Windsander · Oct 29, 2026 · Oct 29, 2026 · Oct 29, 2026 · Oct 29, 2026 · Oct 29, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -15,6 +15,39 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 The GitHub Release body is extracted from this file: everything between the release's
 `## [vX.Y.Z]` heading and the next `## [` heading. Keep that section self-contained.
 
+## [v0.2.4] - 2026-10-29
+
+Agent adoption and Skill deployment release. All six npm packages and the desktop app
+ship as `0.2.4`; no runtime protocol or data-format changes are included.
+
+### Added
+
+- **Skill as a deployment artifact** — `connectClient`, App initialization, daemon startup, `mebular init`, and the `fleet --daemon` service path now ensure `mebular-memory` and `mebular-tasks` for detected clients. Installs include the `mcp/` fragments and a managed manifest.
+- **Settings · Common “Auto repair”** — one-click, confirmed repair of detected assistant MCP entries and Skills. Failures are reported per client with redacted, expandable details.
+- **All folder-based Agent targets** — OpenChamber/OpenCode, Hermes, Claude Code, Cursor and DeepSeek Harness each get their own detected global Skill directory; Claude Desktop remains a zip/UI upload flow.
+- **Agent routing hints** — all 29 MCP tools now start their descriptions with “何时用”, and the MCP server publishes global `instructions` for routing and memory/task discipline.
+- **SETUP runtime detection** — the agent playbook recognizes `runtime.json` + `/healthz` first, so an App runtime without a PATH CLI is not treated as uninstalled.
+
+### Changed
+
+- User-modified or unmarked Skills are preserved by default; only an explicit “Auto repair” force-overwrites the managed client assets.
+- The locked settings page no longer duplicates “New cloud / Join cloud”; those actions stay in the top bar, while the settings page keeps diagnostics and guidance.
+- Dependency maintenance: electron-builder and `@modelcontextprotocol/server` bumps.
+
+### Fixed
+
+- Managed-Skill cleanup now rejects absolute paths, drive letters, backslashes, empty segments, and `.`/`..` segments, preventing force repair from deleting files outside the Skill directory.
+- `repair-api` Windows CI uses a real `.cmd` test double; `runtime.json` parsing no longer depends on Node being on PATH.
+
+### Verified
+
+- PR #288 required checks: 8/8 passed, including Windows, build/test/lint, desktop smoke, WAN NAT, semantic recall, and real DSH E2E minimum/latest/Node 22.
+- PR #290 required checks: 8/8 passed; target matrix covers OpenChamber/OpenCode, Hermes, Claude Code, Cursor and DSH.
+- Local gates for the target matrix: `verify:mcp:skill`, `check:docs`, `check:i18n`, and the target-matrix Jest suites.
+- Packaging dry-run [run 40829880252](https://github.com/Windsander/Mebular/actions/runs/40829880252) passed: verify + 6 tarballs, macOS/Windows/Linux installers, and real DSH E2E minimum/latest/Node 22.
+- Real Agent E2E: OpenCode 2.0.29 with DeepSeek Flash loaded `mebular-memory`, called `memory_write` and stored a preference; a new session then called `memory_query`/`memory_profile` and recalled it. Temporary HOME only; real user data untouched.
+- App 0.2.4 packaged runtime boots and reports `0.2.4`; auto-install requires an initialized cloud and was validated through the packaged runtime + OpenCode path.
+
 ## [v0.2.3] - 2026-10-28
 
 Identity-focused maintenance release. All six npm packages and the desktop app

diff --git a/README.md b/README.md
@@ -61,14 +61,14 @@ Memory and tasks stay on your devices; devices sync directly.
 <table width="100%">
   <thead>
     <tr>
-      <th align="left" width="30%">Desktop app · v0.2.3</th>
+      <th align="left" width="30%">Desktop app · v0.2.4</th>
       <th align="left">Download &amp; first launch</th>
     </tr>
   </thead>
   <tbody>
     <tr>
       <td><strong>Unsigned release</strong><br><sub>macOS Universal · Windows x64 · Linux x64</sub></td>
-      <td><a href="https://github.com/Windsander/Mebular/releases/tag/v0.2.3">Download from GitHub Releases</a><br><sub>Verify with <code>SHA256SUMS.txt</code>. macOS: right-click → <strong>Open</strong>. Windows: <strong>More info → Run anyway</strong>. Bundles Electron and its runtime.</sub></td>
+      <td><a href="https://github.com/Windsander/Mebular/releases/tag/v0.2.4">Download from GitHub Releases</a><br><sub>Verify with <code>SHA256SUMS.txt</code>. macOS: right-click → <strong>Open</strong>. Windows: <strong>More info → Run anyway</strong>. Bundles Electron and its runtime.</sub></td>
     </tr>
   </tbody>
 </table>
@@ -135,7 +135,7 @@ mebular print-config --client opencode         # MCP config
 
 <p align="center"><strong>Use with DSH</strong><br>
 Install the plugin from npm into DSH's web profile:<br>
-<code>dsh plugin --profile web add @mebular/dsh-plugin@0.2.3</code><br>
+<code>dsh plugin --profile web add @mebular/dsh-plugin@0.2.4</code><br>
 The App and the DSH Plugin are two equal entries to one local Mebular runtime: the plugin defaults to <code>attach</code> and connects to an existing App/CLI/service without starting or downloading anything. If no runtime exists, the panel explicitly offers a pinned shared-runtime install. The sidebar panel embeds the same Console through <code>?embed=dsh</code> (loopback only), and the official MCP client reaches the same graph. The plugin is an independent adapter with its code isolated in <code>packages/dsh-plugin</code>; it is published by its own npm job, while its version follows the unified release train. For plugin development, install from <code>packages/dsh-plugin</code> instead.<br>
 Listed on <a href="https://github.com/awesome-dsh-plugin/awesome-dsh-plugin">awesome-dsh-plugin</a> under <code>memory</code>.<br>
 <a href="packages/dsh-plugin/README_EN.md">DSH plugin guide →</a> · <a href="docs/integrations/DSH.md">Integration notes →</a></p>
@@ -172,6 +172,6 @@ Runnable examples: [`examples/quickstart`](examples/quickstart/index.mjs) writes
 
 <div align="center">
 
-v0.2.3 · early · MIT · © 2026 Sobert Li
+v0.2.4 · early · MIT · © 2026 Sobert Li
 
 </div>
diff --git a/README_CN.md b/README_CN.md
@@ -61,14 +61,14 @@
 <table width="100%">
   <thead>
     <tr>
-      <th align="left" width="30%">桌面 App · v0.2.3</th>
+      <th align="left" width="30%">桌面 App · v0.2.4</th>
       <th align="left">下载与首次打开</th>
     </tr>
   </thead>
   <tbody>
     <tr>
       <td><strong>未签名发布</strong><br><sub>macOS Universal · Windows x64 · Linux x64</sub></td>
-      <td><a href="https://github.com/Windsander/Mebular/releases/tag/v0.2.3">从 GitHub Releases 下载</a><br><sub>用 <code>SHA256SUMS.txt</code> 校验。macOS：右键 →「打开」；Windows：「更多信息 → 仍要运行」。自带 Electron 与 runtime。</sub></td>
+      <td><a href="https://github.com/Windsander/Mebular/releases/tag/v0.2.4">从 GitHub Releases 下载</a><br><sub>用 <code>SHA256SUMS.txt</code> 校验。macOS：右键 →「打开」；Windows：「更多信息 → 仍要运行」。自带 Electron 与 runtime。</sub></td>
     </tr>
   </tbody>
 </table>
@@ -135,7 +135,7 @@ mebular print-config --client opencode         # MCP 配置
 
 <p align="center"><strong>与 DSH 一起使用</strong><br>
 从 npm 把插件装入 DSH 的 web profile：<br>
-<code>dsh plugin --profile web add @mebular/dsh-plugin@0.2.3</code><br>
+<code>dsh plugin --profile web add @mebular/dsh-plugin@0.2.4</code><br>
 App 与 DSH Plugin 是同一套本机 Mebular runtime 的两个等权入口：插件默认 <code>attach</code>，已有 App/CLI/service 时直接连接，不会启动或下载任何东西。完全没有 runtime 时，面板会先询问，再按需安装固定版本共享 runtime。侧边栏面板通过 <code>?embed=dsh</code>（仅 loopback）嵌入同一套 Console，官方 MCP client 连接同一张图。插件是独立适配器，代码隔离在 <code>packages/dsh-plugin</code>；它由独立 npm job 发布，版本随统一 release train；开发时仍可从 <code>packages/dsh-plugin</code> 本地安装。<br>
 已收录于 <a href="https://github.com/awesome-dsh-plugin/awesome-dsh-plugin">awesome-dsh-plugin</a> 的 <code>memory</code> 分类。<br>
 <a href="packages/dsh-plugin/README.md">DSH 插件指南 →</a> · <a href="docs/integrations/DSH_CN.md">集成说明 →</a></p>
@@ -172,6 +172,6 @@ await mebular.initialize();
 
 <div align="center">
 
-v0.2.3 · early · MIT · © 2026 Sobert Li
+v0.2.4 · early · MIT · © 2026 Sobert Li
 
 </div>
diff --git a/RELEASE.md b/RELEASE.md
@@ -10,8 +10,8 @@ The release operations for this repository live under `docs/operations/`:
 - [Changelog](CHANGELOG.md) — release notes; the `## [vX.Y.Z]` section is the source of the
   GitHub Release body.
 
-The current release line is **v0.2.3**: a single-version umbrella with six npm packages at
-`0.2.3` (`core`, `service`, `skill`, `mcp`, `fleet`, `dsh-plugin`), and unsigned desktop
+The current release line is **v0.2.4**: a single-version umbrella with six npm packages at
+`0.2.4` (`core`, `service`, `skill`, `mcp`, `fleet`, `dsh-plugin`), and unsigned desktop
 installers for macOS, Windows and Linux. The DSH plugin is an isolated adapter published by
 its own npm job, but it follows the unified release train; no release ships the DSH plugin
 alone. `bump_version.sh` updates all six packages, and `verify:release-version` / the publish

diff --git a/apps/desktop/README.md b/apps/desktop/README.md
@@ -1,6 +1,6 @@
 # Mebular 桌面 App（apps/desktop）
 
-> v0.2.3：**壳 + 守护托管 + 内嵌控制台 + 发布 tarball 运行时 + 三平台 unsigned 安装包**。
+> v0.2.4：**壳 + 守护托管 + 内嵌控制台 + 发布 tarball 运行时 + 三平台 unsigned 安装包**。
 > 安装包 runtime 来自与 npm 发布同一批 verify tarball；签名、公证与自动更新留到后续版本。
 > 发布操作见 [`docs/operations/DESKTOP_RELEASE.md`](../../docs/operations/DESKTOP_RELEASE.md)。
 
@@ -32,7 +32,7 @@ npm run dev -- --home ~/.mebular --port 7331   # 透传参数（可选）
 npm run smoke                     # 无 GUI 有界冒烟（CI 用）
 ```
 
-## 安装包（v0.2.3，unsigned）
+## 安装包（v0.2.4，unsigned）
 
 安装包里的 Mebular 运行时**不来自仓库源码目录**，而是先用 `npm pack` 产出五个发布
 tarball，再由 `prepare-runtime` 一次性 `npm install --omit=dev --ignore-scripts` 到
@@ -75,7 +75,7 @@ node apps/desktop/scripts/smoke-runtime.mjs --runtime apps/desktop/dist/win-unpa
 node apps/desktop/scripts/smoke-runtime.mjs --runtime apps/desktop/dist/linux-unpacked/resources
 ```
 
-> v0.2.3 产物**未签名、未公证**：macOS Gatekeeper 要求右键 → 打开（或系统设置 → 隐私与
+> v0.2.4 产物**未签名、未公证**：macOS Gatekeeper 要求右键 → 打开（或系统设置 → 隐私与
 > 安全性 → 仍要打开），Windows SmartScreen 要求「更多信息 → 仍要运行」。发布前先用
 > Release 的 `SHA256SUMS.txt` 校验。签名、公证与自动更新留到后续版本；完整说明见
 > [`docs/operations/DESKTOP_RELEASE.md`](../../docs/operations/DESKTOP_RELEASE.md)。

diff --git a/apps/desktop/package-lock.json b/apps/desktop/package-lock.json
diff --git a/apps/desktop/package.json b/apps/desktop/package.json
@@ -2,7 +2,7 @@
   "name": "@mebular/desktop",
   "productName": "Mebular",
   "desktopName": "mebular",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "private": true,
   "description": "Mebular 桌面应用（Electron 壳 + 内嵌控制台 + 守护托管）",
   "license": "MIT",

diff --git a/apps/desktop/src/main/daemon.mjs b/apps/desktop/src/main/daemon.mjs
@@ -12,7 +12,7 @@ import { homedir } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
-export const APP_VERSION = '0.2.3';
+export const APP_VERSION = '0.2.4';
 export const SERVICE_KIND = 'mebular-serve';
 /** App 注册到 <cloudRoot>/runtime-providers.json 的能力（只写发现信息，不写 token/身份）。 */
 export const APP_RUNTIME_PROVIDER_CAPABILITIES = Object.freeze(['serve']);

diff --git a/assets/desktop-steps-cn-light.svg b/assets/desktop-steps-cn-light.svg