@dsh-enhanced/assistant-delivery 0.1.3 → 0.1.5

package/README.md

@@ -44,8 +44,6 @@ Patch 通过 `inject: [assistantPolicy]` 固定加载策略依赖；入站 Agent
 | `defaultAgentPreset` | `standard` | 新 session 解析并挂载的 preset；该内置 preset 提供 Bash、文件、检索、Skills 等完整编码能力 |
 | `policyRef` | `owner-dm` | 固化在 binding 上的策略引用标签 |
 | `agentProvider` / `agentModel` | `deepseek-official` / `deepseek-v4-flash` | 渠道 Agent 的部署默认模型；会话可用 `/model` 覆盖 |
-| `toolCapableProviders` | `[deepseek-official]` | 尚未发布 registry metadata 的上游原生工具 provider 审计列表；在 `unknownRouteToolCalls: deny` 下作为白名单生效 |
-| `unknownRouteToolCalls` | `allow` | 未发布任何工具能力声明的 route 如何准入；`deny` 切换为严格白名单。provider 显式声明 `none` 时两种取值都 fail closed |
 | `agentMaxOutputTokens` | `8192` | 单轮模型输出上限 |
 | `modelPickerTtlMs` | `900000` | `/model` 选择卡片的签名提交有效期；范围 1 分钟至 24 小时 |
 | `permissionPickerTtlMs` | `900000` | `/permissions` 三档权限卡片的签名提交有效期；范围 1 分钟至 24 小时 |
@@ -106,6 +104,7 @@ rules:
 - 429/明确 5xx 未发送应给出 `retryable` 与可选 `retryAfterMs`；永久 4xx 进入 dead。
 - 请求可能已到平台但 response 丢失时返回 `unknown`。若声明 `reconcileUnknownSend` capability，必须实现对账，并使用独立的有界对账 attempt；连续无法判定达到上限后进入 dead，释放同 lane 后续消息。未声明该能力时记录保持 `unknown_after_send`，不会被领取为空对账 attempt，直到 owner 显式 retry/cancel。
 - receipt 必须带同一个 channel、account、provider message id；状态只允许单调 `accepted→delivered→read`。
+- `progress()` 收到的工具参数/结果仅是最多 1500 字符的展示预览，并会脱敏常见 credential 字段与 token 形态；畸形或原始输入过大的参数只产生状态标记，不回显 raw text。它不包含任何 reasoning/thinking 内容或 provider 原始错误。adapter 仍必须按当前受众决定是否展示明细，群聊等共享受众应保持 status-only。
 - adapter 的 socket、timer、SDK client 和 listener 必须由 `start()` disposer 释放。
 
 内部身份始终是结构化的 `ExternalPrincipalKey`、`ConversationRef` 与 `ConversationBinding`，不会从 `platform:chat:thread` 字符串反解析路由。DM 不允许 thread；group 入口要求渠道提供显式且稳定的 thread，可以是真实 provider root，也可以是渠道命名空间内按 principal 派生的顶层合成 lane。binding 仍固定精确 principal，任何同 conversation 的另一 principal 都会在进入 session 前 dead-letter，不能共享既有 owner 上下文。Lark 顶层群消息使用按发送者派生的合成 lane，真实回复串继续按 `root_id` 隔离。
@@ -150,7 +149,7 @@ rules:
 
 `/model` 从宿主 `ctx.llm` 的实时 provider/model 目录生成受限的 typed `model-picker` intent，不发起模型生成；每个模型会显式关联它自己的 `effortIds`，而不是共享全局 effort 并集。支持它的渠道可以据此显示“分组、模型、effort”三级联动选择和确认按钮，不支持它的渠道会把该 intent 明确拒绝而不会降级为任意卡片 JSON。持久 selection 会先投影为不含 `updatedAt/version` 的纯路由再进入严格 intent 边界；如果目录中的异常数据仍使卡片校验失败，系统会立即退回完整纯文本目录，确定性校验错误不会重试。某个 provider 或模型能力解析失败不影响其他项，最多载入 20 个 provider、50 个模型、每模型 20 档 effort，并且全目录最多 20 个不同 effort id。
 
-卡片提交后，Delivery 会再次核对 active binding、精确 principal/chat 和 Policy，并用实时 `resolveModelInfo()` 验证 provider/model 及该模型支持的 effort；通过后把三项选择按 canonical conversation 持久化到 Delivery SQLite。选择从下一条普通消息生效，保留当前 session 上下文，跨 `/new` 和 Host 重启仍有效。卡片可选择“默认（由模型决定）”；`/model use` 保留为无卡片渠道和排错时的文字后备，`/model reset` 删除会话覆盖并恢复 `agentProvider` / `agentModel`。模型目录按宿主约定是建议性的，最终调用是否成功仍由对应 adapter 和账号认证决定。
+卡片提交后，Delivery 会再次核对 active binding、精确 principal/chat、原始 provider message id 和 Policy，并用实时 `resolveModelInfo()` 验证 provider/model 及该模型支持的 effort；通过后把三项选择按 canonical conversation 持久化到 Delivery SQLite。渠道可以等待该 durable settlement：同实例由完成通知即时唤醒，共享数据库的另一实例完成时由有界轮询感知，从而把原卡更新成不可交互的最终结果。选择从下一条普通消息生效，保留当前 session 上下文，跨 `/new` 和 Host 重启仍有效。卡片可选择“默认（由模型决定）”；`/model use` 保留为无卡片渠道和排错时的文字后备，`/model reset` 删除会话覆盖并恢复 `agentProvider` / `agentModel`。模型目录按宿主约定是建议性的，最终调用是否成功仍由对应 adapter 和账号认证决定。若某个已持久化的显式 effort 在下一条普通消息前被 DSH 核心判为不支持，Delivery 会在任何 prompt 或 durable dispatch 标记之前，以 version CAS 仅清除该 effort、重新预检同一 provider/model 的默认档位；CAS 冲突会重试而不会覆盖更晚的 `/model` 选择。模型不会被静默替换，也不会重放或重复计费。
 
 `/permissions`（别名 `/permission`）只允许当前 active binding 的精确 owner 使用，命令本身不会进入 Agent 或触发 LLM。支持 typed `permission-picker` 的私聊渠道会显示“请求批准（ask）/帮我批准（auto）/完全访问权限（full）”三档卡片并标出当前档位；不支持卡片或渲染失败时自动退回含同等信息的文字命令。前两档都使用 `workspace-write + ask`，区别是持久 reviewer 为 `user` 或 `auto-review`。`full` 使用 `danger-full-access + never + none`，可访问网络及任意文件；卡片按钮带原生风险确认，文字入口则由 `/permission full` 显示橙色警告，必须再次发送 `/permission full confirm` 才切换。
 
@@ -164,7 +163,7 @@ rules:
 
 权限命令在第一次 reviewer/policy/sandbox mutation 前还必须先取得 Inbox 的 durable dispatch/recovery marker；每个异步边界后都复核 abort 与租约。若进程退出、续租失败、flush 未确认、依赖尚未就绪或回复入队失败，该 marker 会绕过普通 `maxAttempts`，在原 binding 串行 lane 中继续恢复，直到确认已持久化目标并补发成功终态，或安全收敛到 ask 后补发失败/取消终态。`/stop` 和 `/new` 会在 abort 前把正在执行的权限命令原子改标为 cancelled recovery；旧命令不会以 `processor-ambiguous` 终止，也不会从原始文本重新制造一次可能已取消的 full 提权。
 
-普通消息真正 resume Agent 时，Delivery 会在 preset 挂载完成后检查最终 scoped tool schemas。非空工具时，provider 通过 `@dsh-enhanced/llm-route-capabilities` 声明 `native`/`bridge` 即放行。DSH 的 `generate` 契约对所有 adapter 都接受 `tools`，因此工具调用是 adapter 基线能力：未发布任何声明的 route（pi-ai 等内置/网关 provider 从不发布 registry metadata）默认按 `unknownRouteToolCalls: allow` 准入，避免整类可用 route 被误拒。需要严格白名单的部署设为 `deny`，此时只放行 `toolCapableProviders`。provider 显式声明 `none` 时始终 fail closed，不受上述任何一项影响。Claude、Cursor、Grok 和 Codex CLI 等 text-only route 因此会在 `followup()`、认证和子进程之前返回可操作的 `/model` 提示；显式 opt-in 的 Codex direct route 声明 `native`，可把 function call 交回同一个 DSH Agent Loop 执行。fresh session 创建本身不执行模型，仍可先持久建立 binding。最终工具为空时不要求能力声明。
+普通消息真正 resume Agent 时，Delivery 先解析并挂载 binding 固定的 preset，再把该 Agent 的最终 scoped tool schemas 原样交给当前 provider/model。工具和 Skills 属于 Agent/preset，模型切换不会改变它们的可见集合，Delivery 也不维护 provider 工具白名单或部署侧能力名单。协议元数据缺失、`native` 和 `bridge` 都会放行；只有 adapter 主动声明 `toolCalls: none` 且最终 scope 非空时，才会在 prompt 发送前因“未实现统一 DSH tool-call 协议”失败关闭。这个检查描述 adapter 的传输实现，不是模型权限或能力分级；实际工具执行仍逐次经过 ToolRuntime、Policy、sandbox、审批、身份与预算检查。fresh session 创建本身不执行模型，仍可先持久建立 binding。
 
 只注册两个模型工具：
 

package/cordis.patch.yml

@@ -21,8 +21,6 @@
         policyRef: owner-dm
         agentProvider: deepseek-official
         agentModel: deepseek-v4-flash
-        toolCapableProviders:
-          - deepseek-official
         agentMaxOutputTokens: 8192
         modelPickerTtlMs: 900000
         permissionPickerTtlMs: 900000

package/lib/agent-runtime.d.ts

@@ -26,11 +26,16 @@ interface DshDeliveryRuntimeOptions {
     policyRef: string;
     provider: string;
     model: string;
-    toolCapableProviders: ReadonlySet<string>;
-    unknownRouteToolCalls: 'allow' | 'deny';
     maxOutputTokens: number;
     permissionPickerTtlMs: number;
     getModelSelection(conversation: ConversationRef): ConversationModelSelection | undefined;
+    /** Atomically remove a stale explicit effort without overwriting a newer model choice. */
+    clearStaleModelReasoningEffort(conversation: ConversationRef, expected: ConversationModelSelection): {
+        applied: false;
+    } | {
+        applied: true;
+        selection: ConversationModelSelection;
+    };
     imageMaterializer: Pick<InboundImageMaterializer, 'materialize'>;
     isInboundAuthorized(binding: Readonly<ConversationBinding>, envelope: Readonly<InboundEnvelope>): boolean;
     isPermissionController(binding: Readonly<ConversationBinding>, envelope: Readonly<InboundEnvelope>): boolean;
@@ -60,15 +65,14 @@ interface ModelCommandReply {
     fallbackText?: string;
 }
 /**
- * Convert one durable session fact into a deliberately narrow, user-visible progress update.
- * Raw reasoning chunks, tool arguments, result content, and error details never cross this boundary.
+ * Convert one durable session fact into a bounded, user-visible progress update.
+ * Reasoning/thinking content and provider error messages never cross this boundary. Tool calls/results
+ * contribute bounded previews with common credential shapes redacted; the channel still decides
+ * whether its current audience is private enough to render those previews.
  *
- * The `reasoning` block of a durable `assistant/message` is the assistant's own settled summary of
- * the step, not a streaming fragment, so it is the one reasoning form safe to surface. Only some
- * providers emit it at all: subscription CLIs declare an effort capability but still return text
- * only, and the ACP thought channel is not mapped to DSH reasoning yet. `step/start` therefore also
- * yields a neutral phase label, so a turn reports progress even on providers that never reason
- * out loud.
+ * A DSH `reasoning` block is explicitly thinking content and is not guaranteed to be a public
+ * summary, even after assembly into `assistant/message`. `step/start` therefore provides the only
+ * reasoning-independent phase label, so a turn reports progress without exposing hidden thought.
  */
 export declare function deliveryProgressFromSessionEvent(event: SessionEvent): DeliveryProgressUpdate | undefined;
 export declare function permissionStateHash(events: readonly SessionEvent[], tableFingerprint?: string): string;
@@ -88,6 +92,13 @@ export declare class DshDeliveryRuntime implements DeliveryInboundRuntime {
     /** Wait for only the turn that claims Delivery's exact message identity. */
     private followupTurn;
     private setupAgent;
+    /**
+     * DSH validates an explicit reasoning effort before calling an adapter. That is normally the
+     * right contract, but a persisted external-channel selection can outlive a provider's live
+     * model directory. Clear only that stale persisted effort before a prompt crosses the durable
+     * dispatch boundary; TraeX still rechecks the newly created ACP session afterwards.
+     */
+    private resolveExecutionRoute;
     private reconcileNativeFullPermissionReviewer;
     private runPermissionCommand;
     createSession(input: {

package/lib/agent-runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-runtime.d.ts","sourceRoot":"","sources":["../src/agent-runtime.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAElD,OAAO,EAEL,KAAK,KAAK,EAGX,MAAM,wBAAwB,CAAA;AAC/B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAA;AAUlE,OAAO,EAA2B,KAAK,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAMrF,OAAO,EAKL,KAAK,sBAAsB,EAC5B,MAAM,gCAAgC,CAAA;AAEvC,OAAO,KAAK,EACV,qBAAqB,EACrB,oBAAoB,EAEpB,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACvB,MAAM,kBAAkB,CAAA;AAEzB,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAA;AACnE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAA;AAS1D,OAAO,KAAK,EACV,mBAAmB,EACnB,0BAA0B,EAC1B,eAAe,EACf,sBAAsB,EACtB,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,sBAAsB,EAEvB,MAAM,YAAY,CAAA;AAEnB,OAAO,QAAQ,sBAAsB,CAAC;IACpC,UAAU,gBAAgB;QACxB,QAAQ,EAAE;YACR,IAAI,EAAE,UAAU,CAAA;YAChB,OAAO,EAAE,MAAM,CAAA;YACf,OAAO,EAAE,MAAM,CAAA;YACf,OAAO,EAAE,MAAM,CAAA;YACf,KAAK,EAAE,WAAW,CAAA;SACnB,CAAA;KACF;CACF;AAED,UAAU,yBAAyB;IACjC,gBAAgB,EAAE,MAAM,CAAA;IACxB,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;IACnB,eAAe,IAAI,IAAI,CAAC,YAAY,EAAE,OAAO,GAAG,SAAS,CAAC,GAAG,SAAS,CAAA;IACtE,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IACzC,qBAAqB,EAAE,OAAO,GAAG,MAAM,CAAA;IACvC,eAAe,EAAE,MAAM,CAAA;IACvB,qBAAqB,EAAE,MAAM,CAAA;IAC7B,iBAAiB,CAAC,YAAY,EAAE,eAAe,GAAG,0BAA0B,GAAG,SAAS,CAAA;IACxF,iBAAiB,EAAE,IAAI,CAAC,wBAAwB,EAAE,aAAa,CAAC,CAAA;IAChE,mBAAmB,CACjB,OAAO,EAAE,QAAQ,CAAC,mBAAmB,CAAC,EACtC,QAAQ,EAAE,QAAQ,CAAC,eAAe,CAAC,GAClC,OAAO,CAAA;IACV,sBAAsB,CACpB,OAAO,EAAE,QAAQ,CAAC,mBAAmB,CAAC,EACtC,QAAQ,EAAE,QAAQ,CAAC,eAAe,CAAC,GAClC,OAAO,CAAA;IACV,iGAAiG;IACjG,wBAAwB,CACtB,OAAO,EAAE,QAAQ,CAAC,mBAAmB,CAAC,EACtC,QAAQ,EAAE,QAAQ,CAAC,eAAe,CAAC,GAClC,OAAO,CAAA;IACV,iBAAiB,CAAC,YAAY,EAAE,eAAe,GAAG,MAAM,CAAA;IACxD,kBAAkB,CAAC,KAAK,EAAE;QACxB,YAAY,EAAE,eAAe,CAAA;QAC7B,aAAa,EAAE,MAAM,CAAA;QACrB,KAAK,CAAC,EAAE,aAAa,CAAA;KACtB,GAAG;QAAE,OAAO,EAAE,KAAK,CAAA;KAAE,GAAG;QAAE,OAAO,EAAE,IAAI,CAAC;QAAC,SAAS,CAAC,EAAE,0BAA0B,CAAA;KAAE,CAAA;IAClF,gBAAgB,EAAE,MAAM,CAAA;IACxB,QAAQ,CACN,OAAO,EAAE,QAAQ,CAAC,mBAAmB,CAAC,EACtC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,sBAAsB,GAC7B,OAAO,CAAC,IAAI,CAAC,CAAA;IAChB,YAAY,CACV,OAAO,EAAE,QAAQ,CAAC,mBAAmB,CAAC,EACtC,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,iBAAiB,EACxB,cAAc,CAAC,EAAE,MAAM,GACtB,IAAI,CAAA;IACP,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,GAAG,IAAI,CAAA;CACrE;AAED,UAAU,iBAAiB;IACzB,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,CAAC,EAAE,UAAU,GAAG,cAAc,GAAG,mBAAmB,GAAG,OAAO,CAAA;IACpE,WAAW,CAAC,EAAE,iBAAiB,CAAA;IAC/B,gBAAgB,CAAC,EAAE,sBAAsB,CAAA;IACzC,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAmHD;;;;;;;;;;GAUG;AACH,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,YAAY,GAAG,sBAAsB,GAAG,SAAS,CA0CxG;AAkMD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,EAAE,gBAAgB,SAAK,GAAG,MAAM,CAalG;AAED,wBAAgB,2BAA2B,CAAC,YAAY,EAAE,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAU5G;AA2CD,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAUvG;AA8SD,qBAAa,kBAAmB,YAAW,sBAAsB;IAK7D,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAN1B,QAAQ,CAAC,eAAe,EAAG,UAAU,CAAS;IAC9C,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAA0C;gBAG7D,GAAG,EAAE,OAAO,EACZ,MAAM,EAAE,sBAAsB,EAC9B,OAAO,EAAE,yBAAyB;IAG/C,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,EAAE,KAAK,GAAG,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAwBrG,OAAO,CAAC,mBAAmB;IAwB3B,OAAO,CAAC,iBAAiB;YAMX,yBAAyB;IAwBvC,4EAA4E;IAC5E,OAAO,CAAC,YAAY;YA2CN,UAAU;YAqBV,qCAAqC;YASrC,oBAAoB;IAmb5B,aAAa,CAAC,KAAK,EAAE;QACzB,QAAQ,EAAE,QAAQ,CAAC,eAAe,CAAC,CAAA;QACnC,UAAU,EAAE,MAAM,CAAA;QAClB,QAAQ,CAAC,EAAE,QAAQ,CAAC,mBAAmB,CAAC,CAAA;QACxC,MAAM,EAAE,WAAW,CAAA;KACpB,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAqEvF,OAAO,CACX,OAAO,EAAE,QAAQ,CAAC,mBAAmB,CAAC,EACtC,QAAQ,EAAE,QAAQ,CAAC,eAAe,CAAC,EACnC,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,QAAQ,CAAC,qBAAqB,CAAC,GACvC,OAAO,CAAC,oBAAoB,CAAC;IAmDhC,OAAO,CAAC,mBAAmB;IAiB3B,OAAO,CAAC,WAAW;YAkBL,iBAAiB;IA2LzB,OAAO,CACX,OAAO,EAAE,QAAQ,CAAC,mBAAmB,CAAC,EACtC,QAAQ,EAAE,QAAQ,CAAC,eAAe,CAAC,EACnC,WAAW,EAAE,WAAW,EACxB,QAAQ,CAAC,EAAE,QAAQ,CAAC,sBAAsB,CAAC,EAC3C,eAAe,CAAC,EAAE,sBAAsB,GACvC,OAAO,CAAC,oBAAoB,CAAC;YA+ClB,iBAAiB;CA8PhC"}
+{"version":3,"file":"agent-runtime.d.ts","sourceRoot":"","sources":["../src/agent-runtime.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAElD,OAAO,EAEL,KAAK,KAAK,EAGX,MAAM,wBAAwB,CAAA;AAC/B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAA;AAUlE,OAAO,EAAiD,KAAK,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAM3G,OAAO,EAKL,KAAK,sBAAsB,EAC5B,MAAM,gCAAgC,CAAA;AAEvC,OAAO,KAAK,EACV,qBAAqB,EACrB,oBAAoB,EAEpB,oBAAoB,EACpB,sBAAsB,EACtB,sBAAsB,EACvB,MAAM,kBAAkB,CAAA;AAEzB,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAA;AACnE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAA;AAS1D,OAAO,KAAK,EACV,mBAAmB,EACnB,0BAA0B,EAC1B,eAAe,EACf,sBAAsB,EACtB,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,sBAAsB,EAEvB,MAAM,YAAY,CAAA;AAEnB,OAAO,QAAQ,sBAAsB,CAAC;IACpC,UAAU,gBAAgB;QACxB,QAAQ,EAAE;YACR,IAAI,EAAE,UAAU,CAAA;YAChB,OAAO,EAAE,MAAM,CAAA;YACf,OAAO,EAAE,MAAM,CAAA;YACf,OAAO,EAAE,MAAM,CAAA;YACf,KAAK,EAAE,WAAW,CAAA;SACnB,CAAA;KACF;CACF;AAED,UAAU,yBAAyB;IACjC,gBAAgB,EAAE,MAAM,CAAA;IACxB,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;IACnB,eAAe,IAAI,IAAI,CAAC,YAAY,EAAE,OAAO,GAAG,SAAS,CAAC,GAAG,SAAS,CAAA;IACtE,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,eAAe,EAAE,MAAM,CAAA;IACvB,qBAAqB,EAAE,MAAM,CAAA;IAC7B,iBAAiB,CAAC,YAAY,EAAE,eAAe,GAAG,0BAA0B,GAAG,SAAS,CAAA;IACxF,0FAA0F;IAC1F,8BAA8B,CAC5B,YAAY,EAAE,eAAe,EAC7B,QAAQ,EAAE,0BAA0B,GACnC;QAAE,OAAO,EAAE,KAAK,CAAA;KAAE,GAAG;QAAE,OAAO,EAAE,IAAI,CAAC;QAAC,SAAS,EAAE,0BAA0B,CAAA;KAAE,CAAA;IAChF,iBAAiB,EAAE,IAAI,CAAC,wBAAwB,EAAE,aAAa,CAAC,CAAA;IAChE,mBAAmB,CACjB,OAAO,EAAE,QAAQ,CAAC,mBAAmB,CAAC,EACtC,QAAQ,EAAE,QAAQ,CAAC,eAAe,CAAC,GAClC,OAAO,CAAA;IACV,sBAAsB,CACpB,OAAO,EAAE,QAAQ,CAAC,mBAAmB,CAAC,EACtC,QAAQ,EAAE,QAAQ,CAAC,eAAe,CAAC,GAClC,OAAO,CAAA;IACV,iGAAiG;IACjG,wBAAwB,CACtB,OAAO,EAAE,QAAQ,CAAC,mBAAmB,CAAC,EACtC,QAAQ,EAAE,QAAQ,CAAC,eAAe,CAAC,GAClC,OAAO,CAAA;IACV,iBAAiB,CAAC,YAAY,EAAE,eAAe,GAAG,MAAM,CAAA;IACxD,kBAAkB,CAAC,KAAK,EAAE;QACxB,YAAY,EAAE,eAAe,CAAA;QAC7B,aAAa,EAAE,MAAM,CAAA;QACrB,KAAK,CAAC,EAAE,aAAa,CAAA;KACtB,GAAG;QAAE,OAAO,EAAE,KAAK,CAAA;KAAE,GAAG;QAAE,OAAO,EAAE,IAAI,CAAC;QAAC,SAAS,CAAC,EAAE,0BAA0B,CAAA;KAAE,CAAA;IAClF,gBAAgB,EAAE,MAAM,CAAA;IACxB,QAAQ,CACN,OAAO,EAAE,QAAQ,CAAC,mBAAmB,CAAC,EACtC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,sBAAsB,GAC7B,OAAO,CAAC,IAAI,CAAC,CAAA;IAChB,YAAY,CACV,OAAO,EAAE,QAAQ,CAAC,mBAAmB,CAAC,EACtC,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,iBAAiB,EACxB,cAAc,CAAC,EAAE,MAAM,GACtB,IAAI,CAAA;IACP,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,iBAAiB,GAAG,IAAI,CAAA;CACrE;AAED,UAAU,iBAAiB;IACzB,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,CAAC,EAAE,UAAU,GAAG,cAAc,GAAG,mBAAmB,GAAG,OAAO,CAAA;IACpE,WAAW,CAAC,EAAE,iBAAiB,CAAA;IAC/B,gBAAgB,CAAC,EAAE,sBAAsB,CAAA;IACzC,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAiUD;;;;;;;;;GASG;AACH,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,YAAY,GAAG,sBAAsB,GAAG,SAAS,CAiDxG;AAkMD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,EAAE,gBAAgB,SAAK,GAAG,MAAM,CAalG;AAED,wBAAgB,2BAA2B,CAAC,YAAY,EAAE,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAU5G;AA2CD,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAUvG;AAyTD,qBAAa,kBAAmB,YAAW,sBAAsB;IAK7D,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAN1B,QAAQ,CAAC,eAAe,EAAG,UAAU,CAAS;IAC9C,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAA0C;gBAG7D,GAAG,EAAE,OAAO,EACZ,MAAM,EAAE,sBAAsB,EAC9B,OAAO,EAAE,yBAAyB;IAG/C,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,EAAE,KAAK,GAAG,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAwBrG,OAAO,CAAC,mBAAmB;IAwB3B,OAAO,CAAC,iBAAiB;YAMX,yBAAyB;IAwBvC,4EAA4E;IAC5E,OAAO,CAAC,YAAY;YA2CN,UAAU;IAqBxB;;;;;OAKG;YACW,qBAAqB;YAiCrB,qCAAqC;YASrC,oBAAoB;IAmb5B,aAAa,CAAC,KAAK,EAAE;QACzB,QAAQ,EAAE,QAAQ,CAAC,eAAe,CAAC,CAAA;QACnC,UAAU,EAAE,MAAM,CAAA;QAClB,QAAQ,CAAC,EAAE,QAAQ,CAAC,mBAAmB,CAAC,CAAA;QACxC,MAAM,EAAE,WAAW,CAAA;KACpB,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAqEvF,OAAO,CACX,OAAO,EAAE,QAAQ,CAAC,mBAAmB,CAAC,EACtC,QAAQ,EAAE,QAAQ,CAAC,eAAe,CAAC,EACnC,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,QAAQ,CAAC,qBAAqB,CAAC,GACvC,OAAO,CAAC,oBAAoB,CAAC;IAmDhC,OAAO,CAAC,mBAAmB;IAiB3B,OAAO,CAAC,WAAW;YAkBL,iBAAiB;IA2LzB,OAAO,CACX,OAAO,EAAE,QAAQ,CAAC,mBAAmB,CAAC,EACtC,QAAQ,EAAE,QAAQ,CAAC,eAAe,CAAC,EACnC,WAAW,EAAE,WAAW,EACxB,QAAQ,CAAC,EAAE,QAAQ,CAAC,sBAAsB,CAAC,EAC3C,eAAe,CAAC,EAAE,sBAAsB,GACvC,OAAO,CAAC,oBAAoB,CAAC;YA+ClB,iBAAiB;CAuQhC"}

package/lib/agent-runtime.js

@@ -3,7 +3,7 @@ import { mkdir, stat } from 'node:fs/promises';
 import { installModelSelection, } from '@deepseek-ai/dsh-agent';
 import { contentHasImage, createUserMessage, ReasoningEffortId, } from '@deepseek-ai/dsh-llm';
 import { effectiveSandboxMode, setSandboxMode } from '@deepseek-ai/dsh-sandbox-policy';
-import { SessionId } from '@deepseek-ai/dsh-session';
+import { isAppendSurfaceEvent, SessionId } from '@deepseek-ai/dsh-session';
 import { effectiveApprovalPolicy, setApprovalPolicy, } from '@deepseek-ai/dsh-user-approval';
 import { approvalReviewerOf, setApprovalReviewer, waitForApprovalReviewerSessionEventReady, } from '@dsh-enhanced/assistant-policy';
 import { resolveLlmRouteCapability } from '@dsh-enhanced/llm-route-capabilities';
@@ -22,6 +22,16 @@ class UserSessionCancellation extends Error {
 const MAX_CATALOG_MODELS = 50;
 const MAX_PROGRESS_TODOS = 20;
 const MAX_PROGRESS_TEXT_CHARS = 240;
+const MAX_PROGRESS_TOOL_PREVIEW_CHARS = 1_500;
+const MAX_PROGRESS_JSON_INPUT_CHARS = 32_768;
+const MAX_PROGRESS_JSON_DEPTH = 16;
+const MAX_PROGRESS_JSON_NODES = 500;
+const MAX_PROGRESS_RESULT_BLOCKS = 100;
+const REDACTED_PROGRESS_VALUE = '[REDACTED]';
+const TRUNCATED_PROGRESS_VALUE = '[TRUNCATED]';
+const PROGRESS_ASSIGNMENT_KEY = '([A-Za-z_][A-Za-z0-9_.-]{0,127})';
+const PROGRESS_ASSIGNMENT_START = new RegExp(`(^|[^A-Za-z0-9_])(["']?)${PROGRESS_ASSIGNMENT_KEY}\\2(\\s*[:=]\\s*)`, 'giu');
+const ESCAPED_QUOTED_PROGRESS_ASSIGNMENT_START = new RegExp(`(^|[^A-Za-z0-9_])\\\\+(["'])${PROGRESS_ASSIGNMENT_KEY}\\\\+\\2(\\s*[:=]\\s*)`, 'giu');
 class DurableAgentIdentityError extends Error {
 }
 class ApprovalReviewerReaderUnavailableError extends Error {
@@ -30,16 +40,16 @@ class ApprovalReviewerReaderUnavailableError extends Error {
         this.name = 'ApprovalReviewerReaderUnavailableError';
     }
 }
-class ToolCapabilityAdmissionError extends Error {
+class AdapterToolCallProtocolError extends Error {
     provider;
     model;
     presetId;
     constructor(provider, model, presetId) {
-        super(`assistant-delivery: ${provider}/${model} cannot execute the tools mounted by preset ${presetId}`);
+        super(`assistant-delivery: adapter ${provider}/${model} declares no DSH tool-call protocol`);
         this.provider = provider;
         this.model = model;
         this.presetId = presetId;
-        this.name = 'ToolCapabilityAdmissionError';
+        this.name = 'AdapterToolCallProtocolError';
     }
 }
 class ImageCapabilityAdmissionError extends Error {
@@ -52,32 +62,18 @@ class ImageCapabilityAdmissionError extends Error {
         this.name = 'ImageCapabilityAdmissionError';
     }
 }
-function requireToolCapability(llm, provider, model, presetId, toolCount, declaredToolCapableProviders, unknownRouteToolCalls) {
+function requireAdapterToolCallProtocol(llm, provider, model, presetId, toolCount) {
     if (toolCount === 0)
         return;
-    const capability = resolveLlmRouteCapability(llm, provider, model);
-    if (capability?.toolCalls === 'native' || capability?.toolCalls === 'bridge')
-        return;
-    // A provider-owned declaration is authoritative in both directions: an
-    // explicit `none` still fails closed even when the route is allowlisted or
-    // unknown routes are admitted.
-    if (capability?.toolCalls === 'none')
-        throw new ToolCapabilityAdmissionError(provider, model, presetId);
-    // Only routes with no declaration at all reach the host policy. The DSH
-    // `generate` contract accepts `tools` for every adapter, so tool calling is
-    // the adapter baseline rather than an opt-in: gateway and built-in providers
-    // (pi-ai and friends) never publish registry metadata, and denying them by
-    // default made every such route unusable behind a tool-mounting preset.
-    if (declaredToolCapableProviders.has(provider))
-        return;
-    if (unknownRouteToolCalls === 'allow')
-        return;
-    throw new ToolCapabilityAdmissionError(provider, model, presetId);
+    if (resolveLlmRouteCapability(llm, provider, model)?.toolCalls === 'none') {
+        throw new AdapterToolCallProtocolError(provider, model, presetId);
+    }
 }
-function toolCapabilityReply(error) {
+function adapterToolCallProtocolReply(error) {
     return {
-        text: `当前模型 ${error.provider}/${error.model} 已声明不支持工具调用，无法执行 preset “${error.presetId}” 暴露的工具。`
-            + '请发送 /model 切换到支持工具调用的 provider，或改用不挂载工具的 preset。',
+        text: `当前路由 ${error.provider}/${error.model} 的 adapter 明确声明未实现统一 DSH tool-call 协议，`
+            + `因此无法承载 preset “${error.presetId}” 已挂载的工具。`
+            + '这不是模型权限差异；请升级或修复该 provider adapter，使其实现 native/bridge 协议。',
         format: 'plain',
     };
 }
@@ -97,16 +93,214 @@ async function requireImageCapability(llm, provider, model, signal) {
 function boundedProgressText(value) {
     return [...value].slice(0, MAX_PROGRESS_TEXT_CHARS).join('');
 }
+function boundedProgressToolPreview(value) {
+    const trimmed = value.trim();
+    const characters = [...trimmed];
+    return characters.length <= MAX_PROGRESS_TOOL_PREVIEW_CHARS
+        ? trimmed
+        : `${characters.slice(0, MAX_PROGRESS_TOOL_PREVIEW_CHARS - 1).join('')}…`;
+}
+function redactProgressText(value) {
+    const common = redactEscapedKeyProgressAssignments(value)
+        .replace(/-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?(?:-----END [^-]*PRIVATE KEY-----|$)/giu, '[REDACTED PRIVATE KEY]')
+        .replace(/\b([a-z][a-z0-9+.-]*:\/\/)[^/\s@]+@/giu, '$1[REDACTED]@')
+        .replace(/\b((?:proxy-)?authorization\s*[:=]\s*)(?:basic|bearer)\s+[^\s,;]+/giu, '$1[REDACTED]');
+    return redactProgressAssignments(common)
+        .replace(/\b(?:github_pat_[A-Za-z0-9_]{20,}|gh[pousr]_[A-Za-z0-9]{20,}|(?:sk|xai)-[A-Za-z0-9_-]{8,})\b/gu, REDACTED_PROGRESS_VALUE)
+        .replace(/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/gu, REDACTED_PROGRESS_VALUE);
+}
+function isSensitiveProgressKey(key) {
+    const words = key.normalize('NFKC')
+        .replace(/([a-z\d])([A-Z])/gu, '$1_$2')
+        .toLowerCase()
+        .split(/[^a-z\d]+/gu)
+        .filter(Boolean);
+    const joined = words.join('');
+    return words.some(word => [
+        'auth', 'authorization', 'bearer', 'cookie', 'cookies', 'credential', 'credentials',
+        'password', 'passwd', 'secret', 'session', 'token',
+    ].includes(word))
+        || ['apikey', 'accesskey', 'privatekey'].some(phrase => joined.includes(phrase))
+        || words.some((word, index) => ['api', 'access', 'private'].includes(word) && words[index + 1] === 'key');
+}
 /**
- * Convert one durable session fact into a deliberately narrow, user-visible progress update.
- * Raw reasoning chunks, tool arguments, result content, and error details never cross this boundary.
+ * Text credentials have no trustworthy terminator: quotes may be malformed or multiply escaped,
+ * while spaces, semicolons, and nested assignments can still belong to the value. Once a key is
+ * recognized, fail closed through the logical line instead of exposing an arbitrary suffix.
+ */
+function redactProgressAssignments(value) {
+    let retainedIndex = 0;
+    let redacted = '';
+    PROGRESS_ASSIGNMENT_START.lastIndex = 0;
+    for (let match = PROGRESS_ASSIGNMENT_START.exec(value); match !== null; match = PROGRESS_ASSIGNMENT_START.exec(value)) {
+        const key = match[3];
+        if (key === undefined || !isSensitiveProgressKey(key)) {
+            // The prefix regex consumes the separator of an innocent outer field. Resume inside that
+            // match so nested assignments on the same line remain visible to this scanner.
+            PROGRESS_ASSIGNMENT_START.lastIndex = match.index + 1;
+            continue;
+        }
+        const valueStart = match.index + match[0].length;
+        const lineEnd = progressRedactionEnd(value, valueStart);
+        redacted += value.slice(retainedIndex, valueStart) + REDACTED_PROGRESS_VALUE;
+        retainedIndex = lineEnd;
+        PROGRESS_ASSIGNMENT_START.lastIndex = lineEnd;
+    }
+    PROGRESS_ASSIGNMENT_START.lastIndex = 0;
+    return redacted + value.slice(retainedIndex);
+}
+/** Escaped JSON keys inside a log string cannot be parsed as the outer text; fail closed by line. */
+function redactEscapedKeyProgressAssignments(value) {
+    let retainedIndex = 0;
+    let redacted = '';
+    ESCAPED_QUOTED_PROGRESS_ASSIGNMENT_START.lastIndex = 0;
+    for (let match = ESCAPED_QUOTED_PROGRESS_ASSIGNMENT_START.exec(value); match !== null; match = ESCAPED_QUOTED_PROGRESS_ASSIGNMENT_START.exec(value)) {
+        const key = match[3];
+        if (key === undefined || !isSensitiveProgressKey(key)) {
+            ESCAPED_QUOTED_PROGRESS_ASSIGNMENT_START.lastIndex = match.index + 1;
+            continue;
+        }
+        const valueStart = match.index + match[0].length;
+        const lineEnd = progressRedactionEnd(value, valueStart);
+        redacted += value.slice(retainedIndex, valueStart) + REDACTED_PROGRESS_VALUE;
+        retainedIndex = lineEnd;
+        ESCAPED_QUOTED_PROGRESS_ASSIGNMENT_START.lastIndex = lineEnd;
+    }
+    ESCAPED_QUOTED_PROGRESS_ASSIGNMENT_START.lastIndex = 0;
+    return redacted + value.slice(retainedIndex);
+}
+function progressRedactionEnd(value, start) {
+    let cursor = start;
+    while (cursor < value.length) {
+        const carriageReturn = value.indexOf('\r', cursor);
+        const lineFeed = value.indexOf('\n', cursor);
+        const candidates = [carriageReturn, lineFeed].filter(index => index >= 0);
+        if (candidates.length === 0)
+            return value.length;
+        const boundary = Math.min(...candidates);
+        if (value[boundary - 1] !== '\\')
+            return boundary;
+        cursor = boundary + (value[boundary] === '\r' && value[boundary + 1] === '\n' ? 2 : 1);
+    }
+    return value.length;
+}
+function redactProgressJson(value, state, depth = 0) {
+    state.nodes += 1;
+    if (depth > MAX_PROGRESS_JSON_DEPTH || state.nodes > MAX_PROGRESS_JSON_NODES) {
+        return TRUNCATED_PROGRESS_VALUE;
+    }
+    if (Array.isArray(value)) {
+        const items = value.slice(0, 100).map(item => redactProgressJson(item, state, depth + 1));
+        if (value.length > items.length)
+            items.push(TRUNCATED_PROGRESS_VALUE);
+        return items;
+    }
+    if (value !== null && typeof value === 'object') {
+        const entries = Object.entries(value).slice(0, 100).map(([key, item]) => [
+            key,
+            isSensitiveProgressKey(key)
+                ? REDACTED_PROGRESS_VALUE
+                : redactProgressJson(item, state, depth + 1),
+        ]);
+        if (Object.keys(value).length > entries.length)
+            entries.push(['…', TRUNCATED_PROGRESS_VALUE]);
+        return Object.fromEntries(entries);
+    }
+    return typeof value === 'string' ? redactProgressText(value) : value;
+}
+function progressArgumentsPlaceholder(value) {
+    const characters = [...redactProgressText(value.slice(0, MAX_PROGRESS_JSON_INPUT_CHARS))];
+    let retained = Math.min(characters.length, MAX_PROGRESS_TOOL_PREVIEW_CHARS);
+    while (retained >= 0) {
+        const encoded = JSON.stringify({
+            truncated: true,
+            preview: characters.slice(0, retained).join(''),
+        });
+        if ([...encoded].length <= MAX_PROGRESS_TOOL_PREVIEW_CHARS)
+            return encoded;
+        retained = retained === 0 ? -1 : Math.floor(retained * 0.75);
+    }
+    return '{"truncated":true}';
+}
+function progressArgumentsPreview(value) {
+    if (value.trim() === '')
+        return '{}';
+    // Never publish raw malformed or oversized model output. Normal tool calls are valid JSON; when
+    // that invariant fails, a status marker is more useful than a best-effort secret scrubber.
+    if (value.length > MAX_PROGRESS_JSON_INPUT_CHARS)
+        return '{"truncated":true}';
+    try {
+        const encoded = JSON.stringify(redactProgressJson(JSON.parse(value), { nodes: 0 }), null, 2);
+        if (encoded === undefined)
+            return '{"invalidJson":true}';
+        return [...encoded].length <= MAX_PROGRESS_TOOL_PREVIEW_CHARS
+            ? encoded
+            : progressArgumentsPlaceholder(encoded);
+    }
+    catch {
+        return '{"invalidJson":true}';
+    }
+}
+function redactProgressResultText(value) {
+    if (value.length > MAX_PROGRESS_JSON_INPUT_CHARS)
+        return '{"truncated":true}';
+    const trimmed = value.trim();
+    if ((trimmed.startsWith('{') && trimmed.endsWith('}'))
+        || (trimmed.startsWith('[') && trimmed.endsWith(']'))) {
+        try {
+            const encoded = JSON.stringify(redactProgressJson(JSON.parse(trimmed), { nodes: 0 }), null, 2);
+            if (encoded !== undefined)
+                return encoded;
+        }
+        catch {
+            // Fall through to conservative line-oriented handling for JSON-like logs and fragments.
+        }
+    }
+    return redactProgressText(value);
+}
+function progressResultPreview(content, depth = 0) {
+    if (depth > 4)
+        return TRUNCATED_PROGRESS_VALUE;
+    const parts = [];
+    let approximateLength = 0;
+    const append = (value) => {
+        if (approximateLength >= MAX_PROGRESS_TOOL_PREVIEW_CHARS * 2 || value === '')
+            return;
+        const retained = value.slice(0, MAX_PROGRESS_TOOL_PREVIEW_CHARS * 2 - approximateLength);
+        parts.push(retained);
+        approximateLength += retained.length;
+    };
+    let blockCount = 0;
+    for (const block of content) {
+        if (approximateLength >= MAX_PROGRESS_TOOL_PREVIEW_CHARS * 2)
+            break;
+        if (blockCount >= MAX_PROGRESS_RESULT_BLOCKS) {
+            append(TRUNCATED_PROGRESS_VALUE);
+            break;
+        }
+        blockCount += 1;
+        if (block.type === 'text')
+            append(redactProgressResultText(block.text));
+        else if (block.type === 'image')
+            append('[图片]');
+        else if (block.type === 'tool-call') {
+            append(`${block.name}\n${progressArgumentsPreview(block.arguments)}`);
+        }
+        else if (block.type === 'tool-result') {
+            append(progressResultPreview(block.content, depth + 1));
+        }
+    }
+    return boundedProgressToolPreview(redactProgressText(parts.join('\n')));
+}
+/**
+ * Convert one durable session fact into a bounded, user-visible progress update.
+ * Reasoning/thinking content and provider error messages never cross this boundary. Tool calls/results
+ * contribute bounded previews with common credential shapes redacted; the channel still decides
+ * whether its current audience is private enough to render those previews.
  *
- * The `reasoning` block of a durable `assistant/message` is the assistant's own settled summary of
- * the step, not a streaming fragment, so it is the one reasoning form safe to surface. Only some
- * providers emit it at all: subscription CLIs declare an effort capability but still return text
- * only, and the ACP thought channel is not mapped to DSH reasoning yet. `step/start` therefore also
- * yields a neutral phase label, so a turn reports progress even on providers that never reason
- * out loud.
+ * A DSH `reasoning` block is explicitly thinking content and is not guaranteed to be a public
+ * summary, even after assembly into `assistant/message`. `step/start` therefore provides the only
+ * reasoning-independent phase label, so a turn reports progress without exposing hidden thought.
  */
 export function deliveryProgressFromSessionEvent(event) {
     if (event.type === 'step/start') {
@@ -117,31 +311,39 @@ export function deliveryProgressFromSessionEvent(event) {
         };
     }
     if (event.type === 'assistant/message') {
-        const reasoning = event.data.message.content
-            .filter(value => value.type === 'reasoning')
-            .map(value => (value.type === 'reasoning' ? value.text.trim() : ''))
-            .filter(text => text !== '')
-            .join('\n');
-        return reasoning === '' ? undefined : { kind: 'step', text: boundedProgressText(reasoning) };
+        return undefined;
     }
     if (event.type === 'tool/call') {
+        const argumentsPreview = progressArgumentsPreview(event.data.arguments);
         return {
             kind: 'tool-started',
             callId: String(event.data.callId),
             toolName: boundedProgressText(event.data.name),
+            ...(argumentsPreview === '' ? {} : { argumentsPreview }),
         };
     }
     if (event.type === 'tool/result') {
+        // Replacement copies belong only to the model-visible surface (for example after compaction).
+        // Human progress is an append-origin transcript, so projecting a replacement would make an
+        // old tool result look like a tool invocation from the active turn.
+        if (!isAppendSurfaceEvent(event))
+            return undefined;
         const block = event.data.message.content.find(value => value.type === 'tool-result');
         const callId = block?.type === 'tool-result'
             ? block.toolCallId
             : event.data.message.source?.callId;
         if (callId === undefined)
             return undefined;
+        const resultPreview = block?.type === 'tool-result'
+            ? progressResultPreview(block.content)
+            : '';
+        const code = event.data.error?.code;
         return {
             kind: 'tool-finished',
             callId: String(callId),
             failed: event.data.error !== undefined || (block?.type === 'tool-result' && block.isError === true),
+            ...(resultPreview === '' ? {} : { resultPreview }),
+            ...(code === undefined ? {} : { code: boundedProgressText(code) }),
         };
     }
     if (event.type === 'todo/write') {
@@ -412,6 +614,17 @@ function agentSelection(route) {
             : { reasoningEffort: ReasoningEffortId(route.reasoningEffort) }),
     };
 }
+function errorHasCode(error, code) {
+    let current = error;
+    const visited = new Set();
+    while (typeof current === 'object' && current !== null && !visited.has(current)) {
+        visited.add(current);
+        if ('code' in current && current.code === code)
+            return true;
+        current = current instanceof Error ? current.cause : undefined;
+    }
+    return false;
+}
 async function modelCatalog(llm, conversation, current, isDefault, eventId, expiresAt, signal) {
     const providers = llm.listProviders();
     const catalogs = await Promise.all(providers.map(async (provider) => {
@@ -810,6 +1023,44 @@ export class DshDeliveryRuntime {
         installModelSelection(agentCtx, { current: selected, assembled: undefined });
         await agentPresets?.mount(agentCtx, presetId);
     }
+    /**
+     * DSH validates an explicit reasoning effort before calling an adapter. That is normally the
+     * right contract, but a persisted external-channel selection can outlive a provider's live
+     * model directory. Clear only that stale persisted effort before a prompt crosses the durable
+     * dispatch boundary; TraeX still rechecks the newly created ACP session afterwards.
+     */
+    async resolveExecutionRoute(conversation, persisted, route, signal) {
+        if (route.reasoningEffort === undefined)
+            return { route };
+        const llm = this.ctx.get('llm');
+        if (llm === undefined)
+            throw new Error('assistant-delivery: llm service is required');
+        try {
+            await llm.resolveCallConfig({
+                provider: route.provider,
+                model: route.model,
+                reasoningEffort: ReasoningEffortId(route.reasoningEffort),
+            }, signal);
+            return { route };
+        }
+        catch (error) {
+            if (signal.aborted || !errorHasCode(error, 'UNSUPPORTED_REASONING_EFFORT'))
+                throw error;
+            const fallback = { provider: route.provider, model: route.model };
+            // Do not turn an invalid model/default into a silent recovery. This is the same core
+            // preflight without the stale explicit effort, still before an Agent turn is dispatched.
+            await llm.resolveCallConfig(fallback, signal);
+            if (persisted === undefined) {
+                this.ctx.logger.warn(`assistant-delivery: using provider default after unsupported reasoning effort for ${route.provider}/${route.model}`);
+                return { route: fallback };
+            }
+            const recovered = this.options.clearStaleModelReasoningEffort(conversation, persisted);
+            if (!recovered.applied)
+                return { retry: true };
+            this.ctx.logger.warn(`assistant-delivery: cleared stale reasoning effort for ${route.provider}/${route.model} before dispatch`);
+            return { route: toModelRoute(recovered.selection) };
+        }
+    }
     async reconcileNativeFullPermissionReviewer(session) {
         const result = await this.policy.reconcileNativeFullReviewer(session);
         if (result === 'unavailable') {
@@ -1707,9 +1958,15 @@ export class DshDeliveryRuntime {
         if (agents === undefined || sessions === undefined) {
             return { outcome: 'not-processed', failureCode: 'agent-runtime-unavailable', retryable: true };
         }
-        const selectedRoute = toModelRoute(prepared?.modelRoute
-            ?? this.options.getModelSelection(envelope.conversation)
+        const persistedSelection = this.options.getModelSelection(envelope.conversation);
+        const requestedRoute = toModelRoute(persistedSelection
+            ?? prepared?.modelRoute
             ?? { provider: this.options.provider, model: this.options.model });
+        const resolvedRoute = await this.resolveExecutionRoute(envelope.conversation, persistedSelection, requestedRoute, signal);
+        if ('retry' in resolvedRoute) {
+            return { outcome: 'not-processed', failureCode: 'model-selection-changed-before-dispatch', retryable: true };
+        }
+        const selectedRoute = resolvedRoute.route;
         const selected = agentSelection(selectedRoute);
         let handle;
         let dispatched = false;
@@ -1743,7 +2000,7 @@ export class DshDeliveryRuntime {
                     const llm = this.ctx.get('llm');
                     if (llm === undefined)
                         throw new Error('assistant-delivery: llm service is required');
-                    requireToolCapability(llm, selected.provider, selected.model, presetId, agentCtx.tools.schemas(agentCtx.agent).length, this.options.toolCapableProviders, this.options.unknownRouteToolCalls);
+                    requireAdapterToolCallProtocol(llm, selected.provider, selected.model, presetId, agentCtx.tools.schemas(agentCtx.agent).length);
                 } });
             const agent = handle.agent;
             await this.reconcileNativeFullPermissionReviewer(agent.session);
@@ -1843,13 +2100,13 @@ export class DshDeliveryRuntime {
                     return { outcome: 'not-processed', failureCode: 'image-capability-notice-failed', retryable: true };
                 }
             }
-            if (error instanceof ToolCapabilityAdmissionError) {
+            if (error instanceof AdapterToolCallProtocolError) {
                 try {
-                    this.options.replyCommand(binding, envelope.eventId, toolCapabilityReply(error));
+                    this.options.replyCommand(binding, envelope.eventId, adapterToolCallProtocolReply(error));
                     return { outcome: 'processed' };
                 }
                 catch {
-                    return { outcome: 'not-processed', failureCode: 'tool-capability-notice-failed', retryable: true };
+                    return { outcome: 'not-processed', failureCode: 'adapter-tool-protocol-notice-failed', retryable: true };
                 }
             }
             this.ctx.logger.warn(`assistant-delivery: ${sessionResumeFailureCode(error)} for session ${sessionFingerprint(binding.sessionId)}`);