@y9931666/dsh-plugin-crossfire 0.1.0

package/lib/index.js

@@ -0,0 +1,3909 @@
+import { a as newReviewId, c as reviewDirOf, d as withCrossfireLock, f as writeJsonAtomic, i as listReviewIds, l as reviewLockKey, n as appendJsonLine, o as readJsonFile, p as writeTextAtomic, s as readJsonLines, u as stateRootOf } from "./state-DzrgVdrB.js";
+import z from "@deepseek-ai/schemastery";
+import { createHash, randomUUID } from "node:crypto";
+import { dirname, join } from "node:path";
+import { mkdir, readFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { defineTool } from "@deepseek-ai/dsh-tools";
+
+//#region src/budget.ts
+/**
+* 估算文本的 token 成本（粗估：CJK 0.6/字，其它非空白 0.3/字符，向上取整）。
+*
+* 口径与圆桌 `budget.ts` 的 `estimateTokens` **完全一致**（逐字符 `for...of`
+* 按码点遍历，`code >= 0x2e80` 记 CJK，空白不计入 other，最后 `Math.ceil`）。
+* 这是刻意照搬而不是重新设计：两个插件对同一段中文给出的预算数字必须可比。
+*
+* 再次强调：这是一个**已说出的文本长度估算**，不是模型真实用量。
+*/
+function estimateTokens(text$1) {
+	let cjk = 0;
+	let other = 0;
+	for (const char of text$1) if ((char.codePointAt(0) ?? 0) >= 11904) cjk += 1;
+	else if (char.trim() !== "") other += 1;
+	return Math.ceil(cjk * .6 + other * .3);
+}
+/**
+* 哪条预算轴被突破（无则 `undefined`）。
+*
+* 语义（与圆桌一致，见文件头）：两条轴的 `max*` 为 `0` 表示该轴不限制。
+* 返回的是**轴名**，不是布尔 —— 调用方需要把它透出给用户，让"是哪条线断了"
+* 可诊断，而不是笼统的一句"预算用完了"。
+*/
+function budgetExceeded(record) {
+	const { maxRounds, maxTokens, usedRounds, usedTokens } = record.budget;
+	if (maxRounds > 0 && usedRounds > maxRounds) return "rounds";
+	if (maxTokens > 0 && usedTokens >= maxTokens) return "tokens";
+}
+/**
+* 预算熔断错误。
+*
+* 不是"会议已结束"，也不是"会议被静音"：针锋只有这一种停止原因，且**可恢复**
+* —— 用户把设置里的上限调大即可继续（状态从未被改动，所以不存在"复活"一说）。
+*/
+var CrossfireMutedError = class extends Error {
+	axis;
+	constructor(reviewId, axis) {
+		super(`crossfire: review "${reviewId}" hit the ${axis} budget cap — later work stops here; raise the cap in the Crossfire settings to continue (the review status was not changed)`);
+		this.name = "CrossfireMutedError";
+		this.axis = axis;
+	}
+};
+/**
+* 熔断门禁：超限即抛 {@link CrossfireMutedError}，否则什么都不做。
+*
+* **不修改 `record`**（与圆桌 `markMuted` 的本质区别）：针锋不把"超预算"写成
+* 一个持久状态，因为那个状态会反过来挡住用户自救的路径 —— 圆桌的真实事故就是
+* `ensureActive` 先改状态再抛错，导致连补预算/导出都被同一个门禁拒绝，花完预算
+* 的会议永远卡在 `active` 却什么都做不了。这里只抛、不改，问题无从被固化。
+*
+* @param record - 被检查的评审记录。
+* @param options.allowMuted - 收尾路径（导出、表态、定稿）必须保持可达，
+*   否则用户连"把已经打出来的缺陷看完并裁决"都做不了；置 `true` 时直接放行。
+*/
+function assertBudget(record, options = {}) {
+	if (options.allowMuted === true) return;
+	const axis = budgetExceeded(record);
+	if (axis !== void 0) throw new CrossfireMutedError(record.reviewId, axis);
+}
+/**
+* 把一段专家输出计入 token 用量（**原地修改** `record`，由调用方负责落盘）。
+*
+* 只在文本非空时累加，避免空发言把 `usedTokens` 上一堆无意义的 `+0` 调用；
+* 估算口径交给 {@link estimateTokens}，本函数不做任何额外加权。
+*/
+function chargeTokens(record, text$1) {
+	if (text$1 === "") return;
+	record.budget.usedTokens += estimateTokens(text$1);
+}
+/**
+* 推进一轮：`reviewPass += 1` 并同步 `budget.usedRounds`，返回新的轮次。
+*
+* 这里**不**做预算检查：门禁由调用方在动手之前调用 {@link assertBudget}，因为
+* "先检查后推进"的顺序一旦反过来，第 N+1 轮的副作用就已经发生了。
+* `usedRounds` 与 `reviewPass` 必须同进同退，两者脱钩会让预算判据失去意义。
+*/
+function beginPass(record) {
+	record.reviewPass += 1;
+	record.budget.usedRounds = record.reviewPass;
+	return record.reviewPass;
+}
+
+//#endregion
+//#region src/types.ts
+/**
+* Crossfire（针锋）的领域类型。
+*
+* 设计边界（与圆桌会议刻意不同，务必守住）：
+* - 没有 nodes / edges / topology —— 专家是行，不是图。
+* - 没有 charter 的多模式 —— 只有一种角色：红队。
+* - 没有 kb / skill / proxy-thinking 字段 —— 这个插件不读知识库、不传 skill。
+*
+* @module dsh-plugin-crossfire/types
+*/
+/**
+* 固定维度池。
+*
+* 为什么必须固定：抽样 5 份真实圆桌 `review.json`，`dimension` 实值是
+* `维度②`(×5) / `维度④`(×1) / `其他`(×4) / 空串(×1) —— 只有 1 份给出了
+* 有意义的 `架构/产品/成本`。原因是 LLM 拆分经常失败并退到本地启发式兜底，
+* 而兜底把段首的圆圈数字直接当成了维度名。用户看到的因此是一堆编号。
+* 固定池 + 落库归一化是这件事的唯一可靠解法。
+*/
+const DIMENSION_POOL = [
+	"安全",
+	"数据",
+	"交互",
+	"性能",
+	"兼容",
+	"流程",
+	"反例"
+];
+/** 三档强度的完整定义。 */
+const INTENSITY_SPECS = {
+	quick: {
+		expertsPerDimension: 1,
+		crossExamination: false,
+		maxReviewPass: 1,
+		label: "快审：一轮出结论，不复审"
+	},
+	standard: {
+		expertsPerDimension: 1,
+		crossExamination: false,
+		maxReviewPass: 2,
+		label: "标准：一轮攻击，可复审一次"
+	},
+	deep: {
+		expertsPerDimension: 1,
+		crossExamination: true,
+		maxReviewPass: 3,
+		label: "深挖：加一轮交叉质证，可复审两次"
+	}
+};
+
+//#endregion
+//#region src/review.ts
+/** 当前 schema 版本。 */
+const CURRENT_SCHEMA_VERSION = 1;
+/** `<reviewDir>/review.json`。 */
+function reviewFile(stateRoot, reviewId) {
+	return join(reviewDirOf(stateRoot, reviewId), "review.json");
+}
+/** `<reviewDir>/transcript.jsonl`。 */
+function transcriptFile(stateRoot, reviewId) {
+	return join(reviewDirOf(stateRoot, reviewId), "transcript.jsonl");
+}
+/** `<reviewDir>/export.md`。 */
+function exportFile(stateRoot, reviewId) {
+	return join(reviewDirOf(stateRoot, reviewId), "export.md");
+}
+/** 通用：取一个非空字符串，否则返回 undefined。 */
+function asText(value, max = 4096) {
+	if (typeof value !== "string") return void 0;
+	const text$1 = value.trim();
+	if (text$1 === "") return void 0;
+	return text$1.slice(0, max);
+}
+/** 通用：取一个非负整数，否则返回 undefined。 */
+function asCount(value) {
+	if (typeof value !== "number" || !Number.isFinite(value)) return void 0;
+	const n = Math.floor(value);
+	return n < 0 ? void 0 : n;
+}
+function sanitizeEvidence(value) {
+	if (value === null || typeof value !== "object") return void 0;
+	const raw = value;
+	if (raw.kind !== "repro" && raw.kind !== "argument") return void 0;
+	const text$1 = asText(raw.text, 600);
+	if (text$1 === void 0) return void 0;
+	return {
+		kind: raw.kind,
+		text: text$1
+	};
+}
+function sanitizeRecheck(value) {
+	if (value === null || typeof value !== "object") return void 0;
+	const raw = value;
+	const pass = asCount(raw.pass);
+	if (pass === void 0) return void 0;
+	const verdict = raw.verdict === "fixed" || raw.verdict === "unfixed" || raw.verdict === "partial" ? raw.verdict : void 0;
+	const note = asText(raw.note, 500);
+	return {
+		pass,
+		...verdict === void 0 ? {} : { verdict },
+		...note === void 0 ? {} : { note }
+	};
+}
+/** 净化一条缺陷；内容为空的条目直接丢弃。 */
+function sanitizeDefect(value, index, allowed) {
+	if (value === null || typeof value !== "object") return void 0;
+	const raw = value;
+	const content = asText(raw.content, 2e3);
+	if (content === void 0) return void 0;
+	const id = asText(raw.id, 128) ?? `defect-${index}`;
+	const utteranceId = asText(raw.utteranceId, 128) ?? id;
+	const expertKey = asText(raw.expertKey, 64) ?? "";
+	const rawDimension = asText(raw.dimension, 32);
+	const matched = rawDimension !== void 0 && allowed.includes(rawDimension) ? rawDimension : void 0;
+	const defect = {
+		id,
+		utteranceId,
+		expertKey,
+		content,
+		dimension: matched ?? allowed[0] ?? DIMENSION_POOL[0],
+		status: raw.status === "endorsed" || raw.status === "rejected" ? raw.status : "pending",
+		ts: asCount(raw.ts) ?? Date.now(),
+		seq: asCount(raw.seq) ?? 0
+	};
+	if (matched === void 0) defect.dimensionFallback = true;
+	else if (raw.dimensionFallback === true) defect.dimensionFallback = true;
+	const quote$1 = asText(raw.quote, 120);
+	if (quote$1 !== void 0) defect.quote = quote$1;
+	const evidence = sanitizeEvidence(raw.evidence);
+	if (evidence !== void 0) defect.evidence = evidence;
+	if (raw.strikesStance === true) defect.strikesStance = true;
+	const rejectReason = asText(raw.rejectReason, 500);
+	if (rejectReason !== void 0) defect.rejectReason = rejectReason;
+	const recheck = sanitizeRecheck(raw.recheck);
+	if (recheck !== void 0) defect.recheck = recheck;
+	return defect;
+}
+/** 净化一位专家的状态。 */
+function sanitizeExpert(value) {
+	if (value === null || typeof value !== "object") return void 0;
+	const raw = value;
+	const key = asText(raw.key, 64);
+	if (key === void 0) return void 0;
+	const expert = {
+		key,
+		dimension: asText(raw.dimension, 32) ?? DIMENSION_POOL[0],
+		status: raw.status === "running" || raw.status === "done" || raw.status === "failed" || raw.status === "silent" ? raw.status : "pending",
+		defectCount: asCount(raw.defectCount) ?? 0
+	};
+	const childId = asText(raw.childId, 128);
+	if (childId !== void 0) expert.childId = childId;
+	const reportCount = asCount(raw.reportCount);
+	if (reportCount !== void 0) expert.reportCount = reportCount;
+	const provider = asText(raw.provider, 64);
+	if (provider !== void 0) expert.provider = provider;
+	const model = asText(raw.model, 128);
+	if (model !== void 0) expert.model = model;
+	const role = asText(raw.role, 2e3);
+	if (role !== void 0) expert.role = role;
+	const note = asText(raw.note, 500);
+	if (note !== void 0) expert.note = note;
+	return expert;
+}
+function sanitizeStance(value, now) {
+	const raw = value !== null && typeof value === "object" ? value : {};
+	const text$1 = asText(raw.text, 2e3) ?? "";
+	const origin = raw.origin === "manual" || raw.origin === "distilled" ? raw.origin : "edited";
+	const distilledAt = asCount(raw.distilledAt);
+	return {
+		text: text$1,
+		origin: text$1 === "" ? "manual" : origin,
+		...distilledAt === void 0 ? {} : { distilledAt },
+		updatedAt: asCount(raw.updatedAt) ?? now
+	};
+}
+function sanitizeSubject(value) {
+	const raw = value !== null && typeof value === "object" ? value : {};
+	const source = raw.source === "chat" || raw.source === "file" ? raw.source : "manual";
+	const subject = {
+		title: asText(raw.title, 200) ?? "未命名评审",
+		content: asText(raw.content, 2e4) ?? "",
+		source
+	};
+	const sourceRef = asText(raw.sourceRef, 512);
+	if (sourceRef !== void 0) subject.sourceRef = sourceRef;
+	return subject;
+}
+function sanitizeBudget(value, fallback) {
+	const raw = value !== null && typeof value === "object" ? value : {};
+	return {
+		maxRounds: asCount(raw.maxRounds) ?? fallback.maxRounds,
+		maxTokens: asCount(raw.maxTokens) ?? fallback.maxTokens,
+		usedRounds: asCount(raw.usedRounds) ?? 0,
+		usedTokens: asCount(raw.usedTokens) ?? 0
+	};
+}
+/** 净化一轮历史快照。 */
+function sanitizeSnapshot(value, index, allowed) {
+	if (value === null || typeof value !== "object") return void 0;
+	const raw = value;
+	const rawDefects = Array.isArray(raw.defects) ? raw.defects : [];
+	const defects = [];
+	for (const [position, item] of rawDefects.entries()) {
+		const defect = sanitizeDefect(item, position, allowed);
+		if (defect !== void 0) defects.push(defect);
+	}
+	const intensity = raw.intensity === "quick" || raw.intensity === "deep" ? raw.intensity : "standard";
+	const snapshot = {
+		pass: asCount(raw.pass) ?? index + 1,
+		subject: asText(raw.subject, 2e4) ?? "",
+		stanceText: asText(raw.stanceText, 2e3) ?? "",
+		dimensions: Array.isArray(raw.dimensions) ? raw.dimensions.filter((item) => typeof item === "string") : [...allowed],
+		intensity,
+		defects,
+		finishedAt: asCount(raw.finishedAt) ?? Date.now()
+	};
+	const revisedSummary = asText(raw.revisedSummary, 2e3);
+	if (revisedSummary !== void 0) snapshot.revisedSummary = revisedSummary;
+	return snapshot;
+}
+/**
+* 把任意一份读出来的记录收敛成当前 schema 的**完整可用**记录。
+*
+* @param raw - 磁盘上读到的原始值（可能来自旧版本、可能被人手改坏）。
+* @param reviewId - 目录名（权威 id：即使文件里写的 id 不一致也以目录为准）。
+*/
+function normalizeRecord(raw, reviewId) {
+	const source = raw !== null && typeof raw === "object" ? raw : {};
+	const now = Date.now();
+	const schemaVersion = CURRENT_SCHEMA_VERSION;
+	const intensity = source.intensity === "quick" || source.intensity === "deep" ? source.intensity : "standard";
+	const spec = INTENSITY_SPECS[intensity];
+	const dimensions = Array.isArray(source.dimensions) ? source.dimensions.filter((item) => typeof item === "string" && item.trim() !== "").map((item) => item.trim().slice(0, 32)).filter((item, index, all) => all.indexOf(item) === index) : [];
+	const allowed = dimensions.length > 0 ? dimensions : [...DIMENSION_POOL];
+	const defects = [];
+	if (Array.isArray(source.defects)) for (const [index, item] of source.defects.entries()) {
+		const defect = sanitizeDefect(item, index, allowed);
+		if (defect !== void 0) defects.push(defect);
+	}
+	const experts = [];
+	if (Array.isArray(source.experts)) for (const item of source.experts) {
+		const expert = sanitizeExpert(item);
+		if (expert !== void 0) experts.push(expert);
+	}
+	const history = [];
+	if (Array.isArray(source.history)) for (const [index, item] of source.history.entries()) {
+		const snapshot = sanitizeSnapshot(item, index, allowed);
+		if (snapshot !== void 0) history.push(snapshot);
+	}
+	const status = source.status === "attacking" || source.status === "judging" || source.status === "settled" ? source.status : "draft";
+	const reviewPass = Math.max(1, asCount(source.reviewPass) ?? 1);
+	const maxReviewPass = Math.max(1, asCount(source.maxReviewPass) ?? spec.maxReviewPass);
+	const record = {
+		schemaVersion,
+		reviewId,
+		status,
+		subject: sanitizeSubject(source.subject),
+		stance: sanitizeStance(source.stance, now),
+		dimensions: allowed,
+		intensity,
+		experts,
+		defects,
+		reviewPass,
+		maxReviewPass,
+		history,
+		budget: sanitizeBudget(source.budget, {
+			maxRounds: 6,
+			maxTokens: 15e4,
+			usedRounds: 0,
+			usedTokens: 0
+		}),
+		startedAt: asCount(source.startedAt) ?? now,
+		updatedAt: asCount(source.updatedAt) ?? now
+	};
+	const sourceMeeting = asText(source.sourceMeeting, 128);
+	if (sourceMeeting !== void 0) record.sourceMeeting = sourceMeeting;
+	const ownerSessionId = asText(source.ownerSessionId, 128);
+	if (ownerSessionId !== void 0) record.ownerSessionId = ownerSessionId;
+	const settledAt = asCount(source.settledAt);
+	if (settledAt !== void 0) record.settledAt = settledAt;
+	return record;
+}
+/** 按输入构造一份全新的记录（status 恒为 `draft`）。 */
+function newRecord(input) {
+	const now = input.now ?? Date.now();
+	const spec = INTENSITY_SPECS[input.intensity];
+	const stanceText = (input.stanceText ?? "").trim().slice(0, 2e3);
+	const subject = {
+		title: input.title.trim().slice(0, 200) || "未命名评审",
+		content: input.content.trim().slice(0, 2e4),
+		source: input.source
+	};
+	if (input.sourceRef !== void 0 && input.sourceRef !== "") subject.sourceRef = input.sourceRef;
+	const record = {
+		schemaVersion: CURRENT_SCHEMA_VERSION,
+		reviewId: input.reviewId,
+		status: "draft",
+		subject,
+		stance: {
+			text: stanceText,
+			origin: "manual",
+			updatedAt: now
+		},
+		dimensions: input.dimensions.length > 0 ? [...input.dimensions] : [...DIMENSION_POOL],
+		intensity: input.intensity,
+		experts: [],
+		defects: [],
+		reviewPass: 1,
+		maxReviewPass: spec.maxReviewPass,
+		history: [],
+		budget: {
+			maxRounds: input.maxRounds,
+			maxTokens: input.maxTokens,
+			usedRounds: 0,
+			usedTokens: 0
+		},
+		startedAt: now,
+		updatedAt: now
+	};
+	if (input.sourceMeeting !== void 0 && input.sourceMeeting !== "") record.sourceMeeting = input.sourceMeeting;
+	if (input.ownerSessionId !== void 0 && input.ownerSessionId !== "") record.ownerSessionId = input.ownerSessionId;
+	return record;
+}
+/** 读一场评审；缺失或损坏都返回 undefined。 */
+async function readRecord(stateRoot, reviewId) {
+	const raw = await readJsonFile(reviewFile(stateRoot, reviewId));
+	if (raw === void 0) return void 0;
+	return normalizeRecord(raw, reviewId);
+}
+/** 写一场评审（自动刷新 updatedAt）。 */
+async function writeRecord(stateRoot, record) {
+	record.updatedAt = Date.now();
+	await writeJsonAtomic(reviewFile(stateRoot, record.reviewId), record);
+}
+/** 读发言记录（坏行计数一并返回，不许静默吞掉）。 */
+async function readTranscriptReport(stateRoot, reviewId) {
+	const report = await readJsonLines(transcriptFile(stateRoot, reviewId));
+	return {
+		items: report.items.filter((item) => item !== null && typeof item === "object" && typeof item.content === "string" && item.content.trim() !== ""),
+		malformed: report.malformed
+	};
+}
+/** 追加一条专家发言。 */
+async function appendTranscript(stateRoot, reviewId, utterance) {
+	await appendJsonLine(transcriptFile(stateRoot, reviewId), utterance);
+}
+/**
+* 在锁内读-改-写一场评审。
+*
+* @returns 变更函数的返回值；记录不存在时返回 undefined。
+*/
+async function mutateRecord(stateRoot, reviewId, mutate) {
+	return await withCrossfireLock(reviewLockKey(stateRoot, reviewId), async () => {
+		const record = await readRecord(stateRoot, reviewId);
+		if (record === void 0) return void 0;
+		const result = mutate(record);
+		await writeRecord(stateRoot, record);
+		return result;
+	});
+}
+/**
+* 设置一条缺陷的三态（可互切）。
+*
+* 驳回必须给理由 —— 这条约束同时是"用户在想什么"这一信息的唯一来源，
+* 因此它在数据层就被强制，而不是只靠界面拦。
+*
+* @returns true = 确有变更；false = 记录/缺陷不存在，或状态本来就相同。
+*/
+async function setDefectStatus(stateRoot, reviewId, defectId, status, rejectReason) {
+	const reason = (rejectReason ?? "").trim();
+	if (status === "rejected" && reason === "") throw new Error("rejecting a defect requires a non-empty reason");
+	return await mutateRecord(stateRoot, reviewId, (record) => {
+		const defect = record.defects.find((candidate) => candidate.id === defectId);
+		if (defect === void 0) return false;
+		if (defect.status === status && (status !== "rejected" || defect.rejectReason === reason)) return false;
+		defect.status = status;
+		if (status === "rejected") defect.rejectReason = reason.slice(0, 500);
+		return true;
+	}) === true;
+}
+/** 设置一条核对项的复审核对结论。 */
+async function setRecheckVerdict(stateRoot, reviewId, defectId, verdict, note) {
+	return await mutateRecord(stateRoot, reviewId, (record) => {
+		const defect = record.defects.find((candidate) => candidate.id === defectId);
+		if (defect === void 0) return false;
+		const pass = Math.max(1, record.reviewPass - 1);
+		const trimmed = (note ?? "").trim();
+		defect.recheck = trimmed === "" ? {
+			pass,
+			verdict
+		} : {
+			pass,
+			verdict,
+			note: trimmed.slice(0, 500)
+		};
+		return true;
+	}) === true;
+}
+/** 统计三态。 */
+function countDefects(record) {
+	let pending = 0;
+	let endorsed = 0;
+	let rejected = 0;
+	let strikes = 0;
+	for (const defect of record.defects) {
+		if (defect.status === "endorsed") endorsed += 1;
+		else if (defect.status === "rejected") rejected += 1;
+		else pending += 1;
+		if (defect.strikesStance === true) strikes += 1;
+	}
+	return {
+		total: record.defects.length,
+		pending,
+		endorsed,
+		rejected,
+		strikes
+	};
+}
+/** 已认定缺陷清单（定稿时固化的 known-flaws）。 */
+function knownFlaws(record) {
+	return record.defects.filter((defect) => defect.status === "endorsed");
+}
+/** 归一化用于比较的文本：去空白与标点、统一小写。 */
+function compareKey(text$1) {
+	return text$1.replace(/[\s\u3000]+/g, "").replace(/[，。、；：！？"'“”‘’（）()\[\]【】《》<>—\-·…,.!?;:]/g, "").toLowerCase();
+}
+/**
+* 两条缺陷是否应视为"同一条"。
+*
+* 两档判据（刻意不同，因为代价不对称）：
+* - **完全相同**（规范化后）→ 同一条，**哪怕它很短**。"缺日志"就是"缺日志"，
+*   用户驳回过它，就不该第二次弹出来。
+* - **部分包含** → 只有较短一方 ≥ 8 个字符时才敢判。否则"缺日志"会把
+*   "缺日志且没有轮转机制" 这类同族但不同的缺陷一起吞掉 —— 漏报一条真缺陷，
+*   比多弹一条重复项严重得多。
+*/
+function isSameDefect(a, b) {
+	const x = compareKey(a);
+	const y = compareKey(b);
+	if (x === "" || y === "") return false;
+	if (x === y) return true;
+	const shorter = x.length <= y.length ? x : y;
+	const longer = x.length <= y.length ? y : x;
+	if (shorter.length < 8) return false;
+	return longer.includes(shorter);
+}
+/** 历史上被用户**驳回**过的全部缺陷内容（用于"不再重复弹同一观点"）。 */
+function rejectedContents(record) {
+	const out = [];
+	for (const snapshot of record.history) for (const defect of snapshot.defects) if (defect.status === "rejected") out.push(defect.content);
+	for (const defect of record.defects) if (defect.status === "rejected") out.push(defect.content);
+	return out;
+}
+/** 上一轮（history 的最后一轮）中已被用户**认定**的缺陷。 */
+function lastEndorsedDefects(record) {
+	const previous = record.history[record.history.length - 1];
+	if (previous === void 0) return [];
+	return previous.defects.filter((defect) => defect.status === "endorsed");
+}
+/**
+* 复审开轮：把上一轮已认定的缺陷变成本轮的"修复核对项"。
+*
+* 语义（R7）：复审**只核对旧账**，不许开新战线。所以本轮的缺陷集合不是清的，
+* 而是被这些核对项替换。
+*
+* **刻意不预置 `verdict`**：开轮时机器不替人下结论。此前这里写死
+* `verdict: 'unfixed'`（"未被证明修复之前都算没修"），结果是复审轮一打开，
+* 三态按钮里"未修复"就已经是高亮选中态，而备注框旁的保存按钮会把这个机器默认值
+* 当作人的表态落库（红队评审抓出的真实缺陷）。现在缺席即"尚未判断"，由人来选。
+*/
+function buildRecheckItems(record) {
+	const previousPass = Math.max(1, record.reviewPass - 1);
+	return lastEndorsedDefects(record).map((defect) => ({
+		id: defect.id,
+		utteranceId: defect.utteranceId,
+		expertKey: defect.expertKey,
+		content: defect.content,
+		dimension: defect.dimension,
+		...defect.dimensionFallback === true ? { dimensionFallback: true } : {},
+		...defect.quote === void 0 ? {} : { quote: defect.quote },
+		...defect.evidence === void 0 ? {} : { evidence: defect.evidence },
+		status: "endorsed",
+		ts: Date.now(),
+		seq: defect.seq,
+		recheck: { pass: previousPass }
+	}));
+}
+/**
+* 过滤掉"上一轮已被驳回"的候选缺陷。
+*
+* 这是 D8 允许的唯一历史用法：提升信噪比。**绝不**把用户偏好告诉红队 ——
+* 模型一旦知道用户历史上总驳回某类观点，就会干脆不提那类问题，系统性削弱
+* 对抗强度，与这个插件存在的理由正好相反。
+*/
+function dropRejectedDuplicates(candidates, pastRejected) {
+	if (pastRejected.length === 0) return {
+		kept: candidates,
+		dropped: 0
+	};
+	const kept = [];
+	let dropped = 0;
+	for (const candidate of candidates) {
+		if (pastRejected.some((rejected) => isSameDefect(candidate.content, rejected))) {
+			dropped += 1;
+			continue;
+		}
+		kept.push(candidate);
+	}
+	return {
+		kept,
+		dropped
+	};
+}
+
+//#endregion
+//#region src/expert-events.ts
+/** childId → 评审位置。进程内，理由见模块注释。 */
+const expertIndex = /* @__PURE__ */ new Map();
+/** 记住一位刚被拉起的专家属于哪场评审。 */
+function registerExpertChild(childId, location) {
+	if (childId === "") return;
+	expertIndex.set(childId, location);
+}
+/** 按子会话 id 查一位专家的评审位置。 */
+function locateExpertChild(childId) {
+	return expertIndex.get(childId);
+}
+/**
+* 宽限查询：索引里没有就等一个极短窗口再查一次。
+*
+* ## 为什么需要它（红队在真实评审里抓到的竞态）
+*
+* 索引是在 `spawnExpert` **返回之后**才登记的，而宿主的 `startContinuable` 文档
+* 写明它"resolve at initial idle" —— 也就是说子代理可能在 `spawnExpert` 返回的
+* 那一瞬间就已经跑完第一轮并提交了发言。这几毫秒的窗口里：
+*
+* - `crossfire_report` 查不到归属 → 抛"你不在任何评审里"，专家的产出直接丢掉；
+* - `subagent/end` 查不到归属 → 被当作"不属于任何评审"丢弃，专家永远停在 running。
+*
+* 概率极低（需要专家在几毫秒内完成整轮），但代价是**丢掉一整位专家的工作**，而且
+* 它无法复现、无法从外部诊断。所以这里不是掩盖问题，而是把这个窗口等过去。
+*
+* @param childId - 子会话 id。
+* @param graceMs - 等待窗口（默认 400ms，仅在一次查不到时才付出这点时间）。
+*/
+async function locateExpertChildWithGrace(childId, graceMs = 400) {
+	const immediate = expertIndex.get(childId);
+	if (immediate !== void 0) return immediate;
+	await new Promise((resolve) => setTimeout(resolve, graceMs));
+	return expertIndex.get(childId);
+}
+/** 把一条助手输出里的文本块拼起来（没有则返回空串）。 */
+function blocksToText(blocks) {
+	if (blocks === void 0 || blocks.length === 0) return "";
+	const parts = [];
+	for (const block of blocks) {
+		const candidate = block;
+		if (candidate.type === "text" && typeof candidate.text === "string") parts.push(candidate.text);
+	}
+	return parts.join("\n").trim();
+}
+/**
+* 判定一次结束的子代理运行给评审带来了什么。
+*
+* 一个 `completed` 但没有任何文本的运行**不是**硬故障（专家可能只回了一句确认），
+* 所以它有自己的一句措辞 —— 要点是绝不让用户去猜"还在跑"和"已经死了"。
+*/
+function describeExpertEnd(info) {
+	const text$1 = blocksToText(info.lastAssistantMessage);
+	if (text$1 !== "") return {
+		text: text$1,
+		note: ""
+	};
+	const reason = info.stopReason ?? "unknown";
+	return {
+		text: "",
+		note: reason === "completed" ? "本轮结束但没有产出内容（可能只回了确认，未见 crossfire_report）" : `本轮未产出内容（stopReason=${reason}）`
+	};
+}
+/** 一句可读的 provider 请求失败说明。 */
+function describeRequestFailure(provider, failure) {
+	const status = typeof failure?.status === "number" ? ` HTTP ${failure.status}` : "";
+	const code = typeof failure?.code === "string" && failure.code !== "" ? ` ${failure.code}` : "";
+	const message = typeof failure?.message === "string" ? failure.message.trim().slice(0, 200) : "";
+	return `请求失败（provider=${provider}${status}${code}）${message === "" ? "" : `：${message}`}`;
+}
+/** 按 childId 更新专家的状态与备注。 */
+async function writeExpertNote(location, childId, note, status) {
+	await mutateRecord(location.stateRoot, location.reviewId, (record) => {
+		const expert = record.experts.find((candidate) => candidate.childId === childId);
+		if (expert === void 0) return void 0;
+		expert.status = status;
+		expert.note = note;
+	});
+}
+/**
+* 捕获一次结束的专家运行。
+*
+* 有产出：作为 `auto-capture` 发言落盘，并清掉备注 —— 这样即便专家从没调用过
+* `crossfire_report`，它的内容也仍然进了转录。
+* 无产出：留下一条可读的专家备注。
+*/
+async function onExpertEnd(ctx, info) {
+	const childId = String(info.id ?? "");
+	if (childId === "") return;
+	const location = await locateExpertChildWithGrace(childId);
+	if (location === void 0) return;
+	const outcome = describeExpertEnd(info);
+	try {
+		if (outcome.text === "") {
+			await writeExpertNote(location, childId, outcome.note, "silent");
+			return;
+		}
+		let expertKey = "";
+		let pass = 1;
+		await mutateRecord(location.stateRoot, location.reviewId, (record) => {
+			const expert = record.experts.find((candidate) => candidate.childId === childId);
+			if (expert === void 0) return void 0;
+			expertKey = expert.key;
+			pass = record.reviewPass;
+			expert.status = "done";
+			expert.note = void 0;
+			record.budget.usedTokens += estimateTokens(outcome.text);
+		});
+		if (expertKey === "") return;
+		const utterance = {
+			id: randomUUID(),
+			expertKey,
+			kind: "auto-capture",
+			content: outcome.text,
+			pass,
+			ts: Date.now()
+		};
+		await appendTranscript(location.stateRoot, location.reviewId, utterance);
+	} catch (error) {
+		ctx.logger.warn(`crossfire: capturing output of expert ${childId} failed: ${String(error)}`);
+	}
+}
+/** 记住每位专家最近一次 provider 失败（可观测性，不做恢复）。 */
+function onRequestError(ctx, payload) {
+	const agentId = String(payload.agent?.id ?? "");
+	if (agentId === "") return;
+	const location = locateExpertChild(agentId);
+	if (location === void 0) return;
+	writeExpertNote(location, agentId, describeRequestFailure(String(payload.provider ?? ""), payload.failure), "failed").catch((error) => {
+		ctx.logger.warn(`crossfire: recording request failure of expert ${agentId} failed: ${String(error)}`);
+	});
+}
+/**
+* 订阅两个让专家产出与专家失败变得可见的宿主事件。
+*
+* 刻意非侵入：`subagent/end` 是普通 emit；`agent/request-error` 是 waterfall
+* 监听器，且**永远通过 `next()` 委托**，因此宿主自己的重试/恢复策略完全不受影响
+* —— 本插件只观察。
+*/
+function attachExpertEvents(ctx) {
+	ctx.on("subagent/end", (info) => {
+		onExpertEnd(ctx, info);
+	});
+	ctx.on("agent/request-error", (payload, next) => {
+		try {
+			onRequestError(ctx, payload);
+		} catch {}
+		return next();
+	});
+}
+
+//#endregion
+//#region src/etag.ts
+/** 计算一个内容摘要，用作 ETag 的取值（不带引号，由调用方按需包）。 */
+function contentDigest(body) {
+	return createHash("sha1").update(body).digest("hex");
+}
+/**
+* 发送一个 JSON 响应，并在内容未变时改发 `304 Not Modified`。
+*
+* @param requestHeaders - 入站请求头（读 `if-none-match`）。
+* @returns `true` 表示请求已被处理（200 或 304 都已发出）；调用方**不要**再写响应。
+*
+* 两条边界：
+* - **没有 `if-none-match` 时行为与从前逐字相同**（只是多一个 ETag 头），所以这是
+*   可增量上线的改动；客户端不需要同时改。
+* - `cache-control` 用 `no-cache` 而不是 `no-store`：前者允许浏览器存副本但**每次
+*   都必须回源校验**（我们因此能收到 `if-none-match`），语义上依然是"不直接用陈旧
+*   数据"。`no-store` 会让浏览器根本不存，ETag 也就永远不会被回传。
+*/
+function sendJsonConditional(requestHeaders, res, payload, status = 200) {
+	const body = JSON.stringify(payload);
+	const etag = `"${contentDigest(body)}"`;
+	const ifNoneMatch = requestHeaders["if-none-match"];
+	const sent = Array.isArray(ifNoneMatch) ? ifNoneMatch.join(",") : ifNoneMatch ?? "";
+	if (sent !== "" && sent.split(",").map((part) => part.trim()).includes(etag)) {
+		res.writeHead(304, {
+			etag,
+			"cache-control": "no-cache"
+		});
+		res.end();
+		return true;
+	}
+	res.writeHead(status, {
+		"content-type": "application/json; charset=utf-8",
+		etag,
+		"cache-control": "no-cache"
+	});
+	res.end(body);
+	return true;
+}
+
+//#endregion
+//#region src/prompt.ts
+/**
+* 注入全局系统提示的用法段落（纯文本模块，体积可被测试断言）。
+*
+* 与圆桌会议的 `prompt.ts` 关键差异：这里**没有**主持人编排协议。圆桌要求模型
+* 按轮次统筹、转述、聚合；针锋的推进由卡片按钮经 RPC 直推 host 状态机完成，
+* 模型不是编排者。所以这段文字交代的是：针锋是什么、四条不可越界的边界、工具
+* 清单与调用顺序，以及**什么时候不该用它**。
+*
+* @module dsh-plugin-crossfire/prompt
+*/
+/** 七步编排与那一条不可越界的规则。 */
+const USAGE_STEPS = [
+	"1. `crossfire_open` —— 把待验证对象摆上台（标题 + 正文 + 维度 + 强度，可选立场）。状态 `draft`。",
+	"2. `crossfire_stance`（可选但强烈建议）—— 写入\"用户的立场与理由\"。用户自己写最好；他没写就**从对话提炼**并传 `distilled=true`，但**绝不虚构**他没表达过的立场（虚构的立场等于给红队一个假靶子）。有了立场，每条红队缺陷都必须回应其中一条理由，并标注是否被打穿。用户随时可以在卡片上改。",
+	"3. `crossfire_attack` —— 按维度拉起只读红队专家。状态 `attacking`。",
+	"4. `crossfire_collect` —— 把专家发言拆成逐条可裁决的缺陷（自动过滤过程叙述、归一化维度、去掉用户上轮驳回过的重复项）。状态 `judging`。",
+	"5. **等人在卡片上逐条表态**。这一步没有工具可代劳。",
+	"6. `crossfire_finish` —— 定稿，把已认定缺陷固化为 known-flaws 清单并写入历史。状态 `settled`。",
+	"7. `crossfire_recheck` —— 复审：只核对上一轮已认定的缺陷是否修复，**不许开新战线**；`crossfire_export` 导出 Markdown。"
+];
+/**
+* 当前版本的用法段落。
+*/
+function usageSectionText() {
+	return [
+		"## 针锋 Crossfire（对抗式评审）",
+		"",
+		"针锋只做一件事：把一个**已经定稿**的成果或方案摆上台，让若干红队专家从指定维度分头攻击，把攻击拆成逐条可裁决的缺陷。",
+		"",
+		"四条边界（不要越界，越界即破坏了它存在的意义）：",
+		"",
+		"1. **表态永远由人做。** 不存在\"代表认定缺陷\"的工具，也不该替你认定。认定 / 驳回只能由用户在卡片上操作。",
+		"2. **针锋不产出方案、不改代码、不自动修复。** 它是验收器，不是执行器。",
+		"3. **红队专家只读。** 它们的工具被限制为只读检索（read / read_image / glob / grep）加一个 `crossfire_report`：只挑错，不动工作区。",
+		"4. **不许把用户偏好喂给红队。** 历史表态记录只用于去重与复审递进，绝不用来塑造专家对\"用户喜欢什么\"的预期。",
+		"",
+		"### 编排（七步，每步可单独重试）",
+		"",
+		...USAGE_STEPS,
+		"",
+		"### 什么时候该用 / 不该用",
+		"",
+		"- **该用**：一个方案、一段设计、一份清单**已经定稿**，你或用户想知道它在哪些地方站不住。",
+		"- **该用**：需要\"逐条可追溯的判断\"而不是一句\"看起来还行\"——每条缺陷都有来源专家、维度与证据分级，用户逐条认定或驳回。",
+		"- **不该用**：还处在\"要做什么\"的阶段。针锋不产出方案，此时应该先正常讨论再定稿。",
+		"- **不该用**：需要多 agent 分工把活干完。那是协作型团队的场景；针锋的专家不写代码、不产出交付物。",
+		"",
+		"### 两条容易搞错的细节",
+		"",
+		"- `crossfire_attack` 返回之后专家**仍在跑**：它是后台子代理，`crossfire_collect` 之前请确认它们已经提交（卡片上会显示每位专家的状态）。",
+		"- 用户在卡片上的表态**随时可能发生**，也可能一直不发生。不要在用户没表态时反复调用 `crossfire_finish` 催结论——未完成的清单就是未完成，那是刻意的。"
+	].join("\n");
+}
+
+//#endregion
+//#region src/preferences.ts
+/**
+* 解析 DeepSeek Harness home。
+*
+* 与宿主 `@deepseek-ai/dsh-home-paths` 的 `resolveDshHome` 优先级对齐：
+* `configured` > `$DSH_HOME` > `~/.dsh`。第一级做不到（它是宿主进程内部传入的
+* 显式覆盖，插件拿不到），但环境变量与默认值这两级完全一致。
+*
+* 刻意**不**静态 import `@deepseek-ai/dsh-home-paths`：那会把它变成加载门禁，
+* 而本模块只是要一个路径。
+*/
+function dshHomeDir() {
+	const fromEnv = process.env.DSH_HOME?.trim();
+	if (fromEnv !== void 0 && fromEnv !== "") return fromEnv;
+	return join(homedir(), ".dsh");
+}
+/** 偏好文件的绝对路径（DSH home 下的 `crossfire/preferences.json`）。 */
+function preferencesFilePath() {
+	return join(dshHomeDir(), "crossfire", "preferences.json");
+}
+/** 没有任何持久化数据时的偏好。`defaultIntensity` 由调用方按插件 Config 覆盖。 */
+function defaultPreferences(defaultIntensity) {
+	return {
+		defaultIntensity,
+		maxRounds: 6,
+		maxTokens: 15e4,
+		expertMaxTokens: 0,
+		expertMaxOpinions: 3,
+		customDimensions: [],
+		rolePresets: [],
+		squads: [],
+		dismissedHints: {}
+	};
+}
+/** 自定义维度的硬上限（客户端与服务端共用；服务端截断，客户端提前拦截）。 */
+const CUSTOM_DIMENSION_MAX = 12;
+/** 单条维度名的最大长度。 */
+const DIMENSION_NAME_MAX = 12;
+/**
+* 把任意输入收敛成合法的自定义维度清单。
+*
+* 三条规则：空/超长丢弃；与固定池重名的丢弃（池内的不算"自定义"，否则界面上
+* 会出现两个"安全"）；去重且截断到上限。
+*/
+function sanitizeCustomDimensions(value) {
+	if (!Array.isArray(value)) return [];
+	const pool = DIMENSION_POOL;
+	const out = [];
+	for (const item of value) {
+		const raw = typeof item === "string" ? item.trim() : "";
+		if (raw === "" || raw.length > DIMENSION_NAME_MAX) continue;
+		if (pool.includes(raw) || out.includes(raw)) continue;
+		out.push(raw);
+		if (out.length >= CUSTOM_DIMENSION_MAX) break;
+	}
+	return out;
+}
+/** 角色预设条目的硬上限。 */
+const ROLE_PRESET_MAX = 50;
+/** 阵容条目的硬上限。 */
+const SQUAD_MAX = 20;
+/** 单个阵容的成员上限。 */
+const SQUAD_MEMBER_MAX = 8;
+/** 名称/角色说明的最大长度。 */
+const TEXT_MAX = 120;
+/** 把任意输入收敛成合法的角色预设清单（缺 name/role 的条目直接丢弃）。 */
+function sanitizeRolePresets(value) {
+	if (!Array.isArray(value)) return [];
+	const out = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const item of value) {
+		const entry = item !== null && typeof item === "object" ? item : {};
+		const id = typeof entry.id === "string" ? entry.id.trim() : "";
+		const name$1 = typeof entry.name === "string" ? entry.name.trim().slice(0, TEXT_MAX) : "";
+		const role = typeof entry.role === "string" ? entry.role.trim().slice(0, TEXT_MAX) : "";
+		if (id === "" || name$1 === "" || role === "" || seen.has(id)) continue;
+		seen.add(id);
+		const preset = {
+			id,
+			name: name$1,
+			role
+		};
+		if (typeof entry.provider === "string" && entry.provider.trim() !== "") preset.provider = entry.provider.trim();
+		if (typeof entry.model === "string" && entry.model.trim() !== "") preset.model = entry.model.trim();
+		out.push(preset);
+		if (out.length >= ROLE_PRESET_MAX) break;
+	}
+	return out;
+}
+/** 阵容成员 key 的合法化（小写、去空白；空则丢弃）。 */
+function sanitizeMemberKey(value) {
+	const raw = typeof value === "string" ? value.trim().toLowerCase() : "";
+	return /^[a-z0-9][a-z0-9_-]*$/.test(raw) ? raw.slice(0, 32) : "";
+}
+/** 把任意输入收敛成合法的阵容清单。 */
+function sanitizeSquads(value) {
+	if (!Array.isArray(value)) return [];
+	const out = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const item of value) {
+		const entry = item !== null && typeof item === "object" ? item : {};
+		const id = typeof entry.id === "string" ? entry.id.trim() : "";
+		const name$1 = typeof entry.name === "string" ? entry.name.trim().slice(0, TEXT_MAX) : "";
+		if (id === "" || name$1 === "" || seen.has(id)) continue;
+		const rawMembers = Array.isArray(entry.members) ? entry.members : [];
+		const members = [];
+		const memberKeys = /* @__PURE__ */ new Set();
+		for (const rawMember of rawMembers) {
+			const member = rawMember !== null && typeof rawMember === "object" ? rawMember : {};
+			const key = sanitizeMemberKey(member.key);
+			if (key === "" || memberKeys.has(key)) continue;
+			memberKeys.add(key);
+			const sanitized = {
+				key,
+				role: typeof member.role === "string" ? member.role.trim().slice(0, TEXT_MAX) : ""
+			};
+			if (typeof member.provider === "string" && member.provider.trim() !== "") sanitized.provider = member.provider.trim();
+			if (typeof member.model === "string" && member.model.trim() !== "") sanitized.model = member.model.trim();
+			members.push(sanitized);
+			if (members.length >= SQUAD_MEMBER_MAX) break;
+		}
+		if (members.length === 0) continue;
+		seen.add(id);
+		out.push({
+			id,
+			name: name$1,
+			members
+		});
+		if (out.length >= SQUAD_MAX) break;
+	}
+	return out;
+}
+/**
+* 四个数字字段共用的净化规则：**0 = 不限制**，只接受非负整数，并夹到上限
+* 避免误填一个天文数字。
+*
+* 为什么四个字段必须同规则：设置页对这四个字段都写着「0 = 不限制」。如果
+* `maxTokens` 单独要求 ≥1000，用户填 0 就会被静默拒绝并退回旧值 —— 界面显示
+* 一个数、实际生效另一个数，是最难被用户理解的一类失败。
+*/
+function clampLimit(value) {
+	if (typeof value !== "number" || !Number.isFinite(value)) return void 0;
+	const n = Math.floor(value);
+	if (n < 0) return void 0;
+	return Math.min(n, 5e5);
+}
+/**
+* 把任意一层输入叠加到基准偏好上。
+*
+* 与 {@link defaultPreferences} 的分工：`base` 是"当前生效值"，`layer` 是"这次
+* 提交的部分更新"。缺字段一律沿用 base，非法字段一律退回 base（而不是默认值）
+* —— 这样一次错误的提交不会把用户的其它设置顺手清掉。
+*/
+function normalizePreferences(layer, base) {
+	const raw = layer !== null && typeof layer === "object" ? layer : {};
+	const pick = (key, fallback, accept) => {
+		if (!(key in raw)) return fallback;
+		const accepted = accept(raw[key]);
+		return accepted === void 0 ? fallback : accepted;
+	};
+	const asIntensity = (value) => value === "quick" || value === "standard" || value === "deep" ? value : void 0;
+	return {
+		defaultIntensity: pick("defaultIntensity", base.defaultIntensity, asIntensity),
+		maxRounds: pick("maxRounds", base.maxRounds, clampLimit),
+		maxTokens: pick("maxTokens", base.maxTokens, clampLimit),
+		expertMaxTokens: pick("expertMaxTokens", base.expertMaxTokens, clampLimit),
+		expertMaxOpinions: pick("expertMaxOpinions", base.expertMaxOpinions, clampLimit),
+		customDimensions: pick("customDimensions", base.customDimensions, sanitizeCustomDimensions),
+		rolePresets: pick("rolePresets", base.rolePresets, sanitizeRolePresets),
+		squads: pick("squads", base.squads, sanitizeSquads),
+		dismissedHints: pick("dismissedHints", base.dismissedHints, sanitizeDismissedHints)
+	};
+}
+/** 已关闭说明的键长度上限（键是代码里的常量，不是用户输入）。 */
+const DISMISSED_HINT_KEY_MAX = 64;
+/** 已关闭说明的条数上限 —— 防止有人用 prefs.patch 往里塞无上限的垃圾。 */
+const DISMISSED_HINT_MAX = 100;
+/**
+* 把任意输入收敛成"已关闭说明"的键集。
+*
+* 规则：键必须是非空短字符串、值必须是 `true`（只记"关掉了"这一事实，不存别的东西）、
+* 去重并截断。存 `true` 而不是存时间戳，是因为界面只需要回答"要不要显示这一段"。
+*/
+function sanitizeDismissedHints(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return void 0;
+	const out = {};
+	let count = 0;
+	for (const [key, flag] of Object.entries(value)) {
+		if (flag !== true) continue;
+		const trimmed = key.trim();
+		if (trimmed === "" || trimmed.length > DISMISSED_HINT_KEY_MAX) continue;
+		if (out[trimmed] === true) continue;
+		out[trimmed] = true;
+		count += 1;
+		if (count >= DISMISSED_HINT_MAX) break;
+	}
+	return out;
+}
+/** 本次可用的完整维度清单：固定池在前，自定义在后。 */
+function effectiveDimensions(prefs) {
+	return [...DIMENSION_POOL, ...prefs.customDimensions];
+}
+/**
+* 创建偏好存储。
+*
+* 读盘是**惰性且异步**的（构造后立刻开始），因此 `get()` 在首次读盘完成前返回
+* 基准值而不是阻塞宿主启动 —— 这也是它比 `ctx.inject(['settings'])` 更稳的地方：
+* 没有可选能力可缺。
+*/
+function createPreferenceStore(options) {
+	const file = options.file ?? preferencesFilePath();
+	let current = options.base;
+	let writeQueue = Promise.resolve();
+	const listeners = /* @__PURE__ */ new Set();
+	const load = (async () => {
+		try {
+			const text$1 = await readFile(file, "utf8");
+			current = normalizePreferences(JSON.parse(text$1), options.base);
+		} catch (error) {
+			if (error.code !== "ENOENT") options.log?.(`crossfire: preferences at ${file} unreadable; using defaults`, error);
+		}
+	})();
+	const publish = (next) => {
+		current = next;
+		for (const listener of listeners) try {
+			listener(next);
+		} catch (error) {
+			options.log?.("crossfire: a preference listener threw", error);
+		}
+	};
+	return {
+		get: () => current,
+		ready: () => load.then(() => void 0),
+		watch(listener) {
+			listeners.add(listener);
+			return () => {
+				listeners.delete(listener);
+			};
+		},
+		async update(patch) {
+			await load;
+			const next = normalizePreferences(patch, current);
+			publish(next);
+			writeQueue = writeQueue.then(async () => {
+				try {
+					await mkdir(dirname(file), { recursive: true });
+					await writeTextAtomic(file, JSON.stringify(next, null, 2));
+				} catch (error) {
+					options.log?.(`crossfire: failed to persist preferences to ${file}`, error);
+				}
+			});
+			await writeQueue;
+			return next;
+		}
+	};
+}
+
+//#endregion
+//#region src/dimensions.ts
+/**
+* 固定池维度的同义词表（中英混合，含常见越界说法）。
+*
+* 顺序有意义：一个词命中多个维度时取**先定义**的那个（例如「迁移」同时像
+* 「数据」与「兼容」，这里判给「数据」，因为 schema/字段迁移是数据面的事）。
+*/
+const DIMENSION_ALIASES = {
+	安全: [
+		"security",
+		"secure",
+		"安全",
+		"安全审查",
+		"权限",
+		"鉴权",
+		"授权",
+		"隐私",
+		"密钥",
+		"凭据",
+		"注入",
+		"漏洞",
+		"攻击面",
+		"越权",
+		"加密",
+		"合规风险"
+	],
+	数据: [
+		"data",
+		"数据",
+		"schema",
+		"字段",
+		"表结构",
+		"迁移",
+		"一致性",
+		"持久化",
+		"备份",
+		"丢失",
+		"序列化",
+		"编码"
+	],
+	交互: [
+		"ux",
+		"ui",
+		"交互",
+		"体验",
+		"可用性",
+		"入口",
+		"提示",
+		"文案",
+		"无障碍",
+		"键盘",
+		"布局",
+		"反馈"
+	],
+	性能: [
+		"performance",
+		"perf",
+		"性能",
+		"延迟",
+		"吞吐",
+		"内存",
+		"cpu",
+		"缓存",
+		"并发",
+		"扩展性",
+		"规模",
+		"耗时"
+	],
+	兼容: [
+		"compat",
+		"compatibility",
+		"兼容",
+		"版本",
+		"平台",
+		"windows",
+		"macos",
+		"linux",
+		"浏览器",
+		"宿主",
+		"升级",
+		"跨平台"
+	],
+	流程: [
+		"process",
+		"流程",
+		"发布",
+		"回滚",
+		"部署",
+		"ci",
+		"持续集成",
+		"测试",
+		"验收",
+		"灰度",
+		"评审流程",
+		"协作",
+		"职责"
+	],
+	反例: [
+		"counter",
+		"counterexample",
+		"反例",
+		"边界",
+		"极端",
+		"失败路径",
+		"异常",
+		"空值",
+		"假设",
+		"前提",
+		"反直觉",
+		"误导"
+	]
+};
+/** 规范化：去空白、去包裹引号、小写。 */
+function normalizeKey(value) {
+	return value.replace(/[\s\u3000]+/g, "").replace(/^[「【"'“”『\[(（]+|[」】"'“”』\])）]+$/g, "").toLowerCase();
+}
+/**
+* 把一个自由文本维度收敛到 `allowed` 里。
+*
+* @param raw - 模型/用户给出的原始维度（任意值，非字符串会被当作缺失）。
+* @param allowed - 本次评审实际采用的维度清单（固定池 + 自定义）。
+* @returns 归一化结果；`allowed` 为空时退回固定池。
+*/
+function resolveDimension(raw, allowed) {
+	const pool = allowed.length > 0 ? allowed : DIMENSION_POOL;
+	const source = typeof raw === "string" ? raw : "";
+	const key = normalizeKey(source);
+	if (key === "") return {
+		dimension: pool[0] ?? "其他",
+		fallback: true,
+		how: "default"
+	};
+	for (const candidate of pool) if (source.trim() === candidate) return {
+		dimension: candidate,
+		fallback: false,
+		how: "exact"
+	};
+	for (const candidate of pool) if (normalizeKey(candidate) === key) return {
+		dimension: candidate,
+		fallback: false,
+		how: "normalized"
+	};
+	for (const [poolDimension, aliases] of Object.entries(DIMENSION_ALIASES)) {
+		if (!pool.includes(poolDimension)) continue;
+		if (!aliases.some((alias) => normalizeKey(alias) === key)) continue;
+		return {
+			dimension: poolDimension,
+			fallback: poolDimension !== source.trim(),
+			how: "alias"
+		};
+	}
+	for (const candidate of pool) {
+		const candidateKey = normalizeKey(candidate);
+		if (candidateKey === "") continue;
+		if (key.includes(candidateKey) || candidateKey.includes(key)) return {
+			dimension: candidate,
+			fallback: true,
+			how: "contains"
+		};
+	}
+	return {
+		dimension: pool[0] ?? "其他",
+		fallback: true,
+		how: "default"
+	};
+}
+/**
+* 把一组候选维度收敛成"本次实际采用"的清单。
+*
+* 用于 `crossfire_open`：用户给的维度可能重复、越界、或全是垃圾。结果永远非空
+* （最差退回固定池全集），因为"没有维度"会让分发逻辑无处安放。
+*/
+function resolveDimensions(raw, customAllowed) {
+	const pool = [...DIMENSION_POOL];
+	for (const extra of customAllowed) if (!pool.includes(extra)) pool.push(extra);
+	if (!Array.isArray(raw)) return pool;
+	const out = [];
+	for (const item of raw) {
+		const { dimension } = resolveDimension(item, pool);
+		if (!out.includes(dimension)) out.push(dimension);
+	}
+	return out.length > 0 ? out : pool;
+}
+
+//#endregion
+//#region src/noise.ts
+/**
+* 专家发言的噪音过滤（缺陷收集的第一道闸门）。
+*
+* ## 为什么必须有这一层
+*
+* 圆桌的真实数据里，下面这类**过程叙述**被当成缺陷收进了裁决列表：
+*
+*   `[当前状态] 已收到主持人任务，完成对 17 项清单的四维红队审查；按…`
+*   `[当前状态] 主持人再次派发任务；第一轮 3 条观点已提交（第 7 项语义矛盾 / 批次 10–…`
+*
+* 它们有两个来源：
+*  - 宿主的 `subagent/end` 自动补捕（`kind: 'auto-capture'`）：专家没主动上报结果就
+*    结束了，宿主把它的最后一段话整段当成发言收下 —— 通常只是收尾寒暄或进度叙述；
+*  - 专家自己写的进度汇报：以 `[当前状态]`/`[进度]` 之类的方括号标记开头。
+*
+* 它们不是缺陷，却会挤进用户的表态面：用户被迫对"我收到了任务"点认定或驳回。
+* 判定在这里集中成一处，**缺陷收集侧只调 `isNoiseUtterance`**，规则不外泄。
+*
+* @module dsh-plugin-crossfire/noise
+*/
+/**
+* 行首的进度/状态标记。命中即视为过程叙述，而不是缺陷。
+*
+* 只认**方括号标记在行首**：真正的缺陷正文不会以 `[当前状态]` 开头，而
+* "第 3 步会打印 `[状态]`"这种出现在正文中间的说法不该被误杀 —— 所以
+* 这里刻意不做全文搜索。
+*/
+const PROGRESS_MARKER = /^\s*[\[【]\s*(当前状态|状态|进度|任务|当前任务|汇报|确认)\s*[\]】]/;
+/**
+* 极短发言里的客套话。**只在发言足够短时才生效**（见 rule 4）。
+*
+* 「开始」「已完成确认」这类词单独看毫无信息量；但一条真正的缺陷正文
+* 完全可能包含它们（例如「开始运行前没有做密钥校验」），所以这张表
+* 必须与"长度 ≤ 24"联合判定，不能单独使用。
+*/
+const ACK_PHRASES = [
+	"收到",
+	"明白",
+	"好的",
+	"已收到",
+	"了解",
+	"开始",
+	"已完成确认"
+];
+/** 被认为"极短"的长度上限（按去空白后的字符数）。 */
+const ACK_MAX_LENGTH = 24;
+/** 去空白：所有空白（含全角空格）都折叠掉，便于长度与开头判定。 */
+function squeeze(value) {
+	return value.replace(/[\s\u3000]+/g, "");
+}
+/**
+* 命中的噪音规则名（诊断/测试用；不是噪音时返回 `undefined`）。
+*
+* 按顺序判定，命中即返回：`auto-capture` → `progress-report` → `empty`
+* → `acknowledgement`。
+*/
+function noiseReason(kind, content) {
+	if (kind === "auto-capture") return "auto-capture";
+	if (PROGRESS_MARKER.test(content)) return "progress-report";
+	const squeezed = squeeze(content);
+	if (squeezed === "") return "empty";
+	if (squeezed.length <= ACK_MAX_LENGTH && ACK_PHRASES.some((phrase) => squeezed.includes(phrase))) return "acknowledgement";
+}
+/** 这条发言是否应当被排除在缺陷收集之外。 */
+function isNoiseUtterance(kind, content) {
+	return noiseReason(kind, content) !== void 0;
+}
+
+//#endregion
+//#region src/split.ts
+/** 拆分工具的 JSON schema（防线①）。导出以便测试断言 schema 形状。 */
+const SPLIT_TOOL = {
+	name: "split_crossfire_defect",
+	description: "把一条红队专家发言拆成 1~3 条独立缺陷（每条缺陷只含一个问题）。",
+	parameters: {
+		type: "object",
+		additionalProperties: false,
+		properties: { defects: {
+			type: "array",
+			minItems: 1,
+			maxItems: 3,
+			items: {
+				type: "object",
+				additionalProperties: false,
+				properties: {
+					content: {
+						type: "string",
+						description: "单条缺陷的完整表述。"
+					},
+					quote: {
+						type: "string",
+						description: "发言原文中与该缺陷对应的子串（可选，必须逐字来自发言原文）。"
+					},
+					dimension: {
+						type: "string",
+						description: "缺陷所属维度。必须逐字取自给定清单 allowed 中的一项，不得自创。"
+					},
+					strikes_stance: {
+						type: "boolean",
+						description: "该缺陷是否打穿了用户在「立场」里给出的某条理由。"
+					},
+					evidence: {
+						type: "object",
+						description: "证据分级（C1）：代码/bug 类缺陷填 repro（附可复现步骤 1. 2. 3.）；设计类缺陷填 argument（附论证链，不编造伪复现步骤）。无法给出证据时省略该字段。",
+						additionalProperties: false,
+						properties: {
+							kind: {
+								type: "string",
+								enum: ["repro", "argument"],
+								description: "repro=可复现步骤（代码/bug 类）；argument=论证链（设计类）。"
+							},
+							text: {
+								type: "string",
+								description: "证据正文：复现步骤（编号 1. 2. 3.）或论证链，≤600 字符。"
+							}
+						},
+						required: ["kind", "text"]
+					}
+				},
+				required: ["content", "dimension"]
+			}
+		} },
+		required: ["defects"]
+	}
+};
+const SPLIT_TIMEOUT_MS = 6e4;
+/** 调用 LLM 一次，收集工具调用参数（或文本 JSON）为字符串；失败返回 null。 */
+async function callSplitLlm(llm, config, system, userText) {
+	const controller = new AbortController();
+	const timer = setTimeout(() => controller.abort(), SPLIT_TIMEOUT_MS);
+	try {
+		const deltas = [];
+		let assembled = null;
+		const stream = llm.stream({
+			provider: config.provider,
+			model: config.model,
+			messages: [{
+				id: randomUUID(),
+				role: "user",
+				content: [{
+					type: "text",
+					text: userText
+				}],
+				source: { kind: "user" }
+			}],
+			system,
+			tools: [SPLIT_TOOL],
+			temperature: 0,
+			maxTokens: 1024,
+			signal: controller.signal
+		});
+		for await (const chunk of stream) {
+			const raw$1 = chunk;
+			if (raw$1.type === "tool-call-delta" && typeof raw$1.argumentsDelta === "string") deltas.push(raw$1.argumentsDelta);
+			else if (raw$1.type === "block-end" && raw$1.block?.type === "tool-call" && typeof raw$1.block.arguments === "string") assembled = raw$1.block.arguments;
+			else if (raw$1.type === "text" && typeof raw$1.delta === "string") deltas.push(raw$1.delta);
+			else if (raw$1.type === "text" && typeof raw$1.text === "string") deltas.push(raw$1.text);
+			else if (raw$1.type === "text-delta" && typeof raw$1.text === "string") deltas.push(raw$1.text);
+		}
+		const raw = (assembled ?? deltas.join("")).trim();
+		return raw === "" ? null : raw;
+	} catch {
+		return null;
+	} finally {
+		clearTimeout(timer);
+	}
+}
+/**
+* 本地启发式兜底拆分（零 token、确定性）：红队专家发言通常按
+* "**观点 N（指向 X，维度Y）**" 的固定结构分条，直接按该标记切段，
+* 并从段首括号里提取维度标签。找不到任何观点标记时返回 null，
+* 由调用方整条兜底（seq=0）。
+*/
+const VIEWPOINT_MARKER = /(?:\*{1,2})?\s*观点\s*(\d+)\s*[（(]([^）)]*)[）)]/g;
+const TAIL_SECTION = /\[(?:核心产出|下一步建议)[^\]]*\]/;
+/** 括号里可能出现的维度引导词，去掉它们才剩下维度名。 */
+const DIMENSION_LABEL_WORD = /^(维度|方面|角度|类别|类型)/;
+/**
+* 从段首括号的文字里提取维度，并交给 `resolveDimension` 归一化。
+*
+* 上一版的兜底把括号里的圆圈数字（①）直接当成了维度名，产出 `维度②`
+* 这种垃圾值 —— 真实数据显示 5 份 review.json 里全是这种编号。现在改成：
+* 按分隔符拆成若干候选，取**第一个能被归一化到具体维度**的那段；全都不行时
+* 传空串给 `resolveDimension`，由它给出默认维度（并标 fallback）。
+*/
+function dimensionOfSegmentHead(head, allowed) {
+	const pieces = head.split(/[，,、；;｜|/\s]+/).filter((piece) => piece.trim() !== "");
+	for (const piece of pieces) {
+		const candidate = piece.trim().replace(DIMENSION_LABEL_WORD, "").replace(/[：:]+$/, "");
+		if (candidate === "") continue;
+		const resolved = resolveDimension(candidate, allowed);
+		if (resolved.how !== "default") return {
+			dimension: resolved.dimension,
+			fallback: resolved.fallback
+		};
+	}
+	const fallback = resolveDimension("", allowed);
+	return {
+		dimension: fallback.dimension,
+		fallback: fallback.fallback
+	};
+}
+function splitByMarkers(content, allowed) {
+	const trimmed = content.replace(/\s+/g, " ").trim();
+	if (trimmed === "") return null;
+	const marks = [];
+	VIEWPOINT_MARKER.lastIndex = 0;
+	let m;
+	while ((m = VIEWPOINT_MARKER.exec(trimmed)) !== null) marks.push({
+		start: m.index,
+		end: m.index + m[0].length,
+		label: m[1] ?? "",
+		head: m[2] ?? ""
+	});
+	if (marks.length === 0) return null;
+	const lines = [];
+	for (let i = 0; i < marks.length; i++) {
+		const mark = marks[i];
+		if (mark === void 0) continue;
+		const next = marks[i + 1];
+		const rawEnd = next !== void 0 ? next.start : trimmed.length;
+		let raw = trimmed.slice(mark.end, rawEnd);
+		const tail = raw.search(TAIL_SECTION);
+		if (tail !== -1) raw = raw.slice(0, tail);
+		const text$1 = raw.replace(/^[\s*:：]+/, "").replace(/\s+/g, " ").trim();
+		if (text$1 === "") continue;
+		const { dimension, fallback } = dimensionOfSegmentHead(mark.head, allowed);
+		lines.push({
+			content: `观点 ${mark.label}（${mark.head}）：${text$1}`,
+			dimension,
+			...fallback ? { dimensionFallback: true } : {},
+			quote: void 0
+		});
+	}
+	return lines.length > 0 ? lines : null;
+}
+/**
+* 拆分一条发言为若干独立缺陷；任何失败返回 null（调用方整条兜底）。
+* quote 与发言原文做规范化子串校验（防线③），不匹配即丢弃。
+* dimension 一律过 `resolveDimension`（落库值必须 ∈ allowed）。
+*/
+async function splitUtterance(llm, config, expertKey, content, allowed) {
+	const trimmed = content.replace(/\s+/g, " ").trim();
+	if (trimmed === "") return null;
+	const raw = await callSplitLlm(llm, config, "你是 Crossfire「针锋」评审的缺陷拆分器。把下面一条红队专家发言拆成 1~3 条独立缺陷，每条缺陷只包含一个问题，不得发明原文没有的内容。dimension 必须**逐字取自给定清单 allowed 中的一项**，不得自创标签、不得输出编号；若该缺陷用「立场」中的某条理由打穿了用户的说法，把 strikes_stance 设为 true。对每条缺陷给出证据分级（C1）：代码/bug 类缺陷的 evidence.kind=repro 并写可复现步骤（1. 2. 3.）；设计类缺陷的 evidence.kind=argument 并写论证链——禁止为设计类缺陷编造\"运行某命令即可复现\"这类伪复现步骤。无法从原文提取证据时省略 evidence 字段。必须调用 split_crossfire_defect 工具返回结构化结果。", `本次评审采用的维度清单 allowed（dimension 只能取其中之一）：${allowed.length > 0 ? allowed.join(" / ") : "（未限定，按通用维度判断）"}\n\n专家 ${expertKey} 的发言：\n${trimmed}`);
+	if (raw !== null) {
+		let parsed;
+		try {
+			parsed = JSON.parse(raw);
+		} catch {
+			parsed = void 0;
+		}
+		const list = parsed?.defects;
+		if (Array.isArray(list) && list.length > 0) {
+			const lines = [];
+			for (const item of list) {
+				const obj = item;
+				const line = typeof obj?.content === "string" ? obj.content.replace(/\s+/g, " ").trim() : "";
+				if (line === "") continue;
+				let quote$1;
+				if (typeof obj?.quote === "string") {
+					const candidate = obj.quote.replace(/\s+/g, " ").trim();
+					if (candidate !== "" && candidate.length <= 120 && trimmed.includes(candidate)) quote$1 = candidate;
+				}
+				const resolved = resolveDimension(obj?.dimension, allowed);
+				let evidence;
+				const ev = obj?.evidence;
+				if (ev !== null && typeof ev === "object" && (ev.kind === "repro" || ev.kind === "argument") && typeof ev.text === "string") {
+					const text$1 = ev.text.replace(/\s+/g, " ").trim();
+					if (text$1 !== "") evidence = {
+						kind: ev.kind,
+						text: text$1.slice(0, 600)
+					};
+				}
+				lines.push({
+					content: line,
+					quote: quote$1,
+					dimension: resolved.dimension,
+					...obj?.strikes_stance === true ? { strikesStance: true } : {},
+					...resolved.fallback ? { dimensionFallback: true } : {},
+					evidence
+				});
+				if (lines.length >= Math.max(1, config.maxOpinions)) break;
+			}
+			if (lines.length > 0) return lines;
+		}
+	}
+	return splitByMarkers(trimmed, allowed);
+}
+
+//#endregion
+//#region src/engine.ts
+/**
+* 按强度档与维度算出这一轮要拉起谁。
+*
+* 纯函数（可单测）：同样一份记录 + 同一份 roster 永远得到同一份阵容。规模上限按
+* `record.dimensions` 的顺序截断，所以**用户排在前面的维度优先** —— 这是可预期的，
+* 而不是随机丢人。
+*
+* 人选来源两条，按优先级：
+* 1. `roster` 里 `key` 等于维度名的那一条（精确指定，最符合直觉）；
+* 2. 否则按**顺序**取 roster 的第 i 条（i = 维度序号）—— 用户不必把 key 改名成
+*    维度名也能用上一份现成的阵容；
+* 3. 都取不到时只写维度与状态（专家继承主持人路由、无补充定位），与从前完全一致。
+*
+* @param roster - 可选人选来源；缺席或为空时行为与从前逐字一致。
+*/
+function planExperts(record, maxExperts, roster = []) {
+	const spec = INTENSITY_SPECS[record.intensity];
+	const experts = [];
+	let dimensionIndex = 0;
+	for (const dimension of record.dimensions) {
+		const count = Math.max(1, spec.expertsPerDimension);
+		const matched = roster.find((entry) => entry.key === dimension) ?? roster[dimensionIndex];
+		dimensionIndex += 1;
+		for (let index = 0; index < count; index += 1) {
+			const expert = {
+				key: count === 1 ? dimension : `${dimension}-${index + 1}`,
+				dimension,
+				status: "pending",
+				defectCount: 0
+			};
+			if (matched !== void 0) {
+				if (matched.role !== void 0 && matched.role.trim() !== "") expert.role = matched.role.trim();
+				if (matched.provider !== void 0 && matched.model !== void 0) {
+					expert.provider = matched.provider;
+					expert.model = matched.model;
+				}
+			}
+			experts.push(expert);
+		}
+	}
+	return experts.length > maxExperts ? experts.slice(0, maxExperts) : experts;
+}
+/**
+* 有界并发的 `map`（零依赖）。
+*
+* 为什么需要它：拆分一条发言要打一次 LLM（`split.ts` 每次 60s 超时），而此前是
+* **串行** `await` —— 一场 7 位专家、每人报告 3 次的评审 = 21 次串行往返，收集动作
+* 的墙钟时间 ≈ 21 × 单次往返（十秒级），期间界面只有一个禁用的"收集"按钮，既没有
+* 进度也没有取消（红队评审抓出的性能缺陷）。
+*
+* 并发上限刻意**不高**：这些请求打的是同一个 provider，并发拉满只会撞速率限制、
+* 反而更慢，而且要留出余量给界面自己的请求。
+*
+* 结果顺序与输入**逐位对应**（按下标回填，而不是按完成先后），所以拆出来的缺陷顺序
+* 与串行版本完全一致 —— 这是可测的，见 `test/engine.test.mjs`。
+*/
+async function collectWithConcurrency(items, limit, worker) {
+	const results = new Array(items.length);
+	let cursor = 0;
+	const width = Math.max(1, Math.min(limit, items.length));
+	const workers = Array.from({ length: width }, async () => {
+		while (cursor < items.length) {
+			const index = cursor;
+			cursor += 1;
+			const item = items[index];
+			if (item === void 0) continue;
+			results[index] = await worker(item, index);
+		}
+	});
+	await Promise.all(workers);
+	return results;
+}
+/**
+* 把本轮专家发言收成逐条可裁决的缺陷。
+*
+* 五道处理，顺序有意义：
+* 1. **只收本轮**（`utterance.pass === record.reviewPass`）；
+* 2. **幂等**（`utteranceId` 已收集过就跳过 —— 拆分后 defect.id 会变，不能用作去重键）；
+* 3. **噪音过滤**（`auto-capture` 与进度汇报；真实数据里前者曾被当成缺陷收进裁决面）；
+* 4. **拆分**（LLM 三道防线优先 → 本地标记切分兜底 → 整条兜底 `seq = 0`）；
+* 5. **维度归一化 + 历史去重**（落库维度必须 ∈ 本次采用维度；上轮被驳回的观点不再弹）。
+*
+* 复审轮（`reviewPass > 1` 且已有历史）**不新增缺陷**：那一轮唯一的任务是核对旧账。
+*/
+async function collectDefects(input) {
+	const { record, transcript, llm } = input;
+	const allowed = record.dimensions;
+	const collectedUtterances = new Set(record.defects.map((defect) => defect.utteranceId));
+	const isRecheckRound = record.reviewPass > 1 && record.history.length > 0;
+	const candidates = [];
+	let skippedNoise = 0;
+	let alreadyCollected = 0;
+	const pending = [];
+	for (const utterance of transcript) {
+		if (utterance.pass !== record.reviewPass) continue;
+		if (collectedUtterances.has(utterance.id)) {
+			alreadyCollected += 1;
+			continue;
+		}
+		if (isNoiseUtterance(utterance.kind, utterance.content)) {
+			skippedNoise += 1;
+			continue;
+		}
+		if (isRecheckRound) continue;
+		const content = utterance.content.replace(/\s+/g, " ").trim();
+		if (content === "") continue;
+		pending.push({
+			utterance,
+			content
+		});
+	}
+	/**
+	* 拆一条发言。返回 `usedLlm` 而不是直接改计数器 —— 并发下那会变成共享可变状态。
+	*/
+	const collectOne = async (item, _index, activeLlm) => {
+		if (activeLlm === void 0) return {
+			lines: splitByMarkers(item.content, allowed),
+			usedLlm: false
+		};
+		try {
+			return {
+				lines: await splitUtterance(activeLlm, input.splitConfig, item.utterance.expertKey, item.content, allowed),
+				usedLlm: true
+			};
+		} catch {
+			return {
+				lines: splitByMarkers(item.content, allowed),
+				usedLlm: false
+			};
+		}
+	};
+	const splitResults = await collectWithConcurrency(pending, input.llmConcurrency ?? input.splitConfig.llmConcurrency ?? 4, (item, index) => collectOne(item, index, llm));
+	const splitAttempts = splitResults.filter((item) => item.usedLlm).length;
+	for (const [position, item] of pending.entries()) {
+		const lines = splitResults[position]?.lines ?? splitByMarkers(item.content, allowed);
+		const utterance = item.utterance;
+		if (lines === null) {
+			candidates.push({
+				id: utterance.id,
+				utteranceId: utterance.id,
+				expertKey: utterance.expertKey,
+				content: item.content,
+				dimension: allowed[0] ?? "其他",
+				dimensionFallback: true,
+				status: "pending",
+				ts: utterance.ts,
+				seq: 0
+			});
+			continue;
+		}
+		for (const [index, line] of lines.entries()) {
+			const resolved = resolveDimension(line.dimension, allowed);
+			const defect = {
+				id: `${utterance.id}#${index + 1}`,
+				utteranceId: utterance.id,
+				expertKey: utterance.expertKey,
+				content: line.content,
+				dimension: resolved.dimension,
+				status: "pending",
+				ts: utterance.ts,
+				seq: index + 1
+			};
+			if (line.dimensionFallback === true || resolved.fallback) defect.dimensionFallback = true;
+			if (line.quote !== void 0) defect.quote = line.quote;
+			if (line.evidence !== void 0) defect.evidence = line.evidence;
+			if (line.strikesStance === true) defect.strikesStance = true;
+			candidates.push(defect);
+		}
+	}
+	const { kept, dropped } = dropRejectedDuplicates(candidates, rejectedContents(record));
+	return {
+		added: kept,
+		droppedDuplicates: dropped,
+		skippedNoise,
+		splitAttempts,
+		alreadyCollected,
+		malformedLines: input.malformed
+	};
+}
+/** 把用户偏好里的阵容与角色预设合成一份 roster。 */
+function rosterFrom(input) {
+	const squads = input.squads ?? [];
+	const chosen = (input.squadId === void 0 ? void 0 : squads.find((squad) => squad.id === input.squadId)) ?? (input.squadId === void 0 ? squads[0] : void 0);
+	if (chosen !== void 0 && chosen.members.length > 0) return [...chosen.members];
+	return (input.rolePresets ?? []).map((preset) => ({
+		key: preset.key.trim() !== "" ? preset.key : preset.name ?? "",
+		...preset.role === void 0 ? {} : { role: preset.role },
+		...preset.provider === void 0 ? {} : { provider: preset.provider },
+		...preset.model === void 0 ? {} : { model: preset.model }
+	}));
+}
+/**
+* 把收集结果并入记录（原地修改；调用方负责落盘）。
+*/
+function applyCollected(record, added) {
+	record.defects = [...record.defects, ...added];
+	for (const expert of record.experts) expert.defectCount = record.defects.filter((defect) => defect.expertKey === expert.key).length;
+}
+
+//#endregion
+//#region src/redteam.ts
+/**
+* 红队专家允许使用的工具（全局工具白名单，只有列出的这些保持可见）。
+*
+* 只有 5 个：`read`、`read_image`、`glob`、`grep` 四个只读检索工具，
+* 外加唯一一个写入口 `crossfire_report`（写的是评审自己的 transcript，
+* 不是工作区）。
+*
+* **刻意不给** `write` / `edit` / `bash` / `pwsh` / `web_search` / `web_fetch` /
+* `todo_write` 等。理由（这是本插件最本质的安全边界，不是配置偷懒）：
+* - **只挑错、不动工作区**：评审一旦能改文件，"提缺陷"就会滑向"顺手修好"，
+*   用户拿到的就不再是待裁决的缺陷清单，而是一份未经同意的改动。红队与
+*   "智能体团队"成员最本质的区别就在这里：团队成员有写权限、以交付为目标；
+*   红队没有写权限、以推翻为目标。
+* - **不联网**：外部检索会把评审从"针对眼前这份成果"漂移成"泛泛的行业意见"，
+*   也会引入不可复现的外部依据；针锋要的是针对具体位置的论证与复现。
+* - **不写待办**：红队没有执行阶段，`todo_write` 只会让它开始规划"怎么修"，
+*   直接违反"不产出方案"。
+*
+* 想放开任何一项之前，先回答：放开的那个工具能让专家**证明**一个缺陷，还是
+* 只能让它**动手**？只有前者可以进这张表。
+*/
+const EXPERT_TOOL_ALLOW = [
+	"read",
+	"read_image",
+	"glob",
+	"grep",
+	"crossfire_report"
+];
+/**
+* 红队专家禁止使用的工具（黑名单）。
+*
+* 这里列的是全部**主持人专属**的 `crossfire_*` 工具：开评审、发起攻击、收集
+* 缺陷、定稿、复审、导出。这些都是主持人的编排权，专家一旦能调
+* `crossfire_collect`/`crossfire_finish`，就等于自己给自己结案，"表态由人做"
+* 当场失效。
+*
+* 为什么白名单之外还要再来一份黑名单：两者是**与**关系（必须同时在白名单里
+* 且不在黑名单里才可见）。将来有人为了加一个只读工具而改动
+* {@link EXPERT_TOOL_ALLOW} 时，不会顺带把编排权放开 —— 黑名单这一层与被修改
+* 的那一行无关，能拦住"删一项白名单等于多一份权限"的误操作。
+*
+* **注意**：`crossfire_report` 是**专家自己的**发言工具，绝不能列进本表。
+*/
+const EXPERT_TOOL_DENY = [
+	"crossfire_open",
+	"crossfire_attack",
+	"crossfire_collect",
+	"crossfire_finish",
+	"crossfire_recheck",
+	"crossfire_export",
+	"crossfire_stance"
+];
+/**
+* 专家的工具限制。
+*
+* 每次返回**新的数组实例**，且以 `readonly` 声明：宿主侧可能在拿到后排序或增删，
+* 共用模块级数组会让一次改动污染后续所有专家。黑名单恒为全量主持人工具，
+* 与白名单内容无关 —— 它是与被修改的那一行**无关**的第二道闸。
+*/
+function expertToolRestriction() {
+	return {
+		allow: [...EXPERT_TOOL_ALLOW],
+		deny: [...EXPERT_TOOL_DENY]
+	};
+}
+/**
+* 报告信封的格式说明（persona 与 welcome 共用同一份文本）。
+*
+* 为什么格式必须固定到这个程度：缺陷要能被**逐条裁决**，而裁决面是按条渲染的。
+* 本地兜底切分器（模型没按格式走时的最后一道网）认的就是 `观点 N（指向 …，
+* 维度Y）：` 这个行首标记。标记缺失时整段发言只能作为一条缺陷收进列表，用户
+* 就得面对一团散文去点"认定/驳回" —— 针锋存在的意义当场归零。
+*
+* @param maxOpinions - 最多几条（0 = 不限制），写进语气会随上限收紧。
+*/
+function reportEnvelopeSpec(maxOpinions) {
+	return [
+		"【报告格式】",
+		"你的发言会被逐条切分并交给用户裁决，所以格式是硬要求，不是风格建议。",
+		"每一条缺陷都必须以这样一个标记作为**第 1 行**：",
+		"",
+		"  观点 N（指向 <具体位置>，维度<维度名>）：<这一条缺陷的完整表述>",
+		"",
+		"其中：",
+		"- `N` 从 1 开始连续编号；",
+		"- `<具体位置>` 必须是可定位的东西（文件路径、行号、函数名、章节号、界面元素名、字段名），",
+		"  不能写\"整体\"\"全文\"\"部分实现\"这类无法定位的说法；",
+		"- `维度<维度名>` 写分配给你的维度名，且**只能**写这一个。",
+		"",
+		"标记之后，紧跟下面两行里的**恰好一行**，以及（仅当存在用户立场时）再跟一行立场结论：",
+		"",
+		"  证据（repro）：1. … 2. … 3. …（编号步骤，真的可以照着做）",
+		"  证据（argument）：…（论证链：前提 → 推理 → 结论）",
+		"  针对立场：打穿 / 未打穿",
+		"",
+		`完整发言${maxOpinions > 0 ? `最多 ${maxOpinions} 条` : "条数不限制（但每一条都必须真的站得住，凑数等于自损可信度）"}。多条缺陷之间空一行，每条都从自己的「观点 N（…）：」标记重新开始。`,
+		"",
+		"再次强调：**必须**用 `观点 N（指向 X，维度Y）` 作为每一条的开头。",
+		"否则整段发言会被当成一整条缺陷，用户无法逐条裁决，你这一轮的产出等于作废。"
+	].join("\n");
+}
+/** 非空判定：兼容 `undefined` 与纯空白（"没写立场"比"写了几个空格"更常见）。 */
+function hasText(value) {
+	return value !== void 0 && value.trim() !== "";
+}
+/** 截断到上限，并明确标注被截断（截断不能静默发生）。 */
+function truncate(text$1, max) {
+	const trimmed = text$1.trim();
+	if (trimmed.length <= max) return trimmed;
+	return `${trimmed.slice(0, max)}\n…（此处被截断，需要更多上下文请用只读工具读取原文）`;
+}
+/** 逗号连接（维度不长，用中文顿号更好读）。 */
+function joinList(items) {
+	return items.join("、");
+}
+/** 维度清单兜底：空清单退化为"没有指定"而不是空串（空串会读成语义不明的破句）。 */
+function dimensionList(dimensions) {
+	return dimensions.length > 0 ? joinList(dimensions) : "（未指定）";
+}
+/**
+* 生成红队专家的 persona（系统级人设）。
+*
+* 九条硬约束逐条落在文本里（身份 / 单维度 / 不产出方案 / 不要客套 / 一条一缺陷 /
+* 证据分级 / 立场对攻 / 工具边界 / 不许迎合）。这些约束的共同目标只有一个：
+* 让产出的东西**可以被判定**，而不是听起来很有道理。
+*/
+function expertPersona(input) {
+	const { reviewId, dimension, title, stance, dimensions, maxOpinions } = input;
+	const constraints = [
+		{
+			title: "身份",
+			body: `你是「针锋」评审里负责「${dimension}」维度的红队专家。你的唯一任务是把这份成果打穿。`,
+			why: "你在这里没有中立观察者的位置，也不是来帮忙的：你是最想推翻它的那个人。",
+			anti: "任何\"它大体上是成立的\"这类判断都不是你的产出。"
+		},
+		{
+			title: "只攻击你这一个维度",
+			body: `审稿范围只有「${dimension}」。本次评审的其余维度已经分给了别的专家：${dimensionList(dimensions)}。`,
+			why: "重复覆盖等于浪费一次评审，越界还会让别人负责的维度没人认真盯。",
+			anti: "越界到别人维度的观点会被直接丢弃 —— 那部分话等于没说过。"
+		},
+		{
+			title: "不产出方案",
+			body: "不要给出改进建议、不要写代码、不要重写方案、不要提\"可以这样改\"。",
+			why: "你只负责指出\"哪里站不住\"；修不修、怎么修是别人的事。",
+			anti: "一旦你开始给方案，这个评审就从\"验收\"变成了\"再来一版\"，而\"再来一版\"永远比挑错舒服。"
+		},
+		{
+			title: "不要客套",
+			body: "禁止开场白、禁止总结、禁止致谢、禁止\"总体不错\"\"思路很好\"这类评价。",
+			why: "这些字对用户没有任何可裁决的信息量。",
+			anti: "只输出缺陷本身。你的发言里出现夸奖，就是不合格的发言。"
+		},
+		{
+			title: "每条发言只含一个缺陷",
+			body: maxOpinions > 0 ? `一条缺陷一条发言，最多 ${maxOpinions} 条。` : "一条缺陷一条发言，条数不限制。",
+			why: "缺陷要能被逐条裁决；一条里塞进两个缺陷，用户认定其中一个就没法继续操作。",
+			anti: "\"另外还有一个问题是…\"这种顺手追加，必须拆成新的「观点 N」。"
+		},
+		{
+			title: "证据分级（重要）",
+			body: "代码/行为类缺陷给 `repro`：可复现步骤，用 1. 2. 3. 编号，且必须真的可执行；设计/取舍类缺陷给 `argument`：论证链。",
+			why: "两类缺陷的成立方式根本不同：前者靠\"照做就能看到\"，后者靠\"跟着推理推不掉\"。",
+			anti: "**禁止为设计类缺陷编造\"运行某命令即可复现\"这类伪复现步骤** —— 那是最廉价的红队噪音，它唯一的作用是让一条没想清楚的批评看起来像有证据。宁可只给论证链，也不要伪造步骤。"
+		},
+		{
+			title: "立场对攻",
+			body: hasText(stance) ? "用户已经写下了自己的立场与理由（见下方【用户立场与理由】）。你**必须逐条回应其中的每一条理由**，并在对应缺陷里标注是否**打穿**了它（`strikes_stance: true/false`）。" : "本次没有用户立场文本：不要虚构一个立场来对攻，只按维度攻击。",
+			why: "针锋的\"锋\"就在这里：用户的理由要真的被检验，而不是被绕过去。",
+			anti: "打不穿就如实标 `false`，不要为了讨好而假装打穿；不要只挑最弱的那条理由回应，其余理由回避不谈同样算没回应。"
+		},
+		{
+			title: "工具边界",
+			body: `你只能调 \`crossfire_report\` 提交发言；其余可用工具只有只读检索：${joinList(EXPERT_TOOL_ALLOW.filter((name$1) => name$1 !== "crossfire_report"))}。**你没有写权限，也不要试图修改工作区。**`,
+			why: "红队只挑错、不动工作区，评审的目的是产出待裁决的缺陷，不是产出一份未经同意的改动。",
+			anti: "任何试图写文件、改配置、执行命令的动作都是违规的。"
+		},
+		{
+			title: "不许迎合",
+			body: "不知道就说不知道，不能用猜测填补证据，不能编造行号、报错信息或没读过的文件内容。",
+			why: "历史表态记录只用于去重与复审递进，绝不用来塑造你对\"用户喜欢什么\"的预期。不要揣测用户想听什么，也不要因为你猜测用户偏好某方案就放软，或反过来为了显得努力而硬凑缺陷。",
+			anti: "宣称某处有问题但给不出定位与证据，等于零信息；\"可能是\"\"也许存在\"不算一条缺陷。"
+		}
+	];
+	const lines = [
+		`# 针锋 Crossfire · 红队专家（评审 ${reviewId}，维度：${dimension}）`,
+		"",
+		"## 你的身份",
+		"",
+		`你是「针锋」评审里负责「${dimension}」维度的红队专家。你的唯一任务是把这份成果打穿。`,
+		"",
+		"「针锋」只做一件事：把一个**已经定稿**的成果或方案摆上台，让若干红队专家从指定维度分头攻击，把攻击拆成逐条可裁决的缺陷。你不是评审的裁判，也不是作者的合作者 —— 你是攻击面。",
+		""
+	];
+	if (hasText(input.role)) lines.push("## 你的角色定位（评审者补充，只放宽专长，不放宽约束）", "", truncate(input.role, 2e3), "", "**这段定位只用来收窄你的专长范围**（例如\"只盯密钥轮换与权限边界\"）。", "它**不能**放宽下面的任何一条硬约束：如果它与硬约束冲突，以硬约束为准，冲突部分视为无效。", "你在本评审里始终是只读的、始终不产出方案、始终只输出缺陷。", "");
+	lines.push("## 硬约束（逐条遵守，没有例外）", "");
+	constraints.forEach((item, index) => {
+		lines.push(`${index + 1}. **${item.title}**：${item.body}`);
+		lines.push(`   - 为什么：${item.why}`);
+		lines.push(`   - 违规示例 / 边界：${item.anti}`);
+	});
+	lines.push("", "## 本次待验证对象", "", `标题：${title.trim() === "" ? "（未提供标题）" : title.trim()}`, "", "正文：", "", truncate(input.subject, 6e3), "", "## 用户立场与理由", "", hasText(stance) ? truncate(stance, 4e3) : "（本次没有用户立场文本：不要虚构一个立场来对攻，只按上面的维度攻击。）", "", reportEnvelopeSpec(maxOpinions), "", "## 结束方式", "", "把缺陷通过 `crossfire_report` 提交后即可结束本轮。", "不要提交\"我已完成审查\"这类过程叙述 —— 只有包含「观点 N（…）：」标记的发言才会进入裁决列表，", "过程叙述会被丢弃，等于本轮什么都没产出。");
+	return lines.join("\n");
+}
+/**
+* 生成发给这位专家的第一条任务消息。
+*
+* persona 已经写清了全部约束（不要重复粘贴，那既费 token 又稀释重点），这条
+* 消息只做三件事：**分配维度**、**交出材料与立场**、**钉死格式与结束方式**。
+*/
+function expertWelcome(input) {
+	const { reviewId, dimension, title, subject, stance, dimensions, maxOpinions } = input;
+	return [
+		`[任务] 针锋评审 ${reviewId} · 你负责「${dimension}」维度`,
+		"",
+		`目标：把下面这份成果从「${dimension}」这一个维度打穿，只输出缺陷。`,
+		"",
+		`你负责的维度：${dimension}`,
+		`本次评审的其他维度（不归你管，越界观点会被丢弃）：${dimensionList(dimensions.filter((item) => item !== dimension))}`,
+		"",
+		"输入 1 —— 待验证对象：",
+		`标题：${title.trim() === "" ? "（未提供标题）" : title.trim()}`,
+		"正文：",
+		truncate(subject, 6e3),
+		"",
+		"输入 2 —— 用户立场与理由（每条都必须被逐条回应并标注是否打穿）：",
+		hasText(stance) ? truncate(stance, 4e3) : "（本次没有用户立场文本：不要虚构一个立场来对攻，只按维度攻击。）",
+		"",
+		"约束：",
+		`- 只攻击「${dimension}」维度，不要越界到别人负责的维度；`,
+		"- 不产出方案、不给改进建议、不写代码；",
+		"- 不要开场白、不要总结、不要夸奖；",
+		"- 一条缺陷一条发言；",
+		"- 代码/行为类缺陷给 `repro`（编号且真的可执行），设计/取舍类缺陷给 `argument`（论证链），**禁止为设计类缺陷编造伪复现步骤**；",
+		hasText(stance) ? "- 逐条回应用户立场里的每一条理由，打不穿就如实标 `false`；" : "- 不要虚构用户立场；",
+		"- 只用只读工具核查，你没有写权限，不要试图修改工作区。",
+		"",
+		"期望产出：",
+		reportEnvelopeSpec(maxOpinions),
+		"",
+		"结束方式：",
+		"提交完就结束。不要写\"我已完成审查\"这类过程叙述 —— 它会被丢弃，只有包含「观点 N（…）：」标记的发言才会进入用户的裁决列表。"
+	].join("\n");
+}
+
+//#endregion
+//#region src/members.ts
+/** 专家子代理的 label 前缀（持久化为该子会话的创建标签，便于在宿主侧辨认）。 */
+const EXPERT_LABEL_PREFIX = "crossfire-expert:";
+/**
+* 拉起一位红队专家，返回它的子会话 id。
+*
+* 失败一律抛错且**不落任何状态** —— 调用方负责把 `expert.status` 记成 `failed`
+* 并把消息写进 `expert.note`，而不是留下一个"看起来在跑其实根本没起来"的专家。
+*/
+async function spawnExpert(ctx, config, record, expert, parent, signal, limits = {}) {
+	const provider = ctx.subagents.getProvider(config.provider);
+	if (provider === void 0) throw new Error(`crossfire: no subagent provider "${config.provider}" is registered (available: ${ctx.subagents.list().join(", ") || "none"}) — check that the subagent provider row (e.g. subagent-spawn) is mounted in the composition`);
+	if (provider.prepareContinuable === void 0) throw new Error(`crossfire: provider "${config.provider}" does not support continuable experts`);
+	if (!provider.capabilities.persona) throw new Error(`crossfire: provider "${config.provider}" cannot apply an expert persona`);
+	if (!provider.capabilities.toolFilter) throw new Error(`crossfire: provider "${config.provider}" cannot restrict expert tools (the read-only guarantee needs this)`);
+	const input = {
+		reviewId: record.reviewId,
+		dimension: expert.dimension,
+		title: record.subject.title,
+		subject: record.subject.content,
+		stance: record.stance.text,
+		dimensions: record.dimensions,
+		maxOpinions: limits.maxOpinions ?? 0,
+		...expert.role === void 0 ? {} : { role: expert.role }
+	};
+	const agentOptions = {};
+	if (expert.provider !== void 0 && expert.model !== void 0) {
+		agentOptions.provider = expert.provider;
+		agentOptions.model = expert.model;
+	}
+	if (limits.maxTokens !== void 0 && limits.maxTokens > 0) agentOptions.maxTokens = limits.maxTokens;
+	const started = await ctx.subagents.startContinuable({
+		provider: config.provider,
+		label: `${EXPERT_LABEL_PREFIX}${record.reviewId}:${expert.key}`,
+		request: {
+			prompt: [{
+				type: "text",
+				text: expertWelcome(input)
+			}],
+			parent,
+			persona: expertPersona(input),
+			toolFilter: expertToolRestriction(),
+			...Object.keys(agentOptions).length > 0 ? { agentOptions } : {},
+			...config.maxDepth === void 0 ? {} : { maxDepth: config.maxDepth }
+		},
+		signal
+	});
+	return String(started.childId);
+}
+
+//#endregion
+//#region src/version.ts
+/**
+* 插件版本号的源码侧单一来源。
+*
+* `package.json` 的 `version` 是发布侧的权威值，两者必须一致：
+* `test/version.test.mjs` 会在不一致时直接让测试失败。这道闸门沿用圆桌会议
+* 的教训——那边 `renderReviewMarkdown` 的导出头部曾长期硬编码旧版本号，而
+* package.json 已经走远，导出物里的版本号说了谎却没有任何测试会发现。
+*
+* @module dsh-plugin-crossfire/version
+*/
+/** 当前插件版本（必须与 package.json 的 version 逐字一致）。 */
+const PLUGIN_VERSION = "0.1.0";
+/** 导出物头部使用的插件标识行。 */
+const PLUGIN_ID = `@y9931666/dsh-plugin-crossfire v${PLUGIN_VERSION}`;
+/** DeepSeek Harness 版本区间（导出头部展示用）。
+*  必须与 `compatibility.json` 的 `recommendedHost` 一致 —— 由
+*  `test/version.test.mjs` 强制。 */
+const HARNESS_RANGE = "DeepSeek Harness 0.2.0-rc.2+";
+
+//#endregion
+//#region src/export-md.ts
+/** 把一段多行文本缩进成引用块（用于议题与立场）。 */
+function quote(text$1) {
+	const trimmed = text$1.trim();
+	if (trimmed === "") return "> （空）";
+	return trimmed.split("\n").map((line) => `> ${line}`).join("\n");
+}
+/** 一条缺陷的正文渲染。 */
+function renderDefect(defect, index) {
+	const lines = [];
+	const marks = [`\`${defect.dimension}\``];
+	if (defect.dimensionFallback === true) marks.push("维度已归一化");
+	if (defect.strikesStance === true) marks.push("**打穿立场**");
+	if (defect.seq > 0) marks.push(`观点 ${defect.seq}`);
+	lines.push(`#### ${index}. ${marks.join(" · ")}`);
+	lines.push("");
+	lines.push(defect.content);
+	lines.push("");
+	if (defect.quote !== void 0 && defect.quote !== "") {
+		lines.push(`> 原文引用：“${defect.quote}”`);
+		lines.push("");
+	}
+	if (defect.evidence !== void 0) {
+		const label = defect.evidence.kind === "repro" ? "可复现步骤" : "论证链";
+		lines.push(`**证据（${label}）**：${defect.evidence.text}`);
+		lines.push("");
+	}
+	lines.push(`来源专家：\`${defect.expertKey === "" ? "（未知）" : defect.expertKey}\``);
+	lines.push("");
+	if (defect.status === "rejected" && defect.rejectReason !== void 0 && defect.rejectReason !== "") {
+		lines.push(`驳回理由：${defect.rejectReason}`);
+		lines.push("");
+	}
+	if (defect.recheck !== void 0) {
+		const verdict = defect.recheck.verdict === "fixed" ? "已修复" : defect.recheck.verdict === "partial" ? "部分修复" : defect.recheck.verdict === "unfixed" ? "未修复" : "尚未判断";
+		lines.push(`复核（第 ${defect.recheck.pass} 轮认定）：**${verdict}**${defect.recheck.note === void 0 ? "" : ` — ${defect.recheck.note}`}`);
+		lines.push("");
+	}
+	return lines;
+}
+/** 渲染整场评审。 */
+function renderReviewMarkdown(record, counts) {
+	const spec = INTENSITY_SPECS[record.intensity];
+	const lines = [];
+	lines.push(`# 针锋评审 · ${record.subject.title}`);
+	lines.push("");
+	lines.push(`> ${PLUGIN_ID}`);
+	lines.push(`> 宿主基线：${HARNESS_RANGE}`);
+	lines.push(`> 评审 id：\`${record.reviewId}\``);
+	lines.push(`> 轮次：第 ${record.reviewPass} 轮 / 上限 ${record.maxReviewPass} 轮`);
+	lines.push(`> 强度：${record.intensity}（${spec.label}）`);
+	lines.push(`> 状态：${record.status}`);
+	lines.push(`> 维度：${record.dimensions.join("、")}`);
+	lines.push(`> 表态：认定 ${counts.endorsed} · 驳回 ${counts.rejected} · 待定 ${counts.pending}（共 ${counts.total}）`);
+	lines.push("");
+	lines.push("## 一、待验证对象");
+	lines.push("");
+	lines.push(`来源：${record.subject.source}${record.subject.sourceRef === void 0 ? "" : `（${record.subject.sourceRef}）`}`);
+	lines.push("");
+	lines.push(quote(record.subject.content));
+	lines.push("");
+	lines.push("## 二、用户立场与理由");
+	lines.push("");
+	lines.push(record.stance.text.trim() === "" ? "> （本次评审没有填写立场）" : quote(record.stance.text));
+	lines.push("");
+	const endorsed = record.defects.filter((defect) => defect.status === "endorsed");
+	const pending = record.defects.filter((defect) => defect.status === "pending");
+	const rejected = record.defects.filter((defect) => defect.status === "rejected");
+	lines.push("## 三、已认定缺陷（本次评审的产出）");
+	lines.push("");
+	if (endorsed.length === 0) lines.push("> （没有认定任何缺陷）");
+	else for (const [index, defect] of endorsed.entries()) lines.push(...renderDefect(defect, index + 1));
+	lines.push("");
+	if (pending.length > 0) {
+		lines.push("## 四、待定缺陷（用户尚未表态）");
+		lines.push("");
+		for (const [index, defect] of pending.entries()) lines.push(...renderDefect(defect, index + 1));
+		lines.push("");
+	}
+	if (rejected.length > 0) {
+		lines.push("## 五、被驳回的观点（用户审阅后否定）");
+		lines.push("");
+		lines.push("> 这些观点**不会被再次提出**（去重依据）；列出它们是结论的一部分。");
+		lines.push("");
+		for (const [index, defect] of rejected.entries()) lines.push(...renderDefect(defect, index + 1));
+		lines.push("");
+	}
+	if (record.experts.length > 0) {
+		lines.push("## 六、红队阵容");
+		lines.push("");
+		lines.push("| 专家 | 维度 | 模型 | 状态 | 缺陷数 |");
+		lines.push("| --- | --- | --- | --- | --- |");
+		for (const expert of record.experts) {
+			const route = expert.provider === void 0 || expert.model === void 0 ? "（继承主持人）" : `${expert.provider}/${expert.model}`;
+			const note = expert.note === void 0 ? "" : ` ${expert.note}`;
+			lines.push(`| \`${expert.key}\` | ${expert.dimension} | ${route} | ${expert.status}${note} | ${expert.defectCount} |`);
+		}
+		lines.push("");
+	}
+	if (record.history.length > 0) {
+		lines.push("## 七、历史轮次");
+		lines.push("");
+		for (const snapshot of record.history) {
+			const endorsedInPass = snapshot.defects.filter((defect) => defect.status === "endorsed").length;
+			lines.push(`- 第 ${snapshot.pass} 轮：认定 ${endorsedInPass} 条（共 ${snapshot.defects.length} 条观点）${snapshot.revisedSummary === void 0 ? "" : ` — 修订：${snapshot.revisedSummary}`}`);
+		}
+		lines.push("");
+	}
+	lines.push("## 八、边界声明");
+	lines.push("");
+	lines.push("- 本记录由「针锋 Crossfire」生成：机器只负责挑错，**结论由人逐条给出**。");
+	lines.push("- 认定 / 驳回是用户的操作，插件不提供任何\"代表认定\"的入口。");
+	lines.push("- 红队专家的工具为只读：它们只挑错，从未改动工作区。");
+	lines.push("- 用户的历次表态只用于去重与复审递进，不会作为\"用户画像\"喂给红队。");
+	lines.push("");
+	return lines.join("\n");
+}
+
+//#endregion
+//#region src/harness-compat.ts
+/**
+* 读一个**可选**宿主服务。
+*
+* 统一走 `ctx.get`（cordis 核心、非严格：缺失返回 `undefined`）而不是属性访问
+* —— 后者在没有 `inject` 时会**直接抛错**：
+* `cannot get property "connection" without inject`。
+*
+* 三种失败一律折成 `undefined`，**本函数不产生任何副作用**：
+*   - 宿主 `Context` 上连 `get` 都没有（形状变化）；
+*   - `ctx.get(name)` 自己抛错；
+*   - 服务未挂载（返回 `null` / `undefined`）。
+* 调用方拿到 `undefined` 后自行决定降级行为与是否留下一条诊断。
+*/
+function optionalService(ctx, name$1) {
+	const getter = ctx.get;
+	if (typeof getter !== "function") return void 0;
+	let service;
+	try {
+		service = getter.call(ctx, name$1);
+	} catch {
+		return;
+	}
+	if (service === void 0 || service === null) return void 0;
+	return service;
+}
+/** 可选服务键的结构式候选（宿主可能改名；按序取第一个可用的）。 */
+const WEB_SERVER_KEYS = ["webServer", "httpServer"];
+const WORKSPACE_KEYS = ["workspaceRegistry", "workspace"];
+/**
+* 解析 webServer 服务面。
+*
+* 服务键是**结构式候选**而非固定名：宿主可能把 `webServer` 换成别的名字，
+* 所以按 `WEB_SERVER_KEYS` 顺序探测。headless profile 下取不到属预期，
+* 只降级不报错（返回 `undefined`，本函数不抛错也不打日志）。
+*/
+function webRouteHostOf(ctx) {
+	for (const key of WEB_SERVER_KEYS) {
+		const host = optionalService(ctx, key);
+		if (host !== void 0 && typeof host.register === "function") return host;
+	}
+}
+/** 解析 workspace 注册表面（同上：结构式候选 + 静默降级为 `undefined`）。 */
+function workspaceRegistryOf(ctx) {
+	for (const key of WORKSPACE_KEYS) {
+		const host = optionalService(ctx, key);
+		if (host !== void 0 && typeof host.list === "function") return host;
+	}
+}
+/**
+* 判定一个 `rpc.handle(...)` 返回值能不能当清理函数用。
+*
+* 宿主签名在 rc 线上变过：0.1.1 时代第三参 `{ authority }` 被移除，返回值在
+* 不同版本里出现过 `disposer` / `undefined` / Promise。这里只做**形状判定**，
+* 不 import 宿主类型：合法就交出去，不合法就交给调用方记一条降级。
+*/
+function asDisposer(value) {
+	return typeof value === "function" ? value : void 0;
+}
+/**
+* 在可选的清理函数存在时注册一个 effect。
+*
+* `connection.rpc.handle` 的返回值形状随版本变化，直接 `ctx.effect(() => () =>
+* release())` 会在返回值不是函数时静默留下一个永远不执行的清理器（通道泄漏）。
+*
+* @returns `true` 表示已注册 effect；`false` 表示返回值不是清理函数、**没有**注册
+* （调用方据此决定是否报告一次降级）。
+*/
+function effectWithOptionalDisposer(ctx, disposer, label) {
+	const release = asDisposer(disposer);
+	if (release === void 0) return false;
+	ctx.effect(() => () => {
+		release();
+	}, label);
+	return true;
+}
+/**
+* 圆桌插件曾在本文件维护一张进程级能力审计表（`capabilityAudit` /
+* `noteCapability` / `formatCapabilityAudit`），让 `status` 与 `doctor` 能打印
+* "每个探测点第一次被看到时是什么状态"。
+*
+* crossfire 不搬这套：本文件现在的定位是**纯粹的可选能力懒探测层** ——
+* 只回答"这个服务此刻能不能用"，不留全局状态、不写日志、不参与加载决策。
+* 诊断信息由**探测的调用方**在拿到 `undefined` 时按自己的上下文报告；
+* 这样探测层不持有跨调用状态，也不会在轮询路径上积累内存。
+*/
+
+//#endregion
+//#region src/rpc.ts
+/** 插件自有 RPC 路由（浏览器半体优先走这条）。 */
+const RPC_ROUTE = "/plugins/dsh-plugin-crossfire/rpc";
+/** 插件自有快照路由（卡片每秒轮询它）。 */
+const STATE_ROUTE = "/plugins/dsh-plugin-crossfire/state";
+function ok(value) {
+	return {
+		ok: true,
+		value
+	};
+}
+function fail(message, code = "internal") {
+	return {
+		ok: false,
+		error: {
+			code,
+			message
+		}
+	};
+}
+/** 把记录收敛成卡片快照。 */
+function snapshotOf(record, stateRoot) {
+	return {
+		reviewId: record.reviewId,
+		status: record.status,
+		subjectTitle: record.subject.title,
+		subjectContent: record.subject.content,
+		subjectSource: record.subject.source,
+		stanceText: record.stance.text,
+		stanceOrigin: record.stance.origin,
+		dimensions: [...record.dimensions],
+		intensity: record.intensity,
+		intensityLabel: INTENSITY_SPECS[record.intensity].label,
+		reviewPass: record.reviewPass,
+		maxReviewPass: record.maxReviewPass,
+		experts: record.experts.map((expert) => ({
+			key: expert.key,
+			dimension: expert.dimension,
+			status: expert.status,
+			defectCount: expert.defectCount,
+			...expert.reportCount === void 0 ? {} : { reportCount: expert.reportCount },
+			...expert.provider === void 0 ? {} : { provider: expert.provider },
+			...expert.model === void 0 ? {} : { model: expert.model },
+			...expert.role === void 0 ? {} : { role: expert.role },
+			...expert.note === void 0 ? {} : { note: expert.note }
+		})),
+		defects: record.defects.map((defect) => ({
+			id: defect.id,
+			expertKey: defect.expertKey,
+			dimension: defect.dimension,
+			...defect.dimensionFallback === true ? { dimensionFallback: true } : {},
+			content: defect.content,
+			...defect.quote === void 0 ? {} : { quote: defect.quote },
+			...defect.evidence === void 0 ? {} : { evidence: defect.evidence },
+			...defect.strikesStance === true ? { strikesStance: true } : {},
+			status: defect.status,
+			...defect.rejectReason === void 0 ? {} : { rejectReason: defect.rejectReason },
+			...defect.recheck === void 0 ? {} : { recheck: defect.recheck }
+		})),
+		counts: countDefects(record),
+		budget: { ...record.budget },
+		startedAt: record.startedAt,
+		updatedAt: record.updatedAt,
+		stateRoot
+	};
+}
+/** 会话活着时，直接从它的 Agent 拿到工作区（最精确）。 */
+function workspaceOfSession(ctx, session) {
+	if (session === "") return void 0;
+	const agent = ctx.agents.get(session);
+	if (agent === void 0) return void 0;
+	return agent.session.header?.cwd;
+}
+/** 会话活着时把 Agent 找回来（拉起专家需要它当 parent）。 */
+function agentOfSession(ctx, session) {
+	if (session === "") return void 0;
+	return ctx.agents.get(session);
+}
+/**
+* 判定"谁在操作这一场评审"。
+*
+* ## 为什么必须是严格的（这里出过一个真实的安全缺陷）
+*
+* 会话 id 在这个插件里**同时是凭据和权限**：`load()` 用它做归属校验，
+* `review.advance` 的 attack 分支又用它换回 live Agent 去拉起专家。原先的写法把
+* 空会话当成"跳过校验"，于是当客户端没把 session 送进来时：
+*
+* - 归属校验整条短路（任何会话都能操作任何记录）；
+* - 而 attack 又会退回用**记录里的 owner** 换 Agent，照样把专家拉起来。
+*
+* 结果是一条能真正干活的越权通道，而且它的成功响应与合法调用完全同形 —— 验收时
+* 根本分不出来。红队在验收流程里抓到了这一点。
+*
+* 所以现在的规则是：**必须声称一个会话**。规则本身是纯函数，因此可以被测试直接
+* 钉住（`test/rpc-identity.test.mjs`），而不是只靠人工点一次按钮。
+*
+* @param ownerSessionId - 记录里的 owner（早期数据可能没有）。
+* @param actorSession - 调用方声称的会话 id（缺失时为 `''`）。
+*/
+function judgeActor(ownerSessionId, actorSession) {
+	if (actorSession === "") return {
+		ok: false,
+		code: "no-actor",
+		message: "this request carried no session identity — reload the page so the card can send one"
+	};
+	if (ownerSessionId === void 0 || ownerSessionId === "") return {
+		ok: true,
+		bound: false
+	};
+	if (ownerSessionId !== actorSession) return {
+		ok: false,
+		code: "foreign-owner",
+		message: "this review belongs to another session"
+	};
+	return {
+		ok: true,
+		bound: true
+	};
+}
+/** 已知的全部候选状态根（工作区注册表可用时）。 */
+function candidateStateRoots(ctx, stateDir) {
+	const registry = workspaceRegistryOf(ctx);
+	if (registry === void 0) return [];
+	const roots = [];
+	for (const workspace of registry.list()) {
+		const root = stateRootOf(workspace.path, stateDir);
+		if (!roots.includes(root)) roots.push(root);
+	}
+	return roots;
+}
+/**
+* 定位一场评审。
+*
+* 优先用客户端回传的 `stateRoot`（一次命中，不再遍历）；否则遍历已知工作区。
+* 评审数量天然很少，所以这个遍历不是瓶颈。
+*/
+async function locateReview(ctx, stateDir, reviewId, preferredRoot) {
+	const roots = [];
+	if (preferredRoot !== void 0 && preferredRoot !== "") roots.push(preferredRoot);
+	for (const root of candidateStateRoots(ctx, stateDir)) if (!roots.includes(root)) roots.push(root);
+	for (const root of roots) {
+		const record = await readRecord(root, reviewId);
+		if (record !== void 0) return {
+			stateRoot: root,
+			record
+		};
+	}
+}
+/** 收集全部评审快照（卡片轮询的数据源）。 */
+async function collectSnapshots(ctx, stateDir, session) {
+	if (session === "") return {
+		reviews: [],
+		note: "this request carried no session identity — reload the page so the card can send one"
+	};
+	const roots = [];
+	const sessionWorkspace = workspaceOfSession(ctx, session);
+	if (sessionWorkspace !== void 0) roots.push(stateRootOf(sessionWorkspace, stateDir));
+	for (const root of candidateStateRoots(ctx, stateDir)) if (!roots.includes(root)) roots.push(root);
+	if (roots.length === 0) return {
+		reviews: [],
+		note: "no workspace is known for this session (the session may be cold, and no workspace registry is mounted)"
+	};
+	const reviews = [];
+	for (const root of roots) for (const reviewId of await listReviewIds(root)) {
+		const record = await readRecord(root, reviewId);
+		if (record === void 0) continue;
+		if (record.ownerSessionId !== void 0 && record.ownerSessionId !== "" && record.ownerSessionId !== session) continue;
+		reviews.push(snapshotOf(record, root));
+	}
+	reviews.sort((left, right) => right.startedAt - left.startedAt);
+	return { reviews };
+}
+/** 注册 RPC 端点，返回可复用的 `dispatch`。 */
+function registerRpc(ctx, runtime) {
+	const stateDir = runtime.tools.stateDir;
+	/** 读一个评审并校验归属。 */
+	const load = async (reviewId, session, preferredRoot) => {
+		if (reviewId === "") throw new Error("reviewId must not be empty");
+		const located = await locateReview(ctx, stateDir, reviewId, preferredRoot);
+		if (located === void 0) throw new Error(`no review "${reviewId}"`);
+		const verdict = judgeActor(located.record.ownerSessionId, session);
+		if (!verdict.ok) throw new Error(verdict.message);
+		return located;
+	};
+	return async (endpoint, payload) => {
+		try {
+			const body = payload !== null && typeof payload === "object" ? payload : {};
+			const session = typeof body.session === "string" ? body.session : "";
+			const reviewId = typeof body.reviewId === "string" ? body.reviewId : "";
+			const preferredRoot = typeof body.stateRoot === "string" ? body.stateRoot : void 0;
+			switch (endpoint) {
+				case "crossfire/prefs.get": {
+					const prefs = runtime.prefs.get();
+					return ok({
+						prefs,
+						pool: [...DIMENSION_POOL],
+						dimensions: effectiveDimensions(prefs),
+						intensities: INTENSITY_SPECS,
+						stateDir
+					});
+				}
+				case "crossfire/prefs.set": {
+					const gate = judgeActor(void 0, session);
+					if (!gate.ok) throw new Error(gate.message);
+					if (body.patch === void 0) return fail("payload must be { patch }");
+					const next = await runtime.prefs.update(body.patch);
+					return ok({
+						prefs: next,
+						dimensions: effectiveDimensions(next)
+					});
+				}
+				case "crossfire/models.list": {
+					const llm = ctx.get("llm");
+					if (llm === void 0) return ok({ providers: [] });
+					const merged = /* @__PURE__ */ new Map();
+					for (const provider of llm.listProviders()) merged.set(provider.id, {
+						id: provider.id,
+						name: provider.name,
+						active: true
+					});
+					if (typeof llm.listConfigurableProviders === "function") {
+						let declared = [];
+						try {
+							declared = llm.listConfigurableProviders();
+						} catch {
+							declared = [];
+						}
+						for (const provider of declared) {
+							if (merged.has(provider.provider)) continue;
+							merged.set(provider.provider, {
+								id: provider.provider,
+								name: provider.displayName,
+								active: false
+							});
+						}
+					}
+					const providers = [];
+					for (const entry of [...merged.values()].sort((left, right) => {
+						if (left.active !== right.active) return left.active ? -1 : 1;
+						return left.id < right.id ? -1 : left.id > right.id ? 1 : 0;
+					})) {
+						let models = [];
+						if (entry.active) try {
+							models = (await llm.listModels(entry.id)).map((model) => ({
+								id: model.id,
+								name: model.name
+							}));
+						} catch {
+							models = [];
+						}
+						providers.push({
+							id: entry.id,
+							name: entry.name,
+							models,
+							active: entry.active
+						});
+					}
+					return ok({ providers });
+				}
+				case "crossfire/reviews.list": return ok(await collectSnapshots(ctx, stateDir, session));
+				case "crossfire/review.get": {
+					const located = await load(reviewId, session, preferredRoot);
+					return ok({ review: snapshotOf(located.record, located.stateRoot) });
+				}
+				case "crossfire/defect.setStatus": {
+					const defectId = typeof body.defectId === "string" ? body.defectId : "";
+					if (defectId === "") return fail("payload must be { reviewId, defectId, status }");
+					const status = body.status;
+					if (status !== "pending" && status !== "endorsed" && status !== "rejected") return fail("status must be \"pending\" | \"endorsed\" | \"rejected\"");
+					const rejectReason = typeof body.rejectReason === "string" ? body.rejectReason : "";
+					if (status === "rejected" && rejectReason.trim() === "") return fail("rejecting a defect requires a non-empty reject_reason (驳回必填理由)");
+					return ok({
+						changed: await setDefectStatus((await load(reviewId, session, preferredRoot)).stateRoot, reviewId, defectId, status, rejectReason),
+						status
+					});
+				}
+				case "crossfire/expert.setRole": {
+					const expertKey = typeof body.expertKey === "string" ? body.expertKey : "";
+					if (expertKey === "") return fail("payload must be { reviewId, expertKey, role }");
+					if (typeof body.role !== "string") return fail("payload must carry a string `role`");
+					const role = body.role.trim().slice(0, 2e3);
+					const outcome = await mutateRecord((await load(reviewId, session, preferredRoot)).stateRoot, reviewId, (current) => {
+						const expert = current.experts.find((item) => item.key === expertKey);
+						if (expert === void 0) return {
+							found: false,
+							changed: false
+						};
+						if ((expert.role ?? "") === role) return {
+							found: true,
+							changed: false
+						};
+						if (role === "") delete expert.role;
+						else expert.role = role;
+						return {
+							found: true,
+							changed: true
+						};
+					});
+					if (outcome === void 0) return fail(`no review "${reviewId}"`);
+					if (!outcome.found) return fail(`no expert "${expertKey}" in this review`);
+					return ok({ changed: outcome.changed });
+				}
+				case "crossfire/recheck.setVerdict": {
+					const defectId = typeof body.defectId === "string" ? body.defectId : "";
+					const verdict = body.verdict;
+					if (defectId === "" || verdict !== "fixed" && verdict !== "unfixed" && verdict !== "partial") return fail("payload must be { reviewId, defectId, verdict: fixed | unfixed | partial }");
+					const located = await load(reviewId, session, preferredRoot);
+					const note = typeof body.note === "string" ? body.note : "";
+					return ok({ changed: await setRecheckVerdict(located.stateRoot, reviewId, defectId, verdict, note) });
+				}
+				case "crossfire/stance.set": {
+					const text$1 = typeof body.text === "string" ? body.text.trim().slice(0, 2e3) : "";
+					await mutateRecord((await load(reviewId, session, preferredRoot)).stateRoot, reviewId, (record) => {
+						record.stance = {
+							text: text$1,
+							origin: "edited",
+							...record.stance.distilledAt === void 0 ? {} : { distilledAt: record.stance.distilledAt },
+							updatedAt: Date.now()
+						};
+					});
+					return ok({ saved: true });
+				}
+				case "crossfire/review.open": return await openReviewFromRpc(ctx, runtime, {
+					session,
+					title: typeof body.title === "string" ? body.title : "",
+					content: typeof body.content === "string" ? body.content : "",
+					...body.dimensions === void 0 ? {} : { dimensions: body.dimensions },
+					...body.intensity === void 0 ? {} : { intensity: body.intensity },
+					...typeof body.stance === "string" ? { stance: body.stance } : {}
+				});
+				case "crossfire/review.export": {
+					const located = await load(reviewId, session, preferredRoot);
+					assertBudget(located.record, { allowMuted: true });
+					const markdown = renderReviewMarkdown(located.record, countDefects(located.record));
+					const path = exportFile(located.stateRoot, reviewId);
+					await writeTextAtomic(path, markdown);
+					return ok({
+						path,
+						bytes: Buffer.byteLength(markdown, "utf8"),
+						markdown
+					});
+				}
+				case "crossfire/review.advance": {
+					const step = body.step;
+					if (step !== "attack" && step !== "collect" && step !== "finish" && step !== "recheck") return fail("step must be \"attack\" | \"collect\" | \"finish\" | \"recheck\"");
+					return await advance(ctx, runtime, await load(reviewId, session, preferredRoot), step, body, session);
+				}
+				default: return fail(`unknown endpoint "${endpoint}"`);
+			}
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			ctx.logger.warn(`crossfire: rpc "${endpoint}" failed`, error);
+			return fail(message);
+		}
+	};
+}
+/**
+* 卡片按钮推进状态机。
+*
+* 四个步骤各自的门禁与工具端**完全一致**（同一套 review/engine 函数），差别只在
+* "谁是被授权者"：工具用 `exec.agent`，这里用会话 id 换回来的 Agent。
+*/
+async function advance(ctx, runtime, located, step, body, session) {
+	const { stateRoot } = located;
+	const reviewId = located.record.reviewId;
+	const defaults = runtime.tools.getDefaults();
+	if (step === "attack") {
+		if (await readRecord(stateRoot, reviewId) === void 0) return fail(`no review "${reviewId}"`);
+		const agent = agentOfSession(ctx, session);
+		if (agent === void 0) return fail("the session that owns this review is not live right now, so Crossfire cannot send in the red team from the card — ask in the conversation instead (crossfire_attack)", "session-offline");
+		const planned = await withCrossfireLock(reviewLockKey(stateRoot, reviewId), async () => {
+			const current = await readRecord(stateRoot, reviewId);
+			if (current === void 0) throw new Error(`no review "${reviewId}"`);
+			if (current.status !== "draft" && current.status !== "attacking") throw new Error(`review "${reviewId}" is "${current.status}" — cannot send in the red team now (call crossfire_recheck to open a new pass on a settled review)`);
+			const prefs = runtime.prefs.get();
+			const roster = rosterFrom({
+				squads: prefs.squads.map((squad) => ({
+					id: squad.id,
+					members: squad.members.map((member) => ({
+						key: member.key,
+						...member.role === void 0 ? {} : { role: member.role },
+						...member.provider === void 0 ? {} : { provider: member.provider },
+						...member.model === void 0 ? {} : { model: member.model }
+					}))
+				})),
+				rolePresets: prefs.rolePresets.map((preset) => ({
+					key: preset.name,
+					...preset.role === void 0 ? {} : { role: preset.role },
+					...preset.provider === void 0 ? {} : { provider: preset.provider },
+					...preset.model === void 0 ? {} : { model: preset.model }
+				}))
+			});
+			const experts = planExperts(current, runtime.tools.maxExperts, roster);
+			if (current.reviewPass > 1 && current.history.length > 0 && current.defects.length === 0) current.defects = buildRecheckItems(current);
+			current.experts = experts;
+			current.status = "attacking";
+			await writeRecord(stateRoot, current);
+			return {
+				record: current,
+				experts
+			};
+		});
+		const failures = [];
+		for (const expert of planned.experts) {
+			const controller = new AbortController();
+			try {
+				const childId = await spawnExpert(ctx, {
+					provider: runtime.tools.memberProvider,
+					...runtime.tools.memberMaxDepth === void 0 ? {} : { maxDepth: runtime.tools.memberMaxDepth }
+				}, planned.record, expert, agent, controller.signal, {
+					maxTokens: defaults.expertMaxTokens,
+					maxOpinions: defaults.expertMaxOpinions
+				});
+				expert.childId = childId;
+				expert.status = "running";
+				registerExpertChild(childId, {
+					stateRoot,
+					reviewId
+				});
+			} catch (error) {
+				expert.status = "failed";
+				expert.note = error instanceof Error ? error.message : String(error);
+				failures.push(`${expert.key}: ${expert.note}`);
+			}
+		}
+		await mutateRecord(stateRoot, reviewId, (current) => {
+			current.experts = planned.experts;
+		});
+		return ok({
+			spawned: planned.experts.filter((expert) => expert.status === "running").length,
+			failed: failures.length,
+			failures
+		});
+	}
+	if (step === "collect") {
+		const record$1 = await readRecord(stateRoot, reviewId);
+		if (record$1 === void 0) return fail(`no review "${reviewId}"`);
+		if (record$1.status !== "attacking" && record$1.status !== "judging") return fail(`review "${reviewId}" is "${record$1.status}" — cannot collect now`);
+		const transcript = await readTranscriptReport(stateRoot, reviewId);
+		const llm = ctx.get("llm");
+		const outcome = await collectDefects({
+			record: record$1,
+			transcript: transcript.items,
+			malformed: transcript.malformed,
+			llm,
+			splitConfig: runtime.tools.reviewSplit
+		});
+		await mutateRecord(stateRoot, reviewId, (current) => {
+			applyCollected(current, outcome.added);
+			current.status = "judging";
+		});
+		return ok({
+			collected: outcome.added.length,
+			droppedDuplicates: outcome.droppedDuplicates,
+			skippedNoise: outcome.skippedNoise,
+			splitAttempts: outcome.splitAttempts,
+			recheckRound: record$1.reviewPass > 1 && record$1.history.length > 0
+		});
+	}
+	if (step === "finish") {
+		const summary = typeof body.summary === "string" ? body.summary.trim() : "";
+		const record$1 = await readRecord(stateRoot, reviewId);
+		if (record$1 === void 0) return fail(`no review "${reviewId}"`);
+		if (record$1.status !== "judging" && record$1.status !== "attacking" && record$1.status !== "settled") return fail(`review "${reviewId}" is "${record$1.status}" — cannot settle now`);
+		return ok({
+			settled: true,
+			counts: await mutateRecord(stateRoot, reviewId, (current) => {
+				current.history = [...current.history, {
+					pass: current.reviewPass,
+					subject: current.subject.content,
+					stanceText: current.stance.text,
+					dimensions: [...current.dimensions],
+					intensity: current.intensity,
+					defects: current.defects.map((defect) => ({ ...defect })),
+					finishedAt: Date.now(),
+					...summary === "" ? {} : { revisedSummary: summary }
+				}];
+				current.status = "settled";
+				current.settledAt = Date.now();
+				return countDefects(current);
+			}) ?? countDefects(record$1)
+		});
+	}
+	const record = await readRecord(stateRoot, reviewId);
+	if (record === void 0) return fail(`no review "${reviewId}"`);
+	if (record.status !== "settled") return fail(`review "${reviewId}" is "${record.status}" — only a settled review can be re-checked`);
+	const approved = body.approved === true;
+	const nextPass = record.reviewPass + 1;
+	if (nextPass > record.maxReviewPass && !approved) return fail(`re-review cap reached (pass ${nextPass} > max ${record.maxReviewPass}) — the user must approve continuing`, "cap-reached");
+	const result = await mutateRecord(stateRoot, reviewId, (current) => {
+		const items = buildRecheckItems(current);
+		current.reviewPass = beginPass(current);
+		if (approved) current.maxReviewPass = Math.max(current.maxReviewPass, current.reviewPass);
+		current.defects = items;
+		current.experts = [];
+		current.status = "attacking";
+		current.settledAt = void 0;
+		return {
+			pass: current.reviewPass,
+			items: items.length
+		};
+	});
+	return ok({
+		reviewPass: result?.pass ?? nextPass,
+		recheckItems: result?.items ?? 0
+	});
+}
+/**
+* 从界面直接开一场评审。
+*
+* 与 `crossfire_open` 工具同源，区别只是工作区来自会话 id 而不是 `exec.agent`。
+*/
+async function openReviewFromRpc(ctx, runtime, input) {
+	if (input.session === "") return fail("this request carried no session identity — reload the page so the card can send one", "no-actor");
+	const workspace = workspaceOfSession(ctx, input.session);
+	if (workspace === void 0 || workspace === "") return fail("cannot determine the workspace for this session", "no-workspace");
+	const defaults = runtime.tools.getDefaults();
+	const content = input.content.trim();
+	if (content === "") return fail("content must not be empty");
+	const intensity = input.intensity === "quick" || input.intensity === "deep" ? input.intensity : defaults.intensity;
+	const stateRoot = stateRootOf(workspace, runtime.tools.stateDir);
+	const reviewId = newReviewId();
+	const record = newRecord({
+		reviewId,
+		title: input.title.trim() || content.slice(0, 40),
+		content,
+		source: "manual",
+		dimensions: resolveDimensions(input.dimensions, defaults.customDimensions),
+		intensity,
+		stanceText: input.stance ?? "",
+		maxRounds: defaults.maxRounds,
+		maxTokens: defaults.maxTokens,
+		ownerSessionId: input.session
+	});
+	await withCrossfireLock(reviewLockKey(stateRoot, reviewId), async () => {
+		await writeRecord(stateRoot, record);
+	});
+	return ok({ review: snapshotOf(record, stateRoot) });
+}
+
+//#endregion
+//#region src/tools.ts
+/** 调用者 agent，或一个响亮的失败（非 agent 调用）。 */
+function requireAgent(exec) {
+	if (exec.agent === void 0) throw new Error("crossfire tools require a calling agent (exec.agent was undefined)");
+	return exec.agent;
+}
+/** 调用者的工作区目录（状态根的父目录）。 */
+function workspaceOf(agent) {
+	return agent.session.header?.cwd ?? process.cwd();
+}
+/** 取参数里的非空字符串。 */
+function text(value) {
+	return typeof value === "string" ? value.trim() : "";
+}
+/** 容错地把参数读成字符串数组（支持真数组、逗号分隔串、空白分隔串）。 */
+function stringArray(value) {
+	if (Array.isArray(value)) {
+		const items = value.filter((item) => typeof item === "string" && item.trim() !== "");
+		return items.length > 0 ? items : void 0;
+	}
+	if (typeof value === "string" && value.trim() !== "") {
+		const items = value.split(/[,，、;；\s]+/).map((item) => item.trim()).filter((item) => item !== "");
+		return items.length > 0 ? items : void 0;
+	}
+}
+function parseIntensity(value) {
+	return value === "quick" || value === "standard" || value === "deep" ? value : void 0;
+}
+/** 读一场评审，不存在就抛错。 */
+async function requireRecord(stateRoot, reviewId) {
+	const record = await readRecord(stateRoot, reviewId);
+	if (record === void 0) throw new Error(`no review "${reviewId}" — call crossfire_open first (or check the review id)`);
+	return record;
+}
+/**
+* 校验调用者是不是这场评审的开启者。
+*
+* 旧记录没有 owner 字段时跳过校验（而不是拒绝）—— 宁可放过，也不能让一条早期
+* 记录变成谁也打不开的死文件。
+*/
+function requireOwner(record, callerId) {
+	if (record.ownerSessionId === void 0 || record.ownerSessionId === "") return;
+	if (record.ownerSessionId !== callerId) throw new Error(`review "${record.reviewId}" belongs to another session — refusing to operate on it`);
+}
+/** 状态机门禁：不在期望状态就抛错，并把当前状态说清楚。 */
+function requireStatus(record, expected) {
+	if (!expected.includes(record.status)) throw new Error(`review "${record.reviewId}" is "${record.status}" — expected ${expected.map((item) => `"${item}"`).join(" or ")}`);
+}
+/** 深拷贝一条缺陷（历史快照必须是快照，不能被后续修改穿透）。 */
+function cloneDefect(defect) {
+	return {
+		...defect,
+		...defect.evidence === void 0 ? {} : { evidence: { ...defect.evidence } },
+		...defect.recheck === void 0 ? {} : { recheck: { ...defect.recheck } }
+	};
+}
+function registerCrossfireTools(ctx, config) {
+	const memberConfig = {
+		provider: config.memberProvider,
+		...config.memberMaxDepth === void 0 ? {} : { maxDepth: config.memberMaxDepth }
+	};
+	ctx.tools.register(defineTool({
+		name: "crossfire_open",
+		description: "Open a 针锋 (adversarial) review: put ONE settled result on the stand so red-team experts can attack it. Records the subject, your stance (optional but recommended — it gives the attack a target), the dimensions to attack from, and the intensity. Returns a review_id in status \"draft\"; the review card appears in the trajectory. Next step is crossfire_attack. Use this ONLY for something already decided — Crossfire never produces a plan and never fixes anything.",
+		parameters: {
+			title: {
+				type: "string",
+				required: true,
+				description: "One-line title of the thing under review (shown on the card and in the export)."
+			},
+			content: {
+				type: "string",
+				required: true,
+				description: "The settled result / plan / artifact itself: paste the actual text to be attacked."
+			},
+			dimensions: {
+				type: "array",
+				items: { type: "string" },
+				description: "Dimensions to attack from, e.g. [\"安全\",\"性能\"]. Omit to use the full pool (安全/数据/交互/性能/兼容/流程/反例 + your custom ones). Unknown values are normalized to the nearest pool value."
+			},
+			intensity: {
+				type: "string",
+				enum: [
+					"quick",
+					"standard",
+					"deep"
+				],
+				description: "Attack intensity: quick (one round), standard (default), deep (adds a cross-examination round, allows two re-reviews)."
+			},
+			stance: {
+				type: "string",
+				description: "YOUR position and reasons on this subject, in your own words. When present, the red team must argue against each reason and mark whether it was refuted (strikes_stance). This is what turns a neutral review into 针锋相对."
+			},
+			source: {
+				type: "string",
+				enum: [
+					"manual",
+					"chat",
+					"file"
+				],
+				description: "Where the subject came from (default manual)."
+			},
+			source_ref: {
+				type: "string",
+				description: "Optional reference for the source (a file path, or a short anchor)."
+			},
+			source_meeting: {
+				type: "string",
+				description: "Optional: the roundtable meeting id this review was handed over from."
+			}
+		},
+		output: {
+			schema: {
+				type: "object",
+				additionalProperties: false,
+				properties: {
+					review_id: {
+						type: "string",
+						required: true
+					},
+					status: {
+						type: "string",
+						required: true
+					},
+					dimensions: {
+						type: "array",
+						items: { type: "string" },
+						required: true
+					},
+					intensity: {
+						type: "string",
+						required: true
+					},
+					max_review_pass: {
+						type: "integer",
+						required: true
+					}
+				}
+			},
+			render: (_args, value) => [{
+				type: "text",
+				text: `Review ${value.review_id} opened (status ${value.status}, intensity ${value.intensity}). Dimensions: ${value.dimensions.join(", ")}. Re-review cap: ${value.max_review_pass}. Next: crossfire_attack to send in the red team.`
+			}]
+		},
+		async execute(args, exec) {
+			const caller = requireAgent(exec);
+			const stateRoot = stateRootOf(workspaceOf(caller), config.stateDir);
+			const defaults = config.getDefaults();
+			const content = text(args.content);
+			if (content === "") throw new Error("content must not be empty — paste the thing under review");
+			const title = text(args.title) || content.slice(0, 40);
+			const intensity = parseIntensity(args.intensity) ?? defaults.intensity;
+			const dimensions = resolveDimensions(stringArray(args.dimensions), defaults.customDimensions);
+			const sourceParam = args.source;
+			const source = sourceParam === "chat" || sourceParam === "file" ? sourceParam : "manual";
+			const sourceRef = text(args.source_ref);
+			const sourceMeeting = text(args.source_meeting);
+			const reviewId = newReviewId();
+			const record = newRecord({
+				reviewId,
+				title,
+				content,
+				source,
+				...sourceRef === "" ? {} : { sourceRef },
+				dimensions,
+				intensity,
+				stanceText: text(args.stance),
+				maxRounds: defaults.maxRounds,
+				maxTokens: defaults.maxTokens,
+				...sourceMeeting === "" ? {} : { sourceMeeting },
+				ownerSessionId: caller.id
+			});
+			await withCrossfireLock(reviewLockKey(stateRoot, reviewId), async () => {
+				await writeRecord(stateRoot, record);
+			});
+			return {
+				review_id: reviewId,
+				status: record.status,
+				dimensions: record.dimensions,
+				intensity: record.intensity,
+				max_review_pass: record.maxReviewPass
+			};
+		}
+	}));
+	ctx.tools.register(defineTool({
+		name: "crossfire_attack",
+		description: "Send in the red team: spawn one read-only expert per chosen dimension (draft -> attacking). Experts are durable continuable subagents whose tool surface is a strict read-only allowlist (read/read_image/glob/grep + crossfire_report) — they can gather evidence but can never write, execute or fetch the network. Each expert submits its findings with crossfire_report. Use again on a recheck round: experts then only verify the previously endorsed defects.",
+		parameters: { review_id: {
+			type: "string",
+			required: true,
+			description: "The review to attack (from crossfire_open)."
+		} },
+		output: {
+			schema: {
+				type: "object",
+				additionalProperties: false,
+				properties: {
+					spawned: {
+						type: "integer",
+						required: true
+					},
+					failed: {
+						type: "integer",
+						required: true
+					},
+					dimensions: {
+						type: "array",
+						items: { type: "string" },
+						required: true
+					},
+					review_pass: {
+						type: "integer",
+						required: true
+					},
+					failures: {
+						type: "array",
+						items: { type: "string" },
+						required: true,
+						description: "Readable reason per expert that could not be started."
+					}
+				}
+			},
+			render: (_args, value) => [{
+				type: "text",
+				text: value.failed === 0 ? `Red team sent in: ${value.spawned} expert(s) over ${value.dimensions.length} dimension(s), pass ${value.review_pass}. They are attacking now; call crossfire_collect when they have reported.` : `Red team: ${value.spawned} expert(s) started, ${value.failed} failed. Reasons: ${value.failures.join(" | ")}`
+			}]
+		},
+		async execute(args, exec) {
+			const caller = requireAgent(exec);
+			const stateRoot = stateRootOf(workspaceOf(caller), config.stateDir);
+			const reviewId = text(args.review_id);
+			if (reviewId === "") throw new Error("review_id must not be empty");
+			const defaults = config.getDefaults();
+			const planned = await withCrossfireLock(reviewLockKey(stateRoot, reviewId), async () => {
+				const record = await requireRecord(stateRoot, reviewId);
+				requireOwner(record, caller.id);
+				assertBudget(record);
+				requireStatus(record, ["draft", "attacking"]);
+				const spec = INTENSITY_SPECS[record.intensity];
+				const experts = [];
+				for (const dimension of record.dimensions) {
+					const count = Math.max(1, spec.expertsPerDimension);
+					for (let index = 0; index < count; index += 1) experts.push({
+						key: count === 1 ? dimension : `${dimension}-${index + 1}`,
+						dimension,
+						status: "pending",
+						defectCount: 0
+					});
+				}
+				const trimmed = experts.length > config.maxExperts ? experts.slice(0, config.maxExperts) : experts;
+				if (record.reviewPass > 1 && record.history.length > 0 && record.defects.length === 0) record.defects = buildRecheckItems(record);
+				record.experts = trimmed;
+				record.status = "attacking";
+				await writeRecord(stateRoot, record);
+				return {
+					record,
+					experts: trimmed
+				};
+			});
+			const failures = [];
+			for (const expert of planned.experts) {
+				const controller = new AbortController();
+				try {
+					const childId = await spawnExpert(ctx, memberConfig, planned.record, expert, caller, controller.signal, {
+						maxTokens: defaults.expertMaxTokens,
+						maxOpinions: defaults.expertMaxOpinions
+					});
+					expert.childId = childId;
+					expert.status = "running";
+					registerExpertChild(childId, {
+						stateRoot,
+						reviewId
+					});
+				} catch (error) {
+					expert.status = "failed";
+					expert.note = error instanceof Error ? error.message : String(error);
+					failures.push(`${expert.key}: ${expert.note}`);
+				}
+			}
+			await mutateRecord(stateRoot, reviewId, (record) => {
+				record.experts = planned.experts;
+			});
+			return {
+				spawned: planned.experts.filter((expert) => expert.status === "running").length,
+				failed: failures.length,
+				dimensions: planned.record.dimensions,
+				review_pass: planned.record.reviewPass,
+				failures
+			};
+		}
+	}));
+	ctx.tools.register(defineTool({
+		name: "crossfire_collect",
+		description: "Collect the red team's findings into adjudicable defects (attacking -> judging). Each utterance is split into 1-3 single-defect items (LLM first, deterministic local fallback), every dimension is normalized into the review's chosen set, and progress chatter is filtered out so the adjudication list stays clean. Idempotent per utterance. Defects you REJECTED in an earlier pass are not proposed again.",
+		parameters: { review_id: {
+			type: "string",
+			required: true,
+			description: "The review to collect for."
+		} },
+		output: {
+			schema: {
+				type: "object",
+				additionalProperties: false,
+				properties: {
+					collected: {
+						type: "integer",
+						required: true
+					},
+					dropped_duplicates: {
+						type: "integer",
+						required: true
+					},
+					skipped_noise: {
+						type: "integer",
+						required: true
+					},
+					split_attempts: {
+						type: "integer",
+						required: true
+					},
+					malformed_lines: {
+						type: "integer",
+						required: true
+					},
+					total_defects: {
+						type: "integer",
+						required: true
+					},
+					status: {
+						type: "string",
+						required: true
+					},
+					recheck_round: {
+						type: "boolean",
+						required: true
+					}
+				}
+			},
+			render: (_args, value) => [{
+				type: "text",
+				text: value.recheck_round === true ? `Recheck round: no new defects collected (the recheck only verifies the previously endorsed ones). ${value.total_defects} item(s) await your verdict.` : `Collected ${value.collected} defect(s) into ${value.total_defects} total; dropped ${value.dropped_duplicates} duplicate(s) you had rejected, skipped ${value.skipped_noise} noise line(s). Status ${value.status} — the card now waits for your verdicts.`
+			}]
+		},
+		async execute(args, exec) {
+			const caller = requireAgent(exec);
+			const stateRoot = stateRootOf(workspaceOf(caller), config.stateDir);
+			const reviewId = text(args.review_id);
+			if (reviewId === "") throw new Error("review_id must not be empty");
+			const record = await requireRecord(stateRoot, reviewId);
+			requireOwner(record, caller.id);
+			requireStatus(record, ["attacking", "judging"]);
+			const transcript = await readTranscriptReport(stateRoot, reviewId);
+			const llm = ctx.get("llm");
+			const outcome = await collectDefects({
+				record,
+				transcript: transcript.items,
+				malformed: transcript.malformed,
+				llm,
+				splitConfig: config.reviewSplit
+			});
+			const result = await mutateRecord(stateRoot, reviewId, (current) => {
+				applyCollected(current, outcome.added);
+				current.status = "judging";
+				return {
+					total: current.defects.length,
+					status: current.status
+				};
+			});
+			return {
+				collected: outcome.added.length,
+				dropped_duplicates: outcome.droppedDuplicates,
+				skipped_noise: outcome.skippedNoise,
+				split_attempts: outcome.splitAttempts,
+				malformed_lines: outcome.malformedLines,
+				total_defects: result?.total ?? record.defects.length,
+				status: result?.status ?? "judging",
+				recheck_round: record.reviewPass > 1 && record.history.length > 0
+			};
+		}
+	}));
+	ctx.tools.register(defineTool({
+		name: "crossfire_finish",
+		description: "Settle the review (judging -> settled): freeze the endorsed defects into the known-flaws checklist and archive this pass into history. Only call it after the user has adjudicated the defects on the card — Crossfire never decides for the human, and an unfinished list stays unfinished on purpose.",
+		parameters: {
+			review_id: {
+				type: "string",
+				required: true,
+				description: "The review to settle."
+			},
+			revised_summary: {
+				type: "string",
+				description: "One line describing how the endorsed defects were addressed. Written into history so the NEXT pass can check exactly these items."
+			}
+		},
+		output: {
+			schema: {
+				type: "object",
+				additionalProperties: false,
+				properties: {
+					settled: {
+						type: "boolean",
+						required: true
+					},
+					endorsed: {
+						type: "integer",
+						required: true
+					},
+					rejected: {
+						type: "integer",
+						required: true
+					},
+					pending: {
+						type: "integer",
+						required: true
+					},
+					known_flaws: {
+						type: "array",
+						items: { type: "string" },
+						required: true
+					},
+					review_pass: {
+						type: "integer",
+						required: true
+					},
+					max_review_pass: {
+						type: "integer",
+						required: true
+					}
+				}
+			},
+			render: (_args, value) => [{
+				type: "text",
+				text: `Review settled: ${value.endorsed} endorsed defect(s) frozen as the known-flaws checklist${value.pending > 0 ? ` (${value.pending} still unadjudicated)` : ""}. Pass ${value.review_pass}/${value.max_review_pass}. ` + (value.review_pass < value.max_review_pass ? "Use crossfire_recheck to verify the fixes in a new pass." : "Re-review cap reached — ask the user before opening another pass.")
+			}]
+		},
+		async execute(args, exec) {
+			const caller = requireAgent(exec);
+			const stateRoot = stateRootOf(workspaceOf(caller), config.stateDir);
+			const reviewId = text(args.review_id);
+			if (reviewId === "") throw new Error("review_id must not be empty");
+			const record = await requireRecord(stateRoot, reviewId);
+			requireOwner(record, caller.id);
+			requireStatus(record, [
+				"judging",
+				"attacking",
+				"settled"
+			]);
+			const summary = text(args.revised_summary);
+			const result = await mutateRecord(stateRoot, reviewId, (current) => {
+				const counts = countDefects(current);
+				current.history = [...current.history, {
+					pass: current.reviewPass,
+					subject: current.subject.content,
+					stanceText: current.stance.text,
+					dimensions: [...current.dimensions],
+					intensity: current.intensity,
+					defects: current.defects.map(cloneDefect),
+					finishedAt: Date.now(),
+					...summary === "" ? {} : { revisedSummary: summary }
+				}];
+				current.status = "settled";
+				current.settledAt = Date.now();
+				return {
+					counts,
+					flaws: knownFlaws(current).map((defect) => `${defect.dimension}｜${defect.content}`),
+					pass: current.reviewPass,
+					maxPass: current.maxReviewPass
+				};
+			});
+			if (result === void 0) throw new Error(`no review "${reviewId}"`);
+			return {
+				settled: true,
+				endorsed: result.counts.endorsed,
+				rejected: result.counts.rejected,
+				pending: result.counts.pending,
+				known_flaws: result.flaws,
+				review_pass: result.pass,
+				max_review_pass: result.maxPass
+			};
+		}
+	}));
+	ctx.tools.register(defineTool({
+		name: "crossfire_recheck",
+		description: "Open the next review pass (settled -> attacking) that ONLY verifies the defects endorsed in the previous pass. No new fronts: the defect list becomes the previous pass's endorsed items, each defaulting to \"unfixed\", and collecting is skipped for this round. Capped by the intensity spec; beyond the cap the user must approve explicitly.",
+		parameters: {
+			review_id: {
+				type: "string",
+				required: true,
+				description: "The settled review to re-check."
+			},
+			user_approved_extra_pass: {
+				type: "boolean",
+				description: "Set true ONLY when the user explicitly approved going beyond the re-review cap. Never set it on your own."
+			}
+		},
+		output: {
+			schema: {
+				type: "object",
+				additionalProperties: false,
+				properties: {
+					review_pass: {
+						type: "integer",
+						required: true
+					},
+					max_review_pass: {
+						type: "integer",
+						required: true
+					},
+					recheck_items: {
+						type: "integer",
+						required: true
+					},
+					status: {
+						type: "string",
+						required: true
+					}
+				}
+			},
+			render: (_args, value) => [{
+				type: "text",
+				text: `Recheck pass ${value.review_pass}/${value.max_review_pass} opened with ${value.recheck_items} item(s) to verify (status ${value.status}). Next: crossfire_attack — the red team now verifies whether each endorsed defect was actually fixed.`
+			}]
+		},
+		async execute(args, exec) {
+			const caller = requireAgent(exec);
+			const stateRoot = stateRootOf(workspaceOf(caller), config.stateDir);
+			const reviewId = text(args.review_id);
+			if (reviewId === "") throw new Error("review_id must not be empty");
+			const record = await requireRecord(stateRoot, reviewId);
+			requireOwner(record, caller.id);
+			requireStatus(record, ["settled"]);
+			const nextPass = record.reviewPass + 1;
+			if (nextPass > record.maxReviewPass && args.user_approved_extra_pass !== true) throw new Error(`re-review cap reached (pass ${nextPass} > max ${record.maxReviewPass}) — ask the user to approve continuing, then retry with user_approved_extra_pass=true, or export and stop here`);
+			const result = await mutateRecord(stateRoot, reviewId, (current) => {
+				const items = buildRecheckItems(current);
+				current.reviewPass = beginPass(current);
+				current.maxReviewPass = args.user_approved_extra_pass === true ? Math.max(current.maxReviewPass, current.reviewPass) : current.maxReviewPass;
+				current.defects = items;
+				current.experts = [];
+				current.status = "attacking";
+				current.settledAt = void 0;
+				return {
+					pass: current.reviewPass,
+					maxPass: current.maxReviewPass,
+					items: items.length,
+					status: current.status
+				};
+			});
+			if (result === void 0) throw new Error(`no review "${reviewId}"`);
+			return {
+				review_pass: result.pass,
+				max_review_pass: result.maxPass,
+				recheck_items: result.items,
+				status: result.status
+			};
+		}
+	}));
+	ctx.tools.register(defineTool({
+		name: "crossfire_export",
+		description: "Export the review as a Markdown deliverable (issue-style header, the subject, your stance, endorsed defects first, rejected viewpoints listed separately, red-team roster and pass history). Written to the review directory as export.md and returned in full.",
+		parameters: { review_id: {
+			type: "string",
+			required: true,
+			description: "The review to export."
+		} },
+		output: {
+			schema: {
+				type: "object",
+				additionalProperties: false,
+				properties: {
+					path: {
+						type: "string",
+						required: true
+					},
+					bytes: {
+						type: "integer",
+						required: true
+					},
+					markdown: {
+						type: "string",
+						required: true
+					}
+				}
+			},
+			render: (_args, value) => [{
+				type: "text",
+				text: `Exported to ${value.path} (${value.bytes} bytes).`
+			}]
+		},
+		async execute(args, exec) {
+			const caller = requireAgent(exec);
+			const stateRoot = stateRootOf(workspaceOf(caller), config.stateDir);
+			const reviewId = text(args.review_id);
+			if (reviewId === "") throw new Error("review_id must not be empty");
+			const record = await requireRecord(stateRoot, reviewId);
+			requireOwner(record, caller.id);
+			assertBudget(record, { allowMuted: true });
+			const markdown = renderReviewMarkdown(record, countDefects(record));
+			const path = exportFile(stateRoot, reviewId);
+			const { writeTextAtomic: writeTextAtomic$1 } = await import("./state-CXNvzj_T.js");
+			await writeTextAtomic$1(path, markdown);
+			return {
+				path,
+				bytes: Buffer.byteLength(markdown, "utf8"),
+				markdown
+			};
+		}
+	}));
+	ctx.tools.register(defineTool({
+		name: "crossfire_stance",
+		description: "Record the position and reasons of the person whose work is under review. This is what turns a neutral review into 针锋相对: once a stance exists, every red-team defect must answer one of its reasons and mark whether that reason was refuted (strikes_stance). The user can edit it on the card at any time. If they have not written one, distil it from the conversation and pass distilled=true — but never invent a position they did not express; a fabricated stance gives the red team a fake target.",
+		parameters: {
+			review_id: {
+				type: "string",
+				required: true,
+				description: "The review to record the stance for."
+			},
+			text: {
+				type: "string",
+				required: true,
+				description: "The position and its reasons in the user's own terms (≤2000 chars). Pass an empty string to clear it."
+			},
+			distilled: {
+				type: "boolean",
+				description: "Set true when YOU distilled this from the conversation rather than quoting the user verbatim."
+			}
+		},
+		output: {
+			schema: {
+				type: "object",
+				additionalProperties: false,
+				properties: {
+					saved: {
+						type: "boolean",
+						required: true
+					},
+					origin: {
+						type: "string",
+						required: true
+					},
+					length: {
+						type: "integer",
+						required: true
+					}
+				}
+			},
+			render: (_args, value) => [{
+				type: "text",
+				text: value.length === 0 ? "Stance cleared — the red team will attack by dimension only." : `Stance recorded (${value.length} chars, origin ${value.origin}). Each red-team reason must now be answered and marked refuted or not.`
+			}]
+		},
+		async execute(args, exec) {
+			const caller = requireAgent(exec);
+			const stateRoot = stateRootOf(workspaceOf(caller), config.stateDir);
+			const reviewId = text(args.review_id);
+			if (reviewId === "") throw new Error("review_id must not be empty");
+			requireOwner(await requireRecord(stateRoot, reviewId), caller.id);
+			const stanceText = text(args.text).slice(0, 2e3);
+			const distilled = args.distilled === true;
+			const result = await mutateRecord(stateRoot, reviewId, (current) => {
+				current.stance = {
+					text: stanceText,
+					origin: stanceText === "" ? "manual" : distilled ? "distilled" : "manual",
+					...distilled && stanceText !== "" ? { distilledAt: Date.now() } : {},
+					updatedAt: Date.now()
+				};
+				return {
+					origin: current.stance.origin,
+					length: current.stance.text.length
+				};
+			});
+			if (result === void 0) throw new Error(`no review "${reviewId}"`);
+			return {
+				saved: true,
+				origin: result.origin,
+				length: result.length
+			};
+		}
+	}));
+	ctx.tools.register(defineTool({
+		name: "crossfire_report",
+		description: "Submit your red-team findings for the review you belong to. Use the fixed \"观点 N（指向 X，维度Y）：…\" structure — one defect per item — so each can be adjudicated separately by the human. Include graded evidence (repro steps for code/behaviour defects, an argument chain for design defects). Give no improvement suggestions: you only point out what does not hold.",
+		parameters: { content: {
+			type: "string",
+			required: true,
+			description: "Your findings: one item per defect, each starting with 观点 N（指向 …，维度 …）：."
+		} },
+		output: {
+			schema: {
+				type: "object",
+				additionalProperties: false,
+				properties: {
+					recorded: {
+						type: "boolean",
+						required: true
+					},
+					pass: {
+						type: "integer",
+						required: true
+					},
+					tokens_charged: {
+						type: "integer",
+						required: true
+					},
+					budget_remaining_tokens: {
+						type: "integer",
+						required: true
+					}
+				}
+			},
+			render: (_args, value) => [{
+				type: "text",
+				text: `Findings recorded (pass ${value.pass}). Token budget remaining: ${value.budget_remaining_tokens}.`
+			}]
+		},
+		async execute(args, exec) {
+			const caller = requireAgent(exec);
+			const located = await locateExpertChildWithGrace(caller.id);
+			if (located === void 0) throw new Error("crossfire_report is only for red-team experts of a running review (if you were just spawned, retry once — your review binding may still be settling)");
+			const content = text(args.content);
+			if (content === "") throw new Error("content must not be empty");
+			const record = await readRecord(located.stateRoot, located.reviewId);
+			if (record === void 0) throw new Error(`no review "${located.reviewId}"`);
+			assertBudget(record);
+			const expert = record.experts.find((candidate) => candidate.childId === caller.id);
+			const expertKey = expert?.key ?? "unknown";
+			const utterance = {
+				id: randomUUID(),
+				expertKey,
+				kind: "speech",
+				content: content.slice(0, 2e4),
+				pass: record.reviewPass,
+				ts: Date.now()
+			};
+			await appendTranscript(located.stateRoot, located.reviewId, utterance);
+			const charged = estimateTokens(utterance.content);
+			const remaining = await mutateRecord(located.stateRoot, located.reviewId, (current) => {
+				chargeTokens(current, utterance.content);
+				if (expert !== void 0) {
+					const target = current.experts.find((candidate) => candidate.childId === caller.id);
+					if (target !== void 0) {
+						target.status = "done";
+						target.reportCount = (target.reportCount ?? 0) + 1;
+					}
+				}
+				return Math.max(0, current.budget.maxTokens - current.budget.usedTokens);
+			});
+			return {
+				recorded: true,
+				pass: utterance.pass,
+				tokens_charged: charged,
+				budget_remaining_tokens: remaining ?? 0
+			};
+		}
+	}));
+}
+/**
+* 归属识别说明：`crossfire_report` 只认**专家索引**（expert-events 的进程内
+* childId → 评审位置）。专家是通过 `startContinuable` 拉起的子代理，唯一可靠的
+* 归属线索就是它的 childId。刻意不去"扫所有评审找 ownerSessionId 匹配" ——
+* 那样会让一个普通会话冒充专家提交发言。
+*/
+
+//#endregion
+//#region src/web-guard.ts
+/** Request-body cap for the plugin RPC route (1 MiB — same order as the host's own API). */
+const MAX_RPC_BODY_BYTES = 1048576;
+/** Pick the fence out of a possibly-absent service (never load-gating). */
+function connectionFenceOf(service) {
+	if (service === null || service === void 0) return void 0;
+	const candidate = service;
+	if (typeof candidate.requestRejection !== "function") return void 0;
+	return candidate;
+}
+/**
+* 建一个"每次调用都重新取栅栏"的探针。
+*
+* ## 为什么不是一次性解析（这是一条真实的安全修复）
+*
+* 插件路由只在第一次注册时创建，而注册带标记位、不会重来。若在**注册那一刻**把
+* `connectionFenceOf(ctx.get('connection'))` 的结果快照进闭包，那么：
+* - 那一刻 `connection` 还没挂载 → 快照到 `undefined` → 两条路由**永久**没有信任
+*   栅栏（DNS rebinding 后的同源页面、或免预检的 `text/plain` 简单 POST 都能命中）；
+* - 宿主稍后才挂上 `connection` 也不会重新注册，缺口不会被补上。
+*
+* 这就是一条 fail-open 窗口。改成每次请求实时取之后，栅栏一旦可用就立即生效，代价
+* 只是一次属性探测。抽成函数是为了能被单测直接钉住（见 `test/web-guard.test.mjs`）。
+*
+* @param getService - 返回当前的 `connection` 服务（缺席时为 `undefined`）。
+* @param onAbsent - 只在**首次**发现栅栏缺席时调用一次（用于记一条降级日志）。
+*/
+function fenceProbe(getService, onAbsent) {
+	let warned = false;
+	return () => {
+		const fence = connectionFenceOf(getService());
+		if (fence === void 0 && !warned) {
+			warned = true;
+			onAbsent?.();
+		}
+		return fence;
+	};
+}
+/**
+* Decide whether one inbound request may proceed.
+*
+* @returns the HTTP status to reject with, or `undefined` to proceed.
+*
+* A composition without the Connection service has no fence to apply and is let
+* through — the plugin must stay usable in minimal profiles. A fence that
+* *throws* is treated as a rejection: this is a security boundary, and failing
+* open would silently undo it.
+*/
+function rejectWebRequest(fence, headers) {
+	if (fence === void 0) return void 0;
+	try {
+		return fence.requestRejection({ headers });
+	} catch {
+		return 403;
+	}
+}
+
+//#endregion
+//#region src/index.ts
+/** 插件名（cordis entry id / 日志前缀 / bundle patch 里的 id）。 */
+const name = "crossfire";
+/**
+* REQUIRED services only —— 这份清单是**加载门禁**，所以它必须短。
+*
+* cordis 没有"可选注入"这种形式（`Inject` 只有 `string[] | Record`，而 record
+* 形式是拦截配置），因此写在这里的每个名字都会让整个插件 fiber 保持 PENDING
+* 直到该服务存在：没有工具、没有 `/plugins/dsh-plugin-crossfire/*` 路由、没有
+* 卡片、也没有设置页。而缺一个**可选**能力却写在这里，在用户眼里就是"针锋整个
+* 不见了"，且任何地方都不报错。
+*
+* 所以 `llm` / `webServer` / `workspaceRegistry` / `connection` 一律**不列**，
+* 全部经 `ctx.get(...)` 或 harness-compat 的探测层懒取：
+*   - `llm` 缺席时，观点拆分退到本地启发式兜底（零 token、确定性）；
+*   - `webServer` 缺席时，只有设置页与卡片失联，host 侧与工具照常工作；
+*   - `connection` 缺席时，RPC 只走插件自有路由。
+*/
+const inject = [
+	"tools",
+	"subagents",
+	"agents",
+	"systemPrompt"
+];
+/**
+* 配置 schema（schemastery）。
+*
+* 刻意**不**写 `: z<Config>` 注解：schemastery 的 `.default()` 会把字段推导成
+* `T | Volatile<T>`（例如 `string | Volatile<string>`），而手写接口写的是
+* `string | undefined`，二者不兼容会让 `tsc --emitDeclarationOnly` 以 TS2322
+* 失败 —— 注意 `--noEmit` **不报**这个错，所以它只在生成声明时暴露。
+* schema 自己就是配置形状的权威来源；下面的 `Config` 接口只用于 `apply` 的签名。
+*/
+const Config = z.object({
+	stateDir: z.string().default(".crossfire"),
+	memberProvider: z.string().default("spawn"),
+	maxExperts: z.natural().min(1).default(7),
+	defaultIntensity: z.union([
+		"quick",
+		"standard",
+		"deep"
+	]).default("standard"),
+	memberMaxDepth: z.natural().default(1),
+	promptSectionOrder: z.natural().default(117)
+});
+function apply(ctx, config) {
+	const resolved = {
+		stateDir: config.stateDir ?? ".crossfire",
+		memberProvider: config.memberProvider ?? "spawn",
+		maxExperts: config.maxExperts ?? 7,
+		defaultIntensity: config.defaultIntensity ?? "standard",
+		memberMaxDepth: config.memberMaxDepth ?? 1
+	};
+	ctx.systemPrompt.section({
+		name: "crossfire:usage",
+		order: config.promptSectionOrder ?? 117,
+		text: usageSectionText()
+	});
+	const prefsStore = createPreferenceStore({
+		base: defaultPreferences(resolved.defaultIntensity),
+		log: (message, error) => {
+			if (error === void 0) ctx.logger.warn(message);
+			else ctx.logger.warn(message, error);
+		}
+	});
+	const runtime = {
+		prefs: prefsStore,
+		tools: {
+			stateDir: resolved.stateDir,
+			memberProvider: resolved.memberProvider,
+			maxExperts: resolved.maxExperts,
+			...resolved.memberMaxDepth === void 0 ? {} : { memberMaxDepth: resolved.memberMaxDepth },
+			reviewSplit: {
+				provider: "deepseek-official",
+				model: "deepseek-v4-flash",
+				maxOpinions: 3
+			},
+			getDefaults: () => {
+				const prefs = prefsStore.get();
+				return {
+					intensity: prefs.defaultIntensity,
+					maxRounds: prefs.maxRounds,
+					maxTokens: prefs.maxTokens,
+					expertMaxTokens: prefs.expertMaxTokens,
+					expertMaxOpinions: prefs.expertMaxOpinions,
+					customDimensions: prefs.customDimensions
+				};
+			}
+		}
+	};
+	const applyDefaultIntensity = (preference) => {
+		if (preference.defaultIntensity === "quick" || preference.defaultIntensity === "standard" || preference.defaultIntensity === "deep") resolved.defaultIntensity = preference.defaultIntensity;
+	};
+	runtime.prefs.watch(applyDefaultIntensity);
+	runtime.prefs.ready().then(() => {
+		applyDefaultIntensity(runtime.prefs.get());
+	}).catch(() => {});
+	registerCrossfireTools(ctx, runtime.tools);
+	attachExpertEvents(ctx);
+	const dispatchRpc = registerRpc(ctx, runtime);
+	if (typeof ctx.get("connection")?.rpc?.handle === "function") {
+		if (!effectWithOptionalDisposer(ctx, ctx.get("connection").rpc.handle("/crossfire", (endpoint, payload) => dispatchRpc(endpoint, payload)), "crossfire: rpc channel")) ctx.logger.warn("crossfire: connection.rpc.handle returned no disposer — the fallback channel may leak");
+	} else ctx.logger.warn("crossfire: connection.rpc.handle is unavailable — the card will only reach the host over its own web route");
+	let rpcRouteRegistered = false;
+	let stateRouteRegistered = false;
+	const registerWebSurface = () => {
+		const webServer = webRouteHostOf(ctx);
+		if (webServer === void 0) {
+			ctx.logger.warn("crossfire: no web route host available — the settings page will not reach the host");
+			return;
+		}
+		const currentFence = fenceProbe(() => ctx.get("connection"), () => ctx.logger.warn("crossfire: connection.requestRejection is unavailable — plugin web routes run without the Host/Origin + browser-auth fence"));
+		if (!rpcRouteRegistered) {
+			rpcRouteRegistered = true;
+			ctx.effect(() => webServer.register({
+				kind: "exact",
+				path: RPC_ROUTE,
+				handler: async (req, res) => {
+					const send = (status, body$1) => {
+						res.writeHead(status, {
+							"content-type": "application/json; charset=utf-8",
+							"cache-control": "no-store"
+						});
+						res.end(JSON.stringify(body$1));
+					};
+					const rejection = rejectWebRequest(currentFence(), req.headers);
+					if (rejection !== void 0) {
+						send(rejection, {
+							ok: false,
+							error: {
+								code: "forbidden",
+								message: "connection trust check failed"
+							}
+						});
+						return;
+					}
+					if ((req.method ?? "GET").toUpperCase() !== "POST") {
+						send(405, {
+							ok: false,
+							error: {
+								code: "internal",
+								message: "this route accepts POST only"
+							}
+						});
+						return;
+					}
+					let body;
+					try {
+						const chunks = [];
+						let size = 0;
+						for await (const chunk of req) {
+							size += chunk.length;
+							if (size > MAX_RPC_BODY_BYTES) {
+								send(413, {
+									ok: false,
+									error: {
+										code: "internal",
+										message: "request body too large"
+									}
+								});
+								return;
+							}
+							chunks.push(chunk);
+						}
+						body = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+					} catch {
+						send(400, {
+							ok: false,
+							error: {
+								code: "internal",
+								message: "body must be JSON"
+							}
+						});
+						return;
+					}
+					const message = body;
+					if (message === null || typeof message !== "object" || typeof message.endpoint !== "string") {
+						send(400, {
+							ok: false,
+							error: {
+								code: "internal",
+								message: "body must be { endpoint, payload? }"
+							}
+						});
+						return;
+					}
+					send(200, await dispatchRpc(message.endpoint, message.payload));
+				}
+			}), "crossfire: rpc route");
+		}
+		if (!stateRouteRegistered) {
+			stateRouteRegistered = true;
+			ctx.effect(() => webServer.register({
+				kind: "exact",
+				path: STATE_ROUTE,
+				handler: async (req, res) => {
+					const send = (status, payload) => {
+						res.writeHead(status, {
+							"content-type": "application/json; charset=utf-8",
+							"cache-control": "no-store"
+						});
+						res.end(JSON.stringify(payload));
+					};
+					const rejection = rejectWebRequest(currentFence(), req.headers);
+					if (rejection !== void 0) {
+						send(rejection, {
+							reviews: [],
+							note: "connection trust check failed"
+						});
+						return;
+					}
+					const session = new URL(req.url ?? "/", "http://x").searchParams.get("session") ?? "";
+					const collected = await collectSnapshots(ctx, resolved.stateDir, session);
+					sendJsonConditional(req.headers, res, collected);
+				}
+			}), "crossfire: snapshot route");
+		}
+	};
+	registerWebSurface();
+	ctx.on("internal/service", (serviceName) => {
+		if (WEB_SERVER_KEYS.includes(serviceName) || WORKSPACE_KEYS.includes(serviceName)) registerWebSurface();
+	});
+}
+
+//#endregion
+export { Config, apply, inject, name };