dsh-decision-layer 0.7.1 → 0.7.2

package/README.en.md

@@ -4,7 +4,7 @@
 
 `dsh-decision-layer` adds structured, explicitly scoped decisions to the DeepSeek Harness (DSH) agent loop, backed by a pluggable adjudication backend. Dangerous-call gating, output self-check, tool narrowing, and loop prevention hook into the agent loop as automatic interventions.
 
-> **0.7.1 is a preview release.** The plugin works, but how much real value the adjudication interventions add is still being explored — every threshold is an unvalidated heuristic default. Treat it as something to observe, not a proven guarantee of impact. See [ROADMAP.md](<ROADMAP.md>) for scope and progress.
+> **0.7.2 is a preview release.** The plugin works, but how much real value the adjudication interventions add is still being explored — every threshold is an unvalidated heuristic default. Treat it as something to observe, not a proven guarantee of impact. See [ROADMAP.md](<ROADMAP.md>) for scope and progress.
 
 ## Installation
 
@@ -22,13 +22,13 @@ Or from a GitHub Release: install directly from the version's tgz asset URL.
 dsh plugin --profile web add https://github.com/xbzbing/dsh-decision-layer/releases/download/v<version>/dsh-decision-layer-<version>.tgz
 ```
 
-> The repository no longer commits the built `lib/client.js` ([ADR-0012](<docs/adr/0012-distribution-via-github-actions.md>)), so installing `github:xbzbing/dsh-decision-layer` without a ref does **not** work — that tree has no `lib/`, and while the host half still loads, the panel never appears. Use the Release tarball on the GitHub side.
+> The repository does not commit build output (`lib/`) ([ADR-0012](<docs/adr/0012-distribution-via-github-actions.md>)), so installing `github:xbzbing/dsh-decision-layer` without a ref does **not** work — that tree has neither `lib/host/` nor `lib/client.js`, so the plugin cannot load. Use the Release tarball on the GitHub side.
 
 Or build locally and install the `file:` path:
 
 ```sh
 npm ci --ignore-scripts
-npm run build:client
+npm run build
 dsh plugin --profile web add file:/absolute/path/dsh-decision-layer
 ```
 
@@ -37,9 +37,9 @@ Restart `dsh web` and refresh after installing or updating: the host and client
 ## Features
 
 - **Manual verdicts** — `decision_evaluate` and the `decision-layer` skill submit `noul` / `score` / `choice` questions; `decision_check_connection` tests connectivity. Manual calls do not count as automatic decisions and do not change agent behavior.
-- **Dangerous-call gate** — before a destructive tool call, a redacted summary asks the backend for a verdict; only a high-confidence deny blocks the call. Allow, ask, low confidence, backend failure, and invalid responses do not intervene and run the host's original path. Rules and the block confidence floor are configurable.
-- **Output self-check and quality trend** — scores the final reply at turn end (0–2), observe-only by default; an opt-in low-score re-prompt fires at most once per turn. Several consecutive high-confidence low scores tint the dock trigger grey → amber → red as a reminder.
-- **Tool narrowing** — at turn start, drops optional tools by task relevance, intersecting the host-allowed set and never expanding it; core tools and keep-prefix matches are always kept, over-cap falls back to observe-only, too-few-kept is treated as untrustworthy and skipped, and small-context backends are batched automatically. Enforced by default; observe-only is available.
+- **Dangerous-call gate** — before a destructive tool call, a redacted summary asks the backend for a verdict; only a high-confidence deny blocks the call. Allow, ask, low confidence, backend failure, and invalid responses do not intervene and run the host's original path. Rules and the block confidence floor are configurable. Gate rows carry the redacted command/path plus this turn's task excerpt, so a block can be reviewed in context.
+- **Output self-check and quality trend** — scores the final reply at turn end (0–2), observe-only by default; an opt-in low-score re-prompt fires at most once per turn. Several consecutive high-confidence low scores tint the dock trigger grey → amber → red as a reminder. Self-check rows carry the turn number and the same task excerpt, so you can tell which turn was scored.
+- **Tool narrowing** — at turn start, drops optional tools by task relevance, intersecting the host-allowed set and never expanding it; core tools and keep-prefix matches are always kept, over-cap falls back to observe-only, too-few-kept is treated as untrustworthy and skipped, and small-context backends are batched automatically. Enforced by default; observe-only is available. Narrowing logs include the turn number and an expandable task excerpt, so you can assess the dropped tools against the task; older logs are not backfilled.
 - **Task-completion review** — when the user spells out multiple delivery conditions, each is judged satisfied / unsatisfied / insufficient evidence, with tool evidence primary. Observe-only by default, with an opt-in re-prompt.
 - **Loop guard** — denies the same call repeated consecutively past a threshold; deterministic, local, and backend-free. The per-feature switches do not affect it, but the session master switch pauses it too.
 - **Session panel and decision-analysis view** — the panel shows automatic-decision metrics, the session master switch, and the recent log; the "Decision analysis" tab shows a per-session process profile, trend backtest, and decision accuracy, with per-row ratings and a session intervention switch.
@@ -58,10 +58,10 @@ Once a key is configured, the plugin sends adjudication requests to the remote e
 
 User-message text may include context the host injects, such as workspace instructions (AGENTS.md), runtime details, and memory snippets. This content leaves your machine, and the remote provider may log, retain, or otherwise use it depending on its terms; redaction and truncation reduce risk but are not anonymization.
 
-Two kinds of data are also stored locally for 30 days: decision logs in `~/.config/dsh-decision-layer/logs/` and session snapshots in `~/.config/dsh-decision-layer/state/`. They include redacted command/path summaries and short request subjects; delete them yourself if needed.
+Two kinds of data are also stored locally for 30 days: decision logs in `~/.config/dsh-decision-layer/logs/` and session snapshots in `~/.config/dsh-decision-layer/state/`. They include redacted command/path summaries; the gate, self-check and narrowing rows carry a task excerpt (up to 512 characters, with injected memory/system-reminder blocks removed and common credential forms masked), the self-check and narrowing rows also carry the turn number, and completion rows hold only counts. The excerpts are written to the local logs/snapshots and shown in the local session panel and decision-analysis view only — outbound adjudication content is the list above; delete them yourself if needed.
 
 **If your session content is sensitive, prefer a locally deployed model** so adjudication data never leaves the machine. `tev1` is served natively by ollama at `/v1/systemone`; see [Running with a local tev1](<docs/en/deploy-tev1-with-plugin.md>). Any other local model works as long as it exposes a compatible `/v1/systemone` endpoint, pointed to from the config page.
 
 ## Safety boundary and development
 
-Automatic intervention only subtracts: the gate only denies, narrowing only removes tools, and neither grants new permissions. The gate only blocks on a high-confidence deny; on backend failure, low confidence, or an invalid response it does not intervene and runs the host's original path. Self-check, narrowing, and loop-guard errors skip intervention. The redacted gate summary sent to the backend carries only tool name and command/path with secret redaction; the plugin never reads file content, but the command itself (for example a heredoc or text written with echo) is included as-is. Node.js `>=20.11`; `npm test` runs the tests, `npm run build:client` builds `lib/client.js` (this is also where strict `tsc` runs), and `npm run check` runs both. **Build output is not committed** ([ADR-0012](<docs/adr/0012-distribution-via-github-actions.md>)): `lib/` is gitignored and the source is the only source of truth. Releases run through `.github/workflows/release.yml`, which builds, gates, `npm pack`s and then asserts with `scripts/assert-pack.mjs` that the tarball really carries `lib/client.js` and leaks no sources — only then does it publish to npm or open a Release. It runs when a version bump lands on main and publishes through npm Trusted Publishing (OIDC), so no long-lived token is involved. Architecture decisions live in [docs/adr/](<docs/adr/README.md>): why each rule exists and what was rejected. 0.7.1 is a preview: the interventions work, but their real value and thresholds are still being explored — feedback on misjudgments and feel observed in the decision log is welcome.
+Automatic intervention only subtracts: the gate only denies, narrowing only removes tools, and neither grants new permissions. The gate only blocks on a high-confidence deny; on backend failure, low confidence, or an invalid response it does not intervene and runs the host's original path. Self-check, narrowing, and loop-guard errors skip intervention. The redacted gate summary sent to the backend carries only tool name and command/path with secret redaction; the plugin never reads file content, but the command itself (for example a heredoc or text written with echo) is included as-is. Both halves are TypeScript under strict mode: `npm run build` type-checks with `tsc` and emits `lib/host/*.js` plus `lib/client.js` ([ADR-0015](<docs/adr/0015-typed-host-build.md>)); `npm test` builds first and then runs the tests, and `npm run check` matches CI (build, tests, and the packed-tarball check). Node.js `>=20.11` at runtime. **Build output is not committed** ([ADR-0012](<docs/adr/0012-distribution-via-github-actions.md>)): `lib/` is gitignored and the source is the only source of truth. Releases run through `.github/workflows/release.yml`, which builds, gates, `npm pack`s and then asserts with `scripts/assert-pack.mjs` that the tarball really carries the host entry and `lib/client.js`, and leaks no sources — only then does it publish to npm or open a Release. It runs when a version bump lands on main and publishes through npm Trusted Publishing (OIDC), so no long-lived token is involved. Architecture decisions live in [docs/adr/](<docs/adr/README.md>): why each rule exists and what was rejected. 0.7.2 is a preview: the interventions work, but their real value and thresholds are still being explored — feedback on misjudgments and feel observed in the decision log is welcome.

package/README.md

@@ -4,7 +4,7 @@
 
 DeepSeek Harness（DSH）的结构化裁决插件。它把有明确判断标准的问题交给同协议的裁决后端，供 agent 在需要时使用，并在 agent loop 上接入危险门控、产出自检、工具收窄和防循环等自动介入。
 
-> **0.7.1 是体验版。** 插件功能已可用，但裁决介入能带来多少实际价值仍在探索中——各决策点的阈值都是未经验证的启发式默认值，建议先以观察心态体验，别当成经过验证的效果保证。功能与后续进度以 [ROADMAP.md](<ROADMAP.md>) 为准。
+> **0.7.2 是体验版。** 插件功能已可用，但裁决介入能带来多少实际价值仍在探索中——各决策点的阈值都是未经验证的启发式默认值，建议先以观察心态体验，别当成经过验证的效果保证。功能与后续进度以 [ROADMAP.md](<ROADMAP.md>) 为准。
 
 ## 安装
 
@@ -22,13 +22,13 @@ dsh plugin --profile web add dsh-decision-layer@latest
 dsh plugin --profile web add https://github.com/xbzbing/dsh-decision-layer/releases/download/v<版本>/dsh-decision-layer-<版本>.tgz
 ```
 
-> 仓库不再提交构建产物 `lib/client.js`（[ADR-0012](<docs/adr/0012-distribution-via-github-actions.md>)），因此**不带 ref 的 `github:xbzbing/dsh-decision-layer` 安装不可用**——那样拿到的是没有 `lib/` 的源码树，host 半仍能加载，但面板不会出现。GitHub 侧请用上面的 Release 附件。
+> 仓库不再提交构建产物 `lib/`（[ADR-0012](<docs/adr/0012-distribution-via-github-actions.md>)），因此**不带 ref 的 `github:xbzbing/dsh-decision-layer` 安装不可用**——那样拿到的是没有 `lib/host/` 与 `lib/client.js` 的源码树，插件加载不了。GitHub 侧请用上面的 Release 附件。
 
 也可从源码本地构建后用 `file:` 安装：
 
 ```sh
 npm ci --ignore-scripts
-npm run build:client
+npm run build
 dsh plugin --profile web add file:/绝对路径/dsh-decision-layer
 ```
 
@@ -37,9 +37,9 @@ dsh plugin --profile web add file:/绝对路径/dsh-decision-layer
 ## 功能
 
 - **手动裁决**：`decision_evaluate` 工具与 `decision-layer` skill 可显式提交 `noul` / `score` / `choice` 问题，`decision_check_connection` 做连通测试；手动调用不计入自动裁决指标，也不改变 agent 行为。
-- **危险门控**：破坏性工具调用执行前用脱敏摘要请后端裁决，只有高置信「拒绝」才拦截；放行、询问、低置信、后端失败或响应不合法一律不介入，按宿主原路径执行。危险规则与拦截置信度门槛可配。
-- **产出自检与质量趋势**：回合结束给最终回复打分（0–2），默认只记录；可开启低分补完，同一回合最多补一次。连续多次高置信低分时，dock 触发器图标会从灰变橙、变红作为提醒。
-- **工具收窄**：回合开始时按任务相关性摘掉可选工具，只在宿主已允许的集合内取交集、不扩权；核心工具与保留前缀命中的工具始终保留，可选工具过多时自动降为仅观察、保留过少时视为判定不可信并跳过，对小上下文后端自动分批。默认真正生效，也可切到仅观察。
+- **危险门控**：破坏性工具调用执行前用脱敏摘要请后端裁决，只有高置信「拒绝」才拦截；放行、询问、低置信、后端失败或响应不合法一律不介入，按宿主原路径执行。危险规则与拦截置信度门槛可配。门控日志带脱敏命令 / 路径与本轮任务节选，便于回看拦截是否合理。
+- **产出自检与质量趋势**：回合结束给最终回复打分（0–2），默认只记录；可开启低分补完，同一回合最多补一次。连续多次高置信低分时，dock 触发器图标会从灰变橙、变红作为提醒。自检日志带回合号与同一套任务节选，便于对照是哪一轮被打分。
+- **工具收窄**：回合开始时按任务相关性摘掉可选工具，只在宿主已允许的集合内取交集、不扩权；核心工具与保留前缀命中的工具始终保留，可选工具过多时自动降为仅观察、保留过少时视为判定不可信并跳过，对小上下文后端自动分批。默认真正生效，也可切到仅观察。收窄日志附带回合号和可展开的任务节选，便于对照被摘除的工具评估判断是否合理；旧日志不会补录场景。
 - **任务完成核对**：用户明确列出多个交付条件时，逐项判定「已满足 / 未满足 / 证据不足」，以工具证据为准；默认只观察，可配补完。
 - **防循环**：同一调用连续重复超过阈值即拒绝，确定性本地逻辑，不依赖后端；不受各决策点开关影响，但会话总开关关闭时同样暂停。
 - **会话面板与决策分析页**：面板展示自动裁决指标、会话总开关和最近日志；「决策分析」tab 按会话展示过程画像、趋势回测与判断准确度，并支持逐条标注和开关本会话的自动介入。
@@ -58,7 +58,7 @@ dsh plugin --profile web add file:/绝对路径/dsh-decision-layer
 
 user 消息的文本里可能含有宿主注入的上下文，例如工作区指令（AGENTS.md）、运行时信息和记忆片段。这些内容会离开本机，远程服务提供方可能记录、留存或用于其他用途，具体取决于其服务条款；脱敏和截断只降低风险，不等于匿名化。
 
-本地还会落盘两类数据，各保留 30 天：决策日志在 `~/.config/dsh-decision-layer/logs/`，会话快照在 `~/.config/dsh-decision-layer/state/`，其中包含脱敏后的命令 / 路径和请求主题摘要，可按需自行清理。
+本地还会落盘两类数据，各保留 30 天：决策日志在 `~/.config/dsh-decision-layer/logs/`，会话快照在 `~/.config/dsh-decision-layer/state/`，其中包含脱敏后的命令 / 路径；门控、自检与收窄带任务节选（最多 512 字符，过滤记忆 / 系统提醒注入块并遮蔽常见凭据写法），自检与收窄另带回合号，完成核对目前只有条件计数。任务节选只写入本地日志 / 快照并展示在本地会话面板和决策分析页，不随裁决请求外发（外发内容以上一节逐项列出为准），可按需自行清理。
 
 **会话内容敏感时，推荐改用本地部署的模型**，让裁决数据不出本机。`tev1` 可经 ollama 原生的 `/v1/systemone` 端点直接接入，部署步骤见 [用本地 tev1 配合插件（部署指南）](<docs/zh/deploy-tev1-with-plugin.md>)；其他本地模型只要提供兼容 `/v1/systemone` 的端点，同样可以在配置页把服务地址指向本机。
 
@@ -68,8 +68,8 @@ user 消息的文本里可能含有宿主注入的上下文，例如工作区指
 
 ## 开发
 
-服务端使用 Node.js `>=20.11`（`.mjs`，无需构建）；客户端用 TypeScript + esbuild 构建。`npm test` 跑本地测试，`npm run build:client` 生成 `lib/client.js`（`tsc` 严格模式就在这一步），`npm run check` 跑完两者。
+服务端与客户端都是 TypeScript（严格模式）：`npm run build` 用 `tsc` 检查类型、esbuild 产出 `lib/host/*.js` 与 `lib/client.js`（[ADR-0015](<docs/adr/0015-typed-host-build.md>)），`npm test` 先构建再跑本地测试，`npm run check` 与 CI 等价（构建 + 测试 + `npm pack` 断言）。运行期需要 Node.js `>=20.11`。
 
-**构建产物不入库**（[ADR-0012](<docs/adr/0012-distribution-via-github-actions.md>)）：`lib/` 已被 `.gitignore` 覆盖，源码是唯一事实来源。发布由 GitHub Actions 的 `release.yml` 完成——构建、跑门禁、`npm pack`，并用 `scripts/assert-pack.mjs` 断言产物里确实有 `lib/client.js` 且没有源码泄漏，之后才发 npm / 建 Release。该 workflow 在版本号变更推入 main 时自动执行；npm 侧使用 Trusted Publishing（OIDC），不依赖长期 token。
+**构建产物不入库**（[ADR-0012](<docs/adr/0012-distribution-via-github-actions.md>)）：`lib/` 已被 `.gitignore` 覆盖，源码是唯一事实来源。发布由 GitHub Actions 的 `release.yml` 完成——构建、跑门禁、`npm pack`，并用 `scripts/assert-pack.mjs` 断言产物里确实有 host 入口与 `lib/client.js`、且没有源码泄漏，之后才发 npm / 建 Release。该 workflow 在版本号变更推入 main 时自动执行；npm 侧使用 Trusted Publishing（OIDC），不依赖长期 token。
 
-架构决策记录见 [docs/adr/](<docs/adr/README.md>)：每条规则为什么存在、当时放弃了哪些备选。0.7.1 为体验版：介入能力已可用，但实际价值与阈值仍在探索，欢迎反馈决策日志观察到的误判与体感。
+架构决策记录见 [docs/adr/](<docs/adr/README.md>)：每条规则为什么存在、当时放弃了哪些备选。0.7.2 为体验版：介入能力已可用，但实际价值与阈值仍在探索，欢迎反馈决策日志观察到的误判与体感。

package/lib/client.js

@@ -1,8 +1,6 @@
-window.__ModuleLoader__.load({
-  id: 'dsh-decision-layer',
-  factory: (require) => {
-    var module = { exports: {} };
-    var exports = module.exports;
+window.__ModuleLoader__.load({ id: 'dsh-decision-layer', factory: (require) => {
+var module = { exports: {} }; var exports = module.exports;
+"use strict";
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
@@ -82,6 +80,8 @@ var zh = {
   logCheck: "\u81EA\u68C0",
   logNarrow: "\u6536\u7A84",
   logComplete: "\u5B8C\u6210\u6838\u5BF9",
+  logTurn: "\u56DE\u5408 {turn}",
+  logTask: "\u573A\u666F\uFF08\u4EFB\u52A1\u8282\u9009\uFF09\uFF1A",
   logSuggested: "\u6A21\u578B\u5EFA\u8BAE",
   logEvalFailed: "\u8BC4\u4F30\u5931\u8D25",
   logScore: "\u5F97\u5206",
@@ -91,7 +91,7 @@ var zh = {
   logPathLabel: "\u8DEF\u5F84\uFF1A",
   logSubjectLabel: "\u8BF7\u6C42\uFF1A",
   logScoreHint: "\u5F97\u5206\u4E3A\u5404\u6863\u4F4D\u6309\u6982\u7387\u52A0\u6743\u7684\u7ED3\u679C\uFF0C\u53EF\u80FD\u662F\u5C0F\u6570\uFF08\u5982 1.4\uFF09\uFF0C\u6EE1\u5206\u4E3A\u9876\u6863\u53F7 2\u3002",
-  logCheckHint: "\u6BCF\u56DE\u5408\u7ED3\u675F\u540E\uFF0C\u628A\u8FD9\u8F6E AI \u7684\u6700\u7EC8\u56DE\u590D\u4EA4\u7ED9\u88C1\u51B3\u6A21\u578B\uFF0C\u6309\u300C\u4E25\u91CD\u9057\u6F0F/\u81EA\u76F8\u77DB\u76FE \u2192 \u6709\u5C0F\u9057\u6F0F \u2192 \u5B8C\u6574\u51C6\u786E\u300D\u4E09\u6863\u6253\u4E00\u4E2A 0\u20132 \u7684\u8D28\u91CF\u5206\uFF0C\u7528\u6765\u53D1\u73B0\u9057\u6F0F\u6216\u77DB\u76FE\u3002",
+  logCheckHint: "\u6BCF\u56DE\u5408\u7ED3\u675F\u540E\uFF0C\u628A\u8FD9\u8F6E AI \u7684\u6700\u7EC8\u56DE\u590D\u4EA4\u7ED9\u88C1\u51B3\u6A21\u578B\uFF0C\u6309\u300C\u4E25\u91CD\u9057\u6F0F/\u81EA\u76F8\u77DB\u76FE \u2192 \u6709\u5C0F\u9057\u6F0F \u2192 \u5B8C\u6574\u51C6\u786E\u300D\u4E09\u6863\u6253\u4E00\u4E2A 0\u20132 \u7684\u8D28\u91CF\u5206\uFF0C\u7528\u6765\u53D1\u73B0\u9057\u6F0F\u6216\u77DB\u76FE\uFF1B\u81EA\u68C0\u884C\uFF08\u542B\u540E\u7AEF\u5931\u8D25\u884C\uFF09\u4F1A\u5E26\u672C\u56DE\u5408\u7684\u4EFB\u52A1\u8282\u9009\uFF08\u6700\u591A 512 \u5B57\uFF0C\u5DF2\u906E\u853D\u51ED\u636E\uFF09\u3002",
   logNarrowHint: "\u6BCF\u56DE\u5408\u5F00\u59CB\u65F6\uFF0C\u628A\u8FD9\u8F6E\u4EFB\u52A1\u4E0E\u5F53\u524D\u53EF\u7528\u5DE5\u5177\u9010\u4E2A\u4EA4\u7ED9\u88C1\u51B3\u6A21\u578B\u5224\u65AD\u76F8\u5173\u6027\uFF08noul\uFF09\uFF0C\u6458\u6389\u660E\u663E\u7528\u4E0D\u4E0A\u7684\u5DE5\u5177\uFF0C\u53EA\u5728\u5F53\u524D\u5BBF\u4E3B\u5DF2\u5141\u8BB8\u7684\u96C6\u5408\u5185\u53D6\u4EA4\u96C6\u3001\u7EDD\u4E0D\u6269\u6743\uFF1B\u300C\u4EC5\u89C2\u5BDF\u300D\u53EA\u8BB0\u5F55\u5EFA\u8BAE\uFF0C\u300C\u5DF2\u751F\u6548\u300D\u624D\u771F\u6B63\u5BF9\u672C\u56DE\u5408\u9650\u5236\u5DE5\u5177\u3002",
   actionDeny: "\u5DF2\u62D2\u7EDD",
   actionAsk: "\u8F6C\u4EA4\u5BA1\u6279",
@@ -277,6 +277,8 @@ var en = {
   logCheck: "Self-check",
   logNarrow: "Narrow",
   logComplete: "Completion",
+  logTurn: "Turn {turn}",
+  logTask: "Context (task excerpt): ",
   logSuggested: "model suggested",
   logEvalFailed: "evaluation failed",
   logScore: "score",
@@ -286,7 +288,7 @@ var en = {
   logPathLabel: "path: ",
   logSubjectLabel: "request: ",
   logScoreHint: "The score is a probability-weighted mean across the levels, so it can be fractional (e.g. 1.4); the top score is the highest level number, 2.",
-  logCheckHint: "After each turn, the AI\u2019s final reply for that turn is sent to the adjudication model, which grades its quality on three levels (severe omission/contradiction \u2192 minor gaps \u2192 complete and accurate) as a 0\u20132 score, to catch omissions or contradictions.",
+  logCheckHint: "After each turn, the AI\u2019s final reply for that turn is sent to the adjudication model, which grades its quality on three levels (severe omission/contradiction \u2192 minor gaps \u2192 complete and accurate) as a 0\u20132 score, to catch omissions or contradictions; every self-check row (including a failed one) carries this turn\u2019s task excerpt (up to 512 characters, credentials masked).",
   logNarrowHint: "At the start of each turn, the current task and each available tool are sent to the adjudication model (a noul per tool) to judge relevance, dropping tools clearly not needed. It only intersects the host-allowed set and never expands it; observe merely logs the suggestion, enforced actually restricts the tools for this turn.",
   actionDeny: "denied",
   actionAsk: "sent to approval",
@@ -474,6 +476,12 @@ function gateArgs({ t }, entry) {
   const preview = value.length > 160 ? `${value.slice(0, 160)}\u2026` : value;
   return /* @__PURE__ */ (0, import_jsx_runtime.jsx)("code", { className: "decision-log-cmd", title: `${label}${value}`, children: preview });
 }
+function turnTag(t, entry) {
+  return typeof entry.turn === "number" ? /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("span", { className: "decision-log-detail", children: [
+    " \xB7 ",
+    t("logTurn", { turn: entry.turn })
+  ] }) : null;
+}
 function renderGate({ t }, entry) {
   const tool = /* @__PURE__ */ (0, import_jsx_runtime.jsx)("code", { className: "decision-log-tool", children: entry.tool ?? "\u2014" });
   const args = gateArgs({ t }, entry);
@@ -541,7 +549,10 @@ function renderGate({ t }, entry) {
   ] });
 }
 function renderCheck({ t }, entry) {
-  const label = /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { title: t("logCheckHint"), children: t("logCheck") });
+  const label = /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { title: t("logCheckHint"), children: t("logCheck") }),
+    turnTag(t, entry)
+  ] });
   const subject = entry.subject ? /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("span", { className: "decision-log-subject", title: `${t("logSubjectLabel")}${entry.subject}`, children: [
     "\u300C",
     entry.subject.length > 60 ? `${entry.subject.slice(0, 60)}\u2026` : entry.subject,
@@ -593,7 +604,10 @@ function renderCheck({ t }, entry) {
   ] });
 }
 function renderNarrow({ t }, entry) {
-  const label = /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { title: t("logNarrowHint"), children: t("logNarrow") });
+  const label = /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { title: t("logNarrowHint"), children: t("logNarrow") }),
+    turnTag(t, entry)
+  ] });
   if (entry.outcome === "error") return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
     label,
     " ",
@@ -721,7 +735,16 @@ function DecisionLogList({ entries, ratings, onRate, t, newestFirst = true }) {
   const rows = newestFirst ? entries.slice().reverse() : entries.slice();
   return /* @__PURE__ */ (0, import_jsx_runtime.jsx)("ol", { className: "decision-log", children: rows.map((entry, index) => /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("li", { className: `decision-log-item decision-log-${outcomeTagOf(entry)}`, children: [
     /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "decision-log-time", children: time(entry.at) }),
-    /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { className: "decision-log-body", children: renderBody({ t }, entry) }),
+    /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { className: "decision-log-body", children: [
+      renderBody({ t }, entry),
+      entry.task ? /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("details", { className: "decision-log-context", children: [
+        /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("summary", { children: [
+          t("logTask"),
+          entry.task.length > 60 ? `${entry.task.slice(0, 60)}\u2026` : entry.task
+        ] }),
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { children: entry.task })
+      ] }) : null
+    ] }),
     entry.id && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(RatingButtons, { id: entry.id, t, ratings, onRate })
   ] }, entry.id ?? `${entry.at}-${index}`)) });
 }
@@ -2112,6 +2135,10 @@ var css = `
 .decision-log-tool{font-size:.76rem;padding:.05rem .35rem;border-radius:5px;background:var(--dsw-alias-bg-layer-1,#f2f4f6);color:var(--dsw-alias-label-primary,#202124)}
 .decision-log-cmd{font-size:.74rem;padding:.05rem .35rem;border-radius:5px;background:var(--dsw-alias-bg-layer-1,#f2f4f6);color:var(--dsw-alias-label-secondary,#59636e);word-break:break-all}
 .decision-log-subject{font-size:.74rem;color:var(--dsw-alias-label-secondary,#59636e);font-style:italic}
+.decision-log-context{margin-top:.25rem;font-size:.74rem;color:var(--dsw-alias-label-secondary);overflow-wrap:anywhere}
+.decision-log-context summary{cursor:pointer}
+.decision-log-context summary:focus-visible{outline:2px solid var(--dsw-alias-label-secondary);outline-offset:2px}
+.decision-log-context p{margin:.25rem 0 0}
 .decision-log-verdict{font-weight:600}
 .decision-log-deny .decision-log-verdict{color:#c0392b}
 .decision-log-ok .decision-log-verdict{color:#1f8a70}
@@ -2297,7 +2324,5 @@ function apply(ctx) {
     (props) => props.view === "summary" ? props.t("summary") : /* @__PURE__ */ (0, import_jsx_runtime6.jsx)(ConfigForm, { t: props.t })
   ));
 }
-
-    return module.exports;
-  }
-});
+return module.exports;
+} });

package/lib/host/backend.d.ts

@@ -0,0 +1,15 @@
+import type { BackendConfig, EvaluateInput, EvaluateResult } from './types.js';
+export type BackendError = Error & {
+    reason: string;
+};
+export declare function validateRequest(input: unknown): EvaluateInput;
+export declare function createBackend({ config, fetcher, timeoutMs, retryDelayMs }: {
+    config: () => Promise<BackendConfig>;
+    fetcher?: typeof fetch;
+    timeoutMs?: number;
+    retryDelayMs?: number;
+}): {
+    evaluate(input: EvaluateInput, { signal }?: {
+        signal?: AbortSignal;
+    }): Promise<EvaluateResult>;
+};

package/lib/host/backend.js

@@ -0,0 +1,149 @@
+import { setTimeout as wait } from "node:timers/promises";
+import { DEFAULT_MODEL } from "./config-store.js";
+import { isObject, isProbability } from "./types.js";
+const REQUEST_LIMIT = 256 * 1024;
+const RESPONSE_LIMIT = 1024 * 1024;
+const isContent = (value) => typeof value === "string" ? value.trim().length > 0 : isObject(value) || Array.isArray(value);
+function backendError(reason, message) {
+  const error = new Error(message);
+  error.reason = reason;
+  return error;
+}
+function validateRequest(input) {
+  if (!isObject(input) || !isContent(input.state) || !isObject(input.questions)) throw new Error("Invalid state or questions");
+  const questions = Object.entries(input.questions);
+  if (questions.length < 1 || questions.length > 64) throw new Error("Invalid question count");
+  for (const [id, question] of questions) {
+    if (!id.trim() || id.length > 160 || !isObject(question) || !isContent(question.instructions)) throw new Error("Invalid question");
+    if (question.type === "choice") {
+      const criteria = question.criteria;
+      if (!isObject(criteria) || Object.keys(criteria).length < 2 || Object.keys(criteria).length > 255 || Object.entries(criteria).some(([key, value]) => !key.trim() || value !== null && !isContent(value))) throw new Error("Invalid choice criteria");
+    } else if (question.type === "score") {
+      const criteria = question.criteria;
+      if (!Array.isArray(criteria) || criteria.length < 2 || criteria.length > 10 || !criteria.every(isContent)) throw new Error("Invalid score criteria");
+    } else if (question.type !== "noul" || question.criteria !== void 0 && (!isObject(question.criteria) || Object.keys(question.criteria).some((key) => !["true", "false"].includes(key)))) {
+      throw new Error("Invalid question type or criteria");
+    }
+  }
+  let encoded;
+  try {
+    encoded = JSON.stringify(input, (_key, value) => {
+      if (typeof value === "function" || typeof value === "symbol" || typeof value === "bigint" || typeof value === "number" && !Number.isFinite(value)) throw new Error("Invalid JSON");
+      return value;
+    });
+  } catch {
+    throw new Error("Invalid JSON payload");
+  }
+  if (Buffer.byteLength(encoded) > REQUEST_LIMIT) throw new Error("Request too large");
+  return { state: input.state, questions: input.questions };
+}
+function validateAnswer(value, question) {
+  if (!isObject(value) || value.type !== question.type) throw backendError("invalid-response", "Invalid response answer");
+  if (question.type === "noul") {
+    if (!isProbability(value.noul)) throw backendError("invalid-response", "Invalid response probability");
+    return { type: "noul", noul: value.noul };
+  }
+  const keys = question.type === "choice" ? Object.keys(question.criteria) : question.criteria.map((_, i) => String(i));
+  const probabilities = value.probabilities;
+  if (!isObject(probabilities) || !isProbability(value.confidence) || Object.keys(probabilities).length !== keys.length || keys.some((key) => !isProbability(probabilities[key])) || Math.abs(keys.reduce((sum, key) => sum + Number(probabilities[key]), 0) - 1) > 0.02) throw backendError("invalid-response", "Invalid response probabilities");
+  const common = {
+    confidence: value.confidence,
+    probabilities: Object.fromEntries(keys.map((key) => [key, probabilities[key]]))
+  };
+  if (question.type === "choice") {
+    if (typeof value.choice !== "string" || !keys.includes(value.choice)) throw backendError("invalid-response", "Invalid response choice");
+    return { type: "choice", ...common, choice: value.choice };
+  }
+  if (typeof value.score !== "number" || !Number.isFinite(value.score) || value.score < 0 || value.score > keys.length - 1) throw backendError("invalid-response", "Invalid response score");
+  return { type: "score", ...common, score: value.score };
+}
+function validateResponse(value, questions) {
+  if (!isObject(value) || !isObject(value.answers) || typeof value.model !== "string") throw backendError("invalid-response", "Invalid response");
+  const raw = value.answers;
+  const answers = /* @__PURE__ */ Object.create(null);
+  for (const [id, question] of Object.entries(questions)) answers[id] = validateAnswer(raw[id], question);
+  const usage = value.usage;
+  return { model: value.model, answers, usage: isObject(usage) ? {
+    input_tokens: Number.isSafeInteger(usage.input_tokens) ? usage.input_tokens : 0,
+    output_tokens: Number.isSafeInteger(usage.output_tokens) ? usage.output_tokens : 0
+  } : void 0 };
+}
+async function boundedJson(response) {
+  const reader = response.body?.getReader();
+  if (!reader) throw backendError("invalid-response", "Invalid response body");
+  const chunks = [];
+  let size = 0;
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      size += value.byteLength;
+      if (size > RESPONSE_LIMIT) throw backendError("invalid-response", "Invalid response size");
+      chunks.push(value);
+    }
+  } finally {
+    await reader.cancel().catch(() => {
+    });
+  }
+  try {
+    return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+  } catch {
+    throw backendError("invalid-response", "Invalid response JSON");
+  }
+}
+function createBackend({ config, fetcher = globalThis.fetch, timeoutMs = 2e4, retryDelayMs = 200 }) {
+  if (typeof config !== "function" || typeof fetcher !== "function" || !Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || !Number.isSafeInteger(retryDelayMs) || retryDelayMs < 0 || retryDelayMs > 5e3) {
+    throw new Error("Invalid backend dependencies");
+  }
+  return {
+    async evaluate(input, { signal } = {}) {
+      const { state, questions } = validateRequest(input);
+      const settings = await config();
+      const key = settings.apiKey?.trim();
+      if (!key || /[\r\n]/.test(key)) throw backendError("config", "API key is required");
+      let url;
+      try {
+        url = new URL(settings.url);
+      } catch {
+        throw backendError("config", "Invalid backend URL");
+      }
+      if (!["https:", "http:"].includes(url.protocol) || url.username || url.password || url.search || url.hash) throw backendError("config", "Invalid backend URL");
+      if (url.protocol === "http:" && settings.httpApprovedUrl !== settings.url) throw backendError("config", "HTTP URL requires confirmation");
+      const model = settings.model || DEFAULT_MODEL;
+      if (typeof model !== "string" || !model.trim() || /[\r\n]/.test(model)) throw backendError("config", "Invalid model");
+      const endpoint = new URL(url.href);
+      endpoint.pathname = `${url.pathname.replace(/\/+$/, "")}/v1/systemone`;
+      if (endpoint.origin !== url.origin) throw backendError("config", "Invalid backend endpoint");
+      const timeout = AbortSignal.timeout(timeoutMs);
+      const combined = signal ? AbortSignal.any([signal, timeout]) : timeout;
+      for (let attempt = 0; attempt < 3; attempt++) {
+        let reply;
+        try {
+          reply = await fetcher(endpoint.href, {
+            method: "POST",
+            redirect: "error",
+            signal: combined,
+            headers: { authorization: `Bearer ${key}`, "content-type": "application/json" },
+            body: JSON.stringify({ state, questions, model })
+          });
+        } catch {
+          throw backendError("unreachable", "Backend request failed or timed out");
+        }
+        if (reply.ok) return validateResponse(await boundedJson(reply), questions);
+        await reply.body?.cancel().catch(() => {
+        });
+        if (![429, 529].includes(reply.status) || attempt === 2) throw backendError("http-error", `Backend HTTP ${reply.status}`);
+        try {
+          await wait(retryDelayMs * (attempt + 1), void 0, { signal: combined });
+        } catch {
+          throw backendError("unreachable", "Backend request failed or timed out");
+        }
+      }
+      throw backendError("http-error", "Backend retries exhausted");
+    }
+  };
+}
+export {
+  createBackend,
+  validateRequest
+};

package/lib/host/config-store.d.ts

@@ -0,0 +1,12 @@
+import type { ConfigView, FeatureKey, Features, ResolvedConfig } from './types.js';
+export declare const DEFAULT_URL = "https://api.typesafe.ai";
+export declare const DEFAULT_MODEL = "jev-latest";
+export declare function configPath(env?: Record<string, string | undefined>): string;
+export declare const FEATURE_KEYS: readonly FeatureKey[];
+export declare function featureEnabled(features: Features | undefined, key: FeatureKey): boolean;
+export declare function loadConfig(path?: string): Promise<ConfigView>;
+export declare function resolveConfig({ path, env }?: {
+    path?: string;
+    env?: Record<string, string | undefined>;
+}): Promise<ResolvedConfig>;
+export declare function saveConfig(input: Record<string, unknown>, path?: string): Promise<ConfigView>;