@jjh32456/dsh-longlive 1.6.7 → 1.8.0

package/src/role/writeprotect.js

@@ -0,0 +1,373 @@
+// src/role/writeprotect.js — 1.8.0 / v2.8.1 §16.8 A/E：宿主私有写保护 + HMAC 侧车 + 四元边界
+//
+// 设计（§16.8）：
+//   A. `.longlive/role/**`、`.longlive/working/**` 等数据「模型与子脑不可写」：
+//      ① 宿主进程独占写（tmp + rename + fsync）；② 每文件 HMAC 侧车
+//      `<file>.hmac` = HMAC-SHA256(auditKey, canonical bytes)，读时校验，失败
+//      → `E_INTEGRITY_TAMPER` 且拒绝加载；③ 模型工具/子脑直写 → `E_WRITE_DENY`。
+//   E. 四元边界 sessionId/userId/projectId/readers[]：私密帧拒绝 `E_FRAME_PRIVATE`；
+//      role 文件带 subject/readers，跨用户读取被拒（宿主例外）。
+//
+// 密钥：宿主内存 auditKey 优先（与 panel-auth 同源）；未注入时从
+// `<memoryRoot>/.longlive/.hostkey` 取（首启生成，0600 权限，宿主私有目录约定）。
+// 该 key 与内容分开存放且不在任何响应/日志里出现；残余风险见 docs/ROLE.md。
+//
+// 纯本地、失败静默：写路径抛结构化错误；读路径由调用方决定降级。
+
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+
+import { isInsideRoot, memoryError } from '../memory/paths.js';
+import { RoleError, ROLE_CODES, iso } from './base.js';
+
+export const WRITEPROTECT_SCHEMA = 'hostwrite/v1';
+export const SIDECAR_SUFFIX = '.hmac';
+export const HOST_KEY_FILE = '.hostkey';
+/** Host-injected audit key wins over the persisted fallback key file. */
+export const AUDIT_KEY_ENV = 'DSH_LONGLIVE_AUDIT_KEY';
+export const WRITE_CODES = Object.freeze({
+  WRITE_DENY: 'E_WRITE_DENY',
+  NO_CAP: 'E_NO_CAP',
+  TAMPER: 'E_INTEGRITY_TAMPER',
+  SIDECAR: 'E_SIDECAR_INVALID',
+  FRAME_PRIVATE: 'E_FRAME_PRIVATE',
+  ACCESS_DENIED: 'E_ACCESS_DENIED',
+  SUBJECT: 'E_SUBJECT_INVALID',
+});
+export const ROLE_SUBJECT_FIELDS = Object.freeze(['sessionId', 'userId', 'projectId', 'readers']);
+/** §16.8 A：模型/子脑永远不是 host writer。 */
+export const HOST_ACTORS = Object.freeze(['host', 'panel']);
+
+function writeError(code, message, status = 403, details = undefined) {
+  const error = new RoleError(code, message, details);
+  error.status = status;
+  return error;
+}
+
+/** Host-only actor gate: anything else is a model/subagent direct write. */
+export function assertHostWrite(actorKind) {
+  const actor = String(actorKind ?? 'host');
+  if (!HOST_ACTORS.includes(actor)) {
+    throw writeError(WRITE_CODES.WRITE_DENY, `模型/子脑不可直写宿主私有数据（actor=${actor}）；请走宿主写路径。`);
+  }
+  return true;
+}
+
+function hostKeyPath(memoryRoot) {
+  return path.join(path.resolve(String(memoryRoot ?? '')), '.longlive', HOST_KEY_FILE);
+}
+
+/** Read the persisted host key file, or null when absent. */
+export function readHostKeyFile(memoryRoot) {
+  try {
+    const text = fs.readFileSync(hostKeyPath(memoryRoot), 'utf8').trim();
+    return text === '' ? null : text;
+  } catch {
+    return null;
+  }
+}
+
+/** Host-injected key from the environment (never written to disk by this module). */
+export function readHostKeyEnv(env = process.env) {
+  const value = env?.[AUDIT_KEY_ENV];
+  return typeof value === 'string' && value.trim() !== '' ? value.trim() : null;
+}
+
+/**
+ * Resolve a key for read verification without creating anything:
+ * host-injected env/auditKey first, then the persisted fallback file.
+ * Missing everything => null (callers fail closed).
+ */
+export function readHostKey(memoryRoot, { auditKey = null, env = process.env } = {}) {
+  const envKey = readHostKeyEnv(env);
+  if (envKey !== null) return envKey;
+  if (Buffer.isBuffer(auditKey) || typeof auditKey === 'string') {
+    const key = Buffer.isBuffer(auditKey) ? auditKey.toString('hex') : String(auditKey);
+    if (key.trim() !== '') return key.trim();
+  }
+  return readHostKeyFile(memoryRoot);
+}
+
+/**
+ * Keys a read path may verify against: host env key, injected auditKey, then
+ * the persisted fallback key file. Writers seal with the first available key.
+ */
+export function hostKeyCandidates(memoryRoot, { auditKey = null, env = process.env } = {}) {
+  const candidates = [];
+  const envKey = readHostKeyEnv(env);
+  if (envKey !== null) candidates.push(envKey);
+  if (Buffer.isBuffer(auditKey) || typeof auditKey === 'string') {
+    const key = Buffer.isBuffer(auditKey) ? auditKey.toString('hex') : String(auditKey);
+    if (key.trim() !== '' && !candidates.includes(key.trim())) candidates.push(key.trim());
+  }
+  const fileKey = readHostKeyFile(memoryRoot);
+  if (fileKey !== null && !candidates.includes(fileKey)) candidates.push(fileKey);
+  return candidates;
+}
+
+/**
+ * Resolve the host write key: env DSH_LONGLIVE_AUDIT_KEY > injected auditKey >
+ * persisted fallback `<memoryRoot>/.longlive/.hostkey` (created on first use).
+ */
+export function resolveHostKey(memoryRoot, { auditKey = null, env = process.env } = {}) {
+  const envKey = readHostKeyEnv(env);
+  if (envKey !== null) return envKey;
+  if (Buffer.isBuffer(auditKey) || typeof auditKey === 'string') {
+    const key = Buffer.isBuffer(auditKey) ? auditKey.toString('hex') : String(auditKey);
+    if (key.trim() !== '') return key;
+  }
+  const file = hostKeyPath(memoryRoot);
+  try {
+    const text = fs.readFileSync(file, 'utf8').trim();
+    if (text !== '') return text;
+  } catch {
+    /* create below */
+  }
+  const key = crypto.randomBytes(32).toString('hex');
+  const dir = path.dirname(file);
+  fs.mkdirSync(dir, { recursive: true });
+  const tmp = `${file}.tmp-${process.pid}-${crypto.randomBytes(3).toString('hex')}`;
+  fs.writeFileSync(tmp, `${key}\n`, { encoding: 'utf8', mode: 0o600 });
+  fs.renameSync(tmp, file);
+  try { fs.chmodSync(file, 0o600); } catch { /* windows best effort */ }
+  return key;
+}
+
+export function hmacFor(key, text) {
+  return crypto.createHmac('sha256', key).update(String(text ?? ''), 'utf8').digest('hex');
+}
+
+export function sidecarPath(file) {
+  return `${file}${SIDECAR_SUFFIX}`;
+}
+
+function writeAtomicRaw(file, text) {
+  const dir = path.dirname(file);
+  fs.mkdirSync(dir, { recursive: true });
+  const tmp = path.join(dir, `.${path.basename(file)}.${process.pid}.${crypto.randomBytes(4).toString('hex')}.tmp`);
+  const fd = fs.openSync(tmp, 'w');
+  try {
+    fs.writeFileSync(fd, text, 'utf8');
+    fs.fsyncSync(fd);
+  } finally {
+    fs.closeSync(fd);
+  }
+  fs.renameSync(tmp, file);
+  const readBack = fs.readFileSync(file, 'utf8');
+  if (readBack !== text) throw writeError(WRITE_CODES.TAMPER, `写后读回不一致：${file}`, 500);
+  return { ok: true, bytes: Buffer.byteLength(text, 'utf8'), sha256: crypto.createHash('sha256').update(text).digest('hex') };
+}
+
+/**
+ * Host-only protected write: atomic file + HMAC sidecar over the exact bytes.
+ * Refuses model/subagent actors and paths outside the memory root.
+ */
+export function writeProtectedFile({ memoryRoot, file, text, auditKey = null, actorKind = 'host' }) {
+  assertHostWrite(actorKind);
+  const root = path.resolve(String(memoryRoot ?? ''));
+  if (!isInsideRoot(root, path.resolve(file))) {
+    throw memoryError(ROLE_CODES.PATH_OUTSIDE_ROOT, `写保护路径越界：${file}`);
+  }
+  const key = resolveHostKey(root, { auditKey });
+  const written = writeAtomicRaw(file, text);
+  const hmac = hmacFor(key, text);
+  writeAtomicRaw(sidecarPath(file), `${JSON.stringify({
+    schema: WRITEPROTECT_SCHEMA,
+    alg: 'HMAC-SHA256',
+    file: path.basename(file),
+    bytes: written.bytes,
+    sha256: written.sha256,
+    hmac,
+    sealedAt: iso(Date.now()),
+  }, null, 2)}\n`);
+  return { ok: true, file, bytes: written.bytes, sha256: written.sha256, hmac };
+}
+
+/** Host-only protected JSON write. */
+export function writeProtectedJson({ memoryRoot, file, value, auditKey = null, actorKind = 'host' }) {
+  return writeProtectedFile({
+    memoryRoot,
+    file,
+    text: `${JSON.stringify(value, null, 2)}\n`,
+    auditKey,
+    actorKind,
+  });
+}
+
+/** Host-only protected JSONL append: append + re-seal the whole file sidecar. */
+export function appendProtectedJsonl({ memoryRoot, file, row, auditKey = null, actorKind = 'host' }) {
+  assertHostWrite(actorKind);
+  const root = path.resolve(String(memoryRoot ?? ''));
+  if (!isInsideRoot(root, path.resolve(file))) {
+    throw memoryError(ROLE_CODES.PATH_OUTSIDE_ROOT, `写保护路径越界：${file}`);
+  }
+  const key = resolveHostKey(root, { auditKey });
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  const line = `${JSON.stringify(row)}\n`;
+  const fd = fs.openSync(file, 'a');
+  try {
+    fs.writeFileSync(fd, line, 'utf8');
+    try { fs.fsyncSync(fd); } catch { /* append fsync best effort */ }
+  } finally {
+    fs.closeSync(fd);
+  }
+  const text = fs.readFileSync(file, 'utf8');
+  const hmac = hmacFor(key, text);
+  writeAtomicRaw(sidecarPath(file), `${JSON.stringify({
+    schema: WRITEPROTECT_SCHEMA,
+    alg: 'HMAC-SHA256',
+    file: path.basename(file),
+    bytes: Buffer.byteLength(text, 'utf8'),
+    hmac,
+    sealedAt: iso(Date.now()),
+  }, null, 2)}\n`);
+  return { ok: true, file, bytes: Buffer.byteLength(line, 'utf8'), hmac };
+}
+
+/**
+ * Verify one file against its sidecar. Returns {ok, code, tampered}.
+ * Missing sidecar on a missing file = clean absence; missing sidecar on an
+ * existing file = `E_SIDECAR_INVALID` (unprotected content must not load).
+ */
+export function verifyProtectedFile({ memoryRoot, file, auditKey = null }) {
+  const root = path.resolve(String(memoryRoot ?? ''));
+  let text;
+  try {
+    text = fs.readFileSync(file, 'utf8');
+  } catch (error) {
+    if (error?.code === 'ENOENT') return { ok: true, absent: true, tampered: false };
+    return { ok: false, absent: false, tampered: true, code: WRITE_CODES.TAMPER, error: error?.code ?? 'EREAD' };
+  }
+  let sidecar;
+  try {
+    sidecar = JSON.parse(fs.readFileSync(sidecarPath(file), 'utf8'));
+  } catch {
+    return {
+      ok: false, absent: false, tampered: true, code: WRITE_CODES.SIDECAR,
+      message: `缺少/不可读 HMAC 侧车：${sidecarPath(file)}（拒绝加载未受保护的宿主私有内容）`,
+    };
+  }
+  const candidates = hostKeyCandidates(root, { auditKey });
+  // 读路径不创建 key 文件：没有可用 key 时 fail-safe 按 tampered 处理。
+  const matched = typeof sidecar?.hmac === 'string'
+    && candidates.some((key) => hmacFor(key, text) === sidecar.hmac);
+  if (!matched) {
+    return { ok: false, absent: false, tampered: true, code: WRITE_CODES.TAMPER, message: 'HMAC 校验失败（文件被篡改或侧车不匹配）' };
+  }
+  return { ok: true, absent: false, tampered: false, text, sha256: sidecar.sha256 ?? null };
+}
+
+/** Read + verify protected JSON, parsing on success. */
+export function readProtectedJsonValue({ memoryRoot, file, auditKey = null }) {
+  const verify = verifyProtectedFile({ memoryRoot, file, auditKey });
+  if (!verify.ok) return { ok: false, absent: verify.absent === true, code: verify.code, tampered: true, message: verify.message };
+  if (verify.absent) return { ok: true, absent: true, value: null };
+  try {
+    return { ok: true, absent: false, value: JSON.parse(verify.text) };
+  } catch {
+    return { ok: false, absent: false, code: WRITE_CODES.TAMPER, tampered: true, message: '受保护文件 JSON 解析失败' };
+  }
+}
+
+/** Read + verify protected JSONL. */
+export function readProtectedJsonl({ memoryRoot, file, auditKey = null, limit = 10_000 }) {
+  const verify = verifyProtectedFile({ memoryRoot, file, auditKey });
+  if (!verify.ok) return { ok: false, absent: verify.absent === true, code: verify.code, tampered: true, rows: [], bad: 0, message: verify.message };
+  if (verify.absent) return { ok: true, absent: true, rows: [], bad: 0, total: 0 };
+  const rows = [];
+  let bad = 0;
+  for (const line of verify.text.split(/\r?\n/)) {
+    if (line.trim() === '') continue;
+    try {
+      const parsed = JSON.parse(line);
+      if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) rows.push(parsed);
+      else bad += 1;
+    } catch {
+      bad += 1;
+    }
+  }
+  return { ok: true, absent: false, rows: rows.slice(-limit), total: rows.length, bad };
+}
+
+/** Serialize a value to the canonical text used by the sidecar. */
+export function protectedJsonText(value) {
+  return `${JSON.stringify(value, null, 2)}\n`;
+}
+
+// ------------------------------------------------------------------ 四元边界
+//
+// §16.8 E：sessionId/userId/projectId/readers[]。private 帧或 readers 不含调用者
+// 时，跨用户读取被拒（host/panel 例外——它们持能力令牌）。
+
+/** Normalize one subject (missing fields are null, readers is a string array). */
+export function normalizeRoleSubject(raw = {}) {
+  const value = raw && typeof raw === 'object' ? raw : {};
+  const readers = Array.isArray(value.readers)
+    ? [...new Set(value.readers.filter((item) => typeof item === 'string' && item.trim() !== '').map((item) => item.trim()))]
+    : [];
+  const field = (name) => (typeof value[name] === 'string' && value[name].trim() !== '' ? value[name].trim() : null);
+  const subject = {
+    sessionId: field('sessionId'),
+    userId: field('userId'),
+    projectId: field('projectId'),
+    readers,
+  };
+  if (value.private === true) subject.private = true;
+  return subject;
+}
+
+/** True when the caller may read this subject's data. Host/panel always may. */
+export function isSubjectReadable(subject, caller = {}) {
+  const actorKind = String(caller?.actorKind ?? 'host');
+  if (HOST_ACTORS.includes(actorKind)) return { ok: true, reason: 'host' };
+  const norm = normalizeRoleSubject(subject ?? {});
+  const userId = typeof caller?.userId === 'string' && caller.userId.trim() !== '' ? caller.userId.trim() : null;
+  if (norm.private === true && userId === null) return { ok: false, code: WRITE_CODES.FRAME_PRIVATE, reason: 'private' };
+  if (norm.readers.length > 0) {
+    if (userId !== null && norm.readers.includes(userId)) return { ok: true, reason: 'reader' };
+    return { ok: false, code: WRITE_CODES.ACCESS_DENIED, reason: 'readers' };
+  }
+  // No explicit reader list: the subject owner is the only non-host reader.
+  if (norm.userId !== null && userId !== norm.userId) {
+    return { ok: false, code: WRITE_CODES.ACCESS_DENIED, reason: 'owner-only' };
+  }
+  if (norm.userId !== null && userId === null) {
+    return { ok: false, code: WRITE_CODES.ACCESS_DENIED, reason: 'owner-only' };
+  }
+  return { ok: true, reason: 'open' };
+}
+
+/** Throwing variant used by read paths that must fail closed. */
+export function assertSubjectReadable(subject, caller = {}) {
+  const verdict = isSubjectReadable(subject, caller);
+  if (!verdict.ok) {
+    throw writeError(verdict.code, `跨用户读取被拒（${verdict.reason}）：subject=${JSON.stringify(normalizeRoleSubject(subject ?? {}))}`, 403);
+  }
+  return true;
+}
+
+/** Frame-specific: `private` frames without a matching reader → E_FRAME_PRIVATE. */
+export function assertFrameReadable(frame, caller = {}) {
+  const subject = normalizeRoleSubject(frame?.subject ?? { sessionId: frame?.sessionId ?? null });
+  const verdict = isSubjectReadable(subject, caller);
+  if (!verdict.ok && (verdict.code === WRITE_CODES.FRAME_PRIVATE || subject.private === true)) {
+    throw writeError(WRITE_CODES.FRAME_PRIVATE, `私密帧拒绝读取（sessionId=${subject.sessionId ?? '?'}，caller=${caller?.userId ?? '?'}）`, 403);
+  }
+  if (!verdict.ok) {
+    throw writeError(WRITE_CODES.ACCESS_DENIED, `跨用户帧读取被拒（${verdict.reason}）`, 403);
+  }
+  return true;
+}
+
+/** Fill the four-element subject for a frame/frame-like record (host write). */
+export function attachFrameSubject(frame, { subject = {}, readers = [], userId = null, projectId = null } = {}) {
+  const merged = normalizeRoleSubject({
+    sessionId: subject.sessionId ?? frame?.sessionId ?? null,
+    userId: subject.userId ?? userId,
+    projectId: subject.projectId ?? projectId,
+    readers: Array.isArray(subject.readers) ? subject.readers : readers,
+    private: subject.private === true || frame?.private === true,
+  });
+  return { ...frame, subject: merged };
+}

package/src/router/aliases.json

@@ -2,30 +2,181 @@
   "version": 1,
   "description": "动作名归一表：canonical 用设计文档的点号写法，legacy 是 0.8.0-rc.1 之前的旧名。judge 一律用 canonical 比对；输出同时保留 legacy 作为兼容别名，旧调用方不用改。",
   "actions": [
-    { "canonical": "acp_status", "legacy": "acp_status", "aliases": ["acp_status", "context.status", "acp.status"] },
-    { "canonical": "read", "legacy": "read", "aliases": ["read", "file.read"] },
-    { "canonical": "grep", "legacy": "grep", "aliases": ["grep", "file.grep"] },
-    { "canonical": "worker_spawn", "legacy": "worker_spawn", "aliases": ["worker_spawn", "worker.spawn", "workflow"] },
-    { "canonical": "worker_status", "legacy": "worker_status", "aliases": ["worker_status", "worker.status"] },
-    { "canonical": "guard.refuse", "legacy": "guard.refuse", "aliases": ["guard.refuse", "refuse", "guard_refuse"] },
-    { "canonical": "guard.dryRun", "legacy": "guard_dry_run", "aliases": ["guard.dryRun", "guard_dry_run", "dry_run", "dry-run"] },
-    { "canonical": "engram.search", "legacy": "engram_search", "aliases": ["engram_search", "engram.search", "memory_recall"] },
-    { "canonical": "engram.save", "legacy": "engram_save", "aliases": ["engram_save", "engram.save", "save_memory"] },
-    { "canonical": "engram.facts.replace", "legacy": "engram_facts", "aliases": ["engram_facts", "engram.facts", "engram.facts.replace"] },
-    { "canonical": "journal.append", "legacy": "journal.append", "aliases": ["journal.append", "journal_append"] },
-    { "canonical": "procedures.draft", "legacy": "procedures.draft", "aliases": ["procedures.draft", "procedures_draft", "memory_procedure"] },
-    { "canonical": "topics.write", "legacy": "topics.write", "aliases": ["topics.write", "topics_write", "topics.write_card"] },
-    { "canonical": "taskboard.update", "legacy": "taskboard.update", "aliases": ["taskboard.update", "taskboard_update"] },
-    { "canonical": "session.handover", "legacy": "session_handover", "aliases": ["session_handover", "session.handover", "handover"] },
-    { "canonical": "session.compact", "legacy": "session_compact", "aliases": ["session_compact", "session.compact", "compress"] },
-    { "canonical": "reply.only", "legacy": "reply.only", "aliases": ["reply.only", "reply_only", "chat"] },
-    { "canonical": "reply.no_write", "legacy": "reply.no_write", "aliases": ["reply.no_write", "reply_no_write", "no_write"] },
-    { "canonical": "reply.ask", "legacy": "reply_ask", "aliases": ["reply.ask", "reply_ask", "ask_user"] },
-    { "canonical": "memory.save_local", "legacy": "memory_save_local", "aliases": ["memory.save_local", "memory_save_local", "save_local"] },
-    { "canonical": "memory.distillPropose", "legacy": "memory_distill_propose", "aliases": ["memory.distillPropose", "memory_distill_propose", "propose_distill"] },
-    { "canonical": "memory.delete", "legacy": "memory_delete", "aliases": ["memory.delete", "memory_delete", "forget_memory"] },
-    { "canonical": "engram.forget", "legacy": "engram_forget", "aliases": ["engram.forget", "engram_forget", "forget"] },
-    { "canonical": "engram.profile.edit", "legacy": "engram_profile_edit", "aliases": ["engram.profile.edit", "engram_profile_edit", "profile_edit"] },
-    { "canonical": "identity.hold", "legacy": "identity_hold", "aliases": ["identity.hold", "identity_hold", "identity_consent_hold"] }
+    {
+      "canonical": "acp_status",
+      "legacy": "acp_status",
+      "aliases": [
+        "acp_status",
+        "context.status",
+        "acp.status"
+      ]
+    },
+    {
+      "canonical": "read",
+      "legacy": "read",
+      "aliases": [
+        "read",
+        "file.read"
+      ]
+    },
+    {
+      "canonical": "grep",
+      "legacy": "grep",
+      "aliases": [
+        "grep",
+        "file.grep"
+      ]
+    },
+    {
+      "canonical": "worker_spawn",
+      "legacy": "worker_spawn",
+      "aliases": [
+        "worker_spawn",
+        "worker.spawn",
+        "workflow"
+      ]
+    },
+    {
+      "canonical": "worker_status",
+      "legacy": "worker_status",
+      "aliases": [
+        "worker_status",
+        "worker.status"
+      ]
+    },
+    {
+      "canonical": "guard.refuse",
+      "legacy": "guard.refuse",
+      "aliases": [
+        "guard.refuse",
+        "refuse",
+        "guard_refuse"
+      ]
+    },
+    {
+      "canonical": "guard.dryRun",
+      "legacy": "guard_dry_run",
+      "aliases": [
+        "guard.dryRun",
+        "guard_dry_run",
+        "dry_run",
+        "dry-run"
+      ]
+    },
+    {
+      "canonical": "journal.append",
+      "legacy": "journal.append",
+      "aliases": [
+        "journal.append",
+        "journal_append"
+      ]
+    },
+    {
+      "canonical": "procedures.draft",
+      "legacy": "procedures.draft",
+      "aliases": [
+        "procedures.draft",
+        "procedures_draft",
+        "memory_procedure"
+      ]
+    },
+    {
+      "canonical": "topics.write",
+      "legacy": "topics.write",
+      "aliases": [
+        "topics.write",
+        "topics_write",
+        "topics.write_card"
+      ]
+    },
+    {
+      "canonical": "taskboard.update",
+      "legacy": "taskboard.update",
+      "aliases": [
+        "taskboard.update",
+        "taskboard_update"
+      ]
+    },
+    {
+      "canonical": "session.handover",
+      "legacy": "session_handover",
+      "aliases": [
+        "session_handover",
+        "session.handover",
+        "handover"
+      ]
+    },
+    {
+      "canonical": "session.compact",
+      "legacy": "session_compact",
+      "aliases": [
+        "session_compact",
+        "session.compact",
+        "compress"
+      ]
+    },
+    {
+      "canonical": "reply.only",
+      "legacy": "reply.only",
+      "aliases": [
+        "reply.only",
+        "reply_only",
+        "chat"
+      ]
+    },
+    {
+      "canonical": "reply.no_write",
+      "legacy": "reply.no_write",
+      "aliases": [
+        "reply.no_write",
+        "reply_no_write",
+        "no_write"
+      ]
+    },
+    {
+      "canonical": "reply.ask",
+      "legacy": "reply_ask",
+      "aliases": [
+        "reply.ask",
+        "reply_ask",
+        "ask_user"
+      ]
+    },
+    {
+      "canonical": "memory.distillPropose",
+      "legacy": "memory_distill_propose",
+      "aliases": [
+        "memory.distillPropose",
+        "memory_distill_propose",
+        "propose_distill"
+      ]
+    },
+    {
+      "canonical": "memory.delete",
+      "legacy": "memory_delete",
+      "aliases": [
+        "memory.delete",
+        "memory_delete",
+        "forget_memory"
+      ]
+    },
+    {
+      "canonical": "identity.hold",
+      "legacy": "identity_hold",
+      "aliases": [
+        "identity.hold",
+        "identity_hold",
+        "identity_consent_hold"
+      ]
+    },
+    {
+      "canonical": "memory.save_local",
+      "legacy": "memory_save_local",
+      "aliases": [
+        "memory.save_local",
+        "memory_save_local",
+        "save_local"
+      ]
+    }
   ]
 }

package/src/router/background/agent-runner.mjs

@@ -10,7 +10,7 @@
 //     （dsh-session :1672-1687）给出按 surface 重放的消息序列。
 //   - dispose 在 create() 的返回值上，走与 unload 相同的 teardown（:1740-1746）。
 //
-// 红队 P0-2 的教训：旧实现调 handle.followup / handle.whenIdle / handle.result，
+// 评审 P0-2 的教训：旧实现调 handle.followup / handle.whenIdle / handle.result，
 // 在真宿主上直接 E_AGENT_IDLE（handle.followup is not a function）。
 //
 // 顺序仍然是 create -> followup -> whenIdle -> dispose（finally），任何一步失败

package/src/router/background/anchor.mjs

@@ -1,6 +1,6 @@
 // anchor.mjs — 预算账本 / 审计链之外的第三个「锚」
 //
-// 为什么需要它（红队 F10）：账本和审计各自都是自证 hash 链。攻击者如果有写权限，
+// 为什么需要它（评审 F10）：账本和审计各自都是自证 hash 链。攻击者如果有写权限，
 // 可以同时重算两条链（把 used 30 改成 5），两条链各自自洽、互相对得上，旧版
 // start() 就放行了。锚文件把「某一时刻两条链的 (seq, last_hash, used)」再封一次，
 // 并且自己也是一条只追加 hash 链；重算账本+审计而不同时重算锚，就会在锚的

package/src/router/background/audit.mjs

@@ -4,10 +4,10 @@
 //   1. 只追加，不重写；崩溃后文件仍可逐行解析。
 //   2. 每条记录都有固定信封：v / seq / ts / run_id / kind，其余字段可选。
 //   3. 每条记录带 CRC32（crc 字段），读取时可发现「被截断/篡改但仍能 JSON.parse」
-//      的记录 —— 红队 P04 的根因是旧实现只跳过「解析不了」的行，截断记录被当成
+//      的记录 —— 评审 P04 的根因是旧实现只跳过「解析不了」的行，截断记录被当成
 //      合法数据静默丢掉，预算回放于是少算。
 //   4. hash chain：每条记录带 prev_hash + hash（sha256），删中间整行 / 改字段 /
-//      缺号都会在 readAudit() 的 chainBreaks 里暴露（红队 P0-4）。
+//      缺号都会在 readAudit() 的 chainBreaks 里暴露（评审 P0-4）。
 //   5. seq 单调递增；重启时从所有轮转文件里续号，而不是从 1 重来。
 //   6. 每次写都 fsync，保证「动作已发生」与「审计已落盘」尽可能同生共死。
 //   7. 超过 maxBytes 时轮转：base -> .1 -> .2 ...（最多 maxRotations 个）。

package/src/router/background/budget-ledger.mjs

@@ -2,7 +2,7 @@
 //
 // 为什么需要它：Router 的预算上限是「每个 run 目录」的，不是「每个进程实例」的。
 // 旧实现把 tokensUsed 放在 Router 实例内存里，两个实例各读同一个审计文件、
-// 各自以为还剩 100，结果 75 + 75 = 150 超支（红队 P02）；重启时又从审计里
+// 各自以为还剩 100，结果 75 + 75 = 150 超支（评审 P02）；重启时又从审计里
 // 取 max(tokens_total) 而不是累加（P03），只恢复了一部分。
 //
 // 账本是一个只追加的 JSONL 文件（默认与 queue 同目录的 budget.ledger.jsonl）：
@@ -13,7 +13,7 @@
 //   - reserve 是全有或全无：剩余不够 callMaxTokens 就返回 E_BUDGET_EXCEEDED，
 //     不写任何记录（绝不出现「先花了再发现超了」）；
 //   - settle 是硬上限：实花只记 min(请求值, 预留, 预算剩余)，超出部分拒绝并
-//     返回 E_BUDGET_OVERSHOOT（红队 P0-1：60+60 重试不得记 120）；
+//     返回 E_BUDGET_OVERSHOOT（评审 P0-1：60+60 重试不得记 120）；
 //   - reserve 记录带 pid / started_at / lease_expires_at；崩溃遗留的 active 预留
 //     在下次启动或下一 tick 时按「pid 不存在」或「租约过期」回收（P0-2）；
 //   - 每条记录带 prev_hash + hash 的链，删整行/改字段会在下次读时暴露（P0-4）；

package/src/router/background/host-sim.mjs

@@ -1,6 +1,6 @@
 // host-sim.mjs — 真宿主形状的最小仿真器（测试 fixture 用）
 //
-// 第二轮红队的核心批评：旧 sim 的「形状」是自造的，测试只能证明 sim 与
+// 第二轮评审的核心批评：旧 sim 的「形状」是自造的，测试只能证明 sim 与
 // 自己一致。这一版按宿主 checkout 里抽出的真实签名
 // 重写，测试断言的都是真宿主会给出/接受的东西：
 //

package/src/router/background/memory.mjs

@@ -1,9 +1,9 @@
 // memory.mjs — 只读记忆快照
 //
-// 原型只读一个本地 JSON/Markdown 快照，不直接打开 engram 的 SQLite：
-// engram 库是 node:sqlite 的私有 schema（见 SPIKE.md 的证据），后台面不应绕过
+// 原型只读一个本地 JSON/Markdown 快照，不直接打开外部记忆库的 SQLite：
+// 外部记忆库是 node:sqlite 的私有 schema（见 SPIKE.md 的证据），后台面不应绕过
 // 它的写入/迁移逻辑去读。生产接线有两条正路（SPIKE.md §3）：
-//   a) 走 ctx.agents 起一个 agent，让 engram 的 agent/pre-step 自动注入；
+//   a) 走 ctx.agents 起一个 agent，让外部记忆插件的 agent/pre-step 自动注入；
 //   b) 读宿主公开的记忆根（longlive 的 topics/ journal/ 明文 markdown）。
 //
 // 这里演示 (b) 的最小形态，并把「读不到」当成正常情况（fail-open），
@@ -53,7 +53,7 @@ export class MemoryReader {
   }
 }
 
-/** 把记忆事实拼进 system 提示（原型级；生产应交给 engram 的 pre-step）。 */
+/** 把记忆事实拼进 system 提示（原型级；生产应交给外部记忆插件的 pre-step）。 */
 export function memoryToSystemPrompt(facts) {
   if (!facts || facts.length === 0) return '你是 Router 后台面的执行体。当前没有可用记忆。';
   return [