@dsh-edge/dsh-edge-agent 0.0.0-stage → 0.1.2

package/cordis.patch.yml

@@ -0,0 +1,382 @@
+# dsh-edge-agent bundle patch — applied after the dsh-base layer.
+# This patch is the ONLY patch needed when a profile lists
+# `@dsh-edge/dsh-edge-agent` in its bundles array.
+#
+# 2026-09-05 (§7.43): 默认 host = dsh-tui（mandatory primary）。bundle 本身仍
+# profile-agnostic，可挂到 web / dsh-tui / 任意 profile；只是 install.sh 的默认
+# 部署目标从 web 切到 dsh-tui。2026-09-11 进一步改 install.sh 为 --profiles=dsh-tui,web 并存启动，--with-web 完全弃用。
+#
+# 2026-09-03 (§7.31): dsh-edge-agent 是 profile-agnostic pure-plugin bundle。
+# Previously had a separate profiles/dsh-edge-agent/cordis.patch.yml (459 lines)
+# that was the profile overlay; that overlay is now deleted. Bundle is fully
+# self-contained — `dsh plugin --profile <name> add -w $LOCAL_PKG` picks up every
+# plugin in a single bundle layer with no profile overlay needed.
+#
+# 2026-09-04: http-api plugin re-enabled. Provides standalone HTTP entry
+# point at :21017 for external consumers (mobile apps, third-party services).
+# Web profile still uses dsh-web-app native chat (:3080) alongside http-api.
+#
+# Load order:
+#   dsh-base → ...other bundles... → @dsh-edge/dsh-edge-agent (this)
+#   → ~/.dsh/profiles/<prof>/cordis.patch.yml (user skin)
+#
+# Layer-ordering rule resolves all 5 conflicts vs. dsh-web-app automatically:
+#   * persona (system-prompt)         — last-write-wins → edge-agent wins
+#   * agent-presets default           — last-write-wins → edge-agent wins
+#   * tool-* enable/disable           — last-write-wins → edge-agent wins
+#   * webserver port                  — never touched here → dsh-web-app wins (3080)
+#   * input-guard coverage            — {global:true} hooks cover webui RPC
+
+# ── surface-specific overrides over the dsh-base layer ────────────────────
+
+# Deployment persona: the edge agent's default is a private-assistant tone
+# (not "coding agent"). DSH_EDGE_PERSONA wins; default below.
+# 2026-09-02: expanded to mirror the persona declared at the profile layer
+# (so this bundle works standalone without the profile overlay).
+- id: system-prompt
+  config:
+    persona: !!js process.env.DSH_EDGE_PERSONA ?? 'You are edge-agent, a privacy-first AI assistant running on the user\'s edge device. Answer in the user\'s language. Be concise and helpful. You have access to local tools for file operations and calculations when appropriate. For knowledge questions, current events, or complex reasoning, provide comprehensive answers. Use the tool registry (bash, read, write, edit, glob, grep, todo_write, web_search, web_fetch, skill, send_message, interrupt_agent, subagent_fork, local_file_read, local_file_write, local_calculate) when an action is required; call the matching tool with the correct parameter shape and never invent tool names. The `skill` tool loads detailed instructions for a named capability (e.g. lark-doc, lark-calendar); once you call skill({name}) and receive its content, use that content immediately to answer the user\'s question — do NOT call the same skill again. For local host queries (the user\'s own IP, hostname, disk, memory, kernel, running processes), call the `bash` tool directly with read-only commands — `ip addr`, `hostname -I`, `ifconfig`, `cat /proc/net/...`, `uname -a`, `df -h`, `free -h`, `uptime`, `ps aux`. Reserve the `skill` tool for explicit capability names the user invokes (e.g. `ets-discover` for scanning OTHER 密盒 devices on the LAN, `lark-doc` for Lark documents); do NOT use `ets-discover` to answer "my IP" or "本机局域网IP" — ets-discover broadcasts and returns other devices\' IPs, not the host\'s.'
+
+# §7.100: 删除了 llm-deepseek 的 config override 行。宿主云路由
+# （deepseek-official / deepseek-account）现在作为 cloud-llm delegate 的
+# 转发目标，key / baseURL / reasoning 全归宿主自己的配置层（dsh-credentials
+# + profile patch），edge 侧不再双头管理。需要 edge 自有云池的部署请显式
+# 配置 CLOUD_LLM_*（走 cloud-llm-adapter 直连模式）。
+
+# The edge agent creates/resumes its agent at runtime; no declarative
+# agents are started at boot, and the configured agent list stays the
+# base's empty default.
+- id: agent-loop
+  config:
+    agents: []
+
+# Approval policy: edge agent defaults to ASK everywhere (no
+# danger-full-access by default; user must opt in via env var).
+# On Windows the trust model matches every other terminal coding agent.
+- id: approval
+  config:
+    policy: !!js "process.platform === 'win32' ? 'never' : ((process.env.DSH_EDGE_PERMISSION_MODE ?? 'ask') === 'danger-full-access' ? 'never' : 'ask')"
+
+# Sessions live in the edge-agent specific JSONL store so the
+# ~/.dsh-edge-agent/sessions directory is isolated from any other DSH
+# bundle.
+- id: session-persistence-jsonl
+  config:
+    root: !!js process.env.DSH_EDGE_SESSION_ROOT ?? (process.env.USERPROFILE ?? process.env.HOME) + '/.dsh-edge-agent/sessions'
+
+# Sandbox: tighter than dsh-base (workspace-write, not danger-full-access).
+# On Windows the no-sandbox trust model applies.
+- id: sandbox-policy
+  config:
+    mode: !!js "process.platform === 'win32' ? 'danger-full-access' : (process.env.DSH_EDGE_PERMISSION_MODE ?? 'workspace-write')"
+    workspaceRoot: !!js process.cwd()
+
+# §7.100: 删除了 agent-default-model override 行。宿主 profile 自己的选择
+# （桌面 GUI saveSelection / dsh-base shipped deepseek-official）现在直接生效；
+# http-api 路径不吃这个 row（intent resolveRoute → cloud-llm/local-llm，
+# cloud-llm 在 delegate 模式下转发到宿主选择）——"profile 已配置模型提供商
+# 就把它当 cloud-llm"的落点就在 delegate adapter，而不是改宿主全局默认。
+
+# Persona + agent-presets delegation
+#
+# 2026-08-31: system-prompt row keeps the host deployment persona. The
+# preset does NOT register its own `persona` row — that would conflict with
+# this host row at the same NamedEntries table (both publish `deployment:persona`
+# at host scope; the second one throws `prompt section already registered`).
+# Shipped `standard` preset hits the same collision; it's an upstream bug
+# in dsh 0.1.0-rc.7 (dsh-persona calls ctx.systemPrompt.section() which
+# targets the systemPrompt service's own ctx, i.e. host, not the preset's
+# standing scope).
+#
+# 2026-08-31: tool-skill moved to disabled=true at host plane. The preset
+# registers its own `tool-skill` row, which joins the agent scope via
+# parentage and registers into that scope's skill-registry layer.
+#
+# 2026-08-31: `agent-presets` config row pins the default preset to
+# `dsh-edge-agent`. Moved to insert block (line 269) because TUI/headless
+# profiles don't load dsh-web-app, so agent-presets must be inserted, not
+# patched. See insert block for the active configuration.
+
+# ── upstream-disabled rows ──────────────────────────────────────────────────────
+# 2026-09-02: keep the disabled rows for the 7 stub plugins so any future
+# downgrade (dsh-edge-agent bundle mounted alone, without the
+# profiles/dsh-edge-agent overlay profile) still skips their apply() —
+# they are M5+ work, not M4. The "dsh-edge-agent overlay" here refers
+# to the default standalone profile directory, not a profile name; the
+# bundle itself lives at the repo root.
+
+# §7.100: 撤销了 llm-deepseek 的 disable —— 宿主云路由现在是 cloud-llm
+# delegate 的转发目标，必须保持挂载。A4 (OHTTP) 届时替换的是 delegate
+# 之下的 wire transport，不再是"edge 独占云路由"。
+#
+# §7.101.x (2026-10-20, fix #5): this `disabled: true` override is a NO-OP
+# for the bare host-half row inserted below in the same file — cordis
+# applies top-level overrides to already-existing entries only, and the
+# insert creates the entry with that name. Kept as documentation of the
+# standalone-profile intent (individual rows mount there).
+
+- id: dsh-edge-agent
+  disabled: true
+  # Aggregator; 2026-09-03 (§7.31) dsh-edge-agent bundle 仅装 web profile
+  # 一个, 但 aggregator 仍保持 disabled 避免 individual plugins (file-logger,
+  # http-api, input-guard, etc.) double-apply。
+
+- id: plugin-host
+  disabled: true
+- id: ohttp-gateway
+  disabled: true
+- id: secure-bridge
+  disabled: true
+- id: attestation
+  disabled: true
+- id: web-search
+  disabled: true
+- id: voice-input
+  disabled: true
+
+# ── tools (subset of dsh-base defaults restored after webui disables) ──────────
+# 2026-09-02: when dsh-edge-agent is added to the web profile, dsh-web-app's
+# layer (which comes BEFORE dsh-edge-agent) disables many tool rows. By
+# re-declaring them here (last-write-wins), dsh-edge-agent overrides that
+# disable with the upstream default. Standalone usage is unaffected.
+
+# 启用的工具（明确 disabled: false 覆盖 dsh-web-app 的禁用）
+- id: tool-bash
+  disabled: false
+- id: tool-fs
+  disabled: false
+- id: tool-fs-search
+  disabled: false
+- id: tool-web
+  disabled: false
+  config:
+    search: true
+    fetch: true
+    searchMaxResults: 8
+    searchTimeoutMs: 30000
+    fetchTimeoutMs: 30000
+- id: web
+  # 2026-09-02: WebRuntime.Config (dsh-web/lib/index.js:42-50) requires BOTH
+  # `searchProvider` AND `fetchProvider`. The upstream dsh-base row only
+  # supplies `searchProvider`, so Cordis plugin-config validation rejects
+  # the WebRuntime class plugin silently — `ctx.web` never gets provided,
+  # web-search-deepseek's `inject: ['web']` never fires, and `web_search`
+  # tool calls fail with "configured web provider ... is not registered".
+  # 2026-09-04: fetchProvider now uses 'http' from dsh-web-fetch-http plugin.
+  # 2026-09-18 (§7.82): searchProvider 改 tavily-bocha-fallback —— 三级链
+  # provider(Tavily → 博查 AI → DeepSeek)。web-search-deepseek 仍 enabled 作
+  # Tier-3 内部兜底(由 aggregator 私有 DeepSeekSearchProvider 实例调用,
+  # 不暴露为独立 provider;否则 seam 会因 AMBIGUOUS 报错)。
+  config:
+    searchProvider: tavily-bocha-fallback
+    fetchProvider: http
+- id: tool-todo
+  disabled: false
+- id: tool-str-replace-editor
+  disabled: false
+- id: web-search-deepseek
+  # 2026-09-04: RE-ENABLED. The 2026-09-03 comment claimed peer dep
+  # `@deepseek-ai/dsh-environment` was missing. Wrong — actual peer deps are
+  # `dsh-launch-environment`, `dsh-web`, `dsh-agent`, all in dsh scope (0.2.x line).
+  # Without this plugin, `deepseek-official` search provider is never registered,
+  # so web_search tool calls fail with "provider not registered".
+  # 2026-09-18 (§7.82): DISABLED —— web-search-tavily-bocha 接管 searchProvider
+  # 路由,在 aggregator 内部私有持有 DeepSeekSearchProvider 实例作 Tier-3
+  # fallback。若两 plugin 同 enabled, ctx.web 会同时注册 2 个 usable provider
+  # ('tavily-bocha-fallback' + 'deepseek-official') → AMBIGUOUS 报错。仍启用
+  # 会留 orphan DeepSeek 注册 + 浪费一次 HTTP probe。
+  disabled: true
+- id: web-fetch-http
+  # 2026-09-04: ENABLED. Provides the 'http' fetch provider for web_fetch tool.
+  # Peer deps (cordis, dsh-timeout, dsh-web) all in dsh scope. Without this,
+  # web_fetch tool calls fail with "fetchProvider not registered".
+
+# 禁用的工具
+- id: tool-pwsh
+  disabled: true
+- id: tool-jobs
+  disabled: true
+- id: tool-skill
+  # 2026-09-04 (§7.40.2): RE-ENABLED at host plane. Previously disabled
+  # to avoid conflict with preset's tool-skill row. Empirically the
+  # preset's row did NOT deliver the `skill` tool to the LLM — system-
+  # prompt.assemble gathers toolProviders from the scope where dsh-tools
+  # was constructed (host), so the bridge between ctx.tools.register() and
+  # assembly.tools lives at host, not at the preset's standing scope. The
+  # agent joined the standing scope by parentage but did not inherit the
+  # toolProviders layer, so the `skill` tool was absent from the 27-tool
+  # list while the system reminder kept telling the model to call it.
+  # 2026-09-04 fix: disable the preset's row (single registration point)
+  # and enable this host row. Session `cw-fix-test-1` and earlier
+  # `7eb91d59-...` reproduced the 5-turn loop with resultLen=12
+  # (`</tool_call>` residual) — LLM picked `tool-fs-search` instead and
+  # produced malformed outputs.
+- id: tool-subagent
+  disabled: true
+- id: tool-subagent-fork
+  disabled: true
+- id: tool-subagent-control
+  disabled: true
+- id: tool-subagent-list-agents
+  disabled: true
+- id: tool-subagent-report
+  disabled: true
+- id: tool-workflow
+  disabled: true
+- id: tool-ralph
+  disabled: true
+- id: tool-goal
+  disabled: true
+- id: skill-filesystem
+  name: '@deepseek-ai/dsh-skill-filesystem'
+  # 2026-09-04: ENABLED at host plane so realm-skill-bridge can access
+  # ctx.skills.list() at boot. Previously disabled here because preset
+  # registered its own skill-filesystem row, causing "a skill provider
+  # named 'filesystem' is already registered" error. Now preset disables
+  # its row to avoid conflict. realm-skill-bridge needs skills available
+  # at host plane for Layer 1 catalog filtering.
+  disabled: false
+- id: skill-badge
+  disabled: true
+- id: workflow-worker-thread
+  disabled: true
+# 2026-08-31: goal service + driver + command re-enabled — required by
+# the dsh-edge-agent preset's tool-goal row (which "waits for goals" if
+# the host-plane service is missing). These are upstream dsh plugins
+# mounted on the host plane; the preset's tool-goal row just provides the
+# model-facing tool.
+- id: goal
+- id: goal-round-driver
+- id: command-goal
+- id: session-title-llm
+  disabled: true
+- id: session-telemetry-otel
+  disabled: true
+- id: repeat-tool-reminder
+  disabled: true
+- id: spill-local
+  disabled: true
+- id: spill-policy
+  disabled: true
+- id: session-checkpoint-policy
+  disabled: true
+- id: tool-result-pruner
+  disabled: true
+- id: tool-call-timeout-policy
+  disabled: true
+- id: compaction-basic
+  disabled: true
+- id: command-compact
+  disabled: true
+
+# ── new plugin inserts ─────────────────────────────────────────────────────────
+
+# ── 2026-09-04: agent-presets — per-session agent composition.
+# dsh-web-app inserts this for web profile; dsh-tui inserts a scoped copy
+# (`dsh-tui-agent-presets`) for TUI/headless. We do NOT re-insert here —
+# that produces either "service agentPresets has been registered" (when
+# both rows enabled) or "duplicate loader entry id" (when both rows use
+# the same id in an insert block). Instead we config-override the
+# existing dsh-tui-agent-presets entry to flip its default from
+# 'standard' to 'dsh-edge-agent', so TUI agents compose our preset (with
+# ets-* skills) instead of dsh-base's standard one.
+#
+# §7.40.3 detail: top-level `- id:` rows with the same id as an existing
+# entry are Cordis Loader config overrides (last-write-wins on config,
+# single entry per id, dedup at parse time — vs insert block which adds
+# new entries). This is the standard "user skin overrides bundle default"
+# pattern. On web profile (no dsh-tui bundle), this id is unknown to the
+# loader; Cordis silently no-ops the override, leaving dsh-web-app's
+# own agent-presets insert as the source — which already sets
+# default=dsh-edge-agent (verified in dsh-web-app bundle).
+- id: dsh-tui-agent-presets
+  config:
+    default: dsh-edge-agent
+    includeUserRoot: true
+
+# ── 2026-09-01 (M6): file-logger — durable ops log exporter.
+# Mount FIRST kept as a placement convention, but §7.169 实测推翻其原依据：
+# 同层插件的 apply 先后由模块解析/求值速度决定,**不**依赖配置树顺序 ⇒
+# "居首所以兜住所有 ctx.logger.*"不成立。通道可用性改由消费方延迟注入保证
+# (ctx.inject(['fileLogger'], …):回调触发时导出器必已注册)。
+# 历史上本行还声明过 inject:['web'](boot 诊断),该硬依赖会把它整个 apply 拖到
+# web 就绪之后 ⇒ §7.169 起 web 降为延迟注入,本插件零静态依赖。
+# See `src/dsh-adapter/file-logger.ts` for the two-channel discipline
+# (ops log: metadata only; audit JSONL: redacted call content).
+
+# ── 本 bundle 留在宿主树的三行（§7.136）──────────────────────────────────
+# 理由见 scripts/_isolate-edge-group.mjs 的文件头：
+#   dsh-edge-agent（裸包名）—— 宿主 client-modules 只扫宿主 Loader 的 entries，
+#     preset 树不在其中 ⇒ Edge tab 的浏览器半边只能从这里被发现；
+#   audit-log / file-logger —— 裸包名行 inject auditLog，且它的 installFileLogger
+#     会先占住 fileLogger 服务名 ⇒ 两者必须在 root realm，且 file-logger 行要更早装载。
+- insert:
+    # §7.101.x (2026-10-20, fix #5) + §7.136: the BARE-package host-half row.
+    # The webview client-module system (@deepseek-ai/dsh-client-modules) scans
+    # LOADER ENTRY NAMES for a `dsh.client` declaration, and its package
+    # locator only accepts bare package-root specifiers (`exactPackageSpecifier`)
+    # — subpath rows like '@scope/pkg/audit-log' can never surface the bundle's
+    # browser half.
+    #
+    # §7.136: this row must stay in the HOST tree. client-modules scans
+    # `ctx.loader.entries()` — the host Loader's entries — while a preset's
+    # plugin list lives in its own EntryTree, outside that enumeration. A bare
+    # row inside the preset would therefore never surface the browser half and
+    # the Edge tab would vanish in every work mode.
+    - id: dsh-edge-agent
+      name: '@dsh-edge/dsh-edge-agent'
+
+    - id: file-logger
+      name: '@dsh-edge/dsh-edge-agent/file-logger'
+      config:
+        # §7.102 "one config file": root / level / rotation come from
+        # config/edge.json (audit.*) inside the plugin. Only static wiring
+        # stays in the row. (Rotation semantics unchanged — see PROGRESS
+        # §7.56; the effective values logMaxAgeDays=1 / logMaxRotated=7 /
+        # logLevel=info are in edge.json.)
+        filename: dsh-edge-agent.log
+        flushIntervalMs: 1000
+        queueCapacity: 10000
+        maxFileSizeBytes: 52428800  # 50MB
+
+    # NOTE: `sessions` and `audit-log` are NOT mounted — `dsh-session`
+    # provides `sessions` upstream and nothing provides `auditLog` so
+    # audit-log is mounted below under its own name.
+    #
+    # ── sessions provider ── dsh-base already mounts the same package
+    # under id `session-persistence-jsonl` (root: `dshHomePath('sessions')`),
+    # which exposes `sessionPersistence`. Previously we declared a second
+    # mount under id `sessions` — that caused a duplicate `provide()` call
+    # and a hard boot failure after the loader upgrade in @xmanrui/dsh-im
+    # (commit b42c7db). Keep the upstream mount; our session-root env
+    # override (`DSH_EDGE_SESSION_ROOT`) flows through `dshHomePath()`.
+    - id: audit-log
+      name: '@dsh-edge/dsh-edge-agent/audit-log'
+      config:
+        # §7.102: minLevel / flush / root come from config/edge.json
+        # (audit.*; root default = ~/.dsh-edge-agent/audit, 2026-08-29 统一).
+        ringBufferSize: 512
+        filename: audit.plain.jsonl
+        enablePIIRedaction: true
+        maxFileSizeBytes: 10485760  # 10MB
+        maxFileAgeDays: 7
+        maxRotatedFiles: 5
+
+    # §7.145: 桌面版「起不来」的根因修复（431）。
+    #
+    # 这一行**必须**留在宿主树（不是 preset）—— 它修的不是 Edge 行为，而是
+    # **宿主自己的启动**：Electron 外壳的 welcome 握手带着 Chromium cookie jar
+    # 出发，cookie 越攒越多 ⇒ 请求头爆 16 KB ⇒ 431 ⇒ 外壳拆宿主 ⇒
+    # 「DeepSeek Harness is unavailable」。握手发生在**任何工作方式选定之前**
+    # ⇒ 修它的插件也必须在 preset 之外。
+    #
+    # 它自带 `process.versions.electron` 判据 ⇒ headless profile（web / tui）
+    # 里直接跳过，不会去动无关 profile 的宿主 web 服务。
+    - id: desktop-cookie-janitor
+      name: '@dsh-edge/dsh-edge-agent/desktop-cookie-janitor'
+      config:
+        enabled: true
+        # 宿主 web 服务是裸 createServer（16 KB 头上限）；抬到 64 KB 让
+        # 一个已经攒胖的 cookie jar 也不会打死启动。
+        maxHeaderBytes: 65536
+