odai-dsh-agent 0.0.3 → 0.0.5

package/README.md

@@ -35,7 +35,7 @@ Open a new DSH session and select `Odai` from the Agent preset picker. Existing
 
 In `dsh@0.1.0-rc.6`, the one-shot `--profile headless` driver creates a global agent directly and neither mounts nor accepts a session Agent preset. Automated Agent runs must create a Web session with `agentPreset: odai`; use the profile-wide Plugin for one-shot headless tasks.
 
-The installer copies through a mode-tightened staging directory and atomically publishes the preset. Updates verify every previously managed file first, refuse to overwrite local edits, and always change the composition generation key so new sessions in a running DSH process do not reuse stale runtime code.
+The installer copies through a mode-tightened staging directory and atomically publishes the preset. Updates verify every previously managed file first, refuse to overwrite local edits, and always change the composition generation key so new sessions in a running DSH process do not reuse stale runtime code. If install or update finds recognized historical Odai audit records, it refuses to change the preset until every DSH process is stopped and the command is rerun with `--yes`. The confirmed migration adds DSH's official `ignorable: true` envelope marker, covers both plaintext and concatenated-frame Zstandard session artifacts, verifies each replacement, and retains a content-addressed backup without deleting messages or evidence. Confirmation alone is insufficient: migration also refuses when local process inspection fails or finds any active DSH process. Keep DSH stopped until the installer exits because historical runtimes do not participate in a migration lock. An unknown unmarked `odai/*` type blocks the operation instead of being assumed safe to ignore.
 
 DSH classifies this as a `trust: user` preset. User presets have the same privileges as shell access, so install only reviewed package versions; the installer repeats this trust notice in both plain and JSON output.
 
@@ -49,10 +49,20 @@ The Agent ships no planner, executor, or reviewer model mapping. It stays quiet
 验收改用 provider-z/model-review，推理档 max。
 ```
 
-The controller calls `odai_routing_config` to persist that explicit choice. The user does not edit Agent files, YAML, or JSON and does not add trigger terms to later tasks. Mappings live in `$DSH_HOME/odai/routing.json`, outside the managed preset, so installer updates do not report them as drift. Changes apply from the next user turn. If reasoning effort is omitted, the target provider/model uses its own default rather than inheriting the source controller's setting. Plugin and Agent read the same store when both are deliberately present.
+The controller calls `odai_routing_config` to persist that explicit choice. The user does not edit Agent files, YAML, or JSON and does not add trigger terms to later tasks. Mappings live in `$DSH_HOME/odai/routing.json`, outside the managed preset, so installer updates do not report them as drift. Audit evidence likewise lives under `$DSH_HOME/odai/session-evidence/` instead of using private DSH session-event types, so changing or removing the preset cannot make a session unreadable. Changes apply from the next user turn. If reasoning effort is omitted, the target provider/model uses its own default rather than inheriting the source controller's setting. Plugin and Agent read the same stores when both are deliberately present.
 
 Planner, executor, and reviewer are independent optional responsibilities. If any needed one has no mapping, high-impact work fails closed and remains read-only; lower-impact work continues only where it does not depend on the missing independent responsibility. Odai never chooses a model on the user's behalf.
 
+## Skill sources
+
+The Agent keeps the managed preset's complete skill copy as its `bundled` default, so existing installations do not change behavior. When the user explicitly asks to show, set, or reset the Odai skill source, the controller uses `odai_skill_source_config` and stores the choice in `$DSH_HOME/odai/source.json`, outside the managed preset:
+
+- `bundled`: use the skill shipped with this Agent release.
+- `auto`: allow a compatible current-project `.dsh/skills/odai` or `.agents/skills/odai` bundle, then DSH custom roots and newer user installs under `$DSH_HOME/skills/odai` or `$DSH_AGENTS_HOME/skills/odai` (default `~/.agents/skills/odai`), with bundled fallback.
+- `user`: ignore project roots and require a compatible custom or user-level bundle. An unusable source produces an explicit bundled fallback diagnostic so it can be repaired through the same tool.
+
+An independent install must be a complete directory bundle containing `SKILL.md`, `manifest.json`, and every manifest-declared file. The runtime checks SemVer 2.0.0 `skillVersion`, an exact supported `runtimeContract`, complete-file SHA-256 integrity, and same-version content conflicts. Prompt governance and routing role contracts are selected atomically for one agent turn; project sources are scoped by that session's cwd, and changes are reconsidered on the next user turn. Explicit deployment `skillPath` or `ODAI_SKILL_PATH` remains highest priority and requires a DSH restart.
+
 ## Status and uninstall
 
 ```sh
@@ -61,7 +71,7 @@ npx odai-dsh-agent status --json
 npx odai-dsh-agent uninstall
 ```
 
-`status` reports `absent`, `installed`, or `drifted`. Update and uninstall fail closed when managed files were changed or unmanaged files were added. Uninstall also refuses while `agent-presets.default` still names `odai`; select another default first so the next session cannot fail on a missing preset.
+`status` reports `absent`, `installed`, or `drifted`. Update and uninstall fail closed when managed files were changed or unmanaged files were added. Uninstall first checks for legacy Odai session events and, when any exist, requires the same stopped-DSH `--yes` confirmation before making them ignorable; a failed inspection or migration refuses removal. It also refuses while `agent-presets.default` still names `odai`; select another default first so the next session cannot fail on a missing preset. Stop DSH before install, update, or uninstall so session artifacts are not being written concurrently.
 
 ## Plugin versus Agent
 
@@ -71,7 +81,7 @@ Use only the surface that matches the desired scope:
 - `odai-dsh-agent`: selectable Odai governance for only sessions using this preset.
 - both: supported only for a deliberate combination of profile-wide and Agent-scoped behavior; normally redundant, so it is not the default recommendation.
 
-When both are deliberate, durable tool and route evidence is deduplicated and denials remain monotonic. Neither package installs or changes the provider-neutral `odai-cli`.
+When both are deliberate, a process-shared per-agent/per-turn skill snapshot keeps prompt governance and role contracts identical, the compatibility-safe evidence store deduplicates tool and route records, and denials remain monotonic. Neither package installs or changes the provider-neutral `odai-cli`.
 
 ## Development
 

package/bin/odai-dsh-agent.mjs

@@ -18,6 +18,7 @@ Commands:
 Options:
   --dsh-home <path>  Override DSH_HOME
   --json             Print JSON
+  --yes              Confirm DSH is stopped; active-process verification still applies
   -h, --help         Show this help
 `;
 
@@ -27,13 +28,19 @@ try {
     process.stdout.write(HELP);
   } else if (args.command === "install") {
     assertDshVersion();
-    print(await installAgentPreset({ dshHome: args.dshHome }), args.json);
+    print(await installAgentPreset({
+      dshHome: args.dshHome,
+      confirmDshStopped: args.yes,
+    }), args.json);
   } else if (args.command === "status") {
     const result = await inspectAgentInstallation({ dshHome: args.dshHome });
     print(result, args.json);
     if (result.status === "drifted") process.exitCode = 2;
   } else if (args.command === "uninstall") {
-    print(await uninstallAgentPreset({ dshHome: args.dshHome }), args.json);
+    print(await uninstallAgentPreset({
+      dshHome: args.dshHome,
+      confirmDshStopped: args.yes,
+    }), args.json);
   } else {
     throw new Error("a command is required\n\n" + HELP);
   }
@@ -56,11 +63,12 @@ function assertDshVersion() {
 }
 
 function parseArgs(argv) {
-  const parsed = { command: undefined, dshHome: undefined, json: false, help: false };
+  const parsed = { command: undefined, dshHome: undefined, json: false, yes: false, help: false };
   for (let index = 0; index < argv.length; index += 1) {
     const arg = argv[index];
     if (arg === "-h" || arg === "--help") parsed.help = true;
     else if (arg === "--json") parsed.json = true;
+    else if (arg === "--yes") parsed.yes = true;
     else if (arg === "--dsh-home") parsed.dshHome = argv[++index];
     else if (!parsed.command && ["install", "status", "uninstall"].includes(arg)) parsed.command = arg;
     else throw new Error(`unknown argument: ${arg}`);
@@ -82,5 +90,17 @@ function print(result, json) {
     return;
   }
   process.stdout.write(`${result.operation}: ${result.target}\n`);
+  if (result.sessionCompatibility?.repairedEvents > 0) {
+    process.stdout.write(`session compatibility: made ${result.sessionCompatibility.repairedEvents} legacy Odai event(s) ignorable in ${result.sessionCompatibility.repairedArtifacts} session artifact(s)\n`);
+  }
+  if (result.sessionCompatibility?.backupPaths?.length > 0) {
+    process.stdout.write(`session compatibility: retained ${result.sessionCompatibility.backupPaths.length} verified backup artifact(s)\n`);
+  }
+  for (const path of result.sessionCompatibility?.tornArtifacts ?? []) {
+    process.stdout.write(`session compatibility warning: preserved DSH-recoverable torn tail: ${path}\n`);
+  }
+  for (const failure of result.sessionCompatibility?.failures ?? []) {
+    process.stdout.write(`session compatibility warning: ${failure.path}: ${failure.error}\n`);
+  }
   if (result.security) process.stdout.write(`security: ${result.security}\n`);
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "odai-dsh-agent",
-  "version": "0.0.3",
-  "description": "完整继承 DSH Standard 全部能力的 Odai Agent preset。",
+  "version": "0.0.5",
+  "description": "完整继承 DSH 标准模式 全部能力的 Odai Agent preset。主要用于治理、规划、测试、验证 等，可当成默认总控使用。",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -56,7 +56,7 @@
     }
   },
   "engines": {
-    "node": ">=20"
+    "node": ">=22.15.0"
   },
   "keywords": [
     "agent",

package/preset/odai/preset.yml

@@ -1,3 +1,3 @@
-name: Odai
+name: odai 治理模式
 order: 40
-description: 完整继承 DSH Standard 全部能力，并叠加 Odai 治理、证据与自动路由。
+description: 完整继承 DSH 标准模式 全部能力，并叠加 odai 治理、证据与自动路由，以 odai 为总控。

package/preset/odai/runtime/governance.mjs

@@ -57,9 +57,9 @@ export function createChildToolGuard(options = {}) {
   };
 }
 
-export function activeRouteProtection(agent) {
+export function activeRouteProtection(agent, recordedEvents = agent?.session?.events) {
   if (isSubagent(agent)) return undefined;
-  const events = agent?.session?.events;
+  const events = recordedEvents;
   if (!Array.isArray(events)) return undefined;
 
   let currentTurn;

package/preset/odai/runtime/index.mjs

@@ -1,11 +1,11 @@
 import { randomUUID } from "node:crypto";
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 
 import {
   decideRoute,
-  extractLatestUserText,
+  extractRoutingText,
   renderDelegationPrompt,
   renderMissingRouteConfigNotice,
   renderRouteFailureNotice,
@@ -26,6 +26,24 @@ import {
   resolveRoleRoute,
   resolveRoutingConfigPath,
 } from "./routing-config.mjs";
+import { createSessionEvidence, resolveSessionEvidenceRoot } from "./session-evidence.mjs";
+import {
+  SKILL_SOURCE_CONFIG_PROMPT,
+  createSkillSourceConfigTool,
+  effectiveSkillSource,
+  resolveSkillSourceConfigPath,
+} from "./skill-source-config.mjs";
+import {
+  ODAI_RUNTIME_CONTRACT,
+  SKILL_SOURCE_MODES,
+  loadSkillBundle,
+} from "./skill-bundle.mjs";
+import { resolveSkillSelection } from "./skill-selector.mjs";
+import {
+  currentAgentTurn,
+  selectSharedSkillForTurn,
+  sharedSkillSelection,
+} from "./skill-selection-state.mjs";
 
 export const name = "odai-dsh-runtime";
 export const inject = ["systemPrompt", "tools", "subagents"];
@@ -53,6 +71,8 @@ export function resolveConfig(rawConfig = {}) {
   const maxInputChars = routing.maxInputChars ?? 12_000;
   const configPath = resolveRoutingConfigPath(routing.configPath);
   const additionalDeniedTools = governance.additionalDeniedTools ?? [];
+  const skillSource = governance.skillSource ?? "bundled";
+  const skillConfigPath = resolveSkillSourceConfigPath(governance.skillConfigPath);
   const unknownRoles = Object.keys(roles).filter((role) => !ROUTED_ROLES.includes(role));
 
   if (!ROUTING_MODES.has(mode)) {
@@ -71,6 +91,9 @@ export function resolveConfig(rawConfig = {}) {
     || additionalDeniedTools.some((tool) => typeof tool !== "string" || tool.trim() === "")) {
     throw new TypeError("config.governance.additionalDeniedTools must be an array of non-empty strings");
   }
+  if (!SKILL_SOURCE_MODES.includes(skillSource)) {
+    throw new TypeError("config.governance.skillSource must be bundled, auto, or user");
+  }
   if (raw.skillPath !== undefined && (typeof raw.skillPath !== "string" || raw.skillPath.trim() === "")) {
     throw new TypeError("config.skillPath must be a non-empty string");
   }
@@ -89,32 +112,31 @@ export function resolveConfig(rawConfig = {}) {
     }),
     governance: Object.freeze({
       additionalDeniedTools: Object.freeze(additionalDeniedTools.map((tool) => tool.trim())),
+      skillSource,
+      skillConfigPath,
     }),
   });
 }
 
-export function resolveSkillPath(configuredPath) {
+export function resolveSkillPath(configuredPath, env = process.env) {
+  const explicit = configuredPath ?? env.ODAI_SKILL_PATH;
+  if (explicit !== undefined) {
+    const path = resolve(explicit);
+    if (!existsSync(path)) throw new Error(`explicit Odai canonical skill not found: ${path}`);
+    return path;
+  }
+
   const candidates = [
-    configuredPath,
-    process.env.ODAI_SKILL_PATH,
     resolve(PLUGIN_DIR, "skills/odai/SKILL.md"),
     resolve(PLUGIN_DIR, "../../skills/odai/SKILL.md"),
-  ].filter(Boolean).map((candidate) => resolve(candidate));
-
+  ];
   const found = candidates.find((candidate) => existsSync(candidate));
   if (found) return found;
-
-  throw new Error(`odai canonical skill not found; checked: ${candidates.join(", ")}`);
+  throw new Error(`Odai bundled canonical skill not found; checked: ${candidates.join(", ")}`);
 }
 
 export function loadRoleContracts(skillPath) {
-  const roleRoot = resolve(dirname(skillPath), "assets/routing-roles");
-  return Object.freeze(Object.fromEntries(ROUTED_ROLES.map((role) => {
-    const path = resolve(roleRoot, `${role}.md`);
-    const text = existsSync(path) ? readFileSync(path, "utf8").trim() : "";
-    if (!text) throw new Error(`odai canonical ${role} role is unavailable: ${path}`);
-    return [role, text];
-  })));
+  return loadSkillBundle(skillPath).roleContracts;
 }
 
 function deepFreeze(value) {
@@ -142,20 +164,6 @@ function loggerFor(ctx) {
   return ctx.logger(name);
 }
 
-function appendEvent(agent, type, data, logger) {
-  try {
-    agent?.session?.append(type, data);
-  } catch (error) {
-    logger.warn(`failed to append ${type}: ${error instanceof Error ? error.message : String(error)}`);
-  }
-}
-
-function hasSessionEvent(agent, type, predicate) {
-  const events = agent?.session?.events;
-  if (!Array.isArray(events)) return false;
-  return events.some((event) => event?.type === type && predicate(event.data));
-}
-
 function outputText(blocks) {
   if (!Array.isArray(blocks)) return "";
   return blocks
@@ -276,13 +284,20 @@ export async function runRoutedRole({ subagents, provider, decision, taskText, r
   return outcome;
 }
 
-function canonicalPrompt(skillPath, skillText) {
+function canonicalPrompt(selection) {
+  const { bundle } = selection;
+  const fallback = selection.status === "fallback"
+    ? `Selection fallback: ${selection.reasonCode}${selection.detail ? ` (${selection.detail})` : ""}.`
+    : undefined;
   return [
     "## odai canonical governance",
-    `Canonical source: ${skillPath}`,
+    `Canonical source: ${bundle.source} (${bundle.provider})`,
+    `Canonical skill: ${bundle.manifest.skillVersion}; runtime contract: ${bundle.manifest.runtimeContract}; digest: ${bundle.digest}.`,
+    ...(fallback ? [fallback] : []),
     "Apply this governance to every request. Keep the controller as the final delivery owner; use another role only for a real independent gap with observable net benefit.",
+    "Odai governance is already loaded by this runtime; do not call the skill tool to load odai again.",
     "",
-    skillText,
+    bundle.skillText,
   ].join("\n");
 }
 
@@ -303,21 +318,116 @@ function routedRoleOf(agent) {
 export function apply(ctx, rawConfig) {
   const config = resolveConfig(rawConfig);
   const logger = loggerFor(ctx);
+  const evidence = createSessionEvidence({
+    root: resolveSessionEvidenceRoot(config.routing.configPath),
+    logger,
+  });
+  const appendEvent = (agent, type, data) => {
+    try {
+      evidence.append(agent, type, data);
+    } catch (error) {
+      logger.warn(`failed to record ${type}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  };
+  const hasSessionEvent = (agent, type, predicate) => evidence.has(agent, type, predicate);
   const skillPath = resolveSkillPath(config.skillPath);
-  const skillText = readFileSync(skillPath, "utf8").trim();
-  if (!skillText) throw new Error(`odai canonical skill is empty: ${skillPath}`);
-  const roleContracts = loadRoleContracts(skillPath);
+  const explicitSkillPath = config.skillPath !== undefined
+    || (typeof process.env.ODAI_SKILL_PATH === "string" && process.env.ODAI_SKILL_PATH.trim() !== "");
+  const bundled = loadSkillBundle(skillPath, {
+    source: explicitSkillPath ? "path" : "bundled",
+    provider: explicitSkillPath ? "odai-explicit-path" : "odai-dsh-runtime",
+  });
+  if (bundled.manifest.runtimeContract !== ODAI_RUNTIME_CONTRACT) {
+    throw new Error(`Odai canonical runtimeContract ${bundled.manifest.runtimeContract} is incompatible with this runtime`);
+  }
+  const baseSelection = Object.freeze({
+    mode: explicitSkillPath ? "path" : "bundled",
+    status: "selected",
+    reasonCode: explicitSkillPath ? "explicit-path" : "bundled-configured",
+    bundle: bundled,
+    rejections: Object.freeze([]),
+  });
 
   ctx.systemPrompt.section({
     name: "odai:canonical-governance",
     order: -20,
-    text: canonicalPrompt(skillPath, skillText),
+    text: canonicalPrompt(baseSelection),
   });
   ctx.systemPrompt.section({
     name: "odai:routing-configuration",
     order: -19,
     text: ROUTING_CONFIG_PROMPT,
   });
+  ctx.systemPrompt.section({
+    name: "odai:skill-source-configuration",
+    order: -18,
+    text: SKILL_SOURCE_CONFIG_PROMPT,
+  });
+
+  const optionalSkillRegistry = () => {
+    try {
+      if (ctx.skills && typeof ctx.skills.get === "function") return ctx.skills;
+    } catch {}
+    try {
+      const service = typeof ctx.get === "function" ? ctx.get("skills") : undefined;
+      return service && typeof service.get === "function" ? service : undefined;
+    } catch {
+      return undefined;
+    }
+  };
+  const selectForAgent = async (agent, context) => {
+    if (explicitSkillPath) return baseSelection;
+    let mode;
+    try {
+      mode = effectiveSkillSource(config.governance.skillConfigPath, config.governance.skillSource);
+    } catch (error) {
+      return Object.freeze({
+        ...baseSelection,
+        mode: "bundled",
+        status: "fallback",
+        reasonCode: "source-config-invalid",
+        detail: error instanceof Error ? error.message : String(error),
+      });
+    }
+    return resolveSkillSelection({
+      mode,
+      bundled,
+      cwd: agent.session?.header?.cwd,
+      scope: context.scope,
+      signal: context.signal,
+      skills: optionalSkillRegistry(),
+    });
+  };
+  ctx.on("system-prompt/assemble", async (assembly, context, next) => {
+    const downstream = await next();
+    const agent = context.agent;
+    if (!agent) return downstream;
+    const selection = await selectSharedSkillForTurn(agent, () => selectForAgent(agent, context));
+    const turn = currentAgentTurn(agent);
+    const selectionEvidence = {
+      ...(turn === undefined ? {} : { turn }),
+      requestedMode: selection.mode,
+      status: selection.status,
+      reasonCode: selection.reasonCode,
+      effectiveSource: selection.bundle.source,
+      skillVersion: selection.bundle.manifest.skillVersion,
+      runtimeContract: selection.bundle.manifest.runtimeContract,
+      digest: selection.bundle.digest,
+      rejections: selection.rejections.map(({ source, reasonCode }) => ({ source, reasonCode })),
+    };
+    if (!hasSessionEvent(agent, "odai/skill-selected", (data) => data?.turn === turn && data?.digest === selection.bundle.digest)) {
+      appendEvent(agent, "odai/skill-selected", selectionEvidence);
+    }
+    if (selection.status === "fallback") {
+      logger.warn(`Odai skill source ${selection.mode} fell back to bundled governance (${selection.reasonCode})`);
+    }
+    return {
+      ...downstream,
+      sections: downstream.sections.map((section) => section.name === "odai:canonical-governance"
+        ? { ...section, text: canonicalPrompt(selection) }
+        : section),
+    };
+  });
 
   const routeProtections = new WeakMap();
   const controllerUpgrades = new WeakMap();
@@ -347,10 +457,24 @@ export function apply(ctx, rawConfig) {
     onDenied,
     protectionFor(agent) {
       if (config.routing.mode === "off") return undefined;
-      return routeProtections.get(agent) ?? activeRouteProtection(agent);
+      return routeProtections.get(agent) ?? activeRouteProtection(agent, evidence.events(agent));
     },
   });
-  ctx.tools.register(createRoutingConfigTool(config.routing.configPath));
+  ctx.tools.register(createRoutingConfigTool(config.routing.configPath, {
+    onConfigured(agent, data) {
+      appendEvent(agent, "odai/routing-configured", data);
+    },
+  }));
+  ctx.tools.register(createSkillSourceConfigTool(
+    config.governance.skillConfigPath,
+    config.governance.skillSource,
+    {
+      explicitPath: explicitSkillPath,
+      onConfigured(agent, data) {
+        appendEvent(agent, "odai/skill-source-configured", data);
+      },
+    },
+  ));
   ctx.tools.guard((execution) => childGuard(execution) ?? routeProtectionGuard(execution));
 
   ctx.on("tools/result", (execution, result) => {
@@ -420,7 +544,7 @@ export function apply(ctx, rawConfig) {
       if (routed.has(routeKey)) return downstream;
       routed.add(routeKey);
 
-      const taskText = extractLatestUserText(downstream.messages).slice(0, config.routing.maxInputChars);
+      const taskText = extractRoutingText(downstream.messages, agent?.session?.events).slice(0, config.routing.maxInputChars);
       const decision = decideRoute({ text: taskText });
       const routeRole = decision.targetRole ?? decision.role;
       appendEvent(agent, "odai/route-decided", {
@@ -517,7 +641,7 @@ export function apply(ctx, rawConfig) {
             provider: config.routing.provider,
             decision: delegationDecision,
             taskText,
-            roleContract: roleContracts[routeRole],
+            roleContract: (sharedSkillSelection(agent, turn)?.bundle ?? bundled).roleContracts[routeRole],
             agent,
             signal,
             roleRoute,
@@ -574,7 +698,7 @@ export function apply(ctx, rawConfig) {
     }, { prepend: true });
   }
 
-  logger.info(`loaded canonical governance from ${skillPath}; routing=${config.routing.mode}`);
+  logger.info(`loaded canonical governance ${bundled.manifest.skillVersion} from ${skillPath}; skillSource=${explicitSkillPath ? "path" : config.governance.skillSource}; routing=${config.routing.mode}`);
 }
 
 function isSubagentSession(agent) {

package/preset/odai/runtime/router.mjs

@@ -60,6 +60,16 @@ const IRREVERSIBLE_ACTION_PATTERNS = [
   /\b(?:delete|drop|clear|migrate|deploy|release|disable)\b/iu,
 ];
 
+const CONTINUATION_PATTERNS = [
+  /(?:继续|接着|进一步|深入|再(?:判断|分析|评估|检查|处理)|按(?:照)?(?:刚才|上面|上述|前面|这个|该)|那就|就按)/iu,
+  /\b(?:continue|proceed|go ahead|follow up|dig deeper|based on (?:that|the previous|the above))\b/iu,
+];
+
+const LOW_RISK_TRANSFORM_PATTERNS = [
+  /(?:重述|总结|概括|压缩|翻译|改写|润色|格式化|解释(?:一下)?)/iu,
+  /\b(?:restate|summari[sz]e|translate|shorten|rewrite|format|explain)\b/iu,
+];
+
 function matchesAny(text, patterns) {
   return patterns.some((pattern) => pattern.test(text));
 }
@@ -72,6 +82,48 @@ function stripQuotedMaterial(text) {
     .replace(/“[^”\n]*”|‘[^’\n]*’|「[^」\n]*」|『[^』\n]*』|《[^》\n]*》|"[^"\n]*"/gu, " ");
 }
 
+function hasContextualPlannerGap(text) {
+  return matchesAny(text, RISK_PATTERNS)
+    && matchesAny(text, UNVERIFIED_CAUSAL_PATTERNS)
+    && matchesAny(text, CONCRETE_CHANGE_PATTERNS)
+    && (matchesAny(text, SPECIFIC_PARAMETER_PATTERNS)
+      || matchesAny(text, URGENCY_PATTERNS)
+      || matchesAny(text, IRREVERSIBLE_ACTION_PATTERNS));
+}
+
+function isLowRiskTransform(text) {
+  return matchesAny(stripQuotedMaterial(text), LOW_RISK_TRANSFORM_PATTERNS);
+}
+
+function genuineUserText(message) {
+  if (message?.role !== "user" || message?.source?.kind !== "user" || !Array.isArray(message.content)) return "";
+  return message.content
+    .filter((block) => block?.type === "text" && typeof block.text === "string")
+    .map((block) => block.text)
+    .join("\n")
+    .trim();
+}
+
+function genuineUserTexts(messages, sessionEvents = []) {
+  const candidates = [
+    ...(Array.isArray(messages) ? [...messages].reverse() : []),
+    ...(Array.isArray(sessionEvents)
+      ? [...sessionEvents].reverse()
+        .filter((event) => event?.type === "user/message")
+        .map((event) => event.data)
+      : []),
+  ];
+  const seen = new Set();
+  const texts = [];
+  for (const message of candidates) {
+    const text = genuineUserText(message);
+    if (!text || seen.has(text)) continue;
+    seen.add(text);
+    texts.push(text);
+  }
+  return texts;
+}
+
 function route(role, reasonCode, reason, signals, action = role === "controller" ? "direct" : "delegate", targetRole) {
   return Object.freeze({
     role,
@@ -137,11 +189,11 @@ export function decideRoute(input = {}) {
     );
   }
 
-  const hasContextualPlannerGap = riskPresent
+  const contextualPlannerGap = riskPresent
     && unverifiedCausalClaim
     && concreteChangeRequest
     && (specificOperationalParameter || urgencyPressure || irreversibleAction);
-  if (hasContextualPlannerGap) {
+  if (contextualPlannerGap) {
     return route(
       "controller",
       HIGH_IMPACT_PLANNER_REASON,
@@ -162,23 +214,29 @@ export function decideRoute(input = {}) {
 }
 
 export function extractLatestUserText(messages) {
-  if (!Array.isArray(messages)) return "";
-
-  for (let index = messages.length - 1; index >= 0; index -= 1) {
-    const message = messages[index];
-    if (message?.role !== "user") continue;
-    if (message?.source?.kind !== "user") continue;
-    if (!Array.isArray(message.content)) continue;
-
-    const text = message.content
-      .filter((block) => block?.type === "text" && typeof block.text === "string")
-      .map((block) => block.text)
-      .join("\n")
-      .trim();
-    if (text) return text;
+  return genuineUserTexts(messages)[0] ?? "";
+}
+
+export function extractRoutingText(messages, sessionEvents) {
+  const texts = genuineUserTexts(messages, sessionEvents);
+  const latest = texts[0] ?? "";
+  if (!latest
+    || hasContextualPlannerGap(latest)
+    || !matchesAny(stripQuotedMaterial(latest), CONTINUATION_PATTERNS)
+    || isLowRiskTransform(latest)) {
+    return latest;
   }
 
-  return "";
+  let referencedHighImpact;
+  for (const text of texts.slice(1)) {
+    if (hasContextualPlannerGap(text)) {
+      referencedHighImpact = text;
+      break;
+    }
+    if (!isLowRiskTransform(text)) break;
+  }
+  if (!referencedHighImpact) return latest;
+  return `${latest}\n\nReferenced earlier high-impact user context:\n${referencedHighImpact}`;
 }
 
 export function requiresFailClosedProtection(decision) {
@@ -283,6 +341,7 @@ export function renderDelegationPrompt(decision, taskText, roleContract) {
     `You are the odai ${decision.role}.`,
     roleContract.trim(),
     "Runtime boundary: do not edit files, run shell commands, ask the user, or delegate further. The controller owns all final decisions and delivery.",
+    "Context boundary: this is a bounded task and evidence packet, not an inherited controller transcript. Use only the supplied contract, task, evidence, and source pointers; do not request or reconstruct the controller's full history.",
     "",
     "Task:",
     taskText,

package/preset/odai/runtime/routing-config.mjs

@@ -180,7 +180,8 @@ function resultFor(configPath, action, roles, responsibility, recoveredInvalidSt
   };
 }
 
-export function createRoutingConfigTool(configPath) {
+export function createRoutingConfigTool(configPath, options = {}) {
+  const onConfigured = typeof options.onConfigured === "function" ? options.onConfigured : () => {};
   return {
     name: "odai_routing_config",
     description: [
@@ -301,7 +302,7 @@ export function createRoutingConfigTool(configPath) {
         if (args.action === "remove") delete roles[args.responsibility];
         else roles[args.responsibility] = proposedRoute;
         writeRoutingStore(configPath, roles);
-        execution.agent.session?.append?.("odai/routing-configured", {
+        onConfigured(execution.agent, {
           action: args.action,
           responsibility: args.responsibility,
           route: roles[args.responsibility],