dsh-decision-layer 0.7.1 → 0.7.3

package/service/loop-guard.mjs

@@ -1,51 +0,0 @@
-import { createHash } from 'node:crypto';
-
-const MAX_FINGERPRINT_INPUT = 16 * 1024;
-
-export function fingerprintCall(exec) {
-  const name = typeof exec?.name === 'string' ? exec.name : '';
-  let args = '';
-  try { args = JSON.stringify(exec?.arguments ?? null); } catch { args = ''; }
-  return createHash('sha256').update(name).update('\0').update(args.slice(0, MAX_FINGERPRINT_INPUT)).digest('hex');
-}
-
-// Deterministic, backend-free loop guard: it denies only a run of the SAME tool
-// call repeated consecutively past a threshold. Any different intervening call
-// resets the run, so a legitimate identical call reached again later is allowed.
-export function createLoopGuard({ threshold = 3, maxSessions = 1024, sessions } = {}) {
-  if (!Number.isSafeInteger(threshold) || threshold < 2) throw new Error('Invalid loop threshold');
-  const runs = new Map();
-  const runFor = id => {
-    let run = runs.get(id);
-    if (!run) {
-      if (runs.size >= maxSessions) runs.delete(runs.keys().next().value);
-      run = { key: undefined, count: 0 };
-      runs.set(id, run);
-    }
-    return run;
-  };
-  return {
-    check(exec) {
-      const id = exec?.agent?.session?.id;
-      if (typeof id !== 'string') return undefined;
-      // The master switch pauses automatic intervention (mirrors the danger gate):
-      // a deliberate user toggle skips the loop guard too.
-      if (sessions) {
-        try {
-          if (sessions.snapshot(id).enabled === false) return undefined;
-        } catch { /* fall through and guard */ }
-      }
-      const run = runFor(id);
-      const key = fingerprintCall(exec);
-      run.count = key === run.key ? run.count + 1 : 1;
-      run.key = key;
-      if (run.count >= threshold) {
-        return `Identical tool call repeated ${run.count} times in a row; blocked to break a loop`;
-      }
-      return undefined;
-    },
-    runLength(id) {
-      return runs.get(id)?.count ?? 0;
-    },
-  };
-}

package/service/manager-api.mjs

@@ -1,137 +0,0 @@
-import { loadConfig, resolveConfig, saveConfig } from './config-store.mjs';
-
-export const API_PREFIX = '/plugins/dsh-decision-layer/api';
-const BODY_LIMIT = 32 * 1024;
-
-function respond(res, status, value) {
-  res.writeHead(status, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store',
-    'x-content-type-options': 'nosniff', 'referrer-policy': 'no-referrer' });
-  res.end(JSON.stringify(value));
-}
-
-function authorizedBrowser(req) {
-  const address = req.socket?.remoteAddress;
-  if (!['127.0.0.1', '::1', '::ffff:127.0.0.1'].includes(address)) return false;
-  const host = req.headers.host;
-  if (typeof host !== 'string' || !/^(localhost|127\.0\.0\.1|\[::1\]):\d+$/.test(host)) return false;
-  if (req.headers['sec-fetch-site'] === 'cross-site') return false;
-  const origin = req.headers.origin;
-  if (origin === undefined) return req.method === 'GET';
-  try {
-    const parsed = new URL(origin);
-    return ['http:', 'https:'].includes(parsed.protocol) && parsed.host === host;
-  } catch { return false; }
-}
-
-async function readBody(req) {
-  if (!req.headers['content-type']?.startsWith('application/json')) throw new Error('Expected JSON');
-  let size = 0;
-  const chunks = [];
-  for await (const chunk of req) {
-    size += chunk.length;
-    if (size > BODY_LIMIT) throw new Error('Request too large');
-    chunks.push(chunk);
-  }
-  const value = JSON.parse(Buffer.concat(chunks).toString('utf8'));
-  if (value === null || typeof value !== 'object' || Array.isArray(value)) throw new Error('Expected object');
-  return value;
-}
-
-export function createManagerRoutes({ path, sessions, backend, logStore, analyze, listRows, env = process.env, bindHost = '127.0.0.1' }) {
-  const route = (suffix, methods) => ({ kind: 'exact', path: `${API_PREFIX}/${suffix}`, handler: async (req, res) => {
-    if (bindHost !== '127.0.0.1' || !authorizedBrowser(req)) return respond(res, 403, { ok: false, error: 'Local same-origin browser request required' });
-    if (!Object.hasOwn(methods, req.method)) return respond(res, 405, { ok: false, error: 'Method not allowed' });
-    try {
-      const value = await methods[req.method](req);
-      return respond(res, 200, { ok: true, value });
-    } catch (error) {
-      // A genuine internal fault (log analysis / annotation write) is a 500; a
-      // tagged or untagged validation/config error stays a client 400. Neither
-      // body carries error internals.
-      if (error?.code === 'INTERNAL') return respond(res, 500, { ok: false, error: 'Internal error' });
-      if (error?.code === 'BAD_REQUEST') return respond(res, 400, { ok: false, error: error.message });
-      return respond(res, 400, { ok: false, error: 'Invalid request or backend unavailable' });
-    }
-  } });
-  const sessionId = req => {
-    const id = new URL(req.url ?? '/', 'http://localhost').searchParams.get('sessionId');
-    if (!id) { const error = new Error('sessionId is required'); error.code = 'BAD_REQUEST'; throw error; }
-    return id;
-  };
-  return [
-    route('config', {
-      GET: async () => ({ ...(await loadConfig(path)), effectiveUrl: (await resolveConfig({ path, env })).url }),
-      PUT: async req => {
-        const saved = await saveConfig(await readBody(req), path);
-        return { ...saved, effectiveUrl: (await resolveConfig({ path, env })).url };
-      },
-    }),
-    route('probe', {
-      POST: async () => {
-        const effectiveUrl = (await resolveConfig({ path, env })).url;
-        try {
-          const result = await backend.evaluate({ state: 'Connection test', questions: {
-            connected: { type: 'noul', instructions: 'Is this a connection test?' },
-          } });
-          return { connected: true, model: result.model, usage: result.usage, effectiveUrl };
-        } catch { return { connected: false, reason: 'unavailable', effectiveUrl }; }
-      },
-    }),
-    route('metrics', { GET: async req => { const id = sessionId(req); await sessions.ensureLoaded?.(id); return sessions.snapshot(id); } }),
-    route('log', { GET: async req => { const id = sessionId(req); await sessions.ensureLoaded?.(id); return { entries: sessions.snapshot(id).log ?? [] }; } }),
-    // Read-only analysis over the persisted decision logs for one session. Returns
-    // only aggregates and annotation counts — never raw log rows — so gate command
-    // / path fragments are not echoed back to the browser.
-    route('logs', {
-      GET: async req => {
-        if (typeof analyze !== 'function') { const error = new Error('analysis unavailable'); error.code = 'BAD_REQUEST'; throw error; }
-        const id = sessionId(req);
-        try { return await analyze(id); }
-        catch (error) { if (error?.code === 'BAD_REQUEST') throw error; const wrapped = new Error('analysis failed'); wrapped.code = 'INTERNAL'; throw wrapped; }
-      },
-    }),
-    // One newest-first page of this session's full persisted decision rows, for
-    // the analysis tab's paginated log. Rows carry the same panel fields as /log,
-    // including the gate's already-redacted and length-bounded command/path, so
-    // this exposes nothing the recent-rows route does not already.
-    route('logrows', {
-      GET: async req => {
-        if (typeof listRows !== 'function') { const error = new Error('log rows unavailable'); error.code = 'BAD_REQUEST'; throw error; }
-        const id = sessionId(req);
-        const params = new URL(req.url ?? '/', 'http://localhost').searchParams;
-        const page = Number.parseInt(params.get('page') ?? '1', 10);
-        const pageSize = Number.parseInt(params.get('pageSize') ?? '100', 10);
-        try { return await listRows(id, { page: Number.isNaN(page) ? 1 : page, pageSize: Number.isNaN(pageSize) ? 100 : pageSize }); }
-        catch (error) { if (error?.code === 'BAD_REQUEST') throw error; const wrapped = new Error('log rows failed'); wrapped.code = 'INTERNAL'; throw wrapped; }
-      },
-    }),
-    // Append one annotation event for a decision. Explicit user intent: validated
-    // and written immediately; a write failure surfaces as an error, not silence.
-    route('annotate', {
-      POST: async req => {
-        if (!logStore || typeof logStore.appendAnnotation !== 'function') { const error = new Error('annotation unavailable'); error.code = 'BAD_REQUEST'; throw error; }
-        const body = await readBody(req);
-        const target = typeof body.target === 'string' ? body.target.trim() : '';
-        const rating = body.rating;
-        const session = typeof body.sessionId === 'string' ? body.sessionId.trim() : '';
-        if (!target || target.length > 128 || !['good', 'bad', 'unsure'].includes(rating) || !session || session.length > 512) {
-          const error = new Error('Invalid annotation'); error.code = 'BAD_REQUEST'; throw error;
-        }
-        // A validated write that still fails is an internal fault (disk / IO), not
-        // bad input: surface it as 500 so the client does not read it as a 400.
-        try { await logStore.appendAnnotation({ kind: 'annotation', target, rating, sessionId: session }); }
-        catch { const error = new Error('annotation write failed'); error.code = 'INTERNAL'; throw error; }
-        return { ok: true, target, rating };
-      },
-    }),
-    route('session', {
-      GET: async req => { const id = sessionId(req); await sessions.ensureLoaded?.(id); return sessions.snapshot(id); },
-      PUT: async req => {
-        const body = await readBody(req);
-        await sessions.ensureLoaded?.(body.sessionId);
-        sessions.setEnabled(body.sessionId, body.enabled);
-        return sessions.snapshot(body.sessionId);
-      },
-    }),
-  ];
-}

package/service/narrowing.mjs

@@ -1,226 +0,0 @@
-const isObject = value => value !== null && typeof value === 'object' && !Array.isArray(value);
-const probability = value => typeof value === 'number' && Number.isFinite(value) && value >= 0 && value <= 1;
-
-// Whether a narrowing pass actually restricted the tool set. `applied` is the
-// authoritative field; a vetoed pass (low-keep, too many candidates) is never
-// applied, and rows logged before `applied` existed are read from their reason.
-export const narrowApplied = record => {
-  if (record?.applied === false) return false;
-  if (record?.reason === 'low-keep' || record?.reason === 'too-many-candidates') return false;
-  return record?.applied === true || record?.outcome === 'applied';
-};
-const MAX_STATE = 8 * 1024;
-// The adjudication backend hard-rejects a request carrying more than 64 questions
-// (backend.mjs validateRequest). One relevance question is sent per optional tool,
-// so the candidate cap can never exceed this — otherwise evaluate() throws locally
-// before any network call and the failure is mislabeled as a backend error.
-const MAX_QUESTIONS = 64;
-
-// Core tools an agent almost always needs. They are never judged for relevance
-// and never dropped, so narrowing cannot strip the agent's fundamental
-// capabilities. Beyond the filesystem/shell/search/todo basics, this includes
-// the DSH agent meta-abilities (ask the user, goals, skills, delivery, images,
-// background jobs, teammates, subagents): their relevance rarely shows in a
-// single turn's task text, so per-tool judging would keep pruning them.
-export const DEFAULT_CORE_TOOLS = Object.freeze([
-  'read', 'write', 'edit', 'bash', 'glob', 'grep', 'ls', 'todo_write',
-  'ask_user_question', 'create_goal', 'update_goal', 'get_goal', 'exit_plan_mode',
-  'skill', 'present', 'read_image', 'workflow',
-  'job_list', 'job_output', 'job_kill',
-  'spawn_teammate', 'interrupt_agent', 'list_agents', 'wait_agent', 'send_message',
-  'subagent', 'subagent_fork',
-]);
-
-// Tool-name prefixes that are always kept and never judged, on top of the core
-// tools. Memory/context tools like OpenViking are "keep resident, trigger on
-// demand": their relevance rarely shows in the literal task text, so per-tool
-// relevance judging would keep pruning them. Teamwork tools (`team_task_`) are
-// deliberately NOT in this list: they are ordinary task-board capabilities and
-// should be judged like any other optional tool. Users can override this list.
-export const DEFAULT_KEEP_PREFIXES = Object.freeze(['mcp__openviking']);
-
-// Intersect the host-allowed tool set with the model's relevance verdict. Only
-// removes tools; never adds. Any missing or invalid noul keeps the tool, and a
-// verdict that would strip everything is skipped so the agent is never disabled.
-// `keepBase` is the number of always-kept tools outside `allowed` (core tools and
-// keep-prefix matches); the never-strip-everything guard must count them, or
-// dropping every optional tool would be vetoed even though those tools remain.
-// Drop threshold: a tool is dropped only when its relevance probability is below
-// this value (noul < threshold). The default leans aggressive — only tools the
-// model rates as fairly relevant survive, so the surface stays small. A noul near
-// 0.5 means the model is unsure and is dropped under this default; lower the
-// threshold to keep such may-need tools.
-export const DEFAULT_NARROW_THRESHOLD = 0.7;
-export function narrowTools(allowed, result, { threshold = DEFAULT_NARROW_THRESHOLD, keepBase = 0 } = {}) {
-  const tools = Array.isArray(allowed) ? allowed.filter(name => typeof name === 'string') : [];
-  const answers = isObject(result?.answers) ? result.answers : undefined;
-  if (tools.length === 0 || !answers) return { applied: false, keep: [...tools], drop: [] };
-  const base = Number.isSafeInteger(keepBase) && keepBase > 0 ? keepBase : 0;
-
-  const keep = [];
-  const drop = [];
-  for (const name of tools) {
-    const answer = answers[name];
-    if (isObject(answer) && answer.type === 'noul' && probability(answer.noul) && answer.noul < threshold) drop.push(name);
-    else keep.push(name);
-  }
-  if (drop.length === 0 || keep.length + base === 0) return { applied: false, keep: [...tools], drop: [] };
-  return { applied: true, keep, drop };
-}
-
-// Build one Noul relevance question per candidate tool. The state carries the
-// current task; each question references the tool being judged. Noul answers
-// have no confidence field, so relevance is read straight from the probability.
-export function relevanceQuestions(state, tools) {
-  const task = typeof state === 'string' ? state.slice(0, MAX_STATE)
-    : isObject(state) ? state : '';
-  return {
-    state: task,
-    questions: Object.fromEntries(tools.map(tool => [tool.name, {
-      type: 'noul',
-      instructions: {
-        tool: { name: tool.name, description: typeof tool.description === 'string' ? tool.description.slice(0, 512) : '' },
-        question: '完成当前任务是否会用到 `tool` 描述的这个工具？',
-      },
-    }])),
-  };
-}
-
-// Orchestrates one relevance pass over the host-allowed tools. Pure of DSH
-// runtime types: the caller supplies the candidate tools and the task state,
-// and owns applying the restriction (only enforce mode should act on `drop`).
-// `settings` resolves { mode: 'observe' | 'enforce', threshold } live.
-//
-// Guardrails against over-narrowing a large tool surface:
-//   A. core tools are always kept and never judged (DEFAULT_CORE_TOOLS);
-//   B. when the judged (optional) candidate count exceeds `maxCandidates`,
-//      enforce is downgraded to observe so a large surface cannot be mass-pruned;
-//   C. if narrowing would leave fewer than `minKeep` tools total, the verdict is
-//      treated as untrustworthy and no restriction is applied.
-export function createNarrowing({ evaluate, sessions, settings, coreTools = DEFAULT_CORE_TOOLS,
-  keepPrefixes = DEFAULT_KEEP_PREFIXES, minCandidates = 2, maxCandidates = 20, minKeep = 5, splitConcurrency = 8 } = {}) {
-  if (typeof evaluate !== 'function') throw new Error('Narrowing requires an evaluator');
-  const core = new Set(Array.isArray(coreTools) ? coreTools.filter(name => typeof name === 'string') : []);
-  const defaultPrefixes = Array.isArray(keepPrefixes) ? keepPrefixes.filter(prefix => typeof prefix === 'string' && prefix) : [];
-  const concurrency = Number.isSafeInteger(splitConcurrency) && splitConcurrency >= 1 ? splitConcurrency : 8;
-  // Set once a 'single' (whole-batch) pass hits a context-overflow http-error:
-  // from then on 'auto' sends one request per tool. A large-context backend
-  // (Jev) never trips this and stays at one call; a small-context backend
-  // (tev1, ~2050-token prompt) self-corrects after the first failure.
-  let adaptiveSplit = false;
-  const resolveSettings = async () => {
-    let raw = {};
-    try { raw = (typeof settings === 'function' ? await settings() : settings) ?? {}; } catch { raw = {}; }
-    const mode = raw?.mode === 'observe' ? 'observe' : 'enforce';
-    const threshold = typeof raw?.threshold === 'number' && Number.isFinite(raw.threshold) && raw.threshold >= 0 && raw.threshold <= 1 ? raw.threshold : DEFAULT_NARROW_THRESHOLD;
-    const batchMode = raw?.batchMode === 'single' || raw?.batchMode === 'split' ? raw.batchMode : 'auto';
-    // An explicit array in settings (including empty) overrides the default set.
-    const prefixes = Array.isArray(raw?.keepPrefixes)
-      ? raw.keepPrefixes.filter(prefix => typeof prefix === 'string' && prefix)
-      : defaultPrefixes;
-    // A configured optional-candidate ceiling overrides the constructor default,
-    // clamped to the backend's per-request question limit so the judged set is
-    // never large enough to be rejected before it is sent.
-    const configuredCap = Number.isSafeInteger(raw?.maxCandidates) && raw.maxCandidates >= 1 ? raw.maxCandidates : maxCandidates;
-    const cap = Math.min(configuredCap, MAX_QUESTIONS);
-    return { mode, threshold, prefixes, cap, batchMode };
-  };
-  const record = (turn, outcome, detail = {}) => {
-    const id = turn?.agent?.session?.id;
-    if (!sessions || typeof id !== 'string') return;
-    try { if (typeof sessions.recordNarrow === 'function') sessions.recordNarrow(id, outcome, detail.dropped ?? 0, narrowApplied({ ...detail, outcome })); }
-    catch { /* telemetry is best effort */ }
-    if (typeof sessions.log !== 'function') return;
-    try { sessions.log(id, { kind: 'narrow', outcome, ...detail }); }
-    catch { /* logging is best effort */ }
-  };
-  // Send one relevance request per tool with bounded concurrency, then merge the
-  // per-tool answers into one result. Each request's prompt is only the task
-  // state plus a single question, so it cannot exceed a small-context backend's
-  // prompt limit. A tool whose request fails is omitted from the merged answers,
-  // which narrowTools treats as "keep" (best effort). Returns null only when
-  // every tool failed, so the caller can still report a backend error.
-  const evaluateSplit = async (state, tools, signal) => {
-    const answers = Object.create(null);
-    let anyOk = false;
-    for (let i = 0; i < tools.length; i += concurrency) {
-      const group = tools.slice(i, i + concurrency);
-      const settled = await Promise.all(group.map(async tool => {
-        try {
-          const reply = await evaluate(relevanceQuestions(state, [tool]), { signal });
-          const answer = reply?.answers?.[tool.name];
-          return isObject(answer) ? [tool.name, answer] : undefined;
-        } catch { return undefined; }
-      }));
-      for (const pair of settled) { if (pair) { answers[pair[0]] = pair[1]; anyOk = true; } }
-    }
-    return anyOk ? { model: 'split', answers } : null;
-  };
-  const skip = { evaluated: false, applied: false, keep: [], drop: [], mode: 'observe' };
-  return {
-    async review(turn) {
-      const tools = Array.isArray(turn?.tools) ? turn.tools.filter(tool => tool && typeof tool.name === 'string') : [];
-      const names = tools.map(tool => tool.name);
-      const { mode, threshold, prefixes, cap, batchMode } = await resolveSettings();
-      // A: core tools and keep-prefix matches are always kept and never sent to
-      // the model for judging (e.g. mcp__openviking memory tools stay resident).
-      const alwaysKeep = name => core.has(name) || prefixes.some(prefix => name.startsWith(prefix));
-      const keptNames = names.filter(alwaysKeep);
-      const optional = tools.filter(tool => !alwaysKeep(tool.name));
-      if (optional.length < minCandidates) return { ...skip, keep: names };
-      const hasState = typeof turn?.state === 'string' ? turn.state.trim().length > 0
-        : isObject(turn?.state) ? Object.keys(turn.state).length > 0 : false;
-      if (!hasState) return { ...skip, keep: names };
-      const id = turn?.agent?.session?.id;
-      if (sessions && typeof id === 'string') {
-        try { if (sessions.snapshot(id).enabled === false) return { ...skip, keep: names }; }
-        catch { return { ...skip, keep: names }; }
-      }
-      // B: a large optional surface must not be enforced — only observed. When
-      // over the cap we still evaluate a bounded subset (never more than the
-      // backend's question limit) so the pass is logged without throwing, but the
-      // result is observe-only and applies no restriction.
-      const overCap = optional.length > cap;
-      const effectiveMode = overCap ? 'observe' : mode;
-      const judged = overCap ? optional.slice(0, cap) : optional;
-      const judgedNames = judged.map(tool => tool.name);
-      // Choose per-request strategy by backend context capacity. 'split' (or an
-      // 'auto' pass that already fell back) sends one request per tool so no
-      // prompt exceeds a small-context limit. 'single'/'auto' first try one
-      // whole-batch request; under 'auto', a context-overflow http-error flips
-      // this instance to split from then on and retries the same tools split.
-      let result;
-      if (batchMode === 'split' || adaptiveSplit) {
-        result = await evaluateSplit(turn.state, judged, turn.signal);
-        if (!result) { record(turn, 'error', { reason: 'unreachable', mode: effectiveMode }); return { ...skip, keep: names, mode: effectiveMode }; }
-      } else {
-        try { result = await evaluate(relevanceQuestions(turn.state, judged), { signal: turn.signal }); }
-        catch (error) {
-          const reason = typeof error?.reason === 'string' ? error.reason : 'unreachable';
-          if (batchMode === 'auto' && reason === 'http-error') {
-            adaptiveSplit = true;
-            result = await evaluateSplit(turn.state, judged, turn.signal);
-            if (!result) { record(turn, 'error', { reason, mode: effectiveMode }); return { ...skip, keep: names, mode: effectiveMode }; }
-          } else {
-            record(turn, 'error', { reason, mode: effectiveMode });
-            return { ...skip, keep: names, mode: effectiveMode };
-          }
-        }
-      }
-      const narrowed = narrowTools(judgedNames, result, { threshold, keepBase: keptNames.length });
-      const keep = [...keptNames, ...narrowed.keep];
-      const drop = narrowed.drop;
-      // C: too few tools left over is a sign the verdict over-pruned; do not apply.
-      const trustworthy = keep.length >= minKeep;
-      const applied = narrowed.applied && trustworthy && !overCap && mode === 'enforce';
-      const dropped = drop.length;
-      const detail = { dropped, kept: keep.length, mode: effectiveMode, tools: drop, applied };
-      // The optional-candidate count (excludes core tools and keep-prefix matches),
-      // recorded so the "too many candidates" reason shows the number that tripped it.
-      if (overCap) { detail.reason = 'too-many-candidates'; detail.candidates = optional.length; }
-      else if (dropped > 0 && !trustworthy) detail.reason = 'low-keep';
-      record(turn, dropped > 0 ? 'applied' : 'ok', detail);
-      return { evaluated: true, applied, keep, drop, mode: effectiveMode, overCap, trustworthy };
-    },
-  };
-}

package/service/quality-trend.mjs

@@ -1,29 +0,0 @@
-// Pure helpers for the output-quality trend alarm. A run counts consecutive
-// high-confidence low self-check scores; the run length maps to a severity that
-// the trigger icon renders (normal → warn → severe). All thresholds are
-// unvalidated heuristics, tuned later on real decision logs.
-
-export const DEFAULT_TREND_MIN_CONFIDENCE = 0.6;
-export const DEFAULT_TREND_RUN = 3;
-export const DEFAULT_TREND_SEVERE_RUN = 5;
-
-// Advance the run over ONE evaluated self-check:
-//   - a good score (not low) resets the run to 0;
-//   - a high-confidence low score increments it;
-//   - a low-confidence low score is skipped (neither resets nor increments);
-//   - an unevaluated/absent verdict must not call this at all.
-// `sample` is { lowScore: boolean, confident: boolean }.
-export function advanceRun(run, sample) {
-  const current = Number.isSafeInteger(run) && run >= 0 ? run : 0;
-  if (!sample || sample.lowScore !== true) return 0;
-  if (sample.confident === true) return current + 1;
-  return current;
-}
-
-// Map a run length to a severity, given the warn/severe thresholds.
-export function severityOf(run, { trendRun = DEFAULT_TREND_RUN, trendSevereRun = DEFAULT_TREND_SEVERE_RUN } = {}) {
-  const value = Number.isSafeInteger(run) && run >= 0 ? run : 0;
-  if (value >= trendSevereRun) return 'severe';
-  if (value >= trendRun) return 'warn';
-  return 'normal';
-}

package/service/self-check.mjs

@@ -1,131 +0,0 @@
-import { createSteerOnce } from './steer-once.mjs';
-
-const MAX_OUTPUT = 24 * 1024;
-
-export const DEFAULT_RUBRIC = Object.freeze([
-  '明显答非所问，或存在严重遗漏 / 自相矛盾',
-  '基本答到问题，但有可察觉的遗漏或不严谨',
-  '完整、准确、无自相矛盾地回应了请求',
-]);
-
-const STEER_TEXT = '本回合自检得分偏低：请复核是否答到了用户的问题、有无遗漏或自相矛盾，并在需要时补完。';
-
-// A short, single-line hint of the request this self-check judged, so a human
-// reviewing the log knows WHICH turn's output was scored (not just "self-check").
-// Best-effort over an untrusted string: injected OpenViking memory context blocks
-// (which are not part of the user's actual request) are stripped first, then
-// whitespace collapses and the length is capped.
-function subjectOf(text) {
-  if (typeof text !== 'string') return undefined;
-  const cleaned = text
-    // Drop any complete injected memory blocks (there can be several, multi-line).
-    .replace(/<openviking-context\b[^>]*>[\s\S]*?<\/openviking-context>/gi, ' ')
-    // Drop a dangling, unclosed block (e.g. a truncated tail) through to the end.
-    .replace(/<openviking-context\b[\s\S]*$/i, ' ')
-    .replace(/\s+/g, ' ')
-    .trim();
-  return cleaned ? cleaned.slice(0, 120) : undefined;
-}
-
-function boundedRubric(rubric) {
-  if (!Array.isArray(rubric)) return DEFAULT_RUBRIC;
-  const levels = rubric.filter(item => typeof item === 'string' && item.trim() && item.length <= 256).slice(0, 10);
-  return levels.length >= 2 ? levels : DEFAULT_RUBRIC;
-}
-
-const isProbability = value => typeof value === 'number' && Number.isFinite(value) && value >= 0 && value <= 1;
-
-export function scoreQuestion(output, rubric = DEFAULT_RUBRIC) {
-  return {
-    state: { answer: String(output).slice(0, MAX_OUTPUT) },
-    questions: { quality: {
-      type: 'score',
-      instructions: '按下列从低到高的档位，评估这次最终产出对用户请求的完成质量。',
-      criteria: boundedRubric(rubric),
-    } },
-  };
-}
-
-// The confidence floor for interrupting the user with a supplemental prompt.
-// Named rather than inlined because config-store's `checkSettings.minConfidence`
-// and the config form both document this value; a bare literal in three places
-// drifts silently on the next tuning pass.
-export const DEFAULT_MIN_CONFIDENCE = 0.4;
-
-// `settings` is an async resolver so rubric/mode/threshold follow live config.
-// `steer(agent, text)` performs the host-native steer; the caller owns building
-// the framework UserMessage so this module stays free of DSH message types.
-export function createSelfCheck({ evaluate, sessions, steer, settings, minConfidence = DEFAULT_MIN_CONFIDENCE } = {}) {
-  if (typeof evaluate !== 'function') throw new Error('Self-check requires an evaluator');
-  const steerOnce = createSteerOnce();
-  const resolveSettings = async () => {
-    let raw = {};
-    try { raw = (typeof settings === 'function' ? await settings() : settings) ?? {}; } catch { raw = {}; }
-    const mode = raw?.mode === 'steer' ? 'steer' : 'observe';
-    const lowScoreThreshold = Number.isSafeInteger(raw?.lowScoreThreshold) && raw.lowScoreThreshold >= 0 ? raw.lowScoreThreshold : 1;
-    // Confidence required before a low score actually opens the supplemental
-    // prompt. The constructor argument is the fallback so a direct caller (and a
-    // config without the field) keeps its own floor.
-    const confidenceFloor = isProbability(raw?.minConfidence) ? raw.minConfidence : minConfidence;
-    // Quality-trend thresholds (unvalidated heuristics; see quality-trend.mjs).
-    const trendMinConfidence = typeof raw?.trendMinConfidence === 'number' && Number.isFinite(raw.trendMinConfidence) && raw.trendMinConfidence >= 0 && raw.trendMinConfidence <= 1 ? raw.trendMinConfidence : 0.6;
-    const trendRun = Number.isSafeInteger(raw?.trendRun) && raw.trendRun >= 2 ? raw.trendRun : 3;
-    const trendSevereRun = Number.isSafeInteger(raw?.trendSevereRun) && raw.trendSevereRun > trendRun ? raw.trendSevereRun : Math.max(trendRun + 1, 5);
-    return { mode, rubric: boundedRubric(raw?.rubric), lowScoreThreshold, minConfidence: confidenceFloor, trendMinConfidence, trendRun, trendSevereRun };
-  };
-  const record = (turn, outcome, detail = {}, trend) => {
-    const id = turn?.agent?.session?.id;
-    if (!sessions || typeof id !== 'string' || typeof sessions.recordCheck !== 'function') return;
-    try { sessions.recordCheck(id, outcome, trend); } catch { /* telemetry is best effort */ }
-    if (typeof sessions.log !== 'function') return;
-    try { sessions.log(id, { kind: 'check', outcome, ...detail }); }
-    catch { /* logging is best effort */ }
-  };
-  return {
-    async review(turn) {
-      const output = typeof turn?.output === 'string' ? turn.output.trim() : '';
-      if (!output) return { evaluated: false, lowScore: false, steered: false };
-      const id = turn?.agent?.session?.id;
-      if (sessions && typeof id === 'string') {
-        try { if (sessions.snapshot(id).enabled === false) return { evaluated: false, lowScore: false, steered: false }; }
-        catch { return { evaluated: false, lowScore: false, steered: false }; }
-      }
-      // The request this turn answered, carried onto every log row so a reviewer
-      // can tell which turn's output each self-check score belongs to.
-      const subject = subjectOf(turn?.userText);
-      const subjectDetail = subject ? { subject } : {};
-      const { mode, rubric, lowScoreThreshold, minConfidence: confidenceFloor, trendMinConfidence, trendRun, trendSevereRun } = await resolveSettings();
-      let answer;
-      try {
-        const result = await evaluate(scoreQuestion(output, rubric), { signal: turn.signal });
-        answer = result?.answers?.quality;
-      } catch (error) { record(turn, 'error', { ...subjectDetail, reason: typeof error?.reason === 'string' ? error.reason : 'unreachable' }); return { evaluated: false, lowScore: false, steered: false }; }
-      if (!answer || answer.type !== 'score' || typeof answer.score !== 'number' || !Number.isFinite(answer.score)) {
-        record(turn, 'error', { ...subjectDetail, reason: 'invalid-response' });
-        return { evaluated: false, lowScore: false, steered: false };
-      }
-      // A low-confidence Score is a legitimate answer, not a failure: the score
-      // stays usable and is recorded as ok/low. Confidence only gates the steer,
-      // because only interrupting the user warrants the model being sure.
-      const confidence = typeof answer.confidence === 'number' && Number.isFinite(answer.confidence) ? answer.confidence : undefined;
-      const detail = confidence === undefined ? { ...subjectDetail } : { ...subjectDetail, confidence };
-      const lowScore = answer.score <= lowScoreThreshold;
-      // The trend run advances over every evaluated score; a high-confidence low
-      // score is the only thing that grows it. Thresholds flow to session-state.
-      const trend = { confident: lowScore && confidence !== undefined && confidence >= trendMinConfidence, trendRun, trendSevereRun };
-      // A low score the model is not confident about (confidence present but below
-      // the trend threshold) does not advance the quality-trend judgment. Flag it
-      // so the decision log can mark it as low-signal noise instead of a real dip.
-      if (lowScore && confidence !== undefined && !trend.confident) detail.lowConfidence = true;
-      record(turn, lowScore ? 'low' : 'ok', { score: answer.score, ...detail }, trend);
-      if (!lowScore) return { evaluated: true, lowScore: false, steered: false, score: answer.score };
-      const confident = confidence !== undefined && confidence >= confidenceFloor;
-      // The turn budget is consumed only on a successful steer (createSteerOnce),
-      // so a transient host failure does not permanently suppress this turn.
-      const steered = mode === 'steer' && confident && typeof steer === 'function' && turn?.agent
-        ? steerOnce.attempt(turn, () => steer(turn.agent, STEER_TEXT))
-        : false;
-      return { evaluated: true, lowScore: true, steered, score: answer.score };
-    },
-  };
-}