techflag · Oct 18, 2026 · Oct 18, 2026 · Oct 18, 2026 · Oct 18, 2026 · Oct 18, 2026
diff --git a/.github/release-notes/desktop-v3.0.0-alpha.1.md b/.github/release-notes/desktop-v3.0.0-alpha.1.md
@@ -0,0 +1,36 @@
+# WorkDSH Desktop 3.0.0-alpha.1
+
+每个人，都能定制自己的 AI 服务。
+
+本次 Alpha 更新统一升级至官方 **DeepSeek Harness 0.2.1-rc.1**，并改进桌面运行诊断、工作台共用交付流程与发行校验。README 顶部提供完整系统实录，包含中文配音、字幕及开源地址。
+
+## 更新内容
+
+- Desktop 与 Web 固定到同一 DSH 版本。官方运行依赖从校验过的发行文件提取，桌面端继续使用完整官方客户端。
+- 桌面启动失败时显示实际原因与脱敏后的近期运行输出，并保留本机错误记录；进程清理失败不会再覆盖启动原因。
+- 新工作区在默认本机端口被占用时可选择独立端口；已有工作区保留原地址，避免页面数据因地址变化而看似丢失。错误弹框显示简短原因，完整脱敏输出保存在本机日志中。
+- 基础 Desktop Profile 加入工作台平台，与连接器、专家、资料库、项目和 Skill 共六个默认 WorkDSH bundle。工作台统一需求确认、开发、启动检查、安装状态核对与试用验收，支持中断后恢复。
+- 视频展示使用平台生成的旅行应用，可持续管理多次旅行，每次有独立行程、预算和清单；基础安装包不预装该业务示例。
+- 改进发行脚本的首次依赖安装顺序，检查 Profile 依赖、平台运行文件与归档完整性。
+- 共用交付脚本使用随包 Node 和 pnpm，不依赖系统 npm；构建不自动切换包管理器或安装依赖，打包不重复执行构建脚本。
+- 开发工程从实际安装位置解析公共 SDK，支持安装目录与可写工作区分离；重开制作记录保留原生会话和已保存需求。安装核验明确区分“未检查启用”与“启用失败”，按实际 bundle 继续处理，并在当前已登录的宿主页面验收。
+- 企业连接继续作为独立插件下载并显式安装，基础安装包不预装企业账号与协作插件。
+
+## 发行文件
+
+- Windows x64：`WorkDSH-3.0.0-alpha.1-x64-Setup.exe` 安装程序。
+- macOS Apple Silicon arm64 / Intel x64：对应架构的 `WorkDSH-3.0.0-alpha.1-<arch>.dmg`。本次 DMG 未签名。
+- 企业连接：`workdsh-enterprise-connection-0.1.0-alpha.2.tgz`，另附 ZIP、兼容版本清单及校验信息；在“插件 → 添加插件”中安装 TGZ。
+- 附件名称含构建平台前缀，所有文件的 SHA-256 见 `SHA256SUMS`。
+
+## 验证范围
+
+发行门禁覆盖源码构建、类型检查、自动化回归和 Windows x64、macOS x64/arm64 打包，并在实际随包运行时中检查完整 Host、六个必需产品服务及客户端资源。自动检查不代表各平台全部真实交互与企业后台均已验收；Web 预览也不能代替 Desktop 打包运行时验收。
+
+工作台外框适配限定官方 DSH `0.2.1-rc.1` 的两个外框接缝，并校验原始文件与适配后文件的摘要；未知版本或文件内容不匹配时停止处理。官方 Header、对话视图、Composer 与右侧栏的完整组件及状态归属保持不变。该适配不代表所有业务工作台已经完成界面与数据验收。
+
+当前为 Alpha 预发布，升级前请备份本地配置和数据。SkillHub、dsh-market 为独立第三方来源，目录内容并非全部预装或经 WorkDSH 审核，安装前请核对许可、依赖与版本兼容性。
+
+已有工作区若安装了仅适配旧 DSH 的第三方插件，官方插件管理器会阻止升级并恢复原依赖。例如 `sigmapad-plugin@0.1.0-alpha.180` 要求 DSH `0.2.0-rc.2`，与本次底座不兼容；需由插件方提供适配版本，再通过官方插件管理器升级。WorkDSH 不会自动删除或禁用这类插件，也不会绕过版本检查。干净新安装不包含此第三方插件。
+
+开源地址：[github.com/techflag/workdsh](https://github.com/techflag/workdsh)
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -47,7 +47,7 @@ jobs:
           HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
         run: |
           set -euo pipefail
-          node --test scripts/bilingual-docs.test.mjs
+          node --test scripts/bilingual-docs.test.mjs scripts/ci-scope.test.mjs
           node scripts/verify-bilingual-docs.mjs
           if [[ "$EVENT_NAME" == "workflow_dispatch" || "$REF_TYPE" == "tag" ]]; then
             product=true
@@ -61,8 +61,8 @@ jobs:
             git diff --check "$BASE_SHA" "$HEAD_SHA"
             product="$(git diff --name-only -z "$BASE_SHA" "$HEAD_SHA" | node scripts/classify-ci-changes.mjs)"
             changed_paths="$(git diff --name-only "$BASE_SHA" "$HEAD_SHA")"
-            if [[ -n "$changed_paths" ]] && grep -Eq '^(apps/web/|packages/|profiles/)' <<< "$changed_paths"; then web=true; else web=false; fi
-            if [[ -n "$changed_paths" ]] && grep -qv '^apps/web/' <<< "$changed_paths"; then desktop=true; else desktop=false; fi
+            if [[ -n "$changed_paths" ]] && grep -Eq '^(apps/web/|packages/|profiles/)|^scripts/native-workbench-frame-patch\.(mjs|json|d\.mts)$' <<< "$changed_paths"; then web=true; else web=false; fi
+            if [[ "$product" == "true" && -n "$changed_paths" ]] && grep -qv '^apps/web/' <<< "$changed_paths"; then desktop=true; else desktop=false; fi
           fi
           echo "product=$product" >> "$GITHUB_OUTPUT"
           echo "desktop=$desktop" >> "$GITHUB_OUTPUT"
@@ -360,25 +360,14 @@ jobs:
         shell: bash
         run: |
           VERSION="${TAG#desktop-v}"
-          cat > release-notes.md <<'EOF'
-          WorkDSH Desktop 将 WorkBuddy 风格的项目、资料、专家、技能和连接器工作台与 DeepSeek Harness 插件能力结合。
-
-          - 本地插件压缩包按内容校验后保存到应用管理目录，安装后移动或删除原始下载文件不再阻挡后续安装。
-          - 新会话创建独立空白会话，不沿用旧草稿的专家、MCP 或资料选择；明确切换专家仍保留当前草稿与引用。
-          - 修复 macOS 召唤或切换专家时的 Dock 闪动，后台浏览器从原生启动阶段保持无 Dock 图标，主窗口正常显示。
-          - 对话框可直接召唤专家并显示当前专家名称；切换专家保留资料库的可点击引用和 MCP 选择。
-          - 资料库支持 CSV/XLSX 导入；专家、资料库和 MCP 的选择浮层保持一致。
-          - 内置 MCP 示例随当前安装包定位运行文件，避免升级后引用旧路径。
-          - 技能页接入 SkillHub 目录，可查看技能图标、来源、版本与安装入口；本地技能仍可单独管理。
-          - 现有插件页可直接发现 DSH 社区插件，并打开第三方 dsh-market 目录进行搜索和安装。
-          - Desktop 使用与源码锁一致的官方 DSH Profile；内置 Node.js 和 Python，不额外打包浏览器。
-          - 企业连接作为独立 tgz 附件下载，在个人空间“插件 → 添加插件”输入下载文件的完整路径安装，再进入“设置 → 企业账号 → 连接企业”；无需第三方市场。基础安装包不预装企业插件。
-          - 提供 Windows x64 安装包，以及 macOS Intel x64、Apple Silicon arm64 未签名 DMG。
-
-          SkillHub 和 dsh-market 是独立第三方来源；目录内容并非全部预装或经 WorkDSH 审核。安装前请检查许可、依赖和版本兼容性。本次为 Alpha 预发布，升级前请备份本地配置和数据。所有文件的 SHA-256 见 `SHA256SUMS`。
-          EOF
+          NOTES_FILE=".github/release-notes/${TAG}.md"
+          test -s "$NOTES_FILE"
+          release_flags=(--latest)
+          if [[ "$VERSION" == *-* ]]; then
+            release_flags=(--prerelease --latest=false)
+          fi
           gh release create "$TAG" release-assets/* \
             --repo "$GITHUB_REPOSITORY" \
             --title "WorkDSH Desktop ${VERSION}" \
-            --notes-file release-notes.md \
-            --latest
+            --notes-file "$NOTES_FILE" \
+            "${release_flags[@]}"
diff --git a/AGENTS.md b/AGENTS.md
@@ -33,7 +33,7 @@ This repository owns WorkDSH Web and Desktop. Desktop and Web consume the same e
 
 ## Current authorized npm migration
 
-- The user explicitly requires the latest published DSH release, currently `0.2.1-rc.1` (2026-10-17). `upstream.json` locks the same npm target and downloaded official Desktop artifacts. Web preview opens the complete native Conversation through public Workspace/Layout APIs, without embedded custom conversation controls; the narrowly authorized local-preview outer-frame patch below applies. Matching artifact hashes do not prove Desktop packaged-runtime acceptance; do not package or release Desktop until its runtime checks pass.
+- The user explicitly requires the latest published DSH release, currently `0.2.1-rc.1` (2026-10-17). `upstream.json` locks the same npm target and downloaded official Desktop artifacts. Web preview and Desktop preserve the complete native Conversation, using public Workspace/Layout APIs and only the narrowly authorized shared outer-frame patch below, without embedded custom conversation controls. Matching artifact hashes do not prove Desktop packaged-runtime acceptance; do not release Desktop until its runtime and UI checks pass.
 
 ## Personal and enterprise product boundary
 
@@ -46,7 +46,7 @@ This repository owns WorkDSH Web and Desktop. Desktop and Web consume the same e
 
 - Never clone, import or compile official DSH source as part of product builds. `upstream.json` locks published package versions and Desktop archive URLs, sizes and SHA-512 hashes. Extract only runtime dependencies, Office assets and prebuilt command helpers; do not carry a second official Electron application or DSH installation.
 
-- Explicit user-authorized exception (2026-10-17): local Web preview may apply the exact-version/checksum-locked `native-workbench-frame-patch` for official `0.2.1-rc.1` to restore the rightmost complete native Conversation. Only the two outer-frame seams may change; preserve original headers, views, Composer and right-sidebar owners. Fail closed on unknown bytes and keep exact rollback. This does not authorize Desktop packaging or release patches.
+- Explicit user-authorized exception (Web preview 2026-10-17; Desktop packaging and release 2026-10-18): both may apply the same exact-version/checksum-locked `native-workbench-frame-patch` for official `0.2.1-rc.1` to restore the rightmost complete native Conversation. Only the two outer-frame seams may change; preserve original headers, views, Composer and right-sidebar owners. Fail closed on unknown bytes, verify the packaged result and keep exact rollback. Desktop release still requires actual packaged-runtime and UI acceptance; no other official file changes are authorized.
 
 ## Delivery regression gate
 

diff --git a/apps/desktop/README.i18n.yaml b/apps/desktop/README.i18n.yaml
@@ -1,3 +1,3 @@
+README.md: 7b9fd895c8a2e0ecb4a77c4cf09ff02b4f9149e5
+README.zh.md: 6c1e914ccc678da3a4ce50046646a40f23cac5a8
 # Both languages carry equal authority; these Git blob hashes record the current consistent pair.
-README.md: dee36148df4db7857c9a4265c9bfe3c211b153cf
-README.zh.md: cea9c21fc39bf43323d9112b5eb0c5db26033cdf
diff --git a/apps/desktop/README.md b/apps/desktop/README.md
@@ -2,13 +2,13 @@
 
 [中文](README.zh.md)
 
-This package builds the Electron application and contains one bundled personal runtime Profile. Official DeepSeek Harness owns the Host, full Web Client and core execution; WorkDSH feature packages supply shared experts, Skills, Library and MCP/connectors. These are the default owned feature boundary, not a promise that every definition or MCP service is preinstalled. The enterprise account plugin is carried in the immutable runtime and selected only after enterprise login; personal defaults do not activate it. Collaboration and notifications remain explicitly installed external plugins.
+This package builds the Electron application and contains one bundled personal runtime Profile. Official DeepSeek Harness owns the Host, full Web Client and core execution; shared WorkDSH feature packages supply the product capabilities selected by the reviewed Profile. This does not preinstall every expert definition, Skill or MCP service. Enterprise identity and collaboration are installed explicitly as external plugins and are not included in the base installer. Notifications and independent business applications are also optional external plugins.
 
 ## Personal and enterprise connections
 
-The carrier first shows a personal/enterprise chooser. Personal mode starts the personal local Home/Profile. The enterprise administrator fixes the company HTTPS backend origin when packaging; enterprise mode authenticates the verified organization/member in Main; HTTP is allowed only for loopback development. It then runs the same official DSH locally in the member's separate space, rather than opening remote enterprise Web. Enterprise Web continues to run per-account processes on ECS.
+The carrier first shows a personal/enterprise chooser. Personal mode starts the personal local Home/Profile. The enterprise administrator fixes the company HTTPS backend origin when packaging; enterprise mode authenticates the verified organization/member in Main; HTTP is allowed only for loopback development. It then runs the same official DSH locally in the member's separate space, rather than opening remote enterprise Web. Enterprise execution remains on the employee's Desktop; the server provides accounts, authorization, collaboration data and model forwarding.
 
-The enterprise account plugin loads from the packaged official dependency graph without an employee tgz installation step. A missing, incompatible or member-local shadowing package prevents enterprise startup. Personal defaults do not select enterprise identity; collaboration and notifications are not automatically installed. Backend, organization and member determine separate configuration, credentials, skill roots and window storage, while both modes use the same official client, settings and right panel. This change supplies account/body adapters without automatically installing collaboration or notifications.
+Install and activate the Enterprise Connection archive in the personal space before company login. Missing or incompatible enterprise packages prevent enterprise startup. Backend, organization and member determine separate configuration, credentials, skill roots and window storage; both modes use the same official client, settings and right panel. Installing a plugin does not grant membership or business permissions; the backend verifies them.
 
 The backend bearer stays in Main memory; business pages and the DSH CLI never receive it. A controlled loopback interface rechecks the fixed account for each operation and exposes only account, logout and visible-body synchronization. The plugin reuses its account page, showing the organization name, sync status, retry/delete and logout.
 
@@ -23,7 +23,7 @@ The enterprise administrator copies `config/enterprise.example.json`, sets the b
 ```
 
 ```sh
-WORKDSH_DEPLOYMENT_CONFIG=/absolute/path/company.json corepack yarn package:dir
+WORKDSH_DEPLOYMENT_CONFIG=/absolute/path/company.json corepack yarn workspace dsh-plugin-desktop package:dir
 ```
 
 Packaging writes the validated configuration to `workdsh-config.json` in application Resources. Employees see the fixed address and cannot override it. Only `enterprise.backendUrl` is accepted; passwords and Keys are rejected. Personal builds without this environment variable generate empty configuration and cannot inherit a previous company's address. Development uses `corepack yarn dev` with manual setup or `WORKDSH_ENTERPRISE_PORTAL` prefill; this is not the managed deployment configuration.
@@ -34,8 +34,9 @@ Use Node.js `^22.19.0` or `>=24` and Corepack Yarn 4.18.0. At the repository roo
 
 ```sh
 corepack yarn install --immutable
-corepack pnpm --dir workdsh-web build
-node apps/desktop/scripts/pack-workdsh-profile.mjs workdsh-web
+corepack pnpm --dir apps/web install --frozen-lockfile
+corepack pnpm --dir apps/web build
+node apps/desktop/scripts/pack-workdsh-profile.mjs apps/web
 corepack yarn dev
 ```
 
@@ -52,8 +53,8 @@ corepack yarn check:desktop-dsh-alignment
 
 `corepack yarn release:pack` builds and packages the same commit's Web sources and the reviewed Desktop composition, preserving the clean-source release gate. The Web release directory also receives `desktop-release-manifest.json` and its hash-named archives for published Desktop packaging.
 
-Build the four owned features, their required support packages and the enterprise account package in WorkDSH first. `pack-workdsh-profile.mjs` creates immutable archives and a version/hash manifest in `build/workdsh-profile-release`; select another candidate with `WORKDSH_RELEASE_DIRECTORY`. Runtime preparation installs the official version with a portable lockfile and carries pnpm's JavaScript CLI for explicit plugin operations. It rejects additional default feature packages and verifies the real plugin manager exposes exactly four WorkDSH bundles. The same Profile preserves the pinned SkillHub 0.2.16 and dshmarket 1.66.8 catalog integrations. Their catalog entries are not all installed or reviewed by WorkDSH. It does not package a live user's configuration or credentials.
+Build the shared features and their required support packages first. `pack-workdsh-profile.mjs` creates immutable archives and a version/hash manifest in `build/workdsh-profile-release`; select another candidate with `WORKDSH_RELEASE_DIRECTORY`. Runtime preparation installs the official version with a portable lockfile and carries pnpm's JavaScript CLI for explicit plugin operations. The package inventory in `scripts/workdsh-package-boundary.mjs` defines the reviewed default bundles and required support packages; enterprise plugins are excluded from the base installer. The same Profile preserves the pinned SkillHub 0.2.16 and dshmarket 1.66.8 catalog integrations. Their catalog entries are not all installed or reviewed by WorkDSH. It does not package a live user's configuration or credentials.
 
-The Desktop pin and shared product target are **DSH 0.2.0-rc.2**, selected explicitly by the user. The unmodified official `dsh-v0.2.0-rc.2` tag pins commit `639ed015397290b3745d163aafe02ffee4aa3f84`. Existing installed applications and Profiles have their own actual versions. Desktop alignment, Desktop checks and packaged-runtime acceptance must pass before declaring the unified upgrade complete; Web Docker evidence cannot replace those gates. Prefer validated official stable releases by default.
+`upstream.json` locks Desktop and Web to the same official **DSH 0.2.1-rc.1** release, as explicitly required by the user. Published packages and checksum-locked official Desktop archives supply the runtime; product builds do not import or compile official source. Existing applications and Profiles have their own actual versions. Alignment, Desktop checks and packaged-runtime acceptance must pass before declaring an upgrade complete; Web preview evidence cannot replace them. Prefer validated official stable releases by default.
 
-The upstream checkout remains read-only. The carrier source and packaging scripts live here; feature package source belongs to WorkDSH, and the server launcher/gateway recipe is owned by its deploy/member-process directory. See [Desktop ownership](../../docs/desktop-boundaries.md).
+The carrier source and packaging scripts live here; shared WorkDSH feature sources live under the repository's `packages/`. Official DSH packages are consumed without a source checkout. Enterprise administration and model forwarding belong to the separate WorkDSH Admin repository. See [Desktop ownership](../../docs/desktop-boundaries.md).