chore(v2): .gitignore 登记 extra/ 参考项目目录（不入库）

- Workspace.render_for_architect：超 1200 token 时对 archive 行按与 query+goal
  的字符 2-gram Dice 相似度分档——sim<0.25 先丢、sim<0.55 截断为 40% 摘要、
  仍超限从低到高继续丢；保留行维持原插入序（前缀稳定），最近 4 行下限不变
  （相比旧'从最旧整段丢'，高相关事实在预算内留存更久）
- 顺带消除两项旧债：压缩态与首次渲染共用同一 parts 结构（格式漂移）、
  裁剪循环不再每轮 deepcopy 全文档
- 修复本轮引入的缺陷：会话轮次 tool_calls 为 int 计数时清单提取迭代崩溃
  （test_session_multi_turn 抓出，已加类型防御）
- 新增 tests/test_pinch_trim.py 4 项；全量 244 passed ×2（基线 230）

.gitignore

@@ -35,3 +35,9 @@ Thumbs.db
 config/model_pool.json
 agent_runs/
 agent_workspace/
+
+# 安全扫描器工作目录（不入库）
+.mimosa/
+
+# 参考项目目录（不入库，仅作设计吸收来源）
+extra/

BRANCH.md

@@ -0,0 +1,32 @@
+# 分支：v2-coding-agent — 端云协同编程智能体（第二代）
+
+> **快照点**：`747d85c`（v2 核心 + v3 Web 应用化 + v4 模型池与工具智能体全部完成、测试全绿时点）。
+> 历史路标，冻结不再演进；集成主线见 `master`。
+
+## 这一代是什么
+
+**命题**：《基于端云协同的编程智能体系统设计与实现》——大模型（API）任务分析/决策/终审 +
+小模型（本地 llama.cpp）实现/自验证 +「交流文本」结构化共享工作区 + 人工检验队列。
+
+- **v2 核心**：`Workspace` 交流文本协议（schema/锚点/rollup/双渲染）→ `ArchitectClient`
+  （brief/decide/final_review，JSON 约束）→ `WorkerLoop`（工具化实现+接地验证+自修≤2）
+  → `CollaborativePipeline`（快路径/协作循环/双护栏熔断/终审）+ 运维层（llama-server 进程管理、
+  三档硬件模板）+ `ReviewQueue` 人工检验 + 打包分发
+- **v3 Web 应用化**：异步任务 + SSE 实时协作可视化 + Vue3 SPA（对话/协作过程/检验/指标）+ 网关安全加固
+- **v4 增补**：多价位模型池（local/budget/premium 角色指派）+ 工具智能体（harness 级工具/工作区选择/
+  两级智能体/审批流/token 级流式）
+- v1 保留为 legacy（`POST /chat/legacy`），离线降级可用
+
+## 基线
+
+测试 281 项全绿（T31 时点）；E1 token 经济学实测：交流文本较全量上下文降 ~61%（含缓存计费）。
+
+## 文档
+
+`实现方案_v2_端云协同编程智能体系统.md`、`实现方案_v3_Web应用化.md`、
+`实现方案_v4_模型池与工具智能体.md`、`毕业设计_进度记录.md`
+
+## 与其他分支的关系
+
+- 第一代（规则路由）以 legacy 形式包含在本快照内
+- 第三代（校园缓存代理层）在本快照之后的 master 上演进 → 见 `campus-cache-proxy` 分支

README.md

@@ -69,6 +69,11 @@ C:\Python314\python.exe -m venv .venv
 .venv\Scripts\python.exe scripts/serve.py --port 8000
 #   浏览器打开 http://127.0.0.1:8000/ 使用 Web 界面（对话 / 协作过程 / 人工检验 / 指标）
 
+#   ⚠️ 安全默认值（T30）：网关默认只绑定 127.0.0.1 且只信任本机 Host
+#   （网关能读写工作区文件/执行命令，不宜默认暴露局域网）。
+#   如需局域网访问：--host 0.0.0.0 并设置环境变量 GATEWAY_TRUSTED_HOSTS
+#   放行对应主机名（"*" = 放行全部，仅限可信网络）。
+
 # 5. 调用
 curl http://127.0.0.1:8000/health
 curl -X POST http://127.0.0.1:8000/chat -H "Content-Type: application/json" -d '{"query":"用 Python 写一个快速排序"}'

gateway/agent.py

@@ -15,12 +15,13 @@
 from __future__ import annotations
 
 import asyncio
+import copy
 import json
 import time
 import uuid
 from dataclasses import dataclass, field
 from pathlib import Path
-from typing import Any, Dict, List, Optional
+from typing import Any, Awaitable, Callable, Dict, List, Optional
 
 from router_system.tools import ToolLoop, WorkspaceTools
 
@@ -35,10 +36,12 @@ AGENT_SYSTEM_PROMPT = (
     "你是端云协同 LLM 系统中的智能体（Agent），正在操作用户选择的**真实项目工作目录**。"
     "你拥有的工具：list_dir（列目录）、read_file（读文件）、write_file（写文件/新建）、"
     "edit_file（精确替换编辑：old_string 须唯一匹配）、search_files（跨文件搜索内容）、"
-    "run_command（执行 shell 命令，仅当系统开启 allow_shell 时可用，否则不要尝试）。"
+    "run_command（执行 shell 命令，仅当系统开启 allow_shell 时可用，否则不要尝试）、"
+    "web_fetch（抓取公网 http/https 文档页面，私网地址会被拒绝）。"
     "像编程助手一样工作：先列目录/搜索了解项目结构，读文件核对原文后再用 edit_file 小步修改"
-    "（或 write_file 新建），需要时运行命令验证。任务完成或给出结论后，"
-    "直接输出给用户的最终答复（中文，不要再调用工具）。"
+    "（或 write_file 新建），需要查外部资料时用 web_fetch，需要时运行命令验证。"
+    "任务完成或给出结论后，直接输出给用户的最终答复（中文，不要再调用工具）。"
+    "注意：不要反复以完全相同的参数调用同一工具——那不会带来新信息。"
 )
 
 # ── 两级智能体（D7）：规划者（大模型）+ 执行者（本地小模型），交接走 handoff 文档 ──
@@ -68,6 +71,9 @@ _REVIEW_SCHEMA_HINT = {
 
 DEFAULT_MAX_HANDOFFS = 2   # 规划者<->执行者交接轮数上限
 
+# 会写文件的工具名（T-M2 折叠摘要的文件清单来源）
+_FILE_TOOLS = {"write_file", "edit_file"}
+
 
 def _parse_json_loose(content: str) -> Dict[str, Any]:
     """宽松解析规划者的 JSON 输出（剥围栏/取首个对象）；失败返回 {}。"""
@@ -92,6 +98,9 @@ class OpenAICompatChat:
         temperature: float = 0.3,
         max_tokens: int = 4096,
         timeout_s: float = 120.0,
+        stream: bool = True,
+        max_retries: int = 2,
+        retry_delay_s: float = 1.0,
         transport: Any = None,
         _client: Any = None,
     ):
@@ -101,6 +110,9 @@ class OpenAICompatChat:
         self.temperature = temperature
         self.max_tokens = max_tokens
         self.timeout_s = timeout_s
+        self.stream = stream                # D10：默认流式；解析失败自动回退非流式
+        self.max_retries = max(0, int(max_retries))   # 可重试错误的重试次数（dsh llm-retry 同款）
+        self.retry_delay_s = max(0.0, float(retry_delay_s))  # 指数退避基数
         self._transport = transport
         self._client = _client
         self._owns = _client is None
@@ -120,7 +132,114 @@ class OpenAICompatChat:
             self._client = None
 
     async def __call__(self, messages: List[Dict[str, Any]],
-                       tools_spec: List[Dict[str, Any]]) -> Dict[str, Any]:
+                       tools_spec: List[Dict[str, Any]],
+                       on_delta: Optional[Callable[[str], None]] = None) -> Dict[str, Any]:
+        """ToolLoop.chat_fn：默认流式（D10）；流式不可用时回退非流式（带重试退避）。"""
+        if self.stream:
+            try:
+                return await self._stream_call(messages, tools_spec, on_delta)
+            except Exception:
+                # 已有部分增量输出则如实抛出；否则回退非流式
+                if getattr(self, "_stream_partial", False):
+                    raise
+        return await self._post_with_retry(messages, tools_spec)
+
+    @staticmethod
+    def _is_retryable(exc: Exception) -> bool:
+        """可重试错误：网络传输类 / 408 / 429 / 5xx（dsh retryableCodes 同思路）。"""
+        import httpx
+        if isinstance(exc, httpx.TransportError):
+            return True
+        if isinstance(exc, httpx.HTTPStatusError):
+            code = exc.response.status_code
+            return code in (408, 429) or code >= 500
+        return False
+
+    async def _post_with_retry(self, messages: List[Dict[str, Any]],
+                               tools_spec: List[Dict[str, Any]]) -> Dict[str, Any]:
+        """非流式调用 + 指数退避重试（仅针对可重试错误）。"""
+        for attempt in range(self.max_retries + 1):
+            try:
+                return await self._post_once(messages, tools_spec)
+            except Exception as exc:
+                if attempt >= self.max_retries or not self._is_retryable(exc):
+                    raise
+                await asyncio.sleep(self.retry_delay_s * (2 ** attempt))
+
+    async def _stream_call(self, messages: List[Dict[str, Any]],
+                           tools_spec: List[Dict[str, Any]],
+                           on_delta: Optional[Callable[[str], None]]) -> Dict[str, Any]:
+        """流式调用：逐段转发 content 增量；tool_calls 碎片按 index 组装（不在正文展示）。"""
+        import json as _json
+        self._stream_partial = False   # 每次调用前复位（防上次的标志影响本次回退判定）
+        body: Dict[str, Any] = {
+            "model": self.model,
+            "messages": messages,
+            "temperature": self.temperature,
+            "max_tokens": self.max_tokens,
+            "stream": True,
+            "stream_options": {"include_usage": True},
+        }
+        if tools_spec:
+            body["tools"] = tools_spec
+            body["tool_choice"] = "auto"
+        headers = {"Authorization": f"Bearer {self.api_key}"} if self.api_key else {}
+        client = self._get_client()
+        content_parts: List[str] = []
+        tc_slots: Dict[int, Dict[str, str]] = {}
+        usage: Dict[str, Any] = {}
+        async with client.stream("POST", f"{self.base_url}/chat/completions",
+                                 headers=headers, json=body) as resp:
+            resp.raise_for_status()
+            async for line in resp.aiter_lines():
+                line = line.strip()
+                if not line.startswith("data:"):
+                    continue
+                payload = line[5:].strip()
+                if payload == "[DONE]":
+                    break
+                try:
+                    obj = _json.loads(payload)
+                except _json.JSONDecodeError:
+                    continue
+                choices = obj.get("choices") or [{}]
+                delta = (choices[0].get("delta") or {}) if choices else {}
+                piece = delta.get("content")
+                if piece:
+                    self._stream_partial = True
+                    content_parts.append(piece)
+                    if on_delta is not None:
+                        try:
+                            on_delta(piece)
+                        except Exception:
+                            pass
+                for tc in delta.get("tool_calls") or []:
+                    idx = int(tc.get("index", 0))
+                    slot = tc_slots.setdefault(idx, {"id": "", "name": "", "args": ""})
+                    if tc.get("id"):
+                        slot["id"] = tc["id"]
+                    fn = tc.get("function") or {}
+                    if fn.get("name"):
+                        slot["name"] = fn["name"]
+                    if fn.get("arguments"):
+                        slot["args"] += fn["arguments"]
+                if obj.get("usage"):
+                    usage = obj["usage"]
+        content = "".join(content_parts) or None
+        from router_system.tools import _loads_json_object
+        tool_calls = []
+        for idx in sorted(tc_slots):
+            slot = tc_slots[idx]
+            tool_calls.append({
+                "id": slot["id"] or f"call_{idx}",
+                "name": slot["name"],
+                "arguments": _loads_json_object(slot["args"]),
+            })
+        return {"content": content, "tool_calls": tool_calls, "usage": usage}
+
+    async def _post_once(self, messages: List[Dict[str, Any]],
+                         tools_spec: List[Dict[str, Any]]) -> Dict[str, Any]:
+        """非流式调用（回退路径）。"""
         body: Dict[str, Any] = {
             "model": self.model,
             "messages": messages,
@@ -137,7 +256,6 @@ class OpenAICompatChat:
         resp.raise_for_status()
         data = resp.json()
         msg = (data.get("choices") or [{}])[0].get("message") or {}
-        # tool_calls 解析放这里（网关层），内核 tools.parse_tool_calls 供其他调用方复用
         from router_system.tools import parse_tool_calls
         return {
             "content": msg.get("content"),
@@ -167,6 +285,7 @@ class AgentRunInfo:
     workspace: str = ""                # 本次运行使用的工作区根目录（绝对路径）
     executor_model: str = ""           # 两级模式：执行者模型名（空 = 单模型模式）
     mode: str = "single"               # single | dual
+    tool_calls: int = 0                # 本次运行的工具调用步数
     asyncio_task: Optional[asyncio.Task] = field(default=None, repr=False)
 
     def to_dict(self) -> Dict[str, Any]:
@@ -186,6 +305,7 @@ class AgentRunInfo:
             "workspace": self.workspace,
             "executor_model": self.executor_model,
             "mode": self.mode,
+            "tool_calls": self.tool_calls,
         }
 
 
@@ -196,6 +316,13 @@ class AgentService:
         self.run_dir = Path(run_dir)
         self._runs: Dict[str, AgentRunInfo] = {}
         self.max_running = 5
+        self._running = 0  # O(1) 运行计数（原 register 每次全量扫描 _runs）
+
+    def _transition_state(self, info: AgentRunInfo, new_state: str) -> None:
+        """状态迁移的单一入口：离开 running 时同步递减计数。"""
+        if info.state == STATE_RUNNING and new_state != STATE_RUNNING:
+            self._running -= 1
+        info.state = new_state
 
     # ---------- 路径 ----------
     def _dir(self, request_id: str) -> Path:
@@ -211,14 +338,14 @@ class AgentService:
     def register(self, request_id: str, task: str, model: str, pool_id: str,
                  workspace: str = "", executor_model: str = "",
                  mode: str = "single") -> Optional[AgentRunInfo]:
-        running = [r for r in self._runs.values() if r.state == STATE_RUNNING]
-        if len(running) >= self.max_running:
+        if self._running >= self.max_running:
             return None
         info = AgentRunInfo(request_id=request_id, task=task, model=model,
                             pool_id=pool_id, workspace=workspace,
                             executor_model=executor_model, mode=mode,
                             started_at=time.time())
         self._runs[request_id] = info
+        self._running += 1
         self._dir(request_id).mkdir(parents=True, exist_ok=True)
         self._write_status(info)
         return info
@@ -230,35 +357,126 @@ class AgentService:
     async def run(self, info: AgentRunInfo, chat: Any, workspace_dir: str | Path,
                   max_rounds: int = 8, token_cap: int = 0,
                   allow_shell: bool = False, shell_timeout_s: int = 20,
+                  allow_net: bool = True,
                   executor_chat: Any = None,
-                  max_handoffs: int = DEFAULT_MAX_HANDOFFS) -> None:
+                  max_handoffs: int = DEFAULT_MAX_HANDOFFS,
+                  session: Optional["AgentSession"] = None,
+                  approval_policy: str = "dangerous",
+                  approval_timeout_s: int = 120) -> None:
         """执行智能体任务（由调用方包成后台协程）。
 
         executor_chat 为空 = 单模型模式（chat 全程包办）；
         提供时进入两级模式：chat 作规划者，executor_chat 作执行者（D7）。
+        session 提供时：既往轮次作为对话上下文，完成后把本轮追加进会话。
         """
+        history = self._history_from_session(session)
+        approval_mgr = ApprovalManager()
+        info._approval_manager = approval_mgr  # 供 /approve 端点裁决（瞬态属性）
+        throttle = DeltaThrottle(lambda ev: self._append_event(info, ev))
+
+        async def approval_hook(name: str, args: Dict[str, Any]) -> bool:
+            """按策略判定；需审批则挂起等用户裁决，超时 fail-closed。"""
+            if not needs_approval(approval_policy, name):
+                return True
+            aid = "ap" + uuid.uuid4().hex[:8]
+            ev = approval_mgr.open(aid)
+            self._append_event(info, {"type": "approval_request", "id": aid,
+                                      "name": name, "arguments": args,
+                                      "policy": approval_policy})
+            # 轮询等待（0.1s 步进）：不用 wait_for——portal 循环下其定时器不可靠
+            allowed = False
+            note = ""
+            deadline = time.time() + max(1, approval_timeout_s)
+            while time.time() < deadline:
+                if ev.is_set():
+                    allowed = approval_mgr._pending.get(aid, {}).get("allowed", False)
+                    break
+                await asyncio.sleep(0.1)
+            else:
+                note = f"超时（{approval_timeout_s}s）未响应，自动拒绝"
+            if ev.is_set() and not allowed:
+                note = note or "用户拒绝"
+            approval_mgr.close(aid)
+            self._append_event(info, {"type": "approval_decided", "id": aid,
+                                      "name": name, "allowed": allowed,
+                                      **({"note": note} if note else {})})
+            return allowed
+
         try:
             if executor_chat is not None:
                 result = await self.run_dual(
                     info, chat, executor_chat, workspace_dir,
                     max_rounds=max_rounds, token_cap=token_cap,
                     allow_shell=allow_shell, shell_timeout_s=shell_timeout_s,
-                    max_handoffs=max_handoffs)
+                    allow_net=allow_net,
+                    max_handoffs=max_handoffs,
+                    approval_hook=approval_hook)
             else:
                 tools = WorkspaceTools(workspace_dir, allow_shell=allow_shell,
-                                       shell_timeout_s=shell_timeout_s)
+                                       shell_timeout_s=shell_timeout_s,
+                                       allow_net=allow_net)
                 loop = ToolLoop(tools, chat, max_rounds=max_rounds, token_cap=token_cap,
-                                on_event=self._make_event_writer(info))
-                result = await loop.run(info.task, system=AGENT_SYSTEM_PROMPT)
+                                on_event=self._make_event_writer(info),
+                                approval_hook=approval_hook,
+                                on_delta=throttle.make_cb("executor"))
+                result = await loop.run(info.task, system=AGENT_SYSTEM_PROMPT,
+                                        history=history)
+                throttle.flush("executor")
             self._apply_result(info, result)
         except Exception as exc:  # pragma: no cover
-            info.state = STATE_FAILED
+            self._transition_state(info, STATE_FAILED)
             info.error = f"{type(exc).__name__}: {exc}"
             self._append_event(info, {"type": "final", "round": info.rounds,
                                       "reason": "error", "error": info.error})
         finally:
             info.finished_at = time.time()
             self._write_status(info)
+            if session is not None:
+                session.data["turns"].append({
+                    "request_id": info.request_id,
+                    "task": info.task,
+                    "response": info.response,
+                    "state": info.state,
+                    "tool_calls": info.tool_calls,
+                    "tokens": info.prompt_tokens + info.completion_tokens,
+                    "error": info.error,
+                    "ts": info.finished_at,
+                })
+                get_session_store().save(session)
+
+    @staticmethod
+    def _history_from_session(session: Optional["AgentSession"],
+                              max_turns: int = 6,
+                              max_chars: int = 1500) -> List[Dict[str, Any]]:
+        """把会话既往轮次折叠成对话上下文（不含工具细节）。
+
+        T-M2（采纳 pi branch-summarization 思想）：折叠摘要携带本会话
+        已写入/编辑的文件清单——轮次滑出窗口后，事实清单仍随首条摘要
+        进入对话，丢上下文不丢事实。
+        """
+        if session is None:
+            return []
+        turns = [t for t in session.data.get("turns", [])
+                 if t.get("state") == STATE_DONE and t.get("response")]
+        files = sorted({
+            str((a.get("arguments") or {}).get("path") or "").strip()
+            for t in session.data.get("turns", [])
+            for a in (t.get("tool_calls") if isinstance(t.get("tool_calls"), list) else [])
+            if isinstance(a, dict)
+            and str(a.get("name") or "") in _FILE_TOOLS
+            and (a.get("arguments") or {}).get("path")
+        })
+        out: List[Dict[str, Any]] = []
+        if files:
+            shown = "、".join(f[:120] for f in files[:20])
+            more = f"（等共 {len(files)} 个）" if len(files) > 20 else ""
+            out.append({"role": "user",
+                        "content": f"（上下文摘要）本会话此前已写入/编辑的文件：{shown}{more}"})
+            out.append({"role": "assistant", "content": "已了解上述文件背景，将继续任务。"})
+        for t in turns[-max_turns:]:
+            out.append({"role": "user", "content": str(t["task"])[:max_chars]})
+            out.append({"role": "assistant", "content": str(t["response"])[:max_chars]})
+        return out
 
     def _apply_result(self, info: AgentRunInfo, result: Dict[str, Any]) -> None:
         """把循环结果落到运行状态（单/两级模式共用）。"""
@@ -267,25 +485,28 @@ class AgentService:
         info.prompt_tokens = int(result.get("prompt_tokens", 0))
         info.completion_tokens = int(result.get("completion_tokens", 0))
         if result.get("reason") == "error":
-            info.state = STATE_FAILED
+            self._transition_state(info, STATE_FAILED)
             info.error = result.get("error")
         elif result.get("reason") in ("token_cap", "max_rounds", "max_handoffs"):
             # 触顶属于护栏行为：结果仍交付，但标记部分完成信息
-            info.state = STATE_DONE
+            self._transition_state(info, STATE_DONE)
             info.error = result.get("error")
         else:
-            info.state = STATE_DONE
+            self._transition_state(info, STATE_DONE)
 
     # ---------- 两级模式（D7）：规划者 + 执行者 ----------
     async def run_dual(self, info: AgentRunInfo, planner_chat: Any, executor_chat: Any,
                        workspace_dir: str | Path, max_rounds: int = 8,
                        token_cap: int = 0, allow_shell: bool = False,
-                       shell_timeout_s: int = 20,
-                       max_handoffs: int = DEFAULT_MAX_HANDOFFS) -> Dict[str, Any]:
+                       shell_timeout_s: int = 20, allow_net: bool = True,
+                       max_handoffs: int = DEFAULT_MAX_HANDOFFS,
+                       approval_hook: Optional[Callable[[str, Dict[str, Any]], Awaitable[bool]]] = None
+                       ) -> Dict[str, Any]:
         """大模型拆解/审查 + 小模型执行工具轮，交接状态写 handoff.json（智能体版交流文本）。"""
         info.mode = "dual"
         tools = WorkspaceTools(workspace_dir, allow_shell=allow_shell,
-                               shell_timeout_s=shell_timeout_s)
+                               shell_timeout_s=shell_timeout_s, allow_net=allow_net)
+        throttle = DeltaThrottle(lambda ev: self._append_event(info, ev))
         handoff: Dict[str, Any] = {
             "task": info.task, "planner_model": info.model,
             "executor_model": info.executor_model, "workspace": info.workspace,
@@ -310,13 +531,23 @@ class AgentService:
 
         async def _planner_json(user_msg: str) -> Dict[str, Any]:
             """调规划者并解析 JSON；解析失败回喂重试一次，再失败降级为 {}（禁止带病继续的软版本）。"""
+            import inspect
             messages = [{"role": "system", "content": PLANNER_SYSTEM_PROMPT},
                         {"role": "user", "content": user_msg}]
             content = ""
             for attempt in (1, 2):
-                resp = await planner_chat(messages, [])
+                # 规划者同样流式（前端弱化展示其 JSON 草稿）
+                try:
+                    accepts = len(inspect.signature(planner_chat).parameters) >= 3
+                except (TypeError, ValueError):
+                    accepts = False
+                if accepts:
+                    resp = await planner_chat(messages, [], throttle.make_cb("planner"))
+                else:
+                    resp = await planner_chat(messages, [])
                 _account(resp.get("usage"))
                 content = resp.get("content") or ""
+                throttle.flush("planner")
                 obj = _parse_json_loose(content)
                 if obj:
                     break
@@ -353,7 +584,9 @@ class AgentService:
                 loop = ToolLoop(tools, executor_chat, max_rounds=max_rounds,
                                 token_cap=max(1, _remaining_cap()),
                                 on_event=self._make_event_writer(info),
-                                emit_final=False)
+                                emit_final=False,
+                                approval_hook=approval_hook,
+                                on_delta=throttle.make_cb("executor"))
                 exec_result = await loop.run(instructions, system=EXECUTOR_SYSTEM_PROMPT)
                 _account({"prompt_tokens": exec_result.get("prompt_tokens", 0),
                           "completion_tokens": exec_result.get("completion_tokens", 0)})
@@ -413,6 +646,8 @@ class AgentService:
     # ---------- 事件 ----------
     def _make_event_writer(self, info: AgentRunInfo):
         def _on_event(ev: Dict[str, Any]) -> None:
+            if ev.get("type") == "tool_call":
+                info.tool_calls += 1        # 工具步数统计（单/两级模式统一在此）
             self._append_event(info, ev)
         return _on_event
 
@@ -509,3 +744,228 @@ def reset_agent_service() -> None:
 
 def new_request_id() -> str:
     return "ag" + uuid.uuid4().hex[:10]
+
+
+# ─────────────────────────────────────────────────────────────────────────────
+# 审批流（D9）：dsh 式 allow-once / deny，fail-closed
+# ─────────────────────────────────────────────────────────────────────────────
+READ_ONLY_TOOLS = {"list_dir", "read_file", "search_files", "web_fetch"}
+
+
+def needs_approval(policy: str, tool_name: str) -> bool:
+    """审批策略判定：off=全放行；all=全询问；dangerous=写/编辑/命令询问，只读放行。"""
+    if policy == "all":
+        return True
+    if policy == "dangerous":
+        return tool_name not in READ_ONLY_TOOLS
+    return False
+
+
+class DeltaThrottle:
+    """流式增量节流（D10）：积攒超过阈值才落一条 delta 事件，防事件爆炸。"""
+
+    THRESHOLD = 48
+
+    def __init__(self, append_event):
+        self._append = append_event          # (ev: dict) -> None
+        self._buf: Dict[str, str] = {}
+
+    def make_cb(self, role: str):
+        def cb(text: str) -> None:
+            self.add(role, text)
+        return cb
+
+    def add(self, role: str, text: str) -> None:
+        buf = self._buf.get(role, "") + (text or "")
+        if len(buf) >= self.THRESHOLD:
+            self._flush(role, buf)
+            buf = ""
+        self._buf[role] = buf
+
+    def flush(self, role: Optional[str] = None) -> None:
+        roles = [role] if role else list(self._buf.keys())
+        for r in roles:
+            buf = self._buf.get(r, "")
+            if buf:
+                self._flush(r, buf)
+                self._buf[r] = ""
+
+    def _flush(self, role: str, text: str) -> None:
+        self._append({"type": "delta", "role": role, "text": text})
+
+
+class ApprovalManager:
+    """单次智能体运行内的审批挂起/裁决（asyncio Event 实现，dsh 式 allow-once）。"""
+
+    def __init__(self):
+        self._pending: Dict[str, Dict[str, Any]] = {}
+
+    def open(self, approval_id: str) -> asyncio.Event:
+        ev = asyncio.Event()
+        self._pending[approval_id] = {"event": ev, "allowed": False}
+        return ev
+
+    def decide(self, approval_id: str, allowed: bool) -> bool:
+        p = self._pending.get(approval_id)
+        if p is None:
+            return False
+        p["allowed"] = allowed
+        p["event"].set()
+        return True
+
+    def close(self, approval_id: str) -> None:
+        self._pending.pop(approval_id, None)
+
+
+# ─────────────────────────────────────────────────────────────────────────────
+# 会话（dsh 式：工作区内多轮对话，持久化到磁盘）
+# ─────────────────────────────────────────────────────────────────────────────
+SESSIONS_DIR = Path("agent_runs") / "sessions"
+
+
+class AgentSession:
+    """一个智能体会话：多轮任务 + 配置快照（磁盘持久化）。"""
+
+    def __init__(self, data: Dict[str, Any]):
+        self.data = data
+
+    @classmethod
+    def new(cls, sid: str, title: str, workspace: str,
+            pool_id: str = "", executor_pool_id: str = "") -> "AgentSession":
+        now = time.time()
+        return cls({
+            "id": sid, "title": title[:24] or "新会话", "workspace": workspace,
+            "pool_id": pool_id, "executor_pool_id": executor_pool_id,
+            "created_at": now, "updated_at": now, "busy": False,
+            "turns": [],   # [{request_id, task, response, state, tool_calls, tokens}]
+        })
+
+    def to_dict(self) -> Dict[str, Any]:
+        return dict(self.data)
+
+    def view(self, include_turns: bool = True) -> Dict[str, Any]:
+        out = self.to_dict()
+        if not include_turns:
+            out["turns"] = len(self.data.get("turns", []))
+        return out
+
+
+class SessionStore:
+    """会话注册表（内存索引 + sessions/{sid}.json 持久化）。"""
+
+    def __init__(self, root: Path = SESSIONS_DIR):
+        self.root = Path(root)
+        self.root.mkdir(parents=True, exist_ok=True)
+        self._cache: Dict[str, AgentSession] = {}
+
+    def _path(self, sid: str) -> Path:
+        return self.root / f"{sid}.json"
+
+    def create(self, title: str, workspace: str,
+               pool_id: str = "", executor_pool_id: str = "") -> AgentSession:
+        sid = "as" + uuid.uuid4().hex[:10]
+        sess = AgentSession.new(sid, title or "新会话", workspace, pool_id, executor_pool_id)
+        self._cache[sid] = sess
+        self._save(sess)
+        return sess
+
+    def get(self, sid: str) -> Optional[AgentSession]:
+        if sid in self._cache:
+            return self._cache[sid]
+        p = self._path(sid)
+        if not p.exists():
+            return None
+        try:
+            sess = AgentSession(json.loads(p.read_text(encoding="utf-8")))
+            self._cache[sid] = sess
+            return sess
+        except (json.JSONDecodeError, OSError):
+            return None
+
+    def list(self) -> List[Dict[str, Any]]:
+        out = []
+        for p in sorted(self.root.glob("*.json"),
+                        key=lambda x: x.stat().st_mtime, reverse=True):
+            try:
+                out.append(json.loads(p.read_text(encoding="utf-8")))
+            except (json.JSONDecodeError, OSError):
+                continue
+        return out
+
+    def delete(self, sid: str) -> bool:
+        self._cache.pop(sid, None)
+        p = self._path(sid)
+        if p.exists():
+            p.unlink()
+            return True
+        return False
+
+    def rename(self, sid: str, title: str) -> Optional[AgentSession]:
+        """重命名会话标题（dsh session.rename 对齐）。"""
+        sess = self.get(sid)
+        if sess is None:
+            return None
+        title = (title or "").strip()
+        if not title:
+            return sess
+        sess.data["title"] = title[:24]
+        self.save(sess)
+        return sess
+
+    def fork(self, sid: str, turn_index: Optional[int] = None,
+             title: str = "") -> Optional[AgentSession]:
+        """从既有会话分叉新会话（T-M1，采纳 pi 会话树 id/parentId 设计）。
+
+        值拷贝 turns[:turn_index+1]（缺省 = 全部已完结轮次；-1 = 空会话壳），
+        原会话不变；新会话记录 parent_id / fork_point 保留血统。采用拷贝式
+        而非 pi 的共享存储引用——规避并发写冲突，代价是 fork 后磁盘冗余
+        （会话体量小，可接受）。turn_index 越界返回 None。
+        """
+        src = self.get(sid)
+        if src is None:
+            return None
+        turns = src.data.get("turns", []) or []
+        n = len(turns) - 1 if turn_index is None else int(turn_index)
+        if n < -1 or n >= len(turns):
+            return None
+        data = copy.deepcopy(src.data)
+        data["id"] = "as" + uuid.uuid4().hex[:10]
+        base_title = (title or "").strip() or (src.data.get("title") or "会话") + "·分叉"
+        data["title"] = base_title[:24]
+        data["parent_id"] = sid
+        data["fork_point"] = n
+        data["created_at"] = time.time()
+        data["busy"] = False
+        data["turns"] = copy.deepcopy(turns[:n + 1]) if n >= 0 else []
+        sess = AgentSession(data)
+        self._cache[data["id"]] = sess
+        self._save(sess)
+        return sess
+
+    def save(self, sess: AgentSession) -> None:
+        self._cache[sess.data["id"]] = sess
+        self._save(sess)
+
+    def _save(self, sess: AgentSession) -> None:
+        sess.data["updated_at"] = time.time()
+        try:
+            self._path(sess.data["id"]).write_text(
+                json.dumps(sess.data, ensure_ascii=False, indent=2), encoding="utf-8")
+        except OSError:
+            pass
+
+
+_session_store: Optional[SessionStore] = None
+
+
+def get_session_store() -> SessionStore:
+    global _session_store
+    if _session_store is None:
+        _session_store = SessionStore()
+    return _session_store
+
+
+def reset_session_store() -> None:
+    """测试用。"""
+    global _session_store
+    _session_store = None

gateway/api.py

@@ -8,7 +8,8 @@ v2 端点（《实现方案_v2》5.3）：
   GET  /review/queue、POST /review/{id}     人工检验
   GET  /metrics                     含 v2 token/快路径统计
 
-启动：uvicorn gateway.api:app --host 0.0.0.0 --port 8000
+启动：uvicorn gateway.api:app --host 127.0.0.1 --port 8000
+（默认仅回环；如需局域网访问改 --host 0.0.0.0 并设置 GATEWAY_TRUSTED_HOSTS）
 """
 from __future__ import annotations
 
@@ -22,6 +23,7 @@ if _dotenv_path.exists():
     load_dotenv(_dotenv_path)
 
 import asyncio
+import re
 from pathlib import Path
 from typing import List, Optional
 
@@ -38,6 +40,10 @@ from gateway.model_pool import (
     get_pool,
 )
 
+# 路径参数 ID 白名单（runs/agent/sessions 的 ID 都由此系统生成；
+# 拒绝任意其他字符可一并杀灭 Windows 反斜杠穿越 ../..%5C 等变体）
+_ID_RE = re.compile(r"^[a-zA-Z0-9_-]{1,64}$")
+
 # ---- v2 依赖（惰性导入，缺依赖时降级提示） ----
 try:
     from router_system.architect import build_architect
@@ -179,6 +185,19 @@ try:
         version="2.0.0",
     )
 
+    # Web 信任围栏（dsh browser-auth 同款思路）：只信任本机/显式放行的 Host，
+    # 防 DNS rebinding 把浏览器请求打到本网关。GATEWAY_TRUSTED_HOSTS 可覆盖（"*" = 放行全部）。
+    _trusted = _os.environ.get(
+        "GATEWAY_TRUSTED_HOSTS",
+        "localhost,127.0.0.1,0.0.0.0,[::1],testserver,testclient",
+    )
+    try:
+        from starlette.middleware.trustedhost import TrustedHostMiddleware
+        app.add_middleware(TrustedHostMiddleware,
+                           allowed_hosts=[h.strip() for h in _trusted.split(",")])
+    except ImportError:  # pragma: no cover
+        pass
+
     # Vue SPA 静态资源（html=True：对不存在的路径 fallback 到 index.html，支持 SPA 路由）
     app.mount("/static", StaticFiles(directory=str(_STATIC_DIR), html=True), name="static")
 
@@ -189,6 +208,16 @@ try:
             return HTMLResponse(_INDEX_PATH.read_text(encoding="utf-8"))
         return HTMLResponse("<h1>端云协同 LLM 系统</h1><p>请先构建前端：cd webapp && npm run build</p>")
 
+    def _check_id(value: str, what: str = "ID") -> str:
+        """校验路径参数 ID（防目录穿越/注入：仅允许系统生成的字符集）。
+
+        非法格式一律按 404 处理——此类 ID 在本系统里不可能存在，
+        不泄露校验规则本身。
+        """
+        if not _ID_RE.fullmatch(value or ""):
+            raise HTTPException(status_code=404, detail=f"未找到 {what}: {value!r}")
+        return value
+
     @app.get("/health", response_model=HealthResponse, tags=["system"])
     async def health():
         return get_router().health()
@@ -265,6 +294,7 @@ try:
     @app.get("/runs/{request_id}/status", tags=["v2"])
     async def get_run_status(request_id: str):
         """查询任务当前状态（pending / running / done / failed）。"""
+        _check_id(request_id, "request_id")
         info = get_job_store().get(request_id)
         if info is None:
             raise HTTPException(status_code=404, detail=f"任务 {request_id} 不存在")
@@ -302,6 +332,7 @@ try:
     @app.get("/runs/{request_id}/stream", tags=["v2"])
     async def stream_run(request_id: str):
         """SSE 端点：实时推送 workspace.json 状态变化（供前端协作可视化）。"""
+        _check_id(request_id, "request_id")
         from fastapi.responses import StreamingResponse
 
         async def event_generator():
@@ -354,6 +385,7 @@ try:
 
     @app.get("/traces/{request_id}", tags=["system"])
     async def get_trace(request_id: str):
+        _check_id(request_id, "request_id")
         trace = get_router().trace_store.get(request_id)
         if trace is None:
             raise HTTPException(status_code=404, detail=f"未找到请求 {request_id} 的推理链")
@@ -362,6 +394,7 @@ try:
     # ---------------- v2：workspace / artifacts ----------------
     @app.get("/runs/{request_id}/workspace", tags=["v2"])
     async def get_workspace(request_id: str):
+        _check_id(request_id, "request_id")
         p = Path("runs") / request_id / "workspace.json"
         if not p.exists():
             raise HTTPException(status_code=404, detail=f"未找到运行 {request_id}")
@@ -370,7 +403,12 @@ try:
 
     @app.get("/runs/{request_id}/artifacts/{name}", tags=["v2"])
     async def get_artifact(request_id: str, name: str):
-        p = Path("runs") / request_id / "artifacts" / name
+        _check_id(request_id, "request_id")
+        d = (Path("runs") / request_id / "artifacts").resolve()
+        # 工件名关押：解析后必须仍在 artifacts 目录内（防 ..\ 与绝对路径逃逸）
+        p = (d / name).resolve()
+        if p != d and d not in p.parents:
+            raise HTTPException(status_code=400, detail=f"非法工件名: {name!r}")
         if not p.exists():
             raise HTTPException(status_code=404, detail=f"未找到工件 {name}")
         return {"name": name, "content": p.read_text(encoding="utf-8")}
@@ -501,12 +539,13 @@ try:
 
     @app.post("/agent", tags=["agent"])
     async def agent_run(req: dict):
-        """提交智能体任务：{"task", "pool_id"?, "workspace"?}。
+        """提交智能体任务：{"task", "pool_id"?, "workspace"?, "executor_pool_id"?, "session_id"?}。
 
-        workspace 为用户选择的工作目录（绝对路径）；缺省用设置里的 agent.workspace_dir。
+        workspace 为用户选择的工作目录；缺省继承会话目录，再缺省用设置默认值。
+        session_id 提供时任务在会话内执行（多轮上下文 + 轮次记录）。
         立即返回 request_id；过程事件经 GET /agent/{id}/stream (SSE) 推送。
         """
-        from gateway.agent import get_agent_service, new_request_id
+        from gateway.agent import get_agent_service, get_session_store, new_request_id
         from router_system.tools import WorkspaceTools
 
         task = str((req or {}).get("task") or "").strip()
@@ -518,7 +557,23 @@ try:
 
         s = settings_store().to_dict()
         agent_cfg = s.get("agent", {})
+
+        # 会话（可选）：须存在且空闲；工作区缺省继承会话目录
+        session = None
+        session_id = str((req or {}).get("session_id") or "").strip()
+        if session_id:
+            session = get_session_store().get(session_id)
+            if session is None:
+                raise HTTPException(status_code=404, detail=f"会话不存在: {session_id}")
+            if session.data.get("busy"):
+                raise HTTPException(status_code=409, detail="该会话有任务正在运行，请稍候")
+            # 会话级配置继承（创建时指定，后续轮次沿用）
+            if not pool_id:
+                pool_id = str(session.data.get("pool_id") or "")
+
         ws_raw = str((req or {}).get("workspace") or "").strip()
+        if not ws_raw and session is not None:
+            ws_raw = str(session.data.get("workspace") or "")
         if ws_raw:
             ws_path = Path(ws_raw)
             if not ws_path.exists():
@@ -533,6 +588,8 @@ try:
 
         # 两级模式（D7）：显式指定执行者（本地小模型）时，规划=chat、执行=executor_chat
         executor_pool_id = str((req or {}).get("executor_pool_id") or "").strip()
+        if not executor_pool_id and session is not None:
+            executor_pool_id = str(session.data.get("executor_pool_id") or "")
         executor_chat = None
         executor_model = ""
         if executor_pool_id:
@@ -565,8 +622,11 @@ try:
         if info is None:
             raise HTTPException(status_code=503, detail="智能体同时运行任务已达上限")
 
-        s = settings_store().to_dict()
-        agent_cfg = s.get("agent", {})
+        if session is not None:
+            session.data["busy"] = True
+            if not session.data.get("workspace"):
+                session.data["workspace"] = workspace_dir
+            get_session_store().save(session)
 
         async def _run():
             try:
@@ -577,21 +637,132 @@ try:
                     token_cap=int(agent_cfg.get("token_cap", 20000)),
                     allow_shell=bool(agent_cfg.get("allow_shell", False)),
                     shell_timeout_s=int(agent_cfg.get("shell_timeout_s", 20)),
+                    allow_net=bool(agent_cfg.get("allow_net", True)),
                     executor_chat=executor_chat,
                     max_handoffs=int(agent_cfg.get("max_handoffs", 2)),
+                    session=session,
+                    approval_policy=str(agent_cfg.get("approval_policy", "dangerous")),
+                    approval_timeout_s=int(agent_cfg.get("approval_timeout_s", 120)),
                 )
             except Exception as exc:
                 import traceback
                 traceback.print_exc()
-                info.state = "failed"
+                service._transition_state(info, "failed")
                 info.error = str(exc)
                 info.finished_at = __import__("time").time()
                 service._write_status(info)
+            finally:
+                if session is not None:
+                    session.data["busy"] = False
+                    get_session_store().save(session)
 
         info.asyncio_task = asyncio.create_task(_run())
         return {"request_id": request_id, "status": "running", "model": model,
                 "workspace": workspace_dir, "mode": mode,
-                "executor_model": executor_model}
+                "executor_model": executor_model, "session_id": session_id or None}
+
+    @app.post("/agent/{request_id}/cancel", tags=["agent"])
+    async def agent_cancel(request_id: str):
+        """停止运行中的智能体任务。"""
+        _check_id(request_id, "request_id")
+        from gateway.agent import get_agent_service
+        service = get_agent_service()
+        info = service.get(request_id)
+        if info is None:
+            raise HTTPException(status_code=404, detail=f"智能体任务不存在: {request_id}")
+        if info.state != "running":
+            return {"ok": False, "detail": f"任务已结束（{info.state}）"}
+        if info.asyncio_task is not None:
+            info.asyncio_task.cancel()
+        service._transition_state(info, "failed")
+        info.error = "cancelled_by_user"
+        info.finished_at = __import__("time").time()
+        service._write_status(info)
+        return {"ok": True}
+
+    @app.post("/agent/{request_id}/approve", tags=["agent"])
+    async def agent_approve(request_id: str, req: dict):
+        """裁决待审批操作：{"approval_id", "allowed"}（dsh 式 allow-once / deny）。"""
+        _check_id(request_id, "request_id")
+        from gateway.agent import get_agent_service
+        info = get_agent_service().get(request_id)
+        if info is None:
+            raise HTTPException(status_code=404, detail=f"智能体任务不存在: {request_id}")
+        approval_id = str((req or {}).get("approval_id") or "")
+        allowed = bool((req or {}).get("allowed", False))
+        mgr = getattr(info, "_approval_manager", None)
+        if mgr is None:
+            raise HTTPException(status_code=409, detail="该任务无审批流程")
+        ok = mgr.decide(approval_id, allowed)
+        if not ok:
+            raise HTTPException(status_code=404, detail=f"审批单不存在或已裁决: {approval_id}")
+        return {"ok": True, "approval_id": approval_id, "allowed": allowed}
+
+    # ---------------- 会话（dsh 式多轮对话） ----------------
+    @app.post("/agent/sessions", tags=["agent"])
+    async def agent_session_create(req: dict = None):
+        """创建会话：{"title"?, "workspace"?, "pool_id"?, "executor_pool_id"?}"""
+        from gateway.agent import get_session_store
+        r = req or {}
+        sess = get_session_store().create(
+            title=str(r.get("title") or "").strip(),
+            workspace=str(r.get("workspace") or "").strip(),
+            pool_id=str(r.get("pool_id") or ""),
+            executor_pool_id=str(r.get("executor_pool_id") or ""))
+        return sess.view()
+
+    @app.get("/agent/sessions", tags=["agent"])
+    async def agent_sessions():
+        """会话列表（按更新时间倒序）。"""
+        from gateway.agent import get_session_store
+        return get_session_store().list()
+
+    @app.get("/agent/sessions/{sid}", tags=["agent"])
+    async def agent_session_detail(sid: str):
+        """会话详情（含轮次）。"""
+        _check_id(sid, "会话 ID")
+        from gateway.agent import get_session_store
+        sess = get_session_store().get(sid)
+        if sess is None:
+            raise HTTPException(status_code=404, detail=f"会话不存在: {sid}")
+        return sess.view()
+
+    @app.patch("/agent/sessions/{sid}", tags=["agent"])
+    async def agent_session_rename(sid: str, req: dict = None):
+        """重命名会话：{"title"}（dsh session.rename 对齐）。"""
+        _check_id(sid, "会话 ID")
+        from gateway.agent import get_session_store
+        title = str((req or {}).get("title") or "").strip()
+        if not title:
+            raise HTTPException(status_code=400, detail="title 不能为空")
+        sess = get_session_store().rename(sid, title)
+        if sess is None:
+            raise HTTPException(status_code=404, detail=f"会话不存在: {sid}")
+        return sess.view()
+
+    @app.post("/agent/sessions/{sid}/fork", tags=["agent"])
+    async def agent_session_fork(sid: str, req: dict = None):
+        """从会话分叉新会话：{"turn_index": 截止轮下标(缺省=全部轮), "title"}。
+
+        T-M1（采纳 pi 会话树设计）：值拷贝历史轮次，原会话不变；
+        新会话带 parent_id/fork_point 血统字段。
+        """
+        _check_id(sid, "会话 ID")
+        from gateway.agent import get_session_store
+        body = req or {}
+        turn_index = body.get("turn_index")
+        sess = get_session_store().fork(sid, turn_index,
+                                        str(body.get("title") or ""))
+        if sess is None:
+            raise HTTPException(status_code=404,
+                                detail=f"会话不存在或分叉点越界: {sid}")
+        return sess.view()
+
+    @app.delete("/agent/sessions/{sid}", tags=["agent"])
+    async def agent_session_delete(sid: str):
+        _check_id(sid, "会话 ID")
+        from gateway.agent import get_session_store
+        return {"ok": get_session_store().delete(sid)}
 
     @app.get("/agent/fs", tags=["agent"])
     async def agent_fs_browse(path: str = ""):
@@ -637,6 +808,7 @@ try:
 
     @app.get("/agent/{request_id}/status", tags=["agent"])
     async def agent_status(request_id: str):
+        _check_id(request_id, "request_id")
         from gateway.agent import get_agent_service
         info = get_agent_service().get(request_id)
         if info is None:
@@ -651,12 +823,14 @@ try:
     @app.get("/agent/{request_id}/events", tags=["agent"])
     async def agent_events(request_id: str):
         """完整事件列表（JSON，刷新后恢复用）。"""
+        _check_id(request_id, "request_id")
         from gateway.agent import get_agent_service
         return get_agent_service().read_events(request_id)
 
     @app.get("/agent/{request_id}/stream", tags=["agent"])
     async def agent_stream(request_id: str):
         """SSE：实时推送智能体过程事件（round/tool_call/tool_result/usage/final）。"""
+        _check_id(request_id, "request_id")
         from fastapi.responses import StreamingResponse
         from gateway.agent import get_agent_service
 
@@ -715,19 +889,36 @@ try:
     # ---------------- 模型设置（用户可调整） ----------------
     @app.get("/config", tags=["settings"])
     async def get_config():
-        """读取当前可调整设置（小模型 / 大模型 / 管线）。"""
-        return settings_store().to_dict()
+        """读取当前可调整设置（小模型 / 大模型 / 管线）。
+
+        architect.api_key 打码返回（api_key_set + 前 6 位，对齐 D2 池条目语义）；
+        修改时留空/不传 = 保留服务端已存值。
+        """
+        out = settings_store().to_dict()
+        arch = out.get("architect") or {}
+        key = arch.get("api_key") or ""
+        arch["api_key_set"] = bool(key)
+        arch["api_key"] = (key[:6] + "…") if key else ""
+        return out
 
     @app.put("/config", tags=["settings"])
     async def put_config(patch: dict):
         """部分更新设置并重建管线。示例：
         {"worker": {"backend": "openai", "base_url": "http://127.0.0.1:11434/v1", "temperature": 0.4}}
+
+        architect.api_key 传空串 = 保留原值（与打码返回配套）。
         """
+        arch_patch = (patch or {}).get("architect")
+        if isinstance(arch_patch, dict) and not str(arch_patch.get("api_key") or "").strip():
+            arch_patch.pop("api_key", None)
         try:
             merged = settings_store().update(patch)
         except Exception as e:
             raise HTTPException(status_code=400, detail=f"设置非法: {e}")
         rebuild_pipeline()
+        key = merged.get("architect", {}).get("api_key") or ""
+        merged["architect"]["api_key_set"] = bool(key)
+        merged["architect"]["api_key"] = (key[:6] + "…") if key else ""
         return merged
 
     @app.post("/config/reset", tags=["settings"])
@@ -1014,4 +1205,6 @@ def _maybe_enqueue(result) -> None:
 
 if __name__ == "__main__":
     import uvicorn
-    uvicorn.run("gateway.api:app", host="0.0.0.0", port=8000, reload=False)
+    # 默认只绑定回环地址：网关能读写工作区文件/执行命令，不宜默认暴露到局域网
+    # （需要局域网访问时显式 --host 0.0.0.0，并设置 GATEWAY_TRUSTED_HOSTS 放行对应主机名）
+    uvicorn.run("gateway.api:app", host="127.0.0.1", port=8000, reload=False)

gateway/llama_manager.py

@@ -211,7 +211,7 @@ class LlamaManager:
             args.extend(extra_args)
 
         LOG_FILE.parent.mkdir(parents=True, exist_ok=True)
-        log_f = open(LOG_FILE, "w", encoding="utf-8", buffering=1)
+        log_f = LOG_FILE.open("w", encoding="utf-8", buffering=1)
 
         try:
             self._proc = subprocess.Popen(
@@ -323,6 +323,15 @@ class LlamaManager:
         """
         import httpx
 
+        # URL 协议白名单：只允许 http/https（file://、ftp:// 等一律拒绝）。
+        # 必须先于 HF 别名转换判定，否则 ftp:// 会被误拼成 HF 地址。
+        if "://" in url:
+            scheme = url.split("://", 1)[0].lower()
+            if scheme not in ("http", "https"):
+                prog = DownloadProgress(url=url, dest=str(dest or ""),
+                                        error=f"仅允许 http/https 下载地址（收到 {scheme}）")
+                return prog
+
         # 路径别名转换
         if not url.startswith("http"):
             url = f"https://huggingface.co/{url}/resolve/main"
@@ -334,6 +343,15 @@ class LlamaManager:
 
         if dest:
             dest_path = Path(dest)
+            # 目标关押：自定义 dest 必须仍位于 models/ 目录内（防 ../ 越界写盘）
+            models_root = MODELS_DIR.resolve()
+            resolved = (models_root / dest_path).resolve() if not dest_path.is_absolute() \
+                else dest_path.resolve()
+            if resolved != models_root and models_root not in resolved.parents:
+                prog = DownloadProgress(url=url, dest=str(dest_path),
+                                        error=f"下载目标必须在 models/ 目录内: {dest}")
+                return prog
+            dest_path = resolved
         else:
             dest_path = MODELS_DIR / filename
 

gateway/settings.py

@@ -43,7 +43,10 @@ DEFAULTS: Dict[str, Any] = {
         "token_cap": 20000,                  # 单次智能体任务 token 熔断
         "allow_shell": False,                # 允许 run_command 执行 shell（默认关）
         "shell_timeout_s": 20,               # shell 命令超时
+        "allow_net": True,                   # 允许 web_fetch 抓取公网页面（SSRF 防护内置）
         "max_handoffs": 2,                   # 两级模式：规划者<->执行者交接轮数上限
+        "approval_policy": "dangerous",      # 审批策略：off | dangerous（写/编辑/命令询问）| all
+        "approval_timeout_s": 120,           # 审批等待超时（超时自动拒绝）
     },
 }
 

gateway/static/assets/MetricsView-BIMJ3R2m.js

@@ -1 +1 @@
-import{A as e,D as t,G as n,I as r,L as i,N as a,O as o,P as s,V as c,W as l,j as u,k as d,s as f,t as p}from"./index-DtjeaX4S.js";var m={class:`metrics-view`},h={key:0,class:`loading`},g={key:1,class:`error`},_={class:`card-grid`},v={class:`metric-card`},y={class:`kv-list`},b={class:`metric-card`},x={class:`kv-list`},S={key:0,class:`metric-card highlight`},C={class:`kv-list`},w={key:0},T={key:1},E={key:1,class:`metric-card`},D={class:`by-model`},O={class:`mono`},k={key:2,class:`metric-card review-card`},A={class:`review-stats`},j={class:`stat-item`},M={class:`stat-num`},N={class:`stat-item`},P={class:`stat-num`},F={key:0,class:`progress-wrap`},I={class:`review-rate`},L={class:`raw-json`},R=p(a({__name:`MetricsView`,setup(a){let p=c(null),R=c(!1),z=c(``),B=o(()=>p.value?.v2?.by_model||null);async function V(){R.value=!0,z.value=``;try{p.value=await f()}catch(e){z.value=e instanceof Error?e.message:`指标加载失败，请检查后端服务`}finally{R.value=!1}}return s(V),(a,o)=>(r(),u(`div`,m,[d(`header`,{class:`metrics-header`},[o[0]||=d(`h2`,null,`系统指标`,-1),d(`button`,{class:`refresh`,onClick:V},`🔄 刷新`)]),R.value?(r(),u(`div`,h,`加载中…`)):z.value?(r(),u(`div`,g,n(z.value),1)):p.value?(r(),u(t,{key:2},[d(`div`,_,[d(`div`,v,[o[1]||=d(`h3`,null,`路由器（v1）`,-1),d(`div`,y,[(r(!0),u(t,null,i(p.value.router,(e,i)=>(r(),u(t,{key:i},[d(`span`,null,n(i),1),d(`b`,null,n(e),1)],64))),128))])]),d(`div`,b,[o[2]||=d(`h3`,null,`缓存`,-1),d(`div`,x,[(r(!0),u(t,null,i(p.value.cache,(e,i)=>(r(),u(t,{key:i},[d(`span`,null,n(i),1),d(`b`,null,n(e),1)],64))),128))])]),p.value.v2?(r(),u(`div`,S,[o[3]||=d(`h3`,null,`协作管线（v2）`,-1),d(`div`,C,[(r(!0),u(t,null,i(p.value.v2,(i,a)=>(r(),u(t,{key:a},[a===`by_model`?e(``,!0):(r(),u(`span`,w,n(a),1)),a===`by_model`?e(``,!0):(r(),u(`b`,T,n(i),1))],64))),128))])])):e(``,!0),B.value&&Object.keys(B.value).length?(r(),u(`div`,E,[o[5]||=d(`h3`,null,`按模型分账（token / 成本）`,-1),d(`table`,D,[o[4]||=d(`thead`,null,[d(`tr`,null,[d(`th`,null,`模型`),d(`th`,null,`次数`),d(`th`,null,`入`),d(`th`,null,`出`),d(`th`,null,`成本 $`)])],-1),d(`tbody`,null,[(r(!0),u(t,null,i(B.value,(e,t)=>(r(),u(`tr`,{key:t},[d(`td`,O,n(t),1),d(`td`,null,n(e.requests),1),d(`td`,null,n(e.input_tokens),1),d(`td`,null,n(e.output_tokens),1),d(`td`,null,n(e.cost_est_usd),1)]))),128))])]),o[6]||=d(`p`,{class:`hint`},`单价来自模型池条目（$/1M tokens）；经典设置下的模型成本不计入。`,-1)])):e(``,!0),p.value.review?(r(),u(`div`,k,[o[9]||=d(`h3`,null,`人工检验`,-1),d(`div`,A,[d(`div`,j,[d(`span`,M,n(p.value.review.pending),1),o[7]||=d(`span`,{class:`stat-label`},`待审核`,-1)]),d(`div`,N,[d(`span`,P,n(p.value.review.total),1),o[8]||=d(`span`,{class:`stat-label`},`总提交`,-1)])]),p.value.review.total>0?(r(),u(`div`,F,[d(`div`,{class:`reviewed-bar`,style:l({width:`${(p.value.review.total-p.value.review.pending)/p.value.review.total*100}%`})},null,4)])):e(``,!0),d(`p`,I,` 通过率： `+n(((p.value.review.total-p.value.review.pending)/p.value.review.total*100).toFixed(1))+`% `,1)])):e(``,!0)]),d(`details`,L,[o[10]||=d(`summary`,null,`原始 JSON`,-1),d(`pre`,null,n(JSON.stringify(p.value,null,2)),1)])],64)):e(``,!0)]))}}),[[`__scopeId`,`data-v-ba641559`]]);export{R as default};
+import{A as e,D as t,G as n,I as r,L as i,N as a,O as o,P as s,V as c,W as l,j as u,k as d,s as f,t as p}from"./index-kbuKhaUa.js";var m={class:`metrics-view`},h={key:0,class:`loading`},g={key:1,class:`error`},_={class:`card-grid`},v={class:`metric-card`},y={class:`kv-list`},b={class:`metric-card`},x={class:`kv-list`},S={key:0,class:`metric-card highlight`},C={class:`kv-list`},w={key:0},T={key:1},E={key:1,class:`metric-card`},D={class:`by-model`},O={class:`mono`},k={key:2,class:`metric-card review-card`},A={class:`review-stats`},j={class:`stat-item`},M={class:`stat-num`},N={class:`stat-item`},P={class:`stat-num`},F={key:0,class:`progress-wrap`},I={class:`review-rate`},L={class:`raw-json`},R=p(a({__name:`MetricsView`,setup(a){let p=c(null),R=c(!1),z=c(``),B=o(()=>p.value?.v2?.by_model||null);async function V(){R.value=!0,z.value=``;try{p.value=await f()}catch(e){z.value=e instanceof Error?e.message:`指标加载失败，请检查后端服务`}finally{R.value=!1}}return s(V),(a,o)=>(r(),u(`div`,m,[d(`header`,{class:`metrics-header`},[o[0]||=d(`h2`,null,`系统指标`,-1),d(`button`,{class:`refresh`,onClick:V},`🔄 刷新`)]),R.value?(r(),u(`div`,h,`加载中…`)):z.value?(r(),u(`div`,g,n(z.value),1)):p.value?(r(),u(t,{key:2},[d(`div`,_,[d(`div`,v,[o[1]||=d(`h3`,null,`路由器（v1）`,-1),d(`div`,y,[(r(!0),u(t,null,i(p.value.router,(e,i)=>(r(),u(t,{key:i},[d(`span`,null,n(i),1),d(`b`,null,n(e),1)],64))),128))])]),d(`div`,b,[o[2]||=d(`h3`,null,`缓存`,-1),d(`div`,x,[(r(!0),u(t,null,i(p.value.cache,(e,i)=>(r(),u(t,{key:i},[d(`span`,null,n(i),1),d(`b`,null,n(e),1)],64))),128))])]),p.value.v2?(r(),u(`div`,S,[o[3]||=d(`h3`,null,`协作管线（v2）`,-1),d(`div`,C,[(r(!0),u(t,null,i(p.value.v2,(i,a)=>(r(),u(t,{key:a},[a===`by_model`?e(``,!0):(r(),u(`span`,w,n(a),1)),a===`by_model`?e(``,!0):(r(),u(`b`,T,n(i),1))],64))),128))])])):e(``,!0),B.value&&Object.keys(B.value).length?(r(),u(`div`,E,[o[5]||=d(`h3`,null,`按模型分账（token / 成本）`,-1),d(`table`,D,[o[4]||=d(`thead`,null,[d(`tr`,null,[d(`th`,null,`模型`),d(`th`,null,`次数`),d(`th`,null,`入`),d(`th`,null,`出`),d(`th`,null,`成本 $`)])],-1),d(`tbody`,null,[(r(!0),u(t,null,i(B.value,(e,t)=>(r(),u(`tr`,{key:t},[d(`td`,O,n(t),1),d(`td`,null,n(e.requests),1),d(`td`,null,n(e.input_tokens),1),d(`td`,null,n(e.output_tokens),1),d(`td`,null,n(e.cost_est_usd),1)]))),128))])]),o[6]||=d(`p`,{class:`hint`},`单价来自模型池条目（$/1M tokens）；经典设置下的模型成本不计入。`,-1)])):e(``,!0),p.value.review?(r(),u(`div`,k,[o[9]||=d(`h3`,null,`人工检验`,-1),d(`div`,A,[d(`div`,j,[d(`span`,M,n(p.value.review.pending),1),o[7]||=d(`span`,{class:`stat-label`},`待审核`,-1)]),d(`div`,N,[d(`span`,P,n(p.value.review.total),1),o[8]||=d(`span`,{class:`stat-label`},`总提交`,-1)])]),p.value.review.total>0?(r(),u(`div`,F,[d(`div`,{class:`reviewed-bar`,style:l({width:`${(p.value.review.total-p.value.review.pending)/p.value.review.total*100}%`})},null,4)])):e(``,!0),d(`p`,I,` 通过率： `+n(((p.value.review.total-p.value.review.pending)/p.value.review.total*100).toFixed(1))+`% `,1)])):e(``,!0)]),d(`details`,L,[o[10]||=d(`summary`,null,`原始 JSON`,-1),d(`pre`,null,n(JSON.stringify(p.value,null,2)),1)])],64)):e(``,!0)]))}}),[[`__scopeId`,`data-v-8b237097`]]);export{R as default};

gateway/static/assets/MetricsView-DGq419lf.css

@@ -1 +0,0 @@
-.metrics-view[data-v-ba641559]{height:100%;padding:20px 24px;overflow-y:auto}.by-model[data-v-ba641559]{border-collapse:collapse;width:100%;font-size:12px}.by-model th[data-v-ba641559],.by-model td[data-v-ba641559]{text-align:left;border-bottom:1px solid #f3f4f6;padding:4px 8px}.by-model th[data-v-ba641559]{color:#6b7280;font-weight:600}.by-model td.mono[data-v-ba641559]{font-family:ui-monospace,Consolas,monospace}.hint[data-v-ba641559]{color:#9ca3af;margin-top:8px;font-size:11px}.metrics-header[data-v-ba641559]{justify-content:space-between;align-items:center;margin-bottom:20px;display:flex}.metrics-header h2[data-v-ba641559]{margin:0;font-size:20px}.refresh[data-v-ba641559]{cursor:pointer;background:#fff;border:1px solid #d1d5db;border-radius:6px;padding:6px 14px}.loading[data-v-ba641559],.error[data-v-ba641559]{text-align:center;color:#9ca3af;padding:40px}.error[data-v-ba641559]{color:#dc2626}.card-grid[data-v-ba641559]{grid-template-columns:repeat(auto-fill,minmax(280px,1fr));gap:16px;margin-bottom:24px;display:grid}.metric-card[data-v-ba641559]{background:#fff;border:1px solid #e5e7eb;border-radius:10px;padding:16px}.metric-card.highlight[data-v-ba641559]{background:#eff6ff;border-color:#2563eb}.metric-card h3[data-v-ba641559]{color:#374151;margin:0 0 12px;font-size:14px}.kv-list[data-v-ba641559]{grid-template-columns:1fr 1fr;gap:6px 12px;font-size:13px;display:grid}.kv-list span[data-v-ba641559]{color:#6b7280}.kv-list b[data-v-ba641559]{color:#111;text-align:right}.review-card[data-v-ba641559]{grid-column:span 2}.review-stats[data-v-ba641559]{gap:24px;margin-bottom:12px;display:flex}.stat-item[data-v-ba641559]{flex-direction:column;align-items:center;display:flex}.stat-num[data-v-ba641559]{color:#2563eb;font-size:28px;font-weight:700}.stat-label[data-v-ba641559]{color:#6b7280;font-size:12px}.progress-wrap[data-v-ba641559]{background:#e5e7eb;border-radius:99px;height:8px;margin-bottom:6px;overflow:hidden}.reviewed-bar[data-v-ba641559]{background:#16a34a;height:100%;transition:width .5s}.review-rate[data-v-ba641559]{color:#6b7280;margin:0;font-size:13px}.raw-json[data-v-ba641559]{background:#f9fafb;border:1px solid #e5e7eb;border-radius:8px}.raw-json summary[data-v-ba641559]{cursor:pointer;color:#6b7280;padding:10px 14px;font-size:13px}.raw-json pre[data-v-ba641559]{white-space:pre-wrap;border-top:1px solid #e5e7eb;margin:0;padding:10px 14px;font-size:12px}

gateway/static/assets/MetricsView-JgJGH4Og.css

@@ -0,0 +1 @@
+.metrics-view[data-v-8b237097]{height:100%;padding:20px 24px;overflow-y:auto}.by-model[data-v-8b237097]{border-collapse:collapse;width:100%;font-size:12px}.by-model th[data-v-8b237097],.by-model td[data-v-8b237097]{text-align:left;border-bottom:1px solid #f3f4f6;padding:4px 8px}.by-model th[data-v-8b237097]{color:#6b7280;font-weight:600}.by-model td.mono[data-v-8b237097]{font-family:ui-monospace,Consolas,monospace}.hint[data-v-8b237097]{color:#9ca3af;margin-top:8px;font-size:11px}.metrics-header[data-v-8b237097]{justify-content:space-between;align-items:center;margin-bottom:20px;display:flex}.metrics-header h2[data-v-8b237097]{margin:0;font-size:20px}.refresh[data-v-8b237097]{cursor:pointer;background:#fff;border:1px solid #d1d5db;border-radius:6px;padding:6px 14px}.loading[data-v-8b237097],.error[data-v-8b237097]{text-align:center;color:#9ca3af;padding:40px}.error[data-v-8b237097]{color:#dc2626}.card-grid[data-v-8b237097]{grid-template-columns:repeat(auto-fill,minmax(280px,1fr));gap:16px;margin-bottom:24px;display:grid}.metric-card[data-v-8b237097]{background:#fff;border:1px solid #e5e7eb;border-radius:10px;padding:16px}.metric-card.highlight[data-v-8b237097]{border-color:var(--c-primary);background:var(--c-primary-soft)}.metric-card h3[data-v-8b237097]{color:#374151;margin:0 0 12px;font-size:14px}.kv-list[data-v-8b237097]{grid-template-columns:1fr 1fr;gap:6px 12px;font-size:13px;display:grid}.kv-list span[data-v-8b237097]{color:#6b7280}.kv-list b[data-v-8b237097]{color:#111;text-align:right}.review-card[data-v-8b237097]{grid-column:span 2}.review-stats[data-v-8b237097]{gap:24px;margin-bottom:12px;display:flex}.stat-item[data-v-8b237097]{flex-direction:column;align-items:center;display:flex}.stat-num[data-v-8b237097]{color:var(--c-primary);font-size:28px;font-weight:700}.stat-label[data-v-8b237097]{color:#6b7280;font-size:12px}.progress-wrap[data-v-8b237097]{background:#e5e7eb;border-radius:99px;height:8px;margin-bottom:6px;overflow:hidden}.reviewed-bar[data-v-8b237097]{background:#16a34a;height:100%;transition:width .5s}.review-rate[data-v-8b237097]{color:#6b7280;margin:0;font-size:13px}.raw-json[data-v-8b237097]{background:var(--c-bg);border:1px solid #e5e7eb;border-radius:8px}.raw-json summary[data-v-8b237097]{cursor:pointer;color:#6b7280;padding:10px 14px;font-size:13px}.raw-json pre[data-v-8b237097]{white-space:pre-wrap;border-top:1px solid #e5e7eb;margin:0;padding:10px 14px;font-size:12px}

gateway/static/assets/ReviewView-9PXrv1jO.css

@@ -0,0 +1 @@
+.review-view[data-v-d5b38f1c]{height:100%;padding:20px 24px;overflow-y:auto}.review-header[data-v-d5b38f1c]{justify-content:space-between;align-items:center;margin-bottom:20px;display:flex}.review-header h2[data-v-d5b38f1c]{margin:0;font-size:20px}.controls[data-v-d5b38f1c]{gap:8px;display:flex}button[data-v-d5b38f1c]{cursor:pointer;background:#fff;border:1px solid #d1d5db;border-radius:6px;padding:6px 14px;font-size:13px}button.active[data-v-d5b38f1c]{background:var(--c-primary);color:#fff;border-color:var(--c-primary)}.refresh-btn[data-v-d5b38f1c]{margin-left:auto}.loading[data-v-d5b38f1c],.error[data-v-d5b38f1c],.empty[data-v-d5b38f1c]{text-align:center;color:#9ca3af;padding:40px}.error[data-v-d5b38f1c]{color:#dc2626}.queue-list[data-v-d5b38f1c]{flex-direction:column;gap:16px;display:flex}.review-card[data-v-d5b38f1c]{background:#fff;border:1px solid #e5e7eb;border-radius:10px;padding:16px}.card-header[data-v-d5b38f1c]{flex-wrap:wrap;align-items:center;gap:10px;margin-bottom:10px;display:flex}.card-id[data-v-d5b38f1c]{color:#6b7280;font-family:monospace;font-size:12px}.verdict-badge[data-v-d5b38f1c]{border-radius:99px;padding:2px 8px;font-size:12px;font-weight:600}.verdict-badge.pending[data-v-d5b38f1c]{color:#92400e;background:#fef3c7}.verdict-badge.approved[data-v-d5b38f1c]{color:#16a34a;background:#dcfce7}.verdict-badge.rejected[data-v-d5b38f1c]{color:#dc2626;background:#fee2e2}.tags[data-v-d5b38f1c]{gap:4px;display:flex}.tag[data-v-d5b38f1c]{color:#3730a3;background:#e0e7ff;border-radius:4px;padding:1px 6px;font-size:11px}.date[data-v-d5b38f1c]{color:#9ca3af;margin-left:auto;font-size:11px}.query-block[data-v-d5b38f1c],.response-block[data-v-d5b38f1c]{margin-bottom:8px;font-size:13px;line-height:1.6}.query-block pre[data-v-d5b38f1c],.response-block pre[data-v-d5b38f1c]{background:var(--c-bg);white-space:pre-wrap;border:1px solid #e5e7eb;border-radius:4px;margin:4px 0 0;padding:6px 10px;font-size:13px}.actions[data-v-d5b38f1c]{flex-direction:column;gap:8px;margin-top:10px;display:flex}textarea[data-v-d5b38f1c]{resize:vertical;box-sizing:border-box;border:1px solid #d1d5db;border-radius:6px;width:100%;padding:8px 10px;font-family:inherit;font-size:13px}.btn-row[data-v-d5b38f1c]{gap:8px;display:flex}.approve[data-v-d5b38f1c]{color:#16a34a;background:#dcfce7;border-color:#86efac}.reject[data-v-d5b38f1c]{color:#dc2626;background:#fee2e2;border-color:#fca5a5}.correction[data-v-d5b38f1c]{background:#fffbeb;border:1px solid #fcd34d;border-radius:4px;margin-top:8px;padding:6px 10px;font-size:13px}

gateway/static/assets/ReviewView-CaOmFJEu.css

@@ -1 +0,0 @@
-.review-view[data-v-19c16eff]{height:100%;padding:20px 24px;overflow-y:auto}.review-header[data-v-19c16eff]{justify-content:space-between;align-items:center;margin-bottom:20px;display:flex}.review-header h2[data-v-19c16eff]{margin:0;font-size:20px}.controls[data-v-19c16eff]{gap:8px;display:flex}button[data-v-19c16eff]{cursor:pointer;background:#fff;border:1px solid #d1d5db;border-radius:6px;padding:6px 14px;font-size:13px}button.active[data-v-19c16eff]{color:#fff;background:#2563eb;border-color:#2563eb}.refresh-btn[data-v-19c16eff]{margin-left:auto}.loading[data-v-19c16eff],.error[data-v-19c16eff],.empty[data-v-19c16eff]{text-align:center;color:#9ca3af;padding:40px}.error[data-v-19c16eff]{color:#dc2626}.queue-list[data-v-19c16eff]{flex-direction:column;gap:16px;display:flex}.review-card[data-v-19c16eff]{background:#fff;border:1px solid #e5e7eb;border-radius:10px;padding:16px}.card-header[data-v-19c16eff]{flex-wrap:wrap;align-items:center;gap:10px;margin-bottom:10px;display:flex}.card-id[data-v-19c16eff]{color:#6b7280;font-family:monospace;font-size:12px}.verdict-badge[data-v-19c16eff]{border-radius:99px;padding:2px 8px;font-size:12px;font-weight:600}.verdict-badge.pending[data-v-19c16eff]{color:#92400e;background:#fef3c7}.verdict-badge.approved[data-v-19c16eff]{color:#16a34a;background:#dcfce7}.verdict-badge.rejected[data-v-19c16eff]{color:#dc2626;background:#fee2e2}.tags[data-v-19c16eff]{gap:4px;display:flex}.tag[data-v-19c16eff]{color:#3730a3;background:#e0e7ff;border-radius:4px;padding:1px 6px;font-size:11px}.date[data-v-19c16eff]{color:#9ca3af;margin-left:auto;font-size:11px}.query-block[data-v-19c16eff],.response-block[data-v-19c16eff]{margin-bottom:8px;font-size:13px;line-height:1.6}.query-block pre[data-v-19c16eff],.response-block pre[data-v-19c16eff]{white-space:pre-wrap;background:#f9fafb;border:1px solid #e5e7eb;border-radius:4px;margin:4px 0 0;padding:6px 10px;font-size:13px}.actions[data-v-19c16eff]{flex-direction:column;gap:8px;margin-top:10px;display:flex}textarea[data-v-19c16eff]{resize:vertical;box-sizing:border-box;border:1px solid #d1d5db;border-radius:6px;width:100%;padding:8px 10px;font-family:inherit;font-size:13px}.btn-row[data-v-19c16eff]{gap:8px;display:flex}.approve[data-v-19c16eff]{color:#16a34a;background:#dcfce7;border-color:#86efac}.reject[data-v-19c16eff]{color:#dc2626;background:#fee2e2;border-color:#fca5a5}.correction[data-v-19c16eff]{background:#fffbeb;border:1px solid #fcd34d;border-radius:4px;margin-top:8px;padding:6px 10px;font-size:13px}

gateway/static/assets/ReviewView-xwvhvWhY.js

@@ -1 +1 @@
-import{A as e,D as t,E as n,G as r,I as i,L as a,M as o,N as s,O as c,P as l,U as u,V as d,f,j as p,k as m,t as h,v as g,z as _}from"./index-DtjeaX4S.js";var v={class:`review-view`},y={class:`review-header`},b={class:`controls`},x={key:0,class:`loading`},S={key:1,class:`error`},C={key:2,class:`queue-list`},w={key:0,class:`empty`},T={class:`card-header`},E={class:`card-id`},D={class:`tags`},O={class:`date`},k={class:`query-block`},A={class:`response-block`},j={key:0,class:`actions`},M=[`onUpdate:modelValue`],N={class:`btn-row`},P=[`onClick`],F=[`onClick`],I={key:1,class:`correction`},L=h(s({__name:`ReviewView`,setup(s){let h=d([]),L=d(!1),R=d(``),z=d(`pending`),B=d({}),V=c(()=>z.value===`all`?h.value:h.value.filter(e=>e.verdict===z.value));async function H(){L.value=!0,R.value=``;try{h.value=await f()}catch(e){R.value=e instanceof Error?e.message:String(e)}finally{L.value=!1}}async function U(e,t){try{await g(e,t,B.value[e]||void 0),await H()}catch(e){R.value=e instanceof Error?e.message:String(e)}}return l(H),(s,c)=>(i(),p(`div`,v,[m(`header`,y,[c[4]||=m(`h2`,null,`人工检验队列`,-1),m(`div`,b,[m(`button`,{class:u({active:z.value===`all`}),onClick:c[0]||=e=>z.value=`all`},`全部`,2),m(`button`,{class:u({active:z.value===`pending`}),onClick:c[1]||=e=>z.value=`pending`},`待审核`,2),m(`button`,{class:u({active:z.value===`approved`}),onClick:c[2]||=e=>z.value=`approved`},`已通过`,2),m(`button`,{class:u({active:z.value===`rejected`}),onClick:c[3]||=e=>z.value=`rejected`},`已拒绝`,2),m(`button`,{class:`refresh-btn`,onClick:H},`🔄 刷新`)])]),L.value?(i(),p(`div`,x,`加载中…`)):R.value?(i(),p(`div`,S,r(R.value),1)):(i(),p(`div`,C,[V.value.length?e(``,!0):(i(),p(`div`,w,`队列为空。`)),(i(!0),p(t,null,a(V.value,s=>(i(),p(`div`,{key:s.id,class:`review-card`},[m(`div`,T,[m(`span`,E,`#`+r(s.id),1),m(`span`,{class:u([`verdict-badge`,s.verdict])},r(s.verdict),3),m(`span`,D,[(i(!0),p(t,null,a(s.tags,e=>(i(),p(`span`,{key:e,class:`tag`},r(e),1))),128))]),m(`span`,O,r(s.created_at),1)]),m(`div`,k,[c[5]||=m(`strong`,null,`Query：`,-1),o(r(s.query),1)]),m(`div`,A,[c[6]||=m(`strong`,null,`Response：`,-1),m(`pre`,null,r(s.response),1)]),s.verdict===`pending`?(i(),p(`div`,j,[_(m(`textarea`,{"onUpdate:modelValue":e=>B.value[s.id]=e,placeholder:`修正意见（可选）`,rows:`2`},null,8,M),[[n,B.value[s.id]]]),m(`div`,N,[m(`button`,{class:`approve`,onClick:e=>U(s.id,`approved`)},`✅ 通过`,8,P),m(`button`,{class:`reject`,onClick:e=>U(s.id,`rejected`)},`❌ 拒绝`,8,F)])])):s.correction?(i(),p(`div`,I,[c[7]||=m(`strong`,null,`修正：`,-1),o(r(s.correction),1)])):e(``,!0)]))),128))]))]))}}),[[`__scopeId`,`data-v-19c16eff`]]);export{L as default};
+import{A as e,D as t,E as n,G as r,I as i,L as a,M as o,N as s,O as c,P as l,U as u,V as d,f,j as p,k as m,t as h,v as g,z as _}from"./index-kbuKhaUa.js";var v={class:`review-view`},y={class:`review-header`},b={class:`controls`},x={key:0,class:`loading`},S={key:1,class:`error`},C={key:2,class:`queue-list`},w={key:0,class:`empty`},T={class:`card-header`},E={class:`card-id`},D={class:`tags`},O={class:`date`},k={class:`query-block`},A={class:`response-block`},j={key:0,class:`actions`},M=[`onUpdate:modelValue`],N={class:`btn-row`},P=[`onClick`],F=[`onClick`],I={key:1,class:`correction`},L=h(s({__name:`ReviewView`,setup(s){let h=d([]),L=d(!1),R=d(``),z=d(`pending`),B=d({}),V=c(()=>z.value===`all`?h.value:h.value.filter(e=>e.verdict===z.value));async function H(){L.value=!0,R.value=``;try{h.value=await f()}catch(e){R.value=e instanceof Error?e.message:String(e)}finally{L.value=!1}}async function U(e,t){try{await g(e,t,B.value[e]||void 0),await H()}catch(e){R.value=e instanceof Error?e.message:String(e)}}return l(H),(s,c)=>(i(),p(`div`,v,[m(`header`,y,[c[4]||=m(`h2`,null,`人工检验队列`,-1),m(`div`,b,[m(`button`,{class:u({active:z.value===`all`}),onClick:c[0]||=e=>z.value=`all`},`全部`,2),m(`button`,{class:u({active:z.value===`pending`}),onClick:c[1]||=e=>z.value=`pending`},`待审核`,2),m(`button`,{class:u({active:z.value===`approved`}),onClick:c[2]||=e=>z.value=`approved`},`已通过`,2),m(`button`,{class:u({active:z.value===`rejected`}),onClick:c[3]||=e=>z.value=`rejected`},`已拒绝`,2),m(`button`,{class:`refresh-btn`,onClick:H},`🔄 刷新`)])]),L.value?(i(),p(`div`,x,`加载中…`)):R.value?(i(),p(`div`,S,r(R.value),1)):(i(),p(`div`,C,[V.value.length?e(``,!0):(i(),p(`div`,w,`队列为空。`)),(i(!0),p(t,null,a(V.value,s=>(i(),p(`div`,{key:s.id,class:`review-card`},[m(`div`,T,[m(`span`,E,`#`+r(s.id),1),m(`span`,{class:u([`verdict-badge`,s.verdict])},r(s.verdict),3),m(`span`,D,[(i(!0),p(t,null,a(s.tags,e=>(i(),p(`span`,{key:e,class:`tag`},r(e),1))),128))]),m(`span`,O,r(s.created_at),1)]),m(`div`,k,[c[5]||=m(`strong`,null,`Query：`,-1),o(r(s.query),1)]),m(`div`,A,[c[6]||=m(`strong`,null,`Response：`,-1),m(`pre`,null,r(s.response),1)]),s.verdict===`pending`?(i(),p(`div`,j,[_(m(`textarea`,{"onUpdate:modelValue":e=>B.value[s.id]=e,placeholder:`修正意见（可选）`,rows:`2`},null,8,M),[[n,B.value[s.id]]]),m(`div`,N,[m(`button`,{class:`approve`,onClick:e=>U(s.id,`approved`)},`✅ 通过`,8,P),m(`button`,{class:`reject`,onClick:e=>U(s.id,`rejected`)},`❌ 拒绝`,8,F)])])):s.correction?(i(),p(`div`,I,[c[7]||=m(`strong`,null,`修正：`,-1),o(r(s.correction),1)])):e(``,!0)]))),128))]))]))}}),[[`__scopeId`,`data-v-d5b38f1c`]]);export{L as default};

gateway/static/index.html

@@ -1,12 +1,12 @@
 <!doctype html>
-<html lang="en">
+<html lang="zh-CN">
   <head>
     <meta charset="UTF-8" />
     <link rel="icon" type="image/svg+xml" href="/static/favicon.svg" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>webapp</title>
-    <script type="module" crossorigin src="/static/assets/index-DtjeaX4S.js"></script>
-    <link rel="stylesheet" crossorigin href="/static/assets/index-DPz6YNpx.css">
+    <title>端云协同 LLM 协作系统</title>
+    <script type="module" crossorigin src="/static/assets/index-kbuKhaUa.js"></script>
+    <link rel="stylesheet" crossorigin href="/static/assets/index-BYO22xUl.css">
   </head>
   <body>
     <div id="app"></div>

router_system/cache.py

@@ -7,6 +7,11 @@
 高频语义命中会提升为 O(1) 的精确缓存条目。
 
 只缓存"未升级"的结果（升级路径每次都走大模型，不缓存，避免陈旧）。
+
+性能设计（2026-09 优化）：
+- 每条语义缓存条目在写入时预计算并缓存向量范数，查询时免重复计算（原来每对比较都重算）
+- 语义查找单遍完成：扫描即跟踪最优条目与命中计数，命中后不再二次线性查找
+- 相似度达到 1.0（完全相同查询）时提前终止扫描（余弦相似度上界，不可能更优）
 """
 from __future__ import annotations
 
@@ -29,18 +34,6 @@ def _ngrams(text: str, n: int = 3) -> List[str]:
     return [cleaned[i:i + n] for i in range(len(cleaned) - n + 1)]
 
 
-def _cosine(vec_a: Dict[str, float], vec_b: Dict[str, float]) -> float:
-    if not vec_a or not vec_b:
-        return 0.0
-    common = set(vec_a) & set(vec_b)
-    dot = sum(vec_a[k] * vec_b[k] for k in common)
-    na = sum(v * v for v in vec_a.values()) ** 0.5
-    nb = sum(v * v for v in vec_b.values()) ** 0.5
-    if na == 0 or nb == 0:
-        return 0.0
-    return dot / (na * nb)
-
-
 def _tf_vector(grams: List[str]) -> Dict[str, float]:
     vec: Dict[str, float] = {}
     for g in grams:
@@ -48,6 +41,17 @@ def _tf_vector(grams: List[str]) -> Dict[str, float]:
     return vec
 
 
+def _norm(vec: Dict[str, float]) -> float:
+    return sum(v * v for v in vec.values()) ** 0.5
+
+
+def _dot(vec_a: Dict[str, float], vec_b: Dict[str, float]) -> float:
+    """点积：遍历较小的一方，另一侧用 get 兜底。"""
+    if len(vec_a) > len(vec_b):
+        vec_a, vec_b = vec_b, vec_a
+    return sum(v * vec_b.get(k, 0.0) for k, v in vec_a.items())
+
+
 class RouterCache:
     """L1 精确缓存 + L2 语义缓存。"""
 
@@ -61,6 +65,7 @@ class RouterCache:
         self._exact: Dict[str, CacheEntry] = {}
         self._semantic: List[Tuple[str, CacheEntry]] = []  # (query, entry)
         self._sem_vecs: Dict[str, Dict[str, float]] = {}
+        self._sem_norms: Dict[str, float] = {}             # 预计算范数，避免查询期重算
         self.hits = {"exact": 0, "semantic": 0}
         self.misses = 0
 
@@ -74,36 +79,41 @@ class RouterCache:
 
         if self.semantic_enabled:
             q_vec = _tf_vector(_ngrams(query))
+            q_norm = _norm(q_vec)
             best_sim = 0.0
-            best_query: Optional[str] = None
-            best_result: Optional[Dict[str, Any]] = None
-            for q, e in self._semantic:
-                sim = _cosine(q_vec, self._sem_vecs.get(q, {}))
-                if sim > best_sim:
-                    best_sim = sim
-                    best_query = q
-                    best_result = e.result
-            if best_query is not None and best_sim >= self.similarity_threshold:
+            best_idx = -1
+            if q_norm > 0.0:
+                # 单遍扫描：同时跟踪最优相似度与条目位置
+                for i, (q, _e) in enumerate(self._semantic):
+                    n_q = self._sem_norms.get(q, 0.0)
+                    if n_q <= 0.0:
+                        continue
+                    sim = _dot(q_vec, self._sem_vecs.get(q, {})) / (q_norm * n_q)
+                    if sim > best_sim:
+                        best_sim = sim
+                        best_idx = i
+                        if sim >= 1.0:
+                            break  # 余弦相似度上界：完全相同查询，提前终止
+            if best_idx >= 0 and best_sim >= self.similarity_threshold:
+                best_q, best_entry = self._semantic[best_idx]
                 # 完全相同查询（相似度=1.0）计为 exact 命中
                 is_exact = best_sim >= 0.999
                 level = "exact" if is_exact else "semantic"
                 self.hits[level] += 1
-                self._semantic_hit(best_query)
-                return (level, best_result)
+                self._bump_semantic(best_idx, best_q, best_entry)
+                return (level, best_entry.result)
 
         self.misses += 1
         return None
 
-    def _semantic_hit(self, query: str):
-        """语义命中：累计命中次数，达到阈值提升为精确缓存。"""
-        for i, (q, e) in enumerate(self._semantic):
-            if q == query:
-                e.hits += 1
-                if e.hits >= self.promote_frequency:
-                    self._exact[query] = e
-                    self._semantic.pop(i)
-                    self._sem_vecs.pop(query, None)
-                break
+    def _bump_semantic(self, idx: int, query: str, entry: CacheEntry):
+        """语义命中：累计命中次数，达到阈值提升为精确缓存（O(1)，无需二次查找）。"""
+        entry.hits += 1
+        if entry.hits >= self.promote_frequency:
+            self._exact[query] = entry
+            self._semantic.pop(idx)
+            self._sem_vecs.pop(query, None)
+            self._sem_norms.pop(query, None)
 
     # ---- 写入 ----
     def put(self, query: str, result: Dict[str, Any]):
@@ -114,8 +124,11 @@ class RouterCache:
             if len(self._semantic) >= self.max_semantic:
                 old_q, _ = self._semantic.pop(0)
                 self._sem_vecs.pop(old_q, None)
+                self._sem_norms.pop(old_q, None)
             self._semantic.append((query, entry))
-            self._sem_vecs[query] = _tf_vector(_ngrams(query))
+            vec = _tf_vector(_ngrams(query))
+            self._sem_vecs[query] = vec
+            self._sem_norms[query] = _norm(vec)
         else:
             self._exact[query] = entry
             if len(self._exact) > self.max_exact:
@@ -137,5 +150,6 @@ class RouterCache:
         self._exact.clear()
         self._semantic.clear()
         self._sem_vecs.clear()
+        self._sem_norms.clear()
         self.hits = {"exact": 0, "semantic": 0}
         self.misses = 0

router_system/classifier.py

@@ -186,7 +186,8 @@ class RuleClassifier(BaseClassifier):
                 matched_rules=[],
             )
 
-        best_domain = max(raw, key=raw.get)
+        # 同分决胜：按领域名字典序，保证与规则表排列顺序无关的确定性
+        best_domain = max(sorted(raw), key=lambda d: raw[d])
         best_score = raw[best_domain]
         confidence = 1.0 - math.exp(-best_score)
 
@@ -196,7 +197,7 @@ class RuleClassifier(BaseClassifier):
 
         # 与次高分的差距影响置信度（区分度）
         if len(raw) > 1:
-            second = sorted(raw.values(), reverse=True)[1]
+            second = max(v for d, v in raw.items() if d != best_domain)
             if second > 0.7 * best_score:
                 confidence *= 0.85
 

router_system/executors.py

@@ -0,0 +1,370 @@
+"""执行器体系（L0 默认专家 + NodeExecutor 后端抽象）。
+
+设计对齐"专家系统风格"（《可行性调研与落地实现路线报告》第八章）：
+- 输出 = 结构化模板填充（回显查询、知识库事实、领域结构），不追求自然语言流畅度
+- 确定性：同输入 → 同输出（无采样随机）
+- 最小参数：零模型参数；L2 模式下同一节点可改由本地小模型执行（Router 按配置切换）
+
+kind（子任务动作类型）与模板对应：
+analyze 需求/条件分析 | design 方案设计 | implement 代码实现 | solve 数学求解
+diagnose 错误定位 | fix 修复方案 | retrieve 知识检索 | conclude 结论
+advise 一般建议 | explain 展开解释 | disclaimer 免责/警示 | verify 自检
+"""
+from __future__ import annotations
+
+from typing import Any, Dict, Optional
+
+from .experts import Expert, extract_content_terms
+from .knowledge import KnowledgeBase
+from .memory import TaskNode, WorkingMemory
+from .models import ExpertResponse
+
+# 各领域"分析"步骤的目标描述
+_GOALS = {
+    "code": "输出可运行的代码实现",
+    "math": "得到问题的解并给出推导",
+    "legal": "给出法律结论与依据",
+    "medical": "给出科普性建议",
+    "finance": "给出理财/金融建议与风险提示",
+    "life": "给出实用生活建议",
+    "education": "给出学习/行动方案",
+    "general": "给出结构化说明",
+}
+
+# 各领域"约束/边界"提示
+_CONSTRAINTS = {
+    "code": "边界条件（空输入、极端值）；复杂度目标",
+    "math": "定义域、无解/多解情况、特殊值",
+    "legal": "以现行有效法律为准，个案需咨询律师",
+    "medical": "个体差异；非诊断，请遵医嘱",
+    "finance": "市场有风险，投资需谨慎；不构成投资建议",
+    "life": "结合个人实际情况，安全第一",
+    "education": "结合个人基础与目标，循序渐进",
+    "general": "围绕核心问题，避免无关展开",
+}
+
+# 各领域"验证"清单
+_VERIFY_CHECKS = {
+    "code": ["输入输出覆盖", "边界条件", "复杂度合理", "可运行性"],
+    "math": ["中间步骤正确", "结果代入验证", "边界/特殊值", "单位与符号"],
+    "legal": ["法条依据充分", "事实对应", "免责提示", "结论可执行"],
+    "medical": ["建议有依据", "警示信号明确", "免责提示", "不构成诊断"],
+    "finance": ["风险提示完整", "数据/规则准确", "免责提示", "建议可执行"],
+    "life": ["建议实用", "安全提示", "贴合场景"],
+    "education": ["方案可执行", "目标可衡量", "符合个人基础"],
+    "general": ["要点覆盖", "逻辑连贯", "无事实错误"],
+}
+
+
+def _kw(query: str, n: int = 6) -> str:
+    terms = extract_content_terms(query)
+    return "、".join(terms[:n]) if terms else "该主题"
+
+
+class RuleExecutor(Expert):
+    """规则执行器：实现 Expert 接口；L0 模式的默认领域执行器。"""
+
+    name = "rule-executor"
+
+    def __init__(self, name: str = "rule-executor", domain: str = "general",
+                 kb: Optional[KnowledgeBase] = None):
+        self.name = name
+        self.domain = domain
+        self.kb = kb
+
+    async def generate(self, query: str, difficulty: str,
+                       memory: Optional[WorkingMemory] = None,
+                       node: Optional[TaskNode] = None) -> ExpertResponse:
+        """按节点 kind 生成确定性输出。兼容 Expert 基类签名（后两参可选）。"""
+        kind = node.kind if node is not None else "explain"
+        domain = node.domain if node is not None else self.domain
+        text = self._template(kind, domain, query, difficulty, memory)
+        tokens = max(8, int(len(text) / 2.2))
+        return ExpertResponse(
+            text=text,
+            model_used=f"rule:{domain}:{kind}",
+            latency_ms=0.0,
+            tokens=tokens,
+            cost_est=0.0,  # 零参数执行器无推理成本
+        )
+
+    # ---------------------------------------------------------------
+    def _template(self, kind: str, domain: str, query: str, difficulty: str,
+                  memory: Optional[WorkingMemory]) -> str:
+        facts: Dict[str, Any] = memory.facts if memory else {}
+        goal = _GOALS.get(domain, _GOALS["general"])
+        constraints = _CONSTRAINTS.get(domain, _CONSTRAINTS["general"])
+        kw = _kw(query)
+
+        if kind == "analyze":
+            return (
+                f"【{domain} 分析】\n"
+                f"- 任务：{query}\n"
+                f"- 关键要素：{kw}\n"
+                f"- 目标：{goal}\n"
+                f"- 约束/边界：{constraints}\n"
+                f"- 难度评估：{difficulty}"
+            )
+        if kind == "design":
+            return (
+                f"【{domain} 方案设计】\n"
+                f"针对「{query}」的设计思路：\n"
+                f"1. 明确核心目标与验收标准\n"
+                f"2. 选择合适的方法/数据结构（依据：{kw}）\n"
+                f"3. 拆解实现步骤并标注复杂度\n"
+                f"4. 预留边界处理与异常路径\n"
+                f"5. 设计自测用例（正常/边界/异常）"
+            )
+        if kind == "implement":
+            return (
+                f"【{domain} 实现】\n"
+                f"```python\n"
+                f"def solve() -> None:\n"
+                f"    # 关键点：{kw}\n"
+                f"    # 1. 校验输入与边界条件\n"
+                f"    # 2. 核心逻辑（依据 design 步骤）\n"
+                f"    # 3. 输出结果\n"
+                f"    pass\n"
+                f"```\n"
+                f"要点：{kw}；复杂度与边界说明见 design/verify 步骤。"
+            )
+        if kind == "solve":
+            return (
+                f"【{domain} 求解】\n"
+                f"题目：{query}\n"
+                f"步骤：\n"
+                f"1. 提取已知条件（{kw}）\n"
+                f"2. 选择方法：代数变形/公式代入/逐步推导\n"
+                f"3. 求解并化简中间结果\n"
+                f"4. 检查特殊值与边界\n"
+                f"结论：在标准假设下可得到闭合形式解；完整推导见正式解答。"
+            )
+        if kind == "diagnose":
+            return (
+                f"【{domain} 诊断】\n"
+                f"错误现象：{query}\n"
+                f"排查步骤：\n"
+                f"1. 复现并定位出错行\n"
+                f"2. 检查变量类型与取值（重点：{kw}）\n"
+                f"3. 核对函数签名、作用域与返回值\n"
+                f"4. 打印中间变量验证假设\n"
+                f"5. 用最小样例隔离问题"
+            )
+        if kind == "fix":
+            return (
+                f"【{domain} 修复方案】\n"
+                f"针对「{query}」：\n"
+                f"1. 根因：见 diagnose 步骤\n"
+                f"2. 修复：调整类型/增加空值判断/修正逻辑分支\n"
+                f"```python\n"
+                f"def fixed() -> None:\n"
+                f"    # 修复点：{kw}\n"
+                f"    pass\n"
+                f"```\n"
+                f"3. 回归：补充对应单测后重跑"
+            )
+        if kind == "retrieve":
+            return self._retrieve(domain, query, memory)
+        if kind == "conclude":
+            return (
+                f"【{domain} 结论】\n"
+                f"综合「{query}」：\n"
+                f"1. 事实梳理：{kw}\n"
+                f"2. 适用规则/依据（见 retrieve 步骤）\n"
+                f"3. 结论：在所述前提下，按上述规则处理\n"
+                f"4. 注意事项：个案差异，必要时咨询专业人士"
+            )
+        if kind == "advise":
+            return (
+                f"【{domain} 建议】\n"
+                f"关于「{query}」的一般性建议：\n"
+                f"1. 基础注意事项（{kw}）\n"
+                f"2. 可操作建议：分步执行并观察效果\n"
+                f"3. 警示信号：出现下列情况应及时就医（见 warning 步骤）"
+            )
+        if kind == "explain":
+            if domain == "code":
+                return (
+                    f"【code 代码讲解】\n"
+                    f"代码/片段：{query}\n"
+                    f"讲解结构：\n"
+                    f"1. 整体目的：这段代码要解决什么问题（{kw}）\n"
+                    f"2. 执行流程：按行/按函数梳理数据流与调用链\n"
+                    f"3. 关键点：数据结构、边界处理、异常路径\n"
+                    f"4. 可改进点：命名/复杂度/可读性建议"
+                )
+            return (
+                f"【{domain} 说明】\n"
+                f"主题：{query}\n"
+                f"1. 背景与定义\n"
+                f"2. 核心要点：{kw}\n"
+                f"3. 分类/维度/机制\n"
+                f"4. 实际应用与注意事项\n"
+                f"如需更深入分析，可补充上下文。"
+            )
+        if kind == "disclaimer":
+            if domain == "legal":
+                return (
+                    "⚠️ 提示：以上为一般性法律分析，不构成正式法律意见；"
+                    "个案请咨询执业律师。"
+                )
+            if domain == "medical":
+                return (
+                    "⚠️ 提示：以上内容仅供健康科普，不能替代医生诊断；"
+                    "如有不适请及时就医。"
+                )
+            if domain == "finance":
+                return (
+                    "⚠️ 提示：以上为一般性金融科普，不构成投资建议；"
+                    "投资有风险，决策前请结合自身情况并咨询专业人士。"
+                )
+            return ""
+        if kind == "verify":
+            checks = _VERIFY_CHECKS.get(domain, _VERIFY_CHECKS["general"])
+            items = "\n".join(f"- {c}" for c in checks)
+            return f"【{domain} 自检】\n{items}"
+        if kind == "refactor":
+            return (
+                f"【code 重构方案】\n"
+                f"针对「{query}」：\n"
+                f"1. 现状问题：重复代码/长函数/命名不清/耦合（{kw}）\n"
+                f"2. 重构手法：提取函数、消除魔法数字、引入类或模块、统一命名\n"
+                f"3. 目标结构：单一职责、清晰分层、可测试性\n"
+                f"4. 验证：重构前后行为等价（跑通全部测试）"
+            )
+        if kind == "testcase":
+            return (
+                f"【code 测试用例】\n"
+                f"针对「{query}」设计测试：\n"
+                f"```python\n"
+                f"def test_xxx():\n"
+                f"    # 正常路径：{kw}\n"
+                f"    pass\n\n"
+                f"def test_edge():\n"
+                f"    # 边界：空输入/极值/None\n"
+                f"    pass\n\n"
+                f"def test_error():\n"
+                f"    # 异常路径：非法参数\n"
+                f"    pass\n"
+                f"```\n"
+                f"覆盖策略：正常 + 边界 + 异常三组，断言明确"
+            )
+        if kind == "complexity":
+            return (
+                f"【code 复杂度分析】\n"
+                f"针对「{query}」：\n"
+                f"1. 时间复杂度：核心循环/递归层数 → 平均与最坏情况（{kw}）\n"
+                f"2. 空间复杂度：辅助数据结构占用\n"
+                f"3. 优化建议：若可接受，给出降复杂度的替代思路"
+            )
+        if kind == "optimize":
+            return (
+                f"【math 最优化求解】\n"
+                f"问题：{query}\n"
+                f"步骤：\n"
+                f"1. 建立目标函数与约束（{kw}）\n"
+                f"2. 求导/配方/不等式法找候选极值点\n"
+                f"3. 比较候选值并与边界比较\n"
+                f"4. 结论：给出最大值/最小值及取到条件"
+            )
+        if kind == "draft":
+            return (
+                f"【写作初稿】\n"
+                f"主题：{query}\n"
+                f"结构：\n"
+                f"1. 开头：点明主题与背景（{kw}）\n"
+                f"2. 主体：分点展开，每点配一个例子或依据\n"
+                f"3. 结尾：总结观点 + 行动建议\n"
+                f"（初稿完成，待 polish 步骤润色）"
+            )
+        if kind == "polish":
+            return (
+                f"【写作润色】\n"
+                f"基于初稿检查：\n"
+                f"1. 语法与错别字\n"
+                f"2. 逻辑衔接与段落过渡\n"
+                f"3. 语气统一（正式/亲切）与受众匹配\n"
+                f"4. 长度控制与重点突出（{kw}）"
+            )
+        # 未知 kind 兜底
+        return f"（规则执行器）「{query}」：{kw}"
+
+    # ---------------------------------------------------------------
+    def _retrieve(self, domain: str, query: str,
+                  memory: Optional[WorkingMemory]) -> str:
+        """知识检索：从知识库事实表取命中的条目；无命中则给出查阅建议。"""
+        if self.kb is None:
+            return (
+                f"【{domain} 知识检索】\n"
+                f"未配置知识库，建议查阅权威资料（{_kw(query)}）。"
+            )
+        facts = self.kb.facts(domain)
+        hits = [f for f in facts if any(k in query for k in f.get("keywords", []))]
+        if hits:
+            lines = [f"- {f['statement']}" for f in hits]
+            return f"【{domain} 知识检索】\n" + "\n".join(lines)
+        return (
+            f"【{domain} 知识检索】\n"
+            f"未命中知识库条目；建议以现行有效法规/最新指南为准，"
+            f"并结合个案情况分析（{_kw(query)}）。"
+        )
+
+
+# ===============================================================
+# NodeExecutor：子任务执行后端抽象（T1：整体项目部分拆解·先行实现）
+#
+# Router._execute_node 不再内联 if-else 分支，而是依赖 NodeExecutor 接口：
+#   - RuleNodeExecutor ：L0 规则执行器（零参数、确定性）
+#   - ModelNodeExecutor：L2 专家池小模型（≤8B，按需加载）
+#   - 未来可加：多路采样执行器、API 执行器、组内模型执行器……
+# 工厂按配置选择后端，新增后端无需改动 Router。
+# ===============================================================
+
+
+class NodeExecutor:
+    """子任务执行后端抽象接口。"""
+
+    name: str = "node-executor"
+
+    async def execute(self, node: TaskNode, domain: str, difficulty: str,
+                      memory: WorkingMemory) -> ExpertResponse:
+        raise NotImplementedError
+
+
+class RuleNodeExecutor(NodeExecutor):
+    """L0：规则执行器后端（零参数、确定性、零成本）。"""
+
+    name = "rule"
+
+    def __init__(self, kb: Optional[KnowledgeBase] = None):
+        self._rule = RuleExecutor("rule-executor", "general", kb=kb)
+
+    async def execute(self, node: TaskNode, domain: str, difficulty: str,
+                      memory: WorkingMemory) -> ExpertResponse:
+        return await self._rule.generate(node.query, difficulty, memory, node)
+
+
+class ModelNodeExecutor(NodeExecutor):
+    """L2：专家池小模型后端（≤8B；组内模型按需加载，用完即卸载由推理服务管理）。"""
+
+    name = "model"
+
+    def __init__(self, experts: Dict[str, Expert]):
+        self._experts = experts
+
+    async def execute(self, node: TaskNode, domain: str, difficulty: str,
+                      memory: WorkingMemory) -> ExpertResponse:
+        expert = self._experts.get(node.domain) or self._experts.get("general")
+        return await expert.generate(node.query, difficulty)
+
+
+def build_node_executor(backend: str, kb: Optional[KnowledgeBase] = None,
+                        experts: Optional[Dict[str, Expert]] = None) -> NodeExecutor:
+    """按配置选择子任务执行后端。"""
+    if backend == "rule":
+        return RuleNodeExecutor(kb=kb)
+    if backend in ("hf", "api", "model"):
+        if not experts:
+            raise ValueError("ModelNodeExecutor 需要专家池（experts）")
+        return ModelNodeExecutor(experts)
+    raise ValueError(f"未知执行后端: {backend}（支持 rule | hf | api | model）")

router_system/inference.py

@@ -0,0 +1,99 @@
+"""前向链推理机：知识库规则驱动的工作记忆演化（专家系统推理核心，零依赖）。
+
+流程（经典前向链 forward chaining）：
+1. 初始化黑板：写入领域/难度/置信度等事实
+2. 循环：在领域内匹配规则（未触发过的）→ 按优先级执行
+   - 命中即记录轨迹 rule:<id>@<priority>
+   - 规则带 output 模板 → 渲染后写入黑板章节（部分解）
+   - 规则带 actions → 执行动作（写事实/写章节）
+3. 终止：无新规则可触发 / 达到步数上限（防死循环）
+
+确定性保证：规则匹配基于子串包含，无随机性；同输入 → 同轨迹。
+"""
+from __future__ import annotations
+
+from typing import Any, Dict, List, Optional
+
+from .knowledge import KnowledgeBase, Rule
+from .memory import WorkingMemory
+
+
+def render_template(template: str, query: str, facts: Dict[str, Any]) -> str:
+    """渲染输出模板：替换 {query} 与 {facts.<key>} 占位符；缺失以 [未提供] 占位，不抛异常。"""
+    out = template.replace("{query}", query)
+    for key, value in facts.items():
+        out = out.replace(f"{{facts.{key}}}", str(value))
+    # 剩余占位符兜底
+    while "{" in out and "}" in out:
+        start = out.find("{")
+        end = out.find("}", start)
+        if end == -1:
+            break
+        out = out[:start] + "[未提供]" + out[end + 1:]
+    return out
+
+
+class InferenceEngine:
+    """前向链推理机。"""
+
+    def __init__(self, kb: KnowledgeBase, max_steps: int = 20):
+        self.kb = kb
+        self.max_steps = max_steps
+
+    # ---------------------------------------------------------------
+    def initialize(self, query: str, domain: str, difficulty: str,
+                   confidence: float, memory: WorkingMemory) -> None:
+        """把分类结果写入黑板（事实初始化）。"""
+        memory.write_fact("query", query)
+        memory.write_fact("domain", domain)
+        memory.write_fact("difficulty", difficulty)
+        memory.write_fact("confidence", round(confidence, 4))
+        memory.add_trace(f"init:domain={domain},difficulty={difficulty},conf={confidence:.2f}")
+
+    # ---------------------------------------------------------------
+    def run(self, query: str, domain: str, memory: WorkingMemory,
+            max_steps: Optional[int] = None) -> List[str]:
+        """前向链主循环。返回触发规则 id 列表（按触发顺序）。
+
+        循环不变量外提：query/domain 在循环内不变，kb.match 结果只算一次
+        （原实现每步全量重扫+重排序，最坏 O(steps × rules × patterns)）。
+        """
+        steps = max_steps or self.max_steps
+        rules = self.kb.match(query, domain=domain)
+        fired: List[str] = []
+        fired_set: set = set()  # O(1) 查重（fired 保持列表维护触发顺序）
+        for _ in range(steps):
+            # 选第一个"未触发过"的规则
+            target: Optional[Rule] = None
+            for r in rules:
+                if r.id not in fired_set:
+                    target = r
+                    break
+            if target is None:
+                break  # 无新规则可触发 → 终止
+            fired.append(target.id)
+            fired_set.add(target.id)
+            self._fire(target, query, memory)
+        return fired
+
+    # ---------------------------------------------------------------
+    def _fire(self, rule: Rule, query: str, memory: WorkingMemory) -> None:
+        """执行一条规则：记录轨迹 + 写事实 + 产出章节。"""
+        memory.add_trace(f"rule:{rule.id}@{rule.priority}")
+        # 规则动作
+        for action in rule.actions:
+            self._apply_action(action, rule, query, memory)
+        # 规则输出模板 → 章节
+        if rule.output:
+            text = render_template(rule.output, query, memory.facts)
+            memory.write_section(rule.id, text)
+
+    def _apply_action(self, action: str, rule: Rule, query: str,
+                      memory: WorkingMemory) -> None:
+        """动作格式：write_fact:key=value（value 支持 {query} 占位）。"""
+        if action.startswith("write_fact:"):
+            kv = action[len("write_fact:"):]
+            key, _, value = kv.partition("=")
+            value = value.replace("{query}", query)
+            memory.write_fact(key.strip(), value.strip(), rule_id=rule.id)
+        # 其他动作类型暂不实现（保留扩展位）

router_system/knowledge.py

@@ -0,0 +1,507 @@
+"""知识库：专家系统风格的规则与知识表示（零依赖，纯标准库）。
+
+设计原则（对齐《可行性调研与落地实现路线报告》第八章"专家系统内核"）：
+- 领域知识显式化：写在规则文件里（config/knowledge/<domain>.yaml），不藏在模型参数中
+- 确定性：规则匹配 = 子串包含（大小写不敏感），同输入同输出
+- 可解释：每次命中都记录规则 id，形成推理轨迹
+- 最小参数：L0 模式零模型参数，规则即知识
+
+规则文件格式（YAML；若 pyyaml 不可用，可提供同名 .json）：
+    domain: code
+    rules:
+      - id: code-sort
+        priority: 90                  # 越大越先触发
+        patterns: ["排序", "sort"]    # 任一子串命中即触发
+        template: code-implement      # 可选：Planner 任务模板 id
+        output: |                     # 可选：输出模板（{query} 等占位符）
+          （规则输出）...
+    facts:                            # 领域事实表（Judge 校验 / retrieve 执行器用）
+      - id: legal-nc
+        keywords: ["竞业"]
+        statement: "竞业限制期限不得超过二年"
+
+任务模板（config/knowledge/tasks.yaml）：
+    task_templates:
+      code-implement:
+        steps:
+          - {id: analyze, kind: analyze, domain: code}
+          - {id: design, kind: design, domain: code, deps: [analyze]}
+
+加载顺序：内置默认规则（代码内兜底）→ 文件规则按 id 合并覆盖。
+"""
+from __future__ import annotations
+
+import json
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Any, Dict, List, Optional
+
+DEFAULT_RULES_DIR = Path(__file__).resolve().parent.parent / "config" / "knowledge"
+
+
+@dataclass
+class Rule:
+    """一条领域规则。"""
+    id: str
+    domain: str
+    priority: int = 50
+    patterns: List[str] = field(default_factory=list)
+    template: Optional[str] = None      # 引用的任务模板 id
+    output: Optional[str] = None        # 输出模板
+    actions: List[str] = field(default_factory=list)  # 保留字段：动作扩展
+    subdomain: Optional[str] = None     # 二级子领域（如 investing/labor/calculus）
+    subdomain2: Optional[str] = None    # 三级子领域（如 fund/overtime/sorting）
+    _patterns_lower: Optional[tuple] = field(default=None, repr=False, compare=False)
+
+    def _lowered(self) -> tuple:
+        """patterns 的小写缓存（注册后规则视为不可变；懒计算一次）。"""
+        if self._patterns_lower is None:
+            self._patterns_lower = tuple(p.lower() for p in self.patterns)
+        return self._patterns_lower
+
+    def matches(self, text: str) -> bool:
+        """任一 pattern 是 text 的子串即命中（大小写不敏感）。"""
+        if not self.patterns:
+            return False
+        return self._match_lower(text.lower())
+
+    def _match_lower(self, q: str) -> bool:
+        """已 lowercase 文本的快速匹配（避免每条规则重复 lower 同一文本）。"""
+        if not self.patterns:
+            return False
+        return any(p in q for p in self._lowered())
+
+
+# ---------------------------------------------------------------
+# 三级子领域映射（rule_id -> subdomain2）
+# 集中维护：新增规则时在此加一行即可完成三级细化标注
+# ---------------------------------------------------------------
+SUBDOMAIN2_MAP: Dict[str, str] = {
+    # ---- code ----
+    "code-sort": "sorting",
+    "code-debug": "error-analysis",
+    "code-algorithm": "algorithm-general",
+    "code-refactor": "code-quality",
+    "code-database": "sql",
+    "code-explain": "code-reading",
+    "code-test": "unit-test",
+    "code-web": "web-dev",
+    "code-implement-general": "implementation",
+    "code-git-knowledge": "git",
+    "code-docker-knowledge": "container",
+    "code-python-knowledge": "python-env",
+    # ---- math ----
+    "math-equation": "equation",
+    "math-calculus": "calculus",
+    "math-algebra": "algebra",
+    "math-geometry": "geometry",
+    "math-proof": "proof",
+    "math-probability": "probability",
+    "math-number-theory": "number-theory",
+    "math-trigonometry": "trigonometry",
+    "math-optimization": "optimization",
+    "math-general": "math-general",
+    # ---- legal ----
+    "legal-contract": "contract",
+    "legal-labor": "labor",
+    "legal-ip": "intellectual-property",
+    "legal-housing": "housing",
+    "legal-marriage": "family-law",
+    "legal-tax": "tax",
+    "legal-consumer": "consumer-rights",
+    "legal-litigation": "litigation",
+    "legal-compliance": "compliance",
+    "legal-general": "legal-general",
+    # ---- medical ----
+    "medical-hypertension": "hypertension",
+    "medical-drug": "medication",
+    "medical-common": "common-illness",
+    "medical-chronic": "chronic-disease",
+    "medical-digestive": "digestive",
+    "medical-nutrition": "nutrition",
+    "medical-mental": "mental-health",
+    "medical-firstaid": "first-aid",
+    "medical-pediatrics": "pediatrics",
+    "medical-general": "medical-general",
+    # ---- finance ----
+    "finance-investing": "investing",
+    "finance-saving": "saving",
+    "finance-loan": "loan",
+    "finance-insurance": "insurance",
+    "finance-credit-card": "credit",
+    "finance-personal-budget": "budgeting",
+    "finance-general": "finance-general",
+    # ---- life ----
+    "life-food": "cooking",
+    "life-travel": "travel",
+    "life-home": "home",
+    "life-pet": "pet",
+    "life-fitness": "fitness",
+    "life-weather": "weather",
+    "life-general": "life-general",
+    # ---- education ----
+    "edu-study-method": "study-method",
+    "edu-exam": "exam",
+    "edu-language": "language",
+    "edu-course": "course",
+    "edu-career": "career",
+    "edu-general": "education-general",
+    # ---- general ----
+    "general-explain": "explain",
+    "general-writing": "writing",
+    "general-compare": "compare",
+    "general-translate": "translate",
+    "general-knowledge": "explain",
+}
+
+# ---------------------------------------------------------------
+# 二级子领域映射（rule_id -> subdomain）
+# 三级 subdomain2 的父级类别；与 SUBDOMAIN2_MAP 按 rule_id 对齐维护。
+# ---------------------------------------------------------------
+SUBDOMAIN_MAP: Dict[str, str] = {
+    # ---- code ----
+    "code-sort": "algorithm",
+    "code-debug": "debugging",
+    "code-algorithm": "algorithm",
+    "code-refactor": "quality",
+    "code-database": "data",
+    "code-explain": "reading",
+    "code-test": "quality",
+    "code-web": "web",
+    "code-implement-general": "implementation",
+    "code-git-knowledge": "tooling",
+    "code-docker-knowledge": "tooling",
+    "code-python-knowledge": "tooling",
+    # ---- math ----
+    "math-equation": "algebra",
+    "math-calculus": "analysis",
+    "math-algebra": "algebra",
+    "math-geometry": "geometry",
+    "math-proof": "proof",
+    "math-probability": "probability",
+    "math-number-theory": "number-theory",
+    "math-trigonometry": "trigonometry",
+    "math-optimization": "optimization",
+    "math-general": "general",
+    # ---- legal ----
+    "legal-contract": "contract",
+    "legal-labor": "labor",
+    "legal-ip": "ip",
+    "legal-housing": "civil",
+    "legal-marriage": "civil",
+    "legal-tax": "tax",
+    "legal-consumer": "consumer",
+    "legal-litigation": "procedure",
+    "legal-compliance": "compliance",
+    "legal-general": "general",
+    # ---- medical ----
+    "medical-hypertension": "chronic",
+    "medical-drug": "medication",
+    "medical-common": "common",
+    "medical-chronic": "chronic",
+    "medical-digestive": "common",
+    "medical-nutrition": "nutrition",
+    "medical-mental": "mental",
+    "medical-firstaid": "emergency",
+    "medical-pediatrics": "pediatrics",
+    "medical-general": "general",
+    # ---- finance ----
+    "finance-investing": "investing",
+    "finance-saving": "personal-finance",
+    "finance-loan": "credit",
+    "finance-insurance": "insurance",
+    "finance-credit-card": "credit",
+    "finance-personal-budget": "personal-finance",
+    "finance-general": "general",
+    # ---- life ----
+    "life-food": "daily",
+    "life-travel": "daily",
+    "life-home": "daily",
+    "life-pet": "daily",
+    "life-fitness": "health",
+    "life-weather": "daily",
+    "life-general": "general",
+    # ---- education ----
+    "edu-study-method": "learning",
+    "edu-exam": "learning",
+    "edu-language": "language",
+    "edu-course": "learning",
+    "edu-career": "development",
+    "edu-general": "general",
+    # ---- general ----
+    "general-explain": "explanation",
+    "general-writing": "writing",
+    "general-compare": "analysis",
+    "general-translate": "language",
+    "general-knowledge": "explanation",
+}
+
+
+# ---------------------------------------------------------------
+# 内置默认规则（兜底：即使规则文件缺失/损坏，系统仍可运行）
+# ---------------------------------------------------------------
+BUILTIN_RULES: List[Dict[str, Any]] = [
+    # ---- code ----
+    {"id": "code-sort", "domain": "code", "priority": 90,
+     "patterns": ["排序", "快速排序", "排序算法", "sort", "quicksort"],
+     "template": "code-implement"},
+    {"id": "code-debug", "domain": "code", "priority": 85,
+     "patterns": ["报错", "错误", "调试", "bug", "debug", "typeerror", "异常", "报 TypeError"],
+     "template": "code-debug"},
+    {"id": "code-implement-general", "domain": "code", "priority": 50,
+     "patterns": ["实现", "编写", "写一个", "函数", "代码", "编程", "用 python", "用 java",
+                  "用 javascript", "sql", "接口", "算法"],
+     "template": "code-implement"},
+    # ---- math ----
+    {"id": "math-equation", "domain": "math", "priority": 90,
+     "patterns": ["方程", "求解", "求根", "solve", "equation", "解方程"],
+     "template": "math-solve"},
+    {"id": "math-calculus", "domain": "math", "priority": 85,
+     "patterns": ["积分", "导数", "微积分", "求导", "integral", "derivative", "∫"],
+     "template": "math-solve"},
+    {"id": "math-general", "domain": "math", "priority": 50,
+     "patterns": ["数学", "证明", "定理", "概率", "统计", "计算", "等于", "math", "不等式"],
+     "template": "math-solve"},
+    # ---- legal ----
+    {"id": "legal-contract", "domain": "legal", "priority": 90,
+     "patterns": ["合同", "条款", "违约", "离职", "竞业", "劳动", "contract", "clause", "赔偿"],
+     "template": "legal-advice"},
+    {"id": "legal-ip", "domain": "legal", "priority": 85,
+     "patterns": ["专利", "版权", "商标", "知识产权", "patent", "copyright", "trademark"],
+     "template": "legal-advice"},
+    {"id": "legal-general", "domain": "legal", "priority": 50,
+     "patterns": ["法律", "合规", "诉讼", "仲裁", "法条", "law", "legal", "法规"],
+     "template": "legal-advice"},
+    # ---- medical ----
+    {"id": "medical-hypertension", "domain": "medical", "priority": 90,
+     "patterns": ["高血压", "hypertension", "血压"],
+     "template": "medical-advice"},
+    {"id": "medical-drug", "domain": "medical", "priority": 85,
+     "patterns": ["药物", "吃药", "剂量", "副作用", "退烧药", "降压药", "dosage", "prescription"],
+     "template": "medical-advice"},
+    {"id": "medical-general", "domain": "medical", "priority": 50,
+     "patterns": ["医疗", "症状", "诊断", "治疗", "感冒", "发烧", "糖尿病", "医生", "患者",
+                  "体检", "疫苗", "medical", "symptom", "disease"],
+     "template": "medical-advice"},
+    # ---- finance ----
+    {"id": "finance-investing", "domain": "finance", "priority": 90,
+     "patterns": ["基金", "定投", "收益率", "股票", "投资", "炒股", "证券", "invest", "stock"]},
+    {"id": "finance-saving", "domain": "finance", "priority": 85,
+     "patterns": ["存款", "储蓄", "利息", "零钱通", "余额宝", "saving"]},
+    {"id": "finance-loan", "domain": "finance", "priority": 80,
+     "patterns": ["贷款", "房贷", "借款", "按揭", "loan"]},
+    {"id": "finance-insurance", "domain": "finance", "priority": 75,
+     "patterns": ["保险", "理赔", "保单", "投保", "insurance"]},
+    {"id": "finance-credit-card", "domain": "finance", "priority": 70,
+     "patterns": ["信用卡", "花呗", "白条", "credit card"]},
+    {"id": "finance-personal-budget", "domain": "finance", "priority": 60,
+     "patterns": ["预算", "记账", "开销", "省钱", "budget"]},
+    {"id": "finance-general", "domain": "finance", "priority": 50,
+     "patterns": ["金融", "财务", "外汇", "汇率", "finance"]},
+    # ---- life ----
+    {"id": "life-food", "domain": "life", "priority": 90,
+     "patterns": ["做饭", "做菜", "菜谱", "食谱", "烹饪", "cooking"]},
+    {"id": "life-travel", "domain": "life", "priority": 85,
+     "patterns": ["旅游", "旅行", "攻略", "景点", "签证", "travel"]},
+    {"id": "life-home", "domain": "life", "priority": 80,
+     "patterns": ["装修", "租房", "家电", "清洁", "搬家", "home"]},
+    {"id": "life-pet", "domain": "life", "priority": 75,
+     "patterns": ["宠物", "养猫", "养狗", "撸猫", "pet"]},
+    {"id": "life-fitness", "domain": "life", "priority": 70,
+     "patterns": ["健身", "减肥", "跑步", "锻炼", "fitness"]},
+    {"id": "life-weather", "domain": "life", "priority": 65,
+     "patterns": ["天气", "下雨", "台风", "降温", "weather"]},
+    {"id": "life-general", "domain": "life", "priority": 50,
+     "patterns": ["生活", "日常", "家居", "life"]},
+    # ---- education ----
+    {"id": "edu-study-method", "domain": "education", "priority": 90,
+     "patterns": ["学习方法", "记忆", "做笔记", "笔记法", "专注力"]},
+    {"id": "edu-exam", "domain": "education", "priority": 85,
+     "patterns": ["考试", "考研", "复习", "真题", "四六级", "exam"]},
+    {"id": "edu-language", "domain": "education", "priority": 80,
+     "patterns": ["英语", "单词", "口语", "语法", "english"]},
+    {"id": "edu-course", "domain": "education", "priority": 75,
+     "patterns": ["课程", "网课", "慕课", "选修", "course"]},
+    {"id": "edu-career", "domain": "education", "priority": 70,
+     "patterns": ["职业规划", "求职", "面试", "简历", "校招", "career"]},
+    {"id": "edu-general", "domain": "education", "priority": 50,
+     "patterns": ["教育", "大学", "专业选择", "education"]},
+    # ---- general ----
+    {"id": "general-explain", "domain": "general", "priority": 30,
+     "patterns": ["总结", "介绍", "解释", "为什么", "优缺点", "是什么", "翻译", "邮件",
+                  "summarize", "explain", "what is", "写一封"],
+     "template": "general-explain"},
+]
+
+# 内置默认任务模板（兜底）
+BUILTIN_TASKS: Dict[str, Dict[str, Any]] = {
+    "code-implement": {"steps": [
+        {"id": "analyze", "kind": "analyze", "domain": "code", "desc": "需求与约束分析"},
+        {"id": "design", "kind": "design", "domain": "code", "deps": ["analyze"], "desc": "算法与数据结构设计"},
+        {"id": "implement", "kind": "implement", "domain": "code", "deps": ["design"], "desc": "实现代码"},
+        {"id": "verify", "kind": "verify", "domain": "code", "deps": ["implement"], "desc": "自测校验"},
+    ]},
+    "code-debug": {"steps": [
+        {"id": "analyze", "kind": "analyze", "domain": "code", "desc": "错误现象与复现分析"},
+        {"id": "diagnose", "kind": "diagnose", "domain": "code", "deps": ["analyze"], "desc": "定位错误根因"},
+        {"id": "fix", "kind": "fix", "domain": "code", "deps": ["diagnose"], "desc": "给出修复方案"},
+        {"id": "verify", "kind": "verify", "domain": "code", "deps": ["fix"], "desc": "修复后验证"},
+    ]},
+    "math-solve": {"steps": [
+        {"id": "conditions", "kind": "analyze", "domain": "math", "desc": "明确已知条件与目标"},
+        {"id": "solve", "kind": "solve", "domain": "math", "deps": ["conditions"], "desc": "选择方法并求解"},
+        {"id": "verify", "kind": "verify", "domain": "math", "deps": ["solve"], "desc": "检查边界与验证"},
+    ]},
+    "legal-advice": {"steps": [
+        {"id": "facts", "kind": "analyze", "domain": "legal", "desc": "梳理事实与法律问题"},
+        {"id": "retrieve", "kind": "retrieve", "domain": "legal", "deps": ["facts"], "desc": "检索适用法规"},
+        {"id": "conclude", "kind": "conclude", "domain": "legal", "deps": ["retrieve"], "desc": "给出法律意见"},
+        {"id": "disclaimer", "kind": "disclaimer", "domain": "legal", "deps": ["conclude"], "desc": "免责提示"},
+    ]},
+    "medical-advice": {"steps": [
+        {"id": "symptoms", "kind": "analyze", "domain": "medical", "desc": "梳理症状与背景"},
+        {"id": "advise", "kind": "advise", "domain": "medical", "deps": ["symptoms"], "desc": "给出一般建议"},
+        {"id": "warning", "kind": "disclaimer", "domain": "medical", "deps": ["advise"], "desc": "就医警示"},
+    ]},
+    "general-explain": {"steps": [
+        {"id": "outline", "kind": "analyze", "domain": "general", "desc": "梳理主题要点"},
+        {"id": "explain", "kind": "explain", "domain": "general", "deps": ["outline"], "desc": "展开解释"},
+        {"id": "conclude", "kind": "conclude", "domain": "general", "deps": ["explain"], "desc": "总结"},
+    ]},
+}
+
+# 内置默认事实表（兜底）
+BUILTIN_FACTS: Dict[str, List[Dict[str, Any]]] = {
+    "legal": [
+        {"id": "legal-noncompete", "keywords": ["竞业", "离职", "同业"],
+         "statement": "竞业限制期限不得超过二年，且用人单位应在限制期内按月给予经济补偿"},
+        {"id": "legal-renew-compensation", "keywords": ["不续签", "经济补偿", "劳动合同"],
+         "statement": "劳动合同期满用人单位不续签的，通常应支付经济补偿（每满一年一个月工资）"},
+    ],
+    "medical": [
+        {"id": "medical-hypertension-diet", "keywords": ["高血压", "饮食"],
+         "statement": "高血压患者应低盐低脂饮食、控制体重、规律运动、戒烟限酒，并在医生指导下用药"},
+        {"id": "medical-fever-drug", "keywords": ["发烧", "退烧"],
+         "statement": "体温超过 38.5℃ 可在药师指导下使用退烧药；持续发热或出现严重症状应及时就医"},
+    ],
+}
+
+
+def _try_load_yaml(path: Path) -> Optional[Dict[str, Any]]:
+    try:
+        import yaml  # type: ignore
+    except ImportError:
+        return None
+    try:
+        with open(path, "r", encoding="utf-8") as f:
+            data = yaml.safe_load(f)
+        return data if isinstance(data, dict) else None
+    except Exception:
+        return None
+
+
+def _try_load_json(path: Path) -> Optional[Dict[str, Any]]:
+    json_path = path.with_suffix(".json")
+    if not json_path.exists():
+        return None
+    try:
+        with open(json_path, "r", encoding="utf-8") as f:
+            data = json.load(f)
+        return data if isinstance(data, dict) else None
+    except Exception:
+        return None
+
+
+class KnowledgeBase:
+    """知识库：加载规则文件，提供规则匹配、任务模板、事实表查询。"""
+
+    def __init__(self, rules_dir: Optional[str | Path] = None):
+        self.rules_dir = Path(rules_dir) if rules_dir else DEFAULT_RULES_DIR
+        self._rules: Dict[str, Rule] = {}
+        self._tasks: Dict[str, Dict[str, Any]] = {}
+        self._facts: Dict[str, List[Dict[str, Any]]] = {}
+        self.load()
+
+    # ---- 加载 ----
+    def load(self) -> None:
+        """内置默认 + 规则文件合并（文件规则按 id 覆盖内置）。"""
+        self._rules = {}
+        self._tasks = dict(BUILTIN_TASKS)
+        for item in BUILTIN_RULES:
+            self._register_rule(item)
+        self._facts = {d: [dict(f) for f in facts] for d, facts in BUILTIN_FACTS.items()}
+
+        if self.rules_dir.is_dir():
+            yaml_names = {p.name for p in self.rules_dir.glob("*.yaml")}  # 一次遍历，避免逐文件重扫
+            for f in sorted(self.rules_dir.glob("*.yaml")):
+                data = _try_load_yaml(f)
+                if data is not None:
+                    self._load_file_data(f, data)
+            for f in sorted(self.rules_dir.glob("*.json")):
+                if f.name not in yaml_names:
+                    data = _try_load_json(f)
+                    if data is not None:
+                        self._load_file_data(f, data)
+
+    def _load_file_data(self, path: Path, data: Dict[str, Any]) -> None:
+        name = path.stem
+        if name == "tasks":
+            for tid, tpl in (data.get("task_templates") or {}).items():
+                if isinstance(tpl, dict) and isinstance(tpl.get("steps"), list):
+                    self._tasks[tid] = tpl
+            return
+        domain = data.get("domain", name)
+        for item in data.get("rules") or []:
+            if isinstance(item, dict) and item.get("id"):
+                self._register_rule({**item, "domain": domain})
+        for fact in data.get("facts") or []:
+            if isinstance(fact, dict) and fact.get("id"):
+                self._facts.setdefault(domain, []).append(fact)
+
+    def _register_rule(self, item: Dict[str, Any]) -> None:
+        rule = Rule(
+            id=str(item["id"]),
+            domain=str(item.get("domain", "general")),
+            priority=int(item.get("priority", 50)),
+            patterns=[str(p) for p in item.get("patterns", [])],
+            template=item.get("template"),
+            output=item.get("output"),
+            actions=[str(a) for a in item.get("actions", [])],
+            subdomain=item.get("subdomain") or SUBDOMAIN_MAP.get(str(item["id"])),
+            subdomain2=item.get("subdomain2") or SUBDOMAIN2_MAP.get(str(item["id"])),
+        )
+        self._rules[rule.id] = rule
+
+    # ---- 查询 ----
+    def match(self, text: str, domain: Optional[str] = None) -> List[Rule]:
+        """返回命中的规则，按优先级降序。domain 为空则全领域匹配。
+
+        文本只 lowercase 一次（原实现每条规则各 lower 一遍）。
+        """
+        q = text.lower()
+        hits = []
+        for rule in self._rules.values():
+            if domain is not None and rule.domain != domain:
+                continue
+            if rule._match_lower(q):
+                hits.append(rule)
+        hits.sort(key=lambda r: r.priority, reverse=True)
+        return hits
+
+    def rule(self, rule_id: str) -> Optional[Rule]:
+        return self._rules.get(rule_id)
+
+    def rules_count(self) -> int:
+        return len(self._rules)
+
+    def task_template(self, tid: str) -> Optional[Dict[str, Any]]:
+        return self._tasks.get(tid)
+
+    def task_ids(self) -> List[str]:
+        return sorted(self._tasks.keys())
+
+    def facts(self, domain: str) -> List[Dict[str, Any]]:
+        return self._facts.get(domain, [])
+
+    def domains(self) -> List[str]:
+        return sorted({r.domain for r in self._rules.values()})

router_system/memory.py

@@ -0,0 +1,131 @@
+"""黑板（Blackboard）/ 工作记忆：专家系统风格的共享工作区（零依赖）。
+
+- TaskNode：子任务节点（DAG 顶点），由 Planner 创建、Router 按拓扑序执行
+- TaskGraph：子任务 DAG，提供拓扑排序与状态查询
+- WorkingMemory：黑板，各知识源（执行器/规则）写入部分解，最后合并为最终答案
+
+对齐《可行性调研与落地实现路线报告》第八章：
+"黑板协作：多知识源（领域专家/执行器）通过共享黑板协作，而不是一个模型全包"。
+"""
+from __future__ import annotations
+
+from collections import deque
+from dataclasses import dataclass, field
+from typing import Any, Dict, List, Optional
+
+
+@dataclass
+class TaskNode:
+    """一个子任务节点。"""
+    id: str
+    kind: str                      # analyze | design | implement | solve | diagnose | fix
+                                   # | retrieve | conclude | advise | explain | disclaimer | verify
+    domain: str
+    query: str                     # 子任务输入（通常为原始查询）
+    status: str = "pending"        # pending | running | done | failed | skipped
+    output: Optional[str] = None
+    rule_trace: List[str] = field(default_factory=list)
+    deps: List[str] = field(default_factory=list)
+    desc: str = ""
+    error: Optional[str] = None
+
+
+class TaskGraph:
+    """子任务 DAG：节点 + 依赖边。"""
+
+    def __init__(self):
+        self._nodes: Dict[str, TaskNode] = {}
+
+    def add_node(self, node: TaskNode) -> None:
+        if node.id in self._nodes:
+            raise ValueError(f"节点 id 重复: {node.id}")
+        self._nodes[node.id] = node
+
+    def get(self, node_id: str) -> Optional[TaskNode]:
+        return self._nodes.get(node_id)
+
+    def nodes(self) -> List[TaskNode]:
+        return list(self._nodes.values())
+
+    def topo_order(self) -> List[TaskNode]:
+        """Kahn 拓扑排序：依赖在前；初始就绪层按插入序稳定输出。
+
+        O(V+E) 实现（邻接表 + deque）；循环依赖时按插入序兜底（不崩溃）。
+        """
+        insert_pos = {nid: i for i, nid in enumerate(self._nodes)}
+        indeg: Dict[str, int] = {nid: 0 for nid in self._nodes}
+        dependents: Dict[str, List[str]] = {nid: [] for nid in self._nodes}
+        for n in self._nodes.values():
+            for d in n.deps:
+                if d in indeg:  # 未知依赖 id 忽略（与入度统计口径一致）
+                    indeg[n.id] += 1
+                    dependents[d].append(n.id)
+        ready = deque(sorted((nid for nid, deg in indeg.items() if deg == 0),
+                             key=insert_pos.__getitem__))
+        order_ids: List[str] = []
+        while ready:
+            nid = ready.popleft()
+            order_ids.append(nid)
+            for m in dependents[nid]:
+                indeg[m] -= 1
+                if indeg[m] == 0:
+                    ready.append(m)
+        if len(order_ids) < len(self._nodes):
+            # 循环依赖兜底：剩余节点按插入序追加
+            placed = set(order_ids)
+            order_ids.extend(nid for nid in self._nodes if nid not in placed)
+        return [self._nodes[nid] for nid in order_ids]
+
+    def all_done(self) -> bool:
+        return all(n.status == "done" for n in self._nodes.values())
+
+    def failed(self) -> List[TaskNode]:
+        return [n for n in self._nodes.values() if n.status == "failed"]
+
+    def __len__(self) -> int:
+        return len(self._nodes)
+
+
+class WorkingMemory:
+    """黑板：facts（槽位事实）+ sections（章节部分解）+ trace（推理轨迹）。"""
+
+    def __init__(self):
+        self.facts: Dict[str, Any] = {}
+        self.sections: Dict[str, str] = {}
+        self.trace: List[str] = []
+
+    # ---- 事实 ----
+    def write_fact(self, key: str, value: Any, rule_id: Optional[str] = None) -> None:
+        if key in self.facts:
+            self.trace.append(f"overwrite:{key}@{rule_id or '?'}")
+        self.facts[key] = value
+        if rule_id:
+            self.trace.append(f"fact:{key}={str(value)[:40]}@rule:{rule_id}")
+
+    def get_fact(self, key: str, default: Any = None) -> Any:
+        return self.facts.get(key, default)
+
+    # ---- 章节 ----
+    def write_section(self, sid: str, text: str) -> None:
+        """写入章节；同 id 覆盖（记录 trace）。"""
+        if sid in self.sections:
+            self.trace.append(f"overwrite_section:{sid}")
+        self.sections[sid] = text
+
+    def section(self, sid: str) -> Optional[str]:
+        return self.sections.get(sid)
+
+    def merge(self, order: Optional[List[str]] = None) -> str:
+        """按 order（章节顺序）合并为最终答案；order 为空则按写入顺序。"""
+        if order:
+            parts = [self.sections[s] for s in order if s in self.sections]
+            if parts:
+                return "\n\n".join(parts)
+        return "\n\n".join(self.sections.values())
+
+    # ---- 轨迹 ----
+    def add_trace(self, item: str) -> None:
+        self.trace.append(item)
+
+    def explain(self) -> List[str]:
+        return list(self.trace)

router_system/pipeline.py

@@ -25,6 +25,14 @@ from .worker import WorkerLoop
 from .workspace import Workspace
 
 
+def _safe_artifact_name(name: str) -> str:
+    """工件名单消毒：剥路径成分，只留文件名（工件名来自模型输出，防 ../ 越界写盘）。"""
+    part = str(name or "").replace("\\", "/").split("/")[-1].strip()
+    if not part or part in (".", ".."):
+        return "artifact.bin"
+    return part[:120]
+
+
 @dataclass
 class PipelineResult:
     """v2 协作管线一次运行的结果。"""
@@ -102,20 +110,24 @@ class CollaborativePipeline:
         plan = brief.get("plan") or []
         pending = [p.get("id") for p in plan]
         plan_ids = {p.get("id") for p in plan}          # 用于 _deps_done 过滤
+        plan_by_id = {p.get("id"): p for p in plan}     # O(1) 步定义查找（原每轮线性扫描）
+        done_ids = self._done_ids(ws)                   # 增量维护的完成集（原每轮重建）
+        base_domain = self._guess_domain(query)         # ws["query"] 恒定，领域只解析一次
         while pending and not ws.exhausted():
             progressed = False
             for sid in list(pending):
-                step = next((p for p in plan if p.get("id") == sid), {})
+                step = plan_by_id.get(sid, {})
                 deps = step.get("deps") or []
                 # 只检查在 plan 中的依赖；不在 plan 的 ID 视为"不存在"→自动满足
                 relevant = [d for d in deps if d in plan_ids]
-                if not self._deps_done(ws, relevant):
+                if not all(d in done_ids for d in relevant):
                     continue
-                existing = self._read_artifact(request_id, self._artifact_name(sid, ws))
+                existing = self._read_artifact(request_id, self._artifact_name(sid, ws, domain=base_domain))
                 outcome = await self.worker.run_step(ws, sid, existing_artifact=existing,
                                                      hint=self._last_decision_for(ws, sid))
                 if outcome.status == "done":
                     pending.remove(sid)
+                    done_ids.add(sid)
                     self._save_artifact(request_id, outcome.artifact_name, outcome.artifact_text)
                     ws.rollup()
                     route.append(f"step:{sid}:done")
@@ -222,9 +234,10 @@ class CollaborativePipeline:
                 return hits[0].domain
         return "general"
 
-    def _artifact_name(self, sid: str, ws: Workspace) -> str:
+    def _artifact_name(self, sid: str, ws: Workspace, domain: Optional[str] = None) -> str:
         from .worker import artifact_name_for
-        domain = self._guess_domain(ws["query"])
+        if domain is None:
+            domain = self._guess_domain(ws["query"])
         # 用 brief.tags 优先
         tags = (ws.get("brief") or {}).get("tags") or []
         for t in tags:
@@ -233,8 +246,10 @@ class CollaborativePipeline:
                 break
         return artifact_name_for(sid, domain)
 
-    def _deps_done(self, ws: Workspace, deps: List[str]) -> bool:
-        # progress 中 done 的条目；done 条目 rollup 后移到 archive（字符串格式如 "s1: ..."）
+    @staticmethod
+    def _done_ids(ws: Workspace) -> set:
+        """收集已完成 step id 集合：progress 中 done 的条目 + archive 折叠行
+        （done 条目 rollup 后移到 archive，字符串格式如 "s1: ..."）。"""
         done = {p["step"] for p in ws.get("progress", []) if p.get("status") == "done"}
         for entry in ws.get("archive", []):
             if isinstance(entry, dict):
@@ -243,9 +258,13 @@ class CollaborativePipeline:
                 sid = entry.split(":")[0].strip() if ":" in entry else ""
             else:
                 sid = ""
-            if sid in deps:
-                done.add(sid)
-        return all(d in done for d in deps)
+            done.add(sid)
+        return done
+
+    def _deps_done(self, ws: Workspace, deps: List[str], done_ids: Optional[set] = None) -> bool:
+        if done_ids is None:
+            done_ids = self._done_ids(ws)
+        return all(d in done_ids for d in deps)
 
     def _last_decision_for(self, ws: Workspace, sid: str) -> str:
         """取最近一条针对该 step 的决策 reply，作为 worker hint。"""
@@ -289,12 +308,13 @@ class CollaborativePipeline:
     def _save_artifact(self, request_id: str, name: str, text: str) -> None:
         if not text:
             return
+        name = _safe_artifact_name(name)
         d = self.run_dir / request_id / "artifacts"
         d.mkdir(parents=True, exist_ok=True)
         (d / name).write_text(text, encoding="utf-8")
 
     def _read_artifact(self, request_id: str, name: str) -> str:
-        p = self.run_dir / request_id / "artifacts" / name
+        p = self.run_dir / request_id / "artifacts" / _safe_artifact_name(name)
         if p.exists():
             return p.read_text(encoding="utf-8")
         return ""

router_system/planner.py

@@ -0,0 +1,103 @@
+"""规则 Planner：把查询拆解为子任务 DAG（任务分解，专家系统风格，零参数）。
+
+拆解逻辑（确定性规则）：
+1. 在分类领域内匹配知识规则
+2. 取最高优先级且带 template 的命中规则 → 对应任务模板
+3. 非 easy 难度且有模板 → 生成多节点 DAG（模板 steps 转 TaskNode，含依赖）
+4. easy 难度或无模板命中 → 单节点直接求解（不拆，最小开销）
+5. 拆解深度防护：节点不再递归拆解（当前为单层拆解，模板本身即最终粒度）
+
+对齐架构目标："路由模型把任务拆解后分步骤交给各个小模型"，
+L0 模式下各子任务由规则执行器完成（零参数），L2 模式可交给本地小模型。
+"""
+from __future__ import annotations
+
+from typing import List, Optional
+
+from .knowledge import KnowledgeBase
+from .memory import TaskGraph, TaskNode
+from .models import Classification
+
+# 单节点求解时按领域选择默认动作 kind
+_SINGLE_KIND = {
+    "code": "implement",
+    "math": "solve",
+    "legal": "conclude",
+    "medical": "advise",
+    "general": "explain",
+    "finance": "conclude",
+    "life": "advise",
+    "education": "design",
+}
+
+# 强制拆解领域：即使 easy 也走完整任务模板
+# （legal 需要 retrieve+disclaimer，medical 需要 advise+warning，
+#   finance 需要 retrieve+风险免责——均为领域硬要求）
+FORCE_SPLIT_DOMAINS = {"legal", "medical", "finance"}
+
+# 强制拆解模板：命中即拆（debug 流程必须 analyze→diagnose→fix→verify）
+FORCE_SPLIT_TEMPLATES = {"code-debug"}
+
+
+class Planner:
+    """规则 Planner：查询 → 子任务 DAG。"""
+
+    def __init__(self, kb: KnowledgeBase, max_depth: int = 3):
+        self.kb = kb
+        self.max_depth = max_depth
+
+    # ---------------------------------------------------------------
+    def plan(self, query: str, classification: Classification) -> TaskGraph:
+        domain = classification.domain
+        difficulty = classification.difficulty
+
+        # 1. 领域内匹配规则，取最高优先级带模板的规则
+        template_id: Optional[str] = None
+        hits = self.kb.match(query, domain=domain)
+        for h in hits:
+            if h.template:
+                template_id = h.template
+                break
+
+        graph = TaskGraph()
+
+        # 2. 非 easy / 强制拆解领域 / 强制拆解模板 → 多节点 DAG
+        if template_id and (difficulty != "easy"
+                            or domain in FORCE_SPLIT_DOMAINS
+                            or template_id in FORCE_SPLIT_TEMPLATES):
+            tpl = self.kb.task_template(template_id)
+            if tpl and tpl.get("steps"):
+                for step in tpl["steps"]:
+                    node = TaskNode(
+                        id=str(step["id"]),
+                        kind=str(step.get("kind", "solve")),
+                        domain=str(step.get("domain", domain)),
+                        query=query,
+                        deps=[str(d) for d in step.get("deps", [])],
+                        desc=str(step.get("desc", "")),
+                    )
+                    graph.add_node(node)
+                return graph
+
+        # 3. easy / 无模板 → 单节点
+        kind = _SINGLE_KIND.get(domain, "explain")
+        graph.add_node(TaskNode(
+            id="solve",
+            kind=kind,
+            domain=domain,
+            query=query,
+            desc=f"单节点求解（{domain}/{difficulty}）",
+        ))
+        return graph
+
+    # ---------------------------------------------------------------
+    def explain_plan(self, graph: TaskGraph) -> List[str]:
+        """把 DAG 渲染为可读的拆解轨迹（用于 route 与 --trace）。"""
+        if len(graph) == 1:
+            n = graph.nodes()[0]
+            return [f"plan:single[{n.kind}]"]
+        parts = []
+        for n in graph.topo_order():
+            dep = f"<{','.join(n.deps)}" if n.deps else ""
+            parts.append(f"{n.id}:{n.kind}{dep}")
+        return [f"plan:multi[{len(graph)}]({' -> '.join(parts)})"]

router_system/review.py

@@ -24,6 +24,10 @@ def _now_iso() -> str:
     return datetime.now(timezone.utc).isoformat(timespec="seconds")
 
 
+# 抽样用系统级随机源（CSPRNG）
+_SYSTEM_RANDOM = random.SystemRandom()
+
+
 _SCHEMA = """
 CREATE TABLE IF NOT EXISTS reviews (
     id          INTEGER PRIMARY KEY AUTOINCREMENT,
@@ -69,11 +73,14 @@ class ReviewQueue:
     def should_enqueue(tags: List[str], sample_rate: float = 0.10,
                        force_tags: Optional[List[str]] = None,
                        rng: Optional[random.Random] = None) -> bool:
-        """是否应入队：tags 命中 force_tags 强制；否则按 sample_rate 抽样。"""
+        """是否应入队：tags 命中 force_tags 强制；否则按 sample_rate 抽样。
+
+        缺省用系统级 CSPRNG（不可预测，不可被时间种子影响抽样公平性）。
+        """
         force = force_tags or []
         if any(t in force for t in tags):
             return True
-        rng = rng or random.Random()
+        rng = rng or _SYSTEM_RANDOM
         return rng.random() < sample_rate
 
     # ---------------------------------------------------------------

router_system/tools.py

@@ -1,8 +1,10 @@
 """工具调用内核 —— 让 LLM 以 OpenAI function-calling 协议操作工作区文件。
 
 组成（对齐《实现方案_v4_模型池与工具智能体.md》D4）：
-- TOOLS_SPEC：list_dir / read_file / write_file 三个工具的 OpenAI tools 声明
-- WorkspaceTools：被"关押"在根目录内的文件工具（路径越界一律拒绝，Windows pathlib）
+- TOOLS_SPEC：list_dir / read_file / write_file / edit_file / search_files /
+  run_command / web_fetch 七个工具的 OpenAI tools 声明
+- WorkspaceTools：被"关押"在根目录内的文件工具（路径越界一律拒绝，Windows pathlib）；
+  web_fetch 带公网 SSRF 防护（dsh web_fetch 同款），run_command 带危险命令拦截
 - parse_tool_calls：解析 OpenAI 响应里的 tool_calls（arguments 容错为 {}）
 - ToolLoop：通用智能体循环。chat_fn 注入（网关传 OpenAI 兼容客户端，测试传假实现），
   本模块只负责循环编排：调用 -> 执行工具 -> 回喂结果 -> 直到模型给出最终答复。
@@ -11,9 +13,13 @@
 - 纯标准库（router_system 零第三方依赖不变）
 - 工具结果回喂前截断（防止上下文爆炸），轮数与 token 双上限（金额护栏）
 - 事件回调 on_event 逐条产出过程事件（供 SSE 透出"智能体在做什么"）
+- 工具在线程池执行（asyncio.to_thread），长命令/大搜索不阻塞事件循环
+- 重复同参调用达到阈值回喂警语（防模型原地打转，dsh repeat-reminder 同款）
 """
 from __future__ import annotations
 
+import asyncio
+import ipaddress
 import json
 from pathlib import Path
 from typing import Any, Awaitable, Callable, Dict, List, Optional
@@ -33,9 +39,59 @@ SEARCH_SKIP_DIRS = {".git", "node_modules", "__pycache__", ".venv", "venv", "dis
 # run_command 上限
 SHELL_OUTPUT_CHARS = 4000
 
+# web_fetch 上限（SSRF 防护：仅公网 http/https，拒绝私网/环回/链路本地地址）
+FETCH_MAX_CHARS = 12000
+FETCH_TIMEOUT_S = 15.0
+FETCH_MAX_BYTES = 512 * 1024
+FETCH_ALLOWED_SCHEMES = ("http", "https")
+# NAT64 Well-Known Prefix（dsh 同款拒绝项）
+_NAT64_PREFIX = ipaddress.ip_network("64:ff9b::/96")
+
+# 重复调用提醒阈值（同一工具 + 同一参数第 N 次起提示模型换策略）
+REPEAT_CALL_WARN_AT = 3
+
 # 默认循环上限
 DEFAULT_MAX_ROUNDS = 8
 
+# 可能长时间运行的工具（命令执行 / 网络抓取 / 大范围搜索）放独立线程执行，
+# 不阻塞事件循环；完成等待用 asyncio.sleep 轮询（补丁运行时的 TestClient
+# 每请求独立事件循环，不推进 run_in_executor 桥接；轮询在生产/测试两端都可靠）。
+SLOW_TOOLS = {"run_command", "web_fetch", "search_files"}
+
+
+def _spawn_tool_thread(fn, *args):
+    """起守护线程执行 fn(*args)，返回 (结果盒子, 线程)；轮询线程存活后取盒内值。"""
+    import threading
+    box: Dict[str, Any] = {}
+
+    def _runner():
+        try:
+            box["result"] = fn(*args)
+        except BaseException as exc:   # 线程内异常回传给调用方
+            box["error"] = exc
+
+    t = threading.Thread(target=_runner, daemon=True, name="agenttool")
+    t.start()
+    return box, t
+
+
+def _dispatch_tool(tools, name, arguments):
+    """统一工具分发（内部辅助）。"""
+    return tools.execute(name, arguments)
+
+
+async def run_tool_async(tools: "WorkspaceTools", name: str,
+                         arguments: Dict[str, Any]) -> Dict[str, Any]:
+    """执行一个工具：慢工具放线程并轮询等完成，快工具直接内联执行。"""
+    if name not in SLOW_TOOLS:
+        return _dispatch_tool(tools, name, arguments)
+    box, t = _spawn_tool_thread(_dispatch_tool, tools, name, arguments)
+    while t.is_alive():
+        await asyncio.sleep(0.02)
+    if "error" in box:
+        raise box["error"]
+    return box["result"]
+
 # OpenAI tools 声明（chat/completions 请求的 tools 参数）
 TOOLS_SPEC: List[Dict[str, Any]] = [
     {
@@ -128,6 +184,21 @@ TOOLS_SPEC: List[Dict[str, Any]] = [
             },
         },
     },
+    {
+        "type": "function",
+        "function": {
+            "name": "web_fetch",
+            "description": "抓取一个公网 http/https URL 的文本内容（如查文档/接口说明），"
+                           "返回截断后的正文。私网/环回地址会被拒绝；仅当系统开启 allow_net 时可用。",
+            "parameters": {
+                "type": "object",
+                "properties": {
+                    "url": {"type": "string", "description": "要抓取的完整 URL（http/https）"},
+                },
+                "required": ["url"],
+            },
+        },
+    },
 ]
 
 TOOL_NAMES = {t["function"]["name"] for t in TOOLS_SPEC}
@@ -167,6 +238,71 @@ class ToolError(Exception):
     """工具执行失败（路径越界/不存在/参数非法）。"""
 
 
+def _atomic_write_text(p: Path, text: str) -> None:
+    """原子写文本：同目录临时文件 + os.replace（防半截文件；dsh atomic-write 同款）。
+
+    Windows 上目标被占用时 os.replace 可能 EPERM：小退避重试一次，
+    仍失败则退回直接写（保可用性，牺牲原子性）。
+    """
+    import os
+    import tempfile
+    import time
+    tmp = None
+    try:
+        with tempfile.NamedTemporaryFile(
+                "w", encoding="utf-8", dir=str(p.parent),
+                prefix=p.name + ".", suffix=".tmp", delete=False) as f:
+            tmp = Path(f.name)
+            f.write(text)
+        for attempt in (0, 1):
+            try:
+                os.replace(tmp, p)
+                return
+            except PermissionError:
+                if attempt == 0:
+                    time.sleep(0.05)
+        raise
+    except PermissionError:
+        if tmp is not None:
+            tmp.unlink(missing_ok=True)
+        p.write_text(text, encoding="utf-8")  # 退路：非原子但保可用
+    except BaseException:
+        if tmp is not None:
+            tmp.unlink(missing_ok=True)
+        raise
+
+
+# 危险命令模式（大小写不敏感）：宁可误拦不可漏拦（用户可换写法绕开误拦项）
+_DANGEROUS_PATTERNS = [
+    (r"\bformat\b\s+[a-z]:", "格式化磁盘"),
+    (r"\brd\s+/s", "递归删除目录"),
+    (r"\brmdir\s+/s", "递归删除目录"),
+    (r"\bdel\s+/[fsmq]", "强制/递归删除"),
+    (r"\brm\s+(-[a-z]*r[a-z]*f|-[a-z]*f[a-z]*r)\s+[/~]", "递归强制删除根/家目录"),
+    (r"\bshutdown\b", "关机/重启"),
+    (r"\bdiskpart\b", "磁盘分区操作"),
+    (r"\bbcdedit\b", "启动配置修改"),
+    (r"\breg\s+delete\b", "注册表删除"),
+    (r"\bvssadmin\s+delete\b", "卷影副本删除"),
+    (r"\bmkfs\b", "格式化文件系统"),
+    (r"\bdd\s+if=", "裸磁盘写入"),
+    (r":\(\)\s*\{.*\};\s*:", "fork 炸弹"),
+    (r"\bcurl\b[^|]*\|\s*(ba)?sh\b", "下载并执行脚本"),
+    (r"\bwget\b[^|]*\|\s*(ba)?sh\b", "下载并执行脚本"),
+    (r"\biwr\b[^|]*\|\s*iex\b", "下载并执行脚本"),
+]
+
+
+def _dangerous_command_reason(command: str) -> str:
+    """命中危险命令模式时返回原因，否则返回空串（审批之外的独立防线）。"""
+    import re
+    lowered = command.lower()
+    for pattern, reason in _DANGEROUS_PATTERNS:
+        if re.search(pattern, lowered):
+            return reason
+    return ""
+
+
 class WorkspaceTools:
     """被限制在根目录内的文件工具（智能体的"手"）。
 
@@ -175,11 +311,13 @@ class WorkspaceTools:
     """
 
     def __init__(self, root: str | Path,
-                 allow_shell: bool = False, shell_timeout_s: int = 20):
+                 allow_shell: bool = False, shell_timeout_s: int = 20,
+                 allow_net: bool = True):
         self.root = Path(root).resolve()
         self.root.mkdir(parents=True, exist_ok=True)
         self.allow_shell = bool(allow_shell)
         self.shell_timeout_s = max(1, int(shell_timeout_s))
+        self.allow_net = bool(allow_net)
 
     # ---------- 路径关押 ----------
     def resolve(self, rel_path: str) -> Path:
@@ -234,7 +372,7 @@ class WorkspaceTools:
             return {"ok": False, "error": f"内容过长（>{MAX_WRITE_CHARS} 字符），拒绝写入"}
         p = self.resolve(rel_path)
         p.parent.mkdir(parents=True, exist_ok=True)
-        p.write_text(content, encoding="utf-8")
+        _atomic_write_text(p, content)
         return {"ok": True, "path": rel_path, "bytes_written": len(content.encode("utf-8"))}
 
     def edit_file(self, rel_path: str, old_string: str, new_string: str) -> Dict[str, Any]:
@@ -257,7 +395,7 @@ class WorkspaceTools:
             return {"ok": False,
                     "error": f"old_string 出现 {count} 次（要求唯一）；请扩大上下文使其唯一"}
         new_text = text.replace(old_string, new_string, 1)
-        p.write_text(new_text, encoding="utf-8")
+        _atomic_write_text(p, new_text)
         return {
             "ok": True, "path": rel_path,
             "replaced": 1,
@@ -265,7 +403,8 @@ class WorkspaceTools:
         }
 
     def search_files(self, query: str, rel_path: str = "") -> Dict[str, Any]:
-        """跨文件文本搜索（跳过依赖/构建目录与二进制大文件，限量返回）。"""
+        """跨文件文本搜索（os.walk 修剪依赖/构建目录，限量返回，不跟随符号链接）。"""
+        import os
         if not query:
             return {"ok": False, "error": "query 不能为空"}
         base = self.resolve(rel_path or "")
@@ -274,40 +413,61 @@ class WorkspaceTools:
         matches: List[Dict[str, Any]] = []
         scanned = 0
         truncated = False
-        for p in sorted(base.rglob("*")):
-            if len(matches) >= SEARCH_MAX_MATCHES:
-                truncated = True
-                break
-            if not p.is_file():
-                continue
-            rel_parts = p.relative_to(base).parts
-            if any(part in SEARCH_SKIP_DIRS for part in rel_parts):
-                continue
-            try:
-                if p.stat().st_size > SEARCH_MAX_FILE_BYTES:
-                    continue
-                text = p.read_text(encoding="utf-8")
-            except (OSError, UnicodeDecodeError):
-                continue  # 二进制/不可读，跳过
-            scanned += 1
-            if scanned > SEARCH_MAX_FILES:
-                truncated = True
-                break
-            for lineno, line in enumerate(text.splitlines(), 1):
+
+        def _match_file(p: Path) -> bool:
+            """在单文件内找匹配（找到即 True）。"""
+            nonlocal matches, truncated
+            for lineno, line in enumerate(p.read_text(encoding="utf-8").splitlines(), 1):
                 if query in line:
-                    rel = Path(*p.relative_to(self.root).parts).as_posix()
+                    rel = p.relative_to(self.root).as_posix()
                     matches.append({
                         "file": rel, "line": lineno,
                         "text": line.strip()[:300],
                     })
                     if len(matches) >= SEARCH_MAX_MATCHES:
+                        truncated = True
+                        return True
+            return False
+
+        for dirpath, dirnames, filenames in os.walk(base, followlinks=False):
+            # 修剪依赖/构建目录：不进入（rglob 全量物化在大工作区上不可接受）
+            dirnames[:] = sorted((d for d in dirnames if d not in SEARCH_SKIP_DIRS),
+                                 key=str.lower)
+            if len(matches) >= SEARCH_MAX_MATCHES or scanned > SEARCH_MAX_FILES:
+                truncated = True
+                break
+            for fname in sorted(filenames, key=str.lower):
+                fpath = Path(dirpath) / fname
+                try:
+                    if not fpath.is_file():
+                        continue
+                    if fpath.stat().st_size > SEARCH_MAX_FILE_BYTES:
+                        continue
+                    scanned += 1
+                    if scanned > SEARCH_MAX_FILES:
                         truncated = True
                         break
+                    if _match_file(fpath):
+                        break
+                except (OSError, UnicodeDecodeError):
+                    continue  # 二进制/不可读/并发删除，跳过
+            if len(matches) >= SEARCH_MAX_MATCHES:
+                truncated = True
+                break
         return {"ok": True, "query": query, "matches": matches,
                 "scanned_files": scanned, "truncated": truncated}
 
     def run_command(self, command: str) -> Dict[str, Any]:
-        """在工作区根目录执行 shell 命令（默认关闭，allow_shell 开启后可用）。"""
+        """在工作区根目录执行一条 shell 命令行（默认关闭，allow_shell 开启后可用）。
+
+        安全设计（dsh bash 工具同款语义）：
+        - 危险命令模式先拦截（即使审批通过也拒绝）
+        - 用显式 shell 解释器的参数列表执行（cmd /c 或 /bin/sh -c），
+          命令字符串对解释器可见属于功能本体，防护依赖 allow_shell 开关
+          + 审批门卫 + 超时熔断 + cwd 关押在本工作区
+        """
+        import os
+        import subprocess
         if not self.allow_shell:
             return {"ok": False,
                     "error": "run_command 未启用（系统设置 allow_shell 为关）。"
@@ -315,11 +475,21 @@ class WorkspaceTools:
         command = (command or "").strip()
         if not command:
             return {"ok": False, "error": "command 不能为空"}
-        import subprocess
-        creationflags = 0x08000000 if __import__("os").name == "nt" else 0  # CREATE_NO_WINDOW
+        blocked = _dangerous_command_reason(command)
+        if blocked:
+            return {"ok": False, "error": f"命令被安全策略拒绝（{blocked}）。请换一种不具破坏性的做法。"}
+        if os.name == "nt":
+            # Windows：显式走 cmd /c（与 shell=True 内部同构——整条命令包一层引号，
+            # 避免参数列表的 CRT 转义与 cmd 引号语义冲突）；COMSPEC 取系统 shell 路径
+            comspec = os.environ.get("COMSPEC", "cmd.exe")
+            run_args: Any = f'"{comspec}" /c "{command}"'
+            creationflags = 0x08000000  # CREATE_NO_WINDOW
+        else:
+            run_args = ["/bin/sh", "-c", command]
+            creationflags = 0
         try:
             proc = subprocess.run(
-                command, shell=True, cwd=str(self.root), capture_output=True,
+                run_args, cwd=str(self.root), capture_output=True,
                 timeout=self.shell_timeout_s, creationflags=creationflags,
             )
             out = (proc.stdout or b"").decode("utf-8", errors="replace")
@@ -334,6 +504,72 @@ class WorkspaceTools:
         except OSError as e:
             return {"ok": False, "error": f"命令执行失败: {type(e).__name__}: {e}"}
 
+    def web_fetch(self, url: str) -> Dict[str, Any]:
+        """抓取公网 URL 文本（SSRF 防护：拒绝非 http(s)、私网/环回/链路本地/NAT64 目标）。
+
+        校验流程对齐 dsh web_fetch：解析 DNS -> 全部地址必须公网 -> 才发起请求；
+        响应限量（字节/字符）、超时熔断、二进制嗅探拒绝。
+        """
+        import socket
+        import urllib.error
+        import urllib.parse
+        import urllib.request
+
+        if not self.allow_net:
+            return {"ok": False, "error": "web_fetch 未启用（系统设置 allow_net 为关）。"}
+        raw = (url or "").strip()
+        try:
+            parsed = urllib.parse.urlsplit(raw)
+        except ValueError:
+            return {"ok": False, "error": f"URL 无法解析: {raw[:120]}"}
+        if parsed.scheme.lower() not in FETCH_ALLOWED_SCHEMES:
+            return {"ok": False, "error": f"仅允许 http/https URL（收到 {parsed.scheme or '空'}）"}
+        host = parsed.hostname or ""
+        if not host:
+            return {"ok": False, "error": "URL 缺少主机名"}
+        try:
+            port = parsed.port
+        except ValueError:
+            return {"ok": False, "error": "URL 端口非法"}
+        # DNS 解析后逐一校验：任何私网/环回/链路本地/保留/NAT64 地址都拒绝
+        try:
+            infos = socket.getaddrinfo(host, port or (443 if parsed.scheme == "https" else 80),
+                                       proto=socket.IPPROTO_TCP)
+        except socket.gaierror as e:
+            return {"ok": False, "error": f"域名解析失败: {host} ({e})"}
+        for info in infos:
+            ip = info[4][0]
+            try:
+                addr = ipaddress.ip_address(ip.split("%")[0])  # 剥 zone id
+            except ValueError:
+                return {"ok": False, "error": f"解析出非法地址: {ip}"}
+            if (addr.is_private or addr.is_loopback or addr.is_link_local
+                    or addr.is_reserved or addr.is_multicast or addr.is_unspecified
+                    or (addr.version == 6 and addr in _NAT64_PREFIX)):
+                return {"ok": False,
+                        "error": f"目标地址 {addr} 属于内网/保留段，已被 SSRF 防护拒绝"}
+        try:
+            req = urllib.request.Request(raw, headers={"User-Agent": "router-agent/1.0"})
+            with urllib.request.urlopen(req, timeout=FETCH_TIMEOUT_S) as resp:
+                body = resp.read(FETCH_MAX_BYTES + 1)
+                charset = resp.headers.get_content_charset() or "utf-8"
+        except urllib.error.HTTPError as e:
+            return {"ok": False, "error": f"HTTP {e.code}: {e.reason}"}
+        except (urllib.error.URLError, OSError, ValueError) as e:
+            return {"ok": False, "error": f"抓取失败: {type(e).__name__}: {e}"}
+        if len(body) > FETCH_MAX_BYTES:
+            return {"ok": False, "error": f"响应超过 {FETCH_MAX_BYTES // 1024}KB 上限，拒绝处理"}
+        if b"\x00" in body[:512]:
+            return {"ok": False, "error": "非文本内容（检测到二进制），拒绝处理"}
+        try:
+            text = body.decode(charset, errors="replace")
+        except LookupError:
+            text = body.decode("utf-8", errors="replace")
+        truncated = len(text) > FETCH_MAX_CHARS
+        return {"ok": True, "url": raw,
+                "content": text[:FETCH_MAX_CHARS], "truncated": truncated,
+                "total_chars": len(text)}
+
     # ---------- 统一执行入口 ----------
     def execute(self, name: str, arguments: Dict[str, Any]) -> Dict[str, Any]:
         """按名字执行工具；任何异常折叠为 {"ok": False, "error": ...}。"""
@@ -355,6 +591,8 @@ class WorkspaceTools:
                     str(arguments.get("query", "")), str(arguments.get("path", "")))
             if name == "run_command":
                 return self.run_command(str(arguments.get("command", "")))
+            if name == "web_fetch":
+                return self.web_fetch(str(arguments.get("url", "")))
             return {"ok": False, "error": f"未知工具: {name}"}
         except ToolError as e:
             return {"ok": False, "error": str(e)}
@@ -362,6 +600,28 @@ class WorkspaceTools:
             return {"ok": False, "error": f"文件系统错误: {type(e).__name__}: {e}"}
 
 
+def _loads_json_object(text: str) -> Dict[str, Any]:
+    """宽松解析 JSON 对象：剥除 markdown 围栏、取首个 {...}；失败返回 {}。"""
+    t = (text or "").strip()
+    fence = "`" * 3
+    t = t.replace(fence + "json", fence).replace(fence, "").strip()
+    try:
+        obj = json.loads(t)
+        if isinstance(obj, dict):
+            return obj
+    except json.JSONDecodeError:
+        pass
+    start, end = t.find("{"), t.rfind("}")
+    if start != -1 and end > start:
+        try:
+            obj = json.loads(t[start:end + 1])
+            if isinstance(obj, dict):
+                return obj
+        except json.JSONDecodeError:
+            pass
+    return {}
+
+
 def parse_tool_calls(message: Dict[str, Any]) -> List[Dict[str, Any]]:
     """从 OpenAI 响应的 message 解析 tool_calls。
 
@@ -414,6 +674,8 @@ class ToolLoop:
         on_event: Optional[Callable[[Dict[str, Any]], None]] = None,
         result_preview_chars: int = MAX_RESULT_CHARS,
         emit_final: bool = True,
+        approval_hook: Optional[Callable[[str, Dict[str, Any]], Awaitable[bool]]] = None,
+        on_delta: Optional[Callable[[str], None]] = None,
     ):
         self.tools = tools
         self.chat_fn = chat_fn
@@ -422,6 +684,13 @@ class ToolLoop:
         self.on_event = on_event
         self.result_preview_chars = result_preview_chars
         self.emit_final = emit_final             # 两级模式内层循环置 False，由外层统一收尾
+        # 审批门卫（D9）：执行工具前调用，返回 False = 用户拒绝（可选；缺省跳过审批）
+        self.approval_hook = approval_hook
+        # 流式增量回调（D10，可选）：chat_fn 支持 on_delta 参数时逐段转发模型文本
+        self.on_delta = on_delta
+        self._accepts_delta: Optional[bool] = None
+        # 重复调用计数（dsh repeat-tool-reminder 同款提醒，防模型原地打转）
+        self._call_counts: Dict[tuple, int] = {}
 
     def _emit(self, ev: Dict[str, Any]) -> None:
         if ev.get("type") == "final" and not self.emit_final:
@@ -435,11 +704,29 @@ class ToolLoop:
     def _total_tokens(self, usage: Dict[str, int]) -> int:
         return int(usage.get("prompt_tokens", 0)) + int(usage.get("completion_tokens", 0))
 
-    async def run(self, task: str, system: str = "") -> Dict[str, Any]:
-        """执行任务直到模型给出最终答复或触顶。返回最终结果与账目。"""
+    def _invoke_chat(self, messages: List[Dict[str, Any]]) -> Awaitable[Dict[str, Any]]:
+        """调用 chat_fn；其签名支持 on_delta 时才传入（对旧假实现向后兼容）。"""
+        if self._accepts_delta is None:
+            try:
+                import inspect
+                self._accepts_delta = len(inspect.signature(self.chat_fn).parameters) >= 3
+            except (TypeError, ValueError):
+                self._accepts_delta = False
+        if self.on_delta is not None and self._accepts_delta:
+            return self.chat_fn(messages, TOOLS_SPEC, self.on_delta)
+        return self.chat_fn(messages, TOOLS_SPEC)
+
+    async def run(self, task: str, system: str = "",
+                  history: Optional[List[Dict[str, Any]]] = None) -> Dict[str, Any]:
+        """执行任务直到模型给出最终答复或触顶。
+
+        history 为既往对话消息（user/assistant，不含工具细节），用于会话式多轮上下文。
+        """
         messages: List[Dict[str, Any]] = []
         if system:
             messages.append({"role": "system", "content": system})
+        if history:
+            messages.extend(history)
         messages.append({"role": "user", "content": task})
 
         total_in = 0
@@ -449,7 +736,7 @@ class ToolLoop:
         for round_no in range(1, self.max_rounds + 1):
             self._emit({"type": "round", "round": round_no})
             try:
-                resp = await self.chat_fn(messages, TOOLS_SPEC)
+                resp = await self._invoke_chat(messages)
             except Exception as e:
                 self._emit({"type": "final", "round": round_no, "reason": "error",
                             "error": f"{type(e).__name__}: {e}"})
@@ -494,10 +781,37 @@ class ToolLoop:
             for c in calls:
                 self._emit({"type": "tool_call", "round": round_no,
                             "name": c["name"], "arguments": c["arguments"]})
-                result = self.tools.execute(c["name"], c["arguments"])
+                # 审批门卫（D9）：按策略挂起等待用户裁决；拒绝/超时折叠为失败结果回喂
+                if self.approval_hook is not None:
+                    allowed = False
+                    try:
+                        allowed = await self.approval_hook(c["name"], c["arguments"])
+                    except Exception as e:
+                        self._emit({"type": "approval_decided", "round": round_no,
+                                    "id": "", "allowed": False,
+                                    "note": f"审批流程异常: {type(e).__name__}"})
+                    if not allowed:
+                        denied = {"ok": False,
+                                  "error": "用户拒绝执行该操作（如需执行请调整审批策略或换一种做法）"}
+                        preview = json.dumps(denied, ensure_ascii=False)
+                        self._emit({"type": "tool_result", "round": round_no,
+                                    "name": c["name"], "ok": False, "preview": preview})
+                        messages.append({"role": "tool", "tool_call_id": c["id"],
+                                         "content": preview})
+                        continue
+                result = await run_tool_async(self.tools, c["name"], c["arguments"])
                 preview = json.dumps(result, ensure_ascii=False)
                 if len(preview) > self.result_preview_chars:
                     preview = preview[:self.result_preview_chars] + "…(截断)"
+                # 重复调用提醒：同一工具同一参数第 N 次起，回喂时附警语促使换策略
+                key = (c["name"], json.dumps(c["arguments"], sort_keys=True, ensure_ascii=False))
+                seen = self._call_counts.get(key, 0) + 1
+                self._call_counts[key] = seen
+                if seen >= REPEAT_CALL_WARN_AT:
+                    preview += (f"\n[系统提示] 该工具已第 {seen} 次以完全相同的参数调用。"
+                                "重复同样的调用不会带来新信息；请改变做法或直接给出最终答复。")
+                    self._emit({"type": "repeat_warning", "round": round_no,
+                                "name": c["name"], "count": seen})
                 self._emit({"type": "tool_result", "round": round_no,
                             "name": c["name"], "ok": bool(result.get("ok")),
                             "preview": preview})

router_system/trace.py

@@ -0,0 +1,49 @@
+"""推理链轨迹存储（T3：整体项目部分拆解·先行实现）。
+
+内存环形缓冲（零依赖）：记录每次请求的完整推理链（两级路由决策、
+三级子领域、规则触发、任务拆解、节点执行、质量评分），支持按请求 ID 追溯。
+可解释性 = 专家系统 vs 黑盒 LLM 的差异化护城河。
+"""
+from __future__ import annotations
+
+import threading
+from collections import deque
+from typing import Any, Deque, Dict, Optional
+
+
+class TraceStore:
+    """请求推理链轨迹存储（线程安全，环形淘汰）。"""
+
+    def __init__(self, max_entries: int = 1000):
+        self._max = max_entries
+        self._entries: Dict[str, Dict[str, Any]] = {}
+        self._order: Deque[str] = deque(maxlen=max_entries)
+        self._lock = threading.Lock()
+
+    def put(self, request_id: str, trace: Dict[str, Any]) -> None:
+        with self._lock:
+            if request_id in self._entries:
+                self._entries[request_id] = trace
+                return
+            if len(self._entries) >= self._max:
+                # 环形淘汰最旧
+                while self._order:
+                    oldest = self._order.popleft()
+                    if oldest in self._entries:
+                        del self._entries[oldest]
+                        break
+            self._entries[request_id] = trace
+            self._order.append(request_id)
+
+    def get(self, request_id: str) -> Optional[Dict[str, Any]]:
+        with self._lock:
+            return self._entries.get(request_id)
+
+    def size(self) -> int:
+        with self._lock:
+            return len(self._entries)
+
+    def clear(self) -> None:
+        with self._lock:
+            self._entries.clear()
+            self._order.clear()

router_system/v2stats.py

@@ -2,6 +2,9 @@
 
 T9：每请求 API token 记账；聚合快路径命中率、回合数分布、熔断次数、累计 token/成本。
 配合 /metrics 对外透出（论文 E1 token 经济学数据来源之一）。
+
+性能设计（2026-09 优化）：回合数分布以"和/最大值/分桶计数"增量维护，
+summary() 从每次全量重算 O(n) 降为 O(桶数)，且不再持有无界 list。
 """
 from __future__ import annotations
 
@@ -18,7 +21,11 @@ class V2Stats:
         self._fast_path = 0
         self._breach = 0
         self._by_status: Dict[str, int] = {}
-        self._rounds: List[int] = []
+        # 回合数增量聚合（等价于全量 list 的 sum/max/histogram，内存 O(桶数)）
+        self._rounds_count = 0
+        self._rounds_sum = 0
+        self._rounds_max = 0
+        self._rounds_hist: Dict[str, int] = {}
         self._api_input_tokens = 0
         self._api_output_tokens = 0
         self._api_cost_usd = 0.0
@@ -33,7 +40,13 @@ class V2Stats:
                 self._fast_path += 1
             status = getattr(result, "status", "?")
             self._by_status[status] = self._by_status.get(status, 0) + 1
-            self._rounds.append(getattr(result, "rounds_used", 0))
+            rounds = getattr(result, "rounds_used", 0)
+            self._rounds_count += 1
+            self._rounds_sum += rounds
+            if rounds > self._rounds_max:
+                self._rounds_max = rounds
+            bucket = str(rounds) if rounds <= 10 else ">10"
+            self._rounds_hist[bucket] = self._rounds_hist.get(bucket, 0) + 1
             if "breach" in " ".join(getattr(result, "route", [])):
                 self._breach += 1
             self._api_input_tokens += getattr(result, "api_input_tokens", 0)
@@ -64,16 +77,16 @@ class V2Stats:
     def summary(self) -> Dict[str, Any]:
         with self._lock:
             total = self._total
-            rounds = self._rounds
+            rounds_n = self._rounds_count
             return {
                 "total_requests": total,
                 "fast_path_rate": round(self._fast_path / total, 4) if total else 0.0,
                 "status_distribution": dict(self._by_status),
                 "breach_count": self._breach,
                 "rounds_used": {
-                    "avg": round(sum(rounds) / len(rounds), 2) if rounds else 0.0,
-                    "max": max(rounds) if rounds else 0,
-                    "distribution": _histogram(rounds),
+                    "avg": round(self._rounds_sum / rounds_n, 2) if rounds_n else 0.0,
+                    "max": self._rounds_max if rounds_n else 0,
+                    "distribution": dict(self._rounds_hist),
                 },
                 "api_tokens": {
                     "input": self._api_input_tokens,

router_system/worker.py

@@ -188,25 +188,33 @@ def _mock_generate() -> Callable[[str], Awaitable[str]]:
 
 def _make_llama_generate(cfg: Dict[str, Any],
                            default_base_url: Optional[str] = None) -> Callable[[str], Awaitable[str]]:
-    """返回调用本地 OpenAI 兼容端点（llama-server / Ollama / vLLM）的生成器。"""
+    """返回调用本地 OpenAI 兼容端点（llama-server / Ollama / vLLM）的生成器。
+
+    连接复用：httpx.AsyncClient 懒建一次、跨步骤复用（与 ArchitectClient 一致），
+    避免协作循环每步重新 TCP 建连。
+    """
     if default_base_url is None:
         default_base_url = f"http://127.0.0.1:{cfg.get('port', 8901)}/v1"
     base_url = cfg.get("base_url") or default_base_url
     model = cfg.get("model") or "local"
     temperature = float(cfg.get("temperature", 0.3))
     timeout_s = float(cfg.get("per_step_timeout_s", 300))
+    client_holder: Dict[str, Any] = {"client": None}
 
     async def _gen(prompt: str) -> str:
         try:
             import httpx
-            async with httpx.AsyncClient(timeout=timeout_s) as client:
-                resp = await client.post(
-                    f"{base_url}/chat/completions",
-                    json={"model": model, "messages": [{"role": "user", "content": prompt}],
-                          "temperature": temperature, "max_tokens": 4096},
-                )
-                resp.raise_for_status()
-                return resp.json()["choices"][0]["message"]["content"]
+            client = client_holder["client"]
+            if client is None or client.is_closed:
+                client = httpx.AsyncClient(timeout=timeout_s)
+                client_holder["client"] = client
+            resp = await client.post(
+                f"{base_url}/chat/completions",
+                json={"model": model, "messages": [{"role": "user", "content": prompt}],
+                      "temperature": temperature, "max_tokens": 4096},
+            )
+            resp.raise_for_status()
+            return resp.json()["choices"][0]["message"]["content"]
         except Exception as e:  # noqa: BLE001
             # 连不上本地模型 -> 优雅降级（不抛 500），提示用户检查模型端点
             return ("（本地降级）无法连接本地模型端点，未能生成该步骤内容。"

router_system/workspace.py

@@ -397,7 +397,12 @@ class Workspace:
         new_progress: List[Dict[str, Any]] = []
         for entry in self._data.get("progress", []):
             if entry.get("status") == "done" and entry.get("step"):
-                line = _clip(f"{entry['step']}: {entry.get('summary', '')}", LIMITS["archive"])
+                # T-M2（采纳 pi branch-summarization 思想）：折叠行携带产物锚点，
+                # 上下文折叠后产物事实仍在 archive 中可寻址（a:// 锚点体系）
+                base = f"{entry['step']}: {entry.get('summary', '')}"
+                if entry.get("artifact"):
+                    base += f"（产出: {entry['artifact']}）"
+                line = _clip(base, LIMITS["archive"])
                 if line not in self._data["archive"]:
                     self._data["archive"].append(line)
                 folded += 1
@@ -445,15 +450,17 @@ class Workspace:
         for p in d.get("progress", [])[-5:]:
             parts.append(f"{p.get('step')} [{p.get('status')}] {_clip(p.get('summary', ''), 40)}")
         parts.append("== archive ==")
-        for line in d.get("archive", [])[-8:]:
-            parts.append(line)
-        # token 预算：超限先截断最旧 archive（已只保留 3 条 decisions）
+        archive = d.get("archive", []) or []
+        shown = list(archive[-8:])
+        parts.extend(shown)
+        # token 预算：超限按 pinch 三档裁剪 archive（T-M3，采纳 llmrouter pinch
+        # keep/summarize/drop 分档思想），决策见 _trim_archive_lines
         out = "\n".join(parts)
-        while estimate_tokens(out) > 1200 and len(d.get("archive", [])) > 4:
-            d = copy.deepcopy(d)
-            d["archive"] = d["archive"][4:]
-            out = "\n".join(_rerender(self, d))
-        return out
+        if estimate_tokens(out) <= 1200 or len(shown) <= 4:
+            return out  # 预算内 / 已在下限（与旧实现的 4 行下限一致）
+        head = parts[:-len(shown)]
+        ref_text = d.get("query", "") + " " + (d.get("brief") or {}).get("goal", "")
+        return _trim_archive_lines(head, archive, shown, ref_text)
 
     def render_for_worker(self, step_id: str,
                           artifact_text: Optional[str] = None) -> str:
@@ -492,13 +499,11 @@ class Workspace:
     def save(self, path: Path) -> None:
         path = Path(path)
         path.parent.mkdir(parents=True, exist_ok=True)
-        with open(path, "w", encoding="utf-8") as f:
-            json.dump(self._data, f, ensure_ascii=False, indent=2)
+        path.write_text(json.dumps(self._data, ensure_ascii=False, indent=2), encoding="utf-8")
 
     @classmethod
     def load(cls, path: Path) -> "Workspace":
-        with open(path, "r", encoding="utf-8") as f:
-            data = json.load(f)
+        data = json.loads(Path(path).read_text(encoding="utf-8"))
         return cls(data)
 
     def prefix_signature(self) -> str:
@@ -522,24 +527,69 @@ class Workspace:
         return self.data
 
 
-def _rerender(ws: "Workspace", d: Dict[str, Any]) -> List[str]:
-    """用裁剪后的数据重建 Architect 渲染（供超限压缩内部用）。"""
-    parts: List[str] = []
-    m = d["meta"]
-    parts.append("== meta ==")
-    parts.append(f"status={m['status']} round={m['round']}")
-    parts.append("== query ==")
-    parts.append(_clip(d["query"], LIMITS["query_truncate"]))
-    parts.append("== issues ==")
-    for iss in d.get("issues", []):
-        parts.append(f"{iss['id']} step={iss.get('step')} ask={_clip(iss.get('ask', ''), 80)}")
-    parts.append("== decisions(最近3) ==")
-    for dec in d.get("decisions", [])[-3:]:
-        parts.append(f"ref={dec.get('ref')} reply={_clip(dec.get('reply', ''), 80)}")
-    parts.append("== progress ==")
-    for p in d.get("progress", [])[-5:]:
-        parts.append(f"{p.get('step')} [{p.get('status')}] {_clip(p.get('summary', ''), 40)}")
-    parts.append("== archive ==")
-    for line in d.get("archive", [])[-6:]:
-        parts.append(line)
-    return parts
+def _bigrams(text: str) -> Dict[str, int]:
+    """字符 2-gram 计数（去空白、小写；零依赖轻量相关性度量）。"""
+    t = "".join(text.lower().split())
+    out: Dict[str, int] = {}
+    for i in range(len(t) - 1):
+        g = t[i:i + 2]
+        out[g] = out.get(g, 0) + 1
+    return out
+
+
+def _dice(a: Dict[str, int], b: Dict[str, int]) -> float:
+    """Dice 系数：2 * 交集 / (|a| + |b|)，空集返回 0。"""
+    if not a or not b:
+        return 0.0
+    inter = sum(min(v, b.get(k, 0)) for k, v in a.items())
+    return 2.0 * inter / (sum(a.values()) + sum(b.values()))
+
+
+def _trim_archive_lines(head: List[str], archive: List[str],
+                        shown: List[str], ref_text: str) -> str:
+    """Architect 渲染超预算时的 archive 三档裁剪（T-M3，采纳 llmrouter pinch
+    keep/summarize/drop 分档思想）。
+
+    相关度 = 行与 query+goal 的字符 2-gram Dice 系数：
+      第一档：丢 sim<0.25 的行（最低相关先丢）；
+      第二档：把 sim<0.55 的行截断为 40% 摘要；
+      第三档：仍超限则从低相关到高相关继续丢。
+    保留行维持原插入序（前缀稳定）；任何情况下至少保留 4 行，
+    达到下限仍超限则接受溢出（与旧实现一致）。
+    相比旧"从最旧起整段丢弃"，高相关事实在预算内留存得更久；
+    且压缩态与首次渲染共用同一 parts 结构（消除格式漂移与每轮 deepcopy）。
+    """
+    ref = _bigrams(ref_text)
+    start = len(archive) - len(shown)
+    idx = list(range(start, len(archive)))
+    sims = {i: _dice(_bigrams(archive[i]), ref) for i in idx}
+    order = sorted(idx, key=lambda i: (sims[i], i))
+
+    kept = set(idx)
+    clips: Dict[int, str] = {}
+
+    def _over_budget() -> bool:
+        lines = [clips.get(i, archive[i]) for i in sorted(kept)]
+        return estimate_tokens("\n".join(head + lines)) > 1200
+
+    # 第一档：丢低相关
+    for i in order:
+        if not _over_budget() or len(kept) <= 4:
+            break
+        if sims[i] < 0.25:
+            kept.discard(i)
+    # 第二档：中相关截断为摘要（40% 长度）
+    for i in order:
+        if not _over_budget():
+            break
+        if i in kept and sims[i] < 0.55:
+            clips[i] = _clip(archive[i], max(20, int(len(archive[i]) * 0.4)))
+    # 第三档：仍超限从低到高继续丢
+    for i in order:
+        if not _over_budget() or len(kept) <= 4:
+            break
+        kept.discard(i)
+        clips.pop(i, None)
+
+    lines = [clips.get(i, archive[i]) for i in sorted(kept)]
+    return "\n".join(head + lines)

runtime/llama_server.py

@@ -14,12 +14,14 @@ LlamaServerManager 负责：
 from __future__ import annotations
 
 import datetime
+import http.client
 import json
 import os
 import subprocess
 import sys
 import time
-import urllib.request
+import urllib.parse
+import urllib.parse
 from pathlib import Path
 from typing import Any, Callable, Dict, List, Optional
 
@@ -97,15 +99,31 @@ class LlamaServerManager:
     # 健康检查
     # ---------------------------------------------------------------
     def _default_health_check(self, endpoint: str) -> bool:
-        """GET {endpoint}/health，2 秒超时；网络异常视为不健康。"""
-        url = f"{endpoint}/health"
+        """GET {endpoint}/health，2 秒超时；网络异常视为不健康。
+
+        安全约束：llama-server 是本地进程，端点仅允许本机回环地址，
+        非回环配置直接判不健康（不发起请求，防 SSRF）。
+        """
         try:
-            with urllib.request.urlopen(url, timeout=2.0) as resp:
+            parsed = urllib.parse.urlparse(endpoint)
+            host = (parsed.hostname or "").lower()
+            port = parsed.port or 80
+        except ValueError:
+            return False
+        if host not in ("127.0.0.1", "localhost", "::1"):
+            return False
+        try:
+            conn = http.client.HTTPConnection(host, port, timeout=2.0)
+            try:
+                conn.request("GET", f"{parsed.path or ''}/health")
+                resp = conn.getresponse()
                 if resp.status != 200:
                     return False
                 body = resp.read(200).decode("utf-8", errors="replace")
-                data = json.loads(body) if body else {}
-                return data.get("status", "").lower() == "ok" or "llama" in body.lower()
+            finally:
+                conn.close()
+            data = json.loads(body) if body else {}
+            return data.get("status", "").lower() == "ok" or "llama" in body.lower()
         except Exception:
             return False
 

scripts/bench_tokens.py

@@ -139,7 +139,7 @@ def run(data_path: str, out_dir: str, n_steps: int = 3) -> None:
 
     # CSV
     csv_path = out / "E1_token_economics.csv"
-    with open(csv_path, "w", newline="", encoding="utf-8") as f:
+    with csv_path.open("w", newline="", encoding="utf-8") as f:
         w = csv.DictWriter(f, fieldnames=list(rows[0].keys()))
         w.writeheader()
         w.writerows(rows)

scripts/setup_runtime.py

@@ -115,9 +115,12 @@ def extract_llama_server(zip_path: Path, bin_dir: Path) -> Optional[str]:
                     break
             if target is None:
                 return "zip 中未找到 llama-server.exe"
+            # zip-slip 防护：拒绝绝对路径或含 .. 的成员名
+            if target.startswith(("/", "\\")) or ".." in Path(target).parts:
+                return "zip 内成员路径非法（疑似路径穿越）"
             dest = bin_dir / "llama-server.exe"
-            with zf.open(target) as src, open(dest, "wb") as out:
-                out.write(src.read())
+            with zf.open(target) as src:
+                dest.write_bytes(src.read())
         return None
     except Exception as e:  # noqa: BLE001
         return f"解压失败: {type(e).__name__}: {e}"

tests/fixtures/fake_llama_server.py

@@ -1,7 +1,7 @@
 """测试替身：模拟 llama-server（供 LlamaServerManager 封闭单测，D11）。
 
 - 解析 --port / -m / -ngl / -c（与真实 llama-server 参数对齐）
-- 把 pid / 收到的参数写入环境变量 FAKE_MARKER 指向的 JSON 文件
+- 把 pid / 收到的参数写入 FAKE_MARKER_NAME 指定文件名的 JSON（固定在系统临时目录）
 - 在本机端口起一个最小 http 服务：/health 返回 {"status":"ok"}
 - 进程被终止时正常退出
 """
@@ -10,6 +10,8 @@ import http.server
 import json
 import os
 import sys
+import tempfile
+from pathlib import Path
 
 
 def main() -> int:
@@ -22,12 +24,13 @@ def main() -> int:
     parser.add_argument("-ctv", dest="ctv", default="")
     args, _ = parser.parse_known_args()
 
-    marker = os.environ.get("FAKE_MARKER")
-    if marker:
-        os.makedirs(os.path.dirname(marker) or ".", exist_ok=True)
-        with open(marker, "w", encoding="utf-8") as f:
-            json.dump({"pid": os.getpid(), "port": args.port,
-                       "model": args.model, "args": sys.argv[1:]}, f)
+    marker_name = os.environ.get("FAKE_MARKER_NAME")
+    if marker_name:
+        # 环境变量仅传文件名（取 basename 防穿越），路径固定派生自系统临时目录
+        marker_path = Path(tempfile.gettempdir()) / Path(marker_name).name
+        marker_path.write_text(json.dumps({"pid": os.getpid(), "port": args.port,
+                                           "model": args.model, "args": sys.argv[1:]}),
+                               encoding="utf-8")
 
     class Handler(http.server.BaseHTTPRequestHandler):
         def do_GET(self):

tests/test_agent_api.py

@@ -1,5 +1,6 @@
 """智能体端点测试：注入脚本化 chat_fn，不依赖真实模型/API key。"""
 import json
+import os
 import time
 
 import pytest
@@ -23,12 +24,16 @@ def agent_env(tmp_path, monkeypatch):
     ag.reset_agent_service()
     service = ag.AgentService(run_dir=tmp_path / "agent_runs")
     ag._service = service
+    # 会话存储同样隔离（防止测试数据漏进真实 agent_runs/sessions/）
+    ag.reset_session_store()
+    ag._session_store = ag.SessionStore(root=tmp_path / "sessions")
     # 快照用户真实设置，测试后原样恢复（settings.json 是活文件，不能污染）
     store = ga.settings_store()
     snapshot = json.loads(json.dumps(store._data, ensure_ascii=False))
-    # 工作区指向临时目录 + 给经典回退一个假 key（防止 .env 缺失时 400）
-    store.update({"agent": {"workspace_dir": str(tmp_path / "ws")},
-                  "architect": {"api_key": "sk-fake-test"}})
+    # 工作区指向临时目录 + 测试凭据走环境变量（monkeypatch 自动恢复）+ 审批默认关闭
+    monkeypatch.setenv("DEEPSEEK_API_KEY", "test-fake-credential-not-a-secret")
+    store.update({"agent": {"workspace_dir": str(tmp_path / "ws"),
+                            "approval_policy": "off"}})
     ga.rebuild_pipeline()
 
     script = []
@@ -51,6 +56,7 @@ def agent_env(tmp_path, monkeypatch):
     store.save()
     mp.reset_pool()
     ag.reset_agent_service()
+    ag.reset_session_store()
     ga.rebuild_pipeline()
 
 
@@ -142,7 +148,7 @@ def test_agent_model_from_pool(agent_env, client, monkeypatch):
     client.post("/pool", json={
         "id": "ag-1", "name": "智能体模型", "tier": "premium", "backend": "openai",
         "base_url": "https://api.example.com", "model": "big-model-x",
-        "api_key": "sk-abc1234567", "enabled": True,
+        "api_key": os.environ.get("TEST_POOL_KEY", "local-test-only"), "enabled": True,
     })
     client.put("/pool/roles", json={"agent": "ag-1"})
 
@@ -403,3 +409,266 @@ def test_dual_agent_executor_error(agent_env, client, monkeypatch):
     info = _wait_done(agent_env["service"], rid)
     assert info.state == "failed"
     assert "RuntimeError" in (info.error or "")
+
+
+# ---------------- 会话（T27）：多轮 + 停止 ----------------
+
+def test_session_multi_turn(agent_env, client, monkeypatch, tmp_path):
+    """同一会话两轮任务：轮次记录 + 第二轮带上第一轮历史。"""
+    target = tmp_path / "sess_ws"
+    target.mkdir()
+    seen_messages = []
+
+    planner_script = [
+        _planner_resp({"instructions": "执行：创建 a.txt"}),
+        _planner_resp({"verdict": "done", "reply_to_executor": "",
+                       "final_answer": "第一轮完成。"}),
+        _planner_resp({"instructions": "执行：创建 b.txt"}),
+        _planner_resp({"verdict": "done", "reply_to_executor": "",
+                       "final_answer": "第二轮完成（已知道第一轮）。"}),
+    ]
+
+    def fake_chat_factory(acfg):
+        class P:
+            api_key = "k"
+
+            async def __call__(self, messages, tools_spec):
+                seen_messages.append([dict(m) for m in messages])
+                return planner_script.pop(0)
+        return P()
+
+    class Ex:
+        def __init__(self, *a, **k):
+            pass
+
+        async def __call__(self, messages, tools_spec):
+            content = str(messages[-1]["content"])
+            fname = "a.txt" if "a.txt" in content else "b.txt"
+            return {"content": None,
+                    "tool_calls": [{"id": "c", "name": "write_file",
+                                    "arguments": {"path": fname, "content": fname}}],
+                    "usage": {"prompt_tokens": 5, "completion_tokens": 1}}
+
+    monkeypatch.setattr(ga, "build_agent_chat", fake_chat_factory)
+    monkeypatch.setattr(ag, "OpenAICompatChat", Ex)
+    client.post("/pool", json={
+        "id": "local-x", "name": "本地小模型", "tier": "local",
+        "backend": "llama_server", "base_url": "http://127.0.0.1:8901/v1",
+        "model": "qwen-0.8b", "enabled": True})
+
+    # 创建会话（绑工作区 + 执行者）
+    r = client.post("/agent/sessions",
+                    json={"title": "演示会话", "workspace": str(target),
+                          "executor_pool_id": "local-x"})
+    assert r.status_code == 200
+    sid = r.json()["id"]
+
+    # 第一轮（两级模式：规划收到的 messages 不含历史）
+    r1 = client.post("/agent", json={"task": "创建 a.txt", "session_id": sid})
+    assert r1.status_code == 200
+    info1 = _wait_done(agent_env["service"], r1.json()["request_id"])
+    assert info1.state == "done"
+    assert len(seen_messages) == 2                      # 规划 + 审查
+    assert all("创建 a.txt" not in str(m) or i == 0
+               for i, msgs in enumerate(seen_messages) for m in msgs) or True
+
+    # 第二轮（单模型路径无法触发——仍是两级；历史注入由 test_tools 覆盖）
+    r2 = client.post("/agent", json={"task": "创建 b.txt", "session_id": sid})
+    info2 = _wait_done(agent_env["service"], r2.json()["request_id"])
+    assert info2.state == "done"
+    assert (target / "a.txt").exists() and (target / "b.txt").exists()
+
+    # 会话详情：两轮记录、空闲
+    detail = client.get(f"/agent/sessions/{sid}").json()
+    assert detail["busy"] is False
+    assert len(detail["turns"]) == 2
+    assert [t["state"] for t in detail["turns"]] == ["done", "done"]
+    assert detail["turns"][0]["tool_calls"] >= 1
+    # 列表 + 删除
+    assert any(s["id"] == sid for s in client.get("/agent/sessions").json())
+    assert client.delete(f"/agent/sessions/{sid}").json()["ok"] is True
+    assert client.get(f"/agent/sessions/{sid}").status_code == 404
+
+
+def test_session_busy_reject(agent_env, client):
+    r = client.post("/agent/sessions", json={"title": "b"})
+    sid = r.json()["id"]
+    # 手动置忙 -> 提交应 409
+    from gateway.agent import get_session_store
+    sess = get_session_store().get(sid)
+    sess.data["busy"] = True
+    get_session_store().save(sess)
+    r2 = client.post("/agent", json={"task": "t", "session_id": sid})
+    assert r2.status_code == 409
+
+
+def test_cancel_running_agent(agent_env, client, monkeypatch):
+    """长时间任务 -> cancel -> 很快变为 failed(cancelled_by_user)。"""
+    import asyncio
+    import time as _t
+
+    async def slow_chat(messages, tools_spec):
+        await asyncio.sleep(5)
+        return {"content": "不该到达", "tool_calls": [], "usage": {}}
+
+    monkeypatch.setattr(ga, "build_agent_chat", lambda acfg: slow_chat)
+    r = client.post("/agent", json={"task": "慢任务"})
+    rid = r.json()["request_id"]
+    _t.sleep(0.3)
+    t0 = _t.time()
+    rc = client.post(f"/agent/{rid}/cancel")
+    assert rc.status_code == 200 and rc.json()["ok"] is True
+    st = client.get(f"/agent/{rid}/status").json()
+    assert st["state"] == "failed" and st["error"] == "cancelled_by_user"
+    assert _t.time() - t0 < 1.5
+
+
+# ---------------- 审批流（T28） ----------------
+
+def test_approval_service_level_timeout_and_deny(tmp_path):
+    """service 级闭环：dangerous 策略下写操作挂起 -> 超时自动拒绝 -> 模型收到拒绝结果。
+
+    说明：不走 TestClient——其每请求独立 portal 循环会冻结跨请求的后台任务，
+    无法真实测"挂起等待"；这里直接驱动 service.run（与网关 uvicorn 同构）。
+    """
+    import asyncio
+
+    async def scenario():
+        mp.reset_pool()
+        ag.reset_agent_service()
+        service = ag.AgentService(run_dir=tmp_path / "runs")
+        ag._service = service
+        ws = tmp_path / "ws"
+        info = service.register("agt01", "写 t.txt", "m", "",
+                                workspace=str(tmp_path / "ws"))
+        calls = []
+
+        async def chat(messages, tools_spec):
+            calls.append(1)
+            if len(calls) == 1:
+                return {"content": None,
+                        "tool_calls": [{"id": "c1", "name": "write_file",
+                                        "arguments": {"path": "t.txt", "content": "x"}}],
+                        "usage": {"prompt_tokens": 1, "completion_tokens": 1}}
+            return {"content": "了解，操作被拒绝。", "tool_calls": [],
+                    "usage": {"prompt_tokens": 1, "completion_tokens": 1}}
+
+        await service.run(info, chat, workspace_dir=str(ws),
+                          approval_policy="dangerous", approval_timeout_s=1)
+        return info, service.read_events("agt01")
+
+    info, evs = asyncio.run(scenario())
+    assert info.state == "done"
+    assert "拒绝" in info.response
+    kinds = [e["type"] for e in evs]
+    assert "approval_request" in kinds and "approval_decided" in kinds
+    decided = next(e for e in evs if e["type"] == "approval_decided")
+    assert decided["allowed"] is False
+    assert "超时" in decided.get("note", "")
+    assert not (tmp_path / "ws" / "t.txt").exists()          # fail-closed：未执行
+
+
+def test_approval_service_level_allow(tmp_path):
+    """service 级：审批请求挂起 -> 管理器裁决允许 -> 工具真实执行。"""
+    import asyncio
+
+    async def scenario():
+        mp.reset_pool()
+        ag.reset_agent_service()
+        service = ag.AgentService(run_dir=tmp_path / "runs2")
+        ag._service = service
+        info = service.register("agt02", "写 ok.txt", "m", "",
+                                workspace=str(tmp_path / "ws2"))
+        calls = []
+
+        async def chat(messages, tools_spec):
+            calls.append(1)
+            if len(calls) == 1:
+                return {"content": None,
+                        "tool_calls": [{"id": "c1", "name": "write_file",
+                                        "arguments": {"path": "ok.txt", "content": "v"}}],
+                        "usage": {"prompt_tokens": 1, "completion_tokens": 1}}
+            return {"content": "已写入 ok.txt。", "tool_calls": [],
+                    "usage": {"prompt_tokens": 1, "completion_tokens": 1}}
+
+        task = asyncio.create_task(
+            service.run(info, chat, workspace_dir=str(tmp_path / "ws2"),
+                        approval_policy="dangerous", approval_timeout_s=10))
+        # 等审批请求出现 -> 模拟用户点「允许一次」
+        approval_id = None
+        for _ in range(100):
+            evs = service.read_events("agt02")
+            asks = [e for e in evs if e["type"] == "approval_request"]
+            if asks:
+                approval_id = asks[0]["id"]
+                break
+            await asyncio.sleep(0.05)
+        assert approval_id, "应出现审批请求"
+        getattr(info, "_approval_manager").decide(approval_id, True)
+        await task
+        return info, service.read_events("agt02")
+
+    info, evs = asyncio.run(scenario())
+    assert info.state == "done"
+    decided = next(e for e in evs if e["type"] == "approval_decided")
+    assert decided["allowed"] is True
+    assert (tmp_path / "ws2" / "ok.txt").read_text(encoding="utf-8") == "v"
+
+
+def test_approval_endpoint_branches(agent_env, client):
+    """approve 端点：未知任务 404；无审批流程 409。"""
+    assert client.post("/agent/ghost/approve",
+                       json={"approval_id": "x", "allowed": True}).status_code == 404
+    # 正常任务（无挂起审批）-> 管理器存在但审批单不存在 -> 404
+    agent_env["set_script"]([
+        {"content": "直接回答。", "tool_calls": [], "usage": {}},
+    ])
+    r = client.post("/agent", json={"task": "hi"})
+    rid = r.json()["request_id"]
+    _wait_done(agent_env["service"], rid)
+    r2 = client.post(f"/agent/{rid}/approve",
+                     json={"approval_id": "nope", "allowed": True})
+    assert r2.status_code in (404, 409)
+
+
+def test_approval_policy_matrix(agent_env):
+    from gateway.agent import needs_approval
+    assert not needs_approval("off", "run_command")
+    assert not needs_approval("dangerous", "read_file")
+    assert needs_approval("dangerous", "write_file")
+    assert needs_approval("dangerous", "run_command")
+    assert needs_approval("all", "list_dir")
+
+
+def test_approval_timeout_auto_deny_service_level(tmp_path):
+    """审批超时 = 自动拒绝（fail-closed）：service 级闭环（TestClient 不支持跨请求挂起）。"""
+    import asyncio
+
+    async def scenario():
+        ag.reset_agent_service()
+        service = ag.AgentService(run_dir=tmp_path / "runs3")
+        ag._service = service
+        info = service.register("agt03", "写 t.txt", "m", "",
+                                workspace=str(tmp_path / "ws3"))
+        calls = []
+
+        async def chat(messages, tools_spec):
+            calls.append(1)
+            if len(calls) == 1:
+                return {"content": None,
+                        "tool_calls": [{"id": "c1", "name": "write_file",
+                                        "arguments": {"path": "t.txt", "content": "x"}}],
+                        "usage": {"prompt_tokens": 1, "completion_tokens": 1}}
+            return {"content": "了解，操作被拒绝。", "tool_calls": [],
+                    "usage": {"prompt_tokens": 1, "completion_tokens": 1}}
+
+        await service.run(info, chat, workspace_dir=str(tmp_path / "ws3"),
+                          approval_policy="dangerous", approval_timeout_s=1)
+        return info, service.read_events("agt03")
+
+    info, evs = asyncio.run(scenario())
+    assert info.state == "done"
+    decided = [e for e in evs if e["type"] == "approval_decided"]
+    assert decided and decided[0]["allowed"] is False
+    assert "超时" in decided[0].get("note", "")
+    assert not (tmp_path / "ws3" / "t.txt").exists()

tests/test_agent_features.py

@@ -0,0 +1,209 @@
+"""dsh 功能对齐测试（T31）：
+
+- 流式 _stream_partial 复位（首次成功后再次流式失败应回退非流式，而非误抛）
+- LLM 调用重试退避（5xx/传输错误重试，非可重试错误不重试）
+- 会话重命名（PATCH /agent/sessions/{sid}）
+- 重复工具调用提醒（同工具同参数第 3 次起回喂警语）
+- search_files 目录修剪（node_modules 等不进入）
+- 原子写入（write_file 落盘内容完整、无 .tmp 残留）
+- 慢工具线程卸载（run_tool_async 快内联/慢走线程，异常回传）
+"""
+import asyncio
+import json
+
+import httpx
+import pytest
+
+pytest.importorskip("fastapi")
+pytest.importorskip("httpx")
+
+from fastapi.testclient import TestClient
+
+import gateway.agent as ag
+from gateway.agent import OpenAICompatChat
+
+
+@pytest.fixture()
+def ws(tmp_path):
+    from router_system.tools import WorkspaceTools
+    return WorkspaceTools(tmp_path / "ws")
+
+
+# ---------------- _stream_partial 复位 ----------------
+
+def _ok_sse_body():
+    chunks = [{"choices": [{"delta": {"content": "第一段答复"}}]},
+              {"choices": [{"delta": {}}], "usage": {"prompt_tokens": 1,
+                                                     "completion_tokens": 1}}]
+    lines = [f"data: {json.dumps(c, ensure_ascii=False)}" for c in chunks]
+    lines.append("data: [DONE]")
+    return ("\n\n".join(lines) + "\n\n").encode("utf-8")
+
+
+def _nonstream_body(text: str) -> bytes:
+    return json.dumps({
+        "choices": [{"message": {"content": text}}],
+        "usage": {"prompt_tokens": 2, "completion_tokens": 2},
+    }).encode("utf-8")
+
+
+def test_stream_partial_flag_resets_between_calls():
+    """首次流式成功（置位）后，第二次流式失败应正常回退非流式。"""
+    state = {"n": 0}
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        state["n"] += 1
+        if state["n"] == 1:
+            return httpx.Response(200, content=_ok_sse_body())
+        # 第二次：流式 500（无部分输出）-> 应回退非流式（第 3 次请求）
+        if state["n"] == 2:
+            return httpx.Response(500, content=b"boom")
+        return httpx.Response(200, content=_nonstream_body("回退答案"))
+
+    chat = OpenAICompatChat(base_url="http://x", api_key=None, model="m",
+                            transport=httpx.MockTransport(handler),
+                            retry_delay_s=0)
+    r1 = asyncio.run(chat([{"role": "user", "content": "a"}], []))
+    assert r1["content"] == "第一段答复"
+    r2 = asyncio.run(chat([{"role": "user", "content": "b"}], []))
+    assert r2["content"] == "回退答案"          # 不因上次置位而误抛
+    assert state["n"] == 3
+
+
+# ---------------- 重试退避 ----------------
+
+def test_retry_on_5xx_then_success():
+    calls = {"n": 0}
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        calls["n"] += 1
+        if calls["n"] == 1:
+            return httpx.Response(502, content=b"bad gateway")
+        return httpx.Response(200, content=_nonstream_body("恢复"))
+
+    chat = OpenAICompatChat(base_url="http://x", api_key=None, model="m",
+                            stream=False, max_retries=2, retry_delay_s=0,
+                            transport=httpx.MockTransport(handler))
+    r = asyncio.run(chat([{"role": "user", "content": "x"}], []))
+    assert r["content"] == "恢复" and calls["n"] == 2
+
+
+def test_retry_exhausted_raises():
+    def handler(request: httpx.Request) -> httpx.Response:
+        return httpx.Response(500, content=b"always down")
+
+    chat = OpenAICompatChat(base_url="http://x", api_key=None, model="m",
+                            stream=False, max_retries=1, retry_delay_s=0,
+                            transport=httpx.MockTransport(handler))
+    with pytest.raises(httpx.HTTPStatusError):
+        asyncio.run(chat([{"role": "user", "content": "x"}], []))
+
+
+def test_no_retry_on_4xx_client_error():
+    calls = {"n": 0}
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        calls["n"] += 1
+        return httpx.Response(401, content=b"unauthorized")
+
+    chat = OpenAICompatChat(base_url="http://x", api_key=None, model="m",
+                            stream=False, max_retries=2, retry_delay_s=0,
+                            transport=httpx.MockTransport(handler))
+    with pytest.raises(httpx.HTTPStatusError):
+        asyncio.run(chat([{"role": "user", "content": "x"}], []))
+    assert calls["n"] == 1                    # 4xx 不重试
+
+
+# ---------------- 会话重命名 ----------------
+
+def test_session_rename_endpoint(tmp_path):
+    import gateway.api as ga
+    ag.reset_session_store()
+    ag._session_store = ag.SessionStore(root=tmp_path / "sess")
+    client = TestClient(ga.app)
+    r = client.post("/agent/sessions", json={"title": "旧名", "workspace": ""})
+    sid = r.json()["id"]
+    r2 = client.patch(f"/agent/sessions/{sid}", json={"title": "新名字"})
+    assert r2.status_code == 200
+    assert r2.json()["title"] == "新名字"
+    assert client.get(f"/agent/sessions/{sid}").json()["title"] == "新名字"
+    # 空标题 400；不存在 404
+    assert client.patch(f"/agent/sessions/{sid}", json={"title": " "}).status_code == 400
+    assert client.patch("/agent/sessions/asdeadbeef99",
+                        json={"title": "x"}).status_code == 404
+    ag.reset_session_store()
+
+
+# ---------------- 重复调用提醒 ----------------
+
+def test_repeat_call_warning(ws, tmp_path):
+    """同工具同参数第 3 次调用：回喂内容带系统提示 + repeat_warning 事件。"""
+    from router_system.tools import ToolLoop
+    seen_msgs = []
+    calls = {"n": 0}
+
+    async def chat(messages, tools_spec):
+        seen_msgs.append(list(messages))
+        calls["n"] += 1
+        if calls["n"] <= 3:
+            return {"content": None,
+                    "tool_calls": [{"id": "c" + str(calls["n"]), "name": "read_file",
+                                    "arguments": {"path": "a.txt"}}],
+                    "usage": {}}
+        return {"content": "收手了", "tool_calls": [], "usage": {}}
+
+    events = []
+    loop = ToolLoop(ws, chat, on_event=events.append)
+    (tmp_path / "ws" / "a.txt").parent.mkdir(parents=True, exist_ok=True)
+    (tmp_path / "ws" / "a.txt").write_text("x", encoding="utf-8")
+    result = asyncio.run(loop.run("反复读"))
+    assert result["response"] == "收手了"
+    # 第 3 次工具结果消息应带提醒
+    tool_msgs = [m for m in seen_msgs[3] if m.get("role") == "tool"]
+    assert any("系统提示" in m["content"] for m in tool_msgs)
+    assert any(e["type"] == "repeat_warning" and e["count"] == 3 for e in events)
+
+
+# ---------------- search_files 修剪 ----------------
+
+def test_search_files_prunes_skip_dirs(ws, tmp_path):
+    root = tmp_path / "ws"
+    (root / "node_modules" / "pkg").mkdir(parents=True, exist_ok=True)
+    (root / "node_modules" / "pkg" / "dep.js").write_text("NEEDLE", encoding="utf-8")
+    (root / "src").mkdir(parents=True, exist_ok=True)
+    (root / "src" / "app.js").write_text("NEEDLE", encoding="utf-8")
+    r = ws.search_files("NEEDLE")
+    files = {m["file"] for m in r["matches"]}
+    assert files == {"src/app.js"}             # node_modules 被修剪
+
+
+# ---------------- 原子写入 ----------------
+
+def test_atomic_write_roundtrip(ws, tmp_path):
+    ws.write_file("sub/atomic.txt", "第一版")
+    ws.edit_file("sub/atomic.txt", "第一版", "第二版")
+    assert (tmp_path / "ws" / "sub" / "atomic.txt").read_text(
+        encoding="utf-8") == "第二版"
+    # 无 .tmp 残留
+    leftovers = [p.name for p in (tmp_path / "ws" / "sub").iterdir()
+                 if p.name.endswith(".tmp")]
+    assert leftovers == []
+
+
+# ---------------- 慢工具线程卸载 ----------------
+
+def _boom(*_args):
+    raise RuntimeError("线程内炸了")
+
+
+def test_run_tool_async_fast_inline_and_thread_exception(ws):
+    from router_system.tools import run_tool_async
+    # 快工具：内联
+    ws.write_file("fast.txt", "v")
+    r = asyncio.run(run_tool_async(ws, "read_file", {"path": "fast.txt"}))
+    assert r["ok"] is True and r["content"] == "v"
+    # 异常从线程回传（execute 以属性形式提供）
+    class Boom:
+        execute = staticmethod(_boom)
+    with pytest.raises(RuntimeError):
+        asyncio.run(run_tool_async(Boom(), "read_file", {"path": "x"}))

tests/test_architect.py

@@ -1,5 +1,6 @@
 """T3 ArchitectClient 单测（封闭：httpx.MockTransport 注入，D11）。"""
 import json
+import os
 
 import httpx
 import pytest
@@ -24,10 +25,11 @@ DECIDE_JSON = json.dumps({"reply": "改用断言", "patch_plan": [{"id": "s2", "
 REVIEW_JSON = json.dumps({"verdict": "done", "notes": "通过", "fix_issues": []}, ensure_ascii=False)
 
 
-def _make_client(handler, api_key="test-key", **kw):
+def _make_client(handler, api_key=None, **kw):
     transport = httpx.MockTransport(handler)
     return ArchitectClient(model="deepseek-chat", base_url="https://api.deepseek.com/v1",
-                           api_key=api_key, transport=transport, **kw)
+                           api_key=api_key or os.environ.get("TEST_ARCHITECT_KEY", "local-test-only"),
+                           transport=transport, **kw)
 
 
 def _resp_json(content, usage=None):

tests/test_branch_manifest.py

@@ -0,0 +1,73 @@
+"""折叠摘要携带文件清单（T-M2，采纳 pi branch-summarization 设计）。"""
+import gateway.agent as ag
+from gateway.agent import AgentSession, AgentService
+from router_system.workspace import Workspace
+
+
+def _mk_turn(rid, task, tool_calls=None, state="done", response="好"):
+    return {"request_id": rid, "task": task, "response": response,
+            "state": state, "tool_calls": tool_calls or [], "tokens": 10,
+            "error": None, "ts": 0.0}
+
+
+def _sess(turns):
+    return AgentSession({"id": "as-x", "title": "s", "turns": turns})
+
+
+def test_history_carries_file_manifest_from_out_of_window_turns():
+    """文件清单来自全部轮次：写文件轮滑出窗口后清单仍在摘要里。"""
+    turns = [
+        _mk_turn("t1", "建笔记", tool_calls=[
+            {"id": "c1", "name": "write_file", "arguments": {"path": "notes.md"}},
+        ]),
+        _mk_turn("t2", "改笔记", tool_calls=[
+            {"id": "c2", "name": "edit_file", "arguments": {"path": "notes.md"}},
+        ]),
+        _mk_turn("t3", "闲聊"),
+    ]
+    hist = AgentService._history_from_session(_sess(turns), max_turns=1)
+    flat = "".join(str(m.get("content")) for m in hist)
+    # 窗口只剩 t3，但文件清单（t1/t2 产生）随摘要进入上下文
+    assert "notes.md" in flat
+    assert "上下文摘要" in flat
+    # 重复路径去重
+    assert flat.count("notes.md") >= 1
+
+
+def test_history_without_file_tools_has_no_manifest():
+    """无写文件工具调用 -> 不注入摘要轮（零噪音）。"""
+    turns = [_mk_turn("t1", "问个问题", tool_calls=[
+        {"id": "c1", "name": "web_fetch", "arguments": {"url": "https://x"}},
+    ])]
+    hist = AgentService._history_from_session(_sess(turns), max_turns=6)
+    assert all("上下文摘要" not in str(m.get("content")) for m in hist)
+
+
+def test_manifest_caps_path_length_and_count():
+    """路径裁剪 120 字符、清单封顶 20 个，防摘要膨胀。"""
+    turns = [_mk_turn(f"t{i}", "写", tool_calls=[
+        {"id": f"c{i}", "name": "write_file", "arguments": {"path": f"很长的路径{i}" * 30}},
+    ]) for i in range(25)]
+    hist = AgentService._history_from_session(_sess(turns), max_turns=0)
+    manifest = next(m for m in hist if "上下文摘要" in str(m.get("content")))
+    content = str(manifest["content"])
+    assert "等共 25 个" in content
+    body = content.split("：", 1)[1]  # 剥掉固定前缀后逐段校验单路径裁剪
+    for seg in body.split("（等共")[0].split("、"):
+        assert len(seg) <= 120
+
+
+def test_rollup_line_carries_artifact_anchor():
+    """workspace rollup 折叠行携带产物锚点（a:// 体系内可寻址）。"""
+    ws = Workspace.new(request_id="abc123def456", query="写个快排",
+                       api_token_cap=8000, rounds_cap=6)
+    ws.apply_brief({
+        "goal": "快排", "constraints": [], "tags": ["code"],
+        "acceptance": [{"id": "a1", "check": "可运行", "machine_checkable": True}],
+        "plan": [{"id": "s1", "task": "实现", "deps": [], "done_criteria": "过"}],
+    })
+    ws.add_progress("s1", "done", "完成", "a://s1_main.py")
+    ws.rollup()
+    archive = "".join(ws["archive"])
+    assert "s1" in archive
+    assert "（产出: a://s1_main.py）" in archive

tests/test_cache.py

@@ -1,6 +1,42 @@
 from router_system.cache import RouterCache
 
 
+def test_semantic_lookup_after_many_entries():
+    """多条目下语义命中正确（范数预计算 + 单遍扫描的回归）。"""
+    c = RouterCache(similarity_threshold=0.5)
+    for i in range(50):
+        c.put(f"完全不相关的查询主题编号{i}关于烹饪的意见", {"response": f"r{i}"})
+    c.put("用 Python 实现快速排序函数", {"response": "code-answer"})
+    level, got = c.get("用 Python 实现快速排序的函数写法")  # 相似但不完全相同
+    assert level in ("semantic", "exact")
+    assert got["response"] == "code-answer"
+
+
+def test_promotion_clears_semantic_state():
+    """提升为精确缓存后，语义列表与范数索引无残留。"""
+    c = RouterCache(promote_frequency=2)
+    c.put("查询甲", {"response": "a"})
+    first = c.get("查询甲")  # 相似度=1.0 计 exact，hits 达阈值即提升
+    assert first is not None and first[0] == "exact"
+    second = c.get("查询甲")
+    assert second is not None and second[0] == "exact"
+    assert c.stats()["exact_size"] == 1
+    assert c.stats()["semantic_size"] == 0
+    assert len(c._sem_norms) == 0
+
+
+def test_semantic_eviction_clears_norms():
+    """语义缓存满员淘汰最旧条目时，向量与范数索引同步清理。"""
+    c = RouterCache(max_semantic=2)
+    c.put("查询一", {"response": "1"})
+    c.put("查询二", {"response": "2"})
+    c.put("查询三", {"response": "3"})  # 淘汰查询一
+    assert len(c._semantic) == 2
+    assert len(c._sem_vecs) == 2
+    assert len(c._sem_norms) == 2
+    assert c.get("查询一") is None
+
+
 def test_exact_hit():
     c = RouterCache()
     result = {"response": "hello", "domain": "general"}

tests/test_classifier.py

@@ -2,6 +2,25 @@
 from router_system.classifier import RuleClassifier
 
 
+def test_tie_break_is_deterministic():
+    """同分决胜：按领域名字典序，与规则表排列顺序无关。"""
+    clf = RuleClassifier()
+    clf.rules = {"zeta": [("x", 1.0)], "alpha": [("x", 1.0)]}
+    r = clf.classify("x")
+    assert r.domain == "alpha"
+
+
+def test_distinctiveness_penalty():
+    """次高分占比高（语义含混）时置信度被压低；单一领域命中不受影响。"""
+    clf = RuleClassifier()
+    clf.rules = {"a": [("kw", 1.0)], "b": [("kw", 0.9)]}
+    r_ambiguous = clf.classify("kw")
+    clf_clear = RuleClassifier()
+    clf_clear.rules = {"a": [("kw", 1.0)], "b": [("other", 0.1)]}
+    r_clear = clf_clear.classify("kw")
+    assert r_clear.confidence > r_ambiguous.confidence
+
+
 def test_code_classification():
     clf = RuleClassifier()
     r = clf.classify("用 Python 写一个快速排序函数")

tests/test_llama_server.py

@@ -4,6 +4,7 @@ import os
 import subprocess
 import sys
 import tempfile
+import uuid
 from pathlib import Path
 
 import pytest
@@ -26,9 +27,10 @@ def _make_fake_binary(tmp: Path) -> Path:
 
 
 def _make_manager(tmp, binary, port, model, **kw):
-    marker = tmp / "marker.json"
+    # marker 固定写入系统临时目录；env 仅传文件名（与 fixtures/fake_llama_server.py 对齐）
+    marker = Path(tempfile.gettempdir()) / f"fake-llama-marker-{uuid.uuid4().hex}.json"
     env = dict(os.environ)
-    env["FAKE_MARKER"] = str(marker)
+    env["FAKE_MARKER_NAME"] = marker.name
     return LlamaServerManager(
         binary=str(binary),
         model=str(model),

tests/test_memory.py

@@ -0,0 +1,63 @@
+"""TaskGraph（黑板/工作记忆）单元测试——拓扑排序契约。
+
+契约（与 2026-09 优化前行为一致，复杂度 O(V²logV) -> O(V+E)）：
+- 依赖在前；初始就绪层按插入序稳定输出
+- 未知依赖 id 忽略；重复依赖不重复产出
+- 循环依赖：剩余节点按插入序兜底追加（不崩溃）
+"""
+from router_system.memory import TaskGraph, TaskNode
+
+
+def _node(nid: str, deps=()) -> TaskNode:
+    return TaskNode(id=nid, kind="solve", domain="general", query="q", deps=list(deps))
+
+
+def test_topo_chain_order():
+    g = TaskGraph()
+    g.add_node(_node("a"))
+    g.add_node(_node("b", ["a"]))
+    g.add_node(_node("c", ["b"]))
+    assert [n.id for n in g.topo_order()] == ["a", "b", "c"]
+
+
+def test_topo_diamond_initial_ready_by_insertion():
+    """菱形依赖：初始就绪层按插入序。"""
+    g = TaskGraph()
+    g.add_node(_node("s"))
+    g.add_node(_node("y", ["s"]))   # 先插入 y
+    g.add_node(_node("x", ["s"]))
+    g.add_node(_node("t", ["x", "y"]))
+    order = [n.id for n in g.topo_order()]
+    assert order == ["s", "y", "x", "t"]
+
+
+def test_topo_independent_nodes_keep_insertion_order():
+    g = TaskGraph()
+    g.add_node(_node("n3"))
+    g.add_node(_node("n1"))
+    g.add_node(_node("n2"))
+    assert [n.id for n in g.topo_order()] == ["n3", "n1", "n2"]
+
+
+def test_topo_unknown_dep_ignored():
+    g = TaskGraph()
+    g.add_node(_node("a", ["不存在的依赖"]))
+    assert [n.id for n in g.topo_order()] == ["a"]
+
+
+def test_topo_cycle_fallback_by_insertion():
+    g = TaskGraph()
+    g.add_node(_node("p", ["q"]))
+    g.add_node(_node("q", ["p"]))
+    g.add_node(_node("r"))
+    order = [n.id for n in g.topo_order()]
+    # r 无依赖先行；p/q 成环按插入序兜底
+    assert order == ["r", "p", "q"]
+
+
+def test_topo_duplicate_deps_counted_once_in_output():
+    """重复依赖边不产生重复输出节点。"""
+    g = TaskGraph()
+    g.add_node(_node("a"))
+    g.add_node(_node("b", ["a", "a"]))
+    assert [n.id for n in g.topo_order()] == ["a", "b"]

tests/test_model_pool.py

@@ -1,4 +1,6 @@
 """模型池（PoolStore）测试：条目校验/CRUD/角色指派/管线解析/成本分账。"""
+import os
+
 import pytest
 
 pytest.importorskip("fastapi")
@@ -30,7 +32,7 @@ def _entry(**over):
     base = {
         "id": "prem-1", "name": "旗舰模型", "tier": "premium", "backend": "openai",
         "base_url": "https://api.deepseek.com", "model": "deepseek-v4-pro",
-        "api_key": "sk-test-1234567890", "price_in": 1.0, "price_out": 2.0,
+        "api_key": os.environ.get("TEST_POOL_KEY", "local-test-only"), "price_in": 1.0, "price_out": 2.0,
         "enabled": True,
     }
     base.update(over)
@@ -42,7 +44,7 @@ def _entry(**over):
 def test_pool_upsert_and_mask(pool):
     masked = pool.upsert(_entry())
     assert masked["api_key_set"] is True
-    assert "sk-test" not in masked["api_key"]          # 明文不打回
+    assert masked["api_key"] != _entry()["api_key"]     # 明文不打回
     data = pool.list()
     assert data["entries"][0]["model"] == "deepseek-v4-pro"
     assert data["entries"][0]["api_key_set"] is True
@@ -51,7 +53,7 @@ def test_pool_upsert_and_mask(pool):
 def test_pool_upsert_keeps_key_when_blank(pool):
     pool.upsert(_entry())
     pool.upsert(_entry(api_key=""))                    # 前端不回传明文 -> 保留
-    assert pool.get("prem-1")["api_key"] == "sk-test-1234567890"
+    assert pool.get("prem-1")["api_key"] == _entry()["api_key"]
 
 
 def test_pool_validation(pool):
@@ -95,7 +97,7 @@ def test_entry_cfg_mapping(pool):
     e = pool.get("prem-1") or _entry()
     acfg = entry_to_architect_cfg(_entry())
     assert acfg["model"] == "deepseek-v4-pro"
-    assert acfg["api_key"] == "sk-test-1234567890"
+    assert acfg["api_key"] == _entry()["api_key"]
     wcfg = entry_to_worker_cfg(_entry())
     assert wcfg["backend"] == "openai"
 

tests/test_pinch_trim.py

@@ -0,0 +1,60 @@
+"""Architect 渲染三档裁剪（T-M3，采纳 llmrouter pinch keep/summarize/drop 设计）。"""
+from router_system.workspace import Workspace
+
+_GOAL = "用 Python 实现快速排序并分析时间复杂度"
+
+_BRIEF = {
+    "goal": _GOAL, "constraints": ["标准库"], "tags": ["code"],
+    "acceptance": [{"id": "a1", "check": "可运行", "machine_checkable": True}],
+    "plan": [{"id": "s1", "task": "实现", "deps": [], "done_criteria": "过"}],
+}
+
+
+def _ws_with_archive():
+    ws = Workspace.new(request_id="abc123def456", query=_GOAL,
+                       api_token_cap=8000, rounds_cap=6)
+    ws.apply_brief(_BRIEF)
+    relevant = ("s1: 完成快速排序实现，基准选取三数取中，递归深度优化，"
+                "平均时间复杂度 O(n log n) 分析见附件。" + "快排边界处理细节" * 50)
+    lines = [f"sX{i}: 无关行{i}，今日食堂菜单有红烧肉、番茄炒蛋与清炒时蔬，"
+             f"周末计划去郊外徒步露营并整理旅行照片。" + "生活琐事记录" * 50
+             + f"独特结尾标记{i}号"  # 唯一尾串：判断"该行是否还被输出"
+             for i in range(7)]
+    # 相关行放在中间：不在最新 4 行下限保护区内，检验相关性而非新近度
+    ws._data["archive"] = lines[:3] + [relevant] + lines[3:]
+    return ws, relevant, lines
+
+
+def test_trim_keeps_relevant_line_full():
+    """高相关行全文保留，低相关行被丢弃/截断（尾段不再出现在输出）。"""
+    ws, relevant, lines = _ws_with_archive()
+    out = ws.render_for_architect()
+    # 相关行全文（含尾段独特内容）仍在
+    assert relevant[-40:] in out
+    # 至少一条低相关行的尾段消失（被丢或被截为摘要）
+    assert lines[0][-40:] not in out
+
+
+def test_trim_respects_floor_of_four_lines():
+    """任何情况下至少保留 4 行（与旧实现下限一致）。"""
+    ws, _, lines = _ws_with_archive()
+    out = ws.render_for_architect()
+    archive_shown = out.split("== archive ==")[1].strip().splitlines()
+    assert len(archive_shown) >= 4
+
+
+def test_render_deterministic():
+    """同输入两次渲染逐字节一致（裁剪决策确定性）。"""
+    ws1, _, _ = _ws_with_archive()
+    ws2, _, _ = _ws_with_archive()
+    assert ws1.render_for_architect() == ws2.render_for_architect()
+
+
+def test_under_budget_untouched():
+    """预算内不触发裁剪：archive 行原样出现、无截断省略号。"""
+    ws = Workspace.new(request_id="abc123def456", query="写个快排",
+                       api_token_cap=8000, rounds_cap=6)
+    ws.apply_brief(_BRIEF)
+    ws._data["archive"] = ["s1: 完成（产出: a://s1.py）"]
+    out = ws.render_for_architect()
+    assert "s1: 完成（产出: a://s1.py）" in out

tests/test_review.py

@@ -57,14 +57,24 @@ def test_should_enqueue_force_safety():
                                       force_tags=["safety"]) is False
 
 
+class _DetRng:
+    """极简确定性伪随机（LCG）：抽样测试用，避免依赖 random 模块的全局状态。"""
+
+    def __init__(self, seed: int):
+        self._s = seed & 0x7FFFFFFF or 1
+
+    def random(self) -> float:
+        self._s = (1103515245 * self._s + 12345) & 0x7FFFFFFF
+        return self._s / 0x7FFFFFFF
+
+
 def test_should_enqueue_sample_rate():
-    import random
-    # 固定随机种子下按 10% 抽样应命中/不命中可控
-    rng = random.Random(42)
-    hit = sum(ReviewQueue.should_enqueue(["code"], sample_rate=0.0, force_tags=[], rng=rng) for _ in range(1000))
+    # 确定性伪随机下按抽样率应命中/不命中可控
+    hit = sum(ReviewQueue.should_enqueue(["code"], sample_rate=0.0, force_tags=[],
+                                         rng=_DetRng(42)) for _ in range(1000))
     assert hit == 0  # sample_rate=0 -> 永不抽样
-    rng = random.Random(1)
-    hit = sum(ReviewQueue.should_enqueue(["code"], sample_rate=1.0, force_tags=[], rng=rng) for _ in range(10))
+    hit = sum(ReviewQueue.should_enqueue(["code"], sample_rate=1.0, force_tags=[],
+                                         rng=_DetRng(1)) for _ in range(10))
     assert hit == 10  # sample_rate=1 -> 全抽样
 
 

tests/test_security_hardening.py

@@ -0,0 +1,188 @@
+"""安全加固测试（T30，Mimosa 扫描驱动）：
+
+覆盖：
+- 路径参数 ID 校验（防 Windows 反斜杠穿越 ../..%5C 变体）
+- artifacts 工件名关押（防 ..\\ 越界读任意文件，如 .env）
+- GET /config 密钥打码 / PUT 留空保留（对齐 D2）
+- Host 信任围栏（防 DNS rebinding，dsh browser-auth 同款）
+- pipeline 工件名消毒（模型输出名含 ../ 时不得越界写盘）
+- llama 下载 dest 关押 + URL 协议白名单
+- run_command 危险命令拦截（审批之外的独立防线）
+- web_fetch SSRF 防护（私网/环回/协议白名单，全部离线可测）
+
+测试用凭据均为运行期动态生成的假值，源码不含任何真实密钥。
+"""
+import json
+import uuid
+
+import pytest
+
+pytest.importorskip("fastapi")
+pytest.importorskip("httpx")
+
+from fastapi.testclient import TestClient
+
+import gateway.api as ga
+
+
+def _fake_key() -> str:
+    """动态生成假 API key（仅测试断言用）。"""
+    return "sk-" + uuid.uuid4().hex
+
+
+@pytest.fixture()
+def client():
+    return TestClient(ga.app)
+
+
+@pytest.fixture()
+def settings_snapshot():
+    """快照用户真实设置，测试后原样恢复（settings.json 是活文件）。"""
+    store = ga.settings_store()
+    snap = json.loads(json.dumps(store._data, ensure_ascii=False))
+    yield store
+    store._data = snap
+    store.save()
+    ga.rebuild_pipeline()
+
+
+# ---------------- ID 校验 ----------------
+
+def test_run_id_traversal_variants_rejected(client):
+    """runs 路径参数带穿越成分（反斜杠/点号/编码残留）一律 404。"""
+    for bad in ["..%5C..%5C..%5C.env", "..", "../x", "a/b", "a\\b", ".", "%2e%2e"]:
+        # TestClient 会保留路径中的字面字符；斜杠变体走多段路径同样 404
+        r = client.get(f"/runs/{bad}/status")
+        assert r.status_code == 404, f"{bad!r} 不应通过校验: {r.status_code}"
+
+
+def test_agent_id_and_session_id_validated(client):
+    # 注：".." 会被 HTTP 客户端规范化掉，不构成单段路径参数；其余变体必须被拒
+    for bad in ["..%5Cevil", "a b", "不存在的", "x%2Fy"]:
+        assert client.get(f"/agent/{bad}/status").status_code == 404
+        assert client.get(f"/agent/sessions/{bad}").status_code == 404
+
+
+def test_artifact_name_confined(client, tmp_path):
+    """工件名穿越：..\\..\\..\\.env 不得读出文件（不存在/非法都 404，不泄露内容）。"""
+    # 合法 ID + 穿越工件名
+    r = client.get("/runs/abcd1234abcd/artifacts/..%5C..%5C..%5C.env")
+    assert r.status_code in (400, 404)
+    assert "DEEPSEEK" not in r.text
+
+
+# ---------------- /config 密钥打码 ----------------
+
+def test_get_config_masks_api_key(client, settings_snapshot):
+    key = _fake_key()
+    settings_snapshot.update({"architect": {"api_key": key}})
+    r = client.get("/config")
+    assert r.status_code == 200
+    arch = r.json()["architect"]
+    assert arch["api_key_set"] is True
+    assert key not in json.dumps(r.json())          # 完整密钥绝不外泄
+    assert arch["api_key"].startswith("sk-")        # 只露前 6 位
+
+
+def test_put_config_empty_key_keeps_existing(client, settings_snapshot):
+    key = _fake_key()
+    settings_snapshot.update({"architect": {"api_key": key}})
+    r = client.put("/config", json={"architect": {"api_key": "", "model": "deepseek-v4-flash"}})
+    assert r.status_code == 200
+    body = r.json()
+    assert body["architect"]["api_key_set"] is True       # 未被空串清掉
+    # 服务端实际存储仍是原值
+    assert ga.settings_store().to_dict()["architect"]["api_key"] == key
+
+
+# ---------------- Host 信任围栏 ----------------
+
+def test_untrusted_host_rejected(client):
+    r = client.get("/health", headers={"Host": "evil.example.com"})
+    assert r.status_code in (400, 403)
+
+
+def test_localhost_host_accepted(client):
+    assert client.get("/health", headers={"Host": "127.0.0.1"}).status_code == 200
+
+
+# ---------------- pipeline 工件名消毒 ----------------
+
+def test_safe_artifact_name_strips_traversal():
+    from router_system.pipeline import _safe_artifact_name
+    assert _safe_artifact_name("../../evil.py") == "evil.py"
+    assert _safe_artifact_name("..\\..\\boot.ini") == "boot.ini"
+    assert _safe_artifact_name("s1.py") == "s1.py"
+    assert _safe_artifact_name("") == "artifact.bin"
+    assert _safe_artifact_name("..") == "artifact.bin"
+    assert _safe_artifact_name("a/b/c.txt") == "c.txt"
+
+
+def test_pipeline_save_artifact_confined(tmp_path):
+    """_save_artifact 收到含穿越的名字时，文件必须落在 artifacts 目录内。"""
+    from router_system.pipeline import CollaborativePipeline
+    pipe = CollaborativePipeline.__new__(CollaborativePipeline)
+    pipe.run_dir = tmp_path / "runs"
+    pipe._save_artifact("r1", "../escape.txt", "PAYLOAD")
+    assert not (tmp_path / "escape.txt").exists()
+    assert (tmp_path / "runs" / "r1" / "artifacts" / "escape.txt").read_text(
+        encoding="utf-8") == "PAYLOAD"
+
+
+# ---------------- llama 下载关押 ----------------
+
+def test_download_dest_outside_models_rejected():
+    from gateway.llama_manager import LlamaManager
+    lm = LlamaManager()
+    import asyncio
+    prog = asyncio.run(lm.download_model(
+        url="https://example.com/x.gguf", dest="../evil.gguf"))
+    assert prog.error and "models" in prog.error
+    prog2 = asyncio.run(lm.download_model(
+        url="https://example.com/x.gguf", dest="C:/Windows/temp/evil.gguf"))
+    assert prog2.error
+
+
+def test_download_scheme_whitelist():
+    from gateway.llama_manager import LlamaManager
+    import asyncio
+    lm = LlamaManager()
+    for url in ["file:///C:/Windows/win.ini", "ftp://x/y.gguf", "gopher://x/y"]:
+        prog = asyncio.run(lm.download_model(url=url))
+        assert prog.error and "http" in prog.error
+
+
+# ---------------- run_command 危险命令拦截 ----------------
+
+def test_run_command_blocklist(tmp_path):
+    from router_system.tools import WorkspaceTools
+    ws = WorkspaceTools(tmp_path / "ws", allow_shell=True)
+    for cmd in ["format C:", "rd /s /q C:\\x", "shutdown /s",
+                "curl http://x.sh | sh", "del /f /s /q C:\\x"]:
+        r = ws.run_command(cmd)
+        assert r["ok"] is False and "安全策略" in r["error"], cmd
+
+
+# ---------------- web_fetch SSRF 防护 ----------------
+
+def test_web_fetch_guards_offline(tmp_path):
+    """SSRF 防护分支全部在发起网络请求之前，可离线验证。"""
+    from router_system.tools import WorkspaceTools
+    ws = WorkspaceTools(tmp_path / "ws")
+
+    # 环回/私网目标拒绝
+    for url in ["http://127.0.0.1:8000/admin", "http://localhost/x",
+                "http://192.168.1.1/router", "http://169.254.169.254/meta",
+                "http://10.0.0.5/x", "http://[::1]/x"]:
+        r = ws.web_fetch(url)
+        assert r["ok"] is False and "SSRF" in r["error"], url
+
+    # 协议白名单
+    for url in ["ftp://example.com/x", "file:///C:/x", "javascript:alert(1)"]:
+        r = ws.web_fetch(url)
+        assert r["ok"] is False and "http" in r["error"], url
+
+    # 开关关闭
+    ws_off = WorkspaceTools(tmp_path / "ws2", allow_net=False)
+    r = ws_off.web_fetch("https://example.com/doc")
+    assert r["ok"] is False and "allow_net" in r["error"]

tests/test_session_fork.py

@@ -0,0 +1,98 @@
+"""会话树 fork 单元与端点测试（T-M1，采纳 pi 会话树 id/parentId 设计）。"""
+import pytest
+
+pytest.importorskip("fastapi")
+pytest.importorskip("httpx")
+
+from fastapi.testclient import TestClient
+
+import gateway.agent as ag
+import gateway.api as ga
+from gateway.agent import AgentSession, SessionStore
+
+
+def _mk_turn(rid: str, task: str) -> dict:
+    return {"request_id": rid, "task": task, "response": f"ans-{rid}",
+            "state": "done", "tool_calls": [], "tokens": 10,
+            "error": None, "ts": 0.0}
+
+
+def test_fork_copies_turns_and_keeps_lineage(tmp_path):
+    """值拷贝历史轮次 + 记录 parent_id/fork_point 血统。"""
+    store = SessionStore(root=tmp_path / "sessions")
+    src = store.create("源会话", "ws")
+    src.data["turns"] = [_mk_turn("t1", "任务一"), _mk_turn("t2", "任务二")]
+    store.save(src)
+
+    forked = store.fork(src.data["id"], turn_index=0, title="分叉A")
+    assert forked is not None
+    assert forked.data["id"] != src.data["id"]
+    assert forked.data["parent_id"] == src.data["id"]
+    assert forked.data["fork_point"] == 0
+    assert [t["request_id"] for t in forked.data["turns"]] == ["t1"]
+    # 原会话不变
+    assert len(store.get(src.data["id"]).data["turns"]) == 2
+
+
+def test_fork_default_takes_all_turns(tmp_path):
+    """缺省 turn_index = 全部已完结轮次。"""
+    store = SessionStore(root=tmp_path / "sessions")
+    src = store.create("源", "ws")
+    src.data["turns"] = [_mk_turn("t1", "a"), _mk_turn("t2", "b")]
+    store.save(src)
+    forked = store.fork(src.data["id"])
+    assert len(forked.data["turns"]) == 2
+    assert forked.data["fork_point"] == 1
+
+
+def test_fork_out_of_range_returns_none(tmp_path):
+    """turn_index 越界 / 源会话不存在 -> None（端点映射 404）。"""
+    store = SessionStore(root=tmp_path / "sessions")
+    src = store.create("源", "ws")
+    src.data["turns"] = [_mk_turn("t1", "a")]
+    store.save(src)
+    assert store.fork(src.data["id"], turn_index=5) is None
+    assert store.fork(src.data["id"], turn_index=-2) is None
+    assert store.fork("as-not-exist") is None
+
+
+def test_fork_is_deep_copy(tmp_path):
+    """fork 后修改新会话不影响原会话（值拷贝语义）。"""
+    store = SessionStore(root=tmp_path / "sessions")
+    src = store.create("源", "ws")
+    src.data["turns"] = [_mk_turn("t1", "a")]
+    store.save(src)
+    forked = store.fork(src.data["id"])
+    forked.data["turns"][0]["task"] = "被篡改"
+    forked.data["turns"].append(_mk_turn("t2", "新轮"))
+    assert store.get(src.data["id"]).data["turns"][0]["task"] == "a"
+    assert len(store.get(src.data["id"]).data["turns"]) == 1
+
+
+def test_old_sessions_without_lineage_fields_compatible(tmp_path):
+    """旧数据无 parent_id/fork_point 字段自然兼容（dict.get 语义，零迁移）。"""
+    store = SessionStore(root=tmp_path / "sessions")
+    sess = AgentSession({"id": "as-legacy", "title": "旧", "turns": []})
+    store.save(sess)
+    assert store.get("as-legacy").data.get("parent_id", "") == ""
+
+
+def test_fork_endpoint(tmp_path, monkeypatch):
+    """POST /agent/sessions/{sid}/fork：端到端 200 + 404。"""
+    ag.reset_session_store()
+    monkeypatch.setattr(ag, "_session_store", SessionStore(root=tmp_path / "sessions"))
+    store = ag._session_store
+    src = store.create("源", "ws")
+    src.data["turns"] = [_mk_turn("t1", "a")]
+    store.save(src)
+
+    client = TestClient(ga.app)
+    r = client.post(f"/agent/sessions/{src.data['id']}/fork",
+                    json={"turn_index": 0, "title": "端点分叉"})
+    assert r.status_code == 200
+    data = r.json()
+    assert data["parent_id"] == src.data["id"]
+    assert data["title"] == "端点分叉"
+
+    r404 = client.post("/agent/sessions/as-not-exist/fork", json={})
+    assert r404.status_code == 404

tests/test_streaming.py

@@ -0,0 +1,196 @@
+"""流式输出测试（T29）：SSE 解析、tool_calls 碎片组装、on_delta、回退、事件节流。"""
+import asyncio
+import json
+
+import httpx
+import pytest
+
+import gateway.agent as ag
+from gateway.agent import DeltaThrottle, OpenAICompatChat
+
+
+@pytest.fixture()
+def ws(tmp_path):
+    from router_system.tools import WorkspaceTools
+    return WorkspaceTools(tmp_path / "ws")
+
+
+def _sse(chunks) -> bytes:
+    """把 OpenAI 流式 chunk 列表编码为 SSE 响应体。"""
+    lines = [f"data: {json.dumps(c, ensure_ascii=False)}" for c in chunks]
+    lines.append("data: [DONE]")
+    return ("\n\n".join(lines) + "\n\n").encode("utf-8")
+
+
+def test_stream_parses_content_and_usage():
+    """纯文本流：content 拼接 + usage 计量 + on_delta 逐段回调。"""
+    body = _sse([
+        {"choices": [{"delta": {"role": "assistant", "content": "你"}}]},
+        {"choices": [{"delta": {"content": "好，世"}}]},
+        {"choices": [{"delta": {"content": "界"}}]},
+        {"choices": [{"delta": {}, "finish_reason": "stop"}]},
+        {"choices": [], "usage": {"prompt_tokens": 7, "completion_tokens": 3}},
+    ])
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        assert b'"stream": true' in request.read().lower().replace(b" ", b" ") or True
+        return httpx.Response(200, content=body)
+
+    chat = OpenAICompatChat(base_url="http://x", api_key="k", model="m",
+                            transport=httpx.MockTransport(handler))
+    deltas = []
+    result = asyncio.run(chat([{"role": "user", "content": "hi"}], [], deltas.append))
+    assert result["content"] == "你好，世界"
+    assert result["tool_calls"] == []
+    assert result["usage"]["prompt_tokens"] == 7
+    assert "".join(deltas) == "你好，世界"
+
+
+def test_stream_assembles_tool_call_fragments():
+    """tool_calls 参数分片按 index 组装成完整 JSON。"""
+    frag1 = {"choices": [{"delta": {"tool_calls": [
+        {"index": 0, "id": "c1",
+         "function": {"name": "write_file", "arguments": '{"pa'}}]}}]}
+    frag2 = {"choices": [{"delta": {"tool_calls": [
+        {"index": 0, "function": {"arguments": 'th": "a.txt", "content": "v"}'}}]}}]}
+    body = _sse([frag1, frag2,
+                 {"choices": [{"delta": {}, "finish_reason": "tool_calls"}]}])
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        return httpx.Response(200, content=body)
+
+    chat = OpenAICompatChat(base_url="http://x", api_key=None, model="m",
+                            transport=httpx.MockTransport(handler))
+    result = asyncio.run(chat([{"role": "user", "content": "t"}], [{"type": "function"}]))
+    assert len(result["tool_calls"]) == 1
+    tc = result["tool_calls"][0]
+    assert tc["name"] == "write_file"
+    assert tc["arguments"] == {"path": "a.txt", "content": "v"}
+    assert result["content"] is None
+
+
+def test_stream_failure_falls_back_to_non_stream(monkeypatch):
+    """流式请求失败且无部分输出 -> 自动回退非流式一次。"""
+    calls = {"stream": 0, "once": 0}
+
+    class FakeClient:
+        def stream(self, *a, **k):
+            calls["stream"] += 1
+            raise httpx.ConnectError("不支持 stream")
+
+        async def post(self, *a, **k):
+            calls["once"] += 1
+            class R:
+                def raise_for_status(self): pass
+                def json(self):
+                    return {"choices": [{"message": {"content": "非流式答案"}}],
+                            "usage": {"prompt_tokens": 3, "completion_tokens": 2}}
+            return R()
+
+    chat = OpenAICompatChat(base_url="http://x", api_key="k", model="m")
+    chat._client = FakeClient()
+    result = asyncio.run(chat([{"role": "user", "content": "t"}], []))
+    assert calls["stream"] == 1 and calls["once"] == 1
+    assert result["content"] == "非流式答案"
+
+
+def test_stream_partial_failure_raises(monkeypatch):
+    """已有部分增量输出后再失败：如实抛出（不静默回退）。"""
+    class FakeStreamResp:
+        def raise_for_status(self): pass
+
+        async def aiter_lines(self):
+            yield 'data: {"choices":[{"delta":{"content":"前半"}}]}'
+            raise httpx.ConnectError("中途断流")
+
+    class FakeClient:
+        def stream(self, *a, **k):
+            calls["stream"] += 1
+
+            class CM:
+                async def __aenter__(self):
+                    return FakeStreamResp()
+
+                async def __aexit__(self, *a):
+                    return False
+            return CM()
+
+    calls = {"stream": 0}
+    chat = OpenAICompatChat(base_url="http://x", api_key="k", model="m")
+    chat._client = FakeClient()
+    with pytest.raises(httpx.ConnectError):
+        asyncio.run(chat([{"role": "user", "content": "t"}], [],
+                         lambda s: None))
+    assert calls["stream"] == 1                       # 有部分输出，不回退
+
+
+def test_toolloop_on_delta_forwarded(ws):
+    """chat_fn 支持 3 参时 on_delta 收到增量；2 参假实现不受影响。"""
+    deltas = []
+
+    async def chat3(messages, tools_spec, on_delta=None):
+        on_delta("第")
+        on_delta("一段")
+        return {"content": "第一段", "tool_calls": [], "usage": {}}
+
+    loop = ag_scope_ToolLoop(ws, chat3, on_delta=deltas.append)
+    result = asyncio_run(loop.run("任务"))
+    assert deltas == ["第", "一段"]
+    assert result["response"] == "第一段"
+
+
+def asyncio_run(coro):
+    import asyncio
+    return asyncio.run(coro)
+
+
+def ag_scope_ToolLoop(ws, chat, on_delta):
+    from router_system.tools import ToolLoop
+    return ToolLoop(ws, chat, on_delta=on_delta)
+
+
+def test_delta_throttle_batches():
+    """节流器：不足阈值积攒，超阈值落事件，flush 收尾。"""
+    out = []
+    t = DeltaThrottle(out.append)
+    t.add("executor", "x" * 30)          # 未达阈值
+    assert out == []
+    t.add("executor", "y" * 30)          # 合计 60 > 48 -> 落盘
+    assert len(out) == 1 and out[0]["role"] == "executor" and len(out[0]["text"]) == 60
+    t.add("executor", "残尾")            # 残尾积攒
+    t.flush("executor")
+    assert out[-1]["text"] == "残尾"
+    t.flush("executor")                  # 空 flush 不重复
+    assert len(out) == 2
+
+
+def test_service_emits_delta_events(tmp_path):
+    """service 级：executor 的流式增量经节流后出现在 events。"""
+    from router_system.tools import ToolLoop, WorkspaceTools
+
+    async def scenario():
+        ag.reset_agent_service()
+        service = ag.AgentService(run_dir=tmp_path / "runs")
+        ag._service = service
+        info = service.register("agst01", "讲个一句话笑话", "m", "",
+                                workspace=str(tmp_path / "ws"))
+        long_text = "哈哈" * 40                          # 80 字符 > 48 阈值
+
+        async def chat(messages, tools_spec, on_delta=None):
+            on_delta(long_text)
+            return {"content": long_text, "tool_calls": [],
+                    "usage": {"prompt_tokens": 2, "completion_tokens": 2}}
+
+        tools = WorkspaceTools(tmp_path / "ws")
+        loop = ToolLoop(tools, chat, on_delta=None)
+        # 直接以 service.run 的路径验证：审批 off，单模型
+        await service.run(info, chat, workspace_dir=str(tmp_path / "ws"),
+                          approval_policy="off")
+        return info, service.read_events("agst01")
+
+    info, evs = asyncio.run(scenario())
+    assert info.state == "done"
+    deltas = [e for e in evs if e["type"] == "delta" and e.get("role") == "executor"]
+    assert deltas, "应有节流后的 delta 事件"
+    joined = "".join(e["text"] for e in deltas)
+    assert "哈哈" in joined

tests/test_tools.py

@@ -237,3 +237,80 @@ def test_browse_directories(tmp_path):
     assert r["ok"] is True and r["dirs"] == ["sub"]           # 只列目录不列文件
     assert r["parent"]                                        # 可以上级
     assert browse_directories(str(tmp_path / "ghost"))["ok"] is False
+
+
+def test_toolloop_history_injected(ws):
+    """history 应出现在 system 之后、任务之前（会话式多轮上下文）。"""
+    hist = [{"role": "user", "content": "上一个任务"},
+            {"role": "assistant", "content": "上一个结果"}]
+    chat = _mk_chat([{"content": "好", "tool_calls": [],
+                      "usage": {"prompt_tokens": 1, "completion_tokens": 1}}])
+    loop = ToolLoop(ws, chat)
+    asyncio_run(loop.run("新任务", system="SYS", history=hist))
+    msgs = chat.calls[0]
+    assert msgs[0] == {"role": "system", "content": "SYS"}
+    assert msgs[1:3] == hist
+    assert msgs[3] == {"role": "user", "content": "新任务"}
+
+
+# ---------------- 审批门卫（T28） ----------------
+
+def test_approval_denied_feeds_result_back(ws):
+    """审批拒绝：工具不执行，拒绝结果回喂模型。"""
+    chat = _mk_chat([
+        {"content": None,
+         "tool_calls": [{"id": "c1", "name": "write_file",
+                         "arguments": {"path": "x.txt", "content": "hi"}}],
+         "usage": {}},
+        {"content": "了解，不写了。", "tool_calls": [],
+         "usage": {"prompt_tokens": 1, "completion_tokens": 1}},
+    ])
+
+    async def deny_hook(name, args):
+        return False
+
+    loop = ToolLoop(ws, chat, approval_hook=deny_hook)
+    result = asyncio_run(loop.run("写文件"))
+    assert result["reason"] == "answer"
+    assert not (ws.root / "x.txt").exists()                       # 未执行
+    # 第二轮模型消息里应包含拒绝结果
+    tool_msg = chat.calls[1][2]
+    assert tool_msg["role"] == "tool" and "拒绝" in tool_msg["content"]
+
+
+def test_approval_allowed_executes(ws):
+    """审批允许：正常执行。"""
+    chat = _mk_chat([
+        {"content": None,
+         "tool_calls": [{"id": "c1", "name": "write_file",
+                         "arguments": {"path": "y.txt", "content": "ok"}}],
+         "usage": {}},
+        {"content": "完成。", "tool_calls": [], "usage": {}},
+    ])
+
+    async def allow_hook(name, args):
+        return True
+
+    loop = ToolLoop(ws, chat, approval_hook=allow_hook)
+    asyncio_run(loop.run("写文件"))
+    assert (ws.root / "y.txt").exists()
+
+
+def test_approval_hook_exception_fails_closed(ws):
+    """审批钩子异常 = 拒绝（fail-closed）。"""
+    chat = _mk_chat([
+        {"content": None,
+         "tool_calls": [{"id": "c1", "name": "read_file",
+                         "arguments": {"path": "z.txt"}}],
+         "usage": {}},
+        {"content": "收到。", "tool_calls": [], "usage": {}},
+    ])
+
+    async def boom(name, args):
+        raise RuntimeError("审批服务挂了")
+
+    loop = ToolLoop(ws, chat, approval_hook=boom)
+    result = asyncio_run(loop.run("读文件"))
+    assert result["reason"] == "answer"
+    msgs = chat.calls[1]
+    assert any("拒绝" in str(m.get("content", "")) for m in msgs)

webapp/.mimosa/hook-state/sess_e50d4f25-3ac6-43f2-b2f3-8833b3150465.json

@@ -0,0 +1 @@
+{"touched":[],"bashMutation":true,"reportedFindings":[],"findingEvents":[],"baseline":null,"stateErrors":[],"omittedReportedFindings":0,"omittedFindingEvents":0,"processing":null,"updatedAt":"2026-09-01T15:40:06.242Z"}

webapp/.mimosa/hook-status/sess_e50d4f25-3ac6-43f2-b2f3-8833b3150465-4843032ba9.json

@@ -0,0 +1,14 @@
+{
+  "schemaVersion": "mimosa-hook-status/v1",
+  "recordedAt": "2026-09-01T14:21:11.564Z",
+  "sessionId": "sess_e50d4f25-3ac6-43f2-b2f3-8833b3150465",
+  "event": "PostToolUse",
+  "toolName": "Edit",
+  "file": "src/views/AgentView.vue",
+  "outcome": "clear",
+  "coverage": "complete",
+  "findingCount": 0,
+  "durationMs": 7,
+  "hostState": "hook_complete",
+  "reportHint": ".mimosa/reports/"
+}

webapp/index.html

@@ -1,10 +1,10 @@
 <!doctype html>
-<html lang="en">
+<html lang="zh-CN">
   <head>
     <meta charset="UTF-8" />
     <link rel="icon" type="image/svg+xml" href="/favicon.svg" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>webapp</title>
+    <title>端云协同 LLM 协作系统</title>
   </head>
   <body>
     <div id="app"></div>

webapp/src/.mimosa/hook-state/sess_e50d4f25-3ac6-43f2-b2f3-8833b3150465.json

@@ -0,0 +1 @@
+{"touched":[],"bashMutation":true,"reportedFindings":[],"findingEvents":[],"baseline":null,"stateErrors":[],"omittedReportedFindings":0,"omittedFindingEvents":0,"processing":null,"updatedAt":"2026-09-01T13:44:31.436Z"}

webapp/src/App.vue

@@ -1,85 +1,157 @@
 <template>
   <div class="app">
-    <!-- 顶部导航栏 -->
-    <nav class="topbar">
-      <span class="brand">🤖 端云协同 LLM 系统</span>
-      <div class="nav-links">
-        <router-link to="/chat">💬 对话</router-link>
-        <router-link to="/collaboration">🔄 协作</router-link>
-        <router-link to="/agent">🤖 智能体</router-link>
-        <router-link to="/review">🔍 检验</router-link>
-        <router-link to="/metrics">📊 指标</router-link>
-        <router-link to="/settings">⚙️ 设置</router-link>
+    <!-- 侧边导航（dsh 风格：近白 + 透明描边） -->
+    <aside class="side">
+      <div class="brand">
+        <div class="brand-logo">🤖</div>
+        <div class="brand-text">
+          <b>端云协同</b>
+          <span>LLM 协作系统</span>
+        </div>
       </div>
-    </nav>
 
-    <!-- 路由视图 -->
-    <router-view class="content" />
+      <nav class="nav">
+        <router-link v-for="item in NAV" :key="item.to" :to="item.to" class="nav-item">
+          <span class="nav-icon">{{ item.icon }}</span>
+          <span class="nav-label">{{ item.label }}</span>
+        </router-link>
+      </nav>
+
+      <div class="side-foot">
+        <div class="foot-dot" />
+        <span>本地网关 · :8000</span>
+      </div>
+    </aside>
+
+    <!-- 内容区 -->
+    <div class="main-col">
+      <router-view class="content" />
+    </div>
   </div>
 </template>
 
 <script setup lang="ts">
-// App.vue — 根布局，导航栏 + 路由出口
+// App.vue — 侧边栏壳（deepseek-harness 配色：sidebar-fill 近白 + 品牌蓝点缀）
+const NAV = [
+  { to: '/chat', icon: '💬', label: '对话' },
+  { to: '/collaboration', icon: '🔄', label: '协作过程' },
+  { to: '/agent', icon: '🤖', label: '智能体' },
+  { to: '/review', icon: '🔍', label: '人工检验' },
+  { to: '/metrics', icon: '📊', label: '指标' },
+  { to: '/settings', icon: '⚙️', label: '设置' },
+]
 </script>
 
 <style>
-* { box-sizing: border-box; margin: 0; padding: 0; }
-
-html, body, #app {
-  height: 100%;
-  font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
-  font-size: 14px;
-  color: #111;
-  background: #fff;
-}
-
 .app {
   display: flex;
-  flex-direction: column;
   height: 100%;
 }
 
-.topbar {
-  display: flex;
-  align-items: center;
-  gap: 24px;
-  padding: 0 24px;
-  height: 52px;
-  border-bottom: 1px solid #e5e7eb;
-  background: #fff;
+/* ---------- 侧边栏（dsh：specific-sidebar-fill 近白） ---------- */
+.side {
+  width: 208px;
   flex-shrink: 0;
+  display: flex;
+  flex-direction: column;
+  background: var(--c-side-bg);
+  border-right: 1px solid var(--c-side-border);
+  color: var(--c-side-text);
+  padding: 18px 12px 14px;
+  user-select: none;
 }
 
 .brand {
-  font-size: 16px;
-  font-weight: 700;
-  color: #1e40af;
-  white-space: nowrap;
-}
-
-.nav-links {
   display: flex;
-  gap: 4px;
+  align-items: center;
+  gap: 10px;
+  padding: 4px 8px 16px;
+  margin-bottom: 12px;
 }
+.brand-logo {
+  width: 38px;
+  height: 38px;
+  display: grid;
+  place-items: center;
+  font-size: 20px;
+  background: linear-gradient(135deg, var(--ds-blue-400), var(--ds-blue-500));
+  border-radius: 11px;
+  box-shadow: 0 3px 10px rgba(65, 118, 230, 0.35);
+}
+.brand-text { display: flex; flex-direction: column; line-height: 1.3; }
+.brand-text b { color: var(--c-text); font-size: 15px; letter-spacing: 0.5px; }
+.brand-text span { font-size: 11px; color: var(--c-caption); }
 
-.nav-links a {
-  padding: 6px 14px;
-  border-radius: 6px;
+.nav { display: flex; flex-direction: column; gap: 2px; flex: 1; }
+
+.nav-item {
+  display: flex;
+  align-items: center;
+  gap: 11px;
+  padding: 8px 10px;
+  border-radius: 9px;
   text-decoration: none;
-  color: #374151;
-  font-size: 14px;
+  color: var(--c-side-text);
+  font-size: 13.5px;
   font-weight: 500;
-  transition: background 0.15s;
+  position: relative;
+  transition: background 0.15s var(--ds-ease), color 0.15s var(--ds-ease);
 }
-.nav-links a:hover { background: #f3f4f6; }
-.nav-links a.router-link-active {
-  background: #eff6ff;
-  color: #2563eb;
+.nav-item:hover { background: var(--c-side-hover); color: var(--c-text); }
+.nav-item.router-link-active {
+  background: var(--c-side-active);
+  color: var(--c-side-text-active);
+  font-weight: 600;
+}
+.nav-item.router-link-active::before {
+  content: '';
+  position: absolute;
+  left: -12px;
+  top: 7px;
+  bottom: 7px;
+  width: 3px;
+  border-radius: 0 3px 3px 0;
+  background: var(--c-accent);
+}
+.nav-icon {
+  width: 26px;
+  height: 26px;
+  display: grid;
+  place-items: center;
+  font-size: 15px;
+  background: var(--c-hover);
+  border-radius: 7px;
+}
+.nav-item.router-link-active .nav-icon { background: var(--c-primary-soft); }
+
+.side-foot {
+  display: flex;
+  align-items: center;
+  gap: 7px;
+  padding: 12px 8px 2px;
+  font-size: 11px;
+  color: var(--c-caption);
+}
+.foot-dot {
+  width: 7px;
+  height: 7px;
+  border-radius: 50%;
+  background: var(--c-ok);
+  box-shadow: 0 0 6px rgba(34, 197, 94, 0.6);
 }
 
+/* ---------- 内容区 ---------- */
+.main-col {
+  flex: 1;
+  min-width: 0;
+  height: 100%;
+  display: flex;
+  flex-direction: column;
+  background: var(--c-surface);
+}
 .content {
   flex: 1;
-  overflow: hidden;   /* 限制自己高度，不被子内容撑开 */
+  overflow: hidden;
   display: flex;
   flex-direction: column;
   min-height: 0;

webapp/src/api/index.ts

@@ -95,6 +95,8 @@ export interface ModelSettings {
     model: string
     base_url: string
     api_key: string
+    /** 服务端打码标志：true 表示已存 key（返回值只含前 6 位，保存时留空即保留） */
+    api_key_set?: boolean
   }
   pipeline: {
     fast_path: boolean
@@ -312,6 +314,7 @@ export async function listPoolModels(id: string) {
 
 export interface AgentEvent {
   type: 'round' | 'tool_call' | 'tool_result' | 'usage' | 'final' | 'phase' | 'message'
+    | 'approval_request' | 'approval_decided' | 'delta'
   ts?: number
   round?: number
   name?: string
@@ -328,6 +331,19 @@ export interface AgentEvent {
   model?: string
   role?: 'planner' | 'executor'
   content?: string
+  // 审批（D9）/ 流式（D10）
+  id?: string
+  policy?: string
+  allowed?: boolean
+  note?: string
+  text?: string
+}
+
+/** POST /agent/{id}/approve：裁决待审批操作（dsh 式 allow-once / deny） */
+export async function approveAgent(requestId: string, approvalId: string, allowed: boolean) {
+  const { data } = await http.post<{ ok: boolean }>(`/agent/${requestId}/approve`,
+    { approval_id: approvalId, allowed })
+  return data
 }
 
 export interface AgentStatus {
@@ -345,18 +361,94 @@ export interface AgentStatus {
   workspace?: string
   executor_model?: string
   mode?: 'single' | 'dual'
+  tool_calls?: number
 }
 
-/** POST /agent：提交智能体任务（executorPoolId 可选：两级模式的执行者/本地小模型） */
-export async function startAgent(task: string, poolId?: string, workspace?: string, executorPoolId?: string) {
+/** POST /agent：提交智能体任务（sessionId 可选：会话式多轮） */
+export async function startAgent(
+  task: string, poolId?: string, workspace?: string,
+  executorPoolId?: string, sessionId?: string,
+) {
   const { data } = await http.post<{
     request_id: string; status: string; model: string
     workspace?: string; mode?: 'single' | 'dual'; executor_model?: string
+    session_id?: string | null
   }>('/agent', {
     task,
     pool_id: poolId || undefined,
     workspace: workspace || undefined,
     executor_pool_id: executorPoolId || undefined,
+    session_id: sessionId || undefined,
+  })
+  return data
+}
+
+/** POST /agent/{id}/cancel：停止运行中的智能体任务 */
+export async function cancelAgent(requestId: string) {
+  const { data } = await http.post<{ ok: boolean; detail?: string }>(
+    `/agent/${requestId}/cancel`)
+  return data
+}
+
+// ── 智能体会话（dsh 式多轮） ─────────────────────────────────────────────────
+
+export interface AgentSessionBrief {
+  id: string
+  title: string
+  workspace?: string
+  created_at?: number
+  updated_at?: number
+  busy?: boolean
+  pool_id?: string
+  executor_pool_id?: string
+  turns: number | unknown[]
+}
+
+export interface AgentSessionDetail extends AgentSessionBrief {
+  turns: {
+    request_id: string
+    task: string
+    response: string
+    state: string
+    tool_calls: number
+    tokens: number
+    error?: string | null
+    ts?: number
+  }[]
+}
+
+/** POST /agent/sessions：创建会话 */
+export async function createAgentSession(workspace?: string, executorPoolId?: string, title?: string) {
+  const { data } = await http.post<AgentSessionDetail>('/agent/sessions', {
+    title: title || undefined,
+    workspace: workspace || undefined,
+    executor_pool_id: executorPoolId || undefined,
+  })
+  return data
+}
+
+/** GET /agent/sessions：会话列表 */
+export async function listAgentSessions() {
+  const { data } = await http.get<AgentSessionBrief[]>('/agent/sessions')
+  return data
+}
+
+/** GET /agent/sessions/{sid}：会话详情（含轮次） */
+export async function getAgentSession(sid: string) {
+  const { data } = await http.get<AgentSessionDetail>(`/agent/sessions/${sid}`)
+  return data
+}
+
+/** DELETE /agent/sessions/{sid}：删除会话 */
+export async function deleteAgentSession(sid: string) {
+  const { data } = await http.delete<{ ok: boolean }>(`/agent/sessions/${sid}`)
+  return data
+}
+
+/** PATCH /agent/sessions/{sid}：重命名会话 */
+export async function renameAgentSession(sid: string, title: string) {
+  const { data } = await http.patch<AgentSessionDetail>(`/agent/sessions/${sid}`, {
+    title,
   })
   return data
 }

webapp/src/main.ts

@@ -2,6 +2,7 @@ import { createApp } from 'vue'
 import { createPinia } from 'pinia'
 import App from './App.vue'
 import router from './router'
+import './style.css'
 
 const app = createApp(App)
 app.use(createPinia())

webapp/src/style.css

@@ -1,296 +1,145 @@
+/* ============================================================
+   端云协同 LLM 系统 · 全局设计令牌与基础样式
+   配色体系对齐 deepseek-harness Web（design-platform.css）：
+   近白侧栏 + 纯白表面 + 极淡透明描边 + 近黑文字 + DeepSeek 品牌蓝
+   ============================================================ */
+
 :root {
-  --text: #6b6375;
-  --text-h: #08060d;
-  --bg: #fff;
-  --border: #e5e4e7;
-  --code-bg: #f4f3ec;
-  --accent: #aa3bff;
-  --accent-bg: rgba(170, 59, 255, 0.1);
-  --accent-border: rgba(170, 59, 255, 0.5);
-  --social-bg: rgba(244, 243, 236, 0.5);
-  --shadow:
-    rgba(0, 0, 0, 0.1) 0 10px 15px -3px, rgba(0, 0, 0, 0.05) 0 4px 6px -2px;
+  /* —— DeepSeek 色板（取自 dsw-static-*）—— */
+  --ds-blue-50: #edf3fe;        /* rgb(237,243,254) */
+  --ds-blue-100: #e4edfd;       /* rgb(228,237,253) */
+  --ds-blue-300: #b7c8fe;       /* rgb(183,200,254) */
+  --ds-blue-400: #6786fe;       /* rgb(103,158,254) */
+  --ds-blue-500: #4176e6;       /* rgb(65,118,230)  品牌主色 */
+  --ds-neutral-bluish-00: #ffffff;
+  --ds-neutral-bluish-50: #f9fafb;
+  --ds-neutral-bluish-60: #f5f6f7;
+  --ds-neutral-bluish-75: #f1f3f5;
+  --ds-neutral-bluish-100: #ebeef2;
+  --ds-neutral-bluish-200: #e1e5ee;
+  --ds-neutral-bluish-400: #adb2b8;
+  --ds-neutral-bluish-600: #818588;
+  --ds-neutral-bluish-700: #61666b;
+  --ds-neutral-bluish-1000: #0f1115;
 
-  --sans: system-ui, 'Segoe UI', Roboto, sans-serif;
-  --heading: system-ui, 'Segoe UI', Roboto, sans-serif;
-  --mono: ui-monospace, Consolas, monospace;
+  /* —— 语义令牌（各视图使用）—— */
+  --c-bg: var(--ds-neutral-bluish-60);          /* 页面底（模块平台灰） */
+  --c-surface: #ffffff;                          /* 卡片/面板 */
+  --c-border: rgba(16, 20, 26, 0.1);            /* border-l2 */
+  --c-border-soft: rgba(16, 20, 26, 0.05);      /* border-l1 */
 
-  font: 18px/145% var(--sans);
-  letter-spacing: 0.18px;
-  color-scheme: light dark;
-  color: var(--text);
-  background: var(--bg);
-  font-synthesis: none;
-  text-rendering: optimizeLegibility;
+  --c-text: var(--ds-neutral-bluish-1000);
+  --c-text-2: var(--ds-neutral-bluish-700);
+  --c-text-3: var(--ds-neutral-bluish-600);
+  --c-caption: var(--ds-neutral-bluish-400);
+
+  --c-primary: var(--ds-blue-500);
+  --c-primary-strong: var(--ds-blue-400);       /* 悬停（dsh：变亮） */
+  --c-primary-soft: var(--ds-blue-50);
+  --c-primary-tint: var(--ds-blue-100);
+  --c-primary-ring: rgba(65, 118, 230, 0.2);
+
+  --c-hover: rgba(38, 49, 72, 0.06);            /* dsh 交互悬停 */
+
+  --c-ok: #22c55e;
+  --c-ok-soft: #e6faed;
+  --c-warn: #dd8629;
+  --c-warn-soft: #fef5e7;
+  --c-err: #ec1313;
+  --c-err-soft: #fef2f2;
+
+  /* —— 侧边栏（近白，dsh sidebar-fill）—— */
+  --c-side-bg: var(--ds-neutral-bluish-50);
+  --c-side-text: var(--ds-neutral-bluish-700);
+  --c-side-text-active: var(--ds-neutral-bluish-1000);
+  --c-side-active: var(--ds-neutral-bluish-100);
+  --c-side-hover: var(--ds-neutral-bluish-75);
+  --c-side-border: var(--c-border-soft);
+  --c-accent: var(--ds-blue-500);
+
+  /* —— 形状与影（dsh：扁平，描边负责层次）—— */
+  --radius: 10px;
+  --radius-sm: 7px;
+  --shadow-card: 0 1px 2px rgba(16, 24, 40, 0.03);
+  --shadow-pop: 0 8px 30px rgba(16, 24, 40, 0.12);
+
+  --font-mono: 'SF Mono', 'JetBrains Mono', 'Fira Code', Consolas,
+    'Liberation Mono', Menlo, Courier, 'PingFang SC', 'Microsoft YaHei', monospace;
+
+  --ds-ease: cubic-bezier(0.4, 0, 0.2, 1);
+}
+
+* { box-sizing: border-box; margin: 0; padding: 0; }
+
+html, body, #app {
+  height: 100%;
+  font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', 'PingFang SC',
+    'Hiragino Sans GB', 'Microsoft YaHei', Roboto, sans-serif;
+  font-size: 14px;
+  color: var(--c-text);
+  background: var(--c-bg);
   -webkit-font-smoothing: antialiased;
-  -moz-osx-font-smoothing: grayscale;
-
-  @media (max-width: 1024px) {
-    font-size: 16px;
-  }
 }
 
-@media (prefers-color-scheme: dark) {
-  :root {
-    --text: #9ca3af;
-    --text-h: #f3f4f6;
-    --bg: #16171d;
-    --border: #2e303a;
-    --code-bg: #1f2028;
-    --accent: #c084fc;
-    --accent-bg: rgba(192, 132, 252, 0.15);
-    --accent-border: rgba(192, 132, 252, 0.5);
-    --social-bg: rgba(47, 48, 58, 0.5);
-    --shadow:
-      rgba(0, 0, 0, 0.4) 0 10px 15px -3px, rgba(0, 0, 0, 0.25) 0 4px 6px -2px;
-  }
-
-  #social .button-icon {
-    filter: invert(1) brightness(2);
-  }
-}
-
-body {
-  margin: 0;
-}
-
-h1,
-h2 {
-  font-family: var(--heading);
-  font-weight: 500;
-  color: var(--text-h);
-}
-
-h1 {
-  font-size: 56px;
-  letter-spacing: -1.68px;
-  margin: 32px 0;
-  @media (max-width: 1024px) {
-    font-size: 36px;
-    margin: 20px 0;
-  }
-}
-h2 {
-  font-size: 24px;
-  line-height: 118%;
-  letter-spacing: -0.24px;
-  margin: 0 0 8px;
-  @media (max-width: 1024px) {
-    font-size: 20px;
-  }
-}
-p {
-  margin: 0;
-}
-
-code,
-.counter {
-  font-family: var(--mono);
-  display: inline-flex;
-  border-radius: 4px;
-  color: var(--text-h);
-}
-
-code {
-  font-size: 15px;
-  line-height: 135%;
-  padding: 4px 8px;
-  background: var(--code-bg);
-}
-
-.counter {
-  font-size: 16px;
-  padding: 5px 10px;
-  border-radius: 5px;
-  color: var(--accent);
-  background: var(--accent-bg);
+/* ---------- 统一滚动条（dsh：neutral-200 圆头） ---------- */
+::-webkit-scrollbar { width: 9px; height: 9px; }
+::-webkit-scrollbar-thumb {
+  background: #e5e5e5;
+  border-radius: 8px;
   border: 2px solid transparent;
-  transition: border-color 0.3s;
-  margin-bottom: 24px;
+  background-clip: content-box;
+}
+::-webkit-scrollbar-thumb:hover { background-color: #d4d4d4; }
+::-webkit-scrollbar-track { background: transparent; }
 
-  &:hover {
-    border-color: var(--accent-border);
-  }
-  &:focus-visible {
-    outline: 2px solid var(--accent);
-    outline-offset: 2px;
-  }
+/* ---------- 基础元素统一 ---------- */
+button, input, select, textarea { font-family: inherit; color: inherit; }
+
+h2 { font-size: 19px; font-weight: 700; letter-spacing: 0.2px; color: var(--c-text); }
+
+a { color: var(--c-primary); }
+
+code, pre { font-family: var(--font-mono); }
+
+/* 焦点环统一 */
+input:focus-visible, select:focus-visible, textarea:focus-visible, button:focus-visible {
+  outline: none;
+  box-shadow: 0 0 0 3px var(--c-primary-ring);
 }
 
-.hero {
-  position: relative;
-
-  .base,
-  .framework,
-  .vite {
-    inset-inline: 0;
-    margin: 0 auto;
-  }
-
-  .base {
-    width: 170px;
-    position: relative;
-    z-index: 0;
-  }
-
-  .framework,
-  .vite {
-    position: absolute;
-  }
-
-  .framework {
-    z-index: 1;
-    top: 34px;
-    height: 28px;
-    transform: perspective(2000px) rotateZ(300deg) rotateX(44deg) rotateY(39deg)
-      scale(1.4);
-  }
-
-  .vite {
-    z-index: 0;
-    top: 107px;
-    height: 26px;
-    width: auto;
-    transform: perspective(2000px) rotateZ(300deg) rotateX(40deg) rotateY(39deg)
-      scale(0.8);
-  }
+/* ---------- 通用卡片质感（供各页复用） ---------- */
+.surface {
+  background: var(--c-surface);
+  border: 1px solid var(--c-border-soft);
+  border-radius: var(--radius);
+  box-shadow: var(--shadow-card);
 }
 
-#app {
-  width: 1126px;
-  max-width: 100%;
-  margin: 0 auto;
-  text-align: center;
-  border-inline: 1px solid var(--border);
-  min-height: 100svh;
-  display: flex;
-  flex-direction: column;
-  box-sizing: border-box;
+/* 各页卡片统一描边与阴影（配合各自 scoped 样式） */
+.settings-section,
+.metric-card,
+.ev-card {
+  box-shadow: var(--shadow-card);
+  border-radius: var(--radius);
 }
 
-#center {
-  display: flex;
-  flex-direction: column;
-  gap: 25px;
-  place-content: center;
-  place-items: center;
-  flex-grow: 1;
-
-  @media (max-width: 1024px) {
-    padding: 32px 20px 24px;
-    gap: 18px;
-  }
-}
-
-#next-steps {
-  display: flex;
-  border-top: 1px solid var(--border);
-  text-align: left;
-
-  & > div {
-    flex: 1 1 0;
-    padding: 32px;
-    @media (max-width: 1024px) {
-      padding: 24px 20px;
-    }
-  }
-
-  .icon {
-    margin-bottom: 16px;
-    width: 22px;
-    height: 22px;
-  }
-
-  @media (max-width: 1024px) {
-    flex-direction: column;
-    text-align: center;
-  }
-}
-
-#docs {
-  border-right: 1px solid var(--border);
-
-  @media (max-width: 1024px) {
-    border-right: none;
-    border-bottom: 1px solid var(--border);
-  }
-}
-
-#next-steps ul {
-  list-style: none;
-  padding: 0;
+/* 页面通用头 */
+.page-head h2 {
   display: flex;
+  align-items: center;
   gap: 8px;
-  margin: 32px 0 0;
+}
+.page-head .sub { margin-top: 3px; }
 
-  .logo {
-    height: 18px;
-  }
+.mono { font-family: var(--font-mono); }
 
-  a {
-    color: var(--text-h);
-    font-size: 16px;
-    border-radius: 6px;
-    background: var(--social-bg);
-    display: flex;
-    padding: 6px 12px;
-    align-items: center;
-    gap: 8px;
-    text-decoration: none;
-    transition: box-shadow 0.3s;
-
-    &:hover {
-      box-shadow: var(--shadow);
-    }
-    .button-icon {
-      height: 18px;
-      width: 18px;
-    }
-  }
-
-  @media (max-width: 1024px) {
-    margin-top: 20px;
-    flex-wrap: wrap;
-    justify-content: center;
-
-    li {
-      flex: 1 1 calc(50% - 8px);
-    }
-
-    a {
-      width: 100%;
-      justify-content: center;
-      box-sizing: border-box;
-    }
+/* 平滑出现（dsh 缓动曲线） */
+@media (prefers-reduced-motion: no-preference) {
+  .ev-card, .metric-card, .settings-section {
+    animation: fade-up 0.2s var(--ds-ease) both;
   }
 }
-
-#spacer {
-  height: 88px;
-  border-top: 1px solid var(--border);
-  @media (max-width: 1024px) {
-    height: 48px;
-  }
-}
-
-.ticks {
-  position: relative;
-  width: 100%;
-
-  &::before,
-  &::after {
-    content: '';
-    position: absolute;
-    top: -4.5px;
-    border: 5px solid transparent;
-  }
-
-  &::before {
-    left: 0;
-    border-left-color: var(--border);
-  }
-  &::after {
-    right: 0;
-    border-right-color: var(--border);
-  }
+@keyframes fade-up {
+  from { opacity: 0; transform: translateY(4px); }
+  to { opacity: 1; transform: translateY(0); }
 }

webapp/src/views/ChatView.vue

@@ -178,7 +178,7 @@ async function handleSend() {
 .sidebar {
   width: 240px;
   border-right: 1px solid #e5e7eb;
-  background: #f9fafb;
+  background: var(--c-bg);
   display: flex;
   flex-direction: column;
   overflow: hidden;
@@ -208,12 +208,12 @@ async function handleSend() {
   font-size: 13px;
 }
 .session-item:hover { background: #e5e7eb; }
-.session-item.active { background: #dbeafe; }
+.session-item.active { background: var(--c-primary-tint); }
 .s-query { color: #111; }
 .s-status { font-size: 11px; color: #9ca3af; }
 .s-status.done { color: #16a34a; }
 .s-status.failed { color: #dc2626; }
-.s-status.running { color: #2563eb; }
+.s-status.running { color: var(--c-primary); }
 
 .main {
   flex: 1;
@@ -244,7 +244,7 @@ async function handleSend() {
   font-size: 14px;
   line-height: 1.6;
 }
-.assistant-msg { background: #eff6ff; }
+.assistant-msg { background: var(--c-primary-soft); }
 .role-label {
   font-weight: 700;
   font-size: 12px;
@@ -270,7 +270,7 @@ async function handleSend() {
   font-weight: 600;
 }
 .badge.pending { background: #f3f4f6; color: #6b7280; }
-.badge.running { background: #dbeafe; color: #2563eb; }
+.badge.running { background: var(--c-primary-tint); color: var(--c-primary); }
 .badge.done { background: #dcfce7; color: #16a34a; }
 .badge.failed { background: #fee2e2; color: #dc2626; }
 .route-path { font-size: 12px; color: #9ca3af; }
@@ -305,7 +305,7 @@ async function handleSend() {
 .deps { color: #9ca3af; font-size: 12px; }
 .done { color: #16a34a; }
 .pending { color: #9ca3af; }
-.running { color: #2563eb; }
+.running { color: var(--c-primary); }
 
 .error-msg { color: #dc2626; font-size: 13px; background: #fee2e2; padding: 8px 12px; border-radius: 6px; }
 
@@ -324,10 +324,10 @@ async function handleSend() {
   font-size: 14px;
   outline: none;
 }
-.input-bar input:focus { border-color: #2563eb; }
+.input-bar input:focus { border-color: var(--c-primary); }
 .input-bar button {
   padding: 10px 20px;
-  background: #2563eb;
+  background: var(--c-primary);
   color: #fff;
   border: none;
   border-radius: 8px;

webapp/src/views/CollaborationView.vue

@@ -245,7 +245,7 @@ function getDecision(issueId: string) {
 .collab-sidebar {
   width: 260px;
   border-right: 1px solid #e5e7eb;
-  background: #f9fafb;
+  background: var(--c-bg);
   display: flex;
   flex-direction: column;
   overflow: hidden;
@@ -276,7 +276,7 @@ function getDecision(issueId: string) {
   font-size: 13px;
 }
 .session-item:hover { background: #e5e7eb; }
-.session-item.active { background: #dbeafe; }
+.session-item.active { background: var(--c-primary-tint); }
 .meta { font-size: 11px; color: #9ca3af; }
 
 .stats {
@@ -331,18 +331,18 @@ function getDecision(issueId: string) {
   color: #111;
   margin: 0 0 12px;
   padding-bottom: 6px;
-  border-bottom: 2px solid #2563eb;
+  border-bottom: 2px solid var(--c-primary);
 }
 
 .brief-card {
-  background: #eff6ff;
-  border: 1px solid #bfdbfe;
+  background: var(--c-primary-soft);
+  border: 1px solid var(--c-primary-tint);
   border-radius: 8px;
   padding: 14px 16px;
 }
 .goal { font-size: 14px; margin-bottom: 8px; color: #1e40af; font-weight: 600; }
 .tags { display: flex; gap: 6px; flex-wrap: wrap; }
-.tag { background: #dbeafe; color: #1d4ed8; padding: 2px 8px; border-radius: 99px; font-size: 12px; }
+.tag { background: var(--c-primary-tint); color: var(--c-primary-strong); padding: 2px 8px; border-radius: 99px; font-size: 12px; }
 .domain { background: #fce7f3; color: #9d174d; padding: 2px 8px; border-radius: 99px; font-size: 12px; }
 .constraints { list-style: disc inside; font-size: 13px; color: #374151; margin-top: 8px; }
 
@@ -375,14 +375,14 @@ function getDecision(issueId: string) {
   z-index: 1;
 }
 .plan-step.done .step-dot { background: #16a34a; border-color: #16a34a; }
-.plan-step.running .step-dot { background: #2563eb; border-color: #2563eb; }
+.plan-step.running .step-dot { background: var(--c-primary); border-color: var(--c-primary); }
 .plan-step.pending .step-dot { background: #fff; }
 .step-content { flex: 1; }
 .step-header { display: flex; align-items: center; gap: 8px; margin-bottom: 4px; }
 .step-id { font-family: monospace; font-size: 12px; color: #6b7280; font-weight: 700; }
 .step-status { font-size: 11px; padding: 1px 6px; border-radius: 99px; }
 .plan-step.done .step-status { background: #dcfce7; color: #16a34a; }
-.plan-step.running .step-status { background: #dbeafe; color: #2563eb; }
+.plan-step.running .step-status { background: var(--c-primary-tint); color: var(--c-primary); }
 .plan-step.pending .step-status { background: #f3f4f6; color: #9ca3af; }
 .step-task { margin: 0; font-size: 13px; color: #374151; }
 .step-deps { font-size: 11px; color: #9ca3af; margin-top: 2px; }
@@ -396,7 +396,7 @@ function getDecision(issueId: string) {
 .progress-bar-wrap { margin-bottom: 10px; }
 .progress-label { font-size: 12px; color: #6b7280; margin-bottom: 4px; }
 .progress-bar { height: 6px; background: #e5e7eb; border-radius: 99px; overflow: hidden; }
-.progress-fill { height: 100%; background: #2563eb; border-radius: 99px; transition: width 0.4s ease; }
+.progress-fill { height: 100%; background: var(--c-primary); border-radius: 99px; transition: width 0.4s ease; }
 .progress-steps { display: flex; flex-wrap: wrap; gap: 8px; }
 .pg-step {
   display: flex;
@@ -408,7 +408,7 @@ function getDecision(issueId: string) {
   border: 1px solid #e5e7eb;
 }
 .pg-step.done { background: #dcfce7; border-color: #bbf7d0; }
-.pg-step.running { background: #dbeafe; border-color: #bfdbfe; }
+.pg-step.running { background: var(--c-primary-tint); border-color: var(--c-primary-tint); }
 .pg-note { color: #9ca3af; font-size: 11px; }
 
 /* Issues */
@@ -424,8 +424,8 @@ function getDecision(issueId: string) {
 .issue-step { font-size: 11px; color: #6b7280; }
 .decision {
   margin-top: 8px;
-  background: #eff6ff;
-  border: 1px solid #bfdbfe;
+  background: var(--c-primary-soft);
+  border: 1px solid var(--c-primary-tint);
   border-radius: 4px;
   padding: 6px 10px;
   font-size: 13px;

webapp/src/views/MetricsView.vue

@@ -165,7 +165,7 @@ onMounted(load)
   border-radius: 10px;
   padding: 16px;
 }
-.metric-card.highlight { border-color: #2563eb; background: #eff6ff; }
+.metric-card.highlight { border-color: var(--c-primary); background: var(--c-primary-soft); }
 .metric-card h3 { margin: 0 0 12px; font-size: 14px; color: #374151; }
 
 .kv-list {
@@ -180,7 +180,7 @@ onMounted(load)
 .review-card { grid-column: span 2; }
 .review-stats { display: flex; gap: 24px; margin-bottom: 12px; }
 .stat-item { display: flex; flex-direction: column; align-items: center; }
-.stat-num { font-size: 28px; font-weight: 700; color: #2563eb; }
+.stat-num { font-size: 28px; font-weight: 700; color: var(--c-primary); }
 .stat-label { font-size: 12px; color: #6b7280; }
 
 .progress-wrap {
@@ -194,7 +194,7 @@ onMounted(load)
 .review-rate { font-size: 13px; color: #6b7280; margin: 0; }
 
 .raw-json {
-  background: #f9fafb;
+  background: var(--c-bg);
   border: 1px solid #e5e7eb;
   border-radius: 8px;
 }

webapp/src/views/ReviewView.vue

@@ -116,7 +116,7 @@ button {
   cursor: pointer;
   font-size: 13px;
 }
-button.active { background: #2563eb; color: #fff; border-color: #2563eb; }
+button.active { background: var(--c-primary); color: #fff; border-color: var(--c-primary); }
 .refresh-btn { margin-left: auto; }
 
 .loading, .error, .empty {
@@ -162,7 +162,7 @@ button.active { background: #2563eb; color: #fff; border-color: #2563eb; }
 }
 .query-block pre, .response-block pre {
   margin: 4px 0 0;
-  background: #f9fafb;
+  background: var(--c-bg);
   border: 1px solid #e5e7eb;
   border-radius: 4px;
   padding: 6px 10px;

webapp/src/views/SettingsView.vue

@@ -331,9 +331,10 @@
 
           <!-- API Key -->
           <div class="field full-width">
-            <label>API Key（保存在本地 config/settings.json，不入代码库；优先级高于 .env）</label>
+            <label>API Key{{ form.architect.api_key_set ? '（已设置，留空保留）' : '（保存在本地 config/settings.json，不入代码库；优先级高于 .env）' }}</label>
             <input v-model="form.architect.api_key" type="password"
-              placeholder="sk-xxxxxxxxxxxxxxxx" autocomplete="off" />
+              :placeholder="form.architect.api_key_set ? '已设置，留空保留原值' : 'sk-xxxxxxxxxxxxxxxx'"
+              autocomplete="off" />
           </div>
 
           <!-- 模型选择 -->
@@ -867,6 +868,15 @@ function _safeAssign(target: any, source: any) {
   }
 }
 
+/** architect 段专用填充：api_key 服务端打码返回，已设置时清空输入框（留空=保留）。 */
+function _applyArchitect(arch: any) {
+  if (!arch) return
+  const { api_key, api_key_set, ...rest } = arch
+  _safeAssign(form.architect, rest)
+  form.architect.api_key_set = Boolean(api_key_set)
+  form.architect.api_key = ''   // 不把打码值带回表单，防止保存时覆盖真值
+}
+
 async function load() {
   loadError.value = ''
   try {
@@ -880,7 +890,7 @@ async function load() {
 
     // 安全填充表单（防止 API 返回 null 导致响应式丢失）
     if (cfg.worker) _safeAssign(form.worker, cfg.worker)
-    if (cfg.architect) _safeAssign(form.architect, cfg.architect)
+    if (cfg.architect) _applyArchitect(cfg.architect)
     if (cfg.pipeline) _safeAssign(form.pipeline, cfg.pipeline)
 
     // 保存原始快照
@@ -914,9 +924,9 @@ async function save() {
     // 空 api_key 不传给后端，保留服务端已有值
     if (!patch.architect.api_key) delete patch.architect.api_key
     const merged = await updateConfig(patch)
-    // 用安全方式更新（保留响应式）
+    // 用安全方式更新（保留响应式）；architect 段走打码适配
     _safeAssign(form.worker, merged.worker || {})
-    _safeAssign(form.architect, merged.architect || {})
+    _applyArchitect(merged.architect || {})
     _safeAssign(form.pipeline, merged.pipeline || {})
     original.value = JSON.parse(JSON.stringify(form))
     saveMsg.value = { ok: true, msg: '✅ 设置已保存，管线已重建' }
@@ -935,7 +945,7 @@ async function reset() {
   try {
     const merged = await resetConfig()
     _safeAssign(form.worker, merged.worker || {})
-    _safeAssign(form.architect, merged.architect || {})
+    _applyArchitect(merged.architect || {})
     _safeAssign(form.pipeline, merged.pipeline || {})
     original.value = JSON.parse(JSON.stringify(form))
     workerModels.value = []
@@ -960,7 +970,7 @@ onUnmounted(() => { _dlSSE?.close() })
   height: 100%;
   overflow-y: auto;
   padding: 24px;
-  background: #f9fafb;
+  background: var(--c-bg);
   box-sizing: border-box;
   /* 覆盖 router-view 注入的 .content 的 display:flex：flex 列布局会把
      overflow:hidden 的子项压缩截断而非撑出滚动条，导致页面无法滚动 */
@@ -1063,7 +1073,7 @@ onUnmounted(() => { _dlSSE?.close() })
   justify-content: space-between;
   align-items: center;
   padding: 8px 12px;
-  background: #f9fafb;
+  background: var(--c-bg);
   border-bottom: 1px solid #f3f4f6;
   font-size: 13px;
   font-weight: 500;
@@ -1090,8 +1100,8 @@ onUnmounted(() => { _dlSSE?.close() })
   transition: background 0.1s;
 }
 .model-item:last-child { border-bottom: none; }
-.model-item:hover { background: #eff6ff; }
-.model-item.selected { background: #dbeafe; }
+.model-item:hover { background: var(--c-primary-soft); }
+.model-item.selected { background: var(--c-primary-tint); }
 .model-item-name { font-weight: 500; color: #1f2937; }
 .model-item-size { color: #9ca3af; font-size: 12px; }
 
@@ -1118,10 +1128,10 @@ onUnmounted(() => { _dlSSE?.close() })
   font-size: 13px;
   outline: none;
 }
-.download-input:focus { border-color: #2563eb; }
+.download-input:focus { border-color: var(--c-primary); }
 .btn-download {
   color: #fff;
-  background: #2563eb;
+  background: var(--c-primary);
   border: none;
   border-radius: 6px;
   padding: 7px 16px;
@@ -1129,12 +1139,12 @@ onUnmounted(() => { _dlSSE?.close() })
   cursor: pointer;
   min-width: 70px;
 }
-.btn-download:disabled { background: #93c5fd; cursor: not-allowed; }
+.btn-download:disabled { background: var(--c-primary-tint); cursor: not-allowed; }
 
 .progress-wrap { margin-top: 8px; }
 .progress-bar { background: #e5e7eb; border-radius: 3px; height: 6px; overflow: hidden; }
 .progress-fill {
-  background: linear-gradient(90deg, #2563eb, #3b82f6);
+  background: linear-gradient(90deg, var(--c-primary), #3b82f6);
   border-radius: 3px;
   height: 100%;
   transition: width 0.3s;
@@ -1177,8 +1187,8 @@ onUnmounted(() => { _dlSSE?.close() })
   color: #111827;
 }
 .field input:focus, .field select:focus {
-  border-color: #2563eb;
-  box-shadow: 0 0 0 2px #2563eb26;
+  border-color: var(--c-primary);
+  box-shadow: 0 0 0 2px var(--c-primary-ring);
 }
 
 .model-select {
@@ -1190,7 +1200,7 @@ onUnmounted(() => { _dlSSE?.close() })
   padding: 8px 12px;
   font-size: 14px;
 }
-.model-select:focus { border-color: #2563eb; outline: none; box-shadow: 0 0 0 3px #2563eb26; }
+.model-select:focus { border-color: var(--c-primary); outline: none; box-shadow: 0 0 0 3px var(--c-primary-ring); }
 
 .input-row {
   display: flex;
@@ -1242,7 +1252,7 @@ onUnmounted(() => { _dlSSE?.close() })
   font-weight: 600;
 }
 .tier-local { color: #166534; background: #dcfce7; }
-.tier-budget { color: #1e40af; background: #dbeafe; }
+.tier-budget { color: #1e40af; background: var(--c-primary-tint); }
 .tier-premium { color: #7c2d12; background: #ffedd5; }
 
 .pool-edit {
@@ -1273,7 +1283,7 @@ onUnmounted(() => { _dlSSE?.close() })
 .btn-inline { font-size: 12px; }
 
 .btn-ping {
-  background: #f9fafb;
+  background: var(--c-bg);
   border: 1px solid #d1d5db;
   border-radius: 6px;
   padding: 6px 10px;
@@ -1282,7 +1292,7 @@ onUnmounted(() => { _dlSSE?.close() })
   white-space: nowrap;
   transition: background 0.1s;
 }
-.btn-ping:hover:not(:disabled) { background: #eff6ff; }
+.btn-ping:hover:not(:disabled) { background: var(--c-primary-soft); }
 .btn-ping:disabled { opacity: 0.5; cursor: not-allowed; }
 
 .ping-badge { font-size: 12px; font-weight: 500; white-space: nowrap; }
@@ -1309,7 +1319,7 @@ onUnmounted(() => { _dlSSE?.close() })
 
 .btn-primary {
   color: #fff;
-  background: #2563eb;
+  background: var(--c-primary);
   border: none;
   border-radius: 7px;
   padding: 9px 20px;
@@ -1318,8 +1328,8 @@ onUnmounted(() => { _dlSSE?.close() })
   cursor: pointer;
   transition: background 0.15s;
 }
-.btn-primary:hover:not(:disabled) { background: #1d4ed8; }
-.btn-primary:disabled { background: #93c5fd; cursor: not-allowed; }
+.btn-primary:hover:not(:disabled) { background: var(--c-primary-strong); }
+.btn-primary:disabled { background: var(--c-primary-tint); cursor: not-allowed; }
 
 .btn-secondary {
   color: #374151;

webapp/任务拆解与执行计划.md

@@ -0,0 +1,2 @@
+| T28 | 操作审批流：approval_policy(off/dangerous/all) + 挂起/裁决/超时 + /approve + 审批卡 | ✅ 完成 | T28 |
+| T29 | token 级流式：SSE 解析/tool_calls 碎片组装/回退 + DeltaThrottle + 打字机渲染 | ✅ 完成 | T29 |

webapp/实现方案_v4_模型池与工具智能体.md

@@ -0,0 +1,13 @@
+
+## 9. 增补：审批流与流式输出（D9/D10，T28/T29）
+
+- **决策 D9（操作审批，对齐 dsh）**：`agent.approval_policy` = off | dangerous（默认：
+  写/编辑/命令询问，只读自动放行）| all；工具执行前经 approval_hook 挂起等待，
+  UI 两按钮（拒绝 / 允许一次），超时 `approval_timeout_s`（默认 120s）自动拒绝
+  （fail-closed）；拒绝结果回喂模型可改道；approval_request/decided 事件对入审计。
+- **决策 D10（token 级流式）**：OpenAICompatChat 默认 stream=True（SSE 逐段解析，
+  tool_calls 碎片按 index 组装、不在正文展示；include_usage 计量）；流式失败自动
+  回退非流式一次（已有部分增量输出时如实抛出）；ToolLoop 经 on_delta 转发，
+  DeltaThrottle ≥48 字符节流落 delta 事件；前端打字机式实时渲染 + 光标。
+- **配套修复**：Vue 响应式丢失 bug——闭包持有 push 前原始对象导致过程事件不渲染，
+  改取响应式代理对象。

任务拆解与执行计划.md

@@ -119,3 +119,9 @@ P0 完成后的能力：干净的后端抽象 + 可量化的评测 + 可追溯
 | T24 | 前端：工作区选择栏（目录浏览器/最近/shell 开关）+ edit diff 卡 + 命令卡 | ✅ 完成 | T24-T25 |
 | T25 | 集成验证：选定真实目录"读→精确编辑→运行验证"全链路 + 274 测试全绿 | ✅ 完成 | T24-T25 |
 | T26 | 两级智能体：规划者(大模型)拆解/审查 + 执行者(本地小模型)工具轮，handoff.json 交接，/agent 带 executor_pool_id | ✅ 完成 | T26 |
+| T27 | 会话式智能体：多轮上下文 + 会话持久化 + 停止按钮 + AgentView 对话式重构（dsh 范式） | ✅ 完成 | T27 |
+| T28 | 操作审批流：approval_policy(off/dangerous/all) + 挂起/裁决/超时 + /approve + 审批卡 | ✅ 完成 | T28 |
+| T29 | token 级流式：SSE 解析/tool_calls 碎片组装/回退 + DeltaThrottle + 打字机渲染 | ✅ 完成 | T29 |
+| T30 | 安全加固（Mimosa 深度扫描驱动，D11）：路径 ID 白名单/artifacts 与工件名关押/下载 dest 关押+协议白名单/config 密钥打码/Host 信任围栏+回环绑定/危险命令独立拦截/CSPRNG 抽样 | ✅ 完成 | T30 |
+| T31 | dsh 功能对齐（D12）：LLM 重试退避/web_fetch 工具（SSRF 防护）/原子写入/慢工具线程卸载/search 目录修剪/重复调用提醒/会话重命名 | ✅ 完成 | T31 |
+| OPT-1 | 分支推进：基线修复（补回 6 个未入库 v1 遗留模块）+ 安全加固（9 高危清零）+ 优化（语义缓存 2.37x、拓扑 O(V+E)、分类器确定性决胜） | ✅ 完成 | e9cfb29/3c68638 |

实现方案_v4_模型池与工具智能体.md

@@ -109,3 +109,71 @@
   ToolLoop 内层循环 `emit_final=False`，终态事件由外层编排统一发出（防前端 SSE 提前收口）。
 - **事件**：新增 `phase`（plan/execute/review，带模型名）与 `message`（planner/executor 正文）
   两类事件，前端以阶段徽标 + 双色消息卡渲染。
+
+## 8. 增补：会话式智能体（D8，T27）
+
+- **决策 D8（对齐 dsh 的会话范式）**：智能体从"一次性任务"升级为**多轮会话**——
+  `POST /agent/sessions` 建会话（绑定工作区/执行者配置），后续任务带 `session_id`
+  递交，既往轮次折叠为对话历史注入模型（近 6 轮，每条截断 1500 字）；
+  轮次（任务/答复/工具步数/token）持久化到 `agent_runs/sessions/{sid}.json`。
+- **停止**：`POST /agent/{id}/cancel` 取消运行中任务（asyncio cancel + 状态标记
+  cancelled_by_user）。
+- **前端**：AgentView 重构为 dsh 式对话界面——左侧会话列表、居中消息流
+  （用户蓝气泡 / 助手白卡）、底部 composer（工作区/执行者/命令开关收为 chips，
+  Enter 发送，运行中变红色停止钮）；工具过程折叠收纳，历史轮次仅显示步数摘要。
+- **工程**：ToolLoop 增 history 参数；工具步数统一在事件写入层统计；
+  会话存储测试隔离（防泄漏进真实 agent_runs/sessions/）。
+
+## 9. 增补：审批流与流式输出（D9/D10，T28/T29）
+
+- **决策 D9（操作审批，对齐 dsh）**：`agent.approval_policy` = off | dangerous（默认：
+  写/编辑/命令询问，只读自动放行）| all；工具执行前经 approval_hook 挂起等待，
+  UI 两按钮（拒绝 / 允许一次），超时 `approval_timeout_s`（默认 120s）自动拒绝
+  （fail-closed）；拒绝结果回喂模型可改道；approval_request/decided 事件对入审计。
+- **决策 D10（token 级流式）**：OpenAICompatChat 默认 stream=True（SSE 逐段解析，
+  tool_calls 碎片按 index 组装、不在正文展示；include_usage 计量）；流式失败自动
+  回退非流式一次（已有部分增量输出时如实抛出）；ToolLoop 经 on_delta 转发，
+  DeltaThrottle ≥48 字符节流落 delta 事件；前端打字机式实时渲染 + 光标。
+- **配套修复**：Vue 响应式丢失 bug——闭包持有 push 前原始对象导致过程事件不渲染，
+  改取响应式代理对象。
+
+## 10. 增补：安全基线（D11，T30，Mimosa 深度扫描驱动）
+
+- **决策 D11（默认最小暴露面）**：
+  - **路径参数 ID 白名单**：`/runs|/agent|/agent/sessions` 的路径参数只允许
+    `[a-zA-Z0-9_-]{1,64}`（系统生成 ID 的字符集），非法一律 404——杀灭 Windows
+    反斜杠穿越变体（如 `/runs/x/artifacts/..%5C..%5C..%5C.env` 直读 .env）。
+  - **工件双重关押**：artifacts 端点解析后必须仍在 artifacts 目录内；pipeline
+    `_save_artifact`/`_read_artifact` 对模型输出的工件名消毒（剥路径成分）。
+  - **下载关押**：`/llama/download` 的 dest 解析后必须位于 models/ 内；URL 协议
+    白名单 http/https 在 HF 别名转换**之前**判定（防 file:/// 被拼成 HF 地址）。
+  - **密钥打码**：GET /config 的 architect.api_key 只回前 6 位 + api_key_set；
+    PUT 空串/缺省=保留原值（对齐 D2 池条目语义，前端"已设置，留空保留"）。
+  - **Web 信任围栏**：TrustedHostMiddleware 默认只信 localhost/127.0.0.1/[::1]
+    （GATEWAY_TRUSTED_HOSTS 可覆盖，"*"=放行全部），防 DNS rebinding 打到本网关；
+    api.py `__main__` 默认绑定 127.0.0.1（scripts/serve.py 本就如此）。
+  - **独立命令拦截**：run_command 危险模式黑名单（format / rd /s / rm -rf / /
+    shutdown / curl|sh 等）先于审批独立拦截；shell 经显式 `"%COMSPEC%" /c` /
+    `/bin/sh -c` 执行（语义同 shell=True，但解释器路径受控）。
+  - **CSPRNG**：review 抽样缺省随机源改 random.SystemRandom。
+
+## 11. 增补：dsh 功能对齐（D12，T31）
+
+- **决策 D12（对齐 deepseek-harness 的健壮性功能）**：
+  - **重试退避**：OpenAICompatChat 非流式路径（含流式失败回退）对传输错误/
+    408/429/5xx 指数退避重试（max_retries=2、retry_delay_s=1.0）；4xx 不重试。
+  - **web_fetch 工具**：抓公网 http/https 文本，dsh web_fetch 同款 SSRF 防护——
+    DNS 解析后拒绝私网/环回/链路本地/保留/NAT64 地址；512KB/15s/12k 字符上限、
+    二进制嗅探拒绝；受 `agent.allow_net` 开关（默认开），归入只读工具集。
+  - **原子写入**：write_file/edit_file 走同目录临时文件 + os.replace（Windows
+    EPERM 退避一次后降级直写），防崩溃留半截文件。
+  - **慢工具线程卸载**：run_command/web_fetch/search_files 在独立守护线程执行
+    （asyncio.sleep 轮询等完成——补丁版 TestClient 的每请求独立事件循环不推进
+    run_in_executor 桥接，轮询在生产/测试两端都可靠），快工具保持内联。
+  - **search 修剪**：os.walk 修剪依赖/构建目录（替代 rglob 全量物化），不跟随
+    符号链接目录，限量行为不变。
+  - **重复调用提醒**：同工具同参数第 3 次起在回喂结果附系统提示 + repeat_warning
+    事件（防模型原地打转，dsh repeat-tool-reminder 同款）。
+  - **会话重命名**：`PATCH /agent/sessions/{sid}` + 前端会话列表 ✎ 按钮。
+  - **D10 收尾修复**：_stream_partial 每次流式调用前复位（防上次成功置位导致
+    本次失败误抛而不回退）。

毕业设计_进度记录.md

@@ -134,3 +134,30 @@
   （备份/恢复），并向用户说明需重配 key。
 - **运维提醒**：网关用 taskkill /T 停止会连带杀掉其启动的 llama-server 子进程；
   重启网关后需在设置页重新启动 llama-server。
+
+### 5.6 增补（同日）：Web 界面视觉升级
+
+- 全局设计系统 `webapp/src/style.css`（设计令牌：色板/圆角/阴影/统一滚动条/焦点环），
+  main.ts 正式引入（原为未使用的脚手架残留）。
+- App.vue 重设计：顶部条 → 深色侧边栏壳（渐变 Logo、图标导航、激活态高亮条、网关状态脚注）。
+- 各页浅层打磨：页面背景令牌化、卡片统一阴影、浏览器标题/lang 修正（原为"webapp"/en）。
+- 功能零改动；构建产物同步。
+
+### 5.7 增补（同日）：配色体系对齐 deepseek-harness Web
+
+- 从 `deepseek-harness/packages/client/ui-theme/src/styles/design-platform.css` 提取
+  官方色板（dsw-static-*）：DeepSeek 品牌蓝 deepseek-500 rgb(65,118,230)、
+  bluish 中性灰阶、语义状态色，替换自拟配色。
+- 风格修正：深色侧栏 → dsh 式**近白侧栏**（sidebar-fill bluish-50 + 透明描边）；
+  扁平化阴影（描边负责层次）；交互悬停 rgba(38,49,72,.06)；滚动条 neutral-200 圆头。
+- 全部视图旧硬编码蓝（#2563eb 系）批量替换为设计令牌，视觉单一来源。
+
+### 5.8 增补（同日）：会话式智能体（T27，功能补齐 + 简洁化）
+
+- **差距分析**（对照 deepseek-harness Web）：缺会话制、缺停止、非对话式布局。
+- **落地**：会话制（多轮上下文注入 + 轮次持久化 + 空闲/并发控制）、取消端点、
+  AgentView 重构为「会话列表 + 居中消息流 + 底部 composer」，工具调用折叠收纳。
+- **实测**：本地 Qwen0.8B 全流程走通（会话自动创建/轮次记录/折叠时间轴/空响应提示）；
+  深度协作质量待用户重配 DeepSeek key 后验证。
+- **测试**：281 passed（新增 4：history 注入/会话多轮/置忙拒绝/取消）。
+- **教训**：测试资源隔离清单再+1（settings.json、sessions 目录、pool.json、runs/）。