@modusensus/dsh-mneme 0.9.4 → 0.10.0

package/test/scope-candidates.test.js

@@ -53,7 +53,7 @@ function llmCtx(captured = [], selection = { provider: "mock", model: "sleep-mod
       async *stream(options) {
         captured.push(options);
         const userText = options.messages.find((m) => m.role === "user")?.content?.[0]?.text ?? "";
-        yield { type: "text-delta", index: 0, text: userText.startsWith("候选冲突") || userText.startsWith("Candidate conflicts") ? "[]" : "[]" };
+        yield { type: "text-delta", index: 0, text: options.purpose === "sleep-conflict" ? "[]" : "[]" };
         yield { type: "finish", reason: { kind: "stop" } };
       }
     }
@@ -210,7 +210,7 @@ test("non-freeze with an LLM: cross-scope pair bypasses adjudication; same-scope
   ctx.llm.stream = async function* (options) {
     captured.push(options);
     const userText = options.messages.find((m) => m.role === "user")?.content?.[0]?.text ?? "";
-    const isConflictPass = userText.startsWith("候选冲突") || userText.startsWith("Candidate conflicts");
+    const isConflictPass = options.purpose === "sleep-conflict";
     const text = isConflictPass
       ? JSON.stringify([{ action: "conflict", winner: yNew.id, loser: yOld.id, reason: "同归属重复" }])
       : "[]";
@@ -221,9 +221,12 @@ test("non-freeze with an LLM: cross-scope pair bypasses adjudication; same-scope
   const result = await runSleep(ctx, service, baseConfig(), ctx.logger, { embedder, vectorIndex }, null);
   assert.equal(result.status, "ok");
 
+  // 认「哪一次是冲突裁决」改按 purpose，不再看 user 段首行：#493 追加的围栏让 user 段以
+  // 角色声明开头，而败者行的溯源注释里也会出现「候选冲突」这个词——用 includes 会把模式
+  // 阶段误判成冲突阶段。purpose 与 prompt 形态彻底解耦。
   const conflictPassTexts = captured
-    .map((o) => o.messages.find((m) => m.role === "user")?.content?.[0]?.text ?? "")
-    .filter((t) => t.startsWith("候选冲突") || t.startsWith("Candidate conflicts"));
+    .filter((o) => o.purpose === "sleep-conflict")
+    .map((o) => o.messages.find((m) => m.role === "user")?.content?.[0]?.text ?? "");
   assert.ok(conflictPassTexts.length >= 1, "conflict pass ran for the same-scope pair");
   for (const t of conflictPassTexts) {
     assert.ok(!t.includes(xNew.id) && !t.includes(xOld.id), "cross-scope pair must never enter the LLM prompt");

package/test/scope-state.test.js

@@ -421,6 +421,135 @@ test("睡眠侧：被按下作用域的行不进 pattern 扫描池，也就不
   store.close();
 });
 
+// --- issue #515：闸门把可扫行挡在 LIMIT 窗口之外 ---------------------------
+//
+// 上面那条用例锁的是「政策轴排在截断之前」，但它的库只有 4 行，根本碰不到
+// store.list 的 `LIMIT 200`，所以它测不到 #515 真正的症状：被按下的行**多到占满窗口**
+// 时，过滤前它们吃掉全部名额、过滤后自家行一条都不剩，相位回 `no memories to scan`
+// ——读起来像「库里没东西可扫」，实际是「闸门把可扫的行挡在了窗口里」。
+// 修复方向是不动判定、只放宽取数：窗口过滤后不够本次要扫的名额时，不带窗口重取一次。
+//
+// 造「自家行在窗口之外」用的是 importance 而不是 updated_at：默认档位是
+// `importance DESC, updated_at DESC, id`，而 store.save 的时间戳由实现内部取
+// nowIso()（调用方传不进去），同毫秒落库的行会退到 id 平局键——靠时间戳排序会依赖
+// 插入速度，快机器上自家行可能反而排进窗口，用例就成了偶发绿。importance 差（5 vs 1）
+// 让被按下的那批恒占窗口前排，与毫秒无关。
+
+/** 填满 200 窗口的按下行 + 两条落在窗口之外的自家行。 */
+function seedStarvedPatternPool(store, service) {
+  const own = [];
+  for (const t of ["own-1", "own-2"]) {
+    own.push(store.save({ type: "project", title: t, content: `${t} 正文`, importance: 1 }));
+  }
+  for (let i = 0; i < 200; i++) {
+    store.save({
+      type: "project", title: `paused-${i}`, content: `paused-${i} 正文`, importance: 5,
+      workspace_scope: "proj-a", workspace_scope_source: "explicit"
+    });
+  }
+  service.setScopeState({ dimension: "workspace", scope_value: "proj-a", state: "paused" });
+  return own;
+}
+
+/** 记录 service.list 的入参（只包 list，其余方法原样透出），用于「付了几次查询」。 */
+function countingList(service, calls) {
+  return new Proxy(service, {
+    get(target, prop) {
+      if (prop === "list") {
+        return (query) => {
+          calls.push(query);
+          return target.list(query);
+        };
+      }
+      return Reflect.get(target, prop, target);
+    }
+  });
+}
+
+test("#515：被按下的行占满 LIMIT 200 窗口时，模式扫描不报「没东西可扫」", async () => {
+  const { store, service } = setup(sleepConfig());
+  seedStarvedPatternPool(store, service);
+
+  const seen = [];
+  const ctx = {
+    ...sleepCtx(),
+    llm: {
+      async *stream(options) {
+        const text = options.messages.find((m) => m.role === "user")?.content?.[0]?.text ?? "";
+        // 认清单**形状**（行里带 `| importance=`），不认首行——#501/#493 那批围栏让 user 段以角色声明开头了
+        if (text.includes("| importance=")) seen.push(text);
+        yield { type: "text-delta", index: 0, text: "[]" };
+        yield { type: "finish", reason: { kind: "stop" } };
+      }
+    }
+  };
+  const result = await runSleep(ctx, service, sleepConfig(), ctx.logger, null, null);
+  const patterns = result.phases.patterns;
+
+  assert.notEqual(patterns?.reason, "no memories to scan",
+    `窗口被按下行占满时不该静默跳过，实得 ${JSON.stringify(patterns)}`);
+  // 反向断言：这条才是「真的扫了」的证据——只断上面那句的话，一个「相位整个没跑」
+  // 的实现（连 reason 都不产出）也能过。
+  assert.equal(seen.length, 1, "模式扫描必须真发起了这次 LLM 调用");
+  assert.ok(seen[0].includes("own-1") && seen[0].includes("own-2"), "窗口外的自家行要被重取回来");
+  // 重取只放宽窗口，不放宽判定：被按下的行一条都不许混进提示。
+  assert.ok(!seen[0].includes("paused-"), "被按下的行不该因为重取而混进扫描池");
+  store.close();
+});
+
+test("#515：重取按需——闸门没按下且窗口够用时，仍只付一次有界查询", async () => {
+  const { store, service } = setup(sleepConfig());
+  // 120 条自家行（无闸门）：过滤后的池子 ≥ sleepPatternMinMemories(100)，窗口没被吃掉，
+  // 第二趟不该发生。这一条锁的是「常态仍只付一次有界查询」那半句承诺。
+  for (let i = 0; i < 120; i++) {
+    store.save({ type: "project", title: `m-${i}`, content: `m-${i} 正文`, importance: 3 });
+  }
+  const calls = [];
+  const ctx = sleepCtx();
+  await runSleep(ctx, countingList(service, calls), sleepConfig(), ctx.logger, null, null);
+
+  assert.equal(calls.length, 1, `常态只该取一次，实得 ${calls.length} 次`);
+  assert.equal(calls[0].limit, 200, "常态走的是有界窗口");
+  store.close();
+});
+
+test("#515：窗口跟着配额走——把 sleepPatternMinMemories 配到 200 之上时，常态仍不触发无界重取", async () => {
+  // 这条锁的是我自己差点留下的坑：合法上限是 1000（src/config.js:612），若窗口仍是死的
+  // 200，凡把这个值配到 200 以上的人**每一轮**都会白付一次全表重取，跟闸门按没按下无关。
+  const config = sleepConfig({ sleepPatternMinMemories: 300 });
+  const { store, service } = setup(config);
+  for (let i = 0; i < 400; i++) {
+    store.save({ type: "project", title: `m-${i}`, content: `m-${i} 正文`, importance: 3 });
+  }
+  const calls = [];
+  const ctx = sleepCtx();
+  await runSleep(ctx, countingList(service, calls), config, ctx.logger, null, null);
+
+  assert.equal(calls.length, 1, `窗口够用时不该重取，实得 ${calls.length} 次`);
+  assert.equal(calls[0].limit, 300, "窗口至少等于本次要扫的名额");
+  store.close();
+});
+
+test("#515：窗口饿死时重取一次，且只放宽 limit——三条过滤轴一条不许动", async () => {
+  const { store, service } = setup(sleepConfig());
+  seedStarvedPatternPool(store, service);
+
+  const calls = [];
+  const ctx = sleepCtx();
+  await runSleep(ctx, countingList(service, calls), sleepConfig(), ctx.logger, null, null);
+
+  assert.equal(calls.length, 2, `饿死时补一趟无界重取，实得 ${calls.length} 次`);
+  assert.equal(calls[0].limit, 200);
+  assert.equal(calls[1].limit, null, "重取是不带窗口（store.list 的 limit == null 即无界档）");
+  // 除 limit 之外的口径必须逐字段相同：重取放宽的是窗口，不是判定。
+  assert.deepEqual(
+    { ...calls[0], limit: null },
+    calls[1],
+    "第二趟只能比第一趟少一个窗口，excludeTypes/excludeImported/includeForgotten 都得在"
+  );
+  store.close();
+});
+
 test("睡眠侧：被按下作用域的行不进关系补全的候选池", async () => {
   const { store, service } = setup(sleepConfig());
   const alpha = service.createEntity({ name: "Alpha", type: "project" });
@@ -453,7 +582,7 @@ test("巩固侧：被按下作用域的行不进总览输入——否则会被
     llm: {
       async *stream(options) {
         const userText = options.messages.find((m) => m.role === "user")?.content?.[0]?.text ?? "";
-        if (userText.startsWith("id=")) {
+        if (userText.includes("| type=")) {
           yield { type: "text-delta", index: 0, text: "[]" };
           yield { type: "finish", reason: { kind: "stop" } };
           return;

package/test/security-doc.test.js

@@ -104,10 +104,22 @@ function routesInBullet(line) {
   return out;
 }
 
-function bullet(prefix) {
-  const line = doc.split(/\r?\n/).find((l) => l.startsWith(prefix));
-  assert.ok(line, `SECURITY.md 里应有以「${prefix}」开头的清单行`);
-  return routesInBullet(line);
+// 清单行必须**恰好一条**。原先用 .find() 只读第一条命中，于是「同一条目出现两份」
+// 这件事守卫完全无感：#509 的 merge 把两份 Open reads / Gated routes 一起解进来，
+// 其中一份 stale（少 /memory/provenance），CI 却全绿——因为 .find() 读的是第一份。
+// 「文档与代码平价」的全部信心都来自这个文件，一旦它对重复条目零感知，第二份就是没有守卫的谎话。
+// 所以这里先收全部命中，再判唯一；多于一条时把行号报出来，避免变成「哪份算数」的新谜题。
+// source 参数只为可测：守卫本身是「唯一性」，喂一份合成的重复文档就能验，不必真去改 SECURITY.md。
+function bullet(prefix, source = doc) {
+  const hits = [];
+  source.split(/\r?\n/).forEach((line, i) => {
+    if (line.startsWith(prefix)) hits.push({ line, no: i + 1 });
+  });
+  assert.ok(hits.length > 0, `SECURITY.md 里应有以「${prefix}」开头的清单行`);
+  assert.equal(hits.length, 1,
+    `SECURITY.md 里以「${prefix}」开头的清单行必须恰好一条，实际 ${hits.length} 条（行号 ${hits.map((h) => h.no).join(", ")}）。` +
+    "清单只许有一份：多出来的那份不会被本文件校验，改它不会红，只能靠删掉来保持平价。");
+  return routesInBullet(hits[0].line);
 }
 
 // 文档里的 /semantic/graph/* 覆盖代码里的 /semantic/graph/ego 与 /semantic/graph/entity-attrs。
@@ -137,3 +149,30 @@ test("SECURITY.md 的受门控清单与代码里的 policy 声明一致", () =>
     assert.deepEqual(stale, [], `${prefix} 写了代码里并不受门控的路由：${stale.join(", ")}`);
   }
 });
+
+// 上面那条唯一性断言本身要有回归：把 SECURITY.md 的清单行复制成两份必须红。
+// 这条用例喂合成文档，不碰真文件——真文件的平价由上面两条双向比对负责。
+// 变异自证（人工做过一次，记录在 PR 里）：把 Gated routes 那一行原样复制一份 → 红；
+// 复制成两份且第二份把 /memory/provenance 换成别的 → 也红。两种都只在「恰好一条」上红。
+test("重复的清单行会被守卫抓住（#523）", () => {
+  const gated = doc.split(/\r?\n/).find((l) => l.startsWith("- **Gated routes"));
+  assert.ok(gated, "SECURITY.md 里应有 Gated routes 清单行");
+
+  const withDup = ["# synthetic", gated, gated].join("\n");
+  assert.throws(
+    () => bullet("- **Gated routes", withDup),
+    /必须恰好一条，实际 2 条（行号 2, 3）/,
+    "同一清单行出现两份时必须报出重复的行号——这正是 #509 merge 时守卫看不见的形状"
+  );
+
+  // 内容不同的两份同样要红：危险的不是写错了什么，而是那份副本对守卫隐形。
+  const staleDup = ["# synthetic", gated, gated.replace("/memory/provenance", "/memory/provenance-OLD")].join("\n");
+  assert.throws(
+    () => bullet("- **Gated routes", staleDup),
+    /必须恰好一条，实际 2 条/,
+    "两份内容不同的清单同样必须红，否则陈旧副本可以一直过期"
+  );
+
+  // 只有一份时不能误伤。
+  assert.ok(bullet("- **Gated routes", gated).length > 0);
+});

package/test/serve.test.js

@@ -4,6 +4,8 @@ import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { createServeRuntime } from "../src/serve.js";
+import { createStore } from "../src/store.js";
+import { createSettings } from "../src/settings.js";
 
 // daemon 装配面锁(test/serve-bin.test.js 另有真子进程 + 多进程共存):
 // in-process 起真 HTTP(port 0,OS 分配),fetch 走 health / 401 / save / search /
@@ -194,3 +196,63 @@ test("serve: 非法 embed provider 拒装配;embed=off 时 semantic 为 null", a
     try { rmSync(dir, { recursive: true, force: true }); } catch { /* 同上 */ }
   }
 });
+
+// --- GET /memory/provenance 的 distillRecords.enabled 门（#509 评审整改）--------
+// 单独立一条 daemon 级用例的理由：standalone 的既有用例是手搭 config 骗过门的，
+// 而 daemon 的 cfg 来自 serve.js 自己装配（原本是最小集，一个 distillRecords 键都没有）
+// ——不测真实装配，就会漏掉「daemon 恒定回功能关了」这一整类回归。
+async function seedFlags(dir, patch) {
+  const seed = createStore(join(dir, "memory.db"));
+  createSettings(seed.db).setFeatureFlags(patch);
+  seed.close();
+}
+
+test("serve: /memory/provenance 跟随面板开关（开着读得到）", async () => {
+  const dir = tmpDir();
+  await seedFlags(dir, { "distillRecords.enabled": true });
+  const rt = await createServeRuntime({ memoryDir: dir, port: 0, embed: "off" });
+  await rt.api.ready;
+  try {
+    const base = `http://127.0.0.1:${rt.api.port}`;
+    const auth = { authorization: `Bearer ${rt.api.token}` };
+    // 先经数据面写一条记忆，再直接落溯源链接与原文（写入面不关心是谁写的）。
+    const saved = await fetch(`${base}/memories`, {
+      method: "POST", headers: { ...auth, "content-type": "application/json" },
+      body: JSON.stringify({ type: "decision", title: "核心决策", content: "选定 SQLite 单文件库", importance: 5 })
+    });
+    const savedBody = await saved.json();
+    const memoryId = savedBody.memory?.id ?? savedBody.id;
+    rt.store.saveMemoryProvenance({ memoryId, sessionId: "s1", seqStart: 10, seqEnd: 11, createdAt: "2026-10-23T00:00:00Z" });
+    rt.store.saveDistillRecords([
+      { sessionId: "s1", seq: 10, role: "user", text: "第一句原文", windowId: "w1", distilledAt: "2026-10-23T00:00:00Z" },
+      { sessionId: "s1", seq: 11, role: "assistant", text: "第二句原文", windowId: "w1", distilledAt: "2026-10-23T00:00:00Z" }
+    ]);
+
+    const res = await fetch(`${base}/memory/provenance?id=${encodeURIComponent(memoryId)}`, { headers: auth });
+    assert.equal(res.status, 200, "面板开着的留存，daemon 必须读得到（serve.js 把开关展开进了 cfg）");
+    const body = await res.json();
+    assert.deepEqual(body.windows[0].records.map((r) => r.text), ["第一句原文", "第二句原文"]);
+  } finally {
+    rt.dispose();
+    try { rmSync(dir, { recursive: true, force: true }); } catch { /* win 文件锁偶发 */ }
+  }
+});
+
+test("serve: 面板从没设过 distillRecords.enabled → daemon 这一面按关处理（409）", async () => {
+  // 残留不对称（写进 docs/DAEMON.md）：只靠 bundle 配置打开、从没在面板点过的用户，
+  // 宿主认、daemon 不认——daemon 结构上看不到宿主的 bundle config。这是已知的那一半，
+  // 不是本用例要修的；这里锁的是「没设过 → 关」这个 fail-closed 方向本身。
+  const dir = tmpDir();
+  const rt = await createServeRuntime({ memoryDir: dir, port: 0, embed: "off" });
+  await rt.api.ready;
+  try {
+    const res = await fetch(`http://127.0.0.1:${rt.api.port}/memory/provenance?id=m1`, {
+      headers: { authorization: `Bearer ${rt.api.token}` }
+    });
+    assert.equal(res.status, 409);
+    assert.deepEqual(await res.json(), { error: "distill-records-disabled" });
+  } finally {
+    rt.dispose();
+    try { rmSync(dir, { recursive: true, force: true }); } catch { /* win 文件锁偶发 */ }
+  }
+});

package/test/session-gate.test.js

@@ -0,0 +1,264 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { Config } from "../src/config.js";
+import { createSessionGate } from "../src/session-gate.js";
+import { createStore } from "../src/store.js";
+import { createService } from "../src/service.js";
+import { createSettings } from "../src/settings.js";
+import { createInjector } from "../src/inject.js";
+import { MEMORY_GUIDE_SECTION } from "../src/guide.js";
+import { createTools } from "../src/tools.js";
+import { createSummarizer } from "../src/summarize.js";
+
+test("session gate defaults off and gates subagents by the host's delegation marks", () => {
+  const defaults = Config({});
+  assert.equal(defaults.sessionGateEnabled, false);
+  assert.equal(defaults.sessionGateSubagents, true);
+  assert.deepEqual(defaults.sessionGateSessions, []);
+
+  const gate = createSessionGate({ sessionGateEnabled: true, sessionGateSubagents: true });
+  const sessions = [
+    { id: "header-origin", header: { origin: "subagent" } },
+    { id: "header-depth", header: { delegationDepth: 2 } },
+    { id: "header-both", header: { parentSession: "captain", origin: "subagent", delegationDepth: 1 } },
+    { id: "request-origin", requestHeader: () => ({ config: { origin: "subagent", delegationDepth: 1 } }) }
+  ];
+  for (const session of sessions) {
+    assert.equal(gate.isOff(session), true, session.id);
+  }
+
+  const firstEvent = { id: "first-event", header: { parentSession: "captain", origin: "subagent" } };
+  assert.equal(gate.isOff(firstEvent), true, "header match works before any session/event was observed");
+  gate.observe(firstEvent);
+  assert.equal(gate.isOff("first-event"), true, "observed child ids remain recognizable in log scans");
+});
+
+// 形状锁：`parentSession` 是「有父会话」，不是「是子代理」。dsh-session 的
+// sessions.fork() 给**主会话分支**也写 parentSession（且不写 origin / 不带
+// delegationDepth），把它当判据就会让用户 fork 出来的普通会话整体失忆。
+// 本机 641 个真实会话头实测：origin/delegationDepth 命中 455 个子代理、零漏检，
+// parentSession 对子代理识别零贡献、只多判出 3 个 fork 主会话（各有 74–136 条
+// 用户消息、694 次工具调用）。这条用例锁的就是那次误判不许回来。
+test("parentSession alone never gates: forked captain sessions stay fully enabled", () => {
+  const gate = createSessionGate({ sessionGateEnabled: true, sessionGateSubagents: true });
+  const forked = { id: "forked-captain", header: { parentSession: "captain", isSeeded: true, delegationDepth: 0 } };
+  assert.equal(gate.isOff(forked), false, "a fork of a captain session is still a captain session");
+  assert.equal(gate.isOff({ id: "flat-parent", parentSession: "captain" }), false);
+  assert.equal(gate.isOff({ id: "alias-parent", parentSessionId: "captain" }), false);
+  assert.equal(gate.isOff({ id: "request-parent", requestHeader: () => ({ config: { parentSession: "captain" } }) }), false);
+  gate.observe(forked);
+  assert.equal(gate.isOff("forked-captain"), false, "observing a non-child must not record it as one");
+});
+
+test("manual ids survive the subagent switch, master-off is inert, and config is read live", () => {
+  const cfg = { sessionGateEnabled: false, sessionGateSubagents: false, sessionGateSessions: ["manual"] };
+  const gate = createSessionGate(cfg);
+  const manual = { id: "manual" };
+  const child = { id: "child", header: { origin: "subagent" } };
+
+  assert.equal(gate.isOff(manual), false, "the master is the only opt-in");
+  cfg.sessionGateEnabled = true;
+  assert.equal(gate.isOff(manual), true, "manual id matches even when automatic child detection is off");
+  assert.equal(gate.isOff(child), false, "subagent switch independently controls automatic matching");
+  cfg.sessionGateSubagents = true;
+  assert.equal(gate.isOff(child), true, "the next call sees a live config change");
+  cfg.sessionGateEnabled = false;
+  assert.equal(gate.isOff(manual), false, "turning the master off restores normal behavior immediately");
+
+  // 复现 comment 6541389（#541）：上面刚把总开关关掉，若在这里直接断言
+  // doesNotThrow，isEnabled() 就先把调用挡回去了，id getter 那条保护路径
+  // 一次都不会执行——测的是「关掉时不出事」，不是「读不到 id 时不出事」。
+  // 所以先开总开关，再断言两件事：不抛，且被当成普通会话（false），
+  // 而不是被当成「id 为空所以放行」的巧合。
+  cfg.sessionGateEnabled = true;
+  const inaccessible = {};
+  Object.defineProperty(inaccessible, "id", { get() { throw new Error("host getter"); } });
+  assert.doesNotThrow(() => gate.isOff(inaccessible));
+  assert.equal(gate.isOff(inaccessible), false, "an unreadable id is an ordinary session, not a gated one");
+});
+
+// #539 原文：「子会话在首次 session/event 之前就可能组装上下文，故必须直接检查
+// 传入 session，不能只靠事件后记录 ID」。所以「拿不到 id」不能当作「不是无痕
+// 会话」——那一行早退正是这条要求最容易失守的地方（注入面在上下文组装期跑的
+// 就是这条路径）。手动名单仍然依赖 id，那是名单本身的形状，不是缺陷。
+test("a subagent session without a usable id is still gated", () => {
+  const gate = createSessionGate({ sessionGateEnabled: true, sessionGateSubagents: true });
+  assert.equal(gate.isOff({ header: { origin: "subagent" } }), true, "id-less subagent header");
+  assert.equal(gate.isOff({ header: { delegationDepth: 1 } }), true, "id-less delegation depth");
+  assert.equal(gate.isOff({ id: "", header: { origin: "subagent" } }), true, "empty id is the same as missing");
+  assert.equal(gate.isOff({}), false, "no id and no child mark is an ordinary session");
+  assert.equal(gate.isOff(null), false);
+  assert.equal(gate.isOff(undefined), false);
+  const offSwitch = createSessionGate({ sessionGateEnabled: true, sessionGateSubagents: false });
+  assert.equal(offSwitch.isOff({ header: { origin: "subagent" } }), false, "the subagent switch still wins");
+});
+
+// 记账表只服务「日志扫描拿得到 id、却解析不出头」这一条退路，所以它必须有界：
+// 长驻宿主跑上几百个子代理后只涨不落会把每个 id 永久留在内存里，而淘汰最旧的
+// 代价只是那一次日志过滤少认一个会话，活路径永远直接用会话对象判定。
+test("tracked child ids stay bounded and eviction only costs the log-scan fallback", () => {
+  const gate = createSessionGate({ sessionGateEnabled: true, sessionGateSubagents: true });
+  for (let i = 0; i < 600; i += 1) gate.observe({ id: `child-${i}`, header: { origin: "subagent" } });
+  assert.equal(gate.isOff("child-599"), true, "the newest child is still tracked");
+  assert.equal(gate.isOff("child-0"), false, "the oldest id was evicted instead of kept forever");
+  gate.observe({ id: "child-599", header: { origin: "subagent" } });
+  assert.equal(gate.isOff("child-599"), true, "re-observing the same id stays stable");
+});
+
+function injectionSetup() {
+  const store = createStore(":memory:");
+  const service = createService({ store, mirror: null, config: {} });
+  const settings = createSettings(store.db);
+  service.saveWithDedupe({ type: "preference", title: "语言", content: "中文", importance: 5 });
+  settings.setProfile("用户画像正文");
+  settings.setRules(["先给结论"]);
+  const contexts = [];
+  const sections = [];
+  const ctx = {
+    systemPrompt: {
+      context(definition) { contexts.push(definition); return () => {}; },
+      section(definition) { sections.push(definition); return () => {}; }
+    }
+  };
+  const gate = createSessionGate({
+    sessionGateEnabled: true,
+    sessionGateSubagents: true,
+    sessionGateSessions: ["private"]
+  });
+  createInjector(ctx, service, settings, { injectGuidanceEnabled: true }, null, gate);
+  return { store, contexts, sections, gate };
+}
+
+test("all system-prompt surfaces are empty for incognito and remain available to captain", () => {
+  const { contexts, sections, gate } = injectionSetup();
+  const memory = contexts.find((item) => item.name === "memory");
+  const userSettings = contexts.find((item) => item.name === "user-settings");
+  const guide = sections.find((item) => item.name === "memory-guide");
+  const privateContext = { agent: { session: { id: "private" } } };
+  const childContext = { agent: { session: { id: "worker", header: { parentSession: "captain", origin: "subagent" } } } };
+  const captainContext = { agent: { session: { id: "captain", header: { origin: "main" } } } };
+
+  assert.equal(memory.text(privateContext), "");
+  assert.equal(userSettings.text(privateContext), "");
+  assert.equal(guide.text(privateContext), "");
+  assert.equal(memory.text(childContext), "");
+  assert.equal(userSettings.text(childContext), "");
+  assert.equal(guide.text(childContext), "");
+
+  assert.match(memory.text(captainContext), /\[记忆库\]/);
+  assert.match(userSettings.text(captainContext), /用户画像正文/);
+  assert.equal(guide.text(captainContext), MEMORY_GUIDE_SECTION);
+  gate.observe(childContext.agent.session);
+  assert.equal(gate.isOff("worker"), true);
+});
+
+test("every registered memory tool rejects before side effects for an incognito session", async () => {
+  const store = createStore(":memory:");
+  const baseService = createService({ store, mirror: null, config: {} });
+  let serviceCalls = 0;
+  const service = new Proxy(baseService, {
+    get(target, key, receiver) {
+      const value = Reflect.get(target, key, receiver);
+      if (typeof value !== "function") return value;
+      return (...args) => {
+        serviceCalls += 1;
+        return value.apply(target, args);
+      };
+    }
+  });
+  const registered = [];
+  const registry = { register(tool) { registered.push(tool); return () => {}; } };
+  const gate = createSessionGate({ sessionGateEnabled: true, sessionGateSessions: ["private"] });
+  createTools({ tools: registry }, service, {}, null, gate);
+  const exec = { agent: { session: { id: "private" } } };
+
+  assert.ok(registered.length >= 11);
+  for (const tool of registered) {
+    await assert.rejects(tool.execute({}, exec), /incognito session/, tool.name);
+  }
+  assert.equal(serviceCalls, 0, "rejected calls do not reach memory service reads or writes");
+  assert.equal(store.count(), 0, "no memory rows were written through an executor");
+  assert.equal(store.db.prepare("SELECT COUNT(*) AS n FROM scope_state").get().n, 0, "set_scope_state also rejects before writing");
+
+  const captainSave = registered.find((tool) => tool.name === "memory_save");
+  const result = await captainSave.execute(
+    { type: "preference", title: "captain", content: "可用", importance: 4 },
+    { agent: { session: { id: "captain", header: { origin: "main" } } } }
+  );
+  assert.equal(result.action, "created", "normal captain tool use is unaffected");
+  assert.equal(store.count(), 1);
+  store.close();
+});
+
+test("retained tool executors use the latest gate after live registry reapply", async () => {
+  const store = createStore(":memory:");
+  const service = createService({ store, mirror: null, config: {} });
+  const registered = [];
+  const registry = { register(tool) { registered.push(tool); return () => {}; } };
+  const initialGate = createSessionGate({ sessionGateEnabled: true, sessionGateSessions: ["private"] });
+  createTools({ tools: registry }, service, {}, null, initialGate);
+  const retainedSave = registered.find((tool) => tool.name === "memory_save");
+  const privateExec = { agent: { session: { id: "private" } } };
+  const args = { type: "preference", title: "live gate", content: "check", importance: 4 };
+
+  await assert.rejects(retainedSave.execute(args, privateExec), /incognito session/);
+  const openGate = createSessionGate({ sessionGateEnabled: false });
+  createTools({ tools: registry }, service, {}, null, openGate);
+  assert.equal(registered.length, 11, "live reapply keeps the host's existing tool registrations");
+  assert.equal((await retainedSave.execute(args, privateExec)).action, "created", "off restores the original tool behavior");
+  const closedGate = createSessionGate({ sessionGateEnabled: true, sessionGateSessions: ["private"] });
+  createTools({ tools: registry }, service, {}, null, closedGate);
+  await assert.rejects(
+    retainedSave.execute({ ...args, content: "blocked" }, privateExec),
+    /incognito session/,
+    "a retained tool uses the gate from the latest live reapply"
+  );
+  assert.equal(store.count(), 1, "the re-applied gate still runs before any write");
+  store.close();
+});
+
+function summarySession(id, header = {}) {
+  return {
+    id,
+    header,
+    requestHeader: () => ({ config: { provider: "deepseek", model: "deepseek-chat" } }),
+    events: [
+      { type: "user/message", data: { source: { kind: "user" }, content: [{ type: "text", text: "选型" }] } },
+      { type: "turn/end", seq: 2 }
+    ]
+  };
+}
+
+test("distillation skips incognito sessions before model or storage work", async () => {
+  const store = createStore(":memory:");
+  const service = createService({ store, mirror: null, config: {} });
+  const listeners = [];
+  const calls = [];
+  const ctx = {
+    on(name, handler) { listeners.push({ name, handler }); return () => {}; },
+    llm: {
+      stream() {
+        calls.push(true);
+        const output = JSON.stringify([{ type: "decision", title: "选择", content: "落库", importance: 4 }]);
+        return (async function* () {
+          yield { type: "block-start", block: { type: "text" } };
+          yield { type: "text-delta", delta: output };
+          yield { type: "block-end", block: { type: "text" } };
+          yield { type: "finish", kind: "ok" };
+        })();
+      }
+    }
+  };
+  const gate = createSessionGate({ sessionGateEnabled: true, sessionGateSessions: ["private"] });
+  const summarizer = createSummarizer(ctx, service, { autoSummarize: true, distillRateLimitIntervalMs: 0 }, {}, gate);
+  const handler = listeners.find((item) => item.name === "session/event").handler;
+
+  await handler(summarySession("private"), { type: "turn/end", seq: 2 });
+  assert.equal(calls.length, 0);
+  assert.equal(store.count(), 0);
+  await handler(summarySession("captain", { origin: "main" }), { type: "turn/end", seq: 2 });
+  assert.equal(calls.length, 1);
+  assert.equal(store.count(), 1, "captain still distills normally");
+  summarizer.dispose();
+  store.close();
+});

package/test/settings.test.js

@@ -186,6 +186,8 @@ test("feature flags accept the new boolean, string, url and enum keys", () => {
     "distillRecords.retentionDays": 30,
     bm25SearchEnabled: false,
     conflictFreezeEnabled: true,
+    sessionGateEnabled: true,
+    sessionGateSubagents: false,
     trustEpistemicWeighting: true,
     reflectionFailureTracking: false,
     dreamProvider: "  siliconflow  ",
@@ -205,6 +207,8 @@ test("feature flags accept the new boolean, string, url and enum keys", () => {
   assert.equal(flags.conflictFreezeEnabled, true);
   assert.equal(flags.trustEpistemicWeighting, true);
   assert.equal(flags.reflectionFailureTracking, false);
+  assert.equal(flags.sessionGateEnabled, true);
+  assert.equal(flags.sessionGateSubagents, false);
   assert.equal(flags.dreamProvider, "siliconflow", "string values are trimmed");
   assert.equal(flags.dreamModel, "deepseek-chat");
   assert.equal(flags.ollamaBaseUrl, "http://127.0.0.1:11434/");