dsh-miloco-bridge 0.0.0-stage → 0.1.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 dsh-miloco-bridge contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/NOTICE

@@ -0,0 +1,37 @@
+dsh-miloco-bridge
+=================
+
+This repository is an independent, unofficial integration between
+DeepSeek Harness (DSH) and Xiaomi Miloco.
+
+What this repository contains
+-----------------------------
+- Original Node.js/JavaScript code for a native DSH plugin.
+- Original Chinese Skill documents written for this plugin. They describe how
+  to use this plugin's own tools; they are not copies of Xiaomi Miloco's
+  Skill documents.
+- An original, duck-typed `agent_platform` adapter that talks to DSH's HTTP
+  webhook. It does not import or vendor Xiaomi Miloco backend code.
+
+What this repository does NOT contain
+-------------------------------------
+- No Xiaomi Miloco source code, binaries, model files, dashboard assets, or
+  documentation is redistributed here.
+- No Xiaomi logo or other trademark is used to endorse this project.
+
+Third-party project
+-------------------
+Xiaomi Miloco is a separate project owned by Xiaomi Corporation and governed
+by its own license:
+  https://github.com/XiaoMi/xiaomi-miloco
+
+The optional "one-click deploy" feature clones and installs Xiaomi Miloco at
+runtime from its official repository, on the user's own machine, after the
+user explicitly clicks the button. The user is responsible for reviewing and
+complying with Xiaomi Miloco's license and with the terms applicable to any
+Xiaomi account, device, or API used with it.
+
+"Xiaomi", "Mi Home", "Mijia", and "Miloco" are trademarks or product names of
+Xiaomi Corporation and/or its affiliates. They are used here only to describe
+interoperability. This project is not affiliated with, endorsed by, or
+sponsored by Xiaomi.

package/README.md

@@ -1,3 +1,123 @@
-# Temporary Holding Version
+# dsh-miloco-bridge
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+**一个把 Xiaomi Miloco 接入 DeepSeek Harness (DSH) 的桥接插件：用专用 Agent 预设隔离 Miloco 产生的工具，避免干扰其他对话/项目，同时兼容 Miloco 的主动推送能力。**
+
+[![npm](https://img.shields.io/npm/v/dsh-miloco-bridge)](https://www.npmjs.com/package/dsh-miloco-bridge)
+[![license](https://img.shields.io/github/license/exa160/dsh-miloco-bridge)](LICENSE)
+[![dsh-plugin](https://img.shields.io/badge/topic-dsh--plugin-blue)](https://github.com/topics/dsh-plugin)
+
+> 非官方项目，与小米无隶属关系；非网页版，是运行在 DSH Web profile 里的原生插件。
+> Miloco 是独立项目，受其自身许可证约束，见 [NOTICE](NOTICE)。
+
+## 截图
+
+| Agent 预设 | Miloco 配置页 |
+|---|---|
+| ![Agent 预设](https://raw.githubusercontent.com/exa160/dsh-miloco-bridge/main/docs/images/agent-presets.png) | ![Miloco 配置页](https://raw.githubusercontent.com/exa160/dsh-miloco-bridge/main/docs/images/miloco-settings.png) |
+
+> 截图使用演示数据；真实账号、内网地址与 token 用量已脱敏。
+
+## 它解决什么问题
+
+- **Agent 隔离**：56 个 Miloco 工具和 18 个 Skill 只挂在专用预设「Miloco 家庭助手」上。
+  普通对话看不到 `miloco_*` 工具，也不会被注入 Miloco 技能。
+- **完整能力**：设备、场景、感知、规则、任务、身份、宠物、家庭档案、通知、token 用量。
+- **推送闭环**：Miloco 的感知事件、规则触发、任务到期可以主动推送到 DSH 会话。
+- **感知过滤**：按 `low / medium / high` 事件优先级过滤，低于阈值的感知建议不产生 DSH turn。
+- **可视化配置**：账号/设备/token 概览、推送目标、感知等级、运行模式、连接与卸载都在
+  「设置 → 插件 → Miloco」里完成。
+- **可独立安装**：没有 Miloco 也能装插件；之后可在 UI 一键部署或连接已有实例。
+
+## 安装
+
+### 从 npm 安装（推荐）
+
+```bash
+dsh plugin --profile web add dsh-miloco-bridge
+```
+
+> npm 新包可能处于审核期；若上述命令暂时 404，请使用下面的源码安装。
+
+### 源码安装（npm 审核期 / 未发布时）
+
+```bash
+dsh plugin --profile web add github:exa160/dsh-miloco-bridge
+```
+
+### 从 bundle / 本地安装
+
+```bash
+# 发布包
+dsh plugin --profile web add file:dist/dsh-miloco-bridge-0.1.1.tgz
+
+# 本地开发（link）
+./install.sh --profile web
+```
+
+### Miloco 侧 adapter
+
+如果已安装 Miloco，`install.sh` 会自动安装 adapter、写入连接与推送令牌。
+手动步骤、systemd、升级与卸载见 [docs/INSTALL.md](docs/INSTALL.md)。
+
+安装后重启 DSH：
+
+```bash
+systemctl --user restart dsh-web.service
+```
+
+## 快速开始
+
+1. 打开 DSH WebUI →「设置 → 插件 → Miloco」。
+2. 没有 Miloco：点「一键部署 Miloco」；已有实例：点「连接已有的 Miloco」。
+3. 新建会话时选择 **「Miloco 家庭助手」**。
+4. 在设置页选择运行模式（只读 / 管家）、推送会话、可选模型与感知等级。
+5. 想收 Miloco 主动推送时，确认 Miloco 的 `agent.platform=dsh`，并使用同一枚 Bearer token。
+
+## 权限与风险
+
+- 写入 `$DSH_HOME`（配置、状态、可选部署源码）和 `$MILOCO_HOME`（adapter）。
+- 访问 Miloco HTTP API（默认 `127.0.0.1:1810`，也可配置局域网地址）。
+- 「一键部署」会运行上游 Miloco 安装器，可能安装 Python 依赖并占用磁盘。
+- **默认只读**：写工具不注册；切换到管家模式后才会暴露设备控制、规则/任务创建等能力。
+- 插件不包含遥测，不内置任何账号或 token；推送入口无令牌时 fail closed。
+
+## 兼容性
+
+- DSH：`0.2.1-rc.4` 实测通过；建议 `>= 0.2.1-rc.4`。
+- Node.js：`>= 22`。
+- Miloco：2.0 HTTP API（`/api/*`，`/api/admin/status`、`/api/perception/*` 等）。
+- 平台：Linux / macOS；Web profile（`dsh --profile web`）。
+
+## 文档索引
+
+| 文档 | 内容 |
+|---|---|
+| [docs/INSTALL.md](docs/INSTALL.md) | 安装、连接、adapter、systemd、升级/卸载、排错 |
+| [docs/VERIFICATION.md](docs/VERIFICATION.md) | 离线测试、真实 DSH/Miloco 验证、推送与过滤验证 |
+| [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md) | 双半架构、路由、配置层、状态文件、推送协议 |
+| [docs/SKILL-REWRITES.md](docs/SKILL-REWRITES.md) | 为什么重写 18 个 Skill、改了什么、合规边界 |
+| [docs/TOOLS.md](docs/TOOLS.md) | 56 个工具的参数与语义 |
+| [SECURITY.md](SECURITY.md) | 安全边界与漏洞报告 |
+
+## 开发
+
+```bash
+npm test                 # 65 项测试
+npm run selftest         # 离线自检
+npm run verify:readonly  # 真实 Miloco 只读接口
+npm run pack:bundle      # 生成 dist/*.tgz
+./install.sh --check     # 安装环境检查
+```
+
+## DSH Plugin 市场信息
+
+- 能力分类：**集成与连接**
+- 安装命令：`dsh plugin --profile web add dsh-miloco-bridge`
+- GitHub topic：`dsh-plugin`
+- 许可证：MIT
+- 插件导出：`apply(ctx)`；根目录包含 `package.json`
+
+## 许可证
+
+MIT。Xiaomi Miloco 的名称、接口与商标归小米所有；本仓库不包含上游源码、Skill 原文、
+模型或面板资源。详见 [LICENSE](LICENSE) 与 [NOTICE](NOTICE)。

package/SECURITY.md

@@ -0,0 +1,33 @@
+# Security
+
+## Reporting
+
+Open a private security advisory on the repository host, or contact the
+maintainers directly. Do not file a public issue for a vulnerability that can
+control devices, leak tokens, or reach a private camera stream.
+
+## Design boundaries
+
+- **Default read-only.** Write tools are not registered while the plugin runs
+  in `readonly` mode. There is no runtime "hidden tool" that the model could
+  still call.
+- **Webhook fail-closed.** `/miloco/webhook` rejects every request when no
+  push token is configured.
+- **Token storage.** Connection and push tokens live in
+  `$DSH_HOME/miloco-plugin.json` with mode `0600`; they are never returned to
+  the browser.
+- **Same-origin writes.** Settings mutations reject cross-site `Origin`
+  headers.
+- **No secrets in the repository.** The project ships no credentials, device
+  ids, or Xiaomi account data.
+- **No shell interpolation in deployment.** The deployer uses
+  `spawn(command, args)`; the repository URL must be `https://`.
+
+## Operational guidance
+
+- Prefer a dedicated Miloco backend token, not your Xiaomi account password.
+- Do not expose the DSH Web UI or `/miloco/webhook` directly to the public
+  internet; put them behind a trusted reverse proxy/VPN and TLS.
+- Review Miloco's own security model before enabling camera perception.
+- Treat model-generated device actions as untrusted: confirm high-risk actions
+  (locks, gas, cameras, member deletion) in the UI.

package/adapter/dsh_adapter.py

@@ -0,0 +1,399 @@
+"""DSH agent_platform adapter for Xiaomi Miloco.
+
+Miloco loads this file from ``$MILOCO_HOME/agent_platform/dsh/adapter.py`` and
+calls it with duck-typed turn contexts. It does not import Miloco internals:
+the only optional import is the public ``AdapterTransportError`` class when
+running inside the backend process, so the dispatcher can classify transport
+failures. Standalone use falls back to a local class with the same name.
+
+Configuration is read from ``$MILOCO_HOME/agent_platform/dsh/config.yaml``
+(flat ``key: value`` lines) or environment variables:
+
+    webhook_url: "http://127.0.0.1:3080/miloco/webhook"
+    auth_bearer: "same token as the DSH plugin push token"
+    include_home_profile: true
+    home_profile_max_chars: 4000
+    # optional explicit backend endpoint for reading the rendered profile
+    backend_url: "http://127.0.0.1:1810"
+    backend_token: "..."
+
+Environment overrides:
+
+    DSH_MILOCO_WEBHOOK_URL
+    DSH_MILOCO_WEBHOOK_TOKEN
+    DSH_MILOCO_INCLUDE_HOME_PROFILE
+    DSH_MILOCO_BACKEND_URL
+    DSH_MILOCO_BACKEND_TOKEN
+
+The protocol is the one Miloco already uses for webhook agents::
+
+    POST {webhook_url}
+    {"action": "agent", "payload": {
+        "message": "...", "sessionKey": "...", "lane": "...",
+        "traceId": "...", "idempotencyKey": "...", "timeoutMs": 120000,
+        "urgency": "high|medium|low"
+    }}
+
+DSH replies ``{"code": 0, "data": {runId, status, sessionId, reply}}``.
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+import os
+import re
+import time
+from pathlib import Path
+from types import SimpleNamespace
+from typing import Any, Optional
+
+try:  # Available when this adapter runs inside the Miloco backend.
+    from miloco.agent_platform.base import AdapterTransportError
+except Exception:  # pragma: no cover - standalone / tests
+    class AdapterTransportError(Exception):
+        """Transport-level failure (connect, timeout, 5xx)."""
+
+
+try:
+    import httpx
+except ImportError:  # pragma: no cover - dependency is provided by backend
+    httpx = None  # type: ignore[assignment]
+
+logger = logging.getLogger(__name__)
+
+_HTTP_BUFFER_S = 20.0
+_DEFAULT_WAIT_MS = 120_000
+_URGENCY_RE = re.compile(r"(?:事件优先级|urgency)\s*[：:=]\s*(high|medium|low|ignore)", re.I)
+_URGENCY_RANK = {"low": 1, "medium": 2, "high": 3}
+
+
+def _extract_urgency(text: str) -> str:
+    """Return the highest urgency mentioned by a perception event batch.
+
+    Miloco's event text uses ``事件优先级：high|medium|low``. A batch may
+    contain several suggestions; the highest one decides the batch priority.
+    Returns an empty string for non-perception events (rules/tasks/etc.).
+    """
+    best = ""
+    best_rank = 0
+    saw_ignore = False
+    for match in _URGENCY_RE.finditer(text or ""):
+        value = match.group(1).lower()
+        if value == "ignore":
+            saw_ignore = True
+            continue
+        rank = _URGENCY_RANK.get(value, 0)
+        if rank > best_rank:
+            best = value
+            best_rank = rank
+    return best or ("ignore" if saw_ignore else "")
+
+
+def _miloco_home() -> Path:
+    raw = os.environ.get("MILOCO_HOME", "").strip()
+    return Path(raw).expanduser() if raw else Path.home() / ".miloco"
+
+
+def _read_flat_yaml(path: Path) -> dict[str, str]:
+    """Read simple ``key: value`` YAML without adding a dependency."""
+    data: dict[str, str] = {}
+    try:
+        text = path.read_text(encoding="utf-8")
+    except OSError:
+        return data
+    for raw_line in text.splitlines():
+        line = raw_line.strip()
+        if not line or line.startswith("#") or ":" not in line:
+            continue
+        key, _, value = line.partition(":")
+        value = value.strip()
+        if len(value) >= 2 and value[0] == value[-1] and value[0] in ("'", '"'):
+            value = value[1:-1]
+        data[key.strip()] = value
+    return data
+
+
+def _truthy(value: Any, default: bool = True) -> bool:
+    if value is None or value == "":
+        return default
+    return str(value).strip().lower() not in ("0", "false", "no", "off")
+
+
+def _read_backend_connection() -> tuple[str, str]:
+    """Read Miloco's own server URL/token from ``$MILOCO_HOME/config.json``."""
+    try:
+        payload = json.loads((_miloco_home() / "config.json").read_text(encoding="utf-8"))
+    except (OSError, ValueError):
+        return "", ""
+    server = payload.get("server") if isinstance(payload, dict) else {}
+    if not isinstance(server, dict):
+        return "", ""
+    url = str(server.get("url") or "").strip()
+    if not url:
+        host = str(server.get("host") or "127.0.0.1")
+        port = str(server.get("port") or "1810")
+        url = f"http://{host}:{port}"
+    return url.rstrip("/"), str(server.get("token") or "").strip()
+
+
+class Adapter:
+    """Deliver Miloco turns into DeepSeek Harness."""
+
+    name = "dsh"
+
+    def __init__(self) -> None:
+        config = _read_flat_yaml(_miloco_home() / "agent_platform" / "dsh" / "config.yaml")
+        self.webhook_url = str(
+            os.environ.get("DSH_MILOCO_WEBHOOK_URL")
+            or config.get("webhook_url")
+            or "http://127.0.0.1:3080/miloco/webhook"
+        ).strip()
+        self.auth_bearer = str(
+            os.environ.get("DSH_MILOCO_WEBHOOK_TOKEN")
+            or config.get("auth_bearer")
+            or ""
+        ).strip()
+        self.include_home_profile = _truthy(
+            os.environ.get("DSH_MILOCO_INCLUDE_HOME_PROFILE", config.get("include_home_profile")),
+            default=True,
+        )
+        try:
+            self.home_profile_max_chars = int(config.get("home_profile_max_chars", "4000"))
+        except (TypeError, ValueError):
+            self.home_profile_max_chars = 4000
+
+        default_backend_url, default_backend_token = _read_backend_connection()
+        self.backend_url = str(
+            os.environ.get("DSH_MILOCO_BACKEND_URL")
+            or config.get("backend_url")
+            or default_backend_url
+        ).strip().rstrip("/")
+        self.backend_token = str(
+            os.environ.get("DSH_MILOCO_BACKEND_TOKEN")
+            or config.get("backend_token")
+            or default_backend_token
+        ).strip()
+
+        self._client: Optional[Any] = None
+        self._profile_cache: Optional[tuple[float, str]] = None
+
+    # ------------------------------------------------------------------ HTTP
+
+    def _http(self) -> Any:
+        if httpx is None:
+            raise AdapterTransportError("httpx is not available; cannot reach DSH")
+        if self._client is None:
+            self._client = httpx.AsyncClient(timeout=180.0)
+        return self._client
+
+    async def aclose(self) -> None:
+        if self._client is not None:
+            try:
+                await self._client.aclose()
+            finally:
+                self._client = None
+
+    # --------------------------------------------------------------- profile
+
+    def build_system(self, profile: str, extra: dict[str, Any]) -> str:
+        """Return the optional home-profile block prepended to the message.
+
+        DSH has no public "replace system prompt per turn" hook, so the block
+        travels as part of the message text and is clearly delimited. It is
+        omitted for lightweight profiles (``minimal`` / ``rule`` /
+        ``suggestion``) to save tokens.
+        """
+        if not self.include_home_profile or profile in ("minimal", "rule", "suggestion"):
+            return ""
+        rendered = self._load_home_profile()
+        if not rendered:
+            return ""
+        return (
+            "【家庭档案 · 由 Miloco 注入】\n"
+            f"{rendered}\n"
+            "【以上为家庭档案】\n\n"
+        )
+
+    def _load_home_profile(self) -> str:
+        now = time.monotonic()
+        if self._profile_cache is not None and now - self._profile_cache[0] < 300:
+            return self._profile_cache[1]
+        text = self._fetch_home_profile()
+        self._profile_cache = (now, text)
+        return text
+
+    def _fetch_home_profile(self) -> str:
+        if httpx is None or not self.backend_url:
+            return ""
+        headers = {"accept": "application/json"}
+        if self.backend_token:
+            headers["authorization"] = f"Bearer {self.backend_token}"
+        try:
+            response = httpx.get(
+                f"{self.backend_url}/api/home-profile/rendered",
+                headers=headers,
+                timeout=10.0,
+            )
+            if response.status_code >= 400:
+                return ""
+            payload = response.json()
+        except Exception as exc:  # noqa: BLE001 - profile injection is best effort
+            logger.debug("dsh adapter: home profile unavailable: %s", exc)
+            return ""
+
+        data = payload.get("data") if isinstance(payload, dict) else payload
+        if isinstance(data, str):
+            rendered = data
+        elif isinstance(data, dict):
+            rendered = (
+                data.get("markdown")
+                or data.get("rendered")
+                or data.get("text")
+                or ""
+            )
+            if not rendered:
+                rendered = json.dumps(data, ensure_ascii=False)
+        else:
+            rendered = ""
+        rendered = str(rendered).strip()
+        if len(rendered) > self.home_profile_max_chars:
+            rendered = rendered[: self.home_profile_max_chars] + "\n…（已截断）"
+        return rendered
+
+    # ------------------------------------------------------------------ turn
+
+    async def send_turn(self, ctx: Any) -> Any:
+        """Deliver one turn to DSH and wait for its completion."""
+        client = self._http()
+
+        text = getattr(ctx, "text", "") or ""
+        session_key = getattr(ctx, "session_key", "") or ""
+        lane = getattr(ctx, "lane", "") or ""
+        trace_id = getattr(ctx, "trace_id", "") or ""
+        wait_timeout_ms = int(getattr(ctx, "wait_timeout_ms", _DEFAULT_WAIT_MS) or _DEFAULT_WAIT_MS)
+        profile = getattr(ctx, "profile", "full") or "full"
+        extra = getattr(ctx, "extra", {}) or {}
+
+        system_block = ""
+        try:
+            system_block = self.build_system(profile, extra)
+        except Exception as exc:  # noqa: BLE001
+            logger.warning("dsh adapter: build_system failed: %s", exc)
+
+        payload: dict[str, Any] = {
+            "message": f"{system_block}{text}" if system_block else text,
+            "sessionKey": session_key,
+            "lane": lane,
+            "traceId": trace_id,
+            "idempotencyKey": trace_id,
+            "timeoutMs": wait_timeout_ms,
+        }
+        urgency = _extract_urgency(text)
+        if urgency:
+            payload["urgency"] = urgency
+        delivery = extra.get("delivery") or {}
+        if isinstance(delivery, dict):
+            for key in ("deliver", "resolveTarget", "lightContext"):
+                if delivery.get(key) is not None:
+                    payload[key] = delivery[key]
+
+        headers = {"content-type": "application/json"}
+        if self.auth_bearer:
+            headers["authorization"] = f"Bearer {self.auth_bearer}"
+
+        started = time.monotonic()
+        timeout_s = wait_timeout_ms / 1000 + _HTTP_BUFFER_S
+        try:
+            response = await client.post(
+                self.webhook_url,
+                json={"action": "agent", "payload": payload},
+                headers=headers,
+                timeout=timeout_s,
+            )
+        except Exception as exc:  # noqa: BLE001 - classified as transport
+            raise AdapterTransportError(f"DSH webhook request failed: {exc}") from exc
+
+        rtt_ms = (time.monotonic() - started) * 1000
+        if response.status_code >= 400:
+            body = response.text[:300]
+            raise AdapterTransportError(f"DSH webhook HTTP {response.status_code}: {body}")
+
+        try:
+            body = response.json()
+        except ValueError as exc:
+            raise AdapterTransportError(f"DSH webhook returned non-JSON: {response.text[:200]}") from exc
+
+        code = body.get("code", -1) if isinstance(body, dict) else -1
+        if code != 0:
+            message = body.get("message", "unknown error") if isinstance(body, dict) else "unknown error"
+            logger.warning("dsh adapter: webhook error code=%s message=%s", code, message)
+            return SimpleNamespace(
+                run_id=None,
+                status="error",
+                rtt_ms=rtt_ms,
+                recovered=None,
+                error=str(message),
+                reply=None,
+                session_id=None,
+            )
+
+        data = body.get("data") if isinstance(body, dict) else None
+        data = data if isinstance(data, dict) else {}
+        status = data.get("status", "ok")
+        if status not in ("ok", "timeout", "error"):
+            status = "ok"
+        return SimpleNamespace(
+            run_id=data.get("runId"),
+            status=status,
+            rtt_ms=rtt_ms,
+            recovered=data.get("recovered"),
+            error=data.get("error"),
+            reply=data.get("reply"),
+            session_id=data.get("sessionId"),
+        )
+
+    # ----------------------------------------------------------------- trace
+
+    async def read_trace_meta(self, run_id: str) -> Optional[Any]:
+        """DSH keeps turn metadata in memory, not as a trace file."""
+        return None
+
+    # ----------------------------------------------------------------- reset
+
+    async def reset_sessions(self, routes: list[Any], *, timeout: float = 10.0) -> Optional[Any]:
+        """Ask DSH to forget the sessions tied to Miloco session keys."""
+        if not routes or not self.webhook_url:
+            return None
+        keys = []
+        for item in routes:
+            if isinstance(item, str):
+                keys.append(item)
+            elif isinstance(item, (tuple, list)) and item:
+                keys.append(str(item[0]))
+            else:
+                value = getattr(item, "session_key", None)
+                if value:
+                    keys.append(str(value))
+        keys = sorted(set(keys))
+        if not keys:
+            return None
+
+        headers = {"content-type": "application/json"}
+        if self.auth_bearer:
+            headers["authorization"] = f"Bearer {self.auth_bearer}"
+        try:
+            client = self._http()
+            response = await client.post(
+                self.webhook_url,
+                json={
+                    "action": "reset_sessions",
+                    "payload": {"sessionKeys": keys, "deleteTranscript": True},
+                },
+                headers=headers,
+                timeout=timeout,
+            )
+            return response.json()
+        except Exception as exc:  # noqa: BLE001 - cleanup is best effort
+            logger.warning("dsh adapter: reset_sessions failed: %s", exc)
+            return None