@awiki/dsh-plugin 0.2.4 → 0.3.0-rc.1

package/README.md

@@ -6,9 +6,10 @@ the model tools, and a Web client with a draggable AWiki Me launcher.
 
 [中文说明](./README.zh.md)
 
-Registration failures preserve the form and local pending identity material. Closed registration,
-unavailable verification state, and commit conflicts each give a safe next action without exposing
-remote response details.
+Identity-entry failures preserve the currently mounted form and local pending identity material. The
+phone and OTP never enter browser persistence, controller snapshots, or public
+Remote results. Closed registration, unavailable verification state, and commit conflicts each give
+a safe next action without exposing remote response details.
 
 The Rust SDK exclusively owns the identity, SecretVault, database, cache, and metadata below the
 configured `stateRoot`. This release performs a clean cutover and does not import the former
@@ -16,20 +17,44 @@ TypeScript SDK `identity.json`; create a new Rust-backed identity after upgradin
 
 ## Features
 
-- Register one deployment-level AWiki identity from the Web UI.
-- Open the top-left AWiki account menu to sign out locally without deleting the encrypted identity or message database; **Resume** restores the same DID and Handle, including across DSH restarts.
+- Enter a Handle and phone through one Web UI flow. Before any code is sent, the Host classifies the Handle: a new Handle receives a registration OTP and creates the deployment identity, while an existing Handle receives one Recovery V4 OTP and enters the recovery state machine directly.
+- Open the top-left AWiki account menu to sign out locally without deleting the encrypted identity or message database; **Resume local identity** restores the same DID and Handle, including across DSH restarts. The signed-out screen reveals phone recovery only after local resume fails. Switching identities requires an explicit confirmation that permanently clears local AWiki data first.
 - Reuse that identity across the root Agent and its subagents.
-- Direct-message and existing-group conversation lists, unread counts, latest-message previews, and persisted display names. Opening a conversation keeps loading feedback inside the history and lands on the newest message; scrolling up reveals a latest-message control that counts newer arrivals without interrupting reading. A conversation is marked read only after its newest rendered message reaches the visible bottom.
-- Text messages plus one attachment per message, with Enter-to-send, Shift+Enter line breaks, optimistic sending bubbles, image previews, and SHA verification.
+- Direct-message and existing-group conversation lists, unread counts, latest-message previews, and persisted display names. Core SQLite remains the persistent source of truth: the Host joins persisted peer profiles onto Direct roster rows, while the browser keeps the active identity's last trustworthy Direct profile and group title. Sparse polling identifiers therefore cannot overwrite a resolved display name or real group title. After an existing Handle is recovered, the Host synchronizes account projections before asking Core to restore old group memberships; pending or blocked groups expose a retryable status without disabling Direct messages or other groups. Opening a conversation renders the committed local timeline first, hydrates group sender labels from the Core display-profile cache, reconciles remote history and Direct profile data in the background, and keeps local messages visible if refresh fails. A failed background roster poll also leaves the usable local view quiet; explicit loads still surface their errors. This local-first path covers the newest projected page; loading older messages still requires the remote history service. Scrolling up reveals a latest-message control that counts newer arrivals without interrupting reading. A conversation is marked read only after its newest rendered message reaches the visible bottom.
+- Create a private-discovery, open-join, transport-protected group from the Web UI with a name and 1–50 initial Handle or DID members. The group opens immediately; members that could not be added are reported without hiding the successfully created group.
+- Text messages plus one attachment per message, with Enter-to-send, Shift+Enter line breaks, optimistic sending bubbles reconciled by an exact client message ID, image previews, and SHA verification. Verified image bytes use three bounded layers: a browser-runtime LRU makes conversation remounts immediate, identity-scoped IndexedDB survives full page reloads without a Host call, and the private Host disk cache survives browser-storage loss and Harness restarts. Clear Local Data removes all three layers.
 - A draggable circular launcher, adaptive popup placement, dark mode, and remembered active conversation.
 - User-triggered AI summaries for up to 50 recent or unread messages, kept only in runtime memory with explicit stale, retry, copy, and source-navigation states.
-- OTP registration keeps the verification form visible and disables resend with a visible server-directed cooldown countdown.
-- An AWiki page in DSH Settings for a durable, validated default Handle domain.
+- OTP identity access keeps the verification form visible and disables resend with a visible server-directed cooldown countdown. Handle classification happens before OTP delivery, so each attempt sends exactly one purpose-correct registration or recovery code.
+- When the separate `@awiki/dsh-model-proxy` package is installed, an AWiki-hosted DeepSeek choice appears before the official API-key onboarding step only when Harness has no usable model provider, with an explicit opt-in and an unchanged API-key escape path. New sessions do not show AWiki model or payment prompts after the official or another provider is usable.
+- The optional model-proxy package owns the Host-only short-token flow registering `awiki-deepseek` with `deepseek-v4-flash` and `deepseek-v4-pro`; Flash is recommended and credentials never enter the Browser.
+- Advanced AWiki settings are always available. Account & Recharge and Usage tabs appear only when `@awiki/dsh-model-proxy` is loaded, exposing explicit model state and calculated versus charged usage.
 - A typed second confirmation in the Settings danger zone before permanently clearing local AWiki identity, key, token, registration-draft, and message-index state.
-- Five approval-aware Agent tools: identity status, conversations, history, text send, and attachment send.
+- Five messaging Agent tools: identity status, conversations, history, approved text send, and approved attachment send.
+- Five on-demand mail Agent tools: mailbox account, inbox, plain-text read, approved mark-read, and approved plain-text send.
+- An opt-in realtime listener that lets exact-allowlisted Direct peers continue one DSH Agent session or use `/new`, `/status`, and `/help`.
+
+## Screenshots
+
+### Messaging
+
+![AWiki direct and group messaging in DeepSeek Harness](./assets/screenshots/awiki-messaging.png)
+
+### Mail
+
+![AWiki mailbox in DeepSeek Harness](./assets/screenshots/awiki-mail.jpg)
 
 The first release does not implement end-to-end encryption, multiple identities,
-group administration, realtime push, or multiple attachments in one message.
+post-creation group administration or multiple attachments in one message. The Agent listener accepts only
+plain Direct text; Groups, attachments, encrypted/payload content, and unknown slash commands never
+reach the Agent.
+
+Mail v1 is on demand only and has no browser mailbox or compose UI. It does not wake an Agent for
+new mail, render or send HTML, transfer mail attachments, or implement reply, forward, and
+threading. Mail subject, addresses, preview, body, timestamps, and attachment metadata are
+untrusted external data, never Agent instructions. `awiki_mail_mark_read` and `awiki_mail_send`
+require execution approval. Mail send is attempted once without automatic retry; a timeout or
+transport loss returns `delivery-unknown`, so inspect the mailbox before approving another send.
 
 ## Install
 
@@ -39,6 +64,13 @@ Install the official public npm package:
 dsh plugin --profile web add @awiki/dsh-plugin@latest
 ```
 
+The main package no longer installs the AWiki-hosted model provider. Add the
+independently versioned Host-only package only when that capability is wanted:
+
+```bash
+dsh plugin --profile web add @awiki/dsh-model-proxy@latest
+```
+
 The profile installer both adds the package and activates its bundle layer. A
 plain `npm i @awiki/dsh-plugin` in a DSH project only installs the package; it
 does not activate the bundle, so the profile command remains the recommended
@@ -51,8 +83,11 @@ families in a DSH root dependency tree.
 not an installation source for this release line.
 
 Apply the package after the normal DSH base and Web app bundles. Its
-`cordis.patch.yml` adds the Host service and provider; DSH discovers and injects
-the browser client through the package metadata.
+The main `cordis.patch.yml` adds the AWiki Host service, Rust SDK provider, and
+summary provider; DSH discovers and injects the browser client through the
+package metadata. It does not insert Model Proxy. The optional package has its
+own patch, inserts exactly one `awiki-model-proxy` row after AWiki, and declares
+an explicit dependency on the loaded `awiki` service.
 
 ## Configuration
 
@@ -63,18 +98,77 @@ The plugin works against the public `awiki.ai` tenant without environment config
 | `DSH_AWIKI_USER_SERVICE_URL` | Absolute AWiki user-service URL | `https://awiki.ai` |
 | `DSH_AWIKI_USER_SERVICE_DOMAIN` | Composition default for the Handle provider domain | `awiki.ai` |
 | `DSH_AWIKI_MESSAGE_SERVICE_URL` | Message-service URL called by the Host | `https://awiki.ai` |
+| `DSH_AWIKI_MAIL_SERVICE_URL` | Mail-service URL called by the Host | Resolved user-service URL |
 | `DSH_AWIKI_MESSAGE_SERVICE_DID` | Authoritative message-service DID | `did:wba:awiki.ai` |
 | `DSH_AWIKI_MESSAGE_SERVICE_PUBLIC_URL` | Public endpoint written to protocol records | `https://awiki.ai` |
 | `DSH_AWIKI_ALLOWED_ATTACHMENT_ORIGINS` | JSON array of extra exact HTTPS origins | `[]` |
 | `DSH_AWIKI_STATE_ROOT` | Private Rust IM Core state directory | `$DSH_HOME/awiki/im-core` or `~/.dsh/awiki/im-core` |
+| `DSH_AWIKI_VAULT_ROOT_KEY_FILE` | Existing private file containing a base64/base64url 32-byte Vault root key | `$DSH_HOME/awiki/secret-vault/root-key.b64u` |
+| `DSH_AWIKI_VAULT_WORKSPACE_ID` | Stable non-secret Vault workspace context | `dsh-awiki` |
+| `DSH_AWIKI_VAULT_DEVICE_ID` | Stable non-secret Vault device context | `local-device` |
 | `DSH_AWIKI_POLL_INTERVAL_MS` | Open-dialog polling interval | `5000` |
 | `DSH_AWIKI_ATTACHMENT_MAX_BYTES` | Decoded attachment limit | `10485760` |
+| `DSH_AWIKI_IMAGE_CACHE_MAX_BYTES` | Private verified image-preview cache budget | `67108864` |
+| `DSH_AWIKI_LISTENER_ENABLED` | Enable the Direct-to-Agent listener | `false` |
+| `DSH_AWIKI_LISTENER_ALLOWED_PEERS` | JSON array of exact Handles or DIDs; required when enabled | `[]` |
+| `DSH_AWIKI_LISTENER_WORKSPACE_PATH` | Absolute shared Workspace for AWiki-originated Sessions | `$DSH_HOME/workspaces/awiki` or `~/.dsh/workspaces/awiki` |
 | `DSH_AWIKI_SUMMARY_MAX_INPUT_BYTES` | UTF-8 cap after Host-side summary minimization | `32768` |
 | `DSH_AWIKI_SUMMARY_TIMEOUT_MS` | One-shot model deadline | `30000` |
 | `DSH_AWIKI_SUMMARY_MAX_OUTPUT_TOKENS` | Structured summary output cap | `768` |
+## AWiki-hosted DeepSeek account
+
+This capability now requires the separate `@awiki/dsh-model-proxy` package. It
+uses `ctx.awiki.externalHttpAuth` to obtain a short-lived
+model token inside the Host and reuses the Harness DeepSeek adapter. The Browser receives only
+sanitized account, usage, and order state over a loopback RPC channel. DID signatures, bearer
+tokens, and upstream platform credentials are absent from the browser bundle.
+
+The former runtime import `@awiki/dsh-plugin/model-proxy` has been removed. Use
+`@awiki/dsh-model-proxy`; the shared browser-safe contract intentionally remains
+`@awiki/dsh-plugin/model-proxy-contract`. Installing only the main package keeps
+model onboarding, account/recharge, and usage entry points hidden while leaving
+AWiki Advanced settings functional.
+
+This RC split starts with `@awiki/dsh-plugin@0.3.0-rc.1` and
+`@awiki/dsh-model-proxy@0.1.0-rc.1`. The optional package requires main `^0.3.0-rc.1`, so
+it cannot be combined with a `0.2.x` main package that still inserted the old
+runtime by default.
+
+The optional package owns these configuration variables:
+
+| Variable | Purpose | Default |
+| --- | --- | --- |
+| `DSH_AWIKI_MODEL_PROXY_URL` | AWiki-hosted DeepSeek proxy root URL | `https://model.awiki.info` |
+| `DSH_AWIKI_MODEL_CONTEXT_WINDOW` | AWiki-hosted DeepSeek context window | `1000000` |
+| `DSH_AWIKI_MODEL_MAX_TOKENS` | Maximum AWiki-hosted DeepSeek output | `8192` |
+| `DSH_AWIKI_MODEL_TOKEN_REFRESH_SKEW_SECONDS` | Early short-token refresh interval | `60` |
+
+AWiki-hosted DeepSeek is disabled by default. Only an explicit choice in onboarding or Settings → AWiki →
+Account & Recharge registers the `awiki-deepseek` route and selects Flash. Disabling restores the
+previous provider, model, and reasoning effort. A successful recharge refreshes the balance but
+never enables AWiki or changes the selected model automatically.
+
+The settings UI supports both payment redirects and TongQiFu `ALI_QR` content. When payments are
+disabled it reports the development restriction without blocking an account whose
+`model_access_available` flag is true. Development bypass displays calculated and charged amounts
+separately, with zero charged; it does not invent a price when no price table is active.
+Public recharge creation also has a client release gate in
+`src/client/recharge-availability.ts`. The gate is currently closed: recharge controls remain
+visible, but attempting to recharge shows a localized coming-soon dialog and sends no order RPC.
+Open that single gate only after the production collection account is ready; the existing payment,
+polling, and cancellation flows remain intact behind it.
+Strict billing keeps the internal billing-mode label out of the normal account summary. When the
+backend reports `model_access_reason=insufficient_balance`, recharge becomes the primary action and
+model enablement is withheld until credit is available. The Host restores the newest pending order
+and its payment action whenever the settings page is reopened, polls it without creating duplicates,
+and still requires an explicit model opt-in after payment. Recharge amounts are immutable after order
+creation. To choose another amount, the user confirms **Cancel and change amount**; the Host first
+closes the provider order, then restores the amount editor without creating a replacement. A close
+failure leaves the existing payment action available, while a payment that wins the race refreshes
+the credited account instead of being reported as cancelled.
 
 The default Handle provider domain is `awiki.ai`. A local user can override it
-from Settings → AWiki; DSH persists that choice in its settings document and
+from Settings → AWiki → Advanced; DSH persists that choice in its settings document and
 applies it after the next Harness restart. The setting affects future identity
 registration and completion of short Handles. It does not rewrite an already
 registered DID or Handle.
@@ -84,22 +178,37 @@ accepts only from loopback. This keeps an independently installed `@awiki/dsh-pl
 compatible with stock DSH releases without adding AWiki to a core settings
 allowlist; non-local browser origins cannot read or mutate the Host setting.
 
-Settings → AWiki → Danger zone clears only this installation's local AWiki
+Settings → AWiki → Advanced → Danger zone clears only this installation's local AWiki
 state; it does not delete the server-side account or Handle. The dialog requires
 the displayed confirmation phrase. After success, the local DID keys, access
-token, registration draft, conversations, and attachment index cannot be
+token, registration draft, conversations, attachment index, and cached image previews cannot be
 recovered by the app, and this installation may lose access to the old identity.
 
 Ordinary sign-out is separate from that destructive action. It writes only a private
 Host-owned session marker, gates both Web and Agent operations, and retains the SDK-owned
-SecretVault identity, keys, tokens, conversations, and attachment index. Resuming removes
-the marker and reloads the same local identity without registration.
+SecretVault identity, keys, tokens, conversations, attachment index, and cached image previews. **Resume local
+identity** removes the marker and reloads that identity without registration. The signed-out screen does not
+show a competing recovery path by default; phone recovery appears only after resume fails. **Use another
+identity** requires a checked destructive-data confirmation and returns to the unified Handle entry only after
+local clearing succeeds, where the same form creates a new identity or recovers an existing one.
 
 The provider domain and message-service DID are protocol identifiers. Do not
 infer them from an API hostname. Production service URLs must use HTTPS. The IM Core state directory contains access material;
 keep it outside the repository, restrict filesystem access, and protect the
 underlying disk and backups.
 
+The Node facade owns `stateRoot/vault/root-key.b64u`; the Host does not provide, copy, or log Vault
+key material. Preserve the complete SDK state root across ordinary restarts and upgrades.
+
+The listener is disabled unless both `DSH_AWIKI_LISTENER_ENABLED=true` and a non-empty exact
+allowlist are configured. On startup and every Core realtime scheduling signal it runs canonical
+reliable sync before reading committed history. Core owns WebSocket connection and reconnect;
+stream closure is recovered as stop, reconnect sync, then replacement realtime session. One
+persisted route and message watermark per Direct conversation preserve the current DSH Session
+across restarts. Every AWiki-originated Session is created in and attached to the registered shared
+AWiki Workspace. Listener messages are untrusted user data and do not approve tools or bridge
+approval/user-question prompts.
+
 For the default 10 MiB decoded attachment cap, configure a reverse-proxy request
 limit of at least 14 MiB to account for base64 and JSON overhead.
 
@@ -147,22 +256,22 @@ Web client bundle. Exposing it across an untrusted boundary would create a signi
 
 ## Development
 
-Requirements: Node.js 22.19+ (or 24+) and pnpm 11.7.
+Requirements: Node.js 22.19+ (or 24+) and pnpm 11.22.
 
 ```bash
 pnpm install --frozen-lockfile
-pnpm run verify
+pnpm run verify:workspace
 pnpm pack --dry-run
 ```
 
-The production Host loads the exact `@awiki/im-core-node@0.1.3` runtime package;
+The production Host loads the exact `@awiki/im-core-node@0.1.6` runtime package;
 the platform-specific native addon is selected through its optional dependencies
 and remains external to the JavaScript bundle. Consumers do not need Rust or an
 `awiki-cli-rs2` checkout. See `THIRD_PARTY_NOTICES.md` for provenance and
 licensing.
 
 The checked-in Typert Host/Remote artifacts were generated from the same Host
-contract. `pnpm check:generated` pins their complete seventeen-method surface until
+contract. `pnpm check:generated` pins their complete eighteen-method surface until
 the standalone Typert generator supports root-level packages.
 
 ## Security

package/README.zh.md

@@ -10,19 +10,41 @@ Rust 身份。
 
 ## 功能
 
-- 在 Web UI 中注册一个部署级 AWiki 身份，根 Agent 与子 Agent 共用。
-- 点击 AWiki 面板左上角图标可打开账户菜单；普通退出只锁定本机会话，不删除加密身份或消息数据库，重新进入及重启 DSH 后仍恢复同一个 DID 和 Handle。
-- 注册失败时保留手机号、Handle、验证码和本机待注册密钥；注册未开放、验证码状态失效和提交冲突会给出对应的安全处理提示。
-- 私聊和已有群聊列表、未读角标、最新消息预览、时间更新与昵称持久化。打开会话时在消息区内显示加载状态并落到最新消息；向上阅读时显示下滑箭头，新消息到达后在同一控件中累计数量且不打断阅读位置。只有最新一条已渲染消息到达可视区域底部后，当前会话才会自动标记为已读。
-- 文本和单附件消息；Enter 发送、Shift+Enter 换行，发送中立即显示带 loading 动画的乐观气泡，并支持图片预览、附件说明与 SHA 校验。
+- 在 Web UI 的统一入口输入 Handle 和手机号。Host 会在发送验证码前判断 Handle 状态：新 Handle 只发送注册验证码并创建部署级身份，已有 Handle 只发送 Recovery V4 恢复验证码并直接进入恢复流程；根 Agent 与子 Agent 共用最终身份。
+- 点击 AWiki 面板左上角图标可打开账户菜单；普通退出只锁定本机会话，不删除加密身份或消息数据库，重新进入及重启 DSH 后仍恢复同一个 DID 和 Handle。退出页默认只提供重新进入本机身份和使用其他身份；只有本机重新进入失败后才显示手机号恢复入口。改用其他身份必须先确认永久清除本地 AWiki 数据。
+- 身份入口失败时保留当前挂载表单中的手机号、Handle 和验证码，以便修正后重试；手机号和验证码不进入 Browser 持久化状态、controller snapshot 或公开 Remote 结果。仅恢复操作编号可用于崩溃续跑。注册未开放、验证码状态失效和提交冲突会给出对应的安全处理提示。
+- 私聊和已有群聊列表、未读角标、最新消息预览、时间更新与昵称持久化。Core SQLite 是持久化真相源：Host 将持久化的对端资料合并进私聊列表，浏览器再按当前身份保留最后一次可信的私聊资料和群名，稀疏轮询中的 Handle、DID 或 Group DID 占位不会覆盖真实名称。恢复已有 Handle 后，Host 会先同步账号投影，再让 Core 自动恢复旧群聊成员身份；未完成或受阻的群聊会显示可重试状态，但不影响私聊和其他群聊。打开会话时先显示 Core 已提交的本地时间线，并从 Core 显示资料缓存补齐群消息发送者名称，再在后台补齐远端历史和私聊资料；刷新失败不会清空本地消息。后台会话轮询失败也不会用全局红条打断仍可用的本地页面，用户主动加载失败仍会正常提示。当前 local-first 只覆盖本地最新一页，“加载更早消息”仍需访问远端 history。向上阅读时显示下滑箭头，新消息到达后在同一控件中累计数量且不打断阅读位置。只有最新一条已渲染消息到达可视区域底部后，当前会话才会自动标记为已读。
+- 可从 Web UI 输入群名和 1–50 个 Handle 或 DID 发起私有发现、开放加入、传输保护的群聊。建群成功后立即进入新会话；个别成员添加失败会单独提示，不会隐藏已经创建的群。
+- 文本和单附件消息；Enter 发送、Shift+Enter 换行，发送中立即显示带 loading 动画的乐观气泡，并通过精确的客户端消息 ID 与已提交消息对账，避免同一条消息显示两个气泡；同时支持图片预览、附件说明与 SHA 校验。校验通过的图片字节使用三层有界缓存：浏览器运行期 LRU 让会话重新挂载时立即出图，按身份隔离的 IndexedDB 在整页刷新后无需访问 Host，Host 私有磁盘缓存则应对浏览器缓存丢失并跨 Harness 重启复用；“清除本地数据”会删除三层缓存。
 - 圆形可拖动入口、自适应四角弹窗、深色模式和当前会话记忆。
 - 用户点击后才生成的 AI 对话总结：最多处理 50 条最近或未读消息，按会话保留本次运行期缓存，并支持过期提示、重试、复制与跳转原消息。
-- OTP 注册会保留验证码输入表单，并按服务端返回的冷却时间显示重发倒计时、禁用提前重发。
-- 在 DSH 设置中提供 AWiki 页面，可持久化修改并校验默认 Handle 域名。
+- OTP 身份入口会保留验证码输入表单，并按服务端返回的冷却时间显示重发倒计时、禁用提前重发；Handle 分流发生在发送前，因此每次只会发送一个用途正确的注册或恢复验证码。
+- 安装独立的 `@awiki/dsh-model-proxy` 后，仅在 Harness 没有任何可用模型时，首次引导才会在官方 API Key 步骤前提供 AWiki 托管模型选项；用户可以明确启用，也可以跳过并继续原版 API Key 流程。已经配置官方或其他 Provider 时，新会话不会显示 AWiki 模型或支付提示。
+- 可选 Model Proxy 包独占 Host 内部短期 Token 与 `awiki-deepseek` Provider，提供 `deepseek-v4-flash` 和 `deepseek-v4-pro`，默认推荐 Flash；Token 不进入 Browser。
+- “高级设置”始终可用；只有加载 `@awiki/dsh-model-proxy` 后才显示“账户与充值”和“用量明细”，用于显式启停模型并查看计算费用和实际扣费。
 - 在设置页危险区域中，经输入确认词的二次确认后，永久清空本机 AWiki 身份、密钥、令牌、注册草稿和消息索引。
-- 五个受 Harness 审批约束的 Agent 工具：身份、会话、历史、文本发送、附件发送。
+- 五个消息 Agent 工具：身份、会话、历史、需审批的文本发送和需审批的附件发送。
+- 五个按需邮件 Agent 工具：邮箱账户、收件箱、纯文本读取、需审批的标记已读和需审批的纯文本发送。
+- 可选的实时监听模式：exact allowlist 中的私聊对方可续接一个 DSH Agent 会话，或使用 `/new`、`/status`、`/help`。
 
-首版不包含端到端加密、多身份、群管理、实时推送和单消息多附件。
+## 界面截图
+
+### 消息
+
+![DeepSeek Harness 中的 AWiki 私聊与群聊界面](./assets/screenshots/awiki-messaging.png)
+
+### 邮件
+
+![DeepSeek Harness 中的 AWiki 邮箱界面](./assets/screenshots/awiki-mail.jpg)
+
+首版不包含端到端加密、多身份、建群后的成员或群设置管理和单消息多附件。Agent listener 只接受明文私聊文本；
+群聊、附件、加密/payload 内容和未知斜杠命令都不会进入 Agent。
+
+邮件 v1 仅支持按需调用，不提供浏览器收件箱或写信 UI，也不会以新邮件唤醒 Agent；不渲染或
+发送 HTML，不传输邮件附件，也不支持回复、转发和会话串联。邮件主题、地址、预览、正文、
+时间戳和附件元数据都是不可信外部数据，不能作为 Agent 指令。`awiki_mail_mark_read` 和
+`awiki_mail_send` 每次执行都需要审批。邮件发送只尝试一次且不自动重试；超时或传输中断返回
+`delivery-unknown`，再次审批发送前应先检查邮箱。
 
 ## 安装
 
@@ -32,6 +54,13 @@ Rust 身份。
 dsh plugin --profile web add @awiki/dsh-plugin@latest
 ```
 
+主包不再默认安装 AWiki 托管模型 Provider。仅在需要该能力时，另行安装独立版本的
+Host-only 包：
+
+```bash
+dsh plugin --profile web add @awiki/dsh-model-proxy@latest
+```
+
 Profile 安装器会同时添加包并激活 bundle layer。在 DSH 项目根目录执行普通的
 `npm i @awiki/dsh-plugin` 只会安装依赖，不会激活 bundle，因此仍推荐使用上述
 Profile 命令。本发布线面向 `0.1.0-rc.7` 包族，并精确锁定所有直接 Host peer，
@@ -40,8 +69,10 @@ Profile 命令。本发布线面向 `0.1.0-rc.7` 包族，并精确锁定所有
 从 `0.2.0-rc.4` 起，`@awiki/dsh-plugin` 是唯一规范包名。原
 `@awiki/dsh` registry 条目已被 unpublish，不再作为本发布线的安装来源。
 
-请在常规 DSH base 和 Web app bundle 之后应用本包。`cordis.patch.yml` 会加入
-Host Service 和 Provider；浏览器客户端由 DSH 根据包元数据自动发现并注入。
+请在常规 DSH base 和 Web app bundle 之后应用本包。主包 `cordis.patch.yml` 会加入
+AWiki Host Service、Rust SDK Provider 和 Summary Provider；浏览器客户端由 DSH 根据
+包元数据自动发现并注入。主 patch 不再插入 Model Proxy。可选包使用自己的 patch，
+只插入一个 `awiki-model-proxy`，并显式依赖已经加载的 `awiki` 服务。
 
 ## 配置
 
@@ -52,17 +83,64 @@ Host Service 和 Provider；浏览器客户端由 DSH 根据包元数据自动
 | `DSH_AWIKI_USER_SERVICE_URL` | AWiki user service 绝对 URL | `https://awiki.ai` |
 | `DSH_AWIKI_USER_SERVICE_DOMAIN` | Handle 提供方域名的部署默认值 | `awiki.ai` |
 | `DSH_AWIKI_MESSAGE_SERVICE_URL` | Host 调用的 message service URL | `https://awiki.ai` |
+| `DSH_AWIKI_MAIL_SERVICE_URL` | Host 调用的 mail service URL | 解析后的 user service URL |
 | `DSH_AWIKI_MESSAGE_SERVICE_DID` | 权威消息服务 DID | `did:wba:awiki.ai` |
 | `DSH_AWIKI_MESSAGE_SERVICE_PUBLIC_URL` | 写入协议记录的公开 endpoint | `https://awiki.ai` |
 | `DSH_AWIKI_ALLOWED_ATTACHMENT_ORIGINS` | 额外附件 HTTPS origin 的 JSON 数组 | `[]` |
 | `DSH_AWIKI_STATE_ROOT` | 私有 Rust IM Core 状态目录 | `$DSH_HOME/awiki/im-core` 或 `~/.dsh/awiki/im-core` |
+| `DSH_AWIKI_VAULT_ROOT_KEY_FILE` | 含 base64/base64url 32-byte Vault root key 的既有私有文件 | `$DSH_HOME/awiki/secret-vault/root-key.b64u` |
+| `DSH_AWIKI_VAULT_WORKSPACE_ID` | 稳定、非秘密的 Vault workspace context | `dsh-awiki` |
+| `DSH_AWIKI_VAULT_DEVICE_ID` | 稳定、非秘密的 Vault device context | `local-device` |
 | `DSH_AWIKI_POLL_INTERVAL_MS` | 弹窗打开时的轮询间隔 | `5000` |
 | `DSH_AWIKI_ATTACHMENT_MAX_BYTES` | 解码后的附件上限 | `10485760` |
+| `DSH_AWIKI_IMAGE_CACHE_MAX_BYTES` | 私有图片预览缓存的磁盘预算 | `67108864` |
+| `DSH_AWIKI_LISTENER_ENABLED` | 开启私聊到 Agent 的 listener | `false` |
+| `DSH_AWIKI_LISTENER_ALLOWED_PEERS` | exact Handle/DID JSON 数组；开启时必填 | `[]` |
+| `DSH_AWIKI_LISTENER_WORKSPACE_PATH` | 所有 AWiki Session 共用的绝对 Workspace 路径 | `$DSH_HOME/workspaces/awiki` 或 `~/.dsh/workspaces/awiki` |
 | `DSH_AWIKI_SUMMARY_MAX_INPUT_BYTES` | Host 最小化后的 UTF-8 输入上限 | `32768` |
 | `DSH_AWIKI_SUMMARY_TIMEOUT_MS` | 单次模型调用超时 | `30000` |
 | `DSH_AWIKI_SUMMARY_MAX_OUTPUT_TOKENS` | 结构化摘要输出上限 | `768` |
+## AWiki 托管模型账户
+
+该能力现在需要单独安装 `@awiki/dsh-model-proxy`。它通过
+`ctx.awiki.externalHttpAuth` 在 Host 内向模型代理换取
+短期 Token，并复用 Harness 的 DeepSeek Adapter。Browser 只能通过 loopback RPC 读取经过
+裁剪的账户、用量和订单状态；DID 签名、Bearer Token 和上游平台密钥都不会进入浏览器包。
+
+旧运行时导入 `@awiki/dsh-plugin/model-proxy` 已移除，请改用
+`@awiki/dsh-model-proxy`；浏览器安全的公共契约继续保留在
+`@awiki/dsh-plugin/model-proxy-contract`。只安装主包时，模型首次引导、账户/充值和
+用量入口保持隐藏，高级 AWiki 设置仍可正常使用。
+
+本次 RC 拆分从 `@awiki/dsh-plugin@0.3.0-rc.1` 与
+`@awiki/dsh-model-proxy@0.1.0-rc.1` 开始。可选包 peer 固定为主包 `^0.3.0-rc.1`，避免与仍会
+默认插入旧 runtime 的 `0.2.x` 主包组合后加载两个 Model Proxy。
+
+以下环境变量归可选包所有：
 
-Handle 提供方的默认域名为 `awiki.ai`。本机用户可以在“设置 → AWiki”中覆盖该值；
+| 环境变量 | 用途 | 默认值 |
+| --- | --- | --- |
+| `DSH_AWIKI_MODEL_PROXY_URL` | AWiki 托管的 DeepSeek 代理服务根 URL | `https://model.awiki.info` |
+| `DSH_AWIKI_MODEL_CONTEXT_WINDOW` | AWiki 托管模型上下文窗口 | `1000000` |
+| `DSH_AWIKI_MODEL_MAX_TOKENS` | AWiki 托管模型单次最大输出 | `8192` |
+| `DSH_AWIKI_MODEL_TOKEN_REFRESH_SKEW_SECONDS` | 短期 Token 提前刷新秒数 | `60` |
+
+插件默认关闭 AWiki 托管模型。用户在首次引导或“设置 → AWiki → 账户与充值”明确启用后，
+才注册 `awiki-deepseek` 路由并把 Flash 设为默认模型；停用时会恢复启用前的默认 Provider、
+模型和 reasoning effort。充值到账只刷新余额，不会自动启用 AWiki 或切换当前模型。
+
+设置页同时支持支付跳转和通企付 `ALI_QR` 二维码。支付功能关闭时会显示“开发环境暂未开放
+充值”，但只要账户响应中的 `model_access_available` 为真，仍可启用模型。开发绕过模式会
+展示计算费用和实际扣费的区别，实际扣费固定为 0；未激活价表时不显示臆造价格。
+正式计费时，账户摘要不会显示内部的“计费模式”项。后端返回
+`model_access_reason=insufficient_balance` 时，界面会把充值作为当前主要操作，余额到账前
+不显示误导性的启用按钮。Host 会在每次重新打开设置时恢复最新的待支付订单和支付入口，
+持续查询状态并阻止重复创建；支付到账后仍必须由用户明确启用托管模型。
+充值金额在订单创建后不可修改。需要更换金额时，用户必须确认“取消并修改金额”；Host 会先
+关闭支付平台订单，再恢复金额输入框，并且不会自动创建替代订单。关闭失败时原支付入口继续
+有效；若支付在关闭竞态中先完成，界面会刷新已入账账户，而不会误报订单已取消。
+
+Handle 提供方的默认域名为 `awiki.ai`。本机用户可以在“设置 → AWiki → 高级设置”中覆盖该值；
 DSH 会把选择写入自己的设置文件，并在下次重启 Harness 后生效。该设置影响后续
 身份注册和短 Handle 的域名补全，不会改写已经注册的 DID 或 Handle。
 
@@ -70,18 +148,30 @@ DSH 会把选择写入自己的设置文件，并在下次重启 Harness 后生
 因此独立安装的 `@awiki/dsh-plugin` 无需修改 DSH 核心设置白名单；非本机浏览器来源不能
 读取或修改这项 Host 设置。
 
-“设置 → AWiki → 危险区域”中的清空操作只删除此安装的本地 AWiki 状态，不删除
+“设置 → AWiki → 高级设置 → 危险区域”中的清空操作只删除此安装的本地 AWiki 状态，不删除
 服务端账号或 Handle。执行前必须在确认弹窗中输入指定确认词；成功后本机 DID 私钥、
-访问令牌、注册草稿、会话记录和附件索引无法通过应用恢复，原身份也可能无法再由本机使用。
+访问令牌、注册草稿、会话记录、附件索引和图片预览缓存无法通过应用恢复，原身份也可能无法再由本机使用。
 
 普通“退出登录”与危险区域的永久清空相互独立。退出只写入一个 Host 私有会话标记，
-同时阻止 Web UI 和 Agent 使用该身份；SecretVault 中的身份、密钥、令牌、会话和附件索引
-全部保留。“重新进入”会移除标记并恢复同一个本机身份，不需要重新注册。
+同时阻止 Web UI 和 Agent 使用该身份；SecretVault 中的身份、密钥、令牌、会话、附件索引和图片预览缓存
+全部保留。“重新进入本机身份”会移除标记并恢复同一个本机身份，不需要重新注册。退出页默认不显示恢复入口；
+只有重新进入失败后，才提供原身份的手机号恢复。“使用其他身份”必须先勾选不可逆数据清除确认，清理成功后回到
+统一身份入口，并由同一个 Handle 表单判断是创建新身份还是恢复已有身份。
 
 Provider 域名和消息服务 DID 都是协议标识，不能根据 API host 猜测。生产环境 URL
 必须使用 HTTPS。IM Core 状态目录含访问材料，应置于仓库外，限制文件权限，并为磁盘
 和备份提供保护。
 
+Node facade 独占 `stateRoot/vault/root-key.b64u`；Host 不提供、不复制也不记录 Vault key
+material。普通重启与升级期间应完整保留 SDK state root。
+
+Listener 只有在 `DSH_AWIKI_LISTENER_ENABLED=true` 且 exact allowlist 非空时才启用。启动和每个
+Core realtime 调度信号都会先执行 canonical reliable sync，再读取已提交 history。WebSocket
+连接与重连由 Core 所有；stream 关闭固定按“停止旧 session、reconnect sync、启动 replacement”
+恢复。每个私聊持久化一个当前 DSH Session route 和消息 watermark，重启后可续接；所有 AWiki
+来源 Session 都创建并 attach 到已注册的共享 AWiki Workspace。Listener 消息始终是不可信用户
+数据，不会自动批准工具，也不会桥接 approval 或 user-question prompt。
+
 默认附件上限为解码后 10 MiB；反向代理请求体上限至少应为 14 MiB，以容纳
 base64 与 JSON 封装开销。
 
@@ -123,20 +213,20 @@ redirect，由 Rust 自动选择当前 origin 的进程内 Bearer Token 或新 H
 
 ## 开发与验证
 
-需要 Node.js 22.19+（或 24+）以及 pnpm 11.7：
+需要 Node.js 22.19+（或 24+）以及 pnpm 11.22：
 
 ```bash
 pnpm install --frozen-lockfile
-pnpm run verify
+pnpm run verify:workspace
 pnpm pack --dry-run
 ```
 
-生产 Host 加载固定版本 `@awiki/im-core-node@0.1.3`；平台原生 addon 由它的
+生产 Host 加载固定版本 `@awiki/im-core-node@0.1.6`；平台原生 addon 由它的
 optional dependencies 选择，并保持在 JavaScript bundle 外。使用者无需安装 Rust，
 也无需检出 `awiki-cli-rs2`。来源与许可证见 `THIRD_PARTY_NOTICES.md`。
 
 Typert Host/Remote 产物与当前 Host 契约一同提交；在独立 Typert 生成器支持根级
-包之前，`pnpm check:generated` 会固定检查完整的 17 个 Remote 方法。
+包之前，`pnpm check:generated` 会固定检查完整的 18 个 Remote 方法。
 
 ## 安全
 

package/THIRD_PARTY_NOTICES.md

@@ -2,7 +2,7 @@
 
 ## AWiki Rust IM Core Node SDK
 
-`@awiki/im-core-node@0.1.3` and its target-specific optional package provide the
+`@awiki/im-core-node@0.1.6` and its target-specific optional package provide the
 Rust IM Core runtime used by the Host provider. These packages are distributed
 under AGPL-3.0-only. Each package carries its own `LICENSE`, `NOTICE.md`,
 `SOURCE.md`, CycloneDX SBOM, checksums, and build provenance. The corresponding
@@ -19,3 +19,10 @@ manager as a normal exact-version runtime dependency.
 The embedded launcher artwork in `src/client/assets.ts` comes from the AWiki Me
 application maintained by the same project team. Its use here is limited to
 identifying the AWiki integration.
+
+## QR Code generation
+
+The browser bundle uses `qrcode@1.5.4` (node-qrcode) to render TongQiFu
+`ALI_QR` payment content as an image. The package and its bundled browser
+dependencies are distributed under their respective MIT licenses; their
+license text is retained by the package manager and source distribution.

package/cordis.patch.yml

@@ -8,13 +8,18 @@
         userServiceUrl: !!js process.env.DSH_AWIKI_USER_SERVICE_URL ?? 'https://awiki.ai'
         userServiceDomain: !!js process.env.DSH_AWIKI_USER_SERVICE_DOMAIN ?? 'awiki.ai'
         messageServiceUrl: !!js process.env.DSH_AWIKI_MESSAGE_SERVICE_URL ?? 'https://awiki.ai'
+        mailServiceUrl: !!js process.env.DSH_AWIKI_MAIL_SERVICE_URL
         messageServiceDid: !!js process.env.DSH_AWIKI_MESSAGE_SERVICE_DID ?? 'did:wba:awiki.ai'
         messageServicePublicUrl: !!js process.env.DSH_AWIKI_MESSAGE_SERVICE_PUBLIC_URL ?? 'https://awiki.ai'
         allowedAttachmentOrigins: !!js JSON.parse(process.env.DSH_AWIKI_ALLOWED_ATTACHMENT_ORIGINS ?? '[]')
         stateRoot: !!js process.env.DSH_AWIKI_STATE_ROOT
         pollIntervalMs: !!js Number(process.env.DSH_AWIKI_POLL_INTERVAL_MS ?? '5000')
         attachmentMaxBytes: !!js Number(process.env.DSH_AWIKI_ATTACHMENT_MAX_BYTES ?? '10485760')
+        imageAttachmentCacheMaxBytes: !!js Number(process.env.DSH_AWIKI_IMAGE_CACHE_MAX_BYTES ?? '67108864')
         summaryMaxInputBytes: !!js Number(process.env.DSH_AWIKI_SUMMARY_MAX_INPUT_BYTES ?? '32768')
+        listenerEnabled: !!js process.env.DSH_AWIKI_LISTENER_ENABLED === 'true'
+        listenerAllowedPeers: !!js JSON.parse(process.env.DSH_AWIKI_LISTENER_ALLOWED_PEERS ?? '[]')
+        listenerWorkspacePath: !!js process.env.DSH_AWIKI_LISTENER_WORKSPACE_PATH
 
     - id: awiki-provider
       name: '@awiki/dsh-plugin/provider'