@dsh-edge/dsh-edge-agent 0.0.0-stage → 0.1.2

package/lib/dsh-adapter/web-search-tavily-bocha.d.ts

@@ -0,0 +1,152 @@
+/**
+ * web-search-tavily-bocha — Phase 5 (§7.82) 3-tier fallback search provider.
+ *
+ * Provider chain (resolved per call, on `ctx.web.search`):
+ *   1. Tavily        — primary (English/global, AI-tuned results, `tavilyApiKey`)
+ *   2. 博查 AI        — secondary (Chinese search optimization, `bochaApiKey`)
+ *   3. DeepSeek      — tertiary (re-imports `@deepseek-ai/dsh-web-search-deepseek`,
+ *                       uses native `web_search_20250305` server tool on Anthropic
+ *                       Messages; final backstop when both Tavily and Bocha fail
+ *                       or when neither key is set and only DEEPSEEK_API_KEY is present)
+ *
+ * Configuration (.env-managed via §7.75 .env.sh source chain — bare names,
+ * no DSH_/XDG_/DYLD_/BASH_FUNC_ prefix to bypass dsh-app-boot blacklist):
+ *   - TAVILY_API_KEY    (Tier 1) — bare name, lives in repo .env
+ *   - BOCHA_API_KEY     (Tier 2) — bare name, lives in repo .env
+ *   - DEEPSEEK_API_KEY  (Tier 3 fallback, already required for cloud-llm)
+ *   - DEEPSEEK_BASE_URL (optional, default https://api.deepseek.com/anthropic/v1)
+ *
+ * Where the keys come from (§7.102, 2026-10-21): config/edge.json
+ * `secrets.tavilyApiKey` / `secrets.bochaApiKey` / `secrets.deepseekApiKey`.
+ * The old flow was: repo .env → install.sh `source .env.sh` → process.env
+ * → this read. That chain is gone — the desktop GUI never sourced it, so
+ * the desktop build had no search keys at all. The env names below stay
+ * honoured as a per-process override.
+ *
+ * Why bare names (NOT DSH_EDGE_* prefix)?  DSH dsh-app-boot 0.1.2-rc.1's
+ * BOOTSTRAP_PREFIXES = ["DSH_", "XDG_", "DYLD_", "BASH_FUNC_"] rejects any
+ * DSH_-prefixed KEY in .env files when dsh itself parses them
+ * (dsh-app-boot/lib/index.js:933-1015). Bare names stay compatible with
+ * that launcher behaviour for the env override path.
+ *
+ * Cordis integration: registers as a single search provider with id
+ * `tavily-bocha-fallback` in `ctx.web`. `available()` returns true iff at
+ * least one tier has its key configured — when both Tavily and Bocha keys
+ * are missing but DEEPSEEK_API_KEY is set, the aggregator still registers
+ * (Tier-3 DeepSeek only), avoiding the seam's `WEB_PROVIDER_UNAVAILABLE`.
+ *
+ * Fallback semantics mirror lingguard's `internal/tools/web.go` (Tavily →
+ * 博查) but extend to a 3rd tier for resilience: any exception from a tier
+ * (HTTP non-2xx, malformed JSON, AbortError) is logged and the next tier
+ * takes over. Final WebError `WEB_PROVIDER_UNAVAILABLE` only fires when ALL
+ * three tiers fail or are unavailable.
+ */
+import { type WebSearchProvider, type WebSearchRequest, type WebSearchResult } from '@deepseek-ai/dsh-web';
+import { DeepSeekSearchProvider } from '@deepseek-ai/dsh-web-search-deepseek';
+import type { Context } from '@deepseek-ai/cordis';
+import Schema from '@deepseek-ai/schemastery';
+/** Stable id for `ctx.web.searchProviderId` selection and audit messages. */
+export declare const TAVILY_BOCHA_PROVIDER_ID = "tavily-bocha-fallback";
+/**
+ * Cordis plugin name — must match the `id:` row in `cordis.patch.yml`.
+ */
+export declare const name = "web-search-tavily-bocha";
+/** Inject `web` (seam) so `ctx.web.registerSearchProvider` is available. */
+export declare const inject: string[];
+/**
+ * Config schema. The aggregator is fully env-driven (§7.82: TAVILY_API_KEY
+ * / BOCHA_API_KEY / DEEPSEEK_API_KEY — bare names per §7.75), so the schema is
+ * intentionally minimal — provided only to satisfy the `verify:plugin-spec`
+ * battery. Future Phase 5 work (per-provider rate-limit split, domain
+ * whitelist, SafeSearch) can add fields here without touching `apply()`.
+ */
+export interface Config {
+    /** Reserved for future tuning knobs. No-op in v0.1.x. */
+    reserved: Record<string, unknown>;
+}
+export declare const Config: Schema<Config>;
+/**
+ * Aggregator provider: Tier-1 Tavily → Tier-2 Bocha → Tier-3 DeepSeek.
+ * Implements the `WebSearchProvider` interface from `@deepseek-ai/dsh-web`.
+ */
+export declare class TavilyBochaFallbackProvider implements WebSearchProvider {
+    private readonly tavilyKey;
+    private readonly bochaKey;
+    private readonly dsKey;
+    private readonly deepseek;
+    /**
+     * §7.107 (2026-10-24): per-tier switches. `config/edge.json` has always
+     * declared `webSearch.tavilyEnabled` / `bochaEnabled` — and NOTHING read
+     * them: the tiers were gated purely on "is the key present". An operator
+     * who wanted DeepSeek Search as the backend had no way to say so; every
+     * search burned two 401 round-trips on the way down the chain to it.
+     * §7.182 (2026-11-11, owner ruling): the shipped default is **OFF** for
+     * both tiers ⇒ out of the box only the DeepSeek tier is on the chain.
+     * An unset switch therefore means DISABLED (opt-in, not opt-out).
+     */
+    private readonly tiers;
+    readonly id = "tavily-bocha-fallback";
+    constructor(tavilyKey: string | undefined, bochaKey: string | undefined, dsKey: string | undefined, deepseek: DeepSeekSearchProvider, 
+    /**
+     * §7.107 (2026-10-24): per-tier switches. `config/edge.json` has always
+     * declared `webSearch.tavilyEnabled` / `bochaEnabled` — and NOTHING read
+     * them: the tiers were gated purely on "is the key present". An operator
+     * who wanted DeepSeek Search as the backend had no way to say so; every
+     * search burned two 401 round-trips on the way down the chain to it.
+     * §7.182 (2026-11-11, owner ruling): the shipped default is **OFF** for
+     * both tiers ⇒ out of the box only the DeepSeek tier is on the chain.
+     * An unset switch therefore means DISABLED (opt-in, not opt-out).
+     */
+    tiers?: {
+        tavilyEnabled?: boolean;
+        bochaEnabled?: boolean;
+    });
+    private get tavilyEnabled();
+    private get bochaEnabled();
+    /**
+     * Cheap local availability check; no network calls. Returns true iff any
+     * tier can serve — at least one of Tavily/Bocha/DeepSeek key set.
+     *
+     * We deliberately do NOT delegate to `this.deepseek.available()` because
+     * upstream's check returns true whenever a `resolveApiKey` thunk is
+     * defined, regardless of whether the resolved key string is empty.
+     * Our caller may legitimately invoke us with `dsKey=undefined` (Tiers 1/2
+     * only config), so we must check the key string ourselves.
+     *
+     * When ALL three are unavailable, `ctx.web` will filter us out and the
+     * seam will throw `WEB_PROVIDER_UNAVAILABLE` only if no other provider
+     * is registered as a fallback. (We always register this row, so an
+     * absent-key env is a no-op rather than an error.)
+     */
+    available(): boolean;
+    search(request: WebSearchRequest, signal?: AbortSignal): Promise<WebSearchResult>;
+    private searchTavily;
+    private searchBocha;
+}
+/**
+ * The dsh loader passes the parent Cordis `ctx` here; `inject: ['web']`
+ * guarantees `ctx.web` is non-null. We register one aggregator provider
+ * whose id is `tavily-bocha-fallback`.
+ *
+ * The Tier-3 DeepSeek provider is constructed (not registered) so we can
+ * invoke its `search()` directly inside our Tier-3 fallback path. The
+ * upstream `web-search-deepseek` plugin row is kept enabled in
+ * `cordis.patch.yml` so its `registerSearchProvider('deepseek-official')`
+ * also fires — but DSH's seam then sees TWO registered search providers
+ * (ours + deepseek-official) and would throw `WEB_PROVIDER_AMBIGUOUS`.
+ *
+ * To avoid that, the cordis.patch.yml disables `web-search-deepseek` when
+ * `web-search-tavily-bocha` is enabled; the Tier-3 fallback inside the
+ * aggregator reaches the same DeepSeek HTTP endpoint by holding a private
+ * `DeepSeekSearchProvider` instance, so we never lose the backstop.
+ *
+ * @param ctx - Cordis context with `ctx.web` available per `inject`.
+ */
+export declare function apply(ctx: Context, _config: Config): Promise<void>;
+declare const _default: {
+    name: string;
+    inject: string[];
+    apply: typeof apply;
+};
+export default _default;
+//# sourceMappingURL=web-search-tavily-bocha.d.ts.map

package/lib/dsh-adapter/web-search-tavily-bocha.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-search-tavily-bocha.d.ts","sourceRoot":"","sources":["../../src/dsh-adapter/web-search-tavily-bocha.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAEH,OAAO,EAAY,KAAK,iBAAiB,EAAE,KAAK,gBAAgB,EAAE,KAAK,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACpH,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAA;AAC7E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,MAAM,MAAM,0BAA0B,CAAA;AAW7C,6EAA6E;AAC7E,eAAO,MAAM,wBAAwB,0BAA0B,CAAA;AAE/D;;GAEG;AACH,eAAO,MAAM,IAAI,4BAA4B,CAAA;AAE7C,4EAA4E;AAC5E,eAAO,MAAM,MAAM,UAAU,CAAA;AAE7B;;;;;;GAMG;AACH,MAAM,WAAW,MAAM;IACrB,yDAAyD;IACzD,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAClC;AAED,eAAO,MAAM,MAAM,EAAE,MAAM,CAAC,MAAM,CAEhC,CAAA;AAEF;;;GAGG;AACH,qBAAa,2BAA4B,YAAW,iBAAiB;IAIjE,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB;;;;;;;;;OASG;IACH,OAAO,CAAC,QAAQ,CAAC,KAAK;IAjBxB,QAAQ,CAAC,EAAE,2BAA2B;gBAGnB,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,QAAQ,EAAE,sBAAsB;IACjD;;;;;;;;;OASG;IACc,KAAK,GAAE;QAAE,aAAa,CAAC,EAAE,OAAO,CAAC;QAAC,YAAY,CAAC,EAAE,OAAO,CAAA;KAAO;IAGlF,OAAO,KAAK,aAAa,GAGxB;IAED,OAAO,KAAK,YAAY,GAGvB;IAED;;;;;;;;;;;;;;OAcG;IACH,SAAS,IAAI,OAAO;IAId,MAAM,CAAC,OAAO,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC;YA+CzE,YAAY;YAwCZ,WAAW;CA8D1B;AAGD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAsCxE;;;;;;AAED,wBAAsC"}

package/lib/dsh-adapter/web-search-tavily-bocha.js

@@ -0,0 +1,289 @@
+/**
+ * web-search-tavily-bocha — Phase 5 (§7.82) 3-tier fallback search provider.
+ *
+ * Provider chain (resolved per call, on `ctx.web.search`):
+ *   1. Tavily        — primary (English/global, AI-tuned results, `tavilyApiKey`)
+ *   2. 博查 AI        — secondary (Chinese search optimization, `bochaApiKey`)
+ *   3. DeepSeek      — tertiary (re-imports `@deepseek-ai/dsh-web-search-deepseek`,
+ *                       uses native `web_search_20250305` server tool on Anthropic
+ *                       Messages; final backstop when both Tavily and Bocha fail
+ *                       or when neither key is set and only DEEPSEEK_API_KEY is present)
+ *
+ * Configuration (.env-managed via §7.75 .env.sh source chain — bare names,
+ * no DSH_/XDG_/DYLD_/BASH_FUNC_ prefix to bypass dsh-app-boot blacklist):
+ *   - TAVILY_API_KEY    (Tier 1) — bare name, lives in repo .env
+ *   - BOCHA_API_KEY     (Tier 2) — bare name, lives in repo .env
+ *   - DEEPSEEK_API_KEY  (Tier 3 fallback, already required for cloud-llm)
+ *   - DEEPSEEK_BASE_URL (optional, default https://api.deepseek.com/anthropic/v1)
+ *
+ * Where the keys come from (§7.102, 2026-10-21): config/edge.json
+ * `secrets.tavilyApiKey` / `secrets.bochaApiKey` / `secrets.deepseekApiKey`.
+ * The old flow was: repo .env → install.sh `source .env.sh` → process.env
+ * → this read. That chain is gone — the desktop GUI never sourced it, so
+ * the desktop build had no search keys at all. The env names below stay
+ * honoured as a per-process override.
+ *
+ * Why bare names (NOT DSH_EDGE_* prefix)?  DSH dsh-app-boot 0.1.2-rc.1's
+ * BOOTSTRAP_PREFIXES = ["DSH_", "XDG_", "DYLD_", "BASH_FUNC_"] rejects any
+ * DSH_-prefixed KEY in .env files when dsh itself parses them
+ * (dsh-app-boot/lib/index.js:933-1015). Bare names stay compatible with
+ * that launcher behaviour for the env override path.
+ *
+ * Cordis integration: registers as a single search provider with id
+ * `tavily-bocha-fallback` in `ctx.web`. `available()` returns true iff at
+ * least one tier has its key configured — when both Tavily and Bocha keys
+ * are missing but DEEPSEEK_API_KEY is set, the aggregator still registers
+ * (Tier-3 DeepSeek only), avoiding the seam's `WEB_PROVIDER_UNAVAILABLE`.
+ *
+ * Fallback semantics mirror lingguard's `internal/tools/web.go` (Tavily →
+ * 博查) but extend to a 3rd tier for resilience: any exception from a tier
+ * (HTTP non-2xx, malformed JSON, AbortError) is logged and the next tier
+ * takes over. Final WebError `WEB_PROVIDER_UNAVAILABLE` only fires when ALL
+ * three tiers fail or are unavailable.
+ */
+import { WebError } from '@deepseek-ai/dsh-web';
+import { DeepSeekSearchProvider } from '@deepseek-ai/dsh-web-search-deepseek';
+import Schema from '@deepseek-ai/schemastery';
+import { loadEdgeConfig } from './edge-config.js';
+// ── Endpoints (fixed; these are the only authoritative hosts for each provider) ─────
+const TAVILY_ENDPOINT = 'https://api.tavily.com/search';
+// 博查 AI web-search endpoint (§7.82.2 修正域名 —— 旧 `api.bocha.cn` 是误传,
+// 官方开放平台 docs https://open.bochaai.com 明确指向 `api.bochaai.com`;
+// 旧域名持任何 key 都会 403 quota 错误,实际是路由不可达伪装成 quota)。
+const BOCHA_ENDPOINT = 'https://api.bochaai.com/v1/web-search';
+const DEEPSEEK_DEFAULT_BASE_URL = 'https://api.deepseek.com/anthropic/v1';
+/** Stable id for `ctx.web.searchProviderId` selection and audit messages. */
+export const TAVILY_BOCHA_PROVIDER_ID = 'tavily-bocha-fallback';
+/**
+ * Cordis plugin name — must match the `id:` row in `cordis.patch.yml`.
+ */
+export const name = 'web-search-tavily-bocha';
+/** Inject `web` (seam) so `ctx.web.registerSearchProvider` is available. */
+export const inject = ['web'];
+export const Config = Schema.object({
+    reserved: Schema.dict(Schema.any()).default({}),
+});
+/**
+ * Aggregator provider: Tier-1 Tavily → Tier-2 Bocha → Tier-3 DeepSeek.
+ * Implements the `WebSearchProvider` interface from `@deepseek-ai/dsh-web`.
+ */
+export class TavilyBochaFallbackProvider {
+    tavilyKey;
+    bochaKey;
+    dsKey;
+    deepseek;
+    tiers;
+    id = TAVILY_BOCHA_PROVIDER_ID;
+    constructor(tavilyKey, bochaKey, dsKey, deepseek, 
+    /**
+     * §7.107 (2026-10-24): per-tier switches. `config/edge.json` has always
+     * declared `webSearch.tavilyEnabled` / `bochaEnabled` — and NOTHING read
+     * them: the tiers were gated purely on "is the key present". An operator
+     * who wanted DeepSeek Search as the backend had no way to say so; every
+     * search burned two 401 round-trips on the way down the chain to it.
+     * §7.182 (2026-11-11, owner ruling): the shipped default is **OFF** for
+     * both tiers ⇒ out of the box only the DeepSeek tier is on the chain.
+     * An unset switch therefore means DISABLED (opt-in, not opt-out).
+     */
+    tiers = {}) {
+        this.tavilyKey = tavilyKey;
+        this.bochaKey = bochaKey;
+        this.dsKey = dsKey;
+        this.deepseek = deepseek;
+        this.tiers = tiers;
+    }
+    get tavilyEnabled() {
+        // §7.182: unset = disabled (the shipped default is off).
+        return this.tiers.tavilyEnabled === true;
+    }
+    get bochaEnabled() {
+        // §7.182: unset = disabled (the shipped default is off).
+        return this.tiers.bochaEnabled === true;
+    }
+    /**
+     * Cheap local availability check; no network calls. Returns true iff any
+     * tier can serve — at least one of Tavily/Bocha/DeepSeek key set.
+     *
+     * We deliberately do NOT delegate to `this.deepseek.available()` because
+     * upstream's check returns true whenever a `resolveApiKey` thunk is
+     * defined, regardless of whether the resolved key string is empty.
+     * Our caller may legitimately invoke us with `dsKey=undefined` (Tiers 1/2
+     * only config), so we must check the key string ourselves.
+     *
+     * When ALL three are unavailable, `ctx.web` will filter us out and the
+     * seam will throw `WEB_PROVIDER_UNAVAILABLE` only if no other provider
+     * is registered as a fallback. (We always register this row, so an
+     * absent-key env is a no-op rather than an error.)
+     */
+    available() {
+        return Boolean((this.tavilyEnabled && this.tavilyKey) || (this.bochaEnabled && this.bochaKey) || this.dsKey);
+    }
+    async search(request, signal) {
+        // Tier 1 — Tavily
+        if (this.tavilyEnabled && this.tavilyKey) {
+            try {
+                return await this.searchTavily(request, signal);
+            }
+            catch (err) {
+                // Tier 1 failed; fall through to Tier 2. We log but do not throw —
+                // this is the explicit lingguard-style "fail-down" contract.
+                console.warn(`[web-search-tavily-bocha] Tavily failed, falling through to 博查: ` +
+                    (err instanceof Error ? err.message : String(err)));
+            }
+        }
+        // Tier 2 — 博查 AI
+        if (this.bochaEnabled && this.bochaKey) {
+            try {
+                return await this.searchBocha(request, signal);
+            }
+            catch (err) {
+                console.warn(`[web-search-tavily-bocha] 博查 failed, falling through to DeepSeek: ` +
+                    (err instanceof Error ? err.message : String(err)));
+            }
+        }
+        // Tier 3 — DeepSeek (imported provider; uses native server-tool search).
+        // We gate on `this.dsKey` directly rather than `this.deepseek.available()`
+        // because upstream's available() returns true whenever a `resolveApiKey`
+        // thunk is defined, even when it resolves to an empty string.
+        if (this.dsKey) {
+            return await this.deepseek.search(request, signal);
+        }
+        // All tiers failed or unavailable.
+        throw new WebError('all web search providers failed or none configured ' +
+            '(set TAVILY_API_KEY / BOCHA_API_KEY / DEEPSEEK_API_KEY in .env)', 'WEB_PROVIDER_UNAVAILABLE');
+    }
+    // ── Tier 1: Tavily ───────────────────────────────────────────────────────
+    // API: https://docs.tavily.com/docs/rest-api/api-reference#endpoint-search
+    // Body: { api_key, query, max_results, search_depth, include_answer }
+    // 200 OK response: { answer?: string, results: [{ title, url, content, score }] }
+    async searchTavily(req, signal) {
+        const r = await fetch(TAVILY_ENDPOINT, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                api_key: this.tavilyKey,
+                query: req.query,
+                max_results: req.maxResults ?? 5,
+                search_depth: 'basic',
+                include_answer: true,
+            }),
+            signal,
+        });
+        if (!r.ok) {
+            const body = await r.text().catch(() => '');
+            throw new Error(`Tavily HTTP ${r.status}: ${body.slice(0, 200)}`);
+        }
+        const json = (await r.json());
+        const sources = (json.results ?? [])
+            .filter((it) => it.url)
+            .map((it) => ({
+            url: it.url,
+            ...(it.title ? { title: it.title } : {}),
+            ...(it.content ? { snippet: it.content } : {}),
+        }));
+        return {
+            ...(json.answer ? { content: json.answer } : {}),
+            sources,
+            truncated: false,
+        };
+    }
+    // ── Tier 2: 博查 AI ────────────────────────────────────────────────────────
+    // API: https://open.bochaai.com(§7.82.2 修正:旧 feishu docx 链接已迁移,权威 spec 在开放平台)
+    // Body: { query, count, summary, freshness } —— 4 个字段,无额外必填
+    // 200 OK response: { code: 200, msg: null, log_id, data: { _type, queryContext, webPages: { webSearchUrl, totalEstimatedMatches, value: [...] }, images?, videos? } }
+    // 错误 response: { code: 4xx, msg: '...', log_id } —— 无 data 字段
+    async searchBocha(req, signal) {
+        const r = await fetch(BOCHA_ENDPOINT, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                Authorization: `Bearer ${this.bochaKey}`,
+            },
+            body: JSON.stringify({
+                query: req.query,
+                count: req.maxResults ?? 5,
+                summary: true,
+                freshness: 'noLimit',
+            }),
+            signal,
+        });
+        if (!r.ok) {
+            const body = await r.text().catch(() => '');
+            throw new Error(`博查 HTTP ${r.status}: ${body.slice(0, 200)}`);
+        }
+        const json = (await r.json());
+        if (json.code !== 200) {
+            throw new Error(`博查 API code ${json.code}: ${json.msg ?? 'unknown error'} (log_id=${json.log_id ?? 'n/a'})`);
+        }
+        const pages = json.data?.webPages?.value ?? [];
+        const sources = pages
+            .filter((it) => it.url)
+            .map((it) => ({
+            url: it.url,
+            ...(it.name ? { title: it.name } : {}),
+            ...(it.summary ? { snippet: it.summary } : it.snippet ? { snippet: it.snippet } : {}),
+            ...(it.datePublished ? { datePublished: it.datePublished } : {}),
+        }));
+        return {
+            ...(json.data?.summary ? { content: json.data.summary } : {}),
+            sources,
+            truncated: false,
+        };
+    }
+}
+// ── Cordis plugin entry point ───────────────────────────────────────────
+/**
+ * The dsh loader passes the parent Cordis `ctx` here; `inject: ['web']`
+ * guarantees `ctx.web` is non-null. We register one aggregator provider
+ * whose id is `tavily-bocha-fallback`.
+ *
+ * The Tier-3 DeepSeek provider is constructed (not registered) so we can
+ * invoke its `search()` directly inside our Tier-3 fallback path. The
+ * upstream `web-search-deepseek` plugin row is kept enabled in
+ * `cordis.patch.yml` so its `registerSearchProvider('deepseek-official')`
+ * also fires — but DSH's seam then sees TWO registered search providers
+ * (ours + deepseek-official) and would throw `WEB_PROVIDER_AMBIGUOUS`.
+ *
+ * To avoid that, the cordis.patch.yml disables `web-search-deepseek` when
+ * `web-search-tavily-bocha` is enabled; the Tier-3 fallback inside the
+ * aggregator reaches the same DeepSeek HTTP endpoint by holding a private
+ * `DeepSeekSearchProvider` instance, so we never lose the backstop.
+ *
+ * @param ctx - Cordis context with `ctx.web` available per `inject`.
+ */
+export async function apply(ctx, _config) {
+    // §7.102 (2026-10-21): the search keys come from config/edge.json
+    // (secrets.tavilyApiKey / secrets.bochaApiKey / secrets.deepseekApiKey).
+    // The old flow was: repo .env → install.sh `source .env.sh` → process.env
+    // → this read. That chain is gone — the desktop GUI never sourced it.
+    // Env names stay honoured as a per-process override.
+    const cfg = loadEdgeConfig(true);
+    const secrets = cfg.secrets ?? {};
+    const tavilyKey = (secrets.tavilyApiKey ?? process.env.TAVILY_API_KEY)?.trim() || undefined;
+    const bochaKey = (secrets.bochaApiKey ?? process.env.BOCHA_API_KEY)?.trim() || undefined;
+    const dsKey = (secrets.deepseekApiKey ?? process.env.DEEPSEEK_API_KEY)?.trim() || undefined;
+    const dsBaseURL = process.env.DEEPSEEK_BASE_URL?.trim() || DEEPSEEK_DEFAULT_BASE_URL;
+    // Construct upstream DeepSeek provider for Tier-3 fallback. We bypass its
+    // settings-section / credential-ref machinery because we read env vars
+    // ourselves (consistent with `local-llm-adapter` pattern). The provider
+    // class is stateless across calls — re-reading env on each `search()`.
+    const dsProvider = new DeepSeekSearchProvider(() => ({
+        resolveApiKey: async () => dsKey,
+        baseURL: dsBaseURL,
+        model: 'deepseek-v4-flash',
+        apiVersion: '2023-06-01',
+        maxTokens: 4096,
+        maxUses: 5,
+    }));
+    const provider = new TavilyBochaFallbackProvider(tavilyKey, bochaKey, dsKey, dsProvider, {
+        // §7.107: the per-tier switches, finally read. §7.182: default =
+        // disabled ⇒ an unset config keeps only the DeepSeek tier on the chain.
+        tavilyEnabled: cfg.webSearch?.tavilyEnabled,
+        bochaEnabled: cfg.webSearch?.bochaEnabled,
+    });
+    // The `web` seam is registered by `@deepseek-ai/dsh-tool-web` upstream;
+    // it's not part of the stock `Context` interface, so cast narrowly.
+    const webCtx = ctx;
+    webCtx.web.registerSearchProvider(provider);
+}
+export default { name, inject, apply };

package/lib/http-api.d.ts

@@ -0,0 +1,2 @@
+export * from './dsh-adapter/http-api.js';
+//# sourceMappingURL=http-api.d.ts.map

package/lib/http-api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-api.d.ts","sourceRoot":"","sources":["../src/http-api.ts"],"names":[],"mappings":"AACA,cAAc,2BAA2B,CAAA"}

package/lib/http-api.js

@@ -0,0 +1,2 @@
+// @module dsh-edge-agent/http-api
+export * from './dsh-adapter/http-api.js';

package/lib/index.d.ts

@@ -0,0 +1,48 @@
+/**
+ * dsh-edge-agent — package root (flat layout, matching dsh-context's pattern).
+ *
+ * The aggregate plugin (`name='dsh-edge-agent'`) that cordis 0.2.1-rc.2
+ * mounts when the patch row uses the bare package name lives in
+ * `./dsh-adapter/dsh-edge-agent.ts` so the adapter boundary holds:
+ * `verify-adapter-boundary` only allows `@deepseek-ai/*` imports under
+ * `src/dsh-adapter/`. This file stays as a thin re-export shell — it must
+ * NOT import upstream packages directly, only re-export sub-plugin modules
+ * and the aggregate bootstrap.
+ *
+ * For `cordis require('@scope/pkg')` to resolve to the aggregate plugin,
+ * `package.json#main` → `lib/index.js` (this file compiled) AND the
+ * `lib/` directory must hold `index.js` flat (no dotted `lib/types/` prefix).
+ * The dotted layout silently misroutes cordis to `lib/types/<name>.js`,
+ * which would cause the whole bundle to never mount — flat layout is
+ * mandatory (see docs/dev-notes/cordis-rc021-patch-loader.md).
+ *
+ * Sub-plugin re-exports preserve the public API: a consumer can still do
+ *   `import { auditLog } from '@scope/pkg/audit-log'`
+ * because every adapter subpath is `export *`-ed here.
+ */
+export { name, inject, Config, apply, type Config as AggregatorConfig, } from './dsh-adapter/dsh-edge-agent.js';
+export * from './dsh-adapter/tcm.js';
+export * from './dsh-adapter/local-storage.js';
+export * from './dsh-adapter/sessions.js';
+export * from './dsh-adapter/audit-log.js';
+export * from './dsh-adapter/privacy-policy.js';
+export * from './dsh-adapter/tools.js';
+export * from './dsh-adapter/realm-skill-bridge.js';
+export * from './dsh-adapter/prompt-guard.js';
+export * from './dsh-adapter/intent-router.js';
+export * from './dsh-adapter/model-router.js';
+export * from './dsh-adapter/local-llm-adapter.js';
+export * from './dsh-adapter/cloud-llm-adapter.js';
+export * from './dsh-adapter/sanitizer-pipeline.js';
+export * from './dsh-adapter/ohttp-gateway.js';
+export * from './dsh-adapter/secure-bridge.js';
+export * from './dsh-adapter/attestation.js';
+export * from './dsh-adapter/td-bus.js';
+export * from './dsh-adapter/voice-input.js';
+export * from './dsh-adapter/plugin-host.js';
+export { name as httpApiName, inject as httpApiInject, Config as HttpApiConfig, HttpApiServiceImpl, apply as httpApiApply } from './dsh-adapter/http-api.js';
+export type { HttpApiService } from './dsh-adapter/http-api.js';
+export * from './dsh-adapter/llm-adapters.js';
+export * from './dsh-adapter/edge-context-view.js';
+export * from './dsh-adapter/desktop-cookie-janitor.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EACL,IAAI,EACJ,MAAM,EACN,MAAM,EACN,KAAK,EACL,KAAK,MAAM,IAAI,gBAAgB,GAChC,MAAM,iCAAiC,CAAA;AAKxC,cAAc,sBAAsB,CAAA;AACpC,cAAc,gCAAgC,CAAA;AAC9C,cAAc,2BAA2B,CAAA;AACzC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,iCAAiC,CAAA;AAC/C,cAAc,wBAAwB,CAAA;AACtC,cAAc,qCAAqC,CAAA;AACnD,cAAc,+BAA+B,CAAA;AAC7C,cAAc,gCAAgC,CAAA;AAC9C,cAAc,+BAA+B,CAAA;AAC7C,cAAc,oCAAoC,CAAA;AAClD,cAAc,oCAAoC,CAAA;AAClD,cAAc,qCAAqC,CAAA;AACnD,cAAc,gCAAgC,CAAA;AAC9C,cAAc,gCAAgC,CAAA;AAC9C,cAAc,8BAA8B,CAAA;AAC5C,cAAc,yBAAyB,CAAA;AACvC,cAAc,8BAA8B,CAAA;AAC5C,cAAc,8BAA8B,CAAA;AAC5C,OAAO,EAAE,IAAI,IAAI,WAAW,EAAE,MAAM,IAAI,aAAa,EAAE,MAAM,IAAI,aAAa,EAAE,kBAAkB,EAAE,KAAK,IAAI,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAC5J,YAAY,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAC/D,cAAc,+BAA+B,CAAA;AAC7C,cAAc,oCAAoC,CAAA;AAClD,cAAc,yCAAyC,CAAA"}

package/lib/index.js

@@ -0,0 +1,49 @@
+/**
+ * dsh-edge-agent — package root (flat layout, matching dsh-context's pattern).
+ *
+ * The aggregate plugin (`name='dsh-edge-agent'`) that cordis 0.2.1-rc.2
+ * mounts when the patch row uses the bare package name lives in
+ * `./dsh-adapter/dsh-edge-agent.ts` so the adapter boundary holds:
+ * `verify-adapter-boundary` only allows `@deepseek-ai/*` imports under
+ * `src/dsh-adapter/`. This file stays as a thin re-export shell — it must
+ * NOT import upstream packages directly, only re-export sub-plugin modules
+ * and the aggregate bootstrap.
+ *
+ * For `cordis require('@scope/pkg')` to resolve to the aggregate plugin,
+ * `package.json#main` → `lib/index.js` (this file compiled) AND the
+ * `lib/` directory must hold `index.js` flat (no dotted `lib/types/` prefix).
+ * The dotted layout silently misroutes cordis to `lib/types/<name>.js`,
+ * which would cause the whole bundle to never mount — flat layout is
+ * mandatory (see docs/dev-notes/cordis-rc021-patch-loader.md).
+ *
+ * Sub-plugin re-exports preserve the public API: a consumer can still do
+ *   `import { auditLog } from '@scope/pkg/audit-log'`
+ * because every adapter subpath is `export *`-ed here.
+ */
+export { name, inject, Config, apply, } from './dsh-adapter/dsh-edge-agent.js';
+// Convenience: re-export the canonical subpath plugins so that consumers
+// who `import '@dsh-edge/dsh-edge-agent'` can also
+// pull individual cordis rows out of the same module.
+export * from './dsh-adapter/tcm.js';
+export * from './dsh-adapter/local-storage.js';
+export * from './dsh-adapter/sessions.js';
+export * from './dsh-adapter/audit-log.js';
+export * from './dsh-adapter/privacy-policy.js';
+export * from './dsh-adapter/tools.js';
+export * from './dsh-adapter/realm-skill-bridge.js';
+export * from './dsh-adapter/prompt-guard.js';
+export * from './dsh-adapter/intent-router.js';
+export * from './dsh-adapter/model-router.js';
+export * from './dsh-adapter/local-llm-adapter.js';
+export * from './dsh-adapter/cloud-llm-adapter.js';
+export * from './dsh-adapter/sanitizer-pipeline.js';
+export * from './dsh-adapter/ohttp-gateway.js';
+export * from './dsh-adapter/secure-bridge.js';
+export * from './dsh-adapter/attestation.js';
+export * from './dsh-adapter/td-bus.js';
+export * from './dsh-adapter/voice-input.js';
+export * from './dsh-adapter/plugin-host.js';
+export { name as httpApiName, inject as httpApiInject, Config as HttpApiConfig, HttpApiServiceImpl, apply as httpApiApply } from './dsh-adapter/http-api.js';
+export * from './dsh-adapter/llm-adapters.js';
+export * from './dsh-adapter/edge-context-view.js';
+export * from './dsh-adapter/desktop-cookie-janitor.js';

package/lib/intent-router.d.ts

@@ -0,0 +1,2 @@
+export * from './dsh-adapter/intent-router.js';
+//# sourceMappingURL=intent-router.d.ts.map

package/lib/intent-router.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"intent-router.d.ts","sourceRoot":"","sources":["../src/intent-router.ts"],"names":[],"mappings":"AACA,cAAc,gCAAgC,CAAA"}

package/lib/intent-router.js

@@ -0,0 +1,2 @@
+// @module dsh-edge-agent/intent-router
+export * from './dsh-adapter/intent-router.js';

package/lib/llm-adapters.d.ts

@@ -0,0 +1,2 @@
+export * from './dsh-adapter/llm-adapters.js';
+//# sourceMappingURL=llm-adapters.d.ts.map

package/lib/llm-adapters.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"llm-adapters.d.ts","sourceRoot":"","sources":["../src/llm-adapters.ts"],"names":[],"mappings":"AACA,cAAc,+BAA+B,CAAA"}

package/lib/llm-adapters.js

@@ -0,0 +1,2 @@
+// @module dsh-edge-agent/llm-adapters
+export * from './dsh-adapter/llm-adapters.js';

package/lib/local-llm-adapter.d.ts

@@ -0,0 +1,2 @@
+export * from './dsh-adapter/local-llm-adapter.js';
+//# sourceMappingURL=local-llm-adapter.d.ts.map

package/lib/local-llm-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-llm-adapter.d.ts","sourceRoot":"","sources":["../src/local-llm-adapter.ts"],"names":[],"mappings":"AACA,cAAc,oCAAoC,CAAA"}

package/lib/local-llm-adapter.js

@@ -0,0 +1,2 @@
+// @module dsh-edge-agent/local-llm-adapter
+export * from './dsh-adapter/local-llm-adapter.js';

package/lib/local-storage.d.ts

@@ -0,0 +1,2 @@
+export * from './dsh-adapter/local-storage.js';
+//# sourceMappingURL=local-storage.d.ts.map

package/lib/local-storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-storage.d.ts","sourceRoot":"","sources":["../src/local-storage.ts"],"names":[],"mappings":"AACA,cAAc,gCAAgC,CAAA"}

package/lib/local-storage.js

@@ -0,0 +1,2 @@
+// @module dsh-edge-agent/local-storage
+export * from './dsh-adapter/local-storage.js';

package/lib/model-router.d.ts

@@ -0,0 +1,2 @@
+export * from './dsh-adapter/model-router.js';
+//# sourceMappingURL=model-router.d.ts.map

package/lib/model-router.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-router.d.ts","sourceRoot":"","sources":["../src/model-router.ts"],"names":[],"mappings":"AACA,cAAc,+BAA+B,CAAA"}

package/lib/model-router.js

@@ -0,0 +1,2 @@
+// @module dsh-edge-agent/model-router
+export * from './dsh-adapter/model-router.js';

package/lib/ohttp-gateway.d.ts

@@ -0,0 +1,2 @@
+export * from './dsh-adapter/ohttp-gateway.js';
+//# sourceMappingURL=ohttp-gateway.d.ts.map

package/lib/ohttp-gateway.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ohttp-gateway.d.ts","sourceRoot":"","sources":["../src/ohttp-gateway.ts"],"names":[],"mappings":"AACA,cAAc,gCAAgC,CAAA"}

package/lib/ohttp-gateway.js

@@ -0,0 +1,2 @@
+// @module dsh-edge-agent/ohttp-gateway
+export * from './dsh-adapter/ohttp-gateway.js';

package/lib/plugin-host.d.ts

@@ -0,0 +1,2 @@
+export * from './dsh-adapter/plugin-host.js';
+//# sourceMappingURL=plugin-host.d.ts.map

package/lib/plugin-host.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-host.d.ts","sourceRoot":"","sources":["../src/plugin-host.ts"],"names":[],"mappings":"AACA,cAAc,8BAA8B,CAAA"}

package/lib/plugin-host.js

@@ -0,0 +1,2 @@
+// @module dsh-edge-agent/plugin-host
+export * from './dsh-adapter/plugin-host.js';