pi-web-ui 0.96.1 → 0.98.0

package/dist/server/dsh/dsh-client.js

@@ -78,6 +78,7 @@ export class DshRuntime {
     notificationHandler = null;
     stderrTail = "";
     closed = false;
+    disposed = false;
     initialized = false;
     /** PI_WEB_DSH_DEBUG=1 时把 RPC 帧/生命周期事件打到 stderr（诊断用，默认关）。 */
     debugEnabled = process.env.PI_WEB_DSH_DEBUG === "1";
@@ -122,6 +123,9 @@ export class DshRuntime {
     }
     /** 启动子进程 + initialize 握手（幂等；并发调用共享同一个启动任务）。 */
     start() {
+        if (this.disposed) {
+            return Promise.reject(new DshTransportError(bilingual("client has been disposed", "客户端已销毁")));
+        }
         if (this.alive && this.initialized)
             return Promise.resolve();
         if (!this.startPromise) {
@@ -136,7 +140,9 @@ export class DshRuntime {
             throw new DshTransportError(bilingual(`launcher missing: ${this.launcher}`, `launcher 不存在: ${this.launcher}`));
         }
         if (!existsSync(this.jsonrpcEntry)) {
-            throw new DshTransportError(bilingual(`dsh-sdk-jsonrpc-server is not installed (missing ${this.jsonrpcEntry}). Run npm i @deepseek-ai/dsh-sdk-jsonrpc-server@0.1.1-rc.2 first`, `dsh-sdk-jsonrpc-server 未安装（缺 ${this.jsonrpcEntry}）。请先 npm i @deepseek-ai/dsh-sdk-jsonrpc-server@0.1.1-rc.2`));
+            // 不写死版本号：依赖版本会随 package.json 升（见 docs/dsh-engine.md §1
+            // 「版本族」），写死的提示迟早骗人。报当前实际解析到的路径即可。
+            throw new DshTransportError(bilingual(`dsh-sdk-jsonrpc-server is not installed (missing ${this.jsonrpcEntry}). Run npm i (see docs/dsh-engine.md for the pinned version family) first`, `dsh-sdk-jsonrpc-server 未安装（缺 ${this.jsonrpcEntry}）。请先 npm i（版本族见 docs/dsh-engine.md）`));
         }
         const key = loadDeepSeekKey(this.agentDir);
         const env = {
@@ -268,7 +274,10 @@ export class DshRuntime {
         if (!proc || !proc.stdin || proc.stdin.destroyed) {
             throw new DshTransportError(bilingual("runtime not started", "runtime 未启动"));
         }
-        proc.stdin.write(JSON.stringify(msg) + "\n");
+        const ok = proc.stdin.write(JSON.stringify(msg) + "\n");
+        if (!ok) {
+            this.debug("stdin buffer full, backpressure triggered");
+        }
     }
     /**
      * 向一个会话排队 prompt。返回持久化收据 messageId（运行时接受即 resolve）。
@@ -409,8 +418,9 @@ export class DshRuntime {
     }
     /** 优雅关闭：shutdown 握手 → stdin EOF → SIGTERM → SIGKILL 阶梯。 */
     async close() {
-        if (this.closed)
+        if (this.disposed)
             return;
+        this.disposed = true;
         this.closed = true;
         const proc = this.proc;
         if (!proc || proc.exitCode !== null) {
@@ -485,16 +495,44 @@ export class DshRuntime {
         this.failPending(new DshTransportError(bilingual("runtime killed (interrupt)", "运行时已被终止（中断）")));
         try {
             if (process.platform === "win32") {
-                const killer = spawn("taskkill", ["/pid", String(pid), "/T", "/F"], {
-                    stdio: "ignore",
-                    windowsHide: true,
-                });
-                killer.on("error", () => {
+                await new Promise((resolve) => {
+                    let settled = false;
+                    const done = () => {
+                        if (!settled) {
+                            settled = true;
+                            clearTimeout(timer);
+                            resolve();
+                        }
+                    };
+                    const timer = setTimeout(done, 1500);
                     try {
-                        proc.kill("SIGKILL");
+                        const killer = spawn("taskkill", ["/pid", String(pid), "/T", "/F"], {
+                            stdio: "ignore",
+                            windowsHide: true,
+                        });
+                        killer.on("close", (code) => {
+                            if (code !== 0) {
+                                try {
+                                    proc.kill("SIGKILL");
+                                }
+                                catch { }
+                            }
+                            done();
+                        });
+                        killer.on("error", () => {
+                            try {
+                                proc.kill("SIGKILL");
+                            }
+                            catch { }
+                            done();
+                        });
                     }
                     catch {
-                        /* already dead */
+                        try {
+                            proc.kill("SIGKILL");
+                        }
+                        catch { }
+                        done();
                     }
                 });
             }

package/dist/server/dsh/dsh-serialize.js

@@ -23,15 +23,8 @@
  *   - streamingMessage：由 assistant/chunk 增量累积（reasoning→thinking、
  *     text→text、tool-call→toolCall），id 用 stream-<会话seq> 稳定跨快照。
  */
-const TEXT_CAP = 200_000;
-const TOOL_OUTPUT_CAP = 100_000;
-const ARGS_CAP = 20_000;
-function truncate(s, cap) {
-    const str = typeof s === "string" ? s : String(s ?? "");
-    if (str.length <= cap)
-        return { text: str, truncated: false };
-    return { text: `${str.slice(0, cap)}\n\n… [truncated]`, truncated: true };
-}
+import { parseTextQuote } from "../text-quote.js";
+import { ARGS_CAP, TEXT_CAP, TOOL_OUTPUT_CAP, truncate } from "../serialize.js";
 /** DSH user-role content blocks → UiContentBlock[]。 */
 export function serializeUserBlocks(blocks) {
     if (!Array.isArray(blocks) || blocks.length === 0) {
@@ -102,10 +95,19 @@ export function toolResultEventToUiMessage(data) {
 }
 /** user/message 事件 data → UiMessage。 */
 export function userMessageEventToUiMessage(data) {
+    const quotes = [];
+    const content = (data.content ?? []).filter((block) => {
+        const quote = block.type === "text" ? parseTextQuote(block.text ?? "") : null;
+        if (!quote)
+            return true;
+        quotes.push(quote);
+        return false;
+    });
     return {
         id: `u-${data.id ?? "?"}`,
         role: "user",
-        content: serializeUserBlocks(data.content ?? []),
+        content: serializeUserBlocks(content),
+        ...(quotes.length ? { details: { quotes } } : {}),
         timestamp: data.time,
     };
 }

package/dist/server/dsh/dsh-sessions.js

@@ -84,14 +84,28 @@ function zstdDecompressAll(buf) {
         }
     }
     let out = "";
-    for (let i = 0; i < starts.length; i++) {
+    let i = 0;
+    while (i < starts.length) {
         const from = starts[i];
-        const to = i + 1 < starts.length ? starts[i + 1] : buf.length;
-        try {
-            out += zstdDecompressSync(buf.subarray(from, to)).toString("utf8");
+        let nextIdx = i + 1;
+        let decompressed = null;
+        // 贪心尝试：若数据体内部误命中魔数导致切帧错误，向后试探合并到下一个魔数直至解压成功（issue #467）
+        while (nextIdx <= starts.length) {
+            const to = nextIdx < starts.length ? starts[nextIdx] : buf.length;
+            try {
+                decompressed = zstdDecompressSync(buf.subarray(from, to));
+                break;
+            }
+            catch {
+                nextIdx++;
+            }
         }
-        catch {
-            /* skip unreadable frame */
+        if (decompressed) {
+            out += decompressed.toString("utf8");
+            i = nextIdx;
+        }
+        else {
+            i++;
         }
     }
     return out || buf.toString("utf8");

package/dist/server/dsh/runtime/goal-rpc.mjs

@@ -870,10 +870,19 @@ class DshGoalJsonRpcServer extends HarnessSdkJsonRpcServer {
 		return new Promise((resolve, reject) => {
 			const timer = setTimeout(() => {
 				const queued = this.questionBridge.queue.findIndex((q) => q.qid === qid);
-				if (queued >= 0) this.questionBridge.queue.splice(queued, 1);
+				if (queued >= 0) {
+					this.questionBridge.queue.splice(queued, 1);
+					// #459：排队条目超时也必须 settle——此前只 splice 不 reject，
+					// 该 ask 的 Promise 永不落定，agent-loop 卡死在工具调用上。
+					reject(new Error("提问超时（等待回答过久）"));
+					return;
+				}
 				if (this.questionBridge.pending?.qid === qid) {
 					this.questionBridge.pending = null;
 					reject(new Error("提问超时（等待回答过久）"));
+					// #459：pending 腾出后必须派发下一个排队提问——否则队列无人派发，
+					// 后续条目只能等各自超时且永不 settle，整条提问桥永久停摆。
+					this.dispatchNextQuestion();
 				}
 			}, QUESTION_TIMEOUT_MS);
 			timer.unref?.();
@@ -939,6 +948,10 @@ class DshGoalJsonRpcServer extends HarnessSdkJsonRpcServer {
 		}
 		const bytes = new Uint8Array(Buffer.from(params.data, "base64"));
 		if (bytes.length === 0) throw new TypeError("attachment/save: empty image data");
+		const MAX_ATTACHMENT_BYTES = 20 * 1024 * 1024; // 20MB 上限
+		if (bytes.length > MAX_ATTACHMENT_BYTES) {
+			throw new RangeError(`attachment/save: image data exceeds 20MB limit (${bytes.length} bytes)`);
+		}
 		const ref = await this.ctx.attachments.saveImage({
 			data: bytes,
 			mediaType,

package/dist/server/dsh/runtime/runtime-root.mjs

@@ -1,5 +1,5 @@
 // Shared runtime-tree resolution for the pi-web-ui DSH runtime.
-// Used by launcher.mjs (boot-time) and probe-mixed.mjs (self-check).
+// Used by launcher.mjs (boot-time) and dev/dsh-probes/probe-mixed.mjs (self-check).
 //
 // A "runtime tree" is a node_modules root that directly contains the dsh
 // runtime packages: `@deepseek-ai/dsh-base` (with its cordis.patch.yml

package/dist/server/ensure-bash.js

@@ -11,9 +11,10 @@
  * Download is fire-and-forget at server start and never throws: on failure
  * the terminal simply falls back to $COMSPEC (cmd.exe) as before.
  */
-import { copyFileSync, existsSync, mkdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { copyFileSync, existsSync, mkdirSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
+import { writeAtomicSync } from "./atomic-file.js";
 /** Official busybox-w32 64-bit Unicode build (Win10 1903+ / Win11). */
 const BUSYBOX_URL = "https://frippery.org/files/busybox/busybox64u.exe";
 /** busybox.exe is ~660KB; anything far smaller is an error page, not a binary. */
@@ -55,7 +56,6 @@ export async function ensureWindowsBash() {
         return null; // Git Bash preferred — nothing to install.
     const dir = windowsBashDir();
     mkdirSync(dir, { recursive: true });
-    const tmp = join(dir, `busybox-${process.pid}.tmp`);
     try {
         const res = await fetch(BUSYBOX_URL, {
             signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS),
@@ -65,13 +65,11 @@ export async function ensureWindowsBash() {
         const buf = Buffer.from(await res.arrayBuffer());
         if (buf.length < MIN_SIZE)
             return null; // error/HTML page, not the exe.
-        writeFileSync(tmp, buf);
-        renameSync(tmp, join(dir, "busybox.exe"));
+        writeAtomicSync(join(dir, "busybox.exe"), buf);
         copyFileSync(join(dir, "busybox.exe"), target);
         return target;
     }
     catch {
-        rmSync(tmp, { force: true });
         return null;
     }
 }

package/dist/server/eval-tool.js

@@ -287,8 +287,9 @@ class EvalKernel {
             this.proc = spawn(pyCmd, ["-u", "-c", PYTHON_DRIVER_SCRIPT], spawnOpts);
         }
         else {
-            // js / ts：独立 node -e 驱动，避免 eval 里的死循环卡住服务端事件循环。
-            this.proc = spawn(process.execPath, ["-e", NODE_DRIVER_SCRIPT], spawnOpts);
+            // js / ts：独立 node -e 驱动，ts 时带 --experimental-strip-types 支持 TypeScript 原生剥离执行。
+            const nodeArgs = this.language === "ts" ? ["--experimental-strip-types", "-e", NODE_DRIVER_SCRIPT] : ["-e", NODE_DRIVER_SCRIPT];
+            this.proc = spawn(process.execPath, nodeArgs, spawnOpts);
         }
         // stderr 必须持续排空：驱动只把用户的 print/console 劫进 StringIO，但
         // os.write(2, …) / 原生扩展 / eval 里再 spawn 的子进程仍写真实 fd 2。
@@ -503,7 +504,9 @@ export function makeEvalTool(opts) {
             code: Type.String({
                 description: "The code snippet to evaluate. Top-level variables and functions are preserved across calls.",
             }),
-            language: Type.Optional(Type.Union([Type.Literal("py"), Type.Literal("js"), Type.Literal("ts")], {
+            language: Type.Optional(Type.Unsafe({
+                type: "string",
+                enum: ["py", "js", "ts"],
                 description: 'Target language: "py" for Python (default), "js" or "ts" for Node.js sandbox.',
             })),
             title: Type.Optional(Type.String({
@@ -567,8 +570,11 @@ export function makeEvalTool(opts) {
             }
             catch (err) {
                 const durationMs = Date.now() - startTime;
-                const errMsg = err.message;
-                const text = `[eval:${language} error (${durationMs}ms)]\n${errMsg}`;
+                let errMsg = err.message;
+                if (errMsg.includes("Python executable not found in PATH")) {
+                    errMsg = pick(lang, "未在系统 PATH 中找到 Python 可执行程序，请安装 Python 或使用 language: 'js'。", "Python executable not found in PATH. Please install Python or use language: 'js'.");
+                }
+                const text = `${pick(lang, `[eval:${language} 出错 (${durationMs}ms)]`, `[eval:${language} error (${durationMs}ms)]`)}\n${errMsg}`;
                 return {
                     content: [{ type: "text", text }],
                     details: {

package/dist/server/goal-review-gate.js

@@ -0,0 +1,250 @@
+/**
+ * server/goal-review-gate.ts
+ *
+ * 目标审查回合的硬闸门（纯函数）：主对话在 `awaitingVerdict` 置位期间是审查者，
+ * 只许只读核实 —— 写类工具 / 非常规 bash / 派发类工具 / 向用户提问一律拒。
+ *
+ * 为什么要硬闸门而不只靠契约：审查回合的提示词只写了「只读核实」，但主对话是
+ * 用户自己的全功能会话，模型在长任务里「顺手改一下」是常态；且 D6 要求轮次由
+ * 服务端控制，派生/等待/指挥别的对话必须拦。闸门是**无状态**的（每次执行只读
+ * `awaitingVerdict` 是否置位），verdict 落定即自动恢复，不存在「钉死只读」。
+ *
+ * 判定全部是纯函数（无 IO），单测见 tests/unit/goal-review-gate.test.ts。
+ * 包裹形态与 withPlanModeGate / withDelegationGate 同构，见 agent-service.ts。
+ *
+ * 已知局限（与计划/审查者闸门同口径）：创建时注册进 customTools 的插件工具
+ * 同样被包裹；但之后经 refreshPluginTools 动态补入已有会话的不在覆盖面。
+ * 自研插件若绕过 wrapper 直接写文件同样拦不住 —— 只读是硬闸门，不是安全边界。
+ */
+import { bashCommandIsReadOnly, SESSION_DISPATCH_TOOLS } from "./plan-mode.js";
+/** 审查回合禁写的工具：与计划/审查者模式同名单（写 / 改 / 增删 / git 写 / 形态变换）。 */
+const WRITE_TOOLS = new Set([
+    // 文件写入与编辑（第一方 + SDK 内置 + 编辑器类扩展的常见名）
+    "write",
+    "create",
+    "create_file",
+    "write_file",
+    "edit",
+    "edit_file",
+    "edit_soft",
+    "apply_patch",
+    "patch",
+    "patch_tool",
+    "str_replace",
+    "str_replace_editor",
+    "multi_edit",
+    "notebook_edit",
+    // 文件系统增删改
+    "mv",
+    "move",
+    "cp",
+    "copy",
+    "mkdir",
+    "rm",
+    "rmdir",
+    "delete",
+    "delete_file",
+    "touch",
+    "chmod",
+    "chown",
+    "truncate",
+    "rename",
+    // 版本控制写（git add/commit/checkout/reset…；只读子命令走 bash 白名单）
+    "git",
+    // 代码求值（eval 沙箱可写真实文件系统 —— 审查回合只读核实，#436）
+    "eval",
+    // 形态变换（会重写整个文件树）
+    "format",
+    "prettier",
+    "lint_fix",
+    "autofix",
+]);
+/**
+ * 审查回合禁掉的「派发类」工具：轮次由服务端控制（D6）—— 派生 / 等待 / 指挥
+ * 别的对话、排程、改模式 / 开新目标都会绕开「一轮 = 派活 + 判定」的口径。
+ * 名单 = 三闸门共用的真实注册派发工具（SESSION_DISPATCH_TOOLS，#436 前是一堆
+ * 幽灵名）。subagent 不在此列：上面的按 action 判定已拦掉全部写向 action，
+ * 只读的 `conversation_read` / subagent get_result/list/templates 放行 ——
+ * 审查者可以按需看执行者的转录（契约要求看实际状态，而不是信描述）。
+ */
+const DISPATCH_TOOLS = SESSION_DISPATCH_TOOLS;
+/** bash 家族（要逐条判命令是否只读；与审查者模式同名单）。 */
+const BASH_TOOLS = new Set(["bash", "shell", "sh", "zsh", "terminal", "terminal_bash", "run_command", "exec"]);
+/** 引号感知的命令切分（按 | ; && || 换行拆段；含 $( / 反引号时整条视为一段交白名单判
+ *  —— 白名单必拒，方向是 fail-closed，这里的拆分只会让判定更严不会放宽）。 */
+function splitReviewSegments(cmd) {
+    if (/[`$]\(/.test(cmd))
+        return [cmd];
+    const out = [];
+    let cur = "";
+    let quote = null;
+    for (let i = 0; i < cmd.length; i++) {
+        const ch = cmd[i];
+        if (quote) {
+            cur += ch;
+            if (ch === quote && cmd[i - 1] !== "\\")
+                quote = null;
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            quote = ch;
+            cur += ch;
+            continue;
+        }
+        if (ch === ";" || ch === "\n") {
+            out.push(cur);
+            cur = "";
+            continue;
+        }
+        if ((ch === "&" || ch === "|") && cmd[i + 1] === (ch === "&" ? "&" : "|")) {
+            out.push(cur);
+            cur = "";
+            i++;
+            continue;
+        }
+        if (ch === "|") {
+            out.push(cur);
+            cur = "";
+            continue;
+        }
+        cur += ch;
+    }
+    out.push(cur);
+    return out.map((s) => s.trim()).filter((s) => s !== "");
+}
+/**
+ * 审查回合额外放行的测试命令：契约承诺审查者可以「跑测试」验结论，而计划模式的
+ * 保守白名单连 `npm test` 都没有（解释器只放 --version/--help）。只认「跑测试」
+ * 的形状（test 脚本 / 各语言测试运行器），`npm run deploy` 这类一律不放；
+ * 重定向 / 反引号沿白名单方向必拒。
+ */
+function isTestRunnerChunk(chunk) {
+    if (/[><`]/.test(chunk))
+        return false;
+    const tokens = chunk.split(/\s+/).filter(Boolean);
+    const first = tokens[0] ?? "";
+    const name = first.slice(first.lastIndexOf("/") + 1);
+    const args = tokens.slice(1);
+    switch (name) {
+        case "npm":
+        case "yarn":
+        case "pnpm":
+        case "bun":
+            return args[0] === "test" || (args[0] === "run" && (args[1] ?? "").startsWith("test"));
+        case "npx":
+            return args[0] === "vitest" || args[0] === "jest" || args[0] === "mocha";
+        case "pytest":
+            return true;
+        case "python":
+        case "python3":
+            return args[0] === "-m" && (args[1] === "pytest" || args[1] === "unittest");
+        case "node":
+            return args[0] === "--test";
+        case "go":
+        case "cargo":
+            return args[0] === "test";
+        case "make":
+            return (args[0] ?? "").startsWith("test") || args[0] === "check";
+        default:
+            return false;
+    }
+}
+/**
+ * 审查回合的 bash 是否可放行：每段要么过计划模式只读白名单，要么是跑测试的形状。
+ * 空命令返回 false（调用方另行处理无命令调用）。
+ */
+export function goalReviewBashAllowed(cmd) {
+    const text = (cmd ?? "").trim();
+    if (!text)
+        return false;
+    const chunks = splitReviewSegments(text);
+    if (chunks.length === 0)
+        return false;
+    return chunks.every((c) => isTestRunnerChunk(c) || bashCommandIsReadOnly(c));
+}
+/** 从工具参数里取命令文本（各工具字段名不同）。 */
+function commandOf(params) {
+    if (!params || typeof params !== "object")
+        return "";
+    const p = params;
+    for (const key of ["command", "cmd", "script", "input"]) {
+        const v = p[key];
+        if (typeof v === "string" && v.trim() !== "")
+            return v;
+    }
+    return "";
+}
+/**
+ * 审查回合中的用户插话是否顺延：纯文本 steer 会污染 verdict，必须排队到 verdict
+ * 落定后；followUp（补充按钮）由 SDK 排在整轮结束后才送达，本来就安全；斜杠命令
+ * 与带附件的不进顺延（前者直通，后者引用只在发送瞬间有效、调用方改响亮拒绝）。
+ */
+export function shouldDeferPromptForReview(opts) {
+    if (opts.queue || !opts.awaitingVerdict || opts.hasAttachments)
+        return false;
+    if (opts.text.trim().startsWith("/"))
+        return false;
+    return true;
+}
+/**
+ * 目标审查闸门（纯函数）：命中即拒绝，并把「该干什么」告诉模型 ——
+ * 拒绝理由是模型在审查回合里唯一的纠偏机会（长任务里最容易「顺手改一下」）。
+ */
+export function goalReviewDenial(toolName, params) {
+    const name = (toolName ?? "").trim();
+    if (!name)
+        return undefined;
+    // 向用户提问：审查回合禁弹窗（问了就没人应答，verdict 会超时拖成 blocked）。
+    if (name === "ask_user_question") {
+        return {
+            kind: "ask-user",
+            reason: "目标审查回合：不能向用户提问（本回合由服务端自动驱动，弹窗无人应答）。请只做本轮审查、只回 verdict JSON。",
+            reasonEn: "Goal review round: do not ask the user anything (this round is server-driven; dialogs go unanswered). Just review this round and reply with only the verdict JSON.",
+        };
+    }
+    if (name === "subagent") {
+        const action = typeof params === "object" && params !== null ? params.action : undefined;
+        const act = typeof action === "string" ? action.trim().toLowerCase() : "";
+        // 只读 action（get_result, list, templates）放行；其余（spawn, steer, stop, wait_all, handoff）或未传 action 均拒绝
+        if (act === "get_result" || act === "list" || act === "templates") {
+            return undefined;
+        }
+        return {
+            kind: "dispatch-tool",
+            reason: `目标审查回合：不能调用 subagent(action="${act || "spawn"}") —— 轮次由服务端控制。请只做本轮审查、只回 verdict JSON。`,
+            reasonEn: `Goal review round: subagent(action="${act || "spawn"}") is unavailable — the server owns the rounds. Just review this round and reply with only the verdict JSON.`,
+        };
+    }
+    if (DISPATCH_TOOLS.has(name)) {
+        return {
+            kind: "dispatch-tool",
+            reason: `目标审查回合：不能调用 ${name} —— 轮次由服务端控制。请只做本轮审查、只回 verdict JSON。`,
+            reasonEn: `Goal review round: ${name} is unavailable — the server owns the rounds. Just review this round and reply with only the verdict JSON.`,
+        };
+    }
+    if (BASH_TOOLS.has(name)) {
+        const cmd = commandOf(params);
+        if (cmd.trim() === "") {
+            return {
+                kind: "bash",
+                reason: "目标审查回合：终端只用于只读核实（跑测试 / 看 diff），不接受无命令调用。请用 read / grep / 只读 git。",
+                reasonEn: "Goal review round: the terminal is for read-only verification only (run tests / inspect the diff); calls without a command are rejected. Use read / grep / read-only git.",
+            };
+        }
+        if (goalReviewBashAllowed(cmd))
+            return undefined;
+        return {
+            kind: "bash",
+            reason: `目标审查回合：只允许只读命令，命令被拒：\`${cmd.slice(0, 200)}\`。要改工作区请在 verdict 里判 fail 并写具体待改项，让执行对话下一轮做。`,
+            reasonEn: `Goal review round: only read-only commands are allowed; rejected: \`${cmd.slice(0, 200)}\`. To change the workspace, verdict fail with concrete items and let the executor do it next round.`,
+        };
+    }
+    if (WRITE_TOOLS.has(name)) {
+        return {
+            kind: "write-tool",
+            reason: `目标审查回合：只读核实，${name} 被拒。工作区的改动由执行对话做；你的职责是看实际状态、只回 verdict JSON。`,
+            reasonEn: `Goal review round: read-only verification — ${name} was rejected. The executor conversation makes the changes; your job is to inspect the actual state and reply with only the verdict JSON.`,
+        };
+    }
+    return undefined;
+}