@mars.liu/dsh-cybernetics 0.7.8 → 0.8.4

package/src/index.ts

@@ -73,6 +73,8 @@ export interface Config extends ControllerConfig {
   taskAgentModel?: string
   /** Flat verify-agent model override (same format); empty = inherit session agent. */
   verifyAgentModel?: string
+  /** Flat triage-agent model override (same format); empty = inherit session agent. */
+  triageAgentModel?: string
   /**
    * Hard orchestration gate (default false): hide execution tools from
    * TOP-LEVEL session agents at prompt-assembly time, so the session agent
@@ -101,6 +103,12 @@ export interface Config extends ControllerConfig {
    * Off (default) keeps the v0.6 implicit-trigger behavior exactly unchanged.
    */
   allGoalsMode?: boolean
+  /**
+   * Max concurrent rounds across ALL sessions (default 0 = unlimited): a new
+   * round (blocking, 'start' or 'revise') is refused while this many rounds
+   * are in flight, protecting the host from parallel-agent storms.
+   */
+  maxConcurrentRounds?: number
 }
 
 // Under the host's 0.1.7 settings model, an exported schemastery `Config`
@@ -110,20 +118,35 @@ export interface Config extends ControllerConfig {
 // pattern). At least one field must be `.volatile()` for the page to be
 // served at all; a volatile edit is committed into the running fiber's
 // reference without a remount and announced via `loader/volatile-update`.
-// allGoalsMode is volatile so the panel toggle is live; hardGate and the
-// gate/roles fields are deliberately non-volatile — they change structural
-// wiring (tool stripping listener, per-role routing), so an edit remounts
-// the row, which is the correct behavior for them.
+// The user-facing knobs (taskAgentModel / verifyAgentModel / triageAgentModel /
+// roundsPerSubgoal / maxConcurrentRounds / allGoalsMode) are all
+// volatile so they are visible AND writable in the settings panel and take
+// effect on the next goal round. roles stays in the schema but is NOT
+// volatile (v0.8.4): the panel serves only volatile fields, so it no longer
+// shows in the GUI — advanced users (agent-guided) configure it directly in
+// the profile config yaml; a host reload applies it. hardGate and the gate fields stay non-volatile: the panel
+// cannot write them (they change structural wiring — tool stripping listener —
+// so they belong in the profile config document instead).
 export const Config = z.object({
   /** Model-facing tool name. */
   toolName: z.string().default('cybernetics').description('模型侧工具名（缺省 cybernetics）。'),
   /** Inject the implicit goal-loop guidance section. */
   implicitTrigger: z.boolean().default(true).description('注入隐式 goal-loop 系统提示段（缺省开启）。'),
-  /** Per-role sub-agent model/provider overrides: role -> {provider, model}. */
+  /**
+   * Per-role sub-agent model/provider overrides: role -> {provider, model}.
+   * v0.8.4: NOT volatile — the settings card no longer exposes the roles JSON
+   * textarea (hand-editing JSON in the GUI is unfriendly), and the host panel
+   * serves only volatile fields, so a non-volatile roles simply disappears
+   * from the GUI while remaining configurable in the profile config yaml
+   * (save triggers a plugin-row remount / host reload, which is fine for an
+   * advanced setting an agent guides the user through). Runtime semantics are
+   * unchanged: readConfigField accepts a plain object (non-volatile) exactly
+   * like a live reference (volatile), and named task roles keep working.
+   */
   roles: z.dict(z.object({
     provider: z.string(),
     model: z.string(),
-  })).description('按角色的子 agent provider/model 覆盖：role -> {provider, model}（如 default/verify/triage/frontend）。'),
+  })).description('按角色的子 agent provider/model 覆盖：role -> {provider, model}（如 default/verify/triage/frontend）。高级配置：直接编辑 profile 配置 yaml 后需宿主重载生效（GUI 不再提供此字段的编辑控件）。'),
   /**
    * Flat task-agent model override ("provider/model" or a bare model name).
    * Empty = inherit the session agent. Merged over roles.default at wiring
@@ -140,6 +163,25 @@ export const Config = z.object({
   taskAgentModel: z.string().default('').volatile().description('task agent 模型覆盖（「provider/model」或裸模型名）；留空 = 与 session agent 一致。保存后下一轮 goal 即生效，无需重载。'),
   /** Flat verify-agent model override; same format, fallback and volatile semantics as taskAgentModel. */
   verifyAgentModel: z.string().default('').volatile().description('verify agent 模型覆盖（「provider/model」或裸模型名）；留空 = 与 session agent 一致。保存后下一轮 goal 即生效，无需重载。'),
+  /**
+   * Flat triage-agent model override (v0.8.2); identical shape, fallback and
+   * volatile semantics as taskAgentModel/verifyAgentModel. The triage role
+   * reads the task/verify results and produces the round's convergence
+   * decision (met / continue / human-input / ...); quick-depth rounds skip
+   * verify+triage entirely, so this override only ever fires on full rounds.
+   */
+  triageAgentModel: z.string().default('').volatile().description('triage agent 模型覆盖（「provider/model」或裸模型名）；留空 = 与 session agent 一致。triage 角色读 task/verify 结果输出本轮收敛决策（met/continue/human-input 等）；quick 轮不启用。保存后下一轮 goal 即生效，无需重载。'),
+  /**
+   * Max consecutive rounds per subgoal before the loop pauses for the user
+   * (controller round-cap, default 3). Volatile: read per round start, so the
+   * panel edit governs the very next goal round without a remount.
+   */
+  roundsPerSubgoal: z.number().default(3).volatile().description('同一子目标的最大连续轮数（递归深度上限，缺省 3）：超过即暂停并升级给用户。保存后下一轮 goal 即生效，无需重载。'),
+  /**
+   * Max concurrent rounds across all sessions (default 0 = unlimited).
+   * Volatile: enforced at every launch, live on the next tool call.
+   */
+  maxConcurrentRounds: z.number().default(0).volatile().description('全局并行轮数上限（缺省 0 = 不限）：在跑轮数达到上限时拒绝启动新一轮，防止并行风暴。保存后即时生效，无需重载。'),
   /** Hard orchestration gate (default false). */
   hardGate: z.boolean().default(false).description('硬编排门：装配期从顶层 session agent 摘除执行工具，所有改动必须经 cybernetics goal + task agent。修改会触发插件重载。'),
   /** Tool names hidden in denylist mode (default DEFAULT_GATED_TOOLS). */
@@ -859,19 +901,39 @@ export function apply(ctx: any, config: Partial<Config> = {}) {
 
       // Flat settings-panel model fields fold into the canonical roles shape:
       // an unset field leaves its role untouched = inherit the session agent.
-      // Both fields are volatile (v0.7.7), so the loader hands back live
-      // references — unwrap through readConfigField ('' = inherit) exactly
-      // like the allGoalsMode live ref above.
-      const roleOverrides: RolesConfig = { ...(config.roles ?? {}) }
+      // All three fields are volatile (task/verify v0.7.7, triage v0.8.2), so
+      // the loader hands back live references — unwrap through readConfigField
+      // ('' = inherit) exactly like the allGoalsMode live ref above.
+      // roles may be volatile (a live reference, pre-0.8.3 configs) or a plain
+      // object (non-volatile since v0.8.4, configured via profile yaml) —
+      // readConfigField handles both shapes: a live ref is unwrapped, a plain
+      // object is returned as-is (hardGate and friends take the same path).
+      const roleOverrides: RolesConfig = { ...readConfigField(config.roles, {} as RolesConfig) }
       const taskSpec = parseAgentModelSpec(readConfigField(config.taskAgentModel, ''))
       if (taskSpec) roleOverrides.default = { ...roleOverrides.default, ...taskSpec }
       const verifySpec = parseAgentModelSpec(readConfigField(config.verifyAgentModel, ''))
       if (verifySpec) roleOverrides.verify = { ...roleOverrides.verify, ...verifySpec }
+      const triageSpec = parseAgentModelSpec(readConfigField(config.triageAgentModel, ''))
+      if (triageSpec) roleOverrides.triage = { ...roleOverrides.triage, ...triageSpec }
       const controllerConfig: ControllerConfig = {
         roundScriptPath: config.roundScriptPath ?? fileURLToPath(new URL('../workflows/round.js', import.meta.url)),
-        roundsPerSubgoal: config.roundsPerSubgoal,
+        // Volatile schema fields surface as live references — unwrap per round
+        // start so a settings-panel edit governs the next round (0/undefined
+        // falls back to the controller's built-in default).
+        roundsPerSubgoal: Math.max(1, Math.floor(readConfigField(config.roundsPerSubgoal, 3))),
         roles: roleOverrides,
       }
+      // Concurrent-round cap (0 = unlimited), read live at every launch.
+      const maxConcurrentRounds = () => {
+        const raw = Math.floor(readConfigField(config.maxConcurrentRounds, 0))
+        return Number.isFinite(raw) && raw > 0 ? raw : 0
+      }
+      const concurrentCapError = () => {
+        const cap = maxConcurrentRounds()
+        return cap > 0 && running.size >= cap
+          ? `cybernetics: 已有 ${running.size} 个运行中的轮，达到全局并行上限 ${cap}（可在设置面板调高 maxConcurrentRounds 或等待完成）`
+          : undefined
+      }
       const objective = loop.objective ?? goalView?.objective ?? loop.title ?? ''
 
       /**
@@ -904,6 +966,8 @@ export function apply(ctx: any, config: Partial<Config> = {}) {
        * goal's status is already 'running' when this is called.
        */
       const launchBackground = async (target: LoopState): Promise<{ round: number }> => {
+        const blocked = concurrentCapError()
+        if (blocked) throw new Error(blocked)
         const controller = new AbortController()
         if (exec.signal) {
           if (exec.signal.aborted) controller.abort()
@@ -1046,6 +1110,8 @@ export function apply(ctx: any, config: Partial<Config> = {}) {
       if (running.has(loop.goalId!)) {
         throw new Error(`cybernetics: goal "${loop.goalId}" already has a round in flight — collect or cancel it first`)
       }
+      const blocked = concurrentCapError()
+      if (blocked) throw new Error(blocked)
       loop.status = 'running'
       // In-flight visibility: the blocking 'round' path can run for minutes, so
       // publish before awaiting it (the async path needs no second publish —

package/workflows/round.js

@@ -36,13 +36,90 @@ const specFor = (key) => {
     : {}
 }
 
+// --- v0.8 调用级模型回退（call-level model fallback） --------------------------
+// 判定信号来自 workflow runtime（@deepseek-ai/dsh-workflow-ptc）的 agent() hook：
+//  - 抛出 WorkflowError：code AGENT_START（消息 `agent() could not start a child: …`，
+//    provider 解析 / 子 agent spawn / 首调失败——恒为可用性失败）或 AGENT_RESULT
+//    （`child agent run failed: …`，消息内嵌失败原因，需命中可用性模式才回退）；
+//    其余抛出（INVALID_ARGUMENT / UNSUPPORTED_* / AGENT_CAP 等脚本或守卫错误）
+//    原样上抛，绝不换模型。离线 harness 的 mock 错误没有 code 时按消息模式判定。
+//  - 返回 null：runtime 把子 agent 的失败压成 null 且不透传原因（子 run
+//    stopReason ≠ 'completed' —— LLM 调用中途失败（限额/网络/provider 报错经
+//    dsh-subagent 的 agent/error → stopReason 'error'）或无结构化产出）。仅当该
+//    角色配置了模型覆盖时，把 null 视为「覆盖模型疑似不可调用」，撤销覆盖以
+//    session agent 模型重试一次（无覆盖时 null 维持原失败语义——本来就跑在
+//    session 模型上，无处可退）。
+// 逻辑失败是返回值层面的判定（task agent 正常交付 done=false 的报告、verify
+// 给出未达成 verdict），从不触发回退。每次回退记录进 fallbacks（轮结果携带，
+// 随审计日志落盘），并经 log() 出现在 workflow/log 事件流。
+const fallbacks = []
+
+const errorTextOf = (err) => {
+  try { return String((err && (err.stack || err.message)) || err) } catch { return '' }
+}
+
+// 模型可用性失败的消息模式：限流/quota/鉴权/服务端不可用/网络/provider 解析。
+const AVAILABILITY_PATTERNS = [
+  /could not start a child/i,                                                    // AGENT_START 包装
+  /no subagent provider registered/i,                                            // 覆盖的 provider 未注册
+  // v0.8.3：配置的模型在模型设置里删除订阅（provider 仍在但该 model 不可路由）时
+  // 的典型报错形态（AGENT_RESULT 内嵌或无 code 的直抛），与既有模式互补。
+  /model not found|no such model|unknown model|invalid model|not subscribed|model .*not (?:available|enabled|found)/i,
+  /rate.?limit|\b429\b|too many requests/i,                                      // 限流
+  /quota|insufficient|额度|余额|配额/i,                                           // 限额 / quota 耗尽
+  /\b401\b|\b403\b|unauthorized|forbidden|invalid api key|authentication/i,      // 鉴权
+  /overloaded|service unavailable|temporarily unavailable|\b502\b|\b503\b|\b529\b/i, // 服务端不可用
+  /ECONNREFUSED|ECONNRESET|ECONNABORTED|ETIMEDOUT|ENOTFOUND|EAI_AGAIN|ENETUNREACH|EHOSTUNREACH|socket hang up|fetch failed|network/i, // 网络不可达
+]
+
+const isAvailabilityFailure = (err) => {
+  const code = err && typeof err === 'object' ? err.code : undefined
+  if (code === 'AGENT_START') return true // 子 agent 启动即失败恒为可用性失败
+  const text = errorTextOf(err)
+  return AVAILABILITY_PATTERNS.some((re) => re.test(text))
+}
+
+const specLabel = (spec) => [spec.provider, spec.model].filter(Boolean).join('/')
+
+/**
+ * 以角色模型覆盖调用 agent()；覆盖模型不可用（可用性错误或 null 无产出）时
+ * 回退到 session agent 的模型配置重试一次（不传 provider/model = 继承调用方）。
+ * 无覆盖 = 直接调用（无回退必要）；非可用性错误原样上抛；重试再失败降级为
+ * null（沿用既有「本轮无结果」路径，回退记录仍可见）。
+ */
+const callRoleAgent = async (roleKey, prompt, opts) => {
+  const spec = specFor(roleKey)
+  const overridden = !!(spec.provider || spec.model)
+  try {
+    const result = await agent(prompt, { ...opts, ...spec })
+    if (result === null && overridden) {
+      const reason = 'agent() 返回 null（runtime 未透传原因：子 agent 未完成或无结构化产出），疑似覆盖模型不可调用'
+      fallbacks.push({ role: roleKey, from: spec, trigger: 'null-result', reason })
+      log(`[cybernetics fallback] ${roleKey} 角色覆盖模型 ${specLabel(spec)} 执行无产出，回退到 session agent 模型重试`)
+      try { return await agent(prompt, opts) } catch { return null }
+    }
+    return result
+  } catch (err) {
+    if (overridden && isAvailabilityFailure(err)) {
+      const reason = errorTextOf(err).split('\n')[0].slice(0, 300)
+      fallbacks.push({ role: roleKey, from: spec, trigger: 'availability-error', reason })
+      log(`[cybernetics fallback] ${roleKey} 角色覆盖模型 ${specLabel(spec)} 调用失败（${reason}），回退到 session agent 模型重试`)
+      try { return await agent(prompt, opts) } catch { return null }
+    }
+    throw err
+  }
+}
+
+/** 轮结果统一携带回退记录（空数组 = 未发生回退）。 */
+const withFallbacks = (out) => ({ ...out, fallbacks })
+
 // v0.6 TeamExecutor: the persistent teammate already did the task work; the
 // controller hands its report in as `taskReport`. Skip the task agent entirely
 // and go straight to verify/triage (quick depth returns the derived verdict).
 if (taskReport && typeof taskReport === 'object') {
   const report = taskReport
   if (depth === 'quick') {
-    return {
+    return withFallbacks({
       round: state.round,
       report,
       verdict: {
@@ -53,10 +130,10 @@ if (taskReport && typeof taskReport === 'object') {
         goalItselfQuestionable: false,
       },
       triage: { auto: [], defer: [], reject: [], human: [] },
-    }
+    })
   }
   await phase('verify')
-  const verdict = await agent(
+  const verdict = await callRoleAgent('verify',
     [
       `你是独立的 verify agent：你没有、也不应获得 task agent 的叙述过程。`,
       `下面是目标、工作委托书和 task agent 的报告，请基于证据判定本轮是否达成目标。`,
@@ -72,7 +149,7 @@ if (taskReport && typeof taskReport === 'object') {
       ``,
       `判定标准：证据是否支撑报告的每一项结论；是否覆盖了本轮子目标；是否存在未验证的断言。`,
     ].join('\n'),
-    { label: 'verify', ...specFor('verify'), schema: {
+    { label: 'verify', schema: {
       type: 'object', additionalProperties: false,
       required: ['met', 'criteria', 'gaps', 'goalItselfQuestionable'],
       properties: {
@@ -84,7 +161,7 @@ if (taskReport && typeof taskReport === 'object') {
     } },
   )
   await phase('triage')
-  const triage = await agent(
+  const triage = await callRoleAgent('triage',
     [
       `你是 triage agent：把 verify 的缺口拆成四类处置建议。`,
       ``,
@@ -94,7 +171,7 @@ if (taskReport && typeof taskReport === 'object') {
       `【本轮子目标】`,
       subgoal || '',
     ].join('\n'),
-    { label: 'triage', ...specFor('triage'), schema: {
+    { label: 'triage', schema: {
       type: 'object', additionalProperties: false,
       required: ['auto', 'defer', 'reject', 'human'],
       properties: {
@@ -106,9 +183,9 @@ if (taskReport && typeof taskReport === 'object') {
     } },
   )
   if (verdict === null || triage === null) {
-    return { round: state.round, report, failed: 'verify/triage agent 失败，本轮无结论' }
+    return withFallbacks({ round: state.round, report, failed: 'verify/triage agent 失败，本轮无结论' })
   }
-  return { round: state.round, report, verdict, triage }
+  return withFallbacks({ round: state.round, report, verdict, triage })
 }
 
 await phase('task')
@@ -119,7 +196,7 @@ await phase('task')
 // enough to fully drive execution) falling back to the durable objective.
 const workOrder = (brief && brief.trim()) || goal.objective
 
-const report = await agent(
+const report = await callRoleAgent(role ?? 'default',
   [
     `你是一个独立的 task agent：不继承任何对话历史，从零开始工作。`,
     `下面这份工作委托书是你可以获得的全部任务信息，它被要求详细到足以让你独立完成当前工作；`,
@@ -142,7 +219,7 @@ const report = await agent(
     `完成后交付：summary、done、artifacts、evidence、nextStepThoughts。`,
     `nextStepThoughts 只记录"值得做但超出本轮子目标"的后续工作线索，不要执行它们。`,
   ].join('\n'),
-  { label: `task:${role ?? 'default'}`, ...specFor(role ?? 'default'), schema: {
+  { label: `task:${role ?? 'default'}`, schema: {
     type: 'object', additionalProperties: false,
     required: ['summary', 'done', 'artifacts', 'evidence', 'nextStepThoughts'],
     properties: {
@@ -155,14 +232,14 @@ const report = await agent(
 )
 
 if (report === null) {
-  return { round: state.round, failed: 'task agent 失败，本轮无结果' }
+  return withFallbacks({ round: state.round, failed: 'task agent 失败，本轮无结果' })
 }
 
 // quick depth: lightweight analysis — one agent, one round, direct feedback.
 // Skip verify/triage entirely; derive a verdict-shaped outcome from the
 // task report so the controller's decision logic works unchanged.
 if (depth === 'quick') {
-  return {
+  return withFallbacks({
     round: state.round,
     report,
     verdict: {
@@ -173,12 +250,12 @@ if (depth === 'quick') {
       goalItselfQuestionable: false,
     },
     triage: { auto: [], defer: [], reject: [], human: [] },
-  }
+  })
 }
 
 await phase('verify')
 
-const verdict = await agent(
+const verdict = await callRoleAgent('verify',
   [
     `你是 verify agent，独立验收 task agent 的交付。你只对照目标判定达成度，把目标拆成可判定的方面逐条列出并判定，每个判断必须给出证据；`,
     `不重做工作，不接受"大概完成了"。`,
@@ -192,7 +269,7 @@ const verdict = await agent(
     ``,
     `若你认为是目标本身有问题（而非执行缺口），置 goalItselfQuestionable=true。`,
   ].join('\n'),
-  { label: 'verify', ...specFor('verify'), schema: {
+  { label: 'verify', schema: {
     type: 'object', additionalProperties: false,
     required: ['met', 'criteria', 'gaps', 'goalItselfQuestionable'],
     properties: {
@@ -209,12 +286,12 @@ const verdict = await agent(
 )
 
 if (verdict === null) {
-  return { round: state.round, failed: 'verify agent 失败，本轮无结果', report }
+  return withFallbacks({ round: state.round, failed: 'verify agent 失败，本轮无结果', report })
 }
 
 await phase('triage')
 
-const triage = await agent(
+const triage = await callRoleAgent('triage',
   [
     `你是 goal agent。对 task agent 提出的后续工作线索做三分拣：`,
     `- auto：目标内、低风险、可自动执行的下一步工作`,
@@ -229,7 +306,7 @@ const triage = await agent(
     `待分拣线索：`,
     ...report.nextStepThoughts.map((s, i) => `${i + 1}. ${s}`),
   ].join('\n'),
-  { label: 'triage', ...specFor('triage'), schema: {
+  { label: 'triage', schema: {
     type: 'object', additionalProperties: false,
     required: ['auto', 'defer', 'reject', 'human'],
     properties: {
@@ -242,4 +319,4 @@ const triage = await agent(
   } },
 )
 
-return { round: state.round, report, verdict, triage: triage ?? { auto: [], defer: [], reject: [], human: [] } }
+return withFallbacks({ round: state.round, report, verdict, triage: triage ?? { auto: [], defer: [], reject: [], human: [] } })