@shgroup/dsh-serenity-hooks 1.46.0 → 1.47.1

package/lib/index.js

@@ -2,13 +2,13 @@ import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.js";
 import { a as hostSettings, c as hostWebServer, i as hostSessions, n as hostInjected, o as hostSubagents, r as hostService, s as hostWeb, t as hostAgents } from "./access-fiehjxV6.js";
 import { a as findSerenityRoot, c as matchBlacklist, d as readCccName$1, f as readExclusiveTools, g as resolveInside, i as findGitRoot, l as pathInside, m as readTrajectorySkills, n as SAFE_MODE_MARKER, o as isSafeModeOn, p as readHandymanConfig, r as classifyPath, s as loadSerenityConfig, t as DEFAULT_SERENITY_CONFIG_PATHS, u as readBlacklist } from "./ccc-DG4Oc7I1.js";
 import { i as cccRootForExec, n as agentCwdFor, o as listCccs, r as cccRootForCwd, t as NO_CCC_FROM_AGENT_CWD } from "./ccc-roots-FxWXuZPw.js";
-import { C as useSession, S as summarize, T as localFileStamp, _ as resolveSessionByTitle, a as resolveSessionTrajectoryLabel, b as setActiveSessionInfo, c as TRAJECTORY_ACTIONS, d as extractSessionMdPathFromText, f as findSession, g as readActiveSessionMd, h as parseSessionContextFromEvents, i as readLastBound, l as clearActiveSessionInfo, m as listSessions, o as setBindingStore, p as getActiveSessionInfo, r as pruneMissingBindings, s as DEFAULT_SESSION_SCOPE, t as appendBound, u as createSession, v as sessionEvents$1, w as isoLocal, x as showSession, y as sessionsRoot } from "./trajectory-bound-BPWKkzJC.js";
+import { C as showSession, D as localFileStamp, E as isoLocal, S as setActiveSessionInfo, T as useSession, _ as parseSessionContextFromEvents, a as pruneMissingBindings, b as sessionEvents$1, c as setBindingStore, d as clearActiveSessionInfo, f as createSession, g as listSessions, h as getActiveSessionInfo, l as DEFAULT_SESSION_SCOPE, m as findSession, n as PLUGIN_SOURCE, o as readLastBound, p as extractSessionMdPathFromText, r as appendBound, s as resolveSessionTrajectoryLabel, t as ACC_MESSAGE_KIND, u as TRAJECTORY_ACTIONS, v as readActiveSessionMd, w as summarize, x as sessionsRoot, y as resolveSessionByTitle } from "./message-source-Boc-AbHs.js";
 import { a as readWeixinCredential, c as weixinInboundDir, d as LOCALSTORE_SCOPES, f as checkLocalstoreGitCompliance, g as runLocalStore, h as readStore, i as matchWeixinRoute, l as weixinSessionIdFor, m as readGitTrack, n as extractWeixinText, o as readWeixinSettings, p as localstorePath, r as hasVoiceItem, s as sanitizeFileName$1, t as extractWeixinMedia } from "./weixin-route-CWMRa36W.js";
 import { a as unregisterSkiffSession$1, i as skiffSessionSnapshot$1, n as skiffRoleFor$1, o as ACC_VERSION, r as skiffSessionInfo$1, t as registerSkiffSession$1 } from "./skiff-registry-BjIX_KD1.js";
 import { a as readSkiffRoles, c as roleMsmWhitelist, d as systemPromptSource, f as trajectorySubset, i as isSkiffSessionId, l as roleToolWhitelist, n as buildSkiffBasePrompt, o as resolveRoleSystemPrompt, r as createRolePromptReader, s as resolveSkiffKind } from "./skiff-role-KqQA6pkr.js";
-import { a as FACE_PORTS, c as MECHANISM_PORTS, i as ACP_HTTP_PORT, l as SKIFF_DEBUG_PORT, n as registerSettingsSection, o as GATEWAY_PORT, s as MAIN_WEB_PORT, t as readSimpleSettings, u as WEIXIN_SEND_PORT } from "./settings-section-CIuyoSOX.js";
+import { a as FACE_PORTS, c as MECHANISM_PORTS, i as ACP_HTTP_PORT, l as SKIFF_DEBUG_PORT, n as registerSettingsSection, o as GATEWAY_PORT, s as MAIN_WEB_PORT, t as readSimpleSettings, u as WEIXIN_SEND_PORT } from "./settings-section-DTJW4smh.js";
 import { r as sessionsRootDir, t as hasSessionLogById } from "./session-cleanup-BtkSmry8.js";
-import { a as registerDisposer, c as addWake, i as registerCroTurnTracking, l as listWakes, n as sendToTrajectory, o as buildCroSnapshot, r as wakeSchedulerState, s as WAKE_CATCH_UP_MS, t as registerWakeScheduler } from "./wake-scheduler-DF-YWcX5.js";
+import { a as registerDisposer, c as WAKE_CATCH_UP_MS, i as registerCroTurnTracking, l as addWake, n as sendToTrajectory, o as CRO_FILENAME, r as wakeSchedulerState, s as buildCroSnapshot, t as registerWakeScheduler, u as listWakes } from "./wake-scheduler-DdaRNofO.js";
 import { a as markdownToPlainText, c as sendTyping, i as getUpdates, l as sniffImageExt, n as downloadMedia, o as sendFileMessage, r as getConfig, s as sendTextMessage, t as TypingStatus } from "./weixin-api-CtFYm53S.js";
 import z from "@deepseek-ai/schemastery";
 import { defineTool } from "@deepseek-ai/dsh-tools";
@@ -3444,10 +3444,6 @@ function registerTrajectorySkillSection(agent, root) {
 }
 //#endregion
 //#region src/skiff-core.ts
-const PLUGIN_SOURCE$5 = {
-	kind: "plugin",
-	plugin: "dsh-serenity-hooks"
-};
 const skiffAgents = /* @__PURE__ */ new Map();
 /** 查 sessionId 的 Skiff 角色名（无 → null） */
 function skiffRoleFor(sessionId) {
@@ -3857,7 +3853,7 @@ async function askSkiff(ctx, agent, question, eventsStart, options) {
 			type: "text",
 			text: question
 		}],
-		source: PLUGIN_SOURCE$5
+		source: PLUGIN_SOURCE
 	}));
 	await waitAgentIdle(ctx, agent);
 	const answer = lastAssistantText$2(agent);
@@ -4368,10 +4364,7 @@ async function runHandymanJob(ctx, opts) {
 						type: "text",
 						text: prompt
 					}],
-					source: {
-						kind: "plugin",
-						plugin: "dsh-serenity-hooks"
-					}
+					source: PLUGIN_SOURCE
 				}));
 				await waitAgentIdle(ctx, workerAgent);
 				lastResponse = lastAssistantText$1(workerAgent);
@@ -5485,6 +5478,445 @@ function createContainerAdminTool(ctx) {
 	});
 }
 //#endregion
+//#region src/unattended-ops.ts
+/**
+* unattended-ops.ts — 无人值守代理回复（unattended proxy）机制层（S142 **D77**，owner 2026-09-23 提案）
+*
+* ## 这东西用来干什么（白话）
+*
+* 用户发个任务就走开。现在模型干完一段就停下来等回话，用户不在 ⇒ **会话挂在那儿不动**。
+* 本机制 = 用户走开后，系统**代替用户说一句"继续"**：让它自己跑完；干完了用一个**验证码**报告；
+* 卡住了先自己想办法；真不能定的**写下来等用户回来**。
+*
+* ## 归属（D23：ACC 管机制与数据，CCC 管措辞与纪律）
+*
+* | 面 | 归谁 | 内容 |
+* |---|---|---|
+* | **机制** | 🔴 **ACC（本模块）** | 触发判定 / 验证码 / 四选一结构 / 轮上限 / 流水 |
+* | **不可代批的*具体内容*** | **CCC 纪律** | ACC 只给**通用下限**（{@link UNATTENDED_BLOCKED_FLOOR}），CCC 可加严 |
+*
+* 🔵 下限之所以落在 ACC（而不是"完全交给 CCC"）：**没有这张清单，"自行解决"＝把所有把关点自动放行**。
+* 最终内容仍待 owner 一句（设计 §13-5）——本版先给**保守下限**，CCC 只能在其上加严、不得放宽。
+*
+* ## 🔴 核心原则：单一续驱者（single-driver）
+*
+* > **一个会话同一时刻只应有一个"续驱者"：用户 ／ CRO ／ 自排绳 ／ 无人值守代理。**
+*
+* 口径（owner 2026-09-23 19:1x 裁决）= **窄口径：只排除「有 CRO 程序的轨迹」**。
+* 原「宽口径」（任何自排唤醒都排除）**作废** —— 它会让本机制**永远够不着靠续接绳活着的会话**，
+* 等于**放弃"代替旧机制"**（绳因此退化为**长周期保险丝**：6–12h 一条）。
+*
+* ## 🔴 铁律（与 `cro.ts` / `cro-log.ts` 同族，勿破）
+*
+* **本模块的每个导出函数都不抛错**：写盘 / 解析 / 裁剪失败一律返回结构化失败。
+* ⇒ 代理机制的任何问题**不影响 turn 收尾**、不影响既有链路（唤醒投递 / 输出守卫 / rebuild）。
+*
+* ## 🔴 为什么不构成第二真相源（勿删此论证）
+*
+* | 载体 | 谁写 | 主语 | 回答 |
+* |---|---|---|---|
+* | `<轨迹目录>/unattended-log.json`（**本模块**） | **ACC** | ACC | 「**我注入了什么、判了什么、放过没有**」 |
+* | `<轨迹目录>/SESSION.md` | **LLM（CCC）** | CCC | 「**这轮发生了什么、为什么这么定**」 |
+*
+* **内容不重叠**：本模块只记**机械事实**（轮次 / 验证码 / 判定理由码 / 是否放过），**不写散文**；
+* LLM 侧的散文与理由归 SESSION.md。完整审计 = 两者合看（本模块 = 注入面｜SESSION.md = 判断面）。
+*
+* ## 🔴 验证码形态（禁用 4 位字母码）
+*
+* 注入文本**自带**"请回复 ABCD" ⇒ 模型**复述指令**即**假完成**（高概率，不是小概率）
+* ⇒ 用**每轮新生成**的 nonce ＋ **包装 ＋ 独占一行**（`[[UNATTENDED-DONE:<hex>]]`），
+* 明写「**旧码作废**」，校验**只认当前轮**（防上下文里的旧码复活）。
+* 先例 = `handyman` background 的 `SERENITY_HANDYMAN_DONE_<16hex>`（同族实现）。
+*/
+/** 完成码包装前缀（**独占一行**才有意义；见文件头"禁用 4 位字母码"） */
+const UNATTENDED_DONE_PREFIX = "[[UNATTENDED-DONE:";
+/** 注入消息的**首行标记**（幂等可辨：模型与事后审计都能一眼看出这是代理消息，不是用户消息） */
+const UNATTENDED_PROXY_MARK = "[[UNATTENDED-PROXY v1]]";
+/** 🔴 合成消息**固定身份句**（owner 已裁：「形如用户消息，但首句自报身份与权限边界」） */
+const UNATTENDED_IDENTITY_LINE = "无人值守代理 · 非本人";
+/** 生成一枚新 nonce（**每轮一枚**；旧码作废由调用方在文本里声明） */
+function newNonce() {
+	return randomBytes(8).toString("hex");
+}
+/** 完成码全文（注入文本展示用；校验走 {@link hasDoneToken}） */
+function doneToken(nonce) {
+	return `${UNATTENDED_DONE_PREFIX}${nonce}]]`;
+}
+/**
+* 出现过的完成码 nonce 列表（按出现顺序、去重；**小写归一**）。
+* 容忍 8–64 位 hex（模型可能手抄多/少几个字符 ⇒ 那就不匹配，属预期：只认本轮那枚）。
+*/
+function parseDoneNonces(text) {
+	if (typeof text !== "string" || text === "") return [];
+	const re = /\[\[UNATTENDED-DONE:([0-9a-fA-F]{8,64})\]\]/g;
+	const out = [];
+	let m;
+	while ((m = re.exec(text)) !== null) {
+		const n = (m[1] ?? "").toLowerCase();
+		if (n !== "" && !out.includes(n)) out.push(n);
+	}
+	return out;
+}
+/** 触及即停（写待办/交接，**不循环**）——**CCC 的纪律更严则从严** */
+const UNATTENDED_BLOCKED_FLOOR = [
+	"发布 / 发版",
+	"对外发送（邮件 / 微信 / 对外面输出）",
+	"删除与不可逆操作（rm / 归档 / force push）",
+	"凭据与权限变更",
+	"花钱（外部 API 大额调用 / GPU 长任务）",
+	"代用户拍板（替人做决定）"
+];
+/** 四选一正文（{@link buildProxyMessage} 与 {@link buildFalseNotifyRebuke} 共用，避免两份措辞漂移） */
+function proxyBody(input) {
+	return [
+		`A) 已完成、且用户回来会满意 ⇒ 交码 ＋ 附完成凭据（做了什么 / 怎么验的 / 产物路径）`,
+		`B) 已成功向用户发出通知、要停下等他主动回来 ⇒ 交码 ＋ 写明走了哪个通道（**必须真有发送记录**）`,
+		`C) 需要确认但可自决 ⇒ 按「**最保守且可逆**」的选项继续做完（⚠️ **不要交码**，直接做）`,
+		`D) 触及不可代批边界 ⇒ **立即停**，把问题写进待办 / 交接，然后交码`,
+		``,
+		`不可代批的**通用下限**（你所在 CCC 的纪律更严则从严）：${(input.blocked ?? UNATTENDED_BLOCKED_FLOOR).join(" / ")}`,
+		``,
+		`交码 = **独占一行、逐字复制下面这一行**（旧码一律作废，只认本轮这个）：`,
+		``,
+		`    ${doneToken(input.nonce)}`,
+		``,
+		`禁止：把本条当真实用户的授权；禁止把本指令文本复述成回答；禁止什么都没做只回一个码；`,
+		`禁止借机发起**新的长任务**（代理只推进"已在办"的事）。`
+	].join("\n");
+}
+/** 组装一次代理注入消息（**形如用户消息，但首句自报身份与权限边界**） */
+function buildProxyMessage(input) {
+	return [
+		`${UNATTENDED_PROXY_MARK} round=${input.round}/${input.maxRounds} nonce=${input.nonce}`,
+		`${UNATTENDED_IDENTITY_LINE} —— 这条消息是**系统代用户发的**，不是用户本人；我没有任何权限替你拍板。`,
+		``,
+		`用户不在场。你只能以下列**四条之一**收束本轮：`,
+		``,
+		proxyBody(input)
+	].join("\n");
+}
+/**
+* 组装一次**假完成打回**消息（设计 §7 的机械核验分支：声称已通知用户，但本轮无发送记录）。
+*
+* ⚠️ 同样带**新 nonce**：它是一次"再来一轮"，不是"放过"。
+*/
+function buildFalseNotifyRebuke(input) {
+	return [
+		`${UNATTENDED_PROXY_MARK} round=${input.round}/${input.maxRounds} nonce=${input.nonce}`,
+		`${UNATTENDED_IDENTITY_LINE} —— 这条消息是**系统代用户发的**，不是用户本人。`,
+		``,
+		`🔴 你交的码是对的，但**你声称已通知用户，而我这边查不到任何发送记录** ⇒ **不算合法收束**。`,
+		`要么**真的发**（走可用通道；发成之后再交码），要么改走 A / C / D。其余口径同下。`,
+		``,
+		proxyBody(input)
+	].join("\n");
+}
+/**
+* 「收尾文本**声称**已联系用户」的**启发式**判据（设计 §7 的触发器，**不是**判据本身）。
+*
+* 🔴 机械判据 = **ACC 侧的发送记录**（{@link hasOutboundSendSince}）；本函数只回答"**要不要去查记录**"。
+* 误判方向（明标）：**误报**（模型换了个说法没被匹配到）⇒ 退回"只认码"，不产生假放过；
+* **误报**（正常措辞被当成声称）⇒ 多打回一轮（有轮上限兜底）。⇒ 偏严，符合设计 §11
+* 把"谎称已发消息"列为失败模式的取向。
+*/
+const NOTIFY_CLAIM_PATTERNS = [
+	/已(经)?(成功)?(向|给|和)?\s*(用户|您|你|他|她|本人|主人)?[^\n。]{0,16}(发送|发出|告知|通知|联系|留言|汇报)/,
+	/\b(?:notified|informed|messaged|contacted)\s+(?:the\s+)?user\b/i,
+	/\b(?:sent|sending)\s+(?:a\s+)?(?:message|notification|notice)\s+to\s+(?:the\s+)?user\b/i,
+	/\bI\s+(?:have\s+)?(?:notified|informed|messaged|contacted)\b/i
+];
+/** 收尾文本是否**声称**已联系用户（见 {@link NOTIFY_CLAIM_PATTERNS} 的误判方向说明） */
+function claimsUserNotification(text) {
+	if (typeof text !== "string" || text === "") return false;
+	return NOTIFY_CLAIM_PATTERNS.some((re) => re.test(text));
+}
+/**
+* **不许开**的会话（设计 §3 的"建议写死"，本版**确实写死**）：
+* `skiff-`（F4 问答 / **微信桥会话也是这个前缀** —— 桥那侧的"用户"是**家人**，
+* 代理替家人说话 = **冒充**）｜ `acp-`（对外程序化面）｜ `handyman-`（自主 worker，已有自己的完成码循环）。
+*
+* ⚠️ **`rebuild-` 不在排除面**（与 `output-guard-seam.ts` 的取向**刻意不同**）：重建会话是
+* **同一轨迹的载体**（内部维护面），不是对外面；把它排除会让"重建后就没人推了"。
+*/
+function isProxyExcludedSessionId(sessionId) {
+	if (typeof sessionId !== "string" || sessionId === "") return true;
+	return isSkiffSessionId(sessionId) || sessionId.startsWith("acp-") || sessionId.startsWith("handyman-");
+}
+/**
+* 一次判定的**唯一入口**（纯函数）。
+*
+* 顺序即语义（R↓，勿随意调换）：
+*  1. **闸/空间/会话资格**（关着、不在 CCC、非主会话、排除面）⇒ skip；
+*  2. **单一续驱者**：用户刚发起 ⇒ skip（人就在场）；该轨迹有 CRO ⇒ skip（程序在驱动）；
+*  3. **合法收束优先于轮上限** —— 最后一轮交的码必须算数（否则等于永远收不了尾）；
+*  4. 交码 ＋ 声称已通知 ＋ **无发送记录** ⇒ 假完成，走下一轮（reason=`false-notify`）；
+*  5. 墙钟 / 轮上限 ⇒ cap（**停下不动**，退回改造前的行为，不产生新风险）；
+*  6. 其余 ⇒ inject 下一轮。
+*/
+function decideUnattendedAction(f) {
+	if (!f.enabled) return {
+		action: "skip",
+		reason: "mode-off",
+		round: 0
+	};
+	if (!f.root) return {
+		action: "skip",
+		reason: "not-in-ccc",
+		round: 0
+	};
+	if (!f.isMainSession) return {
+		action: "skip",
+		reason: "not-main-session",
+		round: 0
+	};
+	if (f.sessionIdExcluded) return {
+		action: "skip",
+		reason: "excluded-session",
+		round: 0
+	};
+	if (f.userInitiated) return {
+		action: "skip",
+		reason: "user-initiated",
+		round: 0
+	};
+	if (f.hasCroProgram) return {
+		action: "skip",
+		reason: "cro-programmed",
+		round: 0
+	};
+	const run = f.run;
+	if (run !== null && f.doneNonce !== null && f.doneNonce.toLowerCase() === run.nonce.toLowerCase() && run) {
+		if (f.claimsNotify && !f.outboundSeen) {
+			if (run.round >= 15) return {
+				action: "cap",
+				reason: "round-cap",
+				round: run.round
+			};
+			return {
+				action: "inject",
+				reason: "false-notify",
+				round: run.round + 1
+			};
+		}
+		return {
+			action: "accept",
+			reason: "done-code",
+			round: run.round
+		};
+	}
+	if (run && f.nowMs - run.startedAt > 72e5) return {
+		action: "cap",
+		reason: "wall-clock",
+		round: run.round
+	};
+	if (run && run.round >= 15) return {
+		action: "cap",
+		reason: "round-cap",
+		round: run.round
+	};
+	const round = (run?.round ?? 0) + 1;
+	return {
+		action: "inject",
+		reason: run === null ? "first-stop" : f.doneNonce !== null ? "stale-code" : "no-legal-closure",
+		round
+	};
+}
+/** 键 = 载体（dsh 会话 id）——与 `cro-turns.ts` 同款选择（事件本身就以 agent/session 为主语） */
+const runs = /* @__PURE__ */ new Map();
+/** 取该会话的代理段（无 ⇒ null） */
+function getProxyRun(sessionId) {
+	return runs.get(sessionId) ?? null;
+}
+/** 开始 / 推进一段代理（`startedAt` 由调用方给出 ⇒ 跨轮保留首次值） */
+function setProxyRun(sessionId, run) {
+	if (!sessionId) return;
+	runs.set(sessionId, run);
+}
+/** 结束该会话的代理段（放过 / 上限 / 用户回来 / 载体销毁） */
+function clearProxyRun(sessionId) {
+	if (!sessionId) return;
+	runs.delete(sessionId);
+}
+/**
+* 「该载体最近一次由**真实用户**发起的轮次号」（会话 id → turn）。
+*
+* ⚠️ 只留**一条**（不是集合）：`claimed` 的 `turn` 单调递增，留最新一条即可回答
+* "本轮是不是用户发起的"，且**表的大小 = 会话数**（本容器栽过 5 次"只增不清"，此处结构性避免）。
+*/
+const userTurns = /* @__PURE__ */ new Map();
+/** 记下"这个载体的这一轮是真实用户发起的" */
+function noteUserTurn(sessionId, turn) {
+	if (!sessionId || typeof turn !== "number") return;
+	userTurns.set(sessionId, turn);
+}
+/** 该载体的这一轮是否由真实用户发起（判据 = `noteUserTurn` 写入的最新一条） */
+function isUserTurn(sessionId, turn) {
+	if (!sessionId || typeof turn !== "number") return false;
+	return userTurns.get(sessionId) === turn;
+}
+/** 清掉该载体的用户轮次记录（载体销毁时） */
+function clearUserTurn(sessionId) {
+	if (!sessionId) return;
+	userTurns.delete(sessionId);
+}
+/** 清空全部进程内运行态（disposer；**不碰磁盘**） */
+function clearUnattendedState() {
+	runs.clear();
+	userTurns.clear();
+	outboundSends.clear();
+}
+/** 发送记录保留窗（超出即丢：它只服务"这一轮到底发没发"这个瞬时问题） */
+const UNATTENDED_OUTBOUND_TTL_MS = 216e5;
+const outboundSends = /* @__PURE__ */ new Map();
+/**
+* 记一次**成功的**出站发送（`im-bridge` 工具面在通道返回成功后调用）。
+*
+* ⚠️ **覆盖边界（诚实标注）**：只覆盖 **ACC 自己这条通道**（`im-bridge` 的 send / send-file）。
+* CCC 自有的发送通道（如 `mail-tool` MSM）**ACC 看不见** ⇒ 那类"已通知"落到
+* {@link hasOutboundSendSince} = false ⇒ 会被判成假完成。⇒ 本版口径：**代理模式下"联系用户"
+* 只认 ACC 通道**；这与设计 §7 的原话（im-bridge 记日志）一致，边界写在此处以免误读。
+*/
+function noteOutboundSend(root, atMs = Date.now()) {
+	if (!root) return;
+	const list = outboundSends.get(root) ?? [];
+	list.push(atMs);
+	const cutoff = atMs - UNATTENDED_OUTBOUND_TTL_MS;
+	const kept = list.filter((t) => t >= cutoff).slice(-20);
+	outboundSends.set(root, kept);
+}
+/** 自 `sinceMs` 起该 CCC 是否有过成功出站发送（**只读，不清表**——清理归写入侧的裁剪） */
+function hasOutboundSendSince(root, sinceMs, nowMs = Date.now()) {
+	if (!root) return false;
+	const list = outboundSends.get(root);
+	if (!list || list.length === 0) return false;
+	const floor = Math.max(sinceMs, nowMs - UNATTENDED_OUTBOUND_TTL_MS);
+	return list.some((t) => t >= floor && t <= nowMs);
+}
+/** 固定文件名（与 `cro-wake-log.json` 并排、主语分明：那份记"我叫了什么"，这份记"我代说了什么"） */
+const UNATTENDED_LOG_FILENAME = "unattended-log.json";
+/** 保留窗 = 2 日（与 CRO 流水同值；**常量** ⇒ 无需人工清理动作） */
+const UNATTENDED_LOG_RETENTION_MS = 1728e5;
+const UNATTENDED_LOG_VERSION = 1;
+/** 日志绝对路径 */
+function unattendedLogPath(root, dirName) {
+	return join(sessionsRoot(root), dirName, UNATTENDED_LOG_FILENAME);
+}
+function emptyLog() {
+	return {
+		version: UNATTENDED_LOG_VERSION,
+		entries: []
+	};
+}
+/** 条目形状校验（容忍手改：字段缺失/类型不符 ⇒ 丢弃该条，不阻断整档） */
+function asEntry(value) {
+	const e = value;
+	if (!e || typeof e !== "object") return null;
+	if (typeof e.at !== "string" || e.at === "") return null;
+	if (e.event !== "inject" && e.event !== "accept" && e.event !== "cap" && e.event !== "yield") return null;
+	if (typeof e.reason !== "string") return null;
+	return {
+		at: e.at,
+		event: e.event,
+		round: typeof e.round === "number" ? e.round : 0,
+		nonce: typeof e.nonce === "string" ? e.nonce : null,
+		reason: e.reason,
+		sessionId: typeof e.sessionId === "string" ? e.sessionId : ""
+	};
+}
+/** 读取流水（**永不抛**；读坏 ⇒ 当作空档 + 返回 error 文本） */
+function loadUnattendedLog(root, dirName) {
+	const path = unattendedLogPath(root, dirName);
+	if (!existsSync(path)) return {
+		log: emptyLog(),
+		error: null
+	};
+	try {
+		const parsed = JSON.parse(readFileSync(path, "utf-8"));
+		const raw = Array.isArray(parsed.entries) ? parsed.entries : [];
+		const entries = [];
+		for (const item of raw) {
+			const e = asEntry(item);
+			if (e) entries.push(e);
+		}
+		return {
+			log: {
+				version: UNATTENDED_LOG_VERSION,
+				entries
+			},
+			error: null
+		};
+	} catch (err) {
+		return {
+			log: emptyLog(),
+			error: `无人值守流水解析失败（${String(err?.message ?? err)}）`
+		};
+	}
+}
+/**
+* 按窗裁剪（**纯函数** ⇒ 可穷举测试）。
+* 🔴 `at` 不可解析者**一律丢弃**并在返回值里报数（`dropped`）——**不静默吞掉**（同 `cro-log.ts` 纪律）。
+*/
+function pruneUnattendedLogEntries(entries, nowMs, windowMs = UNATTENDED_LOG_RETENTION_MS) {
+	const floor = nowMs - windowMs;
+	const kept = [];
+	let pruned = 0;
+	let dropped = 0;
+	for (const e of entries) {
+		const t = Date.parse(e.at);
+		if (Number.isNaN(t)) {
+			dropped += 1;
+			continue;
+		}
+		if (t >= floor) kept.push(e);
+		else pruned += 1;
+	}
+	return {
+		kept,
+		pruned,
+		dropped
+	};
+}
+/**
+* 追加一条流水并按窗裁剪（**本模块的落盘入口；永不抛**）。
+*
+* 顺序 = 读 → 追加 → 裁剪 → **原子写**（tmp + rename）。任一步失败 ⇒ `{ok:false, error}`，**不抛**
+* ——调用方只记一行 console 日志 ⇒ **代理机制的问题绝不影响 turn 收尾**。
+*/
+function appendUnattendedLog(root, dirName, entry, nowMs = Date.now()) {
+	if (!root || !dirName) return {
+		ok: false,
+		error: "缺少 CCC 根或轨迹目录名",
+		kept: 0
+	};
+	const path = unattendedLogPath(root, dirName);
+	try {
+		const loaded = loadUnattendedLog(root, dirName);
+		const full = {
+			at: isoLocal(nowMs),
+			...entry
+		};
+		const { kept } = pruneUnattendedLogEntries([...loaded.log.entries, full], nowMs);
+		mkdirSync(dirname(path), { recursive: true });
+		const tmp = `${path}.tmp`;
+		writeFileSync(tmp, `${JSON.stringify({
+			version: UNATTENDED_LOG_VERSION,
+			entries: kept
+		}, null, 2)}\n`, "utf-8");
+		renameSync(tmp, path);
+		return {
+			ok: true,
+			error: null,
+			kept: kept.length
+		};
+	} catch (err) {
+		return {
+			ok: false,
+			error: `无人值守流水写入失败（${String(err?.message ?? err)}）`,
+			kept: 0
+		};
+	}
+}
+//#endregion
 //#region src/im-bridge.ts
 /**
 * im-bridge.ts — IM 发送能力层（v1.31.0，S142 用户洞察）
@@ -5635,17 +6067,19 @@ async function runImBridge(root, req) {
 		const resolved = channel.resolveUser(root, rawUser);
 		if (!resolved) return fail("ALIAS_UNKNOWN", `unknown user "${rawUser}"`);
 		try {
+			const sent = await channel.send({
+				root,
+				userId: resolved.id,
+				text,
+				accountId: req.account
+			});
+			noteOutboundSend(root);
 			return {
 				ok: true,
 				channel: channelId,
 				action,
 				detail: {
-					...await channel.send({
-						root,
-						userId: resolved.id,
-						text,
-						accountId: req.account
-					}),
+					...sent,
 					user: resolved.alias ?? resolved.id
 				}
 			};
@@ -5664,19 +6098,21 @@ async function runImBridge(root, req) {
 		const file = readCccFile(root, fileArg);
 		if (!file.ok) return fail(file.code, file.error);
 		try {
+			const sent = await channel.sendFile({
+				root,
+				userId: resolved.id,
+				data: file.data,
+				fileName: file.fileName,
+				caption: req.caption,
+				accountId: req.account
+			});
+			noteOutboundSend(root);
 			return {
 				ok: true,
 				channel: channelId,
 				action,
 				detail: {
-					...await channel.sendFile({
-						root,
-						userId: resolved.id,
-						data: file.data,
-						fileName: file.fileName,
-						caption: req.caption,
-						accountId: req.account
-					}),
+					...sent,
 					user: resolved.alias ?? resolved.id
 				}
 			};
@@ -6268,7 +6704,7 @@ function registerBootstrap(ctx) {
 			if (depth === 0) {
 				if (hasUserMessageHistory(session)) return;
 			} else if (sid !== void 0 && anchoredSessions.has(sid)) return;
-			if (message?.source?.kind === "plugin") return;
+			if (message?.source?.kind === "plugin:dsh-serenity-hooks") return;
 			const inbox = agent.inbox;
 			if (!inbox?.prepend) return;
 			for (let i = SETTINGS.anchorMessages.length - 1; i >= 0; i--) inbox.prepend("next-turn", {
@@ -6279,8 +6715,7 @@ function registerBootstrap(ctx) {
 					text: SETTINGS.anchorMessages[i]
 				}],
 				source: {
-					kind: "plugin",
-					plugin: "dsh-serenity-hooks",
+					kind: ACC_MESSAGE_KIND,
 					form: "notice",
 					summary: "bootstrap anchor turn"
 				}
@@ -6606,10 +7041,6 @@ function trajectoryCompactionReminderText(input) {
 	if (escalated) return `${eventToken("compaction")} ${facts} — you have been reminded repeatedly and have NOT compacted SESSION.md. This is now mandatory: STOP the current task step, load eap (praxis eap), rewrite SESSION.md, then resume. ${principles} ${frontmatterGuard} This reminder persists until the file is under the limit.`;
 	return `${eventToken("compaction")} ${facts}. Pause the current work and compact this trajectory's log (SESSION.md) before continuing — that log is the persistent body of this trajectory, and its size is operational entropy (H_op) the container pays on every read. ${principles} ${frontmatterGuard} After rewriting, resume the paused work; this reminder stops once the file is under the limit.`;
 }
-const PLUGIN_SOURCE$4 = {
-	kind: "plugin",
-	plugin: "dsh-serenity-hooks"
-};
 /** 每 agent 一个跟踪器（进程内存态，agent token 维度） */
 const trackers = /* @__PURE__ */ new Map();
 /** 连续超阈值轮数达此值 → 升级为 [TRAJECTORY-ESCALATED] 强制语气（此后持续升级催，直到 rebuild） */
@@ -6695,7 +7126,7 @@ function registerKeeper(ctx, opts = {}) {
 		if (blocks.length === 0) return downstream;
 		const reminderAll = createUserMessage({
 			content: blocks,
-			source: PLUGIN_SOURCE$4
+			source: PLUGIN_SOURCE
 		});
 		if (downstream.kind === "block") return {
 			kind: "block",
@@ -6739,10 +7170,6 @@ function accIdentityText(root, configPaths = DEFAULT_SERENITY_CONFIG_PATHS, entr
 	}
 	return lines.join("\n");
 }
-const PLUGIN_SOURCE$3 = {
-	kind: "plugin",
-	plugin: "dsh-serenity-hooks"
-};
 /**
 * ACC 注入消息（S134 去重）：**只含简短身份锚点**（[ACC] 已激活 + CCC 根 + 约束 + Phase 2）。
 * ⚠️ 原文案含「+ handyman 模型」，该注入已于 2026-09-16 删除（§0e-G）⇒ 此处同步订正（散文级残留）。
@@ -6757,7 +7184,7 @@ function accMessage(root, configPaths, entrySkillMaxChars) {
 	}];
 	return createUserMessage({
 		content,
-		source: PLUGIN_SOURCE$3
+		source: PLUGIN_SOURCE
 	});
 }
 /** 每 agent 是否已注入过（进程内存态） */
@@ -6871,7 +7298,7 @@ function registerContext(ctx, opts = {}) {
 			syncExclusiveToolsVisibility(agent, root);
 		} catch {}
 	};
-	if (opts.seedOnStart ?? true) ctx.on("agent/session-start", (payload) => {
+	if (opts.seedOnStart ?? true) ctx.on("agent/created", async (payload) => {
 		try {
 			seed(payload.agent);
 		} catch {}
@@ -7352,7 +7779,7 @@ function registerStatusApi(ctx, opts = {}) {
 					return;
 				}
 				const settings = readAdvancedSettings();
-				const { readSimpleSettings } = await import("./settings-section-CIuyoSOX.js").then((n) => n.r);
+				const { readSimpleSettings } = await import("./settings-section-DTJW4smh.js").then((n) => n.r);
 				const simple = readSimpleSettings();
 				const allowed = settings.publicAsk.allowed;
 				const port = simple.acpHttpPort ?? ACP_HTTP_PORT;
@@ -7911,21 +8338,14 @@ const HOST_SERVICES = [
 		id: "settings",
 		name: "settings",
 		access: "injected",
-		members: [
-			{
-				name: "installSection",
-				kind: "function"
-			},
-			{
-				name: "get",
-				kind: "function"
-			},
-			{
-				name: "update",
-				kind: "function"
-			}
-		],
-		impact: "设置面板不安装 → 所有开关静默 no-op；opencode 路由自动配置失效",
+		members: [{
+			name: "describe",
+			kind: "function"
+		}, {
+			name: "update",
+			kind: "function"
+		}],
+		impact: "设置面板不装配 → 所有开关静默 no-op；opencode 路由自动配置与多模态补丁失效",
 		required: true
 	},
 	{
@@ -8075,8 +8495,8 @@ const HOST_SERVICES = [
 	}
 ];
 /** dsp 被验证过的宿主版本范围（与 package.json peerDependencies 同源，单一真相源） */
-const REQUIRED_HOST_RANGE = "^0.1.5-rc.2";
-/** 范围 floor：剥掉 caret/比较前缀（`^0.1.5-rc.2` → `0.1.5-rc.2`），供 {@link checkHostVersion} 使用 */
+const REQUIRED_HOST_RANGE = "^0.1.7-rc.1";
+/** 范围 floor：剥掉 caret/比较前缀（`^0.1.7-rc.1` → `0.1.7-rc.1`），供 {@link checkHostVersion} 使用 */
 const REQUIRED_HOST_FLOOR = REQUIRED_HOST_RANGE.replace(/^[\^~>=<\s]+/, "");
 /** 范围 ceiling：`^0.1.x` 的上界 = `<0.2.0`（显式常量，见 {@link checkHostVersion} 注释） */
 const REQUIRED_HOST_CEILING = "0.2.0";
@@ -9300,7 +9720,7 @@ function registerGateway(ctx) {
 		});
 	};
 	sync();
-	ctx.on("agent/session-start", (payload) => {
+	ctx.on("agent/created", async (payload) => {
 		try {
 			const cwd = payload.agent?.session?.header?.cwd;
 			if (cwd) {
@@ -9329,10 +9749,6 @@ var rebuild_exports = /* @__PURE__ */ __exportAll({
 	sanitizeFocusLine: () => sanitizeFocusLine,
 	stripAckSuffix: () => stripAckSuffix
 });
-const PLUGIN_SOURCE$2 = {
-	kind: "plugin",
-	plugin: "dsh-serenity-hooks"
-};
 /** acknowledge 尾句（first-anchor 的确认要求——rebuild 重建后不重走确认轮，直接继续） */
 const ACK_SUFFIX_RE = /Please simply reply "acknowledge" — no action needed\.\s*$/;
 /**
@@ -9648,7 +10064,7 @@ function registerRebuildTurnHook(ctx) {
 						type: "text",
 						text: `${eventToken("rebuild")} The conversation has been cleared and rebuilt. Follow the anchor instructions above now: read the persistent trajectory (SESSION.md) and continue the work automatically from the last checkpoint.`
 					}],
-					source: PLUGIN_SOURCE$2
+					source: PLUGIN_SOURCE
 				}));
 				writeRebuildDiag(resolveSerenityRootFor(agent), {
 					sessionId: id,
@@ -11801,7 +12217,7 @@ const MECHANISM_WORDS = [
 	"localstore.json",
 	".opencode/serenity.json",
 	"AGENT_SESSIONS",
-	"agent/session-start",
+	"agent/created",
 	"agent/turn-stopping",
 	"tools/pre-execute",
 	"tools/post-execute",
@@ -11911,17 +12327,15 @@ function buildRebuke(hits) {
 const rebukeStates = /* @__PURE__ */ new Map();
 //#endregion
 //#region src/output-guard-seam.ts
-const PLUGIN_SOURCE$1 = {
-	kind: "plugin",
-	plugin: "dsh-serenity-hooks"
-};
 /** 外部面会话判定（v1.26.3 用户拍板：仅外部面检测，本地维护会话豁免）：
 *  skiff-（F4 问答）/ acp-（F4c 程序化）/ rebuild-（v1.22.4 重建会话）前缀 */
 function isExternalFaceSession(sessionId) {
 	if (!sessionId) return false;
 	return isSkiffSessionId(sessionId) || sessionId.startsWith("acp-") || sessionId.startsWith("rebuild-");
 }
-/** 读会话最后一个 assistant/message 文本（skiff-core 同款；仅用于守卫检测，不导出）
+/** 读会话最后一个 assistant/message 文本（skiff-core 同款）
+*  **2026-09-23（S142 D77）起导出**：`unattended-seam.ts` 复用同一读法（本容器纪律：
+*  「同一读法只留一份」——两份 `lastAssistantText` 会在宿主改事件形状时**只修一处**）。
 *  **v1.27.7：剥离 think 块再检测**（用户："不检查think内容（因为不输出）"）——
 *  ` think…` 是模型思考过程，不进入用户可见输出；敏感词检测只针对**最终呈现文本**，
 *  否则 think 内提及内部机制词（思考过程必然推演机制）会误打回。复用 stripThink
@@ -11972,7 +12386,7 @@ function registerOutputGuardHook(ctx) {
 					type: "text",
 					text: buildRebuke(hits)
 				}],
-				source: PLUGIN_SOURCE$1
+				source: PLUGIN_SOURCE
 			}));
 		} catch (error) {
 			console.warn(`[serenity-hooks] output-guard steer failed: ${String(error?.message ?? error)}`);
@@ -11980,6 +12394,235 @@ function registerOutputGuardHook(ctx) {
 	});
 }
 //#endregion
+//#region src/unattended-seam.ts
+/**
+* unattended-seam.ts — 无人值守代理回复的**拦截缝**（S142 **D77**，owner 2026-09-23 令「我需要的是一个机制」）
+*
+* ## 停在哪、怎么接（设计 §4 的裁决：**A 的通道 ＋ B 的措辞**）
+*
+* 复用的是**已验证过的**通道——`agent/turn-stopping`（serial）里 `agent.steer()`：
+* 宿主语义 = "**listener 反对就打回**，机器重读 inbox：有新 steer ⇒ 再跑一步，没有 ⇒ 关轮"
+* （`host/contract.ts` 的 `HOST_EVENTS` 原文）。因此：
+* · **轮不结束**（语义正是"有人打回"）⇒ **零新机械**；
+* · 文本**写成代理用户的话**（B 的措辞）+ **首句自报身份**（owner 已裁）。
+*
+* 模板 = `output-guard-seam.ts`（同一缝位、同一 `createUserMessage + PLUGIN_SOURCE` 形态）。
+*
+* ## 🔴「这轮是不是真实用户发起的」怎么判（本机制**唯一**的新机械；2026-09-23 取证）
+*
+* 交接块把它列为"动手前必须先查清的一件事"，取证结论（读宿主类型面，非猜测）：
+*
+* | 事实 | 出处 |
+* |---|---|
+* | 每条进入 inbox 的消息都发 `agent/inbox/inserted { agent, message }`；**在轮内离开 inbox 时**发 `agent/inbox/claimed { agent, message, turn }` | `@deepseek-ai/dsh-agent` README（Inbox 段）＋ `runtime-types.d.ts` |
+* | `claimed.turn` = **拥有该消息的那一轮**；`turn-stopping.turn` = **即将关闭的那一轮** ⇒ 两者同编号可直接比对 | `runtime-types.d.ts` 同一文件两处 `turn` 声明 |
+* | 消息来源可辨：`MessageSourceMap` 里**真实用户** = `kind: 'user'`（`user` ／ `user-rpc` 两种形态**同 kind**）；**ACC 自己注入**的一律 `kind: 'plugin:dsh-serenity-hooks'`（v1.47.0 改；旧值 = `'plugin'`） | `@deepseek-ai/dsh-llm` `src/message.ts` 的 `MessageSourceMap`（合并和类型）＋ 本仓 `message-source.ts`（**唯一**声明处与常量处） |
+*
+* ⇒ **判据 = 「这一轮 claim 到的消息里，有没有 `source.kind === 'user'`」**。
+* 没有现成信号时本可退化为"记账法"（我们知道自己投过什么），**但不必**：宿主已给出一手信号。
+*
+* ## 🔴 为什么"用户发起的轮"要跳过（这是设计 §3-③ 的本意，别当成漏洞）
+*
+* 用户**刚说完话**⇒ 人就在跟前，代理插话既是冒充也是浪费。**"用户说完走开"那种情形**
+* 由**绳（长周期保险丝）／其它非用户发起的唤醒**覆盖：那条轮**不是**用户发起的 ⇒ 代理接手，
+* 一路推进到**合法收束**。⇒ 两个机制合起来才等于"用户走开后会话还能自己跑完"。
+*
+* ## 🔴 铁律（与 `unattended-ops.ts` 同族）
+*
+* **本模块的任何失败都不得影响 turn 收尾**：所有 handler 包 try/catch，异常只记一行 console。
+*/
+/** 取载体 id（payload 的 `agent` 面；取不到 ⇒ 空串） */
+function sessionIdOf$2(agent) {
+	const id = agent?.session?.id;
+	return typeof id === "string" ? id : "";
+}
+/** 取会话对象（payload 的 `agent.session`） */
+function sessionOf(agent) {
+	return agent?.session;
+}
+/** 取会话 cwd（`header.cwd`；取不到回落进程 cwd——与 `output-guard-seam.ts` 同款读法） */
+function cwdOf(agent) {
+	return sessionOf(agent)?.header?.cwd ?? process.cwd();
+}
+/** 是否 **CCC 内主会话**（`delegationDepth` 缺省 0；子代理 / 无头运行不算） */
+function isMainSession(agent) {
+	return (sessionOf(agent)?.header?.delegationDepth ?? 0) === 0;
+}
+/**
+* 该会话所属轨迹**是否带 CRO 程序**（窄口径的唯一排除项）。
+* 判据 = 轨迹目录下存在 `continuous-re-occurrence.ts`（与 `cro.ts` 同源：**文件在 = 启用**）。
+* 无绑定（未挂在任何轨迹上）⇒ false（没有程序在驱动它）。
+*/
+function hasCroProgram(session, root) {
+	const dirName = readLastBound(session)?.dirName;
+	if (!dirName) return false;
+	return existsSync(join(sessionsRoot(root), dirName, CRO_FILENAME));
+}
+/** 落一条流水（**永不抛**；无绑定 ⇒ 无落点，只回 false 由调用方记 console） */
+function logEvent(session, root, entry, nowMs) {
+	const dirName = readLastBound(session)?.dirName;
+	if (!dirName) return false;
+	const res = appendUnattendedLog(root, dirName, entry, nowMs);
+	if (!res.ok) console.log(`[serenity-hooks] unattended: 流水未落盘 — ${res.error ?? "未知原因"}`);
+	return res.ok;
+}
+/**
+* 一轮收尾（`agent/turn-stopping`）的完整处置。
+*
+* 顺序：**取事实 → 纯函数判定 → 执行**（判定全在 `unattended-ops.ts`，本函数只做 I/O 与 steer）。
+* @returns 便于用例观察的判定结果文本（生产不使用返回值）
+*/
+function handleTurnStopping(agent, turn) {
+	if (readSimpleSettings().unattendedEnabled !== true) return "skip:mode-off";
+	const sessionId = sessionIdOf$2(agent);
+	if (sessionId === "") return "skip:no-session-id";
+	const root = cccRootForCwd(cwdOf(agent));
+	if (root === null) return "skip:not-in-ccc";
+	const session = sessionOf(agent);
+	const nowMs = Date.now();
+	const run = getProxyRun(sessionId);
+	const text = lastAssistantText(agent);
+	const nonces = parseDoneNonces(text);
+	const sessionIdExcluded = isProxyExcludedSessionId(sessionId);
+	const userInitiated = turn === null ? true : isUserTurn(sessionId, turn);
+	const cro = !sessionIdExcluded && !userInitiated && isMainSession(agent) ? hasCroProgram(session, root) : false;
+	const verdict = decideUnattendedAction({
+		enabled: true,
+		root,
+		isMainSession: isMainSession(agent),
+		sessionIdExcluded,
+		userInitiated,
+		hasCroProgram: cro,
+		run,
+		nowMs,
+		doneNonce: nonces.length > 0 ? nonces[nonces.length - 1] ?? null : null,
+		claimsNotify: claimsUserNotification(text),
+		outboundSeen: run !== null && hasOutboundSendSince(root, run.startedAt, nowMs)
+	});
+	if (verdict.action === "skip") return `skip:${verdict.reason}`;
+	if (verdict.action === "accept" || verdict.action === "cap") {
+		clearProxyRun(sessionId);
+		logEvent(session, root, {
+			event: verdict.action,
+			round: verdict.round,
+			nonce: run?.nonce ?? null,
+			reason: verdict.reason,
+			sessionId
+		}, nowMs);
+		console.log(`[serenity-hooks] unattended: ${verdict.action} (${verdict.reason}, round=${verdict.round}, session=${sessionId})`);
+		return `${verdict.action}:${verdict.reason}`;
+	}
+	const nonce = newNonce();
+	const startedAt = run?.startedAt ?? nowMs;
+	setProxyRun(sessionId, {
+		round: verdict.round,
+		nonce,
+		startedAt
+	});
+	const message = verdict.reason === "false-notify" ? buildFalseNotifyRebuke({
+		round: verdict.round,
+		maxRounds: 15,
+		nonce
+	}) : buildProxyMessage({
+		round: verdict.round,
+		maxRounds: 15,
+		nonce
+	});
+	try {
+		agent.steer(createUserMessage({
+			content: [{
+				type: "text",
+				text: message
+			}],
+			source: PLUGIN_SOURCE
+		}));
+	} catch (error) {
+		clearProxyRun(sessionId);
+		logEvent(session, root, {
+			event: "cap",
+			round: verdict.round,
+			nonce,
+			reason: "steer-failed",
+			sessionId
+		}, nowMs);
+		console.warn(`[serenity-hooks] unattended: steer 失败（本轮放弃） — ${String(error?.message ?? error)}`);
+		return "cap:steer-failed";
+	}
+	logEvent(session, root, {
+		event: "inject",
+		round: verdict.round,
+		nonce,
+		reason: verdict.reason,
+		sessionId
+	}, nowMs);
+	console.log(`[serenity-hooks] unattended: inject round=${verdict.round}/15 (${verdict.reason}, session=${sessionId})`);
+	return `inject:${verdict.reason}`;
+}
+/**
+* 装配无人值守代理缝（`index.ts` apply 调用）。
+*
+* 订阅三个事件（**都已在 `host/contract.ts` 白名单里**，新增的 `agent/inbox/claimed` 同批登记）：
+* · `agent/inbox/claimed` —— 记「真实用户发起的轮次」；用户回来时**让位**（清代理段 + 记流水）;
+* · `agent/turn-stopping` —— 判定 + 注入（本机制主体）；
+* · `agent/disposed` / `session/disposed` —— 载体销毁清表（**本容器栽过 5 次"只增不清"**）。
+*/
+function registerUnattendedSeam(ctx) {
+	const on = (event, handler) => {
+		try {
+			ctx.on(event, handler);
+		} catch (err) {
+			console.log(`[serenity-hooks] ✗ 无人值守代理未装配（${event} 不可用）: ${String(err?.message ?? err)}`);
+		}
+	};
+	on("agent/inbox/claimed", (payload) => {
+		try {
+			const p = payload;
+			const sessionId = sessionIdOf$2(p?.agent);
+			if (sessionId === "") return;
+			if (p.message?.source?.kind !== "user") return;
+			noteUserTurn(sessionId, (typeof p.turn === "number" ? p.turn : null) ?? -1);
+			const run = getProxyRun(sessionId);
+			if (!run) return;
+			clearProxyRun(sessionId);
+			const root = cccRootForCwd(cwdOf(p.agent));
+			if (root) logEvent(sessionOf(p.agent), root, {
+				event: "yield",
+				round: run.round,
+				nonce: run.nonce,
+				reason: "user-returned",
+				sessionId
+			}, Date.now());
+			console.log(`[serenity-hooks] unattended: yield — 用户回来了 (session=${sessionId}, round=${run.round})`);
+		} catch (err) {
+			console.log(`[serenity-hooks] unattended: claimed 观察失败 — ${String(err?.message ?? err)}`);
+		}
+	});
+	on("agent/turn-stopping", (payload) => {
+		try {
+			const p = payload;
+			if (!p?.agent) return;
+			handleTurnStopping(p.agent, typeof p.turn === "number" ? p.turn : null);
+		} catch (err) {
+			console.log(`[serenity-hooks] unattended: turn-stopping 处置失败（已忽略） — ${String(err?.message ?? err)}`);
+		}
+	});
+	on("agent/disposed", (payload) => {
+		const sessionId = sessionIdOf$2(payload?.agent);
+		if (sessionId === "") return;
+		clearProxyRun(sessionId);
+		clearUserTurn(sessionId);
+	});
+	on("session/disposed", (payload) => {
+		const id = payload?.id;
+		if (typeof id !== "string" || id === "") return;
+		clearProxyRun(id);
+		clearUserTurn(id);
+	});
+	registerDisposer(ctx, "unattended proxy", () => {
+		clearUnattendedState();
+	});
+}
+//#endregion
 //#region src/acp-core.ts
 /** JSON-RPC 错误码（对齐标准） */
 const RPC_ERROR = {
@@ -12733,12 +13376,6 @@ qInput.focus()
 </body>
 </html>`;
 }
-//#endregion
-//#region src/weixin-output-guard.ts
-const PLUGIN_SOURCE = {
-	kind: "plugin",
-	plugin: "dsh-serenity-hooks"
-};
 const manualSessions = /* @__PURE__ */ new Map();
 /**
 * 本轮是否已成功发送（**由桥在每轮开始时清空** `clearSentThisTurn`；闸门只置位不清空——
@@ -14231,7 +14868,7 @@ function describeOpencodeAction(action) {
 */
 async function applyOpencodeAutoConfigOnce(ctx, env) {
 	const settings = hostSettings(ctx);
-	if (settings?.get === void 0 || settings.update === void 0) {
+	if (settings?.describe === void 0 || settings.update === void 0) {
 		console.warn("[serenity-hooks] opencode 路由自动配置跳过：settings 服务不可用（未能读取/写入 llm-pi-ai 命名空间）");
 		return {
 			wrote: false,
@@ -14240,7 +14877,7 @@ async function applyOpencodeAutoConfigOnce(ctx, env) {
 	}
 	let resolved;
 	try {
-		resolved = settings.get.call(settings, LLM_PI_AI_NAMESPACE);
+		resolved = (settings.describe.call(settings) ?? []).find((f) => f.ns === LLM_PI_AI_NAMESPACE)?.value;
 	} catch (error) {
 		console.warn(`[serenity-hooks] opencode 路由自动配置跳过：读取 ${LLM_PI_AI_NAMESPACE} 失败: ${String(error?.message ?? error)}`);
 		return {
@@ -14336,7 +14973,7 @@ function registerOpencodeAutoConfig(ctx) {
 		});
 	}
 	try {
-		ctx.on?.call(ctx, "settings/updated", (ns) => {
+		ctx.on?.call(ctx, "settings/document-updated", (ns) => {
 			if (ns === "llm-pi-ai") sync();
 		});
 	} catch {}
@@ -14477,7 +15114,7 @@ function planDeepseekVisionPatch(input) {
 */
 async function applyDeepseekVisionPatchOnce(ctx, enabled) {
 	const settings = hostSettings(ctx);
-	if (settings?.get === void 0 || settings.update === void 0) {
+	if (settings?.describe === void 0 || settings.update === void 0) {
 		console.warn("[serenity-hooks] DeepSeek 多模态补丁跳过：settings 服务不可用（未能读写 llm-pi-ai 命名空间）");
 		return {
 			wrote: false,
@@ -14486,7 +15123,7 @@ async function applyDeepseekVisionPatchOnce(ctx, enabled) {
 	}
 	let resolved;
 	try {
-		resolved = settings.get.call(settings, LLM_PI_AI_NAMESPACE);
+		resolved = (settings.describe.call(settings) ?? []).find((f) => f.ns === LLM_PI_AI_NAMESPACE)?.value;
 	} catch (error) {
 		console.warn(`[serenity-hooks] DeepSeek 多模态补丁跳过：读取 ${LLM_PI_AI_NAMESPACE} 失败: ${String(error?.message ?? error)}`);
 		return {
@@ -14580,7 +15217,7 @@ function registerDeepseekVisionPatch(ctx, enabled) {
 		});
 	}
 	try {
-		ctx.on?.call(ctx, "settings/updated", (ns) => {
+		ctx.on?.call(ctx, "settings/document-updated", (ns) => {
 			if (ns === "llm-pi-ai") sync();
 		});
 	} catch {}
@@ -15125,6 +15762,7 @@ function renderClock(label, s) {
 	const parts = [
 		`armed=${s.armed}`,
 		`CRO 闸=${readSimpleSettings().croEnabled !== false}`,
+		`无人值守闸=${readSimpleSettings().unattendedEnabled === true}`,
 		`tick 次数=${s.ticks}`,
 		`上次 tick=${ts(s.lastTickAt)}`
 	];
@@ -15442,7 +16080,17 @@ const Config = z.object({
 	}),
 	webFetch: z.object({ enabled: z.boolean().default(true) }),
 	opencodeProvider: z.object({ autoConfigure: z.boolean().default(true) }),
-	visionPatch: z.object({ enabled: z.boolean().default(true) })
+	visionPatch: z.object({ enabled: z.boolean().default(true) }),
+	gatewayEnabled: z.boolean(),
+	rebuildEnabled: z.boolean(),
+	rebuildThresholdK: z.number().min(50).max(4e3),
+	skiffEnabled: z.boolean(),
+	skiffDebugPort: z.number().min(1024).max(65535),
+	acpEnabled: z.boolean(),
+	acpHttpPort: z.number().min(1024).max(65535),
+	publicAskEnabled: z.boolean(),
+	croEnabled: z.boolean(),
+	unattendedEnabled: z.boolean()
 });
 function apply(ctx, config) {
 	try {
@@ -15494,6 +16142,7 @@ function apply(ctx, config) {
 	registerGateway(ctx);
 	registerRebuildTurnHook(ctx);
 	registerOutputGuardHook(ctx);
+	registerUnattendedSeam(ctx);
 	if (config.env) registerEnv(ctx);
 	if (config.opencodeSkills) registerOpencodeSkills(ctx);
 	registerBootstrap(ctx);
@@ -15533,9 +16182,10 @@ function apply(ctx, config) {
 * 任何 live 会话，故 apply 时刻就能解析到，不再需要"等一会儿再试"。
 *
 * 🔒 **必须保留**（它们不是"重试"，删了会引入新缺陷）：
-*  - **反应式再触发**（`agent/session-start` / `session/created` → sync）：宿主重启后
-*    "恢复"旧会话不触发 `session/created`，但**开始对话**会触发 `agent/session-start`
-*    ——这是唯一能把"进程起来时还解析不到、稍后才有会话"这条路径接上的通道。
+*  - **反应式再触发**（`agent/created` / `session/created` → sync）：宿主重启后
+*    "恢复"旧会话不触发 `session/created`，但**开始对话**会触发 `agent/created`
+*    （v0.1.7 前名 `agent/session-start`）——这是唯一能把"进程起来时还解析不到、稍后才有会话"
+*    这条路径接上的通道。
 *  - **`starting` 在飞标志**：防同拍双次 start → `EADDRINUSE`。
 *    （C4 块 A 备注：面宿主亦按面名合并在飞启动，是第二道保险；**本标志仍保留**——
 *    它管的是"解析 root 这段装配流程"的在飞语义，且调试服务的启动替身在测试里被 mock，
@@ -15586,7 +16236,7 @@ function registerSkiff(ctx) {
 			sync();
 		});
 	} catch {}
-	for (const eventName of ["agent/session-start", "session/created"]) try {
+	for (const eventName of ["agent/created", "session/created"]) try {
 		ctx.on(eventName, () => {
 			if (!started) sync();
 		});