dsh-chat-preset 0.0.0-stage → 1.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 lwb6
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,281 @@
-# Temporary Holding Version
+# dsh-chat-preset
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+> ChatOnly —— 本项目提供的预设 agent。抑制工具注入与工作目录注入，使请求仅包含用户输入，以及可选的自定义系统提示词。
+
+[![CI](https://github.com/Xxx-Bin/dsh-chat-preset/actions/workflows/ci.yml/badge.svg)](https://github.com/Xxx-Bin/dsh-chat-preset/actions/workflows/ci.yml)
+[![npm](https://img.shields.io/npm/v/dsh-chat-preset.svg)](https://www.npmjs.com/package/dsh-chat-preset)
+[![license](https://img.shields.io/badge/license-MIT-blue.svg)](./LICENSE)
+[![node](https://img.shields.io/badge/node-%E2%89%A518-3c873a.svg)](https://nodejs.org)
+
+> **安装前须知。** 本包不依赖公开插件 API，其行为由 DSH 的三处内部语义决定（作用域同名 shadow 覆盖、`system-prompt/assemble` 瀑布、`refreshContext()` 的合并顺序）。上述语义变更时，本包会**静默失效**：不报错、不崩溃，仅退回默认请求形态。详见[兼容性与脆弱性](#兼容性与脆弱性)。
+
+---
+
+## 概述
+
+DSH 默认的最小配置是精简模式。即便在该模式下，请求仍包含两类注入，且均无法在预设配置层消除：
+
+1. **工具 schema。** 工具在全局层收集，与预设作用域无关，预设只能追加、不能移除。
+2. **工作目录消息。** DSH 默认在用户输入之后追发一条 `runtime-context` 用户消息，内容为当前工作目录 `Current working directory: C:\…`；该 contribution 以 `required: true` 注册，`includeRuntimeContext: false` 只过滤可选 contribution。
+
+本包提供 ChatOnly 预设 agent，在装配瀑布与 context 注册层分别消除这两类注入，并将系统提示词改为文件热更新，用于受控条件下的模型能力评测。
+
+## 请求形态
+
+测量环境：DSH 桌面端，`desktop` profile。
+
+```diff
+  # 抑制前
+- tools:    9 个 — acp_cache, acp_read_original_image, acp_status, compress,
+-                 decompress, external_plugins, load_workspace_dependencies,
+-                 search_context, working_directory
+- messages: [ …, { source: { kind: "runtime-context" } } ]
+-                 # 用户输入之后追发的工作目录消息
+  # 抑制后
++ tools:    该键不存在
++ messages: 仅用户输入
+```
+
+工具数量随已安装插件变化，本机观测区间为 **8–14 个**。
+
+## 预设层的限制
+
+| 目标 | 预设层的限制 |
+|---|---|
+| 移除工作目录消息 | 该 contribution 注册为 `required: true`；`suppressRuntimeContext()` 仅过滤可选项 |
+| 移除全局工具 schema | 工具在全局层收集，预设作用域只可追加；不存在 `suppressTools()` |
+| 改写 `agent/pre-step` 决策 | `dsh-agent-loop` 的 `step()` 会重新计算上下文并写入 surface，从 decision 中移除消息只会使其在 fallback 分支重建 |
+
+本包因此改由三处机制实现：agent 作用域内的同名空 shadow、`system-prompt/assemble` 瀑布、以及 `buildRequest()` 在工具列表为空时省略该键的行为。推导过程与源码行号见 [`index.js`](./index.js) 头部注释。
+
+## 安装
+
+依赖：**dsh**（桌面端或 CLI）、`pnpm` 位于 `PATH`（`dsh plugin add` 内部转发 `pnpm add`）、**Node.js ≥ 18**。
+
+```bash
+# npm
+dsh plugin --profile desktop add dsh-chat-preset
+
+# GitHub
+dsh plugin --profile desktop add github:Xxx-Bin/dsh-chat-preset
+
+# 本地路径（修改代码后需重启 dsh，模块存在缓存）
+git clone git@github.com:Xxx-Bin/dsh-chat-preset.git
+dsh plugin --profile desktop add /absolute/path/to/dsh-chat-preset
+```
+
+`--profile` 为 profile 名，即 `~/.dsh/profiles/` 下的目录名；桌面端默认为 `desktop`。`add` 在该目录执行 `pnpm add`，随后核对 `dsh.profile.bundles`：凡已安装且 `package.json` 声明 `dsh.bundle` 的依赖会被追加进 layer stack。本包声明 `dsh.bundle.patch`，安装后自动登记。
+
+**安装后须重启 dsh。** bundles 层仅在启动时合成，运行期不监听变更。重启后在预设选择中启用 **ChatOnly**。
+
+<details>
+<summary>手动安装（不依赖 dsh CLI）</summary>
+
+1. 在 `~/.dsh/profiles/desktop/package.json` 的 `dependencies` 中添加 `"dsh-chat-preset": "link:/absolute/path/to/dsh-chat-preset"`
+2. 在同一文件的 `dsh.profile.bundles` 数组中添加 `"dsh-chat-preset"`
+3. 在该目录执行 `pnpm install`
+4. 重启 dsh
+
+</details>
+
+## 使用
+
+### 系统提示词：`/chatprompt`
+
+提示词存于 `~/.dsh/chatonly-system-prompt.md`，命令仅作为读写入口，亦可直接编辑文件。
+
+| 命令 | 行为 |
+|---|---|
+| `/chatprompt <text>` | 写入文件，下一条消息生效 |
+| `/chatprompt` | 输出预览、字符数与文件路径 |
+| `/chatprompt show` | 输出全文 |
+| `/chatprompt clear` | 清空文件；此后不发送系统提示词 |
+
+文件为空时不发送任何系统消息，请求中仅含用户输入。`deployment:persona-prefix` 段由本包以 `complete: true` 独占，不再拼接部署层其它文本。
+
+> 该命令全局注册，可在任意预设下调用，但仅影响 ChatOnly；在其它预设下修改不会生效，亦无提示。
+
+### 工具抑制开关：`/chattools`
+
+默认抑制，即请求不携带任何工具 schema。
+
+| 命令 | 行为 |
+|---|---|
+| `/chattools` 或 `/chattools status` | 输出当前模式与状态文件路径 |
+| `/chattools on` | 抑制工具注入 |
+| `/chattools off` | 放行，`assembly.tools` 原样传递 |
+| `/chattools reset` | 删除状态文件，回退出厂默认 |
+
+状态存于 `~/.dsh/chatonly-strip-tools.state`，内容为 `strip` 或 `pass`。每次装配重新读取，切换后下一条消息生效；文件不存在时采用 `config.stripTools`。参数接受 `on`／`strip`／`intercept`／`block`／`true`／`1` 与 `off`／`pass`／`allow`／`bypass`／`false`／`0` 两组同义词，无法识别时返回错误且不改变状态。
+
+放行状态下，本包原样返回下游装配结果，其它插件的工具追加与过滤逻辑均按原有顺序生效。本包不提供工具，仅在抑制状态下清空列表。
+
+> 该命令全局注册且作用于所有 ChatOnly 会话：状态是单一文件，不按会话或 agent 区分。
+
+#### 两种抑制相互独立
+
+`/chattools off` 仅放行工具。`working-directory:current` 在该会话中仍为空，模型不获得工作目录及其它环境信息。
+
+若启用文件类工具而未提供工作目录，模型缺少定位依据，评测结果将混入环境缺失的影响。因此放行工具时应同时满足两项条件：
+
+1. 通过 `dsh-tool-manager` 等插件将工具集限制为本次评测所需的最小集合。全局注入的 8–14 个工具签名不属于评测变量。
+2. 在系统提示词中补充工作目录与环境约束。抑制状态下，该文件是唯一的环境信息来源。
+
+### 配置
+
+`cordis.patch.yml` 以 `config.role` 分流两处挂载：
+
+| role | 挂载位置 | 职责 |
+|---|---|---|
+| `policy`（默认） | 全局 | 抑制工作目录注入、按开关抑制工具、注册 `/chatprompt` 与 `/chattools` |
+| `section` | ChatOnly 预设 agent 的 `plugins` | 占用 persona 槽位，从文件读取系统提示词 |
+
+```yaml
+- insert:
+    # 行 1：全局挂载（policy）
+    - id: chatonly-context-policy
+      name: 'dsh-chat-preset'
+      config:
+        role: 'policy'
+        presetId: 'chatonly'                      # 须与预设行的 config.id 一致
+        contextName: 'working-directory:current'  # 被覆盖的 contribution 名
+        stripTools: true                          # 出厂默认；运行期由 /chattools 切换
+        toolsStateFile: '~/.dsh/chatonly-strip-tools.state'
+        file: '~/.dsh/chatonly-system-prompt.md'  # /chatprompt 写入目标
+
+    # 行 2：定义预设 ChatOnly，并在其 plugins 内挂载 section
+    - id: preset-chat
+      name: '@deepseek-ai/dsh-agent-preset'
+      config:
+        id: chatonly
+        name: ChatOnly
+        order: 5
+        plugins:
+          - id: prompt
+            name: 'dsh-chat-preset'
+            config:
+              role: 'section'
+              file: '~/.dsh/chatonly-system-prompt.md'  # 装配读取来源
+```
+
+**`presetId` 必须与预设行的 `config.id` 一致。** 两者不同时，`policy` 行不会作用于该预设，注入照常存在。
+
+**两处 `file` 必须一致。** 写入与读取路径不同时，`/chatprompt` 会报告保存成功而系统提示词从未生效。
+
+**`toolsStateFile` 不得与 `file` 指向同一路径。** 开关文件按单行关键字解析，读到提示词全文时识别失败并永久回退出厂默认；反向更糟，`/chattools on|off` 会把提示词覆盖成一行 `strip`／`pass`。
+
+**`stripTools` 是出厂默认值，不是总开关。** 状态文件存在时以其为准；设为 `false` 不会禁用 `/chattools`，仅改变未切换时的默认行为。需要彻底禁用抑制行为时应卸载本包。
+
+## 兼容性与脆弱性
+
+本包依赖三处非公开行为：
+
+| 依赖 | 失效后果 |
+|---|---|
+| agent 作用域同名 context 覆盖全局同名 context | shadow 不生效，工作目录消息恢复 |
+| `required: false` + `text: ''` 使 contribution 被过滤、投影返回 `undefined` | 空字符串被视为内容，请求中多出一条空 `runtime-context` |
+| `buildRequest()` 在 `tools` 为空时省略该键 | 该键变为 `tools: []`，多数模型 API 会拒绝 |
+
+失效时无报错、无异常，仅退回默认形态。升级 dsh 后应依次确认：bundles 仍然登记（见[排障](#确认生效)第 1 条）；新建 ChatOnly 会话的请求中不存在 `tools` 键。
+
+开发与测量环境为 DSH 桌面端 `desktop` profile；CLI profile 原理相同，未逐项验证。
+
+## 限制
+
+1. **无上下文压缩。** 未挂载压缩插件，不支持自动压缩与 `/compact`。对话超出模型上下文窗口时请求直接失败。
+2. **与 `dsh-prompt-setting` 的「我的 Prompt」互斥。** `complete: true` 会覆盖同作用域内的其它段（参见该项目 `core/experiments.js` E3），两者不可共存。
+3. **同一作用域内同名 section 只能注册一次。** 预设内不应再挂载 `dsh-persona`，否则抛错。
+4. **会话内切换预设不撤销工作目录抑制。** shadow 在 agent 作用域一次性注册且无卸载路径。由 ChatOnly 切换至其它预设后，该会话的 `working-directory:current` 仍为空，直至新建会话。
+5. **旧会话不追溯。** 修复前已落库的工作目录消息仍然存在；此类会话下次对话会多出一条一次性的 `Current runtime context: none.`。
+6. **工具开关为全局状态。** 其值为单一文件，`/chattools off` 对所有已打开的 ChatOnly 会话同时生效。工作目录抑制则按 agent 注册且不可撤销。两者机制不同，行为不对称。
+
+## 卸载与清理
+
+```bash
+# 1. 从 profile 移除：dependencies 与 dsh.profile.bundles 各删除一条
+#    ~/.dsh/profiles/desktop/package.json
+#    随后在该目录执行 pnpm install 并重启 dsh
+
+# 2. 系统提示词文件（用户内容，按需保留）
+rm ~/.dsh/chatonly-system-prompt.md
+
+# 3. 工具开关状态
+rm ~/.dsh/chatonly-strip-tools.state
+
+# 4. 调试日志
+rm ~/.dsh-filter-rtc-debug.log
+```
+
+`dsh plugin remove`（或桌面端插件页的卸载）**不会**动上面第 2–4 项。它的流程是：从 `dsh.profile.bundles` 摘除 → 卸载运行期 contribution → `pnpm remove` → 重新解析。插件 API 没有卸载钩子，流程也不扫描插件写过哪些文件，因此这几步只能手动执行。
+
+不清理不算残留故障：卸载会 dispose 全部运行期注册（命令、section、监听器、shadow），行为当场回到默认；上述文件此后无人读取，只是留在主目录。唯一的真实影响是**重装沿用旧开关** —— `chatonly-strip-tools.state` 仍在时 `/chattools` 不回出厂默认，而是上次写入的 `strip`／`pass`；要拿到干净初值，先执行 `/chattools reset`。
+
+Windows 下 `rm` 不可用：PowerShell 用 `Remove-Item`，cmd 用 `del`。
+
+### 调试日志
+
+`index.js` 向 `~/.dsh-filter-rtc-debug.log` 同步追加 JSON 行，记录每次装配、每次工具剥离、每次模式切换与每次 shadow 注册。日志无大小上限与轮转机制，长期使用会持续增长。
+
+`{"evt":"strip-tools","count":9,...}` 为抑制生效的记录，可按 `sessionId` 核对具体会话。该日志为调试期脚手架，删除后会在下次触发时重建。
+
+## 确认生效
+
+按序检查，用 `desktop` 举例：
+
+```bash
+# 1. 依赖与 bundles 登记状态（可同时区分"未安装"与"已安装未登记"）
+node -e "const os=require('os'),fs=require('fs');const f=os.homedir()+'/.dsh/profiles/desktop/package.json';if(!fs.existsSync(f)){console.log('profile 不存在: '+f);process.exit(0)}const p=JSON.parse(fs.readFileSync(f,'utf8'));console.log('dep    :',p.dependencies?.['dsh-chat-preset']??'<未安装>');const b=p.dsh?.profile?.bundles;console.log('bundles:',Array.isArray(b)?(b.includes('dsh-chat-preset')?'已登记':'未登记'):'<无此字段>')"
+
+# 2. 依赖树中存在该包（应输出 dsh-chat-preset@<版本>）
+
+#    Linux / macOS
+dsh plugin --profile desktop ls | grep dsh-chat-preset
+
+#    Windows（PowerShell，无 grep）
+dsh plugin --profile desktop ls | Select-String dsh-chat-preset
+#    Windows（cmd，无 grep）
+dsh plugin --profile desktop ls | findstr dsh-chat-preset
+
+# 3. 重启 dsh —— bundles 层仅在启动时合成
+```
+
+前两步仅确认安装状态，第三步之后才涉及生效。Windows 用户以 git-bash 执行时可沿用 `grep` 写法。
+
+| 第 1 步输出 | 结论 |
+|---|---|
+| `dep: <未安装>` | 依赖未写入，重新安装 |
+| `dep: ^1.2.0` + `bundles: 未登记` | 已安装但未进入 layer stack，手动补充 `dsh.profile.bundles` |
+| 两项均正常，但 ChatOnly 不在预设列表 | 未重启，或重启的 profile 不符 |
+
+> `dsh --profile desktop --dump-config` 会报 *profile "desktop" is managed exclusively by the Electron application*。桌面端 profile 不允许 CLI 渲染配置树；如需检查合成结果，可在 CLI 管理的 profile（`web` / `headless`）中安装一次。
+
+## 开发
+
+```bash
+node test.mjs
+```
+
+25 项测试，全部通过。基于 `@deepseek-ai/dsh-system-prompt` 与 `agent-loop step()` 的等价模型，覆盖作用域隔离、预设判定、幂等性、能力缺失时的降级、工具瀑布的两种模式（抑制清空／放行后其它插件的增删可见）以及 `/chattools` 的切换语义。仅依赖 `node:` 内置模块。
+
+测试使用等价装配模型而非 DSH 本体；真实链路仍以新建 ChatOnly 会话检查请求为准。
+
+CI 在 Node 18／20／22 上运行同一套测试（`.github/workflows/ci.yml`）。
+
+## 发布
+
+推版本标签即触发 npm 发布（`.github/workflows/publish.yml`）：
+
+```bash
+npm version patch            # 或 minor / major，同时打 tag（如 v1.2.0）
+git push --follow-tags
+```
+
+工作流依次执行：升级 npm（OIDC 需 ≥ 11.5.1）→ 测试 → 校验 tag 与 `package.json` 版本一致 → `npm publish --access public --provenance`。
+
+发布使用 npm **Trusted Publishing**（OIDC），不需要任何仓库 Secret。npm 侧需为该包登记 publisher：GitHub 仓库 `Xxx-Bin/dsh-chat-preset`、workflow 文件名 `publish.yml`；两者之一对不上，认证即失败。工作流内 `NODE_AUTH_TOKEN` 被显式置空——`actions/setup-node` 会注入占位值，非空时会压过 OIDC。
+
+> 本机 `~/.npmrc` 若将 registry 指向镜像（如 `registry.npmmirror.com`），手动发布需显式指定 `--registry https://registry.npmjs.org`；工作流的 `setup-node` 已固定为官方源。
+
+## License
+
+[MIT](./LICENSE)

package/cordis.patch.yml

@@ -0,0 +1,49 @@
+# ChatOnly in one package: the preset row, the context policy, and the system
+# prompt that belongs to it.
+#
+# Row 1 (`chatonly-context-policy`, mounted globally) loads THIS package's
+# index.js with role `policy`:
+#   - shadows the required `working-directory:current` contribution, so the
+#     runtime-context snapshot never reaches the request or the session log;
+#   - clears `assembly.tools`, because global tool providers are collected for
+#     every preset and a preset row cannot remove them. That interception is a
+#     LIVE switch, not this file: `stripTools` is only the factory default, the
+#     current value lives in `toolsStateFile` and is flipped with
+#     `/chattools on|off`. With the switch off the assembly is passed through
+#     untouched, so other plugins own the tool list again;
+#   - registers `/chatprompt`, the composer-side editor for the prompt file.
+#
+# Row 2 (`preset-chat`) defines the preset. Its `plugins` list mounts THIS
+# package again with role `section`, which owns the `deployment:persona-prefix`
+# slot (complete: true) and reads its text from
+# `~/.dsh/chatonly-system-prompt.md` on every assembly — edit the file (or send
+# `/chatprompt …`) and the next message uses it. No restart.
+#
+# Do NOT add a `dsh-persona` row next to it: one section name may be registered
+# once per scope.
+#
+# No compaction: no auto-condensation, no /compact — a conversation that
+# exceeds the model context window fails instead of shrinking.
+- insert:
+    - id: chatonly-context-policy
+      name: 'dsh-chat-preset'
+      config:
+        role: 'policy'
+        presetId: 'chatonly'
+        contextName: 'working-directory:current'
+        stripTools: true                                   # 出厂默认；运行中用 /chattools 切
+        toolsStateFile: '~/.dsh/chatonly-strip-tools.state' # 当前开关值（strip/pass），缺省即默认
+        file: '~/.dsh/chatonly-system-prompt.md'
+    - id: preset-chat
+      name: '@deepseek-ai/dsh-agent-preset'
+      config:
+        id: chatonly
+        name: ChatOnly
+        description: '纯对话：默认不注入工具与工作区上下文；系统提示词来自 ~/.dsh/chatonly-system-prompt.md（留空则仅发送用户输入）；/chattools 可放行工具'
+        order: 5
+        plugins:
+          - id: prompt
+            name: 'dsh-chat-preset'
+            config:
+              role: 'section'
+              file: '~/.dsh/chatonly-system-prompt.md'

package/index.js

@@ -0,0 +1,480 @@
+/**
+ * chat-preset — the ChatOnly preset row PLUS the context policy that belongs
+ * to it (merged from the former `@local/dsh-filter-runtime-context` package:
+ * one package, one place to look when ChatOnly's request looks wrong).
+ *
+ * Keeps the loop-owned runtime-context snapshot out of the model request for
+ * agents owned by ONE preset (default: the local `chatonly` preset), and drops
+ * the globally registered tool schemas for that preset.
+ *
+ * Why the obvious approach does NOT work
+ * -------------------------------------
+ * Rewriting the `agent/pre-step` waterfall decision (`{ ...decision, messages }`
+ * without the snapshot) has no effect, neither on the request nor on the
+ * committed session log. `dsh-agent-loop`'s `step()` recomputes the context
+ * itself and re-admits it:
+ *
+ *   const sections = renderContextSections(
+ *     this.loopCtx.systemPrompt.refreshContext(assembly, assembleContextFor(this, signal)));
+ *   const context = this.runtimeContext.project(joinContextSections(sections), sections);
+ *   ...
+ *   if (firstAttempt) for (const message of decision.messages)
+ *     if (message.source.kind === 'runtime-context') { ... sets contextAdmitted only ... }
+ *   if (context !== void 0 && !contextAdmitted)
+ *     this.session.append('user/message', context, { surfaceOp: 'append' });   // <-- always
+ *
+ * `decision.messages` is consulted solely to decide *whether* to admit the
+ * freshly projected context — dropping the message from that list only makes
+ * the admission happen on the fallback line, with identical text. Evidence on
+ * this machine: all 9 chatonly sessions that ran the previous version still
+ * carry a `source.kind === 'runtime-context'` user message on the surface.
+ *
+ * Why the preset cannot remove it either
+ * -------------------------------------
+ * `@deepseek-ai/dsh-working-directory` registers its contribution as
+ * `required: true`. Suppression (`systemPrompt.suppressRuntimeContext()`, which
+ * is what the chatonly preset's `includeRuntimeContext: false` does) removes
+ * only optional contributions, and `refreshContext()` keeps every
+ * `required === true` entry regardless.
+ *
+ * The lever that works
+ * --------------------
+ * Register a scoped shadow of that contribution under the SAME name in the
+ * agent's own scope (`agent.ctx`, scope key = the agent — see
+ * `assembleContextFor` in `dsh-agent`: `{ scope: agent }`). Scoped named entries
+ * shadow global ones in both `assemble()` and `refreshContext()`, so the shadow
+ * wins the name:
+ *
+ *   - `required: false` drops it from the suppression-filtered assembly, and
+ *   - `text: ''` renders to nothing, so `renderContextSections()` filters it out,
+ *     `joinContextSections()` yields `''`, and `RuntimeContextProjection.project()`
+ *     returns `undefined` (fresh session) — nothing is appended to the surface
+ *     and nothing reaches the request.
+ *
+ * Registration is owned by the agent scope fiber, so it is disposed with the
+ * agent; one registration per agent is enforced locally because a duplicate
+ * name inside one layer throws.
+ *
+ * Caveat: for a session that already committed a snapshot under an older
+ * version, `RuntimeContextProjection.project()` first emits its one-shot
+ * `Current runtime context: none.` marker (retained -> CLEARED). New chatonly
+ * sessions never see it.
+ *
+ * Tools (switch: `/chattools`, factory default = intercept)
+ * ---------------------------------------------------------
+ * A preset row cannot remove tools: `assemble()` collects every GLOBAL tool
+ * provider unconditionally (`dsh-system-prompt`:364-365) and there is no
+ * `suppressTools()` counterpart to `suppressRuntimeContext()`. With tools
+ * registered by the desktop bundles (acp_*, sidebar_open, working_directory,
+ * search_context, …) a ChatOnly request therefore still carried 10 tool
+ * schemas. The assembly waterfall fixes it: `buildRequest(…, assembly.tools, …)`
+ * emits `{ tools }` only when the list is non-empty (`dsh-agent-loop`:1217-1220),
+ * so clearing `assembly.tools` means the model is offered no tools at all.
+ *
+ * Interception is a live switch, not a build-time config:
+ *   - `~/.dsh/chatonly-strip-tools.state` — one word (`strip` / `pass`), read on
+ *     every assembly and written by `/chattools on|off`. Missing = the factory
+ *     default, `config.stripTools` (true).
+ *   - With the switch OFF the listener returns the downstream assembly verbatim,
+ *     so any other plugin's tool provider or filter behaves exactly as it would
+ *     without this package installed. That is the "let someone else manage it"
+ *     mode — this package never adds tools of its own, it only clears the list.
+ *   - `config.stripTools: false` therefore means "ship turned off", not "toggle
+ *     disabled": `/chattools on` can still turn interception on later.
+ *
+ * @module dsh-chat-preset
+ */
+
+// --- self-diagnostics: one JSON line per install/miss into ~/.dsh-filter-rtc-debug.log ---
+// (temporary; delete dbg() and this block once the filter is verified in the app)
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+const DBG_PATH = `${os.homedir()}/.dsh-filter-rtc-debug.log`;
+function dbg(obj) {
+  // Read lazily: tests import this module (which runs before their own statements)
+  // and set DSH_FILTER_RTC_DEBUG=0 to keep their runs out of the app's log.
+  if (process.env.DSH_FILTER_RTC_DEBUG === '0') return;
+  try {
+    fs.appendFileSync(DBG_PATH, `${JSON.stringify({ t: new Date().toISOString(), ...obj })}\n`);
+  } catch {
+    /* diagnostics must never break the loop */
+  }
+}
+
+export const name = 'chat-preset';
+
+/**
+ * Cordis resolves a service on a context only for fibers that declare it.
+ * Without this the plugin's own `ctx.sessionProjections` throws
+ * `cannot get property "sessionProjections" without inject` — which is exactly
+ * what the first live run produced (evt:"error" in the debug log).
+ */
+export const inject = ['sessionProjections', 'systemPrompt', 'commands'];
+
+const DEFAULT_PRESET_ID = 'chatonly';
+/**
+ * The tool-interception switch. One line of text; absent/empty = factory default
+ * (`config.stripTools`, itself defaulting to true). Read on every assembly, so
+ * `/chattools off` applies to the next message — no restart.
+ */
+const DEFAULT_TOOLS_STATE_FILE = '~/.dsh/chatonly-strip-tools.state';
+/** Accepted spellings in the state file / `/chattools` argument. */
+const SWITCH_ON = new Set(['on', 'strip', 'intercept', 'block', 'true', '1']);
+const SWITCH_OFF = new Set(['off', 'pass', 'allow', 'bypass', 'false', '0']);
+/** The working-directory contribution owned by `dsh-working-directory`. */
+const DEFAULT_CONTEXT_NAME = 'working-directory:current';
+/** Fallback placement = `CONTEXT_ORDERS.WORKING_DIRECTORY` in `dsh-system-prompt`. */
+const DEFAULT_CONTEXT_ORDER = 100;
+/** Where the ChatOnly system prompt lives (role `section`). */
+const DEFAULT_PROMPT_FILE = '~/.dsh/chatonly-system-prompt.md';
+/** Section names owned by `dsh-system-prompt` / `dsh-persona`. */
+const PERSONA_PREFIX_SECTION = 'deployment:persona-prefix';
+const PERSONA_SUFFIX_SECTION = 'deployment:persona-suffix';
+
+function applyPolicy(ctx, config = {}) {
+  const presetId = config.presetId ?? DEFAULT_PRESET_ID;
+  const contextName = config.contextName ?? DEFAULT_CONTEXT_NAME;
+  const toolsStateFile = expandHome(config.toolsStateFile ?? DEFAULT_TOOLS_STATE_FILE);
+  /** Factory default for the switch; the state file (see `/chattools`) overrides it. */
+  const stripToolsDefault = config.stripTools ?? true;
+  /** Agents whose shadow contribution is already installed (per agent, never reused). */
+  const installed = new WeakSet();
+  /** Last observed switch value, so diagnostics fire on flips instead of per step. */
+  let lastStrip;
+
+  const stripToolsNow = () => readSwitch(toolsStateFile, stripToolsDefault);
+
+  dbg({ evt: 'applied', presetId, contextName, stripTools: stripToolsNow(), toolsStateFile, pid: process.pid });
+
+  ctx.on('agent/pre-step', (payload, next) => {
+    const agent = payload?.agent;
+    if (agent === undefined || agent === null) return next();
+
+    // 1) Only the owning preset is touched; every other agent passes through.
+    //    A diagnostic or capability failure must never break the loop, so every
+    //    step below is defensive and the decision is always handed back as-is.
+    try {
+      if (readPresetId(ctx, agent) === presetId) {
+        // 2) Shadow the required contribution before `step()` refreshes it.
+        suppress(agent, contextName, installed);
+      }
+    } catch (error) {
+      dbg({ evt: 'error', message: String(error), sessionId: agent?.session?.id ?? null });
+    }
+
+    // 3) The decision is returned untouched: the snapshot is not a message we
+    //    can filter, it is a projection `step()` recomputes (see header).
+    return next();
+  });
+
+  // --- tools -----------------------------------------------------------------
+  // `assemble()` collects every GLOBAL tool provider unconditionally
+  // (dsh-system-prompt/lib/index.js:365) and a preset's scoped layer can only
+  // add, never remove — so a preset row cannot drop tools. The assembly
+  // waterfall is the one place that can: `buildRequest(..., assembly.tools, ...)`
+  // omits `tools` entirely when the list is empty.
+  //
+  // The listener is ALWAYS registered, even when the switch is off: that is what
+  // makes `/chattools off|on` a live toggle. With the switch off the assembly is
+  // returned verbatim, so every other plugin's tool provider / filter keeps
+  // working exactly as it would without this package.
+  ctx.on('system-prompt/assemble', async (assembly, context, next) => {
+    const out = await next();
+    try {
+      const agent = context?.agent;
+      if (agent === undefined || agent === null) return out;
+      if (readPresetId(ctx, agent) !== presetId) return out;
+
+      const strip = stripToolsNow();
+      if (strip !== lastStrip) {
+        lastStrip = strip;
+        dbg({ evt: 'tools-mode', strip, file: toolsStateFile, sessionId: agent?.session?.id ?? null });
+      }
+      if (!strip) return out; // pass-through: other plugins own the tool list
+
+      const tools = out?.tools;
+      if (!Array.isArray(tools) || tools.length === 0) return out;
+      dbg({
+        evt: 'strip-tools',
+        count: tools.length,
+        names: tools.map((tool) => tool?.name).slice(0, 20),
+        sessionId: agent?.session?.id ?? null,
+      });
+      return { ...out, tools: [] };
+    } catch (error) {
+      dbg({ evt: 'error', stage: 'strip-tools', message: String(error) });
+      return out;
+    }
+  });
+
+  registerToolsCommand(ctx, toolsStateFile, stripToolsDefault);
+  registerCommand(ctx, config.file ?? DEFAULT_PROMPT_FILE);
+}
+
+// --- the tool switch ---------------------------------------------------------
+
+/** Last unrecognized state value already reported, per file. */
+const complained = new Map();
+
+/** The persisted switch, falling back to the factory default. Never throws. */
+function readSwitch(file, fallback) {
+  let raw;
+  try {
+    raw = fs.readFileSync(file, 'utf8').trim().toLowerCase();
+  } catch {
+    return fallback; // missing file = never toggled
+  }
+  if (raw.length === 0) return fallback;
+  if (SWITCH_ON.has(raw)) return true;
+  if (SWITCH_OFF.has(raw)) return false;
+  // Assembled on every request: complain once per distinct bad value, not per turn.
+  if (complained.get(file) !== raw) {
+    complained.set(file, raw);
+    dbg({ evt: 'miss', stage: 'tools-state', reason: `unrecognized "${raw}"`, file });
+  }
+  return fallback;
+}
+
+function describeSwitch(strip, file) {
+  return strip
+    ? `当前：**拦截工具** —— ChatOnly 请求里不带任何工具 schema。\n文件：${file}`
+    : `当前：**放行工具** —— 工具由其他插件/预设决定，本包不干预。\n文件：${file}`;
+}
+
+/**
+ * `/chattools [on | off | status | reset]` — the live switch for tool
+ * interception. Writing the file is enough: the assembly listener re-reads it on
+ * the next request.
+ */
+function registerToolsCommand(ctx, file, fallback) {
+  ctx.effect(() => ctx.commands.register({
+    name: 'chattools',
+    description: '切换 ChatOnly 是否拦截工具（默认拦截；关闭后由其他插件管理工具）',
+    input: { hint: 'on | off | status | reset' },
+    handler: async (invocation) => {
+      const arg = String(invocation?.rawInput ?? '').trim().toLowerCase();
+      if (arg.length === 0 || arg === 'status') {
+        return { kind: 'success', text: `${describeSwitch(readSwitch(file, fallback), file)}\n用法：/chattools on | off | reset` };
+      }
+      if (arg === 'reset') {
+        try {
+          fs.rmSync(file, { force: true });
+          return { kind: 'success', text: `已恢复默认（${fallback ? '拦截' : '放行'}），下一条消息生效。` };
+        } catch (error) {
+          return { kind: 'error', text: `删除失败：${String(error)}` };
+        }
+      }
+      let value;
+      if (SWITCH_ON.has(arg)) value = true;
+      else if (SWITCH_OFF.has(arg)) value = false;
+      else return { kind: 'error', text: `不认识的参数「${arg}」。用法：/chattools on | off | status | reset` };
+
+      try {
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+        fs.writeFileSync(file, value ? 'strip' : 'pass', 'utf8');
+      } catch (error) {
+        return { kind: 'error', text: `写入失败：${String(error)}` };
+      }
+      dbg({ evt: 'tools-toggle', strip: value, file, via: 'command' });
+      return {
+        kind: 'success',
+        text: value
+          ? `已切换为**拦截**：下一条消息起 ChatOnly 不带工具。\n文件：${file}`
+          : `已切换为**放行**：下一条消息起工具由其他插件/预设决定，本包不再清空。\n文件：${file}`,
+      };
+    },
+  }), 'chat-preset.tools-command()');
+}
+
+
+/**
+ * The preset a Session currently runs under, from the `agentPreset` Session
+ * projection (`dsh-agent-preset-registry`): initialized from the creation
+ * header, advanced by the last `agent-preset/selected` event. Falls back to
+ * the header alone when the projection is unavailable.
+ */
+function readPresetId(ctx, agent) {
+  const session = agent?.session;
+  let state;
+  try {
+    // Declared via `inject`, but a resolution failure here must fall back to
+    // the header rather than skip the whole filter (the first live run lost the
+    // preset entirely to a "without inject" throw).
+    state = typeof ctx?.sessionProjections?.stateOf === 'function' && session !== undefined
+      ? ctx.sessionProjections.stateOf(session, 'agentPreset')
+      : undefined;
+  } catch (error) {
+    dbg({ evt: 'error', stage: 'preset-projection', message: String(error), sessionId: session?.id ?? null });
+    state = undefined;
+  }
+  if (typeof state === 'string' && state !== '') return state;
+  const header = session?.header?.agentPreset;
+  return typeof header === 'string' && header !== '' ? header : undefined;
+}
+
+/**
+ * Install the empty, non-required shadow of `contextName` in the agent's own
+ * scope. Never registers through the plugin's own context: that layer is
+ * global and would strip the contribution for every preset.
+ *
+ * The registration runs inside a tiny plugin MOUNTED INTO the agent scope, so
+ * (a) `systemPrompt` resolves there (its fiber declares the dependency — the
+ * agent scope fiber does not, so a bare `agent.ctx.systemPrompt` lookup fails
+ * with "without inject"), and (b) the registration is owned by that fiber, so
+ * it disappears with the agent.
+ */
+function suppress(agent, contextName, installed) {
+  if (installed.has(agent)) return;
+  const scopeCtx = agent?.ctx;
+  const sessionId = agent?.session?.id ?? null;
+  const register = (c) => {
+    c.systemPrompt.context({
+      name: contextName,
+      order: typeof c.systemPrompt.getContextOrder === 'function'
+        ? (c.systemPrompt.getContextOrder('WORKING_DIRECTORY') ?? DEFAULT_CONTEXT_ORDER)
+        : DEFAULT_CONTEXT_ORDER,
+      required: false,
+      interpolate: false,
+      text: '',
+    });
+    dbg({ evt: 'suppress', contextName, sessionId, agentId: agent?.id ?? null, via: 'agent-scope-plugin' });
+  };
+
+  if (typeof scopeCtx?.plugin === 'function') {
+    scopeCtx.plugin({
+      name: 'chat-preset:context-shadow',
+      inject: ['systemPrompt'],
+      apply(c) {
+        try {
+          register(c);
+        } catch (error) {
+          dbg({ evt: 'error', stage: 'register', message: String(error), sessionId });
+        }
+      },
+    });
+    installed.add(agent);
+    return;
+  }
+
+  // Fallback for a scope object that is not a Cordis context.
+  const prompt = scopeCtx?.systemPrompt;
+  if (typeof prompt?.context !== 'function') {
+    dbg({ evt: 'miss', reason: 'agent.ctx has neither plugin() nor systemPrompt', sessionId });
+    return;
+  }
+  try {
+    register({ systemPrompt: prompt });
+    installed.add(agent);
+  } catch (error) {
+    dbg({ evt: 'error', stage: 'register-fallback', message: String(error), sessionId });
+  }
+}
+
+// --- /chatprompt -------------------------------------------------------------
+// The composer-side editor for the system prompt above. Registered from the
+// GLOBAL mount only: `commands.register()` scopes by the calling context, so a
+// per-agent registration would collide as soon as a second ChatOnly agent exists.
+
+/** `/chatprompt [text | show | clear]` */
+function registerCommand(ctx, file) {
+  const target = expandHome(file);
+  ctx.effect(() => ctx.commands.register({
+    name: 'chatprompt',
+    description: '查看/设置 ChatOnly 的系统提示词（写入文件，下一条消息生效）',
+    input: { hint: '文本 | show | clear' },
+    handler: async (invocation) => {
+      const raw = String(invocation?.rawInput ?? '');
+      const arg = raw.trim();
+      if (arg.length === 0) {
+        const text = readPrompt(target);
+        return {
+          kind: 'success',
+          text: text.length === 0
+            ? `当前系统提示词为空。\n文件：${target}\n用法：/chatprompt 你是一个……`
+            : `当前系统提示词（${text.length} 字）：\n${preview(text)}\n\n文件：${target}`,
+        };
+      }
+      if (arg === 'show') {
+        const text = readPrompt(target);
+        return { kind: 'success', text: text.length === 0 ? '(空)' : `${text}\n\n— 文件：${target}` };
+      }
+      if (arg === 'clear') {
+        try {
+          fs.mkdirSync(path.dirname(target), { recursive: true });
+          fs.writeFileSync(target, '', 'utf8');
+          return { kind: 'success', text: `已清空，下一条消息起不再发送系统提示词。\n文件：${target}` };
+        } catch (error) {
+          return { kind: 'error', text: `写入失败：${String(error)}` };
+        }
+      }
+      try {
+        fs.mkdirSync(path.dirname(target), { recursive: true });
+        const body = raw.trim();
+        fs.writeFileSync(target, body, 'utf8');
+        return { kind: 'success', text: `已保存（${body.length} 字），下一条消息生效。\n文件：${target}` };
+      } catch (error) {
+        return { kind: 'error', text: `写入失败：${String(error)}` };
+      }
+    },
+  }), 'chat-preset.command()');
+}
+
+// --- role: 'section' -------------------------------------------------------------
+// Mounted INSIDE the preset (see the `plugins` list in cordis.patch.yml), where it
+// shadows the deployment persona by section name. `text` is a FUNCTION, so
+// `SystemPrompt.assemble()` re-reads the file on every assembly
+// (`dsh-system-prompt/lib/index.js:388`) — edit the file and the next message uses
+// it, no restart.
+//
+// The persona row must NOT be mounted next to this one: two registrations of one
+// section name inside one scope throw.
+
+/** Cordis rejects two `complete` sections, so this role owns the slot alone. */
+function applySection(ctx, config = {}) {
+  const file = expandHome(config.file ?? DEFAULT_PROMPT_FILE);
+  const prompt = ctx.systemPrompt;
+  ctx.effect(() => prompt.section({
+    name: PERSONA_PREFIX_SECTION,
+    order: prompt.getSectionOrder('DEPLOYMENT_PERSONA_PREFIX'),
+    complete: true,
+    text: () => readPrompt(file),
+  }), 'chat-preset.section()');
+  ctx.effect(() => prompt.section({
+    name: PERSONA_SUFFIX_SECTION,
+    order: prompt.getSectionOrder('DEPLOYMENT_PERSONA_SUFFIX'),
+    text: '',
+  }), 'chat-preset.suffix()');
+  // What the persona row's `includeRuntimeContext: false` used to do.
+  ctx.effect(() => prompt.suppressRuntimeContext(), 'chat-preset.suppress()');
+  dbg({ evt: 'prompt-section', file, length: readPrompt(file).length, pid: process.pid });
+}
+
+/** The current prompt; a missing or unreadable file means "no system prompt". */
+function readPrompt(file) {
+  try {
+    return fs.readFileSync(file, 'utf8').trim();
+  } catch {
+    return '';
+  }
+}
+
+function preview(text) {
+  return text.length <= 400 ? text : `${text.slice(0, 400)}\n…（共 ${text.length} 字，用 /chatprompt show 查看全文）`;
+}
+
+function expandHome(file) {
+  if (file === '~') return os.homedir();
+  if (file.startsWith('~/') || file.startsWith('\\')) return path.join(os.homedir(), file.slice(2));
+  return file;
+}
+
+/**
+ * `policy` (default, mounted globally): keeps the runtime context and the global
+ * tool schemas out of ChatOnly requests, and owns the `/chatprompt` command.
+ * `section`: the system-prompt slot, mounted inside the preset.
+ */
+export function apply(ctx, config = {}) {
+  if ((config.role ?? 'policy') === 'section') applySection(ctx, config);
+  else applyPolicy(ctx, config);
+}

package/package.json

@@ -1,6 +1,23 @@
 {
   "name": "dsh-chat-preset",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "1.2.0",
+  "private": false,
+  "description": "DSH 的纯净对话预设 ChatOnly：拦截工具注入与工作区上下文，模型只收到你输入的内容；/chatprompt 设定系统提示词，/chattools 可关闭工具拦截。",
+  "keywords": ["dsh", "dsh-plugin", "deepseek-harness", "cordis", "agent-preset", "chatonly", "system-prompt", "runtime-context", "tools", "toggle"],
+  "license": "MIT",
+  "engines": { "node": ">=18" },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Xxx-Bin/dsh-chat-preset.git"
+  },
+  "homepage": "https://github.com/Xxx-Bin/dsh-chat-preset#readme",
+  "bugs": "https://github.com/Xxx-Bin/dsh-chat-preset/issues",
+  "type": "module",
+  "main": "index.js",
+  "files": ["index.js", "cordis.patch.yml"],
+  "dsh": { "bundle": { "patch": "./cordis.patch.yml" } }
+}