@ljwei-stak/dsh-model-route-bot 0.66.3 → 0.67.0

package/modules/bot-runtime/vendor/ds-bot/src/host/roster.js

@@ -2,7 +2,7 @@
 // the first Main Bot of a new team.
 import { mkdir } from 'node:fs/promises'
 import { MAX_AVATAR_IMAGE, ROOM_MAX_MEMBERS, ROOM_MODES, ROOM_NAME_MAX, ROOM_NOTICE_MAX } from './constants.js'
-import { currentColor, isColor, normalize, unquote } from './text.js'
+import { currentColor, isColor, normalize, splitRef, unquote } from './text.js'
 import { nameProblem } from '../shared/mentions.js'
 
 const BROWSER_GRANT_KINDS = new Set(['post', 'upload', 'download', 'delete', '*'])
@@ -420,6 +420,114 @@ export function install(rt) {
     return bot
   }
 
+  // Trusted product-only profile edit. No notice is delivered, no model is selected,
+  // and no kickoff is released. The owner service supplies the final synchronous
+  // committed-state check; the live base is compared at the same mutation boundary.
+  async function updateBotProfile(id, patch, { base, check } = {}) {
+    const fail = (code, message) => { throw Object.assign(new Error(message), { code }) }
+    const fields = { name: 40, role: 24, instructions: 4000 }
+    const plain = value => value && typeof value === 'object' && !Array.isArray(value)
+    if (!plain(patch) || !Object.keys(patch).length || Object.keys(patch).some(key => !Object.hasOwn(fields, key))
+      || !plain(base) || typeof check !== 'function') fail('BOT_PROFILE_INVALID', 'Invalid profile mutation')
+    const bot = rt.botOf(id)
+    if (!bot || state.bots[id] !== bot) fail('BOT_PROFILE_UNKNOWN_BOT', 'Unknown Bot')
+    if (rt.readOnly() !== undefined) fail('PRODUCT_READ_ONLY', rt.readOnly())
+    const next = {}
+    for (const field of Object.keys(patch)) {
+      if (typeof patch[field] !== 'string' || patch[field].trim().length > fields[field]) fail('BOT_PROFILE_INVALID', 'Invalid profile field')
+      if (typeof base[field] !== 'string' || (bot[field] ?? '') !== base[field]) fail('BOT_PROFILE_CONFLICT', 'Bot profile changed before commit')
+      next[field] = patch[field].trim()
+    }
+    if (next.name !== undefined) {
+      const clash = rt.findBot(next.name)
+      const pending = isHeld('bot', next.name) && normalize(next.name) !== normalize(bot.name)
+      const problem = next.name === bot.name ? undefined : nameProblem(next.name)
+      if (!next.name || (clash && clash.id !== id) || pending || problem !== undefined) fail('BOT_PROFILE_NAME_INVALID', 'Bot name is not available')
+    }
+    const checked = check(bot)
+    if (checked && typeof checked.then === 'function') fail('BOT_PROFILE_INVALID', 'Profile commit check must be synchronous')
+    // No await between the check and all three field assignments.
+    const renamed = next.name !== undefined && next.name !== bot.name
+    Object.assign(bot, next)
+    const rooms = renamed ? Object.values(state.rooms).filter(room => !room.named && room.members.includes(id)) : []
+    for (const room of rooms) room.name = autoRoomName(room.members)
+    await rt.save()
+    // Session titles are presentation. A failure cannot undo an already persisted
+    // profile or turn the successful save into a request the UI might retry.
+    if (renamed) {
+      try {
+        const agent = await rt.resolveAgent(rt.chatOf(id))
+        const current = rt.botOf(id)
+        if (current) await ctx.sessionTitle.rename(agent.session, current.name)
+      } catch (error) { rt.warn('ds-bot: profile session title not updated: %s', error?.message ?? error) }
+      for (const room of rooms) await retitleRoom(room)
+    }
+    return bot
+  }
+
+  // Trusted product-only thread records. A thread Session is made by the caller
+  // through rt.createSession — the same factory every own chat uses — and
+  // recorded here in one save, so the committed state the Host lifecycle
+  // compiles and the directory the product keeps can never disagree about who
+  // owns a Session. Nothing here delivers a notice, picks a model beyond the
+  // Bot's own, or starts a turn.
+  const THREAD_LIMIT = 64
+  const THREAD_ID = /^[A-Za-z0-9_-]{1,128}$/
+  const threadFail = (code, message) => { throw Object.assign(new Error(message), { code }) }
+  async function addThreadSession(botId, threadId, sessionId, { name } = {}) {
+    const readOnly = rt.readOnly()
+    if (readOnly !== undefined) threadFail('PRODUCT_READ_ONLY', readOnly)
+    const bot = rt.botOf(botId)
+    if (!bot || state.bots[botId] !== bot) threadFail('BOT_THREAD_UNKNOWN_BOT', 'Unknown Bot')
+    if (!THREAD_ID.test(threadId ?? '') || !THREAD_ID.test(sessionId ?? '')) threadFail('BOT_THREAD_INVALID', 'Invalid thread identity')
+    const threads = bot.threads ?? []
+    if (threads.length >= THREAD_LIMIT) threadFail('BOT_THREAD_LIMIT', 'Too many threads on one Bot')
+    if (threads.some(thread => thread.threadId === threadId)) threadFail('BOT_THREAD_KNOWN', 'That thread already has a Session')
+    for (const other of Object.values(state.bots)) {
+      for (const thread of other.threads ?? []) if (thread.sessionId === sessionId) threadFail('BOT_THREAD_SESSION_TAKEN', 'That Session already belongs to a thread')
+    }
+    const record = { threadId, sessionId, createdAt: Date.now(), ...(typeof name === 'string' && name.trim() ? { name: name.trim().slice(0, 80) } : {}) }
+    ;(bot.threads ??= []).push(record)
+    await rt.save()
+    // A thread runs on its Bot's model and permission preset, as a fresh part does.
+    const ref = await rt.desiredModel(bot)
+    if (ref !== undefined) {
+      const effort = await rt.desiredEffort(bot, ref)
+      await rt.selectSessionModel(sessionId, { ...splitRef(ref), ...(effort === undefined ? {} : { reasoningEffort: effort }) })
+        .catch(error => rt.warn('ds-bot: model for a thread of %s not applied: %s', bot.name, error))
+    }
+    await rt.applyPermission(bot, sessionId)
+      .catch(error => rt.warn('ds-bot: permission for a thread of %s not applied: %s', bot.name, error))
+    return { ...record }
+  }
+
+  async function renameThread(botId, threadId, name) {
+    const readOnly = rt.readOnly()
+    if (readOnly !== undefined) threadFail('PRODUCT_READ_ONLY', readOnly)
+    const bot = rt.botOf(botId)
+    const thread = bot?.threads?.find(entry => entry.threadId === threadId)
+    if (!bot || !thread) threadFail('BOT_THREAD_UNKNOWN', 'Unknown thread')
+    if (typeof name !== 'string' || name.trim().length > 80) threadFail('BOT_THREAD_INVALID', 'Invalid thread name')
+    thread.name = name.trim()
+    await rt.save()
+    return { ...thread }
+  }
+
+  // Archive hides a thread and drops its authority in the same save: the
+  // Session and its history stay, and only an explicit restore brings it back.
+  async function setThreadArchived(botId, threadId, archivedAt) {
+    const readOnly = rt.readOnly()
+    if (readOnly !== undefined) threadFail('PRODUCT_READ_ONLY', readOnly)
+    const bot = rt.botOf(botId)
+    const thread = bot?.threads?.find(entry => entry.threadId === threadId)
+    if (!bot || !thread) threadFail('BOT_THREAD_UNKNOWN', 'Unknown thread')
+    if (archivedAt === undefined || archivedAt === null) delete thread.archivedAt
+    else if (Number.isFinite(archivedAt) && archivedAt >= 0) thread.archivedAt = archivedAt
+    else threadFail('BOT_THREAD_INVALID', 'Invalid archive stamp')
+    await rt.save()
+    return { ...thread }
+  }
+
   async function setFlags(id, { pinned, hidden }) {
     const entry = rt.botOf(id) ?? rt.roomOf(id) ?? rt.own(state.agents, id)
     if (entry === undefined) throw new Error('Unknown conversation')
@@ -694,7 +802,7 @@ export function install(rt) {
     const archived = rt.archiveBotMemory(id)
     const current = rt.chatOf(id)
     // Questions and exchange turns are kept per Session, so every part of the chat is cleared.
-    const parts = new Set([id, current, ...(bot.segments ?? []).map(segment => segment.sessionId)])
+    const parts = new Set([id, current, ...(bot.segments ?? []).map(segment => segment.sessionId), ...(bot.threads ?? []).map(thread => thread.sessionId)])
     // `archiving` stands until the archive's path is known: the memory may already be
     // there, and no region of its own closes it yet.
     const closedArchive = bot.private === true ? {
@@ -769,7 +877,8 @@ export function install(rt) {
   }
 
   Object.assign(rt, {
-    ensureWorkspace, keepTeamFolder, createSession, createBot, duplicateBot, updateBot, setFlags,
+    ensureWorkspace, keepTeamFolder, createSession, createBot, duplicateBot, updateBot, updateBotProfile,
+    addThreadSession, renameThread, setThreadArchived, setFlags,
     roomBusy, autoRoomName, retitleRoom, createRoom, updateRoom, deleteRoom,
     setMain, deleteBot, bootstrap, releaseKickoff, greetingOut, holdKickoffAgain, userWrote, userAnswered,
   })

package/modules/bot-runtime/vendor/ds-bot/src/host/store.js

@@ -430,6 +430,8 @@ export function install(rt) {
   const roomOwners = new Map()
   /** @type {Map<string, {botId?:string, roomId?:string}>} */
   const pastOwners = new Map()
+  /** @type {Map<string, string>} */
+  const threadOwners = new Map()
   const chatOf = botId => botOf(botId)?.sessionId ?? botId
   const sessionOfRoom = room => (room === undefined ? undefined : room.sessionId ?? room.id)
   const indexSessions = () => {
@@ -437,9 +439,23 @@ export function install(rt) {
     groupOwners.clear()
     roomOwners.clear()
     pastOwners.clear()
+    threadOwners.clear()
     for (const bot of Object.values(state.bots)) {
       for (const segment of bot.segments ?? []) pastOwners.set(segment.sessionId, { botId: bot.id })
       chatOwners.set(chatOf(bot.id), bot.id)
+      // A live thread Session is another own chat of the same Bot: it speaks
+      // with the Bot's identity, prompt, tools and money, so it sits in
+      // chatOwners beside the Bot's default chat. chatOf() stays the default
+      // chat, which is a different thing from any one thread. An archived
+      // thread keeps its history readable and gains no authority.
+      for (const thread of bot.threads ?? []) {
+        if (thread?.sessionId === undefined) continue
+        if (thread.archivedAt === undefined || thread.archivedAt === null) {
+          if (chatOwners.has(thread.sessionId)) { warn('ds-bot: thread Session %s is owned already; it keeps its first owner', thread.sessionId); continue }
+          chatOwners.set(thread.sessionId, bot.id)
+          threadOwners.set(thread.sessionId, bot.id)
+        } else pastOwners.set(thread.sessionId, { botId: bot.id, threadId: thread.threadId })
+      }
     }
     for (const room of Object.values(state.rooms)) {
       const sessionId = sessionOfRoom(room)
@@ -461,6 +477,22 @@ export function install(rt) {
   const selfOf = id => chatOwners.get(id) ?? groupOwners.get(id)?.botId ?? pastOwners.get(id)?.botId
   // A Session where the Bot speaks now, as opposed to an archived segment.
   const isBotSession = id => chatOwners.has(id) || groupOwners.has(id)
+  // Threads: several independent own chats under one Bot. threadsOf() is the
+  // read-only record list, threadOf() the live owner of one Session, and
+  // sessionsOfBot() every Session that speaks for a Bot.
+  const threadsOf = botId => (botOf(botId)?.threads ?? []).map(thread => ({ ...thread }))
+  const threadOf = sessionId => {
+    if (typeof sessionId !== 'string') return undefined
+    for (const bot of Object.values(state.bots)) {
+      for (const thread of bot.threads ?? []) {
+        if (thread.sessionId !== sessionId) continue
+        return thread.archivedAt === undefined || thread.archivedAt === null ? { botId: bot.id, threadId: thread.threadId } : undefined
+      }
+    }
+    return undefined
+  }
+  const threadSessionOf = (botId, threadId) => threadsOf(botId).find(thread => thread.threadId === threadId)?.sessionId
+  const sessionsOfBot = botId => [...new Set([botId, chatOf(botId), ...(botOf(botId)?.segments ?? []).map(segment => segment.sessionId), ...threadsOf(botId).map(thread => thread.sessionId), ...groupSessionsOf(botId)])]
   const groupSessionsOf = botId => Object.values(state.rooms).map(room => room.sessions?.[botId]).filter(Boolean)
   const dropGroupSession = (room, botId) => {
     if (room.memberDirs !== undefined) delete room.memberDirs[botId]
@@ -506,7 +538,8 @@ export function install(rt) {
   Object.assign(rt, {
     state, load, save, refresh, readOnly, own,
     botOf, roomOf, isMain, chatOf, sessionOfRoom, selfOf, isBotSession,
-    chatOwners, groupOwners, roomOwners, pastOwners,
+    chatOwners, groupOwners, roomOwners, pastOwners, threadOwners,
+    threadsOf, threadOf, threadSessionOf, sessionsOfBot,
     groupSessionsOf, dropGroupSession, retireGroupSession, findBot, findRooms, isAdminOf,
   })
 }

package/modules/bot-runtime/vendor/ds-bot/src/host/usage.js

@@ -304,7 +304,7 @@ export function install(rt) {
     const owners = new Map()
     const botOwner = bot => ({ owner: bot.id, name: bot.name })
     for (const bot of Object.values(state.bots)) {
-      for (const sessionId of [bot.id, rt.chatOf(bot.id), ...(bot.segments ?? []).map(segment => segment.sessionId)]) owners.set(sessionId, botOwner(bot))
+      for (const sessionId of rt.sessionsOfBot(bot.id)) owners.set(sessionId, botOwner(bot))
     }
     for (const room of Object.values(state.rooms)) {
       for (const sessionId of [rt.sessionOfRoom(room), ...(room.parts ?? []).map(segment => segment.sessionId)].filter(Boolean)) owners.set(sessionId, { owner: `room:${room.id}`, name: room.name })

package/modules/independent-runtime/index.mjs

@@ -1,62 +1,152 @@
-import { createRemoteTools } from './remote-tools.mjs'
-/**
- * Mount the independent Bot runtime as this plugin's own path.
- *
- * This plugin does not have to borrow the Harness delivery pipeline: it owns a session store, a
- * loop and a dispatch point, so a turn is just "input in, answer out" through the Host's model
- * service. The provider below turns that service's stream into the small reply shape the loop
- * expects, and the assembly module keeps the two runtimes from ever serving one Bot.
- *
- * Everything is opt-in: without `enabled` the runtime is never constructed, and nothing about the
- * existing Bot integration changes.
- */
-
-import { join } from 'node:path'
-import { createWorkspaceTools } from './workspace-tools.mjs'
-import { createIndependentRuntime } from '../../packages/orchestration/src/bot-runtime-assembly.mjs'
-
-const fail = code => { const error = new Error(code); error.code = code; throw error }
-
-/** Collect one streamed answer into `{ text }`. Tool calls are not inferred from text. */
-export async function collectAnswer(stream) {
-  let text = ''
-  for await (const chunk of stream) {
-    if (typeof chunk === 'string') { text += chunk; continue }
-    if (chunk?.type === 'text' && typeof chunk.text === 'string') { text += chunk.text; continue }
-    if (chunk?.type === 'delta' && typeof chunk.text === 'string') { text += chunk.text }
-  }
-  return { text }
-}
-
-/**
- * @param {{
- *   ctx: { get: (name: string) => unknown, llm?: object, logger?: object },
- *   settings?: { enabled?: boolean, dir?: string, provider?: string, model?: string, maxSteps?: number },
- *   stateDir: string,
- *   integration?: (request: object) => Promise<object>,
- *   now?: () => number,
- * }} options
- */
-export function createPluginRuntime({ ctx, settings = {}, stateDir, integration, now = Date.now } = {}) {
-  if (settings.enabled !== true) return null
-  if (!ctx || typeof ctx.get !== 'function') throw new TypeError('PLUGIN_RUNTIME_REQUIRES_CONTEXT')
-  const llm = ctx.get('llm') ?? ctx.llm
-  if (!llm || typeof llm.stream !== 'function') throw new TypeError('PLUGIN_RUNTIME_REQUIRES_LLM')
-  const provider = settings.provider
-  const model = settings.model
-  if (typeof provider !== 'string' || !provider || typeof model !== 'string' || !model) fail('PLUGIN_RUNTIME_REQUIRES_MODEL')
-
-  const providerFor = () => async ({ messages }) => collectAnswer(llm.stream({ provider, model, messages }))
-  // Tools are per Bot: the Host invoker is bound to this Bot, so one Bot cannot borrow another grant.
-  const toolsFor = botId => typeof settings.remoteInvoke === 'function'
-    ? createRemoteTools({ invoke: (tool, args) => settings.remoteInvoke(botId, tool, args), ...(Array.isArray(settings.remoteTools) ? { names: settings.remoteTools } : {}) })
-    : typeof settings.workspaceRoot === 'string' && settings.workspaceRoot ? createWorkspaceTools({ root: settings.workspaceRoot }) : null
-  return createIndependentRuntime({
-    dir: settings.dir ? String(settings.dir) : join(stateDir, 'independent-runtime'),
-    integration: typeof integration === 'function' ? integration : async () => fail('INDEPENDENT_RUNTIME_NO_INTEGRATION'),
-    providerFor,
-    toolsFor,
-    now,
-    ...(Number.isSafeInteger(settings.maxSteps) ? { maxSteps: settings.maxSteps } : {}),
-  })
-}
+import { createRemoteTools } from './remote-tools.mjs'
+import { INDEPENDENT_TOOL_NAMES, independentToolEntry } from '../../packages/orchestration/src/independent-tool-catalog.mjs'
+/**
+ * Mount the independent Bot runtime as this plugin's own path.
+ *
+ * This plugin does not have to borrow the Harness delivery pipeline: it owns a session store, a
+ * loop and a dispatch point, so a turn is just "input in, answer out" through the Host's model
+ * service. The provider below asks the Host's own trusted execution frame for that answer — the
+ * committed Bot, the model that Bot has saved, the Bot policy and the one money stream — and the
+ * assembly module keeps the two runtimes from ever serving one Bot.
+ *
+ * Everything is opt-in: without `enabled` the runtime is never constructed, and nothing about the
+ * existing Bot integration changes.
+ */
+
+import { join } from 'node:path'
+import { createIndependentRuntime } from '../../packages/orchestration/src/bot-runtime-assembly.mjs'
+import { collectAnswer } from '../../packages/orchestration/src/bot-independent-stream.mjs'
+
+const fail = code => { const error = new Error(code); error.code = code; throw error }
+
+export { collectAnswer }
+
+/**
+ * Where this Bot's runtime switch lives. The path is published even when the independent runtime
+ * is switched off, because a Bot that was moved before it was switched off still has a committed
+ * mode on disk: a Host that cannot read that back has to refuse, not assume integration.
+ */
+export function runtimeSwitchPath({ settings = {}, stateDir } = {}) {
+  if (typeof stateDir !== 'string' || stateDir === '') throw new TypeError('RUNTIME_STATE_DIR_REQUIRED')
+  return settings.dir ? String(settings.dir) : join(stateDir, 'independent-runtime')
+}
+
+/**
+ * @param {{
+ *   ctx: { get: (name: string) => unknown, llm?: object, logger?: object },
+ *   settings?: { enabled?: boolean, dir?: string, maxSteps?: number,
+ *     remoteInvoke?: (botId: string, tool: string, args: object) => Promise<unknown>,
+ *     remoteTools?: string[], toolsFor?: (botId: string) => object | null },
+ *   stateDir: string,
+ *   integration?: (request: object) => Promise<object>,
+ *   serving?: object | null,
+ *   now?: () => number,
+ * }} options
+ */
+export function createPluginRuntime({ ctx, settings = {}, stateDir, integration, serving = null, now = Date.now } = {}) {
+  if (settings.enabled !== true) return null
+  if (!ctx || typeof ctx.get !== 'function') throw new TypeError('PLUGIN_RUNTIME_REQUIRES_CONTEXT')
+  const llm = ctx.get('llm') ?? ctx.llm
+  if (!llm || typeof llm.stream !== 'function') throw new TypeError('PLUGIN_RUNTIME_REQUIRES_LLM')
+  // The Bot product publishes the only frame an independent turn may run in. It is resolved per
+  // call, never captured at construction: the plugin starts the product synchronously and composes
+  // it asynchronously, so `connect` may build this runtime before the frame exists. A turn that
+  // starts before it does is refused — a Host with no committed Bot, no Bot policy and no money
+  // path must not answer from a global provider/model setting.
+  const executionOf = () => {
+    const execution = (() => { try { return ctx.get('botIndependentExecution') ?? null } catch { return null } })()
+    if (!execution || typeof execution.complete !== 'function' || typeof execution.routeFor !== 'function' || typeof execution.assertTurn !== 'function') {
+      throw Object.assign(new Error('宿主尚未发布 Bot 产品的独立执行上下文，本次请求被拒绝。'), { code: 'INDEPENDENT_EXECUTION_UNAVAILABLE', outcome: 'refused' })
+    }
+    return execution
+  }
+  // Per Bot, per step: the route comes from that Bot's own committed record and the call runs in
+  // the Host's frame, so one Bot can neither pick another Bot's model nor answer without policy.
+  // The tool schemas travel with the request: they are the ones the Host just re-decided for this
+  // step, so the model is only ever told about tools this Bot holds right now.
+  const providerFor = botId => async ({ messages, signal, tools, onText, conversationId }) => {
+    const execution = executionOf()
+    return execution.complete({ botId, ...execution.routeFor(botId), messages, signal, ...(conversationId ? { conversationId } : {}), ...(tools ? { tools } : {}), ...(onText ? { onText } : {}) })
+  }
+  // Tools are per Bot and Host-bound. The order is the Host's own, decided per call:
+  //
+  // 1. The Host's published independent tool service (`createIndependentToolHost`), which owns the
+  //    machine directory, the durable Task journal and the per-Bot catalog. This is the only path
+  //    on which a write is a tracked Task.
+  // 2. An explicit per-Bot resolver the Host passes in (`toolsFor`), for a Host that composes its
+  //    own surface.
+  // 3. The Host's own remote invoker, which carries this Bot's subject, live binding, root and a
+  //    fresh task/attempt per call. Without a durable Task backend this path offers the model the
+  //    read-only tools only, and names the rest as unavailable — a Host that cannot track a write
+  //    must not pretend it can.
+  //
+  // A Host that offers none of the three offers nothing, and the loop then says so: no shared
+  // workspace root is handed to every Bot as a stand-in.
+  const hostFor = botId => {
+    const host = (() => { try { return ctx.get('botIndependentToolHost') ?? null } catch { return null } })()
+    if (host && typeof host.forBot === 'function') return host.forBot(botId) ?? null
+    if (typeof settings.toolsFor === 'function') return settings.toolsFor(botId) ?? null
+    if (typeof settings.remoteInvoke === 'function') return legacyToolsFor(botId)
+    return null
+  }
+  // The Host's own remote invoker, in the vocabulary the loop speaks. Reads are offered by their
+  // catalog names; the machine-tool spellings still dispatch, because a Host that wired `remoteInvoke`
+  // already applies its own binding, root and task checks there.
+  const legacyToolsFor = botId => {
+    const inner = createRemoteTools({
+      invoke: (tool, args, context) => settings.remoteInvoke(botId, tool, args, context),
+      ...(Array.isArray(settings.remoteTools) ? { names: settings.remoteTools } : {}),
+    })
+    const granted = new Set(inner.names)
+    const offered = INDEPENDENT_TOOL_NAMES.map(independentToolEntry)
+      .filter(entry => entry && entry.machineTool && entry.backend === null && granted.has(entry.machineTool))
+    const unavailable = INDEPENDENT_TOOL_NAMES.map(independentToolEntry)
+      .filter(entry => entry && (entry.backend !== null || !granted.has(entry.machineTool)))
+      .map(entry => ({ name: entry.name, code: entry.backend ? 'TASK_BACKEND_UNAVAILABLE' : 'MACHINE_TOOL_NOT_GRANTED' }))
+    return {
+      names: offered.map(entry => entry.name),
+      origin: inner.origin,
+      isReadonly: name => offered.some(entry => entry.name === name && entry.effect === 'read'),
+      schemas: () => offered.map(entry => ({ name: entry.name, description: entry.description, parameters: entry.parameters })),
+      unavailable: () => unavailable,
+      async call(name, args = {}, context = {}) {
+        const entry = offered.find(item => item.name === name)
+        return inner.call(entry ? entry.machineTool : name, args, context)
+      },
+    }
+  }
+  const runtime = createIndependentRuntime({
+    dir: runtimeSwitchPath({ settings, stateDir }),
+    integration: typeof integration === 'function' ? integration : async () => fail('INDEPENDENT_RUNTIME_NO_INTEGRATION'),
+    providerFor,
+    toolsFor: hostFor,
+    // The Bot product's own frame re-decides the turn before every transcript write, every
+    // provider step and every tool call, so a move, a deletion, a revocation or an emptied grant
+    // stops the turn at the next checkpoint instead of finishing on a state that no longer stands.
+    assertTurn: botId => executionOf().assertTurn(botId),
+    // Published by the Host composition; a model/owner payload can never select
+    // the callback or turn a stop request into confirmed native-tree retirement.
+    retireConversation: async (botId, details) => {
+      const retirement = (() => { try { return ctx.get('botIndependentConversationRetirement') } catch { return null } })()
+      if (typeof retirement !== 'function') throw Object.assign(new Error('INDEPENDENT_CONTEXT_RETIREMENT_UNAVAILABLE'), { code: 'INDEPENDENT_CONTEXT_RETIREMENT_UNAVAILABLE', outcome: 'refused' })
+      return retirement(botId, details)
+    },
+    now,
+    // The Host's own serving admission: the same lease the integrated stream holds, so a Bot is
+    // never written by both paths and a move sees a turn this path is running.
+    ...(serving ? { serving } : {}),
+    ...(Number.isSafeInteger(settings.maxSteps) ? { maxSteps: settings.maxSteps } : {}),
+  })
+  // A Host that unloads must not leave this runtime's loops behind: a turn that never finishes would
+  // otherwise sit on its lease until the lease expires. The effect is the Host's own disposal seam and
+  // closing twice is a no-op. The Host's tool service is asked to close as well - this runtime is its
+  // only consumer - but a Host that owns its lifecycle may close it first, which is also a no-op.
+  if (typeof ctx.effect === 'function') {
+    ctx.effect(() => async () => {
+      const host = (() => { try { return ctx.get('botIndependentToolHost') ?? null } catch { return null } })()
+      try { host?.close?.() } catch { /* the Host owns its own lifecycle */ }
+      runtime.close()
+    }, 'model-router: independent Bot runtime')
+  }
+  return runtime
+}

package/modules/independent-runtime/remote-tools.mjs

@@ -6,8 +6,9 @@
  * grant, and exposes the same tool names the model-facing path uses. A name outside the allowed set
  * never reaches `invoke`, so a reply cannot invent a tool.
  *
- * `invoke(tool, args)` must already bind machine, root, Bot, task and operation identity. Nothing
- * here passes an endpoint, a path outside the root, or an operation id.
+ * `invoke(tool, args, context)` must already bind machine, root, Bot, task and operation identity,
+ * and it receives the turn's cancel signal so a stop reaches the machine layer. Nothing here passes
+ * an endpoint, a path outside the root, or an operation id.
  */
 
 export const REMOTE_TOOL_NAMES = Object.freeze([
@@ -21,7 +22,7 @@ const fail = (code, message) => { const error = new Error(message ?? code); erro
 export const READ_ONLY_TOOLS = Object.freeze(['machine_ping', 'fs_list', 'fs_read', 'operation_status', 'artifact_stat', 'artifact_read'])
 
 /**
- * @param {{ invoke: (tool: string, args: object) => Promise<unknown>, names?: string[], origin?: string }} options
+ * @param {{ invoke: (tool: string, args: object, context?: { signal?: AbortSignal, botId?: string }) => Promise<unknown>, names?: string[], origin?: string }} options
  */
 export function createRemoteTools({ invoke, names = REMOTE_TOOL_NAMES, machines = [], origin = '远程电脑' } = {}) {
   if (typeof invoke !== 'function') throw new TypeError('REMOTE_TOOLS_REQUIRE_INVOKE')
@@ -37,7 +38,7 @@ export function createRemoteTools({ invoke, names = REMOTE_TOOL_NAMES, machines
     /** Whether a name may run beside another call in the same step. */
     isReadonly: name => allowed.includes(name) && READ_ONLY_TOOLS.includes(name),
     origin,
-    async call(name, args = {}) {
+    async call(name, args = {}, context = {}) {
       if (typeof name !== 'string' || !allowed.includes(name)) fail('TOOL_NOT_GRANTED')
       if (!args || typeof args !== 'object' || Array.isArray(args)) fail('INVALID_TOOL_ARGS')
       if (Object.hasOwn(args, 'machineId') && !machinesAllowed.includes(args.machineId)) fail('MACHINE_NOT_ALLOWED')
@@ -45,7 +46,9 @@ export function createRemoteTools({ invoke, names = REMOTE_TOOL_NAMES, machines
       for (const key of ['rootId', 'botId', 'taskId', 'attemptId', 'operationId', 'endpoint', 'secretRef']) {
         if (Object.hasOwn(args, key)) fail(`TOOL_ARG_FORBIDDEN:${key}`)
       }
-      return invoke(name, args)
+      // The turn's cancel travels with the call, so a stop reaches the machine layer instead of
+      // being discovered only after the whole round finished.
+      return invoke(name, args, { ...(context?.signal ? { signal: context.signal } : {}), ...(context?.botId ? { botId: context.botId } : {}) })
     },
   })
 }

package/modules/openmaus-protocol/NOTICE

@@ -0,0 +1,10 @@
+OpenMausBot protocol components
+Upstream: https://github.com/milind-soni/OpenMausBot
+Pinned commit: 1bc4749aa8307d7d6998bf86de4ef6478460dd93
+Author: Milind Soni and OpenMausBot contributors
+License: Apache License 2.0; see vendor/LICENSE.
+
+The companion end-to-end encryption protocol, descriptor, credentials, yamux
+codec and interoperability vectors are copied without modification. Product
+adapters and their permission policy are separate from the frozen upstream
+files. SOURCE.json records each source path and byte hash.

package/modules/openmaus-protocol/README.md

@@ -0,0 +1,15 @@
+# OpenMausBot 端到端协议
+
+冻结复用 `companion/src/e2e` 的 Noise、凭据派生、设备描述符、yamux、流会话与 Node 客户端。来源、固定提交、完整许可证和每文件 SHA-256 位于 `SOURCE.json`、`NOTICE` 与 `vendor/LICENSE`。
+
+这是全功能迁移的协议底座，导入协议本身不授予任何 Bot、电脑或模型权限。产品适配器负责一次性配对、设备生命周期、Host 授权与原任务身份；不改冻结源文件。`scripts/openmaus-protocol-entry.mjs` 聚合冻结源码，经固定 esbuild 构建为 `dist/protocol.mjs`；生产 `index.mjs` 只导出 JavaScript。Node 不允许在 node_modules 中直接擦除 TypeScript，因此不能把开发目录中直接导入 `.ts` 的成功当作安装后可用。
+
+```sh
+node scripts/sync-openmaus-protocol.mjs --check
+node scripts/sync-openmaus-protocol.mjs --source ../OpenMausBot
+node scripts/build-openmaus-protocol.mjs
+node scripts/build-openmaus-protocol.mjs --check
+node --test tests/pairing-protocol.test.mjs
+```
+
+导入只接受固定提交的可信 checkout；允许 Windows 检出换行差异，写入 vendor 的始终是固定 Git blob 原始字节。更换提交是显式的源升级，不能自动取远端最新版本。

package/modules/openmaus-protocol/SOURCE.json

@@ -0,0 +1,68 @@
+{
+  "schemaVersion": 1,
+  "upstream": "https://github.com/milind-soni/OpenMausBot",
+  "commit": "1bc4749aa8307d7d6998bf86de4ef6478460dd93",
+  "license": "Apache-2.0",
+  "files": [
+    {
+      "source": "companion/src/e2e/credentials.ts",
+      "target": "vendor/companion/src/e2e/credentials.ts",
+      "sha256": "1b576030c9e795eb64f5bee9fdc5918d6cfb92f2481b70259f7636991d6f5f6f",
+      "bytes": 6328
+    },
+    {
+      "source": "companion/src/e2e/noise.ts",
+      "target": "vendor/companion/src/e2e/noise.ts",
+      "sha256": "9269403237b43246142d5dd69bee0269d3b41f81c6bfe95520693320b6469250",
+      "bytes": 15871
+    },
+    {
+      "source": "companion/src/e2e/descriptor.ts",
+      "target": "vendor/companion/src/e2e/descriptor.ts",
+      "sha256": "5a7b39e4571e8b83fd85a3b6141cc09501918326afcc58c6ccb4a61344bbb2c8",
+      "bytes": 4570
+    },
+    {
+      "source": "companion/src/e2e/yamux.ts",
+      "target": "vendor/companion/src/e2e/yamux.ts",
+      "sha256": "1292b278d229d3ed8b92a32aec4137e04329d6fb2497d90ffee6f6d4bef20683",
+      "bytes": 13359
+    },
+    {
+      "source": "companion/src/e2e/session.ts",
+      "target": "vendor/companion/src/e2e/session.ts",
+      "sha256": "1ff7d26fe674ccab9f75026fec15f85bd791f99d75b888eaf24b7be744c4da0e",
+      "bytes": 14336
+    },
+    {
+      "source": "companion/src/e2e/phone.ts",
+      "target": "vendor/companion/src/e2e/phone.ts",
+      "sha256": "9fd5a069eecdea29afe5fb00ea2bfc5d42d8aae448927cd9ce3770a8cd2de5d0",
+      "bytes": 4083
+    },
+    {
+      "source": "companion/src/e2e/vectors/v1.json",
+      "target": "vendor/companion/src/e2e/vectors/v1.json",
+      "sha256": "5471a0070ddbb69dca34dee6da550de4581e8e1a40e22e0f97873d539793bf4e",
+      "bytes": 204553
+    },
+    {
+      "source": "companion/src/e2e/vectors/v1.sha256",
+      "target": "vendor/companion/src/e2e/vectors/v1.sha256",
+      "sha256": "99de21e9eef973a92e651517d88e977a1ef91fb441183648115b8a06b24796ee",
+      "bytes": 74
+    },
+    {
+      "source": "companion/src/e2e/README.md",
+      "target": "vendor/companion/src/e2e/README.md",
+      "sha256": "b752ee693e97c9674a207561be536105a34f90e99eaaead49b1f644f2b69589d",
+      "bytes": 29207
+    },
+    {
+      "source": "LICENSE",
+      "target": "vendor/LICENSE",
+      "sha256": "cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30",
+      "bytes": 11358
+    }
+  ]
+}