create-windy 0.8.3 → 0.9.1

package/dist/cli.js

@@ -206,6 +206,45 @@ var starterProfile = {
 };
 var projectLicenseKeys = ["UNLICENSED", "MIT", "Apache-2.0"];
 
+// src/module-distribution-audit.ts
+var auditDistribution = {
+  fileRoots: [
+    "apps/server/src/audit/drizzle-log-store.ts",
+    "apps/server/src/audit/recovery-queue.ts",
+    "apps/server/src/audit/recovery-queue.test.ts",
+    "apps/server/src/audit/reliable-writer.ts",
+    "apps/server/src/audit/reliable-writer.test.ts",
+    "apps/server/src/persistence.integration.test.ts",
+    "apps/server/src/system/audit-routes.ts",
+    "apps/server/src/observability/diagnostic-index.ts",
+    "apps/server/src/observability/diagnostic-index.test.ts",
+    "apps/server/src/observability/diagnostic-http-contract.test.ts",
+    "apps/server/src/observability/diagnostic-repository.ts",
+    "apps/server/src/observability/diagnostic-failure-recorder.ts",
+    "apps/server/src/system/diagnostic-routes.ts",
+    "apps/server/src/system/diagnostic-routes.test.ts",
+    "apps/web/src/pages/system/DiagnosticLookupPage.vue",
+    "apps/web/src/pages/system/DiagnosticLookupPage.webtest.ts",
+    "apps/web/src/pages/system/components/DiagnosticRecordDetails.vue",
+    "apps/web/src/pages/system/composables/useDiagnosticLookup.ts",
+    "apps/web/src/services/diagnostics-api.ts",
+    "packages/shared/src/diagnostics.ts",
+    "apps/server/src/system/audit-routes.test.ts",
+    "apps/web/src/pages/system/audit-log-presenter.ts",
+    "apps/web/src/pages/system/audit-time-range.ts",
+    "apps/web/src/pages/system/components/AuditActionCell.vue",
+    "apps/web/src/pages/system/components/AuditActionCell.webtest.ts",
+    "apps/web/src/pages/system/components/AuditLogDetailDialog.vue",
+    "apps/web/src/pages/system/components/AuditLogDetailDialog.webtest.ts",
+    "apps/web/src/pages/system/components/AuditLogFilters.vue",
+    "apps/web/src/pages/system/components/AuditLogFilters.webtest.ts"
+  ],
+  documentation: ["docs/platform/audit-reliability.md"],
+  schemaFiles: ["packages/database/src/schema/diagnostics.ts"],
+  databaseTables: ["audit_logs", "diagnostic_events"],
+  databaseStatementTokens: ["idx_audit_logs_", "idx_diagnostic_events_"]
+};
+
 // src/module-distribution-validation.ts
 function validateModuleDistributionCatalog(manifests) {
   const names = new Set;
@@ -281,6 +320,8 @@ var agentOptionalModule = {
     "system.workflow"
   ]),
   registryDependencies: [
+    { sourceName: "fflate", name: "fflate", version: "0.8.3" },
+    { sourceName: "yaml", name: "yaml", version: "2.9.0" },
     {
       sourceName: "@modelcontextprotocol/sdk",
       name: "@modelcontextprotocol/sdk",
@@ -294,15 +335,39 @@ var agentOptionalModule = {
   ],
   fileRoots: [
     "apps/agent-server",
+    "apps/server/scripts/check-dsh-platform-example.ts",
     "apps/document-server",
     "apps/speech-server",
     "apps/embedding-server",
     "apps/server/src/agent",
+    "apps/server/src/agent-skills",
+    "deploy/dsh",
     "apps/server/src/agent-workflow",
     "apps/server/src/ai-runtime-report",
     "apps/server/src/ai-runtime-readiness",
     "apps/server/src/app/ai-screenshot-intake-binding.ts",
     "apps/server/src/app/agent-runtime-composition.ts",
+    "apps/server/src/app/workbench-public-origin.ts",
+    "apps/server/src/app/agent-workflow-presets.ts",
+    "apps/server/src/app/dsh-skill-draft-audit.test.ts",
+    "apps/server/src/app/dsh-skill-draft-audit.ts",
+    "apps/server/src/app/dsh-workbench-handshake.test.ts",
+    "apps/server/src/app/dsh-workbench-audit.ts",
+    "apps/server/src/app/dsh-workbench-audit.test.ts",
+    "apps/server/src/app/dsh-workbench-socket-audit.test.ts",
+    "apps/server/src/app/dsh-workbench-handshake.ts",
+    "apps/server/src/app/dsh-workbench-http.test.ts",
+    "apps/server/src/app/dsh-workbench-lan-origin.test.ts",
+    "apps/server/src/app/dsh-workbench-launch.test.ts",
+    "apps/server/src/app/dsh-workbench-origin.test.ts",
+    "apps/server/src/app/dsh-workbench-proxy.ts",
+    "apps/server/src/app/dsh-workbench-session-conflict.test.ts",
+    "apps/server/src/app/dsh-workbench-session.ts",
+    "apps/server/src/app/dsh-workbench-socket.test.ts",
+    "apps/server/src/app/dsh-workbench-socket.ts",
+    "apps/server/src/app/dsh-workbench-test-support.ts",
+    "apps/server/src/app/dsh-workbench.test.ts",
+    "apps/server/src/app/dsh-workbench.ts",
     "apps/server/src/app/client-agent-host-auth-binding.ts",
     "apps/server/src/app/client-agent-workflow-artifact-binding.ts",
     "apps/server/src/app/document-output-artifact-bindings.ts",
@@ -324,8 +389,17 @@ var agentOptionalModule = {
     "apps/server/src/module-host/tool-handlers.ts",
     "apps/server/src/module-host/tool-handlers.test.ts",
     "apps/server/src/module-host/module-secret-tool-boundary.test.ts",
+    "apps/web/dsh-workbench-proxy.ts",
+    "apps/web/dsh-workbench-proxy.test.ts",
+    "apps/web/dsh-workbench-location.ts",
     "apps/web/src/pages/system/AiRuntimePage.vue",
     "apps/web/src/pages/system/AgentToolsPage.vue",
+    "apps/web/src/pages/system/SystemAgentSkillsPage.vue",
+    "apps/web/src/pages/system/SystemAgentSkillsPage.webtest.ts",
+    "apps/web/src/pages/system/components/agent-skills",
+    "apps/web/src/pages/system/composables/useAgentSkillsGovernance.ts",
+    "apps/web/src/pages/system/composables/useAgentWorkflowPresets.ts",
+    "apps/web/src/services/agent-skills-api.ts",
     "apps/web/src/pages/system/AgentDebugPage.vue",
     "apps/web/src/pages/system/components/agent-workbench",
     "apps/web/src/pages/system/composables/useAgentWorkbench.ts",
@@ -358,6 +432,7 @@ var agentOptionalModule = {
     "packages/modules/src/system-agent-admin-bindings.ts",
     "packages/modules/src/system-agent-audit-actions.ts",
     "packages/modules/src/system-agent-tools.ts",
+    "packages/modules/src/system-agent-dsh.ts",
     "packages/modules/src/system-agent-supervisor.ts",
     "packages/modules/src/system-agent-supervisor.test.ts",
     "packages/modules/src/system-ai-api-bindings.ts",
@@ -373,6 +448,8 @@ var agentOptionalModule = {
     "packages/database/src/ai-output-artifacts.test.ts",
     "packages/shared/src/agent-admin-catalog.ts",
     "packages/shared/src/agent-workbench.ts",
+    "packages/shared/src/agent-skills.ts",
+    "packages/shared/src/agent-workflow-presets.ts",
     "packages/shared/src/agent-workflow-definition.ts",
     "packages/shared/src/agent-workflow-delegation.ts",
     "packages/shared/src/agent-workflow-evaluation.ts",
@@ -385,9 +462,14 @@ var agentOptionalModule = {
   ],
   documentation: [
     "docs/adr/0003-agent-session-event-source.md",
+    "docs/adr/0004-embedded-dsh-runtime.md",
     "docs/architecture/agent-admin-workbench-plan.md",
     "docs/architecture/agent-admin-workbench-implementation.md",
     "docs/architecture/agent-harness.md",
+    "docs/architecture/embedded-dsh-integration.md",
+    "docs/platform/agent-skills.md",
+    "docs/operations/dsh-agent-migration.md",
+    "docs/development/dsh-plugins.md",
     "docs/architecture/agent-runtime-compatibility.md",
     "docs/architecture/agent-workflow.md",
     "docs/architecture/durable-jobs.md",
@@ -417,6 +499,7 @@ var agentOptionalModule = {
   ],
   schemaFiles: [
     "packages/database/src/schema/agent-runtime.ts",
+    "packages/database/src/schema/agent-skills.ts",
     "packages/database/src/schema/agent-context-message.ts",
     "packages/database/src/schema/agent-session-receipt.ts",
     "packages/database/src/schema/agent-session.ts",
@@ -431,6 +514,8 @@ var agentOptionalModule = {
   ],
   databaseTables: [
     "agent_operation_releases",
+    "agent_skill_versions",
+    "agent_skill_mutations",
     "agent_runtime_runs",
     "agent_runtime_events",
     "agent_evaluation_results",
@@ -468,6 +553,9 @@ var agentOptionalModule = {
   ],
   databaseStatementTokens: [
     "idx_agent_context_sources_origin",
+    "idx_agent_skill_",
+    "uk_agent_skill_",
+    "ck_agent_skill_",
     "idx_agent_memory_sources_origin",
     "uk_agent_source_invalidations_sequence",
     "agent_workflow_",
@@ -826,27 +914,7 @@ var platformModules = [
   },
   {
     ...module("system.audit", "\u5BA1\u8BA1\u65E5\u5FD7", "\u5BA1\u8BA1\u67E5\u8BE2\u3001\u53EF\u9760\u5199\u5165\u548C\u6062\u590D\u3002", "recommended", ["system"]),
-    fileRoots: [
-      "apps/server/src/audit/drizzle-log-store.ts",
-      "apps/server/src/audit/recovery-queue.ts",
-      "apps/server/src/audit/recovery-queue.test.ts",
-      "apps/server/src/audit/reliable-writer.ts",
-      "apps/server/src/audit/reliable-writer.test.ts",
-      "apps/server/src/persistence.integration.test.ts",
-      "apps/server/src/system/audit-routes.ts",
-      "apps/server/src/system/audit-routes.test.ts",
-      "apps/web/src/pages/system/audit-log-presenter.ts",
-      "apps/web/src/pages/system/audit-time-range.ts",
-      "apps/web/src/pages/system/components/AuditActionCell.vue",
-      "apps/web/src/pages/system/components/AuditActionCell.webtest.ts",
-      "apps/web/src/pages/system/components/AuditLogDetailDialog.vue",
-      "apps/web/src/pages/system/components/AuditLogDetailDialog.webtest.ts",
-      "apps/web/src/pages/system/components/AuditLogFilters.vue",
-      "apps/web/src/pages/system/components/AuditLogFilters.webtest.ts"
-    ],
-    documentation: ["docs/platform/audit-reliability.md"],
-    databaseTables: ["audit_logs"],
-    databaseStatementTokens: ["idx_audit_logs_"]
+    ...auditDistribution
   },
   {
     ...module("system.operations", "\u8FD0\u7EF4\u76D1\u63A7", "\u670D\u52A1\u3001\u6570\u636E\u5E93\u3001\u7F13\u5B58\u3001\u78C1\u76D8\u548C\u4F1A\u8BDD\u76D1\u63A7\u3002", "recommended", ["system", "system.configuration"]),
@@ -868,6 +936,8 @@ var platformModules = [
       "apps/web/src/pages/system/components/OperationOnlineUsers.webtest.ts",
       "apps/web/src/pages/system/components/OperationServiceMonitor.vue",
       "apps/web/src/pages/system/components/OperationServiceMonitor.webtest.ts",
+      "apps/web/src/pages/system/composables/useSchedulerOperations.ts",
+      "apps/web/src/pages/system/composables/useSchedulerOperations.webtest.ts",
       "apps/web/src/services/operations-api.ts"
     ],
     documentation: ["docs/platform/operations-overview.md"]
@@ -1218,7 +1288,7 @@ import { lstat, open, readFile, rename, rm } from "fs/promises";
 import { join } from "path";
 var managedSecretKeys = [
   "AGENT_SERVER_INTERNAL_TOKEN",
-  "AGENT_RUN_ENCRYPTION_SECRET",
+  "AGENT_INTERNAL_OUTPUT_ENCRYPTION_SECRET",
   "AI_ARTIFACT_ENCRYPTION_SECRET",
   "EMBEDDING_RUN_ENCRYPTION_SECRET",
   "AI_OUTPUT_ARTIFACT_REFERENCE_SECRET"
@@ -1236,8 +1306,8 @@ async function initializeLocalEnvironment(projectRoot, generateSecret = defaultS
   if (/^AGENT_SERVER_INTERNAL_TOKEN=[ \t\r]*$/m.test(content)) {
     content = setEmptyVariable(content, "AGENT_SERVER_INTERNAL_TOKEN", generateSecret());
   }
-  if (/^AGENT_RUN_ENCRYPTION_SECRET=[ \t\r]*$/m.test(content)) {
-    content = setEmptyVariable(content, "AGENT_RUN_ENCRYPTION_SECRET", generateSecret());
+  if (/^AGENT_INTERNAL_OUTPUT_ENCRYPTION_SECRET=[ \t\r]*$/m.test(content)) {
+    content = setEmptyVariable(content, "AGENT_INTERNAL_OUTPUT_ENCRYPTION_SECRET", generateSecret());
   }
   if (/^AI_ARTIFACT_ENCRYPTION_SECRET=[ \t\r]*$/m.test(content)) {
     content = setEmptyVariable(content, "AI_ARTIFACT_ENCRYPTION_SECRET", generateSecret());
@@ -2711,7 +2781,8 @@ function isMissing2(error) {
   return error instanceof Error && "code" in error && error.code === "ENOENT";
 }
 
-// src/docker-copy-sync.ts
+// src/docker-copy-targets.ts
+var agentDockerfilePath = "apps/agent-server/Dockerfile";
 var webDockerfilePath = "apps/web/Dockerfile";
 var webEntryDirectory = "apps/web";
 var serverDockerfilePath = "apps/server/Dockerfile";
@@ -2728,8 +2799,14 @@ var dockerfileCopyTargets = [
     dockerfilePath: webDockerfilePath,
     entryDirectory: webEntryDirectory,
     includeBuildClosure: true
+  },
+  {
+    dockerfilePath: agentDockerfilePath,
+    entryDirectory: "apps/agent-server",
+    includeBuildClosure: false
   }
 ];
+// src/docker-copy-sync.ts
 async function snapshotWorkspacePackages(root, options = {}) {
   const rootContent = await readSafeOptional(root, "package.json");
   if (!rootContent) {
@@ -3240,31 +3317,6 @@ Skill \u4ECD\u53EF\u7528\u4E8E\u666E\u901A\u4E1A\u52A1\u6A21\u5757\u5F00\u53D1\u
 `;
 }
 
-// src/runtime-profile-opensearch.ts
-var openSearchComposeService = `  opensearch:
-    profiles: ["search"]
-    image: opensearchproject/opensearch:2.19.3
-    environment:
-      discovery.type: single-node
-      DISABLE_INSTALL_DEMO_CONFIG: "true"
-      DISABLE_SECURITY_PLUGIN: "true"
-      OPENSEARCH_JAVA_OPTS: "-Xms512m -Xmx512m"
-    ports:
-      - "127.0.0.1:19200:9200"
-    volumes:
-      - opensearch-data:/usr/share/opensearch/data
-    healthcheck:
-      test:
-        [
-          "CMD-SHELL",
-          "curl -fsS http://127.0.0.1:9200/_cluster/health?wait_for_status=yellow",
-        ]
-      interval: 10s
-      timeout: 5s
-      retries: 12
-
-`;
-
 // src/runtime-profile-compose-build.ts
 var starterServerBuild = `    build:
       context: .
@@ -3290,112 +3342,7 @@ function optionalComposeVolumes(includeAgent, includeSearch, includeStorage) {
 `);
 }
 
-// src/runtime-profile-files.ts
-var starterComposeBase = `services:
-  postgres:
-    image: pgvector/pgvector:pg18
-    environment:
-      POSTGRES_DB: windy
-      POSTGRES_USER: windy
-      POSTGRES_PASSWORD: \${POSTGRES_PASSWORD:?\u8BF7\u5728 .env \u4E2D\u8BBE\u7F6E POSTGRES_PASSWORD}
-    ports:
-      - "15432:5432"
-    volumes:
-      - postgres18-data:/var/lib/postgresql
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U windy -d windy"]
-      interval: 10s
-      timeout: 5s
-      retries: 5
-
-  migrate:
-${starterServerBuild}
-    command: ["bun", "run", "db:migrate"]
-    environment:
-      DATABASE_URL: postgresql://windy:\${POSTGRES_PASSWORD}@postgres:5432/windy
-    volumes:
-      - ./packages:/app/packages
-    depends_on:
-      postgres:
-        condition: service_healthy
-
-  server:
-${starterServerBuild}
-    command: ["bun", "run", "--cwd", "apps/server", "dev"]
-    environment:
-      NODE_ENV: development
-      PORT: 9747
-      DATABASE_URL: postgresql://windy:\${POSTGRES_PASSWORD}@postgres:5432/windy
-      WINDY_BOOTSTRAP_ADMIN_PASSWORD: \${WINDY_BOOTSTRAP_ADMIN_PASSWORD:?\u8BF7\u5728 .env \u4E2D\u8BBE\u7F6E\u7BA1\u7406\u5458\u521D\u59CB\u5BC6\u7801}
-      WINDY_AUDIT_QUEUE_FILE: /app/data/audit/recovery-queue.json
-__STORAGE_SERVER_ENV__
-      WINDY_CONTAINERIZED: "1"
-      BUN_CONFIG_NO_CLEAR_TERMINAL_ON_RELOAD: "true"
-      WINDY_SYSTEM_USAGE_PATHS: /app/data/audit
-      PLATFORM_ENABLE_AI: \${PLATFORM_ENABLE_AI:-false}
-      AGENT_SERVER_URL: http://agent-server:8080
-      WINDY_PUBLIC_BASE_URL: \${WINDY_PUBLIC_BASE_URL:-http://localhost:9747}
-      AGENT_TOOL_HOST_URL: http://server:9747
-__TOOL_SANDBOX_SERVER_ENV__
-      AGENT_SERVER_INTERNAL_TOKEN: \${AGENT_SERVER_INTERNAL_TOKEN:-}
-__AGENT_WORKFLOW_SERVER_ENV__
-      AI_ARTIFACT_URL: http://server:9747/api/internal/ai/artifacts
-      AI_ARTIFACT_ENCRYPTION_SECRET: \${AI_ARTIFACT_ENCRYPTION_SECRET:-}
-      DOCUMENT_SERVER_URL: \${DOCUMENT_SERVER_URL:-}
-      AI_OUTPUT_ARTIFACT_REFERENCE_SECRET: \${AI_OUTPUT_ARTIFACT_REFERENCE_SECRET:-}
-      DOCUMENT_OUTPUT_ARTIFACT_SINK_IDENTITY: \${DOCUMENT_OUTPUT_ARTIFACT_SINK_IDENTITY:-}
-      DOCUMENT_OUTPUT_ARTIFACT_SINK_RELEASE_DIGEST: \${DOCUMENT_OUTPUT_ARTIFACT_SINK_RELEASE_DIGEST:-}
-      SPEECH_SERVER_URL: \${SPEECH_SERVER_URL:-}
-      EMBEDDING_SERVER_URL: \${EMBEDDING_SERVER_URL:-}
-__OPENSEARCH_SERVER_ENV__
-    ports:
-      - "9747:9747"
-    volumes:
-      - ./apps/server:/app/apps/server
-      - ./packages:/app/packages
-      - server-audit-data:/app/data/audit
-__STORAGE_SERVER_VOLUME__
-__TOOL_SANDBOX_SERVER_VOLUME__
-    depends_on:
-      migrate:
-        condition: service_completed_successfully
-
-__OPENSEARCH_SERVICE__
-  web:
-    build:
-      context: .
-      dockerfile: apps/web/Dockerfile
-    command: ["bun", "run", "--cwd", "apps/web", "dev"]
-    environment:
-      NODE_ENV: development
-      WINDY_DEV_PORT: 18746
-      WINDY_DEV_USE_POLLING: "1"
-      API_UPSTREAM: http://server:9747
-      VITE_DEV_HOST: 0.0.0.0
-    ports:
-      - "18746:18746"
-    volumes:
-      - ./apps/web:/app/apps/web
-      - ./packages:/app/packages
-    healthcheck:
-      test:
-        [
-          "CMD",
-          "bun",
-          "-e",
-          "const r=await fetch('http://127.0.0.1:18746/-/windy-dev');process.exit(r.ok?0:1)",
-        ]
-      interval: 5s
-      timeout: 3s
-      retries: 6
-    depends_on:
-      - server
-
-volumes:
-  postgres18-data:
-  server-audit-data:
-__OPTIONAL_VOLUMES__
-`;
+// src/runtime-profile-agent.ts
 var agentComposeService = `  tool-sandbox-init:
     profiles: ["agent"]
 ${starterServerBuild}
@@ -3444,23 +3391,38 @@ ${starterServerBuild}
       context: .
       dockerfile: apps/agent-server/Dockerfile
       args:
-        WINDY_PYPI_INDEX_URL: \${WINDY_PYPI_INDEX_URL:-http://mirrors.cloud.tencent.com/pypi/simple}
+        WINDY_AGENT_NATIVE_REGISTRY: \${WINDY_AGENT_NATIVE_REGISTRY:-https://registry.npmjs.org}
+        WINDY_PYPI_INDEX_URL: \${WINDY_PYPI_INDEX_URL:-https://pypi.org/simple}
+    cap_drop: ["ALL"]
+    cap_add: ["SETUID", "SETGID", "CHOWN", "DAC_OVERRIDE", "KILL"]
+    security_opt:
+      - no-new-privileges:true
+    pids_limit: 512
+    mem_limit: \${AGENT_SERVER_MEMORY_LIMIT:-4g}
+    cpus: \${AGENT_SERVER_CPU_LIMIT:-2}
     environment:
       AGENT_SERVER_INTERNAL_TOKEN: \${AGENT_SERVER_INTERNAL_TOKEN:-}
       AGENT_CONTEXT_HOST_URL: http://server:9747
-      AGENT_RUN_STORE_PATH: /app/data/agent/runs.sqlite3
-      AGENT_DATABASE_URL: postgresql://windy:\${POSTGRES_PASSWORD}@postgres:5432/windy
-      AGENT_RUN_ENCRYPTION_SECRET: \${AGENT_RUN_ENCRYPTION_SECRET:-}
-      OTEL_EXPORTER_OTLP_TRACES_ENDPOINT: \${OTEL_EXPORTER_OTLP_TRACES_ENDPOINT:-}
-      OTEL_EXPORTER_OTLP_HEADERS: \${OTEL_EXPORTER_OTLP_HEADERS:-}
-      AI_PROVIDER_AUDIT_STORE_PATH: /app/data/agent/provider-audit.sqlite3
+      AGENT_INTERNAL_OUTPUT_ENCRYPTION_SECRET: \${AGENT_INTERNAL_OUTPUT_ENCRYPTION_SECRET:-}
+      AGENT_RUNTIME_DATABASE_PATH: /app/data/agent/embedded-dsh.sqlite
+      AI_TOOL_HOST_URL: http://server:9747
+      AI_ARTIFACT_URL: http://server:9747/api/internal/ai/artifacts
+      AGENT_DSH_HOME: /app/data/agent/dsh
+      AGENT_DSH_MAX_USERS: \${AGENT_DSH_MAX_USERS:-2}
+      AGENT_DSH_USER_EXTENSIONS: \${AGENT_DSH_USER_EXTENSIONS:-1}
+      AGENT_DSH_MAX_ACTIVE_RUNS: \${AGENT_DSH_MAX_ACTIVE_RUNS:-2}
+      AGENT_DSH_WORKSPACE_MAX_BYTES: \${AGENT_DSH_WORKSPACE_MAX_BYTES:-536870912}
       AI_PROVIDER_AUDIT_RETENTION_DAYS: \${AI_PROVIDER_AUDIT_RETENTION_DAYS:-90}
       QWEN_API_URL: \${QWEN_API_URL:-}
       QWEN_API_KEY: \${QWEN_API_KEY:-}
       QWEN_MODEL: \${QWEN_MODEL:-}
+      QWEN_STRUCTURED_OUTPUT_MODE: \${QWEN_STRUCTURED_OUTPUT_MODE:-json_schema}
       AI_PROVIDER_HTTPS_HOST_ALLOWLIST: \${AI_PROVIDER_HTTPS_HOST_ALLOWLIST:-}
-      AI_PROVIDER_CONNECT_TIMEOUT_MS: \${AI_PROVIDER_CONNECT_TIMEOUT_MS:-5000}
       AI_PROVIDER_REQUEST_TIMEOUT_MS: \${AI_PROVIDER_REQUEST_TIMEOUT_MS:-60000}
+      AI_PROVIDER_CONTEXT_TOKENS: \${AI_PROVIDER_CONTEXT_TOKENS:-}
+      AI_PROVIDER_TOKENIZE_PATH: \${AI_PROVIDER_TOKENIZE_PATH:-}
+      AI_PROVIDER_OUTPUT_RESERVE_TOKENS: \${AI_PROVIDER_OUTPUT_RESERVE_TOKENS:-4096}
+      AI_PROVIDER_CONTEXT_SAFETY_TOKENS: \${AI_PROVIDER_CONTEXT_SAFETY_TOKENS:-512}
       AI_PROVIDER_MAX_RESPONSE_BYTES: \${AI_PROVIDER_MAX_RESPONSE_BYTES:-2097152}
       AI_PROVIDER_MAX_DURATION_SECONDS: \${AI_PROVIDER_MAX_DURATION_SECONDS:-300}
       AI_PROVIDER_MAX_INPUT_BYTES: \${AI_PROVIDER_MAX_INPUT_BYTES:-67108864}
@@ -3480,7 +3442,6 @@ ${starterServerBuild}
         condition: service_completed_successfully
       server:
         condition: service_started
-
   document-server:
     profiles: ["document"]
     build:
@@ -3577,122 +3538,268 @@ ${starterServerBuild}
         condition: service_started
 
 `;
-function starterComposeFor(includeAgent, includeSearch = true, includeStorage = true) {
-  return starterComposeBase.replace(`  web:
-`, `${includeAgent ? agentComposeService : ""}  web:
-`).replace("__TOOL_SANDBOX_SERVER_ENV__", includeAgent ? "      TOOL_SANDBOX_SOCKET: /run/windy-tool-sandbox/worker.sock" : "").replace("__AGENT_WORKFLOW_SERVER_ENV__", agentWorkflowServerEnvironment(includeAgent)).replace("__TOOL_SANDBOX_SERVER_VOLUME__", includeAgent ? "      - tool-sandbox-ipc:/run/windy-tool-sandbox" : "").replace("__STORAGE_SERVER_ENV__", includeStorage ? "      WINDY_STORAGE_ROOT: /app/data/storage" : "").replace("__STORAGE_SERVER_VOLUME__", includeStorage ? "      - server-storage-data:/app/data/storage" : "").replace("__OPENSEARCH_SERVER_ENV__", includeSearch ? `      OPENSEARCH_URL: \${OPENSEARCH_URL:-}
-      OPENSEARCH_USERNAME: \${OPENSEARCH_USERNAME:-}
-      OPENSEARCH_PASSWORD: \${OPENSEARCH_PASSWORD:-}
-      OPENSEARCH_WORK_ORDER_INDEX: \${OPENSEARCH_WORK_ORDER_INDEX:-windy-work-orders-v1}` : "").replace("__OPENSEARCH_SERVICE__", includeSearch ? openSearchComposeService : "").replace("__OPTIONAL_VOLUMES__", optionalComposeVolumes(includeAgent, includeSearch, includeStorage));
-}
-var starterCompose = starterComposeFor(true);
-// src/runtime-environment-example.ts
-function environmentExample(includeExample, includeAgent = true, includeSearch = true, includeStorage = true) {
-  return `# \u590D\u5236\u4E3A .env \u540E\u586B\u5199\u3002\u4E0D\u8981\u63D0\u4EA4\u771F\u5B9E\u5BC6\u7801\u3002
-POSTGRES_PASSWORD=
-WINDY_BOOTSTRAP_ADMIN_PASSWORD=
-${includeStorage ? `
-# Compose \u9ED8\u8BA4\u628A Storage \u4E0E\u62A5\u544A\u6682\u5B58\u6301\u4E45\u5316\u5230 /app/data/storage\u3002
-# \u5982\u9700\u72EC\u7ACB\u6302\u8F7D\u62A5\u544A\u6682\u5B58\u76EE\u5F55\uFF0C\u8BF7\u540C\u65F6\u4FEE\u6539 Compose volume\u3002
-# WINDY_REPORT_STAGING_ROOT=/app/data/storage/report-staging
-` : ""}
-${includeAgent ? `
-# Agent profile \u4EC5\u7531\u670D\u52A1\u7AEF Agent Runtime \u8BFB\u53D6\uFF1B\u4E0D\u8981\u4F7F\u7528 VITE_ \u524D\u7F00\u3002
-PLATFORM_ENABLE_AI=false
-AGENT_SERVER_INTERNAL_TOKEN=
-AGENT_RUN_ENCRYPTION_SECRET=
-# Model \u8282\u70B9\u542F\u7528\u524D\u5FC5\u987B\u586B\u5165\u7531\u8FD0\u7EF4\u51BB\u7ED3\u7684 deployment/model \u4EF7\u683C\u76EE\u5F55\uFF1B\u7F3A\u5931\u65F6 readiness \u660E\u786E unavailable\u3002
-WINDY_AGENT_WORKFLOW_MODEL_PRICING_JSON=
-# \u975E Compose \u90E8\u7F72\u9700\u6307\u5411 Windy Server\uFF1B\u957F\u671F Session \u7684\u6A21\u578B\u8C03\u7528\u4F1A fail closed\u3002
-# AGENT_CONTEXT_HOST_URL=http://server:9747
-# \u591A\u526F\u672C\u751F\u4EA7\u9ED8\u8BA4\u4F7F\u7528 Compose \u6CE8\u5165\u7684 PostgreSQL\uFF1B\u7559\u7A7A\u624D\u56DE\u9000\u5355\u526F\u672C SQLite\u3002
-AGENT_DATABASE_URL=
-# \u53EF\u9009\uFF1A\u53EA\u53D1\u9001\u65E0 Prompt/\u8F93\u5165/\u8F93\u51FA\u7684 Agent Run \u5143\u6570\u636E Span\u3002
-OTEL_EXPORTER_OTLP_TRACES_ENDPOINT=
-OTEL_EXPORTER_OTLP_HEADERS=
-AI_ARTIFACT_ENCRYPTION_SECRET=
-WINDY_PUBLIC_BASE_URL=http://localhost:9747
-DOCUMENT_SERVER_URL=
-DOCUMENT_ARTIFACT_URL=
-DOCUMENT_OUTPUT_ARTIFACT_URL=
-DOCUMENT_ADAPTER_URL=
-DOCUMENT_ADAPTER_TOKEN=
-DOCUMENT_DEPLOYMENT_KEY=
-DOCUMENT_DEPLOYMENT_IDENTITY=
-DOCUMENT_RELEASE_DIGEST=
-DOCUMENT_OFFERS_DIGEST=
-AI_OUTPUT_ARTIFACT_REFERENCE_SECRET=
-DOCUMENT_OUTPUT_ARTIFACT_SINK_IDENTITY=
-DOCUMENT_OUTPUT_ARTIFACT_SINK_RELEASE_DIGEST=
-# DOCUMENT_ADAPTER_CAPABILITIES=document.ocr,document.layout,document.table
-# DOCUMENT_MAX_UNITS=500
-SPEECH_SERVER_URL=
-SPEECH_ARTIFACT_URL=
-SPEECH_OUTPUT_ARTIFACT_URL=
-SPEECH_ADAPTER_URL=
-SPEECH_ADAPTER_TOKEN=
-SPEECH_DEPLOYMENT_KEY=
-SPEECH_DEPLOYMENT_IDENTITY=
-SPEECH_RELEASE_DIGEST=
-SPEECH_OFFERS_DIGEST=
-# SPEECH_ADAPTER_CAPABILITIES=speech.transcribe.batch,speech.translate,speech.vad,speech.timestamps
-# SPEECH_MAX_UNITS=100000
-# SPEECH_MAX_MEDIA_DURATION_SECONDS=86400
-# SPEECH_MAX_INPUT_ARTIFACT_BYTES=2147483648
-# SPEECH_MAX_INLINE_OUTPUT_BYTES=67108864
-# SPEECH_MAX_OUTPUT_ARTIFACT_BYTES=536870912
-# SPEECH_MAX_CONCURRENT_RUNS=1
-# SPEECH_MAX_QUEUE_DEPTH=0
-# SPEECH_READINESS_TIMEOUT_SECONDS=5
-# SPEECH_READINESS_TTL_SECONDS=60
-EMBEDDING_SERVER_URL=
-EMBEDDING_ARTIFACT_URL=
-EMBEDDING_RUN_ARTIFACT_URL=
-EMBEDDING_ADAPTER_URL=
-EMBEDDING_ADAPTER_TOKEN=
-EMBEDDING_DEPLOYMENT_KEY=
-EMBEDDING_DEPLOYMENT_IDENTITY=
-EMBEDDING_RELEASE_DIGEST=
-EMBEDDING_OFFERS_DIGEST=
-EMBEDDING_DEPLOYMENT_ALIAS=
-EMBEDDING_MODEL=
-EMBEDDING_MODEL_VERSION=
-EMBEDDING_DIMENSIONS=
-# EMBEDDING_NORMALIZED=true
-# EMBEDDING_CAPABILITIES=embedding.text,embedding.image
-# EMBEDDING_MAX_UNITS=256
-# EMBEDDING_MAX_DURATION_SECONDS=600
-# EMBEDDING_MAX_INPUT_BYTES=268435456
-# EMBEDDING_MAX_OUTPUT_BYTES=268435456
-# EMBEDDING_MAX_ARTIFACTS=16
-# EMBEDDING_MAX_PIXELS_PER_ARTIFACT=100000000
-EMBEDDING_RUN_ENCRYPTION_SECRET=
-# EMBEDDING_MAX_CONCURRENT_RUNS=1
-# EMBEDDING_MAX_QUEUE_DEPTH=0
-# EMBEDDING_READINESS_TIMEOUT_SECONDS=5
-# EMBEDDING_READINESS_TTL_SECONDS=60
-# EMBEDDING_RUN_TERMINAL_TTL_SECONDS=604800
-QWEN_API_URL=
-QWEN_API_KEY=
-QWEN_MODEL=
-AI_PROVIDER_HTTPS_HOST_ALLOWLIST=
-# VLM Deployment \u793A\u4F8B\uFF1Atext-generation,vision\uFF1B\u8F93\u5165\u6A21\u6001\uFF1Atext,image
-# AI_PROVIDER_CAPABILITIES=text-generation
-# AI_PROVIDER_INPUT_MODALITIES=text
-# AI_PROVIDER_DEPLOYMENT_IDENTITY=
-# AI_PROVIDER_RELEASE_DIGEST=
-# AI_PROVIDER_READINESS_TTL_SECONDS=60
-# AI_PROVIDER_MAX_CONCURRENT_RUNS=1
-# AI_PROVIDER_MAX_QUEUE_DEPTH=0
-# AI_PROVIDER_AUDIT_RETENTION_DAYS=90
-# AI_PROVIDER_CONNECT_TIMEOUT_MS=5000
-# AI_PROVIDER_REQUEST_TIMEOUT_MS=60000
-# AI_PROVIDER_MAX_RESPONSE_BYTES=2097152
-# AI_PROVIDER_MAX_DURATION_SECONDS=300
-# AI_PROVIDER_MAX_INPUT_BYTES=67108864
-# AI_PROVIDER_MAX_ARTIFACTS=16
-# AI_PROVIDER_MAX_PIXELS_PER_ARTIFACT=100000000
-` : ""}
+
+// src/runtime-profile-opensearch.ts
+var openSearchComposeService = `  opensearch:
+    profiles: ["search"]
+    image: opensearchproject/opensearch:2.19.3
+    environment:
+      discovery.type: single-node
+      DISABLE_INSTALL_DEMO_CONFIG: "true"
+      DISABLE_SECURITY_PLUGIN: "true"
+      OPENSEARCH_JAVA_OPTS: "-Xms512m -Xmx512m"
+    ports:
+      - "127.0.0.1:19200:9200"
+    volumes:
+      - opensearch-data:/usr/share/opensearch/data
+    healthcheck:
+      test:
+        [
+          "CMD-SHELL",
+          "curl -fsS http://127.0.0.1:9200/_cluster/health?wait_for_status=yellow",
+        ]
+      interval: 10s
+      timeout: 5s
+      retries: 12
+
+`;
+
+// src/runtime-profile-files.ts
+var starterComposeBase = `services:
+  postgres:
+    image: pgvector/pgvector:pg18
+    environment:
+      POSTGRES_DB: windy
+      POSTGRES_USER: windy
+      POSTGRES_PASSWORD: \${POSTGRES_PASSWORD:?\u8BF7\u5728 .env \u4E2D\u8BBE\u7F6E POSTGRES_PASSWORD}
+    ports:
+      - "15432:5432"
+    volumes:
+      - postgres18-data:/var/lib/postgresql
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U windy -d windy"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  migrate:
+${starterServerBuild}
+    command: ["bun", "run", "db:migrate"]
+    environment:
+      DATABASE_URL: postgresql://windy:\${POSTGRES_PASSWORD}@postgres:5432/windy
+    volumes:
+      - ./packages:/app/packages
+    depends_on:
+      postgres:
+        condition: service_healthy
+
+  server:
+${starterServerBuild}
+    command: ["bun", "run", "--cwd", "apps/server", "dev"]
+    environment:
+      NODE_ENV: development
+      PORT: 9747
+      DATABASE_URL: postgresql://windy:\${POSTGRES_PASSWORD}@postgres:5432/windy
+      WINDY_BOOTSTRAP_ADMIN_PASSWORD: \${WINDY_BOOTSTRAP_ADMIN_PASSWORD:?\u8BF7\u5728 .env \u4E2D\u8BBE\u7F6E\u7BA1\u7406\u5458\u521D\u59CB\u5BC6\u7801}
+      WINDY_AUDIT_QUEUE_FILE: /app/data/audit/recovery-queue.json
+__STORAGE_SERVER_ENV__
+      WINDY_CONTAINERIZED: "1"
+      BUN_CONFIG_NO_CLEAR_TERMINAL_ON_RELOAD: "true"
+      WINDY_SYSTEM_USAGE_PATHS: /app/data/audit
+      PLATFORM_ENABLE_AI: \${PLATFORM_ENABLE_AI:-false}
+      AGENT_SERVER_URL: http://agent-server:8080
+      WINDY_PUBLIC_BASE_URL: "\${WINDY_PUBLIC_BASE_URL:-}"
+      AGENT_TOOL_HOST_URL: http://server:9747
+__TOOL_SANDBOX_SERVER_ENV__
+      AGENT_SERVER_INTERNAL_TOKEN: \${AGENT_SERVER_INTERNAL_TOKEN:-}
+__AGENT_WORKFLOW_SERVER_ENV__
+      AI_ARTIFACT_URL: http://server:9747/api/internal/ai/artifacts
+      AI_ARTIFACT_ENCRYPTION_SECRET: \${AI_ARTIFACT_ENCRYPTION_SECRET:-}
+      DOCUMENT_SERVER_URL: \${DOCUMENT_SERVER_URL:-}
+      AI_OUTPUT_ARTIFACT_REFERENCE_SECRET: \${AI_OUTPUT_ARTIFACT_REFERENCE_SECRET:-}
+      DOCUMENT_OUTPUT_ARTIFACT_SINK_IDENTITY: \${DOCUMENT_OUTPUT_ARTIFACT_SINK_IDENTITY:-}
+      DOCUMENT_OUTPUT_ARTIFACT_SINK_RELEASE_DIGEST: \${DOCUMENT_OUTPUT_ARTIFACT_SINK_RELEASE_DIGEST:-}
+      SPEECH_SERVER_URL: \${SPEECH_SERVER_URL:-}
+      EMBEDDING_SERVER_URL: \${EMBEDDING_SERVER_URL:-}
+__OPENSEARCH_SERVER_ENV__
+    ports:
+      - "9747:9747"
+    volumes:
+      - ./apps/server:/app/apps/server
+      - ./packages:/app/packages
+      - server-audit-data:/app/data/audit
+__STORAGE_SERVER_VOLUME__
+__TOOL_SANDBOX_SERVER_VOLUME__
+    depends_on:
+      migrate:
+        condition: service_completed_successfully
+
+__OPENSEARCH_SERVICE__
+  web:
+    build:
+      context: .
+      dockerfile: apps/web/Dockerfile
+    command: ["bun", "run", "--cwd", "apps/web", "dev"]
+    environment:
+      NODE_ENV: development
+      WINDY_DEV_PORT: 18746
+      WINDY_DEV_USE_POLLING: "1"
+      API_UPSTREAM: http://server:9747
+      VITE_DEV_HOST: 0.0.0.0
+    ports:
+      - "18746:18746"
+    volumes:
+      - ./apps/web:/app/apps/web
+      - ./packages:/app/packages
+    healthcheck:
+      test:
+        [
+          "CMD",
+          "bun",
+          "-e",
+          "const r=await fetch('http://127.0.0.1:18746/-/windy-dev');process.exit(r.ok?0:1)",
+        ]
+      interval: 5s
+      timeout: 3s
+      retries: 6
+    depends_on:
+      - server
+
+volumes:
+  postgres18-data:
+  server-audit-data:
+__OPTIONAL_VOLUMES__
+`;
+function starterComposeFor(includeAgent, includeSearch = true, includeStorage = true) {
+  return starterComposeBase.replace(`  web:
+`, `${includeAgent ? agentComposeService : ""}  web:
+`).replace("__TOOL_SANDBOX_SERVER_ENV__", includeAgent ? "      TOOL_SANDBOX_SOCKET: /run/windy-tool-sandbox/worker.sock" : "").replace("__AGENT_WORKFLOW_SERVER_ENV__", agentWorkflowServerEnvironment(includeAgent)).replace("__TOOL_SANDBOX_SERVER_VOLUME__", includeAgent ? "      - tool-sandbox-ipc:/run/windy-tool-sandbox" : "").replace("__STORAGE_SERVER_ENV__", includeStorage ? "      WINDY_STORAGE_ROOT: /app/data/storage" : "").replace("__STORAGE_SERVER_VOLUME__", includeStorage ? "      - server-storage-data:/app/data/storage" : "").replace("__OPENSEARCH_SERVER_ENV__", includeSearch ? `      OPENSEARCH_URL: \${OPENSEARCH_URL:-}
+      OPENSEARCH_USERNAME: \${OPENSEARCH_USERNAME:-}
+      OPENSEARCH_PASSWORD: \${OPENSEARCH_PASSWORD:-}
+      OPENSEARCH_WORK_ORDER_INDEX: \${OPENSEARCH_WORK_ORDER_INDEX:-windy-work-orders-v1}` : "").replace("__OPENSEARCH_SERVICE__", includeSearch ? openSearchComposeService : "").replace("__OPTIONAL_VOLUMES__", optionalComposeVolumes(includeAgent, includeSearch, includeStorage));
+}
+var starterCompose = starterComposeFor(true);
+// src/runtime-environment-example.ts
+function environmentExample(includeExample, includeAgent = true, includeSearch = true, includeStorage = true) {
+  return `# \u590D\u5236\u4E3A .env \u540E\u586B\u5199\u3002\u4E0D\u8981\u63D0\u4EA4\u771F\u5B9E\u5BC6\u7801\u3002
+POSTGRES_PASSWORD=
+WINDY_BOOTSTRAP_ADMIN_PASSWORD=
+${includeStorage ? `
+# Compose \u9ED8\u8BA4\u628A Storage \u4E0E\u62A5\u544A\u6682\u5B58\u6301\u4E45\u5316\u5230 /app/data/storage\u3002
+# \u5982\u9700\u72EC\u7ACB\u6302\u8F7D\u62A5\u544A\u6682\u5B58\u76EE\u5F55\uFF0C\u8BF7\u540C\u65F6\u4FEE\u6539 Compose volume\u3002
+# WINDY_REPORT_STAGING_ROOT=/app/data/storage/report-staging
+` : ""}
+${includeAgent ? `
+# Agent profile \u4EC5\u7531\u670D\u52A1\u7AEF Agent Runtime \u8BFB\u53D6\uFF1B\u4E0D\u8981\u4F7F\u7528 VITE_ \u524D\u7F00\u3002
+PLATFORM_ENABLE_AI=false
+AGENT_SERVER_INTERNAL_TOKEN=
+AGENT_INTERNAL_OUTPUT_ENCRYPTION_SECRET=
+# Model \u8282\u70B9\u542F\u7528\u524D\u5FC5\u987B\u586B\u5165\u7531\u8FD0\u7EF4\u51BB\u7ED3\u7684 deployment/model \u4EF7\u683C\u76EE\u5F55\uFF1B\u7F3A\u5931\u65F6 readiness \u660E\u786E unavailable\u3002
+WINDY_AGENT_WORKFLOW_MODEL_PRICING_JSON=
+# \u975E Compose \u90E8\u7F72\u9700\u6307\u5411 Windy Server\uFF1B\u957F\u671F Session \u7684\u6A21\u578B\u8C03\u7528\u4F1A fail closed\u3002
+# AGENT_CONTEXT_HOST_URL=http://server:9747
+# DSH \u534F\u8C03\u5668\u5F53\u524D\u4EC5\u652F\u6301\u5355\u526F\u672C\uFF1B\u4F7F\u7528\u65B0\u7684Agent\u4E13\u7528\u76EE\u5F55\uFF0C\u4E0D\u8BFB\u53D6\u65E7Python\u8FD0\u884C\u5E93\u3002
+# AGENT_RUNTIME_DATABASE_PATH=/app/data/agent/embedded-dsh.sqlite
+# AGENT_DSH_HOME=/app/data/agent/dsh
+AGENT_DSH_USER_EXTENSIONS=1
+# AGENT_DSH_MAX_USERS=2
+# AGENT_DSH_MAX_ACTIVE_RUNS=2
+# AGENT_DSH_WORKSPACE_MAX_BYTES=536870912
+# AGENT_SERVER_MEMORY_LIMIT=4g
+# AGENT_SERVER_CPU_LIMIT=2
+# \u6784\u5EFA\u671F\u955C\u50CF\u6E90\u4ECD\u9700\u7B26\u5408\u9501\u6587\u4EF6\u7684hash\uFF1B\u8FD0\u884C\u65F6\u4E0D\u4E0B\u8F7D\u539F\u751F\u4F9D\u8D56\u3002
+# WINDY_AGENT_NATIVE_REGISTRY=https://registry.npmjs.org
+# WINDY_PYPI_INDEX_URL=https://pypi.org/simple
+AI_ARTIFACT_ENCRYPTION_SECRET=
+# \u5F00\u53D1\u7559\u7A7A\u65F6\u5DE5\u4F5C\u53F0\u8DDF\u968F\u6D4F\u89C8\u5668\u540C\u6E90 Host\uFF0C\u652F\u6301 Web \u7AEF\u53E3\u548C\u52A8\u6001\u5C40\u57DF\u7F51\u5730\u5740\u3002
+# HTTPS \u53CD\u5411\u4EE3\u7406\u6216\u751F\u4EA7 Client Agent Session \u5FC5\u987B\u586B\u5199\u7528\u6237\u5B9E\u9645\u8BBF\u95EE\u7684 Web origin\u3002
+# WINDY_PUBLIC_BASE_URL=https://windy.example
+WINDY_PUBLIC_BASE_URL=
+DOCUMENT_SERVER_URL=
+DOCUMENT_ARTIFACT_URL=
+DOCUMENT_OUTPUT_ARTIFACT_URL=
+DOCUMENT_ADAPTER_URL=
+DOCUMENT_ADAPTER_TOKEN=
+DOCUMENT_DEPLOYMENT_KEY=
+DOCUMENT_DEPLOYMENT_IDENTITY=
+DOCUMENT_RELEASE_DIGEST=
+DOCUMENT_OFFERS_DIGEST=
+AI_OUTPUT_ARTIFACT_REFERENCE_SECRET=
+DOCUMENT_OUTPUT_ARTIFACT_SINK_IDENTITY=
+DOCUMENT_OUTPUT_ARTIFACT_SINK_RELEASE_DIGEST=
+# DOCUMENT_ADAPTER_CAPABILITIES=document.ocr,document.layout,document.table
+# DOCUMENT_MAX_UNITS=500
+SPEECH_SERVER_URL=
+SPEECH_ARTIFACT_URL=
+SPEECH_OUTPUT_ARTIFACT_URL=
+SPEECH_ADAPTER_URL=
+SPEECH_ADAPTER_TOKEN=
+SPEECH_DEPLOYMENT_KEY=
+SPEECH_DEPLOYMENT_IDENTITY=
+SPEECH_RELEASE_DIGEST=
+SPEECH_OFFERS_DIGEST=
+# SPEECH_ADAPTER_CAPABILITIES=speech.transcribe.batch,speech.translate,speech.vad,speech.timestamps
+# SPEECH_MAX_UNITS=100000
+# SPEECH_MAX_MEDIA_DURATION_SECONDS=86400
+# SPEECH_MAX_INPUT_ARTIFACT_BYTES=2147483648
+# SPEECH_MAX_INLINE_OUTPUT_BYTES=67108864
+# SPEECH_MAX_OUTPUT_ARTIFACT_BYTES=536870912
+# SPEECH_MAX_CONCURRENT_RUNS=1
+# SPEECH_MAX_QUEUE_DEPTH=0
+# SPEECH_READINESS_TIMEOUT_SECONDS=5
+# SPEECH_READINESS_TTL_SECONDS=60
+EMBEDDING_SERVER_URL=
+EMBEDDING_ARTIFACT_URL=
+EMBEDDING_RUN_ARTIFACT_URL=
+EMBEDDING_ADAPTER_URL=
+EMBEDDING_ADAPTER_TOKEN=
+EMBEDDING_DEPLOYMENT_KEY=
+EMBEDDING_DEPLOYMENT_IDENTITY=
+EMBEDDING_RELEASE_DIGEST=
+EMBEDDING_OFFERS_DIGEST=
+EMBEDDING_DEPLOYMENT_ALIAS=
+EMBEDDING_MODEL=
+EMBEDDING_MODEL_VERSION=
+EMBEDDING_DIMENSIONS=
+# EMBEDDING_NORMALIZED=true
+# EMBEDDING_CAPABILITIES=embedding.text,embedding.image
+# EMBEDDING_MAX_UNITS=256
+# EMBEDDING_MAX_DURATION_SECONDS=600
+# EMBEDDING_MAX_INPUT_BYTES=268435456
+# EMBEDDING_MAX_OUTPUT_BYTES=268435456
+# EMBEDDING_MAX_ARTIFACTS=16
+# EMBEDDING_MAX_PIXELS_PER_ARTIFACT=100000000
+EMBEDDING_RUN_ENCRYPTION_SECRET=
+# EMBEDDING_MAX_CONCURRENT_RUNS=1
+# EMBEDDING_MAX_QUEUE_DEPTH=0
+# EMBEDDING_READINESS_TIMEOUT_SECONDS=5
+# EMBEDDING_READINESS_TTL_SECONDS=60
+# EMBEDDING_RUN_TERMINAL_TTL_SECONDS=604800
+QWEN_API_URL=
+QWEN_API_KEY=
+QWEN_MODEL=
+# QWEN_STRUCTURED_OUTPUT_MODE=json_schema
+AI_PROVIDER_HTTPS_HOST_ALLOWLIST=
+# VLM Deployment \u793A\u4F8B\uFF1Atext-generation,vision\uFF1B\u8F93\u5165\u6A21\u6001\uFF1Atext,image
+# AI_PROVIDER_CAPABILITIES=text-generation
+# AI_PROVIDER_INPUT_MODALITIES=text
+# AI_PROVIDER_DEPLOYMENT_IDENTITY=
+# AI_PROVIDER_RELEASE_DIGEST=
+# AI_PROVIDER_READINESS_TTL_SECONDS=60
+# AI_PROVIDER_MAX_CONCURRENT_RUNS=1
+# AI_PROVIDER_MAX_QUEUE_DEPTH=0
+# AI_PROVIDER_AUDIT_RETENTION_DAYS=90
+# AI_PROVIDER_CONTEXT_TOKENS=
+# AI_PROVIDER_OUTPUT_RESERVE_TOKENS=4096
+# AI_PROVIDER_CONTEXT_SAFETY_TOKENS=512
+# AI_PROVIDER_TOKENIZE_PATH=
+# AI_PROVIDER_REQUEST_TIMEOUT_MS=60000
+# AI_PROVIDER_MAX_RESPONSE_BYTES=2097152
+# AI_PROVIDER_MAX_DURATION_SECONDS=300
+# AI_PROVIDER_MAX_INPUT_BYTES=67108864
+# AI_PROVIDER_MAX_ARTIFACTS=16
+# AI_PROVIDER_MAX_PIXELS_PER_ARTIFACT=100000000
+` : ""}
 
 ${includeSearch ? `# OpenSearch profile \u9ED8\u8BA4\u4E0D\u542F\u52A8\uFF1Bbun run dev:search \u4F1A\u53EA\u5411 Server \u6CE8\u5165\u5BB9\u5668\u5185\u5730\u5740\u3002
 OPENSEARCH_URL=
@@ -3809,7 +3916,7 @@ bun run dev:server
 
 ${starterMcpAndSkillGuidance(includeAgent)}
 ${includeAgent ? `
-## OpenAI-compatible Agent profile
+## DSH Agent profile
 
 Agent Runtime \u9ED8\u8BA4\u4E0D\u542F\u52A8\u3002\u5148\u5728\u4EC5\u4F9B\u672C\u673A\u4F7F\u7528\u7684 \`.env\` \u4E2D\u8BBE\u7F6E
 \`PLATFORM_ENABLE_AI=true\`\u3001\`AGENT_SERVER_INTERNAL_TOKEN\`\u3001\`QWEN_API_URL\`\u3001
@@ -3823,7 +3930,10 @@ bun run dev:agent
 \`QWEN_API_KEY\`\u3001Endpoint \u548C Host allowlist \u53EA\u8FDB\u5165 Agent Server\uFF0C\u4E0D\u4F1A\u8FDB\u5165 Web
 \u73AF\u5883\u6216\u8FD4\u56DE\u7ED9\u5BA2\u6237\u7AEF\u3002\u516C\u7F51 HTTPS Endpoint \u7684\u4E3B\u673A\u5FC5\u987B\u663E\u5F0F\u52A0\u5165
 \`AI_PROVIDER_HTTPS_HOST_ALLOWLIST\`\u3002\u8FD0\u884C\u4E0E\u6A21\u5757
-\u63A5\u5165\u7EC6\u8282\u89C1 [Agent Runtime \u63A5\u5165](./docs/platform/agent-runtime.md)\u3002
+\u63A5\u5165\u7EC6\u8282\u89C1 [Agent Runtime \u63A5\u5165](./docs/platform/agent-runtime.md)\u53CA
+[DSH \u90E8\u7F72\u4E0E\u8FC1\u79FB](./docs/operations/dsh-agent-migration.md)\u3002Agent Server \u4EE5 Node 24.7+
+\u6267\u884C\uFF0C\u4F7F\u7528\u65B0 SQLite \u6570\u636E\u8DEF\u5F84\uFF1B\u539F\u751F\u5DE5\u4F5C\u53F0\u9700\u8981 Linux \u9694\u79BB\u80FD\u529B\u3002\u5168\u5C40\u5BB9\u91CF\u9ED8\u8BA4 1 \u65F6\u4E3A\u65E2\u6709
+\u8C03\u7528\u94FE\u9884\u7559\uFF0C\u5DE5\u4F5C\u53F0\u4F1A\u660E\u786E\u663E\u793A\u5BB9\u91CF\u672A\u5F00\u653E\u3002\u4E2A\u4EBA\u6269\u5C55\u9ED8\u8BA4\u5F00\u653E\uFF0C\u7531\u90E8\u7F72\u5F00\u5173\u63A7\u5236\u3002
 
 Document Runtime \u540C\u6837\u9ED8\u8BA4\u5173\u95ED\u3002\u914D\u7F6E\u81F3\u5C11 32 \u5B57\u7B26\u7684
 \`AI_ARTIFACT_ENCRYPTION_SECRET\`\u3001\u672C\u5730\u6216\u5185\u7F51 \`DOCUMENT_ADAPTER_URL\` \u53CA\u5176
@@ -4019,7 +4129,7 @@ function createStarterPackage(source, projectName, includeOxc = true, projectLic
     private: true,
     license: projectLicense,
     packageManager: "bun@1.3.14",
-    engines: { ...source.engines, bun: ">=1.3.14" },
+    engines: { ...source.engines, bun: ">=1.3.14", node: ">=24.7.0" },
     ...includeOxc ? { "lint-staged": sourceLintStaged ?? defaultLintStaged } : {},
     scripts: {
       ...includeOxc ? {
@@ -4032,20 +4142,23 @@ function createStarterPackage(source, projectName, includeOxc = true, projectLic
         "dev:search": "OPENSEARCH_URL=http://opensearch:9200 docker compose --profile search up --build"
       } : {},
       ...selectedModules.includes("system.agent") ? {
-        "dev:agent": "docker compose --profile agent up --build",
+        "dev:agent": "bun run docker:sync && docker compose --profile agent up --build",
+        "check:agent": "bun run --cwd apps/agent-server typecheck",
+        "test:agent": "bun run --cwd apps/agent-server test",
         "dev:speech": "PLATFORM_ENABLE_AI=true SPEECH_SERVER_URL=http://speech-server:8091 docker compose --profile agent --profile speech up --build",
         "speech:pins": "bun run scripts/provision-speech-readiness.ts"
       } : {},
       ...generatorVersion ? { windy: "create-windy" } : {},
       "dev:web": "bun run --cwd apps/web dev",
       "dev:server": "bun run --cwd apps/server dev",
-      build: "bun run --cwd apps/web build",
+      build: selectedModules.includes("system.agent") ? "bun run --cwd apps/agent-server build && bun run --cwd apps/web build" : "bun run --cwd apps/web build",
       "db:generate": "drizzle-kit generate --config drizzle.config.ts",
       "db:migrate": "drizzle-kit migrate --config drizzle.config.ts",
       "generate:crud": "bun run packages/crud-generator/src/cli.ts",
       typecheck: [
         "bun run --cwd apps/web typecheck",
         "bun run --cwd apps/server typecheck",
+        ...selectedModules.includes("system.agent") ? ["bun run --cwd apps/agent-server typecheck"] : [],
         "bun run --cwd packages/ai-client typecheck",
         "bun run --cwd packages/jobs typecheck",
         "bun run --cwd packages/shared typecheck",
@@ -4059,7 +4172,7 @@ function createStarterPackage(source, projectName, includeOxc = true, projectLic
         format: "oxfmt",
         "format:staged": "lint-staged"
       } : {},
-      test: "bun test && bun run --cwd apps/web test"
+      test: "bun test && bun run --cwd apps/web test" + (selectedModules.includes("system.agent") ? " && bun run test:agent" : "")
     },
     devDependencies: {
       ...migrationCliDependencies,
@@ -4091,6 +4204,7 @@ var templateDirectories = [
   ".agents/skills/windy-business-module",
   "apps/server",
   "apps/agent-server",
+  "deploy/dsh",
   "apps/document-server",
   "apps/speech-server",
   "apps/embedding-server",
@@ -4111,8 +4225,15 @@ var templateDirectories = [
 var templateDocumentationFiles = [
   "docs/operations/legacy-data-migration.md",
   "docs/adr/0003-agent-session-event-source.md",
+  "docs/adr/0004-embedded-dsh-runtime.md",
   "docs/architecture/admin-surface-boundary.md",
   "docs/architecture/agent-harness.md",
+  "docs/architecture/agent-admin-workbench-plan.md",
+  "docs/architecture/agent-admin-workbench-implementation.md",
+  "docs/architecture/embedded-dsh-integration.md",
+  "docs/platform/agent-skills.md",
+  "docs/operations/dsh-agent-migration.md",
+  "docs/development/dsh-plugins.md",
   "docs/architecture/agent-runtime-compatibility.md",
   "docs/architecture/agent-workflow.md",
   "docs/architecture/ai-egress.md",
@@ -6432,62 +6553,8 @@ function sentenceWithoutStop(value) {
 import { rm as rm10 } from "fs/promises";
 import { resolve as resolve8 } from "path";
 
-// src/update/doctor.ts
-import { readFile as readFile12 } from "fs/promises";
-import { join as join17 } from "path";
-
-// src/update/process.ts
-import { spawn as spawn2 } from "child_process";
-var LOCAL_GIT_ENVIRONMENT_VARIABLES = [
-  "GIT_ALTERNATE_OBJECT_DIRECTORIES",
-  "GIT_CONFIG",
-  "GIT_CONFIG_PARAMETERS",
-  "GIT_CONFIG_COUNT",
-  "GIT_OBJECT_DIRECTORY",
-  "GIT_DIR",
-  "GIT_WORK_TREE",
-  "GIT_IMPLICIT_WORK_TREE",
-  "GIT_GRAFT_FILE",
-  "GIT_INDEX_FILE",
-  "GIT_NO_REPLACE_OBJECTS",
-  "GIT_REPLACE_REF_BASE",
-  "GIT_PREFIX",
-  "GIT_SHALLOW_FILE",
-  "GIT_COMMON_DIR"
-];
-async function captureProcess(command, args, cwd, inherit = false) {
-  return await new Promise((resolve6, reject) => {
-    const child = spawn2(command, args, {
-      cwd,
-      env: withoutParentGitRepository(process.env),
-      stdio: inherit ? "inherit" : ["ignore", "pipe", "pipe"]
-    });
-    let stdout2 = "";
-    let stderr = "";
-    child.stdout?.on("data", (chunk) => stdout2 += chunk.toString());
-    child.stderr?.on("data", (chunk) => stderr += chunk.toString());
-    child.once("error", reject);
-    child.once("close", (code) => resolve6({ code: code ?? 1, stdout: stdout2, stderr }));
-  });
-}
-async function assertProcess(command, args, cwd, inherit = false) {
-  const result = await captureProcess(command, args, cwd, inherit);
-  if (result.code !== 0) {
-    const detail = result.stderr.trim() || result.stdout.trim();
-    throw new Error(`${command} ${args.join(" ")} \u6267\u884C\u5931\u8D25${detail ? `\uFF1A${detail}` : ""}`);
-  }
-  return result;
-}
-function withoutParentGitRepository(source) {
-  const environment = { ...source };
-  for (const key of LOCAL_GIT_ENVIRONMENT_VARIABLES) {
-    delete environment[key];
-  }
-  return environment;
-}
-
-// src/update/transaction-cas.ts
-import { basename as basename8, dirname as dirname7 } from "path";
+// src/update/transaction-cas.ts
+import { basename as basename8, dirname as dirname7 } from "path";
 
 // src/update/transaction-native-cas.ts
 import { ptr as ptr3, read as read3, dlopen as dlopen4, FFIType as FFIType4 } from "bun:ffi";
@@ -8334,6 +8401,105 @@ async function applyTransaction(plan) {
   };
 }
 
+// src/update/sync-docker-command.ts
+async function synchronizeDockerfiles(projectDirectory) {
+  const workspace = await snapshotWorkspacePackages(projectDirectory);
+  const targets = dockerfileCopyTargets.filter((target) => target.entryDirectory !== "apps/agent-server" || workspace.packages.some(({ directory }) => directory === target.entryDirectory));
+  const plans = await Promise.all(targets.map((target) => planDockerfileInProject(projectDirectory, target, {
+    requireAnchors: true
+  }).then((result) => ({ target, result }))));
+  if (plans.some(({ result }) => !result.synced)) {
+    throw new Error("\u9879\u76EE\u7F3A\u5C11\u53D7\u652F\u6301\u7684 Dockerfile\uFF0C\u65E0\u6CD5\u540C\u6B65 COPY \u6E05\u5355");
+  }
+  const changed = plans.filter(({ result }) => result.changed && result.content !== undefined);
+  if (changed.length) {
+    const membershipExpectations = [
+      ...workspace.membershipExpectations,
+      ...plans.flatMap(({ result }) => result.membershipExpectations)
+    ];
+    await assertWorkspaceMembership(projectDirectory, membershipExpectations);
+    const state = await applyMetadataTransaction({
+      id: `sync-docker-${Date.now()}`,
+      projectDirectory,
+      guards: [
+        ...workspace.expectations,
+        ...plans.flatMap(({ result }) => result.expectations)
+      ],
+      writes: changed.map(({ target, result }) => ({
+        path: target.dockerfilePath,
+        content: result.content
+      }))
+    });
+    await finalizeOwnedTransaction({
+      projectDirectory,
+      ownerToken: state.ownerToken,
+      expectations: changed.map(({ target, result }) => ({
+        path: target.dockerfilePath,
+        expected: {
+          kind: "hash",
+          value: hashContent(result.content)
+        }
+      })),
+      workspaceMembershipExpectations: membershipExpectations
+    });
+  }
+  console.log(changed.length ? "\u5DF2\u540C\u6B65 Server \u4E0E Web Dockerfile workspace COPY \u6E05\u5355" : "Server \u4E0E Web Dockerfile workspace COPY \u6E05\u5355\u5DF2\u662F\u6700\u65B0");
+}
+
+// src/update/doctor.ts
+import { readFile as readFile12 } from "fs/promises";
+import { join as join17 } from "path";
+
+// src/update/process.ts
+import { spawn as spawn2 } from "child_process";
+var LOCAL_GIT_ENVIRONMENT_VARIABLES = [
+  "GIT_ALTERNATE_OBJECT_DIRECTORIES",
+  "GIT_CONFIG",
+  "GIT_CONFIG_PARAMETERS",
+  "GIT_CONFIG_COUNT",
+  "GIT_OBJECT_DIRECTORY",
+  "GIT_DIR",
+  "GIT_WORK_TREE",
+  "GIT_IMPLICIT_WORK_TREE",
+  "GIT_GRAFT_FILE",
+  "GIT_INDEX_FILE",
+  "GIT_NO_REPLACE_OBJECTS",
+  "GIT_REPLACE_REF_BASE",
+  "GIT_PREFIX",
+  "GIT_SHALLOW_FILE",
+  "GIT_COMMON_DIR"
+];
+async function captureProcess(command, args, cwd, inherit = false) {
+  return await new Promise((resolve6, reject) => {
+    const child = spawn2(command, args, {
+      cwd,
+      env: withoutParentGitRepository(process.env),
+      stdio: inherit ? "inherit" : ["ignore", "pipe", "pipe"]
+    });
+    let stdout2 = "";
+    let stderr = "";
+    child.stdout?.on("data", (chunk) => stdout2 += chunk.toString());
+    child.stderr?.on("data", (chunk) => stderr += chunk.toString());
+    child.once("error", reject);
+    child.once("close", (code) => resolve6({ code: code ?? 1, stdout: stdout2, stderr }));
+  });
+}
+async function assertProcess(command, args, cwd, inherit = false) {
+  const result = await captureProcess(command, args, cwd, inherit);
+  if (result.code !== 0) {
+    const detail = result.stderr.trim() || result.stdout.trim();
+    throw new Error(`${command} ${args.join(" ")} \u6267\u884C\u5931\u8D25${detail ? `\uFF1A${detail}` : ""}`);
+  }
+  return result;
+}
+function withoutParentGitRepository(source) {
+  const environment = { ...source };
+  for (const key of LOCAL_GIT_ENVIRONMENT_VARIABLES) {
+    delete environment[key];
+  }
+  return environment;
+}
+
 // src/update/legacy-adk-retirement.ts
 import { lstat as lstat6, readFile as readFile11 } from "fs/promises";
 import { join as join16 } from "path";
@@ -8547,7 +8713,9 @@ var recipes = [
   },
   { id: "starter-0.8.0-to-0.8.1", from: "0.8.0", to: "0.8.1" },
   { id: "starter-0.8.1-to-0.8.2", from: "0.8.1", to: "0.8.2" },
-  { id: "starter-0.8.2-to-0.8.3", from: "0.8.2", to: "0.8.3" }
+  { id: "starter-0.8.2-to-0.8.3", from: "0.8.2", to: "0.8.3" },
+  { id: "starter-0.8.3-to-0.9.0", from: "0.8.3", to: "0.9.0" },
+  { id: "starter-0.9.0-to-0.9.1", from: "0.9.0", to: "0.9.1" }
 ];
 function resolveRecipeChain(sourceVersion, targetVersion) {
   if (compareVersions2(sourceVersion, minimumSupportedUpdateVersion) < 0) {
@@ -8953,8 +9121,8 @@ async function readProjectName2(projectDirectory) {
 }
 
 // src/update/planner.ts
-import { readFile as readFile22 } from "fs/promises";
-import { dirname as dirname9, join as join27 } from "path";
+import { readFile as readFile23 } from "fs/promises";
+import { dirname as dirname9, join as join29 } from "path";
 
 // src/update/docker-copy-update-plan.ts
 async function deriveDockerfilePlans(files, snapshots, paths, targetWorkspaceManifests) {
@@ -9422,9 +9590,33 @@ async function readSnapshot(root, tag) {
 }
 
 // src/update/planner-file.ts
-import { readFile as readFile20 } from "fs/promises";
-import { join as join25 } from "path";
+import { readFile as readFile21 } from "fs/promises";
+import { join as join27 } from "path";
 
+// src/update/planner-file-support.ts
+function readyPlannedFile(path2, ownership, action, reason, expectedProjectContent, content) {
+  return {
+    path: path2,
+    ownership,
+    action,
+    reason,
+    expectedProjectContent,
+    content
+  };
+}
+function expectationForSnapshot(content) {
+  return content ? { kind: "hash", value: hashContent(content) } : { kind: "missing" };
+}
+function conflict(path2, ownership, reason, expectedProjectContent) {
+  return {
+    path: path2,
+    ownership,
+    action: "preserve",
+    reason: "\u5BA2\u6237\u5DF2\u4FEE\u6539",
+    expectedProjectContent,
+    conflict: reason
+  };
+}
 // src/update/merge.ts
 import { mkdtemp as mkdtemp2, rm as rm6, writeFile as writeFile12 } from "fs/promises";
 import { tmpdir as tmpdir2 } from "os";
@@ -9867,13 +10059,13 @@ function isObject(value) {
 // src/update/planner-project-owned.ts
 function planGeneratedProjectOwned(path2, source, target, ours, theirs, expected) {
   if (!source && target) {
-    return !ours && theirs ? ready(path2, "create", "\u6A21\u5757\u5B89\u88C5\u65B0\u589E\u9879\u76EE\u6269\u5C55\u70B9", expected, theirs) : conflict(path2, "\u6A21\u5757\u65B0\u589E\u8DEF\u5F84\u5DF2\u88AB\u9879\u76EE\u5360\u7528", expected);
+    return !ours && theirs ? ready(path2, "create", "\u6A21\u5757\u5B89\u88C5\u65B0\u589E\u9879\u76EE\u6269\u5C55\u70B9", expected, theirs) : conflict2(path2, "\u6A21\u5757\u65B0\u589E\u8DEF\u5F84\u5DF2\u88AB\u9879\u76EE\u5360\u7528", expected);
   }
   if (source && !target) {
     if (!ours) {
       return ready(path2, "preserve", "\u6A21\u5757\u8DEF\u5F84\u5DF2\u79FB\u9664", expected);
     }
-    return hashContent(ours) === source.hash ? ready(path2, "delete", "\u6A21\u5757\u5378\u8F7D\u79FB\u9664\u672A\u4FEE\u6539\u6269\u5C55\u70B9", expected) : conflict(path2, "\u5BA2\u6237\u4FEE\u6539\u8FC7\u6A21\u5757\u6269\u5C55\u70B9\uFF0C\u62D2\u7EDD\u5378\u8F7D", expected);
+    return hashContent(ours) === source.hash ? ready(path2, "delete", "\u6A21\u5757\u5378\u8F7D\u79FB\u9664\u672A\u4FEE\u6539\u6269\u5C55\u70B9", expected) : conflict2(path2, "\u5BA2\u6237\u4FEE\u6539\u8FC7\u6A21\u5757\u6269\u5C55\u70B9\uFF0C\u62D2\u7EDD\u5378\u8F7D", expected);
   }
   if (!source || !target || !ours || !theirs) {
     return ready(path2, "preserve", "\u9879\u76EE\u62E5\u6709\uFF0C\u6A21\u5757\u7EC4\u5408\u672A\u6539\u53D8", expected);
@@ -9884,7 +10076,7 @@ function planGeneratedProjectOwned(path2, source, target, ours, theirs, expected
   if (source.hash === target.hash) {
     return ready(path2, "preserve", "\u6A21\u5757\u7EC4\u5408\u672A\u6539\u53D8", expected);
   }
-  return hashContent(ours) === source.hash ? ready(path2, "update", "\u66F4\u65B0\u672A\u4FEE\u6539\u7684\u6A21\u5757\u7EC4\u5408\u6269\u5C55\u70B9", expected, theirs) : conflict(path2, "\u5BA2\u6237\u4FEE\u6539\u8FC7\u6A21\u5757\u7EC4\u5408\u6269\u5C55\u70B9", expected);
+  return hashContent(ours) === source.hash ? ready(path2, "update", "\u66F4\u65B0\u672A\u4FEE\u6539\u7684\u6A21\u5757\u7EC4\u5408\u6269\u5C55\u70B9", expected, theirs) : conflict2(path2, "\u5BA2\u6237\u4FEE\u6539\u8FC7\u6A21\u5757\u7EC4\u5408\u6269\u5C55\u70B9", expected);
 }
 function ready(path2, action, reason, expectedProjectContent, content) {
   return {
@@ -9896,7 +10088,7 @@ function ready(path2, action, reason, expectedProjectContent, content) {
     content
   };
 }
-function conflict(path2, reason, expectedProjectContent) {
+function conflict2(path2, reason, expectedProjectContent) {
   return {
     path: path2,
     ownership: "project-owned",
@@ -9949,10 +10141,10 @@ function planClientWorkflowProjectOwned(input) {
 }
 function planBinding(input) {
   if (!input.target)
-    return conflict2(input, "\u76EE\u6807\u7248\u672C\u7F3A\u5C11 Workflow binding seam");
+    return conflict3(input, "\u76EE\u6807\u7248\u672C\u7F3A\u5C11 Workflow binding seam");
   const target = decode(input.target);
   if (target !== immutableReleaseDefaultBinding) {
-    return conflict2(input, "\u76EE\u6807\u7248\u672C Workflow binding seam \u5951\u7EA6\u65E0\u6548");
+    return conflict3(input, "\u76EE\u6807\u7248\u672C Workflow binding seam \u5951\u7EA6\u65E0\u6548");
   }
   if (!input.ours) {
     return ready2(input, "create", "\u65B0\u589E\u9ED8\u8BA4\u5173\u95ED\u7684 Workflow binding seam", input.target);
@@ -9962,17 +10154,17 @@ function planBinding(input) {
     return ready2(input, "preserve", "\u5DF2\u5305\u542B immutable release binding seam");
   }
   if (source !== legacyDefaultBinding) {
-    return conflict2(input, "Workflow binding seam \u4E0D\u662F 0.6.14 \u9ED8\u8BA4\u7A7A\u7248\u672C");
+    return conflict3(input, "Workflow binding seam \u4E0D\u662F 0.6.14 \u9ED8\u8BA4\u7A7A\u7248\u672C");
   }
   return ready2(input, "update", "\u5347\u7EA7\u9ED8\u8BA4\u7A7A Workflow binding seam", input.target);
 }
 function planComposition(input) {
   if (!input.target) {
-    return conflict2(input, "\u76EE\u6807\u7248\u672C\u7F3A\u5C11 Agent Runtime Composition");
+    return conflict3(input, "\u76EE\u6807\u7248\u672C\u7F3A\u5C11 Agent Runtime Composition");
   }
   const target = decode(input.target);
   if (hashContent(target) !== immutableReleaseCompositionHash) {
-    return conflict2(input, "\u76EE\u6807\u7248\u672C Agent Runtime Composition \u5951\u7EA6\u65E0\u6548");
+    return conflict3(input, "\u76EE\u6807\u7248\u672C Agent Runtime Composition \u5951\u7EA6\u65E0\u6548");
   }
   if (!input.ours) {
     return ready2(input, "create", "\u65B0\u589E Agent Runtime Composition", input.target);
@@ -9982,11 +10174,11 @@ function planComposition(input) {
     return ready2(input, "preserve", "\u5DF2\u88C5\u914D Workflow Artifact binding");
   }
   if ([workflowArtifactImport, newOmit, workflowArtifactProperty].some((value) => source.includes(value))) {
-    return conflict2(input, "Agent Runtime Composition \u53EA\u5305\u542B\u90E8\u5206\u76EE\u6807\u88C5\u914D");
+    return conflict3(input, "Agent Runtime Composition \u53EA\u5305\u542B\u90E8\u5206\u76EE\u6807\u88C5\u914D");
   }
   const runtimeConflict = validateLegacyRuntimeObject(source);
   if (runtimeConflict)
-    return conflict2(input, runtimeConflict);
+    return conflict3(input, runtimeConflict);
   const replacements2 = [
     {
       anchor: hostAuthImport,
@@ -10006,7 +10198,7 @@ ${workflowArtifactProperty}`
   let content = source;
   for (const replacement of replacements2) {
     if (occurrences(content, replacement.anchor) !== 1) {
-      return conflict2(input, `Agent Runtime Composition \u951A\u70B9\u4E0D\u552F\u4E00\uFF1A${replacement.anchor}`);
+      return conflict3(input, `Agent Runtime Composition \u951A\u70B9\u4E0D\u552F\u4E00\uFF1A${replacement.anchor}`);
     }
     content = content.replace(replacement.anchor, replacement.value);
   }
@@ -10022,7 +10214,7 @@ function ready2(input, action, reason, content) {
     content
   };
 }
-function conflict2(input, message) {
+function conflict3(input, message) {
   return {
     path: input.path,
     ownership: "project-owned",
@@ -10120,18 +10312,18 @@ function recipeCanManageMissingProjectOwnedPath(path2) {
 async function planRecipeProjectOwned(input) {
   if (input.path === clientWorkflowCompositionPath || input.path === clientWorkflowBindingPath) {
     if (!input.target) {
-      return conflict3(input, "\u7248\u672C recipe \u6240\u9700\u7684\u76EE\u6807\u6587\u4EF6\u7F3A\u5931");
+      return conflict4(input, "\u7248\u672C recipe \u6240\u9700\u7684\u76EE\u6807\u6587\u4EF6\u7F3A\u5931");
     }
     return planClientWorkflowProjectOwned({ ...input, target: input.target });
   }
   if (!input.ours) {
-    return conflict3(input, "\u7248\u672C recipe \u6240\u9700\u7684\u9879\u76EE\u951A\u70B9\u7F3A\u5931");
+    return conflict4(input, "\u7248\u672C recipe \u6240\u9700\u7684\u9879\u76EE\u951A\u70B9\u7F3A\u5931");
   }
   const source = new TextDecoder().decode(input.ours);
   const target = input.target ? new TextDecoder().decode(input.target) : undefined;
   const transformed = transformProjectOwnedAnchor(input.path, source, target);
   if ("error" in transformed)
-    return conflict3(input, transformed.error);
+    return conflict4(input, transformed.error);
   if (transformed.content === source) {
     return preserve(input, "\u5DF2\u5305\u542B\u7248\u672C recipe \u76EE\u6807\u5185\u5BB9");
   }
@@ -10317,7 +10509,7 @@ function update(input, content) {
     content
   };
 }
-function conflict3(input, message) {
+function conflict4(input, message) {
   return {
     path: input.path,
     ownership: "project-owned",
@@ -10328,14 +10520,163 @@ function conflict3(input, message) {
   };
 }
 
+// src/update/dsh-platform-recipe.ts
+import { join as join26 } from "path";
+
+// src/update/planner-snapshots.ts
+import { readFile as readFile20, stat as stat2 } from "fs/promises";
+import { join as join25 } from "path";
+async function snapshotProjectFiles(project, paths, seed) {
+  const snapshots = new Map(seed);
+  await Promise.all([...paths].filter((path2) => !snapshots.has(path2)).map(async (path2) => {
+    snapshots.set(path2, await readOptional(join25(project, path2)));
+  }));
+  return snapshots;
+}
+async function snapshotProjectModes(project, paths) {
+  return new Map(await Promise.all([...paths].map(async (path2) => [path2, await readModeOptional(join25(project, path2))])));
+}
+async function assertPlanSnapshots(project, expectations) {
+  const changed = [];
+  for (const expectation2 of expectations) {
+    const actual = expectationForSnapshot(await readOptional(join25(project, expectation2.path)));
+    if (JSON.stringify(actual) !== JSON.stringify(expectation2.expected)) {
+      changed.push(expectation2.path);
+      continue;
+    }
+    if ("mode" in expectation2 && await readModeOptional(join25(project, expectation2.path)) !== expectation2.mode) {
+      changed.push(expectation2.path);
+    }
+  }
+  if (changed.length) {
+    throw new Error(`\u751F\u6210\u66F4\u65B0\u8BA1\u5212\u671F\u95F4\u5019\u9009\u6587\u4EF6\u53D1\u751F\u53D8\u5316\uFF1A${changed.join("\u3001")}`);
+  }
+}
+async function readModeOptional(path2) {
+  try {
+    return (await stat2(path2)).mode & 511;
+  } catch (error) {
+    if (isMissing7(error))
+      return;
+    throw error;
+  }
+}
+async function readSourceParentMode(path2) {
+  try {
+    const info = await stat2(path2);
+    if (!info.isDirectory()) {
+      throw new Error(`artifact \u6E90\u7801\u7236\u8DEF\u5F84\u4E0D\u662F\u76EE\u5F55\uFF1A${path2}`);
+    }
+    return info.mode & 493 | 493;
+  } catch (error) {
+    if (isMissing7(error))
+      return 493;
+    throw error;
+  }
+}
+async function readOptional(path2) {
+  try {
+    return await readFile20(path2);
+  } catch (error) {
+    if (isMissing7(error))
+      return;
+    throw error;
+  }
+}
+function isMissing7(error) {
+  return error instanceof Error && "code" in error && error.code === "ENOENT";
+}
+
+// src/update/dsh-platform-recipe.ts
+var dshPlatformRecipeId = "dsh-platform-v1";
+var dshPlatformRecipePaths = new Set([
+  "apps/server/src/app/agent-workflow-presets.ts",
+  "apps/server/src/app/workbench-public-origin.ts",
+  "apps/web/src/router/index.ts",
+  "apps/web/src/router/platform-admin-pages.ts",
+  "apps/web/src/router/platform-admin-route-bindings.ts",
+  "apps/web/src/composables/useLoginFlow.ts",
+  "apps/web/src/pages/system/AgentWorkflowPage.vue",
+  "apps/web/src/services/agent-workflow-api.ts",
+  "apps/web/vite.config.ts",
+  "apps/web/server.ts",
+  "apps/web/runtime-server.ts",
+  "apps/web/dev/start.ts"
+]);
+function isDshPlatformRecipePath(path2) {
+  return dshPlatformRecipePaths.has(path2) || path2.startsWith("apps/server/src/app/dsh-") && path2.endsWith(".ts");
+}
+async function isDshPlatformTransition(input) {
+  if (!input.sourceModules.includes("system.agent") || !input.targetModules.includes("system.agent"))
+    return false;
+  const path2 = "apps/agent-server/package.json";
+  const [base, target] = await Promise.all([
+    readOptional(join26(input.baseDirectory, path2)),
+    readOptional(join26(input.targetDirectory, path2))
+  ]);
+  return hasDsh(target) && !hasDsh(base);
+}
+function planDshPlatformFile(input) {
+  const common2 = {
+    path: input.path,
+    ownership: input.ownership,
+    expectedProjectContent: input.expected
+  };
+  if (input.target && input.ours && hashContent(input.ours) === hashContent(input.target)) {
+    return {
+      ...common2,
+      action: "preserve",
+      reason: "\u5DF2\u5305\u542B DSH \u5E73\u53F0\u63A5\u7EBF\u76EE\u6807\u5185\u5BB9"
+    };
+  }
+  if (input.target && !input.ours && !input.base) {
+    return {
+      ...common2,
+      action: "create",
+      reason: "DSH \u5E73\u53F0\u65B0\u589E\u9879\u76EE\u6269\u5C55\u70B9",
+      content: input.target
+    };
+  }
+  if (input.target && input.base && input.ours && hashContent(input.ours) === hashContent(input.base)) {
+    return {
+      ...common2,
+      action: "update",
+      reason: "DSH \u5E73\u53F0\u5347\u7EA7\u7CBE\u786E\u6765\u6E90\u63A5\u7EBF",
+      content: input.target
+    };
+  }
+  return {
+    ...common2,
+    action: "preserve",
+    reason: "\u4FDD\u7559\u5BA2\u6237 DSH \u63A5\u7EBF",
+    conflict: "DSH \u5E73\u53F0\u63A5\u7EBF\u4E0E\u7CBE\u786E\u6765\u6E90\u6216\u76EE\u6807\u4E0D\u4E00\u81F4\uFF1B\u8BF7\u5BA1\u6838\u9879\u76EE\u4FEE\u6539\u540E\u663E\u5F0F\u96C6\u6210\uFF0C\u7981\u6B62\u731C\u6D4B\u8986\u76D6"
+  };
+}
+function hasDsh(content) {
+  if (!content)
+    return false;
+  const value = JSON.parse(new TextDecoder().decode(content));
+  return typeof value.dependencies?.["@deepseek-ai/dsh"] === "string";
+}
+
 // src/update/planner-file.ts
-async function planFile(path2, baseRoot, targetRoot, source, target, ours, provenance, targetContentOverride, manageGeneratedProjectOwned = false, forcePlatformBaseline = false, manageRecipeProjectOwned = false) {
+async function planFile(path2, baseRoot, targetRoot, source, target, ours, provenance, targetContentOverride, manageGeneratedProjectOwned = false, forcePlatformBaseline = false, manageRecipeProjectOwned = false, migrateDshPlatform = false) {
   const [base, theirs] = await Promise.all([
-    readOptional(join25(baseRoot, path2)),
-    targetContentOverride ? Promise.resolve(targetContentOverride) : readOptional(join25(targetRoot, path2))
+    readOptional2(join27(baseRoot, path2)),
+    targetContentOverride ? Promise.resolve(targetContentOverride) : readOptional2(join27(targetRoot, path2))
   ]);
   const ownership = source?.ownership ?? target?.ownership ?? classifyOwnership(path2);
   const expected = expectationForSnapshot(ours);
+  if (migrateDshPlatform && isDshPlatformRecipePath(path2)) {
+    return planDshPlatformFile({
+      path: path2,
+      ownership,
+      ours,
+      base,
+      target: theirs,
+      expected
+    });
+  }
   if (ownership === "project-owned") {
     const hasExistingRecipeSource = source !== undefined && source.state !== "missing" && ours !== undefined;
     if (manageRecipeProjectOwned && target && (hasExistingRecipeSource || recipeCanManageMissingProjectOwnedPath(path2))) {
@@ -10348,29 +10689,29 @@ async function planFile(path2, baseRoot, targetRoot, source, target, ours, prove
   }
   if (path2.startsWith("packages/database/drizzle/") && path2.endsWith(".sql")) {
     if (source && !target) {
-      return conflict4(path2, ownership, "\u5DF2\u53D1\u5E03 migration \u4E0D\u53EF\u5220\u9664", expected);
+      return conflict(path2, ownership, "\u5DF2\u53D1\u5E03 migration \u4E0D\u53EF\u5220\u9664", expected);
     }
     if (source && target && source.hash !== target.hash) {
-      return conflict4(path2, ownership, "\u5DF2\u53D1\u5E03 migration \u4E0D\u53EF\u6539\u5199\uFF0C\u53EA\u80FD\u8FFD\u52A0\u65B0\u6587\u4EF6", expected);
+      return conflict(path2, ownership, "\u5DF2\u53D1\u5E03 migration \u4E0D\u53EF\u6539\u5199\uFF0C\u53EA\u80FD\u8FFD\u52A0\u65B0\u6587\u4EF6", expected);
     }
   }
   if (!source && target) {
     if (!ours) {
       return readyPlannedFile(path2, ownership, "create", "\u76EE\u6807\u7248\u672C\u65B0\u589E", expected, theirs);
     }
-    return theirs && hashContent(ours) === target.hash ? readyPlannedFile(path2, ownership, "preserve", "\u5DF2\u5305\u542B\u76EE\u6807\u5185\u5BB9", expected) : conflict4(path2, ownership, "\u76EE\u6807\u7248\u672C\u65B0\u589E\u8DEF\u5F84\u5DF2\u88AB\u9879\u76EE\u5360\u7528", expected);
+    return theirs && hashContent(ours) === target.hash ? readyPlannedFile(path2, ownership, "preserve", "\u5DF2\u5305\u542B\u76EE\u6807\u5185\u5BB9", expected) : conflict(path2, ownership, "\u76EE\u6807\u7248\u672C\u65B0\u589E\u8DEF\u5F84\u5DF2\u88AB\u9879\u76EE\u5360\u7528", expected);
   }
   if (source && !target) {
     if (!ours) {
       return readyPlannedFile(path2, ownership, "preserve", "\u9879\u76EE\u5DF2\u5220\u9664", expected);
     }
-    return hashContent(ours) === source.hash ? readyPlannedFile(path2, ownership, "delete", "\u76EE\u6807\u7248\u672C\u5220\u9664", expected) : conflict4(path2, ownership, "\u5BA2\u6237\u4FEE\u6539\u540E Windy \u53C8\u5220\u9664", expected);
+    return hashContent(ours) === source.hash ? readyPlannedFile(path2, ownership, "delete", "\u76EE\u6807\u7248\u672C\u5220\u9664", expected) : conflict(path2, ownership, "\u5BA2\u6237\u4FEE\u6539\u540E Windy \u53C8\u5220\u9664", expected);
   }
   if (source && target && !ours) {
     return readyPlannedFile(path2, "project-owned", "preserve", "\u9879\u76EE\u5DF2\u5220\u9664", expected);
   }
   if (!source || !target || !ours || !theirs) {
-    return conflict4(path2, ownership, "\u6587\u4EF6\u72B6\u6001\u4E0D\u5B8C\u6574\uFF0C\u4E0D\u80FD\u5B89\u5168\u63A8\u65AD", expected);
+    return conflict(path2, ownership, "\u6587\u4EF6\u72B6\u6001\u4E0D\u5B8C\u6574\uFF0C\u4E0D\u80FD\u5B89\u5168\u63A8\u65AD", expected);
   }
   const oursChanged = hashContent(ours) !== source.hash;
   const sourceArtifactHash = artifactHashOf(source);
@@ -10384,7 +10725,7 @@ async function planFile(path2, baseRoot, targetRoot, source, target, ours, prove
   });
   if (forceTargetBaseline && path2.endsWith("package.json") && base) {
     const merged = mergePackageJson(base, ours, theirs);
-    return merged.content ? readyPlannedFile(path2, ownership, "update", "package.json \u5B57\u6BB5\u7EA7\u5408\u5E76", expected, merged.content) : conflict4(path2, ownership, `\u5B57\u6BB5\u51B2\u7A81\uFF1A${merged.conflicts.join("\u3001")}`, expected);
+    return merged.content ? readyPlannedFile(path2, ownership, "update", "package.json \u5B57\u6BB5\u7EA7\u5408\u5E76", expected, merged.content) : conflict(path2, ownership, `\u5B57\u6BB5\u51B2\u7A81\uFF1A${merged.conflicts.join("\u3001")}`, expected);
   }
   if (forceTargetBaseline) {
     return readyPlannedFile(path2, ownership, "update", "\u5F3A\u5236\u91C7\u7528\u76EE\u6807\u5E73\u53F0\u57FA\u7EBF", expected, theirs);
@@ -10394,11 +10735,11 @@ async function planFile(path2, baseRoot, targetRoot, source, target, ours, prove
   }
   if (targetChanged && path2.endsWith("package.json") && base) {
     const merged = mergePackageJson(base, ours, theirs);
-    return merged.content ? readyPlannedFile(path2, ownership, "update", "package.json \u5B57\u6BB5\u7EA7\u5408\u5E76", expected, merged.content) : conflict4(path2, ownership, `\u5B57\u6BB5\u51B2\u7A81\uFF1A${merged.conflicts.join("\u3001")}`, expected);
+    return merged.content ? readyPlannedFile(path2, ownership, "update", "package.json \u5B57\u6BB5\u7EA7\u5408\u5E76", expected, merged.content) : conflict(path2, ownership, `\u5B57\u6BB5\u51B2\u7A81\uFF1A${merged.conflicts.join("\u3001")}`, expected);
   }
   if (!oursChanged && targetChanged && adoptedProjectDelta && base) {
     const merged = await mergeTextFile(base, ours, theirs);
-    return merged.content ? readyPlannedFile(path2, ownership, "update", "\u4E09\u65B9\u5408\u5E76\u5DF2\u91C7\u7EB3\u9879\u76EE\u589E\u91CF", expected, merged.content) : conflict4(path2, ownership, merged.conflict || "\u4E09\u65B9\u5408\u5E76\u5931\u8D25", expected);
+    return merged.content ? readyPlannedFile(path2, ownership, "update", "\u4E09\u65B9\u5408\u5E76\u5DF2\u91C7\u7EB3\u9879\u76EE\u589E\u91CF", expected, merged.content) : conflict(path2, ownership, merged.conflict || "\u4E09\u65B9\u5408\u5E76\u5931\u8D25", expected);
   }
   if (!oursChanged) {
     return readyPlannedFile(path2, ownership, "update", "\u4EC5 Windy \u4FEE\u6539", expected, theirs);
@@ -10411,9 +10752,9 @@ async function planFile(path2, baseRoot, targetRoot, source, target, ours, prove
   }
   if (base) {
     const merged = await mergeTextFile(base, ours, theirs);
-    return merged.content ? readyPlannedFile(path2, ownership, "update", "\u4E09\u65B9\u5408\u5E76", expected, merged.content) : conflict4(path2, ownership, merged.conflict || "\u4E09\u65B9\u5408\u5E76\u5931\u8D25", expected);
+    return merged.content ? readyPlannedFile(path2, ownership, "update", "\u4E09\u65B9\u5408\u5E76", expected, merged.content) : conflict(path2, ownership, merged.conflict || "\u4E09\u65B9\u5408\u5E76\u5931\u8D25", expected);
   }
-  return conflict4(path2, ownership, "\u5BA2\u6237\u548C Windy \u5747\u5DF2\u4FEE\u6539", expected);
+  return conflict(path2, ownership, "\u5BA2\u6237\u548C Windy \u5747\u5DF2\u4FEE\u6539", expected);
 }
 function shouldForcePlatformBaseline(input) {
   return input.forcePlatformBaseline && !input.oursChanged && input.base !== undefined && hashContent(input.base) !== input.sourceArtifactHash;
@@ -10421,32 +10762,9 @@ function shouldForcePlatformBaseline(input) {
 function targetChangedSinceBase(sourceHash, base, target) {
   return base && target ? hashContent(base) !== hashContent(target) : !!target && hashContent(target) !== sourceHash;
 }
-function readyPlannedFile(path2, ownership, action, reason, expectedProjectContent, content) {
-  return {
-    path: path2,
-    ownership,
-    action,
-    reason,
-    expectedProjectContent,
-    content
-  };
-}
-function expectationForSnapshot(content) {
-  return content ? { kind: "hash", value: hashContent(content) } : { kind: "missing" };
-}
-function conflict4(path2, ownership, reason, expectedProjectContent) {
-  return {
-    path: path2,
-    ownership,
-    action: "preserve",
-    reason: "\u5BA2\u6237\u5DF2\u4FEE\u6539",
-    expectedProjectContent,
-    conflict: reason
-  };
-}
-async function readOptional(path2) {
+async function readOptional2(path2) {
   try {
-    return await readFile20(path2);
+    return await readFile21(path2);
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
       return;
@@ -10455,6 +10773,31 @@ async function readOptional(path2) {
   }
 }
 
+// src/update/planner-files.ts
+var metadataPaths = new Set([
+  ".windy/generation.json",
+  ".windy/files.json",
+  ".windy-template.json"
+]);
+async function planFiles(input) {
+  const files = [];
+  for (const path2 of [...input.paths].sort()) {
+    if (metadataPaths.has(path2))
+      continue;
+    const forcedContent = input.migrations.forceUpdates.has(path2) ? input.migrations.contentOverrides.get(path2) : undefined;
+    const ours = input.projectSnapshots.get(path2);
+    const expected = expectationForSnapshot(ours);
+    if (input.migrations.forcePreserves.has(path2)) {
+      files.push(readyPlannedFile(path2, input.sourceEntries.get(path2)?.ownership ?? classifyOwnership(path2), "preserve", "\u4FDD\u7559\u9879\u76EE\u5DF2\u53D1\u5E03 migration \u5386\u53F2", expected));
+    } else if (forcedContent) {
+      files.push(readyPlannedFile(path2, input.targetEntries.get(path2)?.ownership ?? input.sourceEntries.get(path2)?.ownership ?? classifyOwnership(path2), "update", "\u5408\u5E76\u5E73\u53F0\u4E0E\u4E0B\u6E38 migration \u5386\u53F2", expected, forcedContent));
+    } else {
+      files.push(await planFile(path2, input.artifactSet.baseDirectory, input.artifactSet.targetDirectory, input.sourceEntries.get(path2), input.targetEntries.get(path2), ours, input.provenance, input.migrations.contentOverrides.get(path2), input.manageGeneratedProjectOwned, input.forcePlatformBaseline, input.recipeProjectOwnedPaths.has(path2), input.migrateDshPlatform));
+    }
+  }
+  return files;
+}
+
 // src/update/planner-modules.ts
 function resolveModuleRecipeIds(request) {
   const lifecycle = request.lifecycle;
@@ -10497,70 +10840,6 @@ function hasExistingSourceForTest(path2, sourcePaths) {
   return sourceExtensions.some((extension) => sourcePaths.has(`${stem}${extension}`));
 }
 
-// src/update/planner-snapshots.ts
-import { readFile as readFile21, stat as stat2 } from "fs/promises";
-import { join as join26 } from "path";
-async function snapshotProjectFiles(project, paths, seed) {
-  const snapshots = new Map(seed);
-  await Promise.all([...paths].filter((path2) => !snapshots.has(path2)).map(async (path2) => {
-    snapshots.set(path2, await readOptional2(join26(project, path2)));
-  }));
-  return snapshots;
-}
-async function snapshotProjectModes(project, paths) {
-  return new Map(await Promise.all([...paths].map(async (path2) => [path2, await readModeOptional(join26(project, path2))])));
-}
-async function assertPlanSnapshots(project, expectations) {
-  const changed = [];
-  for (const expectation2 of expectations) {
-    const actual = expectationForSnapshot(await readOptional2(join26(project, expectation2.path)));
-    if (JSON.stringify(actual) !== JSON.stringify(expectation2.expected)) {
-      changed.push(expectation2.path);
-      continue;
-    }
-    if ("mode" in expectation2 && await readModeOptional(join26(project, expectation2.path)) !== expectation2.mode) {
-      changed.push(expectation2.path);
-    }
-  }
-  if (changed.length) {
-    throw new Error(`\u751F\u6210\u66F4\u65B0\u8BA1\u5212\u671F\u95F4\u5019\u9009\u6587\u4EF6\u53D1\u751F\u53D8\u5316\uFF1A${changed.join("\u3001")}`);
-  }
-}
-async function readModeOptional(path2) {
-  try {
-    return (await stat2(path2)).mode & 511;
-  } catch (error) {
-    if (isMissing7(error))
-      return;
-    throw error;
-  }
-}
-async function readSourceParentMode(path2) {
-  try {
-    const info = await stat2(path2);
-    if (!info.isDirectory()) {
-      throw new Error(`artifact \u6E90\u7801\u7236\u8DEF\u5F84\u4E0D\u662F\u76EE\u5F55\uFF1A${path2}`);
-    }
-    return info.mode & 493 | 493;
-  } catch (error) {
-    if (isMissing7(error))
-      return 493;
-    throw error;
-  }
-}
-async function readOptional2(path2) {
-  try {
-    return await readFile21(path2);
-  } catch (error) {
-    if (isMissing7(error))
-      return;
-    throw error;
-  }
-}
-function isMissing7(error) {
-  return error instanceof Error && "code" in error && error.code === "ENOENT";
-}
-
 // src/update/preflight.ts
 async function assertProjectReadyForUpdate(projectDirectory) {
   await assertNoPendingUpdate(projectDirectory);
@@ -10581,12 +10860,45 @@ function resolveUpdateTargetModules(sourceModules, explicitTarget) {
   });
 }
 
+// src/update/legacy-python-agent-retirement.ts
+import { lstat as lstat8, readFile as readFile22 } from "fs/promises";
+import { join as join28 } from "path";
+var retiredKeys = [
+  "AGENT_DATABASE_URL",
+  "AGENT_RUN_STORE_PATH",
+  "AGENT_RUN_ENCRYPTION_SECRET",
+  "AI_PROVIDER_AUDIT_STORE_PATH",
+  "AI_PROVIDER_CONNECT_TIMEOUT_MS",
+  "OTEL_EXPORTER_OTLP_TRACES_ENDPOINT",
+  "OTEL_EXPORTER_OTLP_HEADERS"
+];
+async function inspectPythonAgentRetirement(projectDirectory) {
+  const path2 = join28(projectDirectory, ".env");
+  try {
+    const stat3 = await lstat8(path2);
+    if (stat3.isSymbolicLink() || !stat3.isFile())
+      return [
+        {
+          kind: "external-environment",
+          path: ".env",
+          message: "\u672A\u8BFB\u53D6\u5916\u90E8\u6258\u7BA1\u6216\u975E\u5E38\u89C4 .env\uFF1B\u8BF7\u6838\u5BF9\u65E7 Python Agent \u4E13\u7528\u914D\u7F6E\uFF0C\u4F7F\u7528\u65B0 DSH \u5B58\u50A8\u4E0E\u52A0\u5BC6\u914D\u7F6E\u3002"
+        }
+      ];
+    const content = await readFile22(path2, "utf8");
+    return retiredKeys.filter((key) => new RegExp(`^(?:export\\s+)?${key}\\s*=`, "m").test(content)).map((key) => ({
+      kind: "environment-key",
+      path: ".env",
+      key,
+      message: `${key} \u4E0D\u518D\u7531\u65B0 Agent Server \u8BFB\u53D6\uFF1B\u73AF\u5883\u4E0E\u65E7 Agent \u6570\u636E\u7531\u9879\u76EE\u6240\u6709\u8005\u5907\u4EFD\u540E\u4EBA\u5DE5\u6E05\u7406\uFF0C\u4E0D\u5F71\u54CD\u5176\u5B83\u670D\u52A1\u540C\u540D\u914D\u7F6E\u3002`
+    }));
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT")
+      return [];
+    throw error;
+  }
+}
+
 // src/update/planner.ts
-var metadataPaths = new Set([
-  ".windy/generation.json",
-  ".windy/files.json",
-  ".windy-template.json"
-]);
 var oxcManagedPaths = new Set([
   ".oxfmtrc.json",
   ".oxlintrc.json",
@@ -10594,8 +10906,8 @@ var oxcManagedPaths = new Set([
 ]);
 async function createUpdatePlan(request, artifacts, dependencies = {}) {
   await assertProjectReadyForUpdate(request.projectDirectory);
-  const manifestPath = join27(request.projectDirectory, ".windy/files.json");
-  const expectedManifestHash = hashContent(await readFile22(manifestPath));
+  const manifestPath = join29(request.projectDirectory, ".windy/files.json");
+  const expectedManifestHash = hashContent(await readFile23(manifestPath));
   const generationSnapshot = await readGenerationProvenanceSnapshot(request.projectDirectory);
   const provenance = generationSnapshot.provenance;
   const targetModules = resolveUpdateTargetModules(provenance.modules.map(({ name }) => name), request.targetModules);
@@ -10607,7 +10919,17 @@ async function createUpdatePlan(request, artifacts, dependencies = {}) {
   }
   const versionRecipes = (dependencies.resolveVersionRecipes ?? resolveRecipeChain)(provenance.windyVersion, targetVersion);
   const moduleRecipes = resolveModuleRecipeIds(request);
-  const recipes2 = [...versionRecipes.map(({ id }) => id), ...moduleRecipes];
+  const migrateDshPlatform = await isDshPlatformTransition({
+    baseDirectory: artifactSet.baseDirectory,
+    targetDirectory: artifactSet.targetDirectory,
+    sourceModules: provenance.modules.map(({ name }) => name),
+    targetModules
+  });
+  const recipes2 = [
+    ...versionRecipes.map(({ id }) => id),
+    ...moduleRecipes,
+    ...migrateDshPlatform ? [dshPlatformRecipeId] : []
+  ];
   const recipeProjectOwnedPaths = recipeManagedProjectOwnedPaths(recipes2);
   const [rawSourceManifest, rawTargetManifest] = await Promise.all([
     readManagedFilesManifest(request.projectDirectory),
@@ -10642,8 +10964,10 @@ async function createUpdatePlan(request, artifacts, dependencies = {}) {
   const paths = new Set([...sourceEntries.keys(), ...targetEntries.keys()]);
   for (const path2 of paths) {
     if (!projectSnapshots.has(path2)) {
-      projectSnapshots.set(path2, await readOptional2(join27(request.projectDirectory, path2)));
-      projectModes.set(path2, await readModeOptional(join27(request.projectDirectory, path2)));
+      projectSnapshots.set(path2, await readOptional(join29(request.projectDirectory, path2)));
+    }
+    if (!projectModes.has(path2)) {
+      projectModes.set(path2, await readModeOptional(join29(request.projectDirectory, path2)));
     }
   }
   const files = await planFiles({
@@ -10656,7 +10980,8 @@ async function createUpdatePlan(request, artifacts, dependencies = {}) {
     provenance,
     manageGeneratedProjectOwned: request.targetModules !== undefined,
     forcePlatformBaseline: request.forcePlatformBaseline === true,
-    recipeProjectOwnedPaths
+    recipeProjectOwnedPaths,
+    migrateDshPlatform
   });
   preserveTestsForExistingProjectOwnedSources(files, sourceEntries);
   await deriveDockerfilePlans(files, projectSnapshots, new Set([
@@ -10667,10 +10992,10 @@ async function createUpdatePlan(request, artifacts, dependencies = {}) {
   for (const file of files) {
     file.expectedProjectMode = projectModes.get(file.path);
     if (file.action === "create" || file.action === "update") {
-      file.mode = file.expectedProjectMode ?? await readModeOptional(join27(artifactSet.targetDirectory, file.path));
+      file.mode = file.expectedProjectMode ?? await readModeOptional(join29(artifactSet.targetDirectory, file.path));
     }
     if (file.action === "create") {
-      file.parentMode = await readSourceParentMode(join27(artifactSet.targetDirectory, dirname9(file.path)));
+      file.parentMode = await readSourceParentMode(join29(artifactSet.targetDirectory, dirname9(file.path)));
     }
   }
   const plannedPaths = new Set(files.map(({ path: path2 }) => path2));
@@ -10690,8 +11015,11 @@ async function createUpdatePlan(request, artifacts, dependencies = {}) {
     ...migrations.conflicts,
     ...files.flatMap((file) => file.conflict ? [`${file.path}\uFF1A${file.conflict}`] : [])
   ];
-  const manualCleanup = await inspectAdkRetirement(request.projectDirectory);
-  if (hashContent(await readFile22(manifestPath)) !== expectedManifestHash) {
+  const manualCleanup = [
+    ...await inspectAdkRetirement(request.projectDirectory),
+    ...migrateDshPlatform ? await inspectPythonAgentRetirement(request.projectDirectory) : []
+  ];
+  if (hashContent(await readFile23(manifestPath)) !== expectedManifestHash) {
     throw new Error("\u751F\u6210\u66F4\u65B0\u8BA1\u5212\u671F\u95F4\u53D7\u7BA1\u6E05\u5355\u53D1\u751F\u53D8\u5316");
   }
   await assertPlanSnapshots(request.projectDirectory, [
@@ -10724,24 +11052,6 @@ async function createUpdatePlan(request, artifacts, dependencies = {}) {
     lifecycle: request.lifecycle
   };
 }
-async function planFiles(input) {
-  const files = [];
-  for (const path2 of [...input.paths].sort()) {
-    if (metadataPaths.has(path2))
-      continue;
-    const forcedContent = input.migrations.forceUpdates.has(path2) ? input.migrations.contentOverrides.get(path2) : undefined;
-    const ours = input.projectSnapshots.get(path2);
-    const expected = expectationForSnapshot(ours);
-    if (input.migrations.forcePreserves.has(path2)) {
-      files.push(readyPlannedFile(path2, input.sourceEntries.get(path2)?.ownership ?? classifyOwnership(path2), "preserve", "\u4FDD\u7559\u9879\u76EE\u5DF2\u53D1\u5E03 migration \u5386\u53F2", expected));
-    } else if (forcedContent) {
-      files.push(readyPlannedFile(path2, input.targetEntries.get(path2)?.ownership ?? input.sourceEntries.get(path2)?.ownership ?? classifyOwnership(path2), "update", "\u5408\u5E76\u5E73\u53F0\u4E0E\u4E0B\u6E38 migration \u5386\u53F2", expected, forcedContent));
-    } else {
-      files.push(await planFile(path2, input.artifactSet.baseDirectory, input.artifactSet.targetDirectory, input.sourceEntries.get(path2), input.targetEntries.get(path2), ours, input.provenance, input.migrations.contentOverrides.get(path2), input.manageGeneratedProjectOwned, input.forcePlatformBaseline, input.recipeProjectOwnedPaths.has(path2)));
-    }
-  }
-  return files;
-}
 function createUpdateId(from, to) {
   return `${new Date().toISOString().replaceAll(/[:.]/g, "-")}-${from}-to-${to}`;
 }
@@ -10817,9 +11127,9 @@ function frozenManifestHash(file, finalizedHashes) {
 }
 
 // src/update/format-stabilizer.ts
-import { mkdir as mkdir8, mkdtemp as mkdtemp3, readFile as readFile23, rm as rm7, writeFile as writeFile13 } from "fs/promises";
+import { mkdir as mkdir8, mkdtemp as mkdtemp3, readFile as readFile24, rm as rm7, writeFile as writeFile13 } from "fs/promises";
 import { tmpdir as tmpdir3 } from "os";
-import { dirname as dirname10, extname as extname4, join as join28, resolve as resolve6, sep as sep5 } from "path";
+import { dirname as dirname10, extname as extname4, join as join30, resolve as resolve6, sep as sep5 } from "path";
 var formattedExtensions = new Set([
   ".cjs",
   ".css",
@@ -10858,7 +11168,7 @@ async function stabilizeManagedContent(result2, execute, writeProjectFile) {
     }
   }
   inputs.set(".windy/generation.json", new TextEncoder().encode(generationContent));
-  const temporaryRoot = await mkdtemp3(join28(tmpdir3(), "windy-update-format-"));
+  const temporaryRoot = await mkdtemp3(join30(tmpdir3(), "windy-update-format-"));
   try {
     const stagedPaths = await stageInputs(temporaryRoot, inputs);
     for (let offset = 0;offset < stagedPaths.length; offset += 80) {
@@ -10866,14 +11176,14 @@ async function stabilizeManagedContent(result2, execute, writeProjectFile) {
         "x",
         "oxfmt",
         "--write",
-        `--config=${join28(result2.plan.projectDirectory, ".oxfmtrc.json")}`,
+        `--config=${join30(result2.plan.projectDirectory, ".oxfmtrc.json")}`,
         ...stagedPaths.slice(offset, offset + 80)
       ], result2.plan.projectDirectory);
     }
     const hashes = plannedContentHashes(result2);
     let formattedGeneration = generationContent;
     for (const [path2, original] of inputs) {
-      const formatted = await readFile23(safeTemporaryPath(temporaryRoot, path2));
+      const formatted = await readFile24(safeTemporaryPath(temporaryRoot, path2));
       if (path2 === ".windy/generation.json") {
         formattedGeneration = formatted.toString();
         continue;
@@ -10914,8 +11224,8 @@ function safeTemporaryPath(root, path2) {
 }
 
 // src/update/project-quality-verification.ts
-import { readFile as readFile24 } from "fs/promises";
-import { join as join29 } from "path";
+import { readFile as readFile25 } from "fs/promises";
+import { join as join31 } from "path";
 var qualityScriptNames = ["lint", "typecheck", "test", "build"];
 function skippedProjectQualityVerification() {
   return {
@@ -10929,7 +11239,7 @@ function skippedProjectQualityVerification() {
   };
 }
 async function runProjectQualityVerification(projectDirectory, execute) {
-  const packageJson = JSON.parse(await readFile24(join29(projectDirectory, "package.json"), "utf8"));
+  const packageJson = JSON.parse(await readFile25(join31(projectDirectory, "package.json"), "utf8"));
   const steps = [];
   for (const name of qualityScriptNames) {
     const stepName = `bun run ${name}`;
@@ -11807,39 +12117,7 @@ async function runLifecycleCommand(args, dependencies = {}) {
       console.log("\u7528\u6CD5\uFF1Acreate-windy sync-docker [--cwd <project-directory>]");
       return true;
     }
-    const plans = await Promise.all(dockerfileCopyTargets.map((target) => planDockerfileInProject(projectDirectory, target, {
-      requireAnchors: true
-    }).then((result2) => ({ target, result: result2 }))));
-    if (plans.some(({ result: result2 }) => !result2.synced)) {
-      throw new Error("\u9879\u76EE\u7F3A\u5C11\u53D7\u652F\u6301\u7684 Dockerfile\uFF0C\u65E0\u6CD5\u540C\u6B65 COPY \u6E05\u5355");
-    }
-    const changed = plans.filter(({ result: result2 }) => result2.changed && result2.content !== undefined);
-    if (changed.length) {
-      const membershipExpectations = plans.flatMap(({ result: result2 }) => result2.membershipExpectations);
-      await assertWorkspaceMembership(projectDirectory, membershipExpectations);
-      const state = await applyMetadataTransaction({
-        id: `sync-docker-${Date.now()}`,
-        projectDirectory,
-        guards: plans.flatMap(({ result: result2 }) => result2.expectations),
-        writes: changed.map(({ target, result: result2 }) => ({
-          path: target.dockerfilePath,
-          content: result2.content
-        }))
-      });
-      await finalizeOwnedTransaction({
-        projectDirectory,
-        ownerToken: state.ownerToken,
-        expectations: changed.map(({ target, result: result2 }) => ({
-          path: target.dockerfilePath,
-          expected: {
-            kind: "hash",
-            value: hashContent(result2.content)
-          }
-        })),
-        workspaceMembershipExpectations: membershipExpectations
-      });
-    }
-    console.log(changed.length ? "\u5DF2\u540C\u6B65 Server \u4E0E Web Dockerfile workspace COPY \u6E05\u5355" : "Server \u4E0E Web Dockerfile workspace COPY \u6E05\u5355\u5DF2\u662F\u6700\u65B0");
+    await synchronizeDockerfiles(projectDirectory);
     return true;
   }
   if (command === "doctor") {
@@ -12038,20 +12316,20 @@ import {
   cp,
   mkdir as mkdir9,
   mkdtemp as mkdtemp4,
-  readFile as readFile26,
+  readFile as readFile27,
   readdir as readdir9,
   rename as rename2,
   rm as rm11,
   writeFile as writeFile14
 } from "fs/promises";
-import { dirname as dirname11, join as join30, relative as relative7 } from "path";
+import { dirname as dirname11, join as join32, relative as relative7 } from "path";
 
 // src/module-schema/config.ts
-import { readFile as readFile25 } from "fs/promises";
+import { readFile as readFile26 } from "fs/promises";
 import { isAbsolute as isAbsolute2, relative as relative6, resolve as resolve9 } from "path";
 async function readModuleSchemaLineageConfig(projectDirectory, configPath) {
   const absolutePath = resolveProjectPath(projectDirectory, configPath);
-  const parsed = JSON.parse(await readFile25(absolutePath, "utf8"));
+  const parsed = JSON.parse(await readFile26(absolutePath, "utf8"));
   if (!isConfig(parsed)) {
     throw new Error("Module schema lineage \u914D\u7F6E\u65E0\u6548");
   }
@@ -12185,17 +12463,17 @@ async function handoffModuleSchemaLineages(options) {
 async function stageModuleLineages(project, temporaryRoot, config, execute) {
   const outputs = [];
   for (const [index, module2] of config.modules.entries()) {
-    const output = join30(temporaryRoot, `module-${index}`);
+    const output = join32(temporaryRoot, `module-${index}`);
     await mkdir9(output, { recursive: true });
-    const generatedConfig = join30(temporaryRoot, `module-${index}.config.ts`);
+    const generatedConfig = join32(temporaryRoot, `module-${index}.config.ts`);
     await writeDrizzleConfig(generatedConfig, project, module2.schema, relative7(temporaryRoot, output));
     await execute(generatedConfig, temporaryRoot);
     const sqlFiles = await listSqlFiles(output);
     if (sqlFiles.length !== 1) {
       throw new Error(`${module2.key} baseline \u5FC5\u987B\u6070\u597D\u751F\u6210\u4E00\u4E2A migration`);
     }
-    await writeFile14(join30(output, sqlFiles[0]), metadataOnlySql("module"));
-    await writeFile14(join30(output, "lineage.json"), `${JSON.stringify({
+    await writeFile14(join32(output, sqlFiles[0]), metadataOnlySql("module"));
+    await writeFile14(join32(output, "lineage.json"), `${JSON.stringify({
       schemaVersion: 1,
       moduleKey: module2.key,
       schema: module2.schema,
@@ -12209,25 +12487,25 @@ async function stageModuleLineages(project, temporaryRoot, config, execute) {
 }
 async function stagePlatformLineage(project, temporaryRoot, config, execute) {
   const source = resolveProjectPath(project, config.platform.out);
-  const output = join30(temporaryRoot, "platform");
+  const output = join32(temporaryRoot, "platform");
   await cp(source, output, { recursive: true });
   const before = new Set(await listSqlFiles(output));
-  const generatedConfig = join30(temporaryRoot, "platform.config.ts");
+  const generatedConfig = join32(temporaryRoot, "platform.config.ts");
   await writeDrizzleConfig(generatedConfig, project, config.platform.schema, relative7(temporaryRoot, output));
   await execute(generatedConfig, temporaryRoot);
   const created = (await listSqlFiles(output)).filter((path2) => !before.has(path2));
   if (created.length !== 1) {
     throw new Error("\u5E73\u53F0 lineage handoff \u5FC5\u987B\u6070\u597D\u751F\u6210\u4E00\u4E2A migration");
   }
-  const sqlPath = join30(output, created[0]);
+  const sqlPath = join32(output, created[0]);
   const allowed = config.modules.flatMap(({ legacyPlatformTables }) => legacyPlatformTables);
-  validatePlatformHandoffSql(await readFile26(sqlPath, "utf8"), allowed);
+  validatePlatformHandoffSql(await readFile27(sqlPath, "utf8"), allowed);
   await writeFile14(sqlPath, metadataOnlySql("platform"));
   return output;
 }
 async function installStagedLineages(project, temporaryRoot, config, stagedModules, stagedPlatform) {
   const platform = resolveProjectPath(project, config.platform.out);
-  const backup = join30(temporaryRoot, "platform-backup");
+  const backup = join32(temporaryRoot, "platform-backup");
   const installed = [];
   await rename2(platform, backup);
   try {
@@ -12274,9 +12552,9 @@ async function validateSchemaSources(project, config) {
   }
 }
 async function createTemporaryRoot(project) {
-  const windy = join30(project, ".windy");
+  const windy = join32(project, ".windy");
   await mkdir9(windy, { recursive: true });
-  return await mkdtemp4(join30(windy, "module-schema-handoff-"));
+  return await mkdtemp4(join32(windy, "module-schema-handoff-"));
 }
 async function listSqlFiles(root) {
   return (await readdir9(root)).filter((path2) => path2.endsWith(".sql")).sort();
@@ -12324,7 +12602,7 @@ import { resolve as resolve14 } from "path";
 
 // src/package-configuration.ts
 import { createHash as createHash5 } from "crypto";
-import { readFile as readFile27 } from "fs/promises";
+import { readFile as readFile28 } from "fs/promises";
 import { isAbsolute as isAbsolute3, normalize, relative as relative8, resolve as resolve11, sep as sep6 } from "path";
 
 // src/package-types.ts
@@ -12348,7 +12626,7 @@ async function readPackageConfiguration(projectDirectory) {
   const path2 = resolve11(projectDirectory, configurationFile);
   let source;
   try {
-    source = await readFile27(path2, "utf8");
+    source = await readFile28(path2, "utf8");
   } catch (error) {
     if (error.code === "ENOENT") {
       throw new Error("\u672A\u58F0\u660E\u6253\u5305\u9002\u914D\u5668\uFF1A\u9879\u76EE\u6839\u76EE\u5F55\u7F3A\u5C11 windy.build.json", {
@@ -12679,7 +12957,7 @@ function failed(sourceRevision, diagnostic, artifacts2 = []) {
 }
 
 // src/package-plan.ts
-import { readFile as readFile28, realpath as realpath3, writeFile as writeFile15 } from "fs/promises";
+import { readFile as readFile29, realpath as realpath3, writeFile as writeFile15 } from "fs/promises";
 import { dirname as dirname12, relative as relative10, resolve as resolve13 } from "path";
 function resolvePackageProfile(configuration, profileKey) {
   const profile = configuration.profiles.find(({ key }) => key === profileKey);
@@ -12759,7 +13037,7 @@ function assertFrozenPlanCurrent(input) {
 }
 async function readFrozenPackagePlan(path2) {
   try {
-    return parseFrozenPackagePlan(JSON.parse(await readFile28(path2, "utf8")));
+    return parseFrozenPackagePlan(JSON.parse(await readFile29(path2, "utf8")));
   } catch (error) {
     if (error instanceof Error && error.message.startsWith("\u51BB\u7ED3\u6253\u5305\u8BA1\u5212"))
       throw error;