dsh-agent-message 1.5.0 → 1.5.1

package/README.en.md

@@ -12,8 +12,8 @@ English | [中文](./README.md)
 
 In DeepSeek Harness, a single process hosts multiple Agent sessions at once. This plugin equips each session with three tools so they can "message" each other:
 
-- Before sending, first **list every sendable session** (all non-archived ones are listed, including offline ones that haven't been reopened), and find the target by its title;
-- Once found, **deliver the message to the target session** — ordinary messages always enter a new independent turn; if the target is offline (not loaded since the last process restart), the plugin resumes it through Harness's public API, delivers the message, and releases the runtime after processing;
+- Before sending, first **list every sendable independent session** (non-archived, excluding actual subagents, including offline sessions that have not been reopened), and find the target by its title;
+- Once found, **deliver the message to the target session** — ordinary messages always enter a new independent turn; if the target is offline (not loaded since the last process restart), the plugin resumes it through Harness's public API, delivers the message, and keeps the handle loaded for later communication until plugin teardown;
 - When needed, **query the delivery status of a message on demand** (queued / claimed / discarded / unknown), with the target runtime status reported separately for supervision scenarios.
 
 Typical scenarios: an orchestrator Agent dispatching work to a developer Agent, two Agents collaborating in a relay, a main session sending instructions to a test session, or a supervisor Agent watching over several workers.
@@ -33,7 +33,7 @@ Typical scenarios: an orchestrator Agent dispatching work to a developer Agent,
 
 ![Clickable sender header example](./docs/assets/message-header-navigation.jpg)
 
-The image shows navigation on a historical `user` bubble. Current relay messages use the same visible-card and sender-navigation experience while retaining plugin `relay` provenance instead of impersonating human input. The full session id remains in typed source metadata and in a Host-generated model-visible protocol header, so the receiving Agent never has to guess the sender.
+Current relay messages are displayed as visible Agent message cards; clicking the header opens the sender session. The persisted source remains plugin `relay` provenance rather than impersonating human input. The full session id remains in typed source metadata and in a Host-generated model-visible protocol header, so the receiving Agent never has to guess the sender.
 
 ### Delivery modes (the `mode` parameter of `send_agent_message`)
 
@@ -78,8 +78,8 @@ The plugin ships a `cordis.patch.yml` (pointed to by `dsh.bundle.patch` in `pack
 ## Usage
 
 1. Type `@` at the beginning of session A's composer and choose the target from the native candidate menu; each candidate shows its title and `Running`/`Idle` activity;
-2. `@` only tells A where the relevant session is; it does not mean send. A calls `send_agent_message` when either the current request or an orchestration responsibility already granted by the user requires cross-session communication, and makes that routing decision silently. For example, `@B tell it to stop after opening the draft PR` sends, while `@B analyze its latest conversation result` only reads B on demand without explaining the internal routing decision;
-3. For an explicit forwarding request, A only delivers and reports the result. It must not execute the forwarded task itself or ask B for an extra acknowledgement. B sends a business result to `senderSessionId` only when the body explicitly asks for one;
+2. `@` only tells A where the relevant session is; it does not mean send. A calls `send_agent_message` only when the current request or an orchestration responsibility already granted by the user requires cross-session communication. For example, `@B tell it to stop after opening the draft PR` sends, while `@B analyze its latest conversation result` must not send a message to B;
+3. For an explicit forwarding request, A only delivers and reports whether the message was accepted or failed. It must not execute the forwarded task itself or ask B for an extra acknowledgement. B sends a message to `senderSessionId` only when the body explicitly asks it to return business content;
 4. You can still ask the Agent to call `list_peer_agents` and send directly with a full session id;
 5. Session B receives a native `UserMessage` with a typed relay source plus a minimal Host-generated source header on the first body line, so B does not have to guess the sender. The Client presents it as a visible Agent message card whose header opens the sender session;
 6. (Supervision) Say "check the status of my messages to `<session id>`" — it calls `check_delivery`.
@@ -99,14 +99,16 @@ Delivery paths of `send_agent_message`:
 
 Session enumeration, batched titles, and offline log reads use Harness's `sessionQuery.listSessions()`, `readTitleSnapshots()`, and `readSession()` respectively. `SessionId` is the only address; `parentSession` records fork lineage only, and only `origin: subagent` identifies an actual subagent. The plugin does not scan `sessionPersistence` directly to rebuild a parallel session directory.
 
-After `send_agent_message` submits the native message to the target Inbox, it immediately returns `accepted` with the native `messageId`. `check_delivery` then derives `pending` (still queued), `claimed` (claimed by a turn), `discarded` (cancelled), or `unknown` from Inbox events. `claimed` is transport evidence only: it does not prove that the message was read, answered, or completed. Pre-admission failure remains a Harness tool error and writes nothing to the target Inbox. Runtime state is reported separately as `targetRuntimeStatus`, so unrelated Agent activity never changes the message state. A known `messageId` remains queryable from the target Inbox log after a process restart.
+After `send_agent_message` submits the native message to the target Inbox, it immediately returns `accepted` with the native `messageId`; the model receives only a terse “delivered” projection while the complete result stays in tool presentation metadata. `check_delivery` then derives `pending` (still queued), `claimed` (claimed by a turn), `discarded` (cancelled), or `unknown` from Inbox events on demand. `claimed` is transport evidence only: it does not prove that the message was read, answered, or completed. Pre-admission failure remains a Harness tool error and writes nothing to the target Inbox. Runtime state is reported separately as `targetRuntimeStatus`, so unrelated Agent activity never changes the message state. A known `messageId` remains queryable from the target Inbox log after a process restart.
 
 Every cross-session message is created by Harness `createUserMessage()`, and `UserMessage.id` is its only message identity. Its source always uses `kind: dsh-agent-message` and `form: relay`, plus the protocol version, sender/target Session ids, and display title. Because current Harness model requests do not expand custom source fields, the Host also writes a minimal `<dsh-agent-message>` header containing only `senderSessionId` on the first body line. The typed source is the durable/UI truth; the header is only the model-visible projection needed for reply addressing. The plugin registers no global system prompt; send admission lives only in the `send_agent_message` tool contract. The Client only projects relay as a visible Agent message card and never rewrites an Agent message as human `user` provenance.
 
-The current release has no separate result protocol: relay only means “a message addressed by another session”; it neither requires nor forbids a reply. When the body explicitly requests a business result, the receiving Agent may send it to `senderSessionId` with the same tool. Otherwise it must not send a transport acknowledgement or a bare “received.” A correlated Result protocol should be added only when machine-verifiable request/result linkage is required.
+Relay only means “a message addressed by another session”; it neither requires nor forbids a reply. When the body explicitly requests business content in return, the receiving Agent may send a message to `senderSessionId` with the same tool. Otherwise it must not send a transport acknowledgement or a bare “received.” The plugin does not automatically correlate requests and replies or forward ordinary Agent answers.
 
 The composer-side `@` session locator reuses Harness's native `inputTriggers` command marker. The visible selected title is capped at 40 Unicode characters with an ellipsis; submission replaces it with the full stable `@session-...` id for the current Agent. The sent bubble still projects that id with a chat icon and the live session title, so renaming a session does not change the locator target.
 
+See [`docs/architecture-v2.md`](./docs/architecture-v2.md) for the current architecture contract.
+
 ## Directory structure
 
 ```
@@ -116,18 +118,16 @@ dsh-agent-message/
 │   └── client.js       # client half: @session references, session navigation and copy-session-id button
 ├── cordis.patch.yml    # self-registration patch (pointed to by dsh.bundle.patch)
 ├── package.json        # DSH plugin manifest (dsh.bundle / dsh.client / dshx.contributes)
-├── docs/               # design notes and README example screenshot
+├── docs/               # current architecture and README example screenshot
 ├── README.md           # Chinese documentation
 └── README.en.md        # English documentation
 ```
 
-## In Development
-
-- **Cross-process communication:** Allow Agent sessions running in different DSH processes to exchange messages.
-
 ## Limitations
 
 - The target session must be **non-archived** and present in local persistence; archived sessions are always rejected.
+- These tools are only for communication between independent sessions; actual subagents are neither listed as targets nor allowed to call them.
+- One Session pair, regardless of direction, may receive at most 10 deliveries in a rolling 60-second window. The 11th is rejected before the target Inbox is changed. This window belongs to the current Harness process and resets on restart.
 - Automatically resuming an offline session uses the **default model** (it does not inherit a model manually selected earlier in that session); if resume fails, the message is not written to the target Inbox.
 - Bulk receipt queries without `messageId` rely on in-memory bookkeeping and cover only the most recent 1000 sends in the current process (FIFO eviction). After a restart, a known `messageId` remains queryable, but the volatile `sentAt` and `mode` fields are no longer returned.
 - Cross-process / cross-machine communication is out of scope.

package/README.md

@@ -12,8 +12,8 @@
 
 在 DeepSeek Harness 里，一个进程会同时挂着多个 Agent 会话。本插件给每个会话装上三个工具，让它们能互相"发消息"：
 
-- 发消息前，先**列出所有可发送的会话**（未归档的都在列，含离线未打开的），按标题找到目标；
-- 找到后，**把消息投递到目标会话**——普通消息统一进入独立的新 turn；目标离线（进程重启后还没打开）时，插件通过 Harness 公开接口恢复会话、投递，并在处理结束后释放 runtime；
+- 发消息前，先**列出所有可发送的独立会话**（未归档、排除真实子代理，含离线未打开的），按标题找到目标；
+- 找到后，**把消息投递到目标会话**——普通消息统一进入独立的新 turn；目标离线（进程重启后还没打开）时，插件通过 Harness 公开接口恢复会话、投递，并保持加载供后续通信，插件卸载时再释放 handle；
 - 需要时，可以**按需查询**某条消息的送达状态（排队中/已认领/被丢弃/未知），并单独查看目标是否正在运行，供监督场景使用。
 
 典型场景：编排者 Agent 给开发 Agent 派活、两个 Agent 协作接力、主会话给测试会话发指令、监督者 Agent 盯梢多个 worker。
@@ -33,7 +33,7 @@
 
 ![可点击的发送者消息头示例](./docs/assets/message-header-navigation.jpg)
 
-图中是历史 `user` 气泡的导航效果；当前 relay 消息使用相同的可见卡片和发送方跳转，但持久化来源仍是插件 `relay`，不会伪装成人类输入。完整会话 ID 同时保留在 typed source 和 Host 生成的模型可见协议头中，避免接收 Agent 猜测发送方。
+当前 relay 消息显示为可见的 Agent 消息卡片；点击消息头即可跳转到发送方会话。持久化来源仍是插件 `relay`，不会伪装成人类输入。完整会话 ID 同时保留在 typed source 和 Host 生成的模型可见协议头中，避免接收 Agent 猜测发送方。
 
 ### 投递模式（`send_agent_message` 的 `mode` 参数）
 
@@ -79,8 +79,8 @@ Agent 会用 bash 执行这条命令，装完自动挂载、所有会话立即
 ## 使用
 
 1. 在会话 A 的输入框开头键入 `@`，从原生候选菜单中选择目标会话；候选会显示标题和“运行中/空闲”；
-2. `@` 只告诉 A 信息或操作的目标在哪里，不代表发送。当前请求或用户已授予的编排职责要求跨会话传递信息时，A 调用 `send_agent_message`并静默执行路由决策。例如 `@B 告诉他最后提交 PR draft 就停止` 会发送，`@B 帮我分析他最新的对话结果` 则只按需读取 B，不向用户解释内部路由判断；
-3. 显式要求转告时，A 只负责投递和报告结果，不代为执行被转发的任务，也不要求 B 额外回复“收到”；如果正文明确要求 B 把业务结果返回 A，B 才向 `senderSessionId` 发送结果；
+2. `@` 只告诉 A 信息或操作的目标在哪里，不代表发送。当前请求或用户已授予的编排职责要求跨会话传递信息时，A 才调用 `send_agent_message`。例如 `@B 告诉他最后提交 PR draft 就停止` 会发送，`@B 帮我分析他最新的对话结果` 则不应向 B 发消息；
+3. 显式要求转告时，A 只负责投递并报告“已接受”或失败，不代为执行被转发的任务，也不要求 B 额外回复“收到”；如果正文明确要求 B 把业务内容返回 A，B 才向 `senderSessionId` 发送消息；
 4. 也可以让 Agent 调 `list_peer_agents`，再用完整会话 ID 直接发送；
 5. 会话 B 收到的是带 typed relay source 的原生 `UserMessage`；正文首行还有 Host 生成的最小来源协议，B 不需要猜测发送方；Client 将其显示为可见 Agent 消息卡片，并可从消息头打开发送方会话；
 6. （监督场景）说「查一下我发给 `<会话ID>` 的消息状态」——它会调 `check_delivery`。
@@ -100,14 +100,16 @@ Agent 会用 bash 执行这条命令，装完自动挂载、所有会话立即
 
 会话枚举、批量标题和离线日志读取分别使用 Harness 的 `sessionQuery.listSessions()`、`readTitleSnapshots()` 与 `readSession()`。`SessionId` 是唯一地址；`parentSession` 只记录分叉血缘，只有 `origin: subagent` 才会被识别为真实子代理。插件不直接扫描 `sessionPersistence` 重建另一份会话目录。
 
-`send_agent_message` 成功把原生消息提交给目标 Inbox 后立即返回 `accepted` 和该消息的原生 `messageId`；`check_delivery` 根据 Inbox 事件返回 `pending`（仍在排队）、`claimed`（已被某轮认领）、`discarded`（被取消）或 `unknown`。`claimed` 只是传输证据，不表示已读、回复或任务完成。接纳前失败由 Harness 工具错误表示，不写入目标 Inbox。目标是否正在运行通过独立的 `targetRuntimeStatus` 返回，不把 Agent 的整体运行状态误当成某条消息正在处理。指定 `messageId` 时可从目标现有 Inbox 日志恢复状态，因此进程重启后仍可查询。
+`send_agent_message` 成功把原生消息提交给目标 Inbox 后立即返回 `accepted` 和该消息的原生 `messageId`；模型只接收简短的“已投递”，完整结果保留在工具呈现元数据中。`check_delivery` 根据 Inbox 事件按需返回 `pending`（仍在排队）、`claimed`（已被某轮认领）、`discarded`（被取消）或 `unknown`。`claimed` 只是传输证据，不表示已读、回复或任务完成。接纳前失败由 Harness 工具错误表示，不写入目标 Inbox。目标是否正在运行通过独立的 `targetRuntimeStatus` 返回，不把 Agent 的整体运行状态误当成某条消息正在处理。指定 `messageId` 时可从目标现有 Inbox 日志恢复状态，因此进程重启后仍可查询。
 
 所有跨会话消息都由 Harness `createUserMessage()` 创建，`UserMessage.id` 是唯一消息身份。`source.kind` 固定为 `dsh-agent-message`，`form` 固定为 `relay`，并携带协议版本、发送/目标 Session 和显示标题。由于当前 Harness 不会把自定义 source 字段展开给模型，Host 还会在正文首行写入只含 `senderSessionId` 的最小 `<dsh-agent-message>` 协议头；source 是持久化/UI 真相，协议头只是回复寻址所需的模型可见投影。插件不注册全局系统提示词，发送准入只存在于 `send_agent_message` 的工具合同中。Client 只把 relay 投影为可见的 Agent 消息卡片，不会反向把 Agent 消息伪装成人类 `user` 来源。
 
-当前版本没有额外的结果协议：relay 只表达“另一会话发来的消息”，本身不等于必须回复或禁止回复。正文明确要求返回业务结果时，接收 Agent 可用同一工具向 `senderSessionId` 发送结果；没有明确要求时不回传 transport ack 或单纯的“收到”。需要机器可核验的请求/结果关联时，再引入独立 Result 协议。
+relay 只表达“另一会话发来的消息”，本身不等于必须回复或禁止回复。正文明确要求返回业务内容时，接收 Agent 可用同一工具向 `senderSessionId` 发送消息；没有明确要求时不回传 transport ack 或单纯的“收到”。插件不自动关联请求与回复，也不自动转发 Agent 的普通回答。
 
 输入框的 `@` 会话定位复用 Harness 原生 `inputTriggers` 命令标记：选择后的可见标题最多 40 个 Unicode 字符，超出用省略号；提交给当前 Agent 时换成完整 `@session-...` 稳定 ID。发送后的气泡依然用聊天图标和实时会话标题投影该 ID，显示名称变化不会改变定位目标。
 
+完整的现役架构合同见 [`docs/architecture-v2.md`](./docs/architecture-v2.md)。
+
 ## 目录结构
 
 ```
@@ -117,18 +119,16 @@ dsh-agent-message/
 │   └── client.js       # client 半区：@会话引用、会话导航与复制会话ID按钮
 ├── cordis.patch.yml    # 自注册补丁（dsh.bundle.patch 指向它）
 ├── package.json        # DSH 插件清单（dsh.bundle / dsh.client / dshx.contributes）
-├── docs/               # 设计稿与 README 示例截图
+├── docs/               # 现役架构与 README 示例截图
 ├── README.md           # 中文文档
 └── README.en.md        # English documentation
 ```
 
-## 正在开发
-
-- **跨进程通信**：让运行在不同 DSH 进程中的 Agent 会话也能互相收发消息。
-
 ## 限制
 
 - 目标会话必须**未归档**且存在于本机持久化里；归档会话一律拒绝发送。
+- 工具只用于独立 Session 之间通信；真实子代理既不会出现在目标列表中，也不能作为调用方使用这些工具。
+- 同一对 Session（不分发送方向）在滚动 60 秒内最多投递 10 条消息；第 11 条会在写入目标 Inbox 前被拒绝。该窗口只属于当前 Harness 进程，重启后清空。
 - 自动恢复离线会话时会使用**默认模型**（不继承它上次手动切换的模型选择）；恢复失败时消息不会被写入目标 Inbox。
 - 不指定 `messageId` 的批量回执依赖内存记账，只覆盖本进程最近 1000 条发送记录（FIFO 淘汰）；进程重启后仍可凭已知 `messageId` 查询，但不再返回易失的 `sentAt` 和 `mode`。
 - 跨进程/跨机器通信不在本插件范围内。

package/lib/client.js

@@ -14,6 +14,7 @@ window.__ModuleLoader__.load({
     function apply(ctx) {
       const senderSelector = '[data-ref-chip="subagent"], [data-context-relay-sender]';
       const referenceSource = "agent-message-session";
+      const reactRootSelector = "[data-agent-msg-react-root]";
       const candidateRows = new WeakMap();
       const mountedRoots = new Map();
       const sessionLinks = new Set();
@@ -53,20 +54,26 @@ window.__ModuleLoader__.load({
         if (!root) {
           root = createRoot(host);
           mountedRoots.set(host, root);
+          host.setAttribute("data-agent-msg-react-root", "true");
         }
         root.render(content);
       }
 
       function cleanupRoots(node) {
-        mountedRoots.forEach(function (root, host) {
-          if (node === host || (node instanceof Element && node.contains(host))) {
-            root.unmount();
-            mountedRoots.delete(host);
-          }
-        });
-        sessionLinks.forEach(function (element) {
-          if (node === element || (node instanceof Element && node.contains(element))) sessionLinks.delete(element);
+        if (!(node instanceof Element)) return;
+        const hosts = node.matches(reactRootSelector)
+          ? [node].concat(Array.from(node.querySelectorAll(reactRootSelector)))
+          : Array.from(node.querySelectorAll(reactRootSelector));
+        hosts.forEach(function (host) {
+          const root = mountedRoots.get(host);
+          if (!root) return;
+          root.unmount();
+          mountedRoots.delete(host);
         });
+        const links = node.matches(".agent-msg-session-link")
+          ? [node].concat(Array.from(node.querySelectorAll(".agent-msg-session-link")))
+          : Array.from(node.querySelectorAll(".agent-msg-session-link"));
+        links.forEach(function (element) { sessionLinks.delete(element); });
       }
 
       function SessionActivity(props) {
@@ -84,7 +91,7 @@ window.__ModuleLoader__.load({
       function RelaySender(props) {
         return React.createElement("span", { className: "agent-msg-relay-sender-content" },
           React.createElement(IconQueueOutline14, { size: 14, className: "agent-msg-session-icon" }),
-          React.createElement("span", null, "From Session · " + props.title + ":"));
+          React.createElement("span", null, uiText("来自会话 · ", "From Session · ") + props.title + ":"));
       }
 
       function enhanceReferenceHost(element, row) {
@@ -166,7 +173,7 @@ window.__ModuleLoader__.load({
 
       function titleFrom(text) {
         const line = String(text || "").split("\n", 1)[0].trim();
-        const current = line.match(/^From (?:Session|Agent)(?: ·)? (.+?):(?: @session-[\w-]+)?$/);
+        const current = line.match(/^(?:From (?:Session|Agent)|来自会话)(?: ·)? (.+?):(?: @session-[\w-]+)?$/);
         const previous = line.match(/^来自 Agent · (.+)$/);
         const legacy = line.match(/^来自 Agent「(.+)」\s*[·：:]?$/);
         return (current || previous || legacy)?.[1]?.trim() || "";
@@ -177,7 +184,6 @@ window.__ModuleLoader__.load({
         const label = element.previousElementSibling;
         const title = titleFrom(label?.textContent);
         if (title && label) {
-          label.textContent = "";
           label.classList.add("agent-msg-sender-prefix");
         }
         return title;
@@ -197,13 +203,13 @@ window.__ModuleLoader__.load({
           element.dataset.agentMsgSessionId = link.sessionId;
           if (title) element.dataset.agentMsgSenderTitle = title;
           if (relay) renderInto(element, React.createElement(RelaySender, { title: title }));
-          else element.textContent = "From Session · " + title + ":";
+          else element.textContent = uiText("来自会话 · ", "From Session · ") + title + ":";
           element.classList.add("agent-msg-session-link", "agent-msg-sender-link");
           sessionLinks.add(element);
           element.setAttribute("role", "link");
           element.setAttribute("tabindex", "0");
-          element.setAttribute("title", "打开发送方会话");
-          element.setAttribute("aria-label", "打开发送方会话：" + (title || link.sessionId));
+          element.setAttribute("title", uiText("打开发送方会话", "Open sender session"));
+          element.setAttribute("aria-label", uiText("打开发送方会话：", "Open sender session: ") + (title || link.sessionId));
         });
       }
 
@@ -363,14 +369,18 @@ window.__ModuleLoader__.load({
           type: "button",
           onClick: onClick,
           onMouseLeave: onMouseLeave,
-          title: "复制会话 ID",
-          "aria-label": "复制会话 ID",
+          title: uiText("复制会话 ID", "Copy session ID"),
+          "aria-label": uiText("复制会话 ID", "Copy session ID"),
           className: "agent-msg-copy-id"
-        }, copyState === "copied" ? "已复制" : copyState === "failed" ? "复制失败" : "复制ID");
+        }, copyState === "copied"
+          ? uiText("已复制", "Copied")
+          : copyState === "failed"
+            ? uiText("复制失败", "Copy failed")
+            : uiText("复制ID", "Copy ID"));
       }
 
       ctx.slots.inject("conversation.session.header.actions", () => ctx.slots.register(
-        { name: "conversation.session.header.actions", id: "copy-session-id", order: 30, label: "复制会话ID" },
+        { name: "conversation.session.header.actions", id: "copy-session-id", order: 30, label: uiText("复制会话ID", "Copy session ID") },
         (props) => React.createElement(CopyButton, { sessionId: props.sessionId })
       ));
 

package/lib/index.js

@@ -10,9 +10,14 @@ export function apply(ctx) {
   const sent = new Map()
   /** 记账表 FIFO 上限：超过则淘汰最老记录，内存恒定。 */
   const SENT_MAX = 1000
+  const PAIR_MESSAGE_LIMIT = 10
+  const PAIR_WINDOW_MS = 60_000
   const receiptMeaning = 'claimed 仅表示目标 turn 已从 Inbox 认领消息；传输回执不表示对方已读、回复或完成。'
   /** 插件恢复的 Session handle；保留到插件卸载，避免 idle dispose 移除 Harness store 投影。 */
   const resumedHandles = new Map()
+  /** 无向 Session 对 -> 最近成功或正在进行的投递预留；只保护当前 Harness 进程。 */
+  const pairSends = new Map()
+  let lastPairPruneAt = 0
 
   ctx.effect(() => async () => {
     const handles = [...resumedHandles.values()]
@@ -37,6 +42,34 @@ export function apply(ctx) {
     if (sent.size > SENT_MAX) sent.delete(sent.keys().next().value)
   }
 
+  function reservePairSend(from, to) {
+    const now = Date.now()
+    if (now < lastPairPruneAt || now - lastPairPruneAt >= PAIR_WINDOW_MS) {
+      for (const [key, entries] of pairSends) {
+        const active = entries.filter((entry) => now - entry.at < PAIR_WINDOW_MS)
+        if (active.length === 0) pairSends.delete(key)
+        else pairSends.set(key, active)
+      }
+      lastPairPruneAt = now
+    }
+    const key = JSON.stringify([String(from), String(to)].sort())
+    const recent = (pairSends.get(key) ?? []).filter((entry) => now - entry.at < PAIR_WINDOW_MS)
+    if (recent.length >= PAIR_MESSAGE_LIMIT) {
+      pairSends.set(key, recent)
+      throw new Error('同一对会话 60 秒内最多投递 10 条消息，请稍后再试')
+    }
+    const reservation = { at: now }
+    recent.push(reservation)
+    pairSends.set(key, recent)
+    return () => {
+      const current = pairSends.get(key)
+      if (current === undefined) return
+      const index = current.indexOf(reservation)
+      if (index !== -1) current.splice(index, 1)
+      if (current.length === 0) pairSends.delete(key)
+    }
+  }
+
   function titleOf(agent) {
     const service = ctx.get('sessionTitle')
     if (service !== undefined) {
@@ -71,6 +104,12 @@ export function apply(ctx) {
     return header?.origin === 'subagent'
   }
 
+  function assertPeerCaller(agent) {
+    if (agent !== undefined && isSubagentSession(agent.session.header)) {
+      throw new Error('子代理不能使用独立会话通信工具')
+    }
+  }
+
   function sessionQuery() {
     const query = ctx.get('sessionQuery')
     if (query === undefined) throw new Error('本部署缺少 sessionQuery，无法查询逻辑会话')
@@ -180,6 +219,7 @@ export function apply(ctx) {
     },
     async execute(_args, exec) {
       const me = exec.agent
+      assertPeerCaller(me)
       const archived = archivedIds()
       const query = sessionQuery()
       const live = new Map()
@@ -230,6 +270,7 @@ export function apply(ctx) {
       '默认使用 followup 创建独立的新 turn；' +
       '目标离线（进程里未加载）时自动恢复该会话后投递。' +
       '用户无需说出模式名：目标为 running 且整句明确要求立即介入时用 steer，明确要求不打断当前任务、只补充上下文时用 inject；不确定时使用 followup。' +
+      '同一对 Session 双向合计 60 秒内最多投递 10 条消息，超过时拒绝本次投递。' +
       '归档会话和子代理一律拒绝。' +
       '注意：它不同于 send_message（后者是给你的后台子代理续聊）。',
     parameters: {
@@ -239,15 +280,31 @@ export function apply(ctx) {
     },
     output: {
       schema: { type: 'json' },
-      render(_args, value) {
-        return [{ type: 'text', text: value.text || JSON.stringify(value) }]
+      render() {
+        return [{ type: 'text', text: '已投递。' }]
       },
+      presentationMeta(_args, value) {
+        return value
+      },
+    },
+    presentResult(_args, result) {
+      const meta = result.meta
+      if (result.isError || meta === null || typeof meta !== 'object' || Array.isArray(meta)) return
+      return {
+        card: 'generic',
+        title: '消息已投递',
+        content: [{ type: 'text', text: meta.text || JSON.stringify(meta, null, 2) }],
+      }
     },
     async execute(args, exec) {
       const me = exec.agent
       if (me === undefined) throw new Error('no calling agent')
+      assertPeerCaller(me)
       const to = args.to
       if (to === '' || String(to) === String(me.id)) throw new Error('不能给自己发消息')
+      if (args.content.includes('<dsh-agent-message>') || args.content.includes('</dsh-agent-message>')) {
+        throw new Error('消息正文不能包含保留协议标签 dsh-agent-message')
+      }
 
       const archived = archivedIds()
       if (archived.has(String(to))) throw new Error('对方会话已归档，无法发送（请先取消归档）')
@@ -260,6 +317,14 @@ export function apply(ctx) {
         throw new Error(mode + ' 仅用于 running 会话；目标当前状态：' + target.status)
       }
 
+      let inspected
+      if (target === undefined) {
+        inspected = await readLogicalSession(to)
+        if (inspected === undefined) throw new Error('会话不存在：' + to)
+        if (isSubagentSession(inspected.session)) throw new Error('目标是子代理，不能通过会话通信插件直接发送')
+        if (mode !== 'followup') throw new Error('目标离线（进程里未加载）：' + mode + ' 仅用于 running 会话')
+      }
+
       const myTitle = titleOf(me) || String(me.id)
       const source = {
         kind: name,
@@ -279,19 +344,21 @@ export function apply(ctx) {
       let usedMode = ''
       let targetRuntimeStatus = 'offline'
 
-      if (target !== undefined) {
-        if (mode === 'followup') { target.followup(message); usedMode = mode }
-        else if (mode === 'inject') { target.inject(message); usedMode = 'inject' }
-        else { target.steer(message); usedMode = 'steer' }
-        targetRuntimeStatus = target.status
-      } else {
-        const inspected = await readLogicalSession(to)
-        if (inspected === undefined) throw new Error('会话不存在：' + to)
-        if (isSubagentSession(inspected.session)) throw new Error('目标是子代理，不能通过会话通信插件直接发送')
-        if (mode !== 'followup') throw new Error('目标离线（进程里未加载）：' + mode + ' 仅用于 running 会话')
-        const resumed = await resumeAndFollowup(to, message, inspected)
-        usedMode = 'followup'
-        targetRuntimeStatus = resumed.status
+      const rollbackPairSend = reservePairSend(me.id, to)
+      try {
+        if (target !== undefined) {
+          if (mode === 'followup') { target.followup(message); usedMode = mode }
+          else if (mode === 'inject') { target.inject(message); usedMode = 'inject' }
+          else { target.steer(message); usedMode = 'steer' }
+          targetRuntimeStatus = target.status
+        } else {
+          const resumed = await resumeAndFollowup(to, message, inspected)
+          usedMode = 'followup'
+          targetRuntimeStatus = resumed.status
+        }
+      } catch (error) {
+        rollbackPairSend()
+        throw error
       }
 
       rememberSent(message.id, String(to), usedMode)
@@ -324,7 +391,8 @@ export function apply(ctx) {
         return [{ type: 'text', text: JSON.stringify(value, null, 2) }]
       },
     },
-    async execute(args) {
+    async execute(args, exec) {
+      assertPeerCaller(exec?.agent)
       const target = agents.get(args.to)
       const targetRuntimeStatus = target !== undefined ? target.status : 'offline'
       if (args.messageId !== undefined) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-agent-message",
-  "version": "1.5.0",
+  "version": "1.5.1",
   "packageManager": "pnpm@11.1.1",
   "description": "跨会话 Agent 通信：让 DeepSeek Harness 里不同的 Agent 会话互相收发消息。",
   "keywords": ["deepseek", "deepseek-harness", "agent", "multi-agent", "messaging"],