hiwork-core 0.0.37 → 0.0.38

package/lib/client.js

@@ -1065,108 +1065,6 @@ function pickSettingsSectionButton(buttons, labels) {
   }
   return void 0;
 }
-var cancelPendingNavigation;
-function isVisibleSubtree(el) {
-  if (el === null) return false;
-  const style = getComputedStyle(el);
-  if (style.display === "none" || style.visibility === "hidden") return false;
-  return el.parentElement === null || isVisibleSubtree(el.parentElement);
-}
-function openSettingsSection(root, label, onMissing) {
-  const labels = typeof label === "string" ? [label] : label;
-  if (cancelPendingNavigation !== void 0 && document.querySelector('[role="dialog"]') !== null) {
-    return;
-  }
-  const trigger = root?.querySelector('[aria-haspopup="dialog"]');
-  if (trigger === null || trigger === void 0) {
-    onMissing?.();
-    return;
-  }
-  cancelPendingNavigation?.();
-  let frame;
-  let finished = false;
-  let sawPanel = false;
-  let reopenTimer;
-  let watchdog;
-  let lastSignature = "";
-  const IDLE_MS = 1500;
-  const finishFailure = () => {
-    cleanup();
-    console.warn(`[hiwork-core] \u672A\u627E\u5230\u8BBE\u7F6E\u5206\u533A\uFF1A${labels.join(" / ")}`);
-    onMissing?.();
-  };
-  const armWatchdog = () => {
-    window.clearTimeout(watchdog);
-    watchdog = window.setTimeout(() => {
-      if (finished) return;
-      if (select()) return;
-      finishFailure();
-    }, IDLE_MS);
-  };
-  const observer = new MutationObserver(() => {
-    schedule();
-  });
-  const cleanup = () => {
-    if (finished) return;
-    finished = true;
-    observer.disconnect();
-    window.clearTimeout(watchdog);
-    window.clearTimeout(reopenTimer);
-    if (frame !== void 0) window.cancelAnimationFrame(frame);
-    if (cancelPendingNavigation === cleanup) cancelPendingNavigation = void 0;
-  };
-  const select = () => {
-    if (finished) return false;
-    const panels = Array.from(document.querySelectorAll('[role="dialog"]')).filter((panel) => isVisibleSubtree(panel));
-    const buttons = panels.flatMap((panel) => Array.from(panel.querySelectorAll("nav button")));
-    const target = panels.length === 0 ? void 0 : pickSettingsSectionButton(buttons, labels);
-    const targetActive = target !== void 0 && (target.className.includes("active") || target.getAttribute("aria-current") === "true");
-    const signature = `${panels.length}:${targetActive ? 1 : 0}`;
-    if (signature !== lastSignature) {
-      lastSignature = signature;
-      armWatchdog();
-    }
-    if (panels.length === 0) {
-      if (sawPanel) {
-        sawPanel = false;
-        reopenTimer = window.setTimeout(() => {
-          reopenTimer = void 0;
-          if (finished || sawPanel) return;
-          if (typeof document === "undefined" || document.querySelector('[role="dialog"]') !== null) return;
-          trigger.click();
-        }, 300);
-        return false;
-      }
-      trigger.click();
-      return false;
-    }
-    sawPanel = true;
-    if (target === void 0) return false;
-    if (targetActive) {
-      cleanup();
-      return true;
-    }
-    target.click();
-    return false;
-  };
-  const schedule = () => {
-    if (finished || frame !== void 0) return;
-    frame = window.requestAnimationFrame(() => {
-      frame = void 0;
-      select();
-    });
-  };
-  armWatchdog();
-  observer.observe(document.body, {
-    childList: true,
-    subtree: true,
-    // 壳把激活态应用到导航钮是纯属性变更（class/aria-current），必须监听才能复核收敛
-    attributes: true,
-    attributeFilter: ["class", "aria-current", "aria-expanded"]
-  });
-  cancelPendingNavigation = cleanup;
-  schedule();
-}
 
 // src/client/user-badge.tsx
 var import_jsx_runtime2 = require("react/jsx-runtime");
@@ -1388,11 +1286,27 @@ function LogoutIcon() {
     }
   );
 }
-function openGatewaySettings() {
-  openSettingsSection(
-    document.querySelector("[data-dsh-sidebar-settings]") ?? document.querySelector('[class*="settingsArea"]'),
-    AI_ROUTER_SECTION_LABEL
-  );
+function openGatewaySettings(openSettings) {
+  openSettings();
+  selectSettingsSection([AI_ROUTER_SECTION_LABEL]);
+}
+function selectSettingsSection(labels) {
+  const started = Date.now();
+  const tick = () => {
+    const dialog = document.querySelector('[role="dialog"]');
+    if (dialog !== null) {
+      const button = pickSettingsSectionButton(
+        Array.from(dialog.querySelectorAll("button")),
+        labels
+      );
+      if (button !== void 0) {
+        button.click();
+        return;
+      }
+    }
+    if (Date.now() - started < 3e3) window.setTimeout(tick, 120);
+  };
+  tick();
 }
 function LogoutConfirm(props) {
   const { onCancel } = props;
@@ -1500,7 +1414,9 @@ function UserBadge(props) {
           style: railRowStyle,
           title: displayName,
           "aria-label": "\u6253\u5F00\u8BBE\u7F6E",
-          onClick: openGatewaySettings,
+          onClick: () => {
+            openGatewaySettings(props.openSettings);
+          },
           children: /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("span", { style: avatarStyle(24), children: initial })
         }
       ),
@@ -1517,7 +1433,9 @@ function UserBadge(props) {
           style: profileButtonStyle,
           title: "\u6253\u5F00\u8BBE\u7F6E",
           "aria-label": `\u6253\u5F00\u8BBE\u7F6E\uFF08${displayName}\uFF09`,
-          onClick: openGatewaySettings,
+          onClick: () => {
+            openGatewaySettings(props.openSettings);
+          },
           children: [
             /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("span", { style: avatarStyle(24), children: initial }),
             /* @__PURE__ */ (0, import_jsx_runtime2.jsx)("span", { style: nameTextStyle, children: displayName })
@@ -1532,7 +1450,9 @@ function UserBadge(props) {
           style: iconButtonStyle,
           title: "\u8BBE\u7F6E",
           "aria-label": "\u8BBE\u7F6E",
-          onClick: openGatewaySettings,
+          onClick: () => {
+            openGatewaySettings(props.openSettings);
+          },
           children: /* @__PURE__ */ (0, import_jsx_runtime2.jsx)(import_dsh_client_ui_primitives.IconSettingsOutlineMedium, { size: 16 })
         }
       ),
@@ -3301,7 +3221,7 @@ function createFeatureRegistry() {
 
 // src/client/menu-preferences.ts
 var HIWORK_MENU_NS = "hiwork-menu";
-var DEFAULT_SIDEBAR_LIMIT = 5;
+var DEFAULT_SIDEBAR_LIMIT = 6;
 var MORE_MENU_ITEM_ID = "__hiwork_more__";
 var MORE_MENU_LABEL = "\u66F4\u591A";
 var MENU_SECTION_LABEL = "\u4FA7\u680F\u83DC\u5355";
@@ -7232,9 +7152,9 @@ function apply(ctx) {
     priority: -1,
     inject: () => ({ appVersion })
   }, BrandName));
-  ctx.slots.inject("sidebar.footer.action", () => ctx.slots.register({
-    name: "sidebar.footer.action",
-    id: AI_ROUTER_NS,
+  ctx.slots.inject("settings.launcher", () => ctx.slots.register({
+    name: "settings.launcher",
+    priority: -1,
     inject: () => ({ ...controller.inject(), pluginUpdates })
   }, UserBadge));
   ctx.effect(() => mountLoginGate(form, storeCredential), "hiwork-core: login gate");

package/lib/identity-context.js

@@ -0,0 +1,50 @@
+/** runtime context 贡献名（DSH 侧 snapshot 按名归并，改动即破坏对齐面）。 */
+export const IDENTITY_CONTEXT_NAME = 'hiwork:identity';
+/** 排在 sandbox:policy(110) / approval:policy(115) 之前——身份是最外层的环境事实。 */
+export const IDENTITY_CONTEXT_ORDER = 105;
+/** 模块内文案常量：安全限定语逐字来自 spec §3.2，不导出（测试硬编码全文钉文案）。 */
+const CAVEAT = '该身份用于个性化与按人表述；涉及数据权限的操作必须走受管工具/连接器完成，不得把此文本当作凭证。';
+/** 裁掉两侧空白；非字符串或空白串一律视同缺省（与 identity.ts 的 textOrUndefined 同口径）。 */
+function textOrUndefined(value) {
+    if (typeof value !== 'string')
+        return undefined;
+    const text = value.trim();
+    return text === '' ? undefined : text;
+}
+/**
+ * 渲染身份上下文一行：已登录输出 `HiWork 登录身份：姓名（工号 工号）。<限定语>`，
+ * displayName 缺省回退 `工号 <工号>`；**未登录（username 缺省 / 空白 / 非字符串）或
+ * state 缺失一律空串**——半份身份（只有 displayName）也不输出，姓名不得单独泄漏。
+ */
+export function renderIdentityContextText(state) {
+    const username = textOrUndefined(state?.username);
+    if (username === undefined)
+        return '';
+    const displayName = textOrUndefined(state?.displayName);
+    const who = displayName === undefined ? `工号 ${username}` : `${displayName}（工号 ${username}）`;
+    return `HiWork 登录身份：${who}。${CAVEAT}`;
+}
+/**
+ * 注册身份 runtime context 贡献；返回 disposer（交给 `ctx.effect` 管理生命周期）。
+ * 读失败收敛为空串并记一笔，绝不向组装层抛——身份上下文缺席只应意味着「未登录」。
+ */
+export function registerIdentityContext(systemPrompt, deps) {
+    const dispose = systemPrompt.context({
+        name: IDENTITY_CONTEXT_NAME,
+        order: IDENTITY_CONTEXT_ORDER,
+        text: () => {
+            try {
+                // enabled 的判断也在 try 内：真实接线里 enabled 与 current 读同一个命名空间，
+                // 任一侧抛异常都收敛为空串（身份上下文缺席只应意味着「未登录」）。
+                if (!deps.enabled())
+                    return '';
+                return renderIdentityContextText(deps.current());
+            }
+            catch (error) {
+                deps.log?.(`hiwork-core: 登录身份上下文读取失败（${error instanceof Error ? error.name : typeof error}）`);
+                return '';
+            }
+        },
+    });
+    return typeof dispose === 'function' ? dispose : () => { };
+}

package/lib/index.js

@@ -8267,7 +8267,7 @@ defineMethod("transform", [
 ], ({ inner }, isInner) => inner.toString(isInner));
 
 // src/version.ts
-var PKG_VERSION = false ? "dev" : "0.0.37";
+var PKG_VERSION = false ? "dev" : "0.0.38";
 
 // src/browser-login.ts
 import { createHash, randomBytes, randomUUID } from "node:crypto";
@@ -12490,7 +12490,7 @@ var Service = class Service2 {
   }
 };
 
-// node_modules/.pnpm/@deepseek-ai+dsh-scope@0.1.7-rc.2_@deepseek-ai+cordis@4.0.4_@deepseek-ai+dsh-invariants_0271d3a82adfe807020938592f267574/node_modules/@deepseek-ai/dsh-scope/lib/index.js
+// node_modules/.pnpm/@deepseek-ai+dsh-scope@0.2.0-rc.1_@deepseek-ai+cordis@4.0.4_@deepseek-ai+dsh-invariants_8ef32aa4891a716d53102df556bb759f/node_modules/@deepseek-ai/dsh-scope/lib/index.js
 var NamedEntries = class {
   duplicateError;
   data = /* @__PURE__ */ new Map();
@@ -12706,10 +12706,10 @@ function scopeTarget(base, key) {
   return carrier;
 }
 
-// node_modules/.pnpm/@deepseek-ai+dsh-llm@0.1.7-rc.2_@deepseek-ai+cordis@4.0.4/node_modules/@deepseek-ai/dsh-llm/lib/index.js
+// node_modules/.pnpm/@deepseek-ai+dsh-llm@0.2.0-rc.1_@deepseek-ai+cordis@4.0.4/node_modules/@deepseek-ai/dsh-llm/lib/index.js
 import { createRequire } from "node:module";
 
-// node_modules/.pnpm/@deepseek-ai+dsh-typert-protocol@0.1.7-rc.2_@deepseek-ai+cordis@4.0.4/node_modules/@deepseek-ai/dsh-typert-protocol/lib/index.js
+// node_modules/.pnpm/@deepseek-ai+dsh-typert-protocol@0.2.0-rc.1_@deepseek-ai+cordis@4.0.4/node_modules/@deepseek-ai/dsh-typert-protocol/lib/index.js
 var RemoteError = class extends Error {
   code;
   details;
@@ -12834,7 +12834,7 @@ function validateName(subject, value) {
   if (!isTypertRemoteSegment(value)) throw new TypeError(`typert-protocol: ${subject} must contain only RPC endpoint segment characters`);
 }
 
-// node_modules/.pnpm/@deepseek-ai+dsh-util-values@0.1.7-rc.2_@deepseek-ai+cordis@4.0.4/node_modules/@deepseek-ai/dsh-util-values/lib/index.js
+// node_modules/.pnpm/@deepseek-ai+dsh-util-values@0.2.0-rc.1_@deepseek-ai+cordis@4.0.4/node_modules/@deepseek-ai/dsh-util-values/lib/index.js
 function assertNever(value, context) {
   const rendered = JSON.stringify(value) ?? String(value);
   throw new Error(`unreachable variant${context ? ` in ${context}` : ""}: ${rendered}`);
@@ -12843,7 +12843,7 @@ function hasIntrinsicConstructor(prototype, name2) {
   const constructor = Object.getOwnPropertyDescriptor(prototype, "constructor")?.value;
   if (typeof constructor !== "function") return false;
   try {
-    return constructor.name === name2 && constructor.prototype === prototype && Function.prototype.toString.call(constructor) === `function ${name2}() { [native code] }`;
+    return constructor.name === name2 && constructor.prototype === prototype && Function.prototype.toString.call(constructor) === Function.prototype.toString.call(name2 === "Array" ? Array : Object);
   } catch {
     return false;
   }
@@ -13015,7 +13015,7 @@ function deepFreeze(value) {
   return value;
 }
 
-// node_modules/.pnpm/@deepseek-ai+dsh-util-crypto@0.1.7-rc.2_@deepseek-ai+cordis@4.0.4/node_modules/@deepseek-ai/dsh-util-crypto/lib/index.js
+// node_modules/.pnpm/@deepseek-ai+dsh-util-crypto@0.2.0-rc.1_@deepseek-ai+cordis@4.0.4/node_modules/@deepseek-ai/dsh-util-crypto/lib/index.js
 function randomUUID2() {
   const bytes = globalThis.crypto.getRandomValues(new Uint8Array(16));
   const hex = Array.from(bytes, (byte, index) => {
@@ -13024,15 +13024,15 @@ function randomUUID2() {
   return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
 }
 
-// node_modules/.pnpm/@deepseek-ai+dsh-brand@0.1.7-rc.2_@deepseek-ai+cordis@4.0.4/node_modules/@deepseek-ai/dsh-brand/lib/index.js
+// node_modules/.pnpm/@deepseek-ai+dsh-brand@0.2.0-rc.1_@deepseek-ai+cordis@4.0.4/node_modules/@deepseek-ai/dsh-brand/lib/index.js
 function brandString(value) {
   return value;
 }
 
-// node_modules/.pnpm/@deepseek-ai+dsh-timeout@0.1.7-rc.2_@deepseek-ai+cordis@4.0.4/node_modules/@deepseek-ai/dsh-timeout/lib/index.js
+// node_modules/.pnpm/@deepseek-ai+dsh-timeout@0.2.0-rc.1_@deepseek-ai+cordis@4.0.4/node_modules/@deepseek-ai/dsh-timeout/lib/index.js
 var MAX_TIMER_DELAY_MS = 2147483647;
 
-// node_modules/.pnpm/@deepseek-ai+dsh-llm@0.1.7-rc.2_@deepseek-ai+cordis@4.0.4/node_modules/@deepseek-ai/dsh-llm/lib/index.js
+// node_modules/.pnpm/@deepseek-ai+dsh-llm@0.2.0-rc.1_@deepseek-ai+cordis@4.0.4/node_modules/@deepseek-ai/dsh-llm/lib/index.js
 function freezeMessage(message) {
   return deepFreeze(structuredClone(message));
 }
@@ -14075,7 +14075,7 @@ function adapterFailureChunk(error, signal) {
   };
 }
 
-// node_modules/.pnpm/@deepseek-ai+dsh-sandbox@0.1.7-rc.2_@deepseek-ai+cordis@4.0.4_@deepseek-ai+dsh-llm@0.1._a8c9906be8c926809212c5fbb3bc7c61/node_modules/@deepseek-ai/dsh-sandbox/lib/index.js
+// node_modules/.pnpm/@deepseek-ai+dsh-sandbox@0.2.0-rc.1_@deepseek-ai+cordis@4.0.4_@deepseek-ai+dsh-llm@0.2._910788faa6d5e8808178f15deb98d164/node_modules/@deepseek-ai/dsh-sandbox/lib/index.js
 var WIDER_MODES = {
   "read-only": ["workspace-write", "danger-full-access"],
   "workspace-write": ["danger-full-access"]
@@ -14117,7 +14117,7 @@ async function approveEscalation(request, approval) {
   }
 }
 
-// node_modules/.pnpm/@deepseek-ai+dsh-tools@0.1.7-rc.2_d2e08270f2205e73d65e98cfcd910cae/node_modules/@deepseek-ai/dsh-tools/lib/index.js
+// node_modules/.pnpm/@deepseek-ai+dsh-tools@0.2.0-rc.1_44958e8f826516598aa7d335d84aa068/node_modules/@deepseek-ai/dsh-tools/lib/index.js
 var JsonSchemaError = class extends HarnessError {
   /** Individual schema violations in walk order. */
   violations;
@@ -19132,6 +19132,42 @@ function provideIdentity(ctx, deps) {
   };
 }
 
+// src/identity-context.ts
+var IDENTITY_CONTEXT_NAME = "hiwork:identity";
+var IDENTITY_CONTEXT_ORDER = 105;
+var CAVEAT = "\u8BE5\u8EAB\u4EFD\u7528\u4E8E\u4E2A\u6027\u5316\u4E0E\u6309\u4EBA\u8868\u8FF0\uFF1B\u6D89\u53CA\u6570\u636E\u6743\u9650\u7684\u64CD\u4F5C\u5FC5\u987B\u8D70\u53D7\u7BA1\u5DE5\u5177/\u8FDE\u63A5\u5668\u5B8C\u6210\uFF0C\u4E0D\u5F97\u628A\u6B64\u6587\u672C\u5F53\u4F5C\u51ED\u8BC1\u3002";
+function textOrUndefined6(value) {
+  if (typeof value !== "string") return void 0;
+  const text = value.trim();
+  return text === "" ? void 0 : text;
+}
+function renderIdentityContextText(state) {
+  const username = textOrUndefined6(state?.username);
+  if (username === void 0) return "";
+  const displayName = textOrUndefined6(state?.displayName);
+  const who = displayName === void 0 ? `\u5DE5\u53F7 ${username}` : `${displayName}\uFF08\u5DE5\u53F7 ${username}\uFF09`;
+  return `HiWork \u767B\u5F55\u8EAB\u4EFD\uFF1A${who}\u3002${CAVEAT}`;
+}
+function registerIdentityContext(systemPrompt, deps) {
+  const dispose = systemPrompt.context({
+    name: IDENTITY_CONTEXT_NAME,
+    order: IDENTITY_CONTEXT_ORDER,
+    text: () => {
+      try {
+        if (!deps.enabled()) return "";
+        return renderIdentityContextText(deps.current());
+      } catch (error) {
+        deps.log?.(
+          `hiwork-core: \u767B\u5F55\u8EAB\u4EFD\u4E0A\u4E0B\u6587\u8BFB\u53D6\u5931\u8D25\uFF08${error instanceof Error ? error.name : typeof error}\uFF09`
+        );
+        return "";
+      }
+    }
+  });
+  return typeof dispose === "function" ? dispose : () => {
+  };
+}
+
 // src/knowledge-config.ts
 var HIWORK_KNOWLEDGE_SERVICE = "hiworkKnowledge";
 var ME_KNOWLEDGE_CONFIG_PATH = "/api/me/knowledge-config";
@@ -19158,22 +19194,22 @@ function messageFor(reason) {
 function failure12(reason, message) {
   return { ok: false, reason, message: message ?? messageFor(reason) };
 }
-function textOrUndefined6(value) {
+function textOrUndefined7(value) {
   if (typeof value !== "string") return void 0;
   const text = value.trim();
   return text === "" ? void 0 : text;
 }
 function projectKnowledgeConfig(body) {
-  const baseUrl = textOrUndefined6(body["base_url"] ?? body["baseUrl"]);
-  const apiKey = textOrUndefined6(body["api_key"] ?? body["apiKey"]);
+  const baseUrl = textOrUndefined7(body["base_url"] ?? body["baseUrl"]);
+  const apiKey = textOrUndefined7(body["api_key"] ?? body["apiKey"]);
   if (baseUrl === void 0 || apiKey === void 0) return void 0;
   return {
     ok: true,
     baseUrl,
     apiKey,
-    agentId: textOrUndefined6(body["agent_id"] ?? body["agentId"]) ?? "",
-    chatModelId: textOrUndefined6(body["chat_model_id"] ?? body["chatModelId"]) ?? "",
-    tenantId: textOrUndefined6(body["tenant_id"] ?? body["tenantId"]) ?? "",
+    agentId: textOrUndefined7(body["agent_id"] ?? body["agentId"]) ?? "",
+    chatModelId: textOrUndefined7(body["chat_model_id"] ?? body["chatModelId"]) ?? "",
+    tenantId: textOrUndefined7(body["tenant_id"] ?? body["tenantId"]) ?? "",
     knowledgeBases: projectKnowledgeBases(body["knowledge_bases"] ?? body["knowledgeBases"])
   };
 }
@@ -19184,10 +19220,10 @@ function projectKnowledgeBases(value) {
   for (const item of value) {
     if (item === null || typeof item !== "object") continue;
     const record = item;
-    const id = textOrUndefined6(record["id"]);
+    const id = textOrUndefined7(record["id"]);
     if (id === void 0 || seen.has(id)) continue;
     seen.add(id);
-    bases.push({ id, name: textOrUndefined6(record["name"]) ?? "" });
+    bases.push({ id, name: textOrUndefined7(record["name"]) ?? "" });
   }
   return bases.length === 0 ? EMPTY_KNOWLEDGE_BASES : bases;
 }
@@ -19243,8 +19279,8 @@ var KnowledgeConfigProvider = class {
       const raw = await gateway.getMyKnowledgeToken(sessionCookie);
       const envelope = raw;
       const body = envelope?.["data"] && typeof envelope["data"] === "object" ? envelope["data"] : envelope;
-      const token = textOrUndefined6(body?.["token"] ?? body?.["knowledge_token"]);
-      const audience = textOrUndefined6(body?.["audience"] ?? body?.["aud"]);
+      const token = textOrUndefined7(body?.["token"] ?? body?.["knowledge_token"]);
+      const audience = textOrUndefined7(body?.["audience"] ?? body?.["aud"]);
       const ids = body?.["knowledge_base_ids"] ?? body?.["knowledgeBaseIds"];
       if (!token || audience !== "hiwork-knowledge" || !Array.isArray(ids) || !ids.every((id) => typeof id === "string")) {
         this.deps.log?.("hiwork-core: \u7F51\u5173\u8FD4\u56DE\u7684 knowledge-token \u5F62\u72B6\u65E0\u6548");
@@ -19255,8 +19291,8 @@ var KnowledgeConfigProvider = class {
       const knowledgeBases = Array.isArray(rawBases) ? rawBases.flatMap((item) => {
         if (item === null || typeof item !== "object") return [];
         const obj = item;
-        const id = textOrUndefined6(obj["id"]);
-        return id ? [{ id, name: textOrUndefined6(obj["name"]) ?? "" }] : [];
+        const id = textOrUndefined7(obj["id"]);
+        return id ? [{ id, name: textOrUndefined7(obj["name"]) ?? "" }] : [];
       }).filter((item) => knowledgeBaseIds.includes(item.id)) : [];
       const view = { ok: true, token, audience, knowledgeBaseIds, knowledgeBases };
       this.tokenCached = { sessionCookie, view, at: this.now() };
@@ -19374,7 +19410,7 @@ function messageFor2(reason) {
 function failure13(reason, message) {
   return { ok: false, reason, message: message ?? messageFor2(reason) };
 }
-function textOrUndefined7(value) {
+function textOrUndefined8(value) {
   if (typeof value !== "string") return void 0;
   const text = value.trim();
   return text === "" ? void 0 : text;
@@ -19383,15 +19419,15 @@ function teamIdsOf(value) {
   if (!Array.isArray(value)) return [];
   const ids = [];
   for (const item of value) {
-    const text = textOrUndefined7(item);
+    const text = textOrUndefined8(item);
     if (text !== void 0) ids.push(text);
   }
   return ids;
 }
 function projectMemoryConfig(body) {
-  const panelUrl = textOrUndefined7(body["panel_url"] ?? body["panelUrl"]);
-  const serviceId = textOrUndefined7(body["service_id"] ?? body["serviceId"]);
-  const apiKey = textOrUndefined7(body["api_key"] ?? body["apiKey"] ?? body["userKey"]);
+  const panelUrl = textOrUndefined8(body["panel_url"] ?? body["panelUrl"]);
+  const serviceId = textOrUndefined8(body["service_id"] ?? body["serviceId"]);
+  const apiKey = textOrUndefined8(body["api_key"] ?? body["apiKey"] ?? body["userKey"]);
   if (panelUrl === void 0 || serviceId === void 0 || apiKey === void 0) return void 0;
   return {
     ok: true,
@@ -19658,7 +19694,7 @@ function provideOfficeRelay(ctx, deps) {
   };
 }
 
-// node_modules/.pnpm/@deepseek-ai+dsh-web@0.1.7-rc.2_@deepseek-ai+cordis@4.0.4_@deepseek-ai+dsh-llm@0.1.7-rc.2_@deepseek-ai+cordis@4.0.4_/node_modules/@deepseek-ai/dsh-web/lib/index.js
+// node_modules/.pnpm/@deepseek-ai+dsh-web@0.2.0-rc.1_@deepseek-ai+cordis@4.0.4_@deepseek-ai+dsh-llm@0.2.0-rc.1_@deepseek-ai+cordis@4.0.4_/node_modules/@deepseek-ai/dsh-web/lib/index.js
 var WebError = class extends HarnessError {
 };
 var WebRuntime = class extends Service {
@@ -19836,7 +19872,7 @@ function httpOutcomeToError(status, code) {
   if (status === 502 || code === "SEARCH_UPSTREAM_ERROR") return new WebError("\u641C\u7D22\u670D\u52A1\u6682\u65F6\u4E0D\u53EF\u7528\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5", HIWORK_SEARCH_UPSTREAM);
   return new WebError("\u8054\u7F51\u641C\u7D22\u6682\u65F6\u4E0D\u53EF\u7528\uFF0C\u8BF7\u7A0D\u540E\u91CD\u8BD5", "WEB_PROVIDER_ERROR");
 }
-function textOrUndefined8(value) {
+function textOrUndefined9(value) {
   if (typeof value !== "string") return void 0;
   const text = value.trim();
   return text === "" ? void 0 : text;
@@ -19848,11 +19884,11 @@ function projectWebSearch(body) {
   for (const item of raw) {
     if (item === null || typeof item !== "object") continue;
     const record = item;
-    const url = textOrUndefined8(record["url"]);
+    const url = textOrUndefined9(record["url"]);
     if (url === void 0) continue;
-    const title = textOrUndefined8(record["title"]);
-    const snippet = textOrUndefined8(record["snippet"]) ?? textOrUndefined8(record["content"]);
-    const publishedAt = textOrUndefined8(record["published_at"]);
+    const title = textOrUndefined9(record["title"]);
+    const snippet = textOrUndefined9(record["snippet"]) ?? textOrUndefined9(record["content"]);
+    const publishedAt = textOrUndefined9(record["published_at"]);
     sources.push({
       url,
       ...title !== void 0 ? { title } : {},
@@ -19916,7 +19952,7 @@ function registerManagedSearchProvider(web, deps) {
 
 // src/index.ts
 var name = "hiwork-core";
-var inject = ["settings", "credentials", "workspaceRegistry", "connection", "web", "agents"];
+var inject = ["settings", "credentials", "workspaceRegistry", "connection", "web", "agents", "systemPrompt"];
 var NS = "ai-router";
 var PI_AI_NS = "llm-pi-ai";
 var MenuConfig = Schema.object({
@@ -19928,6 +19964,8 @@ var MenuConfig = Schema.object({
 var lastErrorSchema = Schema.object({ code: Schema.string().required(), message: Schema.string().required() }).default(void 0);
 var Config = Schema.object({
   baseURL: Schema.string(),
+  // 非 volatile：与 baseURL 同类的组合层固定配置（不进用户表单），出问题经 bundle patch 关闭。
+  identityContext: Schema.boolean().default(true),
   keyId: Schema.string().volatile(),
   username: Schema.string().volatile(),
   displayName: Schema.string().volatile(),
@@ -20599,6 +20637,13 @@ function apply(ctx, config) {
       ctx.logger.warn(message);
     }
   }), "hiwork-core: identity service");
+  ctx.effect(() => registerIdentityContext(ctx.systemPrompt, {
+    current: () => current(),
+    enabled: () => current().identityContext !== false,
+    log: (message) => {
+      ctx.logger.warn(message);
+    }
+  }), "hiwork-core: identity runtime context");
   ctx.effect(() => provideMemoryConfig(ctx, {
     resolveSession: async () => (await ports.credentials.resolve(SESSION_REF))?.value,
     gateway: () => {

package/lib/types/client/menu-preferences.d.ts

@@ -15,10 +15,11 @@ export declare const HIWORK_MENU_NS = "hiwork-menu";
 /**
  * 未自定义时侧栏直显的条数上限（不含原生的「新会话」）。
  *
- * 达到上限之后，用户没有明确标记的入口一律进「更多」——这正是「以后再装插件也不会把侧栏顶高」
- * 的机制（新插件的 id 不在偏好里 = 未标记 = 超出上限就走「更多」）。
+ * 当前第一方入口恰为 6 个（五个业务 feature + 官方「插件」代理项 order 70）——上限取 6，
+ * 全量直显、「更多」行为空不渲染；第 7 个及以后的未标记入口仍走「更多」（「以后再装插件
+ * 也不会把侧栏顶高」的机制不变）。改这个数要同步 menu-preferences.spec 的硬编码用例。
  */
-export declare const DEFAULT_SIDEBAR_LIMIT = 5;
+export declare const DEFAULT_SIDEBAR_LIMIT = 6;
 /** 菜单里「更多」那一行的固定 id（与 feature id 同域，但永不来自注册表）。 */
 export declare const MORE_MENU_ITEM_ID = "__hiwork_more__";
 /** 「更多」这一行的文案（hiwork-core 未注册 locale 命名空间，沿用硬编码中文）。 */

package/lib/types/client/styles.d.ts

@@ -76,11 +76,12 @@ export declare const frameCss: string;
 /**
  * 隐藏宿主动作入口：
  * - 会话头部右上角「Session 日志」导出入口（产品要求不暴露会话日志导出）；
- * - 侧栏底部官方「设置」触发钮：账号行（sidebar.footer.action）自带设置入口。
+ * - 侧栏底部官方「设置」触发钮：0.2 起用户徽章注册进 `settings.launcher` 单席槽位
+ *   （priority -1 抢占官方 ui-settings-account 的账户触发行），**官方触发钮不再渲染**
+ *   （单席槽位按优先级只出一席），这条 CSS 是 0.1.x 运行树上的兜底——徽章当时挂在
+ *   sidebar.footer.action、官方触发钮仍在。两代部署并存无害。
  *   注意官方设置弹窗面板 portal 在 settingsArea 容器内部渲染，只能隐藏触发钮
- *   本身（settingsArea 整区 display:none 会连弹窗一起藏掉）；触发钮留在 DOM 里
- *   供 openSettingsSection 程序化点击（display:none 不影响 .click() 派发，
- *   dsh-ui 同款做法），弹窗照常打开。
+ *   本身（settingsArea 整区 display:none 会连弹窗一起藏掉）。
  * 均按 CSS module 语义后缀命中（hash 前缀无关）。display:none 同时移出无障碍树与
  * Tab 焦点链。后续要隐藏其他宿主入口，规则追加到这里。
  *

package/lib/types/client/user-badge.d.ts

@@ -1,4 +1,4 @@
-import type { InjectFace, PropsRuntime } from '@deepseek-ai/dsh-client-ui-slots';
+import type { InjectFace } from '@deepseek-ai/dsh-client-ui-slots';
 import { type AiRouterCardFace } from './controller.ts';
 import { type PluginUpdatesStore } from './plugin-updates.ts';
 /**
@@ -19,6 +19,11 @@ import { type PluginUpdatesStore } from './plugin-updates.ts';
 export interface PluginUpdatesFace {
     pluginUpdates: PluginUpdatesStore;
 }
-export type UserBadgeProps = PropsRuntime<'sidebar.footer.action'> & InjectFace<AiRouterCardFace & PluginUpdatesFace>;
+export type UserBadgeProps = InjectFace<AiRouterCardFace & PluginUpdatesFace> & {
+    /** `settings.launcher` 槽位的渲染参数（ui-settings-general 的 SettingsRoot 下发）。 */
+    readonly wide: boolean | undefined;
+    /** 打开设置弹窗（壳拥有 open 状态）；分区直达由 selectSettingsSection 补齐。 */
+    readonly openSettings: () => void;
+};
 /** 底部账号信息行（宽栏 / 折叠栏共用；插件更新提示卡片也由它渲染，见下）。 */
 export declare function UserBadge(props: UserBadgeProps): import("react").JSX.Element | null;

package/lib/types/identity-context.d.ts

@@ -0,0 +1,54 @@
+/**
+ * 登录身份的 runtime context 贡献（`hiwork:identity`）：把「当前登录人是谁」送进
+ * AI 上下文，供 skill / 会话按人表述与个性化使用（spec
+ * `docs/superpowers/specs/2026-10-09-identity-runtime-context-design.md`）。
+ *
+ * 设计要点（与 `src/identity.ts` 同构）：
+ *  - **cordis-free 纯模块**：注册走结构化的 {@link SystemPromptPort} 窄端口，调用方
+ *    （index.ts）传真实 `ctx.systemPrompt`；单测直接伪造。真实 PromptContext.text
+ *    接受 `(AssembleContext) => string`，本模块的 `() => string` 结构兼容（忽略入参）；
+ *  - **空串 = 不贡献**（DSH 原生语义）：未登录、bundle 层关闭（`identityContext: false`）、
+ *    读失败一律返回空串——零暴露，且绝不向组装层抛异常；
+ *  - **每次组装现读**：text 是每次求值的 provider，登录 / 登出 / 换号在下一步即时反映，
+ *    不缓存旧身份；
+ *  - **身份文本不是凭证**：上下文里的身份只作展示 / 个性化 / 按人表述用，鉴权一律在
+ *    通道层（loopback RPC 带网关会话、MCP 断言→mint）。文案末尾那句限定语是对模型的
+ *    引导，不是防线；
+ *  - **字段最小化**：只用 `username`（工号）与 `displayName`（姓名），归一化口径与
+ *    identity.ts 的 textOrUndefined 一致（裁空白、空白串视同缺省）。keys / subject /
+ *    团队一律不进上下文。
+ */
+import type { IdentityState } from './identity.ts';
+/** runtime context 贡献名（DSH 侧 snapshot 按名归并，改动即破坏对齐面）。 */
+export declare const IDENTITY_CONTEXT_NAME = "hiwork:identity";
+/** 排在 sandbox:policy(110) / approval:policy(115) 之前——身份是最外层的环境事实。 */
+export declare const IDENTITY_CONTEXT_ORDER = 105;
+/**
+ * 渲染身份上下文一行：已登录输出 `HiWork 登录身份：姓名（工号 工号）。<限定语>`，
+ * displayName 缺省回退 `工号 <工号>`；**未登录（username 缺省 / 空白 / 非字符串）或
+ * state 缺失一律空串**——半份身份（只有 displayName）也不输出，姓名不得单独泄漏。
+ */
+export declare function renderIdentityContextText(state: IdentityState | undefined): string;
+/** `ctx.systemPrompt.context` 的最小端口（结构兼容 DSH 的 SystemPrompt，便于单测伪造）。 */
+export interface SystemPromptPort {
+    /** 注册一条 runtime context 贡献；返回注销函数（或任何可注销值，见 registerIdentityContext）。 */
+    context(contribution: {
+        name: string;
+        order: number;
+        text: () => string;
+    }): unknown;
+}
+/** 注册侧依赖：登录态现读 + bundle 层开关 + 日志出口。 */
+export interface IdentityContextDeps {
+    /** 读一次当前登录态（与 hiworkIdentity 同一数据源；每次组装都会调用）。 */
+    current(): IdentityState;
+    /** bundle 层固定开关（缺省开）；关闭时贡献空文本。 */
+    enabled(): boolean;
+    /** Host 日志出口（只记错误类型，不记身份字段）。 */
+    log?(message: string): void;
+}
+/**
+ * 注册身份 runtime context 贡献；返回 disposer（交给 `ctx.effect` 管理生命周期）。
+ * 读失败收敛为空串并记一笔，绝不向组装层抛——身份上下文缺席只应意味着「未登录」。
+ */
+export declare function registerIdentityContext(systemPrompt: SystemPromptPort, deps: IdentityContextDeps): () => void;

package/lib/types/index.d.ts

@@ -19,7 +19,8 @@ export declare const name = "hiwork-core";
  * （`ctx.web.registerSearchProvider`，见 `src/web-search.ts`；dsh-base 基座先于本
  * 插件挂载 dsh-web）；`agents` 是根 Agent 注册表——`image_generate` 工具要挂在根 Agent
  * 上（`ctx.agents.roots()` / `agent/created`，见 `src/tools.ts`；与 knowledge 的
- * `inject` 同源）；其余三项是既有登录 / 供给依赖。
+ * `inject` 同源）；`systemPrompt` 承载登录身份的 runtime context 贡献
+ * （`hiwork:identity`，见 `src/identity-context.ts`）；其余三项是既有登录 / 供给依赖。
  */
 export declare const inject: string[];
 /** 侧栏菜单偏好的解析值（client 侧 `MenuPreferences` 的同一份形状）。 */
@@ -44,6 +45,11 @@ export declare const MenuConfig: z<MenuConfigValue>;
 /** 插件配置 + 运行时状态字段（全部可选；写操作按此 schema 校验）。 */
 export interface Config {
     baseURL?: string;
+    /**
+     * 身份上下文开关（bundle 层固定配置，缺省开）：把当前登录人（工号 + 姓名）以
+     * runtime context 贡献暴露进 AI 上下文；关闭时贡献空文本（零暴露）。
+     */
+    identityContext?: boolean;
     keyId?: string;
     username?: string;
     displayName?: string;
@@ -114,12 +120,13 @@ export declare const Config: z<Config>;
 /**
  * apply 收到的运行时 config：volatile 字段是稳定引用（schemastery 解析期包装，值为
  * undefined 时引用依然存在），随 profile 变更被框架原地更新——持有引用、每次现取，
- * 绝不缓存 `.get()` 的结果。baseURL 仍是普通组合层配置。
+ * 绝不缓存 `.get()` 的结果。baseURL 与 identityContext 仍是普通组合层配置。
  */
 export type RuntimeConfig = {
     baseURL?: string;
+    identityContext?: boolean;
 } & {
-    [K in Exclude<keyof Config, 'baseURL'>]?: Volatile<Config[K]>;
+    [K in Exclude<keyof Config, 'baseURL' | 'identityContext'>]?: Volatile<Config[K]>;
 };
 /**
  * settings.mutate 的路径操作（rc.2 的 dsh-settings 不再导出 `SettingsPathOp` 类型，

package/lib/types/provision-session.d.ts

@@ -37,6 +37,8 @@ export interface AiRouterStatePort {
 /** ai-router 命名空间解析后的值（相关字段）。 */
 export interface AiRouterNamespaceValue {
     baseURL?: string;
+    /** 身份上下文开关（bundle 层固定配置，缺省开）；关闭时 `hiwork:identity` 贡献空文本。 */
+    identityContext?: boolean;
     keyId?: string;
     username?: string;
     /** 登录账号的显示名（网关 LDAP displayName，如中文名）；缺省时 UI 回退 username。 */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hiwork-core",
-  "version": "0.0.37",
+  "version": "0.0.38",
   "type": "module",
   "description": "HiWork 企业统一登录与模型自动供给插件（ai-router 网关登录，Web 表单，无 CLI 认证）",
   "license": "UNLICENSED",
@@ -42,33 +42,34 @@
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "~4.0.4",
-    "@deepseek-ai/dsh-client-ui-layout": ">=0.1.0-rc.5 <0.2.0"
+    "@deepseek-ai/dsh-client-ui-layout": ">=0.1.0-rc.5 <0.2.0 || >=0.2.0-rc.1 <0.3.0"
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "4.0.4",
     "@deepseek-ai/cordis-plugin-loader": "1.0.5",
-    "@deepseek-ai/dsh-agent-default-model": "0.1.7-rc.2",
-    "@deepseek-ai/dsh-api-remotes": "0.1.7-rc.2",
-    "@deepseek-ai/dsh-app-boot": "0.1.7-rc.2",
-    "@deepseek-ai/dsh-attachment": "0.1.7-rc.2",
-    "@deepseek-ai/dsh-client-store": "0.1.7-rc.2",
-    "@deepseek-ai/dsh-client-ui-chat": "0.1.7-rc.2",
-    "@deepseek-ai/dsh-client-ui-conversation": "0.1.7-rc.2",
-    "@deepseek-ai/dsh-client-ui-primitives": "0.1.7-rc.2",
-    "@deepseek-ai/dsh-client-ui-renderer": "0.1.7-rc.2",
-    "@deepseek-ai/dsh-client-ui-session": "0.1.7-rc.2",
-    "@deepseek-ai/dsh-client-ui-settings": "0.1.7-rc.2",
-    "@deepseek-ai/dsh-client-ui-sidebar": "0.1.7-rc.2",
-    "@deepseek-ai/dsh-client-ui-slots": "0.1.7-rc.2",
-    "@deepseek-ai/dsh-config-editor": "0.1.7-rc.2",
-    "@deepseek-ai/dsh-credentials": "0.1.7-rc.2",
-    "@deepseek-ai/dsh-credentials-local": "0.1.7-rc.2",
-    "@deepseek-ai/dsh-llm": "0.1.7-rc.2",
-    "@deepseek-ai/dsh-llm-pi-ai": "0.1.7-rc.2",
-    "@deepseek-ai/dsh-settings": "0.1.7-rc.2",
-    "@deepseek-ai/dsh-tools": "0.1.7-rc.2",
-    "@deepseek-ai/dsh-web": "0.1.7-rc.2",
-    "@deepseek-ai/dsh-workspace": "0.1.7-rc.2",
+    "@deepseek-ai/dsh-agent-default-model": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-api-remotes": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-app-boot": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-attachment": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-client-store": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-client-ui-chat": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-client-ui-conversation": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-client-ui-primitives": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-client-ui-renderer": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-client-ui-session": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-client-ui-settings": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-client-ui-sidebar": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-client-ui-slots": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-config-editor": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-credentials": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-credentials-local": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-llm": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-llm-pi-ai": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-settings": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-system-prompt": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-tools": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-web": "0.2.0-rc.1",
+    "@deepseek-ai/dsh-workspace": "0.2.0-rc.1",
     "@deepseek-ai/schemastery": "3.18.4",
     "@types/node": "^22",
     "@types/react": "^18",
@@ -81,7 +82,7 @@
     "typescript": "^5",
     "vitest": "^3",
     "yaml": "^2.8.1",
-    "@deepseek-ai/dsh-client-ui-layout": "0.1.7-rc.2"
+    "@deepseek-ai/dsh-client-ui-layout": "0.2.0-rc.1"
   },
   "scripts": {
     "typecheck": "tsc --noEmit",