@dsh-fly/dsh-plugin-fly-mode 0.0.0-stage → 0.1.3

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 DSH Fly contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,80 @@
-# Temporary Holding Version
+# @dsh-fly/dsh-plugin-fly-mode
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+把 **Fly 安全模式**（agent preset `fly`）作为一个**可安装的 bundle 层**发出去：任何 profile
+装上它之后就能服务 `fly` preset，于是跨 profile 共用的会话库里那些带 `fly` 标签的会话不再是
+"看得见、拿不到"（宿主会抛 `agent-preset/not-found: Unknown agent preset: fly`）。
+
+## 它是什么 / 不是什么
+
+- **是**：一条 `- insert:` 声明（`id: preset-fly`，行表来自 `presets/fly/agent.cordis.yml`）。其中
+  **7 个 Fly 工具**（binary / reverse / pwn / diag / recon / blackbox / guard）的源码**内联在包内
+  `tools/`**，行表用**本包子路径**引用它们 —— 装这个包**不会**在 npm 上再拉这 7 个包；
+  **`fly-smart` 单独一个 plugin**：它是本包 `dependencies` 里**唯一**一项，行表保持裸名，
+  由 npm 装进 profile 的 `node_modules`（它变化最快，且与工作台面板是一个整体，不适合内联）。
+- **不是**：不带 `dsh.client`（模式是 agent 平面，没有浏览器半边）；不带 Fly 工作台
+  （console / diagnostics / netops / plugins / smart-panel 是各自独立的包）；**不带**
+  `dsh-plugin-fly-shell`（那会在别人的 UI 上再画一层 Fly 外壳）。
+- **不写 registry 的 `default:`**：默认模式归上游 `standard`。装上它 ≠ 默认变 fly —— fly
+  只是「设置 → Agent 预设」里多出来的一个可选模式。
+- **不含三模型路由**：`brainRoute` / `handRoute` / `reviewRoute` 是**用户机器**上的状态
+  （`~/.dsh-fly/smart-routes.json`，面板写），本机那份值还是内网 provider。未被配置时工具会
+  大声报错并指路（行配置 `<field>Route` 优先，其次才是工作台抽屉）。
+
+## `cordis.patch.yml` 是生成的，别手改
+
+```bash
+# 在 dsh-fly 仓库里：
+node scripts/build-fly-mode-bundle.mjs --out ../dsh-plugins/dsh-plugin-fly-mode/cordis.patch.yml
+node scripts/build-fly-mode-bundle.mjs --out ../dsh-plugins/dsh-plugin-fly-mode/cordis.patch.yml --check
+```
+
+同源：它跑的是 `dsh-fly` 仓库里 `scripts/lib/fly-profile.mjs` 的 `seedAgentPreset()` —— dev 装配
+（`pnpm setup:profile`）写进 `~/.dsh/profiles/fly/cordis.patch.yml` 的是**同一个函数**的输出。
+`--check` 用于门禁（漂移即红）。
+
+## 发布（0.1.3 起走 tag → OIDC，自动带 provenance）
+
+- **以后每次发版**：升 `version` → 提交 → 打**注释 tag** → 推 tag；`.github/workflows/release.yml`
+  会自动 `npm publish --access public --provenance` —— **不需要 token、不需要 2FA、不需要人工批准**。
+  前提是包的「Settings → Trusted Publisher」按下面配好（**一次即可**）：
+
+  ```
+  Publisher            GitHub Actions
+  Organization or user ethanchen669
+  Repository           dsh-plugin-fly-mode
+  Workflow filename    release.yml        ← 只写文件名，不是 workflow 里的 name:
+  Allowed actions      ☑ Allow npm publish  ← 不勾只会"暂存"，npm publish 会"成功"但什么都不发
+  ```
+
+  重推同一个 tag **不会**重跑 workflow ⇒ 要重跑就换一个新 tag。
+- **首次发布（≤0.1.2）走的是另一条路**：包在 npm 上还不存在 ⇒ 没有 Trusted Publisher 页面可填，
+  只能 `npm stage publish --access public` 再在网页上批准（`stage` 不需要 2FA）。
+  0.1.0 / 0.1.1 已废弃，**0.1.2 是最后一个用 stage 发出去的版本**。
+- **验收三件**（必须**换缓存键**再读：registry 的 packument 会被 CDN 缓存，反复查同一把钥匙只会读到第一次的结果）：
+  ① `dist-tags.latest == 新版本`；② **`dist.attestations` 存在**（= provenance 成了）；
+  ③ `readme` 是**发布那一刻**的快照（改了 README 要等下一次发版才上 npm 页面）。
+- 发布前两条硬要求：`repository.url` 与跑 workflow 的仓库**逐字一致**（`--provenance` 会校验，写错**直接拒发**）；
+  发布目标钉在 `publishConfig.registry = https://registry.npmjs.org/` —— 本机默认 registry 是**内网镜像**。
+
+## 安装
+
+```bash
+# CLI 路径（web 等 profile）；cwd 必须是 DSH_HOME
+cd ~/.dsh
+dsh plugin --profile=web add @dsh-fly/dsh-plugin-fly-mode@0.1.3 --registry=https://registry.npmjs.org/
+```
+
+- 装完**必须重启那个进程**：引擎把层与服务缓存在**进程内**，刷新页面不够。
+- **官方桌面版**归 app 独占（`dsh plugin` 会拒：`profile "desktop" is managed exclusively by the
+  Electron application`）⇒ 在 `~/.dsh/profiles/desktop/` 里 `pnpm add …@0.1.3 --registry=…`，
+  并且要把包名加进 `package.json` 的 **`dsh.profile.bundles`** —— 那一条才让它成为一层
+  （只写 `dependencies` 是不会生效的）。
+
+## 仓库状态（2026-10-11）
+
+- 形状定稿：一条 `- insert:` 声明 + 包内 `tools/`（7 个工具内联，行表用本包子路径引用）+
+  `dsh-plugin-fly-smart` 作为**唯一** npm 依赖。声明由 `dsh-fly` 仓的
+  `scripts/build-fly-mode-bundle.mjs` 生成，门禁用 `--check` 断漂移（含多出来的文件）。
+- `.github/workflows/{ci,release}.yml` **已适配本仓**（纯声明包：不装依赖、直接跑
+  `node scripts/verify.mjs`），CI 已在公开仓实测全绿，含 `fetch-depth: 0` 的**全历史署名硬门**。
+- 身份已按规范设好（仓级 `user.email = ethanchen669@users.noreply.github.com`）。

package/cordis.patch.yml

@@ -0,0 +1,399 @@
+# 由仓库脚本生成，别手改：node scripts/build-fly-mode-bundle.mjs --out <本文件>
+# 同源：这段声明来自 scripts/lib/fly-profile.mjs 的 seedAgentPreset()（dev 装配写进 profile 的
+# 是同一条）；8 个工具的行名被改写成**本包的子路径**（tools/**，随包一起发布）。
+# 门禁用 --check 断言本文件与 tools/** 都 == 生成器输出。
+# 不含三模型路由（用户机器状态）、不写 registry default（默认归上游 standard）。
+- insert:
+    - id: preset-fly
+      name: '@deepseek-ai/dsh-agent-preset'
+      config:
+        id: fly
+        name: "Fly 安全"
+        description: "功能完整的编码 Agent，附带 Fly 安全/CTF 工具链（binary / reverse / pwn / diag / recon）。"
+        order: 10
+        plugins:
+          # Fly 的 agent preset：完整编码 agent + Fly 安全工具链。每个进程挂载一次。
+          #
+          # **怎么被挂上去的**：0.1.7-rc.2 的 `dsh-agent-preset-registry` 只从
+          # `@deepseek-ai/dsh-agent-preset` **声明行**组合 preset；`$DSH_HOME/.agent-presets/`
+          # 已经没人读了。声明行由 `scripts/lib/fly-profile.mjs` 的 `seedAgentPreset()` 从本文件
+          # 生成到 profile 的 patch 层（`- insert:` 一条 `preset-fly`，外加只写一次的 registry
+          # `default: standard` —— **默认模式留给上游**，见那个块里的注释：官方 Web / 官方桌面版
+          # 各自从自己的 profile 读同一个字段，装皮肤的人不该替它们决定默认模式；Fly 模式在
+          # 「设置 → Agent 预设」里可选、可设为默认）。
+          # 改本文件后重跑 `pnpm setup:profile` 即生效。
+          #
+          # This file is an AGENT-PLANE composition. The roster mounts it ONCE under a
+          # standing scope; every session naming it joins by scope parentage, so the
+          # tools and prompt sections registered here cover each joined agent while a
+          # session's own state stays keyed per Session/Agent inside the plugins. The
+          # host composition (`base.cordis.yml` + `web.cordis.yml`) keeps everything a
+          # preset must not own: the registries themselves, the sandbox and approval
+          # stack, persistence, and the model route.
+          #
+          # A service row here MUST sit inside a group carrying an `isolate` realm.
+          # Without one it publishes into the root realm, where it is process-global —
+          # another preset publishing the same name collides, and a host reader would
+          # resolve one preset's instance for every session; `dsh-agent-presets` rejects
+          # that at mount. `true` means an entry-local realm: this standing mount's own
+          # private instance, apart from every other preset's. (A shared label does NOT
+          # pool instances — `provide()` throws on the second registration under the
+          # same realm symbol; labels join REALMS, and are not what this file needs.)
+
+          # ── identity ────────────────────────────────────────────────────────────────
+
+          # The preset's own persona, shadowing the deployment default for this agent.
+          # `{{model}}` and `{{cwd}}` resolve from the agent's own route and workspace.
+          #
+          # `prefix`/`suffix` are the schema (`dsh-persona`: `prefix` required, `suffix`
+          # defaulted, `text` is a *boolean* interpolation switch). A `text: <string>` row
+          # used to sit here: it is not this plugin's config, so the row failed to activate
+          # and — because a preset mounts as one composition — the rejected row took the
+          # whole Fly preset down with it (symptom: sessions that never become composable).
+          - id: persona
+            name: '@deepseek-ai/dsh-persona'
+            config:
+              prefix: You are a coding agent powered by the {{model}} model.
+              suffix: Your working directory is {{cwd}}.
+
+          - id: agent-instructions
+            name: '@deepseek-ai/dsh-agent-instructions'
+            config:
+              maxBytes: 65536
+
+          # ── shell ───────────────────────────────────────────────────────────────────
+
+          # `shell-env` stays in the HOST composition: `apps/cli/src/web.ts` injects it to
+          # publish `DSH_WEB_URL`/`DSH_WEB_MODE`, and a host row that injects a service is
+          # the criterion for host-plane ownership — injection resolves before any session
+          # exists, so there is no agent to key by. Behind a preset realm those variables
+          # never reached the model's shell at all. Both shell tools consume the host
+          # registry from here; their executors (`bash-sandbox`/`pwsh-sandbox`) are
+          # host-plane too.
+          - id: tool-bash
+            name: '@deepseek-ai/dsh-tool-bash'
+            disabled: !!js process.platform === 'win32'
+
+          - id: tool-pwsh
+            name: '@deepseek-ai/dsh-tool-pwsh'
+            disabled: !!js process.platform !== 'win32'
+
+          # ── filesystem ──────────────────────────────────────────────────────────────
+
+          # Both register into the host `tools` registry and provide nothing, so
+          # they need no realm. The `fs` service and its policy stay in the host.
+          - id: tool-fs
+            name: '@deepseek-ai/dsh-tool-fs'
+
+          - id: tool-fs-search
+            name: '@deepseek-ai/dsh-tool-fs-search'
+            config:
+              sampleOverCapGlobResults: false
+
+          # ── background jobs ────────────────────────────────────────────────────────
+
+          # Only the model-facing controls. The task REGISTRY stays on the host plane:
+          # its producers sit outside any realm this file could put it in — `tool-bash`
+          # above resolves it with `ctx.get`, and an entry-local realm here is invisible
+          # to every sibling row, so `run_in_background` would answer "background jobs
+          # unavailable" while these controls sat in the catalog. The registry is keyed by
+          # owning agent anyway, so one host instance serves every session. What a preset
+          # chooses is whether its agent can collect and stop background work at all.
+          - id: tool-jobs
+            name: '@deepseek-ai/dsh-tool-jobs'
+
+          # ── skills ──────────────────────────────────────────────────────────────────
+
+          # The skill REGISTRY lives in the host composition and is layered per scope:
+          # these rows register into THIS preset's layer of it, so they need no realm.
+          # `skill-filesystem` contributes local-root discovery for agents on this preset, and
+          # `tool-skill` gives them the catalog and loader; the merged catalog also
+          # carries whatever the deployment registered globally (repository plugins).
+          #
+          # `customSkillDirs` 借的是官方**创造模式**自带的那四份 skill
+          # （`agent-experience` / `cordis-plugin-development` / `editing-cordis-compositions` /
+          # `cordis-composition-reference`）：它们随 `@deepseek-ai/dsh-agent-preset` 出货，
+          # 创造模式用下面这条完全相同的表达式挂它们（见
+          # `@deepseek-ai/dsh-web-app/presets/cordis.patch.yml` 的 `skill-filesystem` 行）。
+          #
+          # 为什么 Fly 要借：Fly 的定位就是"用 DSH 扩展 DSH"——本仓库的装配（手写 `- insert:`
+          # 补丁 + `fly-bundle.mjs` 打包）与官方创造模式的运行时路径是**同一条**（preset registry
+          # 的 README：新建 preset 只能是 bundle 补丁 + 装上 profile）。这四份 skill 是上游对那条
+          # 路径的说明书，且随包更新；我们自己的 `docs/analysis/dsh-plugin-composition-rules.md`
+          # 是它的手工版本。**门禁**：`acceptance fly-shell` 在真会话的 `/` 菜单里按名过滤出它们
+          # （`/cordis` 与 `/agent-experience` 都要命中、乱敲一个名字必须 0 行）——只声明不生效会红。
+          #
+          # 表达式逐字照抄，别"简化"：`baseUrl` 是 Loader 求值 `!!js` 时的配置基准（app-boot：
+          # `ctx.baseUrl = new URL('.', pathToFileURL(filename)).href`），`createRequire(baseUrl)` 从
+          # **profile 目录**向上找 `@deepseek-ai/dsh-agent-preset`（它在 `profiles/node_modules` 里，
+          # dev 与打包两条路都把引擎闭包铺在那儿），所以不需要新加依赖。
+          - id: skill-filesystem
+            name: '@deepseek-ai/dsh-skill-filesystem'
+            config:
+              customSkillDirs:
+                - !!js process.getBuiltinModule('node:path').join(process.getBuiltinModule('node:path').dirname(process.getBuiltinModule('node:module').createRequire(baseUrl).resolve('@deepseek-ai/dsh-agent-preset/package.json')), 'skills')
+
+          - id: tool-skill
+            name: '@deepseek-ai/dsh-tool-skill'
+
+          # ── goals ───────────────────────────────────────────────────────────────────
+
+          # The goal service and session driver stay on the host plane, where the Gateway
+          # can resolve them. The human command and model-facing tool register into this
+          # preset's scoped layers.
+          - id: command-goal
+            name: '@deepseek-ai/dsh-command-goal'
+
+          - id: tool-goal
+            name: '@deepseek-ai/dsh-tool-goal'
+
+          # ── plan mode ───────────────────────────────────────────────────────────────
+
+          # Plan state is per-agent by nature, so an entry-local realm is not a
+          # workaround here — it is the correct lifetime.
+          - id: planning
+            name: cordis:group
+            group: true
+            isolate:
+              planMode: true
+            config:
+              - id: plan-mode
+                name: '@deepseek-ai/dsh-plan-mode'
+                config:
+                  section: |
+                        You are in plan mode. Stay in plan mode until exit_plan_mode succeeds or the user switches the session mode. Imperative language to implement changes means plan the implementation, not execute it. A user's conversational agreement — including an answer confirming something you asked — approves nothing and does not end plan mode; fold the confirmed decision into the plan and submit it through exit_plan_mode.
+
+                        Explore first. Use non-mutating reads, searches, static analysis, and checks to ground the plan in the actual repository. Do not edit or write files, change configuration, run formatters or code generation that rewrites tracked files, commit, or otherwise carry out the plan. Prefer existing functions and patterns over new machinery.
+
+                        The tool catalog stays the same across modes for request-cache stability. These plan-mode rules override any later tool description or guidance that suggests using mutation tools; those tools remain listed to keep the tool catalog unchanged. Do not use todo_write to track this planning phase: it tracks implementation after an approved plan, while the plan itself belongs in exit_plan_mode.
+
+                        Resolve discoverable facts by inspection. Use ask_user_question only for user-owned choices or material ambiguity that inspection cannot answer. Do not ask the user where code lives or how current behavior works when you can find out.
+
+                        Make the plan decision-complete: state the goal and success criteria; group implementation changes by subsystem; identify public API, schema, and data-flow changes; cover edge cases, failure modes, tests, acceptance criteria, and explicit assumptions. Keep it concise enough to review but detailed enough that another engineer can implement it without making design decisions.
+
+                        When ready, call exit_plan_mode with the complete plan markdown, starting with a # title. Make exit_plan_mode the only and final tool call in that assistant response: it presents the plan for approval, and implementation begins only in a later step after approval. Do not paste the final plan as a plain reply or ask "should I proceed?" through prose or ask_user_question. If review rejects it, incorporate the feedback and present again. If the review channel is unavailable or aborted, stay in plan mode and ask the user to switch modes manually; do not proceed with implementation.
+
+          # ── compaction ──────────────────────────────────────────────────────────────
+
+          # `compaction-basic` reads `toolResultPrune` through `ctx.get`, so the pruner must
+          # share this realm rather than sit outside it.
+          #
+          # `tokenMeter` is deliberately NOT in this realm: the meter stays on the HOST
+          # plane, and the rows here resolve that one instance. It takes no configuration,
+          # keys every fold by Session, and owns the context-meter projection units the
+          # browser reads for every session — behind a realm those units would come and go
+          # with whichever presets happen to be mounted. What a preset chooses is whether
+          # its agent compacts at all, which is `compaction-basic` below.
+          - id: compaction
+            name: cordis:group
+            group: true
+            isolate:
+              compaction: true
+              toolResultPruner: true
+            config:
+              - id: compaction-basic
+                name: '@deepseek-ai/dsh-compaction-basic'
+
+              - id: command-compact
+                name: '@deepseek-ai/dsh-command-compact'
+
+              - id: tool-result-pruner
+                name: '@deepseek-ai/dsh-compaction-tool-result-pruner'
+                config:
+                  thresholdChars: 8192
+                  headChars: 4096
+                  tailChars: 1024
+
+          # ── delegation and workflows ────────────────────────────────────────────────
+
+          # The `subagents` registry and its spawn/fork backends live in the HOST
+          # composition: the registry is a process singleton whose cross-session queries
+          # the api-proxy serves to the browser, and a provider name may only be
+          # registered once. This preset contributes the delegation TOOLS, which resolve
+          # that host registry.
+          #
+          # `workflows` is different — nothing outside an agent reads it — so every row
+          # that reaches it shares one entry-local realm here, and a consumer left
+          # outside would resolve a host registry this preset does not populate.
+          - id: delegation
+            name: cordis:group
+            group: true
+            isolate:
+              workflowEngine: true
+            config:
+              - id: tool-subagent-control
+                name: '@deepseek-ai/dsh-tool-subagent-control'
+
+              - id: tool-subagent-list-agents
+                name: '@deepseek-ai/dsh-tool-subagent-control/list-agents'
+
+              - id: tool-subagent
+                name: '@deepseek-ai/dsh-tool-subagent'
+                config:
+                  provider: spawn
+                  toolName: subagent
+                  modelSelectionSettings: true
+                  backgroundMode: continuable
+
+              # Fork omits model selection so provider/model stay equal to the parent and
+              # the inherited history remains eligible for KV Cache reuse. This preset
+              # keeps fork continuable; parent and child inherit the same messaging tool,
+              # while the parent id and return guidance follow the inherited history.
+              - id: tool-subagent-fork
+                name: '@deepseek-ai/dsh-tool-subagent'
+                config:
+                  provider: fork
+                  toolName: subagent_fork
+                  backgroundMode: continuable
+
+              # Production dsh does not install these optional providers. Install the
+              # matching Bundle in this Profile and restart the Host, then copy this
+              # preset and remove `disabled` from the matching tool row. Host availability
+              # alone grants no tool.
+              - id: tool-subagent-codex
+                name: '@deepseek-ai/dsh-tool-subagent'
+                disabled: true
+                config:
+                  provider: codex
+                  toolName: subagent_codex
+                  backgroundMode: one-shot
+                  maxDepth: provider-managed
+
+              - id: tool-subagent-claude-code
+                name: '@deepseek-ai/dsh-tool-subagent'
+                disabled: true
+                config:
+                  provider: claude-code
+                  toolName: subagent_claude_code
+                  backgroundMode: one-shot
+                  maxDepth: provider-managed
+
+              - id: workflow-ptc
+                name: '@deepseek-ai/dsh-workflow-ptc'
+                config:
+                  provider: spawn
+
+              - id: tool-workflow
+                name: '@deepseek-ai/dsh-tool-workflow'
+
+              - id: tool-ralph
+                name: '@deepseek-ai/dsh-tool-ralph'
+                config:
+                  subagentProvider: spawn
+                  maxRounds: 64
+
+          # ── remaining model-facing rows ─────────────────────────────────────────────
+
+          - id: tool-ask-user
+            name: '@deepseek-ai/dsh-tool-ask-user'
+
+          - id: tool-todo
+            name: '@deepseek-ai/dsh-tool-todo'
+            config:
+              allowParallelInProgress: true
+
+          # The `web` service and its search provider stay in the host composition; only
+          # the model-facing tool is per-session.
+          - id: tool-web
+            name: '@deepseek-ai/dsh-tool-web'
+            config:
+              fetch: true
+              searchTimeoutMs: 60000
+
+          # ── fly security tooling ─────────────────────────────────────────────────────
+
+          # Out-of-tree DSH Fly tool plugins. Like `tool-bash`/`tool-fs` above, each row
+          # registers model-facing tools into the HOST `tools` registry and provides
+          # nothing, so it needs no realm; it CONSUMES the host `shell` seam for sandboxed
+          # command execution (never node:child_process). The packages are installed as
+          # plain profile dependencies (they declare no `dsh.bundle`), and this preset is
+          # what mounts them per session.
+          #
+          # fly-recon registers BOTH a `tools/pre-execute` guard (deny unless
+          # FLY_ALLOW_RECON=1) and its two tools from one apply(), so it is a single row.
+          - id: tool-fly-binary
+            name: '@dsh-fly/dsh-plugin-fly-mode/tools/dsh-plugin-fly-binary/index.js'
+          - id: tool-fly-reverse
+            name: '@dsh-fly/dsh-plugin-fly-mode/tools/dsh-plugin-fly-reverse/index.js'
+          - id: tool-fly-pwn
+            name: '@dsh-fly/dsh-plugin-fly-mode/tools/dsh-plugin-fly-pwn/index.js'
+          - id: tool-fly-diag
+            name: '@dsh-fly/dsh-plugin-fly-mode/tools/dsh-plugin-fly-diag/index.js'
+          - id: tool-fly-recon
+            name: '@dsh-fly/dsh-plugin-fly-mode/tools/dsh-plugin-fly-recon/index.js'
+          # 客户端黑盒排查链（微信小程序实战沉淀）：`bx_proxy` / `bx_flows` / `bx_diff` /
+          # `bx_doctor` / `bx_ca` / `bx_sysproxy` 六个工具 + 包内 `client-blackbox` skill 资产。
+          # 行形状与上面几个 `tool-fly-*` 完全一致（`id` + `name`，**不**写 `inject`）：
+          # 声明面由包自己的 `export const inject` 决定（本包是 `['tools','shell','skills']`）。
+          # 为什么要在注释里点明 `skills`：skill provider 是在 `apply(ctx)` 里用
+          # `ctx.skills.registerProvider()` 注册的 —— 包上漏写 `skills`，引擎就不会把
+          # `ctx.skills` 交给它，apply 里那一步直接抛 ⇒ **整棵 preset 挂载被拒**（不是少一个
+          # skill，是整个 Fly 会话起不来）。门禁 `verify blackbox` 第 7/19 条同时盯
+          # "inject 恰好是这三项"与"preset 里有这一行"。
+          # 起停代理 / 主动探测 / 改系统代理走 `FLY_ALLOW_INTERCEPT=1` 授权门；只读面永远可用。
+          - id: tool-fly-blackbox
+            name: '@dsh-fly/dsh-plugin-fly-mode/tools/dsh-plugin-fly-blackbox/index.js'
+          # ── fly smart mode ───────────────────────────────────────────────────────────
+
+          # Smart 模式（docs/smart-mode-design.md）：先设计、后执行、再验收的双模型工作流。
+          # 它只注册工具、自己不提供服务，所以和上面几行一样是普通行、不需要 realm；每个会话
+          # 的当前任务以 agent.session 为键记在插件闭包里，会话之间不串。除了九个工具，这一行还挂
+          # 纪律 section（`fly-smart:policy`）与宿主平面的 `/smart` 命令（官方 `/goal` 同款：
+          # 宿主 `commands` 注册表 + 本行 ctx 的 scoped layer），因此声明面是
+          # `inject = ['tools', 'commands', 'systemPrompt']` —— 少一个都会在 apply 里抛，
+          # 而抛 = 整棵 preset 挂载被拒（S6 根因，§12.6）。两个模型路由
+          # （brainRoute/handRoute）留给设置行配置。
+          - id: tool-fly-smart
+            name: dsh-plugin-fly-smart
+            config:
+              enabled: true
+              # 返工额度是**每阶段**的：一个阶段反复迭代不该把后面阶段的预算吃掉。额度耗尽不是强制
+              # 收尾 —— 门会把它交回用户（选「退回重做」＝同意再加一个预算），详见 docs/smart-mode-design.md。
+              maxRework: 5
+              requireConsult: true
+
+          # ── 改自己：官方创造模式的能力 + Fly 的门 ───────────────────────────────────
+          #
+          # `present`：把工作区里的文件声明成「交付物」（官方 `@deepseek-ai/dsh-tool-present`）。宿主平面的
+          # `FILE_REFERENCE_PROMPT` 明确要求用它、而不是在回复里贴长文件；官方那两个 preset 都带这一行
+          # （`presets/cordis.patch.yml` 与 `presets/standard.patch.yml` 各一份，逐字相同），而我们此前没有 ——
+          # 尺子（`scripts/tests/preset-relation.spec.mjs`）把它记成 `DECLARED_MISSING`，所以它是一条**可见**的
+          # 偏差，而不是悄悄少一行。现在补齐：Fly 相对 `standard` 不再缺任何一行。
+          # 判据两面都断（`acceptance fly-shell`）：mounted preset 里真的有这一行；并且把上游那个包真
+          # `apply()` 一遍 —— 注册出名为 `present` 的工具、`inject` 三个服务、配置不合法必须抛。
+          # 只断"行在"会漏掉"包解析不到/挂不上"这一半（那正是 preset 行最常见的失败形状）。
+          - id: present
+            name: '@deepseek-ai/dsh-tool-present'
+
+          # 这一段是"Fly 安全 × 官方创造模式"的交点。两者是同一个 registry 里的**兄弟**（同样的
+          # `dsh-agent-preset` 声明行、同一棵 profile 树，`packages/dsh-plugin-fly-plugins` 的面板里
+          # 并排显示）：官方创造模式（preset `cordis`）＝ 标准 preset **加上"能改自己"的那两样**，
+          # 也就是下面这一行 cordis 组合工具与一行 plugin_manager。
+          #
+          # 我们的差异只在**门**上。创造模式那一层的授权面就是会话的沙箱模式 + 逐次审批 ——
+          # 而本机实测这两项是 `danger-full-access` + 审批 `never`，等于**没有门**；`plugin_manager`
+          # 能把包写进 profile、能让**会在宿主进程里跑起来**的代码落地，且跨会话存活。
+          # 所以 Fly 补一道自己的门：`packages/dsh-plugin-fly-guard`（默认全拒写入，只读面照旧；
+          # 人要显式给宿主设 `FLY_ALLOW_PROFILE_WRITE=1` 才放行）。这就是"Fly 安全是创造能力的护栏"。
+          #
+          # `@deepseek-ai/dsh-tool-cordis/host` 已经在宿主平面上注册过一次（`dsh-web-app` 的 patch
+          # 层，上游注释点名了这条重复 id 的坑），所以这里**只**挂 agent 半边。
+          - id: tool-cordis
+            name: '@deepseek-ai/dsh-tool-cordis'
+
+          # `disabled:` 那一行逐字照抄官方创造模式的同名行。判据：`profileContext` 由宿主提供
+          # （`dsh/lib/profile-boot-*.js` 里 `hostCtx.provide('profileContext', …)`），而会话上下文
+          # **看得见**宿主服务（反向不通，见 AGENTS.md 平面隔离那条），所以在 profile 里它恒为"启用"；
+          # 在没有任何 profile 的裸上下文里它会自动关掉 —— 那里没有 `pluginManager` 服务，
+          # 硬挂会让**整棵 preset 挂载被拒**（不是少一个工具，是整个 Fly 会话起不来）。
+          - id: tool-plugin-manager
+            name: '@deepseek-ai/dsh-plugin-manager/tools'
+            disabled: !!js "!ctx.get('profileContext')"
+
+          # 这道门自己。它不注册任何工具（只挂 `tools/pre-execute` 的 waterfall），但仍是一行 preset 行：
+          # 门必须与它管的东西在同一个 scope 里（`inject: ['tools']`）。行 id 用 `tool-` 前缀不是口味问题 ——
+          # `scripts/lib/fly-profile.mjs` 的 `toolPackages` 是装配的唯一实现，门禁（含
+          # `verify-fly-profile.mjs` 的"preset 挂上全部 N 行"）**从它派生**行名，凭喜好起名会让那条断言看不见这一行。
+          - id: tool-fly-guard
+            name: '@dsh-fly/dsh-plugin-fly-mode/tools/dsh-plugin-fly-guard/index.js'
+# <<< fly-agent-preset

package/package.json

@@ -1,6 +1,34 @@
 {
   "name": "@dsh-fly/dsh-plugin-fly-mode",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.3",
+  "description": "Fly 安全模式（agent preset `fly`）作为一个可安装的包：自带 7 个 Fly 工具（源码内联在包内 tools/，行表用本包子路径引用），并依赖单独发布的 dsh-plugin-fly-smart；装进任何 profile 后那里就能服务 fly preset。",
+  "type": "module",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ethanchen669/dsh-plugin-fly-mode.git"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "files": [
+    "cordis.patch.yml",
+    "README.md",
+    "tools"
+  ],
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    }
+  },
+  "scripts": {
+    "verify": "node scripts/verify.mjs"
+  },
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org/",
+    "access": "public"
+  },
+  "dependencies": {
+    "dsh-plugin-fly-smart": "^0.1.0"
+  }
+}