@eddyskywalker/dsh-chatgpt-subscription 0.58.0 → 0.60.0

package/lib/codemode.js

@@ -0,0 +1,1952 @@
+import { n as PLUGIN_MESSAGE_SOURCE_KIND } from "./llm-compat-u9mor0uu.js";
+import { createUserMessage } from "@deepseek-ai/dsh-llm";
+import { NativeToolExecutor } from "@deepseek-ai/dsh-tool-executor-native";
+import { AsyncLocalStorage } from "node:async_hooks";
+//#region src/host/codemode/discovery.ts
+/**
+* 造三个发现工具（外加可选的 `code_debug`）。
+*
+* @param rules - 已归一化的规则。
+* @param catalog - 当前清单的读取函数。
+* @param debug - 调试信息读取函数（`code_debug` 用）。
+* @returns 原始工具定义数组。
+*/
+function createDiscoveryDefinitions(rules, catalog, debug) {
+	const [listTool, searchTool, describeTool, debugTool] = rules.options.metaTools;
+	const definitions = [];
+	if (listTool !== void 0) definitions.push(listDefinition(listTool, catalog));
+	if (searchTool !== void 0) definitions.push(searchDefinition(searchTool, rules, catalog));
+	if (describeTool !== void 0) definitions.push(describeDefinition(describeTool, catalog));
+	if (rules.options.debug && debugTool !== void 0) definitions.push(debugDefinition(debugTool, debug));
+	return definitions;
+}
+/** `code_tools_list`：整份清单（含被遮蔽的）。 */
+function listDefinition(name, catalog) {
+	return {
+		name,
+		description: "List every tool this session can call from a program, including the ones hidden from the model list.",
+		parameters: {
+			type: "object",
+			additionalProperties: false,
+			properties: { namespace: {
+				type: "string",
+				description: "Only tools of this namespace (MCP server name, or \"plugin\")."
+			} }
+		},
+		output: {
+			schema: {
+				type: "object",
+				additionalProperties: false,
+				required: ["tools"],
+				properties: { tools: {
+					type: "array",
+					items: {
+						type: "object",
+						additionalProperties: false,
+						required: [
+							"name",
+							"description",
+							"namespace"
+						],
+						properties: {
+							name: { type: "string" },
+							description: { type: "string" },
+							namespace: { type: "string" }
+						}
+					}
+				} }
+			},
+			render: (_args, value) => [{
+				type: "text",
+				text: value.tools.map((hit) => hit.name + "  [" + hit.namespace + "]  " + hit.description).join("\n")
+			}]
+		},
+		async execute(args) {
+			const namespace = namespaceOf(args);
+			return { tools: catalog().filter((entry) => namespace === void 0 || namespaceOfName(entry.name) === namespace).map((entry) => ({
+				name: entry.name,
+				description: clip(entry.description),
+				namespace: namespaceOfName(entry.name)
+			})) };
+		}
+	};
+}
+/** `code_tools_search`：按名字 / 描述排序检索，返回完整参数 schema。 */
+function searchDefinition(name, rules, catalog) {
+	return {
+		name,
+		description: "Rank callable tools against a free-text query and return their full parameter schemas. The intended first step before calling a hidden tool.",
+		parameters: {
+			type: "object",
+			additionalProperties: false,
+			required: ["query"],
+			properties: {
+				query: {
+					type: "string",
+					description: "What you need, in words."
+				},
+				limit: {
+					type: "number",
+					description: "Maximum rows (default 8)."
+				},
+				namespace: {
+					type: "string",
+					description: "Only tools of this namespace."
+				}
+			}
+		},
+		output: {
+			schema: {
+				type: "object",
+				additionalProperties: false,
+				required: ["tools"],
+				properties: {
+					fallback: {
+						type: "boolean",
+						description: "True when nothing matched and the rows are a namespace browse instead."
+					},
+					tools: {
+						type: "array",
+						items: {
+							type: "object",
+							additionalProperties: false,
+							required: [
+								"name",
+								"description",
+								"parameters"
+							],
+							properties: {
+								name: { type: "string" },
+								description: { type: "string" },
+								parameters: {}
+							}
+						}
+					}
+				}
+			},
+			render: (_args, value) => [{
+				type: "text",
+				text: value.tools.length === 0 ? "No tool matched that query, and this session has no tools to browse." : (value.fallback === true ? "No exact match. These are the callable tools, grouped by namespace — call one by exact name, or refine the query:" : "") + value.tools.map((hit) => hit.name + "\n  " + hit.description + "\n  parameters: " + safeJson(hit.parameters)).join("\n\n")
+			}]
+		},
+		async execute(args) {
+			const record = typeof args === "object" && args !== null ? args : {};
+			const query = typeof record["query"] === "string" ? record["query"] : "";
+			const rawLimit = record["limit"];
+			const limit = typeof rawLimit === "number" && Number.isFinite(rawLimit) && rawLimit > 0 ? Math.floor(rawLimit) : 8;
+			const namespace = namespaceOf(args);
+			const candidates = catalog().filter((entry) => namespace === void 0 || namespaceOfName(entry.name) === namespace);
+			const terms = [...new Set(tokenize(query))];
+			const { indexed, documentFrequency } = buildIndex(candidates);
+			const scored = [];
+			for (const item of indexed) {
+				const score = scoreOf(item, terms, documentFrequency, indexed.length, query);
+				if (terms.length > 0 && score <= 0) continue;
+				scored.push({
+					indexed: item,
+					score
+				});
+			}
+			scored.sort((left, right) => right.score - left.score || left.indexed.entry.name.localeCompare(right.indexed.entry.name));
+			const hits = scored.slice(0, limit);
+			if (hits.length > 0) return { tools: hits.map((row) => ({
+				name: row.indexed.entry.name,
+				description: clip(row.indexed.entry.description),
+				parameters: row.indexed.entry.parameters
+			})) };
+			return {
+				tools: browseByNamespace(candidates, limit),
+				fallback: true
+			};
+		}
+	};
+}
+/** `code_tools_describe`：一个工具的完整描述与参数 schema。 */
+function describeDefinition(name, catalog) {
+	return {
+		name,
+		description: "Describe one callable tool by exact name: its description and complete parameter schema.",
+		parameters: {
+			type: "object",
+			additionalProperties: false,
+			required: ["name"],
+			properties: { name: {
+				type: "string",
+				description: "Exact tool name."
+			} }
+		},
+		output: {
+			schema: {
+				type: "object",
+				additionalProperties: false,
+				required: ["found"],
+				properties: {
+					found: { type: "boolean" },
+					name: { type: "string" },
+					description: { type: "string" },
+					parameters: {}
+				}
+			},
+			render: (_args, value) => [{
+				type: "text",
+				text: value.found !== true ? "No tool named that is callable from this session." : String(value.name) + "\n" + String(value.description) + "\nparameters: " + safeJson(value.parameters)
+			}]
+		},
+		async execute(args) {
+			const record = typeof args === "object" && args !== null ? args : {};
+			const wanted = typeof record["name"] === "string" ? record["name"] : "";
+			const entry = catalog().find((row) => row.name === wanted);
+			if (entry === void 0) return { found: false };
+			return {
+				found: true,
+				name: entry.name,
+				description: clip(entry.description),
+				parameters: entry.parameters
+			};
+		}
+	};
+}
+/** `code_debug`：最近若干次 describe 决策（只在程序内可见）。 */
+function debugDefinition(name, debug) {
+	return {
+		name,
+		description: "Read the last few catalog decisions of this preset (visible vs hidden tool names). Diagnostics only.",
+		parameters: {
+			type: "object",
+			additionalProperties: false,
+			properties: { limit: {
+				type: "number",
+				description: "Maximum entries (default 5)."
+			} }
+		},
+		output: {
+			schema: {
+				type: "object",
+				additionalProperties: false,
+				required: ["entries"],
+				properties: { entries: {
+					type: "array",
+					items: {}
+				} }
+			},
+			render: (_args, value) => [{
+				type: "text",
+				text: safeJson(value.entries)
+			}]
+		},
+		async execute(args) {
+			const record = typeof args === "object" && args !== null ? args : {};
+			const limit = typeof record["limit"] === "number" && record["limit"] > 0 ? Math.floor(record["limit"]) : 5;
+			const all = debug();
+			return { entries: Array.isArray(all) ? all.slice(-limit) : [all] };
+		}
+	};
+}
+/** 读一个可选 namespace 参数。 */
+function namespaceOf(args) {
+	if (typeof args !== "object" || args === null) return void 0;
+	const value = args["namespace"];
+	return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
+}
+/**
+* 零命中时的兜底浏览：按 namespace 分组，每组给出若干名字。
+*
+* 一次失败的检索不该让模型空手而归——它多半只会换词再搜一次，或者干脆瞎猜名字。
+* 这里直接给出分好组的清单，等于把「再搜」换成「挑一个」。
+*
+* @param entries - 当前清单。
+* @param limit - 总行数上限。
+* @returns 与命中同形的行。
+*/
+function browseByNamespace(entries, limit) {
+	const groups = /* @__PURE__ */ new Map();
+	for (const entry of entries) {
+		const namespace = namespaceOfName(entry.name);
+		const bucket = groups.get(namespace);
+		if (bucket === void 0) groups.set(namespace, [entry]);
+		else bucket.push(entry);
+	}
+	const ordered = [...groups.entries()].sort((left, right) => right[1].length - left[1].length || left[0].localeCompare(right[0]));
+	const rows = [];
+	for (const [namespace, bucket] of ordered) for (const entry of bucket.slice(0, 2)) {
+		if (rows.length >= limit) return rows;
+		rows.push({
+			name: entry.name,
+			description: clip(namespace + ": " + entry.description),
+			parameters: entry.parameters
+		});
+	}
+	return rows;
+}
+/** 一个工具名所属的 namespace。 */
+function namespaceOfName(name) {
+	if (!name.startsWith("mcp__")) return "plugin";
+	const rest = name.slice(5);
+	const cut = rest.indexOf("__");
+	return cut < 0 ? rest : rest.slice(0, cut);
+}
+/**
+* 中日韩文字范围：扩展 A、基本区、兼容表意文字、日文假名、韩文音节。
+*
+* 用 fromCharCode 拼而不写转义：这个字符类写错一层反斜杠不会报错，只会让中日韩
+* 分词整条静默失效（查询被切成空 token，然后按字母序返回一堆无关工具）。
+*/
+const CJK_RUN = new RegExp("[" + String.fromCharCode(13312) + "-䶿一-鿿豈-﫿぀-ヿ가-힯]+", "g");
+/** 英文 / 数字词。 */
+const WORD_RUN = /[a-z0-9]+/g;
+/**
+* 分词：拉丁词按词切，中日韩按单字 + 二元组（作为分词器的廉价替代）。
+*
+* **刻意不做中英对照**。工具的检索词来自工具自己（名字、描述、参数名），跨语言
+* 落差交给模型：说明段明确要求用英文关键词检索，而模型本来就会翻译。一张手写的
+* 同义词表只能覆盖写表的人想到的那几个词，覆盖率永远是问号，维护成本却是常态。
+*
+* @param text - 任意文本（工具名、描述、参数名或查询）。
+* @returns 查询词。
+*/
+function tokenize(text) {
+	const value = String(text ?? "").toLowerCase();
+	const tokens = [];
+	for (const word of value.match(WORD_RUN) ?? []) tokens.push(word);
+	for (const run of value.match(CJK_RUN) ?? []) {
+		if (run.length === 1) tokens.push(run);
+		for (let index = 0; index + 1 < run.length; index += 1) tokens.push(run.slice(index, index + 2));
+	}
+	return tokens;
+}
+/**
+* 参数名也是强信号：`instId`、`sql`、`channel` 这类词往往只出现在参数里，而它恰恰是
+* 用户或模型用来定位工具的那个词。
+*
+* @param parameters - 工具的参数 JSON Schema。
+* @returns 参数名分词。
+*/
+function parameterTokens(parameters) {
+	const tokens = [];
+	for (const key of propertiesOf(parameters)) tokens.push(...tokenize(key));
+	return tokens;
+}
+/**
+* 读出一个工具参数 schema 的属性名。
+*
+* @param parameters - 参数 JSON Schema。
+* @returns 属性名数组（没有时为 `[]`）。
+*/
+function propertiesOf(parameters) {
+	if (typeof parameters !== "object" || parameters === null) return [];
+	const properties = parameters.properties;
+	if (typeof properties !== "object" || properties === null) return [];
+	return Object.keys(properties);
+}
+/**
+* 参数名里是否存在与查询词**完全相同**的键。
+*
+* 索引只留了参数名的分词，丢掉了「原始键名」，所以这里在索引项上多存一份原始键名集合，
+* 只用于给完全匹配再加一点权重。
+*
+* @param indexed - 索引项。
+* @param term - 查询词。
+* @returns 命中时 1，否则 0。
+*/
+function rawParameterHit(indexed, term) {
+	return indexed.parameterNames.has(term) ? 1 : 0;
+}
+/**
+* 把一份清单建成检索索引，并给出每个词的文档频率（用于降噪加权）。
+*
+* @param entries - 当前清单。
+* @returns 索引项与词 → 出现次数。
+*/
+function buildIndex(entries) {
+	const documentFrequency = /* @__PURE__ */ new Map();
+	const indexed = [];
+	for (const entry of entries) {
+		const name = countOf(tokenize(entry.name));
+		const description = countOf(tokenize(entry.description));
+		const parameters = new Set(parameterTokens(entry.parameters));
+		const parameterNames = new Set(propertiesOf(entry.parameters).map((key) => key.toLowerCase()));
+		indexed.push({
+			entry,
+			name,
+			description,
+			parameters,
+			parameterNames
+		});
+		const seen = /* @__PURE__ */ new Set([
+			...name.keys(),
+			...description.keys(),
+			...parameters
+		]);
+		for (const token of seen) documentFrequency.set(token, (documentFrequency.get(token) ?? 0) + 1);
+	}
+	return {
+		indexed,
+		documentFrequency
+	};
+}
+/** 统计词频。 */
+function countOf(tokens) {
+	const counts = /* @__PURE__ */ new Map();
+	for (const token of tokens) counts.set(token, (counts.get(token) ?? 0) + 1);
+	return counts;
+}
+/**
+* 一个工具的命中分数。
+*
+* 三处命中权重递减：名字 > 参数名 > 描述。每个词再乘一个 idf 权重，让 `ticker`、
+* `candle` 这类稀有词压过 `get`、`list`、`create` 这类几乎每个工具都有的泛词——否则
+* 「看一下 K 线」会被 `get_balance` 抢走（两者都命中 `get`）。
+*
+* @param indexed - 索引项。
+* @param terms - 去重后的查询词。
+* @param documentFrequency - 词 → 文档频率。
+* @param total - 清单规模。
+* @param query - 原始查询（用于整串子串加分）。
+* @returns 分数；0 表示不相关。
+*/
+function scoreOf(indexed, terms, documentFrequency, total, query) {
+	if (terms.length === 0) return 1;
+	let score = 0;
+	for (const term of terms) {
+		const inName = indexed.name.get(term) ?? 0;
+		const inDescription = indexed.description.get(term) ?? 0;
+		const inParameters = indexed.parameters.has(term) ? 1 : 0;
+		const exactParameter = Math.max(0, rawParameterHit(indexed, term));
+		if (inName === 0 && inDescription === 0 && inParameters === 0) continue;
+		const df = documentFrequency.get(term) ?? 1;
+		const weight = Math.log(1 + total / (1 + df));
+		score += weight * (inName > 0 ? 6 + Math.min(inName, 3) : 0);
+		score += weight * (inParameters === 1 ? 3 + exactParameter : 0);
+		score += weight * (inDescription > 0 ? 1 + Math.min(inDescription, 2) * .5 : 0);
+	}
+	const name = indexed.entry.name.toLowerCase();
+	const wanted = query.trim().toLowerCase();
+	if (wanted.length > 0 && (name === wanted || name.endsWith("__" + wanted))) score += 50;
+	else if (wanted.length > 1 && name.includes(wanted)) score += 12;
+	return score;
+}
+/** 截断描述，避免清单输出过长。 */
+function clip(text, max = 240) {
+	const value = String(text ?? "");
+	return value.length <= max ? value : value.slice(0, max - 1) + "…";
+}
+/** 安全 JSON 化。 */
+function safeJson(value) {
+	try {
+		return JSON.stringify(value);
+	} catch {
+		return String(value);
+	}
+}
+/** 发现工具名契约：`[list, search, describe, debug?]`。第一个同时用作 Code Mode 标记。 */
+const DEFAULT_META_TOOLS = Object.freeze([
+	"code_tools_list",
+	"code_tools_search",
+	"code_tools_describe",
+	"code_debug"
+]);
+/** 默认额外遮蔽的名字前缀。 */
+const DEFAULT_HIDDEN_PREFIXES = Object.freeze(["mcp__"]);
+/**
+* 默认始终原生呈现的名字。
+*
+* 恒定系统提示词或子代理运行时契约里点名要求直接调用这些工具（大输出预览补读、调度账本查询、
+* 进展更新汇报、结构化子代理输出提交，以及 Windows 下替代被撤回 `pwsh` 的 `win_bash`）：
+* 遮蔽它们要么让提示词指向模型看不见的名字并触发整批 `UNKNOWN_TOOL` 重跑，要么让会话顶层
+* 失去唯一可用的 Shell。若某个工具当前未在宿主/子会话注册，保留在此集合中不会凭空暴露它。
+*/
+const DEFAULT_NATIVE_TOOLS = Object.freeze([
+	"cache_warmup_result",
+	"dispatch_ledger",
+	"progress_update",
+	"structured_output",
+	"win_bash"
+]);
+/**
+* 把原始配置归一化。
+*
+* @param config - 行配置；`null` / 省略表示默认值。
+* @returns 冻结的配置与集合。
+*/
+function createRules(config) {
+	const options = normalizeConfig(config);
+	return {
+		options,
+		hidden: /* @__PURE__ */ new Set([...options.hiddenTools, ...options.metaTools]),
+		native: /* @__PURE__ */ new Set([...options.nativeTools, options.runToolName])
+	};
+}
+/**
+* 校验并冻结一份配置。
+*
+* @param config - 原始配置。
+* @returns 规范化后的只读配置。
+*/
+function normalizeConfig(config) {
+	const source = config ?? {};
+	const runToolName = nonEmptyString$1(source.runToolName) ?? "code_run";
+	const metaTools = stringList(source.metaTools, DEFAULT_META_TOOLS);
+	if (metaTools.length === 0) throw new TypeError("codemode: metaTools must list at least one tool name");
+	if (metaTools.includes(runToolName)) throw new TypeError("codemode: metaTools must not repeat the transport name");
+	return Object.freeze({
+		nativeScope: source.nativeScope !== false,
+		hiddenPrefixes: Object.freeze(stringList(source.hiddenPrefixes, DEFAULT_HIDDEN_PREFIXES)),
+		nativeTools: Object.freeze(stringList(source.nativeTools, DEFAULT_NATIVE_TOOLS)),
+		hiddenTools: Object.freeze(stringList(source.hiddenTools, [])),
+		metaTools: Object.freeze(metaTools),
+		runToolName,
+		maxParallelSubCalls: positiveInteger(source.maxParallelSubCalls, 10),
+		maxSubCalls: positiveInteger(source.maxSubCalls, 512),
+		explicitMaxSubCalls: typeof source.maxSubCalls === "number" && Number.isInteger(source.maxSubCalls) && source.maxSubCalls > 0,
+		maxSubCallsPerMinute: positiveInteger(source.maxSubCallsPerMinute, 1024),
+		guard: source.guard !== false,
+		sdkSection: source.sdkSection !== false,
+		debug: source.debug !== false
+	});
+}
+/** 作用域不可用时的空视图。 */
+const DISABLED_VIEW = Object.freeze({
+	enabled: false,
+	globalNames: /* @__PURE__ */ new Set(),
+	presetNames: /* @__PURE__ */ new Set()
+});
+/**
+* 判定一个名字是否要从模型清单里剥离。
+*
+* 顺序：显式例外（`nativeTools` / 传输工具 / 发现工具）→ 显式遮蔽
+* （`hiddenTools`）→ 名字前缀 → 作用域归属。
+*
+* 作用域归属只在能确认归属时遮蔽：
+*
+* - 在全局视图里解析得到 → 全局层注册的，遮蔽；
+* - 只在预设视图里解析得到 → 本预设自己注册的，保持原生；
+* - 两处都解析不到 → 只可能注册在本预设之下（agent 层），遮蔽。
+*
+* @param name - 工具名。
+* @param rules - 已归一化的规则。
+* @param view - 归属视图。
+* @returns 要遮蔽时为 `true`。
+*/
+function isMaskedName(name, rules, view) {
+	if (typeof name !== "string" || name.length === 0) return false;
+	if (rules.native.has(name)) return false;
+	if (rules.hidden.has(name)) return true;
+	for (const prefix of rules.options.hiddenPrefixes) if (prefix.length > 0 && name.startsWith(prefix)) return true;
+	if (!rules.options.nativeScope || !view.enabled) return false;
+	if (view.globalNames.has(name)) return true;
+	if (view.presetNames.has(name)) return false;
+	return true;
+}
+/**
+* 汇总被遮蔽的工具。
+*
+* @param names - 被遮蔽的名字。
+* @returns 计数与分组。
+*/
+function summarizeHidden(names) {
+	const groups = /* @__PURE__ */ new Map();
+	for (const name of names) {
+		const mcp = name.startsWith("mcp__") ? name.split("__")[1] : void 0;
+		const namespace = mcp !== void 0 && mcp.length > 0 ? mcp : "plugin";
+		const kind = mcp !== void 0 && mcp.length > 0 ? "mcp" : "plugin";
+		const key = kind + ":" + namespace;
+		const entry = groups.get(key);
+		if (entry === void 0) groups.set(key, {
+			namespace,
+			kind,
+			count: 1
+		});
+		else entry.count += 1;
+	}
+	const namespaces = [...groups.values()].sort((left, right) => right.count - left.count || left.namespace.localeCompare(right.namespace));
+	return {
+		total: names.length,
+		namespaces
+	};
+}
+/**
+* 生成 `tools:sdk` 段的正文。
+*
+* ## 恒定契约
+*
+* 这段正文**只**依赖入参里的两个工具名与部署级的 `language` / `programFormat`。它刻意不含遮蔽
+* 工具的数量、namespace 分布、会话 id 或时间，因此同一部署下逐字节恒定：挂载或卸载
+* MCP 服务端不会改写它，前缀缓存不会因为它失效。
+*
+* @param input - 传输工具名、发现工具名与程序形态。
+* @returns 说明段正文。
+*/
+function buildCodemodeSectionText(input) {
+	const python = input.language === "python";
+	const retained = input.programFormat === "repl";
+	const listTool = input.metaTools[0] ?? "code_tools_list";
+	const searchTool = input.metaTools[1] ?? "code_tools_search";
+	const describeTool = input.metaTools[2] ?? "code_tools_describe";
+	const run = input.runToolName;
+	const example = python ? [
+		"```py",
+		"# standard tools and hidden tools alike",
+		"import asyncio",
+		"files = await tools.glob({\"pattern\": \"src/**/*.ts\"})",
+		"rows = await asyncio.gather(*(tools.read({\"file_path\": f}) for f in files))",
+		"[r.splitlines()[0] for r in rows if \"TODO\" in r]",
+		"```"
+	] : [
+		"```js",
+		"// standard tools and hidden tools alike",
+		"const files = await tools.glob({ pattern: \"src/**/*.ts\" })",
+		"const rows = await Promise.all(files.map((f) => tools.read({ file_path: f })))",
+		retained ? "rows.filter((r) => r.includes(\"TODO\")).map((r) => r.split(\"\\n\")[0])" : "return rows.filter((r) => r.includes(\"TODO\")).map((r) => r.split(\"\\n\")[0])",
+		"```"
+	];
+	return [
+		"## Code Mode",
+		"",
+		"This session runs in Code Mode. The tools in your tool list are called directly, exactly as usual. A second, larger set of tools is deliberately **not** in your context: every MCP tool, and every tool contributed by a plugin outside this preset. Reach them from inside " + run + ".",
+		"",
+		"### Calling tools from a program",
+		"",
+		...example,
+		"",
+		python ? retained ? "- A retained Python REPL: top-level await and a final expression. Its variables and imported modules survive into your later programs in this session." : "- Async Python program: top-level await works; print or evaluate a final expression to produce output." : retained ? "- A retained TypeScript REPL: top-level declarations, await, and a final expression. Its variables and imported modules survive into your later programs in this session." : "- Erasable TypeScript, run as the body of an async function: top-level await and return work.",
+		"- Only what you return or console.log reaches the conversation; every intermediate result stays in the program, so filter and aggregate there instead of returning raw payloads.",
+		"- Prefer batching multi-step read/search chains inside one " + run + " program instead of issuing many sequential single-tool turns.",
+		"- Independent read-only calls may overlap under Promise.all; mutating calls run alone, in submission order.",
+		"- A failed sub-call rejects; try/catch or Promise.allSettled it to keep the calls that succeeded. Completed calls are real side effects and are not rolled back.",
+		"",
+		"### Discovery API (callable from inside a program)",
+		"",
+		"- tools." + listTool + "({ namespace? }) - every callable tool as { name, description, namespace }, hidden ones included.",
+		"- tools." + searchTool + "({ query, limit?, namespace? }) - ranked matches with their full parameter schemas; the intended first step. Query with the English keywords the tool is likely named and described with (tool names and descriptions are English); a phrase in another language is only matched literally.",
+		"- tools." + describeTool + "({ name }) - one tool description and complete parameter schema.",
+		"",
+		"If a hidden tool name is called directly instead of from a program, the call is refused and the refusal names the discovery call to make."
+	].join("\n");
+}
+/** 一个非空字符串，或 `undefined`。 */
+function nonEmptyString$1(value) {
+	return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
+}
+/** 名字列表：省略时用缺省值，拒绝非字符串项与重复项。 */
+function stringList(value, fallback) {
+	if (value === void 0 || value === null) return [...fallback];
+	if (!Array.isArray(value)) throw new TypeError("codemode: expected an array of tool names");
+	const out = [];
+	for (const entry of value) {
+		const name = nonEmptyString$1(entry);
+		if (name === void 0) throw new TypeError("codemode: tool names must be non-empty strings");
+		if (!out.includes(name)) out.push(name);
+	}
+	return out;
+}
+/** 正整数，越界或非法时用缺省值。 */
+function positiveInteger(value, fallback) {
+	if (typeof value !== "number" || !Number.isInteger(value) || value <= 0) return fallback;
+	return value;
+}
+//#endregion
+//#region src/host/codemode/executor.ts
+/**
+* Code Mode 的工具执行器：本包遮蔽与拒绝的唯一接缝。
+*
+* ## 为什么是 executor
+*
+* DSH 0.2.2 把「模型看到的工具清单」的归属权从 `system-prompt/assemble` 瀑布搬到了
+* per-scope `ToolExecutor`：注册表向当前作用域选中的 executor 要 schema，所以
+* `describe()` 就是请求面。它同时解决了归属问题——executor **按作用域链选择**，只有挂
+* 在本预设里的这一份会服务本预设的会话，因此不需要判断「这个 agent 是不是我的」。
+*
+* 三件事：
+*
+* 1. `describe()` 丢掉一切不该出现在模型清单里的名字，其余交给原生 executor 投影；
+* 2. `sections` 提供**恒定**的 Code Mode 说明段（见 rules.ts 的恒定契约）；
+* 3. `execute()` 在派发**之前**拒绝模型对被遮蔽名字的直接调用，其余整批委托给原生
+*    executor——委托而不是重写，是因为手写 pre-policy / 审批 / around-dispatch /
+*    post-execute 管线正是插件静默丢策略的方式。
+*
+* ## 程序内子调用怎么与模型直呼区分
+*
+* 批量 `execute()` 的入参没有 `parent` 字段（执行令牌由注册表自己的管线铸造，插件
+* 造不出来），所以传输层把自己持有的 `AbortSignal` 打上 {@link NESTED_MARK}，并让子调用 id
+* 形如 `<outer>:ptc:<n>`。signal 是模型无法伪造的对象，call id 不可改，两个标记互为兜底。
+*
+* @module @eddyskywalker/dsh-chatgpt-subscription/host/codemode/executor
+*/
+/** 传输层打在 AbortSignal 上的嵌套标记。 */
+const NESTED_MARK = Symbol.for("dsh-chatgpt-subscription.codemode.nested");
+/** 子调用 id 里的一段：`<outer>:ptc:<n>`，与内核自己的命名一致。 */
+const NESTED_CALL_ID_MARKER = ":ptc:";
+/**
+* 给一个 signal 打上嵌套标记。
+*
+* @param signal - 传给 `tools.execute()` 的那一个 signal。
+* @returns 同一个 signal（便于链式使用）。
+*/
+function markNested(signal) {
+	if (signal === void 0) return void 0;
+	try {
+		Object.defineProperty(signal, NESTED_MARK, {
+			value: true,
+			enumerable: false,
+			configurable: true
+		});
+	} catch {}
+	return signal;
+}
+/**
+* 判断一批调用是不是来自程序内部。
+*
+* @param call - 批里的一条调用（结构探测）。
+* @param batchSignal - 批级 signal（`tools.execute()` 只收一份，注册表会复制给每条执行）。
+* @returns 来自程序内部时为 `true`。
+*/
+function isNestedCall(call, batchSignal) {
+	if (isMarked(batchSignal)) return true;
+	if (typeof call !== "object" || call === null) return false;
+	if (isMarked(call.signal)) return true;
+	const id = call.id;
+	return typeof id === "string" && id.includes(":ptc:");
+}
+/** 一个值是否带着本包的嵌套标记。 */
+function isMarked(value) {
+	return typeof value === "object" && value !== null && value[NESTED_MARK] === true;
+}
+/**
+* 造一个 Code Mode 执行器。
+*
+* @param ctx - 本包的行上下文（读取系统提示段的排序位）。
+* @param rules - 已归一化的规则。
+* @param hooks - 归属视图、说明段与委托目标。
+* @returns 执行器。
+*/
+function createCodemodeExecutor(ctx, rules, hooks) {
+	const sectionOrder = sectionOrderOf(ctx);
+	const sections = rules.options.sdkSection ? [{
+		name: "tools:sdk",
+		order: sectionOrder,
+		interpolate: false,
+		text: () => hooks.sectionText()
+	}] : [];
+	const visibleNames = /* @__PURE__ */ new Set();
+	return {
+		sections,
+		describe(tools) {
+			hooks.onCatalog?.(tools ?? []);
+			const view = hooks.view();
+			const visible = [];
+			const masked = [];
+			visibleNames.clear();
+			for (const tool of tools ?? []) {
+				const name = nameOf(tool);
+				if (name === void 0) continue;
+				if (isMaskedName(name, rules, view)) masked.push(name);
+				else {
+					visible.push(tool);
+					visibleNames.add(name);
+				}
+			}
+			hooks.onDescribe?.({
+				visible: [...visibleNames],
+				masked
+			});
+			return hooks.delegate.describe(visible);
+		},
+		async execute(input) {
+			const calls = Array.isArray(input?.calls) ? input.calls : [];
+			const denials = /* @__PURE__ */ new Map();
+			if (rules.options.guard) for (let index = 0; index < calls.length; index += 1) {
+				const reason = denialFor(calls[index], rules, hooks, input?.signal);
+				if (reason !== void 0) denials.set(index, reason);
+			}
+			if (denials.size === 0) return hooks.delegate.execute(input);
+			return {
+				results: calls.map((call, index) => {
+					const callId = idOf(call) ?? "call-" + String(index);
+					const reason = denials.get(index) ?? "This call was not run: the batch also contained a call that is not part of this session tool list. Re-issue it on its own.";
+					return {
+						callId,
+						result: {
+							isError: true,
+							error: {
+								name: "ToolNotFoundError",
+								code: "UNKNOWN_TOOL",
+								message: reason
+							},
+							content: [{
+								type: "text",
+								text: "Error: " + reason
+							}]
+						}
+					};
+				}),
+				additionalContexts: [],
+				concluded: false
+			};
+		}
+	};
+}
+/**
+* 一条模型直呼调用的拒绝理由，或 `undefined` 表示放行。
+*
+* @param call - 批里的一条调用。
+* @param rules - 已归一化的规则。
+* @param hooks - 归属视图与说明段。
+* @param batchSignal - 批级 signal。
+* @returns 拒绝理由或 `undefined`。
+*
+* 判定不读「本步可见名清单」：那份集合是**执行器级**的，多个会话并发时会被后一次 describe
+* 覆盖，用它放行等于给另一个会话开一个不该开的口子。这里只按名字自身的归属判一次。
+*/
+function denialFor(call, rules, hooks, batchSignal) {
+	if (typeof call !== "object" || call === null) return void 0;
+	const name = call.name;
+	if (typeof name !== "string" || name.length === 0) return void 0;
+	if (isNestedCall(call, batchSignal)) return void 0;
+	if (name === rules.options.runToolName) return void 0;
+	if (!isMaskedName(name, rules, hooks.viewForName(name))) return void 0;
+	if (rules.options.metaTools.includes(name)) return "The discovery tool \"" + name + "\" is callable only from inside " + rules.options.runToolName + ": run a program and call await tools." + name + "(...) there.";
+	const searchTool = rules.options.metaTools[1] ?? rules.options.metaTools[0] ?? "code_tools_search";
+	return "The tool \"" + name + "\" is not part of this session tool list. In Code Mode, tools this preset does not own (MCP servers, plugins outside the preset) are reachable only from inside " + rules.options.runToolName + ": call tools." + searchTool + "({ query: \"...\" }) there to discover it, then call it by exact name.";
+}
+/** 读一段工具定义的 ``name``。 */
+function nameOf(tool) {
+	if (typeof tool !== "object" || tool === null) return void 0;
+	const name = tool.name;
+	return typeof name === "string" && name.length > 0 ? name : void 0;
+}
+/** 读一条调用的 id。 */
+function idOf(call) {
+	if (typeof call !== "object" || call === null) return void 0;
+	const id = call.id;
+	return typeof id === "string" && id.length > 0 ? id : void 0;
+}
+/** 取 `tools:sdk` 的排序位；取不到时退回 5000（内核 TOOLS_SDK 的默认位）。 */
+function sectionOrderOf(ctx) {
+	try {
+		const order = (ctx?.get?.("systemPrompt"))?.getSectionOrder?.("TOOLS_SDK");
+		return typeof order === "number" && Number.isFinite(order) ? order : 5e3;
+	} catch {
+		return 5e3;
+	}
+}
+//#endregion
+//#region src/host/codemode/retention.ts
+/**
+* 造一个常驻环境管理器。
+*
+* @param runtimeOf - 读当前运行时的函数（每次调用重读，运行时可能晚于本插件挂载）。
+* @returns 管理句柄。
+*/
+function createRetention(runtimeOf) {
+	const live = /* @__PURE__ */ new Set();
+	const released = /* @__PURE__ */ new WeakSet();
+	const release = async (owner) => {
+		if (released.has(owner)) return;
+		released.add(owner);
+		live.delete(owner);
+		const runtime = runtimeOf();
+		if (runtime?.release === void 0) return;
+		try {
+			await runtime.release(owner);
+		} catch {}
+	};
+	return {
+		owner(agent) {
+			const owner = typeof agent === "object" && agent !== null ? agent : fallbackOwner;
+			released.delete(owner);
+			live.add(owner);
+			return owner;
+		},
+		release,
+		async dispose() {
+			const owners = [...live];
+			await Promise.all(owners.map((owner) => release(owner)));
+		}
+	};
+}
+/** 没有 agent 的调用（例如服务级直调）共用的 owner。 */
+const fallbackOwner = Object.freeze({ kind: "codemode-sessionless" });
+//#endregion
+//#region src/host/codemode/scope.ts
+/**
+* 工具归属判定：一个名字是**全局层**注册的，还是**本预设**注册的。
+*
+* ## 为什么要这么绕
+*
+* 注册表没有公开「某个工具注册在哪个作用域」的 API。`@deepseek-ai/dsh-scope` 把作用域标签
+* 写在一个模块私有的 `Symbol('dsh.scope')` 上，链关系（parent）也在私有 WeakMap 里，
+* 都不导出。能用的只有两件事：
+*
+* 1. 本包自己所在作用域的 key —— 按符号描述从 ctx 上扫出来（{@link findScopeKey}）；
+* 2. 公开的 `ctx.tools.get(name)`（全局视图）与 `ctx.tools.get(name, key)`（该作用域视图）。
+*
+* 于是归属判定变成两次公开查询：
+*
+* - 全局视图能解析 → 全局层（MCP 服务端、profile 级 bundle）；
+* - 只有本预设视图能解析 → 本预设自己注册的；
+* - 两处都解析不到 → 只可能注册在本预设之下（agent 层）。
+*
+* 探测失败（本包被挂在 host 层而不是预设里）时返回 `enabled: false`：规则整体降级为
+* 纯名字匹配，绝不因为读不到归属就误遮蔽。
+*
+* @module @eddyskywalker/dsh-chatgpt-subscription/host/codemode/scope
+*/
+/** 内核写作用域标签用的符号描述。 */
+const SCOPE_SYMBOL_DESCRIPTION = "dsh.scope";
+/**
+* 从一个 ctx 上找出「本包所在作用域」的 key。
+*
+* Cordis 的 scoped context 把作用域标签写成自有（或原型上）的一个 symbol 属性，
+* 描述是 `dsh.scope`。这里按描述扫，不猜符号本身——写法与参考实现一致，因为
+* 直接 `import` 内核的 scope 包在 profile 插件里解析不到。
+*
+* @param ctx - 本包的行上下文。
+* @returns 作用域 key；读不到时为 `undefined`。
+*/
+function findScopeKey(ctx) {
+	if (typeof ctx !== "object" || ctx === null) return void 0;
+	return scanForScope(ctx, 0);
+}
+/** 在对象自身及其原型链上找作用域标签（只看 symbol 属性，深度上限 4）。 */
+function scanForScope(source, depth) {
+	if (depth > 4) return void 0;
+	let symbols;
+	try {
+		symbols = Object.getOwnPropertySymbols(source);
+	} catch {
+		return;
+	}
+	for (const symbol of symbols) {
+		if (symbol.description !== SCOPE_SYMBOL_DESCRIPTION) continue;
+		let value;
+		try {
+			value = source[symbol];
+		} catch {
+			continue;
+		}
+		if (typeof value === "object" && value !== null) return value;
+	}
+	const proto = Object.getPrototypeOf(source);
+	if (proto === null || proto === Object.prototype) return void 0;
+	return scanForScope(proto, depth + 1);
+}
+/**
+* 为一个名字清单建立归属视图。
+*
+* @param tools - 工具注册表（结构探测，不看类身份）。
+* @param scopeKey - 本预设的作用域 key；`undefined` 表示探测失败。
+* @param names - 要判定的名字（通常是本步的模型可见清单）。
+* @returns 归属视图；读不到任何归属时返回禁用视图。
+*/
+function resolveCatalogView(tools, scopeKey, names) {
+	const registry = asRegistry(tools);
+	if (scopeKey === void 0 || registry === void 0) return DISABLED_VIEW;
+	const globalNames = /* @__PURE__ */ new Set();
+	const presetNames = /* @__PURE__ */ new Set();
+	for (const name of names) {
+		if (typeof name !== "string" || name.length === 0) continue;
+		if (probes(registry, name, void 0)) globalNames.add(name);
+		if (probes(registry, name, scopeKey)) presetNames.add(name);
+	}
+	return {
+		enabled: true,
+		globalNames,
+		presetNames
+	};
+}
+/**
+* 判定一个名字在**调用时**是否属于本预设之外的层。
+*
+* 拒绝路径（模型直呼被遮蔽的名字）没有当步清单可用，只能按同一个视图单独判一次；
+* 判定规则与 {@link resolveCatalogView} 完全一致，两处因此不可能给出互相矛盾的结论。
+*
+* @param tools - 工具注册表。
+* @param scopeKey - 本预设的作用域 key。
+* @param name - 工具名。
+* @returns 归属视图（只含这一个名字）。
+*/
+function resolveNameView(tools, scopeKey, name) {
+	const registry = asRegistry(tools);
+	if (scopeKey === void 0 || registry === void 0) return DISABLED_VIEW;
+	const globalNames = /* @__PURE__ */ new Set();
+	const presetNames = /* @__PURE__ */ new Set();
+	if (probes(registry, name, void 0)) globalNames.add(name);
+	if (probes(registry, name, scopeKey)) presetNames.add(name);
+	return {
+		enabled: true,
+		globalNames,
+		presetNames
+	};
+}
+/** 一次公开查询：解析得到定义时为 `true`。 */
+function probes(registry, name, scope) {
+	try {
+		return registry.get(name, scope) !== void 0;
+	} catch {
+		return false;
+	}
+}
+/** 结构探测：读得到 `get` 就当注册表用。 */
+function asRegistry(tools) {
+	if (typeof tools !== "object" || tools === null) return void 0;
+	if (typeof tools.get !== "function") return void 0;
+	return tools;
+}
+//#endregion
+//#region src/host/codemode/transport.ts
+/**
+* Code Mode 的程序传输工具 `code_run`。
+*
+* 工具名不是 `run_code`：那个名字被内核保留（`tools.register()` 会抛错），所以本包
+* 用自己的名字注册同一件事——把模型写的一段程序交给 `ctx.ptcRuntime` 执行，程序里的每次
+* `tools.<name>(args)` 都是一次真实的工具调用。
+*
+* ## 与内核 PTC `run_code` 对齐的使用配置
+*
+* 1. **运行时感知 Schema**：按 `ptcRuntime` 的语言（TypeScript / Python）、程序形态
+*    （`function-body` / 常驻 REPL）、超时预算（`defaultMs` / `maxMs`）与沙箱支持动态投影
+*    描述和参数（含单次提权的 `sandbox_permissions` + `justification`）；同一部署下静态恒定，
+*    不会扰动前缀缓存。
+* 2. **完整子调用调度与上下文转发**：只读并发上限受 `maxParallelSubCalls` 约束，写类调用等待
+*    在飞调用排空后独占执行；程序结算时中止悬空请求并等待已启动子调用落盘；子调用产生的图片块、
+*    `additionalContexts` 与 `concludesTurn` 原样转交给外层步骤。
+* 3. **展示元数据与输出格式化**：声明 `presentCall` 与 `output.presentationMeta`（记录语言），
+*    深层 JSON 结果控制缩进上限，失败时保留已捕获输出与沙箱诊断信息。
+*
+* @module @eddyskywalker/dsh-chatgpt-subscription/host/codemode/transport
+*/
+/**
+* 本次程序运行看到的工具清单快照。
+*
+* 绑定函数在程序开始那一刻按当时的清单建好，此后程序内**只能**调这份清单里的名字。检索却
+* 读的是执行器级的“最新清单”：同一预设下主代理与子代理并发时，另一个会话的一次装配就会把
+* 它覆盖掉，于是程序可能搜到一个自己调不到的名字（`tools.xxx is not a function`）。
+*
+* 用 AsyncLocalStorage 把快照挂到这次运行上，程序内的检索与绑定因此读同一份清单：搜得到
+* 就调得动，调不到就搜不到。
+*/
+const catalogScope = new AsyncLocalStorage();
+/**
+* 读当前程序运行的清单快照。
+*
+* @returns 程序运行期间是这次运行的快照；程序之外为 `undefined`。
+*/
+function currentCatalogSnapshot() {
+	return catalogScope.getStore();
+}
+/** 允许单次提权的目标沙箱模式（对齐 `@deepseek-ai/dsh-sandbox` 的 `ESCALATION_TARGETS`）。 */
+const ESCALATION_TARGETS = Object.freeze(["workspace-write", "danger-full-access"]);
+/** 与内核 `run_code` 一致的 `description` 参数说明。 */
+const DESCRIPTION_PARAM_DESCRIPTION = "Clear, concise description of what this program does in active voice, 5-10 words (shown in the UI). Examples: \"Count TODO markers across packages\"; \"Read failing test and its fixture\"; \"Rename config key in every cordis.yml\".";
+function buildFlavor(languageName, execution) {
+	return {
+		description: `Execute a ${languageName} program against the available tools. Takes two required arguments: \`code\`, ${execution.programDescription}, and \`description\`, a short summary of what the program does. Call tools as \`await tools.name(args)\`. ${execution.outputInstruction} Image-bearing subtool results are attached after the run.`,
+		codeDescription: execution.codeDescription
+	};
+}
+const TYPESCRIPT_REPL_FLAVOR = buildFlavor("TypeScript", {
+	programDescription: "the program to execute",
+	outputInstruction: "Curate the program output.",
+	codeDescription: "The TypeScript program to execute, following this tool's execution instructions."
+});
+const TYPESCRIPT_FUNCTION_FLAVOR = buildFlavor("TypeScript", {
+	programDescription: "the BODY of an async function (erasable syntax only; top-level `await` and `return` work)",
+	outputInstruction: "Only what you print or return is program output — curate it.",
+	codeDescription: "The program: the body of an async TypeScript function."
+});
+const PYTHON_FLAVOR = buildFlavor("Python", {
+	programDescription: "the program to execute",
+	outputInstruction: "Curate the program output.",
+	codeDescription: "The Python program to execute, following this tool's execution instructions."
+});
+function resolveFlavor(runtime) {
+	if (runtime?.language === "python") return PYTHON_FLAVOR;
+	if (runtime?.language === "typescript" && runtime.programFormat === "repl") return TYPESCRIPT_REPL_FLAVOR;
+	return TYPESCRIPT_FUNCTION_FLAVOR;
+}
+function escalationGuidance(sandboxMode) {
+	return sandboxMode === void 0 ? "" : " A sandbox escalation approves this complete program for one execution only. Nested tools retain their own policies and approvals. Request wider access only after evidence of a denial. Earlier effects may already have completed: inspect them before explicitly retrying. Programs are never replayed automatically.";
+}
+function buildTransportDescription(runtime) {
+	const flavor = resolveFlavor(runtime);
+	const instructions = typeof runtime?.executionInstructions === "string" && runtime.executionInstructions.length > 0 ? ` ${runtime.executionInstructions}` : "";
+	return flavor.description + instructions + " Each program starts in the Session's current directory. Running programs keep their initial directory." + escalationGuidance(runtime?.sandboxMode);
+}
+function buildTransportParameters(runtime) {
+	const flavor = resolveFlavor(runtime);
+	const timeoutDescription = runtime?.timeout !== void 0 ? `Positive elapsed-time budget in milliseconds, including nested tool and approval waits. Default ${String(runtime.timeout.defaultMs)}; capped at ${String(runtime.timeout.maxMs)}. Zero does not disable the deadline.` : "Positive elapsed-time budget in milliseconds, capped by the runtime maximum.";
+	const properties = {
+		code: {
+			type: "string",
+			description: flavor.codeDescription
+		},
+		description: {
+			type: "string",
+			description: DESCRIPTION_PARAM_DESCRIPTION
+		},
+		timeoutMs: {
+			type: "number",
+			description: timeoutDescription
+		}
+	};
+	if (runtime?.sandboxMode !== void 0) {
+		properties["sandbox_permissions"] = {
+			type: "string",
+			enum: [...ESCALATION_TARGETS],
+			description: "Wider sandbox mode for this complete program execution; requires justification and approval."
+		};
+		properties["justification"] = {
+			type: "string",
+			description: "Reason this complete program needs wider access, shown to the user for approval. Use the language of the user’s current request."
+		};
+	}
+	return {
+		type: "object",
+		additionalProperties: false,
+		required: ["code", "description"],
+		properties
+	};
+}
+/**
+* 造 `code_run` 的工具定义。
+*
+* @param host - 运行环境句柄。
+* @param rules - 已归一化的规则。
+* @returns 可直接交给 `ctx.tools.register()` 的原始定义。
+*/
+function createTransportDefinition(host, rules) {
+	const runToolName = rules.options.runToolName;
+	const definition = {
+		name: runToolName,
+		description: buildTransportDescription(void 0),
+		parameters: buildTransportParameters(void 0),
+		output: {
+			schema: {
+				type: "object",
+				additionalProperties: false,
+				required: ["logs"],
+				properties: {
+					logs: {
+						type: "array",
+						items: { type: "string" }
+					},
+					result: {},
+					sandbox: {
+						type: "object",
+						additionalProperties: false,
+						required: ["mode", "denied"],
+						properties: {
+							mode: { type: "string" },
+							denied: { type: "boolean" },
+							enforcement: {
+								type: "string",
+								enum: ["full", "partial"]
+							}
+						}
+					}
+				}
+			},
+			render: (_args, value) => {
+				const parts = [(value.logs ?? []).join("\n"), value.result === void 0 ? "" : renderProgramValue(value.result)].filter((part) => part.length > 0);
+				if (value.sandbox?.enforcement === "partial") parts.push("File sandbox enforcement is partial on this host.");
+				if (value.sandbox?.denied === true) parts.push("The " + value.sandbox.mode + " file sandbox denied an operation." + escalationGuidance(host.runtime()?.sandboxMode));
+				return [{
+					type: "text",
+					text: parts.length > 0 ? parts.join("\n") : "(" + runToolName + " completed with no output)"
+				}];
+			},
+			presentationMeta: () => {
+				return { language: host.runtime()?.language === "python" ? "python" : "typescript" };
+			}
+		},
+		presentCall(args) {
+			if (typeof args !== "object" || args === null) return void 0;
+			const record = args;
+			const code = record["code"];
+			const description = record["description"];
+			if (typeof code !== "string" || typeof description !== "string" || description.trim().length === 0) return;
+			return {
+				card: "generic",
+				title: description,
+				kind: "execute",
+				rawInput: code
+			};
+		},
+		async execute(args, exec) {
+			const input = readArguments(args);
+			const runtime = host.runtime();
+			if (runtime === void 0) throw new Error("codemode: no PTC runtime is mounted (ctx.ptcRuntime); the program transport is unavailable");
+			if (input.timeoutMs !== void 0 && runtime.timeout !== void 0 === false && isStrictTimeoutUnsupported(runtime)) throw new Error("timeoutMs is not available for this PTC runtime");
+			const catalog = host.catalog();
+			const runController = new AbortController();
+			const onOuterAbort = () => {
+				runController.abort(exec.signal.reason);
+			};
+			if (exec.signal.aborted) runController.abort(exec.signal.reason);
+			else exec.signal.addEventListener("abort", onOuterAbort, { once: true });
+			const nestedSignal = markNested(runController.signal) ?? runController.signal;
+			const owner = host.stateOwner(exec.agent);
+			let maxSubCalls = rules.options.maxSubCalls;
+			let attempts = 0;
+			const scheduler = createSubCallScheduler(rules.options.maxParallelSubCalls, () => runController.signal.aborted);
+			const definitions = /* @__PURE__ */ new Map();
+			for (const entry of catalog) definitions.set(entry.name, entry);
+			const functions = Object.create(null);
+			for (const entry of catalog) {
+				if (entry.name === runToolName) continue;
+				const invoke = async (rawArgs) => {
+					if (runController.signal.aborted) throw new Error(runToolName + " run is over; " + entry.name + " not dispatched");
+					const n = ++attempts;
+					if (n > maxSubCalls) {
+						const limitErr = /* @__PURE__ */ new Error("program sub-call limit exceeded: " + String(maxSubCalls) + " calls");
+						runController.abort(limitErr);
+						throw limitErr;
+					}
+					const parsed = losslessArgs(rawArgs);
+					const loggedArgs = losslessArgs(parsed);
+					const callId = String(exec.callId) + NESTED_CALL_ID_MARKER + String(n);
+					const dispatchLog = createDispatchLog(exec.agent, {
+						rootCallId: rootCallIdOf(String(exec.callId)),
+						parentCallId: String(exec.callId),
+						subCallId: callId,
+						name: entry.name,
+						arguments: loggedArgs
+					});
+					const run = async () => {
+						dispatchLog.start();
+						let outcome;
+						try {
+							outcome = await host.callTool({
+								name: entry.name,
+								args: parsed,
+								callId,
+								signal: nestedSignal,
+								agent: exec.agent,
+								toolSet: exec.toolSet
+							});
+						} catch (error) {
+							dispatchLog.settle({ error: error instanceof Error ? error.message : String(error) });
+							throw error;
+						}
+						dispatchLog.settle(outcome);
+						if (outcome.error === void 0 && Array.isArray(outcome.content) && hasImageBlock(outcome.content)) {
+							const imageMsg = host.createImageContext?.(outcome.content);
+							if (imageMsg !== void 0) exec.deferContext?.(imageMsg);
+						}
+						if (Array.isArray(outcome.additionalContexts)) for (const contextMsg of outcome.additionalContexts) exec.deferContext?.(contextMsg);
+						if (outcome.error === void 0 && outcome.concluded === true) exec.concludeTurn?.();
+						if (runController.signal.aborted) throw new Error(runToolName + " run is over; " + entry.name + " result discarded");
+						if (outcome.error !== void 0) throw new Error(outcome.error);
+						return outcome.value !== void 0 ? outcome.value : outcome.text ?? null;
+					};
+					const mode = isConcurrencySafe(definitions.get(entry.name), parsed) ? "parallel" : "exclusive";
+					return scheduler.schedule(mode, run, () => {
+						throw new Error(runToolName + " run is over; " + entry.name + " tool call abandoned");
+					});
+				};
+				Object.defineProperty(functions, entry.name, {
+					enumerable: true,
+					configurable: true,
+					writable: true,
+					value: invoke
+				});
+			}
+			try {
+				/**
+				* 跑一次程序：每次重取会话授权，因为重试发生在策略变更之后。
+				*
+				* 单次沙箱提权（`sandbox_permissions`）只在第一次进入前审批一次，且提权后的单次执行不传
+				* `stateOwner`，避免把单次授权固化到常驻环境中（对齐内核 `ptc.ts`）。
+				*/
+				let approvedEscalatedMode;
+				const attempt = async () => {
+					const authority = await host.runAuthority?.(exec.agent, nestedSignal);
+					const standingPolicy = authority?.sandboxPolicy;
+					let effectivePolicy = standingPolicy;
+					let escalated = false;
+					if (input.sandboxPermissions !== void 0 && input.justification !== void 0) {
+						if (standingPolicy === void 0 || typeof host.escalateSandbox !== "function") throw new Error("sandbox_permissions is not available for this PTC runtime");
+						if (approvedEscalatedMode === void 0) {
+							const nextPolicy = await host.escalateSandbox({
+								requestedMode: input.sandboxPermissions,
+								justification: input.justification,
+								standingPolicy,
+								agent: exec.agent,
+								callId: String(exec.callId),
+								toolName: runToolName,
+								signal: exec.signal
+							});
+							effectivePolicy = nextPolicy;
+							approvedEscalatedMode = modeOfPolicy(nextPolicy);
+						} else if (typeof standingPolicy === "object" && standingPolicy !== null) effectivePolicy = {
+							...standingPolicy,
+							mode: approvedEscalatedMode
+						};
+						escalated = modeOfPolicy(effectivePolicy) !== modeOfPolicy(standingPolicy);
+					}
+					const request = {
+						program: input.code,
+						bindings: [{
+							global: "tools",
+							functions,
+							errorClass: {
+								name: "ToolCallError",
+								memberNameProperty: "toolName"
+							}
+						}],
+						...escalated ? {} : { stateOwner: owner },
+						...authority?.cwd === void 0 ? {} : { cwd: authority.cwd },
+						...effectivePolicy === void 0 ? {} : { sandboxPolicy: effectivePolicy },
+						...input.timeoutMs === void 0 ? {} : { timeoutMs: input.timeoutMs },
+						signal: nestedSignal
+					};
+					const spec = typeof runtime.resolve === "function" ? runtime.resolve(request) : request;
+					maxSubCalls = resolveSubCallBudget(spec, rules);
+					return await catalogScope.run(catalog, () => runtime.run(spec));
+				};
+				let result;
+				try {
+					try {
+						result = await attempt();
+					} catch (error) {
+						if (!isRetainedPolicyChange(error)) throw error;
+						await host.releaseOwner(owner);
+						host.stateOwner(exec.agent);
+						result = await attempt();
+					}
+				} finally {
+					runController.abort(runToolName + " settled");
+					await scheduler.drain();
+				}
+				if (result.error !== void 0) {
+					const logsText = Array.isArray(result.logs) && result.logs.length > 0 ? "\nCaptured output:\n" + result.logs.join("\n") : "";
+					const sandboxText = result.sandbox === void 0 ? "" : "\nFile sandbox: " + result.sandbox.mode + (result.sandbox.enforcement === void 0 ? "" : "; enforcement: " + result.sandbox.enforcement) + (result.sandbox.denied ? "; operation denied" : "") + ".";
+					const hint = result.sandbox?.denied ? escalationGuidance(runtime.sandboxMode) : "";
+					throw new Error("program failed (" + result.error.kind + "): " + result.error.message + logsText + sandboxText + hint);
+				}
+				return {
+					logs: [...result.logs ?? []],
+					...result.value === void 0 ? {} : { result: result.value },
+					...result.sandbox === void 0 ? {} : { sandbox: {
+						mode: result.sandbox.mode,
+						denied: result.sandbox.denied,
+						...result.sandbox.enforcement === void 0 ? {} : { enforcement: result.sandbox.enforcement }
+					} }
+				};
+			} finally {
+				exec.signal.removeEventListener("abort", onOuterAbort);
+			}
+		}
+	};
+	Object.defineProperty(definition, "description", {
+		enumerable: true,
+		configurable: true,
+		get: () => buildTransportDescription(safeRuntime(host))
+	});
+	Object.defineProperty(definition, "parameters", {
+		enumerable: true,
+		configurable: true,
+		get: () => buildTransportParameters(safeRuntime(host))
+	});
+	return definition;
+}
+function safeRuntime(host) {
+	try {
+		return host.runtime();
+	} catch {
+		return;
+	}
+}
+/** 只有明确声明了 `timeout: undefined` 自身属性（而非测试假对象省略字段）才视作不支持 `timeoutMs`。 */
+function isStrictTimeoutUnsupported(runtime) {
+	return Object.prototype.hasOwnProperty.call(runtime, "timeout") && runtime.timeout === void 0;
+}
+function modeOfPolicy(policy) {
+	if (typeof policy !== "object" || policy === null) return void 0;
+	const mode = policy.mode;
+	return typeof mode === "string" ? mode : void 0;
+}
+function hasImageBlock(content) {
+	return content.some((block) => typeof block === "object" && block !== null && block.type === "image");
+}
+function resolveSubCallBudget(spec, rules) {
+	if (rules.options.explicitMaxSubCalls) return rules.options.maxSubCalls;
+	if (spec.timeoutMs === null) return Infinity;
+	if (typeof spec.timeoutMs === "number" && Number.isFinite(spec.timeoutMs) && spec.timeoutMs > 0) return Math.max(1, Math.floor(spec.timeoutMs / 6e4 * rules.options.maxSubCallsPerMinute));
+	return rules.options.maxSubCalls;
+}
+/** 没有会话可写时的空记录。 */
+const NO_DISPATCH_LOG = Object.freeze({
+	start() {},
+	settle() {}
+});
+/** 回放里单个文本块的上限：日志要有界，程序拿到的值不受影响。 */
+const DISPATCH_LOG_TEXT_LIMIT = 8e3;
+/**
+* 造一条子调用的回放记录。
+*/
+function createDispatchLog(agent, entry) {
+	const session = typeof agent === "object" && agent !== null ? agent.session : void 0;
+	const append = session?.append;
+	if (typeof append !== "function") return NO_DISPATCH_LOG;
+	const base = {
+		rootCallId: entry.rootCallId,
+		parentCallId: entry.parentCallId,
+		subCallId: entry.subCallId,
+		name: entry.name,
+		arguments: entry.arguments
+	};
+	const write = (type, data) => {
+		try {
+			append.call(session, type, data);
+		} catch {}
+	};
+	return {
+		start() {
+			write("tool/ptc-dispatch-start", { ...base });
+		},
+		settle(outcome) {
+			write("tool/ptc-dispatch", {
+				...base,
+				isError: outcome.error !== void 0,
+				content: clipContent(outcome.content),
+				...outcome.meta === void 0 ? {} : { meta: outcome.meta },
+				...outcome.errorInfo === void 0 ? {} : { error: outcome.errorInfo }
+			});
+		}
+	};
+}
+/**
+* 把内容块裁到日志能承受的长度。
+*/
+function clipContent(content) {
+	if (content === void 0) return [];
+	return content.map((block) => {
+		if (typeof block !== "object" || block === null) return block;
+		const record = block;
+		const text = record["text"];
+		if (typeof text !== "string" || text.length <= DISPATCH_LOG_TEXT_LIMIT) return block;
+		return {
+			...record,
+			text: text.slice(0, DISPATCH_LOG_TEXT_LIMIT) + "…[truncated in dispatch log]"
+		};
+	});
+}
+/**
+* 一条调用所属调用树的根 id。
+*/
+function rootCallIdOf(callId) {
+	const at = callId.indexOf(NESTED_CALL_ID_MARKER);
+	return at > 0 ? callId.slice(0, at) : callId;
+}
+/** 内核在常驻环境遇到策略变更时的拒绝文本；其余异常一律原样上抛。 */
+function isRetainedPolicyChange(error) {
+	return (error instanceof Error ? error.message : String(error)).includes("release the retained environment before changing its sandbox policy");
+}
+/** 校验单次沙箱提权参数配对（对齐 `@deepseek-ai/dsh-sandbox` 的 `validateEscalationArgs`）。 */
+function validateEscalationArgs(sandboxPermissions, justification) {
+	if (sandboxPermissions !== void 0 && justification === void 0) throw new Error("invalid escalation: sandbox_permissions requires a justification");
+	if (justification !== void 0 && sandboxPermissions === void 0) throw new Error("invalid escalation: justification is only valid together with sandbox_permissions");
+	if (sandboxPermissions === void 0 && justification === void 0) return {};
+	if (typeof sandboxPermissions !== "string" || !ESCALATION_TARGETS.includes(sandboxPermissions)) throw new Error("invalid sandbox_permissions: expected \"workspace-write\" or \"danger-full-access\"");
+	if (typeof justification !== "string" || justification.trim().length === 0) throw new Error("invalid justification: expected a non-empty sentence");
+	return {
+		sandboxPermissions,
+		justification
+	};
+}
+/** 校验并读出工具参数。 */
+function readArguments(args) {
+	if (typeof args !== "object" || args === null) throw new Error("codemode: expected an arguments object");
+	const record = args;
+	const code = record["code"];
+	const description = record["description"];
+	if (typeof code !== "string" || code.trim().length === 0) throw new Error("codemode: invalid code: expected a non-empty string");
+	if (typeof description !== "string" || description.trim().length === 0) throw new Error("codemode: invalid description: expected a non-empty string");
+	const escalation = validateEscalationArgs(record["sandbox_permissions"], record["justification"]);
+	const timeoutMs = record["timeoutMs"];
+	if (timeoutMs === void 0) return {
+		code,
+		description,
+		...escalation
+	};
+	if (typeof timeoutMs !== "number" || !Number.isFinite(timeoutMs) || timeoutMs <= 0) throw new Error("codemode: invalid timeoutMs: expected a positive finite number");
+	return {
+		code,
+		description,
+		timeoutMs,
+		...escalation
+	};
+}
+/** 子调用参数必须是可无损 JSON 化的值。 */
+function losslessArgs(value) {
+	if (value === void 0) return {};
+	try {
+		return JSON.parse(JSON.stringify(value));
+	} catch {
+		throw new Error("codemode: tool arguments must be lossless JSON");
+	}
+}
+/** 一个工具的调用是否可以与兄弟调用重叠（只有明确 true 才算）。 */
+function isConcurrencySafe(entry, args) {
+	if (entry === void 0 || typeof entry.isConcurrencySafe !== "function") return false;
+	try {
+		return entry.isConcurrencySafe(args) === true;
+	} catch {
+		return false;
+	}
+}
+/**
+* 子调用并发与互斥调度器（对齐内核 `ptc.ts` 的读写屏障）：
+*
+* - `parallel` 调用可并发重叠，最多 `maxParallel` 个同时在飞；
+* - `exclusive` 调用必须等待所有已在飞调用结算后独占运行，并在自身结算后才放行后续调用；
+* - 排队期间若外层运行已中止，直接放弃且不启动任务（保证未启动调用零 `start` 事件）；
+* - `drain()` 等待全部已启动任务结算。
+*/
+function createSubCallScheduler(maxParallel, isAborted) {
+	const cap = Math.max(1, maxParallel);
+	const queue = [];
+	const inFlight = /* @__PURE__ */ new Set();
+	let exclusiveActive = false;
+	const pump = () => {
+		while (queue.length > 0) {
+			const head = queue[0];
+			if (isAborted()) {
+				queue.shift();
+				head.abandon();
+				continue;
+			}
+			if (exclusiveActive) return;
+			if (head.mode === "exclusive") {
+				if (inFlight.size > 0) return;
+				exclusiveActive = true;
+				queue.shift();
+				head.start();
+				return;
+			}
+			if (inFlight.size >= cap) return;
+			queue.shift();
+			head.start();
+		}
+	};
+	return {
+		schedule(mode, task, onAbandon) {
+			return new Promise((resolve, reject) => {
+				queue.push({
+					mode,
+					abandon() {
+						try {
+							onAbandon();
+						} catch (error) {
+							reject(error);
+						}
+					},
+					start() {
+						const tracked = task().then(resolve, reject).finally(() => {
+							inFlight.delete(tracked);
+							if (mode === "exclusive") exclusiveActive = false;
+							pump();
+						}).then(() => void 0, () => void 0);
+						inFlight.add(tracked);
+					}
+				});
+				pump();
+			});
+		},
+		async drain() {
+			pump();
+			while (inFlight.size > 0) {
+				await Promise.allSettled([...inFlight]);
+				pump();
+			}
+		}
+	};
+}
+const JSON_INDENT = "  ";
+const MAX_JSON_INDENT_CHARS = 10;
+/** 迭代式 JSON 渲染：与内核 `ptc.ts` 一致，深于 5 层后自动紧凑化，防止深层缩进膨胀。 */
+function renderProgramValue(value) {
+	if (typeof value === "string") return value;
+	let normalized;
+	try {
+		normalized = JSON.parse(JSON.stringify(value));
+	} catch {
+		return String(value);
+	}
+	if (typeof normalized === "string") return normalized;
+	if (normalized === void 0) return "";
+	const chunks = [];
+	const tasks = [{
+		kind: "value",
+		value: normalized,
+		depth: 0,
+		compact: false
+	}];
+	for (let task = tasks.pop(); task !== void 0; task = tasks.pop()) {
+		if (task.kind === "text") {
+			chunks.push(task.text);
+			continue;
+		}
+		const current = task.value;
+		if (current === null || typeof current === "boolean" || typeof current === "number") {
+			chunks.push(String(current));
+			continue;
+		}
+		if (typeof current === "string") {
+			chunks.push(JSON.stringify(current));
+			continue;
+		}
+		const compact = task.compact || (task.depth + 1) * 2 > MAX_JSON_INDENT_CHARS;
+		const childDepth = task.depth + 1;
+		if (Array.isArray(current)) {
+			chunks.push("[");
+			if (current.length === 0) {
+				chunks.push("]");
+				continue;
+			}
+			tasks.push({
+				kind: "text",
+				text: compact ? "]" : `\n${JSON_INDENT.repeat(task.depth)}]`
+			});
+			for (let index = current.length - 1; index >= 0; index -= 1) {
+				tasks.push({
+					kind: "value",
+					value: current[index],
+					depth: childDepth,
+					compact
+				});
+				tasks.push({
+					kind: "text",
+					text: compact ? index === 0 ? "" : "," : `${index === 0 ? "\n" : ",\n"}${JSON_INDENT.repeat(childDepth)}`
+				});
+			}
+			continue;
+		}
+		if (typeof current === "object") {
+			const record = current;
+			const keys = Object.keys(record);
+			chunks.push("{");
+			if (keys.length === 0) {
+				chunks.push("}");
+				continue;
+			}
+			tasks.push({
+				kind: "text",
+				text: compact ? "}" : `\n${JSON_INDENT.repeat(task.depth)}}`
+			});
+			for (let index = keys.length - 1; index >= 0; index -= 1) {
+				const key = keys[index];
+				tasks.push({
+					kind: "value",
+					value: record[key],
+					depth: childDepth,
+					compact
+				});
+				tasks.push({
+					kind: "text",
+					text: compact ? `${index === 0 ? "" : ","}${JSON.stringify(key)}:` : `${index === 0 ? "\n" : ",\n"}${JSON_INDENT.repeat(childDepth)}${JSON.stringify(key)}: `
+				});
+			}
+		}
+	}
+	return chunks.join("");
+}
+//#endregion
+//#region src/entry-codemode.ts
+/**
+* Code Mode 预设行 —— 本包自己的「原生工具 + 程序传输」呈现方式。
+*
+* 这一行挂在 `dispatch` 预设里（见 presets/dispatch/agent.cordis.yml 与 src/host/agent-preset.ts），
+* 因此它注册的工具、它选中的 executor、它提供的提示词段都属于**这个预设的会话**，其它预设
+* 完全不受影响。
+*
+* ## 它替掉了什么
+*
+* 内核的 `ptc` 呈现方式只把 `run_code` 交给模型，其余工具一律硬拒（UNKNOWN_TOOL），
+* `standard` 又完全没有程序传输——「原生工具 + 程序」这个组合在内核里表达不出来。本行用
+* `standard` 的原生工具面 + 自己的 `code_run` 把这个组合重建，再把预设清单以外的工具
+* 挡在上下文之外，只留程序内可达。
+*
+* ## 四件事
+*
+* 1. 注册发现工具（list / search / describe / debug）；
+* 2. 注册程序传输工具 `code_run`；
+* 3. 选一个执行器：`describe()` 丢掉预设清单以外的名字，`execute()` 派发前拒绝模型直呼，
+*    其余整批委托给内核原生执行器（完整策略 / 审批 / post-execute 管线）；
+* 4. 提供**恒定**的 Code Mode 说明段，替换内核那份 SDK 声明段。
+*
+* @module @eddyskywalker/dsh-chatgpt-subscription/codemode
+*/
+/** Cordis 插件名。 */
+const name = "codemode";
+/** 依赖的服务。 */
+const inject = ["tools", "systemPrompt"];
+/** 决策环长度：只留给 `code_debug`。 */
+const DEBUG_RING = 50;
+/** 严格加宽阶梯（对齐 `@deepseek-ai/dsh-sandbox` 的 `WIDER_MODES`）。 */
+const WIDER_SANDBOX_MODES = {
+	"read-only": ["workspace-write", "danger-full-access"],
+	"workspace-write": ["danger-full-access"]
+};
+/**
+* 装配本行。
+*
+* @param ctx - 预设作用域上的行上下文。
+* @param config - 行配置（{@link CodemodeConfig}）。
+*/
+function apply(ctx, config = {}) {
+	const context = ctx;
+	const log = (level, message) => {
+		try {
+			context.logger?.[level]?.(message);
+		} catch {}
+	};
+	const tools = context.tools;
+	const runtimeOf = () => {
+		try {
+			return context.get?.("ptcRuntime");
+		} catch {
+			return;
+		}
+	};
+	/** 读一个内核服务（缺失或未挂载时为 undefined）。 */
+	const serviceOf = (name) => {
+		try {
+			return context.get?.(name);
+		} catch {
+			return;
+		}
+	};
+	/**
+	* 取会话级运行授权：目录与文件策略都读内核服务，本行只转交、不自己造。
+	*
+	* `ptcRuntime.run()` 在 DSH 0.2.2 起要求已解析的策略与目录；缺了这两项，程序会带着部署
+	* 默认值（通常是 read-only 与部署根目录）执行，或者干脆被运行时拒绝。老代 harness 没有这两个
+	* 服务，返回 undefined 让它照旧兜底。
+	*/
+	const runAuthority = async (agent, signal) => {
+		const authority = {};
+		const session = typeof agent === "object" && agent !== null ? agent.session : void 0;
+		const policy = serviceOf("sandboxPolicy");
+		if (typeof policy?.resolve === "function") try {
+			const resolved = policy.resolve(session === void 0 ? {} : { session });
+			if (resolved !== void 0) authority.sandboxPolicy = resolved;
+		} catch {}
+		const directories = serviceOf("workingDirectory");
+		if (agent !== void 0 && typeof directories?.ensure === "function") try {
+			authority.cwd = await directories.ensure(agent, signal);
+		} catch {}
+		return authority;
+	};
+	const rules = createRules(config);
+	const retention = createRetention(runtimeOf);
+	if (typeof context.effect === "function") context.effect(() => () => {
+		retention.dispose();
+	}, "codemode retained environments");
+	const scopeKey = findScopeKey(ctx);
+	if (rules.options.nativeScope && scopeKey === void 0) log("warn", "[codemode] no registry scope tag on this context: masking falls back to name rules only (" + rules.options.hiddenPrefixes.join(", ") + "). Mount this row inside an agent preset to hide every tool the preset does not own.");
+	/** 最近一次 describe 收到的完整定义集（含被遮蔽的）。 */
+	let catalog = [];
+	const debugRing = [];
+	let firstDescribeLogged = false;
+	const escalateSandbox = async (input) => {
+		const record = typeof input.standingPolicy === "object" && input.standingPolicy !== null ? input.standingPolicy : void 0;
+		const effectiveMode = typeof record?.["mode"] === "string" ? record["mode"] : void 0;
+		if (record === void 0 || effectiveMode === void 0) throw new Error("sandbox_permissions is not available for this PTC runtime");
+		if (input.requestedMode === effectiveMode) return input.standingPolicy;
+		if (!(WIDER_SANDBOX_MODES[effectiveMode] ?? []).includes(input.requestedMode)) throw new Error(`sandbox escalation to "${input.requestedMode}" is not strictly wider than this call's current "${effectiveMode}" mode`);
+		const approver = serviceOf("approval");
+		if (typeof approver?.request !== "function") throw new Error(`sandbox escalation to "${input.requestedMode}" requires approval, but no approval service is composed`);
+		if (input.agent === void 0) throw new Error(`sandbox escalation to "${input.requestedMode}" requires approval, but the call has no agent to route it through`);
+		const outcome = await approver.request({
+			agent: input.agent,
+			toolName: input.toolName,
+			callId: input.callId,
+			reason: `escalate sandbox to ${input.requestedMode}: ${input.justification}`,
+			displayReason: {
+				en: `Allow this program to run once with ${input.requestedMode} access: ${input.justification}`,
+				zh: `允许本次程序以 ${input.requestedMode} 权限单次运行：${input.justification}`
+			},
+			signal: input.signal
+		});
+		switch (outcome) {
+			case "allowed-once": return {
+				...record,
+				mode: input.requestedMode
+			};
+			case "rejected": throw new Error(`the user rejected escalating this program to "${input.requestedMode}"; it stays denied, so stop and explain instead of working around it`);
+			case "cancelled": throw new Error(`approval for escalating to "${input.requestedMode}" was cancelled`);
+			case "unavailable": throw new Error(`sandbox escalation to "${input.requestedMode}" requires approval, but no approval channel is available`);
+			default: throw new Error(`unexpected approval outcome: ${String(outcome)}`);
+		}
+	};
+	const host = {
+		catalog: () => catalog,
+		runtime: runtimeOf,
+		stateOwner: (agent) => retention.owner(agent),
+		releaseOwner: (owner) => retention.release(owner),
+		runAuthority,
+		escalateSandbox,
+		createImageContext(content) {
+			return createUserMessage({
+				content,
+				source: { kind: PLUGIN_MESSAGE_SOURCE_KIND }
+			});
+		},
+		async callTool(request) {
+			const call = {
+				type: "tool-call",
+				id: request.callId,
+				name: request.name,
+				arguments: stringifyArguments(request.args)
+			};
+			let batch;
+			try {
+				batch = await tools.execute({
+					calls: [call],
+					signal: request.signal,
+					...request.agent === void 0 ? {} : { agent: request.agent },
+					...request.toolSet === void 0 ? {} : { toolSet: request.toolSet }
+				});
+			} catch (error) {
+				return { error: messageOf(error) };
+			}
+			const result = batch.results?.[0]?.result;
+			if (result === void 0) return { error: "sub-call produced no result" };
+			const content = result.content ?? [];
+			const additionalContexts = Array.isArray(batch.additionalContexts) && batch.additionalContexts.length > 0 ? batch.additionalContexts : void 0;
+			if (result.isError === true) return {
+				error: errorTextOf(result),
+				content,
+				...errorInfoOf(result),
+				...additionalContexts === void 0 ? {} : { additionalContexts }
+			};
+			const meta = result.meta;
+			return {
+				...result.value !== void 0 ? { value: result.value } : { text: textOf(result.content) },
+				content,
+				...meta === void 0 ? {} : { meta },
+				...additionalContexts === void 0 ? {} : { additionalContexts },
+				...batch.concluded === true ? { concluded: true } : {}
+			};
+		}
+	};
+	for (const definition of createDiscoveryDefinitions(rules, () => currentCatalogSnapshot() ?? catalog, () => debugRing)) tools.register(definition);
+	tools.register(createTransportDefinition(host, rules));
+	if (typeof tools.setExecutor !== "function") {
+		log("warn", "[codemode] this DSH build has no ctx.tools.setExecutor(); Code Mode requires DSH 0.2.2 or later. Switch this session to the built-in ptc preset.");
+		return;
+	}
+	const delegate = new NativeToolExecutor(ctx);
+	const view = () => resolveCatalogView(tools, scopeKey, catalog.map((entry) => entry.name));
+	const executor = createCodemodeExecutor(ctx, rules, {
+		delegate,
+		view,
+		viewForName: (toolName) => resolveNameView(tools, scopeKey, toolName),
+		sectionText: () => {
+			const runtime = runtimeOf();
+			return buildCodemodeSectionText({
+				runToolName: rules.options.runToolName,
+				metaTools: rules.options.metaTools,
+				language: runtime?.language,
+				programFormat: runtime?.programFormat
+			});
+		},
+		onCatalog: (definitions) => {
+			catalog = definitions.map(toCatalogEntry).filter((entry) => entry !== void 0);
+		},
+		onDescribe: (decision) => {
+			const hidden = summarizeHidden(decision.masked);
+			debugRing.push({
+				at: (/* @__PURE__ */ new Date()).toISOString(),
+				visible: decision.visible,
+				hidden
+			});
+			while (debugRing.length > DEBUG_RING) debugRing.shift();
+			const namespaces = hidden.namespaces.map((entry) => entry.namespace + "=" + String(entry.count)).join(", ");
+			const line = "[codemode] masked " + String(hidden.total) + " non-standard tool(s)" + (namespaces === "" ? "" : " (" + namespaces + ")") + "; request tools: " + decision.visible.join(", ");
+			if (!firstDescribeLogged) {
+				firstDescribeLogged = true;
+				log("info", line);
+			} else log("debug", line);
+		}
+	});
+	tools.setExecutor(executor);
+	const scopeNote = scopeKey === void 0 ? "" : ", everything outside this preset scope";
+	log("info", "[codemode] active: transport [" + rules.options.runToolName + "], discovery [" + rules.options.metaTools.join(", ") + "], hiding [" + rules.options.hiddenPrefixes.join(", ") + "]" + scopeNote);
+}
+/** 把一个工具定义投影成程序清单条目。 */
+function toCatalogEntry(definition) {
+	if (typeof definition !== "object" || definition === null) return void 0;
+	const record = definition;
+	const toolName = record["name"];
+	if (typeof toolName !== "string" || toolName.length === 0) return void 0;
+	const description = typeof record["description"] === "string" ? record["description"] : "";
+	const safe = record["isConcurrencySafe"];
+	return {
+		name: toolName,
+		description,
+		parameters: record["parameters"],
+		...typeof safe === "function" ? { isConcurrencySafe: safe } : {}
+	};
+}
+/** 参数序列化成线上形状（`ToolCallBlock.arguments` 是字符串）。 */
+function stringifyArguments(args) {
+	if (args === void 0) return "{}";
+	try {
+		return JSON.stringify(args);
+	} catch {
+		return "{}";
+	}
+}
+/** 一条失败结果的面向前模型文本。 */
+function errorTextOf(result) {
+	const message = typeof result.error?.message === "string" ? result.error.message : void 0;
+	if (message !== void 0 && message.length > 0) return message;
+	const text = textOf(result.content);
+	return text.length > 0 ? text : "tool call failed";
+}
+/**
+* 读出结构化失败身份。
+*
+* 内核把 `result.error.info` 原样放进回放事件的 `error` 字段；缺任一必填项时给空
+* 对象，让调用方可以无条件展开。
+*
+* @param result - 一条失败结果。
+* @returns 带 `errorInfo` 的对象，或空对象。
+*/
+function errorInfoOf(result) {
+	const info = result.error?.info;
+	if (info === void 0 || info === null) return {};
+	const name = nonEmptyString(info.name);
+	const code = nonEmptyString(info.code);
+	if (name === void 0 || code === void 0) return {};
+	const reason = nonEmptyString(info.reason);
+	return { errorInfo: {
+		name,
+		code,
+		...reason === void 0 ? {} : { reason }
+	} };
+}
+/** 非空字符串，或 `undefined`。 */
+function nonEmptyString(value) {
+	return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+/** 把内容块里的文本拼起来。 */
+function textOf(content) {
+	if (!Array.isArray(content)) return "";
+	const parts = [];
+	for (const block of content) {
+		if (typeof block !== "object" || block === null) continue;
+		const record = block;
+		if (record["type"] === "text" && typeof record["text"] === "string") parts.push(record["text"]);
+	}
+	return parts.join("\n");
+}
+/** 一个抛出值的消息。 */
+function messageOf(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+//#endregion
+export { apply, inject, name };