@awiki/dsh-plugin 0.3.12 → 0.3.16

package/README.md

@@ -23,11 +23,12 @@ tools, or model APIs.
 
 ## Features
 
-- Enter a Handle and phone through one Web UI flow and always request a registration OTP. A new Handle creates the deployment identity; an existing Handle offers ordinary Device Join first. Choosing Recovery V4 opens a separate destructive-impact page without cancelling Join or sending an OTP; only its second explicit “replace DID” action cancels the pending choice and requests a purpose-scoped recovery OTP.
+- Select a Core-advertised identity method (WBA by default, or Web when enabled), then enter a Handle and phone through one Web UI flow and always request a registration OTP. A new Handle creates the deployment identity; an existing Handle offers ordinary Device Join first. Choosing Recovery V4 opens a separate destructive-impact page without cancelling Join or sending an OTP; only its second explicit “replace DID” action cancels the pending choice and requests a purpose-scoped recovery OTP.
 - DSH can join an existing Handle as an independent member device. When DSH created or recovered the Handle and is the current ready-admin, the foreground Devices tab can list devices, verify an incoming request with SAS, approve one member, reject it, or revoke another device. These mutations are not Agent tools and require explicit `APPROVE` / `REVOKE` confirmation.
-- A local Darwin x64 ready-admin can prepare Root Transfer for one exact active member and use native system authentication before sending management capability. Authorization handles and Root material remain Host/Core-only; unsupported or headless Hosts fail closed. A recovered old device uses the same native-authentication seam to re-Join only as a member.
+- A local Darwin x64 WBA ready-admin can prepare Root Transfer for one exact active member and use native system authentication before sending management capability. Authorization handles and Root material remain Host/Core-only; unsupported or headless Hosts fail closed. A recovered old device uses the same native-authentication seam to re-Join only as a member.
 - Open the top-left AWiki account menu to sign out locally without deleting the encrypted identity or message database; **Resume local identity** restores the same DID and Handle, including across DSH restarts. The signed-out screen reveals phone recovery only after local resume fails. Switching identities requires an explicit confirmation that permanently clears local AWiki data first.
 - Reuse that identity across the root Agent and its subagents.
+- Web identities use the same independent-device Join/revoke flow. The device page lets a current ready-admin edit public services, keeps protected system services read-only, and explicitly resumes a Core-owned pending update after a lost response. Web has no Recovery or Root Transfer; losing the first administrator permanently loses management capability. Unfinished registrations are rediscovered from Core and require an explicit choice plus fresh verification, even when new creation has been disabled. See [the method and restart contract](docs/dsh-device-join-design.md#45-web-身份方法与非设备服务更新).
 - Direct-message and existing-group conversation lists, unread counts, latest-message previews, and persisted display names. Core SQLite remains the persistent source of truth: the Host joins persisted peer profiles onto Direct roster rows, while the browser keeps the active identity's last trustworthy Direct profile and group title. Sparse polling identifiers therefore cannot overwrite a resolved display name or real group title. After an existing Handle is recovered, the Host synchronizes account projections before asking Core to restore old group memberships; pending or blocked groups expose a retryable status without disabling Direct messages or other groups. Opening a conversation renders the committed local timeline first, hydrates group sender labels from the Core display-profile cache, reconciles remote history and Direct profile data in the background, and keeps local messages visible if refresh fails. A failed background roster poll also leaves the usable local view quiet; explicit loads still surface their errors. This local-first path covers the newest projected page; loading older messages still requires the remote history service. Scrolling up reveals a latest-message control that counts newer arrivals without interrupting reading. A conversation is marked read only after its newest rendered message reaches the visible bottom.
 - Create a private-discovery, open-join, transport-protected group from the Web UI with a name and 1–50 initial Handle or DID members. The group opens immediately; members that could not be added are reported without hiding the successfully created group.
 - Text messages plus one attachment per message, with Enter-to-send, Shift+Enter line breaks, optimistic sending bubbles reconciled by an exact client message ID, image previews, and SHA verification. Verified image bytes use three bounded layers: a browser-runtime LRU makes conversation remounts immediate, identity-scoped IndexedDB survives full page reloads without a Host call, and the private Host disk cache survives browser-storage loss and Harness restarts. Clear Local Data removes all three layers and selectively removes every AWiki Mail list/folder localStorage projection while preserving unrelated origin storage.
@@ -317,13 +318,19 @@ Requirements: Node.js 22.19+ (or 24+) and pnpm 11.22.
 
 ```bash
 pnpm install --frozen-lockfile
+# Run these test commands only when the user explicitly requests tests:
 pnpm run verify:workspace
 pnpm run e2e:smoke
 DSH_AWIKI_E2E_CONFIG=/absolute/path/to/rwiki-cn-testing.json pnpm run e2e:live
 DSH_AWIKI_E2E_CONFIG=/absolute/path/to/awiki-info-testing.json pnpm run e2e:live -- --headed --grep RECOVERY
+# Publication packing defaults to build and static package checks:
 pnpm pack --dry-run
 ```
 
+SDK/插件包发布默认不运行测试。`pnpm pack` 的 prepack 仅执行构建与静态包校验；
+只有用户明确要求测试时，才单独运行 `pnpm run verify`、`pnpm run verify:workspace`
+或 E2E 命令。打包成功不代表这些测试通过。
+
 `e2e:smoke` uses Playwright Chromium to install the current tarball into an
 isolated real DSH Web profile, complete the stock Harness first-run dialogs,
 and open the AWiki identity entry without sending an OTP. The optional
@@ -361,3 +368,18 @@ verification and packaging.
 
 The plugin is MIT licensed. Its Rust IM Core runtime dependency is distributed
 under AGPL-3.0-only and remains subject to its own retained notices and license.
+
+### Account-first registration
+
+The identity entry performs the read-only User Service `registration_check` before
+sending an OTP. Existing Handles continue through the existing identity flow.
+When the service requires an invitation for a new Handle, the entry displays an
+invitation field and validates it before requesting an OTP. The same invitation
+is forwarded through the Node bridge for OTP and final registration; the server
+remains responsible for admission and atomic invitation consumption. Invitations
+stay in transient form memory and are cleared when changing the Handle.
+
+Deploy the compatible User Service before enabling this client. Missing or
+invalid precheck responses fail closed; they never trigger an OTP. This change
+requires the accompanying Node bridge source change in awiki-cli-rs2. Local
+acceptance must use that source build; no registry publication is required.

package/README.zh.md

@@ -11,9 +11,10 @@ Host-only Provider lease 不会进入 Browser、Remote、Agent tools 或模型 A
 
 ## 功能
 
-- 在 Web UI 的统一入口输入 Handle 和手机号，先查找该 Handle 的未完成恢复；命中则继续原操作，否则发送注册验证码。新 Handle 创建部署级身份；已有 Handle 优先进入普通 Device Join。首次选择 Recovery V4 只打开独立的替换 DID 风险确认页，不取消 Join、不创建 Recovery operation、也不发送 OTP；只有第二次明确点击“发送恢复验证码并替换 DID”才取消待处理 Join 并发送用途隔离的恢复验证码。根 Agent 与子 Agent 共用最终身份。
+- 在 Web UI 的统一入口按 Core 公布的能力选择身份方法（默认 WBA，启用后可选 Web），输入 Handle 和手机号，先查找该 Handle 的未完成恢复；命中则继续原操作，否则发送注册验证码。新 Handle 创建部署级身份；已有 Handle 优先进入普通 Device Join。首次选择 Recovery V4 只打开独立的替换 DID 风险确认页，不取消 Join、不创建 Recovery operation、也不发送 OTP；只有第二次明确点击“发送恢复验证码并替换 DID”才取消待处理 Join 并发送用途隔离的恢复验证码。根 Agent 与子 Agent 共用最终身份。
 - DSH 可以作为独立 member 设备加入已有 Handle；当 DSH 创建或恢复 Handle、当前设备为 ready-admin 时，前台“设备”页可列出设备、通过 SAS 验证并批准 member、拒绝请求或撤销其他设备。管理动作不进入 Agent 工具，并要求显式输入 `APPROVE` / `REVOKE`。
-- 本机 Darwin x64 ready-admin 可在“设备”页准备 Root Transfer，并经系统级用户认证把管理能力发送给一个精确的 active member；authorization handle 和 Root material 不进入 Browser。Linux、远程无头或系统认证不可用时失败关闭。Recovery 后旧设备 re-Join 复用同一认证端口，但仍只恢复为 member。
+- 本机 Darwin x64 WBA ready-admin 可在“设备”页准备 Root Transfer，并经系统级用户认证把管理能力发送给一个精确的 active member；authorization handle 和 Root material 不进入 Browser。Linux、远程无头或系统认证不可用时失败关闭。Recovery 后旧设备 re-Join 复用同一认证端口，但仍只恢复为 member。
+- Web 身份沿用独立设备 Join／撤销；当前 ready-admin 可在设备页编辑公开服务，系统服务保持只读。响应丢失后展示 Core 的未决更新，用户显式继续原操作。Web 不支持恢复或管理权转移，首个管理员丢失后无法恢复管理能力。重开时读取 Core 未完成注册，用户选择原注册并重新验证，即使新建能力关闭也能续接；不会自动重新注册。合同见 [Web 身份方法与非设备服务更新](docs/dsh-device-join-design.md#45-web-身份方法与非设备服务更新)。
 - 点击 AWiki 面板左上角图标可打开账户菜单；普通退出只锁定本机会话，不删除加密身份或消息数据库，重新进入及重启 DSH 后仍恢复同一个 DID 和 Handle。退出页默认只提供重新进入本机身份和使用其他身份；只有本机重新进入失败后才显示手机号恢复入口。改用其他身份必须先确认永久清除本地 AWiki 数据。
 - 一般身份入口失败时保留当前挂载表单中的手机号、Handle 和验证码，以便修正后重试。例外是 Node 返回精确错误码 `short_handle_invite_required`：注册会清空验证码并返回可编辑的 Handle／手机号表单，显示“注册少于5位的handle需要使用邀请码，目前暂不支持自主注册。”；该提示在关闭重开面板后保留，修改 Handle 后清除。界面不根据 Handle 长度或远端错误文案推断该错误。手机号和验证码不进入 Browser 持久化状态、controller snapshot 或公开 Remote 结果。恢复操作编号以及按租户和操作隔离的非敏感重发截止时间可用于崩溃续跑；后者只恢复服务端冷却，不包含手机号、Handle 或验证码。注册未开放、验证码状态失效和提交冲突会给出对应的安全处理提示。
 - 私聊和已有群聊列表、未读角标、最新消息预览、时间更新与昵称持久化。Core SQLite 是持久化真相源：Host 将持久化的对端资料合并进私聊列表，浏览器再按当前身份保留最后一次可信的私聊资料和群名，稀疏轮询中的 Handle、DID 或 Group DID 占位不会覆盖真实名称。恢复已有 Handle 后，Host 会先同步账号投影，再让 Core 自动恢复旧群聊成员身份；未完成或受阻的群聊会显示可重试状态，但不影响私聊和其他群聊。打开会话时先显示 Core 已提交的本地时间线，并从 Core 显示资料缓存补齐群消息发送者名称，再在后台补齐远端历史和私聊资料；刷新失败不会清空本地消息。后台会话轮询失败也不会用全局红条打断仍可用的本地页面，用户主动加载失败仍会正常提示。当前 local-first 只覆盖本地最新一页，“加载更早消息”仍需访问远端 history。向上阅读时显示下滑箭头，新消息到达后在同一控件中累计数量且不打断阅读位置。只有最新一条已渲染消息到达可视区域底部后，当前会话才会自动标记为已读。
@@ -298,3 +299,12 @@ Typert Host/Remote 产物与当前 Host 契约一同提交；在独立 Typert
 ### 群成员与发送人名称
 
 Host `getDisplayProfiles` 返回 Core 本地展示投影并调度后台刷新；Browser 沿用会话轮询更新成员与发送人，首帧无需等待公开资料网络请求。刷新按 DID 去重，Core 管理 TTL、失败重试和 owner 隔离，既不创建联系人也不创建 Direct 会话。成功的空昵称回退到 Handle/DID，网络失败保留已缓存名称；身份切换和会话切换后的旧结果不回写界面。该路径使用 Node native API v14，必须与本地 Core Node 包配套构建。
+
+
+### 本地邀请码注册验收
+
+`DSH_REGISTRATION_FIXTURE=<绝对路径的0600 JSON> pnpm exec playwright test --project=local-registration-chromium --reporter=line`
+执行 `DSH-WEB-REGISTRATION-001`：三位新 Handle 缺少邀请码、错误邀请码、纠正后获取验证码及完成注册；独立 DSH 状态下同一个已有短账号不要求邀请码并进入加入设备入口。
+配置字段为 `url`、`freshUrl`（两个隔离 DSH 实例）、`userServiceUrl`、`handle`、`phone`、`otp`、`inviteCode`，三个 URL 必须是 HTTP loopback。外部本地服务 provisioner 负责创建一次性账号和邀请、核对消费次数及清理数据库；本用例不是生产环境入口。
+该项目关闭 trace、录像及截图；失败上下文仍可能包含表单内容，只能保存到受保护的本地目录并在分享前脱敏。
+本地 TLS 测试可以通过 `DSH_AWIKI_CA_BUNDLE` 指定专用 CA，由 Host 传给 Core；它不会关闭证书或域名校验。Host 自身的 Node HTTPS 请求另遵循 Node 的 CA 配置。

package/cordis.patch.yml

@@ -15,6 +15,7 @@
         messageServicePublicUrl: !!js process.env.DSH_AWIKI_MESSAGE_SERVICE_PUBLIC_URL
         allowedAttachmentOrigins: !!js JSON.parse(process.env.DSH_AWIKI_ALLOWED_ATTACHMENT_ORIGINS ?? '[]')
         allowInsecureLoopbackForTesting: !!js process.env.DSH_AWIKI_ALLOW_INSECURE_LOOPBACK_FOR_TESTING === 'true'
+        caBundle: !!js process.env.DSH_AWIKI_CA_BUNDLE
         stateRoot: !!js process.env.DSH_AWIKI_STATE_ROOT
         pollIntervalMs: !!js Number(process.env.DSH_AWIKI_POLL_INTERVAL_MS ?? '5000')
         attachmentMaxBytes: !!js Number(process.env.DSH_AWIKI_ATTACHMENT_MAX_BYTES ?? '10485760')