feat: update dsh and openclaw

Author: zhengkunwang223

.github/workflows/deepseek-harness-release.yml

@@ -5,7 +5,7 @@ on:
     inputs:
       dshVersion:
         description: "@deepseek-ai/dsh npm version"
-        default: "0.1.1-rc.2"
+        default: "0.1.2-rc.1"
         required: true
       platforms:
         description: "Platforms"

.github/workflows/openclaw-release.yml

@@ -7,8 +7,8 @@ on:
   workflow_dispatch:
     inputs:
       openclawTag:
-        default: "2026.9.1"
-        description: "OpenClaw release and Docker Hub tag, for example 2026.9.1"
+        default: "2026.9.2"
+        description: "OpenClaw release and Docker Hub tag, for example 2026.9.2"
         required: true
       pushLatest:
         description: "Push latest tag"

deepseek-harness/Dockerfile

@@ -2,7 +2,7 @@ FROM caddy:2.11.4 AS caddy
 
 FROM node:24-bookworm-slim AS dsh-builder
 
-ARG DSH_VERSION=0.1.1-rc.2
+ARG DSH_VERSION=0.1.2-rc.1
 
 RUN apt-get update && \
     DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \

deepseek-harness/docker-entrypoint.sh

@@ -65,6 +65,7 @@ gosu node env \
   HOME=/data/dsh/home \
   DSH_HOME=/data/dsh \
   DSH_TELEMETRY_DISABLED=1 \
+  ONEPANEL_DSH_AUTH_PROXY=1 \
   node --expose-internals /usr/local/lib/node_modules/@deepseek-ai/dsh/lib/bin.js \
     web --host 127.0.0.1 --port 3080 \
       --trusted-host 127.0.0.1:3080 "$access_host" &

deepseek-harness/patch-dsh-authenticated-settings.mjs

@@ -5,6 +5,7 @@ import { dirname, join, resolve } from 'node:path'
 const dshRoot = resolve(process.argv[2] ?? '/usr/local/lib/node_modules/@deepseek-ai/dsh')
 const requireFromDsh = createRequire(join(dshRoot, 'package.json'))
 const flag = 'globalThis.__DSH_AUTHENTICATED_SETTINGS__ === true'
+const proxyAuthFlag = 'process.env.ONEPANEL_DSH_AUTH_PROXY === "1"'
 
 async function packageRoot(name) {
   const manifestPath = requireFromDsh.resolve(`${name}/package.json`)
@@ -28,18 +29,25 @@ const settingsPath = join(
 let settings = await readFile(settingsPath, 'utf8')
 settings = replaceOnce(
   settings,
-  'new SettingsScopeController(connection.api, spec, this.mirror, connection.isLoopback ? "host" : "memory", this.schema)',
-  `new SettingsScopeController(connection.api, spec, this.mirror, connection.isLoopback || ${flag} ? "host" : "memory", this.schema)`,
-  'settings scope',
-)
-settings = replaceOnce(
-  settings,
-  'new SettingsDescribeMirror(connection.api, connection.isLoopback ? "host" : "memory")',
-  `new SettingsDescribeMirror(connection.api, connection.isLoopback || ${flag} ? "host" : "memory")`,
-  'settings mirror',
+  'const persistence = ctx.remote.$host.isLoopback ? "host" : "memory";',
+  `const persistence = ctx.remote.$host.isLoopback || ${flag} ? "host" : "memory";`,
+  'settings persistence',
 )
 await writeFile(settingsPath, settings, 'utf8')
 
+const connectionPath = join(
+  await packageRoot('@deepseek-ai/dsh-client-connection'),
+  'lib/index.js',
+)
+let connection = await readFile(connectionPath, 'utf8')
+connection = replaceOnce(
+  connection,
+  'isAuthenticated(request) {\n\t\tconst authority = requestAuthority(request.headers);',
+  `isAuthenticated(request) {\n\t\tif (${proxyAuthFlag}) return true;\n\t\tconst authority = requestAuthority(request.headers);`,
+  'browser proxy authentication',
+)
+await writeFile(connectionPath, connection, 'utf8')
+
 const frontendPath = join(
   await packageRoot('@deepseek-ai/dsh-web-frontend'),
   'dist/index.html',
@@ -53,6 +61,10 @@ if (moduleScripts.length !== 1 || frontend.includes(bootstrap)) {
 frontend = frontend.replace(moduleScripts[0], `  ${bootstrap}\n${moduleScripts[0]}`)
 await writeFile(frontendPath, frontend, 'utf8')
 
-if ((settings.split(flag).length - 1) !== 2 || !frontend.includes(`${bootstrap}\n${moduleScripts[0]}`)) {
+if (
+  (settings.split(flag).length - 1) !== 1 ||
+  (connection.split(proxyAuthFlag).length - 1) !== 1 ||
+  !frontend.includes(`${bootstrap}\n${moduleScripts[0]}`)
+) {
   throw new Error('authenticated settings patch verification failed')
 }

openclaw/Dockerfile

@@ -83,6 +83,7 @@ COPY scripts/postinstall-bundled-plugins.mjs scripts/preinstall-package-manager-
 COPY scripts/lib/guard-inventory-utils.mjs ./scripts/lib/guard-inventory-utils.mjs
 COPY scripts/lib/package-dist-imports.mjs ./scripts/lib/package-dist-imports.mjs
 COPY scripts/lib/package-lifecycle-marker.mjs ./scripts/lib/package-lifecycle-marker.mjs
+COPY scripts/docker/verify-fs-safe-native.mjs ./scripts/docker/verify-fs-safe-native.mjs
 COPY scripts/docker/verify-native-addons.sh ./scripts/docker/verify-native-addons.sh
 
 COPY --from=workspace-deps /out/packages/ ./packages/
@@ -269,6 +270,8 @@ COPY --from=runtime-assets --chown=node:node /app/skills ./skills
 COPY --from=runtime-assets --chown=node:node /app/docs ./docs
 COPY --from=runtime-assets --chown=node:node /app/qa ./qa
 COPY openclaw/docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
+RUN --mount=from=dependency-inputs,source=/app/scripts/docker/verify-fs-safe-native.mjs,target=/tmp/verify-fs-safe-native.mjs \
+    node /tmp/verify-fs-safe-native.mjs --package-root /app --mode require
 
 # Validate the release version on every runtime surface.
 ARG OPENCLAW_DOCKER_BUILD_VERSION