从一条会话事件，到一段挂载的代码From a session event to a piece of mounted code

总览Overview

一、观察：把会话事件变成“摩擦”1. Observe: from session events to friction

插件订阅 DSH 的会话事件，先归一化成与版本无关的“观察”（一次工具调用及其结果、一条用户消息、一轮的开始和结束），再交给 16 个判断点。因为判断点读的是归一化后的数据，同一套判断既能跑在实时会话上，也能跑在磁盘上存着的历史会话上。The plugin subscribes to DSH's session events and first normalizes them into version-independent observations (a tool call with its result, a user message, the start and end of a turn), which 16 detectors then read. Because detectors read normalized data, the same detectors run on a live session and on a session stored on disk.

每个发现带一个签名，它去掉路径、行号、时间戳，只留下能认出“这是同一个坑”的事实，比如 bash:command-not-found:python。签名让一个麻烦可以跨会话计数。Every finding carries a signature. Paths, line numbers and timestamps are stripped, and what is left is the fact that identifies the same pothole, such as bash:command-not-found:python. A signature is what lets a trouble be counted across sessions.

二、决策：值不值得改，什么时候改2. Decide: whether to change, and when

一个发现不等于一个决定。触发策略把它和适配库里已有的东西放在一起权衡：A finding is not a decision. The trigger policy weighs it against what the library already knows:

大多数麻烦在下一步模型请求之前处理；“没验证就要收工”这一类在这一轮结束的边界上处理。Most trouble is answered before the next model request. Ending a turn on unverified edits is answered at the boundary where the turn would stop.

三、改写：让会话里的模型写 Harness 代码3. Rewrite: the session's model writes harness code

插件向会话当前的模型发一次单独的请求：一份适配 API 的说明，加上这次发现的证据（哪些调用、怎么失败的、用户说了什么）。模型回一段 JavaScript。这次请求不进入会话日志，记在适配库的审计记录里。The plugin sends one separate request to the session's current model: a description of the adaptation API plus the evidence of this finding (which calls, how they failed, what the user said). The model replies with a piece of JavaScript. The request stays out of the session log and is recorded in the library's audit trail.

被校验关打回的版本会连同原因一起发回去重写，默认最多两次。还是不行，就用内置模板生成一个保守的版本。A version the gate rejects is sent back together with the reasons, twice at most by default. If that fails too, a built-in template produces a conservative version.

四、校验与挂载4. Validate and mount

1. 静态Static

   长度上限；不许出现 require、import、process、eval、网络访问。A length limit; no require, import, process, eval or network access.

2. 加载Load

   能编译，调用了 define()，确实注册了东西，声明的能力都用到了。It compiles, calls define(), registers something, and uses every capability it declares.

3. 重演Replay

   把触发它的那几次调用回放给它，它必须有所动作。什么都不做的代码过不了这一关。The calls that triggered it are replayed to it, and it has to act. Code that does nothing stops here.

4. 回归Regression

   把本次会话里成功的调用回放给它，它不许拒绝、拦截或改写其中任何一个，也不许拦 command -v 这类查看环境的命令。The calls that succeeded in this session are replayed, and it must not refuse, block or rewrite any of them, nor commands that only inspect the environment, such as command -v.

5. 权限Permission

   用到改写结果、新增工具、执行命令这三种能力的，默认搁置，等人批准。An adaptation that rewrites results, adds a tool or runs commands is held for a person's approval by default.

通过之后，适配装进独立的 node:vm 上下文，和宿主之间只隔着一个传 JSON 字符串的桥，拿不到宿主对象。每次调用有同步和异步两重超时。它在下一次模型请求之前生效，同时告诉模型 Harness 刚刚改了什么。After the gate, the adaptation is mounted in its own node:vm context. Only a bridge that passes JSON strings connects it to the host, so it cannot reach host objects. Every call has a synchronous and an asynchronous timeout. It takes effect before the next model request, and the model is told what the harness just changed.

五、沉淀与共享5. Keep and share

每台机器有一个适配库（默认在 $DSH_HOME/rsi）：每个适配一个目录，带版本历史；ledger.jsonl 记每次摩擦、挂载、生效和出错，audit.jsonl 记系统做过的每个决定。Every machine has one library (in $DSH_HOME/rsi by default): one directory per adaptation with its version history; ledger.jsonl records every friction, mount, effect and fault, and audit.jsonl every decision the system took.

• 新适配是 candidate，在后来的会话里起过作用且没出过错，转为 active。A new adaptation is a candidate. Once it has acted in later sessions without faults it becomes active.
• 处理函数抛错不影响它所挂的那次工具调用。累计三次，上一版重新上岗；没有上一版就 quarantined。A handler that throws never affects the tool call it is attached to. After three faults the version before it goes back to work; with no earlier version it is quarantined.
• 核心指标是二次命中率：装上之前和之后，有多大比例的会话还会遇到这个麻烦。The central metric is the second-hit rate: the share of sessions that still meet the trouble, before and after the adaptation.
• 项目层的适配转正后写进 .dsh-rsi/adaptations/。别的机器认的是文件内容的哈希：dsh-rsi trust 之前不运行，文件变了要重新接受。A promoted project-layer adaptation is written to .dsh-rsi/adaptations/. Other machines go by the hash of a file's content: nothing runs before dsh-rsi trust, and a changed file has to be accepted again.

六、回退：坏了怎么办6. Going back: when a change is wrong

一个会改自己的 Harness，必须改得回去。能做到这一点，靠的是三条设计上的性质：Harness 自己的代码从不被改动，适配只是运行时挂上去的脚本；每个版本都留在磁盘上，编号不会用第二次；Harness 运行的东西每变一次，timeline.jsonl 里就多一行，记下改了什么、谁改的、以及改完之后的完整状态。A harness that changes itself has to be able to change back. Three properties of the design make that possible: the harness's own code is never touched, an adaptation being a script mounted at run time; every version stays on disk, and a version number is never used twice; and whenever what the harness runs changes, one line goes into timeline.jsonl with what changed, who changed it and the whole state it left behind.

Harness 自己撤回What the harness takes back by itself

放行试探只用于在本机、从失败的调用里学出来的适配：它们主张的是“这个调用在这里会失败”，这是一个可以用真实调用检验的事实。代表用户要求的拦截、来自项目 Harness 或导入包的拦截，绝不会被放行。被撤回的版本连同原因一起记下，下次模型为同一个原因写适配时会看到它错在哪，同一段代码不会被接受第二次。The check applies only to adaptations learned on this machine from a call that failed. What they claim, "this call fails here", is a fact that a real call can test. A refusal that stands for something the user asked for, or that came from a project harness or an imported pack, is never set aside. A version that was taken back is remembered with the reason: the next time the model writes for the same cause it is shown what went wrong, and the same script is not accepted twice.

用户撤回What the user can take back

这些操作都在正在运行的会话的下一次工具调用之前生效，什么都不删。恢复本身也是一代，所以回退也能被撤回。项目 Harness 的文件属于仓库：在自己的机器上回退只是让它们不在这里运行，替所有人撤回要靠删掉文件并提交。All of these take effect in running sessions before their next tool call, and none of them deletes anything. A restore is itself a generation, so going back can be taken back too. The files of a project harness belong to the repository: going back on one machine stops them from running there, and taking one back for everyone means removing the file and committing.

安全模型Safety model

接入 DSH 的位置Where it plugs into DSH

没有摩擦、没有挂载任何适配时，插件对模型完全不可见：系统提示词、工具列表和消息逐字节不变，有端到端用例守着。With no friction and nothing mounted, the plugin is invisible to the model: system prompt, tool list and messages are unchanged byte for byte, and an end-to-end test guards that.

路线图Roadmap

下面分成“已经有的”和“打算做的”。打算做的是计划，不是承诺，也没有日期。Split into what exists and what is planned. Planned means intended, with no promise and no date.