OhMyAgent Desktop v4.3.0-beta1

v4.3.0-beta1 测试版：新增判断内核（Judge Kernel），内嵌 pi-mono 升级至 v1.1.0，并修复渠道投递与配置热重载的可靠性问题。

🧭 新增：判断内核（Judge Kernel）

• 在 15 个关键环节引入"裁判"判定：意图分类、技能披露、记忆捕获 / 价值 / 合并、上下文遗忘与压缩、偏航检测、收尾验证、风险命令复核、注入筛查、群聊分诊、通知路由、工具输出准入等；每个决策点可设为 关闭 / 影子（只记录不生效）/ 生效
• 裁判链在 WebUI 中拖拽排序：内置分类器供应商（OpenCode、Typesafe、Vercel AI Gateway、OpenRouter、Cloudflare Workers AI 免费档）与自定义中继裁判平级混排，第一个可用者为主裁判，主裁判灰区或失败时依次顺延，全部不可用时回落到原有规则
• 自动晋升：影子点攒够样本后按统计闸门（样本 ≥30、一致率 ≥90%、灰区率 <20%）自动转生效，质量退化自动退回，无需人工标注；在 config.yaml 手动固定的点不受自动管理
• WebUI 新增「判断内核」标签页：裁判链拖拽排序、供应商分组、金样例一键测试（显示延迟与判定结果）、判决台账；配置以 config.yaml 的 judge: 节为唯一来源，关闭或该节缺失时行为与没有裁判时完全一致

⬆️ 升级 pi-mono 至 v1.1.0

• 新增 OpenAI Decisions 分类器 API（gpt-6-luna）、Claude Haiku 5.5、工具耗时统计
• 上游修复一并采纳：server_busy 等供应商错误改为可重试；Anthropic 浏览器登录端口被 Hyper-V / WSL 占用时自动换端口；Mistral finish_reason: error 重试；Bedrock Converse 对 OpenAI 模型正确发送 reasoning effort
• MCP：OAuth 全链路支持取消，被中止的刷新不再退回重新授权

🔧 修复

• 修复：新会话的首条消息在历史里重复出现两遍。 首轮之前插入的工具声明系统消息让落库窗口错位一格，同一条用户消息被写入两次；现按可持久化的 user / assistant 序列计数
• 修复：配置热重载可能被上一次的旧配置覆盖。 多个重载（文件监听、WebUI 保存、环境变量）并发到达时按到达顺序串行应用，旧配置不会最后落地
• 修复：微信渠道消息可能重复处理或丢失。 批次先处理成功再提交游标，失败批次按指数退避重试且已完成的消息不重跑；回复令牌改为顺序写入，避免并发覆盖同一用户的令牌
• 修复：飞书渠道队列满时消息被静默丢弃。 队列拒绝现在会被上报，单条任务失败也不再阻塞同会话的后续消息
• 修复：长时间运行后会话的 agent / 模型 / 思考档位映射无限增长。 三张映射表改为有界（上限 500，淘汰最久未用）

---

v4.3.0-beta1 is a beta: it introduces the Judge Kernel, upgrades the embedded pi-mono to v1.1.0, and fixes channel delivery and config hot-reload reliability.

🧭 New: Judge Kernel

• A "judge" now decides 15 key steps: intent classification, skill disclosure, memory capture / worth / merge, context forgetting and compaction, turn drift, turn completion, risky-command review, injection screening, group-chat triage, notification routing, tool-output admission and more; each decision point can be off / shadow (recorded only) / active
• The judge chain is drag-sortable in the WebUI: built-in classifier providers (OpenCode, Typesafe, Vercel AI Gateway, OpenRouter, Cloudflare Workers AI free tier) sit alongside custom relay judges as peers; the first usable one is the primary judge, later ones are tried in order when it returns a gray zone or fails, and the original rules take over when none is available
• Autopilot promotion: a shadow point that collects enough samples is promoted automatically by a statistical gate (samples ≥30, agreement ≥90%, gray-zone rate <20%) and demoted again if quality degrades — no human labeling; points pinned manually in config.yaml are left alone
• New Judge Kernel tab in the WebUI: drag-sortable chain, provider groups, one-click golden-sample test (latency and verdict), and the verdict ledger; the judge: section of config.yaml is the single source of truth, and when it is off or absent behavior is identical to having no judge at all

⬆️ pi-mono Upgraded to v1.1.0

• New OpenAI Decisions classifier API (gpt-6-luna), Claude Haiku 5.5, and tool duration timing
• Upstream fixes adopted: provider errors such as server_busy are retried; the Anthropic browser login port falls back automatically when Hyper-V / WSL holds it; Mistral finish_reason: error is retried; Bedrock Converse sends reasoning effort for OpenAI models
• MCP: OAuth flows support cancellation throughout, and an aborted refresh no longer falls back to re-authorization

🔧 Fixes

• Fixed: the first message of a new session appeared twice in history. The tool-declaration system message injected before the first turn shifted the persist window by one, so the same user message was written twice; the counter now follows the persistable user/assistant sequence
• Fixed: a config hot reload could be overwritten by the previous one. Overlapping reloads (file watcher, WebUI save, env) are now applied serially in arrival order, so an older config can never land last
• Fixed: WeChat messages could be processed twice or dropped. A batch is processed before its cursor is committed, failed batches retry with exponential backoff without re-running completed turns, and reply tokens are written sequentially so concurrent writes cannot clobber another user's token
• Fixed: Feishu messages were silently dropped when the queue was full. Queue rejections are now reported, and one failing task no longer blocks later messages in the same session
• Fixed: the session agent / model / reasoning-level maps grew without bound. All three are now bounded (500 entries, least-recently-used evicted)