@ljwei-stak/model-router-galgame 0.4.12 → 0.4.14

package/.dsh-plugin/client.js

@@ -61740,7 +61740,7 @@ var gal_scene_default = { version: 1, settings: { stageW: 1920, stageH: 1080, sh
 var name = "gal-view";
 var PROJECT_URL = "https://github.com/ljwei-stak/deepseek-harness";
 var RELEASES_URL = `${PROJECT_URL}/releases`;
-var PLUGIN_VERSION = "0.4.12";
+var PLUGIN_VERSION = "0.4.14";
 function createUpdateApi() {
   const bridge = globalThis.deepSeekHarnessDesktop;
   const openExternal = (url) => {

package/.dsh-plugin/index.mjs

@@ -15,6 +15,17 @@ import {
   modLensUpstream,
   routeThroughModLens,
 } from './shared/modlens-routing.mjs'
+import {
+  approvalGateStatus,
+  approvalSafetyContext,
+  decorateApprovalReason,
+  isApprovalGateReason,
+} from './shared/approval-gate.mjs'
+import {
+  webCapabilityForPlan,
+  webCapabilityStatus,
+  webInstruction,
+} from './shared/web-routing.mjs'
 
 let settingsRuntimePromise
 let routerSettings = { ...DEFAULT_ROUTER_SETTINGS }
@@ -213,6 +224,17 @@ function stageMessage(plan, step) {
   }
 }
 
+function webMessage(plan) {
+  const text = webInstruction(plan?.web)
+  if (text === '') return null
+  return {
+    id: newMessageId(),
+    role: 'user',
+    content: [{ type: 'text', text }],
+    source: { kind: 'plugin', plugin: name, form: 'web-capability', summary: '联网与可见浏览器策略' },
+  }
+}
+
 /**
  * Persona is a final-answer context only. It is intentionally a separate
  * message so the collaboration stages and their audit records remain free of
@@ -268,6 +290,7 @@ function analysisMessage(plan) {
     `缓存计费比例：读取 ${Math.round(Number(plan.optimization?.cacheReadRatio ?? 0) * 100)}%，写入 ${Math.round(Number(plan.optimization?.cacheWriteRatio ?? 0) * 100)}%（未填写时按普通输入计费）`,
     Number(plan.optimization?.budgetUsd ?? 0) > 0 ? `预算上限：$${Number(plan.optimization.budgetUsd).toFixed(6)}；${plan.optimization.budgetExceeded ? '仍超预算，已在质量下限内尽量压缩' : '满足预算约束'}` : '',
     `LiveBench：${plan.optimization?.liveBench?.fetchedAt ? `快照于 ${new Date(Number(plan.optimization.liveBench.fetchedAt)).toISOString()}${plan.optimization.liveBench.stale ? '（本次刷新失败，沿用上次快照）' : ''}` : '未完成联网核验，使用实验基线'}`,
+    plan.web?.needsWeb ? `联网策略：${plan.web.directBrowser ? 'Ego Browser 可见窗口优先' : 'ModSearch 搜索/抓取，失败时 Ego Browser 窗口兜底'}；反爬处理：人工接管后继续` : '',
     String(plan.reason ?? ''),
   ].filter(Boolean).join('\n')
   return {
@@ -432,6 +455,27 @@ export function apply(ctx) {
     routerSettingsPromise = registerRouterSettings(ctx)
   }
   const scheduleOpenCodeRepair = createOpenCodeRepairScheduler(ctx)
+
+  // dsh-approval-gate owns the actual decision. The router adds auditable
+  // stage/route context before that waterfall so multi-task escalations are
+  // visible to the gate's Flash classifier and human reviewer. The request
+  // object is borrowed by the Host approval service for this dispatch only.
+  ctx.on('approval/request', (request, next) => {
+    if (!isApprovalGateReason(request?.reason)) return next()
+    const state = request?.agent === undefined ? null : stateFor(request.agent)
+    const context = approvalSafetyContext(state, state?.lastStep)
+    const decorated = decorateApprovalReason(request.reason, context)
+    if (decorated !== request.reason) {
+      try {
+        request.reason = decorated
+      } catch {
+        // Some hosts freeze event payloads. In that case the gate still
+        // receives the original reason and remains fully fail-safe.
+      }
+    }
+    return next()
+  }, { prepend: true })
+
   ctx.commands.register({
     name: 'router',
     description: 'switch Model Router mode or inspect the latest routing plan',
@@ -440,7 +484,7 @@ export function apply(ctx) {
     // the whole composer submission; the GAL client sends this command
     // without image bytes so the attachment remains available for the next
     // user turn.
-    input: { hint: 'mode collective|single | plan', images: true },
+    input: { hint: 'mode collective|single | plan | safety', images: true },
     recordInput: true,
     handler: ({ agent, rawInput }) => {
       const state = stateFor(agent)
@@ -458,7 +502,13 @@ export function apply(ctx) {
       if (value === 'plan' || value === '') {
         return { kind: 'success', text: state.plan === null ? '还没有可展示的路由方案。' : JSON.stringify(state.plan) }
       }
-      return { kind: 'error', text: '用法：/router mode collective、/router mode single 或 /router plan' }
+      if (value === 'safety' || value === 'approval') {
+        return { kind: 'success', text: JSON.stringify({ ...approvalGateStatus(ctx), context: approvalSafetyContext(state, state.lastStep) }) }
+      }
+      if (value === 'web' || value === 'network') {
+        return { kind: 'success', text: JSON.stringify({ ...webCapabilityStatus(ctx), context: webCapabilityForPlan(state.taskText, state.plan) }) }
+      }
+      return { kind: 'error', text: '用法：/router mode collective、/router mode single、/router plan、/router safety 或 /router web' }
     },
   })
 
@@ -515,7 +565,7 @@ export function apply(ctx) {
       await routerSettingsPromise
       state.taskText = inputText(messages)
       const liveBench = await liveBenchFor(ctx, state)
-      state.plan = buildPlan({
+      const plan = buildPlan({
         text: state.taskText,
         available,
         mode: state.mode,
@@ -526,6 +576,16 @@ export function apply(ctx) {
         cacheReadRatio: routerSettings.cacheReadRatio,
         cacheWriteRatio: routerSettings.cacheWriteRatio,
       })
+      state.plan = {
+        ...plan,
+        web: webCapabilityForPlan(state.taskText, plan),
+        safety: {
+          ...approvalGateStatus(ctx),
+          ...approvalSafetyContext({ ...state, plan }, Number(step)),
+          hardCategories: ['deletion', 'credential', 'remote', 'system', 'bulk'],
+          failSafe: true,
+        },
+      }
       state.collaboration = shouldCollaborate(state.plan, available)
         ? { lastStep: 0, queuedStep: null }
         : null
@@ -538,11 +598,13 @@ export function apply(ctx) {
     const currentStep = Number.isFinite(Number(step)) ? Number(step) : state.lastStep + 1
     const stageContext = stageMessage(state.plan, currentStep)
     const analysisContext = currentStep === 1 ? analysisMessage(state.plan) : null
+    const webContext = currentStep === 1 ? webMessage(state.plan) : null
     const hasPersona = proposed.messages.some(message => message?.content?.some(block => isPersonaPrompt(block?.text)))
     if (hasPersona) state.personaInjected = true
     const personaContext = state.personaInjected ? null : personaMessage(state, agent, currentStep)
     const additions = []
     if (analysisContext !== null && !hasStageMarker(proposed.messages, currentStep)) additions.push(analysisContext)
+    if (webContext !== null && !proposed.messages.some(message => message?.content?.some(block => block?.text === webContext.content[0].text))) additions.push(webContext)
     if (personaContext !== null) {
       additions.push(personaContext)
       state.personaInjected = true

package/.dsh-plugin/shared/approval-gate.mjs

@@ -0,0 +1,108 @@
+/**
+ * Compatibility bridge for dsh-approval-gate.
+ *
+ * The approval-gate package owns the approval waterfall, Flash judgement,
+ * learning, audit files, snapshots and UI. This module only produces a small,
+ * deterministic safety context for the current Model Router work package.
+ * Keeping the bridge stateless makes it safe when the gate is installed by
+ * another profile layer as well as when it is bundled by this plugin.
+ */
+
+export const APPROVAL_GATE_PACKAGE = 'dsh-approval-gate'
+export const APPROVAL_GATE_VERSION = '0.5.0'
+
+const ESCALATION_RE = /escalate\s+sandbox\s+to\s+([^\s:]+):?\s*([\s\S]*)/i
+
+function clean(value, max = 240) {
+  return String(value ?? '').replace(/[\r\n]+/g, ' ').trim().slice(0, max)
+}
+
+function stageFor(state, step) {
+  const plan = state?.plan
+  const tasks = Array.isArray(plan?.subtasks) ? plan.subtasks : []
+  if (tasks.length === 0) return null
+  const index = Math.max(0, Number(step || state?.lastStep || 1) - 1)
+  return tasks[index] ?? tasks[tasks.length - 1] ?? null
+}
+
+/**
+ * Return the router safety facts that are relevant to an approval request.
+ * `bulk` is a candidate supplied as context; dsh-approval-gate still performs
+ * the authoritative category decision and fail-safe human handoff.
+ */
+export function approvalSafetyContext(state, step) {
+  const plan = state?.plan
+  const tasks = Array.isArray(plan?.subtasks) ? plan.subtasks : []
+  const stage = stageFor(state, step)
+  const collective = state?.mode === 'collective'
+  const multiTask = collective && plan?.complexity?.band === 'complex' && tasks.length >= 3
+  return {
+    mode: state?.mode ?? 'collective',
+    complexity: plan?.complexity?.band ?? 'unknown',
+    stage: stage?.id ?? null,
+    stagePurpose: stage?.purpose ?? null,
+    stageType: stage?.type ?? null,
+    stageIndex: tasks.length === 0 ? 0 : Math.max(1, Number(step || state?.lastStep || 1)),
+    stageCount: tasks.length,
+    multiTask,
+    candidateCategory: multiTask ? 'bulk' : 'neutral',
+    selectedRoute: plan?.selected?.provider && plan?.selected?.model
+      ? `${plan.selected.provider}/${plan.selected.model}`
+      : null,
+    activeRoute: state?.lastTarget?.provider && state?.lastTarget?.model
+      ? `${state.lastTarget.provider}/${state.lastTarget.model}`
+      : null,
+  }
+}
+
+/**
+ * Decorate the justification consumed by dsh-approval-gate. The original
+ * escalation prefix remains intact, so the target plugin can parse it. The
+ * marker is deliberately plain text because the target plugin's Flash model
+ * judges only the justification string.
+ */
+export function decorateApprovalReason(reason, context) {
+  const raw = String(reason ?? '')
+  const match = raw.match(ESCALATION_RE)
+  if (!match || context === null || context === undefined) return raw
+  const mode = clean(match[1], 64)
+  const justification = clean(match[2], 500)
+  const stage = context.stage ? `${context.stage} ${context.stageIndex}/${context.stageCount}` : 'unknown'
+  const route = context.activeRoute || context.selectedRoute || 'unassigned'
+  const marker = [
+    '[model-router safety context]',
+    `mode=${context.mode}`,
+    `complexity=${context.complexity}`,
+    `stage=${stage}`,
+    `purpose=${context.stagePurpose || 'unknown'}`,
+    `route=${route}`,
+    `task_count=${context.stageCount || 0}`,
+    `risk_candidate=${context.candidateCategory}`,
+    context.multiTask ? 'multi_task_review=required' : 'multi_task_review=not_applicable',
+  ].join('; ')
+  return `escalate sandbox to ${mode}: ${justification || 'router stage requires sandbox escalation'} ${marker}`.trim()
+}
+
+export function isApprovalGateReason(reason) {
+  return ESCALATION_RE.test(String(reason ?? ''))
+}
+
+export function approvalGateStatus(ctx) {
+  let approval = false
+  let permissionPresets = false
+  try {
+    approval = Boolean(ctx?.get?.('approval'))
+    permissionPresets = Boolean(ctx?.get?.('permissionPresets'))
+  } catch {
+    approval = false
+    permissionPresets = false
+  }
+  return {
+    package: APPROVAL_GATE_PACKAGE,
+    version: APPROVAL_GATE_VERSION,
+    bundled: true,
+    approvalServiceDetected: approval,
+    permissionPresetsDetected: permissionPresets,
+    policy: 'hard-risk-human-review',
+  }
+}

package/.dsh-plugin/shared/web-routing.mjs

@@ -0,0 +1,90 @@
+/**
+ * Web capability selection for the bundled ModSearch + Ego Browser pair.
+ *
+ * ModSearch owns search/fetch engines and SSRF protection. Ego Browser owns
+ * the real visible browser, login state, screenshots, and human-check handoff.
+ * This module only classifies intent and creates an auditable instruction for
+ * the model; it never fetches an untrusted URL itself.
+ */
+
+export const MODSEARCH_PACKAGE = '@liustack/modsearch'
+export const MODSEARCH_VERSION = '5.10.1'
+export const EGO_BROWSER_PACKAGE = 'dsh-ego-browser'
+export const EGO_BROWSER_VERSION = '0.8.0'
+
+const WEB_RE = /https?:\/\/|www\.|联网|上网|网页|网站|搜索|查找|资料|文献|新闻|最新|实时|网页内容|页面|来源|引用|网络|x\s*帖子|twitter|推特|github|反爬|验证码|登录|人机验证/i
+const BROWSER_RE = /反爬|验证码|人机验证|cloudflare|turnstile|recaptcha|hcaptcha|登录|需要点击|动态页面|网页窗口|浏览器|可见窗口|手动验证|页面交互/i
+
+function text(value, max = 12000) {
+  return String(value ?? '').slice(-max)
+}
+
+export function classifyWebIntent(input) {
+  const value = text(input)
+  const needsWeb = WEB_RE.test(value)
+  const directBrowser = BROWSER_RE.test(value)
+  return {
+    needsWeb,
+    directBrowser,
+    antiBotFallback: needsWeb,
+    primary: needsWeb ? 'modsearch' : 'native-model',
+    fallback: needsWeb ? 'ego-browser' : null,
+    reason: directBrowser
+      ? '用户明确要求动态网页、登录态或反爬页面，优先使用可见 Ego Browser。'
+      : needsWeb
+        ? '先使用 ModSearch 搜索/抓取；失败、内容不完整或触发人机验证时切换 Ego Browser。'
+        : '',
+  }
+}
+
+export function webCapabilityForPlan(input, plan = null) {
+  const intent = classifyWebIntent(input)
+  const tasks = Array.isArray(plan?.subtasks) ? plan.subtasks : []
+  return {
+    ...intent,
+    taskCount: tasks.length,
+    stageAware: tasks.length > 1,
+    packages: {
+      search: MODSEARCH_PACKAGE,
+      browser: EGO_BROWSER_PACKAGE,
+    },
+    versions: {
+      search: MODSEARCH_VERSION,
+      browser: EGO_BROWSER_VERSION,
+    },
+    humanCheckPolicy: 'pause-and-handoff',
+  }
+}
+
+export function webCapabilityStatus(ctx) {
+  let web = false
+  let tools = false
+  try {
+    web = Boolean(ctx?.get?.('web'))
+    tools = Boolean(ctx?.get?.('tools'))
+  } catch {
+    web = false
+    tools = false
+  }
+  return {
+    modsearch: { package: MODSEARCH_PACKAGE, version: MODSEARCH_VERSION, bundled: true, webServiceDetected: web },
+    egoBrowser: { package: EGO_BROWSER_PACKAGE, version: EGO_BROWSER_VERSION, bundled: true, toolServiceDetected: tools },
+    antiBotWindow: 'ego_space_open -> ego_navigate -> ego_page_info/ego_captcha -> ego_snapshot/ego_screenshot',
+    humanCheck: 'pause-and-handoff',
+  }
+}
+
+export function webInstruction(capability) {
+  if (!capability?.needsWeb) return ''
+  const browserFirst = capability.directBrowser
+  return [
+    '[联网与可见浏览器适配]',
+    browserFirst
+      ? '本任务涉及动态网页、登录态或反爬页面：优先使用 Ego Browser 的真实可见窗口。'
+      : '普通联网先使用 ModSearch 提供的 web_search/read_page；需要 X 内容时使用 x_search。',
+    '如果搜索或抓取返回 unavailable、内容不完整、JS 页面空白或 warnings，切换 Ego Browser：先 ego_space_open，再 ego_navigate；随后调用 ego_page_info 或 ego_captcha 检查 humanCheck。',
+    '页面可读时使用 ego_snapshot、ego_read_element、ego_screenshot 或 ego_http(browser) 提取证据；必须交互时使用 ego_click、ego_fill、ego_wait*。',
+    '检测到验证码、Cloudflare、Turnstile、登录或其他 humanCheck=true 时，暂停当前工作包，提示用户在 Agent 浏览器观察窗完成验证；用户确认后再继续。不要绕过验证码或伪造验证结果。',
+    '联网证据必须保留 URL、页面状态和不确定性说明；批量抓取仍遵守审批门控。',
+  ].join('\n')
+}

package/README.md

@@ -15,6 +15,8 @@ This plugin installs on an original DeepSeek Harness checkout. It adds a cost-aw
 - **GAL view** turns each new conversation into an archive. Every line retains its actual provider/model, so the nameplate, color, and portrait follow the active model. ERNIE, Wenxin, and Baidu provider/model identifiers consistently select `ERNIE娘` and `ernie1.png`. The route explanation is an auditable summary, not private model chain-of-thought.
 - **Markdown/KaTeX** reuses Harness `MarkdownText` for headings, lists, tables, quotes, code, links, and formulas. Wide content scrolls inside the dialogue box; player input remains plain text.
 - **Attachments and multimodality** use the native image pipeline and extract Markdown/TXT/JSON/code as text. PDF/DOCX and other binary files keep an explicit parsing state rather than silently inventing content.
+- **Multi-task safety approval adapter** bundles `dsh-approval-gate@0.5.0`. Every sandbox escalation in a complex collective task carries the work package, stage, route, and task-count context; multi-task work is marked as a `bulk` risk candidate for Flash classification, hard-risk human review, learning, audit, and snapshots. Single-session mode is never forcibly rerouted.
+- **Web search and anti-bot browsing** bundle `@liustack/modsearch@5.10.1` and `dsh-ego-browser@0.8.0`. ModSearch handles `web_search`, `read_page`, and `x_search`; Ego Browser opens a real Chrome/Edge window for JavaScript pages, login state, screenshots, and human verification. Search failures and anti-bot pages are routed to the visible browser flow.
 - **OpenCode Zen compatibility** repairs official website overrides to the catalog-owned `/zen` and `/zen/v1` endpoints while leaving custom gateways untouched.
 - **Release updates and desktop support** provide release checks and a one-click updater. When the desktop is outdated it updates the full client and bundled plugin; otherwise it updates only the plugin. Browser-only installs open Releases because they cannot write local files.
 
@@ -29,7 +31,7 @@ This plugin installs on an original DeepSeek Harness checkout. It adds a cost-aw
 
 ### Recommended: install the published npm package
 
-The package is public and already includes the official `@liustack/modlens@3.25.4` bundle. You do not need to install Docker, Python, a ModLens server, or a second ModLens package.
+The package is public and already includes the official `@liustack/modlens@3.25.4`, `dsh-approval-gate@0.5.0`, `@liustack/modsearch@5.10.1`, and the registry package `dsh-ego-browser@0.8.0` plus its runtime peers (`@deepseek-ai/dsh-tools@0.1.0-rc.8`, `schemastery@3.18.0`). You do not need to clone the Ego Browser GitHub repository or install these dependencies separately.
 
 1. Open PowerShell in the DSH Desktop checkout:
 
@@ -75,7 +77,7 @@ pnpm dsh plugin --profile web add --registry=https://registry.npmjs.org "@ljwei-
 4. Verify that the router and its ModLens dependency are present:
 
 ```powershell
-pnpm dsh --profile web --dump-config | Select-String "model-router-galgame|modlens"
+pnpm dsh --profile web --dump-config | Select-String "model-router-galgame|modlens|dsh-approval-gate|modsearch|ego-browser"
 ```
 
 The output should contain:
@@ -83,6 +85,9 @@ The output should contain:
 ```text
 @ljwei-stak/model-router-galgame
 @liustack/modlens
+dsh-approval-gate
+@liustack/modsearch
+dsh-ego-browser
 ```
 
 Do not add `@liustack/modlens` separately after installing this package. The
@@ -95,6 +100,23 @@ pnpm dsh plugin --profile web remove @liustack/modlens
 pnpm dsh plugin --profile web add "@ljwei-stak/model-router-galgame@$routerVersion"
 ```
 
+Do not add `dsh-approval-gate` separately to the same profile. If it was previously installed as a standalone entry, remove it before reinstalling the router to avoid a duplicate loader:
+
+```powershell
+pnpm dsh plugin --profile web remove dsh-approval-gate
+pnpm dsh plugin --profile web add "@ljwei-stak/model-router-galgame@$routerVersion"
+```
+
+Do not add `@liustack/modsearch` or `dsh-ego-browser` separately either. If either
+was installed before the router, remove the standalone entries and reinstall the
+router once so each loader is registered exactly once:
+
+```powershell
+pnpm dsh plugin --profile web remove @liustack/modsearch
+pnpm dsh plugin --profile web remove dsh-ego-browser
+pnpm dsh plugin --profile web add "@ljwei-stak/model-router-galgame@$routerVersion"
+```
+
 5. Stop any already-running DSH process, then start the selected profile:
 
 ```powershell
@@ -112,7 +134,7 @@ the old process has released its profile lock:
 pnpm dsh web --no-open --port 3081
 ```
 
-### Verify ModLens
+### Verify bundled capabilities
 
 Run the diagnostic from the installed Web profile (the command is forwarded to
 the profile's installed binary):
@@ -123,6 +145,15 @@ pnpm dsh plugin --profile web exec modlens doctor
 
 Configure the vision provider in the DSH settings page or in `C:\Users\<your-user>\.modlens\config.json`. Then create a conversation, upload an image, and ask the model to transcribe or explain it. Text-only models appear with a `(modlens vision)` entry when a compatible upstream route is available.
 
+For ordinary web questions, ask for current sources or use the native `web_search`
+tool; the bundle routes it through ModSearch. For a JavaScript, login, Cloudflare,
+Turnstile, or other anti-bot page, the router provides the Ego Browser sequence:
+`ego_space_open` -> `ego_navigate` -> `ego_page_info`/`ego_captcha` ->
+`ego_snapshot`/`ego_screenshot`. When `humanCheck=true`, the current work package
+pauses and the user completes the check in the Agent Browser observation window.
+The router never fabricates a successful verification. Use `/router web` to inspect
+the bundled versions and whether the Host services are detected.
+
 ### Update
 
 To install the newest version visible on npm:
@@ -133,10 +164,10 @@ pnpm dsh plugin --profile web add "@ljwei-stak/model-router-galgame@$routerVersi
 ```
 
 For a reproducible deployment, replace `$routerVersion` with a concrete version
-that you have verified with `npm view` (for example `0.4.12`):
+that you have verified with `npm view` (for example `0.4.14`):
 
 ```powershell
-pnpm dsh plugin --profile web add @ljwei-stak/model-router-galgame@0.4.12
+pnpm dsh plugin --profile web add @ljwei-stak/model-router-galgame@0.4.14
 ```
 
 You can also ask pnpm to update an already-installed package within its declared
@@ -159,10 +190,11 @@ cd F:\DeepSeek_harness\DSH-Desktop
 pnpm dsh plugin --profile web remove @liustack/modlens
 $routerVersion = npm view @ljwei-stak/model-router-galgame version --registry=https://registry.npmjs.org/
 pnpm dsh plugin --profile web add "@ljwei-stak/model-router-galgame@$routerVersion"
-pnpm dsh --profile web --dump-config | Select-String "model-router-galgame|modlens"
+pnpm dsh --profile web --dump-config | Select-String "model-router-galgame|modlens|dsh-approval-gate|modsearch|ego-browser"
 ```
 
-The dump should show one `modlens` row and one `model-router-galgame` row. If the
+The dump should show one row for each of `modlens`, `dsh-approval-gate`, `modsearch`,
+`ego-browser`, and `model-router-galgame`. If the
 error is `EADDRINUSE` on port 3080, or `task-board ledger is already owned by
 process ...`, an old DSH process is still running; close that process before
 starting another instance, or choose another port:
@@ -199,35 +231,331 @@ If no model is available, native model selection remains intact and the conversa
 - `/router mode collective`
 - `/router mode single`
 - `/router plan`
+- `/router safety`: show the approval adapter version, current stage, task count, active route, and risk candidate.
+- `/router web`: show ModSearch/Ego Browser versions, service detection, and the current web strategy.
 
 `collective` is the default. The plugin exposes task labels, scores, assignments, costs, and fallback records; it never exposes private model chain-of-thought.
 
+### Approval and multi-task safety
+
+The bundle loads `dsh-approval-gate` together with the router. To enable its learning-based auto-approval mode, select the target plugin's `auto-approve` permission preset in the profile; the default `ask` policy continues to use the native Harness approval UI. The router does not decide approval outcomes. It only adds safety context before `approval/request` enters the waterfall:
+
+- Complex collective tasks with at least three work packages carry `risk_candidate=bulk`, and each stage is audited separately.
+- Deletion, credential, remote, system, and bulk risks remain human-only in `dsh-approval-gate`.
+- Flash timeout, errors, unparseable output, or failed similarity checks fail safe to a human review.
+- Single-session mode keeps the native model and approval behavior.
+
+Audit, learning, and snapshots use the target project's directory: `%DSH_HOME%\auto-approve\` (or `%USERPROFILE%\.dsh\auto-approve\` when `DSH_HOME` is unset), including `events.jsonl`, `audit.log`, `allowlist.json`, `learning.json`, and `snapshots\`. Run `/router safety` to inspect the bridge state.
+
+### Web and anti-bot pages
+
+ModSearch supplies ordinary web search and page reading, including source URLs and
+fetch warnings. Pages that require login state, JavaScript rendering, or a visible
+human check use Ego Browser. The model should open a browser space, navigate to the
+URL, inspect `ego_page_info` or `ego_captcha`, and then collect evidence with
+`ego_snapshot`, `ego_read_element`, `ego_screenshot`, or `ego_http(browser)`. Use
+`ego_click`, `ego_fill`, and `ego_wait*` only when interaction is required. A
+`humanCheck=true` result pauses the current work package until the user completes
+the check in the Agent Browser window. Captcha and Cloudflare checks are never
+bypassed or represented as successful without user confirmation.
+
 ## Mathematical routing model
 
-For a request `x`, the router derives a task type `t`, complexity band `c`, work-package set `I`, and candidate set `M`. Quality comes from a LiveBench task-category score (then overall, then the experimental baseline); prices come from user overrides or the baseline catalog.
+This section describes the implementation in the form of the research framework in
+`RESEARCH_PAPER_FRAMEWORK.md`. The production router and the offline experiment
+plugin share the same objective, quality floors, cost model, and fallback semantics.
+The production implementation adds Pareto pruning and bounded global search so that
+the result is not merely a sequence of unrelated local choices.
+
+### 1. Problem definition
+
+For a request `x`, the router constructs:
+
+```text
+t       task type: general, code, math, research, writing, summarization, vision
+c       complexity band: simple, balanced, or complex
+I       ordered work-package set
+M       discovered provider/model routes
+F(i)    quality floor for work package i
+B       optional per-request budget in USD
+```
+
+The assignment is $\pi: I \to M$. The primary objective is to maximize multi-objective
+utility while satisfying quality constraints. When a budget is configured, it is a
+hard secondary constraint:
+
+$$
+\begin{aligned}
+\text{maximize}\quad & \sum_{i \in I} U(i,\pi(i)) \\
+\text{subject to}\quad & Q(i,\pi(i)) \ge F(i), && \forall i \in I \\
+& \sum_{i \in I} \mathrm{Cost}(i,\pi(i)) \le B
+\end{aligned}
+$$
+
+If no model satisfies a particular floor, the router chooses the highest-quality
+available fallback and records `constraintRelaxed: true`; it never silently claims
+that an unavailable constraint was satisfied.
+
+### 2. Request analysis and work-package construction
+
+Task classification is signal based and deterministic. The classifier counts explicit
+markers for code, mathematics, research, writing, summarization, and vision, then
+uses the strongest signal as the primary type while retaining all detected types for
+complex-task decomposition.
+
+Complexity is a bounded score assembled from text length, list/requirement density,
+domain markers, code/reasoning markers, and vision markers. The bands are:
 
-For work package `i` and model `m`:
+$$
+\begin{aligned}
+\text{simple:}\quad & 0.00 \le \mathrm{complexity} < 0.34 \\
+\text{balanced:}\quad & 0.34 \le \mathrm{complexity} < 0.66 \\
+\text{complex:}\quad & 0.66 \le \mathrm{complexity} \le 1.00
+\end{aligned}
+$$
+
+Simple and balanced requests use one execution package. A complex request is expanded
+into a small DAG-like sequence:
 
 ```text
-U(i,m) = wq(c) Q(i,m) + wc(c) C(m) + wl(c) (1 - L(m))
-         + ws(c) S(i,m) - wr(c) R(m)
-         - lambda * 1[m is already used]
-         - kappa * max(0, F(i) - Q(i,m))
+analysis -> domain execution packages -> optional verification -> synthesis
 ```
 
-`F(i)` is the quality floor. Candidates satisfying `Q(i,m) >= F(i)` form the feasible set. A budget `B` is a secondary hard constraint: if the first utility assignment exceeds `B`, lower-criticality stages are replaced by the cheapest feasible candidates until the budget is met or no valid replacement remains. Synthesis prefers DeepSeek V4 Pro and falls back deterministically when unavailable.
+Every package has an id, type, purpose, criticality, quality floor, and `dependsOn`
+list. The default floors are `0.75`, `0.78`, and `0.82` for simple, balanced, and
+complex work. A complex synthesis package has a minimum floor of `0.84`; critical
+non-synthesis packages receive a small additional floor based on criticality.
+
+### 3. Model quality, specialty, cost, and risk
+
+For route `m` and task type `t`, quality is resolved in this order:
+
+$$
+Q(m,t)=
+\begin{cases}
+\text{LiveBench category score}, & \text{when available};\\
+\text{LiveBench overall score}, & \text{otherwise};\\
+\text{catalog quality baseline}, & \text{otherwise}
+\end{cases}
+$$
+
+Specialty `S(m,t)` is `1.0` for an explicit catalog specialty, `0.58` for a general
+task, and a deterministic partial match for related domains. Risk `R(m)` and latency
+`L(m)` are normalized catalog values; user pricing overrides only affect cost.
+
+With input/output prices in USD per one million tokens, cache-aware cost is:
+
+$$
+\mathrm{Cost}(i,m)=
+\frac{(n_{in}-n_{cache\_read}-n_{cache\_write})p_{in}
+      +n_{cache\_read}p_{cache\_read}
+      +n_{cache\_write}p_{cache\_write}
+      +n_{out}p_{out}}{10^6}
+$$
+
+The cache ratios are clamped to `[0,1]` and write ratio cannot overlap the read ratio.
+If no cache ratio is configured, ordinary input pricing is used.
+
+### 4. Multi-objective utility
+
+The implementation uses the normalized cost score
+$C_{\mathrm{norm}}=1-p_{\mathrm{effective}}/p_{\max}$, so a lower price receives a
+larger utility contribution. For a
+work package `i` and candidate `m`:
+
+$$
+\begin{aligned}
+U(i,m)={}&w_q(c)Q(i,m)+w_c(c)C_{\mathrm{norm}}(m)+w_l(c)(1-L(m))\\
+&+w_s(c)S(i,m)-w_r(c)R(m)\\
+&-\lambda\,\mathbb{1}[m\text{ already used}]
+-\kappa\max(0,F(i)-Q(i,m))\\
+&+\mathrm{synthesis\_bonus}(i,m)
+\end{aligned}
+$$
+
+The default weight vectors are:
+
+| Complexity | Quality | Cost | Latency | Specialty | Risk |
+|---|---:|---:|---:|---:|---:|
+| simple | 0.30 | 0.50 | 0.14 | 0.04 | 0.02 |
+| balanced | 0.45 | 0.30 | 0.10 | 0.10 | 0.05 |
+| complex | 0.55 | 0.16 | 0.06 | 0.16 | 0.07 |
+
+For synthesis, the quality-oriented vector is `0.70/0.10/0.04/0.10/0.06`, and
+DeepSeek V4 Pro receives a small deterministic preference bonus when present. The
+bonus is soft: if that route is unavailable, the normal feasible ranking remains in
+force. Reusing a route costs `0.08` utility; changing routes across a dependency
+boundary costs `0.015` in the global assignment search.
+
+### 5. Production algorithm: Pareto-pruned constrained beam assignment
+
+The current Host router is a bounded global solver with five stages.
+
+#### 5.1 Candidate discovery and quality filtering
+
+For each work package, routes below its quality floor are removed when at least one
+qualified route exists. If none exists, at most the three highest-quality routes are
+retained and the package is marked as relaxed. This makes constraint failure visible
+and bounds the work on large model catalogs.
+
+#### 5.2 Pareto pruning
+
+Candidate `a` dominates candidate `b` for the same package when it is no worse in all
+five dimensions and strictly better in at least one:
+
+$$
+Q(a)\ge Q(b),\quad \mathrm{Cost}(a)\le\mathrm{Cost}(b),\quad L(a)\le L(b),\quad
+S(a)\ge S(b),\quad R(a)\le R(b)
+$$
+
+Dominated candidates cannot improve quality, cost, latency, specialty, or risk. The
+router keeps the Pareto frontier plus three anchors: the cheapest candidate, the
+highest-utility candidate, and the highest-quality candidate. The per-package pool is
+limited to 12 routes.
+
+#### 5.3 Dependency-aware beam search
+
+Each beam state stores the partial assignment, route selected for every completed
+package, total cost, utility, number of dependency handoffs, and accumulated quality
+shortfall. States are expanded in package order. A child receives the candidate
+utility minus `0.015` for every dependency edge that crosses to a different route.
+The beam width is 256. Ties are resolved by quality shortfall, utility, cost,
+handoffs, and finally lexical provider/model order, making repeated plans stable.
+
+The search first minimizes constraint violations, then quality shortfall, and then
+maximizes utility. With a budget, suffix minimum-cost bounds prune partial states that
+cannot possibly fit the remaining budget.
+
+#### 5.4 Budget strategy
+
+The router evaluates three plans:
+
+1. an unconstrained utility plan;
+2. a utility plan that must fit `B`;
+3. when (2) is infeasible, a minimum-cost plan that still preserves every available
+   quality floor.
 
-The algorithm is wired into the Host request path: `index.mjs` calls `buildPlan` in collective mode and executes the planned stages; single-session mode preserves the explicitly selected model instead of applying the collective override. `router.test.mjs` covers complexity, mixed-domain decomposition, LiveBench and price overrides, and budget fallback; `collaboration.test.mjs` covers multi-stage execution and final synthesis.
+If no floor-preserving plan exists, the least-cost best-quality fallback is returned,
+`budgetExceeded` and/or `constraintRelaxed` are exposed in the audit record, and the
+UI explains why the target could not be met. This is a global replacement strategy,
+not a greedy “replace the last stage” rule.
 
-With user prices `p_in(m), p_out(m)` and estimated token counts:
+#### 5.5 Production pseudocode
 
 ```text
-Cost(i,m) = (n_in(i) * p_in(m) + n_out(i) * p_out(m)) / 10^6
-TotalCost = sum_i Cost(i, assign(i))
-Saving = max(0, 1 - TotalCost / BaselineStrongCost)
+BuildPlan(x, M, B):
+  (t, c, I) <- AnalyzeRequest(x)
+  for i in I:
+      P_i <- FeasibleCandidates(i, M)
+      P_i <- ParetoPrune(P_i) + {cheapest, best-utility, best-quality}
+  plan <- BeamAssign(I, P, B = infinity)
+  if B > 0:
+      budgetPlan <- BeamAssign(I, P, B)
+      plan <- budgetPlan if feasible
+              else BeamAssign(I, P, minimize total cost)
+  return auditable assignments, costs, floors, handoffs, and fallback flags
 ```
 
-Higher complexity increases the weight of quality, specialty, and criticality constraints; simple requests favor low cost and latency. The implementation is a bounded quality-constrained greedy solver with `O(|I||M| log |M|)` plan generation, suitable for interactive desktop use.
+### 6. Experiment algorithms
+
+The `experiment-plugin` contains standalone implementations used by the six paper
+experiments. They are intentionally deterministic and use the same model schema as
+the Host router.
+
+**QCG-Router (quality-constrained greedy / Pareto variant)**
+
+QCG evaluates every model in $O(\lvert M\rvert)$, predicts quality from the baseline score plus a
+specialty bonus, removes candidates below `F(i)`, computes the five-objective utility,
+and selects the first Pareto/utility candidate. If the feasible set is empty, it
+returns the highest-quality fallback with `constraintRelaxed: true`.
+
+**AMO-Router (adaptive multi-objective routing)**
+
+AMO starts from the paper's complexity-specific weights. After observing actual cost
+and quality it computes:
+
+$$
+e_{cost}=\mathrm{clamp}\!\left(\frac{\mathrm{actual\_cost}-\mathrm{target\_cost}}
+ {\max(\mathrm{target\_cost},\varepsilon)}\right),\qquad
+v_q=\max(0,\mathrm{quality\_floor}-\mathrm{actual\_quality})
+$$
+
+The feedback is exponentially smoothed (`0.10`). Positive cost error increases cost
+pressure; a quality violation increases quality and specialty pressure. Weights are
+projected back to the positive simplex after every update, so they remain finite,
+positive, and sum to one. This fixes the sign ambiguity that could previously reduce
+cost pressure when observed cost was too high.
+
+**DAG-Assign (dependency-aware task allocation)**
+
+DAG-Assign uses Kahn topological sorting, rejects unknown edge endpoints and cycles,
+and computes criticality as the number of unique descendants plus `100` for a
+synthesis node. For every node it keeps the QCG Pareto candidates, then runs a bounded
+beam assignment with dependency handoff penalties, a synthesis quality bonus, and a
+criticality bonus. Budget pruning uses suffix lower bounds; if the budget is
+impossible, the result explicitly reports `budgetFeasible: false` instead of silently
+assigning a below-floor model.
+
+### 7. Complexity and correctness properties
+
+Let $N=\lvert M\rvert$, $K\le 12$ be the retained candidate pool,
+$P=\lvert I\rvert$, and $W=256$ be
+the beam width. The current implementation has the following bounded worst-case
+costs:
+
+| Component | Time complexity | Space complexity |
+|---|---:|---:|
+| Candidate scoring | $O(PN)$ | $O(PN)$ |
+| Pairwise Pareto pruning | $O(PN^2)$ | $O(PN)$ |
+| Beam assignment | $O(PWK)$ | $O(WK+P)$ |
+| DAG topological sort | $O(\lvert V\rvert+\lvert E\rvert)$ | $O(\lvert V\rvert+\lvert E\rvert)$ |
+
+The constants are small for desktop catalogs, and all loops are bounded by the
+discovered routes, 12 candidates per package, and beam width 256.
+
+The following invariants are enforced and exposed in the result:
+
+1. **Quality guarantee**: if a qualified candidate exists for a package, every normal
+   assignment considered by the solver satisfies $Q\ge F$.
+2. **Budget guarantee**: a plan marked `budgetFeasible: true` has estimated total cost
+   no greater than `B`, subject to the configured token and price estimates.
+3. **Dependency guarantee**: every collaboration stage is emitted in topological
+   order, and handoff count is recorded.
+4. **Determinism**: equal scores use stable cost and route-id tie breakers; repeated
+   input/catalog/settings produce the same plan.
+5. **Graceful degradation**: no models, failed providers, stale LiveBench data, and
+   unsatisfied floors are represented as explicit fallback metadata rather than
+   blocking the native Harness request path.
+
+The beam solver is deliberately bounded. It provides an auditable, deterministic
+near-optimal heuristic for interactive desktop routing, not a formal global-optimum
+guarantee for arbitrary DAGs. A larger beam improves search coverage at the cost of
+latency; Pareto pruning and suffix lower bounds keep the default `W = 256` practical.
+
+### 8. Cost and audit outputs
+
+For every plan the router reports:
+
+$$
+\begin{aligned}
+\mathrm{TotalCost}&=\sum_{i\in I}\mathrm{Cost}(i,\mathrm{assign}(i)),\\
+\mathrm{BaselineCost}&=\text{cost of the strongest available model per package},\\
+\mathrm{EstimatedSaving}&=\max\!\left(0,1-\frac{\mathrm{TotalCost}}{\mathrm{BaselineCost}}\right)
+\end{aligned}
+$$
+
+The plan also contains per-stage token estimates, cache read/write tokens, predicted
+quality, quality floor, provider/model, Pareto-pruned count, beam width, handoff count,
+budget feasibility, and whether constraints were relaxed. `/router plan` and the GAL
+analysis panel display these audit fields; neither exposes private model chain of
+thought.
+
+The algorithm is wired into the Host request path: `index.mjs` calls `buildPlan` in
+collective mode and executes the planned stages. Single-session mode preserves the
+explicitly selected model instead of applying the collective override. The regression
+suite covers complexity, mixed-domain decomposition, LiveBench and price overrides,
+budget behavior, Pareto pruning, AMO feedback direction, DAG ordering, multi-stage
+execution, and final synthesis.
 
 ## OpenCode Zen settings
 

package/README.zh.md

@@ -15,6 +15,8 @@
 - **GAL 视窗**：新会话自动形成存档；历史记录保留实际 provider/model，名牌、颜色和立绘随当前模型变化。ERNIE、文心一言和百度 provider/model 标识统一显示 `ERNIE娘` 与 `ernie1.png`。路由分析显示的是可审计摘要，不是模型私有思维链。
 - **Markdown/KaTeX**：复用 Harness 的 `MarkdownText`，支持标题、列表、表格、引用、代码、链接和数学公式；宽表格、代码块和公式在对话框内滚动，玩家输入保持纯文本。
 - **附件与多模态**：图片使用原生多模态管线，Markdown/TXT/JSON/代码文件提取为文本；PDF/DOCX 等二进制文件保留解析状态，不会静默伪造内容。
+- **多任务安全审批适配**：内置 `dsh-approval-gate@0.5.0` 适配。复杂集体任务的每次沙箱升级都会附带工作包、阶段、路由和任务数量上下文；批量任务标记为 `bulk` 风险候选，由审批插件执行 Flash 判定、硬风险人工确认、学习白名单、审计和快照。单独会话不会被路由器强制切换。
+- **联网与反爬窗口**：内置 `@liustack/modsearch@5.10.1` 接管原生 `web_search`，并提供 `read_page`/`x_search`；内置 `dsh-ego-browser@0.8.0` 提供真实 Chrome 窗口、语义树、截图、点击、登录态和验证码检测。ModSearch 抓取失败或遇到动态/反爬页面时，路由指导模型切换到 Ego Browser；检测到人机验证会暂停并让用户在观察窗完成。
 - **OpenCode Zen**：官方站点覆盖会自动恢复模型目录所需的 `/zen`、`/zen/v1` 端点；自定义网关不受影响。
 - **更新与桌面端**：插件设置页提供 GitHub Release 检查和一键更新；客户端过期时更新完整客户端及内置插件，否则只更新插件。网页端无法写入本机文件时会打开 Releases 页面。
 
@@ -29,7 +31,7 @@
 
 ### 推荐方式：安装已发布的 npm 包
 
-这个公开包已经把官方 `@liustack/modlens@3.25.4` 作为依赖和 DSH bundle 一起打包。无需安装 Docker、Python、8000 端口服务，也无需再单独安装 ModLens。
+这个公开包会从 npm registry 安装官方 `@liustack/modlens@3.25.4`、`dsh-approval-gate@0.5.0`、`@liustack/modsearch@5.10.1` 和 `dsh-ego-browser@0.8.0`，同时带上 Ego Browser 实际运行所需的 `@deepseek-ai/dsh-tools@0.1.0-rc.8`、`schemastery@3.18.0`。无需克隆 Ego Browser GitHub 仓库，也无需单独安装这些依赖。
 
 1. 在 PowerShell 中进入 DSH Desktop 目录：
 
@@ -74,7 +76,7 @@ pnpm dsh plugin --profile web add --registry=https://registry.npmjs.org "@ljwei-
 4. 检查路由器和它的 ModLens 依赖是否已加入 profile：
 
 ```powershell
-pnpm dsh --profile web --dump-config | Select-String "model-router-galgame|modlens"
+pnpm dsh --profile web --dump-config | Select-String "model-router-galgame|modlens|dsh-approval-gate|modsearch|ego-browser"
 ```
 
 输出中应包含：
@@ -82,6 +84,9 @@ pnpm dsh --profile web --dump-config | Select-String "model-router-galgame|modle
 ```text
 @ljwei-stak/model-router-galgame
 @liustack/modlens
+dsh-approval-gate
+@liustack/modsearch
+dsh-ego-browser
 ```
 
 安装本插件后不要再单独添加 `@liustack/modlens`。本插件已经包含官方 ModLens
@@ -93,6 +98,23 @@ pnpm dsh plugin --profile web remove @liustack/modlens
 pnpm dsh plugin --profile web add "@ljwei-stak/model-router-galgame@$routerVersion"
 ```
 
+`modsearch` 和 `dsh-ego-browser` 也不要在同一 profile 中重复安装。重复条目会造成
+搜索 provider 或浏览器工具重复注册：
+
+```powershell
+pnpm dsh plugin --profile web remove @liustack/modsearch
+pnpm dsh plugin --profile web remove dsh-ego-browser
+pnpm dsh plugin --profile web add "@ljwei-stak/model-router-galgame@$routerVersion"
+```
+
+同理，不要在同一个 profile 中再次单独添加 `dsh-approval-gate`。如果以前单独安装过，
+先删除旧条目再安装本插件，避免重复 loader：
+
+```powershell
+pnpm dsh plugin --profile web remove dsh-approval-gate
+pnpm dsh plugin --profile web add "@ljwei-stak/model-router-galgame@$routerVersion"
+```
+
 5. 关闭已经运行的 DSH，再启动对应 profile：
 
 ```powershell
@@ -129,10 +151,10 @@ pnpm dsh plugin --profile web add "@ljwei-stak/model-router-galgame@$routerVersi
 ```
 
 如果需要可复现部署，请把 `$routerVersion` 替换为通过 `npm view` 确认过的具体版本号
-（例如 `0.4.12`）：
+（例如 `0.4.13`）：
 
 ```powershell
-pnpm dsh plugin --profile web add @ljwei-stak/model-router-galgame@0.4.12
+pnpm dsh plugin --profile web add @ljwei-stak/model-router-galgame@0.4.13
 ```
 
 已经安装过插件时，也可以让 pnpm 在当前版本范围内更新：
@@ -154,10 +176,10 @@ cd F:\DeepSeek_harness\DSH-Desktop
 pnpm dsh plugin --profile web remove @liustack/modlens
 $routerVersion = npm view @ljwei-stak/model-router-galgame version --registry=https://registry.npmjs.org/
 pnpm dsh plugin --profile web add "@ljwei-stak/model-router-galgame@$routerVersion"
-pnpm dsh --profile web --dump-config | Select-String "model-router-galgame|modlens"
+pnpm dsh --profile web --dump-config | Select-String "model-router-galgame|modlens|dsh-approval-gate"
 ```
 
-输出应只显示一条 `modlens` 行和一条 `model-router-galgame` 行。如果报
+输出应只显示一条 `modlens` 行、一条 `dsh-approval-gate` 行和一条 `model-router-galgame` 行。如果报
 `EADDRINUSE` 且端口为 3080，或报 `task-board ledger is already owned by process ...`，
 说明旧的 DSH 进程仍在运行；先关闭旧进程，或换一个端口启动：
 
@@ -193,35 +215,303 @@ pnpm dsh plugin --profile desktop remove @ljwei-stak/model-router-galgame
 - `/router mode collective`
 - `/router mode single`
 - `/router plan`
+- `/router safety`：查看审批适配版本、当前阶段、任务数量、活动路由和风险候选。
+- `/router web`：查看 ModSearch/Ego Browser 版本、服务探测状态和当前联网策略。
 
 默认模式为 `collective`。系统只公开任务分类、评分、分配、费用和回退记录，不输出任何模型私有思维链。
 
+### 审批与多任务安全策略
+
+安装后，profile 的 bundle 会同时加载 `dsh-approval-gate`。要启用其自动审批学习模式，
+请在 profile 的权限预设中选择目标插件提供的 `auto-approve`；默认 `ask` 策略仍然由
+Harness 原生审批界面处理。路由器不会改变审批结论，只会在 `approval/request` 进入瀑布
+前补充安全上下文：
+
+- 复杂集体任务（至少 3 个工作包）标记 `risk_candidate=bulk`，每个阶段单独审计。
+- 删除、凭据、远程、系统和批量风险由 `dsh-approval-gate` 永久要求人工确认。
+- Flash 超时、异常、输出无法解析或同类验证失败时，按 fail-safe 转人工。
+- 单独会话保留原生模型和审批行为，不会被集体路由计划覆盖。
+
+审计、学习和快照沿用目标项目的目录：`%DSH_HOME%\auto-approve\`（未设置
+`DSH_HOME` 时为 `%USERPROFILE%\.dsh\auto-approve\`），包括 `events.jsonl`、
+`audit.log`、`allowlist.json`、`learning.json` 和 `snapshots\`。如需确认桥接状态，
+在会话中运行 `/router safety`。
+
+### 联网和反爬页面
+
+普通搜索和页面阅读由 ModSearch 处理，结果带有来源 URL、不确定性和抓取警告。需要
+登录态、JavaScript 动态渲染、验证码或 Cloudflare/Turnstile 的页面由 Ego Browser
+接管。模型应按以下顺序工作：`ego_space_open` → `ego_navigate` → `ego_page_info`/
+`ego_captcha` → `ego_snapshot`/`ego_screenshot`；需要交互时使用 `ego_click`、
+`ego_fill` 或 `ego_wait*`。检测到 `humanCheck=true` 后，当前工作包会暂停，用户在
+“Agent 浏览器”观察窗完成验证，确认后再继续。系统不会尝试绕过验证码或伪造结果。
+
+在 Web profile 中，Ego Browser 会注册 `/api/ego/*` 观察窗路由；若安装了
+`dsh-better-sidebar`，观察窗显示为“Agent 浏览器”侧边栏 Tab，否则显示浮动观察窗。
+
 ## 数学路由模型
 
-对请求 `x`，系统先得到任务类型 `t`、复杂度档位 `c`、工作包集合 `I` 和候选模型集合 `M`。每个候选的质量来自 LiveBench 的任务分类分数（其次为 overall，最后回退实验基线），价格来自用户覆盖或实验目录。
+本节按照 `RESEARCH_PAPER_FRAMEWORK.md` 的论文框架，完整说明当前 `0.4.14`
+实现。生产路由器与离线实验插件共用质量下限、费用模型、目标函数和回退语义；
+生产实现进一步加入 Pareto 剪枝与有界全局搜索，因此不再是互相独立的逐阶段局部贪心。
+
+### 1. 问题定义
 
-单个工作包 `i` 分配给模型 `m` 的效用为：
+给定用户请求 `x`，系统构造：
 
 ```text
-U(i,m) = wq(c) Q(i,m) + wc(c) C(m) + wl(c) (1 - L(m))
-         + ws(c) S(i,m) - wr(c) R(m)
-         - lambda * 1[m is already used]
-         - kappa * max(0, F(i) - Q(i,m))
+t       任务类型：general、code、math、research、writing、summarization、vision
+c       复杂度档位：simple、balanced、complex
+I       有序工作包集合
+M       已发现的 provider/model 路由集合
+F(i)    工作包 i 的质量下限
+B       可选的单请求 USD 预算
 ```
 
-其中 `F(i)` 是工作包质量下限；只有满足 `Q(i,m) >= F(i)` 的候选才优先进入可行集合。复杂任务还设置预算 `B`，若初始效用分配超预算，算法按关键度从低到高尝试替换为更便宜且仍满足质量下限的模型。最终汇总阶段默认优先 DeepSeek V4 Pro，若不可用则按候选排序回退。
+分配函数为 $\pi: I \to M$。首要目标是在满足质量约束的前提下最大化多目标效用；
+设置预算时，预算是第二层硬约束：
+
+$$
+\begin{aligned}
+\text{最大化}\quad & \sum_{i \in I} U(i,\pi(i)) \\
+\text{约束}\quad & Q(i,\pi(i)) \ge F(i), && \forall i \in I \\
+& \sum_{i \in I} \mathrm{Cost}(i,\pi(i)) \le B
+\end{aligned}
+$$
+
+如果某个工作包没有任何模型达到质量下限，系统会选择可用候选中质量最高的回退模型，
+并写入 `constraintRelaxed: true`；不会把未满足的约束伪装成已满足。
 
-该算法已经接入 Host 请求路径：`index.mjs` 在集体模式调用 `buildPlan`，并按计划执行各阶段；单独模式保留用户指定模型，不经过集体路由覆盖。`router.test.mjs` 覆盖复杂度、混合业务拆分、LiveBench 与价格覆盖及预算回退，`collaboration.test.mjs` 覆盖多阶段执行和最终整合。
+### 2. 请求分析与工作包构造
 
-阶段费用使用用户价格 `p_in(m), p_out(m)` 和 token 估计：
+任务分类是确定性的信号计数过程。系统分别统计代码、数学、研究、写作、摘要和视觉
+关键词，以信号最多的类型作为主类型，同时保留所有检测到的类型用于复杂任务拆分。
+
+复杂度分数由文本长度、条目/要求密度、领域关键词、代码/推理标记和视觉标记组成，
+并限制在 `[0,1]`：
+
+$$
+\begin{aligned}
+\text{simple:}\quad & 0.00 \le \mathrm{complexity} < 0.34 \\
+\text{balanced:}\quad & 0.34 \le \mathrm{complexity} < 0.66 \\
+\text{complex:}\quad & 0.66 \le \mathrm{complexity} \le 1.00
+\end{aligned}
+$$
+
+简单和均衡请求使用一个执行工作包。复杂请求展开为一个小型 DAG 序列：
 
 ```text
-Cost(i,m) = (n_in(i) * p_in(m) + n_out(i) * p_out(m)) / 10^6
-TotalCost = sum_i Cost(i, assign(i))
-Saving = max(0, 1 - TotalCost / BaselineStrongCost)
+analysis -> 领域执行工作包 -> 可选 verification -> synthesis
 ```
 
-复杂度越高，质量、专长和关键度约束越重要；简单请求则更多使用低价、低延迟模型。该实现是有界的质量约束贪心求解器，复杂度约为 `O(|I||M| log |M|)`，适合桌面端实时生成计划。
+每个工作包都具有 id、类型、用途、关键度、质量下限和 `dependsOn` 依赖列表。默认
+质量下限为：simple `0.75`、balanced `0.78`、complex `0.82`。复杂任务的 synthesis
+工作包最低为 `0.84`；关键度较高的非 synthesis 工作包会在基础下限上获得小幅增量。
+
+### 3. 模型质量、专长、费用与风险
+
+对于模型路由 `m` 和任务类型 `t`，质量按以下顺序解析：
+
+$$
+Q(m,t)=
+\begin{cases}
+\text{LiveBench 分类分数}, & \text{可用时};\\
+\text{LiveBench overall 分数}, & \text{否则};\\
+\text{仓库内实验基线分数}, & \text{否则}
+\end{cases}
+$$
+
+专长 `S(m,t)`：模型明确声明该专长时为 `1.0`；general 任务为 `0.58`；研究/写作等
+相关方向使用确定性的部分匹配。风险 `R(m)` 与延迟 `L(m)` 使用目录归一化值；用户
+价格覆盖只改变费用，不会伪造质量分数。
+
+输入/输出价格单位为 USD/百万 token，支持 prompt cache 的费用公式为：
+
+$$
+\mathrm{Cost}(i,m)=
+\frac{(n_{in}-n_{cache\_read}-n_{cache\_write})p_{in}
+      +n_{cache\_read}p_{cache\_read}
+      +n_{cache\_write}p_{cache\_write}
+      +n_{out}p_{out}}{10^6}
+$$
+
+缓存读写比例会被限制在 `[0,1]`，写入比例不会与读取比例重叠；没有配置缓存比例时，
+全部输入按普通输入价格计费。
+
+### 4. 多目标效用函数
+
+代码使用归一化费用效用
+$C_{\mathrm{norm}}=1-p_{\mathrm{effective}}/p_{\max}$，因此
+实际价格越低，成本目标贡献越高。单个工作包 `i` 选择模型 `m` 的效用为：
+
+$$
+\begin{aligned}
+U(i,m)={}&w_q(c)Q(i,m)+w_c(c)C_{\mathrm{norm}}(m)+w_l(c)(1-L(m))\\
+&+w_s(c)S(i,m)-w_r(c)R(m)\\
+&-\lambda\,\mathbb{1}[m\text{ 已经使用}]
+-\kappa\max(0,F(i)-Q(i,m))\\
+&+\mathrm{synthesis\_bonus}(i,m)
+\end{aligned}
+$$
+
+默认权重为：
+
+| 复杂度 | 质量 | 成本 | 延迟 | 专长 | 风险 |
+|---|---:|---:|---:|---:|---:|
+| simple | 0.30 | 0.50 | 0.14 | 0.04 | 0.02 |
+| balanced | 0.45 | 0.30 | 0.10 | 0.10 | 0.05 |
+| complex | 0.55 | 0.16 | 0.06 | 0.16 | 0.07 |
+
+synthesis 使用质量优先的 `0.70/0.10/0.04/0.10/0.06` 权重；存在 DeepSeek V4 Pro
+时只增加一个小的确定性偏好项，并非硬编码强制选择，不可用时仍按可行候选排序回退。
+重复使用同一路由扣除 `0.08` 效用；依赖边跨越不同模型时，在全局分配中每条边扣除
+`0.015`，用于抑制不必要的上下文交接。
+
+### 5. 生产算法：Pareto 剪枝的质量约束 Beam Assignment
+
+当前 Host 路由器由五个步骤组成。
+
+#### 5.1 候选发现与质量过滤
+
+对每个工作包，若至少存在一个达到质量下限的模型，就删除所有低于下限的候选；若一个
+都不存在，则保留质量最高的至多三个候选，并标记该工作包需要放宽约束。这样既保证正常
+情况下的质量硬约束，也让约束失败可见，并限制大模型目录下的计算量。
+
+#### 5.2 Pareto 剪枝
+
+对于同一个工作包，候选 `a` 支配候选 `b` 的条件是：五个维度全部不差，且至少一个维度
+严格更好：
+
+$$
+Q(a)\ge Q(b),\quad \mathrm{Cost}(a)\le\mathrm{Cost}(b),\quad L(a)\le L(b),\quad
+S(a)\ge S(b),\quad R(a)\le R(b)
+$$
+
+被支配的模型不可能同时改善质量、费用、延迟、专长或风险，因此可以安全删除。系统保留
+Pareto 前沿，并额外保留三个锚点：最低费用、最高综合效用和最高质量候选；每个工作包
+最终至多保留 12 条路由。
+
+#### 5.3 依赖感知的 Beam Search
+
+每个 Beam 状态保存：部分分配、已完成工作包的路由映射、累计费用、累计效用、依赖交接
+次数和质量缺口。算法按工作包顺序扩展状态；如果当前模型与依赖工作包模型不同，就按
+每条依赖边扣除 `0.015`。Beam 宽度为 256。并列状态按质量缺口、综合效用、费用、交接
+次数和 provider/model 字典序稳定决胜，因此相同输入会得到相同方案。
+
+搜索排序优先减少质量约束违规，再减少质量缺口，最后最大化效用。预算搜索使用“后缀最低
+费用”下界，提前剪掉即使后续全部使用最便宜模型也无法满足预算的部分状态。
+
+#### 5.4 预算策略
+
+系统依次评估三种方案：
+
+1. 不设预算的效用最优方案；
+2. 必须满足 `B` 的效用方案；
+3. 如果第 2 项不可行，则求仍保持所有可用质量下限的最低费用方案。
+
+如果连保持质量下限的方案都不存在，就返回“质量最高的低成本回退”，并在审计结果中明确
+写入 `budgetExceeded` 和/或 `constraintRelaxed`。这是全局组合替换，不是简单地只替换
+最后一个阶段。
+
+#### 5.5 生产伪代码
+
+```text
+BuildPlan(x, M, B):
+  (t, c, I) <- AnalyzeRequest(x)
+  for i in I:
+      P_i <- FeasibleCandidates(i, M)
+      P_i <- ParetoPrune(P_i) + {最低费用、最高效用、最高质量}
+  plan <- BeamAssign(I, P, B = infinity)
+  if B > 0:
+      budgetPlan <- BeamAssign(I, P, B)
+      plan <- budgetPlan if feasible
+              else BeamAssign(I, P, minimize total cost)
+  return assignments、费用、质量下限、交接次数和回退标记
+```
+
+### 6. 实验插件中的三种算法
+
+`experiment-plugin` 提供论文六项实验使用的独立算法实现。它们使用与 Host 相同的模型
+字段，并采用固定随机种子保证离线结果可复现。
+
+**QCG-Router（质量约束贪心 / Pareto 变体）**
+
+QCG 对每个模型进行质量、费用、延迟、专长和风险评估；质量预测为基线分数加专长奖励，
+复杂任务有小幅复杂度扣减。算法先过滤低于 `F(i)` 的候选，再从 Pareto 前沿中选择效用
+最高者。若没有可行候选，则返回质量最高的回退并设置 `constraintRelaxed: true`。
+
+**AMO-Router（自适应多目标路由）**
+
+AMO 从论文规定的三组复杂度权重开始。得到真实费用和质量后计算：
+
+$$
+e_{cost}=\mathrm{clamp}\!\left(\frac{\mathrm{actual\_cost}-\mathrm{target\_cost}}
+ {\max(\mathrm{target\_cost},\varepsilon)}\right),\qquad
+v_q=\max(0,\mathrm{quality\_floor}-\mathrm{actual\_quality})
+$$
+
+反馈使用 `0.10` 的指数平滑。实际费用高于目标时提高成本目标权重；质量违反时提高质量
+和专长权重。每次更新后投影回正权重单纯形，保证五个权重有限、为正且总和为 1。这样修正
+了旧实现中“费用超标反而降低成本压力”的符号问题。
+
+**DAG-Assign（依赖感知任务分配）**
+
+DAG-Assign 使用 Kahn 拓扑排序，拒绝未知节点边和环；关键度定义为唯一后继数量，并为
+synthesis 节点额外加 `100`。每个节点保留 QCG Pareto 候选，然后以 Beam 宽度 256 做
+依赖感知分配，加入依赖交接惩罚、synthesis 质量奖励和关键度奖励。预算剪枝使用后缀最低
+费用；如果预算不可能满足，结果显式报告 `budgetFeasible: false`，而不是静默分配低于质量
+下限的模型。
+
+### 7. 复杂度与正确性性质
+
+令 $N=\lvert M\rvert$、$K\le 12$ 为剪枝后的候选数、
+$P=\lvert I\rvert$、$W=256$ 为 Beam 宽度，
+当前实现的有界最坏情况复杂度为：
+
+| 组件 | 时间复杂度 | 空间复杂度 |
+|---|---:|---:|
+| 候选评分 | $O(PN)$ | $O(PN)$ |
+| 两两 Pareto 剪枝 | $O(PN^2)$ | $O(PN)$ |
+| Beam 分配 | $O(PWK)$ | $O(WK+P)$ |
+| DAG 拓扑排序 | $O(\lvert V\rvert+\lvert E\rvert)$ | $O(\lvert V\rvert+\lvert E\rvert)$ |
+
+桌面端模型目录通常较小，且所有循环都受已发现路由数、每包 12 个候选和 Beam 宽度 256
+限制，适合交互式生成计划。
+
+系统强制并在结果中公开以下不变量：
+
+1. **质量保证**：只要某个工作包存在合格候选，正常分配中所有候选都满足 $Q\ge F$。
+2. **预算保证**：标记 `budgetFeasible: true` 的方案，其估算总费用不超过 `B`（以配置的
+   token 和价格估算为准）。
+3. **依赖保证**：协作阶段按拓扑顺序输出，并记录模型交接次数。
+4. **确定性**：相同分数按费用和路由 id 稳定决胜；相同输入、目录和设置产生相同方案。
+5. **优雅降级**：没有模型、provider 失败、LiveBench 过期或质量下限不可满足时，都通过
+   显式回退元数据表达，不阻塞 Harness 原生请求路径。
+
+Beam 求解器是有界的。它为桌面端交互式路由提供可审计、确定性的近似最优启发式，
+并不声称对任意 DAG 都能形式化保证全局最优。增大 Beam 可以提高搜索覆盖率，但会增加
+决策延迟；Pareto 剪枝和后缀费用下界使默认 `W = 256` 保持可用。
+
+### 8. 费用与审计输出
+
+每个计划输出：
+
+$$
+\begin{aligned}
+\mathrm{TotalCost}&=\sum_{i\in I}\mathrm{Cost}(i,\mathrm{assign}(i)),\\
+\mathrm{BaselineCost}&=\text{每个工作包使用当前可用最高质量模型的费用},\\
+\mathrm{EstimatedSaving}&=\max\!\left(0,1-\frac{\mathrm{TotalCost}}{\mathrm{BaselineCost}}\right)
+\end{aligned}
+$$
+
+同时输出每阶段 token 估计、缓存读写 token、预测质量、质量下限、provider/model、Pareto
+剪枝数量、Beam 宽度、交接次数、预算可行性及约束是否放宽。`/router plan` 和 GAL 路由
+分析面板展示这些可审计字段，但不会展示模型私有思维链。
+
+算法已接入 Host 请求路径：集体模式由 `index.mjs` 调用 `buildPlan` 并按计划执行；单独
+模式保留用户明确选择的模型，不被集体路由覆盖。回归测试覆盖复杂度、混合业务拆分、
+LiveBench/价格覆盖、预算行为、Pareto 剪枝、AMO 反馈方向、DAG 顺序、多阶段执行和最终
+整合。
 
 ## OpenCode Zen 设置
 

package/cordis.patch.yml

@@ -3,11 +3,26 @@
 - insert:
     - id: modlens
       name: '@liustack/modlens'
+    # ModSearch replaces the native web_search provider and adds read_page/x_search.
+    - id: modsearch
+      name: '@liustack/modsearch'
+    # Ego Browser supplies visible Chromium tools for JS-heavy and anti-bot pages.
+    - id: ego-browser
+      name: 'dsh-ego-browser'
+    # The router annotates multi-task approval requests; dsh-approval-gate
+    # owns the Flash decision, human handoff, audit and snapshot UI.
+    - id: dsh-approval-gate
+      name: 'dsh-approval-gate'
     # The package dependency is transitive from the profile's point of view,
     # so this bundle entry is needed when the router is installed by itself.
     - id: model-router-galgame
       name: '@ljwei-stak/model-router-galgame'
 
+# Route DSH's native web_search seam through ModSearch's engine chain.
+- id: web
+  config:
+    searchProvider: modsearch
+
 # ModLens consumes the durable image blocks on the Host pre-step. Leave the
 # describe-image fallback available for explicit use, but do not rewrite every
 # text-model upload into a markdown tool reference before ModLens can read it.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ljwei-stak/model-router-galgame",
-  "version": "0.4.12",
+  "version": "0.4.14",
   "type": "module",
   "description": "DeepSeek Harness plugin: adaptive model routing, cost analysis and GAL view",
   "repository": {
@@ -48,7 +48,12 @@
     "node": ">=22.19"
   },
   "dependencies": {
-    "@liustack/modlens": "3.25.4"
+    "dsh-approval-gate": "0.5.0",
+    "@deepseek-ai/dsh-tools": "0.1.0-rc.8",
+    "@liustack/modsearch": "5.10.1",
+    "dsh-ego-browser": "0.8.0",
+    "@liustack/modlens": "3.25.4",
+    "schemastery": "3.18.0"
   },
   "peerDependencies": {
     "@deepseek-ai/dsh-settings": "^0.1.1-rc.1",