bothouse-dsh 0.1.52 → 0.1.54

package/collab/cli-member.mjs

@@ -53,6 +53,8 @@ export function cleanEnv(env = process.env) {
   return Object.fromEntries(Object.entries(env).filter(([k]) => KEEP_ENV.has(k) || (!k.startsWith('CLAUDECODE') && !k.startsWith('CLAUDE_CODE_'))))
 }
 
+function flattenOptions(options = []) { return options.flatMap(x => Array.isArray(x.options) ? flattenOptions(x.options) : [x]) }
+
 export class CliMember {
   constructor({ cli, cwd, persona = '', env } = {}) {
     if (!ADAPTERS[cli]) throw new Error(`unknown cli: ${cli}`)
@@ -81,6 +83,10 @@ export class CliMember {
       },
       sessionUpdate: async (n) => {
         const u = n.update
+        if (u?.sessionUpdate === 'config_option_update' && Array.isArray(u.configOptions)) {
+          const session = [...this.sessions.values()].find(x => x.sessionId === n.sessionId)
+          if (session) session.configOptions = u.configOptions
+        }
         if (u?.sessionUpdate === 'agent_message_chunk' && u.content?.type === 'text' && this.buffers.has(n.sessionId)) {
           // 工具调用隔开的两段话是两条消息：另起一段，[report]/[ask] 这类首行标记才落在行首（team-exit.mjs exitMark）。
           const prev = this.buffers.get(n.sessionId)
@@ -161,8 +167,8 @@ export class CliMember {
     this.saved.delete(room)
     if (prevId && this.canLoad) {
       try {
-        await Promise.race([this.conn.loadSession({ sessionId: prevId, cwd: this.cwd, mcpServers: [] }), this.exited])
-        s = { sessionId: prevId }
+        const loaded = await Promise.race([this.conn.loadSession({ sessionId: prevId, cwd: this.cwd, mcpServers: [] }), this.exited])
+        s = { sessionId: prevId, configOptions: loaded?.configOptions }
         this.sessions.set(room, s)
         return { ...s, resumed: true, lost: false }
       } catch (err) {
@@ -170,11 +176,73 @@ export class CliMember {
       }
     }
     const r = await Promise.race([this.conn.newSession({ cwd: this.cwd, mcpServers: [] }), this.exited])
-    s = { sessionId: r.sessionId }
+    s = { sessionId: r.sessionId, configOptions: r.configOptions }
     this.sessions.set(room, s)
     return { ...s, resumed: false, lost: Boolean(prevId) }
   }
 
+  // A fresh probe supplies current adapter defaults, including the selected model's effort default.
+  // It never prompts and does not touch the existing conversation.
+  async _options(model) {
+    await this._start()
+    const fresh = await Promise.race([this.conn.newSession({ cwd: this.cwd, mcpServers: [] }), this.exited])
+    let options = fresh.configOptions || []
+    const selector = (id) => options.find(o => o.id === id && o.type === 'select')
+    if (model !== undefined) {
+      const option = selector('model')
+      if (!option) return []
+      if (!flattenOptions(option.options).some(o => o.value === model)) { const error = new Error('Codex model is unavailable'); error.code = 'COLLAB_CONFIG_INVALID'; throw error }
+      options = (await Promise.race([this.conn.setSessionConfigOption({ sessionId: fresh.sessionId, configId: 'model', value: model }), this.exited])).configOptions || []
+      if (selector('model')?.currentValue !== model) throw new Error('Codex did not apply the model')
+    }
+    return options
+  }
+
+  async probeOptions(model) {
+    const options = await this._options(model)
+    const select = id => {
+      const o = options.find(x => x.id === id && x.type === 'select')
+      return o ? { current: o.currentValue ?? null, options: flattenOptions(o.options).map(x => ({ value: x.value, name: x.name })) } : null
+    }
+    const modelOption = select('model')
+    return modelOption ? { supported: true, model: modelOption, reasoningEffort: select('reasoning_effort') } : { supported: false, model: null, reasoningEffort: null }
+  }
+
+  // Keep probe sessions in a short-lived process, not in the conversation adapter.
+  async _defaultOptions(model) {
+    const probe = new CliMember({ cli: this.cli, cwd: this.cwd, env: this.extraEnv })
+    try { return await probe._options(model) } finally { probe.close() }
+  }
+
+  async _configure(s, desired) {
+    const get = (opts, id) => opts?.find(o => o.id === id && o.type === 'select')
+    const signature = JSON.stringify([desired?.model ?? null, desired?.reasoningEffort ?? null])
+    const snapshot = s.appliedConfig
+    if (snapshot?.signature === signature && snapshot.values.every(([id, value]) => get(s.configOptions, id)?.currentValue === value)) return
+    const stored = [...this.sessions.values()].find(x => x.sessionId === s.sessionId)
+    if (stored) stored.appliedConfig = undefined
+    const defaults = await this._defaultOptions(desired?.model)
+    const model = desired?.model ?? get(defaults, 'model')?.currentValue
+    const effort = desired?.reasoningEffort ?? get(defaults, 'reasoning_effort')?.currentValue
+    if (!model) throw new Error('Codex model selection is unsupported')
+    let options = s.configOptions || []
+    for (const [id, value] of [['model', model], ['reasoning_effort', effort]]) {
+      if (value === undefined || value === null) continue
+      const option = get(options, id)
+      if (!option || !flattenOptions(option.options).some(o => o.value === value)) throw new Error(`Codex ${id} selection is unavailable`)
+      if (option.currentValue !== value) {
+        options = (await Promise.race([this.conn.setSessionConfigOption({ sessionId: s.sessionId, configId: id, value }), this.exited])).configOptions || []
+        if (stored) stored.configOptions = options
+      }
+      if (get(options, id)?.currentValue !== value) throw new Error(`Codex ${id} did not apply`)
+    }
+    s.configOptions = options
+    if (stored) {
+      stored.configOptions = options
+      stored.appliedConfig = { signature, values: [['model', model], ['reasoning_effort', effort]].filter(([, value]) => value != null) }
+    }
+  }
+
   /**
    * onText(textSoFar) 在每个公开文字分片到达时调用（#121）；onTool(update) 在每个工具调用开始/更新和每个思考分片到达时调用。
    * opts.resumeId：要续上的 sessionId；opts.onSession({ sessionId, resumed, lost })：会话就绪后、发提示词前调用。
@@ -188,9 +256,10 @@ export class CliMember {
     return run
   }
 
-  async _ask(text, room, onText, onTool, { resumeId, onSession, attachments = [], onPermission } = {}) {
+  async _ask(text, room, onText, onTool, { resumeId, onSession, attachments = [], onPermission, cliConfig, cliConfigManaged } = {}) {
     const s = await this._session(room, resumeId)
-    await onSession?.(s)
+    if (this.cli === 'codex' && cliConfigManaged) await this._configure(s, cliConfig)
+    await onSession?.({ sessionId: s.sessionId, resumed: s.resumed, lost: s.lost })
     // persona 每轮都拼：续上的或新开的会话都不会丢人设。
     const body = this.persona ? `${this.persona}\n\n${text}` : text
     this.buffers.set(s.sessionId, '')

package/collab/dsh-member.mjs

@@ -385,7 +385,7 @@ export class DshMembers {
     this.openTurns = new Map();
     /** Agents whose request hook was installed after they were loaded by someone else. */
     this.hooked = new WeakSet();
-    /** memberId -> { cli, agent } live local CLI agents (members with a `cli` field). */
+    /** JSON([memberId, cwd, roomId]) -> { memberId, cli, agent } live local CLI agents (members with a `cli` field). */
     this.cliAgents = new Map();
     /** #557: permission cards of channel-started turns, shared with cloud-web bots. */
     this.approvals = ChannelApprovals.of(hub);
@@ -669,7 +669,10 @@ export class DshMembers {
     if (!this.store.markSent(job.id, sessionId, 0, undefined)) return;
     const cwd = this.store.bindingWorkspacePath(member.id, room.id, this.store.workspacePath(room.id, this.rt.workspacePath));
     this.store.setBindingWorkspacePath(member.id, room.id, cwd);
-    const cliKey = JSON.stringify([member.id, cwd]);
+    // The room is part of the key: a CLI process gets its env once, at spawn (cli-member.mjs _start), and
+    // CC_SESSION_KEY names the room memvote.py records a citation under (memory-sources.mjs keyRoom). Keyed
+    // by (member, cwd) alone, the turn in room 2 kept the process of room 1 and voted/recalled room 1.
+    const cliKey = JSON.stringify([member.id, cwd, room.id]);
     let entry = this.cliAgents.get(cliKey);
     if (entry === undefined) {
       // Persona goes through promptText every turn, so an edit applies without restarting the CLI.
@@ -737,8 +740,9 @@ export class DshMembers {
     };
     let done = false;
     try {
-      this.store.advanceCursor(member.id, job.room_id, job.trigger_id);
       const onSession = ({ sessionId: acpId, lost }) => {
+        this.store.advanceCursor(member.id, job.room_id, job.trigger_id);
+        wiki.commit();
         if (this.store.binding(member.id, room.id)?.session_id !== acpId) this.store.rebind(member.id, room.id, acpId);
         if (lost) {
           // the CLI's new session has none of what this conversation was given: the next turn gives it again
@@ -751,8 +755,7 @@ export class DshMembers {
         }
       };
       const prompt = promptText(room, member, unseen, withBlock(memberStatus(this.hub, undefined, room.id), wiki.block), this.store.dispatchMode(room.id), this.store) + (this.rt.later?.instructions(member.id, room.id) ?? '') + workspaceHint(this.hub, this.rt.later, member.id, room.id);
-      wiki.commit();
-      const text = (await entry.agent.ask(prompt, String(room.id), onText, onTool, { resumeId, onSession, onPermission, attachments: attachmentBlocks(this.rt.files, unseen) }))?.trim();
+      const text = (await entry.agent.ask(prompt, String(room.id), onText, onTool, { resumeId, onSession, onPermission, cliConfig: member.cliConfig, cliConfigManaged: member.cliConfigManaged, attachments: attachmentBlocks(this.rt.files, unseen) }))?.trim();
       if (this.closed) return;
       this.hub.quota?.observe(member.id, room.id, { error: text });
       if (!text) { this.fail(job.id, `${member.name} 这一轮没有给出回复（${member.cli} 没有输出文字）`); return; }

package/collab/handoff-rules.json

@@ -1,12 +1,12 @@
 {
  "_doc": [
-  "交接校验规则，只此一份：ws-handoff（_handoff_rules.py）和 DSH collab（handoff-rules.mjs：建工作区交接、/tasks 派活）都读它。",
+  "交接校验规则（产品默认，只查通用必填项）：ws-handoff（_handoff_rules.py）和 DSH collab（handoff-rules.mjs：建工作区交接、/tasks 派活）都读它。",
+  "必填只有「用户原话」「总目标」「范围」（至少一行「改：…」）和「参照实现」（文件:行，或「无（新建）」）；另外不许引用 /tmp、浏览器活要写标签页 id、多人改要写底分支。",
+  "严格规则在 handoff-rules.strict.json，默认不加载；在数据目录的 collaboration/handoff-rules.local.json 写 {\"profile\": \"strict\"} 才叠加。local 文件的 checks 按 id 覆盖或追加，flags 打开 ws-handoff 的额外关卡（require_short、cli_gate）。DSH collab 只读本文件。",
   "标题行 = 去掉前导空白后以 # 开头的行；一节 = 从标题（或 inline 时以节名开头的行）到下一个标题。lead 是行首可去掉的字符。",
   "正则只写 ASCII 字符类（JS 的 \\w、\\d 只认 ASCII，Python 认 Unicode），按 search 用，要锚定就写 ^。",
-  "checks 按顺序跑，报第一条不合格的。dispatch 列出只带字段的派活（/tasks：title、ref、base）要跑的检查：字段拼成一份交接再查。",
-  "改规则后跑 contrib/lead/test_handoff_rules.py（Python 与 Node 跑同一组 fixture 比对）。",
-  "art_ref：出图类活（总目标/范围提到画、出图、小人、角色图、封面、立绘、Q版等，且范围的「改」行没写代码文件）要有「参考图」节（或「参考图：」行），列至少 min 张参考图路径或链接；写「原创：无现成图」的创意活照样要 min 张风格/构图参考，另写先出小样给用户挑。交回 [report] 要带对照图（team-exit-rules.json 的 art）。起因：用户 11-01「每次都给我画一坨屎出来」，规矩写在文字里没人执行，改成检查。",
-  "reuse：参照实现写「无（新建）」时必须有「复用盘点：」行。起因：用户 10-30 两次、11-02 一次骂「又自己写一套、不复用记忆论坛」，同类错第 3 次改成检查。"
+  "checks 按顺序跑；ws-handoff 一次列出所有不合格项，DSH collab 报第一条。dispatch 列出只带字段的派活（/tasks：title、ref、base）要跑的检查：字段拼成一份交接再查。",
+  "改规则后跑 contrib/lead/test_handoff_rules.py（Python 与 Node 跑同一组 fixture 比对）。"
  ],
  "lead": "#-*> \t",
  "checks": [
@@ -16,11 +16,7 @@
    "names": [
     "用户原话",
     "总目标",
-    "范围",
-    "已查过什么",
-    "进度",
-    "相关改动",
-    "规矩"
+    "范围"
    ],
    "msg": "交接文件缺小节：{missing}",
    "sep": "、"
@@ -36,49 +32,17 @@
    "msg": "缺参照实现：写 文件:行，非代码活写「无（新建）」。示例：\n## 参照实现\n- bridge/contrib/lead/ws-up:120（和它的差异：…）",
    "dispatch_msg": "缺参照实现：写 文件:行，非代码活写「无（新建）」。示例：ref: \"dsh/collab/tasks.mjs:226\"，或 ref: \"无（新建）\""
   },
-  {
-   "id": "reuse",
-   "type": "needs_if",
-   "trigger_re": "无\\s*[（(]\\s*新建\\s*[)）]",
-   "need_re": "复用盘点\\s*[:：]\\s*\\S.{5,}",
-   "msg": "参照实现写了「无（新建）」，就要加一行「复用盘点：」，写清查过哪些现成能力（记忆论坛推送/打分、夜间反思、dream 手册、ws-handoff 续做、已有脚本或 skill 等，带 文件:行 或名字）、为什么都不能用。起因：用户 10-30、11-02 三次骂「又自己写一套」。示例：\n复用盘点：查过 ~/.bothouse/gate-exp/ctxsvc.py:355 推送、~/wiki/bin/manuals.py 夜里手册，都管不到 X，所以新建"
-  },
-  {
-   "id": "checked",
-   "type": "ref",
-   "section": "已查过什么",
-   "none_re": "无\\s*[（(]\\s*没查过",
-   "ref_re": "[~A-Za-z0-9_./-]*[A-Za-z_][~A-Za-z0-9_./-]*(:[0-9]+|\\.[A-Za-z]+)",
-   "path_re": "[/.]",
-   "msg": "「已查过什么」节要写已查过的 文件:行 或文档路径，下一棒不用重查；什么都没查过写「无（没查过）」。示例：\n## 已查过什么\n- dsh/collab/tasks.mjs:467 assign 只校验 ref/base\n- ~/work/codemaps/bothouse-bridge.md「编译与测试」节"
-  },
   {
    "id": "scope",
    "type": "kinds",
    "section": "范围",
    "line_re": "^(不?改)\\s*[:：]\\s*\\S",
    "need": [
-    "改",
-    "不改"
+    "改"
    ],
-   "max": {
-    "kind": "改",
-    "n": 3,
-    "msg": "「范围」里「改」有 {n} 项，超过 3 项：拆成几件分别交，每件只管 1-3 项。"
-   },
    "item": "{}：…",
    "sep": "」「",
-   "msg": "「范围」节缺「{missing}」行：用户原话里的名词逐个写改或不改，没有不改的写「不改：无」。示例：\n## 范围\n- 改：任务卡（只在工作区显示）\n- 不改：进度表、聊天频道的每轮回复"
-  },
-  {
-   "id": "conflict",
-   "type": "values",
-   "section": "相关改动",
-   "line_re": "^冲突\\s*[:：]\\s*(.*)",
-   "ok_re": "^无\\s*([（(].*[）)])?\\s*[。.；;]?$",
-   "or_re": "已问用户\\s*[:：]\\s*\\S",
-   "msg": "「相关改动」节缺一行「冲突：无」或「冲突：…（已问用户：<答复>）」。示例：\n## 相关改动\n- #612 已合，改了 core/handoff.go，和这件不重叠\n冲突：无",
-   "bad_msg": "相关改动里写了冲突、没写已问用户：先在聊天频道问用户，把答复写进相关改动（「冲突：…（已问用户：<答复>）」）"
+   "msg": "「范围」节缺「{missing}」行：写清这件要改什么，一行一项。示例：\n## 范围\n- 改：任务卡（只在工作区显示）\n- 不改：聊天频道的每轮回复"
   },
   {
    "id": "base",
@@ -91,63 +55,6 @@
    "msg": "交接文件写了多人改同组文件（「共改文件」/「多人改」节），缺「底分支：<分支名>」一行。示例：\n底分支：feat/approvals-card",
    "dispatch_msg": "多人改同组文件要写底分支：base 填分支名，示例：base: \"feat/approvals-card\""
   },
-  {
-   "id": "art_ref",
-   "type": "art_ref",
-   "trigger_sections": [
-    "总目标",
-    "范围"
-   ],
-   "trigger_re": "出图|生图|小人|角色图|立绘|[Qq] ?版|插画|海报|宣传图|配图|封面图|做封面|画(一|个|张|幅|出)?[张个幅]?(角色|人物|头像|封面|画像|插图)",
-   "code_section": "范围",
-   "code_line_re": "^改\\s*[:：].*([A-Za-z0-9_-][.](py|go|mjs|js|ts|tsx|json|sh|yml|yaml|toml|html|css)([^A-Za-z0-9]|$)|[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+)",
-   "section": "参考图",
-   "inline": true,
-   "image_re": "https?://[^ \t<>()（）「」\"'`，,、；;]+|[^ \t<>()（）「」\"'`，,、；;：:]+[.](png|jpg|jpeg|webp|gif|avif|PNG|JPG|JPEG|WEBP)",
-   "min": 2,
-   "original_re": "原创\\s*[:：]\\s*无现成图",
-   "sample_re": "小样",
-   "msg": "这是出图类活，缺参考图：先找官方图或现成高分图当参考，写一节「参考图」列至少 {min} 张图的路径或链接（现在 {n} 张）。真是原创没有现成图，写「原创：无现成图」，照样列 {min} 张风格/构图参考（同类作品、画风、配色都行），并写明先出 3 张小样给用户挑，挑定再出正稿。示例：\n## 参考图\n- ~/art/ref/官方立绘.png\n- https://example.com/高分同人.jpg",
-   "original_msg": "写了「原创：无现成图」，还要写明先出 3 张小样给用户挑、挑定再出正稿（正文里要有「小样」）。"
-  },
-  {
-   "id": "exemplar",
-   "type": "section_needs_table",
-   "trigger_section": "用户原话",
-   "trigger_re": "「(?!\\[replying)[^」]*(照着|照抄|抄|学习|学一下|参考|对标|模仿|仿照)",
-   "object_re": "https?://|《[^》]+》",
-   "section": "照抄对象",
-   "row_re": "^\\S.*(→|->)\\s*\\S",
-   "rows": 3,
-   "need_res": [
-    "https?://|《[^》]+》",
-    "并排截图"
-   ],
-   "msg": "用户原话给了范本（链接或《…》+ 照着/抄/学习/参考/对标），交接要有「照抄对象」节：范本链接、「范本第 N 部分 → 我们第 N 部分」对照至少 3 行、验收写「并排截图」。示例：\n## 照抄对象\n- 范本：https://github.com/BotHarness/DeepSeekBot 的 README\n- 范本第 1 部分 顶部插画横幅 → 我们第 1 部分 顶部横幅\n- 范本第 2 部分 明暗两版截图 → 我们第 2 部分 功能截图\n- 范本第 3 部分 三行安装 → 我们第 3 部分 安装\n- 验收：并排截图（范本和我们同一部分左右放）"
-  },
-  {
-   "id": "hq_kinds",
-   "type": "kinds",
-   "section": "总部判断",
-   "line_re": "^(要的效果|好的样子|教训和定案)\\s*[:：]\\s*\\S.{9,}",
-   "need": [
-    "要的效果",
-    "好的样子",
-    "教训和定案"
-   ],
-   "item": "{}：…",
-   "sep": "」「",
-   "msg": "交接缺「总部判断」或写得太空：要有「{missing}」行，每行写满一句（10 字以上），写清要的效果、好的样子、教训和定案。"
-  },
-  {
-   "id": "hq_ref",
-   "type": "ref",
-   "section": "总部判断",
-   "none_re": "(?!)",
-   "ref_re": "[~A-Za-z0-9_./-]*[A-Za-z_][~A-Za-z0-9_./-]*:[0-9]+|[0-9]{1,2}-[0-9]{2}",
-   "path_re": "[/.]|^[0-9]{1,2}-[0-9]{2}$",
-   "msg": "「总部判断」没写出处：至少带一处文档 文件:行，或原话的日期（如 11-01）。"
-  },
   {
    "id": "no_tmp",
    "type": "forbid",

package/collab/instance-lock.mjs

@@ -0,0 +1,46 @@
+import { mkdirSync } from 'node:fs';
+import { dirname } from 'node:path';
+import { DatabaseSync } from 'node:sqlite';
+
+export const LOCK_FILE = 'collab.lock';
+
+/**
+ * #1019: one DSH process per collab data directory. Two hosts on the same collab.sqlite3 both run
+ * reminders, recovery and bot routing, so every job and message is handled twice.
+ *
+ * The lock is an exclusive SQLite transaction on a separate file: SQLite takes a POSIX lock, the
+ * kernel drops it when the process dies however it dies, so a crash never leaves a stale lock and
+ * no pid file has to be guessed at. busy_timeout 0 makes the second taker fail at once.
+ * Nothing is written to collab.sqlite3 itself.
+ */
+export class InstanceLock {
+  /** @returns InstanceLock, or undefined when another process already holds `path`. */
+  static acquire(path) {
+    mkdirSync(dirname(path), { recursive: true });
+    const db = new DatabaseSync(path);
+    try {
+      db.exec('PRAGMA busy_timeout = 0; BEGIN EXCLUSIVE');
+    } catch (err) {
+      db.close();
+      if (/locked|busy/i.test(String(err?.message))) return undefined;
+      throw err;
+    }
+    return new InstanceLock(db);
+  }
+
+  constructor(db) { this.db = db; }
+
+  release() {
+    if (this.db === undefined) return;
+    const db = this.db;
+    this.db = undefined;
+    try { db.exec('ROLLBACK'); } catch { /* closing drops the lock anyway */ }
+    db.close();
+  }
+}
+
+/** Plain-language reason shown in the DSH log when the plugin refuses to start. */
+export function lockBusyMessage(path) {
+  return `conest-collab: 频道插件没有启动——这台电脑上已经有另一个 DSH 在用同一份频道数据（${path}）。`
+    + '两个同时跑会让提醒、派活和消息各处理两遍。请用已经打开的那个 DSH；要换就先关掉它再打开。';
+}

package/collab/member-management.mjs

@@ -0,0 +1,75 @@
+import { CollabError } from './store.mjs';
+import { rowToMember } from './roster.mjs';
+import { createCliMember } from './cli-member.mjs';
+
+const fields = new Set(['name', 'persona', 'cli', 'model', 'cliConfig']);
+function check(body, create = false) {
+  if (!body || typeof body !== 'object' || Array.isArray(body) || Object.keys(body).some(k => !fields.has(k))) throw new CollabError('invalid', 'invalid member fields');
+  if (create && (typeof body.name !== 'string' || !body.name.trim())) throw new CollabError('invalid', 'name is required');
+  if (body.name !== undefined && (typeof body.name !== 'string' || !body.name.trim())) throw new CollabError('invalid', 'name is required');
+  if (body.persona !== undefined && typeof body.persona !== 'string') throw new CollabError('invalid', 'persona must be a string');
+}
+function view(m, source = m.source) {
+  return { id: m.id, name: m.name, source, can_edit: source === 'ui', can_delete: source === 'ui', persona: m.persona ?? '',
+    cli: m.cli ?? null, model: m.model ?? null, cliConfig: m.cliConfig ?? null,
+    apply: { timing: 'next_turn', status: m.cliConfigManaged ? 'pending' : 'not_configured' } };
+}
+export function managementMembers(roster, hub) {
+  const rows = roster.store.members().map(rowToMember);
+  const seen = new Set(rows.map(m => m.id));
+  return [...rows.map(m => view(m)), ...hub.memberList().filter(m => m.kind !== 'human' && !seen.has(m.id)).map(m => view(m, 'external'))];
+}
+async function validateChoices(roster, member, probe, id) {
+  const config = member.cliConfig;
+  if (!config || !Object.keys(config).length) return;
+  const result = await probe({ cli: 'codex', ...(id ? { memberId: id } : {}), ...(config.model ? { model: config.model } : {}) });
+  if (!result.supported) throw new CollabError('invalid', 'Codex configuration is unsupported');
+  if (config.model && !result.model?.options.some(x => x.value === config.model)) throw new CollabError('invalid', 'Codex model is unavailable');
+  if (config.reasoningEffort && !result.reasoningEffort?.options.some(x => x.value === config.reasoningEffort)) throw new CollabError('invalid', 'Codex reasoning effort is unavailable');
+}
+export async function managementCreate(roster, body, probe) {
+  check(body, true);
+  if (body.cli === null) body = { ...body, cli: undefined };
+  if (probe && body.cliConfig != null) await validateChoices(roster, await roster.validate(body), probe);
+  return view(await roster.create(body));
+}
+export async function managementUpdate(roster, id, body, probe) {
+  check(body);
+  const row = roster.store.member(id);
+  if (!row || row.removed) throw new CollabError('member-missing', 'member not found');
+  if (row.source !== 'ui') throw new CollabError('read-only', 'member is read-only');
+  const old = rowToMember(row);
+  if (Object.hasOwn(body, 'cli') && body.cli !== (old.cli ?? null) && roster.store.openJobs().some(j => j.member_id === id && j.state === 'sent')) throw new CollabError('member-busy', 'member is busy');
+  const merged = { ...old, ...body };
+  if (Object.hasOwn(body, 'cliConfig') && body.cliConfig != null && merged.cli !== 'codex') throw new CollabError('invalid', 'cliConfig requires a Codex member');
+  if (Object.hasOwn(body, 'cli') && body.cli !== old.cli) {
+    if (!Object.hasOwn(body, 'model')) merged.model = null;
+    if (!Object.hasOwn(body, 'cliConfig')) merged.cliConfig = null;
+  }
+  if (body.cliConfig && typeof body.cliConfig === 'object' && !Array.isArray(body.cliConfig)) {
+    merged.cliConfig = { ...(old.cliConfig || {}), ...body.cliConfig };
+    for (const k of Object.keys(merged.cliConfig)) if (merged.cliConfig[k] === null) delete merged.cliConfig[k];
+  }
+  if (merged.cli == null) { merged.cli = undefined; merged.cliConfig = undefined; }
+  if (probe && Object.hasOwn(body, 'cliConfig') && merged.cliConfig != null) await validateChoices(roster, await roster.validate(merged, id), probe, old.cli === 'codex' ? id : undefined);
+  return view(await roster.update(id, merged));
+}
+export function managementDelete(roster, id) {
+  const row = roster.store.member(id);
+  if (!row || row.removed) throw new CollabError('member-missing', 'member not found');
+  if (row.source !== 'ui') throw new CollabError('read-only', 'member is read-only');
+  if (roster.store.openJobs().some(j => j.member_id === id && j.state === 'sent')) throw new CollabError('member-busy', 'member is busy');
+  roster.remove(id);
+}
+export async function managementOptions(roster, body, cwd) {
+  if (!body || body.cli !== 'codex' || Object.keys(body).some(k => !['cli','memberId','model'].includes(k)) || (body.model !== undefined && (typeof body.model !== 'string' || !body.model))) throw new CollabError('invalid', 'invalid capability request');
+  if (body.memberId !== undefined) {
+    const row = roster.store.member(body.memberId);
+    if (!row || row.removed) throw new CollabError('member-missing', 'member not found');
+    if (row.source !== 'ui' || row.cli !== 'codex') throw new CollabError('read-only', 'member cannot be probed');
+  }
+  const probe = createCliMember({ cli: 'codex', cwd });
+  try { return await probe.probeOptions(body.model); }
+  catch (error) { throw new CollabError(error.code === 'COLLAB_CONFIG_INVALID' ? 'invalid' : 'offline', error.code === 'COLLAB_CONFIG_INVALID' ? 'Codex model is unavailable' : 'Codex capability probe failed'); }
+  finally { probe.close(); }
+}

package/collab/plugin.mjs

@@ -10,12 +10,14 @@ import { existsSync, readFileSync, realpathSync, statSync } from 'node:fs';
 import { isAbsolute, join } from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { Store, CollabError, publicMessage } from './store.mjs';
+import { InstanceLock, LOCK_FILE, lockBusyMessage } from './instance-lock.mjs';
 import { startBotPort } from './bot-port.mjs';
 import { Hub } from './hub.mjs';
 import { TeamExit } from './team-exit.mjs';
 import { CloudWebGateway, WS_PATH } from './cloudweb.mjs';
 import { DshMembers } from './dsh-member.mjs';
 import { Roster, rowToMember } from './roster.mjs';
+import { managementMembers, managementCreate, managementUpdate, managementDelete, managementOptions } from './member-management.mjs';
 import { Tasks, WORKING } from './tasks.mjs';
 import { createCliMember } from './cli-member.mjs';
 import { MemorySources } from './memory-sources.mjs';
@@ -134,10 +136,37 @@ export async function apply(ctx, rawConfig) {
   const { WebSocketServer } = createRequire(import.meta.url)('ws');
   if (typeof createUserMessage !== 'function' || typeof WebSocketServer !== 'function') throw Error('conest-collab: unsupported DSH runtime');
 
+  // #1019: a second DSH on the same data directory refuses to start the plugin instead of
+  // sharing collab.sqlite3 (the panel's 「打开 DSH」 used to start one beside a running host).
+  const lockPath = join(config.dataDir, LOCK_FILE);
+  const lock = InstanceLock.acquire(lockPath);
+  if (lock === undefined) throw Error(lockBusyMessage(lockPath));
+  // Teardown is registered before anything is opened, so a startup that fails half-way still
+  // stops whatever it started; the lock is released last, after the store and the background
+  // writers are closed, so no second host gets in while this one can still write.
+  const r = {};
+  ctx.effect(() => async () => {
+    r.teamStatus?.stop();
+    r.desk?.stop();
+    r.quota?.close();
+    r.later?.close();
+    r.tasks?.close();
+    r.gateway?.closeAll();
+    clearInterval(r.pairSweep);
+    clearInterval(r.aliveSweep);
+    await r.pairListener?.close();
+    for (const end of r.streams ?? []) end();
+    r.wss?.close();
+    // Drain DSH jobs first: a job still awaiting its Agent must not touch a closed store.
+    await r.dsh?.close();
+    r.store?.close();
+    lock.release();
+  }, 'conest-collab: teardown');
+
   // #1044: an install from before had the desk, panel and other-computers pages; checked before Store creates the file.
   const collabExisted = existsSync(join(config.dataDir, 'collab.sqlite3'));
   // #445: the instance maxRelay stays the default for channels that never set their own cap.
-  const store = new Store(join(config.dataDir, 'collab.sqlite3'), { maxRelay: config.maxRelay });
+  const store = r.store = new Store(join(config.dataDir, 'collab.sqlite3'), { maxRelay: config.maxRelay });
   for (const room of config.rooms) {
     store.ensureRoom(room.id, store.room(room.id)?.name ?? room.name.trim(), room.workspacePath);
     store.ensureRoomSettings(room.id);
@@ -150,18 +179,18 @@ export async function apply(ctx, rawConfig) {
   hub.teamExit = new TeamExit(hub);
   hub.setMember({ id: OWNER, name: config.ownerName, kind: 'human', online: true });
   const files = new Attachments(join(config.dataDir, 'attachments'));
-  const gateway = new CloudWebGateway(hub, { token: config.botToken, logger: ctx.logger, files });
-  const later = new Later(hub, join(config.dataDir, 'collab.sqlite3'), (id, msg) => dsh.nudge(id, msg) || gateway.nudge(id, msg), { start: false });
+  const gateway = r.gateway = new CloudWebGateway(hub, { token: config.botToken, logger: ctx.logger, files });
+  const later = r.later = new Later(hub, join(config.dataDir, 'collab.sqlite3'), (id, msg) => dsh.nudge(id, msg) || gateway.nudge(id, msg), { start: false });
   gateway.later = later;
-  const dsh = new DshMembers(hub, { files, later, ctx, createUserMessage, createCliMember, workspacePath: config.workspacePath, logger: ctx.logger }, [], { maxRelay: config.maxRelay });
+  const dsh = r.dsh = new DshMembers(hub, { files, later, ctx, createUserMessage, createCliMember, workspacePath: config.workspacePath, logger: ctx.logger }, [], { maxRelay: config.maxRelay });
   const avatarUploads = new AvatarUploads(join(config.dataDir, 'avatars'));
   const roster = new Roster(hub, dsh, ctx.llm, avatarUploads);
   // #139 B: dispatched tasks; a reminder wakes its owner whichever kind of member it is.
   // Started after dsh.recover(): a reminder due during the downtime must not look like a leftover job.
-  const tasks = new Tasks(hub, { start: false });
+  const tasks = r.tasks = new Tasks(hub, { start: false });
   hub.tasks = tasks;
   gateway.tasks = tasks;
-  const quota = new QuotaCooling(hub, tasks, (id, msg) => dsh.nudge(id,msg) || gateway.nudge(id,msg), quotaDirectory(config.leadFile));
+  const quota = r.quota = new QuotaCooling(hub, tasks, (id, msg) => dsh.nudge(id,msg) || gateway.nudge(id,msg), quotaDirectory(config.leadFile));
   hub.quota = quota;
   tasks.onWake((memberId, message) => dsh.nudge(memberId, message) || gateway.nudge(memberId, message));
   // A workspace released after its last task shows up free in the room list. Its sessions are
@@ -186,10 +215,10 @@ export async function apply(ctx, rawConfig) {
   later.start();
   quota.start();
   // #876: only the plugin's own tail touches board-events.jsonl; board.py writes it.
-  const desk = new DeskEvents(hub, { boardDir: config.boardDir, logger: ctx.logger });
+  const desk = r.desk = new DeskEvents(hub, { boardDir: config.boardDir, logger: ctx.logger });
   desk.start();
   // #876 K: read-only busy/idle from the shared team directory; no bridge change.
-  const teamStatus = config.teamStatusDir === undefined ? undefined : new TeamStatus(hub, config.teamStatusDir, { logger: ctx.logger });
+  const teamStatus = r.teamStatus = config.teamStatusDir === undefined ? undefined : new TeamStatus(hub, config.teamStatusDir, { logger: ctx.logger });
   teamStatus?.start();
   if (!config.botToken) ctx.logger.warn(`conest-collab: ${config.botTokenEnv} is unset; cc-connect bots cannot connect`);
 
@@ -201,20 +230,20 @@ export async function apply(ctx, rawConfig) {
   const pairPort = Number(process.env.CONEST_COLLAB_PAIR_PORT) || PAIR_PORT;
   const pairHost = new PairHost({ file: join(config.dataDir, 'pair-devices.json') });
   const pairClient = new PairClient({ file: join(config.dataDir, 'pair-links.json'), port: pairPort });
-  const pairListener = new PairListener({
+  const pairListener = r.pairListener = new PairListener({
     host: pairHost, port: pairPort, logger: ctx.logger,
     address: pairAddr === '' ? () => tailnetAddress() : async () => pairAddr,
     handler: hostHandler({ host: pairHost, name: hostname(), route: (req, res) => browserRoute(req, res), allowLoopback: isLoopback(pairAddr) }),
   });
   if (pairHost.list().length > 0) pairListener.ensure().catch(err => ctx.logger.warn('conest-collab: pairing listener: %s', err.message));
   // 来源：码有效期按分钟计（pairing.mjs CODE_TTL_MS），每分钟收一次没人用的配对监听。
-  const pairSweep = setInterval(() => { pairListener.settle().catch(() => {}); }, 60_000);
+  const pairSweep = r.pairSweep = setInterval(() => { pairListener.settle().catch(() => {}); }, 60_000);
   pairSweep.unref?.();
   // 「直到我断开」: drop links whose DSH window stopped beating (same cadence as the beat).
-  const aliveSweep = setInterval(() => { pairClient.sweep().catch(() => {}); }, ALIVE_EVERY_MS);
+  const aliveSweep = r.aliveSweep = setInterval(() => { pairClient.sweep().catch(() => {}); }, ALIVE_EVERY_MS);
   aliveSweep.unref?.();
-  const wss = new WebSocketServer({ noServer: true, maxPayload: BOT_WS_MAX_PAYLOAD });
-  const streams = new Set();
+  const wss = r.wss = new WebSocketServer({ noServer: true, maxPayload: BOT_WS_MAX_PAYLOAD });
+  const streams = r.streams = new Set();
 
   ctx.effect(() => ctx.webServer.register({ kind: 'prefix', path: '/collab', handler: (req, res) => browserRoute(req, res) }), 'conest-collab: /collab');
   ctx.effect(() => ctx.webServer.register({ kind: 'prefix', path: '/api/rooms', handler: (req, res) => historyRoute(req, res) }), 'conest-collab: /api/rooms');
@@ -241,22 +270,6 @@ export async function apply(ctx, rawConfig) {
         err => { ctx.logger.warn('conest-collab: bot port %d not opened: %s', config.botPort, err.message); return undefined; });
     ctx.effect(() => async () => { (await listening)?.close(); }, 'conest-collab: bot port');
   }
-  ctx.effect(() => async () => {
-    teamStatus?.stop();
-    desk.stop();
-    quota.close();
-    later.close();
-    tasks.close();
-    gateway.closeAll();
-    clearInterval(pairSweep);
-    clearInterval(aliveSweep);
-    await pairListener.close();
-    for (const end of streams) end();
-    wss.close();
-    // Drain DSH jobs first: a job still awaiting its Agent must not touch a closed store.
-    await dsh.close();
-    store.close();
-  }, 'conest-collab: teardown');
 
   ctx.logger.info('conest-collab: %d room(s), %d DSH member(s), cloud-web %s', config.rooms.length, config.dshMembers.length, config.botToken ? 'on' : 'off');
 
@@ -456,6 +469,12 @@ export async function apply(ctx, rawConfig) {
       }, false);
     }
     if (path === '/collab/api/clis') return clisHandler(req, res);
+    if (path === '/collab/api/panel/members' && req.method === 'GET') return json(res, 200, { members: managementMembers(roster, hub) });
+    if (path === '/collab/api/panel/members' && req.method === 'POST') return withBody(req, res, async body => ({ member: await managementCreate(roster, body, b => managementOptions(roster, b, config.workspacePath)) }));
+    const panelMember = /^\/collab\/api\/panel\/members\/([^/]+)$/.exec(path);
+    if (panelMember && req.method === 'PATCH') return withBody(req, res, async body => ({ member: await managementUpdate(roster, decodeURIComponent(panelMember[1]), body, b => managementOptions(roster, b, config.workspacePath)) }));
+    if (panelMember && req.method === 'DELETE') return withBody(req, res, () => { const id = decodeURIComponent(panelMember[1]); managementDelete(roster, id); hub.emit({ type: 'rooms', rooms: store.roomsView() }); return { id }; }, false);
+    if (path === '/collab/api/panel/cli-options' && req.method === 'POST') return withBody(req, res, body => managementOptions(roster, body, config.workspacePath));
     if (path === '/collab/api/models' && req.method === 'GET') return json(res, 200, { routes: await roster.models() });
     if (path === '/collab/api/rooms' && req.method === 'POST') {
       return withBody(req, res, (body) => {
@@ -477,6 +496,15 @@ export async function apply(ctx, rawConfig) {
         return { room };
       });
     }
+    // #155: close a private chat (hidden from the list, history kept; opening it again restores it).
+    const dmm = /^\/collab\/api\/dms\/(\d+)$/.exec(path);
+    if (dmm !== null && req.method === 'DELETE') {
+      return withBody(req, res, () => {
+        store.closeDm(Number(dmm[1]));
+        hub.emit({ type: 'rooms', rooms: store.roomsView() });
+        return { ok: true };
+      }, false);
+    }
     if (path === '/collab/api/members' && req.method === 'POST') {
       return withBody(req, res, async body => ({ member: await roster.create(body) }));
     }
@@ -487,7 +515,11 @@ export async function apply(ctx, rawConfig) {
       return withBody(req, res, async body => ({ member: await roster.update(decodeURIComponent(mm[1]), body) }));
     }
     if (mm !== null && req.method === 'DELETE') {
-      return withBody(req, res, () => { roster.remove(decodeURIComponent(mm[1])); return { ok: true }; }, false);
+      return withBody(req, res, () => {
+        roster.remove(decodeURIComponent(mm[1]));
+        hub.emit({ type: 'rooms', rooms: store.roomsView() }); // #155: its private chat leaves the list too.
+        return { ok: true };
+      }, false);
     }
     return json(res, 404, { error: 'not found' });
   }
@@ -560,7 +592,9 @@ export function renameRoomRoute(req, res, path, { store, hub, dsh }) {
   const roomId = Number(match[1]);
   if (store.room(roomId) === undefined) return json(res, 404, { error: 'room not found' });
   return withBody(req, res, async body => {
-    const room = store.renameRoom(roomId, body?.name);
+    // #176: create strips a leading '#' (the channel list shows names with one), so rename must too,
+    // or '#general' gets past checkRoomName as a second "general".
+    const room = store.renameRoom(roomId, typeof body?.name === 'string' ? body.name.trim().replace(/^#/, '') : body?.name);
     hub.emit({ type: 'rooms', rooms: store.roomsView() });
     await dsh.refreshRoomTitles(roomId);
     return { room };