dsh-agent-plugins-market 0.6.0 → 0.6.2

package/lib/routes.js

@@ -7,12 +7,13 @@
  * enable/disable against a local profile.
  */
 import { isAbsolute } from 'node:path';
-import { MARKET_ROUTES } from './contracts/market.js';
+import { MARKET_ROUTES, userPanelRoute } from './contracts/market.js';
 import { expandHome } from './catalog/paths.js';
 import { sanitizeOverridePatch } from './runtime/mcp-overrides.js';
+import { readModelCatalog } from './runtime/model-catalog.js';
 const MAX_BODY_BYTES = 64 * 1024;
 /** Mount every route; returns the disposer releasing them all. */
-export function mountSuiteRoutes(hostCtx, manager) {
+export function mountSuiteRoutes(hostCtx, manager, panels) {
     const host = hostCtx;
     const disposers = [];
     const get = (path, handler) => {
@@ -34,7 +35,7 @@ export function mountSuiteRoutes(hostCtx, manager) {
                         return;
                     }
                     try {
-                        const value = await handler(body);
+                        const value = await handler(body, request);
                         sendJson(response, 200, { ok: true, ...value });
                     }
                     catch (error) {
@@ -47,9 +48,44 @@ export function mountSuiteRoutes(hostCtx, manager) {
     get(MARKET_ROUTES.overview, async (_request, response) => {
         sendJson(response, 200, await manager.overview());
     });
+    get(MARKET_ROUTES.modelCatalog, async (request, response) => {
+        try {
+            const query = queryOf(request);
+            sendJson(response, 200, await readModelCatalog(host, query.get('provider') || undefined, query.get('model') || undefined));
+        }
+        catch (error) {
+            sendJson(response, 503, { ok: false, error: error instanceof Error ? error.message : String(error) });
+        }
+    });
     get(MARKET_ROUTES.mcpStatus, async (_request, response) => {
         sendJson(response, 200, await manager.mcpStatus());
     });
+    get(MARKET_ROUTES.serverConfig, async (request, response) => {
+        try {
+            const query = queryOf(request);
+            const kind = query.get('kind');
+            if (kind !== 'mcp' && kind !== 'lsp')
+                throw new Error('invalid service kind');
+            sendJson(response, 200, await manager.serverConfig(kind, query.get('id') ?? ''));
+        }
+        catch (error) {
+            sendJson(response, 400, { ok: false, error: error instanceof Error ? error.message : String(error) });
+        }
+    });
+    post(MARKET_ROUTES.saveServerConfig, async (body) => {
+        if (body.kind !== 'mcp' && body.kind !== 'lsp')
+            throw new Error('invalid service kind');
+        if (typeof body.id !== 'string' || body.id === '')
+            throw new Error('missing service id');
+        await manager.saveServerConfig(body.kind, body.id, body.config);
+        return {};
+    });
+    post(MARKET_ROUTES.addMcpServer, async (body) => {
+        if (typeof body.name !== 'string')
+            throw new Error('MCP server name is required');
+        await manager.addMcpServer(body.name, body.config);
+        return {};
+    });
     get(MARKET_ROUTES.lspStatus, async (_request, response) => {
         sendJson(response, 200, await manager.lspStatus());
     });
@@ -157,7 +193,7 @@ export function mountSuiteRoutes(hostCtx, manager) {
         const id = body['id'];
         if (typeof id !== 'string' || id === '')
             throw new Error('missing source id');
-        await manager.removeSource(id);
+        await manager.removeSource(id, body['deleteCheckout'] === true);
         return {};
     });
     post(MARKET_ROUTES.refreshSource, async (body) => {
@@ -249,11 +285,75 @@ export function mountSuiteRoutes(hostCtx, manager) {
         return await manager.mcpBackendInfo();
     });
     // Validate and persist the user's direct LSP server table; the reconcile
-    // pass picks it up and mounts it alongside the suite declarations.
-    post(MARKET_ROUTES.lspServers, async (body) => {
+    // pass picks it up and mounts it alongside the suite declarations. The
+    // mutation path is distinct from the read path: the webserver's exact table
+    // is keyed by pathname only, so a same-path GET/POST pair cannot coexist.
+    post(`${MARKET_ROUTES.lspServers}/save`, async (body) => {
         const servers = await manager.setLspServers(body['lspServers']);
         return { lspServers: servers };
     });
+    post(MARKET_ROUTES.addLspServer, async (body) => {
+        if (typeof body.name !== 'string')
+            throw new Error('missing LSP server name');
+        await manager.addLspServer(body.name.trim(), body.config);
+        return {};
+    });
+    post(`${MARKET_ROUTES.lspServers}/enabled`, async (body) => {
+        const id = String(body['id'] ?? '');
+        if (id === '')
+            throw new Error('missing LSP server id');
+        await manager.setLspServerEnabled(id, body['enabled'] !== false);
+        return {};
+    });
+    // User panel CRUD (skills / commands / agent personas). The host web
+    // server matches exact pathnames, so the entry name rides the `name` query
+    // parameter (GET read, POST replace, POST .../delete remove). The routes
+    // only parse and delegate; the stores own validation and persistence, and
+    // each mutation notifies the change pipeline so skills/commands remount.
+    if (panels !== undefined) {
+        const kinds = ['skills', 'commands', 'agents'];
+        const storeOf = (kind) => panels[kind];
+        for (const kind of kinds) {
+            get(userPanelRoute(kind), async (_request, response) => {
+                sendJson(response, 200, { entries: await storeOf(kind).list() });
+            });
+            get(`${userPanelRoute(kind)}/entry`, async (request, response) => {
+                const name = queryOf(request).get('name') ?? '';
+                const entry = await storeOf(kind).get(name);
+                if (entry === undefined) {
+                    sendJson(response, 404, { ok: false, error: `no entry named "${name}"` });
+                    return;
+                }
+                sendJson(response, 200, { entry });
+            });
+            post(`${userPanelRoute(kind)}/create`, async (body) => {
+                const name = String(body['name'] ?? '').trim();
+                const text = String(body['text'] ?? '');
+                if (name === '')
+                    throw new Error('missing entry name');
+                const entry = await storeOf(kind).create(name, text);
+                await manager.notifyPanelsChanged();
+                return { entry };
+            });
+            post(`${userPanelRoute(kind)}/update`, async (body, request) => {
+                const name = queryOf(request).get('name') ?? '';
+                const text = String(body['text'] ?? '');
+                if (name === '')
+                    throw new Error('missing entry name');
+                await storeOf(kind).update(name, text);
+                await manager.notifyPanelsChanged();
+                return {};
+            });
+            post(`${userPanelRoute(kind)}/delete`, async (body) => {
+                const name = String(body['name'] ?? '');
+                if (name === '')
+                    throw new Error('missing entry name');
+                await storeOf(kind).remove(name);
+                await manager.notifyPanelsChanged();
+                return {};
+            });
+        }
+    }
     return () => {
         for (const dispose of disposers)
             dispose();

package/lib/runtime/agent-role-router.js

@@ -0,0 +1,226 @@
+/** Execute user and installed-suite agent cards through the host subagent service. */
+import { readFile } from 'node:fs/promises';
+import { defineTool } from '@deepseek-ai/dsh-tools';
+import { parse as parseYaml } from 'yaml';
+import { mountSubagentCatalog } from './subagent-catalog.js';
+import { bindHostLocale } from './host-locale.js';
+export const AGENT_ROLE_TOOL_NAME = 'subagents_run';
+function optionalText(value, key) {
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== 'string' || value.trim() === '')
+        throw new Error(`agent metadata ${key} must be a non-empty string`);
+    return value.trim();
+}
+function toolList(value, key) {
+    if (value === undefined)
+        return undefined;
+    const entries = typeof value === 'string' ? value.split(',') : Array.isArray(value) ? value : [value];
+    return [
+        ...new Set(entries.map(entry => {
+            if (typeof entry !== 'string' || !/^[\w.:-]+$/.test(entry.trim()))
+                throw new Error(`agent metadata ${key} must contain tool names (comma-separated or a YAML array)`);
+            return entry.trim();
+        }))
+    ];
+}
+/** Strict YAML parsing prevents malformed routing/restriction metadata from silently inheriting wider privileges. */
+export function parseAgentRole(text) {
+    const match = /^(?:\uFEFF)?---\r?\n([\s\S]*?)\r?\n---[ \t]*(?:\r?\n|$)/.exec(text);
+    if (match === null) {
+        if (/^(?:\uFEFF)?---(?:\r?\n|$)/.test(text))
+            throw new Error('agent frontmatter is not closed');
+        return { content: text, disabled: false };
+    }
+    const parsed = parseYaml(match[1]);
+    if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed))
+        throw new Error('agent frontmatter must be a YAML object');
+    const metadata = parsed;
+    if (metadata.disabled !== undefined && typeof metadata.disabled !== 'boolean')
+        throw new Error('agent metadata disabled must be a boolean');
+    const model = optionalText(metadata.model, 'model');
+    const provider = optionalText(metadata.provider, 'provider');
+    const effort = optionalText(metadata.reasoning_effort, 'reasoning_effort');
+    const camelEffort = optionalText(metadata.reasoningEffort, 'reasoningEffort');
+    if (effort !== undefined && camelEffort !== undefined && effort !== camelEffort)
+        throw new Error('agent metadata reasoning_effort and reasoningEffort conflict');
+    const reasoningEffort = effort ?? camelEffort;
+    const title = optionalText(metadata.name, 'name');
+    const description = optionalText(metadata.description, 'description');
+    if (model === 'inherit' && provider !== undefined)
+        throw new Error('agent model inherit cannot specify a provider');
+    return {
+        content: text.slice(match[0].length),
+        disabled: metadata.disabled === true,
+        ...(model === undefined || model === 'inherit' ? {} : { model }),
+        ...(provider === undefined ? {} : { provider }),
+        ...(reasoningEffort === undefined ? {} : { reasoningEffort }),
+        ...(title === undefined ? {} : { title }),
+        ...(description === undefined ? {} : { description }),
+        ...(metadata.tools === undefined ? {} : { tools: toolList(metadata.tools, 'tools') }),
+        ...(metadata.disallowedTools === undefined ? {} : { disallowedTools: toolList(metadata.disallowedTools, 'disallowedTools') })
+    };
+}
+/** Bare ids must resolve uniquely; Claude aliases are accepted only if actually advertised by a DSH provider. */
+export async function resolveAgentModel(policy, catalog) {
+    if (policy.model === undefined)
+        return policy.provider === undefined ? {} : { provider: policy.provider };
+    const providers = catalog.listProviders();
+    if (policy.provider !== undefined) {
+        if (!providers.some(provider => provider.id === policy.provider))
+            throw new Error(`agent model provider "${policy.provider}" is not registered`);
+        return { provider: policy.provider, model: policy.model };
+    }
+    const qualified = providers.filter(provider => policy.model.startsWith(`${provider.id}/`)).sort((a, b) => b.id.length - a.id.length)[0];
+    if (qualified !== undefined) {
+        const model = policy.model.slice(qualified.id.length + 1);
+        if (model === '')
+            throw new Error('agent model id must not be empty');
+        return { provider: qualified.id, model };
+    }
+    const matches = (await Promise.all(providers.map(async (provider) => {
+        try {
+            return (await catalog.listModels(provider.id)).some(model => model.id === policy.model) ? provider.id : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }))).filter((provider) => provider !== undefined);
+    if (matches.length !== 1)
+        throw new Error(`agent model "${policy.model}" ${matches.length === 0 ? 'is not advertised' : 'is ambiguous'}; configure provider and model explicitly`);
+    return { provider: matches[0], model: policy.model };
+}
+/** Read the same declaration for catalog summaries and execution, including inline resources. */
+export async function readAgentRole(entry) {
+    return parseAgentRole(entry.rawText ?? (await readFile(entry.path, 'utf8')));
+}
+/** Stable summaries; invalid declarations are excluded and transient read failures abort publication. */
+export async function agentRoleCatalog(entries, signal, diagnose = () => { }) {
+    const summaries = [];
+    const counts = new Map();
+    for (const entry of entries)
+        counts.set(entry.name, (counts.get(entry.name) ?? 0) + 1);
+    for (const entry of entries) {
+        signal.throwIfAborted();
+        if (entry.disabled)
+            continue;
+        if (counts.get(entry.name) !== 1) {
+            diagnose(`ambiguous subagent role: ${entry.name}`);
+            continue;
+        }
+        let text;
+        try {
+            text = entry.rawText ?? (await readFile(entry.path, 'utf8'));
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+            continue;
+        }
+        let policy;
+        try {
+            policy = parseAgentRole(text);
+        }
+        catch (error) {
+            diagnose(`${entry.path}: ${String(error)}`);
+            continue;
+        }
+        if (policy.disabled)
+            continue;
+        const description = (policy.description ?? entry.description).replaceAll(/\s+/g, ' ').trim();
+        summaries.push({
+            name: entry.name,
+            title: policy.title ?? entry.title ?? entry.name,
+            description: description.length <= 500 ? description : `${description.slice(0, 497)}...`,
+            ...(policy.provider === undefined ? {} : { provider: policy.provider }),
+            ...(policy.model === undefined ? {} : { model: policy.model }),
+            ...(policy.reasoningEffort === undefined ? {} : { reasoningEffort: policy.reasoningEffort })
+        });
+    }
+    signal.throwIfAborted();
+    return summaries.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+}
+/** Resolve fresh panel state and raw Markdown on every call, including after edits, disabling and uninstall. */
+export async function executeAgentRole(host, listRoles, name, prompt, parent, signal) {
+    if (parent === undefined)
+        throw new Error('subagents_run requires a calling agent');
+    if (prompt.trim() === '')
+        throw new Error('subagents_run requires a non-empty prompt');
+    signal.throwIfAborted();
+    const entries = (await listRoles(parent)).filter(entry => entry.name === name);
+    if (entries.length !== 1)
+        throw new Error(`agent role "${name}" is unavailable or ambiguous`);
+    const entry = entries[0];
+    if (entry.disabled)
+        throw new Error(`agent role "${name}" is disabled`);
+    const policy = await readAgentRole(entry);
+    if (policy.disabled)
+        throw new Error(`agent role "${name}" is disabled`);
+    const agentOptions = { ...(await resolveAgentModel(policy, host.llm)), ...(policy.reasoningEffort === undefined ? {} : { reasoningEffort: policy.reasoningEffort }) };
+    const parentAgent = parent;
+    const parentOptions = parentAgent.session?.requestHeader?.()?.config ?? parentAgent.options ?? {};
+    const provider = agentOptions.provider ?? parentOptions.provider;
+    const model = agentOptions.model ?? parentOptions.model;
+    if (provider === undefined || model === undefined)
+        throw new Error('subagents_run requires an effective provider and model');
+    const routeChanged = provider !== parentOptions.provider || model !== parentOptions.model;
+    const reasoningEffort = agentOptions.reasoningEffort ?? (routeChanged ? undefined : parentOptions.reasoningEffort);
+    await host.llm.resolveCallConfig({ provider, model, ...(reasoningEffort === undefined ? {} : { reasoningEffort }) }, signal);
+    signal.throwIfAborted();
+    const run = await host.subagents.start('spawn', {
+        label: name,
+        prompt: [{ type: 'text', text: prompt }],
+        parent,
+        signal,
+        maxDepth: 3,
+        agentOptions,
+        persona: policy.content,
+        ...(policy.tools === undefined && policy.disallowedTools === undefined
+            ? {}
+            : {
+                toolFilter: {
+                    ...(policy.tools === undefined ? {} : { allow: policy.tools }),
+                    ...(policy.disallowedTools === undefined ? {} : { deny: policy.disallowedTools })
+                }
+            })
+    });
+    try {
+        const result = await run.result;
+        if (result.stopReason !== 'completed')
+            throw new Error(`agent role "${name}" stopped: ${result.stopReason}; partial output: ${JSON.stringify(result.output)}`);
+        return { runId: run.id, output: result.output };
+    }
+    finally {
+        await run.dispose();
+    }
+}
+/** Mount once after tools, llm and subagents are available; the returned disposer belongs to the plugin lifecycle. */
+export function mountAgentRoleTool(ctx, listRoles, t = bindHostLocale(undefined)) {
+    const host = ctx;
+    const tool = defineTool({
+        name: AGENT_ROLE_TOOL_NAME,
+        description: 'Delegate a self-contained task to a role from the current subagent catalog and wait for its result. The child starts without the parent conversation. Its saved provider, model, reasoning effort, persona and tool restrictions are applied automatically.',
+        parameters: {
+            role: { type: 'string', required: true, description: 'Exact role ID from the current subagent catalog.' },
+            prompt: { type: 'string', required: true, description: 'Complete task and context for the isolated child.' }
+        },
+        output: { schema: { type: 'json' }, render: (_args, result) => [{ type: 'text', text: JSON.stringify(result) }] },
+        isConcurrencySafe: () => true,
+        async execute(args, exec) {
+            return executeAgentRole(host, listRoles, args.role, args.prompt, exec.agent, exec.signal);
+        }
+    });
+    const disposeTool = host.tools.register(tool);
+    let disposeCatalog;
+    try {
+        disposeCatalog = mountSubagentCatalog(ctx, tool, async (agent, signal) => agentRoleCatalog(await listRoles(agent), signal, message => ctx.logger?.warn(message)), t);
+    }
+    catch (error) {
+        disposeTool();
+        throw error;
+    }
+    return () => {
+        disposeCatalog();
+        disposeTool();
+    };
+}

package/lib/runtime/commands-mounts.js

@@ -1,46 +1,34 @@
-/**
- * Claude Code command compatibility: `commands/*.md` of enabled suites
- * register as dsh slash commands.
- *
- * A CC command is a prompt template the model executes (its body carries
- * `$ARGUMENTS` and execution rules), so the handler maps it onto the
- * harness's follow-up mechanism: the template with `$ARGUMENTS` substituted
- * becomes one durable user-role follow-up message on the receiving agent.
- * Registrations reconcile on every enable/disable/install/uninstall; a
- * broken command file or an unavailable `ctx.commands` is contained per
- * command and reported as a diagnostic.
- */
-import { readFile, readdir } from 'node:fs/promises';
-import { join } from 'node:path';
 import { parse as parseYaml } from 'yaml';
-import { parseSkillFrontmatter, stripFrontmatter } from '../catalog/skills-parse.js';
+import { stripFrontmatter } from '../catalog/skills-parse.js';
+import { parseFrontmatterRecord } from './user-store.js';
 import { qualifiedSuiteId } from '../catalog/paths.js';
+import { defaultMarkdownResources, resourceText, resourceCommandName } from '../catalog/component-files.js';
 import { bindHostLocale } from './host-locale.js';
 const COMMAND_NAME = /^[a-z][a-z0-9_-]*$/;
 export class CommandMountRegistry {
     ctx;
     t;
+    fingerprints = new Map();
     live = new Map();
     constructor(ctx, t = bindHostLocale(undefined)) {
         this.ctx = ctx;
         this.t = t;
     }
-    /** Register/unregister suite commands and agent-commands to match the enabled suites exactly. */
+    /** Register/unregister suite commands to match the enabled suites exactly. */
     async reconcile(enabledSuites) {
         const diagnostics = [];
         const wanted = new Map();
         for (const suite of enabledSuites) {
-            const specs = suite.activeSurfaces?.commands === false && suite.activeSurfaces?.agents === false
-                ? []
-                : [
-                    ...(suite.activeSurfaces?.commands === false ? [] : await readCommands(suite.root)),
-                    ...(suite.activeSurfaces?.agents === false ? [] : await readAgents(suite.root, this.t))
-                ];
+            const specs = suite.activeSurfaces?.commands === false ? [] : await readCommands(suite.root, suite.resources?.commands);
             for (const spec of specs) {
                 // The registry key is source-qualified: bare suite ids are unique per
                 // source only, so two sources' same-named suites would collide.
                 const suiteKey = qualifiedSuiteId(suite.sourceId, suite.id);
                 const key = `${suiteKey}/${spec.name}`;
+                if (wanted.has(key)) {
+                    diagnostics.push({ suiteId: suiteKey, command: spec.name, reason: 'duplicate normalized command name' });
+                    continue;
+                }
                 wanted.set(key, { ...spec, suiteId: suiteKey, suiteName: suite.manifest.name });
             }
         }
@@ -57,8 +45,12 @@ export class CommandMountRegistry {
             return diagnostics;
         }
         for (const [key, spec] of wanted) {
-            if (this.live.has(key))
+            const fingerprint = JSON.stringify(spec);
+            if (this.live.has(key) && this.fingerprints.get(key) === fingerprint)
                 continue;
+            this.live.get(key)?.();
+            this.live.delete(key);
+            this.fingerprints.delete(key);
             try {
                 const disposer = host.commands.register({
                     name: spec.name,
@@ -72,6 +64,7 @@ export class CommandMountRegistry {
                     }
                 });
                 this.live.set(key, disposer);
+                this.fingerprints.set(key, fingerprint);
             }
             catch (error) {
                 diagnostics.push({ suiteId: spec.suiteId, command: spec.name, reason: error instanceof Error ? error.message : String(error) });
@@ -84,69 +77,36 @@ export class CommandMountRegistry {
         for (const disposer of [...this.live.values()])
             disposer();
         this.live.clear();
+        this.fingerprints.clear();
     }
 }
 /** Parse `commands/*.md` of one suite root (Claude Code format). */
-export async function readCommands(root) {
-    let entries;
-    try {
-        entries = await readdir(join(root, 'commands'));
-    }
-    catch {
-        return [];
-    }
+export async function readCommands(root, resources) {
+    const entries = resources ?? (await defaultMarkdownResources(root, 'commands'));
     const specs = [];
     for (const entry of entries) {
-        if (!entry.endsWith('.md'))
-            continue;
-        const name = entry.slice(0, -3);
+        const name = resourceCommandName(entry.name);
         if (!COMMAND_NAME.test(name))
             continue;
         let text;
         try {
-            text = await readFile(join(root, 'commands', entry), 'utf8');
+            text = await resourceText(entry);
         }
         catch {
             continue;
         }
-        const meta = commandMeta(text);
-        const description = meta?.description ?? firstLine(text);
-        if (description === undefined)
-            continue;
-        specs.push({ name, description, hint: meta?.hint, body: stripFrontmatter(text) });
-    }
-    return specs;
-}
-/** Parse `agents/*.md` of one suite root into `agent-<name>` commands so
- *  subagents are selectable from the slash-command menu, grouped by the
- *  `agent-` prefix (the harness command UI has no group headers). */
-export async function readAgents(root, t) {
-    let entries;
-    try {
-        entries = await readdir(join(root, 'agents'));
-    }
-    catch {
-        return [];
-    }
-    const specs = [];
-    for (const entry of entries) {
-        if (!entry.endsWith('.md'))
-            continue;
-        const name = `agent-${entry.slice(0, -3)}`;
-        if (!COMMAND_NAME.test(name))
-            continue;
-        let text;
         try {
-            text = await readFile(join(root, 'agents', entry), 'utf8');
+            if (parseFrontmatterRecord(text).disabled === true)
+                continue;
         }
         catch {
             continue;
         }
-        const parsed = parseSkillFrontmatter(text, name);
-        const description = typeof parsed === 'string' ? parsed : parsed.description;
+        const meta = commandMeta(text);
+        const description = meta?.description ?? firstLine(text);
         if (description === undefined)
             continue;
-        specs.push({ name, description, hint: t('agentCommandHint'), body: stripFrontmatter(text) });
+        specs.push({ name, description, hint: meta?.hint, body: stripFrontmatter(text) });
     }
     return specs;
 }
@@ -163,7 +123,7 @@ function commandMeta(text) {
         const description = record['description'];
         if (typeof description === 'string' && description.trim() !== '')
             meta.description = description.trim();
-        const hint = record['argument-hint'];
+        const hint = record['argument-hint'] ?? record['argumentHint'];
         if (typeof hint === 'string' && hint.trim() !== '')
             meta.hint = hint.trim();
         return meta;