@dsh-edge/dsh-edge-agent 0.0.0-stage → 0.1.1

package/config/edge.example.json

@@ -0,0 +1,179 @@
+{
+  "_comment": "dsh-edge-agent 配置模板（tracked）。§7.182（2026-11-11）起，运行时只认两个落点：①装好后的插件目录里的 config/edge.json（顺位 1 —— 打开插件目录就能看到能改的那个）；②~/.dsh-edge-agent/edge.json（顺位 2 —— 重装/删 profile 都活着，跨 npm/git/tarball 三条通道通用）。仓库的 config/ 目录不再放活配置（明文 API key 不该待在 git checkout 里）。本文件本身不再是运行时候选（模板里的部署值已并入代码默认值），它只是给你抄的那份模板：cp config/edge.example.json ~/.dsh-edge-agent/edge.json，然后填真实端点与 key。",
+  "secrets": {
+    "_comment": "HTTP API 鉴权 + 各 LLM 池的直连凭据。直连模式下写入 Authorization 头。",
+    "edgeApiKey": "",
+    "deepseekApiKey": "",
+    "dashscopeApiKey": "",
+    "minimaxApiKey": "",
+    "aliyuntokenplanApiKey": "",
+    "tavilyApiKey": "",
+    "bochaApiKey": "",
+    "bailianApiKey": ""
+  },
+  "http": {
+    "_comment": "http-api 监听入口。",
+    "host": "127.0.0.1",
+    "port": 21017
+  },
+  "llm": {
+    "_comment": "§7.100 / §7.171：两个池的 baseUrl 都留空 = DELEGATE 到宿主 profile 已配置的模型提供商（桌面 GUI 选的模型 / dsh-base 默认 deepseek-official），凭据全归宿主 adapter，edge 侧不碰任何 secret。",
+    "local": {
+      "_comment": "留空 = DELEGATE 模式（转发宿主提供商，与 llm.cloud 对称）。要 edge 自有直连池时填 baseUrl + model + keyRef。baseUrl 必须含 /v1 —— adapter 只追加 /chat/completions（local-llm-adapter.ts）。delegate=false = kill switch，回到 opt-in 语义（不注册 local-llm 路由，意图分类 / guard 检测自动降级到关键词 / 正则规则档）。reasoningEffortNone：ollama 池必开 —— ollama 的 /v1 层静默丢弃 chat_template_kwargs 和顶层 think:false，只有 reasoning_effort:\"none\" 生效（实测 <你的内网主机>:11434）。不加它，thinking 吃满 max_tokens → content 空 → json-parse-failed → 攻击检测静默落回正则档（24.6s → 6.5s）。严格网关（OpenAI 官方风格）不认这个参数会 400，保持 false。",
+      "baseUrl": "",
+      "model": "",
+      "keyRef": "",
+      "stripTools": false,
+      "enableThinking": false,
+      "reasoningEffortNone": false,
+      "delegate": true,
+      "delegateProvider": "",
+      "delegateModel": ""
+    },
+    "cloud": {
+      "_comment": "留空 = DELEGATE 模式（转发宿主提供商）。要 edge 自有直连云池时填 baseUrl + model + keyRef。",
+      "baseUrl": "",
+      "model": "",
+      "keyRef": "",
+      "delegate": true,
+      "delegateProvider": "",
+      "delegateModel": ""
+    }
+  },
+  "stages": {
+    "_comment": "★ 隐私不变式（用户仲裁 2026-10-18）：分类 / guard 检测只吃本地模型 —— 送进云池等于把「待检测的用户原文」上行，违背端侧私密定位。留空 = 用 plugin Schema 默认 local-llm；本地端点不可达时 intent-router / prompt-guard 自动降级到关键词 / 正则规则档，绝不借用宿主云模型。",
+    "guard": {
+      "provider": "local-llm",
+      "model": "",
+      "enabled": true,
+      "timeoutMs": 60000,
+      "maxInput": 2000
+    },
+    "intent": {
+      "provider": "local-llm",
+      "model": "",
+      "defaultCategory": "LOCAL",
+      "timeoutMs": 60000,
+      "confidenceThreshold": 0.6,
+      "maxInput": 2000,
+      "recentLimit": 3,
+      "cloudKeywords": [],
+      "localEntities": [],
+      "fallbackKeywords": [],
+      "deviceCommands": {
+        "_comment": "§7.124 家庭设备操作正则层（Tier-0）的扩展词表 —— 追加到内置词表（灯/空调/电视/窗帘…）。加一个新电器名只改这里一行，不用改代码。devices = 设备名词，actions = 动作词。",
+        "devices": [],
+        "actions": []
+      },
+      "llmFallback": true,
+      "_comment": " §7.115：llmFallback=false = 决策模型 only 模式（jev skip 直接落规则层，LLM 分类器不再运行）。"
+    }
+  },
+  "jev": {
+    "_comment": "§7.92.3 jev 意图识别（toggle，§7.182 主人裁决：**默认 OFF** —— 它是可选加速器，需要本地 :8001 的决策模型服务；没有它时 classify() 完全跳过 jev 路径；开 → 在 LLM classifier 之前先跑）。Toggle=false 时 classify() 完全跳过 jev 路径（无 network call）。高置信 (>=confidenceThreshold) + 低风险 (<riskThreshold) → 直接采纳；否则 fall through 到 LLM。 §7.112（2026-10-25）：provider 可选 local（默认，ONNX /predict）| bailian-decision（阿里 decision-model /systemone——questions 从 categories 自动生成，model 填 decision-model-preview，apiKeyRef 指向 secrets 里的百炼 MaaS key，authScheme raw=Authorization: <key> / bearer=Bearer 前缀）。§7.114：决策模型是配置文件绑定的外部服务——path 默认 /systemone（MaaS 部署）；本地 MLX serve 同一契约时 url 指 http://127.0.0.1:11017/v1、path 改 /classify（它有 /health，探针自动恢复）。 §7.115：localAdoptFloor=方向分闸——LOCAL 倾向判决 ≥ 该值直接采纳（默认本地，不落 LLM），非 LOCAL 仍走 confidenceThreshold。",
+    "enabled": false,
+    "url": "http://127.0.0.1:8001",
+    "timeoutMs": 2500,
+    "confidenceThreshold": 0.85,
+    "riskThreshold": 0.7,
+    "breakerTtlMs": 30000,
+    "bootProbeEnabled": true,
+    "bootProbeTimeoutMs": 2000,
+    "breakerProbeMs": 5000,
+    "probeTimeoutMs": 1000,
+    "provider": "local",
+    "model": "decision-model-preview",
+    "_apiKeyRef": "§7.182：默认档（provider=local，ONNX 决策模型）不需要 key —— 故意不写 apiKeyRef。写了就会在启动时报「配置里的密钥引用指向不存在的槽位」（槽位为空也算不存在，edge-config.ts danglingSecretRefs()）。要换百炼决策模型才把这一行加回来：\"apiKeyRef\": \"bailianApiKey\"，同时在 secrets 里填上那个槽位的真实 key。",
+    "authScheme": "raw",
+    "path": "/systemone",
+    "localAdoptFloor": 0.5
+  },
+  "functionCallExternal": {
+    "_comment": "§7.93.1 ExternalToolCaller（纯 client，外部维护）。契约 GET /health + POST /extract {query,tools,system?,max_new_tokens?}。CLOUD intent 不走 caller；caller 不可达 / 低置信 fall through 到 LLM 自提取。",
+    "enabled": false,
+    "url": "http://127.0.0.1:8081",
+    "timeoutMs": 15000,
+    "confidenceThreshold": 0.5,
+    "breakerTtlMs": 30000,
+    "bootProbeEnabled": true,
+    "bootProbeTimeoutMs": 2000,
+    "breakerProbeMs": 5000,
+    "probeTimeoutMs": 1000
+  },
+  "privacy": {
+    "_comment": "Input-Guard / Privacy-Policy / Realm-Bridge 开关。policyPath/realmConfigPath 留空 = ~/.dsh-edge-agent/ 下同名文件。",
+    "inputGuardEnabled": true,
+    "rejectPolicyEnabled": true,
+    "sanitizeDowngradeEnabled": true,
+    "realmHotReload": true,
+    "realmWatchMs": 5000,
+    "policyPath": "",
+    "realmConfigPath": "",
+    "policyHotReload": true,
+    "policyWatchMs": 5000,
+    "sanTtlMs": 900000,
+    "sanMaxSessions": 1000,
+    "sanSweepMs": 60000
+  },
+  "resources": {
+    "_comment": "Session / Sanitizer / body 限制。",
+    "maxSessions": 100,
+    "maxBodyBytes": 1048576,
+    "sessionIdleMs": 1800000,
+    "sanMaxSessions": 1000,
+    "sanSweepMs": 60000,
+    "sanTtlMs": 900000
+  },
+  "audit": {
+    "_comment": "Audit / Ops Log 落盘。root/logRoot 留空 = ~/.dsh-edge-agent/audit 与 ~/.dsh-edge-agent/log。",
+    "minLevel": "info",
+    "flushMs": 1000,
+    "logLevel": "info",
+    "logMaxAgeDays": 1,
+    "logMaxRotated": 7,
+    "root": "",
+    "logRoot": "",
+    "llmTrace": {
+      "_comment": "§7.118 详细 LLM request/response 追踪（写进 ops log，info 级别默认可见）。enabled=false 全关；includeRequest/includeResponse 可各自单关；maxChars 是单字段字符上限（截断会以 …[+N chars] 显式标注，绝不静默）；maxMessages 只保留最近 N 条 message；redactPii 走 pii-utils 10 类规则；redactSecrets 盖住厂商前缀密钥（sk-cp- / sk-ws- / tvly- …，pii-utils 的 api-key 规则盖不住）。",
+      "enabled": true,
+      "includeRequest": true,
+      "includeResponse": true,
+      "maxChars": 2000,
+      "maxMessages": 12,
+      "redactPii": true,
+      "redactSecrets": true
+    }
+  },
+  "tee": {
+    "_comment": "TEE 后端选择（simulated / trustzone / keystone / sgx）；平台自动探测时可留空。storageRoot 留空 = ~/.dsh-edge-agent。",
+    "type": "simulated",
+    "storageRoot": "",
+    "keyStorePath": ""
+  },
+  "storage": {
+    "_comment": "local-storage 明文 JSONL KV 根目录；留空 = ~/.dsh-edge-agent/storage。",
+    "root": ""
+  },
+  "etscli": {
+    "_comment": "etscli 只读工具 wrapper（§7.98）。bin 留空 = ~/.local/bin/etscli。",
+    "bin": "",
+    "timeoutMs": 30000
+  },
+  "threat": {
+    "_comment": "td-bus 阈值。cloudRate = 每分钟云请求数上限（0 = 不限）。",
+    "cloudRate": 20,
+    "blockLevel": "critical"
+  },
+  "webSearch": {
+    "_comment": "Phase 5 web-search providers（§7.82）三级链：Tavily → 博查 AI → DeepSeek。任一可用即可，任一失败自动 fallback；不写 key 就跳过该 tier。§7.182 主人裁决：Tavily / 博查两档**默认关闭** ⇒ 出厂只有 DeepSeek 档在链上（secrets.deepseekApiKey）；要开就把对应开关写 true。",
+    "tavilyEnabled": false,
+    "bochaEnabled": false
+  },
+  "agent": {
+    "_comment": "agent persona + 工具权限。",
+    "persona": "You are edge-agent, a privacy-first AI assistant running on the user's device.",
+    "localToolsWritable": true,
+    "localToolsAllowlist": "/tmp",
+    "permissionMode": "workspace-write"
+  }
+}

package/config/privacy-policy.json

@@ -0,0 +1,202 @@
+{
+  "version": "1.9.0",
+  "_comment": "sanitizationRules 的 pattern 必须与 src/dsh-adapter/pii-utils.ts 的 PII_PATTERNS 保持一致（tests/unit/pii-utils.test.ts 有一致性断言）。已移除 replacement 字段：占位符由 sanitizer-pipeline 自行生成为 [<PIITYPE>_<seq>]，该字段历史上不生效。",
+  "_categories_comment": "§7.110（默认本地，类别简并）：categories 只需要**肯定式定义例外**——CLOUD（需要公网信息）和 REJECT（危险请求）；其余一切（本地操作、日常问答、含 PII 的本地处理）都是默认 LOCAL，不设行。SANITIZED 不再单列：CLOUD 路径本来必经 sanitizer（fail-closed，脱不了敏不上云），含敏感数据的操作另有 PII LOCAL 正则护栏兜底。 jevIntents 同步收敛：只保留无歧义的 CLOUD/REJECT 信号标签（知识问答/通用咨询属日常问答 → 默认 LOCAL，不再进 CLOUD）。intent-router 在 policy 无 LOCAL 行时自动补 catch-all 提示行并放行 LOCAL 输出。",
+  "_stages_comment": "§7.109（语义优先裁决）：路由以 jev/LLM 的语义判决为主——stages.intent.semanticCloudMinConfidence 是操作者对分类器的信任阈值，语义判 CLOUD 且置信度 ≥ 阈值即出网（无需关键词佐证）。关键词/正则只作护栏与零成本快路径（REJECT 危险操作、PII LOCAL 安全网、内置新闻/天气类信号），不再为领域扩词——子串匹配易误命中（如「游戏攻略」）。stages.intent.cloudKeywords/localEntities/fallbackKeywords 仍是可用的扩展面（追加/替换语义见 §7.108），但默认为空。全部热重载。",
+  "categories": [
+    {
+      "id": "CLOUD",
+      "description": "需要检索公网上信息的任务：新闻、天气、行情、搜索引擎，以及旅游攻略、景点推荐、行程规划等需要实时公网信息的任务",
+      "examples": [
+        "今天北京天气",
+        "查一下最新的AI新闻",
+        "准备一个杭州游玩的攻略",
+        "规划一个西湖一日游"
+      ],
+      "jevIntents": [
+        "天气",
+        "新闻",
+        "搜索",
+        "旅游攻略",
+        "景点推荐",
+        "行程规划",
+        "weather",
+        "news",
+        "search",
+        "travel",
+        "travel_planning",
+        "attraction"
+      ]
+    },
+    {
+      "id": "REJECT",
+      "description": "高危 / 违法 / 违规请求（危险系统操作、破坏性命令、投诉、法务）",
+      "examples": [
+        "rm -rf /",
+        "drop table users",
+        "我要投诉"
+      ],
+      "jevIntents": [
+        "投诉",
+        "法务咨询",
+        "complaint",
+        "legal"
+      ]
+    }
+  ],
+  "routingRules": [
+    {
+      "pattern": "(导出|删除|清空|格式化).*(数据库|系统|磁盘|全部数据)",
+      "realm": "REJECT",
+      "confidence": 0.9,
+      "rationale": "危险系统操作"
+    },
+    {
+      "pattern": "(drop\\s+table|rm\\s+-rf|format\\s+[a-z]:|del\\s+/[fs])",
+      "realm": "REJECT",
+      "confidence": 0.95,
+      "rationale": "破坏性命令特征"
+    },
+    {
+      "pattern": "(本地|local|文件|file|计算|calculate|读取|写入)",
+      "realm": "LOCAL",
+      "confidence": 0.8,
+      "rationale": "本地操作不出设备"
+    },
+    {
+      "pattern": "(密码|password|secret|密钥|private.?key|token)",
+      "realm": "LOCAL",
+      "confidence": 0.9,
+      "rationale": "敏感凭据不得离开设备"
+    },
+    {
+      "pattern": "(身份证号|id.?card|银行卡|bank.?card|信用卡|credit.?card)",
+      "realm": "LOCAL",
+      "confidence": 0.95,
+      "rationale": "金融/身份类 PII 必须留在本地"
+    },
+    {
+      "pattern": "(手机号|电话号码|手机.{0,5}号|phone.?number|mobile.?number)",
+      "realm": "LOCAL",
+      "confidence": 0.95,
+      "rationale": "手机号 PII 必须留在本地"
+    },
+    {
+      "pattern": "(邮箱|电邮|email.?address|e-?mail)",
+      "realm": "LOCAL",
+      "confidence": 0.95,
+      "rationale": "邮箱 PII 必须留在本地"
+    },
+    {
+      "pattern": "(IP\\s*地址|服务器.{0,8}(IP|地址)|server\\s+IP|局域网.{0,8}(IP|地址))",
+      "realm": "LOCAL",
+      "confidence": 0.9,
+      "rationale": "IP 地址 PII 必须留在本地"
+    },
+    {
+      "pattern": "(家庭住址|住址|home\\s+address|通信地址)",
+      "realm": "LOCAL",
+      "confidence": 0.85,
+      "rationale": "家庭住址 PII 必须留在本地"
+    },
+    {
+      "pattern": "(联网|上网|网上查|搜索引擎|搜索一下网上|web search|search the web|look up online|weather forecast|天气预报|实时行情|股价|汇率|current price)",
+      "realm": "CLOUD",
+      "confidence": 0.8,
+      "rationale": "需要检索公网上的信息 → 才允许走云端 LLM"
+    }
+  ],
+  "stages": {
+    "intent": {
+      "_semantic_comment": "§7.123 (2026-10-27): raised 0.75 → 0.95. The bailian decision-model answers a `choice` question and frequently reports NO numeric confidence; the decoder then substitutes a synthetic 0.9 ('decisive-by-construction'). At 0.75 that placeholder was always >= threshold, so EVERY CLOUD verdict from that provider left the device with no public-web signal — the §7.107 gate was inert on the one path that talks to a cloud service. 0.95 sits above the synthetic placeholder so only a MEASURED high confidence can unlock the semantic path. §7.123 also added a provenance guard in code (Intent.confidenceReported): a synthetic confidence can never satisfy this threshold at all. Lower it only if your classifier genuinely reports calibrated confidences; 0.95 is the safe floor for a choice-style model.",
+      "semanticCloudMinConfidence": 0.95,
+      "deviceCommands": {
+        "_comment": "家庭设备操作正则层的扩展词表 —— 追加到内置词表（灯/空调/电视/窗帘…）。devices = 设备名词，actions = 动作词。改这里即时生效（热重载），不用重启 App。",
+        "devices": [],
+        "actions": []
+      }
+    }
+  },
+  "sanitizationRules": [
+    {
+      "pattern": "\\b[1-9]\\d{5}(?:19|20)\\d{2}(?:0[1-9]|1[0-2])(?:0[1-9]|[12]\\d|3[01])\\d{3}[\\dXx]\\b",
+      "dataClass": "secret",
+      "piiType": "id-card",
+      "keepPrefix": 6
+    },
+    {
+      "pattern": "\\b\\d{16,19}\\b",
+      "dataClass": "secret",
+      "piiType": "bank-card"
+    },
+    {
+      "pattern": "\\b1[3-9]\\d{9}\\b",
+      "dataClass": "confidential",
+      "piiType": "phone",
+      "keepPrefix": 7
+    },
+    {
+      "pattern": "[\\w.-]+@[\\w.-]+\\.\\w+",
+      "dataClass": "confidential",
+      "piiType": "email"
+    },
+    {
+      "pattern": "(?:sk-(?:proj-|ant-|live-|test-|org-)?[a-zA-Z0-9]{20,}|key-[a-zA-Z0-9]{16,}|api[_-]?key[_-]?[a-zA-Z0-9]{16,})",
+      "dataClass": "secret",
+      "piiType": "api-key"
+    },
+    {
+      "pattern": "(?:密码|口令|用户名|账号|账户|passwd|password|pwd|username|account|secret|access[ _-]?token|token|api[ _-]?key)[\"' 　]{0,2}(?:[:：=]|是|为|\\s+is\\s+)[\"' 　]?[^\\s\"'，,;；<>（）()]{3,64}",
+      "dataClass": "secret",
+      "piiType": "credential",
+      "replacement": "<PII_CREDENTIAL_n>"
+    },
+    {
+      "pattern": "(?<![vV\\d.])(?:(?:25[0-5]|2[0-4]\\d|1\\d{2}|[1-9]?\\d)\\.){3}(?:25[0-5]|2[0-4]\\d|1\\d{2}|[1-9]?\\d)(?!\\.?\\d)",
+      "dataClass": "confidential",
+      "piiType": "ip-address"
+    },
+    {
+      "pattern": "(?:[0-9A-Fa-f]{2}[:-]){5}[0-9A-Fa-f]{2}",
+      "dataClass": "confidential",
+      "piiType": "mac-address"
+    },
+    {
+      "pattern": "\\b(?:E[0-9A-Z]\\d{7}|G\\d{8})\\b",
+      "dataClass": "secret",
+      "piiType": "passport"
+    },
+    {
+      "pattern": "[京津沪渝冀豫云辽黑湘皖鲁新苏浙赣鄂桂甘晋蒙陕吉闽贵粤川青藏琼][A-Z][A-HJ-NP-Z0-9]{5}",
+      "dataClass": "confidential",
+      "piiType": "license-plate"
+    }
+  ],
+  "dataClassifications": [
+    {
+      "class": "public",
+      "defaultRealm": "CLOUD",
+      "ttlSeconds": 3600
+    },
+    {
+      "class": "internal",
+      "defaultRealm": "SANITIZED",
+      "ttlSeconds": 1800
+    },
+    {
+      "class": "confidential",
+      "defaultRealm": "LOCAL",
+      "ttlSeconds": 900
+    },
+    {
+      "class": "secret",
+      "defaultRealm": "LOCAL",
+      "ttlSeconds": 300
+    }
+  ],
+  "globalConstraints": {
+    "maxCloudRequestsPerMinute": 20,
+    "requireAttestation": false,
+    "blockIfTcbCompromised": true
+  }
+}

package/cordis.desktop-safe.patch.yml

@@ -0,0 +1,129 @@
+# dsh-edge-agent — desktop-safe overlay
+#
+# This patch is intended for loading the bundle into an existing DSH Desktop /
+# Web profile through the Plugins page. Unlike the production `cordis.patch.yml`,
+# it **only inserts** the edge privacy stack. It does not rewrite host defaults:
+#
+#   - no system-prompt/persona override
+#   - no agent-default-model override
+#   - no approval/sandbox override
+#   - no session-root override
+#   - no http-api listener
+#   - no upstream tool/subagent/workflow disables
+#
+# What it does mount:
+#   - durable ops log + audit log
+#   - TCM stub + threat bus
+#   - Realm-aware skill/tool bridge
+#   - privacy policy + PII sanitizer
+#   - prompt guard + intent router + input guard orchestrator
+#   - §7.100 / §7.171 LLM routes: BOTH pools are DELEGATE adapters by default
+#     (they forward to the host profile's own configured model provider — the
+#     Desktop GUI's model picker — with host-side credential resolution; the
+#     bundle never reads any secret). A pool becomes a DIRECT (edge-owned) one
+#     only when its own endpoint is configured in config/edge.json
+#     (llm.local.baseUrl / llm.cloud.baseUrl).
+#
+# Notes:
+#   - §7.171 (2026-11-10) made llm.local symmetric with llm.cloud: with no
+#     `llm.local.baseUrl` the local route still registers, but forwards to the
+#     host provider. Consequence to be aware of: the internal LLM stages
+#     (intent classification / guard model-detection) are pinned to
+#     `local-llm`, so with no local endpoint they now run on the host's model
+#     and the text under inspection rides along. The 2026-10-18 ruling
+#     ("internal LLM calls must never borrow the host's cloud model") is
+#     therefore honoured only when a local endpoint IS configured — or when
+#     `llm.local.delegate=false`, which leaves the route unregistered and
+#     sends the stages back to their keyword/regex tier.
+#   - SANITIZED/CLOUD answers egress through the host's own provider — the
+#     same destination plain Desktop use already picks — after PII
+#     placeholder sanitization.
+#   - LLM-based guard/intent detection config comes from config/edge.json
+#     (stages.guard.* / stages.intent.*): both are ON by default, both point
+#     at `local-llm`, and intent-router falls back to keyword/policy rules
+#     when its classifier provider is unavailable.
+#   - The privacy pipeline still intercepts every agent step. That is expected:
+#     this is what makes it an edge-agent. If you want zero behavior change,
+#     set DSH_EDGE_INPUT_GUARD=false before starting/restarting the profile.
+
+- id: tool-web
+  disabled: false
+  config:
+    search: true
+    fetch: true
+    searchMaxResults: 8
+    searchTimeoutMs: 30000
+    fetchTimeoutMs: 30000
+- id: web
+  config:
+    searchProvider: tavily-bocha-fallback
+    fetchProvider: http
+- id: web-search-deepseek
+  disabled: true
+
+# ── 本 bundle 留在宿主树的三行（§7.136）──────────────────────────────────
+# 理由见 scripts/_isolate-edge-group.mjs 的文件头：
+#   dsh-edge-agent（裸包名）—— 宿主 client-modules 只扫宿主 Loader 的 entries，
+#     preset 树不在其中 ⇒ Edge tab 的浏览器半边只能从这里被发现；
+#   audit-log / file-logger —— 裸包名行 inject auditLog，且它的 installFileLogger
+#     会先占住 fileLogger 服务名 ⇒ 两者必须在 root realm，且 file-logger 行要更早装载。
+- insert:
+    # §7.101.x (2026-10-20, fix #5) + §7.136: the BARE-package host-half row.
+    # The webview client-module system (@deepseek-ai/dsh-client-modules) scans
+    # LOADER ENTRY NAMES for a `dsh.client` declaration — and its package
+    # locator only accepts bare package-root specifiers (`exactPackageSpecifier`),
+    # so subpath rows like '@scope/pkg/audit-log' can never surface the
+    # bundle's browser half. dsh-context shows the working shape: one bare
+    # row (`name: dsh-context`) whose main entry IS the plugin AND whose
+    # manifest carries `dsh.client.platform: "web"`.
+    #
+    # §7.136: this row must stay in the HOST tree. client-modules scans
+    # `ctx.loader.entries()` — the host Loader's entries — while a preset's
+    # plugin list lives in its own EntryTree, outside that enumeration. A bare
+    # row inside the preset would therefore never surface the browser half and
+    # the Edge tab would vanish in every work mode.
+    - id: dsh-edge-agent
+      name: '@dsh-edge/dsh-edge-agent'
+
+    # Ops log exporter. Mount first so later plugin logs land on disk.
+    - id: file-logger
+      name: '@dsh-edge/dsh-edge-agent/file-logger'
+      config:
+        # §7.102 "one config file": only profile-specific statics live here.
+        # root / level / rotation come from config/edge.json (audit.*);
+        # no process.env reads — the desktop GUI never had them.
+        filename: dsh-edge-agent-desktop.log
+        flushIntervalMs: 1000
+        queueCapacity: 10000
+        maxFileSizeBytes: 52428800
+
+    # Security ledger. Default root stays isolated under ~/.dsh-edge-agent.
+    - id: audit-log
+      name: '@dsh-edge/dsh-edge-agent/audit-log'
+      config:
+        # §7.102 "one config file": minLevel / flush / root come from
+        # config/edge.json (audit.*). Only static wiring stays here.
+        ringBufferSize: 512
+        filename: audit.plain.jsonl
+        enablePIIRedaction: true
+        maxFileSizeBytes: 10485760
+        maxFileAgeDays: 7
+        maxRotatedFiles: 5
+
+    # §7.145: 桌面版「起不来」的根因修复（431）。
+    #
+    # 这一行**必须**留在宿主树（不是 preset）—— 它修的不是 Edge 行为，而是
+    # **宿主自己的启动**：Electron 外壳的 welcome 握手带着 Chromium cookie jar
+    # 出发，cookie 越攒越多 ⇒ 请求头爆 16 KB ⇒ 431 ⇒ 外壳拆宿主 ⇒
+    # 「DeepSeek Harness is unavailable」。握手发生在**任何工作方式选定之前**
+    # ⇒ 修它的插件也必须在 preset 之外。
+    #
+    # 它自带 `process.versions.electron` 判据 ⇒ headless profile 里直接跳过。
+    - id: desktop-cookie-janitor
+      name: '@dsh-edge/dsh-edge-agent/desktop-cookie-janitor'
+      config:
+        enabled: true
+        # 宿主 web 服务是裸 createServer（16 KB 头上限）；抬到 64 KB 让
+        # 一个已经攒胖的 cookie jar 也不会打死启动。
+        maxHeaderBytes: 65536
+