dominds 1.18.2 → 1.19.2

package/dist/tool-availability.js

@@ -116,7 +116,7 @@ async function buildAppDynamicLayer(params) {
         taskDocPath: params.taskDocPath,
         agentId: params.agentId,
         dialogId: params.dialog?.selfId,
-        rootDialogId: params.dialog?.rootId,
+        mainDialogId: params.dialog?.rootId,
         sessionSlug: params.dialog?.sessionSlug,
     });
     if (result.status === 'not_applicable') {

package/dist/tools/app-reminders.js

@@ -5,6 +5,7 @@ exports.ensureAppReminderOwnersRegistered = ensureAppReminderOwnersRegistered;
 exports.unregisterAppReminderOwnersForApps = unregisterAppReminderOwnersForApps;
 exports.applyAppReminderRequests = applyAppReminderRequests;
 const evt_registry_1 = require("../evt-registry");
+const log_1 = require("../log");
 const driver_messages_1 = require("../runtime/driver-messages");
 const work_language_1 = require("../runtime/work-language");
 const shared_reminders_1 = require("../shared-reminders");
@@ -159,8 +160,8 @@ function findOwnedReminderEntries(dlg, descriptor, owner) {
 function fallbackRenderedReminder(reminder) {
     const language = (0, work_language_1.getWorkLanguage)();
     return {
-        type: 'transient_guide_msg',
-        role: 'assistant',
+        type: 'environment_msg',
+        role: 'user',
         content: (0, driver_messages_1.formatReminderItemGuide)(language, reminder.id, reminder.content, {
             meta: reminder.meta,
             scope: reminder.scope,
@@ -212,7 +213,13 @@ function createAppReminderOwner(params) {
                         : reminder.meta,
                 };
             }
-            catch {
+            catch (error) {
+                log_1.log.warn('App reminder update failed; keeping existing reminder state', error, {
+                    appId: descriptor.appId,
+                    ownerRef: descriptor.ownerRef,
+                    dialogId: dlg.id.selfId,
+                    reminderId: reminder.id,
+                });
                 return { treatment: 'keep' };
             }
         },
@@ -229,7 +236,13 @@ function createAppReminderOwner(params) {
                     workLanguage: (0, work_language_1.getWorkLanguage)(),
                 });
             }
-            catch {
+            catch (error) {
+                log_1.log.warn('App reminder render failed; using generic reminder rendering', error, {
+                    appId: descriptor.appId,
+                    ownerRef: descriptor.ownerRef,
+                    dialogId: dlg.id.selfId,
+                    reminderId: reminder.id,
+                });
                 return fallbackRenderedReminder(reminder);
             }
         },

package/dist/tools/ctrl.js

@@ -634,9 +634,9 @@ exports.clearMindTool = {
 exports.changeMindTool = {
     type: 'func',
     name: 'change_mind',
-    description: 'Replace one shared Taskdoc section in the mainline dialog.',
+    description: 'Replace one shared Taskdoc section in the Main Dialog.',
     descriptionI18n: {
-        en: 'Replace one shared Taskdoc section in the mainline dialog.',
+        en: 'Replace one shared Taskdoc section in the Main Dialog.',
         zh: '在主线对话中替换一段共享差遣牒章节。',
     },
     parameters: {
@@ -659,13 +659,13 @@ exports.changeMindTool = {
     async call(dlg, caller, args) {
         const language = (0, work_language_1.getWorkLanguage)();
         const t = getCtrlMessages(language);
-        if (dlg.supdialog !== undefined) {
-            const maintainerId = dlg instanceof dialog_1.SubDialog ? dlg.rootDialog.agentId : dlg.agentId;
+        if (dlg.askerDialog !== undefined) {
+            const maintainerId = dlg instanceof dialog_1.SideDialog ? dlg.mainDialog.agentId : dlg.agentId;
             if (language === 'zh') {
                 return (0, tool_1.toolFailure)(`错误：\`change_mind\` 仅允许在主线对话中使用（支线对话中不可用）。\n` +
                     `请诉请差遣牒维护人 @${maintainerId} 在其对话中执行 \`change_mind\`，并提供你已合并好的“分段全文替换稿”（禁止覆盖/抹掉他人条目）。`);
             }
-            return (0, tool_1.toolFailure)(`Error: \`change_mind\` is only available in the mainline dialog (not in sideline dialogs).\n` +
+            return (0, tool_1.toolFailure)(`Error: \`change_mind\` is only available in the Main Dialog (not in Side Dialogs).\n` +
                 `Ask the Taskdoc maintainer @${maintainerId} to run \`change_mind\` and provide a fully merged full-section replacement draft (do not overwrite/delete other contributors).`);
         }
         const selectorValue = args['selector'];

package/dist/tools/os.js

@@ -403,7 +403,7 @@ function stripDaemonLifecyclePhaseSummary(content) {
 function getOsToolMessages(language) {
     if (language === 'zh') {
         return {
-            daemonStarted: (pid, timeoutSeconds, command) => `🟢 ${command} 已转入后台持续运行（PID: ${pid}）\n该进程在 ${timeoutSeconds} 秒内未完成，现已作为守护进程继续执行。你将看到同一张生命周期状态卡持续刷新：系统维护 / 实时真源 / 不可删除。\n\n需要时可使用 stop_daemon({"pid": ${pid}}) 终止该进程。`,
+            daemonStarted: (pid, timeoutSeconds, command) => `🟢 ${command} 已转入后台持续运行（PID: ${pid}）\n该进程在 ${timeoutSeconds} 秒内未完成，现已作为守护进程继续执行。你将看到同一条生命周期提醒持续刷新：系统维护 / 实时真源 / 不可删除。\n\n需要时可使用 stop_daemon({"pid": ${pid}}) 终止该进程。`,
             commandCompleted: (exitCode, scrollNotice) => `✅ 命令已完成（退出码：${exitCode ?? 'unknown'}）${scrollNotice}\n\n`,
             scrolledLinesNotice: (lines) => `\n⚠️  执行期间有 ${lines} 行已滚出可视范围`,
             stdoutLabel: '📤 stdout：',
@@ -418,7 +418,7 @@ function getOsToolMessages(language) {
         };
     }
     return {
-        daemonStarted: (pid, timeoutSeconds, command) => `🟢 ${command} is now running in the background (PID: ${pid})\nThe process did not finish within ${timeoutSeconds} seconds and has transitioned into a daemon. You will see the same lifecycle card keep updating: system-maintained / live source of truth / not deletable.\n\nUse stop_daemon({"pid": ${pid}}) to terminate it when needed.`,
+        daemonStarted: (pid, timeoutSeconds, command) => `🟢 ${command} is now running in the background (PID: ${pid})\nThe process did not finish within ${timeoutSeconds} seconds and has transitioned into a daemon. You will see the same lifecycle reminder keep updating: system-maintained / live source of truth / not deletable.\n\nUse stop_daemon({"pid": ${pid}}) to terminate it when needed.`,
         commandCompleted: (exitCode, scrollNotice) => `✅ Command completed (exit code: ${exitCode ?? 'unknown'})${scrollNotice}\n\n`,
         scrolledLinesNotice: (lines) => `\n⚠️  ${lines} lines scrolled out of view during execution`,
         stdoutLabel: '📤 stdout:',
@@ -1171,12 +1171,12 @@ exports.shellCmdReminderOwner = {
                 type: 'environment_msg',
                 role: 'user',
                 content: language === 'zh'
-                    ? `${prefix} 后台进程生命周期状态卡 [${reminder.id}]
-这是系统维护的后台进程状态快照。把它当成环境信号，不是你自己写的工作便签。若它没有实质改变你的判断/计划/风险，则禁止做任何用户可见回应（禁止写“静默吸收”“已收到”等占位语句）；只有它实际影响后续动作时，才在下一条有实质内容的回复中体现相关事实。该提醒在进程运行期间会自动更新；进程结束后会保留终态，等待你确认后手动删除。
+                    ? `${prefix} 后台进程生命周期提醒 [${reminder.id}]
+当前运行环境中有一条系统维护的后台进程状态提醒。请把它当成环境信号，不要当成你自己写的工作便签。若它没有实质改变你的判断/计划/风险，则禁止做任何用户可见回应（禁止写“静默吸收”“已收到”等占位语句）；只有它实际影响后续动作时，才在下一条有实质内容的回复中体现相关事实。该提醒在进程运行期间会自动更新；进程结束后会保留终态，等待你确认后手动删除。
 ---
 ${reminder.content}`
-                    : `${prefix} Background process lifecycle card [${reminder.id}]
-This is a system-maintained background process snapshot. Treat it as an environment signal, not a self-authored work note. If it does not materially change your judgment/plan/risk, make no user-visible reply at all (do not send filler like “silently noted” or “received”); only reflect it inside the next substantive reply when it actually affects the next action. This reminder auto-updates while the process is running; after exit it keeps the terminal state until you delete it manually.
+                    : `${prefix} Background process lifecycle reminder [${reminder.id}]
+The current runtime environment has a system-maintained background-process state reminder. Treat it as an environment signal, not as your self-authored work note. If it does not materially change your judgment/plan/risk, make no user-visible reply at all (do not send filler like "silently noted" or "received"); only reflect it inside the next substantive reply when it actually affects the next action. This reminder auto-updates while the process is running; after exit it keeps the terminal state until you delete it manually.
 ---
 ${reminder.content}`,
             };
@@ -1193,12 +1193,12 @@ ${reminder.content}`,
                     type: 'environment_msg',
                     role: 'user',
                     content: language === 'zh'
-                        ? `${prefix} 守护进程生命周期状态卡 [${reminder.id}] - ${exitedSummary}｜PID ${pid}
-该后台进程已退出。若需要再核对最后 stdout/stderr，可先按需调用 get_daemon_output({ "pid": ${pid} })；若该调用已不可用，则以下是最后一次已知快照。确认已知悉后，请手动删除这条提醒。
+                        ? `${prefix} 守护进程生命周期提醒 [${reminder.id}] - ${exitedSummary}｜PID ${pid}
+当前运行环境中 daemon 已退出。若需要再核对最后 stdout/stderr，可先按需调用 get_daemon_output({ "pid": ${pid} })；若该调用已不可用，则以下是最后一次已知快照。确认已知悉后，请手动删除这条提醒。
 ---
 ${reminder.content}`
-                        : `${prefix} Daemon lifecycle card [${reminder.id}] - ${exitedSummary} | PID ${pid}
-This daemon has exited. If you still need to inspect the final stdout/stderr, first call get_daemon_output({ "pid": ${pid} }) if it is still available; otherwise use the last known snapshot below. After you have acknowledged the exit, delete this reminder manually.
+                        : `${prefix} Daemon lifecycle reminder [${reminder.id}] - ${exitedSummary} | PID ${pid}
+The current runtime environment shows that this daemon has exited. If you still need to inspect the final stdout/stderr, first call get_daemon_output({ "pid": ${pid} }) if it is still available; otherwise use the last known snapshot below. After you have acknowledged the exit, delete this reminder manually.
 ---
 ${reminder.content}`,
                 };
@@ -1208,9 +1208,9 @@ ${reminder.content}`,
                 role: 'user',
                 content: language === 'zh'
                     ? `${prefix} 进程生命周期提醒 [${reminder.id}] - 后台进程已结束（PID ${pid}）
-该后台进程的生命周期已经结束，当前不再运行。`
+当前运行环境中该后台进程的生命周期已经结束，当前不再运行。`
                     : `${prefix} Process lifecycle reminder [${reminder.id}] - daemon terminated (PID ${pid})
-This daemon process has finished its lifecycle and is no longer running.`,
+The current runtime environment shows that this daemon process has finished its lifecycle and is no longer running.`,
             };
         }
         if (resolved.kind === 'error') {
@@ -1233,13 +1233,13 @@ This daemon process has finished its lifecycle and is no longer running.`,
             type: 'environment_msg',
             role: 'user',
             content: language === 'zh'
-                ? `🔄 ${prefix} 守护进程生命周期状态卡 [${reminder.id}] - ${runningSummary}｜PID ${pid}，已运行 ${uptimeStr}
-这是系统维护的状态快照，不是新的用户诉求，也不是默认需要单独汇报的事项。若下面的信息没有实质改变你的判断、计划、风险，且不需要调用守护进程相关工具，则禁止做任何用户可见回应；若它有实质影响，只在下一条有实质内容的回复中体现，禁止单独发送“静默吸收”“已收到”等占位语句。
+                ? `🔄 ${prefix} 守护进程生命周期提醒 [${reminder.id}] - ${runningSummary}｜PID ${pid}，已运行 ${uptimeStr}
+当前运行环境中 daemon 仍在运行。这是系统维护的状态提醒，不是默认需要单独汇报的事项。若下面的信息没有实质改变你的判断、计划、风险，且不需要调用守护进程相关工具，则禁止做任何用户可见回应；若它有实质影响，只在下一条有实质内容的回复中体现，禁止单独发送“静默吸收”“已收到”等占位语句。
 
 **状态快照：**
 ${statusInfo}`
-                : `🔄 ${prefix} Daemon lifecycle card [${reminder.id}] - ${runningSummary} | PID ${pid}, uptime: ${uptimeStr}
-This is a system-maintained snapshot, not a new user request and not something that normally deserves a standalone mention. If the information below does not materially change your judgment, plan, risk, or require a daemon-management action, make no user-visible reply at all; if it does matter, reflect it only inside the next substantive reply instead of sending filler like “silently noted” or “received”.
+                : `🔄 ${prefix} Daemon lifecycle reminder [${reminder.id}] - ${runningSummary} | PID ${pid}, uptime: ${uptimeStr}
+The current runtime environment shows that this daemon is still running. This is a system-maintained state reminder and not something that normally deserves a standalone mention. If the information below does not materially change your judgment, plan, risk, or require a daemon-management action, make no user-visible reply at all; if it does matter, reflect it only inside the next substantive reply instead of sending filler like "silently noted" or "received".
 
 **State snapshot:**
 ${statusInfo}`,

package/dist/tools/pending-tellask-reminder.js

@@ -37,12 +37,12 @@ function isPendingTellaskReminderMeta(value) {
 function getPendingTellaskUpdateAltInstruction(language) {
     return language === 'zh'
         ? '不要手改这条系统提醒。若要改变某一路诉请，只有长线诉请（`tellask` + `sessionSlug`）才能更新那一路诉请的“任务安排”：复用同一 `sessionSlug` 再发 `tellask`，让对应主理人按最新安排自行最终回复并自然结束。一次性诉请（`tellaskSessionless`）没有这个通道；新开一个 `tellaskSessionless` 只会再创建新的瞬态支线，不能要求旧主理人停止。其余情况等待系统按真实诉请状态自动刷新。'
-        : 'Do not hand-edit this system reminder. If you need to change one tellask, only a sessioned tellask (`tellask` + `sessionSlug`) can be updated in place: send another `tellask` with the same `sessionSlug` so the responder can finish naturally under the latest assignment. A one-shot tellask (`tellaskSessionless`) has no such channel; another `tellaskSessionless` only creates a new transient sideline and cannot tell the earlier owner to stop. Otherwise wait for system refresh from real tellask state.';
+        : 'Do not hand-edit this system reminder. If you need to change one tellask, only a sessioned tellask (`tellask` + `sessionSlug`) can be updated in place: send another `tellask` with the same `sessionSlug` so the tellaskee can finish naturally under the latest assignment. A one-shot tellask (`tellaskSessionless`) has no such channel; another `tellaskSessionless` only creates a new transient Side Dialog and cannot tell the earlier owner to stop. Otherwise wait for system refresh from real tellask state.';
 }
 function getPendingTellaskDeleteAltInstruction(language) {
     return language === 'zh'
         ? '这条系统提醒不可删除。若要改变某一路诉请，只有长线诉请（`tellask` + `sessionSlug`）才能更新那一路诉请的“任务安排”：复用同一 `sessionSlug` 再发 `tellask`，让对应主理人按最新安排自行最终回复并自然结束。一次性诉请（`tellaskSessionless`）没有这个通道；新开一个 `tellaskSessionless` 只会再创建新的瞬态支线，不能要求旧主理人停止。其余情况等待系统按真实诉请状态自动刷新。'
-        : 'This system reminder is not deletable. If you need to change one tellask, only a sessioned tellask (`tellask` + `sessionSlug`) can be updated in place: send another `tellask` with the same `sessionSlug` so the responder can finish naturally under the latest assignment. A one-shot tellask (`tellaskSessionless`) has no such channel; another `tellaskSessionless` only creates a new transient sideline and cannot tell the earlier owner to stop. Otherwise wait for system refresh from real tellask state.';
+        : 'This system reminder is not deletable. If you need to change one tellask, only a sessioned tellask (`tellask` + `sessionSlug`) can be updated in place: send another `tellask` with the same `sessionSlug` so the tellaskee can finish naturally under the latest assignment. A one-shot tellask (`tellaskSessionless`) has no such channel; another `tellaskSessionless` only creates a new transient Side Dialog and cannot tell the earlier owner to stop. Otherwise wait for system refresh from real tellask state.';
 }
 function callKindLabel(language, view) {
     if (view.callType === 'A') {
@@ -52,9 +52,7 @@ function callKindLabel(language, view) {
 }
 function pendingTargetLabel(language, view) {
     if (view.callType === 'A') {
-        return language === 'zh'
-            ? `上游诉请者 @${view.targetAgentId}`
-            : `upstream requester @${view.targetAgentId}`;
+        return language === 'zh' ? `诉请者 @${view.targetAgentId}` : `tellasker @${view.targetAgentId}`;
     }
     switch (view.callName) {
         case 'freshBootsReasoning':
@@ -76,7 +74,14 @@ function summarizeTellask(view) {
 }
 function makePendingSignature(pending) {
     return pending
-        .map((p) => [p.subdialogId, p.targetAgentId, p.callType, p.sessionSlug ?? '', summarizeTellask(p)].join('|'))
+        .map((p) => [
+        p.sideDialogId,
+        p.targetAgentId,
+        p.callType,
+        p.callId,
+        p.sessionSlug ?? '',
+        summarizeTellask(p),
+    ].join('|'))
         .sort()
         .join('||');
 }
@@ -117,7 +122,7 @@ function buildReminderContent(language, pending) {
     }
     const summary = language === 'zh'
         ? '以下诉请仍在执行中；除这些条目外，当前没有其它仍在执行中的诉请。该提醒项只是系统状态窗，不是控制面：自动维护、不可手改，且在非 0 路进行中时不可删除。只有长线诉请（`tellask` + `sessionSlug`）才能更新“任务安排”；一次性诉请（`tellaskSessionless`）没有这个通道。新开一个 `tellaskSessionless` 只会再创建新的瞬态支线，不会影响旧支线继续执行，更不能要求旧主理人停止。若某一路长线诉请的要求变化，才可复用同一 `sessionSlug` 再发 `tellask`，让对应主理人按最新安排自行最终回复并自然结束。误删会被拒绝，并返回同样的引导文案。'
-        : 'Only the Tellasks listed below are still in flight; besides them, no other Tellasks are currently executing. This reminder is only a system status window, not a control surface: auto-maintained, not hand-editable, and non-deletable while any tellask is still active. Only a sessioned tellask (`tellask` + `sessionSlug`) has an assignment-update channel; a one-shot tellask (`tellaskSessionless`) does not. Opening another `tellaskSessionless` only creates another transient sideline; it does not affect the earlier one and cannot tell the earlier owner to stop. If a sessioned tellask needs to change, reuse the same `sessionSlug` in another `tellask` so the responder can finish naturally under the latest assignment. Mistaken deletion will be rejected with the same guidance.';
+        : 'Only the Tellasks listed below are still in flight; besides them, no other Tellasks are currently executing. This reminder is only a system status window, not a control surface: auto-maintained, not hand-editable, and non-deletable while any tellask is still active. Only a sessioned tellask (`tellask` + `sessionSlug`) has an assignment-update channel; a one-shot tellask (`tellaskSessionless`) does not. Opening another `tellaskSessionless` only creates another transient Side Dialog; it does not affect the earlier one and cannot tell the earlier owner to stop. If a sessioned tellask needs to change, reuse the same `sessionSlug` in another `tellask` so the tellaskee can finish naturally under the latest assignment. Mistaken deletion will be rejected with the same guidance.';
     const lines = pending.map((p, idx) => {
         const base = language === 'zh'
             ? `${idx + 1}. ${pendingTargetLabel(language, p)} | ${callKindLabel(language, p)} | ${summarizeTellask(p)}`
@@ -148,17 +153,18 @@ function assertSingleOwnedReminder(dlg) {
         return indices[0] ?? null;
     throw new Error(`pendingTellask reminder invariant violated: expected <=1 owner reminder, got ${indices.length} (dialog=${dlg.id.valueOf()})`);
 }
-async function loadPendingSubdialogView(dlg) {
-    const pending = await persistence_1.DialogPersistence.loadPendingSubdialogs(dlg.id, dlg.status);
+async function loadPendingSideDialogView(dlg) {
+    const pending = await persistence_1.DialogPersistence.loadPendingSideDialogs(dlg.id, dlg.status);
     return await Promise.all(pending.map(async (p) => {
-        const subdialogId = new dialog_1.DialogID(p.subdialogId, dlg.id.rootId);
-        const latest = await persistence_1.DialogPersistence.loadDialogLatest(subdialogId, dlg.status);
+        const sideDialogId = new dialog_1.DialogID(p.sideDialogId, dlg.id.rootId);
+        const latest = await persistence_1.DialogPersistence.loadDialogLatest(sideDialogId, dlg.status);
         return {
-            subdialogId: p.subdialogId,
+            sideDialogId: p.sideDialogId,
             latestActivityAt: latest?.lastModified ?? p.createdAt,
             mentionList: p.mentionList,
             tellaskContent: p.tellaskContent,
             targetAgentId: p.targetAgentId,
+            callId: p.callId,
             callType: p.callType,
             callName: p.callName,
             sessionSlug: p.sessionSlug,
@@ -172,7 +178,7 @@ async function withDialogLockIfNeeded(dlg, fn) {
     return await dlg.withLock(fn);
 }
 async function syncPendingTellaskReminderState(dlg) {
-    const pending = await loadPendingSubdialogView(dlg);
+    const pending = await loadPendingSideDialogView(dlg);
     return await withDialogLockIfNeeded(dlg, async () => {
         const reminderIndex = assertSingleOwnedReminder(dlg);
         const language = (0, work_language_1.getWorkLanguage)();
@@ -210,7 +216,7 @@ exports.pendingTellaskReminderOwner = {
         if (reminder.owner !== exports.pendingTellaskReminderOwner) {
             return { treatment: 'keep' };
         }
-        const pending = await loadPendingSubdialogView(dlg);
+        const pending = await loadPendingSideDialogView(dlg);
         const language = (0, work_language_1.getWorkLanguage)();
         const updatedContent = buildReminderContent(language, pending);
         const currentMeta = isPendingTellaskReminderMeta(reminder.meta) ? reminder.meta : undefined;

package/dist/tools/prompts/control/en/index.md

@@ -29,7 +29,7 @@ control is Dominds' **dialog control toolset** for managing dialog state, remind
 - **Reminder management**: Two reminder scopes. Default to dialog-local working set; use `personal` only for responsibility-linked notes that you should keep seeing in all later dialogs you lead
 - **Taskdoc operations**: Update task contracts (goals/constraints/progress); within Taskdoc, `progress` is the team-shared, quasi-real-time, scannable task bulletin board
 - **Context maintenance**: Reduce cognitive load without losing key resume state
-- **Reply routing**: Separate `tellaskBack`, `replyTellask*`, and plain text by responsibility in sideline / ask-back flows
+- **Reply routing**: Separate `tellaskBack`, `replyTellask*`, and plain text by responsibility in Side Dialog / ask-back flows
 
 ## Quick Navigation
 

package/dist/tools/prompts/control/en/principles.md

@@ -46,7 +46,7 @@ Default to `dialog`. Use `personal` only when you should keep seeing that note i
 | Feature | dialog reminder | personal reminder | personal memory |
 |---------|-----------------|-------------------|-----------------|
 | Persistence | Current dialog only | Across all later dialogs you lead | Long-term / file-backed |
-| Visibility | Current dialog | Current responder agent | Current agent |
+| Visibility | Current dialog | Current Dialog Responder | Current agent |
 | Best for | Current next step, blocker, volatile clue | Responsibility-linked operating cue | Stable facts / reusable knowledge |
 
 ### 1.1 Scope Choice Rule
@@ -92,21 +92,21 @@ Taskdoc is a **task contract** and the task's **team-shared source of current tr
 
 ### Decision Rules
 
-- If the current sideline is unfinished, first judge whether team SOP / role ownership already identifies the responsible owner; if yes and the issue is execution work, directly use `tellask` / `tellaskSessionless` for that owner
-- Call `tellaskBack({ tellaskContent })` only when upstream must clarify the request, decide a tradeoff, confirm acceptance criteria, provide missing input, or current SOP cannot determine ownership
+- If the current Side Dialog is unfinished, first judge whether team SOP / role ownership already identifies the responsible owner; if yes and the issue is execution work, directly use `tellask` / `tellaskSessionless` for that owner
+- Call `tellaskBack({ tellaskContent })` only when the tellasker must clarify the request, decide a tradeoff, confirm acceptance criteria, provide missing input, or current SOP cannot determine ownership
 - If a human must personally perform login / GUI / captcha / high-risk authorization: call `askHuman({ tellaskContent })`
-- If the current sideline is complete and the assignment header says `replyTellask`: call `replyTellask({ replyContent })`
-- If the current sideline is complete and the assignment header says `replyTellaskSessionless`: call `replyTellaskSessionless({ replyContent })`
-- If you are answering an upstream `tellaskBack` follow-up and runtime exposes `replyTellaskBack`: call `replyTellaskBack({ replyContent })`
+- If the current Side Dialog is complete and the assignment header says `replyTellask`: call `replyTellask({ replyContent })`
+- If the current Side Dialog is complete and the assignment header says `replyTellaskSessionless`: call `replyTellaskSessionless({ replyContent })`
+- If you are answering a tellasker `tellaskBack` follow-up and runtime exposes `replyTellaskBack`: call `replyTellaskBack({ replyContent })`
 - Plain text is not the normal completion channel for inter-dialog delivery; if you emit plain text instead of the reply tool, runtime may temporarily inject a `role=user` reminder telling you to use the correct reply function
 
 ### Low-Burden Rule
 
-- Focus on doing the current task correctly first; use `reply*` only when final upstream delivery is actually ready
+- Focus on doing the current task correctly first; use `reply*` only when final tellasker delivery is actually ready
 - Do not memorize reply variants by yourself; follow the current assignment header and the function currently exposed by runtime
 - `reply*` tool descriptions are intentionally minimal and spec-like; use this manual's principles / scenarios for situational guidance
 - If runtime exposes only one `reply*`, that is the only correct completion path for the current state
-- `tellaskBack` is the fallback when ownership cannot be determined from existing SOP, or when upstream must answer; it is not the default first move for every blocked state
+- `tellaskBack` is valid only when ownership cannot be determined from existing SOP, or when the tellasker must answer; it is not the default first move for every blocked state
 
 ## Best Practices
 

package/dist/tools/prompts/control/en/scenarios.md

@@ -51,11 +51,11 @@ delete_reminder({
 - If the information should synchronize the whole team's current effective state, put it in Taskdoc `progress` instead
 - If the note is durable knowledge rather than an active working-set cue, move it to `personal_memory` instead
 
-## Scenario 2: Sideline is complete, and the assignment header requires replyTellask
+## Scenario 2: Side Dialog is complete, and the assignment header requires replyTellask
 
 ### Scenario Description
 
-The current sideline is finished, and the assignment header explicitly says "when complete, call `replyTellask`".
+The current Side Dialog is finished, and the assignment header explicitly says "when complete, call `replyTellask`".
 
 ### Example
 
@@ -72,11 +72,11 @@ replyTellask({
 - Put the final deliverable body directly in `replyContent`
 - If the header says `replyTellaskSessionless`, use the same shape with that exact function name
 
-## Scenario 3: Work is not finished yet, and an upstream clarification is required
+## Scenario 3: Work is not finished yet, and tellasker clarification is required
 
 ### Scenario Description
 
-The sideline is still blocked or incomplete, so you need to ask upstream for missing information.
+The Side Dialog is still blocked or incomplete, so you need to ask the tellasker for missing information.
 
 ### Example
 
@@ -89,15 +89,15 @@ tellaskBack({
 
 ### Key Points
 
-- This example uses `tellaskBack` because upstream input is specifically required
+- This example uses `tellaskBack` because tellasker input is specifically required
 - If team SOP / role ownership already identifies the responsible executor, directly use `tellask` / `tellaskSessionless` for that owner instead of mapping every unfinished state to `tellaskBack`
 - Do not use `replyTellask*` for intermediate clarifications
 
-## Scenario 4: Upstream answered the ask-back, so use replyTellaskBack to close
+## Scenario 4: Tellasker answered the ask-back, so use replyTellaskBack to close
 
 ### Scenario Description
 
-You previously sent a `tellaskBack`, upstream has now replied, and runtime exposes `replyTellaskBack`.
+You previously sent a `tellaskBack`, the tellasker has now replied, and runtime exposes `replyTellaskBack`.
 
 ### Example
 

package/dist/tools/prompts/control/en/tools.md

@@ -23,16 +23,16 @@
 
 The **tool descriptions themselves** for these functions intentionally stay minimal and spec-like. This section carries the smallest practical lookup for when they appear and how to choose among them.
 
-| Function                  | Minimal parameter contract   | When runtime exposes it                                                                             | Effect                                                     |
-| ------------------------- | ---------------------------- | --------------------------------------------------------------------------------------------------- | ---------------------------------------------------------- |
-| `replyTellask`            | `{ replyContent: string }`   | Current sideline comes from a sessioned `tellask` and is ready for final delivery                   | Delivers the final result for the current tellask session  |
-| `replyTellaskSessionless` | `{ replyContent: string }`   | Current sideline comes from a one-shot `tellaskSessionless` and is ready for final delivery         | Delivers the final result for the current one-shot tellask |
-| `replyTellaskBack`        | `{ replyContent: string }`   | Current dialog holds an unresolved `tellaskBack` reply directive                                    | Delivers the final answer to the upstream ask-back         |
-| `tellaskBack`             | `{ tellaskContent: string }` | Current sideline must ask upstream back, and existing team SOP cannot directly assign another owner | Sends a follow-up request upstream; not final delivery     |
+| Function                  | Minimal parameter contract   | When runtime exposes it                                                                                     | Effect                                                         |
+| ------------------------- | ---------------------------- | ----------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------- |
+| `replyTellask`            | `{ replyContent: string }`   | Current Side Dialog comes from a sessioned `tellask` and is ready for final delivery                        | Delivers the final result for the current tellask session      |
+| `replyTellaskSessionless` | `{ replyContent: string }`   | Current Side Dialog comes from a one-shot `tellaskSessionless` and is ready for final delivery              | Delivers the final result for the current one-shot tellask     |
+| `replyTellaskBack`        | `{ replyContent: string }`   | Current dialog holds an unresolved `tellaskBack` reply directive                                            | Delivers the final answer to the tellasker ask-back            |
+| `tellaskBack`             | `{ tellaskContent: string }` | Current Side Dialog must ask the tellasker back, and existing team SOP cannot directly assign another owner | Sends a follow-up request to the tellasker; not final delivery |
 
 ### Minimal Usage Rules
 
-- Focus on doing the current task correctly first; only move into `reply*` closure when final upstream delivery is actually ready
+- Focus on doing the current task correctly first; only move into `reply*` closure when final tellasker delivery is actually ready
 - Call whichever `reply*` runtime currently exposes; do not switch to another reply variant by yourself
 - If the assignment header explicitly names a reply function, follow that exact name
 - Put only the final deliverable body in `replyContent`; do not wrap it in meta-explanations like "I am now calling replyTellask"

package/dist/tools/prompts/control/zh/principles.md

@@ -93,20 +93,20 @@
 ### 决策规则
 
 - 当前支线未完成时，先判断团队规程 / SOP / 职责卡能否明确负责人；若能明确且属于执行性处理，直接 `tellask` / `tellaskSessionless` 对应负责人
-- 只有当必须向上游补需求、澄清目标、裁决取舍、确认验收口径、提供缺失输入，或现有规程无法明确判责时：调用 `tellaskBack({ tellaskContent })`
+- 只有当必须向诉请者补需求、澄清目标、裁决取舍、确认验收口径、提供缺失输入，或现有规程无法明确判责时：调用 `tellaskBack({ tellaskContent })`
 - 需要人类亲自登录 / GUI / 验证码 / 高风险授权时：调用 `askHuman({ tellaskContent })`
 - 当前支线已经完成，且当前 assignment 明确要求 `replyTellask`：调用 `replyTellask({ replyContent })`
 - 当前支线已经完成，且当前 assignment 明确要求 `replyTellaskSessionless`：调用 `replyTellaskSessionless({ replyContent })`
-- 当前是在回复一条上游发来的 `tellaskBack` 续诉请，且 runtime 暴露了 `replyTellaskBack`：调用 `replyTellaskBack({ replyContent })`
+- 当前是在回复一条诉请者发来的 `tellaskBack` 续诉请，且 runtime 暴露了 `replyTellaskBack`：调用 `replyTellaskBack({ replyContent })`
 - 普通文本不是跨对话完成交付通道；如果你直接输出正文而没调 reply 工具，runtime 可能临时插入一条 `role=user` 的提醒要求你改用正确的 reply 函数
 
 ### 心智负担最小化规则
 
-- 先专注把当前任务做对；`reply*` 只在最终对上游交付时用于收口
+- 先专注把当前任务做对；`reply*` 只在最终对诉请者交付时用于收口
 - 不要靠记忆硬选 reply 变体；以当前 assignment 头部和 runtime 当前暴露的函数名为准
 - `reply*` 函数自身说明文案故意保持极简，只承载最小规格；情景判断看本手册的 principles / scenarios
 - 若 runtime 只暴露一个 `reply*`，那就是当前应调用的唯一完成路径
-- `tellaskBack` 是“无法按现有规程明确判责，或必须回问上游”的兜底动作，不是所有阻塞的默认第一动作
+- `tellaskBack` 只在“无法按现有规程明确判责，或必须回问诉请者”时成立，不是所有阻塞的默认第一动作
 
 ## 最佳实践
 

package/dist/tools/prompts/control/zh/scenarios.md

@@ -71,11 +71,11 @@ replyTellask({
 - `replyContent` 直接放最终交付正文
 - 若 assignment 头部写的是 `replyTellaskSessionless`，则同结构替换函数名
 
-## 场景 3：当前未完成，需要回问上游
+## 场景 3：当前未完成，需要回问诉请者
 
 ### 场景描述
 
-当前支线仍未完成，因此需要向上游补问缺失信息。
+当前支线仍未完成，因此需要向诉请者补问缺失信息。
 
 ### 示例
 
@@ -84,12 +84,12 @@ tellaskBack({
   tellaskContent: '还缺少生产环境端口与部署入口信息。请补充这两项后我再继续给出最终方案。',
 });
 
-// 等上游补充后，runtime 会在当前对话里继续推进
+// 等诉请者补充后，runtime 会在当前对话里继续推进
 ```
 
 ### 关键点
 
-- 这里只是“必须向上游补输入”的例子，所以用 `tellaskBack`
+- 这里只是“必须向诉请者补输入”的例子，所以用 `tellaskBack`
 - 若团队规程 / SOP / 职责卡已经能明确执行负责人，应直接 `tellask` / `tellaskSessionless` 对应负责人，而不是机械因为“未完成态”就用 `tellaskBack`
 - `tellaskBack` 只负责把问题问回去，不负责最终交付
 
@@ -97,7 +97,7 @@ tellaskBack({
 
 ### 场景描述
 
-你之前发过 `tellaskBack`，上游现在补回了所需信息，runtime 暴露了 `replyTellaskBack`。
+你之前发过 `tellaskBack`，诉请者现在补回了所需信息，runtime 暴露了 `replyTellaskBack`。
 
 ### 示例
 

package/dist/tools/prompts/control/zh/tools.md

@@ -27,12 +27,12 @@
 | ------------------------- | ---------------------------- | -------------------------------------------------------------------- | ----------------------------------- |
 | `replyTellask`            | `{ replyContent: string }`   | 当前支线承接的是 sessioned `tellask`，且已进入可交付完成态           | 把最终结果回复给当前 `tellask` 会话 |
 | `replyTellaskSessionless` | `{ replyContent: string }`   | 当前支线承接的是 one-shot `tellaskSessionless`，且已进入可交付完成态 | 把最终结果回复给当前一次性诉请      |
-| `replyTellaskBack`        | `{ replyContent: string }`   | 当前对话持有一条未完成的 `tellaskBack` 回复指令                      | 把对上一条回问的最终答复送回上游    |
-| `tellaskBack`             | `{ tellaskContent: string }` | 当前支线必须回问上游，且现有团队规程无法直接判责到其他负责人         | 向上游发起续诉请，不算最终交付      |
+| `replyTellaskBack`        | `{ replyContent: string }`   | 当前对话持有一条未完成的 `tellaskBack` 回复指令                      | 把对上一条回问的最终答复送回诉请者  |
+| `tellaskBack`             | `{ tellaskContent: string }` | 当前支线必须回问诉请者，且现有团队规程无法直接判责到其他负责人       | 向诉请者发起续诉请，不算最终交付    |
 
 ### 最小使用规则
 
-- 先专注把当前任务做对；只有真到最终对上游交付时，才进入 `reply*` 收口
+- 先专注把当前任务做对；只有真到最终对诉请者交付时，才进入 `reply*` 收口
 - 看见哪一个 `reply*` 被 runtime 暴露，就调用哪一个；不要自行改选别的 reply 变体
 - assignment 头部若已点名 reply 函数名，以那个名字为准
 - `replyContent` 只放最终交付正文，不要再包一层“我现在调用了 replyXXX”

package/dist/tools/prompts/team_memory/en/scenarios.md

@@ -103,7 +103,7 @@ Maintain shared terminology and standard wording across the team.
 add_team_memory({
   path: 'team/glossary/dialog-terms',
   content:
-    '## Dialog Terms\n\n- In user-facing copy, prefer: Mainline dialog / Sideline dialog\n- In implementation context, main dialog / subdialog / supdialog are acceptable\n- Do not surface implementation terms directly into user-facing copy',
+    '## Dialog Terms\n\n- In user-facing copy, prefer: Main Dialog / Side Dialog\n- In implementation context, main dialog / sideDialog / askerDialog are acceptable\n- Do not surface implementation terms directly into user-facing copy',
 });
 ```
 

package/dist/tools/prompts/team_memory/zh/scenarios.md

@@ -103,7 +103,7 @@ add_team_memory({
 add_team_memory({
   path: 'team/glossary/dialog-terms',
   content:
-    '## 对话术语\n\n- 用户面向文案优先使用：主线对话 / 支线对话\n- 实现上下文可使用：main dialog / subdialog / supdialog\n- 不要把实现术语直接裸露到用户可见 copy',
+    '## 对话术语\n\n- 用户面向文案优先使用：主线对话 / 支线对话\n- 实现上下文可使用：main dialog / sideDialog / askerDialog\n- 不要把实现术语直接裸露到用户可见 copy',
 });
 ```
 

package/dist/tools/team_mgmt-manual.js

@@ -114,7 +114,7 @@ async function renderTeamMgmtGuideContent(language, topicsRaw = []) {
                     '`model_param_options` 可选：用于记录该 provider 支持的 `.minds/team.yaml model_params` 选项（文档用途）。',
                     '`apiQuirks` 可选：写在 `providers.<providerKey>.apiQuirks`，类型是 `string|string[]`。它是 provider 级 transport / 网关兼容开关，用来描述“这个供应商/网关的 API 有非标准行为”，不是 `.minds/team.yaml` 的成员参数，也不是 `model_params`。',
                     '使用原则：只有在你确认某个上游网关确实偏离了标准协议，而且 Dominds 已为这个偏差实现了命名 quirk 时才配置；不要把它当作随意调参入口。当前实现里，未知 quirk 值通常不会报错，但也不会带来任何效果。',
-                    '当前已知示例：OpenAI Responses 包装层支持 `apiQuirks: xcode.best`（或数组里包含它）。它一方面会把供应商额外发出的 `keepalive` 流事件识别为 heartbeat，而不是当作异常事件处理；另一方面也会对该网关特有的失败模式做 provider-specific failure handling，包括“同一对话上下文连续返回 empty response”时先做少量临时重试；如果在同一未变化上下文里连续达到阈值，就判定这是 provider 侧 same-context deadlock，而不是普通基础设施抖动：此时继续沿用同一上下文自动重试大概率仍然不会有真实进展，必须引入新的信息或新的指令（例如补充上下文、改写问题、换一个切入方式，或在确实需要人类判断时调用 askHuman）。这类 provider/API retry 状态在同一次 driver 自动续跑链里会继续沿用，不因中途换 course 而自动清零；若当前对话启用了鞭策，driver 也会优先判断是否能按鞭策逻辑直接续跑一次，而不是先落入 stopped，并且一旦 driver 接受这次自动恢复资格，就会立刻记作已消费；这里的恢复语义是“deadlock break”而不是普通空转鞭策，所以即使当前轮次已经登记了在途诉请/支线对话，也不会仅因 pending subdialog 就否决这一次恢复；以及把网关返回的 HTML 版 502 Bad Gateway 错误页和 `500 auth_unavailable: no auth available` 这类基础设施失败归类为 conservative 策略重试。最小示例：\n```yaml\nproviders:\n  my_gateway:\n    apiType: openai\n    baseUrl: https://example.invalid/v1\n    apiKeyEnvVar: MY_GATEWAY_API_KEY\n    apiQuirks: xcode.best\n    models:\n      my_model: { name: "upstream-model-id" }\n```',
+                    '当前已知示例：OpenAI Responses 包装层支持 `apiQuirks: xcode.best`（或数组里包含它）。它一方面会把供应商额外发出的 `keepalive` 流事件识别为 heartbeat，而不是当作异常事件处理；另一方面也会对该网关特有的失败模式做 provider-specific failure handling，包括“同一对话上下文连续返回 empty response”时先做少量临时重试；如果在同一未变化上下文里连续达到阈值，就判定这是 provider 侧 same-context deadlock，而不是普通基础设施抖动：此时继续沿用同一上下文自动重试大概率仍然不会有真实进展，必须引入新的信息或新的指令（例如补充上下文、改写问题、换一个切入方式，或在确实需要人类判断时调用 askHuman）。这类 provider/API retry 状态在同一次 driver 自动续跑链里会继续沿用，不因中途换 course 而自动清零；若当前对话启用了鞭策，driver 也会优先判断是否能按鞭策逻辑直接续跑一次，而不是先落入 stopped，并且一旦 driver 接受这次自动恢复资格，就会立刻记作已消费；这里的恢复语义是“deadlock break”而不是普通空转鞭策，所以即使当前轮次已经登记了在途诉请/支线对话，也不会仅因 pending sideDialog 就否决这一次恢复；以及把网关返回的 HTML 版 502 Bad Gateway 错误页和 `500 auth_unavailable: no auth available` 这类基础设施失败归类为 conservative 策略重试。最小示例：\n```yaml\nproviders:\n  my_gateway:\n    apiType: openai\n    baseUrl: https://example.invalid/v1\n    apiKeyEnvVar: MY_GATEWAY_API_KEY\n    apiQuirks: xcode.best\n    models:\n      my_model: { name: "upstream-model-id" }\n```',
                     '边界提醒：`apiQuirks` 只影响实现里显式消费它的 provider/generator。就当前实现看，至少 OpenAI Responses 路径会读取它；不要假设所有 `apiType` 都支持或需要它。若配置后行为仍异常，应继续检查上游网关文档、抓流事件类型，并结合 `team_mgmt_check_provider(...)` / 运行日志排查。',
                 ])
             : fmtHeader('.minds/llm.yaml') +
@@ -128,7 +128,7 @@ async function renderTeamMgmtGuideContent(language, topicsRaw = []) {
                     'Optional: `model_param_options` documents `.minds/team.yaml model_params` knobs (documentation only).',
                     '`apiQuirks` is optional under `providers.<providerKey>.apiQuirks`, with type `string|string[]`. It is a provider-level transport / gateway compatibility switch for non-standard upstream API behavior. It is not a `.minds/team.yaml` member field and not part of `model_params`.',
                     'Use it only when you have confirmed that an upstream gateway deviates from the expected protocol and Dominds has an explicitly named quirk for that deviation. Do not treat it as a generic tuning field. In the current implementation, unknown quirk values are usually ignored rather than rejected, so a typo may silently do nothing.',
-                    'Known current example: the OpenAI Responses wrapper supports `apiQuirks: xcode.best` (or an array containing it). It not only treats vendor-emitted `keepalive` stream events as heartbeat events instead of unexpected protocol noise, but also applies provider-specific failure handling for gateway-specific failures, including repeated empty responses in the same unchanged dialog context (a few temporary retries first; once the unchanged-context streak reaches the threshold, Dominds treats it as a provider-side same-context deadlock rather than ordinary infrastructure flakiness, which means repeating the same automatic retry path is no longer expected to make real progress and fresh information or fresh instructions are required, such as adding context, reframing the ask, changing the angle, or calling askHuman when human judgment is genuinely needed; this provider/API retry state intentionally continues across course changes within the same driver auto-continue chain; if Diligence Push is enabled for the dialog, the driver will first see whether it can continue once through that path before falling into stopped, and that recovery budget is considered consumed as soon as the driver accepts that path; this is a deadlock-break recovery rather than the ordinary idle-time Diligence Push, so a pending subdialog alone does not veto that one recovery injection) and gateway-returned HTML 502 Bad Gateway pages plus `500 auth_unavailable: no auth available` infrastructure failures classified into conservative retry. Minimal example:\n```yaml\nproviders:\n  my_gateway:\n    apiType: openai\n    baseUrl: https://example.invalid/v1\n    apiKeyEnvVar: MY_GATEWAY_API_KEY\n    apiQuirks: xcode.best\n    models:\n      my_model: { name: "upstream-model-id" }\n```',
+                    'Known current example: the OpenAI Responses wrapper supports `apiQuirks: xcode.best` (or an array containing it). It not only treats vendor-emitted `keepalive` stream events as heartbeat events instead of unexpected protocol noise, but also applies provider-specific failure handling for gateway-specific failures, including repeated empty responses in the same unchanged dialog context (a few temporary retries first; once the unchanged-context streak reaches the threshold, Dominds treats it as a provider-side same-context deadlock rather than ordinary infrastructure flakiness, which means repeating the same automatic retry path is no longer expected to make real progress and fresh information or fresh instructions are required, such as adding context, reframing the ask, changing the angle, or calling askHuman when human judgment is genuinely needed; this provider/API retry state intentionally continues across course changes within the same driver auto-continue chain; if Diligence Push is enabled for the dialog, the driver will first see whether it can continue once through that path before falling into stopped, and that recovery budget is considered consumed as soon as the driver accepts that path; this is a deadlock-break recovery rather than the ordinary idle-time Diligence Push, so a pending sideDialog alone does not veto that one recovery injection) and gateway-returned HTML 502 Bad Gateway pages plus `500 auth_unavailable: no auth available` infrastructure failures classified into conservative retry. Minimal example:\n```yaml\nproviders:\n  my_gateway:\n    apiType: openai\n    baseUrl: https://example.invalid/v1\n    apiKeyEnvVar: MY_GATEWAY_API_KEY\n    apiQuirks: xcode.best\n    models:\n      my_model: { name: "upstream-model-id" }\n```',
                     'Boundary reminder: `apiQuirks` only affects providers/generators that explicitly read it in code. In the current implementation, at least the OpenAI Responses path consumes it; do not assume every `apiType` supports or needs it. If behavior is still wrong after setting it, continue with upstream gateway docs, raw stream event inspection, and `team_mgmt_check_provider(...)` / runtime logs.',
                 ]);
     }

package/dist/tools/team_mgmt-mcp-manual.js

@@ -484,6 +484,7 @@ async function renderMcpManual(language) {
                 '支持热重载：编辑 `.minds/mcp.yaml` 后通常无需重启 Dominds；必要时用 `mcp_restart`。',
                 '默认按“每个对话租用一个 MCP 运行时实例”运行（更安全）：某个对话首次使用该 server 时，可能为它启动/持有一个运行时实例（HTTP 连接或 stdio 进程），并添加 sticky reminder。确认当前对话不再需要该运行时实例后，用 `mcp_release` 释放。租约只表达运行时资源归属，不决定该 server 的全局工具注册/可见性；如确实是无状态服务器，可配置 `truely-stateless: true` 允许跨对话共享。',
                 'stdio 配置格式：`command` 必须是字符串（可执行命令），参数放在 `args`（string[]，可省略，默认空数组）。`cwd` 可选（字符串）：用于固定相对路径解析目录。',
+                'HTTP headers 支持三种值：字面量字符串、`{ env: NAME }`、`{ prefix: "Bearer ", env: NAME }`；认证 token 建议从环境变量读取，不要写死在 YAML。',
                 '用 `tools.whitelist/blacklist` 控制暴露的工具，用 `transform` 做命名变换。',
                 '常见坑：stdio transport 需要可执行命令路径正确，且受成员权限（目录 + 扩展名：`*_dirs/no_*_dirs/*_file_ext_names/no_*_file_ext_names`）约束；HTTP transport 需要服务可达（url/端口/网络）。',
                 '高频坑（stdio 路径）：若未设置 `cwd`，相对路径按 Dominds 进程工作目录（通常 rtws 根目录）解析；建议显式配置 `cwd` 或直接使用绝对路径。`cwd` 必须存在且是目录。',
@@ -545,6 +546,10 @@ async function renderMcpManual(language) {
                 '    truely-stateless: false',
                 '    transport: streamable_http',
                 '    url: http://127.0.0.1:3000/mcp',
+                '    # headers:',
+                '    #   Authorization:',
+                '    #     prefix: "Bearer "',
+                '    #     env: MCP_AUTH_TOKEN',
                 '    tools: { whitelist: [], blacklist: [] }',
                 '    transform: []',
                 '    manual:',
@@ -563,6 +568,7 @@ async function renderMcpManual(language) {
             'Hot reload: edits usually apply without restarting Dominds; use `mcp_restart` when needed.',
             "Default is per-dialog MCP runtime leasing (safer): a dialog's first use may start/hold one runtime instance for that server (an HTTP connection or stdio process), and first use adds a sticky reminder. Call `mcp_release` when you're sure the current dialog no longer needs that runtime instance. This lease is about runtime resource ownership only; tool registration/visibility still follows the latest global server instance. If the server is truly stateless, set `truely-stateless: true` to allow cross-dialog sharing.",
             'Stdio shape: `command` must be a string executable; parameters go in `args` (string[], optional, defaults to empty). Optional `cwd` (string) fixes the working directory used for relative paths.',
+            'HTTP headers support three value forms: literal strings, `{ env: NAME }`, and `{ prefix: "Bearer ", env: NAME }`; keep auth tokens in env instead of hardcoding them in YAML.',
             'Use `tools.whitelist/blacklist` for exposure control and `transform` for naming transforms.',
             'Common pitfalls: stdio transport needs a correct executable/command path, and is subject to member permissions (directory + extension: `*_dirs/no_*_dirs/*_file_ext_names/no_*_file_ext_names`); HTTP transport requires the server URL to be reachable.',
             'High-frequency pitfall (stdio paths): if `cwd` is omitted, relative paths are resolved from Dominds process cwd (usually rtws root). Prefer setting `cwd` explicitly or use absolute paths. `cwd` must exist and be a directory.',
@@ -624,6 +630,10 @@ async function renderMcpManual(language) {
             '    truely-stateless: false',
             '    transport: streamable_http',
             '    url: http://127.0.0.1:3000/mcp',
+            '    # headers:',
+            '    #   Authorization:',
+            '    #     prefix: "Bearer "',
+            '    #     env: MCP_AUTH_TOKEN',
             '    tools: { whitelist: [], blacklist: [] }',
             '    transform: []',
             '    manual:',