# Changelog All notable changes to this project will be documented in this file. ## 0.7.5 — 2026-10-22 - **fix(security)**: Enforce centralized API authentication on all `/session-manager/api/*` routes using DSH official `ctx.connection.admit(req)`. Enforce strict Owner-only authorization (`peer.principal.kind === "owner"`), reject untrusted, unauthenticated, empty, or non-owner requests before body reading and database queries, and fail closed with HTTP 503 (`auth-unavailable`) if connection service is missing or unready, preventing unauthorized access across public tunnels, reverse proxies, and local networks (#43). - **fix(move)**: Synchronize the effective `workingDirectory` projection upon moving sessions across workspaces. For active sessions, call official `workingDirectory.set(agent, path)` when active or fall back to appending `working-directory/change` events to fold the projection in real time, and flush to disk via projection cache; for cold sessions, rewrite headers when un-diverged or append change events for sequential logs. For unmigrated packed rows with conflicting historical working-directory events, safely refuse moves with HTTP 409 (`working-directory-sync-unsafe`) before any file write to prevent destination directory drift upon restart (#42). - **fix(ui)**: Align session header action buttons with native DSH session title bar style: unify height to 28px, remove idle border and background (transparent ghost buttons), add standard 6px border-radius, use official hover and active tokens, style danger buttons cleanly, and replace raw Unicode emojis with crisp 14×14 SVG vector icons (#44). - **fix(ui)**: Optimize session header and manager panel layout: set header slot order to 0 to sit immediately after static session preset and team entries and before dynamic subagent and task status indicators; switch header action buttons to a fixed-width (flex-shrink: 0, 28px square) icon-only layout with corner priority badge; in session manager panel row actions, convert buttons matching header (archive, favorite, review, edit, move, delete) to clean icon-only buttons with hover tooltips while keeping non-header ("Open", "Migrate") and bulk action buttons with visible text labels (#46). - **test**: Add comprehensive test suites for API authentication gating (`issue-43-api-auth.test.mjs`), cross-workspace working directory synchronization (`issue-42-working-directory-after-move.test.mjs`), header action button styling with SVG vector icons (`issue-44-header-styles.test.mjs`), and header/panel row layout optimization (`issue-46-header-layout.test.mjs`). - **compat**: Compatible with DSH Desktop v0.2.1-rc.2 (and v0.2.0-rc.2). ## 0.7.4 — 2026-10-20 - **fix(workspace)**: Repair workspace session membership on DSH 0.2.x. New and forked sessions are now attributed to the workspace owning their `cwd` as soon as the session is announced (runtime repair, no restart needed), and historical sessions whose `cwd` matches a registered workspace are re-registered on startup — all through the official DSH workspace entity API (#41). - **fix(move)**: "Move to workspace" on a session whose `cwd` already equals the target workspace path now repairs the missing membership instead of returning a silent no-op. The response reports whether a membership was written (`attached`); the artifact's content, size and mtime are untouched and running sessions are never restarted (#41). - **fix(compat)**: Resolve the DSH home through the official `$DSH_HOME` → `~/.dsh` order (tilde-expanded, absolute) when the `dshHomePath` service is not visible to the plugin scope, so session scans and stores work with a custom DSH home (#41). - **fix(workspace)**: Read durable workspace membership from the registry record instead of the runtime-filtered projection when deleting sessions, so stale runtime indexes can no longer leave dead entries behind. - **test**: Add regression coverage for runtime new/forked session attribution, boot repair, same-path move repair (including artifact byte/size/mtime invariants), idempotence, cross-workspace moves, cwd mismatch safety, incomplete-scan safety, restart stability, archived-session preservation, and custom DSH home resolution (#41). - **compat**: Compatible with DSH Desktop v0.2.1-rc.2 (and v0.2.0-rc.2); workspace membership repair uses the official workspace registry entity API. - **fix(safety)**: Workspace membership repair never migrates a session that is already accounted by another workspace: such a conflict is refused with `409 workspace-membership-conflict` and both records stay untouched, because an account removed from a different workspace cannot be restored through the official API. Completing a missing membership still goes through the official `attachSession()` after its validation conditions (header readability, cwd resolution, canonical path equality) are pre-checked, so a predictable rejection fails before any write (#41). - **fix(api)**: "Move to workspace" no longer reports success when a repair cannot be completed: hosts without the official `attachSession` API answer `501 workspace-attach-unavailable`, an unconfirmable membership state is refused, a membership conflict answers `409 workspace-membership-conflict`, and unsafe or failed repairs answer `500` with `workspace-repair-unsafe` / `workspace-repair-failed`. Successful repairs report `membership` (`already-member` / `attached`) next to the existing `moved` / `attached` fields (#41). ## 0.7.3 — 2026-10-18 - **fix(update)**: Fix built-in one-click update and resolve `cannot get property "remote" without inject` by routing update requests through the plugin's own Host API instead of client-side `remote.pluginManager`. - **feat(update)**: Implement completely independent one-click self-update without relying on `dsh-market`. Support both HMR (`removeBundle` -> `installBundle` sequence with automatic rollback to previous version on failure) and non-HMR environments. - **feat(update)**: Add persistent update status tracking (`.dsh-session-manager-update.json` in profile directory) and `GET /update/status` polling recovery, ensuring seamless result delivery even if the client connection is temporarily interrupted during HMR reload. - **feat(update)**: Install source protection: automatically identify `linked` (local development) and `github` install sources to refuse npm package overwrites and protect local workspaces. - **fix(update)**: Prevent accidental version downgrades with `400 not-upgrade` checks, properly handle `application: "failed"` responses from the bundle installer, and add post-install disk file/entry point verification. - **fix(ui)**: Fix button hover contrast in light and dark themes: ensure `.sm-nativeDialogConfirm` retain blue background and white text when hovered. - **test**: Add comprehensive regression tests covering update checking, install source protection, HMR safe self-update and automatic rollback, status polling recovery, and button hover styling. - **compat**: Compatible with DSH Desktop V0.2.1-rc.2 (and V0.2.0-rc.2). ## 0.7.2 — 2026-10-17 - **fix(encoding)**: Correct session directory encoding and candidate matching for IM and non-UUID sessions (`encodeFsSessionSegment` matching DSH `encodeSegment` with `~XXXX` hex escapes). Support colons and non-alphanumeric characters in session IDs without directory traversal risks, distinguish project keys from session directory segments, and maintain multi-candidate fallback compatibility for existing sessions (#39). - **fix(ui)**: Scope custom dropdown interceptor to Session Manager elements only (`getTargetSmSelect`), preventing global interception of third-party plugin selects and DSH native dropdowns and eliminating unwanted `preventDefault` / `stopPropagation` calls (#36). - **fix(ui)**: Prevent scrolling within the custom select menu from closing the menu, enabling smooth wheel scrolling and scrollbar dragging across long option lists (PR #37). - **fix(ui)**: Improve sidebar footer layout compatibility when multiple plugins inject actions into `sidebar.footer.action`. Apply scoped `flex-wrap: wrap` on the footer actions container and update `.sm-footerBtn-wide` to `flex: 1 1 100%`, preventing overlapping buttons and horizontal squishing without fragile CSS module hashes or targeting other plugins' private classes (#38). - **compat**: Compatible with DSH Desktop V0.2.1-rc.2 (and V0.2.0-rc.2). ## 0.7.1 — 2026-10-15 - **fix(cache)**: Decouple boot-time workspace session membership reconciliation from projection cache reconstruction, preventing background event-loop blocking and watchdog recovery timeouts on large session libraries (#32). - **fix(cache)**: Fix projection cache reconstruction error on packed rows (e.g. `tool-call-chunks` without sequential `seq`); prioritize official `adapter.openSessionRead()` logical events and safely skip unmigrated physical rows during disk fallback without triggering missing seq warnings (#32). - **fix(move)**: Preserve source artifact filename and generation version when moving cold sessions across workspaces, preventing forged `version: 4` headers on unmigrated physical event content (#32). - **fix(safety)**: Safely skip corrupted JSON lines and unresolvable seeded session boundaries during cache refold, preserving original session artifacts without poisoning projection caches (#32). - **feat(perf)**: Introduce budget controls (50 sessions max, 2000ms timeout, 5MB artifact limit) and event-loop yielding (`setImmediate`) during boot projection cache sweeps (#32). - **feat(update)**: Support on-demand silent update checks when opening session manager panel with a 6-hour interval, 30-minute failure cooldown, and concurrent request protection. - **feat(ui)**: Refine settings card layout and preferences order (Auto-check -> Registry -> Opacity), harmonize control widths, and inline background opacity description hint. - **test**: Add comprehensive regression tests covering packed rows, old format moves, cache hits/misses, large history library budget limits, post-move cache consistency (#32), and on-demand panel update checks. ## 0.7.0 — 2026-10-15 - **fix(ui)**: Unify select dropdown styling across all dialogs and panels with shadow-free custom floating menus, strictly align popup width with triggers, and isolate pointer events to eliminate duplicate native OS popups on Chromium. - **fix(ui)**: Fix workspace bulk action buttons wrapping to next row when overflowing in English mode, preventing the unarchive button from exceeding the window boundary. - **fix(ui)**: Align dropdown trigger box width and dropdown menu content width in workspace management panel. - **fix(ui)**: Make workspace management toolbar buttons adaptively wrap when the window narrows, matching session management panel behavior. - **feat(workspace)**: Automatically reveal and restore archived workspaces when creating a workspace with an identical directory path. - **feat(workspace)**: Add Workspace Management tab to the Session Manager panel with dedicated search, active/archived filters, and update-time & alphabetical sorting. - **feat(workspace)**: Support single and bulk workspace archiving via toggle switch and bulk actions without secondary confirmation. - **fix(ui)**: Remove hover tooltip on workspace switch and stabilize layout against window jitter during hover and toggle. - **ui**: Reorder workspace toolbar with sort dropdown placed after the active filter button, with responsive multi-row layout for bulk action controls. - **ui**: Simplify select-all button label to "Select All Filtered" in both session and workspace management panels. - **ui**: Remove duplicate "Reset Filters" button in the Session Management panel. - **feat(workspace)**: Support workspace restoration, unarchiving only sessions archived during the workspace archive operation while keeping individually archived sessions intact. - **feat(workspace)**: Support workspace bulk management with selection mode, row checkboxes, select-all/clear, and bulk archive/unarchive controls aligned on the same toolbar row as filters and sort. - **feat(workspace)**: Consolidate workspace toolbar row layout placing sort dropdown, filter buttons, and bulk action buttons on a single harmonious row. - **feat(workspace)**: Robust workspace and session update timestamp extraction supporting live member sessions, backend cache, and filesystem mtimes. - **feat(sessions)**: Add Name Ascending (`name-asc`) and Name Descending (`name-desc`) sorting in both session management and workspace management. - **ui**: Rename sidebar footer entry from "Sessions" to "Sessions & Workspaces". - **feat(workspace)**: Integrate native DSH sidebar hiding via wrapped `workspaces.list.getSnapshot()`, filtering hidden workspaces and merging session IDs into `archivedSessionIds` so sessions never spill into "Ungrouped". - **feat(workspace)**: Durable host-side persistence in `workspace-archives.v1.json` with file locking, and zero-flash synchronous `localStorage` caching with automatic migration from legacy `dsh-workspace-hide.hidden.v2`. - **feat(safety)**: Refuse workspace archiving if any session has running activity, and implement automatic rollback on partial archive failures. - **test**: Add comprehensive test suites covering workspace listing, search/filter/sort, toggle archiving/unarchiving, bulk mode and batch archive/unarchive, sidebar hiding, ungrouped isolation, running session safety, and failure rollbacks. ## 0.6.4 — 2026-10-13 - **fix(ui)**: Portal `SessionManagerPanel` into `#dsh-session-manager-overlay-root` to resolve overlay occlusion and interaction blocking by DSH sidebar/main view (#28). - **fix(responsive)**: Align compact header menu item order with expanded state across folding modes, hide visible primary actions from menu in medium fold, open menu rightwards under 420px ultra-narrow view, and clamp dialog positioning to avoid left sidebar occlusion. - **fix(ui)**: Close secondary dialogs in LIFO order on Escape, align action button styles, and unify tooltip wrappers. - **fix(compat)**: Support DSH 0.2.0-rc.2+ 3-argument `coldSnapshot` signature, fixing log offset warnings and projection refresh after workspace move (#25). - **fix(workspace)**: Sync sidebar state on archive/unarchive via official `uiWorkspace`/`workspaces` commands, unpin archived sessions, and stop active sessions on archive (#26). - **test**: Add automated test coverage for issues #25, #26, and #28. - **docs**: Streamline dialog opacity and theming documentation in README files. ## 0.6.3 — 2026-10-03 - **feat(settings)**: Add "Dialog opacity" preference (50%–100%) in Settings card to adjust plugin dialog background transparency without affecting text, borders, or controls (#23). - **fix(theme)**: Directly consume official DSH `--dsw-alias-*` theme tokens instead of locally redefining them, removing hardcoded backgrounds and `!important` locks that broke custom themes (#23). - **fix(theme)**: Subscribe to DSH `theme/change` event for reliable theme synchronization across light and dark modes. - **fix(ui)**: Keep modal layers within DSH's 1000–1100 floating tier (`1020` panel, `1050` overlay root) so DSH tooltips remain visible above dialogs (#21). - **fix(ui)**: Standardize dialog action buttons to 28px height with unified transparent border and hover styles. - **fix(ui)**: Style dropdown `