@matamt-dbg/dsh-studio 0.2.2 → 0.2.7

package/index.js

@@ -62,6 +62,7 @@ var ROLE_TOOL = "subagent_role";
 var LEGACY_ROLE_TOOL = "studio_role";
 var GENERIC_DELEGATION_TOOLS = ["subagent", "subagent_fork", "list_subagent_models"];
 var SUBAGENT_PLUGIN = "@deepseek-ai/dsh-tool-subagent";
+var isDelegationPlugin = (name) => name === SUBAGENT_PLUGIN || name === ROLE_PLUGIN;
 var WITHDRAWN_TOOLS = ["task_run"];
 function delegationTools(tools, hasRoles = false) {
   const delegates = hasRoles || tools.some((name) => name === ROLE_TOOL || name === LEGACY_ROLE_TOOL || GENERIC_DELEGATION_TOOLS.includes(name));
@@ -69,7 +70,7 @@ function delegationTools(tools, hasRoles = false) {
   return delegates ? [...rest, ROLE_TOOL] : rest;
 }
 function withoutDelegationPlugins(rows) {
-  return rows.filter((row) => row.name !== SUBAGENT_PLUGIN && row.name !== ROLE_PLUGIN).map((row) => row.group && Array.isArray(row.config) ? { ...row, config: withoutDelegationPlugins(row.config) } : row);
+  return rows.filter((row) => !isDelegationPlugin(row.name)).map((row) => row.group && Array.isArray(row.config) ? { ...row, config: withoutDelegationPlugins(row.config) } : row);
 }
 function renameLegacyRoleKey(entries) {
   if (!entries || !Object.hasOwn(entries, LEGACY_ROLE_TOOL)) return entries;
@@ -91,7 +92,31 @@ function migratePolicyConfig(config) {
 // src/optimized-preset.ts
 var OPTIMIZED_PRESET_ID = "studio-optimized";
 var BUILTIN_TOOL_PRESETS = ["standard", "ptc", "minimal", "cordis"];
-var excluded = /* @__PURE__ */ new Set(["get_goal", "create_goal", "update_goal", "todo_write", "task_run", "cordis_inspect_list", "cordis_inspect_query", "plugin_manager"]);
+var OPTIMIZED_TOOLS = [
+  "read_batch",
+  "read",
+  "write",
+  "edit",
+  "glob",
+  "grep",
+  "job_output",
+  "job_list",
+  "job_kill",
+  "skill",
+  "ask_user_question",
+  "web_search",
+  "web_fetch",
+  "present",
+  "bash",
+  "read_image",
+  "exit_plan_mode",
+  "send_message",
+  "interrupt_agent",
+  "list_agents",
+  "workflow",
+  "subagent_role"
+];
+var ALLOWED_TOOLS = /* @__PURE__ */ new Set([...OPTIMIZED_TOOLS, ...GENERIC_DELEGATION_TOOLS, LEGACY_ROLE_TOOL]);
 var OPTIMIZED_PROMPT = `Use glob to discover paths, grep to search contents, and read to inspect files before editing. Prefer targeted edits.
 Batch independent read-only inspections with read_batch. Start independent tool calls together; keep calls that depend on earlier results sequential. Do not guess unknown arguments.
 Wait for required work to finish before validating it. Use background execution only for independent work or intentionally long-lived services. Do not duplicate running work or busy-poll it.
@@ -99,7 +124,7 @@ Track every job you start. Before reporting completion, collect all relevant res
 Delegate self-contained independent work when useful and collect the result before relying on it.
 Keep changes within the requested scope and preserve user work. Use the smallest sufficient checks for the requested outcome and risk, then stop when the work is complete.`;
 function optimizedTemplate(tools) {
-  const selected = delegationTools(tools.filter((name) => !excluded.has(name)));
+  const selected = delegationTools(tools.filter((name) => ALLOWED_TOOLS.has(name)));
   const request = {
     preset: "studio-master",
     providers: ["@deepseek-ai/dsh-persona"],
@@ -378,7 +403,8 @@ var toolPromptSections = {
   web_search: ["tool:web_search"],
   get_goal: ["tool:goal"],
   create_goal: ["tool:goal"],
-  update_goal: ["tool:goal"]
+  update_goal: ["tool:goal"],
+  workflow: ["tool:workflow"]
 };
 
 // src/preset-catalog.ts
@@ -491,6 +517,8 @@ function parsePreviewRequest(value) {
   if (row.providerConfigs !== void 0 && (!record4(row.providerConfigs) || Object.values(row.providerConfigs).some((v) => !record4(v)))) throw new Error("Invalid provider configs");
   if (row.configOverrides !== void 0) validateConfigOverrides(row.configOverrides);
   if (row.execution !== void 0) validateExecutionDefaults(row.execution);
+  const filter = row.subagentToolFilter;
+  if (filter !== void 0 && (!record4(filter) || !strings(filter.deny) || filter.deny.some((name) => !name))) throw new Error("Invalid subagent tool filter");
   return {
     ...row.configOverrides !== void 0 ? { configOverrides: row.configOverrides } : {},
     ...row.execution !== void 0 ? { execution: row.execution } : {},
@@ -502,7 +530,8 @@ function parsePreviewRequest(value) {
     ...row.persona !== void 0 ? { persona: row.persona } : {},
     ...row.sections !== void 0 ? { sections: row.sections } : {},
     ...row.toolOverrides !== void 0 ? { toolOverrides: row.toolOverrides } : {},
-    ...row.providerConfigs !== void 0 ? { providerConfigs: row.providerConfigs } : {}
+    ...row.providerConfigs !== void 0 ? { providerConfigs: row.providerConfigs } : {},
+    ...filter !== void 0 && filter.deny.length ? { subagentToolFilter: { deny: [...new Set(filter.deny)] } } : {}
   };
 }
 function promptProviders(rows) {
@@ -537,12 +566,26 @@ function parseComposition(content) {
 function findProviders(rows) {
   return rows.flatMap((row) => row.disabled === true ? [] : row.group && Array.isArray(row.config) ? findProviders(row.config) : promptProviderModules.includes(row.name) ? [row] : []);
 }
+function normalizeRetention(config, overrides) {
+  if (overrides?.retainTokens !== void 0 && overrides.retainRatio !== void 0) {
+    throw new Error("Compaction retainRatio and retainTokens are mutually exclusive");
+  }
+  if (overrides?.retainTokens !== void 0) delete config.retainRatio;
+  if (overrides?.retainRatio !== void 0) delete config.retainTokens;
+}
 async function compositionPlan(ctx, input) {
   const request = parsePreviewRequest(input);
-  const base = request.preset === MASTER_PRESET_ID ? MASTER_PRESET_ID : "minimal";
+  const base = request.preset;
   if (request.configOverrides && base !== MASTER_PRESET_ID) throw new Error("Config overrides require Studio Master");
-  const minimal = applyConfigOverrides(parseComposition((await ctx.agentPresets.readDocument(base)).content), request.configOverrides ?? {});
-  const available = new Map(findProviders(minimal).map((row) => [row.name, row]));
+  const source = applyConfigOverrides(parseComposition((await ctx.agentPresets.readDocument(base)).content), request.configOverrides ?? {});
+  if (request.configOverrides && Object.keys(request.configOverrides).length) {
+    for (const { id, row } of configEntries(source)) {
+      if (row.name === "@deepseek-ai/dsh-compaction-basic") {
+        normalizeRetention(row.config, request.configOverrides[id]);
+      }
+    }
+  }
+  const available = new Map(findProviders(source).map((row) => [row.name, row]));
   const presets = await ctx.agentPresets.list();
   for (const preset of presets) {
     if (base === MASTER_PRESET_ID || !["minimal", "standard", "ptc", "cordis"].includes(preset.id)) continue;
@@ -572,33 +615,21 @@ async function compositionPlan(ctx, input) {
       if (request.persona !== void 0) config.prefix = request.persona;
     }
     if (name === "@deepseek-ai/dsh-compaction-basic") {
-      if (overrides?.retainTokens !== void 0 && overrides.retainRatio === void 0) delete config.retainRatio;
-      if (overrides?.retainRatio !== void 0 && overrides.retainTokens === void 0) delete config.retainTokens;
+      normalizeRetention(config, overrides);
     }
     return { ...row, id: `studio-provider-${index}`, config };
   });
   if (request.persona !== void 0 && !request.providers.includes("@deepseek-ai/dsh-persona")) throw new Error("Select persona before editing its prefix");
   for (const name of Object.keys(request.providerConfigs ?? {})) if (!request.providers.includes(name)) throw new Error(`Unselected provider override: ${name}`);
-  const globalNames = new Set(ctx.tools.schemas().map((tool) => tool.name));
-  const missing = request.tools.filter((name) => !globalNames.has(name));
-  if (missing.length || base === MASTER_PRESET_ID) {
-    let source;
-    const candidates = base === MASTER_PRESET_ID ? [MASTER_PRESET_ID] : ["minimal", ...presets.map((p) => p.id).filter((id) => id !== "minimal" && !id.startsWith("studio-"))];
-    for (const id of candidates) {
-      let lease;
-      try {
-        lease = await ctx.agentPresets.acquireScope(id);
-        const names2 = new Set(ctx.tools.schemas(lease.key).map((tool) => tool.name));
-        if (missing.every((name) => names2.has(name))) {
-          source = id === base ? minimal : parseComposition((await ctx.agentPresets.readDocument(id)).content);
-          break;
-        }
-      } catch {
-      } finally {
-        await lease?.[Symbol.asyncDispose]();
-      }
+  if (request.tools.length || base === MASTER_PRESET_ID) {
+    const lease = await ctx.agentPresets.acquireScope(base);
+    try {
+      const names2 = new Set(ctx.tools.schemas(lease.key).map((tool) => tool.name));
+      const missing = request.tools.filter((name) => !names2.has(name));
+      if (missing.length) throw new Error(`Requested preset ${base} does not supply tools: ${missing.join(", ")}. Tools from other source scopes cannot be substituted safely.`);
+    } finally {
+      await lease[Symbol.asyncDispose]();
     }
-    if (!source) throw new Error(`No compatible installed tool composition supplies: ${missing.join(", ")}. Tools from incompatible source scopes cannot be combined safely.`);
     plugins.push(...selectPromptProviders(source, []));
   }
   const compaction = plugins.filter((row) => ["@deepseek-ai/dsh-compaction-basic", "@deepseek-ai/dsh-compaction-tool-result-pruner"].includes(row.name));
@@ -608,7 +639,7 @@ async function compositionPlan(ctx, input) {
 }
 
 // src/host/preset-policy.ts
-import { scopeOf } from "@deepseek-ai/dsh-scope";
+import { scopeChainOf, scopeOf } from "@deepseek-ai/dsh-scope";
 var POLICY_SECTION_ORDERS = Object.freeze({
   "tool:jobs": "TOOL_JOBS",
   "tool:bash": "TOOL_BASH",
@@ -620,7 +651,8 @@ var POLICY_SECTION_ORDERS = Object.freeze({
   "tool:grep": "TOOL_GREP",
   "tool:web_fetch": "TOOL_WEB_FETCH",
   "tool:web_search": "TOOL_WEB_SEARCH",
-  "tool:goal": "TOOL_GOAL"
+  "tool:goal": "TOOL_GOAL",
+  "tool:workflow": "TOOL_WORKFLOW"
 });
 var own2 = (object3, key) => Object.prototype.hasOwnProperty.call(object3, key);
 var record3 = (value) => !!value && typeof value === "object" && !Array.isArray(value);
@@ -638,6 +670,11 @@ function validatePolicy(config) {
   for (const [name, text] of Object.entries(config.sections)) {
     if (!own2(POLICY_SECTION_ORDERS, name) || typeof text !== "string") throw new Error(`Unsupported policy section: ${name}`);
   }
+  if (config.childToolFilter !== void 0) {
+    const deny = record3(config.childToolFilter) ? config.childToolFilter.deny : void 0;
+    if (!Array.isArray(deny) || deny.some((name) => typeof name !== "string" || !name)) throw new Error("Invalid subagent tool filter");
+    for (const name of deny) if (!config.tools.includes(name)) throw new Error(`Subagent tool filter requires selected tool: ${name}`);
+  }
 }
 function patchParameter(parameters, path, description) {
   const segments = path.split(".");
@@ -651,11 +688,20 @@ function patchParameter(parameters, path, description) {
 function installPolicy(ctx, scopeKey, config) {
   validatePolicy(config);
   if (scopeOf(ctx) !== scopeKey) throw new Error("Studio policy requires its owning scoped context");
+  if (config.tools.includes("run_code") || ctx.tools.get("run_code", scopeKey) !== void 0) {
+    throw new Error("Studio policy does not support PTC presentation or the reserved run_code tool; configure this preset with native tool presentation");
+  }
   const missing = config.tools.filter((name) => ctx.tools.get(name, scopeKey) === void 0);
-  if (missing.length) console.warn(`Studio policy: ${missing.length} selected tool(s) unavailable on this host, skipped: ${missing.join(", ")}`);
-  const available = config.tools.filter((name) => !missing.includes(name));
-  const selected = new Set(available);
-  const definitions = available.map((name) => {
+  if (missing.length) throw new Error(`Studio policy selected tools unavailable: ${missing.join(", ")}`);
+  const restoreProbe = ctx.tools.restrict({ allow: [] });
+  try {
+    const local = ctx.tools.schemas(scopeKey);
+    if (local.length) throw new Error(`Studio policy does not support own-scope tools: ${local.map((tool) => tool.name).join(", ")}; register providers in an ancestor preset scope. Public API cannot hide late own-scope schemas; dynamic own-scope providers are unsupported`);
+  } finally {
+    restoreProbe();
+  }
+  const selected = new Set(config.tools);
+  const definitions = config.tools.map((name) => {
     const definition = ctx.tools.get(name, scopeKey);
     const override = config.toolOverrides[name];
     const defaults = config.execution?.defaults[name];
@@ -689,9 +735,7 @@ function installPolicy(ctx, scopeKey, config) {
     for (const release of disposers.splice(0).reverse()) release();
   };
   try {
-    disposers.push(ctx.tools.restrict({ allow: available }));
-    const excess = ctx.tools.schemas(scopeKey).filter((tool) => !selected.has(tool.name));
-    if (excess.length) throw new Error(`Unselected scoped tools must be removed from preset plugins: ${excess.map((tool) => tool.name).join(", ")}`);
+    disposers.push(ctx.tools.restrict({ allow: [...selected] }));
     disposers.push(ctx.tools.guard((execution) => selected.has(execution.name) ? void 0 : "Tool excluded by Studio preset policy"));
     for (const definition of definitions) disposers.push(ctx.tools.register(definition));
     for (const [name, text] of Object.entries(config.sections)) disposers.push(ctx.systemPrompt.section({ name, order: ctx.systemPrompt.getSectionOrder(POLICY_SECTION_ORDERS[name]), text, interpolate: false }));
@@ -758,6 +802,7 @@ function executionCapabilities(tools) {
 }
 
 // src/host/preset-store.ts
+import { createScope as createScope2 } from "@deepseek-ai/dsh-scope";
 import { randomUUID as randomUUID3 } from "node:crypto";
 import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2, rename as rename2 } from "node:fs/promises";
 import { dirname as dirname2, join } from "node:path";
@@ -787,11 +832,27 @@ function parseRoles(input) {
     if (!/^[a-zA-Z0-9_-]+$/.test(reasoning)) throw new Error("Role reasoning must be inherit or an effort identifier");
     if (spawn !== "fresh" && spawn !== "fork") throw new Error("Role spawn must be fresh or fork");
     seen.add(role);
-    return { name, role, model, reasoning, spawn, persona, ..."overrides" in value ? { overrides: structuredClone(value.overrides) } : {} };
+    const filter = value.toolFilter;
+    if (filter !== void 0 && (!object2(filter) || !Array.isArray(filter.deny) || filter.deny.some((name2) => typeof name2 !== "string" || !name2) || filter.mode !== void 0 && filter.mode !== "extend" && filter.mode !== "replace")) throw new Error("Invalid role tool filter");
+    return {
+      name,
+      role,
+      model,
+      reasoning,
+      spawn,
+      persona,
+      ...filter !== void 0 ? { toolFilter: { mode: filter.mode ?? "replace", deny: [...new Set(filter.deny)] } } : {},
+      ..."overrides" in value ? { overrides: structuredClone(value.overrides) } : {}
+    };
   });
 }
 function executableRoles(roles) {
-  return roles.map(({ name, role, model, reasoning, spawn, persona }) => ({ name, role, model, reasoning, spawn, persona }));
+  return roles.map(({ name, role, model, reasoning, spawn, persona, toolFilter }) => ({ name, role, model, reasoning, spawn, persona, ...toolFilter ? { toolFilter } : {} }));
+}
+function roleToolFilter(role, presetDefault = []) {
+  const own3 = role?.toolFilter;
+  if (!own3) return [...presetDefault];
+  return own3.mode === "replace" ? [...own3.deny] : [.../* @__PURE__ */ new Set([...presetDefault, ...own3.deny])];
 }
 
 // src/host/role-validation.ts
@@ -821,7 +882,7 @@ async function validateRoleModel(llm, role, signal) {
 
 // src/host/preset-store.ts
 var owned = (id) => id === OPTIMIZED_PRESET_ID || /^studio-user-[a-f0-9-]{36}$/.test(id);
-var warning = "Work convenience settings are saved but not applied yet. Legacy role overrides are stored only; roles apply only their supported settings.";
+var retiredLegacyWarning = "Work convenience settings are saved but not applied yet. Legacy role overrides are stored only; roles apply only their supported settings.";
 function migrateLegacyNames(row) {
   const request = row.request;
   if (request.toolOverrides) {
@@ -864,6 +925,7 @@ var PresetStore = class {
           if (!owned(row.id)) throw new Error("Invalid Studio preset ownership");
           parsePreviewRequest(row.request);
           migrateLegacyNames(row);
+          if (row.applyWarning === retiredLegacyWarning) delete row.applyWarning;
         }
       } catch (error) {
         if (error.code !== "ENOENT") throw error;
@@ -879,10 +941,32 @@ var PresetStore = class {
     })();
   }
   async mount(id, definition) {
-    const dispose = await this.ctx.agentPresets.register({ id, name: definition.name, description: definition.description, plugins: parseComposition(definition.plugins) });
+    const plugins = parseComposition(definition.plugins);
+    const dispose = await this.ctx.agentPresets.register({ id, name: definition.name, description: definition.description, plugins });
     try {
       const preset = await this.ctx.agentPresets.resolve(id);
       if (preset.broken) throw new Error(preset.broken);
+      const policies = (rows) => rows.flatMap((row) => row.disabled === true ? [] : row.group && Array.isArray(row.config) ? policies(row.config) : row.name === POLICY_PLUGIN ? [row.config] : []);
+      const configs = policies(plugins);
+      if (configs.length) {
+        const lease = await this.ctx.agentPresets.acquireScope(id);
+        try {
+          const key = {};
+          const child = createScope2(this.ctx, key, { parent: lease.key });
+          const releases = [];
+          try {
+            for (const config of configs) releases.push(installPolicy(child.ctx, key, config));
+          } finally {
+            try {
+              for (const release of releases.reverse()) release();
+            } finally {
+              await child.dispose();
+            }
+          }
+        } finally {
+          await lease[Symbol.asyncDispose]();
+        }
+      }
       this.disposers.set(id, dispose);
     } catch (error) {
       await dispose();
@@ -909,27 +993,72 @@ var PresetStore = class {
     const { applied, ...value } = row;
     return structuredClone({ ...value, ...row.id === OPTIMIZED_PRESET_ID ? { template: true, nonDeletable: true } : {} });
   }
-  /** Seed once. Later startups retain user edits and explicit unapplied state. */
+  /** Compose the Optimized applied snapshot: the template request over the current base composition. */
+  optimizedApplied(request, plugins) {
+    const delegates = request.tools.includes(ROLE_TOOL);
+    const base = applyConfigOverrides(plugins, request.configOverrides ?? {});
+    return dump([...delegates ? [...withoutDelegationPlugins(base), { id: "studio-roles", name: ROLE_PLUGIN, config: { roles: [] } }] : base, { id: "studio-optimized-policy", name: POLICY_PLUGIN, config: { tools: request.tools, toolOverrides: request.toolOverrides, sections: {}, prompt: request.prompt, execution: request.execution } }], { schema: entryListSchema2, noRefs: true });
+  }
+  /**
+   * Seed the built-in on first run, then keep it aligned with the shipped template. Optimized is
+   * locked against editing, so its stored request carries no user content — only the applied or
+   * unapplied choice is the user's, and that survives. Without the alignment a profile plugin that
+   * registers a new tool would enlarge the preset forever after its first seed.
+   */
   ensureOptimized(tools, plugins) {
     return this.serial(async () => {
-      const existing = this.rows.find((row2) => row2.id === OPTIMIZED_PRESET_ID);
-      if (existing) return this.public(existing);
       const template = optimizedTemplate(tools);
-      const request = template.request;
-      const delegates = request.tools.includes(ROLE_TOOL);
-      const base = applyConfigOverrides(plugins, request.configOverrides ?? {});
-      const applied = { name: template.name, description: template.description, plugins: dump([...delegates ? [...withoutDelegationPlugins(base), { id: "studio-roles", name: ROLE_PLUGIN, config: { roles: [] } }] : base, { id: "studio-optimized-policy", name: POLICY_PLUGIN, config: { tools: request.tools, toolOverrides: request.toolOverrides, sections: {}, prompt: request.prompt, execution: request.execution } }], { schema: entryListSchema2, noRefs: true }) };
+      const existing = this.rows.find((row) => row.id === OPTIMIZED_PRESET_ID);
+      if (existing && JSON.stringify(existing.request) === JSON.stringify(template.request)) return this.public(existing);
       const now = (/* @__PURE__ */ new Date()).toISOString();
-      const row = { id: template.id, name: template.name, description: template.description, request: template.request, conveniences: {}, agents: [], updatedAt: now, appliedAt: now, status: "applied", applied, ...template.applyWarning ? { applyWarning: template.applyWarning } : {} };
-      await this.mount(row.id, applied);
+      const buildApplied = () => ({ name: template.name, description: template.description, plugins: this.optimizedApplied(template.request, plugins) });
+      if (!existing) {
+        const applied = buildApplied();
+        const row = { id: template.id, name: template.name, description: template.description, request: template.request, conveniences: {}, agents: [], updatedAt: now, appliedAt: now, status: "applied", applied, ...template.applyWarning ? { applyWarning: template.applyWarning } : {} };
+        await this.mount(row.id, applied);
+        try {
+          await this.persist([...this.rows, row]);
+        } catch (error) {
+          await this.disposers.get(row.id)?.();
+          this.disposers.delete(row.id);
+          throw error;
+        }
+        return this.public(row);
+      }
+      const refresh = { ...existing, name: template.name, description: template.description, request: template.request, updatedAt: now };
+      if (template.applyWarning) refresh.applyWarning = template.applyWarning;
+      else delete refresh.applyWarning;
+      if (existing.applied) {
+        const applied = buildApplied();
+        await this.disposers.get(existing.id)?.();
+        this.disposers.delete(existing.id);
+        try {
+          await this.mount(existing.id, applied);
+        } catch (error) {
+          try {
+            await this.mount(existing.id, existing.applied);
+          } catch {
+          }
+          throw error;
+        }
+        refresh.applied = applied;
+        refresh.appliedAt = now;
+        refresh.status = "applied";
+      }
       try {
-        await this.persist([...this.rows, row]);
+        await this.persist(this.rows.map((row) => row.id === existing.id ? refresh : row));
       } catch (error) {
-        await this.disposers.get(row.id)?.();
-        this.disposers.delete(row.id);
+        await this.disposers.get(existing.id)?.();
+        this.disposers.delete(existing.id);
+        if (existing.applied) {
+          try {
+            await this.mount(existing.id, existing.applied);
+          } catch {
+          }
+        }
         throw error;
       }
-      return this.public(row);
+      return this.public(refresh);
     });
   }
   list() {
@@ -974,21 +1103,25 @@ var PresetStore = class {
       for (const role of roles) await validateRoleModel(this.ctx.get("llm"), role);
       const delegates = tools.includes(ROLE_TOOL);
       const keep = (entries) => Object.fromEntries(Object.entries(entries).filter(([name]) => tools.includes(name)));
-      const rolePlugins = delegates ? [{ id: "studio-roles", name: ROLE_PLUGIN, config: { roles } }] : [];
+      const presetHidden = old.request.subagentToolFilter?.deny ?? [];
+      const lists = [presetHidden, ...roles.map((role) => roleToolFilter(role, presetHidden))];
+      const unknownHidden = [...new Set(lists.flat().filter((name) => !tools.includes(name) || name === ROLE_TOOL))];
+      if (delegates && unknownHidden.length) throw new Error(`Subagent Tool Filter may only list tools selected in this preset: ${unknownHidden.join(", ")}`);
+      const hideable = delegates ? [...new Set(lists.flat())] : [];
+      const childToolFilter = hideable.length ? { deny: hideable } : void 0;
+      const rolePlugins = delegates ? [{ id: "studio-roles", name: ROLE_PLUGIN, config: { roles, ...presetHidden.length ? { toolFilter: { deny: [...presetHidden] } } : {} } }] : [];
       const execution = request.execution && {
         ...request.execution,
         defaults: keep(request.execution.defaults),
         ...request.execution.batch && !tools.includes(request.execution.batch.tool) ? { batch: void 0 } : {}
       };
-      const applied = { name: old.name, description: old.description, plugins: dump([...withoutDelegationPlugins(plugins), ...rolePlugins, { id: "studio-policy", name: POLICY_PLUGIN, config: { tools: [...new Set(tools)], toolOverrides: keep(request.toolOverrides ?? {}), sections: request.sections ?? {}, prompt: request.prompt, ...execution ? { execution } : {} } }], { schema: entryListSchema2, noRefs: true }) };
+      const applied = { name: old.name, description: old.description, plugins: dump([...withoutDelegationPlugins(plugins), ...rolePlugins, { id: "studio-policy", name: POLICY_PLUGIN, config: { tools: [...new Set(tools)], toolOverrides: keep(request.toolOverrides ?? {}), sections: request.sections ?? {}, prompt: request.prompt, ...execution ? { execution } : {}, ...childToolFilter ? { childToolFilter } : {} } }], { schema: entryListSchema2, noRefs: true }) };
       await this.disposers.get(id)?.();
       this.disposers.delete(id);
       try {
         await this.mount(id, applied);
-        const hasLegacySettings = old.conveniences != null && Object.keys(Object(old.conveniences)).length > 0 || Array.isArray(old.agents) && old.agents.some((role) => role && Object.hasOwn(role, "overrides"));
         const row = { ...old, applied, appliedAt: (/* @__PURE__ */ new Date()).toISOString(), status: "applied" };
-        if (hasLegacySettings) row.applyWarning = warning;
-        else delete row.applyWarning;
+        delete row.applyWarning;
         await this.persist(this.rows.map((item) => item.id === id ? row : item));
         return this.public(row);
       } catch (error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@matamt-dbg/dsh-studio",
-  "version": "0.2.2",
+  "version": "0.2.7",
   "description": "DSH Studio: build, edit and apply DeepSeek Harness agent presets — tools, prompts, Configs and role-based subagents — from the web GUI.",
   "keywords": [
     "deepseek-harness",

package/policy.js

@@ -39,7 +39,34 @@ function applyExecutionDefaults(args, defaults) {
 }
 
 // src/host/preset-policy.ts
-import { scopeOf } from "@deepseek-ai/dsh-scope";
+import { scopeChainOf, scopeOf } from "@deepseek-ai/dsh-scope";
+
+// src/tool-prompt-sections.ts
+var toolPromptSections = {
+  bash: ["tool:bash"],
+  pwsh: ["tool:pwsh"],
+  read: ["tool:read"],
+  write: ["tool:write"],
+  edit: ["tool:edit"],
+  glob: ["tool:glob"],
+  grep: ["tool:grep"],
+  job_list: ["tool:jobs"],
+  job_output: ["tool:jobs"],
+  job_kill: ["tool:jobs"],
+  web_fetch: ["tool:web_fetch"],
+  web_search: ["tool:web_search"],
+  get_goal: ["tool:goal"],
+  create_goal: ["tool:goal"],
+  update_goal: ["tool:goal"],
+  workflow: ["tool:workflow"]
+};
+function sectionsOnlyFor(hidden, kept) {
+  const owned = (names2) => new Set(names2.flatMap((name2) => toolPromptSections[name2] ?? []));
+  const still = owned(kept);
+  return [...owned(hidden)].filter((section) => !still.has(section));
+}
+
+// src/host/preset-policy.ts
 var POLICY_SECTION_ORDERS = Object.freeze({
   "tool:jobs": "TOOL_JOBS",
   "tool:bash": "TOOL_BASH",
@@ -51,7 +78,8 @@ var POLICY_SECTION_ORDERS = Object.freeze({
   "tool:grep": "TOOL_GREP",
   "tool:web_fetch": "TOOL_WEB_FETCH",
   "tool:web_search": "TOOL_WEB_SEARCH",
-  "tool:goal": "TOOL_GOAL"
+  "tool:goal": "TOOL_GOAL",
+  "tool:workflow": "TOOL_WORKFLOW"
 });
 var own2 = (object, key) => Object.prototype.hasOwnProperty.call(object, key);
 var record2 = (value) => !!value && typeof value === "object" && !Array.isArray(value);
@@ -69,6 +97,26 @@ function validatePolicy(config) {
   for (const [name2, text] of Object.entries(config.sections)) {
     if (!own2(POLICY_SECTION_ORDERS, name2) || typeof text !== "string") throw new Error(`Unsupported policy section: ${name2}`);
   }
+  if (config.childToolFilter !== void 0) {
+    const deny = record2(config.childToolFilter) ? config.childToolFilter.deny : void 0;
+    if (!Array.isArray(deny) || deny.some((name2) => typeof name2 !== "string" || !name2)) throw new Error("Invalid subagent tool filter");
+    for (const name2 of deny) if (!config.tools.includes(name2)) throw new Error(`Subagent tool filter requires selected tool: ${name2}`);
+  }
+}
+function childPolicy(config, hidden) {
+  const deny = new Set(hidden);
+  if (!deny.size) return config;
+  const keep = (entries) => Object.fromEntries(Object.entries(entries).filter(([name2]) => !deny.has(name2)));
+  const { childToolFilter: _filter, execution, ...rest } = config;
+  const tools = config.tools.filter((name2) => !deny.has(name2));
+  const blank = Object.fromEntries(sectionsOnlyFor([...deny], tools).filter((name2) => own2(POLICY_SECTION_ORDERS, name2)).map((name2) => [name2, ""]));
+  return {
+    ...rest,
+    tools,
+    toolOverrides: keep(config.toolOverrides),
+    sections: { ...config.sections, ...blank },
+    ...execution ? { execution: (({ batch, ...value }) => ({ ...value, defaults: keep(execution.defaults), ...batch && !deny.has(batch.tool) ? { batch } : {} }))(execution) } : {}
+  };
 }
 function patchParameter(parameters, path, description) {
   const segments = path.split(".");
@@ -82,11 +130,20 @@ function patchParameter(parameters, path, description) {
 function installPolicy(ctx, scopeKey, config) {
   validatePolicy(config);
   if (scopeOf(ctx) !== scopeKey) throw new Error("Studio policy requires its owning scoped context");
+  if (config.tools.includes("run_code") || ctx.tools.get("run_code", scopeKey) !== void 0) {
+    throw new Error("Studio policy does not support PTC presentation or the reserved run_code tool; configure this preset with native tool presentation");
+  }
   const missing = config.tools.filter((name2) => ctx.tools.get(name2, scopeKey) === void 0);
-  if (missing.length) console.warn(`Studio policy: ${missing.length} selected tool(s) unavailable on this host, skipped: ${missing.join(", ")}`);
-  const available = config.tools.filter((name2) => !missing.includes(name2));
-  const selected = new Set(available);
-  const definitions = available.map((name2) => {
+  if (missing.length) throw new Error(`Studio policy selected tools unavailable: ${missing.join(", ")}`);
+  const restoreProbe = ctx.tools.restrict({ allow: [] });
+  try {
+    const local = ctx.tools.schemas(scopeKey);
+    if (local.length) throw new Error(`Studio policy does not support own-scope tools: ${local.map((tool) => tool.name).join(", ")}; register providers in an ancestor preset scope. Public API cannot hide late own-scope schemas; dynamic own-scope providers are unsupported`);
+  } finally {
+    restoreProbe();
+  }
+  const selected = new Set(config.tools);
+  const definitions = config.tools.map((name2) => {
     const definition = ctx.tools.get(name2, scopeKey);
     const override = config.toolOverrides[name2];
     const defaults = config.execution?.defaults[name2];
@@ -120,9 +177,7 @@ function installPolicy(ctx, scopeKey, config) {
     for (const release of disposers.splice(0).reverse()) release();
   };
   try {
-    disposers.push(ctx.tools.restrict({ allow: available }));
-    const excess = ctx.tools.schemas(scopeKey).filter((tool) => !selected.has(tool.name));
-    if (excess.length) throw new Error(`Unselected scoped tools must be removed from preset plugins: ${excess.map((tool) => tool.name).join(", ")}`);
+    disposers.push(ctx.tools.restrict({ allow: [...selected] }));
     disposers.push(ctx.tools.guard((execution) => selected.has(execution.name) ? void 0 : "Tool excluded by Studio preset policy"));
     for (const definition of definitions) disposers.push(ctx.tools.register(definition));
     for (const [name2, text] of Object.entries(config.sections)) disposers.push(ctx.systemPrompt.section({ name: name2, order: ctx.systemPrompt.getSectionOrder(POLICY_SECTION_ORDERS[name2]), text, interpolate: false }));
@@ -137,23 +192,91 @@ var name = "studio-preset-policy";
 var inject = ["tools", "systemPrompt"];
 function apply(ctx, config) {
   validatePolicy(config);
+  const registry = ctx.get("agents");
+  const hideable = config.childToolFilter?.deny ?? [];
+  const policyFor = (agent) => {
+    if (!hideable.length) return config;
+    const provided = (name2) => scopeOf(ctx) === void 0 || ctx.tools.get(name2, scopeOf(ctx)) !== void 0;
+    const hidden = hideable.filter((name2) => agent.ctx.tools.get(name2, agent) === void 0 && provided(name2));
+    return hidden.length ? childPolicy(config, hidden) : config;
+  };
   const installed = /* @__PURE__ */ new Map();
+  const installing = /* @__PURE__ */ new Set();
+  const install = (agent) => {
+    if (installed.has(agent) || installing.has(agent)) return;
+    installing.add(agent);
+    try {
+      installed.set(agent, installPolicy(agent.ctx, agent, policyFor(agent)));
+    } finally {
+      installing.delete(agent);
+    }
+  };
+  const remove = (agent) => {
+    installed.get(agent)?.();
+    installed.delete(agent);
+  };
   ctx.on("agent/created", ({ agent }) => {
-    if (!installed.has(agent)) installed.set(agent, installPolicy(agent.ctx, agent, config));
+    install(agent);
     return void 0;
   });
   ctx.on("agent/disposed", ({ agent }) => {
-    installed.get(agent)?.();
-    installed.delete(agent);
+    remove(agent);
+  });
+  const composition = scopeOf(ctx);
+  const agents = registry;
+  if (composition === void 0 || agents === void 0) {
+    ctx.effect(() => () => {
+      for (const dispose of installed.values()) dispose();
+      installed.clear();
+    });
+    return;
+  }
+  const belongs = (agent) => scopeChainOf(scopeOf(agent.ctx)).includes(composition);
+  const blocked = /* @__PURE__ */ new Map();
+  const unblock = (agent) => {
+    blocked.get(agent)?.release();
+    blocked.delete(agent);
+  };
+  const block = (agent, error) => {
+    const reason = `Studio preset policy could not be installed: ${error instanceof Error ? error.message : String(error)}`;
+    const current = blocked.get(agent);
+    if (current?.reason === reason) return;
+    current?.release();
+    blocked.set(agent, { release: agent.ctx.tools.guard(() => reason), reason });
+  };
+  const reconcile = () => {
+    const live = agents.list();
+    for (const agent of live) {
+      if (!belongs(agent)) {
+        remove(agent);
+        unblock(agent);
+        continue;
+      }
+      if (installed.has(agent)) continue;
+      try {
+        install(agent);
+        unblock(agent);
+      } catch (error) {
+        block(agent, error);
+      }
+    }
+    for (const agent of [...blocked.keys()]) if (!live.includes(agent)) unblock(agent);
+  };
+  ctx.on("tools/change", reconcile);
+  ctx.on("agent/disposed", ({ agent }) => {
+    unblock(agent);
   });
+  reconcile();
   ctx.effect(() => () => {
     for (const dispose of installed.values()) dispose();
     installed.clear();
+    for (const agent of [...blocked.keys()]) unblock(agent);
   });
 }
 export {
   POLICY_SECTION_ORDERS,
   apply,
+  childPolicy,
   inject,
   installPolicy,
   name,