dsh-plugin-prompt-tool 2.1.0 → 3.0.0

package/engine/rule-spec.mjs

@@ -1,17 +1,136 @@
-/** module.yml.rules 的唯一运行时编译入口。旧声明仅由离线迁移器读取。 */
+/** module.yml.rules 的唯一运行时编译入口。 */
 import { ACTION_KINDS, actionExecutionPoint, prepareAction, validateActionOptions } from './actions/index.mjs'
-import { compileWhen, PREDICATE_FACTORIES, COMPOSITE_OPERATORS } from './conditions/index.mjs'
-import { createPromptConfigs, KNOWN_LAYERS } from './schema.mjs'
+// 字段清单与动作声明同住 `actions/catalog.mjs`（`actions/index.mjs` 不再导出新面）。
+import { ACTION_FIELDS } from './actions/catalog.mjs'
+import { compileWhen, PREDICATE_FACTORIES, COMPOSITE_OPERATORS, FACT_PREDICATE_SUBJECTS, channelFactSubjects, channelTextSubjects } from './conditions/index.mjs'
+import { createPromptConfigs, INJECT_CONFIG_FIELDS, KNOWN_LAYERS, SESSION_VARIABLES_DISABLED, assertLlmCallPatch } from './schema.mjs'
+import { stripDeclaredRefs } from './interpolate.mjs'
+import { matchesAudience, validateConfig } from './shared.mjs'
 import { WATERFALL_POSITIONS } from './trigger.mjs'
 import { ACTION_EXAMPLES } from './actions/examples.mjs'
 import { PREDICATE_EXAMPLES } from './conditions/examples.mjs'
 import { conjunction, expandActions } from './branch.mjs'
+import { identityOf, textRegistrationName } from './delivery.mjs'
+import { AUDIENCE_ALL, audienceOf, intersectAudiences } from './audience.mjs'
+import { isFixedRegistration } from './fixed-registration.mjs'
+import { record } from './record.mjs'
 
 /** 规则字段：只有 `if`/`then`/`else`；旧名 `when`/`do` 留在名单里，只为把 unknown fields 换成一句「已退役，改用 X」。 */
 const RULE_FIELDS = new Set(['id', 'name', 'enabled', 'layer', 'group', 'exclusive', 'if', 'then', 'else', 'when', 'do'])
-const record = value => value !== null && typeof value === 'object' && !Array.isArray(value)
 const nonempty = value => typeof value === 'string' && value.trim().length > 0
 
+/** `prepend` 退役文案（动作层与 `inject-text.config` 共用）：等价档只有「注册到最外层」一档，而 `inject-text` 连它也不接受。 */
+const PREPEND_RETIRED = '`prepend` 已取消 — 它是未文档化的注册后门（executor 直读 config.prepend），作用只有「注册到最外层」一档：非 inject-text 动作改用 `waterfallPosition: outermost`；`inject-text` 不接受该字段，没有等价写法'
+
+/**
+ * 条件树引用的全部「谓词 → 通道事实」对（含组合与否定）；`subject === undefined` = 作者漏写。
+ * 树是数据：校验期读它，挂载期由 `rebindConditions` 用它重绑——`compileWhen` 的产物把 subject 关进闭包，读不回来。
+ * `text` 的 subject 由作者声明；事实谓词读的事实取自谓词侧的 `FACT_PREDICATE_SUBJECTS`
+ * （唯一登记处，见 `conditions/subject.mjs`），本函数不再逐谓词手抄。
+ */
+function conditionSubjects(node, out = []) {
+  if (!record(node)) return out
+  for (const [key, value] of Object.entries(node)) {
+    if (key === 'text' && record(value)) out.push({ predicate: 'text', subject: value.subject })
+    else if (Object.hasOwn(FACT_PREDICATE_SUBJECTS, key)) out.push({ predicate: key, subject: FACT_PREDICATE_SUBJECTS[key] })
+    else if (key === 'not') conditionSubjects(value, out)
+    else if ((key === 'all' || key === 'any' || key === 'notAny') && Array.isArray(value)) {
+      for (const child of value) conditionSubjects(child, out)
+    }
+  }
+  return out
+}
+
+function referencedActions(node, out = new Set()) {
+  if (!record(node)) return out
+  if (node.anchor?.after) out.add(node.anchor.after.action)
+  for (const key of ['all', 'any', 'notAny']) {
+    if (Array.isArray(node[key])) for (const child of node[key]) referencedActions(child, out)
+  }
+  if (node.not) referencedActions(node.not, out)
+  return out
+}
+
+function validateActionLinks(rule) {
+  const actions = new Map(rule.actions.map(action => [action.id, action]))
+  const edges = new Map()
+  for (const action of rule.actions) {
+    const content = action.compiledConfig
+    if (content?.fill === 'tool-catalog') {
+      const source = actions.get(content.params.action)
+      if (source?.kind !== 'tool-visibility' || !Array.isArray(source.allow)) {
+        throw new TypeError(`rule ${rule.id}: tool-catalog action ${action.id} requires a same-rule tool-visibility action with allow`)
+      }
+      content.toolCatalogSource = { allow: source.allow, deny: source.deny, discovery: source.discovery }
+    }
+    const refs = referencedActions(action.conditions, referencedActions(rule.conditionTrees.when))
+    edges.set(action.id, refs)
+    if (refs.size && action.compiledConfig) action.compiledConfig.linkedDelivery = true
+    for (const id of refs) {
+      const target = actions.get(id)
+      if (target === undefined) throw new TypeError(`rule ${rule.id}: unknown after action ${id}`)
+      if (id === action.id) throw new TypeError(`rule ${rule.id}: action ${id} cannot reference itself in after`)
+      const config = target.compiledConfig
+      if (target.kind !== 'inject-text' || !['pre-step', 'runtime-context', 'turn-stop'].includes(config?.layer)
+        || config.mergeMode === 'merged') throw new TypeError(`rule ${rule.id}: after action ${id} requires an independently delivered message or runtime-context`)
+      for (const other of rule.actions) {
+        if (other === target || other.compiledConfig === undefined) continue
+        const conflict = config.layer === 'runtime-context'
+          ? other.compiledConfig.layer === config.layer && textRegistrationName(config, 'contextName') === textRegistrationName(other.compiledConfig, 'contextName')
+          : identityOf(config) === identityOf(other.compiledConfig)
+        if (conflict) throw new TypeError(`rule ${rule.id}: after action ${id} has an ambiguous delivery identity`)
+      }
+      config.linkedDelivery = true
+    }
+  }
+  const visiting = new Set(), visited = new Set()
+  const visit = id => {
+    if (visiting.has(id)) throw new TypeError(`rule ${rule.id}: cyclic after action reference at ${id}`)
+    if (visited.has(id)) return
+    visiting.add(id)
+    for (const target of edges.get(id) ?? []) visit(target)
+    visiting.delete(id); visited.add(id)
+  }
+  for (const id of actions.keys()) visit(id)
+}
+
+/** 命名快照在整个挂载 scope 内共享，关联目标不能借别的规则的同名贡献确认。 */
+export function validateDeliverySources(sources) {
+  const names = new Map()
+  for (const source of sources) for (const rule of source.rules) {
+    if (rule.enabled === false) continue
+    for (const action of rule.actions) {
+      if (action.compiledConfig?.layer !== 'runtime-context') continue
+      const config = { ...action.compiledConfig, sourceModuleId: source.moduleId }
+      const name = textRegistrationName(config, 'contextName')
+      const previous = names.get(name)
+      if (previous && (previous.linkedDelivery || config.linkedDelivery)) {
+        throw new TypeError(`ambiguous runtime-context delivery identity ${JSON.stringify(name)}`)
+      }
+      names.set(name, config)
+    }
+  }
+}
+
+/**
+ * **只用于动作级条件**：动作的判定绑定单一执行点，谓词要读的事实写错通道（或 `text` 省略
+ * subject）等于该动作永不执行，而挂载与运行期都不报错（`availability.mjs` 对通道取不到的
+ * 字段返回 UNAVAILABLE，`condition-facts.mjs#subjectTextOf` 取不到一律空串）。规则级 `if` 相反：
+ * 它在该规则每个动作的执行点上各自求值，「缺事实即不执行」是三值语义的设计意图（见
+ * `test/engine/rules.test.mjs` 的缺事实用例），因此编译期不拒绝。
+ */
+function assertSubject(predicate, subject, allowed, label) {
+  if (subject === undefined) {
+    throw new TypeError(`${label}: ${predicate} needs an explicit subject — 省略时判定恒为「缺事实」，规则永不命中`)
+  }
+  if (!allowed.includes(subject)) {
+    throw new TypeError(
+      `${label}: ${predicate} subject ${JSON.stringify(subject)} is unavailable at this execution point`
+      + ` — 本执行点可用 ${allowed.length > 0 ? allowed.join(', ') : '（无）'}；写死条件不会命中`,
+    )
+  }
+}
+
 /** 规则及物化身份的唯一安全边界；host 保存、导入与直接编译共用。 */
 export function assertRuleId(id) {
   if (!nonempty(id)) throw new TypeError('rule id must be a non-empty string')
@@ -24,11 +143,13 @@ export function assertRuleId(id) {
 /** 注入叶子的唯一身份投影；稳定动作 id 保证重排不改变投递身份。 */
 export function injectionConfigSpec(rule, action, options = {}) {
   if (action?.kind !== 'inject-text' || !record(action.config)) throw new TypeError('inject-text config must be an object')
+  if (Object.hasOwn(action.config, 'variables')) throw new TypeError('动作 config.variables 已退役；请显式提升为模块 variables，同名不同值须先解决冲突')
   const config = { ...action.config, id: action.config.id ?? `rule:${encodeURIComponent(rule.id)}:${encodeURIComponent(action.id)}`, layer: action.config.layer ?? rule.layer ?? 'pre-step' }
   const variables = record(options.variables) ? options.variables : {}
   if (options.variablesEnabled === false) {
     const keys = new Set(Object.keys(variables))
-    const strip = text => typeof text === 'string' ? text.replace(/\{\{([A-Za-z0-9_.\u4e00-\u9fff-]+)\}\}/g, (match, key) => keys.has(key) ? '' : match) : text
+    // 剥离复用插值语法（同一条 REFERENCE_RE）：花括号内空白与 `::参数` 形态也算引用。
+    const strip = text => stripDeclaredRefs(text, keys)
     if (config.text !== undefined) config.text = strip(config.text)
     if (Array.isArray(config.texts)) config.texts = config.texts.map(strip)
     if (record(config.params) && typeof config.params.text === 'string') config.params = { ...config.params, text: strip(config.params.text) }
@@ -50,9 +171,36 @@ export function validateRuleGroups(rules) {
   }
 }
 
+/** 编译与宿主聚合共用的受众独占清单，身份保留到规则和动作。 */
+export function completeRuleSections(rules, audience) {
+  return rules.filter(rule => rule.enabled !== false).flatMap(rule => rule.actions.flatMap(action => {
+    const config = action.compiledConfig ?? action.config
+    return action.kind === 'inject-text' && config?.layer === 'system-section' && config.params?.complete === true
+      && matchesAudience(config.audience, audience) ? [`${rule.id}/${action.id}`] : []
+  }))
+}
+
+/**
+ * 动作级受众事实：规则级 `when` 与动作级 `conditions` 的合取。
+ *
+ * 规则级 `else` 的动作自带 `not(if)` 并标记 `bypassRuleWhen`——它的受众已由动作条件
+ * 决定，再叠 `when` 会得到 `when ∧ ¬when` 的空集。未知 `actionId` 是防御分支：
+ * 调用方只在遍历真实动作时使用，遇到未知 id 按两个受众处理。
+ */
+export function actionAudiences(rule, actionId) {
+  const actions = Array.isArray(rule?.actions) ? rule.actions : []
+  const action = actions.find((item) => record(item) && item.id === actionId)
+  if (action === undefined) return new Set(AUDIENCE_ALL)
+  const own = audienceOf(action.conditions)
+  const when = action.bypassRuleWhen === true ? undefined : audienceOf(rule?.conditionTrees?.when)
+  if (when === undefined && own === undefined) return new Set(AUDIENCE_ALL)
+  if (when === undefined) return new Set(own)
+  if (own === undefined) return new Set(when)
+  return intersectAudiences(when, own)
+}
+
 export function ruleActionExecution(action) {
-  const fixed = action.kind === 'guard' || (action.kind === 'inject-text'
-    && (action.config?.params?.complete === true || action.config?.params?.suppressRuntimeContext === true))
+  const fixed = action.kind === 'inject-text' && isFixedRegistration(action.config)
   return { ...actionExecutionPoint(action), lifecycle: fixed ? 'registration' : 'event' }
 }
 
@@ -62,10 +210,13 @@ function normalizeActionGates(action, execution) {
   if (!inject && action.kind !== 'request-params') return
   const target = inject ? action.config : action
   if (inject) {
-    if (target.enabled !== undefined && target.enabled !== true) throw new TypeError(`action ${action.id}: move config.enabled to rule.enabled`)
-    delete target.enabled
+    // 这三个键在 `rule-runtime.mjs` 组装注入配置时被逐条覆盖（group/exclusive/enabled），
+    // 动作不另建启停和互斥状态，避免出现第二个规则总闸。
+    for (const field of ['enabled', 'group', 'exclusive']) {
+      if (target[field] !== undefined) throw new TypeError(`action ${action.id}: config.${field} 属于规则层，移到 rule.${field}`)
+    }
   }
-  const fields = inject ? ['audience', 'modelScope', 'promotion', 'subject', 'match'] : ['audience', 'modelScope']
+  const fields = inject ? ['audience', 'modelScope', 'promotion'] : ['audience', 'modelScope']
   for (const field of fields) {
     const value = target[field]
     if (inject && field === 'audience' && target.layer === 'system-section' && execution.lifecycle === 'registration' && ['main', 'subagent'].includes(value)) continue
@@ -75,12 +226,13 @@ function normalizeActionGates(action, execution) {
   }
 }
 
-/** 注册制层：内容在 agent 装配时注册一次，没有逐轮求值时机，因此不接受分支条件。 */
-const REGISTRATION_LAYERS = new Set(['system-section', 'runtime-context'])
-
 /** options.promptConfigOptions 拥有模板/策略路径；configOrder 使用规则 id，moduleId 只标记来源。 */
 export function compileRules(specs, options = {}) {
   if (!Array.isArray(specs)) throw new TypeError('rules must be an array')
+  // 条件的绑定**不在编译期**：`preset` 谓词的取法要挂载 scope 的 ctx（`conditions/preset.mjs`），
+  // 准备期拿不到。这里显式剥掉挂载期选项——传了也不生效，免得调用方以为已经绑好。
+  // variableStore 与 ctx/standingMountFor 同理：绑定发生在挂载期，准备期传了也不生效。
+  const { ctx: _ctx, standingMountFor: _standingMountFor, variableStore: _variableStore, ...conditionOptions } = options
   const ids = new Set()
   const pendingConfigs = []
   const moduleId = options.moduleId ?? options.sourceModuleId
@@ -98,17 +250,25 @@ export function compileRules(specs, options = {}) {
     if (spec.when !== undefined) throw new TypeError(`rule ${spec.id}: "when" 已退役，改用 "if"`)
     if (spec.do !== undefined) throw new TypeError(`rule ${spec.id}: "do" 已退役，改用 "then"`)
     const ruleIf = spec.if
+    // 规则级 `if` 跨执行点各自求值，不在这里判定（见 assertSubject 的说明）。`else` 的动作自带
+    // 这个 `not(if)`，校验时按**对象身份**剔除（`branch.mjs#expandActions` 保留 `outer` 元素
+    // 引用）——按 subject 名字跳过会连带跳过嵌套分支里同名、但来自另一个执行点的死条件。
+    const ruleNegation = ruleIf === undefined ? undefined : { not: ruleIf }
     const ruleThen = spec.then
     if (!Array.isArray(ruleThen) || ruleThen.length === 0) throw new TypeError(`rule ${spec.id}.then must be a non-empty array`)
     const sequence = options.configOrder?.[spec.id] ?? index * 10
     if (!Number.isSafeInteger(sequence) || sequence < 0) throw new TypeError(`rule ${spec.id}: invalid configOrder`)
-    const when = compileWhen(ruleIf, options)
+    const when = compileWhen(ruleIf, conditionOptions)
+    // 规则级 else 依赖 `not(if)` 才能与 then 互斥；没有 if 时 else 会退化成无条件动作。
+    if (spec.else !== undefined && (ruleIf === undefined || ruleIf === null)) {
+      throw new TypeError(`rule ${spec.id}: else requires an if — 规则级 else 不能脱离 if 存在`)
+    }
     // 规则级 `if` 由 `rule.when` 判定，then 分支的动作不再重复叠加它；规则级 `else` 的动作
     // 自带 `not(if)` 并标记跳过规则级判定——否则两者自相矛盾，else 分支永远不会执行。
     const expanded = [
       ...expandActions(ruleThen, {}, `rule ${spec.id}.then`),
       ...(spec.else === undefined ? [] : expandActions(spec.else, {
-        outer: ruleIf === undefined ? [] : [{ not: ruleIf }],
+        outer: [ruleNegation],
         bypass: true,
       }, `rule ${spec.id}.else`)),
     ]
@@ -118,13 +278,50 @@ export function compileRules(specs, options = {}) {
       if (actionIds.has(source.id)) throw new TypeError(`rule ${spec.id}: duplicate action id ${source.id}`)
       actionIds.add(source.id)
       if (!Object.hasOwn(ACTION_KINDS, source.kind)) throw new TypeError(`rule ${spec.id}: unknown action ${source.kind}`)
+      // 带 `kind` 的节点同时写分支键时，`expandActions` 只认无 `kind` 的分支节点——分支会被
+      // 静默丢掉（条件不生效、动作照旧执行），因此点名拒绝而不是当未知键。
+      const branchKeys = ['if', 'then', 'else'].filter(key => source[key] !== undefined)
+      if (branchKeys.length > 0) throw new TypeError(`rule ${spec.id}: action ${source.id} 写了 ${branchKeys.join(', ')} — 分支必须写成无 \`kind\` 的节点`)
+      // 旧动作级开关已退役：显式拒绝并给出新名（比 unknown fields 更可直接照做）。
+      if (source.when !== undefined) throw new TypeError(`rule ${spec.id}: action ${source.id}: "when" 已退役，改用 "if"`)
+      if (source.prepend !== undefined) throw new TypeError(`rule ${spec.id}: action ${source.id}: ${PREPEND_RETIRED}`)
+      // 声明路径（YAML / JSON / 导入）表达不了函数，而 `structuredClone` 对函数抛
+      // DataCloneError——报错提示「改用函数」等于把人引向死路。`match` 出现即拒，
+      // 条件写在规则级 `if` 或分支节点里。
+      if (source.match !== undefined) {
+        throw new TypeError(`rule ${spec.id}: action ${source.id}.match 已取消 — 声明路径写不了函数，条件改用 rule.if`)
+      }
       const action = structuredClone(source)
       if (action.kind === 'inject-text') {
         action.config = injectionConfigSpec(spec, action, options)
-        if (action.config.strategy === 'custom-fallback') throw new TypeError(`action ${action.id}: migrate custom-fallback to an anchor condition and anchor-notice content`)
       }
       const execution = ruleActionExecution(action)
+      // 未知键检查必须在 normalizeActionGates **之后**：中性旧 audience/modelScope/promotion
+      // 由它删除、非中性旧门由它报「move it to rule.if」，那些键因此既不会落在未知键名单里，
+      // 也不会被静默丢弃。声明式 config.subject/match 已删除，不再进入这张旧门名单。
       normalizeActionGates(action, execution)
+      validateConfig(`rule ${spec.id}: action ${action.id}`, action, ACTION_FIELDS[action.kind])
+      if (action.kind === 'request-params') {
+        // patch / unset 的子键同属 LlmCallConfig（键集与值规则复用 schema 的 assertLlmCallPatch）：
+        // 拼错的键与非法值今天会被静默忽略（补丁不生效），与动作级未知键是同一类失效。
+        for (const field of ['patch', 'unset']) {
+          if (record(action[field])) assertLlmCallPatch(action[field], `action ${action.id}.${field}`)
+        }
+      }
+      if (action.kind === 'inject-text') {
+        if (action.config.prepend !== undefined) throw new TypeError(`rule ${spec.id}: action ${action.id}: ${PREPEND_RETIRED}`)
+        validateConfig(`rule ${spec.id}: action ${action.id} config`, action.config, INJECT_CONFIG_FIELDS)
+        // F27：complete / suppressRuntimeContext 是 system-section 的注册期效果。写在别的层上
+        // 既不注册成独占段、又会被独占计数误算，逐动作点名拒绝（params 子键不做白名单）。
+        // 出现即拒（`false` 除外）：`'yes'` / `1` 这类值同样落不到任何注册期效果上。
+        if (action.config.layer !== 'system-section' && record(action.config.params)) {
+          for (const flag of ['complete', 'suppressRuntimeContext']) {
+            if (action.config.params[flag] !== undefined && action.config.params[flag] !== false) {
+              throw new TypeError(`rule ${spec.id}: action ${action.id}: config.params.${flag} 只属于 layer system-section — 当前 layer 是 ${JSON.stringify(action.config.layer)}`)
+            }
+          }
+        }
+      }
       const channelOrder = action.channelOrder ?? sequence
       if (!Number.isSafeInteger(channelOrder) || channelOrder < 0) throw new TypeError(`action ${action.id}: channelOrder must be a non-negative safe integer`)
       const waterfallPosition = action.waterfallPosition ?? 'default'
@@ -134,16 +331,25 @@ export function compileRules(specs, options = {}) {
       if (action.kind === 'inject-text') {
         validateActionOptions(action)
         if (!record(action.config)) throw new TypeError(`action ${action.id}: config must be an object`)
-        // 原始声明保持不变；稳定动作身份只在未提供正文身份时补入运行时编译输入。
-        pendingConfigs.push({ action, source: { ...action.config, id: action.config.id ?? `${spec.id}:${action.id}` }, sequence: channelOrder, ruleId: spec.id, actionIndex })
+        // 原始声明保持不变；正文身份由 `injectionConfigSpec` 保证（`config.id` 非空，不再兜第二次）。
+        pendingConfigs.push({ action, source: { ...action.config }, sequence: channelOrder, ruleId: spec.id, actionIndex })
       } else prepareAction(action, { promptConfigOptions: options.promptConfigOptions })
+      // 动作级条件只在本动作的执行点求值：谓词要读的事实必须由该通道真实提供，否则是死条件。
+      // 规则级 `if` 自身不在这里校验（它跨执行点求值）；`else` 注入的 `not(if)` 按**对象身份**
+      // 剔除——因此嵌套分支的 `if` 照样校验，同名 subject 不再被规则级 `if` 连带跳过。
+      const actionConditions = conjunction(conditions)
+      const ownConditions = conjunction(conditions.filter(node => node !== ruleNegation))
+      for (const { predicate, subject } of conditionSubjects(ownConditions)) {
+        assertSubject(predicate, subject,
+          predicate === 'text' ? channelTextSubjects(execution.channel) : channelFactSubjects(execution.channel),
+          `rule ${spec.id}: action ${action.id}`)
+      }
       // 空条件数组经 conjunction → undefined → compileWhen 直接返回 undefined（无条件动作）。
-      const actionWhen = compileWhen(conjunction(conditions), options)
-      const branchLayer = action.kind === 'inject-text' ? action.config.layer : spec.layer ?? 'pre-step'
-      if (actionWhen !== undefined && (REGISTRATION_LAYERS.has(branchLayer) || execution.lifecycle === 'registration')) {
-        throw new TypeError(`action ${action.id}: layer ${branchLayer} has no per-turn evaluation point — move the branch to pre-step / subagent-* / tool-pipeline / turn-stop`)
+      const actionWhen = compileWhen(actionConditions, conditionOptions)
+      if (actionWhen !== undefined && execution.lifecycle === 'registration') {
+        throw new TypeError(`action ${action.id}: registration effects do not support conditional branches`)
       }
-      return Object.assign(action, { execution, channelOrder, waterfallPosition, actionIndex, actionWhen, bypassRuleWhen: bypass })
+      return Object.assign(action, { execution, channelOrder, waterfallPosition, actionIndex, actionWhen, bypassRuleWhen: bypass, conditions: structuredClone(actionConditions) })
     })
     const pointOrders = new Map()
     for (const action of actions) {
@@ -152,23 +358,91 @@ export function compileRules(specs, options = {}) {
       if (previous !== undefined && previous.channelOrder !== action.channelOrder) throw new TypeError(`rule ${spec.id}: conflicting channelOrder for actions ${previous.id} and ${action.id} at ${key}`)
       pointOrders.set(key, action)
     }
-    return { id: spec.id, name: spec.name, layer: spec.layer, group: spec.group, exclusive: spec.exclusive === true, enabled: spec.enabled !== false, sequence, when, actions, promptConfigOptions: options.promptConfigOptions }
+    return {
+      id: spec.id, name: spec.name, layer: spec.layer, group: spec.group, exclusive: spec.exclusive === true, enabled: spec.enabled !== false,
+      sequence, when, actions, promptConfigOptions: options.promptConfigOptions,
+      // 绑定所需的树：规则级 `if` + 每个动作展开后的条件（动作那半与 `action.conditions` 同一引用）。
+      // **只有引擎内部读它**（`rebindConditions` 绑定、`actionAudiences` 推导受众）——调用方与挂载缝都不需要知道这个形状。
+      conditionTrees: {
+        ...(ruleIf === undefined ? {} : { when: structuredClone(ruleIf) }),
+        actions: Object.fromEntries(actions.filter(action => action.conditions !== undefined).map(action => [action.id, action.conditions])),
+      },
+    }
   })
   validateRuleGroups(rules)
-  const complete = rules.filter(rule => rule.enabled).flatMap(rule => rule.actions).filter(action => action.config?.params?.complete === true)
-  if (complete.length > 1 || (complete.length > 0 && options.personaComplete === true)) throw new TypeError('rules: multiple complete system sections are active')
+  for (const audience of ['main', 'subagent']) {
+    const complete = completeRuleSections(rules, audience)
+    if (complete.length > 1 || (complete.length > 0 && options.personaComplete === true)) {
+      throw new TypeError(`rules: multiple complete system sections are active for ${audience}: ${complete.join(', ')}`)
+    }
+  }
   if (pendingConfigs.length) {
     const compiled = createPromptConfigs(pendingConfigs.map(item => item.source), { ...options.promptConfigOptions, ...(moduleId === undefined ? {} : { sourceModuleId: moduleId }) })
     const byId = new Map(compiled.map(config => [config.id, config]))
     for (const item of pendingConfigs) {
       const config = byId.get(item.source.id)
-      Object.assign(config, { sequence: item.sequence, ruleId: item.ruleId, ruleActionIndex: item.actionIndex })
+      Object.assign(config, { sequence: item.sequence, ruleId: item.ruleId, ruleActionId: item.action.id, ruleActionIndex: item.actionIndex })
+      // 停用标记在这里打，不在 `injectionConfigSpec`：那是校验**之前**，标记会变成作者可写的字段。
+      // 校验之后打标，作者手写同名键按未知键 fail loud；执行期据此跳过会话变量合并。
+      if (options.variablesEnabled === false) config[SESSION_VARIABLES_DISABLED] = true
+      // 模块级 ST 递归开关（module.yml 顶层）：与上一行同源同时序，作者写同名键按未知键 fail loud。
+      if (options.contextActivationRecursive === true) config.contextActivationRecursive = true
       item.action.compiledConfig = config
     }
   }
+  for (const rule of rules) validateActionLinks(rule)
+  validateDeliverySources([{ moduleId, rules }])
   return rules
 }
 
+/**
+ * 树里是否需要挂载期的输入：
+ * - `preset` 谓词：`conditions/preset.mjs` 把服务查询基准绑在**构造期**；
+ * - `phase` 谓词（且未显式 `subscribe: false`）：订阅模式要从挂载缝的追踪器池里取实例
+ *   （见 `promotion-pool.mjs`），否则每个编译出的谓词各建一份、各自订阅、各自喂事件。
+ * - `anchor.after`：引用目标需要挂载来源的真实模块身份。
+ *
+ * 其余原语只用节点选项。只重绑需要重绑的树：调用方对不含这些节点的条件谓词做的包装/替换
+ * 不会被覆盖，「挂载缝接管绑定」与「调用方仍可注入自定义判定」两件事不冲突。
+ */
+function needsMountContext(node) {
+  if (node === null || typeof node !== 'object') return false
+  if (Array.isArray(node)) return node.some(needsMountContext)
+  if (Object.hasOwn(node, 'preset')) return true
+  // variable 要读挂载 scope 的变量适配器（准备期没有）。
+  if (Object.hasOwn(node, 'variable')) return true
+  if (Object.hasOwn(node, 'phase') && node.phase?.subscribe !== false) return true
+  if (node.anchor?.after !== undefined) return true
+  return Object.values(node).some(needsMountContext)
+}
+
+/**
+ * 把需要挂载期 ctx 的条件绑定到挂载缝：**`compileRules` 只编译与校验，绑定由 `mountRuleSources`
+ * 在这里完成**（`rule-runtime.mjs`）。
+ *
+ * 为什么不在编译期绑：`preset` 谓词要挂载 scope 的 ctx，准备期拿不到——编译期绑出来的 preset
+ * 条件恒 UNAVAILABLE，而且是静默的。树只在本模块读：调用方与挂载缝都不需要知道
+ * `conditionTrees` 的形状；没有该字段的产物（已绑好的输入）原样保留。
+ */
+export function rebindConditions(sources, context = {}) {
+  if (!Array.isArray(sources)) throw new TypeError('sources must be an array')
+  for (const source of sources) {
+    for (const rule of source?.rules ?? []) {
+      const trees = rule.conditionTrees
+      if (trees === undefined) continue
+      const targets = new Map(rule.actions.filter(action => action.compiledConfig !== undefined)
+        .map(action => [action.id, { ...action.compiledConfig, sourceModuleId: source.moduleId }]))
+      const binding = { ...context, moduleId: source.moduleId, resolveAction: id => targets.get(id) }
+      if (trees.when !== undefined && needsMountContext(trees.when)) rule.when = compileWhen(trees.when, binding)
+      for (const action of rule.actions ?? []) {
+        const tree = trees.actions?.[action.id]
+        if (tree !== undefined && needsMountContext(tree)) action.actionWhen = compileWhen(tree, binding)
+      }
+    }
+  }
+  return sources
+}
+
 export function getRuleEditorMeta() {
   const predicates = Object.keys(PREDICATE_FACTORIES).map(kind => ({ kind, example: { [kind]: structuredClone(PREDICATE_EXAMPLES[kind]) } }))
   for (const kind of COMPOSITE_OPERATORS) {

package/engine/run-code-env.mjs

@@ -19,6 +19,8 @@
  */
 
 import { bool, defineConfig, stringList } from './fields.mjs'
+import { machinePaths } from './machine-paths.mjs'
+import { SENSITIVE_ENV_RE } from './env-safety.mjs'
 
 /** Cordis 插件名，供 loader 诊断使用。 */
 export const name = 'run-code-env'
@@ -26,11 +28,15 @@ export const name = 'run-code-env'
 /** 需要 tools 视图与 systemPrompt 段。shellEnv 为机会型读取，不写进 inject。 */
 export const inject = ['tools', 'systemPrompt']
 
-/** 任何疑似凭据的名字一律不放行。 */
-export const SENSITIVE_ENV_RE = /KEY|PASSWORD|SECRET|TOKEN/i
+/** 任何疑似凭据的名字一律不放行；判据与 env-facts 共用 env-safety。 */
+export { SENSITIVE_ENV_RE }
 
-/** run_code 定义对象只 patch 一次（跨 HMR 安全）。 */
-const PATCHED = new WeakSet()
+/**
+ * run_code 工具对象上的共享状态：官方 ToolRuntime 的 run_code 是进程内单例，多个 Agent
+ * 共用同一个定义对象。状态随对象走，跨模块实例/HMR 复用；配置在每次执行时按 Agent 查，
+ * 不能被某次 apply 的闭包固化。
+ */
+const STATE = Symbol.for('dsh-plugin-prompt-tool.run-code-env')
 
 /**
  * envKeys 字段：非空字符串数组，逐项 trim 后去重。
@@ -126,16 +132,15 @@ export function buildEnv(ctx, keys, agent) {
     // shellEnv 缺失/失败只意味着没有受管变量，不阻断 PTC。
   }
 
-  // DSH_HOME 兜底：启动器/宿主进程通常显式设置了 DSH_HOME（本机为
-  // D:\AI\DeepSeek harness\.dsh）。shellEnv 不可用时退回到该值；shellEnv
-  // 已给出受管值时这里不会覆盖。
-  if (env.DSH_HOME === undefined) {
-    const ambientHome = lookupEnv(hostEnv, 'DSH_HOME')
-    if (ambientHome !== undefined && ambientHome !== null && !SENSITIVE_ENV_RE.test('DSH_HOME')) {
-      env.DSH_HOME = String(ambientHome)
-    }
+  // DSH_HOME 兜底：受管快照没给值时按机器路径事实的**唯一来源**推导（与插值同答案：
+  // 显式环境变量 → `USERPROFILE\.dsh`）。这是有意的**行为对齐**——此前未设 DSH_HOME 时
+  // 这里不给该键，于是 `{{DSH_HOME}}` 与 `run_code` 的 `env.DSH_HOME` 是两个答案。
+  if (env.DSH_HOME === undefined && !SENSITIVE_ENV_RE.test('DSH_HOME')) {
+    const derived = machinePaths(agent?.session, hostEnv).DSH_HOME
+    if (derived.length > 0) env.DSH_HOME = derived
   }
 
+  // DSH_WORKSPACE 只认**会话 cwd**（没有就不落键）——取值统一后仍按本处规则决定给不给键。
   const cwd = agent?.session?.header?.cwd
   if (typeof cwd === 'string' && cwd.length > 0 && !SENSITIVE_ENV_RE.test('DSH_WORKSPACE')) {
     env.DSH_WORKSPACE = cwd
@@ -169,38 +174,84 @@ function envSectionText(ctx, keys) {
   ].join('\n')
 }
 
-/** 给 run_code 的 ToolDefinition 打补丁：execute 前注入 env 前缀。 */
-export function patchRunCodeTool(tool, ctx, keys) {
+/** 取或建立工具状态；`configs` 按真实调用 Agent 键控，default 服务无 agent 的 apply。 */
+function stateOf(tool) {
+  return (tool[STATE] ??= { configs: new WeakMap(), default: undefined, patched: false })
+}
+
+/**
+ * 给 run_code 的 ToolDefinition 打补丁：execute 前注入 env 前缀。
+ * 单例只包装一次；配置在每次执行时读取，不再固化首个 Agent 的 ctx/keys。
+ */
+export function patchRunCodeTool(tool) {
   if (tool === undefined || tool.name !== 'run_code') return false
-  if (PATCHED.has(tool)) return false
-  PATCHED.add(tool)
+  const state = stateOf(tool)
+  if (state.patched) return false
 
   const originalExecute = tool.execute.bind(tool)
   tool.execute = async (rawArgs, exec) => {
+    const agent = exec?.agent
+    // 具名 Agent 只用自己的注册；无 agent 的执行才回落到 default 配置。
+    const config = agent === undefined ? state.default : state.configs.get(agent)
+    if (config === undefined) return originalExecute(rawArgs, exec)
+    // 官方在策略前已深冻结 arguments，不能原地改写；spread 出新对象再交给原 execute。
     const args = rawArgs ?? {}
-    const env = buildEnv(ctx, keys, exec?.agent)
+    const env = buildEnv(config.ctx, config.keys, agent)
     const code = injectEnvPrefix(typeof args.code === 'string' ? args.code : '', env)
     return originalExecute({ ...args, code }, exec)
   }
+  state.patched = true
   return true
 }
 
+/**
+ * 登记一份 Agent 配置：同一 Agent 多次 apply（多个模块）时 keys 取并集、ctx 取最新。
+ * @returns 注销函数；只删除自己仍是当前配置的那份，后注册的并集不被先撤者抹掉。
+ */
+function configureRunCode(tool, ctx, keys, agent) {
+  const state = stateOf(tool)
+  const previous = agent === undefined ? state.default : state.configs.get(agent)
+  const entry = { ctx, keys: new Set([...(previous?.keys ?? []), ...keys]) }
+  if (agent === undefined) state.default = entry
+  else state.configs.set(agent, entry)
+  return () => {
+    const current = agent === undefined ? state.default : state.configs.get(agent)
+    if (current !== entry) return
+    if (agent === undefined) state.default = undefined
+    else state.configs.delete(agent)
+  }
+}
+
 /** 注册 PTC env 注入：只在目标 scope 出现 run_code 时生效。 */
-export function apply(ctx, config) {
+export function apply(ctx, config, options = {}) {
   // 校验入口：未知键 / enabled 非布尔 / envKeys 缺失或全空都在挂载期 fail loud。
   const source = configContract.parse(config, name)
   // 开关语义：未声明 = 关闭（组合源为本模块显式写 enabled: true）。
   const { enabled, envKeys: keys } = source
+  const agent = options?.agent
+  let disposeConfig
+  let configuredTool
 
   const tryPatch = (scope) => {
     if (!enabled) return
     try {
-      patchRunCodeTool(ctx.tools.get('run_code', scope), ctx, keys)
+      const tool = ctx.tools.get('run_code', scope)
+      if (tool === undefined || tool === null) return
+      patchRunCodeTool(tool)
+      // 同一工具只登记一次；若宿主替换了 transport 定义，旧配置让位给新工具。
+      if (tool !== configuredTool) {
+        disposeConfig?.()
+        disposeConfig = configureRunCode(tool, ctx, keys, agent)
+        configuredTool = tool
+      }
     } catch {
       // run_code 尚未物化或 registry 不可用：下一次 assemble/execute 再试。
     }
   }
 
+  // 当前 scope 已物化 run_code 时挂载期即可登记。
+  tryPatch(agent)
+
   // 动态工具变化后，新 scope 的 run_code transport 可能刚创建。
   ctx.on('tools/change', () => tryPatch())
 
@@ -228,4 +279,7 @@ export function apply(ctx, config) {
       },
     })
   }
+
+  // 释放时只撤本模块登记的配置；工具上的 wrapper 保留（单例、无配置即透传）。
+  return enabled ? () => { disposeConfig?.() } : undefined
 }