: plugin row composes with nothing pending, `__DSH_BOOT__.entries` advertises `dsh-mnemosyne` with the recomposed inject list, the host-advertised client bundle returns 200 with the `dsh-mnemosyne` registration id, and the auth gate answers 401 unauthenticated, 403 cross-origin, and serves the route body once authenticated and same-origin.
- `npm pack --dry-run`: `cordis.patch.yml` ships in the tarball and matches `dsh.bundle.patch`.