dsh-decision-layer 0.7.1 → 0.7.3

package/service/session-state.mjs

@@ -1,260 +0,0 @@
-import { randomUUID } from 'node:crypto';
-import { advanceRun, severityOf } from './quality-trend.mjs';
-
-function sessionKey(value) {
-  if (typeof value !== 'string' || !value.trim() || value.length > 512) throw new Error('Invalid session ID');
-  return value.trim();
-}
-
-function emptyState() {
-  return { enabled: true, attempts: 0, failures: 0,
-    gate: { attempts: 0, failures: 0, ask: 0, deny: 0, allow: 0, actual: { allow: 0, deny: 0, error: 0 } },
-    check: { attempts: 0, failures: 0, low: 0, run: 0, severity: 'normal' },
-    narrow: { attempts: 0, failures: 0, applied: 0, dropped: 0 },
-    complete: { attempts: 0, failures: 0, unsatisfied: 0, satisfied: 0, insufficient: 0, steered: 0 }, log: [] };
-}
-
-function safeTool(value) {
-  return typeof value === 'string' && value.trim() ? value.trim().slice(0, 128) : undefined;
-}
-
-const toCount = value => (Number.isSafeInteger(value) && value >= 0 ? value : 0);
-
-// Rebuild a trusted in-memory state from a persisted (untrusted) snapshot. Every
-// counter is coerced into the emptyState() shape with a non-negative-integer
-// guard and the trend severity into its enum, so a stale or tampered file can
-// never inject an out-of-shape value into the live counters. The recent log is
-// kept as plain records (newest-last); callers trim it to the log cap.
-function coerceState(raw) {
-  const state = emptyState();
-  if (!raw || typeof raw !== 'object') return state;
-  if (typeof raw.enabled === 'boolean') state.enabled = raw.enabled;
-  state.attempts = toCount(raw.attempts);
-  state.failures = toCount(raw.failures);
-  const g = raw.gate;
-  if (g && typeof g === 'object') {
-    state.gate.attempts = toCount(g.attempts); state.gate.failures = toCount(g.failures);
-    state.gate.ask = toCount(g.ask); state.gate.deny = toCount(g.deny); state.gate.allow = toCount(g.allow);
-    const a = g.actual;
-    if (a && typeof a === 'object') { state.gate.actual.allow = toCount(a.allow); state.gate.actual.deny = toCount(a.deny); state.gate.actual.error = toCount(a.error); }
-  }
-  const c = raw.check;
-  if (c && typeof c === 'object') {
-    state.check.attempts = toCount(c.attempts); state.check.failures = toCount(c.failures); state.check.low = toCount(c.low);
-    state.check.run = toCount(c.run);
-    state.check.severity = ['normal', 'warn', 'severe'].includes(c.severity) ? c.severity : 'normal';
-  }
-  const n = raw.narrow;
-  if (n && typeof n === 'object') {
-    state.narrow.attempts = toCount(n.attempts); state.narrow.failures = toCount(n.failures);
-    state.narrow.applied = toCount(n.applied); state.narrow.dropped = toCount(n.dropped);
-  }
-  const k = raw.complete;
-  if (k && typeof k === 'object') {
-    state.complete.attempts = toCount(k.attempts); state.complete.failures = toCount(k.failures);
-    state.complete.unsatisfied = toCount(k.unsatisfied); state.complete.satisfied = toCount(k.satisfied);
-    state.complete.insufficient = toCount(k.insufficient); state.complete.steered = toCount(k.steered);
-  }
-  if (Array.isArray(raw.log)) {
-    state.log = raw.log
-      .filter(entry => entry && typeof entry === 'object' && !Array.isArray(entry) && typeof entry.kind === 'string')
-      .map(entry => ({ ...entry }));
-  }
-  return state;
-}
-
-export function createSessionState({ maxSessions = 1024, maxLogEntries = 50, onLog, loadState, persistState } = {}) {
-  if (!Number.isSafeInteger(maxSessions) || maxSessions < 1) throw new Error('Invalid session limit');
-  if (!Number.isSafeInteger(maxLogEntries) || maxLogEntries < 1) throw new Error('Invalid log limit');
-  const sessions = new Map();
-  const sink = typeof onLog === 'function' ? onLog : undefined;
-  const load = typeof loadState === 'function' ? loadState : undefined;
-  const persist = typeof persistState === 'function' ? persistState : undefined;
-  // Memoize rehydration per id so a session is seeded from disk at most once per
-  // process. Bounded like `sessions`; dropping a memo entry only risks a
-  // redundant disk read that no-ops (ensureLoaded never clobbers live state).
-  const loaded = new Map();
-  // Mirror the latest live state to the durable store after every mutation.
-  // Best-effort: a persistence fault must never surface in the decision path.
-  const bump = (key, state) => { if (persist) { try { persist(key, state); } catch { /* best effort */ } } };
-  // FIFO eviction: when the map is full, drop the oldest-inserted session before
-  // admitting a new one (Map preserves insertion order, so the first key is the
-  // oldest). This mirrors loop-guard / narrowing and means the store never
-  // "fills up" — there is no capacity-exceeded state. An evicted session's
-  // in-memory counters/log are gone, but the persisted JSONL log is unaffected;
-  // a later call rebuilds an empty state for it.
-  const writable = id => {
-    const key = sessionKey(id);
-    let state = sessions.get(key);
-    if (!state) {
-      if (sessions.size >= maxSessions) sessions.delete(sessions.keys().next().value);
-      state = emptyState();
-      sessions.set(key, state);
-    }
-    return state;
-  };
-  return {
-    // Rehydrate a session's live counters/log from the durable store the first
-    // time it is touched this process, before any new event mutates it — so disk
-    // history and in-process events never double-count. Memoized per id; a no-op
-    // when no loadState was given or the session already has live state. Callers
-    // should await this before the first snapshot/record of a resumed session
-    // (the plugin does so at the turn's first step and in the panel routes).
-    async ensureLoaded(id) {
-      if (!load) return;
-      let key;
-      try { key = sessionKey(id); } catch { return; }
-      const existing = loaded.get(key);
-      if (existing) return existing;
-      const promise = (async () => {
-        if (sessions.has(key)) return; // live events already created state; keep it
-        let raw;
-        try { raw = await load(key); } catch { raw = undefined; }
-        if (!raw) return;
-        if (sessions.has(key)) return; // a concurrent mutation won the race; do not clobber
-        const state = coerceState(raw);
-        if (state.log.length > maxLogEntries) state.log.splice(0, state.log.length - maxLogEntries);
-        if (sessions.size >= maxSessions) sessions.delete(sessions.keys().next().value);
-        sessions.set(key, state);
-      })();
-      if (loaded.size >= maxSessions) loaded.delete(loaded.keys().next().value);
-      loaded.set(key, promise);
-      return promise;
-    },
-    setEnabled(id, enabled) {
-      if (typeof enabled !== 'boolean') throw new Error('Invalid enabled value');
-      const state = writable(id);
-      state.enabled = enabled;
-      bump(sessionKey(id), state);
-    },
-    snapshot(id) {
-      const stored = sessions.get(sessionKey(id));
-      const state = stored ?? emptyState();
-      const value = { enabled: state.enabled, hasAutomaticDecisions: state.attempts > 0, attempts: state.attempts, failures: state.failures };
-      if (state.gate.attempts > 0) value.gate = { ...state.gate, actual: { ...state.gate.actual } };
-      if (state.check.attempts > 0) value.check = { attempts: state.check.attempts, failures: state.check.failures, low: state.check.low, trend: { run: state.check.run, severity: state.check.severity } };
-      if (state.narrow.attempts > 0) value.narrow = { ...state.narrow };
-      if (state.complete.attempts > 0) value.complete = { ...state.complete };
-      if (state.log.length > 0) value.log = state.log.map(entry => ({ ...entry }));
-      return value;
-    },
-    record(id, kind, outcome) {
-      if (kind !== 'gate' || !['allow', 'ask', 'deny', 'error'].includes(outcome)) throw new Error('Invalid automatic decision');
-      const state = writable(id);
-      state.attempts++;
-      state.gate.attempts++;
-      if (outcome === 'error') { state.failures++; state.gate.failures++; }
-      else state.gate[outcome]++;
-      bump(sessionKey(id), state);
-    },
-    recordActual(id, outcome) {
-      if (!['allow', 'deny', 'error'].includes(outcome)) throw new Error('Invalid actual decision');
-      const state = writable(id);
-      state.gate.actual[outcome]++;
-      bump(sessionKey(id), state);
-    },
-    recordCheck(id, outcome, trend) {
-      if (!['ok', 'low', 'error'].includes(outcome)) throw new Error('Invalid self-check outcome');
-      const state = writable(id);
-      state.attempts++;
-      state.check.attempts++;
-      if (outcome === 'error') { state.failures++; state.check.failures++; }
-      else {
-        if (outcome === 'low') state.check.low++;
-        // Advance the quality-trend run over this evaluated score. A good score
-        // resets the run; a high-confidence low score grows it; a low-confidence
-        // low score neither resets nor grows. `trend` carries the per-sample flags
-        // and the configured thresholds; absent trend leaves the run unchanged.
-        if (trend && typeof trend === 'object') {
-          state.check.run = advanceRun(state.check.run, { lowScore: outcome === 'low', confident: trend.confident === true });
-          state.check.severity = severityOf(state.check.run, { trendRun: trend.trendRun, trendSevereRun: trend.trendSevereRun });
-        }
-      }
-      bump(sessionKey(id), state);
-    },
-    recordNarrow(id, outcome, dropped = 0, applied = outcome === 'applied') {
-      if (!['ok', 'applied', 'error'].includes(outcome)) throw new Error('Invalid narrowing outcome');
-      const state = writable(id);
-      state.attempts++;
-      state.narrow.attempts++;
-      if (outcome === 'error') { state.failures++; state.narrow.failures++; }
-      else if (outcome === 'applied') {
-        // A vetoed pass (low-keep, too many candidates) still dropped tools on
-        // paper, but the restriction never took effect; only count real ones.
-        if (applied) state.narrow.applied++;
-        if (Number.isSafeInteger(dropped) && dropped > 0) state.narrow.dropped += dropped;
-      }
-      bump(sessionKey(id), state);
-    },
-    // Task-completion checking. `ok`/`unsatisfied` are real evaluations; `error`
-    // is an unevaluated failure counted as a failure, never as "unsatisfied".
-    // The per-condition three-state tallies come from `detail`.
-    recordComplete(id, outcome, detail = {}) {
-      if (!['ok', 'unsatisfied', 'error'].includes(outcome)) throw new Error('Invalid task-completion outcome');
-      const state = writable(id);
-      state.attempts++;
-      state.complete.attempts++;
-      if (outcome === 'error') { state.failures++; state.complete.failures++; }
-      else {
-        if (Number.isSafeInteger(detail.satisfied) && detail.satisfied > 0) state.complete.satisfied += detail.satisfied;
-        if (Number.isSafeInteger(detail.unsatisfied) && detail.unsatisfied > 0) state.complete.unsatisfied += detail.unsatisfied;
-        if (Number.isSafeInteger(detail.insufficient) && detail.insufficient > 0) state.complete.insufficient += detail.insufficient;
-        if (detail.steered === true) state.complete.steered++;
-      }
-      bump(sessionKey(id), state);
-    },
-    log(id, entry) {
-      if (entry === null || typeof entry !== 'object' || Array.isArray(entry)) throw new Error('Invalid log entry');
-      if (!['gate', 'check', 'narrow', 'complete'].includes(entry.kind)) throw new Error('Invalid log entry');
-      // Every decision record carries a stable unique id, generated here so the
-      // in-memory panel copy and the persisted sink record share the same id.
-      // Later annotation events reference this id to attribute a rating to one decision.
-      const record = { id: randomUUID(), at: Date.now(), kind: entry.kind, outcome: typeof entry.outcome === 'string' ? entry.outcome.slice(0, 32) : '' };
-      const tool = safeTool(entry.tool);
-      if (tool) record.tool = tool;
-      if (typeof entry.suggestion === 'string' && entry.suggestion) record.suggestion = entry.suggestion.slice(0, 16);
-      if (typeof entry.action === 'string' && entry.action) record.action = entry.action.slice(0, 16);
-      if (typeof entry.reason === 'string' && entry.reason) record.reason = entry.reason.slice(0, 32);
-      // A short hint of the request a self-check judged, so a log row says which
-      // turn's output was scored (not just "self-check"). Already collapsed upstream.
-      if (typeof entry.subject === 'string' && entry.subject.trim()) record.subject = entry.subject.replace(/\s+/g, ' ').trim().slice(0, 120);
-      // The redacted command/path summary of a gated call, so the log row can show
-      // what was evaluated (not just the tool). Already secret-stripped upstream;
-      // kept to a bounded preview here. Newlines collapse to single spaces so one
-      // multi-line script stays on one readable row.
-      if (typeof entry.command === 'string' && entry.command.trim()) record.command = entry.command.replace(/\s+/g, ' ').trim().slice(0, 512);
-      if (typeof entry.path === 'string' && entry.path.trim()) record.path = entry.path.replace(/\s+/g, ' ').trim().slice(0, 512);
-      if (typeof entry.mode === 'string' && entry.mode) record.mode = entry.mode.slice(0, 16);
-      if (typeof entry.score === 'number' && Number.isFinite(entry.score)) record.score = Math.round(entry.score * 100) / 100;
-      if (typeof entry.confidence === 'number' && Number.isFinite(entry.confidence)) record.confidence = Math.round(entry.confidence * 100) / 100;
-      if (Number.isSafeInteger(entry.dropped) && entry.dropped >= 0) record.dropped = entry.dropped;
-      if (Number.isSafeInteger(entry.kept) && entry.kept >= 0) record.kept = entry.kept;
-      if (typeof entry.applied === 'boolean') record.applied = entry.applied;
-      if (Number.isSafeInteger(entry.candidates) && entry.candidates >= 0) record.candidates = entry.candidates;
-      if (Number.isSafeInteger(entry.conditions) && entry.conditions >= 0) record.conditions = entry.conditions;
-      if (Number.isSafeInteger(entry.satisfied) && entry.satisfied >= 0) record.satisfied = entry.satisfied;
-      if (Number.isSafeInteger(entry.unsatisfied) && entry.unsatisfied >= 0) record.unsatisfied = entry.unsatisfied;
-      if (Number.isSafeInteger(entry.insufficient) && entry.insufficient >= 0) record.insufficient = entry.insufficient;
-      if (entry.steered === true) record.steered = true;
-      if (entry.lowConfidence === true) record.lowConfidence = true;
-      if (Array.isArray(entry.tools)) {
-        const names = entry.tools.filter(name => typeof name === 'string' && name.trim()).slice(0, 12).map(name => name.trim().slice(0, 64));
-        if (names.length > 0) record.tools = names;
-      }
-      const state = writable(id);
-      state.log.push(record);
-      if (state.log.length > maxLogEntries) state.log.splice(0, state.log.length - maxLogEntries);
-      // Full, untruncated record for the research log sink (all dropped tool
-      // names, keyed by session id). The in-memory panel record above stays capped.
-      if (sink) {
-        const full = { ...record, sessionId: sessionKey(id) };
-        if (Array.isArray(entry.tools)) {
-          const allNames = entry.tools.filter(name => typeof name === 'string' && name.trim()).map(name => name.trim());
-          if (allNames.length > 0) full.tools = allNames;
-        }
-        try { sink(full); } catch { /* persistence is best effort */ }
-      }
-      bump(sessionKey(id), state);
-    },
-  };
-}

package/service/state-store.mjs

@@ -1,100 +0,0 @@
-import { mkdir, readFile, readdir, rename, rm, stat, writeFile } from 'node:fs/promises';
-import { homedir } from 'node:os';
-import { join } from 'node:path';
-import { randomUUID } from 'node:crypto';
-
-export function stateDir() {
-  return join(homedir(), '.config', 'dsh-decision-layer', 'state');
-}
-
-// A session id is persisted only when it is safe as a single path segment, so a
-// crafted id can never escape the state directory. dsh session ids are
-// `session-<uuid>`, which pass; anything with separators, leading dot, `..`, or
-// an unreasonable length is skipped (that session simply stays in-memory only).
-const SAFE_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,199}$/;
-export function safeStateId(id) {
-  return typeof id === 'string' && SAFE_ID.test(id) && !id.includes('..') ? id : undefined;
-}
-
-// Durable per-session mirror of the live decision counters + recent log. One
-// small JSON file per session id (`<id>.json`), written debounced and atomically
-// (unique tmp + rename), pruned by age on an occasional flush. This is separate
-// from the JSONL research log: it exists only so a resumed session's live panel
-// (dock count, metric cards, recent log) survives an instance restart instead of
-// resetting to zero. All IO is best-effort — a failure never throws into the
-// decision path; at worst the panel loses the last few seconds of counters.
-export function createStateStore({ dir = stateDir(), flushIntervalMs = 2000,
-  retentionDays = 30, now = () => Date.now() } = {}) {
-  const pending = new Map(); // id -> latest live state reference awaiting a flush
-  let timer;
-  let flushing = false;
-  let lastPrune = 0;
-
-  const fileFor = id => join(dir, `${id}.json`);
-
-  const writeOne = async (id, state) => {
-    const temporary = join(dir, `${id}.${randomUUID()}.tmp`);
-    try {
-      await writeFile(temporary, `${JSON.stringify({ v: 1, at: now(), state })}\n`, { mode: 0o600, flag: 'wx' });
-      await rename(temporary, fileFor(id));
-    } finally {
-      await rm(temporary, { force: true }).catch(() => {});
-    }
-  };
-
-  const prune = async () => {
-    let names;
-    try { names = await readdir(dir); } catch { return; }
-    const cutoff = now() - retentionDays * 24 * 60 * 60 * 1000;
-    await Promise.all(names.map(async name => {
-      if (!name.endsWith('.json')) return;
-      try {
-        const info = await stat(join(dir, name));
-        if (info.mtimeMs < cutoff) await rm(join(dir, name), { force: true }).catch(() => {});
-      } catch { /* a file vanishing under us is fine */ }
-    }));
-  };
-
-  const flush = async () => {
-    if (flushing || pending.size === 0) return;
-    flushing = true;
-    // Snapshot ids now; each state is JSON.stringify'd at write time so the file
-    // reflects the latest counters, which is exactly what we want.
-    const batch = [...pending.entries()];
-    pending.clear();
-    try {
-      await mkdir(dir, { recursive: true, mode: 0o700 });
-      for (const [id, state] of batch) await writeOne(id, state).catch(() => {});
-      // Prune at most about once per hour of activity, not on every flush.
-      if (now() - lastPrune > 60 * 60 * 1000) { lastPrune = now(); await prune(); }
-    } catch { /* best effort; a dropped flush must never break the decision path */ }
-    finally { flushing = false; }
-  };
-
-  return {
-    // Read a session's persisted state, or undefined when there is no usable file.
-    async load(id) {
-      const safe = safeStateId(id);
-      if (!safe) return undefined;
-      try {
-        const parsed = JSON.parse(await readFile(fileFor(safe), 'utf8'));
-        if (parsed && typeof parsed === 'object' && parsed.state && typeof parsed.state === 'object' && !Array.isArray(parsed.state)) {
-          return parsed.state;
-        }
-      } catch { /* missing or malformed: no seed, start empty */ }
-      return undefined;
-    },
-    // Register the latest live state for a session and schedule a debounced flush.
-    save(id, state) {
-      const safe = safeStateId(id);
-      if (!safe || state === null || typeof state !== 'object') return;
-      pending.set(safe, state);
-      if (!timer) timer = setTimeout(() => { timer = undefined; void flush(); }, flushIntervalMs);
-    },
-    flush,
-    dispose() {
-      if (timer) { clearTimeout(timer); timer = undefined; }
-      return flush();
-    },
-  };
-}

package/service/steer-once.mjs

@@ -1,25 +0,0 @@
-// Shared "steer at most once per turn" gate for the turn-stopping decision
-// points (self-check, task-completion). A steer opens a supplemental step, so it
-// must fire at most once per (session, turn) — but a transient host failure must
-// NOT burn that budget, or one flaky steer permanently suppresses the turn.
-//
-// `attempt(turn, run)` calls `run()` (which performs the host steer and may
-// throw) and records the turn key only after `run()` returns without throwing.
-// Returns true iff a steer was actually performed this call.
-export function createSteerOnce({ maxTurns = 4096 } = {}) {
-  const steeredTurns = new Set();
-  const keyOf = turn => {
-    const id = turn?.agent?.session?.id;
-    return typeof id === 'string' && Number.isInteger(turn?.turn) ? `${id}:${turn.turn}` : undefined;
-  };
-  return {
-    attempt(turn, run) {
-      const key = keyOf(turn);
-      if (key === undefined || steeredTurns.has(key)) return false;
-      try { run(); } catch { return false; }
-      steeredTurns.add(key);
-      if (steeredTurns.size > maxTurns) steeredTurns.delete(steeredTurns.values().next().value);
-      return true;
-    },
-  };
-}

package/service/task-completion.mjs

@@ -1,163 +0,0 @@
-import { createSteerOnce } from './steer-once.mjs';
-
-const MAX_STATE = 8 * 1024;
-const MAX_CONDITION = 512;
-const MAX_CONDITIONS = 20;
-const MAX_EVIDENCE = 40;
-
-const isObject = value => value !== null && typeof value === 'object' && !Array.isArray(value);
-const probability = value => typeof value === 'number' && Number.isFinite(value) && value >= 0 && value <= 1;
-
-const STEER_TEXT = '本回合任务完成核对发现有明确交付条件尚未满足：请对照用户列出的条件逐项复核，补完未完成的部分。';
-
-// Deterministic extraction of the explicit deliverable conditions a user listed.
-// Only structured forms are recognized — numbered lists, bullet lists, and a
-// single line of comma/、-separated multiple commands. Implicit or inferred
-// expectations are deliberately out of scope for the first version.
-export function extractConditions(userText) {
-  const text = typeof userText === 'string' ? userText : '';
-  if (!text.trim()) return [];
-  const conditions = [];
-  const push = value => {
-    const item = value.trim().replace(/\s+/g, ' ').slice(0, MAX_CONDITION);
-    if (item && !conditions.includes(item)) conditions.push(item);
-  };
-  const lines = text.split(/\r?\n/);
-  let matchedStructured = false;
-  for (const line of lines) {
-    // Numbered: `1. `, `1) `, `1、`, `（1）`, `(1)`; or bullets: `- `, `* `, `• `.
-    const numbered = line.match(/^\s*(?:[（(]?\d+[)）.、]|\d+\s*[.)、])\s+(.*)$/);
-    const bullet = line.match(/^\s*[-*•]\s+(.*)$/);
-    if (numbered && numbered[1].trim()) { push(numbered[1]); matchedStructured = true; }
-    else if (bullet && bullet[1].trim()) { push(bullet[1]); matchedStructured = true; }
-  }
-  // Fallback: a single instruction line joining multiple commands with 、/,/，
-  // and enough parts to look like an explicit multi-step ask (e.g. "改配置、跑测试、说明失败原因").
-  if (!matchedStructured) {
-    const compact = text.trim();
-    if (!/[\r\n]/.test(compact)) {
-      const parts = compact.split(/[、，,]/).map(part => part.trim()).filter(Boolean);
-      if (parts.length >= 2) for (const part of parts) push(part);
-    }
-  }
-  return conditions.slice(0, MAX_CONDITIONS);
-}
-
-// Build one choice question per explicit condition. The state carries the
-// conditions, the turn's tool evidence, and the final reply. Tool evidence is
-// primary; the reply's own claims are explicitly NOT treated as proof, so the
-// model can answer insufficient_evidence when only the reply asserts completion.
-export function completionQuestions(conditions, evidence, answer) {
-  const items = Array.isArray(conditions) ? conditions.slice(0, MAX_CONDITIONS) : [];
-  const tools = Array.isArray(evidence)
-    ? evidence.filter(item => isObject(item) && typeof item.tool === 'string').slice(0, MAX_EVIDENCE)
-      .map(item => ({ tool: item.tool.slice(0, 128), outcome: item.outcome === 'error' ? 'error' : 'ok' }))
-    : [];
-  const state = {
-    conditions: items.map((text, index) => ({ id: `c${index}`, text })),
-    toolEvidence: tools,
-    finalReply: String(answer ?? '').slice(0, MAX_STATE),
-    note: '工具证据（toolEvidence）是判定依据；finalReply 自称完成不作为证据。缺少证据时选 insufficient_evidence。',
-  };
-  const questions = Object.fromEntries(items.map((text, index) => [`c${index}`, {
-    type: 'choice',
-    instructions: {
-      condition: text,
-      question: '根据当前工具证据与最终回复，这个交付条件的完成情况属于哪一种？',
-    },
-    criteria: {
-      satisfied: '有工具证据或用户明确确认表明该条件已完成',
-      unsatisfied: '有证据表明该条件未完成或做错',
-      insufficient_evidence: '现有证据不足以判断该条件是否完成',
-    },
-  }]));
-  return { state, questions };
-}
-
-// The confidence floor for interrupting the user with a supplemental prompt.
-// Named rather than inlined because config-store's `completeSettings.minConfidence`
-// and the config form both document this value; a bare literal in three places
-// drifts silently on the next tuning pass.
-export const DEFAULT_MIN_CONFIDENCE = 0.4;
-
-// Orchestrates one task-completion pass at turn end. Read-only by default: it
-// records a per-condition verdict and only steers when explicitly configured,
-// the model is confident, and at least one condition is not satisfied. A steer
-// opens a supplemental step; it never rewrites the already-committed reply.
-export function createTaskCompletion({ evaluate, sessions, steer, settings, minConfidence = DEFAULT_MIN_CONFIDENCE } = {}) {
-  if (typeof evaluate !== 'function') throw new Error('Task completion requires an evaluator');
-  const steerOnce = createSteerOnce();
-  const resolveSettings = async () => {
-    let raw = {};
-    try { raw = (typeof settings === 'function' ? await settings() : settings) ?? {}; } catch { raw = {}; }
-    const mode = raw?.mode === 'steer' ? 'steer' : 'observe';
-    const minConditions = Number.isSafeInteger(raw?.minConditions) && raw.minConditions >= 2 ? raw.minConditions : 2;
-    // Confidence required before an unmet condition actually opens the
-    // supplemental step; the constructor argument is the fallback when the
-    // config does not set it.
-    const confidenceFloor = probability(raw?.minConfidence) ? raw.minConfidence : minConfidence;
-    return { mode, minConditions, minConfidence: confidenceFloor };
-  };
-  const record = (turn, outcome, detail = {}) => {
-    const id = turn?.agent?.session?.id;
-    if (!sessions || typeof id !== 'string' || typeof sessions.recordComplete !== 'function') return;
-    try { sessions.recordComplete(id, outcome, detail); } catch { /* telemetry is best effort */ }
-    if (typeof sessions.log !== 'function') return;
-    try { sessions.log(id, { kind: 'complete', outcome, ...detail }); }
-    catch { /* logging is best effort */ }
-  };
-  const skip = { evaluated: false, steered: false };
-  return {
-    async review(turn) {
-      const output = typeof turn?.output === 'string' ? turn.output.trim() : '';
-      const { mode, minConditions, minConfidence: confidenceFloor } = await resolveSettings();
-      const conditions = extractConditions(turn?.userText);
-      if (conditions.length < minConditions) return { ...skip };
-      const evidence = Array.isArray(turn?.evidence) ? turn.evidence : [];
-      if (evidence.length === 0) return { ...skip };
-      const id = turn?.agent?.session?.id;
-      if (sessions && typeof id === 'string') {
-        try { if (sessions.snapshot(id).enabled === false) return { ...skip }; }
-        catch { return { ...skip }; }
-      }
-      let answers;
-      try {
-        const result = await evaluate(completionQuestions(conditions, evidence, output), { signal: turn.signal });
-        answers = isObject(result?.answers) ? result.answers : undefined;
-      } catch (error) {
-        record(turn, 'error', { reason: typeof error?.reason === 'string' ? error.reason : 'unreachable' });
-        return { ...skip };
-      }
-      if (!answers) { record(turn, 'error', { reason: 'invalid-response' }); return { ...skip }; }
-      let satisfied = 0, unsatisfied = 0, insufficient = 0;
-      // Track the minimum confidence over the `unsatisfied` verdicts only: a steer
-      // fires on a confident unsatisfied finding, so a low-confidence satisfied /
-      // insufficient verdict on another condition must not suppress it.
-      let unsatisfiedMinConf = 1;
-      for (let index = 0; index < conditions.length; index++) {
-        const answer = answers[`c${index}`];
-        if (!isObject(answer) || answer.type !== 'choice' || typeof answer.choice !== 'string') {
-          insufficient++; continue;
-        }
-        if (answer.choice === 'satisfied') satisfied++;
-        else if (answer.choice === 'unsatisfied') {
-          unsatisfied++;
-          if (probability(answer.confidence)) unsatisfiedMinConf = Math.min(unsatisfiedMinConf, answer.confidence);
-        }
-        else insufficient++;
-      }
-      const outcome = unsatisfied > 0 ? 'unsatisfied' : 'ok';
-      const detail = { conditions: conditions.length, satisfied, unsatisfied, insufficient };
-      // A steer is only for a confident finding that a listed condition is not met.
-      const confident = unsatisfied > 0 && unsatisfiedMinConf >= confidenceFloor;
-      // The turn budget is consumed only on a successful steer (createSteerOnce),
-      // so a transient host failure does not permanently suppress this turn.
-      const steered = mode === 'steer' && confident && typeof steer === 'function' && turn?.agent
-        ? steerOnce.attempt(turn, () => steer(turn.agent, STEER_TEXT))
-        : false;
-      if (steered) detail.steered = true;
-      record(turn, outcome, detail);
-      return { evaluated: true, steered, satisfied, unsatisfied, insufficient };
-    },
-  };
-}