@kasenri/dsh-orbit 0.5.7 → 0.5.9

package/README.md

@@ -94,17 +94,19 @@ The `orbit_controller` tool drives the run:
 Orbit supports three activation styles:
 
 1. `/agent-orbit <goal>` — deterministic slash-command activation. In the Web
-   GUI it appears in the `/` menu (`Run a goal with Orbit deterministic
-   engineering orchestration`); on headless/CLI surfaces a genuine user message
+   GUI it appears in the `/` menu (`使用 Orbit 确定性工程编排执行目标`); on headless/CLI surfaces a genuine user message
    that starts with `/agent-orbit` activates Orbit directly. The original
    command line stays visible in the conversation, the goal is passed through
    without rewriting, and no goal asks for one instead of starting an empty run.
-2. `orbit模式` — recommended natural-language activation, e.g.
+  2. `orbit模式` — recommended natural-language activation, e.g.
    “用 orbit模式完成这个项目”.
-3. `cx模式` — legacy compatibility; still resolves to Orbit.
+  3. `cx模式` — legacy compatibility; still resolves to Orbit.
 
 All three routes converge on the existing `orbit_controller` tool and
 `OrbitService`; the activation layer never starts a run of its own.
+After a hard-activated run reaches `SUCCESS`, the initiating Session displays
+the Final Commander's user-visible result directly, with the Commander's frozen
+provider/model provenance. The parent model and parent tools remain bypassed.
 
 ## Model configuration (Web)
 
@@ -113,20 +115,21 @@ seat (`conversation.input.right` renders before `conversation.input.model`).
 Its button names the Commander's model; the menu edits three roles:
 
 - **Commander** and **Watchdog** pick from the same native model catalog and
-  persist into the DSH `orbit` settings namespace (`settings.yaml`), with the
-  composition `config.routes` as the base/default. Switching a model uses that
-  model's own default reasoning effort — a previous model's effort is never
-  inherited.
+  persist into the DSH `orbit` settings namespace (`settings.yaml`). Picking a
+  model first opens reasoning selection; nothing is saved until the user chooses
+  a catalog-declared effort or provider default. No effort is inferred.
 - **Executor** follows the current session model ("Follows current session
   model"). Both the Orbit row and the native seat read and write the SAME
   per-session `ModelDirectory`, so a change in either place updates the other.
 
 A new run resolves its routes exactly once — Commander/Watchdog from `orbit`
-settings, Executor from the initiating session's current selection, each
-falling back to `config.routes` — and freezes them into `state.routes`.
+settings, Executor from the initiating session's current selection — and freezes
+them into `state.routes`. Orbit ships no provider/model or reasoning defaults.
 Changes made while a run is active apply to the next run; resumed runs keep
-their frozen routes. Headless/CLI profiles without a settings provider keep
-running from `config.routes` unchanged.
+their frozen routes. Explicit profile routes are permitted for headless/CLI:
+Commander/Watchdog use settings then explicit config; Executor uses the Session
+selection, with explicit config only when there is no Session. Missing or
+unavailable roles block creation of a Run before any child starts.
 
 ## State machine
 
@@ -158,11 +161,16 @@ PLAN → EXECUTE → EVALUATE → SUCCESS
 ## Safety boundaries
 
 - Commander and Watchdog receive read-only tool allowlists.
-- Executors receive the configured writer allowlist; browser tools are added
-  only for steps that declare the `browser` capability.
+- Executors always receive only base read tools (`read/read_image/glob/grep`).
+  Each Step explicitly declares `filesystem`, `shell`, `web`, or `browser` to
+  add only the corresponding tools. Legacy `web-api-recon` normalizes to `web`
+  plus `browser`. No capability means no bash, writers, web, or browser tools.
 - While Orbit owns a workspace, other top-level autonomous drivers
   (`create_goal`, `ralph`, `workflow`) are refused, and Orbit refuses to start
-  while an active goal driver owns the same workspace.
+  while an active Goal driver owns the same workspace. Only an Orbit-owned
+  Executor child can use mutation tools while Orbit owns that workspace.
+- Bounded, redacted `step_results` preserve each Step's summary, changes and
+  test evidence. Cold resume retains them and FINAL_EVALUATE sees every Step.
 - `.cx` durable state is written only by the Orbit service (atomic write, short
   lock transaction, monotonic revision).
 
@@ -171,10 +179,10 @@ PLAN → EXECUTE → EVALUATE → SUCCESS
 | Key | Default | Meaning |
 |---|---|---|
 | `projectDir` | session cwd | Project the run operates on. |
-| `routes.commander` | `deepseek-official` / `deepseek-v4-pro` / `high` | Commander model route. |
-| `routes.executor` | `deepseek-official` / `deepseek-v4-flash` / `high` | Executor model route. |
-| `routes.watchdog` | `deepseek-official` / `deepseek-v4-flash` / `low` | Watchdog model route. |
-| `executorTools` | read/glob/grep/bash/edit/write/… | Executor allowlist. |
+| `routes.commander` | none | Explicit profile fallback; normally user-selected in Orbit settings. |
+| `routes.executor` | none | Explicit config only without a Session; otherwise follows DSH Session selection. |
+| `routes.watchdog` | none | Explicit profile fallback; normally user-selected in Orbit settings. |
+| `executorTools` | read/read_image/glob/grep | Base read-only subset; mutation tools require Step capabilities. |
 | `browserTools` | `["agent_browser"]` | Browser capability tool names. |
 | `commanderReadOnlyTools` | read/glob/grep/web… | Commander allowlist. |
 | `watchdogTools` | read/glob/grep | Watchdog allowlist. |

package/cordis.patch.yml

@@ -2,8 +2,8 @@
 #
 # Adds the Orbit engineering orchestration plugin (OrbitService + orbit_controller
 # tool; `cx_controller` remains a legacy alias) on top of the active bundle stack.
-# Model routes use the plugin defaults and can be overridden in the profile's own
-# cordis.patch.yml.
+# Orbit does not ship model-route defaults. Users select Commander/Watchdog in
+# Orbit settings; Executor follows the current DSH Session selection.
 - insert:
     - id: dsh-orbit
       name: '@kasenri/dsh-orbit'

package/lib/activation.js

@@ -65,18 +65,18 @@ export function invokedOrbitMessage(messages) {
 export function registerOrbitCommand(ctx) {
     ctx.effect(() => ctx.commands.register({
         name: AGENT_ORBIT_COMMAND,
-        description: 'Run a goal with Orbit deterministic engineering orchestration',
-        input: { hint: 'Describe the engineering goal for Orbit' },
+        description: '使用 Orbit 确定性工程编排执行目标',
+        input: { hint: '描述要交给 Orbit 完成的工程目标' },
         handler(invocation) {
             const goal = invocation.rawInput.trim();
             if (goal === '') {
-                return { kind: 'error', text: `Usage: /${AGENT_ORBIT_COMMAND} <goal> — 请输入要交给 Orbit 完成的任务。` };
+                return { kind: 'error', text: `用法：/${AGENT_ORBIT_COMMAND} <goal>，请输入任务。` };
             }
             invocation.agent.followup(createUserMessage({
                 content: [{ type: 'text', text: `/${AGENT_ORBIT_COMMAND}${invocation.rawInput}` }],
                 source: { kind: 'user' },
             }));
-            return { kind: 'success', text: 'Orbit activated — the existing supervisor will handle this goal.' };
+            return { kind: 'success', text: 'Orbit 已激活，现有 Supervisor 将处理此目标。' };
         },
     }), 'dsh-orbit: /agent-orbit host command');
 }
@@ -91,18 +91,18 @@ export function registerOrbitCommand(ctx) {
 export function registerOrbitToggleCommand(ctx) {
     ctx.effect(() => ctx.commands.register({
         name: ORBIT_TOGGLE_COMMAND,
-        description: 'Turn the per-chat Orbit default on or off without starting a run',
-        input: { hint: 'on or off' },
+        description: '启用或关闭本会话 Orbit，不启动 Run',
+        input: { hint: '请输入 on 或 off' },
         handler(invocation) {
             const enabled = parseOrbitToggle(invocation.rawInput);
             if (enabled === undefined) {
-                return { kind: 'error', text: `Usage: /${ORBIT_TOGGLE_COMMAND} on|off — 请输入 on 或 off。` };
+                return { kind: 'error', text: `用法：/${ORBIT_TOGGLE_COMMAND} on|off，请输入 on 或 off。` };
             }
             return {
                 kind: 'success',
                 text: enabled
-                    ? 'Orbit is on for this chat — ordinary messages will enter Orbit.'
-                    : 'Orbit is off for this chat — ordinary messages stay native.',
+                    ? '本会话 Orbit 已启用，普通消息将进入 Orbit。'
+                    : '本会话 Orbit 已关闭，普通消息使用原生执行方式。',
             };
         },
     }), 'dsh-orbit: /orbit-toggle host command');
@@ -116,7 +116,8 @@ export function registerOrbitToggleCommand(ctx) {
  * call while the message stays in the conversation as durable history.
  */
 export function installOrbitGestureBoundary(ctx, options = {}) {
-    ctx.on('agent/pre-step', async ({ agent, messages, signal }, next) => {
+    ctx.on('agent/pre-step', async (payload, next) => {
+        const { agent, messages, signal } = payload;
         const decision = await next();
         if (decision.kind === 'reject')
             return decision;
@@ -134,7 +135,7 @@ export function installOrbitGestureBoundary(ctx, options = {}) {
         // `decision.messages`, which this path leaves empty.
         for (const message of messages)
             agent.session.append('user/message', message, { surfaceOp: 'append' });
-        await activate(agent, goal, signal);
+        await activate(agent, goal, { turn: payload.turn, step: payload.step }, signal);
         return { kind: 'enter', messages: [] };
     });
 }

package/lib/capabilities.js

@@ -0,0 +1,23 @@
+export const EXECUTOR_READ_ONLY_TOOLS = ['read', 'read_image', 'glob', 'grep'];
+export const FILESYSTEM_TOOLS = ['write', 'edit', 'str_replace_editor'];
+export const SHELL_TOOLS = ['bash'];
+export const WEB_TOOLS = ['web_search', 'web_fetch'];
+export const READ_ONLY_ROLE_TOOLS = [...EXECUTOR_READ_ONLY_TOOLS, ...WEB_TOOLS];
+const READ_ONLY_SET = new Set(EXECUTOR_READ_ONLY_TOOLS);
+/** Deterministically map bounded capability ids to tool names. */
+export function executorToolsFor(capabilities, browserTools, configuredReadOnly = EXECUTOR_READ_ONLY_TOOLS) {
+    const tools = configuredReadOnly.filter((tool) => READ_ONLY_SET.has(tool));
+    if (capabilities.includes('filesystem'))
+        tools.push(...FILESYSTEM_TOOLS);
+    if (capabilities.includes('shell'))
+        tools.push(...SHELL_TOOLS);
+    if (capabilities.includes('web'))
+        tools.push(...WEB_TOOLS);
+    if (capabilities.includes('browser'))
+        tools.push(...browserTools);
+    return [...new Set(tools)];
+}
+/** Tools that can mutate workspace or browser state while Orbit owns it. */
+export function mutationTools(browserTools) {
+    return new Set([...FILESYSTEM_TOOLS, ...SHELL_TOOLS, 'pwsh', 'apply_patch', 'delete_file', 'move_file', ...browserTools]);
+}

package/lib/client.js

@@ -19,46 +19,22 @@ window.__ModuleLoader__.load({
 			}
 		}
 		/**
-		* UI-only fallback ladder for models whose catalog entry declares no reasoning
-		* metadata. The DSH catalog is never modified: this only fills the Orbit
-		* picker, and a provider that rejects an effort still fails through the normal
-		* selection error path.
-		*/
-		const FALLBACK_REASONING_EFFORTS = [
-			"low",
-			"medium",
-			"high",
-			"xhigh",
-			"max"
-		];
-		const FALLBACK_EFFORT_LABELS = {
-			low: "Low",
-			medium: "Medium",
-			high: "High",
-			xhigh: "XHigh",
-			max: "Max"
-		};
-		/**
-		* Effort options for one model: the adapter's explicit list when the catalog
-		* declares one, otherwise the Orbit UI fallback ladder.
+		* Effort options for one model: exactly the DSH model metadata's explicit
+		* `reasoning.efforts`. A model without reasoning metadata yields none; the
+		* picker then offers only Provider default.
 		*/
 		function effortsOf(model) {
-			const explicit = model?.reasoning?.efforts ?? [];
-			if (explicit.length > 0) return explicit.map((effort) => ({
+			return (model?.reasoning?.efforts ?? []).map((effort) => ({
 				id: effort.id,
 				name: effort.name
 			}));
-			return FALLBACK_REASONING_EFFORTS.map((id) => ({
-				id,
-				name: FALLBACK_EFFORT_LABELS[id] ?? id
-			}));
 		}
 		/** Human effort label for a stored effort id; falls back to the raw id. */
 		function effortLabelOf(model, effort) {
 			if (effort === void 0 || effort === "") return void 0;
 			const explicit = model?.reasoning?.efforts.find((entry) => entry.id === effort);
 			if (explicit !== void 0) return explicit.name;
-			return FALLBACK_EFFORT_LABELS[effort] ?? effort;
+			return effort;
 		}
 		/** Display name for a stored route: catalog name, then its model id. */
 		function routeLabelOf(state, route) {
@@ -66,33 +42,19 @@ window.__ModuleLoader__.load({
 			return modelOf(state, route)?.name ?? route.model;
 		}
 		/**
-		* Route for a freshly picked model: the model's own default effort. A model
-		* without effort metadata yields no effort — a previous model's effort is
-		* never inherited.
+		* Route for a freshly picked model: no reasoning effort is adopted, not even
+		* the catalog metadata's `defaultEffort`. Provider default means the absent
+		* effort, and a previous model's effort is never inherited.
 		*/
 		function routeForModel(provider, model) {
-			const defaultEffort = model.reasoning?.defaultEffort;
-			return {
-				provider,
-				model: model.id,
-				...defaultEffort === void 0 ? {} : { reasoningEffort: defaultEffort }
-			};
-		}
-		/**
-		* Selection for the shared Session directory: preserve the current effort
-		* when the route did not change, otherwise use the picked model's default.
-		*/
-		function selectionForModel(state, provider, model) {
-			const effort = state.current?.provider === provider && state.current.model === model.id ? state.current?.reasoningEffort ?? model.reasoning?.defaultEffort : model.reasoning?.defaultEffort;
 			return {
 				provider,
-				model: model.id,
-				...effort === void 0 ? {} : { reasoningEffort: effort }
+				model: model.id
 			};
 		}
 		/**
 		* Effort rows for one model: Provider default (an undefined effort) first,
-		* then the model's explicit ladder or the Orbit UI fallback.
+		* then the model's explicit metadata efforts, if any.
 		*/
 		function effortChoicesOf(model, providerDefaultLabel) {
 			return [{
@@ -132,22 +94,22 @@ window.__ModuleLoader__.load({
 			document.head.appendChild(tag);
 		}
 		var OrbitModelSelect_module_css_default = {
-			"back": "f77nca_back",
-			"rowLabel": "f77nca_rowLabel",
 			"title": "f77nca_title",
-			"row": "f77nca_row",
-			"hint": "f77nca_hint",
-			"switchRow": "f77nca_switchRow",
 			"panel": "f77nca_panel",
+			"switchControl": "f77nca_switchControl",
+			"error": "f77nca_error",
 			"rowDetail": "f77nca_rowDetail",
+			"chevron": "f77nca_chevron",
 			"group": "f77nca_group",
-			"error": "f77nca_error",
-			"rowValue": "f77nca_rowValue",
-			"switchControl": "f77nca_switchControl",
+			"row": "f77nca_row",
+			"switchRow": "f77nca_switchRow",
+			"hint": "f77nca_hint",
 			"rowValueActive": "f77nca_rowValueActive",
-			"chevron": "f77nca_chevron",
+			"rowValue": "f77nca_rowValue",
+			"rowLabel": "f77nca_rowLabel",
 			"check": "f77nca_check",
-			"separator": "f77nca_separator"
+			"separator": "f77nca_separator",
+			"back": "f77nca_back"
 		};
 		//#endregion
 		//#region client/OrbitModelSelect.tsx
@@ -200,6 +162,7 @@ window.__ModuleLoader__.load({
 			const [open, setOpen] = (0, react.useState)(false);
 			const [pane, setPane] = (0, react.useState)({ kind: "root" });
 			const [busy, setBusy] = (0, react.useState)(false);
+			const submitting = (0, react.useRef)(false);
 			const triggerRef = (0, react.useRef)(null);
 			const panelRef = (0, react.useRef)(null);
 			const position = (0, _deepseek_ai_dsh_client_ui_primitives.useAnchoredPosition)({
@@ -236,16 +199,26 @@ window.__ModuleLoader__.load({
 			const watchdogLabel = watchdogRoute === void 0 ? void 0 : routeLabelOf(dir, watchdogRoute) ?? watchdogRoute.model;
 			const watchdogEffort = effortLabelOf(watchdogModel, watchdogRoute?.reasoningEffort);
 			const commitRole = async (role, route) => {
+				if (submitting.current || config.status !== "ready") return;
+				submitting.current = true;
 				setBusy(true);
-				const ok = await writeRole(role, route);
-				setBusy(false);
-				if (ok) setOpen(false);
+				try {
+					if (await writeRole(role, route)) setOpen(false);
+				} finally {
+					submitting.current = false;
+					setBusy(false);
+				}
 			};
 			const commitExecutor = async (selection) => {
+				if (submitting.current) return;
+				submitting.current = true;
 				setBusy(true);
-				const ok = await selectModel(selection);
-				setBusy(false);
-				if (ok) setOpen(false);
+				try {
+					if (await selectModel(selection)) setOpen(false);
+				} finally {
+					submitting.current = false;
+					setBusy(false);
+				}
 			};
 			const currentRouteOf = (role) => role === "commander" ? config.commander : role === "watchdog" ? config.watchdog : executorRoute;
 			const roleLabelOf = (role) => role === "commander" ? commanderLabel : role === "watchdog" ? watchdogLabel : executorLabel;
@@ -272,15 +245,11 @@ window.__ModuleLoader__.load({
 					className: OrbitModelSelect_module_css_default.row,
 					disabled: busy,
 					onClick: () => {
-						if (active) {
-							setOpen(false);
-							return;
-						}
-						if (role === "executor") {
-							commitExecutor(selectionForModel(dir, provider, model));
-							return;
-						}
-						commitRole(role, routeForModel(provider, model));
+						setPane({
+							kind: "efforts",
+							role,
+							draft: routeForModel(provider, model)
+						});
 					},
 					children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("span", {
 						className: OrbitModelSelect_module_css_default.rowLabel,
@@ -294,7 +263,7 @@ window.__ModuleLoader__.load({
 					}) : null]
 				}, `${provider}/${model.id}`);
 			};
-			const effortPaneRoute = pane.kind === "efforts" ? currentRouteOf(pane.role) : void 0;
+			const effortPaneRoute = pane.kind === "efforts" ? pane.draft ?? currentRouteOf(pane.role) : void 0;
 			const effortPaneModel = modelOf(dir, effortPaneRoute);
 			const effortPaneChoices = pane.kind === "efforts" ? effortChoicesOf(effortPaneModel, t("providerDefault")) : [];
 			const settingsError = config.error;
@@ -553,7 +522,7 @@ window.__ModuleLoader__.load({
 						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
 							className: OrbitModelSelect_module_css_default.rowLabel,
 							children: choice.label
-						}), effortPaneRoute.reasoningEffort === choice.effort ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+						}), pane.draft === void 0 && effortPaneRoute.reasoningEffort === choice.effort ? /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
 							className: OrbitModelSelect_module_css_default.check,
 							children: "✓"
 						}) : null]
@@ -571,7 +540,7 @@ window.__ModuleLoader__.load({
 		const NS = "orbit-model";
 		/** English strings (the key-set source of truth for this pair). */
 		const en = {
-			triggerFallback: "Orbit",
+			triggerFallback: "Not configured",
 			tooltip: "Orbit model configuration",
 			title: "Orbit — Self-reviewing continuous execution",
 			enableLongRun: "Enable long-running execution",
@@ -596,7 +565,7 @@ window.__ModuleLoader__.load({
 		};
 		/** Chinese strings. */
 		const zh = {
-			triggerFallback: "Orbit",
+			triggerFallback: "未配置",
 			tooltip: "Orbit 模型配置",
 			title: "Orbit 让AI自我审核连续执行",
 			enableLongRun: "启用一键长执行",
@@ -690,6 +659,7 @@ window.__ModuleLoader__.load({
 			}, "dsh-orbit: settings mirror");
 			const writeRole = async (role, route) => {
 				const snapshot = settings.getSnapshot();
+				if (snapshot.status !== "ready" || snapshot.revision === void 0) return false;
 				try {
 					const response = await ctx.remote.settings.update(ORBIT_SETTINGS_NS, { [role]: {
 						provider: route.provider,

package/lib/decisions.js

@@ -14,16 +14,16 @@ export const COMMANDER_PLAN_SCHEMA = {
     additionalProperties: false,
     required: ['summary', 'steps'],
     properties: {
-        summary: { type: 'string', description: 'One-sentence plan summary.' },
+        summary: { type: 'string', description: '一句话计划摘要。' },
         steps: {
             type: 'array',
-            description: '2-5 logical engineering steps.',
+            description: '1-5 个逻辑工程步骤。',
             items: {
                 type: 'object',
                 additionalProperties: false,
                 required: ['goal'],
                 properties: {
-                    id: { type: 'string', description: 'Stable id such as P0.' },
+                    id: { type: 'string', description: '稳定标识，例如 P0。' },
                     goal: { type: 'string' },
                     capabilities: { type: 'array', items: { type: 'string', enum: CAPABILITY_ENUM } },
                 },
@@ -94,7 +94,7 @@ export const WATCHDOG_STRATEGY_SCHEMA = {
     additionalProperties: false,
     required: ['question'],
     properties: {
-        question: { type: 'string', description: 'The single strategy question to put to the Commander.' },
+        question: { type: 'string', description: '提交给 Commander 的单个策略质疑问题。' },
     },
 };
 export const WATCHDOG_GUARD_SCHEMA = {