@awiki/dsh-plugin

AWiki identity and messaging for DeepSeek Harness. The package installs one Host service, its production Rust SDK provider, the model tools, and a Web client with a draggable AWiki Me launcher.

中文说明

Identity-entry failures preserve the currently mounted form and local pending identity material. The phone and OTP never enter browser persistence, controller snapshots, or public Remote results. Closed registration, unavailable verification state, and commit conflicts each give a safe next action without exposing remote response details.

The Rust SDK exclusively owns the identity, SecretVault, database, cache, and metadata below the configured stateRoot. This release performs a clean cutover and does not import the former TypeScript SDK identity.json; create a new Rust-backed identity after upgrading.

Features

• Enter a Handle and phone through one Web UI flow. Before any code is sent, the Host classifies the Handle: a new Handle receives a registration OTP and creates the deployment identity, while an existing Handle receives one Recovery V4 OTP and enters the recovery state machine directly.
• Open the top-left AWiki account menu to sign out locally without deleting the encrypted identity or message database; Resume local identity restores the same DID and Handle, including across DSH restarts. The signed-out screen reveals phone recovery only after local resume fails. Switching identities requires an explicit confirmation that permanently clears local AWiki data first.
• Reuse that identity across the root Agent and its subagents.
• Direct-message and existing-group conversation lists, unread counts, latest-message previews, and persisted display names. Core SQLite remains the persistent source of truth: the Host joins persisted peer profiles onto Direct roster rows, while the browser keeps the active identity's last trustworthy Direct profile and group title. Sparse polling identifiers therefore cannot overwrite a resolved display name or real group title. After an existing Handle is recovered, the Host synchronizes account projections before asking Core to restore old group memberships; pending or blocked groups expose a retryable status without disabling Direct messages or other groups. Opening a conversation renders the committed local timeline first, hydrates group sender labels from the Core display-profile cache, reconciles remote history and Direct profile data in the background, and keeps local messages visible if refresh fails. A failed background roster poll also leaves the usable local view quiet; explicit loads still surface their errors. This local-first path covers the newest projected page; loading older messages still requires the remote history service. Scrolling up reveals a latest-message control that counts newer arrivals without interrupting reading. A conversation is marked read only after its newest rendered message reaches the visible bottom.
• Create a private-discovery, open-join, transport-protected group from the Web UI with a name and 1–50 initial Handle or DID members. The group opens immediately; members that could not be added are reported without hiding the successfully created group.
• Text messages plus one attachment per message, with Enter-to-send, Shift+Enter line breaks, optimistic sending bubbles reconciled by an exact client message ID, image previews, and SHA verification. Verified image bytes use three bounded layers: a browser-runtime LRU makes conversation remounts immediate, identity-scoped IndexedDB survives full page reloads without a Host call, and the private Host disk cache survives browser-storage loss and Harness restarts. Clear Local Data removes all three layers.
• A draggable circular launcher that defaults to the lower-left sidebar area, adaptive popup placement, dark mode, and remembered active conversation.
• User-triggered AI summaries for up to 50 recent or unread messages, kept only in runtime memory with explicit stale, retry, copy, and source-navigation states.
• OTP identity access keeps the verification form visible and disables resend with a visible server-directed cooldown countdown. Handle classification happens before OTP delivery, so each attempt sends exactly one purpose-correct registration or recovery code.
• After Recovery V4 reaches applied, the Host activates the recovered identity immediately. Automatic restoration of the historical mailbox and canonical model billing account is currently deferred, so those optional account projections cannot block identity recovery. The Browser clears its blocking operation marker while Core retains the authoritative recovery journal; no recovery attestation or model reconciliation request is issued.
• When the separate @awiki/dsh-model-proxy package is installed, an AWiki-hosted DeepSeek choice appears before the official API-key onboarding step only when Harness has no usable model provider, with an explicit opt-in and an unchanged API-key escape path. New sessions do not show AWiki model or payment prompts after the official or another provider is usable.
• The optional model-proxy package owns the Host short-token flow and every model-hosting Browser surface: onboarding plus Settings → Quick Recharge with Account & Recharge and Usage tabs. It registers awiki-deepseek with deepseek-v4-flash and deepseek-v4-pro; Flash is recommended and credentials never enter the Browser.
• AWiki identity, domain, and local-data settings remain in the main package. Installing only the main package does not register model opt-in, recharge, usage, or model onboarding UI.
• A typed second confirmation in the Settings danger zone before permanently clearing local AWiki identity, key, token, registration-draft, and message-index state.
• Five messaging Agent tools: identity status, conversations, history, approved text send, and approved attachment send.
• A mail Web UI that selects, reviews, removes, and sends up to 10 bounded attachments, then explicitly downloads one metadata-matched attachment with Base64, size, and SHA-256 verification.
• Five on-demand mail Agent tools: mailbox account, inbox, plain-text read, approved mark-read, and approved plain-text send. Mail read exposes attachment metadata plus a Browser-UI-only download note; Agent mail send remains attachment-free because DSH has no authorized file-resource handle for this tool.
• An opt-in realtime listener that lets exact-allowlisted Direct peers continue one DSH Agent session or use /new, /status, and /help.

Screenshots

Messaging

Mail

The first release does not implement end-to-end encryption, multiple identities, post-creation group administration or multiple attachments in one message. The Agent listener accepts only plain Direct text; Groups, attachments, encrypted/payload content, and unknown slash commands never reach the Agent.

Mail remains on demand and does not wake an Agent for new mail, render or send HTML, or implement reply, forward, and threading. The Browser reads only user-selected File objects, freezes the approved draft during its one send attempt, and enforces the Host-provided count, single-file, and total-size limits before canonical Base64 crosses Remote. Attachment downloads are always explicit; the Browser matches the returned metadata and verifies canonical Base64, byte count, and SHA-256 before creating a temporary Blob URL, then revokes that URL immediately. It never auto-opens HTML, SVG, or another attachment. Sent history stores only the service message id, file metadata, and SHA-256, never attachment bytes. Mail subject, addresses, preview, body, timestamps, and attachment metadata are untrusted external data, never Agent instructions. awiki_mail_mark_read and awiki_mail_send require execution approval. Mail send is attempted once without automatic retry; a timeout or transport loss returns delivery-unknown, so inspect the mailbox before approving another send. The Agent tool does not accept attachment Base64 or local paths; attachment selection and download remain explicit Browser UI actions until Harness provides a formally authorized file-resource contract.

Identity recovery does not add server-side private-chat restoration. A fresh local state does not reconstruct historical Direct conversations; only ordinary data already retained by the Rust SDK continues to follow Core's existing local migration rules. Mailbox and hosted-model reconciliation are independent of that private-chat boundary.

Install

Install the official public npm package:

dsh plugin --profile web add @awiki/dsh-plugin@latest

The main package no longer installs the AWiki-hosted model provider. Add the independently versioned Model Proxy package only when that capability is wanted:

dsh plugin --profile web add @awiki/dsh-model-proxy@latest

The profile installer both adds the package and activates its bundle layer. A plain npm i @awiki/dsh-plugin in a DSH project only installs the package; it does not activate the bundle, so the profile command remains the recommended installation path. This release line targets the 0.1.1-rc.2 package family and pins every direct Host peer exactly, preventing npm from mixing prerelease families in a DSH root dependency tree.

@awiki/dsh-plugin is the canonical package identity starting with 0.2.0-rc.4. The former @awiki/dsh registry entry was unpublished and is not an installation source for this release line.

Apply the package after the normal DSH base and Web app bundles. Its The main cordis.patch.yml adds the AWiki Host service, Rust SDK provider, and summary provider; DSH discovers and injects the browser client through the package metadata. It does not insert Model Proxy. The optional package has its own patch, inserts exactly one awiki-model-proxy row after AWiki, and declares an explicit dependency on the loaded awiki service.

Configuration

The plugin works against the public awiki.ai tenant without environment configuration. Set these variables only when a deployment needs an override:

The default state directory is isolated by DSH profile. Desktop uses the Host's desktopProfiles.current.name; ordinary dsh --profile accepts the name only when the Loader root exactly matches $DSH_HOME/profiles/<name>. The plugin does not guess from argv, ports, or process type, and does not copy a legacy database automatically. The old shared awiki/im-core directory remains untouched. When it is detected, the identity screen explains the isolation and guides the user to recover with the original Handle and phone as a separate device.

AWiki-hosted DeepSeek account

This capability now requires the separate @awiki/dsh-model-proxy package. It uses ctx.awiki.externalHttpAuth to obtain a short-lived model token inside the Host and reuses the Harness DeepSeek adapter. The Browser receives only sanitized account, usage, and order state over a loopback RPC channel. DID signatures, bearer tokens, and upstream platform credentials are absent from the browser bundle.

The former runtime import @awiki/dsh-plugin/model-proxy has been removed. Use @awiki/dsh-model-proxy; the shared browser-safe contract intentionally remains @awiki/dsh-plugin/model-proxy-contract. Installing only the main package keeps model onboarding, account/recharge, and usage entry points hidden while leaving AWiki Advanced settings functional.

The stable split-package line uses @awiki/dsh-plugin@0.3.0; the standalone @awiki/dsh-model-proxy@0.1.0 package requires main ^0.3.0. This lower bound is the first main package that provides the shared awikiClient Browser bridge, and it also prevents combining the standalone package with a 0.2.x main package that still inserted the old runtime by default.

The optional package owns these configuration variables:

AWiki-hosted DeepSeek is disabled by default. Only an explicit choice in onboarding or Settings → Quick Recharge → Account & Recharge registers the awiki-deepseek route and selects Flash. Disabling restores the previous provider, model, and reasoning effort. A successful recharge refreshes the balance but never enables AWiki or changes the selected model automatically.

The settings UI supports both payment redirects and TongQiFu ALI_QR content. When payments are disabled it reports the development restriction without blocking an account whose model_access_available flag is true. Development bypass displays calculated and charged amounts separately, with zero charged; it does not invent a price when no price table is active. Public recharge creation also has a client release gate in packages/dsh-model-proxy/src/client/recharge-availability.ts. The current stable line ships that gate open. Order creation still requires the account response to report payments_available=true; otherwise the UI reports that payments are unavailable and sends no order RPC. The gate remains a single emergency rollback for the existing payment, polling, and cancellation flows. Strict billing keeps the internal billing-mode label out of the normal account summary. When the backend reports model_access_reason=insufficient_balance, recharge becomes the primary action and model enablement is withheld until credit is available. The Host restores the newest pending order and its payment action whenever the settings page is reopened, polls it without creating duplicates, and still requires an explicit model opt-in after payment. Recharge amounts are immutable after order creation. To choose another amount, the user confirms Cancel and change amount; the Host first closes the provider order, then restores the amount editor without creating a replacement. A close failure leaves the existing payment action available, while a payment that wins the race refreshes the credited account instead of being reported as cancelled.

The default AWiki tenant domain is awiki.ai. A local user can switch it from Settings → AWiki; DSH persists that choice in its settings document and applies it after the next Harness restart. Unless an endpoint has an explicit deployment override, the User, Message, Mail, attachment origin, and message- service DID routes are derived from the selected domain. Each domain uses an isolated local identity, message, cache directory, and browser recovery-operation key. Switching back restores that tenant's previous local state instead of rewriting its DID or keys.

The settings page talks to a plugin-owned Connection channel that the Host accepts only from loopback. This keeps an independently installed @awiki/dsh-plugin compatible with stock DSH releases without adding AWiki to a core settings allowlist; non-local browser origins cannot read or mutate the Host setting.

Settings → AWiki → Danger zone clears only this installation's local AWiki state; it does not delete the server-side account or Handle. The dialog requires the displayed confirmation phrase. After success, the local DID keys, access token, registration draft, conversations, attachment index, and cached image previews cannot be recovered by the app, and this installation may lose access to the old identity.

Ordinary sign-out is separate from that destructive action. It writes only a private Host-owned session marker, gates both Web and Agent operations, and retains the SDK-owned SecretVault identity, keys, tokens, conversations, attachment index, and cached image previews. Resume local identity removes the marker and reloads that identity without registration. The signed-out screen does not show a competing recovery path by default; phone recovery appears only after resume fails. Use another identity requires a checked destructive-data confirmation and returns to the unified Handle entry only after local clearing succeeds, where the same form creates a new identity or recovers an existing one.

The provider domain and message-service DID are protocol identifiers. Do not infer them from an API hostname. Production service URLs must use HTTPS. The IM Core state directory contains access material; keep it outside the repository, restrict filesystem access, and protect the underlying disk and backups.

The Node facade owns stateRoot/vault/root-key.b64u; the Host does not provide, copy, or log Vault key material. Preserve the complete SDK state root across ordinary restarts and upgrades.

The listener is disabled unless both DSH_AWIKI_LISTENER_ENABLED=true and a non-empty exact allowlist are configured. On startup and every Core realtime scheduling signal it runs canonical reliable sync before reading committed history. Core owns WebSocket connection and reconnect; stream closure is recovered as stop, reconnect sync, then replacement realtime session. One persisted route and message watermark per Direct conversation preserve the current DSH Session across restarts. Every AWiki-originated Session is created in and attached to the registered shared AWiki Workspace. Listener messages are untrusted user data and do not approve tools or bridge approval/user-question prompts.

For the default 10 MiB decoded attachment cap, configure a reverse-proxy request limit of at least 14 MiB to account for base64 and JSON overhead.

AI summary generation runs only after the user selects AI Summary. If a conversation had unread messages when it was opened, the Host summarizes that unread tail; otherwise it summarizes the newest 50 messages. The Host enforces the 50-message and UTF-8 limits, sends attachment metadata rather than file bytes, and treats serialized conversation content as untrusted data. Summaries are cached per conversation only for the current browser runtime and become stale, without another model call, when newer messages arrive. The replaceable @awiki/dsh-plugin/summary-provider uses the current Harness default provider and model for one direct ctx.llm.stream request; it does not create an Agent or write an Agent session.

External HTTP ANP authentication

Trusted same-process DSH Host plugins can authenticate an externally transported HTTP request without handling ANP signatures, access tokens, challenges, or retries themselves:

const response = await ctx.awiki.externalHttpAuth.dispatch(
  new Request('https://api.example.com/orders', {
    method: 'POST',
    headers: { 'content-type': 'application/json' },
    body: JSON.stringify({ productId: '123' }),
  }),
  request => fetch(request),
)

The callback remains the only network transport owner. AWiki buffers at most 4 MiB of exact body bytes, forces manual redirects, asks Rust to select an origin-scoped in-memory Bearer token or a fresh HTTP Message Signature, observes only authentication response headers, and invokes the transport at most twice for one bounded 401 authentication retry. The final Response body is untouched. Transport rejections preserve their original error identity.

The unsigned input must not contain Authorization, Signature-Input, Signature, or Content-Digest. Production targets require HTTPS; test-only loopback HTTP uses the existing allowInsecureLoopbackForTesting deployment gate. Tokens come only from successful Authentication-Info responses, are scoped to the current identity/signing key/origin, and are not persisted across Harness restarts.

externalHttpAuth is deliberately absent from Browser Remote, Agent tools, Typert Remote, and the Web client bundle. Exposing it across an untrusted boundary would create a signing oracle.

Development

Requirements: Node.js 22.19+ (or 24+) and pnpm 11.22.

pnpm install --frozen-lockfile
pnpm run verify:workspace
pnpm pack --dry-run

The production Host loads the exact @awiki/im-core-node@0.1.10 runtime package; the platform-specific native addon is selected through its optional dependencies and remains external to the JavaScript bundle. Consumers do not need Rust or an awiki-cli-rs2 checkout. See THIRD_PARTY_NOTICES.md for provenance and licensing.

The checked-in Typert Host/Remote artifacts were generated from the same Host contract. pnpm check:generated pins their complete eighteen-method surface until the standalone Typert generator supports root-level packages.

Security

Do not commit OTPs, access tokens, private keys, identity state, .env files, or remote-test reports. pnpm check:public enforces the public-tree guard before verification and packaging.

License

The plugin is MIT licensed. Its Rust IM Core runtime dependency is distributed under AGPL-3.0-only and remains subject to its own retained notices and license.