@mars.liu/dsh-cybernetics 0.7.8 → 0.8.4

package/lib/client.js

@@ -1,8 +1,12 @@
 // dsh-cybernetics client module: the「目标 / Goal」conversation tab, the
-//「控制」tab, and (v0.7.2+, fixed in v0.7.3) the allGoalsMode settings card
-// seated on the official Plugins page (plugins.item / plugins.row.config /
-// plugins.bundle.config, bound to the row's ConfigForm in either of the two
-// shapes the seats deliver — volatile writes stay live without a restart).
+//「控制」tab, and (v0.7.2+, fixed in v0.7.3, full volatile coverage in v0.8.1,
+// triageAgentModel added in v0.8.2) the settings card seated on the official
+// Plugins page (plugins.item / plugins.row.config / plugins.bundle.config,
+// bound to the row's ConfigForm in either of the two shapes the seats deliver
+// — volatile writes stay live without a restart). The card is the ONLY GUI
+// surface for the plugin's seven volatile fields: the host Plugins page draws
+// no fields of its own and dsh-client-ui-settings ships the configForms
+// service, not a renderer.
 // Rendered from the session's `goal` projection (dsh-goal), pushed live by the
 // host — no plugin HTTP route needed. Hand-written ModuleLoader wrapper, same
 // format the host bundler emits (see dsh-context / dsh-maze client.js).
@@ -82,6 +86,35 @@ window.__ModuleLoader__.load({
 			// surfaces the host's exact RemoteError message (the shared
 			// ConfigFormController swallows it into a bare `false`).
 			'settings.saveFailedDetail': '保存未生效，宿主拒绝原因：{message}',
+			// v0.8.1: the remaining five volatile fields. The card is the ONLY
+			// GUI surface for them (see the card region comment): the host has
+			// no generic schema-driven field renderer, so every field the card
+			// does not draw is invisible everywhere.
+			'settings.taskAgentModel': 'Task agent 模型',
+			'settings.verifyAgentModel': 'Verify agent 模型',
+			// v0.8.3: the three model fields are dropdown-backed (datalist over the
+			// host's live model catalog, remote.session.modelCatalog) with free
+			// manual entry preserved — the datalist input accepts any text.
+			'settings.modelFieldHint': '可从下拉选择当前系统模型（显示 provider · provider/model），也可手工输入「provider/model」或裸模型名；留空 = 与 session agent 一致（继承）。回车或移开焦点即保存。',
+			// v0.8.3: configured value no longer in the live catalog = deleted
+			// subscription. Warn + one-click clear; NEVER auto-unset (the value
+			// may be valid again after resubscribing, and silent rewrites of
+			// user config are a side effect) — the runtime already falls back to
+			// the session agent model per v0.8.0, so the warning is advisory.
+			'settings.modelUnavailable': '该模型已不在当前系统模型列表中，运行时将回退到 session agent 模型。',
+			'settings.modelClear': '清除',
+			// v0.8.2: the triage role's flat model field — triage reads the
+			// task/verify results and emits the round's convergence decision
+			// (met/continue/human-input/...); quick rounds never invoke it.
+			'settings.triageAgentModel': 'Triage agent 模型',
+			'settings.triageModelHint': '可从下拉选择当前系统模型，也可手工输入「provider/model」或裸模型名；留空 = 与 session agent 一致（继承）。triage 角色读 task/verify 结果输出本轮收敛决策（met/continue/human-input 等），quick 轮不启用。回车或移开焦点即保存。',
+			'settings.roundsPerSubgoal': '子目标轮数上限',
+			'settings.roundsPerSubgoalHint': '同一子目标的最大连续轮数（整数 ≥1，缺省 3）；留空恢复默认。回车或移开焦点即保存。',
+			'settings.maxConcurrentRounds': '并行轮数上限',
+			'settings.maxConcurrentRoundsHint': '全局并行轮数上限（整数 ≥0，缺省 0 = 不限）；留空恢复默认。回车或移开焦点即保存。',
+			// v0.8.4: roles 高级配置不再上卡片（手工编辑 JSON 对用户不友善）——
+			// 由 agent 指导用户直接编辑 profile 配置 yaml（见 README）。
+			'settings.invalidNumber': '请输入符合范围的整数，或留空恢复默认。',
 		};
 		const en = {
 			'view.goal': 'Goal',
@@ -133,6 +166,20 @@ window.__ModuleLoader__.load({
 			'settings.saving': 'Saving…',
 			'settings.saveFailed': 'Save did not take effect (the host refused the write).',
 			'settings.saveFailedDetail': 'Save did not take effect — host refusal: {message}',
+			// v0.8.1: the remaining five volatile fields (see zh for the rationale).
+			'settings.taskAgentModel': 'Task agent model',
+			'settings.verifyAgentModel': 'Verify agent model',
+			'settings.modelFieldHint': 'Pick from the dropdown of currently available system models (shown as provider · provider/model), or type "provider/model" or a bare model name; empty = inherit the session agent. Enter or blur saves.',
+			'settings.modelUnavailable': 'This model is no longer in the system model list; at runtime the round falls back to the session agent model.',
+			'settings.modelClear': 'Clear',
+			// v0.8.2: the triage role's flat model field (see zh for the rationale).
+			'settings.triageAgentModel': 'Triage agent model',
+			'settings.triageModelHint': 'Pick from the dropdown of available system models, or type "provider/model" or a bare model name; empty = inherit the session agent. The triage role reads the task/verify results and emits the round\'s convergence decision (met/continue/human-input/...); quick rounds never invoke it. Enter or blur saves.',
+			'settings.roundsPerSubgoal': 'Rounds per subgoal',
+			'settings.roundsPerSubgoalHint': 'Max consecutive rounds on one subgoal (integer ≥1, default 3); empty restores the default. Enter or blur saves.',
+			'settings.maxConcurrentRounds': 'Concurrent round cap',
+			'settings.maxConcurrentRoundsHint': 'Global cap on rounds in flight (integer ≥0, default 0 = unlimited); empty restores the default. Enter or blur saves.',
+			'settings.invalidNumber': 'Enter an integer in range, or leave blank to restore the default.',
 		};
 		//#endregion
 
@@ -446,7 +493,7 @@ window.__ModuleLoader__.load({
 		const noopSubscribe = () => () => {};
 
 		var settingsStyles = {
-			card: { display: 'flex', flexDirection: 'column', gap: 6, padding: '12px 0' },
+			card: { display: 'flex', flexDirection: 'column', gap: 10, padding: '12px 0' },
 			row: { display: 'flex', alignItems: 'center', gap: 12 },
 			main: { display: 'flex', flexDirection: 'column', gap: 2, flex: 1, minWidth: 0 },
 			title: { fontSize: 13, fontWeight: 600 },
@@ -465,15 +512,123 @@ window.__ModuleLoader__.load({
 			knobOn: { left: 20, background: '#fff' },
 			knobOff: { left: 2, background: 'currentColor' },
 			unavailable: { fontSize: 12, opacity: 0.6 },
+			// v0.8.1: editable volatile fields (text / number inputs).
+			field: { display: 'flex', flexDirection: 'column', gap: 4, paddingTop: 6, borderTop: '1px solid rgba(127,127,127,0.18)' },
+			input: {
+				font: 'inherit', fontSize: 12, color: 'inherit', maxWidth: 320,
+				background: 'transparent', border: '1px solid rgba(127,127,127,0.4)',
+				borderRadius: 4, padding: '3px 8px', outline: 'none',
+			},
+			inputInvalid: { borderColor: '#d29922' },
+			invalid: { fontSize: 11, color: '#d29922' },
 		};
 
+		// v0.8.1: the card renders ALL volatile fields, not just the
+		// allGoalsMode toggle (v0.8.2 adds triageAgentModel → seven). Verified
+		// against the running host's sources (2026-11-04): the Plugins page
+		// detail view (ItemDetail in @deepseek-ai/dsh-client-ui-plugin-manager
+		// lib/client.js) renders a plugin's configuration ONLY through its slot
+		// cards — the page itself draws no fields;
+		// @deepseek-ai/dsh-client-ui-settings ships the configForms SERVICE
+		// (transport + volatileForm serve/write gates) but no generic field
+		// renderer; dsh-client-ui-settings-plugins is a read-only inventory
+		// shell ("Configuring a built-in plugin happens on the sidebar's
+		// Plugins page, where each official plugin's own companion package
+		// registers its page"). Official plugins each draw their own card
+		// (agent-loop / web-search / …). So a volatile field this card does not
+		// render is editable NOWHERE in the GUI — that was the v0.7.9–v0.8.0
+		// panel gap. Field types follow the schema (src/index.ts Config):
+		// allGoalsMode boolean toggle; taskAgentModel / verifyAgentModel /
+		// triageAgentModel text ('' = inherit); roundsPerSubgoal /
+		// maxConcurrentRounds integers (≥1 / ≥0; blank restores the default via
+		// an `unset` op). v0.8.4: roles is no longer on the card — hand-editing
+		// a JSON object in the GUI is unfriendly; roles became non-volatile and
+		// is configured directly in the profile yaml (agent-guided, README).
+		// The card's field list is back to six:
+		// allGoalsMode / taskAgentModel / verifyAgentModel / triageAgentModel /
+		// roundsPerSubgoal / maxConcurrentRounds.
+		const SETTINGS_FIELDS = [
+			// v0.8.3: the three model fields are kind 'model' — datalist-backed
+			// dropdown over the live host catalog, manual entry still accepted
+			// (a datalist input is a free text input); invalid configured values
+			// render the unavailable warning + a one-click clear.
+			{ field: 'taskAgentModel', labelKey: 'settings.taskAgentModel', hintKey: 'settings.modelFieldHint', kind: 'model' },
+			{ field: 'verifyAgentModel', labelKey: 'settings.verifyAgentModel', hintKey: 'settings.modelFieldHint', kind: 'model' },
+			{ field: 'triageAgentModel', labelKey: 'settings.triageAgentModel', hintKey: 'settings.triageModelHint', kind: 'model' },
+			{ field: 'roundsPerSubgoal', labelKey: 'settings.roundsPerSubgoal', hintKey: 'settings.roundsPerSubgoalHint', kind: 'number', min: 1 },
+			{ field: 'maxConcurrentRounds', labelKey: 'settings.maxConcurrentRounds', hintKey: 'settings.maxConcurrentRoundsHint', kind: 'number', min: 0 },
+		];
+		/** Sentinel for "blank input = restore the schema default" (an unset op). */
+		const UNSET = {};
+		//#region v0.8.3 model catalog store (dropdown data + invalid-model detection)
+		// Host model directory, read the same way the official 子智能体 settings
+		// page does (@deepseek-ai/dsh-client-ui-settings-subagent): the
+		// `remote.session` namespace answers `modelCatalog()` with
+		// { ok, value: { groups: [{id, name, models: [{id, name}]}], failures } }
+		// — every currently routable model, grouped by provider. Provider
+		// invalidations arrive as `llm/adapters-updated` on ctx.remote. OPTIONAL
+		// everywhere: a host without the namespace leaves the store absent, the
+		// dropdown empty and the text entry intact — no crash, no warnings.
+		function createModelCatalogStore() {
+			let snap = { status: 'idle', options: [] };
+			const subs = new Set();
+			return {
+				subscribe(cb) { subs.add(cb); return () => subs.delete(cb); },
+				getSnapshot() { return snap; },
+				set(next) { snap = next; for (const cb of subs) cb(); },
+				load: async (session) => {
+					snap = { status: 'loading', options: snap.options };
+					for (const cb of subs) cb();
+					try {
+						const response = await session.modelCatalog();
+						if (response && response.ok === true && response.value && Array.isArray(response.value.groups)) {
+							const options = [];
+							for (const group of response.value.groups) {
+								for (const model of (group.models ?? [])) {
+									options.push({
+										value: group.id + '/' + model.id,
+										provider: group.id,
+										model: model.id,
+										label: (group.name ?? group.id) + ' · ' + group.id + '/' + model.id,
+									});
+								}
+							}
+							snap = { status: 'ready', options };
+						} else {
+							snap = { status: 'error', options: [] };
+						}
+					} catch {
+						snap = { status: 'error', options: [] };
+					}
+					for (const cb of subs) cb();
+				},
+			};
+		}
+		/**
+		 * Whether a configured model value still resolves against the live
+		 * catalog. Accepts the same shapes the runtime does (parseAgentModelSpec):
+		 * `provider/model` (exact option match) or a bare model name (matches any
+		 * provider's model id). An empty value or an absent/failed catalog never
+		 * flags — the warning must be provable, not a guess.
+		 */
+		function isConfiguredModelAvailable(value, catalogSnap) {
+			const text = (value ?? '').trim();
+			if (text === '') return true;
+			if (!catalogSnap || catalogSnap.status !== 'ready' || !Array.isArray(catalogSnap.options) || catalogSnap.options.length === 0) return true;
+			if (text.indexOf('/') >= 0) {
+				return catalogSnap.options.some((opt) => opt.value === text);
+			}
+			return catalogSnap.options.some((opt) => opt.model === text);
+		}
+		//#endregion
+
 		/**
-		 * One boolean settings row; shared by all three seats. Two form shapes
-		 * reach it, and the card must speak both:
+		 * The settings card; shared by all three seats. Two form shapes reach
+		 * it, and the card must speak both:
 		 *  - the LIVE ConfigForm this module injects (ctx.configForms.get):
-		 *    getSnapshot / subscribe / set — the only shape on the
-		 *    plugins.bundle.config page and in summary rows, whose owners pass
-		 *    no form of their own;
+		 *    getSnapshot / subscribe / set / unset / mutate — the only shape on
+		 *    the plugins.bundle.config page and in summary rows, whose owners
+		 *    pass no form of their own;
 		 *  - the HOST's ConfigPageForm { state, mutate }: the plugins.item and
 		 *    plugins.row.config detail pages compute it from the same shared
 		 *    mirror (configForms.get(id).getSnapshot()/mutate) and pass it as
@@ -516,44 +671,71 @@ window.__ModuleLoader__.load({
 			// `false` = no failure; `true` = failure without a host message;
 			// a string = the host's exact refusal (RemoteError.message).
 			const [failed, setFailed] = react.useState(false);
+			// v0.8.1: per-field edit drafts (field → text; absent = untouched,
+			// the control shows the snapshot value) and the field whose current
+			// draft failed local validation ('' = none). A failed SAVE keeps
+			// the draft for correction; an accepted write clears it.
+			const [drafts, setDrafts] = react.useState({});
+			const [invalid, setInvalid] = react.useState('');
+			// v0.8.3: the live model catalog face (optional prop; absent on hosts
+			// without remote.session — the dropdown then renders empty and no
+			// availability warning is ever shown).
+			const catalog = props.catalog;
+			const catalogSnap = react.useSyncExternalStore(
+				catalog ? (cb) => catalog.subscribe(cb) : noopSubscribe,
+				catalog ? () => catalog.getSnapshot() : () => NO_FORM_SNAP,
+			);
+			const catalogOptions = catalogSnap && Array.isArray(catalogSnap.options) ? catalogSnap.options : [];
 			const on = snap.status === 'ready' && snap.value != null && snap.value.allGoalsMode === true;
+			const cfg = snap.status === 'ready' && snap.value !== null && typeof snap.value === 'object' ? snap.value : {};
 			const disabled = (live === undefined && host === undefined) || snap.status !== 'ready' || snap.writable === false || saving;
+			const setDraft = (field, text) => setDrafts((d) => ({ ...d, [field]: text }));
+			const clearDraft = (field) => setDrafts((d) => {
+				if (!(field in d)) return d;
+				const next = { ...d };
+				delete next[field];
+				return next;
+			});
 
-			const toggle = () => {
+			// One write for any volatile field; the toggle is
+			// writeField('allGoalsMode', !on). Both write paths land in the same
+			// host mutation: ConfigForm.set/unset are one-field sugar over
+			// ConfigForm.mutate, and the host's ConfigPageForm.mutate IS that
+			// form's mutate (the expected revision carried explicitly). The
+			// host commits the write into the running plugin instance
+			// (volatile) and the next snapshot / page render pushes the
+			// accepted value back here.
+			// Failure policy (v0.7.4): the transport can REFUSE (settles
+			// false) or stall (the observed "保存中" hang). Neither is
+			// silent: a refused write shows saveFailed for a few seconds,
+			// and a stalled write releases the controls after 15 s with the
+			// same hint — every control always returns to the snapshot value,
+			// which is the only state the host confirmed.
+			// v0.7.6: a refused write is retried ONCE through the direct
+			// settings transport (props.directMutate, no expectedRevision).
+			// Same落点 (user patch row via configEditor), unconditional
+			// revision — a stale-revision conflict therefore heals, and any
+			// remaining refusal reports its host message verbatim.
+			const writeField = (field, value) => {
 				if (disabled) return;
 				setSaving(true);
 				setFailed(false);
-				// Both write paths land in the same host mutation: ConfigForm.set
-				// is one-field sugar over ConfigForm.mutate, and the host's
-				// ConfigPageForm.mutate IS that form's mutate (the expected
-				// revision carried explicitly). The host commits the write into
-				// the running plugin instance (volatile) and the next snapshot /
-				// page render pushes the accepted value back here.
-				// Failure policy (v0.7.4): the transport can REFUSE (settles
-				// false) or stall (the observed "保存中" hang). Neither is
-				// silent: a refused write shows saveFailed for a few seconds,
-				// and a stalled write releases the switch after 15 s with the
-				// same hint — the switch always returns to the snapshot value,
-				// which is the only state the host confirmed.
-				// v0.7.6: a refused write is retried ONCE through the direct
-				// settings transport (props.directMutate, no expectedRevision).
-				// Same落点 (user patch row via configEditor), unconditional
-				// revision — a stale-revision conflict therefore heals, and any
-				// remaining refusal reports its host message verbatim.
+				setInvalid('');
 				let settled = false;
 				const finish = (ok, detail) => {
 					if (settled) return;
 					settled = true;
 					setSaving(false);
-					if (!ok) {
-						setFailed(detail || true);
-						setTimeout(() => setFailed(false), 6000);
-					}
+					if (ok) { clearDraft(field); return; }
+					setFailed(detail || true);
+					setTimeout(() => setFailed(false), 6000);
 				};
 				const guard = setTimeout(() => finish(false), 15000);
-				const op = { op: 'set', path: ['allGoalsMode'], value: !on };
+				const op = value === UNSET
+					? { op: 'unset', path: [field] }
+					: { op: 'set', path: [field], value };
 				const write = live !== undefined
-					? live.set('allGoalsMode', !on)
+					? (value === UNSET ? live.unset(field) : live.set(field, value))
 					: host.mutate([op], snap.revision);
 				Promise.resolve(write)
 					.then(async (accepted) => {
@@ -572,11 +754,98 @@ window.__ModuleLoader__.load({
 					})
 					.catch((error) => { clearTimeout(guard); finish(false, error && error.message); });
 			};
+			const toggle = () => writeField('allGoalsMode', !on);
+
+			// Text/number commit (Enter or blur): an untouched field never
+			// writes; a draft equal to the snapshot just clears; a blank draft
+			// restores the schema default through an `unset` op; a number
+			// outside its range flags the field instead of writing.
+			const commitField = (spec) => {
+				const draft = drafts[spec.field];
+				if (draft === undefined) return;
+				const current = cfg[spec.field];
+				const text = draft.trim();
+				if (text === (current === undefined || current === null ? '' : String(current))) {
+					clearDraft(spec.field);
+					setInvalid('');
+					return;
+				}
+				if (text === '') { writeField(spec.field, UNSET); return; }
+				if (spec.kind === 'number') {
+					const n = Number(text);
+					if (!Number.isInteger(n) || n < spec.min) { setInvalid(spec.field); return; }
+					writeField(spec.field, n);
+					return;
+				}
+				writeField(spec.field, text);
+			};
 
 			if (view === 'summary') {
 				return jsx.jsx('span', { children: snap.status === 'ready' ? t(on ? 'settings.summaryOn' : 'settings.summaryOff') : t('settings.unavailable') });
 			}
 
+			const fieldRow = (spec) => {
+				// v0.8.3: availability verdict for the configured (snapshot) value —
+				// drafts are uncommitted text and never warn. Only a loaded catalog
+				// can flag; an empty/failed catalog keeps every value "available".
+				const configuredValue = cfg[spec.field] === undefined || cfg[spec.field] === null ? '' : String(cfg[spec.field]);
+				const modelUnavailable = spec.kind === 'model'
+					&& !isConfiguredModelAvailable(configuredValue, catalogSnap);
+				const listId = 'cybernetics-models-' + spec.field;
+				return jsx.jsxs('div', { style: settingsStyles.field, children: [
+					jsx.jsx('div', { style: settingsStyles.title, children: t(spec.labelKey) }),
+					jsx.jsx('div', { style: settingsStyles.desc, children: t(spec.hintKey) }),
+					snap.status === 'ready'
+						? jsx.jsxs('div', { style: { display: 'flex', flexDirection: 'column', gap: 4 }, children: [
+							jsx.jsx('input', {
+								type: 'text',
+								// datalist: native dropdown over the catalog options; the
+								// input stays a free text field, so manual entry is the
+								// built-in fallback (and values off-catalog still commit).
+								list: spec.kind === 'model' && catalogOptions.length > 0 ? listId : undefined,
+								inputMode: spec.kind === 'number' ? 'numeric' : undefined,
+								'aria-label': t(spec.labelKey),
+								'aria-invalid': invalid === spec.field || undefined,
+								disabled,
+								value: drafts[spec.field] !== undefined
+									? drafts[spec.field]
+									: configuredValue,
+								onChange: (e) => setDraft(spec.field, e && e.target ? String(e.target.value) : ''),
+								onKeyDown: (e) => {
+									if (!e) return;
+									if (e.key === 'Enter') commitField(spec);
+									if (e.key === 'Escape') { clearDraft(spec.field); setInvalid(''); }
+								},
+								onBlur: () => commitField(spec),
+								style: { ...settingsStyles.input, ...(invalid === spec.field ? settingsStyles.inputInvalid : {}) },
+							}),
+							spec.kind === 'model' && catalogOptions.length > 0
+								? jsx.jsx('datalist', { id: listId, children: catalogOptions.map((opt) =>
+									jsx.jsx('option', { value: opt.value, label: opt.label ?? opt.value }, opt.value)) })
+								: null,
+						] })
+						: null,
+					modelUnavailable
+						? jsx.jsxs('div', { style: { ...settingsStyles.invalid, color: '#d29922', display: 'flex', alignItems: 'center', gap: 8, flexWrap: 'wrap' }, children: [
+							jsx.jsx('span', { children: t('settings.modelUnavailable') }),
+							// One-click clear = an explicit user action writing an unset
+							// op (same writeField path as blanking the field) — never a
+							// silent auto-unset of stored config (recorded trade-off in
+							// docs/CHANGELOG.md v0.8.3).
+							jsx.jsx('button', {
+								type: 'button',
+								'aria-label': t('settings.modelClear') + ' ' + t(spec.labelKey),
+								disabled,
+								onClick: () => writeField(spec.field, UNSET),
+								style: { ...settingsStyles.apply, alignSelf: 'auto' },
+								children: t('settings.modelClear'),
+							}),
+						] })
+						: null,
+					invalid === spec.field ? jsx.jsx('div', { style: settingsStyles.invalid, children: t('settings.invalidNumber') }) : null,
+				] }, spec.field);
+			};
+
 			return jsx.jsxs('div', { style: settingsStyles.card, children: [
 				jsx.jsxs('div', { style: settingsStyles.row, children: [
 					jsx.jsxs('div', { style: settingsStyles.main, children: [
@@ -592,6 +861,7 @@ window.__ModuleLoader__.load({
 						})
 						: null,
 				] }),
+				...SETTINGS_FIELDS.map(fieldRow),
 				snap.status !== 'ready' ? jsx.jsx('div', { style: settingsStyles.unavailable, children: t('settings.unavailable') }) : null,
 				saving ? jsx.jsx('div', { style: settingsStyles.unavailable, children: t('settings.saving') }) : null,
 				!saving && failed ? jsx.jsx('div', { style: { ...settingsStyles.unavailable, color: '#d29922' }, children: failed === true ? t('settings.saveFailed') : t('settings.saveFailedDetail', { message: failed }) }) : null,
@@ -612,7 +882,12 @@ window.__ModuleLoader__.load({
 			// fallback. Optional at runtime (guarded in apply): a host without
 			// the namespace parks this client module exactly as it would
 			// ui-settings itself — the web profile always serves it.
-			'remote', 'remote.settings'];
+			'remote', 'remote.settings',
+			// v0.8.3: the settings card's model dropdown reads the host model
+			// catalog through the session namespace (same service the official
+			// ui-settings-subagent page declares). Guarded at runtime: absent →
+			// no dropdown, no warnings, text entry as before.
+			'remote.session'];
 
 		function apply(ctx) {
 			ctx.effect(() => ctx.locale.register(NS, { zh, en }), 'dsh-cybernetics: dictionaries');
@@ -641,7 +916,28 @@ window.__ModuleLoader__.load({
 			} catch {
 				settingsDirectMutate = undefined;
 			}
-			const settingsInject = () => ({ form: settingsForm, directMutate: settingsDirectMutate });
+			// v0.8.3: the live model catalog for the settings card's dropdown +
+			// invalid-model warnings. OPTIONAL: a host without the remote.session
+			// namespace (or without modelCatalog) leaves it undefined — the card
+			// renders text-only fields exactly as pre-v0.8.3, no crash, no
+			// false warnings. Refresh on `llm/adapters-updated` (the same
+			// invalidation the 子智能体 settings page listens to), so a model
+			// deleted/added in the model settings updates the dropdown live.
+			let catalogStore;
+			try {
+				if (ctx.remote && ctx.remote.session && typeof ctx.remote.session.modelCatalog === 'function') {
+					catalogStore = createModelCatalogStore();
+					ctx.effect(() => {
+						catalogStore.load(ctx.remote.session);
+						if (ctx.remote.$on && typeof ctx.remote.$on === 'function') {
+							ctx.remote.$on('llm/adapters-updated', () => { catalogStore.load(ctx.remote.session); });
+						}
+					}, 'dsh-cybernetics: model catalog');
+				}
+			} catch {
+				catalogStore = undefined;
+			}
+			const settingsInject = () => ({ form: settingsForm, directMutate: settingsDirectMutate, catalog: catalogStore });
 			// v0.7.2 (the actual gap): the official Plugins page renders the
 			// 内置插件配置 group cards ONLY from the `plugins.item` slot
 			// (ItemCard in @deepseek-ai/dsh-client-ui-plugin-manager client.js:

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "@mars.liu/dsh-cybernetics",
-  "version": "0.7.8",
+  "version": "0.8.4",
+  "license": "MIT",
   "private": false,
   "files": [
     "src",

package/src/controller.ts

@@ -15,6 +15,31 @@ import type { WorkflowEngine } from '@deepseek-ai/dsh-workflow'
 /** Directory holding per-round audit logs, relative to the workspace root. */
 export const STATE_DIR = '.cybernetics'
 
+/**
+ * One call-level model fallback within a round (v0.8): a role's configured
+ * model override failed to be called (availability failure) and the role's
+ * sub-agent was re-run on the session agent's model (no provider/model opts).
+ */
+export interface RoleFallback {
+  /** Role whose override was bypassed ('default'/named task role, 'verify', 'triage'). */
+  role: string
+  /** The configured override that failed. */
+  from: { provider?: string; model?: string }
+  /**
+   * Signal layer (workflow runtime agent() hook, @deepseek-ai/dsh-workflow-ptc):
+   * 'availability-error' = the hook THREW a WorkflowError whose code/message
+   * matches an availability failure (AGENT_START always; AGENT_RESULT or
+   * uncoded errors on quota/rate-limit/auth/5xx/network/provider patterns);
+   * 'null-result' = the hook returned null (the runtime flattens a child run
+   * that ends stopReason ≠ 'completed' — e.g. a mid-run LLM call failure via
+   * dsh-subagent agent/error — into null without the cause), retried only
+   * because an override was in effect.
+   */
+  trigger: 'availability-error' | 'null-result'
+  /** Human-readable reason (first line of the runtime error, or the null semantics). */
+  reason: string
+}
+
 /** One executed round, as returned by the workflow run. */
 export interface RoundResult {
   round: number
@@ -22,6 +47,8 @@ export interface RoundResult {
   verdict?: unknown
   triage?: unknown
   failed?: string
+  /** Call-level model fallbacks that occurred in this round (v0.8 audit). */
+  fallbacks?: RoleFallback[]
   /** Execution substrate used for this round (v0.6 audit). */
   executor?: 'ephemeral' | 'persistent'
 }
@@ -354,26 +381,42 @@ export async function runRound(
   }
 }
 
+/**
+ * v0.8 visibility: render the round's call-level model fallbacks as a decision
+ * note suffix, so the tool result names every fallback (role, failed override,
+ * trigger) instead of only living in the audit log.
+ */
+function fallbackSuffix(result: RoundResult): string {
+  const fallbacks = result.fallbacks ?? []
+  if (fallbacks.length === 0) return ''
+  const items = fallbacks.map((f) => {
+    const from = [f.from.provider, f.from.model].filter(Boolean).join('/') || '(inherit)'
+    return `${f.role}(${from}→session 模型，${f.trigger === 'null-result' ? '无产出' : '调用失败'})`
+  })
+  return `；⚠ 模型回退 ${fallbacks.length} 次：${items.join('，')}`
+}
+
 /** Fold one round result into a continue/pause decision. Pure. */
 function decide(result: RoundResult, state: LoopState, config: ControllerConfig): ControllerDecision {
+  const fb = fallbackSuffix(result)
   if (result.failed) {
-    return { action: 'pause', reason: 'failed', note: `第 ${result.round} 轮失败：${result.failed}` }
+    return { action: 'pause', reason: 'failed', note: `第 ${result.round} 轮失败：${result.failed}${fb}` }
   }
   const verdict = result.verdict as { met?: boolean; goalItselfQuestionable?: boolean; gaps?: string[] } | undefined
   if (verdict && verdict.goalItselfQuestionable) {
-    return { action: 'pause', reason: 'goal-questionable', note: 'verify 判定目标本身可能有问题，需通过对话重新校准' }
+    return { action: 'pause', reason: 'goal-questionable', note: `verify 判定目标本身可能有问题，需通过对话重新校准${fb}` }
   }
   if (verdict?.met) {
-    return { action: 'pause', reason: 'met', note: '验收全部通过；等待用户确认完成' }
+    return { action: 'pause', reason: 'met', note: `验收全部通过；等待用户确认完成${fb}` }
   }
   const triage = result.triage as { human?: { question?: string; step: string }[]; auto?: { step: string }[] } | undefined
   const human = triage?.human ?? []
   if (human.length > 0) {
-    return { action: 'pause', reason: 'human-input', note: `待用户裁定：${human.map((h) => h.question ?? h.step).join('；')}` }
+    return { action: 'pause', reason: 'human-input', note: `待用户裁定：${human.map((h) => h.question ?? h.step).join('；')}${fb}` }
   }
   const cap = config.roundsPerSubgoal ?? 3
   if (state.round >= cap) {
-    return { action: 'pause', reason: 'round-cap', note: `同一子目标已迭代 ${state.round} 轮仍未达成，升级用户` }
+    return { action: 'pause', reason: 'round-cap', note: `同一子目标已迭代 ${state.round} 轮仍未达成，升级用户${fb}` }
   }
   const gaps = verdict?.gaps ?? []
   const auto = triage?.auto ?? []
@@ -382,5 +425,5 @@ function decide(result: RoundResult, state: LoopState, config: ControllerConfig)
     : auto.length > 0
       ? auto.map((s) => s.step).join('；')
       : state.subgoal
-  return { action: 'continue', subgoal: nextSubgoal, note: `进入第 ${state.round + 1} 轮` }
+  return { action: 'continue', subgoal: nextSubgoal, note: `进入第 ${state.round + 1} 轮${fb}` }
 }