dsh-rule-engine 0.5.3 → 0.5.5

package/lib/index.js

@@ -2,9 +2,11 @@
 // 容器：解析 AGENTS.md → 理解器 → 匹配机 → 执行框架。
 // 执行框架：ctx.tools.guard() 硬拦 + session/event 文本纠察 + 审计台账 + /guard 命令。
 import { readFileSync, watch, writeFileSync } from "node:fs";
+import { randomUUID } from "node:crypto";
 import { audit, readAuditLog } from "./core/audit.js";
 import { loadPluginConfig } from "./core/config.js";
 import { guardDecision } from "./core/guard-core.js";
+import { computeBaselineGap, loadBaselineFile, BASELINE_COMPLETE_RE } from "./core/baseline.js";
 import {
   activateForAssistant,
   activateForToolCall,
@@ -20,20 +22,29 @@ import {
   isBackupTool,
   isGetDateCommand,
   isManualReadTool,
+  isReadOnlyTool,
+  needsApprovalReminder,
   PRIVATE_NETWORK_RE,
   setWorkspaceRoot
 } from "./core/patterns.js";
 import {
+  askQuestionCoreText,
   askQuestionText,
   askResultApproved,
+  askResultSelectedText,
   inferPathPrefixFromText,
   inferTypeFromText,
   isAuthMessage,
   isDirectiveMessage,
-  isQuestionMessage
+  isQuestionMessage,
+  isSessionWideAskText,
+  scopesFromIntents
 } from "./core/authorization.js";
+import { isEngineInjectedMessage, isInjectedContextMessage, isKnownSystemInjection, parseUserIntents, stripInjectedContext } from "./core/intent.js";
+import { enrichIntentWithLlm } from "./core/llm-intent.js";
 import {
   applyTaskContractConfig,
+  clearAuthorizations,
   getSessionState,
   maybeReloadIfChanged,
   recordAuthorization,
@@ -41,12 +52,15 @@ import {
   reloadRules,
   resetTurn
 } from "./core/state.js";
+import { SAFE_UNCOVERED_TOOLS } from "./core/guard-core.js";
+import { toolClass } from "./core/tool-catalog.js";
 import { state } from "./core/runtime.js";
 import { detectViolations, extractAssistantText } from "./core/text-detect.js";
 import {
   applyContract,
   contractSummary,
   decideContractAction,
+  consumeDelegateBudget,
   defaultContract,
   isArmed,
   isObserving,
@@ -118,10 +132,22 @@ function sessionIdOfExec(exec) {
   return "global";
 }
 
-function extractUserText(message) {
+/**
+ * 从 user/message 事件提取用户文本。
+ * 2026-08-24 根因修复：官方结构（@deepseek-ai/dsh-session/surface）中
+ * event.data 就是消息对象本身（deriveEventMessage case 'user/message' 返回 event.data），
+ * 并非 data.message——旧代码取 d.message 导致永远提取空文本：
+ *   旧行为 → 空文本 parseUserIntents("") 非空对象 → 规则 22 无故全拦；
+ *   中间版 → if (!text) return 跳过 → 全放行（漏拦）；
+ * 正解 = 取对字段；兼容 data 与 data.message 两种历史形态。
+ */
+export function extractUserText(message) {
   if (!message) return "";
   if (typeof message === "string") return message;
-  const content = message.content;
+  const obj = typeof message === "object" && !Array.isArray(message)
+    ? (message.content !== undefined ? message : message.message)
+    : message;
+  const content = obj?.content;
   if (typeof content === "string") return content;
   if (Array.isArray(content)) {
     return content
@@ -133,28 +159,52 @@ function extractUserText(message) {
 
 // ── session/event 处理 ──────────────────────────────────────────────────────
 
+// O1 注入通道修复（2026-08-24，批次 6）：
+// 根因——maybeInject 在 session/event 观察回调内同步调用 agent.inject，而 inject 底层是
+// 同步 session.append("agent/inbox/spliced")；dsh-session 对同一 session 的 append 有
+// 同步重入保护（entry.appending → "session append cannot reenter while another append
+// is being published"），观察回调正处在 append 发布边界内 → 必然抛错（README 局限 6 记录：
+// 注入从未到达模型/界面，仅审计留痕）。
+// 修复——投递延迟到当前 append 发布边界之后（宏任务 setTimeout 0），语义不变
+// （inject 官方语义本就是 "queue context for the next pre-step, without waking"）；
+// 插件卸载/热重载时统一清理 pending 定时器。
+const pendingInjectTimers = new Set();
+
 function maybeInject(ctx, sessionId, violation) {
   if (!pluginConfig.correctInject) return;
   const key = `${sessionId}:${violation.ruleId}`;
   const count = state.injectCounts.get(key) || 0;
   if (count >= pluginConfig.injectLimitPerRulePerSession) return;
   state.injectCounts.set(key, count + 1);
-  try {
-    const agent = ctx.agents.get(sessionId);
-    if (agent && typeof agent.inject === "function") {
-      agent.inject({
-        content: [
-          {
-            type: "text",
-            text: `[规则引擎] ${violation.reason}（规则 ${violation.ruleId}，已记入 /guard log；下次回复请自证/纠正）`
-          }
-        ],
-        source: { kind: "plugin", plugin: name }
-      });
+  const timer = setTimeout(() => {
+    pendingInjectTimers.delete(timer);
+    try {
+      const agent = ctx.agents.get(sessionId);
+      if (agent && typeof agent.inject === "function") {
+        // 2026-08-24 批次 6 收尾（O1 实弹观测）：注入消息必须具备官方身份（id+role）——
+        // dsh-llm 官方 createUserMessage 生成 { id: randomUUID(), role: "user", content, source }；
+        // 无 id 时 Inbox.validate 用 undefined 作身份，同批第二条起抛
+        // `message "undefined" is already pending`（实弹 17:56:37 八连发观测）。
+        agent.inject({
+          id: `re-${randomUUID()}`,
+          role: "user",
+          content: [
+            {
+              type: "text",
+              text: `[规则引擎] ${violation.reason}（规则 ${violation.ruleId}，已记入 /guard log；下次回复请自证/纠正）`
+            }
+          ],
+          source: { kind: "plugin", plugin: name }
+        });
+        audit({ kind: "inject", rule: violation.ruleId, name: "纠正注入", event: "inject", reason: `注入已投递（agent=${sessionId}）：${String(violation.reason || "").slice(0, 120)}`, session: sessionId });
+      } else {
+        audit({ kind: "inject", rule: violation.ruleId, name: "纠正注入", event: "inject", reason: `注入未投递：agents.get(${sessionId}) 无可用 agent.inject`, session: sessionId });
+      }
+    } catch (error) {
+      audit({ kind: "inject", rule: violation.ruleId, name: "纠正注入", event: "inject", reason: `注入异常：${error instanceof Error ? error.message : String(error)}`, session: sessionId });
     }
-  } catch {
-    // 注入失败不影响审计
-  }
+  }, 0);
+  pendingInjectTimers.add(timer);
 }
 
 async function refreshSkills(ctx) {
@@ -166,7 +216,7 @@ async function refreshSkills(ctx) {
   }
 }
 
-function handleSessionEvent(ctx, session, event) {
+export function handleSessionEvent(ctx, session, event) {
   maybeReloadIfChanged(state);
   const sid = session?.id || "global";
   const s = getSessionState(state, sid);
@@ -175,11 +225,87 @@ function handleSessionEvent(ctx, session, event) {
     resetTurn(state, sid, d.turn);
     return;
   }
+  if (event.type === "turn/end") {
+    // M8 双通道机制：本回合用 dsh-manual-write 落盘手册/AGENTS 后，必须同轮 engram_store 沉淀记忆；
+    // 缺失 → 审计 + 注入纠正（用户明确要求机制化，2026-08-24）
+    if (s.turn.manualWriteSeen && !s.turn.engramStoreSeen) {
+      audit({
+        kind: "engram-gap",
+        rule: "__engram-gap",
+        name: "双通道记忆缺失",
+        event: "turn/end",
+        reason: "本回合 dsh-manual-write 落盘了手册/AGENTS，但未同轮调用 engram_store；按规则 19/77/M8 应在同一回合完成记忆沉淀",
+        session: sid
+      });
+      maybeInject(ctx, sid, {
+        ruleId: "__engram-gap",
+        reason: "规则 19/M8：手册/AGENTS 落盘后必须在同一回合补 engram_store，否则记忆机制断链——请立即补写并说明"
+      });
+    }
+    return;
+  }
   if (event.type === "user/message") {
-    const text = extractUserText(d.message);
+    // 机制 A（2026-08-24）：source.kind 主判——非 user 来源（官方 agent-instructions/skill-catalog、
+    // 插件自定义 kind）一律不进授权池、不覆盖回合状态；审计留痕可对账（source-skip）。
+    const srcKind = d?.source?.kind;
+    if (typeof srcKind === "string" && srcKind !== "user") {
+      const preview = extractUserText(d).slice(0, 80);
+      audit({
+        kind: "source-skip",
+        rule: "__source-skip",
+        name: "非用户来源消息跳过",
+        event: "user/message",
+        reason: `source.kind=${srcKind}：${preview}`,
+        session: sid
+      });
+      return;
+    }
+    // 系统注入剥离（2026-08-24 v2）：注入与真实用户消息合并为同一事件
+    //（官方注入机制将 <system-reminder> 烤进 content；剥离后剩余文本 = 用户消息）。
+    // 2026-08-24 根因修复：event.data 即消息对象（官方 surface 结构），不再取 d.message。
+    const text = stripInjectedContext(extractUserText(d));
+    if (!text) return;
+    // 引擎自身注入的 [规则引擎] 提示不是用户消息，跳过——否则其中的“请直接执行”会被记录成授权（自我续授权漏洞）
+    if (isEngineInjectedMessage(text)) return;
+    // 模板兜底（对 kind=user 同样生效，防"标 user 的注入"——super-injector createUserMessage 同类风险）：
+    // runtime context 快照 / 子代理完成通知 / vision-router 挂载提醒等已知注入模板 → 整体跳过
+    if (isKnownSystemInjection(text)) {
+      audit({
+        kind: "source-skip",
+        rule: "__source-skip",
+        name: "已知系统注入模板跳过",
+        event: "user/message",
+        reason: `文本模板命中：${text.slice(0, 80)}`,
+        session: sid
+      });
+      return;
+    }
+    // 批次 3（2026-08-24）：用户明确"允许使用 X"→ 未归类工具会话白名（unknown→deny 的唯一批准路径）
+    if (!state.unknownToolApproved) state.unknownToolApproved = new Set();
+    for (const hit of text.matchAll(/(?:允许|批准|同意)\s*(?:使用|调用|用|启用|放行)\s*([A-Za-z_][A-Za-z0-9_:.-]*)/g)) {
+      const toolName = hit[1];
+      if (toolClass(toolName, {}) !== "unknown") continue; // 只对未归类工具有意义（已知工具不走 unknown 分支）
+      const isNew = !state.unknownToolApproved.has(toolName);
+      state.unknownToolApproved.add(toolName);
+      audit({
+        kind: "unknown-tool-whitelist",
+        rule: "__unknown-tool",
+        name: "用户批准未归类工具",
+        event: "user/message",
+        reason: `用户明确允许使用 ${toolName}${isNew ? "" : "（重复，忽略）"} → 会话白名`,
+        session: sid
+      });
+    }
     s.lastUserText = text;
     s.turn.userText = text;
     s.turn.questionOnly = isQuestionMessage(text);
+    s.turn.intents = parseUserIntents(text);
+    // 规则 22 粒度升级（2026-08-24）：本回合授权范围 = 各 execute 子句推导出的 type+path 范围
+    s.turn.scopes = scopesFromIntents(s.turn.intents);
+    // LLM 意图兜底（方案 A）：低置信/歧义消息异步预取，不阻塞事件流；失败自动降级词表
+    if (pluginConfig.llmIntent?.enabled) {
+      void enrichIntentWithLlm(ctx, state, sid, text, pluginConfig.llmIntent);
+    }
     if (state.taskContract?.taskContractEnabled) {
       const patch = naturalMode(text, s.contract);
       if (patch) {
@@ -197,12 +323,29 @@ function handleSessionEvent(ctx, session, event) {
         }
       }
     }
-    if (isAuthMessage(text) || isDirectiveMessage(text)) {
+    const intents = s.turn.intents;
+    let recordedAuth = false;
+    if (intents?.clauses?.some((c) => c.type === "execute")) {
+      // 与规则 22 粒度保持一致：按 scopesFromIntents 的多 type×多 path 逐条记录 12A 授权，
+      // 避免“规则 22 放行、12A 却因只记了单 type/单路径而拦截”的不一致（2026-08-24 第二轮修复）
+      const execScopes = s.turn.scopes && s.turn.scopes.length > 0 ? s.turn.scopes : scopesFromIntents(intents);
+      for (const scope of execScopes) {
+        recordAuthorization(state, sid, {
+          type: scope.type,
+          pathPrefix: scope.pathPrefix,
+          source: "user-message-clause",
+          clauseId: scope.clauseId
+        });
+      }
+      recordedAuth = true;
+      audit({ kind: "auth", rule: "12D", name: "用户消息执行子句授权", event: "user/message", reason: `记录执行分点授权：${text.slice(0, 120)}`, session: sid });
+    } else if (isAuthMessage(text) || isDirectiveMessage(text)) {
       recordAuthorization(state, sid, {
         type: inferTypeFromText(text),
         pathPrefix: inferPathPrefixFromText(text),
         source: "user-message"
       });
+      recordedAuth = true;
       audit({ kind: "auth", rule: "12D", name: "用户消息授权", event: "user/message", reason: `记录用户消息授权：${text.slice(0, 120)}`, session: sid });
     }
     const active = activateForUserMessage(state.configs, text);
@@ -231,6 +374,18 @@ function handleSessionEvent(ctx, session, event) {
     if (toolName === "pwsh" || toolName === "bash") {
       const cmd = args?.command || args?.code || "";
       if (isGetDateCommand(cmd)) s.turn.getDateSeen = true;
+      // workdir 校验提示（机制批 M6）：命令含显式相对路径（./ 或 ../）但未声明 workdir → 审计提示（不拦）
+      if (cmd && /(?:^|\s)(?:\.{1,2}[\\/])/.test(cmd) && !args?.workdir) {
+        audit({
+          kind: "workdir-hint",
+          rule: "__workdir-hint",
+          name: "workdir 提示",
+          event: "tool/call",
+          tool: toolName,
+          reason: "命令含相对路径但未显式声明 workdir——易与当前目录错配（机制批 M6），pws 请显式 workdir",
+          session: sid
+        });
+      }
       const bp = backupPathsFromTool(toolName, args);
       if (bp) {
         if (!pendingCall.backupPaths) pendingCall.backupPaths = [];
@@ -283,7 +438,12 @@ function handleSessionEvent(ctx, session, event) {
     if (pendingCall) {
       const key = `${pendingCall.name}:${JSON.stringify(pendingCall.args || {})}`;
       if (isError) {
-        state.retryCounts.set(key, (state.retryCounts.get(key) || 0) + 1);
+        // 规则 1 计数解耦（P1-7，2026-08-24）：引擎 deny 来源的失败不计入“同工具连续失败”
+        if (!((state.deniedKeys || new Set()).has(key))) {
+          state.retryCounts.set(key, (state.retryCounts.get(key) || 0) + 1);
+        } else {
+          state.retryCounts.delete(key);
+        }
       } else {
         state.retryCounts.delete(key);
       }
@@ -297,23 +457,20 @@ function handleSessionEvent(ctx, session, event) {
       }
     }
 
-    // 任务契约：子代理成功执行后扣减预算（仅 armed 生效）
-    if (!isError && pendingCall && state.taskContract?.taskContractEnabled && isArmed(s.contract, state.taskContract)) {
-      const action = classifyAction(pendingCall.name, pendingCall.args);
-      if (action.mutability === "delegate" && action.delegationCount > 0) {
-        s.contract.agentsUsed += action.delegationCount;
-        audit({
-          kind: "task-budget",
-          rule: "__task-contract",
-          name: "子代理预算扣减",
-          event: "tool/result",
-          reason: `已用 ${s.contract.agentsUsed}/${s.contract.agentBudget}`,
-          session: sid,
-          tool: pendingCall.name
-        });
+    // M8 双通道机制（2026-08-24）：dsh-manual-write 落盘成功 → 标记；同轮 engram_store 成功 → 标记
+    if (!isError && pendingCall) {
+      const cmd = pendingCall.args?.command || pendingCall.args?.code || "";
+      if ((pendingCall.name === "pwsh" || pendingCall.name === "bash") && /\bdsh-manual-write\.mjs/.test(cmd)) {
+        s.turn.manualWriteSeen = true;
+      }
+      if (pendingCall.name === "engram_store") {
+        s.turn.engramStoreSeen = true;
       }
     }
 
+    // 任务契约：委托预算扣减已移至 pre-execute 启动即计（批次 5.5；原 tool/result 路径因
+    // subagent 无 pendingCall 从未执行——本块删除防双重扣减）
+
     // 规则 27：装配变更成功后全局 revision +1；审计命令输出通过/失败后更新本会话审计 revision
     if (pendingCall) {
       if (!isError && isAssemblyMutationTool(pendingCall.name, pendingCall.args)) {
@@ -397,6 +554,19 @@ function handleSessionEvent(ctx, session, event) {
       }
     }
 
+    // 交付闸门采集（机制批 M3）：测试/冷加载探针通过输出 → verify-pass 记录（供规则 23④ 声明核对）
+    // 2026-08-25 鲁棒化（实弹观测）：旧条件依赖 pendingCall（tool/call→result 的 callId 匹配），
+    // RC.2 下疑似失配导致采集从未执行——23④ 每次声明都 verify-gap；改为只看输出文本，不依赖
+    // pendingToolCalls 状态（what 降级记录），verify-pass 语义不变（输出即证据）。
+    if (!isError) {
+      const output = extractToolOutput(d);
+      if (/\bALL TESTS PASSED\b|RESULT:\s*PASS/.test(output)) {
+        if (!state.verifyPass) state.verifyPass = [];
+        state.verifyPass.push({ at: Date.now(), sessionId: sid, what: pendingCall?.name || "tool-result" });
+        if (state.verifyPass.length > 100) state.verifyPass.splice(0, state.verifyPass.length - 100);
+      }
+    }
+
     // 命令输出静默错误检测（不阻断，只审计 + 注入提醒）
     if (!isError && pendingCall && (pendingCall.name === "pwsh" || pendingCall.name === "bash")) {
       const output = extractToolOutput(d);
@@ -421,7 +591,11 @@ function handleSessionEvent(ctx, session, event) {
       const result = d.result ?? d.value ?? d;
       if (askResultApproved(result)) {
         const qText = askQuestionText(pending.questions);
-        const pathPrefix = inferPathPrefixFromText(qText);
+        const selectedText = askResultSelectedText(result);
+        // 授权范围只取“问题核心 + 用户实际选择”，不再把全部选项描述纳入；
+        // 避免“仅会话内说明/不跨会话保留”等选项说明把一次小授权放大成全局 12h（2026-08-24 修复）
+        const scopeText = `${askQuestionCoreText(pending.questions)} ${selectedText}`.trim();
+        const pathPrefix = inferPathPrefixFromText(scopeText || qText);
         // ask 问题文本措辞不可靠，授权记录为宽泛类型 any + 路径前缀，避免类型错位
         // 无路径的全局 any 授权缩短 TTL，降低安全边界风险
         const authRecord = {
@@ -429,10 +603,31 @@ function handleSessionEvent(ctx, session, event) {
           pathPrefix,
           source: "ask"
         };
-        const sessionWide = /本会话|剩余|全部|会话内/i.test(qText);
+        const sessionWide = isSessionWideAskText(scopeText) || isSessionWideAskText(selectedText);
         if (sessionWide) authRecord.expiresAt = Date.now() + 12 * 60 * 60 * 1000;
         else if (!pathPrefix) authRecord.expiresAt = Date.now() + 2 * 60 * 1000;
         recordAuthorization(state, sid, authRecord);
+        // 2026-08-25 修复（用户授权）：ask 答复也是用户明确允许——若答复文本含"允许使用 X"模式，
+        // 同步写入 unknown 工具会话白名单（与 user/message 分支同一判定；此前只有用户消息文本可写白名，
+        // ask 弹窗授权后 web_fetch 等仍被 unknown deny 拦——机制缺口，本修复关闭）
+        const whtText = `${qText} ${selectedText}`;
+        for (const hit of whtText.matchAll(/(?:允许|批准|同意)\s*(?:使用|调用|用|启用|放行)\s*([A-Za-z_][A-Za-z0-9_:.-]*)/g)) {
+          const wname = hit[1];
+          if (toolClass(wname, {}) !== "unknown") continue;
+          if (!state.unknownToolApproved) state.unknownToolApproved = new Set();
+          const isNew = !state.unknownToolApproved.has(wname);
+          state.unknownToolApproved.add(wname);
+          audit({
+            kind: "unknown-tool-whitelist",
+            rule: "__unknown-tool",
+            name: "用户批准未归类工具（ask 答复）",
+            event: "tool/result",
+            reason: `ask 答复含"允许使用 ${wname}" → 会话白名${isNew ? "" : "（重复，忽略）"}（来源=ask 选择文本）`,
+            session: sid
+          });
+        }
+        if (!s.turn.scopes) s.turn.scopes = [];
+        s.turn.scopes.push(authRecord);
         audit({
           kind: "auth",
           rule: "12D",
@@ -442,6 +637,11 @@ function handleSessionEvent(ctx, session, event) {
           session: sid
         });
       } else {
+        // 弹窗消减（2026-08-24）：本回合 ask 被拒 → 标记 + 全局记录（5 分钟内再 ask 会被 __ask-throttle 拦）
+        s.turn.askRejected = true;
+        if (!state.askRejections) state.askRejections = [];
+        state.askRejections.push({ sessionId: sid, at: Date.now() });
+        if (state.askRejections.length > 200) state.askRejections.splice(0, state.askRejections.length - 200);
         audit({
           kind: "auth-reject",
           rule: "12D",
@@ -464,6 +664,52 @@ function handleSessionEvent(ctx, session, event) {
   }
   if (event.type === "assistant/message") {
     const text = extractAssistantText(d.message);
+    // 交付声明机器闸门（机制批 M3，规则 23④）：完成类声明 → 核对同会话 30 分钟内 verify-pass 记录，缺失注入纠正
+    if (/完成|已通过|已修复|搞定|验证通过|全部通过|修复完成|落盘完成/.test(text)) {
+      const windowStart = Date.now() - 30 * 60 * 1000;
+      const hasPass = (state.verifyPass || []).some((v) => v.sessionId === sid && v.at > windowStart);
+      if (!hasPass) {
+        audit({
+          kind: "verify-gap",
+          rule: "23",
+          name: "交付声明缺验证闸门记录",
+          event: "assistant/message",
+          reason: "交付/完成类声明缺少同会话近期 verify-pass（ALL TESTS PASSED / check-plugin-load RESULT: PASS）记录",
+          session: sid
+        });
+        maybeInject(ctx, sid, { ruleId: "23", reason: "规则 23④：完成/通过类声明需同会话近期验证记录（测试全绿或冷加载 PASS），缺失已记审计——请先运行验证并附证据再宣布完成" });
+      }
+    }
+    // 需求基线覆盖核查（RB-09，2026-08-24）：方案/重构/整体完成类声明 → 基线仍存在 planned 需求 → 审计纠正（fail-closed）
+    if (BASELINE_COMPLETE_RE.test(text)) {
+      const bl = loadBaselineFile();
+      if (bl.ok) {
+        const gap = computeBaselineGap(text, bl.items);
+        if (gap) {
+          audit({
+            kind: "baseline-gap",
+            rule: "__baseline-gap",
+            name: "需求基线未覆盖",
+            event: "assistant/message",
+            reason: `完成类声明但需求基线仍有 ${gap.count} 条未落地（${gap.pending.join("、")}）——先完成或更新基线再宣布完成`,
+            session: sid
+          });
+          maybeInject(ctx, sid, {
+            ruleId: "__baseline-gap",
+            reason: `需求基线仍有 ${gap.count} 条未落地（${gap.pending.join("、")}），请先完成或更新基线再宣布整体完成`
+          });
+        }
+      } else {
+        audit({
+          kind: "baseline-unreadable",
+          rule: "__baseline-gap",
+          name: "需求基线不可读",
+          event: "assistant/message",
+          reason: `完成类声明但需求基线文件无法读取（${bl.error || "未知"}）——fail-closed，无法核查覆盖`,
+          session: sid
+        });
+      }
+    }
     const violations = detectViolations({ configs: state.configs, session: s, text, reasoningText: s.turn.reasoningText, mountRevision: state.mountRevision });
     for (const v of violations) {
       audit({
@@ -564,6 +810,7 @@ async function executeGuard(ctx, invocation) {
         `  放行剩余：${fmtRemain(remainMs(state.bypassUntil))}（全部守卫暂停）`,
         `  授权存储：内存态（重启失效）`,
         `  审计日志：${auditFilePath()}`,
+        `  LLM 意图判定：${state.llmIntentCfg?.enabled ? `开启（今日 ${[...(state.llmIntentBudget?.values() || [])].reduce((a, b) => a + b, 0)} 次/${pluginConfig.llmIntent?.dailyLimitPerSession ?? 50}，缓存命中 ${state.llmIntentHits || 0}，缓存 ${state.llmIntentCache?.size || 0} 条${state.llmIntentLast ? `；最近：${state.llmIntentLast.text} → ${state.llmIntentLast.source}${state.llmIntentLast.verdict ? `（conf=${state.llmIntentLast.verdict.confidence}）` : "【降级词表】"}` : ""}）` : "关闭"}`,
         `  最近激活：${state.lastActive.length ? state.lastActive.map((a) => a.ruleId).join("、") : "无"}`,
         `  提示：审批策略 never 只关系统审批弹窗，不影响对话内 ask_user_question 授权；规则 12A 仍会硬拦需要授权的操作。`
       ];
@@ -592,6 +839,8 @@ async function executeGuard(ctx, invocation) {
     case "unlock": {
       const minutes = Math.min(Math.max(1, command.minutes), 60);
       state.unlockUntil = Date.now() + minutes * 60000;
+      // 逃生门请求审计（机制批 M1）：用途留痕，供规则 1⑤ 事前说明核对
+      audit({ kind: "guard-command", rule: "__escape-gate", name: "逃生门请求", event: "command", reason: `/guard unlock ${minutes} 分钟（配置写保护）`, session: invocation?.session?.id || "global" });
       return {
         kind: "success",
         text: `已解锁「配置写保护」${minutes} 分钟。现在可以让助手修改 rule-engine.json / rule-understanding.json / AGENTS.md；改完请执行 /guard lock 或等待自动恢复。`
@@ -600,6 +849,8 @@ async function executeGuard(ctx, invocation) {
     case "bypass": {
       const minutes = Math.min(Math.max(1, command.minutes), 60);
       state.bypassUntil = Date.now() + minutes * 60000;
+      // 逃生门请求审计（机制批 M1）
+      audit({ kind: "guard-command", rule: "__escape-gate", name: "逃生门请求", event: "command", reason: `/guard bypass ${minutes} 分钟（全部守卫）`, session: invocation?.session?.id || "global" });
       return {
         kind: "success",
         text: `已临时放行全部守卫 ${minutes} 分钟。到期自动恢复，也可 /guard reload 后立即恢复。`
@@ -611,12 +862,18 @@ async function executeGuard(ctx, invocation) {
       return { kind: "success", text: "守卫已全部恢复：解锁与放行均已取消。" };
     }
     case "revoke": {
-      let count = 0;
-      for (const s of state.sessions.values()) {
-        count += s.authorizations.length;
-        s.authorizations = [];
-      }
-      return { kind: "success", text: `已撤销全部授权记录（共 ${count} 条）。` };
+      // R1.3（2026-08-24）：全清——session.authorizations + turn.scopes + globalAuthorizations + askRejections
+      const count = clearAuthorizations(state);
+      // 可观测性（阶段 0 + 机制 C，2026-08-24）：revoke 事件必须留痕，否则撤销无法复核（B4 实证）
+      audit({
+        kind: "guard-command",
+        rule: "__revoke",
+        name: "撤销全部授权",
+        event: "command",
+        reason: `撤销 ${count} 条授权/范围（session + turn.scopes + global + askRejections 全清）`,
+        session: invocation?.session?.id || "global"
+      });
+      return { kind: "success", text: `已撤销全部授权与范围（共 ${count} 条，含全局池与 ask 拒绝记录；不再有残留）。` };
     }
     case "log": {
       const n = Math.min(Math.max(1, command.n), 200);
@@ -696,6 +953,9 @@ export function apply(ctx) {
     setWorkspaceRoot(process.env.DSH_WORKSPACE || "");
   }
 
+  // 0.0.1 LLM 意图兜底配置（guardDecision 为纯函数，经 state 传入）
+  state.llmIntentCfg = pluginConfig.llmIntent || {};
+
   // 0.1 技能目录实时联动
   refreshSkills(ctx);
   ctx.on("skills/change", () => {
@@ -730,11 +990,59 @@ export function apply(ctx) {
     "dsh-rule-engine watch"
   );
 
+  // 0.3.1 注入延迟投递定时器清理（O1 批次 6）：卸载/热重载时取消全部 pending inject
+  ctx.effect(
+    function* () {
+      yield () => {
+        for (const t of pendingInjectTimers) clearTimeout(t);
+        pendingInjectTimers.clear();
+      };
+    },
+    "dsh-rule-engine inject timers"
+  );
+
   // 1. 单调守卫：工具调用先裁决，命中即物理拒绝
   ctx.effect(
     function* () {
       yield ctx.tools.guard((exec) => {
-        const hit = guardDecision(state, exec, Date.now());
+        // 落盘授权粒度提醒（机制批 M7，2026-08-24）：受保护文件统一入口调用 + 本回合用户消息为方案性指令
+        //（调整/补充/评估/建议且无落盘词）→ approval-gap 审计 + 注入提醒（规则 22 自证③：方案性指令 ≠ 落盘授权）
+        {
+          const cmd = exec?.arguments?.command || exec?.arguments?.code || "";
+          if ((exec?.name === "pwsh" || exec?.name === "bash") && /\bdsh-manual-write\.mjs/.test(cmd)) {
+            const s7 = getSessionState(state, sessionIdOfExec(exec));
+            if (needsApprovalReminder(s7.turn.userText || "")) {
+              audit({
+                kind: "approval-gap",
+                rule: "__approval-gap",
+                name: "落盘授权粒度提醒",
+                event: "tool/guard",
+                tool: exec?.name,
+                args: summarizeArgs(exec?.arguments),
+                reason: "本回合用户消息为方案性指令（调整/补充/评估/建议等），不构成落盘授权（规则 22 自证③）——落盘前应先展示→用户确认",
+                session: sessionIdOfExec(exec)
+              });
+              maybeInject(ctx, sessionIdOfExec(exec), {
+                ruleId: "__approval-gap",
+                reason: "规则 22 自证③：方案性指令不构成落盘授权——受保护文件落盘需先展示改动→用户明确确认→再执行（机制批 M7）"
+              });
+            }
+          }
+        }
+        // 逃生门窗口打标（机制批 M2）：bypass 生效期间一切变更类调用记 bypass-action 审计（用途留痕，供规则 1⑤ 核对）
+        if (state.bypassUntil > Date.now() && !isReadOnlyTool(exec?.name, exec?.arguments)) {
+          audit({
+            kind: "bypass-action",
+            rule: "__escape-gate",
+            name: "逃生门窗口变更",
+            event: "tool/guard",
+            tool: exec?.name,
+            args: summarizeArgs(exec?.arguments),
+            reason: "窗口内变更（逃生门用途：引擎/规则/手册修复，规则 1⑤ 范围核对）",
+            session: sessionIdOfExec(exec)
+          });
+        }
+        const hit = guardDecision(state, exec, Date.now(), { audit });
         if (hit) {
           audit({
             kind: "deny",
@@ -743,9 +1051,25 @@ export function apply(ctx) {
             event: "tool/guard",
             tool: exec?.name,
             args: summarizeArgs(exec?.arguments),
-            reason: hit.reason
+            reason: hit.reason,
+            session: sessionIdOfExec(exec) // P0-4：deny 审计补 session（2026-08-24 事故复盘：归属会话靠猜）
           });
           state.lastActive = [{ ruleId: hit.ruleId, title: hit.title, reason: hit.reason }];
+          // 规则 1 计数解耦（2026-08-24，P1-7）：引擎 deny 不计入“同工具连续失败”
+          const dkey = `${exec?.name}:${JSON.stringify(exec?.arguments || {})}`;
+          if (!state.deniedKeys) state.deniedKeys = new Set();
+          state.deniedKeys.add(dkey);
+          if (state.deniedKeys.size > 500) {
+            const oldest = state.deniedKeys.keys().next().value;
+            if (oldest !== undefined) state.deniedKeys.delete(oldest);
+          }
+          // 弹窗消减（2026-08-24）：E3/ask 节流命中后注入纠正，提示改用普通文本，勿连环弹窗
+          if (hit.ruleId === "__already-authorized" || hit.ruleId === "__ask-rejected" || hit.ruleId === "__ask-throttle") {
+            maybeInject(ctx, sessionIdOfExec(exec), {
+              ruleId: hit.ruleId,
+              reason: `${hit.title}：已有授权或询问被拒时请直接执行、或用普通文本说明，不要再弹窗 ask。`
+            });
+          }
           return hit.reason;
         }
         return undefined;
@@ -775,6 +1099,34 @@ export function apply(ctx) {
     return next();
   });
 
+  // 0.9 机制 B（2026-08-24）：未归类工具（新插件/新工具）首调 deny——fail-closed，防"approval 层自动放行 ask"的洞。
+  // 批次 3（2026-08-24 用户拍板分支 A）：实测未知工具首调 ask 被 DSH approval 层自动放行（无弹窗直接执行），
+  // 因此 unknown → 物理 deny；批准路径 = 用户明确"允许使用 X"（handleSessionEvent 写入会话白名），本会话内放行。
+  ctx.on("tools/pre-execute", async (exec, next) => {
+    try {
+      if (SAFE_UNCOVERED_TOOLS.has(exec?.name)) return next(); // 控制类不进 unknown 判定（避免 ask 自身被 ask）
+      if (toolClass(exec?.name, exec?.arguments || {}) !== "unknown") return next();
+      if ((state.unknownToolApproved || new Set()).has(exec.name)) return next(); // 会话内用户已批准
+      audit({
+        kind: "unknown-tool",
+        rule: "__unknown-tool",
+        name: "未归类工具拦截",
+        event: "tools/pre-execute",
+        tool: exec?.name,
+        args: summarizeArgs(exec?.arguments),
+        reason: `工具 ${exec.name} 不在规则引擎分类表（可能是新装的插件）：已拦截（unknown→deny）。批准路径：用户明确"允许使用 ${exec.name}"后本会话放行；长期规则请补充工具分类表`,
+        session: sessionIdOfExec(exec)
+      });
+      return {
+        kind: "deny",
+        reason: `工具 ${exec.name} 尚未归类（新装插件？）：已拦截。如需使用请向用户说明用途并获取其"允许使用 ${exec.name}"的明确答复后重试（批准后本会话内放行）。`
+      };
+    } catch (error) {
+      ctx.logger?.warn?.("[dsh-rule-engine] unknown-tool deny error", error);
+      return next();
+    }
+  });
+
   // 1.1 任务契约 ask 通道：仅在总开关 + askEnabled 时对“应询问”动作返回 ask
   ctx.on("tools/pre-execute", async (exec, next) => {
     try {
@@ -784,6 +1136,19 @@ export function apply(ctx) {
       if (!isArmed(s.contract, state.taskContract)) return next();
       const action = classifyAction(exec?.name, exec?.arguments);
       const dec = decideContractAction({ contract: s.contract, action, config: state.taskContract });
+      // 批次 5.5（2026-08-24）：委托启动即计预算——原 tool/result 扣减因 subagent 无 pendingCall 从未执行（agents 恒 0）
+      if (dec.outcome === "allow" && action.mutability === "delegate" && action.delegationCount > 0) {
+        s.contract = consumeDelegateBudget(s.contract, action.delegationCount);
+        audit({
+          kind: "task-budget",
+          rule: "__task-contract",
+          name: "子代理预算扣减",
+          event: "tools/pre-execute",
+          tool: exec?.name,
+          reason: `已用 ${s.contract.agentsUsed}/${s.contract.agentBudget}`,
+          session: sid
+        });
+      }
       if (dec.outcome === "ask") {
         audit({
           kind: "task-ask",
@@ -797,6 +1162,24 @@ export function apply(ctx) {
         });
         return { kind: "ask", reason: `${dec.reason}（任务契约｜${dec.nextStep || "请确认或使用放行词"}）` };
       }
+      // 可观测性（阶段 0，2026-08-24）：armed 下 deny/allow 裁决也留痕，CI 澄清"契约 deny 有无真实拦截路径"
+      if (dec.outcome === "deny" || dec.outcome === "allow") {
+        audit({
+          kind: "contract-decision",
+          rule: "__task-contract",
+          name: "任务契约裁决",
+          event: "tools/pre-execute",
+          tool: exec?.name,
+          args: summarizeArgs(exec?.arguments),
+          reason: `裁决 ${dec.outcome}｜${dec.reasonCode}｜${dec.reason}`,
+          session: sid
+        });
+      }
+      // 批次 4（2026-08-24）：契约 deny 真实物理拦截（原仅审计 + next()——armed 下出界写/
+      // 无界委托/预算超/模式禁止变更均无实际效力）
+      if (dec.outcome === "deny") {
+        return { kind: "deny", reason: `${dec.reason}（任务契约｜${dec.nextStep || "请调整契约或停止该操作"}）` };
+      }
       return next();
     } catch (error) {
       ctx.logger?.warn?.("[dsh-rule-engine] tools/pre-execute error", error);