@dsh-edge/dsh-edge-agent 0.0.0-stage → 0.1.2

package/config/privacy-policy.json

@@ -0,0 +1,202 @@
+{
+  "version": "1.9.0",
+  "_comment": "sanitizationRules 的 pattern 必须与 src/dsh-adapter/pii-utils.ts 的 PII_PATTERNS 保持一致（tests/unit/pii-utils.test.ts 有一致性断言）。已移除 replacement 字段：占位符由 sanitizer-pipeline 自行生成为 [<PIITYPE>_<seq>]，该字段历史上不生效。",
+  "_categories_comment": "§7.110（默认本地，类别简并）：categories 只需要**肯定式定义例外**——CLOUD（需要公网信息）和 REJECT（危险请求）；其余一切（本地操作、日常问答、含 PII 的本地处理）都是默认 LOCAL，不设行。SANITIZED 不再单列：CLOUD 路径本来必经 sanitizer（fail-closed，脱不了敏不上云），含敏感数据的操作另有 PII LOCAL 正则护栏兜底。 jevIntents 同步收敛：只保留无歧义的 CLOUD/REJECT 信号标签（知识问答/通用咨询属日常问答 → 默认 LOCAL，不再进 CLOUD）。intent-router 在 policy 无 LOCAL 行时自动补 catch-all 提示行并放行 LOCAL 输出。",
+  "_stages_comment": "§7.109（语义优先裁决）：路由以 jev/LLM 的语义判决为主——stages.intent.semanticCloudMinConfidence 是操作者对分类器的信任阈值，语义判 CLOUD 且置信度 ≥ 阈值即出网（无需关键词佐证）。关键词/正则只作护栏与零成本快路径（REJECT 危险操作、PII LOCAL 安全网、内置新闻/天气类信号），不再为领域扩词——子串匹配易误命中（如「游戏攻略」）。stages.intent.cloudKeywords/localEntities/fallbackKeywords 仍是可用的扩展面（追加/替换语义见 §7.108），但默认为空。全部热重载。",
+  "categories": [
+    {
+      "id": "CLOUD",
+      "description": "需要检索公网上信息的任务：新闻、天气、行情、搜索引擎，以及旅游攻略、景点推荐、行程规划等需要实时公网信息的任务",
+      "examples": [
+        "今天北京天气",
+        "查一下最新的AI新闻",
+        "准备一个杭州游玩的攻略",
+        "规划一个西湖一日游"
+      ],
+      "jevIntents": [
+        "天气",
+        "新闻",
+        "搜索",
+        "旅游攻略",
+        "景点推荐",
+        "行程规划",
+        "weather",
+        "news",
+        "search",
+        "travel",
+        "travel_planning",
+        "attraction"
+      ]
+    },
+    {
+      "id": "REJECT",
+      "description": "高危 / 违法 / 违规请求（危险系统操作、破坏性命令、投诉、法务）",
+      "examples": [
+        "rm -rf /",
+        "drop table users",
+        "我要投诉"
+      ],
+      "jevIntents": [
+        "投诉",
+        "法务咨询",
+        "complaint",
+        "legal"
+      ]
+    }
+  ],
+  "routingRules": [
+    {
+      "pattern": "(导出|删除|清空|格式化).*(数据库|系统|磁盘|全部数据)",
+      "realm": "REJECT",
+      "confidence": 0.9,
+      "rationale": "危险系统操作"
+    },
+    {
+      "pattern": "(drop\\s+table|rm\\s+-rf|format\\s+[a-z]:|del\\s+/[fs])",
+      "realm": "REJECT",
+      "confidence": 0.95,
+      "rationale": "破坏性命令特征"
+    },
+    {
+      "pattern": "(本地|local|文件|file|计算|calculate|读取|写入)",
+      "realm": "LOCAL",
+      "confidence": 0.8,
+      "rationale": "本地操作不出设备"
+    },
+    {
+      "pattern": "(密码|password|secret|密钥|private.?key|token)",
+      "realm": "LOCAL",
+      "confidence": 0.9,
+      "rationale": "敏感凭据不得离开设备"
+    },
+    {
+      "pattern": "(身份证号|id.?card|银行卡|bank.?card|信用卡|credit.?card)",
+      "realm": "LOCAL",
+      "confidence": 0.95,
+      "rationale": "金融/身份类 PII 必须留在本地"
+    },
+    {
+      "pattern": "(手机号|电话号码|手机.{0,5}号|phone.?number|mobile.?number)",
+      "realm": "LOCAL",
+      "confidence": 0.95,
+      "rationale": "手机号 PII 必须留在本地"
+    },
+    {
+      "pattern": "(邮箱|电邮|email.?address|e-?mail)",
+      "realm": "LOCAL",
+      "confidence": 0.95,
+      "rationale": "邮箱 PII 必须留在本地"
+    },
+    {
+      "pattern": "(IP\\s*地址|服务器.{0,8}(IP|地址)|server\\s+IP|局域网.{0,8}(IP|地址))",
+      "realm": "LOCAL",
+      "confidence": 0.9,
+      "rationale": "IP 地址 PII 必须留在本地"
+    },
+    {
+      "pattern": "(家庭住址|住址|home\\s+address|通信地址)",
+      "realm": "LOCAL",
+      "confidence": 0.85,
+      "rationale": "家庭住址 PII 必须留在本地"
+    },
+    {
+      "pattern": "(联网|上网|网上查|搜索引擎|搜索一下网上|web search|search the web|look up online|weather forecast|天气预报|实时行情|股价|汇率|current price)",
+      "realm": "CLOUD",
+      "confidence": 0.8,
+      "rationale": "需要检索公网上的信息 → 才允许走云端 LLM"
+    }
+  ],
+  "stages": {
+    "intent": {
+      "_semantic_comment": "§7.123 (2026-10-27): raised 0.75 → 0.95. The bailian decision-model answers a `choice` question and frequently reports NO numeric confidence; the decoder then substitutes a synthetic 0.9 ('decisive-by-construction'). At 0.75 that placeholder was always >= threshold, so EVERY CLOUD verdict from that provider left the device with no public-web signal — the §7.107 gate was inert on the one path that talks to a cloud service. 0.95 sits above the synthetic placeholder so only a MEASURED high confidence can unlock the semantic path. §7.123 also added a provenance guard in code (Intent.confidenceReported): a synthetic confidence can never satisfy this threshold at all. Lower it only if your classifier genuinely reports calibrated confidences; 0.95 is the safe floor for a choice-style model.",
+      "semanticCloudMinConfidence": 0.95,
+      "deviceCommands": {
+        "_comment": "家庭设备操作正则层的扩展词表 —— 追加到内置词表（灯/空调/电视/窗帘…）。devices = 设备名词，actions = 动作词。改这里即时生效（热重载），不用重启 App。",
+        "devices": [],
+        "actions": []
+      }
+    }
+  },
+  "sanitizationRules": [
+    {
+      "pattern": "\\b[1-9]\\d{5}(?:19|20)\\d{2}(?:0[1-9]|1[0-2])(?:0[1-9]|[12]\\d|3[01])\\d{3}[\\dXx]\\b",
+      "dataClass": "secret",
+      "piiType": "id-card",
+      "keepPrefix": 6
+    },
+    {
+      "pattern": "\\b\\d{16,19}\\b",
+      "dataClass": "secret",
+      "piiType": "bank-card"
+    },
+    {
+      "pattern": "\\b1[3-9]\\d{9}\\b",
+      "dataClass": "confidential",
+      "piiType": "phone",
+      "keepPrefix": 7
+    },
+    {
+      "pattern": "[\\w.-]+@[\\w.-]+\\.\\w+",
+      "dataClass": "confidential",
+      "piiType": "email"
+    },
+    {
+      "pattern": "(?:sk-(?:proj-|ant-|live-|test-|org-)?[a-zA-Z0-9]{20,}|key-[a-zA-Z0-9]{16,}|api[_-]?key[_-]?[a-zA-Z0-9]{16,})",
+      "dataClass": "secret",
+      "piiType": "api-key"
+    },
+    {
+      "pattern": "(?:密码|口令|用户名|账号|账户|passwd|password|pwd|username|account|secret|access[ _-]?token|token|api[ _-]?key)[\"' 　]{0,2}(?:[:：=]|是|为|\\s+is\\s+)[\"' 　]?[^\\s\"'，,;；<>（）()]{3,64}",
+      "dataClass": "secret",
+      "piiType": "credential",
+      "replacement": "<PII_CREDENTIAL_n>"
+    },
+    {
+      "pattern": "(?<![vV\\d.])(?:(?:25[0-5]|2[0-4]\\d|1\\d{2}|[1-9]?\\d)\\.){3}(?:25[0-5]|2[0-4]\\d|1\\d{2}|[1-9]?\\d)(?!\\.?\\d)",
+      "dataClass": "confidential",
+      "piiType": "ip-address"
+    },
+    {
+      "pattern": "(?:[0-9A-Fa-f]{2}[:-]){5}[0-9A-Fa-f]{2}",
+      "dataClass": "confidential",
+      "piiType": "mac-address"
+    },
+    {
+      "pattern": "\\b(?:E[0-9A-Z]\\d{7}|G\\d{8})\\b",
+      "dataClass": "secret",
+      "piiType": "passport"
+    },
+    {
+      "pattern": "[京津沪渝冀豫云辽黑湘皖鲁新苏浙赣鄂桂甘晋蒙陕吉闽贵粤川青藏琼][A-Z][A-HJ-NP-Z0-9]{5}",
+      "dataClass": "confidential",
+      "piiType": "license-plate"
+    }
+  ],
+  "dataClassifications": [
+    {
+      "class": "public",
+      "defaultRealm": "CLOUD",
+      "ttlSeconds": 3600
+    },
+    {
+      "class": "internal",
+      "defaultRealm": "SANITIZED",
+      "ttlSeconds": 1800
+    },
+    {
+      "class": "confidential",
+      "defaultRealm": "LOCAL",
+      "ttlSeconds": 900
+    },
+    {
+      "class": "secret",
+      "defaultRealm": "LOCAL",
+      "ttlSeconds": 300
+    }
+  ],
+  "globalConstraints": {
+    "maxCloudRequestsPerMinute": 20,
+    "requireAttestation": false,
+    "blockIfTcbCompromised": true
+  }
+}

package/cordis.desktop-safe.patch.yml

@@ -0,0 +1,129 @@
+# dsh-edge-agent — desktop-safe overlay
+#
+# This patch is intended for loading the bundle into an existing DSH Desktop /
+# Web profile through the Plugins page. Unlike the production `cordis.patch.yml`,
+# it **only inserts** the edge privacy stack. It does not rewrite host defaults:
+#
+#   - no system-prompt/persona override
+#   - no agent-default-model override
+#   - no approval/sandbox override
+#   - no session-root override
+#   - no http-api listener
+#   - no upstream tool/subagent/workflow disables
+#
+# What it does mount:
+#   - durable ops log + audit log
+#   - TCM stub + threat bus
+#   - Realm-aware skill/tool bridge
+#   - privacy policy + PII sanitizer
+#   - prompt guard + intent router + input guard orchestrator
+#   - §7.100 / §7.171 LLM routes: BOTH pools are DELEGATE adapters by default
+#     (they forward to the host profile's own configured model provider — the
+#     Desktop GUI's model picker — with host-side credential resolution; the
+#     bundle never reads any secret). A pool becomes a DIRECT (edge-owned) one
+#     only when its own endpoint is configured in config/edge.json
+#     (llm.local.baseUrl / llm.cloud.baseUrl).
+#
+# Notes:
+#   - §7.171 (2026-11-10) made llm.local symmetric with llm.cloud: with no
+#     `llm.local.baseUrl` the local route still registers, but forwards to the
+#     host provider. Consequence to be aware of: the internal LLM stages
+#     (intent classification / guard model-detection) are pinned to
+#     `local-llm`, so with no local endpoint they now run on the host's model
+#     and the text under inspection rides along. The 2026-10-18 ruling
+#     ("internal LLM calls must never borrow the host's cloud model") is
+#     therefore honoured only when a local endpoint IS configured — or when
+#     `llm.local.delegate=false`, which leaves the route unregistered and
+#     sends the stages back to their keyword/regex tier.
+#   - SANITIZED/CLOUD answers egress through the host's own provider — the
+#     same destination plain Desktop use already picks — after PII
+#     placeholder sanitization.
+#   - LLM-based guard/intent detection config comes from config/edge.json
+#     (stages.guard.* / stages.intent.*): both are ON by default, both point
+#     at `local-llm`, and intent-router falls back to keyword/policy rules
+#     when its classifier provider is unavailable.
+#   - The privacy pipeline still intercepts every agent step. That is expected:
+#     this is what makes it an edge-agent. If you want zero behavior change,
+#     set DSH_EDGE_INPUT_GUARD=false before starting/restarting the profile.
+
+- id: tool-web
+  disabled: false
+  config:
+    search: true
+    fetch: true
+    searchMaxResults: 8
+    searchTimeoutMs: 30000
+    fetchTimeoutMs: 30000
+- id: web
+  config:
+    searchProvider: tavily-bocha-fallback
+    fetchProvider: http
+- id: web-search-deepseek
+  disabled: true
+
+# ── 本 bundle 留在宿主树的三行（§7.136）──────────────────────────────────
+# 理由见 scripts/_isolate-edge-group.mjs 的文件头：
+#   dsh-edge-agent（裸包名）—— 宿主 client-modules 只扫宿主 Loader 的 entries，
+#     preset 树不在其中 ⇒ Edge tab 的浏览器半边只能从这里被发现；
+#   audit-log / file-logger —— 裸包名行 inject auditLog，且它的 installFileLogger
+#     会先占住 fileLogger 服务名 ⇒ 两者必须在 root realm，且 file-logger 行要更早装载。
+- insert:
+    # §7.101.x (2026-10-20, fix #5) + §7.136: the BARE-package host-half row.
+    # The webview client-module system (@deepseek-ai/dsh-client-modules) scans
+    # LOADER ENTRY NAMES for a `dsh.client` declaration — and its package
+    # locator only accepts bare package-root specifiers (`exactPackageSpecifier`),
+    # so subpath rows like '@scope/pkg/audit-log' can never surface the
+    # bundle's browser half. dsh-context shows the working shape: one bare
+    # row (`name: dsh-context`) whose main entry IS the plugin AND whose
+    # manifest carries `dsh.client.platform: "web"`.
+    #
+    # §7.136: this row must stay in the HOST tree. client-modules scans
+    # `ctx.loader.entries()` — the host Loader's entries — while a preset's
+    # plugin list lives in its own EntryTree, outside that enumeration. A bare
+    # row inside the preset would therefore never surface the browser half and
+    # the Edge tab would vanish in every work mode.
+    - id: dsh-edge-agent
+      name: '@dsh-edge/dsh-edge-agent'
+
+    # Ops log exporter. Mount first so later plugin logs land on disk.
+    - id: file-logger
+      name: '@dsh-edge/dsh-edge-agent/file-logger'
+      config:
+        # §7.102 "one config file": only profile-specific statics live here.
+        # root / level / rotation come from config/edge.json (audit.*);
+        # no process.env reads — the desktop GUI never had them.
+        filename: dsh-edge-agent-desktop.log
+        flushIntervalMs: 1000
+        queueCapacity: 10000
+        maxFileSizeBytes: 52428800
+
+    # Security ledger. Default root stays isolated under ~/.dsh-edge-agent.
+    - id: audit-log
+      name: '@dsh-edge/dsh-edge-agent/audit-log'
+      config:
+        # §7.102 "one config file": minLevel / flush / root come from
+        # config/edge.json (audit.*). Only static wiring stays here.
+        ringBufferSize: 512
+        filename: audit.plain.jsonl
+        enablePIIRedaction: true
+        maxFileSizeBytes: 10485760
+        maxFileAgeDays: 7
+        maxRotatedFiles: 5
+
+    # §7.145: 桌面版「起不来」的根因修复（431）。
+    #
+    # 这一行**必须**留在宿主树（不是 preset）—— 它修的不是 Edge 行为，而是
+    # **宿主自己的启动**：Electron 外壳的 welcome 握手带着 Chromium cookie jar
+    # 出发，cookie 越攒越多 ⇒ 请求头爆 16 KB ⇒ 431 ⇒ 外壳拆宿主 ⇒
+    # 「DeepSeek Harness is unavailable」。握手发生在**任何工作方式选定之前**
+    # ⇒ 修它的插件也必须在 preset 之外。
+    #
+    # 它自带 `process.versions.electron` 判据 ⇒ headless profile 里直接跳过。
+    - id: desktop-cookie-janitor
+      name: '@dsh-edge/dsh-edge-agent/desktop-cookie-janitor'
+      config:
+        enabled: true
+        # 宿主 web 服务是裸 createServer（16 KB 头上限）；抬到 64 KB 让
+        # 一个已经攒胖的 cookie jar 也不会打死启动。
+        maxHeaderBytes: 65536
+