@sqdr2/dsh-fusion 0.0.0-stage → 0.3.2

package/src/host/tool-table.ts

@@ -0,0 +1,56 @@
+/** A model-facing tool, identified by the name the request will advertise. */
+export interface NamedTool { name: string }
+
+export interface ProjectedTools<T extends NamedTool> {
+  tools: T[]
+  /** Fusion tools this role must see that neither the assembled table nor the registry still has. */
+  missing: string[]
+}
+
+/**
+ * Rebuild one role's request tool table after another plugin replaces `assembled.tools`.
+ *
+ * The allowlist is a capability ceiling, not a list of mandatory registrations.
+ * It filters the assembled table, then permitted names are copied back from this
+ * agent's own registry: allowlisted tools (such as `job_output`) and Fusion's own
+ * `fusion_*` registrations. An undefined allowlist keeps the assembled table and only
+ * unions Fusion's registrations, so a writing role is not narrowed.
+ *
+ * A Fusion tool is required only when this agent actually registered it and the role
+ * may see it. `fusion_read_state` and `fusion_delegate_text` are registered only for
+ * model-like profiles; a legacy allowlist that merely names them is not incomplete.
+ * Restore copies every permitted registry tool before the gap is measured, so `missing`
+ * stays empty for every table this function itself builds. The field remains so a later
+ * change that stops restoring a registered tool fails closed instead of sending a
+ * silently smaller catalog.
+ */
+export function projectRoleTools<T extends NamedTool>(input: {
+  assembled: readonly T[]
+  allowlist: readonly string[] | undefined
+  registry: readonly T[]
+  /** Names this role keeps even when the allowlist omits them. */
+  always?: readonly string[]
+}): ProjectedTools<T> {
+  const always = input.always ?? []
+  const permitted = (name: string) => input.allowlist === undefined || input.allowlist.includes(name) || always.includes(name)
+  const tools = input.allowlist === undefined ? [...input.assembled] : input.assembled.filter(tool => permitted(tool.name))
+  const present = new Set(tools.map(tool => tool.name))
+  const owned = input.registry.filter(tool => tool.name.startsWith('fusion_'))
+  const registered = new Set(input.registry.map(tool => tool.name))
+  const restore = input.allowlist === undefined
+    ? owned
+    : input.registry.filter(tool => permitted(tool.name))
+  for (const tool of restore) {
+    if (present.has(tool.name)) continue
+    tools.push(tool)
+    present.add(tool.name)
+  }
+  const candidates = input.allowlist === undefined ? owned.map(tool => tool.name) : [...input.allowlist, ...always]
+  const required = [...new Set(candidates)].filter(name => name.startsWith('fusion_') && registered.has(name))
+  return { tools, missing: required.filter(name => !present.has(name)) }
+}
+
+/** Shown when the role's Fusion tools cannot be restored. The request must not proceed as a normal completion. */
+export function fusionToolDiagnostic(missing: readonly string[]): string {
+  return `FUSION_TOOL_TABLE_INCOMPLETE: required Fusion tools are absent from this request (${missing.join(', ')}). Another plugin replaced the tool table and Fusion could not restore them from its own registry. Do not tell the user that delegation is unavailable by design, and do not end the task as completed with no work. Report this diagnostic.`
+}

package/src/host/worker-terminal.ts

@@ -0,0 +1,91 @@
+/** What fusion_wait should do once the resident Worker handle is already gone. */
+export function absentWorkerOutcome(input: { pendingEffects: number; outcomeUnknown: boolean; submitted: boolean }):
+  { kind: 'recovery'; reason: string } | { kind: 'collect-report' } | { kind: 'incomplete' } {
+  if (input.pendingEffects > 0 || input.outcomeUnknown) {
+    return { kind: 'recovery', reason: 'Worker is absent with unfinished native effects; reconcile its persisted session' }
+  }
+  return input.submitted ? { kind: 'collect-report' } : { kind: 'incomplete' }
+}
+
+/** Settlement notice text. It must match whether a report was persisted, and must not send the Lead back to a disposed Worker. */
+export function workerSettlementGuidance(submitted: boolean): string {
+  if (submitted) {
+    return 'The Worker has ended and a structured report is already persisted. This notice is not task acceptance. Review the report and check evidence. Call fusion_wait only if that report has not been returned yet; it reads persisted state and does not restart the Worker.'
+  }
+  return 'The Worker has ended without a structured report. This notice is not task acceptance, and it is not a provider or quota outage. Call fusion_wait once: it returns the terminal status "worker ended without submitting a report" (WORKFLOW_INCOMPLETE) from persisted state and does not restart the Worker. Do not keep waiting.'
+}
+
+/**
+ * How to describe a Worker model-control wait to the Lead.
+ * WORKFLOW_INCOMPLETE and NO_PROGRESS are missing work, not an unavailable provider.
+ */
+export function workerStopExplanation(code: string): { reasonCode: string; next: string } {
+  if (code === 'WORKFLOW_INCOMPLETE') return {
+    reasonCode: 'workflow-incomplete',
+    next: 'The required report or workflow transition is missing. This is not a provider outage or quota limit. Do not tell the user the Sidekick or its model is unavailable. Explain the unfinished report and await a user decision.',
+  }
+  if (code === 'NO_PROGRESS') return {
+    reasonCode: 'workflow-incomplete',
+    next: 'Repeated unchanged results made no progress. This is not a provider outage or quota limit. Change the approach; do not describe the Sidekick as unavailable.',
+  }
+  return {
+    reasonCode: 'worker-unavailable',
+    next: 'Explain which role is unavailable. Use local Fusion controls to continue or replace its model; do not retry delegation or take over automatically.',
+  }
+}
+
+/**
+ * Why a quiescent Worker produced no report.
+ *
+ * A Worker that was offered a tool table but never dispatched one tool call of it
+ * did not "run out of steps" or lose work: its route could not call those tools at
+ * all. Adapters that drive their own execution loop (for example an external CLI
+ * agent) only surface tool calls when the request also carries their own transport
+ * tool, so `fusion_submit_result` stays unreachable even though this plugin did
+ * advertise it. That is a configuration mismatch the Lead must report accurately
+ * instead of retrying or blaming the model.
+ *
+ * Both counts are read from the Worker's own session log, so a text assignment —
+ * offered the Worker Fusion tools and nothing else — is judged the same way. An
+ * unreadable log yields no evidence and therefore keeps the generic verdict.
+ */
+export function workerNoReportCause(input: { requestedTools: number; dispatchedToolCalls: number }): 'unreachable-tools' | 'no-report' {
+  return input.requestedTools > 0 && input.dispatchedToolCalls === 0 ? 'unreachable-tools' : 'no-report'
+}
+
+/**
+ * Whether the recorded unreachable route still speaks for the current order.
+ *
+ * The verdict is per work order: a new order must be judged on its own dispatch,
+ * so a replacement route is never refused on a predecessor's evidence. The task
+ * is only wedged while the same order that failed still owns the handoff.
+ */
+export function workerUnreachableFor(order: { id?: string } | undefined,
+  record: { workOrderId?: string } | undefined): boolean {
+  return Boolean(order?.id && record && record.workOrderId === order.id)
+}
+
+/**
+ * The one wording for a route that cannot reach Host tools, shared by every entry
+ * point that can rediscover the verdict, so a later `fusion_wait` says the same
+ * thing as the delegation that first failed.
+ */
+export function workerUnreachableReply(childId: string | undefined,
+  route: { provider: string; model: string }): string {
+  return JSON.stringify({
+    status: 'needs-decision',
+    reason: 'worker dispatched no tool call, so it could not reach fusion_submit_result',
+    reasonCode: 'worker-tools-unreachable', failureCode: 'WORKER_TOOLS_UNREACHABLE',
+    childId, workerRunning: false, provider: route.provider, model: route.model,
+    next: 'This is a route/adapter mismatch, not a provider outage, quota limit or a model capability. The Worker route ran its own agent loop and only surfaces a tool call when the request also carries that adapter\'s own transport tool, so the Fusion tools this Host advertised were unreachable. Fusion adds that transport (agy_tool for the antigravity/agy route) to the Worker ceiling automatically, so first check the route itself: mcpBridge on, permissionMode skip, and the bridge tool allowlist permitting fusion_submit_result. Do not retry fusion_rework, do not take over and do not claim completion. Tell the user which Worker route failed, and that it must be configured to reach Host tools or be replaced by a direct-call route in Settings → Fusion.',
+  })
+}
+
+/** Continue/switch is refused before the route is written. Say so when a switch was requested. */
+export function unsettledContinuationError(switching: boolean): { zh: string; en: string } {
+  return switching
+    ? { zh: '中断的操作尚未确认结束，本次尚未切换模型。请先使用 /fusion recover <检查记录> 核对，再更换并继续。',
+      en: 'Interrupted operations are not confirmed finished, so this switch was not applied. Use /fusion recover <inspection note> first, then switch and continue.' }
+    : { zh: '中断的操作尚未确认结束，请先使用 /fusion recover 核对',
+      en: 'Interrupted operations are not confirmed finished; use /fusion recover first' }
+}

package/src/host/workspace-guard.ts

@@ -0,0 +1,17 @@
+/**
+ * Workspace write mutual exclusion for agents Fusion owns.
+ * Ordinary sessions are not governed: a foreign lease does not make them read-only.
+ * `exempt` covers read tools, Fusion's own control tools, and `run_code`.
+ * The caller passes the lease for this call's cwd only, so another directory is isolated.
+ */
+export function workspaceWriterDenial(input: {
+  fusionOwned: boolean
+  exempt: boolean
+  cwd?: string
+  leaseHolder?: string
+  agentId: string
+}): string | undefined {
+  if (!input.fusionOwned || input.exempt) return undefined
+  if (!input.cwd || !input.leaseHolder || input.leaseHolder === input.agentId) return undefined
+  return `Workspace writer is ${input.leaseHolder}; this Agent is read-only`
+}

package/src/host/workspace.ts

@@ -0,0 +1,184 @@
+import { execFileSync } from 'node:child_process'
+import type { Stats } from 'node:fs'
+import { lstatSync, readdirSync, readFileSync, readlinkSync, realpathSync } from 'node:fs'
+import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path'
+import { SnapshotId } from '../contracts.js'
+import { digestOf, sha256Hex } from '../digest.js'
+
+// These directories are not source evidence. The manifest records the exclusion
+// contract explicitly; callers must not describe this as a whole-disk snapshot.
+export const SNAPSHOT_EXCLUSIONS = ['.git', 'node_modules', '__pycache__', '.pytest_cache', '.mypy_cache', '.ruff_cache'] as const
+// Outside a git work tree there are no ignore rules to consult; also skip common environment and cache directories.
+export const FALLBACK_EXCLUSIONS = [...SNAPSHOT_EXCLUSIONS, '.venv', 'venv', '.tox', '.nox', '.eggs', '.gradle', '.next', '.turbo', '.cache'] as const
+export interface WorkspaceEntry { path: string; kind: 'file' | 'symlink'; digest: string; executable: boolean }
+export interface WorkspaceSnapshot {
+  schemaVersion: 1
+  root: string
+  excludedDirectoryNames: readonly string[]
+  /** Present when the entry list came from git (tracked + untracked, minus the repository's ignore rules). */
+  ignoreRules?: 'git-exclude-standard'
+  entries: readonly WorkspaceEntry[]
+  id: SnapshotId
+}
+
+export function workspacePath(root: string, path: string): string {
+  if (!path || isAbsolute(path) || path.includes('\0')) throw new Error('Workspace paths must be nonempty relative paths')
+  const absolute = resolve(root, path)
+  const rel = relative(root, absolute)
+  if (rel === '..' || rel.startsWith(`..${sep}`) || isAbsolute(rel)) throw new Error('Path escapes the workspace')
+  // Never traverse a link when interpreting an allowed path or verifier input.
+  let current = root
+  for (const part of rel.split(sep).filter(Boolean)) {
+    current = join(current, part)
+    try { if (lstatSync(current).isSymbolicLink()) throw new Error('Workspace path traverses a symlink') }
+    catch (error) { if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error }
+  }
+  return absolute
+}
+
+/**
+ * The root-relative form of a model-supplied path ('' for the root itself), or undefined outside the workspace.
+ * `root` is the canonical (realpath) workspace, but models write the session's own spelling of it: macOS
+ * `/tmp/x` for `/private/tmp/x`, a symlinked checkout, another drive-letter case. So an absolute path is
+ * matched by the filesystem identity of its ancestors, not by string. The shortest ancestor that is the root
+ * wins, so a link below the root is never followed here; workspacePath still refuses one.
+ */
+export function workspaceRelative(root: string, path: string): string | undefined {
+  const absolute = resolve(root, path)
+  const ancestors = [absolute]
+  for (let parent = dirname(absolute); parent !== ancestors.at(-1); parent = dirname(parent)) ancestors.push(parent)
+  for (const candidate of ancestors.reverse()) {
+    let real: string
+    try { real = realpathSync.native(candidate) } catch { return undefined }
+    if (real === root) return relative(candidate, absolute)
+  }
+  return undefined
+}
+
+const MAX_ENTRIES = 200_000
+const LARGE_FILE = 16 * 1024 * 1024
+
+/**
+ * Source files git would consider (tracked plus untracked, minus the repository's ignore rules), relative
+ * to root; undefined outside a git work tree or without git. Ignore rules are the project's own statement
+ * of what is not source (virtualenvs, build output, caches), so no per-ecosystem list has to guess.
+ */
+function gitSourceFiles(root: string): string[] | undefined {
+  try {
+    const out = execFileSync('git', ['-C', root, 'ls-files', '-z', '--cached', '--others', '--exclude-standard'],
+      { encoding: 'buffer', maxBuffer: 512 * 1024 * 1024, stdio: ['ignore', 'pipe', 'ignore'], env: { ...process.env, GIT_OPTIONAL_LOCKS: '0' } })
+    return [...new Set(out.toString('utf8').split('\0').filter(Boolean))].sort()
+  } catch { return undefined }
+}
+
+export function snapshotWorkspace(cwd: string): WorkspaceSnapshot {
+  const root = realpathSync.native(cwd)
+  const entries: WorkspaceEntry[] = []
+  const excluded = (path: string) => path.split('/').some(part => (SNAPSHOT_EXCLUSIONS as readonly string[]).includes(part))
+  function add(full: string, path: string, stat: Stats): void {
+    if (stat.isSymbolicLink()) {
+      entries.push({ path, kind: 'symlink', digest: sha256Hex(readlinkSync(full)), executable: false })
+    } else if (stat.isFile()) {
+      // A very large file (dataset, binary asset) is fingerprinted by size and mtime instead of content.
+      const large = stat.size > LARGE_FILE
+      const contents = large ? undefined : readFileSync(full)
+      const after = lstatSync(full)
+      if (after.ino !== stat.ino || after.mtimeMs !== stat.mtimeMs || after.size !== (contents?.length ?? stat.size)) throw new Error('Workspace changed while taking the snapshot')
+      entries.push({ path, kind: 'file', digest: contents ? sha256Hex(contents) : sha256Hex(`large:${stat.size}:${stat.mtimeMs}`), executable: Boolean(stat.mode & 0o111) })
+    } else if (!stat.isDirectory()) { throw new Error(`Unsupported source file type: ${path}`) }
+    if (entries.length > MAX_ENTRIES) throw new Error('Workspace exceeds the bounded file manifest; choose a smaller project root')
+  }
+  function visit(directory: string): void {
+    for (const name of readdirSync(directory).sort()) {
+      const full = join(directory, name)
+      const stat = lstatSync(full)
+      if (stat.isDirectory()) { if (!(FALLBACK_EXCLUSIONS as readonly string[]).includes(name)) visit(full); continue }
+      add(full, relative(root, full).split(sep).join('/'), stat)
+    }
+  }
+  const listed = gitSourceFiles(root)
+  if (listed) {
+    for (const path of listed) {
+      if (excluded(path)) continue
+      const full = join(root, ...path.split('/'))
+      let stat: Stats
+      try { stat = lstatSync(full) } catch (error) { if ((error as NodeJS.ErrnoException).code === 'ENOENT') continue; throw error }
+      if (!stat.isDirectory()) add(full, path, stat) // a nested repository (gitlink) is not traversed
+    }
+  } else visit(root)
+  const manifest = { schemaVersion: 1 as const, root, excludedDirectoryNames: listed ? SNAPSHOT_EXCLUSIONS : FALLBACK_EXCLUSIONS,
+    ...(listed ? { ignoreRules: 'git-exclude-standard' as const } : {}), entries }
+  return { ...manifest, id: SnapshotId(`source:${digestOf(manifest)}`) }
+}
+
+export function changedPaths(before: WorkspaceSnapshot, after: WorkspaceSnapshot): string[] {
+  if (before.root !== after.root) throw new Error('Workspace root changed')
+  const old = new Map(before.entries.map(entry => [entry.path, digestOf(entry)]))
+  const now = new Map(after.entries.map(entry => [entry.path, digestOf(entry)]))
+  return [...new Set([...old.keys(), ...now.keys()])].filter(path => old.get(path) !== now.get(path)).sort()
+}
+
+/**
+ * Workspace-relative allowlist check. `/` always separates segments; `\` is a
+ * separator only on Windows — on POSIX it is a legal filename character, so
+ * `src\file.ts` must not match a `src` grant there. `.`/`..` segments then
+ * resolve lexically, so `src/../outside` (and its backslash form on Windows)
+ * never matches a `src` grant. workspacePath only bounds a path to the
+ * workspace root; membership in allowedPaths is decided here. Absolute paths
+ * (`/x`, `C:\x`, drive-relative `C:x`, UNC), empty paths and NUL are not
+ * workspace-relative and never normalize.
+ */
+export function normalizeRelativePath(path: string): string | undefined {
+  if (!path || path.includes('\0') || isAbsolute(path) || (process.platform === 'win32' && /^[a-z]:/i.test(path))) return undefined
+  const segments: string[] = []
+  for (const segment of path.split(process.platform === 'win32' ? /[\\/]+/ : /\//)) {
+    if (!segment || segment === '.') continue
+    if (segment === '..') { if (!segments.pop()) return undefined }
+    else segments.push(segment)
+  }
+  return segments.join('/')
+}
+
+/** Wildcards other than a trailing `/**` would authorize an unpredictable set of files. */
+const WILDCARD = /[*?[\]{}]/
+
+/**
+ * One `allowedPaths` entry → the prefix it grants. `dir/**` is the conventional spelling of
+ * "this directory and everything under it", so it grants exactly what `dir` grants.
+ *
+ * A grant that matches nothing is not a narrow scope, it is an unrecoverable deadlock: the
+ * Host freezes it, the Worker's writes then fail the freeze check forever, and widening the
+ * scope needs the delegation-time bytes those writes already replaced (session-daa71a4a: a
+ * `lib/types/**` grant authorized nothing while the task's own build rewrote exactly those
+ * declarations). So a wildcard the Host cannot honour is refused when the Lead grants it.
+ */
+export function grantOf(raw: string): string {
+  const trimmed = raw.trim().replace(/\/+$/, '')
+  const prefix = trimmed.endsWith('/**') ? trimmed.slice(0, -3) : trimmed
+  if (WILDCARD.test(prefix)) {
+    throw new Error(`allowedPaths takes a workspace-relative file or directory, not a wildcard: ${JSON.stringify(raw)} grants nothing. `
+      + 'Name the directory (a directory grant covers every file under it, so `lib/types` already means `lib/types/**`) or name each file.')
+  }
+  const normalized = prefix === '' ? undefined : normalizeRelativePath(prefix)
+  if (normalized === undefined) throw new Error(`allowedPaths entry ${JSON.stringify(raw)} is not a workspace-relative path`)
+  // `'.'` is the legitimate whole-workspace grant; keep its spelling so it survives a round trip.
+  return normalized === '' ? '.' : normalized
+}
+
+/** The prefix a stored grant matches by, tolerating `dir/**` spelling from older work orders. */
+function grantPrefix(raw: string): string | undefined {
+  const trimmed = raw.trim().replace(/\/+$/, '')
+  if (!trimmed) return undefined
+  return normalizeRelativePath(trimmed.endsWith('/**') ? trimmed.slice(0, -3) : trimmed)
+}
+
+export function pathAllowed(path: string, allowed: readonly string[]): boolean {
+  const normalized = normalizeRelativePath(path)
+  if (normalized === undefined) return false
+  // `'.'` normalizes to the root: it is the legitimate whole-workspace grant. An empty
+  // or absolute allowed entry instead fails normalization above and never authorizes.
+  return allowed.some(raw => {
+    const prefix = grantPrefix(raw)
+    return prefix !== undefined && (prefix === '' || normalized === prefix || normalized.startsWith(`${prefix}/`))
+  })
+}

package/src/identity.ts

@@ -0,0 +1,76 @@
+/**
+ * The identity this plugin registers under.
+ *
+ * Both halves import this module, so the provider route, the model entry and
+ * the durable producers keep one spelling. It deliberately has no imports: the
+ * browser bundle inlines it and must not pull a Host module in.
+ */
+
+/** The HTTP path the panel's own views and actions are served from. */
+export const FUSION_API_PATH = '/api/fusion'
+
+/**
+ * The path this plugin served before the rename. The host keeps answering it
+ * so a browser tab holding the previous client bundle keeps working until its
+ * next reload; nothing in the current bundle requests it.
+ */
+export const LEGACY_FUSION_API_PATH = '/api/model-fusion'
+
+/**
+ * The npm package this project publishes under.
+ *
+ * Distinct from {@link PLUGIN_NAME}: the package name is the registry identity
+ * and the module specifier a profile's patch resolves, while the plugin id is
+ * the runtime identity that names the state directory, the bundle patch row and
+ * the log marker. Keeping them apart is what lets the package move into a scope
+ * without moving anyone's data.
+ */
+export const PACKAGE_NAME = '@sqdr2/dsh-fusion'
+
+/** The plugin id this project registers under, and the name of its state directory. */
+export const PLUGIN_NAME = 'dsh-fusion'
+
+/** The plugin id and package name this project used before the rename. */
+export const LEGACY_PLUGIN_NAME = 'dsh-model-fusion'
+
+/** Registered provider route for the Fusion model entry. */
+export const FUSION_PROVIDER = 'dsh-fusion'
+
+/** The single model id the Fusion entry advertises. */
+export const FUSION_MODEL = 'auto'
+
+/**
+ * The provider route this plugin registered before it was renamed from
+ * `dsh-model-fusion`. Sessions created then still name it in their durable
+ * `model/selection` event, so reading it as Fusion is what keeps those
+ * sessions working; writing it is never correct.
+ */
+export const LEGACY_FUSION_PROVIDER = 'dsh-model-fusion'
+
+/** Whether a provider route belongs to this plugin, under either name. */
+export const isFusionProvider = (provider: string | undefined): boolean =>
+  provider === FUSION_PROVIDER || provider === LEGACY_FUSION_PROVIDER
+
+/** Whether a route names the Fusion entry, under either name. */
+export const isFusionSelection = (route: { provider?: string; model?: string } | undefined): boolean =>
+  isFusionProvider(route?.provider) && route?.model === FUSION_MODEL
+
+/**
+ * How a native model-switch notice names this entry (`provider/model`).
+ *
+ * Both spellings are listed: a session that switched to Fusion before the
+ * rename carries the old one in its durable log, and the notice is the same
+ * non-change on every Fusion step either way.
+ */
+export const FUSION_SELECTION_LABELS = [
+  `${FUSION_PROVIDER}/${FUSION_MODEL}`,
+  `${LEGACY_FUSION_PROVIDER}/${FUSION_MODEL}`,
+] as const
+
+/**
+ * Whether a route already names the entry under its current name. A durable
+ * intent that fails this is rewritten before the next request is assembled;
+ * the legacy spelling is a read-side alias, not a route that still dispatches.
+ */
+export const isCurrentFusionSelection = (route: { provider?: string; model?: string } | undefined): boolean =>
+  route?.provider === FUSION_PROVIDER && route.model === FUSION_MODEL

package/src/index.ts

@@ -0,0 +1,50 @@
+export { FusionError, FUSION_CONTEXT_BUDGET, NEEDS_REPAIR, OUTCOME_UNKNOWN, SPEND_UNAUTHORIZED, STORE_MIGRATION_REQUIRED, USAGE_LEDGER_REQUIRED, WORK_ORDER_CONFLICT } from './errors.js'
+export * from './contracts.js'
+export { digestOf, sha256Hex } from './digest.js'
+export { reduce, reduceAll } from './task/reducer.js'
+export { FileFusionStore, failingRenameIo, requireStorageProjectionVersion, STORE_PROJECTION_VERSION } from './task/store.js'
+export type { FusionStore } from './task/store.js'
+export { SqliteFusionStore } from './task/sqlite-store.js'
+export type { TaskState } from './task/state.js'
+export { normalizeUsage, observationFromNormalized, apiEquivalentUsd, priceUsage } from './usage/normalize.js'
+export type { UsageObservationMeta, UsagePrice, UsagePriceStatus } from './usage/normalize.js'
+export {
+  ingestDurable,
+  ingestObservation,
+  newLedger,
+  projectLedger,
+  restoreLedger,
+  splitInput,
+} from './usage/ledger.js'
+export type { CanonicalBill, UsageLedgerV2, UsageObservation, UsageProjection, UsageRequestKey } from './usage/ledger.js'
+export { quoteLedger } from './usage/pricing.js'
+export type { PriceRates, RequestQuote } from './usage/pricing.js'
+export { BudgetLedger, loadSpendingAuthorization } from './usage/budget.js'
+export { WorkspaceWriteLease, classifyEffect } from './execution/write-lease.js'
+export { resolveProfile, completeProfile, loadJsonObject, promptDigests } from './profile/resolve.js'
+export { assertFinalBudget, measureRequest, inputBudget, boundedOverflowRecovery } from './context/guard.js'
+export { consumeApproval, answerApproval, neverMeansDeny, pendingDoesNotExpire } from './approval/logical.js'
+export { evaluateReport, DEFAULT_TEST_VERIFIERS } from './evidence/gate.js'
+export type { TrustedEvidenceRegistry, RegisteredVerifier, EvaluateReportOptions } from './evidence/gate.js'
+export { assertPlannedCheck, invocationHeader, memoryVerificationRegistry, resolveInvocation, checkPlanDigest } from './evidence/receipts.js'
+export type { CheckPlan, InvocationHeader, PlannedReceipt, VerificationRegistry } from './evidence/receipts.js'
+export {
+  assertCurrentSubject,
+  captureTicket,
+  createReviewTicket,
+  resultFromCapturedTicket,
+  reviewOutboxRow,
+  reportSubject,
+  reviewReadinessReceipt,
+  reviewRequestedEvent,
+} from './review/ticket.js'
+export { appendCapturedReviewResult, loadReviewOutboxByRequestId, persistReviewRequest } from './review/dispatch.js'
+export { classifyReview, reviewAttemptFields, normalizeTermination, toReducerReviewDecision } from './review/protocol.js'
+export type { ReviewClassification, ReviewDecision, ReviewStatus, ReviewTermination } from './review/protocol.js'
+export { reconcile } from './recovery/reconcile.js'
+export { loadPromptBundle, promptManifest } from './prompts.js'
+export { runNativeBenchmark, NativeRequestBudget } from './benchmark/native-run.js'
+export type { NativeBenchmarkOptions } from './benchmark/native-run.js'
+export { resolveBenchmarkOutputLimits } from './benchmark/output-limits.js'
+export type { BenchmarkOutputLimits } from './benchmark/output-limits.js'
+export { snapshotWorkspace } from './host/workspace.js'

package/src/message-source.ts

@@ -0,0 +1,31 @@
+import type { ContextFormed } from '@deepseek-ai/dsh-llm'
+declare module '@deepseek-ai/dsh-llm' {
+  interface MessageSourceMap {
+    'plugin:dsh-fusion': { kind: 'plugin:dsh-fusion' } & ContextFormed
+    /**
+     * The producer kind this plugin wrote before it was renamed from
+     * `dsh-model-fusion`. Sessions that already exist still carry it in their
+     * durable log, so it stays a readable alias; nothing new is written under
+     * it and no migration rewrites history.
+     */
+    'plugin:dsh-model-fusion': { kind: 'plugin:dsh-model-fusion' } & ContextFormed
+  }
+}
+
+/** The kind every new Fusion message is written under. */
+export const FUSION_SOURCE_KIND = 'plugin:dsh-fusion'
+
+/** Kinds a Fusion-produced message may already carry in an existing session. */
+export const FUSION_SOURCE_KINDS = [FUSION_SOURCE_KIND, 'plugin:dsh-model-fusion'] as const
+
+export type FusionSourceKind = (typeof FUSION_SOURCE_KINDS)[number]
+
+/**
+ * Whether a message source was produced by this plugin, under either name.
+ *
+ * Read-side call sites use this guard instead of comparing one literal, so a
+ * session started before the rename keeps its context across the upgrade.
+ */
+export function isFusionSourceKind(kind: unknown): kind is FusionSourceKind {
+  return typeof kind === 'string' && (FUSION_SOURCE_KINDS as readonly string[]).includes(kind)
+}

package/src/profile/compactor.ts

@@ -0,0 +1,26 @@
+import { bi } from '../bilingual.js'
+import type { PairProfile, PhysicalRoute } from '../contracts.js'
+
+/** A separate summary model is never inferred from a provider name or enabled by default. */
+export function compactorChoice(value: unknown): PairProfile['compactor'] {
+  if (value === undefined) return undefined
+  if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error(bi('压缩模型配置无效', 'Invalid compaction model setting'))
+  const raw = value as Record<string, unknown>, route = raw.route as Record<string, unknown> | undefined
+  if (Object.keys(raw).some(key => key !== 'route' && key !== 'maxOutputTokens')
+    || !route || typeof route !== 'object' || Array.isArray(route)
+    || Object.keys(route).some(key => !['provider', 'model', 'reasoningEffort'].includes(key))
+    || typeof route.provider !== 'string' || !route.provider.trim()
+    || typeof route.model !== 'string' || !route.model.trim()
+    || (route.reasoningEffort !== undefined && (typeof route.reasoningEffort !== 'string' || !route.reasoningEffort.trim()))
+    || !Number.isSafeInteger(raw.maxOutputTokens) || Number(raw.maxOutputTokens) < 1 || Number(raw.maxOutputTokens) > 128_000) {
+    throw new Error(bi('请选择压缩模型，并设置 1–128000 的输出 Token 上限', 'Choose a compaction model and an output limit of 1–128000 tokens'))
+  }
+  return { route: { provider: route.provider, model: route.model,
+    ...(route.reasoningEffort === undefined ? {} : { reasoningEffort: route.reasoningEffort as string }) },
+    maxOutputTokens: Number(raw.maxOutputTokens) }
+}
+
+/** All physical routes in a frozen configuration share the same explicit spending authorization. */
+export function profileRoutes(profile: Pick<PairProfile, 'lead' | 'worker' | 'compactor'>): PhysicalRoute[] {
+  return [profile.lead, profile.worker, ...(profile.compactor ? [profile.compactor.route] : [])]
+}

package/src/profile/keepalive.ts

@@ -0,0 +1,13 @@
+import type { PairProfile } from '../contracts.js'
+
+/** No provider-name heuristic can establish cache support for a DSH route. */
+export function keepaliveChoice(value: unknown): PairProfile['cacheKeepalive'] {
+  if (value === undefined) return undefined
+  if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error('Invalid cache keepalive selection')
+  const raw = value as Record<string, unknown>
+  const valid = (item: unknown): item is boolean | 'auto' => typeof item === 'boolean' || item === 'auto'
+  if (Object.keys(raw).some(key => key !== 'lead' && key !== 'worker') || !valid(raw.lead) || !valid(raw.worker)) {
+    throw new Error('Cache keepalive requires explicit Lead and Worker choices (true, false or "auto")')
+  }
+  return { lead: raw.lead, worker: raw.worker }
+}