dsh-subagent-profile 0.3.2 → 0.3.4

package/lib/core/profiles-store.mjs

@@ -1,26 +1,25 @@
-// lib/core/profiles-store.mjs — profile registry store and enable/disable switch
-// (moved verbatim from index.mjs and refactored into a factory; import-free —
-// node builtins + lib/core/pure.mjs only, no @deepseek-ai dependency).
+// lib/core/profiles-store.mjs — profile 注册表 store 与启用/禁用开关
+// （从 index.mjs 逐字移出并重构为工厂；import-free——
+// 仅 node 内置 + lib/core/pure.mjs，无 @deepseek-ai 依赖）。
 //
-// `dshHome()` and `BUILTIN_SEEDS` are module-level exports shared by the
-// factory and by lib/core/http-routes.mjs (the settings HTTP handlers look up seeds). The
-// per-apply store is constructed by `createProfileStore({ dshHome, logger })`,
-// replacing the apply-closure singleton: every apply() call gets its own
-// profiles Map / deletedBuiltins Set / allowFailOpen flag, exactly like the
-// original closure state.
+// `dshHome()` 与 `BUILTIN_SEEDS` 是模块级导出，工厂与 lib/core/http-routes.mjs
+// （设置 HTTP 处理器查 seeds）共享。per-apply store 由
+// `createProfileStore({ dshHome, logger })` 构造，取代 apply 闭包单例：
+// 每次 apply() 调用都有自己的 profiles Map / deletedBuiltins Set /
+// allowFailOpen 标志，与原始闭包状态完全一致。
 //
-// 工厂内嵌的 loadProfiles/persistProfiles/loadEnabled/persistEnabled/
-// resolveProfile 按行门抽为模块级函数，per-apply 状态收集进 `state` 对象
-// 注入；返回面与拆分前逐字一致。
+// 工厂内嵌的 loadProfiles/persistProfiles/resolveProfile 按行门抽为模块级函数，
+// per-apply 状态收集进 `state` 对象注入；开关态（enabled / evolutionAdvice）
+// 经 loadState/persistState 读写共享 state.json。
 
 import { existsSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { sanitizeProfile } from './pure.mjs';
 
-// Resolve the DSH home directory (env override wins, platform fallback) — the
-// same policy as the dsh-persona-ref bundle: user profiles persist to
-// ~/.dsh/subagent-profiles.json, stable across harness working directories.
+// 解析 DSH 主目录（env 覆盖优先，平台回退）——与 dsh-persona-ref bundle 相同
+// 策略：用户 profile 持久化到 ~/.dsh/subagent-profiles.json，跨 harness 工作目录
+// 稳定。
 export function dshHome() {
   const raw = process.env.DSH_HOME;
   if (typeof raw === 'string' && raw.trim() !== '') {
@@ -32,15 +31,13 @@ export function dshHome() {
   return join(homedir(), '.dsh');
 }
 
-// 1. Profile registry (per-instance state; a bundle row is process-level, so
-//    this Map is the singleton store, exactly like the dynamic plugin's).
-//    Builtin seeds carry `builtin: true` so reset/remove can identify them and
-//    a modified builtin stays distinguishable from a pure user profile.
-//    Descriptions are semantic: one-line positioning + when to use, to help
-//    the model choose. reasoningEffort levels verified against the
-//    llm-deepseek adapter (off/high/max; see resolveModel gating on
-//    connection.defaults.thinking — this deployment leaves thinking unset,
-//    so the full set is advertised for deepseek-v4-flash).
+// 1. Profile 注册表（per-instance 状态；bundle 行是进程级，故本 Map 是单例
+//    store，与动态插件完全一致）。内置种子带 `builtin: true`，reset/remove 可
+//    识别它们，改过的内置方案与纯用户 profile 可区分。
+//    description 是语义化的：一行定位 + 何时用，帮助模型选择。reasoningEffort
+//    档位经 llm-deepseek adapter 核验（off/high/max；见 resolveModel 对
+//    connection.defaults.thinking 的门控——本部署未设 thinking，
+//    故对 deepseek-v4-flash 全档位宣传）。
 export const BUILTIN_SEEDS = [
   { id: 'swap-standard', name: '标准编码', description: '切换到 standard 预设的完整编码工具集。当父会话不是 standard、但子任务需要完整编码能力时用。', preset: 'standard', tokenTier: 'balanced', builtin: true },
   { id: 'researcher', name: '调研检索', description: '关闭深度推理省 token，继承父工具。适合查资料、汇总、背景调研，不适合改代码。', reasoningEffort: 'off', persona: 'You are a research subagent: search, read, and summarize only. Do not modify code or files.', tokenTier: 'cheap', builtin: true }
@@ -50,14 +47,14 @@ export const BUILTIN_SEEDS = [
 
 function resolveProfile(profiles, id) {
   const found = profiles.get(id);
-  if (found === undefined) throw new Error(`dispatch: unknown profile "${id}"`);
-  if (found.enabled === false) throw new Error(`dispatch: profile "${id}" is disabled`);
+  if (found === undefined) throw new Error(`dispatch: 未知 profile "${id}"（可在设置页的 profile 列表确认可用的 id）`);
+  if (found.enabled === false) throw new Error(`dispatch: profile "${id}" 已禁用（可在设置页重新启用该 profile）`);
   return found;
 }
 
-// Two file shapes: v1 = a bare array; v2 = { version:2,
-// profiles:[...], allowFailOpen:<bool> }. Returns { entries, version } or
-// { entries: undefined } for an unrecognized shape.
+// 两种文件形状：v1 = 裸数组；v2 = { version:2, profiles:[...],
+// allowFailOpen:<bool> }。返回 { entries, version }；无法识别的形状返回
+// { entries: undefined }。
 function classifyProfileFile(parsed) {
   if (Array.isArray(parsed)) return { entries: parsed, version: 1 };
   if (parsed !== null && typeof parsed === 'object' && Array.isArray(parsed.profiles)) {
@@ -66,10 +63,9 @@ function classifyProfileFile(parsed) {
   return { entries: undefined, version: undefined };
 }
 
-// Per-entry sanitize (strict=false): over-limit fields are dropped (field
-// removed) + warned; an over-length persona is KEPT + warned (never silently
-// truncated). A bad entry is skipped (fail-soft). Returns
-// 'loaded' | 'skipped' | 'deleted' so loadProfiles can keep its counters.
+// 逐条净化（strict=false）：超限字段被丢弃（字段移除）+ 告警；超长 persona
+// 保留 + 告警（绝不静默截断）。坏条目跳过（fail-soft）。返回
+// 'loaded' | 'skipped' | 'deleted'，loadProfiles 据此维护计数。
 function applyProfileEntry(raw, profiles, deletedBuiltins, logger) {
   if (!raw || typeof raw !== 'object' || typeof raw.id !== 'string' || raw.id.length === 0) {
     logger.warn('[dsh-subagent-profile] skipping malformed profile entry:', raw === null ? String(raw) : typeof raw);
@@ -95,13 +91,11 @@ function applyProfileEntry(raw, profiles, deletedBuiltins, logger) {
   return 'loaded';
 }
 
-// 1b. User profile persistence. The settings service cannot serve this
-// plugin (its write path hard-requires register(ns, schema) + a schemastery
-// schema), so user profiles are persisted to ~/.dsh/subagent-profiles.json
-// through node:fs — a bundle has node globals, unlike the dynamic-plugin
-// sandbox that needed the optional `fs` service. Loaded once at startup; the
-// add/remove HTTP routes rewrite the file. Persistence is an enhancement, not
-// a hard dependency: any failure only warns and the builtin seeds work.
+// 1b. 用户 profile 持久化。设置服务服务不了本插件（其写路径硬性要求
+//    register(ns, schema) + schemastery schema），故用户 profile 经 node:fs
+//    持久化到 ~/.dsh/subagent-profiles.json——bundle 有 node 全局，不像需要可选
+//    `fs` 服务的动态插件沙箱。启动时加载一次；add/remove HTTP 路由重写文件。
+//    持久化是增强而非硬依赖：任何失败只告警，内置种子照常工作。
 function loadProfiles(state, logger) {
   if (!existsSync(state.profilesFile)) return;
   try {
@@ -112,7 +106,7 @@ function loadProfiles(state, logger) {
       return;
     }
     if (version !== 2) {
-      // v1 (or an unversioned array): migrate in memory, keep fail-open compat.
+      // v1（或无版本数组）：内存迁移，保持 fail-open 兼容。
       state.allowFailOpen = true;
       logger.warn('[dsh-subagent-profile] v1 数据：fail-open 兼容模式');
     } else {
@@ -127,8 +121,8 @@ function loadProfiles(state, logger) {
       if (status === 'loaded') loaded++;
       else if (status === 'skipped') skipped++;
     }
-    // Silent success: report how many persisted profiles came in (skipped
-    // when none — a missing/empty file is the normal first boot).
+    // 静默成功：报告载入了多少持久化 profile（没有时跳过——缺失/空文件是
+    // 正常首启）。
     if (loaded > 0) logger.info(`[dsh-subagent-profile] loaded ${loaded} persisted profile(s)`);
     if (skipped > 0) logger.warn(`[dsh-subagent-profile] skipped ${skipped} malformed profile entry(ies)`);
   } catch (error) {
@@ -137,13 +131,11 @@ function loadProfiles(state, logger) {
 }
 
 /**
- * Persist every `persisted: true` profile plus builtin-delete tombstones.
- * Atomic write: write `<profilesFile>.tmp` in the same directory,
- * then `renameSync` over the target (a crash leaves the old file intact, never
- * a truncated one). Fail-visible: a failure does NOT throw and does NOT
- * roll back the in-memory `profiles` Map — it returns `{ persisted: false }` so
- * the caller can signal "已保存但未持久化" while the in-memory state keeps
- * driving this process. Always writes the v2 envelope shape.
+ * 持久化每个 `persisted: true` 的 profile 加内置删除墓碑。
+ * 原子写：同目录写 `<profilesFile>.tmp`，再 `renameSync` 覆盖目标
+ * （崩溃只留下旧文件完好，绝不留下截断文件）。失败可见：失败不抛、不
+ * 回滚内存 `profiles` Map——返回 `{ persisted: false }`，调用方可以提示
+ * 「已保存但未持久化」，内存态继续驱动本进程。恒写 v2 信封形状。
  */
 function persistProfiles(state, logger) {
   const entries = [];
@@ -166,42 +158,67 @@ function persistProfiles(state, logger) {
     renameSync(tmp, state.profilesFile);
     return { persisted: true };
   } catch (error) {
-    // Best-effort cleanup of the partial tmp file (rename never ran).
+    // 尽力清理残留的 tmp 文件（rename 未执行）。
     try { rmSync(tmp, { force: true }); } catch { /* best effort */ }
     logger.warn('[dsh-subagent-profile] persisted profile write failed:', error instanceof Error ? error.message : String(error));
     return { persisted: false, error: error instanceof Error ? error.message : String(error) };
   }
 }
 
-// The plugin's enable/disable switch. Persisted beside the profile list so a
-// user can turn the dispatch tool off without uninstalling the bundle. Default
-// is enabled; a missing/unreadable file falls back to enabled.
-function loadEnabled(state) {
+// 插件开关态（state.json）：enabled（默认开，禁用即关派发工具）+ evolutionAdvice
+// （派发优化建议注入，默认关，需显式开）+ escapeEnabled（逃生舱放行，默认关——信任
+// 底板，仅设置页显式 opt-in 可放开）。三开关共用同一 state.json，读写整份对象
+// 以互不覆盖；缺失文件回退默认值（全新部署），损坏文件 fail-closed（三开关全关，
+// 绝不静默回退 enabled:true —— 安全禁用会被撤销），内存态仍驱动本进程。
+const STATE_DEFAULTS = { enabled: true, evolutionAdvice: false, escapeEnabled: false };
+const STATE_FAIL_CLOSED = { enabled: false, evolutionAdvice: false, escapeEnabled: false };
+
+function loadState(state) {
+  if (!existsSync(state.stateFile)) return { ...STATE_DEFAULTS };
   try {
-    if (existsSync(state.stateFile)) {
-      const parsed = JSON.parse(readFileSync(state.stateFile, 'utf8'));
-      return parsed && parsed.enabled !== false;
+    const parsed = JSON.parse(readFileSync(state.stateFile, 'utf8'));
+    if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) throw new Error('state 文件不是对象');
+    return {
+      enabled: parsed.enabled !== false,
+      evolutionAdvice: parsed.evolutionAdvice === true,
+      escapeEnabled: parsed.escapeEnabled === true,
+    };
+  } catch (error) {
+    // fail-closed（S2）：损坏的 state.json 若回退 enabled:true，会把「安全禁用」静默撤销。
+    // 三开关一律关（派发/建议/逃生舱全停），显式 warn；下次持久化写入即自愈。
+    if (state.logger !== undefined && typeof state.logger.warn === 'function') {
+      state.logger.warn('[dsh-subagent-profile] state.json 损坏，按 fail-closed 处理（三开关全关）：', error instanceof Error ? error.message : String(error));
     }
-  } catch {
-    // fall through to enabled
+    return { ...STATE_FAIL_CLOSED };
   }
-  return true;
 }
 
-function persistEnabled(state, enabled) {
+// 原子写 state.json（tmp+rename，与 persistProfiles 同口径，修复「全库唯一非原子写」）。
+// 返回 { persisted: true } 或 { persisted: false, error }，供开关路由回传 persisted 信号；
+// 写失败仍触发治理审计钩子（不抛），内存态照常驱动本进程。
+function persistState(state, patch, onGovernanceFailure) {
+  const next = { ...loadState(state), ...patch };
+  const tmp = `${state.stateFile}.tmp`;
   try {
-    writeFileSync(state.stateFile, JSON.stringify({ enabled }, null, 2), 'utf8');
-  } catch {
-    // best effort — the in-memory state still drives this process
+    writeFileSync(tmp, JSON.stringify(next, null, 2), 'utf8');
+    renameSync(tmp, state.stateFile);
+    return { persisted: true };
+  } catch (error) {
+    try { rmSync(tmp, { force: true }); } catch { /* best effort */ }
+    // best effort——内存态仍驱动本进程；
+    // 开关态（含 persistEnabled）写失败也是治理审计丢失，通知审计钩子（不抛）。
+    if (typeof onGovernanceFailure === 'function') onGovernanceFailure();
+    return { persisted: false, error: error instanceof Error ? error.message : String(error) };
   }
 }
 
-// Build one store instance. `dshHome` is the already-resolved home directory
-// string (from the exported dshHome()); `logger` is the apply-time ctx.logger.
-// Per-apply state (profiles / deletedBuiltins / paths / allowFailOpen) collects
-// into `state` for the moved module-level functions. The returned surface is
-// identical to the pre-split factory.
-export function createProfileStore({ dshHome, logger }) {
+// 构造一个 store 实例。`dshHome` 是已解析的主目录字符串（来自导出的
+// dshHome()）；`logger` 是 apply 时的 ctx.logger。`onGovernanceFailure`（可选）
+// 是任何 profile/state 持久化写失败时触发的审计钩子——一次治理审计丢失事件。
+// per-apply 状态（profiles / deletedBuiltins / paths / allowFailOpen）收进
+// `state` 供移出的模块级函数使用。profile 注册表表面与拆分前工厂一致；两个
+// 开关访问器（enabled / evolutionAdvice）读写共享 state.json。
+export function createProfileStore({ dshHome, logger, onGovernanceFailure = () => {} }) {
   const profiles = new Map(BUILTIN_SEEDS.map((p) => [p.id, { ...p }]));
   const deletedBuiltins = new Set();
   const state = {
@@ -210,17 +227,27 @@ export function createProfileStore({ dshHome, logger }) {
     profilesFile: join(dshHome, 'subagent-profiles.json'),
     stateFile: join(dshHome, 'subagent-profiles.state.json'),
     allowFailOpen: false,
+    logger,
   };
   return {
     profiles,
     deletedBuiltins,
     resolveProfile: (id) => resolveProfile(profiles, id),
     loadProfiles: () => loadProfiles(state, logger),
-    persistProfiles: () => persistProfiles(state, logger),
-    loadEnabled: () => loadEnabled(state),
-    persistEnabled: (enabled) => persistEnabled(state, enabled),
-    // getAllowFailOpen: the cost guard must read the migration flag at dispatch
-    // time; loadProfiles/persistProfiles own the mutation.
+    persistProfiles: () => {
+      const result = persistProfiles(state, logger);
+      // 治理审计：profile 变更持久化失败计一次治理丢失（写入不抛，仅为高可见标记）。
+      if (result.persisted === false) onGovernanceFailure();
+      return result;
+    },
+    loadEnabled: () => loadState(state).enabled,
+    persistEnabled: (enabled) => persistState(state, { enabled }, onGovernanceFailure),
+    loadEvolutionAdvice: () => loadState(state).evolutionAdvice,
+    persistEvolutionAdvice: (value) => persistState(state, { evolutionAdvice: value === true }, onGovernanceFailure),
+    loadEscapeEnabled: () => loadState(state).escapeEnabled,
+    persistEscapeEnabled: (value) => persistState(state, { escapeEnabled: value === true }, onGovernanceFailure),
+    // getAllowFailOpen：cost guard 必须在派发时读取迁移标志；
+    // loadProfiles/persistProfiles 持有该写入。
     getAllowFailOpen: () => state.allowFailOpen,
   };
 }

package/lib/core/pure.mjs

@@ -1,10 +1,12 @@
-// lib/core/pure.mjs — import-free pure helpers (extracted from index.mjs and grown
-// by later refactors). No @deepseek-ai imports and no external dependencies:
-// @deepseek-ai symbols converge in lib/core/shims.mjs (the only such entry point),
-// and this module is safe to import from bare-CI tests without the junction
-// packages. Every function here is deterministic and free of service/fs access.
+// lib/core/pure.mjs — 纯函数助手（从 index.mjs 拆出，经后续重构扩展）。
+// 无 @deepseek-ai import、无外部依赖：唯一 import 是 node:crypto（dispatchLabel
+// 用的 node 内置），@deepseek-ai 符号全部收敛在 lib/core/shims.mjs（唯一入口），
+// 本模块可在 bare-CI 测试中无 junction 包安全导入。
+// 这里每个函数都是确定性的，无服务/fs 访问。
 
-// Shipped toStopReason: map a turn-end reason to the seam's terminal vocabulary.
+import { createHash } from 'node:crypto';
+
+// 官方 toStopReason：把一轮结束原因映射到接缝的终态词汇表。
 export function toStopReason(reason) {
   switch (reason?.kind) {
     case 'completed': return 'completed';
@@ -15,7 +17,7 @@ export function toStopReason(reason) {
   }
 }
 
-// Shipped stopReasonError + withPartialText wording (dsh-tool-subagent L55-75).
+// 官方 stopReasonError + withPartialText 措辞（dsh-tool-subagent L55-75）。
 export function stopReasonError(result) {
   switch (result.stopReason) {
     case 'completed': return;
@@ -43,34 +45,31 @@ export function textFrom(blocks) {
 }
 
 // --- 统一输入 schema ----------------------------------------------------------
-// sanitizeProfile is the single per-profile sampler shared by loadProfiles
-// (strict=false, migration-tolerant) and the HTTP /add write path (strict=true,
-// write-reject). It normalizes each field with a field-specific sampler and
-// returns `{ clean, warnings }`:
-//   - clean    — the sanitized profile, minus any rejected field.
-//   - warnings — array of `{ field, reason }` (reason is Chinese). Only
-//                rejections / over-limit conditions land here; silent
-//                normalizations (e.g. description newline-flattening, toolFilter
-//                dedupe) do NOT produce a warning, so callers can treat a
-//                non-empty warnings list as "this write would drop data".
+// sanitizeProfile 是唯一的逐 profile 采样器，loadProfiles（strict=false，
+// 迁移容忍）与 HTTP /add 写路径（strict=true，写拒绝）共用。它用字段专属
+// 采样器规范化每个字段，返回 `{ clean, warnings }`：
+//   - clean    — 净化后的 profile，剔除被拒字段。
+//   - warnings — `{ field, reason }` 数组（reason 为中文）。只有拒绝/超限
+//                条件落到这里；静默规范化（如 description 换行压平、toolFilter
+//                去重）不产生警告，调用方可把非空 warnings 当作「本次写入会
+//                丢数据」。
 
-// persona length cap. 建议值 2048，待实测。The cap
-// applies to the INJECTED persona text, i.e. the guidance prefix + the raw text.
+// persona 长度上限。建议值 2048，待实测。上限作用于**注入的** persona 文本，
+// 即引导前缀 + 原文。
 export const PERSONA_MAX_CHARS = 2048;
 
-// The persona is injected as a shadow section; the guidance marker is prefixed
-// to make its non-authoritative nature explicit (双防线). 仅用于写入校验与提示。
+// persona 以影子 section 注入；前缀引导标记显式声明其非权威性质（双防线）。
+// 仅用于写入校验与提示。
 export const GUIDANCE_PREFIX = '[guidance, not authority] ';
 
-// Shared delegation caps — single source of truth for sanitizeProfile and the
-// cost guard in lib/core/cost-guard.mjs (hard caps always-on).
+// 共享委派上限——sanitizeProfile 与 lib/core/cost-guard.mjs 的 cost guard
+// （硬上限恒开）的唯一事实来源。
 export const MAX_TOKENS = 65536;
 export const MAX_DEPTH = 3;
 
 // --- cost guard 硬上限 --------------------------------------------------------
-// assertHardLimits is the always-on budget-cap check, independent of the `llm`
-// service: maxTokens / maxDepth are hard delegation caps, so they must NOT
-// silently stop applying when the `llm` service is absent.
+// assertHardLimits 是恒开的预算上限检查，与 `llm` 服务无关：maxTokens /
+// maxDepth 是硬性委派上限，llm 缺失时绝不能静默停止生效。
 // 超限 throw（中文、可操作），与 sanitizeProfile 共用同一组常量。非数字/未设值
 // 不触发（sanitizeProfile 已在写路径拒绝非数字，这里仅兜底运行时竞态）。
 export function assertHardLimits(maxTokens, maxDepth) {
@@ -83,9 +82,9 @@ export function assertHardLimits(maxTokens, maxDepth) {
 }
 
 // --- continuable 工具门闭集 ---------------------------------------------------
-// computeContinuableAllow pre-computes the CLOSED tool `allow` set for the
-// continuable dispatch path: 父工具集 − run_code − (toolFilter.deny)，并在存在
-// toolFilter.allow 时再 ∩ allow。空集 fail-loud（throw）—— 绝不静默派发零工具。
+// computeContinuableAllow 预计算 continuable 派发路径的**闭合**工具 `allow` 集：
+// 父工具集 − run_code − (toolFilter.deny)，存在 toolFilter.allow 时再 ∩ allow。
+// 空集 fail-loud（throw）——绝不静默派发零工具。
 //
 // 代码编辑者注意：这里写代码注释的「假设 / 失效条件」必须与 dispatch-tool.mjs
 // continuable 分支的注释保持一致（要求写入代码注释与 README）。
@@ -109,11 +108,10 @@ export function computeContinuableAllow(parentNames, toolFilter = {}) {
   return result;
 }
 
-// description/name sampler: `\n→空格`压平. These are display lines (the
-// dispatch:profiles section interpolates them into a single row), so a newline
-// would break the row. 压平仅作存储层；引号包裹由显示层负责——显示层在该行给
-// description 加引号（空时显示 '(无描述)' 不套引号），本纯函数只保证存储值
-// 是单行、无换行。
+// description/name 采样器：`\n→空格` 压平。这些是显示行（dispatch:profiles
+// section 把它们插进单行），换行会破坏该行。压平仅作存储层；引号包裹由显示层
+// 负责——显示层在该行给 description 加引号（空时显示 '(无描述)' 不套引号），
+// 本纯函数只保证存储值是单行、无换行。
 function sanitizeShortText(value) {
   return value.replace(/\r\n|\r|\n/g, ' ');
 }
@@ -192,8 +190,8 @@ function sanitizeToolFilterField(value, clean, warnings) {
     const deduped = [...new Set(sub.filter((s) => s.length > 0))];
     if (deduped.length > 0) tf[op] = deduped;
   }
-  // Unknown toolFilter keys are ignored; an empty (or fully-invalid)
-  // toolFilter is simply omitted from clean (mirrors the /add write path).
+  // 未知 toolFilter 键忽略；空（或全非法）toolFilter 直接从 clean 省略
+  // （与 /add 写路径一致）。
   if (Object.keys(tf).length > 0) clean.toolFilter = tf;
 }
 
@@ -215,24 +213,22 @@ function sanitizeTokenTierField(value, clean, warnings) {
 // 在 `textFrom` 之前执行，把回灌进父上下文的体积压到阈值内。
 //
 // 阈值常量：head / tail / minKeep 是**子级**预期裁剪口径（比 agent.cordis.yml
-// 现行 compaction-basic 的 4096/1024 更保守）。**待实测**——宿主
+// 现行 compaction-basic 的 4096/1024 更保守）。宿主
 // toolResultPruner.pruneContent(blocks) 只接收 blocks，自身读取其配置
 // （thresholdChars/headChars/tailChars），因此这三个常量当前**不会**作为实参
 // 传给宿主 pruner；它们记录本条目的子级口径，并保留给后续「信封 / 精修
-// 剪枝」路径使用。改动前先实测真实分布再校准。
+// 剪枝」路径使用。改动前先实测真实分布再校准（当前子输出样本不足，待积累）。
 export const PRUNE_HEAD_CHARS = 2048;
 export const PRUNE_TAIL_CHARS = 1024;
 export const PRUNE_MIN_KEEP = 128;
 
-// Apply host pruning to one subagent result's content blocks.
-//   - `blocks`   — the result.output content blocks (or undefined; not an array).
-//   - `pruner`   — the `toolResultPruner` service, or undefined.
-// Returns the (possibly pruned) blocks, or an empty array placeholder. When the
-// pruner is absent (headless deployment without the compaction pruner) OR the
-// content is not an array, it falls back to NO pruning — 剪枝是增强，绝非硬依赖。
-// A host pruner that throws on an unusual content shape also
-// falls back to the full output, because automatic pruning must NEVER swallow a
-// legitimate child result.
+// 对单个子 Agent 结果的内容块应用宿主剪枝。
+//   - `blocks` — result.output 内容块（或 undefined；非数组）。
+//   - `pruner` — `toolResultPruner` 服务，或 undefined。
+// 返回（可能被剪的）块，或空数组占位。pruner 缺失（无压缩插件的无头部署）
+// 或内容非数组时回退为不剪——剪枝是增强，绝非硬依赖。
+// 宿主 pruner 在异常内容形状上抛错也回退为完整输出，因为自动剪枝绝不允许
+// 吞掉合法的子结果。
 export function pruneBlocks(blocks, pruner) {
   if (Array.isArray(blocks) && pruner !== undefined && typeof pruner.pruneContent === 'function') {
     try {
@@ -245,12 +241,58 @@ export function pruneBlocks(blocks, pruner) {
   return Array.isArray(blocks) ? blocks : [];
 }
 
+// --- 输出回灌信任标注 ----------------------------------------------------------
+// trustLabel 给 completed 子结果的回收文本加结构化信任标注前缀，让父上下文
+// 不把子 Agent 输出误当高信任指令（正文先见标注、再见子输出）。profile/preset
+// 与 buildMeta 同源字段；preset 为 'inherit'（子继承父预设、无换用）或字段缺失
+// 时省略该段。前缀只含这两个元数据标识符，绝不携带 prompt/persona 原文。
+function trustFields(meta) {
+  const m = meta !== null && meta !== undefined && typeof meta === 'object' ? meta : {};
+  const fields = [];
+  if (typeof m.profile === 'string' && m.profile !== '') fields.push(['profile', m.profile]);
+  if (typeof m.preset === 'string' && m.preset !== '' && m.preset !== 'inherit') fields.push(['preset', m.preset]);
+  return fields;
+}
+
+// 模型可见的标注前缀：进回收 output 文本（render 行首部格式不变，前缀在 output 内部）。
+export function trustLabel(meta) {
+  const fields = trustFields(meta);
+  return fields.length === 0
+    ? '[dispatch:trusted-output]'
+    : `[dispatch:trusted-output] ${fields.map(([key, value]) => `${key}=${value}`).join(' ')}`;
+}
+
+// 审计记录：与 trustLabel 同字段集的 JSON，只进 logger、不进结果字符串，无子输出
+// 原文。调用方拼 `[dsh-subagent-profile] trusted-output: ` 前缀后以 info 记录。
+export function trustAudit(meta) {
+  return JSON.stringify(Object.fromEntries(trustFields(meta)));
+}
+
+// --- 派发 label 去敏 ----------------------------------------------------------
+// dispatchLabel 生成子会话标题/任务卡 label：只含结构化段（profile/preset/model）
+// 加 prompt 的 sha1 前 8 位十六进制哈希，绝不落 prompt 原文前缀。哈希让排障时
+// 不同任务可辨识（不同 prompt → 不同哈希），却不泄漏任何前缀内容。profile 缺失
+// 时回退 '(inline)'；preset 缺失或为 'inherit'（子继承父预设、无换用）时省略该
+// 段；model 缺失时省略该段——与 buildMeta/trustFields 的字段口径一致。
+export function dispatchLabel(args, merged) {
+  const a = args !== null && typeof args === 'object' ? args : {};
+  const m = merged !== null && typeof merged === 'object' ? merged : {};
+  const profile = typeof a.profile === 'string' && a.profile !== '' ? a.profile : '(inline)';
+  const promptText = String(a.prompt ?? '');
+  const hash = createHash('sha1').update(promptText, 'utf8').digest('hex').slice(0, 8);
+  const segments = [`dispatch:${profile}`];
+  if (typeof m.preset === 'string' && m.preset !== '' && m.preset !== 'inherit') segments.push(m.preset);
+  if (typeof m.model === 'string' && m.model !== '') segments.push(m.model);
+  segments.push(`#${hash}`);
+  return segments.join(' ');
+}
+
 // --- continuable 可见性修复 ----------------------------------------------------
 // 共享一致性规则：三个 closed `output.schema.oneOf` 分支
-// (background / continuable / foreground) must carry an IDENTICAL shared meta key
-// set whenever a result-meta field is added — so `ignored`, `reasoningEffort`,
-// `profile/preset/provider/model` must appear in ALL three branches, keeping the
-// model-side schema from rejecting a分支 that "forgot" the field.
+// (background / continuable / foreground) 在新增结果元数据字段时必须携带
+// **相同**的共享元数据键集——`ignored`、`reasoningEffort`、
+// `profile/preset/provider/model` 必须出现在全部三个分支，使模型侧 schema
+// 不会拒绝「忘了」该字段的分支。
 //
 // 判据：元数据集合 = 每个分支 properties 的键集，**剔除**各分支自有的判别键
 // （`kind`/`jobId`/`subagentId`/`output`——background/continuable/foreground 各自
@@ -287,10 +329,9 @@ export function assertResultSchemaConsistency(schema) {
   return true;
 }
 
-// The full field set that may live on a profile. ANY other key — including
-// __proto__ / constructor / prototype (which JSON.parse can produce as OWN
-// properties) — is dropped instead of copied, so assignment never walks into
-// the object prototype chain (prototype-pollution guard).
+// profile 上可能存在的完整字段集。任何其它键——包括 __proto__ / constructor /
+// prototype（JSON.parse 可以产出为 OWN 属性）——一律丢弃而不复制，赋值永远
+// 不会走进对象原型链（原型污染防护）。
 const KNOWN_PROFILE_FIELDS = new Set([
   'id', 'name', 'description', 'persona', 'preset', 'provider', 'model',
   'reasoningEffort', 'enabled', 'maxTokens', 'maxDepth', 'toolFilter',
@@ -298,18 +339,16 @@ const KNOWN_PROFILE_FIELDS = new Set([
 ]);
 
 /**
- * Sanitize one profile entry. `options.strict`:
- *   - strict=false (migration read): an over-length persona is KEPT (not
- *     truncated) and warned; over-limit maxTokens/maxDepth and illegal
- *     toolFilter subfields are dropped (field removed) + warned.
- *   - strict=true (write path): an over-length persona is also REMOVED from
- *     clean and warned, so the caller can reject the whole write with a 400.
- * Non-rejection normalizations (description/name flatten, toolFilter dedupe) are
- * silent and never produce a warning.
+ * 净化一条 profile。`options.strict`：
+ *   - strict=false（迁移读取）：超长 persona 保留（不截断）并告警；超限
+ *     maxTokens/maxDepth 与非法 toolFilter 子字段丢弃（字段移除）+ 告警。
+ *   - strict=true（写路径）：超长 persona 也从 clean 移除并告警，调用方可
+ *     用 400 拒绝整次写入。
+ * 非拒绝型规范化（description/name 压平、toolFilter 去重）静默进行，绝不告警。
  *
- * Security: `clean` is `Object.create(null)` (no inherited `__proto__`
- * setter) and only whitelisted fields are copied, so a hostile `__proto__` /
- * `constructor` / `prototype` key is ignored rather than polluting the result.
+ * 安全：`clean` 是 `Object.create(null)`（无继承的 `__proto__` setter），且只
+ * 复制白名单字段，敌意的 `__proto__` / `constructor` / `prototype` 键被忽略而
+ * 不会污染结果。
  */
 export function sanitizeProfile(profile, options = {}) {
   const { strict = false } = options;
@@ -325,8 +364,13 @@ export function sanitizeProfile(profile, options = {}) {
       continue;
     }
     switch (key) {
+      case 'id':
+      case 'preset':
       case 'name':
       case 'description':
+        // id/preset 与 name/description 同走文本采样：压平换行，阻断经 \n 注入
+        // orchestrator systemPrompt 的提示注入面（H1）。id/preset 此前走 default
+        // 分支原样拷贝，可注入换行破坏 dispatch:profiles 行。
         sanitizeTextField(key, value, clean, warnings);
         break;
       case 'persona':