dsh-model-switch 0.4.31 → 0.4.33

package/lib/session-route-D1zoZgf3.js

@@ -0,0 +1,258 @@
+//#region lib/types/provider-group.js
+/**
+* Provider configuration groups: per-provider presets for the compaction,
+* auto-review, session-naming, and subagent routes.
+*
+* A group is a DERIVED policy, not a write: `src/session-route.ts` resolves the
+* routes one session should use from its own provider plus this stored table, so
+* switching a session's provider never rewrites deployment-wide settings and two
+* sessions on different providers cannot overwrite each other. The field names
+* below are the flat settings field names a group pins, which keeps the stored
+* shape identical across releases.
+*
+* All functions here are pure and never throw on malformed storage.
+*/
+const ROUTE_FIELDS = Object.freeze([
+	"compactProvider",
+	"compactModel",
+	"autoReviewProvider",
+	"autoReviewModel",
+	"subagentProvider",
+	"subagentModel",
+	"subagentReasoningEffort",
+	"titleProvider",
+	"titleModel"
+]);
+/** Own data property, so a literal '__proto__' provider id can never touch a prototype. */
+function setKey(target, key, value) {
+	Object.defineProperty(target, key, {
+		value,
+		enumerable: true,
+		writable: true,
+		configurable: true
+	});
+}
+/** A non-blank string. Blank values behave exactly like an absent field. */
+function present$1(value) {
+	return typeof value === "string" && value.trim() !== "";
+}
+/** Normalize one raw entry to its owning provider and route view; undefined for non-object junk. */
+function normalizeEntry(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return void 0;
+	const source = value;
+	const group = {};
+	for (const field of ROUTE_FIELDS) {
+		const item = source[field];
+		if (present$1(item)) group[field] = item;
+	}
+	return {
+		provider: present$1(source.provider) ? source.provider : "",
+		group
+	};
+}
+/**
+* Strip a raw stored value to well-formed groups; never throws. Both storage
+* shapes are accepted: the stored entry array (keys live in each entry's
+* `provider` field) and a hand-written provider → routes map (keys are the
+* providers). All-empty entries stay: they pin a provider to every default.
+*/
+function normalizeProviderGroups(raw) {
+	const groups = {};
+	if (Array.isArray(raw)) {
+		for (const entry of raw) {
+			const view = normalizeEntry(entry);
+			if (view === void 0 || view.provider === "") continue;
+			setKey(groups, view.provider, view.group);
+		}
+		return groups;
+	}
+	if (raw !== null && typeof raw === "object") for (const [key, value] of Object.entries(raw)) {
+		if (key.trim() === "") continue;
+		const view = normalizeEntry(value);
+		if (view === void 0) continue;
+		setKey(groups, key, view.group);
+	}
+	return groups;
+}
+/**
+* The saved group for a provider.
+* @returns the normalized group, or undefined when the provider has no group —
+* which is what leaves the live routes untouched during a switch.
+*/
+function groupOf(groups, provider) {
+	if (groups === void 0 || provider.trim() === "") return void 0;
+	if (!Object.prototype.hasOwnProperty.call(groups, provider)) return void 0;
+	return groups[provider];
+}
+//#endregion
+//#region lib/types/session-route.js
+/**
+* Per-session capability route derivation.
+*
+* Model Switch stores one deployment-wide route per capability (the flat
+* settings fields) plus, per provider, a saved provider group. Nothing is
+* written when a session changes provider: this module DERIVES the route a
+* capability should use for one session from (a) the session's own provider and
+* (b) the stored group table. Two sessions on different providers therefore
+* resolve independently, and no session's actions rewrite another session's
+* route.
+*
+* The session's provider is read from durable, official state in this order:
+* the `modelSelection` session projection (`pending` before `lastUsed`, so a
+* selection the user just made counts), then the latest logged request-context
+* route, then the latest `request/header` route. Every read is optional: a
+* session with no observable provider, an unregistered projection, or a
+* profile without the projection package all resolve to the deployment default,
+* which is exactly the pre-derivation behavior.
+*
+* All functions are pure except the readers, which never throw and never write.
+*/
+/** Flat deployment-default fields per capability, in group-storage field names. */
+const CAPABILITY_FIELDS = Object.freeze({
+	compaction: {
+		provider: "compactProvider",
+		model: "compactModel"
+	},
+	autoReview: {
+		provider: "autoReviewProvider",
+		model: "autoReviewModel"
+	},
+	title: {
+		provider: "titleProvider",
+		model: "titleModel"
+	},
+	subagent: {
+		provider: "subagentProvider",
+		model: "subagentModel"
+	}
+});
+/** A non-blank string; blank values behave exactly like an absent field. */
+function present(value) {
+	return typeof value === "string" && value.trim() !== "";
+}
+/** Read one capability's pair from a flat route record; undefined unless both halves are present. */
+function pairOf(source, fields) {
+	if (source === void 0) return void 0;
+	const record = source;
+	const provider = record[fields.provider];
+	const model = record[fields.model];
+	if (!present(provider) || !present(model)) return void 0;
+	return {
+		provider,
+		model
+	};
+}
+/**
+* The deployment-wide route for one capability: the flat settings pair.
+* @param settings - live Model Switch settings; undefined means none are reachable.
+* @param capability - capability whose flat pair is read.
+* @returns The complete pair, or undefined when the capability stays at its official/derived default.
+*/
+function deploymentRoute(settings, capability) {
+	return pairOf(settings, CAPABILITY_FIELDS[capability]);
+}
+/**
+* The route a subagent spawn should use for one parent-session provider.
+*
+* A saved group for that provider pins the spawn; otherwise the flat Subagent
+* card pins it, but only in `fixed` mode — `follow-main` IS the official inherit
+* path, expressed by leaving the request untouched rather than by naming it.
+* @param settings - live Model Switch settings.
+* @param provider - the delegating session's provider, when one is observable.
+* @returns The complete route, or undefined for official inherit.
+*/
+function subagentRouteOf(settings, provider) {
+	const group = groupRoute(settings, provider, "subagent");
+	if (group !== void 0) {
+		const effort = groupOf(settings?.providerGroups, provider ?? "")?.subagentReasoningEffort;
+		return present(effort) ? {
+			...group,
+			reasoningEffort: effort
+		} : group;
+	}
+	if (settings?.subagentMode !== "fixed") return void 0;
+	const fixed = deploymentRoute(settings, "subagent");
+	if (fixed === void 0) return void 0;
+	return present(settings.subagentReasoningEffort) ? {
+		...fixed,
+		reasoningEffort: settings.subagentReasoningEffort
+	} : fixed;
+}
+/**
+* One provider's saved route for one capability.
+* @param settings - live Model Switch settings carrying the group table.
+* @param provider - the session's provider; blank or unknown resolves to undefined.
+* @param capability - capability whose group pin is read.
+* @returns The complete group pair, or undefined when the group pins nothing here.
+*/
+function groupRoute(settings, provider, capability) {
+	if (!present(provider)) return void 0;
+	return pairOf(groupOf(settings?.providerGroups, provider), CAPABILITY_FIELDS[capability]);
+}
+/**
+* The route one capability should use for one session.
+*
+* A saved provider group for the session's provider wins; otherwise the flat
+* deployment default applies. An unknown session provider skips every group, so
+* a session Model Switch cannot attribute keeps the deployment default.
+* @param settings - live Model Switch settings.
+* @param provider - the session's provider, when one is observable.
+* @param capability - capability being resolved.
+* @returns The complete pair, or undefined for the capability's official default.
+*/
+function resolveCapabilityRoute(settings, provider, capability) {
+	return groupRoute(settings, provider, capability) ?? deploymentRoute(settings, capability);
+}
+/**
+* Read the provider from the durable model-selection projection.
+* @param ctx - context that may expose `sessionProjections`.
+* @param session - the session whose selection is read.
+* @returns The pending provider, else the last-used provider, else undefined.
+*/
+function projectionProvider(ctx, session) {
+	let state;
+	try {
+		state = ctx.get("sessionProjections", false)?.stateOf(session, "modelSelection");
+	} catch {
+		state = void 0;
+	}
+	if (state === void 0) return void 0;
+	if (present(state.pending?.provider)) return state.pending.provider;
+	if (present(state.lastUsed?.provider)) return state.lastUsed.provider;
+}
+/**
+* The provider one session is using, from official durable state.
+*
+* Preferred source is the session's own model selection (it covers a switch the
+* client has sent but no request has consumed yet); the logged request-context
+* and request-header routes cover profiles without the projection package and
+* replayed sessions that never emitted a selection.
+* @param ctx - context used for the optional projection read.
+* @param session - the session to resolve; undefined resolves to undefined.
+* @returns The provider, or undefined when nothing durable names one.
+*/
+function sessionProviderOf(ctx, session) {
+	if (session === void 0) return void 0;
+	const selected = projectionProvider(ctx, session);
+	if (selected !== void 0) return selected;
+	try {
+		const context = session.requestContext()?.provider;
+		if (present(context)) return context;
+		const header = session.requestHeader()?.config.provider;
+		if (present(header)) return header;
+	} catch {
+		return;
+	}
+}
+/**
+* The subagent route one exact session's spawns should use.
+* @param ctx - context used for the optional session reads.
+* @param session - the delegating session; undefined keeps official inherit.
+* @param settings - live Model Switch settings.
+* @returns The complete route, or undefined for official inherit.
+*/
+function sessionSubagentRouteOf(ctx, session, settings) {
+	return subagentRouteOf(settings, sessionProviderOf(ctx, session));
+}
+//#endregion
+export { sessionSubagentRouteOf as a, sessionProviderOf as i, groupRoute as n, normalizeProviderGroups as o, resolveCapabilityRoute as r, deploymentRoute as t };

package/lib/session-title.js

@@ -1,4 +1,4 @@
-import { i as sessionProviderOf, n as groupRoute, t as deploymentRoute } from "./session-route-BjNPlliu.js";
+import { i as sessionProviderOf, n as groupRoute, t as deploymentRoute } from "./session-route-D1zoZgf3.js";
 //#region lib/types/session-title.js
 /**
 * Model Switch-owned session-naming row.

package/lib/subagent-runtime.js

@@ -1,4 +1,4 @@
-import { a as sessionSubagentRouteOf } from "./session-route-BjNPlliu.js";
+import { a as sessionSubagentRouteOf } from "./session-route-D1zoZgf3.js";
 import { ReasoningEffortId } from "@deepseek-ai/dsh-llm";
 import OfficialSubagentRuntime from "@deepseek-ai/dsh-subagent";
 //#region lib/types/subagent-runtime.js

package/lib/types/auto-review-takeover.d.ts

@@ -36,9 +36,19 @@ export declare const OFFICIAL_AUTO_REVIEW_ROW = "auto-review";
  */
 export declare const OFFICIAL_AUTO_REVIEW_PACKAGE = "@deepseek-ai/dsh-experimental-auto-review";
 /** Bounded takeover attempts before the seam is reported lost. */
-export declare const TAKEOVER_MAX_ATTEMPTS = 20;
+export declare const TAKEOVER_MAX_ATTEMPTS = 60;
 /** Delay between takeover attempts; the first attempt is immediate. */
-export declare const TAKEOVER_RETRY_DELAY_MS = 10;
+export declare const TAKEOVER_RETRY_DELAY_MS = 50;
+/**
+ * Delays for the late re-claims after the attempt loop gave up (ms).
+ *
+ * `Entry.update({ disabled: true })` starts the displaced fiber's disposal but
+ * the loader does not await it, and a disposal that tears down a mounted gate,
+ * restores permission presets and unwinds fibers can take longer than the
+ * attempt loop's budget. These re-claims keep trying for a few more seconds so a
+ * hot-swapped install converges instead of needing a restart.
+ */
+export declare const TAKEOVER_LATE_RETRY_DELAYS_MS: readonly [500, 1000, 1500];
 /** The seam this row's gate owns; the takeover drives it around the official row. */
 export interface AutoReviewSeam {
     /**

package/lib/types/auto-review.d.ts

@@ -51,6 +51,19 @@ export declare const name = "model-switch-auto-review";
  * takeover).
  */
 export declare const inject: string[];
+/**
+ * Live Auto-reviewer takeover status, read by the runtime-capability snapshot.
+ *
+ * `held: false` means the official row kept the single `registerAuto` slot (or
+ * has not released it yet): the reviewer route is not configurable and the
+ * tool-call safety net allows unreviewed calls instead of failing them.
+ * `allowedCalls` counts the calls the net let through in that state, so the
+ * settings card can tell the human how much review was skipped.
+ */
+export declare const autoReviewStatus: {
+    held: boolean;
+    allowedCalls: number;
+};
 /** Pinned reviewer route; both identifiers are non-empty. */
 export interface AutoReviewRoute {
     readonly provider: string;
@@ -102,6 +115,41 @@ export declare function resolveSessionAutoReviewRoute(ctx: Context, session?: Se
  * @param activeSession - AsyncLocalStorage holding the session under review.
  */
 export declare function bindAutoReviewSessionCorrelation(scope: Context, activeSession: AsyncLocalStorage<Session | undefined>): void;
+/**
+ * Whether a reviewer-path throw is a broken seam rather than a real decision.
+ * @param cause - whatever the waterfall threw.
+ * @returns true when the reviewer itself could not run.
+ */
+export declare function isReviewerInfrastructureFailure(cause: unknown): boolean;
+/**
+ * Keep a broken reviewer seam from failing tool calls.
+ *
+ * Registered on this row's own context through `{ prepend: true }`, so it sits
+ * ahead of the official gate's listener and stays live even when the gate could
+ * not be mounted (the takeover lost `registerAuto`, or the displaced row has
+ * not released it yet). That is the one window the defensive
+ * `permissionPresets` shadow cannot cover: the shadow lives in this row's review
+ * scope, while the serving gate resolves the real service from the profile.
+ *
+ * The waterfall only decides whether the body runs; the body dispatches after
+ * it returns, so allowing here never masks a tool failure. Reviewer transport
+ * and quota errors keep failing closed — only seam breakage is allowed through.
+ *
+ * @param ctx - this row's context (the listener lives and dies with the plugin).
+ * @param options - diagnostics plus the degraded-state predicate.
+ */
+export declare function installToolCallSafetyNet(ctx: Context, options?: {
+    /** Diagnostic fiber dump appended to the first report. */
+    fiberChain?: (() => string) | undefined;
+    /**
+     * Whether this row currently knows the reviewer route is not held.
+     *
+     * The net only fails open in that state: another plugin's broken listener
+     * must keep failing closed, and a held route already has the defensive
+     * shadow in front of it. Defaults to always degraded (direct callers).
+     */
+    isDegraded?: (() => boolean) | undefined;
+}): void;
 /** The permission-preset face the official gate reads; structural so a missing package never breaks a build. */
 export interface PermissionPresetsFace {
     current(session: Session): string;

package/lib/types/client/locales.d.ts

@@ -32,6 +32,7 @@ export declare const zh: {
     readonly autoReviewFollow: "跟随会话模型";
     readonly autoReviewHelp: "为官方 auto-review（Auto 权限预设的逐调用审查）指定审查模型；需启用官方 auto-review 能力包。关闭时审查跟随当前会话模型。本插件启用时，官方「自动审查」组件由本插件接管。";
     readonly autoReviewRouteHelp: "审查请求固定使用这里的 Provider/模型，与会话模型无关；保存后对下一次审查立即生效。";
+    readonly autoReviewTakeoverWarning: "审查路由当前未接管（官方「自动审查」行仍占着唯一注册位）：工具调用会照常执行，但这些调用未经审查。重启 DSH 即可收敛；若重启后仍显示此提示，请把日志里的 fiber 链反馈给上游。";
     readonly autoReviewTakeoverNote: "官方「自动审查」组件已由本插件接管（提供可配置审查路由）；在插件管理里把它重新打开会被再次关闭，并在日志里留下一条记录。";
     readonly compaction: "压缩模型";
     readonly compactionFollow: "跟随会话模型";

package/lib/types/host-runtime.d.ts

@@ -19,6 +19,13 @@ export declare class ModelSwitchRuntime extends Service {
             providers: string[];
             catalog: readonly import("./adapter-registry.js").SearchProviderMetadata[];
         };
+        autoReview: {
+            available: boolean;
+            reason?: never;
+        } | {
+            available: boolean;
+            reason: "auto-review-takeover";
+        };
         mainDefaults: Readonly<{
             available: true;
         }>;

package/lib/types/runtime-capabilities.d.ts

@@ -1,4 +1,4 @@
-export type RuntimeCapabilityReason = 'central-subagent-routing' | 'packaged-preset-roots' | 'tool-owner-suppression' | 'search-provider-adapters' | 'vision-provider-adapters' | 'image-provider-adapters';
+export type RuntimeCapabilityReason = 'central-subagent-routing' | 'packaged-preset-roots' | 'tool-owner-suppression' | 'search-provider-adapters' | 'vision-provider-adapters' | 'image-provider-adapters' | 'auto-review-takeover';
 import type { SearchProviderMetadata } from './adapter-registry.js';
 export interface RuntimeCapability {
     readonly available: boolean;
@@ -15,6 +15,14 @@ export interface RuntimeCapabilities {
     readonly searchProviderAdapters: RuntimeCapability;
     readonly visionProviderAdapters: RuntimeCapability;
     readonly imageProviderAdapters: RuntimeCapability;
+    /**
+     * Whether this row currently holds the official Auto reviewer route.
+     *
+     * `false` means the official row kept the single `registerAuto` slot (or has
+     * not released it yet): the reviewer route is not configurable, and the
+     * tool-call safety net allows unreviewed calls instead of failing them.
+     */
+    readonly autoReview: RuntimeCapability;
 }
 export declare const RUNTIME_CAPABILITIES: Readonly<{
     mainDefaults: Readonly<{
@@ -47,4 +55,7 @@ export declare const RUNTIME_CAPABILITIES: Readonly<{
         available: true;
         providers: readonly string[];
     }>;
+    autoReview: Readonly<{
+        available: true;
+    }>;
 }>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-model-switch",
-  "version": "0.4.31",
+  "version": "0.4.33",
   "description": "Explicit model routing plus composer/Plan picker for DeepSeek Harness",
   "repository": {
     "type": "git",