@shgroup/dsh-serenity-hooks 1.79.5 → 1.81.0

package/dsh.plugin.json

@@ -1,6 +1,6 @@
 {
   "id": "dsh-serenity-hooks",
-  "version": "1.79.5",
+  "version": "1.81.0",
   "main": "lib/index.js",
   "description": "宁静号 ACC harness（Native Cordis 插件）：给 DSH 装一个「AI 工作区」——14 个工具（container_fs/cognitive_trajectory/dashboard/container_git/msm/praxis/ontology/serenity-skill-creator/cheap-worker/localstore/container_admin；另三个 im-bridge/acc-diag/diagram 按配置条件出现）+ 机械约束（安全模式/工作区围墙/密钥守卫）+ 认知轨迹日志与原地重建 + 网页登录入口/IM 桥/认知轨迹唤醒注册表。轨迹声明 = 轨迹目录下的 trajectory.json（约束面 + 旧标识 uid + CRO 机器绑定 cro.host；旧名 trajectory-constraint.json / skiff.json 仍在读取族里）；轨迹提示词 = 轨迹目录下的 PROMPT.md（一条轨迹「是谁、按什么章程工作」，所有轨迹通用，追加在容器层与质量层之后，不替换它们）。适配 DSH 0.1.7-rc.1 / 0.2.0-rc.1 / 0.2.1-rc.1（三档，deepseek-ai/deepseek-harness）。",
   "engines": {

package/lib/{ccc-roots-DAwz9Li1.js → ccc-roots-4LwGLCXa.js}

@@ -227,7 +227,7 @@ async function listCccs(ctx, opts = {}) {
 	if (typeof defaultRoot === "string" && defaultRoot !== "" && !c.roots.includes(defaultRoot)) c.roots.unshift(defaultRoot);
 	let rolesOf = null;
 	if (opts.withRoles === true) {
-		const { listTrajectoryConstraints } = await import("./profile-5TQ_C1xi.js").then((n) => n.i);
+		const { listTrajectoryConstraints } = await import("./profile-CiRWh2a2.js").then((n) => n.i);
 		rolesOf = (root) => {
 			try {
 				return listTrajectoryConstraints(root).map((p) => p.code);

package/lib/index.js

@@ -1,12 +1,12 @@
 import { i as __toESM, n as __exportAll } from "./rolldown-runtime-B4iAMlE-.js";
-import { c as hostInjected, d as hostSessions, f as hostSettings, h as hostWebServer, i as cccRootForExec, l as hostLlm, m as hostWeb, n as agentCwdFor, o as listCccs, p as hostSubagents, r as cccRootForCwd, s as hostAgents, t as NO_CCC_FROM_AGENT_CWD, u as hostService } from "./ccc-roots-DAwz9Li1.js";
+import { c as hostInjected, d as hostSessions, f as hostSettings, h as hostWebServer, i as cccRootForExec, l as hostLlm, m as hostWeb, n as agentCwdFor, o as listCccs, p as hostSubagents, r as cccRootForCwd, s as hostAgents, t as NO_CCC_FROM_AGENT_CWD, u as hostService } from "./ccc-roots-4LwGLCXa.js";
 import { _ as resolveInside, a as findSerenityRoot$1, c as matchBlacklist, d as readCccName$1, f as readCheapWorkerConfig, h as readSafeModeHiddenTools, i as findGitRoot, l as pathInside, m as readExclusiveTools, n as SAFE_MODE_MARKER, o as isSafeModeOn, r as classifyPath, s as loadSerenityConfig, t as DEFAULT_SERENITY_CONFIG_PATHS, u as readBlacklist } from "./ccc-CyYJL4F2.js";
-import { A as sessionEvents, B as isoLocal, C as listSessions, E as parseTrajectoryCode, F as trajectoryDescOf, H as localHuman, I as useSession, L as TRAJECTORY_FILENAME, M as setActiveSessionInfo, N as showSession, O as readTrajectoryUid, P as summarize, R as TRAJECTORY_LEGACY_FILENAMES, S as listActiveTrajectories, T as parseSessionContextFromEvents, U as localIdStamp, V as localFileStamp, _ as createSession, a as readTrajectoryConstraintAt, b as getActiveSessionInfo, c as trajectoryConstraintForSession, f as COGNITIVE_TRAJECTORY_ACTIONS, g as clearActiveSessionInfo, h as archiveSession, j as sessionsRoot, k as resolveSessionByTitle, m as UID_FILENAME, n as isTrajectoryConstrained, o as readTrajectoryConstraintByCode, r as listTrajectoryConstraints, s as replacesDefaultIdentity, t as TRAJECTORY_CONSTRAINT_FILENAME, v as extractSessionMdPathFromText, w as namingTitleFor, y as findSession, z as readTrajectoryFile } from "./profile-5TQ_C1xi.js";
+import { A as sessionEvents, B as isoLocal, C as listSessions, E as parseTrajectoryCode, F as trajectoryDescOf, H as localHuman, I as useSession, L as TRAJECTORY_FILENAME, M as setActiveSessionInfo, N as showSession, O as readTrajectoryUid, P as summarize, R as TRAJECTORY_LEGACY_FILENAMES, S as listActiveTrajectories, T as parseSessionContextFromEvents, U as localIdStamp, V as localFileStamp, _ as createSession, a as readTrajectoryConstraintAt, b as getActiveSessionInfo, c as trajectoryConstraintForSession, f as COGNITIVE_TRAJECTORY_ACTIONS, g as clearActiveSessionInfo, h as archiveSession, j as sessionsRoot, k as resolveSessionByTitle, m as UID_FILENAME, n as isTrajectoryConstrained, o as readTrajectoryConstraintByCode, r as listTrajectoryConstraints, s as replacesDefaultIdentity, t as TRAJECTORY_CONSTRAINT_FILENAME, v as extractSessionMdPathFromText, w as namingTitleFor, y as findSession, z as readTrajectoryFile } from "./profile-CiRWh2a2.js";
 import { n as checkLocalstoreGitCompliance, o as readStore, s as runLocalStore, t as LOCALSTORE_SCOPES } from "./service-DDmHSglV.js";
-import { _ as ACC_VERSION, a as listBoundSessionIds, d as constraintCognitiveTrajectory, f as constraintSystemPromptSource, g as resolveConstraintSystemPrompt, h as profileToolWhitelist, i as carrierState, l as TRAJECTORY_CONSTRAINT_HINT, n as PLUGIN_SOURCE, o as readLastBound, r as appendBound, s as resolveSessionCognitiveTrajectoryLabel, t as ACC_MESSAGE_KIND, v as findPackageRoot } from "./message-source-DiP3Uve3.js";
-import { A as buildResourceIndex, C as verifyPassword, D as recordToolUsage, E as verifyTotpCode, F as hasTrajectoryPrompt, M as isSafeSkillName, N as truncateContent, O as REFERENCE_DIR, P as TRAJECTORY_PROMPT_FILENAME, S as toWire, T as MECHANISM_PORTS, _ as registerEntrySkillSectionGlobal, a as trajectoryConstraintFor, b as projectKnownWorkspaces, c as trajectoryWorkspaceMdPath, d as CHEAP_WORKER_GUIDE, f as providerAvailabilityError, g as registerEntrySkillSection, h as registerCognitiveTrajectorySkillSection, i as getTrajectoryAgent, j as buildResourceNameSuffix, k as SKILL_ONTOLOGY_FILE, l as unregisterTrajectorySession, m as splitModel, n as createTrajectoryAgent, o as trajectoryConstraintMsmGate, p as requireWhitelistedModel, r as ensureWorkspacePromptSection, s as trajectoryConstraintParticipates, t as askTrajectory, u as workspaceCognitiveTrajectoryLine, v as applyWirePatch, w as FACE_PORTS, x as readAdvancedSettings, y as migrateLegacyLocalstore } from "./session-tdlJDS9i.js";
+import { _ as resolveConstraintSystemPrompt, a as listBoundSessionIds, d as constraintCognitiveTrajectory, f as constraintSystemPromptSource, g as profileWriteWhitelist, h as profileToolWhitelist, i as carrierState, l as TRAJECTORY_CONSTRAINT_HINT, n as PLUGIN_SOURCE, o as readLastBound, r as appendBound, s as resolveSessionCognitiveTrajectoryLabel, t as ACC_MESSAGE_KIND, v as ACC_VERSION, y as findPackageRoot } from "./message-source-CfqdGIi2.js";
+import { A as buildResourceIndex, C as verifyPassword, D as recordToolUsage, E as verifyTotpCode, F as hasTrajectoryPrompt, M as isSafeSkillName, N as truncateContent, O as REFERENCE_DIR, P as TRAJECTORY_PROMPT_FILENAME, S as toWire, T as MECHANISM_PORTS, _ as registerEntrySkillSectionGlobal, a as trajectoryConstraintFor, b as projectKnownWorkspaces, c as trajectoryWorkspaceMdPath, d as CHEAP_WORKER_GUIDE, f as providerAvailabilityError, g as registerEntrySkillSection, h as registerCognitiveTrajectorySkillSection, i as getTrajectoryAgent, j as buildResourceNameSuffix, k as SKILL_ONTOLOGY_FILE, l as unregisterTrajectorySession, m as splitModel, n as createTrajectoryAgent, o as trajectoryConstraintMsmGate, p as requireWhitelistedModel, r as ensureWorkspacePromptSection, s as trajectoryConstraintParticipates, t as askTrajectory, u as workspaceCognitiveTrajectoryLine, v as applyWirePatch, w as FACE_PORTS, x as readAdvancedSettings, y as migrateLegacyLocalstore } from "./session-KBRbYb52.js";
 import { n as hasSessionLogById, r as sessionsRootDir } from "./cleanup-C-92qnDs.js";
-import { n as readSimpleSettings, r as registerSettingsSection } from "./settings-B-vn8j4g.js";
+import { n as readSimpleSettings, r as registerSettingsSection } from "./settings-Dj4_ppTC.js";
 import { REGISTERED_TOOLS } from "./invariant.js";
 import { a as readFeishuCredential, d as weixinSessionIdForTrajectory, i as matchWeixinRoute, l as sanitizeFileName$1, n as extractWeixinText, o as readWeixinCredential, r as hasVoiceItem, s as readWeixinSettings, t as extractWeixinMedia, u as weixinInboundDir } from "./route-Dr0SFD8A.js";
 import { c as sendTextMessage, i as getUpdates, l as sendTyping, n as downloadMedia, o as markdownToPlainText, r as getConfig, s as sendFileMessage, t as TypingStatus, u as sniffImageExt } from "./ilink-BMk2w2KY.js";
@@ -10727,6 +10727,7 @@ becomes a 轨迹约束; delete it and it goes back to being an ordinary trajecto
     "model": "provider/model",          // optional; **不写 = 用会话当前模型**（不回退 cheap-worker；每轮生效）
     "tools": ["read","grep","msm",...], // optional; **不写 = 不收窄**。显式 [] = 全隐藏（除 skill）
     "msms":  ["msm-a","msm-b"],         // optional; **不写 = 不收窄**。register/deregister 恒拒
+    "writes": ["AGENT_SESSIONS/<我的目录>/"], // optional; **不写 = 不收窄**。显式 [] = 一个写都落不下
     "cognitiveTrajectory": { "session": true, "keeper": true, "rebuild": true },  // 缺省 TRUE（见下）
     "resident": { "serves": "..." },    // optional; 对外用途自述（见 trajectory-self 章）
     "cro": { "host": "<machine name>" } // optional: which machine may run this trajectory's CRO program
@@ -10752,6 +10753,20 @@ becomes a 轨迹约束; delete it and it goes back to being an ordinary trajecto
   🔴 判据是**字段在不在**，不是**数组空不空**（D181）。旧版把两者混成"空 = 全拒"，
      于是「只想声明常驻」的人被静默锁死 —— 那是本仓实测踩过的坑（D179(b)）。
 
+── \`writes\`: the THIRD whitelist — the PATH dimension（owner 2026-10-20 令）──
+  \`tools\` 管的是**工具名**，管不了"这个工具能写哪儿"：给了 \`write\` 之后，路径守卫只拦
+  「逃出 CCC」与黑名单，**拦不住它去写别人的轨迹或 docs/**。\`writes\` 补的正是这一维。
+
+  - **不写** ⇒ 不收窄（写权限 = 路径守卫那几条，与之前完全一致）
+  - \`"writes": []\` ⇒ **一个写都落不下**（显式意图；只影响写，不影响读）
+  - \`"writes": ["AGENT_SESSIONS/<我的目录>/", "_tmp/"]\` ⇒ 写类工具的**目标路径**必须落在这些前缀内
+  - 条目可以是**相对 CCC 根**的路径，也可以是绝对路径；判定按"目标在这个目录之内（含自身）"
+  - 只管**写类**工具（\`write\` / \`edit\` / \`container_fs\` 的写动作 / \`append\` / \`touch\`），**读不受影响**
+  - 越界拒绝时**会指名允许的前缀与当前目标**（D186：不许不出声；出声必须指对路）
+
+  ⇒ 典型用法（两条 IM 轨迹）：给 \`write\`/\`edit\` 写自己的身体，同时把写面收窄到自己那一格：
+     \`"tools": ["read","write","edit",...], "writes": ["AGENT_SESSIONS/<code 目录>/"]\`
+
 ── cognitiveTrajectory: why the defaults are TRUE ──
   The workspace of a 轨迹约束 is its own SESSION.md. Setting these to false would cut it off from
   its own body, so \`session\`/\`keeper\`/\`rebuild\` all default to true. Set false explicitly only
@@ -10792,6 +10807,11 @@ function validateTrajectoryConstraint(root) {
 			}
 		})())) issues.push(`trajectory "${p.code}": no trajectory prompt (add ${TRAJECTORY_PROMPT_FILENAME} in the trajectory dir — recommended — or the legacy systemPromptFile/systemPrompt)`);
 		for (const m of p.msms ?? []) if (!registered.has(m)) issues.push(`trajectory "${p.code}": msms "${m}" is not registered in mech-registry.json`);
+		for (const w of p.writes ?? []) try {
+			resolveInside(root, w);
+		} catch (err) {
+			issues.push(`trajectory "${p.code}": writes "${w}" is outside the CCC root (${String(err?.message ?? err)}) — a write prefix outside the container can never match; use a path relative to the CCC root`);
+		}
 		if (p.model && allowedModels && !allowedModels.has(p.model)) issues.push(`trajectory "${p.code}": model "${p.model}" not in cheap-worker.models (${[...allowedModels].join(", ") || "(none)"})`);
 	}
 	return {
@@ -10824,6 +10844,7 @@ function listTrajectoryConstraintSummary(root) {
 			model: p.model ?? "(unchanged)",
 			msms: wl(p.msms, "(unrestricted)"),
 			tools: wl(p.tools, "(unrestricted)"),
+			writes: wl(p.writes, "(unrestricted)"),
 			...p.resident !== void 0 ? { resident: p.resident.serves !== void 0 ? p.resident.serves : "(no serves)" } : {},
 			cognitiveTrajectory: constraintCognitiveTrajectory(p),
 			promptSource: constraintSystemPromptSource(p, hasTrajectoryPrompt(root, p.dirName)),
@@ -10892,6 +10913,34 @@ const TRAJECTORY_SELF_GUIDE = [
   ⚠️ 与 SESSION.md 的分工（别写重了）：
      SESSION.md = **发生了什么**（日志、决策、当前状态）
      PROMPT.md  = **我是谁、怎么工作**（章程；很少改，改了就改变行为）`,
+	"",
+	`── 我的章程怎么进来：追加（缺省）还是替换 ──
+
+  \`trajectory.json\` 的 \`prompt\` 段（**不写它 = 追加**，既有行为逐字不变）：
+
+  \`\`\`jsonc
+  {
+    "prompt": {
+      "injection": "replace",                       // append（缺省）| replace
+      "replaces": ["metaphor", "principles", "cce", "eap"]   // 可选；不写 = 四块全换
+    }
+  }
+  \`\`\`
+
+  | 模式 | 结果 |
+  |---|---|
+  | \`append\`（缺省） | 宁静号各块照常注入，我的 \`PROMPT.md\` **追加**在它们之后 |
+  | \`replace\` | 我点名的**约束块**不再注入，我的 \`PROMPT.md\` **站到它们原来的位置**（紧跟身份块） |
+
+  可替换的四块：\`metaphor\`（世界模型）／\`principles\`（信念与边界）／\`cce\`（连续性纪律）／\`eap\`（输出标准）。
+  🔴 **身份块（\`=== Serenity ACC ===\`）不可替换** —— 它回答"我在哪儿工作"，不是"按什么章法工作"；
+  写进去会被丢弃并指名告警。
+
+  🔴 **两条硬前提**（缺一即**降级回 append** 并告警，绝不静默）：
+  ① \`replace\` 需要**真的有一份 \`PROMPT.md\`** —— 没有替代物的替换 = 静默清空纪律；
+  ② \`append\` 下写 \`replaces\` 不生效（会告诉你，别以为它管用）。
+
+  ⚠️ 想表达"我一块都不想换" ⇒ 写 \`"replaces": []\`（显式空数组），它**不等于**不写（不写 = 四块全换）。`,
 	"",
 	`── 常驻：自己声明"欢迎别人来麻烦我"（trajectory.json 的 resident 字段）──
 
@@ -10927,9 +10976,11 @@ const TRAJECTORY_SELF_GUIDE = [
   | \`model\` | 用会话当前的模型（**不会**回退到 cheap-worker） | **每轮**（改文件下一轮即生效） |
   | \`tools\` | **不收窄**工具面 | 每轮 |
   | \`msms\` | **不收窄** MSM 面 | 每轮 |
+  | \`writes\` | **不收窄**写路径（写权限 = 路径守卫那几条） | 每轮 |
   | \`resident\` | 不出现在常驻名单里（不参与"被找"） | 每轮 |
   | \`cognitiveTrajectory\` | 三项纪律全参与（true） | 每轮 |
   | \`systemPromptFile\` / \`systemPrompt\` | 用 ACC 的通用身份（**不替换**） | 保存即生效 |
+  | \`prompt\` | 追加模式：宁静号各块照常注入，章程排在它们之后 | **每轮**（改文件下一轮即生效） |
 
   🔴 **"没写" 与 "写了空数组" 是两种意思**：
       \`"tools": []\`（显式空数组）= **我一个都不给** ⇒ 除 \`skill\` 外全部工具被隐藏。
@@ -10937,8 +10988,10 @@ const TRAJECTORY_SELF_GUIDE = [
       ⇒ 想只声明常驻？那就**只写 resident**，别的键一个都不要写。
 
   🔴 **写 \`trajectory.json\` 本身不改任何默认行为** —— 它只是"我把设定放这儿了"。
-      只有当某个 key **真的取代了默认**（目前唯一一个是自带章程 systemPrompt*）时，
-      这条轨迹才不再注入 ACC 身份。其余字段都不影响。`,
+      只有当某个 key **真的取代了默认**时才改变装配，目前只有两处：
+      ① 自带章程 \`systemPromptFile\` / \`systemPrompt\`（取代 ACC 身份）；
+      ② \`prompt.injection = "replace"\`（**只**取代四个约束块，**不动**身份块）。
+      其余字段都不影响。`,
 	"",
 	`── 想限制自己（白名单 / 模型 / 纪律参与项）──
 
@@ -10947,7 +11000,9 @@ const TRAJECTORY_SELF_GUIDE = [
 	`── 写完之后怎么验（别只看文档，要能机械判定）──
 
   章程生效了吗    改 PROMPT.md 后**在同一会话里**看下一轮的系统提示词段是否变化（保存即生效）
-  我声明了什么    container_admin config list  —— 逐轨迹列出 model/tools/msms 的**生效值**；
+  注入模式生效了吗 改 trajectory.json 的 prompt 段后，**同一会话下一轮**：replace 下四块消失、
+                  我的章程紧跟身份块；⛔ 不需要重启（这两者都是每轮现读）
+  我声明了什么    container_admin config list  —— 逐轨迹列出 model/tools/msms/writes 的**生效值**；
                   没写的字段印 \`(unchanged)\` / \`(unrestricted)\`，不是伪装成某个默认值
   配置合法吗      container_admin config validate  —— msms 均已注册 / model 在可用表里
   常驻被看见了吗  cognitive_trajectory action=resident —— 我出现在名单里，且 serves 可读
@@ -11532,6 +11587,14 @@ function decideGuard(input) {
 			deny: "tool not allowed in this 轨迹约束 trajectory",
 			kind: "deny"
 		};
+		const writeScopes = profileWriteWhitelist(profile);
+		if (writeScopes !== null && pathArg !== void 0 && isWriteTool(toolName, action)) {
+			const abs = resolve(root, pathArg);
+			if (!writeScopes.some((scope) => pathInside(resolve(root, scope), abs))) return {
+				deny: `${toolName}: write outside this trajectory's declared write scope (allowed: ${writeScopes.length > 0 ? writeScopes.join(" / ") : "(none — \"writes\" is an empty array)"}); target: ${pathArg} — add the prefix to this trajectory's trajectory.json "writes" if the write is intended`,
+				kind: "deny"
+			};
+		}
 	}
 	if (safeModeOn && toolName === "bash") return {
 		deny: `bash: no such tool`,
@@ -14085,7 +14148,7 @@ function registerStatusApi(ctx, opts = {}) {
 						});
 					}
 					const { saveWeixinRoutes } = await import("./route-Dr0SFD8A.js").then((n) => n.c);
-					const { findDirNameByCode } = await import("./profile-5TQ_C1xi.js").then((n) => n.i);
+					const { findDirNameByCode } = await import("./profile-CiRWh2a2.js").then((n) => n.i);
 					for (const r of routes) if (findDirNameByCode(root, r.trajectory) === null) {
 						sendJson$2(res, 400, { error: `unknown trajectory: ${r.trajectory} (no such trajectory code in ${root})` });
 						return;
@@ -19082,7 +19145,7 @@ const MEDIA_MAX_BYTES = 20971520;
 */
 async function resolveCccRootByAlias(ctx, alias) {
 	try {
-		const { listCccs } = await import("./ccc-roots-DAwz9Li1.js").then((n) => n.a);
+		const { listCccs } = await import("./ccc-roots-4LwGLCXa.js").then((n) => n.a);
 		const entries = await listCccs(ctx);
 		const byName = entries.find((e) => e.name === alias);
 		if (byName) return byName.root;
@@ -19150,7 +19213,7 @@ async function resolveInboundTarget(ctx, input) {
 		});
 		return null;
 	}
-	const { findDirNameByCode } = await import("./profile-5TQ_C1xi.js").then((n) => n.i);
+	const { findDirNameByCode } = await import("./profile-CiRWh2a2.js").then((n) => n.i);
 	if (findDirNameByCode(root, target.role) === null) {
 		const detail = `目标 CCC "${target.ccc}" 内没有编码为 "${target.role}" 的认知轨迹`;
 		console.error(`[serenity-hooks] ✗ human-channel: ${detail}（account=${input.account} user=${input.user}）—— 该消息**未投递**，请改订阅表里的目标编码`);
@@ -19990,7 +20053,7 @@ function syncHumanChannel(ctx) {
 	(async () => {
 		try {
 			stopMachineLoops();
-			const { listCccs } = await import("./ccc-roots-DAwz9Li1.js").then((n) => n.a);
+			const { listCccs } = await import("./ccc-roots-4LwGLCXa.js").then((n) => n.a);
 			for (const entry of await listCccs(ctx)) syncCccBridge(ctx, entry.root);
 		} catch {}
 	})();
@@ -20254,7 +20317,7 @@ function matchCcc(input, candidates) {
 }
 /** 组装候选列表（`ccc-roots.listCccs` 投影 + `.serenity` 名；动态 import 保持本模块静态依赖轻量） */
 async function collectCandidates(ctx) {
-	const { listCccs } = await import("./ccc-roots-DAwz9Li1.js").then((n) => n.a);
+	const { listCccs } = await import("./ccc-roots-4LwGLCXa.js").then((n) => n.a);
 	const entries = await listCccs(ctx, { defaultRoot: process.cwd() });
 	const seen = /* @__PURE__ */ new Set();
 	const out = [];

package/lib/{message-source-DiP3Uve3.js → message-source-CfqdGIi2.js}

@@ -1,6 +1,6 @@
-import { r as cccRootForCwd } from "./ccc-roots-DAwz9Li1.js";
+import { r as cccRootForCwd } from "./ccc-roots-4LwGLCXa.js";
 import { _ as resolveInside, g as readUtf8 } from "./ccc-CyYJL4F2.js";
-import { A as sessionEvents, E as parseTrajectoryCode, b as getActiveSessionInfo, j as sessionsRoot, x as getLastActiveSessionInfo } from "./profile-5TQ_C1xi.js";
+import { A as sessionEvents, E as parseTrajectoryCode, b as getActiveSessionInfo, j as sessionsRoot, x as getLastActiveSessionInfo } from "./profile-CiRWh2a2.js";
 import { dirname, join } from "node:path";
 import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, statSync, writeFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
@@ -105,6 +105,28 @@ function profileToolWhitelist(profile) {
 function profileMsmWhitelist(profile) {
 	return new Set(profile?.msms ?? []);
 }
+/**
+* 该轨迹可**写**的路径前缀（owner 2026-10-20 令：「轨迹设定自己的写白名单」）。
+*
+* 🔴 与 `profileToolWhitelist` 共用同一条判据（D181/D183）：**字段在不在，不是数组空不空**。
+*
+* | `writes` | 返回 | 语义 |
+* |---|---|---|
+* | 缺省 | **`null`** | 不收窄（写权限 = 路径守卫那几条，与今天一致） |
+* | `[]` | `[]`（空数组） | **一个写都落不下**（显式意图） |
+* | `['a/']` | `['a/']` | 写目标必须落在 `a/` 之内 |
+*
+* ⛔ **调用方不许把 `null` 当 `[]`** —— 那会把"我没想到这件事"读成"我不许写任何东西"，
+* 正是 S196 被静默锁死的形态（D179(b)）。
+*
+* ⚠️ 返回的是**原始条目**（相对 CCC 根或绝对路径都可），解析成绝对路径由调用方按自己的 root 做 ——
+* 本模块不持有 root（判据在 `seams/guards.ts`）。
+*/
+function profileWriteWhitelist(profile) {
+	if (!profile) return null;
+	if (profile.writes === void 0) return null;
+	return profile.writes;
+}
 /** 轨迹纪律参与项（`profile` 缺省已在 `readTrajectoryConstraintAt` 归一为全 true） */
 function constraintCognitiveTrajectory(profile) {
 	return {
@@ -799,4 +821,4 @@ const ACC_MESSAGE_KIND = "plugin:dsh-serenity-hooks";
 /** ACC 注入消息的统一来源值（各缝共用；需要 `form` 时按 `ContextFormed` 另加字段）。 */
 const PLUGIN_SOURCE = { kind: ACC_MESSAGE_KIND };
 //#endregion
-export { ACC_VERSION as _, listBoundSessionIds as a, setBindingStore as c, constraintCognitiveTrajectory as d, constraintSystemPromptSource as f, resolveConstraintSystemPrompt as g, profileToolWhitelist as h, carrierState as i, TRAJECTORY_CONSTRAINT_HINT as l, profileMsmWhitelist as m, PLUGIN_SOURCE as n, readLastBound as o, createProfilePromptReader as p, appendBound as r, resolveSessionCognitiveTrajectoryLabel as s, ACC_MESSAGE_KIND as t, buildTrajectoryBasePrompt as u, findPackageRoot as v };
+export { resolveConstraintSystemPrompt as _, listBoundSessionIds as a, setBindingStore as c, constraintCognitiveTrajectory as d, constraintSystemPromptSource as f, profileWriteWhitelist as g, profileToolWhitelist as h, carrierState as i, TRAJECTORY_CONSTRAINT_HINT as l, profileMsmWhitelist as m, PLUGIN_SOURCE as n, readLastBound as o, createProfilePromptReader as p, appendBound as r, resolveSessionCognitiveTrajectoryLabel as s, ACC_MESSAGE_KIND as t, buildTrajectoryBasePrompt as u, ACC_VERSION as v, findPackageRoot as y };

package/lib/{profile-5TQ_C1xi.js → profile-CiRWh2a2.js}

@@ -1078,6 +1078,19 @@ function readTrajectoryConstraintAt(trajectoryDir, root) {
 	}
 	const tools = strListMaybe(obj.tools);
 	const msms = strListMaybe(obj.msms);
+	const writes = strListMaybe(obj.writes);
+	/**
+	* 提示词注入模式（owner 2026-10-20）：只搬运，不判决。
+	*
+	* 🔴 判决在 `planPromptInjection()` —— 那里有唯一的合法性表与降级规则。
+	* 这里若也判一次（比如把未知值归一成 append），就会有两处真相：
+	* 一处静默改值、一处告警，读数是矛盾的（D151 同族）。
+	*/
+	const promptRaw = obj.prompt;
+	const prompt = promptRaw !== null && typeof promptRaw === "object" && !Array.isArray(promptRaw) ? {
+		...typeof promptRaw.injection === "string" ? { injection: promptRaw.injection } : {},
+		...strListMaybe(promptRaw.replaces) !== void 0 ? { replaces: strListMaybe(promptRaw.replaces) } : {}
+	} : void 0;
 	return {
 		dirName,
 		code,
@@ -1085,7 +1098,9 @@ function readTrajectoryConstraintAt(trajectoryDir, root) {
 		...model !== void 0 ? { model } : {},
 		...tools !== void 0 ? { tools } : {},
 		...msms !== void 0 ? { msms } : {},
+		...writes !== void 0 ? { writes } : {},
 		...resident !== void 0 ? { resident } : {},
+		...prompt !== void 0 ? { prompt } : {},
 		cognitiveTrajectory: {
 			session: boolOrTrue(ct.session),
 			keeper: boolOrTrue(ct.keeper),

package/lib/{session-tdlJDS9i.js → session-KBRbYb52.js}

@@ -1,8 +1,8 @@
-import { n as agentCwdFor, r as cccRootForCwd, s as hostAgents } from "./ccc-roots-DAwz9Li1.js";
+import { n as agentCwdFor, r as cccRootForCwd, s as hostAgents } from "./ccc-roots-4LwGLCXa.js";
 import { g as readUtf8, o as isSafeModeOn, p as readCognitiveTrajectorySkills, u as readBlacklist } from "./ccc-CyYJL4F2.js";
-import { B as isoLocal, D as readActiveSessionMd, a as readTrajectoryConstraintAt, c as trajectoryConstraintForSession, d as unregisterTrajectorySession$1, j as sessionsRoot, l as registerTrajectorySession$1, p as DEFAULT_SESSION_SCOPE, u as trajectoryDirNameForSession } from "./profile-5TQ_C1xi.js";
+import { B as isoLocal, D as readActiveSessionMd, a as readTrajectoryConstraintAt, c as trajectoryConstraintForSession, d as unregisterTrajectorySession$1, j as sessionsRoot, l as registerTrajectorySession$1, p as DEFAULT_SESSION_SCOPE, u as trajectoryDirNameForSession } from "./profile-CiRWh2a2.js";
 import { a as readGitTrack, i as localstorePath } from "./service-DDmHSglV.js";
-import { _ as ACC_VERSION, d as constraintCognitiveTrajectory, m as profileMsmWhitelist, n as PLUGIN_SOURCE, o as readLastBound, p as createProfilePromptReader, u as buildTrajectoryBasePrompt } from "./message-source-DiP3Uve3.js";
+import { d as constraintCognitiveTrajectory, m as profileMsmWhitelist, n as PLUGIN_SOURCE, o as readLastBound, p as createProfilePromptReader, u as buildTrajectoryBasePrompt, v as ACC_VERSION } from "./message-source-CfqdGIi2.js";
 import { basename, dirname, join, resolve } from "node:path";
 import { chmodSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, statSync, writeFileSync } from "node:fs";
 import { createUserMessage } from "@deepseek-ai/dsh-llm";
@@ -1379,6 +1379,110 @@ function applyWirePatch(wire) {
 	return updateAdvancedSettings(patch);
 }
 //#endregion
+//#region src/trajectory/prompt-injection.ts
+/**
+* trajectory/prompt-injection.ts — **轨迹提示词的注入模式**（owner 2026-10-20 令）
+*
+* ## owner 的原话与动机（本模块的全部设计依据）
+*
+* > 「某条角色轨迹目前工作起来，容易多做多想，主要原因我认为还是宁静号原本的提示词注入导致的，
+* >   所以我认为轨迹提示词的设定要容许更高的复杂度，轨迹自身的配置里要有提示词注入选项：
+* >   **默认追加**，可以设定为**替换宁静号系统提示词的约束部分**；同时要确认
+* >   对该提示词和设定的修改可以**热生效**。」
+*
+* ## 两个模式（判据只有这两个，别再开第三个）
+*
+* | 模式 | 行为 |
+* |---|---|
+* | `append`（**缺省**） | 容器与质量各块照常注入，轨迹提示词**追加**在第 ⑧ 位 —— 这是 2026-10-19 起的既有行为，**不变** |
+* | `replace` | 轨迹提示词**取代**指定的「约束块」，并站到它们原来的位置上（紧跟 ACC 身份） |
+*
+* ## 🔴 可替换的块 = 四个「约束块」，**身份块永不在列**
+*
+* `metaphor`（世界模型）／`principles`（信念与边界）／`cce`（连续性纪律）／`eap`（输出质量标准）。
+* **`identity`（`=== Serenity ACC ===`）刻意不可替换**：它回答的是"这条轨迹在哪里工作"，
+* 不是"按什么章法工作"；把它换掉会让同一个容器里的轨迹**彼此不再共享同一套边界**，
+* 而那正是 §5.9b 四层模型里"容器层永不可覆盖"那一条要保的东西。
+* ⚠️ 若以后确实要开放身份块，那是一次**标准级**决定（specs §5.9b），不是加个字符串。
+*
+* ## 三条失败语义（都**响亮**，不静默降级）
+*
+* 1. **未知块名** ⇒ 丢弃该项并指名（"教一个会静默不生效的写法"是最坏的一类文档债）。
+* 2. **`replace` 但没有轨迹提示词** ⇒ **不执行替换**，按 `append` 走并告警 ——
+*    「替换」需要一个替代物；没有替代物的替换 = **静默清空纪律**，那不是本选项的意思。
+* 3. **`append` 却写了 `replaces`** ⇒ `replaces` 不生效并告警（同上：不教空头写法）。
+*
+* 本模块是**纯函数**（不读盘、不打日志）：读盘在调用方（`seams/system-prompt.ts`），
+* 日志也由调用方按 `problems` 打 —— 这样判据可单测，且告警去重只在一个地方。
+*/
+/** 注入模式的闭集（**新增模式 = 改标准**，不是加一个字符串值） */
+const PROMPT_INJECTION_MODES = ["append", "replace"];
+/**
+* 可被轨迹提示词取代的块（**有意排除 `identity`**，见文件头）。
+*
+* ⚠️ 这些 id 必须与 `seams/system-prompt.ts` 里实际的块一一对应；
+* 改块名/加块时**同批改这里**，否则本选项会静默失配（D143 同族）。
+*/
+const REPLACEABLE_PROMPT_BLOCKS = [
+	"metaphor",
+	"principles",
+	"cce",
+	"eap"
+];
+const DEFAULT_PLAN = {
+	mode: "append",
+	replaces: /* @__PURE__ */ new Set(),
+	promptPosition: "late",
+	problems: []
+};
+/**
+* 判决一次注入（纯函数）。
+*
+* @param raw `trajectory.json` 的 `prompt` 段（原样；`undefined` = 没写 = 缺省追加）
+* @param hasTrajectoryPrompt 该轨迹目录里**是否真有** `PROMPT.md`（调用方查，本函数不做 IO）
+*/
+function planPromptInjection(raw, hasTrajectoryPrompt) {
+	if (raw === void 0) return DEFAULT_PLAN;
+	const problems = [];
+	const declared = typeof raw.injection === "string" ? raw.injection.trim() : "";
+	if (declared !== "" && !PROMPT_INJECTION_MODES.includes(declared)) {
+		problems.push(`prompt.injection 的取值「${declared}」不是合法模式（只有 ${PROMPT_INJECTION_MODES.join(" / ")}）⇒ 按 append 处理`);
+		return {
+			...DEFAULT_PLAN,
+			problems
+		};
+	}
+	if ((declared === "replace" ? "replace" : "append") === "append") {
+		if (raw.replaces !== void 0) problems.push("prompt.replaces 只在 injection=\"replace\" 下生效（当前是 append）⇒ 已忽略");
+		return {
+			...DEFAULT_PLAN,
+			problems
+		};
+	}
+	if (!hasTrajectoryPrompt) {
+		problems.push("prompt.injection=\"replace\" 但轨迹目录里没有 PROMPT.md ⇒ 不执行替换（按 append 处理）：替换需要一个替代物，否则就是静默清空纪律");
+		return {
+			...DEFAULT_PLAN,
+			problems
+		};
+	}
+	const wanted = raw.replaces;
+	let picked;
+	if (wanted === void 0) picked = [...REPLACEABLE_PROMPT_BLOCKS];
+	else {
+		const invalid = wanted.filter((n) => !REPLACEABLE_PROMPT_BLOCKS.includes(n));
+		if (invalid.length > 0) problems.push(`prompt.replaces 含不可替换的块名：${invalid.join(" / ")}（可替换的只有 ${REPLACEABLE_PROMPT_BLOCKS.join(" / ")}；身份块 identity 刻意不可替换）⇒ 已忽略这些项`);
+		picked = wanted.filter((n) => REPLACEABLE_PROMPT_BLOCKS.includes(n));
+	}
+	const replaces = new Set(picked);
+	return {
+		mode: "replace",
+		replaces,
+		promptPosition: replaces.size === 0 ? "late" : "constraint",
+		problems
+	};
+}
+//#endregion
 //#region src/seams/system-prompt.ts
 /** 读取 persona 彩蛋配置（plugin 全局；未配置 → mode='' 彩蛋关闭） */
 function readPersonaSettings() {
@@ -1805,13 +1909,15 @@ function sessionBlock(root, scope = DEFAULT_SESSION_SCOPE) {
 function serenitySystemPrompt(root, scope = DEFAULT_SESSION_SCOPE, dirName) {
 	const persona = readPersonaSettings();
 	const personaOn = persona.mode !== "" && persona.overrideText.trim() !== "";
-	const parts = [
-		identityBlock(root),
-		metaphorBlock(),
-		principlesBlock(root, personaOn),
-		cceBlock(),
-		eapBlock()
-	];
+	const trajReader = dirName === void 0 ? null : createTrajectoryPromptReader(root, dirName);
+	const trajPrompt = trajReader === null ? "" : trajectoryPromptBlock(trajReader());
+	const plan = planInjectionFor(root, dirName, trajPrompt !== "");
+	const parts = [identityBlock(root)];
+	if (plan.promptPosition === "constraint" && trajPrompt !== "") parts.push(trajPrompt);
+	if (!plan.replaces.has("metaphor")) parts.push(metaphorBlock());
+	if (!plan.replaces.has("principles")) parts.push(principlesBlock(root, personaOn));
+	if (!plan.replaces.has("cce")) parts.push(cceBlock());
+	if (!plan.replaces.has("eap")) parts.push(eapBlock());
 	if (personaOn) {
 		const expr = personaBlock(persona.mode, persona.overrideText);
 		if (expr !== "") parts.push(expr);
@@ -1820,14 +1926,45 @@ function serenitySystemPrompt(root, scope = DEFAULT_SESSION_SCOPE, dirName) {
 	if (state) parts.push(state);
 	const skill = entrySkillSectionText(root);
 	if (skill) parts.push(skill);
-	const trajPrompt = dirName === void 0 ? "" : trajectoryPromptBlock(createTrajectoryPromptReader(root, dirName)());
-	if (trajPrompt !== "") parts.push(trajPrompt);
+	if (plan.promptPosition === "late" && trajPrompt !== "") parts.push(trajPrompt);
 	parts.push(toolsBlock());
 	const session = sessionBlock(root, scope);
 	if (session) parts.push(session);
 	return parts.join("\n\n");
 }
 /**
+* 解析该轨迹的**注入判决**（每次装配现读；坏设定只告警一次，不阻断装配）。
+*
+* 🔴 为什么热路径可以读盘：`trajectory.json` 是**每轮都要读**的本来就有的东西
+* （工具白名单 / model / resident 都走同一条读取路径），多读一次不会改变复杂度量级；
+* 而**缓存**会让"改了设定但没生效"重新变成一个只能靠重启解释的现象 ——
+* owner 这次的原话里明确要求「对提示词和设定的修改可以热生效」。
+*
+* @param root CCC 根
+* @param dirName 绑定的轨迹目录名（`undefined` ⇒ 追加模式，无轨迹上下文）
+* @param hasTrajectoryPrompt 该轨迹目录里是否真有 `PROMPT.md`（`replace` 的前提）
+*/
+function planInjectionFor(root, dirName, hasTrajectoryPrompt) {
+	if (dirName === void 0) return planPromptInjection(void 0, false);
+	let raw;
+	try {
+		raw = readTrajectoryConstraintAt(join(sessionsRoot(root), dirName), root)?.prompt;
+	} catch {
+		raw = void 0;
+	}
+	const plan = planPromptInjection(raw, hasTrajectoryPrompt);
+	for (const p of plan.problems) {
+		const key = `${root}\u0000${dirName}\u0000${p}`;
+		if (!warnedPromptInjection.has(key)) {
+			warnedPromptInjection.add(key);
+			console.warn(`[serenity-hooks] ✗ 轨迹提示词注入设定（${dirName}）：${p}`);
+		}
+	}
+	return plan;
+}
+/** 同一（CCC × 轨迹 × 原因）只告警一次：每轮装配都执行，不去重会刷屏（但**不静默**） */
+const warnedPromptInjection = /* @__PURE__ */ new Set();
+/**
 * Code Mode 适配行：当前 scope 以 Code Mode 呈现工具时（run_code 可见），
 * ACC 块按 native 语义指引"直接调用工具"会与"只有 run_code 可直接调用"的执行
 * 塌缩冲突（模型直呼工具名 → UNKNOWN_TOOL，拒绝信息误导）。追加一行说明，

package/lib/{settings-B-vn8j4g.js → settings-Dj4_ppTC.js}

@@ -1,4 +1,4 @@
-import { f as hostSettings } from "./ccc-roots-DAwz9Li1.js";
+import { f as hostSettings } from "./ccc-roots-4LwGLCXa.js";
 //#region src/surface/settings.ts
 /**
 * 设置面板命名空间 = **profile 条目 id**（v0.1.7 起；与旧 `settings.yaml` 段名逐字相同）。

package/lib/trajectory/policy/profile.d.ts

@@ -31,6 +31,7 @@
  * ⚠️ **文件名 `profile` 与 `trajectory-constraint.json` / `TrajectoryConstraint` 等符号名一律不动**：
  * 那是有具体指称的东西（一个固定文件名 ＋ 它的解析结果），不是组织单位。
  */
+import type { RawPromptInjection } from '../prompt-injection.js';
 /**
  * 🆕 **声明文件的文件名**（2026-10-19 owner 裁 Q2：短名 `trajectory.json`）。
  *
@@ -66,6 +67,20 @@ export interface TrajectoryConstraint {
     tools?: string[];
     /** MSM 白名单；缺省/空数组语义同 `tools`（D181） */
     msms?: string[];
+    /**
+     * **写路径白名单**（owner 2026-10-20 令：「ACC 如果支持轨迹设定自己的写白名单就好了」）。
+     *
+     * `tools` 只管**工具名**，管不了"这个工具能写哪儿"——一旦给了 `write`，路径守卫只拦
+     * "逃出 CCC"与黑名单，**拦不住它去写别人的轨迹或 `docs/`**。本字段补的就是这一维。
+     *
+     * 🔴 判据与 D181 同一条：**字段在不在，不是数组空不空**。
+     * - 缺省（`undefined`）⇒ **不收窄**（写权限 = 路径守卫那几条）；
+     * - `[]` ⇒ **一个写都落不下**（显式意图，不告警）；
+     * - 非空 ⇒ 写类工具的**目标路径**必须落在这些前缀内（相对 CCC 根，或其绝对路径）。
+     *
+     * 只约束**写类**工具（`write`/`edit`/`container_fs` 写动作/`append`/`touch`）；读不受影响。
+     */
+    writes?: string[];
     /** 轨迹纪律参与项（**缺省全 true**，见上方 R↓） */
     cognitiveTrajectory: {
         session: boolean;
@@ -86,6 +101,18 @@ export interface TrajectoryConstraint {
     resident?: {
         serves?: string;
     };
+    /**
+     * **提示词注入模式**（owner 2026-10-20 令）—— 轨迹提示词**怎么**进入系统提示词。
+     *
+     * - 缺省（字段不写）⇒ `append`：容器与质量各块照常注入，轨迹提示词追加在第 ⑧ 位。
+     * - `{ "injection": "replace", "replaces": [...] }` ⇒ 轨迹提示词**取代**指定的约束块
+     *   （`metaphor` / `principles` / `cce` / `eap`；缺省全换），并站到它们的原位上。
+     *   **身份块（`=== Serenity ACC ===`）刻意不可替换** —— 判据见 `trajectory/prompt-injection.ts`。
+     *
+     * ⚠️ 本字段**只搬运值**，合法性与降级判决在 `planPromptInjection()`（纯函数、可单测）；
+     * 两份实现会让"文件里写的"与"实际生效的"分叉。
+     */
+    prompt?: RawPromptInjection;
 }
 /**
  * 读一个目录下的 `trajectory-constraint.json`（**纯读，不施加约束**）。

package/lib/trajectory/policy/rules.d.ts

@@ -45,6 +45,24 @@ export declare const TRAJECTORY_CONSTRAINT_HINT = "systemPromptFile hot-reloads
 export declare function profileToolWhitelist(profile: TrajectoryConstraint | null | undefined): Set<string> | null;
 /** 该轨迹会话可 exec 的 MSM 白名单（`msm` 工具内部再过滤；独立于工具白名单） */
 export declare function profileMsmWhitelist(profile: TrajectoryConstraint | null | undefined): Set<string>;
+/**
+ * 该轨迹可**写**的路径前缀（owner 2026-10-20 令：「轨迹设定自己的写白名单」）。
+ *
+ * 🔴 与 `profileToolWhitelist` 共用同一条判据（D181/D183）：**字段在不在，不是数组空不空**。
+ *
+ * | `writes` | 返回 | 语义 |
+ * |---|---|---|
+ * | 缺省 | **`null`** | 不收窄（写权限 = 路径守卫那几条，与今天一致） |
+ * | `[]` | `[]`（空数组） | **一个写都落不下**（显式意图） |
+ * | `['a/']` | `['a/']` | 写目标必须落在 `a/` 之内 |
+ *
+ * ⛔ **调用方不许把 `null` 当 `[]`** —— 那会把"我没想到这件事"读成"我不许写任何东西"，
+ * 正是 S196 被静默锁死的形态（D179(b)）。
+ *
+ * ⚠️ 返回的是**原始条目**（相对 CCC 根或绝对路径都可），解析成绝对路径由调用方按自己的 root 做 ——
+ * 本模块不持有 root（判据在 `seams/guards.ts`）。
+ */
+export declare function profileWriteWhitelist(profile: TrajectoryConstraint | null | undefined): string[] | null;
 /** 轨迹纪律参与项（`profile` 缺省已在 `readTrajectoryConstraintAt` 归一为全 true） */
 export declare function constraintCognitiveTrajectory(profile: TrajectoryConstraint | null | undefined): {
     session: boolean;

package/lib/trajectory/prompt-injection.d.ts

@@ -0,0 +1,73 @@
+/**
+ * trajectory/prompt-injection.ts — **轨迹提示词的注入模式**（owner 2026-10-20 令）
+ *
+ * ## owner 的原话与动机（本模块的全部设计依据）
+ *
+ * > 「某条角色轨迹目前工作起来，容易多做多想，主要原因我认为还是宁静号原本的提示词注入导致的，
+ * >   所以我认为轨迹提示词的设定要容许更高的复杂度，轨迹自身的配置里要有提示词注入选项：
+ * >   **默认追加**，可以设定为**替换宁静号系统提示词的约束部分**；同时要确认
+ * >   对该提示词和设定的修改可以**热生效**。」
+ *
+ * ## 两个模式（判据只有这两个，别再开第三个）
+ *
+ * | 模式 | 行为 |
+ * |---|---|
+ * | `append`（**缺省**） | 容器与质量各块照常注入，轨迹提示词**追加**在第 ⑧ 位 —— 这是 2026-10-19 起的既有行为，**不变** |
+ * | `replace` | 轨迹提示词**取代**指定的「约束块」，并站到它们原来的位置上（紧跟 ACC 身份） |
+ *
+ * ## 🔴 可替换的块 = 四个「约束块」，**身份块永不在列**
+ *
+ * `metaphor`（世界模型）／`principles`（信念与边界）／`cce`（连续性纪律）／`eap`（输出质量标准）。
+ * **`identity`（`=== Serenity ACC ===`）刻意不可替换**：它回答的是"这条轨迹在哪里工作"，
+ * 不是"按什么章法工作"；把它换掉会让同一个容器里的轨迹**彼此不再共享同一套边界**，
+ * 而那正是 §5.9b 四层模型里"容器层永不可覆盖"那一条要保的东西。
+ * ⚠️ 若以后确实要开放身份块，那是一次**标准级**决定（specs §5.9b），不是加个字符串。
+ *
+ * ## 三条失败语义（都**响亮**，不静默降级）
+ *
+ * 1. **未知块名** ⇒ 丢弃该项并指名（"教一个会静默不生效的写法"是最坏的一类文档债）。
+ * 2. **`replace` 但没有轨迹提示词** ⇒ **不执行替换**，按 `append` 走并告警 ——
+ *    「替换」需要一个替代物；没有替代物的替换 = **静默清空纪律**，那不是本选项的意思。
+ * 3. **`append` 却写了 `replaces`** ⇒ `replaces` 不生效并告警（同上：不教空头写法）。
+ *
+ * 本模块是**纯函数**（不读盘、不打日志）：读盘在调用方（`seams/system-prompt.ts`），
+ * 日志也由调用方按 `problems` 打 —— 这样判据可单测，且告警去重只在一个地方。
+ */
+/** 注入模式的闭集（**新增模式 = 改标准**，不是加一个字符串值） */
+export declare const PROMPT_INJECTION_MODES: readonly ["append", "replace"];
+export type PromptInjectionMode = (typeof PROMPT_INJECTION_MODES)[number];
+/**
+ * 可被轨迹提示词取代的块（**有意排除 `identity`**，见文件头）。
+ *
+ * ⚠️ 这些 id 必须与 `seams/system-prompt.ts` 里实际的块一一对应；
+ * 改块名/加块时**同批改这里**，否则本选项会静默失配（D143 同族）。
+ */
+export declare const REPLACEABLE_PROMPT_BLOCKS: readonly ["metaphor", "principles", "cce", "eap"];
+export type ReplaceablePromptBlock = (typeof REPLACEABLE_PROMPT_BLOCKS)[number];
+/** `trajectory.json` 里 `prompt` 段的**原始**形态（校验在本模块做，profile 只管搬运） */
+export interface RawPromptInjection {
+    injection?: string;
+    replaces?: string[];
+}
+/** 一次装配要用的**判决**（纯数据；调用方据此决定注入哪些块、提示词放哪） */
+export interface PromptInjectionPlan {
+    /** 实际生效的模式（`replace` 的前提不成立时会被降级成 `append`） */
+    mode: PromptInjectionMode;
+    /** `replace` 时**真正**被取代的块（`append` ⇒ 空集） */
+    replaces: ReadonlySet<ReplaceablePromptBlock>;
+    /**
+     * 轨迹提示词的位置：
+     *  · `constraint` —— 站到被取代块的原位（紧跟身份）
+     *  · `late`       —— 第 ⑧ 位（追加形态，既有行为）
+     */
+    promptPosition: 'constraint' | 'late';
+    /** 需要**响亮**告警的原因（空数组 = 一切正常）。调用方负责按轨迹去重后打日志 */
+    problems: string[];
+}
+/**
+ * 判决一次注入（纯函数）。
+ *
+ * @param raw `trajectory.json` 的 `prompt` 段（原样；`undefined` = 没写 = 缺省追加）
+ * @param hasTrajectoryPrompt 该轨迹目录里**是否真有** `PROMPT.md`（调用方查，本函数不做 IO）
+ */
+export declare function planPromptInjection(raw: RawPromptInjection | undefined, hasTrajectoryPrompt: boolean): PromptInjectionPlan;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shgroup/dsh-serenity-hooks",
-  "version": "1.79.5",
+  "version": "1.81.0",
   "description": "宁静号 ACC harness（Native Cordis 插件）——给 DeepSeek Harness 装一个「AI 工作区」：14 个工具（container_fs/cognitive_trajectory/dashboard/container_git/msm/praxis/ontology/serenity-skill-creator/cheap-worker/localstore/container_admin；另三个 im-bridge/acc-diag/diagram 按配置条件出现）+ 机械约束（安全模式/工作区围墙/密钥守卫/对外输出守卫）+ 认知轨迹日志与原地重建 + 网页登录入口/IM 桥/认知轨迹唤醒注册表。轨迹声明 = 轨迹目录下的 trajectory.json（约束面 + 旧标识 uid + CRO 机器绑定 cro.host；旧名 trajectory-constraint.json / skiff.json 仍在读取族里）；轨迹提示词 = 轨迹目录下的 PROMPT.md（一条轨迹「是谁、按什么章程工作」，所有轨迹通用，追加在容器层与质量层之后，不替换它们）。适配 DSH 0.1.7-rc.1 / 0.2.0-rc.1 / 0.2.1-rc.1（三档）。",
   "license": "MIT",
   "repository": {