@shgroup/dsh-serenity-hooks 1.69.1 → 1.69.2

package/README.md

@@ -275,7 +275,8 @@ my-workspace/                     ← 工作区根目录（放一个 .serenity
 
 ### 6.4 对外接入（官方 ACP）
 
-本插件**不自造** ACP 面。要程序化或远程使用，用宿主自带的官方 ACP server：
+**本插件不提供 ACP 面** —— 既不提供当年那种自造 HTTP 面，也不提供跑在 `dsh web` 进程内的
+那一版（后者已在 v1.69.1 整面删除）。要程序化或远程使用，用宿主自带的官方 ACP server：
 
 | 步 | 做什么 |
 |---|---|
@@ -283,8 +284,10 @@ my-workspace/                     ← 工作区根目录（放一个 .serenity
 | 2 | 用任一 ACP 客户端连它（编辑器内直接起子进程；手机/远程经桥 + 隧道） |
 | 3 | **认证放在接入层**（隧道 / 反代 / Cloudflare Access）——官方 server 自身不做认证 |
 
-> **为什么不再自造**：原 3100 面是一个**没有客户端生态**的私有外壳，而官方件已发布并随宿主同版本演进。
-> 详细接法与手机端配置见宁静号 CCC 的接入指南。
+> **为什么不自造**：原 3100 面是一个**没有客户端生态**的私有外壳，而官方件已发布并随宿主同版本演进。
+> **为什么连进程内那版也删掉**：`dsh-acp` 没有 `session/load`，且 `session/resume` 不回放历史
+> ⇒ 客户端每次连上只能新建会话、看不到既有对话。对一个以「长期认知轨迹」为核心的系统，
+> 那是结构性障碍，不是体验问题。⇒ 详见 CHANGELOG 的 v1.69.1。
 
 ### 6.5 认知轨迹与定时唤醒（cognitive trajectory）
 
@@ -345,7 +348,7 @@ my-workspace/                     ← 工作区根目录（放一个 .serenity
 
 | 层 | 位置 | 放什么 |
 |---|---|---|
-| DSH 原生设置 | DSH 的 settings.yaml（即设置面板那几项） | 开关与阈值：网关总开关、重建阈值、子角色开关与调试端口、**CRO 总闸（`croEnabled`，默认为开）**、**图工具总闸（默认关）**、**官方 ACP 面（`acpFaceEnabled`，默认关）** |
+| DSH 原生设置 | DSH 的 settings.yaml（即设置面板那几项） | 开关与阈值：网关总开关、重建阈值、子角色开关与调试端口、**CRO 总闸（`croEnabled`，默认为开）**、**图工具总闸（默认关）** |
 | 插件全局文件 | `~/.dsh/serenity-hooks.json`（权限 0600） | 网关账号（scrypt + TOTP）、监听地址与端口、工作区白名单、cookie 安全开关 |
 | 工作区配置 | `.opencode/serenity.json` | 助手模型白名单、日志阈值、安全模式黑名单、子角色、**认知轨迹级 skill 供给（`cognitiveTrajectory.skills`）**、微信（账号/路由/开关） |
 | 工作区凭据 | `localstore.json` | 密钥与本地偏好；微信机器人 token 也在这一层 |

package/dsh.plugin.json

@@ -1,6 +1,6 @@
 {
   "id": "dsh-serenity-hooks",
-  "version": "1.69.1",
+  "version": "1.69.2",
   "main": "lib/index.js",
   "description": "宁静号 ACC harness（Native Cordis 插件）：给 DSH 装一个「AI 工作区」——14 个工具（container_fs/cognitive_trajectory/dashboard/container_git/msm/praxis/ontology/serenity-skill-creator/cheap-worker/localstore/container_admin；另三个 im-bridge/acc-diag/diagram 按配置条件出现）+ 机械约束（安全模式/工作区围墙/密钥守卫）+ 认知轨迹日志与原地重建 + 网页登录入口/微信桥/子角色/官方 ACP 面/认知轨迹唤醒注册表。适配 DSH 0.1.7-rc.1 / 0.2.0-rc.1 / 0.2.1-rc.1（三档，deepseek-ai/deepseek-harness）。",
   "engines": {

package/lib/{ccc-roots-RMzGU-CJ.js → ccc-roots-RzasspMr.js}

@@ -227,7 +227,7 @@ async function listCccs(ctx, opts = {}) {
 	if (typeof defaultRoot === "string" && defaultRoot !== "" && !c.roots.includes(defaultRoot)) c.roots.unshift(defaultRoot);
 	let rolesOf = null;
 	if (opts.withRoles === true) {
-		const { readSkiffRoles } = await import("./skiff-role-Boc4SKct.js").then((n) => n.d);
+		const { readSkiffRoles } = await import("./skiff-role-cwxAt0gE.js").then((n) => n.d);
 		rolesOf = (root) => [...readSkiffRoles(root).keys()];
 	}
 	return c.roots.map((root) => ({

package/lib/index.js

@@ -1,10 +1,10 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { c as hostInjected, d as hostSessions, f as hostSettings, h as hostWebServer, i as cccRootForExec, l as hostLlm, m as hostWeb, n as agentCwdFor, o as listCccs, p as hostSubagents, r as cccRootForCwd, s as hostAgents, t as NO_CCC_FROM_AGENT_CWD, u as hostService } from "./ccc-roots-RMzGU-CJ.js";
+import { c as hostInjected, d as hostSessions, f as hostSettings, h as hostWebServer, i as cccRootForExec, l as hostLlm, m as hostWeb, n as agentCwdFor, o as listCccs, p as hostSubagents, r as cccRootForCwd, s as hostAgents, t as NO_CCC_FROM_AGENT_CWD, u as hostService } from "./ccc-roots-RzasspMr.js";
 import { _ as resolveInside, a as findSerenityRoot$1, c as matchBlacklist, d as readCccName$1, f as readCheapWorkerConfig, h as readSafeModeHiddenTools, i as findGitRoot, l as pathInside, m as readExclusiveTools, n as SAFE_MODE_MARKER, o as isSafeModeOn, p as readCognitiveTrajectorySkills, r as classifyPath, s as loadSerenityConfig, t as DEFAULT_SERENITY_CONFIG_PATHS, u as readBlacklist } from "./ccc-C33QWoWZ.js";
-import { A as summarize, C as readTrajectoryUid, D as setActiveSessionInfo, E as sessionsRoot, F as localIdStamp, M as isoLocal, N as localFileStamp, O as setTrajectoryUid, P as localHuman, S as readActiveSessionMd, T as sessionEvents$1, _ as getActiveSessionInfo, a as pruneMissingBindings, b as namingTitleFor, c as setBindingStore, d as UID_FILENAME, f as archiveSession, g as findSession, h as extractSessionMdPathFromText, i as listBoundSessionIds, j as useSession, k as showSession, l as COGNITIVE_TRAJECTORY_ACTIONS, m as createSession, n as PLUGIN_SOURCE, o as readLastBound, p as clearActiveSessionInfo, r as appendBound, s as resolveSessionCognitiveTrajectoryLabel, u as DEFAULT_SESSION_SCOPE, v as listActiveTrajectories, w as resolveSessionByTitle, x as parseSessionContextFromEvents, y as listSessions } from "./message-source-Catc7q1z.js";
+import { A as summarize, C as readTrajectoryUid, D as setActiveSessionInfo, E as sessionsRoot, F as localIdStamp, M as isoLocal, N as localFileStamp, O as setTrajectoryUid, P as localHuman, S as readActiveSessionMd, T as sessionEvents$1, _ as getActiveSessionInfo, a as pruneMissingBindings, b as namingTitleFor, c as setBindingStore, d as UID_FILENAME, f as archiveSession, g as findSession, h as extractSessionMdPathFromText, i as listBoundSessionIds, j as useSession, k as showSession, l as COGNITIVE_TRAJECTORY_ACTIONS, m as createSession, n as PLUGIN_SOURCE, o as readLastBound, p as clearActiveSessionInfo, r as appendBound, s as resolveSessionCognitiveTrajectoryLabel, u as DEFAULT_SESSION_SCOPE, v as listActiveTrajectories, w as resolveSessionByTitle, x as parseSessionContextFromEvents, y as listSessions } from "./message-source-DWWECjGB.js";
 import { a as readWeixinCredential, c as weixinInboundDir, d as LOCALSTORE_SCOPES, f as checkLocalstoreGitCompliance, g as runLocalStore, h as readStore, i as matchWeixinRoute, l as weixinSessionIdFor, m as readGitTrack, n as extractWeixinText, o as readWeixinSettings, p as localstorePath, r as hasVoiceItem, s as sanitizeFileName$1, t as extractWeixinMedia } from "./weixin-route-D_DvgPqy.js";
-import { a as GATEWAY_PORT, c as SKIFF_DEBUG_PORT, d as skiffRoleFor$1, f as skiffSessionInfo$1, i as FACE_PORTS, l as WEIXIN_SEND_PORT, m as ACC_VERSION, n as readSimpleSettings, o as MAIN_WEB_PORT, p as unregisterSkiffSession$1, r as registerSettingsSection, s as MECHANISM_PORTS, u as registerSkiffSession$1 } from "./settings-section-DcZPcWPv.js";
-import { a as isSkiffSessionId, c as resolveSkiffKind, f as systemPromptSource, i as createRolePromptReader, l as roleMsmWhitelist, n as buildSkiffBasePrompt, o as readSkiffRoles, r as cognitiveTrajectorySubset, s as resolveRoleSystemPrompt, u as roleToolWhitelist } from "./skiff-role-Boc4SKct.js";
+import { a as GATEWAY_PORT, c as SKIFF_DEBUG_PORT, d as skiffRoleFor$1, f as skiffSessionInfo$1, i as FACE_PORTS, l as WEIXIN_SEND_PORT, m as ACC_VERSION, n as readSimpleSettings, o as MAIN_WEB_PORT, p as unregisterSkiffSession$1, r as registerSettingsSection, s as MECHANISM_PORTS, u as registerSkiffSession$1 } from "./settings-section-0TPYWug9.js";
+import { a as isSkiffSessionId, c as resolveSkiffKind, f as systemPromptSource, i as createRolePromptReader, l as roleMsmWhitelist, n as buildSkiffBasePrompt, o as readSkiffRoles, r as cognitiveTrajectorySubset, s as resolveRoleSystemPrompt, u as roleToolWhitelist } from "./skiff-role-cwxAt0gE.js";
 import { REGISTERED_TOOLS } from "./invariant.js";
 import { a as markdownToPlainText, c as sendTyping, i as getUpdates, l as sniffImageExt, n as downloadMedia, o as sendFileMessage, r as getConfig, s as sendTextMessage, t as TypingStatus } from "./weixin-api-BrRcPiQs.js";
 import { createRequire } from "node:module";
@@ -3968,10 +3968,31 @@ async function createSkiffAgent(ctx, root, roleName, role, defaultModel, session
 		console.warn(`[serenity-hooks] skiff 角色 "${roleName}" 专属 SESSION 处理失败（不影响 agent 创建）: ${String(err?.message ?? err)}`);
 	}
 	try {
+		let readerPath = role?.systemPromptFile?.trim();
+		let reader = rolePrompt;
+		const liveRolePrompt = () => {
+			let live = role;
+			try {
+				const fresh = readSkiffRoles(root).get(roleName);
+				if (fresh) live = fresh;
+			} catch {}
+			const wantPath = live?.systemPromptFile?.trim();
+			if (wantPath !== readerPath) {
+				reader = kind === "persistent" ? createRolePromptReader(root, live) : (() => {
+					let snapshot = "";
+					try {
+						snapshot = resolveRoleSystemPrompt(root, live);
+					} catch {}
+					return () => snapshot;
+				})();
+				readerPath = wantPath;
+			}
+			return reader();
+		};
 		agent.ctx.systemPrompt.section({
 			name: "serenity-skiff",
 			order: -60,
-			text: () => [buildSkiffBasePrompt(roleName, role), rolePrompt()].filter(Boolean).join("\n")
+			text: () => [buildSkiffBasePrompt(roleName), liveRolePrompt()].filter(Boolean).join("\n")
 		});
 	} catch (err) {
 		console.warn(`[serenity-hooks] skiff 系统提示词注册失败: ${String(err?.message ?? err)}`);
@@ -15404,7 +15425,7 @@ function registerStatusApi(ctx, opts = {}) {
 						return;
 					}
 					const { saveWeixinRoutes } = await import("./weixin-route-D_DvgPqy.js").then((n) => n.u);
-					const { readSkiffRoles } = await import("./skiff-role-Boc4SKct.js").then((n) => n.d);
+					const { readSkiffRoles } = await import("./skiff-role-cwxAt0gE.js").then((n) => n.d);
 					const roles = readSkiffRoles(root);
 					for (const r of routes) if (!roles.has(r.role)) {
 						sendJson$3(res, 400, { error: `unknown role: ${r.role} (not in ${root} skiff.roles)` });
@@ -20763,7 +20784,7 @@ function manualOutputFallbackNeeded(input) {
 */
 async function resolveCccRootByAlias(ctx, alias) {
 	try {
-		const { listCccs } = await import("./ccc-roots-RMzGU-CJ.js").then((n) => n.a);
+		const { listCccs } = await import("./ccc-roots-RzasspMr.js").then((n) => n.a);
 		const entries = await listCccs(ctx);
 		const byName = entries.find((e) => e.name === alias);
 		if (byName) return byName.root;
@@ -21262,7 +21283,7 @@ function syncHumanChannel(ctx) {
 	(async () => {
 		try {
 			stopMachineLoops();
-			const { listCccs } = await import("./ccc-roots-RMzGU-CJ.js").then((n) => n.a);
+			const { listCccs } = await import("./ccc-roots-RzasspMr.js").then((n) => n.a);
 			for (const entry of await listCccs(ctx)) syncCccBridge(ctx, entry.root);
 		} catch {}
 	})();
@@ -21498,7 +21519,7 @@ function matchCcc(input, candidates) {
 }
 /** 组装候选列表（`ccc-roots.listCccs` 投影 + `.serenity` 名；动态 import 保持本模块静态依赖轻量） */
 async function collectCandidates(ctx) {
-	const { listCccs } = await import("./ccc-roots-RMzGU-CJ.js").then((n) => n.a);
+	const { listCccs } = await import("./ccc-roots-RzasspMr.js").then((n) => n.a);
 	const entries = await listCccs(ctx, { defaultRoot: process.cwd() });
 	const seen = /* @__PURE__ */ new Set();
 	const out = [];

package/lib/{message-source-Catc7q1z.js → message-source-DWWECjGB.js}

@@ -1,4 +1,4 @@
-import { r as cccRootForCwd } from "./ccc-roots-RMzGU-CJ.js";
+import { r as cccRootForCwd } from "./ccc-roots-RzasspMr.js";
 import { basename, dirname, join } from "node:path";
 import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 //#region src/time.ts

package/lib/{settings-section-DcZPcWPv.js → settings-section-0TPYWug9.js}

@@ -1,4 +1,4 @@
-import { f as hostSettings } from "./ccc-roots-RMzGU-CJ.js";
+import { f as hostSettings } from "./ccc-roots-RzasspMr.js";
 import { dirname, join } from "node:path";
 import { readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";

package/lib/{skiff-role-Boc4SKct.js → skiff-role-cwxAt0gE.js}

@@ -166,25 +166,38 @@ function createRolePromptReader(root, role) {
 	};
 }
 /**
-* Skiff 基础提示词（dsp 只给这部分；CCC 的 systemPrompt 段由调用方拼接）：
-* 身份 + 可用 MSM/工具清单 + 调用协议 + 边界声明。动态生成（清单来自角色白名单）。
+* Skiff 基础提示词（dsp 只给这部分；CCC 的 systemPrompt 段由调用方拼接）。
+*
+* ## 🔴 为什么**不再枚举**清单（owner 2026-10-19 令）
+*
+* 旧版在这里抄了两份清单（`MSMs: a, b, c` / `Tools: read, grep, …`）。那是**第二真相源**，
+* 而真相源本来就在模型自己手里：
+*   · **工具清单** = 这一轮实际注册给它的 tool schema —— 模型已经看得见，抄一遍只会漂
+*   · **MSM 清单** = `msm()` 无参调用返回的目录 —— 已按角色白名单过滤，且**每次实时读配置**
+*
+* ⚠️ **漂移不是理论风险，是已发生的缺陷**（2026-10-19）：角色配置早就长到 8 个工具，
+* 而这个函数是从**创建时冻结的 role 快照**求值的 ⇒ 提示词里一直写着旧的 4 个
+* ⇒ 模型照着提示词办事，**它自己以为没有的能力就不去调** ⇒ 症状是"工具用不了"，
+* 而守卫那边（每调用实时读配置）其实是放行的。两个真相源打架，输的总是提示词。
+*
+* ⇒ 现在只声明**边界与发现路径**，不抄内容：清单在哪，怎么取，越界会怎样。
+*
+* @param roleName 角色名（CCC 定义；用于身份声明）
 */
-function buildSkiffBasePrompt(roleName, role) {
-	const msms = role?.msms ?? [];
-	const tools = role?.tools ?? [];
-	const lines = [
+function buildSkiffBasePrompt(roleName) {
+	return [
 		"=== Serenity Skiff ===",
 		`Role: ${roleName} (defined by this CCC)`,
-		"You interact with this CCC ONLY through the exposed surface below:"
-	];
-	if (msms.length > 0) lines.push(`  MSMs: ${msms.join(", ")} (call msm("<name>", ["<args>"]) ; pass inspect=true or "--help" as first arg for usage)`);
-	else lines.push("  MSMs: (none)");
-	lines.push(`  Tools: ${tools.length > 0 ? tools.join(", ") : "(none)"}`);
-	lines.push("No other tools are available. Your capability boundary is this surface.");
-	lines.push("");
-	lines.push("---");
-	lines.push("");
-	return lines.join("\n");
+		"Your capability boundary is enforced mechanically by this CCC — anything outside it is rejected at the call site, not by your judgment.",
+		"Discover your surface, do not memorize it (both are generated from the live config on every turn):",
+		"  · Your tools are exactly the tool schemas you see in this session — if a tool is not in your schema, it is not available.",
+		"  · Your MSMs are listed by calling msm() with no arguments — that directory is already filtered to this role.",
+		"  · Usage for any MSM: msm(\"<name>\", [], inspect=true) or pass \"--help\" as the first argument.",
+		"Do not infer unavailability from anything you remember or from an earlier list: this surface changes when the CCC configuration changes, and it takes effect without restarting.",
+		"",
+		"---",
+		""
+	].join("\n");
 }
 //#endregion
 export { isSkiffSessionId as a, resolveSkiffKind as c, skiff_role_exports as d, systemPromptSource as f, createRolePromptReader as i, roleMsmWhitelist as l, buildSkiffBasePrompt as n, readSkiffRoles as o, cognitiveTrajectorySubset as r, resolveRoleSystemPrompt as s, SKIFF_SESSION_PREFIX as t, roleToolWhitelist as u };

package/lib/skiff-role.d.ts

@@ -68,7 +68,22 @@ export declare function resolveSkiffKind(role: SkiffRoleConfig | undefined, hasS
  */
 export declare function createRolePromptReader(root: string, role: SkiffRoleConfig | undefined): () => string;
 /**
- * Skiff 基础提示词（dsp 只给这部分；CCC 的 systemPrompt 段由调用方拼接）：
- * 身份 + 可用 MSM/工具清单 + 调用协议 + 边界声明。动态生成（清单来自角色白名单）。
+ * Skiff 基础提示词（dsp 只给这部分；CCC 的 systemPrompt 段由调用方拼接）。
+ *
+ * ## 🔴 为什么**不再枚举**清单（owner 2026-10-19 令）
+ *
+ * 旧版在这里抄了两份清单（`MSMs: a, b, c` / `Tools: read, grep, …`）。那是**第二真相源**，
+ * 而真相源本来就在模型自己手里：
+ *   · **工具清单** = 这一轮实际注册给它的 tool schema —— 模型已经看得见，抄一遍只会漂
+ *   · **MSM 清单** = `msm()` 无参调用返回的目录 —— 已按角色白名单过滤，且**每次实时读配置**
+ *
+ * ⚠️ **漂移不是理论风险，是已发生的缺陷**（2026-10-19）：角色配置早就长到 8 个工具，
+ * 而这个函数是从**创建时冻结的 role 快照**求值的 ⇒ 提示词里一直写着旧的 4 个
+ * ⇒ 模型照着提示词办事，**它自己以为没有的能力就不去调** ⇒ 症状是"工具用不了"，
+ * 而守卫那边（每调用实时读配置）其实是放行的。两个真相源打架，输的总是提示词。
+ *
+ * ⇒ 现在只声明**边界与发现路径**，不抄内容：清单在哪，怎么取，越界会怎样。
+ *
+ * @param roleName 角色名（CCC 定义；用于身份声明）
  */
-export declare function buildSkiffBasePrompt(roleName: string, role: SkiffRoleConfig | undefined): string;
+export declare function buildSkiffBasePrompt(roleName: string): string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shgroup/dsh-serenity-hooks",
-  "version": "1.69.1",
+  "version": "1.69.2",
   "description": "宁静号 ACC harness（Native Cordis 插件）——给 DeepSeek Harness 装一个「AI 工作区」：14 个工具（container_fs/cognitive_trajectory/dashboard/container_git/msm/praxis/ontology/serenity-skill-creator/cheap-worker/localstore/container_admin；另三个 im-bridge/acc-diag/diagram 按配置条件出现）+ 机械约束（安全模式/工作区围墙/密钥守卫/对外输出守卫）+ 认知轨迹日志与原地重建 + 网页登录入口/微信桥/子角色/官方 ACP 面/认知轨迹唤醒注册表。适配 DSH 0.1.7-rc.1 / 0.2.0-rc.1 / 0.2.1-rc.1（三档）。",
   "license": "MIT",
   "repository": {