Adapt accessibility core to DSH 0.1.7-alpha.1

[mattheliu]

Targets official dsh-v0.1.7-alpha.1 exactly. Re-ports keyboard, focus, naming, live-announcement, quiet CLI, and reading-view ownership changes into the current Session V4/grouped conversation architecture. Preserves archived/pinned sessions and current settings/plugin surfaces. Includes narrow-viewport plugin inventory reflow and Firefox native scroll-container focus handling.

Local validation: official build and type checks; 7,396 GUI tests passed with 1 skip; 486 complete Web replay tests passed with 15 conditional skips; core accessibility Chromium 14 passed, Firefox/WebKit 13 passed plus 1 unsupported forced-colors skip each; companion assembled integration 5 passed; 42 documentation gates and 3 actual corpus checks passed. Historical Session generations remain intact; new V4 generations and shared-source references are validated.

Candidate tag: dsh-v0.1.7-alpha.1-a11y.2. No full accessibility or real-AT claim: VoiceOver/NVDA and disabled-developer task evidence remain pending. Existing human campaigns are not retargeted. This PR compares only against the exact official baseline, not the older fork master.

Follow-up validation (2026-09-22): core 41074ff repairs retired Windows test paths, upstream-only Project credentials, test unknown casts, and the migrated heartbeat fixture idle window. 124 focused tests passed; the final terminal recheck passed 20 tests and the corrected heartbeat scenario passed. Static rehearsal passed 57 gates; its two failed gates passed individual rechecks after repair. Prior full GUI/Web/browser results above belong to b11b37b. The first companion remote run passed all six OS/Node matrix jobs and assembled checks. New exact-revision remote CI is pending; do not treat it as passed or publish yet. Real assistive-technology evidence remains pending.

[mattheliu]

Pre-merge audit (2026-09-22): inspected tracked text in both workspaces (13,153 core files and 175 companion files), the additions in 39 core and 7 companion commits relative to the PR bases, and the companion npm dry-run inventory (126 files, including its generated source map). No real credentials, personal machine paths, or private intranet addresses were found in the adaptation changes or candidate package. Scanner hits in existing source were synthetic security-test inputs or unchanged upstream examples; this is a scoped review, not a comprehensive security certification.

Current-revision local checks: core 41074ff + companion ae689cdc passed the five assembled browser tests (Chromium, Firefox, WebKit); 76 focused privacy/evidence/reading-view checks passed. Repositories are clean. These runs use synthetic/replayed conversations, not live-provider, VoiceOver/NVDA, or disabled-user evidence. Raw lab readiness logs are not public evidence and are not included in the npm package.

No npm publication is authorized by this merge step. Preserve the pending human-AT status and historical evidence versions.

[mattheliu]

Merge-check follow-up: 2f7eaf7865, immutable candidate dsh-v0.1.7-alpha.1-a11y.3.

• Fixed a real keyboard issue found by the new regression: ArrowUp/ArrowDown on an already-open subagent trigger also bubbled to the tree navigation handler and moved focus twice.
• Added missing permission-restoration, empty-catalog, and conflicting JSON mode coverage. Focused coverage: 279 tests passed; all five targeted source files reached 100% statements, branches, functions, and lines.
• Updated migrated PowerShell cancellation tests to observe the command after warmup, and the real shell fixture to release its owned barrier before awaiting prompt completion. Cross-platform fixtures keep relative paths relative across drives, own the ACL inheritance under test, and wait for the actual Client registry instead of a populated Sessions tree. Windows execution is still required in this new CI run.
• Local complete GUI: 7,398 passed, 1 skipped. Complete read-only Web replay: 486 passed, 15 conditional skips across 143 files. Documentation: 20 quick and 42 full checks passed; lint and normal pre-commit/pre-push hooks passed.
• Real macOS PowerShell: all three pwsh shell cases passed using an official checksum-verified temporary runtime; broader shell tests passed 35 with one platform-dependent skip.
• An initial overlapping local Firefox run had one focus lookup failure; diagnostic reruns and the final isolated run passed. Final isolated browser results: Chromium 14 passed; Firefox and WebKit each 13 passed plus one unsupported forced-colors skip. Failed logs were not relabeled as passing.
• Incremental scan of the 128 added lines found no strong credential, credential-bearing URL, or personal-path matches. This remains a scoped scan, not a security certification.

The merge target remains baseline/dsh-v0.1.7-alpha.1; older master is not replaced. Wait for every remote check, including Windows coverage, before merging. No npm publication was performed. Real VoiceOver/NVDA and disabled-developer evidence remains pending.

[mattheliu]

Windows follow-up; merge remains gated

The a11y.3 run finished with 24 passing checks and one failure: Windows coverage. The Windows ACL runner suite passed all 19 tests. Two other tests failed:

• The private-cookie test assumed a fixed arrival order for the concurrently requested profile and balance endpoints. The observed Windows order was the reverse. The fixture now requires the same exact requests/count, login/logout order, cookies and credential/privacy assertions while accepting either order for only those two parallel requests.
• The repository-wide compiler inventory completed in about 65 seconds, exceeding its explicit 60-second override. Its budget now matches the coverage lane's existing 90 seconds; schema mutation and retired-field rejection assertions remain unchanged.

Candidate 0f8480ec06dcf099d4f4257be799f7f36d90c5d2 is tagged dsh-v0.1.7-alpha.1-a11y.4. All 112 focused local tests passed, along with normal commit/push hooks. This follow-up changes only two test files, not production behavior, coverage exclusions, or security policy. Earlier tags and failed-run evidence are retained.

The new CI run must pass in full, including Windows coverage, before merge to baseline/dsh-v0.1.7-alpha.1. Companion PR deepseek-ai#28 will use this exact new tag. No npm publication or real VoiceOver/NVDA/user certification is claimed.

[mattheliu]

Verified merge completed

• Core PR #4 merged into baseline/dsh-v0.1.7-alpha.1 as ba2f152e5b02e147c482ec883887a4f698ca2925. Its tree is exactly the tested 0f8480ec06 / dsh-v0.1.7-alpha.1-a11y.4 tree (5ec45b90ebad538317994d6ab6941abd756dd728). The older core master remains unchanged at 073359c4d5.
• Companion PR #28 merged into main as aac6ff34ad0b606332e236b871ae968095497431, following PR 前排打卡👀加油小鲸鱼🐳 deepseek-ai/deepseek-harness#27. Its tree is exactly the tested 7e45e13 tree (57d810f2e957d4d5e294e450958b19daec22343f).

Before either final merge, core CI had 25 passing checks, including both Linux and Windows coverage, with no pending/failing checks. Three scope-conditioned jobs were skipped: upstream issue policy, Cloudflare preview and credential-dependent real-API E2E. Companion CI passed all eight checks. Neither PR had unresolved review threads; both exact heads and bases were rechecked before squash merge.

The final core Linux instrumented run passed 33,723 tests with one expected failure and 121 conditional skips; its per-file coverage and uninstrumented-heavy gates passed. Remote Web replay passed 488 tests with 13 conditional skips. Final local follow-up evidence includes 112 focused core tests and five assembled external-plugin tests across Chromium, Firefox and WebKit. Earlier failed runs remain recorded separately.

Both local worktrees are clean. No npm publication was performed. Real VoiceOver/NVDA and disabled-developer observations remain pending; these automated checks are not an accessibility certification.