@y9931666/dsh-plugin-crossfire 0.1.5 → 0.2.0

package/lib/index.js

@@ -92,16 +92,6 @@ function beginPass(record) {
 //#endregion
 //#region src/types.ts
 /**
-* Crossfire（针锋）的领域类型。
-*
-* 设计边界（与圆桌会议刻意不同，务必守住）：
-* - 没有 nodes / edges / topology —— 专家是行，不是图。
-* - 没有 charter 的多模式 —— 只有一种角色：红队。
-* - 没有 kb / skill / proxy-thinking 字段 —— 这个插件不读知识库、不传 skill。
-*
-* @module dsh-plugin-crossfire/types
-*/
-/**
 * 固定维度池。
 *
 * 为什么必须固定：抽样 5 份真实圆桌 `review.json`，`dimension` 实值是
@@ -260,12 +250,50 @@ function sanitizeExpert(value) {
 	if (model !== void 0) expert.model = model;
 	const role = asText(raw.role, 2e3);
 	if (role !== void 0) expert.role = role;
+	const prompt = asText(raw.prompt, 2e3);
+	if (prompt !== void 0) expert.prompt = prompt;
 	const persona = asText(raw.persona, 32e3);
 	if (persona !== void 0) expert.persona = persona;
 	const note = asText(raw.note, 500);
 	if (note !== void 0) expert.note = note;
 	return expert;
 }
+/**
+* 净化确认卡落盘的阵容（`CrossfireRecord.expertRoster`）。
+*
+* `key` 是唯一必填项（与 `planExperts` 的匹配语义一致）；其余字段只保留非空值
+* —— 空串与缺席在 persona/路由两处的语义完全相同（"没写"），落空串只会让记录
+* 里多一个看起来有值的字段。
+*
+* 整体为空时返回 undefined（而不是 `[]`）：缺席与空数组在本插件里没有行为差异，
+* 但不写这个字段能让"没走确认卡"的老记录保持与从前逐字相同的形状。
+*/
+function sanitizeRoster(value) {
+	if (!Array.isArray(value)) return void 0;
+	const entries = [];
+	for (const item of value) {
+		if (item === null || typeof item !== "object") continue;
+		const raw = item;
+		const key = asText(raw.key, 64);
+		if (key === void 0) continue;
+		const entry = { key };
+		const dimension = asText(raw.dimension, 32);
+		if (dimension !== void 0) entry.dimension = dimension;
+		const role = asText(raw.role, 2e3);
+		if (role !== void 0) entry.role = role;
+		const provider = asText(raw.provider, 64);
+		if (provider !== void 0) entry.provider = provider;
+		const model = asText(raw.model, 128);
+		if (model !== void 0) entry.model = model;
+		const prompt = asText(raw.prompt, 2e3);
+		if (prompt !== void 0) entry.prompt = prompt;
+		const name$1 = asText(raw.name, 120);
+		if (name$1 !== void 0) entry.name = name$1;
+		entries.push(entry);
+		if (entries.length >= 64) break;
+	}
+	return entries.length > 0 ? entries : void 0;
+}
 function sanitizeStance(value, now) {
 	const raw = value !== null && typeof value === "object" ? value : {};
 	const text$1 = asText(raw.text, 2e3) ?? "";
@@ -379,6 +407,8 @@ function normalizeRecord(raw, reviewId) {
 	};
 	const sourceMeeting = asText(source.sourceMeeting, 128);
 	if (sourceMeeting !== void 0) record.sourceMeeting = sourceMeeting;
+	const expertRoster = sanitizeRoster(source.expertRoster);
+	if (expertRoster !== void 0) record.expertRoster = expertRoster;
 	const ownerSessionId = asText(source.ownerSessionId, 128);
 	if (ownerSessionId !== void 0) record.ownerSessionId = ownerSessionId;
 	const settledAt = asCount(source.settledAt);
@@ -823,15 +853,16 @@ function sendJsonConditional(requestHeaders, res, payload, status = 200) {
 *
 * @module dsh-plugin-crossfire/prompt
 */
-/** 七步编排与那一条不可越界的规则。 */
+/** 八步编排（预检 + 状态机七步）与那一条不可越界的规则。 */
 const USAGE_STEPS = [
-	"1. `crossfire_open` —— 把待验证对象摆上台（标题 + 正文 + 维度 + 强度，可选立场）。状态 `draft`。",
-	"2. `crossfire_stance`（可选但强烈建议）—— 写入\"用户的立场与理由\"。用户自己写最好；他没写就**从对话提炼**并传 `distilled=true`，但**绝不虚构**他没表达过的立场（虚构的立场等于给红队一个假靶子）。有了立场，每条红队缺陷都必须回应其中一条理由，并标注是否被打穿。用户随时可以在卡片上改。",
-	"3. `crossfire_attack` —— 按维度拉起只读红队专家。状态 `attacking`。",
-	"4. `crossfire_collect` —— 把专家发言拆成逐条可裁决的缺陷（自动过滤过程叙述、归一化维度、去掉用户上轮驳回过的重复项）。状态 `judging`。",
-	"5. **等人在卡片上逐条表态**。这一步没有工具可代劳。",
-	"6. `crossfire_finish` —— 定稿，把已认定缺陷固化为 known-flaws 清单并写入历史。状态 `settled`。",
-	"7. `crossfire_recheck` —— 复审：只核对上一轮已认定的缺陷是否修复，**不许开新战线**；`crossfire_export` 导出 Markdown。"
+	"1. `crossfire_plan_review` —— **先弹设置确认卡**：把评审标题 / 正文 / 来源 / 强度（每维专家数、复审上限、轮数、Token）/ 维度 / 立场 / 红队阵容逐行摊成两张表，等人点「确定开始」。点「仍需修改」就按用户的话改草案、带 `changes[]` 再弹一次；**确认前不要 open**。",
+	"2. `crossfire_open` —— 把待验证对象摆上台（标题 + 正文 + 维度 + 强度，可选立场）。把确认卡返回的 `experts` **原样**传入（它会落盘成这场评审的阵容）。状态 `draft`。",
+	"3. `crossfire_stance`（可选但强烈建议）—— 写入\"用户的立场与理由\"。用户自己写最好；他没写就**从对话提炼**并传 `distilled=true`，但**绝不虚构**他没表达过的立场（虚构的立场等于给红队一个假靶子）。有了立场，每条红队缺陷都必须回应其中一条理由，并标注是否被打穿。用户随时可以在卡片上改。",
+	"4. `crossfire_attack` —— 按维度拉起只读红队专家（名单优先用确认卡落盘的阵容）。状态 `attacking`。",
+	"5. `crossfire_collect` —— 把专家发言拆成逐条可裁决的缺陷（自动过滤过程叙述、归一化维度、去掉用户上轮驳回过的重复项）。状态 `judging`。",
+	"6. **等人在卡片上逐条表态**。这一步没有工具可代劳。",
+	"7. `crossfire_finish` —— 定稿，把已认定缺陷固化为 known-flaws 清单并写入历史。状态 `settled`。",
+	"8. `crossfire_recheck` —— 复审：只核对上一轮已认定的缺陷是否修复，**不许开新战线**；`crossfire_export` 导出 Markdown。"
 ];
 /**
 * 当前版本的用法段落。
@@ -849,7 +880,7 @@ function usageSectionText() {
 		"3. **红队专家只读。** 它们的工具被限制为只读检索（read / read_image / glob / grep）加一个 `crossfire_report`：只挑错，不动工作区。",
 		"4. **不许把用户偏好喂给红队。** 历史表态记录只用于去重与复审递进，绝不用来塑造专家对\"用户喜欢什么\"的预期。",
 		"",
-		"### 编排（七步，每步可单独重试）",
+		"### 编排（八步：预检一步 + 状态机七步，每步可单独重试）",
 		"",
 		...USAGE_STEPS,
 		"",
@@ -1637,11 +1668,13 @@ async function splitUtterance(llm, config, expertKey, content, allowed, stance)
 * `record.dimensions` 的顺序截断，所以**用户排在前面的维度优先** —— 这是可预期的，
 * 而不是随机丢人。
 *
-* 人选来源两条，按优先级：
-* 1. `roster` 里 `key` 等于维度名的那一条（精确指定，最符合直觉）；
-* 2. 否则按**顺序**取 roster 的第 i 条（i = 维度序号）—— 用户不必把 key 改名成
+* 人选来源三条，按优先级：
+* 1. `roster` 里 `dimension` 等于该维度的那一条（确认卡落盘的阵容就是这种形状：
+*    用户确认的是"安全这一行"，而不是某个恰好叫安全的 key）；
+* 2. 否则 `key` 等于维度名的那一条（精确指定，最符合直觉）；
+* 3. 否则按**顺序**取 roster 的第 i 条（i = 维度序号）—— 用户不必把 key 改名成
 *    维度名也能用上一份现成的阵容；
-* 3. 都取不到时只写维度与状态（专家继承主持人路由、无补充定位），与从前完全一致。
+* 4. 都取不到时只写维度与状态（专家继承主持人路由、无补充定位），与从前完全一致。
 *
 * @param roster - 可选人选来源；缺席或为空时行为与从前逐字一致。
 */
@@ -1651,7 +1684,7 @@ function planExperts(record, maxExperts, roster = []) {
 	let dimensionIndex = 0;
 	for (const dimension of record.dimensions) {
 		const count = Math.max(1, spec.expertsPerDimension);
-		const matched = roster.find((entry) => entry.key === dimension) ?? roster[dimensionIndex];
+		const matched = roster.find((entry) => entry.dimension !== void 0 && entry.dimension === dimension) ?? roster.find((entry) => entry.key === dimension) ?? roster[dimensionIndex];
 		dimensionIndex += 1;
 		for (let index = 0; index < count; index += 1) {
 			const expert = {
@@ -1664,6 +1697,7 @@ function planExperts(record, maxExperts, roster = []) {
 				if (matched.role !== void 0 && matched.role.trim() !== "") expert.role = matched.role.trim();
 				if (matched.provider !== void 0 && matched.provider.trim() !== "") expert.provider = matched.provider.trim();
 				if (matched.model !== void 0 && matched.model.trim() !== "") expert.model = matched.model.trim();
+				if (matched.prompt !== void 0 && matched.prompt.trim() !== "") expert.prompt = matched.prompt.trim();
 			}
 			experts.push(expert);
 		}
@@ -1887,10 +1921,10 @@ const EXPERT_TOOL_ALLOW = [
 /**
 * 红队专家禁止使用的工具（黑名单）。
 *
-* 这里列的是全部**主持人专属**的 `crossfire_*` 工具：开评审、发起攻击、收集
-* 缺陷、定稿、复审、导出。这些都是主持人的编排权，专家一旦能调
-* `crossfire_collect`/`crossfire_finish`，就等于自己给自己结案，"表态由人做"
-* 当场失效。
+* 这里列的是全部**主持人专属**的 `crossfire_*` 工具：启动前确认、开评审、发起
+* 攻击、收集缺陷、定稿、复审、导出、写入立场。这些都是主持人的编排权，专家一旦
+* 能调 `crossfire_plan_review`/`crossfire_collect`/`crossfire_finish`，就等于自己
+* 给自己结案，"表态由人做"当场失效。
 *
 * 为什么白名单之外还要再来一份黑名单：两者是**与**关系（必须同时在白名单里
 * 且不在黑名单里才可见）。将来有人为了加一个只读工具而改动
@@ -1900,6 +1934,7 @@ const EXPERT_TOOL_ALLOW = [
 * **注意**：`crossfire_report` 是**专家自己的**发言工具，绝不能列进本表。
 */
 const EXPERT_TOOL_DENY = [
+	"crossfire_plan_review",
 	"crossfire_open",
 	"crossfire_attack",
 	"crossfire_collect",
@@ -1958,7 +1993,7 @@ function reportEnvelopeSpec(maxOpinions) {
 	].join("\n");
 }
 /** 非空判定：兼容 `undefined` 与纯空白（"没写立场"比"写了几个空格"更常见）。 */
-function hasText(value) {
+function hasText$1(value) {
 	return value !== void 0 && value.trim() !== "";
 }
 /** 截断到上限，并明确标注被截断（截断不能静默发生）。 */
@@ -2023,7 +2058,7 @@ function expertPersona(input) {
 		},
 		{
 			title: "立场对攻",
-			body: hasText(stance) ? "用户已经写下了自己的立场与理由（见下方【用户立场与理由】）。你**必须逐条回应其中的每一条理由**，并在对应缺陷里标注是否**打穿**了它（`strikes_stance: true/false`）。" : "本次没有用户立场文本：不要虚构一个立场来对攻，只按维度攻击。",
+			body: hasText$1(stance) ? "用户已经写下了自己的立场与理由（见下方【用户立场与理由】）。你**必须逐条回应其中的每一条理由**，并在对应缺陷里标注是否**打穿**了它（`strikes_stance: true/false`）。" : "本次没有用户立场文本：不要虚构一个立场来对攻，只按维度攻击。",
 			why: "针锋的\"锋\"就在这里：用户的理由要真的被检验，而不是被绕过去。",
 			anti: "打不穿就如实标 `false`，不要为了讨好而假装打穿；不要只挑最弱的那条理由回应，其余理由回避不谈同样算没回应。"
 		},
@@ -2050,14 +2085,15 @@ function expertPersona(input) {
 		"「针锋」只做一件事：把一个**已经定稿**的成果或方案摆上台，让若干红队专家从指定维度分头攻击，把攻击拆成逐条可裁决的缺陷。你不是评审的裁判，也不是作者的合作者 —— 你是攻击面。",
 		""
 	];
-	if (hasText(input.role)) lines.push("## 你的角色定位（评审者补充，只放宽专长，不放宽约束）", "", truncate(input.role, 2e3), "", "**这段定位只用来收窄你的专长范围**（例如\"只盯密钥轮换与权限边界\"）。", "它**不能**放宽下面的任何一条硬约束：如果它与硬约束冲突，以硬约束为准，冲突部分视为无效。", "你在本评审里始终是只读的、始终不产出方案、始终只输出缺陷。", "");
+	if (hasText$1(input.role)) lines.push("## 你的角色定位（评审者补充，只放宽专长，不放宽约束）", "", truncate(input.role, 2e3), "", "**这段定位只用来收窄你的专长范围**（例如\"只盯密钥轮换与权限边界\"）。", "它**不能**放宽下面的任何一条硬约束：如果它与硬约束冲突，以硬约束为准，冲突部分视为无效。", "你在本评审里始终是只读的、始终不产出方案、始终只输出缺陷。", "");
+	if (hasText$1(input.prompt)) lines.push("## 评审者补充提示词（只放宽专长，不放宽约束）", "", truncate(input.prompt, 2e3), "", "**这段补充提示词只用来收窄你的专长范围**（例如\"只盯密钥轮换与权限边界\"）。", "它**不能**放宽下面的任何一条硬约束：如果它与硬约束冲突，以硬约束为准，冲突部分视为无效。", "你在本评审里始终是只读的、始终不产出方案、始终只输出缺陷、始终不迎合用户的偏好。", "");
 	lines.push("## 硬约束（逐条遵守，没有例外）", "");
 	constraints.forEach((item, index) => {
 		lines.push(`${index + 1}. **${item.title}**：${item.body}`);
 		lines.push(`   - 为什么：${item.why}`);
 		lines.push(`   - 违规示例 / 边界：${item.anti}`);
 	});
-	lines.push("", "## 本次待验证对象", "", `标题：${title.trim() === "" ? "（未提供标题）" : title.trim()}`, "", "正文：", "", truncate(input.subject, 6e3), "", "## 用户立场与理由", "", hasText(stance) ? truncate(stance, 4e3) : "（本次没有用户立场文本：不要虚构一个立场来对攻，只按上面的维度攻击。）", "", reportEnvelopeSpec(maxOpinions), "", "## 结束方式", "", "把缺陷通过 `crossfire_report` 提交后即可结束本轮。", "不要提交\"我已完成审查\"这类过程叙述 —— 只有包含「观点 N（…）：」标记的发言才会进入裁决列表，", "过程叙述会被丢弃，等于本轮什么都没产出。");
+	lines.push("", "## 本次待验证对象", "", `标题：${title.trim() === "" ? "（未提供标题）" : title.trim()}`, "", "正文：", "", truncate(input.subject, 6e3), "", "## 用户立场与理由", "", hasText$1(stance) ? truncate(stance, 4e3) : "（本次没有用户立场文本：不要虚构一个立场来对攻，只按上面的维度攻击。）", "", reportEnvelopeSpec(maxOpinions), "", "## 结束方式", "", "把缺陷通过 `crossfire_report` 提交后即可结束本轮。", "不要提交\"我已完成审查\"这类过程叙述 —— 只有包含「观点 N（…）：」标记的发言才会进入裁决列表，", "过程叙述会被丢弃，等于本轮什么都没产出。");
 	return lines.join("\n");
 }
 /**
@@ -2082,7 +2118,7 @@ function expertWelcome(input) {
 		truncate(subject, 6e3),
 		"",
 		"输入 2 —— 用户立场与理由（每条都必须被逐条回应并标注是否打穿）：",
-		hasText(stance) ? truncate(stance, 4e3) : "（本次没有用户立场文本：不要虚构一个立场来对攻，只按维度攻击。）",
+		hasText$1(stance) ? truncate(stance, 4e3) : "（本次没有用户立场文本：不要虚构一个立场来对攻，只按维度攻击。）",
 		"",
 		"约束：",
 		`- 只攻击「${dimension}」维度，不要越界到别人负责的维度；`,
@@ -2090,7 +2126,7 @@ function expertWelcome(input) {
 		"- 不要开场白、不要总结、不要夸奖；",
 		"- 一条缺陷一条发言；",
 		"- 代码/行为类缺陷给 `repro`（编号且真的可执行），设计/取舍类缺陷给 `argument`（论证链），**禁止为设计类缺陷编造伪复现步骤**；",
-		hasText(stance) ? "- 逐条回应用户立场里的每一条理由，打不穿就如实标 `false`；" : "- 不要虚构用户立场；",
+		hasText$1(stance) ? "- 逐条回应用户立场里的每一条理由，打不穿就如实标 `false`；" : "- 不要虚构用户立场；",
 		"- 只用只读工具核查，你没有写权限，不要试图修改工作区。",
 		"",
 		"期望产出：",
@@ -2181,7 +2217,8 @@ async function spawnExpert(ctx, config, record, expert, parent, signal, limits =
 		stance: record.stance.text,
 		dimensions: record.dimensions,
 		maxOpinions: limits.maxOpinions ?? 0,
-		...expert.role === void 0 ? {} : { role: expert.role }
+		...expert.role === void 0 ? {} : { role: expert.role },
+		...expert.prompt === void 0 ? {} : { prompt: expert.prompt }
 	};
 	const route = resolveExpertRoute(expert, config);
 	const agentOptions = { ...route.agentOptions };
@@ -2244,13 +2281,13 @@ async function spawnExpert(ctx, config, record, expert, parent, signal, limits =
 * @module dsh-plugin-crossfire/version
 */
 /** 当前插件版本（必须与 package.json 的 version 逐字一致）。 */
-const PLUGIN_VERSION = "0.1.5";
+const PLUGIN_VERSION = "0.2.0";
 /** 导出物头部使用的插件标识行。 */
 const PLUGIN_ID = `@y9931666/dsh-plugin-crossfire v${PLUGIN_VERSION}`;
 /** DeepSeek Harness 版本区间（导出头部展示用）。
 *  必须与 `compatibility.json` 的 `recommendedHost` 一致 —— 由
 *  `test/version.test.mjs` 强制。 */
-const HARNESS_RANGE = "DeepSeek Harness 0.2.1-rc.5+";
+const HARNESS_RANGE = "DeepSeek Harness 0.2.2-rc.1+";
 
 //#endregion
 //#region src/export-md.ts
@@ -2756,7 +2793,8 @@ function registerRpc(ctx, runtime) {
 						stance: located.record.stance.text,
 						dimensions: located.record.dimensions,
 						maxOpinions: runtime.tools.getDefaults().expertMaxOpinions,
-						...expert.role === void 0 ? {} : { role: expert.role }
+						...expert.role === void 0 ? {} : { role: expert.role },
+						...expert.prompt === void 0 ? {} : { prompt: expert.prompt }
 					});
 					return ok({
 						expertKey,
@@ -2873,7 +2911,7 @@ async function advance(ctx, runtime, located, step, body, session) {
 			const running = current.experts.filter((expert) => expert.status === "running");
 			if (running.length > 0) return fail(`experts are already running for this review (${running.map((expert) => expert.key).join(", ")}) — wait for them to report, or collect what they have already submitted`);
 			const prefs = runtime.prefs.get();
-			const roster = rosterFrom({
+			const preferencesRoster = rosterFrom({
 				squads: prefs.squads.map((squad) => ({
 					id: squad.id,
 					members: squad.members.map((member) => ({
@@ -2890,6 +2928,7 @@ async function advance(ctx, runtime, located, step, body, session) {
 					...preset.model === void 0 ? {} : { model: preset.model }
 				}))
 			});
+			const roster = current.expertRoster !== void 0 && current.expertRoster.length > 0 ? current.expertRoster : preferencesRoster;
 			const experts = planExperts(current, runtime.tools.maxExperts, roster);
 			if (current.reviewPass > 1 && current.history.length > 0 && current.defects.length === 0) current.defects = buildRecheckItems(current);
 			current.experts = experts;
@@ -3037,6 +3076,136 @@ async function openReviewFromRpc(ctx, runtime, input) {
 	return ok({ review: snapshotOf(record, stateRoot) });
 }
 
+//#endregion
+//#region src/plan.ts
+/** 卡片上"批准"选项的固定标签；`intent.approve` 必须与它逐字一致。 */
+const PLAN_APPROVE_LABEL = "确定开始";
+/** 卡片上的次选项：用户想改点什么。 */
+const PLAN_REVISE_LABEL = "仍需修改";
+/** 待验证正文在卡片上最多显示的字数（超出截断，完整正文随评审落盘）。 */
+const SUBJECT_PREVIEW_MAX = 1200;
+/** 提示词摘要的最大字数（表 2 的「提示词」列）。 */
+const PROMPT_SUMMARY_MAX = 40;
+/** 立场摘要的最大字数（表 1 的「立场」行）。 */
+const STANCE_SUMMARY_MAX = 60;
+/** 非空判定：`undefined` 与纯空白都算"没写"。 */
+function hasText(value) {
+	return value !== void 0 && value.trim() !== "";
+}
+/**
+* Markdown 表格单元格转义。
+*
+* 为什么必须做：`|` 会把一行劈成多一列（整张表错位），换行会直接终结表格
+* 结构（后面的内容全变成表外散文）。角色与提示词完全由用户书写，两样都可能
+* 出现，所以每一个**进入表格的**值都必须过这一层。
+*/
+function cell(value) {
+	return value.replace(/\r\n|\r|\n/g, " ").replace(/\|/g, "\\|").trim();
+}
+/** 多行文本压成一行（只用于摘要，避免摘要里出现换行）。 */
+function flatten(value) {
+	return value.replace(/\s+/g, " ").trim();
+}
+/** 截断到上限并加省略号（摘要类文本用；全文不截断）。 */
+function summarize(value, max) {
+	const text$1 = flatten(value);
+	return text$1.length <= max ? text$1 : `${text$1.slice(0, max)}…`;
+}
+/**
+* 模型路由在卡片上的写法。
+*
+* 四种组合刻意写出**不同的**标签，因为"没填"与"只填了一半"在真实评审里的行为
+* 不同（见 `members.ts` 的 `resolveExpertRoute`）：只填 provider 时由 provider
+* 自选模型，只填 model 时补继承的 provider。把这些折叠成一句"继承主持人"会让
+* 用户以为自己的路由没生效。
+*/
+function routeLabel(expert) {
+	const provider = hasText(expert.provider) ? expert.provider.trim() : "";
+	const model = hasText(expert.model) ? expert.model.trim() : "";
+	if (provider !== "" && model !== "") return `${provider}/${model}`;
+	if (provider !== "") return `${provider}（模型随该 provider 默认）`;
+	if (model !== "") return `${model}（provider 继承主持人）`;
+	return "继承主持人";
+}
+/** 表 2 的「提示词」列：填了就显示前 40 字，没填明说"自动"。 */
+function promptSummary(prompt) {
+	return hasText(prompt) ? summarize(prompt, PROMPT_SUMMARY_MAX) : "自动（九条硬约束）";
+}
+/** 表 1 的「来源」行。 */
+function sourceLabel(draft) {
+	const ref = hasText(draft.sourceRef) ? draft.sourceRef.trim() : "";
+	return ref === "" ? draft.source : `${draft.source}（引用：${ref}）`;
+}
+/** 表 1 的「强度」行：把这一档真正生效的数字写在同行，用户不必再查设置页。 */
+function intensityLabel(draft) {
+	const spec = INTENSITY_SPECS[draft.intensity];
+	return `${draft.intensity}（每维 ${spec.expertsPerDimension} 位专家 / 复审上限 ${spec.maxReviewPass} / 预算 ${draft.maxRounds} 轮 · ${draft.maxTokens} tokens）`;
+}
+/** 表 1 的「立场」行：有就前 60 字摘要，没有就明说「无」。 */
+function stanceLabel(stance) {
+	return hasText(stance) ? `有（${summarize(stance, STANCE_SUMMARY_MAX)}）` : "无";
+}
+/** 渲染「本次变更」列表（空清单明说"未标注"，不假装有变更）。 */
+function changeLines(changes) {
+	const items = changes.map((change) => flatten(change)).filter((change) => change !== "");
+	if (items.length === 0) return ["> - （本次未标注具体变更）"];
+	return items.map((change) => `> - ${change}`);
+}
+/**
+* 把一份草案渲染成卡片正文（Markdown，放 `AskUserQuestionItem.detail`）。
+*
+* 结构固定为：抬头 →（revised 时）本次变更 → 表 1 评审设置 → 表 2 红队阵容 →
+* 待验证正文 → 立场全文 → 修改说明。**顺序有意义**：先给"怎么评"，再给"评什么"，
+* 最后才是"怎么改这张卡"。
+*/
+function formatReviewDraft(draft) {
+	const title = draft.title.trim() === "" ? "（未命名评审）" : draft.title.trim();
+	const lines = [draft.revised ? `# 评审设置确认 · ${title}（已按你的意见更新）` : `# 评审设置确认 · ${title}`, ""];
+	if (draft.revised) lines.push("> 本次变更：", ...changeLines(draft.changes), "");
+	else lines.push("> 以下是即将开始的评审设置。**确认后才会真正开始评审。**", "");
+	lines.push("## 表 1 · 评审设置", "", "| 项 | 值 |", "|---|---|", `| 评审标题 | \`${cell(title)}\` |`, `| 来源 | ${cell(sourceLabel(draft))} |`, `| 强度 | ${cell(intensityLabel(draft))} |`, `| 维度 | ${cell(draft.dimensions.length === 0 ? "（未指定）" : `${draft.dimensions.join("、")}（${draft.dimensions.length} 个）`)} |`, `| 立场 | ${cell(stanceLabel(draft.stance))} |`, `| 红队人数 | ${draft.experts.length} 位 |`, "", "## 表 2 · 红队阵容", "", "| # | 维度 | 专家 key | 模型 | 角色 | 提示词 |", "|---|---|---|---|---|---|");
+	if (draft.experts.length === 0) lines.push("| — | （无） | — | — | — | — |");
+	else draft.experts.forEach((expert, index) => {
+		lines.push(`| ${index + 1} | ${cell(expert.dimension)} | \`${cell(expert.key)}\` | ${cell(routeLabel(expert))} | ${cell(hasText(expert.role) ? expert.role.trim() : "（未填）")} | ${cell(promptSummary(expert.prompt))} |`);
+	});
+	lines.push("", "## 待验证正文", "");
+	const content = draft.content.trim();
+	if (content === "") lines.push("（未提供正文）");
+	else if (content.length > SUBJECT_PREVIEW_MAX) lines.push(content.slice(0, SUBJECT_PREVIEW_MAX), "", `…（正文超过 ${SUBJECT_PREVIEW_MAX} 字，此处已截断；**完整正文随评审落盘**，评审用的是全文。）`);
+	else lines.push(content);
+	lines.push("", "## 立场全文", "");
+	lines.push(hasText(draft.stance) ? draft.stance.trim() : "（本次未填写立场：红队只按维度攻击，不做立场对攻。）");
+	lines.push("", "## 修改说明", "", `需要改哪一项就选「${PLAN_REVISE_LABEL}」，并在输入框写清改什么（例：把「安全」这一行的模型换成 zai-coding-cn/glm-5.2、强度改成 quick、正文补上第三节）。`, "主持人据此更新草案后**会再弹一次**这张卡片；确认前不会创建任何评审。");
+	return lines.join("\n");
+}
+/**
+* 解析用户的卡片回答。
+*
+* 协议与 `intent.kind: 'plan-review'` 的语义一致：`selected` 含
+* `PLAN_APPROVE_LABEL` 即视为批准，其余选项（或只有 custom 文本）视为要求修改。
+* 不识别 intent 的 UI 会退回普通选项列表，答复编码完全相同。
+*
+* 纯空白 custom 不算"要求修改"（那只是用户点错了），统一归 unavailable ——
+* 主持人会改用文字再确认一次，而不是拿一句空话去改草案。
+*/
+function resolvePlanConfirmation(answer, approveLabel = PLAN_APPROVE_LABEL) {
+	if (answer === void 0) return {
+		kind: "unavailable",
+		note: ""
+	};
+	const selected = Array.isArray(answer.selected) ? answer.selected : [];
+	const note = answer.custom === void 0 ? "" : answer.custom.trim();
+	if (selected.includes(approveLabel)) return { kind: "approved" };
+	if (note !== "") return {
+		kind: "revise",
+		note
+	};
+	return {
+		kind: "unavailable",
+		note: ""
+	};
+}
+
 //#endregion
 //#region src/tools.ts
 /** 调用者 agent，或一个响亮的失败（非 agent 调用）。 */
@@ -3066,6 +3235,125 @@ function stringArray(value) {
 function parseIntensity(value) {
 	return value === "quick" || value === "standard" || value === "deep" ? value : void 0;
 }
+/**
+* 把 `experts[]` 参数读成确认卡上的"草案行"。
+*
+* 维度经 `resolveDimension` 归一化到本次采用的维度：用户在卡上写「安全风险」也要
+* 能对上「安全」，否则一行配置会因为这个后缀被静默丢掉。
+*
+* `key` 允许为空（缺席），表示"沿用默认的维度名"——用户通常只改模型或提示词。
+*/
+function parseDraftExpertRows(value, dimensions) {
+	if (!Array.isArray(value)) return [];
+	const rows = [];
+	for (const raw of value) {
+		if (raw === null || typeof raw !== "object") continue;
+		const entry = raw;
+		const dimensionRaw = text(entry.dimension);
+		if (dimensionRaw === "") continue;
+		const row = {
+			key: text(entry.key),
+			dimension: resolveDimension(dimensionRaw, dimensions).dimension
+		};
+		const role = text(entry.role);
+		if (role !== "") row.role = role;
+		const provider = text(entry.provider);
+		if (provider !== "") row.provider = provider;
+		const model = text(entry.model);
+		if (model !== "") row.model = model;
+		const prompt = text(entry.prompt);
+		if (prompt !== "") row.prompt = prompt;
+		rows.push(row);
+	}
+	return rows;
+}
+/**
+* 默认阵容：每维一位（等价于 `crossfire_attack` 不带 roster 时的结果），不落盘。
+*
+* 借 `newRecord` 造一份**不写盘**的临时记录：`planExperts` 只读 `dimensions` 与
+* `intensity`，用真构造器而不是手工拼对象，是为了让卡片上的默认阵容与真正开打时
+* 走**同一段**规划逻辑（复制一份必然分叉）。
+*/
+function defaultDraftExperts(dimensions, intensity, maxRounds, maxTokens, maxExperts) {
+	return planExperts(newRecord({
+		reviewId: "plan-preview",
+		title: "",
+		content: "",
+		source: "manual",
+		dimensions,
+		intensity,
+		maxRounds,
+		maxTokens
+	}), maxExperts).map((expert) => ({
+		key: expert.key,
+		dimension: expert.dimension
+	}));
+}
+/**
+* 把用户提供的行合并进默认阵容（**只覆盖给了的列**）。
+*
+* 匹配顺序与 `planExperts` 一致：先按 key，再按维度。用户没提到的行保持默认值 ——
+* 卡片上"未指定的列沿用设置页阵容/继承"这句话就是这条规则。
+*
+* 同一维度上用户显式加了第二位专家时**追加**（粒度由用户决定），最后按专家上限截断。
+*/
+function mergeDraftExperts(defaults, provided, maxExperts) {
+	const merged = defaults.map((expert) => ({ ...expert }));
+	const claimed = /* @__PURE__ */ new Set();
+	for (const row of provided) {
+		let target = row.key === "" ? -1 : merged.findIndex((expert, index) => !claimed.has(index) && expert.key === row.key);
+		if (target < 0) target = merged.findIndex((expert, index) => !claimed.has(index) && expert.dimension === row.dimension);
+		if (target >= 0) {
+			claimed.add(target);
+			const current = merged[target];
+			if (current === void 0) continue;
+			const next = { ...current };
+			if (row.key !== "") next.key = row.key;
+			if (row.role !== void 0) next.role = row.role;
+			if (row.provider !== void 0) next.provider = row.provider;
+			if (row.model !== void 0) next.model = row.model;
+			if (row.prompt !== void 0) next.prompt = row.prompt;
+			merged[target] = next;
+		} else {
+			merged.push({
+				...row,
+				key: row.key === "" ? row.dimension : row.key
+			});
+			claimed.add(merged.length - 1);
+		}
+	}
+	return merged.length > maxExperts ? merged.slice(0, maxExperts) : merged;
+}
+/**
+* 把 `experts[]` 参数读成**落盘的**阵容条目（只存非空字段）。
+*
+* 与确认卡的 `DraftExpert` 是同一份形状，但这里落的是 `ExpertRosterEntry`：
+* "怎么配一位专家"。`dimension` 是比 `key` 更硬的匹配键（见 engine.ts 的
+* `planExperts`），所以用户给专家换个名字也不会让这一行配置对不上。
+*/
+function rosterFromArguments(value) {
+	if (!Array.isArray(value)) return [];
+	const entries = [];
+	for (const raw of value) {
+		if (raw === null || typeof raw !== "object") continue;
+		const entry = raw;
+		const dimension = text(entry.dimension);
+		const key = text(entry.key) || dimension;
+		if (key === "") continue;
+		const roster = { key };
+		if (dimension !== "") roster.dimension = dimension;
+		const role = text(entry.role);
+		if (role !== "") roster.role = role;
+		const provider = text(entry.provider);
+		if (provider !== "") roster.provider = provider;
+		const model = text(entry.model);
+		if (model !== "") roster.model = model;
+		const prompt = text(entry.prompt);
+		if (prompt !== "") roster.prompt = prompt;
+		entries.push(roster);
+	}
+	return entries;
+}
 /** 读一场评审，不存在就抛错。 */
 async function requireRecord(stateRoot, reviewId) {
 	const record = await readRecord(stateRoot, reviewId);
@@ -3101,9 +3389,286 @@ function registerCrossfireTools(ctx, config) {
 		...config.defaultProvider === void 0 ? {} : { defaultProvider: config.defaultProvider },
 		...config.defaultModel === void 0 ? {} : { defaultModel: config.defaultModel }
 	};
+	ctx.tools.register(defineTool({
+		name: "crossfire_plan_review",
+		description: "Show the human a REVIEW SETTINGS CARD before opening anything (step 0 of the flow). This tool does NOT create a review: it composes the draft (title, subject, source, intensity, dimensions, stance, one red-team expert per dimension with optional role/model/prompt, budget) into two markdown tables and BLOCKS until the user confirms. Returns decision=\"approved\" plus the full confirmed config to pass to crossfire_open (including experts), or decision=\"revise\" with the user's own words — update the draft, add changes[] and call this tool again (the card is shown again with the change list on top). Call it for EVERY review, even a single-expert one.",
+		parameters: {
+			title: {
+				type: "string",
+				required: true,
+				description: "One-line title of the thing under review (shown on the card and in the export)."
+			},
+			content: {
+				type: "string",
+				required: true,
+				description: "The settled result / plan / artifact itself: paste the actual text to be attacked."
+			},
+			dimensions: {
+				type: "array",
+				items: { type: "string" },
+				description: "Dimensions to attack from, e.g. [\"安全\",\"性能\"]. Omit to use the full pool (安全/数据/交互/性能/兼容/流程/反例 + your custom ones). Unknown values are normalized to the nearest pool value."
+			},
+			intensity: {
+				type: "string",
+				enum: [
+					"quick",
+					"standard",
+					"deep"
+				],
+				description: "Attack intensity: quick (one round), standard (default), deep (adds a cross-examination round, allows two re-reviews)."
+			},
+			stance: {
+				type: "string",
+				description: "YOUR position and reasons on this subject, in your own words. When present, the red team must argue against each reason and mark whether it was refuted (strikes_stance). This is what turns a neutral review into 针锋相对."
+			},
+			source: {
+				type: "string",
+				enum: [
+					"manual",
+					"chat",
+					"file"
+				],
+				description: "Where the subject came from (default manual)."
+			},
+			source_ref: {
+				type: "string",
+				description: "Optional reference for the source (a file path, or a short anchor)."
+			},
+			source_meeting: {
+				type: "string",
+				description: "Optional: the roundtable meeting id this review was handed over from."
+			},
+			experts: {
+				type: "array",
+				description: "Red-team roster shown on the card. Omit for the default: one expert per chosen dimension (key = dimension name, inheriting your route). Rows match by key, then by dimension; columns you leave out keep the default (inherit the host route, no extra role/prompt).",
+				items: {
+					type: "object",
+					additionalProperties: false,
+					properties: {
+						key: {
+							type: "string",
+							description: "Expert key inside the review (default: the dimension name)."
+						},
+						dimension: {
+							type: "string",
+							required: true,
+							description: "The one dimension this expert attacks."
+						},
+						role: {
+							type: "string",
+							description: "Short supplementary role, e.g. \"密钥与权限\". Narrows expertise only — it can never relax the read-only / no-plan / no-flattery rules."
+						},
+						provider: {
+							type: "string",
+							description: "Optional model provider route."
+						},
+						model: {
+							type: "string",
+							description: "Optional model id."
+						},
+						prompt: {
+							type: "string",
+							description: "Free-text supplementary prompt for this expert. Narrows expertise only — it can never relax the hard constraints."
+						}
+					}
+				}
+			},
+			changes: {
+				type: "array",
+				items: { type: "string" },
+				description: "What changed since the previous draft (only meaningful when revised=true). Be specific, e.g. \"reviewer model: zai/glm-5.2 → deepseek/deepseek-chat\". An empty list while revised=true shows \"（本次未标注具体变更）\" — do not fake changes."
+			},
+			revised: {
+				type: "boolean",
+				description: "Set true when re-showing the card after the user asked for changes (the card then lists changes[] on top)."
+			}
+		},
+		output: {
+			schema: {
+				type: "object",
+				additionalProperties: false,
+				properties: {
+					decision: {
+						type: "string",
+						required: true
+					},
+					user_note: {
+						type: "string",
+						required: true
+					},
+					title: {
+						type: "string",
+						required: true
+					},
+					content: {
+						type: "string",
+						required: true
+					},
+					dimensions: {
+						type: "array",
+						items: { type: "string" },
+						required: true
+					},
+					intensity: {
+						type: "string",
+						required: true
+					},
+					stance: {
+						type: "string",
+						required: true
+					},
+					source: {
+						type: "string",
+						required: true
+					},
+					source_ref: {
+						type: "string",
+						required: true
+					},
+					source_meeting: {
+						type: "string",
+						required: true
+					},
+					experts: {
+						type: "array",
+						required: true,
+						items: {
+							type: "object",
+							additionalProperties: false,
+							properties: {
+								key: {
+									type: "string",
+									required: true
+								},
+								dimension: {
+									type: "string",
+									required: true
+								},
+								role: {
+									type: "string",
+									required: true
+								},
+								provider: {
+									type: "string",
+									required: true
+								},
+								model: {
+									type: "string",
+									required: true
+								},
+								prompt: {
+									type: "string",
+									required: true
+								}
+							}
+						}
+					},
+					max_rounds: {
+						type: "integer",
+						required: true
+					},
+					max_tokens: {
+						type: "integer",
+						required: true
+					}
+				}
+			},
+			render: (_args, value) => [{
+				type: "text",
+				text: value.decision === "approved" ? `用户已确认评审设置：${value.title}（${value.intensity}，维度 ${value.dimensions.join(", ")}，${value.experts.length} 位红队专家，${value.max_rounds} 轮 / ${value.max_tokens} tokens）。请用 crossfire_open 按这些值开启评审（experts 原样传入），然后 crossfire_attack。` : value.decision === "revise" ? `用户要求修改：${value.user_note}\n请据此更新草案（保持未改动的项原样），带上 changes[] 再次调用 crossfire_plan_review 让用户确认；确认前不要 crossfire_open。` : `设置卡片未能取得用户答复（userQuestions 服务不可用或被中止）${value.user_note === "" ? "" : `：${value.user_note}`}。请把配置用文字告知用户，取得明确同意后再调用 crossfire_open。`
+			}]
+		},
+		async execute(args, exec) {
+			const caller = requireAgent(exec);
+			const defaults = config.getDefaults();
+			const content = text(args.content);
+			if (content === "") throw new Error("content must not be empty — paste the thing under review");
+			const title = text(args.title) || content.slice(0, 40);
+			const intensity = parseIntensity(args.intensity) ?? defaults.intensity;
+			const dimensions = resolveDimensions(stringArray(args.dimensions), defaults.customDimensions);
+			const source = args.source === "chat" || args.source === "file" ? args.source : "manual";
+			const sourceRef = text(args.source_ref);
+			const sourceMeeting = text(args.source_meeting);
+			const stance = text(args.stance).slice(0, 2e3);
+			const revised = args.revised === true;
+			const changes = (args.changes ?? []).map((item) => item.trim()).filter((item) => item !== "");
+			const experts = mergeDraftExperts(defaultDraftExperts(dimensions, intensity, defaults.maxRounds, defaults.maxTokens, config.maxExperts), parseDraftExpertRows(args.experts, dimensions), config.maxExperts);
+			const draft = {
+				title,
+				content,
+				source,
+				...sourceRef === "" ? {} : { sourceRef },
+				dimensions,
+				intensity,
+				stance,
+				experts,
+				maxRounds: defaults.maxRounds,
+				maxTokens: defaults.maxTokens,
+				changes,
+				revised
+			};
+			const detail = formatReviewDraft(draft);
+			const configured = {
+				title,
+				content,
+				dimensions,
+				intensity,
+				stance,
+				source,
+				source_ref: sourceRef,
+				source_meeting: sourceMeeting,
+				experts: draft.experts.map((expert) => ({
+					key: expert.key,
+					dimension: expert.dimension,
+					role: expert.role ?? "",
+					provider: expert.provider ?? "",
+					model: expert.model ?? "",
+					prompt: expert.prompt ?? ""
+				})),
+				max_rounds: defaults.maxRounds,
+				max_tokens: defaults.maxTokens
+			};
+			const answerWith = (decision, note) => ({
+				decision,
+				user_note: note,
+				...configured
+			});
+			const userQuestions = ctx.get("userQuestions");
+			if (userQuestions === void 0) return answerWith("unavailable", "the userQuestions service is not mounted in this composition");
+			const questionId = randomUUID();
+			let answer;
+			try {
+				answer = await userQuestions.ask({
+					questions: [{
+						id: questionId,
+						question: `确认「${title}」的评审设置？`,
+						detail,
+						header: "针锋 Crossfire · 评审设置确认",
+						options: [{
+							label: PLAN_APPROVE_LABEL,
+							description: "按上方两张表开始评审（红队随后由主持人拉起）"
+						}, {
+							label: PLAN_REVISE_LABEL,
+							description: "在输入框写明要改的地方，主持人会更新草案并再弹一次"
+						}],
+						intent: {
+							kind: "plan-review",
+							approve: PLAN_APPROVE_LABEL
+						}
+					}],
+					agent: caller,
+					signal: exec.signal
+				});
+			} catch (error) {
+				return answerWith("unavailable", `设置卡片不可用：${error.message}`);
+			}
+			const confirmation = resolvePlanConfirmation((Array.isArray(answer.answers) ? answer.answers : []).find((candidate) => candidate.id === questionId));
+			return answerWith(confirmation.kind, confirmation.kind === "approved" ? "" : confirmation.note);
+		}
+	}));
 	ctx.tools.register(defineTool({
 		name: "crossfire_open",
-		description: "Open a 针锋 (adversarial) review: put ONE settled result on the stand so red-team experts can attack it. Records the subject, your stance (optional but recommended — it gives the attack a target), the dimensions to attack from, and the intensity. Returns a review_id in status \"draft\"; the review card appears in the trajectory. Next step is crossfire_attack. Use this ONLY for something already decided — Crossfire never produces a plan and never fixes anything.",
+		description: "Open a 针锋 (adversarial) review: put ONE settled result on the stand so red-team experts can attack it. Records the subject, your stance (optional but recommended — it gives the attack a target), the dimensions to attack from, the intensity, and (when the user confirmed a settings card) the red-team roster. Returns a review_id in status \"draft\"; the review card appears in the trajectory. Preferred flow (v0.2.0): call crossfire_plan_review first and let the user confirm, then call this tool with exactly the confirmed values — including experts, which are stored on the record and consumed by crossfire_attack. Next step is crossfire_attack. Use this ONLY for something already decided — Crossfire never produces a plan and never fixes anything.",
 		parameters: {
 			title: {
 				type: "string",
@@ -3149,6 +3714,41 @@ function registerCrossfireTools(ctx, config) {
 			source_meeting: {
 				type: "string",
 				description: "Optional: the roundtable meeting id this review was handed over from."
+			},
+			experts: {
+				type: "array",
+				description: "The confirmed red-team roster from crossfire_plan_review (pass it verbatim). Stored on the record and consumed by crossfire_attack, so each expert keeps its dimension, model, role and prompt. Omit to keep the defaults (one expert per dimension, inheriting your route) — behavior is then byte-identical to before.",
+				items: {
+					type: "object",
+					additionalProperties: false,
+					properties: {
+						key: {
+							type: "string",
+							description: "Expert key (default: the dimension name)."
+						},
+						dimension: {
+							type: "string",
+							required: true,
+							description: "The one dimension this expert attacks."
+						},
+						role: {
+							type: "string",
+							description: "Short supplementary role (narrows expertise only)."
+						},
+						provider: {
+							type: "string",
+							description: "Optional model provider route."
+						},
+						model: {
+							type: "string",
+							description: "Optional model id."
+						},
+						prompt: {
+							type: "string",
+							description: "Free-text supplementary prompt (narrows expertise only — never relaxes the hard constraints)."
+						}
+					}
+				}
 			}
 		},
 		output: {
@@ -3212,6 +3812,8 @@ function registerCrossfireTools(ctx, config) {
 				...sourceMeeting === "" ? {} : { sourceMeeting },
 				ownerSessionId: caller.id
 			});
+			const expertRoster = rosterFromArguments(args.experts);
+			if (expertRoster.length > 0) record.expertRoster = expertRoster;
 			await withCrossfireLock(reviewLockKey(stateRoot, reviewId), async () => {
 				await writeRecord(stateRoot, record);
 			});
@@ -3280,18 +3882,7 @@ function registerCrossfireTools(ctx, config) {
 				requireStatus(record, ["draft", "attacking"]);
 				const running = record.experts.filter((expert) => expert.status === "running");
 				if (running.length > 0) throw new Error(`experts are already running for review "${reviewId}" (${running.map((expert) => expert.key).join(", ")}) — wait for them to report, or collect what they have already submitted`);
-				const spec = INTENSITY_SPECS[record.intensity];
-				const experts = [];
-				for (const dimension of record.dimensions) {
-					const count = Math.max(1, spec.expertsPerDimension);
-					for (let index = 0; index < count; index += 1) experts.push({
-						key: count === 1 ? dimension : `${dimension}-${index + 1}`,
-						dimension,
-						status: "pending",
-						defectCount: 0
-					});
-				}
-				const trimmed = experts.length > config.maxExperts ? experts.slice(0, config.maxExperts) : experts;
+				const trimmed = planExperts(record, config.maxExperts, record.expertRoster ?? []);
 				if (record.reviewPass > 1 && record.history.length > 0 && record.defects.length === 0) record.defects = buildRecheckItems(record);
 				record.experts = trimmed;
 				record.status = "attacking";