Merge remote-tracking branch 'origin/master' into worktree/custom-deepseek-models

# Conflicts:
#	packages/host/apiproxy/README.i18n.yaml

packages/host/apiproxy/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/host/apiproxy/README.md
-README.md: 8e2cb4ef6a4f465cf23922a61f50e9f383135de3
-README.zh.md: 87bfaf2ca6b47e877a7e39c9a16cd44f50441ae3
+README.md: 7a5e18990792d55f6eaabaf92df8d1cc0cb7c0ba
+README.zh.md: d5f98f4cd7827a8c8db67b8707bad76f984c999d

packages/host/apiproxy/README.md

@@ -10,6 +10,8 @@ Wire messages form a four-quadrant discriminated union — who initiates × requ
 
 The layering/protocol decisions are recorded in the [GUI layering and RPC protocol RFC](../../../.agents/notes/implemented/architecture/2026-07-19-gui-layering-and-rpc-protocol.md); the browser-side consumption architecture in the [web client architecture RFC](../../../.agents/notes/implemented/architecture/2026-07-19-gui-web-client-architecture.md).
 
+Question responses are validated against their pending request before the first answer claims it. A multi-select item may carry both requested option labels in `selected` and non-empty `custom` text; a single-select item must use one or the other. Duplicate labels, unknown labels, mismatched ids, incomplete batches, and empty custom text are rejected as `bad-response`.
+
 `session.history` reads an attached Session in memory or inspects a cold log through persistence without resuming or publishing an Agent, then pages on append-origin message boundaries. `maxMessages` counts `user/message`, `assistant/message`, and `steering/message` events that entered the surface by appending, so a model-only replacement copy consumes no quota. Each page stays one contiguous raw event range, which keeps a compaction's log-only provenance on the same page as the replacement that cites it.
 
 `session.history`'s tail page (`beforeSeq` absent) additionally carries an optional `projections` block — the watermark snapshot of every unit registered on `ctx.sessionProjections` (`@deepseek-ai/dsh-session-projection`), with `asOfSeq` = the last event seq the values reflect (`-1` on an empty log). The gateway also subscribes to the registry's change feed and mints a `session/projection` mux frame per changed unit (`{sessionId, key, value, seq}` — live push state, never logged; clients hold one generic per-session value store under higher-seq-wins). The carrier holds zero domain knowledge (each value passed its unit's own schema inside the registry; the wire schemas keep `values`/`value` wide); loadOlder pages never carry the block, and a composition without the registry serves histories without either surface.

packages/host/apiproxy/README.zh.md

@@ -10,6 +10,8 @@
 
 分层与协议决策记录在 [GUI 分层与 RPC 协议 RFC](../../../.agents/notes/implemented/architecture/2026-07-19-gui-layering-and-rpc-protocol.md)中；浏览器侧消费架构记录在 [Web 客户端架构 RFC](../../../.agents/notes/implemented/architecture/2026-07-19-gui-web-client-architecture.md)中。
 
+首个回答认领待处理请求之前，系统会对照该请求校验问题响应。多选题的回答项可以同时携带 `selected` 中的请求选项标签与非空 `custom` 文本；单选题的回答项必须二选一。标签重复、标签未知、id 不匹配、批次不完整以及自定义文本为空都会以 `bad-response` 拒绝。
+
 `session.history` 会读取已附加 Session 的内存状态，或通过持久化检查冷日志，而不会恢复或发布 agent（智能体），然后按追加来源的消息边界分页。`maxMessages` 统计以追加方式进入 surface 的 `user/message`、`assistant/message` 和 `steering/message` 事件，因此仅供模型使用的替换副本不占用配额。每一页仍是一段连续的原始事件区间，从而让压缩（compaction）的仅日志溯源信息与引用它的替换留在同一页。
 
 `session.history` 的尾页（不带 `beforeSeq`）额外携带一个可选的 `projections` 块——`ctx.sessionProjections`（`@deepseek-ai/dsh-session-projection`）上每个已注册单元的水位线快照，`asOfSeq` = 这些值共同反映到的最后一个事件 seq（空日志为 `-1`）。网关还订阅注册表的变更流，为每个状态发生变化的单元铸造一个 `session/projection` mux 帧（`{sessionId, key, value, seq}`——实时推送状态，绝不入日志；客户端按 seq 高者胜维护一个按会话的通用值仓）。载体不持有任何领域知识（每个值在注册表内部已过其单元自己的 schema；协议 schema 对 `values`/`value` 保持宽松）；loadOlder 页永不携带该块，未装注册表的组合则两个面都不提供。

packages/host/apiproxy/src/api-proxy.ts

@@ -395,8 +395,10 @@ function matchesQuestions(payload: QuestionResponsePayload, pending: PendingQues
     if (new Set(answer.selected).size !== answer.selected.length) return false
     const custom = answer.custom?.trim()
     if (custom !== undefined && custom === '') return false
-    if (custom !== undefined && answer.selected.length > 0) return false
-    if (question.multiSelect !== true && answer.selected.length > 1) return false
+    if (question.multiSelect !== true) {
+      if (custom !== undefined && answer.selected.length > 0) return false
+      if (answer.selected.length > 1) return false
+    }
     const labels = new Set(question.options?.map(option => option.label) ?? [])
     return answer.selected.every(label => labels.has(label))
   })

packages/host/apiproxy/tests/api-proxy-question.spec.ts

@@ -0,0 +1,116 @@
+import { describe, expect, it } from 'vitest'
+import { Context } from 'cordis'
+import type { Agent } from '@deepseek-ai/dsh-agent'
+import SessionStore from '@deepseek-ai/dsh-session'
+import UserInteractionService from '@deepseek-ai/dsh-user-interaction'
+import type { ApiProxy, MuxFrame, RpcRequest } from '@deepseek-ai/dsh-host-apiproxy/api'
+import { RpcId } from '@deepseek-ai/dsh-host-apiproxy/api/rpc'
+import { createApiProxy } from '../src/api-proxy.ts'
+
+async function harness(): Promise<{ ctx: Context; api: ApiProxy }> {
+  const ctx = new Context()
+  await ctx.plugin(SessionStore)
+  await ctx.plugin(UserInteractionService)
+  return {
+    ctx,
+    api: createApiProxy(ctx, { provider: 'p', model: 'm', cwd: '/tmp', workspaceRoot: '/tmp' }),
+  }
+}
+
+function agent(id: string): Agent {
+  return { id } as unknown as Agent
+}
+
+function openMux(api: ApiProxy, abort: AbortController): {
+  envelopes: RpcRequest<MuxFrame>[]
+  waitForQuestion(): Promise<RpcRequest<Extract<MuxFrame, { type: 'question/requested' }>>>
+} {
+  const envelopes: RpcRequest<MuxFrame>[] = []
+  let resolveQuestion!: (value: RpcRequest<Extract<MuxFrame, { type: 'question/requested' }>>) => void
+  const question = new Promise<RpcRequest<Extract<MuxFrame, { type: 'question/requested' }>>>((resolve) => {
+    resolveQuestion = resolve
+  })
+  void (async () => {
+    for await (const envelope of api.events.mux({ rpcId: RpcId('question-mux'), payload: {} }, abort.signal)) {
+      envelopes.push(envelope)
+      if (envelope.payload.type === 'question/requested') {
+        resolveQuestion(envelope as RpcRequest<Extract<MuxFrame, { type: 'question/requested' }>>)
+      }
+    }
+  })()
+  return { envelopes, waitForQuestion: () => question }
+}
+
+function answer(
+  envelope: RpcRequest<Extract<MuxFrame, { type: 'question/requested' }>>,
+  selected: string[],
+  custom?: string,
+): Parameters<ApiProxy['respond']>[0] {
+  return {
+    type: 'client-response',
+    rpcId: envelope.rpcId,
+    result: {
+      ok: true,
+      value: {
+        sessionId: envelope.payload.sessionId,
+        answer: {
+          answers: [{
+            id: envelope.payload.questions[0]?.id,
+            selected,
+            ...custom === undefined ? {} : { custom },
+          }],
+        },
+      },
+    },
+  }
+}
+
+describe('question response validation', () => {
+  it('accepts selected options with custom text for multi-select questions', async () => {
+    const { ctx, api } = await harness()
+    const abort = new AbortController()
+    const mux = openMux(api, abort)
+    const asked = ctx.userInteraction.ask({
+      agent: agent('session-multi'),
+      questions: [{
+        id: 'targets',
+        question: 'Choose targets and add another',
+        multiSelect: true,
+        options: [{ label: 'Code' }, { label: 'Docs' }],
+      }],
+    })
+    const envelope = await mux.waitForQuestion()
+
+    expect(await api.respond(answer(envelope, ['Code', 'Docs'], 'Release notes')))
+      .toEqual({ accepted: true })
+    await expect(asked).resolves.toEqual({
+      answers: [{ id: 'targets', selected: ['Code', 'Docs'], custom: 'Release notes' }],
+    })
+    expect(mux.envelopes.some(item => item.payload.type === 'question/resolved')).toBe(true)
+    abort.abort()
+  })
+
+  it('keeps selected options and custom text mutually exclusive for single-select questions', async () => {
+    const { ctx, api } = await harness()
+    const abort = new AbortController()
+    const mux = openMux(api, abort)
+    const asked = ctx.userInteraction.ask({
+      agent: agent('session-single'),
+      questions: [{
+        id: 'target',
+        question: 'Choose one target',
+        options: [{ label: 'Code' }, { label: 'Docs' }],
+      }],
+    })
+    const envelope = await mux.waitForQuestion()
+
+    expect(await api.respond(answer(envelope, ['Code'], 'Release notes')))
+      .toEqual({ accepted: false, reason: 'bad-response' })
+    expect(await api.respond(answer(envelope, [], 'Release notes')))
+      .toEqual({ accepted: true })
+    await expect(asked).resolves.toEqual({
+      answers: [{ id: 'target', selected: [], custom: 'Release notes' }],
+    })
+    abort.abort()
+  })
+})