diff --git a/catalog.json b/catalog.json
index 772aa7e..79dfc14 100644
--- a/catalog.json
+++ b/catalog.json
@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "providerId": "official",
   "name": "PI-Desktop Official Plugins",
-  "updatedAt": "2026-10-06T15:05:01Z",
+  "updatedAt": "2026-09-20T17:49:14Z",
   "homepage": "https://github.com/vastsa/pi-desktop-plugins",
   "plugins": [
     {
@@ -432,13 +432,13 @@
       "safetyNotes": "\u4fbf\u7b7e\u6570\u636e\u4ec5\u5b58\u4e8e\u63d2\u4ef6\u81ea\u5df1\u7684 settings \u4e2d\uff0c\u4e0d\u8bbf\u95ee\u5de5\u4f5c\u533a\u6216\u7f51\u7edc\uff1b\u70b9\u51fb\u4fbf\u7b7e\u5185\u7684\u5916\u90e8\u94fe\u63a5\u4f1a\u6253\u5f00\u7cfb\u7edf\u6d4f\u89c8\u5668\u3002",
       "versions": [
         {
-          "version": "0.1.6",
-          "publishedAt": "2026-10-06T15:05:01Z",
-          "changelog": "Release 0.1.6: leads every agent-tool description with explicit when-to-use trigger conditions and example phrasings (including Chinese), so the agent picks the right sticky-note tool from the user's goal; purge_note now states it must never serve an ordinary delete request. Release 0.1.5: reserves space for the host window-control capsule so top-right panel actions no longer overlap it. Release 0.1.4: gives the panel an explicit full-height page surface and keeps the host window-control capsule synchronized with live theme changes. Release 0.1.3: migrates the panel to v3 paint-through chrome so top-band controls remain clickable without the legacy 46px blank area. Release 0.1.2: refreshes the sticky-notes panel chrome, controls, focus states, dialogs, and compact responsive spacing. Release 0.1.1: adapts the panel to PI-Desktop's cross-platform 46px host drag band and minimal three-button window-control capsule. First release: multiple notes, Markdown preview/editing, task lists, highlights, image paste, and recycle bin.",
+          "version": "0.1.5",
+          "publishedAt": "2026-09-12T17:13:25Z",
+          "changelog": "Release 0.1.5: reserves space for the host window-control capsule so top-right panel actions no longer overlap it. Release 0.1.4: gives the panel an explicit full-height page surface and keeps the host window-control capsule synchronized with live theme changes. Release 0.1.3: migrates the panel to v3 paint-through chrome so top-band controls remain clickable without the legacy 46px blank area. Release 0.1.2: refreshes the sticky-notes panel chrome, controls, focus states, dialogs, and compact responsive spacing. Release 0.1.1: adapts the panel to PI-Desktop's cross-platform 46px host drag band and minimal three-button window-control capsule. First release: multiple notes, Markdown preview/editing, task lists, highlights, image paste, and recycle bin.",
           "minPiDesktop": ">=0.7.1",
-          "shasum": "7980707fabf25e7427775feb3681f34eb80e82af5df7b349cf0df0ac5560c9e0",
-          "url": "packages/pi.bianqian-0.1.6.piplug",
-          "sizeBytes": 1065975,
+          "shasum": "816ea81e1b029f7534b0600feabcdf4b272f36b9082679bcad658888ae73fae5",
+          "url": "packages/pi.bianqian-0.1.5.piplug",
+          "sizeBytes": 1064430,
           "permissions": [
             "ui.panel",
             "agent.tool.register",
@@ -889,17 +889,17 @@
       "downloads": 0,
       "homepage": "https://github.com/vastsa/pi-desktop-plugins/tree/main/plugins/pi.session-orchestrator",
       "repository": "https://github.com/vastsa/pi-desktop-plugins",
-      "readmeMarkdown": "# Session Orchestrator\n\nPlugin ID: `pi.session-orchestrator`  \nRequires PI-Desktop `>= 0.14.7` with host collaboration APIs.\n\nSession Orchestrator coordinates real PI-Desktop sessions through one\nhigh-risk Agent tool, `SessionTask`. Every session is addressed by its existing\ndurable `sessionId`; follow-up messages keep that session's context and model.\nThe host owns delivery, queue admission, execution state, results, and completion\nnotifications. The plugin does not infer success from assistant text.\n\n## Install\n\n- **Marketplace**: PI-Desktop \u2192 Plugins \u2192 Marketplace \u2192 Session Orchestrator\n- **Development**: Plugins \u2192 Load development plugin \u2192 this repository root\n\n## Quick start (how do I use it?)\n\nThis plugin deliberately has **no panel, no command, and nothing to\nconfigure** after install. It works inside your existing Agent chat: the agent\ngains one tool, `SessionTask`, and decides to use it from your goal \u2014 **no\nspecial keyword is required**. Just describe what you want:\n\n| You say (any language) | What happens |\n| --- | --- |\n| \u5f00\u4e24\u4e2a\u5b50\u4f1a\u8bdd\uff0c\u4e00\u4e2a\u8dd1\u6d4b\u8bd5\u4e00\u4e2a\u6539\u6587\u6863 / \"spawn two workers: one runs the tests, one updates the docs\" | Two real sessions are created and start working in parallel |\n| \u628a\u8fd9\u4e2a\u62a5\u9519\u53d1\u7ed9\u4fee Bug \u7684\u90a3\u4e2a\u4f1a\u8bdd\u7ee7\u7eed\u67e5 / \"send this error to the bug-fixing session\" | A follow-up message goes to that existing session, keeping its model and context |\n| \u5b50\u4f1a\u8bdd\u8dd1\u5b8c\u4e86\u5417\uff1f/ \"are the workers done?\" | `status`/`result` reports live host-owned state |\n\nThe completion notice arrives back in your session automatically \u2014 you do not\nneed to keep asking. If the agent does not pick the tool up, say explicitly\n\"\u7528 SessionTask \u5f00\u4e00\u4e2a\u5b50\u4f1a\u8bdd\u2026\" / \"use SessionTask to spawn a worker that\u2026\".\n\n\u8be6\u7ec6\u673a\u5236\uff08\u52a8\u4f5c\u8868\u3001\u6a21\u578b\u9009\u62e9\u3001\u72b6\u6001\u4e0e\u6062\u590d\uff09\u89c1\u4e0b\u6587 / The full reference \u2014 actions,\nmodel selection, state and recovery \u2014 follows below.\n\n## A normal workflow\n\n1. Call `models` to inspect the user's ready configured models when a task needs\n   a particular model. Then `spawn(task, title?, model?)` to create a worker.\n   Keep the returned `sessionId` and delivery `messageId`.\n2. Work in parallel. By default the host sends a completion message back to the\n   sending session when the target turn settles; repeated polling is unnecessary.\n3. Use `send(sessionId, message)` for follow-up work in the same session, or to\n   communicate with any other existing session. Workers can reply to their\n   initiating session and peers by their real Session IDs.\n4. Inspect `status` or `result` when needed. Pass `messageId` or `turnId` to\n   retrieve one specific delivery instead of whichever message is latest.\n5. Review the actual result. `accept` optionally records that review for the\n   exact completed message. `cancel` stops collaboration work and retains the\n   durable session and history.\n\nA received message is explicitly identified as another session's communication,\nnot human input or new user authorization. Completion notices need no\nacknowledgement unless further work is necessary. Use\n`notifyOnCompletion: false` for informational messages to avoid unnecessary\nreturn messages. Host-generated completion notices never request another\nautomatic completion notice.\n\n## Actions\n\n| Action | Behavior |\n| --- | --- |\n| `spawn(task, title?, model?)` | Atomically creates a real worker and admits its first delivery through the host. |\n| `send(sessionId, message, kind?)` | Sends a task or message to an existing session, including a busy session's host queue. Does not reselect its model. |\n| `models()` | Lists ready model keys, aliases, reasoning metadata, AI-delegation eligibility, and the default. |\n| `status(sessionIds?)` | Reads host-owned live summaries; omission selects this caller's recent session references. |\n| `list()` | Reads a bounded host-backed directory of communicable Agent sessions, including independent top-level sessions. The response also retains a legacy `workers` field for recent-reference callers. |\n| `result(sessionId, messageId?, turnId?)` | Returns the host delivery and exact turn outcome. Failed or interrupted work is never accepted as a successful report. |\n| `wait(sessionIds, timeoutMs?)` | Explicit polling fallback, 25 seconds by default and at most 45 seconds. The entire read budget observes the deadline and cancellation. |\n| `supervise(sessionIds, message)` | Sends up to four follow-ups in parallel; returns successful receipts and any individual failures. |\n| `accept(sessionId|sessionIds, messageId?, note?)` | Stores review metadata keyed by the exact completed delivery. It never changes host execution state. |\n| `cancel(sessionId, messageId?)` | Cancels target collaboration work without deleting the session. |\n\n`result.ready` means the delivery has settled, including failure, cancellation,\nor interruption. Successful work requires `message.status === \"completed\"`;\nthe compatibility `worker.report` field is populated only for that outcome.\n\n`spawn` and `send` accept `notifyOnCompletion` (default true) and an optional\n`idempotencyKey` for retrying the same request. Use a different key for a new\nrequest. For batch supervision requiring retry identities, call `send` separately\nwith one key per target. Session identity and delivery identity have separate\npurposes: `messageId` names a ledger entry, not a second worker system.\n\n## Model selection\n\nAn omitted `model` first selects from ready bindings with\n`availableForSubagents: true`. A default within that set takes precedence;\notherwise the first configured eligible row provides a stable selection.\nOnly when that set is empty does the configured ready default apply. An empty\ncatalog or unavailable default produces a clear configuration error.\n\nThe spawn response records `requestedModel` and its selection policy; the\nactual session model is read from `status.modelKey`, including after an\nidempotent retry.\n\nAn explicit request resolves against existing model keys, IDs, aliases and\nnames. Matching handles case, spacing, punctuation, common English/Chinese\nfamily names, and supported reasoning/non-reasoning intent. Numeric version\norder is preserved. Multiple matches return bounded exact-key candidates;\nno match is an error. The plugin never invents a model ID or silently chooses\nan unrelated default. It does not rank model quality or cost from brand names;\nthe Parent can use `models` and the task requirements to make that decision.\n\nExisting-session `send` never changes provider, model, project, context, or\npermissions. New-session project and permission inheritance, effective thinking\nconfiguration, active-worker limits (four per creator, sixteen per plugin), and\nthe restriction on workers autonomously creating further workers are enforced\nby the host, using durable creation provenance.\n\n## State and recovery\n\nPI-Desktop's durable session communication ledger is authoritative. Status,\ncurrent task, sender, recent exchanges, and final outcome come directly from it.\nA callback is tied to the actual settled turn, retained on failure, and generated\nat most once. Restart follows the host's existing interruption fence; the\nplugin does not replay messages or start replacements during load.\n\nPrivate plugin settings retain at most 256 recent session references and 256\nmessage review notes. They contain no cached transcript, report, or execution\nstate. Reference eviction affects only recent-history discovery, never the\nability to address a known Session ID or the host's creation limits. Successful\nhost receipts remain available to the caller if optional history persistence\nfails; the response includes a warning.\n\nVersion 0.3 `workerSessionId`/`sessionId` records migrate to recent references.\nOld cached statuses, reports, rounds and acceptance markers are retired because\nthey cannot prove a host delivery's outcome. Existing sessions are preserved.\nLegacy `workerId`/`workerIds` arguments remain supported aliases; conflicting\naliases are rejected. Unloading cancels plugin reads and waits, unregisters the\ntool, and flushes metadata. Host-owned work and callbacks remain owned by the\nhost.\n\nThis plugin has no standalone window. Session discovery, messaging, status,\nand cancellation happen only through `SessionTask`.\n\n## Host compatibility and security\n\nThe manifest retains `engines.piDesktop >=0.14.7`, but version alone does not\nprove this additive capability exists. Each operation checks the host's reviewed\ncatalog for `session/collaboration/{spawn,send,list,status,result,cancel}`. An older\nhost receives an explicit update-required error; the plugin never falls back\nto untracked create/prompt calls or transcript inference.\n\n| Capability | Data and boundary |\n| --- | --- |\n| `desktop.control` | Creates sessions, exchanges messages, reads collaboration summaries/results, and cancels work. The host binds the sender to the current Agent tool invocation, enforces permissions and bounded creation, and labels provenance. Messages can consume configured model quota. |\n| `models.list` | Reads ready configured model identifiers, aliases, delegation flags and reasoning metadata; no credentials. |\n| Plugin settings | Stores only bounded recent references and review notes keyed by delivery identity. Never grants access or represents execution truth. |\n\nThe high-risk grant allows bidirectional communication with any existing\nsession. Message content is task data and cannot grant new permissions. The\nplugin has no direct network permission, never reads credentials or MCP tokens,\nnever executes downloaded code, and never deletes sessions. Host provider\nrequests continue to use the user's configured model and normal policy.\n\n## Development\n\n```bash\nnode --test test/*.test.mjs\n```\n\nThis repository is the source of `pi.session-orchestrator`. Marketplace packages\nare published from [pi-desktop-plugins](https://github.com/vastsa/pi-desktop-plugins).\n\n",
+      "readmeMarkdown": "# Session Orchestrator\n\nPlugin ID: `pi.session-orchestrator`  \nRequires PI-Desktop `>= 0.14.7` with host collaboration APIs.\n\nSession Orchestrator coordinates real PI-Desktop sessions through one\nhigh-risk Agent tool, `SessionTask`. Every session is addressed by its existing\ndurable `sessionId`; follow-up messages keep that session's context and model.\nThe host owns delivery, queue admission, execution state, results, and completion\nnotifications. The plugin does not infer success from assistant text.\n\n## Install\n\n- **Marketplace**: PI-Desktop \u2192 Plugins \u2192 Marketplace \u2192 Session Orchestrator\n- **Development**: Plugins \u2192 Load development plugin \u2192 this repository root\n\n## A normal workflow\n\n1. Call `models` to inspect the user's ready configured models when a task needs\n   a particular model. Then `spawn(task, title?, model?)` to create a worker.\n   Keep the returned `sessionId` and delivery `messageId`.\n2. Work in parallel. By default the host sends a completion message back to the\n   sending session when the target turn settles; repeated polling is unnecessary.\n3. Use `send(sessionId, message)` for follow-up work in the same session, or to\n   communicate with any other existing session. Workers can reply to their\n   initiating session and peers by their real Session IDs.\n4. Inspect `status` or `result` when needed. Pass `messageId` or `turnId` to\n   retrieve one specific delivery instead of whichever message is latest.\n5. Review the actual result. `accept` optionally records that review for the\n   exact completed message. `cancel` stops collaboration work and retains the\n   durable session and history.\n\nA received message is explicitly identified as another session's communication,\nnot human input or new user authorization. Completion notices need no\nacknowledgement unless further work is necessary. Use\n`notifyOnCompletion: false` for informational messages to avoid unnecessary\nreturn messages. Host-generated completion notices never request another\nautomatic completion notice.\n\n## Actions\n\n| Action | Behavior |\n| --- | --- |\n| `spawn(task, title?, model?)` | Atomically creates a real worker and admits its first delivery through the host. |\n| `send(sessionId, message, kind?)` | Sends a task or message to an existing session, including a busy session's host queue. Does not reselect its model. |\n| `models()` | Lists ready model keys, aliases, reasoning metadata, AI-delegation eligibility, and the default. |\n| `status(sessionIds?)` | Reads host-owned live summaries; omission selects this caller's recent session references. |\n| `list()` | Reads a bounded host-backed directory of communicable Agent sessions, including independent top-level sessions. The response also retains a legacy `workers` field for recent-reference callers. |\n| `result(sessionId, messageId?, turnId?)` | Returns the host delivery and exact turn outcome. Failed or interrupted work is never accepted as a successful report. |\n| `wait(sessionIds, timeoutMs?)` | Explicit polling fallback, 25 seconds by default and at most 45 seconds. The entire read budget observes the deadline and cancellation. |\n| `supervise(sessionIds, message)` | Sends up to four follow-ups in parallel; returns successful receipts and any individual failures. |\n| `accept(sessionId|sessionIds, messageId?, note?)` | Stores review metadata keyed by the exact completed delivery. It never changes host execution state. |\n| `cancel(sessionId, messageId?)` | Cancels target collaboration work without deleting the session. |\n\n`result.ready` means the delivery has settled, including failure, cancellation,\nor interruption. Successful work requires `message.status === \"completed\"`;\nthe compatibility `worker.report` field is populated only for that outcome.\n\n`spawn` and `send` accept `notifyOnCompletion` (default true) and an optional\n`idempotencyKey` for retrying the same request. Use a different key for a new\nrequest. For batch supervision requiring retry identities, call `send` separately\nwith one key per target. Session identity and delivery identity have separate\npurposes: `messageId` names a ledger entry, not a second worker system.\n\n## Model selection\n\nAn omitted `model` first selects from ready bindings with\n`availableForSubagents: true`. A default within that set takes precedence;\notherwise the first configured eligible row provides a stable selection.\nOnly when that set is empty does the configured ready default apply. An empty\ncatalog or unavailable default produces a clear configuration error.\n\nThe spawn response records `requestedModel` and its selection policy; the\nactual session model is read from `status.modelKey`, including after an\nidempotent retry.\n\nAn explicit request resolves against existing model keys, IDs, aliases and\nnames. Matching handles case, spacing, punctuation, common English/Chinese\nfamily names, and supported reasoning/non-reasoning intent. Numeric version\norder is preserved. Multiple matches return bounded exact-key candidates;\nno match is an error. The plugin never invents a model ID or silently chooses\nan unrelated default. It does not rank model quality or cost from brand names;\nthe Parent can use `models` and the task requirements to make that decision.\n\nExisting-session `send` never changes provider, model, project, context, or\npermissions. New-session project and permission inheritance, effective thinking\nconfiguration, active-worker limits (four per creator, sixteen per plugin), and\nthe restriction on workers autonomously creating further workers are enforced\nby the host, using durable creation provenance.\n\n## State and recovery\n\nPI-Desktop's durable session communication ledger is authoritative. Status,\ncurrent task, sender, recent exchanges, and final outcome come directly from it.\nA callback is tied to the actual settled turn, retained on failure, and generated\nat most once. Restart follows the host's existing interruption fence; the\nplugin does not replay messages or start replacements during load.\n\nPrivate plugin settings retain at most 256 recent session references and 256\nmessage review notes. They contain no cached transcript, report, or execution\nstate. Reference eviction affects only recent-history discovery, never the\nability to address a known Session ID or the host's creation limits. Successful\nhost receipts remain available to the caller if optional history persistence\nfails; the response includes a warning.\n\nVersion 0.3 `workerSessionId`/`sessionId` records migrate to recent references.\nOld cached statuses, reports, rounds and acceptance markers are retired because\nthey cannot prove a host delivery's outcome. Existing sessions are preserved.\nLegacy `workerId`/`workerIds` arguments remain supported aliases; conflicting\naliases are rejected. Unloading cancels plugin reads and waits, unregisters the\ntool, and flushes metadata. Host-owned work and callbacks remain owned by the\nhost.\n\nThis plugin has no standalone window. Session discovery, messaging, status,\nand cancellation happen only through `SessionTask`.\n\n## Host compatibility and security\n\nThe manifest retains `engines.piDesktop >=0.14.7`, but version alone does not\nprove this additive capability exists. Each operation checks the host's reviewed\ncatalog for `session/collaboration/{spawn,send,list,status,result,cancel}`. An older\nhost receives an explicit update-required error; the plugin never falls back\nto untracked create/prompt calls or transcript inference.\n\n| Capability | Data and boundary |\n| --- | --- |\n| `desktop.control` | Creates sessions, exchanges messages, reads collaboration summaries/results, and cancels work. The host binds the sender to the current Agent tool invocation, enforces permissions and bounded creation, and labels provenance. Messages can consume configured model quota. |\n| `models.list` | Reads ready configured model identifiers, aliases, delegation flags and reasoning metadata; no credentials. |\n| Plugin settings | Stores only bounded recent references and review notes keyed by delivery identity. Never grants access or represents execution truth. |\n\nThe high-risk grant allows bidirectional communication with any existing\nsession. Message content is task data and cannot grant new permissions. The\nplugin has no direct network permission, never reads credentials or MCP tokens,\nnever executes downloaded code, and never deletes sessions. Host provider\nrequests continue to use the user's configured model and normal policy.\n\n## Development\n\n```bash\nnode --test test/*.test.mjs\n```\n\nThis repository is the source of `pi.session-orchestrator`. Marketplace packages\nare published from [pi-desktop-plugins](https://github.com/vastsa/pi-desktop-plugins).\n\n",
       "safetyNotes": "This high-risk tool can create sessions, read session collaboration summaries and results, send messages that run the target Agent, and cancel collaboration work through desktop.control. Messages can address any existing Session ID and may consume configured model quota. The host binds the sender, preserves existing target configuration and permissions, labels session messages separately from user input, and bounds autonomous creation and callbacks. Plugin history never grants access. The plugin has no network permission and never deletes sessions or reads credentials.",
       "versions": [
         {
-          "version": "0.6.1",
-          "publishedAt": "2026-10-06T08:20:18Z",
-          "changelog": "Release 0.6.1: leads the SessionTask description with explicit when-to-use trigger conditions (parallel work, sub-sessions, delegation \u2014 in any language, no magic keyword) and adds a bilingual Quick Start to the README so users know how to invoke the plugin from chat.\nRelease 0.6.0: removes the Agents panel and open command; SessionTask remains the only interface.\nRelease 0.5.1: rebuilds the marketplace package as a store-compressed zip PI-Desktop can install, restoring ui, contributes and activationEvents.\nRelease 0.5.0: discovers existing independent Agent sessions through the host-backed list action while retaining legacy worker references and bidirectional messaging.\nRelease 0.4.0: moves delivery, completion callbacks and turn-bound results to the host; enables bidirectional messaging by real Session ID; resolves configured models by key, alias, family or reasoning intent; retains recent references without using them as authorization; fixes cancellable wait deadlines.",
+          "version": "0.6.0",
+          "publishedAt": "2026-09-18T16:03:32Z",
+          "changelog": "Release 0.6.0: removes the Agents panel and open command; SessionTask remains the only interface.\nRelease 0.5.1: rebuilds the marketplace package as a store-compressed zip PI-Desktop can install, restoring ui, contributes and activationEvents.\nRelease 0.5.0: discovers existing independent Agent sessions through the host-backed list action while retaining legacy worker references and bidirectional messaging.\nRelease 0.4.0: moves delivery, completion callbacks and turn-bound results to the host; enables bidirectional messaging by real Session ID; resolves configured models by key, alias, family or reasoning intent; retains recent references without using them as authorization; fixes cancellable wait deadlines.",
           "minPiDesktop": ">=0.14.7",
-          "shasum": "7504d4b9083d3126748b7261fae8b5c85e8917c866f22d40cea6d3c2080388b8",
-          "url": "packages/pi.session-orchestrator-0.6.1.piplug",
-          "sizeBytes": 52965,
+          "shasum": "705148420a011b770c5ac3a60ed4ae7cef633ac5756b768c7b10ce75d46e00f5",
+          "url": "packages/pi.session-orchestrator-0.6.0.piplug",
+          "sizeBytes": 50514,
           "permissions": [
             "agent.tool.register",
             "desktop.control",
@@ -938,13 +938,13 @@
       "safetyNotes": "SSH credentials are never persisted by this plugin. Passwords entered in the panel are held in memory for at most 30 minutes and private-key contents stay outside the plugin. Authentication is delegated to the local OpenSSH client. The panel stores only connection metadata in plugin settings; AI tools can connect to configured hosts and execute remote shell commands, so PI-Desktop's high-risk tool policy must remain enabled.",
       "versions": [
         {
-          "version": "0.1.6",
-          "publishedAt": "2026-10-06T15:05:01Z",
-          "changelog": "Release 0.1.6: leads every agent-tool description with explicit when-to-use trigger conditions and example phrasings (including Chinese), and states the override boundary \u2014 AI cannot authorize a blocked command, only the panel's one-time approval can. Release 0.1.5: restores ProgramData in PI-Desktop's minimal Windows plugin environment so OpenSSH no longer exits 255 silently before connecting; adds a real OpenSSH startup regression test. Release 0.1.4: closes the askpass broker lifecycle boundary so an unload cannot start a new SSH child after the broker has been cleaned up. Release 0.1.3: keeps OpenSSH transport diagnostics visible on Windows instead of suppressing banner-exchange errors behind exit 255, preserves non-default config files for imported aliases without bypassing system config for the default file, detaches an alias when its explicit connection fields are edited, prevents one-shot commands from inheriting plugin stdin, passes special-character passwords through a one-shot local askpass broker without placing them in the ssh process environment, and preserves missing-client diagnostics through the panel bridge. Release 0.1.2: imports concrete hosts from the local OpenSSH config, preserves aliases for complete SSH behavior, adds identity-file selection, surfaces OpenSSH diagnostics instead of a bare exit 255, inherits Windows system environment so ssh.exe can run, and stops leftover ssh processes from throwing on quit. Release 0.1.1: strengthens destructive-command filtering and makes one-time dangerous-command approval available only from the SSH Manager panel. Release 0.1.0: adds local SSH host profiles, strict host-key verification, OpenSSH key/agent and transient password authentication, bounded remote command execution, a focused management panel, and an AI skill describing safe SSH workflows.",
+          "version": "0.1.5",
+          "publishedAt": "2026-09-13T07:10:40Z",
+          "changelog": "Release 0.1.5: restores ProgramData in PI-Desktop's minimal Windows plugin environment so OpenSSH no longer exits 255 silently before connecting; adds a real OpenSSH startup regression test. Release 0.1.4: closes the askpass broker lifecycle boundary so an unload cannot start a new SSH child after the broker has been cleaned up. Release 0.1.3: keeps OpenSSH transport diagnostics visible on Windows instead of suppressing banner-exchange errors behind exit 255, preserves non-default config files for imported aliases without bypassing system config for the default file, detaches an alias when its explicit connection fields are edited, prevents one-shot commands from inheriting plugin stdin, passes special-character passwords through a one-shot local askpass broker without placing them in the ssh process environment, and preserves missing-client diagnostics through the panel bridge. Release 0.1.2: imports concrete hosts from the local OpenSSH config, preserves aliases for complete SSH behavior, adds identity-file selection, surfaces OpenSSH diagnostics instead of a bare exit 255, inherits Windows system environment so ssh.exe can run, and stops leftover ssh processes from throwing on quit. Release 0.1.1: strengthens destructive-command filtering and makes one-time dangerous-command approval available only from the SSH Manager panel. Release 0.1.0: adds local SSH host profiles, strict host-key verification, OpenSSH key/agent and transient password authentication, bounded remote command execution, a focused management panel, and an AI skill describing safe SSH workflows.",
           "minPiDesktop": ">=0.2.9",
-          "shasum": "3c2eb91e4d295015514aad707cf1020b2eef30d1adfb20e71e2c8b60a15658f6",
-          "url": "packages/pi.ssh-manager-0.1.6.piplug",
-          "sizeBytes": 147655,
+          "shasum": "02dfeca1840ea9d8a572bc01a1913800bed68ee97b36a5a92ecd7f9fe9817067",
+          "url": "packages/pi.ssh-manager-0.1.5.piplug",
+          "sizeBytes": 146730,
           "permissions": [
             "ui.panel",
             "agent.tool.register",
diff --git a/packages/pi.bianqian-0.1.6.piplug b/packages/pi.bianqian-0.1.6.piplug
deleted file mode 100644
index 9bb68ad..0000000
Binary files a/packages/pi.bianqian-0.1.6.piplug and /dev/null differ
diff --git a/packages/pi.session-orchestrator-0.6.1.piplug b/packages/pi.session-orchestrator-0.6.1.piplug
deleted file mode 100644
index a8e3e90..0000000
Binary files a/packages/pi.session-orchestrator-0.6.1.piplug and /dev/null differ
diff --git a/packages/pi.ssh-manager-0.1.6.piplug b/packages/pi.ssh-manager-0.1.6.piplug
deleted file mode 100644
index 7b29ffe..0000000
Binary files a/packages/pi.ssh-manager-0.1.6.piplug and /dev/null differ
diff --git a/plugins/pi.bianqian/manifest.json b/plugins/pi.bianqian/manifest.json
index b4a75fa..8dd3fc4 100644
--- a/plugins/pi.bianqian/manifest.json
+++ b/plugins/pi.bianqian/manifest.json
@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "id": "pi.bianqian",
   "name": "便签",
-  "version": "0.1.6",
+  "version": "0.1.5",
   "description": "Markdown 桌面便签：多便签管理、实时预览、任务列表勾选、荧光笔高亮与回收站。Sticky notes with Markdown preview, task lists, text highlights and recycle bin.",
   "i18n": {
     "en": {
@@ -43,7 +43,7 @@
     "agentTools": [
       {
         "name": "list_notes",
-        "description": "Use when the user wants to see or review their sticky notes, e.g. \"列出我的便签\", \"看看我记过什么\", \"list my sticky notes\". Lists all sticky notes with title, snippet, color and timestamps; deleted notes appear only when includeDeleted is true.",
+        "description": "List all sticky notes with title, snippet, color and timestamps; deleted notes are included only when includeDeleted is true.",
         "risk": "low",
         "schema": {
           "type": "object",
@@ -52,7 +52,7 @@
       },
       {
         "name": "get_note",
-        "description": "Use when the user wants the full content of one note whose id is already known, e.g. \"把那条便签的原文给我\", \"show that note in full\". Reads one sticky note's full markdown content by id; prefer search_notes when the id is unknown.",
+        "description": "Read one sticky note's full markdown content by id.",
         "risk": "low",
         "schema": {
           "type": "object",
@@ -62,7 +62,7 @@
       },
       {
         "name": "search_notes",
-        "description": "Use when the user looks for a note by keyword or topic without an id, e.g. \"找一下我记过的关于部署的便签\", \"find the note about the deploy\". Case-insensitive substring search over title, snippet and content.",
+        "description": "Search sticky notes by title, snippet or content (case-insensitive substring).",
         "risk": "low",
         "schema": {
           "type": "object",
@@ -72,7 +72,7 @@
       },
       {
         "name": "create_note",
-        "description": "Use when the user asks to jot down, record or remember something as a sticky note, e.g. \"记一下：周五三点开会\", \"帮我记着这个地址\", \"jot this down in a note\". Not for structured todos (use pi.todo) or goals (use pi.goal-x). Creates a note with optional markdown content and color; the title derives from the first heading or line.",
+        "description": "Create a new sticky note with optional markdown content and color. The title is derived from the content's first heading or line.",
         "risk": "medium",
         "schema": {
           "type": "object",
@@ -84,7 +84,7 @@
       },
       {
         "name": "update_note",
-        "description": "Use when the user asks to edit, extend or correct an existing note, e.g. \"把那条便签补一行端口号\", \"edit the note to add the port\". Updates content, color or mode; content changes re-derive the title.",
+        "description": "Update a sticky note's content, color or mode. Content changes re-derive the title automatically.",
         "risk": "medium",
         "schema": {
           "type": "object",
@@ -99,7 +99,7 @@
       },
       {
         "name": "delete_note",
-        "description": "Use when the user asks to remove a note they no longer need, e.g. \"把这条便签删了\", \"delete the old note\". Soft-deletes to the recycle bin (restorable via restore_note), so prefer it over purge_note.",
+        "description": "Move a sticky note to the recycle bin (soft delete; restorable via restore_note).",
         "risk": "medium",
         "schema": {
           "type": "object",
@@ -109,7 +109,7 @@
       },
       {
         "name": "restore_note",
-        "description": "Use when the user wants a recently deleted note back, e.g. \"刚才删错了一条，恢复一下\", \"restore the note I deleted\". Restores a soft-deleted note from the recycle bin.",
+        "description": "Restore a soft-deleted sticky note from the recycle bin.",
         "risk": "medium",
         "schema": {
           "type": "object",
@@ -119,7 +119,7 @@
       },
       {
         "name": "purge_note",
-        "description": "Use only when the user explicitly asks to permanently destroy a note, e.g. \"彻底删掉这条，不用恢复\", \"purge it permanently\". Never use for an ordinary delete request — that is delete_note. Permanently deletes and cannot be undone.",
+        "description": "Permanently delete a sticky note. This cannot be undone.",
         "risk": "high",
         "schema": {
           "type": "object",
@@ -132,7 +132,7 @@
   "permissions": ["ui.panel", "agent.tool.register", "agent.prompt.inject", "shell.openExternal"],
   "engines": { "piDesktop": ">=0.7.1" },
   "categories": ["productivity", "community"],
-  "changelog": "Release 0.1.6: leads every agent-tool description with explicit when-to-use trigger conditions and example phrasings (including Chinese), so the agent picks the right sticky-note tool from the user's goal; purge_note now states it must never serve an ordinary delete request. Release 0.1.5: reserves space for the host window-control capsule so top-right panel actions no longer overlap it. Release 0.1.4: gives the panel an explicit full-height page surface and keeps the host window-control capsule synchronized with live theme changes. Release 0.1.3: migrates the panel to v3 paint-through chrome so top-band controls remain clickable without the legacy 46px blank area. Release 0.1.2: refreshes the sticky-notes panel chrome, controls, focus states, dialogs, and compact responsive spacing. Release 0.1.1: adapts the panel to PI-Desktop's cross-platform 46px host drag band and minimal three-button window-control capsule. First release: multiple notes, Markdown preview/editing, task lists, highlights, image paste, and recycle bin.",
+  "changelog": "Release 0.1.5: reserves space for the host window-control capsule so top-right panel actions no longer overlap it. Release 0.1.4: gives the panel an explicit full-height page surface and keeps the host window-control capsule synchronized with live theme changes. Release 0.1.3: migrates the panel to v3 paint-through chrome so top-band controls remain clickable without the legacy 46px blank area. Release 0.1.2: refreshes the sticky-notes panel chrome, controls, focus states, dialogs, and compact responsive spacing. Release 0.1.1: adapts the panel to PI-Desktop's cross-platform 46px host drag band and minimal three-button window-control capsule. First release: multiple notes, Markdown preview/editing, task lists, highlights, image paste, and recycle bin.",
   "safetyNotes": "便签数据仅存于插件自己的 settings 中，不访问工作区或网络；点击便签内的外部链接会打开系统浏览器。",
   "activationEvents": ["onCommand:bianqian.open", "onCommand:bianqian.new", "onStartup"]
 }
diff --git a/plugins/pi.session-orchestrator/README.md b/plugins/pi.session-orchestrator/README.md
index 87ced48..a5e6382 100644
--- a/plugins/pi.session-orchestrator/README.md
+++ b/plugins/pi.session-orchestrator/README.md
@@ -14,26 +14,6 @@ notifications. The plugin does not infer success from assistant text.
 - **Marketplace**: PI-Desktop → Plugins → Marketplace → Session Orchestrator
 - **Development**: Plugins → Load development plugin → this repository root
 
-## Quick start (how do I use it?)
-
-This plugin deliberately has **no panel, no command, and nothing to
-configure** after install. It works inside your existing Agent chat: the agent
-gains one tool, `SessionTask`, and decides to use it from your goal — **no
-special keyword is required**. Just describe what you want:
-
-| You say (any language) | What happens |
-| --- | --- |
-| 开两个子会话，一个跑测试一个改文档 / "spawn two workers: one runs the tests, one updates the docs" | Two real sessions are created and start working in parallel |
-| 把这个报错发给修 Bug 的那个会话继续查 / "send this error to the bug-fixing session" | A follow-up message goes to that existing session, keeping its model and context |
-| 子会话跑完了吗？/ "are the workers done?" | `status`/`result` reports live host-owned state |
-
-The completion notice arrives back in your session automatically — you do not
-need to keep asking. If the agent does not pick the tool up, say explicitly
-"用 SessionTask 开一个子会话…" / "use SessionTask to spawn a worker that…".
-
-详细机制（动作表、模型选择、状态与恢复）见下文 / The full reference — actions,
-model selection, state and recovery — follows below.
-
 ## A normal workflow
 
 1. Call `models` to inspect the user's ready configured models when a task needs
diff --git a/plugins/pi.session-orchestrator/manifest.json b/plugins/pi.session-orchestrator/manifest.json
index 6d2438a..a467c24 100644
--- a/plugins/pi.session-orchestrator/manifest.json
+++ b/plugins/pi.session-orchestrator/manifest.json
@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "id": "pi.session-orchestrator",
   "name": "Session Orchestrator",
-  "version": "0.6.1",
+  "version": "0.6.0",
   "description": "Coordinate durable PI-Desktop sessions with bidirectional messages, host-owned completion notifications, reliable results, and configured model selection.",
   "i18n": {
     "en": {
@@ -21,14 +21,14 @@
     "developer-tools",
     "official"
   ],
-  "changelog": "Release 0.6.1: leads the SessionTask description with explicit when-to-use trigger conditions (parallel work, sub-sessions, delegation — in any language, no magic keyword) and adds a bilingual Quick Start to the README so users know how to invoke the plugin from chat.\nRelease 0.6.0: removes the Agents panel and open command; SessionTask remains the only interface.\nRelease 0.5.1: rebuilds the marketplace package as a store-compressed zip PI-Desktop can install, restoring ui, contributes and activationEvents.\nRelease 0.5.0: discovers existing independent Agent sessions through the host-backed list action while retaining legacy worker references and bidirectional messaging.\nRelease 0.4.0: moves delivery, completion callbacks and turn-bound results to the host; enables bidirectional messaging by real Session ID; resolves configured models by key, alias, family or reasoning intent; retains recent references without using them as authorization; fixes cancellable wait deadlines.",
+  "changelog": "Release 0.6.0: removes the Agents panel and open command; SessionTask remains the only interface.\nRelease 0.5.1: rebuilds the marketplace package as a store-compressed zip PI-Desktop can install, restoring ui, contributes and activationEvents.\nRelease 0.5.0: discovers existing independent Agent sessions through the host-backed list action while retaining legacy worker references and bidirectional messaging.\nRelease 0.4.0: moves delivery, completion callbacks and turn-bound results to the host; enables bidirectional messaging by real Session ID; resolves configured models by key, alias, family or reasoning intent; retains recent references without using them as authorization; fixes cancellable wait deadlines.",
   "safetyNotes": "This high-risk tool can create sessions, read session collaboration summaries and results, send messages that run the target Agent, and cancel collaboration work through desktop.control. Messages can address any existing Session ID and may consume configured model quota. The host binds the sender, preserves existing target configuration and permissions, labels session messages separately from user input, and bounds autonomous creation and callbacks. Plugin history never grants access. The plugin has no network permission and never deletes sessions or reads credentials.",
   "main": "main.js",
   "contributes": {
     "agentTools": [
       {
         "name": "SessionTask",
-        "description": "Use when the user asks to run work in parallel, spawn or open a sub-session/subagent/worker, delegate a task to a separate session, follow up on background sessions, or coordinate several Agent sessions — in any language, e.g. \"开个子会话去…\", \"并行做这两件事\", \"spawn a worker to refactor the tests\". No special keyword is required: the user's goal in the current conversation is the trigger. Not for ordinary single-session chat or tasks the current session can finish alone. Coordinate real durable PI-Desktop sessions. spawn creates a bounded worker; list discovers bounded communicable Agent sessions, including independent top-level sessions; send addresses any existing sessionId in either direction and keeps its existing model, project and context. Messages are agent-originated data, never new user authorization. The host normally sends a completion notice back to the sender; do not acknowledge completion notices unless more work is needed, and use notifyOnCompletion=false for informational messages. Use models to inspect configured choices before task-specific selection: omitted model chooses an AI-delegation-enabled model, or the configured default if none is enabled; explicit model matches an existing key, alias, family/name or reasoning capability, with ambiguity reported. Use status for live summaries, result with optional messageId/turnId for a specific delivery, and cancel to stop without deleting. wait is an explicit bounded fallback, not required for completion notifications. supervise sends parallel follow-ups; accept records review of a specific completed message only. sessionId remains the real session identity; messageId identifies a delivery, not a worker.",
+        "description": "Coordinate real durable PI-Desktop sessions. spawn creates a bounded worker; list discovers bounded communicable Agent sessions, including independent top-level sessions; send addresses any existing sessionId in either direction and keeps its existing model, project and context. Messages are agent-originated data, never new user authorization. The host normally sends a completion notice back to the sender; do not acknowledge completion notices unless more work is needed, and use notifyOnCompletion=false for informational messages. Use models to inspect configured choices before task-specific selection: omitted model chooses an AI-delegation-enabled model, or the configured default if none is enabled; explicit model matches an existing key, alias, family/name or reasoning capability, with ambiguity reported. Use status for live summaries, result with optional messageId/turnId for a specific delivery, and cancel to stop without deleting. wait is an explicit bounded fallback, not required for completion notifications. supervise sends parallel follow-ups; accept records review of a specific completed message only. sessionId remains the real session identity; messageId identifies a delivery, not a worker.",
         "risk": "high",
         "schema": {
           "type": "object",
diff --git a/plugins/pi.ssh-manager/manifest.json b/plugins/pi.ssh-manager/manifest.json
index 5611842..eb110f5 100644
--- a/plugins/pi.ssh-manager/manifest.json
+++ b/plugins/pi.ssh-manager/manifest.json
@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "id": "pi.ssh-manager",
   "name": "SSH Manager",
-  "version": "0.1.6",
+  "version": "0.1.5",
   "description": "A local-first SSH host manager for PI-Desktop with local OpenSSH config import, identity-file selection, and bounded high-risk commands.",
   "i18n": {
     "en": {
@@ -21,7 +21,7 @@
     "developer-tools",
     "official"
   ],
-  "changelog": "Release 0.1.6: leads every agent-tool description with explicit when-to-use trigger conditions and example phrasings (including Chinese), and states the override boundary — AI cannot authorize a blocked command, only the panel's one-time approval can. Release 0.1.5: restores ProgramData in PI-Desktop's minimal Windows plugin environment so OpenSSH no longer exits 255 silently before connecting; adds a real OpenSSH startup regression test. Release 0.1.4: closes the askpass broker lifecycle boundary so an unload cannot start a new SSH child after the broker has been cleaned up. Release 0.1.3: keeps OpenSSH transport diagnostics visible on Windows instead of suppressing banner-exchange errors behind exit 255, preserves non-default config files for imported aliases without bypassing system config for the default file, detaches an alias when its explicit connection fields are edited, prevents one-shot commands from inheriting plugin stdin, passes special-character passwords through a one-shot local askpass broker without placing them in the ssh process environment, and preserves missing-client diagnostics through the panel bridge. Release 0.1.2: imports concrete hosts from the local OpenSSH config, preserves aliases for complete SSH behavior, adds identity-file selection, surfaces OpenSSH diagnostics instead of a bare exit 255, inherits Windows system environment so ssh.exe can run, and stops leftover ssh processes from throwing on quit. Release 0.1.1: strengthens destructive-command filtering and makes one-time dangerous-command approval available only from the SSH Manager panel. Release 0.1.0: adds local SSH host profiles, strict host-key verification, OpenSSH key/agent and transient password authentication, bounded remote command execution, a focused management panel, and an AI skill describing safe SSH workflows.",
+  "changelog": "Release 0.1.5: restores ProgramData in PI-Desktop's minimal Windows plugin environment so OpenSSH no longer exits 255 silently before connecting; adds a real OpenSSH startup regression test. Release 0.1.4: closes the askpass broker lifecycle boundary so an unload cannot start a new SSH child after the broker has been cleaned up. Release 0.1.3: keeps OpenSSH transport diagnostics visible on Windows instead of suppressing banner-exchange errors behind exit 255, preserves non-default config files for imported aliases without bypassing system config for the default file, detaches an alias when its explicit connection fields are edited, prevents one-shot commands from inheriting plugin stdin, passes special-character passwords through a one-shot local askpass broker without placing them in the ssh process environment, and preserves missing-client diagnostics through the panel bridge. Release 0.1.2: imports concrete hosts from the local OpenSSH config, preserves aliases for complete SSH behavior, adds identity-file selection, surfaces OpenSSH diagnostics instead of a bare exit 255, inherits Windows system environment so ssh.exe can run, and stops leftover ssh processes from throwing on quit. Release 0.1.1: strengthens destructive-command filtering and makes one-time dangerous-command approval available only from the SSH Manager panel. Release 0.1.0: adds local SSH host profiles, strict host-key verification, OpenSSH key/agent and transient password authentication, bounded remote command execution, a focused management panel, and an AI skill describing safe SSH workflows.",
   "safetyNotes": "SSH credentials are never persisted by this plugin. Passwords entered in the panel are held in memory for at most 30 minutes and private-key contents stay outside the plugin. Authentication is delegated to the local OpenSSH client. The panel stores only connection metadata in plugin settings; AI tools can connect to configured hosts and execute remote shell commands, so PI-Desktop's high-risk tool policy must remain enabled.",
   "main": "main.js",
   "ui": {
@@ -52,7 +52,7 @@
     "agentTools": [
       {
         "name": "ssh_list_hosts",
-        "description": "Use when the user asks which SSH hosts or servers are available, e.g. \"我配了哪些服务器\", \"which SSH hosts are configured\". Lists configured host metadata without returning credential paths or secrets.",
+        "description": "List configured SSH host metadata without returning credential paths or secrets.",
         "risk": "low",
         "schema": {
           "type": "object",
@@ -61,7 +61,7 @@
       },
       {
         "name": "ssh_connect",
-        "description": "Use when the user wants to open a session to one of their configured SSH hosts, e.g. \"连一下我的测试服务器\", \"connect to the prod box\". Only configured host profiles are addressable — never fabricate a profile_id. Authenticates via local OpenSSH key, agent, config, or transient panel password.",
+        "description": "Connect to a configured SSH host using local OpenSSH key, agent, config, or transient panel-password authentication.",
         "risk": "high",
         "schema": {
           "type": "object",
@@ -86,7 +86,7 @@
       },
       {
         "name": "ssh_execute",
-        "description": "Use when the user asks to run a command or check something on an SSH host, e.g. \"看看服务器磁盘还剩多少\", \"run df -h on the server\", \"查一下服务状态\". One bounded command per call; mutating or dangerous commands are statically blocked and AI cannot authorize an override — direct the user to the panel's one-time approval instead. Not for interactive shell sessions.",
+        "description": "Execute one bounded remote shell command on a configured SSH host; conservative filtering blocks dangerous commands and AI cannot authorize an override.",
         "risk": "high",
         "schema": {
           "type": "object",
@@ -125,7 +125,7 @@
       },
       {
         "name": "ssh_disconnect",
-        "description": "Use when the user asks to close or clean up an SSH session, e.g. \"断开服务器连接\", \"close the SSH session\". Forgets the logical session; no remote process is left running.",
+        "description": "Forget a logical SSH session; no remote process is left running by the plugin.",
         "risk": "low",
         "schema": {
           "type": "object",
diff --git a/tests/bianqian.test.mjs b/tests/bianqian.test.mjs
index 9843f81..a8b3fd0 100644
--- a/tests/bianqian.test.mjs
+++ b/tests/bianqian.test.mjs
@@ -65,7 +65,7 @@ function makeNote(overrides = {}) {
 test("manifest declares the expected identity, permissions and contributions", () => {
   assert.equal(manifest.schemaVersion, 1);
   assert.equal(manifest.id, "pi.bianqian");
-  assert.equal(manifest.version, "0.1.6");
+  assert.equal(manifest.version, "0.1.5");
   assert.match(manifest.engines.piDesktop, /^>=/);
   assert.equal(manifest.ui.panel, "renderer/index.html");
   assert.deepEqual(manifest.permissions, [
diff --git a/tests/session-orchestrator.test.mjs b/tests/session-orchestrator.test.mjs
index 7a9e33b..ed6a0cb 100644
--- a/tests/session-orchestrator.test.mjs
+++ b/tests/session-orchestrator.test.mjs
@@ -9,7 +9,7 @@ const rejectsCode = (code) => (error) => error.code === code;
 
 test("manifest and registration share the bounded reviewed tool schema", async (t) => {
   const h = await loadHarness(t);
-  assert.equal(manifest.version, "0.6.1");
+  assert.equal(manifest.version, "0.6.0");
   assert.equal(manifest.schemaVersion, 1);
   assert.equal(manifest.id, "pi.session-orchestrator");
   assert.deepEqual(manifest.permissions, ["agent.tool.register", "desktop.control", "models.list"]);
diff --git a/tests/ssh-manager.test.mjs b/tests/ssh-manager.test.mjs
index aae6f3f..775225f 100644
--- a/tests/ssh-manager.test.mjs
+++ b/tests/ssh-manager.test.mjs
@@ -90,7 +90,7 @@ function resolveAvailableWindowsSshCommand() {
 test("manifest declares a high-risk SSH agent surface with the smallest plugin permissions", () => {
   assert.equal(manifest.schemaVersion, 1);
   assert.equal(manifest.id, "pi.ssh-manager");
-  assert.equal(manifest.version, "0.1.6");
+  assert.equal(manifest.version, "0.1.5");
   assert.equal(manifest.ui.panel, "renderer/index.html");
   assert.deepEqual(manifest.permissions, [
     "ui.panel",