@awiki/dsh-plugin 0.3.4 → 0.3.6

package/README.md

@@ -1,10 +1,8 @@
 # @awiki/dsh-plugin
 
-AWiki account, authorization, recovery, and messaging for
-[DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness). The package installs one Host
-service, its IM Core provider, the model tools, and a Web client with a draggable AWiki Me launcher.
-General DID documents and private keys are managed by the independent
-`@agent-network-protocol/dsh-anp-identity` plugin and injected through Cordis.
+AWiki identity and messaging for [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness).
+The package installs one Host service, its production Rust SDK provider,
+the model tools, and a Web client with a draggable AWiki Me launcher.
 
 [中文说明](./README.zh.md)
 
@@ -13,16 +11,13 @@ phone and OTP never enter browser persistence, controller snapshots, or public
 Remote results. Closed registration, unavailable verification state, and commit conflicts each give
 a safe next action without exposing remote response details.
 
-The two plugins deliberately own different state. ANP Identity owns the multi-DID Store, DID
-documents, private keys, and publication transactions. AWiki IM Core owns Handle/account bindings,
-device and recovery workflows, authentication tokens, messages, mail, SQLite, and caches below its
-configured `stateRoot`. The Host-only provider lease is never exposed to Browser, Remote, Agent
-tools, or model APIs.
+The Rust SDK exclusively owns the identity, SecretVault, database, cache, and metadata below the
+configured `stateRoot`. This release performs a clean cutover and does not import the former
+TypeScript SDK `identity.json`; create a new Rust-backed identity after upgrading.
 
 ## Features
 
-- Enter a Handle and phone through one Web UI flow and always request a registration OTP. A new Handle creates the deployment identity; an existing Handle offers ordinary Device Join first, with Recovery V4 as an explicit destructive alternative that requests a second purpose-scoped OTP.
-- DSH can join an existing Handle as an independent member device. When DSH created or recovered the Handle and is the current ready-admin, the foreground Devices tab can list devices, verify an incoming request with SAS, approve one member, reject it, or revoke another device. These mutations are not Agent tools and require explicit `APPROVE` / `REVOKE` confirmation.
+- Enter a Handle and phone through one Web UI flow. Before any code is sent, the Host classifies the Handle: a new Handle receives a registration OTP and creates the deployment identity, while an existing Handle receives one Recovery V4 OTP and enters the recovery state machine directly.
 - Open the top-left AWiki account menu to sign out locally without deleting the encrypted identity or message database; **Resume local identity** restores the same DID and Handle, including across DSH restarts. The signed-out screen reveals phone recovery only after local resume fails. Switching identities requires an explicit confirmation that permanently clears local AWiki data first.
 - Reuse that identity across the root Agent and its subagents.
 - Direct-message and existing-group conversation lists, unread counts, latest-message previews, and persisted display names. Core SQLite remains the persistent source of truth: the Host joins persisted peer profiles onto Direct roster rows, while the browser keeps the active identity's last trustworthy Direct profile and group title. Sparse polling identifiers therefore cannot overwrite a resolved display name or real group title. After an existing Handle is recovered, the Host synchronizes account projections before asking Core to restore old group memberships; pending or blocked groups expose a retryable status without disabling Direct messages or other groups. Opening a conversation renders the committed local timeline first, hydrates group sender labels from the Core display-profile cache, reconciles remote history and Direct profile data in the background, and keeps local messages visible if refresh fails. A failed background roster poll also leaves the usable local view quiet; explicit loads still surface their errors. This local-first path covers the newest projected page; loading older messages still requires the remote history service. Scrolling up reveals a latest-message control that counts newer arrivals without interrupting reading. A conversation is marked read only after its newest rendered message reaches the visible bottom.
@@ -31,14 +26,15 @@ tools, or model APIs.
 - A draggable circular launcher that defaults to the lower-left sidebar area, adaptive popup placement, dark mode, and remembered active conversation.
 - User-triggered AI summaries for up to 50 recent or unread messages, kept only in runtime memory with explicit stale, retry, copy, and source-navigation states.
 - OTP identity access keeps the verification form visible and disables resend with a visible server-directed cooldown countdown. Handle classification happens before OTP delivery, so each attempt sends exactly one purpose-correct registration or recovery code.
-- After Recovery V4 reaches `applied`, the Host resolves the recovered Handle's original mailbox under the current DID. If the separate Model Proxy package is installed, the Host also obtains one short-lived, audience-bound recovery attestation and reconciles the current DID to the original billing account without copying or adding balances. A temporary failure keeps only the non-secret recovery operation ID and retries the same idempotent reconciliation after restart; the attestation and ledger identity never enter Browser state, Agent tools, logs, or model context.
+- After Recovery V4 reaches `applied`, the Host activates the recovered identity immediately. Automatic restoration of the historical mailbox and canonical model billing account is currently deferred, so those optional account projections cannot block identity recovery. The Browser clears its blocking operation marker while Core retains the authoritative recovery journal; no recovery attestation or model reconciliation request is issued.
 - When the separate `@awiki/dsh-model-proxy` package is installed, an AWiki-hosted DeepSeek choice appears before the official API-key onboarding step only when Harness has no usable model provider, with an explicit opt-in and an unchanged API-key escape path. New sessions do not show AWiki model or payment prompts after the official or another provider is usable.
 - The optional model-proxy package owns the Host short-token flow and every model-hosting Browser surface: onboarding plus Settings → Quick Recharge with Account & Recharge and Usage tabs. It registers `awiki-deepseek` with `deepseek-v4-flash` and `deepseek-v4-pro`; Flash is recommended and credentials never enter the Browser.
 - AWiki identity, domain, and local-data settings remain in the main package. Installing only the main package does not register model opt-in, recharge, usage, or model onboarding UI.
 - A typed second confirmation in the Settings danger zone before permanently clearing local AWiki identity, key, token, registration-draft, and message-index state.
 - Five messaging Agent tools: identity status, conversations, history, approved text send, and approved attachment send.
-- Five on-demand mail Agent tools: mailbox account, inbox, plain-text read, approved mark-read, and approved plain-text send.
-- A default identity-level realtime connection for Direct, Group, and System Notification sync, plus an independent opt-in Agent consumer that lets exact-allowlisted Direct peers continue one DSH Agent session or use `/new`, `/status`, and `/help`.
+- A mail Web UI that selects, reviews, removes, and sends up to 10 bounded attachments, then explicitly downloads one metadata-matched attachment with Base64, size, and SHA-256 verification.
+- Five on-demand mail Agent tools: mailbox account, inbox, plain-text read, approved mark-read, and approved plain-text send. Mail read exposes attachment metadata plus a Browser-UI-only download note; Agent mail send remains attachment-free because DSH has no authorized file-resource handle for this tool.
+- An opt-in realtime listener that lets exact-allowlisted Direct peers continue one DSH Agent session or use `/new`, `/status`, and `/help`.
 
 ## Screenshots
 
@@ -55,12 +51,20 @@ post-creation group administration or multiple attachments in one message. The A
 plain Direct text; Groups, attachments, encrypted/payload content, and unknown slash commands never
 reach the Agent.
 
-Mail v1 is on demand only and has no browser mailbox or compose UI. It does not wake an Agent for
-new mail, render or send HTML, transfer mail attachments, or implement reply, forward, and
-threading. Mail subject, addresses, preview, body, timestamps, and attachment metadata are
+Mail remains on demand and does not wake an Agent for new mail, render or send HTML, or implement
+reply, forward, and threading. The Browser reads only user-selected `File` objects, freezes the
+approved draft during its one send attempt, and enforces the Host-provided count, single-file, and
+total-size limits before canonical Base64 crosses Remote. Attachment downloads are always explicit;
+the Browser matches the returned metadata and verifies canonical Base64, byte count, and SHA-256
+before creating a temporary Blob URL, then revokes that URL immediately. It never auto-opens HTML,
+SVG, or another attachment. Sent history stores only the service message id, file metadata, and
+SHA-256, never attachment bytes. Mail subject, addresses,
+preview, body, timestamps, and attachment metadata are
 untrusted external data, never Agent instructions. `awiki_mail_mark_read` and `awiki_mail_send`
 require execution approval. Mail send is attempted once without automatic retry; a timeout or
 transport loss returns `delivery-unknown`, so inspect the mailbox before approving another send.
+The Agent tool does not accept attachment Base64 or local paths; attachment selection and download
+remain explicit Browser UI actions until Harness provides a formally authorized file-resource contract.
 
 Identity recovery does not add server-side private-chat restoration. A fresh local state does not
 reconstruct historical Direct conversations; only ordinary data already retained by the Rust SDK
@@ -69,10 +73,9 @@ are independent of that private-chat boundary.
 
 ## Install
 
-Install the independent identity plugin first, then AWiki:
+Install the official public npm package:
 
 ```bash
-dsh plugin --profile web add @agent-network-protocol/dsh-anp-identity@latest
 dsh plugin --profile web add @awiki/dsh-plugin@latest
 ```
 
@@ -94,11 +97,10 @@ families in a DSH root dependency tree.
 `0.2.0-rc.4`. The former `@awiki/dsh` registry entry was unpublished and is
 not an installation source for this release line.
 
-Apply the packages after the normal DSH base and Web app bundles. The main
-`cordis.patch.yml` loads the ANP Identity Service, its native Provider, the AWiki Host Service, the
-AWiki IM Core Provider, and the summary Provider in that order; DSH discovers and injects the
-browser client through package metadata. Teardown closes IM Core before revoking its identity
-lease, and the identity Store Provider closes last. The patch does not insert Model Proxy. The optional package has its
+Apply the package after the normal DSH base and Web app bundles. Its
+The main `cordis.patch.yml` adds the AWiki Host service, Rust SDK provider, and
+summary provider; DSH discovers and injects the browser client through the
+package metadata. It does not insert Model Proxy. The optional package has its
 own patch, inserts exactly one `awiki-model-proxy` row after AWiki, and declares
 an explicit dependency on the loaded `awiki` service.
 
@@ -108,30 +110,37 @@ The plugin works against the public `awiki.ai` tenant without environment config
 
 | Variable | Purpose | Default |
 | --- | --- | --- |
-| `DSH_AWIKI_USER_SERVICE_URL` | Absolute AWiki user-service URL | `https://awiki.ai` |
-| `DSH_AWIKI_USER_SERVICE_DOMAIN` | Composition default for the Handle provider domain | `awiki.ai` |
-| `DSH_AWIKI_MESSAGE_SERVICE_URL` | Message-service URL called by the Host | `https://awiki.ai` |
+| `DSH_AWIKI_USER_SERVICE_URL` | Absolute AWiki user-service URL | `https://<selected-domain>` |
+| `DSH_AWIKI_USER_SERVICE_DOMAIN` | Composition default for the tenant domain | `awiki.ai` |
+| `DSH_AWIKI_MESSAGE_SERVICE_URL` | Message-service URL called by the Host | `https://<selected-domain>` |
 | `DSH_AWIKI_MAIL_SERVICE_URL` | Mail-service URL called by the Host | Resolved user-service URL |
-| `DSH_AWIKI_MESSAGE_SERVICE_DID` | Authoritative message-service DID | `did:wba:awiki.ai` |
-| `DSH_AWIKI_MESSAGE_SERVICE_PUBLIC_URL` | Public endpoint written to protocol records | `https://awiki.ai` |
+| `DSH_AWIKI_MESSAGE_SERVICE_DID` | Authoritative message-service DID | `did:wba:<selected-domain>` |
+| `DSH_AWIKI_MESSAGE_SERVICE_PUBLIC_URL` | Public endpoint written to protocol records | `https://<selected-domain>` |
 | `DSH_AWIKI_ALLOWED_ATTACHMENT_ORIGINS` | JSON array of extra exact HTTPS origins | `[]` |
-| `DSH_AWIKI_STATE_ROOT` | Private Rust IM Core state directory | `$DSH_HOME/awiki/im-core` or `~/.dsh/awiki/im-core` |
-| `DSH_ANP_IDENTITY_STATE_ROOT` | Independent multi-DID ANP Identity Store | `$DSH_HOME/anp-identity` |
-| `DSH_ANP_IDENTITY_ROOT_KEY_PROVIDER` | Store Root Key provider (`keyring`, `local-file`, `env`, or programmatic `injected`) | `keyring` |
-| `DSH_ANP_IDENTITY_ROOT_KEY_PROVIDER_ID` | Keyring account, environment variable, or injected-provider identifier | `anp-identity/dsh` |
+| `DSH_AWIKI_STATE_ROOT` | Private Rust IM Core state directory; an explicit value overrides profile isolation | `$DSH_HOME/awiki/<profile>/im-core` or `~/.dsh/awiki/<profile>/im-core`; legacy `awiki/im-core` when no profile can be proven |
 | `DSH_AWIKI_VAULT_ROOT_KEY_FILE` | Existing private file containing a base64/base64url 32-byte Vault root key | `$DSH_HOME/awiki/secret-vault/root-key.b64u` |
 | `DSH_AWIKI_VAULT_WORKSPACE_ID` | Stable non-secret Vault workspace context | `dsh-awiki` |
 | `DSH_AWIKI_VAULT_DEVICE_ID` | Stable non-secret Vault device context | `local-device` |
 | `DSH_AWIKI_POLL_INTERVAL_MS` | Open-dialog polling interval | `5000` |
 | `DSH_AWIKI_ATTACHMENT_MAX_BYTES` | Decoded attachment limit | `10485760` |
+| `DSH_AWIKI_MAIL_ATTACHMENT_MAX_COUNT` | Maximum attachments in one mail; at most the service limit | `10` |
+| `DSH_AWIKI_MAIL_ATTACHMENT_MAX_BYTES` | Maximum decoded bytes in one mail attachment | `10485760` |
+| `DSH_AWIKI_MAIL_ATTACHMENT_TOTAL_MAX_BYTES` | Maximum total decoded attachment bytes in one mail | `18874368` |
 | `DSH_AWIKI_IMAGE_CACHE_MAX_BYTES` | Private verified image-preview cache budget | `67108864` |
-| `DSH_AWIKI_REALTIME_ENABLED` | Enable the identity-level Direct/Group/System Notification WSS | `true` |
 | `DSH_AWIKI_LISTENER_ENABLED` | Enable the Direct-to-Agent listener | `false` |
 | `DSH_AWIKI_LISTENER_ALLOWED_PEERS` | JSON array of exact Handles or DIDs; required when enabled | `[]` |
 | `DSH_AWIKI_LISTENER_WORKSPACE_PATH` | Absolute shared Workspace for AWiki-originated Sessions | `$DSH_HOME/workspaces/awiki` or `~/.dsh/workspaces/awiki` |
 | `DSH_AWIKI_SUMMARY_MAX_INPUT_BYTES` | UTF-8 cap after Host-side summary minimization | `32768` |
 | `DSH_AWIKI_SUMMARY_TIMEOUT_MS` | One-shot model deadline | `30000` |
 | `DSH_AWIKI_SUMMARY_MAX_OUTPUT_TOKENS` | Structured summary output cap | `768` |
+
+The default state directory is isolated by DSH profile. Desktop uses the Host's
+`desktopProfiles.current.name`; ordinary `dsh --profile` accepts the name only when the Loader
+root exactly matches `$DSH_HOME/profiles/<name>`. The plugin does not guess from argv, ports, or
+process type, and does not copy a legacy database automatically. The old shared `awiki/im-core`
+directory remains untouched. When it is detected, the identity screen explains the isolation and
+guides the user to recover with the original Handle and phone as a separate device.
+
 ## AWiki-hosted DeepSeek account
 
 This capability now requires the separate `@awiki/dsh-model-proxy` package. It
@@ -185,11 +194,14 @@ closes the provider order, then restores the amount editor without creating a re
 failure leaves the existing payment action available, while a payment that wins the race refreshes
 the credited account instead of being reported as cancelled.
 
-The default Handle provider domain is `awiki.ai`. A local user can override it
+The default AWiki tenant domain is `awiki.ai`. A local user can switch it
 from Settings → AWiki; DSH persists that choice in its settings document and
-applies it after the next Harness restart. The setting affects future identity
-registration and completion of short Handles. It does not rewrite an already
-registered DID or Handle.
+applies it after the next Harness restart. Unless an endpoint has an explicit
+deployment override, the User, Message, Mail, attachment origin, and message-
+service DID routes are derived from the selected domain. Each domain uses an
+isolated local identity, message, cache directory, and browser recovery-operation
+key. Switching back restores that tenant's previous local state instead of
+rewriting its DID or keys.
 
 The settings page talks to a plugin-owned Connection channel that the Host
 accepts only from loopback. This keeps an independently installed `@awiki/dsh-plugin`
@@ -218,17 +230,14 @@ underlying disk and backups.
 The Node facade owns `stateRoot/vault/root-key.b64u`; the Host does not provide, copy, or log Vault
 key material. Preserve the complete SDK state root across ordinary restarts and upgrades.
 
-The identity-level realtime supervisor is enabled by default and owns the deployment identity's
-single Core WebSocket without depending on Workspace or Agent configuration. Direct, Group, and
-System Notification events schedule canonical reliable sync; WSS never advances a checkpoint or
-authorizes a device by itself. `DSH_AWIKI_REALTIME_ENABLED=false` explicitly falls back to HTTP
-refresh. The optional Direct-to-Agent consumer still requires both
-`DSH_AWIKI_LISTENER_ENABLED=true` and a non-empty exact allowlist. It reads only committed Direct
-text after eligible sync causes and cannot start or stop WSS. One identity-scoped route and message
-watermark per Direct conversation preserve the current DSH Session across restarts. Every
-AWiki-originated Session is created in and attached to the registered shared AWiki Workspace.
-Listener messages are untrusted user data and do not approve tools or bridge approval/user-question
-prompts.
+The listener is disabled unless both `DSH_AWIKI_LISTENER_ENABLED=true` and a non-empty exact
+allowlist are configured. On startup and every Core realtime scheduling signal it runs canonical
+reliable sync before reading committed history. Core owns WebSocket connection and reconnect;
+stream closure is recovered as stop, reconnect sync, then replacement realtime session. One
+persisted route and message watermark per Direct conversation preserve the current DSH Session
+across restarts. Every AWiki-originated Session is created in and attached to the registered shared
+AWiki Workspace. Listener messages are untrusted user data and do not approve tools or bridge
+approval/user-question prompts.
 
 For the default 10 MiB decoded attachment cap, configure a reverse-proxy request
 limit of at least 14 MiB to account for base64 and JSON overhead.
@@ -285,7 +294,7 @@ pnpm run verify:workspace
 pnpm pack --dry-run
 ```
 
-The production Host loads the exact `@awiki/im-core-node@0.2.0` runtime package;
+The production Host loads the exact `@awiki/im-core-node@0.1.9` runtime package;
 the platform-specific native addon is selected through its optional dependencies
 and remains external to the JavaScript bundle. Consumers do not need Rust or an
 `awiki-cli-rs2` checkout. See `THIRD_PARTY_NOTICES.md` for provenance and

package/README.zh.md

@@ -1,18 +1,16 @@
 # @awiki/dsh-plugin
 
 为 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) 提供 AWiki
-账号、授权、恢复与消息能力。主包包含 Host Service、IM Core Provider、Agent 工具，
-以及带可拖动 AWiki Me 悬浮入口的 Web 客户端；通用 DID 文档与私钥由独立的
-`@agent-network-protocol/dsh-anp-identity` 插件管理，并通过 Cordis 注入。
+身份与消息能力。一个包同时包含 Host Service、Rust SDK Provider、Agent 工具，
+以及带可拖动 AWiki Me 悬浮入口的 Web 客户端；入口默认位于 DSH 左下角侧栏区域。
 
-两个插件的状态所有权相互独立：ANP Identity 管理多 DID Store、DID 文档、私钥和发布事务；
-AWiki IM Core 管理 Handle/账号绑定、设备与恢复流程、认证令牌、消息、邮件、SQLite 和缓存。
-Host-only Provider lease 不会进入 Browser、Remote、Agent tools 或模型 API。
+Rust SDK 独占管理配置的 `stateRoot` 下的身份、SecretVault、数据库、缓存和元数据。
+本版本采用干净切换，不导入旧 TypeScript SDK 的 `identity.json`；升级后需创建新的
+Rust 身份。
 
 ## 功能
 
-- 在 Web UI 的统一入口输入 Handle 和手机号，并始终先发送注册验证码。新 Handle 创建部署级身份；已有 Handle 优先进入普通 Device Join，Recovery V4 仅作为显式危险替代项，并重新发送用途隔离的恢复验证码；根 Agent 与子 Agent 共用最终身份。
-- DSH 可以作为独立 member 设备加入已有 Handle；当 DSH 创建或恢复 Handle、当前设备为 ready-admin 时，前台“设备”页可列出设备、通过 SAS 验证并批准 member、拒绝请求或撤销其他设备。管理动作不进入 Agent 工具，并要求显式输入 `APPROVE` / `REVOKE`。
+- 在 Web UI 的统一入口输入 Handle 和手机号。Host 会在发送验证码前判断 Handle 状态：新 Handle 只发送注册验证码并创建部署级身份，已有 Handle 只发送 Recovery V4 恢复验证码并直接进入恢复流程；根 Agent 与子 Agent 共用最终身份。
 - 点击 AWiki 面板左上角图标可打开账户菜单；普通退出只锁定本机会话，不删除加密身份或消息数据库，重新进入及重启 DSH 后仍恢复同一个 DID 和 Handle。退出页默认只提供重新进入本机身份和使用其他身份；只有本机重新进入失败后才显示手机号恢复入口。改用其他身份必须先确认永久清除本地 AWiki 数据。
 - 身份入口失败时保留当前挂载表单中的手机号、Handle 和验证码，以便修正后重试；手机号和验证码不进入 Browser 持久化状态、controller snapshot 或公开 Remote 结果。仅恢复操作编号可用于崩溃续跑。注册未开放、验证码状态失效和提交冲突会给出对应的安全处理提示。
 - 私聊和已有群聊列表、未读角标、最新消息预览、时间更新与昵称持久化。Core SQLite 是持久化真相源：Host 将持久化的对端资料合并进私聊列表，浏览器再按当前身份保留最后一次可信的私聊资料和群名，稀疏轮询中的 Handle、DID 或 Group DID 占位不会覆盖真实名称。恢复已有 Handle 后，Host 会先同步账号投影，再让 Core 自动恢复旧群聊成员身份；未完成或受阻的群聊会显示可重试状态，但不影响私聊和其他群聊。打开会话时先显示 Core 已提交的本地时间线，并从 Core 显示资料缓存补齐群消息发送者名称，再在后台补齐远端历史和私聊资料；刷新失败不会清空本地消息。后台会话轮询失败也不会用全局红条打断仍可用的本地页面，用户主动加载失败仍会正常提示。当前 local-first 只覆盖本地最新一页，“加载更早消息”仍需访问远端 history。向上阅读时显示下滑箭头，新消息到达后在同一控件中累计数量且不打断阅读位置。只有最新一条已渲染消息到达可视区域底部后，当前会话才会自动标记为已读。
@@ -20,15 +18,16 @@ Host-only Provider lease 不会进入 Browser、Remote、Agent tools 或模型 A
 - 文本和单附件消息；Enter 发送、Shift+Enter 换行，发送中立即显示带 loading 动画的乐观气泡，并通过精确的客户端消息 ID 与已提交消息对账，避免同一条消息显示两个气泡；同时支持图片预览、附件说明与 SHA 校验。校验通过的图片字节使用三层有界缓存：浏览器运行期 LRU 让会话重新挂载时立即出图，按身份隔离的 IndexedDB 在整页刷新后无需访问 Host，Host 私有磁盘缓存则应对浏览器缓存丢失并跨 Harness 重启复用；“清除本地数据”会删除三层缓存。
 - 圆形可拖动入口、自适应四角弹窗、深色模式和当前会话记忆。
 - 用户点击后才生成的 AI 对话总结：最多处理 50 条最近或未读消息，按会话保留本次运行期缓存，并支持过期提示、重试、复制与跳转原消息。
-- OTP 身份入口会保留验证码输入表单，并按服务端返回的冷却时间显示重发倒计时、禁用提前重发；已有 Handle 在消费 registration OTP 后再选择 Join 或 Recovery，Recovery 不复用 registration grant。
-- Recovery V4 进入 `applied` 后，Host 会用 current DID 解析已恢复 Handle 的原邮箱；如同时安装独立 Model Proxy 包，还会获取一份短时、固定受众的恢复凭证，把 current DID 对账到原模型账本，不复制余额、不做金额相加。临时失败只保留非敏感 operation id，并在重启后对同一幂等操作自动重试；恢复凭证和账本标识不会进入 Browser 状态、Agent 工具、日志或模型上下文。
+- OTP 身份入口会保留验证码输入表单，并按服务端返回的冷却时间显示重发倒计时、禁用提前重发；Handle 分流发生在发送前，因此每次只会发送一个用途正确的注册或恢复验证码。
+- Recovery V4 进入 `applied` 后，Host 会立即激活恢复后的身份。当前暂不自动恢复历史邮箱或原模型账本，两个可选账户投影不会再阻塞身份恢复。Browser 会清除阻塞流程标记，权威恢复 journal 仍由 Core 保留；当前不会申请恢复凭证，也不会发送模型账本对账请求。
 - 安装独立的 `@awiki/dsh-model-proxy` 后，仅在 Harness 没有任何可用模型时，首次引导才会在官方 API Key 步骤前提供 AWiki 托管模型选项；用户可以明确启用，也可以跳过并继续原版 API Key 流程。已经配置官方或其他 Provider 时，新会话不会显示 AWiki 模型或支付提示。
 - 可选 Model Proxy 包独占 Host 内部短期 Token 和全部模型托管界面：首次引导，以及“设置 → 快速充值”中的“账户与充值”“用量明细”。它提供 `deepseek-v4-flash` 和 `deepseek-v4-pro`，默认推荐 Flash；Token 不进入 Browser。
 - AWiki 主包只保留身份、域名和本地数据设置。只安装主包时，不会注册模型启停、充值、用量或模型首次引导界面。
 - 在设置页危险区域中，经输入确认词的二次确认后，永久清空本机 AWiki 身份、密钥、令牌、注册草稿和消息索引。
 - 五个消息 Agent 工具：身份、会话、历史、需审批的文本发送和需审批的附件发送。
-- 五个按需邮件 Agent 工具：邮箱账户、收件箱、纯文本读取、需审批的标记已读和需审批的纯文本发送。
-- 默认身份级 realtime 连接统一调度 Direct、Group 和 System Notification 同步；独立、可选的 Agent consumer 允许 exact allowlist 中的私聊对方续接一个 DSH Agent 会话，或使用 `/new`、`/status`、`/help`。
+- 邮件 Web UI 支持选择、确认、移除和发送最多 10 个受限附件，并在显式下载时复核元数据、Base64、大小和 SHA-256。
+- 五个按需邮件 Agent 工具：邮箱账户、收件箱、纯文本读取、需审批的标记已读和需审批的纯文本发送。读取工具返回附件元数据和“仅可在 Browser UI 下载”的说明；由于 DSH 当前没有该工具可授权使用的文件资源句柄，Agent 邮件发送仍不接受附件。
+- 可选的实时监听模式：exact allowlist 中的私聊对方可续接一个 DSH Agent 会话，或使用 `/new`、`/status`、`/help`。
 
 ## 界面截图
 
@@ -43,21 +42,25 @@ Host-only Provider lease 不会进入 Browser、Remote、Agent tools 或模型 A
 首版不包含端到端加密、多身份、建群后的成员或群设置管理和单消息多附件。Agent listener 只接受明文私聊文本；
 群聊、附件、加密/payload 内容和未知斜杠命令都不会进入 Agent。
 
-邮件 v1 仅支持按需调用，不提供浏览器收件箱或写信 UI，也不会以新邮件唤醒 Agent；不渲染或
-发送 HTML，不传输邮件附件，也不支持回复、转发和会话串联。邮件主题、地址、预览、正文、
+邮件仍按需调用，不会以新邮件唤醒 Agent；不渲染或发送 HTML，也不支持回复、转发和会话串联。
+Browser 只读取用户明确选择的 `File` 对象，确认发送后冻结整份草稿，并在唯一一次发送前执行
+Host 下发的数量、单文件和总量限制；只有 canonical Base64 会穿过 Remote。附件只能显式下载；
+Browser 在创建临时 Blob URL 前复核返回元数据、canonical Base64、字节数和 SHA-256，随后立即
+释放 URL，不会自动打开 HTML、SVG 或其他附件。本地发件历史只保存服务端消息 ID、文件元数据和
+SHA-256，不保存附件字节。邮件主题、地址、预览、正文、
 时间戳和附件元数据都是不可信外部数据，不能作为 Agent 指令。`awiki_mail_mark_read` 和
 `awiki_mail_send` 每次执行都需要审批。邮件发送只尝试一次且不自动重试；超时或传输中断返回
-`delivery-unknown`，再次审批发送前应先检查邮箱。
+`delivery-unknown`，再次审批发送前应先检查邮箱。Agent 工具不接受附件 Base64 或本地路径；
+在 Harness 提供正式、可授权的文件资源契约前，附件选择和下载都保留为 Browser UI 显式操作。
 
 身份恢复不新增服务端私聊恢复。清空本地状态后不会重新构造历史私聊会话；只有 Rust SDK
 已经保留的普通本地数据继续遵循 Core 既有迁移规则。邮箱和托管模型账本对账与私聊边界相互独立。
 
 ## 安装
 
-先安装独立身份插件，再安装 AWiki：
+安装公开发布的官方 npm 包：
 
 ```bash
-dsh plugin --profile web add @agent-network-protocol/dsh-anp-identity@latest
 dsh plugin --profile web add @awiki/dsh-plugin@latest
 ```
 
@@ -76,10 +79,9 @@ Profile 命令。本发布线面向 `0.1.1-rc.2` 包族，并精确锁定所有
 从 `0.2.0-rc.4` 起，`@awiki/dsh-plugin` 是唯一规范包名。原
 `@awiki/dsh` registry 条目已被 unpublish，不再作为本发布线的安装来源。
 
-请在常规 DSH base 和 Web app bundle 之后应用本包。主包 `cordis.patch.yml` 会依次加入
-ANP Identity Service、其 Native Provider、AWiki Host Service、AWiki IM Core Provider 和
-Summary Provider；浏览器客户端由 DSH 根据包元数据自动发现并注入。卸载时先关闭 IM Core，
-再撤销身份 lease，最后关闭身份 Store Provider。主 patch 不再插入 Model Proxy。可选包使用自己的 patch，
+请在常规 DSH base 和 Web app bundle 之后应用本包。主包 `cordis.patch.yml` 会加入
+AWiki Host Service、Rust SDK Provider 和 Summary Provider；浏览器客户端由 DSH 根据
+包元数据自动发现并注入。主 patch 不再插入 Model Proxy。可选包使用自己的 patch，
 只插入一个 `awiki-model-proxy`，并显式依赖已经加载的 `awiki` 服务。
 
 ## 配置
@@ -88,30 +90,36 @@ Summary Provider；浏览器客户端由 DSH 根据包元数据自动发现并
 
 | 环境变量 | 用途 | 默认值 |
 | --- | --- | --- |
-| `DSH_AWIKI_USER_SERVICE_URL` | AWiki user service 绝对 URL | `https://awiki.ai` |
-| `DSH_AWIKI_USER_SERVICE_DOMAIN` | Handle 提供方域名的部署默认值 | `awiki.ai` |
-| `DSH_AWIKI_MESSAGE_SERVICE_URL` | Host 调用的 message service URL | `https://awiki.ai` |
+| `DSH_AWIKI_USER_SERVICE_URL` | AWiki user service 绝对 URL | `https://<所选域名>` |
+| `DSH_AWIKI_USER_SERVICE_DOMAIN` | 租户域名的部署默认值 | `awiki.ai` |
+| `DSH_AWIKI_MESSAGE_SERVICE_URL` | Host 调用的 message service URL | `https://<所选域名>` |
 | `DSH_AWIKI_MAIL_SERVICE_URL` | Host 调用的 mail service URL | 解析后的 user service URL |
-| `DSH_AWIKI_MESSAGE_SERVICE_DID` | 权威消息服务 DID | `did:wba:awiki.ai` |
-| `DSH_AWIKI_MESSAGE_SERVICE_PUBLIC_URL` | 写入协议记录的公开 endpoint | `https://awiki.ai` |
+| `DSH_AWIKI_MESSAGE_SERVICE_DID` | 权威消息服务 DID | `did:wba:<所选域名>` |
+| `DSH_AWIKI_MESSAGE_SERVICE_PUBLIC_URL` | 写入协议记录的公开 endpoint | `https://<所选域名>` |
 | `DSH_AWIKI_ALLOWED_ATTACHMENT_ORIGINS` | 额外附件 HTTPS origin 的 JSON 数组 | `[]` |
-| `DSH_AWIKI_STATE_ROOT` | 私有 Rust IM Core 状态目录 | `$DSH_HOME/awiki/im-core` 或 `~/.dsh/awiki/im-core` |
-| `DSH_ANP_IDENTITY_STATE_ROOT` | 独立的 ANP Identity 多 DID Store | `$DSH_HOME/anp-identity` |
-| `DSH_ANP_IDENTITY_ROOT_KEY_PROVIDER` | Store 根密钥提供方（`keyring`、`local-file`、`env` 或程序注入的 `injected`） | `keyring` |
-| `DSH_ANP_IDENTITY_ROOT_KEY_PROVIDER_ID` | Keyring account、环境变量名或 injected provider 标识 | `anp-identity/dsh` |
+| `DSH_AWIKI_STATE_ROOT` | 私有 Rust IM Core 状态目录；显式设置时覆盖 profile 隔离 | `$DSH_HOME/awiki/<profile>/im-core` 或 `~/.dsh/awiki/<profile>/im-core`；无法确认 profile 时兼容旧路径 `awiki/im-core` |
 | `DSH_AWIKI_VAULT_ROOT_KEY_FILE` | 含 base64/base64url 32-byte Vault root key 的既有私有文件 | `$DSH_HOME/awiki/secret-vault/root-key.b64u` |
 | `DSH_AWIKI_VAULT_WORKSPACE_ID` | 稳定、非秘密的 Vault workspace context | `dsh-awiki` |
 | `DSH_AWIKI_VAULT_DEVICE_ID` | 稳定、非秘密的 Vault device context | `local-device` |
 | `DSH_AWIKI_POLL_INTERVAL_MS` | 弹窗打开时的轮询间隔 | `5000` |
 | `DSH_AWIKI_ATTACHMENT_MAX_BYTES` | 解码后的附件上限 | `10485760` |
+| `DSH_AWIKI_MAIL_ATTACHMENT_MAX_COUNT` | 单封邮件附件数量上限，不得高于服务端 | `10` |
+| `DSH_AWIKI_MAIL_ATTACHMENT_MAX_BYTES` | 单个邮件附件解码字节上限 | `10485760` |
+| `DSH_AWIKI_MAIL_ATTACHMENT_TOTAL_MAX_BYTES` | 单封邮件附件解码总字节上限 | `18874368` |
 | `DSH_AWIKI_IMAGE_CACHE_MAX_BYTES` | 私有图片预览缓存的磁盘预算 | `67108864` |
-| `DSH_AWIKI_REALTIME_ENABLED` | 开启身份级 Direct/Group/System Notification WSS | `true` |
 | `DSH_AWIKI_LISTENER_ENABLED` | 开启私聊到 Agent 的 listener | `false` |
 | `DSH_AWIKI_LISTENER_ALLOWED_PEERS` | exact Handle/DID JSON 数组；开启时必填 | `[]` |
 | `DSH_AWIKI_LISTENER_WORKSPACE_PATH` | 所有 AWiki Session 共用的绝对 Workspace 路径 | `$DSH_HOME/workspaces/awiki` 或 `~/.dsh/workspaces/awiki` |
 | `DSH_AWIKI_SUMMARY_MAX_INPUT_BYTES` | Host 最小化后的 UTF-8 输入上限 | `32768` |
 | `DSH_AWIKI_SUMMARY_TIMEOUT_MS` | 单次模型调用超时 | `30000` |
 | `DSH_AWIKI_SUMMARY_MAX_OUTPUT_TOKENS` | 结构化摘要输出上限 | `768` |
+
+默认状态目录按 DSH profile 隔离：Desktop 以 Host 公开的 `desktopProfiles.current.name`
+为准，普通 `dsh --profile` 仅在 Loader 根目录严格匹配 `$DSH_HOME/profiles/<name>`
+时采用该名称。插件不会从 argv、端口或进程类型猜测 profile，也不会自动复制旧数据库；
+旧的共享 `awiki/im-core` 仍保留在原处。若检测到旧目录，身份入口会说明隔离原因并引导
+用户通过原 Handle 和手机号恢复，把目标 profile 作为独立设备接入。
+
 ## AWiki 托管模型账户
 
 该能力现在需要单独安装 `@awiki/dsh-model-proxy`。它通过
@@ -156,9 +164,11 @@ Summary Provider；浏览器客户端由 DSH 根据包元数据自动发现并
 关闭支付平台订单，再恢复金额输入框，并且不会自动创建替代订单。关闭失败时原支付入口继续
 有效；若支付在关闭竞态中先完成，界面会刷新已入账账户，而不会误报订单已取消。
 
-Handle 提供方的默认域名为 `awiki.ai`。本机用户可以在“设置 → AWiki”中覆盖该值；
-DSH 会把选择写入自己的设置文件，并在下次重启 Harness 后生效。该设置影响后续
-身份注册和短 Handle 的域名补全，不会改写已经注册的 DID 或 Handle。
+AWiki 的默认租户域名为 `awiki.ai`。本机用户可以在“设置 → AWiki”中切换租户；
+DSH 会把选择写入自己的设置文件，并在下次重启 Harness 后生效。未显式配置独立服务
+端点时，User、Message、Mail、附件公开来源和消息服务 DID 都由所选域名派生。
+每个域名使用相互隔离的本地身份、消息、缓存目录和浏览器身份恢复任务；切回原域名会恢复
+原有本地状态，不会把一个租户的 DID、私钥、邮箱账号或恢复进度带到另一个租户。
 
 设置页通过插件自有的 Connection 通道访问 Host，Host 只接受 loopback 来源。
 因此独立安装的 `@awiki/dsh-plugin` 无需修改 DSH 核心设置白名单；非本机浏览器来源不能
@@ -181,14 +191,12 @@ Provider 域名和消息服务 DID 都是协议标识，不能根据 API host
 Node facade 独占 `stateRoot/vault/root-key.b64u`；Host 不提供、不复制也不记录 Vault key
 material。普通重启与升级期间应完整保留 SDK state root。
 
-身份级 realtime supervisor 默认开启，独占部署身份的一条 Core WebSocket，不依赖 Workspace 或
-Agent 配置。Direct、Group 和 System Notification 事件只调度 canonical reliable sync；WSS 本身
-不推进 checkpoint，也不授权设备。显式设置 `DSH_AWIKI_REALTIME_ENABLED=false` 可回退到 HTTP
-refresh。私聊 Agent consumer 仍只有在 `DSH_AWIKI_LISTENER_ENABLED=true` 且 exact allowlist
-非空时才启用；它只读取合格同步原因之后的已提交 Direct 文本，不能启动或停止 WSS。每个私聊的
-DSH Session route 和消息 watermark 按身份隔离持久化，重启后可续接；所有 AWiki 来源 Session 都
-创建并 attach 到已注册的共享 AWiki Workspace。Listener 消息始终是不可信用户数据，不会自动批准
-工具，也不会桥接 approval 或 user-question prompt。
+Listener 只有在 `DSH_AWIKI_LISTENER_ENABLED=true` 且 exact allowlist 非空时才启用。启动和每个
+Core realtime 调度信号都会先执行 canonical reliable sync，再读取已提交 history。WebSocket
+连接与重连由 Core 所有；stream 关闭固定按“停止旧 session、reconnect sync、启动 replacement”
+恢复。每个私聊持久化一个当前 DSH Session route 和消息 watermark，重启后可续接；所有 AWiki
+来源 Session 都创建并 attach 到已注册的共享 AWiki Workspace。Listener 消息始终是不可信用户
+数据，不会自动批准工具，也不会桥接 approval 或 user-question prompt。
 
 默认附件上限为解码后 10 MiB；反向代理请求体上限至少应为 14 MiB，以容纳
 base64 与 JSON 封装开销。
@@ -239,7 +247,7 @@ pnpm run verify:workspace
 pnpm pack --dry-run
 ```
 
-生产 Host 加载固定版本 `@awiki/im-core-node@0.2.0`；平台原生 addon 由它的
+生产 Host 加载固定版本 `@awiki/im-core-node@0.1.9`；平台原生 addon 由它的
 optional dependencies 选择，并保持在 JavaScript bundle 外。使用者无需安装 Rust，
 也无需检出 `awiki-cli-rs2`。来源与许可证见 `THIRD_PARTY_NOTICES.md`。
 

package/cordis.patch.yml

@@ -2,38 +2,24 @@
 # @deepseek-ai/dsh-base and @deepseek-ai/dsh-web-app.
 
 - insert:
-    - id: anp-identity
-      name: '@agent-network-protocol/dsh-anp-identity'
-      config:
-        stateRoot: !!js process.env.DSH_ANP_IDENTITY_STATE_ROOT
-        allowConsumers: ['@awiki/dsh-plugin']
-        allowProviderConsumers: ['@awiki/dsh-plugin']
-        recoveryOnOpen: true
-
-    - id: anp-identity-provider
-      name: '@agent-network-protocol/dsh-anp-identity/provider'
-      config:
-        stateRoot: !!js process.env.DSH_ANP_IDENTITY_STATE_ROOT
-        rootKeyProvider: !!js process.env.DSH_ANP_IDENTITY_ROOT_KEY_PROVIDER ?? 'keyring'
-        rootKeyProviderId: !!js process.env.DSH_ANP_IDENTITY_ROOT_KEY_PROVIDER_ID ?? 'anp-identity/dsh'
-        keyringFallbackToLocalFile: false
-
     - id: awiki
       name: '@awiki/dsh-plugin'
       config:
-        userServiceUrl: !!js process.env.DSH_AWIKI_USER_SERVICE_URL ?? 'https://awiki.ai'
+        userServiceUrl: !!js process.env.DSH_AWIKI_USER_SERVICE_URL
         userServiceDomain: !!js process.env.DSH_AWIKI_USER_SERVICE_DOMAIN ?? 'awiki.ai'
-        messageServiceUrl: !!js process.env.DSH_AWIKI_MESSAGE_SERVICE_URL ?? 'https://awiki.ai'
+        messageServiceUrl: !!js process.env.DSH_AWIKI_MESSAGE_SERVICE_URL
         mailServiceUrl: !!js process.env.DSH_AWIKI_MAIL_SERVICE_URL
-        messageServiceDid: !!js process.env.DSH_AWIKI_MESSAGE_SERVICE_DID ?? 'did:wba:awiki.ai'
-        messageServicePublicUrl: !!js process.env.DSH_AWIKI_MESSAGE_SERVICE_PUBLIC_URL ?? 'https://awiki.ai'
+        messageServiceDid: !!js process.env.DSH_AWIKI_MESSAGE_SERVICE_DID
+        messageServicePublicUrl: !!js process.env.DSH_AWIKI_MESSAGE_SERVICE_PUBLIC_URL
         allowedAttachmentOrigins: !!js JSON.parse(process.env.DSH_AWIKI_ALLOWED_ATTACHMENT_ORIGINS ?? '[]')
         stateRoot: !!js process.env.DSH_AWIKI_STATE_ROOT
         pollIntervalMs: !!js Number(process.env.DSH_AWIKI_POLL_INTERVAL_MS ?? '5000')
         attachmentMaxBytes: !!js Number(process.env.DSH_AWIKI_ATTACHMENT_MAX_BYTES ?? '10485760')
+        mailAttachmentMaxCount: !!js Number(process.env.DSH_AWIKI_MAIL_ATTACHMENT_MAX_COUNT ?? '10')
+        mailAttachmentMaxBytes: !!js Number(process.env.DSH_AWIKI_MAIL_ATTACHMENT_MAX_BYTES ?? '10485760')
+        mailAttachmentTotalMaxBytes: !!js Number(process.env.DSH_AWIKI_MAIL_ATTACHMENT_TOTAL_MAX_BYTES ?? '18874368')
         imageAttachmentCacheMaxBytes: !!js Number(process.env.DSH_AWIKI_IMAGE_CACHE_MAX_BYTES ?? '67108864')
         summaryMaxInputBytes: !!js Number(process.env.DSH_AWIKI_SUMMARY_MAX_INPUT_BYTES ?? '32768')
-        realtimeEnabled: !!js JSON.parse(process.env.DSH_AWIKI_REALTIME_ENABLED || 'true')
         listenerEnabled: !!js process.env.DSH_AWIKI_LISTENER_ENABLED === 'true'
         listenerAllowedPeers: !!js JSON.parse(process.env.DSH_AWIKI_LISTENER_ALLOWED_PEERS ?? '[]')
         listenerWorkspacePath: !!js process.env.DSH_AWIKI_LISTENER_WORKSPACE_PATH