@dsh-edge/dsh-edge-agent 0.0.0-stage → 0.1.1

package/lib/dsh-adapter/tools.d.ts

@@ -0,0 +1,118 @@
+/**
+ * tools — Realm-aware tool registry *configuration* for dsh-edge-agent.
+ *
+ * M2 stage: this plugin does NOT maintain a parallel registry. The actual
+ * tool storage is `ctx.tools` from `@deepseek-ai/dsh-tools` (DSH upstream).
+ * dsh-edge-agent only configures the runtime (default rate limit, scope
+ * presentation) and exposes a thin service that downstream plugins call
+ * to filter or list the visible tool set by realm.
+ *
+ * Realm filtering is opt-in — agents that do not care about realm scope
+ * see the full upstream tool set. G8 (2026-08-23) wires `enableToolIsolation`
+ * to `filterTools(intent)` / `isToolAllowed(name, intent)`, so consumers
+ * (http-api, agent-loop) can drive tool visibility from the intent-router
+ * verdict. The flag is opt-out so legacy callers see the full set.
+ *
+ * @module dsh-edge-agent/tools
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import { Service } from '@deepseek-ai/cordis';
+import Schema from '@deepseek-ai/schemastery';
+export declare const name = "tools";
+export declare const inject: readonly ["auditLog", "tools"];
+export type ToolRealm = 'LOCAL' | 'CLOUD' | 'SANITIZED';
+export interface Config {
+    /** Default rate limit for registered tools that do not specify their own. */
+    defaultRateLimitPerMinute: number;
+    /** Whether realm isolation (scope restrictions) is active. M2 keeps it on. */
+    enableToolIsolation: boolean;
+    /** Reflection of the upstream `tools` runtime config this plugin maps on. */
+    presentationMode: 'native' | 'code-mode';
+}
+export declare const Config: Schema<Config>;
+export interface ToolSummary {
+    name: string;
+    description: string;
+    realm: ToolRealm;
+}
+export interface ToolsService {
+    /** Lightweight snapshot of the current global tool set, optionally filtered by realm. */
+    list(realm?: ToolRealm): ToolSummary[];
+    /** Returns true when a name is registered globally. */
+    has(name: string): boolean;
+    /** The realm a tool was tagged with at registration; undefined if unknown. */
+    realmOf(name: string): ToolRealm | undefined;
+    /** M2 convenience: classify a tool name by its `local-` / `cloud-` / `sanitized-` prefix. */
+    classify(name: string): ToolRealm;
+    /** G8: tools visible to a given intent-router verdict. REJECT → []. When
+     *  `enableToolIsolation: false`, returns all tools regardless of intent
+     *  (legacy / opt-out callers). When `true`, returns the tools whose realm
+     *  matches `intent.category`. */
+    filterTools(intent: IntentLike): ToolSummary[];
+    /** G8: single-tool check for the same matrix. False for REJECT, false for
+     *  realm mismatches under isolation. */
+    isToolAllowed(toolName: string, intent: IntentLike): boolean;
+}
+/** Structural shape of an intent-router verdict that `filterTools` /
+ *  `isToolAllowed` consume. Local to this module to avoid a circular
+ *  dependency on intent-router.ts — we accept any object that has
+ *  `category` in the right shape. intent-router's `Intent` already
+ *  satisfies it. */
+export type IntentLike = {
+    readonly category: 'LOCAL' | 'CLOUD' | 'SANITIZED' | 'REJECT';
+};
+declare module '@deepseek-ai/cordis' {
+    interface Context {
+        edgeTools: ToolsServiceImpl;
+    }
+}
+/**
+ * Live snapshot of the dsh-edge-agent tool surface. Reads from `ctx.tools`
+ * (upstream registry) and the in-memory realm map. The class is
+ * intentionally a thin view, not a writer — to add a tool, register
+ * through `ctx.tools.register()`.
+ *
+ * Note: DSH native tools (bash, read, write, edit, web_search, web_fetch)
+ * are now used directly. Phase 5 (2026-08-26) hard-codes the realm tags
+ * for DSH native tools via `DSH_NATIVE_REALM_MAP` so `filterTools(intent)`
+ * correctly hides `web_search` under a LOCAL verdict without relying on
+ * prefix heuristics. The map is applied lazily — every `list()` /
+ * `filterTools()` call re-projects from the upstream registry, so tools
+ * registered after boot (via the `tools/change` event) get the right tag.
+ */
+export declare class ToolsServiceImpl extends Service {
+    /** Tool name → set of realms it belongs to. A tool can be in multiple realms. */
+    private readonly realm;
+    private readonly enableToolIsolation;
+    /** Default per-tool rate limit (informational; M3 persistence picks it up). */
+    private readonly defaultRateLimitPerMinute;
+    /** Tool presentation mode (informational; not consulted by this service yet). */
+    private readonly presentationMode;
+    constructor(ctx: Context, config?: Partial<Config>);
+    /** Set realm tag for a tool. Additive — a tool can belong to multiple realms
+     *  (e.g. bash is both LOCAL and CLOUD). Call after tool registration. */
+    setRealm(toolName: string, realm: ToolRealm): void;
+    /** Resolve the realms of a tool name. Checks:
+     *  1. Explicit setRealm/addRealm calls (multi-realm Set)
+     *  2. DSH_NATIVE_MULTI_REALM (bash → [LOCAL, CLOUD])
+     *  3. DSH_NATIVE_REALM_MAP (single-realm fallback)
+     *  4. classifyByPrefix (default)
+     */
+    resolveRealms(toolName: string): Set<ToolRealm>;
+    /** Backward-compatible single-value resolver. Returns the first realm
+     *  from the resolved set. For multi-realm tools (like bash), prefer
+     *  resolveRealms() + Set.has() checks instead. */
+    resolveRealm(toolName: string): ToolRealm;
+    list(realm?: ToolRealm): ToolSummary[];
+    has(name: string): boolean;
+    realmOf(name: string): ToolRealm | undefined;
+    classify(name: string): ToolRealm;
+    /** G8: tools visible under a given intent-router verdict. */
+    filterTools(intent: IntentLike): ToolSummary[];
+    /** G8: single-tool check (cheaper than `filterTools(intent).some`). */
+    isToolAllowed(toolName: string, intent: IntentLike): boolean;
+}
+/** Pure classifier for tests and for the default realm tag. */
+export declare function classifyByPrefix(toolName: string): ToolRealm;
+export declare function apply(ctx: Context, config: Config): Promise<() => Promise<void>>;
+//# sourceMappingURL=tools.d.ts.map

package/lib/dsh-adapter/tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../../src/dsh-adapter/tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAC7C,OAAO,MAAM,MAAM,0BAA0B,CAAA;AAE7C,eAAO,MAAM,IAAI,UAAU,CAAA;AAE3B,eAAO,MAAM,MAAM,gCAAiC,CAAA;AAEpD,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,OAAO,GAAG,WAAW,CAAA;AAEvD,MAAM,WAAW,MAAM;IACrB,6EAA6E;IAC7E,yBAAyB,EAAE,MAAM,CAAA;IACjC,8EAA8E;IAC9E,mBAAmB,EAAE,OAAO,CAAA;IAC5B,6EAA6E;IAC7E,gBAAgB,EAAE,QAAQ,GAAG,WAAW,CAAA;CACzC;AAED,eAAO,MAAM,MAAM,EAAE,MAAM,CAAC,MAAM,CAIhC,CAAA;AAEF,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,SAAS,CAAA;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,yFAAyF;IACzF,IAAI,CAAC,KAAK,CAAC,EAAE,SAAS,GAAG,WAAW,EAAE,CAAA;IACtC,uDAAuD;IACvD,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;IAC1B,8EAA8E;IAC9E,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAAA;IAC5C,6FAA6F;IAC7F,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAA;IACjC;;;qCAGiC;IACjC,WAAW,CAAC,MAAM,EAAE,UAAU,GAAG,WAAW,EAAE,CAAA;IAC9C;4CACwC;IACxC,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO,CAAA;CAC7D;AAED;;;;oBAIoB;AACpB,MAAM,MAAM,UAAU,GAAG;IAAE,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,OAAO,GAAG,WAAW,GAAG,QAAQ,CAAA;CAAE,CAAA;AAE1F,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,OAAO;QACf,SAAS,EAAE,gBAAgB,CAAA;KAC5B;CACF;AA0CD;;;;;;;;;;;;;GAaG;AACH,qBAAa,gBAAiB,SAAQ,OAAO;IAC3C,iFAAiF;IACjF,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAoC;IAC1D,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAS;IAC7C,+EAA+E;IAC/E,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAQ;IAClD,iFAAiF;IACjF,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAwB;gBAE7C,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC;IAUlD;6EACyE;IACzE,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,IAAI;IAMlD;;;;;OAKG;IACH,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAC,SAAS,CAAC;IAc/C;;sDAEkD;IAClD,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS;IAKzC,IAAI,CAAC,KAAK,CAAC,EAAE,SAAS,GAAG,WAAW,EAAE;IActC,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI1B,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS;IAQ5C,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS;IAIjC,6DAA6D;IAC7D,WAAW,CAAC,MAAM,EAAE,UAAU,GAAG,WAAW,EAAE;IAgB9C,uEAAuE;IACvE,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO;CAO7D;AAED,+DAA+D;AAC/D,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAO5D;AAqCD,wBAAsB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAwDtF"}

package/lib/dsh-adapter/tools.js

@@ -0,0 +1,292 @@
+/**
+ * tools — Realm-aware tool registry *configuration* for dsh-edge-agent.
+ *
+ * M2 stage: this plugin does NOT maintain a parallel registry. The actual
+ * tool storage is `ctx.tools` from `@deepseek-ai/dsh-tools` (DSH upstream).
+ * dsh-edge-agent only configures the runtime (default rate limit, scope
+ * presentation) and exposes a thin service that downstream plugins call
+ * to filter or list the visible tool set by realm.
+ *
+ * Realm filtering is opt-in — agents that do not care about realm scope
+ * see the full upstream tool set. G8 (2026-08-23) wires `enableToolIsolation`
+ * to `filterTools(intent)` / `isToolAllowed(name, intent)`, so consumers
+ * (http-api, agent-loop) can drive tool visibility from the intent-router
+ * verdict. The flag is opt-out so legacy callers see the full set.
+ *
+ * @module dsh-edge-agent/tools
+ */
+import { Service } from '@deepseek-ai/cordis';
+import Schema from '@deepseek-ai/schemastery';
+export const name = 'tools';
+export const inject = ['auditLog', 'tools'];
+export const Config = Schema.object({
+    defaultRateLimitPerMinute: Schema.natural().default(60),
+    enableToolIsolation: Schema.boolean().default(true),
+    presentationMode: Schema.union(['native', 'code-mode']).default('native'),
+});
+/**
+ * Hardcoded realm tags for upstream DSH tools whose default `classifyByPrefix`
+ * fallback would be wrong. Phase 5 (2026-08-26) wires web_search / web_fetch
+ * (from `@deepseek-ai/dsh-tool-web`) to CLOUD: they trigger outbound calls
+ * to DeepSeek's Anthropic-compatible endpoint and must NEVER run under a
+ * LOCAL or REJECT intent — see `intent-router` realm routing (G8).
+ *
+ * Anything not in this map still falls through to `classifyByPrefix`, which
+ * returns CLOUD by default (the safe path: explicit refusal rather than
+ * silently routing into LOCAL).
+ */
+const DSH_NATIVE_REALM_MAP = {
+    web_search: 'CLOUD',
+    web_fetch: 'CLOUD',
+    write: 'LOCAL',
+    edit: 'LOCAL',
+    glob: 'LOCAL',
+    grep: 'LOCAL',
+};
+/**
+ * Tools that belong to multiple realms. These override DSH_NATIVE_REALM_MAP
+ * when present. `bash` and `read` are tagged both LOCAL and CLOUD so that
+ * CLOUD agents can invoke lark-cli (and other safe CLI tools) via bash,
+ * and read local files (e.g. skill reference docs like lark-shared/SKILL.md).
+ * Since `bash` already grants equivalent file access, `read` in CLOUD is
+ * consistent rather than a new risk.
+ *
+ * `skill` is the universal skill loader — it loads SKILL.md content regardless
+ * of realm. The actual realm separation happens at the skill level (ets-* →
+ * LOCAL, lark-* → CLOUD) via realm-skill-bridge catalog filtering. Making the
+ * tool itself multi-realm lets LOCAL agents load ets-* skills and CLOUD agents
+ * load lark-* skills, each seeing only their own catalog.
+ */
+const DSH_NATIVE_MULTI_REALM = {
+    bash: ['LOCAL', 'CLOUD'],
+    read: ['LOCAL', 'CLOUD'],
+    skill: ['LOCAL', 'CLOUD'],
+};
+/**
+ * Live snapshot of the dsh-edge-agent tool surface. Reads from `ctx.tools`
+ * (upstream registry) and the in-memory realm map. The class is
+ * intentionally a thin view, not a writer — to add a tool, register
+ * through `ctx.tools.register()`.
+ *
+ * Note: DSH native tools (bash, read, write, edit, web_search, web_fetch)
+ * are now used directly. Phase 5 (2026-08-26) hard-codes the realm tags
+ * for DSH native tools via `DSH_NATIVE_REALM_MAP` so `filterTools(intent)`
+ * correctly hides `web_search` under a LOCAL verdict without relying on
+ * prefix heuristics. The map is applied lazily — every `list()` /
+ * `filterTools()` call re-projects from the upstream registry, so tools
+ * registered after boot (via the `tools/change` event) get the right tag.
+ */
+export class ToolsServiceImpl extends Service {
+    /** Tool name → set of realms it belongs to. A tool can be in multiple realms. */
+    realm = new Map();
+    enableToolIsolation;
+    /** Default per-tool rate limit (informational; M3 persistence picks it up). */
+    defaultRateLimitPerMinute;
+    /** Tool presentation mode (informational; not consulted by this service yet). */
+    presentationMode;
+    constructor(ctx, config) {
+        super(ctx, 'edgeTools');
+        // G8: Config is now plumbed. Pre-G8 callers (existing tests / single-arg
+        // constructor) get isolation OFF by default, which matches the prior
+        // behavior (the flag was defined but never applied).
+        this.enableToolIsolation = config?.enableToolIsolation ?? false;
+        this.defaultRateLimitPerMinute = config?.defaultRateLimitPerMinute ?? 60;
+        this.presentationMode = config?.presentationMode ?? 'native';
+    }
+    /** Set realm tag for a tool. Additive — a tool can belong to multiple realms
+     *  (e.g. bash is both LOCAL and CLOUD). Call after tool registration. */
+    setRealm(toolName, realm) {
+        const existing = this.realm.get(toolName) ?? new Set();
+        existing.add(realm);
+        this.realm.set(toolName, existing);
+    }
+    /** Resolve the realms of a tool name. Checks:
+     *  1. Explicit setRealm/addRealm calls (multi-realm Set)
+     *  2. DSH_NATIVE_MULTI_REALM (bash → [LOCAL, CLOUD])
+     *  3. DSH_NATIVE_REALM_MAP (single-realm fallback)
+     *  4. classifyByPrefix (default)
+     */
+    resolveRealms(toolName) {
+        // 1. Explicit multi-realm tags
+        const explicit = this.realm.get(toolName);
+        if (explicit !== undefined && explicit.size > 0)
+            return explicit;
+        // 2. Multi-realm native map
+        const multi = DSH_NATIVE_MULTI_REALM[toolName];
+        if (multi !== undefined)
+            return new Set(multi);
+        // 3. Single-realm native map
+        const single = DSH_NATIVE_REALM_MAP[toolName];
+        if (single !== undefined)
+            return new Set([single]);
+        // 4. Prefix fallback
+        return new Set([classifyByPrefix(toolName)]);
+    }
+    /** Backward-compatible single-value resolver. Returns the first realm
+     *  from the resolved set. For multi-realm tools (like bash), prefer
+     *  resolveRealms() + Set.has() checks instead. */
+    resolveRealm(toolName) {
+        const realms = this.resolveRealms(toolName);
+        return realms.values().next().value;
+    }
+    list(realm) {
+        const upstream = upstreamTools(this.ctx);
+        const out = [];
+        for (const tool of upstream) {
+            const realms = this.resolveRealms(tool.name);
+            // When filtering by realm, include tools that belong to that realm
+            if (realm !== undefined && !realms.has(realm))
+                continue;
+            // For the summary, use the first realm (or 'LOCAL' for multi-realm like bash)
+            const primaryRealm = realms.values().next().value;
+            out.push({ name: tool.name, description: tool.description, realm: primaryRealm });
+        }
+        return out;
+    }
+    has(name) {
+        return upstreamTools(this.ctx).some((tool) => tool.name === name);
+    }
+    realmOf(name) {
+        const explicit = this.realm.get(name);
+        if (explicit !== undefined && explicit.size > 0)
+            return explicit.values().next().value;
+        const multi = DSH_NATIVE_MULTI_REALM[name];
+        if (multi !== undefined)
+            return multi[0];
+        return DSH_NATIVE_REALM_MAP[name];
+    }
+    classify(name) {
+        return this.resolveRealm(name);
+    }
+    /** G8: tools visible under a given intent-router verdict. */
+    filterTools(intent) {
+        if (intent.category === 'REJECT')
+            return [];
+        if (!this.enableToolIsolation)
+            return this.list();
+        // Under isolation, include tools whose realm set contains the intent's
+        // category. Multi-realm tools (e.g. bash → LOCAL+CLOUD) appear in both.
+        const upstream = upstreamTools(this.ctx);
+        const out = [];
+        for (const tool of upstream) {
+            const realms = this.resolveRealms(tool.name);
+            if (!realms.has(intent.category))
+                continue;
+            const primaryRealm = realms.values().next().value;
+            out.push({ name: tool.name, description: tool.description, realm: primaryRealm });
+        }
+        return out;
+    }
+    /** G8: single-tool check (cheaper than `filterTools(intent).some`). */
+    isToolAllowed(toolName, intent) {
+        if (intent.category === 'REJECT')
+            return false;
+        if (!this.enableToolIsolation)
+            return this.has(toolName);
+        if (!this.has(toolName))
+            return false;
+        const realms = this.resolveRealms(toolName);
+        return realms.has(intent.category);
+    }
+}
+/** Pure classifier for tests and for the default realm tag. */
+export function classifyByPrefix(toolName) {
+    if (toolName.startsWith('local_'))
+        return 'LOCAL';
+    if (toolName.startsWith('cloud_'))
+        return 'CLOUD';
+    if (toolName.startsWith('sanitized_'))
+        return 'SANITIZED';
+    // Unknown realm — leave it as CLOUD so the cloud path can refuse it
+    // explicitly rather than silently routing into LOCAL.
+    return 'CLOUD';
+}
+/** Read the global upstream tool list without depending on the dsh-tools types.
+ *
+ * Cordis exposes registered services through a `ReflectService` proxy on
+ * `ctx`: accessing `ctx.tools` triggers a Proxy `get` trap that throws
+ * `cannot get property "tools" without inject` when the service has not yet
+ * been bound to the active fiber. This happens at apply() time if `tools`
+ * has not finished mounting — the loader wires inject dependencies AFTER
+ * the apply() body starts. Defensive: catch the proxy throw and return []
+ * so `DSH_NATIVE_REALM_MAP` simply skips the boot-time scan. The
+ * `tools/change` listener installed below catches up once tools become
+ * available.
+ */
+function upstreamTools(ctx) {
+    let candidate;
+    try {
+        candidate = ctx.tools;
+    }
+    catch {
+        return [];
+    }
+    if (candidate?.view === undefined)
+        return [];
+    const view = candidate.view();
+    const visible = view?.visible;
+    if (visible === undefined)
+        return [];
+    const out = [];
+    for (const [name, def] of visible.entries()) {
+        out.push({ name, description: def.description ?? '' });
+    }
+    return out;
+}
+export async function apply(ctx, config) {
+    // ToolsServiceImpl extends `Service`, so its constructor calls
+    // `ctx.reflect.provide('edgeTools', this)` for us. Do not call
+    // `ctx.provide` again — that would throw "service already registered".
+    // G8: Config now actually flows into the service — `enableToolIsolation`
+    // drives `filterTools` / `isToolAllowed`. Pre-G8 had `void config` here.
+    const service = new ToolsServiceImpl(ctx, config);
+    ctx.logger?.info?.('[edge-tools-registry] apply() called, ctx.edgeTools registered');
+    // Phase 5 (2026-08-26): wire `DSH_NATIVE_REALM_MAP` into the live registry.
+    // DSH tools are registered by other plugins (`@deepseek-ai/dsh-tool-web`,
+    // `dsh-tool-bash`, etc.) AFTER `edge-tools-registry` boots because they
+    // live in their own cordis rows. We apply the map immediately for tools
+    // already present, then subscribe to `tools/change` so any later
+    // registration auto-tags. The handler is a no-op for tools we don't care
+    // about (resolveRealm already falls back to classifyByPrefix).
+    const bootSnapshot = upstreamTools(ctx);
+    ctx.logger?.info?.(`[edge-tools-registry] boot scan: ${bootSnapshot.length} tools visible via ctx.tools`);
+    for (const tool of bootSnapshot) {
+        // Apply multi-realm native map first
+        const multiRealms = DSH_NATIVE_MULTI_REALM[tool.name];
+        if (multiRealms !== undefined) {
+            for (const r of multiRealms)
+                service.setRealm(tool.name, r);
+            continue;
+        }
+        // Then single-realm native map
+        const mapped = DSH_NATIVE_REALM_MAP[tool.name];
+        if (mapped !== undefined)
+            service.setRealm(tool.name, mapped);
+    }
+    if (bootSnapshot.length > 0) {
+        ctx.logger?.info?.(`[edge-tools-registry] boot snapshot: ${bootSnapshot.map((t) => t.name).join(', ')}`);
+    }
+    const onToolsChange = () => {
+        const after = upstreamTools(ctx);
+        if (after.length > bootSnapshot.length) {
+            ctx.logger?.info?.(`[edge-tools-registry] tools/change → ${after.length} tools now: ${after.map((t) => t.name).join(', ')}`);
+        }
+        for (const tool of after) {
+            const multiRealms = DSH_NATIVE_MULTI_REALM[tool.name];
+            if (multiRealms !== undefined) {
+                for (const r of multiRealms)
+                    service.setRealm(tool.name, r);
+                continue;
+            }
+            const mapped = DSH_NATIVE_REALM_MAP[tool.name];
+            if (mapped !== undefined)
+                service.setRealm(tool.name, mapped);
+        }
+    };
+    // ctx.on returns a disposer; capture so the apply() return closure can
+    // tear it down on plugin dispose.
+    const disposeChange = ctx.on?.('tools/change', onToolsChange);
+    return async () => {
+        disposeChange?.();
+    };
+}

package/lib/dsh-adapter/types.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Type-only re-exports of every DSH / Cordis surface consumed by the
+ * edge-agent plugins. No runtime side effects — this file is `.d.ts`-
+ * friendly and is the canonical place the UI / business layer reaches
+ * to learn upstream types.
+ *
+ * Boundary rule: code outside `src/dsh-adapter/` must NOT import
+ * `@deepseek-ai/*` directly. It must come through this facade or the
+ * services exposed in `src/dsh-adapter/<plugin>.js`.
+ *
+ * Schemastery note: `@deepseek-ai/schemastery` only ships a default
+ * export (`Schema`). Consumers should import that directly when they
+ * need a schema constructor. There is no `Schema`/`SchemaOptions`/
+ * `TypeSchema` named export to re-export here.
+ */
+export type { Context } from '@deepseek-ai/cordis';
+export type { Agent, AgentHandle, AgentStatus, AgentOptions, CreateAgentOptions, PreStepDecision, RequestErrorAction, InboxTarget, } from '@deepseek-ai/dsh-agent';
+export type { LlmAdapter, LlmCallConfig, LlmModelInfo, LlmRuntime, GenerateOptions, Message, StreamChunk, PreparedLlmCall, BlockAssembler, LlmError, LlmProviderInfo, LlmConfigurableProvider, AdapterRegistrationHandle, LlmFailure, } from '@deepseek-ai/dsh-llm';
+export type { Session, SessionId, SessionEvent, SessionHeader, SessionEventMap, TurnEndReason, EpochHeader, } from '@deepseek-ai/dsh-session';
+export type { ToolExecution, ToolExecutionResult, } from '@deepseek-ai/dsh-tools';
+export type { PromptSection, PromptAssembly, } from '@deepseek-ai/dsh-system-prompt';
+export type { Scope, ScopeKey, } from '@deepseek-ai/dsh-scope';
+//# sourceMappingURL=types.d.ts.map

package/lib/dsh-adapter/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/dsh-adapter/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,YAAY,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAElD,YAAY,EACV,KAAK,EACL,WAAW,EACX,WAAW,EACX,YAAY,EACZ,kBAAkB,EAClB,eAAe,EACf,kBAAkB,EAClB,WAAW,GACZ,MAAM,wBAAwB,CAAA;AAE/B,YAAY,EACV,UAAU,EACV,aAAa,EACb,YAAY,EACZ,UAAU,EACV,eAAe,EACf,OAAO,EACP,WAAW,EACX,eAAe,EACf,cAAc,EACd,QAAQ,EAER,eAAe,EACf,uBAAuB,EACvB,yBAAyB,EACzB,UAAU,GACX,MAAM,sBAAsB,CAAA;AAE7B,YAAY,EACV,OAAO,EACP,SAAS,EACT,YAAY,EACZ,aAAa,EACb,eAAe,EACf,aAAa,EACb,WAAW,GACZ,MAAM,0BAA0B,CAAA;AAEjC,YAAY,EACV,aAAa,EACb,mBAAmB,GACpB,MAAM,wBAAwB,CAAA;AAE/B,YAAY,EACV,aAAa,EACb,cAAc,GACf,MAAM,gCAAgC,CAAA;AAEvC,YAAY,EACV,KAAK,EACL,QAAQ,GACT,MAAM,wBAAwB,CAAA"}

package/lib/dsh-adapter/types.js

@@ -0,0 +1,16 @@
+/**
+ * Type-only re-exports of every DSH / Cordis surface consumed by the
+ * edge-agent plugins. No runtime side effects — this file is `.d.ts`-
+ * friendly and is the canonical place the UI / business layer reaches
+ * to learn upstream types.
+ *
+ * Boundary rule: code outside `src/dsh-adapter/` must NOT import
+ * `@deepseek-ai/*` directly. It must come through this facade or the
+ * services exposed in `src/dsh-adapter/<plugin>.js`.
+ *
+ * Schemastery note: `@deepseek-ai/schemastery` only ships a default
+ * export (`Schema`). Consumers should import that directly when they
+ * need a schema constructor. There is no `Schema`/`SchemaOptions`/
+ * `TypeSchema` named export to re-export here.
+ */
+export {};

package/lib/dsh-adapter/voice-input.d.ts

@@ -0,0 +1,30 @@
+/**
+ * voice-input — optional voice input channel. Wraps Whisper-tiny (or
+ * equivalent). Streams PCM in, emits text out, and feeds the result
+ * into the prompt-guard pipeline before landing in the agent inbox.
+ *
+ * @module dsh-edge-agent/voice-input
+ */
+import { Service } from '@deepseek-ai/cordis';
+import Schema from '@deepseek-ai/schemastery';
+export declare const name = "voice-input";
+export declare const inject: readonly ["sessions", "auditLog"];
+export interface Config {
+    modelPath: string;
+    /** VAD silence threshold in seconds. */
+    vadSilenceThreshold: number;
+    /** Sample rate. */
+    sampleRate: number;
+}
+export declare const Config: Schema<Config>;
+export interface VoiceInputService {
+    transcribe(audio: Uint8Array): Promise<string>;
+    transcribeStream(stream: AsyncIterable<Uint8Array>): Promise<string>;
+}
+export declare class VoiceInputServiceImpl extends Service {
+    constructor(ctx: any);
+    transcribe(audio: Uint8Array): Promise<string>;
+    transcribeStream(stream: AsyncIterable<Uint8Array>): Promise<string>;
+}
+export declare function apply(ctx: any, config: Config): Promise<() => Promise<void>>;
+//# sourceMappingURL=voice-input.d.ts.map

package/lib/dsh-adapter/voice-input.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"voice-input.d.ts","sourceRoot":"","sources":["../../src/dsh-adapter/voice-input.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAC7C,OAAO,MAAM,MAAM,0BAA0B,CAAA;AAE7C,eAAO,MAAM,IAAI,gBAAgB,CAAA;AAEjC,eAAO,MAAM,MAAM,mCAAoC,CAAA;AAEvD,MAAM,WAAW,MAAM;IACrB,SAAS,EAAE,MAAM,CAAA;IACjB,wCAAwC;IACxC,mBAAmB,EAAE,MAAM,CAAA;IAC3B,mBAAmB;IACnB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,eAAO,MAAM,MAAM,EAAE,MAAM,CAAC,MAAM,CAIhC,CAAA;AAEF,MAAM,WAAW,iBAAiB;IAChC,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAC9C,gBAAgB,CAAC,MAAM,EAAE,aAAa,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;CACrE;AAED,qBAAa,qBAAsB,SAAQ,OAAO;gBACpC,GAAG,EAAE,GAAG;IAGd,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;IAI9C,gBAAgB,CAAC,MAAM,EAAE,aAAa,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;CAI3E;AAED,wBAAsB,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAIlF"}

package/lib/dsh-adapter/voice-input.js

@@ -0,0 +1,34 @@
+/**
+ * voice-input — optional voice input channel. Wraps Whisper-tiny (or
+ * equivalent). Streams PCM in, emits text out, and feeds the result
+ * into the prompt-guard pipeline before landing in the agent inbox.
+ *
+ * @module dsh-edge-agent/voice-input
+ */
+import { Service } from '@deepseek-ai/cordis';
+import Schema from '@deepseek-ai/schemastery';
+export const name = 'voice-input';
+export const inject = ['sessions', 'auditLog'];
+export const Config = Schema.object({
+    modelPath: Schema.string().required(),
+    vadSilenceThreshold: Schema.number().default(0.6),
+    sampleRate: Schema.natural().default(16000),
+});
+export class VoiceInputServiceImpl extends Service {
+    constructor(ctx) {
+        super(ctx, 'voiceInput');
+    }
+    async transcribe(audio) {
+        void audio;
+        return '';
+    }
+    async transcribeStream(stream) {
+        void stream;
+        return '';
+    }
+}
+export async function apply(ctx, config) {
+    ctx.plugin(VoiceInputServiceImpl);
+    void config;
+    return async () => { };
+}