@lmzhen/dsh-evolution-core 0.1.0-rc.45 → 0.1.0-rc.46

package/lib/index.js

@@ -316,6 +316,53 @@ const DEFAULT_USER_CHAR_LIMIT = 1375;
 const DEFAULT_CONSOLIDATION_FAILURES = 3;
 const DEFAULT_SKILL_CONTENT_CHARS = 1e5;
 //#endregion
+//#region lib/types/gates.js
+/**
+* The control-plane protection sets, held once and queried everywhere
+* (decision B, rc.44 plan M2): the lifecycle engine, the scope view, the LLM
+* nomination gate and the control-plane consolidate all answer "is this name
+* off limits — and why" from the same instance, so the gate sets can never
+* drift apart the way the three pre-rc.46 implementations did.
+*
+* Scope boundary: a GateSet covers NAME-SET protections only. Marker-based
+* protections (pinned / bundled / hub-installed) are file markers resolved by
+* `SkillLibrary.writeProtection` / `deleteProtection` — they depend on the
+* filesystem and the write origin, not on a name list.
+* @module @lmzhen/dsh-evolution-core
+*/
+var EvolutionGateSet = class {
+	exclude;
+	referenced;
+	suppressed;
+	constructor(inputs = {}) {
+		this.exclude = inputs.exclude ?? /* @__PURE__ */ new Set();
+		this.referenced = inputs.referenced ?? /* @__PURE__ */ new Set();
+		this.suppressed = inputs.suppressed ?? /* @__PURE__ */ new Set();
+	}
+	/**
+	* The first protection blocking this name, or null. Any hit blocks — the
+	* order is diagnostic only, so a name in two sets reports the first.
+	*/
+	blockReason(name) {
+		if (this.exclude.has(name)) return "excluded";
+		if (this.referenced.has(name)) return "referenced";
+		if (this.suppressed.has(name)) return "suppressed";
+		if (PROTECTED_BUILTIN_SKILLS.has(name)) return "protected-builtin";
+		return null;
+	}
+	isBlocked(name) {
+		return this.blockReason(name) !== null;
+	}
+};
+/** Build a GateSet from the curator-style config field names. */
+function createGateSet(config) {
+	return new EvolutionGateSet({
+		exclude: config.excludeSkillNames,
+		referenced: config.referencedSkillNames,
+		suppressed: config.suppressedNames
+	});
+}
+//#endregion
 //#region lib/types/curator.js
 /**
 * Deterministic skill curator: active → stale → archived transitions.
@@ -385,13 +432,10 @@ function parseCuratorNominations(text) {
 * view so the two can never disagree: records failing ANY of these gates are
 * outside the managed scope.
 */
-function lifecycleCandidate(name, record, config, bundled) {
+function lifecycleCandidate(name, record, config, bundled, gates = createGateSet(config)) {
 	if (record.pinned) return false;
-	if (config.excludeSkillNames?.has(name)) return false;
-	if (config.suppressedNames?.has(name)) return false;
-	if (config.referencedSkillNames?.has(name)) return false;
+	if (gates.isBlocked(name)) return false;
 	if (!(record.created_by === "agent" || config.manageUnmanaged === true) && !(config.pruneBuiltins === true && bundled)) return false;
-	if (PROTECTED_BUILTIN_SKILLS.has(name)) return false;
 	if (record.state === "archived") return false;
 	return true;
 }
@@ -401,21 +445,22 @@ function lifecycleCandidate(name, record, config, bundled) {
 * curator pass may touch. `protectedNames` carries the marker info the usage
 * records lack (bundled / hub-installed / pinned from `SkillLibrary.list()`).
 */
-function computeScopeView(usage, config, protectedNames) {
+function computeScopeView(usage, config, protectedNames, gates) {
 	const managed = [];
 	const watched = [];
 	const qualityWarned = [];
 	const exempted = [];
 	const protectedSet = /* @__PURE__ */ new Set();
+	const gateSet = gates ?? createGateSet(config);
 	for (const [name, record] of usage) {
-		if (config.excludeSkillNames?.has(name) || config.referencedSkillNames?.has(name)) {
+		if (gateSet.exclude.has(name) || gateSet.referenced.has(name)) {
 			exempted.push(name);
 			continue;
 		}
 		const bundled = config.bundledNames?.has(name) === true;
-		const suppressed = config.suppressedNames?.has(name) === true;
+		const suppressed = gateSet.suppressed.has(name);
 		if (record.pinned || bundled || suppressed || protectedNames?.has(name) === true) protectedSet.add(name);
-		if (lifecycleCandidate(name, record, config, bundled)) {
+		if (lifecycleCandidate(name, record, config, bundled, gateSet)) {
 			managed.push(name);
 			if (record.state === "stale" || record.quality_warn === true) watched.push(name);
 			if (record.quality_warn === true) qualityWarned.push(name);
@@ -432,15 +477,16 @@ function computeScopeView(usage, config, protectedNames) {
 function daysSince(iso, created, now) {
 	return (now - new Date(iso ?? created).getTime()) / 864e5;
 }
-function computeLifecycleTransitions(usage, config, now = /* @__PURE__ */ new Date()) {
+function computeLifecycleTransitions(usage, config, now = /* @__PURE__ */ new Date(), gates) {
 	const result = {
 		transitions: [],
 		archive: [],
 		reactivate: [],
 		markStale: []
 	};
+	const gateSet = gates ?? createGateSet(config);
 	for (const [name, record] of usage) {
-		if (!lifecycleCandidate(name, record, config, config.bundledNames?.has(name) === true)) continue;
+		if (!lifecycleCandidate(name, record, config, config.bundledNames?.has(name) === true, gateSet)) continue;
 		const age = daysSince(null, record.created_at, now.getTime());
 		if (record.use_count === 0 && age < config.staleAfterDays) continue;
 		const idle = daysSince(latestActivityAt(record), record.created_at, now.getTime());
@@ -508,8 +554,8 @@ function computeLifecycleTransitions(usage, config, now = /* @__PURE__ */ new Da
 * changes semantically: the bundle digest is the fail-closed signal for
 * review workers, so a stale id across deployments must be distinguishable.
 */
-const PROMPT_BUNDLE_ID = "dsh-evolution@2";
-const PROMPT_BUNDLE_VERSION = 2;
+const PROMPT_BUNDLE_ID = "dsh-evolution@3";
+const PROMPT_BUNDLE_VERSION = 3;
 const MEMORY_REVIEW_PROMPT = `[Auto-review — Memory]
 Review the conversation above and consider saving to memory if appropriate.
 
@@ -529,13 +575,15 @@ Signals that warrant action:
 - A non-trivial technique, fix, workaround, or debugging path emerged.
 - A loaded skill turned out wrong, missing, or outdated — patch it now.
 
+Only update skills you loaded or read in THIS session; never touch skills you have not read.
+
 Preference order:
 1. Patch a skill that was loaded or read this session.
 2. Patch an existing umbrella skill.
 3. Add references/, templates/, or scripts/ support under an existing skill.
 4. Create a new class-level umbrella skill only when nothing fits.
 
-Protected skills (bundled/hub-installed) must not be edited. Pinned skills may be patched but not archived.
+Protected skills (bundled/hub-installed) must not be edited. Pinned skills are read-only to the background review: the pinned write guard refuses background changes, so only the foreground may update or archive them.
 
 Do NOT capture:
 - Environment-dependent failures (missing binaries, unconfigured credentials).
@@ -551,7 +599,7 @@ Review the conversation above and update two things.
 
 **Memory**: who the user is. Save durable user preferences, personal details, and expectations with the memory tool.
 
-**Skills**: how to do this class of task. Be ACTIVE. Follow the same class-level umbrella policy, preference order, protected-skill rules, and do-not-capture list as a skill review.
+**Skills**: how to do this class of task. Be ACTIVE. Only update skills you loaded or read in THIS session. Follow the same class-level umbrella policy, preference order, protected-skill rules, and do-not-capture list as a skill review.
 
 Act on whichever dimension has real signal. If genuinely nothing stands out on either, say "Nothing to save." and stop — but don't reach for that conclusion as a default.`;
 const CURATOR_PROMPT = `You are the skill curator. Maintain a healthy, class-level skill library, not a flat pile of narrow one-session skills.
@@ -599,7 +647,7 @@ If you accidentally take a mutating action, say so explicitly in the summary.`;
 const COMPLETION_SKILL_REVIEW_PROMPT = `[Auto-review — Skills · task complete]
 Your current task now appears complete. Before wrapping up, review the approach and update the skill library via skill_manage.
 
-Follow the skills review policy: be ACTIVE, prefer class-level umbrellas, patch skills loaded this session, and capture non-trivial techniques and user corrections. Do NOT capture environment-dependent failures, negative claims about tools, or one-off task narratives.
+Follow the skills review policy: be ACTIVE, prefer class-level umbrellas, patch ONLY skills loaded or read this session, and capture non-trivial techniques and user corrections. Do NOT capture environment-dependent failures, negative claims about tools, or one-off task narratives.
 
 Do NOT modify output files or re-run the task. If you are still mid-task, ignore this.`;
 function reviewPrompt(kind) {
@@ -613,12 +661,12 @@ function sha256(text) {
 function createPromptBundle(prompts) {
 	const canonical = JSON.stringify({
 		id: PROMPT_BUNDLE_ID,
-		version: 2,
+		version: 3,
 		prompts: Object.fromEntries(Object.entries(prompts).sort())
 	});
 	return Object.freeze({
 		id: PROMPT_BUNDLE_ID,
-		version: 2,
+		version: 3,
 		prompts: Object.freeze({ ...prompts }),
 		sha256: sha256(canonical)
 	});
@@ -631,10 +679,10 @@ const PROMPT_BUNDLE = createPromptBundle({
 	completion: COMPLETION_SKILL_REVIEW_PROMPT
 });
 function verifyPromptBundle(bundle = PROMPT_BUNDLE) {
-	if (bundle.id !== "dsh-evolution@2" || bundle.version !== 2) return false;
+	if (bundle.id !== "dsh-evolution@3" || bundle.version !== 3) return false;
 	const canonical = JSON.stringify({
 		id: PROMPT_BUNDLE_ID,
-		version: 2,
+		version: 3,
 		prompts: Object.fromEntries(Object.entries(bundle.prompts).sort())
 	});
 	return bundle.sha256 === sha256(canonical);
@@ -1641,6 +1689,30 @@ const SNAPSHOT_EXTRA_NAME_RE = /^[a-z0-9][a-z0-9._-]*$/;
 function skillsRoot(env = process.env) {
 	return join(env.DSH_HOME ?? join(homedir(), ".dsh"), "skills");
 }
+/**
+* Map a requesting session onto the two origin surfaces (rc.44 plan M2-2.3):
+* the APPROVAL surface treats every delegated subagent as the autonomous
+* review channel, while the LIBRARY surface keeps the Hermes distinction -
+* the review fork is 'background_review' (the pinned guard blocks its
+* writes) and any other subagent is 'subagent' (agent-authored, not
+* review-channel). `isReview` marks the caller as the background review
+* pipeline itself. Single source: the two tools and the review executor all
+* read this table instead of re-deriving it.
+*/
+function resolveOrigins(headerOrigin, isReview = false) {
+	if (isReview) return {
+		approval: "background_review",
+		library: "background_review"
+	};
+	if (headerOrigin === "subagent") return {
+		approval: "background_review",
+		library: "subagent"
+	};
+	return {
+		approval: "foreground",
+		library: "foreground"
+	};
+}
 function skillDir(root, name) {
 	return join(root, name);
 }
@@ -2560,4 +2632,4 @@ var JsonState = class JsonState {
 	}
 };
 //#endregion
-export { COMBINED_REVIEW_PROMPT, COMPLETION_SKILL_REVIEW_PROMPT, CURATOR_DRY_RUN_BANNER, CURATOR_PROMPT, DEFAULT_ARCHIVE_AFTER_DAYS, DEFAULT_CONSOLIDATION_FAILURES, DEFAULT_CURATOR_INTERVAL_HOURS, DEFAULT_MAX_OPS_PER_PLAN, DEFAULT_MEMORY_CHAR_LIMIT, DEFAULT_MIN_IDLE_HOURS, DEFAULT_MUTATION_CAP, DEFAULT_REVIEW_MEMORY_INTERVAL, DEFAULT_REVIEW_SKILL_INTERVAL, DEFAULT_SKILL_CONTENT_CHARS, DEFAULT_SKILL_LIMITS, DEFAULT_SKILL_REVIEW_COMPLETION_MIN_TOOL_CALLS, DEFAULT_SKILL_REVIEW_TRIGGER, DEFAULT_STALE_AFTER_DAYS, DEFAULT_SUBSTANTIVE_MIN_AGENT_CHARS, DEFAULT_SUBSTANTIVE_MIN_TOOL_CALLS, DEFAULT_SUBSTANTIVE_MIN_USER_CHARS, DEFAULT_USER_CHAR_LIMIT, DSH_AUTHORING_STANDARDS, ENTRY_DELIMITER, JsonState, LOW_QUALITY_THRESHOLD, MAX_DESCRIPTION_LENGTH, MAX_SKILL_CONTENT_CHARS, MAX_SKILL_FILE_BYTES, MAX_SKILL_NAME_LENGTH, MEMORY_REVIEW_PROMPT, MUTATIONS_FILE_VERSION, MemoryStore, PROMPT_BUNDLE, PROMPT_BUNDLE_ID, PROMPT_BUNDLE_VERSION, PROTECTED_BUILTIN_SKILLS, QUALITY_WEIGHTS, SKILL_NAME_RE, SKILL_REVIEW_PROMPT, SNAPSHOT_EXTRA_NAME_RE, SUPPORT_DIRS, SUPPRESSED_FILE_VERSION, SkillLibrary, advanceReview, buildCuratorRunReport, buildLearnPrompt, bumpPatch, bumpUse, bumpView, computeDedupGroups, computeLifecycleTransitions, computeQualityScores, computeScopeView, contentHash, emptyRecord, evaluateThreat, evolutionHome, evolutionIoAdapter, foldTurn, getRecord, latestActivityAt, lifecycleCandidate, loadMutations, loadSuppressedNames, loadUsage, markAgentCreated, memoryRoot, mutationsFile, nodeEvolutionIo, normalizeUsageRecord, observeEvent, parseCuratorNominations, parseFrontmatter, recordMutation, relatedSkillNames, reviewPrompt, saveSuppressedNames, saveUsage, scanContentThreats, scanMemoryThreats, scanThreats, skillsRoot, suppressedFile, usageFile, validateFrontmatter, verifyPromptBundle };
+export { COMBINED_REVIEW_PROMPT, COMPLETION_SKILL_REVIEW_PROMPT, CURATOR_DRY_RUN_BANNER, CURATOR_PROMPT, DEFAULT_ARCHIVE_AFTER_DAYS, DEFAULT_CONSOLIDATION_FAILURES, DEFAULT_CURATOR_INTERVAL_HOURS, DEFAULT_MAX_OPS_PER_PLAN, DEFAULT_MEMORY_CHAR_LIMIT, DEFAULT_MIN_IDLE_HOURS, DEFAULT_MUTATION_CAP, DEFAULT_REVIEW_MEMORY_INTERVAL, DEFAULT_REVIEW_SKILL_INTERVAL, DEFAULT_SKILL_CONTENT_CHARS, DEFAULT_SKILL_LIMITS, DEFAULT_SKILL_REVIEW_COMPLETION_MIN_TOOL_CALLS, DEFAULT_SKILL_REVIEW_TRIGGER, DEFAULT_STALE_AFTER_DAYS, DEFAULT_SUBSTANTIVE_MIN_AGENT_CHARS, DEFAULT_SUBSTANTIVE_MIN_TOOL_CALLS, DEFAULT_SUBSTANTIVE_MIN_USER_CHARS, DEFAULT_USER_CHAR_LIMIT, DSH_AUTHORING_STANDARDS, ENTRY_DELIMITER, EvolutionGateSet, JsonState, LOW_QUALITY_THRESHOLD, MAX_DESCRIPTION_LENGTH, MAX_SKILL_CONTENT_CHARS, MAX_SKILL_FILE_BYTES, MAX_SKILL_NAME_LENGTH, MEMORY_REVIEW_PROMPT, MUTATIONS_FILE_VERSION, MemoryStore, PROMPT_BUNDLE, PROMPT_BUNDLE_ID, PROMPT_BUNDLE_VERSION, PROTECTED_BUILTIN_SKILLS, QUALITY_WEIGHTS, SKILL_NAME_RE, SKILL_REVIEW_PROMPT, SNAPSHOT_EXTRA_NAME_RE, SUPPORT_DIRS, SUPPRESSED_FILE_VERSION, SkillLibrary, advanceReview, buildCuratorRunReport, buildLearnPrompt, bumpPatch, bumpUse, bumpView, computeDedupGroups, computeLifecycleTransitions, computeQualityScores, computeScopeView, contentHash, createGateSet, emptyRecord, evaluateThreat, evolutionHome, evolutionIoAdapter, foldTurn, getRecord, latestActivityAt, lifecycleCandidate, loadMutations, loadSuppressedNames, loadUsage, markAgentCreated, memoryRoot, mutationsFile, nodeEvolutionIo, normalizeUsageRecord, observeEvent, parseCuratorNominations, parseFrontmatter, recordMutation, relatedSkillNames, resolveOrigins, reviewPrompt, saveSuppressedNames, saveUsage, scanContentThreats, scanMemoryThreats, scanThreats, skillsRoot, suppressedFile, usageFile, validateFrontmatter, verifyPromptBundle };

package/lib/types/curator.d.ts

@@ -6,6 +6,7 @@
  * after. File moves are performed by SkillLibrary.
  */
 import type { UsageMap, UsageRecord } from './usage.ts';
+import { EvolutionGateSet } from './gates.ts';
 export { PROTECTED_BUILTIN_SKILLS } from './constants.ts';
 export interface CuratorConfig {
     staleAfterDays: number;
@@ -95,7 +96,7 @@ export declare function parseCuratorNominations(text: string): CuratorNomination
  * view so the two can never disagree: records failing ANY of these gates are
  * outside the managed scope.
  */
-export declare function lifecycleCandidate(name: string, record: UsageRecord, config: CuratorConfig, bundled: boolean): boolean;
+export declare function lifecycleCandidate(name: string, record: UsageRecord, config: CuratorConfig, bundled: boolean, gates?: EvolutionGateSet): boolean;
 export interface ScopeView {
     /** Skills inside the lifecycle scope right now (candidate gate + active state). */
     managed: string[];
@@ -114,6 +115,6 @@ export interface ScopeView {
  * curator pass may touch. `protectedNames` carries the marker info the usage
  * records lack (bundled / hub-installed / pinned from `SkillLibrary.list()`).
  */
-export declare function computeScopeView(usage: UsageMap, config: CuratorConfig, protectedNames?: ReadonlyMap<string, string>): ScopeView;
-export declare function computeLifecycleTransitions(usage: UsageMap, config: CuratorConfig, now?: Date): CuratorResult;
+export declare function computeScopeView(usage: UsageMap, config: CuratorConfig, protectedNames?: ReadonlyMap<string, string>, gates?: EvolutionGateSet): ScopeView;
+export declare function computeLifecycleTransitions(usage: UsageMap, config: CuratorConfig, now?: Date, gates?: EvolutionGateSet): CuratorResult;
 //# sourceMappingURL=curator.d.ts.map

package/lib/types/gates.d.ts

@@ -0,0 +1,38 @@
+/**
+ * The control-plane protection sets, held once and queried everywhere
+ * (decision B, rc.44 plan M2): the lifecycle engine, the scope view, the LLM
+ * nomination gate and the control-plane consolidate all answer "is this name
+ * off limits — and why" from the same instance, so the gate sets can never
+ * drift apart the way the three pre-rc.46 implementations did.
+ *
+ * Scope boundary: a GateSet covers NAME-SET protections only. Marker-based
+ * protections (pinned / bundled / hub-installed) are file markers resolved by
+ * `SkillLibrary.writeProtection` / `deleteProtection` — they depend on the
+ * filesystem and the write origin, not on a name list.
+ * @module @deepseek-ai/dsh-evolution-core
+ */
+export type GateReason = 'excluded' | 'referenced' | 'suppressed' | 'protected-builtin';
+export interface GateSetInputs {
+    exclude?: ReadonlySet<string> | undefined;
+    referenced?: ReadonlySet<string> | undefined;
+    suppressed?: ReadonlySet<string> | undefined;
+}
+export declare class EvolutionGateSet {
+    readonly exclude: ReadonlySet<string>;
+    readonly referenced: ReadonlySet<string>;
+    readonly suppressed: ReadonlySet<string>;
+    constructor(inputs?: GateSetInputs);
+    /**
+     * The first protection blocking this name, or null. Any hit blocks — the
+     * order is diagnostic only, so a name in two sets reports the first.
+     */
+    blockReason(name: string): GateReason | null;
+    isBlocked(name: string): boolean;
+}
+/** Build a GateSet from the curator-style config field names. */
+export declare function createGateSet(config: {
+    excludeSkillNames?: ReadonlySet<string>;
+    referencedSkillNames?: ReadonlySet<string>;
+    suppressedNames?: ReadonlySet<string>;
+}): EvolutionGateSet;
+//# sourceMappingURL=gates.d.ts.map

package/lib/types/index.d.ts

@@ -8,6 +8,7 @@
  * @module @deepseek-ai/dsh-evolution-core
  */
 export * from './curator.ts';
+export * from './gates.ts';
 export * from './events.ts';
 export * from './io.ts';
 export * from './learn-prompt.ts';

package/lib/types/prompts.d.ts

@@ -3,14 +3,14 @@
  * changes semantically: the bundle digest is the fail-closed signal for
  * review workers, so a stale id across deployments must be distinguishable.
  */
-export declare const PROMPT_BUNDLE_ID = "dsh-evolution@2";
-export declare const PROMPT_BUNDLE_VERSION = 2;
+export declare const PROMPT_BUNDLE_ID = "dsh-evolution@3";
+export declare const PROMPT_BUNDLE_VERSION = 3;
 export declare const MEMORY_REVIEW_PROMPT = "[Auto-review \u2014 Memory]\nReview the conversation above and consider saving to memory if appropriate.\n\nFocus on:\n1. Has the user revealed things about themselves \u2014 persona, desires, preferences, or personal details worth remembering?\n2. Has the user expressed expectations about how you should behave, their work style, or ways they want you to operate?\n\nIf something stands out, save it using the memory tool.\nIf nothing is worth saving, just say \"Nothing to save.\" and stop.";
-export declare const SKILL_REVIEW_PROMPT = "[Auto-review \u2014 Skills]\nReview the conversation above and update the skill library. Be ACTIVE \u2014 most sessions produce at least one skill update, even if small.\n\nTarget shape: CLASS-LEVEL skills with a rich SKILL.md and a references/ directory for session-specific detail. Not a flat list of narrow one-session skills.\n\nSignals that warrant action:\n- The user corrected your style, tone, format, verbosity, workflow, or approach.\n- A non-trivial technique, fix, workaround, or debugging path emerged.\n- A loaded skill turned out wrong, missing, or outdated \u2014 patch it now.\n\nPreference order:\n1. Patch a skill that was loaded or read this session.\n2. Patch an existing umbrella skill.\n3. Add references/, templates/, or scripts/ support under an existing skill.\n4. Create a new class-level umbrella skill only when nothing fits.\n\nProtected skills (bundled/hub-installed) must not be edited. Pinned skills may be patched but not archived.\n\nDo NOT capture:\n- Environment-dependent failures (missing binaries, unconfigured credentials).\n- Negative claims about tools (\"browser tools do not work\").\n- Transient errors that resolved during the session.\n- One-off task narratives.\n\nIf a tool failed because of setup state, capture the FIX under an existing setup skill \u2014 never \"this tool does not work\" as a standalone constraint.\n\n\"Nothing to save.\" is a real option but should NOT be the default.";
-export declare const COMBINED_REVIEW_PROMPT = "[Auto-review]\nReview the conversation above and update two things.\n\n**Memory**: who the user is. Save durable user preferences, personal details, and expectations with the memory tool.\n\n**Skills**: how to do this class of task. Be ACTIVE. Follow the same class-level umbrella policy, preference order, protected-skill rules, and do-not-capture list as a skill review.\n\nAct on whichever dimension has real signal. If genuinely nothing stands out on either, say \"Nothing to save.\" and stop \u2014 but don't reach for that conclusion as a default.";
+export declare const SKILL_REVIEW_PROMPT = "[Auto-review \u2014 Skills]\nReview the conversation above and update the skill library. Be ACTIVE \u2014 most sessions produce at least one skill update, even if small.\n\nTarget shape: CLASS-LEVEL skills with a rich SKILL.md and a references/ directory for session-specific detail. Not a flat list of narrow one-session skills.\n\nSignals that warrant action:\n- The user corrected your style, tone, format, verbosity, workflow, or approach.\n- A non-trivial technique, fix, workaround, or debugging path emerged.\n- A loaded skill turned out wrong, missing, or outdated \u2014 patch it now.\n\nOnly update skills you loaded or read in THIS session; never touch skills you have not read.\n\nPreference order:\n1. Patch a skill that was loaded or read this session.\n2. Patch an existing umbrella skill.\n3. Add references/, templates/, or scripts/ support under an existing skill.\n4. Create a new class-level umbrella skill only when nothing fits.\n\nProtected skills (bundled/hub-installed) must not be edited. Pinned skills are read-only to the background review: the pinned write guard refuses background changes, so only the foreground may update or archive them.\n\nDo NOT capture:\n- Environment-dependent failures (missing binaries, unconfigured credentials).\n- Negative claims about tools (\"browser tools do not work\").\n- Transient errors that resolved during the session.\n- One-off task narratives.\n\nIf a tool failed because of setup state, capture the FIX under an existing setup skill \u2014 never \"this tool does not work\" as a standalone constraint.\n\n\"Nothing to save.\" is a real option but should NOT be the default.";
+export declare const COMBINED_REVIEW_PROMPT = "[Auto-review]\nReview the conversation above and update two things.\n\n**Memory**: who the user is. Save durable user preferences, personal details, and expectations with the memory tool.\n\n**Skills**: how to do this class of task. Be ACTIVE. Only update skills you loaded or read in THIS session. Follow the same class-level umbrella policy, preference order, protected-skill rules, and do-not-capture list as a skill review.\n\nAct on whichever dimension has real signal. If genuinely nothing stands out on either, say \"Nothing to save.\" and stop \u2014 but don't reach for that conclusion as a default.";
 export declare const CURATOR_PROMPT = "You are the skill curator. Maintain a healthy, class-level skill library, not a flat pile of narrow one-session skills.\n\nThe goal is a LIBRARY OF CLASS-LEVEL INSTRUCTIONS. A skill collection of many narrow skills where each captures one session's specific bug is a FAILURE of the library. An agent searching skills matches on descriptions, not exact names; one broad umbrella with labeled subsections beats five narrow siblings for discoverability.\n\nRight target shape: class-level skills with rich SKILL.md + references/, templates/, scripts/ support files for session-specific detail.\n\nHard rules:\n1. NEVER hard-delete a skill. Archive (moving to .archive/) is the maximum destructive action; archives are recoverable, deletion is not.\n2. Do not touch bundled, hub-installed, pinned, or scheduled-task-referenced (`referenced`) skills. Referenced skills MAY be consolidated into an umbrella, but never simply pruned.\n3. Do not archive recently-created or never-used skills without strong evidence. \"use=0\" is NOT evidence either way \u2014 it only means the trigger has not come up yet.\n4. Do NOT reject consolidation on the grounds that \"each skill has a distinct trigger\". The right bar is: would a human maintainer write this as N separate skills, or one skill with N labeled subsections? When the answer is the latter, merge.\n5. Judge overlap on CONTENT, not on usage counters.\n6. Before archiving a merged skill, ensure its unique content was preserved in the umbrella.\n\nHow to work:\n1. Scan the candidate list. Identify PREFIX CLUSTERS \u2014 skills sharing a first word or domain keyword (expect 10-25 clusters).\n2. For each cluster with 2+ members, ask \"what is the UMBRELLA CLASS these skills serve?\" and consolidate:\n   a. MERGE INTO AN EXISTING UMBRELLA (patch a labeled section for each sibling's unique insight, then archive the siblings).\n   b. CREATE A NEW UMBRELLA SKILL.md covering the shared workflow with short labeled subsections, then archive the absorbed siblings.\n   c. DEMOTE session-specific detail to references/, templates/, or scripts/ under the umbrella.\n3. Keep the umbrella body tight and scannable: exact commands, verbatim paths, ~100-200 lines; never invent flags or APIs.\n\nProduce a YAML summary with exactly this shape:\nconsolidations:\n  - from: <old-skill-name>\n    into: <umbrella-skill-name>\n    reason: <one short sentence>\nprunings:\n  - name: <skill-name>\n    reason: <one short sentence>\nNominate a pruning only when archival is clearly safe (stale AND genuinely obsolete or fully absorbed elsewhere).";
 export declare const CURATOR_DRY_RUN_BANNER = "\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\nDRY-RUN \u2014 REPORT ONLY. DO NOT MUTATE THE SKILL LIBRARY.\n\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n\nThis is a PREVIEW pass. Follow every instruction above EXCEPT:\n  \u2022 Do NOT call skill_manage with action=create, update, patch, delete, write_file, or remove_file.\n  \u2022 Do NOT move, copy, or rewrite any file under the skills tree.\n\nYour output IS the deliverable: produce the exact same human-readable summary and YAML block you would on a live run, describing the actions you WOULD take. A reviewer will decide whether to approve a live run.\n\nIf you accidentally take a mutating action, say so explicitly in the summary.";
-export declare const COMPLETION_SKILL_REVIEW_PROMPT = "[Auto-review \u2014 Skills \u00B7 task complete]\nYour current task now appears complete. Before wrapping up, review the approach and update the skill library via skill_manage.\n\nFollow the skills review policy: be ACTIVE, prefer class-level umbrellas, patch skills loaded this session, and capture non-trivial techniques and user corrections. Do NOT capture environment-dependent failures, negative claims about tools, or one-off task narratives.\n\nDo NOT modify output files or re-run the task. If you are still mid-task, ignore this.";
+export declare const COMPLETION_SKILL_REVIEW_PROMPT = "[Auto-review \u2014 Skills \u00B7 task complete]\nYour current task now appears complete. Before wrapping up, review the approach and update the skill library via skill_manage.\n\nFollow the skills review policy: be ACTIVE, prefer class-level umbrellas, patch ONLY skills loaded or read this session, and capture non-trivial techniques and user corrections. Do NOT capture environment-dependent failures, negative claims about tools, or one-off task narratives.\n\nDo NOT modify output files or re-run the task. If you are still mid-task, ignore this.";
 export declare function reviewPrompt(kind: 'memory' | 'skill' | 'combined'): string;
 export interface PromptBundle {
     id: string;

package/lib/types/skill-store.d.ts

@@ -60,6 +60,20 @@ export interface ArchiveOptions {
     allowBundled?: boolean;
 }
 export declare function skillsRoot(env?: NodeJS.ProcessEnv): string;
+/**
+ * Map a requesting session onto the two origin surfaces (rc.44 plan M2-2.3):
+ * the APPROVAL surface treats every delegated subagent as the autonomous
+ * review channel, while the LIBRARY surface keeps the Hermes distinction -
+ * the review fork is 'background_review' (the pinned guard blocks its
+ * writes) and any other subagent is 'subagent' (agent-authored, not
+ * review-channel). `isReview` marks the caller as the background review
+ * pipeline itself. Single source: the two tools and the review executor all
+ * read this table instead of re-deriving it.
+ */
+export declare function resolveOrigins(headerOrigin: string | undefined, isReview?: boolean): {
+    approval: 'foreground' | 'background_review';
+    library: WriteOrigin;
+};
 export interface Frontmatter {
     name?: string;
     description?: string;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@lmzhen/dsh-evolution-core",
   "description": "Shared stores, prompts, signals and lifecycle logic for the dsh-evolution plugin family (community build)",
-  "version": "0.1.0-rc.45",
+  "version": "0.1.0-rc.46",
   "publishConfig": {
     "access": "public"
   },