# Changelog

[简体中文](CHANGELOG.zh-CN.md)

Public releases are listed newest first.

## Unreleased

Everything below is the staged 0.7.0 candidate. It is not published yet; the section is dated when the release is cut.

### Added

- Russian (`ru`) is now a published locale, no longer source-only: the deterministic report, HTML dashboard, semantic prompts, native runtime and Python CLI all ship the full Russian catalog, and `README.ru-RU.md` documents the plugin in Russian. Message texts moved into keyed catalogs, so the semantic-prompt contract (untrusted-data notices and prompt rules) is written natively per locale instead of one English constant for every language. `ru` is accepted in the recorded run scope, resume validation and every entry that already accepted `en`/`zh-CN`.
- DSH `0.2.1-rc.5` is the primary acceptance host. The declared floor stays `>=0.2.1-rc.2`, and `0.2.1-rc.2` keeps compatibility coverage; the previous rc.3 host trees are no longer maintained, consistent with the contributing policy of not maintaining historical hosts.

### Changed

- Acceptance tooling tells the truth about failures and cleanup: failing steps and cleanup failures return their real exit status, an isolated result directory is never overwritten or silently reused, cleanup keeps the scene when the stop state is unclear, and public diagnostics no longer carry arbitrary exception text or machine paths. Fault probes are CRLF-portable.
- Tests run the runtime they claim: every CI cell installs and names its exact DSH runtime (rc.5 primary, rc.2 compatibility), duplicate suites were reduced, and the candidate artifact is packed from the actual PR head instead of relabelling GitHub's merge checkout.

### Security

- The known upstream dependency gap remains unresolved: six official DSH rc.5 packages pin `zod@4.4.3` ([GHSA-mrhx-c7xc-m3w5 / CVE-2023-54404](https://github.com/advisories/GHSA-mrhx-c7xc-m3w5), patched in 4.6.6); nested pinned copies and this project’s peer closure remain vulnerable despite the host root resolving 4.6.7. The 0.6.1 exception expired and was not renewed. On 2026-11-03 the maintainer made a new, limited decision accepting this risk for 0.7.0 and the exact reviewed rc.2/rc.5 cohort: 13 bound files, the host queue and the reviewed 23- and 24-entry report graphs. In local checks, fresh production and full npm scans each exited 1 with the single advisory and 23 affected entries; the policy-aware assessment classified both as `accepted_known_risk`, and the reviewed 24-entry fixture was also accepted. This is neither a clean scan nor an exact-commit CI result. New findings or cohort drift fail closed. The replacement artifact, affected installation identity checks and exact-commit CI remain pending. See [Security Policy](SECURITY.md#known-upstream-dependency-gap).
- The audit gate now accepts a genuinely clean scan (with a valid, non-empty dependency inventory) without any exception file; network failures, invalid JSON, missing steps and new high/critical findings still fail closed.

### Migration

- The analyzer version string is `0.7.0-v4-dsh021rc2.5`; the input identity and semantic schema (`1.2.0`) are unchanged, so 0.6.1 native runs keep their recorded scope and stay resumable, and existing HTML/JSON/Markdown reports remain openable. Deterministic CLI caches written by 0.6.1 are ignored automatically and re-parsed from source; deleting them stays an optional manual cleanup via `dsh-session-insights cache`.

## 0.6.1 - 2026-10-26

Security and correctness patch for 0.6.0: closes the output-boundary, cache-minimization, privacy-projection, project-identity, timezone and aggregate-freshness defects listed below, adds trusted human approval for run deletion, and adds dependency auditing to CI. DSH `0.2.1-rc.3` is the primary acceptance target for this release; `0.2.1-rc.2` stays the minimum supported floor and keeps compatibility coverage. Source-level claims below were verified by synthetic regression on both runtimes; native hosts, models and UI acceptance remain separate gates. Session format stays V4 with DSH `>=0.2.1-rc.2`; start a new analysis run after upgrading; old caches are ignored automatically and deleting them is an optional, deliberate cleanup (see Migration).

### Security

- Known upstream gap: DSH rc.2/rc.3 pins `zod@4.4.3`, affected by GHSA-mrhx-c7xc-m3w5 / CVE-2023-54404 (memory exhaustion; patched in 4.6.6). The maintainer accepts only this risk for 0.6.1 on the current host dependency cohort; scans stay active and other high/critical findings still block. The exception expires on a release-version or DSH dependency-cohort change and must be reassessed at the next DSH upgrade. This is not a fix or a low-probability claim; see the [Security Policy as recorded at v0.6.1](https://github.com/GreenLv/dsh-session-insights/blob/v0.6.1/SECURITY.md#known-upstream-dependency-gap-in-061).

- Derived CLI/bridge outputs (main file, HTML companion JSON, atomic temporaries) are boundary-checked before the first byte is written: targets inside the sessions source tree, pre-existing symlinks, hard links, non-regular files and NTFS alternate-data-stream names are refused with an actionable error, the previous report bytes stay untouched, and main/companion paths can never overwrite each other (`report --format html --output audit.json` writes `audit.data.json`).
- The deterministic parse cache is minimized and scope-gated: a bounded header read decides window/project scope first, so out-of-scope logs are never parsed and never cached; persisted entries carry only a whitelisted, pre-projected session projection (no raw cwd, job registry, team roster, provider metadata or topic text), new POSIX cache directories/files use `0700`/`0600` regardless of umask (Windows uses ACLs, including private-parent inheritance and runtime-created private ACLs), and the cache schema moves to version 9 (version-8 entries are ignored, never auto-imported or auto-deleted). A new `cache` CLI subcommand previews per-root file counts and sizes and deletes listed roots only with an explicit `--delete`.
- Python local-mode text now removes URL userinfo (and query/fragment credentials) exactly like the Node runtime; broken URLs collapse to a placeholder instead of failing the report.
- Aggregate model input is re-projected under the run's analysis privacy — every free string, including object keys in summary sections, so a local-privacy base report can no longer widen a redacted analysis input.
- Extension `source.kind` values in `injected_source_kinds` follow the shared category vocabulary: documented kinds stay readable, extensions are sanitized/pseudonymized per privacy mode, and credentials never persist even locally.
- Model-output validation covers the input-sanitize contract (emails with plus tags, URL userinfo/query, identifiers, paths — values and object keys); invalid replacements keep the previous valid bytes, and an aggregate file placed outside the accepted submit path is untrusted input that finalize refuses. The aggregate response must echo a canonical `aggregate_input_identity` — exactly `identity_schema: 1` (integer; booleans refused) plus the 64-hex digest prepare-aggregate issued — and the same-named field anywhere else (nested items, facets) is ordinary content and scanned like model text.
- Corrupt logs in provable out-of-scope projects are skipped after a bounded header read (never parsed, cached or blocking healthy projects); in-scope corruption still fails closed, now with a privacy-safe session locator and line number.
- Native run deletion requires a human approval through the host approval service (`allowed-once` scoped to that exact call, executed with the caller's agent, call id and cancellation signal); a model-supplied `confirm=true` alone deletes nothing, no approval service means fail-closed, and the typed DSH command `/session-insights --cleanup <run> [--confirm]` is the direct human entry: it previews by default and, with `--confirm`, deletes exactly one named run without running any analysis.

### Changed

- Project identity and display labels are separated: every session, task family, project summary, excerpt and dashboard filter/export carries a stable anonymous `project_id` (hash of the lexical path key, case rules follow the path's own platform), and basename collisions get a short stable suffix instead of merging two projects.
- One report timezone now derives date, hour and weekday together: captured once per request (host local, or explicit `--report-timezone`/IANA name/`UTC+HH:MM`), passed explicitly to the analysis Worker, recorded in the report scope and run manifests so a later resume cannot drift; Windows without IANA data gets an actionable tzdata error instead of a silent UTC fallback.
- Semantic aggregates are content-bound: `get_aggregate` issues an `aggregate_input_identity` naming the exact prepared input, the response must echo that identity, and acceptance recomputes the input digest from the current validated facet content — a response generated against an earlier facet snapshot is refused instead of being re-stamped (a late response cannot complete). Finalize additionally re-verifies facet bytes and the prepared-input digest from disk (mtime-preserving edits cannot bypass it); stale or unbound aggregates refuse to complete, idempotent resubmission stays valid, and recovery is a rebuild-and-resubmit or an explicit degraded fallback. The semantic schema moves to 1.2.0 in both runtimes; prior runs are refused with "start a new run".
- Project paths normalize once at the entry: the Python CLI resolves a relative `--project` against the invoking working directory, and the native entry refuses relative paths with an actionable absolute-path message (no process-cwd guessing, no silent empty reports); selection, worker matching, cache scope and resume records share the canonical key.
- `analyzer_semantics` is now `v4-dsh021rc2.5` (identity version bump); the analyzer version string is `0.6.1-v4-dsh021rc2.5`.
- Redirected Python CLI/analyzer/semantic output uses UTF-8, including Chinese and space-containing paths on Windows; development tests declare portable IANA timezone data.
- CI pins every GitHub Actions use to a verified full commit SHA and adds a `dependency-security` job (`npm audit` for prod and full trees, `pip-audit` over the declared dependency set); scan failures fail the job, empty/unreachable results are never a pass.

### Migration

- Old deterministic (version 8) and semantic (1.1.0) caches are ignored automatically — runs reparse from source. Deleting the leftovers is a deliberate user action: `dsh-session-insights cache --dsh-home <home>` previews roots, `--delete` removes only confirmed cache roots and refuses links or unowned files. Historic copies, backups and model-side retention are unaffected by this deletion and are not claimed as cleaned.
- Existing 0.6.0 HTML/JSON reports remain openable; they lack `project_id` and report-timezone fields, so pre-upgrade reports keep their historical (merged-basename, mixed-timezone) projections and are not retroactively re-differentiated.
- Native 0.6.0 runs are not resumable by the 0.6.1 semantic contract; start a new run. Deleting old runs now goes through approval-gated cleanup.

## 0.6.0

Adapt Session Insights to DSH 0.2.1-rc.2. The floor moves to `>=0.2.1-rc.2`; 0.2.0-rc.2 and 0.2.1-rc.1 are refused. Session format remains V4, but the host adds required event vocabulary and new completion/delegation semantics, so start a new analysis run after upgrading.

### Added

- Admit the required 0.2.1-rc.2 events `job/registered`, `job/settled` and `working-directory/change` in both the Node and Python validators; fixtures are generated by the exact host `Session` writer and restored by the official strict catalog. Unknown required events are still refused and unknown ignorable events are still skipped.
- Report background-job lifecycle per session and in totals: registered/settled/completed/failed/killed/pending, inherited and inherited-pending, by-kind/by-cause, teardown, unreported producer outcome, anomalous duration/detail, unpaired settlements, and turn-ends that occurred while an owned job was still running. Registry outcome is never presented as user-task completion or resource release.
- Count delegation separately from completion: dispatch tool results for `subagent`/`subagent_fork`/`workflow`/`spawn_teammate`, runtime `subagent-settled` notices, `tool-jobs` completion notices, inbound/outbound relays, workflow run/agent records, and Team roster/task snapshots. Delivery, inbox acceptance and parent turn end are not completion evidence.
- Add a labelled working-directory trajectory with header-origin attribution, own vs inherited segments, cross-project activity, platform path forms (posix, home-prefix, drive, UNC, relative), duplicate/relative/invalid change anomalies, and privacy-shaped output. Raw paths stay out of redacted/metrics reports; project filtering and resume keep the immutable header criterion.
- Recognise `web_search` and `web_fetch` as recorded calls (one multi-query search is one call), keep legacy `web.*` search aliases, and retain PTC outer/inner separation. Record `model/selection` and reasoning effort, `llm/retry` scheduled vs performed attempts and chain ids, and per-session token provenance (`input_tokens`/`total_tokens` derived sums, raw buckets recorded).
- Keep third-party `plugin:` records opaque: only type/count coverage is retained, never payload, user intent, model context or completion evidence.
- Refresh fixtures, peer ranges (DSH `>=0.2.1-rc.2`, Cordis `~4.0.5`) with the fixture runtime pinned to exact 0.2.1-rc.2 and Cordis 4.0.5 and contract tooling; add Node/Python parity coverage across local/redacted/metrics privacy and both locales.

### Changed

- `INPUT_IDENTITY`/analyzer semantics are now `v4-dsh021rc2.4`; cached deterministic parses and prior-run resume with different semantics are invalidated by design.
- The npm/Python/Bundle/Skill identity is 0.6.0 and the DSH engines/peers floor is `>=0.2.1-rc.2`.

- Source and synthetic checks are preserved in the [development record](docs/acceptance/v0.6.0-rc2.1-candidate.md). Native, model and UI results are recorded separately in the acceptance receipts attached to each exact release artifact; range admission does not establish testing of future hosts.


## 0.5.2 - 2026-09-30

This patch continues the 0.5.x host-adaptation series, fixes unsafe resume selection and bounds analysis resources. It requires DSH `>=0.2.0-rc.2` and no longer supports RC.1. Start a new analysis run after upgrading from 0.5.1; existing reports remain on disk. Separately installed Python CLI and Skill copies require their own update. Native acceptance is recorded per artifact.

### Changed

- Raise the DSH floor to `>=0.2.0-rc.2` across npm engines, Bundle compatibility and DSH peers. Future host versions are admitted by the declared range (the official RC.2 market consumer evaluates with `includePrerelease`), not by static version tables; only format or analyzer-semantics changes invalidate runs. Fixture runtimes and contract tooling pin the exact RC.2.
- Bind resume to an explicit run and its recorded selection scope. Every run now records a normalized scope (project key, window length, privacy pair, analysis depth, locale) with a scope fingerprint; implicit resume requires an exact match, an explicit `--workdir` refuses contradictory fields, multi-run ambiguity is reported with the candidate paths, and manifests without a recorded scope are refused. Host-version growth alone no longer invalidates a semantically identical run.
- Cap concurrent native analysis per plugin instance (two runs; cancellable FIFO queue of eight). Slash-command and tool calls can no longer multiply 256 MiB analysis Workers without bound; queued work is cancelled on abort or unload.
- Bound Python session-log reads: streaming JSONL with hard budgets for decoded bytes, line count and single-line size, frame-by-frame zstd decoding that detects truncated final frames, refusal of oversized header frames and high compression ratios, and explicit `resource_limited_files` coverage instead of silent truncation or older-generation fallback. Corrupt UTF-8 is reported as unreadable instead of crashing the run.
- Classify RC.2 asynchronous question replies (`source.kind=user-question-reply`) and scheduled prompts (`schedule`) as injected context in the native reader: counted separately, excluded from body evidence, corrections, acceptance signals and completion inference, and never treated as authorization.
- Give `--no-open` a verifiable meaning: the command output stays a bare path line with no view hint, no opened files, no resident server and no upload; the default output appends one view hint naming the report file. Documented viewing steps for the Web runtime and the official Desktop keep the offline HTML as the only report surface.

- Independent review fixes project-filtered preparation, keeps each scheduler slot until Worker termination, validates recorded selection fingerprints, and checks compressed-log budgets during block decoding. Completed `--no-open` results contain only the report path.
- A section with one narrative card now uses the full row. Filter actions wrap on narrow screens, avoiding horizontal overflow.

## 0.5.1 - 2026-09-29

Target DSH `0.2.0-rc.1` exclusively. Start a new analysis run after upgrading; existing reports are retained.

### Changed

- Count interrupted tool results separately from confirmed failures in both production readers. JSON totals and session summaries add `tool_recovery: {outcome_unknown, not_started}` for the host's exact recovery codes; these records do not increase failure, failed-verification, permission or retry counts. Call identity includes its turn and step, preserving separate uncertainty evidence when an ID is reused.
- Pin DSH peers and Bundle compatibility to `0.2.0-rc.1`. New input identity `v4-dsh020rc1.2` invalidates earlier analysis manifests and deterministic caches.
- Generate recovery fixtures through the exact host's official recoverer. Release tooling now retains one commit-bound tarball and validates installation bytes, populated reports, cancellation and cleanup in a portable gate. Source, package, native-host and model acceptance are recorded separately in the [release acceptance](docs/acceptance/v0.5.1-release.md).
- Anonymize machine-local paths in a historical acceptance document and broaden the public-tree path scan. Historical results and limitations are unchanged.

## 0.5.0 - 2026-09-26

Target DSH `0.1.7-rc.2` exclusively and start new V4 analysis runs after upgrading.

### Changed

- Read V4 only in both native snapshots and the optional Python CLI. Migrate older raw logs upstream; old analysis manifests and caches cannot resume.
- Use producer-owned notice messages and cancellable query observations; release observations before analysis and wait for owned work during unload.
- Track developer surface replacements, PTC inner calls and permission-blocked results without treating injected context as human work or approval text as execution evidence.
- Align npm and Python versions at 0.5.0. Source/CI checks, macOS model workflow, Windows deterministic host acceptance and human bilingual browser checks are separately recorded in the [release acceptance](docs/acceptance/v0.5.0-release.md).

## 0.4.0 - 2026-09-20

The native Bundle now generates reports without Python and adds explicit run cleanup.

### Changed

- Move native Bundle analysis and semantic validation to Node.js; remove Python interpreter discovery, subprocess execution and inherited Python environment/import paths. The optional Python CLI remains available.
- Restrict native artifacts to marked run directories, reject linked paths and validate model output before writing. Explicit structured failures now take precedence over success-looking output text.
- Add preview-first cleanup for a single run. Native runs keep validated outputs for resume but no longer write a shared semantic cache; old Python runs must be finished through the CLI or restarted.
- Keep the report schema and dashboard, with refreshed deterministic summaries. Add legacy/V3 Python–JavaScript metric comparisons, full semantic-flow tests and adversarial storage checks. Native DSH acceptance remains pending.

## 0.3.2 - 2026-09-11

Align the published package metadata with the verified DSH support baseline.

### Changed

- Declare DSH `0.1.5-rc.2` consistently in top-level `engines.dsh`, Bundle metadata, and all DSH peer dependencies, so plugin markets and installers no longer advertise the retired `0.1.0-rc.8` threshold.
- Add a regression check that keeps market-facing metadata and both README support statements on the same exact verified range.

This metadata-only release does not change runtime behavior. The source, CI, and macOS native workflow evidence from `0.3.1` remains the applicable behavior evidence; package, installation, publication, and market readback use the new `0.3.2` artifact identity.

## 0.3.1 - 2026-09-11

Fix session-log compatibility with DSH 0.1.5-rc.2: upgraded sessions now appear in reports, and injected context no longer inflates human-work counts.

### Fixed

- Read compressed or plaintext generations 0–3 and select the latest generation per session, without omitting new sessions or counting migration copies twice. Unreadable, encoding-ambiguous, and newer-than-supported generations are diagnosed rather than silently replaced with old logs.
- Separate human prompts from injected context, count system messages and attempts with no delivered reply, and retain historical tool and token accounting.
- Apply consecutive message replacements in current conversation order, so shadowed semantic evidence is removed even when endpoint sequence numbers run backwards. Query snapshots use their header's format version.
- Use the caller's time window for both semantic and deterministic reports; a corrupt zstd file no longer aborts the entire analysis.
- Make synthetic logs conform to DSH framing and migration contracts, with an upstream contract verifier and V3 regression coverage.

The declared minimum DSH version remains `0.1.0-rc.8`. This change targets `0.1.5-rc.2`; see the [acceptance record](docs/acceptance/v0.1.5-rc.2-compatibility.md) for native and CI verification scope.

## 0.3.0 - 2026-08-25

0.3.0 polishes the dashboard's layout (consistent cards, aligned filter toolbar, scroll-aware chip navigation), adds Skill usage and plugin/MCP usage views, measures active time in hours, and records per-session skill calls in the deterministic analyzers.

### Changed

- Dashboard visual system: every block uses the same card treatment (task-family list, friction signals, representative workflows, evidence and coverage notes included), a consistent 28px vertical rhythm, equal-height card rows with bottom-aligned card actions, and one-column collapse below 850px. The filter toolbar was rebuilt as a six-column form grid with the work-area filter and the Reset / Export buttons on one aligned second row.
- KPI cards reordered by what matters most — active time, dedicated token usage, sessions (was "Rollout 数"), turns, tools — with active time in hours everywhere. The drilldown section is renamed 会话明细 (Session details).
- Navigation: the sticky table-of-contents became a pill-chip card that follows document order (任务族 before 时段对比) with scroll tracking, and now includes entries for 会话明细 and 证据.
- Color accents: status pills use green/red/amber tints, usage-chart cards get distinct series colors, and glance cards cycle accent colors.
- Number formatting follows the report language (1.4B vs 14亿) instead of the browser locale.

### Added

- Interaction metrics now count Skill calls and Plugin/MCP calls per filter scope (plus Web searches separately); the deterministic analyzers record per-session `skill_calls` (parser contract bumped to DSH 0.2.2 / 6.0.4).
- The usage section gains 「Skill 使用」 and 「插件/MCP 使用」 cards that rank the most-used skills and MCP servers/plugins (alongside session types, tools, file types, and active hours).

### Fixed

- Chart: the daily active-time measure shows hours with the unit on the y-axis, every date is labelled (even sampling beyond 12 days), and the chart lives in its own card.
- Recommendation and work-area cards align their action rows (copy prompt + adoption select, drill-down buttons) and pin them to the card bottom-right.
- Task-family rows use the same fluid-title / right-aligned-meta proportions as the session-detail list, with completion evidence spanning the full row.
- Scroll tracking no longer jumps ahead or leaves the session-detail and evidence sections unlit; anchor jumps respect the sticky bar.

## 0.2.0 - 2026-08-22

Version 0.2.0 turns session review into a native DeepSeek Harness workflow: run `/session-insights`, let the current DSH agent analyze bounded batches, and open the generated local HTML report and companion JSON. The earlier file-log CLI remains available.

### Added

- The DSH Bundle reads session history through DSH's `sessionQuery` service and coordinates the review through six bounded workflow tools.
- Raw session snapshots are streamed to the Python analyzer and are not copied into the run directory in plugin mode.
- Chinese and English dashboards use the same report data while keeping their own interface and generated narrative language.

### Changed

- Model-assisted retrospective is now the normal Bundle path. Use `--deterministic` for a no-model report or `--resume` to continue the latest incomplete bounded run.
- The published Bundle can be installed through the DSH npm plugin channel.

### Fixed

- English reports no longer inherit Chinese framework text from ordered substring replacement; static and generated text now follow the requested locale explicitly.
- Resume, cancellation, invalid model output, and deterministic fallback clean up their run state consistently.
- macOS aliases such as `/var` and `/private/var`, paths containing spaces, and Windows project filters are handled with native path rules instead of silently rejecting or selecting the wrong sessions.
- The semantic prompt now exposes every allowed aggregate value, preventing a valid model answer from falling back because the contract was impossible to discover.

Release identity, package checksums, CI, native-platform evidence, and the remaining Windows limits are recorded in [the v0.2.0 acceptance record](docs/acceptance/v0.2.0-candidate.md).

## 0.1.0 - 2026-08-21

The first release reads DSH file logs and produces an offline workflow-review dashboard plus companion JSON. It can run deterministically or add a recoverable model-assisted analysis stage.

### Added

- File-log adapter, Python CLI, managed DSH Skill installation, synthetic fixtures, and three privacy modes.
- Recoverable semantic batches with validation, caching, and explicit fallback when generated output is invalid or unavailable.

### Fixed

- Windows console launchers are created at their final environment path, so they do not keep references to a removed staging directory.
- Complete `<redacted>` placeholders pass privacy verification while real credential values remain rejected.

### Platform scope

- Repository checks and cross-platform CI passed, and isolated native acceptance passed on macOS and Windows 11. Linux native acceptance, real-session smoke testing, real-model semantic round trips, and Windows DSH GUI Skill rescanning were not completed for this release.