dsh-advisor-group 0.1.1 → 0.1.2

package/README.md

@@ -17,6 +17,7 @@
 - **Three ways to activate** — `@顾问群` mention (force-start), same question repeated 3 times without resolution, or main-model self-assessed confidence below the threshold.
 - **Optional Jev semantic pre-classification (off by default)** — when `trigger.jev.enabled` is on, a configured Jev model judges non-force-started consultations first (escalation / high-risk / web-search fit, thresholds under `trigger.jev.*`); if Jev is unavailable the local rules-based classifier still decides. With `trigger.jev.useEnglishState`, the judge reads the caller-supplied English gist (`questionEn`) instead of the Chinese question — display and session records stay Chinese.
 - **Retro CRT chat cards** — green/amber/blue CRT themes, scanlines, LIVE/DONE headers, auto-expanded thinking panel with auto-scroll; advisor Markdown rendered with a link-protocol whitelist (headings, lists, code, quotes, links, tables).
+- **Ask another session (`ask_session`)** — hand one question to another live session — by exact session id, exact title, or a natural partial name such as the workspace name (`极简遥控器`) — and read what that session said between the delivery receipt and its next whole-session idle. The result is explicitly **not** a one-to-one reply, and the asking side renders the exchange in the same retro chat-group card. Guards: hop ≤ 2, no self/subagent target, one wait per session, a 32 KB payload budget; the target's turn is never cancelled.
 - **Provider presets (11 platforms · 26 presets)** — DeepSeek, Moonshot Kimi, Kimi Code, Aliyun Bailian, Zhipu AI, OpenAI, Claude, Gemini, SiliconFlow, AIHubMix, OpenRouter (OpenAI/Anthropic-compatible variants included).
 - **Security-minded by design** — API keys use official `SecretField` semantics (never returned to the browser; `apiKeysByProvider` key history is server-side only), SSRF-guarded diagnostics (https-only / loopback, no IP literals, no redirects), per-boot token auth on `/advisor-group/*` routes, and an atomic **configurable daily consultation cap** (default 50, can be disabled) persisted across restarts.
 - **Runtime toggle** — `toggle_advisor_group` enables/disables the plugin and persists the flag to settings.
@@ -58,7 +59,7 @@ npx @deepseek-ai/dsh web
    - type `@顾问群` in your question to force a consultation, or
    - ask a professional/uncertain question — the plugin escalates automatically when appropriate.
 
-`ask_advisors` tools available to the model: `ask_advisors`, `toggle_advisor_group`.
+`ask_advisors` tools available to the model: `ask_advisors`, `toggle_advisor_group`, `ask_session`.
 
 ## ⚙️ Configuration
 
@@ -100,6 +101,8 @@ One consultation is not one call but a chain of them. With the defaults (`maxRou
 
 Billing follows each channel: advisors bill on the route and model you gave them, while the driver bills on the current session's model. To keep costs down, lower `maxRounds`, configure fewer advisors, set `tools: 'off'` for advisors, and pick a daily cap you are comfortable with. Resuming after an interruption ("▶ continue") only asks the advisors that had not finished, so it costs less than starting over.
 
+`ask_session` is outside the consultation quota: it wakes the target session, which answers with one ordinary turn billed on that session's own model, and it never counts as a new consultation.
+
 ## 🔒 Security & privacy
 
 - Direct API keys can be stored in the DSH `settings.yaml` (marked secret, never returned to the browser by `describe`); prefer `apiKeyEnv` (env-var mode) if you don't want keys on disk.
@@ -113,6 +116,7 @@ Billing follows each channel: advisors bill on the route and model you gave them
 
 - A hard crash of the DSH host can leave an already-open card showing **LIVE** until the page is refreshed (a disconnect notice now appears); refresh restores the true state from the session log.
 - Risk notes are **fact-based, never text-based**: a consultation reports truncation (an advisor stream cut off by timeout or network) and cancellation/stop. Users see them on **stopped or completed** cards and in the session log, and the main model receives them in the `ask_advisors` result. Advisor prose is not scanned for keywords — the earlier text heuristic was removed in 0.1.1 because it also fired on plain negations such as 「没有任何风险」.
+- Cross-session asking (`ask_session`) has no settings switch yet, so the tool is visible in every session and relies on its own description to keep use to explicit user requests; two sessions asking each other at the same time is not detected.
 
 ## 🛠️ Development
 

package/README.zh.md

@@ -19,6 +19,7 @@
 - **三种触发方式**：`@顾问群` 提及（强制启动）、同一问题重复 3 次未解决、主模型自评置信度低于阈值。
 - **Jev 语义前置分类（可选，默认关闭）**：开启 `trigger.jev.enabled` 后，未强制启动的咨询先由配置的 Jev 模型语义判断（是否该找顾问 / 是否高风险 / 是否更适合联网，阈值在 `trigger.jev.*`）；Jev 不可用时仍由本地规则分类器判定。`trigger.jev.useEnglishState` 开启后，判定改读主模型附带的英文概要（`questionEn`），展示与会话记录仍用中文。
 - **复古 CRT 聊天组卡片**：绿/琥珀/蓝三主题、扫描线、LIVE/DONE 标题、💭 思考面板默认展开自动滚底；顾问正文走轻量 Markdown 渲染（链接协议白名单，支持标题/列表/代码/引用/链接/表格）。
+- **跨会话提问（`ask_session`）**：把一个问题交给另一个**活着的**会话——用完整会话号、一字不差的标题，或者自然的名字（例如工作目录名「极简遥控器」）都可以——并唤醒它；拿回的是**从投递回执到对方下一次整体空闲**之间它说的话，明确**不是**逐条对应的回答。提问方一侧用同一套复古聊天组卡片呈现这次对话。护栏：跳数 ≤ 2、不能问自己或子会话、同一会话同时只等一个、载荷上限 32 KB；**永不取消对方的回合**。
 - **供应商预设（11 平台 · 26 预设）**：DeepSeek、月之暗面 Kimi、Kimi Code、阿里云百炼、智谱 AI、OpenAI、Claude、Gemini、硅基流动、AIHubMix、OpenRouter（含 OpenAI / Anthropic 兼容变体）。
 - **注重安全**：API Key 采用官方 `SecretField` 语义（浏览器永不回显；`apiKeysByProvider` 供应商密钥档案仅存服务端）；诊断端点 SSRF 加固（仅 https/loopback、拒绝 IP 字面量与重定向）；`/advisor-group/*` 路由启动期 token 鉴权；每日新咨询**可配置原子配额**（默认 50，可关闭），持久化跨重启。
 - **运行时开关**：`toggle_advisor_group` 启停插件并持久化到设置。
@@ -61,7 +62,7 @@ npx @deepseek-ai/dsh web
    - 提问时带 `@顾问群` 强制发起咨询，或
    - 直接提专业/不确定的问题——插件会按需自动升级。
 
-模型可用工具：`ask_advisors`、`toggle_advisor_group`。
+模型可用工具：`ask_advisors`、`toggle_advisor_group`、`ask_session`。
 
 ## ⚙️ 配置项
 
@@ -103,6 +104,8 @@ npx @deepseek-ai/dsh web
 
 费用分别结算：顾问按你给它们配的通道与模型计费，驱动模型按当前会话的模型计费。想控成本，可以降 `maxRounds`、减少顾问数、给顾问设 `tools: 'off'`，再把每日上限设成你能接受的数字。中断后用「▶ 继续聊天」续跑只补问没答完的顾问，不会整场重来，代价低于重开一次。
 
+`ask_session` 不走咨询配额：它唤醒目标会话，对方用一次普通回合作答、按其自身模型计费，也不会被算作一次新咨询。
+
 ## 🔒 安全与隐私
 
 - 直连 API Key 可存于 DSH `settings.yaml`（标 secret，官方 `describe` 绝不回传浏览器）；不想落盘请用 `apiKeyEnv` 环境变量模式。
@@ -116,6 +119,7 @@ npx @deepseek-ai/dsh web
 
 - DSH 宿主进程硬崩溃时，已打开的卡片在刷新前可能仍显示 **LIVE**（现在会先出现断线提示）；刷新后按会话日志恢复真实状态。
 - 风险提示**只看事实、不看措辞**：截断（顾问输出被超时或网络中断）与取消（本轮咨询被停止）两种。用户可在**已停止或已完成**的卡片与会话日志中看到，主模型随 `ask_advisors` 返回收到。顾问正文不做关键词扫描——早期那套「凭字眼猜有没有保留意见」的启发式已在 0.1.1 移除，原因是它连「没有任何风险」这样的否定句也会当成风险提示（盲测里 4 条纯否定句全部误报）。
+- 跨会话提问（`ask_session`）目前**没有设置开关**，工具在所有会话里可见，靠工具说明把使用限制在「用户明确要求时」；两个会话互相等待的情况尚未检测。
 
 ## 🛠️ 开发
 

package/lib/client.js

@@ -283,12 +283,60 @@ const DEFAULT_ADVISOR_PROMPT = `
 *   advisor-group/message -> update (live bubbles)
 *   advisor-group/end     -> update (final synopsis)
 */
-function advisorGroupToken() {
+/** The per-boot token as injected into the page, when that injection arrived. */
+function injectedAdvisorGroupToken() {
 	return globalThis.__ADVISOR_GROUP_TOKEN__ ?? "";
 }
-function authHeaders() {
-	const token = advisorGroupToken();
-	return token ? { "x-advisor-group-token": token } : {};
+let advisorGroupTokenCache = "";
+let advisorGroupTokenFetch = null;
+/** Token known so far: the injected one wins, otherwise the last handshake. */
+function currentAdvisorGroupToken() {
+	return injectedAdvisorGroupToken() || advisorGroupTokenCache;
+}
+/**
+* The host normally injects the per-boot token into the served index. The
+* desktop shell can compose its window before this plugin registers that
+* injection, so the page may never receive it — fall back to fetching it from
+* the plugin's own handshake route.
+*/
+async function resolveAdvisorGroupToken(force = false) {
+	if (!force) {
+		const known = currentAdvisorGroupToken();
+		if (known) return known;
+	}
+	if (!advisorGroupTokenFetch) advisorGroupTokenFetch = (async () => {
+		try {
+			const res = await fetch(`/advisor-group/boot-token`, { headers: { accept: "application/json" } });
+			if (!res.ok) return "";
+			const body = await res.json();
+			return typeof body.token === "string" ? body.token : "";
+		} catch {
+			return "";
+		}
+	})().then((token) => {
+		advisorGroupTokenCache = token;
+		advisorGroupTokenFetch = null;
+		return token;
+	});
+	return await advisorGroupTokenFetch || injectedAdvisorGroupToken();
+}
+/**
+* `fetch` with the per-boot token attached. A 401 means the token rotated (a
+* live plugin reload mints a new one) or that the injected copy was stale, so
+* refresh it once and retry before surfacing the failure.
+*/
+async function authedFetch(path, init = {}) {
+	const send = (token) => fetch(path, {
+		...init,
+		headers: {
+			...init.headers,
+			...token ? { "x-advisor-group-token": token } : {}
+		}
+	});
+	const res = await send(await resolveAdvisorGroupToken());
+	if (res.status !== 401) return res;
+	const refreshed = await resolveAdvisorGroupToken(true);
+	return refreshed ? send(refreshed) : res;
 }
 /**
 * Browser-side twin of `sanitizeAdvisorContent` (host module cannot be
@@ -315,7 +363,8 @@ function viewData(state) {
 		...state.context === void 0 ? {} : { context: state.context },
 		advisors: state.advisors,
 		messages: state.messages,
-		...state.summary === void 0 ? {} : { summary: state.summary }
+		...state.summary === void 0 ? {} : { summary: state.summary },
+		...state.mode === void 0 ? {} : { mode: state.mode }
 	};
 }
 const advisorGroupDefinition = {
@@ -335,7 +384,7 @@ const advisorGroupDefinition = {
 	start: (_context, match) => {
 		if (match.event.type !== "advisor-group/start") throw new Error("advisor-group requires advisor-group/start");
 		const data = match.event.data;
-		return {
+		const base = {
 			sessionId: data.sessionId,
 			turn: data.turn,
 			step: data.step,
@@ -351,6 +400,11 @@ const advisorGroupDefinition = {
 			}],
 			status: "running"
 		};
+		if (data.kind === "ask") return {
+			...base,
+			mode: "ask"
+		};
+		return base;
 	},
 	update: (context, match) => {
 		if (match.event.type === "advisor-group/message") {
@@ -710,11 +764,11 @@ function buildStepSequence(actionDescriptions, thinkingSegments, toolViews) {
 *   💭 思考·1 → ⛭ 工具×1（输入/输出）→ 💭 思考·2 → ⛭ 工具×2 → … → 📄 正文
 * Main/system messages stay a single collapsible row.
 */
-function AdvisorSteps({ message }) {
+function AdvisorSteps({ message, plain = false }) {
 	const isMain = message.role === "main";
 	const isSystem = message.role === "system";
 	const label = isMain ? "YOU" : isSystem ? "SYSTEM" : message.advisorName ?? message.advisorId ?? "ADVISOR";
-	const group = isMain ? "YOU" : isSystem ? "SYSTEM" : `${label} · R${message.round ?? 1}`;
+	const group = isMain || isSystem || plain ? label : `${label} · R${message.round ?? 1}`;
 	const truncated = message.truncated;
 	const toolViews = buildToolStepViews(message.toolSteps);
 	const thinkingSegments = message.thinkingSegments && message.thinkingSegments.length > 0 ? message.thinkingSegments : message.thinking ? [message.thinking] : [];
@@ -767,7 +821,7 @@ function AdvisorSteps({ message }) {
 		if (liveToolPhase) continue;
 		children.push((0, react.createElement)(StepRow, {
 			key: `body-${index}`,
-			title: `${group} 📄 正文`,
+			title: plain ? group : `${group} 📄 正文`,
 			badges: truncated ? [(0, react.createElement)("span", { style: badgeStyle("#f87171") }, truncated.reason === "timeout" ? "⏱ 响应超时截断" : "⚠ 流中断")] : [],
 			defaultOpen: true,
 			color: "#4ade80",
@@ -793,6 +847,7 @@ const NOTICE_TTL_MS = 6e3;
 function AdvisorGroupNodeView(props) {
 	const data = props.node.data;
 	const sessionId = data.sessionId;
+	const isAsk = data.mode === "ask";
 	const [live, setLive] = (0, react.useState)({});
 	const [contextCollapsed, setContextCollapsed] = (0, react.useState)(true);
 	const lastEventIdRef = (0, react.useRef)(0);
@@ -816,9 +871,20 @@ function AdvisorGroupNodeView(props) {
 	const clearStreamNotice = () => {
 		setTransientNotice((prev) => prev && prev.kind === "stream" ? null : prev);
 	};
+	const [streamTokenReady, setStreamTokenReady] = (0, react.useState)(() => currentAdvisorGroupToken() !== "");
+	(0, react.useEffect)(() => {
+		if (streamTokenReady) return;
+		let alive = true;
+		resolveAdvisorGroupToken().then((token) => {
+			if (alive && token) setStreamTokenReady(true);
+		});
+		return () => {
+			alive = false;
+		};
+	}, [streamTokenReady]);
 	(0, react.useEffect)(() => {
-		if (!sessionId) return;
-		const es = new EventSource(`/advisor-group/stream?sessionId=${encodeURIComponent(sessionId)}&lastEventId=${lastEventIdRef.current}&bootId=${encodeURIComponent(lastBootIdRef.current)}&token=${encodeURIComponent(advisorGroupToken())}`);
+		if (!sessionId || isAsk || !streamTokenReady) return;
+		const es = new EventSource(`/advisor-group/stream?sessionId=${encodeURIComponent(sessionId)}&lastEventId=${lastEventIdRef.current}&bootId=${encodeURIComponent(lastBootIdRef.current)}&token=${encodeURIComponent(currentAdvisorGroupToken())}`);
 		es.onopen = () => {
 			clearStreamNotice();
 		};
@@ -896,7 +962,7 @@ function AdvisorGroupNodeView(props) {
 				noticeTimerRef.current = null;
 			}
 		};
-	}, [sessionId]);
+	}, [sessionId, streamTokenReady]);
 	const mergedMessages = data.messages.map((message) => {
 		if (message.role !== "advisor") return message;
 		const advisorId = message.advisorId ?? "";
@@ -927,7 +993,7 @@ function AdvisorGroupNodeView(props) {
 		};
 	});
 	const shortId = data.sessionId.length > 8 ? data.sessionId.slice(0, 8) : data.sessionId;
-	const title = data.status === "completed" ? "ADVISOR GROUP · DONE" : data.status === "cancelled" ? "ADVISOR GROUP · STOPPED" : "ADVISOR GROUP · LIVE";
+	const title = isAsk ? data.status === "completed" ? "跨会话提问 · 已完成" : "跨会话提问 · 等待应答" : data.status === "completed" ? "ADVISOR GROUP · DONE" : data.status === "cancelled" ? "ADVISOR GROUP · STOPPED" : "ADVISOR GROUP · LIVE";
 	return (0, react.createElement)("div", {
 		style: rootStyle,
 		role: "log",
@@ -939,17 +1005,14 @@ function AdvisorGroupNodeView(props) {
 			alignItems: "center",
 			gap: 8
 		}
-	}, data.status === "running" ? (0, react.createElement)("button", {
+	}, data.status === "running" && !isAsk ? (0, react.createElement)("button", {
 		type: "button",
 		onClick: () => {
 			(async () => {
 				try {
-					const body = await (await fetch("/advisor-group/stop", {
+					const body = await (await authedFetch("/advisor-group/stop", {
 						method: "POST",
-						headers: {
-							"content-type": "application/json",
-							...authHeaders()
-						},
+						headers: { "content-type": "application/json" },
 						body: JSON.stringify({ sessionId })
 					})).json();
 					if (body.ok === false) showTransientNotice(body.error ?? "请求未被服务端接受，请稍后重试。", "action", NOTICE_TTL_MS);
@@ -967,17 +1030,14 @@ function AdvisorGroupNodeView(props) {
 			padding: "2px 8px",
 			fontSize: 11
 		}
-	}, "⏹ 停止") : data.status === "cancelled" ? (0, react.createElement)("button", {
+	}, "⏹ 停止") : data.status === "cancelled" && !isAsk ? (0, react.createElement)("button", {
 		type: "button",
 		onClick: () => {
 			(async () => {
 				try {
-					const body = await (await fetch("/advisor-group/resume", {
+					const body = await (await authedFetch("/advisor-group/resume", {
 						method: "POST",
-						headers: {
-							"content-type": "application/json",
-							...authHeaders()
-						},
+						headers: { "content-type": "application/json" },
 						body: JSON.stringify({ sessionId })
 					})).json();
 					if (body.ok === false) showTransientNotice(body.error ?? "请求未被服务端接受，请稍后重试。", "action", NOTICE_TTL_MS);
@@ -999,9 +1059,10 @@ function AdvisorGroupNodeView(props) {
 		type: "button",
 		onClick: () => setContextCollapsed((value) => !value),
 		style: contextToggleStyle
-	}, `📋 项目背景 ${contextCollapsed ? "▸" : "▾"}`), !contextCollapsed ? (0, react.createElement)("div", { style: contextBodyStyle }, data.context) : null) : null, (0, react.createElement)("div", { style: advisorsLineStyle }, `ADVISORS: ${data.advisors.map((a) => a.avatar ? `${a.avatar} ${a.name}` : a.name).join(" · ")}`), mergedMessages.map((message, index) => (0, react.createElement)(AdvisorSteps, {
+	}, `📋 项目背景 ${contextCollapsed ? "▸" : "▾"}`), !contextCollapsed ? (0, react.createElement)("div", { style: contextBodyStyle }, data.context) : null) : null, (0, react.createElement)("div", { style: advisorsLineStyle }, isAsk ? `提问方: ${data.advisors[0]?.name ?? "?"} → 目标会话: ${data.advisors[1]?.name ?? "?"}` : `ADVISORS: ${data.advisors.map((a) => a.avatar ? `${a.avatar} ${a.name}` : a.name).join(" · ")}`), mergedMessages.map((message, index) => (0, react.createElement)(AdvisorSteps, {
 		key: index,
-		message
+		message,
+		plain: isAsk
 	})), data.status === "completed" && data.summary?.conclusion ? (0, react.createElement)("div", { style: {
 		borderTop: "1px dashed #2f9e44",
 		marginTop: 8,
@@ -1010,7 +1071,7 @@ function AdvisorGroupNodeView(props) {
 		color: "#86efac",
 		fontWeight: 700,
 		marginBottom: 4
-	} }, "📌 综合结论"), (0, react.createElement)("div", null, renderMarkdown(data.summary.conclusion))) : null, data.status === "completed" && (data.summary?.riskNotes ?? []).length > 0 ? (0, react.createElement)("div", { style: {
+	} }, isAsk ? "📌 投递说明" : "📌 综合结论"), (0, react.createElement)("div", null, renderMarkdown(data.summary.conclusion))) : null, data.status === "completed" && (data.summary?.riskNotes ?? []).length > 0 ? (0, react.createElement)("div", { style: {
 		borderTop: "1px dashed #2f9e44",
 		marginTop: 8,
 		paddingTop: 8
@@ -1035,7 +1096,7 @@ function AdvisorGroupNodeView(props) {
 			fontSize: 12,
 			marginTop: 2
 		}
-	}, note))) : null, data.status === "running" ? (0, react.createElement)("div", { style: waitingStyle }, "▊ AWAITING RESPONSES…") : null, transientNotice ? (0, react.createElement)("div", { style: noticeStyle }, transientNotice.text) : null);
+	}, note))) : null, data.status === "running" ? (0, react.createElement)("div", { style: waitingStyle }, isAsk ? "▊ 已投递，等待对方回应…" : "▊ AWAITING RESPONSES…") : null, transientNotice ? (0, react.createElement)("div", { style: noticeStyle }, transientNotice.text) : null);
 }
 const settingsRootStyle = {
 	fontFamily: "'Inter', 'Segoe UI', system-ui, sans-serif",
@@ -1235,7 +1296,7 @@ function AdvisorGroupSettingsTab() {
 		setMsg("");
 		setError("");
 		try {
-			const [configData, providerData] = await Promise.all([fetch("/advisor-group/config", { headers: authHeaders() }).then((r) => r.json()), fetch("/advisor-group/providers", { headers: authHeaders() }).then((r) => r.json())]);
+			const [configData, providerData] = await Promise.all([authedFetch("/advisor-group/config").then((r) => r.json()), authedFetch("/advisor-group/providers").then((r) => r.json())]);
 			if (configData.ok && configData.config) {
 				setConfig(configData.config);
 				savedJsonRef.current = JSON.stringify(configData.config);
@@ -1291,12 +1352,9 @@ function AdvisorGroupSettingsTab() {
 		setError("");
 		setMsg("");
 		try {
-			const data = await (await fetch("/advisor-group/models", {
+			const data = await (await authedFetch("/advisor-group/models", {
 				method: "POST",
-				headers: {
-					"content-type": "application/json",
-					...authHeaders()
-				},
+				headers: { "content-type": "application/json" },
 				body: JSON.stringify({
 					advisorId: advisor.id,
 					provider: advisor.provider,
@@ -1332,12 +1390,9 @@ function AdvisorGroupSettingsTab() {
 		setError("");
 		setMsg("");
 		try {
-			const data = await (await fetch("/advisor-group/test-connection", {
+			const data = await (await authedFetch("/advisor-group/test-connection", {
 				method: "POST",
-				headers: {
-					"content-type": "application/json",
-					...authHeaders()
-				},
+				headers: { "content-type": "application/json" },
 				body: JSON.stringify({
 					advisorId: advisor.id,
 					provider: advisor.provider,
@@ -1371,12 +1426,9 @@ function AdvisorGroupSettingsTab() {
 				},
 				advisors: config.advisors.map(({ apiKeyMetaByProvider: _meta, ...rest }) => rest)
 			};
-			const data = await (await fetch("/advisor-group/config", {
+			const data = await (await authedFetch("/advisor-group/config", {
 				method: "POST",
-				headers: {
-					"content-type": "application/json",
-					...authHeaders()
-				},
+				headers: { "content-type": "application/json" },
 				body: JSON.stringify({
 					config: configPayload,
 					expectedRevision: revision