@dsh-edge/dsh-edge-agent 0.0.0-stage → 0.1.2

package/lib/dsh-adapter/index.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Main plugin entry — wires the dsh-edge-agent package together as a single
+ * Cordis plugin that mounts the privacy stack into a host context.
+ *
+ * Plugin surface (consumer of `@deepseek-ai/*`):
+ *   - name: 'dsh-edge-agent'
+ *   - inject: NONE — this entry is only the bundle's host half bootstrap.
+ *     apply() does NOT depend on `agents`/`llm`/`tools`/`sessions`/`invariants`
+ *     at the bundle top level. Each subordinate plugin declares its own
+ *     inject in its own file (e.g. `audit-log`, `intent-router`, ...).
+ *     Declaring deps here used to force cordis 0.2.1-rc.2 to hang pending
+ *     `invariants` (which the desktop webui profile does not provide) —
+ *     documented in docs/dev-notes/cordis-rc021-patch-loader.md.
+ *   - Config: full schemastery schema (matches cordis.yml row)
+ *   - apply: bootstraps the privacy stack and exposes sub-plugin
+ *     re-exports so the package root can be loaded as a single Cordis
+ *     plugin that mounts every sub-plugin via its own cordis.yml row.
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import Schema from '@deepseek-ai/schemastery';
+export declare const name = "dsh-edge-agent";
+export declare const inject: readonly [];
+export interface Config {
+    /** TEE backend preference. Platform-dependent; auto-detected when omitted. */
+    teeType?: 'simulated' | 'trustzone' | 'keystone' | 'sgx';
+    /** Path to the encrypted storage root. */
+    storageRoot?: string;
+    /** Privacy policy file path. Hot-reloaded on change. */
+    policyPath?: string;
+    /** Default privacy posture when the policy engine cannot classify. */
+    defaultDataLevel?: 'public' | 'sanitized' | 'internal';
+    /** Allow outbound OHTTP requests even when the relay is unreachable. */
+    allowFallbackTls?: boolean;
+    /** Number of recent turns to keep in the conversation slice. */
+    sessionWindowSize?: number;
+}
+export declare const Config: Schema<Config>;
+export declare function apply(ctx: Context, config: Config): Promise<() => Promise<void>>;
+export * from './tcm.js';
+export * from './local-storage.js';
+export * from './sessions.js';
+export * from './audit-log.js';
+export * from './privacy-policy.js';
+export * from './tools.js';
+export * from './realm-skill-bridge.js';
+export * from './prompt-guard.js';
+export * from './intent-router.js';
+export * from './model-router.js';
+export * from './local-llm-adapter.js';
+export * from './cloud-llm-adapter.js';
+export * from './sanitizer-pipeline.js';
+export * from './ohttp-gateway.js';
+export * from './secure-bridge.js';
+export * from './attestation.js';
+export * from './td-bus.js';
+export * from './voice-input.js';
+export * from './plugin-host.js';
+export { name as httpApiName, inject as httpApiInject, Config as HttpApiConfig, HttpApiServiceImpl, apply as httpApiApply } from './http-api.js';
+export type { HttpApiService } from './http-api.js';
+export * from './llm-adapters.js';
+export * from './edge-context-view.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/dsh-adapter/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/dsh-adapter/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,MAAM,MAAM,0BAA0B,CAAA;AAE7C,eAAO,MAAM,IAAI,mBAAmB,CAAA;AAOpC,eAAO,MAAM,MAAM,aAAc,CAAA;AAEjC,MAAM,WAAW,MAAM;IACrB,8EAA8E;IAC9E,OAAO,CAAC,EAAE,WAAW,GAAG,WAAW,GAAG,UAAU,GAAG,KAAK,CAAA;IACxD,0CAA0C;IAC1C,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,wDAAwD;IACxD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,sEAAsE;IACtE,gBAAgB,CAAC,EAAE,QAAQ,GAAG,WAAW,GAAG,UAAU,CAAA;IACtD,wEAAwE;IACxE,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,gEAAgE;IAChE,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED,eAAO,MAAM,MAAM,EAAE,MAAM,CAAC,MAAM,CAahC,CAAA;AAEF,wBAAsB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAyBtF;AAKD,cAAc,UAAU,CAAA;AACxB,cAAc,oBAAoB,CAAA;AAClC,cAAc,eAAe,CAAA;AAC7B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,qBAAqB,CAAA;AACnC,cAAc,YAAY,CAAA;AAC1B,cAAc,yBAAyB,CAAA;AACvC,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,mBAAmB,CAAA;AACjC,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,yBAAyB,CAAA;AACvC,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,kBAAkB,CAAA;AAChC,cAAc,aAAa,CAAA;AAC3B,cAAc,kBAAkB,CAAA;AAChC,cAAc,kBAAkB,CAAA;AAIhC,OAAO,EAAE,IAAI,IAAI,WAAW,EAAE,MAAM,IAAI,aAAa,EAAE,MAAM,IAAI,aAAa,EAAE,kBAAkB,EAAE,KAAK,IAAI,YAAY,EAAE,MAAM,eAAe,CAAA;AAIhJ,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AACnD,cAAc,mBAAmB,CAAA;AAMjC,cAAc,wBAAwB,CAAA"}

package/lib/dsh-adapter/index.js

@@ -0,0 +1,97 @@
+/**
+ * Main plugin entry — wires the dsh-edge-agent package together as a single
+ * Cordis plugin that mounts the privacy stack into a host context.
+ *
+ * Plugin surface (consumer of `@deepseek-ai/*`):
+ *   - name: 'dsh-edge-agent'
+ *   - inject: NONE — this entry is only the bundle's host half bootstrap.
+ *     apply() does NOT depend on `agents`/`llm`/`tools`/`sessions`/`invariants`
+ *     at the bundle top level. Each subordinate plugin declares its own
+ *     inject in its own file (e.g. `audit-log`, `intent-router`, ...).
+ *     Declaring deps here used to force cordis 0.2.1-rc.2 to hang pending
+ *     `invariants` (which the desktop webui profile does not provide) —
+ *     documented in docs/dev-notes/cordis-rc021-patch-loader.md.
+ *   - Config: full schemastery schema (matches cordis.yml row)
+ *   - apply: bootstraps the privacy stack and exposes sub-plugin
+ *     re-exports so the package root can be loaded as a single Cordis
+ *     plugin that mounts every sub-plugin via its own cordis.yml row.
+ */
+import Schema from '@deepseek-ai/schemastery';
+export const name = 'dsh-edge-agent';
+// Empty inject — see above. Subordinate plugins each declare their own
+// deps in their own .ts files; the bundle's host-half bootstrap does
+// not need any service to start. Mirrors dsh-context's pattern (its
+// inject is `['sessionProjections']` because it does need a projection
+// store; ours does not because we install our own ring buffer).
+export const inject = [];
+export const Config = Schema.object({
+    teeType: Schema.union([
+        'simulated',
+        'trustzone',
+        'keystone',
+        'sgx',
+    ]).description('TEE backend preference; auto-detected when omitted.'),
+    storageRoot: Schema.string().description('Path to the encrypted storage root (resolved at runtime).'),
+    policyPath: Schema.string().description('Privacy policy file path. Hot-reloaded on change.'),
+    defaultDataLevel: Schema.union(['public', 'sanitized', 'internal'])
+        .description('Default privacy posture when the policy engine cannot classify.'),
+    allowFallbackTls: Schema.boolean().description('Allow outbound OHTTP requests even when the relay is unreachable.'),
+    sessionWindowSize: Schema.natural().description('Number of recent turns to keep in the conversation slice.'),
+});
+export async function apply(ctx, config) {
+    // 0. Install the file-logger exporter (see ./file-logger.ts).
+    //
+    // All dsh-edge-agent plugins log through `ctx.logger.*`; without an
+    // external exporter those calls only land in Cordis's 1000-entry
+    // in-memory ring buffer and are lost on exit. We register a file
+    // exporter here, BEFORE any other plugin can call `ctx.logger.*` so
+    // the drift warning (next step) and every boot diagnostic land on
+    // disk. See `./file-logger.ts` for the persistence + rotation logic.
+    //
+    // - Gated by DSH_EDGE_LOG_FILE !== 'false' (default ON; tests opt out).
+    // - "First-wins" guard: if the DSH host already registered its own
+    //   file exporter, ours would double-write — skip instead.
+    const { installFileLogger } = await import('./file-logger.js');
+    installFileLogger(ctx);
+    // 1. Drift check — warn at boot when upstream DSH has moved.
+    const { upstreamDrift } = await import('./contract.js');
+    for (const entry of await upstreamDrift()) {
+        ctx.logger?.warn?.(`[dsh-edge-agent] upstream drift: ${entry.pkg} has ${entry.installed} (expected ${entry.expected})`);
+    }
+    // 2. Delegate to the real implementation under plugin.ts.
+    const { apply: bootstrap } = await import('./plugin.js');
+    return bootstrap(ctx, config);
+}
+// Convenience: re-export the canonical subpath plugins so that consumers
+// who `import '@dsh-edge/dsh-edge-agent'` can also
+// pull individual cordis rows out of the same module.
+export * from './tcm.js';
+export * from './local-storage.js';
+export * from './sessions.js';
+export * from './audit-log.js';
+export * from './privacy-policy.js';
+export * from './tools.js';
+export * from './realm-skill-bridge.js';
+export * from './prompt-guard.js';
+export * from './intent-router.js';
+export * from './model-router.js';
+export * from './local-llm-adapter.js';
+export * from './cloud-llm-adapter.js';
+export * from './sanitizer-pipeline.js';
+export * from './ohttp-gateway.js';
+export * from './secure-bridge.js';
+export * from './attestation.js';
+export * from './td-bus.js';
+export * from './voice-input.js';
+export * from './plugin-host.js';
+// http-api re-exports: skip `resolveRoute` — it collides with the canonical
+// `resolveRoute` from model-router.js (TS2308). http-api's local copy is only
+// exported for unit tests; consumers should use model-router's version.
+export { name as httpApiName, inject as httpApiInject, Config as HttpApiConfig, HttpApiServiceImpl, apply as httpApiApply } from './http-api.js';
+export * from './llm-adapters.js';
+// §7.101 v5: re-export edge-context-view so it is reachable from the package
+// root (`@dsh-edge/dsh-edge-agent`). The cordis patch row
+// in cordis.desktop-safe.patch.yml points at this name (bare package name,
+// matching dsh-context's pattern); without this re-export the package root
+// has no apply() for the host plugin and Edge tab remains invisible.
+export * from './edge-context-view.js';

package/lib/dsh-adapter/input-guard-messages.d.ts

@@ -0,0 +1,56 @@
+/**
+ * input-guard-messages — message-array helpers for the input guard.
+ *
+ * §7.123 (2026-10-27): these helpers lived at the bottom of
+ * `input-guard.ts` (2086 lines) inside the same file as the hook logic.
+ * They are pure functions over the agent's `messages` array — the part of
+ * the module that most benefits from being readable (and unit-testable) on
+ * its own, because the agent loop's message shape is the thing that keeps
+ * changing upstream.
+ *
+ * The contract they encode:
+ *   - `payload.messages` holds the REAL user turns;
+ *   - `decision.messages` may carry EXTRA synthetic user-role runtime
+ *     context appended by dsh-agent-instructions — that is NOT user
+ *     content and must never be rewritten;
+ *   - so rewriting is driven by indices collected from `payload.messages`.
+ *
+ * @module dsh-edge-agent/input-guard-messages
+ */
+/** Find the last user message with non-empty text content. */
+export declare function findLastUserText(messages: ReadonlyArray<Record<string, unknown>>): {
+    text: string;
+    index: number;
+} | undefined;
+/** Replace the last user message's text (immutable — returns a new array). */
+export declare function replaceLastUserText(messages: ReadonlyArray<Record<string, unknown>>, newText: string): Array<Record<string, unknown>>;
+/**
+ * Replace the text of the message at `index` (immutable — returns a new array).
+ *
+ * Used when dsh-agent-instructions appends content at the end of
+ * `decision.messages` and we still want to rewrite the ORIGINAL user
+ * message (whose index came from `payload.messages`).
+ */
+export declare function replaceAtUserIndex(messages: ReadonlyArray<Record<string, unknown>>, index: number, newText: string): Array<Record<string, unknown>>;
+/**
+ * Collect EVERY user message in the ORIGINAL payload.
+ *
+ * §7.123 (2026-10-27): the previous code only ever sanitized the LAST user
+ * message. That is a data-egress hole: the agent loop sends the whole
+ * conversation to the model, so a phone number the user typed in turn 1 rode
+ * along in `messages` history on every later cloud turn — unredacted. The
+ * sanitizer is session-scoped, so the same value across turns maps to the
+ * same placeholder; the leak was purely "we only rewrote index N".
+ *
+ * Only messages from `payload.messages` are considered — NOT
+ * `decision.messages`, because dsh-agent-instructions appends synthetic
+ * user-role runtime context there (a system-injected run context, not user
+ * content).
+ */
+export declare function findUserTexts(messages: ReadonlyArray<Record<string, unknown>>): Array<{
+    text: string;
+    index: number;
+}>;
+/** Apply a per-index text replacement map to a messages array (immutable). */
+export declare function replaceUserTextsAt(messages: ReadonlyArray<Record<string, unknown>>, replacements: ReadonlyMap<number, string>): Array<Record<string, unknown>>;
+//# sourceMappingURL=input-guard-messages.d.ts.map

package/lib/dsh-adapter/input-guard-messages.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"input-guard-messages.d.ts","sourceRoot":"","sources":["../../src/dsh-adapter/input-guard-messages.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,8DAA8D;AAC9D,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAC/C;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAoB7C;AAED,8EAA8E;AAC9E,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAChD,OAAO,EAAE,MAAM,GACd,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAIhC;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAChD,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,GACd,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CA0BhC;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAC/C,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAsBxC;AAED,8EAA8E;AAC9E,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAChD,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GACxC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAMhC"}

package/lib/dsh-adapter/input-guard-messages.js

@@ -0,0 +1,136 @@
+/**
+ * input-guard-messages — message-array helpers for the input guard.
+ *
+ * §7.123 (2026-10-27): these helpers lived at the bottom of
+ * `input-guard.ts` (2086 lines) inside the same file as the hook logic.
+ * They are pure functions over the agent's `messages` array — the part of
+ * the module that most benefits from being readable (and unit-testable) on
+ * its own, because the agent loop's message shape is the thing that keeps
+ * changing upstream.
+ *
+ * The contract they encode:
+ *   - `payload.messages` holds the REAL user turns;
+ *   - `decision.messages` may carry EXTRA synthetic user-role runtime
+ *     context appended by dsh-agent-instructions — that is NOT user
+ *     content and must never be rewritten;
+ *   - so rewriting is driven by indices collected from `payload.messages`.
+ *
+ * @module dsh-edge-agent/input-guard-messages
+ */
+/** Find the last user message with non-empty text content. */
+export function findLastUserText(messages) {
+    for (let i = messages.length - 1; i >= 0; i--) {
+        const m = messages[i];
+        if (m?.role !== 'user')
+            continue;
+        const content = m.content;
+        if (typeof content === 'string' && content.length > 0) {
+            return { text: content, index: i };
+        }
+        if (Array.isArray(content)) {
+            const texts = [];
+            for (const block of content) {
+                if (block && typeof block === 'object' && block.type === 'text' && typeof block.text === 'string') {
+                    texts.push(block.text);
+                }
+            }
+            const joined = texts.join('');
+            if (joined.length > 0)
+                return { text: joined, index: i };
+        }
+    }
+    return undefined;
+}
+/** Replace the last user message's text (immutable — returns a new array). */
+export function replaceLastUserText(messages, newText) {
+    const found = findLastUserText(messages);
+    if (!found)
+        return [...messages];
+    return replaceAtUserIndex(messages, found.index, newText);
+}
+/**
+ * Replace the text of the message at `index` (immutable — returns a new array).
+ *
+ * Used when dsh-agent-instructions appends content at the end of
+ * `decision.messages` and we still want to rewrite the ORIGINAL user
+ * message (whose index came from `payload.messages`).
+ */
+export function replaceAtUserIndex(messages, index, newText) {
+    if (index < 0 || index >= messages.length)
+        return [...messages];
+    const result = [...messages];
+    const original = result[index];
+    const originalContent = original.content;
+    if (typeof originalContent === 'string') {
+        result[index] = { ...original, content: newText };
+    }
+    else if (Array.isArray(originalContent)) {
+        // 替换所有 text block 为单个合并的 text block
+        const newContent = [];
+        let replaced = false;
+        for (const block of originalContent) {
+            if (block && typeof block === 'object' && block.type === 'text') {
+                if (!replaced) {
+                    newContent.push({ type: 'text', text: newText });
+                    replaced = true;
+                }
+                // 后续 text block 丢弃（已合并到 newText）
+            }
+            else {
+                newContent.push(block);
+            }
+        }
+        if (!replaced)
+            newContent.unshift({ type: 'text', text: newText });
+        result[index] = { ...original, content: newContent };
+    }
+    return result;
+}
+/**
+ * Collect EVERY user message in the ORIGINAL payload.
+ *
+ * §7.123 (2026-10-27): the previous code only ever sanitized the LAST user
+ * message. That is a data-egress hole: the agent loop sends the whole
+ * conversation to the model, so a phone number the user typed in turn 1 rode
+ * along in `messages` history on every later cloud turn — unredacted. The
+ * sanitizer is session-scoped, so the same value across turns maps to the
+ * same placeholder; the leak was purely "we only rewrote index N".
+ *
+ * Only messages from `payload.messages` are considered — NOT
+ * `decision.messages`, because dsh-agent-instructions appends synthetic
+ * user-role runtime context there (a system-injected run context, not user
+ * content).
+ */
+export function findUserTexts(messages) {
+    const out = [];
+    for (let i = 0; i < messages.length; i++) {
+        const m = messages[i];
+        if (m?.role !== 'user')
+            continue;
+        const content = m.content;
+        if (typeof content === 'string' && content.length > 0) {
+            out.push({ text: content, index: i });
+            continue;
+        }
+        if (Array.isArray(content)) {
+            const texts = [];
+            for (const block of content) {
+                if (block && typeof block === 'object' && block.type === 'text' && typeof block.text === 'string') {
+                    texts.push(block.text);
+                }
+            }
+            const joined = texts.join('');
+            if (joined.length > 0)
+                out.push({ text: joined, index: i });
+        }
+    }
+    return out;
+}
+/** Apply a per-index text replacement map to a messages array (immutable). */
+export function replaceUserTextsAt(messages, replacements) {
+    let result;
+    for (const [index, text] of replacements) {
+        result = replaceAtUserIndex(result ?? messages, index, text);
+    }
+    return result ?? [...messages];
+}