@kasenri/dsh-orbit 0.5.7 → 0.5.9

package/lib/dsh-host.js

@@ -1,4 +1,7 @@
 import { execFileSync } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
+import { resolve } from 'node:path';
+import { SessionId } from '@deepseek-ai/dsh-session';
 import { collectTurnToolFacts } from "./evidence.js";
 import { redactText, truncateSafe } from "./sanitize.js";
 import { classifyTurnSettlement } from "./settlement.js";
@@ -10,6 +13,9 @@ function contentToText(blocks) {
         .map((block) => (block.type === 'text' ? block.text : `[${block.type}]`))
         .join('\n');
 }
+function visibleContentToText(blocks) {
+    return blocks?.flatMap((block) => block.type === 'text' && block.text.trim() !== '' ? [block.text] : []).join('\n') ?? '';
+}
 /**
  * Wire the Orbit supervisor to DeepSeek Harness native Agent/Subagent services.
  *
@@ -24,6 +30,7 @@ export class DshOrbitHost {
     ownedChildren = new Set();
     interruptedChildren = new Set();
     childParents = new Map();
+    childGrants = new Map();
     nowFn;
     sleepFn;
     constructor(ctx, options = {}) {
@@ -39,12 +46,14 @@ export class DshOrbitHost {
     }
     async startRole(request) {
         const parent = this.parent();
+        if (request.workspace !== undefined && resolve(parent.session.header.cwd ?? process.cwd()) !== resolve(request.workspace)) {
+            throw new Error('ORBIT_WORKSPACE_MISMATCH: 子代理工作目录必须与 Orbit 持有的 workspace 一致。');
+        }
         const prompt = [{ type: 'text', text: request.prompt }];
         const agentOptions = {
             provider: request.route.provider,
             model: request.route.model,
-            ...(request.route.reasoningEffort ? { reasoningEffort: request.route.reasoningEffort } : {}),
-            ...(request.route.maxTokens ? { maxTokens: request.route.maxTokens } : {}),
+            reasoningEffort: request.route.reasoningEffort,
         };
         if (request.role === 'executor') {
             return this.startExecutor(parent, request, prompt, agentOptions);
@@ -70,11 +79,12 @@ export class DshOrbitHost {
             ...(request.toolFilter ? { toolFilter: request.toolFilter } : {}),
             ...(request.outputSchema ? { outputSchema: request.outputSchema } : {}),
         }));
-        this.registerChild(run.id, parent);
+        this.registerChild(run.id, parent, request);
         const result = run.result
             .then((value) => ({
             childId: run.id,
             output: contentToText(value.output),
+            visibleOutput: visibleContentToText(value.output),
             interrupted: value.stopReason !== 'completed',
             ...(value.stopReason !== 'completed' ? { reason: value.stopReason } : {}),
             ...(value.diagnostic ? { testSummary: [value.diagnostic] } : {}),
@@ -106,13 +116,18 @@ export class DshOrbitHost {
         if (request.resumeOf) {
             const existingId = request.resumeOf;
             const existing = this.ctx.agents.get(existingId);
-            if (existing) {
+            const grant = this.childGrants.get(existingId);
+            const requestedTools = new Set(request.toolFilter?.allow ?? []);
+            const sameGrant = grant?.role === 'executor' && grant.workspace === (request.workspace ?? parent.session.header.cwd ?? process.cwd())
+                && grant.tools.size === requestedTools.size && [...grant.tools].every((tool) => requestedTools.has(tool));
+            if (existing && sameGrant && this.childParents.get(existingId) === parent && this.ctx.agents.isOwnedBy(SessionId(existingId), parent)) {
                 const agent = existing;
                 this.interruptedChildren.delete(existingId);
-                const done = this.waitForExecutorSettlement(agent, existingId);
+                const previousTurns = (agent.session?.snapshotEvents?.() ?? []).filter((event) => event.type === 'turn/start').length;
                 await this.ctx.subagents.sendMessage(parent, existingId, prompt, {
-                    signal: new AbortController().signal,
+                    signal: request.signal ?? new AbortController().signal,
                 });
+                const done = this.waitForExecutorSettlement(agent, existingId, previousTurns);
                 return {
                     childId: existingId,
                     result: done,
@@ -124,19 +139,28 @@ export class DshOrbitHost {
         }
         const controller = new AbortController();
         request.signal?.addEventListener('abort', () => controller.abort(), { once: true });
-        const started = await this.ctx.subagents.startContinuable({
-            provider: 'spawn',
-            label: request.label,
-            request: {
-                prompt,
-                parent,
-                agentOptions,
-                ...(request.toolFilter ? { toolFilter: request.toolFilter } : {}),
-            },
-            signal: controller.signal,
-        });
-        const childId = String(started.childId);
-        this.registerChild(childId, parent);
+        const reservedId = SessionId(randomUUID());
+        const childId = String(reservedId);
+        this.registerChild(childId, parent, request);
+        let started;
+        try {
+            started = await this.ctx.subagents.startContinuable({
+                provider: 'spawn',
+                label: request.label,
+                childId: reservedId,
+                request: {
+                    prompt,
+                    parent,
+                    agentOptions,
+                    ...(request.toolFilter ? { toolFilter: request.toolFilter } : {}),
+                },
+                signal: controller.signal,
+            });
+        }
+        catch (error) {
+            this.forgetChild(childId);
+            throw error;
+        }
         const agent = this.ctx.agents.get(started.childId);
         const result = agent
             ? this.waitForExecutorSettlement(agent, childId)
@@ -149,19 +173,26 @@ export class DshOrbitHost {
             runtimeSnapshot: agent ? () => this.snapshotAgent(agent) : undefined,
         };
     }
-    registerChild(childId, parent) {
+    registerChild(childId, parent, request) {
         this.ownedChildren.add(childId);
         this.childParents.set(childId, parent);
+        this.childGrants.set(childId, {
+            role: request.role,
+            workspace: resolve(request.workspace ?? parent.session.header.cwd ?? process.cwd()),
+            tools: new Set(request.toolFilter?.allow ?? []),
+        });
     }
     forgetChild(childId) {
         this.ownedChildren.delete(childId);
         this.interruptedChildren.delete(childId);
         this.childParents.delete(childId);
+        this.childGrants.delete(childId);
     }
     async interruptExecutor(childId, reason) {
         this.interruptedChildren.add(childId);
         const parent = this.childParents.get(childId);
         this.ctx.subagents.interrupt(childId, parent ? { kind: 'ancestor', agent: parent } : { kind: 'user', parentSessionId: childId });
+        await this.ctx.agents.get(SessionId(childId))?.whenIdle();
         void reason;
     }
     async drainExecutor(parent, childId) {
@@ -173,8 +204,8 @@ export class DshOrbitHost {
         }
         this.forgetChild(childId);
     }
-    async waitForExecutorSettlement(agent, childId) {
-        await this.waitForTurnOrIdle(agent);
+    async waitForExecutorSettlement(agent, childId, previousTurns = 0) {
+        await this.waitForTurnOrIdle(agent, previousTurns);
         const events = agent.session?.snapshotEvents?.() ?? agent.session?.ownEvents?.() ?? [];
         const classified = classifyTurnSettlement(events);
         const output = this.readFinalOutput(agent);
@@ -214,20 +245,22 @@ export class DshOrbitHost {
                 return { childId, output, interrupted: true, reason: 'EXECUTOR_BLOCKED', telemetry, ...evidence };
             case 'max-tokens':
                 return { childId, output, interrupted: true, reason: 'EXECUTOR_MAX_TOKENS', telemetry, ...evidence };
+            case 'interrupted':
+                return { childId, output, interrupted: true, reason: 'EXECUTOR_INTERRUPTED', telemetry, ...evidence };
             default:
                 return { childId, output, interrupted: true, reason: 'EXECUTOR_NO_TURN', telemetry, ...evidence };
         }
     }
-    async waitForTurnOrIdle(agent) {
+    async waitForTurnOrIdle(agent, previousTurns = 0) {
         const deadline = this.nowFn() + EXECUTOR_TURN_START_TIMEOUT_MS;
-        while (this.nowFn() < deadline && !this.hasTurnStarted(agent)) {
+        while (this.nowFn() < deadline && !this.hasTurnStarted(agent, previousTurns)) {
             await this.sleepFn(20);
         }
         await agent.whenIdle?.();
     }
-    hasTurnStarted(agent) {
+    hasTurnStarted(agent, previousTurns) {
         const events = agent.session?.snapshotEvents?.() ?? [];
-        return events.some((event) => event.type === 'turn/start');
+        return events.filter((event) => event.type === 'turn/start').length > previousTurns;
     }
     readFinalOutput(agent) {
         const events = agent.session?.snapshotEvents?.() ?? agent.session?.ownEvents?.() ?? [];
@@ -308,6 +341,53 @@ export class DshOrbitHost {
         const agent = this.ctx.agents.currentInitiator();
         return this.ctx.tools.get(name, agent) !== undefined;
     }
+    async validateRoutes(routes, signal) {
+        const issues = [];
+        const labels = { commander: '指挥官', executor: '执行员', watchdog: '监控模型' };
+        for (const role of ['commander', 'executor', 'watchdog']) {
+            const route = routes[role];
+            try {
+                const llm = this.ctx.reflect.get('llm');
+                if (!llm)
+                    throw new Error('DSH LLM registry 不可用');
+                const deadline = AbortSignal.timeout(10_000);
+                const activeSignal = signal ? AbortSignal.any([signal, deadline]) : deadline;
+                const info = await llm.resolveModelInfo(route.provider, route.model, activeSignal);
+                const catalog = await llm.listModels(route.provider);
+                if (catalog.length > 0 && !catalog.some((entry) => entry.id === route.model)) {
+                    issues.push(`${labels[role]}：ORBIT_MODEL_UNAVAILABLE (${route.provider}/${route.model})，当前模型目录中不存在，请重新选择。`);
+                    continue;
+                }
+                if (route.reasoningEffort !== undefined) {
+                    const efforts = info.reasoning?.efforts ?? [];
+                    if (!efforts.some((effort) => effort.id === route.reasoningEffort)) {
+                        issues.push(`${labels[role]}：ORBIT_REASONING_EFFORT_UNAVAILABLE (${route.provider}/${route.model}/${route.reasoningEffort})，当前模型未声明此推理等级。`);
+                    }
+                }
+            }
+            catch (error) {
+                issues.push(`${labels[role]}：ORBIT_MODEL_UNAVAILABLE (${route.provider}/${route.model})，当前不可用，请重新选择：${truncateSafe(error instanceof Error ? error.message : String(error), 200)}`);
+            }
+        }
+        return issues;
+    }
+    isMutationAuthorized(agent, cwd, tool) {
+        const id = String(agent?.id ?? '');
+        const grant = this.childGrants.get(id);
+        const parent = this.childParents.get(id);
+        return grant?.role === 'executor' && grant.workspace === resolve(cwd) && grant.tools.has(tool)
+            && !this.interruptedChildren.has(id) && this.ctx.agents.get(SessionId(id)) === agent
+            && parent !== undefined && this.ctx.agents.isOwnedBy(SessionId(id), parent);
+    }
+    async revokeWorkspace(cwd) {
+        const ids = [...this.childGrants].filter(([, grant]) => grant.workspace === resolve(cwd) && grant.role === 'executor').map(([id]) => id);
+        for (const id of ids) {
+            const parent = this.childParents.get(id);
+            await this.interruptExecutor(id, 'ORBIT_WORKSPACE_RELEASED');
+            if (parent)
+                await this.drainExecutor(parent, id);
+        }
+    }
     /**
      * Mutation ownership is about top-level autonomous drivers, not about every
      * running agent. The calling parent, Orbit's own children, and ordinary
@@ -316,17 +396,19 @@ export class DshOrbitHost {
      * at tool start by the Orbit mutation guard.
      */
     async otherMutationDrivers(cwd) {
-        void cwd;
         const drivers = [];
         const initiator = this.ctx.agents.currentInitiator();
         // `ctx.reflect.get` is the official service lookup that does not require an
         // inject declaration, so Orbit stays loadable in profiles without dsh-goal.
         const reflect = this.ctx.reflect;
         const goals = reflect?.get('goals');
-        if (goals && initiator) {
+        const agents = this.ctx.agents.list?.() ?? (initiator ? [initiator] : []);
+        for (const candidate of agents) {
+            if (!goals || resolve(candidate.session.header.cwd ?? process.cwd()) !== resolve(cwd) || this.ownedChildren.has(String(candidate.id)))
+                continue;
             try {
-                const goal = goals.get(initiator);
-                if (goal?.phase === 'active')
+                const goal = goals.get(candidate);
+                if (goal?.phase === 'active' && !drivers.includes('goal'))
                     drivers.push('goal');
             }
             catch {

package/lib/evidence.js

@@ -147,3 +147,27 @@ export function buildEvidenceBundle(input) {
 export function formatEvidenceBundle(bundle) {
     return bounded(JSON.stringify(bundle), EVIDENCE_LIMITS.total);
 }
+/** Persist only compact result facts, never a child transcript. */
+export function buildStepResult(stepId, attempt, bundle, tests = []) {
+    return {
+        step_id: bounded(stepId, 80),
+        attempt,
+        summary: bounded(bundle.executor_summary ?? '', EVIDENCE_LIMITS.executorSummary),
+        changed_files: bundle.changed_files.map((entry) => bounded(entry, EVIDENCE_LIMITS.entry)).slice(0, EVIDENCE_LIMITS.changedFiles),
+        test_summary: [...tests, ...bundle.tests.map((entry) => `${entry.command}: ${entry.status}`)]
+            .slice(0, EVIDENCE_LIMITS.testEvidence).map((entry) => bounded(entry, EVIDENCE_LIMITS.entry)),
+        evidence: formatEvidenceBundle(bundle),
+    };
+}
+/** Fair per-step quotas keep every step visible in a bounded final review. */
+export function formatStepResults(state) {
+    const steps = state.plan.steps;
+    const quota = Math.max(1, Math.floor(EVIDENCE_LIMITS.total / Math.max(1, steps.length)) - 100);
+    return steps.map((step) => {
+        const result = state.step_results?.find((entry) => entry.step_id === step.id);
+        const content = result === undefined ? '未记录持久化结果' : JSON.stringify({
+            summary: result.summary, test_summary: result.test_summary, changed_files: result.changed_files, evidence: result.evidence,
+        });
+        return `${bounded(step.id, 80)}[${step.status}] ${bounded(content, quota)}`;
+    }).join('\n');
+}

package/lib/guard.js

@@ -10,23 +10,23 @@ const GITHUB_REMOTE_PATTERNS = [
     /\bgit\s+remote\s+(?:set-url|add|remove)\b/i,
 ];
 const DANGEROUS_PATTERNS = [
-    ['destructive_operation', /\brm\s+-[A-Za-z]*r[A-Za-z]*f|\brm\s+-rf\b/i, 'recursive force deletion'],
-    ['destructive_operation', /\bgit\s+reset\s+--hard\b|\bgit\s+clean\s+-[A-Za-z]*f/i, 'irreversible git reset/clean'],
-    ['production_operation', /\bdrop\s+database\b|\b(?:drop|truncate)\s+(?:table|schema)\b/i, 'irreversible database operation'],
+    ['destructive_operation', /\brm\s+-[A-Za-z]*r[A-Za-z]*f|\brm\s+-rf\b/i, '递归强制删除'],
+    ['destructive_operation', /\bgit\s+reset\s+--hard\b|\bgit\s+clean\s+-[A-Za-z]*f/i, '不可逆的 git reset/clean'],
+    ['production_operation', /\bdrop\s+database\b|\b(?:drop|truncate)\s+(?:table|schema)\b/i, '不可逆的数据库操作'],
     [
         'production_operation',
         /\b(?:production|prod)\b.*\b(?:deploy|migrate|database|restart)\b|\b(?:deploy|migrate)\b.*\b(?:production|prod)\b/i,
-        'production operation',
+        '生产环境操作',
     ],
     [
         'production_operation',
         /\b(?:kubectl|helm)\s+(?:apply|delete|upgrade|rollback)\b|\bterraform\s+apply\b|\bdocker\s+push\b/i,
-        'deployment or remote registry write',
+        '部署或远程 registry 写入',
     ],
-    ['production_operation', /\b(?:alembic|prisma|sequelize|rails)\b.*\b(?:upgrade|migrate|db:migrate)\b/i, 'database migration'],
-    ['production_operation', /\b(?:ufw|iptables)\b.*\b(?:allow|insert|append)\b|\bdocker\s+run\b.*\s-p\s/i, 'public network exposure'],
-    ['secret_operation', /\b(?:cat|less|more|head|tail)\b[^\n]*(?:\.env|secret|credential|auth\.json|cookie)/i, 'credential or secret output'],
-    ['secret_operation', /\b(?:curl|wget)\b[^\n]*(?:Authorization|Bearer|api[_-]?key|token)=?/i, 'credential-bearing network request'],
+    ['production_operation', /\b(?:alembic|prisma|sequelize|rails)\b.*\b(?:upgrade|migrate|db:migrate)\b/i, '数据库迁移'],
+    ['production_operation', /\b(?:ufw|iptables)\b.*\b(?:allow|insert|append)\b|\bdocker\s+run\b.*\s-p\s/i, '暴露公共网络端口'],
+    ['secret_operation', /\b(?:cat|less|more|head|tail)\b[^\n]*(?:\.env|secret|credential|auth\.json|cookie)/i, '输出凭证或敏感信息'],
+    ['secret_operation', /\b(?:curl|wget)\b[^\n]*(?:Authorization|Bearer|api[_-]?key|token)=?/i, '携带凭证的网络请求'],
 ];
 const SENSITIVE_ENV_NAME = /(?:^|_)(?:KEY|TOKEN|PASSWORD|PASSWD|SECRET|COOKIE|AUTH|CREDENTIAL|PRIVATE_KEY|ACCESS_TOKEN|REFRESH_TOKEN)(?:_|$)/i;
 const DURABLE_STATE_PATH = /(?:^|[\s/'"])(?:\.\/)?\.cx(?:[/'"\s]|$)/i;
@@ -82,25 +82,25 @@ export function guardBashCommand(command, intent = {}) {
     if (intent.github_allowed !== true) {
         for (const pattern of GITHUB_REMOTE_PATTERNS) {
             if (pattern.test(trimmed))
-                return block('github_remote_write', `GitHub remote write is not allowed: ${pattern.source}`);
+                return block('github_remote_write', `未授权 GitHub 远程写入：${pattern.source}`);
         }
     }
     if (isDurableStateWrite(trimmed)) {
-        return block('durable_state_write', 'Only the Orbit controller may write .cx durable state.');
+        return block('durable_state_write', '只有 Orbit controller 可以写入 .cx 持久状态。');
     }
     if (looksLikeEnvSecret(trimmed)) {
-        return block('secret_operation', 'Reading or exporting secrets is not allowed.');
+        return block('secret_operation', '不允许读取或导出敏感凭证。');
     }
     if (/^\s*export\s+[A-Za-z_][A-Za-z0-9_]*\s*=/i.test(trimmed)) {
         const assignment = /^\s*export\s+([A-Za-z_][A-Za-z0-9_]*)\s*=/i.exec(trimmed);
         if (assignment && SENSITIVE_ENV_NAME.test(assignment[1] ?? '')) {
-            return block('secret_operation', 'Exporting a secret environment variable is not allowed.');
+            return block('secret_operation', '不允许导出敏感环境变量。');
         }
     }
     if (/^\s*set\s+[A-Za-z_][A-Za-z0-9_]*=/i.test(trimmed)) {
         const assignment = /^\s*set\s+([A-Za-z_][A-Za-z0-9_]*)\s*=/i.exec(trimmed);
         if (assignment && SENSITIVE_ENV_NAME.test(assignment[1] ?? '')) {
-            return block('secret_operation', 'Setting a secret environment variable is not allowed.');
+            return block('secret_operation', '不允许设置敏感环境变量。');
         }
     }
     for (const [code, pattern, reason] of DANGEROUS_PATTERNS) {
@@ -118,11 +118,11 @@ export function guardToolPath(toolName, targetPath, deps) {
     const cwd = deps.cwd;
     const absolute = isAbsolute(targetPath) ? targetPath : resolve(cwd, targetPath);
     if (isInsideDurableState(absolute, cwd)) {
-        return block('durable_state_write', 'Only the Orbit controller may write .cx durable state.');
+        return block('durable_state_write', '只有 Orbit controller 可以写入 .cx 持久状态。');
     }
     const realpath = deps.realpath ?? safeRealpath;
     if (isInsideDurableState(realpathWithin(absolute, realpath), cwd)) {
-        return block('durable_state_write', 'Only the Orbit controller may write .cx durable state (symlink resolved).');
+        return block('durable_state_write', '只有 Orbit controller 可以写入 .cx 持久状态（已解析符号链接）。');
     }
     return { allowed: true };
 }
@@ -153,5 +153,5 @@ function safeRealpath(path) {
     }
 }
 export function guardReason(decision) {
-    return `Blocked by Orbit safety guard (${decision.code}): ${decision.reason}`;
+    return `Orbit 安全护栏阻断当前调用 (${decision.code})：${decision.reason}`;
 }

package/lib/index.js

@@ -1,19 +1,16 @@
-import { boundContextSummary, createUserMessage } from '@deepseek-ai/dsh-llm';
+import { AssistantStreamAccumulator, boundContextSummary, createAssistantMessage, createUserMessage } from '@deepseek-ai/dsh-llm';
 import z from '@deepseek-ai/schemastery';
 import { installOrbitGestureBoundary, registerOrbitCommand, registerOrbitToggleCommand } from "./activation.js";
-import { estimateLoopCount } from "./kernel.js";
 import { createOrbitPreExecuteHandler } from "./pipeline-guard.js";
-import { resolveEffectiveRoutes, sessionModelStateOf, sessionSelectionOf } from "./routes.js";
+import { agentDefaultSelectionOf, resolveEffectiveRoutes, sessionModelSelectionOf, sessionModelStateOf } from "./routes.js";
 import { installOrbitSessionProjection, orbitEnabledOf } from "./session-state.js";
 import { OrbitService } from "./service.js";
 import { createOrbitTool } from "./tool.js";
 /**
- * Minimum loop budget for a hard-activated run. The Commander is asked for a
- * 2-5 step plan and every executed step consumes one loop slot, so the host
- * must grant a budget that can finish a full plan; the goal complexity
- * estimate raises it further when the goal asks for more.
+ * Fixed hard-activation budget. Explicit tool calls may still supply a bounded
+ * user-owned budget; ordinary activation never guesses complexity from words.
  */
-const HARD_ACTIVATION_MIN_LOOPS = 5;
+const HARD_ACTIVATION_LOOP_BUDGET = 5;
 export const name = 'dsh-orbit';
 export const inject = ['tools', 'agents', 'subagents'];
 const Route = z.object({
@@ -39,66 +36,60 @@ export const Config = z.object({
         executor: Route,
         watchdog: Route,
     })
-        .default({
-        commander: { provider: 'deepseek-official', model: 'deepseek-v4-pro', reasoningEffort: 'high' },
-        executor: { provider: 'deepseek-official', model: 'deepseek-v4-flash', reasoningEffort: 'high' },
-        watchdog: { provider: 'deepseek-official', model: 'deepseek-v4-flash', reasoningEffort: 'low' },
-    }),
+        .default({}),
     browserTools: z.array(z.string()).default(['agent_browser']),
     commanderReadOnlyTools: z.array(z.string()).default(['read', 'read_image', 'glob', 'grep', 'web_search', 'web_fetch']),
     watchdogTools: z.array(z.string()).default(['read', 'read_image', 'glob', 'grep']),
     executorTools: z
         .array(z.string())
-        .default(['read', 'read_image', 'glob', 'grep', 'bash', 'write', 'edit', 'str_replace_editor', 'web_search', 'web_fetch']),
+        .default(['read', 'read_image', 'glob', 'grep']),
     executorTimeoutMs: z.natural().default(480_000),
     registerTool: z.boolean().default(true),
     registerGuards: z.boolean().default(true),
     slashCommand: z.boolean().default(true),
 });
 export function apply(ctx, config) {
-    // Orbit settings bridge: register the `orbit` namespace with the composition
-    // routes as its base/default, so a user who never opens the model UI keeps
-    // today's behavior exactly. Lazily injected: minimal/headless compositions
-    // without a settings provider keep running from `config.routes`.
-    let routeSettings;
+    // Orbit settings bridge. The package ships no model defaults; only explicit
+    // profile routes can act as a headless compatibility fallback.
+    let readRouteSettings = () => undefined;
     ctx.inject(['settings'], (settingsCtx) => {
-        const baseRoute = (route) => ({
-            provider: route.provider,
-            model: route.model,
-            reasoningEffort: route.reasoningEffort ?? '',
-        });
         const scope = settingsCtx.settings.register('orbit', OrbitRouteSettingsSchema, {
             base: {
-                commander: baseRoute(config.routes.commander),
-                watchdog: baseRoute(config.routes.watchdog),
+                commander: { provider: '', model: '', reasoningEffort: '' },
+                watchdog: { provider: '', model: '', reasoningEffort: '' },
             },
         });
-        const sync = () => {
-            routeSettings = scope.get();
-        };
-        sync();
-        scope.watch(() => {
-            sync();
-        });
+        readRouteSettings = () => scope.get();
+        settingsCtx.effect(() => () => { readRouteSettings = () => undefined; });
     });
     // A NEW run resolves its three routes exactly once: Commander/Watchdog from
     // the Orbit settings (base = config), Executor from the initiating Session's
-    // durable `modelSelection` projection (pending → lastUsed), with the public
-    // request-header seam and the config route as compatibility fallbacks for
-    // surfaces without one. Existing runs resume from their frozen
-    // `state.routes`.
+    // current model with DSH `selectionFor(agent)` semantics (pending choice →
+    // logged header → deployment default). Explicit config routes are only for
+    // sessions without a DSH model source. Existing runs resume from frozen routes.
     const resolveRoutes = () => {
         const agent = ctx.agents.currentInitiator();
         return resolveEffectiveRoutes({
             configRoutes: config.routes,
-            settings: routeSettings,
-            sessionModel: sessionModelStateOf(ctx, agent?.session),
-            sessionSelection: sessionSelectionOf(agent),
+            settings: readRouteSettings(),
+            hasSession: agent !== undefined,
+            sessionSelection: sessionModelSelectionOf({
+                sessionModel: sessionModelStateOf(ctx, agent?.session),
+                requestHeader: agent?.session?.requestHeader?.(),
+                agentDefault: agent === undefined ? undefined : agentDefaultSelectionOf(ctx),
+            }),
         });
     };
+    // The DSH Session driving the current operation: a new run records it, and
+    // only that Session may answer the run's NEEDS_USER question.
+    const resolveOwnerSessionId = () => {
+        const agent = ctx.agents.currentInitiator();
+        return agent === undefined ? undefined : String(agent.session.id);
+    };
     const serviceConfig = {
         routes: config.routes,
         resolveRoutes,
+        resolveOwnerSessionId,
         browserTools: config.browserTools,
         commanderReadOnlyTools: config.commanderReadOnlyTools,
         watchdogTools: config.watchdogTools,
@@ -129,7 +120,7 @@ export function apply(ctx, config) {
     });
     installOrbitGestureBoundary(ctx, {
         sessionEnabled: (session) => orbitEnabledOf(ctx, session),
-        activate: async (agent, goal, signal) => {
+        activate: async (agent, goal, position, signal) => {
             const cwd = agent.session.header.cwd ?? process.cwd();
             let result;
             try {
@@ -137,13 +128,17 @@ export function apply(ctx, config) {
                 // the parent model is never asked to decide or to run the task.
                 result = await ctx.agents.withInitiator(agent, () => service.run({
                     goal,
-                    approved_loop_count: Math.max(estimateLoopCount(goal), HARD_ACTIVATION_MIN_LOOPS),
+                    approved_loop_count: HARD_ACTIVATION_LOOP_BUDGET,
                 }, cwd, signal));
             }
             catch (error) {
                 appendOrbitNotice(agent.session, `Orbit 启动失败：${error instanceof Error ? error.message : String(error)}`);
                 return;
             }
+            if (result.ok && result.phase === 'SUCCESS' && result.final_output !== undefined) {
+                appendOrbitFinalOutput(agent.session, position, result.final_output);
+                return;
+            }
             const notice = activationNotice(result);
             if (notice !== undefined)
                 appendOrbitNotice(agent.session, notice);
@@ -155,8 +150,9 @@ export function apply(ctx, config) {
     ctx.inject(['sessionProjections'], (projectionCtx) => {
         installOrbitSessionProjection(projectionCtx);
     });
-    if (config.registerGuards) {
+    {
         const handler = createOrbitPreExecuteHandler(service, {
+            contentGuards: config.registerGuards,
             competingDriver: (agent) => {
                 const reflect = ctx.reflect;
                 const goals = reflect?.get('goals');
@@ -176,6 +172,26 @@ export function apply(ctx, config) {
         ctx.on('tools/pre-execute', (exec, next) => handler(exec, next));
     }
 }
+/** Append the existing Final Commander answer as this consumed turn's sole assistant result. */
+function appendOrbitFinalOutput(session, position, output) {
+    const message = createAssistantMessage({
+        content: [{ type: 'text', text: output.text }],
+        source: { provider: output.provider, model: output.model },
+    });
+    const stream = new AssistantStreamAccumulator();
+    const time = Date.now();
+    stream.push({ time, chunk: { type: 'block-start', index: 0, blockType: 'text' } });
+    stream.push({ time, chunk: { type: 'text-delta', index: 0, text: output.text } });
+    stream.push({ time, chunk: { type: 'block-end', index: 0, block: { type: 'text', text: output.text } } });
+    stream.push({ time, chunk: { type: 'finish', reason: { kind: 'stop' } } });
+    session.append('step/start', position);
+    try {
+        session.append('assistant/message', { ...position, message, stream: [...stream.snapshot()] }, { surfaceOp: 'append' });
+    }
+    finally {
+        session.append('step/end', position);
+    }
+}
 /**
  * One durable, user-visible Orbit notice. The DSH `plugin` + `form: 'notice'`
  * source renders as a collapsed notice row instead of a user message, and the
@@ -198,6 +214,11 @@ function activationNotice(result) {
         return undefined;
     const lastError = result.data?.['last_error'];
     const reason = result.message ?? (typeof lastError === 'string' && lastError !== '' ? lastError : undefined);
+    if (result.message?.startsWith('ORBIT_NEEDS_USER_OTHER_SESSION') === true || result.message?.startsWith('ORBIT_NEEDS_USER_OWNER_UNKNOWN') === true) {
+        // Another Session owns the waiting run: report instead of consuming the
+        // message as its reply.
+        return result.message;
+    }
     if (result.phase === 'NEEDS_USER') {
         return reason !== undefined && !reason.startsWith('COMMANDER_')
             ? `Orbit 需要你的回复：${reason}`