dsh-rule-engine 0.5.12 → 0.5.14

package/lib/core/understander.js

@@ -1,150 +1,221 @@
-// understander.js - 规则理解器（模式库兜底版）。
-// 输入 parser 解析出的规则，输出结构化执行配置。
-// LLM 理解器可在后续版本接入 ctx.llm，当前先保证确定性与可测试性。
-import { extractElements } from "./parser.js";
-import {
-  BOM_WRITE,
-  DESTRUCTIVE_CMD,
-  DSH_KEYWORDS_RE,
-  INLINE_CMD,
-  SENSITIVE_CMD,
-  TIME_WORDS,
-  PROMISE_WORDS,
-  URL_RE,
-  SOURCE_MARK
-} from "./patterns.js";
-
-const HANDLER_BY_RULE = {
-  1: "rule1-retry",
-  2: "rule2-time",
-  5: "rule5-source",
-  7: "rule7-promise",
-  9: "rule9-inline-bom",
-  11: "rule11-language",
-  "12A": "rule12a-approval",
-  "12B": "rule12b-skill",
-  "12C": "rule12c-network",
-  "13A": "rule13a-backup",
-  // 13B 已于 2026-08-24 外移至手册（规则正文删除，映射一并清理，防死映射）
-  // 14 为纯 D 级自证规则，无对应 handler（0.5.11：删除空转映射 registry）
-  18: "rule18-manual-first",
-  21: "rule21-meta",
-  22: "rule22-7-direct",
-  23: "rule23-runtime-verify",
-  24: "rule24-assembly-type",
-  26: "rule26-release-asset",
-  27: "rule27-mount-audit"
-};
-
-/**
- * 覆盖自省（一致性预防机制）：
- *  - dead：HANDLER_BY_RULE 映射了但 AGENTS.md 无此规则 ID（死映射，应清理）
- *  - uncovered：A/C/M（deny/ask/meta）级但无 handler 的规则（规则声称会被机器执行，实际不会）
- * 在 /guard status 与一致性测试/脚本中使用；规则 21④/19⑦ 的体检触发条件之一。
- */
-export function analyzeCoverage(configs) {
-  const dead = new Map(); // ruleId -> handler（映射存在但规则不存在）
-  const uncovered = []; // A/C/M 级规则但引擎无执行 handler
-  const present = new Set();
-  for (const cfg of configs || []) {
-    if (cfg && cfg.ruleId !== undefined && cfg.ruleId !== null) present.add(String(cfg.ruleId));
-  }
-  for (const [id, handler] of Object.entries(HANDLER_BY_RULE)) {
-    if (!present.has(String(id))) dead.set(String(id), handler);
-  }
-  for (const cfg of configs || []) {
-    if (cfg.disabled) continue;
-    const acts = cfg.actions || [];
-    const hard = acts.some((a) => a === "deny" || a === "ask" || a === "meta");
-    if (hard && !cfg.handler) {
-      uncovered.push({ ruleId: String(cfg.ruleId), title: cfg.title, actions: acts });
-    }
-  }
-  return { dead, uncovered };
-}
-
-/** 根据执行等级推导动作（容忍空白/强弱/连接符：如 "B + D"、"A 弱 + D"、"D 强"） */
-export function actionsForLevel(level) {
-  const s = String(level || "").toUpperCase().replace(/\s+/g, "");
-  const actions = [];
-  if (s.includes("A")) actions.push("deny");
-  if (s.includes("B")) actions.push("correct");
-  if (s.includes("C")) actions.push("ask");
-  if (s.includes("D")) actions.push("self-certify");
-  if (s.includes("M")) actions.push("meta");
-  if (actions.length === 0) actions.push("self-certify");
-  return [...new Set(actions)];
-}
-
-function splitKeywords(text) {
-  if (!text) return [];
-  return text
-    .split(/[，。；、,\n；:：/\\()（）]+/)
-    .map((s) => s.trim())
-    .filter((s) => s.length >= 2 && s.length <= 20);
-}
-
-/** 从检查文本提取机器可用的提示词 */
-function hintPatterns(checkText) {
-  const hints = [];
-  if (/node\s+-e|node\s+-p|pwsh\s+-c|--eval|--print|-Command\b/i.test(checkText)) hints.push("inline-command");
-  if (/set-content|out-file|add-content|writealltext|utf8bom/i.test(checkText)) hints.push("bom-write");
-  if (/ask_user_question|授权|弹框/i.test(checkText)) hints.push("ask");
-  if (/get-date|时间词|昨天|今天/i.test(checkText)) hints.push("time");
-  if (/skill|技能/i.test(checkText)) hints.push("skill");
-  if (/git\s+(push|commit)|敏感操作|授权/i.test(checkText)) hints.push("sensitive");
-  if (/删除|覆盖|备份|验证/i.test(checkText)) hints.push("backup");
-  if (/手册/i.test(checkText)) hints.push("manual");
-  if (/重试|连续失败|第\s*3\s*次/i.test(checkText)) hints.push("retry");
-  if (/运行时验证|mock|启动|实测/i.test(checkText)) hints.push("runtime-verify");
-  if (/URL|来源|出处|引用/i.test(checkText)) hints.push("source");
-  if (/中文|英文|语言/i.test(checkText)) hints.push("language");
-  return [...new Set(hints)];
-}
-
-/**
- * 理解一条规则。
- * @param {object} rule parser 输出
- * @returns {object} 执行配置
- */
-export function understandRule(rule) {
-  const elems = extractElements(rule.body || "");
-  const level = rule.level || "";
-  const actions = actionsForLevel(level);
-  const hints = hintPatterns(elems.check);
-  const triggerKeywords = splitKeywords(elems.trigger);
-  const confidence = level && elems.trigger && elems.check && (elems.action || level.toUpperCase().includes("D")) ? "high" : level ? "medium" : "low";
-  const handler = HANDLER_BY_RULE[rule.index] || "";
-  const config = {
-    ruleId: rule.index,
-    title: rule.title,
-    section: rule.section,
-    level,
-    actions,
-    confidence,
-    handler,
-    triggerKeywords,
-    hints,
-    elements: elems,
-    disabled: false
-  };
-  return config;
-}
-
-/** 批量理解 */
-export function understandAll(rules) {
-  return rules.map(understandRule);
-}
-
-/** 导出常用正则供测试/调试 */
-export const REGEX = {
-  INLINE_CMD,
-  BOM_WRITE,
-  DESTRUCTIVE_CMD,
-  SENSITIVE_CMD,
-  TIME_WORDS,
-  PROMISE_WORDS,
-  URL_RE,
-  SOURCE_MARK,
-  DSH_KEYWORDS_RE
-};
+// understander.js - 规则理解器（模式库兜底版）。
+// 输入 parser 解析出的规则，输出结构化执行配置。
+// LLM 理解器可在后续版本接入 ctx.llm，当前先保证确定性与可测试性。
+import { extractElements, levelFromTitle } from "./parser.js";
+import {
+  BOM_WRITE,
+  DESTRUCTIVE_CMD,
+  DSH_KEYWORDS_RE,
+  INLINE_CMD,
+  SENSITIVE_CMD,
+  TIME_WORDS,
+  PROMISE_WORDS,
+  URL_RE,
+  SOURCE_MARK
+} from "./patterns.js";
+
+// 2026-08-31（残余1 剥离，用户定稿）：本机默认偏好表从代码下沉到本机配置——
+// rule-engine.json 的 handlerDefaultMap（可选键，可整体替换/清空）。代码层默认表为空
+// （通用版=零本机编号）；本机偏好经 state 注入（understandRule/understandAll 的 opts.defaultMap）。
+
+/**
+ * 覆盖自省（一致性预防机制）：
+ *  - dead：defaultMap 映射了但 AGENTS.md 无此规则 ID（死映射，应清理）
+ *  - uncovered：A/C/M（deny/ask/meta）级但无 handler 的规则（规则声称会被机器执行，实际不会）
+ * 在 /guard status 与一致性测试/脚本中使用；规则 21④/19⑦ 的体检触发条件之一。
+ * 剥离后 defaultMap 由调用方传入（本机=配置表；通用=空表）；缺省空表 → dead 恒 0。
+ * @param {object} configs 理解产物
+ * @param {object} [defaultMap] 生效的默认偏好表（{ruleId: handlerName}）
+ */
+export function analyzeCoverage(configs, defaultMap = {}) {
+  const dead = new Map(); // ruleId -> handler（映射存在但规则不存在）
+  const uncovered = []; // A/C/M 级规则但引擎无执行 handler
+  const present = new Set();
+  for (const cfg of configs || []) {
+    if (cfg && cfg.ruleId !== undefined && cfg.ruleId !== null) present.add(String(cfg.ruleId));
+  }
+  for (const [id, handler] of Object.entries(defaultMap || {})) {
+    if (!present.has(String(id))) dead.set(String(id), handler);
+  }
+  for (const cfg of configs || []) {
+    if (cfg.disabled) continue;
+    const acts = cfg.actions || [];
+    const hard = acts.some((a) => a === "deny" || a === "ask" || a === "meta");
+    if (hard && !cfg.handler) {
+      uncovered.push({ ruleId: String(cfg.ruleId), title: cfg.title, actions: acts });
+    }
+  }
+  return { dead, uncovered };
+}
+
+/** 根据执行等级推导动作（容忍空白/强弱/连接符：如 "B + D"、"A 弱 + D"、"D 强"） */
+export function actionsForLevel(level) {
+  const s = String(level || "").toUpperCase().replace(/\s+/g, "");
+  const actions = [];
+  if (s.includes("A")) actions.push("deny");
+  if (s.includes("B")) actions.push("correct");
+  if (s.includes("C")) actions.push("ask");
+  if (s.includes("D")) actions.push("self-certify");
+  if (s.includes("M")) actions.push("meta");
+  if (actions.length === 0) actions.push("self-certify");
+  return [...new Set(actions)];
+}
+
+function splitKeywords(text) {
+  if (!text) return [];
+  return text
+    .split(/[，。；、,\n；:：/\\()（）]+/)
+    .map((s) => s.trim())
+    .filter((s) => s.length >= 2 && s.length <= 20);
+}
+
+/** 从检查文本提取机器可用的提示词 */
+function hintPatterns(checkText) {
+  const hints = [];
+  if (/node\s+-e|node\s+-p|pwsh\s+-c|--eval|--print|-Command\b/i.test(checkText)) hints.push("inline-command");
+  if (/set-content|out-file|add-content|writealltext|utf8bom/i.test(checkText)) hints.push("bom-write");
+  if (/ask_user_question|授权|弹框/i.test(checkText)) hints.push("ask");
+  if (/get-date|时间词|昨天|今天/i.test(checkText)) hints.push("time");
+  if (/skill|技能/i.test(checkText)) hints.push("skill");
+  if (/git\s+(push|commit)|敏感操作|授权/i.test(checkText)) hints.push("sensitive");
+  if (/删除|覆盖|备份|验证/i.test(checkText)) hints.push("backup");
+  if (/手册/i.test(checkText)) hints.push("manual");
+  if (/重试|连续失败|第\s*3\s*次/i.test(checkText)) hints.push("retry");
+  if (/运行时验证|mock|启动|实测/i.test(checkText)) hints.push("runtime-verify");
+  if (/URL|来源|出处|引用/i.test(checkText)) hints.push("source");
+  if (/中文|英文|语言/i.test(checkText)) hints.push("language");
+  return [...new Set(hints)];
+}
+
+/** 规则正文内联 handler 声明（T3）：`<!-- handler: rule22-7-direct -->` */
+const HANDLER_DECL_RE = /<!--\s*handler\s*:\s*([a-z0-9][a-z0-9-]*)\s*-->/i;
+
+/**
+ * 执行器语义别名（残余3 通用化，2026-08-31）：
+ * 内部执行器名（rule12a-approval 等）带规则编号影子——陌生用户声明时不应见到。
+ * 语义名 → 内部名映射：声明/配置写语义名即归一；直接写内部名不受影响（别名表无该键）。
+ * 归一发生在 resolveHandler 末端；guard-core 分支（按内部名）零改动。
+ */
+const HANDLER_ALIASES = {
+  retry: "rule1-retry",
+  time: "rule2-time",
+  source: "rule5-source",
+  promise: "rule7-promise",
+  "inline-command": "rule9-inline-bom",
+  language: "rule11-language",
+  approval: "rule12a-approval",
+  "skill-auth": "rule12b-skill",
+  network: "rule12c-network",
+  backup: "rule13a-backup",
+  "manual-first": "rule18-manual-first",
+  meta: "rule21-meta",
+  "intent-direct": "rule22-7-direct",
+  "runtime-verify": "rule23-runtime-verify",
+  assembly: "rule24-assembly-type",
+  "release-asset": "rule26-release-asset",
+  "mount-audit": "rule27-mount-audit"
+};
+
+/** 语义名归一（内部名原样返回；未知名保持原样——由覆盖自省提示未覆盖） */
+export function normalizeHandlerName(name) {
+  const s = String(name || "");
+  return HANDLER_ALIASES[s] || s;
+}
+
+/**
+ * handler 绑定解析（T3 通用化，2026-08-31）——优先级：
+ *  ① opts.handlerOverrides[ruleId] （rule-engine.json 配置覆盖，集中管理）
+ *  ② 规则正文内联声明 <!-- handler: xxx --> （随规则走，可声明任意已实现执行器）
+ *  ③ opts.defaultMap || HANDLER_BY_RULE （本机默认偏好表；defaultMap 可整体替换）
+ *  ④ "" （未绑定=纯自证规则，README「局限 4」分流——规则仍参与匹配/自证，不参与硬拦）
+ * 所有来源经 normalizeHandlerName 归一（语义名/内部名均可；本机零行为变化）。
+ */
+export function resolveHandler(rule, opts = {}) {
+  const id = String(rule?.index ?? "");
+  const overrides = opts?.handlerOverrides;
+  if (overrides && typeof overrides === "object" && overrides[id] !== undefined) return normalizeHandlerName(overrides[id]);
+  const body = String(rule?.body || "");
+  const decl = body.match(HANDLER_DECL_RE);
+  if (decl) return normalizeHandlerName(decl[1]);
+  // 剥离后（2026-08-31）：代码层无默认表；defaultMap 由调用方注入（本机=配置 handlerDefaultMap）
+  const map = opts?.defaultMap || {};
+  return normalizeHandlerName(map[rule?.index] || "");
+}
+
+/**
+ * 理解一条规则。
+ * @param {object} rule parser 输出
+ * @param {object} [opts] 绑定选项（handlerOverrides/defaultMap，见 resolveHandler）
+ * @returns {object} 执行配置
+ */
+export function understandRule(rule, opts = {}) {
+  const elems = extractElements(rule.body || "");
+  const level = rule.level || "";
+  const actions = actionsForLevel(level);
+  const hints = hintPatterns(elems.check);
+  const triggerKeywords = splitKeywords(elems.trigger);
+  const confidence = level && elems.trigger && elems.check && (elems.action || level.toUpperCase().includes("D")) ? "high" : level ? "medium" : "low";
+  const handler = resolveHandler(rule, opts);
+  const config = {
+    ruleId: rule.index,
+    title: rule.title,
+    section: rule.section,
+    level,
+    actions,
+    confidence,
+    handler,
+    triggerKeywords,
+    hints,
+    elements: elems,
+    disabled: false
+  };
+  return config;
+}
+
+/** 批量理解。opts：
+ *  - disabledEntries: dsh-rules-manager 禁用存档条目（数组）。正文已移走、不在 rules 中的
+ *    禁用规则用存档正文重建占位 cfg（disabled=true）——禁用=存在但休眠，恢复自动生效。
+ *    在理解层重建保证所有调用方（state/consistency-live/运行时）口径一致。
+ *  - handlerOverrides: { ruleId: handlerName } 声明式绑定覆盖（T3，通用化通道）。
+ *  - defaultMap: 覆盖 HANDLER_BY_RULE 默认偏好表（T3；缺省=本机默认表）。
+ */
+export function understandAll(rules, opts = {}) {
+  const configs = (rules || []).map((r) => understandRule(r, opts));
+  const entries = opts?.disabledEntries;
+  if (Array.isArray(entries) && entries.length) {
+    const disabledIds = new Set(entries.map((d) => String(d.index)).filter(Boolean));
+    // 在场禁用规则：只标 disabled（保留 AGENTS.md 正文，不被存档覆盖）
+    for (const cfg of configs) {
+      if (disabledIds.has(String(cfg.ruleId))) cfg.disabled = true;
+    }
+    // 缺场禁用规则：用存档正文重建占位（正文已移走的规则不再"消失"）
+    const present = new Set(configs.map((c) => String(c.ruleId)));
+    for (const entry of entries) {
+      const key = String(entry.index);
+      if (present.has(key)) continue;
+      const cfg = understandRule({
+        index: entry.index,
+        title: entry.title || "",
+        section: entry.section || "",
+        level: levelFromTitle(entry.header || entry.title || ""),
+        body: entry.body || ""
+      }, opts);
+      cfg.disabled = true;
+      configs.push(cfg);
+    }
+  }
+  return configs;
+}
+
+/** 导出常用正则供测试/调试 */
+export const REGEX = {
+  INLINE_CMD,
+  BOM_WRITE,
+  DESTRUCTIVE_CMD,
+  SENSITIVE_CMD,
+  TIME_WORDS,
+  PROMISE_WORDS,
+  URL_RE,
+  SOURCE_MARK,
+  DSH_KEYWORDS_RE
+};

package/lib/index.js

@@ -101,6 +101,11 @@ export const inject = ["tools", "commands", "agents", "workspaceRegistry", "skil
 const pluginConfig = loadPluginConfig();
 state.enabled = pluginConfig.enabled;
 applyTaskContractConfig(state, pluginConfig);
+// T3 通用化（2026-08-31）：声明式绑定覆盖表注入（rule-engine.json 可选键 handlerOverrides；缺省 {}）
+state.handlerOverrides = pluginConfig?.handlerOverrides || {};
+// 残余1 剥离（2026-08-31）：本机默认偏好表注入（rule-engine.json 可选键 handlerDefaultMap；
+// 通用部署=空表——代码零本机编号，本机偏好不随包走、升级不丢）
+state.handlerDefaultMap = pluginConfig?.handlerDefaultMap || {};
 // reloadRules 内部已统一刷新理解产物（P0-3），此处不再重复写
 reloadRules(state);
 
@@ -157,6 +162,23 @@ function sessionIdOfExec(exec) {
   return "global";
 }
 
+/**
+ * 从 /guard 命令 invocation 取会话 id（2026-08-31 会话寻址修复）。
+ * 官方 CommandInvocation 无 session 字段（只有 commandId/agent/rawInput/attachments/signal），
+ * 旧代码 invocation?.session?.id 恒为 undefined → 永远落到 "global"（仅模板），而当前会话的
+ * contract 在创建时已快照、不随 global 变化 —— 这是"/guard mode change 放行无效"的根因。
+ * 官方类型：Agent.id 与 session.id 是同一身份（"The single identity shared with session"），
+ * 收到命令的代理 = 命令发起的会话；裁决侧 sessionIdOfExec 取 exec.agent.session.id —— 两者对齐。
+ */
+export function sessionIdOfInvocation(invocation) {
+  const agent = invocation?.agent;
+  if (!agent) return "global";
+  if (typeof agent.id === "string" && agent.id) return agent.id;
+  if (typeof agent.session === "object" && agent.session?.id) return agent.session.id;
+  if (typeof agent.session === "string") return agent.session;
+  return "global";
+}
+
 /**
  * 从 user/message 事件提取用户文本。
  * 2026-08-24 根因修复：官方结构（@deepseek-ai/dsh-session/surface）中
@@ -617,6 +639,8 @@ export function handleSessionEvent(ctx, session, event) {
       }
     }
     if (isManualReadTool(toolName, args)) s.manualReadSeen = true;
+    // 规则 5/31 扩展（2026-09-01）：查询类工具调用记下回合号（"近 3 回合有据"判定）
+    if (isReadOnlyTool(toolName, args)) s.lastQueryTurn = s.turn.number;
     if (toolName === "skill" && args?.name) s.turn.skillNames.push(args.name);
     s.turn.toolNames.push(toolName);
     if (state.taskContract?.taskContractEnabled) {
@@ -1078,23 +1102,30 @@ export function handleSessionEvent(ctx, session, event) {
 
 // ── /guard 命令 ─────────────────────────────────────────────────────────────
 
+// ── /guard 子命令单一真源（0.5.13：hint 手写漏 tools 修复）──
+// hint（输入框提示）与 USAGE（完整帮助）均由此派生：未来新增子命令只改这一个数组。
+const COMMAND_SPECS = [
+  { name: "status", args: "", desc: "引擎状态" },
+  { name: "rules", args: "", desc: "规则清单 + 理解产物" },
+  { name: "active", args: "", desc: "最近激活的规则" },
+  { name: "log", args: "[N]", desc: "最近 N 条审计（默认 10）" },
+  { name: "unlock", args: "[N]", desc: "解锁配置写保护 N 分钟（默认 10，仅用户）" },
+  { name: "bypass", args: "[N]", desc: "临时整体放行 N 分钟（默认 5，仅用户）" },
+  { name: "lock", args: "", desc: "立即恢复全部守卫（取消解锁/放行）" },
+  { name: "revoke", args: "", desc: "撤销全部授权记录" },
+  { name: "tools", args: "", desc: "工具放行白名单（永久+本会话，含时间/来源会话）" },
+  { name: "tools revoke", args: "<工具名>", desc: "撤销白名单条目（持久化+会话集）" },
+  { name: "reload", args: "", desc: "强制重解析 AGENTS.md" },
+  { name: "mode", args: "<模式>", desc: "设置任务契约模式（review/answer/change/monitor/watch/off）" },
+  { name: "budget", args: "...", desc: "设置预算（agents=N files=... deps=allow hash=allow）" },
+  { name: "contract", args: "", desc: "查看当前任务契约" },
+  { name: "contract categories", args: "...", desc: "设定契约类别白名单（0.5.12）" },
+  { name: "label", args: "<id> <label>", desc: "给审计记录打标（correct/incorrect/inconclusive）" }
+];
+
 const USAGE = [
   "用法：",
-  "  /guard status          引擎状态",
-  "  /guard rules           规则清单 + 理解产物",
-  "  /guard active          最近激活的规则",
-  "  /guard log [N]         最近 N 条审计（默认 10）",
-  "  /guard unlock [N]      解锁配置写保护 N 分钟（默认 10，仅用户）",
-  "  /guard bypass [N]      临时整体放行 N 分钟（默认 5，仅用户）",
-  "  /guard lock            立即恢复全部守卫（取消解锁/放行）",
-  "  /guard revoke          撤销全部授权记录",
-  "  /guard tools           工具放行白名单（永久+本会话，含时间/来源会话）",
-  "  /guard tools revoke <工具名>  撤销白名单条目（持久化+会话集）",
-  "  /guard reload          强制重解析 AGENTS.md",
-  "  /guard mode <模式>     设置任务契约模式（review/answer/change/monitor/watch/off）",
-  "  /guard budget ...      设置预算（agents=N files=... deps=allow hash=allow）",
-  "  /guard contract        查看当前任务契约",
-  "  /guard label <id> <label>  给审计记录打标（correct/incorrect/inconclusive）",
+  ...COMMAND_SPECS.map((s) => `  /guard ${s.name}${s.args ? " " + s.args : ""}  ${s.desc}`),
   "",
   "说明：",
   "  - 守卫 = 硬拦截：违反规则的工具调用直接拒绝，模型无法自行绕过；",
@@ -1102,6 +1133,10 @@ const USAGE = [
   "  - 每次拦截/纠察都会记录到 " + auditFilePath() + "（/guard log 可查）。"
 ].join("\n");
 
+// 输入框提示：由子命令清单自动派生（顶层命令名去重，新子命令/别名自动同步）
+// eslint-disable-next-line no-unused-vars
+const GUARD_HINT = "[" + [...new Set(COMMAND_SPECS.map((s) => s.name.split(" ")[0]))].join("|") + "]";
+
 function parseCommand(rawInput) {
   const text = (rawInput || "").trim();
   if (!text || /^(status|state)$/i.test(text)) return { kind: "status" };
@@ -1156,11 +1191,14 @@ async function executeGuard(ctx, invocation) {
       const medium = state.configs.filter((c) => c.confidence === "medium").length;
       const low = state.configs.filter((c) => c.confidence === "low").length;
       // 覆盖自省（一致性预防）：dead = 映射有但规则无；uncovered = 硬等级规则但无 handler
-      const { dead, uncovered } = analyzeCoverage(state.configs);
+      const { dead, uncovered } = analyzeCoverage(state.configs, state.handlerDefaultMap || {});
       const parts = [
         "【规则引擎状态】",
         `  总开关：${state.enabled ? "开启" : "已关闭"}`,
         `  任务契约：${state.taskContract?.taskContractEnabled ? `开启（模式 ${state.taskContract.taskContractMode}｜ask ${state.taskContract.askEnabled ? "开" : "关"}）` : "关闭"}`,
+        // 2026-08-31：本会话真实契约（mode/level/预算）——档位（面板）≠ 本会话模式，两者分开展示
+        // （旧版只显示档位：用户 "armed" 误以为已放行，实际裁决按会话 mode 走）
+        `  本会话契约：${state.taskContract?.taskContractEnabled ? `${contractSummary(getSessionState(state, sessionIdOfInvocation(invocation)).contract)}（会话 ${sessionIdOfInvocation(invocation)}）` : "关闭（总开关未开，命令不生效）"}`,
         `  规则容器：${state.configOk ? `正常（${state.configs.length} 条规则）` : "⚠ " + state.configError}`,
         `  理解置信度：high ${high} / medium ${medium} / low ${low}`,
         `  覆盖自省：${dead.size === 0 && uncovered.length === 0 ? "无缺口" : (dead.size > 0 ? `死映射 ${[...dead.keys()].join("、")}（引擎映射存在但规则已删除，建议清理）` : "") + (uncovered.length > 0 ? `；未覆盖 ${uncovered.map((u) => u.ruleId).join("、")}（${uncovered.map((u) => u.actions.join("+")).join("；")} 但无 handler，规则声明强制但引擎不执行，建议降 D 级或补实现）` : "")}`,
@@ -1199,7 +1237,7 @@ async function executeGuard(ctx, invocation) {
       const minutes = Math.min(Math.max(1, command.minutes), 60);
       state.unlockUntil = Date.now() + minutes * 60000;
       // 逃生门请求审计（机制批 M1）：用途留痕，供规则 1⑤ 事前说明核对
-      audit({ kind: "guard-command", rule: "__escape-gate", name: "逃生门请求", event: "command", reason: `/guard unlock ${minutes} 分钟（配置写保护）`, session: invocation?.session?.id || "global" });
+      audit({ kind: "guard-command", rule: "__escape-gate", name: "逃生门请求", event: "command", reason: `/guard unlock ${minutes} 分钟（配置写保护）`, session: sessionIdOfInvocation(invocation) });
       return {
         kind: "success",
         text: `已解锁「配置写保护」${minutes} 分钟。现在可以让助手修改 rule-engine.json / rule-understanding.json / AGENTS.md；改完请执行 /guard lock 或等待自动恢复。`
@@ -1209,7 +1247,7 @@ async function executeGuard(ctx, invocation) {
       const minutes = Math.min(Math.max(1, command.minutes), 60);
       state.bypassUntil = Date.now() + minutes * 60000;
       // 逃生门请求审计（机制批 M1）
-      audit({ kind: "guard-command", rule: "__escape-gate", name: "逃生门请求", event: "command", reason: `/guard bypass ${minutes} 分钟（全部守卫）`, session: invocation?.session?.id || "global" });
+      audit({ kind: "guard-command", rule: "__escape-gate", name: "逃生门请求", event: "command", reason: `/guard bypass ${minutes} 分钟（全部守卫）`, session: sessionIdOfInvocation(invocation) });
       return {
         kind: "success",
         text: `已临时放行全部守卫 ${minutes} 分钟。到期自动恢复，也可 /guard reload 后立即恢复。`
@@ -1230,7 +1268,7 @@ async function executeGuard(ctx, invocation) {
         name: "撤销全部授权",
         event: "command",
         reason: `撤销 ${count} 条授权/范围（session + turn.scopes + global + askRejections 全清）`,
-        session: invocation?.session?.id || "global"
+        session: sessionIdOfInvocation(invocation)
       });
       return { kind: "success", text: `已撤销全部授权与范围（共 ${count} 条，含全局池与 ask 拒绝记录；不再有残留）。` };
     }
@@ -1275,7 +1313,7 @@ async function executeGuard(ctx, invocation) {
           name: "白名单撤销",
           event: "command",
           reason: `/guard tools revoke ${target}（持久化+会话集同步移除）`,
-          session: invocation?.session?.id || "global"
+          session: sessionIdOfInvocation(invocation)
         });
         return { kind: "success", text: `已撤销 ${target}${existed ? "" : "（原不在白名单）"}。` };
       }
@@ -1296,7 +1334,7 @@ async function executeGuard(ctx, invocation) {
     }
     case "mode": {
       if (!state.taskContract?.taskContractEnabled) return { kind: "error", text: "任务契约未启用：请先在规则引擎设置页开启总开关。" };
-      const sid = invocation?.session?.id || "global";
+      const sid = sessionIdOfInvocation(invocation);
       const s = getSessionState(state, sid);
       const res = applyContract(s.contract, { mode: command.mode, level: command.level, source: "guard-command" });
       if (res.changed) {
@@ -1307,7 +1345,7 @@ async function executeGuard(ctx, invocation) {
     }
     case "budget": {
       if (!state.taskContract?.taskContractEnabled) return { kind: "error", text: "任务契约未启用：请先在规则引擎设置页开启总开关。" };
-      const sid = invocation?.session?.id || "global";
+      const sid = sessionIdOfInvocation(invocation);
       const s = getSessionState(state, sid);
       const res = applyContract(s.contract, { ...command.patch, source: "guard-command" });
       if (res.changed) {
@@ -1317,14 +1355,14 @@ async function executeGuard(ctx, invocation) {
       return { kind: "success", text: `任务契约：${contractSummary(s.contract)}` };
     }
     case "contract": {
-      const sid = invocation?.session?.id || "global";
+      const sid = sessionIdOfInvocation(invocation);
       const s = getSessionState(state, sid);
       const enabled = state.taskContract?.taskContractEnabled ? "开启" : "关闭（总开关未开启，命令不生效）";
       return { kind: "success", text: `任务契约（总开关：${enabled}）\n${contractSummary(s.contract)}` };
     }
     case "contract-categories": {
       if (!state.taskContract?.taskContractEnabled) return { kind: "error", text: "任务契约未启用：请先在规则引擎设置页开启总开关。" };
-      const sid = invocation?.session?.id || "global";
+      const sid = sessionIdOfInvocation(invocation);
       const s = getSessionState(state, sid);
       const cats = command.categories;
       if (cats.length === 0) {
@@ -1360,7 +1398,7 @@ async function executeGuard(ctx, invocation) {
         try {
           const fp = labelFingerprint(JSON.parse(found.args || "{}").command || "");
           if (fp) {
-            const sid = invocation?.session?.id || "global";
+            const sid = sessionIdOfInvocation(invocation);
             state.labelRows = upsertLabel(state.labelRows || [], labelEntry(fp, "incorrect", sid));
             saveLabelsToDisk(labelsFilePath(dshHome()), state.labelRows);
             audit({ kind: "task-label", rule: "__task-contract", name: "审计人工标注", event: "command", reason: `${found.eventId} = ${command.label}（来源 ERR-${found.errId || "?"}）+ 命令指纹放行已记录：${fp.slice(0, 100)}`, session: sid });
@@ -1370,7 +1408,7 @@ async function executeGuard(ctx, invocation) {
           // 指纹解析失败不阻断打标（保守：只记单条，不记指纹）
         }
       }
-      audit({ kind: "task-label", rule: "__task-contract", name: "审计人工标注", event: "command", reason: `${found.eventId} = ${command.label}（来源 ERR-${found.errId || "?"}）`, session: invocation?.session?.id || "global" });
+      audit({ kind: "task-label", rule: "__task-contract", name: "审计人工标注", event: "command", reason: `${found.eventId} = ${command.label}（来源 ERR-${found.errId || "?"}）`, session: sessionIdOfInvocation(invocation) });
       return { kind: "success", text: `已标注 ${found.eventId} = ${command.label}` };
     }
     case "label-clear": {
@@ -1378,7 +1416,7 @@ async function executeGuard(ctx, invocation) {
       const before = (state.labelRows || []).length;
       state.labelRows = (state.labelRows || []).filter((r) => r.fingerprint !== fp);
       saveLabelsToDisk(labelsFilePath(dshHome()), state.labelRows);
-      audit({ kind: "task-label", rule: "__task-contract", name: "打标指纹撤销", event: "command", reason: `撤销命令指纹：${fp}（${before} → ${state.labelRows.length} 条）`, session: invocation?.session?.id || "global" });
+      audit({ kind: "task-label", rule: "__task-contract", name: "打标指纹撤销", event: "command", reason: `撤销命令指纹：${fp}（${before} → ${state.labelRows.length} 条）`, session: sessionIdOfInvocation(invocation) });
       return { kind: "success", text: `已撤销命令指纹 ${fp}（剩余 ${state.labelRows.length} 条）` };
     }
     default:
@@ -1732,7 +1770,7 @@ export function apply(ctx) {
       yield ctx.commands.register({
         name: "guard",
         description: "规则执行引擎：查看状态/规则/激活/审计，解锁配置修改，临时放行，强制重载",
-        input: { hint: "[status|rules|active|log <N>|unlock <分钟>|bypass <分钟>|reload]" },
+        input: { hint: GUARD_HINT },
         handler: async (invocation) => {
           try {
             return await executeGuard(ctx, invocation);