dsh-decision-layer 0.7.2 → 0.7.3

package/README.en.md

@@ -4,7 +4,7 @@
 
 `dsh-decision-layer` adds structured, explicitly scoped decisions to the DeepSeek Harness (DSH) agent loop, backed by a pluggable adjudication backend. Dangerous-call gating, output self-check, tool narrowing, and loop prevention hook into the agent loop as automatic interventions.
 
-> **0.7.2 is a preview release.** The plugin works, but how much real value the adjudication interventions add is still being explored — every threshold is an unvalidated heuristic default. Treat it as something to observe, not a proven guarantee of impact. See [ROADMAP.md](<ROADMAP.md>) for scope and progress.
+> **0.7.3 is a preview release.** The plugin works, but how much real value the adjudication interventions add is still being explored — every threshold is an unvalidated heuristic default. Treat it as something to observe, not a proven guarantee of impact. See [ROADMAP.md](<ROADMAP.md>) for scope and progress.
 
 ## Installation
 
@@ -39,8 +39,8 @@ Restart `dsh web` and refresh after installing or updating: the host and client
 - **Manual verdicts** — `decision_evaluate` and the `decision-layer` skill submit `noul` / `score` / `choice` questions; `decision_check_connection` tests connectivity. Manual calls do not count as automatic decisions and do not change agent behavior.
 - **Dangerous-call gate** — before a destructive tool call, a redacted summary asks the backend for a verdict; only a high-confidence deny blocks the call. Allow, ask, low confidence, backend failure, and invalid responses do not intervene and run the host's original path. Rules and the block confidence floor are configurable. Gate rows carry the redacted command/path plus this turn's task excerpt, so a block can be reviewed in context.
 - **Output self-check and quality trend** — scores the final reply at turn end (0–2), observe-only by default; an opt-in low-score re-prompt fires at most once per turn. Several consecutive high-confidence low scores tint the dock trigger grey → amber → red as a reminder. Self-check rows carry the turn number and the same task excerpt, so you can tell which turn was scored.
-- **Tool narrowing** — at turn start, drops optional tools by task relevance, intersecting the host-allowed set and never expanding it; core tools and keep-prefix matches are always kept, over-cap falls back to observe-only, too-few-kept is treated as untrustworthy and skipped, and small-context backends are batched automatically. Enforced by default; observe-only is available. Narrowing logs include the turn number and an expandable task excerpt, so you can assess the dropped tools against the task; older logs are not backfilled.
-- **Task-completion review** — when the user spells out multiple delivery conditions, each is judged satisfied / unsatisfied / insufficient evidence, with tool evidence primary. Observe-only by default, with an opt-in re-prompt.
+- **Tool narrowing** — at turn start and again when a new user request arrives inside the same turn, drops optional tools by task relevance, intersecting the host-allowed set and never expanding it; each re-judgement releases the previous restriction first, the restriction is lifted when the turn stops, and notices such as time or background-job updates never trigger one. Core tools and keep-prefix matches are always kept, over-cap falls back to observe-only, too-few-kept is treated as untrustworthy and skipped, and small-context backends are batched automatically. Enforced by default; observe-only is available. Narrowing logs include the turn and step numbers plus an expandable task excerpt, so you can assess the dropped tools against the task; older logs are not backfilled.
+- **Task-completion review** — when the user spells out multiple delivery conditions, each is judged satisfied / unsatisfied / insufficient evidence. Conditions come only from the turn's latest request, so a retired list cannot be revived, and this turn's tool evidence is primary (an earlier turn's success does not count; self-reported completion is not evidence). Observe-only by default, with an opt-in re-prompt.
 - **Loop guard** — denies the same call repeated consecutively past a threshold; deterministic, local, and backend-free. The per-feature switches do not affect it, but the session master switch pauses it too.
 - **Session panel and decision-analysis view** — the panel shows automatic-decision metrics, the session master switch, and the recent log; the "Decision analysis" tab shows a per-session process profile, trend backtest, and decision accuracy, with per-row ratings and a session intervention switch.
 - **Configuration and persistence** — each decision point has its own switch and configurable thresholds in the plugin details, written to `~/.config/dsh-decision-layer/config.json` and applied live. Defaults and field names are in [ADR-0006](<docs/adr/0006-configurable-thresholds.md>). You can also edit that file by hand, but only with valid values: an out-of-range value, a misspelled field, or a wrong type makes the whole config fail validation, the config page cannot load it, and every decision point reverts to its own safe default (see [ADR-0005](<docs/adr/0005-config-wholesale-replace-and-live-reload.md>)). Decision logs and session metrics persist for 30 days for review and calibration.
@@ -50,18 +50,18 @@ Restart `dsh web` and refresh after installing or updating: the host and client
 
 Once a key is configured, the plugin sends adjudication requests to the remote endpoint `https://api.typesafe.ai` (model `jev-latest`) by default. The payload carries real context:
 
-- Gate: the tool name plus redacted command/path summaries (up to 2048 characters each).
-- Self-check: the turn's final reply (up to about 24K characters).
-- Narrowing: the text of this step's user messages (up to about 8K characters) plus candidate tool names/descriptions.
-- Task-completion review: delivery conditions extracted from this turn's user messages (up to 20), tool names with their ok/error status (no arguments or output), and the first ~8K characters of the reply.
+- Gate: the tool name plus redacted command/path summaries (up to 2048 characters each); no conversation content.
+- Self-check: this turn's request, the recent user asks and AI replies it needs for context (background only, each with its own budget, credentials masked), and the turn's final reply (up to about 24K characters).
+- Narrowing: the current request, the necessary recent background, and the latest execution progress (tool name, ok/error, bounded command/path and shell-result excerpts) plus candidate tool names/descriptions.
+- Task-completion review: delivery conditions extracted from this turn's latest user request (up to 20; a turn's earlier requests are not merged) and that request with its necessary background (credentials masked), this turn's tool evidence (tool name, ok/error, bounded command/path, plus a bounded shell-result excerpt with long unlabeled blobs masked again), and the first ~8K characters of the reply. Raw results from file reads, searches and network tools are never sent.
 - Manual verdicts: `decision_evaluate` and the `decision-layer` skill send whatever the agent submits, unchanged.
 
-User-message text may include context the host injects, such as workspace instructions (AGENTS.md), runtime details, and memory snippets. This content leaves your machine, and the remote provider may log, retain, or otherwise use it depending on its terms; redaction and truncation reduce risk but are not anonymization.
+Only real user messages are used as requests: host-injected content such as time notices, runtime details, memory snippets, system reminders and background-job updates is excluded or stripped, but anything you paste into the conversation still leaves your machine. The remote provider may log, retain, or otherwise use it depending on its terms; redaction and truncation reduce risk but are not anonymization.
 
-Two kinds of data are also stored locally for 30 days: decision logs in `~/.config/dsh-decision-layer/logs/` and session snapshots in `~/.config/dsh-decision-layer/state/`. They include redacted command/path summaries; the gate, self-check and narrowing rows carry a task excerpt (up to 512 characters, with injected memory/system-reminder blocks removed and common credential forms masked), the self-check and narrowing rows also carry the turn number, and completion rows hold only counts. The excerpts are written to the local logs/snapshots and shown in the local session panel and decision-analysis view only — outbound adjudication content is the list above; delete them yourself if needed.
+Two kinds of data are also stored locally for 30 days: decision logs in `~/.config/dsh-decision-layer/logs/` and session snapshots in `~/.config/dsh-decision-layer/state/`. They include redacted command/path summaries; every decision row's task excerpt is at most 512 characters (injected memory/system-reminder blocks removed, common credential forms masked) and a row may carry its turn and step numbers. No extra copies of the full background, execution progress, tool results or reply text are persisted — only the excerpt and decision counters. The excerpts are shown in the local session panel and decision-analysis view only; outbound adjudication content is the list above, and you can delete the local data yourself.
 
 **If your session content is sensitive, prefer a locally deployed model** so adjudication data never leaves the machine. `tev1` is served natively by ollama at `/v1/systemone`; see [Running with a local tev1](<docs/en/deploy-tev1-with-plugin.md>). Any other local model works as long as it exposes a compatible `/v1/systemone` endpoint, pointed to from the config page.
 
 ## Safety boundary and development
 
-Automatic intervention only subtracts: the gate only denies, narrowing only removes tools, and neither grants new permissions. The gate only blocks on a high-confidence deny; on backend failure, low confidence, or an invalid response it does not intervene and runs the host's original path. Self-check, narrowing, and loop-guard errors skip intervention. The redacted gate summary sent to the backend carries only tool name and command/path with secret redaction; the plugin never reads file content, but the command itself (for example a heredoc or text written with echo) is included as-is. Both halves are TypeScript under strict mode: `npm run build` type-checks with `tsc` and emits `lib/host/*.js` plus `lib/client.js` ([ADR-0015](<docs/adr/0015-typed-host-build.md>)); `npm test` builds first and then runs the tests, and `npm run check` matches CI (build, tests, and the packed-tarball check). Node.js `>=20.11` at runtime. **Build output is not committed** ([ADR-0012](<docs/adr/0012-distribution-via-github-actions.md>)): `lib/` is gitignored and the source is the only source of truth. Releases run through `.github/workflows/release.yml`, which builds, gates, `npm pack`s and then asserts with `scripts/assert-pack.mjs` that the tarball really carries the host entry and `lib/client.js`, and leaks no sources — only then does it publish to npm or open a Release. It runs when a version bump lands on main and publishes through npm Trusted Publishing (OIDC), so no long-lived token is involved. Architecture decisions live in [docs/adr/](<docs/adr/README.md>): why each rule exists and what was rejected. 0.7.2 is a preview: the interventions work, but their real value and thresholds are still being explored — feedback on misjudgments and feel observed in the decision log is welcome.
+Automatic intervention only subtracts: the gate only denies, narrowing only removes tools, and neither grants new permissions. The gate only blocks on a high-confidence deny; on backend failure, low confidence, or an invalid response it does not intervene and runs the host's original path. Self-check, narrowing, and loop-guard errors skip intervention. The redacted gate summary sent to the backend carries only tool name and command/path with secret redaction; the plugin never reads file content, but the command itself (for example a heredoc or text written with echo) is included as-is. Both halves are TypeScript under strict mode: `npm run build` type-checks with `tsc` and emits `lib/host/*.js` plus `lib/client.js` ([ADR-0015](<docs/adr/0015-typed-host-build.md>)); `npm test` builds first and then runs the tests, and `npm run check` matches CI (build, tests, and the packed-tarball check). Node.js `>=20.11` at runtime. **Build output is not committed** ([ADR-0012](<docs/adr/0012-distribution-via-github-actions.md>)): `lib/` is gitignored and the source is the only source of truth. Releases run through `.github/workflows/release.yml`, which builds, gates, `npm pack`s and then asserts with `scripts/assert-pack.mjs` that the tarball really carries the host entry and `lib/client.js`, and leaks no sources — only then does it publish to npm or open a Release. It runs when a version bump lands on main and publishes through npm Trusted Publishing (OIDC), so no long-lived token is involved. Architecture decisions live in [docs/adr/](<docs/adr/README.md>): why each rule exists and what was rejected. 0.7.3 is a preview: the interventions work, but their real value and thresholds are still being explored — feedback on misjudgments and feel observed in the decision log is welcome.

package/README.md

@@ -4,7 +4,7 @@
 
 DeepSeek Harness（DSH）的结构化裁决插件。它把有明确判断标准的问题交给同协议的裁决后端，供 agent 在需要时使用，并在 agent loop 上接入危险门控、产出自检、工具收窄和防循环等自动介入。
 
-> **0.7.2 是体验版。** 插件功能已可用，但裁决介入能带来多少实际价值仍在探索中——各决策点的阈值都是未经验证的启发式默认值，建议先以观察心态体验，别当成经过验证的效果保证。功能与后续进度以 [ROADMAP.md](<ROADMAP.md>) 为准。
+> **0.7.3 是体验版。** 插件功能已可用，但裁决介入能带来多少实际价值仍在探索中——各决策点的阈值都是未经验证的启发式默认值，建议先以观察心态体验，别当成经过验证的效果保证。功能与后续进度以 [ROADMAP.md](<ROADMAP.md>) 为准。
 
 ## 安装
 
@@ -39,8 +39,8 @@ dsh plugin --profile web add file:/绝对路径/dsh-decision-layer
 - **手动裁决**：`decision_evaluate` 工具与 `decision-layer` skill 可显式提交 `noul` / `score` / `choice` 问题，`decision_check_connection` 做连通测试；手动调用不计入自动裁决指标，也不改变 agent 行为。
 - **危险门控**：破坏性工具调用执行前用脱敏摘要请后端裁决，只有高置信「拒绝」才拦截；放行、询问、低置信、后端失败或响应不合法一律不介入，按宿主原路径执行。危险规则与拦截置信度门槛可配。门控日志带脱敏命令 / 路径与本轮任务节选，便于回看拦截是否合理。
 - **产出自检与质量趋势**：回合结束给最终回复打分（0–2），默认只记录；可开启低分补完，同一回合最多补一次。连续多次高置信低分时，dock 触发器图标会从灰变橙、变红作为提醒。自检日志带回合号与同一套任务节选，便于对照是哪一轮被打分。
-- **工具收窄**：回合开始时按任务相关性摘掉可选工具，只在宿主已允许的集合内取交集、不扩权；核心工具与保留前缀命中的工具始终保留，可选工具过多时自动降为仅观察、保留过少时视为判定不可信并跳过，对小上下文后端自动分批。默认真正生效，也可切到仅观察。收窄日志附带回合号和可展开的任务节选，便于对照被摘除的工具评估判断是否合理；旧日志不会补录场景。
-- **任务完成核对**：用户明确列出多个交付条件时，逐项判定「已满足 / 未满足 / 证据不足」，以工具证据为准；默认只观察，可配补完。
+- **工具收窄**：回合开始时、以及同一回合内你提出新要求时，按任务相关性摘掉可选工具，只在宿主已允许的集合内取交集、不扩权；每次重新判断前先释放上一轮的旧限制，回合结束即解除，时间提示、后台通知等非用户要求不会触发重判。核心工具与保留前缀命中的工具始终保留，可选工具过多时自动降为仅观察、保留过少时视为判定不可信并跳过，对小上下文后端自动分批。默认真正生效，也可切到仅观察。收窄日志附带回合号、步骤号和可展开的任务节选，便于对照被摘除的工具评估判断是否合理；旧日志不会补录场景。
+- **任务完成核对**：用户明确列出多个交付条件时，逐项判定「已满足 / 未满足 / 证据不足」，条件只取本回合最近一次要求（避免旧清单被恢复），以本回合工具证据为准（上一回合的成功不算数，回复自述不算证据）；默认只观察，可配补完。
 - **防循环**：同一调用连续重复超过阈值即拒绝，确定性本地逻辑，不依赖后端；不受各决策点开关影响，但会话总开关关闭时同样暂停。
 - **会话面板与决策分析页**：面板展示自动裁决指标、会话总开关和最近日志；「决策分析」tab 按会话展示过程画像、趋势回测与判断准确度，并支持逐条标注和开关本会话的自动介入。
 - **配置与持久化**：各决策点可独立开关，阈值在插件详情页调整，写入 `~/.config/dsh-decision-layer/config.json` 并热生效。默认值与字段说明见 [ADR-0006](<docs/adr/0006-configurable-thresholds.md>)。也可直接手改该文件，但只能写合法值：越界、拼错字段名或类型不符会让整份配置校验失败，配置页读不出来，各决策点退回各自的安全默认（见 [ADR-0005](<docs/adr/0005-config-wholesale-replace-and-live-reload.md>)）。决策日志与会话指标落盘 30 天，供回看和校准。
@@ -50,15 +50,15 @@ dsh plugin --profile web add file:/绝对路径/dsh-decision-layer
 
 配置 Key 后，插件默认把裁决请求发往远程端点 `https://api.typesafe.ai`（模型 `jev-latest`）。裁决会携带具体上下文：
 
-- 门控：工具名与脱敏后的命令 / 路径摘要（各最多 2048 字符）。
-- 产出自检：本轮最终回复（最多约 24K 字符）。
-- 工具收窄：本步 user 消息的文本（最多约 8K 字符）与候选工具的名称 / 描述。
-- 完成核对：从本回合 user 消息中提取的交付条件（最多 20 条）、工具名与成败状态（不含参数和输出）、回复前约 8K 字符。
+- 门控：工具名与脱敏后的命令 / 路径摘要（各最多 2048 字符），不含对话内容。
+- 产出自检：本轮请求、最近必要的用户要求与 AI 回复（作背景，各有限额度，已遮蔽凭据），以及本轮最终回复（最多约 24K 字符）。
+- 工具收窄：当前有效请求、必要前文与最近执行进展（工具名、成败、有限的命令 / 路径与 shell 结果摘录）与候选工具的名称 / 描述。
+- 完成核对：从本回合最近一次用户要求中提取的交付条件（最多 20 条，不合并同一回合的多次要求）、本回合最近一次要求与必要前文（作背景，已遮蔽凭据）、本回合工具证据（工具名、成败、有限的命令 / 路径，shell 类工具另有有限结果摘录，并对无标签的长随机串再遮蔽一次）、回复前约 8K 字符。文件读取、搜索与网络工具的结果原文不外发。
 - 手动裁决：`decision_evaluate` 与 `decision-layer` skill 会把 agent 提交的内容原样发送。
 
-user 消息的文本里可能含有宿主注入的上下文，例如工作区指令（AGENTS.md）、运行时信息和记忆片段。这些内容会离开本机，远程服务提供方可能记录、留存或用于其他用途，具体取决于其服务条款；脱敏和截断只降低风险，不等于匿名化。
+进入裁决的用户消息只取真实的那些，时间提示、运行环境、记忆片段、系统提醒与后台通知等宿主注入内容会被排除或剥离；但用户自己粘贴进对话的内容仍会离开本机。远程服务提供方可能记录、留存或用于其他用途，具体取决于其服务条款；脱敏和截断只降低风险，不等于匿名化。
 
-本地还会落盘两类数据，各保留 30 天：决策日志在 `~/.config/dsh-decision-layer/logs/`，会话快照在 `~/.config/dsh-decision-layer/state/`，其中包含脱敏后的命令 / 路径；门控、自检与收窄带任务节选（最多 512 字符，过滤记忆 / 系统提醒注入块并遮蔽常见凭据写法），自检与收窄另带回合号，完成核对目前只有条件计数。任务节选只写入本地日志 / 快照并展示在本地会话面板和决策分析页，不随裁决请求外发（外发内容以上一节逐项列出为准），可按需自行清理。
+本地还会落盘两类数据，各保留 30 天：决策日志在 `~/.config/dsh-decision-layer/logs/`，会话快照在 `~/.config/dsh-decision-layer/state/`，其中包含脱敏后的命令 / 路径；各决策行的任务节选最多 512 字符（过滤记忆 / 系统提醒注入块并遮蔽常见凭据写法），行上可带回合号与步骤号。落盘不额外保存完整前文、执行进展、工具结果或回复原文，只保留节选与决策计数。节选展示在本地会话面板和决策分析页，外发内容以上一节逐项列出为准，可按需自行清理。
 
 **会话内容敏感时，推荐改用本地部署的模型**，让裁决数据不出本机。`tev1` 可经 ollama 原生的 `/v1/systemone` 端点直接接入，部署步骤见 [用本地 tev1 配合插件（部署指南）](<docs/zh/deploy-tev1-with-plugin.md>)；其他本地模型只要提供兼容 `/v1/systemone` 的端点，同样可以在配置页把服务地址指向本机。
 
@@ -72,4 +72,4 @@ user 消息的文本里可能含有宿主注入的上下文，例如工作区指
 
 **构建产物不入库**（[ADR-0012](<docs/adr/0012-distribution-via-github-actions.md>)）：`lib/` 已被 `.gitignore` 覆盖，源码是唯一事实来源。发布由 GitHub Actions 的 `release.yml` 完成——构建、跑门禁、`npm pack`，并用 `scripts/assert-pack.mjs` 断言产物里确实有 host 入口与 `lib/client.js`、且没有源码泄漏，之后才发 npm / 建 Release。该 workflow 在版本号变更推入 main 时自动执行；npm 侧使用 Trusted Publishing（OIDC），不依赖长期 token。
 
-架构决策记录见 [docs/adr/](<docs/adr/README.md>)：每条规则为什么存在、当时放弃了哪些备选。0.7.2 为体验版：介入能力已可用，但实际价值与阈值仍在探索，欢迎反馈决策日志观察到的误判与体感。
+架构决策记录见 [docs/adr/](<docs/adr/README.md>)：每条规则为什么存在、当时放弃了哪些备选。0.7.3 为体验版：介入能力已可用，但实际价值与阈值仍在探索，欢迎反馈决策日志观察到的误判与体感。

package/docs/en/DETAIL.md

@@ -6,8 +6,8 @@ A structured set of explicitly scoped decisions for the DeepSeek Harness agent l
 
 - **Dangerous-call gate** — before a destructive tool call, a redacted summary asks the backend for a verdict; only a high-confidence deny blocks the call, while backend failures, low confidence, and invalid responses fall back to the host's original path.
 - **Output self-check and quality trend** — scores the final reply at turn end and can append one re-prompt when the score is low and the model is confident; several consecutive confident low scores raise an alert on the trigger button.
-- **Task-completion review** — when the user lists multiple delivery conditions, each is judged satisfied / unsatisfied / insufficient evidence, with tool evidence primary and self-reported completion not counting.
-- **Tool narrowing** — at turn start, judges each optional tool's relevance to the task and drops the ones not needed, intersecting the host-allowed set and never expanding it.
+- **Task-completion review** — when the user lists multiple delivery conditions, each is judged satisfied / unsatisfied / insufficient evidence. Conditions come only from the turn's latest request, with this turn's tool evidence primary (an earlier turn's success does not count) and self-reported completion not counting.
+- **Tool narrowing** — at turn start, and again when a new user request arrives inside the same turn, judges each optional tool's relevance to the task and drops the ones not needed; each re-judgement releases the previous restriction first, and notices such as time or background-job updates trigger no re-judgement. It intersects the host-allowed set and never expands it.
 - **Loop guard** — denies the same call repeated consecutively past a threshold; deterministic and backend-free.
 - **Decision panel and analysis view** — shows automatic-decision metrics and the decision log, and lets you rate each decision correct / wrong / unsure; the analysis view's header can enable or disable automatic interventions for the current session.
 

package/docs/zh/DETAIL.md

@@ -6,8 +6,8 @@
 
 - **危险调用门控**：破坏性工具调用执行前，用脱敏摘要请后端裁决；只有高置信「拒绝」才拦截，后端失败、低置信或响应不合法时一律按宿主原路径执行。
 - **产出自检与质量趋势**：回合结束给最终回复打分，低分且模型有把握时可自动补一轮；连续多次高置信低分会在触发按钮上给出告警。
-- **任务完成核对**：用户明确列出多个交付条件时，逐项判定「已满足 / 未满足 / 证据不足」，以工具证据为准，回复自述不算证据。
-- **工具收窄**：回合开始时判断各可选工具与本轮任务的相关性，摘掉用不上的；只在宿主已允许的工具集内取交集，绝不扩权。
+- **任务完成核对**：用户明确列出多个交付条件时，逐项判定「已满足 / 未满足 / 证据不足」，条件只取本回合最近一次要求，以本回合工具证据为准（上一回合的成功不算数），回复自述不算证据。
+- **工具收窄**：回合开始时、以及同一回合内出现新的用户要求时，判断各可选工具与任务的相关性并摘掉用不上的；每次重新判断前先释放旧限制，时间提示与后台通知不触发重判。只在宿主已允许的工具集内取交集，绝不扩权。
 - **防循环**：同一调用连续重复超过阈值即拒绝，确定性本地逻辑，不依赖后端。
 - **决策面板与分析页**：展示自动裁决指标与决策日志，并可逐条标注「判对 / 判错 / 说不准」；分析页顶部可直接开关本会话的自动介入。
 

package/lib/client.js

@@ -81,6 +81,7 @@ var zh = {
   logNarrow: "\u6536\u7A84",
   logComplete: "\u5B8C\u6210\u6838\u5BF9",
   logTurn: "\u56DE\u5408 {turn}",
+  logTurnStep: "\u56DE\u5408 {turn} \xB7 \u7B2C {step} \u6B65",
   logTask: "\u573A\u666F\uFF08\u4EFB\u52A1\u8282\u9009\uFF09\uFF1A",
   logSuggested: "\u6A21\u578B\u5EFA\u8BAE",
   logEvalFailed: "\u8BC4\u4F30\u5931\u8D25",
@@ -91,8 +92,8 @@ var zh = {
   logPathLabel: "\u8DEF\u5F84\uFF1A",
   logSubjectLabel: "\u8BF7\u6C42\uFF1A",
   logScoreHint: "\u5F97\u5206\u4E3A\u5404\u6863\u4F4D\u6309\u6982\u7387\u52A0\u6743\u7684\u7ED3\u679C\uFF0C\u53EF\u80FD\u662F\u5C0F\u6570\uFF08\u5982 1.4\uFF09\uFF0C\u6EE1\u5206\u4E3A\u9876\u6863\u53F7 2\u3002",
-  logCheckHint: "\u6BCF\u56DE\u5408\u7ED3\u675F\u540E\uFF0C\u628A\u8FD9\u8F6E AI \u7684\u6700\u7EC8\u56DE\u590D\u4EA4\u7ED9\u88C1\u51B3\u6A21\u578B\uFF0C\u6309\u300C\u4E25\u91CD\u9057\u6F0F/\u81EA\u76F8\u77DB\u76FE \u2192 \u6709\u5C0F\u9057\u6F0F \u2192 \u5B8C\u6574\u51C6\u786E\u300D\u4E09\u6863\u6253\u4E00\u4E2A 0\u20132 \u7684\u8D28\u91CF\u5206\uFF0C\u7528\u6765\u53D1\u73B0\u9057\u6F0F\u6216\u77DB\u76FE\uFF1B\u81EA\u68C0\u884C\uFF08\u542B\u540E\u7AEF\u5931\u8D25\u884C\uFF09\u4F1A\u5E26\u672C\u56DE\u5408\u7684\u4EFB\u52A1\u8282\u9009\uFF08\u6700\u591A 512 \u5B57\uFF0C\u5DF2\u906E\u853D\u51ED\u636E\uFF09\u3002",
-  logNarrowHint: "\u6BCF\u56DE\u5408\u5F00\u59CB\u65F6\uFF0C\u628A\u8FD9\u8F6E\u4EFB\u52A1\u4E0E\u5F53\u524D\u53EF\u7528\u5DE5\u5177\u9010\u4E2A\u4EA4\u7ED9\u88C1\u51B3\u6A21\u578B\u5224\u65AD\u76F8\u5173\u6027\uFF08noul\uFF09\uFF0C\u6458\u6389\u660E\u663E\u7528\u4E0D\u4E0A\u7684\u5DE5\u5177\uFF0C\u53EA\u5728\u5F53\u524D\u5BBF\u4E3B\u5DF2\u5141\u8BB8\u7684\u96C6\u5408\u5185\u53D6\u4EA4\u96C6\u3001\u7EDD\u4E0D\u6269\u6743\uFF1B\u300C\u4EC5\u89C2\u5BDF\u300D\u53EA\u8BB0\u5F55\u5EFA\u8BAE\uFF0C\u300C\u5DF2\u751F\u6548\u300D\u624D\u771F\u6B63\u5BF9\u672C\u56DE\u5408\u9650\u5236\u5DE5\u5177\u3002",
+  logCheckHint: "\u6BCF\u56DE\u5408\u7ED3\u675F\u540E\uFF0C\u628A\u8FD9\u8F6E AI \u7684\u6700\u7EC8\u56DE\u590D\u8FDE\u540C\u672C\u8F6E\u8BF7\u6C42\u4E0E\u5FC5\u8981\u524D\u6587\uFF08\u6700\u8FD1\u4E00\u6761\u7528\u6237\u8981\u6C42\u4E0E AI \u56DE\u590D\uFF0C\u4F5C\u80CC\u666F\uFF0C\u5747\u5DF2\u906E\u853D\u51ED\u636E\uFF09\u4EA4\u7ED9\u88C1\u51B3\u6A21\u578B\uFF0C\u6309\u300C\u4E25\u91CD\u9057\u6F0F/\u81EA\u76F8\u77DB\u76FE \u2192 \u6709\u5C0F\u9057\u6F0F \u2192 \u5B8C\u6574\u51C6\u786E\u300D\u4E09\u6863\u6253\u4E00\u4E2A 0\u20132 \u7684\u8D28\u91CF\u5206\uFF0C\u7528\u6765\u53D1\u73B0\u9057\u6F0F\u6216\u77DB\u76FE\uFF1B\u81EA\u68C0\u884C\uFF08\u542B\u540E\u7AEF\u5931\u8D25\u884C\uFF09\u4F1A\u5E26\u672C\u56DE\u5408\u7684\u4EFB\u52A1\u8282\u9009\uFF08\u6700\u591A 512 \u5B57\uFF0C\u5DF2\u906E\u853D\u51ED\u636E\uFF09\u3002",
+  logNarrowHint: "\u6BCF\u56DE\u5408\u5F00\u59CB\u65F6\uFF0C\u4EE5\u53CA\u540C\u4E00\u56DE\u5408\u5185\u4F60\u63D0\u51FA\u65B0\u8981\u6C42\u65F6\uFF0C\u628A\u5F53\u524D\u8BF7\u6C42\u3001\u5FC5\u8981\u524D\u6587\u4E0E\u6700\u8FD1\u6267\u884C\u8FDB\u5C55\u8FDE\u540C\u53EF\u7528\u5DE5\u5177\u9010\u4E2A\u4EA4\u7ED9\u88C1\u51B3\u6A21\u578B\u5224\u65AD\u76F8\u5173\u6027\uFF08noul\uFF09\uFF0C\u6458\u6389\u660E\u663E\u7528\u4E0D\u4E0A\u7684\u5DE5\u5177\uFF0C\u53EA\u5728\u5F53\u524D\u5BBF\u4E3B\u5DF2\u5141\u8BB8\u7684\u96C6\u5408\u5185\u53D6\u4EA4\u96C6\u3001\u7EDD\u4E0D\u6269\u6743\uFF1B\u300C\u4EC5\u89C2\u5BDF\u300D\u53EA\u8BB0\u5F55\u5EFA\u8BAE\uFF0C\u300C\u5DF2\u751F\u6548\u300D\u624D\u771F\u6B63\u5BF9\u672C\u56DE\u5408\u9650\u5236\u5DE5\u5177\u3002\u65F6\u95F4\u63D0\u793A\u3001\u540E\u53F0\u901A\u77E5\u7B49\u975E\u7528\u6237\u8981\u6C42\u4E0D\u4F1A\u89E6\u53D1\u91CD\u65B0\u5224\u65AD\u3002",
   actionDeny: "\u5DF2\u62D2\u7EDD",
   actionAsk: "\u8F6C\u4EA4\u5BA1\u6279",
   actionPass: "\u672A\u5E72\u9884",
@@ -117,7 +118,7 @@ var zh = {
   selfCheckHint: "\u6BCF\u56DE\u5408\u7ED3\u675F\u7ED9\u6700\u7EC8\u56DE\u590D\u6253\u5206\uFF080\u20132\uFF0C\u6309\u5404\u6863\u4F4D\u6982\u7387\u52A0\u6743\uFF0C\u53EF\u80FD\u662F\u5C0F\u6570\u5982 1.4\uFF09\u3002\u5173\u95ED\uFF1A\u53EA\u628A\u4F4E\u5206\u8BB0\u8FDB\u65E5\u5FD7\u548C\u7EDF\u8BA1\uFF0C\u4E0D\u6253\u65AD\u5BF9\u8BDD\u3002\u5F00\u542F\uFF1A\u5F97\u5206\u504F\u4F4E\uFF08\u22641\uFF09\u4E14\u6A21\u578B\u6709\u628A\u63E1\u65F6\uFF0C\u81EA\u52A8\u4EE5\u4F60\u7684\u540D\u4E49\u8FFD\u52A0\u4E00\u6761\u63D0\u793A\uFF0C\u8BA9 AI \u590D\u6838\u6709\u65E0\u9057\u6F0F\u6216\u77DB\u76FE\u5E76\u8865\u5B8C\uFF1B\u7F6E\u4FE1\u5EA6\u504F\u4F4E\u7684\u6253\u5206\u53EA\u8BB0\u5F55\u3001\u4E0D\u6253\u65AD\uFF0C\u540C\u4E00\u56DE\u5408\u6700\u591A\u8865\u4E00\u6B21\u3002",
   narrow: "\u5DE5\u5177\u6536\u7A84",
   narrowObserveLabel: "\u4EC5\u89C2\u5BDF\uFF08\u4E0D\u771F\u6B63\u9650\u5236\u5DE5\u5177\uFF09",
-  narrowHint: "\u6BCF\u56DE\u5408\u5F00\u59CB\u65F6\uFF0C\u7528\u88C1\u51B3\u6A21\u578B\u5224\u65AD\u5F53\u524D\u53EF\u9009\u5DE5\u5177\u4E0E\u8FD9\u8F6E\u4EFB\u52A1\u7684\u76F8\u5173\u6027\uFF0C\u6458\u6389\u7528\u4E0D\u4E0A\u7684\uFF1B\u8BFB\u5199\u3001\u7F16\u8F91\u3001Shell\u3001\u68C0\u7D22\u3001\u5F85\u529E\u7B49\u6838\u5FC3\u5DE5\u5177\u59CB\u7EC8\u4FDD\u7559\u3001\u4E0D\u53C2\u4E0E\u5224\u5B9A\u3002\u9ED8\u8BA4\u771F\u6B63\u751F\u6548\uFF1A\u672C\u56DE\u5408\u53EA\u4FDD\u7559\u5224\u4E3A\u76F8\u5173\u7684\u5DE5\u5177\uFF0C\u4E14\u53EA\u5728\u5BBF\u4E3B\u5DF2\u5141\u8BB8\u7684\u8303\u56F4\u5185\u53D6\u4EA4\u96C6\u3001\u4E0D\u6269\u6743\u3002\u5F00\u542F\u300C\u4EC5\u89C2\u5BDF\u300D\u540E\u53EA\u628A\u53EF\u6458\u6389\u7684\u5DE5\u5177\u8BB0\u8FDB\u65E5\u5FD7\u548C\u7EDF\u8BA1\uFF0C\u4E0D\u6539\u52A8\u5DE5\u5177\u96C6\u3002\u4E09\u91CD\u4FDD\u62A4\uFF1A\u6838\u5FC3\u5DE5\u5177\u59CB\u7EC8\u4FDD\u7559\uFF1B\u53EF\u9009\u5DE5\u5177\u8D85\u8FC7 20 \u4E2A\u65F6\u81EA\u52A8\u53EA\u89C2\u5BDF\u4E0D\u9650\u5236\uFF1B\u4FDD\u7559\u4E0B\u6765\u4E0D\u8DB3 5 \u4E2A\u65F6\u89C6\u4E3A\u5224\u5B9A\u4E0D\u53EF\u4FE1\u3001\u8DF3\u8FC7\u3002",
+  narrowHint: "\u6BCF\u56DE\u5408\u5F00\u59CB\u65F6\u3001\u4EE5\u53CA\u540C\u4E00\u56DE\u5408\u5185\u4F60\u63D0\u51FA\u65B0\u8981\u6C42\u65F6\uFF0C\u7528\u88C1\u51B3\u6A21\u578B\u5224\u65AD\u5F53\u524D\u53EF\u9009\u5DE5\u5177\u4E0E\u4EFB\u52A1\u7684\u76F8\u5173\u6027\uFF0C\u6458\u6389\u7528\u4E0D\u4E0A\u7684\uFF1B\u8BFB\u5199\u3001\u7F16\u8F91\u3001Shell\u3001\u68C0\u7D22\u3001\u5F85\u529E\u7B49\u6838\u5FC3\u5DE5\u5177\u59CB\u7EC8\u4FDD\u7559\u3001\u4E0D\u53C2\u4E0E\u5224\u5B9A\u3002\u9ED8\u8BA4\u771F\u6B63\u751F\u6548\uFF1A\u672C\u56DE\u5408\u53EA\u4FDD\u7559\u5224\u4E3A\u76F8\u5173\u7684\u5DE5\u5177\uFF0C\u4E14\u53EA\u5728\u5BBF\u4E3B\u5DF2\u5141\u8BB8\u7684\u8303\u56F4\u5185\u53D6\u4EA4\u96C6\u3001\u4E0D\u6269\u6743\u3002\u5F00\u542F\u300C\u4EC5\u89C2\u5BDF\u300D\u540E\u53EA\u628A\u53EF\u6458\u6389\u7684\u5DE5\u5177\u8BB0\u8FDB\u65E5\u5FD7\u548C\u7EDF\u8BA1\uFF0C\u4E0D\u6539\u52A8\u5DE5\u5177\u96C6\u3002\u4E09\u91CD\u4FDD\u62A4\uFF1A\u6838\u5FC3\u5DE5\u5177\u59CB\u7EC8\u4FDD\u7559\uFF1B\u53EF\u9009\u5DE5\u5177\u8D85\u8FC7 20 \u4E2A\u65F6\u81EA\u52A8\u53EA\u89C2\u5BDF\u4E0D\u9650\u5236\uFF1B\u4FDD\u7559\u4E0B\u6765\u4E0D\u8DB3 5 \u4E2A\u65F6\u89C6\u4E3A\u5224\u5B9A\u4E0D\u53EF\u4FE1\u3001\u8DF3\u8FC7\u3002",
   narrowKeepLabel: "\u59CB\u7EC8\u4FDD\u7559\u7684\u5DE5\u5177\u524D\u7F00",
   narrowKeepHint: "\u540D\u5B57\u4EE5\u8FD9\u4E9B\u524D\u7F00\u5F00\u5934\u7684\u5DE5\u5177\u6C38\u8FDC\u4FDD\u7559\u3001\u4E0D\u53C2\u4E0E\u76F8\u5173\u6027\u5224\u5B9A\uFF0C\u9002\u5408\u8BB0\u5FC6/\u68C0\u7D22\u8FD9\u7C7B\u300C\u5E38\u9A7B\u3001\u6309\u9700\u89E6\u53D1\u300D\u7684\u5DE5\u5177\uFF08\u9ED8\u8BA4\u53EA\u6709 mcp__openviking\uFF09\u3002\u7528\u82F1\u6587\u9017\u53F7\u6216\u6362\u884C\u5206\u9694\u591A\u4E2A\u524D\u7F00\uFF1B\u7559\u7A7A\u5219\u4E0D\u989D\u5916\u4FDD\u7559\u3002",
   narrowMaxLabel: "\u5019\u9009\u5DE5\u5177\u4E0A\u9650",
@@ -160,7 +161,7 @@ var zh = {
   featureCheck: "\u4EA7\u51FA\u81EA\u68C0",
   featureCheckHint: "\u5173\u95ED\u540E\u4E0D\u518D\u5728\u56DE\u5408\u7ED3\u675F\u65F6\u7ED9\u6700\u7EC8\u56DE\u590D\u6253\u5206\u3002",
   featureNarrow: "\u5DE5\u5177\u6536\u7A84",
-  featureNarrowHint: "\u5173\u95ED\u540E\u4E0D\u518D\u5728\u56DE\u5408\u5F00\u59CB\u65F6\u8BC4\u4F30\u5DE5\u5177\u76F8\u5173\u6027\u3002\u9632\u5FAA\u73AF\u4E3A\u786E\u5B9A\u6027\u672C\u5730\u4FDD\u62A4\uFF0C\u4E0D\u53D7\u5404\u51B3\u7B56\u70B9\u5F00\u5173\u5F71\u54CD\uFF0C\u4F46\u4F1A\u8BDD\u603B\u5F00\u5173\u5173\u95ED\u65F6\u540C\u6837\u6682\u505C\u3002",
+  featureNarrowHint: "\u5173\u95ED\u540E\u4E0D\u518D\u5728\u56DE\u5408\u5F00\u59CB\u3001\u6216\u540C\u4E00\u56DE\u5408\u5185\u51FA\u73B0\u65B0\u7684\u7528\u6237\u8981\u6C42\u65F6\u8BC4\u4F30\u5DE5\u5177\u76F8\u5173\u6027\u3002\u9632\u5FAA\u73AF\u4E3A\u786E\u5B9A\u6027\u672C\u5730\u4FDD\u62A4\uFF0C\u4E0D\u53D7\u5404\u51B3\u7B56\u70B9\u5F00\u5173\u5F71\u54CD\uFF0C\u4F46\u4F1A\u8BDD\u603B\u5F00\u5173\u5173\u95ED\u65F6\u540C\u6837\u6682\u505C\u3002",
   featureComplete: "\u4EFB\u52A1\u5B8C\u6210\u6838\u5BF9",
   featureCompleteHint: "\u5173\u95ED\u540E\u4E0D\u518D\u5728\u56DE\u5408\u7ED3\u675F\u65F6\u9010\u9879\u6838\u5BF9\u7528\u6237\u660E\u786E\u5217\u51FA\u7684\u4EA4\u4ED8\u6761\u4EF6\u3002",
   trendWarnHint: "\u672C\u4F1A\u8BDD\u6700\u8FD1\u8FDE\u7EED\u51E0\u8F6E\u4EA7\u51FA\u8D28\u91CF\u504F\u4F4E\uFF08\u9AD8\u7F6E\u4FE1\uFF09\u3002\u53EF\u80FD\u662F\u4EFB\u52A1\u96BE\u5EA6\u4E0A\u5347\u6216\u6A21\u578B\u72B6\u6001\u6CE2\u52A8\uFF0C\u5EFA\u8BAE\u5C1D\u8BD5\u8C03\u6574 prompt \u6216\u66F4\u6362\u6A21\u578B\u3002",
@@ -172,7 +173,7 @@ var zh = {
   rateSummary: "\u5DF2\u6807\u6CE8 {rated} \u6761\uFF08\u5224\u5BF9 {good} / \u5224\u9519 {bad} / \u8BF4\u4E0D\u51C6 {unsure}\uFF09",
   annotateFailed: "\u6807\u6CE8\u4FDD\u5B58\u5931\u8D25\uFF0C\u8BF7\u91CD\u8BD5\u3002",
   completeSteer: "\u6709\u672A\u6EE1\u8DB3\u6761\u4EF6\u65F6\u81EA\u52A8\u8865\u4E00\u8F6E",
-  completeHint: "\u56DE\u5408\u7ED3\u675F\u65F6\uFF0C\u5BF9\u7528\u6237\u660E\u786E\u5217\u51FA\u7684\u591A\u4E2A\u4EA4\u4ED8\u6761\u4EF6\uFF08\u7F16\u53F7 / \u9879\u76EE\u7B26\u53F7 / \u591A\u547D\u4EE4\uFF09\u9010\u9879\u5224\u5B9A\u300C\u5DF2\u6EE1\u8DB3 / \u672A\u6EE1\u8DB3 / \u8BC1\u636E\u4E0D\u8DB3\u300D\uFF0C\u4EE5\u5DE5\u5177\u8BC1\u636E\u4E3A\u51C6\u3001\u56DE\u590D\u81EA\u79F0\u5B8C\u6210\u4E0D\u7B97\u8BC1\u636E\u3002\u5173\u95ED\uFF1A\u53EA\u628A\u7ED3\u679C\u8BB0\u8FDB\u65E5\u5FD7\u548C\u7EDF\u8BA1\uFF0C\u4E0D\u6253\u65AD\u5BF9\u8BDD\u3002\u5F00\u542F\uFF1A\u786E\u6709\u6761\u4EF6\u88AB\u5224\u300C\u672A\u6EE1\u8DB3\u300D\u4E14\u6A21\u578B\u6709\u628A\u63E1\u65F6\uFF0C\u81EA\u52A8\u4EE5\u4F60\u7684\u540D\u4E49\u8FFD\u52A0\u4E00\u6761\u63D0\u793A\u8BA9 AI \u590D\u6838\u8865\u5B8C\uFF1B\u300C\u8BC1\u636E\u4E0D\u8DB3\u300D\u4E0D\u89E6\u53D1\u8865\u5B8C\uFF0C\u540C\u4E00\u56DE\u5408\u6700\u591A\u8865\u4E00\u6B21\u3002",
+  completeHint: "\u56DE\u5408\u7ED3\u675F\u65F6\uFF0C\u5BF9\u7528\u6237\u5728\u672C\u56DE\u5408\u6700\u8FD1\u4E00\u6B21\u8981\u6C42\u4E2D\u660E\u786E\u5217\u51FA\u7684\u591A\u4E2A\u4EA4\u4ED8\u6761\u4EF6\uFF08\u7F16\u53F7 / \u9879\u76EE\u7B26\u53F7 / \u591A\u547D\u4EE4\uFF09\u9010\u9879\u5224\u5B9A\u300C\u5DF2\u6EE1\u8DB3 / \u672A\u6EE1\u8DB3 / \u8BC1\u636E\u4E0D\u8DB3\u300D\uFF0C\u4EE5\u5DE5\u5177\u8BC1\u636E\u4E3A\u51C6\u3001\u56DE\u590D\u81EA\u79F0\u5B8C\u6210\u4E0D\u7B97\u8BC1\u636E\u3002\u5173\u95ED\uFF1A\u53EA\u628A\u7ED3\u679C\u8BB0\u8FDB\u65E5\u5FD7\u548C\u7EDF\u8BA1\uFF0C\u4E0D\u6253\u65AD\u5BF9\u8BDD\u3002\u5F00\u542F\uFF1A\u786E\u6709\u6761\u4EF6\u88AB\u5224\u300C\u672A\u6EE1\u8DB3\u300D\u4E14\u6A21\u578B\u6709\u628A\u63E1\u65F6\uFF0C\u81EA\u52A8\u4EE5\u4F60\u7684\u540D\u4E49\u8FFD\u52A0\u4E00\u6761\u63D0\u793A\u8BA9 AI \u590D\u6838\u8865\u5B8C\uFF1B\u300C\u8BC1\u636E\u4E0D\u8DB3\u300D\u4E0D\u89E6\u53D1\u8865\u5B8C\uFF0C\u540C\u4E00\u56DE\u5408\u6700\u591A\u8865\u4E00\u6B21\u3002",
   completeResultOk: "\u6761\u4EF6\u9F50\u5907",
   completeResultUnsatisfied: "\u6709\u672A\u6EE1\u8DB3",
   completeConditions: "\u6761\u4EF6",
@@ -278,6 +279,7 @@ var en = {
   logNarrow: "Narrow",
   logComplete: "Completion",
   logTurn: "Turn {turn}",
+  logTurnStep: "Turn {turn} \xB7 step {step}",
   logTask: "Context (task excerpt): ",
   logSuggested: "model suggested",
   logEvalFailed: "evaluation failed",
@@ -288,8 +290,8 @@ var en = {
   logPathLabel: "path: ",
   logSubjectLabel: "request: ",
   logScoreHint: "The score is a probability-weighted mean across the levels, so it can be fractional (e.g. 1.4); the top score is the highest level number, 2.",
-  logCheckHint: "After each turn, the AI\u2019s final reply for that turn is sent to the adjudication model, which grades its quality on three levels (severe omission/contradiction \u2192 minor gaps \u2192 complete and accurate) as a 0\u20132 score, to catch omissions or contradictions; every self-check row (including a failed one) carries this turn\u2019s task excerpt (up to 512 characters, credentials masked).",
-  logNarrowHint: "At the start of each turn, the current task and each available tool are sent to the adjudication model (a noul per tool) to judge relevance, dropping tools clearly not needed. It only intersects the host-allowed set and never expands it; observe merely logs the suggestion, enforced actually restricts the tools for this turn.",
+  logCheckHint: "After each turn, the AI\u2019s final reply for that turn, together with the request and the necessary recent background (the last user ask and AI reply, credentials masked), is sent to the adjudication model, which grades its quality on three levels (severe omission/contradiction \u2192 minor gaps \u2192 complete and accurate) as a 0\u20132 score, to catch omissions or contradictions; every self-check row (including a failed one) carries this turn\u2019s task excerpt (up to 512 characters, credentials masked).",
+  logNarrowHint: "At the start of each turn, and again when a new user request arrives inside it, the current request, the necessary background and the latest execution progress are sent with each available tool to the adjudication model (a noul per tool) to judge relevance, dropping tools clearly not needed. It only intersects the host-allowed set and never expands it; observe merely logs the suggestion, enforced actually restricts the tools for this turn.",
   actionDeny: "denied",
   actionAsk: "sent to approval",
   actionPass: "no intervention",
@@ -314,7 +316,7 @@ var en = {
   selfCheckHint: "Each turn ends by scoring the final reply (0\u20132, a probability-weighted mean across the levels, so it can be fractional like 1.4). Off: low scores are only logged, the conversation is not interrupted. On: when the score is low (\u22641) and the model is confident enough, one prompt is appended on your behalf asking the AI to review for gaps or contradictions and finish the work; low-confidence scores are only logged, never interrupt, and at most one prompt per turn.",
   narrow: "Tool narrowing",
   narrowObserveLabel: "Observe only (do not restrict tools)",
-  narrowHint: "At the start of each turn, the adjudication model judges how relevant each optional tool is to the task and drops the ones not needed; core tools (read, write, edit, shell, search, todos) are always kept and never judged. Enforced by default: only the relevant tools are kept for this turn, intersected with the host-allowed set and never expanded. Turn on Observe only to just log the tools that could be dropped, without changing the tool set. Three safeguards: core tools always kept; more than 20 optional tools falls back to observe only; fewer than 5 tools remaining is treated as untrustworthy and skipped.",
+  narrowHint: "At the start of each turn, and again when a new user request arrives inside it, the adjudication model judges how relevant each optional tool is to the task and drops the ones not needed; core tools (read, write, edit, shell, search, todos) are always kept and never judged. Enforced by default: only the relevant tools are kept for this turn, intersected with the host-allowed set and never expanded. Turn on Observe only to just log the tools that could be dropped, without changing the tool set. Three safeguards: core tools always kept; more than 20 optional tools falls back to observe only; fewer than 5 tools remaining is treated as untrustworthy and skipped.",
   narrowKeepLabel: "Always-kept tool prefixes",
   narrowKeepHint: "Tools whose names start with any of these prefixes are always kept and never judged for relevance \u2014 good for resident, on-demand tools like memory/retrieval (defaults to mcp__openviking only). Separate prefixes with commas or newlines; leave empty to keep nothing extra.",
   narrowMaxLabel: "Candidate tool cap",
@@ -357,7 +359,7 @@ var en = {
   featureCheck: "Output self-check",
   featureCheckHint: "When off, the final reply is no longer scored at the end of a turn.",
   featureNarrow: "Tool narrowing",
-  featureNarrowHint: "When off, tool relevance is no longer evaluated at the start of a turn. The loop guard is a deterministic local safeguard outside these switches, but the session master switch pauses it too.",
+  featureNarrowHint: "When off, tool relevance is no longer evaluated at the start of a turn or when a new user request arrives inside it. The loop guard is a deterministic local safeguard outside these switches, but the session master switch pauses it too.",
   featureComplete: "Task completion check",
   featureCompleteHint: "When off, the explicit deliverable conditions the user listed are no longer checked at turn end.",
   trendWarnHint: "Output quality has been low for a few consecutive turns this session (high confidence). It may be rising task difficulty or model drift \u2014 consider adjusting the prompt or switching models.",
@@ -369,7 +371,7 @@ var en = {
   rateSummary: "Rated {rated} ({good} correct / {bad} wrong / {unsure} unsure)",
   annotateFailed: "Could not save the rating. Please retry.",
   completeSteer: "Auto re-prompt on an unmet condition",
-  completeHint: "At turn end, each explicit deliverable condition the user listed (numbered / bulleted / multi-command) is judged satisfied / unsatisfied / insufficient evidence, with tool evidence as the source of truth \u2014 a reply claiming completion is not evidence. Off: results are only logged, the conversation is not interrupted. On: when a condition is confidently judged unsatisfied, one prompt is appended on your behalf asking the AI to review and finish it; insufficient evidence never triggers a re-prompt, and at most one per turn.",
+  completeHint: "At turn end, each explicit deliverable condition in the latest user request of the turn (numbered / bulleted / multi-command) is judged satisfied / unsatisfied / insufficient evidence, with tool evidence as the source of truth \u2014 a reply claiming completion is not evidence. Off: results are only logged, the conversation is not interrupted. On: when a condition is confidently judged unsatisfied, one prompt is appended on your behalf asking the AI to review and finish it; insufficient evidence never triggers a re-prompt, and at most one per turn.",
   completeResultOk: "conditions met",
   completeResultUnsatisfied: "unmet found",
   completeConditions: "conditions",
@@ -477,10 +479,11 @@ function gateArgs({ t }, entry) {
   return /* @__PURE__ */ (0, import_jsx_runtime.jsx)("code", { className: "decision-log-cmd", title: `${label}${value}`, children: preview });
 }
 function turnTag(t, entry) {
-  return typeof entry.turn === "number" ? /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("span", { className: "decision-log-detail", children: [
+  if (typeof entry.turn !== "number") return null;
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("span", { className: "decision-log-detail", children: [
     " \xB7 ",
-    t("logTurn", { turn: entry.turn })
-  ] }) : null;
+    Number.isSafeInteger(entry.step) && entry.step >= 0 ? t("logTurnStep", { turn: entry.turn, step: entry.step }) : t("logTurn", { turn: entry.turn })
+  ] });
 }
 function renderGate({ t }, entry) {
   const tool = /* @__PURE__ */ (0, import_jsx_runtime.jsx)("code", { className: "decision-log-tool", children: entry.tool ?? "\u2014" });
@@ -667,7 +670,10 @@ function renderNarrow({ t }, entry) {
   ] });
 }
 function renderComplete({ t }, entry) {
-  const label = /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { children: t("logComplete") });
+  const label = /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
+    /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { children: t("logComplete") }),
+    turnTag(t, entry)
+  ] });
   if (entry.outcome === "error") return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
     label,
     " ",

package/lib/host/decision-context.d.ts

@@ -0,0 +1,21 @@
+import type { AgentLike, DecisionSnapshot } from './types.js';
+type Position = {
+    turn?: number;
+    messages?: unknown;
+};
+export declare function decisionText(value: unknown, maxBytes?: number): string;
+/**
+ * One agent's turn boundary, captured before inbox messages enter derived history.
+ * `ignored` drops messages the plugin produced itself (a steer carries `kind:user`
+ * for host compatibility but is our prompt, not the user's request).
+ */
+export declare function createDecisionContext({ ignored }?: {
+    ignored?: (id: string) => boolean;
+}): {
+    enter(agent: AgentLike | undefined, position: Position): {
+        changed: boolean;
+        snapshot?: DecisionSnapshot;
+    };
+    snapshot(agent: AgentLike | undefined): DecisionSnapshot;
+};
+export {};

package/lib/host/decision-context.js

@@ -0,0 +1,187 @@
+import { redactCredentials, stripInjected } from "./excerpt.js";
+import { summarizeExecution } from "./danger-gate.js";
+import { isObject } from "./types.js";
+function clip(text, maxBytes) {
+  let size = 0;
+  let result = "";
+  for (const char of text) {
+    size += Buffer.byteLength(char);
+    if (size > maxBytes) break;
+    result += char;
+  }
+  return result;
+}
+function decisionText(value, maxBytes = 1536) {
+  if (typeof value !== "string" || maxBytes <= 0) return "";
+  const clean = redactCredentials(stripInjected(value.slice(0, 32 * 1024))).trim();
+  return clip(clean, maxBytes);
+}
+const OPAQUE = /[A-Za-z0-9_+-]{24,}/g;
+const resultExcerpt = (value, maxBytes) => clip(decisionText(value, 32 * 1024).replace(OPAQUE, "[redacted]"), maxBytes);
+const messagesOf = (value) => Array.isArray(value) ? value.filter(isObject) : [];
+const textOf = (message) => Array.isArray(message.content) ? message.content.filter(isObject).filter((block) => block.type === "text" && typeof block.text === "string").map((block) => block.text).join("\n") : "";
+const human = (message) => message.role === "user" && (!message.source || isObject(message.source) && message.source.kind === "user");
+function historyOf(agent) {
+  try {
+    const derived = agent?.session?.deriveMessages?.();
+    return Array.isArray(derived) ? messagesOf(derived) : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function backgroundOf(messages, isHuman) {
+  const lastUser = messages.findLastIndex(isHuman);
+  const lastAssistant = messages.findLastIndex((message) => message.role === "assistant");
+  return [lastUser, lastAssistant].filter((index) => index >= 0).sort((a, b) => a - b).map((index) => {
+    const message = messages[index];
+    if (!message) return void 0;
+    const role = isHuman(message) ? "user" : "assistant";
+    return { role, text: decisionText(textOf(message), 512) };
+  }).filter((item) => Boolean(item?.text));
+}
+function evidenceOf(messages) {
+  const calls = /* @__PURE__ */ new Map();
+  const evidence = [];
+  for (const message of messages) {
+    if (message.role === "assistant" && Array.isArray(message.content)) {
+      for (const block of message.content.filter(isObject)) {
+        if (block.type !== "tool-call" || typeof block.id !== "string" || typeof block.name !== "string") continue;
+        let args = block.arguments;
+        if (typeof args === "string") {
+          try {
+            args = JSON.parse(args);
+          } catch {
+            args = void 0;
+          }
+        }
+        calls.set(block.id, { name: block.name, arguments: args });
+      }
+    }
+    if (message.role !== "tool") continue;
+    const source = isObject(message.source) ? message.source : {};
+    const id = typeof message.toolCallId === "string" ? message.toolCallId : source.callId;
+    const call = typeof id === "string" ? calls.get(id) : void 0;
+    const name = call?.name ?? (typeof message.name === "string" ? message.name : typeof message.toolName === "string" ? message.toolName : "");
+    if (!name) continue;
+    const item = { tool: decisionText(name, 96), outcome: message.isError === true ? "error" : "ok" };
+    if (call) {
+      const summary = summarizeExecution(call);
+      if (summary.command) item.command = decisionText(summary.command, 160);
+      if (summary.path) item.path = decisionText(summary.path, 160);
+    }
+    if (["bash", "pwsh", "shell", "exec", "terminal", "run_command"].includes(name)) {
+      const result = resultExcerpt(textOf(message), 256);
+      if (result) item.result = result;
+    }
+    evidence.push(item);
+  }
+  const bounded = evidence.length > 12 ? [...evidence.slice(0, 4), ...evidence.slice(-8)] : [...evidence];
+  while (Buffer.byteLength(JSON.stringify(bounded)) > 4096) bounded.shift();
+  return bounded;
+}
+const REPLACEMENTS = /* @__PURE__ */ new Set(["compact-checkpoint", "dsh-rewind"]);
+function afterLastReplacement(messages) {
+  for (let i = messages.length - 1; i >= 0; i--) {
+    const message = messages[i];
+    if (!message) continue;
+    const source = isObject(message.source) ? message.source : void 0;
+    if (source && typeof source.kind === "string" && REPLACEMENTS.has(source.kind)) return messages.slice(i + 1);
+  }
+  return messages;
+}
+function boundaryHolds(history, boundary) {
+  if (boundary.start <= 0) return true;
+  const previous = history[boundary.start - 1];
+  if (!previous) return false;
+  return previous === boundary.anchor || boundary.anchorId !== void 0 && previous.id === boundary.anchorId;
+}
+function snapshotOf(history, boundary, isHuman) {
+  const messages = history ?? [];
+  const lastHuman = messages.findLastIndex(isHuman);
+  const window = boundary === void 0 ? messages.slice(lastHuman >= 0 ? lastHuman : messages.length) : boundary.broken ? [] : boundaryHolds(messages, boundary) ? messages.slice(boundary.start) : [];
+  const current = afterLastReplacement(window);
+  const requests = boundary?.requests ?? current.filter(isHuman).map((message) => decisionText(textOf(message), 8192));
+  const request = decisionText(requests.at(-1) ?? "", 1536);
+  const evidence = evidenceOf(current);
+  const context = {
+    request,
+    // Earlier real requests in this turn stay visible as background: with only the
+    // last one, a short follow-up ("继续") would hide the main task. Pre-turn
+    // context is kept too, but the size cap below drops it first.
+    background: [
+      ...boundary?.background ?? backgroundOf(messages.slice(0, Math.max(lastHuman, 0)), isHuman),
+      ...requests.slice(0, -1).slice(-2).map((text) => ({ role: "user", text: decisionText(text, 1024) }))
+    ].slice(-4),
+    progress: evidence.slice(-3)
+  };
+  while (Buffer.byteLength(JSON.stringify(context.progress)) > 1024 && context.progress.length > 1) context.progress.shift();
+  while (Buffer.byteLength(JSON.stringify(context)) > 4096 && (context.background.length || context.progress.length > 1)) {
+    if (context.background.length) context.background.shift();
+    else context.progress.shift();
+  }
+  return {
+    context,
+    evidence,
+    // Completion conditions come from the latest real request only. Joining a
+    // turn's requests would resurrect work the user just cancelled ("drop the
+    // earlier list, only review"); when the latest request has no explicit
+    // conditions the check skips rather than infer from an older revision.
+    conditionsText: requests.at(-1) ?? ""
+  };
+}
+function createDecisionContext({ ignored } = {}) {
+  const boundaries = /* @__PURE__ */ new WeakMap();
+  const isHuman = (message) => human(message) && !(typeof message.id === "string" && ignored?.(message.id) === true);
+  const enter = (agent, position) => {
+    const known = agent ? boundaries.get(agent) : void 0;
+    const first = !known || known.turn !== position.turn;
+    const inputs = messagesOf(position.messages).filter(isHuman).map((message) => decisionText(textOf(message), 8192)).filter(Boolean);
+    if (!first && inputs.length === 0) return { changed: false };
+    const history = historyOf(agent);
+    let boundary = known;
+    const anchor = history?.at(-1);
+    if (first) {
+      boundary = {
+        turn: position.turn,
+        start: history?.length ?? 0,
+        anchor,
+        broken: history === void 0,
+        ...isObject(anchor) && typeof anchor.id === "string" ? { anchorId: anchor.id } : {},
+        requests: [],
+        background: history ? backgroundOf(history, isHuman) : []
+      };
+      if (agent) boundaries.set(agent, boundary);
+    } else if (boundary?.broken) {
+      boundary.broken = history === void 0;
+      boundary.start = history?.length ?? 0;
+      boundary.anchor = anchor;
+      if (isObject(anchor) && typeof anchor.id === "string") boundary.anchorId = anchor.id;
+      else delete boundary.anchorId;
+      boundary.background = history ? backgroundOf(history, isHuman) : [];
+    }
+    const active = boundary;
+    active.requests.push(...inputs);
+    active.requests = active.requests.slice(-8);
+    return { changed: true, snapshot: snapshotOf(history, active, isHuman) };
+  };
+  return {
+    enter(agent, position) {
+      try {
+        return enter(agent, position);
+      } catch {
+        return { changed: false };
+      }
+    },
+    snapshot(agent) {
+      try {
+        return snapshotOf(historyOf(agent), agent ? boundaries.get(agent) : void 0, isHuman);
+      } catch {
+        return { context: { request: "", background: [], progress: [] }, conditionsText: "", evidence: [] };
+      }
+    }
+  };
+}
+export {
+  createDecisionContext,
+  decisionText
+};

package/lib/host/excerpt.d.ts

@@ -22,4 +22,5 @@ export declare const TASK_EXCERPT_LIMIT = 512;
  * a secret to the log.
  */
 export declare function redactCredentials(input: string): string;
+export declare function stripInjected(input: string): string;
 export declare function taskExcerpt(state: unknown, limit?: number): string | undefined;

package/lib/host/excerpt.js

@@ -1,9 +1,11 @@
 const MAX_INPUT = 8 * 1024;
 const TASK_EXCERPT_LIMIT = 512;
 const TOKEN_KEYS = String.raw`token|api[ _-]*key`;
-const PHRASE_KEYS = String.raw`password|passwd|passphrase|secret`;
+const PHRASE_KEYS = String.raw`password|passw(?:or)?d|passphrase|secret[ _-]?key|access[ _-]?key|private[ _-]?key|secret`;
 const CN_KEYS = String.raw`密码|口令|密码短语|密钥|令牌|凭证|私钥`;
 const COMBINED_KEYS = String.raw`${PHRASE_KEYS}|${TOKEN_KEYS}`;
+const ENV_PHRASE_KEYS = String.raw`PASSW(?:OR)?D|SECRET|ACCESS[_-]?KEY|PRIVATE[_-]?KEY`;
+const ENV_TOKEN_KEYS = String.raw`TOKEN|API[_-]?KEY`;
 const SEPARATOR = String.raw`[:=：＝]`;
 const VALUE = String.raw`(?:"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\s,;}，；、]+)`;
 const CLAUSE = String.raw`(?:"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\r\n,;，；、]*)`;
@@ -30,6 +32,13 @@ const RULE = {
   asciiCopula: new RegExp(String.raw`(\b(?:${COMBINED_KEYS})\b\s*(?:${COPULA})\s*)${VALUE_LIKE}${VALUE}`, "gi"),
   cnCopula: new RegExp(String.raw`((?:${CN_KEYS})\s*(?:是|为)\s*)${VALUE_LIKE}${VALUE}`, "g"),
   flag: new RegExp(String.raw`(^|\s)(--(?:${COMBINED_KEYS})(?:\s+|=))${VALUE}`, "gi"),
+  // Env-style keys are often a suffix of a longer identifier (`DB_PASSWORD`,
+  // `AWS_SECRET_ACCESS_KEY`), where `\b` cannot match across `_`. JSON and quoted
+  // .env output place a closing quote between key and separator, and a quoted
+  // passphrase may contain spaces, so the key allows a quote and the value is the
+  // whole clause (over-redaction is the accepted direction).
+  envPhrase: new RegExp(String.raw`([A-Za-z0-9_]*(?:${ENV_PHRASE_KEYS})[A-Za-z0-9_]*["']?\s*${SEPARATOR}\s*)${CLAUSE}`, "gi"),
+  envToken: new RegExp(String.raw`([A-Za-z0-9_]*(?:${ENV_TOKEN_KEYS})[A-Za-z0-9_]*["']?\s*${SEPARATOR}\s*)${VALUE}`, "gi"),
   // Legacy space form (`token abc`), but never swallow a copula: the rule above
   // masks the value that follows it.
   loose: new RegExp(String.raw`(\b(?:${COMBINED_KEYS})\b\s+)(?!(?:${COPULA})(?:\s|$)|${SEPARATOR})${VALUE}`, "gi")
@@ -45,18 +54,23 @@ function redactCredentials(input) {
   text = text.replace(RULE.asciiCopula, "$1[redacted]");
   text = text.replace(RULE.cnCopula, "$1[redacted]");
   text = text.replace(RULE.flag, "$1$2[redacted]");
+  text = text.replace(RULE.envPhrase, "$1[redacted]");
+  text = text.replace(RULE.envToken, "$1[redacted]");
   text = text.replace(RULE.loose, "$1[redacted]");
   for (const [pattern, replacement] of TOKEN_SHAPES) text = text.replace(pattern, replacement);
   return text;
 }
+function stripInjected(input) {
+  return input.replace(/<(openviking-context|system-reminder)\b[^>]*>[\s\S]*?<\/\1>/gi, " ").replace(/<(openviking-context|system-reminder)\b[\s\S]*$/i, " ");
+}
 function taskExcerpt(state, limit = TASK_EXCERPT_LIMIT) {
   if (typeof state !== "string") return void 0;
-  const stripped = state.slice(0, MAX_INPUT).replace(/<(openviking-context|system-reminder)\b[^>]*>[\s\S]*?<\/\1>/gi, " ").replace(/<(openviking-context|system-reminder)\b[\s\S]*$/i, " ");
-  const text = redactCredentials(stripped).replace(/\s+/g, " ").trim();
+  const text = redactCredentials(stripInjected(state.slice(0, MAX_INPUT))).replace(/\s+/g, " ").trim();
   return text ? text.slice(0, limit) : void 0;
 }
 export {
   TASK_EXCERPT_LIMIT,
   redactCredentials,
+  stripInjected,
   taskExcerpt
 };

package/lib/host/index.js

@@ -11,6 +11,7 @@ import { createTaskCompletion } from "./task-completion.js";
 import { createLoopGuard } from "./loop-guard.js";
 import { createLogStore } from "./log-store.js";
 import { createStateStore } from "./state-store.js";
+import { createDecisionContext } from "./decision-context.js";
 import { analyzeSessionLogs, reconstructSessionSeed, listSessionDecisions } from "./log-analyze.js";
 import { isObject } from "./types.js";
 const name = "dsh-decision-layer";
@@ -35,50 +36,6 @@ function lastAssistantText(agent) {
     return "";
   }
 }
-function stepTaskText(messages) {
-  try {
-    if (!Array.isArray(messages)) return "";
-    return messages.map(asMessage).filter((message) => message?.role === "user" && Array.isArray(message.content)).flatMap((message) => message.content.filter((block) => isObject(block) && block.type === "text" && typeof block.text === "string").map((block) => block.text)).join("\n").slice(0, 8 * 1024);
-  } catch {
-    return "";
-  }
-}
-function turnUserText(agent) {
-  try {
-    const messages = derivedMessages(agent);
-    if (!messages) return "";
-    const texts = [];
-    let collecting = false;
-    for (let i = messages.length - 1; i >= 0; i--) {
-      const message = asMessage(messages[i]);
-      if (message?.role === "user" && Array.isArray(message.content)) {
-        collecting = true;
-        texts.unshift(message.content.filter((block) => isObject(block) && block.type === "text" && typeof block.text === "string").map((block) => block.text).join("\n"));
-      } else if (collecting) break;
-    }
-    return texts.join("\n").slice(0, 8 * 1024);
-  } catch {
-    return "";
-  }
-}
-function turnToolEvidence(agent) {
-  try {
-    const messages = derivedMessages(agent);
-    if (!messages) return [];
-    const evidence = [];
-    for (const item of messages) {
-      const message = asMessage(item);
-      if (message?.role !== "tool" || !Array.isArray(message.content)) continue;
-      const tool = typeof message.name === "string" ? message.name : typeof message.toolName === "string" ? message.toolName : "";
-      if (!tool) continue;
-      evidence.push({ tool: tool.slice(0, 128), outcome: message.isError === true ? "error" : "ok" });
-      if (evidence.length >= 40) break;
-    }
-    return evidence;
-  } catch {
-    return [];
-  }
-}
 function agentTools(ctx, agent) {
   try {
     const schemas = typeof ctx.tools?.schemas === "function" ? ctx.tools.schemas(agent) : void 0;
@@ -108,6 +65,20 @@ async function apply(ctx, options = {}) {
   if (typeof ctx.effect === "function") ctx.effect(() => () => {
     void stateStore.dispose();
   });
+  const steeredIds = /* @__PURE__ */ new Map();
+  const rememberSteer = (message) => {
+    const id = isObject(message) && typeof message.id === "string" ? message.id : void 0;
+    if (!id) return;
+    steeredIds.set(id, true);
+    if (steeredIds.size > 256) steeredIds.delete(steeredIds.keys().next().value);
+  };
+  const steerAgent = (agent, text) => {
+    if (typeof agent.steer !== "function") throw new Error("Agent cannot be steered");
+    const message = createUserMessage({ content: [{ type: "text", text }], source: { kind: "user" } });
+    rememberSteer(message);
+    return agent.steer(message);
+  };
+  const decisionContext = createDecisionContext({ ignored: (id) => steeredIds.has(id) });
   const gate = createDangerGate({
     evaluate: (input, request) => backend.evaluate(input, request),
     sessions,
@@ -116,8 +87,10 @@ async function apply(ctx, options = {}) {
     // is at least this confident. Read per call so an edit takes effect at once.
     minConfidence: async () => (await resolveConfig({ path })).gateSettings?.minConfidence,
     // Read lazily (only when a dangerous call is recorded) so ordinary tool calls
-    // never pay for deriveMessages().
-    taskText: (agent) => turnUserText(agent)
+    // never pay for deriveMessages(). The gate itself still sends only the call
+    // summary; this excerpt is local-log context, from the same snapshot the other
+    // decision points use.
+    taskText: (agent) => decisionContext.snapshot(agent).context.request
   });
   const loopGuard = createLoopGuard({ sessions });
   const featureOn = async (key) => {
@@ -152,19 +125,17 @@ async function apply(ctx, options = {}) {
       evaluate: (input, request) => backend.evaluate(input, request),
       sessions,
       settings: async () => (await resolveConfig({ path })).checkSettings,
-      steer: (agent, text) => {
-        if (typeof agent.steer !== "function") throw new Error("Agent cannot be steered");
-        return agent.steer(createUserMessage({ content: [{ type: "text", text }], source: { kind: "user" } }));
-      }
+      steer: steerAgent
     });
     const installCheck = () => ctx.on("agent/turn-stopping", async (payload) => {
       if (!await featureOn("check")) return;
+      const snapshot = decisionContext.snapshot(payload.agent);
       return selfCheck.review({
         agent: payload.agent,
         turn: payload.turn,
         signal: payload.signal,
         output: lastAssistantText(payload.agent),
-        userText: turnUserText(payload.agent)
+        context: snapshot.context
       });
     });
     if (typeof ctx.effect === "function") ctx.effect(installCheck);
@@ -173,20 +144,21 @@ async function apply(ctx, options = {}) {
       evaluate: (input, request) => backend.evaluate(input, request),
       sessions,
       settings: async () => (await resolveConfig({ path })).completeSettings,
-      steer: (agent, text) => {
-        if (typeof agent.steer !== "function") throw new Error("Agent cannot be steered");
-        return agent.steer(createUserMessage({ content: [{ type: "text", text }], source: { kind: "user" } }));
-      }
+      steer: steerAgent
     });
     const installCompletion = () => ctx.on("agent/turn-stopping", async (payload) => {
       if (!await featureOn("complete")) return;
+      const snapshot = decisionContext.snapshot(payload.agent);
       return taskCompletion.review({
         agent: payload.agent,
         turn: payload.turn,
         signal: payload.signal,
         output: lastAssistantText(payload.agent),
-        userText: turnUserText(payload.agent),
-        evidence: turnToolEvidence(payload.agent)
+        // Conditions come only from this turn's real user text; evidence only from
+        // this turn's window, so an earlier task's successes cannot vouch for it.
+        userText: snapshot.conditionsText,
+        evidence: snapshot.evidence,
+        context: snapshot.context
       });
     });
     if (typeof ctx.effect === "function") ctx.effect(installCompletion);
@@ -197,46 +169,71 @@ async function apply(ctx, options = {}) {
       settings: async () => (await resolveConfig({ path })).narrowSettings
     });
     const narrowedTurns = /* @__PURE__ */ new Map();
-    const installNarrowingHook = () => ctx.on("agent/pre-step", async (payload, next) => {
-      const agent = payload?.agent;
-      const id = agent?.session?.id;
-      const turn = payload?.turn;
-      if (typeof id === "string") await sessions.ensureLoaded(id);
-      if (typeof id === "string" && Number.isInteger(turn)) {
-        const state = narrowedTurns.get(id);
-        if (!state || state.turn !== turn) {
-          state?.dispose?.();
-          narrowedTurns.delete(id);
-          if (await featureOn("narrow")) {
-            const entry = { turn, dispose: void 0 };
-            narrowedTurns.set(id, entry);
-            if (narrowedTurns.size > 1024) {
-              const oldest = narrowedTurns.keys().next().value;
-              if (oldest !== id) {
-                narrowedTurns.get(oldest)?.dispose?.();
-                narrowedTurns.delete(oldest);
+    const releaseNarrowing = (id) => {
+      const entry = narrowedTurns.get(id);
+      if (!entry) return;
+      try {
+        entry.dispose?.();
+      } catch {
+      }
+      narrowedTurns.delete(id);
+    };
+    const installNarrowingHook = () => {
+      const disposeHook = ctx.on("agent/pre-step", async (payload, next) => {
+        const agent = payload?.agent;
+        const id = agent?.session?.id;
+        const turn = payload?.turn;
+        if (typeof id === "string") await sessions.ensureLoaded(id);
+        if (typeof id === "string" && Number.isInteger(turn)) {
+          const entered = decisionContext.enter(agent, { turn, messages: payload.messages });
+          const previous = narrowedTurns.get(id);
+          const turnChanged = !previous || previous.turn !== turn;
+          if (turnChanged || entered.changed) {
+            releaseNarrowing(id);
+            if (await featureOn("narrow")) {
+              const entry = { turn, dispose: void 0 };
+              narrowedTurns.set(id, entry);
+              if (narrowedTurns.size > 1024) {
+                const oldest = narrowedTurns.keys().next().value;
+                if (oldest !== id) releaseNarrowing(oldest);
               }
-            }
-            try {
-              const result = await narrowing.review({
-                agent,
-                turn,
-                signal: payload.signal,
-                state: stepTaskText(payload.messages),
-                tools: agentTools(ctx, agent)
-              });
-              if (result.mode === "enforce" && result.applied && typeof agent?.ctx?.tools?.restrict === "function") {
-                entry.dispose = agent.ctx.tools.restrict({ allow: result.keep });
+              try {
+                const { context } = entered.snapshot ?? decisionContext.snapshot(agent);
+                const result = await narrowing.review({
+                  agent,
+                  turn,
+                  step: payload.step,
+                  signal: payload.signal,
+                  state: { request: context.request, background: context.background, progress: context.progress },
+                  taskText: context.request,
+                  tools: agentTools(ctx, agent)
+                });
+                if (result.mode === "enforce" && result.applied && typeof agent?.ctx?.tools?.restrict === "function") {
+                  const restriction = agent.ctx.tools.restrict({ allow: result.keep });
+                  if (narrowedTurns.get(id) === entry) entry.dispose = restriction;
+                  else restriction?.();
+                }
+              } catch {
               }
-            } catch {
             }
           }
         }
-      }
-      return next();
-    });
+        return next();
+      });
+      return () => {
+        disposeHook?.();
+        for (const key of [...narrowedTurns.keys()]) releaseNarrowing(key);
+      };
+    };
     if (typeof ctx.effect === "function") ctx.effect(installNarrowingHook);
     else installNarrowingHook();
+    const installNarrowingRelease = () => ctx.on("session/event", (subject, event) => {
+      if (!isObject(event) || event.type !== "turn/end") return;
+      const id = isObject(subject) && typeof subject.id === "string" ? subject.id : void 0;
+      if (id !== void 0) releaseNarrowing(id);
+    });
+    if (typeof ctx.effect === "function") ctx.effect(installNarrowingRelease);
+    else installNarrowingRelease();
   }
   const rawSkill = await readFile(new URL("../../skills/decision-layer/SKILL.md", import.meta.url), "utf8");
   const content = rawSkill.replace(/^---\r?\n[\s\S]*?\r?\n---\r?\n/, "").trim();

package/lib/host/narrowing.d.ts

@@ -19,8 +19,11 @@ export declare function relevanceQuestions(state: unknown, tools: readonly ToolC
 export type NarrowTurn = {
     agent?: AgentLike;
     turn?: number;
+    step?: number;
     signal?: AbortSignal;
     state?: unknown;
+    /** Raw request text for the log row; `state` may now be a structured object. */
+    taskText?: unknown;
     tools?: unknown;
 };
 export type NarrowResult = {

package/lib/host/narrowing.js

@@ -106,9 +106,10 @@ function createNarrowing({
     }
     if (typeof sessions.log !== "function") return;
     try {
-      const task = taskExcerpt(turn?.state);
+      const task = taskExcerpt(turn?.taskText ?? turn?.state);
       const context = task ? { task } : {};
       if (Number.isSafeInteger(turn?.turn) && turn?.turn >= 0) context.turn = turn?.turn;
+      if (Number.isSafeInteger(turn?.step) && turn?.step >= 0) context.step = turn?.step;
       sessions.log(id, { kind: "narrow", outcome, ...context, ...detail });
     } catch {
     }
@@ -146,7 +147,7 @@ function createNarrowing({
       const keptNames = names.filter(alwaysKeep);
       const optional = tools.filter((tool) => !alwaysKeep(tool.name));
       if (optional.length < minCandidates) return { ...skip, keep: names };
-      const hasState = typeof turn?.state === "string" ? turn.state.trim().length > 0 : isObject(turn?.state) ? Object.keys(turn.state).length > 0 : false;
+      const hasState = typeof turn?.taskText === "string" ? turn.taskText.trim().length > 0 : typeof turn?.state === "string" ? turn.state.trim().length > 0 : isObject(turn?.state) ? Object.keys(turn.state).length > 0 : false;
       if (!hasState) return { ...skip, keep: names };
       const id = turn?.agent?.session?.id;
       if (sessions && typeof id === "string") {

package/lib/host/self-check.d.ts

@@ -1,6 +1,6 @@
-import type { AgentLike, CheckSettings, EvaluateInput, Evaluator, SessionsFace } from './types.js';
+import type { AgentLike, CheckSettings, DecisionContext, EvaluateInput, Evaluator, SessionsFace } from './types.js';
 export declare const DEFAULT_RUBRIC: readonly string[];
-export declare function scoreQuestion(output: unknown, rubric?: readonly string[]): EvaluateInput;
+export declare function scoreQuestion(output: unknown, rubric?: readonly string[], context?: DecisionContext): EvaluateInput;
 export declare const DEFAULT_MIN_CONFIDENCE = 0.4;
 export type CheckTurn = {
     agent?: AgentLike;
@@ -8,6 +8,7 @@ export type CheckTurn = {
     signal?: AbortSignal;
     output?: unknown;
     userText?: unknown;
+    context?: DecisionContext;
 };
 export type CheckResult = {
     evaluated: boolean;

package/lib/host/self-check.js

@@ -13,9 +13,15 @@ function boundedRubric(rubric) {
   const levels = rubric.filter((item) => typeof item === "string" && Boolean(item.trim()) && item.length <= 256).slice(0, 10);
   return levels.length >= 2 ? levels : DEFAULT_RUBRIC;
 }
-function scoreQuestion(output, rubric = DEFAULT_RUBRIC) {
+function scoreQuestion(output, rubric = DEFAULT_RUBRIC, context) {
   return {
-    state: { answer: String(output).slice(0, MAX_OUTPUT) },
+    state: {
+      // What the turn was asked to do. Without it the model scores an answer
+      // against nothing and cannot detect an off-topic reply.
+      ...context?.request ? { request: context.request } : {},
+      ...context?.background?.length ? { background: context.background } : {},
+      answer: String(output).slice(0, MAX_OUTPUT)
+    },
     questions: { quality: {
       type: "score",
       instructions: "\u6309\u4E0B\u5217\u4ECE\u4F4E\u5230\u9AD8\u7684\u6863\u4F4D\uFF0C\u8BC4\u4F30\u8FD9\u6B21\u6700\u7EC8\u4EA7\u51FA\u5BF9\u7528\u6237\u8BF7\u6C42\u7684\u5B8C\u6210\u8D28\u91CF\u3002",
@@ -59,6 +65,7 @@ function createSelfCheck({ evaluate, sessions, steer, settings, minConfidence =
     async review(turn) {
       const output = typeof turn?.output === "string" ? turn.output.trim() : "";
       if (!output) return { evaluated: false, lowScore: false, steered: false };
+      if (turn?.context !== void 0 && !turn.context.request) return { evaluated: false, lowScore: false, steered: false };
       const id = turn?.agent?.session?.id;
       if (sessions && typeof id === "string") {
         try {
@@ -67,13 +74,13 @@ function createSelfCheck({ evaluate, sessions, steer, settings, minConfidence =
           return { evaluated: false, lowScore: false, steered: false };
         }
       }
-      const task = taskExcerpt(turn?.userText);
+      const task = taskExcerpt(turn?.context?.request ?? turn?.userText);
       const taskDetail = task ? { task } : {};
       if (Number.isSafeInteger(turn?.turn) && turn?.turn >= 0) taskDetail.turn = turn?.turn;
       const { mode, rubric, lowScoreThreshold, minConfidence: confidenceFloor, trendMinConfidence, trendRun, trendSevereRun } = await resolveSettings();
       let answer;
       try {
-        const result = await evaluate(scoreQuestion(output, rubric), { signal: turn?.signal });
+        const result = await evaluate(scoreQuestion(output, rubric, turn?.context), { signal: turn?.signal });
         answer = result?.answers?.quality;
       } catch (error) {
         record(turn, "error", { ...taskDetail, reason: errorReason(error) });

package/lib/host/session-state.js

@@ -248,6 +248,7 @@ function createSessionState({ maxSessions = 1024, maxLogEntries = 50, onLog, loa
       if (typeof entry.path === "string" && entry.path.trim()) record.path = entry.path.replace(/\s+/g, " ").trim().slice(0, 512);
       if (typeof entry.task === "string" && entry.task.trim()) record.task = redactCredentials(entry.task).replace(/\s+/g, " ").trim().slice(0, 512);
       if (Number.isSafeInteger(entry.turn) && entry.turn >= 0) record.turn = entry.turn;
+      if (Number.isSafeInteger(entry.step) && entry.step >= 0) record.step = entry.step;
       if (typeof entry.mode === "string" && entry.mode) record.mode = entry.mode.slice(0, 16);
       if (typeof entry.score === "number" && Number.isFinite(entry.score)) record.score = Math.round(entry.score * 100) / 100;
       if (typeof entry.confidence === "number" && Number.isFinite(entry.confidence)) record.confidence = Math.round(entry.confidence * 100) / 100;

package/lib/host/task-completion.d.ts

@@ -1,6 +1,6 @@
-import type { AgentLike, CompleteSettings, EvaluateInput, Evaluator, SessionsFace } from './types.js';
+import type { AgentLike, CompleteSettings, DecisionContext, EvaluateInput, Evaluator, SessionsFace } from './types.js';
 export declare function extractConditions(userText: unknown): string[];
-export declare function completionQuestions(conditions: unknown, evidence: unknown, answer: unknown): EvaluateInput;
+export declare function completionQuestions(conditions: unknown, evidence: unknown, answer: unknown, context?: DecisionContext): EvaluateInput;
 export declare const DEFAULT_MIN_CONFIDENCE = 0.4;
 export type CompletionTurn = {
     agent?: AgentLike;
@@ -9,6 +9,7 @@ export type CompletionTurn = {
     output?: unknown;
     userText?: unknown;
     evidence?: unknown;
+    context?: DecisionContext;
 };
 export type CompletionResult = {
     evaluated: boolean;

package/lib/host/task-completion.js

@@ -1,3 +1,4 @@
+import { taskExcerpt } from "./excerpt.js";
 import { createSteerOnce } from "./steer-once.js";
 import { errorReason, isObject, isProbability } from "./types.js";
 const MAX_STATE = 8 * 1024;
@@ -30,19 +31,33 @@ function extractConditions(userText) {
     const compact = text.trim();
     if (!/[\r\n]/.test(compact)) {
       const parts = compact.split(/[、，,]/).map((part) => part.trim()).filter(Boolean);
-      if (parts.length >= 2) for (const part of parts) push(part);
+      const floor = compact.includes("\u3001") ? 2 : 3;
+      if (parts.length >= floor) for (const part of parts) push(part);
     }
   }
   return conditions.slice(0, MAX_CONDITIONS);
 }
-function completionQuestions(conditions, evidence, answer) {
+function completionQuestions(conditions, evidence, answer, context) {
   const items = Array.isArray(conditions) ? conditions.slice(0, MAX_CONDITIONS) : [];
-  const tools = Array.isArray(evidence) ? evidence.filter((item) => isObject(item) && typeof item.tool === "string").slice(0, MAX_EVIDENCE).map((item) => ({ tool: item.tool.slice(0, 128), outcome: item.outcome === "error" ? "error" : "ok" })) : [];
+  const tools = Array.isArray(evidence) ? evidence.filter((item) => isObject(item) && typeof item.tool === "string").slice(0, MAX_EVIDENCE).map((item) => {
+    const source = item;
+    const entry = {
+      tool: source.tool.slice(0, 128),
+      outcome: source.outcome === "error" ? "error" : "ok"
+    };
+    for (const key of ["command", "path", "result"]) {
+      const value = source[key];
+      if (typeof value === "string" && value.trim()) entry[key] = value.slice(0, 256);
+    }
+    return entry;
+  }) : [];
   const state = {
+    ...context?.request ? { request: context.request } : {},
+    ...context?.background?.length ? { background: context.background } : {},
     conditions: items.map((text, index) => ({ id: `c${index}`, text })),
     toolEvidence: tools,
     finalReply: String(answer ?? "").slice(0, MAX_STATE),
-    note: "\u5DE5\u5177\u8BC1\u636E\uFF08toolEvidence\uFF09\u662F\u5224\u5B9A\u4F9D\u636E\uFF1BfinalReply \u81EA\u79F0\u5B8C\u6210\u4E0D\u4F5C\u4E3A\u8BC1\u636E\u3002\u7F3A\u5C11\u8BC1\u636E\u65F6\u9009 insufficient_evidence\u3002"
+    note: "\u5DE5\u5177\u8BC1\u636E\uFF08toolEvidence\uFF09\u662F\u5224\u5B9A\u4F9D\u636E\uFF1BfinalReply \u81EA\u79F0\u5B8C\u6210\u4E0D\u4F5C\u4E3A\u8BC1\u636E\uFF0Cbackground \u53EA\u662F\u80CC\u666F\u800C\u4E0D\u662F\u672C\u8F6E\u8981\u6C42\u3002\u7F3A\u5C11\u8BC1\u636E\u65F6\u9009 insufficient_evidence\u3002"
   };
   const questions = Object.fromEntries(items.map((text, index) => [`c${index}`, {
     type: "choice",
@@ -91,6 +106,9 @@ function createTaskCompletion({ evaluate, sessions, steer, settings, minConfiden
   return {
     async review(turn) {
       const output = typeof turn?.output === "string" ? turn.output.trim() : "";
+      const task = taskExcerpt(turn?.context?.request ?? turn?.userText);
+      const taskDetail = task ? { task } : {};
+      if (Number.isSafeInteger(turn?.turn) && turn?.turn >= 0) taskDetail.turn = turn?.turn;
       const { mode, minConditions, minConfidence: confidenceFloor } = await resolveSettings();
       const conditions = extractConditions(turn?.userText);
       if (conditions.length < minConditions) return { ...skip };
@@ -106,14 +124,14 @@ function createTaskCompletion({ evaluate, sessions, steer, settings, minConfiden
       }
       let answers;
       try {
-        const result = await evaluate(completionQuestions(conditions, evidence, output), { signal: turn?.signal });
+        const result = await evaluate(completionQuestions(conditions, evidence, output, turn?.context), { signal: turn?.signal });
         answers = isObject(result?.answers) ? result.answers : void 0;
       } catch (error) {
-        record(turn, "error", { reason: errorReason(error) });
+        record(turn, "error", { ...taskDetail, reason: errorReason(error) });
         return { ...skip };
       }
       if (!answers) {
-        record(turn, "error", { reason: "invalid-response" });
+        record(turn, "error", { ...taskDetail, reason: "invalid-response" });
         return { ...skip };
       }
       let satisfied = 0, unsatisfied = 0, insufficient = 0;
@@ -131,7 +149,7 @@ function createTaskCompletion({ evaluate, sessions, steer, settings, minConfiden
         } else insufficient++;
       }
       const outcome = unsatisfied > 0 ? "unsatisfied" : "ok";
-      const detail = { conditions: conditions.length, satisfied, unsatisfied, insufficient };
+      const detail = { ...taskDetail, conditions: conditions.length, satisfied, unsatisfied, insufficient };
       const confident = unsatisfied > 0 && unsatisfiedMinConf >= confidenceFloor;
       const steered = mode === "steer" && confident && typeof steer === "function" && turn?.agent ? steerOnce.attempt(turn, () => steer(turn.agent, STEER_TEXT)) : false;
       if (steered) detail.steered = true;

package/lib/host/types.d.ts

@@ -166,6 +166,7 @@ export type LogRow = {
     subject?: string;
     task?: string;
     turn?: number;
+    step?: number;
     command?: string;
     path?: string;
     mode?: string;
@@ -268,6 +269,27 @@ export type ToolCandidate = {
     name: string;
     description?: string;
 };
+/** Bounded, masked data for adjudication; background is never authorization. */
+export type ToolEvidence = {
+    tool: string;
+    outcome: 'ok' | 'error';
+    command?: string;
+    path?: string;
+    result?: string;
+};
+export type DecisionContext = {
+    request: string;
+    background: {
+        role: 'user' | 'assistant';
+        text: string;
+    }[];
+    progress: ToolEvidence[];
+};
+export type DecisionSnapshot = {
+    context: DecisionContext;
+    conditionsText: string;
+    evidence: ToolEvidence[];
+};
 export type AgentLike = {
     session?: {
         id?: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-decision-layer",
-  "version": "0.7.2",
+  "version": "0.7.3",
   "description": "A structured decision layer for the DeepSeek Harness agent loop: a danger-call gate, output self-check, tool narrowing, and loop guard backed by a pluggable adjudication model.",
   "keywords": [
     "dsh",