# Legacy compatibility inventory

[简体中文](legacy-compatibility.zh-CN.md)

Last reviewed: 2026-10-15. This inventory and its Chinese counterpart maintain the same stable IDs, version facts, implementation locations, tests and retirement conditions. Update both languages together. The matrices are lookup views; the entries define maintenance decisions. Use complete DSH version numbers instead of release-order descriptions or abbreviated version names.

## Scope and review rules

Plugin `0.1.9` declares support for DSH `0.1.7-rc.1`, `0.1.7-rc.2`, `0.2.0-rc.1`, `0.2.0-rc.2`, `0.2.1-alpha.1`, `0.2.1-alpha.2` and `0.2.1-alpha.3`. Development and tests default to `0.2.1-alpha.3`. Runtime admission uses `>=0.1.7-rc.1`, including prereleases; admission is not verification and still requires package identity and API checks. Versions absent from these matrices do not inherit their verification claims or automatic manual-account activation.

- Review both matrices and every affected entry before changing peers, `dsh.compatibility`, runtime admission, test targets, CI or user compatibility claims.
- `dsh-runtime`: retain an adaptation while its applicable versions intersect the supported set. When the intersection becomes empty, remove exclusive implementation and tests and update both languages, matrices, entries and guides in the same change. Keep shared security checks.
- `plugin-contract`: retire under the plugin's configuration migration policy, independently of DSH support. Plugin `0.1.9` still accepts the `allowedOrigins` input introduced by plugin `0.1.5`.
- Missing exact-version evidence requires preserving implementation and recording the gap. Passing the same test on different releases does not prove identical implementation.
- Support-range or shared host adaptation changes require CLI, browser and installation smoke coverage of the same final artifact across all declared versions. Full `DSH-ACCOUNT-001` feature regression targets only `0.2.1-alpha.3`; `0.1.7-rc.1`, `0.1.7-rc.2`, `0.2.0-rc.1`, `0.2.0-rc.2`, `0.2.1-alpha.1` and `0.2.1-alpha.2` need startup, Settings and disabled-adapter checks for that feature change. The complete CI version matrix stays unchanged.

## Feature → version matrix

“Native” means the exact installed DSH package provides the capability. “Plugin validation/fallback/enabled” identifies an adaptation retained here. “Rejected”, “absent” and “not provided” distinguish rejected configuration, a missing native option and a missing native feature. “Unverified” does not authorize code removal. Public HTTPS through an HTTP reverse proxy is separate from a native DSH HTTPS listener.

| Feature and maintenance ID                                                       | `0.1.7-rc.1`                 | `0.1.7-rc.2`                 | `0.2.0-rc.1`                 | `0.2.0-rc.2`                 | `0.2.1-alpha.1`                   | `0.2.1-alpha.2`                    | `0.2.1-alpha.3`                                               |
| -------------------------------------------------------------------------------- | ---------------------------- | ---------------------------- | ---------------------------- | ---------------------------- | --------------------------------- | ---------------------------------- | ------------------------------------------------------------- |
| Concrete IPv4 listener validation · [DSH-HOST-001](#dsh-host-001)                | Plugin validation            | Plugin validation            | Plugin validation            | Plugin validation            | Plugin validation                 | Native validation                  | Native validation                                             |
| Native IPv6 listener · [DSH-HOST-001](#dsh-host-001)                             | Rejected                     | Rejected                     | Rejected                     | Rejected                     | Rejected                          | Native                             | Native                                                        |
| Native HTTPS listener · [DSH-PROTOCOL-001](#dsh-protocol-001)                    | Rejected                     | Rejected                     | Rejected                     | Rejected                     | Rejected                          | Native                             | Native                                                        |
| Server-side Connection bridge · [DSH-PROTOCOL-001](#dsh-protocol-001)            | HTTP / `127.0.0.1`           | HTTP / `127.0.0.1`           | HTTP / `127.0.0.1`           | HTTP / `127.0.0.1`           | HTTP / `127.0.0.1`                | Actual protocol and bind authority | Actual protocol and bind authority                            |
| Plugin's single `publicUrl` entry · [DSH-PUBLIC-001](#dsh-public-001)            | Supported                    | Supported                    | Supported                    | Supported                    | Supported                         | Supported                          | Supported                                                     |
| Native `--public-url` option · [DSH-PUBLIC-001](#dsh-public-001)                 | Absent                       | Absent                       | Absent                       | Absent                       | Native                            | Native                             | Native                                                        |
| Model-facing Web address · [DSH-PUBLIC-001](#dsh-public-001)                     | Native loopback text section | Native loopback text section | Native loopback text section | Native loopback text section | Final public root in text section | Final public root in text section  | Final public root in runtime context                          |
| `DSH_WEB_URL` · [DSH-PUBLIC-001](#dsh-public-001)                                | Native loopback address      | Native loopback address      | Native loopback address      | Native loopback address      | Final public root                 | Final public root                  | Final public root                                             |
| Radius and focus theme tokens · [DSH-THEME-001](#dsh-theme-001)                  | Plugin fallback              | Native                       | Native                       | Native                       | Native                            | Native                             | Native                                                        |
| Settings entry · [DSH-TEST-001](#dsh-test-001)                                   | Sidebar Settings             | Sidebar Settings             | Sidebar Settings             | Sidebar Settings             | Sidebar Settings                  | Sidebar Settings                   | Account menu → Settings                                       |
| Exact first-run notice/reload triggers · [DSH-TEST-001](#dsh-test-001)           | Unverified; keep helper      | Unverified; keep helper      | Unverified; keep helper      | Unverified; keep helper      | Unverified; keep helper           | Unverified; keep helper            | Account onboarding adapted; notice/reload triggers unverified |
| Native official-account provider · [DSH-ACCOUNT-001](#dsh-account-001)           | Present; loopback HTTP only  | Present; loopback HTTP only  | Present; loopback HTTP only  | Present; loopback HTTP only  | Present; loopback HTTP only       | Present; loopback HTTP only        | Present; loopback HTTP only                                   |
| Plain-Web official-account entry · [DSH-ACCOUNT-001](#dsh-account-001)           | Disabled; Desktop only       | Disabled; Desktop only       | Disabled; Desktop only       | Disabled; Desktop only       | Disabled; Desktop only            | Disabled; Desktop only             | Enabled                                                       |
| Native `startSignIn` first argument · [DSH-ACCOUNT-001](#dsh-account-001)        | Locale string                | Client metadata object       | Client metadata object       | Client metadata object       | Client metadata object            | Client metadata object             | Client metadata object                                        |
| Plugin manual account callback · [DSH-ACCOUNT-001](#dsh-account-001)             | Disabled                     | Disabled                     | Disabled                     | Disabled                     | Disabled                          | Disabled                           | Plugin enabled; native API-key choice retained                |
| Plugin `0.1.5` configuration migration · [PLUGIN-CONFIG-001](#plugin-config-001) | Retained                     | Retained                     | Retained                     | Retained                     | Retained                          | Retained                           | Retained                                                      |

## Version → feature matrix

Each row identifies the exact release's branches and relevant entries. The native `startSignIn` first argument is a locale string on `0.1.7-rc.1` and a client metadata object on `0.1.7-rc.2`, `0.2.0-rc.1`, `0.2.0-rc.2`, `0.2.1-alpha.1`, `0.2.1-alpha.2` and `0.2.1-alpha.3`. Before removing support, find its row and inspect each entry's complete applicable set. Removing one row does not necessarily retire an entire entry.

| Exact DSH version | Listener and bridge differences                                                                                                                                        | Native public address, model prompt and environment                                                             | Theme and Settings entry                                                                                    | Official account and manual callback                                                                       | Entries to review on removal or migration                                     |
| ----------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------- |
| `0.1.7-rc.1`      | Plugin validates concrete IPv4; HTTP only; Connection uses HTTP / `127.0.0.1`                                                                                          | No `--public-url`; plugin public entry works; model text and `DSH_WEB_URL` retain native loopback               | Three tokens need fallback; sidebar Settings; notice/reload triggers unverified                             | Native account service present; plain-Web entry disabled; manual callback disabled                         | DSH-HOST-001, DSH-PROTOCOL-001, DSH-PUBLIC-001, DSH-THEME-001, DSH-TEST-001   |
| `0.1.7-rc.2`      | Plugin validates concrete IPv4; HTTP only; Connection uses HTTP / `127.0.0.1`                                                                                          | No `--public-url`; plugin public entry works; model text and `DSH_WEB_URL` retain native loopback               | Three native tokens; sidebar Settings; notice/reload triggers unverified                                    | Native account service present; plain-Web entry disabled; manual callback disabled                         | DSH-HOST-001, DSH-PROTOCOL-001, DSH-PUBLIC-001, DSH-TEST-001                  |
| `0.2.0-rc.1`      | Plugin validates concrete IPv4; HTTP only; Connection uses HTTP / `127.0.0.1`                                                                                          | No `--public-url`; plugin public entry works; model text and `DSH_WEB_URL` retain native loopback               | Three native tokens; sidebar Settings; notice/reload triggers unverified                                    | Native account service present; plain-Web entry disabled; manual callback disabled                         | DSH-HOST-001, DSH-PROTOCOL-001, DSH-PUBLIC-001, DSH-TEST-001                  |
| `0.2.0-rc.2`      | Plugin validates concrete IPv4; HTTP only; Connection uses HTTP / `127.0.0.1`                                                                                          | No `--public-url`; plugin public entry works; model text and `DSH_WEB_URL` retain native loopback               | Three native tokens; sidebar Settings; notice/reload triggers unverified                                    | Native account service present; plain-Web entry disabled; manual callback disabled                         | DSH-HOST-001, DSH-PROTOCOL-001, DSH-PUBLIC-001, DSH-TEST-001                  |
| `0.2.1-alpha.1`   | Plugin validates concrete IPv4; HTTP only; Connection uses HTTP / `127.0.0.1`                                                                                          | Native `--public-url`; model text and `DSH_WEB_URL` use the plugin's final public root                          | Three native tokens; sidebar Settings; notice/reload triggers unverified                                    | Native account service present; plain-Web entry disabled; manual callback disabled                         | DSH-HOST-001, DSH-PROTOCOL-001, DSH-PUBLIC-001, DSH-TEST-001                  |
| `0.2.1-alpha.2`   | Native concrete IPv4/IPv6 and HTTP/HTTPS; Connection uses actual protocol and bind authority                                                                           | Native `--public-url`; model text and `DSH_WEB_URL` use the plugin's final public root                          | Three native tokens; sidebar Settings; notice/reload triggers unverified                                    | Native account service present; plain-Web entry disabled; manual callback disabled                         | DSH-HOST-001, DSH-PROTOCOL-001, DSH-PUBLIC-001, DSH-TEST-001                  |
| `0.2.1-alpha.3`   | Native concrete IPv4/IPv6 and HTTP/HTTPS; Connection uses actual protocol and bind authority; port type permits an unbound value, requiring validation after listening | Native `--public-url`; model address in `app:web-surface` runtime context; `DSH_WEB_URL` uses final public root | Three native tokens; account menu → Settings; account onboarding adapted, notice/reload triggers unverified | Native loopback HTTP origins only; instruction dialog and manual callback enabled; API-key choice retained | DSH-HOST-001, DSH-PROTOCOL-001, DSH-PUBLIC-001, DSH-TEST-001, DSH-ACCOUNT-001 |

`PLUGIN-CONFIG-001` and shared security boundaries apply to every row and cannot be retired by dropping a DSH release. Unlisted future releases require separate review; `DSH-ACCOUNT-001` defaults to disabled for every release not explicitly enabled.

## Capability migration and retirement workflow

1. When adding or removing DSH support, update both matrices in both languages with complete version numbers, entry IDs and evidence status.
2. When a capability changes, use the feature matrix to identify every affected release, then inspect its entries, installed package APIs, implementation and tests. Releases with the same usable API and exact-version verification may move to a shared implementation. Preserve a branch wherever capability or evidence is missing; release order is not migration evidence.
3. Record the decision per entry: exact versions retained, exact versions migrated, exclusive code/tests removed and remaining evidence gaps. Do not remove the whole entry while its applicable and supported sets intersect.
4. Public OAuth callbacks depend on both DeepSeek Platform and DSH. Platform acceptance of a public `redirect_uri` still requires verification of DSH origin policy, callback handling and UI. Retire the adaptation only under `DSH-ACCOUNT-001` conditions.
5. Review both tables and their entries manually. Do not introduce an inventory-specific generator or CI gate; continue using the existing bilingual-link and packaging checks.

## DSH-HOST-001

Concrete IP listener and schema adaptation. Type: `dsh-runtime`. Active.

| Field                       | Maintenance basis                                                                                                                                                                                                                                                                                                                                                           |
| --------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Adapted versions            | `0.1.7-rc.1`, `0.1.7-rc.2`, `0.2.0-rc.1`, `0.2.0-rc.2` and `0.2.1-alpha.1` expose only `127.0.0.1` and `0.0.0.0` in native schema. The plugin validates concrete IPv4 itself and rejects wildcards, IPv6 and TLS                                                                                                                                                            |
| Native capability versions  | `0.2.1-alpha.2` and `0.2.1-alpha.3` use native Config/address APIs for concrete IPv4/IPv6; wildcard listeners remain forbidden                                                                                                                                                                                                                                              |
| Implementation and upstream | `src/config.ts`, `src/adapters/dsh/runtime-capabilities.ts`, `src/adapters/dsh/webserver.ts`; Config/listener in exact `@deepseek-ai/dsh-host-webserver/lib/index.js`. Unified `resolveStartupConfig` replaced the transitional resolver                                                                                                                                    |
| Tests and evidence          | `tests/unit/config.test.ts`, `tests/integration/dsh-adapter.test.ts`, `tests/integration/native-transport.test.ts`, `tests/browser/native-transport.spec.ts`. The 2026-10-10 `0.2.1-alpha.2` checks covered IPv4, IPv6, mapped/scoped loopback and non-loopback IPv4. No bindable non-loopback IPv6 interface was available; only schema/policy was inspected for that case |
| Migration and retirement    | Remove exclusive IPv4/schema branches and rejection tests only when all adapted versions leave support, or each has evidence of native support and a completed migration. Keep wildcard rejection, port validation, package identity and shared gate checks                                                                                                                 |

## DSH-PROTOCOL-001

Native protocol and Connection bind-authority differences. Type: `dsh-runtime`. Active.

| Field                       | Maintenance basis                                                                                                                                                                                                                                                                                                                                                                    |
| --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Fallback versions           | `0.1.7-rc.1`, `0.1.7-rc.2`, `0.2.0-rc.1`, `0.2.0-rc.2` and `0.2.1-alpha.1` have no native TLS/protocol API, and Connection cannot recognize a concrete non-loopback bind. Keep the server-side HTTP / `127.0.0.1` bridge while the real listener and plugin public URL use concrete IPv4                                                                                             |
| Native capability versions  | `0.2.1-alpha.2` and `0.2.1-alpha.3` use the actual protocol and normalized bind authority. IPv6 zones must not enter portable public URLs; mapped IPv6 must match Connection's WHATWG comparison                                                                                                                                                                                     |
| Implementation and upstream | `listenerProtocol`/`listenerTransport` in `runtime-capabilities.ts`, `src/adapters/dsh/{readiness,browser-auth,startup-urls}.ts`, `src/http/gate.ts`, `src/index.ts`, [cordis.patch.yml](../cordis.patch.yml). `connectionTrustedHosts` combines final nativeAuthority, public authorities needed by preserved paths and explicit CLI trust without expanding outer origin admission |
| Tests and evidence          | `tests/integration/native-transport.test.ts`, `tests/browser/native-transport.spec.ts`, `tests/browser/proxy-chain.spec.ts`. On 2026-10-10, actual `0.1.7-rc.1` and `0.2.1-alpha.1` non-loopback packages demonstrated the need for the loopback bridge; `0.2.1-alpha.2` verified HTTPS/IPv6 MFA, Host settings, CLI revocation and mapped IPv6 HTTP/HTTPS                           |
| Migration and retirement    | Migrate each fallback version only after native protocol/authority evidence. Remove its exclusive fallback when that complete applicable set no longer intersects support. Keep positive HTTP, both proxy directions, Cookie Secure, stream revocation and shared authentication checks                                                                                              |

Outer Cookie Secure follows the public origin; native Cookie Secure follows the listener protocol. This is shared security behavior, independent of a version fallback's retirement.

## DSH-PUBLIC-001

Public URL projection and model prompt location differences. Type: `dsh-runtime`. Active.

| Field                              | Maintenance basis                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| ---------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Versions without the native option | `0.1.7-rc.1`, `0.1.7-rc.2`, `0.2.0-rc.1` and `0.2.0-rc.2` have no `--public-url`. Preserve native model Web text and `DSH_WEB_URL`: fixed `127.0.0.1` plus actual port without a trailing slash. The plugin's own single public entry remains configurable; do not describe it as a native CLI capability                                                                                                                                                           |
| Native text projection versions    | `0.2.1-alpha.1` and `0.2.1-alpha.2` consume `webServer.publicUrl` natively; model system-prompt Web text and `DSH_WEB_URL` use the plugin's final public root                                                                                                                                                                                                                                                                                                       |
| Native context projection version  | `0.2.1-alpha.3` publishes the model address through `webApp.getAdvertisedUrl()` and harness-dev-context's `app:web-surface`, in `assembly.contexts`; `DSH_WEB_URL` still uses the final public root                                                                                                                                                                                                                                                                 |
| Implementation and upstream        | [cordis.patch.yml](../cordis.patch.yml), `src/adapters/dsh/startup-urls.ts`; exact WebApp `lib/startup.js`, `lib/index.js` and `harness-dev-context`. Connection must depend on webStartup/webServer instead of waiting for removed webRuntime                                                                                                                                                                                                                      |
| Tests and evidence                 | `tests/browser/deployment-profile.spec.ts`, `tests/browser/startup-compatibility.spec.ts`, `tests/fixtures/startup-observer.mjs`; real `systemPrompt.assemble` and `shellEnv.collect` verify text versus context location, environment output and absence of tokens per exact version. Installed packages inspected on 2026-10-09 established the missing-option set and `0.2.1-alpha.1` boundary; 2026-10-15 review established the `0.2.1-alpha.3` context change |
| Migration and retirement           | Remove missing-option branches and CLI rejection tests when their applicable set leaves support. Keep text-location assertions while `0.2.1-alpha.1` or `0.2.1-alpha.2` remains supported and context assertions for `0.2.1-alpha.3`. A new projection location does not change how another supported release must be observed                                                                                                                                      |

## DSH-THEME-001

CSS fallback for missing theme tokens. Type: `dsh-runtime`. Active.

| Field                       | Maintenance basis                                                                                                                                                                                                                                                                                                                           |
| --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Fallback version            | Only `0.1.7-rc.1` lacks `--dsw-radius-md`, `--dsw-radius-lg` and `--dsw-focus-ring-color`                                                                                                                                                                                                                                                   |
| Native capability versions  | `0.1.7-rc.2`, `0.2.0-rc.1`, `0.2.0-rc.2`, `0.2.1-alpha.1`, `0.2.1-alpha.2` and `0.2.1-alpha.3` provide these tokens                                                                                                                                                                                                                         |
| Implementation and upstream | `var()` fallbacks in `src/client/settings/style.css`; CSS token definitions in exact `@deepseek-ai/dsh-client-ui-theme/lib` packages. The account dialog is enabled only on `0.2.1-alpha.3` and directly consumes its native typography, radius and elevation tokens; its styling changes do not remove Security fallbacks for `0.1.7-rc.1` |
| Tests and evidence          | `tests/browser/dsh-bootstrap.spec.ts` and manual screenshots under `.cache/ui-review/<version>`. Inspected `0.1.7-rc.1`, `0.1.7-rc.2`, `0.2.0-rc.1`, `0.2.0-rc.2`, `0.2.1-alpha.1` on 2026-10-09; `0.2.1-alpha.2` on 2026-10-10; `0.2.1-alpha.3` on 2026-10-15                                                                              |
| Migration and retirement    | After `0.1.7-rc.1` leaves support and token evidence is complete for the remaining exact versions, remove only fallbacks and documentation retained for that missing-token release. Keep live themes, layout, visible focus and shared visual verification                                                                                  |

## DSH-TEST-001

Settings navigation and first-run test adaptations. Type: `dsh-runtime`. Active; exact notice/reload trigger applicability remains incomplete.

| Field                    | Maintenance basis                                                                                                                                                                                                                                                                                                                       |
| ------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Direct Settings versions | `0.1.7-rc.1`, `0.1.7-rc.2`, `0.2.0-rc.1`, `0.2.0-rc.2`, `0.2.1-alpha.1` and `0.2.1-alpha.2` use sidebar Settings and API-key onboarding                                                                                                                                                                                                 |
| Account-menu version     | `0.2.1-alpha.3` uses account menu → Settings and official-account onboarding. The manual dialog lives outside sidebar/onboarding entries so rebuilding an entry does not cancel pending authorization                                                                                                                                   |
| Evidence gap             | For `0.1.7-rc.1`, `0.1.7-rc.2`, `0.2.0-rc.1`, `0.2.0-rc.2`, `0.2.1-alpha.1`, `0.2.1-alpha.2` and `0.2.1-alpha.3`, the per-trigger mapping of delayed notice, replacement during acknowledgement, first API-key save and page reload is incomplete. Shared helper success does not establish every trigger independently on each release |
| Implementation and tests | `openDshSettings`, `completeApiKeyPrompt`, `clickThroughDshPrompts` and reopen in `tests/helpers/runtime.ts`; `tests/browser/dsh-bootstrap.spec.ts`, `tests/browser/dsh-gate.spec.ts`, `tests/browser/account-login.spec.ts`                                                                                                            |
| Migration and retirement | First establish exact applicability of each interaction through real UI evidence, then remove exclusive branches by support-set intersection. General async retries, persistence waits and browser fallbacks are not automatically exclusive to any DSH release                                                                         |

Parallel `0.2.1-alpha.3` verification also exposed a fixture issue: shared pnpm hardlink ctime changes when another isolated profile installs the same package, triggering native HMR and client plugin disposal. Test installations now copy files, and the account fixture verifies that its client file has no shared hardlink. This is not evidence of a first-run onboarding reload and does not close the notice/reload applicability gap above.

On `0.2.1-alpha.3`, the 2026-10-15 CI run and a local reproduction with `DEEPSEEK_API_KEY` unset confirmed that explicit page reload reopens account onboarding when no model credential was configured. Native `SettingsRoot` keeps completed onboarding steps in component state. `tests/browser/login.spec.ts` clears the inherited key in the DSH runtime environment and rechecks prompts when opening plugin settings after reload, while retaining the settings-persistence assertions. `completeApiKeyPrompt` selects the native API-key alternative on `0.2.1-alpha.3` before entering the shared credential editor, so fixture setup actually configures a provider. This exact case does not establish every delayed-notice or automatic-reload trigger listed above.

## DSH-ACCOUNT-001

Manual official-account callback handoff. Type: `dsh-runtime`. Active; an independently removable temporary adaptation.

| Field                                 | Maintenance basis                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
| ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Native capability versus plugin scope | `0.1.7-rc.1`, `0.1.7-rc.2`, `0.2.0-rc.1`, `0.2.0-rc.2`, `0.2.1-alpha.1` and `0.2.1-alpha.2` already ship account providers/APIs, but ui-settings-account `apply` returns immediately without `dshDesktop`. `0.2.1-alpha.3` enables that UI for plain Web. This plugin adapts only `0.2.1-alpha.3`; a disabled plugin adapter does not mean native account capability is absent                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| Only enabled version                  | Exact `0.2.1-alpha.3`, jointly gated by `supportsManualAccountLogin` and the server-injected browser flag. Do not replace this with an unbounded version comparison                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
| Explicitly disabled versions          | `0.1.7-rc.1`, `0.1.7-rc.2`, `0.2.0-rc.1`, `0.2.0-rc.2`, `0.2.1-alpha.1`, `0.2.1-alpha.2` and all unreviewed future releases. Their native callbacks/account slots stay untouched; manual-authorization endpoints report unavailable                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
| Reason and upstream                   | Account-platform `protocol.ts/loginOrigin` in every exact installed release listed above accepts only loopback HTTP with an explicit port; ui-settings-account defaults to the browser origin. A public browser cannot automatically callback to the DSH machine, and the outer gate rejects cross-site navigation                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
| Implementation                        | `src/shared/account-login.ts`, `src/http/account-login.ts`, `src/adapters/dsh/account-callback.ts`, `src/adapters/dsh/browser-capability.ts`, `src/client/account/`. Public slot entries/subscribe/priority APIs replace the sign-in action; independent `shell.overlay` renders instructions, input and buttons. Native `useApiKey` continues credential onboarding without calling `complete`; the account menu reopens the editor through `openOnboarding`. Inactive authorization offers this choice; active authorization retains cancellation. The server binds the initiating session and retains the native temporary callback handler, dispatched internally only from authenticated POST with a real in-memory Node response. It never fetches the pasted URL, reads private provider state or replaces native PKCE/credential storage |
| Tests                                 | `tests/integration/account-login.test.ts` uses the real `0.2.1-alpha.3` provider and local Platform stand-in for PKCE, redirect URI, state, session, duplicate submission, cancellation, revocation, expiry and retries. `tests/browser/account-login.spec.ts` covers credential-free onboarding with `DEEPSEEK_API_KEY` unset, native API-key save and menu reopening, instructions before authorization, pasted failed-navigation callbacks, blocked popups and responsive bilingual themes. `tests/unit/client-capability.test.ts` checks exact activation and disabled future versions                                                                                                                                                                                                                                                       |
| Public-callback migration             | Platform must accept the public `redirect_uri`, and origin policy, callback, exchange, UI and session boundaries must be verified on the exact target DSH release. Platform acceptance alone does not remove DSH's `loginOrigin` restriction. A new release defaults to native behavior; any manual adaptation requires evidence and explicit inclusion in the enabled set                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| Retirement and preservation           | Retain the branch while supported `0.2.1-alpha.3` still needs loopback. When it leaves support, or its exact native public flow is verified usable, remove exclusive callback/UI/flag code and tests. Keep session ownership, state/PKCE, one-time use, revocation and prohibition on URL forwarding wherever shared by another flow                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| Evidence limits                       | On 2026-10-15, full exchange passed with the actual provider and local Platform stand-in. Official `auth_init` accepted a loopback control, which was cancelled, and rejected three `example.com` public forms at schema validation. A full real official-account authorization was not verified; a domain allowlist has not been ruled out                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |

## PLUGIN-CONFIG-001

Migration of plugin `0.1.5` configuration input. Type: `plugin-contract`. Retained in plugin `0.1.9`, independent of the DSH version set.

| Field                       | Maintenance basis                                                                                                                                                                                                                                                                                                                                                                                                     |
| --------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Configuration contract      | A single-item or empty top-level `allowedOrigins` array from plugin `0.1.5`; plugin `0.1.6` introduced in-memory migration and plugin `0.1.9` retains it                                                                                                                                                                                                                                                              |
| Behavior and implementation | `src/config.ts`, [cordis.patch.yml](../cordis.patch.yml). Omission differs from explicit empty input; a single entry becomes the sole `publicUrl`, while an empty array derives it from the bound listener. Multiple/duplicate entries and coexistence with the new field fail. Emit one deprecation warning per activation without rewriting the profile; use unified pre-start parsing and post-listen finalization |
| Tests                       | `tests/unit/config.test.ts`, `tests/unit/origin-policy.test.ts`, `tests/integration/http-gate.test.ts`, `tests/browser/startup-compatibility.spec.ts`; real Loader checks 0/1 entries, multiple/duplicate entries, null, file/CLI conflicts, warning count and unchanged profile                                                                                                                                      |
| Migration and retirement    | Remove exclusive detection, conversion and tests only after the plugin contract explicitly ends these inputs and provides migration guidance. Dropping any DSH release is insufficient. Keep single-URL validation and origin security regression                                                                                                                                                                     |

## Shared security boundaries

Package identity, API checks after forward admission, concrete binding, original Host/Origin/Fetch Metadata, loopback admission, passwords/TOTP, sessions, stream revocation, storage failure and CLI confirmation apply to all declared releases. HTTPS → HTTP reverse proxy support, Host settings capability `ownsHost` and server-side native browser authentication exchange must not be removed merely because an adaptation retires.

The production entry validates the bound port after official listener initialization; failure must release the listener, admin socket and storage lock. Connection loss or uncertain storage withdraws readiness and closes business carriers. Never satisfy compatibility checks by fabricating services, disabling Loader startup audits or bypassing the native listener.

## Evidence locations and open items

Resolve evidence through the installed DSH → WebApp → actual dependency chain and verify every manifest's complete version. Resolving a child package directly from the test directory can accidentally use source dependencies. Use exact installed packages or matching tags rather than a floating branch. Keep artifact hashes, commands, counts and run results in separate execution records; historical development-package success is not final-artifact verification.

Records from 2026-10-09 through 2026-10-10 establish schema, public URL and protocol boundaries and plugin configuration migration for `0.1.7-rc.1`, `0.1.7-rc.2`, `0.2.0-rc.1`, `0.2.0-rc.2`, `0.2.1-alpha.1` and `0.2.1-alpha.2`. The 2026-10-15 review adds `0.2.1-alpha.3` runtime-context, account-menu, port-type and account-callback evidence. The DSH `0.2.1-alpha.3` development composition uses Cordis `4.0.5-alpha.2` and Schemastery `3.18.5-alpha.2`; these are dependency package versions, not shorthand DSH versions. The same review traced each declared release through its base provider, WebApp account-controller and ui-settings-account to establish existing native providers, the plain-Web UI activation boundary and the `startSignIn` argument difference.

Open items: exact notice/reload trigger mapping per release, real non-loopback IPv6 interface verification, full real official-account authorization, official public `redirect_uri` acceptance and native DSH adaptation. Gaps limit the relevant claims; they do not justify guessing capabilities or removing implementation early.