@try-works/dsh-recursive-mode 0.3.0 → 0.4.0

package/lib/workflow-audit.d.ts

@@ -0,0 +1,207 @@
+/**
+ * T2 — fan the audit out through the native workflow engine's contract.
+ *
+ * WHY. A phase-3.5 audit over several reviewers is a natural fan-out, and the plugin reimplements
+ * that loop by hand. The engine already owns the shape: `phase(title)` to group work, `agent(prompt,
+ * opts)` to run one child, and `parallel(thunks)` to fan out and await all of them. Adopting it means
+ * one orchestration model instead of two that drift.
+ *
+ * ⚠ THE HOOK SHAPE IS A STRUCTURAL SEAM, not an import, because the engine runs against a live host
+ * context (the item calls it integration-grade). Modelling the three hooks this adapter uses keeps
+ * the CONTRACT testable without a host — and the contract is where the risk lives, not the plumbing.
+ *
+ * ⚠⚠ THE PROPERTY THIS ITEM'S OWN RESCOPE NAMED, and the reason the mapping is pure: **no
+ * cross-item null-dropping.** The engine's `agent()` and `parallel()` resolve `null` for a child
+ * that FAILED, and the obvious implementation — `results.filter(Boolean)` — silently turns a
+ * failed reviewer into a fan-out that simply looks smaller. An audit that dropped its dissenting
+ * reviewer would report a clean pass, which is the worst outcome this plugin can produce. So the
+ * result carries an entry for EVERY planned item, with `ok: false` where a child produced nothing,
+ * and `describeAuditFanOut` says how many failed.
+ */
+/** One reviewer's assignment inside the fan-out. */
+export interface AuditFanOutItem {
+    /** Stable label: what the board and the engine's progress show. */
+    label: string;
+    /** The reviewer role, for traceability back to the router. */
+    role: string;
+    prompt: string;
+}
+/** One phase of the fan-out: a titled group of items run in parallel. */
+export interface AuditFanOutPhase {
+    title: string;
+    items: AuditFanOutItem[];
+}
+export interface AuditFanOutPlan {
+    runId: string;
+    phases: AuditFanOutPhase[];
+}
+/** One item's outcome, PRESENT whether or not the child produced anything. */
+export interface AuditFanOutEntry {
+    label: string;
+    role: string;
+    /** False when the child failed or returned nothing — never inferred from a missing entry. */
+    ok: boolean;
+    value?: unknown;
+    /** Why it failed, when it did. */
+    reason?: string;
+}
+export interface AuditFanOutResult {
+    entries: AuditFanOutEntry[];
+    /** How many planned items produced nothing. Stated, so a partial audit cannot read as complete. */
+    failed: number;
+}
+/**
+ * The three hooks this adapter uses.
+ *
+ * `agent` and `parallel` resolve `null` rather than rejecting when a child fails — that is the
+ * engine's documented behaviour and the reason this module handles null explicitly instead of
+ * treating a resolved promise as success.
+ */
+export interface WorkflowHooksLike {
+    phase(title: string): void;
+    agent(prompt: string, options?: {
+        label?: string;
+        phase?: string;
+    }): Promise<unknown>;
+    parallel(thunks: ReadonlyArray<() => Promise<unknown>>): Promise<unknown[]>;
+    log?(message: string): void;
+}
+/** The reviewers a plan is built from — the plugin's own audit inputs, not an engine concept. */
+export interface AuditReviewerSpec {
+    role: string;
+    /** Extra instructions for this reviewer; the plan adds the contract around it. */
+    focus?: string;
+}
+export interface AuditPlanInput {
+    runId: string;
+    artifact: string;
+    phase: string;
+    reviewers: readonly AuditReviewerSpec[];
+    /** Questions every reviewer must answer, so the plan carries them rather than each caller. */
+    auditQuestions?: readonly string[];
+}
+/**
+ * Build the fan-out plan. PURE: same inputs, same plan — which is what makes the orchestration
+ * testable without a host and comparable between runs.
+ *
+ * One phase per ROLE, with one item per reviewer of that role, so the engine's progress reads as
+ * "audit phase X, reviewer Y" rather than a flat list of anonymous children.
+ */
+export declare function buildAuditFanOutPlan(input: AuditPlanInput): AuditFanOutPlan;
+/**
+ * Run a plan through the engine's hooks.
+ *
+ * ⚠ EVERY planned item yields an entry, whether or not its child produced a value. A missing entry
+ * and a failed child are different facts, and conflating them is how an audit reports a pass it did
+ * not earn: this returns `ok: false` with a reason instead of dropping the row.
+ */
+export declare function orchestrateAudit(hooks: WorkflowHooksLike, plan: AuditFanOutPlan): Promise<AuditFanOutResult>;
+/**
+ * A board-facing summary that STATES the failures.
+ *
+ * The count is explicit because an audit with three of five reviewers failed is not a smaller
+ * audit — it is an incomplete one, and a summary that only reported the successes would be the
+ * silent-drop defect wearing a friendlier face.
+ */
+export declare function describeAuditFanOut(result: AuditFanOutResult): string;
+/**
+ * T2 — the canonical script the ENGINE runs, and the request that starts it.
+ *
+ * ⚠⚠ MEASURED, AND IT CHANGES WHERE THE HOOKS LIVE. The engine is a service —
+ * `WorkflowEngine.start(request): WorkflowRun`, *"Parse and execute a workflow script"*, with the
+ * request carrying **the script, its `args`, the parent agent and an optional cancel signal** — and
+ * its `workflow/*` lifecycle events are documented as **"observe-only … never expose run control"**.
+ * So `phase()` / `agent()` / `parallel()` are hooks available to a SCRIPT, not functions the plugin
+ * may call directly: the plugin's job is to hand the engine a script plus the plan, and to read the
+ * frames afterwards. {@link orchestrateAudit} is therefore the shape a script (or a test double)
+ * drives, and this is the shape the plugin submits.
+ *
+ * ⚠ THE PLUGIN DOES NOT SHIP A GENERATED SCRIPT. A script built by string concatenation from a plan
+ * would put reviewer prompts into a program's source, where a stray quote becomes a syntax error in
+ * the orchestration layer — the worst place for one. The script is a CONSTANT that reads the plan
+ * from `args`, which also keeps the orchestration auditable: one script, reviewed once.
+ */
+export declare const AUDIT_FANOUT_SCRIPT: string;
+/**
+ * What the engine needs to start an audit fan-out. Mirrors `WorkflowStartRequest` structurally.
+ *
+ * ⚠ `meta` IS REQUIRED BY THE ENGINE, and this type originally omitted it — a defect found by READING the
+ * engine's declarations rather than by any test (T2's acceptance ran against a scripted engine that
+ * validated nothing). `packages/workflow/workflow/lib/types/runtime-types.d.ts` states the field is
+ * non-optional and its README lists *"a malformed meta block"* among the rejections, so a live engine
+ * would have refused this fan-out outright. `subagentProvider` and `maxTotalAgents` are carried too, since
+ * they are the engine's own child controls and a fan-out that ignores them cannot honour a host's limits.
+ */
+export interface AuditWorkflowRequest {
+    script: string;
+    /** The engine-validated identity block: name, description, and one phase per reviewer role. */
+    meta: {
+        name: string;
+        description: string;
+        whenToUse?: string;
+        phases?: Array<{
+            title: string;
+            detail?: string;
+            provider?: string;
+            model?: string;
+        }>;
+    };
+    args: {
+        plan: AuditFanOutPlan;
+    };
+    parent: unknown;
+    signal?: unknown;
+    /** Optional engine-wide child-provider override for this run. */
+    subagentProvider?: string;
+    /** Optional per-run total-child ceiling, so a host's cap is respected rather than exceeded. */
+    maxTotalAgents?: number;
+}
+/**
+ * Build the engine request for a plan.
+ *
+ * `parent` is the exact live Agent, as the engine requires for child authority; it passes through
+ * untouched rather than reshaped, because the engine authenticates by object identity.
+ *
+ * ⚠ THE META IS DERIVED FROM THE PLAN, not hand-written: the engine's `phases` are `{title, detail?,
+ * provider?, model?}` and the plan already holds exactly that per reviewer role, so deriving it means the
+ * two can never disagree about what the run will do.
+ */
+export declare function auditWorkflowRequest(plan: AuditFanOutPlan, options: {
+    parent: unknown;
+    signal?: unknown;
+    /** Overrides the derived identity block; the phases still come from the plan unless given. */
+    meta?: {
+        name?: string;
+        description?: string;
+        whenToUse?: string;
+    };
+    subagentProvider?: string;
+    maxTotalAgents?: number;
+}): AuditWorkflowRequest;
+/**
+ * T2 — the engine, as a structural seam.
+ *
+ * ⚠ START AND AWAIT ONLY. The engine's `workflow/*` lifecycle events are documented as
+ * **"observe-only … never expose run control"**, so a caller starts a run and awaits the script's
+ * `result`; it must not try to steer the run through the event stream.
+ */
+export interface WorkflowEngineLike {
+    start(request: AuditWorkflowRequest): {
+        result: Promise<unknown>;
+    };
+}
+/**
+ * Start an audit fan-out and await the script's result.
+ *
+ * ⚠ NO ENGINE IS A STATED OUTCOME, not a silent empty audit: a fan-out that could not be
+ * orchestrated must never read as a fan-out that found nothing wrong. The caller gets
+ * `orchestrated: false` and a reason, in the same spirit as every other optional seam here.
+ */
+export declare function startAuditFanOut(workflow: WorkflowEngineLike | null | undefined, plan: AuditFanOutPlan, options: {
+    parent: unknown;
+    signal?: unknown;
+}): Promise<{
+    orchestrated: boolean;
+    reason?: string;
+    result?: unknown;
+}>;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@try-works/dsh-recursive-mode",
-  "description": "recursive-mode workflow as a DeepSeek Harness bundle: RecursiveRuntime service + recursive_status tool",
-  "version": "0.3.0",
+  "description": "recursive-mode workflow as a DeepSeek Harness bundle: RecursiveRuntime service + 13 recursive_* tools (recursive_status, recursive_init, recursive_lock, recursive_lint, recursive_closeout, recursive_scratch, recursive_worktree, recursive_phase, recursive_audit_team, recursive_review, recursive_delegate, recursive_ask, recursive_preview)",
+  "version": "0.4.0",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
@@ -16,6 +16,7 @@
     },
     "./src/*": "./src/*",
     "./cordis.patch.yml": "./cordis.patch.yml",
+    "./preset/recursive.patch.yml": "./preset/recursive.patch.yml",
     "./package.json": "./package.json"
   },
   "files": [
@@ -24,17 +25,18 @@
     "src",
     "preset",
     "scripts",
-    "references"
+    "references",
+    "skills"
   ],
   "license": "MIT",
   "dsh": {
     "bundle": {
-      "patch": "./cordis.patch.yml"
+      "patch": ["./cordis.patch.yml", "./preset/recursive.patch.yml"]
     },
     "client": {
       "platform": "web",
       "inject": [
-        "@deepseek-ai/dsh-client-runtime",
+        "@deepseek-ai/dsh-client-modules",
         "@deepseek-ai/dsh-client-ui-slots",
         "@deepseek-ai/dsh-client-ui-conversation",
         "@deepseek-ai/dsh-client-ui-sidebar",
@@ -45,29 +47,28 @@
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-session": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-session-projection": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-system-prompt": "0.1.1-rc.2",
-    "@deepseek-ai/dsh-tools": "0.1.1-rc.2",
+    "@deepseek-ai/dsh-session": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-session-projection": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-system-prompt": "0.2.0-rc.2",
+    "@deepseek-ai/dsh-tools": "0.2.0-rc.2",
     "react": "^18.2.0"
   },
   "devDependencies": {
-    "@deepseek-ai/cordis": "file:D:/deepseek-harness/vendor/cordis",
-    "@deepseek-ai/cosmokit": "file:D:/deepseek-harness/vendor/cosmokit",
-    "@deepseek-ai/dsh-agent": "file:D:/deepseek-harness/packages/core/agent",
-    "@deepseek-ai/dsh-attachment": "file:D:/deepseek-harness/packages/attachment/attachment",
-    "@deepseek-ai/dsh-brand": "file:D:/deepseek-harness/packages/util/brand",
-    "@deepseek-ai/dsh-code-runtime": "file:D:/deepseek-harness/packages/code-runtime/code-runtime",
-    "@deepseek-ai/dsh-invariants": "file:D:/deepseek-harness/packages/runtime-diagnostics/invariants",
-    "@deepseek-ai/dsh-llm": "file:D:/deepseek-harness/packages/llm/llm",
-    "@deepseek-ai/dsh-scope": "file:D:/deepseek-harness/packages/core/scope",
-    "@deepseek-ai/dsh-session": "file:D:/deepseek-harness/packages/core/session",
-    "@deepseek-ai/dsh-session-projection": "file:D:/deepseek-harness/packages/session/session-projection",
-    "@deepseek-ai/dsh-system-prompt": "file:D:/deepseek-harness/packages/core/system-prompt",
-    "@deepseek-ai/dsh-timeout": "file:D:/deepseek-harness/packages/util/timeout",
-    "@deepseek-ai/dsh-tools": "file:D:/deepseek-harness/packages/core/tools",
-    "@deepseek-ai/dsh-user-approval": "file:D:/deepseek-harness/packages/interaction/user-approval",
-    "@deepseek-ai/schemastery": "file:D:/deepseek-harness/vendor/schemastery",
+    "@deepseek-ai/cordis": "link:D:/deepseek-harness/vendor/cordis",
+    "@deepseek-ai/cosmokit": "link:D:/deepseek-harness/vendor/cosmokit",
+    "@deepseek-ai/dsh-agent": "link:D:/deepseek-harness/packages/core/agent",
+    "@deepseek-ai/dsh-attachment": "link:D:/deepseek-harness/packages/attachment/attachment",
+    "@deepseek-ai/dsh-brand": "link:D:/deepseek-harness/packages/util/brand",
+    "@deepseek-ai/dsh-llm": "link:D:/deepseek-harness/packages/llm/llm",
+    "@deepseek-ai/dsh-scope": "link:D:/deepseek-harness/packages/core/scope",
+    "@deepseek-ai/dsh-session": "link:D:/deepseek-harness/packages/core/session",
+    "@deepseek-ai/dsh-session-projection": "link:D:/deepseek-harness/packages/session/session-projection",
+    "@deepseek-ai/dsh-system-prompt": "link:D:/deepseek-harness/packages/core/system-prompt",
+    "@deepseek-ai/dsh-timeout": "link:D:/deepseek-harness/packages/util/timeout",
+    "@deepseek-ai/dsh-tools": "link:D:/deepseek-harness/packages/core/tools",
+    "@deepseek-ai/dsh-user-approval": "link:D:/deepseek-harness/packages/interaction/user-approval",
+    "@deepseek-ai/dsh-util-values": "link:D:/deepseek-harness/packages/util/values",
+    "@deepseek-ai/schemastery": "link:D:/deepseek-harness/vendor/schemastery",
     "@types/node": "^20.0.0",
     "@types/react": "^18.2.0",
     "@types/react-dom": "^18.2.0",
@@ -81,10 +82,12 @@
     "zod": "^4.4.3"
   },
   "scripts": {
-    "build": "node -e \"require('node:fs').rmSync('lib',{recursive:true,force:true})\" && tsc -p tsconfig.build.json && tsdown",
+    "build": "node scripts/link-dsh.mjs && node -e \"require('node:fs').rmSync('lib',{recursive:true,force:true})\" && tsc -p tsconfig.build.json && tsdown",
     "bundle": "tsdown",
-    "test": "vitest run",
-    "typecheck": "tsc --noEmit",
+    "test": "node scripts/link-dsh.mjs && vitest run",
+    "e2e": "node scripts/e2e-run.mjs",
+    "typecheck": "node scripts/link-dsh.mjs && tsc --noEmit",
+    "link:dsh": "node scripts/link-dsh.mjs",
     "prepare": "node -e \"require('node:fs').rmSync('lib',{recursive:true,force:true})\" && tsc -p tsconfig.build.json && tsdown"
   },
   "peerDependenciesMeta": {
@@ -97,9 +100,6 @@
     "react": {
       "optional": true
     },
-    "@deepseek-ai/dsh-client-runtime": {
-      "optional": true
-    },
     "@deepseek-ai/dsh-client-ui-slots": {
       "optional": true
     },

package/preset/recursive.patch.yml

@@ -0,0 +1,312 @@
+# The recursive-mode agent preset, declared the way DSH declares presets.
+#
+# A preset is not discovered from a directory. The registry documents its parameter as "Parsed
+# configuration supplied by the declaring plugin", and this row IS that declaration: a row naming
+# @deepseek-ai/dsh-agent-preset, whose config is the preset definition. The built-ins ship identically -
+# see the harness bundle at packages/bundle/web-app/presets/*.patch.yml.
+#
+# Kept in step with preset/recursive/agent.cordis.yml, which remains the source composition; a spec
+# proves the two agree rather than trusting two copies to stay identical.
+#
+# The platform-switch expressions below are preserved verbatim, as expressions. The agent-preset plugin
+# sets EntryGroup.key, documented as preserving child expressions until their own plugins activate, so
+# they are evaluated by the loader rather than at packaging time - baking them into static values would
+# freeze one platform behaviour onto the other.
+#
+# The server-entry placeholder in the source is resolved HERE, to the package name, not to an absolute
+# file URL: the loader resolves a package row from the profile node_modules, so no path is guessed and
+# no post-install step is needed.
+- insert:
+    - id: preset-recursive
+      name: '@deepseek-ai/dsh-agent-preset'
+      config:
+        id: recursive
+        name: Recursive mode
+        description: Audited 12-phase workflow with per-phase subagent delegation, receipts and run memory.
+        order: 25
+        plugins:
+          # The `recursive` agent preset: the full coding agent (standard surface), presented
+          # with BOTH tool modes (`mode: both`), plus the recursive-mode workflow surface.
+          # Everything in `standard` is here unchanged; see the recursive-mode surface rows
+          # added before the identity section (tool-presentation both, the isolated
+          # recursive-realm, and the recursive:policy prompt section).
+          #
+          # This file is an AGENT-PLANE composition. The roster mounts it ONCE under a
+          # standing scope; every session naming it joins by scope parentage, so the
+          # tools and prompt sections registered here cover each joined agent while a
+          # session's own state stays keyed per Session/Agent inside the plugins. The
+          # host composition (`base.cordis.yml` + `web.cordis.yml`) keeps everything a
+          # preset must not own: the registries themselves, the sandbox and approval
+          # stack, persistence, and the model route.
+          #
+          # A service row here MUST sit inside a group carrying an `isolate` realm.
+          # Without one it publishes into the root realm, where it is process-global —
+          # another preset publishing the same name collides, and a host reader would
+          # resolve one preset's instance for every session; `dsh-agent-presets` rejects
+          # that at mount. `true` means an entry-local realm: this standing mount's own
+          # private instance, apart from every other preset's. (A shared label does NOT
+          # pool instances — `provide()` throws on the second registration under the
+          # same realm symbol; labels join REALMS, and are not what this file needs.)
+
+          # ── recursive-mode surface ─────────────────────────────────────────────────
+
+          # tool-presentation mode both (decision #12, PROPOSAL §7.4): the model sees
+          # native tools AND the run_code SDK.
+          - id: tool-presentation
+            name: '@deepseek-ai/dsh-agent-tool-presentation'
+            config:
+              mode: both
+
+          # The recursive workflow realm: per-session isolated RecursiveRuntime service +
+          # the recursive_* tools + the /recursive command + the policy prompt section.
+          # isolate.recursive keeps `provide('recursive')` from colliding across sessions.
+          #
+          # R2 (02-to-be-plan.addendum-r4-r2-mount-resolution.md): the server-surface row
+          # is a PLACEHOLDER here; scripts/install-preset.js replaces it with an ABSOLUTE
+          # file URL into the profile-installed package so its own @deepseek-ai/* imports
+          # resolve through the profile flat-fallback junctions (Service identity intact).
+          # commands.ts is bundled INTO lib/index.js, so a single row is sufficient.
+          - id: recursive-realm
+            name: cordis:group
+            group: true
+            isolate:
+              recursive: true
+            config:
+              - id: recursive
+                name: '@try-works/dsh-recursive-mode'
+
+          # The recursive:policy prompt section is registered in code (Stage A,
+          # src/index.ts via ctx.systemPrompt.section) — see plan-mode's pattern.
+
+          # ── identity ────────────────────────────────────────────────────────────────
+
+          # The preset's own persona, shadowing the deployment default for this agent.
+          # `{{model}}` and `{{cwd}}` resolve from the agent's own route and workspace.
+          - id: persona
+            name: '@deepseek-ai/dsh-persona'
+            config:
+              text: >-
+                You are a coding agent powered by the {{model}} model. Your working directory is {{cwd}}.
+
+          - id: agent-instructions
+            name: '@deepseek-ai/dsh-agent-instructions'
+            config:
+              maxBytes: 65536
+
+          # ── shell ───────────────────────────────────────────────────────────────────
+
+          # `shell-env` stays in the HOST composition: `apps/cli/src/web.ts` injects it to
+          # publish `DSH_WEB_URL`/`DSH_WEB_MODE`, and a host row that injects a service is
+          # the criterion for host-plane ownership — injection resolves before any session
+          # exists, so there is no agent to key by. Behind a preset realm those variables
+          # never reached the model's shell at all. Both shell tools consume the host
+          # registry from here; their executors (`bash-sandbox`/`pwsh-sandbox`) are
+          # host-plane too.
+          - id: tool-bash
+            name: '@deepseek-ai/dsh-tool-bash'
+            disabled: !!js process.platform === 'win32'
+
+          - id: tool-pwsh
+            name: '@deepseek-ai/dsh-tool-pwsh'
+            disabled: !!js process.platform !== 'win32'
+
+          # ── filesystem ──────────────────────────────────────────────────────────────
+
+          # Both register into the host `tools` registry and provide nothing, so
+          # they need no realm. The `fs` service and its policy stay in the host.
+          - id: tool-fs
+            name: '@deepseek-ai/dsh-tool-fs'
+
+          - id: tool-fs-search
+            name: '@deepseek-ai/dsh-tool-fs-search'
+            config:
+              sampleOverCapGlobResults: false
+
+          # ── background jobs ────────────────────────────────────────────────────────
+
+          # Only the model-facing controls. The task REGISTRY stays on the host plane:
+          # its producers sit outside any realm this file could put it in — `tool-bash`
+          # above resolves it with `ctx.get`, and an entry-local realm here is invisible
+          # to every sibling row, so `run_in_background` would answer "background jobs
+          # unavailable" while these controls sat in the catalog. The registry is keyed by
+          # owning agent anyway, so one host instance serves every session. What a preset
+          # chooses is whether its agent can collect and stop background work at all.
+          - id: tool-jobs
+            name: '@deepseek-ai/dsh-tool-jobs'
+
+          # ── skills ──────────────────────────────────────────────────────────────────
+
+          # The skill REGISTRY lives in the host composition and is layered per scope:
+          # these rows register into THIS preset's layer of it, so they need no realm.
+          # `skill-filesystem` contributes local-root discovery for agents on this preset, and
+          # `tool-skill` gives them the catalog and loader; the merged catalog also
+          # carries whatever the deployment registered globally (repository plugins).
+          - id: skill-filesystem
+            name: '@deepseek-ai/dsh-skill-filesystem'
+
+          - id: tool-skill
+            name: '@deepseek-ai/dsh-tool-skill'
+
+          # ── goals ───────────────────────────────────────────────────────────────────
+
+          # Only the model-facing tool. The goal SERVICE, its session driver, and the
+          # `/goal` command stay on the host plane: the Gateway serves the goal domain as
+          # Remote endpoints whose receiver comes from a generated descriptor, so it
+          # resolves `goals` on the host and an entry-local realm here would hide it. The
+          # registry is keyed by session anyway, so one host instance serves every
+          # session. What a preset chooses is whether its agent can call the goal tool.
+          - id: tool-goal
+            name: '@deepseek-ai/dsh-tool-goal'
+
+          # ── plan mode ───────────────────────────────────────────────────────────────
+
+          # Plan state is per-agent by nature, so an entry-local realm is not a
+          # workaround here — it is the correct lifetime.
+          - id: planning
+            name: cordis:group
+            group: true
+            isolate:
+              planMode: true
+            config:
+              - id: plan-mode
+                name: '@deepseek-ai/dsh-plan-mode'
+                config:
+                  section: |
+                        You are in plan mode. Stay in plan mode until exit_plan_mode succeeds or the user switches the session mode. Imperative language to implement changes means plan the implementation, not execute it. A user's conversational agreement — including an answer confirming something you asked — approves nothing and does not end plan mode; fold the confirmed decision into the plan and submit it through exit_plan_mode.
+
+                        Explore first. Use non-mutating reads, searches, static analysis, and checks to ground the plan in the actual repository. Do not edit or write files, change configuration, run formatters or code generation that rewrites tracked files, commit, or otherwise carry out the plan. Prefer existing functions and patterns over new machinery.
+
+                        The tool catalog stays the same across modes for request-cache stability. These plan-mode rules override any later tool description or guidance that suggests using mutation tools; those tools remain listed to keep the tool catalog unchanged. Do not use todo_write to track this planning phase: it tracks implementation after an approved plan, while the plan itself belongs in exit_plan_mode.
+
+                        Resolve discoverable facts by inspection. Use ask_user_question only for user-owned choices or material ambiguity that inspection cannot answer. Do not ask the user where code lives or how current behavior works when you can find out.
+
+                        Make the plan decision-complete: state the goal and success criteria; group implementation changes by subsystem; identify public API, schema, and data-flow changes; cover edge cases, failure modes, tests, acceptance criteria, and explicit assumptions. Keep it concise enough to review but detailed enough that another engineer can implement it without making design decisions.
+
+                        When ready, call exit_plan_mode with the complete plan markdown, starting with a # title. Make exit_plan_mode the only and final tool call in that assistant response: it presents the plan for approval, and implementation begins only in a later step after approval. Do not paste the final plan as a plain reply or ask "should I proceed?" through prose or ask_user_question. If review rejects it, incorporate the feedback and present again. If the review channel is unavailable or aborted, stay in plan mode and ask the user to switch modes manually; do not proceed with implementation.
+
+          # ── compaction ──────────────────────────────────────────────────────────────
+
+          # `compaction-basic` reads `toolResultPrune` through `ctx.get`, so the pruner must
+          # share this realm rather than sit outside it.
+          #
+          # `tokenMeter` is deliberately NOT in this realm: the meter stays on the HOST
+          # plane, and the rows here resolve that one instance. It takes no configuration,
+          # keys every fold by Session, and owns the context-meter projection units the
+          # browser reads for every session — behind a realm those units would come and go
+          # with whichever presets happen to be mounted. What a preset chooses is whether
+          # its agent compacts at all, which is `compaction-basic` below.
+          - id: compaction
+            name: cordis:group
+            group: true
+            isolate:
+              compaction: true
+              toolResultPruner: true
+            config:
+              - id: compaction-basic
+                name: '@deepseek-ai/dsh-compaction-basic'
+
+              - id: command-compact
+                name: '@deepseek-ai/dsh-command-compact'
+
+              - id: tool-result-pruner
+                name: '@deepseek-ai/dsh-compaction-tool-result-pruner'
+                config:
+                  thresholdChars: 8192
+                  headChars: 4096
+                  tailChars: 1024
+
+          # ── delegation and workflows ────────────────────────────────────────────────
+
+          # The `subagents` registry and its spawn/fork backends live in the HOST
+          # composition: the registry is a process singleton whose cross-session queries
+          # the api-proxy serves to the browser, and a provider name may only be
+          # registered once. This preset contributes the delegation TOOLS, which resolve
+          # that host registry.
+          #
+          # `workflows` is different — nothing outside an agent reads it — so every row
+          # that reaches it shares one entry-local realm here, and a consumer left
+          # outside would resolve a host registry this preset does not populate.
+          #
+          # `tool-subagent-report` is host-plane for the same reason as the registry,
+          # not because a preset may not want it: it registers a CONTINUABLE SETUP on
+          # that singleton rather than a tool this agent calls, and the setup list is
+          # not scope-aware — one copy per mounted preset means every child gets
+          # `report` registered once per live session, which throws on the second.
+          - id: delegation
+            name: cordis:group
+            group: true
+            isolate:
+              workflowEngine: true
+            config:
+              - id: tool-subagent-control
+                name: '@deepseek-ai/dsh-tool-subagent-control'
+
+              - id: tool-subagent-list-agents
+                name: '@deepseek-ai/dsh-tool-subagent-control/list-agents'
+
+              - id: tool-subagent
+                name: '@deepseek-ai/dsh-tool-subagent'
+                config:
+                  provider: spawn
+                  toolName: subagent
+                  backgroundMode: continuable
+
+              - id: tool-subagent-fork
+                name: '@deepseek-ai/dsh-tool-subagent'
+                config:
+                  provider: fork
+                  toolName: subagent_fork
+                  backgroundMode: continuable
+
+              # Product providers are host-plane singletons. Copy this preset, then
+              # remove `disabled` from either ordinary tool row to expose that product
+              # only to agents composed from the copy.
+              - id: tool-subagent-codex
+                name: '@deepseek-ai/dsh-tool-subagent'
+                disabled: true
+                config:
+                  provider: codex
+                  toolName: subagent_codex
+                  enableRunInBackground: false
+                  maxDepth: provider-managed
+
+              - id: tool-subagent-claude-code
+                name: '@deepseek-ai/dsh-tool-subagent'
+                disabled: true
+                config:
+                  provider: claude-code
+                  toolName: subagent_claude_code
+                  enableRunInBackground: false
+                  maxDepth: provider-managed
+
+              - id: workflow-worker-thread
+                name: '@deepseek-ai/dsh-workflow-worker-thread'
+                config:
+                  provider: spawn
+
+              - id: tool-workflow
+                name: '@deepseek-ai/dsh-tool-workflow'
+
+              - id: tool-ralph
+                name: '@deepseek-ai/dsh-tool-ralph'
+                config:
+                  subagentProvider: spawn
+                  maxRounds: 64
+
+          # ── remaining model-facing rows ─────────────────────────────────────────────
+
+          - id: tool-ask-user
+            name: '@deepseek-ai/dsh-tool-ask-user'
+
+          - id: tool-todo
+            name: '@deepseek-ai/dsh-tool-todo'
+            config:
+              allowParallelInProgress: true
+
+          # The `web` service and its search provider stay in the host composition; only
+          # the model-facing tool is per-session.
+          - id: tool-web
+            name: '@deepseek-ai/dsh-tool-web'
+            config:
+              fetch: false
+              searchTimeoutMs: 60000