fix: restore packaged runtimes and ship macOS DMG only

Desktop 0.12.7 omitted OpenCode's offline node_modules because the resource
copier excludes node_modules at its source root. Copy from the parent and
verify every prepared configuration file in the final package. Bundle DSH
session projection with the unpacked Host instead of leaving an ASAR-only
external import, and reject external DeepSeek imports in shipped chunks.

Run packaged OpenCode plugin import and the real DSH UtilityProcess handshake
in Windows x64 CI before removing unpacked output. Add regressions using the
actual electron-builder copier and Vite externalization configuration.

Prepare approved Desktop 0.12.8 notes and change macOS defaults and CI to DMG
only. Update aggregation, website downloads and update readers for 12
installers and 20 assets. Current readers retain historical DMG/ZIP support;
the user accepts that older macOS GitHub readers and all older mirror readers
need manual upgrades. Agent remains 0.11.21, with no new Agent or LoongArch tag.

Validation: 3608 tests passed, 0 failed, 61 skipped across 339 files;
typecheck, lint, release-note validation, website static checks and 18 website
tests passed. No local production build or packaged-app launch was performed
at the user's request; actual packaged startup validation runs in CI.

Release note: 修复安装后 OpenCode 离线依赖缺失和 DeepSeek Harness Host 启动退出；macOS 改为仅提供 DMG，受影响旧版用户需从下载页手动升级。

docs/development/release-runbook.md

@@ -38,9 +38,19 @@ below.
   `npm run release:package -- --platform <platform> --arch <arch>`. It only
   packages for the native host and writes to
   `dist/release/<platform>-<arch>`.
-- Default deliverables are NSIS and portable ZIP for Windows, DMG and ZIP for
+- Default deliverables are NSIS and portable ZIP for Windows, DMG for
   macOS, and AppImage, DEB, and RPM for Linux. Every target includes
   `release-manifest.json` with SHA-256 hashes.
+- Starting with Desktop 0.12.8, macOS releases contain DMG only. Older macOS
+  GitHub update readers and all older mirror readers require ZIP and cannot
+  validate this new matrix; affected users must upgrade manually from the
+  download page. The user approved this immediate format change. Current
+  readers accept both the historical DMG/ZIP matrix and the DMG-only matrix.
+- Final Desktop package verification compares every bundled OpenCode
+  configuration file with the prepared dependency tree and rejects external
+  DeepSeek imports in the unpacked Host and chunks. Windows x64 CI also
+  imports the packaged OpenCode plugin and starts an isolated packaged
+  UtilityProcess before publishing; source-only tests do not replace it.
 - `build/build-release.cjs` verifies the unpacked application, `app.asar`,
   bundled Continue and OpenCode runtimes, executable architecture, and package
   signatures before atomically replacing a release directory.
@@ -211,12 +221,12 @@ surface together before a new release.
   It must be able to write immutable version objects and the final latest
   pointer without granting unrelated administration privileges.
 - Upload release assets and `site-release.json` under the immutable
-  `releases/<tag>/` prefix first. Verify all 14 installer URLs publicly before
+  `releases/<tag>/` prefix first. Verify all 12 installer URLs publicly before
   creating or publishing the GitHub Release. Update
   `releases/latest.json` only after the GitHub Release is public and all prior
   checks succeeded.
-- The expected GitHub Release contains 22 assets: 14 installers (two formats
-  for each Windows/macOS target and three formats for each Linux target), six
+- The expected GitHub Release contains 20 assets: 12 installers (two formats
+  for each Windows target, DMG for each macOS target, and three formats for each Linux target), six
   renamed target manifests, one aggregate `release-manifest.json`, and one `SHA256SUMS`.
   `site-release.json` is an OSS publication artifact, not a GitHub Release
   asset.
@@ -269,17 +279,17 @@ Do not report a release complete until all of the following are verified:
 2. The public GitHub Release is non-draft, non-prerelease, marked Latest, and
    uses the expected tag and title. Its body must exactly match the Markdown
    generated from the approved packaged bilingual notes.
-3. GitHub release metadata contains exactly the expected 22 uploaded asset
+3. GitHub release metadata contains exactly the expected 20 uploaded asset
    names, including the expected Windows x64 and arm64 assets. Do not download,
    hash, launch, or send individual network probes to published installers
    unless the user explicitly requests that additional validation.
 4. The Beijing `releases/latest.json` returns HTTP 200, has the expected stable
-   version, exact six targets and 14 installer entries, the trusted Beijing
+   version, exact six targets and 12 installer entries, the trusted Beijing
    URLs, and the GitHub fallback URL. It must match the immutable
    `releases/<tag>/site-release.json`. Fetching and comparing these small JSON
    metadata files is sufficient; rely on the successful publication job for
    its per-asset public checks.
-5. The live website successfully fetches the index and produces the 14 correct
+5. The live website successfully fetches the index and produces the 12 correct
    platform/architecture/format links from that metadata.
 6. Both remote `main` refs and both peeled tag refs still equal the approved
    release commit, and the local working tree is clean.

docs/features/assistant-workbar/progress.md

@@ -1,5 +1,18 @@
 # 工作栏实现与验证进度
 
+## 2026-09-08 Desktop 0.12.8 安装包修复
+
+- 真实 `0.12.7` 安装目录确认 OpenCode 配置缺少整个 `node_modules`。新增测试调用实际
+  electron-builder 资源复制器，复现相同 ENOENT；把复制源上移到 `.runtime-resources`
+  后，插件及传递依赖逐文件复制验证通过。
+- 真实安装的 DSH bootstrap 存在 `dsh-session-projection` 外部导入，而 Host 解包目录没有
+  对应依赖。将其加入 Vite bundling，配置回归从失败转为通过；最终包会拒绝同类外部导入。
+- Windows x64 CI 已接入包内 OpenCode 插件导入、真实 DSH UtilityProcess 握手及 npm
+  探针，位于解包目录清理和发布之前。用户要求不做本地打包；CI 探针结果尚待本候选执行，
+  不能把当前源码回归通过当作真实发布包已通过。
+- 本次不改变 Agent `0.11.21` 源码或包。macOS 改为 DMG-only，用户明确接受旧版客户端
+  手动升级影响；格式与发布规则见[发布手册](../../development/release-runbook.md)。
+
 ## 2026-09-08 Execute 目录权限等待修复
 
 - 本机 OpenCode 的内部配置显式允许默认工具权限；每次 Ask 仍设置 deny-all 会话规则并

docs/features/deepseek-harness/technical-design.md

@@ -141,6 +141,9 @@ Harness 子进程内控制面不能取代 Main 控制面，Main 控制面也不
 Harness Session 只在当前 Runtime 进程生命周期内存在。释放 GoodBuddy 会话时必须同步释放对应 Harness Agent。
 固定 Host 显式加载 `dsh-session-projection` 的内存 SessionProjectionRegistry，这是
 `0.1.2-rc.1` AgentLoop 的必需依赖；不加载 Session persistence，也不新增磁盘会话副本。
+该依赖与其余 DSH 依赖一起由 Vite 打入 Host，不能从 `app.asar.unpacked` 外部导入
+仅存在于 `app.asar` 的 npm 包。最终打包检查及 Windows CI 的真实 UtilityProcess
+启动探针见 [Runtime 资源与打包](../../../BUILD.md#runtime-资源)。
 
 ## 6. 总体架构
 

docs/features/remote-host/technical-design.md

@@ -12,7 +12,7 @@ Linux x64/arm64、取消和离线 GoodBuddy 传输的真实 Host 验收。
 Windows 到 Linux x64 的安装、Agent-owned Prompt、Agent 本地模型 gateway、断线恢复、
 同一 OpenCode Session 续接、取消和终态清理已经使用真实模型与工具验证。Agent
 `0.11.14` 已通过独立 workflow 发布 Linux x64/arm64 复合包和签名累计目录；当前未发布
-Agent 源码 lock 为 `0.11.21`，Desktop 候选为 `0.12.7`，等待各自独立发布审批。
+Agent 源码 lock 为已发布的 `0.11.21`，Desktop 候选为 `0.12.8`；本次桌面打包修复不重发 Agent。
 现有源码显示本地与远端 OpenCode 原生 Task，并取消 GoodBuddy 对生产 Prompt 的
 固定墙钟总时限。失败的 `agent-v0.11.3` 保持不可变且未发布。