dsh-model-switch 0.4.23 → 0.4.25

package/lib/provider-group-CwadImhH.js

@@ -0,0 +1,88 @@
+//#region lib/types/provider-group.js
+/**
+* Provider configuration groups: per-provider presets for the compaction,
+* auto-review, session-naming, and subagent routes.
+*
+* A group is a DERIVED policy, not a write: `src/session-route.ts` resolves the
+* routes one session should use from its own provider plus this stored table, so
+* switching a session's provider never rewrites deployment-wide settings and two
+* sessions on different providers cannot overwrite each other. The field names
+* below are the flat settings field names a group pins, which keeps the stored
+* shape identical across releases.
+*
+* All functions here are pure and never throw on malformed storage.
+*/
+const ROUTE_FIELDS = Object.freeze([
+	"compactProvider",
+	"compactModel",
+	"autoReviewProvider",
+	"autoReviewModel",
+	"subagentProvider",
+	"subagentModel",
+	"subagentReasoningEffort",
+	"titleProvider",
+	"titleModel"
+]);
+/** Own data property, so a literal '__proto__' provider id can never touch a prototype. */
+function setKey(target, key, value) {
+	Object.defineProperty(target, key, {
+		value,
+		enumerable: true,
+		writable: true,
+		configurable: true
+	});
+}
+/** A non-blank string. Blank values behave exactly like an absent field. */
+function present(value) {
+	return typeof value === "string" && value.trim() !== "";
+}
+/** Normalize one raw entry to its owning provider and route view; undefined for non-object junk. */
+function normalizeEntry(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return void 0;
+	const source = value;
+	const group = {};
+	for (const field of ROUTE_FIELDS) {
+		const item = source[field];
+		if (present(item)) group[field] = item;
+	}
+	return {
+		provider: present(source.provider) ? source.provider : "",
+		group
+	};
+}
+/**
+* Strip a raw stored value to well-formed groups; never throws. Both storage
+* shapes are accepted: the stored entry array (keys live in each entry's
+* `provider` field) and a hand-written provider → routes map (keys are the
+* providers). All-empty entries stay: they pin a provider to every default.
+*/
+function normalizeProviderGroups(raw) {
+	const groups = {};
+	if (Array.isArray(raw)) {
+		for (const entry of raw) {
+			const view = normalizeEntry(entry);
+			if (view === void 0 || view.provider === "") continue;
+			setKey(groups, view.provider, view.group);
+		}
+		return groups;
+	}
+	if (raw !== null && typeof raw === "object") for (const [key, value] of Object.entries(raw)) {
+		if (key.trim() === "") continue;
+		const view = normalizeEntry(value);
+		if (view === void 0) continue;
+		setKey(groups, key, view.group);
+	}
+	return groups;
+}
+/**
+* The saved group for a provider.
+* @returns the normalized group, or undefined when the provider has no group —
+* which is what leaves the live routes untouched during a switch.
+*/
+function groupOf(groups, provider) {
+	if (groups === void 0 || provider.trim() === "") return void 0;
+	if (!Object.prototype.hasOwnProperty.call(groups, provider)) return void 0;
+	return groups[provider];
+}
+//#endregion
+export { normalizeProviderGroups as n, groupOf as t };

package/lib/session-route-BCQFzqRP.js

@@ -0,0 +1,172 @@
+import { t as groupOf } from "./provider-group-CwadImhH.js";
+//#region lib/types/session-route.js
+/**
+* Per-session capability route derivation.
+*
+* Model Switch stores one deployment-wide route per capability (the flat
+* settings fields) plus, per provider, a saved provider group. Nothing is
+* written when a session changes provider: this module DERIVES the route a
+* capability should use for one session from (a) the session's own provider and
+* (b) the stored group table. Two sessions on different providers therefore
+* resolve independently, and no session's actions rewrite another session's
+* route.
+*
+* The session's provider is read from durable, official state in this order:
+* the `modelSelection` session projection (`pending` before `lastUsed`, so a
+* selection the user just made counts), then the latest logged request-context
+* route, then the latest `request/header` route. Every read is optional: a
+* session with no observable provider, an unregistered projection, or a
+* profile without the projection package all resolve to the deployment default,
+* which is exactly the pre-derivation behavior.
+*
+* All functions are pure except the readers, which never throw and never write.
+*/
+/** Flat deployment-default fields per capability, in group-storage field names. */
+const CAPABILITY_FIELDS = Object.freeze({
+	compaction: {
+		provider: "compactProvider",
+		model: "compactModel"
+	},
+	autoReview: {
+		provider: "autoReviewProvider",
+		model: "autoReviewModel"
+	},
+	title: {
+		provider: "titleProvider",
+		model: "titleModel"
+	},
+	subagent: {
+		provider: "subagentProvider",
+		model: "subagentModel"
+	}
+});
+/** A non-blank string; blank values behave exactly like an absent field. */
+function present(value) {
+	return typeof value === "string" && value.trim() !== "";
+}
+/** Read one capability's pair from a flat route record; undefined unless both halves are present. */
+function pairOf(source, fields) {
+	if (source === void 0) return void 0;
+	const record = source;
+	const provider = record[fields.provider];
+	const model = record[fields.model];
+	if (!present(provider) || !present(model)) return void 0;
+	return {
+		provider,
+		model
+	};
+}
+/**
+* The deployment-wide route for one capability: the flat settings pair.
+* @param settings - live Model Switch settings; undefined means none are reachable.
+* @param capability - capability whose flat pair is read.
+* @returns The complete pair, or undefined when the capability stays at its official/derived default.
+*/
+function deploymentRoute(settings, capability) {
+	return pairOf(settings, CAPABILITY_FIELDS[capability]);
+}
+/**
+* The route a subagent spawn should use for one parent-session provider.
+*
+* A saved group for that provider pins the spawn; otherwise the flat Subagent
+* card pins it, but only in `fixed` mode — `follow-main` IS the official inherit
+* path, expressed by leaving the request untouched rather than by naming it.
+* @param settings - live Model Switch settings.
+* @param provider - the delegating session's provider, when one is observable.
+* @returns The complete route, or undefined for official inherit.
+*/
+function subagentRouteOf(settings, provider) {
+	const group = groupRoute(settings, provider, "subagent");
+	if (group !== void 0) {
+		const effort = groupOf(settings?.providerGroups, provider ?? "")?.subagentReasoningEffort;
+		return present(effort) ? {
+			...group,
+			reasoningEffort: effort
+		} : group;
+	}
+	if (settings?.subagentMode !== "fixed") return void 0;
+	const fixed = deploymentRoute(settings, "subagent");
+	if (fixed === void 0) return void 0;
+	return present(settings.subagentReasoningEffort) ? {
+		...fixed,
+		reasoningEffort: settings.subagentReasoningEffort
+	} : fixed;
+}
+/**
+* One provider's saved route for one capability.
+* @param settings - live Model Switch settings carrying the group table.
+* @param provider - the session's provider; blank or unknown resolves to undefined.
+* @param capability - capability whose group pin is read.
+* @returns The complete group pair, or undefined when the group pins nothing here.
+*/
+function groupRoute(settings, provider, capability) {
+	if (!present(provider)) return void 0;
+	return pairOf(groupOf(settings?.providerGroups, provider), CAPABILITY_FIELDS[capability]);
+}
+/**
+* The route one capability should use for one session.
+*
+* A saved provider group for the session's provider wins; otherwise the flat
+* deployment default applies. An unknown session provider skips every group, so
+* a session Model Switch cannot attribute keeps the deployment default.
+* @param settings - live Model Switch settings.
+* @param provider - the session's provider, when one is observable.
+* @param capability - capability being resolved.
+* @returns The complete pair, or undefined for the capability's official default.
+*/
+function resolveCapabilityRoute(settings, provider, capability) {
+	return groupRoute(settings, provider, capability) ?? deploymentRoute(settings, capability);
+}
+/**
+* Read the provider from the durable model-selection projection.
+* @param ctx - context that may expose `sessionProjections`.
+* @param session - the session whose selection is read.
+* @returns The pending provider, else the last-used provider, else undefined.
+*/
+function projectionProvider(ctx, session) {
+	let state;
+	try {
+		state = ctx.get("sessionProjections", false)?.stateOf(session, "modelSelection");
+	} catch {
+		state = void 0;
+	}
+	if (state === void 0) return void 0;
+	if (present(state.pending?.provider)) return state.pending.provider;
+	if (present(state.lastUsed?.provider)) return state.lastUsed.provider;
+}
+/**
+* The provider one session is using, from official durable state.
+*
+* Preferred source is the session's own model selection (it covers a switch the
+* client has sent but no request has consumed yet); the logged request-context
+* and request-header routes cover profiles without the projection package and
+* replayed sessions that never emitted a selection.
+* @param ctx - context used for the optional projection read.
+* @param session - the session to resolve; undefined resolves to undefined.
+* @returns The provider, or undefined when nothing durable names one.
+*/
+function sessionProviderOf(ctx, session) {
+	if (session === void 0) return void 0;
+	const selected = projectionProvider(ctx, session);
+	if (selected !== void 0) return selected;
+	try {
+		const context = session.requestContext()?.provider;
+		if (present(context)) return context;
+		const header = session.requestHeader()?.config.provider;
+		if (present(header)) return header;
+	} catch {
+		return;
+	}
+}
+/**
+* The subagent route one exact session's spawns should use.
+* @param ctx - context used for the optional session reads.
+* @param session - the delegating session; undefined keeps official inherit.
+* @param settings - live Model Switch settings.
+* @returns The complete route, or undefined for official inherit.
+*/
+function sessionSubagentRouteOf(ctx, session, settings) {
+	return subagentRouteOf(settings, sessionProviderOf(ctx, session));
+}
+//#endregion
+export { sessionProviderOf as n, sessionSubagentRouteOf as r, resolveCapabilityRoute as t };

package/lib/session-title.js

@@ -0,0 +1,217 @@
+import { n as sessionProviderOf, t as resolveCapabilityRoute } from "./session-route-BCQFzqRP.js";
+//#region lib/types/session-title.js
+/**
+* Model Switch-owned session-naming row.
+*
+* The official naming rows hardwire the naming route at registration time: the
+* configured provider/model pair wins over the session's own logged route for
+* every session in the profile. This row registers ONE provider of its own and
+* resolves the route PER REQUEST instead, so a session whose provider has a
+* saved group is named through that group's pair while every other session keeps
+* following its own model.
+*
+* The call itself stays inside the official implementation: the exported
+* `generateSessionTitleWithLlm` receives the session-resolved config and records
+* exactly that route in `session/title-llm-request`, so the durable record and
+* the actual request can never disagree. Nothing is remounted when settings
+* change — the route is read through on every naming request — so a settings
+* save can neither interrupt an in-flight naming request nor leave the profile
+* without a registered provider.
+*
+* `cordis.patch.yml` disables the official row (the seam allows one registered
+* provider per context), and this row mirrors the cadence the disabled row
+* declared, so a profile that restated the row as all-prompts keeps its cadence.
+*
+* @module dsh-model-switch/session-title
+*/
+var __rewriteRelativeImportExtension = function(path, preserveJsx) {
+	if (typeof path === "string" && /^\.\.?\//.test(path)) return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function(m, tsx, d, ext, cm) {
+		return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : d + ext + "." + cm.toLowerCase() + "js";
+	});
+	return path;
+};
+/** Official session-title provider row this module supersedes. */
+const OFFICIAL_TITLE_ROW = "session-title-llm";
+/** The auxiliary-LLM package carrying the shared naming policy and call. */
+const TITLE_LLM_PACKAGE = "@deepseek-ai/dsh-session-title-llm";
+/** Cordis plugin identity; matches the cordis.patch.yml insert row id. */
+const name = "model-switch-session-title";
+/** The loader names the disabled row, and the seam services the call needs are awaited before the first naming request. */
+const inject = [
+	"loader",
+	"sessionTitle",
+	"llm"
+];
+/** Both official cadence packages, in the order a profile may declare them. */
+const TITLE_CADENCES = Object.freeze([Object.freeze({
+	pkg: "@deepseek-ai/dsh-session-title-first-prompt-llm",
+	id: "session-title-first-prompt-llm",
+	automatic: "first-prompt",
+	firstPromptOnly: true
+}), Object.freeze({
+	pkg: "@deepseek-ai/dsh-session-title-all-prompts-llm",
+	id: "session-title-all-prompts-llm",
+	automatic: "all-prompts",
+	firstPromptOnly: false
+})]);
+/**
+* The cadence one official package name declares.
+* @param pkg - the disabled row's package name.
+* @returns The matching cadence, or undefined for a row this row cannot mirror.
+*/
+function titleCadence(pkg) {
+	if (pkg === void 0) return void 0;
+	return TITLE_CADENCES.find((cadence) => cadence.pkg === pkg);
+}
+/**
+* Overlay the session-resolved route over the row's own validated policy.
+*
+* A resolved route always names both halves. When nothing resolves, the row's
+* own policy is returned unchanged: an explicit pair the profile configured on
+* the official row stays the deployment default, and a row without one keeps
+* following each session's logged route.
+* @param config - policy validated from the disabled official row.
+* @param route - session-resolved naming route, or undefined for the row's own policy.
+* @returns A detached config for one naming request.
+*/
+function composeTitleRoute(config, route) {
+	if (route === void 0) return config;
+	return {
+		...config,
+		provider: route.provider,
+		model: route.model
+	};
+}
+/**
+* Frame the exact human messages one naming revision represents.
+* @param messages - every eligible human message of the revision.
+* @param firstPromptOnly - cadence flag: true mirrors the first-prompt provider.
+* @returns The selected messages, in order.
+* @throws when a first-prompt cadence receives an empty revision — the official provider's own contract.
+*/
+function selectTitleMessages(messages, firstPromptOnly) {
+	if (!firstPromptOnly) return messages;
+	const first = messages[0];
+	if (first === void 0) throw new Error("first-prompt title provider requires one human message");
+	return [first];
+}
+/**
+* Locate the official session-title provider row in the loader tree.
+* Disabled entries stay in the tree, so a name-matched disable still matches.
+* @param loader - the host loader, when one is reachable.
+* @returns The official entry, or undefined when this profile has no such row.
+*/
+function officialTitleEntry(loader) {
+	if (!loader) return void 0;
+	for (const entry of loader.entries()) {
+		if (entry.id === OFFICIAL_TITLE_ROW) return entry;
+		const pkg = entry.options?.name;
+		if (typeof pkg === "string" && TITLE_CADENCES.some((cadence) => cadence.pkg === pkg)) return entry;
+	}
+}
+/**
+* Copy the official row's stored config, ignoring non-object payloads.
+* @param entry - the official session-title provider entry.
+* @returns A plain object spread; missing or invalid configs become `{}`. The
+* result is untrusted: the profile may be hand-edited, so the official policy
+* validator runs over it before any naming request is served.
+*/
+function forwardedConfig(entry) {
+	const raw = entry.options?.config;
+	if (raw && typeof raw === "object" && !Array.isArray(raw)) return raw;
+	return {};
+}
+/**
+* The official package name this row mounts (either cadence).
+* @param entry - the official session-title provider entry.
+* @returns The package name, or undefined when the row declares none.
+*/
+function officialTitlePackage(entry) {
+	const pkg = entry.options?.name;
+	return typeof pkg === "string" && pkg.trim() !== "" ? pkg : void 0;
+}
+/**
+* Read live Model Switch settings without requiring the host row.
+*
+* The host is read structurally instead of injected so this row keeps mirroring
+* the official naming behavior when the `model-switch` row is disabled: an
+* unreachable host resolves to the row's own policy rather than to a pinned
+* route.
+* @param ctx - this row's context.
+* @returns The settings, or undefined when the host is unavailable.
+*/
+function currentSettings(ctx) {
+	try {
+		return ctx.get("modelSwitch", false)?.currentSettings();
+	} catch {
+		return;
+	}
+}
+/**
+* Execute one naming request through the official implementation.
+*
+* The route is resolved from the session being titled — its provider selects the
+* saved group, and the flat settings pair is the deployment default — and is
+* handed to `generateSessionTitleWithLlm`, which frames the request, records the
+* exact route in `session/title-llm-request`, and validates the result.
+* @param ctx - this row's context, exposing `llm`.
+* @param module - the loaded auxiliary-LLM module.
+* @param plan - the profile's fixed naming policy.
+* @param request - service-owned session, message revision, and cancellation.
+* @returns The official provider result.
+*/
+async function generateTitle(ctx, module, plan, request) {
+	const provider = sessionProviderOf(ctx, request.session);
+	const route = resolveCapabilityRoute(currentSettings(ctx), provider, "title");
+	return module.generateSessionTitleWithLlm(ctx, composeTitleRoute(plan.config, route), request, selectTitleMessages(request.messages, plan.cadence.firstPromptOnly), plan.cadence.id);
+}
+/**
+* Mount the Model Switch session-naming row for this profile.
+*
+* A profile with no official naming row, an unrecognized row package, a missing
+* auxiliary-LLM package, or an invalid stored policy keeps the session-title
+* service's deterministic fallback titles and reports the lost capability
+* explicitly instead of guessing a route. The registration is an effect of this
+* row's fiber, so unloading the profile unregisters the provider.
+* @param ctx - this row's context.
+*/
+async function apply(ctx) {
+	const entry = officialTitleEntry(ctx.get("loader", false));
+	const cadence = titleCadence(entry === void 0 ? void 0 : officialTitlePackage(entry)) ?? TITLE_CADENCES[0];
+	if (cadence === void 0) return;
+	if (entry === void 0) ctx.logger.info("model-switch: no instantiated official session-title row to mirror; naming uses the first-prompt cadence");
+	/** The displaced row's naming policy, or the official defaults when it is absent. */
+	const forwarded = entry === void 0 ? {} : forwardedConfig(entry);
+	let module;
+	try {
+		module = await import(__rewriteRelativeImportExtension(TITLE_LLM_PACKAGE));
+	} catch (cause) {
+		ctx.logger.error(`model-switch: ${TITLE_LLM_PACKAGE} is unavailable; model-backed session naming cannot run at all`);
+		ctx.logger.error(cause);
+		return;
+	}
+	let config;
+	try {
+		config = module.resolveSessionTitleLlmConfig(forwarded);
+	} catch (cause) {
+		ctx.logger.error("model-switch: the official session-title row has no valid naming policy; naming keeps the deterministic fallback");
+		ctx.logger.error(cause);
+		return;
+	}
+	const plan = {
+		cadence,
+		config
+	};
+	try {
+		ctx.sessionTitle.register({
+			id: cadence.id,
+			automatic: cadence.automatic,
+			generate: (request) => generateTitle(ctx, module, plan, request)
+		});
+	} catch (cause) {
+		ctx.logger.error("model-switch: another session-title provider is already registered; the configurable naming route is unavailable");
+		ctx.logger.error(cause);
+	}
+}
+//#endregion
+export { TITLE_CADENCES, apply, composeTitleRoute, forwardedConfig, inject, name, officialTitleEntry, officialTitlePackage, selectTitleMessages, titleCadence };

package/lib/subagent-runtime.js

@@ -1,3 +1,4 @@
+import { r as sessionSubagentRouteOf } from "./session-route-BCQFzqRP.js";
 import { ReasoningEffortId } from "@deepseek-ai/dsh-llm";
 import OfficialSubagentRuntime from "@deepseek-ai/dsh-subagent";
 //#region lib/types/subagent-runtime.js
@@ -20,27 +21,28 @@ function present(value) {
 function spawnHasAnyRouteField(options) {
 	return present(options?.provider) || present(options?.model) || options?.reasoningEffort !== void 0;
 }
-function fixedRoute(settings) {
-	if (!present(settings.subagentProvider) || !present(settings.subagentModel)) return void 0;
-	return {
-		provider: settings.subagentProvider,
-		model: settings.subagentModel,
-		...present(settings.subagentReasoningEffort) ? { reasoningEffort: ReasoningEffortId(settings.subagentReasoningEffort) } : {}
-	};
-}
-/** Inject a fixed Default Subagent route, or leave the request for Official inherit. */
-function routeSubagentRequest(request, settings) {
+/**
+* Inject one resolved route into a spawn that names none.
+*
+* A spawn that already names a provider, model, or effort keeps it: the caller's
+* explicit selection outranks any profile policy. The route itself is derived
+* from the DELEGATING session (its provider selects a saved group, else the flat
+* Subagent card in `fixed` mode), so two sessions on different providers route
+* their own spawns and neither can rewrite the other's policy.
+* @param request - the caller's spawn request.
+* @param route - the delegating session's resolved route, or undefined for official inherit.
+* @returns The request to hand the official runtime.
+*/
+function routeSubagentRequest(request, route) {
 	if (spawnHasAnyRouteField(request.agentOptions)) return request;
-	if (settings.subagentMode !== "fixed") return request;
-	const selected = fixedRoute(settings);
-	if (selected === void 0) return request;
+	if (route === void 0) return request;
 	return {
 		...request,
 		agentOptions: {
 			...request.agentOptions,
-			provider: selected.provider,
-			model: selected.model,
-			...selected.reasoningEffort === void 0 ? {} : { reasoningEffort: selected.reasoningEffort }
+			provider: route.provider,
+			model: route.model,
+			...route.reasoningEffort === void 0 ? {} : { reasoningEffort: ReasoningEffortId(route.reasoningEffort) }
 		}
 	};
 }
@@ -170,7 +172,8 @@ var ModelSwitchSubagentRuntime = class extends OfficialSubagentRuntime {
 	routed(name, request) {
 		const provider = this.ctx.subagents.getProvider(name);
 		if (provider !== void 0 && provider.capabilities.agentOptions !== true) return request;
-		return routeSubagentRequest(request, routingSurface(this.ctx).currentSettings());
+		const modelSwitch = routingSurface(this.ctx);
+		return routeSubagentRequest(request, sessionSubagentRouteOf(this.ctx, request.parent.session, modelSwitch.currentSettings()));
 	}
 	start(name, request) {
 		return super.start(name, this.routed(name, request));

package/lib/types/adapter-registry.d.ts

@@ -41,7 +41,7 @@ export interface ModelSwitchImageAdapter {
 }
 export interface ModelSwitchProviderAdapters {
     readonly provider: string;
-    /** Native Agent providers own their context and are excluded from DSH switch compaction. */
+    /** Optional runtime role declared by the provider integration. */
     readonly role?: 'llm' | 'agent';
     readonly search?: ModelSwitchSearchAdapter;
     readonly image?: ModelSwitchImageAdapter;

package/lib/types/auto-review.d.ts

@@ -5,9 +5,20 @@
  * reviewer to the session's own request route (`header.config`). This row runs
  * the official `apply` under a scoped child context whose `llm` service is
  * shadowed by a wrapper that rewrites only `stream()`'s provider/model — and
- * only while the profile has a complete reviewer route configured. With no
- * route configured the wrapper passes options through by identity, so the
- * reviewer follows the session model exactly.
+ * only when the reviewing session's derived route (its provider group's
+ * reviewer pair, else the deployment-wide reviewer card) pins one. With no
+ * route pinned the wrapper passes options through by identity, so the reviewer
+ * follows the session model exactly.
+ *
+ * Although the official gate omits `sessionId` and `purpose` from its frozen
+ * `GenerateOptions`, its `tools/pre-execute` waterfall listener receives
+ * `exec.agent` (`exec.agent.session`). After running `official.apply(scope)`,
+ * this module registers a `{ prepend: true }` `tools/pre-execute` listener on
+ * the same scope — which Cordis places ahead of the official gate's listener in
+ * the waterfall — and binds `exec.agent?.session` in an `AsyncLocalStorage`
+ * scope around `next()`. Every `scope.llm.stream()` call from `classifyRisk`
+ * therefore resolves the exact session being reviewed, with zero cross-session
+ * interference when multiple sessions review tool calls concurrently.
  *
  * The official gate stays an opt-in capability: the row mounts it only when
  * the profile actually started with the experimental-auto-review bundle.
@@ -16,8 +27,10 @@
  *
  * @module dsh-model-switch/auto-review
  */
+import { AsyncLocalStorage } from 'node:async_hooks';
 import type { Context } from '@deepseek-ai/cordis';
 import type { GenerateOptions, StreamChunk } from '@deepseek-ai/dsh-llm';
+import type { Session } from '@deepseek-ai/dsh-session';
 /** Cordis plugin name used by loader diagnostics. */
 export declare const name = "model-switch-auto-review";
 /** The official gate's host services plus Model Switch's settings owner. */
@@ -52,12 +65,34 @@ export declare function autoReviewRouteOf(settings: {
  * @returns A structurally compatible llm face for the scoped context.
  */
 export declare function reviewLlm(real: ReviewLlm, route: () => AutoReviewRoute | undefined): ReviewLlm;
+/**
+ * Resolve the reviewer route for one session (or deployment-wide when no session is bound).
+ *
+ * @param ctx - host context whose modelSwitch settings and sessionProjections derive the route.
+ * @param session - the session whose tool call is being reviewed, when known.
+ * @returns The derived reviewer route, or undefined to follow the session model.
+ */
+export declare function resolveSessionAutoReviewRoute(ctx: Context, session?: Session): AutoReviewRoute | undefined;
+/**
+ * Install the outer `tools/pre-execute` correlation listener ahead of the official gate.
+ *
+ * Because Cordis `on(..., { prepend: true })` unshifts onto the event hook list,
+ * registering this listener AFTER `official.apply(scope)` places it at index 0
+ * — directly ahead of the official gate's own prepended listener — so
+ * `activeSession.run(exec.agent?.session, next)` wraps the entire official
+ * review execution.
+ *
+ * @param scope - the review scope context where the gate is mounted.
+ * @param activeSession - AsyncLocalStorage holding the session under review.
+ */
+export declare function bindAutoReviewSessionCorrelation(scope: Context, activeSession: AsyncLocalStorage<Session | undefined>): void;
 /**
  * Build the scoped context the official gate runs under.
  * @param ctx - host context whose modelSwitch settings pin the reviewer route.
+ * @param activeSession - optional AsyncLocalStorage correlating each `tools/pre-execute` call to its session.
  * @returns A child context shadowing only the llm service.
  */
-export declare function reviewScope(ctx: Context): Context;
+export declare function reviewScope(ctx: Context, activeSession?: AsyncLocalStorage<Session | undefined>): Context;
 /**
  * Mount the official gate under the reviewer-route scope.
  *

package/lib/types/client/ModelSwitchSettings.d.ts

@@ -7,7 +7,7 @@ import { type ProviderGroupConfig } from '../provider-group.js';
 import type { RuntimeCapabilities } from '../runtime-capabilities.js';
 import { type CapabilitiesSnapshot } from './search-capabilities.js';
 import type { ModelSwitchLocaleKey } from './locales.js';
-import type { ConfigViewForm } from './derived-config-form.js';
+import type { ConfigViewForm, ConfigViewOp } from './derived-config-form.js';
 export interface ModelSwitchSettingsFace {
     t: (key: ModelSwitchLocaleKey) => string;
     hooks: {
@@ -16,12 +16,16 @@ export interface ModelSwitchSettingsFace {
         imageSettings: ConfigViewForm<CapabilityRouteView>;
         autoReviewSettings: ConfigViewForm<CapabilityRouteView>;
         compactionSettings: ConfigViewForm<CapabilityRouteView>;
+        titleSettings: ConfigViewForm<CapabilityRouteView>;
         switchSettings: Pick<ConfigForm<ModelSwitchSettingsView>, 'getSnapshot' | 'subscribe'>;
     };
     capabilities: RuntimeCapabilities;
-    setSubagent: (field: 'mode' | 'provider' | 'model' | 'reasoningEffort', value: string | undefined) => Promise<void>;
-    setCapability: (route: 'search' | 'image' | 'autoReview' | 'compaction', field: 'provider' | 'model', value: string | undefined) => Promise<void>;
-    setCompactOnSwitch: (value: boolean) => Promise<void>;
+    /**
+     * Apply one row's changes as a SINGLE revision-fenced write, so a refused
+     * write can never leave a half-written provider/model pair behind.
+     */
+    saveSubagent: (ops: readonly ConfigViewOp<SubagentSettingsView>[]) => Promise<void>;
+    saveCapability: (route: 'search' | 'image' | 'autoReview' | 'compaction' | 'title', ops: readonly ConfigViewOp<CapabilityRouteView>[]) => Promise<void>;
     /** Replace or remove (undefined) one provider's saved capability group. */
     saveProviderGroup: (provider: string, group: ProviderGroupConfig | undefined) => Promise<void>;
     loadCatalog: () => Promise<readonly ModelProviderGroup[]>;

package/lib/types/client/derived-config-form.d.ts

@@ -1,9 +1,23 @@
 import type { ConfigForm, ConfigFormSnapshot } from '@deepseek-ai/dsh-client-ui-settings/client';
+/** One field-level change expressed against a view model, before source-path mapping. */
+export interface ConfigViewOp<T> {
+    field: keyof T & string;
+    value?: unknown;
+}
 export interface ConfigViewForm<T> {
     getSnapshot(): ConfigFormSnapshot<T>;
     subscribe(listener: () => void): () => void;
     set(field: keyof T & string, value: unknown): Promise<void>;
     unset(field: keyof T & string): Promise<void>;
+    /**
+     * Apply several view-field changes as ONE revision-fenced source write, so a row save
+     * either lands completely or is rejected as a whole instead of leaving a half-written pair.
+     *
+     * @param ops view fields to change; `value === undefined` unsets the source field
+     * @param expectedRevision revision the draft was seeded from; forwarded to the source fence
+     * @returns a promise that rejects with `settings-rejected` when the host refuses the write
+     */
+    mutate(ops: readonly ConfigViewOp<T>[], expectedRevision?: number): Promise<void>;
 }
 export declare function deriveConfigForm<Source, View>(source: ConfigForm<Source>, project: (value: Source) => View, fields: {
     [K in keyof View & string]: keyof Source & string;