@shgroup/dsh-serenity-hooks 1.57.2 → 1.58.2

package/lib/index.js

@@ -3,7 +3,7 @@ import { c as hostInjected, d as hostSessions, f as hostSettings, h as hostWebSe
 import { _ as resolveInside, a as findSerenityRoot$1, c as matchBlacklist, d as readCccName$1, f as readCheapWorkerConfig, h as readTrajectorySkills, i as findGitRoot, l as pathInside, m as readSafeModeHiddenTools, n as SAFE_MODE_MARKER, o as isSafeModeOn, p as readExclusiveTools, r as classifyPath, s as loadSerenityConfig, t as DEFAULT_SERENITY_CONFIG_PATHS, u as readBlacklist } from "./ccc-B0ZGL9lx.js";
 import { A as localIdStamp, C as setActiveSessionInfo, D as isoLocal, E as useSession, O as localFileStamp, S as sessionsRoot, T as summarize, _ as namingTitleFor, a as pruneMissingBindings, b as resolveSessionByTitle, c as setBindingStore, d as clearActiveSessionInfo, f as createSession, g as listSessions, h as getActiveSessionInfo, i as listBoundSessionIds, k as localHuman, l as DEFAULT_SESSION_SCOPE, m as findSession, n as PLUGIN_SOURCE, o as readLastBound, p as extractSessionMdPathFromText, r as appendBound, s as resolveSessionTrajectoryLabel, t as ACC_MESSAGE_KIND, u as TRAJECTORY_ACTIONS, v as parseSessionContextFromEvents, w as showSession, x as sessionEvents$1, y as readActiveSessionMd } from "./message-source-B4P3Uw6D.js";
 import { a as readWeixinCredential, c as weixinInboundDir, d as LOCALSTORE_SCOPES, f as checkLocalstoreGitCompliance, g as runLocalStore, h as readStore, i as matchWeixinRoute, l as weixinSessionIdFor, m as readGitTrack, n as extractWeixinText, o as readWeixinSettings, p as localstorePath, r as hasVoiceItem, s as sanitizeFileName$1, t as extractWeixinMedia } from "./weixin-route-B9gU1YXz.js";
-import { a as GATEWAY_PORT, c as SKIFF_DEBUG_PORT, d as skiffRoleFor$1, f as skiffSessionInfo$1, i as FACE_PORTS, l as WEIXIN_SEND_PORT, m as ACC_VERSION, n as readSimpleSettings, o as MAIN_WEB_PORT, p as unregisterSkiffSession$1, r as registerSettingsSection, s as MECHANISM_PORTS, u as registerSkiffSession$1 } from "./settings-section-DQIVsTqE.js";
+import { a as FACE_PORTS, c as MECHANISM_PORTS, d as registerSkiffSession$1, f as skiffRoleFor$1, h as ACC_VERSION, i as ACP_PORT, l as SKIFF_DEBUG_PORT, m as unregisterSkiffSession$1, n as readSimpleSettings, o as GATEWAY_PORT, p as skiffSessionInfo$1, r as registerSettingsSection, s as MAIN_WEB_PORT, u as WEIXIN_SEND_PORT } from "./settings-section-DGUQZo5j.js";
 import { a as readSkiffRoles, c as roleMsmWhitelist, d as systemPromptSource, f as trajectorySubset, i as isSkiffSessionId, l as roleToolWhitelist, n as buildSkiffBasePrompt, o as resolveRoleSystemPrompt, r as createRolePromptReader, s as resolveSkiffKind } from "./skiff-role-B615L9MV.js";
 import { REGISTERED_TOOLS } from "./invariant.js";
 import { a as markdownToPlainText, c as sendTyping, i as getUpdates, l as sniffImageExt, n as downloadMedia, o as sendFileMessage, r as getConfig, s as sendTextMessage, t as TypingStatus } from "./weixin-api-BrRcPiQs.js";
@@ -13,7 +13,7 @@ import { defineTool } from "@deepseek-ai/dsh-tools";
 import { basename, dirname, extname, isAbsolute, join, relative, resolve } from "node:path";
 import { appendFileSync, chmodSync, cpSync, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, rmdirSync, statSync, unlinkSync, utimesSync, writeFileSync } from "node:fs";
 import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
-import { homedir, platform } from "node:os";
+import { homedir, hostname, platform } from "node:os";
 import { promisify } from "node:util";
 import { platform as platform$1 } from "node:process";
 import { fileURLToPath } from "node:url";
@@ -9971,10 +9971,20 @@ function listWakes(root, opts = {}) {
 */
 /** 入口文件名（**全写**，所有者令 2026-09-19；不改缩写） */
 const CRO_FILENAME = "continuous-re-occurrence.ts";
+/**
+* 机器绑定文件名（**全写**，与 `CRO_FILENAME` 同风格）。
+*
+* 🔴 **它随 CCC git 走是设计意图，不是缺陷**：
+* 绑定声明必须跟着**轨迹**走，才能在第二台机器上被读到、并被判为"不是我的"。
+* （这正是机器绑定的整个目的 —— 见 `resolveCroHostBinding` 的头注。）
+*/
+const CRO_HOST_FILENAME = "cro-host-binding";
 /** 硬超时（沿用 `biasProvider` 先例的 60s；设计 §5 情形 2） */
 const CRO_TIMEOUT_MS = 6e4;
 /** stdout 上限（防一个坏程序把日志撑爆；沿用 hook 截断思路） */
 const CRO_STDOUT_MAX = 65536;
+/** 绑定文件体积上限（它只是个机器名 ⇒ 超过这个数一定是写错了，不读） */
+const CRO_HOST_FILE_MAX = 1024;
 /** SESSION.md 文件名（与 `trajectory-ops.ts` 同值；此处本地常量避免反向依赖） */
 const SESSION_MD = "SESSION.md";
 /**
@@ -10109,6 +10119,135 @@ function croScriptPath(root, dirName) {
 	return resolveInside(root, join("AGENT_SESSIONS", dirName, CRO_FILENAME));
 }
 /**
+* 解析机器绑定 —— 「**这条轨迹由哪台机器负责自唤醒**」（所有者令 2026-10-15）。
+*
+* ## 所有者裁定的语义（逐字，D135）
+*
+* 「**CRO 必须指定绑定机器，否则不运行，唤醒器 检查这个**」⇒ 三条同时成立：
+* ① **只许这一台**（白名单，不是"排除这一台"）；
+* ② **fail-closed** —— **没绑 = 不跑**（不是"没绑 = 随便跑"）；
+* ③ **检查者在唤醒器**（本函数由 `runCroPhase` 调用，不是程序自己判）。
+*
+* ## 绑定键 = 机器名（所有者 2026-10-15 裁「用 hostname 吧，比较合理」）
+*
+* ⚠️ **已接受的取舍**：本机机器名是 QEMU 机型派生的默认形
+* （`yh-Standard-PC-Q35-ICH9-2009`）⇒ 同法新建的同名用户 VM 会取到同一个名字。
+* 所有者 2026-10-15 明确「**不改名，家里就这几台机器没必要**」⇒ **风险由所有者接受**。
+*
+* ## 🔴 为什么必须是三态，「没绑」不能并进「绑给别人」
+*
+* 2026-10-15 已发生过**同族事故**：`send-now` 失败时报的是「无绑定会话记录」，
+* 而真因是"那条轨迹不可寻址"—— **文案相同、原因不同**，害得排查方向错了一次
+* （S142 §日志 续 129 / D134）。
+* ⇒ 绑定这一层**不许再造同样的坑**：「你没绑」与「你绑给了别人」是**两件不同的事**，
+*   日志必须分开写 —— 否则将来"为什么这条轨迹不跑了"会又一次指错方向。
+*
+* ## 文件形态（刻意的极简）
+*
+* · 位置 = `<轨迹目录>/cro-host-binding`（与 CRO 程序**同级**）
+* · 内容 = **一行机器名**（首尾空白裁掉；只取第一行有效内容）
+* · 不用 JSON —— 它只有一个值，JSON 只会多一种写错的方式
+* · 支持 `#` 注释行与空行（方便人写、方便留痕）
+*
+* 🔴 **它必须随 git 入库**（不是"运行态"）：绑定声明要**跟着轨迹走到第二台机器**，
+*   在那里被判成「绑给了别人」而**正确地不跑** —— 那就是本机制在工作。
+*   ⇒ ⛔ **不要把它加进 `.gitignore`**（那会让第二台机器读到"没绑"而同样不跑，
+*   表面上结果一样，但**判据从"明确绑给别人"退化成"什么都没说"**，失去可诊断性）。
+*
+* ## 为什么读文件而不是读快照字段
+*
+* 快照（`CroSnapshot`）是喂给**程序**的；而本判定发生在**程序被 spawn 之前**
+* —— 程序还没跑，没有快照可读。⇒ 只能读文件。（这也是"机制属 ACC"的体现：
+* ACC 在调用用户程序前先判定自己该不该调用。）
+*
+* @param root CCC 根
+* @param dirName 轨迹目录名
+* @param selfHost 本机机器名（**注入** ⇒ 可测；生产调用方传 `hostname()`）
+* @returns 判定结果（**永不抛** —— 旁路容忍铁律）
+*/
+function resolveCroHostBinding(root, dirName, selfHost) {
+	const self = String(selfHost ?? "").trim();
+	let fileAbs;
+	try {
+		fileAbs = resolveInside(root, join("AGENT_SESSIONS", dirName, CRO_HOST_FILENAME));
+	} catch (err) {
+		return {
+			allowed: false,
+			bound: null,
+			self,
+			code: "read-error",
+			detail: `绑定文件路径非法（已忽略）：${String(err?.message ?? err)}`
+		};
+	}
+	let raw;
+	try {
+		if (!existsSync(fileAbs)) return {
+			allowed: false,
+			bound: null,
+			self,
+			code: "not-bound",
+			detail: `未绑定机器（缺 ${CRO_HOST_FILENAME}）⇒ 按"必须指定"不运行`
+		};
+		const st = statSync(fileAbs);
+		if (st.size > CRO_HOST_FILE_MAX) return {
+			allowed: false,
+			bound: null,
+			self,
+			code: "read-error",
+			detail: `绑定文件过大（${st.size} B > ${CRO_HOST_FILE_MAX} B）⇒ 判为写错，不运行`
+		};
+		raw = readFileSync(fileAbs, "utf-8");
+	} catch (err) {
+		return {
+			allowed: false,
+			bound: null,
+			self,
+			code: "read-error",
+			detail: `绑定文件读取失败 ⇒ 不运行：${String(err?.message ?? err)}`
+		};
+	}
+	const bound = parseCroHostBinding(raw);
+	if (bound === null) return {
+		allowed: false,
+		bound: null,
+		self,
+		code: "not-bound",
+		detail: `绑定文件为空（只有注释/空行）⇒ 按"必须指定"不运行`
+	};
+	if (bound === self) return {
+		allowed: true,
+		bound,
+		self,
+		code: "bound-to-self",
+		detail: `已绑定本机（${bound}）`
+	};
+	return {
+		allowed: false,
+		bound,
+		self,
+		code: "bound-to-other",
+		detail: `绑定给别的机器（绑定=${bound}，本机=${self}）⇒ 本机不运行`
+	};
+}
+/**
+* 解析绑定文件正文 ⇒ 机器名（取不到 ⇒ `null`）。
+*
+* 规则（刻意宽松：**只认一行，其余都当注释**）：
+* · 逐行扫；跳过空行与 `#` 开头的行；
+* · **第一条有效行** = 机器名（裁首尾空白）；
+* · 无有效行 ⇒ `null`。
+* @param raw 文件正文
+* @returns 机器名；无有效内容 ⇒ `null`
+*/
+function parseCroHostBinding(raw) {
+	for (const line of String(raw ?? "").split(/\r?\n/)) {
+		const t = line.trim();
+		if (t === "" || t.startsWith("#")) continue;
+		return t;
+	}
+	return null;
+}
+/**
 * 列出**启用了 CRO 的轨迹目录名**（供调度器每 tick 扫描，设计 §6.1）。
 *
 * ## 判据与形态（R↓）
@@ -11134,7 +11273,10 @@ async function acquireWakeAgent(ctx, root, dirName) {
 			return { error: `冷会话载入失败（${id}）: ${String(err?.message ?? err)}` };
 		}
 	}
-	return { error: `无绑定会话记录（AGENT_SESSIONS/.bindings.json 中无 ${dirName}）——目标轨迹需先被 container_trajectory use 激活过` };
+	return {
+		error: `无绑定会话记录（AGENT_SESSIONS/.bindings.json 中无 ${dirName}）——目标轨迹需先被 container_trajectory use 激活过`,
+		noBinding: true
+	};
 }
 /** 唤醒消息（唤起即投递正文：身份锚定 + 唤醒信息 + 任务） */
 function buildWakeText(entry, target) {
@@ -11256,11 +11398,21 @@ async function sendToTrajectory(ctx, root, target, message, sender) {
 		ok: false,
 		detail: `目标 trajectory 未命中（${target}）`
 	};
-	const acquired = await acquireWakeAgent(ctx, root, t.dirName);
-	if ("error" in acquired) return {
-		ok: false,
-		detail: acquired.error
-	};
+	let acquired = await acquireWakeAgent(ctx, root, t.dirName);
+	let createdNote = "";
+	if ("error" in acquired) {
+		if (!acquired.notReady && acquired.noBinding === true) {
+			acquired = await createAndBindTarget(ctx, root, t.dirName);
+			if ("error" in acquired) return {
+				ok: false,
+				detail: acquired.error
+			};
+			createdNote = `；目标原本无活跃 dsh 会话 ⇒ **已自动创建并绑定**一条（${acquired.how}）`;
+		} else return {
+			ok: false,
+			detail: acquired.error
+		};
+	}
 	const agent = acquired.agent;
 	const make = () => createUserMessage({
 		content: [{
@@ -11280,14 +11432,14 @@ async function sendToTrajectory(ctx, root, target, message, sender) {
 		}
 		return {
 			ok: true,
-			detail: `已即时投递 ${t.dirName}（${acquired.how}；目标空闲 ⇒ followup 立即起轮）`
+			detail: `已即时投递 ${t.dirName}（${acquired.how}；目标空闲 ⇒ followup 立即起轮）${createdNote}`
 		};
 	}
 	try {
 		agent.steer(make());
 		return {
 			ok: true,
-			detail: `已即时注入 ${t.dirName}（${acquired.how}；目标在跑 ⇒ steer 当场注入当前轮）`
+			detail: `已即时注入 ${t.dirName}（${acquired.how}；目标在跑 ⇒ steer 当场注入当前轮）${createdNote}`
 		};
 	} catch (err) {
 		try {
@@ -11300,11 +11452,72 @@ async function sendToTrajectory(ctx, root, target, message, sender) {
 		}
 		return {
 			ok: true,
-			detail: `已投递 ${t.dirName}（${acquired.how}；steer 不可用 ⇒ 退回 followup）: ${String(err?.message ?? err)}`
+			detail: `已投递 ${t.dirName}（${acquired.how}；steer 不可用 ⇒ 退回 followup）: ${String(err?.message ?? err)}${createdNote}`
 		};
 	}
 }
 /**
+* 🆕 **给一条「从未被激活过」的轨迹就地建一条 dsh 会话并绑定它**（2026-10-16 owner 令，S142）。
+*
+* 何时用：**只有** `send-now` 在 `acquireWakeAgent` 报「无绑定会话记录」时（见该处的判据说明）。
+*
+* 三步（顺序不可换）：
+*   ① `sessionController.create({ cwd: root })` —— 宿主原语，**idempotently adopt**
+*      ⇒ 重复调用不会建出第二条（不必自造"先查再建"的竞态窗口）。
+*   ② `resolveAgent(sessionId)` —— 拿到**真 agent**。`create` 只返回 id，不给 agent。
+*   ③ `appendBound(...)` —— 落绑定。**必须由本函数写**：`listBoundSessionIds` 是
+*      `acquireWakeAgent` 的唯一选人依据，不写绑定则下一条消息**还是**找不到它
+*      （那就成了"建了但永远用不上"，比不建更坏）。
+*
+* 🔴 **为什么用 `cwd: root` 而不是目标的目录**：会话的 cwd 决定它落在哪个 CCC
+*    （`cccRootForCwd` 上溯 `.serenity`）。目标轨迹本就住在该 CCC 的 `AGENT_SESSIONS/` 下
+*    ⇒ 传 CCC 根才让它**进同一个 CCC**；传轨迹目录会让它变成一个**不同 CCC**的会话。
+*
+* @returns 命中返回 agent 与取得方式；任一步失败返回**带原因**的 error（不静默、不误报成功）
+*/
+async function createAndBindTarget(ctx, root, dirName) {
+	const sc = hostService(ctx, "sessionController");
+	const create = sc?.create;
+	if (typeof create !== "function") return {
+		error: "目标无活跃 dsh 会话，且 sessionController.create 不可用（绑定 id: 无）——无法就地创建载体；请先对该轨迹执行一次 container_trajectory use",
+		notReady: true
+	};
+	let sessionId = "";
+	try {
+		const out = await create.call(sc, { cwd: root });
+		sessionId = String(out?.sessionId ?? "");
+	} catch (err) {
+		return { error: `就地创建会话失败（${dirName}）: ${String(err?.message ?? err)}` };
+	}
+	if (!sessionId) return { error: `就地创建会话未返回 sessionId（${dirName}）` };
+	const resolved = sc?.resolveAgent;
+	if (typeof resolved !== "function") return {
+		error: `会话已建（${sessionId}）但 sessionController.resolveAgent 不可用`,
+		notReady: true
+	};
+	let agent;
+	try {
+		const out = await resolved.call(sc, sessionId);
+		agent = out?.agent;
+		if (!agent) return { error: `会话已建（${sessionId}）但 resolveAgent 未返回 agent: ${String(out?.error ?? "未知原因")}` };
+	} catch (err) {
+		return { error: `会话已建（${sessionId}）但载入失败: ${String(err?.message ?? err)}` };
+	}
+	const bound = appendBound({ header: {
+		id: sessionId,
+		cwd: root
+	} }, "activate", {
+		dirName,
+		mdPath: join(root, "AGENT_SESSIONS", dirName, "SESSION.md"),
+		note: "auto-created by send-now"
+	});
+	const how = `auto-create(${sessionId}${bound ? ", bound" : ", ⚠️ 绑定写入失败"})`;
+	return {
+		agent,
+		how
+	};
+}
+/**
 * 本 tick 要扫的 CCC 根集合（**并集**）。
 *
 * C2（S142 2026-09-15 Q5）：原实现是 `collectLiveCccs`——**只认 live 会话** ⇒
@@ -11441,10 +11654,18 @@ async function runCroPhase(ctx, root, registry, log) {
 		lastSkipReason: s.lastSkipReason
 	};
 	const agents = hostAgents(ctx);
+	const selfHost = safeHostname();
+	let hostSkips = 0;
 	let wakes = 0;
 	let quiet = 0;
 	let skips = 0;
 	for (const dirName of dirs) try {
+		const verdict = resolveCroHostBinding(root, dirName, selfHost);
+		if (!verdict.allowed) {
+			hostSkips += 1;
+			log.push(`· ${root}: ${dirName}: CRO 机器绑定未通过（${verdict.code}）：${verdict.detail}`);
+			continue;
+		}
 		const bound = listBoundSessionIds(root, dirName);
 		const running = runningCarriersOf(bound, nowMs);
 		const outcome = await evaluateCro(root, dirName, readCroSnapshotInput(root, dirName, nowMs, {
@@ -11481,7 +11702,22 @@ async function runCroPhase(ctx, root, registry, log) {
 		skips += 1;
 		log.push(`· ${root}: ${dirName}: CRO 内部异常（已忽略，不影响既有链路）: ${String(err?.message ?? err)}`);
 	}
-	log.push(`· ${root}: CRO 评估 ${dirs.length} 条（唤起 ${wakes}，不唤起 ${quiet}，跳过 ${skips}）`);
+	log.push(`· ${root}: CRO 评估 ${dirs.length} 条（唤起 ${wakes}，不唤起 ${quiet}，跳过 ${skips}${hostSkips > 0 ? `，非本机绑定 ${hostSkips}` : ""}）`);
+}
+/**
+* 取本机机器名（**永不抛**）。
+*
+* `os.hostname()` 理论上可能抛（极少数环境）⇒ 这里兜底成空串。
+* ⚠️ **空串的后果是"全部不通过"**（`bound === self` 永不成立）⇒ 即 **fail-closed**，
+* 与所有者裁定同向（宁可都不跑，也不会"名字取不到就随便跑"）。
+* @returns 本机机器名；取不到 ⇒ `''`
+*/
+function safeHostname() {
+	try {
+		return hostname();
+	} catch {
+		return "";
+	}
 }
 /** 一次调度 tick：遍历已知 CCC → 到期项串行投递 / 超窗项置 missed；返回人读摘要 */
 async function runWakeTick(ctx) {
@@ -11641,6 +11877,36 @@ const CRO_GUIDE = `CRO（Continuous Re-Occurrence · 持续再发生）编写指
    （tick 日志里会记一行跳过理由 —— 这是为了让你事后能分辨
    「**总闸关着没跑**」和「**跑了、程序自己判了不叫**」这两件完全不同的事）。
 
+## 2b. 🔴 机器绑定（**必须指定，否则不运行** —— 所有者令 2026-10-15）
+
+同目录再放一个文件：
+
+  <CCC 根>/AGENT_SESSIONS/<轨迹目录>/cro-host-binding
+
+内容 = **一行机器名**（就是本机 \`hostname\`）。也支持 \`#\` 注释行，方便留痕：
+
+  # 这条轨迹的自唤醒只在 CCC 宿主机上跑
+  yh-Standard-PC-Q35-ICH9-2009
+
+**语义（三条，缺一不可）**：
+· **只许这一台** —— 文件名里写的那台；别处**不跑**；
+· 🔴 **fail-closed** —— **没写这个文件 ⇒ 不跑**（不是"没写就随便跑"）；
+· **检查者是唤醒器**（ACC），**不是**你的程序 —— 你的程序**根本不会被调用**。
+
+**为什么要有它**：CRO 程序本身**随 git 走**（它在你轨迹目录里，会跟着 CCC 到第二台机器）。
+没有这道门，**同一段程序会在两台机器各跑一次**（同一轨迹被叫两次）。
+有了它，第二台机器读到"绑给了别人"就**正确地不跑**。
+
+⚠️ **两条与它有关的纪律**：
+1. 🔴 **不要把这个文件加进 \`.gitignore\`** —— 它**必须**跟着仓走。
+   否则第二台机器读到的是"没绑"，结果**碰巧一样**（也不跑），
+   但你的判据从「**明确绑给了别人**」退化成「**什么都没说**」⇒ 排查时看不出真因。
+2. 🔴 **tick 日志会区分两种跳过**：
+   「\`not-bound\` 你没绑」与「\`bound-to-other\` 你绑给了别人」是**两件事**，文案不同。
+   （2026-10-15 有过一次教训：两种不同的原因报同一句话，害排查指错方向。）
+
+**改绑 / 解除**：直接改这个文件（或删掉 ⇒ 变回"没绑 ⇒ 不跑"）。**没有额外命令**。
+
 ## 3. 我给你什么（输入）
 ACC 把这条轨迹的状态做成一个 **JSON 快照**，从 **stdin** 喂给你的程序。
 字段分四组：identity（身份）/ time（时间）/ body（轨迹身体）/ binding + scheduling（绑定与调度）。
@@ -11891,13 +12157,56 @@ function renderText$3(value) {
 function createTrajectoryTool(ctx) {
 	return defineTool({
 		name: "container_trajectory",
-		description: "Trajectory (AGENT_SESSIONS/ — the persistent body of a trajectory; the dsh conversation is only its rebuildable carrier). Lifecycle + delivery: list (inventory with stats and anomaly marks) / show (read one SESSION.md) / create / use (activate for this conversation, with inline integrity check) / rebuild (clear-and-rebuild the current conversation in place, Ship of Theseus) / send-now (deliver ONE message to a trajectory RIGHT NOW — live: injected immediately; not live: cold-resumed, i.e. equivalent to a direct wake; returns a synchronous receipt) / send-later (schedule ONE message to any trajectory at a future instant — fire-and-forget: no receipt, no recall, no panel) / cro-guide (the CRO programming guide: how to give THIS trajectory its own program that decides when it should be woken). create requires --desc <desc> [--goal] or --issue <ticket> (exactly one) plus --summary (≤20 chars). use requires --summary (≤20 chars) and may pass --force to switch away from the currently-bound trajectory. rebuild requires --summary (next-phase summary ≤20 chars) + optional --note (task focus for the rebuilt self). send-later requires target (S### or AGENT_SESSIONS dir name) + at (RFC3339 or +30m/+2h) + message. send-now requires target + message. It delivers IMMEDIATELY (never queued behind the current turn): a busy target is steered mid-turn so it reads the message in the CURRENT turn, and an idle target starts a turn right away. Its receipt means the message was injected into the target (it does NOT mean the target ran or replied). The summary is appended to the dsh session title (S###-YYYY-MM-DD-<summary>); the S### id and date stay server-derived.",
+		description: [
+			"container_trajectory — one trajectory: its persistent body (SESSION.md) + its timeline.",
+			"A trajectory is NOT the conversation: SESSION.md is the durable body and never moves;",
+			"the dsh conversation is only its rebuildable carrier (Ship of Theseus — the carrier is replaced, the trajectory continues).",
+			"ACTIONS, grouped by EFFECT (read the grouping before picking one):",
+			"(A) LIFECYCLE — changes which trajectory THIS conversation is bound to:",
+			"list (inventory + stats + anomaly marks) / show (read one SESSION.md) / create (make a NEW trajectory) /",
+			"use (bind THIS conversation to an existing trajectory; inline integrity check — silent when fine, problems reported as hints, never errors) /",
+			"rebuild (clear-and-rebuild THIS conversation in place).",
+			"(B) DELIVERY — sends ONE message to ANOTHER trajectory; your own binding is unchanged:",
+			"send-now (deliver RIGHT NOW) / send-later (deliver at ONE future instant).",
+			"(C) REFERENCE — cro-guide (how to give THIS trajectory its own program that decides when it should be woken).",
+			"HOW TO CHOOSE (a rule, not a guess):",
+			"not yet bound + starting new work ⇒ create — with no prior binding it activates immediately, so the new trajectory has a carrier at once.",
+			"already bound + recording a separate future line ⇒ create — it does NOT steal your binding (you stay on the current trajectory);",
+			"activate the new one when you want it by sending it a message.",
+			"want THIS conversation to move to another trajectory ⇒ use (refuses when it would orphan the current binding; --force overrides).",
+			"want to poke another trajectory ⇒ send-now. Its target needs NO prior setup:",
+			"if the target has no live dsh session, one is created and bound automatically, and your message is injected into it.",
+			"RECEIPTS (read no more than is written): send-now returns a synchronous receipt meaning exactly \"injected / turn started\" —",
+			"NEVER \"the target ran or replied\"; to prove the target actually moved, read its SESSION.md.",
+			"It never queues behind the current turn: a busy target is steered mid-turn (read in the CURRENT turn), an idle target starts a turn at once.",
+			"send-later is fire-and-forget by design: no receipt, no recall, no panel.",
+			"ASYMMETRY (deliberate — the two differ in whether a missing target is normal): send-now creates a target on demand,",
+			"because sending to a never-used trajectory is a legitimate intent; send-later does NOT,",
+			"because scheduling for a trajectory that has never existed is almost always a mistyped name — auto-creating would hide that error behind an empty trajectory.",
+			"PARAMETERS: create requires --desc <desc> [--goal] or --issue <ticket> (exactly one) plus --summary (≤20 chars).",
+			"use requires --summary (≤20 chars) and may pass --force to switch away from the currently-bound trajectory.",
+			"rebuild requires --summary (next-phase summary ≤20 chars) + optional --note (task focus for the rebuilt self).",
+			"send-later requires target (S### or AGENT_SESSIONS dir name) + at (RFC3339 or +30m/+2h) + message.",
+			"send-now requires target + message.",
+			"The summary is appended to the dsh session title (S###-YYYY-MM-DD-<summary>); the S### id and date stay server-derived."
+		].join(" "),
 		parameters: {
 			action: {
 				type: "string",
 				enum: [...TRAJECTORY_ACTIONS],
 				required: true,
-				description: "Subcommand: list (inventory + stats + anomaly marks) / show (S### or dir name or fuzzy keyword) / create (--desc or --issue) / use (activate context; inline integrity check — pass silent, problems reported as hints, not errors) / rebuild (clear-and-rebuild current conversation — requires --summary + optional --note) / send-now (deliver one message RIGHT NOW: live target injected immediately, non-live cold-resumed like a direct wake; returns a synchronous receipt) / send-later (one future instant + one message, delivered to target trajectory) / cro-guide (no parameters: prints the CRO programming guide, including a ready-to-use sample snapshot)"
+				description: [
+					"Subcommand — grouped by effect.",
+					"LIFECYCLE (changes THIS conversation's binding):",
+					"list (inventory + stats + anomaly marks) / show (S### or dir name or fuzzy keyword) /",
+					"create (new trajectory; activates itself when you have no binding, otherwise leaves your binding untouched and tells you how to activate it) /",
+					"use (activate context for THIS conversation; inline integrity check — pass silent, problems reported as hints, not errors) /",
+					"rebuild (clear-and-rebuild current conversation — requires --summary + optional --note).",
+					"DELIVERY (sends one message to ANOTHER trajectory; your binding is unchanged):",
+					"send-now (deliver RIGHT NOW; the target needs no prior setup — if it has no live session, one is created and bound automatically) /",
+					"send-later (one future instant + one message; fire-and-forget, and it does NOT auto-create a target).",
+					"REFERENCE: cro-guide (no parameters: prints the CRO programming guide, including a ready-to-use sample snapshot)"
+				].join(" ")
 			},
 			name: {
 				type: "string",
@@ -11909,15 +12218,15 @@ function createTrajectoryTool(ctx) {
 			},
 			desc: {
 				type: "string",
-				description: "create short description (any language, ≤5 words; mutually exclusive with issue)"
+				description: "create: short description (any language, ≤5 words; mutually exclusive with issue)"
 			},
 			issue: {
 				type: "string",
-				description: "create ticket number (e.g. apaas-26116; dir named YYYY-MM-DD--<issue>; mutually exclusive with desc)"
+				description: "create: ticket number (e.g. apaas-26116; dir named YYYY-MM-DD--<issue>; mutually exclusive with desc)"
 			},
 			goal: {
 				type: "string",
-				description: "create one-sentence goal (optional)"
+				description: "create: one-sentence goal (optional)"
 			},
 			summary: {
 				type: "string",
@@ -11929,7 +12238,7 @@ function createTrajectoryTool(ctx) {
 			},
 			dryRun: {
 				type: "boolean",
-				description: "create preview mode (no actual changes)"
+				description: "create: preview mode (no actual changes)"
 			},
 			target: {
 				type: "string",
@@ -11968,13 +12277,32 @@ function createTrajectoryTool(ctx) {
 						dryRun: isDryRun
 					});
 					const message = result.message;
-					if (!isDryRun) appendBound(agentDshSession(exec), "create", {
-						dirName: result.dirName,
-						mdPath: join(result.sessionPath, "SESSION.md"),
-						sessionId: result.sessionId,
-						note: "created (binding unchanged until explicit use)"
-					});
-					return message;
+					if (isDryRun) return message;
+					const scope = agentScope$1(exec);
+					const priorBound = currentBoundDirName(exec, scope);
+					if (priorBound === null) {
+						const active = useSession(root, result.dirName, scope);
+						const info = getActiveSessionInfo(scope);
+						if (info) renameDshSessionForActive(ctx, exec, info, args.summary);
+						const dsh = agentDshSession(exec);
+						if (dsh && info) appendBound(dsh, "activate", {
+							dirName: info.dirName,
+							mdPath: info.mdPath,
+							sessionId: info.sessionId,
+							note: "auto-activated on create (no prior binding)"
+						});
+						return [
+							message,
+							`✓ 已自动激活（此前**无绑定**）：${active.dir} —— 后续工作写回该轨迹的 SESSION.md。`,
+							`  （判据：create 前无任何绑定 ⇒ 激活；有绑定则只建不夺，见下。）`
+						].join("\n");
+					}
+					return [
+						message,
+						`⚠ 本轨迹【未】被激活 —— 当前已绑定 ${priorBound}，保绑定优先（不夺走你正在用的轨迹）。`,
+						`  要激活它（并在它名下开一条会话）：用 container_trajectory send-now 向 ${result.dirName} 投一条消息 ——`,
+						`  目标若没有活跃 dsh 会话，会自动创建一条并把「使用提示词 ＋ 你的消息」一并注入。`
+					].join("\n");
 				}
 				case "use": {
 					if (!args.name) throw new Error("use requires name (S### or directory name)");
@@ -21488,6 +21816,300 @@ function registerWeixinSendApi(ctx) {
 	sync();
 }
 //#endregion
+//#region src/acp-face.ts
+/** 面名（面宿主幂等键；与 FACE_PORTS 的 id 同名，便于对账） */
+const FACE_ACP = "acp";
+/** 本面绑定的地址（取自集中端口表 —— **单一真相源**，不在本文件硬写） */
+const ACP_HOST = FACE_PORTS.acp.host ?? "127.0.0.1";
+/**
+* `dsh-acp` 需要的服务（**替它声明**，见文件头坑 ①）。
+*
+* 逐字出处 = `dsh-acp/lib/index.js` 的 `const inject = ["agents","llm","sessionPersistence","sessions"]`。
+* ⚠️ **少一个就在它内部抛错**（实测那条是 `sessionPersistence`）⇒ 这里是**照抄它的声明**，
+*    不是"我们觉得它需要什么"。⇒ 它升版改了 `inject`，这里要跟着改（列为**跨版本注意点**）。
+*/
+const ACP_REQUIRED_SERVICES = [
+	"agents",
+	"llm",
+	"sessionPersistence",
+	"sessions"
+];
+function acpFaceActive() {
+	return faceActive(FACE_ACP);
+}
+/**
+* 面是否在监听（意图读取）。
+* ⚠️ 与 `startFace` 的关系同其余各面：**启动本身不读它**（`startFace` 是机械入口），
+* 由装配层用它决定"起还是停"。
+*/
+function acpFaceEnabled() {
+	return readSimpleSettings().acpFaceEnabled;
+}
+/**
+* 把一条裸 WS socket 适配成 ACP `Stream`。
+*
+* 🔴 与官方 `ndJsonStream` **同语义**：我们自己做「消息 ↔ 文本帧」的分帧（按行）。
+*    实测注意（P0′）：`dsh-acp` 写出的每条消息**自带换行**，客户端同样 ⇒ 按行切分即正确。
+*    ⚠️ **空行要丢**；**非 JSON 帧要容忍**（桥/客户端可能插入控制帧）。
+*/
+function wsToAcpStream(ws, onWarn) {
+	return {
+		readable: new ReadableStream({ start(controller) {
+			let buf = "";
+			ws.on("message", (data) => {
+				buf += typeof data === "string" ? data : String(data);
+				let i;
+				while ((i = buf.indexOf("\n")) >= 0) {
+					const line = buf.slice(0, i);
+					buf = buf.slice(i + 1);
+					if (!line.trim()) continue;
+					try {
+						controller.enqueue(JSON.parse(line));
+					} catch {
+						onWarn(line.slice(0, 120));
+					}
+				}
+			});
+			ws.on("close", () => {
+				try {
+					controller.close();
+				} catch {}
+			});
+			ws.on("error", () => {
+				try {
+					controller.close();
+				} catch {}
+			});
+		} }),
+		writable: new WritableStream({ write(msg) {
+			ws.send(`${JSON.stringify(msg)}\n`);
+		} })
+	};
+}
+function newState() {
+	return {
+		handle: null,
+		wss: null,
+		connections: 0,
+		applied: 0,
+		lastErrors: [],
+		disposers: []
+	};
+}
+/** 当前面状态（供 `status()` / 诊断读；无监听时 `handle` 为 null） */
+let state = newState();
+/** 保留最近若干条连接错误（诊断窗口；不无限增长） */
+const MAX_ERR_KEEP = 8;
+/**
+* 启动面 E（幂等；重复调用只起一次）。
+*
+* 🔴 **失败语义**：本面**默认关**且是**可选面** ⇒ 起不来**不得**影响插件其余部分
+* （调用方负责 catch；本函数把失败原样抛出，由装配层记日志）。
+*/
+async function startAcpFace(ctx) {
+	const port = readSimpleSettings().acpFacePort;
+	let dshAcp;
+	let wsMod;
+	try {
+		dshAcp = await import("@deepseek-ai/dsh-acp");
+		wsMod = await import("ws");
+	} catch (err) {
+		const msg = String(err?.message ?? err);
+		throw new Error(`面 E 依赖不可用（${msg}）—— 需要宿主提供 @deepseek-ai/dsh-acp，且本插件能 resolve 到 ws`);
+	}
+	if (typeof dshAcp.apply !== "function") throw new Error("面 E：@deepseek-ai/dsh-acp 未导出 apply（版本不匹配？）");
+	const wss = new wsMod.WebSocketServer({ noServer: true });
+	const local = newState();
+	local.wss = wss;
+	const handle = await startFace({
+		name: FACE_ACP,
+		port,
+		host: ACP_HOST,
+		enabled: () => readSimpleSettings().acpFaceEnabled,
+		handler: (_req, res) => {
+			res.writeHead(426, {
+				"content-type": "text/plain; charset=utf-8",
+				"upgrade": "websocket",
+				"cache-control": "no-store"
+			});
+			res.end("This is an ACP (Agent Client Protocol) endpoint over WebSocket. Use an ACP client.\n");
+		}
+	});
+	local.handle = handle;
+	handle.server.on("upgrade", (req, socket, head) => {
+		local.connections += 1;
+		try {
+			wss.handleUpgrade(req, socket, head, (ws) => {
+				try {
+					const stream = wsToAcpStream(ws, (line) => {
+						console.log(`[serenity-hooks] 面 E：丢弃一条非 JSON 帧（前 120 字）: ${line}`);
+					});
+					const fiber = ctx.plugin({
+						inject: ACP_REQUIRED_SERVICES,
+						apply: (scoped) => {
+							const sel = resolveAcpSelection(scoped);
+							dshAcp.apply(scoped, {
+								stream,
+								provider: sel.provider,
+								model: sel.model
+							});
+						}
+					});
+					local.disposers.push(() => {
+						try {
+							fiber?.dispose?.();
+						} catch {}
+					});
+					local.applied += 1;
+				} catch (err) {
+					const msg = String(err?.message ?? err).slice(0, 200);
+					local.lastErrors.push({
+						at: Date.now(),
+						applied: false,
+						error: msg
+					});
+					if (local.lastErrors.length > MAX_ERR_KEEP) local.lastErrors.shift();
+					console.warn(`[serenity-hooks] ✗ 面 E：dsh-acp 接线失败: ${msg}`);
+					try {
+						ws.close(1011, "acp bridge failed");
+					} catch {}
+				}
+			});
+		} catch (err) {
+			console.warn(`[serenity-hooks] ✗ 面 E：WebSocket 握手失败: ${String(err?.message ?? err)}`);
+			try {
+				socket.destroy();
+			} catch {}
+		}
+	});
+	state = local;
+	console.log(`[serenity-hooks] ✓ 面 E（官方 ACP）：ws://${ACP_HOST}:${port}  ⚠️ 协议无认证，靠外部 Access 兜底`);
+	return handle;
+}
+/**
+* 停面 E（幂等）。
+*
+* ⚠️ **与其余各面同款注意**：`stopFace` **不用** `closeAllConnections()`（那会掐断在飞的请求）；
+*  WS 连接由 `wss.close()` 与 socket 自身生命周期收束。
+*/
+function stopAcpFace() {
+	const wss = state.wss;
+	if (wss) try {
+		wss.close();
+	} catch {}
+	state.disposers = [];
+	state.wss = null;
+	state.handle = null;
+	const stopped = stopFace(FACE_ACP);
+	if (stopped) console.log("[serenity-hooks] face acp: 已停止");
+	return stopped;
+}
+/** ACP 会话用的 provider（取 CCC 现有路由；留空 = 由宿主/请求监听器决定） */
+function readAcpProvider() {
+	return process.env.SERENITY_ACP_PROVIDER || void 0;
+}
+/** ACP 会话用的 model（同上） */
+function readAcpModel() {
+	return process.env.SERENITY_ACP_MODEL || void 0;
+}
+/**
+* 解析 ACP 会话该用的 `{provider, model}`。
+*
+* ## 🔴 为什么必须有这个函数（2026-10-16 容器实测抓出的**真缺陷**）
+*
+* 早先我们是**裸传** `provider: readAcpProvider(), model: readAcpModel()` —— 而它们读的是
+* **环境变量**，默认**未设** ⇒ 传下去就是 `undefined`。后果**不是"用默认模型"**：
+* 上游 `dsh-acp` 的 `agentOptions()`（`lib/index.js:1356-1361`）**只在字段非 undefined 时才带上**：
+* ```js
+* ...config.provider !== void 0 ? { provider: config.provider } : {},
+* ...config.model    !== void 0 ? { model: config.model }    : {}
+* ```
+* ⇒ **我们传 undefined，agent 就真的没有模型** ⇒ 第一条 `session/prompt` 必失败，逐字报：
+* `Internal error: turn failed: prompt variable "{{model}}" has no value for this assembly
+*  (section "deployment:persona-prefix")`。
+*
+* ⚠️ **网页端不中招**（它经 `agent-default-model` 层拿到默认值）⇒ **只有 ACP 这条入口坏** ——
+* 也就是说：**手机上第一条消息必然失败，而本机怎么试都正常**。
+* 🔴 这个缺陷 **typecheck ／ 2812 条单测 ／ deploy 预检 全绿**（它是运行时合成形态，
+* 静态面结构性地看不见）⇒ **只有"容器 ＋ 真模型"那一跑能抓到它**。
+*
+* ## 修法 = **读宿主自己的默认模型服务**（不另造真相源）
+*
+* 宿主暴露服务 `ctx.agentDefaultModel.currentSelection()`，其契约逐字写着
+* *"Default model selection for Agents created **without an explicit model**"*
+* （`dsh-agent-default-model/lib/types/index.d.ts`）—— 这正是"没显式指定时该用什么"的**权威出处**。
+* ⇒ 我们只是**把它转交给 ACP**，不引入第二套缺省。
+*
+* 优先级（**显式 > 宿主默认**）：`SERENITY_ACP_PROVIDER/MODEL` 环境变量（调试用）＞ 宿主默认。
+* ⚠️ **一处如实标注的弱化**：这里**不打日志**（每次连接都解析一次，打日志会刷屏）；
+* 若宿主服务缺失，**退回"两个都 undefined"＝旧行为**（即那条已知会失败的形态）——
+* 而不是静默编一个模型。⇒ 副作用是"没有默认模型时仍会失败"，但那**与宿主自身缺配置时的行为一致**。
+*
+* 🔵 **公开导出**（而非模块私有）：它是一个**纯函数 ＋ 有独立契约**的单元（本仓同类先例 =
+* `host/access.ts` 的一组读取器），且**那个真缺陷正是在它这一层**（裸传 undefined）——
+* 回归钉必须能**直接钉住它**，而不是隔着 WS 握手去间接观察（那样测不出"取到了什么"）。
+*/
+function resolveAcpSelection(ctx) {
+	const envProvider = readAcpProvider();
+	const envModel = readAcpModel();
+	if (envProvider && envModel) return {
+		provider: envProvider,
+		model: envModel
+	};
+	try {
+		const sel = hostInjected(ctx, "agentDefaultModel")?.currentSelection?.();
+		if (sel?.provider && sel?.model) return {
+			provider: sel.provider,
+			model: sel.model
+		};
+	} catch {}
+	return {
+		provider: envProvider,
+		model: envModel
+	};
+}
+/**
+* 装配（`index.ts` 的 `apply` 调用）：按**面板/部署键**启停面 E，配置变化热同步。
+*
+* 🔴 **W3 接线**（2026-10-16）：本轮之前 `startAcpFace` 虽已实现却**没有任何调用点**
+* —— 即"面写好了但从不起"。本函数补上它，形式与两个兄弟面一致
+* （`registerWeixinSendApi` ／ `registerDiagramTool`）：
+*
+* ① **反应式**：面板拨开关**只改配置、不重跑 `apply`**（v1.51.1 实测过的那条铁律）
+*    ⇒ 必须监听事件才会"拨了就有反应"；
+* ② 监听**宿主的真事件** `settings/document-updated`（按 ns 过滤），
+*    ⛔ **不监听** `serenity/settings-changed` —— 那个事件**全仓没有任何 `emit` 点**
+*    （＝死通道；见 `registerDiagramTool` 的注释），照它接线等于接了个永远不响的铃；
+* ③ 再挂 `agent/created`／`session/created` 兜底（宿主事件面若换名，至少还有这条能自愈）；
+* ④ 启动时同步一次（`apply` 时按当前配置定初始态）。
+*
+* ⚠️ **失败语义**：本面**默认关**且**依赖可选**（`dsh-acp` 是 peer）⇒ 起不来**只记日志**，
+*    绝不抛出（抛出会让整个插件加载失败，而它只是一个可选面）。
+*/
+function registerAcpFace(ctx) {
+	const sync = () => {
+		if (!acpFaceEnabled()) {
+			if (acpFaceActive()) stopAcpFace();
+			return;
+		}
+		if (acpFaceActive()) return;
+		startAcpFace(ctx).catch((err) => {
+			console.error(`[serenity-hooks] ✗ 面 E（官方 ACP）启动失败: ${String(err?.message ?? err)}`);
+		});
+	};
+	try {
+		ctx.on("settings/document-updated", (ns) => {
+			if (String(ns) === "serenity-hooks") sync();
+		});
+	} catch {}
+	for (const eventName of ["agent/created", "session/created"]) try {
+		ctx.on(eventName, () => {
+			sync();
+		});
+	} catch {}
+	sync();
+}
+//#endregion
 //#region src/seams/lifecycle.ts
 /** 从 Agent / Session / 事件负载中取会话 id（形状宽容：未知结构返回 null） */
 function sessionIdOf(value) {
@@ -24124,6 +24746,10 @@ const Config = z.object({
 	opencodeProvider: z.object({ autoConfigure: z.boolean().default(true) }),
 	visionPatch: z.object({ enabled: z.boolean().default(true) }),
 	diagram: z.object({ enabled: z.boolean().default(false) }),
+	acpFace: z.object({
+		enabled: z.boolean().default(false),
+		port: z.number().min(1024).max(65535).default(ACP_PORT)
+	}),
 	humanChannel: z.object({
 		accounts: z.array(humanChannelAccountSchema).default([]),
 		subscriptions: z.array(humanChannelSubscriptionSchema).default([]),
@@ -24136,7 +24762,9 @@ const Config = z.object({
 	skiffDebugPort: z.number().min(1024).max(65535).volatile(),
 	croEnabled: z.boolean().volatile(),
 	unattendedEnabled: z.boolean().volatile(),
-	diagramEnabled: z.boolean().volatile()
+	diagramEnabled: z.boolean().volatile(),
+	acpFaceEnabled: z.boolean().volatile(),
+	acpFacePort: z.number().min(1024).max(65535).volatile()
 });
 function apply(ctx, config) {
 	try {
@@ -24200,6 +24828,7 @@ function apply(ctx, config) {
 	registerWakeScheduler(ctx);
 	registerWeixinBridge(ctx);
 	registerWeixinSendApi(ctx);
+	registerAcpFace(ctx);
 	registerWeixinOutputGuard(ctx);
 	registerLifecycle(ctx);
 	if (config.webFetch?.enabled !== false) registerWebFetchProvider(ctx);