agent-bypass 2.18.0 → 2.20.1

package/tests/test_regressions.py

@@ -153,246 +153,5 @@ class JsripSameSiteTests(unittest.TestCase):
         self.assertFalse(self.js.same_site("https://example.com", "https://wwwexample.com/a.js"))
 
 
-class DshInstallerTests(unittest.TestCase):
-    """DeepSeek Harness：技能安装 + Ck 模式预设注入（临时 HOME，离线）。"""
-
-    DSH_ENV = ("DSH_HOME", "DSH_PROFILE", "DSH_AGENTS_HOME", "DSH_APP_PATH", "DSH_ASAR_PATH")
-
-    def _node(self, *args, home):
-        env = dict(os.environ)
-        env["HOME"] = home
-        for k in self.DSH_ENV:
-            env.pop(k, None)
-        return _tmp_run(["node", str(ROOT / "bin" / "install.js"), *args], env=env)
-
-    def _seed(self, home, patch_text="[]\n"):
-        prof = Path(home) / ".dsh" / "profiles" / "desktop"
-        prof.mkdir(parents=True, exist_ok=True)
-        f = prof / "cordis.patch.yml"
-        f.write_text(patch_text, encoding="utf-8")
-        return f
-
-    def test_install_idempotent_and_persona_dollar_preserved(self):
-        with tempfile.TemporaryDirectory() as home:
-            patch = self._seed(home)
-            r1 = self._node("--dsh", home=home)
-            self.assertEqual(r1.returncode, 0, r1.stdout + r1.stderr)
-            skill = Path(home) / ".agents" / "skills" / "agent-bypass" / "SKILL.md"
-            self.assertTrue(skill.exists(), "DSH 技能应安装到 ~/.agents/skills")
-            text = patch.read_text(encoding="utf-8")
-            self.assertEqual(text.count("agent-bypass:dsh-preset-begin"), 1)
-            self.assertEqual(text.count("id: preset-ck"), 1)
-            self.assertIn("Ck 万能执行员", text)
-            # $$ 不能被 String.replace 的替换串语义吃掉（PHP 变量变量）
-            self.assertIn("parse_str / $$", text)
-            # 幂等：重复安装不重复追加
-            r2 = self._node("--dsh", home=home)
-            self.assertEqual(r2.returncode, 0, r2.stdout + r2.stderr)
-            text2 = patch.read_text(encoding="utf-8")
-            self.assertEqual(text2.count("agent-bypass:dsh-preset-begin"), 1)
-            self.assertEqual(text2.count("id: preset-ck"), 1)
-
-    def test_crlf_preserved_and_uninstall_restores(self):
-        with tempfile.TemporaryDirectory() as home:
-            patch = self._seed(home, '# note\r\n- id: web\r\n  name: "@deepseek-ai/dsh-web"\r\n')
-            self.assertEqual(self._node("--dsh", home=home).returncode, 0)
-            data = patch.read_bytes()
-            self.assertIn(b"agent-bypass:dsh-preset-begin", data)
-            self.assertGreater(data.count(b"\r\n"), 100, "CRLF 文件应保持 CRLF")
-            r = self._node("--dsh", "--uninstall", home=home)
-            self.assertEqual(r.returncode, 0, r.stdout + r.stderr)
-            data2 = patch.read_bytes()
-            self.assertNotIn(b"agent-bypass:dsh-preset-begin", data2)
-            self.assertIn(b"# note", data2)
-            self.assertIn(b"id: web", data2)
-            self.assertFalse((Path(home) / ".agents" / "skills" / "agent-bypass").exists())
-
-    def test_comment_only_patch_stays_valid_yaml(self):
-        with tempfile.TemporaryDirectory() as home:
-            patch = self._seed(home, "# user comment\n[]\n")
-            self.assertEqual(self._node("--dsh", home=home).returncode, 0)
-            self.assertEqual(self._node("--dsh", "--uninstall", home=home).returncode, 0)
-            text = patch.read_text(encoding="utf-8")
-            self.assertIn("# user comment", text)
-            self.assertIn("[]", text, "只留注释时应补回空数组，保证 loader 可解析")
-
-    def test_default_targets_include_pi_opencode_dsh(self):
-        with tempfile.TemporaryDirectory() as home:
-            (Path(home) / ".pi").mkdir()
-            (Path(home) / ".config" / "opencode").mkdir(parents=True)
-            self._seed(home)
-            r = self._node(home=home)
-            self.assertEqual(r.returncode, 0, r.stdout + r.stderr)
-            self.assertTrue((Path(home) / ".pi" / "agent" / "skills" / "agent-bypass" / "SKILL.md").exists())
-            self.assertTrue((Path(home) / ".config" / "opencode" / "skills" / "agent-bypass" / "SKILL.md").exists())
-            self.assertTrue((Path(home) / ".agents" / "skills" / "agent-bypass" / "SKILL.md").exists())
-            patch_text = (Path(home) / ".dsh" / "profiles" / "desktop" / "cordis.patch.yml").read_text(encoding="utf-8")
-            self.assertIn("id: preset-ck", patch_text)
-            self.assertIn("dsh", r.stdout + r.stderr)
-
-
-class DoctorTests(unittest.TestCase):
-    """--doctor 环境自检：只读、不写任何文件。"""
-
-    def test_doctor_readonly(self):
-        with tempfile.TemporaryDirectory() as home:
-            env = dict(os.environ)
-            env["HOME"] = home
-            for k in ("DSH_HOME", "DSH_PROFILE", "DSH_AGENTS_HOME", "DSH_APP_PATH", "DSH_ASAR_PATH"):
-                env.pop(k, None)
-            r = _tmp_run(["node", str(ROOT / "bin" / "install.js"), "--doctor"], env=env)
-            self.assertEqual(r.returncode, 0, r.stdout + r.stderr)
-            out = r.stdout + r.stderr
-            self.assertIn("环境自检", out)
-            self.assertIn("平台", out)
-            self.assertIn("包管理器", out)
-            # 只读：临时 HOME 不应产生任何文件
-            self.assertEqual(list(Path(home).rglob("*")), [], "doctor 不应写文件")
-
-
-class NetDnsScanOriginTests(unittest.TestCase):
-    """fake-IP/TUN：netdns 判定 + portscan 解析守卫 + origin_trace 解析（全部离线）。"""
-
-    @classmethod
-    def setUpClass(cls):
-        sys.path.insert(0, str(SCRIPTS))
-        import netdns
-        import portscan
-        import origin_trace
-        cls.nd = netdns
-        cls.ps = portscan
-        cls.ot = origin_trace
-
-    def test_fake_ip_ranges(self):
-        for ip in ("198.18.0.5", "198.19.255.1", "240.1.2.3", "198.51.100.7", "203.0.113.9"):
-            self.assertTrue(self.nd.is_fake_ip(ip), ip)
-        for ip in ("1.1.1.1", "8.8.8.8", "192.168.1.1", "10.0.0.1"):
-            self.assertFalse(self.nd.is_fake_ip(ip), ip)
-
-    def test_parse_dns_json(self):
-        sample = ('{"Answer":[{"type":1,"data":"93.184.216.34"},'
-                  '{"type":28,"data":"2606:2800::1"},{"type":1,"data":"198.18.0.1"}]}')
-        self.assertEqual(self.nd._parse_dns_json(sample, "A"), ["93.184.216.34", "198.18.0.1"])
-        self.assertEqual(self.nd._parse_dns_json(sample, "AAAA"), ["2606:2800::1"])
-        self.assertEqual(self.nd._parse_dns_json("not-json", "A"), [])
-
-    def test_portscan_split_host_fake_guard(self):
-        self.assertEqual(self.ps.split_host("https://example.com:8443/x"), ("example.com", 8443))
-        self.assertEqual(self.ps.split_host("1.2.3.4"), ("1.2.3.4", None))
-        self.assertIsNone(self.ps.split_host("bad host")[0])
-        self.assertTrue(self.ps.is_fake_ip("198.18.1.2"))
-        ip, src, fake = self.ps.resolve_target("198.18.1.2", mode="auto")
-        self.assertEqual((ip, src), ("198.18.1.2", "ip"))
-        self.assertEqual(fake, [])
-
-    def test_origin_trace_parsers(self):
-        ct = '[{"name_value":"a.example.com\\n*.example.com\\nother.test"}]'
-        self.assertEqual(self.ot.parse_crtsh(ct, "example.com"), ["a.example.com", "example.com"])
-        self.assertEqual(self.ot.extract_title("<title>  Hi   There </title>"), "Hi There")
-        self.assertEqual(self.ot.cdn_markers({"cf-ray": "x", "server": "nginx"}), ["cf-ray"])
-        base = {"title": "X", "server": "nginx", "status": "HTTP/1.1 200 OK", "cdn": ["cf-ray"]}
-        cand = {"title": "X", "server": "nginx", "status": "HTTP/1.1 200 OK", "cdn": [], "cert_domain_ok": True}
-        score, reasons = self.ot.score_candidate(base, cand)
-        self.assertGreaterEqual(score, 5)
-        self.assertIn("title", reasons)
-        self.assertLess(self.ot.score_candidate(base, {"cdn": ["cf-ray"]})[0], score)
-
-    def test_doh_shell_syntax(self):
-        sh = shutil.which("sh")
-        if not sh:
-            self.skipTest("no sh")
-        r = _tmp_run([sh, "-n", str(SCRIPTS / "doh_resolve.sh")])
-        self.assertEqual(r.returncode, 0, r.stderr)
-
-
-class SkillCompactTests(unittest.TestCase):
-    """SKILL.md 体积/去重回归：防止再次膨胀。"""
-
-    def test_skill_structure_and_size(self):
-        skill = (ROOT / "SKILL.md").read_text(encoding="utf-8")
-        self.assertEqual(skill.count("<!-- module:"), 35)
-        self.assertNotIn("## 修正对照", skill, "重复的修正对照表已移除，勿再加回")
-        self.assertLess(len(skill.encode("utf-8")), 132000, "SKILL.md 体积超限（保持精简，长内容放 references/）")
-
-
-class HangProtectionTests(unittest.TestCase):
-    """防卡死：DNS 硬超时、扫描总时限、溯源预算/同名 CDN 扣分（全部离线）。"""
-
-    @classmethod
-    def setUpClass(cls):
-        sys.path.insert(0, str(SCRIPTS))
-        import netdns, portscan, origin_trace
-        cls.nd = netdns
-        cls.ps = portscan
-        cls.ot = origin_trace
-
-    def test_system_resolve_hard_timeout(self):
-        import time as _t
-        orig = self.nd._system_resolve_impl
-        self.nd._system_resolve_impl = lambda name: (_t.sleep(3), ["1.2.3.4"])[1]
-        t0 = _t.monotonic()
-        try:
-            ips = self.nd.system_resolve("example.com", timeout=0.2)
-        finally:
-            self.nd._system_resolve_impl = orig
-        self.assertEqual(ips, [])
-        self.assertLess(_t.monotonic() - t0, 1.5, "system_resolve 必须有硬超时，不能挂住")
-
-    def test_portscan_total_deadline(self):
-        import asyncio, time as _t
-        found, timed_out = asyncio.run(
-            self.ps.scan("127.0.0.1", [9, 10], conc=1, timeout=0.05,
-                         deadline=_t.monotonic() - 1))
-        self.assertEqual(found, [])
-        self.assertTrue(timed_out)
-
-    def test_origin_same_cdn_penalty(self):
-        base = {"title": "X", "server": "nginx", "status": "HTTP/1.1 200 OK", "cdn": ["cf-ray"]}
-        cand_cdn = {"title": "X", "server": "nginx", "status": "HTTP/1.1 200 OK", "cdn": ["cf-ray"]}
-        cand_origin = {"title": "X", "server": "nginx", "status": "HTTP/1.1 200 OK", "cdn": []}
-        s_cdn, r_cdn = self.ot.score_candidate(base, cand_cdn)
-        s_org, r_org = self.ot.score_candidate(base, cand_origin)
-        self.assertIn("same-cdn", r_cdn)
-        self.assertLess(s_cdn, s_org)
-
-    def test_passive_ct_parsers(self):
-        cs = '[{"dns_names":["www.example.com","*.example.com","x.test"]}]'
-        self.assertEqual(self.ot.parse_certspotter(cs, "example.com"), ["www.example.com", "example.com"])
-        otx = ('{"passive_dns":[{"hostname":"mail.example.com","address":"1.2.3.4"},'
-               '{"hostname":"x.test","address":"9.9.9.9"},'
-               '{"hostname":"cdn.example.com","address":"198.18.0.9"}]}')
-        hosts, ips = self.ot.parse_otx(otx, "example.com")
-        self.assertIn("mail.example.com", hosts)
-        self.assertEqual(ips, ["1.2.3.4"], "被动 DNS 的 fake-IP 应被过滤")
-        hosts, ips = self.ot.parse_hackertarget("vpn.example.com,5.6.7.8\nAPI count exceeded", "example.com")
-        self.assertEqual(hosts, ["vpn.example.com"])
-        self.assertEqual(ips, ["5.6.7.8"])
-        self.assertEqual(self.ot.parse_anubis('["a.example.com","b.test"]', "example.com"), ["a.example.com"])
-        self.assertEqual(self.ot.parse_rapiddns("<td>oa.example.com</td><td>x.test</td>", "example.com"),
-                         ["oa.example.com"])
-        for src in ("crt.sh", "certspotter", "otx", "hackertarget", "anubis", "rapiddns"):
-            self.assertIn(src, self.ot.CT_SOURCES)
-
-    def test_ct_multi_source_fallback(self):
-        def fake(name, domain, timeout):
-            if name == "crt.sh":
-                raise RuntimeError("502 Bad Gateway")
-            return (["s1.example.com", "s2.example.com"], ["1.2.3.4"])
-        orig = self.ot._ct_fetch
-        self.ot._ct_fetch = fake
-        try:
-            hosts, ips, status = self.ot.fetch_passive_names(
-                "example.com", sources=["crt.sh", "otx"], budget=5)
-        finally:
-            self.ot._ct_fetch = orig
-        self.assertEqual(hosts, ["s1.example.com", "s2.example.com"])
-        self.assertEqual(ips, ["1.2.3.4"])
-        self.assertIn("失败", status["crt.sh"], "单源 502 应被记录并跳过")
-
-    def test_origin_bad_flag_rejected(self):
-        r = _tmp_run([sys.executable, str(SCRIPTS / "origin_trace.py"), "--bogus"])
-        self.assertEqual(r.returncode, 2)
-
-
 if __name__ == "__main__":
     unittest.main()

package/tests/test_tool_inventory.py

@@ -33,7 +33,7 @@ class InventoryTests(unittest.TestCase):
         skill = (ROOT / 'SKILL.md').read_text(encoding='utf-8')
         for item in ['agent-routing.md','tool-selection.md','verification-gates.md','framework-comparison-2026.md','tool_inventory.py']:
             self.assertIn(item, skill)
-        self.assertEqual(skill.count("<!-- module:"), 35)
+        self.assertEqual(skill.count('<!-- module:'), 35)
 
 
 if __name__ == '__main__':

package/dsh/README.md

@@ -1,74 +0,0 @@
-# dsh/ — DeepSeek Harness 集成（Ck 模式）
-
-把 agent-bypass 接进 [DeepSeek Harness](https://www.deepseek.com)（DSH）桌面端，两件事一起做：
-
-1. **技能可读**：技能文件装到 DSH 的用户技能根 `~/.agents/skills/agent-bypass/`，DSH 的 `skill-filesystem` 会在启动时自动发现并加载（catalog 里出现 `agent-bypass`，命中触发词即可用）。
-2. **Ck 模式**：把一个 `@deepseek-ai/dsh-agent-preset` 声明写进 DSH 的 profile patch，新会话里出现 **「Ck 万能执行员」** Agent 预设——人格来自 `persona.md`，工具/插件行与 DSH 官方 `standard` 预设**逐行一致**。
-
-## 文件
-
-| 文件 | 作用 |
-|---|---|
-| `persona.md` | Ck 万能执行员人格正文（自包含，不引用外部技能/模块） |
-| `preset.template.yml` | 预设声明模板：官方 standard 预设的插件/工具行 + `__PERSONA__` 占位符 |
-| `build-template.js` | 从本机 DSH 的 `app.asar` 重新派生 `preset.template.yml`（DSH 升级后用） |
-
-## 安装 / 卸载
-
-`npx agent-bypass`（默认目标已含 DSH）或显式；先自检 `npx agent-bypass --doctor` 可看 DSH 安装探测与 Ck 模式状态：
-
-```bash
-npx agent-bypass --dsh              # 只装 DeepSeek Harness
-npx agent-bypass --dsh --uninstall  # 卸载（技能 + 预设标记块）
-```
-
-安装器做的事：
-
-- 技能 → `~/.agents/skills/agent-bypass/`（`DSH_AGENTS_HOME` 可改共享根；Windows 为 `%USERPROFILE%\.agents\skills`）。该目录是 Agent Skills 开放标准主副本，与 CC Switch / 其他 harness 共用；如果它是指向 Pi 真身的软链，安装器会穿透到真身更新、保持链接。
-- 预设 → `<DSH_HOME>/profiles/<profile>/cordis.patch.yml` 内写入标记块：
-
-```yaml
-# >>> agent-bypass:dsh-preset-begin
-- insert:
-    - id: preset-ck
-      name: '@deepseek-ai/dsh-agent-preset'
-      config: { id: ck, name: 'Ck 万能执行员', order: 0, plugins: [...] }
-# <<< agent-bypass:dsh-preset-end
-```
-
-幂等：重复安装只更新块内容，不动用户原有条目/注释；保留文件 CRLF 与 BOM；若检测到已有的 bundle 方式安装（`plugin_manager install_bundle`）或已存在 `preset-ck` 声明，会跳过注入并在输出里提示，避免行 id 冲突。
-
-## 路径与自动识别（macOS / Windows / Linux）
-
-| 系统 | DSH 安装目录探测顺序 | app.asar |
-|---|---|---|
-| macOS | `/Applications/DeepSeek Harness.app`、`~/Applications/…`；找不到时 `mdfind com.deepseek.dsh` 兜底 | `<app>.app/Contents/Resources/app.asar` |
-| Windows | `%LOCALAPPDATA%\Programs\DeepSeek Harness`、`%LOCALAPPDATA%\DeepSeek Harness`、`%ProgramFiles%\…`、`%ProgramFiles(x86)%\…`；找不到时查注册表 Uninstall 项（InstallLocation / DisplayIcon） | `<安装目录>\resources\app.asar` |
-| Linux | `/opt/DeepSeek Harness`、`/opt/deepseek-harness`、`/usr/lib|share/deepseek-harness` | `<安装目录>/resources/app.asar` |
-
-覆盖方式（任选）：`DSH_APP_PATH=<安装目录>`、`DSH_ASAR_PATH=<app.asar>`、`node dsh/build-template.js --app <目录> / --asar <路径>`。
-
-DSH 自身数据目录：`DSH_HOME`（默认 `~/.dsh`）、profile 名 `DSH_PROFILE`（默认自动选 `desktop`，否则扫 `profiles/*/cordis.patch.yml`）。Windows 下同为 `%USERPROFILE%\.dsh`。
-
-`build-template.js` 用**纯 Node 读取 asar**（不依赖 Electron 二进制位置，跨平台一致；找不到安装目录时可显式指定）。
-
-## 使用 Ck 模式
-
-1. 新建会话（New Session）→ 「Agent 预设」控件 → **「Ck 万能执行员」**（`order: 0` 排最前）。
-2. 想以后默认：设置 → 「Agent 预设」→ 自定义分组 → Ck 卡片 → **「设为新任务默认」**。
-3. 已存在的会话保持其启动时预设，不能中途切换；预设列表没立即出现就重启一次 DSH。
-
-## DSH 升级后
-
-官方 `standard` 预设的插件行可能变化。在装了 DSH 的机器上重跑：
-
-```bash
-node dsh/build-template.js     # 自动定位 app.asar，重建 preset.template.yml
-npx agent-bypass --dsh         # 重新注入（幂等）
-```
-
-## 已知边界
-
-- 预设不是安全沙箱（DSH 官方说明：YAML 与插件可执行 Host 代码）；本目录只产出声明，不含第三方代码。
-- `persona.md` 会作为系统提示前缀随每次请求发送（约 1.4 万字符），嫌重可裁剪后重跑安装。
-- 不要把 `~/.dsh` 与 `~/.agents` 指向错误的用户目录；Windows 用 `%USERPROFILE%`，macOS/Linux 用 `$HOME`。

package/dsh/build-template.js

@@ -1,310 +0,0 @@
-#!/usr/bin/env node
-'use strict';
-
-/**
- * 从本机 DeepSeek Harness 安装目录提取官方 standard 预设，派生 Ck 模式的预设模板。
- *
- * 产物：dsh/preset.template.yml
- *   —— 与官方 standard 预设的插件/工具行完全一致，只替换预设元数据与 persona；
- *      persona 正文保留 __PERSONA__ 占位符，由安装器在安装时填入 dsh/persona.md。
- *
- * 跨平台提示（macOS / Windows / Linux 自动识别）：
- *   macOS   : /Applications/DeepSeek Harness.app（或 ~/Applications），
- *             Info.plist 的 CFBundleIdentifier = com.deepseek.dsh；找不到时用 Spotlight(mdfind) 兜底。
- *             app.asar = <app>.app/Contents/Resources/app.asar
- *   Windows : %LOCALAPPDATA%\Programs\DeepSeek Harness\（electron-builder 默认按用户安装），
- *             以及 %LOCALAPPDATA% / %ProgramFiles% / %ProgramFiles(x86)% 下的 DeepSeek Harness；
- *             找不到时查注册表 Uninstall 项的 InstallLocation / DisplayIcon 兜底。
- *             app.asar = <安装目录>\resources\app.asar
- *   Linux   : /opt/DeepSeek Harness 等常见路径；app.asar = <安装目录>/resources/app.asar
- *
- * 用法：
- *   node dsh/build-template.js                 # 自动探测（可加 --app / --asar 显式覆盖）
- *   node dsh/build-template.js --asar <app.asar 路径>
- *   node dsh/build-template.js --app  <安装目录或 .app>
- *   DSH_APP_PATH=/path node dsh/build-template.js     # 环境变量覆盖
- *   DSH_ASAR_PATH=/path/app.asar node dsh/build-template.js
- *
- * 何时运行：DeepSeek Harness 升级后（官方 standard 预设的插件行可能变化）在本机重跑一次，
- *           再把新的 dsh/preset.template.yml 提交。普通安装不需要运行本脚本。
- */
-
-const fs = require('fs');
-const path = require('path');
-const os = require('os');
-const { spawnSync } = require('child_process');
-
-const ROOT = path.join(__dirname, '..');
-const OUT = path.join(__dirname, 'preset.template.yml');
-const PLACEHOLDER = '                __PERSONA__';
-const STANDARD_RELS = [
-  'dsh/node_modules/@deepseek-ai/dsh-web-app/presets/standard.patch.yml',
-  'node_modules/@deepseek-ai/dsh-web-app/presets/standard.patch.yml',
-];
-const DSH_VERSION_REL = ['dsh/package.json', 'package.json'];
-
-/* ---------------------------------------------------------------- 定位安装目录 */
-
-function candidateAppDirs() {
-  const H = os.homedir();
-  const list = [];
-  if (process.platform === 'darwin') {
-    list.push('/Applications/DeepSeek Harness.app');
-    list.push(path.join(H, 'Applications', 'DeepSeek Harness.app'));
-  } else if (process.platform === 'win32') {
-    const local = process.env.LOCALAPPDATA || path.join(H, 'AppData', 'Local');
-    const pf = process.env.ProgramFiles || 'C:\\Program Files';
-    const pf86 = process.env['ProgramFiles(x86)'] || 'C:\\Program Files (x86)';
-    list.push(path.join(local, 'Programs', 'DeepSeek Harness'));
-    list.push(path.join(local, 'DeepSeek Harness'));
-    list.push(path.join(pf, 'DeepSeek Harness'));
-    list.push(path.join(pf86, 'DeepSeek Harness'));
-  } else {
-    list.push('/opt/DeepSeek Harness');
-    list.push('/opt/deepseek-harness');
-    list.push('/usr/lib/deepseek-harness');
-    list.push('/usr/share/deepseek-harness');
-    list.push(path.join(H, '.local', 'share', 'deepseek-harness'));
-  }
-  return list;
-}
-
-// 显式输入（--app / --asar / 环境变量）→ { asar, app }
-function normalizeInput(input) {
-  if (!input) return null;
-  const abs = path.resolve(input);
-  let st;
-  try { st = fs.statSync(abs); } catch (e) { return null; }
-  if (st.isFile() && abs.endsWith('.asar')) {
-    const isMacBundle = abs.includes(`${path.sep}Contents${path.sep}`);
-    const app = isMacBundle
-      ? path.resolve(abs, '..', '..', '..')      // *.app
-      : path.resolve(abs, '..', '..');           // <app>/resources/app.asar
-    return { asar: abs, app: fs.existsSync(app) ? app : null, input: abs };
-  }
-  if (st.isDirectory()) {
-    const cands = [
-      path.join(abs, 'Contents', 'Resources', 'app.asar'),
-      path.join(abs, 'resources', 'app.asar'),
-      path.join(abs, 'app.asar'),
-    ];
-    for (const asar of cands) {
-      if (fs.existsSync(asar)) return { asar, app: abs, input: abs };
-    }
-    // 开发/免打包目录：<app>/resources/app/...
-    const dev = path.join(abs, 'resources', 'app');
-    if (fs.existsSync(dev)) return { asar: null, app: abs, devDir: dev, input: abs };
-  }
-  return null;
-}
-
-function mdfindAppDir() {
-  if (process.platform !== 'darwin') return null;
-  try {
-    const r = spawnSync('mdfind', ['kMDItemCFBundleIdentifier == "com.deepseek.dsh"'], { encoding: 'utf8', timeout: 15000 });
-    const hit = String(r.stdout || '').split('\n').map((s) => s.trim()).filter(Boolean)[0];
-    return hit || null;
-  } catch (e) { return null; }
-}
-
-function registryAppDir() {
-  if (process.platform !== 'win32') return null;
-  const roots = [
-    'HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall',
-    'HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall',
-    'HKLM\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall',
-  ];
-  for (const root of roots) {
-    let r;
-    try {
-      r = spawnSync('reg', ['query', root, '/s', '/f', 'DeepSeek Harness', '/d'], { encoding: 'utf8', timeout: 20000 });
-    } catch (e) { continue; }
-    const out = String(r.stdout || '');
-    const loc = out.match(/InstallLocation\s+REG_[A-Z_]+\s+(.+)/i);
-    if (loc) {
-      const p = loc[1].trim().replace(/^"|"$/g, '');
-      if (fs.existsSync(p)) return p;
-    }
-    const icon = out.match(/DisplayIcon\s+REG_[A-Z_]+\s+"?([^"\r\n,]+\.exe)/i);
-    if (icon && fs.existsSync(icon[1])) return path.dirname(icon[1].trim());
-  }
-  return null;
-}
-
-function locate() {
-  const tried = [];
-  const push = (v) => { if (v) tried.push(v); };
-
-  // 1) 环境变量 / 显式参数
-  for (const envName of ['DSH_ASAR_PATH', 'DSH_APP_PATH']) {
-    const v = process.env[envName];
-    if (!v) continue;
-    const got = normalizeInput(v);
-    if (got) return { ...got, source: envName };
-    push(`${envName}=${v}`);
-  }
-
-  // 2) 常见安装目录
-  for (const dir of candidateAppDirs()) {
-    push(dir);
-    const got = normalizeInput(dir);
-    if (got) return { ...got, source: 'candidate' };
-  }
-
-  // 3) 系统兜底：macOS Spotlight / Windows 注册表
-  const sys = process.platform === 'darwin' ? mdfindAppDir() : registryAppDir();
-  if (sys) {
-    push(sys);
-    const got = normalizeInput(sys);
-    if (got) return { ...got, source: process.platform === 'darwin' ? 'mdfind' : 'registry' };
-  }
-  return { failed: true, tried };
-}
-
-/* ---------------------------------------------------------------- 读 app.asar */
-
-// 纯 Node 读取 asar 内文件（不依赖 Electron；asm 格式：8B 前置 + header pickle + 数据区）
-function readAsarFile(asarPath, relPath) {
-  const fd = fs.openSync(asarPath, 'r');
-  try {
-    const fstat = fs.fstatSync(fd);
-    const pre = Buffer.alloc(8);
-    if (fs.readSync(fd, pre, 0, 8, 0) !== 8) throw new Error('读取 asar 前置头失败');
-    const headerSize = pre.readUInt32LE(4);
-    if (!headerSize || headerSize > 64 * 1024 * 1024) throw new Error(`asar 头部大小异常: ${headerSize}`);
-    const hp = Buffer.alloc(headerSize);
-    if (fs.readSync(fd, hp, 0, headerSize, 8) !== headerSize) throw new Error('asar 头部被截断');
-    const jsonLen = hp.readUInt32LE(4);
-    let header;
-    try {
-      header = JSON.parse(hp.subarray(8, 8 + jsonLen).toString('utf8'));
-    } catch (e) {
-      throw new Error(`asar 头部不是合法 JSON（文件可能损坏或格式已变化）: ${e.message}`);
-    }
-    const dataOffset = 8 + headerSize;
-
-    let node = header;
-    for (const seg of String(relPath).split('/').filter(Boolean)) {
-      node = node && node.files && node.files[seg];
-      if (!node) return null;
-    }
-    if (node.files) throw new Error(`${relPath} 是目录`);
-    if (node.unpacked) throw new Error(`${relPath} 位于 app.asar.unpacked，请检查 DSH 安装完整性`);
-    const off = dataOffset + Number(node.offset);
-    const size = Number(node.size);
-    if (!Number.isFinite(off) || !Number.isFinite(size) || size < 0 || off + size > fstat.size) {
-      throw new Error(`${relPath} 的 asar 条目偏移异常`);
-    }
-    const buf = Buffer.alloc(size);
-    if (fs.readSync(fd, buf, 0, size, off) !== size) throw new Error(`${relPath} 数据被截断`);
-    return buf.toString('utf8');
-  } finally {
-    fs.closeSync(fd);
-  }
-}
-
-function readAppFile(loc, relPath) {
-  if (loc.asar) return readAsarFile(loc.asar, relPath);
-  const p = path.join(loc.devDir, relPath);
-  return fs.existsSync(p) ? fs.readFileSync(p, 'utf8') : null;
-}
-
-function readStandardPatch(loc) {
-  const errors = [];
-  for (const rel of STANDARD_RELS) {
-    try {
-      const text = readAppFile(loc, rel);
-      if (text) return { text, rel };
-    } catch (e) { errors.push(`${rel}: ${e.message}`); }
-  }
-  throw new Error(`在 DSH 安装内找不到 standard.patch.yml\n  ${errors.join('\n  ')}`);
-}
-
-function readDshVersion(loc) {
-  for (const rel of DSH_VERSION_REL) {
-    try {
-      const text = readAppFile(loc, rel);
-      if (!text) continue;
-      const pkg = JSON.parse(text);
-      if (pkg && pkg.version) return `${pkg.name || 'dsh'}@${pkg.version}`;
-    } catch (e) { /* 忽略 */ }
-  }
-  return 'unknown';
-}
-
-/* ---------------------------------------------------------------- 生成模板 */
-
-function build(standard) {
-  if (!standard.includes('preset-standard')) throw new Error('standard.patch.yml 不含 preset-standard（DSH 版本可能已变化）');
-  let text = standard.replace('    - id: preset-standard', '    - id: preset-ck');
-  if (!text.includes('    - id: preset-ck')) throw new Error('预设行重命名失败（standard.patch.yml 格式变化）');
-
-  const idLine = '        id: standard\n        order: 1\n';
-  if (!text.includes(idLine)) throw new Error('standard.patch.yml 预设元数据格式变化（id/order 段）');
-  const meta = [
-    '        id: ck',
-    "        name: 'Ck 万能执行员'",
-    "        description: '万能执行员：渗透 / 逆向 / Pwn / 协议 / 密码 / 移动 / 取证 / 内存 / 漏洞研究 / 红队 / 自动化 / 开发 / 数据 / 调研，点啥干啥。'",
-    '        order: 0',
-    '',
-  ].join('\n');
-  text = text.replace(idLine, meta);
-
-  const personaLine = '              prefix: You are a coding agent powered by the {{model}} model.';
-  if (!text.includes(personaLine)) throw new Error('standard.patch.yml persona 行格式变化（prefix 单行）');
-  text = text.replace(
-    "          - id: persona\n            name: '@deepseek-ai/dsh-persona'\n            config:\n" + personaLine,
-    "          - id: persona\n            name: '@deepseek-ai/dsh-persona'\n            config:\n              prefix: |\n" + PLACEHOLDER
-  );
-
-  // 去掉官方文件头注释，换成仓库口径
-  const lines = text.split('\n');
-  while (lines.length && lines[0].startsWith('#')) lines.shift();
-  const header = [
-    '# Ck 万能执行员 — DeepSeek Harness Agent 预设声明（agent-bypass · dsh/）',
-    '# 由 dsh/build-template.js 从本机 DSH 官方 standard 预设派生：插件/工具列表与 standard 逐行一致，',
-    '# 仅替换 persona 与预设元数据。安装时 npx agent-bypass --dsh 把 __PERSONA__ 替换为 dsh/persona.md 的正文。',
-    '# DSH 升级后请在本机重跑：node dsh/build-template.js',
-    '',
-  ].join('\n');
-  return header + lines.join('\n');
-}
-
-/* ---------------------------------------------------------------- 主流程 */
-
-function main() {
-  const args = process.argv.slice(2);
-  const getArg = (name) => { const i = args.indexOf(name); return i >= 0 ? args[i + 1] : null; };
-  const explicit = getArg('--asar') || getArg('--app');
-  if (explicit) process.env[String(explicit).endsWith('.asar') ? 'DSH_ASAR_PATH' : 'DSH_APP_PATH'] = explicit;
-
-  const loc = locate();
-  if (loc.failed) {
-    console.error('✗ 未找到 DeepSeek Harness 安装目录。已探测：');
-    for (const t of loc.tried || []) console.error(`  · ${t}`);
-    console.error('可显式指定：');
-    console.error('  node dsh/build-template.js --app "/Applications/DeepSeek Harness.app"');
-    console.error('  node dsh/build-template.js --asar "<app.asar 路径>"');
-    console.error('  DSH_APP_PATH / DSH_ASAR_PATH 环境变量同样可用');
-    process.exit(1);
-  }
-
-  const standard = readStandardPatch(loc).text;
-  const version = readDshVersion(loc);
-  const persona = fs.readFileSync(path.join(__dirname, 'persona.md'), 'utf8').replace(/\r\n/g, '\n').trimEnd();
-  if (!persona) throw new Error('dsh/persona.md 为空');
-  if (/\{\{/.test(persona)) throw new Error('dsh/persona.md 不允许包含 {{…}} 模板变量（persona 是严格模板）');
-
-  const out = build(standard);
-  if (!out.includes(PLACEHOLDER)) throw new Error('生成结果缺少 persona 占位符');
-  if (!out.includes('    - id: preset-ck')) throw new Error('生成结果缺少 preset-ck 声明');
-  if (/\{\{/.test(out)) throw new Error('生成结果仍含 {{…}}（官方 persona 行可能未替换成功）');
-
-  fs.writeFileSync(OUT, out, 'utf8');
-  console.log(`✓ 模板已生成：${path.relative(ROOT, OUT)}（${Buffer.byteLength(out)} 字节）`);
-  console.log(`  DSH 版本：${version}`);
-  console.log(`  安装目录：${loc.app || loc.input || loc.source}`);
-  console.log(`  读取来源：${loc.asar ? 'app.asar' : '未打包目录'}${loc.source ? `（${loc.source}）` : ''}`);
-}
-
-main();