@awiki/dsh-plugin 0.3.4 → 0.3.5

package/README.md

@@ -1,10 +1,8 @@
 # @awiki/dsh-plugin
 
-AWiki account, authorization, recovery, and messaging for
-[DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness). The package installs one Host
-service, its IM Core provider, the model tools, and a Web client with a draggable AWiki Me launcher.
-General DID documents and private keys are managed by the independent
-`@agent-network-protocol/dsh-anp-identity` plugin and injected through Cordis.
+AWiki identity and messaging for [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness).
+The package installs one Host service, its production Rust SDK provider,
+the model tools, and a Web client with a draggable AWiki Me launcher.
 
 [中文说明](./README.zh.md)
 
@@ -13,16 +11,13 @@ phone and OTP never enter browser persistence, controller snapshots, or public
 Remote results. Closed registration, unavailable verification state, and commit conflicts each give
 a safe next action without exposing remote response details.
 
-The two plugins deliberately own different state. ANP Identity owns the multi-DID Store, DID
-documents, private keys, and publication transactions. AWiki IM Core owns Handle/account bindings,
-device and recovery workflows, authentication tokens, messages, mail, SQLite, and caches below its
-configured `stateRoot`. The Host-only provider lease is never exposed to Browser, Remote, Agent
-tools, or model APIs.
+The Rust SDK exclusively owns the identity, SecretVault, database, cache, and metadata below the
+configured `stateRoot`. This release performs a clean cutover and does not import the former
+TypeScript SDK `identity.json`; create a new Rust-backed identity after upgrading.
 
 ## Features
 
-- Enter a Handle and phone through one Web UI flow and always request a registration OTP. A new Handle creates the deployment identity; an existing Handle offers ordinary Device Join first, with Recovery V4 as an explicit destructive alternative that requests a second purpose-scoped OTP.
-- DSH can join an existing Handle as an independent member device. When DSH created or recovered the Handle and is the current ready-admin, the foreground Devices tab can list devices, verify an incoming request with SAS, approve one member, reject it, or revoke another device. These mutations are not Agent tools and require explicit `APPROVE` / `REVOKE` confirmation.
+- Enter a Handle and phone through one Web UI flow. Before any code is sent, the Host classifies the Handle: a new Handle receives a registration OTP and creates the deployment identity, while an existing Handle receives one Recovery V4 OTP and enters the recovery state machine directly.
 - Open the top-left AWiki account menu to sign out locally without deleting the encrypted identity or message database; **Resume local identity** restores the same DID and Handle, including across DSH restarts. The signed-out screen reveals phone recovery only after local resume fails. Switching identities requires an explicit confirmation that permanently clears local AWiki data first.
 - Reuse that identity across the root Agent and its subagents.
 - Direct-message and existing-group conversation lists, unread counts, latest-message previews, and persisted display names. Core SQLite remains the persistent source of truth: the Host joins persisted peer profiles onto Direct roster rows, while the browser keeps the active identity's last trustworthy Direct profile and group title. Sparse polling identifiers therefore cannot overwrite a resolved display name or real group title. After an existing Handle is recovered, the Host synchronizes account projections before asking Core to restore old group memberships; pending or blocked groups expose a retryable status without disabling Direct messages or other groups. Opening a conversation renders the committed local timeline first, hydrates group sender labels from the Core display-profile cache, reconciles remote history and Direct profile data in the background, and keeps local messages visible if refresh fails. A failed background roster poll also leaves the usable local view quiet; explicit loads still surface their errors. This local-first path covers the newest projected page; loading older messages still requires the remote history service. Scrolling up reveals a latest-message control that counts newer arrivals without interrupting reading. A conversation is marked read only after its newest rendered message reaches the visible bottom.
@@ -31,14 +26,14 @@ tools, or model APIs.
 - A draggable circular launcher that defaults to the lower-left sidebar area, adaptive popup placement, dark mode, and remembered active conversation.
 - User-triggered AI summaries for up to 50 recent or unread messages, kept only in runtime memory with explicit stale, retry, copy, and source-navigation states.
 - OTP identity access keeps the verification form visible and disables resend with a visible server-directed cooldown countdown. Handle classification happens before OTP delivery, so each attempt sends exactly one purpose-correct registration or recovery code.
-- After Recovery V4 reaches `applied`, the Host resolves the recovered Handle's original mailbox under the current DID. If the separate Model Proxy package is installed, the Host also obtains one short-lived, audience-bound recovery attestation and reconciles the current DID to the original billing account without copying or adding balances. A temporary failure keeps only the non-secret recovery operation ID and retries the same idempotent reconciliation after restart; the attestation and ledger identity never enter Browser state, Agent tools, logs, or model context.
+- After Recovery V4 reaches `applied`, the Host activates the recovered identity immediately. Automatic restoration of the historical mailbox and canonical model billing account is currently deferred, so those optional account projections cannot block identity recovery. The Browser clears its blocking operation marker while Core retains the authoritative recovery journal; no recovery attestation or model reconciliation request is issued.
 - When the separate `@awiki/dsh-model-proxy` package is installed, an AWiki-hosted DeepSeek choice appears before the official API-key onboarding step only when Harness has no usable model provider, with an explicit opt-in and an unchanged API-key escape path. New sessions do not show AWiki model or payment prompts after the official or another provider is usable.
 - The optional model-proxy package owns the Host short-token flow and every model-hosting Browser surface: onboarding plus Settings → Quick Recharge with Account & Recharge and Usage tabs. It registers `awiki-deepseek` with `deepseek-v4-flash` and `deepseek-v4-pro`; Flash is recommended and credentials never enter the Browser.
 - AWiki identity, domain, and local-data settings remain in the main package. Installing only the main package does not register model opt-in, recharge, usage, or model onboarding UI.
 - A typed second confirmation in the Settings danger zone before permanently clearing local AWiki identity, key, token, registration-draft, and message-index state.
 - Five messaging Agent tools: identity status, conversations, history, approved text send, and approved attachment send.
 - Five on-demand mail Agent tools: mailbox account, inbox, plain-text read, approved mark-read, and approved plain-text send.
-- A default identity-level realtime connection for Direct, Group, and System Notification sync, plus an independent opt-in Agent consumer that lets exact-allowlisted Direct peers continue one DSH Agent session or use `/new`, `/status`, and `/help`.
+- An opt-in realtime listener that lets exact-allowlisted Direct peers continue one DSH Agent session or use `/new`, `/status`, and `/help`.
 
 ## Screenshots
 
@@ -69,10 +64,9 @@ are independent of that private-chat boundary.
 
 ## Install
 
-Install the independent identity plugin first, then AWiki:
+Install the official public npm package:
 
 ```bash
-dsh plugin --profile web add @agent-network-protocol/dsh-anp-identity@latest
 dsh plugin --profile web add @awiki/dsh-plugin@latest
 ```
 
@@ -94,11 +88,10 @@ families in a DSH root dependency tree.
 `0.2.0-rc.4`. The former `@awiki/dsh` registry entry was unpublished and is
 not an installation source for this release line.
 
-Apply the packages after the normal DSH base and Web app bundles. The main
-`cordis.patch.yml` loads the ANP Identity Service, its native Provider, the AWiki Host Service, the
-AWiki IM Core Provider, and the summary Provider in that order; DSH discovers and injects the
-browser client through package metadata. Teardown closes IM Core before revoking its identity
-lease, and the identity Store Provider closes last. The patch does not insert Model Proxy. The optional package has its
+Apply the package after the normal DSH base and Web app bundles. Its
+The main `cordis.patch.yml` adds the AWiki Host service, Rust SDK provider, and
+summary provider; DSH discovers and injects the browser client through the
+package metadata. It does not insert Model Proxy. The optional package has its
 own patch, inserts exactly one `awiki-model-proxy` row after AWiki, and declares
 an explicit dependency on the loaded `awiki` service.
 
@@ -115,23 +108,27 @@ The plugin works against the public `awiki.ai` tenant without environment config
 | `DSH_AWIKI_MESSAGE_SERVICE_DID` | Authoritative message-service DID | `did:wba:awiki.ai` |
 | `DSH_AWIKI_MESSAGE_SERVICE_PUBLIC_URL` | Public endpoint written to protocol records | `https://awiki.ai` |
 | `DSH_AWIKI_ALLOWED_ATTACHMENT_ORIGINS` | JSON array of extra exact HTTPS origins | `[]` |
-| `DSH_AWIKI_STATE_ROOT` | Private Rust IM Core state directory | `$DSH_HOME/awiki/im-core` or `~/.dsh/awiki/im-core` |
-| `DSH_ANP_IDENTITY_STATE_ROOT` | Independent multi-DID ANP Identity Store | `$DSH_HOME/anp-identity` |
-| `DSH_ANP_IDENTITY_ROOT_KEY_PROVIDER` | Store Root Key provider (`keyring`, `local-file`, `env`, or programmatic `injected`) | `keyring` |
-| `DSH_ANP_IDENTITY_ROOT_KEY_PROVIDER_ID` | Keyring account, environment variable, or injected-provider identifier | `anp-identity/dsh` |
+| `DSH_AWIKI_STATE_ROOT` | Private Rust IM Core state directory; an explicit value overrides profile isolation | `$DSH_HOME/awiki/<profile>/im-core` or `~/.dsh/awiki/<profile>/im-core`; legacy `awiki/im-core` when no profile can be proven |
 | `DSH_AWIKI_VAULT_ROOT_KEY_FILE` | Existing private file containing a base64/base64url 32-byte Vault root key | `$DSH_HOME/awiki/secret-vault/root-key.b64u` |
 | `DSH_AWIKI_VAULT_WORKSPACE_ID` | Stable non-secret Vault workspace context | `dsh-awiki` |
 | `DSH_AWIKI_VAULT_DEVICE_ID` | Stable non-secret Vault device context | `local-device` |
 | `DSH_AWIKI_POLL_INTERVAL_MS` | Open-dialog polling interval | `5000` |
 | `DSH_AWIKI_ATTACHMENT_MAX_BYTES` | Decoded attachment limit | `10485760` |
 | `DSH_AWIKI_IMAGE_CACHE_MAX_BYTES` | Private verified image-preview cache budget | `67108864` |
-| `DSH_AWIKI_REALTIME_ENABLED` | Enable the identity-level Direct/Group/System Notification WSS | `true` |
 | `DSH_AWIKI_LISTENER_ENABLED` | Enable the Direct-to-Agent listener | `false` |
 | `DSH_AWIKI_LISTENER_ALLOWED_PEERS` | JSON array of exact Handles or DIDs; required when enabled | `[]` |
 | `DSH_AWIKI_LISTENER_WORKSPACE_PATH` | Absolute shared Workspace for AWiki-originated Sessions | `$DSH_HOME/workspaces/awiki` or `~/.dsh/workspaces/awiki` |
 | `DSH_AWIKI_SUMMARY_MAX_INPUT_BYTES` | UTF-8 cap after Host-side summary minimization | `32768` |
 | `DSH_AWIKI_SUMMARY_TIMEOUT_MS` | One-shot model deadline | `30000` |
 | `DSH_AWIKI_SUMMARY_MAX_OUTPUT_TOKENS` | Structured summary output cap | `768` |
+
+The default state directory is isolated by DSH profile. Desktop uses the Host's
+`desktopProfiles.current.name`; ordinary `dsh --profile` accepts the name only when the Loader
+root exactly matches `$DSH_HOME/profiles/<name>`. The plugin does not guess from argv, ports, or
+process type, and does not copy a legacy database automatically. The old shared `awiki/im-core`
+directory remains untouched. When it is detected, the identity screen explains the isolation and
+guides the user to recover with the original Handle and phone as a separate device.
+
 ## AWiki-hosted DeepSeek account
 
 This capability now requires the separate `@awiki/dsh-model-proxy` package. It
@@ -218,17 +215,14 @@ underlying disk and backups.
 The Node facade owns `stateRoot/vault/root-key.b64u`; the Host does not provide, copy, or log Vault
 key material. Preserve the complete SDK state root across ordinary restarts and upgrades.
 
-The identity-level realtime supervisor is enabled by default and owns the deployment identity's
-single Core WebSocket without depending on Workspace or Agent configuration. Direct, Group, and
-System Notification events schedule canonical reliable sync; WSS never advances a checkpoint or
-authorizes a device by itself. `DSH_AWIKI_REALTIME_ENABLED=false` explicitly falls back to HTTP
-refresh. The optional Direct-to-Agent consumer still requires both
-`DSH_AWIKI_LISTENER_ENABLED=true` and a non-empty exact allowlist. It reads only committed Direct
-text after eligible sync causes and cannot start or stop WSS. One identity-scoped route and message
-watermark per Direct conversation preserve the current DSH Session across restarts. Every
-AWiki-originated Session is created in and attached to the registered shared AWiki Workspace.
-Listener messages are untrusted user data and do not approve tools or bridge approval/user-question
-prompts.
+The listener is disabled unless both `DSH_AWIKI_LISTENER_ENABLED=true` and a non-empty exact
+allowlist are configured. On startup and every Core realtime scheduling signal it runs canonical
+reliable sync before reading committed history. Core owns WebSocket connection and reconnect;
+stream closure is recovered as stop, reconnect sync, then replacement realtime session. One
+persisted route and message watermark per Direct conversation preserve the current DSH Session
+across restarts. Every AWiki-originated Session is created in and attached to the registered shared
+AWiki Workspace. Listener messages are untrusted user data and do not approve tools or bridge
+approval/user-question prompts.
 
 For the default 10 MiB decoded attachment cap, configure a reverse-proxy request
 limit of at least 14 MiB to account for base64 and JSON overhead.
@@ -285,7 +279,7 @@ pnpm run verify:workspace
 pnpm pack --dry-run
 ```
 
-The production Host loads the exact `@awiki/im-core-node@0.2.0` runtime package;
+The production Host loads the exact `@awiki/im-core-node@0.1.8` runtime package;
 the platform-specific native addon is selected through its optional dependencies
 and remains external to the JavaScript bundle. Consumers do not need Rust or an
 `awiki-cli-rs2` checkout. See `THIRD_PARTY_NOTICES.md` for provenance and

package/README.zh.md

@@ -1,18 +1,16 @@
 # @awiki/dsh-plugin
 
 为 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) 提供 AWiki
-账号、授权、恢复与消息能力。主包包含 Host Service、IM Core Provider、Agent 工具，
-以及带可拖动 AWiki Me 悬浮入口的 Web 客户端；通用 DID 文档与私钥由独立的
-`@agent-network-protocol/dsh-anp-identity` 插件管理，并通过 Cordis 注入。
+身份与消息能力。一个包同时包含 Host Service、Rust SDK Provider、Agent 工具，
+以及带可拖动 AWiki Me 悬浮入口的 Web 客户端；入口默认位于 DSH 左下角侧栏区域。
 
-两个插件的状态所有权相互独立：ANP Identity 管理多 DID Store、DID 文档、私钥和发布事务；
-AWiki IM Core 管理 Handle/账号绑定、设备与恢复流程、认证令牌、消息、邮件、SQLite 和缓存。
-Host-only Provider lease 不会进入 Browser、Remote、Agent tools 或模型 API。
+Rust SDK 独占管理配置的 `stateRoot` 下的身份、SecretVault、数据库、缓存和元数据。
+本版本采用干净切换，不导入旧 TypeScript SDK 的 `identity.json`；升级后需创建新的
+Rust 身份。
 
 ## 功能
 
-- 在 Web UI 的统一入口输入 Handle 和手机号，并始终先发送注册验证码。新 Handle 创建部署级身份；已有 Handle 优先进入普通 Device Join，Recovery V4 仅作为显式危险替代项，并重新发送用途隔离的恢复验证码；根 Agent 与子 Agent 共用最终身份。
-- DSH 可以作为独立 member 设备加入已有 Handle；当 DSH 创建或恢复 Handle、当前设备为 ready-admin 时，前台“设备”页可列出设备、通过 SAS 验证并批准 member、拒绝请求或撤销其他设备。管理动作不进入 Agent 工具，并要求显式输入 `APPROVE` / `REVOKE`。
+- 在 Web UI 的统一入口输入 Handle 和手机号。Host 会在发送验证码前判断 Handle 状态：新 Handle 只发送注册验证码并创建部署级身份，已有 Handle 只发送 Recovery V4 恢复验证码并直接进入恢复流程；根 Agent 与子 Agent 共用最终身份。
 - 点击 AWiki 面板左上角图标可打开账户菜单；普通退出只锁定本机会话，不删除加密身份或消息数据库，重新进入及重启 DSH 后仍恢复同一个 DID 和 Handle。退出页默认只提供重新进入本机身份和使用其他身份；只有本机重新进入失败后才显示手机号恢复入口。改用其他身份必须先确认永久清除本地 AWiki 数据。
 - 身份入口失败时保留当前挂载表单中的手机号、Handle 和验证码，以便修正后重试；手机号和验证码不进入 Browser 持久化状态、controller snapshot 或公开 Remote 结果。仅恢复操作编号可用于崩溃续跑。注册未开放、验证码状态失效和提交冲突会给出对应的安全处理提示。
 - 私聊和已有群聊列表、未读角标、最新消息预览、时间更新与昵称持久化。Core SQLite 是持久化真相源：Host 将持久化的对端资料合并进私聊列表，浏览器再按当前身份保留最后一次可信的私聊资料和群名，稀疏轮询中的 Handle、DID 或 Group DID 占位不会覆盖真实名称。恢复已有 Handle 后，Host 会先同步账号投影，再让 Core 自动恢复旧群聊成员身份；未完成或受阻的群聊会显示可重试状态，但不影响私聊和其他群聊。打开会话时先显示 Core 已提交的本地时间线，并从 Core 显示资料缓存补齐群消息发送者名称，再在后台补齐远端历史和私聊资料；刷新失败不会清空本地消息。后台会话轮询失败也不会用全局红条打断仍可用的本地页面，用户主动加载失败仍会正常提示。当前 local-first 只覆盖本地最新一页，“加载更早消息”仍需访问远端 history。向上阅读时显示下滑箭头，新消息到达后在同一控件中累计数量且不打断阅读位置。只有最新一条已渲染消息到达可视区域底部后，当前会话才会自动标记为已读。
@@ -20,15 +18,15 @@ Host-only Provider lease 不会进入 Browser、Remote、Agent tools 或模型 A
 - 文本和单附件消息；Enter 发送、Shift+Enter 换行，发送中立即显示带 loading 动画的乐观气泡，并通过精确的客户端消息 ID 与已提交消息对账，避免同一条消息显示两个气泡；同时支持图片预览、附件说明与 SHA 校验。校验通过的图片字节使用三层有界缓存：浏览器运行期 LRU 让会话重新挂载时立即出图，按身份隔离的 IndexedDB 在整页刷新后无需访问 Host，Host 私有磁盘缓存则应对浏览器缓存丢失并跨 Harness 重启复用；“清除本地数据”会删除三层缓存。
 - 圆形可拖动入口、自适应四角弹窗、深色模式和当前会话记忆。
 - 用户点击后才生成的 AI 对话总结：最多处理 50 条最近或未读消息，按会话保留本次运行期缓存，并支持过期提示、重试、复制与跳转原消息。
-- OTP 身份入口会保留验证码输入表单，并按服务端返回的冷却时间显示重发倒计时、禁用提前重发；已有 Handle 在消费 registration OTP 后再选择 Join 或 Recovery，Recovery 不复用 registration grant。
-- Recovery V4 进入 `applied` 后，Host 会用 current DID 解析已恢复 Handle 的原邮箱；如同时安装独立 Model Proxy 包，还会获取一份短时、固定受众的恢复凭证，把 current DID 对账到原模型账本，不复制余额、不做金额相加。临时失败只保留非敏感 operation id，并在重启后对同一幂等操作自动重试；恢复凭证和账本标识不会进入 Browser 状态、Agent 工具、日志或模型上下文。
+- OTP 身份入口会保留验证码输入表单，并按服务端返回的冷却时间显示重发倒计时、禁用提前重发；Handle 分流发生在发送前，因此每次只会发送一个用途正确的注册或恢复验证码。
+- Recovery V4 进入 `applied` 后，Host 会立即激活恢复后的身份。当前暂不自动恢复历史邮箱或原模型账本，两个可选账户投影不会再阻塞身份恢复。Browser 会清除阻塞流程标记，权威恢复 journal 仍由 Core 保留；当前不会申请恢复凭证，也不会发送模型账本对账请求。
 - 安装独立的 `@awiki/dsh-model-proxy` 后，仅在 Harness 没有任何可用模型时，首次引导才会在官方 API Key 步骤前提供 AWiki 托管模型选项；用户可以明确启用，也可以跳过并继续原版 API Key 流程。已经配置官方或其他 Provider 时，新会话不会显示 AWiki 模型或支付提示。
 - 可选 Model Proxy 包独占 Host 内部短期 Token 和全部模型托管界面：首次引导，以及“设置 → 快速充值”中的“账户与充值”“用量明细”。它提供 `deepseek-v4-flash` 和 `deepseek-v4-pro`，默认推荐 Flash；Token 不进入 Browser。
 - AWiki 主包只保留身份、域名和本地数据设置。只安装主包时，不会注册模型启停、充值、用量或模型首次引导界面。
 - 在设置页危险区域中，经输入确认词的二次确认后，永久清空本机 AWiki 身份、密钥、令牌、注册草稿和消息索引。
 - 五个消息 Agent 工具：身份、会话、历史、需审批的文本发送和需审批的附件发送。
 - 五个按需邮件 Agent 工具：邮箱账户、收件箱、纯文本读取、需审批的标记已读和需审批的纯文本发送。
-- 默认身份级 realtime 连接统一调度 Direct、Group 和 System Notification 同步；独立、可选的 Agent consumer 允许 exact allowlist 中的私聊对方续接一个 DSH Agent 会话，或使用 `/new`、`/status`、`/help`。
+- 可选的实时监听模式：exact allowlist 中的私聊对方可续接一个 DSH Agent 会话，或使用 `/new`、`/status`、`/help`。
 
 ## 界面截图
 
@@ -54,10 +52,9 @@ Host-only Provider lease 不会进入 Browser、Remote、Agent tools 或模型 A
 
 ## 安装
 
-先安装独立身份插件，再安装 AWiki：
+安装公开发布的官方 npm 包：
 
 ```bash
-dsh plugin --profile web add @agent-network-protocol/dsh-anp-identity@latest
 dsh plugin --profile web add @awiki/dsh-plugin@latest
 ```
 
@@ -76,10 +73,9 @@ Profile 命令。本发布线面向 `0.1.1-rc.2` 包族，并精确锁定所有
 从 `0.2.0-rc.4` 起，`@awiki/dsh-plugin` 是唯一规范包名。原
 `@awiki/dsh` registry 条目已被 unpublish，不再作为本发布线的安装来源。
 
-请在常规 DSH base 和 Web app bundle 之后应用本包。主包 `cordis.patch.yml` 会依次加入
-ANP Identity Service、其 Native Provider、AWiki Host Service、AWiki IM Core Provider 和
-Summary Provider；浏览器客户端由 DSH 根据包元数据自动发现并注入。卸载时先关闭 IM Core，
-再撤销身份 lease，最后关闭身份 Store Provider。主 patch 不再插入 Model Proxy。可选包使用自己的 patch，
+请在常规 DSH base 和 Web app bundle 之后应用本包。主包 `cordis.patch.yml` 会加入
+AWiki Host Service、Rust SDK Provider 和 Summary Provider；浏览器客户端由 DSH 根据
+包元数据自动发现并注入。主 patch 不再插入 Model Proxy。可选包使用自己的 patch，
 只插入一个 `awiki-model-proxy`，并显式依赖已经加载的 `awiki` 服务。
 
 ## 配置
@@ -95,23 +91,26 @@ Summary Provider；浏览器客户端由 DSH 根据包元数据自动发现并
 | `DSH_AWIKI_MESSAGE_SERVICE_DID` | 权威消息服务 DID | `did:wba:awiki.ai` |
 | `DSH_AWIKI_MESSAGE_SERVICE_PUBLIC_URL` | 写入协议记录的公开 endpoint | `https://awiki.ai` |
 | `DSH_AWIKI_ALLOWED_ATTACHMENT_ORIGINS` | 额外附件 HTTPS origin 的 JSON 数组 | `[]` |
-| `DSH_AWIKI_STATE_ROOT` | 私有 Rust IM Core 状态目录 | `$DSH_HOME/awiki/im-core` 或 `~/.dsh/awiki/im-core` |
-| `DSH_ANP_IDENTITY_STATE_ROOT` | 独立的 ANP Identity 多 DID Store | `$DSH_HOME/anp-identity` |
-| `DSH_ANP_IDENTITY_ROOT_KEY_PROVIDER` | Store 根密钥提供方（`keyring`、`local-file`、`env` 或程序注入的 `injected`） | `keyring` |
-| `DSH_ANP_IDENTITY_ROOT_KEY_PROVIDER_ID` | Keyring account、环境变量名或 injected provider 标识 | `anp-identity/dsh` |
+| `DSH_AWIKI_STATE_ROOT` | 私有 Rust IM Core 状态目录；显式设置时覆盖 profile 隔离 | `$DSH_HOME/awiki/<profile>/im-core` 或 `~/.dsh/awiki/<profile>/im-core`；无法确认 profile 时兼容旧路径 `awiki/im-core` |
 | `DSH_AWIKI_VAULT_ROOT_KEY_FILE` | 含 base64/base64url 32-byte Vault root key 的既有私有文件 | `$DSH_HOME/awiki/secret-vault/root-key.b64u` |
 | `DSH_AWIKI_VAULT_WORKSPACE_ID` | 稳定、非秘密的 Vault workspace context | `dsh-awiki` |
 | `DSH_AWIKI_VAULT_DEVICE_ID` | 稳定、非秘密的 Vault device context | `local-device` |
 | `DSH_AWIKI_POLL_INTERVAL_MS` | 弹窗打开时的轮询间隔 | `5000` |
 | `DSH_AWIKI_ATTACHMENT_MAX_BYTES` | 解码后的附件上限 | `10485760` |
 | `DSH_AWIKI_IMAGE_CACHE_MAX_BYTES` | 私有图片预览缓存的磁盘预算 | `67108864` |
-| `DSH_AWIKI_REALTIME_ENABLED` | 开启身份级 Direct/Group/System Notification WSS | `true` |
 | `DSH_AWIKI_LISTENER_ENABLED` | 开启私聊到 Agent 的 listener | `false` |
 | `DSH_AWIKI_LISTENER_ALLOWED_PEERS` | exact Handle/DID JSON 数组；开启时必填 | `[]` |
 | `DSH_AWIKI_LISTENER_WORKSPACE_PATH` | 所有 AWiki Session 共用的绝对 Workspace 路径 | `$DSH_HOME/workspaces/awiki` 或 `~/.dsh/workspaces/awiki` |
 | `DSH_AWIKI_SUMMARY_MAX_INPUT_BYTES` | Host 最小化后的 UTF-8 输入上限 | `32768` |
 | `DSH_AWIKI_SUMMARY_TIMEOUT_MS` | 单次模型调用超时 | `30000` |
 | `DSH_AWIKI_SUMMARY_MAX_OUTPUT_TOKENS` | 结构化摘要输出上限 | `768` |
+
+默认状态目录按 DSH profile 隔离：Desktop 以 Host 公开的 `desktopProfiles.current.name`
+为准，普通 `dsh --profile` 仅在 Loader 根目录严格匹配 `$DSH_HOME/profiles/<name>`
+时采用该名称。插件不会从 argv、端口或进程类型猜测 profile，也不会自动复制旧数据库；
+旧的共享 `awiki/im-core` 仍保留在原处。若检测到旧目录，身份入口会说明隔离原因并引导
+用户通过原 Handle 和手机号恢复，把目标 profile 作为独立设备接入。
+
 ## AWiki 托管模型账户
 
 该能力现在需要单独安装 `@awiki/dsh-model-proxy`。它通过
@@ -181,14 +180,12 @@ Provider 域名和消息服务 DID 都是协议标识，不能根据 API host
 Node facade 独占 `stateRoot/vault/root-key.b64u`；Host 不提供、不复制也不记录 Vault key
 material。普通重启与升级期间应完整保留 SDK state root。
 
-身份级 realtime supervisor 默认开启，独占部署身份的一条 Core WebSocket，不依赖 Workspace 或
-Agent 配置。Direct、Group 和 System Notification 事件只调度 canonical reliable sync；WSS 本身
-不推进 checkpoint，也不授权设备。显式设置 `DSH_AWIKI_REALTIME_ENABLED=false` 可回退到 HTTP
-refresh。私聊 Agent consumer 仍只有在 `DSH_AWIKI_LISTENER_ENABLED=true` 且 exact allowlist
-非空时才启用；它只读取合格同步原因之后的已提交 Direct 文本，不能启动或停止 WSS。每个私聊的
-DSH Session route 和消息 watermark 按身份隔离持久化，重启后可续接；所有 AWiki 来源 Session 都
-创建并 attach 到已注册的共享 AWiki Workspace。Listener 消息始终是不可信用户数据，不会自动批准
-工具，也不会桥接 approval 或 user-question prompt。
+Listener 只有在 `DSH_AWIKI_LISTENER_ENABLED=true` 且 exact allowlist 非空时才启用。启动和每个
+Core realtime 调度信号都会先执行 canonical reliable sync，再读取已提交 history。WebSocket
+连接与重连由 Core 所有；stream 关闭固定按“停止旧 session、reconnect sync、启动 replacement”
+恢复。每个私聊持久化一个当前 DSH Session route 和消息 watermark，重启后可续接；所有 AWiki
+来源 Session 都创建并 attach 到已注册的共享 AWiki Workspace。Listener 消息始终是不可信用户
+数据，不会自动批准工具，也不会桥接 approval 或 user-question prompt。
 
 默认附件上限为解码后 10 MiB；反向代理请求体上限至少应为 14 MiB，以容纳
 base64 与 JSON 封装开销。
@@ -239,7 +236,7 @@ pnpm run verify:workspace
 pnpm pack --dry-run
 ```
 
-生产 Host 加载固定版本 `@awiki/im-core-node@0.2.0`；平台原生 addon 由它的
+生产 Host 加载固定版本 `@awiki/im-core-node@0.1.8`；平台原生 addon 由它的
 optional dependencies 选择，并保持在 JavaScript bundle 外。使用者无需安装 Rust，
 也无需检出 `awiki-cli-rs2`。来源与许可证见 `THIRD_PARTY_NOTICES.md`。
 

package/cordis.patch.yml

@@ -2,22 +2,6 @@
 # @deepseek-ai/dsh-base and @deepseek-ai/dsh-web-app.
 
 - insert:
-    - id: anp-identity
-      name: '@agent-network-protocol/dsh-anp-identity'
-      config:
-        stateRoot: !!js process.env.DSH_ANP_IDENTITY_STATE_ROOT
-        allowConsumers: ['@awiki/dsh-plugin']
-        allowProviderConsumers: ['@awiki/dsh-plugin']
-        recoveryOnOpen: true
-
-    - id: anp-identity-provider
-      name: '@agent-network-protocol/dsh-anp-identity/provider'
-      config:
-        stateRoot: !!js process.env.DSH_ANP_IDENTITY_STATE_ROOT
-        rootKeyProvider: !!js process.env.DSH_ANP_IDENTITY_ROOT_KEY_PROVIDER ?? 'keyring'
-        rootKeyProviderId: !!js process.env.DSH_ANP_IDENTITY_ROOT_KEY_PROVIDER_ID ?? 'anp-identity/dsh'
-        keyringFallbackToLocalFile: false
-
     - id: awiki
       name: '@awiki/dsh-plugin'
       config:
@@ -33,7 +17,6 @@
         attachmentMaxBytes: !!js Number(process.env.DSH_AWIKI_ATTACHMENT_MAX_BYTES ?? '10485760')
         imageAttachmentCacheMaxBytes: !!js Number(process.env.DSH_AWIKI_IMAGE_CACHE_MAX_BYTES ?? '67108864')
         summaryMaxInputBytes: !!js Number(process.env.DSH_AWIKI_SUMMARY_MAX_INPUT_BYTES ?? '32768')
-        realtimeEnabled: !!js JSON.parse(process.env.DSH_AWIKI_REALTIME_ENABLED || 'true')
         listenerEnabled: !!js process.env.DSH_AWIKI_LISTENER_ENABLED === 'true'
         listenerAllowedPeers: !!js JSON.parse(process.env.DSH_AWIKI_LISTENER_ALLOWED_PEERS ?? '[]')
         listenerWorkspacePath: !!js process.env.DSH_AWIKI_LISTENER_WORKSPACE_PATH