dsh-keyword-injector 0.2.0-beta.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Mark Elayan
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,163 @@
+# dsh-keyword-injector
+
+Keyword-triggered **context injection** for the [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) (DSH).
+
+Define keywords once; the plugin watches a session and, when a trigger fires, injects your payload into the conversation as a **Context injection** message — the same delivery surface memos-local-memory uses. The reminder renders in the Web GUI as a collapsed `Context injection · dsh-keyword-injector` row and reaches the model with its next request. The agent's flow is never interrupted: no turns are started, nothing is steered, no extra model calls are made for the delivery itself.
+
+```
+user:  "please deploy to staging now"
+       └─ Context injection · dsh-keyword-injector   ← collapsed row, model sees it too
+          [KEYWORD-INJECTOR REMINDER] …rules you configured… [END KEYWORD-INJECTOR REMINDER]
+agent: (answers with your rules applied)
+```
+
+## Why two trigger sources
+
+Most injectors only watch user input. Real prompts often don't contain the word that matters — **the agent's own reasoning does**:
+
+> User: *"resolve the issue"* → agent thinks *"I need to triage this first"* → **`triage` rules arrive on their own.*
+
+| Source | Watches | Fires when |
+|---|---|---|
+| **`user`** (default) | What the user types | The triggering message lands in the session inbox — the reminder joins that message's step (reminder first, one model request) |
+| **`agent`** | The agent's **own reasoning and actions** (assistant messages incl. thinking, tool calls + arguments, tool results) | The agent's step boundary — e.g. it *thinks* "I need to triage this" mid-task and the rules are injected for its **next step of the same turn** |
+
+The matcher enforces source isolation (user triggers never fire on agent text and vice versa), and agent-source triggers fire **once per turn per trigger** — the agent echoing the keyword after reading the rules never re-triggers.
+
+## Real use cases
+
+1. **Standing rules on demand** — trigger `Follow the rules` (user source,
+   static-text) injects your personal operating law: keep the session to-do
+   list updated, use SEQUENTIAL THINKING for long problems, escalate to the
+   advisor when stuck, never work around broken system tools, clean up
+   leftover scripts. Three words typed; the full rulebook arrives as context.
+2. **Skill steering** — trigger `context manager` (user source, steer-skill)
+   injects "load the `context-manager` skill" — the agent picks up the whole
+   methodology without pasted instructions.
+3. **Triage rules the agent asks for itself** — the agent-source example
+   above: user says "resolve the issue", the agent's *own reasoning* matches
+   `triage`, rules arrive at its next step.
+4. **Deploy guardrail** — trigger `deploy to staging` rides a smoke-test
+   reminder along with every matching request, in every session.
+
+## Trigger model
+
+| Field | Values | Notes |
+|---|---|---|
+| keyword | any text (≤ 200 chars) | what to match |
+| matchType | `exact` / `contains` / `regex` | regex validated at save time; ReDoS-shaped patterns (e.g. `(a+)+`) rejected up front; runtime matcher has a sample cap + budget as a second guard; case-sensitivity toggle |
+| mode | `static-text` / `steer-skill` | inject a verbatim payload, or an instruction to load a named skill (validated against the live skills catalog at save time) |
+| source | `user` / `agent` | see above |
+| scope | `all-sessions` / `this-session` | `this-session` only settable from inside a session |
+| enabled | on/off | toggle straight from the table |
+
+Payloads are wrapped in fixed `[KEYWORD-INJECTOR REMINDER] … [END KEYWORD-INJECTOR REMINDER]` delimiters and sanitised (invisible control bytes stripped), so user-supplied payload text can never pose as system instructions — the model always sees it as data inside a marked block.
+
+## UI
+
+Two surfaces, same manager:
+
+1. **Sidebar → Keywords** — a main panel alongside Task Board / SSH / Skill Center.
+2. **Settings → Keyword Injector**.
+
+Both provide: trigger table (enabled toggle, keyword, match type, mode, source, payload preview, scope, edit/delete), filter box, and an edit modal with a **live test** panel — a host-side dry run using the *exact* runtime matcher, so the panel is always honest about what will fire.
+
+## Agent tools
+
+The model can manage triggers itself (useful for self-configuring agents):
+
+- `keyword_injector_list_triggers`
+- `keyword_injector_create_trigger` (skill targets validated)
+- `keyword_injector_update_trigger`
+- `keyword_injector_delete_trigger`
+- `keyword_injector_test_trigger`
+
+## Install
+
+The plugin is a normal DSH bundle. From the web profile:
+
+```sh
+dsh plugin --profile web add github:markelayan/dsh-keyword-injector
+```
+
+or with pnpm directly:
+
+```sh
+cd ~/.dsh/profiles/web
+pnpm add github:markelayan/dsh-keyword-injector
+# then add "dsh-keyword-injector" to dsh.profile.bundles in package.json
+```
+
+Local-development (`link:`) installs: clone anywhere, run `npm install` (pulls
+`schemastery`), then `dsh plugin --profile web add link:<path>`. Note for
+`link:` users: DSH resolves a plugin's imports from its **realpath**, so the
+cloned copy needs its own `node_modules` (the `npm install` above provides it).
+
+Restart `dsh web` and hard-refresh the browser after installing.
+
+Requires a DSH core from the 0.1.1-rc line (tested on 0.1.1-rc.2).
+
+## Architecture
+
+```
+lib/
+├── index.js            host half — events, persistence, HTTP routes, agent tools
+├── client.js           client half SOURCE (sidebar entry, panel, settings page)
+├── client.bundled.js   SHIPPED client — esbuild bundle in ModuleLoader format
+├── schema.js           trigger validation (all trust boundaries)
+├── matcher.js          runtime matching (regex cache, budgets)
+└── reminder.js         reminder text formatting + sanitisation
+```
+
+- **Persistence**: settings namespace `dsh-keyword-injector` (ends up in
+  `~/.dsh/settings.yaml`), registered on boot with a permissive schemastery
+  schema; every read passes strict `validateDocument`, so a corrupted store
+  degrades to an empty trigger list — never a crash.
+- **Client ↔ host**: bundle clients have no `host.call` bridge, so the UI
+  talks to plain HTTP routes on the host:
+  `POST /api/dsh-keyword-injector/{list,create,update,delete,test,skills}`.
+- **Delivery**: reminders are durable, plugin-sourced `user/message` events
+  inserted through the agent inbox (`agent.inject()` → next-step queue), so
+  they are claimed together with the triggering message — reminder first —
+  and render as Context injection rows. The inbox claims exactly one
+  next-turn message per turn, so the plugin never prepends to that queue
+  (that would strand user messages).
+- **Events used**: `agent/inbox/inserted` (user source) and
+  `agent/pre-step` (agent-source scanner).
+
+### Rebuilding the client
+
+The browser loader requires a single self-contained
+`window.__ModuleLoader__.load` file, so the client ships **bundled**. After
+editing `lib/client.js`:
+
+```sh
+npm install                      # once
+npx esbuild lib/client.js --bundle --format=cjs \
+  --external:react --external:react-dom --external:react-dom/client \
+  --outfile=/tmp/kwi.cjs
+# re-wrap with the ModuleLoader factory — see the exact steps in the header
+# comment of lib/client.bundled.js
+```
+
+Then restart `dsh web` and hard-refresh.
+
+## Security & privacy
+
+- **No network calls.** The client fetches same-origin DSH routes only; the
+  host touches local files (the DSH settings store) and in-process APIs.
+  No telemetry, no analytics, no outbound requests, ever.
+- **No secrets.** The plugin stores no credentials and reads none.
+- **Injection-hardened.** Reminder payloads are fenced in constant
+  delimiters, sanitised, and length-capped; the keyword itself is sanitised
+  before embedding. The model is told, in-band, that the block is configured
+  by the user — not instructions from the payload author.
+- **ReDoS guards.** Regex triggers are shape-checked at save time and
+  sample-capped + budgeted at match time.
+- **Self-matching impossible.** The scanner reads only genuine user input or
+  assistant/tool events — never the plugin's own injections — and fires at
+  most once per message (user source) or per turn (agent source).
+
+## Changelog
+
+See [CHANGELOG.md](./CHANGELOG.md). MIT license — see [LICENSE](./LICENSE).

package/cordis.patch.yml

@@ -0,0 +1,12 @@
+# cordis.patch.yml — bundle composition patch for dsh-keyword-injector.
+#
+# Self-mounts the plugin row into the web profile roster. Applied as a profile
+# bundle layer (the `dsh.bundle.patch` manifest field in package.json) — the
+# same mechanism dsh-drawio-links uses. MUST stay a top-level YAML array with
+# an ACTIVE `- insert:` entry: an all-commented file parses to null and crashes
+# boot ("must be a top-level YAML array of loader patch entries").
+# NOTE: the profile-level cordis.patch.yml must NOT also insert this row —
+# that would double-mount the plugin.
+- insert:
+    - id: dsh-keyword-injector
+      name: dsh-keyword-injector