@dsh-edge/dsh-edge-agent 0.0.0-stage → 0.1.1

package/presets/edge.desktop-safe.patch.yml

@@ -0,0 +1,503 @@
+# ── 边缘模式 preset（§7.135）──────────────────────────────────────────
+#
+# 宿主 DSH 的「Agent Preset」机制：preset 是一份 cordis insert patch，声明
+# 一行 `@deepseek-ai/dsh-agent-preset`，其 `config.plugins` 是该工作方式
+# 的**完整**插件行列表。宿主内置四种工作方式，都由 bundle 的 patch 文件
+# 声明（@deepseek-ai/dsh-web-app/presets/*.patch.yml）：
+#
+#   standard —— 标准模式：persona / 工具 / plan-mode / compaction /
+#               delegation / subagent …
+#   ptc / minimal / cordis —— 另外三种
+#
+# 本文件声明**边缘模式**：标准模式的插件列表 **+ 本项目的功能**（隐私护栏、
+# 意图判定、路由决策、PII 脱敏、两个 LLM adapter、Realm 闸门、威胁总线、
+# Edge 面板）。主人裁决（2026-10-28）：
+#
+#   「我需要在 dsh 桌面上出一新的 agent 工作时间，叫做边缘模式，功能是在
+#     标准模式之上增加本项目的功能」
+#   「只有选择 边缘模式 才会出现 edge tab」
+#
+# ## 本项目的插件行在哪（§7.136 修正）
+#
+# 行为面（护栏 / 判定 / 路由 / 脱敏 / Realm / Edge 面板）**在这里**，并且整体
+# 关进一个 `cordis:group` + `isolate` 隔离 realm —— 宿主规则（dsh-agent-preset-
+# registry README）：「preset 的服务提供方及其消费方必须共享同一个 cordis:group
+# 隔离 realm」。挂载审计（lib/types/mount.js）会把「挂在 preset 子树里却把服务
+# 存进 root realm」的行判为泄漏 ⇒ 整个 preset 挂载失败 ⇒ 设置页那张卡显示
+# 「加载失败」。这正是 §7.135 那版预设加载失败的原因。
+#
+# **三行必须留在宿主树**（bundle 顶层 insert 段）—— 宿主机制的限制，不是偏好：
+#
+#   dsh-edge-agent（裸包名行）—— 宿主的 client-modules 只扫**宿主 Loader 的
+#     entries**（dsh-client-modules/lib/index.js：「scans the host Loader's
+#     entries」；processOne() 遍历 `this.ctx.loader.entries()`），preset 的插件树
+#     是独立的 EntryTree、不在其中 ⇒ Edge tab 的浏览器半边只有从宿主树里的裸
+#     包名行才能被发现。
+#   audit-log / file-logger —— 裸包名行 inject ['auditLog']，且它 apply() 里的
+#     installFileLogger 会先占住 `fileLogger` 服务名 ⇒ 两者必须在 root realm，
+#     且 file-logger 行必须比裸包名行更早装载（否则桌面 ops log 的文件名会从
+#     `dsh-edge-agent-desktop.log` 退回 `dsh-edge-agent.log`）。
+#
+# ## 「切回标准模式会怎样」（§7.136 实测结论）
+#
+# 宿主的 preset 是**启动即挂载**的（dsh-agent-preset README：「声明会提前加载」）：
+# 声明过的 preset 在启动时都建好插件树，选哪个只决定 **Agent 绑到哪个 scope**
+# （可见的工具 / 提示词 / 服务）。所以：
+#
+#   * 本项目的插件在任何工作方式下都已挂载 —— 切回标准模式**不会**卸载它们；
+#     让标准模式变「纯宿主」的是**事件作用域**，不是卸载：
+#   * 我们的 hook（agent/pre-step / agent/request / system-prompt/assemble /
+#     tools/pre-execute / tools/result）**不再带 `{ global: true }`**。宿主的
+#     事件过滤（cordis EventsService.dispatch：
+#     `hook.global || !filter || filter.call(thisArg, hook.ctx)`）按 scope 链
+#     判定 —— 监听器自己的 scope 必须是派发 scope 或其祖先；Agent 的 scope 父
+#     链接到所选 preset 的代际 scope（dsh-agent-preset-registry 的
+#     `bindScopeParent`），事件沿 scope 链向上流、不向下 ⇒ 标准模式的 Agent
+#     收不到边缘模式 preset 里的 hook ⇒ 标准模式不经过本项目的护栏；
+#   * `llm/stream` 保留 `{ global: true }`：该事件不带 scope 载体（去掉也不
+#     生效），且无 pre-step state 时恒直通；
+#   * Edge tab 的浏览器半边是全局的（客户端只有一张全局 boot 图，tab 类型是
+#     全局注册表），所以「只有边缘模式才有 edge tab」由**客户端按 roster 的
+#     默认 preset 注册/注销 tab 类型**实现（src/client/index.ts，5s 轮询
+#     `agentPresets.list()` 的 `isDefault`）。
+#
+# ## 为什么标准模式的行是抄来的
+#
+# 注册表**不合并**：preset 的 plugins 是完整列表，覆盖式（宿主原文：「用户覆盖
+# 替换完整子插件列表，不自动合并内置列表的未来更新」）。所以边缘模式要
+# 「在标准模式之上增加」，就必须把标准模式的行**整份抄进来**。
+#
+# 代价要说清楚：**宿主升级后标准模式的插件列表若变了，边缘模式不会自动跟随**
+# —— 需要人把宿主的
+#   @deepseek-ai/dsh-web-app/presets/standard.patch.yml
+# 重新对齐到本文件。生成器 scripts/_gen-edge-preset.mjs 就是干这件事的。
+#
+# ## 主机 row 的覆盖留在顶层
+#
+# 本 bundle 顶层对宿主行的覆盖（tool-web / web / web-search-deepseek）是
+# **patch 层**语义 —— preset 只能声明插件行，不能覆盖宿主行。所以这些覆盖
+# 在任何工作方式下都生效。这是 preset 机制的边界，如实记录在此。
+
+- insert:
+    - id: preset-edge
+      name: '@deepseek-ai/dsh-agent-preset'
+      config:
+        id: edge
+        name: 边缘模式
+        description: 标准模式 + 本项目的端侧隐私能力（意图判定 / 路由决策 / PII 脱敏 / Realm 闸门）
+        order: 5
+        plugins:
+          # §7.175（2026-11-11）：这里**故意没有** `agent-default-model` 行；
+          # §7.176（2026-11-11）起，本地模型默认值改由**本 preset 内的
+          # input-guard** 给出（见下面 edge-stack 组里的 input-guard 行）。
+          #
+          # 实测（桌面 App 日志 2026-11-11 10:24 / 10:26，两次启动一致）：
+          #   WARN [agent-preset-registry] agent preset edge:
+          #     agent-default-model (@deepseek-ai/dsh-agent-default-model):
+          #     service "agentDefaultModel" has been registered at <AgentDefaultModelConfig>
+          # ⇒ 加了这一行，**整个边缘模式 preset 挂载失败**（设置页那张卡显示
+          # 「加载失败」），Edge 模式用不了。
+          #
+          # 根因：宿主 dsh-base/cordis.patch.yml L90-94 已经在 **host scope** 声明了
+          # 同一个插件（provider: deepseek-official / model: deepseek-flash）；该插件
+          # 用 `super(ownerContext, "agentDefaultModel")` 注册 cordis service，
+          # 而这个 service 名**跨 scope 唯一** ⇒ preset scope 再声明一次 ⇒ 撞名。
+          #
+          # ⚠️ 本文件此前写的理由（「service 注册在插件所在 scope，scope 查找就近 ⇒
+          # preset 内就近拿到这一行、遮蔽 host scope 的全局默认」）是**推断，实测证伪**
+          # —— 真正的读取方是 host scope 的那份：
+          # `dsh-api-session-controller` 的 `agentOptions()` 读 `this.ctx.agentDefaultModel`，
+          # preset scope 里那份即使不撞名也**没有读者**。
+          #
+          # §7.176：为什么由 input-guard 给默认值，而不是这一行：
+          #   1. 宿主 0.2.2-rc.1 起，路由只由**会话级** modelSelection 决定
+          #      （`agent/request` 里改写会被 prepareRequest() 判非法并抛错）；
+          #   2. 桌面 GUI 建的 agent，其 agentOptions 来自 host scope 的
+          #      agentDefaultModel（宿主自带的云端模型）⇒ 边缘模式默认会跑云端；
+          #   3. 本地路由 local-llm 在模型目录里隐身（§7.106 Option A：它是管线
+          #      内部件，不是用户可选项）⇒ GUI 里**选不到**它，用户没法手动纠正；
+          #   ⇒ 只能由 preset 侧把会话选择钉成 local-llm。input-guard 用的是宿主
+          #      自己的合规入口 `agent.model.select()`（agent-loop 的
+          #      applyConfiguredRoute() 也是这么写的），**不动**宿主的全局默认 ——
+          #      `sessionController.selectModel()` 会顺手 `saveSelection()` 改全局，
+          #      那样会波及同 profile 的标准模式。
+          #
+          # 主人裁决（2026-11-11）：**npm 包里不会带本地模型配置**（config/edge.json
+          # 被 `files` 白名单排除）⇒ local-llm 走 DELEGATE（§7.171）转发宿主
+          # provider ⇒ 装上就能用（先用 dsh 自带的云端模型），而 provider 身份仍是
+          # local-llm ⇒ §7.175 的 fail-closed 闸门照样放行。
+          # 实测记录见 docs/PROGRESS.md §7.175 / §7.176。
+          - id: persona
+            name: '@deepseek-ai/dsh-persona'
+            config:
+              prefix: You are a coding agent powered by the {{model}} model.
+          - id: agent-instructions
+            name: '@deepseek-ai/dsh-agent-instructions'
+            config:
+              maxBytes: 65536
+          - id: time-context
+            name: '@deepseek-ai/dsh-time-context'
+          - id: tool-bash
+            name: '@deepseek-ai/dsh-tool-bash'
+            disabled: !!js process.platform === 'win32'
+          - id: tool-pwsh
+            name: '@deepseek-ai/dsh-tool-pwsh'
+            disabled: !!js process.platform !== 'win32'
+          - id: tool-fs
+            name: '@deepseek-ai/dsh-tool-fs'
+            config:
+              # §7.174：随宿主 0.2.2-rc.1 的 standard preset 对齐 ——
+              # Set false to drop the apply_patch tool beside edit.
+              applyPatch: false
+          - id: tool-fs-search
+            name: '@deepseek-ai/dsh-tool-fs-search'
+            config:
+              sampleOverCapGlobResults: false
+          - id: tool-jobs
+            name: '@deepseek-ai/dsh-tool-jobs'
+          - id: tool-schedule
+            name: '@deepseek-ai/dsh-tool-schedule'
+          - id: skill-filesystem
+            name: '@deepseek-ai/dsh-skill-filesystem'
+          - id: tool-skill
+            name: '@deepseek-ai/dsh-tool-skill'
+          - id: command-goal
+            name: '@deepseek-ai/dsh-command-goal'
+          - id: tool-goal
+            name: '@deepseek-ai/dsh-tool-goal'
+          - id: planning
+            name: cordis:group
+            group: true
+            isolate:
+              planMode: true
+            config:
+              - id: plan-mode
+                name: '@deepseek-ai/dsh-plan-mode'
+                config:
+                  section: |
+                    You are in plan mode. Stay in plan mode until the user approves your plan through exit_plan_mode or switches the session mode. Imperative language to implement changes means plan the implementation, not execute it. A user's conversational agreement — including an answer confirming something you asked — approves nothing and does not end plan mode; fold the confirmed decision into the plan and submit it through exit_plan_mode.
+
+                    Explore first. Use non-mutating reads, searches, static analysis, and checks to ground the plan in the actual repository. Do not edit or write files, change configuration, run formatters or code generation that rewrites tracked files, commit, or otherwise carry out the plan. Prefer existing functions and patterns over new machinery.
+
+                    The tool catalog stays the same across modes for request-cache stability. These plan-mode rules override any later tool description or guidance that suggests using mutation tools; those tools remain listed to keep the tool catalog unchanged. Do not use todo_write to track this planning phase: it tracks implementation after an approved plan, while the plan itself belongs in exit_plan_mode.
+
+                    Resolve discoverable facts by inspection. Use ask_user_question only for user-owned choices or material ambiguity that inspection cannot answer. Do not ask the user where code lives or how current behavior works when you can find out.
+
+                    Make the plan decision-complete: state the goal and success criteria; group implementation changes by subsystem; identify public API, schema, and data-flow changes; cover edge cases, failure modes, tests, acceptance criteria, and explicit assumptions. Keep it concise enough to review but detailed enough that another engineer can implement it without making design decisions.
+
+                    When ready, call exit_plan_mode with the complete plan markdown, starting with a # title. Make exit_plan_mode the only and final tool call in that assistant response: it presents the plan for approval, and implementation begins only in a later step after approval. Do not paste the final plan as a plain reply or ask "should I proceed?" through prose or ask_user_question. If review rejects it, incorporate the feedback and present again. If the review channel is unavailable or aborted, stay in plan mode and ask the user to switch modes manually; do not proceed with implementation.
+          - id: compaction
+            name: cordis:group
+            group: true
+            isolate:
+              compaction: true
+              toolResultPruner: true
+            config:
+              - id: compaction-basic
+                name: '@deepseek-ai/dsh-compaction-basic'
+              - id: command-compact
+                name: '@deepseek-ai/dsh-command-compact'
+              - id: tool-result-pruner
+                name: '@deepseek-ai/dsh-compaction-tool-result-pruner'
+                config:
+                  thresholdChars: 8192
+                  headChars: 4096
+                  tailChars: 1024
+          - id: delegation
+            name: cordis:group
+            group: true
+            isolate:
+              workflowEngine: true
+            config:
+              - id: tool-subagent-control
+                name: '@deepseek-ai/dsh-tool-subagent-control'
+              # §7.174：宿主 0.2.2-rc.1 的 dsh-tool-subagent-control **不再导出**
+              # './list-agents' 子路径（exports 只剩 . / ./src/* / ./package.json /
+              # ./locale/*.json）⇒ 保留这行会在 preset 挂载时抛
+              # ERR_PACKAGE_PATH_NOT_EXPORTED ⇒ 整个 edge preset 被判 broken
+              # ⇒ 设置页「边缘模式」消失。宿主四个内置 preset（standard/ptc/
+              # minimal/cordis）**都没有这一行** ⇒ 按宿主现状删除。
+              - id: tool-subagent
+                name: '@deepseek-ai/dsh-tool-subagent'
+                config:
+                  provider: spawn
+                  toolName: subagent
+                  # §7.136 曾经**故意不写** modelSelection（那时宿主键名是
+                  # `modelSelectionSettings`）：旧宿主的 per-agent 安装路径在
+                  # tools/change 重投时会二次 install() ⇒ 同一 scope 重复注册
+                  # 'subagent'。上游已改为「挂载时注册一次」，且宿主现在的
+                  # standard/ptc/cordis preset 都写着这两项 ⇒ §7.174 对齐，
+                  # 边缘模式恢复「子 Agent 选模型」参数。
+                  modelSelection: true
+                  modelDiscovery: true
+              - id: tool-subagent-fork
+                name: '@deepseek-ai/dsh-tool-subagent'
+                config:
+                  provider: fork
+                  toolName: subagent_fork
+              - id: workflow-ptc
+                name: '@deepseek-ai/dsh-workflow-ptc'
+                config:
+                  provider: spawn
+              - id: tool-workflow
+                name: '@deepseek-ai/dsh-tool-workflow'
+          - id: tool-ask-user
+            name: '@deepseek-ai/dsh-tool-ask-user'
+          - id: tool-todo
+            name: '@deepseek-ai/dsh-tool-todo'
+            config:
+              allowParallelInProgress: true
+          - id: tool-web
+            name: '@deepseek-ai/dsh-tool-web'
+            config:
+              fetch: true
+              searchTimeoutMs: 60000
+          - id: present
+            name: '@deepseek-ai/dsh-tool-present'
+          - id: tool-plugin-manager
+            name: '@deepseek-ai/dsh-plugin-manager/tools'
+            disabled: true
+          - id: tool-plugin-market
+            name: '@deepseek-ai/dsh-plugin-market/tools'
+            disabled: true
+
+          # ── 边缘模式：本项目的功能（§7.135 + §7.136）──────────────────────
+          #
+          # 宿主规则（dsh-agent-preset-registry README）：
+          #   「preset 的服务提供方及其消费方必须共享同一个 cordis:group 隔离 realm」
+          # 挂载审计（lib/types/mount.js）：preset 子树里的服务如果存进 root realm
+          # ⇒ 泄漏 ⇒ 整个 preset 挂载失败（设置页那张卡显示「加载失败」）。
+          # 所以本组用 cordis:group + isolate 把组内每一行提供的服务关进组内 realm：
+          # 组内互相可见，组外（宿主）看不见 ⇒ 不泄漏。
+          #
+          # isolate 名单由 scripts/_isolate-edge-group.mjs 从源码推导
+          # （super(ctx,'<svc>')），门禁 scripts/verify-preset-isolate.ts 复核 ——
+          # 改源码后必须重跑本脚本。
+          - id: edge-stack
+            name: cordis:group
+            group: true
+            isolate:
+              edgeContextView: true
+              edgeTools: true
+              functionCallExternal: true
+              inputGuard: true
+              intentRouter: true
+              modelRouter: true
+              privacyPolicy: true
+              promptGuard: true
+              realmSkillBridge: true
+              sanitizer: true
+              tcm: true
+              tdBus: true
+            config:
+              # Stub TCM. Real crypto remains future work; keep shape stable.
+              - id: tcm
+                name: '@dsh-edge/dsh-edge-agent/tcm'
+                # §7.102 "one config file": teeType / keyStorePath come from
+                # config/edge.json (tee.*) inside the plugin — no row config.
+
+              # Privacy policy engine. Missing file falls back to built-in v1.6 policy.
+              - id: privacy-policy
+                name: '@dsh-edge/dsh-edge-agent/privacy-policy'
+                inject: [auditLog]
+                # §7.102 "one config file": policyPath / hot-reload knobs come from
+                # config/edge.json (privacy.*).
+
+              # Threat bus. Thresholds come from config/edge.json (threat.*) — §7.102.
+              # Desktop-safe keeps the looser default threshold.
+              - id: td-bus
+                name: '@dsh-edge/dsh-edge-agent/td-bus'
+                inject: [auditLog, privacyPolicy]
+                config:
+                  windowSeconds: 60
+                  thresholds:
+                    failedSanitizationStreak: 3
+                    permissionDeniedStreak: 5
+
+              # Edge tool registry. Do not isolate tools by default in desktop mode.
+              - id: edge-tools-registry
+                name: '@dsh-edge/dsh-edge-agent/tools'
+                inject: [auditLog, tools]
+                config:
+                  defaultRateLimitPerMinute: 60
+                  enableToolIsolation: false
+                  presentationMode: native
+
+              # §7.120: 封堵「bash 里直接调 etscli 写子命令」这条逃逸口。
+              #
+              # 独立行（不挂 etscli-tools）⇒ 桌面**只多一道闸**，不新增那 14 个
+              # 只读 etscli 工具。监听器挂在 `tools/pre-execute` waterfall 上，
+              # 按 scope 链派发 ⇒ 只有边缘模式会话够得着它，标准模式不受影响
+              # （§7.140 的「标准模式零 edge 事件」不变式）。
+              - id: etscli-shell-guard
+                name: '@dsh-edge/dsh-edge-agent/etscli-shell-guard'
+
+              # Realm-aware skill/tool filtering. Uses the shared realm config file.
+              - id: realm-skill-bridge
+                name: '@dsh-edge/dsh-edge-agent/realm-skill-bridge'
+                inject: [auditLog, skills, edgeTools, tools]
+                # §7.102 "one config file": configPath / hot-reload knobs come from
+                # config/edge.json (privacy.realm*).
+
+              # Input guard. Model-assisted detection config comes from
+              # config/edge.json (stages.guard.*) — §7.102.
+              - id: prompt-guard
+                name: '@dsh-edge/dsh-edge-agent/prompt-guard'
+                inject: [privacyPolicy, auditLog, llm]
+                config:
+                  maxInputLength: 10000
+                  maxRequestsPerMinute: 20
+                  enablePIIRedaction: true
+                  enableInjectionDetection: true
+                  enableRateLimit: true
+
+              # Reversible PII sanitizer. Session limits come from
+              # config/edge.json (privacy.*) — §7.102.
+              - id: sanitizer-pipeline
+                name: '@dsh-edge/dsh-edge-agent/sanitizer-pipeline'
+                inject: [privacyPolicy, auditLog]
+                config:
+                  enableAutoDetection: true
+                  maxReplacementsPerSession: 1024
+
+              # Intent router. Classifier config comes from config/edge.json
+              # (stages.intent.*) — §7.102. Classifier provider may be absent;
+              # fail-open to keywords.
+              - id: intent-router
+                name: '@dsh-edge/dsh-edge-agent/intent-router'
+                inject: [llm, auditLog, privacyPolicy]
+
+              # §7.100 cloud-llm = DELEGATE route. baseUrl deliberately absent →
+              # Schema default '' → every CLOUD/SANITIZED turn is forwarded to the
+              # host profile's own configured model provider (GUI picker wins; probe
+              # falls back to live host routes). Credential resolution stays entirely
+              # on the host side — this bundle reads no secrets.
+              # §7.102: the pool + delegate knobs come from config/edge.json
+              # (llm.cloud.*) — the patch row no longer reads process.env.
+              - id: cloud-llm-adapter
+                name: '@dsh-edge/dsh-edge-agent/cloud-llm-adapter'
+                inject: [llm, auditLog]
+                config:
+                  providers: [cloud-llm]
+
+              # §7.102 (2026-10-21): local-LLM configuration moved OUT of the cordis
+              # patch and into config/edge.json (llm.local.*). The patch row no
+              # longer reads process.env — the desktop GUI starts the bundle without
+              # sourcing any .env.sh, so every `process.env.DSH_EDGE_LOCAL_LLM_*`
+              # lookup here resolved to undefined and the adapter fell back to a
+              # hard-coded 127.0.0.1:8080 that collided with unrelated daemons.
+              #
+              # The adapter now reads the pool from config/edge.json itself:
+              #   - baseUrl set    → DIRECT: the local-LLM route talks to that
+              #     OpenAI-compatible endpoint with the key named by
+              #     `llm.local.keyRef` (omit keyRef when the endpoint is open).
+              #   - baseUrl unset  → §7.171 DELEGATE: the route IS registered, but
+              #     forwards to the host profile's provider (symmetric with
+              #     cloud-llm). `llm.local.delegate=false` is the kill switch
+              #     that leaves the route unregistered.
+              #   - Internal LLM stages (intent classification / guard model-detect)
+              #     point here EXCLUSIVELY per the 2026-10-18 privacy ruling; they
+              #     never target cloud-llm. Note: with DELEGATE they run on the
+              #     host's model — configure a local endpoint to keep them on
+              #     device.
+              - id: local-llm-adapter
+                name: '@dsh-edge/dsh-edge-agent/local-llm-adapter'
+                inject: [llm, auditLog]
+                config:
+                  providers: [local-llm]
+
+              # Route catalog so /v1-style enumeration & intent-router soft-dep see
+              # both routes with registry truth (§7.100 isAvailable).
+              - id: model-router
+                name: '@dsh-edge/dsh-edge-agent/model-router'
+                inject: [llm]
+                config:
+                  localModels: [local-llm]
+                  cloudModels: [cloud-llm]
+
+              # Optional external tool caller; disabled by default. Knobs come from
+              # config/edge.json (functionCallExternal.*) — §7.102.
+              - id: function-call-external
+                name: '@dsh-edge/dsh-edge-agent/function-call-external'
+                inject: [auditLog, realmSkillBridge, tools]
+
+              # Orchestrator. This is the actual global hook installer.
+              - id: input-guard
+                name: '@dsh-edge/dsh-edge-agent/input-guard'
+                # §7.176 (2026-11-11): 本行是**边缘模式本地模型默认值的给出点** ——
+                # input-guard 监听 `agent/created`，用宿主的合规入口
+                # `agent.model.select()` 把会话级 modelSelection 钉成 local-llm
+                # （宿主 0.2.2-rc.1 起路由只由会话级选择决定，而 GUI 里选不到
+                # local-llm —— §7.106 Option A 它在模型目录里隐身）。
+                # 详见 docs/PROGRESS.md §7.176。
+                inject: [promptGuard, privacyPolicy, intentRouter, sanitizer, auditLog, realmSkillBridge]
+                config:
+                  sanitizeLocalTraffic: false
+                  # §7.179 (2026-11-11): 本 preset 的 id。`agent-preset/selected`
+                  # 是**全局**事件（宿主 registry 直接 ctx.emit，不带 scope 载体）
+                  # ⇒ input-guard 必须自己按 presetId 过滤，否则会把标准模式的
+                  # 会话也钉成 local-llm。必须与上面 `config.id` 一致 ——
+                  # scripts/verify-preset-isolate.ts 复核这一点。
+                  presetId: edge
+
+              # §7.101 Edge tab host half: folds the audit stream into the four panel
+              # row-lists + session summary and serves them on /api/dsh-edge/context.
+              # Hard dep is auditLog only (the sole live data source — see
+              # docs/notes/dsh-context-walkthrough.md ruling E); `connection` arms
+              # deferred, so headless profiles mount the plugin without the route.
+              #
+              # §7.101.x (2026-10-20, fix #2, SUPERSEDED by fix #4 below): BARE
+              # package name was tried after v7's ERR_PACKAGE_PATH_NOT_EXPORTED,
+              # but the bare name makes the loader mount the MAIN entry plugin
+              # (`dsh-edge-agent` host half) under this `edge-context-view` entry
+              # id — and the host half's apply() (via plugin.ts) touched the
+              # undeclared `ctx.event` service, so cordis reported:
+              #   "1 entry did not activate edge-context-view:
+              #    Error: cannot get property 'event' without inject"
+              # (live evidence: desktop plugin-manager reload, 2026-10-20).
+              #
+              # §7.101.x (2026-10-20, fix #4): the REAL v7 bug was exports pointing
+              # at the removed dotted layout (lib/types/dsh-adapter/*). With the
+              # flat-layout move (tsconfig outDir -> lib, exports -> lib/dsh-adapter/*,
+              # package.json#main -> lib/index.js matching dsh-context), the subpath
+              # name resolves cleanly through exports['./edge-context-view'] to
+              # lib/dsh-adapter/edge-context-view.js (import-proven on this host).
+              # This row now mounts the ACTUAL view plugin (src declares
+              # inject = ['auditLog'] + deferred `connection` inside apply());
+              # plugin.ts's ctx.event emit is also best-effort-wrapped so the host
+              # half can never again poison this entry.
+              #
+              # §7.101.x (2026-10-20, fix #1, still active): no `inject:` / `config:`
+              # fields — cordis 0.2.1-rc.2 patch loader SILENTLY SKIPS both (Bug 1,
+              # docs/dev-notes/cordis-rc021-patch-loader.md). The plugin declares
+              # its deps in src; runtime knobs come from process.env inside apply().
+              - id: edge-context-view
+                name: '@dsh-edge/dsh-edge-agent/edge-context-view'
+
+              # §7.107 (2026-10-23): web search aggregator — Tavily → 博查 AI →
+              # DeepSeek（三级链，§7.82）。它的 Tier-3 DeepSeek 用
+              # `web_search_20250305` server tool 打 DeepSeek Messages API，凭据读
+              # config/edge.json 的 secrets.deepseekApiKey —— 不依赖环境变量，所以
+              # CLI 起的 profile（dsh-http）也能用。
+              - id: web-search-tavily-bocha
+                name: '@dsh-edge/dsh-edge-agent/web-search-tavily-bocha'
+
+      # ── web capability: DEEPSEEK Search + Fetch（§7.107）──────────────────────
+      #
+      # §7.107 的路由规则把「需要检索公网上的信息」定为唯一允许出网的操作 ——
+      # 那这条路径就得真的能搜公网、真的能抓网页，否则规则没有意义。
+      #
+      #   - search → 本仓的 aggregator（Tavily → 博查 → DeepSeek）；DeepSeek 是
+      #     链上的兜底也是唯一不依赖环境变量的后端。
+      #   - fetch  → 宿主的 'http' provider（dsh-web-fetch-http，dsh-base 自带，
+      #     匿名公共 HTTP(S) 抓取，自带目的地校验）。
+      #
+      # dsh-web-app 层把 tool-web 禁掉了（桌面版默认不带网工具）；这里重新启用。
+      # realm 桥仍然管着：web_search / web_fetch 是 CLOUD realm 的工具
+      # (tools.ts 的 DSH_NATIVE_REALM_MAP)，LOCAL realm 下不可见 —— 也就是只有
+      # §7.107 允许出网的那些轮次能用它们。
+      #
+      # 注意：这些是宿主 row 的覆盖（disabled / config），不是 insert。上游
+      # 'deepseek-official' search provider 必须禁掉 —— aggregator 内部私有一份
+      # DeepSeekSearchProvider，两个都注册会让 seam 报 WEB_PROVIDER_AMBIGUOUS
+      # （与 cordis.patch.yml 的 web 段同因同解）。