hiwork-core 0.0.35 → 0.0.38

package/lib/index.js

@@ -8267,7 +8267,7 @@ defineMethod("transform", [
 ], ({ inner }, isInner) => inner.toString(isInner));
 
 // src/version.ts
-var PKG_VERSION = false ? "dev" : "0.0.35";
+var PKG_VERSION = false ? "dev" : "0.0.38";
 
 // src/browser-login.ts
 import { createHash, randomBytes, randomUUID } from "node:crypto";
@@ -8549,21 +8549,28 @@ async function startBrowserLogin(opts) {
   }
   return { authorizeUrl, state };
 }
-async function failBrowserLogin(state, loginError) {
-  await state.patch({
-    set: { lastError: loginError },
-    unset: ["browserLoginRequest", "browserLogin"]
-  }).catch(() => {
-  });
+async function failBrowserLogin(state, loginError, log) {
+  try {
+    await state.patch({
+      set: { lastError: loginError },
+      unset: ["browserLoginRequest", "browserLogin"]
+    });
+  } catch (error) {
+    log(`hiwork-core: \u6D4F\u89C8\u5668\u6388\u6743\u5931\u8D25\u6001\u5199\u56DE\u88AB\u62D2\uFF0C\u754C\u9762\u53EF\u80FD\u505C\u5728\u300C\u7B49\u5F85\u5B8C\u6210\u6388\u6743\u300D\uFF08${error instanceof Error ? error.message : typeof error}\uFF09`);
+  }
   return loginError;
 }
 async function reconcileStaleBrowserLogin(state, value) {
-  if (value.browserLogin === void 0) return;
-  await state.patch({
-    set: { lastError: { code: "AUTH_FAILED", message: "\u4E0A\u6B21\u6D4F\u89C8\u5668\u6388\u6743\u672A\u5B8C\u6210\uFF0C\u8BF7\u91CD\u65B0\u767B\u5F55" } },
-    unset: ["browserLoginRequest", "browserLogin"]
-  }).catch(() => {
-  });
+  if (value.browserLogin === void 0) return true;
+  try {
+    await state.patch({
+      set: { lastError: { code: "AUTH_FAILED", message: "\u4E0A\u6B21\u6D4F\u89C8\u5668\u6388\u6743\u672A\u5B8C\u6210\uFF0C\u8BF7\u91CD\u65B0\u767B\u5F55" } },
+      unset: ["browserLoginRequest", "browserLogin"]
+    });
+    return true;
+  } catch {
+    return false;
+  }
 }
 async function completeBrowserLogin(input, opts) {
   const now = opts.now ?? Date.now;
@@ -8581,18 +8588,18 @@ async function completeBrowserLogin(input, opts) {
   try {
     if (now() - pending.startedAt > BROWSER_LOGIN_TTL_MS) {
       log("hiwork-core: \u6D4F\u89C8\u5668\u6388\u6743\u56DE\u8C03\u5DF2\u8D85\u65F6\uFF08\u8D85\u8FC7 10 \u5206\u949F\uFF09\uFF0C\u5DF2\u62D2\u7EDD");
-      return await failBrowserLogin(opts.state, { code: "AUTH_FAILED", message: "\u6388\u6743\u5DF2\u8D85\u65F6\uFF0C\u8BF7\u91CD\u65B0\u767B\u5F55" });
+      return await failBrowserLogin(opts.state, { code: "AUTH_FAILED", message: "\u6388\u6743\u5DF2\u8D85\u65F6\uFF0C\u8BF7\u91CD\u65B0\u767B\u5F55" }, log);
     }
     if (typeof input.error === "string" && input.error !== "") {
       log(`hiwork-core: \u6D4F\u89C8\u5668\u6388\u6743\u88AB\u62D2\u7EDD\uFF08${input.error.slice(0, 64)}\uFF09`);
-      return await failBrowserLogin(opts.state, { code: "AUTH_FAILED", message: "\u6388\u6743\u88AB\u53D6\u6D88\u6216\u5931\u8D25\uFF0C\u8BF7\u91CD\u65B0\u767B\u5F55" });
+      return await failBrowserLogin(opts.state, { code: "AUTH_FAILED", message: "\u6388\u6743\u88AB\u53D6\u6D88\u6216\u5931\u8D25\uFF0C\u8BF7\u91CD\u65B0\u767B\u5F55" }, log);
     }
     if (typeof input.code !== "string" || input.code === "") {
       log("hiwork-core: \u6D4F\u89C8\u5668\u6388\u6743\u56DE\u8C03\u7F3A\u5C11 code\uFF0C\u5DF2\u4E22\u5F03");
-      return await failBrowserLogin(opts.state, { code: "AUTH_FAILED", message: "\u6388\u6743\u56DE\u8C03\u4E0D\u5B8C\u6574\uFF0C\u8BF7\u91CD\u65B0\u767B\u5F55" });
+      return await failBrowserLogin(opts.state, { code: "AUTH_FAILED", message: "\u6388\u6743\u56DE\u8C03\u4E0D\u5B8C\u6574\uFF0C\u8BF7\u91CD\u65B0\u767B\u5F55" }, log);
     }
     const baseURL = opts.value.baseURL;
-    if (baseURL === void 0 || baseURL === "") return await failBrowserLogin(opts.state, NO_BASE_URL_ERROR);
+    if (baseURL === void 0 || baseURL === "") return await failBrowserLogin(opts.state, NO_BASE_URL_ERROR, log);
     const { sessionCookie, user } = await opts.gateway.exchangeCode({
       code: input.code,
       codeVerifier: pending.codeVerifier,
@@ -8617,7 +8624,7 @@ async function completeBrowserLogin(input, opts) {
     return null;
   } catch (error) {
     const loginError = toLoginError(error, "\u65E0\u6CD5\u8FDE\u63A5\u7F51\u5173\uFF0C\u8BF7\u68C0\u67E5 baseURL \u6216\u7F51\u7EDC");
-    return await failBrowserLogin(opts.state, loginError);
+    return await failBrowserLogin(opts.state, loginError, log);
   } finally {
     pendingAuth = void 0;
   }
@@ -12483,7 +12490,7 @@ var Service = class Service2 {
   }
 };
 
-// node_modules/.pnpm/@deepseek-ai+dsh-scope@0.1.7-rc.2_@deepseek-ai+cordis@4.0.4_@deepseek-ai+dsh-invariants_0271d3a82adfe807020938592f267574/node_modules/@deepseek-ai/dsh-scope/lib/index.js
+// node_modules/.pnpm/@deepseek-ai+dsh-scope@0.2.0-rc.1_@deepseek-ai+cordis@4.0.4_@deepseek-ai+dsh-invariants_8ef32aa4891a716d53102df556bb759f/node_modules/@deepseek-ai/dsh-scope/lib/index.js
 var NamedEntries = class {
   duplicateError;
   data = /* @__PURE__ */ new Map();
@@ -12699,10 +12706,10 @@ function scopeTarget(base, key) {
   return carrier;
 }
 
-// node_modules/.pnpm/@deepseek-ai+dsh-llm@0.1.7-rc.2_@deepseek-ai+cordis@4.0.4/node_modules/@deepseek-ai/dsh-llm/lib/index.js
+// node_modules/.pnpm/@deepseek-ai+dsh-llm@0.2.0-rc.1_@deepseek-ai+cordis@4.0.4/node_modules/@deepseek-ai/dsh-llm/lib/index.js
 import { createRequire } from "node:module";
 
-// node_modules/.pnpm/@deepseek-ai+dsh-typert-protocol@0.1.7-rc.2_@deepseek-ai+cordis@4.0.4/node_modules/@deepseek-ai/dsh-typert-protocol/lib/index.js
+// node_modules/.pnpm/@deepseek-ai+dsh-typert-protocol@0.2.0-rc.1_@deepseek-ai+cordis@4.0.4/node_modules/@deepseek-ai/dsh-typert-protocol/lib/index.js
 var RemoteError = class extends Error {
   code;
   details;
@@ -12827,7 +12834,7 @@ function validateName(subject, value) {
   if (!isTypertRemoteSegment(value)) throw new TypeError(`typert-protocol: ${subject} must contain only RPC endpoint segment characters`);
 }
 
-// node_modules/.pnpm/@deepseek-ai+dsh-util-values@0.1.7-rc.2_@deepseek-ai+cordis@4.0.4/node_modules/@deepseek-ai/dsh-util-values/lib/index.js
+// node_modules/.pnpm/@deepseek-ai+dsh-util-values@0.2.0-rc.1_@deepseek-ai+cordis@4.0.4/node_modules/@deepseek-ai/dsh-util-values/lib/index.js
 function assertNever(value, context) {
   const rendered = JSON.stringify(value) ?? String(value);
   throw new Error(`unreachable variant${context ? ` in ${context}` : ""}: ${rendered}`);
@@ -12836,7 +12843,7 @@ function hasIntrinsicConstructor(prototype, name2) {
   const constructor = Object.getOwnPropertyDescriptor(prototype, "constructor")?.value;
   if (typeof constructor !== "function") return false;
   try {
-    return constructor.name === name2 && constructor.prototype === prototype && Function.prototype.toString.call(constructor) === `function ${name2}() { [native code] }`;
+    return constructor.name === name2 && constructor.prototype === prototype && Function.prototype.toString.call(constructor) === Function.prototype.toString.call(name2 === "Array" ? Array : Object);
   } catch {
     return false;
   }
@@ -13008,7 +13015,7 @@ function deepFreeze(value) {
   return value;
 }
 
-// node_modules/.pnpm/@deepseek-ai+dsh-util-crypto@0.1.7-rc.2_@deepseek-ai+cordis@4.0.4/node_modules/@deepseek-ai/dsh-util-crypto/lib/index.js
+// node_modules/.pnpm/@deepseek-ai+dsh-util-crypto@0.2.0-rc.1_@deepseek-ai+cordis@4.0.4/node_modules/@deepseek-ai/dsh-util-crypto/lib/index.js
 function randomUUID2() {
   const bytes = globalThis.crypto.getRandomValues(new Uint8Array(16));
   const hex = Array.from(bytes, (byte, index) => {
@@ -13017,15 +13024,15 @@ function randomUUID2() {
   return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
 }
 
-// node_modules/.pnpm/@deepseek-ai+dsh-brand@0.1.7-rc.2_@deepseek-ai+cordis@4.0.4/node_modules/@deepseek-ai/dsh-brand/lib/index.js
+// node_modules/.pnpm/@deepseek-ai+dsh-brand@0.2.0-rc.1_@deepseek-ai+cordis@4.0.4/node_modules/@deepseek-ai/dsh-brand/lib/index.js
 function brandString(value) {
   return value;
 }
 
-// node_modules/.pnpm/@deepseek-ai+dsh-timeout@0.1.7-rc.2_@deepseek-ai+cordis@4.0.4/node_modules/@deepseek-ai/dsh-timeout/lib/index.js
+// node_modules/.pnpm/@deepseek-ai+dsh-timeout@0.2.0-rc.1_@deepseek-ai+cordis@4.0.4/node_modules/@deepseek-ai/dsh-timeout/lib/index.js
 var MAX_TIMER_DELAY_MS = 2147483647;
 
-// node_modules/.pnpm/@deepseek-ai+dsh-llm@0.1.7-rc.2_@deepseek-ai+cordis@4.0.4/node_modules/@deepseek-ai/dsh-llm/lib/index.js
+// node_modules/.pnpm/@deepseek-ai+dsh-llm@0.2.0-rc.1_@deepseek-ai+cordis@4.0.4/node_modules/@deepseek-ai/dsh-llm/lib/index.js
 function freezeMessage(message) {
   return deepFreeze(structuredClone(message));
 }
@@ -14068,7 +14075,7 @@ function adapterFailureChunk(error, signal) {
   };
 }
 
-// node_modules/.pnpm/@deepseek-ai+dsh-sandbox@0.1.7-rc.2_@deepseek-ai+cordis@4.0.4_@deepseek-ai+dsh-llm@0.1._a8c9906be8c926809212c5fbb3bc7c61/node_modules/@deepseek-ai/dsh-sandbox/lib/index.js
+// node_modules/.pnpm/@deepseek-ai+dsh-sandbox@0.2.0-rc.1_@deepseek-ai+cordis@4.0.4_@deepseek-ai+dsh-llm@0.2._910788faa6d5e8808178f15deb98d164/node_modules/@deepseek-ai/dsh-sandbox/lib/index.js
 var WIDER_MODES = {
   "read-only": ["workspace-write", "danger-full-access"],
   "workspace-write": ["danger-full-access"]
@@ -14110,7 +14117,7 @@ async function approveEscalation(request, approval) {
   }
 }
 
-// node_modules/.pnpm/@deepseek-ai+dsh-tools@0.1.7-rc.2_d2e08270f2205e73d65e98cfcd910cae/node_modules/@deepseek-ai/dsh-tools/lib/index.js
+// node_modules/.pnpm/@deepseek-ai+dsh-tools@0.2.0-rc.1_44958e8f826516598aa7d335d84aa068/node_modules/@deepseek-ai/dsh-tools/lib/index.js
 var JsonSchemaError = class extends HarnessError {
   /** Individual schema violations in walk order. */
   violations;
@@ -19125,6 +19132,42 @@ function provideIdentity(ctx, deps) {
   };
 }
 
+// src/identity-context.ts
+var IDENTITY_CONTEXT_NAME = "hiwork:identity";
+var IDENTITY_CONTEXT_ORDER = 105;
+var CAVEAT = "\u8BE5\u8EAB\u4EFD\u7528\u4E8E\u4E2A\u6027\u5316\u4E0E\u6309\u4EBA\u8868\u8FF0\uFF1B\u6D89\u53CA\u6570\u636E\u6743\u9650\u7684\u64CD\u4F5C\u5FC5\u987B\u8D70\u53D7\u7BA1\u5DE5\u5177/\u8FDE\u63A5\u5668\u5B8C\u6210\uFF0C\u4E0D\u5F97\u628A\u6B64\u6587\u672C\u5F53\u4F5C\u51ED\u8BC1\u3002";
+function textOrUndefined6(value) {
+  if (typeof value !== "string") return void 0;
+  const text = value.trim();
+  return text === "" ? void 0 : text;
+}
+function renderIdentityContextText(state) {
+  const username = textOrUndefined6(state?.username);
+  if (username === void 0) return "";
+  const displayName = textOrUndefined6(state?.displayName);
+  const who = displayName === void 0 ? `\u5DE5\u53F7 ${username}` : `${displayName}\uFF08\u5DE5\u53F7 ${username}\uFF09`;
+  return `HiWork \u767B\u5F55\u8EAB\u4EFD\uFF1A${who}\u3002${CAVEAT}`;
+}
+function registerIdentityContext(systemPrompt, deps) {
+  const dispose = systemPrompt.context({
+    name: IDENTITY_CONTEXT_NAME,
+    order: IDENTITY_CONTEXT_ORDER,
+    text: () => {
+      try {
+        if (!deps.enabled()) return "";
+        return renderIdentityContextText(deps.current());
+      } catch (error) {
+        deps.log?.(
+          `hiwork-core: \u767B\u5F55\u8EAB\u4EFD\u4E0A\u4E0B\u6587\u8BFB\u53D6\u5931\u8D25\uFF08${error instanceof Error ? error.name : typeof error}\uFF09`
+        );
+        return "";
+      }
+    }
+  });
+  return typeof dispose === "function" ? dispose : () => {
+  };
+}
+
 // src/knowledge-config.ts
 var HIWORK_KNOWLEDGE_SERVICE = "hiworkKnowledge";
 var ME_KNOWLEDGE_CONFIG_PATH = "/api/me/knowledge-config";
@@ -19151,22 +19194,22 @@ function messageFor(reason) {
 function failure12(reason, message) {
   return { ok: false, reason, message: message ?? messageFor(reason) };
 }
-function textOrUndefined6(value) {
+function textOrUndefined7(value) {
   if (typeof value !== "string") return void 0;
   const text = value.trim();
   return text === "" ? void 0 : text;
 }
 function projectKnowledgeConfig(body) {
-  const baseUrl = textOrUndefined6(body["base_url"] ?? body["baseUrl"]);
-  const apiKey = textOrUndefined6(body["api_key"] ?? body["apiKey"]);
+  const baseUrl = textOrUndefined7(body["base_url"] ?? body["baseUrl"]);
+  const apiKey = textOrUndefined7(body["api_key"] ?? body["apiKey"]);
   if (baseUrl === void 0 || apiKey === void 0) return void 0;
   return {
     ok: true,
     baseUrl,
     apiKey,
-    agentId: textOrUndefined6(body["agent_id"] ?? body["agentId"]) ?? "",
-    chatModelId: textOrUndefined6(body["chat_model_id"] ?? body["chatModelId"]) ?? "",
-    tenantId: textOrUndefined6(body["tenant_id"] ?? body["tenantId"]) ?? "",
+    agentId: textOrUndefined7(body["agent_id"] ?? body["agentId"]) ?? "",
+    chatModelId: textOrUndefined7(body["chat_model_id"] ?? body["chatModelId"]) ?? "",
+    tenantId: textOrUndefined7(body["tenant_id"] ?? body["tenantId"]) ?? "",
     knowledgeBases: projectKnowledgeBases(body["knowledge_bases"] ?? body["knowledgeBases"])
   };
 }
@@ -19177,10 +19220,10 @@ function projectKnowledgeBases(value) {
   for (const item of value) {
     if (item === null || typeof item !== "object") continue;
     const record = item;
-    const id = textOrUndefined6(record["id"]);
+    const id = textOrUndefined7(record["id"]);
     if (id === void 0 || seen.has(id)) continue;
     seen.add(id);
-    bases.push({ id, name: textOrUndefined6(record["name"]) ?? "" });
+    bases.push({ id, name: textOrUndefined7(record["name"]) ?? "" });
   }
   return bases.length === 0 ? EMPTY_KNOWLEDGE_BASES : bases;
 }
@@ -19236,8 +19279,8 @@ var KnowledgeConfigProvider = class {
       const raw = await gateway.getMyKnowledgeToken(sessionCookie);
       const envelope = raw;
       const body = envelope?.["data"] && typeof envelope["data"] === "object" ? envelope["data"] : envelope;
-      const token = textOrUndefined6(body?.["token"] ?? body?.["knowledge_token"]);
-      const audience = textOrUndefined6(body?.["audience"] ?? body?.["aud"]);
+      const token = textOrUndefined7(body?.["token"] ?? body?.["knowledge_token"]);
+      const audience = textOrUndefined7(body?.["audience"] ?? body?.["aud"]);
       const ids = body?.["knowledge_base_ids"] ?? body?.["knowledgeBaseIds"];
       if (!token || audience !== "hiwork-knowledge" || !Array.isArray(ids) || !ids.every((id) => typeof id === "string")) {
         this.deps.log?.("hiwork-core: \u7F51\u5173\u8FD4\u56DE\u7684 knowledge-token \u5F62\u72B6\u65E0\u6548");
@@ -19248,8 +19291,8 @@ var KnowledgeConfigProvider = class {
       const knowledgeBases = Array.isArray(rawBases) ? rawBases.flatMap((item) => {
         if (item === null || typeof item !== "object") return [];
         const obj = item;
-        const id = textOrUndefined6(obj["id"]);
-        return id ? [{ id, name: textOrUndefined6(obj["name"]) ?? "" }] : [];
+        const id = textOrUndefined7(obj["id"]);
+        return id ? [{ id, name: textOrUndefined7(obj["name"]) ?? "" }] : [];
       }).filter((item) => knowledgeBaseIds.includes(item.id)) : [];
       const view = { ok: true, token, audience, knowledgeBaseIds, knowledgeBases };
       this.tokenCached = { sessionCookie, view, at: this.now() };
@@ -19367,7 +19410,7 @@ function messageFor2(reason) {
 function failure13(reason, message) {
   return { ok: false, reason, message: message ?? messageFor2(reason) };
 }
-function textOrUndefined7(value) {
+function textOrUndefined8(value) {
   if (typeof value !== "string") return void 0;
   const text = value.trim();
   return text === "" ? void 0 : text;
@@ -19376,15 +19419,15 @@ function teamIdsOf(value) {
   if (!Array.isArray(value)) return [];
   const ids = [];
   for (const item of value) {
-    const text = textOrUndefined7(item);
+    const text = textOrUndefined8(item);
     if (text !== void 0) ids.push(text);
   }
   return ids;
 }
 function projectMemoryConfig(body) {
-  const panelUrl = textOrUndefined7(body["panel_url"] ?? body["panelUrl"]);
-  const serviceId = textOrUndefined7(body["service_id"] ?? body["serviceId"]);
-  const apiKey = textOrUndefined7(body["api_key"] ?? body["apiKey"] ?? body["userKey"]);
+  const panelUrl = textOrUndefined8(body["panel_url"] ?? body["panelUrl"]);
+  const serviceId = textOrUndefined8(body["service_id"] ?? body["serviceId"]);
+  const apiKey = textOrUndefined8(body["api_key"] ?? body["apiKey"] ?? body["userKey"]);
   if (panelUrl === void 0 || serviceId === void 0 || apiKey === void 0) return void 0;
   return {
     ok: true,
@@ -19651,7 +19694,7 @@ function provideOfficeRelay(ctx, deps) {
   };
 }
 
-// node_modules/.pnpm/@deepseek-ai+dsh-web@0.1.7-rc.2_@deepseek-ai+cordis@4.0.4_@deepseek-ai+dsh-llm@0.1.7-rc.2_@deepseek-ai+cordis@4.0.4_/node_modules/@deepseek-ai/dsh-web/lib/index.js
+// node_modules/.pnpm/@deepseek-ai+dsh-web@0.2.0-rc.1_@deepseek-ai+cordis@4.0.4_@deepseek-ai+dsh-llm@0.2.0-rc.1_@deepseek-ai+cordis@4.0.4_/node_modules/@deepseek-ai/dsh-web/lib/index.js
 var WebError = class extends HarnessError {
 };
 var WebRuntime = class extends Service {
@@ -19829,7 +19872,7 @@ function httpOutcomeToError(status, code) {
   if (status === 502 || code === "SEARCH_UPSTREAM_ERROR") return new WebError("\u641C\u7D22\u670D\u52A1\u6682\u65F6\u4E0D\u53EF\u7528\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5", HIWORK_SEARCH_UPSTREAM);
   return new WebError("\u8054\u7F51\u641C\u7D22\u6682\u65F6\u4E0D\u53EF\u7528\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5", "WEB_PROVIDER_ERROR");
 }
-function textOrUndefined8(value) {
+function textOrUndefined9(value) {
   if (typeof value !== "string") return void 0;
   const text = value.trim();
   return text === "" ? void 0 : text;
@@ -19841,11 +19884,11 @@ function projectWebSearch(body) {
   for (const item of raw) {
     if (item === null || typeof item !== "object") continue;
     const record = item;
-    const url = textOrUndefined8(record["url"]);
+    const url = textOrUndefined9(record["url"]);
     if (url === void 0) continue;
-    const title = textOrUndefined8(record["title"]);
-    const snippet = textOrUndefined8(record["snippet"]) ?? textOrUndefined8(record["content"]);
-    const publishedAt = textOrUndefined8(record["published_at"]);
+    const title = textOrUndefined9(record["title"]);
+    const snippet = textOrUndefined9(record["snippet"]) ?? textOrUndefined9(record["content"]);
+    const publishedAt = textOrUndefined9(record["published_at"]);
     sources.push({
       url,
       ...title !== void 0 ? { title } : {},
@@ -19909,7 +19952,7 @@ function registerManagedSearchProvider(web, deps) {
 
 // src/index.ts
 var name = "hiwork-core";
-var inject = ["settings", "credentials", "workspaceRegistry", "connection", "web", "agents"];
+var inject = ["settings", "credentials", "workspaceRegistry", "connection", "web", "agents", "systemPrompt"];
 var NS = "ai-router";
 var PI_AI_NS = "llm-pi-ai";
 var MenuConfig = Schema.object({
@@ -19921,6 +19964,8 @@ var MenuConfig = Schema.object({
 var lastErrorSchema = Schema.object({ code: Schema.string().required(), message: Schema.string().required() }).default(void 0);
 var Config = Schema.object({
   baseURL: Schema.string(),
+  // 非 volatile：与 baseURL 同类的组合层固定配置（不进用户表单），出问题经 bundle patch 关闭。
+  identityContext: Schema.boolean().default(true),
   keyId: Schema.string().volatile(),
   username: Schema.string().volatile(),
   displayName: Schema.string().volatile(),
@@ -19959,19 +20004,45 @@ function pathOps(patch) {
   for (const key of patch.unset ?? []) ops.push({ op: "unset", path: [key] });
   return ops;
 }
-async function writeNamespace(settings, ns, ops) {
-  for (let attempt = 0; attempt < 2; attempt++) {
+var HMR_NESTED_FRAGMENT = "HMR transactions cannot be nested";
+var ENTRY_UNAVAILABLE_FRAGMENTS = ["No configurable plugin entry", "is no longer configurable"];
+var WRITE_DEADLINE_MS = 15e3;
+var WRITE_BACKOFF_MIN_MS = 50;
+var WRITE_BACKOFF_MAX_MS = 1e3;
+function isHmrNestedWriteError(error) {
+  return error instanceof Error && error.message.includes(HMR_NESTED_FRAGMENT);
+}
+function isRetriableWriteError(error) {
+  if (!(error instanceof Error)) return false;
+  return error.name === "SettingsConflictError" || isHmrNestedWriteError(error) || ENTRY_UNAVAILABLE_FRAGMENTS.some((fragment) => error.message.includes(fragment));
+}
+function delay(ms) {
+  return new Promise((resolve3) => {
+    setTimeout(resolve3, ms);
+  });
+}
+async function writeNamespace(settings, ns, ops, opts = {}) {
+  const deadline = Date.now() + (opts.deadlineMs ?? WRITE_DEADLINE_MS);
+  const maxBackoff = opts.maxBackoffMs ?? WRITE_BACKOFF_MAX_MS;
+  let backoff = opts.minBackoffMs ?? WRITE_BACKOFF_MIN_MS;
+  for (; ; ) {
     const descriptor = settings.describe().find((d) => d.ns === ns);
-    if (descriptor === void 0) throw new Error(`settings namespace "${ns}" is not registered`);
+    if (descriptor === void 0) {
+      if (Date.now() >= deadline) throw new Error(`settings namespace "${ns}" is not registered`);
+      await delay(backoff);
+      backoff = Math.min(backoff * 2, maxBackoff);
+      continue;
+    }
     try {
       await settings.mutate(ns, ops, descriptor.revision);
       return;
     } catch (error) {
-      if (error instanceof Error && error.name === "SettingsConflictError") continue;
-      throw error;
+      if (!isRetriableWriteError(error)) throw error;
+      if (Date.now() >= deadline) throw error;
+      await delay(backoff);
+      backoff = Math.min(backoff * 2, maxBackoff);
     }
   }
-  throw new Error(`settings namespace "${ns}" write conflicted repeatedly`);
 }
 function readDefaultSelection(settings) {
   const value = settings.describe().find((d) => d.ns === DEFAULT_MODEL_NS)?.value;
@@ -20188,6 +20259,8 @@ async function importLegacyMenuSection(opts) {
     log(`hiwork-core: \u65E7\u7248\u83DC\u5355\u504F\u597D\u8FC1\u79FB\u5931\u8D25\uFF08${error instanceof Error ? error.name : typeof error}\uFF09`);
   }
 }
+var STALE_BROWSER_LOGIN_RECONCILE_DELAYS_MS = [0, 500, 1500, 4e3, 8e3];
+var LOGIN_REQUEST_POLL_MS = 200;
 function apply(ctx, config) {
   const current = () => plainValue(config);
   const settings = ctx.get("settings");
@@ -20266,9 +20339,7 @@ function apply(ctx, config) {
     }).catch(() => {
     });
   };
-  ctx.on("settings/document-updated", (ns) => {
-    if (ns !== NS) return;
-    requestClientPolicy();
+  const dispatchSectionChange = () => {
     const value = current();
     const requested = value.pendingLogin ?? value.browserLoginRequest ?? value.refreshRequest ?? value.logoutRequest;
     if (requested === void 0) return;
@@ -20286,18 +20357,36 @@ function apply(ctx, config) {
         });
       } catch (error) {
         ctx.logger.error("hiwork-core: ai-router section change failed", error);
+        if (isHmrNestedWriteError(error)) {
+          ctx.logger.warn("hiwork-core: \u8F6E\u8BE2\u4E0A\u4E0B\u6587\u5DF2\u88AB HMR \u4E8B\u52A1\u6C61\u67D3\uFF0C\u672C\u5B9E\u4F8B\u540E\u7EED\u56DE\u5199\u5C06\u5168\u90E8\u88AB\u62D2\uFF08\u9700\u91CD\u6302\u63D2\u4EF6\u6216\u91CD\u542F\u5E94\u7528\uFF09");
+        }
         await ports.credentials.unset(PENDING_PASSWORD_REF).catch(() => {
         });
-        await ports.state.patch({
-          set: { lastError: { code: "GATEWAY_UNREACHABLE", message: "\u7F51\u5173\u63D2\u4EF6\u5904\u7406\u5931\u8D25\uFF0C\u8BF7\u68C0\u67E5\u914D\u7F6E\u4E0E\u7F51\u7EDC" } },
-          unset: ["pendingLogin", "browserLoginRequest", "browserLogin", "refreshRequest", "logoutRequest"]
-        }).catch(() => {
-        });
+        try {
+          await ports.state.patch({
+            set: { lastError: { code: "GATEWAY_UNREACHABLE", message: "\u7F51\u5173\u63D2\u4EF6\u5904\u7406\u5931\u8D25\uFF0C\u8BF7\u68C0\u67E5\u914D\u7F6E\u4E0E\u7F51\u7EDC" } },
+            unset: ["pendingLogin", "browserLoginRequest", "browserLogin", "refreshRequest", "logoutRequest"]
+          });
+        } catch (patchError) {
+          ctx.logger.error("hiwork-core: ai-router \u8BF7\u6C42\u5B57\u6BB5\u6E05\u7406\u5931\u8D25\uFF0C\u754C\u9762\u53EF\u80FD\u505C\u5728\u7B49\u5F85\u4E2D", patchError);
+        }
       }
     })().finally(() => {
       inFlight = void 0;
     });
-  });
+  };
+  ctx.effect(() => {
+    const consume = () => {
+      requestClientPolicy();
+      dispatchSectionChange();
+    };
+    consume();
+    const timer = setInterval(consume, LOGIN_REQUEST_POLL_MS);
+    timer.unref?.();
+    return () => {
+      clearInterval(timer);
+    };
+  }, "hiwork-core: login request poll");
   void ctx.root.loader.await().then(() => importLegacyMenuSection({
     ctx,
     settings,
@@ -20306,7 +20395,15 @@ function apply(ctx, config) {
     ctx.logger.warn(`hiwork-core: \u65E7\u7248\u83DC\u5355\u504F\u597D\u8FC1\u79FB\u672A\u6267\u884C\uFF08${error instanceof Error ? error.name : typeof error}\uFF09`);
   });
   requestClientPolicy();
-  void reconcileStaleBrowserLogin(ports.state, current());
+  void (async () => {
+    for (const delay2 of STALE_BROWSER_LOGIN_RECONCILE_DELAYS_MS) {
+      if (delay2 > 0) await new Promise((resolve3) => {
+        setTimeout(resolve3, delay2);
+      });
+      if (await reconcileStaleBrowserLogin(ports.state, current())) return;
+    }
+    ctx.logger.warn("hiwork-core: \u6D4F\u89C8\u5668\u6388\u6743\u7B49\u5F85\u6001\u5BF9\u8D26\u672A\u5199\u5165\uFF0C\u754C\u9762\u53EF\u80FD\u505C\u5728\u300C\u7B49\u5F85\u5B8C\u6210\u6388\u6743\u300D");
+  })();
   const connection = ctx.get("connection");
   if (connection === void 0) throw new Error("connection service unavailable");
   ctx.effect(() => registerUsageRpc({ connection, logger: ctx.logger }, {
@@ -20540,6 +20637,13 @@ function apply(ctx, config) {
       ctx.logger.warn(message);
     }
   }), "hiwork-core: identity service");
+  ctx.effect(() => registerIdentityContext(ctx.systemPrompt, {
+    current: () => current(),
+    enabled: () => current().identityContext !== false,
+    log: (message) => {
+      ctx.logger.warn(message);
+    }
+  }), "hiwork-core: identity runtime context");
   ctx.effect(() => provideMemoryConfig(ctx, {
     resolveSession: async () => (await ports.credentials.resolve(SESSION_REF))?.value,
     gateway: () => {
@@ -20638,8 +20742,10 @@ export {
   apply,
   createDefaultModelPort,
   inject,
+  isHmrNestedWriteError,
   name,
   plainValue,
   projectLoginMode,
-  registerIpcMessageHandler
+  registerIpcMessageHandler,
+  writeNamespace
 };

package/lib/types/browser-login.d.ts

@@ -80,11 +80,20 @@ export declare function startBrowserLogin(opts: BrowserLoginStartPorts): Promise
  * `browserLogin` 是持久化的。宿主一旦重启（应用重开、DSH 崩溃重启、开发期 HMR），
  * 两者就永久错位：所有回调都被 `completeBrowserLogin` 的「没有待完成的授权请求」丢弃，
  * 界面却仍按持久化的 `browserLogin` 停在「等待完成授权」，用户只能靠「取消」脱困。
+ * 更糟的是登录门挂载时会拿这个**已经死掉的**授权 URL 自动打开浏览器，用户无论怎么
+ * 在浏览器里完成授权都回不来——这正是「浏览器打开了但授权回不到桌面端」的成因。
  *
  * 因此启动即把这种**不可能完成**的等待态收尾成失败：写一条 lastError 并清掉等待字段，
  * 让用户回到登录入口重新发起。没有等待态时不动任何状态。
+ *
+ * ⚠️ **返回值必须被检查，调用方必须重试**：`apply()` 跑在任何 settings 写入可用之前，
+ * 此时写回会被 `settings namespace "<ns>" is not registered` 拒绝（实测 1.0.8 桌面端：
+ * apply 时刻命名空间尚未注册，约 3.7s 后才可写）。捕获后吞掉这个拒绝，等于等待态永远
+ * 清不掉——本函数原先正是 `.catch(() => {})` + 单次调用，缺陷即由此而来。
+ *
+ * @returns `true` = 已收尾（原本就没有等待态，或已成功清掉）；`false` = 写回被拒，需重试。
  */
-export declare function reconcileStaleBrowserLogin(state: AiRouterStatePort, value: Pick<AiRouterNamespaceValue, 'browserLogin'>): Promise<void>;
+export declare function reconcileStaleBrowserLogin(state: AiRouterStatePort, value: Pick<AiRouterNamespaceValue, 'browserLogin'>): Promise<boolean>;
 /**
  * 处理 `hiwork://auth/callback`：校验 state → 兑换一次性 code → 写会话凭据 → 复用供给尾部。
  *

package/lib/types/client/daily-data.d.ts

@@ -20,6 +20,22 @@ export declare const DAILY_ENDPOINTS: readonly ["today", "random"];
 export type DailyEndpoint = (typeof DAILY_ENDPOINTS)[number];
 /** 失败防抖 TTL：5 分钟——观察循环逐帧触发，绝不逐帧重试网关。 */
 export declare const DAILY_FAILURE_TTL_MS: number;
+/**
+ * 失败防抖 TTL 对「宿主本地前置失败」的替代值（毫秒）。
+ *
+ * {@link DAILY_LOCAL_FAILURE_CODES} 里的错误由 Host 在**打网之前**判定（未登录 / 网关地址未配置），
+ * 不产生任何网关流量；而它们在「用户完成登录」或「配置补上」之后必然变化。若也计入 5 分钟防抖，
+ * 就会把「登录后立刻能用」变成「最多再等 5 分钟」——**首次安装正是这个顺序**（先启动、后登录），
+ * 用户看到的是「首次启动没有每日一句，切几次页面 / 关掉重开才有」。
+ * 2 秒只为压住观察循环逐帧触发时的空转（并发已由 `pending` 合并为至多一次在途），不改变可见行为。
+ */
+export declare const DAILY_LOCAL_RETRY_MS = 2000;
+/**
+ * Host 在打网之前判定的失败 code（见 `src/daily-rpc.ts` 的 `handleDailyEndpoint`）：
+ * `SESSION_EXPIRED`（未登录 / 会话失效）与 `GATEWAY_UNREACHABLE`（网关地址未配置）。
+ * 只豁免这两个明确「本地」的 code；网关透传的失败与未知错误一律按真实上游失败进 5 分钟防抖。
+ */
+export declare const DAILY_LOCAL_FAILURE_CODES: readonly ["SESSION_EXPIRED", "GATEWAY_UNREACHABLE"];
 /**
  * 单条每日一句的视图形状（网关 JSON 按结构重声明后的归一结果）：
  * 可选字段缺省一律归一为空串 / 空数组，视图据此隐藏对应区块。
@@ -90,20 +106,27 @@ export declare class DailyDataStore implements DailyQuoteLoader {
     private readonly rpc;
     private entry;
     private failureAt;
+    /** 上一次失败是否为宿主本地前置失败（{@link DAILY_LOCAL_FAILURE_CODES}）——决定节流用哪个 TTL。 */
+    private localFailure;
     private pending;
     private readonly now;
     private readonly localDay;
     private readonly failureTtlMs;
+    private readonly localRetryMs;
     constructor(rpc: DailyRpcPort, options?: {
         now?: (() => number) | undefined;
         localDay?: (() => number) | undefined;
         failureTtlMs?: number | undefined;
+        localRetryMs?: number | undefined;
     });
     /** 清空缓存与防抖状态（登出 / 换账号时调用）。 */
     clear(): void;
     /**
-     * 当日条目：同一本地日内命中缓存直接返回（不发 RPC）；失败防抖期内返回 null 不
-     * 重复打网关；并发调用合并为同一次 RPC。返回 null 即「暂无可展示内容」。
+     * 当日条目：同一本地日内命中缓存直接返回（不发 RPC）；节流期内返回 null 不重复打网关；
+     * 并发调用合并为同一次 RPC。返回 null 即「暂无可展示内容」。
+     *
+     * 节流时长分两档：宿主本地前置失败（未登录 / 网关未配置）只等 {@link DAILY_LOCAL_RETRY_MS}，
+     * 其余失败等 {@link DAILY_FAILURE_TTL_MS}——理由见两个常量的说明（首次安装必先启动后登录）。
      */
     getToday(): Promise<DailyTodayView | null>;
     /**
@@ -111,6 +134,11 @@ export declare class DailyDataStore implements DailyQuoteLoader {
      * 失败 / 暂无随机条目返回 null（视图保持当前条目、无任何提示）。
      */
     getRandom(excludeId?: number): Promise<DailyQuoteView | null>;
-    /** 单次 today 拉取：成功（含池空）写缓存；任何失败进入 5 分钟防抖并返回 null。 */
+    /**
+     * 单次 today 拉取：成功（含池空）写缓存；任何失败进入节流并返回 null。
+     *
+     * 失败分两档记：{@link DAILY_LOCAL_FAILURE_CODES} 是宿主在打网之前判定的（无网关流量、登录后必然变化），
+     * 只记短节流；其余（网关透传失败、形状非法、未知错误）记满 {@link DAILY_FAILURE_TTL_MS}。
+     */
     private fetchToday;
 }

package/lib/types/client/menu-preferences.d.ts

@@ -15,10 +15,11 @@ export declare const HIWORK_MENU_NS = "hiwork-menu";
 /**
  * 未自定义时侧栏直显的条数上限（不含原生的「新会话」）。
  *
- * 达到上限之后，用户没有明确标记的入口一律进「更多」——这正是「以后再装插件也不会把侧栏顶高」
- * 的机制（新插件的 id 不在偏好里 = 未标记 = 超出上限就走「更多」）。
+ * 当前第一方入口恰为 6 个（五个业务 feature + 官方「插件」代理项 order 70）——上限取 6，
+ * 全量直显、「更多」行为空不渲染；第 7 个及以后的未标记入口仍走「更多」（「以后再装插件
+ * 也不会把侧栏顶高」的机制不变）。改这个数要同步 menu-preferences.spec 的硬编码用例。
  */
-export declare const DEFAULT_SIDEBAR_LIMIT = 5;
+export declare const DEFAULT_SIDEBAR_LIMIT = 6;
 /** 菜单里「更多」那一行的固定 id（与 feature id 同域，但永不来自注册表）。 */
 export declare const MORE_MENU_ITEM_ID = "__hiwork_more__";
 /** 「更多」这一行的文案（hiwork-core 未注册 locale 命名空间，沿用硬编码中文）。 */

package/lib/types/client/styles.d.ts

@@ -76,11 +76,12 @@ export declare const frameCss: string;
 /**
  * 隐藏宿主动作入口：
  * - 会话头部右上角「Session 日志」导出入口（产品要求不暴露会话日志导出）；
- * - 侧栏底部官方「设置」触发钮：账号行（sidebar.footer.action）自带设置入口。
+ * - 侧栏底部官方「设置」触发钮：0.2 起用户徽章注册进 `settings.launcher` 单席槽位
+ *   （priority -1 抢占官方 ui-settings-account 的账户触发行），**官方触发钮不再渲染**
+ *   （单席槽位按优先级只出一席），这条 CSS 是 0.1.x 运行树上的兜底——徽章当时挂在
+ *   sidebar.footer.action、官方触发钮仍在。两代部署并存无害。
  *   注意官方设置弹窗面板 portal 在 settingsArea 容器内部渲染，只能隐藏触发钮
- *   本身（settingsArea 整区 display:none 会连弹窗一起藏掉）；触发钮留在 DOM 里
- *   供 openSettingsSection 程序化点击（display:none 不影响 .click() 派发，
- *   dsh-ui 同款做法），弹窗照常打开。
+ *   本身（settingsArea 整区 display:none 会连弹窗一起藏掉）。
  * 均按 CSS module 语义后缀命中（hash 前缀无关）。display:none 同时移出无障碍树与
  * Tab 焦点链。后续要隐藏其他宿主入口，规则追加到这里。
  *