@kasenri/dsh-orbit 0.5.6 → 0.5.8

package/lib/dsh-host.js

@@ -1,4 +1,7 @@
 import { execFileSync } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
+import { resolve } from 'node:path';
+import { SessionId } from '@deepseek-ai/dsh-session';
 import { collectTurnToolFacts } from "./evidence.js";
 import { redactText, truncateSafe } from "./sanitize.js";
 import { classifyTurnSettlement } from "./settlement.js";
@@ -24,6 +27,7 @@ export class DshOrbitHost {
     ownedChildren = new Set();
     interruptedChildren = new Set();
     childParents = new Map();
+    childGrants = new Map();
     nowFn;
     sleepFn;
     constructor(ctx, options = {}) {
@@ -39,12 +43,14 @@ export class DshOrbitHost {
     }
     async startRole(request) {
         const parent = this.parent();
+        if (request.workspace !== undefined && resolve(parent.session.header.cwd ?? process.cwd()) !== resolve(request.workspace)) {
+            throw new Error('ORBIT_WORKSPACE_MISMATCH: 子代理工作目录必须与 Orbit 持有的 workspace 一致。');
+        }
         const prompt = [{ type: 'text', text: request.prompt }];
         const agentOptions = {
             provider: request.route.provider,
             model: request.route.model,
-            ...(request.route.reasoningEffort ? { reasoningEffort: request.route.reasoningEffort } : {}),
-            ...(request.route.maxTokens ? { maxTokens: request.route.maxTokens } : {}),
+            reasoningEffort: request.route.reasoningEffort,
         };
         if (request.role === 'executor') {
             return this.startExecutor(parent, request, prompt, agentOptions);
@@ -70,7 +76,7 @@ export class DshOrbitHost {
             ...(request.toolFilter ? { toolFilter: request.toolFilter } : {}),
             ...(request.outputSchema ? { outputSchema: request.outputSchema } : {}),
         }));
-        this.registerChild(run.id, parent);
+        this.registerChild(run.id, parent, request);
         const result = run.result
             .then((value) => ({
             childId: run.id,
@@ -106,13 +112,18 @@ export class DshOrbitHost {
         if (request.resumeOf) {
             const existingId = request.resumeOf;
             const existing = this.ctx.agents.get(existingId);
-            if (existing) {
+            const grant = this.childGrants.get(existingId);
+            const requestedTools = new Set(request.toolFilter?.allow ?? []);
+            const sameGrant = grant?.role === 'executor' && grant.workspace === (request.workspace ?? parent.session.header.cwd ?? process.cwd())
+                && grant.tools.size === requestedTools.size && [...grant.tools].every((tool) => requestedTools.has(tool));
+            if (existing && sameGrant && this.childParents.get(existingId) === parent && this.ctx.agents.isOwnedBy(SessionId(existingId), parent)) {
                 const agent = existing;
                 this.interruptedChildren.delete(existingId);
-                const done = this.waitForExecutorSettlement(agent, existingId);
+                const previousTurns = (agent.session?.snapshotEvents?.() ?? []).filter((event) => event.type === 'turn/start').length;
                 await this.ctx.subagents.sendMessage(parent, existingId, prompt, {
-                    signal: new AbortController().signal,
+                    signal: request.signal ?? new AbortController().signal,
                 });
+                const done = this.waitForExecutorSettlement(agent, existingId, previousTurns);
                 return {
                     childId: existingId,
                     result: done,
@@ -124,19 +135,28 @@ export class DshOrbitHost {
         }
         const controller = new AbortController();
         request.signal?.addEventListener('abort', () => controller.abort(), { once: true });
-        const started = await this.ctx.subagents.startContinuable({
-            provider: 'spawn',
-            label: request.label,
-            request: {
-                prompt,
-                parent,
-                agentOptions,
-                ...(request.toolFilter ? { toolFilter: request.toolFilter } : {}),
-            },
-            signal: controller.signal,
-        });
-        const childId = String(started.childId);
-        this.registerChild(childId, parent);
+        const reservedId = SessionId(randomUUID());
+        const childId = String(reservedId);
+        this.registerChild(childId, parent, request);
+        let started;
+        try {
+            started = await this.ctx.subagents.startContinuable({
+                provider: 'spawn',
+                label: request.label,
+                childId: reservedId,
+                request: {
+                    prompt,
+                    parent,
+                    agentOptions,
+                    ...(request.toolFilter ? { toolFilter: request.toolFilter } : {}),
+                },
+                signal: controller.signal,
+            });
+        }
+        catch (error) {
+            this.forgetChild(childId);
+            throw error;
+        }
         const agent = this.ctx.agents.get(started.childId);
         const result = agent
             ? this.waitForExecutorSettlement(agent, childId)
@@ -149,19 +169,26 @@ export class DshOrbitHost {
             runtimeSnapshot: agent ? () => this.snapshotAgent(agent) : undefined,
         };
     }
-    registerChild(childId, parent) {
+    registerChild(childId, parent, request) {
         this.ownedChildren.add(childId);
         this.childParents.set(childId, parent);
+        this.childGrants.set(childId, {
+            role: request.role,
+            workspace: resolve(request.workspace ?? parent.session.header.cwd ?? process.cwd()),
+            tools: new Set(request.toolFilter?.allow ?? []),
+        });
     }
     forgetChild(childId) {
         this.ownedChildren.delete(childId);
         this.interruptedChildren.delete(childId);
         this.childParents.delete(childId);
+        this.childGrants.delete(childId);
     }
     async interruptExecutor(childId, reason) {
         this.interruptedChildren.add(childId);
         const parent = this.childParents.get(childId);
         this.ctx.subagents.interrupt(childId, parent ? { kind: 'ancestor', agent: parent } : { kind: 'user', parentSessionId: childId });
+        await this.ctx.agents.get(SessionId(childId))?.whenIdle();
         void reason;
     }
     async drainExecutor(parent, childId) {
@@ -173,8 +200,8 @@ export class DshOrbitHost {
         }
         this.forgetChild(childId);
     }
-    async waitForExecutorSettlement(agent, childId) {
-        await this.waitForTurnOrIdle(agent);
+    async waitForExecutorSettlement(agent, childId, previousTurns = 0) {
+        await this.waitForTurnOrIdle(agent, previousTurns);
         const events = agent.session?.snapshotEvents?.() ?? agent.session?.ownEvents?.() ?? [];
         const classified = classifyTurnSettlement(events);
         const output = this.readFinalOutput(agent);
@@ -214,20 +241,22 @@ export class DshOrbitHost {
                 return { childId, output, interrupted: true, reason: 'EXECUTOR_BLOCKED', telemetry, ...evidence };
             case 'max-tokens':
                 return { childId, output, interrupted: true, reason: 'EXECUTOR_MAX_TOKENS', telemetry, ...evidence };
+            case 'interrupted':
+                return { childId, output, interrupted: true, reason: 'EXECUTOR_INTERRUPTED', telemetry, ...evidence };
             default:
                 return { childId, output, interrupted: true, reason: 'EXECUTOR_NO_TURN', telemetry, ...evidence };
         }
     }
-    async waitForTurnOrIdle(agent) {
+    async waitForTurnOrIdle(agent, previousTurns = 0) {
         const deadline = this.nowFn() + EXECUTOR_TURN_START_TIMEOUT_MS;
-        while (this.nowFn() < deadline && !this.hasTurnStarted(agent)) {
+        while (this.nowFn() < deadline && !this.hasTurnStarted(agent, previousTurns)) {
             await this.sleepFn(20);
         }
         await agent.whenIdle?.();
     }
-    hasTurnStarted(agent) {
+    hasTurnStarted(agent, previousTurns) {
         const events = agent.session?.snapshotEvents?.() ?? [];
-        return events.some((event) => event.type === 'turn/start');
+        return events.filter((event) => event.type === 'turn/start').length > previousTurns;
     }
     readFinalOutput(agent) {
         const events = agent.session?.snapshotEvents?.() ?? agent.session?.ownEvents?.() ?? [];
@@ -308,6 +337,53 @@ export class DshOrbitHost {
         const agent = this.ctx.agents.currentInitiator();
         return this.ctx.tools.get(name, agent) !== undefined;
     }
+    async validateRoutes(routes, signal) {
+        const issues = [];
+        const labels = { commander: '指挥官', executor: '执行员', watchdog: '监控模型' };
+        for (const role of ['commander', 'executor', 'watchdog']) {
+            const route = routes[role];
+            try {
+                const llm = this.ctx.reflect.get('llm');
+                if (!llm)
+                    throw new Error('DSH LLM registry 不可用');
+                const deadline = AbortSignal.timeout(10_000);
+                const activeSignal = signal ? AbortSignal.any([signal, deadline]) : deadline;
+                const info = await llm.resolveModelInfo(route.provider, route.model, activeSignal);
+                const catalog = await llm.listModels(route.provider);
+                if (catalog.length > 0 && !catalog.some((entry) => entry.id === route.model)) {
+                    issues.push(`${labels[role]}：ORBIT_MODEL_UNAVAILABLE (${route.provider}/${route.model})，当前模型目录中不存在，请重新选择。`);
+                    continue;
+                }
+                if (route.reasoningEffort !== undefined) {
+                    const efforts = info.reasoning?.efforts ?? [];
+                    if (!efforts.some((effort) => effort.id === route.reasoningEffort)) {
+                        issues.push(`${labels[role]}：ORBIT_REASONING_EFFORT_UNAVAILABLE (${route.provider}/${route.model}/${route.reasoningEffort})，当前模型未声明此推理等级。`);
+                    }
+                }
+            }
+            catch (error) {
+                issues.push(`${labels[role]}：ORBIT_MODEL_UNAVAILABLE (${route.provider}/${route.model})，当前不可用，请重新选择：${truncateSafe(error instanceof Error ? error.message : String(error), 200)}`);
+            }
+        }
+        return issues;
+    }
+    isMutationAuthorized(agent, cwd, tool) {
+        const id = String(agent?.id ?? '');
+        const grant = this.childGrants.get(id);
+        const parent = this.childParents.get(id);
+        return grant?.role === 'executor' && grant.workspace === resolve(cwd) && grant.tools.has(tool)
+            && !this.interruptedChildren.has(id) && this.ctx.agents.get(SessionId(id)) === agent
+            && parent !== undefined && this.ctx.agents.isOwnedBy(SessionId(id), parent);
+    }
+    async revokeWorkspace(cwd) {
+        const ids = [...this.childGrants].filter(([, grant]) => grant.workspace === resolve(cwd) && grant.role === 'executor').map(([id]) => id);
+        for (const id of ids) {
+            const parent = this.childParents.get(id);
+            await this.interruptExecutor(id, 'ORBIT_WORKSPACE_RELEASED');
+            if (parent)
+                await this.drainExecutor(parent, id);
+        }
+    }
     /**
      * Mutation ownership is about top-level autonomous drivers, not about every
      * running agent. The calling parent, Orbit's own children, and ordinary
@@ -316,17 +392,19 @@ export class DshOrbitHost {
      * at tool start by the Orbit mutation guard.
      */
     async otherMutationDrivers(cwd) {
-        void cwd;
         const drivers = [];
         const initiator = this.ctx.agents.currentInitiator();
         // `ctx.reflect.get` is the official service lookup that does not require an
         // inject declaration, so Orbit stays loadable in profiles without dsh-goal.
         const reflect = this.ctx.reflect;
         const goals = reflect?.get('goals');
-        if (goals && initiator) {
+        const agents = this.ctx.agents.list?.() ?? (initiator ? [initiator] : []);
+        for (const candidate of agents) {
+            if (!goals || resolve(candidate.session.header.cwd ?? process.cwd()) !== resolve(cwd) || this.ownedChildren.has(String(candidate.id)))
+                continue;
             try {
-                const goal = goals.get(initiator);
-                if (goal?.phase === 'active')
+                const goal = goals.get(candidate);
+                if (goal?.phase === 'active' && !drivers.includes('goal'))
                     drivers.push('goal');
             }
             catch {

package/lib/evidence.js

@@ -147,3 +147,27 @@ export function buildEvidenceBundle(input) {
 export function formatEvidenceBundle(bundle) {
     return bounded(JSON.stringify(bundle), EVIDENCE_LIMITS.total);
 }
+/** Persist only compact result facts, never a child transcript. */
+export function buildStepResult(stepId, attempt, bundle, tests = []) {
+    return {
+        step_id: bounded(stepId, 80),
+        attempt,
+        summary: bounded(bundle.executor_summary ?? '', EVIDENCE_LIMITS.executorSummary),
+        changed_files: bundle.changed_files.map((entry) => bounded(entry, EVIDENCE_LIMITS.entry)).slice(0, EVIDENCE_LIMITS.changedFiles),
+        test_summary: [...tests, ...bundle.tests.map((entry) => `${entry.command}: ${entry.status}`)]
+            .slice(0, EVIDENCE_LIMITS.testEvidence).map((entry) => bounded(entry, EVIDENCE_LIMITS.entry)),
+        evidence: formatEvidenceBundle(bundle),
+    };
+}
+/** Fair per-step quotas keep every step visible in a bounded final review. */
+export function formatStepResults(state) {
+    const steps = state.plan.steps;
+    const quota = Math.max(1, Math.floor(EVIDENCE_LIMITS.total / Math.max(1, steps.length)) - 100);
+    return steps.map((step) => {
+        const result = state.step_results?.find((entry) => entry.step_id === step.id);
+        const content = result === undefined ? '未记录持久化结果' : JSON.stringify({
+            summary: result.summary, test_summary: result.test_summary, changed_files: result.changed_files, evidence: result.evidence,
+        });
+        return `${bounded(step.id, 80)}[${step.status}] ${bounded(content, quota)}`;
+    }).join('\n');
+}

package/lib/guard.js

@@ -10,23 +10,23 @@ const GITHUB_REMOTE_PATTERNS = [
     /\bgit\s+remote\s+(?:set-url|add|remove)\b/i,
 ];
 const DANGEROUS_PATTERNS = [
-    ['destructive_operation', /\brm\s+-[A-Za-z]*r[A-Za-z]*f|\brm\s+-rf\b/i, 'recursive force deletion'],
-    ['destructive_operation', /\bgit\s+reset\s+--hard\b|\bgit\s+clean\s+-[A-Za-z]*f/i, 'irreversible git reset/clean'],
-    ['production_operation', /\bdrop\s+database\b|\b(?:drop|truncate)\s+(?:table|schema)\b/i, 'irreversible database operation'],
+    ['destructive_operation', /\brm\s+-[A-Za-z]*r[A-Za-z]*f|\brm\s+-rf\b/i, '递归强制删除'],
+    ['destructive_operation', /\bgit\s+reset\s+--hard\b|\bgit\s+clean\s+-[A-Za-z]*f/i, '不可逆的 git reset/clean'],
+    ['production_operation', /\bdrop\s+database\b|\b(?:drop|truncate)\s+(?:table|schema)\b/i, '不可逆的数据库操作'],
     [
         'production_operation',
         /\b(?:production|prod)\b.*\b(?:deploy|migrate|database|restart)\b|\b(?:deploy|migrate)\b.*\b(?:production|prod)\b/i,
-        'production operation',
+        '生产环境操作',
     ],
     [
         'production_operation',
         /\b(?:kubectl|helm)\s+(?:apply|delete|upgrade|rollback)\b|\bterraform\s+apply\b|\bdocker\s+push\b/i,
-        'deployment or remote registry write',
+        '部署或远程 registry 写入',
     ],
-    ['production_operation', /\b(?:alembic|prisma|sequelize|rails)\b.*\b(?:upgrade|migrate|db:migrate)\b/i, 'database migration'],
-    ['production_operation', /\b(?:ufw|iptables)\b.*\b(?:allow|insert|append)\b|\bdocker\s+run\b.*\s-p\s/i, 'public network exposure'],
-    ['secret_operation', /\b(?:cat|less|more|head|tail)\b[^\n]*(?:\.env|secret|credential|auth\.json|cookie)/i, 'credential or secret output'],
-    ['secret_operation', /\b(?:curl|wget)\b[^\n]*(?:Authorization|Bearer|api[_-]?key|token)=?/i, 'credential-bearing network request'],
+    ['production_operation', /\b(?:alembic|prisma|sequelize|rails)\b.*\b(?:upgrade|migrate|db:migrate)\b/i, '数据库迁移'],
+    ['production_operation', /\b(?:ufw|iptables)\b.*\b(?:allow|insert|append)\b|\bdocker\s+run\b.*\s-p\s/i, '暴露公共网络端口'],
+    ['secret_operation', /\b(?:cat|less|more|head|tail)\b[^\n]*(?:\.env|secret|credential|auth\.json|cookie)/i, '输出凭证或敏感信息'],
+    ['secret_operation', /\b(?:curl|wget)\b[^\n]*(?:Authorization|Bearer|api[_-]?key|token)=?/i, '携带凭证的网络请求'],
 ];
 const SENSITIVE_ENV_NAME = /(?:^|_)(?:KEY|TOKEN|PASSWORD|PASSWD|SECRET|COOKIE|AUTH|CREDENTIAL|PRIVATE_KEY|ACCESS_TOKEN|REFRESH_TOKEN)(?:_|$)/i;
 const DURABLE_STATE_PATH = /(?:^|[\s/'"])(?:\.\/)?\.cx(?:[/'"\s]|$)/i;
@@ -82,25 +82,25 @@ export function guardBashCommand(command, intent = {}) {
     if (intent.github_allowed !== true) {
         for (const pattern of GITHUB_REMOTE_PATTERNS) {
             if (pattern.test(trimmed))
-                return block('github_remote_write', `GitHub remote write is not allowed: ${pattern.source}`);
+                return block('github_remote_write', `未授权 GitHub 远程写入：${pattern.source}`);
         }
     }
     if (isDurableStateWrite(trimmed)) {
-        return block('durable_state_write', 'Only the Orbit controller may write .cx durable state.');
+        return block('durable_state_write', '只有 Orbit controller 可以写入 .cx 持久状态。');
     }
     if (looksLikeEnvSecret(trimmed)) {
-        return block('secret_operation', 'Reading or exporting secrets is not allowed.');
+        return block('secret_operation', '不允许读取或导出敏感凭证。');
     }
     if (/^\s*export\s+[A-Za-z_][A-Za-z0-9_]*\s*=/i.test(trimmed)) {
         const assignment = /^\s*export\s+([A-Za-z_][A-Za-z0-9_]*)\s*=/i.exec(trimmed);
         if (assignment && SENSITIVE_ENV_NAME.test(assignment[1] ?? '')) {
-            return block('secret_operation', 'Exporting a secret environment variable is not allowed.');
+            return block('secret_operation', '不允许导出敏感环境变量。');
         }
     }
     if (/^\s*set\s+[A-Za-z_][A-Za-z0-9_]*=/i.test(trimmed)) {
         const assignment = /^\s*set\s+([A-Za-z_][A-Za-z0-9_]*)\s*=/i.exec(trimmed);
         if (assignment && SENSITIVE_ENV_NAME.test(assignment[1] ?? '')) {
-            return block('secret_operation', 'Setting a secret environment variable is not allowed.');
+            return block('secret_operation', '不允许设置敏感环境变量。');
         }
     }
     for (const [code, pattern, reason] of DANGEROUS_PATTERNS) {
@@ -118,11 +118,11 @@ export function guardToolPath(toolName, targetPath, deps) {
     const cwd = deps.cwd;
     const absolute = isAbsolute(targetPath) ? targetPath : resolve(cwd, targetPath);
     if (isInsideDurableState(absolute, cwd)) {
-        return block('durable_state_write', 'Only the Orbit controller may write .cx durable state.');
+        return block('durable_state_write', '只有 Orbit controller 可以写入 .cx 持久状态。');
     }
     const realpath = deps.realpath ?? safeRealpath;
     if (isInsideDurableState(realpathWithin(absolute, realpath), cwd)) {
-        return block('durable_state_write', 'Only the Orbit controller may write .cx durable state (symlink resolved).');
+        return block('durable_state_write', '只有 Orbit controller 可以写入 .cx 持久状态（已解析符号链接）。');
     }
     return { allowed: true };
 }
@@ -153,5 +153,5 @@ function safeRealpath(path) {
     }
 }
 export function guardReason(decision) {
-    return `Blocked by Orbit safety guard (${decision.code}): ${decision.reason}`;
+    return `Orbit 安全护栏阻断当前调用 (${decision.code})：${decision.reason}`;
 }

package/lib/index.js

@@ -1,19 +1,16 @@
 import { boundContextSummary, createUserMessage } from '@deepseek-ai/dsh-llm';
 import z from '@deepseek-ai/schemastery';
 import { installOrbitGestureBoundary, registerOrbitCommand, registerOrbitToggleCommand } from "./activation.js";
-import { estimateLoopCount } from "./kernel.js";
 import { createOrbitPreExecuteHandler } from "./pipeline-guard.js";
-import { resolveEffectiveRoutes, sessionSelectionOf } from "./routes.js";
+import { agentDefaultSelectionOf, resolveEffectiveRoutes, sessionModelSelectionOf, sessionModelStateOf } from "./routes.js";
 import { installOrbitSessionProjection, orbitEnabledOf } from "./session-state.js";
 import { OrbitService } from "./service.js";
 import { createOrbitTool } from "./tool.js";
 /**
- * Minimum loop budget for a hard-activated run. The Commander is asked for a
- * 2-5 step plan and every executed step consumes one loop slot, so the host
- * must grant a budget that can finish a full plan; the goal complexity
- * estimate raises it further when the goal asks for more.
+ * Fixed hard-activation budget. Explicit tool calls may still supply a bounded
+ * user-owned budget; ordinary activation never guesses complexity from words.
  */
-const HARD_ACTIVATION_MIN_LOOPS = 5;
+const HARD_ACTIVATION_LOOP_BUDGET = 5;
 export const name = 'dsh-orbit';
 export const inject = ['tools', 'agents', 'subagents'];
 const Route = z.object({
@@ -39,61 +36,60 @@ export const Config = z.object({
         executor: Route,
         watchdog: Route,
     })
-        .default({
-        commander: { provider: 'deepseek-official', model: 'deepseek-v4-pro', reasoningEffort: 'high' },
-        executor: { provider: 'deepseek-official', model: 'deepseek-v4-flash', reasoningEffort: 'high' },
-        watchdog: { provider: 'deepseek-official', model: 'deepseek-v4-flash', reasoningEffort: 'low' },
-    }),
+        .default({}),
     browserTools: z.array(z.string()).default(['agent_browser']),
     commanderReadOnlyTools: z.array(z.string()).default(['read', 'read_image', 'glob', 'grep', 'web_search', 'web_fetch']),
     watchdogTools: z.array(z.string()).default(['read', 'read_image', 'glob', 'grep']),
     executorTools: z
         .array(z.string())
-        .default(['read', 'read_image', 'glob', 'grep', 'bash', 'write', 'edit', 'str_replace_editor', 'web_search', 'web_fetch']),
+        .default(['read', 'read_image', 'glob', 'grep']),
     executorTimeoutMs: z.natural().default(480_000),
     registerTool: z.boolean().default(true),
     registerGuards: z.boolean().default(true),
     slashCommand: z.boolean().default(true),
 });
 export function apply(ctx, config) {
-    // Orbit settings bridge: register the `orbit` namespace with the composition
-    // routes as its base/default, so a user who never opens the model UI keeps
-    // today's behavior exactly. Lazily injected: minimal/headless compositions
-    // without a settings provider keep running from `config.routes`.
-    let routeSettings;
+    // Orbit settings bridge. The package ships no model defaults; only explicit
+    // profile routes can act as a headless compatibility fallback.
+    let readRouteSettings = () => undefined;
     ctx.inject(['settings'], (settingsCtx) => {
-        const baseRoute = (route) => ({
-            provider: route.provider,
-            model: route.model,
-            reasoningEffort: route.reasoningEffort ?? '',
-        });
         const scope = settingsCtx.settings.register('orbit', OrbitRouteSettingsSchema, {
             base: {
-                commander: baseRoute(config.routes.commander),
-                watchdog: baseRoute(config.routes.watchdog),
+                commander: { provider: '', model: '', reasoningEffort: '' },
+                watchdog: { provider: '', model: '', reasoningEffort: '' },
             },
         });
-        const sync = () => {
-            routeSettings = scope.get();
-        };
-        sync();
-        scope.watch(() => {
-            sync();
-        });
+        readRouteSettings = () => scope.get();
+        settingsCtx.effect(() => () => { readRouteSettings = () => undefined; });
     });
     // A NEW run resolves its three routes exactly once: Commander/Watchdog from
     // the Orbit settings (base = config), Executor from the initiating Session's
-    // current model selection (public request-header seam) with the config route
-    // as the fallback for surfaces without one. Existing runs resume from their
-    // frozen `state.routes`.
-    const resolveRoutes = () => resolveEffectiveRoutes({
-        configRoutes: config.routes,
-        settings: routeSettings,
-        sessionSelection: sessionSelectionOf(ctx.agents.currentInitiator()),
-    });
+    // current model with DSH `selectionFor(agent)` semantics (pending choice →
+    // logged header → deployment default). Explicit config routes are only for
+    // sessions without a DSH model source. Existing runs resume from frozen routes.
+    const resolveRoutes = () => {
+        const agent = ctx.agents.currentInitiator();
+        return resolveEffectiveRoutes({
+            configRoutes: config.routes,
+            settings: readRouteSettings(),
+            hasSession: agent !== undefined,
+            sessionSelection: sessionModelSelectionOf({
+                sessionModel: sessionModelStateOf(ctx, agent?.session),
+                requestHeader: agent?.session?.requestHeader?.(),
+                agentDefault: agent === undefined ? undefined : agentDefaultSelectionOf(ctx),
+            }),
+        });
+    };
+    // The DSH Session driving the current operation: a new run records it, and
+    // only that Session may answer the run's NEEDS_USER question.
+    const resolveOwnerSessionId = () => {
+        const agent = ctx.agents.currentInitiator();
+        return agent === undefined ? undefined : String(agent.session.id);
+    };
     const serviceConfig = {
         routes: config.routes,
         resolveRoutes,
+        resolveOwnerSessionId,
         browserTools: config.browserTools,
         commanderReadOnlyTools: config.commanderReadOnlyTools,
         watchdogTools: config.watchdogTools,
@@ -132,7 +128,7 @@ export function apply(ctx, config) {
                 // the parent model is never asked to decide or to run the task.
                 result = await ctx.agents.withInitiator(agent, () => service.run({
                     goal,
-                    approved_loop_count: Math.max(estimateLoopCount(goal), HARD_ACTIVATION_MIN_LOOPS),
+                    approved_loop_count: HARD_ACTIVATION_LOOP_BUDGET,
                 }, cwd, signal));
             }
             catch (error) {
@@ -150,8 +146,9 @@ export function apply(ctx, config) {
     ctx.inject(['sessionProjections'], (projectionCtx) => {
         installOrbitSessionProjection(projectionCtx);
     });
-    if (config.registerGuards) {
+    {
         const handler = createOrbitPreExecuteHandler(service, {
+            contentGuards: config.registerGuards,
             competingDriver: (agent) => {
                 const reflect = ctx.reflect;
                 const goals = reflect?.get('goals');
@@ -193,6 +190,11 @@ function activationNotice(result) {
         return undefined;
     const lastError = result.data?.['last_error'];
     const reason = result.message ?? (typeof lastError === 'string' && lastError !== '' ? lastError : undefined);
+    if (result.message?.startsWith('ORBIT_NEEDS_USER_OTHER_SESSION') === true || result.message?.startsWith('ORBIT_NEEDS_USER_OWNER_UNKNOWN') === true) {
+        // Another Session owns the waiting run: report instead of consuming the
+        // message as its reply.
+        return result.message;
+    }
     if (result.phase === 'NEEDS_USER') {
         return reason !== undefined && !reason.startsWith('COMMANDER_')
             ? `Orbit 需要你的回复：${reason}`

package/lib/kernel.js

@@ -5,9 +5,9 @@
  * read a clock, or use randomness. Runtime values (routes, timestamps, run ids)
  * are supplied by the supervisor, which owns orchestration and persistence.
  */
-import { MAX_CORRECTION_DEPTH, MAX_PLAN_STEPS, MAX_WATCHDOG_CALLS_PER_STEP, MIN_PLAN_STEPS, ORBIT_SCHEMA_VERSION, } from "./types.js";
+import { MAX_CORRECTION_DEPTH, DEFAULT_LOOP_BUDGET, MAX_PLAN_STEPS, MAX_WATCHDOG_CALLS_PER_STEP, MIN_PLAN_STEPS, ORBIT_SCHEMA_VERSION, } from "./types.js";
 /** Capabilities a plan step may request. */
-export const ORBIT_CAPABILITIES = ['browser', 'web-api-recon'];
+export const ORBIT_CAPABILITIES = ['filesystem', 'shell', 'web', 'browser'];
 const STEP_CAPABILITIES = new Set(ORBIT_CAPABILITIES);
 const PLAN_STEP_ID = /^P\d+$/u;
 export function normalizeCapabilities(value) {
@@ -15,6 +15,12 @@ export function normalizeCapabilities(value) {
         return undefined;
     const result = [];
     for (const item of value) {
+        if (item === 'web-api-recon') {
+            for (const legacy of ['web', 'browser'])
+                if (!result.includes(legacy))
+                    result.push(legacy);
+            continue;
+        }
         if (typeof item !== 'string' || !STEP_CAPABILITIES.has(item))
             continue;
         if (!result.includes(item))
@@ -22,8 +28,6 @@ export function normalizeCapabilities(value) {
     }
     if (result.length === 0)
         return undefined;
-    if (result.includes('web-api-recon') && !result.includes('browser'))
-        result.unshift('browser');
     return result;
 }
 export function normalizePlan(plan) {
@@ -46,6 +50,9 @@ export function normalizePlan(plan) {
     if (steps.some((step) => !step.goal)) {
         throw new Error('COMMANDER_PLAN_OUTPUT_INVALID: every step needs a goal');
     }
+    if (new Set(steps.map((step) => step.id)).size !== steps.length) {
+        throw new Error('COMMANDER_PLAN_OUTPUT_INVALID: 步骤 id 不得重复');
+    }
     return { summary: String(plan.summary ?? '').slice(0, 1000), steps };
 }
 export function correctionDepthOf(stepId) {
@@ -68,18 +75,6 @@ export function explicitLoopBudget(input) {
         throw new Error('ORBIT_LOOP_BUDGET_INVALID: approved_loop_count above 10 requires an explicit execution request');
     return raw;
 }
-export function estimateLoopCount(goal) {
-    const text = goal.toLowerCase();
-    if (/critical|migrate|migration|production|架构|重构/.test(text))
-        return 6;
-    if (/integration|联调|ui|high/.test(text))
-        return 4;
-    if (/feature|多文件|multi-file/.test(goal))
-        return 3;
-    if (/bug|fix|test/.test(text))
-        return 2;
-    return 1;
-}
 export function updateLoopBudget(state, budget) {
     if (budget < state.loop.used)
         throw new Error(`ORBIT_LOOP_BUDGET_BELOW_USED: requested ${budget}, already used ${state.loop.used}`);
@@ -129,7 +124,7 @@ export function correctionBlockCode(state, step) {
 }
 export function createInitialState(input) {
     const max = explicitLoopBudget({ approved_loop_count: input.approvedLoopCount, max_loops: input.maxLoops }) ??
-        estimateLoopCount(input.goal);
+        DEFAULT_LOOP_BUDGET;
     return {
         schema_version: ORBIT_SCHEMA_VERSION,
         active_run_id: input.runId,
@@ -142,16 +137,18 @@ export function createInitialState(input) {
         goal: input.goal,
         goal_hash: hashGoal(input.goal),
         preset: input.preset ?? 'orbit-lite',
-        routes: input.routes,
+        routes: structuredClone(input.routes),
         loop: { used: 0, max },
         approved_loop_count: max,
         remaining_budget: max,
         loop_count: 0,
         plan: { summary: '', steps: [] },
+        step_results: [],
         changed_files: [],
         test_summary: [],
         last_error: null,
         pending_user_reply: null,
+        ...(input.ownerSessionId === undefined ? {} : { owner_session_id: input.ownerSessionId }),
         user_hard_constraints: input.userHardConstraints ? [...input.userHardConstraints] : [],
         github_allowed: input.githubAllowed === true,
         interruption_retries: 0,
@@ -193,7 +190,7 @@ export function applyExecutorCapabilityUnavailable(state, stepId) {
     state.last_error = 'BROWSER_CAPABILITY_UNAVAILABLE';
     state.commander = {
         last_decision: state.commander?.last_decision,
-        summary: `Executor could not run step ${stepId}: BROWSER_CAPABILITY_UNAVAILABLE (agent_browser tool is not registered).`,
+        summary: `Executor 无法执行步骤 ${stepId}：BROWSER_CAPABILITY_UNAVAILABLE（配置的 Browser 工具不可用）。`,
     };
     state.phase = 'EVALUATE';
 }
@@ -215,6 +212,17 @@ export function clearExecutorChild(state) {
     state.child = undefined;
     state.interruption_retries = 0;
 }
+export const MAX_STEP_RESULTS = 10;
+/** Upsert one bounded durable result without allowing evidence to drive transitions. */
+export function upsertStepResult(state, result) {
+    const results = state.step_results ?? [];
+    const index = results.findIndex((entry) => entry.step_id === result.step_id);
+    if (index === -1)
+        results.push(result);
+    else
+        results[index] = result;
+    state.step_results = results.slice(-MAX_STEP_RESULTS);
+}
 /** Apply a real Executor success: consume one loop slot, then enter EVALUATE. */
 export function applyExecutorSuccess(state, input) {
     state.child = { ...(input.childId ? { id: input.childId } : {}), status: 'completed' };
@@ -262,7 +270,9 @@ export function applyFinalAppend(state, decision) {
         return 'budget_exhausted';
     }
     for (const item of appended.slice(0, remaining)) {
-        const index = state.plan.steps.filter((candidate) => isBaseStepId(candidate.id)).length;
+        let index = state.plan.steps.filter((candidate) => isBaseStepId(candidate.id)).length;
+        while (state.plan.steps.some((candidate) => candidate.id === `P${index}`))
+            index += 1;
         state.plan.steps.push({
             id: `P${index}`,
             goal: item.goal,
@@ -281,7 +291,9 @@ export function applyCorrectionStep(state, step, input) {
     step.status = 'needs_correction';
     const number = correctionDepthOf(step.id) + 2;
     const insertAt = state.plan.steps.indexOf(step) + 1;
-    const correctionCapabilities = normalizeCapabilities(input.capabilities) ?? step.capabilities;
+    const correctionCapabilities = input.capabilities === undefined
+        ? step.capabilities
+        : normalizeCapabilities(input.capabilities);
     state.plan.steps.splice(insertAt, 0, {
         id: `${base}-${number}`,
         goal: input.nextGoal,