@banbolee/dsh-fish-shell 0.4.0

package/README.md

@@ -0,0 +1,103 @@
+# @banbolee/dsh-fish-shell
+
+Fish shell executors and tool for DeepSeek Harness: run commands with
+**fish** instead of bash. Distribution-ready and surface-agnostic: works in
+any profile that mounts it — preset-roster based (dsh-tui, web) or
+host-tool based (headless).
+
+## What this bundle does
+
+- **Executor, sandboxed** (`index.js`, default export): `FishSandboxExecutor`,
+  a `SandboxBashExecutor` subclass that confines `fish -c` commands instead
+  of `bash -c`. Mounted as `ctx.shell` in place of the base `bash-sandbox`
+  executor. The sandbox backend, denial classification, runner-failure
+  facts, and the `sandboxMode` capability fact (required by
+  `dsh-permission-presets`) are inherited. Both the confined and the
+  `danger-full-access` paths run fish (the base class's full-access branch
+  falls through to hardcoded bash, so it is overridden).
+- **Executor, unconfined** (`local.js`, exported as `@banbolee/dsh-fish-shell/local`):
+  `FishLocalExecutor`, a `LocalBashExecutor` subclass running `fish -c`
+  without a sandbox. For custom compositions that deliberately run without a
+  sandbox; composing it with `dsh-permission-presets` fails loud at load.
+- **Tool** (`tool.js`, exported as `@banbolee/dsh-fish-shell/tool`): a model-facing
+  `fish` tool mounted host-globally, executing through `ctx.shell`. It passes
+  the calling session's resolved sandbox policy (so `/permission` switches
+  and the session workspace root are honored), collects the managed `DSH_*`
+  environment from `ctx.shellEnv`, and renders the harness marker contract
+  (`[exit code: N]`, `[stderr]`, `[sandbox: file access denied under <mode>
+  mode]`, `[output truncated; full output: <path>]`). Its description teaches
+  the model fish syntax.
+- **Agent preset** (bundled at `presets/fish/`): a copy of the shipped
+  `standard` preset with the shell section removed (the `fish` tool is
+  host-global, so the preset needs no shell row). The bundle patch adds the
+  package's `presets/` directory as a system preset root and switches the
+  preset-roster default to `fish` for both roster row ids (`agent-presets`
+  used by web, `dsh-tui-agent-presets` used by dsh-tui). The tool plugin also
+  installs the preset under `$DSH_HOME/.agent-presets/fish` create-only
+  (never overwrites an existing file, including a user-authored one; a failed
+  write is a warning) as a fallback for rosters whose row this bundle does
+  not patch.
+
+## Install
+
+```sh
+# from this checkout, per profile:
+dsh plugin --profile <name> add ./plugins/fish-shell
+```
+
+For a published npm package: `dsh plugin --profile <name> add @banbolee/dsh-fish-shell`.
+
+Add it to every profile that should default to fish (dsh-tui, web, headless,
+…). The bundle patch is a no-op (with a warning) for a roster row id that the
+profile does not have, so one patch file is safe across surfaces.
+
+### Deployed copy and the symlink chain
+
+The executors subclass `@deepseek-ai/dsh-bash-local` /
+`@deepseek-ai/dsh-bash-sandbox`. Those imports must resolve to the same
+runtime instance the harness uses — the launcher-maintained
+`profiles/node_modules/@deepseek-ai/*` symlink chain. A plain `link:` to this
+checkout (outside the profile tree) would resolve no `@deepseek-ai` package,
+so the deployed copy lives at `profiles/node_modules/@banbolee/dsh-fish-shell` (inside
+the tree). `scripts/sync-to-profile.sh` copies the plugin there after edits
+and checks the bundled fish preset for drift against the shipped `standard`
+preset; a pnpm `file:` dependency points each profile at the deployed copy. A
+package published to npm installs normally (its realpath already lies inside
+the profile tree).
+
+## Per-surface behavior
+
+- **Preset-roster surfaces** (dsh-tui, web): agents compose tools from the
+  `fish` preset (default) — `standard` minus the shell rows — and see exactly
+  one shell tool, `fish`. **Upstream presets (`standard`, `code`) are not
+  fish-safe**: they register a `bash`-named tool that still executes through
+  the fish executor, so the name/description lie about the shell. Only the
+  bundled `fish` preset is fish-only. (`minimal` has no one-shot shell tool.)
+- **Host-tool surfaces** (headless): the agent uses host-plane tools; the
+  disabled host `tool-bash` and the host-global `fish` tool make fish the
+  agent's only shell tool.
+
+## Behavior
+
+- Every shell call spawns a fresh non-login shell (under the configured
+  sandbox backend for `FishSandboxExecutor`); no state (cwd, variables,
+  functions, history) persists between calls.
+- Output is bounded per stream by the executor's configured caps; timeouts
+  are clamped to the executor's cap; the model sees the harness marker
+  contract.
+- Requires `fish` on PATH; the executors fail loud when it is missing.
+
+## Known Limitations
+
+- Models default to bash idioms; the `fish` tool description teaches fish
+  syntax, but a command written in bash dialect fails under fish. This is the
+  intended trade of swapping the shell.
+- The `fish` tool has no `run_in_background` parameter and no sandbox
+  escalation (`sandbox_permissions`) parameters yet; long commands must
+  finish within the timeout, and a denied command cannot be re-run wider
+  (the executor's `start()` and the approval stack are available to
+  in-process consumers).
+- Upstream presets (`standard`, `code`) are not fish-safe; see
+  Per-surface behavior.
+- POSIX only: the `fish` binary and the underlying process-group semantics
+  are not available on Windows (the pwsh family covers Windows).

package/cordis.patch.yml

@@ -0,0 +1,47 @@
+# @banbolee/dsh-fish-shell bundle: make fish the default shell executor instead of bash.
+#
+# Works across every surface:
+#   - dsh-tui / web (agent-preset roster): disables the base bash executor
+#     (`bash-sandbox`) and the host bash tool (`tool-bash`), mounts the fish
+#     executor (ctx.shell) and a host-global `fish` tool, and points the
+#     roster default at the bundled `fish` agent preset (discovered through
+#     the package's own `presets/` directory, registered below as a system
+#     preset root).
+#   - headless (no preset roster; the agent uses host-plane tools): the
+#     host-global `fish` tool and the disabled `tool-bash` already make fish
+#     the agent's only shell tool.
+#
+# The model-facing `fish` tool is host-global so every surface sees it; the
+# bundled `fish` preset (standard with the shell rows removed) keeps agents
+# that select it free of a duplicate or bash shell tool.
+- id: bash-sandbox
+  disabled: true
+
+- id: tool-bash
+  disabled: true
+
+- insert:
+    - id: fish-shell
+      name: '@banbolee/dsh-fish-shell'
+
+    - id: tool-fish
+      name: '@banbolee/dsh-fish-shell/tool'
+
+- id: dsh-tui-agent-presets
+  config:
+    default: fish
+    roots: !!js >-
+      (() => {
+        const base = ctx.baseUrl
+        if (!base) return []
+        const resolvePath = (url) => {
+          const path = decodeURIComponent(url.pathname)
+          return /^\/[A-Za-z]:/.test(path) ? path.slice(1) : path
+        }
+        const system = new URL('../node_modules/@deepseek-ai/dsh/config/agent-presets/', base)
+        const own = new URL('./node_modules/@banbolee/dsh-fish-shell/presets/', base)
+        return [
+          { path: resolvePath(system), trust: 'system' },
+          { path: resolvePath(own), trust: 'system' },
+        ]
+      })()

package/index.js

@@ -0,0 +1,75 @@
+/**
+ * Fish sandbox executor for DeepSeek Harness: a `SandboxBashExecutor`
+ * subclass that confines `fish -c` commands instead of `bash -c`. Mounted as
+ * the `ctx.shell` provider in place of the base `bash-sandbox` executor.
+ *
+ * `SandboxBashExecutor.run`/`start` bypass `confine()` in
+ * `danger-full-access` mode and fall through to the hardcoded `bash -c`
+ * argv, so this subclass overrides both entry points: the full-access branch
+ * runs `fish -c` through `runArgv`/`startArgv`, while confined modes delegate
+ * to the base class (which calls the polymorphic `confine()`). The sandbox
+ * backend, denial classification, runner-failure facts, and the
+ * `sandboxMode` capability fact (which `dsh-permission-presets` requires of
+ * the mounted executor) are all inherited.
+ *
+ * `@deepseek-ai/dsh-bash-sandbox` resolves through the launcher-maintained
+ * `profiles/node_modules` symlink chain, so this subclass shares the exact
+ * runtime instance the harness runs — no duplicate Cordis or Service class
+ * copies.
+ *
+ * @module @banbolee/dsh-fish-shell
+ */
+
+import { SandboxBashExecutor } from '@deepseek-ai/dsh-bash-sandbox'
+
+/**
+ * Local fish executor under the configured sandbox backend. Reuses every
+ * bash-sandbox mechanic with the public command's shell swapped from bash to
+ * fish.
+ */
+export class FishSandboxExecutor extends SandboxBashExecutor {
+  /**
+   * Run a command in the foreground. Full-access calls run `fish -c`
+   * unconfined (stamping the same sandbox fact the base class would); other
+   * modes delegate to the base class, which confines through
+   * {@link confine}.
+   * @param spec - a resolved spec from `resolve()`.
+   * @returns the settled foreground result.
+   */
+  run(spec) {
+    const policy = spec.sandboxPolicy
+    if (policy?.mode === 'danger-full-access') {
+      return this.runArgv(spec, ['fish', '-c', spec.command]).then((result) => ({
+        ...result,
+        sandbox: { mode: policy.mode, denied: false },
+      }))
+    }
+    return super.run(spec)
+  }
+
+  /**
+   * Start a background process. Full-access calls spawn `fish -c`
+   * unconfined; other modes delegate to the base class.
+   * @param spec - a resolved spec from `resolve()`.
+   * @returns the live background process handle.
+   */
+  start(spec) {
+    const policy = spec.sandboxPolicy
+    if (policy?.mode === 'danger-full-access') {
+      return this.startArgv(spec, ['fish', '-c', spec.command])
+    }
+    return super.start(spec)
+  }
+
+  /**
+   * Confine a `fish -c <command>` argv through the configured sandbox backend.
+   * @param command - the fish command text.
+   * @param policy - the resolved execution policy for this call.
+   * @returns the provider's confined argv and settlement-classification facts.
+   */
+  confine(command, policy) {
+    return this.ctx.sandbox.confine(['fish', '-c', command], policy)
+  }
+}
+
+export default FishSandboxExecutor

package/local.js

@@ -0,0 +1,50 @@
+/**
+ * Unconfined fish executor for DeepSeek Harness: a `LocalBashExecutor`
+ * subclass that runs every command through `fish -c` instead of `bash -c`,
+ * with NO sandbox wrapper.
+ *
+ * This is the `local` row of the fish executor family, mirroring
+ * `@deepseek-ai/dsh-bash-local`: it spawns a managed process group through
+ * `ctx.subprocess` and reuses all of bash-local's mechanics (resolve and
+ * defaulting, deadline and cause classification, the model-friendly terminal
+ * environment, bounded output with spill files, background process groups).
+ *
+ * Prefer {@link FishSandboxExecutor} (this package's default export) in any
+ * composition that mounts `dsh-permission-presets`, which requires the
+ * mounted `ctx.shell` executor to confine (`sandboxMode`). Mount this module
+ * (`@banbolee/dsh-fish-shell/local`) only in custom compositions that deliberately run
+ * without a sandbox.
+ *
+ * `@deepseek-ai/dsh-bash-local` resolves through the launcher-maintained
+ * `profiles/node_modules` symlink chain, so this subclass shares the exact
+ * runtime instance the harness runs.
+ *
+ * @module @banbolee/dsh-fish-shell/local
+ */
+
+import { LocalBashExecutor } from '@deepseek-ai/dsh-bash-local'
+
+/**
+ * Local fish executor without sandbox confinement.
+ */
+export class FishLocalExecutor extends LocalBashExecutor {
+  /**
+   * Run a command in the foreground through `fish -c`.
+   * @param spec - a resolved spec from `resolve()`.
+   * @returns the settled foreground result.
+   */
+  run(spec) {
+    return this.runArgv(spec, ['fish', '-c', spec.command])
+  }
+
+  /**
+   * Start a background process through `fish -c`.
+   * @param spec - a resolved spec from `resolve()`.
+   * @returns the live background process handle.
+   */
+  start(spec) {
+    return this.startArgv(spec, ['fish', '-c', spec.command])
+  }
+}
+
+export default FishLocalExecutor

package/package.json

@@ -0,0 +1,56 @@
+{
+  "name": "@banbolee/dsh-fish-shell",
+  "version": "0.4.0",
+  "description": "Fish shell executors and tool for DeepSeek Harness: run commands with fish instead of bash.",
+  "type": "module",
+  "main": "index.js",
+  "exports": {
+    ".": "./index.js",
+    "./local": "./local.js",
+    "./tool": "./tool.js",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "index.js",
+    "local.js",
+    "tool.js",
+    "cordis.patch.yml",
+    "presets/",
+    "README.md"
+  ],
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    }
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "^4.0.2",
+    "@deepseek-ai/dsh-bash-local": "^0.1.5-rc.1",
+    "@deepseek-ai/dsh-bash-sandbox": "^0.1.5-rc.1",
+    "@deepseek-ai/dsh-home-paths": "^0.1.5-rc.1"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "^4.0.2",
+    "@deepseek-ai/dsh-bash-local": "^0.1.5-rc.1",
+    "@deepseek-ai/dsh-bash-sandbox": "^0.1.5-rc.1",
+    "@deepseek-ai/dsh-home-paths": "^0.1.5-rc.1",
+    "@deepseek-ai/dsh-invariants": "^0.1.5-rc.1",
+    "@deepseek-ai/dsh-scope": "^0.1.5-rc.1",
+    "@deepseek-ai/dsh-shell": "^0.1.5-rc.1"
+  },
+  "keywords": [
+    "dsh",
+    "plugin",
+    "fish",
+    "shell",
+    "bundle"
+  ],
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org"
+  },
+  "engines": {
+    "node": ">=22"
+  }
+}

package/presets/fish/agent.cordis.yml

@@ -0,0 +1,241 @@
+# The `standard` agent preset: the full coding agent, mounted once per process.
+#
+# This file is an AGENT-PLANE composition. The roster mounts it ONCE under a
+# standing scope; every session naming it joins by scope parentage, so the
+# tools and prompt sections registered here cover each joined agent while a
+# session's own state stays keyed per Session/Agent inside the plugins. The
+# host composition (`base.cordis.yml` + `web.cordis.yml`) keeps everything a
+# preset must not own: the registries themselves, the sandbox and approval
+# stack, persistence, and the model route.
+#
+# A service row here MUST sit inside a group carrying an `isolate` realm.
+# Without one it publishes into the root realm, where it is process-global —
+# another preset publishing the same name collides, and a host reader would
+# resolve one preset's instance for every session; `dsh-agent-presets` rejects
+# that at mount. `true` means an entry-local realm: this standing mount's own
+# private instance, apart from every other preset's. (A shared label does NOT
+# pool instances — `provide()` throws on the second registration under the
+# same realm symbol; labels join REALMS, and are not what this file needs.)
+
+# ── identity ────────────────────────────────────────────────────────────────
+
+# The preset's own persona, shadowing the deployment default for this agent.
+# `{{model}}` and `{{cwd}}` resolve from the agent's own route and workspace.
+- id: persona
+  name: '@deepseek-ai/dsh-persona'
+  config:
+    prefix: >-
+      You are a coding agent powered by the {{model}} model. Your working directory is {{cwd}}.
+
+- id: agent-instructions
+  name: '@deepseek-ai/dsh-agent-instructions'
+  config:
+    maxBytes: 65536
+
+# ── shell ───────────────────────────────────────────────────────────────────
+
+# The @banbolee/dsh-fish-shell bundle mounts the model-facing `fish` tool on the HOST
+# plane (global), so this preset carries no shell tool row — agents here see
+# exactly one shell tool, `fish`, and no bash tool. The fish executor
+# (FishSandboxExecutor) supplies ctx.shell on the host plane.
+# ── filesystem ──────────────────────────────────────────────────────────────
+
+# Both register into the host `tools` registry and provide nothing, so
+# they need no realm. The `fs` service and its policy stay in the host.
+- id: tool-fs
+  name: '@deepseek-ai/dsh-tool-fs'
+
+- id: tool-fs-search
+  name: '@deepseek-ai/dsh-tool-fs-search'
+  config:
+    sampleOverCapGlobResults: false
+
+# ── background jobs ────────────────────────────────────────────────────────
+
+# Only the model-facing controls. The task REGISTRY stays on the host plane:
+# its producers sit outside any realm this file could put it in — `tool-bash`
+# above resolves it with `ctx.get`, and an entry-local realm here is invisible
+# to every sibling row, so `run_in_background` would answer "background jobs
+# unavailable" while these controls sat in the catalog. The registry is keyed by
+# owning agent anyway, so one host instance serves every session. What a preset
+# chooses is whether its agent can collect and stop background work at all.
+- id: tool-jobs
+  name: '@deepseek-ai/dsh-tool-jobs'
+
+# ── skills ──────────────────────────────────────────────────────────────────
+
+# The skill REGISTRY lives in the host composition and is layered per scope:
+# these rows register into THIS preset's layer of it, so they need no realm.
+# `skill-filesystem` contributes local-root discovery for agents on this preset, and
+# `tool-skill` gives them the catalog and loader; the merged catalog also
+# carries whatever the deployment registered globally (repository plugins).
+- id: skill-filesystem
+  name: '@deepseek-ai/dsh-skill-filesystem'
+
+- id: tool-skill
+  name: '@deepseek-ai/dsh-tool-skill'
+
+# ── goals ───────────────────────────────────────────────────────────────────
+
+# Only the model-facing tool. The goal SERVICE, its session driver, and the
+# `/goal` command stay on the host plane: the Gateway serves the goal domain as
+# Remote endpoints whose receiver comes from a generated descriptor, so it
+# resolves `goals` on the host and an entry-local realm here would hide it. The
+# registry is keyed by session anyway, so one host instance serves every
+# session. What a preset chooses is whether its agent can call the goal tool.
+- id: tool-goal
+  name: '@deepseek-ai/dsh-tool-goal'
+
+# ── plan mode ───────────────────────────────────────────────────────────────
+
+# Plan state is per-agent by nature, so an entry-local realm is not a
+# workaround here — it is the correct lifetime.
+- id: planning
+  name: cordis:group
+  group: true
+  isolate:
+    planMode: true
+  config:
+    - id: plan-mode
+      name: '@deepseek-ai/dsh-plan-mode'
+      config:
+        section: |
+              You are in plan mode. Stay in plan mode until exit_plan_mode succeeds or the user switches the session mode. Imperative language to implement changes means plan the implementation, not execute it. A user's conversational agreement — including an answer confirming something you asked — approves nothing and does not end plan mode; fold the confirmed decision into the plan and submit it through exit_plan_mode.
+
+              Explore first. Use non-mutating reads, searches, static analysis, and checks to ground the plan in the actual repository. Do not edit or write files, change configuration, run formatters or code generation that rewrites tracked files, commit, or otherwise carry out the plan. Prefer existing functions and patterns over new machinery.
+
+              The tool catalog stays the same across modes for request-cache stability. These plan-mode rules override any later tool description or guidance that suggests using mutation tools; those tools remain listed to keep the tool catalog unchanged. Do not use todo_write to track this planning phase: it tracks implementation after an approved plan, while the plan itself belongs in exit_plan_mode.
+
+              Resolve discoverable facts by inspection. Use ask_user_question only for user-owned choices or material ambiguity that inspection cannot answer. Do not ask the user where code lives or how current behavior works when you can find out.
+
+              Make the plan decision-complete: state the goal and success criteria; group implementation changes by subsystem; identify public API, schema, and data-flow changes; cover edge cases, failure modes, tests, acceptance criteria, and explicit assumptions. Keep it concise enough to review but detailed enough that another engineer can implement it without making design decisions.
+
+              When ready, call exit_plan_mode with the complete plan markdown, starting with a # title. Make exit_plan_mode the only and final tool call in that assistant response: it presents the plan for approval, and implementation begins only in a later step after approval. Do not paste the final plan as a plain reply or ask "should I proceed?" through prose or ask_user_question. If review rejects it, incorporate the feedback and present again. If the review channel is unavailable or aborted, stay in plan mode and ask the user to switch modes manually; do not proceed with implementation.
+
+# ── compaction ──────────────────────────────────────────────────────────────
+
+# `compaction-basic` reads `toolResultPrune` through `ctx.get`, so the pruner must
+# share this realm rather than sit outside it.
+#
+# `tokenMeter` is deliberately NOT in this realm: the meter stays on the HOST
+# plane, and the rows here resolve that one instance. It takes no configuration,
+# keys every fold by Session, and owns the context-meter projection units the
+# browser reads for every session — behind a realm those units would come and go
+# with whichever presets happen to be mounted. What a preset chooses is whether
+# its agent compacts at all, which is `compaction-basic` below.
+- id: compaction
+  name: cordis:group
+  group: true
+  isolate:
+    compaction: true
+    toolResultPruner: true
+  config:
+    - id: compaction-basic
+      name: '@deepseek-ai/dsh-compaction-basic'
+
+    - id: command-compact
+      name: '@deepseek-ai/dsh-command-compact'
+
+    - id: tool-result-pruner
+      name: '@deepseek-ai/dsh-compaction-tool-result-pruner'
+      config:
+        thresholdChars: 8192
+        headChars: 4096
+        tailChars: 1024
+
+# ── delegation and workflows ────────────────────────────────────────────────
+
+# The `subagents` registry and its spawn/fork backends live in the HOST
+# composition: the registry is a process singleton whose cross-session queries
+# the api-proxy serves to the browser, and a provider name may only be
+# registered once. This preset contributes the delegation TOOLS, which resolve
+# that host registry.
+#
+# `workflows` is different — nothing outside an agent reads it — so every row
+# that reaches it shares one entry-local realm here, and a consumer left
+# outside would resolve a host registry this preset does not populate.
+#
+# `tool-subagent-report` is host-plane for the same reason as the registry,
+# not because a preset may not want it: it registers a CONTINUABLE SETUP on
+# that singleton rather than a tool this agent calls, and the setup list is
+# not scope-aware — one copy per mounted preset means every child gets
+# `report` registered once per live session, which throws on the second.
+- id: delegation
+  name: cordis:group
+  group: true
+  isolate:
+    workflowEngine: true
+  config:
+    - id: tool-subagent-control
+      name: '@deepseek-ai/dsh-tool-subagent-control'
+
+    - id: tool-subagent-list-agents
+      name: '@deepseek-ai/dsh-tool-subagent-control/list-agents'
+
+    - id: tool-subagent
+      name: '@deepseek-ai/dsh-tool-subagent'
+      config:
+        provider: spawn
+        toolName: subagent
+        backgroundMode: continuable
+
+    - id: tool-subagent-fork
+      name: '@deepseek-ai/dsh-tool-subagent'
+      config:
+        provider: fork
+        toolName: subagent_fork
+        backgroundMode: continuable
+
+    # Production dsh does not install these optional providers. Install the
+    # matching Bundle in this Profile and restart the Host, then copy this
+    # preset and remove `disabled` from the matching tool row. Host availability
+    # alone grants no tool.
+    - id: tool-subagent-codex
+      name: '@deepseek-ai/dsh-tool-subagent'
+      disabled: true
+      config:
+        provider: codex
+        toolName: subagent_codex
+        backgroundMode: one-shot
+        maxDepth: provider-managed
+
+    - id: tool-subagent-claude-code
+      name: '@deepseek-ai/dsh-tool-subagent'
+      disabled: true
+      config:
+        provider: claude-code
+        toolName: subagent_claude_code
+        backgroundMode: one-shot
+        maxDepth: provider-managed
+
+    - id: workflow-worker-thread
+      name: '@deepseek-ai/dsh-workflow-worker-thread'
+      config:
+        provider: spawn
+
+    - id: tool-workflow
+      name: '@deepseek-ai/dsh-tool-workflow'
+
+    - id: tool-ralph
+      name: '@deepseek-ai/dsh-tool-ralph'
+      config:
+        subagentProvider: spawn
+        maxRounds: 64
+
+# ── remaining model-facing rows ─────────────────────────────────────────────
+
+- id: tool-ask-user
+  name: '@deepseek-ai/dsh-tool-ask-user'
+
+- id: tool-todo
+  name: '@deepseek-ai/dsh-tool-todo'
+  config:
+    allowParallelInProgress: true
+
+# The `web` service and its search provider stay in the host composition; only
+# the model-facing tool is per-session.
+- id: tool-web
+  name: '@deepseek-ai/dsh-tool-web'
+  config:
+    fetch: false
+    searchTimeoutMs: 60000

package/tool.js

@@ -0,0 +1,337 @@
+/**
+ * Model-facing `fish` tool for DeepSeek Harness.
+ *
+ * Registers a `fish` tool that executes commands through the harness `fish`
+ * executor (`ctx.shell`, the {@link FishSandboxExecutor} mounted by this
+ * bundle) instead of spawning its own subprocess. Going through `ctx.shell`
+ * means every call inherits the executor's sandbox confinement, credential
+ * scrub, bounded output collection, timeout clamping, and result facts —
+ * the standalone-spawn version this module used to carry was removed because
+ * it bypassed all of that.
+ *
+ * The tool description teaches fish syntax because models default to bash
+ * idioms; without it, every `export`/`$(...)`/`if then fi` would fail under
+ * fish.
+ *
+ * @module @banbolee/dsh-fish-shell/tool
+ */
+
+import { isAbsolute, resolve } from 'node:path'
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs'
+import { resolveDshHome } from '@deepseek-ai/dsh-home-paths'
+
+export const name = 'fish-tool'
+export const inject = ['tools', 'shell', 'shellEnv']
+
+/**
+ * Bundled fish agent preset: a copy of the shipped `standard` preset with
+ * the shell section removed (the `fish` tool is mounted host-globally by
+ * this plugin, so the preset needs no shell row).
+ */
+const BUNDLED_PRESET_URL = new URL('./presets/fish/agent.cordis.yml', import.meta.url)
+
+/**
+ * Install the bundled fish agent preset under the agent-presets user root,
+ * create-only: an existing target (even a user-edited one) is left alone,
+ * and a failed write is a warning, never a load failure.
+ */
+function installPreset() {
+  const home = resolveDshHome()
+  const targetDir = `${home}/.agent-presets/fish`
+  const target = `${targetDir}/agent.cordis.yml`
+  let exists = true
+  try {
+    readFileSync(target)
+  } catch {
+    exists = false
+  }
+  if (exists) return
+  try {
+    mkdirSync(targetDir, { recursive: true })
+    writeFileSync(target, readFileSync(BUNDLED_PRESET_URL, 'utf8'))
+  } catch (error) {
+    console.warn('@banbolee/dsh-fish-shell: could not install the fish agent preset:', String(error))
+  }
+}
+
+/**
+ * The model-facing tool description. Written from the model's perspective:
+ * the most important fact is that this is FISH, not bash, so the model must
+ * translate bash idioms before running them.
+ */
+const TOOL_DESCRIPTION = `Execute a fish shell command (\`fish -c\`) and return its stdout/stderr. Each call runs in a fresh non-login fish: no state (cwd, variables, functions, history) persists between calls — pass \`workdir\` instead of using \`cd\`. This tool uses the FISH shell, NOT bash; translate bash commands to fish syntax first:
+- Variables: \`set -gx NAME value\` (not \`export NAME=value\`); read them as \`$NAME\`. Use \`env\` to see exported variables.
+- Conditionals/loops: \`if ...; ...; end\`, \`for x in ...; ...; end\`, \`while ...; ...; end\`, \`switch\` instead of \`case\`.
+- Chaining: \`a; and b\` / \`a; or b\` (fish 3 also accepts \`&&\` / \`||\`); background a job with \`cmd &\` and wait with \`wait\`.
+- Command substitution: \`(cmd)\` (fish 3 also accepts \`$(cmd)\`); arithmetic: \`math '1 + 2'\`; string processing: \`string ...\`.
+- Expansion: \`~\`, \`$VAR\`, and globs like \`*.md\` expand; an unmatched glob is an error, not a literal.
+- Commands may run under a file sandbox; a blocked file operation is reported as \`[sandbox: file access denied under <mode> mode]\`.
+- Non-zero exits are reported as \`[exit code: N]\`. Long output is truncated to its tail.
+Bash idioms fish REJECTS with exit 127 — translate before running:
+  \`VAR=x\` / \`export VAR=x\`      → \`set VAR x\` / \`set -gx VAR x\`
+  \`for i in ...; do ...; done\`    → \`for i in ...; ...; end\`
+  \`if [ c ]; then ...; fi\`        → \`if test c; ...; end\`
+  \`cmd <<'EOF' ... EOF\` (heredoc) → \`printf '...' | cmd\` (fish has no heredoc)
+If fish rejects your command, retry with the fish form from the table — failed results carry a [fish syntax] hint naming the exact fix.`
+
+/**
+ * Targeted fish-syntax correction for a failed run. Models default to bash
+ * idioms; when fish rejects a command the stderr carries a diagnostic like
+ * "Unsupported use of '='. In fish, use 'set ...'". Instead of making the
+ * model guess, map the exact diagnostic to the fish form. Returns '' when
+ * there's nothing to correct.
+ */
+const FISH_SYNTAX_HINTS = [
+  {
+    pattern: /Unsupported use of '='\. In fish, please use 'set/i,
+    hint: 'bash assignment `VAR=x` → fish `set VAR x` (export: `set -gx VAR x`)',
+  },
+  {
+    pattern: /Expected a string, but found a redirection/i,
+    hint: 'bash heredoc `cmd <<EOF` has no fish equivalent — use `printf \'...\' | cmd` or `echo ... | cmd`',
+  },
+  {
+    pattern: /Missing end to balance this for loop/i,
+    hint: 'bash `for x in ...; do ...; done` → fish `for x in ...; ...; end`',
+  },
+  {
+    pattern: /Missing end to balance this if/i,
+    hint: 'bash `if [ c ]; then ...; fi` → fish `if test c; ...; end`',
+  },
+  {
+    pattern: /Unexpected end of string, quotes are not balanced/i,
+    hint: 'unbalanced quotes — fish strings must close (`"..."` or `\'...\'`); check escaping',
+  },
+  {
+    pattern: /No matches for wildcard/i,
+    hint: 'unmatched glob is an error in fish — quote the path or check the pattern (e.g. `"*.json"`)',
+  },
+]
+
+/** Find a fish syntax hint for one stderr text, or '' when none applies. */
+function fishSyntaxHint(stderrText) {
+  for (const { pattern, hint } of FISH_SYNTAX_HINTS) {
+    if (pattern.test(stderrText)) return hint
+  }
+  return ''
+}
+
+/**
+ * Shape one finished run into the text the model sees: stdout, then a marked
+ * stderr section, then sandbox/timeout/signal/exit markers — the same marker
+ * contract the harness bash tool uses, so the model reads both shells
+ * identically.
+ * @param {object} result - the settled foreground result from the executor.
+ * @returns {string} the model-facing text.
+ */
+function renderResult(result) {
+  const streamText = (stream) => {
+    if (!stream.truncated) return stream.text
+    return `${stream.text}\n[output truncated${stream.spillPath !== undefined
+      ? `; full output: ${stream.spillPath}`
+      : '; full output: (unavailable)'}]`
+  }
+  const out = streamText(result.stdout)
+  const err = streamText(result.stderr)
+
+  let body = out
+  if (err.length > 0) {
+    if (body.length > 0 && !body.endsWith('\n')) body += '\n'
+    body += `[stderr]\n${err}`
+  }
+  if (body.length === 0) body = '(no output)'
+
+  // When the command failed and fish named a syntax problem, append the exact
+  // correction so the model retries in fish form instead of guessing. The exit
+  // marker alone ("[exit code: 127]") doesn't say how to fix it.
+  const syntaxHint = result.exitCode !== 0 ? fishSyntaxHint(err) : ''
+  if (syntaxHint.length > 0) {
+    if (!body.endsWith('\n')) body += '\n'
+    body += `[fish syntax] ${syntaxHint}`
+  }
+
+  const markers = []
+  if (result.sandbox?.denied) {
+    markers.push(`[sandbox: file access denied under ${result.sandbox.mode} mode]`)
+  }
+  if (result.timedOut) markers.push(`[timed out after ${result.timeoutMs ?? 0}ms]`)
+  if (result.signal !== null) {
+    markers.push(`[killed by signal: ${result.signal}]`)
+  } else if (result.exitCode !== 0) {
+    markers.push(`[exit code: ${result.exitCode}]`)
+  }
+  if (markers.length === 0) return body
+  if (!body.endsWith('\n')) body += '\n'
+  return body + markers.join('\n')
+}
+
+/** Object-root JSON Schema for the tool's parameters (raw-registered). */
+const PARAMETERS = {
+  type: 'object',
+  additionalProperties: false,
+  required: ['command', 'description'],
+  properties: {
+    command: {
+      type: 'string',
+      description: 'The fish command to execute.',
+    },
+    description: {
+      type: 'string',
+      description: 'Clear, concise description of what this command does in active voice, '
+        + '5-10 words (shown in the UI). Examples: "git status" → "Show working tree status".',
+    },
+    workdir: {
+      type: 'string',
+      description: 'Working directory for this command. Defaults to the session workspace; '
+        + 'a relative path is resolved against it.',
+    },
+    timeoutMs: {
+      type: 'number',
+      description: 'Timeout in milliseconds (clamped to the executor\'s configured cap). '
+        + 'The command is killed on expiry.',
+    },
+  },
+}
+
+const OUTPUT = {
+  schema: {
+    type: 'object',
+    additionalProperties: false,
+    required: ['kind', 'exitCode', 'signal', 'timedOut', 'aborted', 'timeoutMs', 'stdout', 'stderr'],
+    properties: {
+      kind: { type: 'string', const: 'foreground' },
+      exitCode: { oneOf: [{ type: 'integer' }, { type: 'null' }] },
+      signal: { oneOf: [{ type: 'string' }, { type: 'null' }] },
+      timedOut: { type: 'boolean' },
+      aborted: { type: 'boolean' },
+      timeoutMs: { type: 'number' },
+      stdout: {
+        type: 'object',
+        additionalProperties: false,
+        required: ['text', 'truncated'],
+        properties: {
+          text: { type: 'string' },
+          truncated: { type: 'boolean' },
+          spillPath: { type: 'string' },
+        },
+      },
+      stderr: {
+        type: 'object',
+        additionalProperties: false,
+        required: ['text', 'truncated'],
+        properties: {
+          text: { type: 'string' },
+          truncated: { type: 'boolean' },
+          spillPath: { type: 'string' },
+        },
+      },
+      sandbox: {
+        type: 'object',
+        additionalProperties: false,
+        required: ['mode', 'denied'],
+        properties: {
+          mode: { type: 'string' },
+          denied: { type: 'boolean' },
+        },
+      },
+    },
+  },
+  render: (_args, value) => [{ type: 'text', text: renderResult(value) }],
+}
+
+/** Resolve an explicit workdir: the sandbox policy's workspace root wins as
+ * the base, then the session cwd; a relative path resolves against it. */
+function resolveWorkdir(modelWorkdir, exec, policyWorkspaceRoot) {
+  const sessionCwd = policyWorkspaceRoot ?? exec?.agent?.session?.header?.cwd
+  if (modelWorkdir === undefined) return sessionCwd
+  if (sessionCwd !== undefined && !isAbsolute(modelWorkdir)) {
+    return resolve(sessionCwd, modelWorkdir)
+  }
+  return modelWorkdir
+}
+
+/**
+ * Cordis plugin entry: install the bundled fish agent preset (an idempotent
+ * user-root fallback for surfaces whose roster row this bundle does not
+ * patch), then register the `fish` tool once the tool registry and the
+ * `fish` executor are up.
+ * @param {import('@deepseek-ai/cordis').Context} ctx - the harness context.
+ */
+export function apply(ctx) {
+  installPreset()
+
+  // Mirror dsh-tool-bash's policy path: when the mounted executor confines,
+  // resolve each call's standing policy against the calling session so
+  // /permission switches and the session workspace are honored, and fail loud
+  // at load when the policy owner is missing.
+  const defaultMode = ctx.shell.sandboxMode
+  const sandboxPolicy = defaultMode === undefined ? undefined : ctx.get('sandboxPolicy')
+  if (defaultMode !== undefined && sandboxPolicy === undefined) {
+    throw new Error('tool-fish: the mounted fish executor confines but ctx.sandboxPolicy is missing')
+  }
+  const resolveSandboxPolicy = (exec) => {
+    if (sandboxPolicy === undefined) return undefined
+    return sandboxPolicy.resolve(exec.agent === undefined ? {} : { session: exec.agent.session })
+  }
+
+  async function execute(args, exec) {
+    if (typeof args.command !== 'string' || args.command.trim().length === 0) {
+      throw new Error('invalid command: expected a non-empty string')
+    }
+    if (typeof args.description !== 'string' || args.description.trim().length === 0) {
+      throw new Error('invalid description: expected a non-empty string')
+    }
+    if (args.timeoutMs !== undefined && (!Number.isFinite(args.timeoutMs) || args.timeoutMs <= 0)) {
+      throw new Error(`invalid timeoutMs: expected a positive number, got ${JSON.stringify(args.timeoutMs)}`)
+    }
+    const standingPolicy = resolveSandboxPolicy(exec)
+    const workdir = resolveWorkdir(args.workdir, exec, standingPolicy?.workspaceRoot)
+    const request = {
+      command: args.command,
+      ...workdir !== undefined ? { workdir } : {},
+      ...args.timeoutMs !== undefined ? { timeoutMs: args.timeoutMs } : {},
+      dshEnv: ctx.shellEnv.collect(exec),
+      ...standingPolicy !== undefined ? { sandboxPolicy: standingPolicy } : {},
+    }
+    const result = await ctx.shell.run(ctx.shell.resolve({
+      ...request,
+      signal: exec?.signal,
+    }))
+    if (result.aborted) {
+      const error = new Error('tool call aborted')
+      error.name = 'AbortError'
+      throw error
+    }
+    const stream = (s) => ({
+      text: s.text,
+      truncated: s.truncated,
+      ...s.spillPath !== undefined ? { spillPath: s.spillPath } : {},
+    })
+    return {
+      kind: 'foreground',
+      exitCode: result.exitCode,
+      signal: result.signal,
+      timedOut: result.timedOut,
+      aborted: result.aborted,
+      timeoutMs: result.timeoutMs,
+      stdout: stream(result.stdout),
+      stderr: stream(result.stderr),
+      ...result.sandbox !== undefined
+        ? { sandbox: { mode: result.sandbox.mode, denied: result.sandbox.denied } }
+        : {},
+    }
+  }
+
+  ctx.tools.register({
+    name: 'fish',
+    description: TOOL_DESCRIPTION,
+    parameters: PARAMETERS,
+    output: OUTPUT,
+    execute,
+  })
+}
+
+// Deterministic test surface: the tool description and the result renderer are
+// pure, so unit tests can assert the bash→fish guidance and the syntax-hint
+// injection without booting a harness or running a live shell.
+export { FISH_SYNTAX_HINTS, TOOL_DESCRIPTION, fishSyntaxHint, renderResult }