@awiki/dsh-plugin 0.3.7-dsh-test.20260831.2 → 0.3.10

package/README.md

@@ -23,15 +23,17 @@ tools, or model APIs.
 
 - Enter a Handle and phone through one Web UI flow and always request a registration OTP. A new Handle creates the deployment identity; an existing Handle offers ordinary Device Join first, with Recovery V4 as an explicit destructive alternative that requests a second purpose-scoped OTP.
 - DSH can join an existing Handle as an independent member device. When DSH created or recovered the Handle and is the current ready-admin, the foreground Devices tab can list devices, verify an incoming request with SAS, approve one member, reject it, or revoke another device. These mutations are not Agent tools and require explicit `APPROVE` / `REVOKE` confirmation.
+- A local Darwin x64 ready-admin can prepare Root Transfer for one exact active member and use native system authentication before sending management capability. Authorization handles and Root material remain Host/Core-only; unsupported or headless Hosts fail closed. A recovered old device uses the same native-authentication seam to re-Join only as a member.
 - Open the top-left AWiki account menu to sign out locally without deleting the encrypted identity or message database; **Resume local identity** restores the same DID and Handle, including across DSH restarts. The signed-out screen reveals phone recovery only after local resume fails. Switching identities requires an explicit confirmation that permanently clears local AWiki data first.
 - Reuse that identity across the root Agent and its subagents.
 - Direct-message and existing-group conversation lists, unread counts, latest-message previews, and persisted display names. Core SQLite remains the persistent source of truth: the Host joins persisted peer profiles onto Direct roster rows, while the browser keeps the active identity's last trustworthy Direct profile and group title. Sparse polling identifiers therefore cannot overwrite a resolved display name or real group title. After an existing Handle is recovered, the Host synchronizes account projections before asking Core to restore old group memberships; pending or blocked groups expose a retryable status without disabling Direct messages or other groups. Opening a conversation renders the committed local timeline first, hydrates group sender labels from the Core display-profile cache, reconciles remote history and Direct profile data in the background, and keeps local messages visible if refresh fails. A failed background roster poll also leaves the usable local view quiet; explicit loads still surface their errors. This local-first path covers the newest projected page; loading older messages still requires the remote history service. Scrolling up reveals a latest-message control that counts newer arrivals without interrupting reading. A conversation is marked read only after its newest rendered message reaches the visible bottom.
 - Create a private-discovery, open-join, transport-protected group from the Web UI with a name and 1–50 initial Handle or DID members. The group opens immediately; members that could not be added are reported without hiding the successfully created group.
-- Text messages plus one attachment per message, with Enter-to-send, Shift+Enter line breaks, optimistic sending bubbles reconciled by an exact client message ID, image previews, and SHA verification. Verified image bytes use three bounded layers: a browser-runtime LRU makes conversation remounts immediate, identity-scoped IndexedDB survives full page reloads without a Host call, and the private Host disk cache survives browser-storage loss and Harness restarts. Clear Local Data removes all three layers.
+- Text messages plus one attachment per message, with Enter-to-send, Shift+Enter line breaks, optimistic sending bubbles reconciled by an exact client message ID, image previews, and SHA verification. Verified image bytes use three bounded layers: a browser-runtime LRU makes conversation remounts immediate, identity-scoped IndexedDB survives full page reloads without a Host call, and the private Host disk cache survives browser-storage loss and Harness restarts. Clear Local Data removes all three layers and selectively removes every AWiki Mail list/folder localStorage projection while preserving unrelated origin storage.
 - A draggable circular launcher that defaults to the lower-left sidebar area, adaptive popup placement, dark mode, and remembered active conversation.
 - User-triggered AI summaries for up to 50 recent or unread messages, kept only in runtime memory with explicit stale, retry, copy, and source-navigation states.
 - OTP identity access keeps the verification form visible and disables resend with a visible server-directed cooldown countdown. Handle classification happens before OTP delivery, so each attempt sends exactly one purpose-correct registration or recovery code.
-- After Recovery V4 reaches `applied`, the Host resolves the recovered Handle's original mailbox under the current DID. If the separate Model Proxy package is installed, the Host also obtains one short-lived, audience-bound recovery attestation and reconciles the current DID to the original billing account without copying or adding balances. A temporary failure keeps only the non-secret recovery operation ID and retries the same idempotent reconciliation after restart; the attestation and ledger identity never enter Browser state, Agent tools, logs, or model context.
+- When the user continues into the recovered identity after Recovery V4 reaches `applied`, the Host resolves the recovered Handle's original mailbox under the current DID. Inbox and sent views remount for that identity; sent history is read from the Mail Service with `mail.list(direction=outbound)`, never from the removed Host-local sent store. The optional Model Proxy package independently authenticates that current DID and sends only strict `{}` to the Model endpoint; it never requests or carries a User Service recovery credential, DID path, proof, assurance, or ledger owner. It consumes only the actual outcome-only Model response (`restored`, `already_current`, or `not_applicable`); transition assurance remains a Model server-side operation/audit/DB oracle and is not inferred by DSH.
+- Recovery E2E receipt collection uses a run-ID-first `0600` file handshake with separately operated Model/Mail producers; DSH verifies producer, target, source candidate, measurement window, receipt path, and shared operation fingerprints but never launches those external producers. The current Mail send API is text-only, so outbound attachment-preservation evidence remains blocked until DSH/Core expose an independently reviewed attachment-send seam.
 - When the separate `@awiki/dsh-model-proxy` package is installed, an AWiki-hosted DeepSeek choice appears before the official API-key onboarding step only when Harness has no usable model provider, with an explicit opt-in and an unchanged API-key escape path. New sessions do not show AWiki model or payment prompts after the official or another provider is usable.
 - The optional model-proxy package owns the Host short-token flow and every model-hosting Browser surface: onboarding plus Settings → Quick Recharge with Account & Recharge and Usage tabs. It registers `awiki-deepseek` with `deepseek-v4-flash` and `deepseek-v4-pro`; Flash is recommended and credentials never enter the Browser.
 - AWiki identity, domain, and local-data settings remain in the main package. Installing only the main package does not register model opt-in, recharge, usage, or model onboarding UI.
@@ -55,8 +57,12 @@ post-creation group administration or multiple attachments in one message. The A
 plain Direct text; Groups, attachments, encrypted/payload content, and unknown slash commands never
 reach the Agent.
 
-Mail v1 is on demand only and has no browser mailbox or compose UI. It does not wake an Agent for
-new mail, render or send HTML, transfer mail attachments, or implement reply, forward, and
+Mail v1 provides an on-demand browser mailbox/compose UI and five on-demand Agent tools. Inbox uses
+the existing Core inbound query; sent uses a fixed Host-only, current-identity-authenticated
+`mail.list(direction=outbound)` query. The identity-scoped browser cache may keep the last visible
+page during an explicit refresh error, but it is never sent-history authority. A successful send is
+attempted once and triggers one server-backed sent refresh in the browser. Mail does not wake an Agent
+for new mail, render or send HTML, transfer mail attachments, or implement reply, forward, and
 threading. Mail subject, addresses, preview, body, timestamps, and attachment metadata are
 untrusted external data, never Agent instructions. `awiki_mail_mark_read` and `awiki_mail_send`
 require execution approval. Mail send is attempted once without automatic retry; a timeout or
@@ -67,6 +73,8 @@ reconstruct historical Direct conversations; only ordinary data already retained
 continues to follow Core's existing local migration rules. Mailbox and hosted-model reconciliation
 are independent of that private-chat boundary.
 
+Version checks, manual upgrade commands, and tenant isolation are documented in [Updates](docs/updates.md).
+
 ## Install
 
 Install the independent identity plugin first, then AWiki:
@@ -107,16 +115,27 @@ an explicit dependency on the loaded `awiki` service.
 
 Full keys, sources, purposes, and defaults: [docs/configuration.md](docs/configuration.md).
 
-The plugin works against the public `awiki.ai` tenant without environment configuration. Set these variables only when a deployment needs an override:
+Fresh installations contain exactly the package's two built-in tenant slots and start on its configured
+default slot. The repository default is AWiki China followed by AWiki Global. Existing official state is
+promoted in place when its endpoint still matches, without moving its identity, messages, attachments,
+Vault, or state directory. A non-empty state root created before the tenant registry keeps the immutable
+`awiki.info` endpoint snapshot shipped by that release line. Operators who have positive deployment
+evidence that the old root belongs to a current official slot may classify it once with
+`DSH_AWIKI_LEGACY_TENANT_SLOT`. Settings → AWiki → Tenant switches the Host-owned
+runtime transactionally; the two official tenants are immutable, while custom tenants use independent
+storage scopes. Build with `pnpm run build -- --tenant-config /absolute/path/tenants.json` to replace the
+complete two-slot catalog; partial merging and hidden official fallbacks are not supported. Set deployment
+variables only for legacy private/development migration inputs:
 
 | Variable | Purpose | Default |
 | --- | --- | --- |
-| `DSH_AWIKI_USER_SERVICE_URL` | Absolute AWiki user-service URL | `https://awiki.ai` |
-| `DSH_AWIKI_USER_SERVICE_DOMAIN` | Composition default for the Handle provider domain | `awiki.ai` |
-| `DSH_AWIKI_MESSAGE_SERVICE_URL` | Message-service URL called by the Host | `https://awiki.ai` |
+| `DSH_AWIKI_USER_SERVICE_URL` | Legacy absolute AWiki user-service URL | Package default tenant Origin |
+| `DSH_AWIKI_USER_SERVICE_DOMAIN` | Legacy Handle provider domain | Package default tenant DID host |
+| `DSH_AWIKI_LEGACY_TENANT_SLOT` | Evidence-based one-time official-slot override for pre-registry state | Unset; preserve the historical `awiki.info` snapshot |
+| `DSH_AWIKI_MESSAGE_SERVICE_URL` | Legacy Message-service URL | Package default tenant Origin |
 | `DSH_AWIKI_MAIL_SERVICE_URL` | Mail-service URL called by the Host | Resolved user-service URL |
-| `DSH_AWIKI_MESSAGE_SERVICE_DID` | Authoritative message-service DID | `did:wba:awiki.ai` |
-| `DSH_AWIKI_MESSAGE_SERVICE_PUBLIC_URL` | Public endpoint written to protocol records | `https://awiki.ai` |
+| `DSH_AWIKI_MESSAGE_SERVICE_DID` | Legacy authoritative message-service DID | Package default tenant DID |
+| `DSH_AWIKI_MESSAGE_SERVICE_PUBLIC_URL` | Legacy public protocol endpoint | Package default tenant Origin |
 | `DSH_AWIKI_ALLOWED_ATTACHMENT_ORIGINS` | JSON array of extra exact HTTPS origins | `[]` |
 | `DSH_AWIKI_STATE_ROOT` | Private Rust IM Core state directory | `$DSH_HOME/awiki/im-core` or `~/.dsh/awiki/im-core` |
 | `DSH_ANP_IDENTITY_STATE_ROOT` | Independent multi-DID ANP Identity Store | `$DSH_HOME/anp-identity` |
@@ -149,22 +168,22 @@ The former runtime import `@awiki/dsh-plugin/model-proxy` has been removed. Use
 model onboarding, account/recharge, and usage entry points hidden while leaving
 AWiki Advanced settings functional.
 
-The stable split-package line uses `@awiki/dsh-plugin@0.3.0`; the standalone
-`@awiki/dsh-model-proxy@0.1.0` package requires main `^0.3.0`. This lower
-bound is the first main package that provides the shared `awikiClient` Browser
-bridge, and it also prevents combining the standalone package with a `0.2.x`
-main package that still inserted the old runtime by default.
+The split-package line was introduced by `@awiki/dsh-plugin@0.3.0` and
+`@awiki/dsh-model-proxy@0.1.0`. The current candidate manifests are `0.3.9`
+and `0.1.4`, and Model Proxy requires main `^0.3.9`. This keeps the shared
+`awikiClient` Browser bridge and tenant-capability contract on the same
+reviewed line.
 
 The optional package owns these configuration variables:
 
 | Variable | Purpose | Default |
 | --- | --- | --- |
-| `DSH_AWIKI_MODEL_PROXY_URL` | AWiki-hosted DeepSeek proxy root URL | `https://model.awiki.info` |
 | `DSH_AWIKI_MODEL_CONTEXT_WINDOW` | AWiki-hosted DeepSeek context window | `1000000` |
 | `DSH_AWIKI_MODEL_MAX_TOKENS` | Maximum AWiki-hosted DeepSeek output | `8192` |
 | `DSH_AWIKI_MODEL_TOKEN_REFRESH_SKEW_SECONDS` | Early short-token refresh interval | `60` |
 
-AWiki-hosted DeepSeek is disabled by default. Only an explicit choice in onboarding or Settings → Quick Recharge →
+AWiki-hosted DeepSeek is disabled by default. Its opt-in and fallback selection are persisted per tenant.
+Only an explicit choice in onboarding or Settings → Quick Recharge →
 Account & Recharge registers the `awiki-deepseek` route and selects Flash. Disabling restores the
 previous provider, model, and reasoning effort. A successful recharge refreshes the balance but
 never enables AWiki or changes the selected model automatically.
@@ -188,11 +207,10 @@ closes the provider order, then restores the amount editor without creating a re
 failure leaves the existing payment action available, while a payment that wins the race refreshes
 the credited account instead of being reported as cancelled.
 
-The default Handle provider domain is `awiki.ai`. A local user can override it
-from Settings → AWiki; DSH persists that choice in its settings document and
-applies it after the next Harness restart. The setting affects future identity
-registration and completion of short Handles. It does not rewrite an already
-registered DID or Handle.
+Settings → AWiki is split into Tenant, Devices, Local data, and Guest integration. Tenant changes are available
+before registration, while recovering, while signed out, and while signed in. A successful switch opens
+the target scope before committing the active tenant; a failure reconstructs the previous runtime. The
+legacy `awiki.domain` setting is migration input only and continues to reference its existing state path.
 
 The settings page talks to a plugin-owned Connection channel that the Host
 accepts only from loopback. This keeps an independently installed `@awiki/dsh-plugin`
@@ -226,8 +244,10 @@ single Core WebSocket without depending on Workspace or Agent configuration. Dir
 System Notification events schedule canonical reliable sync; WSS never advances a checkpoint or
 authorizes a device by itself. `DSH_AWIKI_REALTIME_ENABLED=false` explicitly falls back to HTTP
 refresh. Diagnostics report the single-session lifecycle with start/stop balance, peak active
-count, retry generation, and only closed sync failure codes; a healthy reconnect may have multiple
-lifetime starts while still owning exactly one active session. Exact-device Node builds without an
+count, retry generation, only closed sync failure codes, and the last successful sync's page count,
+hydrated-message count, and `olderHistoryExcluded` flag. They never expose a cursor, page ref, token,
+manifest, or message body. A healthy reconnect may have multiple lifetime starts while still owning
+exactly one active session. Exact-device Node builds without an
 active P6 lane use the existing `awiki.sync.event.v3` WebSocket subprotocol, while P6
 delivery-context is requested only after that lane was explicitly negotiated. The optional Direct-to-Agent consumer still requires both
 `DSH_AWIKI_LISTENER_ENABLED=true` and a non-empty exact allowlist. It reads only committed Direct
@@ -289,17 +309,37 @@ Requirements: Node.js 22.19+ (or 24+) and pnpm 11.22.
 ```bash
 pnpm install --frozen-lockfile
 pnpm run verify:workspace
+pnpm run e2e:smoke
+DSH_AWIKI_E2E_CONFIG=/absolute/path/to/rwiki-cn-testing.json pnpm run e2e:live
+DSH_AWIKI_E2E_CONFIG=/absolute/path/to/awiki-info-testing.json pnpm run e2e:live -- --headed --grep RECOVERY
 pnpm pack --dry-run
 ```
 
-The production Host loads the exact `@awiki/im-core-node@0.2.1` runtime package;
+`e2e:smoke` uses Playwright Chromium to install the current tarball into an
+isolated real DSH Web profile, complete the stock Harness first-run dialogs,
+and open the AWiki identity entry without sending an OTP. The optional
+`e2e:smoke:webkit` command provides the same no-write compatibility check.
+The protected general `e2e:live` lane provisions one DSH identity plus one real
+CLI peer on `rwiki-cn-testing`, verifies bidirectional Direct and Group plus a
+same-root Harness restart, scans artifacts for secrets, and requires exact
+managed cleanup with zero residual. The separate Recovery command above is
+restricted to headed macOS, exact `awiki-info-testing`, and Ali-local cleanup
+profile `awiki-info-managed-local-v1`. See the
+[Web E2E technical design](docs/e2e-automation-testing-cli-peer.md).
+
+`pnpm run verify` validates the frozen sibling ANP Identity and IM Core source
+refs, then rebuilds their native fixtures and the IM Core Node TypeScript dist
+from source. Unit results therefore do not depend on stale ignored `.node` or
+`dist/` files left by an earlier worktree.
+
+The production Host loads the exact `@awiki/im-core-node@0.2.3` runtime package;
 the platform-specific native addon is selected through its optional dependencies
 and remains external to the JavaScript bundle. Consumers do not need Rust or an
 `awiki-cli-rs2` checkout. See `THIRD_PARTY_NOTICES.md` for provenance and
 licensing.
 
 The checked-in Typert Host/Remote artifacts were generated from the same Host
-contract. `pnpm check:generated` pins their complete eighteen-method surface until
+contract. `pnpm check:generated` pins their complete 58-method surface until
 the standalone Typert generator supports root-level packages.
 
 ## Security

package/README.zh.md

@@ -11,17 +11,18 @@ Host-only Provider lease 不会进入 Browser、Remote、Agent tools 或模型 A
 
 ## 功能
 
-- 在 Web UI 的统一入口输入 Handle 和手机号，并始终先发送注册验证码。新 Handle 创建部署级身份；已有 Handle 优先进入普通 Device Join，Recovery V4 仅作为显式危险替代项，并重新发送用途隔离的恢复验证码；根 Agent 与子 Agent 共用最终身份。
+- 在 Web UI 的统一入口输入 Handle 和手机号，先查找该 Handle 的未完成恢复；命中则继续原操作，否则发送注册验证码。新 Handle 创建部署级身份；已有 Handle 优先进入普通 Device Join，Recovery V4 仅作为显式危险替代项，并重新发送用途隔离的恢复验证码；根 Agent 与子 Agent 共用最终身份。
 - DSH 可以作为独立 member 设备加入已有 Handle；当 DSH 创建或恢复 Handle、当前设备为 ready-admin 时，前台“设备”页可列出设备、通过 SAS 验证并批准 member、拒绝请求或撤销其他设备。管理动作不进入 Agent 工具，并要求显式输入 `APPROVE` / `REVOKE`。
+- 本机 Darwin x64 ready-admin 可在“设备”页准备 Root Transfer，并经系统级用户认证把管理能力发送给一个精确的 active member；authorization handle 和 Root material 不进入 Browser。Linux、远程无头或系统认证不可用时失败关闭。Recovery 后旧设备 re-Join 复用同一认证端口，但仍只恢复为 member。
 - 点击 AWiki 面板左上角图标可打开账户菜单；普通退出只锁定本机会话，不删除加密身份或消息数据库，重新进入及重启 DSH 后仍恢复同一个 DID 和 Handle。退出页默认只提供重新进入本机身份和使用其他身份；只有本机重新进入失败后才显示手机号恢复入口。改用其他身份必须先确认永久清除本地 AWiki 数据。
 - 身份入口失败时保留当前挂载表单中的手机号、Handle 和验证码，以便修正后重试；手机号和验证码不进入 Browser 持久化状态、controller snapshot 或公开 Remote 结果。仅恢复操作编号可用于崩溃续跑。注册未开放、验证码状态失效和提交冲突会给出对应的安全处理提示。
 - 私聊和已有群聊列表、未读角标、最新消息预览、时间更新与昵称持久化。Core SQLite 是持久化真相源：Host 将持久化的对端资料合并进私聊列表，浏览器再按当前身份保留最后一次可信的私聊资料和群名，稀疏轮询中的 Handle、DID 或 Group DID 占位不会覆盖真实名称。恢复已有 Handle 后，Host 会先同步账号投影，再让 Core 自动恢复旧群聊成员身份；未完成或受阻的群聊会显示可重试状态，但不影响私聊和其他群聊。打开会话时先显示 Core 已提交的本地时间线，并从 Core 显示资料缓存补齐群消息发送者名称，再在后台补齐远端历史和私聊资料；刷新失败不会清空本地消息。后台会话轮询失败也不会用全局红条打断仍可用的本地页面，用户主动加载失败仍会正常提示。当前 local-first 只覆盖本地最新一页，“加载更早消息”仍需访问远端 history。向上阅读时显示下滑箭头，新消息到达后在同一控件中累计数量且不打断阅读位置。只有最新一条已渲染消息到达可视区域底部后，当前会话才会自动标记为已读。
 - 可从 Web UI 输入群名和 1–50 个 Handle 或 DID 发起私有发现、开放加入、传输保护的群聊。建群成功后立即进入新会话；个别成员添加失败会单独提示，不会隐藏已经创建的群。
-- 文本和单附件消息；Enter 发送、Shift+Enter 换行，发送中立即显示带 loading 动画的乐观气泡，并通过精确的客户端消息 ID 与已提交消息对账，避免同一条消息显示两个气泡；同时支持图片预览、附件说明与 SHA 校验。校验通过的图片字节使用三层有界缓存：浏览器运行期 LRU 让会话重新挂载时立即出图，按身份隔离的 IndexedDB 在整页刷新后无需访问 Host，Host 私有磁盘缓存则应对浏览器缓存丢失并跨 Harness 重启复用；“清除本地数据”会删除三层缓存。
+- 文本和单附件消息；Enter 发送、Shift+Enter 换行，发送中立即显示带 loading 动画的乐观气泡，并通过精确的客户端消息 ID 与已提交消息对账，避免同一条消息显示两个气泡；同时支持图片预览、附件说明与 SHA 校验。校验通过的图片字节使用三层有界缓存：浏览器运行期 LRU 让会话重新挂载时立即出图，按身份隔离的 IndexedDB 在整页刷新后无需访问 Host，Host 私有磁盘缓存则应对浏览器缓存丢失并跨 Harness 重启复用；“清除本地数据”会删除三层缓存，并精确删除全部 AWiki Mail list/folder localStorage 投影而保留无关 origin storage。
 - 圆形可拖动入口、自适应四角弹窗、深色模式和当前会话记忆。
 - 用户点击后才生成的 AI 对话总结：最多处理 50 条最近或未读消息，按会话保留本次运行期缓存，并支持过期提示、重试、复制与跳转原消息。
 - OTP 身份入口会保留验证码输入表单，并按服务端返回的冷却时间显示重发倒计时、禁用提前重发；已有 Handle 在消费 registration OTP 后再选择 Join 或 Recovery，Recovery 不复用 registration grant。
-- Recovery V4 进入 `applied` 后，Host 会用 current DID 解析已恢复 Handle 的原邮箱；如同时安装独立 Model Proxy 包，还会获取一份短时、固定受众的恢复凭证，把 current DID 对账到原模型账本，不复制余额、不做金额相加。临时失败只保留非敏感 operation id，并在重启后对同一幂等操作自动重试；恢复凭证和账本标识不会进入 Browser 状态、Agent 工具、日志或模型上下文。
+- Recovery V4 进入 `applied` 且用户继续进入恢复后的身份时，Host 会用 current DID 解析已恢复 Handle 的原邮箱，并为该身份重新挂载收件箱与发件箱；发件历史固定来自 Mail Service 的 `mail.list(direction=outbound)`，不再读取已删除的 Host 本地 sent store。可选 Model Proxy 包会独立使用 current DID 认证，并且只向现有 Model endpoint 发送严格 `{}`。它不请求或携带 User Service 恢复凭证、DID path、proof、assurance 或账本 owner，只消费 Model 实际的 outcome-only 响应（`restored`、`already_current` 或 `not_applicable`）；transition assurance 由 Model 服务端 operation/audit/DB oracle 验证，DSH 不从公开响应推断。
 - 安装独立的 `@awiki/dsh-model-proxy` 后，仅在 Harness 没有任何可用模型时，首次引导才会在官方 API Key 步骤前提供 AWiki 托管模型选项；用户可以明确启用，也可以跳过并继续原版 API Key 流程。已经配置官方或其他 Provider 时，新会话不会显示 AWiki 模型或支付提示。
 - 可选 Model Proxy 包独占 Host 内部短期 Token 和全部模型托管界面：首次引导，以及“设置 → 快速充值”中的“账户与充值”“用量明细”。它提供 `deepseek-v4-flash` 和 `deepseek-v4-pro`，默认推荐 Flash；Token 不进入 Browser。
 - AWiki 主包只保留身份、域名和本地数据设置。只安装主包时，不会注册模型启停、充值、用量或模型首次引导界面。
@@ -43,14 +44,19 @@ Host-only Provider lease 不会进入 Browser、Remote、Agent tools 或模型 A
 首版不包含端到端加密、多身份、建群后的成员或群设置管理和单消息多附件。Agent listener 只接受明文私聊文本；
 群聊、附件、加密/payload 内容和未知斜杠命令都不会进入 Agent。
 
-邮件 v1 仅支持按需调用，不提供浏览器收件箱或写信 UI，也不会以新邮件唤醒 Agent；不渲染或
-发送 HTML，不传输邮件附件，也不支持回复、转发和会话串联。邮件主题、地址、预览、正文、
+邮件 v1 提供按需浏览器邮箱/写信界面和五个按需 Agent 工具。收件箱沿用 Core inbound 查询；
+发件箱通过固定、仅 Host 可用且绑定 current identity 的 `mail.list(direction=outbound)` 查询。
+身份隔离的浏览器 cache 可以在显式刷新失败时保留最近可见页面，但绝不是发件历史权威；发送
+成功后浏览器只触发一次服务端发件箱刷新。邮件不会以新邮件唤醒 Agent；不渲染或发送 HTML，
+不传输邮件附件，也不支持回复、转发和会话串联。邮件主题、地址、预览、正文、
 时间戳和附件元数据都是不可信外部数据，不能作为 Agent 指令。`awiki_mail_mark_read` 和
 `awiki_mail_send` 每次执行都需要审批。邮件发送只尝试一次且不自动重试；超时或传输中断返回
 `delivery-unknown`，再次审批发送前应先检查邮箱。
 
 身份恢复不新增服务端私聊恢复。清空本地状态后不会重新构造历史私聊会话；只有 Rust SDK
-已经保留的普通本地数据继续遵循 Core 既有迁移规则。邮箱和托管模型账本对账与私聊边界相互独立。
+已经保留的普通本地数据继续遵循 Core 既有迁移规则。邮箱恢复与私聊边界相互独立。
+
+版本查询、手动升级命令及租户隔离规则见[版本与更新](docs/updates.md)。
 
 ## 安装
 
@@ -86,16 +92,24 @@ AWiki IM Core Provider 和 Summary Provider。浏览器客户端由 DSH 根据
 
 完整标识符、来源、作用与默认值见 [docs/configuration.md](docs/configuration.md)。
 
-插件无需环境变量即可连接公开的 `awiki.ai` 租户；仅在部署需要覆盖默认值时设置以下变量：
+全新安装只包含打包配置指定的两个内置租户槽位，并进入配置的默认槽位；仓库默认值是
+AWiki 中国与 AWiki 全球。已有官方端点仍匹配时会原地提升并继续保持激活，身份、消息、附件、
+Vault 与状态目录均不搬迁。租户注册表出现前已存在的非空状态根继续使用当时发布过的
+`awiki.info` 端点快照；只有运维掌握其属于当前官方槽位的明确证据时，才通过
+`DSH_AWIKI_LEGACY_TENANT_SLOT` 做一次性分类。
+“设置 → AWiki → 租户”由 Host 事务化切换运行时；两个官方租户不可修改，自定义租户使用独立
+存储 Scope。使用 `pnpm run build -- --tenant-config /绝对路径/tenants.json` 可完整替换两个
+槽位；不做局部合并，也没有隐藏的官方 fallback。以下变量只作为旧私有/开发部署的迁移输入：
 
 | 环境变量 | 用途 | 默认值 |
 | --- | --- | --- |
-| `DSH_AWIKI_USER_SERVICE_URL` | AWiki user service 绝对 URL | `https://awiki.ai` |
-| `DSH_AWIKI_USER_SERVICE_DOMAIN` | Handle 提供方域名的部署默认值 | `awiki.ai` |
-| `DSH_AWIKI_MESSAGE_SERVICE_URL` | Host 调用的 message service URL | `https://awiki.ai` |
+| `DSH_AWIKI_USER_SERVICE_URL` | 旧 AWiki user service 绝对 URL | 打包默认槽位 Origin |
+| `DSH_AWIKI_USER_SERVICE_DOMAIN` | 旧 Handle 提供方域名 | 打包默认槽位 DID host |
+| `DSH_AWIKI_LEGACY_TENANT_SLOT` | 有部署证据时对旧状态做一次性官方槽位覆盖 | 未配置；保留历史 `awiki.info` 快照 |
+| `DSH_AWIKI_MESSAGE_SERVICE_URL` | 旧 message service URL | 打包默认槽位 Origin |
 | `DSH_AWIKI_MAIL_SERVICE_URL` | Host 调用的 mail service URL | 解析后的 user service URL |
-| `DSH_AWIKI_MESSAGE_SERVICE_DID` | 权威消息服务 DID | `did:wba:awiki.ai` |
-| `DSH_AWIKI_MESSAGE_SERVICE_PUBLIC_URL` | 写入协议记录的公开 endpoint | `https://awiki.ai` |
+| `DSH_AWIKI_MESSAGE_SERVICE_DID` | 旧权威消息服务 DID | 打包默认槽位 DID |
+| `DSH_AWIKI_MESSAGE_SERVICE_PUBLIC_URL` | 旧协议公开 endpoint | 打包默认槽位 Origin |
 | `DSH_AWIKI_ALLOWED_ATTACHMENT_ORIGINS` | 额外附件 HTTPS origin 的 JSON 数组 | `[]` |
 | `DSH_AWIKI_STATE_ROOT` | 私有 Rust IM Core 状态目录 | `$DSH_HOME/awiki/im-core` 或 `~/.dsh/awiki/im-core` |
 | `DSH_ANP_IDENTITY_STATE_ROOT` | 独立的 ANP Identity 多 DID Store | `$DSH_HOME/anp-identity` |
@@ -126,21 +140,20 @@ AWiki IM Core Provider 和 Summary Provider。浏览器客户端由 DSH 根据
 `@awiki/dsh-plugin/model-proxy-contract`。只安装主包时，模型首次引导、账户/充值和
 用量入口保持隐藏，高级 AWiki 设置仍可正常使用。
 
-正式拆包版本为 `@awiki/dsh-plugin@0.3.0`；独立的
-`@awiki/dsh-model-proxy@0.1.0` 要求主包 `^0.3.0`。这是首个提供共享
-`awikiClient` Browser bridge 的主包版本，同时避免与仍会默认插入旧 runtime
-的 `0.2.x` 主包组合后加载两个 Model Proxy。
+拆包从 `@awiki/dsh-plugin@0.3.0` 与 `@awiki/dsh-model-proxy@0.1.0`
+开始。当前候选 manifest 分别为 `0.3.9` 和 `0.1.4`，Model Proxy 要求主包
+`^0.3.9`，从而让共享 `awikiClient` Browser bridge 与租户 capability 契约保持在同一条
+已审查版本线上。
 
 以下环境变量归可选包所有：
 
 | 环境变量 | 用途 | 默认值 |
 | --- | --- | --- |
-| `DSH_AWIKI_MODEL_PROXY_URL` | AWiki 托管的 DeepSeek 代理服务根 URL | `https://model.awiki.info` |
 | `DSH_AWIKI_MODEL_CONTEXT_WINDOW` | AWiki 托管模型上下文窗口 | `1000000` |
 | `DSH_AWIKI_MODEL_MAX_TOKENS` | AWiki 托管模型单次最大输出 | `8192` |
 | `DSH_AWIKI_MODEL_TOKEN_REFRESH_SKEW_SECONDS` | 短期 Token 提前刷新秒数 | `60` |
 
-插件默认关闭 AWiki 托管模型。用户在首次引导或“设置 → 快速充值 → 账户与充值”明确启用后，
+插件默认关闭 AWiki 托管模型，启用意愿与回退模型按租户分别持久化。用户在首次引导或“设置 → 快速充值 → 账户与充值”明确启用后，
 才注册 `awiki-deepseek` 路由并把 Flash 设为默认模型；停用时会恢复启用前的默认 Provider、
 模型和 reasoning effort。充值到账只刷新余额，不会自动启用 AWiki 或切换当前模型。
 
@@ -158,9 +171,9 @@ AWiki IM Core Provider 和 Summary Provider。浏览器客户端由 DSH 根据
 关闭支付平台订单，再恢复金额输入框，并且不会自动创建替代订单。关闭失败时原支付入口继续
 有效；若支付在关闭竞态中先完成，界面会刷新已入账账户，而不会误报订单已取消。
 
-Handle 提供方的默认域名为 `awiki.ai`。本机用户可以在“设置 → AWiki”中覆盖该值；
-DSH 会把选择写入自己的设置文件，并在下次重启 Harness 后生效。该设置影响后续
-身份注册和短 Handle 的域名补全，不会改写已经注册的 DID 或 Handle。
+“设置 → AWiki”分为“租户”“设备”“本地数据”“临时消息集成”四个页签。注册前、恢复中、退出后和
+登录后都可进入同一租户面板。切换成功前先打开目标 Scope；任一步失败都会重建旧运行时。
+旧 `awiki.domain` 设置仅作为迁移输入，并继续引用原有状态路径。
 
 设置页通过插件自有的 Connection 通道访问 Host，Host 只接受 loopback 来源。
 因此独立安装的 `@awiki/dsh-plugin` 无需修改 DSH 核心设置白名单；非本机浏览器来源不能
@@ -192,6 +205,10 @@ DSH Session route 和消息 watermark 按身份隔离持久化，重启后可续
 创建并 attach 到已注册的共享 AWiki Workspace。Listener 消息始终是不可信用户数据，不会自动批准
 工具，也不会桥接 approval 或 user-question prompt。
 
+Host-only realtime diagnostics 另外保留最近一次成功同步的分页数、hydrated 消息数和
+`olderHistoryExcluded`。它们只用于安全诊断；不会暴露 cursor、page ref、token、manifest、消息正文，
+也不会进入 Browser Remote、Agent 工具或模型上下文。
+
 默认附件上限为解码后 10 MiB；反向代理请求体上限至少应为 14 MiB，以容纳
 base64 与 JSON 封装开销。
 
@@ -233,20 +250,33 @@ redirect，由 Rust 自动选择当前 origin 的进程内 Bearer Token 或新 H
 
 ## 开发与验证
 
+依赖模式、个人配置及跨仓 PR 提交规则见 [Debug / registry / 源码联调](docs/dependency-modes.md)。
+默认使用 registry，显式本地联调用 `pnpm run build:local`，正式构建用 `pnpm run build:release`。
+首次切换需要按该文档确认依赖已发布并刷新 registry lock；旧 workspace 锁不能作为线上安装证据。
+
 需要 Node.js 22.19+（或 24+）以及 pnpm 11.22：
 
 ```bash
 pnpm install --frozen-lockfile
 pnpm run verify:workspace
+pnpm run e2e:smoke
+DSH_AWIKI_E2E_CONFIG=/absolute/path/to/rwiki-cn-testing.json pnpm run e2e:live
 pnpm pack --dry-run
 ```
 
-生产 Host 加载固定版本 `@awiki/im-core-node@0.2.1`；平台原生 addon 由它的
+`e2e:smoke` 使用 Playwright Chromium，把当前 tarball 安装到隔离的真实 DSH Web profile，
+通过 Harness 自带的首次运行对话框并打开 AWiki 身份入口；它不发送 OTP。受保护的 `e2e:live`
+在 `rwiki-cn-testing` 上创建一个 DSH 身份和一个真实 CLI Peer，验证双向私聊、群聊及同 root
+Harness 重启，并要求 artifact secret scan 与 exact managed cleanup 零残留。当前完成门禁以
+无桌面 Linux Chromium headless 为准；WebKit 只保留为后续可选兼容性检查。详见
+[Web E2E 技术方案](docs/e2e-automation-testing-cli-peer.md)。
+
+生产 Host 加载固定版本 `@awiki/im-core-node@0.2.3`；平台原生 addon 由它的
 optional dependencies 选择，并保持在 JavaScript bundle 外。使用者无需安装 Rust，
 也无需检出 `awiki-cli-rs2`。来源与许可证见 `THIRD_PARTY_NOTICES.md`。
 
 Typert Host/Remote 产物与当前 Host 契约一同提交；在独立 Typert 生成器支持根级
-包之前，`pnpm check:generated` 会固定检查完整的 18 个 Remote 方法。
+包之前，`pnpm check:generated` 会固定检查完整的 58 个 Remote 方法。
 
 ## 安全
 
@@ -257,3 +287,7 @@ Typert Host/Remote 产物与当前 Host 契约一同提交；在独立 Typert
 
 插件使用 MIT 许可证；Rust IM Core 运行时依赖使用 AGPL-3.0-only，并继续适用其
 自带的许可证与声明。
+
+### 群成员与发送人名称
+
+Host `getDisplayProfiles` 返回 Core 本地展示投影并调度后台刷新；Browser 沿用会话轮询更新成员与发送人，首帧无需等待公开资料网络请求。刷新按 DID 去重，Core 管理 TTL、失败重试和 owner 隔离，既不创建联系人也不创建 Direct 会话。成功的空昵称回退到 Handle/DID，网络失败保留已缓存名称；身份切换和会话切换后的旧结果不回写界面。该路径使用 Node native API v14，必须与本地 Core Node 包配套构建。

package/cordis.patch.yml

@@ -6,13 +6,15 @@
     - id: awiki
       name: '@awiki/dsh-plugin'
       config:
-        userServiceUrl: !!js process.env.DSH_AWIKI_USER_SERVICE_URL ?? 'https://awiki.ai'
-        userServiceDomain: !!js process.env.DSH_AWIKI_USER_SERVICE_DOMAIN ?? 'awiki.ai'
-        messageServiceUrl: !!js process.env.DSH_AWIKI_MESSAGE_SERVICE_URL ?? 'https://awiki.ai'
+        userServiceUrl: !!js process.env.DSH_AWIKI_USER_SERVICE_URL
+        userServiceDomain: !!js process.env.DSH_AWIKI_USER_SERVICE_DOMAIN
+        legacyTenantSlot: !!js process.env.DSH_AWIKI_LEGACY_TENANT_SLOT
+        messageServiceUrl: !!js process.env.DSH_AWIKI_MESSAGE_SERVICE_URL
         mailServiceUrl: !!js process.env.DSH_AWIKI_MAIL_SERVICE_URL
-        messageServiceDid: !!js process.env.DSH_AWIKI_MESSAGE_SERVICE_DID ?? 'did:wba:awiki.ai'
-        messageServicePublicUrl: !!js process.env.DSH_AWIKI_MESSAGE_SERVICE_PUBLIC_URL ?? 'https://awiki.ai'
+        messageServiceDid: !!js process.env.DSH_AWIKI_MESSAGE_SERVICE_DID
+        messageServicePublicUrl: !!js process.env.DSH_AWIKI_MESSAGE_SERVICE_PUBLIC_URL
         allowedAttachmentOrigins: !!js JSON.parse(process.env.DSH_AWIKI_ALLOWED_ATTACHMENT_ORIGINS ?? '[]')
+        allowInsecureLoopbackForTesting: !!js process.env.DSH_AWIKI_ALLOW_INSECURE_LOOPBACK_FOR_TESTING === 'true'
         stateRoot: !!js process.env.DSH_AWIKI_STATE_ROOT
         pollIntervalMs: !!js Number(process.env.DSH_AWIKI_POLL_INTERVAL_MS ?? '5000')
         attachmentMaxBytes: !!js Number(process.env.DSH_AWIKI_ATTACHMENT_MAX_BYTES ?? '10485760')

package/lib/builtin-tenants.json

@@ -0,0 +1,22 @@
+{
+  "schema_version": 1,
+  "default_slot": "primary",
+  "tenants": {
+    "primary": {
+      "display_name": {
+        "zh-CN": "AWiki 中国（上海）",
+        "en": "AWiki China (Shanghai)"
+      },
+      "backend_origin": "https://awiki.me",
+      "did_host": "awiki.me"
+    },
+    "secondary": {
+      "display_name": {
+        "zh-CN": "AWiki 全球（硅谷）",
+        "en": "AWiki Global (Silicon Valley)"
+      },
+      "backend_origin": "https://awiki.ai",
+      "did_host": "awiki.ai"
+    }
+  }
+}

package/lib/builtin-tenants.sha256

@@ -0,0 +1 @@
+0c4809aabb37d4d2237a6b55a0ccf3cb2049af69b049ad3514d7558a416f9bdc