dsh-subagent-profile 0.3.2 → 0.3.3

package/README.md

@@ -4,9 +4,8 @@
 <div align="center">
   <b style="font-size: 1.15em;">Subagent dispatch, profiled — the right agent for the right task (preset / model / reasoning effort)</b><br /><br />
   <img alt="License: MIT" src="https://img.shields.io/badge/License-MIT-yellow.svg" />
-  <img alt="Version: v0.3.2" src="https://img.shields.io/badge/Version-v0.3.2-blue.svg" />
   <img alt="npm" src="https://img.shields.io/npm/v/dsh-subagent-profile.svg" />
-  <img alt="DSH" src="https://img.shields.io/badge/DSH-0.1.0--rc.6%20~%200.1.1--rc.2-blue.svg" />
+  <img alt="DSH" src="https://img.shields.io/badge/DSH-0.1.0--rc.6%20~%200.2.0-blue.svg" />
 </div>
 
 <div align="center">English · <a href="README.zh.md">中文</a></div>
@@ -15,7 +14,7 @@ For [DeepSeek Harness](https://github.com/deepseek-ai/dsh) (DSH).
 
 > *Thinking, Fast and Slow*: System 1 is fast and cheap, System 2 is slow and careful. The built-in `subagent` gives every subtask the same brain as its parent — no way to tell them apart. `dsh-subagent-profile` lets you pick per subtask: research with a fast brain, deep work with a careful one, saved as named **profiles**.
 
-## Why the built-in `subagent` isn't enough
+## Why this plugin
 
 | | Built-in `subagent` | `dsh-subagent-profile` |
 |---|---|---|
@@ -25,13 +24,11 @@ For [DeepSeek Harness](https://github.com/deepseek-ai/dsh) (DSH).
 | Cost guardrails | ❌ | ✅ model / effort / tokens / depth capped |
 | GUI management | ❌ | ✅ settings page |
 
-## What it solves
-
 - **Per-subtask control over the child's brain.** `dispatch` sets, per subtask: which preset (composition), which model, which reasoning effort, which tools, and the token cap. A research subtask and a coding subtask can run with completely different setups — something the plain `subagent` tool can't do (it only inherits the parent).
 - **Named, reusable profiles.** A profile is one bundle of preset + model + reasoning effort + tool scope + persona. Save "research" as `researcher` (reasoning off, search-only tools) and dispatch with `dispatch(profile="researcher")`; two built-ins ship (`swap-standard` = full standard coding toolkit, `researcher`), and you can add/edit/remove your own in the settings page.
 - **Fully observable.** Every result reports the effective profile / preset / model / reasoning effort; logs are tagged `[dsh-subagent-profile]`.
 
-## Quick start
+## Installation
 
 ```bash
 dsh plugin --profile web add dsh-subagent-profile        # published package
@@ -44,7 +41,14 @@ Restart `dsh web`. This is a standard **bundle plugin**: it provides the `dispat
 
 ### 1. Configure sub-agent profiles
 
-Profiles are managed in the settings page — each one bundles preset + model + reasoning effort + tool scope (and optionally a persona), and can be enabled, disabled, edited, or reset individually.
+Profiles are managed in the settings page — each one bundles preset + model + reasoning effort + tool scope (and optionally a persona), and can be enabled, disabled, edited, or reset individually. Two built-ins ship:
+
+| Profile | Purpose |
+|---|---|
+| `swap-standard` | switch the child to the full standard coding toolkit |
+| `researcher` | deep reasoning off, search-only tools |
+
+Profiles live in `~/.dsh/subagent-profiles.json` and take effect immediately (edits are made from the settings page).
 
 ![Built-in profile list — editable, deletable, individually toggleable](docs/screenshots/settings-page1.png)
 
@@ -62,15 +66,6 @@ dispatch(
 
 ![dispatch tool-call card — every result shows what actually ran](docs/screenshots/dispatch-card.png)
 
-## Profiles
-
-Profiles live in `~/.dsh/subagent-profiles.json` and take effect immediately (edits are made from the settings page).
-
-| Profile | Purpose |
-|---|---|
-| `swap-standard` | switch the child to the full standard coding toolkit |
-| `researcher` | deep reasoning off, search-only tools |
-
 ## Safety model
 
 Delegation never lets a subagent gain more power than you already have — this is the default, with no configuration:
@@ -83,13 +78,14 @@ Delegation never lets a subagent gain more power than you already have — this
 
 - `~/.dsh/subagent-profiles.json` — the profile registry (edited from the settings page).
 - `~/.dsh/subagent-profiles.state.json` — the plugin's enable/disable switch (default enabled).
+- `~/.dsh/subagent-profiles.failed-traces.json` — the failure ledger (dispatch failure traces).
 - `~/.dsh/.agent-presets/orchestrator/` — the self-installed `orchestrator` agent preset (synced from the bundled `presets/orchestrator/` on every startup).
 
-`DSH_HOME` is respected and defaults to `~/.dsh`.
+`DSH_HOME` is respected and defaults to `~/.dsh`. Uninstalling the plugin removes the three data files above and the self-installed `orchestrator` preset directory (other plugins' presets are left untouched); re-installing or re-launching re-syncs the preset and regenerates the data files.
 
 ## Known limitations
 
-- **Background** one-shot dispatch requires `@deepseek-ai/dsh-jobs` and `@deepseek-ai/dsh-tool-jobs` to be loaded; otherwise it fails with "background jobs unavailable".
+- **Background** one-shot dispatch requires `@deepseek-ai/dsh-jobs` and `@deepseek-ai/dsh-tool-jobs` to be loaded; otherwise it fails with "dispatch: 后台派发不可用：缺少 jobs 服务".
 - **Continuable** mode goes through the DSH standard composition path, so the `preset` swap and `reasoningEffort` are ignored (the child inherits the parent preset at the default reasoning effort).
 - **Continuable** tool gate is a plugin-side mitigation: the child's `allow` is pre-computed as a closed set — parent tool set − `run_code` − `deny`, then intersected with `allow`. **Assumption:** continuable inherits the parent preset, so the child's tool set ≈ the parent's. **Failure condition:** any host behavior change that makes the child's tool set differ from the parent's (not only preset swap — e.g. a future preset swap, composing a different tool set) means the parent set can contain tools the child does not have, so `tools.restrict` throws "unknown tool" and this mitigation automatically degrades to fail-loud (conservatively safe); it must then be replaced with a true parent ∩ child intersection once the upstream provides a provider guard seam.
 
@@ -103,22 +99,40 @@ dsh-subagent-profile/
 │   └── core/                     # host-side modules (lightweight layering)
 │       ├── pure.mjs              # dependency-free pure functions (sanitize / prune / guard math — unit-tested)
 │       ├── shims.mjs             # the single @deepseek-ai import facade (guards fail loud, helpers degrade softly)
-│       └── *.mjs                 # catalog / whitelist / intersection / cost-guard / delegation / profiles-store /
-│                                 #   presets-sync / http-routes / profile-provider / dispatch-tool
+│       ├── catalog.mjs           # tool-name → zh / category tables (zero-dep)
+│       ├── catalog-cache.mjs     # process-shared catalog snapshot (models / presets / tools, TTL cache)
+│       ├── cost-guard.mjs        # runtime capability checks (provider / model / reasoning effort)
+│       ├── decision-trace.mjs    # decision trace (gates / effective / settled) + failure ledger
+│       ├── delegation.mjs        # background one-shot settling + child usage collection
+│       ├── dispatch-gates.mjs    # pre-dispatch gates (whitelist / cost / intersection / budget)
+│       ├── dispatch-guard.mjs    # concurrency + per-parent token budget guard
+│       ├── dispatch-schema.mjs   # dispatch tool input/output schema declarations
+│       ├── dispatch-tool.mjs     # dispatch tool factory (defineTool + execute + syncTool)
+│       ├── escape.mjs            # escape-hatch allow store
+│       ├── evolution-ledger.mjs  # dispatch ledger (jsonl) + governance audit
+│       ├── evolution-summary.mjs # T1 aggregate summaries + advice text
+│       ├── http-routes.mjs       # settings loopback HTTP routes
+│       ├── intersection.mjs      # tool-intersection pure core
+│       ├── presets-sync.mjs      # bundled preset self-install (hash-gated sync)
+│       ├── profile-provider.mjs  # the `profile` subagent provider
+│       ├── profiles-store.mjs    # profile registry store + switch persistence
+│       └── whitelist.mjs         # system-trust preset whitelist
 ├── presets/orchestrator/         # bundled "orchestrator" agent preset (self-installed, synced on every startup)
 ├── cordis.patch.yml              # bundle patch: inserts the plugin row into the host composition
 ├── .gitea/workflows/ci.yml       # bare-CI (Gitea Actions; needs an Act runner on the server)
 ├── package.json                  # metadata, files whitelist, exports (test / test:bare / preflight scripts)
 ├── scripts/
-│   ├── release.mjs               # release helper (version bump / tag checks)
-│   └── preflight.mjs             # preflight: preset-tree reconciliation + README badge == version (zero-dep)
+│   ├── preflight.mjs             # preflight: preset-tree reconciliation + no hardcoded version badge (zero-dep)
+│   └── leak-scan.mjs             # public-release gate: scans all history + worktree for sensitive patterns
 ├── docs/
 │   └── screenshots/              # README screenshots
-├── test/                         # host-side tests (node:test, zero extra deps; 101 cases = 26 bare + 75 junction)
+├── test/                         # host-side tests (node:test, zero extra deps; 352 cases — bare subset in CI, junction local)
 │   ├── README.md / README.zh.md  # test directory guide (EN/ZH) — two-tier split explained
 │   ├── harness/ctx.mjs           # fake Cordis ctx + ~/.dsh isolation
 │   ├── pure / input-schema / catalog-integrity.test.mjs   # bare tier (import-free, runs in bare CI)
-│   └── characterization / facade / gating / persist / recycle / cost-guard / continuable-guard.test.mjs  # junction tier (local only)
+│   └── *.test.mjs                # junction tier (local only): characterization / facade / gating / persist / recycle /
+│                                 #   cost-guard / continuable-guard / decision-trace / dispatch-guard / escape-hatch /
+│                                 #   evolution-* / csrf / label-preset-sync / percall-spec / trust-label / audit-meta / …
 ├── README.md / README.zh.md      # this document (EN/ZH)
 └── LICENSE
 ```
@@ -127,11 +141,6 @@ dsh-subagent-profile/
 
 Found a bug or have an idea? [Open an issue](https://github.com/muzyLink/dsh-subagent-profile/issues) or submit a pull request — all contributions are welcome.
 
-### CI (bare) & preflight
-
-- **Gitea Actions** (`.gitea/workflows/ci.yml`): on `push` / `pull_request` to `v2-midterm` / `main`, runs the **bare-CI** subset — the tests that never load `@deepseek-ai` (`npm run test:bare`: pure / input-schema / catalog-integrity), `node --check` syntax checks, eslint (installed in isolation, since the bare environment cannot install the `@deepseek-ai` devDependencies), and `npm run preflight`. **Enabling Gitea Actions requires installing an Act runner on the server** (register it with the `ubuntu-latest` label); the workflow takes effect automatically once the runner is ready. Junction-dependent tests (characterization / facade / gating / persist / recycle / cost-guard / continuable-guard) run locally only — see `test/README.md` for the two-tier split and its rationale.
-- **Preflight** (`npm run preflight`): zero-dependency self-check — ① reconciles the bundled `presets/` tree against a fresh `$DSH_HOME/.agent-presets` derived tree (byte-identical set, both directions; never touches the real `~/.dsh`), ② asserts the README version badge (`v<version>` in the hero) matches `package.json` `version`. Non-zero exit means drift — fix and re-run before release.
-
 If this plugin has been useful to you, please give it a ⭐ on GitHub — it helps others find it.
 
 ## Credits

package/README.zh.md

@@ -4,9 +4,8 @@
 <div align="center">
   <b style="font-size: 1.15em;">子 Agent 派发方案化插件 —— 用对的人（预设 / 模型 / 推理强度）干对的事</b><br /><br />
   <img alt="License: MIT" src="https://img.shields.io/badge/License-MIT-yellow.svg" />
-  <img alt="Version: v0.3.2" src="https://img.shields.io/badge/Version-v0.3.2-blue.svg" />
   <img alt="npm" src="https://img.shields.io/npm/v/dsh-subagent-profile.svg" />
-  <img alt="DSH" src="https://img.shields.io/badge/DSH-0.1.0--rc.6%20~%200.1.1--rc.2-blue.svg" />
+  <img alt="DSH" src="https://img.shields.io/badge/DSH-0.1.0--rc.6%20~%200.2.0-blue.svg" />
 </div>
 
 <div align="center"><a href="README.md">English</a> · 中文</div>
@@ -15,7 +14,7 @@
 
 > 《思考，快与慢》：系统 1 快而省，系统 2 慢而稳。内置的 `subagent` 给所有子任务同一个「大脑」，分不出快慢；`dsh-subagent-profile` 让你按任务指定——调研用快思考，攻坚用慢思考，常用搭配存成命名**方案**。
 
-## 为什么内置 `subagent` 不够用
+## 为什么选这个插件
 
 | | 内置 `subagent` | `dsh-subagent-profile` |
 |---|---|---|
@@ -25,13 +24,11 @@
 | 成本护栏 | ❌ | ✅ 模型/推理强度/token/深度上限 |
 | GUI 管理 | ❌ | ✅ 设置页 |
 
-## 解决什么问题
-
 - **按子任务指定子 Agent 的「大脑」。** `dispatch` 给每个子任务单独指定：用哪个预设（composition）、哪个模型、哪种推理强度、只开哪些工具、给多少 token 上限。查资料和写代码两个子任务可以用完全不同的配置——这是内置 `subagent` 做不到的（它只能让子任务继承父 Agent 的同一套配置）。
 - **把常用搭配存成命名方案，按名调用。** 「方案」= 预设 + 模型 + 推理强度 + 工具范围 + 人设的一揽子配置。把「调研」存成 `researcher`（关深度推理、只留检索工具），以后 `dispatch(profile="researcher")` 即可；内置 `swap-standard`（切到 standard 全套编码工具）和 `researcher` 两个现成方案，也能在设置页自己增删改。
 - **每次派发都看得见实际用了什么。** 结果里标注实际生效的方案/预设/模型/推理强度，日志带 `[dsh-subagent-profile]` 标记，方便排查。
 
-## 快速开始
+## 安装
 
 ```bash
 dsh plugin --profile web add dsh-subagent-profile        # 发布包
@@ -44,7 +41,14 @@ dsh plugin --profile web add ./dsh-subagent-profile      # 本地检出
 
 ### 1. 配置子 Agent 方案
 
-在设置页管理命名方案——每个方案打包预设 + 模型 + 推理强度 + 工具范围（可选人设），可单独启用、禁用、编辑或批量重置。
+在设置页管理命名方案——每个方案打包预设 + 模型 + 推理强度 + 工具范围（可选人设），可单独启用、禁用、编辑或批量重置。内置两个现成方案：
+
+| 方案 | 用途 |
+|---|---|
+| `swap-standard` | 子 Agent 切换为 standard 全套编码工具 |
+| `researcher` | 关深度推理、只留检索工具 |
+
+方案保存在 `~/.dsh/subagent-profiles.json`，改完立即生效（在设置页编辑）。
 
 ![内置方案列表：可编辑、删除、单独启用/禁用](docs/screenshots/settings-page1.png)
 
@@ -62,15 +66,6 @@ dispatch(
 
 ![dispatch 工具调用卡片：每次派发都显示实际生效的配置](docs/screenshots/dispatch-card.png)
 
-## 方案（Profiles）
-
-方案保存在 `~/.dsh/subagent-profiles.json`，改完立即生效（在设置页编辑）。
-
-| 方案 | 用途 |
-|---|---|
-| `swap-standard` | 子 Agent 切换为 standard 全套编码工具 |
-| `researcher` | 关深度推理、只留检索工具 |
-
 ## 安全模型
 
 委派绝不会让子 Agent 拿到比你更多的权限，默认生效、无需配置：
@@ -83,13 +78,14 @@ dispatch(
 
 - `~/.dsh/subagent-profiles.json` —— 方案注册表（由设置页编辑）。
 - `~/.dsh/subagent-profiles.state.json` —— 插件的启用/禁用开关（默认启用）。
+- `~/.dsh/subagent-profiles.failed-traces.json` —— 失败台账（派发失败轨迹）。
 - `~/.dsh/.agent-presets/orchestrator/` —— 自动安装的 `orchestrator` 编排者预设（每次启动由打包的 `presets/orchestrator/` 同步）。
 
-尊重 `DSH_HOME`，默认 `~/.dsh`。
+尊重 `DSH_HOME`，默认 `~/.dsh`。卸载插件会删除上述三个数据文件与自动安装的 `orchestrator` 预设目录（其它插件的预设不受影响）；重新安装或重新启动会重新同步预设并重新生成数据文件。
 
 ## 已知限制
 
-- **后台**一次性派发需要加载 `@deepseek-ai/dsh-jobs` 与 `@deepseek-ai/dsh-tool-jobs`，否则报「background jobs unavailable」。
+- **后台**一次性派发需要加载 `@deepseek-ai/dsh-jobs` 与 `@deepseek-ai/dsh-tool-jobs`，否则报「后台派发不可用：缺少 jobs 服务」。
 - **可续跑**模式走 DSH 标准组合路径，因此 `preset` 换用与 `reasoningEffort` 会被忽略（继承父预设、使用默认推理强度）。
 - **可续跑**工具门为插件侧缓解：子 Agent 的 `allow` 预加工为闭集 —— 父工具集 − `run_code` − `deny`，再与 `allow` 取交集。**假设：** 可续跑继承父预设 ⇒ 子工具集 ≈ 父工具集。**失效条件：** 任何导致子工具集与父工具集不一致的宿主行为变化（非仅换用预设——例如未来允许换用预设、组合不同工具集等），父集都可能含子集没有的工具，`tools.restrict` 会抛「未知工具」→ 本缓解自动降级为 fail-loud（保守安全）；待上游提供 provider 守卫接缝后替换为真交集。
 
@@ -103,22 +99,40 @@ dsh-subagent-profile/
 │   └── core/                     # 宿主侧模块（轻量分层）
 │       ├── pure.mjs              # 无依赖纯函数（净化 / 剪枝 / 护栏计算——可单测）
 │       ├── shims.mjs             # @deepseek-ai 依赖唯一入口（facade：守卫型 fail-loud、功能映射型软降级）
-│       └── *.mjs                 # catalog / whitelist / intersection / cost-guard / delegation / profiles-store /
-│                                 #   presets-sync / http-routes / profile-provider / dispatch-tool
+│       ├── catalog.mjs           # 工具名 → 中文/分类数据表（零依赖）
+│       ├── catalog-cache.mjs     # 进程级共享 catalog 快照（模型/预设/工具，TTL 缓存）
+│       ├── cost-guard.mjs        # 运行时能力校验（provider / model / reasoningEffort）
+│       ├── decision-trace.mjs    # 决策轨迹（gates/effective/settled）+ 失败台账
+│       ├── delegation.mjs        # 后台 one-shot 结算 + 子会话 usage 收集
+│       ├── dispatch-gates.mjs    # 派发预检闸（白名单/成本/交集/预算）
+│       ├── dispatch-guard.mjs    # 并发 + 每父累计 token 预算守卫
+│       ├── dispatch-schema.mjs   # dispatch 工具输入/输出 schema 声明
+│       ├── dispatch-tool.mjs     # dispatch 工具工厂（defineTool + execute + syncTool）
+│       ├── escape.mjs            # 逃生舱放行集 store
+│       ├── evolution-ledger.mjs  # 派发台账（jsonl）+ 治理审计
+│       ├── evolution-summary.mjs # T1 聚合 summaries + 建议文案
+│       ├── http-routes.mjs       # 设置页 loopback HTTP 路由
+│       ├── intersection.mjs      # 工具交集纯函数核心
+│       ├── presets-sync.mjs      # bundled 预设自安装（哈希门控同步）
+│       ├── profile-provider.mjs  # `profile` 子 Agent provider
+│       ├── profiles-store.mjs    # profile 注册表 store + 开关持久化
+│       └── whitelist.mjs         # system-trust 预设白名单
 ├── presets/orchestrator/         # 内置「编排者模式」agent 预设（自安装，每次启动同步）
 ├── cordis.patch.yml              # bundle 补丁：把插件行插入宿主组成
 ├── .gitea/workflows/ci.yml       # bare-CI（Gitea Actions；需服务器装 Act runner）
 ├── package.json                  # 元数据、files 发布白名单、exports（test / test:bare / preflight scripts）
 ├── scripts/
-│   ├── release.mjs               # 发布脚本（版本 bump / tag 校验）
-│   └── preflight.mjs             # preflight：preset 树对账 + README 徽章 == version（零依赖）
+│   ├── preflight.mjs             # preflight：preset 树对账 + 无硬编码版本徽章（零依赖）
+│   └── leak-scan.mjs             # 公开发布门禁：全历史 + 工作区敏感模式扫描
 ├── docs/
 │   └── screenshots/              # README 截图
-├── test/                         # 宿主侧自动化测试（node:test，零新增依赖；101 用例 = 26 bare + 75 junction）
+├── test/                         # 宿主侧自动化测试（node:test，零新增依赖；352 用例——bare 子集 CI 跑、junction 档本机跑）
 │   ├── README.md / README.zh.md  # 测试目录说明（中英双语）——两档测试划分
 │   ├── harness/ctx.mjs           # 假宿主环境（fake ctx + ~/.dsh 隔离）
 │   ├── pure / input-schema / catalog-integrity.test.mjs   # bare 档（import-free，bare CI 可跑）
-│   └── characterization / facade / gating / persist / recycle / cost-guard / continuable-guard.test.mjs  # junction 档（仅本机）
+│   └── *.test.mjs                # junction 档（仅本机）：characterization / facade / gating / persist / recycle /
+│                                 #   cost-guard / continuable-guard / decision-trace / dispatch-guard / escape-hatch /
+│                                 #   evolution-* / csrf / label-preset-sync / percall-spec / trust-label / audit-meta / …
 ├── README.md / README.zh.md      # 本文档（中英双语）
 └── LICENSE
 ```
@@ -127,11 +141,6 @@ dsh-subagent-profile/
 
 发现 Bug 或有新想法?欢迎[提 Issue](https://github.com/muzyLink/dsh-subagent-profile/issues)或提交 Pull Request,任何形式的贡献都欢迎。
 
-### CI（bare）与 preflight
-
-- **Gitea Actions**（`.gitea/workflows/ci.yml`）：`push` / `pull_request` 到 `v2-midterm` / `main` 时运行 **bare-CI** 子集——从不加载 `@deepseek-ai` 的测试（`npm run test:bare`：pure / input-schema / catalog-integrity）、`node --check` 全仓库语法检查、eslint 行门（eslint 在仓库外隔离安装，因裸环境装不到 `@deepseek-ai` devDependencies）、以及 `npm run preflight`。**启用 Gitea Actions 需服务器装 Act runner**（注册时带上 `ubuntu-latest` 标签），runner 就绪后本工作流自动生效。依赖 junction 的测试（characterization / facade / gating / persist / recycle / cost-guard / continuable-guard）仅本机跑——两档测试的划分与理由见 `test/README.zh.md`。
-- **Preflight**（`npm run preflight`）：零依赖自检——① `presets/` 与全新 `$DSH_HOME/.agent-presets` 派生树做 byte 一致集合对账（双向；绝不写真实 `~/.dsh`）；② 断言 README 版本徽章（Hero 区 `v<version>`）与 `package.json` 的 `version` 一致。非零退出即漂移，发布前修复后重跑。
-
 如果这个插件帮到了你,欢迎在 GitHub 上点个 ⭐,让更多人看到它。
 
 ## 致谢

package/index.mjs

@@ -2,51 +2,114 @@
 // 源自原型动态插件 `code.host` 主体；宿主导入面（registerTool/defineTool/
 // handle）收敛在 lib/core/shims.mjs，装配块按模块拆分驻留 lib/core/（catalog /
 // presets-sync / profiles-store / cost-guard / whitelist / intersection /
-// delegation / pure / shims / http-routes / profile-provider / dispatch-tool）。
+// delegation / pure / shims / http-routes / profile-provider / dispatch-tool /
+// dispatch-guard）。
 // apply 的装配辅助函数（syncBundledPresetsToHome / provideProfileService /
 // registerSystemPromptSections / registerSettingsRoutes）保持 section 文本与
 // 门控逐字不变；`enabled` 始终经 getter 注入，门控读取当前值。
 
+import { readdirSync, renameSync, rmSync } from 'node:fs';
+import { createRequire } from 'node:module';
 import { join } from 'node:path';
 import { syncBundledPresets } from './lib/core/presets-sync.mjs';
 import { dshHome, createProfileStore } from './lib/core/profiles-store.mjs';
 import { createHttpRoutes } from './lib/core/http-routes.mjs';
 import { createProfileProvider } from './lib/core/profile-provider.mjs';
 import { createDispatchTool } from './lib/core/dispatch-tool.mjs';
+import { createDispatchGuard } from './lib/core/dispatch-guard.mjs';
 import { createCatalogCache } from './lib/core/catalog-cache.mjs';
+import { createFailureLedger } from './lib/core/decision-trace.mjs';
+import { createEvolutionLedger } from './lib/core/evolution-ledger.mjs';
+import { createEscapeStore, recordEscapeAllowProvider } from './lib/core/escape.mjs';
 import { tierSortKey } from './lib/core/pure.mjs';
+import { resolveWhitelist, FALLBACK_WHITELIST } from './lib/core/whitelist.mjs';
+import { buildAdviceText, refreshSummaries } from './lib/core/evolution-summary.mjs';
 
 export const name = 'dsh-subagent-profile';
 export const inject = ['subagents', 'tools', 'agents'];
 
-// Self-install the bundled "orchestrator" agent preset into the DSH
-// agent-presets root so the mode appears in the new-session picker without
-// manual copying (mirrors the shipped dsh-liangshen self-install). Idempotent:
-// byte-identical trees are skipped; a bundle change rewrites the preset — the
-// intended upgrade path. Fail-soft: the dispatch tool and settings page keep
-// working even if the write is denied.
+// 自装 bundled 的 "orchestrator" agent 预设到 DSH agent-presets 根，让该模式
+// 无需手动复制就出现在新建会话选择器里（与官方 dsh-liangshen 自安装相同）。
+// 幂等：字节一致的树跳过；bundle 变更重写预设——即预期的升级路径。fail-soft：
+// 写入被拒时 dispatch 工具与设置页照常工作。
 function syncBundledPresetsToHome(ctx) {
   try {
     const presetRoot = join(dshHome(), '.agent-presets');
     const sync = syncBundledPresets(presetRoot);
     for (const { id, error } of sync.failed) ctx.logger.warn(`[dsh-subagent-profile] preset ${id} sync failed: ${error}`);
     if (sync.synced.length > 0) ctx.logger.info(`[dsh-subagent-profile] presets synced into ${presetRoot}: ${sync.synced.join(', ')}`);
+    if (sync.userModified.length > 0) ctx.logger.warn(`[dsh-subagent-profile] presets left untouched (user-modified): ${sync.userModified.join(', ')}`);
   } catch (error) {
     ctx.logger.warn('[dsh-subagent-profile] preset sync failed:', error instanceof Error ? error.message : String(error));
   }
 }
 
-// subagent-profiles service over the store's per-apply profiles Map —
-// lets the outside world enumerate and extend the registry without touching
-// internals.
+// 卸载清理：把本插件持久化的 3 个数据文件 + 自装的 orchestrator 预设目录改名备份
+// （只动本插件拥有的 orchestrator 目录，不碰 .agent-presets 下其它插件/用户的目录）。
+// 改为「改名到 <name>.removed-<ts>」而非 rmSync 删除：ctx.effect 的清理器在禁用/热
+// 重载/进程退出时都可能触发，硬删除会静默丢失用户 profiles/state/失败台账（S1）。
+// 备份保留可恢复副本；规范路径被清空，重装/重启后经 syncBundledPresetsToHome 重新
+// 同步预设、数据文件按需重新生成。fail-soft：改名失败不抛（卸载不应因清理失败而阻断）。
+function removeOwnedData(home) {
+  const stamp = Date.now();
+  for (const file of ['subagent-profiles.json', 'subagent-profiles.state.json', 'subagent-profiles.failed-traces.json']) {
+    try { renameSync(join(home, file), join(home, `${file}.removed-${stamp}`)); } catch { /* 源不存在（正常首启）等：best effort */ }
+  }
+  try { renameSync(join(home, '.agent-presets', 'orchestrator'), join(home, '.agent-presets', `orchestrator.removed-${stamp}`)); } catch { /* best effort */ }
+}
+
+// 启动清理 S1 改名备份残留：.removed-<ts> 备份在下次正常启动后已无保留价值（数据
+// 文件按需重新生成），启动时清掉防积累（热重载/禁用反复触发 effect 会持续产生新
+// 备份）。只清本插件前缀（subagent-profiles.* 与 orchestrator.removed-*），不碰其它
+// 文件；卸载后用户手动改回原名的场景不受影响（改回后无 .removed 残留）。fail-soft。
+function cleanRemovedBackups(home) {
+  for (const dir of [home, join(home, '.agent-presets')]) {
+    let names;
+    try { names = readdirSync(dir); } catch { continue; }
+    for (const name of names) {
+      try {
+        if (name.startsWith('subagent-profiles.') && name.includes('.removed-')) {
+          rmSync(join(dir, name), { force: true });
+        } else if (name.startsWith('orchestrator.removed-')) {
+          rmSync(join(dir, name), { recursive: true, force: true });
+        }
+      } catch { /* best effort */ }
+    }
+  }
+}
+
+// 卸载接线：注销 dispatch 工具（若仍注册）+ 清空失败台账 + 级联取消在途派发 +
+// 清空守卫记账 + 删本插件数据文件与自装预设目录。另挂钩宿主 agent/disposed
+// （Agent 注册 fiber 卸载时发射）：父会话逻辑结束时按父释放并发/token 记账，
+// 防配额随会话累积驻留。
+function registerTeardown(ctx, dispatch, ledger, guard, home) {
+  ctx.effect(() => dispatch.dispose);
+  ctx.effect(() => ledger.clear);
+  ctx.effect(() => () => {
+    guard.cancelAll();
+    guard.reset();
+    removeOwnedData(home);
+  });
+  const onAgentDisposed = ({ agent }) => {
+    const parentSessionId = agent?.session?.header?.id;
+    if (parentSessionId !== undefined && parentSessionId !== null && parentSessionId !== '') {
+      guard.resetParent(parentSessionId);
+    }
+  };
+  ctx.on('agent/disposed', onAgentDisposed);
+  ctx.effect(() => () => ctx.off('agent/disposed', onAgentDisposed));
+}
+
+// subagent-profiles service：包在 store 的 per-apply profiles Map 之上，对外只暴露
+// 枚举/扩展注册表的窄接口，不触碰内部结构。
 function provideProfileService(ctx, store) {
   ctx.provide('subagent-profiles', {
     register(profile) {
       if (!profile || typeof profile.id !== 'string' || profile.id.length === 0) {
-        throw new Error('subagent-profiles: profile id must be a non-empty string');
+        throw new Error('subagent-profiles: profile id 必须为非空字符串');
       }
       if (store.profiles.has(profile.id)) {
-        throw new Error(`subagent-profiles: profile "${profile.id}" is already registered`);
+        throw new Error(`subagent-profiles: profile "${profile.id}" 已注册（id 需唯一）`);
       }
       const registered = { ...profile };
       store.profiles.set(profile.id, registered);
@@ -113,11 +176,21 @@ function profileSectionText(store, gate, context) {
 // orchestrator:mode section 文本（逐字保留；与 profiles 同门控）。
 const ORCHESTRATOR_MODE_TEXT = '本机已安装 dsh-subagent-profile 插件的「编排者模式」agent preset：新建会话的预设选择器中可选「编排者模式」。该模式把 Agent 定位为主协调者——拆解任务后按场景用 dispatch（内置 swap-standard=标准编码、researcher=调研检索，可在「子 Agent 方案」设置页自定义）与 subagent/subagent_fork/workflow 委派给子 Agent，再整合结果。preset 文件由插件维护于 ~/.dsh/.agent-presets，安装/升级时自动同步；用户提到「编排者模式 / orchestrator / 主协调模式」时即指本预设，请据此协作。';
 
-// Directory section rendering the available profiles (systemPrompt's
-// section `text` accepts a function, as the shipped tool-subagent proves).
-// gate: `enabled` must be read live (getter), so /set-enabled toggles
-// apply immediately without a restart.
-function registerSystemPromptSections(ctx, store, getEnabled) {
+// 建议注入候选池：system-trust 白名单（agentPresets 可选；解析失败回退内置
+// 回退名单——fail-loud 检查在建议生成路径进行，不在此处）。刻意不叠加逃生舱放行
+// 集：只读建议不享受逃生舱（逃生舱仅放行「其余三道闸全过」的显式派发，不扩建议池）。
+async function resolveAdviceWhitelist(ctx) {
+  try {
+    return new Set(await resolveWhitelist(ctx.get('agentPresets')));
+  } catch {
+    return new Set(FALLBACK_WHITELIST);
+  }
+}
+
+// 目录 section：渲染可用方案（systemPrompt 的 section text 接受函数，官方
+// tool-subagent 即此用法）。门控注意：`enabled` 必须经 getter 实时读取，
+// 使 /set-enabled 切换立即生效、无需重启。
+function registerSystemPromptSections(ctx, store, getEnabled, getEvolutionAdvice, adviceEnv) {
   const pluginSystemPrompt = ctx.get('systemPrompt');
   if (pluginSystemPrompt === undefined) return;
   const gate = (context) => sectionGatePasses(ctx, getEnabled, context);
@@ -126,25 +199,38 @@ function registerSystemPromptSections(ctx, store, getEnabled) {
     order: 116.5,
     text: (context) => profileSectionText(store, gate, context),
   });
-  // Announce the self-installed orchestrator preset so the current agent
-  // knows the mode exists and can point the user to it. Gated the same
-  // way — only a dispatch-capable agent sees it.
+  // 宣告自装的 orchestrator 预设，让当前 agent 知道该模式存在、可引导用户使用。
+  // 门控与 profiles 段相同——只有可派发的 agent 才看得到。
   pluginSystemPrompt.section({
     name: 'orchestrator:mode',
     order: 117,
     text: (context) => (gate(context) ? ORCHESTRATOR_MODE_TEXT : ''),
   });
+  // 只读建议段：门控 = orchestrator（sectionGatePasses）+ evolutionAdvice 开关。
+  // 只进父 Agent（复用同一门控）、默认关、只含确定性聚合数字与建议文案，不含派生原文。
+  // 生成异常 try/catch 兜底：fail-loud 检查（非 system 候选）落 warn 日志但绝不
+  // 阻断每次提示装配——损坏/手改的 summaries 不得让 orchestrator 会话无法启动。
+  pluginSystemPrompt.section({
+    name: 'evolution:advice',
+    order: 116.8,
+    text: (context) => {
+      if (!getEvolutionAdvice() || !gate(context)) return '';
+      try {
+        return buildAdviceText(adviceEnv);
+      } catch (error) {
+        adviceEnv.logger.warn(`[dsh-subagent-profile] evolution:advice 生成失败，本次不注入：${error instanceof Error ? error.message : String(error)}`);
+        return '';
+      }
+    },
+  });
 }
 
-// HTTP loopback routes for the Client settings UI (webServer.register ↔
-// client fetch; JSON only) — the routes themselves live in
-// lib/core/http-routes.mjs (imported above); this wiring only injects the
-// per-apply deps. webServer is optional — a headless deployment keeps the
-// dispatch tool and drops only the settings page. webServer's activation
-// (listen) is async and may not be ready when this plugin's inject deps
-// resolve, so register inside an inject sub-scope that waits for it
-// (ctx.get would read undefined at apply time).
-function registerSettingsRoutes(ctx, store, getEnabled, setEnabled, syncTool, catalog) {
+// Client 设置 UI 的 HTTP loopback 路由（webServer.register ↔ client fetch，纯 JSON）。
+// 路由本体在 lib/core/http-routes.mjs（上文已 import）；这里只注入 per-apply 依赖。
+// webServer 可选——无头部署保留 dispatch 工具、只丢设置页。webServer 的激活
+// （listen）是异步的，可能晚于本插件 inject 依赖解析完成，故在等它的 inject
+// 子 scope 内注册（apply 时 ctx.get 会读到 undefined）。
+function registerSettingsRoutes(ctx, store, getEnabled, setEnabled, syncTool, catalog, ledger, getAudit, getEvolutionAdvice, setEvolutionAdvice, getEscapeEnabled, setEscapeEnabled, escape, refreshAdvice) {
   ctx.inject(['webServer'], (scope) => {
     scope.effect(createHttpRoutes({
       webServer: scope.webServer,
@@ -153,6 +239,14 @@ function registerSettingsRoutes(ctx, store, getEnabled, setEnabled, syncTool, ca
       setEnabled,
       syncTool,
       catalog,
+      ledger,
+      getAudit,
+      getEvolutionAdvice,
+      setEvolutionAdvice,
+      getEscapeEnabled,
+      setEscapeEnabled,
+      escape,
+      refreshAdvice,
       logger: ctx.logger,
     }), 'dsh-subagent-profile: settings routes');
   });
@@ -170,48 +264,80 @@ function createSharedCatalog(ctx) {
   });
 }
 
-export async function apply(ctx) {
-  // Enable/disable switch (default on, runtime-toggled by the settings
-  // page, persisted across restarts) + profile registry — lib/profiles-store
-  // .mjs: createProfileStore. loadProfiles runs once at startup via the
-  // explicit call below (the factory itself does not auto-load).
-  const store = createProfileStore({ dshHome: dshHome(), logger: ctx.logger });
-  let enabled = store.loadEnabled();
-  store.loadProfiles();
-  // Self-install the bundled "orchestrator" preset (idempotent, fail-soft).
-  syncBundledPresetsToHome(ctx);
-  // 进程级共享 catalog 快照（/options 三路由 + dispatch cost guard 共用）。
-  const catalog = createSharedCatalog(ctx);
-  // `dispatch` tool — lib/core/dispatch-tool.mjs: defineTool block (schema +
-  // execute), the result-schema consistency lock and the syncTool
-  // register/unregister logic.
-  // Created BEFORE the HTTP inject so createHttpRoutes can capture
-  // dispatch.syncTool (/set-enabled).
-  const dispatch = createDispatchTool({
+// 读本插件 package.json version 供派发台账 provenance 使用。fail-soft：读取/解析
+// 失败回退 'unknown'，绝不阻断插件启动。
+function readPluginVersion() {
+  try {
+    const pkg = createRequire(import.meta.url)('./package.json');
+    return typeof pkg?.version === 'string' && pkg.version !== '' ? pkg.version : 'unknown';
+  } catch {
+    return 'unknown';
+  }
+}
+
+// 逃生舱装配：放行集 store + 开关态（state.json 持久化）+ 访问器。开关态经对象字段
+// 可变（/set-escape 改写），getEscapeSet 开关关时恒空数组（零叠加、零放行审计）。
+function setupEscape(ctx, store, evoLedger, home) {
+  const escape = createEscapeStore({ dshHome: home, logger: ctx.logger, onGovernanceFailure: () => evoLedger.markGovernanceFailure() });
+  const state = { escapeEnabled: store.loadEscapeEnabled() };
+  return {
+    escape,
+    getEscapeSet: () => (state.escapeEnabled ? escape.list() : []),
+    getEscapeEnabled: () => state.escapeEnabled,
+    setEscapeEnabled: (next) => { state.escapeEnabled = next; },
+    recordEscapeAllowProvider: (parent, preset) => recordEscapeAllowProvider(evoLedger, parent, preset),
+  };
+}
+
+// `dispatch` 工具装配（defineTool + execute + syncTool）。须在 HTTP inject 之前
+// 构造，使 createHttpRoutes 能拿 dispatch.syncTool 供 /set-enabled 注册/注销。
+function createDispatch(ctx, store, catalog, ledger, guard, evoLedger, getEscapeSet, getEnabled) {
+  return createDispatchTool({
     register: (tool) => ctx.tools.register(tool),
     store,
-    getEnabled: () => enabled,
+    getEnabled,
     getService: (name) => ctx.get(name),
     logger: ctx.logger,
     subagents: ctx.subagents,
     catalog,
+    ledger,
+    guard,
+    evoLedger,
+    getEscapeSet,
   });
-  // subagent-profiles service over the store's per-apply profiles Map.
+}
+
+export async function apply(ctx) {
+  const home = dshHome();
+  // 启动清理：上个生命周期留下的 .removed-* 备份残留（S1 改名的副产物）。
+  cleanRemovedBackups(home);
+  // 派发台账 + 审计分级须在 store 之前构造：store 的治理审计钩子指向其 markGovernanceFailure。
+  const evoLedger = createEvolutionLedger({ dshHome: home, pluginVersion: readPluginVersion(), warn: (message) => ctx.logger.warn(`[dsh-subagent-profile] ${message}`) });
+  const store = createProfileStore({ dshHome: home, logger: ctx.logger, onGovernanceFailure: () => evoLedger.markGovernanceFailure() });
+  const escapeCtl = setupEscape(ctx, store, evoLedger, home);
+  let enabled = store.loadEnabled();
+  let evolutionAdvice = store.loadEvolutionAdvice();
+  store.loadProfiles();
+  // 自装 bundled 的 orchestrator 预设（幂等、fail-soft）。
+  syncBundledPresetsToHome(ctx);
+  const catalog = createSharedCatalog(ctx);
+  const ledger = createFailureLedger({ warn: (message) => ctx.logger.warn(`[dsh-subagent-profile] ${message}`), stateFile: join(home, 'subagent-profiles.failed-traces.json') });
+  const guard = createDispatchGuard({ warn: (message) => ctx.logger.warn(`[dsh-subagent-profile] ${message}`) });
+  const dispatch = createDispatch(ctx, store, catalog, ledger, guard, evoLedger, escapeCtl.getEscapeSet, () => enabled);
   provideProfileService(ctx, store);
-  // Gated system-prompt sections (profile directory + orchestrator mode).
-  registerSystemPromptSections(ctx, store, () => enabled);
-  // `profile` subagent provider — lib/core/profile-provider.mjs:
-  // createProfileProvider registers the provider and returns the disposer.
-  const disposeProvider = createProfileProvider({
-    subagents: ctx.subagents,
-    store,
-    getEnabled: () => enabled,
+  const adviceWhitelist = await resolveAdviceWhitelist(ctx);
+  const adviceEnv = { summariesFile: join(home, 'subagent-evolution', 'summaries.json'), dispatchFile: join(home, 'subagent-evolution', 'dispatch.jsonl'), whitelist: adviceWhitelist, logger: ctx.logger };
+  // 生产聚合触发点（T1 修复）：/options/refresh 手动刷新时重算 summaries.json，让
+  // evolution:advice 有初始生成路径（原先 computeSummaries/writeSummaries 只被测试调用）。
+  const refreshAdvice = () => refreshSummaries({
+    dispatchFile: join(home, 'subagent-evolution', 'dispatch.jsonl'),
+    summariesFile: join(home, 'subagent-evolution', 'summaries.json'),
     logger: ctx.logger,
-    catalog,
   });
+  registerSystemPromptSections(ctx, store, () => enabled, () => evolutionAdvice, adviceEnv);
+  const disposeProvider = createProfileProvider({ subagents: ctx.subagents, store, getEnabled: () => enabled, logger: ctx.logger, catalog, getEscapeSet: escapeCtl.getEscapeSet, recordEscapeAllowProvider: escapeCtl.recordEscapeAllowProvider });
   if (typeof disposeProvider === 'function') ctx.effect(() => disposeProvider);
-  // HTTP loopback routes for the Client settings UI — lib/core/http-routes.mjs.
-  registerSettingsRoutes(ctx, store, () => enabled, (next) => { enabled = next; }, dispatch.syncTool, catalog);
-  // Teardown: unregister the dispatch tool (if still registered).
-  ctx.effect(() => dispatch.dispose);
+  // Client 设置 UI 的 HTTP loopback 路由 —— lib/core/http-routes.mjs。
+  registerSettingsRoutes(ctx, store, () => enabled, (next) => { enabled = next; }, dispatch.syncTool, catalog, ledger, () => evoLedger.auditState(), () => evolutionAdvice, (next) => { evolutionAdvice = next; }, escapeCtl.getEscapeEnabled, escapeCtl.setEscapeEnabled, escapeCtl.escape, refreshAdvice);
+  registerTeardown(ctx, dispatch, ledger, guard, home);
 }