dsh-model-switch 0.4.30 → 0.4.32

package/CHANGELOG.md

@@ -1,3 +1,26 @@
+## v0.4.32
+
+A hot install could still break every tool call: replacing the plugin (disable → remove → install → enable, **without a DSH restart**) leaves the official `auto-review` row serving while this row's takeover is still trying to displace it, and its unshielded probe fails each call. This release makes that window non-fatal and shortens it.
+
+- **P0: a broken reviewer seam no longer fails tool calls (`src/auto-review.ts`).** `installToolCallSafetyNet` registers a `{ prepend: true }` `tools/pre-execute` listener on this row's **own context**, so it is live even when the gate could not mount — the one window the defensive `permissionPresets` shadow cannot cover, because that shadow lives in the review scope while the serving official gate resolves the real service from the profile. It catches only seam failures (`inactive context`, `cannot get required service`, `cannot get property`, `without inject`, `TRANSPORT`), returns `{ kind: 'allow' }` so the body dispatches, and reports once with the fiber-chain dump. It is **inert while this row holds the route** (`isDegraded: () => !presets.registered`), so another plugin's broken listener keeps failing closed; reviewer transport/quota errors (`RATE_LIMIT`, `PI_AI_ERROR`) keep failing closed too — "the reviewer declined" and "the reviewer could not talk" are not broken seams. The waterfall only decides whether the body runs, so allowing here never masks a tool failure.
+- **The takeover budget matches a real disposal (`src/auto-review-takeover.ts`).** 20×10 ms (~200 ms) → 60×50 ms (~3 s), plus `TAKEOVER_LATE_RETRY_DELAYS_MS` = 500/1000/1500 ms: three bounded re-claims after the loop gives up, because `Entry.update({ disabled: true })` starts the displaced fiber's teardown and the loader does not await it. A disposal that unmounts a gate, restores permission presets and unwinds fibers outlasted the old budget, which is exactly the reported hot-swap window. Timers are cleared with the row.
+- **Actionable failure log.** The lost-seam error now says both what happens next ("the reviewer path is shielded instead of failing tool calls") and what the human can do ("Restart DSH to converge the reviewer row — a hot install cannot always displace the official row in time").
+- **Docs.** `docs/seam-gap.md` records the two remaining gaps: no public seam lets a plugin **replace a bundled capability row at runtime** (only disable-and-reclaim through the loader), and the loader cannot address a row nested in a preset's `config.plugins` — the official bundle row is top-level today, but a future nesting would need a config-level bridge like 0.4.27's preset bridge.
+- **Verification.** `pnpm run check` green (55 test files / 494 tests + pack gate). New coverage: the net allows the call and reports exactly once when the seam is broken, stays inert while this row holds the route, rethrows a reviewer quota error, and classifies an inject failure apart from a denial. The late-retry schedule is bounded by the row's lifetime. **Not yet reproduced end-to-end**: the disable → remove → install → enable sequence on the lab plane — this machine cannot reach the GitHub remote, so the release itself is still pending.
+
+## v0.4.31
+
+The recurring tool-call outage is closed at both ends it can be closed from: this plugin now **takes the Auto-reviewer seam over** from the official `auto-review` row (yield-then-claim, the session-title pattern), and its own gate's preset probe can no longer fail a tool call even while the preset service is broken — with a fiber-chain dump in the one degradation log so the upstream half of the failure names itself next time.
+
+- **P0: the official `auto-review` row runs again and every tool call dies (`src/auto-review-takeover.ts`, `src/auto-review.ts`).** v0.4.30's defensive shadow protected only **this row's** gate; at 15:22:34 the plugin manager wrote `- id: auto-review / disabled: false` into the profile patch layer (it applies after every bundle layer, so this plugin's static `disabled` can never win), the official row re-activated beside this one, and its **unguarded** probe — `permissionPresets.current(session)` is the first `tools/pre-execute` step — turned every tool call into `cannot get required service "sessionProjections" in inactive context` until the plugin was disabled and the Host restarted. Two live rows are not survivable on that seam at all: `registerAuto` is single-registration, and whichever row loses it cannot keep serving. The row now displaces the official one through the loader's released seams (the same choreography as the session-title provider slot): on `loader/patch-context` it releases the Auto registration **synchronously before** `next()` — the loader runs the entry's plugin `apply` in the same turn, so an awaited yield would collide — lets the official row apply cleanly, disables it through `Entry.update({ disabled: true })`, and re-claims the registration with a bounded retry; `loader/partial-dispose` re-claims when a toggled-back-on official row goes away again, and an initial sweep covers rows composed before this one. Manual toggling of the official「自动审查」component is now a logged, self-healing no-op instead of an outage.
+- **The Auto selection survives every displacement.** Disposing a gate moves live `auto` sessions to `danger-full-access` by design (the official teardown runs on both the displaced row and this row's own re-mounts), so every takeover step runs inside a preservation window that remembers the sessions on `auto` and restores them after the registration is live again.
+- **P0: the preset probe can no longer fail a tool call, and the shadow is always on (`src/auto-review.ts`).** `defensivePermissionPresets` now resolves the presets service **lazily per call** (the shadow protects even while the service is still activating), degrades `current()` to `custom` so the gate skips review and runs the tool body, swallows a failing teardown `set()`, and reports the lost capability **once** — now including the exact resolution chain (`uid/state/name/inject` per fiber in the caller's chain). That dump matters because the upstream cause is real and recurring: `internal/get` walks the whole caller fiber chain and throws `… in inactive context` at the first fiber whose `inject` declares `sessionProjections` without a resolved snapshot — and **twenty-four** released rows declare it (`dsh-permission-presets` itself, `dsh-session-title`, `dsh-plan-mode`, `dsh-token-meter`, `dsh-tool-todo`, `dsh-agent-loop`, …), so any one of them mid-reload can break an unguarded probe. The upstream fix and the missing seams are recorded in `docs/seam-gap.md`.
+- **`registerAuto` is brokered, not swallowed.** The gate's registration is held through `releaseForTakeover()` / `reclaimRegistration()` so the takeover can hand the single slot over and take it back **without unmounting the gate** (unmounting is what flips live sessions off Auto). A `registerAuto` conflict now fails the gate's mount loudly and the takeover retries, instead of leaving an Auto preset that silently does nothing — the behavior 0.4.30 shipped and which hid the first recurrence.
+- **Honest correction to the v0.4.30 entry.** That entry's model was half right and half wrong, and the real-package harness settled it: the raw message does come from the official gate's unguarded probe (reproduced exactly), but the "half-applied effect leaks its listener" explanation is **false** — when `registerAuto` throws mid-effect, cordis cleans the already-yielded listener up (verified: zero probe calls after the failed mount). The outage needs the official gate actually **running**, which is why 0.4.30's shadow (covering only this row's gate) did not prevent it and why this release makes the official row unable to run at all.
+- **Visibility.** The settings card's「自动审查」section now says that the official component is replaced by this plugin's configurable reviewer route and is re-disabled with a log line when toggled back on; `docs/seam-gap.md` gains the two missing seams (no supersede declaration for a bundled capability row + two layers of `disabled`; the caller-chain `sessionProjections` resolution), and READMEs point at the takeover behavior.
+- **Verification.** `pnpm run check` green (55 test files / 490 tests + pack gate). New coverage: strict package identity (an id-only lookalike is never disabled), the displacement claims the registration around the window that preserves Auto sessions, the reclaim retries until the displaced registration releases and reports the lost seam otherwise, the patch-context yield is **synchronous before** the loader continues, repeated events join one reclaim per entry, the partial-dispose path re-claims, the sweep catches earlier-composed rows, and the lazy shadow degrades while the service is unresolvable and brokers yield/reclaim with the same admit callback. With the **real published packages** (official `auto-review` gate + cordis): the pre-fix shape's half-applied effect leaves **no** leaked listener (hypothesis disproven), the yield-then-claim shape lets the official row apply cleanly and its failure still fail-closes as a clean deny, and the shipped shadowed gate returns `allow` for a tool call with a broken preset service.
+- **Residual (honest).** If the displaced registration never releases within the bounded retry, the takeover reports the lost seam and the official row keeps serving (unguarded) until the next loader cycle — no silent half-state, but also no reviewer route override. The upstream `sessionProjections` chain break can still fail **other** rows' own reads (anything else that injects it); this plugin cannot defend those, and the fiber-chain dump is the evidence-gathering step for the upstream report. Toggling the official component remains visible in the plugin manager as the user set it — the takeover's in-memory disable is re-applied at every startup rather than written over the user's patch.
+
 ## v0.4.30
 
 One live failure class, three fixes: after a provider-group save every tool call in the session died before its body ran with `cannot get required service "sessionProjections" in inactive context`, the settings page sometimes answered a provider-group save with the raw `settings-rejected` sentinel, and the composer's permission selector sometimes disappeared.

package/README.md

@@ -92,7 +92,9 @@ The card body shows only the Plan's first-line title and first-paragraph summary
 
 ## Auto review model
 
-The official `@deepseek-ai/dsh-experimental-auto-review` (the per-call reviewer for the Auto permission preset) hardwires its review requests onto the session's own route. This plugin takes that row over through a `cordis.patch.yml` row replacement: the official row is disabled and `dsh-model-switch/auto-review` mounts the **same official `apply`** under a scoped child context whose `llm.stream` `provider/model` are rewritten to the reviewer route resolved for that session (provider group → flat card → session model). Session correlation rides a `{ prepend: true }` `tools/pre-execute` listener registered on the review scope immediately after `official.apply(scope)`, binding `exec.agent.session` in an `AsyncLocalStorage` scope around `next()` so parallel sessions on different providers never interfere and mid-session provider switches take effect on the very next review. The "Auto review model" card defaults to off = reviews follow the session model; turning it on pins the catalog head as an editable starting point, and saved changes apply to the very next review. When the optional auto-review bundle never started with the profile the row stays unmounted and the Auto preset keeps its official off state; an official row already active elsewhere is reported explicitly instead of producing a second `registerAuto`.
+The official `@deepseek-ai/dsh-experimental-auto-review` (the per-call reviewer for the Auto permission preset) hardwires its review requests onto the session's own route. This plugin takes that row over through a `cordis.patch.yml` row replacement: the official row is disabled and `dsh-model-switch/auto-review` mounts the **same official `apply`** under a scoped child context whose `llm.stream` `provider/model` are rewritten to the reviewer route resolved for that session (provider group → flat card → session model). Session correlation rides a `{ prepend: true }` `tools/pre-execute` listener registered on the review scope immediately after `official.apply(scope)`, binding `exec.agent.session` in an `AsyncLocalStorage` scope around `next()` so parallel sessions on different providers never interfere and mid-session provider switches take effect on the very next review. The "Auto review model" card defaults to off = reviews follow the session model; turning it on pins the catalog head as an editable starting point, and saved changes apply to the very next review. When the optional auto-review bundle never started with the profile the row stays unmounted and the Auto preset keeps its official off state.
+
+Since 0.4.31 the row also owns the seam at runtime, not just in the patch file. The plugin manager writes its component toggles into a layer that applies after every bundle layer, so a manual re-enable of the official「自动审查」component used to bring the official, unguarded gate back — and, because `permissionPresets.registerAuto` is single-registration, two live rows on that seam eventually killed every tool call. The row now takes the seam over the way the session-title slot is taken over: when the official row is about to apply it releases the Auto registration **synchronously first** (so the official row applies cleanly instead of colliding), disables the official row through the public `Entry.update`, and re-claims the registration with a bounded retry — preserving live sessions' Auto selection across the displacement. Toggling the official component back on is therefore a logged, self-healing no-op; the settings card's「自动审查」section says so too.
 
 ## Compaction model
 
@@ -123,7 +125,7 @@ The route is read through on every naming request: a saved change applies to the
 
 Since 0.4.29 the row also coexists with the experimental "titles that update with the conversation" bundle (`dsh-experimental-session-titles-bundle`, which inserts an all-prompts naming row): enabling that bundle keeps this plugin owning the single naming-provider slot, mirrors the all-prompts cadence so titles refresh with every prompt, and keeps the naming-model and provider-group routes in force (the provider id recorded per title is `session-title-all-prompts-llm`, exactly what the official row would record). Disabling the bundle restores the first-prompt cadence with the same route override. The takeover only uses released loader seams — the `loader/patch-context` waterfall, `Entry.update`, and `sessionTitle.register` plus its disposer — letting the official row register successfully first and then disabling it, so enabling the bundle no longer raises the `already registered` activation-failure toast.
 
-Since 0.4.30 the Auto review row also survives a degraded permission service. DSH's Auto gate reads `permissionPresets.current(session)` before every tool call, and when that service has gone inactive the read throws `cannot get required service "sessionProjections" in inactive context` outside the gate's own reviewer-error handling — so every tool call died before its body ran. The row now shadows that service inside its review scope: a failed probe reports "not on Auto", the tool call runs normally, and one log line states that review was skipped. A gate re-mounted after a profile reload unloads its previous registration first, so the `auto` preset cannot disappear from the permission picker.
+Since 0.4.30 the Auto review row also survives a degraded permission service. DSH's Auto gate reads `permissionPresets.current(session)` before every tool call, and when that service has gone inactive the read throws `cannot get required service "sessionProjections" in inactive context` outside the gate's own reviewer-error handling — so every tool call died before its body ran. The row shadows that service inside its review scope: a failed probe reports "not on Auto", the tool call runs normally, and one log line states that review was skipped. Since 0.4.31 the shadow is **always on** and resolves the service lazily per call (so it protects even while the service is still activating), and its one degradation line carries the exact fiber chain (`uid/state/name/inject` per fiber) that failed resolution — because the upstream cause is a loader lifecycle window: `internal/get` walks the whole caller fiber chain and twenty-four released rows declare `sessionProjections`, so any one of them mid-reload can break an unguarded probe (recorded in `docs/seam-gap.md` with the upstream proposal). The Auto registration itself is brokered — handed over and reclaimed around displacements without unmounting the gate, since unmounting is what flips live `auto` sessions to `danger-full-access` — and a gate re-mounted after a profile reload unloads its previous registration first, so the `auto` preset cannot disappear from the permission picker.
 
 
 ## Provider groups
@@ -181,7 +183,7 @@ Release-aligned search regression: `DSH_RELEASE_ANCHOR=/path/to/official/install
 
 If `dsh-composer-picker` is installed, remove it from the profile before enabling Model Switch. Model Switch already owns the Composer Picker and Plan Review seat; two owners produce duplicate or competing UI.
 
-Production profiles must use a released registry version or GitHub tag rather than workspace-local dependencies. Restart the selected DSH profile after installation or route changes.
+Production profiles must use a released registry version or GitHub tag rather than workspace-local dependencies. Restart the selected DSH profile after installation or route changes. **Restart once after installing, updating, enabling or disabling this plugin**: it owns Host rows and takes the official Auto-review row over at runtime (`permissionPresets.registerAuto` is a single registration slot); when a hot enable skips the restart, the official row may still be serving, so the takeover only shields the reviewer path — tools keep running, that call's review is skipped with one log line — and the seam converges on the next start.
 
 ## Compatibility
 

package/README.zh.md

@@ -90,7 +90,9 @@ Plan Review 拥有独立于会话当前路由的执行模型草稿。**确认执
 
 ## 自动审查模型（Auto review）
 
-官方 `@deepseek-ai/dsh-experimental-auto-review`（Auto 权限预设的逐调用审查）把审查请求固定在会话自身的路由上。本插件通过 `cordis.patch.yml` 的行替换接管这一行：官方行被禁用，改挂 `dsh-model-switch/auto-review`，它在作用域子上下文里运行**同一份官方 `apply`**，把 `llm.stream` 的 `provider/model` 改写为该会话解析出的审查模型（供应商配置组 → 全局审查卡片 → 会话自身模型）。在 `official.apply(scope)` 之后，本行立即在同一作用域注册 `{ prepend: true }` 的 `tools/pre-execute` 监听器（在 Cordis 瀑布流中排在官方监听器之前），用 `AsyncLocalStorage` 将 `exec.agent.session` 绑定到审查调用链上，因此不同供应商的多个会话并行时互不干扰，会话中途切换供应商也会在下一次审查立即生效。设置页「自动审查模型」默认关闭 = 审查跟随当前会话模型；打开时以目录首位模型作为可再改的固定起点，保存后对下一次审查立即生效。审查未配置官方能力包（`@deepseek-ai/dsh-experimental-auto-review` 未随 profile 启动）时本行不挂载，Auto 预设保持官方的关闭状态；官方行若已在别处注册，本行明确报错而不产生第二个 `registerAuto`。
+官方 `@deepseek-ai/dsh-experimental-auto-review`（Auto 权限预设的逐调用审查）把审查请求固定在会话自身的路由上。本插件通过 `cordis.patch.yml` 的行替换接管这一行：官方行被禁用，改挂 `dsh-model-switch/auto-review`，它在作用域子上下文里运行**同一份官方 `apply`**，把 `llm.stream` 的 `provider/model` 改写为该会话解析出的审查模型（供应商配置组 → 全局审查卡片 → 会话自身模型）。在 `official.apply(scope)` 之后，本行立即在同一作用域注册 `{ prepend: true }` 的 `tools/pre-execute` 监听器（在 Cordis 瀑布流中排在官方监听器之前），用 `AsyncLocalStorage` 将 `exec.agent.session` 绑定到审查调用链上，因此不同供应商的多个会话并行时互不干扰，会话中途切换供应商也会在下一次审查立即生效。设置页「自动审查模型」默认关闭 = 审查跟随当前会话模型；打开时以目录首位模型作为可再改的固定起点，保存后对下一次审查立即生效。审查未配置官方能力包（`@deepseek-ai/dsh-experimental-auto-review` 未随 profile 启动）时本行不挂载，Auto 预设保持官方的关闭状态。
+
+0.4.31 起本行还在运行时接管这条缝，而不仅靠补丁文件：插件管理器会把组件开关写进"在所有 bundle 层之后生效"的层，手动把官方「自动审查」组件重新打开曾会让无防护的官方 gate 回来——而 `permissionPresets.registerAuto` 是单注册的，同一条缝上的两行最终杀掉每个工具调用。现在本行按接管会话命名槽位的同一手法接管：官方行将要 apply 时**先同步交出** Auto 注册（让官方行干净应用而不是撞车），再通过公开的 `Entry.update` 停用官方行，并以有界重试收回注册——整个位移过程保留会话的 Auto 选择。因此在插件管理器里把官方组件再打开只是一次会记日志、自愈的空操作；设置页「自动审查」卡片里也写明了这一点。
 
 ## 压缩模型（Compaction model）
 
@@ -121,7 +123,7 @@ DSH 会自动为新会话起名；命名的触发节奏由 profile 的官方命
 
 0.4.29 起与实验包「随对话更新的标题」（`dsh-experimental-session-titles-bundle`，插入 all-prompts 命名行）兼容：启用该实验包时，本插件接管同一个命名 provider 槽位并镜像 all-prompts 节奏，标题随对话更新，同时命名模型路由与供应商组路由继续生效（`session/title` 记录中的 provider id 为 `session-title-all-prompts-llm`，与官方行一致）；禁用实验包即回到首条提示节奏与同样的路由覆写。实现只使用 loader 已发布的缝（`loader/patch-context` 瀑布、`Entry.update`、`sessionTitle.register` 及其 disposer），让官方行先成功注册、再被停用并由本行重占槽位，因此启用时不再出现 `already registered` 激活失败弹窗。
 
-0.4.30 起 Auto 审查行还能在许可服务降级时保住工具调用：DSH 的 Auto gate 在每次工具调用前读取 `permissionPresets.current(session)`，一旦该服务失活，这次读取会在 gate 自己的审查错误包装之外抛出 `cannot get required service "sessionProjections" in inactive context`，导致每个工具调用都在执行前失败。本行现在在审查作用域内遮蔽该服务：探测失败即按「不在 Auto」处理，工具调用照常执行，并只记一行日志说明审查被跳过。配置重载后重新挂载的 gate 会先卸载上一个注册，因此 `auto` 预设不会再从许可选择器里消失。
+0.4.30 起 Auto 审查行还能在许可服务降级时保住工具调用：DSH 的 Auto gate 在每次工具调用前读取 `permissionPresets.current(session)`，一旦该服务失活，这次读取会在 gate 自己的审查错误包装之外抛出 `cannot get required service "sessionProjections" in inactive context`，导致每个工具调用都在执行前失败。本行在审查作用域内遮蔽该服务：探测失败即按「不在 Auto」处理，工具调用照常执行，并只记一行日志说明审查被跳过。0.4.31 起该遮蔽**常开**且按调用惰性解析服务（服务尚未激活时也受保护），并把失败的解析链（每级 fiber 的 `uid/state/name/inject`）记进唯一那行降级日志——因为上游成因是 loader 生命周期窗口：`internal/get` 会沿调用方 fiber 链整链查找，而有 24 个已发布行在 `inject` 里声明了 `sessionProjections`，其中任何一行处于重载中都可能打断无防护的探测（连同上游建议一并记录在 `docs/seam-gap.md`）。Auto 注册本身改为**托管**：位移时同步交出、事后收回而不卸载 gate（卸载会把在用 `auto` 的会话翻成 `danger-full-access`）；配置重载后重新挂载的 gate 会先卸载上一个注册，因此 `auto` 预设不会再从许可选择器里消失。
 
 
 ## 供应商配置组（Provider groups）
@@ -179,7 +181,7 @@ DeepSeek 薄适配器调用官方公开 `DeepSeekSearchProvider`，复用用户
 
 如果 profile 已安装 `dsh-composer-picker`，请先移除它。Model Switch 已经拥有 Composer Picker 和 Plan Review 席位；同时安装会产生重复或竞争 UI。
 
-生产 profile 必须使用已发布的注册表版本或 GitHub tag，不能使用工作区本地依赖。安装或修改路由后重启对应的 DSH profile。
+生产 profile 必须使用已发布的注册表版本或 GitHub tag，不能使用工作区本地依赖。安装或修改路由后重启对应的 DSH profile。**安装、更新、启用或禁用本插件后都要重启一次**：它持有 Host 侧的行，并在运行时接管官方的自动审查行（`permissionPresets.registerAuto` 只有一个注册位）；不重启直接热启用时，官方行可能仍在服务，接管只能先把审查路径屏蔽掉——工具照常运行、本次审查跳过并留一条日志——重启后才会真正收敛。
 
 ## 兼容性
 

package/lib/auto-review.js

@@ -1,5 +1,206 @@
 import { i as sessionProviderOf, r as resolveCapabilityRoute } from "./session-route-BjNPlliu.js";
 import { AsyncLocalStorage } from "node:async_hooks";
+/**
+* The official package identity — the only handle on the row this plugin
+* trusts. Matching by id alone could reach a group or another plugin's row, and
+* a matched row is disabled (its fiber disposed).
+*/
+const OFFICIAL_AUTO_REVIEW_PACKAGE = "@deepseek-ai/dsh-experimental-auto-review";
+/**
+* Delays for the late re-claims after the attempt loop gave up (ms).
+*
+* `Entry.update({ disabled: true })` starts the displaced fiber's disposal but
+* the loader does not await it, and a disposal that tears down a mounted gate,
+* restores permission presets and unwinds fibers can take longer than the
+* attempt loop's budget. These re-claims keep trying for a few more seconds so a
+* hot-swapped install converges instead of needing a restart.
+*/
+const TAKEOVER_LATE_RETRY_DELAYS_MS = [
+	500,
+	1e3,
+	1500
+];
+/** Whether one loader entry is the official Auto-review row (strict package identity). */
+function isOfficialAutoReviewRow(entry) {
+	if (entry === void 0) return false;
+	const pkg = entry.options?.name;
+	return typeof pkg === "string" && pkg === "@deepseek-ai/dsh-experimental-auto-review";
+}
+/** The first composed official Auto-review row, if the profile declares one. */
+function officialAutoReviewEntry(loader) {
+	if (loader === void 0 || typeof loader.entries !== "function") return void 0;
+	for (const entry of loader.entries()) if (isOfficialAutoReviewRow(entry)) return entry;
+}
+/** The id one entry is known by (the loader's leaf id, not a nested path). */
+function leafId(entry) {
+	const raw = entry.options?.id;
+	return typeof raw === "string" ? raw : void 0;
+}
+/** A loader entry the loader has not created a fiber for yet. */
+function alreadyDisabled(entry) {
+	return entry.disabled === true;
+}
+/**
+* Displace the official Auto-review row and take the registration back.
+*
+* The official row is disabled through the public `Entry.update` (which starts
+* its fiber's disposal — the loader does not await it, so the claim retries
+* until the displaced registration actually released). The Auto selection of
+* live sessions is preserved around the displacement: the official gate's
+* disposal moves `auto` sessions to `danger-full-access` by design, and this
+* row's registration puts them back.
+*
+* @param ctx - this row's context, used only for logging.
+* @param entry - the official row to displace.
+* @param seam - the Auto-registration seam to yield and reclaim.
+* @returns a promise settling once the takeover attempt loop finished.
+*/
+async function reclaimOfficialAutoReviewRow(ctx, entry, seam) {
+	const label = String(leafId(entry) ?? "auto-review");
+	/** One disable-then-claim step; true once this row holds the registration. */
+	const attempt = async () => {
+		try {
+			await entry.update({ disabled: true });
+			ctx.logger.info(`model-switch: disabled the official auto-review row ${label} (${OFFICIAL_AUTO_REVIEW_PACKAGE}); Model Switch's auto-review row owns the reviewer seam (configurable reviewer route)`);
+		} catch (cause) {
+			ctx.logger.info("model-switch: the displaced auto-review row could not be persisted as disabled; the takeover repeats next startup");
+			ctx.logger.info(String(cause));
+		}
+		return await seam.claim();
+	};
+	await seam.preserveAuto(async () => {
+		for (let index = 0; index < 60; index += 1) {
+			await new Promise((resolve) => setTimeout(resolve, index === 0 ? 0 : 50));
+			if (await attempt()) {
+				ctx.logger.info(`model-switch: displaced the official auto-review row ${label}; Auto review runs under the configurable reviewer route`);
+				return;
+			}
+		}
+		ctx.logger.error(`model-switch: the official auto-review row ${label} kept the Auto registration; the reviewer route override is unavailable this session`);
+	});
+	scheduleLateReclaims(ctx, label, seam);
+}
+/**
+* Keep re-claiming for a few seconds after the attempt loop gave up.
+*
+* The displaced fiber's disposal starts on `Entry.update` but is not awaited by
+* the loader, so it can outlast the attempt loop — which is exactly the hot-swap
+* window where the official (unshielded) gate keeps serving. These bounded
+* re-claims converge that window instead of leaving it to a restart. Timers are
+* cleared when this row unloads.
+*
+* @param ctx - this row's context, used for logging and timer disposal.
+* @param label - the official row's id, for diagnostics.
+* @param seam - the Auto-registration seam to reclaim.
+*/
+function scheduleLateReclaims(ctx, label, seam) {
+	let stopped = false;
+	const timers = [];
+	const stop = () => {
+		stopped = true;
+		for (const timer of timers.splice(0)) clearTimeout(timer);
+	};
+	ctx.effect(function* () {
+		yield stop;
+	}, "model-switch: auto-review late takeover retries");
+	const run = (index) => {
+		if (stopped || index >= TAKEOVER_LATE_RETRY_DELAYS_MS.length) return;
+		const timer = setTimeout(() => {
+			(async () => {
+				if (stopped) return;
+				if (await seam.claim()) {
+					ctx.logger.info(`model-switch: reclaimed the Auto registration late from the official auto-review row ${label}; Auto review runs under the configurable reviewer route`);
+					stop();
+					return;
+				}
+				run(index + 1);
+			})();
+		}, TAKEOVER_LATE_RETRY_DELAYS_MS[index]);
+		timers.push(timer);
+	};
+	run(0);
+}
+/**
+* Install the takeover choreography for an official row that activates later.
+*
+* The plugin manager can re-enable the official row at any time (it writes
+* `disabled: false` into the profile patch layer, which applies after every
+* bundle layer). The `loader/patch-context` listener yields this row's
+* registration **synchronously** before the entry's plugin `apply` runs, so the
+* official row applies cleanly instead of colliding; the reclaim then disables
+* it and takes the registration back.
+*
+* @param ctx - this row's context.
+* @param seam - the Auto-registration seam to yield and reclaim.
+* @returns the guarded reclaim function, so the caller's startup takeover and
+* the listeners share one in-flight guard per entry.
+*/
+function installAutoReviewTakeover(ctx, seam) {
+	/** Entries already handled, so a repeated patch-context does not loop. */
+	const handled = /* @__PURE__ */ new Set();
+	/** Reclaims in flight, shared so two triggers for one entry join one cycle. */
+	const reclaiming = /* @__PURE__ */ new Map();
+	/** Disable the official row and take the registration back, once per entry. */
+	const reclaim = (entry) => {
+		const running = reclaiming.get(entry);
+		if (running !== void 0) return running;
+		const run = reclaimOfficialAutoReviewRow(ctx, entry, seam).finally(() => {
+			reclaiming.delete(entry);
+		});
+		reclaiming.set(entry, run);
+		return run;
+	};
+	/**
+	* The row an event names.
+	*
+	* The loader hands the emitting entry as the event's `this`, but cordis does
+	* not rebind `this` for listeners added through `ctx.on`, so a listener can
+	* also receive the payload as its first argument. Both shapes are accepted;
+	* the real Host always provides one of them.
+	*/
+	const entryOfEvent = (self, first) => {
+		const candidate = self ?? first;
+		return candidate !== null && typeof candidate === "object" && "options" in candidate ? candidate : void 0;
+	};
+	const listeners = [];
+	const listen = (event, listener) => {
+		const dispose = ctx.on?.(event, listener);
+		if (dispose !== void 0) listeners.push(dispose);
+	};
+	listen("loader/patch-context", function(first, second) {
+		const nextFn = typeof first === "function" ? first : second;
+		const entry = entryOfEvent(this, typeof first === "function" ? void 0 : first);
+		if (entry === void 0 || typeof nextFn !== "function" || !isOfficialAutoReviewRow(entry) || handled.has(entry)) return nextFn === void 0 ? void 0 : nextFn();
+		handled.add(entry);
+		seam.yieldRegistration();
+		reclaim(entry);
+		return nextFn();
+	});
+	listen("loader/partial-dispose", function(first) {
+		const entry = entryOfEvent(this, first);
+		if (entry === void 0 || !isOfficialAutoReviewRow(entry)) return;
+		handled.delete(entry);
+		seam.claim();
+	});
+	const loader = ctx.get("loader", false);
+	if (loader !== void 0 && typeof loader.entries === "function") for (const candidate of loader.entries()) {
+		if (!isOfficialAutoReviewRow(candidate)) continue;
+		if (alreadyDisabled(candidate)) continue;
+		reclaim(candidate);
+	}
+	const disposable = () => {
+		for (const dispose of listeners.splice(0)) dispose();
+	};
+	const effect = ctx.effect;
+	if (effect !== void 0) {
+		const registration = effect(function* () {
+			yield disposable;
+		}, "model-switch: auto-review takeover");
+		if (typeof registration === "function") listeners.push(registration);
+	}
+	return reclaim;
+}
+//#endregion
 //#region lib/types/auto-review.js
 /**
 * Model Switch-owned Auto reviewer row.
@@ -24,9 +225,14 @@ import { AsyncLocalStorage } from "node:async_hooks";
 * interference when multiple sessions review tool calls concurrently.
 *
 * The official gate stays an opt-in capability: the row mounts it only when
-* the profile actually started with the experimental-auto-review bundle.
-* `cordis.patch.yml` disables the official row (one `registerAuto` per
-* context), so this row is its replacement rather than a second registration.
+* the profile actually started with the experimental-auto-review bundle. Two
+* rows cannot share the seam — `permissionPresets.registerAuto` is a single
+* registration and the official probe is unshielded — so this row also
+* **takes the seam over** (see `./auto-review-takeover.ts`): a composed or
+* re-enabled official row is displaced through the released loader seams, the
+* registration is handed over and reclaimed around that displacement, and the
+* gate this row mounts keeps the defensive `permissionPresets` shadow so a
+* degraded preset service can never fail a tool call again.
 *
 * @module dsh-model-switch/auto-review
 */
@@ -41,11 +247,18 @@ const name = "model-switch-auto-review";
 * every tool call fail with `cannot get property "workingDirectory" without
 * inject`. The gate is now mounted as its own plugin (see {@link autoReviewGate}),
 * so cordis resolves the official dependency list — including future additions —
-* and this row declares only what it reads itself.
+* and this row declares only what it reads itself (`loader` drives the
+* takeover).
 */
-const inject = ["llm", "modelSwitch"];
+const inject = [
+	"llm",
+	"modelSwitch",
+	"loader"
+];
 /** Optional bundle whose composition opts a profile into Auto review. */
 const AUTO_REVIEW_BUNDLE = "@deepseek-ai/dsh-experimental-auto-review";
+/** The Auto preset name; `registerAuto` is what publishes it. */
+const AUTO_PRESET = "auto";
 /**
 * Resolve the pinned reviewer route from live settings.
 * @param settings - Model Switch settings carrying the optional reviewer pair.
@@ -120,17 +333,67 @@ function bindAutoReviewSessionCorrelation(scope, activeSession) {
 	}, "model-switch: auto-review session correlation");
 }
 /**
-* Build the scoped context the official gate runs under.
-* @param ctx - host context whose modelSwitch settings pin the reviewer route.
-* @param activeSession - optional AsyncLocalStorage correlating each `tools/pre-execute` call to its session.
-* @returns A child context shadowing the llm service and, when the permission
-* preset service is reachable, that service too.
+* Signatures of a broken reviewer seam, never of a real denial.
+*
+* The official gate's `tools/pre-execute` probe resolves its own
+* `sessionProjections` injection before anything can catch it; when that fiber
+* chain breaks it throws `cannot get required service ... in inactive context`
+* (or, on older lines, `cannot get property ... without inject`) straight into
+* the tool call. `TRANSPORT` covers a reviewer that cannot reach its route at
+* all. A denial is a *return* (`{ kind: 'deny' }`), so it never matches.
 */
-function reviewScope(ctx, activeSession = new AsyncLocalStorage()) {
-	const permissionPresets = permissionPresetsOf(ctx);
-	const shadows = { llm: reviewLlm(ctx.llm, () => resolveSessionAutoReviewRoute(ctx, activeSession.getStore())) };
-	if (permissionPresets !== void 0) shadows.permissionPresets = defensivePermissionPresets(permissionPresets, ctx.logger);
-	return ctx.extend(shadows);
+const REVIEWER_INFRA_FAILURE_SIGNATURES = [
+	"inactive context",
+	"cannot get required service",
+	"cannot get property",
+	"without inject",
+	"TRANSPORT"
+];
+/**
+* Whether a reviewer-path throw is a broken seam rather than a real decision.
+* @param cause - whatever the waterfall threw.
+* @returns true when the reviewer itself could not run.
+*/
+function isReviewerInfrastructureFailure(cause) {
+	const text = cause instanceof Error ? `${cause.name}: ${cause.message}` : String(cause);
+	return REVIEWER_INFRA_FAILURE_SIGNATURES.some((signature) => text.includes(signature));
+}
+/**
+* Keep a broken reviewer seam from failing tool calls.
+*
+* Registered on this row's own context through `{ prepend: true }`, so it sits
+* ahead of the official gate's listener and stays live even when the gate could
+* not be mounted (the takeover lost `registerAuto`, or the displaced row has
+* not released it yet). That is the one window the defensive
+* `permissionPresets` shadow cannot cover: the shadow lives in this row's review
+* scope, while the serving gate resolves the real service from the profile.
+*
+* The waterfall only decides whether the body runs; the body dispatches after
+* it returns, so allowing here never masks a tool failure. Reviewer transport
+* and quota errors keep failing closed — only seam breakage is allowed through.
+*
+* @param ctx - this row's context (the listener lives and dies with the plugin).
+* @param options - diagnostics plus the degraded-state predicate.
+*/
+function installToolCallSafetyNet(ctx, options = {}) {
+	let reported = false;
+	const handler = async (_exec, next) => {
+		try {
+			return await next();
+		} catch (cause) {
+			if (!isReviewerInfrastructureFailure(cause)) throw cause;
+			if (options.isDegraded !== void 0 && !options.isDegraded()) throw cause;
+			if (!reported) {
+				reported = true;
+				const detail = options.fiberChain === void 0 ? "" : `; fiber chain: ${options.fiberChain()}`;
+				ctx.logger.warn(`model-switch: the Auto reviewer path is broken (${String(cause)}); tool calls run unreviewed instead of failing${detail}`);
+			}
+			return { kind: "allow" };
+		}
+	};
+	ctx.effect(function* () {
+		yield ctx.on("tools/pre-execute", handler, { prepend: true });
+	}, "model-switch: reviewer-path safety net");
 }
 /** The preset name the service reports when no configured preset matches. */
 const CUSTOM_PRESET = "custom";
@@ -144,34 +407,69 @@ function permissionPresetsOf(ctx) {
 	}
 }
 /**
+* A compact dump of the fiber chain a service resolution walks.
+*
+* `cannot get required service "sessionProjections" in inactive context` is
+* thrown by the first fiber in the caller's chain that declares the service
+* without a resolved snapshot; the chain names that fiber directly.
+* @param ctx - the context whose chain is walked.
+* @returns One `uid/state/name/inject` segment per fiber, outermost last.
+*/
+function fiberChainOf(ctx) {
+	const parts = [];
+	let node = ctx;
+	for (let step = 0; step < 8; step += 1) {
+		const fiber = node?.fiber;
+		if (fiber === void 0) break;
+		const injects = Object.keys(fiber.inject ?? {}).join("|");
+		parts.push(`uid=${String(fiber.uid)} state=${String(fiber.state)} name=${String(fiber.name)} inject=[${injects}]`);
+		node = fiber.parent;
+	}
+	return parts.length === 0 ? "no fiber chain" : parts.join(" -> ");
+}
+/**
 * Wrap the permission-preset service so the official gate's per-call probe can
-* never fail a tool call.
+* never fail a tool call, and broker its single Auto registration.
 *
 * DSH's Auto gate starts every `tools/pre-execute` with
 * `permissionPresets.current(session)`, and that method resolves the presets
 * service's own `sessionProjections` injection. When the presets fiber has
 * turned inactive the probe throws `cannot get required service
 * "sessionProjections" in inactive context` outside the gate's reviewer error
-* wrapper, so every tool call dies. This wrapper degrades the probe to
-* `custom` (the gate then skips review and calls `next()`), reports the lost
-* capability once, and keeps the tool backend alive; the registration and
-* teardown paths degrade the same way instead of throwing.
+* wrapper, so every tool call dies. This wrapper resolves the service lazily
+* (so the shadow is in place even while the service is still activating),
+* degrades the probe to `custom` (the gate then skips review and calls
+* `next()`), and reports the lost capability once — with the fiber chain that
+* failed resolution, so the next occurrence names the inactive fiber.
 *
-* @param real - the host's permission-preset service.
+* `registerAuto` is **brokered**: the gate yields the disposer into its own
+* effect, but the takeover must be able to hand the single registration to a
+* displacing row and take it back without unmounting the gate (the gate's
+* disposal would move live `auto` sessions to `danger-full-access`).
+*
+* @param resolve - resolves the host's permission-preset service per call.
 * @param log - the row logger used for the single degradation report.
-* @returns A structurally compatible preset face.
+* @param chain - diagnostic dump of the resolution chain; defaults to empty.
+* @returns A managed preset face.
 */
-function defensivePermissionPresets(real, log) {
+function defensivePermissionPresets(resolve, log, chain = () => "") {
 	let reported = false;
+	let admit;
+	let release;
 	const degrade = (operation, error) => {
 		if (reported) return;
 		reported = true;
-		log.warn(`model-switch: the permission-preset service refused ${operation} (${String(error)}); the Auto reviewer passes tool calls through instead of blocking them`);
+		log.warn(`model-switch: the permission-preset service refused ${operation} (${String(error)}); the Auto reviewer passes tool calls through instead of blocking them [chain: ${chain()}]`);
+	};
+	const requireService = () => {
+		const face = resolve();
+		if (face === void 0) throw new Error("permission: the permission-preset service is unavailable");
+		return face;
 	};
 	return {
 		current(session) {
 			try {
-				return real.current(session);
+				return requireService().current(session);
 			} catch (error) {
 				degrade("current()", error);
 				return CUSTOM_PRESET;
@@ -179,22 +477,56 @@ function defensivePermissionPresets(real, log) {
 		},
 		set(session, preset) {
 			try {
-				return real.set(session, preset);
+				return requireService().set(session, preset);
 			} catch (error) {
 				degrade("set()", error);
 				return;
 			}
 		},
-		registerAuto(admit) {
+		registerAuto(next) {
+			admit = next;
+			release = requireService().registerAuto(next);
+			return () => {
+				admit = void 0;
+				const dispose = release;
+				release = void 0;
+				return dispose?.();
+			};
+		},
+		releaseForTakeover() {
+			const dispose = release;
+			release = void 0;
+			dispose?.();
+		},
+		reclaimRegistration() {
+			if (release !== void 0) return true;
+			if (admit === void 0) return false;
 			try {
-				return real.registerAuto(admit);
-			} catch (error) {
-				log.warn(`model-switch: the Auto preset integration was not registered (${String(error)}); review keeps the existing integration`);
-				return () => Promise.resolve();
+				release = requireService().registerAuto(admit);
+				return true;
+			} catch {
+				return false;
 			}
+		},
+		get registered() {
+			return release !== void 0;
 		}
 	};
 }
+/**
+* Build the scoped context the official gate runs under.
+* @param ctx - host context whose modelSwitch settings pin the reviewer route.
+* @param activeSession - optional AsyncLocalStorage correlating each `tools/pre-execute` call to its session.
+* @param presets - optional managed preset face shared with the row's takeover.
+* @returns A child context shadowing the llm service and the permission-preset
+* service (always: a gate that sees the raw service can fail a tool call).
+*/
+function reviewScope(ctx, activeSession = new AsyncLocalStorage(), presets = defensivePermissionPresets(() => permissionPresetsOf(ctx), ctx.logger, () => fiberChainOf(ctx))) {
+	return ctx.extend({
+		llm: reviewLlm(ctx.llm, () => resolveSessionAutoReviewRoute(ctx, activeSession.getStore())),
+		permissionPresets: presets
+	});
+}
 /** Structural read of launcher-provided profile facts (the app-boot seam). */
 function autoReviewBundleActive(ctx) {
 	let profile;
@@ -207,6 +539,15 @@ function autoReviewBundleActive(ctx) {
 	const bundles = profile.startedBundles;
 	return Array.isArray(bundles) && bundles.includes(AUTO_REVIEW_BUNDLE);
 }
+/** Structural read of the loader service the takeover drives. */
+function loaderOf(ctx) {
+	try {
+		const loader = ctx.get("loader", false);
+		return loader !== null && typeof loader === "object" ? loader : void 0;
+	} catch {
+		return;
+	}
+}
 /**
 * Wrap the official gate as a plugin that declares its own dependencies.
 *
@@ -247,11 +588,14 @@ function autoReviewGate(gate, hooks = {}) {
 */
 let lastGateFiber;
 /**
-* Mount the official gate under the reviewer-route scope.
+* Mount the official gate under the reviewer-route scope and own the seam.
 *
 * A profile that never enabled the optional bundle keeps no Auto preset and no
 * reviewer; a deployment missing the official package reports the lost
-* capability explicitly instead of guessing another path.
+* capability explicitly instead of guessing another path. A composed (or
+* plugin-manager re-enabled) official row is displaced first — see
+* `./auto-review-takeover.ts` for the choreography and why the yield is
+* synchronous.
 */
 async function apply(ctx) {
 	if (!autoReviewBundleActive(ctx)) {
@@ -266,42 +610,109 @@ async function apply(ctx) {
 		ctx.logger.error(cause);
 		return;
 	}
-	const previous = lastGateFiber;
-	lastGateFiber = void 0;
-	if (previous !== void 0) try {
-		await previous.dispose();
-	} catch (cause) {
-		ctx.logger.info("model-switch: the previous auto-review gate had already unloaded; continuing with the new one");
-		ctx.logger.info(String(cause));
-	}
+	const presets = defensivePermissionPresets(() => permissionPresetsOf(ctx), ctx.logger, () => fiberChainOf(ctx));
 	const activeSession = new AsyncLocalStorage();
-	const scope = reviewScope(ctx, activeSession);
-	let failure;
-	let applied = false;
-	const fiber = scope.plugin(autoReviewGate(official, {
-		onApplied: () => {
-			applied = true;
-		},
-		onFailure: (error) => {
-			failure = error;
-		}
-	}));
-	try {
-		await fiber;
-	} catch (cause) {
-		failure ??= cause;
-	}
-	if (failure !== void 0) {
-		ctx.logger.error("model-switch: the official auto-review row is already active; the reviewer route override is unavailable");
-		ctx.logger.error(failure);
-		return;
-	}
-	if (!applied) {
-		ctx.logger.info("model-switch: the official auto-review gate is waiting for its host services; the reviewer route override is not bound yet");
-		return;
-	}
-	lastGateFiber = fiber;
-	bindAutoReviewSessionCorrelation(scope, activeSession);
+	const scope = reviewScope(ctx, activeSession, presets);
+	installToolCallSafetyNet(ctx, {
+		fiberChain: () => fiberChainOf(ctx),
+		isDegraded: () => !presets.registered
+	});
+	let gateReady = false;
+	let mountInFlight;
+	/** Sessions currently on the Auto preset (best-effort). */
+	const rememberAuto = () => {
+		const remembered = [];
+		try {
+			const sessions = ctx.get("sessions", false);
+			for (const session of sessions?.list?.() ?? []) if (presets.current(session) === AUTO_PRESET) remembered.push(session);
+		} catch {}
+		return remembered;
+	};
+	const restoreAuto = (remembered) => {
+		for (const session of remembered) try {
+			presets.set(session, AUTO_PRESET);
+		} catch {}
+	};
+	/**
+	* Run one displacement step without losing the sessions' Auto selection.
+	*
+	* Disposing a gate moves live `auto` sessions to `danger-full-access` by
+	* design (the official teardown runs on both the displaced row and this
+	* row's own re-mounts); the remembered selection is restored afterwards.
+	*/
+	const preserveAuto = async (action) => {
+		const remembered = rememberAuto();
+		await action();
+		restoreAuto(remembered);
+	};
+	/** Mount this row's shielded gate exactly once; failures dispose and report. */
+	const mountGate = () => {
+		mountInFlight ??= (async () => {
+			let outcome = "failed";
+			await preserveAuto(async () => {
+				const previous = lastGateFiber;
+				lastGateFiber = void 0;
+				gateReady = false;
+				if (previous !== void 0) try {
+					await previous.dispose();
+				} catch (cause) {
+					ctx.logger.info("model-switch: the previous auto-review gate had already unloaded; continuing with the new one");
+					ctx.logger.info(String(cause));
+				}
+				let failure;
+				let applied = false;
+				const fiber = scope.plugin(autoReviewGate(official, {
+					onApplied: () => {
+						applied = true;
+						bindAutoReviewSessionCorrelation(scope, activeSession);
+					},
+					onFailure: (error) => {
+						failure = error;
+					}
+				}));
+				try {
+					await fiber;
+				} catch (cause) {
+					failure ??= cause;
+				}
+				if (failure !== void 0) {
+					try {
+						await fiber.dispose();
+					} catch {}
+					ctx.logger.warn(`model-switch: the Auto reviewer gate did not mount (${String(failure)}); the displaced registration may still be releasing`);
+					outcome = "failed";
+					return;
+				}
+				if (!applied) {
+					ctx.logger.info("model-switch: the official auto-review gate is waiting for its host services; the reviewer route override is not bound yet");
+					outcome = "waiting";
+					return;
+				}
+				lastGateFiber = fiber;
+				gateReady = true;
+				outcome = "applied";
+			});
+			return outcome;
+		})().finally(() => {
+			mountInFlight = void 0;
+		});
+		return mountInFlight;
+	};
+	/** Make this row's Auto registration live; true once it is held. */
+	const claim = async () => {
+		if (presets.registered) return true;
+		if (gateReady) return presets.reclaimRegistration();
+		return await mountGate() !== "failed";
+	};
+	const reclaim = installAutoReviewTakeover(ctx, {
+		yieldRegistration: () => presets.releaseForTakeover(),
+		claim,
+		preserveAuto
+	});
+	const entry = officialAutoReviewEntry(loaderOf(ctx));
+	if (entry !== void 0 && entry.disabled !== true) await reclaim(entry);
+	else await claim();
+	if (!presets.registered) ctx.logger.error("model-switch: the Auto registration is not held by this row, so Auto review runs without the configurable reviewer route; the reviewer path is shielded instead of failing tool calls. Restart DSH to converge the reviewer row — a hot install cannot always displace the official row in time");
 }
 //#endregion
-export { apply, autoReviewGate, autoReviewRouteOf, bindAutoReviewSessionCorrelation, defensivePermissionPresets, inject, name, resolveSessionAutoReviewRoute, reviewLlm, reviewScope };
+export { apply, autoReviewGate, autoReviewRouteOf, bindAutoReviewSessionCorrelation, defensivePermissionPresets, inject, installToolCallSafetyNet, isReviewerInfrastructureFailure, name, resolveSessionAutoReviewRoute, reviewLlm, reviewScope };

package/lib/client.js

@@ -1800,6 +1800,10 @@ window.__ModuleLoader__.load({
 									className: ModelSwitchSettings_module_css_default.hint,
 									children: props.t("loading")
 								}) : /* @__PURE__ */ (0, react_jsx_runtime.jsxs)(react_jsx_runtime.Fragment, { children: [
+									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+										className: ModelSwitchSettings_module_css_default.hint,
+										children: props.t("autoReviewTakeoverNote")
+									}),
 									/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
 										className: ModelSwitchSettings_module_css_default.hint,
 										children: props.t("autoReviewRouteHelp")
@@ -2283,8 +2287,9 @@ window.__ModuleLoader__.load({
 			catalogFailed: "无法加载模型目录。",
 			autoReview: "自动审查模型",
 			autoReviewFollow: "跟随会话模型",
-			autoReviewHelp: "为官方 auto-review（Auto 权限预设的逐调用审查）指定审查模型；需启用官方 auto-review 能力包。关闭时审查跟随当前会话模型。",
+			autoReviewHelp: "为官方 auto-review（Auto 权限预设的逐调用审查）指定审查模型；需启用官方 auto-review 能力包。关闭时审查跟随当前会话模型。本插件启用时，官方「自动审查」组件由本插件接管。",
 			autoReviewRouteHelp: "审查请求固定使用这里的 Provider/模型，与会话模型无关；保存后对下一次审查立即生效。",
+			autoReviewTakeoverNote: "官方「自动审查」组件已由本插件接管（提供可配置审查路由）；在插件管理里把它重新打开会被再次关闭，并在日志里留下一条记录。",
 			compaction: "压缩模型",
 			compactionFollow: "跟随会话模型",
 			compactionHelp: "为官方压缩（/compact 与官方自动压缩）指定摘要模型；关闭（两个字段都留空）时使用官方默认，即当前会话的目标模型。",
@@ -2341,8 +2346,9 @@ window.__ModuleLoader__.load({
 			catalogFailed: "Could not load the model catalog.",
 			autoReview: "Auto review model",
 			autoReviewFollow: "Follows the session model",
-			autoReviewHelp: "Pin the reviewer model for the official auto-review gate (per-call review under the Auto permission preset). Requires the official auto-review bundle. When off, reviews follow the session model.",
+			autoReviewHelp: "Pin the reviewer model for the official auto-review gate (per-call review under the Auto permission preset). Requires the official auto-review bundle. When off, reviews follow the session model. With this plugin enabled the official auto-review component is taken over.",
 			autoReviewRouteHelp: "Review requests use exactly this provider/model regardless of the session model; saved changes apply to the very next review.",
+			autoReviewTakeoverNote: "The official auto-review component is taken over by this plugin (configurable reviewer route); toggling it back on in the plugin manager is re-disabled, with one log line.",
 			compaction: "Compaction model",
 			compactionFollow: "Follows the conversation model",
 			compactionHelp: "Pick the summarization model for official compaction (/compact and official automatic compaction). When off (both fields empty), the official default applies: the conversation target model.",

package/lib/types/auto-review-takeover.d.ts

@@ -0,0 +1,100 @@
+/**
+ * Model Switch's takeover of the official Auto-review row.
+ *
+ * `permissionPresets.registerAuto` is a single registration, and the official
+ * gate's `tools/pre-execute` probe is unshielded — it resolves the presets
+ * service's `sessionProjections` injection on every tool call and dies with
+ * `cannot get required service "sessionProjections" in inactive context` when
+ * that chain breaks. Two live rows are therefore not survivable: the row that
+ * loses `registerAuto` fails mid-effect (its probe listener half-applied, every
+ * later tool call failing on the raw probe error), and the row that wins runs
+ * unguarded. The plugin-manager toggle makes this reachable at runtime by
+ * writing `disabled: false` for the official row into the profile patch layer.
+ *
+ * This module keeps exactly one row on the seam by taking the official row out
+ * of the composition and letting this plugin's row claim the registration —
+ * the same released-seam choreography the session-title takeover uses:
+ * `loader/patch-context`, `Entry.update`, `loader/partial-dispose`.
+ *
+ * The yield is **synchronous** on purpose: `loader/patch-context` is a
+ * synchronous waterfall whose `next()` returns straight into the entry's
+ * `registry.plugin(...)` mount, so the official `registerAuto` runs in the same
+ * turn. An awaited yield would still collide; a synchronous release hands the
+ * registration over cleanly (the official row then applies in full and is
+ * disposed cleanly, never half-applied).
+ *
+ * @module dsh-model-switch/auto-review-takeover
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import type { Entry, Loader } from '@deepseek-ai/cordis-plugin-loader';
+/** The loader row id the official Auto-review bundle declares. */
+export declare const OFFICIAL_AUTO_REVIEW_ROW = "auto-review";
+/**
+ * The official package identity — the only handle on the row this plugin
+ * trusts. Matching by id alone could reach a group or another plugin's row, and
+ * a matched row is disabled (its fiber disposed).
+ */
+export declare const OFFICIAL_AUTO_REVIEW_PACKAGE = "@deepseek-ai/dsh-experimental-auto-review";
+/** Bounded takeover attempts before the seam is reported lost. */
+export declare const TAKEOVER_MAX_ATTEMPTS = 60;
+/** Delay between takeover attempts; the first attempt is immediate. */
+export declare const TAKEOVER_RETRY_DELAY_MS = 50;
+/**
+ * Delays for the late re-claims after the attempt loop gave up (ms).
+ *
+ * `Entry.update({ disabled: true })` starts the displaced fiber's disposal but
+ * the loader does not await it, and a disposal that tears down a mounted gate,
+ * restores permission presets and unwinds fibers can take longer than the
+ * attempt loop's budget. These re-claims keep trying for a few more seconds so a
+ * hot-swapped install converges instead of needing a restart.
+ */
+export declare const TAKEOVER_LATE_RETRY_DELAYS_MS: readonly [500, 1000, 1500];
+/** The seam this row's gate owns; the takeover drives it around the official row. */
+export interface AutoReviewSeam {
+    /**
+     * Synchronously free the Auto registration so a displacing row can register
+     * cleanly. Keeping the admit callback is the seam's business; claiming puts
+     * the registration back.
+     */
+    yieldRegistration(): void;
+    /** Make this row's Auto registration live; true once it is held. */
+    claim(): Promise<boolean>;
+    /** Run one takeover step without losing the sessions' Auto selection. */
+    preserveAuto(action: () => Promise<void>): Promise<void>;
+}
+/** Whether one loader entry is the official Auto-review row (strict package identity). */
+export declare function isOfficialAutoReviewRow(entry: Entry | undefined): boolean;
+/** The first composed official Auto-review row, if the profile declares one. */
+export declare function officialAutoReviewEntry(loader: Loader | undefined): Entry | undefined;
+/**
+ * Displace the official Auto-review row and take the registration back.
+ *
+ * The official row is disabled through the public `Entry.update` (which starts
+ * its fiber's disposal — the loader does not await it, so the claim retries
+ * until the displaced registration actually released). The Auto selection of
+ * live sessions is preserved around the displacement: the official gate's
+ * disposal moves `auto` sessions to `danger-full-access` by design, and this
+ * row's registration puts them back.
+ *
+ * @param ctx - this row's context, used only for logging.
+ * @param entry - the official row to displace.
+ * @param seam - the Auto-registration seam to yield and reclaim.
+ * @returns a promise settling once the takeover attempt loop finished.
+ */
+export declare function reclaimOfficialAutoReviewRow(ctx: Context, entry: Entry, seam: AutoReviewSeam): Promise<void>;
+/**
+ * Install the takeover choreography for an official row that activates later.
+ *
+ * The plugin manager can re-enable the official row at any time (it writes
+ * `disabled: false` into the profile patch layer, which applies after every
+ * bundle layer). The `loader/patch-context` listener yields this row's
+ * registration **synchronously** before the entry's plugin `apply` runs, so the
+ * official row applies cleanly instead of colliding; the reclaim then disables
+ * it and takes the registration back.
+ *
+ * @param ctx - this row's context.
+ * @param seam - the Auto-registration seam to yield and reclaim.
+ * @returns the guarded reclaim function, so the caller's startup takeover and
+ * the listeners share one in-flight guard per entry.
+ */
+export declare function installAutoReviewTakeover(ctx: Context, seam: AutoReviewSeam): (entry: Entry) => Promise<void>;

package/lib/types/auto-review.d.ts

@@ -21,9 +21,14 @@
  * interference when multiple sessions review tool calls concurrently.
  *
  * The official gate stays an opt-in capability: the row mounts it only when
- * the profile actually started with the experimental-auto-review bundle.
- * `cordis.patch.yml` disables the official row (one `registerAuto` per
- * context), so this row is its replacement rather than a second registration.
+ * the profile actually started with the experimental-auto-review bundle. Two
+ * rows cannot share the seam — `permissionPresets.registerAuto` is a single
+ * registration and the official probe is unshielded — so this row also
+ * **takes the seam over** (see `./auto-review-takeover.ts`): a composed or
+ * re-enabled official row is displaced through the released loader seams, the
+ * registration is handed over and reclaimed around that displacement, and the
+ * gate this row mounts keeps the defensive `permissionPresets` shadow so a
+ * degraded preset service can never fail a tool call again.
  *
  * @module dsh-model-switch/auto-review
  */
@@ -42,7 +47,8 @@ export declare const name = "model-switch-auto-review";
  * every tool call fail with `cannot get property "workingDirectory" without
  * inject`. The gate is now mounted as its own plugin (see {@link autoReviewGate}),
  * so cordis resolves the official dependency list — including future additions —
- * and this row declares only what it reads itself.
+ * and this row declares only what it reads itself (`loader` drives the
+ * takeover).
  */
 export declare const inject: string[];
 /** Pinned reviewer route; both identifiers are non-empty. */
@@ -97,40 +103,95 @@ export declare function resolveSessionAutoReviewRoute(ctx: Context, session?: Se
  */
 export declare function bindAutoReviewSessionCorrelation(scope: Context, activeSession: AsyncLocalStorage<Session | undefined>): void;
 /**
- * Build the scoped context the official gate runs under.
- * @param ctx - host context whose modelSwitch settings pin the reviewer route.
- * @param activeSession - optional AsyncLocalStorage correlating each `tools/pre-execute` call to its session.
- * @returns A child context shadowing the llm service and, when the permission
- * preset service is reachable, that service too.
+ * Whether a reviewer-path throw is a broken seam rather than a real decision.
+ * @param cause - whatever the waterfall threw.
+ * @returns true when the reviewer itself could not run.
  */
-export declare function reviewScope(ctx: Context, activeSession?: AsyncLocalStorage<Session | undefined>): Context;
+export declare function isReviewerInfrastructureFailure(cause: unknown): boolean;
+/**
+ * Keep a broken reviewer seam from failing tool calls.
+ *
+ * Registered on this row's own context through `{ prepend: true }`, so it sits
+ * ahead of the official gate's listener and stays live even when the gate could
+ * not be mounted (the takeover lost `registerAuto`, or the displaced row has
+ * not released it yet). That is the one window the defensive
+ * `permissionPresets` shadow cannot cover: the shadow lives in this row's review
+ * scope, while the serving gate resolves the real service from the profile.
+ *
+ * The waterfall only decides whether the body runs; the body dispatches after
+ * it returns, so allowing here never masks a tool failure. Reviewer transport
+ * and quota errors keep failing closed — only seam breakage is allowed through.
+ *
+ * @param ctx - this row's context (the listener lives and dies with the plugin).
+ * @param options - diagnostics plus the degraded-state predicate.
+ */
+export declare function installToolCallSafetyNet(ctx: Context, options?: {
+    /** Diagnostic fiber dump appended to the first report. */
+    fiberChain?: (() => string) | undefined;
+    /**
+     * Whether this row currently knows the reviewer route is not held.
+     *
+     * The net only fails open in that state: another plugin's broken listener
+     * must keep failing closed, and a held route already has the defensive
+     * shadow in front of it. Defaults to always degraded (direct callers).
+     */
+    isDegraded?: (() => boolean) | undefined;
+}): void;
 /** The permission-preset face the official gate reads; structural so a missing package never breaks a build. */
 export interface PermissionPresetsFace {
     current(session: Session): string;
     set(session: Session, preset: string): unknown;
     registerAuto(admit: () => void): unknown;
 }
+/**
+ * The managed face: what the gate sees, plus the registration handle the
+ * takeover drives.
+ */
+export interface ManagedPermissionPresetsFace extends PermissionPresetsFace {
+    /** Synchronously release the live Auto registration, keeping the admit callback. */
+    releaseForTakeover(): void;
+    /** Take the Auto registration back; true once it is live. */
+    reclaimRegistration(): boolean;
+    /** Whether this face currently holds the Auto registration. */
+    readonly registered: boolean;
+}
 /**
  * Wrap the permission-preset service so the official gate's per-call probe can
- * never fail a tool call.
+ * never fail a tool call, and broker its single Auto registration.
  *
  * DSH's Auto gate starts every `tools/pre-execute` with
  * `permissionPresets.current(session)`, and that method resolves the presets
  * service's own `sessionProjections` injection. When the presets fiber has
  * turned inactive the probe throws `cannot get required service
  * "sessionProjections" in inactive context` outside the gate's reviewer error
- * wrapper, so every tool call dies. This wrapper degrades the probe to
- * `custom` (the gate then skips review and calls `next()`), reports the lost
- * capability once, and keeps the tool backend alive; the registration and
- * teardown paths degrade the same way instead of throwing.
- *
- * @param real - the host's permission-preset service.
+ * wrapper, so every tool call dies. This wrapper resolves the service lazily
+ * (so the shadow is in place even while the service is still activating),
+ * degrades the probe to `custom` (the gate then skips review and calls
+ * `next()`), and reports the lost capability once — with the fiber chain that
+ * failed resolution, so the next occurrence names the inactive fiber.
+ *
+ * `registerAuto` is **brokered**: the gate yields the disposer into its own
+ * effect, but the takeover must be able to hand the single registration to a
+ * displacing row and take it back without unmounting the gate (the gate's
+ * disposal would move live `auto` sessions to `danger-full-access`).
+ *
+ * @param resolve - resolves the host's permission-preset service per call.
  * @param log - the row logger used for the single degradation report.
- * @returns A structurally compatible preset face.
+ * @param chain - diagnostic dump of the resolution chain; defaults to empty.
+ * @returns A managed preset face.
  */
-export declare function defensivePermissionPresets(real: PermissionPresetsFace, log: {
+export declare function defensivePermissionPresets(resolve: () => PermissionPresetsFace | undefined, log: {
     warn(line: string): void;
-}): PermissionPresetsFace;
+}, chain?: () => string): ManagedPermissionPresetsFace;
+/**
+ * Build the scoped context the official gate runs under.
+ * @param ctx - host context whose modelSwitch settings pin the reviewer route.
+ * @param activeSession - optional AsyncLocalStorage correlating each `tools/pre-execute` call to its session.
+ * @param presets - optional managed preset face shared with the row's takeover.
+ * @returns A child context shadowing the llm service and the permission-preset
+ * service (always: a gate that sees the raw service can fail a tool call).
+ */
+export declare function reviewScope(ctx: Context, activeSession?: AsyncLocalStorage<Session | undefined>, presets?: ManagedPermissionPresetsFace): Context;
 /**
  * Structural view of the official gate's plugin face.
  *
@@ -168,10 +229,13 @@ export declare function autoReviewGate(gate: OfficialAutoReviewGate, hooks?: {
     readonly onFailure?: (error: unknown) => void;
 }): MountedAutoReviewGate;
 /**
- * Mount the official gate under the reviewer-route scope.
+ * Mount the official gate under the reviewer-route scope and own the seam.
  *
  * A profile that never enabled the optional bundle keeps no Auto preset and no
  * reviewer; a deployment missing the official package reports the lost
- * capability explicitly instead of guessing another path.
+ * capability explicitly instead of guessing another path. A composed (or
+ * plugin-manager re-enabled) official row is displaced first — see
+ * `./auto-review-takeover.ts` for the choreography and why the yield is
+ * synchronous.
  */
 export declare function apply(ctx: Context): Promise<void>;

package/lib/types/client/locales.d.ts

@@ -30,8 +30,9 @@ export declare const zh: {
     readonly catalogFailed: "无法加载模型目录。";
     readonly autoReview: "自动审查模型";
     readonly autoReviewFollow: "跟随会话模型";
-    readonly autoReviewHelp: "为官方 auto-review（Auto 权限预设的逐调用审查）指定审查模型；需启用官方 auto-review 能力包。关闭时审查跟随当前会话模型。";
+    readonly autoReviewHelp: "为官方 auto-review（Auto 权限预设的逐调用审查）指定审查模型；需启用官方 auto-review 能力包。关闭时审查跟随当前会话模型。本插件启用时，官方「自动审查」组件由本插件接管。";
     readonly autoReviewRouteHelp: "审查请求固定使用这里的 Provider/模型，与会话模型无关；保存后对下一次审查立即生效。";
+    readonly autoReviewTakeoverNote: "官方「自动审查」组件已由本插件接管（提供可配置审查路由）；在插件管理里把它重新打开会被再次关闭，并在日志里留下一条记录。";
     readonly compaction: "压缩模型";
     readonly compactionFollow: "跟随会话模型";
     readonly compactionHelp: "为官方压缩（/compact 与官方自动压缩）指定摘要模型；关闭（两个字段都留空）时使用官方默认，即当前会话的目标模型。";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-model-switch",
-  "version": "0.4.30",
+  "version": "0.4.32",
   "description": "Explicit model routing plus composer/Plan picker for DeepSeek Harness",
   "repository": {
     "type": "git",