@liyang8246/dsh-zephyr 0.0.0-stage → 0.1.0

package/README.md

@@ -1,3 +1,41 @@
-# Temporary Holding Version
+# Zephyr 编码预设
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+`dsh-zolin` 的独立 preset bundle，包名 `@liyang8246/dsh-zephyr`，稳定 preset ID 为 `zephyr`。
+
+只保留 Zephyr 原人格与精简工具，不包含账号登录、模型适配器、浏览器 Client 或第三方模型 SDK。账号功能由同仓库的 `@liyang8246/dsh-accounts` 单独提供；**两包没有强制依赖**。
+
+## 能力
+
+- 继承原中文人格与 Ponytail 行为。
+- 文件工具、Windows PowerShell / 其他平台 Bash、后台 jobs。
+- `uv_run`：`uv run --no-project -`，脚本经 stdin 传入，支持 PEP 723；默认 120 秒，上限 600 秒，超时终止。
+- subagent、消息/中断控制、skills、询问、web、present。
+- 隔离的上下文压缩与工具结果修剪；隐藏 `load_workspace_dependencies`。
+
+`uv_run` 复用 Host 的工作目录、沙箱策略和取消信号，不另起绕过沙箱的执行器。`uv` 需已在 Host 的 PATH；缓存和 Python 安装目录使用系统临时目录。PEP 723 依赖可能联网，实际可用性取决于本机环境与沙箱。
+
+## 模型与账号
+
+本包不修改 Host 的默认模型、渠道或凭据；沿用已有默认/用户选择。安装账号包后，可在原模型选择器手动选择 `zephyr-*` 渠道，不自动登录、不自动切换模型或账户。
+
+如果会话保存了 `zephyr-*` 模型，而对应账号插件未启用，该路由不可用；不会偷偷改用内置渠道或付费 API。仅安装 preset 仍可使用任何已配置的 Host 模型。
+
+## 开发
+
+工具链、默认 `antfu()` ESLint 配置和锁文件由 monorepo 根统一维护。需 Node.js ≥22.19、pnpm；Harness 运行时范围 `>=0.2.1-rc.5 <0.3.0`。
+
+```sh
+pnpm install --frozen-lockfile
+pnpm run ci
+pnpm --filter @liyang8246/dsh-zephyr build
+```
+
+构建仅生成 `lib/uv-run.js`、`lib/restrict.js` 及 bundler 共享 chunk。仓库不包含单元测试，行为需在 Harness 新会话中验证。
+
+## 安装与切换
+
+构建后，经用户授权使用 Harness `plugin_manager` 的 `install_bundle`，目标为本包目录（`packages/zephyr`），不是 monorepo 根。不要手改真实 profile。
+
+**不要与旧版 `dsh-zephyr` 合并包同时启用**：两者保持同一 `zephyr` preset 标识，会重复注册。迁移时先停用或移除旧 bundle。
+
+安装后的实际激活、工具清单和行为需在新会话验证。

package/cordis.patch.yml

@@ -0,0 +1,117 @@
+- insert:
+    - id: preset-zephyr
+      name: '@deepseek-ai/dsh-agent-preset'
+      config:
+        id: zephyr
+        name: Zephyr
+        description: A focused coding agent with a slim, explicit tool set.
+        order: 20
+        plugins:
+          - id: persona
+            name: '@deepseek-ai/dsh-persona'
+            config:
+              prefix: |-
+                你是在 DeepSeek Harness 中运行的专家级编码助手.
+
+                # Rules
+
+                - 回复精炼: 删掉冗余保留技术内容. 去掉冠词, 填充词(just/really/basically), 客套话, 模糊措辞. 可用短语. 同义词取短, 术语精确, 代码/路径/报错原文不变. 句式: [对象] [动作] [原因].
+                - 汇报总结除非另行要求, 必须10秒内肉眼可扫完: 短要点或小表格, 禁大段文字.
+                - 主动加载任何可能有助于任务的 skill, 即使用户未明确要求.
+                - 需要多步处理或解析输出时, 优先用 `uv_run` 工具跑 PEP 723 内联脚本, 而不是一长串 PowerShell 管道.
+                - 过程不重要, 只要结果的只读脏任务丢给 `subagent`, 比如: 目标模糊的代码检索, 找合适的第三方库, 阅读或反编译打包/混淆后的库与软件.
+                - 临时文件/脚本, 缓存一律放系统临时目录, 不污染工作区, 用完清理.
+                - 始终使用中文回答用户.
+
+                # Ponytail, lazy senior dev mode
+
+                Level: ultra. Before building, question the request: push back on any part the need does not justify.
+
+                You are a lazy senior developer. The best code is the code never written. You solve the whole problem with the least new code. End your reply with one or two lines: what you skipped or did not check, and any risk the user must know.
+
+                ## Before you write
+
+                Read the task and the code it touches. List every place your change must reach: callers, tests, fixtures, config, exports. Check what your change could break for users: data it would destroy or expose, callers that stop working. That is scope. Extra features are not.
+
+                ## The smallest complete change
+
+                Take the first option that fully works:
+
+                1. Does it need to exist? Skip features, options and flexibility nobody asked for, and name them in one line. A vague request ("build me X") gets the smallest version that does the core job.
+                2. Already in this codebase (a helper, component, service, pattern)? Use it the way the surrounding code does.
+                3. Standard library or a platform feature? Use it, unless the project has its own. A house component beats a native widget.
+                4. An installed dependency? Use it.
+                5. Can it be one line a reader gets at a glance? One line.
+                6. Is there an actively maintained library that already does it? Use it. A dependency someone else maintains beats a hand-rolled copy of the same thing.
+                7. Otherwise: the minimum code that works.
+
+                - Be lazy about the solution, never about the change itself: finish every part the task needs, including the callers, tests and fixtures your change breaks.
+                - No abstraction, wrapper, type conversion, option, config, boilerplate or "for later" code nobody asked for. Keep values in the form the platform already gives you. Deletion beats addition. Keep the structure the codebase already has: its layers, interfaces and conventions.
+                - The shortest working diff wins, once you know everything it must touch. A one-liner that needs decoding is not short.
+                - Comment only the why the code cannot show, in one line.
+                - Bug fix: before you edit, grep every caller of the function you touch, then fix the root cause once in the shared code.
+                - Code you move or merge keeps its error handling and validation.
+                - Between options of equal size, take the one that is correct on edge cases.
+                - Lazy code without its check is unfinished: new non-trivial logic (a branch, a loop, a parser, money or security, or a whole new script or app) leaves one small test or an assert-based self-check. Trivial changes need none.
+                - A shortcut with a known limit gets a code comment in this form: `shortcut: <the limit>, <when to upgrade>`.
+
+                Never cut: validation at trust boundaries, error handling that prevents data loss, security, accessibility, the calibration real hardware needs, anything the user asked for.
+
+          - id: agent-instructions
+            name: '@deepseek-ai/dsh-agent-instructions'
+            config:
+              maxBytes: 65536
+
+          - id: tool-fs
+            name: '@deepseek-ai/dsh-tool-fs'
+          - id: zephyr-tools
+            name: '@liyang8246/dsh-zephyr/restrict'
+          - id: tool-pwsh
+            name: '@deepseek-ai/dsh-tool-pwsh'
+            disabled: !!js process.platform !== 'win32'
+          - id: tool-bash
+            name: '@deepseek-ai/dsh-tool-bash'
+            disabled: !!js process.platform === 'win32'
+          - id: uv-run
+            name: '@liyang8246/dsh-zephyr/uv-run'
+          - id: tool-jobs
+            name: '@deepseek-ai/dsh-tool-jobs'
+          - id: zephyr-subagent
+            name: '@deepseek-ai/dsh-tool-subagent'
+            config:
+              provider: spawn
+          - id: zephyr-subagent-control
+            name: '@deepseek-ai/dsh-tool-subagent-control'
+
+          - id: skill-filesystem
+            name: '@deepseek-ai/dsh-skill-filesystem'
+          - id: tool-skill
+            name: '@deepseek-ai/dsh-tool-skill'
+
+          - id: tool-ask-user
+            name: '@deepseek-ai/dsh-tool-ask-user'
+          - id: tool-web
+            name: '@deepseek-ai/dsh-tool-web'
+            config:
+              fetch: true
+              searchTimeoutMs: 60000
+          - id: present
+            name: '@deepseek-ai/dsh-tool-present'
+
+          - id: compaction
+            name: cordis:group
+            group: true
+            isolate:
+              compaction: true
+              toolResultPruner: true
+            config:
+              - id: compaction-basic
+                name: '@deepseek-ai/dsh-compaction-basic'
+              - id: command-compact
+                name: '@deepseek-ai/dsh-command-compact'
+              - id: tool-result-pruner
+                name: '@deepseek-ai/dsh-compaction-tool-result-pruner'
+                config:
+                  thresholdChars: 8192
+                  headChars: 4096
+                  tailChars: 1024

package/icon.svg

@@ -0,0 +1,12 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" role="img" aria-label="Zephyr">
+  <defs>
+    <linearGradient id="zephyr-gust" x1="8" y1="8" x2="56" y2="56" gradientUnits="userSpaceOnUse">
+      <stop offset="0" stop-color="#38bdf8"/>
+      <stop offset="1" stop-color="#6366f1"/>
+    </linearGradient>
+  </defs>
+  <rect width="64" height="64" rx="14" fill="#0f172a"/>
+  <path d="M12 23h22a5 5 0 1 0-5-5" fill="none" stroke="url(#zephyr-gust)" stroke-width="4" stroke-linecap="round"/>
+  <path d="M12 33h32a5 5 0 1 1-5 5" fill="none" stroke="url(#zephyr-gust)" stroke-width="4" stroke-linecap="round"/>
+  <path d="M12 43h14" fill="none" stroke="#38bdf8" stroke-width="4" stroke-linecap="round"/>
+</svg>

package/lib/restrict.js

@@ -0,0 +1,17 @@
+// src/restrict.ts
+const inject = ["tools"];
+const HIDDEN_TOOLS = ["load_workspace_dependencies"];
+function apply(ctx) {
+	let restricted = false;
+	function restrict() {
+		if (restricted) return;
+		const visible = new Set(ctx.tools.schemas().map((schema) => schema.name));
+		const deny = HIDDEN_TOOLS.filter((name) => visible.has(name));
+		if (deny.length === 0) return;
+		restricted = true;
+		ctx.effect(() => ctx.tools.restrict({ deny }));
+	}
+	ctx.on("tools/change", restrict);
+	restrict();
+}
+export { apply, inject };

package/lib/uv-run.js

@@ -0,0 +1,125 @@
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { stripVTControlCharacters } from "node:util";
+// src/uv-run/args.ts
+function readArgs(raw) {
+	if (typeof raw !== "object" || raw === null || Array.isArray(raw)) throw new Error("invalid arguments: expected an object");
+	const args = raw;
+	if (typeof args.code !== "string" || args.code.trim().length === 0) throw new Error("invalid code: expected a non-empty string");
+	if (args.timeoutMs !== void 0 && (typeof args.timeoutMs !== "number" || !Number.isFinite(args.timeoutMs) || args.timeoutMs <= 0)) throw new Error(`invalid timeoutMs: expected a positive number, got ${JSON.stringify(args.timeoutMs)}`);
+	return {
+		code: args.code,
+		...args.timeoutMs !== void 0 ? { timeoutMs: args.timeoutMs } : {}
+	};
+}
+// src/uv-run/run.ts
+const DEFAULT_TIMEOUT_MS = 12e4;
+const MAX_TIMEOUT_MS = 6e5;
+const UV_CACHE_DIR = join(tmpdir(), "dsh-uv-cache");
+const UV_PYTHON_INSTALL_DIR = join(tmpdir(), "dsh-uv-python");
+async function runUv(ctx, args, exec) {
+	const timeoutMs = Math.min(args.timeoutMs ?? 12e4, MAX_TIMEOUT_MS);
+	const policy = ctx.sandboxPolicy.resolve(exec.agent === void 0 ? {} : { session: exec.agent.session });
+	const cwd = exec.agent === void 0 ? ctx.workingDirectory.defaultDirectory : await ctx.workingDirectory.ensure(exec.agent, exec.signal);
+	const spec = ctx.shell.resolve({
+		command: "uv run --no-project -",
+		workdir: cwd,
+		timeoutMs,
+		onExpiry: "kill",
+		stdin: args.code,
+		env: {
+			PYTHONUTF8: "1",
+			PYTHONIOENCODING: "utf-8",
+			UV_CACHE_DIR,
+			UV_PYTHON_INSTALL_DIR,
+			UV_NO_PROGRESS: "1",
+			NO_COLOR: "1"
+		},
+		sandboxPolicy: policy,
+		signal: exec.signal
+	});
+	let execution;
+	try {
+		execution = await ctx.shell.execute(spec);
+	} catch (error) {
+		throw new Error(`uv_run failed to start: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	return { text: formatResult(await execution.result()) };
+}
+function formatResult(result) {
+	const parts = [];
+	const stdout = stripVTControlCharacters(result.stdout.text).trimEnd();
+	const stderr = stripVTControlCharacters(result.stderr.text).trimEnd();
+	if (stdout.length > 0) parts.push(stdout);
+	if (stderr.length > 0) parts.push(`[stderr]\n${stderr}`);
+	if (result.timedOut) parts.push(`[timed out after ${result.timeoutMs}ms]`);
+	else if (result.aborted) parts.push("[aborted]");
+	else if (result.signal !== null) parts.push(`[killed by signal: ${result.signal}]`);
+	else if (result.exitCode !== null && result.exitCode !== 0) parts.push(`[exit code: ${result.exitCode}]`);
+	if (result.sandbox?.denied) parts.push(`[sandbox: file access denied under ${result.sandbox.mode} mode]`);
+	const spillPath = result.stdout.spillPath ?? result.stderr.spillPath;
+	if (result.stdout.truncated || result.stderr.truncated) parts.push(spillPath === void 0 ? "[output truncated]" : `[output truncated; full output: ${spillPath}]`);
+	return parts.length === 0 ? "(no output)" : parts.join("\n");
+}
+// src/uv-run/definition.ts
+const DESCRIPTION = [
+	"Run a Python script with `uv run --no-project -`.",
+	"Pass the complete script as `code`; it is delivered on stdin, so quotes, backslashes, newlines, and Unicode need no shell escaping.",
+	"Without a PEP 723 header, uv uses the first Python on PATH, so imports outside the standard library may fail.",
+	"To install dependencies, include a PEP 723 header: start with `# /// script`, list dependencies in `# dependencies = [...]`, then close with `# ///`; uv creates an isolated environment for that script.",
+	"Non-zero exits are reported as `[exit code: N]`; sandbox denials are reported as `[sandbox: ...]`."
+].join(" ");
+function valueText(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return "";
+	const text = value.text;
+	return typeof text === "string" ? text : "";
+}
+function createDefinition(ctx) {
+	return {
+		name: "uv_run",
+		description: DESCRIPTION,
+		parameters: {
+			type: "object",
+			properties: {
+				code: {
+					type: "string",
+					description: "Complete Python script. Include PEP 723 inline metadata when it imports third-party packages."
+				},
+				timeoutMs: {
+					type: "number",
+					description: `Timeout in milliseconds; defaults to ${DEFAULT_TIMEOUT_MS} and is capped at ${MAX_TIMEOUT_MS}.`
+				}
+			},
+			required: ["code"],
+			additionalProperties: false
+		},
+		output: {
+			schema: {
+				type: "object",
+				properties: { text: { type: "string" } },
+				required: ["text"],
+				additionalProperties: false
+			},
+			render(_args, value) {
+				return [{
+					type: "text",
+					text: valueText(value)
+				}];
+			}
+		},
+		async execute(rawArgs, exec) {
+			return runUv(ctx, readArgs(rawArgs), exec);
+		}
+	};
+}
+// src/uv-run/index.ts
+const inject = [
+	"tools",
+	"shell",
+	"workingDirectory",
+	"sandboxPolicy"
+];
+function apply(ctx) {
+	ctx.effect(() => ctx.tools.register(createDefinition(ctx)));
+}
+export { apply, inject };

package/locale/en.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "Zephyr Coding Preset",
+    "description": "Standalone Zephyr persona, slim coding tools and sandbox-aware uv_run. Uses the Host's existing model selection."
+  }
+}

package/locale/zh.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "Zephyr 编码预设",
+    "description": "独立 Zephyr 人格、精简编码工具与遵循沙箱策略的 uv_run；沿用宿主模型选择。"
+  }
+}

package/package.json

@@ -1,6 +1,41 @@
 {
   "name": "@liyang8246/dsh-zephyr",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "type": "module",
+  "version": "0.1.0",
+  "description": "Standalone Zephyr coding preset, persona and slim tool set for DeepSeek Harness.",
+  "exports": {
+    "./uv-run": "./lib/uv-run.js",
+    "./restrict": "./lib/restrict.js",
+    "./locale/*.json": "./locale/*.json",
+    "./icon": "./icon.svg",
+    "./cordis.patch.yml": "./cordis.patch.yml",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "README.md",
+    "cordis.patch.yml",
+    "icon.svg",
+    "lib/",
+    "locale/*.json"
+  ],
+  "engines": {
+    "node": ">=22.19.0",
+    "dsh": ">=0.2.1-rc.5 <0.3.0"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "4.0.5",
+    "@deepseek-ai/dsh-sandbox-policy": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-shell": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-tools": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-working-directory": "0.2.1-rc.5"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    }
+  },
+  "scripts": {
+    "build": "tsdown",
+    "typecheck": "tsc --noEmit"
+  }
 }