feat(feedback): add a /feedback command recorded through the command plane

Register a global `/feedback` command so a user can record a remark about the
session without spending a model turn. `/feedback <text>` acknowledges; empty
or whitespace-only input returns a usage error.

The plugin appends no session event of its own. `dsh-commands` already writes
a `command/run` / `command/done` pair for every dispatched command, carrying
the verbatim text and the settled outcome, and both records are log-only and
non-surface. The feedback is therefore durably in the session log and invisible
to the model without this package touching the log format.

Text is never parsed, so `/feedback /plan felt slow` records that literal
content. Nothing consumes the records; capture is deliberately inert.

New group `packages/feedback/` — no existing group owns feedback capture. Its
row raises the packages/README.md word ceiling by 10, which had no headroom;
one redundant sentence there was removed to offset most of the cost.

.agents/notes/implemented/feature/2026-07-28-feedback-command.i18n.yaml

@@ -0,0 +1,6 @@
+# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
+# side as of the last confirmed-consistent state. Both languages carry equal authority;
+# after editing either side, bring the other along and re-record with:
+#   pnpm run verify-translation-pairing --write .agents/notes/implemented/feature/2026-07-28-feedback-command.md
+2026-07-28-feedback-command.md: ae32d3908d568c4a511e8d9e2b8cf50569fb80bf
+2026-07-28-feedback-command.zh.md: f69dbf6a50161e7f5048b76be46bc4063f9e757a

.agents/notes/implemented/feature/2026-07-28-feedback-command.md

@@ -0,0 +1,61 @@
+# Agent Note: `/feedback` command
+
+Status: implemented
+
+English | [中文](2026-07-28-feedback-command.zh.md)
+
+## Problem
+
+A user who notices something wrong mid-session has nowhere to put that observation. Telling the model wastes a turn, changes the conversation the user was having, and buries the remark in derived history where no later reader can find it. Writing it outside the session loses the context that makes it meaningful — which session, at which point, against which work.
+
+The capture surface has to be usable at the moment of annoyance, which rules out anything requiring the user to leave the TUI, and it must not perturb the run in progress: no model tokens, no turn of work, no change to the request the user is waiting on.
+
+## Decision
+
+`@deepseek-ai/dsh-command-feedback` in `packages/feedback/command-feedback/` registers one global `feedback` command over `ctx.commands`. `/feedback <text>` acknowledges; bare or whitespace-only input returns a direct usage error. The handler is synchronous, injects only `commands`, and has no configuration.
+
+The plugin appends **no session event of its own**. `dsh-commands` already writes a `command/run` / `command/done` pair for every dispatched command, carrying the command name, the verbatim unparsed suffix, the invocation source, and the settled outcome. Those records are log-only and non-surface, so the feedback lands in the session log and stays invisible to the model without this package contributing anything to the log format. The appends start persistence's ordinary eager drain; nothing forces a flush, so the acknowledgement reports that the entry is recorded in the log rather than already on disk.
+
+Capture is deliberately inert: nothing in this repository reads those records back.
+
+### Why no dedicated `session/feedback` event
+
+An earlier iteration declared one. It was removed because it duplicated a record the registry already writes: both would carry the same text, appended microseconds apart, and a consumer would have to decide which is authoritative. Selecting `command/run` records by command name is enough to find feedback, and it keeps this package free of the session event format entirely — no `SessionEventMap` merge, no invariant relation, no persistence catalog entry.
+
+The cost is that the recorded text is the raw suffix including its leading separator whitespace, and that feedback is distinguished from other commands only by name. Both are read-time concerns for a consumer that does not yet exist; neither justifies a second durable record now.
+
+### Why the model never sees it
+
+Feedback is about the session, not input to it. Injecting it as a user message would change the next model request, contradicting the requirement that recording not perturb the run, and would make the remark part of the conversation it comments on. `command/run` and `command/done` are absent from `SurfaceEventType`, so they cannot acquire a `surfaceOp` or enter derived history even by mistake.
+
+### Verbatim text
+
+Nothing is parsed. `/feedback /plan felt slow` records that literal text; the leading `/plan` is content, not a nested command. The handler trims only to decide whether any text was supplied. Control-word grammar of the kind `/goal` uses would make the corresponding literal feedback impossible to express, which is the opposite of what a capture surface is for.
+
+### A new group
+
+`packages/feedback/` is a new group because no existing one owns this. `goal/` is objective state, `session-title/` is titles, `core/` is the product spine. The group holds one package; a consumer would join it rather than forcing this one to grow.
+
+## Alternatives considered
+
+**Declare a dedicated `session/feedback` log-only event.** Implemented first, then removed. It gave feedback a first-class queryable type with pre-trimmed text, but duplicated the registry's record, added a `SessionEventMap` member and persistence-catalog entry to the frozen log format, and created two records of one act with no rule for which wins.
+
+**Inject feedback as a user message via `agent.inject()`.** Needs no new event type and reuses the path `/goal` mutations take. Rejected: it makes the feedback model-visible, so it enters the next request, changes the run being commented on, and consumes tokens — contradicting all three parts of the no-perturbation requirement.
+
+**Make `/feedback` a true no-op that records nothing.** The most literal reading of "does not do anything". Rejected because it makes the command pointless: the stated requirement was that the remark reach the session log.
+
+**Register the command inside an existing package** such as `packages/ui/commands`. Avoids a new group and its README pair. Rejected: `ctx.commands` is the registry, not a home for arbitrary command implementations, and the requester asked for a standalone package.
+
+**Parse structure out of the text** (category prefixes, severity markers). Rejected as speculative: no consumer exists to use the structure, and any control-word grammar makes the corresponding literal feedback unrecordable. Verbatim text is the widest surface a future consumer can narrow; a parsed one cannot be widened after the fact.
+
+**Add a model-facing tool instead of a slash command.** Rejected: feedback is a direct human observation. Routing it through the model spends a turn, lets the model paraphrase the user's words, and makes the record contingent on the model choosing to call the tool.
+
+## Consequences
+
+The TUI mounts the command unconditionally — no configuration, no dependency on the goal stack. The headless CLI, ACP, and JSON-RPC apps do not consume `ctx.commands`, so `/feedback` is unavailable there.
+
+This package is now small enough that its whole contract is the command definition plus one validation branch. It owns no session event, so it needs no invariant relation and cannot affect replay, forking, or crash recovery.
+
+Deferred: no consumer; no structured fields; no amend or withdraw, since the log is append-only and this package adds no tombstone; the recorded text is untrimmed, so a consumer trims at read time; and no explicit durability barrier, so an entry recorded immediately before a crash can be lost with any other unflushed tail.
+
+No snapshot accompanies this change. AGENTS.md asks for a keyless snapshot through a runnable example for product-user-visible behavior; this was skipped at the requester's explicit direction. The package tests plus a real Loader composition test over a `cordis.yml` are the whole of the evidence, alongside interactive verification in the assembled TUI.

.agents/notes/implemented/feature/2026-07-28-feedback-command.zh.md

@@ -0,0 +1,61 @@
+# Agent Note: `/feedback` 命令
+
+Status: implemented
+
+[English](2026-07-28-feedback-command.md) | 中文
+
+## 问题
+
+用户在会话中途发现问题时，没有地方记下这个观察。告诉模型会浪费一个轮次、改变用户原本进行的对话，并把这条评论埋进派生历史，使后续读者无法找到它。写到会话之外则会丢失让它有意义的上下文：属于哪个会话、处于哪个时点、针对哪项工作。
+
+采集接口必须能在用户产生不满的那一刻使用，因此任何需要用户离开 TUI 的方案都不可行；它还不能扰动正在进行的运行：不消耗模型 token、不产生工作轮次、不改变用户正在等待的请求。
+
+## 决策
+
+位于 `packages/feedback/command-feedback/` 的 `@deepseek-ai/dsh-command-feedback` 通过 `ctx.commands` 注册一个全局 `feedback` 命令。`/feedback <text>` 给出确认；空输入或仅含空白的输入返回直接用法错误。处理器是同步的，只注入 `commands`，且没有任何配置。
+
+该插件**不追加属于自己的会话事件**。`dsh-commands` 已经为每个已分发命令写入一对 `command/run` / `command/done`，携带命令名、原样未解析的后缀、调用来源以及结算结果。这些记录仅写入日志且非 surface，因此反馈会进入会话日志并对模型保持不可见，而本包无需向日志格式贡献任何内容。这些追加会启动持久化的常规即时排空；没有任何环节强制 flush，因此确认文本报告的是条目已记录在日志中，而非已经落盘。
+
+采集刻意不产生后续动作：本仓库中没有任何代码读回这些记录。
+
+### 为何不设专用的 `session/feedback` 事件
+
+早先的实现声明过该事件，后来将其移除，因为它重复了注册表已经写入的记录：两者会携带相同文本、相隔极短时间先后追加，而消费方还得判断以哪一条为准。依据命令名筛选 `command/run` 记录已足以找到反馈，同时让本包完全不涉及会话事件格式——没有 `SessionEventMap` 合并、没有不变式关系、没有持久化目录条目。
+
+代价是被记录的文本为原始后缀，包含其前导分隔空白；且反馈仅凭命令名与其他命令相区分。两者都属于尚不存在的消费方在读取时需要处理的问题，目前都不足以支撑再增加一条持久记录。
+
+### 为何模型永不看到它
+
+反馈是关于会话的，而不是会话的输入。将其作为 user 消息注入会改变下一次模型请求，与「记录不得扰动运行」的要求相冲突，也会让该评论成为它所评论的那段对话的一部分。`command/run` 与 `command/done` 不属于 `SurfaceEventType`，因此即便出错也无法获得 `surfaceOp` 或进入派生历史。
+
+### 原样文本
+
+不做任何解析。`/feedback /plan felt slow` 记录的就是该字面文本；开头的 `/plan` 是内容，而非嵌套命令。处理器仅为判断是否提供了文本而修剪。若采用 `/goal` 那样的控制词语法，对应的字面反馈将无法表达，这与采集接口的目的正好相反。
+
+### 一个新的分组
+
+`packages/feedback/` 是新分组，因为现有分组都不拥有此职责：`goal/` 负责目标状态，`session-title/` 负责标题，`core/` 是产品主干。该分组目前只有一个包；未来的消费方应加入该分组，而不是迫使这个包不断膨胀。
+
+## 考虑过的替代方案
+
+**声明专用的 `session/feedback` 仅日志事件。** 先实现后移除。它让反馈拥有一等的可查询类型和预先修剪的文本，但重复了注册表的记录，向已冻结的日志格式新增了一个 `SessionEventMap` 成员与持久化目录条目，并使同一行为产生两条记录而没有取舍规则。
+
+**通过 `agent.inject()` 将反馈作为 user 消息注入。** 无需新增事件类型，并复用 `/goal` 变更所走的路径。已否决：它会让反馈对模型可见，从而进入下一次请求、改变正被评论的那次运行并消耗 token——与「不得扰动」要求的三个方面全部冲突。
+
+**让 `/feedback` 成为真正的空操作，什么都不记录。** 这是对「什么都不做」最字面的理解。已否决：这会使命令失去意义——明确的要求是让这条评论进入会话日志。
+
+**在现有包中注册该命令**，例如 `packages/ui/commands`。可省去新分组及其双语 README。已否决：`ctx.commands` 是注册表，而不是任意命令实现的归属地；且请求者明确要求独立的包。
+
+**从文本中解析结构**（类别前缀、严重程度标记）。已否决，属于投机设计：目前没有消费方使用该结构，而任何控制词语法都会让对应的字面反馈无法记录。原样文本是未来消费方可以收窄的最宽接口；而已被解析的接口无法事后放宽。
+
+**改为提供面向模型的工具。** 已否决：反馈是人类的直接观察。经由模型会消耗一个轮次、让模型改写用户的原话，并使记录取决于模型是否选择调用该工具。
+
+## 后果
+
+TUI 无条件挂载该命令：没有配置，也不依赖 goal 栈。无头 CLI、ACP 和 JSON-RPC 应用不消费 `ctx.commands`，因此 `/feedback` 在那里不可用。
+
+本包现已小到其全部契约就是命令定义加一个校验分支。它不拥有任何会话事件，因此无需不变式关系，也不可能影响回放、fork 或崩溃恢复。
+
+延期事项：没有消费方；没有结构化字段；不支持修改或撤回，因为日志仅追加且本包不新增 tombstone；被记录的文本未修剪，需由消费方在读取时处理；且没有显式持久化屏障，因此紧临崩溃前记录的条目可能与其他未 flush 的尾部一同丢失。
+
+本次变更不附带 snapshot。AGENTS.md 要求面向产品用户的可见行为变更通过可运行示例附带无密钥 snapshot；此项按请求者的明确指示跳过。包测试连同一个基于真实 `cordis.yml` 的 Loader 组合测试即为全部证据，此外还有在组装后 TUI 中的交互验证。

docs/config-catalog.md

@@ -1994,7 +1994,7 @@ export interface Config {
 
 Depends on: [`agentCore`](../packages/examples/agent-spine-demo/src/index.ts) · [`JsonlCompression`](../packages/session-persistence/session-persistence-jsonl/src/index.ts) · [`SessionReferenceConfig`](#deepseek-aidsh-session-reference) · [`ToolsConfig`](#deepseek-aidsh-tools) · [`uiTui`](../packages/ui/tui/src/index.ts)
 
-Source: [`packages/examples/tui-demo/src/index.ts:39`](../packages/examples/tui-demo/src/index.ts)
+Source: [`packages/examples/tui-demo/src/index.ts:40`](../packages/examples/tui-demo/src/index.ts)
 
 ## `@deepseek-ai/dsh-user-approval`
 
@@ -2219,6 +2219,7 @@ These load from a `cordis.yml` entry with no `config:` block; they declare no co
 - `@deepseek-ai/dsh-client-ui-theme` ([`packages/client/ui-theme/src/index.ts`](../packages/client/ui-theme/src/index.ts))
 - `@deepseek-ai/dsh-client-ui-trajectory` ([`packages/client/ui-trajectory/src/index.ts`](../packages/client/ui-trajectory/src/index.ts))
 - `@deepseek-ai/dsh-client-ui-workspace` ([`packages/client/ui-workspace/src/index.ts`](../packages/client/ui-workspace/src/index.ts))
+- `@deepseek-ai/dsh-command-feedback` — requires `commands` ([`packages/feedback/command-feedback/src/index.ts`](../packages/feedback/command-feedback/src/index.ts))
 - `@deepseek-ai/dsh-command-goal` — requires `commands` · `goals` ([`packages/goal/command-goal/src/index.ts`](../packages/goal/command-goal/src/index.ts))
 - `@deepseek-ai/dsh-commands` ([`packages/ui/commands/src/index.ts`](../packages/ui/commands/src/index.ts))
 - `@deepseek-ai/dsh-fs-policy` ([`packages/fs/fs-policy/src/index.ts`](../packages/fs/fs-policy/src/index.ts))

docs/module-graph.md

@@ -181,6 +181,9 @@ flowchart TD
     pkg_jsonrpc_demo["jsonrpc-demo"]
     pkg_tui_demo["tui-demo"]
   end
+  subgraph group_feedback["packages/feedback"]
+    pkg_command_feedback["command-feedback"]
+  end
   subgraph group_guard["packages/guard"]
     pkg_repeat_tool_guard["repeat-tool-guard"]
   end
@@ -604,6 +607,8 @@ flowchart TD
   pkg_client_ui_goal --> pkg_client_ui_slots
   pkg_client_ui_goal --> pkg_goal
   pkg_client_ui_goal --> pkg_invariants
+  pkg_command_feedback --> pkg_commands
+  pkg_command_feedback --> pkg_invariants
   pkg_pty_local --> pkg_agent
   pkg_pty_local --> pkg_invariants
   pkg_pty_local --> pkg_pty
@@ -928,6 +933,7 @@ flowchart TD
   pkg_tui_demo --> pkg_agent
   pkg_tui_demo --> pkg_agent_loop
   pkg_tui_demo --> pkg_agent_spine_demo
+  pkg_tui_demo --> pkg_command_feedback
   pkg_tui_demo --> pkg_command_goal
   pkg_tui_demo --> pkg_commands
   pkg_tui_demo --> pkg_invariants
@@ -1069,6 +1075,7 @@ flowchart TD
 | [`acp`](../packages/acp/acp) | `acp` | [`agent`](../packages/core/agent), [`invariants`](../packages/support/invariants), [`session`](../packages/core/session), [`user-approval`](../packages/ui/user-approval) |
 | [`permission`](../packages/ui/permission) | `ui` | [`bash`](../packages/bash/bash), [`invariants`](../packages/support/invariants), [`sandbox`](../packages/sandbox/sandbox), [`sandbox-policy`](../packages/sandbox/sandbox-policy), [`session`](../packages/core/session), [`user-approval`](../packages/ui/user-approval) |
 | [`client-ui-goal`](../packages/client/ui-goal) | `client` | [`client-connection`](../packages/client/connection), [`client-runtime`](../packages/client/runtime), [`client-ui-conversation`](../packages/client/ui-conversation), [`client-ui-primitives`](../packages/client/ui-primitives), [`client-ui-slots`](../packages/client/ui-slots), [`goal`](../packages/goal/goal), [`invariants`](../packages/support/invariants) |
+| [`command-feedback`](../packages/feedback/command-feedback) | `feedback` | [`commands`](../packages/ui/commands), [`invariants`](../packages/support/invariants) |
 | [`pty-local`](../packages/pty/pty-local) | `pty` | [`agent`](../packages/core/agent), [`invariants`](../packages/support/invariants), [`pty`](../packages/pty/pty), [`sandbox`](../packages/sandbox/sandbox), [`sandbox-policy`](../packages/sandbox/sandbox-policy), [`session`](../packages/core/session), [`subprocess`](../packages/subprocess/subprocess) |
 | [`tasks-local`](../packages/tasks/tasks-local) | `tasks` | [`agent`](../packages/core/agent), [`invariants`](../packages/support/invariants), [`tasks`](../packages/tasks/tasks), [`timeout`](../packages/util/timeout) |
 | [`session-telemetry-otel`](../packages/telemetry/session-telemetry-otel) | `telemetry` | [`invariants`](../packages/support/invariants), [`llm`](../packages/llm/llm), [`session`](../packages/core/session), [`session-telemetry`](../packages/telemetry/session-telemetry) |
@@ -1116,6 +1123,6 @@ flowchart TD
 | [`jsonrpc`](../packages/ui/jsonrpc) | `ui` | [`agent`](../packages/core/agent), [`invariants`](../packages/support/invariants), [`llm`](../packages/llm/llm), [`llm-deepseek`](../packages/llm/llm-deepseek), [`scope`](../packages/core/scope), [`sdk-protocol`](../packages/sdk/sdk-protocol), [`session`](../packages/core/session), [`subagent`](../packages/subagent/subagent) |
 | [`acp-demo`](../packages/examples/acp-demo) | `examples` | [`acp`](../packages/acp/acp), [`agent-spine-demo`](../packages/examples/agent-spine-demo), [`app-boot`](../packages/ui/app-boot), [`invariants`](../packages/support/invariants), [`session-checkpoint-policy`](../packages/session-persistence/session-checkpoint-policy), [`session-persistence-jsonl`](../packages/session-persistence/session-persistence-jsonl), [`session-query`](../packages/session-query/session-query), [`session-query-sqlite`](../packages/session-query/session-query-sqlite), [`tools`](../packages/core/tools), [`workspace-context`](../packages/context/workspace-context) |
 | [`cli-demo`](../packages/examples/cli-demo) | `examples` | [`agent`](../packages/core/agent), [`agent-spine-demo`](../packages/examples/agent-spine-demo), [`app-boot`](../packages/ui/app-boot), [`invariants`](../packages/support/invariants), [`llm`](../packages/llm/llm), [`session`](../packages/core/session), [`session-checkpoint-policy`](../packages/session-persistence/session-checkpoint-policy), [`session-persistence-jsonl`](../packages/session-persistence/session-persistence-jsonl), [`tools`](../packages/core/tools), [`workspace-context`](../packages/context/workspace-context) |
-| [`tui-demo`](../packages/examples/tui-demo) | `examples` | [`agent`](../packages/core/agent), [`agent-loop`](../packages/core/agent-loop), [`agent-spine-demo`](../packages/examples/agent-spine-demo), [`command-goal`](../packages/goal/command-goal), [`commands`](../packages/ui/commands), [`invariants`](../packages/support/invariants), [`llm`](../packages/llm/llm), [`session`](../packages/core/session), [`session-checkpoint-policy`](../packages/session-persistence/session-checkpoint-policy), [`session-persistence-jsonl`](../packages/session-persistence/session-persistence-jsonl), [`session-query`](../packages/session-query/session-query), [`session-query-sqlite`](../packages/session-query/session-query-sqlite), [`session-reference`](../packages/context/session-reference), [`tool-ask-user`](../packages/ui/tool-ask-user), [`tools`](../packages/core/tools), [`tui`](../packages/ui/tui), [`user-interaction`](../packages/ui/user-interaction), [`workspace-context`](../packages/context/workspace-context) |
+| [`tui-demo`](../packages/examples/tui-demo) | `examples` | [`agent`](../packages/core/agent), [`agent-loop`](../packages/core/agent-loop), [`agent-spine-demo`](../packages/examples/agent-spine-demo), [`command-feedback`](../packages/feedback/command-feedback), [`command-goal`](../packages/goal/command-goal), [`commands`](../packages/ui/commands), [`invariants`](../packages/support/invariants), [`llm`](../packages/llm/llm), [`session`](../packages/core/session), [`session-checkpoint-policy`](../packages/session-persistence/session-checkpoint-policy), [`session-persistence-jsonl`](../packages/session-persistence/session-persistence-jsonl), [`session-query`](../packages/session-query/session-query), [`session-query-sqlite`](../packages/session-query/session-query-sqlite), [`session-reference`](../packages/context/session-reference), [`tool-ask-user`](../packages/ui/tool-ask-user), [`tools`](../packages/core/tools), [`tui`](../packages/ui/tui), [`user-interaction`](../packages/ui/user-interaction), [`workspace-context`](../packages/context/workspace-context) |
 | [`sdk-client`](../packages/sdk/sdk-client) | `sdk` | [`invariants`](../packages/support/invariants), [`llm`](../packages/llm/llm), [`sdk-protocol`](../packages/sdk/sdk-protocol), [`session`](../packages/core/session) |
 | [`subagent-dsh-sdk`](../packages/subagent/subagent-dsh-sdk) | `subagent` | [`agent`](../packages/core/agent), [`invariants`](../packages/support/invariants), [`llm`](../packages/llm/llm), [`sdk-client`](../packages/sdk/sdk-client), [`session`](../packages/core/session), [`subagent`](../packages/subagent/subagent), [`subprocess`](../packages/subprocess/subprocess) |

packages/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/README.md
-README.md: 7a86e0f034264d4059e75775016d8d5d84600d8d
-README.zh.md: bfcba626bea2a70f5c2aa508bb2a5b8c09bb61dc
+README.md: b283af83596b738deeb6fc482fb4ff18bedf8df8
+README.zh.md: 91bc90ff05b849aaeec1ce1010a0e5a45b5a402a

packages/README.md

@@ -12,6 +12,7 @@ Packages live at `packages/<group>/<pkg>/`; groups are containers, while names r
 |---|---|---|
 | [`core/`](core/README.md) | Product API spine: sessions, prompts, tools, agent services, and the concrete loop | Product — stable surface |
 | [`goal/`](goal/README.md) | Persisted same-session goal state and lifecycle | Product — stable surface |
+| [`feedback/`](feedback/README.md) | Recorded human feedback | Product — stable surface |
 | [`llm/`](llm/README.md) | LLM capability family: the abstract service + provider adapters | Product — stable surface |
 | [`subprocess/`](subprocess/README.md) | Subprocess capability family: spawn seam + local process-tree implementation | Product — stable surface |
 | [`bash/`](bash/README.md) | Bash capability family: executor seam, local impl, model-facing tool | Product — stable surface |
@@ -50,7 +51,7 @@ Packages live at `packages/<group>/<pkg>/`; groups are containers, while names r
 | [`support/`](support/README.md) | Support infrastructure (testkits, invariants, replay, Loader smokes) | Support — lower compatibility expectations |
 | [`util/`](util/README.md) | Low-level zero-dependency utilities shared across groups (`Branded<B>`, Harness home/path helpers, timeout, retention) | Support — small, stable, harness-dep-free |
 
-Groups distinguish product API from support infrastructure. New packages join an existing group; a new group updates its README and this table.
+New packages join an existing group; a new group updates its README and this table.
 
 ## Dependencies
 

packages/README.zh.md

@@ -12,6 +12,7 @@
 |---|---|---|
 | [`core/`](core/README.md) | 产品 API 主干：会话、提示词、工具、agent（智能体）服务与具体循环 | 产品：稳定表面 |
 | [`goal/`](goal/README.md) | 持久化的同会话 goal 状态与生命周期 | 产品：稳定表面 |
+| [`feedback/`](feedback/README.md) | 记录人类对会话的反馈 | 产品：稳定表面 |
 | [`llm/`](llm/README.md) | LLM（大语言模型）能力系列：抽象服务 + 提供方适配器 | 产品：稳定表面 |
 | [`subprocess/`](subprocess/README.md) | 进程管理能力系列：spawn seam + 本地进程树实现 | 产品：稳定表面 |
 | [`bash/`](bash/README.md) | Bash 能力系列：执行器 seam、本地实现、面向模型的工具 | 产品：稳定表面 |
@@ -50,7 +51,7 @@
 | [`support/`](support/README.md) | 支持基础设施（testkit、不变式、回放、Loader 冒烟测试） | 支持：兼容性预期较低 |
 | [`util/`](util/README.md) | 组间共享的低层零依赖工具（`Branded<B>`、Harness home／路径辅助函数、超时、保留策略） | 支持：小型、稳定、无 harness 依赖 |
 
-组用于区分产品 API 与支持基础设施。新包加入现有组；新组则更新其 README 和此表。
+新包加入现有组；新组则更新其 README 和此表。
 
 ## 依赖
 

packages/examples/tui-demo/package.json

@@ -32,6 +32,7 @@
     "@deepseek-ai/dsh-agent-loop": "^0.0.1",
     "@deepseek-ai/dsh-commands": "^0.0.1",
     "@deepseek-ai/dsh-command-goal": "^0.0.1",
+    "@deepseek-ai/dsh-command-feedback": "^0.0.1",
     "@deepseek-ai/dsh-agent-spine-demo": "^0.0.1",
     "@deepseek-ai/dsh-invariants": "^0.0.1",
     "@deepseek-ai/dsh-llm": "^0.0.1",
@@ -55,6 +56,7 @@
     "@deepseek-ai/dsh-agent-loop": "workspace:^",
     "@deepseek-ai/dsh-commands": "workspace:^",
     "@deepseek-ai/dsh-command-goal": "workspace:^",
+    "@deepseek-ai/dsh-command-feedback": "workspace:^",
     "@deepseek-ai/dsh-agent-spine-demo": "workspace:^",
     "@deepseek-ai/dsh-invariants": "workspace:^",
     "@deepseek-ai/dsh-llm": "workspace:^",

packages/examples/tui-demo/src/index.ts

@@ -1,6 +1,6 @@
 /**
  * Full-screen terminal app: the default agent spine ({@link @deepseek-ai/dsh-agent-spine-demo})
- * plus persisted goals, human commands, JSONL persistence, keyboard-backed
+ * plus persisted goals, human commands including `/feedback`, JSONL persistence, keyboard-backed
  * user interaction, and one pre-created agent whose exact session identity the
  * TUI drives. Swappable adapters, executors, optional tools, and HMR stay in the leaf. This Loader plugin
  * intentionally exposes named exports only; a default export would hide its
@@ -16,6 +16,7 @@ import { SessionId } from '@deepseek-ai/dsh-session'
 import ToolRegistry, { type Config as ToolsConfig } from '@deepseek-ai/dsh-tools'
 import CommandService from '@deepseek-ai/dsh-commands'
 import * as commandGoal from '@deepseek-ai/dsh-command-goal'
+import * as commandFeedback from '@deepseek-ai/dsh-command-feedback'
 import * as agentCore from '@deepseek-ai/dsh-agent-spine-demo'
 import * as workspaceContext from '@deepseek-ai/dsh-workspace-context'
 import SessionPersistenceJsonl, {
@@ -122,6 +123,7 @@ export function composeTuiApp(ctx: Context, config: Config): void {
   const goals = config.goals ?? {}
   const persistenceRoot = config.persistenceRoot ?? DEFAULT_PERSISTENCE_ROOT
   ctx.plugin(CommandService)
+  ctx.plugin(commandFeedback)
   if (goals !== false) ctx.plugin(commandGoal)
   ctx.plugin(SessionPersistenceJsonl, {
     root: persistenceRoot,

packages/examples/tui-demo/tests/tui-agent.spec.ts

@@ -49,6 +49,7 @@ describe('dsh-tui-demo app', () => {
 
     expect(calls.map(call => call.name)).toEqual([
       'CommandService',
+      'command-feedback',
       'command-goal',
       'SessionPersistenceJsonl',
       'session-checkpoint-policy',
@@ -61,14 +62,14 @@ describe('dsh-tui-demo app', () => {
       'tool-ask-user',
     ])
     expect(calls[0]?.config).toBeUndefined()
-    expect(calls[2]?.config).toEqual({ root: '/tmp/tui-sessions', compression: 'none' })
-    expect(calls[4]?.config).toEqual({ path: join('/tmp/tui-sessions', 'session-query.db') })
-    expect(calls[5]?.config).toEqual({
+    expect(calls[3]?.config).toEqual({ root: '/tmp/tui-sessions', compression: 'none' })
+    expect(calls[5]?.config).toEqual({ path: join('/tmp/tui-sessions', 'session-query.db') })
+    expect(calls[6]?.config).toEqual({
       maxReferences: 2,
       candidateLimit: 7,
       maxReferenceBytes: 1234,
     })
-    const tuiConfig = calls[8]?.config as { sessionId: string }
+    const tuiConfig = calls[9]?.config as { sessionId: string }
     expect(tuiConfig).toMatchObject({
       welcome: 'TUI ready',
       resumeCommand: 'dsh --resume {session}',
@@ -76,7 +77,7 @@ describe('dsh-tui-demo app', () => {
       maxToolOutputLines: 3,
     })
     expect(tuiConfig.sessionId).toMatch(/^main-session-[0-9a-f-]{36}$/)
-    const spineConfig = calls[9]?.config as {
+    const spineConfig = calls[10]?.config as {
       readonly agents: Array<Record<string, unknown>>
       readonly goals: Record<string, never>
       readonly maxParallelToolCalls: number
@@ -109,11 +110,11 @@ describe('dsh-tui-demo app', () => {
       workspaceContext: false,
     })
 
-    expect(calls[2]?.config).toEqual({ root: './.sessions' })
-    expect(calls[5]?.config).toEqual({})
+    expect(calls[3]?.config).toEqual({ root: './.sessions' })
+    expect(calls[6]?.config).toEqual({})
     // No configured welcome forwards none: the TUI banner sweeps in without a subtitle.
-    expect(calls[8]?.config).toEqual({ sessionId: 'persisted-session' })
-    expect((calls[9]?.config as { agents: Array<Record<string, unknown>> }).agents[0]).toMatchObject({
+    expect(calls[9]?.config).toEqual({ sessionId: 'persisted-session' })
+    expect((calls[10]?.config as { agents: Array<Record<string, unknown>> }).agents[0]).toMatchObject({
       id: 'main',
       resumeSessionId: 'persisted-session',
     })
@@ -129,12 +130,14 @@ describe('dsh-tui-demo app', () => {
       workspaceContext: false,
     })
 
-    const tuiConfig = calls[7]?.config as { sessionId: string }
+    const tuiConfig = calls[8]?.config as { sessionId: string }
     expect(tuiConfig.sessionId).toMatch(/^main-session-[0-9a-f-]{36}$/)
-    expect((calls[8]?.config as { agents: Array<Record<string, unknown>> }).agents[0])
+    expect((calls[9]?.config as { agents: Array<Record<string, unknown>> }).agents[0])
       .toMatchObject({ sessionId: tuiConfig.sessionId })
     expect(calls.map(call => call.name)).not.toContain('command-goal')
-    expect(calls[8]?.config).toMatchObject({ goals: false })
+    // `/feedback` is unconditional: disabling goals must not remove it.
+    expect(calls.map(call => call.name)).toContain('command-feedback')
+    expect(calls[9]?.config).toMatchObject({ goals: false })
   })
 
   it('has the namespace-plugin export shape so the Loader keeps its schema', () => {

packages/examples/tui-demo/tsconfig.json

@@ -35,6 +35,9 @@
     {
       "path": "../../goal/command-goal"
     },
+    {
+      "path": "../../feedback/command-feedback"
+    },
     {
       "path": "../agent-spine-demo"
     },

packages/feedback/README.i18n.yaml

@@ -0,0 +1,6 @@
+# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
+# side as of the last confirmed-consistent state. Both languages carry equal authority;
+# after editing either side, bring the other along and re-record with:
+#   pnpm run verify-translation-pairing --write packages/feedback/README.md
+README.md: ab7bc6f3e3a3be0c280855ff80e92c7d7a7e665e
+README.zh.md: 9c050ac42aa468895c04124a76a3bce58756df0e

packages/feedback/README.md

@@ -0,0 +1,11 @@
+# feedback/ — recorded human feedback
+
+English | [中文](README.zh.md)
+
+The feedback family lets a human record a remark about the session without acting on it. Feedback is durable session-log content, separate from the model conversation and from any policy that might later read it.
+
+| Package | Role | ctx key |
+|---|---|---|
+| `command-feedback/` | Human-facing `/feedback` command recorded through the command plane | — |
+
+A recorded remark is log-only: it never enters the model surface or derived history, and no shipped plugin consumes it. A future consumer reads the command records from the session log rather than changing how they are captured.

packages/feedback/README.zh.md

@@ -0,0 +1,11 @@
+# feedback/：记录的人类反馈
+
+[English](README.md) | 中文
+
+feedback 家族让人类记录对会话的评价，但不据此采取任何动作。反馈属于持久的会话日志内容，与模型对话以及后续可能读取它的任何策略相互独立。
+
+| 包 | 职责 | ctx 键 |
+|---|---|---|
+| `command-feedback/` | 面向用户的 `/feedback` 命令，通过命令平面完成记录 | 无 |
+
+被记录的评价仅写入日志：它绝不会进入模型 surface 或派生历史，随附插件也不会消费它。未来的消费方从会话日志中读取命令记录，而不是改变它们的采集方式。

packages/feedback/command-feedback/README.i18n.yaml

@@ -0,0 +1,6 @@
+# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
+# side as of the last confirmed-consistent state. Both languages carry equal authority;
+# after editing either side, bring the other along and re-record with:
+#   pnpm run verify-translation-pairing --write packages/feedback/command-feedback/README.md
+README.md: 90992b7295536a9099766910f616e640d4b4bcfe
+README.zh.md: a7c4f03997cea182ed24dcfc7f309dc3bd872d5e

packages/feedback/command-feedback/README.md

@@ -0,0 +1,60 @@
+# @deepseek-ai/dsh-command-feedback
+
+English | [中文](README.zh.md)
+
+Human-facing `/feedback` capture. The plugin registers one global command through [`ctx.commands`](../../ui/commands/README.md), so every composed command adapter discovers it; the shipped TUI executes it without a model turn.
+
+## Command contract
+
+| Input | Result |
+|---|---|
+| `/feedback <text>` | Acknowledge with `Feedback recorded.` The registry's `command/run` record carries the verbatim text. |
+| `/feedback` | Return a direct usage error. Whitespace-only input is treated as empty. |
+
+Feedback text is never parsed: no truncation, case folding, or control words. Text that looks like another command, such as `/feedback /plan felt slow`, is feedback content. Repeated commands each produce their own record; nothing is replaced or merged.
+
+## What this plugin does and does not do
+
+The command records a remark and does nothing else. It appends no session event of its own, starts no model work, and no plugin in this repository reads its records.
+
+The record is the command registry's own `command/run` / `command/done` pairing, which [`dsh-commands`](../../ui/commands/README.md) appends for every dispatched command. Those appends start persistence's ordinary eager drain; neither the registry nor this command forces a `session/flush`, so the acknowledgement means the entry is in the log, not that it has already reached disk. `command/run` carries the command name, the verbatim unparsed suffix, and the invocation source; the paired `command/done` carries the outcome. Both are log-only and are absent from the ordered surface, from `deriveMessages()`, and from every model request. A rejected empty input still leaves that pairing, settled as `kind: 'error'`, so no entry can be mistaken for accepted feedback.
+
+A dedicated `session/feedback` event was considered and rejected: it would duplicate a record the registry already writes, and a consumer can select feedback by the command name it already stores.
+
+## Composition
+
+The producer injects only `commands`. A custom app mounts the registry plus this plugin:
+
+```yaml
+- id: commands
+  name: '@deepseek-ai/dsh-commands'
+- id: command-feedback
+  name: '@deepseek-ai/dsh-command-feedback'
+```
+
+The TUI app mounts this command unconditionally; it has no configuration and no dependency on the persisted-goal stack. The headless CLI, ACP automation, and JSON-RPC adapters do not consume `ctx.commands`, so they do not expose it.
+
+## Model Experience
+
+### Human `/feedback` capture
+
+#### What the model sees
+
+Nothing. The slash input, the recorded text, and the acknowledgement are all absent from model requests. The registry's `command/run` and `command/done` records are log-only and carry no `surfaceOp`, so they never reach the ordered surface, `deriveMessages()`, or a system prompt. Recording feedback during a turn does not change that turn's remaining requests.
+
+#### Token effect
+
+Zero direct token effect. Neither an accepted entry nor a usage error adds model tokens, in the recording turn or any later one.
+
+#### KV Cache effect
+
+Independent of the model request path. Recording appends to the session log only, leaving an already-reusable request prefix untouched. Nothing this package contributes can invalidate cache reuse.
+
+## Known Limitations and Deferred Work
+
+- **Nothing consumes the recorded feedback** — capture is deliberately inert. There is no retrieval, aggregation, export, or reporting surface, and no model-facing tool reads it; a consumer is a separate package that selects `command/run` records by command name.
+- **No structured fields** — an entry is one free-text string with no category, severity, or referenced-event link, so feedback cannot be filtered by subject without re-reading its text.
+- **No amend or withdraw** — the session log is append-only and this package adds no tombstone, so a mistaken entry stays recorded and can only be superseded by a later one.
+- **Untrimmed text in the record** — the handler trims only to validate; `command/run` stores the raw suffix, including its leading separator whitespace, so a consumer trims at read time.
+- **No explicit durability barrier** — the acknowledgement follows the append, not a flush, so an entry recorded immediately before a crash can be lost with any other unflushed tail. Feedback is not worth forcing a synchronous disk write for; a consumer that needs one awaits `ctx.sessions.flush(session)`.
+- **TUI only in the shipped apps** — the headless CLI, ACP automation, and JSON-RPC adapters do not mount `ctx.commands`, so `/feedback` is unavailable there.

packages/feedback/command-feedback/README.zh.md

@@ -0,0 +1,60 @@
+# @deepseek-ai/dsh-command-feedback
+
+[English](README.md) | 中文
+
+面向用户的 `/feedback` 采集。该插件通过 [`ctx.commands`](../../ui/commands/README.md) 注册一个全局命令，因此每个已组合的命令适配器都能发现它；随附 TUI 无需模型轮次即可执行。
+
+## 命令契约
+
+| 输入 | 结果 |
+|---|---|
+| `/feedback <text>` | 以 `Feedback recorded.` 确认。注册表的 `command/run` 记录携带原样文本。 |
+| `/feedback` | 返回一个直接用法错误。仅含空白的输入视为空输入。 |
+
+反馈文本从不被解析：没有截断、大小写折叠或控制词。看起来像另一个命令的文本（例如 `/feedback /plan felt slow`）就是反馈内容。重复执行命令会各自产生自己的记录，不会替换或合并。
+
+## 本插件做什么、不做什么
+
+该命令记录一条评价，不做别的事。它不追加属于自己的会话事件，不启动任何模型工作，本仓库中也没有任何插件读取它的记录。
+
+记录来自命令注册表自身的 `command/run` / `command/done` 配对，由 [`dsh-commands`](../../ui/commands/README.md) 为每个已分发命令追加。这些追加会启动持久化的常规即时排空；注册表与本命令都不会强制 `session/flush`，因此确认文本表示条目已进入日志，而不表示它已经落盘。`command/run` 携带命令名、原样未解析的后缀以及调用来源；配对的 `command/done` 携带结果。两者都仅写入日志，不出现在有序 surface、`deriveMessages()` 以及任何模型请求中。被拒绝的空输入仍会留下该配对，并以 `kind: 'error'` 结算，因此任何条目都不会被误认为已接受的反馈。
+
+曾考虑并否决了专用的 `session/feedback` 事件：它会重复注册表已经写入的记录，而消费方可以依据注册表已存储的命令名筛选反馈。
+
+## 组合
+
+生产方只注入 `commands`。自定义应用挂载注册表以及本插件：
+
+```yaml
+- id: commands
+  name: '@deepseek-ai/dsh-commands'
+- id: command-feedback
+  name: '@deepseek-ai/dsh-command-feedback'
+```
+
+TUI 应用无条件挂载此命令；它没有配置，也不依赖持久 goal 栈。无头 CLI、ACP 自动化和 JSON-RPC 适配器不消费 `ctx.commands`，因此不会暴露它。
+
+## 模型体验
+
+### 用户 `/feedback` 采集
+
+#### 模型看到的内容
+
+无。斜杠输入、被记录的文本以及确认文本都不出现在模型请求中。注册表的 `command/run` 与 `command/done` 记录仅写入日志且不携带 `surfaceOp`，因此它们绝不会进入有序 surface、`deriveMessages()` 或系统提示词。在某个轮次中记录反馈不会改变该轮次剩余的请求。
+
+#### Token 影响
+
+无直接 token 影响。无论是已接受的条目还是用法错误，都不会在记录所在轮次或此后任何轮次增加模型 token。
+
+#### KV Cache 影响
+
+与模型请求路径无关。记录只追加到会话日志，不触碰已经可复用的请求前缀。本包贡献的任何内容都不会使缓存复用失效。
+
+## 已知限制与暂缓工作
+
+- **没有任何消费方读取被记录的反馈**：采集刻意不产生任何后续动作。这里没有检索、聚合、导出或报告 surface，也没有面向模型的工具读取它；消费方是另一个依据命令名筛选 `command/run` 记录的独立包。
+- **没有结构化字段**：一条条目就是一个自由文本字符串，没有类别、严重程度或关联事件链接，因此无法在不重读文本的情况下按主题过滤反馈。
+- **不支持修改或撤回**：会话日志是仅追加的，本包也不新增 tombstone，因此错误的条目会一直保留在记录中，只能由后续条目取代。
+- **记录中的文本未修剪**：处理器只为校验而修剪；`command/run` 存储原始后缀，包含其前导分隔空白，因此消费方需在读取时修剪。
+- **没有显式持久化屏障**：确认文本紧随追加而非 flush，因此紧临崩溃前记录的条目可能与其他未 flush 的尾部一同丢失。为反馈强制同步写盘并不值得；需要该保证的消费方可自行等待 `ctx.sessions.flush(session)`。
+- **随附应用中只有 TUI 使用此命令**：无头 CLI、ACP 自动化和 JSON-RPC 适配器不挂载 `ctx.commands`，因此 `/feedback` 在那里不可用。

packages/feedback/command-feedback/package.json

@@ -0,0 +1,44 @@
+{
+  "name": "@deepseek-ai/dsh-command-feedback",
+  "description": "Human-facing slash command that records session feedback as a log-only event",
+  "version": "0.0.1",
+  "private": true,
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/types/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/types/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./invariant": {
+      "types": "./lib/types/invariant.d.ts",
+      "default": "./lib/invariant.js"
+    },
+    "./src/*": "./src/*",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib/index.js",
+    "lib/invariant.js",
+    "lib/types/**/*.d.ts",
+    "lib/types/**/*.d.ts.map",
+    "src"
+  ],
+  "license": "BSD-3-Clause",
+  "peerDependencies": {
+    "@deepseek-ai/dsh-commands": "^0.0.1",
+    "@deepseek-ai/dsh-invariants": "^0.0.1",
+    "cordis": "^4.0.0-rc.7"
+  },
+  "devDependencies": {
+    "@cordisjs/plugin-include": "workspace:^",
+    "@cordisjs/plugin-loader": "workspace:^",
+    "@deepseek-ai/dsh-agent": "workspace:^",
+    "@deepseek-ai/dsh-commands": "workspace:^",
+    "@deepseek-ai/dsh-invariants": "workspace:^",
+    "@deepseek-ai/dsh-llm": "workspace:^",
+    "@deepseek-ai/dsh-session": "workspace:^",
+    "cordis": "^4.0.0-rc.7"
+  }
+}

packages/feedback/command-feedback/src/index.ts

@@ -0,0 +1,40 @@
+/**
+ * Human-facing `/feedback` command. It records a remark about the session and
+ * does nothing else: the command registry's own `command/run` and
+ * `command/done` events are the whole record, so this plugin only validates the
+ * input and acknowledges it. Those appends are eager but unflushed, so the
+ * acknowledgement reports the entry is logged, not that it reached disk.
+ * @module @deepseek-ai/dsh-command-feedback
+ */
+
+import type { Context } from 'cordis'
+import type { CommandInvocation, CommandResult } from '@deepseek-ai/dsh-commands'
+
+export const name = 'command-feedback'
+export const inject = ['commands']
+
+const USAGE = 'Usage: /feedback <text>'
+
+/**
+ * Validate and acknowledge one feedback entry. `command/run` already carries
+ * the verbatim text, so no further append is needed; returning an error instead
+ * settles that record as `kind: 'error'` and leaves no accepted feedback.
+ * @param invocation - receiving agent, raw command input, and UI cancellation.
+ * @returns an acknowledgement, or a usage error when no feedback text was supplied.
+ */
+function executeFeedbackCommand(invocation: CommandInvocation): CommandResult {
+  if (invocation.rawInput.trim().length === 0) {
+    return { kind: 'error', text: `Feedback text is required. ${USAGE}` }
+  }
+  return { kind: 'success', text: 'Feedback recorded.' }
+}
+
+/** Register the global `/feedback` command for every composed command adapter. */
+export function apply(ctx: Context): void {
+  ctx.commands.register({
+    name: 'feedback',
+    description: 'record feedback about this session',
+    input: { hint: '<text>' },
+    handler: executeFeedbackCommand,
+  })
+}

packages/feedback/command-feedback/src/invariant.ts

@@ -0,0 +1,30 @@
+/**
+ * Package-owned invariant companion for `@deepseek-ai/dsh-command-feedback`.
+ * @module @deepseek-ai/dsh-command-feedback/invariant
+ */
+
+/* jscpd:ignore-start */
+import type { Context } from 'cordis'
+import type { InvariantInstaller } from '@deepseek-ai/dsh-invariants'
+
+const PACKAGE_NAME = '@deepseek-ai/dsh-command-feedback'
+
+/** Cordis companion plugin name. */
+export const name = 'command-feedback-invariant'
+/** Service required before the companion can reserve package ownership. */
+export const inject = ['invariants']
+
+/**
+ * No runtime invariant: this command declares no session event and owns no state projection. The
+ * `command/run`/`command/done` pairing that records feedback belongs to `dsh-commands`.
+ */
+const install: InvariantInstaller = () => {}
+
+/**
+ * Register this package's invariant companion.
+ * @param ctx - Cordis context carrying the invariant service.
+ * @returns the installed registration's disposer after setup succeeds.
+ */
+export const apply = (ctx: Context): Promise<() => void> =>
+  Promise.resolve(ctx.invariants.register(PACKAGE_NAME, install))
+/* jscpd:ignore-end */

packages/feedback/command-feedback/tests/command-feedback.spec.ts

@@ -0,0 +1,176 @@
+import { describe, expect, it } from 'vitest'
+import { Context } from 'cordis'
+import Loader from '@cordisjs/plugin-loader'
+import AgentRegistry from '@deepseek-ai/dsh-agent'
+import type { Agent, AgentStatus } from '@deepseek-ai/dsh-agent'
+import CommandService from '@deepseek-ai/dsh-commands'
+import SessionStore, { foldSurface, Session, SessionId } from '@deepseek-ai/dsh-session'
+import * as commandFeedback from '@deepseek-ai/dsh-command-feedback'
+
+interface Harness {
+  readonly ctx: Context
+  readonly agent: Agent
+  readonly session: Session
+  readonly plugin: Awaited<ReturnType<Context['plugin']>>
+}
+
+/** Build a live idle agent over a store-owned session, as an app's spine does. */
+function stubAgent(ctx: Context, id: string): { agent: Agent; session: Session } {
+  const session = ctx.sessions.create(SessionId(id))
+  let status: AgentStatus = 'idle'
+  const agent: Agent = {
+    id: session.id,
+    options: {},
+    session,
+    ctx: new Context(),
+    get status() { return status },
+    get acceptsNextStep() { return status === 'running' },
+    send: () => {},
+    followup: () => {},
+    steer: () => {},
+    inject: () => {},
+    cancel() { status = 'idle' },
+    whenIdle() { return Promise.resolve() },
+  }
+  return { agent, session }
+}
+
+/** Mount the real command registry and this producer. */
+async function harness(): Promise<Harness> {
+  const ctx = new Context()
+  await ctx.plugin(CommandService)
+  await ctx.plugin(AgentRegistry)
+  await ctx.plugin(SessionStore)
+  const plugin = await ctx.plugin(commandFeedback)
+  const { agent, session } = stubAgent(ctx, `command-feedback-${Math.random()}`)
+  ctx.agents.register(agent)
+  return { ctx, agent, session, plugin }
+}
+
+/** Execute `/feedback` through the same registry boundary as a UI adapter. */
+async function run(test: Harness, suffix = ''): Promise<{ kind: string; text?: string }> {
+  const settled = await test.ctx.commands.execute(
+    test.agent,
+    `/feedback${suffix}`,
+    new AbortController().signal,
+  )
+  if (settled === undefined) throw new Error('feedback command was not registered')
+  return settled.result
+}
+
+/** The registry's durable record of each accepted command, in log order. */
+function commandRecords(session: Session): { name: string; args: string; kind: string }[] {
+  const runs = session.events.filter(event => event.type === 'command/run')
+  return runs.map((event) => {
+    const done = session.events.find(item =>
+      item.type === 'command/done' && item.data.commandId === event.data.commandId)
+    if (done?.type !== 'command/done') throw new Error('every command/run must be paired')
+    return { name: event.data.name, args: event.data.args, kind: done.data.kind }
+  })
+}
+
+describe('@deepseek-ai/dsh-command-feedback registration', () => {
+  it('registers one global command with Loader-safe exports and disposes it', async () => {
+    const test = await harness()
+    expect(commandFeedback.name).toBe('command-feedback')
+    expect(commandFeedback.inject).toEqual(['commands'])
+    expect('default' in commandFeedback).toBe(false)
+    const loader = Object.create(Loader.prototype) as Loader
+    expect(loader.unwrapExports(commandFeedback)).toBe(commandFeedback)
+
+    expect(test.ctx.commands.list(test.agent)).toContainEqual({
+      name: 'feedback',
+      description: 'record feedback about this session',
+      input: { hint: '<text>' },
+    })
+    expect(test.ctx.commands.find(test.agent, 'feedback')).toBeDefined()
+
+    await test.plugin.dispose()
+    expect(test.ctx.commands.find(test.agent, 'feedback')).toBeUndefined()
+  })
+})
+
+describe('/feedback human command', () => {
+  it('acknowledges feedback and leaves the registry record as its durable trace', async () => {
+    const test = await harness()
+    await expect(run(test, ' the diff view is unreadable')).resolves.toEqual({
+      kind: 'success',
+      text: 'Feedback recorded.',
+    })
+    expect(commandRecords(test.session)).toEqual([
+      { name: 'feedback', args: ' the diff view is unreadable', kind: 'success' },
+    ])
+  })
+
+  it('adds no event of its own beyond the registry pairing', async () => {
+    const test = await harness()
+    await run(test, ' nothing else happens')
+    // The whole point of the command: record and do nothing. Only the
+    // registry's own pairing appears, and no turn of model work starts.
+    expect(test.session.events.map(event => event.type)).toEqual(['command/run', 'command/done'])
+  })
+
+  it('records verbatim text, including input that looks like another command', async () => {
+    const test = await harness()
+    await run(test, ' /plan felt SLOW\n\ttwice today ')
+    expect(commandRecords(test.session)).toEqual([
+      { name: 'feedback', args: ' /plan felt SLOW\n\ttwice today ', kind: 'success' },
+    ])
+  })
+
+  it('records each entry separately without replacing earlier ones', async () => {
+    const test = await harness()
+    await run(test, ' first')
+    await run(test, ' second')
+    expect(commandRecords(test.session).map(record => record.args)).toEqual([' first', ' second'])
+  })
+
+  it('records concurrent submissions in dispatch order', async () => {
+    const test = await harness()
+    const signal = new AbortController().signal
+    // The shipped TUI dispatches commands fire-and-forget.
+    const settled = await Promise.all([
+      test.ctx.commands.execute(test.agent, '/feedback first', signal),
+      test.ctx.commands.execute(test.agent, '/feedback second', signal),
+    ])
+    expect(settled.map(item => item?.result)).toEqual([
+      { kind: 'success', text: 'Feedback recorded.' },
+      { kind: 'success', text: 'Feedback recorded.' },
+    ])
+    expect(commandRecords(test.session).map(record => record.args)).toEqual([' first', ' second'])
+  })
+
+  it('keeps every recorded event off the model surface and out of derived history', async () => {
+    const test = await harness()
+    await run(test, ' invisible to the model')
+    for (const event of test.session.events) {
+      expect('surfaceOp' in event).toBe(false)
+      expect(test.session.deriveEventMessage(event)).toBeNull()
+    }
+    expect(foldSurface(test.session.events).nodes).toEqual([])
+    expect(test.session.surface.nodes).toEqual([])
+    expect(test.session.deriveMessages()).toEqual([])
+  })
+
+  it('rejects empty and whitespace-only input as a failed command record', async () => {
+    const test = await harness()
+    const expected = {
+      kind: 'error',
+      text: 'Feedback text is required. Usage: /feedback <text>',
+    }
+    await expect(run(test)).resolves.toEqual(expected)
+    await expect(run(test, '   \n\t ')).resolves.toEqual(expected)
+    // Rejected input still leaves the registry's own pairing, settled as an
+    // error, so no entry is mistaken for accepted feedback.
+    expect(commandRecords(test.session).map(record => record.kind)).toEqual(['error', 'error'])
+  })
+
+  it('records nothing when dispatch rejects an already-cancelled request', async () => {
+    const test = await harness()
+    const controller = new AbortController()
+    controller.abort(new Error('user cancelled the command'))
+    await expect(test.ctx.commands.execute(test.agent, '/feedback too late', controller.signal))
+      .rejects.toThrow('user cancelled the command')
+    expect(test.session.events).toEqual([])
+  })
+})

packages/feedback/command-feedback/tests/loader-composition.spec.ts

@@ -0,0 +1,105 @@
+import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { pathToFileURL } from 'node:url'
+import { afterEach, describe, expect, it } from 'vitest'
+import { Context } from 'cordis'
+import Loader from '@cordisjs/plugin-loader'
+import Include from '@cordisjs/plugin-include'
+import AgentRegistry from '@deepseek-ai/dsh-agent'
+import type { Agent, AgentStatus } from '@deepseek-ai/dsh-agent'
+import CommandService from '@deepseek-ai/dsh-commands'
+import SessionStore, { SessionId } from '@deepseek-ai/dsh-session'
+import * as CommandFeedback from '@deepseek-ai/dsh-command-feedback'
+
+let root: string | undefined
+let context: Context | undefined
+
+afterEach(async () => {
+  await context?.fiber.dispose()
+  context = undefined
+  if (root !== undefined) await rm(root, { recursive: true, force: true })
+  root = undefined
+})
+
+/** Register one idle agent over a store-owned session, as an app's spine does. */
+function agent(ctx: Context): Agent {
+  const scope = ctx.plugin(() => {})
+  const id = SessionId('feedback-loader-agent')
+  const session = ctx.sessions.create(id)
+  let status: AgentStatus = 'idle'
+  const value: Agent = {
+    id,
+    options: {},
+    session,
+    ctx: scope.ctx,
+    get status() { return status },
+    get acceptsNextStep() { return status === 'running' },
+    send: () => {},
+    followup: () => {},
+    steer: () => {},
+    inject: () => {},
+    cancel() { status = 'idle' },
+    whenIdle: () => Promise.resolve(),
+  }
+  ctx.agents.register(value)
+  return value
+}
+
+describe('/feedback real Loader composition through cordis.yml', () => {
+  it('boots cordis.yml and records feedback without model-visible output', async () => {
+    root = await mkdtemp(join(tmpdir(), 'dsh-command-feedback-loader-'))
+    const configPath = join(root, 'cordis.yml')
+    await writeFile(configPath, [
+      "- name: '@deepseek-ai/dsh-agent'",
+      "- name: '@deepseek-ai/dsh-session'",
+      "- name: '@deepseek-ai/dsh-commands'",
+      "- name: '@deepseek-ai/dsh-command-feedback'",
+      '',
+    ].join('\n'))
+
+    context = new Context()
+    context.baseUrl = pathToFileURL(root).href + '/'
+    await context.plugin(Loader)
+    context.loader.builtins.include = Include
+    const modules = new Map<string, unknown>([
+      ['@deepseek-ai/dsh-agent', AgentRegistry],
+      ['@deepseek-ai/dsh-session', SessionStore],
+      ['@deepseek-ai/dsh-commands', CommandService],
+      ['@deepseek-ai/dsh-command-feedback', CommandFeedback],
+    ])
+    context.loader.internal = {
+      version: 'v2',
+      async import(specifier: string) {
+        if (!modules.has(specifier)) throw new Error(`unexpected Loader import: ${specifier}`)
+        return modules.get(specifier)
+      },
+    } as unknown as NonNullable<typeof context.loader.internal>
+    await context.loader.create({ name: 'cordis:include', config: { path: pathToFileURL(configPath).href } })
+    await context.loader.await()
+
+    const owner = agent(context)
+    const signal = new AbortController().signal
+
+    // Discoverable through the composed registry, as a UI adapter finds it.
+    expect(context.commands.list(owner).map(command => command.name)).toContain('feedback')
+
+    const accepted = await context.commands.execute(owner, '/feedback the diff view is unreadable', signal)
+    expect(accepted?.result).toEqual({ kind: 'success', text: 'Feedback recorded.' })
+    const rejected = await context.commands.execute(owner, '/feedback', signal)
+    expect(rejected?.result).toEqual({
+      kind: 'error',
+      text: 'Feedback text is required. Usage: /feedback <text>',
+    })
+
+    // The command records itself through the registry and does nothing else.
+    expect(owner.session.events.map(event => event.type))
+      .toEqual(['command/run', 'command/done', 'command/run', 'command/done'])
+    const run = owner.session.events.find(event => event.type === 'command/run')
+    expect(run?.type === 'command/run' && run.data.args).toBe(' the diff view is unreadable')
+
+    // Nothing reached the model.
+    expect(owner.session.deriveMessages()).toEqual([])
+    expect(owner.session.surface.nodes).toEqual([])
+  })
+})

packages/feedback/command-feedback/tsconfig.json

@@ -0,0 +1,24 @@
+{
+  "extends": "../../../tsconfig.base.json",
+  "compilerOptions": {
+    "rootDir": "src",
+    "outDir": "lib/types"
+  },
+  "include": [
+    "src"
+  ],
+  "references": [
+    {
+      "path": "../../../vendor/cosmokit"
+    },
+    {
+      "path": "../../../vendor/cordis"
+    },
+    {
+      "path": "../../ui/commands"
+    },
+    {
+      "path": "../../support/invariants"
+    }
+  ]
+}

pnpm-lock.yaml

@@ -2303,6 +2303,9 @@ importers:
       '@deepseek-ai/dsh-agent-spine-demo':
         specifier: workspace:^
         version: link:../agent-spine-demo
+      '@deepseek-ai/dsh-command-feedback':
+        specifier: workspace:^
+        version: link:../../feedback/command-feedback
       '@deepseek-ai/dsh-command-goal':
         specifier: workspace:^
         version: link:../../goal/command-goal
@@ -2358,6 +2361,33 @@ importers:
         specifier: ^3.17.0
         version: 3.18.0
 
+  packages/feedback/command-feedback:
+    devDependencies:
+      '@cordisjs/plugin-include':
+        specifier: workspace:^
+        version: link:../../../vendor/include
+      '@cordisjs/plugin-loader':
+        specifier: workspace:^
+        version: link:../../../vendor/loader
+      '@deepseek-ai/dsh-agent':
+        specifier: workspace:^
+        version: link:../../core/agent
+      '@deepseek-ai/dsh-commands':
+        specifier: workspace:^
+        version: link:../../ui/commands
+      '@deepseek-ai/dsh-invariants':
+        specifier: workspace:^
+        version: link:../../support/invariants
+      '@deepseek-ai/dsh-llm':
+        specifier: workspace:^
+        version: link:../../llm/llm
+      '@deepseek-ai/dsh-session':
+        specifier: workspace:^
+        version: link:../../core/session
+      cordis:
+        specifier: ^4.0.0-rc.7
+        version: 4.0.0-rc.7(@cordisjs/plugin-include@vendor+include)(@cordisjs/plugin-loader@vendor+loader)
+
   packages/fs/fs:
     devDependencies:
       '@deepseek-ai/dsh-brand':

scripts/doc-budgets.manifest.json

@@ -7,5 +7,5 @@
   "docs/testing.md": 1100,
   "examples/AGENTS.md": 310,
   "packages/AGENTS.md": 675,
-  "packages/README.md": 870
+  "packages/README.md": 880
 }

tsconfig.base.json

@@ -72,6 +72,7 @@
         "./packages/compact/*/src/invariant.ts",
         "./packages/context/*/src/invariant.ts",
         "./packages/goal/*/src/invariant.ts",
+        "./packages/feedback/*/src/invariant.ts",
         "./packages/guard/*/src/invariant.ts",
         "./packages/plan/*/src/invariant.ts",
         "./packages/subagent/*/src/invariant.ts",
@@ -161,6 +162,7 @@
         "./packages/compact/*/src",
         "./packages/context/*/src",
         "./packages/goal/*/src",
+        "./packages/feedback/*/src",
         "./packages/guard/*/src",
         "./packages/plan/*/src",
         "./packages/subagent/*/src",

tsconfig.host.json

@@ -83,6 +83,7 @@
     { "path": "./packages/goal/tool-goal" },
     { "path": "./packages/goal/goal-session" },
     { "path": "./packages/goal/command-goal" },
+    { "path": "./packages/feedback/command-feedback" },
     { "path": "./packages/context/time-context" },
     { "path": "./packages/context/session-reference" },
     { "path": "./packages/ui/user-interaction" },