@eduwork/dsh-oidc 0.1.0-alpha.11 → 0.2.0

package/README.md

@@ -1,6 +1,6 @@
 # dsh-oidc
 
-> npm 包：`@eduwork/dsh-oidc@0.1.0-alpha.11`。旧无作用域包保留供迁移；安装切换与数据兼容见 [迁移说明](docs/EDUWORK-MIGRATION.md)。
+> `0.2.0`，基于官方 DSH `0.1.5-rc.1`：公版保留身份登录、托管 Key、模型发现和注销；配额请求、字段归一化及 UI 已抽离到独立机构扩展，公版不请求配额或心跳。见 [账户扩展接口](docs/account-extensions.md)和 [服务端规范](docs/server-integration-contract.md)。发布状态以 npm registry 为准。
 
 **简体中文** | [English](README.en.md)
 
@@ -10,12 +10,12 @@
 
 1. 标准 OIDC Authorization Code + PKCE 公共客户端登录；
 2. 固定的企业 **Key Binding** 协议，用 OIDC Access Token 申请、解析或轮换可撤销的模型运行凭据；
-3. 本地、经过审计的 OpenAI-compatible DSH Provider 适配器；
-4. 有边界的品牌替换，以及 Web / Desktop 共用的账号与企业模型设置 UI。
+3. 本地 OpenAI-compatible Provider 与可自动同步的模型目录；
+4. 安全的账户刷新和注销，可选机构账户扩展。
 
-插件 Web 优先，不依赖 Wails。桌面产品可以切换到 native account backend，但 Enterprise Profile、Provider 路由、前端账号契约和 Key Binding 语义不变。
+这些能力配有共享账号界面和可选品牌配置。纯身份接入可省略资源协议，个人模型入口始终保留。
 
-> **当前状态：alpha。** 当前源码已适配 DSH `0.1.2-alpha.2`（提交 `0a53fb55…`），并在官方 npm Runtime 与锁定源码 release-pack Runtime 中完成构建和集成检查；Enterprise Profile 仍为 `v1alpha1`。正式生产前仍必须完成真实 OIDC/Key Binding 联调、宿主凭据隔离审计和 DSH 升级兼容性测试。
+插件面向单机客户端。本机 Web 用于功能验证；桌面通过 `backend: desktop` 使用临时 loopback 回调和宿主浏览器服务，无需常驻 WebServer。`backend: native` 仅兼容旧宿主账户桥。三种后端都不依赖特定外壳，详见 [桌面宿主接入](docs/desktop-host.md)。
 
 准备接入自己的机构？先读 **[服务端接口规范](docs/server-integration-contract.md)**，再按 **[完整中文接入指南](docs/getting-started.md)** 部署。前者以请求、响应、字段和错误码形式定义一个机构服务必须共同实现的 OIDC + PKCE、Key Binding 和模型网关能力；后者覆盖配置、安装、验收和排障。
 
@@ -29,7 +29,7 @@
 - Key Binding 负责确认该用户能否获得哪个 Provider 的运行凭据；
 - Enterprise Profile 负责声明品牌、OIDC 公共客户端、Key Binding 基址和模型事实；
 - 本地 Provider 适配器把凭据和模型事实接入 DSH；
-- 具体桌面外壳、配额展示、学校业务页、更新器等仍由产品实现方扩展。
+- 配额由独立机构扩展提供；桌面外壳、学校业务页、心跳与更新器由产品实现方扩展。
 
 远程配置只能是数据，不能指定 JS 模块、脚本、CSS、工具、Skill 或自定义 Provider adapter，也不能修改 Key Binding 的路径和字段。这是开源后的核心安全边界。
 
@@ -37,17 +37,17 @@
 
 已包含：
 
-- 固定 loopback 回调 `http://127.0.0.1:<DSH端口>/oauth/callback`；
+- loopback 回调 `http://127.0.0.1:<实际端口>/oauth/callback`：Web 取 WebServer 端口，桌面默认临时随机端口；
 - OIDC Discovery、PKCE S256、state、nonce、RS256 ID Token 校验、UserInfo subject 绑定、刷新和可选撤销；
 - 只读取标准 `userinfo.name`，缺失时降级到必需字段 `userinfo.sub`；
 - 固定 `worker-user-center-v1` 的 bootstrap / provision / resolve / renew；
 - 使用 DSH Credential Provider 保存 OIDC 会话和模型 API Key；
 - 声明式 Provider/模型目录和有边界的品牌 token；
-- Web 与 native 宿主共用、按宿主能力自动显隐操作的企业服务设置页；该页面通过 DSH 官方 `settings.section` 扩展点注册；
+- 两种桌面壳和本机 Web 共用官方模型设置、onboarding、侧栏账号与通用设置插槽，按宿主能力显示操作；
 - 桌面原生账号后端适配边界；
 - 稳定的 `enterpriseTransforms` 扩展服务，图像理解等插件可以增强某条模型路由，但不会再注册一套重复 Provider。
 
-明确不包含：OIDC 服务端、Key Binding 服务端、多用户会话数据库、学校人员目录、配额 UI、Wails 外壳、客户端更新器和远程可执行插件。
+明确不包含：OIDC 服务端、Key Binding 服务端、多用户会话数据库、学校人员目录、Wails 外壳、客户端更新器和远程可执行插件。
 
 ## 品牌替换范围
 
@@ -65,10 +65,10 @@
 1. 按[服务端接口规范](docs/server-integration-contract.md)联合提供 OIDC、Key Binding 和模型网关。
 2. 为无 Client Secret 的 Public Client 精确登记 `http://127.0.0.1:3080/oauth/callback`。
 3. 从 [`examples/enterprise-profile.example.json`](examples/enterprise-profile.example.json) 复制一份可信本地配置。
-4. 从 npm 安装经过复核的精确版本：
+4. 在统一的 DSH `0.1.5-rc.1` 宿主中安装精确 npm 版本。发布准备期间若 registry 尚未提供该版本，使用下方源码方式，不要改装旧版或忽略 peer 冲突：
 
 ```bash
-dsh plugin --profile web add @eduwork/dsh-oidc@0.1.0-alpha.11
+dsh plugin --profile web add @eduwork/dsh-oidc@0.2.0
 ```
 
 需要审计、开发或测试尚未发布的改动时，也可以从本地 checkout 安装：
@@ -81,7 +81,7 @@ npm run check
 dsh plugin --profile web add .
 ```
 
-本地路径安装会把当前 checkout 以依赖链接到 DSH `web` Profile；安装后不要移动或删除源码目录。团队部署应优先固定经过复核的 npm 精确版本；需要主动跟随 alpha 更新时可以使用 `@eduwork/dsh-oidc@alpha`。
+本地路径安装会把当前 checkout 以依赖链接到 DSH `web` Profile；安装后不要移动或删除源码目录。团队部署应固定经过复核的 npm 精确版本，不要混装其他 DSH 预发布线。
 
 高级产品也可以在自己的 DSH bundle 中显式引入 `dsh-oidc`：
 
@@ -90,13 +90,13 @@ dsh plugin --profile web add .
     - id: enterprise-oidc
       name: '@eduwork/dsh-oidc'
       config:
-        profilePathEnv: DSH_OIDC_ENTERPRISE_PROFILE
+        profilePathEnv: EDUWORK_OIDC_PROFILE
 ```
 
 5. 用环境变量传入配置文件路径，并让 DSH WebServer 监听 `127.0.0.1`：
 
 ```text
-DSH_OIDC_ENTERPRISE_PROFILE=/etc/dsh/enterprise-profile.json
+EDUWORK_OIDC_PROFILE=/etc/dsh/enterprise-profile.json
 dsh --profile web --host 127.0.0.1 --port 3080
 ```
 
@@ -116,7 +116,7 @@ OIDC 部分坚持标准化，不增加机构私有的 UserInfo 映射语法：
 - 展示名取 `name`，缺失时才取 `sub`；
 - bootstrap 中即使返回姓名，也不得覆盖 OIDC 身份。
 
-OIDC、Key Binding 和模型网关共同构成一个完整的机构服务端交付，不能任选。Key Binding 是本项目定义的企业协议：Profile 通过 `baseURL` 指定接口组，其余路径、请求字段和响应字段全部固定。Provider ID 决定运行路由，并默认派生凭据引用（例如 `example-ai` 对应 `EXAMPLE_AI_API_KEY`）；生产/测试复用同一 Provider ID 时，可以用本地 `keyBinding.credentialRef` 明确隔离，且不会改变服务端接口。完整接口见[服务端接口规范](docs/server-integration-contract.md)。
+纯身份接入只需 OIDC，省略 `keyBinding` 与 `provider` 即可。需要自动获得企业 Key 和配置模型时，这两项必须同时配置，并提供 Key Binding 与模型网关。Key Binding 是本项目定义的企业协议：Profile 通过 `baseURL` 指定接口组，其余路径、请求字段和响应字段全部固定。Provider ID 决定运行路由；默认企业凭据统一使用 `EDUWORK_API_KEY`。旧自动名称兼容迁移，独立的自定义引用仍由 `keyBinding.credentialRef` 配置。凭据归属由已验证的身份、资源绑定和 Key 指纹校验，不改变服务端接口。完整接口见[服务端接口规范](docs/server-integration-contract.md)。
 
 ## 开发与复核
 
@@ -125,7 +125,9 @@ npm ci
 npm run check
 ```
 
-完整检查包括 Host/Client 构建、单元测试、OIDC 安全边界测试、JSON Schema 示例校验、OpenAPI 结构检查、敏感信息扫描和 npm tarball 预检。
+开发依赖与锁文件固定本轮 DSH `0.1.5-rc.1`，不依赖开发机已有客户端目录。完整检查包括锁文件、所选 DSH 基线的 Host/Client/API 契约核对、Host/Client 构建、单元测试、OIDC 安全边界测试、JSON Schema 示例校验、OpenAPI 结构检查、敏感信息扫描和 npm tarball 预检。
+
+插件版本 `0.2.0` 不与 EduWork 产品版本机械同步。正式装配使用 npm 精确版本及 integrity；源码路径仅用于开发。升级到本版不会替换旧冻结 tarball。开发入口、干净安装和验证边界见 [开发与发布准备](docs/development.md)。
 
 详细材料：
 

package/SECURITY.en.md

@@ -0,0 +1,45 @@
+# Security policy
+
+[简体中文](SECURITY.md) | **English**
+
+## Supported versions
+
+The supported release line is `0.1.x`; security fixes are applied to its latest release. Alpha versions before `0.1.0` remain available for migration and historical reproduction but do not receive routine fixes.
+
+## Reporting a vulnerability
+
+Do **not** open a public issue for a suspected vulnerability, leaked secret, private endpoint, identity mix-up, credential exposure, or authorization bypass.
+
+Submit reports privately through GitHub [Private Vulnerability Reporting](https://github.com/freedomkk-qfeng/dsh-oidc/security/advisories/new). Do not disclose vulnerability details, real credentials, or personal data in a public issue, discussion, pull request, or log attachment. If the private reporting entry is unavailable, open only a detail-free public issue asking maintainers to check the security-reporting configuration.
+
+Include, where safe:
+
+- affected version/commit and DSH version;
+- deployment topology (Web/native, single-user/shared, Credential Provider);
+- reproduction steps or proof of concept;
+- impact and whether secrets or personal data were accessed;
+- logs with tokens, cookies, API keys, subjects, and internal hosts redacted;
+- suggested mitigation or embargo constraints.
+
+Maintainers aim to acknowledge a complete report within three business days, provide an initial assessment within seven business days, and coordinate disclosure after a fix is available. These are response targets, not a legal or service-level commitment.
+
+## In scope
+
+- OIDC state/nonce/PKCE/token validation and callback handling;
+- identity confusion between ID Token, UserInfo, bootstrap, profiles, or native backend;
+- Key Binding authorization, Provider binding, idempotency, or API-key exposure;
+- credential storage/resolution and cross-user or cross-profile isolation;
+- profile validation bypass or remote code/style execution;
+- client loader, branding, XSS, open redirect, SSRF, or unsafe URL handling;
+- dependency/build/release supply-chain compromise.
+
+## Out of scope
+
+- vulnerabilities solely in an unmodified upstream DSH/pi-ai/Node dependency (report upstream, but notify this project if exploitable here);
+- an operator intentionally publishing secrets in a profile despite documented prohibitions;
+- unsupported shared multi-user deployment using a global/file-backed Credential Provider;
+- social engineering, physical attacks, or denial-of-service requiring unrealistic traffic, unless a low-cost amplification exists.
+
+## Handling secrets
+
+Never attach real tokens, keys, cookies, user records, production profiles, or raw session exports to an issue. If a repository secret is discovered, revoke/rotate it first; deleting Git history alone is not remediation.

package/SECURITY.md

@@ -0,0 +1,45 @@
+# 安全政策
+
+**简体中文** | [English](SECURITY.en.md)
+
+## 支持版本
+
+当前受支持发布线为 `0.1.x`，安全修复应用于该发布线的最新版本。`0.1.0` 之前的 alpha 版本仅保留用于迁移和历史复现，不再接收常规修复。
+
+## 报告漏洞
+
+怀疑存在漏洞、秘密泄露、私有 endpoint、身份混淆、凭据暴露或授权绕过时，**不要创建公开 Issue**。
+
+请通过 GitHub 的 [Private Vulnerability Reporting](https://github.com/freedomkk-qfeng/dsh-oidc/security/advisories/new) 私密提交报告。不要在公开 Issue、Discussion、Pull Request 或日志附件中披露漏洞细节、真实凭据或个人信息。如果该入口不可用，请只创建一条不含技术细节的公开 Issue，提醒维护者检查安全报告配置。
+
+在安全允许的情况下，请提供：
+
+- 受影响版本/commit 和 DSH 版本；
+- 部署拓扑（Web/native、单用户/共享、Credential Provider）；
+- 复现步骤或 PoC；
+- 影响范围，以及是否访问了秘密或个人数据；
+- 已脱敏 Token、Cookie、API Key、subject 和内部 host 的日志；
+- 建议缓解措施或保密期要求。
+
+维护者目标是在三个工作日内确认完整报告，在七个工作日内给出初步评估，并在修复可用后协调披露。上述时间是响应目标，不是法律或服务等级承诺。
+
+## 范围内
+
+- OIDC state/nonce/PKCE/token 校验和 callback 处理；
+- ID Token、UserInfo、bootstrap、Profile 或 native 后端之间的身份混淆；
+- Key Binding 授权、Provider 绑定、幂等或 API Key 暴露；
+- 凭据存储/解析，以及跨用户或跨 Profile 隔离；
+- Profile 校验绕过或远程代码/样式执行；
+- Client loader、品牌替换、XSS、开放重定向、SSRF 或不安全 URL 处理；
+- 依赖、构建和发布供应链攻击。
+
+## 范围外
+
+- 只存在于未修改上游 DSH/pi-ai/Node 依赖中的漏洞（应报告上游；若能在本项目中利用，也请通知本项目）；
+- 运维方违反明确禁令，主动在 Profile 中公开秘密；
+- 使用全局/文件型 Credential Provider 的不受支持共享多用户部署；
+- 社会工程、物理攻击，或需要不现实流量的拒绝服务攻击，除非存在低成本放大。
+
+## 秘密处理
+
+不得在 Issue 中附加真实 Token、Key、Cookie、用户记录、生产 Profile 或原始 session 导出。如果发现仓库秘密，应先撤销或轮换；仅删除 Git 历史不构成修复。

package/SUPPORT.en.md

@@ -0,0 +1,15 @@
+# Support
+
+[简体中文](SUPPORT.md) | **English**
+
+Use [GitHub Issues](https://github.com/freedomkk-qfeng/dsh-oidc/issues) for public integration questions. Use the private process in [`SECURITY.en.md`](SECURITY.en.md) for vulnerabilities and secrets.
+
+When reporting a normal bug, include:
+
+- `dsh-oidc`, Node.js, DSH, and pi-ai versions;
+- Web or native backend and Credential Provider type;
+- sanitized Enterprise Profile with all real domains/IDs replaced;
+- expected and observed behavior;
+- minimal reproduction and redacted logs.
+
+The project does not support shared multi-user Web deployment, unreviewed DSH versions, private Provider adapters selected by profiles, or production secrets posted publicly.

package/SUPPORT.md

@@ -0,0 +1,15 @@
+# 支持
+
+**简体中文** | [English](SUPPORT.en.md)
+
+普通集成问题请使用 [GitHub Issues](https://github.com/freedomkk-qfeng/dsh-oidc/issues)。漏洞和秘密信息请使用[安全政策](SECURITY.md)规定的私有流程。
+
+报告普通缺陷时，请提供：
+
+- `dsh-oidc`、Node.js、DSH 和 pi-ai 版本；
+- Web 或 native 后端，以及 Credential Provider 类型；
+- 已将真实域名和 ID 全部替换的脱敏 Enterprise Profile；
+- 预期行为和实际行为；
+- 最小复现和脱敏日志。
+
+项目不支持以下情形：共享多用户 Web 部署；未经审查的 DSH 版本；由 Profile 选择的私有 Provider adapter；在公开渠道提交生产秘密。

package/THIRD_PARTY_NOTICES.en.md

@@ -6,8 +6,8 @@
 
 ## Runtime peers (not copied into this repository)
 
-- DeepSeek Harness packages `0.1.2-alpha.2` and `@deepseek-ai/cordis` `4.0.2` — MIT, Copyright (c) 2026 DeepSeek, <https://github.com/deepseek-ai/deepseek-harness>
-- `@earendil-works/pi-ai` `^0.84.2` (`0.84.4` in the reviewed source Runtime) — MIT, <https://github.com/earendil-works/pi>
+- DeepSeek Harness packages `0.1.5-rc.1` and `@deepseek-ai/cordis` `4.0.2` — MIT, Copyright (c) 2026 DeepSeek, <https://github.com/deepseek-ai/deepseek-harness>
+- `@earendil-works/pi-ai` `0.85.1` — MIT, <https://github.com/earendil-works/pi>
 - React `18.x` — MIT, Copyright (c) Facebook, Inc. and its affiliates, <https://github.com/facebook/react>
 
 This repository uses public package APIs and does not vendor their source. Their presence as peer dependencies does not imply endorsement of this project.
@@ -44,8 +44,10 @@ Source: <https://github.com/colinhacks/zod>
 
 ## Development-only tools
 
-The repository also declares tsdown (MIT), TypeScript (Apache-2.0), Ajv (MIT), YAML (ISC), and `@types/react` (MIT) for build and validation. They are not included in the npm package's runtime files. Review their transitive licenses and install scripts from the lockfile before release.
+The lock pins the RC.1 DSH test closure plus tsdown (MIT), TypeScript and Playwright Core (Apache-2.0), Ajv (MIT), YAML (ISC), and React types (MIT). Development tools are not copied into the published runtime files. Playwright Core does not download browser binaries during installation.
 
-At the alpha.1 lockfile, npm reports install scripts on `@google/genai` (a no-op preinstall) and `protobufjs` (postinstall), both reached through the `@earendil-works/pi-ai` peer tree. npm's allow-scripts policy left them unapproved during the preparation install. Release managers must re-review this fact whenever the lockfile changes; `npm audit` reporting zero known vulnerabilities does not replace that review.
+The current lock flags two lifecycle scripts: `@google/genai@1.52.0` has an echo-only preinstall; `protobufjs@7.6.6` reads local package manifests and may emit version-scheme warnings. Its reviewed postinstall contains no download or process execution. The local npm allow-scripts policy left these scripts unapproved; review them again when the lock changes. A successful install is not a security-audit result.
 
-The prepared lockfile contains 255 package entries with declared license metadata: MIT (190), Apache-2.0 (48), BSD-3-Clause (12), ISC (3), Python-2.0 (1, `argparse`), and 0BSD (1). This is an inventory result, not legal advice; the release manager must regenerate and review it from the final lockfile.
+`fast-sha256@1.3.0`, reached through pi-ai → Anthropic SDK → standardwebhooks, declares Unlicense. Its distributed LICENSE grants copying, modification and distribution and disclaims warranty. The license check records a package/version-specific exception, not a blanket waiver for unknown licenses; no source is copied into this repository.
+
+The reviewed lock has 260 licensed package entries: 0BSD (1), Apache-2.0 (46), BSD-3-Clause (12), ISC (2), MIT (197), Python-2.0 (1), Unlicense (1). Regenerate this inventory for the final release lock.

package/THIRD_PARTY_NOTICES.md

@@ -6,8 +6,8 @@
 
 ## 运行时 Peer（源码未复制进本仓库）
 
-- DeepSeek Harness `0.1.2-alpha.2` 软件包和 `@deepseek-ai/cordis` `4.0.2`——MIT，Copyright (c) 2026 DeepSeek，<https://github.com/deepseek-ai/deepseek-harness>
-- `@earendil-works/pi-ai` `^0.84.2`（已审查源码 Runtime 中为 `0.84.4`）——MIT，<https://github.com/earendil-works/pi>
+- DeepSeek Harness `0.1.5-rc.1` 软件包和 `@deepseek-ai/cordis` `4.0.2`——MIT，Copyright (c) 2026 DeepSeek，<https://github.com/deepseek-ai/deepseek-harness>
+- `@earendil-works/pi-ai` `0.85.1`——MIT，<https://github.com/earendil-works/pi>
 - React `18.x`——MIT，Copyright (c) Facebook, Inc. and its affiliates，<https://github.com/facebook/react>
 
 本仓库使用这些软件包的公开 API，不 vendor 其源码。它们作为 peer dependency 出现，不表示其作者认可本项目。
@@ -46,8 +46,10 @@ SOFTWARE.
 
 ## 仅开发使用的工具
 
-仓库还声明 tsdown（MIT）、TypeScript（Apache-2.0）、Ajv（MIT）、YAML（ISC）和 `@types/react`（MIT），用于构建与校验。它们不包含在 npm 包运行时文件中。发布前应根据 lockfile 审查其间接许可证和安装脚本。
+锁文件固定 RC.1 DSH 测试闭包及 tsdown（MIT）、TypeScript/Playwright Core（Apache-2.0）、Ajv（MIT）、YAML（ISC）、React 类型（MIT）。开发工具不复制到发布的运行文件。Playwright Core 安装时不下载浏览器二进制。
 
-在 alpha.1 lockfile 中，npm 报告 `@google/genai`（无操作 preinstall）和 `protobufjs`（postinstall）包含安装脚本；二者均来自 `@earendil-works/pi-ai` peer 依赖树。准备安装期间，npm allow-scripts 策略未批准这些脚本。每次 lockfile 变化后，发布经理必须重新审查；`npm audit` 报告零已知漏洞不能替代该审查。
+当前锁标记两个生命周期脚本：`@google/genai@1.52.0` 只有 echo 的 preinstall；`protobufjs@7.6.6` 读取本地 package manifest，必要时输出版本约定提醒，所审查 postinstall 没有下载和进程执行。此次本机 npm allow-scripts 策略仍未批准这两项；锁变化后应重新审查。安装成功不代表已完成安全审计。
 
-准备好的 lockfile 含 255 个带许可证元数据的软件包条目：MIT 190 个、Apache-2.0 48 个、BSD-3-Clause 12 个、ISC 3 个、Python-2.0 1 个（`argparse`）和 0BSD 1 个。这只是清单结果，不构成法律意见；发布经理必须从最终 lockfile 重新生成并审查。
+`fast-sha256@1.3.0` 经 pi-ai → Anthropic SDK → standardwebhooks 引入，声明 Unlicense。已核对其分发 LICENSE 中复制、修改、分发授权与免责条款；许可证检查只为该包的该版本记录例外，不放开其他未知许可证。其源码不复制进本仓库。
+
+当前已审查锁共有 260 个声明许可证的软件包条目：0BSD (1), Apache-2.0 (46), BSD-3-Clause (12), ISC (2), MIT (197), Python-2.0 (1), Unlicense (1)。正式发布锁应重新生成清单。

package/cordis.patch.yml

@@ -5,4 +5,5 @@
     - id: enterprise-oidc
       name: '@eduwork/dsh-oidc'
       config:
-        profilePathEnv: DSH_OIDC_ENTERPRISE_PROFILE
+        profilePathEnv: EDUWORK_OIDC_PROFILE
+        allowEmptyProfiles: true

package/docs/EDUWORK-MIGRATION.en.md

@@ -1,13 +1,13 @@
-# eduwork npm scope migration
+# Package and enterprise-credential migration
 
 [简体中文](EDUWORK-MIGRATION.md) | **English**
 
-Starting with this version, the npm package is `@eduwork/dsh-oidc@0.1.0-alpha.11`, replacing `dsh-oidc`. The npm `eduwork` organization exists. The GitHub repository and checkout directory remain `dsh-oidc`. Consult the npm registry for current publication status.
+Starting with `0.1.0-alpha.11`, the npm package identity changed to `@eduwork/dsh-oidc`, replacing `dsh-oidc`; `0.1.0` is the first stable semantic version after that migration. The npm `eduwork` organization exists. The GitHub repository and checkout directory remain `dsh-oidc`. Consult the npm registry for current publication status.
 
-## Installation and migration
+## Historical npm scope migration (0.1.0)
 
 ```sh
-dsh plugin --profile web add @eduwork/dsh-oidc@0.1.0-alpha.11
+dsh plugin --profile web add @eduwork/dsh-oidc@0.1.0
 ```
 
 Back up an existing Profile's package.json and cordis.patch.yml, then update its dependency and dsh.profile.bundles entries. Update module name paths in custom patches too. Do not enable both package identities together; restart the Host after switching. These are separate npm packages, so updating the old package cannot migrate an installation automatically.
@@ -20,4 +20,16 @@ Storage directories and user configuration content do not change. Product-manage
 
 ## Release scope
 
-This is an alpha package-identity migration retaining the declared DSH peer baseline. Build, tests, documentation, license and tarball checks cover this change. It adds no claims of real institutional sign-in, real email delivery or production acceptance. Stable releases still require the complete deployment checks. Keep previous versions installable and add a migration notice only after the new package passes installation validation.
+`0.1.0` stabilizes the package identity as `@eduwork/dsh-oidc` and targets DSH `0.1.2-rc.1` exactly. Build, tests, documentation, license, and tarball checks cover this change; they do not constitute real institutional sign-in, real email delivery, or production acceptance. Production adoption still requires the complete public-release deployment checks. Keep the old package and scoped alpha versions installable rather than unpublishing them.
+
+## Current 0.2.x candidate: common enterprise credential
+
+The default local reference is `EDUWORK_API_KEY`, independent of institution and Provider names. Explicit legacy automatic references derived from the same Profile ID or Provider ID (uppercase, non-alphanumerics replaced with `_`, plus `_API_KEY`) normalize to the new default. Unrelated custom references such as `MY_TEST_MODEL_KEY` remain unchanged. This is a local secret-store name, never a new server request field.
+
+An existing Web/desktop session may migrate a legacy key only when issuer, client ID, management URL, runtime URL and Provider ID match and only the reference changes. The destination must be empty; another profile must not claim the source; a saved fingerprint, when present, must match. Migration never imports arbitrary environment keys, overwrites an occupied destination, or trusts a key from a different deployment. Config files are read compatibly rather than overwritten.
+
+After a different organization binds the common slot, only the session owning its current fingerprint may call that Provider. Other sessions retain identity but need resource reconnection; their logout cannot delete the new owner's key. Manually configured personal model keys remain untouched. If endpoints change, identity may remain valid while model credentials must be rebound; changed issuer/client ID requires sign-in again. Do not manually copy keys to bypass these checks.
+
+Both new desktop shells use the common desktop backend. Legacy `native` account bridges still own their credential storage and must return a matching reference; this plugin does not rewrite OS-vault entries. Plugin migration moves no workspaces, history directories or application data; shell-level data migration belongs to the product.
+
+The frozen dev.7 package remains unchanged. `0.2.0` provides the same runtime implementation under a stable semantic version. Distribution assembly pins npm `@eduwork/dsh-oidc@0.2.0` and its integrity with coherent DSH `0.1.5-rc.1` dependencies. Publication status and [release checks](release-checklist.en.md) are recorded separately; no old npm version or public tag is rewritten.

package/docs/EDUWORK-MIGRATION.md

@@ -1,13 +1,13 @@
-# eduwork npm 作用域迁移
+# 包名与企业凭据迁移
 
 **简体中文** | [English](EDUWORK-MIGRATION.en.md)
 
-从本版本起，npm 包使用 `@eduwork/dsh-oidc@0.1.0-alpha.11`，替代旧的 `dsh-oidc`。npm `eduwork` 组织已创建；GitHub 仓库和本地 checkout 目录继续使用 `dsh-oidc`。包的当前发布状态以 npm registry 为准。
+从 `0.1.0-alpha.11` 起，npm 包改用 `@eduwork/dsh-oidc`，替代旧的 `dsh-oidc`；`0.1.0` 是完成该迁移后的首个稳定语义版本。npm `eduwork` 组织已创建；GitHub 仓库和本地 checkout 目录继续使用 `dsh-oidc`。包的当前发布状态以 npm registry 为准。
 
-## 安装与迁移
+## 历史 npm 作用域迁移（0.1.0）
 
 ```sh
-dsh plugin --profile web add @eduwork/dsh-oidc@0.1.0-alpha.11
+dsh plugin --profile web add @eduwork/dsh-oidc@0.1.0
 ```
 
 已有 Profile 先备份 package.json 与 cordis.patch.yml，再更新依赖和 dsh.profile.bundles；手写 patch 的模块路径 name 也需切换。不要同时启用新旧两份插件，切换后重启 Host。旧版本和新作用域版本是不同 npm 包，旧包的更新不会自动迁移安装。
@@ -20,4 +20,16 @@ dsh plugin --profile web add @eduwork/dsh-oidc@0.1.0-alpha.11
 
 ## 发布范围
 
-此版本为 alpha 包身份迁移，沿用声明的 DSH peer 基线。构建、测试、文档、开源和 tarball 检查针对本次变更执行；不新增真实学校登录、真实邮件发送或生产部署验收结论。稳定发布仍须完成公开发布检查表中的完整部署验收。旧包保持可安装，新包安装验证通过后添加迁移提示，不撤回旧版本。
+`0.1.0` 将包身份稳定在 `@eduwork/dsh-oidc`，并精确适配 DSH `0.1.2-rc.1`。构建、测试、文档、开源和 tarball 检查针对本次变更执行；这不等于真实学校登录、真实邮件发送或生产部署验收。生产采用仍须完成公开发布检查表中的完整部署验收。旧包和 scoped alpha 保持可安装，不撤回旧版本。
+
+## 当前 0.2.x 候选：统一企业凭据
+
+默认本地引用为 `EDUWORK_API_KEY`，与学校和 Provider 名称无关。同一 Profile ID 或 Provider ID 派生的旧自动引用（转大写，非字母数字换为 `_`，后接 `_API_KEY`）也会规范化为新默认值。其他显式自定义引用如 `MY_TEST_MODEL_KEY` 保持不变。这只是本地秘密存储名称，不是新的服务端请求字段。
+
+旧 Web/desktop 会话只有在 issuer、client ID、管理 URL、运行 URL、Provider ID 全部一致，仅引用改名时才迁移旧 Key。目标槽必须为空，源引用不能被其他 Profile 声明；已有指纹时必须匹配。不会从任意环境变量导入 Key，不覆盖非空目标，也不接纳其他部署的 Key。已有配置文件按兼容规则读取，不会被覆盖改写。
+
+另一机构完成绑定并写入公共槽后，只有拥有当前指纹的会话才能调用该 Provider。其他会话保留身份但需重新连接资源；它们注销时不能删除新所有者的 Key。用户单独配置的个人模型 Key 不受影响。资源端点改变可保留身份，但必须重新绑定模型凭据；issuer/client ID 改变需重新登录。不要手动复制 Key 绕过归属校验。
+
+两种新桌面壳共用 desktop backend。旧 `native` 账号桥仍由宿主管理凭据存储并返回匹配引用；本插件不改写操作系统凭据库。插件迁移不搬动工作区、历史目录或应用数据；更换桌面壳的数据迁移由产品处理。
+
+已冻结 dev.7 包保持原样。`0.2.0` 将同一运行实现按稳定语义版本提供，正式装配固定 npm `@eduwork/dsh-oidc@0.2.0` 和 integrity，并统一宿主 DSH `0.1.5-rc.1` 依赖；发布状态和[发布检查](release-checklist.md)分别记录，不重写旧 npm 版本或公开 tag。

package/docs/account-extensions.en.md

@@ -0,0 +1,40 @@
+# Institution account extensions
+
+[简体中文](account-extensions.md) | **English**
+
+As of `0.2.0-dev.20260910.6`, public OIDC owns identity, managed model keys, models/default selection and sign-out. Quota HTTP, normalization and presentation are external, and public OIDC sends no heartbeat. `resources(profileID)` returns only `{profileID, modelSource, models, issues}`. Extracting quota alone does not require a new login. The dev.7 credential rename migrates only verified ownership and an identical deployment binding; unproven ownership retains identity but requires model-resource reconnection. Deploy matching client and Host type descriptors.
+
+## Host transport
+
+An institution plugin depends on `oidcAccounts` and MUST first check its explicitly configured `profileIDs` allowlist. Installing an institution edition does not authorize quota requests for every organization the user adds.
+
+```js
+const response = await ctx.oidcAccounts.modelResourceFetch(profileID, '/quota', { signal })
+```
+
+This Host-only method has no Remote decorator and never exposes credentials. It uses the configured `profile.provider.baseURL`, active identity and current managed model key; `provider` and `keyBinding` are required. Only GET is supported. Paths consist of slash-separated letters, digits, underscores or hyphens; absolute URLs, query/hash, escaped or dot paths and extra options are rejected. Redirects are denied, timeout is 20 seconds, and the buffered response limit is 1 MiB. HTTP failures return Response; the extension defines safe user-facing states. Do not display raw request/response secrets.
+
+Logout or key replacement during response reading invalidates the result. The extension MUST also subscribe to `oidc/accounts-changed` and `credentials/reference-updated`, invalidate its generation, and check that generation after async operations. Abort requests on disposal. The public package does not cache extension data.
+
+For identity-token services, use the separate `authorizedFetch(profileID, endpoint, init)` method with approved origins, token refresh and one 401 retry. See [the public protocol](public-resource-protocol.en.md). Neither transport schedules business requests itself.
+
+## Client account menu
+
+The public sidebar account declares the official `oidc.account.menu.details` child slot, `kind: single`, `scope: root`. Use `slots.inject()` before registering the occupant. Public UI continues to own identity, login, model credential provisioning and sign-out.
+
+| Owner prop | Meaning |
+| --- | --- |
+| `profile`, `status` | Trusted configuration and non-secret current state; read-only |
+| `busy` | Public account operation in progress; disable competing operations |
+| `run(operation)` | Shared busy/error handling for an async user action |
+| `refreshAccount()` | Reconcile identity/model connection without automatic provisioning |
+| `defaultContent` | Public Refresh account action; return it for inapplicable profiles |
+
+```js
+ctx.slots.inject('oidc.account.menu.details', () =>
+  ctx.slots.register({ name: 'oidc.account.menu.details', priority: -100 }, Details))
+```
+
+The extension owns its own RPC/schema. Check explicit profile ID, provider configuration and `status.credentialReady` before reading; otherwise return `defaultContent` without querying quota. Discard late results after account change, sign-out or unmount. Focusable actions use `role="menuitem"` to share arrow/Escape/outside-focus behavior. Refresh must not replace a personal model selected later by the user.
+
+An ECNU extension may display model allowance, reset dates, resource packs, details and refresh. Missing quantities are unknown; without a total, do not invent percentages. Its `/quota` wire is an institution contract outside the public resource protocol.

package/docs/account-extensions.md

@@ -0,0 +1,42 @@
+# 机构账户扩展接口
+
+**简体中文** | [English](account-extensions.en.md)
+
+从 `0.2.0-dev.20260910.6` 起，公版负责 OIDC 身份、托管模型 Key、模型目录、默认模型与注销；不再包含配额请求、字段归一化或配额 UI，也不发送心跳。`resources(profileID)` 只返回 `{profileID, modelSource, models, issues}`。配额拆分本身不要求重新登录；dev.7 的凭据改名按完整绑定与归属校验迁移，无法证明归属时保留身份并重新连接模型。安装新客户端和公共包须使用一致的类型描述。
+
+## Host 授权传输
+
+机构插件可以依赖 `oidcAccounts` 服务，但必须先用自己的显式 `profileIDs` 白名单判断请求对象。不能仅凭“安装在机构发行版”就查询用户后来添加的其他企业。
+
+```js
+const response = await ctx.oidcAccounts.modelResourceFetch(profileID, '/quota', { signal })
+```
+
+这是 Host 专属方法，**没有 Remote 标记**，不向客户端返回 Key。请求使用已配置的 `profile.provider.baseURL` 和当前托管模型 Key；需要已配置 `provider`、`keyBinding` 和有效登录。只允许 GET，路径必须是 `/segment` 形式（字母、数字、下划线、连字符，可多级），拒绝 URL、查询、片段、编码路径、点段和额外请求选项。请求不跟随重定向，超时 20 秒，缓冲响应最多 1 MiB。HTTP 错误仍返回 Response，由扩展定义友好状态。网络异常和身份变化可能抛出错误；扩展不得向 UI 回显原始请求或响应中的秘密。
+
+读取响应期间注销或替换 Key 会拒绝结果。扩展还必须在自身层订阅 `oidc/accounts-changed` 和 `credentials/reference-updated`，失效正在请求的账户快照；每次异步操作结束后检查世代编号，不能将旧用户结果写入新用户状态。扩展卸载时中止请求。公版不缓存扩展资源。
+
+需要 OIDC 身份 Token 的机构服务仍用 `authorizedFetch(profileID, endpoint, init)`：它遵循已批准的 origin、令牌刷新及一次 401 重试，与上述模型 Key 运输不同。见 [公共身份与资源协议](public-resource-protocol.md)。这两个方法都不会自动触发业务请求。
+
+## 客户端账户菜单
+
+公共 `ui.sidebar.footer.account` 注册一个官方 DSH 子插槽 `oidc.account.menu.details`，类型 `single`、作用域 `root`。可选扩展通过 `slots.inject()` 等待插槽，然后 `slots.register()` 注册组件。公共部分始终拥有身份信息、登录、模型凭据创建及注销；扩展只提供中间附加内容。
+
+组件接收以下 owner props：
+
+| 字段 | 含义 |
+| --- | --- |
+| `profile`, `status` | 当前受信配置与无秘密的账户状态；不可修改 |
+| `busy` | 公共账户操作进行中，扩展操作应禁用 |
+| `run(operation)` | 运行用户操作，复用忙碌及错误呈现；operation 不应泄露响应正文 |
+| `refreshAccount()` | 重新核实账户和模型连接，不自动 Provision |
+| `defaultContent` | 公共“刷新账户”按钮；不适用的组织必须返回它 |
+
+```js
+ctx.slots.inject('oidc.account.menu.details', () =>
+  ctx.slots.register({ name: 'oidc.account.menu.details', priority: -100 }, Details))
+```
+
+扩展自定义 RPC 与字段 schema 归自己的包。组件必须根据明确配置的 profile ID、Provider 是否存在和 `status.credentialReady` 决定是否读取；不匹配或缺少 Key 时返回 `defaultContent`，不得请求配额。账户切换、退出及组件卸载后丢弃迟到结果。可聚焦操作使用 `role="menuitem"`，复用公共菜单的方向键、Escape 与失焦关闭规则。刷新不应夺走用户后来选择的个人模型。
+
+ECNU 发行方的独立扩展可以提供模型额度、资源包、重置时间、详情和刷新。数量缺失代表未知；没有总量不能绘制百分比。该业务及其 `/quota` wire 不属于公共资源协议。

package/docs/architecture.en.md

@@ -10,7 +10,7 @@ The design follows five rules:
 
 1. **DSH owns the runtime.** The plugin uses official DSH services and `PiAiAdapter`; it does not implement a parallel conversation or model transport stack.
 2. **Standards own identity.** Authentication uses OIDC Discovery, Authorization Code + PKCE, ID Tokens, UserInfo, refresh, and optional revocation.
-3. **The institutional service is one complete delivery boundary.** One accountable owner must jointly deliver OIDC, fixed Key Binding, and the model gateway; a Profile declares only their public endpoints and facts.
+3. **The institutional service is one complete delivery boundary.** Managed models require one accountable owner to jointly deliver OIDC, fixed Key Binding and the model gateway; identity-only mode requires only OIDC. a Profile declares only their public endpoints and facts.
 4. **Configuration is data, not code.** A profile cannot select executable adapters, arbitrary endpoint paths, scripts, stylesheets, tools, or skills.
 5. **Product-specific capabilities compose around the core.** The common enterprise-model settings surface belongs to `dsh-oidc`; desktop shells, quota views, model transforms, or institutional pages remain separate plugins/services.
 
@@ -56,12 +56,12 @@ sequenceDiagram
   L->>M: OpenAI-compatible streaming request
 ```
 
-The OIDC Provider, Key Binding, and model gateway in the diagram are three interface groups in one [server API specification](server-integration-contract.en.md). They may route to different internal systems or origins, but an operator cannot choose only a subset. The Web callback always returns to local `127.0.0.1`, not a public institutional DSH address.
+The OIDC Provider, Key Binding, and model gateway in the diagram are three interface groups in one [server API specification](server-integration-contract.en.md). They may route to different internal systems or origins, managed-model mode needs all three groups, while identity-only mode omits the two model-resource groups. The Web callback always returns to local `127.0.0.1`, not a public institutional DSH address.
 
 ## Code layout
 
 - `src/host/index.js`: DSH service entry and Typert remote methods.
-- `src/host/oidc.js`: Web and native account backends.
+- `src/host/oidc.js`: Shared Web/desktop OIDC implementation and the legacy native adapter.
 - `src/host/profile.js`: validation, imports, public projection, Provider projection.
 - `src/host/provider/`: local DSH/PiAi Provider adapter and transform seam.
 - `src/client/`: DSH browser bundle, account surfaces, and remote descriptors.
@@ -83,13 +83,13 @@ OIDC is the only authentication and identity source in the Web backend, which st
 
 ## Credential boundary
 
-The Key Binding service returns the model API key exactly once per resolve/provision/renew response. `dsh-oidc` writes it under the normalized Enterprise Profile credential reference. The default remains deterministically derived from Provider ID:
+The Key Binding service returns the model API key exactly once per resolve/provision/renew response. `dsh-oidc` writes it under the normalized Enterprise Profile credential reference. The default is a single institution-neutral reference:
 
 ```text
-example-ai -> EXAMPLE_AI_API_KEY
+EDUWORK_API_KEY
 ```
 
-Production and test may retain the same Provider ID and wire-level `provider_id` while explicitly using different `keyBinding.credentialRef` values in their respective trusted Profiles. This separates local secret namespaces without changing the server protocol.
+Legacy automatic names normalize to `EDUWORK_API_KEY`; other explicit references remain unchanged. A credential fingerprint is stored alongside verified identity and the complete resource binding in the Host session. Network use and logout cleanup require the current key to belong to that session. The fingerprint is never projected into RPC, logs or conversation text. See the [Profile specification](enterprise-profile.en.md) for migration boundaries.
 
 The Provider adapter resolves that reference at request time. It never reads an ambient pi-ai credential store and never places the key in the Enterprise Profile, UI payload, logs, or DSH transcript. Web and native backends follow the same Profile rule. Native `enterpriseAccounts` is only a host capability adapter; it does not own credential naming, and a conflicting reference is rejected.
 
@@ -107,11 +107,11 @@ Optional feature plugins register a transform through the Cordis service `enterp
 
 It must not mutate the durable transcript or register a competing adapter for the same route. Native multimodal routes can therefore bypass a text-only image-understanding fallback, while text-only routes can opt into it.
 
-## Native desktop boundary
+## Desktop and legacy native boundary
 
-`backend: native` delegates identity lifecycle and optional mutable enterprise-provider management to a host service named `enterpriseAccounts`. This exists for desktop products that require operating-system browser launch, loopback coordination, OS credential vaults, or locally persisted provider choices.
+New desktop products use `backend: desktop`: a temporary loopback callback and official browser service share the OIDC/Key/model implementation across Wails and Electron. The host supplies credential storage. Legacy `backend: native` delegates to `enterpriseAccounts` only for existing bridges; see [desktop integration](desktop-host.en.md).
 
-Wails is not part of this repository or interface. A non-Wails desktop, mobile host, or another local shell can implement the same service. The same component registers one `settings.section` entry in both modes: Web presents trusted Enterprise Profiles read-only, while a native host may advertise add/switch/model-edit/restart capabilities. This official whole-page extension avoids depending on or patching the internals of DSH's Models page. `uiMode: models-only` lets a product reuse exactly that surface while retaining separate account, quota, update, or diagnostic surfaces; `external` disables all plugin UI.
+The shared UI uses official `settings.models.footer`, onboarding, sidebar and general-settings slots. Institution configuration is read-only trusted data. Legacy bridge mutation methods are compatibility APIs, not a requirement or default UI for new institutions. `models-only` mounts the shared model-settings surface; `external` disables plugin UI. Quota and heartbeat remain in explicitly installed institution extensions.
 
 ## Deliberate exclusions
 

package/docs/architecture.md

@@ -10,7 +10,7 @@
 
 1. **DSH 负责运行时。** 插件使用 DSH 官方服务和 `PiAiAdapter`，不另建对话或模型传输栈。
 2. **身份遵循标准。** 认证使用 OIDC Discovery、Authorization Code + PKCE、ID Token、UserInfo、刷新和可选撤销。
-3. **机构服务是一个完整交付边界。** 同一服务所有者必须共同交付 OIDC、固定 Key Binding 和模型网关；Profile 只能声明这些协议表面的公开地址与事实。
+3. **机构服务是一个完整交付边界。** 托管模型模式要求服务所有者共同交付 OIDC、固定 Key Binding 和模型网关；纯身份模式只需 OIDC。Profile 只能声明这些协议表面的公开地址与事实。
 4. **配置是数据，不是代码。** Profile 不能选择可执行 adapter、任意接口路径、脚本、样式表、工具或 Skill。
 5. **产品特有能力围绕核心组合。** 通用企业模型设置界面属于 `dsh-oidc`；桌面外壳、配额视图、模型转换或机构业务页面仍由独立插件或服务承担。
 
@@ -56,12 +56,13 @@ sequenceDiagram
   L->>M: OpenAI-compatible 流式请求
 ```
 
-图中 OIDC Provider、Key Binding 和模型网关是同一份[服务端接口规范](server-integration-contract.md)的三个接口组。它们可以在机构内部拆成不同系统或域名，但不能由部署方任选其一。Web 回调始终返回本机 `127.0.0.1`，不经过机构公网 DSH 地址。
+图中 OIDC Provider、Key Binding 和模型网关是同一份[服务端接口规范](server-integration-contract.md)的三个接口组。它们可以在机构内部拆成不同系统或域名，托管模型模式需要三组完整服务；纯身份模式可以省略两个模型资源组。Web 回调始终返回本机 `127.0.0.1`，不经过机构公网 DSH 地址。
 
 ## 代码布局
 
 - `src/host/index.js`：DSH 服务入口和 Typert 远程方法。
-- `src/host/oidc.js`：Web 与 native 账号后端。
+- `src/host/oidc.js`：Web/desktop 共用 OIDC 实现及旧 native adapter。
+- `src/host/desktop-oidc.js`：临时 loopback 登录与取消。
 - `src/host/profile.js`：校验、导入、公共投影和 Provider 投影。
 - `src/host/provider/`：本地 DSH/PiAi Provider adapter 和转换扩展点。
 - `src/client/`：DSH 浏览器 bundle、账号界面和远程描述符。
@@ -83,13 +84,13 @@ Web 后端只以 OIDC 作为认证和身份来源，并只在 DSH WebServer 精
 
 ## 凭据边界
 
-Key Binding 服务在每次 resolve/provision/renew 响应中返回模型 API Key。`dsh-oidc` 将其写入 Enterprise Profile 解析后的 DSH 凭据引用。默认值仍由 Provider ID 确定性派生：
+Key Binding 服务在每次 resolve/provision/renew 响应中返回模型 API Key。`dsh-oidc` 将其写入 Enterprise Profile 解析后的 DSH 凭据引用。默认值统一为机构无关的公共引用：
 
 ```text
-example-ai -> EXAMPLE_AI_API_KEY
+EDUWORK_API_KEY
 ```
 
-生产与测试可以保持相同的 Provider ID 和服务端 `provider_id`，同时在各自受信任的 Profile 中显式使用不同的 `keyBinding.credentialRef`。这只隔离本地秘密命名空间，不改变服务端协议。
+旧自动引用按 Profile 规则兼容到 `EDUWORK_API_KEY`，其他显式引用保持不变。模型 Key 指纹与已验证身份及完整资源绑定一起保存在 Host 会话中；任何网络使用和登出清理都要求当前值仍归属于该会话。指纹不通过 RPC、日志或对话输出。迁移范围见 [Profile 规范](enterprise-profile.md)。
 
 Provider adapter 在请求时解析该引用。它不会读取环境中的 pi-ai 凭据存储，也不会把密钥放入 Enterprise Profile、UI payload、日志或 DSH 对话记录。Web 后端和 native 后端使用同一 Profile 规则；native `enterpriseAccounts` 只是宿主能力适配器，不拥有凭据命名策略，若返回不一致的引用会被拒绝。
 
@@ -97,7 +98,7 @@ Provider adapter 在请求时解析该引用。它不会读取环境中的 pi-ai
 
 ## Provider 所有权与扩展
 
-每个 Profile 声明一个 Provider ID 和一个或多个模型。`dsh-oidc` 通过 DSH 官方 `PiAiAdapter` 和 `@earendil-works/pi-ai` 的 OpenAI Completions 实现拥有这些路由。
+托管资源 Profile 声明 Provider ID，以及本地模型或发现模式；纯身份 Profile 不声明 Provider。`dsh-oidc` 通过 DSH 官方 `PiAiAdapter` 和 `@earendil-works/pi-ai` 的 OpenAI Completions 实现拥有这些路由。
 
 可选功能插件可通过 Cordis 服务 `enterpriseTransforms` 注册转换。转换可以：
 
@@ -107,11 +108,11 @@ Provider adapter 在请求时解析该引用。它不会读取环境中的 pi-ai
 
 转换不得修改持久对话记录，也不得为同一路由注册竞争 adapter。因此，原生多模态路由可绕过仅面向文本模型的图像理解回退，而纯文本路由可以选择接入该能力。
 
-## Native 桌面边界
+## Desktop 与旧 native 边界
 
-`backend: native` 会把身份生命周期和可选的可变企业 Provider 管理委托给名为 `enterpriseAccounts` 的宿主服务。该模式适用于需要操作系统浏览器启动、回环协调、系统凭据保险库或本地 Provider 选择的桌面产品。
+新桌面使用 `backend: desktop`：临时 loopback 回调和官方浏览器服务在 Wails/Electron 间共享 OIDC/Key/模型实现，凭据存储仍由宿主提供。旧 `backend: native` 仅为已有桥接委托 `enterpriseAccounts`。见[桌面集成](desktop-host.md)。
 
-Wails 不属于本仓库或接口。非 Wails 桌面端、移动宿主或其他本地外壳都可以实现同一服务。Web 与 native 模式由同一组件注册一个 `settings.section`：Web 只读展示受信任的 Enterprise Profile，native 宿主可声明新增、切换、模型编辑和重启能力。这个官方整页扩展点不依赖也不修改 DSH“模型”页面内部实现。`uiMode: models-only` 允许产品只复用该界面，同时保留独立账号、配额、更新或诊断界面；`external` 则关闭插件全部 UI。
+共用 UI 使用官方 `settings.models.footer`、onboarding、侧栏和通用设置插槽。机构配置是只读可信数据；旧桥的可变管理方法只是兼容 API，不是新机构的默认 UI 或必需接口。`models-only` 只挂共用模型设置，`external` 关闭插件 UI。配额和心跳由显式安装的机构扩展提供。
 
 ## 明确排除