dsh-decision-layer 0.7.1 → 0.7.3

package/lib/host/decision-context.js

@@ -0,0 +1,187 @@
+import { redactCredentials, stripInjected } from "./excerpt.js";
+import { summarizeExecution } from "./danger-gate.js";
+import { isObject } from "./types.js";
+function clip(text, maxBytes) {
+  let size = 0;
+  let result = "";
+  for (const char of text) {
+    size += Buffer.byteLength(char);
+    if (size > maxBytes) break;
+    result += char;
+  }
+  return result;
+}
+function decisionText(value, maxBytes = 1536) {
+  if (typeof value !== "string" || maxBytes <= 0) return "";
+  const clean = redactCredentials(stripInjected(value.slice(0, 32 * 1024))).trim();
+  return clip(clean, maxBytes);
+}
+const OPAQUE = /[A-Za-z0-9_+-]{24,}/g;
+const resultExcerpt = (value, maxBytes) => clip(decisionText(value, 32 * 1024).replace(OPAQUE, "[redacted]"), maxBytes);
+const messagesOf = (value) => Array.isArray(value) ? value.filter(isObject) : [];
+const textOf = (message) => Array.isArray(message.content) ? message.content.filter(isObject).filter((block) => block.type === "text" && typeof block.text === "string").map((block) => block.text).join("\n") : "";
+const human = (message) => message.role === "user" && (!message.source || isObject(message.source) && message.source.kind === "user");
+function historyOf(agent) {
+  try {
+    const derived = agent?.session?.deriveMessages?.();
+    return Array.isArray(derived) ? messagesOf(derived) : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function backgroundOf(messages, isHuman) {
+  const lastUser = messages.findLastIndex(isHuman);
+  const lastAssistant = messages.findLastIndex((message) => message.role === "assistant");
+  return [lastUser, lastAssistant].filter((index) => index >= 0).sort((a, b) => a - b).map((index) => {
+    const message = messages[index];
+    if (!message) return void 0;
+    const role = isHuman(message) ? "user" : "assistant";
+    return { role, text: decisionText(textOf(message), 512) };
+  }).filter((item) => Boolean(item?.text));
+}
+function evidenceOf(messages) {
+  const calls = /* @__PURE__ */ new Map();
+  const evidence = [];
+  for (const message of messages) {
+    if (message.role === "assistant" && Array.isArray(message.content)) {
+      for (const block of message.content.filter(isObject)) {
+        if (block.type !== "tool-call" || typeof block.id !== "string" || typeof block.name !== "string") continue;
+        let args = block.arguments;
+        if (typeof args === "string") {
+          try {
+            args = JSON.parse(args);
+          } catch {
+            args = void 0;
+          }
+        }
+        calls.set(block.id, { name: block.name, arguments: args });
+      }
+    }
+    if (message.role !== "tool") continue;
+    const source = isObject(message.source) ? message.source : {};
+    const id = typeof message.toolCallId === "string" ? message.toolCallId : source.callId;
+    const call = typeof id === "string" ? calls.get(id) : void 0;
+    const name = call?.name ?? (typeof message.name === "string" ? message.name : typeof message.toolName === "string" ? message.toolName : "");
+    if (!name) continue;
+    const item = { tool: decisionText(name, 96), outcome: message.isError === true ? "error" : "ok" };
+    if (call) {
+      const summary = summarizeExecution(call);
+      if (summary.command) item.command = decisionText(summary.command, 160);
+      if (summary.path) item.path = decisionText(summary.path, 160);
+    }
+    if (["bash", "pwsh", "shell", "exec", "terminal", "run_command"].includes(name)) {
+      const result = resultExcerpt(textOf(message), 256);
+      if (result) item.result = result;
+    }
+    evidence.push(item);
+  }
+  const bounded = evidence.length > 12 ? [...evidence.slice(0, 4), ...evidence.slice(-8)] : [...evidence];
+  while (Buffer.byteLength(JSON.stringify(bounded)) > 4096) bounded.shift();
+  return bounded;
+}
+const REPLACEMENTS = /* @__PURE__ */ new Set(["compact-checkpoint", "dsh-rewind"]);
+function afterLastReplacement(messages) {
+  for (let i = messages.length - 1; i >= 0; i--) {
+    const message = messages[i];
+    if (!message) continue;
+    const source = isObject(message.source) ? message.source : void 0;
+    if (source && typeof source.kind === "string" && REPLACEMENTS.has(source.kind)) return messages.slice(i + 1);
+  }
+  return messages;
+}
+function boundaryHolds(history, boundary) {
+  if (boundary.start <= 0) return true;
+  const previous = history[boundary.start - 1];
+  if (!previous) return false;
+  return previous === boundary.anchor || boundary.anchorId !== void 0 && previous.id === boundary.anchorId;
+}
+function snapshotOf(history, boundary, isHuman) {
+  const messages = history ?? [];
+  const lastHuman = messages.findLastIndex(isHuman);
+  const window = boundary === void 0 ? messages.slice(lastHuman >= 0 ? lastHuman : messages.length) : boundary.broken ? [] : boundaryHolds(messages, boundary) ? messages.slice(boundary.start) : [];
+  const current = afterLastReplacement(window);
+  const requests = boundary?.requests ?? current.filter(isHuman).map((message) => decisionText(textOf(message), 8192));
+  const request = decisionText(requests.at(-1) ?? "", 1536);
+  const evidence = evidenceOf(current);
+  const context = {
+    request,
+    // Earlier real requests in this turn stay visible as background: with only the
+    // last one, a short follow-up ("继续") would hide the main task. Pre-turn
+    // context is kept too, but the size cap below drops it first.
+    background: [
+      ...boundary?.background ?? backgroundOf(messages.slice(0, Math.max(lastHuman, 0)), isHuman),
+      ...requests.slice(0, -1).slice(-2).map((text) => ({ role: "user", text: decisionText(text, 1024) }))
+    ].slice(-4),
+    progress: evidence.slice(-3)
+  };
+  while (Buffer.byteLength(JSON.stringify(context.progress)) > 1024 && context.progress.length > 1) context.progress.shift();
+  while (Buffer.byteLength(JSON.stringify(context)) > 4096 && (context.background.length || context.progress.length > 1)) {
+    if (context.background.length) context.background.shift();
+    else context.progress.shift();
+  }
+  return {
+    context,
+    evidence,
+    // Completion conditions come from the latest real request only. Joining a
+    // turn's requests would resurrect work the user just cancelled ("drop the
+    // earlier list, only review"); when the latest request has no explicit
+    // conditions the check skips rather than infer from an older revision.
+    conditionsText: requests.at(-1) ?? ""
+  };
+}
+function createDecisionContext({ ignored } = {}) {
+  const boundaries = /* @__PURE__ */ new WeakMap();
+  const isHuman = (message) => human(message) && !(typeof message.id === "string" && ignored?.(message.id) === true);
+  const enter = (agent, position) => {
+    const known = agent ? boundaries.get(agent) : void 0;
+    const first = !known || known.turn !== position.turn;
+    const inputs = messagesOf(position.messages).filter(isHuman).map((message) => decisionText(textOf(message), 8192)).filter(Boolean);
+    if (!first && inputs.length === 0) return { changed: false };
+    const history = historyOf(agent);
+    let boundary = known;
+    const anchor = history?.at(-1);
+    if (first) {
+      boundary = {
+        turn: position.turn,
+        start: history?.length ?? 0,
+        anchor,
+        broken: history === void 0,
+        ...isObject(anchor) && typeof anchor.id === "string" ? { anchorId: anchor.id } : {},
+        requests: [],
+        background: history ? backgroundOf(history, isHuman) : []
+      };
+      if (agent) boundaries.set(agent, boundary);
+    } else if (boundary?.broken) {
+      boundary.broken = history === void 0;
+      boundary.start = history?.length ?? 0;
+      boundary.anchor = anchor;
+      if (isObject(anchor) && typeof anchor.id === "string") boundary.anchorId = anchor.id;
+      else delete boundary.anchorId;
+      boundary.background = history ? backgroundOf(history, isHuman) : [];
+    }
+    const active = boundary;
+    active.requests.push(...inputs);
+    active.requests = active.requests.slice(-8);
+    return { changed: true, snapshot: snapshotOf(history, active, isHuman) };
+  };
+  return {
+    enter(agent, position) {
+      try {
+        return enter(agent, position);
+      } catch {
+        return { changed: false };
+      }
+    },
+    snapshot(agent) {
+      try {
+        return snapshotOf(historyOf(agent), agent ? boundaries.get(agent) : void 0, isHuman);
+      } catch {
+        return { context: { request: "", background: [], progress: [] }, conditionsText: "", evidence: [] };
+      }
+    }
+  };
+}
+export {
+  createDecisionContext,
+  decisionText
+};

package/lib/host/excerpt.d.ts

@@ -0,0 +1,26 @@
+/**
+ * The one bounded, redacted "what was this turn about" excerpt every decision
+ * row may carry into the local decision log.
+ *
+ * It is a human-review hint, never a dump of structured state: injected host
+ * context (memory blocks, system reminders) is stripped first, then common
+ * credential forms are masked, and only then is the text collapsed and cut.
+ * The same rules must hold for every decision point — the panel and the JSONL
+ * sink store what this returns, so a weaker copy elsewhere would leak.
+ *
+ * Masking deliberately errs toward over-redaction: a false positive only costs
+ * the reader some context, while a miss writes a secret to disk for 30 days.
+ * The rules cover labeled key/value pairs (`password`, `token`, Chinese
+ * 密码/令牌 …), HTTP credential headers, URL userinfo, CLI flags, copula forms
+ * (`token is …`), and well-known token shapes that appear without any label.
+ */
+export declare const TASK_EXCERPT_LIMIT = 512;
+/**
+ * Mask the credential forms that show up in a task excerpt. Exported so the
+ * storage layer can apply the same rules as a second boundary (it is cheap and
+ * idempotent), keeping a future caller that forgets `taskExcerpt` from writing
+ * a secret to the log.
+ */
+export declare function redactCredentials(input: string): string;
+export declare function stripInjected(input: string): string;
+export declare function taskExcerpt(state: unknown, limit?: number): string | undefined;

package/lib/host/excerpt.js

@@ -0,0 +1,76 @@
+const MAX_INPUT = 8 * 1024;
+const TASK_EXCERPT_LIMIT = 512;
+const TOKEN_KEYS = String.raw`token|api[ _-]*key`;
+const PHRASE_KEYS = String.raw`password|passw(?:or)?d|passphrase|secret[ _-]?key|access[ _-]?key|private[ _-]?key|secret`;
+const CN_KEYS = String.raw`密码|口令|密码短语|密钥|令牌|凭证|私钥`;
+const COMBINED_KEYS = String.raw`${PHRASE_KEYS}|${TOKEN_KEYS}`;
+const ENV_PHRASE_KEYS = String.raw`PASSW(?:OR)?D|SECRET|ACCESS[_-]?KEY|PRIVATE[_-]?KEY`;
+const ENV_TOKEN_KEYS = String.raw`TOKEN|API[_-]?KEY`;
+const SEPARATOR = String.raw`[:=：＝]`;
+const VALUE = String.raw`(?:"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\s,;}，；、]+)`;
+const CLAUSE = String.raw`(?:"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\r\n,;，；、]*)`;
+const COPULA = String.raw`is|are|was|were|是|为`;
+const VALUE_LIKE = String.raw`(?=\S*(?:\d|[A-Za-z0-9_-]{12,}))`;
+const TOKEN_SHAPES = [
+  [/\b(sk|pk|rk)-[A-Za-z0-9_-]{8,}/gi, "$1-[redacted]"],
+  [/\b(gh[pousr]_)[A-Za-z0-9]{20,}/g, "$1[redacted]"],
+  [/\b(xox[baprs]-)[A-Za-z0-9-]{10,}/g, "$1[redacted]"],
+  [/\b(AKIA)[0-9A-Z]{16}\b/g, "$1[redacted]"],
+  [/\b(glpat-)[A-Za-z0-9_-]{10,}/g, "$1[redacted]"],
+  [/\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]*/g, "[redacted]"]
+];
+const RULE = {
+  // Template placeholders (`{{SECRET_...}}`) hide a value inside braces the
+  // value rules deliberately do not consume, so mask the whole placeholder.
+  template: /\{\{[^{}\r\n]*\}\}/g,
+  bearer: /\bBearer\s+[^\s,;]+/gi,
+  urlUserinfo: /([a-z][a-z0-9+.-]*:\/\/)[^\s/]*@/gi,
+  header: new RegExp(String.raw`(\b(?:authorization|cookie|set-cookie)\b["']?\s*${SEPARATOR}\s*)[^\r\n]*`, "gi"),
+  phrase: new RegExp(String.raw`(\b(?:${PHRASE_KEYS})\b["']?\s*${SEPARATOR}\s*)${CLAUSE}`, "gi"),
+  cnKey: new RegExp(String.raw`((?:${CN_KEYS})\s*[:：＝]\s*)${VALUE}`, "g"),
+  token: new RegExp(String.raw`(\b(?:${TOKEN_KEYS})\b["']?\s*${SEPARATOR}\s*)${VALUE}`, "gi"),
+  asciiCopula: new RegExp(String.raw`(\b(?:${COMBINED_KEYS})\b\s*(?:${COPULA})\s*)${VALUE_LIKE}${VALUE}`, "gi"),
+  cnCopula: new RegExp(String.raw`((?:${CN_KEYS})\s*(?:是|为)\s*)${VALUE_LIKE}${VALUE}`, "g"),
+  flag: new RegExp(String.raw`(^|\s)(--(?:${COMBINED_KEYS})(?:\s+|=))${VALUE}`, "gi"),
+  // Env-style keys are often a suffix of a longer identifier (`DB_PASSWORD`,
+  // `AWS_SECRET_ACCESS_KEY`), where `\b` cannot match across `_`. JSON and quoted
+  // .env output place a closing quote between key and separator, and a quoted
+  // passphrase may contain spaces, so the key allows a quote and the value is the
+  // whole clause (over-redaction is the accepted direction).
+  envPhrase: new RegExp(String.raw`([A-Za-z0-9_]*(?:${ENV_PHRASE_KEYS})[A-Za-z0-9_]*["']?\s*${SEPARATOR}\s*)${CLAUSE}`, "gi"),
+  envToken: new RegExp(String.raw`([A-Za-z0-9_]*(?:${ENV_TOKEN_KEYS})[A-Za-z0-9_]*["']?\s*${SEPARATOR}\s*)${VALUE}`, "gi"),
+  // Legacy space form (`token abc`), but never swallow a copula: the rule above
+  // masks the value that follows it.
+  loose: new RegExp(String.raw`(\b(?:${COMBINED_KEYS})\b\s+)(?!(?:${COPULA})(?:\s|$)|${SEPARATOR})${VALUE}`, "gi")
+};
+function redactCredentials(input) {
+  let text = input.replace(RULE.template, "[redacted]");
+  text = text.replace(RULE.bearer, "Bearer [redacted]");
+  text = text.replace(RULE.urlUserinfo, "$1[redacted]@");
+  text = text.replace(RULE.header, "$1[redacted]");
+  text = text.replace(RULE.phrase, "$1[redacted]");
+  text = text.replace(RULE.cnKey, "$1[redacted]");
+  text = text.replace(RULE.token, "$1[redacted]");
+  text = text.replace(RULE.asciiCopula, "$1[redacted]");
+  text = text.replace(RULE.cnCopula, "$1[redacted]");
+  text = text.replace(RULE.flag, "$1$2[redacted]");
+  text = text.replace(RULE.envPhrase, "$1[redacted]");
+  text = text.replace(RULE.envToken, "$1[redacted]");
+  text = text.replace(RULE.loose, "$1[redacted]");
+  for (const [pattern, replacement] of TOKEN_SHAPES) text = text.replace(pattern, replacement);
+  return text;
+}
+function stripInjected(input) {
+  return input.replace(/<(openviking-context|system-reminder)\b[^>]*>[\s\S]*?<\/\1>/gi, " ").replace(/<(openviking-context|system-reminder)\b[\s\S]*$/i, " ");
+}
+function taskExcerpt(state, limit = TASK_EXCERPT_LIMIT) {
+  if (typeof state !== "string") return void 0;
+  const text = redactCredentials(stripInjected(state.slice(0, MAX_INPUT))).replace(/\s+/g, " ").trim();
+  return text ? text.slice(0, limit) : void 0;
+}
+export {
+  TASK_EXCERPT_LIMIT,
+  redactCredentials,
+  stripInjected,
+  taskExcerpt
+};

package/lib/host/index.d.ts

@@ -0,0 +1,6 @@
+import type { HostContext } from './types.js';
+export declare const name = "dsh-decision-layer";
+export declare const inject: string[];
+export declare function apply(ctx: HostContext, options?: {
+    configPath?: string;
+}): Promise<void>;

package/lib/host/index.js

@@ -0,0 +1,287 @@
+import { readFile } from "node:fs/promises";
+import { createUserMessage } from "@deepseek-ai/dsh-llm";
+import { resolveConfig, featureEnabled } from "./config-store.js";
+import { createBackend } from "./backend.js";
+import { createManagerRoutes } from "./manager-api.js";
+import { createSessionState } from "./session-state.js";
+import { createDangerGate, normalizeDangerRules } from "./danger-gate.js";
+import { createSelfCheck } from "./self-check.js";
+import { createNarrowing } from "./narrowing.js";
+import { createTaskCompletion } from "./task-completion.js";
+import { createLoopGuard } from "./loop-guard.js";
+import { createLogStore } from "./log-store.js";
+import { createStateStore } from "./state-store.js";
+import { createDecisionContext } from "./decision-context.js";
+import { analyzeSessionLogs, reconstructSessionSeed, listSessionDecisions } from "./log-analyze.js";
+import { isObject } from "./types.js";
+const name = "dsh-decision-layer";
+const inject = ["tools", "skills"];
+const asMessage = (value) => isObject(value) ? value : void 0;
+const textOf = (content) => Array.isArray(content) ? content.filter((block) => isObject(block) && block.type === "text" && typeof block.text === "string").map((block) => block.text).join("") : "";
+const derivedMessages = (agent) => {
+  const messages = agent?.session?.deriveMessages?.();
+  return Array.isArray(messages) ? messages : void 0;
+};
+function lastAssistantText(agent) {
+  try {
+    const messages = derivedMessages(agent);
+    if (!messages) return "";
+    for (let i = messages.length - 1; i >= 0; i--) {
+      const message = asMessage(messages[i]);
+      if (message?.role !== "assistant" || !Array.isArray(message.content)) continue;
+      return textOf(message.content);
+    }
+    return "";
+  } catch {
+    return "";
+  }
+}
+function agentTools(ctx, agent) {
+  try {
+    const schemas = typeof ctx.tools?.schemas === "function" ? ctx.tools.schemas(agent) : void 0;
+    if (!Array.isArray(schemas)) return [];
+    return schemas.filter((schema) => isObject(schema) && typeof schema.name === "string").map((schema) => ({ name: schema.name, description: typeof schema.description === "string" ? schema.description : "" }));
+  } catch {
+    return [];
+  }
+}
+async function apply(ctx, options = {}) {
+  const path = options.configPath;
+  const backend = createBackend({ config: () => resolveConfig({ path }) });
+  let logStore;
+  const stateStore = createStateStore();
+  const sessions = createSessionState({
+    onLog: (entry) => logStore?.append(entry),
+    // Restore a resumed session from its durable snapshot; if it has none yet but
+    // has persisted JSONL decision history (e.g. a session that predates this
+    // persistence, or whose snapshot was pruned), reconstruct a seed from the
+    // logs instead. Logs are read across all ports and filtered by the globally
+    // unique session id, so a changed instance port never orphans the history.
+    loadState: async (id) => await stateStore.load(id) ?? reconstructSessionSeed(id, {
+      trendConfig: (await resolveConfig({ path })).checkSettings
+    }).catch(() => void 0),
+    persistState: (id, state) => stateStore.save(id, state)
+  });
+  if (typeof ctx.effect === "function") ctx.effect(() => () => {
+    void stateStore.dispose();
+  });
+  const steeredIds = /* @__PURE__ */ new Map();
+  const rememberSteer = (message) => {
+    const id = isObject(message) && typeof message.id === "string" ? message.id : void 0;
+    if (!id) return;
+    steeredIds.set(id, true);
+    if (steeredIds.size > 256) steeredIds.delete(steeredIds.keys().next().value);
+  };
+  const steerAgent = (agent, text) => {
+    if (typeof agent.steer !== "function") throw new Error("Agent cannot be steered");
+    const message = createUserMessage({ content: [{ type: "text", text }], source: { kind: "user" } });
+    rememberSteer(message);
+    return agent.steer(message);
+  };
+  const decisionContext = createDecisionContext({ ignored: (id) => steeredIds.has(id) });
+  const gate = createDangerGate({
+    evaluate: (input, request) => backend.evaluate(input, request),
+    sessions,
+    rules: async () => normalizeDangerRules((await resolveConfig({ path })).dangerRules),
+    // Live config-backed floor (default 0.6): a `deny` only blocks once the model
+    // is at least this confident. Read per call so an edit takes effect at once.
+    minConfidence: async () => (await resolveConfig({ path })).gateSettings?.minConfidence,
+    // Read lazily (only when a dangerous call is recorded) so ordinary tool calls
+    // never pay for deriveMessages(). The gate itself still sends only the call
+    // summary; this excerpt is local-log context, from the same snapshot the other
+    // decision points use.
+    taskText: (agent) => decisionContext.snapshot(agent).context.request
+  });
+  const loopGuard = createLoopGuard({ sessions });
+  const featureOn = async (key) => {
+    try {
+      return featureEnabled((await resolveConfig({ path })).features, key);
+    } catch {
+      return true;
+    }
+  };
+  if (typeof ctx.on === "function") {
+    if (typeof ctx.tools.guard === "function") {
+      ctx.tools.guard((exec) => loopGuard.check(exec));
+      ctx.tools.guard((exec) => gate.guardReason(exec));
+    }
+    const install = () => {
+      const disposePre = ctx.on("tools/pre-execute", async (exec, next) => {
+        if (!await featureOn("gate")) return next();
+        return gate.preExecute(exec, next);
+      });
+      const disposePost = ctx.on("tools/post-execute", async (exec, result, next) => {
+        gate.observeResult(exec, result);
+        return next();
+      });
+      return () => {
+        disposePre?.();
+        disposePost?.();
+      };
+    };
+    if (typeof ctx.effect === "function") ctx.effect(install);
+    else install();
+    const selfCheck = createSelfCheck({
+      evaluate: (input, request) => backend.evaluate(input, request),
+      sessions,
+      settings: async () => (await resolveConfig({ path })).checkSettings,
+      steer: steerAgent
+    });
+    const installCheck = () => ctx.on("agent/turn-stopping", async (payload) => {
+      if (!await featureOn("check")) return;
+      const snapshot = decisionContext.snapshot(payload.agent);
+      return selfCheck.review({
+        agent: payload.agent,
+        turn: payload.turn,
+        signal: payload.signal,
+        output: lastAssistantText(payload.agent),
+        context: snapshot.context
+      });
+    });
+    if (typeof ctx.effect === "function") ctx.effect(installCheck);
+    else installCheck();
+    const taskCompletion = createTaskCompletion({
+      evaluate: (input, request) => backend.evaluate(input, request),
+      sessions,
+      settings: async () => (await resolveConfig({ path })).completeSettings,
+      steer: steerAgent
+    });
+    const installCompletion = () => ctx.on("agent/turn-stopping", async (payload) => {
+      if (!await featureOn("complete")) return;
+      const snapshot = decisionContext.snapshot(payload.agent);
+      return taskCompletion.review({
+        agent: payload.agent,
+        turn: payload.turn,
+        signal: payload.signal,
+        output: lastAssistantText(payload.agent),
+        // Conditions come only from this turn's real user text; evidence only from
+        // this turn's window, so an earlier task's successes cannot vouch for it.
+        userText: snapshot.conditionsText,
+        evidence: snapshot.evidence,
+        context: snapshot.context
+      });
+    });
+    if (typeof ctx.effect === "function") ctx.effect(installCompletion);
+    else installCompletion();
+    const narrowing = createNarrowing({
+      evaluate: (input, request) => backend.evaluate(input, request),
+      sessions,
+      settings: async () => (await resolveConfig({ path })).narrowSettings
+    });
+    const narrowedTurns = /* @__PURE__ */ new Map();
+    const releaseNarrowing = (id) => {
+      const entry = narrowedTurns.get(id);
+      if (!entry) return;
+      try {
+        entry.dispose?.();
+      } catch {
+      }
+      narrowedTurns.delete(id);
+    };
+    const installNarrowingHook = () => {
+      const disposeHook = ctx.on("agent/pre-step", async (payload, next) => {
+        const agent = payload?.agent;
+        const id = agent?.session?.id;
+        const turn = payload?.turn;
+        if (typeof id === "string") await sessions.ensureLoaded(id);
+        if (typeof id === "string" && Number.isInteger(turn)) {
+          const entered = decisionContext.enter(agent, { turn, messages: payload.messages });
+          const previous = narrowedTurns.get(id);
+          const turnChanged = !previous || previous.turn !== turn;
+          if (turnChanged || entered.changed) {
+            releaseNarrowing(id);
+            if (await featureOn("narrow")) {
+              const entry = { turn, dispose: void 0 };
+              narrowedTurns.set(id, entry);
+              if (narrowedTurns.size > 1024) {
+                const oldest = narrowedTurns.keys().next().value;
+                if (oldest !== id) releaseNarrowing(oldest);
+              }
+              try {
+                const { context } = entered.snapshot ?? decisionContext.snapshot(agent);
+                const result = await narrowing.review({
+                  agent,
+                  turn,
+                  step: payload.step,
+                  signal: payload.signal,
+                  state: { request: context.request, background: context.background, progress: context.progress },
+                  taskText: context.request,
+                  tools: agentTools(ctx, agent)
+                });
+                if (result.mode === "enforce" && result.applied && typeof agent?.ctx?.tools?.restrict === "function") {
+                  const restriction = agent.ctx.tools.restrict({ allow: result.keep });
+                  if (narrowedTurns.get(id) === entry) entry.dispose = restriction;
+                  else restriction?.();
+                }
+              } catch {
+              }
+            }
+          }
+        }
+        return next();
+      });
+      return () => {
+        disposeHook?.();
+        for (const key of [...narrowedTurns.keys()]) releaseNarrowing(key);
+      };
+    };
+    if (typeof ctx.effect === "function") ctx.effect(installNarrowingHook);
+    else installNarrowingHook();
+    const installNarrowingRelease = () => ctx.on("session/event", (subject, event) => {
+      if (!isObject(event) || event.type !== "turn/end") return;
+      const id = isObject(subject) && typeof subject.id === "string" ? subject.id : void 0;
+      if (id !== void 0) releaseNarrowing(id);
+    });
+    if (typeof ctx.effect === "function") ctx.effect(installNarrowingRelease);
+    else installNarrowingRelease();
+  }
+  const rawSkill = await readFile(new URL("../../skills/decision-layer/SKILL.md", import.meta.url), "utf8");
+  const content = rawSkill.replace(/^---\r?\n[\s\S]*?\r?\n---\r?\n/, "").trim();
+  ctx.skills.register({ name: "decision-layer", description: "\u663E\u5F0F\u53D1\u8D77\u7ED3\u6784\u5316\u88C1\u51B3\uFF0C\u8F85\u52A9\u660E\u786E\u8FB9\u754C\u7684\u9009\u62E9\u4E0E\u8BC4\u5206\u3002", content, source: "bundled" });
+  const output = { schema: { type: "object", additionalProperties: true }, render: (_args, value) => [{ type: "text", text: JSON.stringify(value) }] };
+  ctx.tools.register({
+    name: "decision_evaluate",
+    description: "\u5BF9 state \u548C questions \u6267\u884C\u4E00\u6B21\u663E\u5F0F\u7ED3\u6784\u5316\u88C1\u51B3\uFF0C\u4E0D\u4FEE\u6539 agent \u884C\u4E3A\u3002",
+    parameters: { type: "object", required: ["state", "questions"], properties: {
+      state: { oneOf: [{ type: "string" }, { type: "object", additionalProperties: true }, { type: "array", items: {} }] },
+      questions: { type: "object", additionalProperties: { type: "object", additionalProperties: true } }
+    }, additionalProperties: false },
+    output,
+    timeoutMs: 25e3,
+    execute: (args, exec) => backend.evaluate(args, { signal: exec.signal })
+  });
+  ctx.tools.register({
+    name: "decision_check_connection",
+    description: "\u5411\u88C1\u51B3\u7AEF\u70B9\u53D1\u9001\u4E00\u6B21\u8F7B\u91CF\u8FDE\u901A\u6D4B\u8BD5\uFF0C\u4E0D\u589E\u52A0\u81EA\u52A8\u88C1\u51B3\u6307\u6807\u3002",
+    parameters: { type: "object", properties: {}, additionalProperties: false },
+    output,
+    timeoutMs: 25e3,
+    execute: async (_args, exec) => {
+      const result = await backend.evaluate({ state: "Connection test", questions: {
+        connected: { type: "noul", instructions: "Is this a connection test?" }
+      } }, { signal: exec.signal });
+      return { connected: true, model: result.model, usage: result.usage };
+    }
+  });
+  ctx.inject(["webServer"], (web) => {
+    logStore = createLogStore({ port: web.webServer.port });
+    const port = web.webServer.port;
+    const analyze = async (sessionId) => analyzeSessionLogs(sessionId, {
+      port,
+      trendConfig: (await resolveConfig({ path })).checkSettings
+    });
+    const listRows = (sessionId, { page, pageSize } = {}) => listSessionDecisions(sessionId, { port, page, pageSize });
+    const unregister = createManagerRoutes({ path, sessions, backend, logStore, analyze, listRows, bindHost: web.webServer.host }).map((route) => web.webServer.register(route));
+    return () => {
+      unregister.forEach((dispose) => dispose());
+      const store = logStore;
+      logStore = void 0;
+      void store?.dispose();
+    };
+  });
+}
+export {
+  apply,
+  inject,
+  name
+};