@kasenri/dsh-orbit 0.5.7 → 0.5.9

package/lib/kernel.js

@@ -5,9 +5,9 @@
  * read a clock, or use randomness. Runtime values (routes, timestamps, run ids)
  * are supplied by the supervisor, which owns orchestration and persistence.
  */
-import { MAX_CORRECTION_DEPTH, MAX_PLAN_STEPS, MAX_WATCHDOG_CALLS_PER_STEP, MIN_PLAN_STEPS, ORBIT_SCHEMA_VERSION, } from "./types.js";
+import { MAX_CORRECTION_DEPTH, DEFAULT_LOOP_BUDGET, MAX_PLAN_STEPS, MAX_WATCHDOG_CALLS_PER_STEP, MIN_PLAN_STEPS, ORBIT_SCHEMA_VERSION, } from "./types.js";
 /** Capabilities a plan step may request. */
-export const ORBIT_CAPABILITIES = ['browser', 'web-api-recon'];
+export const ORBIT_CAPABILITIES = ['filesystem', 'shell', 'web', 'browser'];
 const STEP_CAPABILITIES = new Set(ORBIT_CAPABILITIES);
 const PLAN_STEP_ID = /^P\d+$/u;
 export function normalizeCapabilities(value) {
@@ -15,6 +15,12 @@ export function normalizeCapabilities(value) {
         return undefined;
     const result = [];
     for (const item of value) {
+        if (item === 'web-api-recon') {
+            for (const legacy of ['web', 'browser'])
+                if (!result.includes(legacy))
+                    result.push(legacy);
+            continue;
+        }
         if (typeof item !== 'string' || !STEP_CAPABILITIES.has(item))
             continue;
         if (!result.includes(item))
@@ -22,8 +28,6 @@ export function normalizeCapabilities(value) {
     }
     if (result.length === 0)
         return undefined;
-    if (result.includes('web-api-recon') && !result.includes('browser'))
-        result.unshift('browser');
     return result;
 }
 export function normalizePlan(plan) {
@@ -46,6 +50,9 @@ export function normalizePlan(plan) {
     if (steps.some((step) => !step.goal)) {
         throw new Error('COMMANDER_PLAN_OUTPUT_INVALID: every step needs a goal');
     }
+    if (new Set(steps.map((step) => step.id)).size !== steps.length) {
+        throw new Error('COMMANDER_PLAN_OUTPUT_INVALID: 步骤 id 不得重复');
+    }
     return { summary: String(plan.summary ?? '').slice(0, 1000), steps };
 }
 export function correctionDepthOf(stepId) {
@@ -68,18 +75,6 @@ export function explicitLoopBudget(input) {
         throw new Error('ORBIT_LOOP_BUDGET_INVALID: approved_loop_count above 10 requires an explicit execution request');
     return raw;
 }
-export function estimateLoopCount(goal) {
-    const text = goal.toLowerCase();
-    if (/critical|migrate|migration|production|架构|重构/.test(text))
-        return 6;
-    if (/integration|联调|ui|high/.test(text))
-        return 4;
-    if (/feature|多文件|multi-file/.test(goal))
-        return 3;
-    if (/bug|fix|test/.test(text))
-        return 2;
-    return 1;
-}
 export function updateLoopBudget(state, budget) {
     if (budget < state.loop.used)
         throw new Error(`ORBIT_LOOP_BUDGET_BELOW_USED: requested ${budget}, already used ${state.loop.used}`);
@@ -129,7 +124,7 @@ export function correctionBlockCode(state, step) {
 }
 export function createInitialState(input) {
     const max = explicitLoopBudget({ approved_loop_count: input.approvedLoopCount, max_loops: input.maxLoops }) ??
-        estimateLoopCount(input.goal);
+        DEFAULT_LOOP_BUDGET;
     return {
         schema_version: ORBIT_SCHEMA_VERSION,
         active_run_id: input.runId,
@@ -142,16 +137,18 @@ export function createInitialState(input) {
         goal: input.goal,
         goal_hash: hashGoal(input.goal),
         preset: input.preset ?? 'orbit-lite',
-        routes: input.routes,
+        routes: structuredClone(input.routes),
         loop: { used: 0, max },
         approved_loop_count: max,
         remaining_budget: max,
         loop_count: 0,
         plan: { summary: '', steps: [] },
+        step_results: [],
         changed_files: [],
         test_summary: [],
         last_error: null,
         pending_user_reply: null,
+        ...(input.ownerSessionId === undefined ? {} : { owner_session_id: input.ownerSessionId }),
         user_hard_constraints: input.userHardConstraints ? [...input.userHardConstraints] : [],
         github_allowed: input.githubAllowed === true,
         interruption_retries: 0,
@@ -193,7 +190,7 @@ export function applyExecutorCapabilityUnavailable(state, stepId) {
     state.last_error = 'BROWSER_CAPABILITY_UNAVAILABLE';
     state.commander = {
         last_decision: state.commander?.last_decision,
-        summary: `Executor could not run step ${stepId}: BROWSER_CAPABILITY_UNAVAILABLE (agent_browser tool is not registered).`,
+        summary: `Executor 无法执行步骤 ${stepId}：BROWSER_CAPABILITY_UNAVAILABLE（配置的 Browser 工具不可用）。`,
     };
     state.phase = 'EVALUATE';
 }
@@ -215,6 +212,17 @@ export function clearExecutorChild(state) {
     state.child = undefined;
     state.interruption_retries = 0;
 }
+export const MAX_STEP_RESULTS = 10;
+/** Upsert one bounded durable result without allowing evidence to drive transitions. */
+export function upsertStepResult(state, result) {
+    const results = state.step_results ?? [];
+    const index = results.findIndex((entry) => entry.step_id === result.step_id);
+    if (index === -1)
+        results.push(result);
+    else
+        results[index] = result;
+    state.step_results = results.slice(-MAX_STEP_RESULTS);
+}
 /** Apply a real Executor success: consume one loop slot, then enter EVALUATE. */
 export function applyExecutorSuccess(state, input) {
     state.child = { ...(input.childId ? { id: input.childId } : {}), status: 'completed' };
@@ -262,7 +270,9 @@ export function applyFinalAppend(state, decision) {
         return 'budget_exhausted';
     }
     for (const item of appended.slice(0, remaining)) {
-        const index = state.plan.steps.filter((candidate) => isBaseStepId(candidate.id)).length;
+        let index = state.plan.steps.filter((candidate) => isBaseStepId(candidate.id)).length;
+        while (state.plan.steps.some((candidate) => candidate.id === `P${index}`))
+            index += 1;
         state.plan.steps.push({
             id: `P${index}`,
             goal: item.goal,
@@ -281,7 +291,9 @@ export function applyCorrectionStep(state, step, input) {
     step.status = 'needs_correction';
     const number = correctionDepthOf(step.id) + 2;
     const insertAt = state.plan.steps.indexOf(step) + 1;
-    const correctionCapabilities = normalizeCapabilities(input.capabilities) ?? step.capabilities;
+    const correctionCapabilities = input.capabilities === undefined
+        ? step.capabilities
+        : normalizeCapabilities(input.capabilities);
     state.plan.steps.splice(insertAt, 0, {
         id: `${base}-${number}`,
         goal: input.nextGoal,

package/lib/pipeline-guard.js

@@ -1,4 +1,5 @@
 import { guardBashCommand, guardReason, guardToolPath } from "./guard.js";
+import { mutationTools } from "./capabilities.js";
 const WRITE_PATH_TOOLS = new Set(['write', 'edit', 'str_replace_editor']);
 /** Top-level autonomous mutation drivers that must not run beside an active Orbit run. */
 export const MUTATION_DRIVER_TOOLS = new Set(['create_goal', 'ralph', 'workflow']);
@@ -16,12 +17,13 @@ export function createOrbitPreExecuteHandler(service, options = {}) {
         const cwd = exec.agent?.session?.header?.cwd ?? process.cwd();
         const active = service.hasActiveRun(cwd);
         const args = (exec.arguments ?? {});
+        const mutating = mutationTools(service.browserToolNames()).has(exec.name);
         // Orbit owns the workspace: refuse to start another top-level mutation driver.
         if (active && MUTATION_DRIVER_TOOLS.has(exec.name)) {
             return {
                 kind: 'deny',
-                reason: `ORBIT_MUTATION_DRIVER_CONFLICT: an active Orbit run owns this workspace, so ${exec.name} must not start. ` +
-                    'Resume or stop the Orbit run first, or continue through orbit_controller.',
+                reason: `ORBIT_MUTATION_DRIVER_CONFLICT: 当前 workspace 由 Orbit 持有，不能启动 ${exec.name}。` +
+                    '请先 resume 或 stop 当前 Run，或通过 orbit_controller 继续。',
             };
         }
         // Another driver already owns the workspace: refuse to start Orbit.
@@ -32,13 +34,23 @@ export function createOrbitPreExecuteHandler(service, options = {}) {
                 if (competing) {
                     return {
                         kind: 'deny',
-                        reason: `ORBIT_MUTATION_DRIVER_CONFLICT: ${competing} already owns mutation in this workspace; stop it before starting Orbit.`,
+                        reason: `ORBIT_MUTATION_DRIVER_CONFLICT: ${competing} 已持有此 workspace 的修改权，请先停止该 Driver。`,
                     };
                 }
             }
         }
         if (!active)
             return next();
+        // Runtime ownership fence: only the current Orbit Executor child may use
+        // mutation-capable tools in an Orbit-owned workspace.
+        if (mutating && !service.isMutationAuthorized(exec.agent, exec.name, cwd)) {
+            return {
+                kind: 'deny',
+                reason: `ORBIT_MUTATION_DRIVER_CONFLICT: 当前 workspace 由 Orbit 持有；只有当前 Orbit Executor 可以调用 ${exec.name}。`,
+            };
+        }
+        if (options.contentGuards === false)
+            return next();
         if (exec.name === 'bash') {
             const command = typeof args['command'] === 'string' ? args['command'] : '';
             const decision = guardBashCommand(command, { github_allowed: service.githubAllowed(cwd) });
@@ -59,7 +71,7 @@ export function createOrbitPreExecuteHandler(service, options = {}) {
         }
         // The browser tool can write its structured result to a caller path; route
         // that path through the same durable-state policy instead of a second copy.
-        if (exec.name === 'agent_browser') {
+        if (service.browserToolNames().includes(exec.name)) {
             const outputPath = args['outputPath'];
             if (typeof outputPath === 'string' && outputPath.length > 0) {
                 const decision = guardToolPath('write', outputPath, { cwd });

package/lib/routes.js

@@ -1,80 +1,82 @@
-/**
- * Effective route resolution for a new Orbit run.
- *
- * Orbit stores only Commander and Watchdog itself (`orbit` settings namespace,
- * falling back to the composition `config.routes`). The Executor follows the
- * initiating Session's current model selection, read from the durable
- * `modelSelection` projection (the user's pending choice first, then the model
- * that actually served the last request) with the request-header seam and
- * `config.routes.executor` as compatibility fallbacks (headless, CLI, minimal
- * profiles, tests). Resolution happens exactly once per new run and is frozen
- * into `state.routes`.
- */
-/**
- * Resolve the optional session projection registry without an inject
- * declaration, exactly like the goal-driver lookup: minimal compositions
- * without the registry simply have no durable model selection.
- * @param ctx - any context whose `reflect` service lookup is available.
- * @returns the registry, or undefined when the composition omits it.
- */
+/** Effective route resolution for a new Orbit run. */
 export function projectionRegistryOf(ctx) {
     const reflect = ctx?.reflect;
     const registry = reflect?.get('sessionProjections');
     return registry !== null && typeof registry === 'object' ? registry : undefined;
 }
-/**
- * Read one Session's durable model-selection state (`modelSelection` unit).
- * @param ctx - context carrying the projection registry.
- * @param session - the initiating Session, when one exists.
- * @returns the projection state, or undefined when it is unavailable.
- */
 export function sessionModelStateOf(ctx, session) {
     const state = projectionRegistryOf(ctx)?.stateOf?.(session, 'modelSelection');
     return state !== null && typeof state === 'object' ? state : undefined;
 }
-/**
- * Normalize one provider/model/effort candidate into a complete route.
- * @param selection - candidate fields from settings, the session model, or tests.
- * @returns the complete route, or undefined when provider/model are unusable.
- */
+/** Read-only access to DSH's deployment model selection. */
+export function agentDefaultSelectionOf(ctx) {
+    const reflect = ctx?.reflect;
+    const service = reflect?.get('agentDefaultModel');
+    if (service?.currentSelection === undefined)
+        return undefined;
+    try {
+        const selection = service.currentSelection();
+        return selection !== null && typeof selection === 'object' ? selection : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** DSH selection intent: pending choice, last request, then deployment default. */
+export function sessionModelSelectionOf(sources) {
+    const pending = sources.sessionModel?.pending;
+    if (pending !== undefined && pending !== null)
+        return pending;
+    const header = sources.requestHeader;
+    if (header?.config !== undefined) {
+        const effort = header.config.reasoningEffort;
+        const adapterDefaultEffort = header.adapterDefaults?.reasoningEffort === true;
+        return {
+            provider: header.config.provider,
+            model: header.config.model,
+            ...(effort === undefined || effort === '' || adapterDefaultEffort ? {} : { reasoningEffort: effort }),
+        };
+    }
+    return sources.agentDefault;
+}
+/** Normalize a user-owned selection; whitespace and malformed effort are invalid. */
 export function routeFromSelection(selection) {
     if (selection === undefined)
         return undefined;
-    const { provider, model, reasoningEffort } = selection;
-    if (typeof provider !== 'string' || provider === '')
+    const provider = typeof selection.provider === 'string' ? selection.provider.trim() : '';
+    const model = typeof selection.model === 'string' ? selection.model.trim() : '';
+    if (provider === '' || model === '')
         return undefined;
-    if (typeof model !== 'string' || model === '')
+    const effort = selection.reasoningEffort;
+    if (effort !== undefined && typeof effort !== 'string')
         return undefined;
     return {
         provider,
         model,
-        ...(typeof reasoningEffort === 'string' && reasoningEffort !== '' ? { reasoningEffort } : {}),
+        ...(typeof effort === 'string' && effort.trim() !== '' ? { reasoningEffort: effort.trim() } : {}),
     };
 }
-/**
- * Resolve the three role routes for a NEW run:
- * Commander = settings (base = config) → config; Executor = session model
- * (pending → lastUsed) → request header → config; Watchdog = settings
- * (base = config) → config.
- * @param input - config fallback, settings section, and session model state.
- * @returns the complete frozen route set.
- */
+const ROLE_LABELS = {
+    commander: 'Commander',
+    executor: 'Executor',
+    watchdog: 'Watchdog',
+};
+/** Resolve all three routes or fail before a durable run is created. */
 export function resolveEffectiveRoutes(input) {
-    return {
-        commander: routeFromSelection(input.settings?.commander) ?? input.configRoutes.commander,
-        executor: routeFromSelection(input.sessionModel?.pending ?? undefined) ??
-            routeFromSelection(input.sessionModel?.lastUsed ?? undefined) ??
-            routeFromSelection(input.sessionSelection) ??
-            input.configRoutes.executor,
-        watchdog: routeFromSelection(input.settings?.watchdog) ?? input.configRoutes.watchdog,
+    const routes = {
+        commander: routeFromSelection(input.settings?.commander) ?? routeFromSelection(input.configRoutes?.commander),
+        executor: input.hasSession === true || input.sessionSelection !== undefined
+            ? routeFromSelection(input.sessionSelection)
+            : routeFromSelection(input.configRoutes?.executor),
+        watchdog: routeFromSelection(input.settings?.watchdog) ?? routeFromSelection(input.configRoutes?.watchdog),
     };
+    const missing = ['commander', 'executor', 'watchdog'].filter((role) => routes[role] === undefined);
+    if (missing.length > 0) {
+        throw new Error(`ORBIT_ROLE_MODEL_CONFIGURATION_REQUIRED: Orbit 尚未完成角色模型配置：${missing.map((role) => `${ROLE_LABELS[role]} 未选择`).join('；')}。` +
+            '请先在 Orbit 模型菜单中选择；无 Web 设置界面的 profile 可显式配置 routes。');
+    }
+    return structuredClone(routes);
 }
-/**
- * Read the initiating Session's current model selection from the public
- * request-header seam (`Agent.session.requestHeader().config`).
- * @param agent - initiating agent, or undefined outside a boundary.
- * @returns the selection route, or undefined when no header exists.
- */
 export function sessionSelectionOf(agent) {
-    return routeFromSelection(agent?.session?.requestHeader?.()?.config);
+    return agent?.session?.requestHeader?.()?.config;
 }

package/lib/sanitize.js

@@ -1,7 +1,7 @@
 /** Secret redaction shared by Orbit state, logs, and watchdog prompts. */
 const SECRET_PATTERNS = [
     /(authorization\s*:\s*(?:bearer\s+)?)[^\s,;]+/gi,
-    /((?:api[_-]?key|access[_-]?token|refresh[_-]?token|password|passwd|cookie|secret|private[_-]?key)\s*[=:]\s*)[^\s,;]+/gi,
+    /((?:api[_-]?key|access[_-]?token|refresh[_-]?token|token|password|passwd|cookie|secret|private[_-]?key)\s*[=:]\s*)[^\s,;]+/gi,
     /(\b(?:sk|pk|ghp|github_pat)_[A-Za-z0-9_-]{8,})/g,
     /(\bBearer\s+)[A-Za-z0-9._-]+/gi,
 ];
@@ -32,7 +32,8 @@ export function truncateSafe(value, max = 4000) {
     const redacted = redactText(value);
     if (redacted.length <= max)
         return redacted;
-    return `${redacted.slice(0, max)}\n...[truncated]`;
+    const marker = '\n...[truncated]';
+    return `${redacted.slice(0, Math.max(0, max - marker.length))}${marker}`;
 }
 export function looksLikeSecretKey(key) {
     return SENSITIVE_KEY.test(key);

package/lib/service.js

@@ -1,4 +1,5 @@
-import { accessSync, constants, mkdirSync } from 'node:fs';
+import { accessSync, constants, existsSync } from 'node:fs';
+import { resolve } from 'node:path';
 import { Service } from '@deepseek-ai/cordis';
 import { DshOrbitHost } from "./dsh-host.js";
 import { OrbitStateStore } from "./state-store.js";
@@ -6,6 +7,7 @@ import { OrbitSupervisor } from "./supervisor.js";
 export class OrbitService extends Service {
     host;
     config;
+    executions = new Map();
     constructor(ctx, config) {
         super(ctx, 'orbit');
         this.host = new DshOrbitHost(ctx);
@@ -15,6 +17,7 @@ export class OrbitService extends Service {
         return new OrbitSupervisor(new OrbitStateStore(projectDir), this.host, {
             defaultRoutes: this.config.routes,
             ...(this.config.resolveRoutes ? { resolveRoutes: this.config.resolveRoutes } : {}),
+            ...(this.config.resolveOwnerSessionId ? { resolveOwnerSessionId: this.config.resolveOwnerSessionId } : {}),
             browserTools: this.config.browserTools,
             commanderReadOnlyTools: this.config.commanderReadOnlyTools,
             watchdogTools: this.config.watchdogTools,
@@ -23,21 +26,67 @@ export class OrbitService extends Service {
         });
     }
     resolveProjectDir(projectDir) {
-        return projectDir ?? this.config.projectDir ?? process.cwd();
+        return resolve(projectDir ?? this.config.projectDir ?? process.cwd());
     }
     run(input, projectDir, signal) {
-        return this.supervisorFor(this.resolveProjectDir(projectDir)).bootstrap(input, signal);
+        const dir = this.resolveProjectDir(projectDir);
+        return this.execute(dir, signal, (activeSignal) => this.supervisorFor(dir).bootstrap(input, activeSignal));
+    }
+    async execute(dir, signal, operation) {
+        if (this.executions.has(dir))
+            return { ok: false, action: 'run', message: 'ORBIT_MUTATION_DRIVER_CONFLICT: 此 workspace 已有 Orbit 执行中的调用。' };
+        const controller = new AbortController();
+        const abort = () => controller.abort();
+        if (signal?.aborted)
+            controller.abort();
+        signal?.addEventListener('abort', abort, { once: true });
+        const result = Promise.resolve().then(() => operation(controller.signal));
+        this.executions.set(dir, { controller, result });
+        try {
+            const settled = await result;
+            if (settled.phase === 'SUCCESS' || settled.phase === 'STOPPED' || settled.phase === 'BUDGET_EXHAUSTED' || settled.message === 'ORBIT_ABORTED') {
+                await this.host.revokeWorkspace(dir);
+            }
+            return settled;
+        }
+        catch (error) {
+            await this.host.revokeWorkspace(dir);
+            throw error;
+        }
+        finally {
+            signal?.removeEventListener('abort', abort);
+            this.executions.delete(dir);
+        }
     }
     async resume(input, projectDir, signal) {
         const dir = this.resolveProjectDir(projectDir);
         const state = new OrbitStateStore(dir).readState();
         if (!state)
-            return { ok: false, action: 'resume', message: 'ORBIT_RUN_NOT_FOUND: no durable run to resume.' };
+            return { ok: false, action: 'resume', message: 'ORBIT_RUN_NOT_FOUND: 没有可继续的持久化 Run。' };
         const supervisor = this.supervisorFor(dir);
-        return supervisor.run(state, signal);
+        if (input.run_id && input.run_id !== state.run_id)
+            return { ok: false, action: 'resume', message: 'ORBIT_RUN_NOT_FOUND: Run id 不匹配。' };
+        if (state.phase === 'NEEDS_USER') {
+            if (state.owner_session_id !== undefined)
+                return this.run(input, dir, signal);
+            // Explicit resume is the only ownerless compatibility path; it never
+            // adopts the caller or stores its message as a user reply.
+            state.phase = state.plan.steps.length === 0 ? 'PLAN' : 'EXECUTE';
+            state.status = 'running';
+        }
+        return this.execute(dir, signal, (activeSignal) => supervisor.run(state, activeSignal));
     }
-    stop(runId, projectDir) {
-        return this.supervisorFor(this.resolveProjectDir(projectDir)).stop('stop', runId);
+    async stop(runId, projectDir) {
+        const dir = this.resolveProjectDir(projectDir);
+        const state = new OrbitStateStore(dir).readState();
+        if (runId && state?.run_id !== runId)
+            return { ok: false, action: 'stop', message: 'ORBIT_RUN_NOT_FOUND: Run id 不匹配。' };
+        const active = this.executions.get(dir);
+        active?.controller.abort();
+        if (active)
+            await active.result.catch(() => undefined);
+        await this.host.revokeWorkspace(dir);
+        return this.supervisorFor(dir).stop('stop', runId);
     }
     status(projectDir) {
         return this.supervisorFor(this.resolveProjectDir(projectDir)).status();
@@ -49,6 +98,12 @@ export class OrbitService extends Service {
         const state = new OrbitStateStore(this.resolveProjectDir(projectDir)).readState();
         return state !== null && state.driver_ownership !== 'CLOSED';
     }
+    isMutationAuthorized(agent, tool, projectDir) {
+        return this.host.isMutationAuthorized(agent, this.resolveProjectDir(projectDir), tool);
+    }
+    browserToolNames() {
+        return this.config.browserTools;
+    }
     githubAllowed(projectDir) {
         const state = new OrbitStateStore(this.resolveProjectDir(projectDir)).readState();
         return state?.github_allowed === true;
@@ -57,9 +112,8 @@ export class OrbitService extends Service {
         const dir = this.resolveProjectDir(projectDir);
         const checks = [];
         try {
-            mkdirSync(`${dir}/.cx`, { recursive: true, mode: 0o700 });
-            accessSync(`${dir}/.cx`, constants.W_OK);
-            checks.push({ name: 'state-storage', status: 'pass', detail: `${dir}/.cx is writable` });
+            accessSync(existsSync(`${dir}/.cx`) ? `${dir}/.cx` : dir, constants.W_OK);
+            checks.push({ name: 'state-storage', status: 'pass', detail: '状态存储目录可写' });
         }
         catch (error) {
             checks.push({ name: 'state-storage', status: 'fail', detail: String(error) });
@@ -92,11 +146,17 @@ export class OrbitService extends Service {
             status: 'pass',
             detail: 'DshOrbitHost provides cancel/dispose/runtimeSnapshot for every role handle',
         });
-        checks.push({
-            name: 'role-routes',
-            status: this.config.routes.commander.model && this.config.routes.executor.model ? 'pass' : 'fail',
-            detail: `commander=${this.config.routes.commander.model} executor=${this.config.routes.executor.model} watchdog=${this.config.routes.watchdog.model}`,
-        });
+        const reflect = this.ctx.reflect;
+        checks.push({ name: 'model-registry', status: reflect.get('llm') ? 'pass' : 'fail', detail: '使用 DSH 当前 LLM registry 校验模型，不内置角色模型。' });
+        checks.push({ name: 'orbit-settings', status: reflect.get('settings') ? 'pass' : 'warn', detail: 'Commander / Watchdog 使用用户 Orbit 设置或显式 profile routes。' });
+        try {
+            const routes = this.config.resolveRoutes?.();
+            const issues = routes ? await this.host.validateRoutes(routes) : ['未配置模型解析来源'];
+            checks.push({ name: 'role-model-configuration', status: issues.length ? 'warn' : 'pass', detail: issues.join('；') || '三角色用户模型配置可用。' });
+        }
+        catch (error) {
+            checks.push({ name: 'role-model-configuration', status: 'warn', detail: String(error) });
+        }
         checks.push({ name: 'tested-dsh-version', status: 'pass', detail: 'tested against @deepseek-ai/dsh 0.1.5-rc.2' });
         const status = checks.some((check) => check.status === 'fail') ? 'fail' : checks.some((check) => check.status === 'warn') ? 'warn' : 'pass';
         return { status, generatedAt: new Date().toISOString(), checks };

package/lib/settlement.js

@@ -5,6 +5,7 @@
  * `completed | aborted | error | blocked | max-tokens` (`interrupted` only
  * appears on cold-read synthesis). A child that is merely `idle` is NOT success.
  */
+import { truncateSafe } from "./sanitize.js";
 export function classifyTurnSettlement(events) {
     let end;
     for (let index = events.length - 1; index >= 0; index -= 1) {
@@ -22,11 +23,13 @@ export function classifyTurnSettlement(events) {
         case 'aborted':
             return { settlement: 'aborted', ...(reason.reason?.kind ? { cancelCause: reason.reason.kind } : {}) };
         case 'error':
-            return { settlement: 'error', ...(reason.error?.message ? { errorMessage: reason.error.message } : {}) };
+            return { settlement: 'error', ...(reason.error?.message ? { errorMessage: truncateSafe(reason.error.message, 500) } : {}) };
         case 'blocked':
             return { settlement: 'blocked' };
         case 'max-tokens':
             return { settlement: 'max-tokens' };
+        case 'interrupted':
+            return { settlement: 'interrupted' };
         default:
             return { settlement: 'open' };
     }

package/lib/state-store.js

@@ -1,4 +1,4 @@
-import { mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import { hostname } from 'node:os';
 import { dirname, join } from 'node:path';
 import { randomUUID } from 'node:crypto';
@@ -63,15 +63,23 @@ export class OrbitStateStore {
         }
     }
     readRawState() {
-        try {
-            const parsed = JSON.parse(readFileSync(this.statePath, 'utf8'));
-            if (parsed !== null && typeof parsed === 'object')
-                return parsed;
+        if (!existsSync(this.statePath))
             return null;
+        let parsed;
+        try {
+            parsed = JSON.parse(readFileSync(this.statePath, 'utf8'));
         }
-        catch {
-            return null;
+        catch (error) {
+            throw new Error(`ORBIT_STATE_INVALID: 无法解析 ${this.statePath}：${error instanceof Error ? error.message : String(error)}`);
+        }
+        if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+            throw new Error(`ORBIT_STATE_INVALID: ${this.statePath} 不是有效的对象状态。`);
+        }
+        const schema = parsed['schema_version'];
+        if (typeof schema === 'number' && schema > ORBIT_SCHEMA_VERSION) {
+            throw new Error(`ORBIT_STATE_SCHEMA_UNSUPPORTED: ${this.statePath} 使用未来 schema_version=${schema}。`);
         }
+        return parsed;
     }
     readState() {
         const raw = this.readRawState();