@jjh32456/dsh-longlive 1.6.7 → 1.6.8

package/src/recall/privacy.mjs

@@ -8,11 +8,20 @@
  * 为什么用 createRequire 而不是静态 import：
  *   - auto-recall 的核心要保持「零 import、可单测」；
  *   - 隐私门是 ESM，但 Node ≥22 支持同步 require(ESM)（本机 v24.21.0 已验证）；
- *   - 这样门缺失时模块仍能加载，退到核心自带的保守 PII 兜底，绝不因「门没装」而放行。
+ *   - 这样门缺失时模块仍能加载，退到核心自带的保守兜底，绝不因「门没装」而放行。
  *
  * 命中口径 = 隐私门的 verdict==='local_only' **或** 核心兜底正则命中（取并集，宁可多拦）。
- * 调用方：bin/eval.mjs、bin/eval-fresh.mjs、bin/recall-once.mjs、plugin/src/index.js
- *        以及 test/auto-recall.test.mjs（证明真门被调用）。
+ * 兜底分两类：
+ *   - PII：手机号 / 邮箱 / 身份证（1.6.7 起就有）；
+ *   - 密钥/令牌（1.6.8 红队 S3 补）：sk-*、Bearer …、*_API_KEY=*、token=/secret=/password=、
+ *     私钥头、AWS/GitHub/Slack 凭证前缀。活动板是跨会话共享的，
+ *     手机号只泄漏一个人的联系方式，密钥泄漏的是账号本身。
+ *
+ * 发布形态下（没有 privacy-gate 仓库）只靠兜底；DSH_PRIVACY_GATE 显式配置但不可达时
+ * 在加载期 `process.emitWarning` 一次，并强制走强化后的本地规则 —— 不允许静默放行。
+ *
+ * 调用方：bin/eval.mjs、bin/eval-fresh.mjs、bin/recall-once.mjs、plugin/src/index.js、
+ *         src/activity/{store,index}.js 以及 test/auto-recall.test.mjs（证明真门被调用）。
  */
 
 import { createRequire } from 'node:module';
@@ -22,15 +31,20 @@ import { fileURLToPath } from 'node:url';
 const HERE = path.dirname(fileURLToPath(import.meta.url));
 const require = createRequire(import.meta.url);
 
+const ENV_GATE = typeof process.env.DSH_PRIVACY_GATE === 'string' && process.env.DSH_PRIVACY_GATE.trim() !== ''
+  ? process.env.DSH_PRIVACY_GATE.trim()
+  : null;
+
 /** 环境变量优先；其次是作者树旁边的 privacy-gate；最后是绝对路径兜底。 */
 export const GATE_CANDIDATES = [
-  process.env.DSH_PRIVACY_GATE,
+  ENV_GATE,
   path.resolve(HERE, '../../../privacy-gate/src/memory/privacy-gate.js'),
 ].filter((p) => typeof p === 'string' && p.trim() !== '');
 
 let realScan = null;
 let loadedFrom = null;
 let loadError = null;
+const loadErrors = [];
 for (const candidate of GATE_CANDIDATES) {
   try {
     const mod = require(candidate);
@@ -39,44 +53,116 @@ for (const candidate of GATE_CANDIDATES) {
       loadedFrom = candidate;
       break;
     }
-    loadError = `scanPrivacy not exported by ${candidate}`;
+    loadErrors.push(`scanPrivacy not exported by ${candidate}`);
   } catch (error) {
-    loadError = `${candidate}: ${error?.code ?? error?.message ?? error}`;
+    loadErrors.push(`${candidate}: ${error?.code ?? error?.message ?? error}`);
+  }
+}
+loadError = loadErrors.length > 0 ? loadErrors[loadErrors.length - 1] : null;
+// Diagnostics should name the explicitly configured gate when that is the one
+// that failed — not the author-tree fallback that was tried after it.
+if (ENV_GATE !== null) {
+  const envFailure = loadErrors.find((entry) => entry.startsWith(ENV_GATE));
+  if (envFailure) loadError = envFailure;
+}
+
+/** 显式配置了门却装不上：不静默放行，加载期告警一次，扫描强制走强化本地规则。 */
+const gateConfigured = ENV_GATE !== null;
+const forcedFallback = gateConfigured && realScan === null;
+if (forcedFallback) {
+  try {
+    process.emitWarning(
+      `[longlive:privacy] DSH_PRIVACY_GATE 已配置但不可达（${loadError ?? 'unknown'}）`
+      + '；已强制使用强化本地兜底规则（含密钥/令牌模式），不会静默放行。',
+    );
+  } catch {
+    /* warning is best effort; the scan below is what enforces the rule */
   }
 }
 
-/* 核心兜底：只认三类最硬的 PII，避免把普通数字（token 数、ID 号）误判。 */
+/* 核心兜底 · 一类最硬的 PII：避免把普通数字（token 数、ID 号）误判。 */
 const PII_PATTERNS = [
   { kind: 'phone', re: /(?<!\d)1[3-9]\d{9}(?!\d)/g },
   { kind: 'email', re: /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g },
   { kind: 'id-card', re: /(?<!\d)\d{17}[\dXx](?!\d)/g },
 ];
 
-/** 核心自带的保守扫描（不依赖任何外部文件）。 */
-export function fallbackScan(text) {
-  const s = String(text ?? '');
-  const spans = [];
-  for (const { kind, re } of PII_PATTERNS) {
+/*
+ * 核心兜底 · 密钥/令牌类。全部要求「像凭证」才拦，尽量不误伤普通文本：
+ *   - sk- 前缀要求前面不是标识符字符（`task-id-1234567890` 里的 `sk-id-…` 不算）；
+ *   - `token=`/`api_key=` 这类赋值要求至少 6–8 位值，`token 数 12`、`--test` 不会命中；
+ *   - 赋值形态允许 `[a-z0-9_]{0,32}` 前缀（RE-S3.1：`my_api_key: …`、`apiKey=…`、
+ *     `secret token: …`），分隔符允许 `= : ： ,` 与两侧空格；**纯空格不算分隔符**，
+ *     所以 `password reset flow` / `password 字段在 config.js 里` 不误伤；
+ *   - PRIVATE KEY 头、AWS/GitHub/Slack 前缀是强特征，直接拦。
+ */
+const ASSIGN_VALUE = String.raw`['"]?[A-Za-z0-9._\-/+!@#$%^&*]{6,}`;
+const SECRET_PATTERNS = [
+  // RE-S3.7: sk-/SK- 前缀大小写不敏感（连续形式；空格/Unicode 变体是 P3 残余建议）。
+  { kind: 'api-key', re: /(?<![A-Za-z0-9_-])sk-[A-Za-z0-9][A-Za-z0-9_-]{8,}/gi },
+  { kind: 'api-key', re: /(?<![A-Za-z0-9_])[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)*(?:_API_KEY|_APIKEY|_KEY|_TOKEN|_SECRET|_PASSWORD|_PASSWD)\s*[=:]\s*\S+/g },
+  // RE-S3.1: 小写/带前缀的赋值形态（大小写不敏感）：my_api_key: "…"、apiKey=…。
+  {
+    kind: 'api-key',
+    re: new RegExp(
+      String.raw`(?<![A-Za-z0-9])[A-Za-z0-9_]{0,32}`
+      + String.raw`(?:api[_-]?key|access[_-]?key|secret[_-]?key|private[_-]?key|app[_-]?key|token|secret|password|passwd|pwd|credential)`
+      + String.raw`\s*[:=：,]\s*` + ASSIGN_VALUE,
+      'gi',
+    ),
+  },
+  // RE-S3.1: 多词标签（允许空格/下划线）：secret token: …、api key = …。
+  {
+    kind: 'token',
+    re: new RegExp(
+      String.raw`(?<![A-Za-z0-9])(?:api|access|secret|private|auth|refresh|session)[\s_-]+(?:key|token|secret|password)`
+      + String.raw`\s*[:=：,]\s*` + ASSIGN_VALUE,
+      'gi',
+    ),
+  },
+  { kind: 'api-key', re: /(?<![A-Za-z0-9_])(?:api[_-]?key|access[_-]?key|secret[_-]?key|private[_-]?key|app[_-]?key)\s*[=:]\s*['"]?[A-Za-z0-9._\-/+]{8,}/gi },
+  { kind: 'token', re: /(?<![A-Za-z0-9_])(?:token|auth|access[_-]?token|refresh[_-]?token|session[_-]?token)\s*[=:]\s*['"]?[A-Za-z0-9._\-/+]{8,}/gi },
+  { kind: 'password', re: /(?<![A-Za-z0-9_])(?:password|passwd|pwd)\s*[=:]\s*['"]?[A-Za-z0-9._\-/+!@#$%^&*]{6,}/gi },
+  { kind: 'bearer', re: /\bBearer\s+[A-Za-z0-9._~+/-]{12,}=*/gi },
+  { kind: 'private-key', re: /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY-----/g },
+  { kind: 'aws-key', re: /(?<![A-Z0-9])(?:AKIA|ASIA)[0-9A-Z]{16}(?![0-9A-Z])/g },
+  { kind: 'github-token', re: /\bgh[pousr]_[A-Za-z0-9]{20,}/g },
+  { kind: 'slack-token', re: /\bxox[baprs]-[A-Za-z0-9-]{10,}/g },
+];
+
+function scanWith(patterns, text, spans) {
+  for (const { kind, re } of patterns) {
     re.lastIndex = 0;
-    let m = re.exec(s);
+    let m = re.exec(text);
     while (m !== null) {
       spans.push({ start: m.index, end: m.index + m[0].length, kind });
       if (m.index === re.lastIndex) re.lastIndex += 1;
-      m = re.exec(s);
+      m = re.exec(text);
     }
   }
+}
+
+/** 核心自带的保守扫描（不依赖任何外部文件）：PII + 凭证类，两类都算 local_only。 */
+export function fallbackScan(text) {
+  const s = String(text ?? '');
+  const spans = [];
+  scanWith(PII_PATTERNS, s, spans);
+  scanWith(SECRET_PATTERNS, s, spans);
   spans.sort((a, b) => a.start - b.start);
-  if (spans.length === 0) return { verdict: 'none', spans: [], reasons: [], source: 'core-fallback' };
+  if (spans.length === 0) {
+    return { verdict: 'none', spans: [], reasons: [], source: forcedFallback ? 'core-fallback:forced' : 'core-fallback' };
+  }
   return {
     verdict: 'local_only',
     spans,
     reasons: [...new Set(spans.map((x) => x.kind))],
-    source: 'core-fallback',
+    source: forcedFallback ? 'core-fallback:forced' : 'core-fallback',
   };
 }
 
 /**
  * 注入前的隐私扫描（同步）。
+ * - 核心兜底（含凭证类）先扫，命中直接 local_only；
  * - 隐私门可用 → 调它；门抛错 → fail-closed；
  * - 门说 none 但兜底正则命中 → 仍按命中处理（并集）。
  * @param {string} text
@@ -113,6 +199,9 @@ export const privacyGateStatus = Object.freeze({
   loaded: realScan !== null,
   from: loadedFrom,
   error: realScan === null ? loadError : null,
+  configured: gateConfigured,
+  forcedFallback,
+  scope: 'pii+secret',
 });
 
 /** 给 chooseRecall 用的一次性参数：`options: { ...privacyDefaults }`。 */

package/src/router/service/board.mjs

@@ -30,6 +30,10 @@ export const FOCUS_ACTION_DETAIL_MAX = 60;
 export const LAST_CONCLUSION_MAX = 120;
 export const TIMELINE_MAX = 8;
 export const ROSTER_MAX = 256;
+// R3: a declared goal older than this is no longer "what the session is doing
+// right now". The board says so instead of letting the heartbeat timestamp
+// masquerade as the goal's freshness.
+export const FOCUS_STALE_MS = 30 * 60 * 1000;
 
 const STATE_PRIORITY = Object.freeze({ running: 0, blocked: 1, waiting: 2, idle: 3 });
 
@@ -331,9 +335,38 @@ export function createBoardBuilder(options = {}) {
     if (args.saturated === true) warnings.push('LIVE_ROWS_SATURATED');
 
     const metadata = Array.isArray(args.metadata) ? args.metadata : null;
+    // A host that cannot list sessions (no metadata source) leaves row origin
+    // unknown. A non-empty list is treated as authoritative; an empty/absent
+    // one falls into the fail-safe heuristic below.
+    const metadataAvailable = Array.isArray(metadata) && metadata.length > 0;
     const metaMap = new Map();
     for (const item of metadata ?? []) metaMap.set(item.sessionId, item);
 
+    /**
+     * R4.6: main vs subagent origin for one live row.
+     * With metadata: the host list is authoritative; a row missing from it is
+     * `unknown` (fail-safe: never counted as active/running/focus).
+     * Without metadata: the host contract (verified against real DSH session
+     * dirs on this machine) is root sessions `session-<uuid>` / subagent and
+     * worker sessions bare UUID ids; a bare UUID row is therefore `unknown`
+     * until proven otherwise, everything else stays `main` so a host that
+     * cannot list sessions never silently drops its rows.
+     */
+    const originOfSession = (sessionId) => {
+      if (typeof sessionId !== 'string' || sessionId === '') return 'unknown';
+      if (metadataAvailable) {
+        const meta = metaMap.get(sessionId) ?? null;
+        if (!meta) return 'unknown';
+        return meta.origin === 'subagent' ? 'subagent' : 'main';
+      }
+      return isBareUuidSessionId(sessionId) ? 'unknown' : 'main';
+    };
+    const originMap = new Map();
+    for (const entry of scan.entries) {
+      if (entry.sessionId) originMap.set(entry.sessionId, originOfSession(entry.sessionId));
+    }
+    const originRank = (entry) => originMap.get(entry.sessionId) ?? 'unknown';
+
     const liveEntries = scan.entries.filter((entry) => !entry.corrupt && entry.sessionId);
     const liveMap = new Map(liveEntries.map((entry) => [entry.sessionId, entry]));
     const liveCount = liveEntries.length;
@@ -366,26 +399,46 @@ export function createBoardBuilder(options = {}) {
     roster.sort((a, b) => a.sessionId.localeCompare(b.sessionId));
     if (roster.length > ROSTER_MAX) roster.length = ROSTER_MAX;
 
-    const unknownSessions = roster.filter((item) => item.unknown === true && item.origin !== 'subagent').length;
-    const activeEntries = liveEntries.filter((entry) => ACTIVE_STATE_SET.has(entry.effectiveState) && !isSubagent(entry, metaMap));
+    const metadataUnknownSessions = roster.filter((item) => item.unknown === true && item.origin !== 'subagent').length;
+    // Active/focus set: rows we can prove are main sessions and that are not
+    // dead/stale/corrupt (ACTIVE_STATE_SET is exactly the declared-state band).
+    const activeEntries = liveEntries.filter((entry) => originRank(entry) === 'main'
+      && ACTIVE_STATE_SET.has(entry.effectiveState));
+    // Rows whose origin we cannot prove: fail-safe — never counted active or
+    // shown in focus, but reported as unknown instead of silently believed
+    // (R4.6 边界：metadata 缺失时的 subagent 行不得再抬高 running/active).
+    const unknownOriginEntries = liveEntries.filter((entry) => originRank(entry) === 'unknown'
+      && ACTIVE_STATE_SET.has(entry.effectiveState));
     // A live row we can see but cannot decode still proves a session exists.
     // DESIGN §9 counts such a row as active (state unknown), while a zero-byte
     // file is an interrupted write and is ignored (and later cleaned).
     const unreadableActive = scan.entries.filter((entry) => entry.corrupt === true
       && entry.sessionId
-      && !isSubagent(entry, metaMap)
+      && originRank(entry) === 'main'
       && fileHasBytes(entry.file)).length;
-    // Subagents are counted only in counts.subagents: they never inflate
-    // activeSessions/unknownSessions and never appear in focus.
+    const unreadableUnknown = scan.entries.filter((entry) => entry.corrupt === true
+      && entry.sessionId
+      && originRank(entry) === 'unknown'
+      && fileHasBytes(entry.file)).length;
+    // Sessions we cannot classify (no metadata + child-shaped id, or a live row
+    // missing from the host's session list) are reported as unknown, never as
+    // running/main. Subagents are counted only in counts.subagents.
+    const unknownSessions = metadataUnknownSessions + unknownOriginEntries.length + unreadableUnknown;
     const allActive = activeEntries.length + unreadableActive;
     if (activeEntries.length > Math.max(1, maxSessions)) warnings.push('FOCUS_LIMITED');
-    const running = liveEntries.filter((entry) => entry.state === 'running').length;
-    const blocked = liveEntries.filter((entry) => entry.state === 'blocked').length;
+    // R4.7: pulse counts share the active/focus set (main sessions, not
+    // dead/stale/corrupt) and count the row's DECLARED state. effectiveState
+    // alone cannot answer this: a fresh heartbeat returns `running` for every
+    // row, so a live declared-blocked row would never count as blocked (the
+    // R4.7 first-round over-fix; RE-R47.1).
+    const running = activeEntries.filter((entry) => entry.state === 'running').length;
+    const blocked = activeEntries.filter((entry) => entry.state === 'blocked').length;
     const subagents = roster.filter((item) => item.origin === 'subagent').length;
 
     const proposals = readProposalSummaries(proposalsDir);
     const countsProposals = proposalCounts(proposals);
     const conclusions = readBridgeConclusions(bridgeDir);
+    const atMs = at.getTime();
 
     const focus = activeEntries
       .map((entry) => {
@@ -395,19 +448,30 @@ export function createBoardBuilder(options = {}) {
         // detail (already capped to 60 chars), skipping lifecycle-only noise.
         const conclusion = conclusions.get(entry.sessionId)
           ?? conclusionFromAction(lastAction);
+        // R3: focus.updatedAt is the goal's own clock; heartbeatAt must never
+        // pretend to be it. Rows that never declared a goal (or rows written
+        // before the goal clock existed) get null — unknown, not fabricated —
+        // and are never marked stale because there is no goal to be stale.
+        const goalUpdatedMs = Date.parse(entry.goalUpdatedAt ?? '');
+        const goalUpdatedAt = Number.isFinite(goalUpdatedMs) ? entry.goalUpdatedAt : null;
+        const declared = goalText !== '';
+        const goalAgeMs = declared && goalUpdatedAt !== null ? Math.max(0, atMs - goalUpdatedMs) : null;
+        const stale = goalAgeMs !== null && goalAgeMs > FOCUS_STALE_MS;
         return {
           sessionId: entry.sessionId,
           goal: goalText || '（未声明）',
-          updatedAt: isoOrNull(entry.heartbeatAt),
+          updatedAt: goalUpdatedAt,
+          goalAgeMs,
+          stale,
           lastAction,
           lastConclusion: lastConclusionOf(conclusion),
           queuedCount: queuedCountOf(entry.queued),
           state: entry.effectiveState,
-          declared: goalText !== '',
+          declared,
         };
       })
       .sort((a, b) => {
-        // DESIGN §3.2: declared goal → running → freshest heartbeat.
+        // DESIGN §3.2: declared goal → running → freshest goal write.
         if (a.declared !== b.declared) return a.declared ? -1 : 1;
         const pa = STATE_PRIORITY[a.state] ?? 9;
         const pb = STATE_PRIORITY[b.state] ?? 9;
@@ -423,7 +487,11 @@ export function createBoardBuilder(options = {}) {
         lastAction: item.lastAction,
         lastConclusion: item.lastConclusion,
         queuedCount: item.queuedCount,
+        // R3.2: the stale flag is the single tree-wide signal (focus item);
+        // omitted when fresh so the persisted 6-field shape is unchanged.
+        ...(item.stale ? { stale: true } : {}),
       }));
+    const focusStale = focus.some((item) => item.stale === true);
 
     const timeline = countsProposals.applied
       .filter((item) => item.title !== '')
@@ -468,7 +536,9 @@ export function createBoardBuilder(options = {}) {
       activeSessions: allActive,
       unknownSessions,
       focusVisible: focus.length,
-      stale: false,
+      // In-memory aggregate of R3 staleness (focus items carry stale:true).
+      // Never persisted: board.json shows it on the individual focus row.
+      stale: focusStale,
       counts: {
         active: allActive,
         running,
@@ -608,9 +678,18 @@ function cleanBoardTmp(boardFile, nowMs) {
   return removed;
 }
 
-function isSubagent(entry, metaMap) {
-  const meta = metaMap.get(entry.sessionId);
-  return meta?.origin === 'subagent';
+/**
+ * R4.6 fail-safe: the host's child-session id shape. Real DSH session dirs on
+ * this machine show root/main sessions as `session-<uuid>` while spawned
+ * subagent/worker sessions get a bare UUID. When the host exposes no session
+ * metadata this is the only honest signal available, so a bare-UUID row is
+ * treated as *unknown origin* (reported in unknownSessions, never counted as
+ * running/active/main). Requires metadata to be certain: with metadata the
+ * host list wins and this heuristic is not consulted.
+ */
+export function isBareUuidSessionId(sessionId) {
+  return typeof sessionId === 'string'
+    && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(sessionId);
 }
 
 function verifyBoardWrite(file, board) {
@@ -623,7 +702,8 @@ function verifyBoardWrite(file, board) {
 
 /** Format one focus row for the fixed hint template. */
 export function renderFocusLine(item) {
-  return `- ${item.sessionId} ${item.state ?? ''} · 目标${quoted(item.goal, FOCUS_GOAL_MAX)} · ${timeOf(item.updatedAt)}`;
+  const stale = item?.stale === true ? ' · stale（目标超 30 分钟未更新）' : '';
+  return `- ${item.sessionId} ${item.state ?? ''} · 目标${quoted(item.goal, FOCUS_GOAL_MAX)} · ${timeOf(item.updatedAt)}${stale}`;
 }
 
 export function timeOf(iso) {

package/src/router/service/hint.mjs

@@ -180,6 +180,17 @@ function relativeMinutes(iso, nowMs) {
 }
 
 const RECENT_ACTION_MS = 10 * 60 * 1000;
+// R3.4: the stale flag must be visible in the shared hint, not only in
+// board.json. Same signal as focus.stale:true — the hint never re-judges it.
+const FOCUS_STALE_MINUTES = 30;
+
+/** User-visible stale suffix for one focus row; '' when the goal is fresh. */
+function focusStaleMarker(item, nowMs) {
+  if (!item || item.stale !== true) return '';
+  const age = relativeMinutes(item.updatedAt, nowMs);
+  const goalAge = age === null || age === '刚刚' ? '目标超 30 分钟未更新' : `目标 ${age}写入，超 ${FOCUS_STALE_MINUTES} 分钟未更新`;
+  return ` · stale（${goalAge}）`;
+}
 
 /**
  * L2 presence upgrade: sessions other than this one whose `lastAction.at` moved
@@ -238,6 +249,9 @@ export function renderHint(board, options = {}) {
       // Presence upgrade: 12-char prefix instead of a full opaque session id.
       const sessionId = sessionPrefix(item.sessionId, 12);
       let line = `- ${sessionId} 目标「${goal}」`;
+      // R3.4: stale goals must be visible to the other session, with the goal's
+      // own write time — never silently dropped from the shared hint.
+      line += focusStaleMarker(item, nowMs);
       const action = item.lastAction && typeof item.lastAction === 'object' ? item.lastAction : null;
       if (action) {
         const kind = neutralizeEnvelope(oneLine(action.kind, 24));

package/src/router/service/service.mjs

@@ -607,8 +607,13 @@ export class RouterService {
         pulse: {
           ...(board.pulse ?? {}),
           active: board.activeSessions ?? 0,
-          running: 0,
-          blocked: this.panelState === 'blocked' ? 1 : 0,
+          // R4.2: same projection as board.json — never a second, hardcoded
+          // number. Before this, status.json said 0 while board.json said 34.
+          running: board.pulse?.running ?? 0,
+          // R4.7: blocked is the same pulse field as the board's — never the
+          // Router's own panelState wearing the same name with another value.
+          // Router state is already reported as status.state.
+          blocked: board.pulse?.blocked ?? 0,
           unknownSessions: board.unknownSessions ?? 0,
           queuedProposals: proposals.queue?.depth ?? 0,
           approvedProposals: proposalCounts.queued ?? 0,
@@ -1567,7 +1572,18 @@ export class RouterService {
     if (this.deps.installListener === false) return;
     if (typeof this.ctx.on !== 'function') return;
     try {
-      const disposer = this.ctx.on('session/event', (event) => this.handleSessionEvent(event), { prepend: false });
+      // R4.4: the real host emits `session/event` as TWO positional args
+      // `(session, event)` (recorded DSH logs, 2026-11-06), while several
+      // shipped tests drive the legacy one-arg envelope. Accept both arities:
+      // two-arg -> event is arg 2 and arg 1 is the session; one-arg -> arg 1 is
+      // the event (which may still carry `.session` inside).
+      const listener = (...args) => {
+        const twoArg = args.length >= 2 && args[1] != null;
+        const event = twoArg ? args[1] : args[0];
+        const session = twoArg ? args[0] : null;
+        return this.handleSessionEvent(event, session);
+      };
+      const disposer = this.ctx.on('session/event', listener, { prepend: false });
       if (typeof disposer === 'function') this.listenerDisposers.push(disposer);
     } catch (error) {
       this.#log('warn', `session/event listener install failed: ${errorMessage(error)}`);
@@ -1699,9 +1715,9 @@ export class RouterService {
     }
   }
 
-  #onTurnEnd(event, via) {
+  #onTurnEnd(event, via, sessionArg = null) {
     if (this.disposed) return;
-    const session = this.#sessionOfEvent(event);
+    const session = sessionArg ?? this.#sessionOfEvent(event);
     const id = sessionIdOf(session) ?? sessionIdOf(event);
     if (!id) return;
     const header = session?.header ?? {};
@@ -1740,20 +1756,20 @@ export class RouterService {
     }
   }
 
-  #handleLiveEvent(event) {
+  #handleLiveEvent(event, sessionArg = null) {
     const type = event?.type;
     if (type === 'session/created') {
-      this.#onSessionCreated(this.#sessionOfEvent(event), 'session/event');
+      this.#onSessionCreated(sessionArg ?? this.#sessionOfEvent(event), 'session/event');
       return true;
     }
     if (type === 'turn/end') {
-      this.#onTurnEnd(event, 'turn/end');
+      this.#onTurnEnd(event, 'turn/end', sessionArg);
       return true;
     }
     if (type === 'agent/status') {
       const status = event?.data?.state ?? event?.data?.status ?? event?.status;
       if (status === 'idle') {
-        this.#onTurnEnd(event, 'agent/status');
+        this.#onTurnEnd(event, 'agent/status', sessionArg);
         return true;
       }
     }
@@ -1764,10 +1780,10 @@ export class RouterService {
    * turn/end 唤醒：只认 reason.kind === 'completed'，2 秒防抖 + 5 分钟合并。
    * 返回 {scheduled, coalesced?, debounced?, ignored?}，方便单测。
    */
-  handleSessionEvent(event) {
+  handleSessionEvent(event, session = null) {
     // L1 heartbeat runs for every turn boundary, independent of reflectOnTurn
     // and of reason.kind (an aborted turn still ends).
-    try { this.#handleLiveEvent(event); } catch (error) {
+    try { this.#handleLiveEvent(event, session); } catch (error) {
       this.#log('warn', `live heartbeat failed: ${errorMessage(error)}`);
     }
     const type = event?.type;