feat(workspace): add composable services with DSH 0.1.5 support

[Grivn]

摘要 / Summary

通过独立 Source、Workspace Strategy 和纯策略增强扩展项目上下文、日志、任务、会话、方法库、文件、协作、后台任务、审查、素材、通知与同步能力，并将设置改为符合 DSH 主题的紧凑控件和窄屏原生弹窗。Rebase 到 v0.5.8 main，使用已发布 DSH 0.1.5-rc.1 契约，保留默认三层组合、运行时容量维护和逐次外部动作审批。

Add independently owned workspace Sources, a complete Workspace Strategy and pure Strategy extensions, with native DSH settings controls and a narrow-screen dialog. Rebase onto v0.5.8 main with the published DSH 0.1.5-rc.1 contracts while preserving the default three-tier profile, runtime capacity maintenance and exact-call external-action approval.

关联 Issue 或背景 / Related Issue or Context

N/A — 维护者在本任务中明确要求扩展插件能力、调整设置 UI、同步 main 并提交新 PR。DSH 0.1.5 报错 #223 与 #225 已由合入 main 的 #226 修复；本 PR 保留该修复并适配新增插件，没有重复关闭这些 Issue。

N/A — The maintainer explicitly requested this plugin expansion, settings refinement, main synchronization and new PR in the task. Issues #223 and #225 were already addressed by #226 on main; this PR retains that fix and adapts the additional plugins.

涉及区域 / Affected Areas

• Host 激活、Headless 或 bundle / Host activation, Headless, or bundle
• 运行时记忆 / Runtime Memory
• 项目档案 / Project Documents
• 记忆空间或 Provider / Memory Spaces or Providers
• 子 Agent 或 Agent 工作流 / Subagent or Agent workflow
• Web UI 或对话交互 / Web UI or conversation interaction
• 设置、存储或安全 / Settings, storage, or security
• CLI、RPC、命令或工具 / CLI, RPC, commands, or tools
• 安装、更新或发布 / Installation, update, or release
• 测试、构建或文档 / Tests, build, or documentation
• 其他（请说明）/ Other (explain below)

PR 类型 / PR Type

• 面向用户的功能或行为变更 / User-facing feature or behavior change
• Bug 修复 / Bug fix
• 增强或优化 / Enhancement or optimization
• 兼容性适配 / Compatibility change
• 维护或重构 / Maintenance or refactor
• 测试或构建 / Tests or build

最新代码确认 / Latest Codebase Confirmation

• 我已基于最新 main 分支开发，或在提交前已 rebase 或合并最新 main。 / I developed from the latest main, or rebased or merged the latest main before submitting.

同步命令 / Sync command:

git fetch origin main codex/composable-workspace-context
git rebase --rebase-merges origin/main

2026-09-12：已 rebase 到 main 8f3ce5e（v0.5.8），保留已有合并结构与手动兼容性修复。当前提交为 bde75c5。上游审阅保护、运行时归档预检、路由回退、稳定结果工具与侧栏修复均已纳入，独立插件依赖图和此前构建、搜索修复保留。

Rebased onto main 8f3ce5e (v0.5.8), preserving merge history and manual compatibility resolutions. Current head: bde75c5. Upstream review guards, runtime archive preflight, routing fallback, stable result tools and sidebar fixes are included; the independent plugin graph and prior build/search fixes are preserved.

AI 编码披露 / AI Coding Disclosure

• 完全 AI 编码：全部编程改动由 AI 产出，贡献者的最终代码审查待完成。 / Fully AI-coded: AI produced all programming changes; final contributor code review is pending.
• 部分 AI 辅助：AI 帮助编写或修改了部分内容。 / Partially AI-assisted: AI helped write or modify part of the change.
• 未使用 AI 编码辅助。 / No AI coding assistance was used.

使用的 AI 模型 / AI model used:

GPT-6

使用的编码 Agent 工具 / Coding Agent tool used:

Codex desktop. 自动化检查与实现审阅由 Codex 执行；不宣称已经完成人工审查。 / Codex performed the automated checks and implementation review; human review is not claimed.

仓库规范检查 / Repository Rules

• 未修改 DSH 官方源码，未让 tsconfig 指向 DSH 源码 checkout，仅使用正式的 @deepseek-ai/* NPM 契约。 / I did not modify DSH source or point tsconfig at a DSH source checkout, and used only published @deepseek-ai/* NPM contracts.
• Client 与 Host 边界仍以浏览器安全的 src/host/protocol.ts 为准，没有在两侧重复定义 wire DTO。 / The Client and Host boundary still uses browser-safe src/host/protocol.ts as the source for wire DTOs.
• 持久化格式、RPC 权限、路径或凭据处理的变更包含兼容或拒绝路径、安全分析和相应测试。 / Changes to persistence formats, RPC authority, paths, or credentials include compatibility or rejection paths, security analysis, and tests.
• 没有提交 token、密钥、私有记忆、未脱敏日志或生成的 lib/ 文件。 / I did not commit tokens, credentials, private memory, unredacted logs, or generated lib/ files.
• 用户可见文案和长期文档已同步维护中文与英文版本，命令、配置键和路径保持一致。 / User-facing copy and long-lived documentation are synchronized in Chinese and English, with matching commands, configuration keys, and paths.
• 会改变发布制品或其元数据的 PR 已添加 changeset；仅测试、CI 或站点文档变更可不添加。 / A PR that changes a published artifact or its metadata includes a changeset; test-only, CI-only, and site-documentation-only changes may omit one.
• 新增和修改的代码、注释、文档、提交信息不含 emoji。 / New and modified code, comments, documentation, and commits contain no emoji.

兼容性与数据安全 / Compatibility and Data Safety

新增能力由可单独安装、测试、构建和停用的插件拥有；Root 仅提供公开契约、Host、通用管理界面与默认 Starter。数据由各 Source 按项目/全局/会话作用域持有，持久修订、原子提交、损坏输入拒绝、来源与回执均有测试。停用插件保留其数据；新增组合是可选配置，原有三层默认行为保留。

Each plugin can be installed, tested, built and disabled independently. Root owns public contracts, Host, shared management UI and the default Starter. Sources own scoped records, revisions, atomic commits, rejection paths, provenance and receipts. Disabling a plugin retains its data; the new composition is optional and the existing three-tier default remains.

进程执行、会话投递、提示词调用、文件同步及通知发送均保留明确计划、范围限制和逐次审批；批准绑定当前动作和参数，执行时重查权限与版本。只用合成数据、本机模型/通知接收器和本机 Git 仓库验收；没有使用第三方账号或发送外部通知。

External actions retain bounded plans, scoped authority and exact-call approval. Execution rechecks current authority and revisions. Validation uses synthetic records, a local model, loopback notification receivers and local Git repositories; no third-party accounts or external notification delivery were used.

开发验证固定使用 DSH 0.1.5-rc.1 的公开制品；独立插件显式声明所需的间接开发 peer，公开运行时 peer 兼容范围保持不变。旧会话修复入口从 main 保留，默认写副本；本任务没有修改个人历史。新版可省略文字的反馈不会生成虚构日志；集中式工作区保留显式检查选择。真实 Mnemon 0.2.7 已通过隔离读写验证。

Development validation pins published DSH 0.1.5-rc.1 artifacts, including the required transitive development peers of standalone plugins. Public runtime peer compatibility ranges are unchanged. The upstream copy-first legacy-session recovery command is retained; personal history was untouched. Textless feedback does not create fabricated journal entries, and centralized workspace inspection remains explicit. Real Mnemon 0.2.7 passed isolated read/write validation.

本地验证 / Local Validation

执行的命令 / Commands run on the rebased code:

pnpm install --frozen-lockfile
pnpm run verify
pnpm run verify:plugins --skip-build
pnpm test
MNEMON_NATIVE_TEST_CLI=/path/to/verified/mnemon pnpm --filter dsh-mnemon-source-memory-spaces exec vitest run tests/native-integration.spec.ts
CHANGESET_BASE_REVISION=8f3ce5e1b275f4ecdce5e0dcd13416a112c6c989 pnpm run release:intent
pnpm run verify:docs

结果摘要 / Result summary — 2026-09-12:

• verify: 1,018 root tests passed, 5 opt-in skips; all 35 plugin builds, type checks and tests, deterministic builds, package contents, public imports, publint and declarations passed. / 根测试 1,018 项通过，5 项 opt-in 跳过；35 个插件构建、类型与测试及公开包验证通过。
• Integrated pnpm test: 1,446 passed, 7 opt-in skips across 177 files. / 集成测试在 177 个文件中通过 1,446 项，另 7 项 opt-in 跳过。
• verify:plugins --skip-build: all 35 standalone plugin repositories and 36 packed artifacts passed, including the external SDK/Client consumer, real DSH Starter upgrade and optional Strategy activation. This reused the already verified Root artifacts; every standalone plugin built from its own sources. / 35 个独立插件仓库、36 个制品、外部 SDK/Client 消费者及真实 DSH 安装与策略启用全部通过；仅复用已验证的 Root 制品，各插件仍从自身源码独立构建。
• DSH 0.1.5 Headless: 39 tools including 8 representative Mnemon tools, restart, canonical Builtin and disabled Starter passed. Real Mnemon: isolated create/write/recall/forget passed. / 真实 Headless 启动与重启、内置模式和停用 Starter 检查通过；真实 Mnemon 创建、写入、召回、删除通过。
• Public package: 48 files, 1,347,922 unpacked bytes, 12 Node imports, 28 public type dependencies and executable help passed. Frozen installation left the lockfile unchanged; release intent and bilingual documentation checks passed. / 公开包内容、12 个 Node 入口、28 个类型依赖及命令帮助检查通过；冻结安装未修改 lockfile，changeset 与双语文档检查通过。
• Reviewed the three upstream background-review warnings and updated the combined bilingual baseline to 983 keys per language. / 核对上游新增的三条后台审查提示后，将组合文案基线更新为每种语言 983 项。
• Standalone development installation now declares the complete required DSH peer set at the tested rc.1 versions. This fixes npm mixing newly available rc.2 peers with pinned rc.1 development dependencies. The lockfile adds only importer entries; resolved packages and snapshots are unchanged. The complete local verify and independent artifact checks passed after this correction. / 独立开发安装已补齐固定 rc.1 的必要 DSH peer，修复 npm 选择新 rc.2 间接依赖导致的冲突；lockfile 仅新增导入条目，包版本与解析图不变。修正后的完整本机与独立制品验证通过。
• Final bde75c5: CI run 34692589126 passed both Node 22.19 source verification (including Node 20 public imports) and Node 24 packed-plugin verification. Draft-only policy workflows are skipped. / 最终提交的源码与独立制品两项 CI 全部通过，含 Node 20 公开入口检查；PR 规范工作流因草稿状态跳过。
• Live Flash quality/stress and Windows-specific opt-in checks were not run; controlled suites do not certify external accounts or model quality. / 未运行真实 Flash 质量/压力与 Windows 专用 opt-in 检查；可控测试不代表外部账号或模型质量。

用户可见变更证据 / Local Feature Evidence

证据 / Evidence:

完整双语验收记录 / Full bilingual validation record includes the recorded desktop/mobile flows, scope isolation, rejected edits, exact approvals, durable receipts and the dated automated results after rebasing onto v0.5.8 main.

以下图片属于同步 main 之前的设置 UI revision 1c272ae，只作为该版功能记录。 / These screenshots belong to the pre-sync settings UI revision 1c272ae and document that revision only.

2026-09-10 的完整 DSH 0.1.5 服务环境已成功启动，但当时内置浏览器与 Chrome 均以 ERR_BLOCKED_BY_CLIENT 阻止访问，未获得同步后的新页面截图。本轮 rebase 完成自动化回归，尚未重做 WebUI 验收。因此 PR 保持 Draft；合并前仍需复查集中式存储布局及新版设置流程。

The complete DSH 0.1.5 service profile started successfully on September 10, but the in-app browser and Chrome then blocked navigation with ERR_BLOCKED_BY_CLIENT, so no post-sync screenshots were obtained. This rebase completes automated regression checks without a new WebUI acceptance run. The PR remains a draft pending a browser recheck of centralized storage layout and the combined settings flow before merge.