dsh-js-reverse-plugin 0.1.0 → 0.2.0

package/index.js

@@ -1,9 +1,12 @@
 // dsh-js-reverse-plugin — one DeepSeek Harness bundle that mounts the
 // js-reverse skills (AST deobfuscation / iv8 / JSVMP) as runtime skills.
-// The js-reverse-mcp server is mounted by the cordis.patch.yml layer, so a
-// single `dsh plugin add` installs skills + MCP tools together.
-import { readdirSync, readFileSync, statSync } from 'node:fs'
-import { join } from 'node:path'
+// The js-reverse-mcp server is mounted by the cordis.patch.yml layer, and the
+// bundled `preset/` directory is installed into the harness home as the
+// `reverse` agent preset, so a single `dsh plugin add` installs skills + MCP
+// tools + the reverse agent mode together.
+import { copyFileSync, mkdirSync, readdirSync, readFileSync, statSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { dirname, join } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { parse } from 'yaml'
 
@@ -13,6 +16,33 @@ export const name = 'js-reverse-plugin'
 export const inject = ['skills']
 
 const SKILLS_DIR = fileURLToPath(new URL('./skills/', import.meta.url))
+const PRESET_DIR = fileURLToPath(new URL('./preset/', import.meta.url))
+
+/** Preset id the bundled composition installs under. */
+export const PRESET_ID = 'reverse'
+
+/**
+ * The user agent-presets root. Honors DSH_HOME; falls back to `~/.dsh`.
+ * @returns the `.agent-presets` directory under the harness home.
+ */
+export function presetUserRoot() {
+  return join(process.env.DSH_HOME ?? join(homedir(), '.dsh'), '.agent-presets')
+}
+
+/**
+ * Install the bundled preset into the user preset root. Idempotent: an
+ * existing composition file is never overwritten, so a user's edits survive
+ * reinstalls. Discovered immediately by `dsh-agent-presets` (unmemoized roots).
+ * @param destDir - the target `<name>` preset directory, derived from {@link PRESET_ID}.
+ */
+export function installPreset(destDir) {
+  mkdirSync(destDir, { recursive: true })
+  for (const file of readdirSync(PRESET_DIR)) {
+    const dest = join(destDir, file)
+    if (statSync(dest, { throwIfNoEntry: false })?.isFile()) continue
+    copyFileSync(join(PRESET_DIR, file), dest)
+  }
+}
 
 /**
  * Split one SKILL.md into its YAML frontmatter and the markdown body.
@@ -53,9 +83,17 @@ export function collectSkills() {
   return registrations
 }
 
-/** Register every bundled skill; each registration is a disposable effect. */
+/** Register every bundled skill and install the bundled preset. */
 export function apply(ctx) {
   for (const skill of collectSkills()) {
     ctx.skills.register(skill)
   }
+  try {
+    installPreset(join(presetUserRoot(), PRESET_ID))
+  } catch (error) {
+    // Preset installation is additive and idempotent; skills and MCP remain
+    // usable when the user preset root is not writable, so this fails soft
+    // with a diagnostic instead of taking the whole bundle down.
+    ctx.logger.warn(`[${name}] could not install the "${PRESET_ID}" agent preset: ${String(error)}`)
+  }
 }

package/package.json

@@ -1,13 +1,14 @@
 {
   "name": "dsh-js-reverse-plugin",
-  "version": "0.1.0",
-  "description": "JavaScript reverse-engineering bundle for DeepSeek Harness: AST deobfuscation / iv8 / JSVMP skills plus the js-reverse-mcp server tools.",
+  "version": "0.2.0",
+  "description": "JavaScript reverse-engineering bundle for DeepSeek Harness: AST deobfuscation / iv8 / JSVMP skills, the js-reverse-mcp server tools, and the reverse agent preset.",
   "type": "module",
   "main": "index.js",
   "files": [
     "index.js",
     "cordis.patch.yml",
-    "skills"
+    "skills",
+    "preset"
   ],
   "dependencies": {
     "yaml": "^2.4.0"

package/preset/agent.cordis.yml

@@ -0,0 +1,263 @@
+# The `reverse` agent preset: a JS reverse-engineering agent. A copy of
+# `standard` whose persona states the reverse-engineering work rules —
+# evidence-driven, stepwise user decisions, iv8 as the only controlled
+# runtime, equivalence acceptance. The capability set is unchanged.
+#
+# This file is an AGENT-PLANE composition. The roster mounts it ONCE under a
+# standing scope; every session naming it joins by scope parentage, so the
+# tools and prompt sections registered here cover each joined agent while a
+# session's own state stays keyed per Session/Agent inside the plugins. The
+# host composition (`base.cordis.yml` + `web.cordis.yml`) keeps everything a
+# preset must not own: the registries themselves, the sandbox and approval
+# stack, persistence, and the model route.
+#
+# A service row here MUST sit inside a group carrying an `isolate` realm.
+# Without one it publishes into the root realm, where it is process-global —
+# another preset publishing the same name collides, and a host reader would
+# resolve one preset's instance for every session; `dsh-agent-presets` rejects
+# that at mount. `true` means an entry-local realm: this standing mount's own
+# private instance, apart from every other preset's. (A shared label does NOT
+# pool instances — `provide()` throws on the second registration under the
+# same realm symbol; labels join REALMS, and are not what this file needs.)
+
+# ── identity ────────────────────────────────────────────────────────────────
+
+# The preset's own persona, shadowing the deployment default for this agent.
+# `{{model}}` and `{{cwd}}` resolve from the agent's own route and workspace.
+- id: persona
+  name: '@deepseek-ai/dsh-persona'
+  config:
+    text: >-
+      You are a JS reverse-engineering agent powered by the {{model}} model. Your working directory is {{cwd}}.
+
+      工作准则：
+      - 证据驱动：每个结论必须可溯源——静态证据（源码、字节码、AST）或动态证据（受控执行、浏览器观测）。区分"事实"与"推断"，不无证猜测。
+      - 逐步决策：关键选择先说明依据与代价，等用户决定——解混淆路线、是否补环境、静态还是动态、继续还是交接。
+      - 保护原始输入：目标文件一律只读；分析前先做格式化派生副本，一切修改只落在副本。
+      - 解混淆服务于分析：产出是方便阅读、搜索、定位、动态观测的派生视图；不以"清理干净"或还原作者原名、原始工程为目标。
+      - 受控执行：动态证据通过 iv8（C++ V8 + 浏览器环境）或 js-reverse MCP 取得；Node.js 仅作静态工程工具。
+      - 等价验收：恢复的算法、签名、映射以与原始实现精确等价为验收标准；"服务器恰好接受"不是证明。
+      - 长线任务用 todo 和 goal 跟踪；多路独立分析（静态/动态/资料）可用 subagent 并行；关键证据和推导过程记录在案，保持可审计。
+
+- id: agent-instructions
+  name: '@deepseek-ai/dsh-agent-instructions'
+  config:
+    maxBytes: 65536
+
+# ── shell ───────────────────────────────────────────────────────────────────
+
+# `shell-env` stays in the HOST composition: `apps/cli/src/web.ts` injects it to
+# publish `DSH_WEB_URL`/`DSH_WEB_MODE`, and a host row that injects a service is
+# the criterion for host-plane ownership — injection resolves before any session
+# exists, so there is no agent to key by. Behind a preset realm those variables
+# never reached the model's shell at all. Both shell tools consume the host
+# registry from here; their executors (`bash-sandbox`/`pwsh-sandbox`) are
+# host-plane too.
+- id: tool-bash
+  name: '@deepseek-ai/dsh-tool-bash'
+  disabled: !!js process.platform === 'win32'
+
+- id: tool-pwsh
+  name: '@deepseek-ai/dsh-tool-pwsh'
+  disabled: !!js process.platform !== 'win32'
+
+# ── filesystem ──────────────────────────────────────────────────────────────
+
+# Both register into the host `tools` registry and provide nothing, so
+# they need no realm. The `fs` service and its policy stay in the host.
+- id: tool-fs
+  name: '@deepseek-ai/dsh-tool-fs'
+
+- id: tool-fs-search
+  name: '@deepseek-ai/dsh-tool-fs-search'
+  config:
+    sampleOverCapGlobResults: false
+
+# ── background jobs ────────────────────────────────────────────────────────
+
+# Only the model-facing controls. The task REGISTRY stays on the host plane:
+# its producers sit outside any realm this file could put it in — `tool-bash`
+# above resolves it with `ctx.get`, and an entry-local realm here is invisible
+# to every sibling row, so `run_in_background` would answer "background jobs
+# unavailable" while these controls sat in the catalog. The registry is keyed by
+# owning agent anyway, so one host instance serves every session. What a preset
+# chooses is whether its agent can collect and stop background work at all.
+- id: tool-jobs
+  name: '@deepseek-ai/dsh-tool-jobs'
+
+# ── skills ──────────────────────────────────────────────────────────────────
+
+# The skill REGISTRY lives in the host composition and is layered per scope:
+# these rows register into THIS preset's layer of it, so they need no realm.
+# `skill-filesystem` contributes local-root discovery for agents on this preset, and
+# `tool-skill` gives them the catalog and loader; the merged catalog also
+# carries whatever the deployment registered globally (repository plugins).
+- id: skill-filesystem
+  name: '@deepseek-ai/dsh-skill-filesystem'
+
+- id: tool-skill
+  name: '@deepseek-ai/dsh-tool-skill'
+
+# ── goals ───────────────────────────────────────────────────────────────────
+
+# Only the model-facing tool. The goal SERVICE, its session driver, and the
+# `/goal` command stay on the host plane: the Gateway serves the goal domain as
+# Remote endpoints whose receiver comes from a generated descriptor, so it
+# resolves `goals` on the host and an entry-local realm here would hide it. The
+# registry is keyed by session anyway, so one host instance serves every
+# session. What a preset chooses is whether its agent can call the goal tool.
+- id: tool-goal
+  name: '@deepseek-ai/dsh-tool-goal'
+
+# ── plan mode ───────────────────────────────────────────────────────────────
+
+# Plan state is per-agent by nature, so an entry-local realm is not a
+# workaround here — it is the correct lifetime.
+- id: planning
+  name: cordis:group
+  group: true
+  isolate:
+    planMode: true
+  config:
+    - id: plan-mode
+      name: '@deepseek-ai/dsh-plan-mode'
+      config:
+        section: |
+              You are in plan mode. Stay in plan mode until exit_plan_mode succeeds or the user switches the session mode. Imperative language to implement changes means plan the implementation, not execute it. A user's conversational agreement — including an answer confirming something you asked — approves nothing and does not end plan mode; fold the confirmed decision into the plan and submit it through exit_plan_mode.
+
+              Explore first. Use non-mutating reads, searches, static analysis, and checks to ground the plan in the actual repository. Do not edit or write files, change configuration, run formatters or code generation that rewrites tracked files, commit, or otherwise carry out the plan. Prefer existing functions and patterns over new machinery.
+
+              The tool catalog stays the same across modes for request-cache stability. These plan-mode rules override any later tool description or guidance that suggests using mutation tools; those tools remain listed to keep the tool catalog unchanged. Do not use todo_write to track this planning phase: it tracks implementation after an approved plan, while the plan itself belongs in exit_plan_mode.
+
+              Resolve discoverable facts by inspection. Use ask_user_question only for user-owned choices or material ambiguity that inspection cannot answer. Do not ask the user where code lives or how current behavior works when you can find out.
+
+              Make the plan decision-complete: state the goal and success criteria; group implementation changes by subsystem; identify public API, schema, and data-flow changes; cover edge cases, failure modes, tests, acceptance criteria, and explicit assumptions. Keep it concise enough to review but detailed enough that another engineer can implement it without making design decisions.
+
+              When ready, call exit_plan_mode with the complete plan markdown, starting with a # title. Make exit_plan_mode the only and final tool call in that assistant response: it presents the plan for approval, and implementation begins only in a later step after approval. Do not paste the final plan as a plain reply or ask "should I proceed?" through prose or ask_user_question. If review rejects it, incorporate the feedback and present again. If the review channel is unavailable or aborted, stay in plan mode and ask the user to switch modes manually; do not proceed with implementation.
+
+# ── compaction ──────────────────────────────────────────────────────────────
+
+# `compaction-basic` reads `toolResultPrune` through `ctx.get`, so the pruner must
+# share this realm rather than sit outside it.
+#
+# `tokenMeter` is deliberately NOT in this realm: the meter stays on the HOST
+# plane, and the rows here resolve that one instance. It takes no configuration,
+# keys every fold by Session, and owns the context-meter projection units the
+# browser reads for every session — behind a realm those units would come and go
+# with whichever presets happen to be mounted. What a preset chooses is whether
+# its agent compacts at all, which is `compaction-basic` below.
+- id: compaction
+  name: cordis:group
+  group: true
+  isolate:
+    compaction: true
+    toolResultPruner: true
+  config:
+    - id: compaction-basic
+      name: '@deepseek-ai/dsh-compaction-basic'
+
+    - id: command-compact
+      name: '@deepseek-ai/dsh-command-compact'
+
+    - id: tool-result-pruner
+      name: '@deepseek-ai/dsh-compaction-tool-result-pruner'
+      config:
+        thresholdChars: 8192
+        headChars: 4096
+        tailChars: 1024
+
+# ── delegation and workflows ────────────────────────────────────────────────
+
+# The `subagents` registry and its spawn/fork backends live in the HOST
+# composition: the registry is a process singleton whose cross-session queries
+# the api-proxy serves to the browser, and a provider name may only be
+# registered once. This preset contributes the delegation TOOLS, which resolve
+# that host registry.
+#
+# `workflows` is different — nothing outside an agent reads it — so every row
+# that reaches it shares one entry-local realm here, and a consumer left
+# outside would resolve a host registry this preset does not populate.
+#
+# `tool-subagent-report` is host-plane for the same reason as the registry,
+# not because a preset may not want it: it registers a CONTINUABLE SETUP on
+# that singleton rather than a tool this agent calls, and the setup list is
+# not scope-aware — one copy per mounted preset means every child gets
+# `report` registered once per live session, which throws on the second.
+- id: delegation
+  name: cordis:group
+  group: true
+  isolate:
+    workflowEngine: true
+  config:
+    - id: tool-subagent-control
+      name: '@deepseek-ai/dsh-tool-subagent-control'
+
+    - id: tool-subagent-list-agents
+      name: '@deepseek-ai/dsh-tool-subagent-control/list-agents'
+
+    - id: tool-subagent
+      name: '@deepseek-ai/dsh-tool-subagent'
+      config:
+        provider: spawn
+        toolName: subagent
+        backgroundMode: continuable
+
+    - id: tool-subagent-fork
+      name: '@deepseek-ai/dsh-tool-subagent'
+      config:
+        provider: fork
+        toolName: subagent_fork
+        backgroundMode: continuable
+
+    # Product providers are host-plane singletons. Copy this preset, then
+    # remove `disabled` from either ordinary tool row to expose that product
+    # only to agents composed from the copy.
+    - id: tool-subagent-codex
+      name: '@deepseek-ai/dsh-tool-subagent'
+      disabled: true
+      config:
+        provider: codex
+        toolName: subagent_codex
+        enableRunInBackground: false
+        maxDepth: provider-managed
+
+    - id: tool-subagent-claude-code
+      name: '@deepseek-ai/dsh-tool-subagent'
+      disabled: true
+      config:
+        provider: claude-code
+        toolName: subagent_claude_code
+        enableRunInBackground: false
+        maxDepth: provider-managed
+
+    - id: workflow-worker-thread
+      name: '@deepseek-ai/dsh-workflow-worker-thread'
+      config:
+        provider: spawn
+
+    - id: tool-workflow
+      name: '@deepseek-ai/dsh-tool-workflow'
+
+    - id: tool-ralph
+      name: '@deepseek-ai/dsh-tool-ralph'
+      config:
+        subagentProvider: spawn
+        maxRounds: 64
+
+# ── remaining model-facing rows ─────────────────────────────────────────────
+
+- id: tool-ask-user
+  name: '@deepseek-ai/dsh-tool-ask-user'
+
+- id: tool-todo
+  name: '@deepseek-ai/dsh-tool-todo'
+  config:
+    allowParallelInProgress: true
+
+# The `web` service and its search provider stay in the host composition; only
+# the model-facing tool is per-session.
+- id: tool-web
+  name: '@deepseek-ai/dsh-tool-web'
+  config:
+    fetch: false
+    searchTimeoutMs: 60000

package/preset/preset.yml

@@ -0,0 +1,3 @@
+name: 逆向模式
+description: JS 逆向工程 Agent：证据驱动、逐步决策，配备 iv8 受控执行与 js-reverse 浏览器取证。
+order: 2