# Changelog

All notable changes to this project are documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).

## [Unreleased]

### Fixed
- Restored the browser UI on DeepSeek Harness `0.1.6-alpha.2` after the Client Session list removed its synthetic `current` field: the session-scoped chip now reads its bound Session directly, while the root overlay follows DSH's `retainedBy.mainView` ownership signal.
- Updated Client package-edge metadata for the slots this plugin contributes to, aligned static stylesheet ownership with the alpha.2 package lifecycle (including retagging an existing 0.5.1 style node), and moved dynamic hot-test CSS to the runner-owned `styles.insert()` lifecycle.

## [0.5.1] - 2026-09-12

### Changed
- Split the Host and Client implementation into responsibility-focused modules; `src/index.ts` and `src/client/index.tsx` now act only as composition roots.
- Dynamic client generation now stitches the split Client modules into the same import-free plugin-dev-loop artifact instead of requiring one monolithic source file.
- Removed the accidentally tracked `coverage/coverage-summary.json` and ignored `coverage/` so local coverage output and machine paths are not committed again.

### Fixed
- Agent-scoped Skill shadows now resolve the `skills` service through `agent.ctx.get("skills")` instead of raw `agent.ctx.skills` property access. This avoids Cordis' undeclared-inject property error on the first model turn while preserving the exact Agent scope through Cordis' traceable service face.
- Agent-scoped Tool restriction access uses the same scoped `ctx.get("tools")` seam for consistency without introducing a per-Agent inject fiber, service cache, or extra lifecycle layer.

## [0.5.0] - 2026-09-09

> **Deprecated / known-bad:** v0.5.0 can fail on the first model turn with Cordis' `cannot get property "skills" without inject` error ([#22](https://github.com/Ri0n72Y/dsh-workspace-scope/issues/22)). Use v0.5.1 or later.

### Added
- Added `docs/architecture.md` with C4 and end-to-end Skill/Tool data flows for the DSH 0.1.5 scope model, including Agent Preset composition, layered `SkillRegistry`, `tool-skill`, `ToolRuntime`, and workspace policy insertion points.

### Changed
- The management UI now inventories only model-invocable Skills from the current live Agent's scoped DSH `SkillRegistry` view. Host-global Skill discovery is no longer used as a fallback for an Agent capability list.
- A blank Session refreshes its Skill inventory when its Agent Preset projection changes, including preset recomposition that keeps the same Session id.
- Bulk enable/disable operations modify only capabilities visible in the current Agent view and preserve saved entries that belong to another preset according to the current whitelist/blacklist mode.
- README compatibility and architecture notes now track DeepSeek Harness 0.1.5-rc.1 and document the native `agent/pre-step` durable Skill catalog flow.
- `src/client/dynamic.tsx` is now an untracked hot-test artifact generated by `pnpm run gen:dynamic`; CI verifies that generation succeeds instead of requiring a committed generated file.

### Fixed
- Preserved `default` and `blacklist` semantics when the current Preset hides Skills: autosave no longer converts a partial scoped view into a whitelist that silently disables capabilities from another Preset. The first disable from `default` now becomes a blacklist.
- Native `modelInvocable: false` Skills no longer appear in the workspace management inventory, matching DSH `tool-skill` catalog eligibility.
- Skill inventory rejects incomplete DSH snapshots instead of publishing a partial Agent capability view.
- Skill runtime policy is skipped when the current Agent has no model `skill` Tool surface, avoiding unnecessary snapshot failures or shadows for Presets without model Skill capability.
- Post-shadow verification recomputes policy from its fresh Skill snapshot, so a newly visible denied Skill cannot slip into the model catalog during policy installation.
- Authoritative config reads wait for pending autosaves before overview or the first Agent policy lock.
- MCP public-name grouping now uses the first delimiter so raw tool names containing `__` stay under their server; `serverName` values containing `__` remain outside the 0.5 compatibility boundary until DSH exposes owner metadata.
- Stale overview responses from a previous Agent Preset can no longer overwrite the newly recomposed Agent's Skill list.
- Removed the unconditional UI claim that every excluded Skill remains available through `/skill-name`; user invocation remains governed by DSH's native `userInvocable` policy.

## [0.4.0] - 2026-09-03

### Changed
- Skill scoping now uses DSH's native per-agent `SkillRegistry` layers: excluded model-invocable skills are shadowed in the agent scope with `modelInvocable: false` while preserving their original user-invocation policy.
- MCP scoping continues to use the native scoped `tools.restrict()` path and is explicitly limited to Host-global MCP tools inherited by the Agent; Agent/Preset-scoped MCP registrations stay outside this plugin's management boundary.
- For DSH 0.1.2-rc.1's assembly-before-pre-step loop, workspace config is read and locked at the first turn-owned `system-prompt/assemble`. Agent-scoped diagnostic assemblies without a turn signal do not lock the blank session.
- MCP policy is reconciled against the current Host-global tool view on each real Agent prompt assembly. When the effective denied tool set changes, the plugin installs the replacement scoped restriction, discards the pre-policy assembly, and asks DSH to assemble once more so native and PTC tool presentation are both generated under the same policy.
- The prepended `agent/pre-step` listener refreshes only Skill shadows immediately before DSH's `tool-skill` catalog listener. It removes the previous shadows before discovery so the scoped SkillRegistry snapshot sees the underlying winning definitions.
- The Host declares its actual hard service dependencies: `webServer`, `fs`, `skills`, `tools`, `agents`, and `systemPrompt`; `sandboxPolicy` remains optional.
- Saving `.dsh-scope.json` does not mutate an active Agent's locked config. UI changes made before the first real model request apply to that conversation; later file edits apply only to later unlocked conversations.
- The management overview inventories every discovered Skill and Host-global MCP server; `.dsh-scope.json` independently supplies each row's enabled/disabled switch state, so an existing capability remains visible in the UI even when it is excluded from model use.

### Fixed
- Host-global MCP restrictions no longer arrive one model request late under current DSH. A changed mask forces one complete reassembly before the request reaches the model, including PTC's generated SDK guidance.
- Excluded Skills remain excluded on second and later steps. Previously a refresh could snapshot the plugin's own `modelInvocable: false` shadow, skip rebuilding it, then dispose that shadow and expose the underlying Skill to the same step's catalog.
- Skill shadow installation now verifies the post-registration scoped catalog and fails the pre-step closed if DSH's same-layer runtime first-wins rule prevents the deny shadow from winning, so an excluded Skill cannot silently remain model-invocable.
- Plugin unload disposes capability policies previously installed into live Agent scopes, preventing stale Skill shadows or MCP restrictions from surviving the plugin instance.
- Workspace config writes are serialized so rapid autosaves cannot complete out of order and roll `.dsh-scope.json` back to an older switch state.
- Agent disposal consumes DSH's `{ agent }` event payload correctly, so a resumed/recreated Agent with the same session id does not inherit a stale `activePolicies` entry.
- MCP server grouping follows DSH's public-name prefix and server-name character constraint; public tool names are not treated as a reversible MCP identity.

### Removed
- Removed the custom `skill-catalog` message renderer/filter, the full-`source.entries` digest workaround, and the extra `tools/pre-execute` Skill deny guard.
- Removed the catalog-waterfall compatibility test suite that existed only for the old interception path.

## [0.3.2] - 2026-08-21

### Fixed
- Completed the `workspace-scope` → `dsh-workspace-scope` rename across the bundle metadata, host/client module references, and static API prefix, so the browser client and host now agree on `/api/dsh-workspace-scope`.
- Updated the generated dynamic client substitutions and integration tests to follow the renamed API routes.
- Replaced `URL` / `URLSearchParams`-dependent request parsing in the host route handler with sandbox-safe parsing, so overview/save requests work in DSH dynamic plugin environments where those globals are unavailable.

## [0.3.1] - 2026-08-18

### Fixed
- npm metadata (repository / homepage / bugs) now points at the renamed `Ri0n72Y/dsh-workspace-scope` repository instead of the old `workspace-scope` URL.

## [0.3.0] - 2026-08-18

### Added
- `release` GitHub Actions workflow: pushing the `release` branch gates, tags `v<version>`, publishes to npm (stable, via the `NPM_TOKEN` secret), and creates the GitHub Release. Idempotent, so re-pushing an already-published version is a no-op.

### Fixed
- The trimmed catalog keeps the full `source.entries` on the rebuilt message (only the visible text is trimmed), so tool-skill's digest-based stability check stays satisfied and no catalog is re-injected on later steps. Previously every user message triggered a full catalog reload (tool-skill saw the trimmed entries, compared their digest against the full snapshot, and republished every step), wasting tokens per turn.

## [0.2.0] - 2026-08-18

### Fixed
- The skill catalog trim runs as an outermost (prepend) pre-step listener, so the full catalog tool-skill appends at the end of the waterfall is filtered too. Previously the trim ran before tool-skill's append and new conversations still saw the full catalog.
- The trim listener reads the authoritative per-conversation lock (`appliedConfigs`) before the UI-shared cache, so a concurrent overview fetch cannot swap the config for a running conversation even for one step.
- A trimmed update catalog keeps its `update` marker, so downstream readers can still tell an initial catalog from a replacement.

### Added
- Host behavior specs through the real apply(): webServer routes (overview/save/405/404), per-pre-step MCP restriction with the per-conversation lock, and the tools/pre-execute deny guard.
- Coverage gate (`pnpm run test:coverage`, thresholds: 85% lines / 65% branches, enforced in CI) and a Windows CI matrix.
- Waterfall regression specs for update-form trims, mid-chain reject/abort propagation, and first-step veto degradation (the trim stays a safe no-op when the inner config listener is skipped).
- Every dialog change saves immediately (no save button left; enable all / disable all remain as quick actions).
- The dialog copy states the effect boundaries explicitly: the scope applies at new-conversation start only, and the `/skill-name` gesture keeps working in any conversation.
- The scope entry is hero-only: the chip shows on the new-session screen, and ongoing conversations show nothing (their config is locked at conversation start).
- Tab / Shift+Tab focus is trapped inside the dialog (wrap at the first and last focusable).
- Host scope math (`deniedServers`, `keptSkillNames`) is exported as pure functions with direct unit tests; legacy blacklist display and search reset on reopen are covered by behavior specs (30 specs total).

## [0.1.0] - 2026-08-16

### Added
- Per-workspace Skill and MCP enablement, stored in `.dsh-scope.json` (whitelist semantics; legacy default/blacklist configs read compatibly).
- Dialog on the new-session screen: search box, collapsible groups, per-row switches with expandable details, enable all / disable all / save.
- Session lock: the config applies to new conversations only; the `/skill-name` gesture still loads excluded skills.
- Dual data channel: static webServer routes plus dynamic sandbox RPC for hot testing.
- Test suite (vitest), GitHub Actions CI, bilingual README with a data-flow diagram, English AGENTS.md, CONTRIBUTING.