@mars.liu/dsh-cybernetics 0.6.0 → 0.7.8

package/README.md

@@ -20,6 +20,99 @@ task agent → verify agent → triage agent，controller 在轮间推进，用
 
 ## 状态
 
+v0.7：**全量 goal 模式（`allGoalsMode`，默认 false）**——开启后注入「ALL-GOALS MODE ACTIVE」
+路由协议：任何用户请求一律先建 goal 再执行（禁止就地分析）；简单只读 → quick 单轮；
+复杂分析/写任务 → full 多轮渐进（start 异步 + collect 收敛）；revise 缺省 `abortPrevious`
+改为自动决策树（查 goal 板 running 状态：旧轮在跑且 objective/depth 被改写 → 自动中止；
+旧轮在跑但目标不变 → 等待自然结束；旧轮未跑 → 直启），显式传值仍是人工控制。
+每次修订的 `revisions-<新goalId>.jsonl` 审计行新增 `abort: {abort, mode, basis}`；
+`revise` 返回值同样携带 `abort`。决策树纯函数在 `src/controller.ts` 的 `decideAbort`。
+关闭模式时提示段与 revise 行为与 v0.6 完全一致（离线测试 48–50 锁死）。`src/` 改动需宿主重载。
+v0.7.1：**插件配置面板可视化配置**——`src/index.ts` 导出 schemastery `Config` schema，宿主
+0.1.7 settings model 据此派生 Web 编辑器插件条目的设置页（机制同 `@linxin666/dsh-ssh` /
+`@linxin666/dsh-usage`：loader 经 `runtime.Config['~standard'].validate` 解析配置，面板由
+dsh-client-ui-settings 的共享配置表单渲染，含每个字段的 `description` 文案）。
+`allGoalsMode` 标记 `.volatile()`：在面板上切换保存后 loader 直接把新值提交进运行实例
+（不 remount），提示段经 `loader/volatile-update` 重挂即时生效；`hardGate`/`gateMode`/
+`gatedTools`/`roles` 等结构性字段为普通字段，保存后触发插件行 remount（需宿主重载完成）。
+注意：schema 解析会把未设置的 `z.array` 字段变成 `[]` 而非 `undefined`，`apply()` 的门
+回退因此按「空数组 = 未设置」处理（离线测试 51 锁死）。此前版本只能手改 profile JSON
+里的 `allGoalsMode: true`；现在在 Web 编辑器「插件」页的本插件卡片上直接切换
+即可（保存 volatile 字段无需重启宿主，刷新浏览器可见最新面板）。
+v0.7.2/0.7.3：**插件页设置卡片**——实测仅有服务端 Config schema 不会在「插件」页产生任何
+卡片（本 profile 的 @linxin666/dsh-client-ui-plugin-manager 停用了官方 ui-settings-plugins
+设置分区，schema 自动面板无处落脚）。官方插件页（@deepseek-ai/dsh-client-ui-plugin-manager）
+只通过它声明的 slot 渲染插件配置：`plugins.item`（「内置插件配置」分组列表卡）、
+`plugins.bundle.config`（按 bundle 名分发，bundle 详情页配置区）、`plugins.row.config`
+（按 `<bundle>#<rowId>` 分发，组件详情页）。`lib/client.js` 因此注册三个席位：
+`plugins.item`（id = `dsh-cybernetics`）、`plugins.bundle.config`（key 同时注册
+profile 依赖名 `dsh-cybernetics` 与包名 `@mars.liu/dsh-cybernetics`）、`plugins.row.config`
+（key `<bundle>#dsh-cybernetics`）。`plugins.item` 无条件注册（v0.7.5 加固）：早先的
+cut 用 `configForms.whileServed` 门控，宿主尚未服务该命名空间时整张卡消失，与「注册
+从未运行」不可区分；现改为 `ctx.configForms.get()` 绑定一个跟随共享 describe mirror
+的活 ConfigFormController，命名空间就绪的瞬间卡片翻成开关，未就绪时渲染
+「配置不可用」行——可见、可诊断。卡片读写 `ctx.configForms.get('dsh-cybernetics')`
+的 ConfigForm；v0.7.3 修复：详情页的 owner prop `form`（宿主 ConfigPageForm
+`{state, mutate}`）在渲染 seam 上覆盖 inject 的 form（renderer renderEntry 先展开
+inject 后展开 ownerProps），卡片两种形态都支持（离线测试 52/53 锁死）。
+`dsh.client.inject` 增补 `@deepseek-ai/dsh-client-ui-settings` 保证 configForms 提供方
+先到。改动 `lib/client.js` 后需重启宿主（客户端模块图在宿主启动时构建）并刷新浏览器。
+v0.7.4：**保存失败可见化**——实机验证（2026-11-03，浏览器实测）：卡片注册、summary 文案、开关渲染
+均正常，但切换保存经 `configForms`→`remote.settings.mutate` 到宿主后被**静默拒绝**（写不落盘：
+profile `cordis.patch.yml` 未变更，RPC 错误不上控制台，卡片此前 `.catch(() => {})` 吞掉失败，
+第一次点击甚至把 promise 挂死在「保存中」）。离线模拟宿主 `dsh-config-editor.edit` 的文档校验
+（`composeEntries([patches])` 含 bundle insert 层 + 新增 override 行）是**通过**的，说明拒绝发生在
+更早的环节（`reconcileProfilePatches` 预检 / loader 热重载路径），宿主日志在本环境不可读，确切
+拒绝原因待宿主侧确认。本轮改动：卡片不再吞错——写入被拒（settles false / reject）或 15 s 未返回
+都显示「保存未生效（宿主拒绝了写入）」并立即把开关还原到宿主确认的快照值；成功路径语义不变
+（volatile 即时生效）。根治写路径需要宿主侧 settings.mutate 的拒绝日志（`harness-log` 或
+`dsh plugin --profile web` 诊断），超出本轮插件仓库边界。
+v0.7.5：**卡片注册无条件化**——见上 v0.7.2/0.7.3 段的 `plugins.item` 说明；
+宿主日志复核（2026-11-03，`~/.dsh/logs/`）：未发现 cybernetics settings mutate 的拒绝
+记录（最近一次启动日志是 EADDRINUSE 的失败实例，当前宿主进程无对应落盘日志），
+写路径的宿主侧根因仍待带日志的复现。
+v0.7.6：**路径 (b) 落点取证 + 拒绝原因透出**——代码级取证（2026-11-04，宿主 checkout 只读）确认：
+`settings.mutate` 的唯一宿主写路径是 `@deepseek-ai/dsh-settings SettingsForms.write` →
+`@deepseek-ai/dsh-config-editor ConfigEditor.edit`，后者写入的就是**用户 patch 行**（在 profile
+`cordis.patch.yml` 追加/更新 `{id, name, config}` 非 insert 行，再以
+`reconcileProfilePatches(root, patches, "dsh", [entry.id])` 应用——见
+`dsh-config-editor/lib/index.js` edit() 的 `findLastIndex` + `document.add({id, name, config})`）。
+即插件侧写入落点**从来就是**宿主允许的用户 patch 行，"写到了 bundle insert 行"的假设不成立；
+实测复现（2026-11-04 浏览器点击开关 + `cordis.patch.yml` mtime 前后比对）显示拒绝发生在宿主
+`edit()` **落盘之前**（文件未被触碰、快速返回 settings/rejected），确切 throw 行仍需宿主侧
+stderr（tty，本环境不可读）。本轮插件侧改动：写入被拒时经插件自有的 `remote.settings.mutate`
+（同一宿主写路径）做**一次无条件 revision 回退写**（expectedRevision 省略 = 宿主文档化的
+无条件写），陈旧 revision 冲突可就地自愈；仍被拒时卡片以
+「保存未生效，宿主拒绝原因：{message}」透出宿主 RemoteError 原文（ConfigFormController 原本把
+错误坍缩成裸 `false`）。离线测试增至 54 项，新增写入落点断言（回退写无 revision、主写成功不触
+回退、无 remote 降级不崩）。
+v0.7.7：**agent 模型字段 volatile 化（表单可写性根治）**——本轮实机复现（2026-11-04 浏览器点击
+插件详情页开关）：写仍被宿主拒绝（快照回弹「全目标模式：关」，profile `cordis.patch.yml` mtime
+21:58:35 未变，拒绝发生在落盘之前），且当前宿主进程 2026-11-03 22:04 启动、早于 v0.7.6 提交
+（00:40），运行中的仍是旧客户端模块。新增宿主侧取证：`@deepseek-ai/dsh-settings` 的
+`volatileForm(schema)`（lib/index.js:122-131）只保留 `.volatile()` 字段作为整个设置表单，
+`write()`（同文件 502-531 行）对每个写入路径做 `isVolatilePath` 检查并抛
+「Config field "…" is not volatile」——即宿主表单**只服务也只接受** volatile 字段；据此把
+taskAgentModel / verifyAgentModel 两个扁平字段也改为 `.volatile()`（此前非 volatile =
+在插件页既不可见也不可写），读取点改为 `readConfigField(config.taskAgentModel, '')` 解包
+活引用（'' = 与 session agent 一致），语义保持「保存后下一轮 goal 即生效，无需重载」。
+离线测试 55 项全过（测试 55 改为断言两字段 volatile + 活引用解析 + readConfigField 解包布线）。
+生效步骤：重启宿主（客户端模块图 + 服务端 schema 都在启动时装配）+ 强刷浏览器；验证步骤：
+插件详情页拨「全目标模式」→ 开关保持 + 摘要行变「全目标模式：开」+ profile patch 出现
+`dsh-cybernetics` 用户行；仍失败时卡片将显示宿主拒绝原文（v0.7.6 面）。
+v0.7.8：**写入落点证明测试（测试 56）**——把宿主 `@deepseek-ai/dsh-settings` write() 的全部
+预写闸门（volatileForm / isVolatilePath / projectForm / mutate op reduce / validatePaths /
+strip + mergeLayers，lib/index.js 122-179 与 488-534 行）逐行复刻，对**真实导出的 Config
+schema** 重放卡片的 toggle 写：开关写通过每一道闸门、经 schemastery 校验
+（= cordis `resolveConfig` 的精确检查）后产出持久化 config，最终落点形状恰为
+`ConfigEditor.edit`（dsh-config-editor lib/index.js 150-155 行）追加到 profile
+`cordis.patch.yml` 的**用户 patch 行** `{id, name, config}`（无 `insert` 键）——即
+`reconcileProfilePatches`（dsh-app-boot lib/index.js:3794）唯一接受的落点。
+负向对照：`hardGate` 等非 volatile 路径在写前即被同一闸门以
+「Config field "hardGate" is not volatile」拒绝、文件不被触碰——这正是 v0.7.4/v0.7.5
+实机观测到的拒绝签名（profile patch mtime 不变、快速 rejected）：**运行中宿主装配的
+插件 schema 若早于 volatile 标注，宿主即在写前拒绝**；生效手段不变：重启宿主装配
+v0.7.7 schema + 强刷浏览器。离线测试增至 56 项。
 v0.6：多 goal session 投影（`cyberneticsGoals`）——goal 板每次变化把本 session 全部 goal 的
 整值快照 append 成一条 `plugin:cybernetics/goals` 事件（可跳过的插件记录，宿主持久化读取安全），
 服务端纯折叠、宿主整值推送，「目标」页签逐条渲染并就地更新；空板回退到 dsh-goal 单 goal 渲染。

package/docs/issue-browser-connection-pool.md

@@ -0,0 +1,79 @@
+# Issue 草稿 / Issue Draft
+
+> 本文件为可直接提交至上游仓库 DeepSeek-AI/deepseek-harness 的 issue 草稿。
+> Title（英文）见下；正文以中文为主，附英文摘要。
+
+---
+
+## Title / 标题
+
+**[EN]** Bug: Persistent SSE/long-polling event streams from client plugins exhaust the browser's per-host HTTP/1.1 connection pool (~6 connections), leaving new API requests (e.g. `/api/pluginManager/listBundles`) queued indefinitely and the page unresponsive
+
+**[ZH]** 各插件常驻 SSE/长轮询事件流占满浏览器对同一 host 的 HTTP/1.1 连接池（约 6 条），导致新请求（如 `/api/pluginManager/listBundles`）无限排队、页面假死
+
+---
+
+## Summary / 摘要（EN）
+
+When multiple DSH web tabs are open against the same host, the browser's per-origin HTTP/1.1 connection limit (~6 sockets in Chrome) is saturated by resident SSE / long-polling event streams opened by client plugins (plus dsh-farm's 5s polling). New requests — e.g. `POST /api/pluginManager/listBundles`, `listPlugins`, `listVersionExemptions`, `schedule/list`, `GET /farm/services` — stay *pending* for 15s+ and end with `net::ERR_ABORTED`, while requests from already-established tabs still return 200. The page appears frozen. Server-side investigation rules out a slow host: `listBundles` is fully synchronous and millisecond-scale, and the host main thread is idle (94% in `kevent`).
+
+---
+
+## 正文 / Body（ZH）
+
+### Environment / 环境
+
+- dsh `0.2.1-rc.3`
+- OS: macOS
+- Browser: Chrome（HTTP/1.1；宿主 server 当前仅支持 HTTP/1.1，未启用 h2）
+- profile 挂载了大量客户端插件（含多个带常驻 SSE/长轮询事件流的插件，以及 dsh-farm 服务）
+- 同一 host 下多标签页使用
+
+### Steps to Reproduce / 复现步骤
+
+1. 启动 DSH web profile，浏览器打开 DSH web 页面（标签页 A），登录。
+2. 再开 1–2 个同 host 的 DSH web 标签页（标签页 B、C），保持打开（各标签页的插件事件流与轮询即开始占用连接）。
+3. 在新标签页中打开插件页（如 plugin manager UI）。
+4. 打开 DevTools → Network 面板，观察：
+   - `POST /api/pluginManager/listBundles`
+   - `POST /api/pluginManager/listPlugins`
+   - `POST /api/pluginManager/listVersionExemptions`
+   - `POST /api/schedule/list`
+   - `GET /farm/services`
+
+### Expected vs Actual / 预期与实际
+
+- **Expected**：上述 API 在毫秒~秒级返回 200，页面正常渲染、可交互。
+- **Actual**：新标签页中上述请求全部 **pending 15s+** 后以 `net::ERR_ABORTED` 失败；与此同时老标签页对同一批 API 的请求仍正常返回 **200**。页面交互假死（点击、渲染均无响应）。独立复现 3 次现象一致。
+
+### Analysis / 根因分析（附证据）
+
+**已排除服务端问题：**
+
+1. 宿主 `listBundles` 实现为全同步逻辑，单次调用仅毫秒级 —— 证据：`dsh-plugin-manager/lib/index.js:1681-1799`。
+2. macOS `sample` 抓栈显示宿主进程主线程空闲，94% 时间停留在 `kevent`（事件循环等待），不存在主线程阻塞。
+3. 未登录状态下直接 curl 该接口，**1ms 返回 401** —— 请求根本没被服务端排队，排除网关/路由层阻塞。
+
+**真实机制：**
+
+- 宿主 server 仅支持 HTTP/1.1（无 h2 多路复用），Chrome 对同一 host 默认仅约 6 条并发 TCP 连接。
+- 每个标签页除 1 条 `/api/remote.mux` WebSocket（WS 不占用 HTTP 连接池）外，各客户端插件还各自打开常驻 **SSE / 长轮询事件流**；dsh-farm 另有**每 5 秒一次**的轮询请求。这些常驻流把 6 条连接持续占满。
+- 于是新标签页发起的普通 API 请求只能在浏览器 socket 池中**无限排队**，直到超时被浏览器 abort（15s+ 后 `net::ERR_ABORTED`），表现为页面假死。这也一并解释了「多标签页导致浏览器失响应」的现象。
+
+### Suggested Fixes / 修复建议（分层）
+
+**宿主 / 上游侧：**
+
+1. **事件通道合并**：将各插件独立的 SSE/长轮询事件流迁移到已存在的 `/api/remote.mux` WebSocket 上复用单一条连接（每标签页一条 WS，多路复用所有插件事件），从根本上消除连接池占用。
+2. **client RPC 加固**：client RPC 增加请求超时与失败重试，避免排队超时后页面无限等待、无恢复路径。
+3. **dsh-farm 轮询降频**：dsh-farm 的 5 秒轮询改为指数退避，或迁移为 WS 推送。
+4. **评估启用 HTTP/2**：宿主 server 评估支持 h2，使浏览器对同一 host 多路复用，绕开 HTTP/1.1 的 6 连接限制。
+
+**用户侧临时缓解：**
+
+- 减少同一 host 下打开的 DSH web 标签页数量；
+- 停用带常驻 SSE/长轮询事件流的插件。
+
+### Additional Context / 补充
+
+以上结论来自对 `0.2.1-rc.3` 的排查：服务端同步实现（`dsh-plugin-manager/lib/index.js:1681-1799`）+ `sample` 主线程空闲证据 + 401 快速返回，三点共同将问题定位在浏览器连接池耗尽，而非宿主处理能力。如需完整排查记录可进一步提供。

package/docs/listBundles-hang-investigation-20261103.md

@@ -0,0 +1,93 @@
+# /api/pluginManager/listBundles 挂起问题排查报告（cybernetics 本轮，只读调研）
+
+日期：2026-11-03（本地 23:39–00:02）
+执行者：task agent（dsh-cybernetics 会话，宿主 checkout 只读）
+
+## 结论（一句话）
+
+`/api/pluginManager/listBundles` 挂起**不是** listBundles 实现慢或死锁，也**不是**插件页重复调用导致宿主扫描过重；
+它是**浏览器对 HTTP/1.1 同一 host 的连接池（约 6 条）被大量常驻长连接（WS 之外的 SSE/事件流 + 轮询）占满后，
+新请求在浏览器侧排队、永远等不到 socket** 的现象。宿主进程主线程空闲、从未收到/处理这些请求。
+多标签页打开 GUI 时每个标签都会新增一条 `/api/remote.mux` WebSocket + 多条事件流，迅速耗尽 6 条池连接——
+这正是"多标签页导致浏览器失去响应"和"插件页卡片链路（listBundles/listPlugins）被阻塞"的共同根源。
+
+## 复现（真实环境，证据）
+
+- 三次独立复现（三个全新浏览器会话，23:41 / 23:48 / 23:55）：带登录态 `POST /api/pluginManager/listBundles`
+  7.6s/15.6s/8.3s 超时，`net::ERR_ABORTED`，**从未收到响应头**（CDP 网络捕获：request state=failed/pending，
+  response_body unavailable）。同法 `pluginManager/listPlugins`、`listVersionExemptions`、`schedule/list` 同样挂起。
+- 未登录 `curl -X POST http://127.0.0.1:3080/api/...` → **401，1ms 内返回**（说明 HTTP 服务、路由、admit 全部正常）。
+- 宿主进程 `sample 39225`（端口 3080 监听者）：主线程 2260 个采样中 2121 个停在 `kevent`（事件循环空闲等待），
+  **没有阻塞**；常驻内存 1.1GB（另一个值得关注的独立问题）。
+- 用户实际打开插件页（/plugins/??…）时，整页请求全部 pending：`/farm/services`（×6，5 秒重试堆积）、
+  `/api/pluginManager/listPlugins`、`/api/pluginManager/listBundles`、`/api/schedule/list`、`/api/commands/list`、
+  `/api/skills/list`、`/api/credentials/describe`（×3）、`/api/pet/*`、`/api/skin-center/*`、
+  `/api/dsh-usage/overview`（20 秒后被页面自身超时中止）——见 CDP capture `listBundles-hang`（116 条请求，~25 条 pending）。
+- `lsof -nP -iTCP:3080`：Chrome 持有 **17 条** ESTABLISHED 连接；`curl -I` 确认服务器为 **HTTP/1.1**（无 h2）。
+  Chromium 对 HTTP/1.1 同一 host 的并发连接上限为 6；WS 不占该池，SSE/普通 fetch 占用。
+
+## 代码证据（文件+行，均为只读引用）
+
+1. listBundles 本身是**全同步**方法，不可能自行挂起：
+   - `@deepseek-ai/dsh-plugin-manager/lib/index.js:1681`（`listBundles()`，profile 与全局安装 diff 为 SAME）
+   - 实现内只有 `readFileSync`/YAML 解析（`lib/index.js:1766-1799` 收尾 `return Promise.resolve(bundles)`）；
+     实测量级：80 个依赖的 package.json 共 223KB + 57 个 patch 文件 15KB，单次调用远小于 100ms。
+2. 分发链路也没有异步等待点（profile 与全局 SAME）：
+   - `@deepseek-ai/dsh-client-connection/lib/index.js:1045-1062`：`/api` 路由 admit（401 快路径）→ `bridge` →
+     `rpcFetchHandler.fetch`（:871-913）→ gateway `dispatchRpc`。
+   - `@deepseek-ai/dsh-api-gateway/lib/index.js:961-978`（dispatchRpc/invokeRpc）、`:1190-1230`（prepareInvocation，
+     strict 描述符 `invocation:{kind:'direct'}`，见 `dsh-plugin-manager/lib/typert.host.js:580-604`）→ 同步调用业务方法。
+3. 浏览器侧传输（挂起真正发生的地方）：
+   - `@deepseek-ai/dsh-client-connection/lib/client.browser.js:1209-1237`（`createWebConnectionRpc.call`）：
+     普通 `fetch(POST /api/<endpoint>)`，**无超时**；请求发不出去（池排队）时 promise 永远 pending。
+   - WS 通道 `/api/remote.mux` 定义于 `dsh-api-gateway/lib/index.js:133`；浏览器每页一条
+     （`dsh-api-gateway/lib/client.browser.js:1630`），WS 不占 HTTP 池，但每个标签的 SSE/事件流占用。
+4. 放大器（插件侧）：
+   - `dsh-farm/client.js:209`：`setInterval(refresh, 5000)` —— 每个挂载了 farm 面板的标签每 5 秒打一次
+     `/farm/services`；请求排队后，每个 tick 再堆一条 pending（捕获中同一 tab 堆了 6 条）。
+   - 插件页自身的读组逻辑 `@linxin666/dsh-client-ui-plugin-manager/lib/client.js:635`（readGroup 并发调
+     listPlugins + listBundles）本身频率合理，不是问题源头。
+
+## 与委托书预期的偏差
+
+- 委托书假设"listBundles 读多少文件/扫多少目录/等待锁导致挂起"——已排除：实现同步、量级小、
+  宿主主线程空闲、且同时段 `/farm/services` 等非 RPC 路由同样挂起。
+- 委托书假设"SSE 资源耗尽"——**方向正确**：耗尽的是浏览器每 host 6 条的 HTTP/1.1 连接池，
+  被 GUI 各标签的常驻事件流（以及每标签 1 条 WS 之外的 SSE 类流）占满。
+- 与并行 goal cyb-30cba954 的关系：其结论"listBundles 挂起阻塞插件页"成立，但归因（宿主实现）
+  需修正为浏览器连接池饥饿；其改动（cordis.patch.yml / lib/client.js，dsh-cybernetics 仓库）不受影响。
+
+## 修复建议分层
+
+### A. 用户侧（立即生效，无需改码）
+- 关闭多余的 GUI 标签页（尤其是停留在插件页/看板页的后台标签），挂起的 listBundles 立即恢复返回。
+
+### B. 插件侧（可落地，但不在本轮可写仓库内）
+本轮可写仓库为 `/Users/mars/jobs/dsh-cybernetics`（dsh-cybernetics），其 client 不发起任何常驻 HTTP 流
+（`lib/client.js` 只使用宿主提供的 faces），**无该问题的可落地修复点** —— 按验收项 2 如实报告"本仓库无可行插件侧方案"。
+真正值得改的插件（均在只读 profile 内，属下一轮或对应仓库任务）：
+- `dsh-farm/client.js:209`：把固定 5s 轮询改为事件驱动/指数退避 + `document.visibilityState==='hidden'` 时暂停；
+- 各自维护 SSE/长轮询的插件（taskboard events、convmap、pet 等）合并为共享一条流或迁移到 `/api/remote.mux` WS 复用；
+- `@linxin666/dsh-client-ui-plugin-manager`：对 readGroup 结果做 30-60s 内存缓存，失败重试加退避，
+  避免排队期间反复堆叠请求。
+
+### C. 宿主/上游侧（建议补丁位置，未修改）
+- 核心：减少长连接对浏览器 6-socket 池的占用。`@deepseek-ai/dsh-api-gateway/lib/index.js:133`
+  已有 WS mux（`/api/remote.mux`）承载 Typert 流；建议上游把插件自定义事件通道统一迁移到该 mux
+  的逻辑流（open/item/end/cancel 帧协议已在 `stream-protocol` 实现），或提供官方 SSE→WS 复用桥。
+- 次要：`@deepseek-ai/dsh-client-connection/lib/client.browser.js:1209` 的 `createWebConnectionRpc.call`
+  增加可配置超时（如 AbortSignal.timeout(30s)），把"永远 pending"变成可见错误；
+  `dsh-host-webserver` 可考虑响应头提示或文档说明 HTTP/1.1 单 host 限制。
+- 观察项：宿主进程 RSS 1.1GB（sample 输出 Physical footprint），建议上游加内存基线告警（独立问题）。
+
+## 验证方式（可复现命令）
+1. `curl -o /dev/null -w '%{http_code} %{time_total}\n' -X POST -H 'content-type: application/json' -d '{}' http://127.0.0.1:3080/api/pluginManager/listBundles` → `401 0.001`（服务正常）。
+2. `sample <node-pid> 3` → 主线程 kevent 空闲（服务未阻塞）。
+3. 登录态浏览器 `fetch('/api/pluginManager/listBundles', {method:'POST', ...})` + AbortController(8s) → 挂起；
+   同时 `lsof -nP -iTCP:3080` 数 Chrome ESTABLISHED ≈17（HTTP/1.1，池 6）。
+4. CDP 网络捕获：新开插件页后 `/api/pluginManager/listBundles`、`/api/schedule/list`、`/farm/services` 全部 pending。
+
+## 风险与残余不确定
+- "池排队"是从浏览器外部可观测行为（请求未送达 + 服务空闲 + 旧连接正常 + HTTP/1.1 + 连接数）反推的最优解释；
+  如需 100% 确证，可用 chrome://net-export 抓一次 net-log（需要用户配合，本轮未做）。
+- 未修改任何文件；未运行测试（纯只读调研轮，无代码变更故无测试项）。

package/docs/protocol.md

@@ -1,7 +1,41 @@
-# Cybernetics 工作协议 v0.6（设计稿）
+# Cybernetics 工作协议 v0.7（设计稿）
 
 目标-行动-测量-校准的迭代回路，构建在 DSH 的 `dsh-workflow` 编排与 `dsh-goal` 持久目标之上。
 
+## v0.7 已实现：全量 goal 模式（allGoalsMode）
+
+配置项 `allGoalsMode`（默认 **false**——关闭时注入的提示段、revise 行为与 v0.6 完全一致）。
+开启后在隐式触发段后追加「ALL-GOALS MODE ACTIVE」路由协议，四条路由规则：
+
+> 配置入口（v0.7.1）：插件导出 schemastery `Config` schema，`allGoalsMode` 为 volatile 字段——
+> 在 DSH Web 编辑器 Settings → Plugins 的本插件条目面板上直接切换，保存后 loader 把新值
+> 提交进运行实例（不 remount），提示段即时重挂。无需再手改 profile JSON。
+
+1. **全量进 goal**：任何用户请求（问题、检索、分析、改动）一律先建 goal（action `'start'` +
+   title/brief）再由 task agent 执行；session agent 禁止用读工具就地完成任务——哪怕单文件
+   查询或一次计算也走回路。硬门关闭时协议同样禁止就地改动：必须委派。
+2. **简单只读请求 → depth `'quick'`**：单 task agent 一轮，跳过 verify/triage，结果直接反馈
+   （有界查询、单文件读取、小型统计）。
+3. **复杂分析 / 写任务 → depth `'full'` 多轮渐进**：action `'start'` 异步启动，逐轮 `'collect'`
+   收敛，controller 按轮推进 subgoal（task → verify → triage）。分析型 = 取数落盘、数据集、
+   统计、多步查询规划；写任务额外依赖硬门——session agent 永不亲自执行改动，goal 回路是
+   唯一路径，改动再小也一样。
+4. **revise 自动决策树**：修订仍是 append-only（新 goal + `parentGoalId`，旧 goal 置
+   `superseded`，`'revise'` 是唯一目标变更动词），但 `abortPrevious` 缺省时按旧 task agent
+   状态自动决策（数据来自现有 goal 板 running 状态，不新增编排机制）：
+   - (a) 旧轮**在跑**且修订改写目标本身（传入 `objective`，或 `depth` 变化）→ 目标矛盾/
+     写域冲突 → **自动中止旧轮**（复用 cancel 路径），等价 `abortPrevious: true`；
+   - (b) 旧轮**在跑**但目标不变（仅 brief/title/role 修正），旧工作仍可复用/可并行 →
+     **等待旧轮自然结束**，等价 `abortPrevious: false`；
+   - (c) 旧 task agent **已结束**（goal 板上该 goal 非 running）→ **直接启动新 goal**，
+     不做任何中止动作。
+   显式传 `abortPrevious: true/false` 保持 v0.6 人工控制语义（决策树让位）。每次修订的
+   `.cybernetics/revisions-<新goalId>.jsonl` 审计行新增 `abort` 字段
+   `{abort, mode: 'auto'|'explicit', basis}`，记录选择的分支与依据；`revise` 返回值同样携带。
+
+实现落点：`src/controller.ts` 的纯函数 `decideAbort`（决策树 + basis 文案）；
+`src/index.ts` 的 `ALL_GOALS_GUIDANCE` 提示段与 revise 路径接线。`src/` 改动需宿主重载生效。
+
 ## v0.6 设计：与 Agent Teams 集成
 
 2026-11-02 与用户逐条定稿的设计决策。第 0 步验证实验已完成（见文末）；执行者适配层

package/lib/client.js

@@ -1,4 +1,8 @@
-// dsh-cybernetics client module: the「目标 / Goal」conversation tab.
+// dsh-cybernetics client module: the「目标 / Goal」conversation tab, the
+//「控制」tab, and (v0.7.2+, fixed in v0.7.3) the allGoalsMode settings card
+// seated on the official Plugins page (plugins.item / plugins.row.config /
+// plugins.bundle.config, bound to the row's ConfigForm in either of the two
+// shapes the seats deliver — volatile writes stay live without a restart).
 // Rendered from the session's `goal` projection (dsh-goal), pushed live by the
 // host — no plugin HTTP route needed. Hand-written ModuleLoader wrapper, same
 // format the host bundler emits (see dsh-context / dsh-maze client.js).
@@ -62,6 +66,22 @@ window.__ModuleLoader__.load({
 			// v0.6 executor line: the durable teammate's name (persistent only)
 			'goal.member': '成员 {name}',
 			'control.goals': '目标',
+			// v0.7.2 plugins-page settings card (plugins.item / plugins.row.config /
+			// plugins.bundle.config). cardLabel titles the 内置插件配置 group card.
+			'settings.cardLabel': 'Cybernetics 编排循环',
+			'settings.title': '全目标模式',
+			'settings.description': '所有用户请求（含只读问题）必须先经 cybernetics goal。保存后即时生效，无需重载。',
+			'settings.on': '开',
+			'settings.off': '关',
+			'settings.summaryOn': '全目标模式：开',
+			'settings.summaryOff': '全目标模式：关',
+			'settings.unavailable': '配置不可用（设置文档未开放或插件未运行）。',
+			'settings.saving': '保存中…',
+			'settings.saveFailed': '保存未生效（宿主拒绝了写入）。',
+			// v0.7.6 path-(b) diagnostics: the direct settings-transport retry
+			// surfaces the host's exact RemoteError message (the shared
+			// ConfigFormController swallows it into a bare `false`).
+			'settings.saveFailedDetail': '保存未生效，宿主拒绝原因：{message}',
 		};
 		const en = {
 			'view.goal': 'Goal',
@@ -102,6 +122,17 @@ window.__ModuleLoader__.load({
 			'goal.revisedFrom': 'Revised from "{title}"',
 			'goal.member': 'Member {name}',
 			'control.goals': 'Goals',
+			'settings.cardLabel': 'Cybernetics goal loop',
+			'settings.title': 'All-goals mode',
+			'settings.description': 'Every user request (including read-only questions) must go through a cybernetics goal first. Takes effect immediately on save; no reload needed.',
+			'settings.on': 'On',
+			'settings.off': 'Off',
+			'settings.summaryOn': 'All-goals mode: on',
+			'settings.summaryOff': 'All-goals mode: off',
+			'settings.unavailable': 'Configuration unavailable (settings document not served or plugin not running).',
+			'settings.saving': 'Saving…',
+			'settings.saveFailed': 'Save did not take effect (the host refused the write).',
+			'settings.saveFailedDetail': 'Save did not take effect — host refusal: {message}',
 		};
 		//#endregion
 
@@ -394,14 +425,267 @@ window.__ModuleLoader__.load({
 		}
 		//#endregion
 
+		//#region plugins-page settings card (v0.7.2)
+		// The official Plugins page (@deepseek-ai/dsh-client-ui-plugin-manager, the
+		// runtime copy that owns the 内置插件配置/实验性插件/已安装插件 groups) renders a
+		// bundle's own configuration ONLY through the slots it declares:
+		//   plugins.bundle.config  keyed by the bundle name (profile dep name)
+		//   plugins.row.config     keyed by `<bundle name>#<row id>`
+		// (rowConfigKey in that page's client.js; slot contract in
+		// dsh-cordis-client-runner's slot catalog). A server-side Config schema
+		// alone surfaces nowhere once the ui-settings-plugins section is disabled
+		// by the family plugin-manager — exactly the observed gap.
+		// Both entries bind the row's own ConfigForm from ctx.configForms (the
+		// namespace id is the loader row id `dsh-cybernetics`, same convention
+		// @deepseek-ai/dsh-experimental-client-ui-cot-translation uses). A toggle
+		// write goes settings mutate → loader volatile commit
+		// (`loader/volatile-update`), so allGoalsMode stays live without a
+		// restart — the v0.7.1 volatile semantics, unchanged.
+		const SETTINGS_ENTRY_ID = 'dsh-cybernetics';
+		const NO_FORM_SNAP = { status: 'unavailable', value: undefined, writable: false };
+		const noopSubscribe = () => () => {};
+
+		var settingsStyles = {
+			card: { display: 'flex', flexDirection: 'column', gap: 6, padding: '12px 0' },
+			row: { display: 'flex', alignItems: 'center', gap: 12 },
+			main: { display: 'flex', flexDirection: 'column', gap: 2, flex: 1, minWidth: 0 },
+			title: { fontSize: 13, fontWeight: 600 },
+			desc: { fontSize: 12, opacity: 0.65, lineHeight: 1.5 },
+			toggle: {
+				cursor: 'pointer', borderRadius: 999, width: 40, height: 22,
+				border: '1px solid rgba(127,127,127,0.45)', position: 'relative', flex: 'none',
+				background: 'transparent', padding: 0,
+			},
+			knob: {
+				position: 'absolute', top: 2, width: 16, height: 16, borderRadius: 999,
+				transition: 'left .15s ease',
+			},
+			trackOn: { background: '#2da44e', borderColor: '#2da44e' },
+			trackOff: { background: 'rgba(127,127,127,0.25)' },
+			knobOn: { left: 20, background: '#fff' },
+			knobOff: { left: 2, background: 'currentColor' },
+			unavailable: { fontSize: 12, opacity: 0.6 },
+		};
+
+		/**
+		 * One boolean settings row; shared by all three seats. Two form shapes
+		 * reach it, and the card must speak both:
+		 *  - the LIVE ConfigForm this module injects (ctx.configForms.get):
+		 *    getSnapshot / subscribe / set — the only shape on the
+		 *    plugins.bundle.config page and in summary rows, whose owners pass
+		 *    no form of their own;
+		 *  - the HOST's ConfigPageForm { state, mutate }: the plugins.item and
+		 *    plugins.row.config detail pages compute it from the same shared
+		 *    mirror (configForms.get(id).getSnapshot()/mutate) and pass it as
+		 *    an OWNER prop, which spreads AFTER inject at the render seam
+		 *    (@deepseek-ai/dsh-client-ui-renderer renderEntry: ...injected,
+		 *    ...ownerProps) — on those pages this shape WINS over the injected
+		 *    form. Reading `.subscribe` on it crashed the first v0.7.2 cut.
+		 * The host shape carries no subscribe; its `state` is re-computed by
+		 * the owning page on every mirror update, so reading it per render is
+		 * already live.
+		 */
+		function SettingsCard(props) {
+			const t = props.t;
+			const form = props.form;
+			// v0.7.6 path-(b) fallback write face: the plugin's own bound
+			// remote.settings.mutate. SAME host write path as the ConfigForm
+			// (remote.settings.mutate → @deepseek-ai/dsh-settings SettingsForms
+			// → @deepseek-ai/dsh-config-editor edit → the USER patch row
+			// `{id, name, config}` appended to the profile cordis.patch.yml,
+			// reconciled by reconcileProfilePatches) — the only落点 the host
+			// accepts. Used ONLY when the primary write refuses, without an
+			// expectedRevision (the controller documents undefined as an
+			// unconditional write), so a stale-revision refusal heals in place
+			// and a hard refusal surfaces its exact host message instead of a
+			// bare「宿主拒绝了写入」with no reason.
+			const directMutate = props.directMutate;
+			const view = props.view === 'summary' ? 'summary' : 'page';
+			const live = form !== null && typeof form === 'object'
+				&& typeof form.subscribe === 'function' && typeof form.getSnapshot === 'function' && typeof form.set === 'function'
+				? form : undefined;
+			const host = live === undefined && form !== null && typeof form === 'object'
+				&& typeof form.mutate === 'function' && form.state !== null && typeof form.state === 'object'
+				? form : undefined;
+			const liveSnap = react.useSyncExternalStore(
+				live ? (cb) => live.subscribe(cb) : noopSubscribe,
+				live ? () => live.getSnapshot() : () => NO_FORM_SNAP,
+			);
+			const snap = host !== undefined ? host.state : liveSnap;
+			const [saving, setSaving] = react.useState(false);
+			// `false` = no failure; `true` = failure without a host message;
+			// a string = the host's exact refusal (RemoteError.message).
+			const [failed, setFailed] = react.useState(false);
+			const on = snap.status === 'ready' && snap.value != null && snap.value.allGoalsMode === true;
+			const disabled = (live === undefined && host === undefined) || snap.status !== 'ready' || snap.writable === false || saving;
+
+			const toggle = () => {
+				if (disabled) return;
+				setSaving(true);
+				setFailed(false);
+				// Both write paths land in the same host mutation: ConfigForm.set
+				// is one-field sugar over ConfigForm.mutate, and the host's
+				// ConfigPageForm.mutate IS that form's mutate (the expected
+				// revision carried explicitly). The host commits the write into
+				// the running plugin instance (volatile) and the next snapshot /
+				// page render pushes the accepted value back here.
+				// Failure policy (v0.7.4): the transport can REFUSE (settles
+				// false) or stall (the observed "保存中" hang). Neither is
+				// silent: a refused write shows saveFailed for a few seconds,
+				// and a stalled write releases the switch after 15 s with the
+				// same hint — the switch always returns to the snapshot value,
+				// which is the only state the host confirmed.
+				// v0.7.6: a refused write is retried ONCE through the direct
+				// settings transport (props.directMutate, no expectedRevision).
+				// Same落点 (user patch row via configEditor), unconditional
+				// revision — a stale-revision conflict therefore heals, and any
+				// remaining refusal reports its host message verbatim.
+				let settled = false;
+				const finish = (ok, detail) => {
+					if (settled) return;
+					settled = true;
+					setSaving(false);
+					if (!ok) {
+						setFailed(detail || true);
+						setTimeout(() => setFailed(false), 6000);
+					}
+				};
+				const guard = setTimeout(() => finish(false), 15000);
+				const op = { op: 'set', path: ['allGoalsMode'], value: !on };
+				const write = live !== undefined
+					? live.set('allGoalsMode', !on)
+					: host.mutate([op], snap.revision);
+				Promise.resolve(write)
+					.then(async (accepted) => {
+						if (accepted !== false) { clearTimeout(guard); finish(true); return; }
+						if (typeof directMutate !== 'function') { clearTimeout(guard); finish(false); return; }
+						try {
+							const answer = await directMutate([op]);
+							clearTimeout(guard);
+							if (answer && typeof answer === 'object' && answer.ok === false) {
+								finish(false, answer.error && answer.error.message);
+							} else finish(true);
+						} catch (error) {
+							clearTimeout(guard);
+							finish(false, error && error.message);
+						}
+					})
+					.catch((error) => { clearTimeout(guard); finish(false, error && error.message); });
+			};
+
+			if (view === 'summary') {
+				return jsx.jsx('span', { children: snap.status === 'ready' ? t(on ? 'settings.summaryOn' : 'settings.summaryOff') : t('settings.unavailable') });
+			}
+
+			return jsx.jsxs('div', { style: settingsStyles.card, children: [
+				jsx.jsxs('div', { style: settingsStyles.row, children: [
+					jsx.jsxs('div', { style: settingsStyles.main, children: [
+						jsx.jsx('div', { style: settingsStyles.title, children: t('settings.title') }),
+						jsx.jsx('div', { style: settingsStyles.desc, children: t('settings.description') }),
+					] }),
+					snap.status === 'ready'
+						? jsx.jsx('button', {
+							type: 'button', role: 'switch', 'aria-checked': on, 'aria-label': t('settings.title'),
+							disabled, onClick: toggle,
+							style: { ...settingsStyles.toggle, ...(on ? settingsStyles.trackOn : settingsStyles.trackOff) },
+							children: jsx.jsx('span', { style: { ...settingsStyles.knob, ...(on ? settingsStyles.knobOn : settingsStyles.knobOff) } }),
+						})
+						: null,
+				] }),
+				snap.status !== 'ready' ? jsx.jsx('div', { style: settingsStyles.unavailable, children: t('settings.unavailable') }) : null,
+				saving ? jsx.jsx('div', { style: settingsStyles.unavailable, children: t('settings.saving') }) : null,
+				!saving && failed ? jsx.jsx('div', { style: { ...settingsStyles.unavailable, color: '#d29922' }, children: failed === true ? t('settings.saveFailed') : t('settings.saveFailedDetail', { message: failed }) }) : null,
+			] });
+		}
+		//#endregion
+
 		//#region plugin apply
 		const name = 'dsh-cybernetics';
-		const inject = ['slots', 'sessions', 'locale'];
+		// configForms: the per-entry ConfigForm registry (@deepseek-ai/dsh-client-ui-settings)
+		// that backs the plugins-page settings card below.
+		const inject = ['slots', 'sessions', 'locale', 'configForms',
+			// v0.7.6: the settings card's diagnostic fallback write rides the
+			// same namespace remote the official ui-settings declares
+			// (["remote", "remote.settings"]). Both are required: ctx access is
+			// gated by the inject declaration (client-runner guard), so an
+			// undeclared `remote` would throw on read and silently disable the
+			// fallback. Optional at runtime (guarded in apply): a host without
+			// the namespace parks this client module exactly as it would
+			// ui-settings itself — the web profile always serves it.
+			'remote', 'remote.settings'];
 
 		function apply(ctx) {
 			ctx.effect(() => ctx.locale.register(NS, { zh, en }), 'dsh-cybernetics: dictionaries');
 			const t = ctx.locale.bind(NS);
 
+			// v0.7.2: bind the row's ConfigForm once per apply body. The namespace
+			// is the loader row id (`dsh-cybernetics`), the same convention the
+			// official cot-translation bundle uses (`ctx.configForms.get(ns)`). If
+			// the host does not serve this namespace yet, the card renders its
+			// unavailable state instead of throwing.
+			let settingsForm;
+			try {
+				settingsForm = ctx.configForms.get(SETTINGS_ENTRY_ID);
+			} catch {
+				settingsForm = undefined;
+			}
+			// v0.7.6 path-(b) diagnostics face: the direct settings transport,
+			// bound from this module's own context (`remote.settings` inject).
+			// Guarded: a deployment without the namespace leaves it undefined
+			// and the card falls back to the v0.7.4 hint-only failure state.
+			let settingsDirectMutate;
+			try {
+				if (ctx.remote && ctx.remote.settings && typeof ctx.remote.settings.mutate === 'function') {
+					settingsDirectMutate = (ops, expectedRevision) => ctx.remote.settings.mutate(SETTINGS_ENTRY_ID, ops, expectedRevision);
+				}
+			} catch {
+				settingsDirectMutate = undefined;
+			}
+			const settingsInject = () => ({ form: settingsForm, directMutate: settingsDirectMutate });
+			// v0.7.2 (the actual gap): the official Plugins page renders the
+			// 内置插件配置 group cards ONLY from the `plugins.item` slot
+			// (ItemCard in @deepseek-ai/dsh-client-ui-plugin-manager client.js:
+			// basicCards = ledger.items from slot "plugins.item"; ItemDetail
+			// renders view "page" with the host form for item.id). The keyed
+			// seats below surface only on an installed bundle's own page, which
+			// this linked bundle never reaches in the 已安装插件 group — that was
+			// why v0.7.1's schema alone (and the first v0.7.2 cut) showed no card.
+			// Register the list card UNCONDITIONALLY (v0.7.5 hardening): the earlier
+			// cut gated it on configForms.whileServed, so a deployment where the
+			// host does not (yet) serve the `dsh-cybernetics` namespace showed NO
+			// card at all — indistinguishable from the registration never running.
+			// ctx.configForms.get() binds a live ConfigFormController that follows
+			// the shared describe mirror (ConfigForms.get → new ConfigFormController
+			// + mirror.ensure), so a card registered before the namespace appears
+			// flips to the toggle the moment the host starts serving it; while it
+			// does not, the card renders its `settings.unavailable` line — visible
+			// and diagnosable instead of absent.
+			ctx.effect(() => ctx.slots.inject('plugins.item', () => ctx.slots.register({
+				name: 'plugins.item',
+				id: SETTINGS_ENTRY_ID,
+				order: 80,
+				label: () => t('settings.cardLabel'),
+				locale: NS,
+				inject: settingsInject,
+			}, SettingsCard)), 'dsh-cybernetics: plugins-page settings card');
+			// The dispatch key bundles use the profile dependency name (the value
+			// in dsh.profile.bundles = `dsh-cybernetics`); register the scoped
+			// package manifest name too, so either resolution finds the card.
+			for (const bundleKey of ['dsh-cybernetics', '@mars.liu/dsh-cybernetics']) {
+				ctx.slots.inject('plugins.row.config', () => ctx.slots.register({
+					name: 'plugins.row.config',
+					key: bundleKey + '#' + SETTINGS_ENTRY_ID,
+					locale: NS,
+					inject: settingsInject,
+				}, SettingsCard));
+				ctx.slots.inject('plugins.bundle.config', () => ctx.slots.register({
+					name: 'plugins.bundle.config',
+					key: bundleKey,
+					locale: NS,
+					inject: settingsInject,
+				}, SettingsCard));
+			}
+
 			// Conversation-view tab, same slot the trajectory/context tabs use.
 			// `t` reaches the view as a slot-provided prop from `locale: NS`
 			// (PropsLocale) — do NOT also pass a hand-bound t through inject:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mars.liu/dsh-cybernetics",
-  "version": "0.6.0",
+  "version": "0.7.8",
   "private": false,
   "files": [
     "src",
@@ -33,12 +33,16 @@
         "@deepseek-ai/dsh-client-locale",
         "@deepseek-ai/dsh-client-ui-conversation",
         "@deepseek-ai/dsh-client-ui-renderer",
-        "@deepseek-ai/dsh-client-ui-session"
+        "@deepseek-ai/dsh-client-ui-session",
+        "@deepseek-ai/dsh-client-ui-settings"
       ],
       "platform": "web",
       "immediately": true
     }
   },
+  "dependencies": {
+    "@deepseek-ai/schemastery": "^3.18.5"
+  },
   "peerDependencies": {
     "@deepseek-ai/dsh-session": "*"
   }

package/src/controller.ts

@@ -32,6 +32,24 @@ export interface RoleSpec {
   model?: string
 }
 
+/**
+ * Parse a flat agent-model field ("provider/model" or a bare "model" name)
+ * into a workflow `agent()` override. Empty/whitespace/undefined → undefined,
+ * which the caller must treat as「与 session agent 一致」(no override handed
+ * to the round script — the workflow inherits the calling model).
+ */
+export function parseAgentModelSpec(value?: string): RoleSpec | undefined {
+  const raw = (value ?? '').trim()
+  if (!raw) return undefined
+  const slash = raw.indexOf('/')
+  if (slash > 0 && slash < raw.length - 1) {
+    const provider = raw.slice(0, slash).trim()
+    const model = raw.slice(slash + 1).trim()
+    if (provider && model) return { provider, model }
+  }
+  return { model: raw }
+}
+
 /** Per-role sub-agent configuration: 'default'/'verify'/'triage' plus named task roles. */
 export interface RolesConfig {
   default?: RoleSpec
@@ -112,6 +130,68 @@ export interface GoalRevisionRecord {
   reason: string
   /** Epoch milliseconds of the revision. */
   at: number
+  /**
+   * v0.7: how the old goal's in-flight round was handled, and why. Present on
+   * every revision so the audit trail records the decision basis, not just the
+   * outcome — see `decideAbort` for the decision tree.
+   */
+  abort?: { abort: boolean; mode: 'auto' | 'explicit'; basis: string }
+}
+
+/**
+ * Whether `revise` aborts the old goal's in-flight task agent round, and on
+ * what grounds. Pure — the caller supplies the "is a round in flight" fact
+ * from its own `running` map (no new orchestration mechanism; this reads the
+ * state the controller already maintains).
+ *
+ * Decision tree (v0.7 all-goals mode; `abortPrevious` explicitly passed keeps
+ * the v0.6 manual semantics):
+ * 1. `abortPrevious` given explicitly → honor it verbatim (mode 'explicit').
+ * 2. Old goal has NO round in flight → no abort, start the successor directly.
+ * 3. Old round in flight AND the revision rewrites the goal itself (a new
+ *    `objective`, or a different `depth`) → the old round is working toward a
+ *    target that no longer exists — contradictory goals / write-domain
+ *    conflict → abort it (the cancel path) so it cannot interleave writes.
+ * 4. Old round in flight, correction only (new brief / title / role on the
+ *    same objective) → the old work is still valuable and its result can be
+ *    reused → let the round finish naturally, no abort.
+ */
+export interface AbortDecision {
+  abort: boolean
+  mode: 'auto' | 'explicit'
+  basis: string
+}
+
+export function decideAbort(
+  previous: LoopState,
+  roundInFlight: boolean,
+  args: { abortPrevious?: boolean; objective?: string; depth?: 'quick' | 'full' },
+): AbortDecision {
+  if (args.abortPrevious !== undefined) {
+    return {
+      abort: args.abortPrevious,
+      mode: 'explicit',
+      basis: args.abortPrevious
+        ? '调用方显式要求中止旧轮（abortPrevious: true，复用 cancel 路径）'
+        : '调用方显式要求保留旧轮（abortPrevious: false，跑完自然结束）',
+    }
+  }
+  if (!roundInFlight) {
+    return { abort: false, mode: 'auto', basis: '旧 task agent 无在跑轮（查 goal 板 running 状态），直接启动新 goal，无需中止' }
+  }
+  const retargets = args.objective !== undefined || (args.depth !== undefined && args.depth !== (previous.depth ?? 'full'))
+  if (retargets) {
+    return {
+      abort: true,
+      mode: 'auto',
+      basis: '旧轮在跑且修订改写了目标本身（objective/depth 变化，目标矛盾/写域冲突）——自动中止旧轮，避免旧任务继续写入已被取代的方向',
+    }
+  }
+  return {
+    abort: false,
+    mode: 'auto',
+    basis: '旧轮在跑但任务目标未变（仅 brief/title/role 修正，旧工作仍可复用/可并行）——等待旧轮自然结束，结果由新 goal 继承',
+  }
 }
 
 /** Input for the append-only goal creation path. */

package/src/index.ts

@@ -25,8 +25,9 @@ import { randomUUID } from 'node:crypto'
 import { mkdir, readFile, rename, writeFile } from 'node:fs/promises'
 import { join } from 'node:path'
 import { fileURLToPath } from 'node:url'
+import z from '@deepseek-ai/schemastery'
 import {
-  STATE_DIR, createGoal, foldRound, runRound, startRound, supersedeGoal, writeRevisionLog,
+  STATE_DIR, createGoal, decideAbort, foldRound, parseAgentModelSpec, runRound, startRound, supersedeGoal, writeRevisionLog,
 } from './controller.ts'
 import type {
   ControllerConfig, ControllerDecision, LoopState, ResumableReason, RoundResult, RolesConfig,
@@ -68,6 +69,10 @@ export interface Config extends ControllerConfig {
   implicitTrigger?: boolean
   /** Per-role sub-agent model/provider overrides. */
   roles?: RolesConfig
+  /** Flat task-agent model override ("provider/model" or bare model); empty = inherit session agent. */
+  taskAgentModel?: string
+  /** Flat verify-agent model override (same format); empty = inherit session agent. */
+  verifyAgentModel?: string
   /**
    * Hard orchestration gate (default false): hide execution tools from
    * TOP-LEVEL session agents at prompt-assembly time, so the session agent
@@ -89,12 +94,83 @@ export interface Config extends ControllerConfig {
   gateAllowlist?: string[]
   /** Extra tool names unioned onto the allowlist (default or gateAllowlist). */
   gateAllowlistExtra?: string[]
+  /**
+   * All-goals mode (v0.7, default false): EVERY user request — including
+   * trivial read-only questions and lightweight analysis — must go through a
+   * cybernetics goal first; in-place analysis by the session agent is banned.
+   * Off (default) keeps the v0.6 implicit-trigger behavior exactly unchanged.
+   */
+  allGoalsMode?: boolean
 }
 
-// No `Config` export: this cordis requires a schemastery schema there// (Config.validate), which a zero-dependency plugin cannot import. The raw
-// patch config object passes through to apply() unvalidated; fields are
-// optional and read defensively (toolName, roundsPerSubgoal, roundScriptPath,
-// implicitTrigger, roles).
+// Under the host's 0.1.7 settings model, an exported schemastery `Config`
+// schema IS the plugin entry's settings page: the Web editor derives the
+// plugin config form from it and serves it through the shared configuration
+// forms (see @linxin666/dsh-ssh and @linxin666/dsh-usage for the same
+// pattern). At least one field must be `.volatile()` for the page to be
+// served at all; a volatile edit is committed into the running fiber's
+// reference without a remount and announced via `loader/volatile-update`.
+// allGoalsMode is volatile so the panel toggle is live; hardGate and the
+// gate/roles fields are deliberately non-volatile — they change structural
+// wiring (tool stripping listener, per-role routing), so an edit remounts
+// the row, which is the correct behavior for them.
+export const Config = z.object({
+  /** Model-facing tool name. */
+  toolName: z.string().default('cybernetics').description('模型侧工具名（缺省 cybernetics）。'),
+  /** Inject the implicit goal-loop guidance section. */
+  implicitTrigger: z.boolean().default(true).description('注入隐式 goal-loop 系统提示段（缺省开启）。'),
+  /** Per-role sub-agent model/provider overrides: role -> {provider, model}. */
+  roles: z.dict(z.object({
+    provider: z.string(),
+    model: z.string(),
+  })).description('按角色的子 agent provider/model 覆盖：role -> {provider, model}（如 default/verify/triage/frontend）。'),
+  /**
+   * Flat task-agent model override ("provider/model" or a bare model name).
+   * Empty = inherit the session agent. Merged over roles.default at wiring
+   * time (parseAgentModelSpec) — the flat fields are the settings-panel face;
+   * roles stays the canonical runtime shape the round script consumes.
+   * Volatile (v0.7.7): the host settings form (@deepseek-ai/dsh-settings
+   * volatileForm, lib/index.js:122-131) serves ONLY `.volatile()` fields, and
+   * its write() refuses any non-volatile path ("Config field ... is not
+   * volatile") — a plain field is invisible AND unwritable on the plugins
+   * page. Volatile commit keeps the running instance live; the value is read
+   * per round start (readConfigField unwrap below), so an edit takes effect
+   * on the next goal round without a remount.
+   */
+  taskAgentModel: z.string().default('').volatile().description('task agent 模型覆盖（「provider/model」或裸模型名）；留空 = 与 session agent 一致。保存后下一轮 goal 即生效，无需重载。'),
+  /** Flat verify-agent model override; same format, fallback and volatile semantics as taskAgentModel. */
+  verifyAgentModel: z.string().default('').volatile().description('verify agent 模型覆盖（「provider/model」或裸模型名）；留空 = 与 session agent 一致。保存后下一轮 goal 即生效，无需重载。'),
+  /** Hard orchestration gate (default false). */
+  hardGate: z.boolean().default(false).description('硬编排门：装配期从顶层 session agent 摘除执行工具，所有改动必须经 cybernetics goal + task agent。修改会触发插件重载。'),
+  /** Tool names hidden in denylist mode (default DEFAULT_GATED_TOOLS). */
+  gatedTools: z.array(z.string()).description('denylist 模式下隐藏的工具名（缺省内置 DEFAULT_GATED_TOOLS）。'),
+  /** Gate semantics. */
+  gateMode: z.union(['denylist', 'allowlist'] as const).default('denylist').description('门语义：denylist 隐藏 gatedTools；allowlist 只保留 gateAllowlist（+gateAllowlistExtra）与 cybernetics 工具本身。'),
+  /** Allowlist-mode survival set (default DEFAULT_GATE_ALLOWLIST). */
+  gateAllowlist: z.array(z.string()).description('allowlist 模式生存工具集（缺省内置 DEFAULT_GATE_ALLOWLIST）。'),
+  /** Extra tool names unioned onto the allowlist. */
+  gateAllowlistExtra: z.array(z.string()).description('并集追加进 allowlist 的额外工具名。'),
+  /**
+   * All-goals mode (v0.7, default false): every user request must go through
+   * a cybernetics goal first. Volatile: the settings-panel toggle commits
+   * into the running instance without a remount.
+   */
+  allGoalsMode: z.boolean().default(false).volatile()
+    .description('全目标模式（v0.7，缺省关）：所有用户请求（含只读问题）都必须先经 cybernetics goal。开关在面板上保存后即时生效，无需重载。'),
+})
+
+/** One resolved config field: a live reference (volatile), or a plain value. */
+type ConfigField<T> = { get(): T } | T
+
+/** Read one resolved config field, following the live reference the schema produces for volatile fields. */
+function readConfigField<T>(field: ConfigField<T> | undefined, fallback: T): T {
+  if (field === undefined) return fallback
+  if (typeof field === 'object' && field !== null && typeof (field as { get?: unknown }).get === 'function') {
+    const value = (field as { get(): T }).get()
+    return value === undefined ? fallback : value
+  }
+  return field as T
+}
 
 /**
  * Multi-goal loop registry: session -> goalId -> loop. v0.3 lifts the
@@ -318,6 +394,42 @@ yourself — you manage goals and the task agents that execute them. Classify ea
   'round-cap'/'failed' = report status. Never mark a goal complete yourself; completion is the user's act.
 Use action 'list' to see every goal on this session's board with its status, round and subgoal.`
 
+/**
+ * v0.7 all-goals mode addendum: turns the implicit trigger from "suggest a
+ * goal for substantial tasks" into "every request is a goal". Contains the
+ * four routing rules the protocol and tests pin down:
+ * (1) everything enters a goal; (2) simple read-only → 'quick' single round;
+ * (3) complex analysis / write tasks → progressive multi-round ('full');
+ * (4) the revise auto-abort decision tree.
+ */
+const ALL_GOALS_GUIDANCE = `
+ALL-GOALS MODE ACTIVE (routing protocol — no exceptions, no in-place analysis):
+- RULE 1 — EVERYTHING ENTERS A GOAL: for ANY user request (question, lookup, analysis, change), first
+  create a goal via cybernetics (action 'start' with title + brief), then let the task agent produce the
+  answer. NEVER answer a request by doing the task work yourself with read tools — even a one-file lookup
+  or a quick calculation goes through the loop. If a change is requested while the hard gate is off, the
+  protocol still forbids in-place edits: delegate.
+- RULE 2 — SIMPLE READ-ONLY REQUEST → depth 'quick': one task-agent round, no verify/triage, feed the
+  result straight back to the user (bounded lookups, single-file reads, small queries).
+- RULE 3 — COMPLEX ANALYSIS or WRITE TASK → depth 'full', progressive multi-round: launch with action
+  'start' (async), then 'collect' each settled round and advance the subgoal round by round (task →
+  verify → triage). Analysis: data fetching to disk, datasets, statistics, multi-step query planning.
+  Write tasks additionally rely on the hard gate: the session agent must NEVER execute a change itself —
+  delegation through the goal loop is the only path, however small the change.
+- RULE 4 — REVISE DECISION TREE (updating an existing goal stays append-only: a new goal with
+  parentGoalId, old goal superseded; 'revise' is the only goal-change verb). Decide abortPrevious by the
+  old task agent's state (check with action 'list'):
+  (a) old round STILL RUNNING and the revision contradicts it (objective/depth rewritten — conflicting
+      goals / write-domain overlap) → let 'revise' auto-abort: do not pass abortPrevious; the plugin
+      cancels the old round automatically;
+  (b) old round STILL RUNNING but the correction keeps the objective (brief/title/role only) and the old
+      work stays valuable / parallelizable / reusable → do not pass abortPrevious; the plugin waits for
+      the old round to finish naturally;
+  (c) old task agent ALREADY FINISHED (goal not running on the board) → just call 'revise'; no abort is
+      needed and none is attempted.
+  The chosen branch and its reason are recorded in the .cybernetics/revisions-<newGoalId>.jsonl audit
+  line (abort.mode = auto|explicit + basis). Passing abortPrevious explicitly keeps manual control.`
+
 /** Tool names hidden from top-level session agents when the hard gate is on. */
 const DEFAULT_GATED_TOOLS = ['bash', 'edit', 'write']
 
@@ -373,6 +485,10 @@ not find it, that is the gate working as intended — delegate instead.`
 export function apply(ctx: any, config: Partial<Config> = {}) {
   const toolName = config.toolName ?? 'cybernetics'
   const hardGate = config.hardGate === true
+  // allGoalsMode is a volatile field: under the loader's schema resolution it
+  // arrives as a live reference whose value the settings panel commits in
+  // place (no remount), so read it at use time instead of capturing it once.
+  const allGoalsMode = () => readConfigField(config.allGoalsMode, false) === true
   const disposers: Array<() => void> = []
 
   // v0.6: register the multi-goal session projection, so every goal on the
@@ -389,13 +505,24 @@ export function apply(ctx: any, config: Partial<Config> = {}) {
     if (typeof projectionDisposer === 'function') disposers.push(projectionDisposer)
   }
 
-  if (config.implicitTrigger !== false) {
-    ctx.systemPrompt.section({
+  // The implicit guidance section embeds the volatile allGoalsMode wording,
+  // so it must be re-derived when a settings-panel toggle is committed into
+  // the running instance (the loader announces loader/volatile-update on this
+  // fiber instead of remounting; same re-derive pattern as dsh-ssh's sync()).
+  let disposeSection: (() => void) | undefined
+  function registerGuidanceSection() {
+    if (disposeSection !== undefined) disposeSection()
+    disposeSection = undefined
+    if (config.implicitTrigger === false) return
+    disposeSection = ctx.systemPrompt.section({
       name: `tool:${toolName}`,
       order: ctx.systemPrompt.getSectionOrder('TOOL_WORKFLOW'),
-      text: IMPLICIT_GUIDANCE + (hardGate ? HARD_GATE_GUIDANCE : ''),
+      text: IMPLICIT_GUIDANCE + (allGoalsMode() ? ALL_GOALS_GUIDANCE : '') + (hardGate ? HARD_GATE_GUIDANCE : ''),
     })
   }
+  registerGuidanceSection()
+  disposers.push(() => { if (disposeSection !== undefined) disposeSection() })
+  ctx.on?.('loader/volatile-update', () => { registerGuidanceSection() })
 
   if (hardGate) {
     // The hard gate: a system-prompt/assemble waterfall listener that strips
@@ -403,12 +530,15 @@ export function apply(ctx: any, config: Partial<Config> = {}) {
     // (task/verify/triage) and team teammates are never in agents.roots(),
     // so their assemblies pass through untouched with full tool access.
     const allowlistMode = config.gateMode === 'allowlist'
+    // NOTE: schema-resolved config turns an unset z.array field into [] (not
+    // undefined), so fall back on length, not on ?? — otherwise the gate
+    // would silently keep/gate nothing.
     const keep = new Set([
-      ...(config.gateAllowlist ?? DEFAULT_GATE_ALLOWLIST),
+      ...(config.gateAllowlist?.length ? config.gateAllowlist : DEFAULT_GATE_ALLOWLIST),
       ...(config.gateAllowlistExtra ?? []),
       toolName,
     ])
-    const gated = new Set(config.gatedTools ?? DEFAULT_GATED_TOOLS)
+    const gated = new Set(config.gatedTools?.length ? config.gatedTools : DEFAULT_GATED_TOOLS)
     const listenerDisposer = ctx.on('system-prompt/assemble', (assembly: any, context: any, next: () => unknown) => {
       const scope = context?.scope
       if (!scope) return next()
@@ -524,7 +654,8 @@ export function apply(ctx: any, config: Partial<Config> = {}) {
         abortPrevious: {
           type: 'boolean',
           description:
-            'revise：是否中止旧 goal 正在运行的 task agent 轮（默认 false，让它跑完；true 时复用 cancel 路径）。',
+            'revise：是否中止旧 goal 正在运行的 task agent 轮。缺省时按决策树自动判断（查 goal 板：旧轮在跑且目标被改写→自动中止；旧轮在跑但目标不变→等待自然结束；旧轮未跑→直启）；' +
+            '显式传 true/false 保持人工控制（true 复用 cancel 路径）。',
         },
         executor: {
           type: 'string',
@@ -540,6 +671,7 @@ export function apply(ctx: any, config: Partial<Config> = {}) {
           goalId: { type: 'string' },
           previousGoalId: { type: 'string' },
           revised: { type: 'boolean' },
+          abort: { type: 'object' },
           revision: { type: 'object' },
           round: { type: 'number' },
           decision: { type: 'object' },
@@ -725,10 +857,20 @@ export function apply(ctx: any, config: Partial<Config> = {}) {
       // it visible in the tab even when this call changes nothing else.
       await publishBoard()
 
+      // Flat settings-panel model fields fold into the canonical roles shape:
+      // an unset field leaves its role untouched = inherit the session agent.
+      // Both fields are volatile (v0.7.7), so the loader hands back live
+      // references — unwrap through readConfigField ('' = inherit) exactly
+      // like the allGoalsMode live ref above.
+      const roleOverrides: RolesConfig = { ...(config.roles ?? {}) }
+      const taskSpec = parseAgentModelSpec(readConfigField(config.taskAgentModel, ''))
+      if (taskSpec) roleOverrides.default = { ...roleOverrides.default, ...taskSpec }
+      const verifySpec = parseAgentModelSpec(readConfigField(config.verifyAgentModel, ''))
+      if (verifySpec) roleOverrides.verify = { ...roleOverrides.verify, ...verifySpec }
       const controllerConfig: ControllerConfig = {
         roundScriptPath: config.roundScriptPath ?? fileURLToPath(new URL('../workflows/round.js', import.meta.url)),
         roundsPerSubgoal: config.roundsPerSubgoal,
-        roles: config.roles,
+        roles: roleOverrides,
       }
       const objective = loop.objective ?? goalView?.objective ?? loop.title ?? ''
 
@@ -805,7 +947,20 @@ export function apply(ctx: any, config: Partial<Config> = {}) {
             'revise the successor goal instead of forking the lineage',
           )
         }
-        const abortPrevious = args.abortPrevious === true
+        // v0.7 abort policy: explicit abortPrevious keeps the v0.6 manual
+        // semantics; when the caller omits it, all-goals mode auto-decides via
+        // the decision tree (see decideAbort). With allGoalsMode off, the
+        // omitted flag means false exactly as before (backward compat) and the
+        // audit records that legacy default instead of a fabricated decision.
+        const roundInFlight = running.has(previous.goalId!)
+        const abortDecision = decideAbort(previous, roundInFlight, args)
+        const legacyDefault = args.abortPrevious === undefined && !allGoalsMode()
+        const effectiveAbort = legacyDefault
+          ? { abort: false, mode: 'explicit' as const, basis: 'all-goals 模式未开启：abortPrevious 缺省沿用 v0.6 默认 false（不中止旧轮）' }
+          : abortDecision
+        const abortPrevious = args.abortPrevious !== undefined
+          ? args.abortPrevious === true
+          : (allGoalsMode() ? abortDecision.abort : false)
         const previousHandle = running.get(previous.goalId!)
         let aborted: string | undefined
         if (abortPrevious && previousHandle) {
@@ -833,7 +988,10 @@ export function apply(ctx: any, config: Partial<Config> = {}) {
         const at = Date.now()
         let revisionLog: string | undefined
         try {
-          revisionLog = await writeRevisionLog(root, newGoalId, { from: previous.goalId!, to: newGoalId, reason, at })
+          revisionLog = await writeRevisionLog(root, newGoalId, {
+            from: previous.goalId!, to: newGoalId, reason, at,
+            abort: effectiveAbort,
+          })
         } catch {
           // Audit is observability: a read-only workspace must not break the
           // revision (the lineage fields on the board still carry the change).
@@ -846,6 +1004,7 @@ export function apply(ctx: any, config: Partial<Config> = {}) {
           round,
           started: true,
           ...(aborted ? { aborted } : {}),
+          abort: effectiveAbort,
           revision: { from: previous.goalId, to: newGoalId, reason, at },
           ...(revisionLog ? { revisionLog } : {}),
         }