@jjh32456/dsh-longlive 1.6.6 → 1.6.8

package/src/heartbeat.js

@@ -1,24 +1,65 @@
 // Auto-heartbeat for the "正在" live registry.
 //
-// Two clocks keep a bound row fresh without the caller passing sessionId:
-//   1. turn lifecycle — `session/event` with `turn/start` / `turn/end` for a
-//      session this writer has already bound;
+// Two clocks keep a row fresh without the caller passing sessionId:
+//   1. turn lifecycle — `session/event` with `turn/start` / `turn/end`. The
+//      event itself carries the session id, so turn boundaries maintain EVERY
+//      non-subagent session's row (R4.5), bound or not; a missing row is
+//      created on the first boundary (128-row cap respected, R4.3);
 //   2. a fallback interval (`heartbeatMs`, default 15 s, `0` disables), which
-//      is what keeps the row fresh through long tool calls and idle stretches.
+//      keeps rows of sessions bound by a longlive tool call fresh through long
+//      tool calls and idle stretches. It never fabricates rows.
 //
-// Identity is bound, never guessed: the id comes from a tool call's explicit
-// `exec.agent` (see identity.js). Turn events and the timer only refresh ids
-// already in that bound set, so a root-scoped plugin observing every session
-// can never heartbeat somebody else's row.
+// Turn boundaries are a state machine, not a heartbeat: `turn/start` writes
+// `state='running'` plus the turn number, `turn/end` writes
+// `idle`/`waiting`/`blocked` plus the turn number (R4.3). It is event driven,
+// so it still runs when the fallback timer is off (`heartbeatMs: 0`); a timer
+// tick, by contrast, only renews `heartbeatAt` and never touches state or
+// `last_action`.
 //
-// Every write is best effort: a missing/corrupt row, an unset memoryRoot or a
-// racing writer must never fail a tool call or crash the host.
+// Every write is best effort: a missing/corrupt row, an unset memoryRoot, a
+// full registry or a racing writer must never fail a tool call or crash the
+// host.
 
-import { liveTouch, liveUpdate } from './live.js';
+import { liveGet, liveList, liveTouch, liveUpdate } from './live.js';
 import { resolveCurrentSessionId } from './identity.js';
 
 export const DEFAULT_HEARTBEAT_MS = 15_000;
 export const MAX_BOUND_SESSIONS = 64;
+/** DESIGN §2.1 live-row cap; mirrored here so turn boundaries cannot blow it up. */
+export const MAX_LIVE_ROWS = 128;
+
+/**
+ * R4.3 pure state machine: state a live row must carry when a turn starts.
+ * @returns {'running'}
+ */
+export function stateForTurnStart() {
+  return 'running';
+}
+
+/**
+ * R4.3 pure state machine: state a live row must carry when a turn ends.
+ * `waiting`/`blocked` are user-facing promises and survive the turn boundary;
+ * anything else falls back to `idle`.
+ * @param {unknown} priorState declared state read before the turn/end write
+ * @returns {'idle'|'waiting'|'blocked'}
+ */
+export function stateForTurnEnd(priorState) {
+  return priorState === 'waiting' || priorState === 'blocked' ? priorState : 'idle';
+}
+
+/**
+ * Pure description of the live-row patch caused by one turn boundary. Kept
+ * separate from I/O so the state machine can be pinned without a registry.
+ * @param {'turn/start'|'turn/end'} type
+ * @param {{turn?:unknown, priorState?:unknown}} [options]
+ * @returns {{state:string, turn:number|null, kind:'turn', detail:string}}
+ */
+export function turnBoundaryPlan(type, options = {}) {
+  const kind = type === 'turn/end' ? 'turn/end' : 'turn/start';
+  const state = kind === 'turn/start' ? stateForTurnStart() : stateForTurnEnd(options.priorState);
+  const turn = Number.isInteger(options.turn) && options.turn >= 0 ? options.turn : null;
+  return { state, turn, kind: 'turn', detail: turn == null ? kind : `${kind} #${turn}` };
+}
 
 function cleanId(value) {
   if (typeof value !== 'string') return null;
@@ -33,12 +74,19 @@ function cleanId(value) {
  * @param {object} [options]
  * @param {object|null} [options.ctx] host context (used for `session/event`)
  * @param {string} [options.memoryRoot] live-registry root; absent disables writes
- * @param {number} [options.heartbeatMs] fallback interval; `0` disables all
- *   automatic writes (binding still happens through the tool resolver)
+ * @param {number} [options.heartbeatMs] fallback interval; `0` disables the
+ *   timer and tool-call touches (binding still happens through the tool
+ *   resolver). Turn-boundary state writes (`turn/start` → running + turn,
+ *   `turn/end` → idle/waiting/blocked + turn) are event driven and keep
+ *   working, because "no timer" is not "no state machine" (R4.3).
  * @param {() => (Date|number)} [options.now] clock injection for tests
  * @param {Function} [options.touch] `liveTouch` injection for tests
  * @param {Function} [options.update] `liveUpdate` injection for tests (first
  *   registration of a session that has no row yet)
+ * @param {Function} [options.get] `liveGet` injection for tests (turn/end reads
+ *   the prior declared state so waiting/blocked survive)
+ * @param {number} [options.maxRows] live-row cap for rows created by turn
+ *   boundaries (default 128, DESIGN §2.1)
  * @param {Function} [options.setInterval] timer injection for tests
  * @param {Function} [options.clearInterval]
  * @param {Function} [options.resolve] `(exec) => {id, source}` injection
@@ -51,6 +99,9 @@ export function createAutoHeartbeat(options = {}) {
     now,
     touch = liveTouch,
     update = liveUpdate,
+    // Read side, used only to preserve waiting/blocked across turn/end.
+    get = liveGet,
+    maxRows = MAX_LIVE_ROWS,
     setInterval: setIntervalFn = globalThis.setInterval,
     clearInterval: clearIntervalFn = globalThis.clearInterval,
     resolve = (exec) => resolveCurrentSessionId({ ctx, exec }),
@@ -61,7 +112,9 @@ export function createAutoHeartbeat(options = {}) {
     ? memoryRoot.trim()
     : null;
   const interval = typeof heartbeatMs === 'number' ? heartbeatMs : Number(heartbeatMs);
-  // Only a finite positive interval enables automatic writes; 0/invalid = off.
+  // Only a finite positive interval enables the fallback timer and the
+  // tool-call touches; 0/invalid = those two off. Turn-boundary state writes
+  // (R4.3) are event driven and deliberately independent of this flag.
   const enabled = Number.isFinite(interval) && interval > 0;
 
   const bound = new Set();
@@ -156,18 +209,82 @@ export function createAutoHeartbeat(options = {}) {
     return touched;
   }
 
+  /**
+   * Prior row snapshot for a turn boundary: does it exist, and what state does
+   * it declare? Read-only; never throws. `known:false` means the read itself
+   * failed, in which case we still attempt the write (liveUpdate is atomic and
+   * the row keeps its prior values for omitted fields).
+   */
+  function readPriorRow(id) {
+    if (root == null || typeof get !== 'function') return { known: false, found: false, state: null };
+    const config = { memoryRoot: root };
+    const at = stamp();
+    if (at !== undefined) config.now = at;
+    try {
+      const got = get({ sessionId: id }, config);
+      if (got?.ok === true) {
+        return { known: true, found: true, state: typeof got.live?.state === 'string' ? got.live.state : null };
+      }
+      if (got?.status === 'absent') return { known: true, found: false, state: null };
+      // corrupt/unreadable-but-present: it occupies a slot; a write repairs it.
+      return { known: true, found: true, state: null };
+    } catch {
+      return { known: false, found: false, state: null };
+    }
+  }
+
+  /** True when a NEW row may still be created without exceeding the 128 cap. */
+  function hasRowCapacity() {
+    if (root == null || typeof liveList !== 'function') return true;
+    const config = { memoryRoot: root };
+    const at = stamp();
+    if (at !== undefined) config.now = at;
+    try {
+      const listed = liveList({ includeDead: true }, config);
+      const scanned = Number.isInteger(listed?.scanned)
+        ? listed.scanned
+        : (Array.isArray(listed?.entries) ? listed.entries.length : 0);
+      return scanned < maxRows;
+    } catch {
+      // Cannot tell -> do not create rows, but an existing row may be updated.
+      return false;
+    }
+  }
+
+  /** One best-effort live-row patch at a turn boundary (state + turn + action). */
+  function writeTurnBoundary(id, { state, turn, kind, detail }) {
+    if (root == null || typeof update !== 'function') return { ok: false, status: 'disabled' };
+    const args = { sessionId: id, state, last_action: { kind, detail } };
+    if (Number.isInteger(turn) && turn >= 0) args.turn = turn;
+    const config = { memoryRoot: root };
+    const at = stamp();
+    if (at !== undefined) config.now = at;
+    try {
+      return update(args, config);
+    } catch {
+      // A state-machine write is decoration for other sessions, never the
+      // turn itself: swallow and let the turn proceed.
+      return { ok: false, status: 'error' };
+    }
+  }
+
   function onSessionEvent(session, event) {
     let id = null;
+    let origin = null;
     try {
-      id = cleanId(session?.id) ?? cleanId(session?.header?.id);
+      id = cleanId(session?.id)
+        ?? cleanId(session?.header?.id)
+        ?? cleanId(event?.session?.id)
+        ?? cleanId(event?.session?.header?.id);
+      const header = session?.header ?? session?.session?.header ?? event?.session?.header ?? {};
+      origin = typeof header.origin === 'string' ? header.origin : null;
     } catch {
       id = null;
     }
     // Auto-truncation watches every session in this agent's scope, not only
     // the ones bound to the live registry: a session that never called a
     // longlive tool can still grow past the threshold. It runs before the
-    // `enabled` gate so `heartbeatMs:0` (live writes off) does not also turn
-    // maintenance off.
+    // live-state gate so `heartbeatMs:0` does not also turn maintenance off.
     if (typeof onTurnEnd === 'function' && event?.type === 'turn/end' && id) {
       try {
         onTurnEnd({ session, event, sessionId: id, turn: event?.data?.turn });
@@ -175,15 +292,31 @@ export function createAutoHeartbeat(options = {}) {
         /* automation is best effort; never fail the host feed */
       }
     }
-    if (!enabled) return;
-    if (!id || !bound.has(id)) return;
     const type = event?.type;
+    if (!id) return;
     if (type !== 'turn/start' && type !== 'turn/end') return;
+    // R4.6: subagents are counted separately on the board; they never get a
+    // live row from the heartbeat (same rule as the Router's L1 writer).
+    if (origin === 'subagent') return;
+    if (root == null || typeof update !== 'function') return;
     const turn = event?.data?.turn;
-    touchOne(id, {
-      kind: 'turn',
-      detail: turn == null ? type : `${type} #${turn}`,
-    });
+    // R4.5: the event carries the session id, so turn boundaries maintain
+    // EVERY non-subagent session's row — a session that only runs native tools
+    // (never calls a longlive tool, so it is never `bind`ed) must still switch
+    // state/turn. Create the row on its first boundary, within the 128 cap.
+    const prior = readPriorRow(id);
+    if (!prior.found && !hasRowCapacity()) return;
+    if (type === 'turn/start') {
+      // R4.3 状态机：turn/start 立刻让 live 行 state: 'running' 并写入 turn 号
+      // （liveUpdate 一次完成；与心跳 tick 无关，tick 只续 heartbeatAt）。
+      const plan = turnBoundaryPlan('turn/start', { turn });
+      writeTurnBoundary(id, plan);
+      return;
+    }
+    // turn/end: idle/blocked/waiting 都落 turn 号；waiting/blocked 是给用户
+    // 看的承诺，turn 结束不能把它抹成 idle。
+    const endPlan = turnBoundaryPlan('turn/end', { turn, priorState: prior.state });
+    writeTurnBoundary(id, endPlan);
   }
 
   function tick() {

package/src/identity/handover.js

@@ -416,6 +416,41 @@ function allocateBudget(parts, total) {
   return budgets;
 }
 
+/**
+ * R6.2: 「状态卡写于 X 分钟前」——X 是 STATE.md mtime 与 now 的差，不是卡片
+ * 生成时间，也不是会话开始时间。拿不到 mtime 时返回 ''（宁可不写，不编造）。
+ * @param {unknown} ageMs
+ * @returns {string}
+ */
+export function stateCardAgeText(ageMs) {
+  if (typeof ageMs !== 'number' || !Number.isFinite(ageMs)) return '';
+  const minutes = Math.max(0, Math.round(ageMs / 60000));
+  return `状态卡写于 ${minutes} 分钟前`;
+}
+
+/**
+ * Resolve the STATE.md age in ms from explicit inputs, falling back to stat()
+ * on `statePath`. Missing/unknown age returns null — the card then omits the
+ * sentence instead of inventing a number.
+ */
+function resolveStateAgeMs(input, safeNow) {
+  if (typeof input.stateAgeMs === 'number' && Number.isFinite(input.stateAgeMs)) {
+    return Math.max(0, input.stateAgeMs);
+  }
+  let mtimeMs = typeof input.stateMtimeMs === 'number' && Number.isFinite(input.stateMtimeMs)
+    ? input.stateMtimeMs
+    : null;
+  if (mtimeMs === null && typeof input.statePath === 'string' && input.statePath.trim() !== '') {
+    try {
+      mtimeMs = fs.statSync(input.statePath).mtimeMs;
+    } catch {
+      mtimeMs = null;
+    }
+  }
+  if (mtimeMs === null) return null;
+  return Math.max(0, safeNow.getTime() - mtimeMs);
+}
+
 /**
  * 生成开机卡。纯函数：所有输入显式传入，方便覆盖缺失/超长/中文路径等边界。
  * @param {{
@@ -424,11 +459,14 @@ function allocateBudget(parts, total) {
  *   maxChars?: number,
  *   now?: Date|number|string,
  *   statePath?: string,
+ *   stateMtimeMs?: number,
+ *   stateAgeMs?: number,
  *   handoverPath?: string,
  * }} [input]
  * @returns {{
  *   text:string, chars:number, truncated:boolean, warnings:string[],
  *   found:Record<string,boolean>, handoverName:string|null,
+ *   stateAgeMinutes:number|null,
  * }}
  */
 export function buildOpenCard(input = {}) {
@@ -439,6 +477,8 @@ export function buildOpenCard(input = {}) {
     ? input.now
     : new Date(input.now ?? Date.now());
   const safeNow = Number.isFinite(now.getTime()) ? now : new Date();
+  const stateAgeMs = resolveStateAgeMs(input, safeNow);
+  const stateAgeMinutes = stateAgeMs === null ? null : Math.max(0, Math.round(stateAgeMs / 60000));
   const warnings = [];
   const stateText = typeof input.stateText === 'string' ? normalizeText(input.stateText) : '';
   if (input.stateText === null || input.stateText === undefined) warnings.push('STATE_MISSING');
@@ -458,7 +498,8 @@ export function buildOpenCard(input = {}) {
   if (!input.handover) warnings.push('HANDOVER_MISSING');
   else if (handoverText.trim() === '') warnings.push('HANDOVER_EMPTY');
 
-  const header = `【开机卡】${formatCardTime(safeNow)}`;
+  const ageText = stateCardAgeText(stateAgeMs);
+  const header = `【开机卡】${formatCardTime(safeNow)}${ageText === '' ? '' : ` · ${ageText}`}`;
   const headings = {
     where: '▍我在哪',
     waiting: '▍在等什么',
@@ -516,6 +557,7 @@ export function buildOpenCard(input = {}) {
     warnings,
     found: { ...parsed.found, handover: handoverText.trim() !== '' },
     handoverName,
+    stateAgeMinutes,
   };
 }
 
@@ -558,6 +600,14 @@ export function collectOpenCard(options = {}) {
   const errors = [];
   const stateRead = readTextFile(statePath);
   if (!stateRead.ok) errors.push(`STATE_READ_FAILED:${stateRead.error}`);
+  // R6.2: the open card must say how old the state card is. Read the mtime
+  // once here; a missing file leaves it unknown and the sentence is omitted.
+  let stateMtimeMs = null;
+  try {
+    stateMtimeMs = fs.statSync(statePath).mtimeMs;
+  } catch {
+    stateMtimeMs = null;
+  }
 
   let handover = null;
   let handoverPath = null;
@@ -593,6 +643,7 @@ export function collectOpenCard(options = {}) {
     maxChars: options.maxChars,
     now: options.now,
     statePath,
+    stateMtimeMs,
     handoverPath: handoverPath ?? undefined,
   });
 

package/src/live.js

@@ -82,6 +82,9 @@ export const LIVE_RECORD_FIELDS = Object.freeze([
   'state',
   'turn',
   'goal',
+  // R3: the clock of the *goal*, not of the row. A heartbeat touch must never
+  // move it (see liveTouch), and the board renders focus.updatedAt from it.
+  'goalUpdatedAt',
   'blocked_on',
   'queued',
   'last_action',
@@ -410,6 +413,9 @@ function decodeRecord(text, expectedSessionId) {
   }
   const updatedMs = parseTime(raw.updatedAt) ?? heartbeatMs;
   const startedMs = parseTime(raw.startedAt) ?? heartbeatMs;
+  // R3 additive field: rows written before this version simply have no goal
+  // clock; keep it as '' (unknown) instead of inventing one from heartbeatAt.
+  const goalUpdatedMs = parseTime(raw.goalUpdatedAt);
   if (!Array.isArray(raw.queued) || !raw.queued.every((item) => typeof item === 'string')) {
     return { ok: false, reason: 'queued 必须是字符串数组' };
   }
@@ -427,6 +433,7 @@ function decodeRecord(text, expectedSessionId) {
       state: raw.state,
       turn: Number.isInteger(raw.turn) && raw.turn >= 0 ? raw.turn : 0,
       goal: typeof raw.goal === 'string' ? raw.goal : '',
+      goalUpdatedAt: goalUpdatedMs != null ? isoTime(goalUpdatedMs) : '',
       blocked_on: typeof raw.blocked_on === 'string' ? raw.blocked_on : '',
       queued: [...raw.queued],
       last_action: normalizeLastAction(raw.last_action, updatedMs),
@@ -485,6 +492,9 @@ function liveEntry(record, { file, root, now, hostname }) {
     pidAlive: alive,
     turn: record.turn,
     goal: record.goal,
+    // R3: the goal write clock (ISO) or null when the row never declared one.
+    // Never derived from heartbeatAt — that is exactly the lie R3 fixes.
+    goalUpdatedAt: record.goalUpdatedAt === '' ? null : record.goalUpdatedAt,
     blocked_on: record.blocked_on,
     queued: record.queued,
     last_action: record.last_action,
@@ -513,6 +523,7 @@ function corruptEntry({ sessionId, file, root, reason, hostHint = null, hostname
     pidAlive: null,
     turn: null,
     goal: '',
+    goalUpdatedAt: null,
     blocked_on: '',
     queued: [],
     last_action: null,
@@ -852,6 +863,12 @@ export function liveUpdate(args = {}, config = {}) {
   const base = prior.record;
   const created = base == null;
   const goal = fit ? fit.value : (base?.goal ?? '');
+  // R3: `goalUpdatedAt` is the goal's own clock. Only a write that supplies a
+  // goal stamps it; patches and heartbeat touches keep the previous value, so
+  // "目标 30 分钟没更新" can be told apart from "心跳 5 秒前刚动过".
+  const goalUpdatedAt = goalInput !== undefined
+    ? isoTime(now)
+    : (base?.goalUpdatedAt ?? '');
   // blocked_on describes a blocked session; anything else clears it, so a
   // running row cannot keep advertising an obstacle nobody is waiting on.
   const priorBlockedOn = base?.blocked_on ?? '';
@@ -873,6 +890,7 @@ export function liveUpdate(args = {}, config = {}) {
     state,
     turn: turn ?? base?.turn ?? 0,
     goal,
+    goalUpdatedAt,
     blocked_on: blockedOn,
     queued: queued.value,
     last_action: lastAction.value,
@@ -940,8 +958,10 @@ export function liveUpdate(args = {}, config = {}) {
  *   - it never creates a row (`status:'absent'` instead), so merely running a
  *     longlive tool does not fabricate a session row;
  *   - it never repairs/lists corrupt rows (`status:'corrupt'`, bytes untouched);
- *   - it preserves `state`, `goal`, `blocked_on`, `queued`, `turn`, `startedAt`
- *     and `ttlMs`: heartbeat says "this writer is still here", not "state changed";
+ *   - it preserves `state`, `goal`, `goalUpdatedAt`, `blocked_on`, `queued`,
+ *     `turn`, `startedAt` and `ttlMs`: heartbeat says "this writer is still
+ *     here", not "state changed". In particular the goal's own clock must not
+ *     move, or the board could no longer tell a stale goal from a live one;
  *   - `lastAction:false` keeps `last_action` exactly as-is (the timer tick);
  *     otherwise only the action stamp is replaced, bounded like every other write.
  */

package/src/recall/privacy.mjs

@@ -8,11 +8,20 @@
  * 为什么用 createRequire 而不是静态 import：
  *   - auto-recall 的核心要保持「零 import、可单测」；
  *   - 隐私门是 ESM，但 Node ≥22 支持同步 require(ESM)（本机 v24.21.0 已验证）；
- *   - 这样门缺失时模块仍能加载，退到核心自带的保守 PII 兜底，绝不因「门没装」而放行。
+ *   - 这样门缺失时模块仍能加载，退到核心自带的保守兜底，绝不因「门没装」而放行。
  *
  * 命中口径 = 隐私门的 verdict==='local_only' **或** 核心兜底正则命中（取并集，宁可多拦）。
- * 调用方：bin/eval.mjs、bin/eval-fresh.mjs、bin/recall-once.mjs、plugin/src/index.js
- *        以及 test/auto-recall.test.mjs（证明真门被调用）。
+ * 兜底分两类：
+ *   - PII：手机号 / 邮箱 / 身份证（1.6.7 起就有）；
+ *   - 密钥/令牌（1.6.8 红队 S3 补）：sk-*、Bearer …、*_API_KEY=*、token=/secret=/password=、
+ *     私钥头、AWS/GitHub/Slack 凭证前缀。活动板是跨会话共享的，
+ *     手机号只泄漏一个人的联系方式，密钥泄漏的是账号本身。
+ *
+ * 发布形态下（没有 privacy-gate 仓库）只靠兜底；DSH_PRIVACY_GATE 显式配置但不可达时
+ * 在加载期 `process.emitWarning` 一次，并强制走强化后的本地规则 —— 不允许静默放行。
+ *
+ * 调用方：bin/eval.mjs、bin/eval-fresh.mjs、bin/recall-once.mjs、plugin/src/index.js、
+ *         src/activity/{store,index}.js 以及 test/auto-recall.test.mjs（证明真门被调用）。
  */
 
 import { createRequire } from 'node:module';
@@ -22,15 +31,20 @@ import { fileURLToPath } from 'node:url';
 const HERE = path.dirname(fileURLToPath(import.meta.url));
 const require = createRequire(import.meta.url);
 
+const ENV_GATE = typeof process.env.DSH_PRIVACY_GATE === 'string' && process.env.DSH_PRIVACY_GATE.trim() !== ''
+  ? process.env.DSH_PRIVACY_GATE.trim()
+  : null;
+
 /** 环境变量优先；其次是作者树旁边的 privacy-gate；最后是绝对路径兜底。 */
 export const GATE_CANDIDATES = [
-  process.env.DSH_PRIVACY_GATE,
+  ENV_GATE,
   path.resolve(HERE, '../../../privacy-gate/src/memory/privacy-gate.js'),
 ].filter((p) => typeof p === 'string' && p.trim() !== '');
 
 let realScan = null;
 let loadedFrom = null;
 let loadError = null;
+const loadErrors = [];
 for (const candidate of GATE_CANDIDATES) {
   try {
     const mod = require(candidate);
@@ -39,44 +53,116 @@ for (const candidate of GATE_CANDIDATES) {
       loadedFrom = candidate;
       break;
     }
-    loadError = `scanPrivacy not exported by ${candidate}`;
+    loadErrors.push(`scanPrivacy not exported by ${candidate}`);
   } catch (error) {
-    loadError = `${candidate}: ${error?.code ?? error?.message ?? error}`;
+    loadErrors.push(`${candidate}: ${error?.code ?? error?.message ?? error}`);
+  }
+}
+loadError = loadErrors.length > 0 ? loadErrors[loadErrors.length - 1] : null;
+// Diagnostics should name the explicitly configured gate when that is the one
+// that failed — not the author-tree fallback that was tried after it.
+if (ENV_GATE !== null) {
+  const envFailure = loadErrors.find((entry) => entry.startsWith(ENV_GATE));
+  if (envFailure) loadError = envFailure;
+}
+
+/** 显式配置了门却装不上：不静默放行，加载期告警一次，扫描强制走强化本地规则。 */
+const gateConfigured = ENV_GATE !== null;
+const forcedFallback = gateConfigured && realScan === null;
+if (forcedFallback) {
+  try {
+    process.emitWarning(
+      `[longlive:privacy] DSH_PRIVACY_GATE 已配置但不可达（${loadError ?? 'unknown'}）`
+      + '；已强制使用强化本地兜底规则（含密钥/令牌模式），不会静默放行。',
+    );
+  } catch {
+    /* warning is best effort; the scan below is what enforces the rule */
   }
 }
 
-/* 核心兜底：只认三类最硬的 PII，避免把普通数字（token 数、ID 号）误判。 */
+/* 核心兜底 · 一类最硬的 PII：避免把普通数字（token 数、ID 号）误判。 */
 const PII_PATTERNS = [
   { kind: 'phone', re: /(?<!\d)1[3-9]\d{9}(?!\d)/g },
   { kind: 'email', re: /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g },
   { kind: 'id-card', re: /(?<!\d)\d{17}[\dXx](?!\d)/g },
 ];
 
-/** 核心自带的保守扫描（不依赖任何外部文件）。 */
-export function fallbackScan(text) {
-  const s = String(text ?? '');
-  const spans = [];
-  for (const { kind, re } of PII_PATTERNS) {
+/*
+ * 核心兜底 · 密钥/令牌类。全部要求「像凭证」才拦，尽量不误伤普通文本：
+ *   - sk- 前缀要求前面不是标识符字符（`task-id-1234567890` 里的 `sk-id-…` 不算）；
+ *   - `token=`/`api_key=` 这类赋值要求至少 6–8 位值，`token 数 12`、`--test` 不会命中；
+ *   - 赋值形态允许 `[a-z0-9_]{0,32}` 前缀（RE-S3.1：`my_api_key: …`、`apiKey=…`、
+ *     `secret token: …`），分隔符允许 `= : ： ,` 与两侧空格；**纯空格不算分隔符**，
+ *     所以 `password reset flow` / `password 字段在 config.js 里` 不误伤；
+ *   - PRIVATE KEY 头、AWS/GitHub/Slack 前缀是强特征，直接拦。
+ */
+const ASSIGN_VALUE = String.raw`['"]?[A-Za-z0-9._\-/+!@#$%^&*]{6,}`;
+const SECRET_PATTERNS = [
+  // RE-S3.7: sk-/SK- 前缀大小写不敏感（连续形式；空格/Unicode 变体是 P3 残余建议）。
+  { kind: 'api-key', re: /(?<![A-Za-z0-9_-])sk-[A-Za-z0-9][A-Za-z0-9_-]{8,}/gi },
+  { kind: 'api-key', re: /(?<![A-Za-z0-9_])[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)*(?:_API_KEY|_APIKEY|_KEY|_TOKEN|_SECRET|_PASSWORD|_PASSWD)\s*[=:]\s*\S+/g },
+  // RE-S3.1: 小写/带前缀的赋值形态（大小写不敏感）：my_api_key: "…"、apiKey=…。
+  {
+    kind: 'api-key',
+    re: new RegExp(
+      String.raw`(?<![A-Za-z0-9])[A-Za-z0-9_]{0,32}`
+      + String.raw`(?:api[_-]?key|access[_-]?key|secret[_-]?key|private[_-]?key|app[_-]?key|token|secret|password|passwd|pwd|credential)`
+      + String.raw`\s*[:=：,]\s*` + ASSIGN_VALUE,
+      'gi',
+    ),
+  },
+  // RE-S3.1: 多词标签（允许空格/下划线）：secret token: …、api key = …。
+  {
+    kind: 'token',
+    re: new RegExp(
+      String.raw`(?<![A-Za-z0-9])(?:api|access|secret|private|auth|refresh|session)[\s_-]+(?:key|token|secret|password)`
+      + String.raw`\s*[:=：,]\s*` + ASSIGN_VALUE,
+      'gi',
+    ),
+  },
+  { kind: 'api-key', re: /(?<![A-Za-z0-9_])(?:api[_-]?key|access[_-]?key|secret[_-]?key|private[_-]?key|app[_-]?key)\s*[=:]\s*['"]?[A-Za-z0-9._\-/+]{8,}/gi },
+  { kind: 'token', re: /(?<![A-Za-z0-9_])(?:token|auth|access[_-]?token|refresh[_-]?token|session[_-]?token)\s*[=:]\s*['"]?[A-Za-z0-9._\-/+]{8,}/gi },
+  { kind: 'password', re: /(?<![A-Za-z0-9_])(?:password|passwd|pwd)\s*[=:]\s*['"]?[A-Za-z0-9._\-/+!@#$%^&*]{6,}/gi },
+  { kind: 'bearer', re: /\bBearer\s+[A-Za-z0-9._~+/-]{12,}=*/gi },
+  { kind: 'private-key', re: /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY-----/g },
+  { kind: 'aws-key', re: /(?<![A-Z0-9])(?:AKIA|ASIA)[0-9A-Z]{16}(?![0-9A-Z])/g },
+  { kind: 'github-token', re: /\bgh[pousr]_[A-Za-z0-9]{20,}/g },
+  { kind: 'slack-token', re: /\bxox[baprs]-[A-Za-z0-9-]{10,}/g },
+];
+
+function scanWith(patterns, text, spans) {
+  for (const { kind, re } of patterns) {
     re.lastIndex = 0;
-    let m = re.exec(s);
+    let m = re.exec(text);
     while (m !== null) {
       spans.push({ start: m.index, end: m.index + m[0].length, kind });
       if (m.index === re.lastIndex) re.lastIndex += 1;
-      m = re.exec(s);
+      m = re.exec(text);
     }
   }
+}
+
+/** 核心自带的保守扫描（不依赖任何外部文件）：PII + 凭证类，两类都算 local_only。 */
+export function fallbackScan(text) {
+  const s = String(text ?? '');
+  const spans = [];
+  scanWith(PII_PATTERNS, s, spans);
+  scanWith(SECRET_PATTERNS, s, spans);
   spans.sort((a, b) => a.start - b.start);
-  if (spans.length === 0) return { verdict: 'none', spans: [], reasons: [], source: 'core-fallback' };
+  if (spans.length === 0) {
+    return { verdict: 'none', spans: [], reasons: [], source: forcedFallback ? 'core-fallback:forced' : 'core-fallback' };
+  }
   return {
     verdict: 'local_only',
     spans,
     reasons: [...new Set(spans.map((x) => x.kind))],
-    source: 'core-fallback',
+    source: forcedFallback ? 'core-fallback:forced' : 'core-fallback',
   };
 }
 
 /**
  * 注入前的隐私扫描（同步）。
+ * - 核心兜底（含凭证类）先扫，命中直接 local_only；
  * - 隐私门可用 → 调它；门抛错 → fail-closed；
  * - 门说 none 但兜底正则命中 → 仍按命中处理（并集）。
  * @param {string} text
@@ -113,6 +199,9 @@ export const privacyGateStatus = Object.freeze({
   loaded: realScan !== null,
   from: loadedFrom,
   error: realScan === null ? loadError : null,
+  configured: gateConfigured,
+  forcedFallback,
+  scope: 'pii+secret',
 });
 
 /** 给 chooseRecall 用的一次性参数：`options: { ...privacyDefaults }`。 */