@ljwei-stak/dsh-model-route-bot 0.66.3 → 0.67.0

package/packages/orchestration/src/bot-loop.mjs

@@ -9,36 +9,114 @@
  * It is deliberately small and side-effect-free beyond the store: the provider and the tool
  * dispatcher are injected, so a test can drive a whole conversation without a network or a Bot
  * runtime, and the Host decides which tools are reachable.
+ *
+ * Two things are threaded all the way through rather than sampled at the edges:
+ *
+ * - The cancel signal reaches the provider and every tool call, and a tool call is raced against
+ *   it, so a cancel is not discovered only after the whole network or tool round finished. The
+ *   operation still in flight keeps the Host's own durable task/attempt identity; nothing here
+ *   replays it.
+ * - `guard` re-decides the turn from committed state before every transcript write, every provider
+ *   step and every tool call. A Bot that was moved, deleted or revoked mid-turn stops at the next
+ *   checkpoint, and a stop that arrives after the answer was produced writes nothing more.
+ *
+ * Two more things the loop refuses to fake:
+ *
+ * - The tool schemas a request offers come from the Host, re-resolved per step, so a model is never
+ *   told about a tool its Bot no longer holds; and a batch of calls is judged as a whole before the
+ *   first side effect, so a duplicate call id or an oversized batch cannot execute half of itself.
+ * - One turn identity is made per run and handed to every call, which is how a durable Task the
+ *   Host opens stays correlated to this turn instead of to a string a reply invented.
  */
 
+import { createHash, randomUUID } from 'node:crypto'
 import { openBotSessionStore } from './bot-session-store.mjs'
+import { independentMessageWire } from './independent-message-wire.mjs'
 
 export const MAX_STEPS = 12
+/** One provider response may ask for at most this many calls; more is refused as a whole. */
+export const MAX_TOOL_CALLS = 8
+export const botRequestMessageIds = requestId => {
+  if (typeof requestId !== 'string' || !/^[A-Za-z0-9_.:-]{1,160}$/.test(requestId)) throw Object.assign(new Error('BOT_REQUEST_ID_INVALID'), { code: 'BOT_REQUEST_ID_INVALID' })
+  const digest = createHash('sha256').update(requestId).digest('hex')
+  return { user: `request-user-${digest}`, answer: `request-answer-${digest}` }
+}
+export function botRequestReceipt(session, requestId) {
+  const ids = botRequestMessageIds(requestId)
+  const user = session.messages.find(message => message.messageId === ids.user && message.role === 'user')
+  const answer = session.messages.find(message => message.messageId === ids.answer && message.role === 'assistant' && !message.toolCalls)
+  return { hasBrief: Boolean(user), hasConfirmedAnswer: Boolean(user && answer && user.contextId === answer.contextId), answer: user && answer && user.contextId === answer.contextId ? answer.content : null, input: user?.content ?? null }
+}
 
-const fail = code => { const error = new Error(code); error.code = code; throw error }
+const fail = (code, message) => { const error = new Error(message ?? code); error.code = code; throw error }
+const idOk = value => typeof value === 'string' && /^[A-Za-z0-9_.:-]{1,128}$/.test(value)
+const cancelled = signal => {
+  const error = Object.assign(new Error('这一轮已被取消。'), { code: 'BOT_LOOP_CANCELLED' })
+  if (signal.aborted) throw error
+  return new Promise((resolve, reject) => {
+    signal.addEventListener('abort', () => reject(signal.reason ?? error), { once: true })
+  })
+}
 
 /**
  * @param {{
  *   store: ReturnType<typeof openBotSessionStore>,
- *   provider: (request: { botId: string, messages: object[] }) => Promise<{ text?: string, toolCalls?: Array<{ id: string, name: string, args?: object }> }>,
- *   tools?: { call: (name: string, args: object, context: { botId: string }) => Promise<unknown> } | null,
+ *   provider: (request: { botId: string, messages: object[], signal?: AbortSignal, tools?: object[] }) => Promise<{ text?: string, toolCalls?: Array<{ id: string, name: string, args?: object }>, source?: object }>,
+ *   tools?: { call: (name: string, args: object, context: { botId: string, signal?: AbortSignal, turnId: string, callId: string }) => Promise<unknown>, schemas?: () => object[] | null, isReadonly?: (name: string) => boolean } | null,
+ *   guard?: (botId: string) => void,
  *   now?: () => number,
  *   maxSteps?: number,
+ *   newTurnId?: () => string,
  * }} options
  */
-export function createBotLoop({ store, provider, tools = null, now = Date.now, maxSteps = MAX_STEPS } = {}) {
+export function createBotLoop({ store, provider, tools = null, guard = null, now = Date.now, maxSteps = MAX_STEPS, newTurnId = () => `turn-${randomUUID()}` } = {}) {
   if (!store || typeof store.append !== 'function' || typeof store.get !== 'function') throw new TypeError('BOT_LOOP_REQUIRES_STORE')
   if (typeof provider !== 'function') throw new TypeError('BOT_LOOP_REQUIRES_PROVIDER')
   if (tools !== null && typeof tools?.call !== 'function') throw new TypeError('BOT_LOOP_INVALID_TOOLS')
+  if (guard !== null && typeof guard !== 'function') throw new TypeError('BOT_LOOP_INVALID_GUARD')
   if (!Number.isSafeInteger(maxSteps) || maxSteps < 1 || maxSteps > 64) throw new TypeError('INVALID_BOT_LOOP_STEPS')
+  if (typeof newTurnId !== 'function') throw new TypeError('BOT_LOOP_INVALID_TURN_ID')
+
+  /**
+   * The tools this step may see, resolved now.
+   *
+   * The Host decides the surface per step and the loop never keeps one: a grant that changed since
+   * the last step changes what the next request offers, and a tool service that disappeared is
+   * reported as unavailable instead of served from a stale object.
+   */
+  const offeredTools = () => {
+    if (!tools || typeof tools.schemas !== 'function') return null
+    const schemas = tools.schemas()
+    return Array.isArray(schemas) && schemas.length ? schemas : null
+  }
 
-  async function step(botId, signal) {
+  async function step(botId, signal, checkpoint, onText) {
     const session = store.get(botId)
     if (signal?.aborted) fail('BOT_LOOP_CANCELLED')
-    const reply = await provider({ botId, messages: session.messages.map(({ role, content, name }) => ({ role, content, ...(name ? { name } : {}) })) })
+    let reply
+    try {
+      const offered = offeredTools()
+      reply = await provider({ botId, messages: independentMessageWire(session.messages.filter(message =>
+        (message.contextId ?? 'legacy') === (session.contextId ?? 'legacy'))), ...(offered ? { tools: offered } : {}), ...(signal ? { signal } : {}), ...(onText ? { onText } : {}) })
+    } catch (error) {
+      // A provider that stopped because this turn was cancelled is a cancel, not a provider fault.
+      if (signal?.aborted) throw Object.assign(new Error('这一轮已被取消。'), { code: 'BOT_LOOP_CANCELLED', cause: error })
+      throw error
+    }
     if (signal?.aborted) fail('BOT_LOOP_CANCELLED')
     if (!reply || typeof reply !== 'object') fail('BOT_LOOP_PROVIDER_REPLY')
-    const calls = Array.isArray(reply.toolCalls) ? reply.toolCalls.slice(0, 8) : []
+    checkpoint()
+    const calls = Array.isArray(reply.toolCalls) ? reply.toolCalls : []
+    // The whole batch is judged before the first side effect: a duplicate call id or a batch past
+    // the cap is refused as a whole, never by quietly running the first few and dropping the rest.
+    if (calls.length > MAX_TOOL_CALLS) fail('BOT_LOOP_TOOL_CALL_LIMIT', `一次响应最多请求 ${MAX_TOOL_CALLS} 个工具调用。`)
+    const seen = new Set()
+    for (const call of calls) {
+      if (!call || typeof call !== 'object' || !idOk(call.id)) fail('BOT_LOOP_TOOL_CALL_INVALID')
+      if (typeof call.name !== 'string' || !call.name) fail('BOT_LOOP_TOOL_CALL_INVALID')
+      if (seen.has(call.id)) fail('BOT_LOOP_TOOL_CALL_DUPLICATE', `同一次响应里重复了工具调用编号 ${call.id}。`)
+      seen.add(call.id)
+    }
     return { reply, calls }
   }
 
@@ -47,35 +125,90 @@ export function createBotLoop({ store, provider, tools = null, now = Date.now, m
      * Run one turn: user input in, answer or tool call out. The whole turn is bounded.
      * @param {{ botId: string, input: string, signal?: AbortSignal }} request
      */
-    async run({ botId, input, signal } = {}) {
+    async run({ botId, input, signal, onProgress, requestId, conversationId } = {}) {
       if (typeof input !== 'string' || input.trim() === '') fail('BOT_LOOP_INPUT_REQUIRED')
-      store.append(botId, [{ role: 'user', content: input }])
+      if (onProgress !== undefined && typeof onProgress !== 'function') fail('BOT_LOOP_PROGRESS_INVALID')
+      // Committed state is re-read before anything is written, so a Bot that no longer stands
+      // leaves no user message behind either.
+      const checkpoint = () => {
+        if (signal?.aborted) fail('BOT_LOOP_CANCELLED')
+        if (guard) guard(botId)
+      }
+      checkpoint()
+      const ids = requestId === undefined ? null : botRequestMessageIds(requestId)
+      if (ids) {
+        const receipt = botRequestReceipt(store.get(botId), requestId)
+        if (receipt.hasBrief) {
+          if (receipt.input !== input) fail('BOT_REQUEST_CONFLICT')
+          if (receipt.hasConfirmedAnswer) return { botId, answer: receipt.answer, steps: 0, toolCalls: [], turns: store.get(botId).turns, replayed: true }
+          fail('BOT_REQUEST_OUTCOME_UNKNOWN')
+        }
+      }
+      store.append(botId, [{ role: 'user', content: input, ...(ids ? { messageId: ids.user } : {}) }])
       const executed = []
+      // One Host turn identity for the whole run, made here and kept for every step: a durable Task
+      // the Host opens for a call is correlated to this turn, and a repeated call re-reads the same
+      // task instead of opening a second one.
+      const turnId = newTurnId()
       for (let index = 0; index < maxSteps; index += 1) {
-        const { reply, calls } = await step(botId, signal)
+        checkpoint()
+        const progress = onProgress ? async text => { checkpoint(); await onProgress({ step: index + 1, text }) } : undefined
+        if (progress) await progress('')
+        const { reply, calls } = await step(botId, signal, checkpoint, progress)
         const text = typeof reply.text === 'string' ? reply.text : ''
         if (calls.length === 0) {
-          const session = store.append(botId, [{ role: 'assistant', content: text }], { turn: true })
+          checkpoint()
+          // The answer keeps the route that produced it under the transcript's own field name, so a
+          // store that persists it (and the projection that reads it) can carry provenance on.
+          const session = store.append(botId, [{ role: 'assistant', content: text, ...(ids ? { messageId: ids.answer } : {}), ...(reply.source ? { modelSource: reply.source } : {}) }], { turn: true })
           return { botId, answer: text, steps: index + 1, toolCalls: executed, turns: session.turns }
         }
-        store.append(botId, [
-          { role: 'assistant', content: text },
-          ...calls.map(call => ({ role: 'assistant', content: '', name: call.name, toolCall: { id: call.id, name: call.name, args: call.args ?? {} } })),
-        ])
+        // The intermediate response is about to become a recorded tool batch.
+        // Remove its transient preview first so polling cannot show it twice
+        // while a long-running tool is still pending.
+        if (progress) await progress('')
+        checkpoint()
+        // One provider response owns the whole call batch. Preserve every id and
+        // its producing route so the next request can replay one assistant message.
+        const toolCalls = calls.map(call => ({ id: call.id, name: call.name, args: call.args ?? {} }))
+        store.append(botId, [{ role: 'assistant', content: text, toolCalls,
+          ...(reply.source ? { modelSource: reply.source } : {}),
+          // Retained for older transcript readers that show the first call.
+          name: toolCalls[0].name, toolCall: toolCalls[0] }])
         if (!tools) fail('BOT_LOOP_TOOLS_UNAVAILABLE')
         for (const call of calls) if (typeof call?.name !== 'string' || !call.name) fail('BOT_LOOP_TOOL_CALL_INVALID')
         // Read-only calls may run together; a mutating call keeps the batch sequential so the
         // transcript order still matches the order the provider asked for.
         const concurrent = calls.length > 1 && typeof tools.isReadonly === 'function' && calls.every(call => tools.isReadonly(call.name))
+        // The call is raced against the cancel: the loop stops waiting, the transcript keeps what
+        // actually happened, and the operation still in flight is reconciled by the Host that owns
+        // its durable identity — never replayed from here.
+        const invoke = call => {
+          const pending = tools.call(call.name, call.args ?? {}, { botId, ...(signal ? { signal } : {}), ...(conversationId ? { conversationId } : {}), turnId, callId: call.id })
+          if (!signal) return pending
+          pending.catch(() => {})
+          const stop = cancelled(signal)
+          stop.catch(() => {})
+          return Promise.race([pending, stop]).catch(error => {
+            // A cancel that arrived while the tool was running is a cancel, not a tool failure.
+            if (!signal.aborted) throw error
+            throw Object.assign(new Error('这一轮已被取消。'), { code: 'BOT_LOOP_CANCELLED', cause: error })
+          })
+        }
         let results
-        if (concurrent) results = await Promise.all(calls.map(call => tools.call(call.name, call.args ?? {}, { botId })))
+        if (concurrent) results = await Promise.all(calls.map(invoke))
         else {
           results = []
-          for (const call of calls) results.push(await tools.call(call.name, call.args ?? {}, { botId }))
+          for (const call of calls) results.push(await invoke(call))
         }
-        for (const [index, call] of calls.entries()) {
+        checkpoint()
+        for (const [at, call] of calls.entries()) {
           executed.push({ id: call.id, name: call.name })
-          store.append(botId, [{ role: 'tool', name: call.name, content: JSON.stringify(results[index] ?? null) }])
+          // The result answers that call, so the transcript keeps the call id beside it: the next
+          // turn correlates the two the way the Host does.
+          const value = results[at]
+          const isError = value?.error && typeof value.error === 'object' && !Array.isArray(value.error) && typeof value.error.code === 'string' && typeof value.error.message === 'string'
+          store.append(botId, [{ role: 'tool', name: call.name, toolCallId: call.id, toolCall: { id: call.id }, content: JSON.stringify(value ?? null), ...(isError ? { isError: true } : {}) }])
         }
       }
       fail('BOT_LOOP_STEP_LIMIT')

package/packages/orchestration/src/bot-notifications.mjs

@@ -0,0 +1,159 @@
+// A durable, read-only notification feed derived from committed Task-journal
+// events. It is a second READ of the journal, never a second execution
+// authority: nothing here starts, stops, retries or approves a Task, and no
+// notification text is taken from a model's own words or from task input —
+// every line is composed from structured journal state (outcome, category, Bot
+// name) plus the durable identity needed to open the original detail.
+//
+// Read state lives in this Host's own SQLite under a single owner scope. It is
+// keyed by the journal's monotonic event `seq`, so the same event can never
+// become two notifications, and an owner's read position never trusts a client
+// clock: the browser may only confirm event ids it was actually shown, or ask
+// to mark everything read (the Host computes that watermark itself).
+
+// State transitions a person should hear about. Transient requests (a bare
+// `cancel-requested`) are deliberately absent: a stop request is not a stop
+// confirmation, so it must not read as a finished outcome.
+export const NOTIFY_KINDS = Object.freeze([
+  'settled', 'blocked', 'dependency-blocked', 'deadline', 'budget-wait-expired',
+  'interrupted', 'admission-conflict', 'retry-fenced', 'reconciled',
+  'cancelled-before-dispatch', 'cancelled-while-waiting-budget', 'admission-recovered-cancelled',
+])
+
+const SCOPE = 'owner'
+const UNREAD_CAP = 512
+
+// One structured category per outcome, with a tone the panel can colour without
+// parsing any text. `reconcile` is the one that must never read as "stopped".
+const categorize = (kind, outcome) => {
+  if (kind === 'reconciled') return { category: 'reconciled', tone: 'ok' }
+  if (kind === 'settled') {
+    if (outcome === 'succeeded') return { category: 'succeeded', tone: 'ok' }
+    if (outcome === 'cancelled') return { category: 'cancelled', tone: 'idle' }
+    if (outcome === 'waiting-budget') return { category: 'waiting-budget', tone: 'wait' }
+    if (outcome === 'needs-reconciliation') return { category: 'reconcile', tone: 'urgent' }
+    return { category: 'failed', tone: 'bad' }
+  }
+  if (kind === 'blocked' || kind === 'dependency-blocked') return { category: 'blocked', tone: 'wait' }
+  if (kind === 'deadline' || kind === 'budget-wait-expired') return { category: 'failed', tone: 'bad' }
+  if (kind === 'interrupted' || kind === 'admission-conflict' || kind === 'retry-fenced') return { category: 'reconcile', tone: 'urgent' }
+  if (kind === 'cancelled-before-dispatch' || kind === 'cancelled-while-waiting-budget' || kind === 'admission-recovered-cancelled') return { category: 'cancelled', tone: 'idle' }
+  return { category: 'update', tone: 'idle' }
+}
+
+const line = (category, botName) => {
+  switch (category) {
+    case 'succeeded': return `${botName} 的任务已完成`
+    case 'failed': return `${botName} 的任务失败`
+    case 'blocked': return `${botName} 的任务受阻，等待处理`
+    case 'reconcile': return `${botName} 的执行需要核对收据：结果未知，不会自动重试`
+    case 'waiting-budget': return `${botName} 的任务等待预算`
+    case 'cancelled': return `${botName} 的任务已取消`
+    case 'reconciled': return `${botName} 的收据已核对`
+    default: return `${botName} 的任务有更新`
+  }
+}
+
+export function createBotNotifications({ Database, file, journal, botIds, botNames, kinds = NOTIFY_KINDS, limit = 50 }) {
+  if (typeof journal?.notificationEvents !== 'function') throw new TypeError('BOT_NOTIFICATIONS_JOURNAL_REQUIRED')
+  if (typeof Database !== 'function') throw new TypeError('BOT_NOTIFICATIONS_DATABASE_REQUIRED')
+  const wanted = [...new Set((Array.isArray(kinds) ? kinds : NOTIFY_KINDS).filter(kind => typeof kind === 'string'))]
+  if (!wanted.length) throw new TypeError('BOT_NOTIFICATIONS_KINDS_REQUIRED')
+  const pageSize = Number.isSafeInteger(limit) && limit >= 1 && limit <= 200 ? limit : 50
+
+  const db = new Database(file)
+  const prior = db.pragma('busy_timeout', { simple: true })
+  try {
+    db.pragma('busy_timeout = 5000')
+    try { db.pragma('journal_mode = WAL') } catch { /* a read-position store does not require WAL */ }
+    db.pragma('synchronous = FULL')
+    db.exec(`
+      CREATE TABLE IF NOT EXISTS bot_notification_state(scope TEXT PRIMARY KEY, cursor_seq INTEGER NOT NULL, baseline_seq INTEGER NOT NULL);
+      CREATE TABLE IF NOT EXISTS bot_notification_reads(seq INTEGER PRIMARY KEY);
+    `)
+  } catch (error) { db.pragma(`busy_timeout=${prior}`); db.close(); throw error }
+
+  let closed = false
+  const run = sql => { if (closed) throw Object.assign(new Error('BOT_NOTIFICATIONS_CLOSED'), { code: 'BOT_NOTIFICATIONS_CLOSED' }); return db.prepare(sql) }
+  const ownerIds = () => {
+    const value = typeof botIds === 'function' ? botIds() : botIds
+    return [...new Set((Array.isArray(value) ? value : []).filter(id => typeof id === 'string' && id.length > 0))]
+  }
+  const names = () => {
+    const value = typeof botNames === 'function' ? botNames() : botNames
+    return value && typeof value === 'object' ? value : {}
+  }
+
+  // The read watermark is fixed on first use and never advances on its own: a
+  // restart, a second window or a late response cannot silently mark the future
+  // read. Everything at or below it is treated as already-seen history. The
+  // parent arms it once, right after the Bot directory has loaded, so "history"
+  // is exactly what existed at boot and everything after is new.
+  const ensureState = () => {
+    const existing = run('SELECT scope,cursor_seq,baseline_seq FROM bot_notification_state WHERE scope=?').get(SCOPE)
+    if (existing) return existing
+    const { maxSeq } = journal.notificationEvents(ownerIds(), wanted, { limit: 1 })
+    run('INSERT OR IGNORE INTO bot_notification_state(scope,cursor_seq,baseline_seq) VALUES(?,?,?)').run(SCOPE, maxSeq, maxSeq)
+    return run('SELECT scope,cursor_seq,baseline_seq FROM bot_notification_state WHERE scope=?').get(SCOPE)
+  }
+  const readSeqs = () => new Set(run('SELECT seq FROM bot_notification_reads').all().map(row => row.seq))
+  const countUnread = (state, reads) => {
+    const feed = journal.notificationEvents(ownerIds(), wanted, { after: state.cursor_seq, limit: UNREAD_CAP })
+    let unread = 0
+    for (const item of feed.items) if (!reads.has(item.seq)) unread++
+    return { unread, truncated: feed.items.length >= UNREAD_CAP, maxSeq: feed.maxSeq }
+  }
+  const decorate = (item, state, reads, names) => {
+    const { category, tone } = categorize(item.kind, item.outcome)
+    const botName = names[item.ownerBotId] ?? item.ownerBotId
+    return {
+      seq: item.seq, kind: item.kind, category, tone, at: item.at,
+      botId: item.ownerBotId, botName, taskId: item.taskId, attemptId: item.attemptId,
+      outcome: item.outcome, code: item.code,
+      read: item.seq <= state.cursor_seq || reads.has(item.seq), isNew: item.seq > state.baseline_seq,
+      text: line(category, botName),
+    }
+  }
+
+  return Object.freeze({
+    kinds: wanted,
+    readModel() {
+      const state = ensureState(), reads = readSeqs()
+      const { unread, truncated, maxSeq } = countUnread(state, reads)
+      return { schemaVersion: 1, status: 'available', unreadCount: unread, maxSeq, cursorSeq: state.cursor_seq, baselineSeq: state.baseline_seq, truncated }
+    },
+    list({ before = null, limit: size = pageSize } = {}) {
+      const state = ensureState(), reads = readSeqs(), botNames = names()
+      const cap = Number.isSafeInteger(size) && size >= 1 && size <= 200 ? size : pageSize
+      const { items, maxSeq } = journal.notificationEvents(ownerIds(), wanted, { before, limit: cap })
+      const { unread, truncated } = countUnread(state, reads)
+      return {
+        schemaVersion: 1, items: items.map(item => decorate(item, state, reads, botNames)),
+        nextBefore: items.length === cap ? items[items.length - 1].seq : null,
+        maxSeq, cursorSeq: state.cursor_seq, baselineSeq: state.baseline_seq, unreadCount: unread, truncated,
+      }
+    },
+    // The browser may only confirm an event id it was shown: an unknown, future
+    // or foreign seq is refused instead of silently widening the read set.
+    read(seq) {
+      if (!Number.isSafeInteger(seq) || seq < 1) throw Object.assign(new Error('INVALID_NOTIFICATION_SEQ'), { code: 'INVALID_NOTIFICATION_SEQ' })
+      const state = ensureState()
+      const probe = journal.notificationEvents(ownerIds(), wanted, { after: seq - 1, before: seq + 1, limit: 1 })
+      if (!probe.items.some(item => item.seq === seq)) throw Object.assign(new Error('NOTIFICATION_NOT_FOUND'), { code: 'NOTIFICATION_NOT_FOUND' })
+      if (seq > state.cursor_seq) run('INSERT OR IGNORE INTO bot_notification_reads(seq) VALUES(?)').run(seq)
+      return this.readModel()
+    },
+    // Mark everything the Host currently shows as read. The watermark is the
+    // Host's own max seq, so a later or reordered event is never swallowed.
+    markAll() {
+      const state = ensureState()
+      const { maxSeq } = journal.notificationEvents(ownerIds(), wanted, { limit: 1 })
+      if (maxSeq > state.cursor_seq) {
+        run('UPDATE bot_notification_state SET cursor_seq=? WHERE scope=?').run(maxSeq, SCOPE)
+        run('DELETE FROM bot_notification_reads WHERE seq<=?').run(maxSeq)
+      }
+      return this.readModel()
+    },
+    close() { if (!closed) { closed = true; try { db.pragma(`busy_timeout=${prior}`) } catch {}; db.close() } },
+  })
+}

package/packages/orchestration/src/bot-policy.mjs

@@ -30,7 +30,7 @@ export function createBotPolicy({ authority, directory, machineId, workspaceId,
     replaceOwnerGrant(grant) { authority.replaceGrant(owner,grant) },
     activeIdentity() {
       const frame=current.getStore()
-      return frame?{subject:frame.subject,botId:authority.describe(frame.subject).botId,owner:frame.owner}:null
+      return frame?{subject:frame.subject,botId:authority.describe(frame.subject).botId,owner:frame.owner,independent:frame.independent===true,...(frame.conversationId?{conversationId:frame.conversationId}:{}),...(frame.workThread?{workThread:frame.workThread}:{})}:null
     },
     bindFinancialRun(binding) {
       const frame=current.getStore()
@@ -56,6 +56,45 @@ export function createBotPolicy({ authority, directory, machineId, workspaceId,
       authority.assertTool(subject, 'task/execute')
       return current.run({ subject, owner: false, signal }, operation)
     },
+    /**
+     * A model turn's own frame.
+     *
+     * A text turn is not a Task: `executionContext` asserts `task/execute`, so a session that only
+     * talks to a model would have to forge a Task to look like one. This frame carries the subject
+     * the Host resolved from committed state — never anything a request carries — plus the turn's
+     * signal, so `modelIdentity` and `modelStream` inside it re-decide the route and re-read the
+     * cancel on every chunk. `botId` is an optional cross-check: a caller that names one Bot and
+     * resolves another is refused instead of silently answered for the wrong Bot.
+     */
+    modelContext(subject, signal, operation, { botId = null, conversationId = null, workThread = null } = {}) {
+      const who = authority.describe(subject)
+      if (botId !== null && who.botId !== botId) throw new PolicyError('SUBJECT_MISMATCH')
+      // A frame that already speaks for another subject cannot be re-pointed at this one: a nested
+      // call must not change whose turn it is.
+      const active = current.getStore()
+      if (active && !active.owner && active.subject !== subject) throw new PolicyError('SUBJECT_MISMATCH')
+      // An admitted financial run stays attached when it belongs to the same subject, so a nested
+      // model call bills the run it is inside instead of opening a second one.
+      const financial = active && active.subject === subject ? active.financial : undefined
+      const signals = [...new Set([active?.signal, signal].filter(Boolean))]
+      const combined = signals.length > 1 ? AbortSignal.any(signals) : signals[0]
+      combined?.throwIfAborted()
+      // Optional trusted Host metadata for a delegated work-thread turn: the per-work-thread
+      // conversationId the composition surfaces as the native identity, and a small workThread
+      // descriptor. Both are Host facts the dispatch boundary supplies; a model can never set
+      // them, and they confer no authority — the subject above is still the only identity.
+      const conversation = typeof conversationId === 'string' && /^[-A-Za-z0-9_.]{1,128}$/.test(conversationId) ? conversationId : null
+      const thread = workThread && typeof workThread === 'object' && !Array.isArray(workThread) ? workThread : null
+      return current.run({ subject, owner: false, independent: true, signal: combined, ...(financial ? { financial } : {}), ...(conversation ? { conversationId: conversation } : {}), ...(thread ? { workThread: thread } : {}) }, operation)
+    },
+    /**
+     * Run an operation OUTSIDE the current model-turn frame. The team dispatch and resume
+     * boundaries use this so a target turn (or a resumed sender turn) never inherits the
+     * calling Bot's async subject or funding: the target re-derives its own subject from
+     * committed state inside its own frame. The hard guarantee remains the target's own
+     * SUBJECT_MISMATCH guard; this is the explicit boundary on top of it.
+     */
+    runDetached(operation) { return current.exit(operation) },
     async run(call, operation) {
       const who = check(call)
       const binding = { taskId: `legacy-${randomUUID()}`, attemptId: 'attempt-1', machineId, workspaceId, location: 'local' }
@@ -79,12 +118,12 @@ export function createBotPolicy({ authority, directory, machineId, workspaceId,
       // If both metadata forms exist they must agree; a nested call cannot select another Bot.
       if (active && options.sessionId && directory.forSession(options.sessionId) !== subject) throw new PolicyError('SUBJECT_MISMATCH')
       authority.assertModel(subject, options.provider, options.model)
-      const signal = active?.signal ? AbortSignal.any([options.signal, active.signal]) : options.signal
+      const signal = active?.signal ? AbortSignal.any([options.signal, active.signal].filter(Boolean)) : options.signal
       return (async function* () {
-        signal.throwIfAborted()
+        signal?.throwIfAborted()
         authority.assertModel(subject, options.provider, options.model)
         for await (const chunk of next()) {
-          signal.throwIfAborted()
+          signal?.throwIfAborted()
           authority.assertModel(subject, options.provider, options.model)
           yield chunk
         }

package/packages/orchestration/src/bot-profile.mjs

@@ -0,0 +1,171 @@
+/**
+ * Bot identity and personality: the owner's own view of what a committed Bot
+ * actually persists.
+ *
+ * The frozen DS roster stores a Bot's name, its one-line role and its standing
+ * instructions, and nothing else about who it is. There is no soul file, no
+ * reply-style enum and no separate personality column behind this Host, so this
+ * service writes exactly those three fields — and only through the Host's
+ * trusted `runtime.updateBotProfile` seam. Instructions are text the system
+ * prompt reads every turn; they are not a grant, so this service never touches a
+ * model, a thinking level, a permission preset, browser grants, a working
+ * directory or an avatar, and it never chooses a Bot, a credential or an
+ * executable path from its arguments.
+ *
+ * Two Host facts shape the design:
+ *
+ *   1. The native `updateBot` answers a role or instructions change with an
+ *      `update` notice delivered into the Bot's own chat, and a delivered notice
+ *      opens a turn: an owner edit would start an unsolicited model turn. The
+ *      seam is the Host's own answer to that — it mutates once and emits no
+ *      notice — so this service never wraps, patches or re-routes `deliver`, and
+ *      never impersonates a Bot actor to reuse the native self-edit exception.
+ *      A Host without the seam refuses the save with BOT_PROFILE_SEAM_UNAVAILABLE
+ *      instead of falling back to global interception.
+ *   2. `updateBot` awaits several times before its final save, so a revision
+ *      read before those awaits fences nothing. The fence therefore lives inside
+ *      the seam: it compares `base` against the live Bot and runs this service's
+ *      `check` at the same synchronous boundary, immediately before the one
+ *      multi-field mutation. The revision read here is an early exit only; the
+ *      commit guarantee is the seam's, and it is reported as such.
+ */
+
+export const BOT_PROFILE_SCHEMA = 1
+export const BOT_PROFILE_LIMITS = Object.freeze({ name: 40, role: 24, instructions: 4000 })
+const FIELDS = Object.freeze(['name', 'role', 'instructions'])
+const EVERYONE = Object.freeze(['all', 'everyone', '所有人', '全体'])
+const STANDS_FOR_USER = Object.freeze(['user', 'you'])
+
+const plain = value => value && typeof value === 'object' && !Array.isArray(value) && [Object.prototype, null].includes(Object.getPrototypeOf(value))
+const fail = (code, message, details = {}) => { throw Object.assign(new Error(message), { code, details }) }
+const keys = (value, allowed, path) => {
+  if (!plain(value) || Object.keys(value).some(key => !allowed.includes(key))) fail('BOT_PROFILE_INVALID', `${path} 含有未知字段或格式无效。`, { field: path })
+}
+const text = (value, limit, path) => {
+  if (typeof value !== 'string') fail('BOT_PROFILE_INVALID', `${path} 必须是文本。`, { field: path })
+  const next = value.trim()
+  if (next.length > limit) fail('BOT_PROFILE_LIMIT', `${path} 不能超过 ${limit} 个字符。`, { field: path })
+  return next
+}
+const owner = context => { if (context?.kind !== 'owner') fail('REMOTE_OWNER_REQUIRED', '请使用已认证的宿主拥有者账号修改 Bot 身份。') }
+
+/** What the frozen roster accepts as a name; the same rule its own create flow applies. */
+export function botProfileNameProblem(name) {
+  const text = String(name ?? '').trim()
+  if (text === '') return 'Bot 需要一个名称。'
+  if (/[@`\r\n]/.test(text)) return '名称不能包含 @、` 或换行。'
+  if (EVERYONE.includes(text.toLowerCase())) return `"${text}" 在群聊里等于@所有人，不能作为 Bot 名称。`
+  if (STANDS_FOR_USER.includes(text.toLowerCase())) return `"${text}" 在聊天里代表用户自己，不能作为 Bot 名称。`
+  return undefined
+}
+
+const viewOf = bot => ({ id: bot.id, name: bot.name ?? '', role: bot.role ?? '', instructions: bot.instructions ?? '' })
+const fieldOf = (bot, field) => (field === 'name' ? bot.name ?? '' : field === 'role' ? bot.role ?? '' : bot.instructions ?? '')
+
+const lifecycleOf = lifecycle => {
+  if (!lifecycle || typeof lifecycle.committedBot !== 'function' || typeof lifecycle.status !== 'function') fail('BOT_PROFILE_LIFECYCLE_UNAVAILABLE', '宿主未提供已提交生命周期，无法确认 Bot 身份。')
+  return lifecycle
+}
+const committedBot = (lifecycle, botId) => {
+  const bot = lifecycle.committedBot(botId)
+  if (!bot) fail('BOT_PROFILE_UNKNOWN_BOT', '这个 Bot 不在已提交的宿主目录中。', { botId })
+  return bot
+}
+const revisionOf = lifecycle => {
+  const revision = lifecycle.status()?.revision
+  return Number.isSafeInteger(revision) && revision >= 0 ? revision : null
+}
+
+/** A bounded owner read: the committed Bot's persistable identity, and nothing else. */
+export async function inspectProductBotProfile({ runtime, lifecycle, signal }, payload) {
+  keys(payload, ['botId'], 'botProfile.inspect')
+  if (typeof payload.botId !== 'string' || payload.botId === '') fail('BOT_PROFILE_INVALID', '请选择当前团队中的 Bot。', { field: 'botId' })
+  signal?.throwIfAborted()
+  await runtime.load()
+  signal?.throwIfAborted()
+  const host = lifecycleOf(lifecycle)
+  const bot = committedBot(host, payload.botId)
+  return { schemaVersion: BOT_PROFILE_SCHEMA, bot: viewOf(bot), revision: revisionOf(host), limits: BOT_PROFILE_LIMITS, availableActions: ['botProfile.save'] }
+}
+
+/**
+ * One atomic owner save of the identity fields. `base` carries the values the
+ * editor read; when the committed revision moved since then, every field this
+ * save changes must still hold its base value, so an edit made in another window
+ * is refused instead of overwritten while an unrelated save (another Bot, a held
+ * greeting) never blocks this one.
+ *
+ * The commit itself is the Host seam's: it compares `base` against the live Bot
+ * and runs `check` at the same synchronous boundary, immediately before one
+ * multi-field mutation that persists once and emits no notice. Nothing is
+ * written until the whole patch passes, and the committed record is read back
+ * before success is reported.
+ */
+export async function saveProductBotProfile({ runtime, lifecycle, signal }, payload, context) {
+  owner(context)
+  keys(payload, ['botId', 'expectedRevision', 'base', 'profile'], 'botProfile.save')
+  if (typeof payload.botId !== 'string' || payload.botId === '') fail('BOT_PROFILE_INVALID', '请选择当前团队中的 Bot。', { field: 'botId' })
+  if (!Number.isSafeInteger(payload.expectedRevision) || payload.expectedRevision < 0) fail('BOT_PROFILE_INVALID', 'expectedRevision 必须是宿主已提交状态的修订号。', { field: 'expectedRevision' })
+  keys(payload.base, FIELDS, 'base')
+  for (const field of FIELDS) if (typeof payload.base[field] !== 'string') fail('BOT_PROFILE_INVALID', `base.${field} 必须是读取时保存的文本。`, { field: `base.${field}` })
+  keys(payload.profile, FIELDS, 'profile')
+  if (Object.keys(payload.profile).length === 0) fail('BOT_PROFILE_INVALID', '没有要保存的身份字段。', { field: 'profile' })
+  const wanted = {}
+  for (const field of FIELDS) {
+    if (payload.profile[field] === undefined) continue
+    wanted[field] = text(payload.profile[field], BOT_PROFILE_LIMITS[field], field)
+  }
+  signal?.throwIfAborted()
+  const host = lifecycleOf(lifecycle)
+  const before = committedBot(host, payload.botId)
+  const revision = revisionOf(host)
+  // An early exit, not the fence: the seam re-checks against the live Bot.
+  if (payload.expectedRevision !== revision) {
+    for (const field of FIELDS) {
+      if (wanted[field] === undefined) continue
+      const current = fieldOf(before, field)
+      if (current !== payload.base[field]) fail('BOT_PROFILE_CONFLICT', '这个 Bot 的身份在别处已更新，请重新读取后再保存。', { field, current, base: payload.base[field], revision })
+    }
+  }
+  if (wanted.name !== undefined) {
+    const problem = botProfileNameProblem(wanted.name)
+    if (problem !== undefined) fail('BOT_PROFILE_NAME_INVALID', problem, { field: 'name' })
+    const taken = host.committedBots().some(bot => bot.id !== payload.botId && String(bot.name ?? '').trim().toLowerCase() === wanted.name.toLowerCase())
+    if (taken) fail('BOT_PROFILE_NAME_TAKEN', `名称 ${wanted.name} 已被其他 Bot 占用。`, { field: 'name' })
+  }
+  const patch = {}
+  for (const field of FIELDS) if (wanted[field] !== undefined && wanted[field] !== fieldOf(before, field)) patch[field] = wanted[field]
+  if (Object.keys(patch).length === 0) {
+    return { schemaVersion: BOT_PROFILE_SCHEMA, botId: payload.botId, bot: viewOf(before), revision, saved: [] }
+  }
+  const seam = runtime.updateBotProfile
+  if (typeof seam !== 'function') {
+    fail('BOT_PROFILE_SEAM_UNAVAILABLE', '这个宿主还没有 updateBotProfile 接线，身份保存已被拒绝，没有写入任何内容。请升级到提供该接线的 Host。', { required: 'runtime.updateBotProfile' })
+  }
+  signal?.throwIfAborted()
+  // Runs inside the seam, on the live Bot, immediately before its single
+  // mutation: fresh committed ownership, the caller's signal, and the live base.
+  const check = bot => {
+    signal?.throwIfAborted()
+    const committed = lifecycle.committedBot(payload.botId)
+    if (!committed || committed.id !== bot?.id) fail('BOT_PROFILE_UNKNOWN_BOT', '这个 Bot 在提交前已不在已提交的宿主目录中。', { botId: payload.botId })
+    for (const field of FIELDS) {
+      if (patch[field] === undefined) continue
+      const live = fieldOf(bot, field)
+      if (live !== payload.base[field]) fail('BOT_PROFILE_CONFLICT', '这个 Bot 的身份在别处已更新，请重新读取后再保存。', { field, current: live, base: payload.base[field] })
+    }
+    return true
+  }
+  await seam.call(runtime, payload.botId, patch, { base: payload.base, check })
+  // Read the committed record, not the live one: only the committed bytes are
+  // what the next turn will actually read.
+  let after = committedBot(host, payload.botId)
+  const unconfirmed = FIELDS.filter(field => patch[field] !== undefined && fieldOf(after, field) !== patch[field])
+  if (unconfirmed.length > 0 && typeof host.refreshGrants === 'function') {
+    await host.refreshGrants()
+    after = committedBot(host, payload.botId)
+  }
+  const missing = FIELDS.filter(field => patch[field] !== undefined && fieldOf(after, field) !== patch[field])
+  if (missing.length > 0) fail('BOT_PROFILE_UNCONFIRMED', '宿主尚未确认这次身份保存，请重新读取后核对。', { fields: missing, patch })
+  return { schemaVersion: BOT_PROFILE_SCHEMA, botId: payload.botId, bot: viewOf(after), revision: revisionOf(host), saved: Object.keys(patch) }
+}