dsh-paoding 0.2.0

package/plugins/paoding-config-ui/package.json

@@ -0,0 +1,23 @@
+{
+  "name": "paoding-config-ui",
+  "version": "0.2.0",
+  "private": true,
+  "type": "module",
+  "main": "index.mjs",
+  "description": "庖丁 (dsh-paoding) 可视化配置器 — DSH Web 设置页集成插件（settings.section 分区 + /api/paoding 路由）",
+  "dsh": {
+    "client": {
+      "platform": "web",
+      "inject": [
+        "@deepseek-ai/dsh-client-runtime",
+        "@deepseek-ai/dsh-client-ui-settings",
+        "@deepseek-ai/dsh-client-connection"
+      ]
+    }
+  },
+  "exports": {
+    ".": "./index.mjs",
+    "./client": "./lib/client.js",
+    "./package.json": "./package.json"
+  }
+}

package/plugins/paoding-config-ui/runtime-inventory.mjs

@@ -0,0 +1,212 @@
+/**
+ * 运行时事实采集 —— DSH Web 插件 (plugins/paoding-config-ui)
+ *
+ * “运行时优先”的通用插件/工具检测基础：在 Web 运行时内直接读取 DSH
+ * 宿主自带的实时注册表，识别任何以 bundle/插件形态加载且启用的插件
+ * （@hyzyn/dsh-codegraph、dsh-mnemon、magic-memory 等），不再依赖
+ * cordis.patch.yml 条目 + 硬编码白名单。已有文件扫描路径保持原样，作为
+ * CLI / 无运行时场景的兜底，二者按需叠加。
+ *
+ * 数据来源（均已查实）：
+ *   - dsh-host-plugin-inventory：ctx.pluginInventory.list() 返回
+ *     { entries: [{ entryId, moduleName, enabled, fiberPhase }] }，
+ *     entries 为 Loader 中全部非 group 条目（含未启用的，enabled 由
+ *     loader disabled 推导；fiberPhase：active=正在运行，null=无 fiber，
+ *     另有 pending/loading/failed/unloading）。
+ *   - dsh-tools：名为 'tools' 的 cordis Service（ctx.tools /
+ *     ctx.get('tools')），公开方法 register/get/restrict/guard/schemas；
+ *     MCP 工具由 dsh-mcp-client 以 `mcp__<server>__<tool>` 公开名注册，
+ *     故 schemas()/entries() 等能枚举出形如 mcp__tavily__tavily_search 的
+ *     全名，与 tools/install.mjs 的 inventory 命名约定一致。
+ *
+ * 约定：本模块只负责“取数”，任何一步失败都不抛出——错误记入 error 字符串
+ * （多条用 '; ' 连接、整体截断），返回可用的部分结果；列表带截断上限防爆。
+ * 服务端只透传插件条目的原始字段（enabled/fiberPhase 原样保留），仅剔除
+ * 显然未启用/未运行（enabled===false 或 fiberPhase 非 'active'）的条目，
+ * 其余判断留给 UI。
+ */
+
+const MAX_PLUGIN_ENTRIES = 200
+const MAX_TOOL_NAMES = 2000
+const MAX_ERROR_LEN = 500
+
+/** 把名字记入结果（字符串校验、去重、截断都在这里做）。 */
+function pushName(name, out, seen) {
+  if (typeof name !== 'string' || name === '') return
+  if (seen.has(name) || out.length >= MAX_TOOL_NAMES) return
+  seen.add(name)
+  out.push(name)
+}
+
+/** 归一化 [key, value] 工具对：优先取 value 对象自带的 name，否则取 key。 */
+function pushPair(key, def, out, seen) {
+  if (def && typeof def === 'object' && typeof def.name === 'string') pushName(def.name, out, seen)
+  else pushName(key, out, seen)
+}
+
+/**
+ * 把一次枚举调用返回的结果收集成字符串工具名数组。
+ * 兼容 Map / 任意迭代器 / 数组三种形态，元素可为字符串、[name, def] 对
+ * 或带 name 字段的对象（如 schemas() 返回的 { name, description, ... }）。
+ */
+function collectToolNames(value, out, seen) {
+  if (value == null) return
+  if (typeof value !== 'object' && typeof value !== 'string') return
+  if (typeof value[Symbol.iterator] !== 'function') return
+  for (const item of value) {
+    if (typeof item === 'string') {
+      pushName(item, out, seen)
+    } else if (Array.isArray(item)) {
+      // [name, def] 对（Map.entries() 的产物）
+      if (item.length > 0) pushPair(item[0], item[1], out, seen)
+    } else if (item && typeof item === 'object') {
+      if (typeof item.name === 'string') {
+        pushName(item.name, out, seen)
+      } else {
+        // 兜底：{ [key]: def } 形态的对象，按 key/def.name 处理
+        for (const [k, v] of Object.entries(item)) pushPair(k, v, out, seen)
+      }
+    }
+  }
+}
+
+/**
+ * 防御式取服务：cordis 的 ctx[key] 受 inject 护栏约束（未注入直接抛
+ * "cannot get property ... without inject"），而 ctx.reflect.get(name)
+ * 是官方文档明确的“无需 inject 即可读取”入口（ctx.get 为其 mixin 别名，
+ * strict=false 连 provider 未处于 running 态也允许读）。按
+ * reflect.get → ctx.get → ctx[key] 三级降级，全部 try/catch，永不抛出。
+ */
+function getService(ctx, key) {
+  if (ctx == null) return undefined
+  const attempts = [
+    () => ctx.reflect?.get?.(key, false),
+    () => ctx.get?.(key),
+    () => ctx[key],
+  ]
+  for (const fn of attempts) {
+    try {
+      const v = fn()
+      if (v !== undefined && v !== null) return v
+    } catch { /* 该路径不可用：尝试下一级 */ }
+  }
+  return undefined
+}
+
+/** 收集一个对象的可调用方法名（沿原型链，去重，限量）。 */
+function collectMethodNames(svc) {
+  const methods = []
+  for (let proto = Object.getPrototypeOf(svc); proto && proto !== Object.prototype; proto = Object.getPrototypeOf(proto)) {
+    for (const m of Object.getOwnPropertyNames(proto)) {
+      if (m !== 'constructor' && typeof svc[m] === 'function' && !methods.includes(m)) methods.push(m)
+    }
+  }
+  return methods
+}
+
+/**
+ * 读取运行时插件清单。返回 { entries, ok }：ok 表示成功拿到 list() 结果
+ * （空清单也算成功，区别于服务不可用）。
+ */
+function collectPluginEntries(ctx, errors) {
+  const pi = getService(ctx, 'pluginInventory')
+  if (pi == null || typeof pi.list !== 'function') return { entries: [], ok: false }
+  try {
+    const result = pi.list()
+    // list() 官方返回 { entries: [...] }；兼容直接返回数组的形态
+    const raw = Array.isArray(result) ? result : Array.isArray(result?.entries) ? result.entries : null
+    if (raw === null) {
+      errors.push('pluginInventory.list() returned an unexpected shape')
+      return { entries: [], ok: false }
+    }
+    const entries = []
+    for (const e of raw.slice(0, MAX_PLUGIN_ENTRIES)) {
+      // 只透传四个已知字段（保持 JSON 安全）；剔除未启用 / 未运行（fiberPhase
+      // 缺失时按“可接受”处理，兼容字段更老的宿主）的条目，其余留给 UI 判断
+      if (e == null || typeof e !== 'object') continue
+      if (e.enabled === false) continue
+      if (e.fiberPhase != null && e.fiberPhase !== 'active') continue
+      entries.push({
+        entryId: typeof e.entryId === 'string' ? e.entryId : undefined,
+        moduleName: typeof e.moduleName === 'string' ? e.moduleName : undefined,
+        enabled: e.enabled,
+        fiberPhase: e.fiberPhase ?? null,
+      })
+    }
+    return { entries, ok: true }
+  } catch (err) {
+    errors.push(`pluginInventory.list() threw: ${String(err?.message ?? err)}`)
+    return { entries: [], ok: false }
+  }
+}
+
+/**
+ * 读取 tools 服务注册的工具公开名。按下列顺序尝试，任意一步抛错都跳过：
+ *   1) t.entries() 若可调用（Map / 迭代器 / 数组 归一化）；
+ *   2) t.schemas() 若可调用（返回 [{ name, description, ... }]，全局视图 =
+ *      全部已注册工具，含 mcp__<server>__<tool>）；
+ *   3) 在方法名里找含 entries/list/schemas/keys 的可调用方法逐个 try 调用
+ *      （不硬猜 presentAs/visible 这类语义方法）；
+ *   4) 全部失败返回空数组。返回 { names, ok }。
+ */
+function readRegisteredToolNames(ctx, errors) {
+  const out = []
+  const seen = new Set()
+  const t = getService(ctx, 'tools')
+  if (t == null) return { names: [], ok: false }
+  const tried = new Set()
+  const attempt = (method, source) => {
+    if (typeof t[method] !== 'function' || tried.has(method)) return false
+    tried.add(method)
+    try {
+      const result = t[method]()
+      // 拿到可迭代结果即视为“服务可用”（即使为空清单）；无结果 / 抛错都跳过
+      if (result != null && typeof result[Symbol.iterator] === 'function') {
+        collectToolNames(result, out, seen)
+        return true
+      }
+    } catch (err) {
+      errors.push(`${source} threw: ${String(err?.message ?? err)}`)
+    }
+    return false
+  }
+
+  // 1) entries() —— cordis Service 层最直观的枚举口（部分版本存在）
+  // 2) schemas() —— dsh-tools 公开 API 里能枚举“全部已注册工具名”的口
+  let acquired = attempt('entries', 'tools.entries()')
+  if (!acquired) acquired = attempt('schemas', 'tools.schemas()')
+
+  // 3) 兜底：在方法列表里找名字含 entries/list/schemas/keys 的函数逐个尝试
+  if (!acquired) {
+    const hint = /entries|list|schemas|keys/
+    for (const m of collectMethodNames(t)) {
+      if (!hint.test(m)) continue
+      if (attempt(m, `tools.${m}()`)) { acquired = true; break }
+    }
+  }
+  return { names: out, ok: acquired }
+}
+
+/**
+ * 采集运行时事实（供 collectState 合并 / UI 展示）。
+ * 永不抛出：任何异常都会落到 error 里，返回部分结果。
+ */
+export function collectRuntimeFacts(ctx) {
+  const errors = []
+  const plugin = collectPluginEntries(ctx, errors)
+  const tools = readRegisteredToolNames(ctx, errors)
+
+  // ok 语义：pluginInventory 与 tools 至少一个服务真正可用即为成功；
+  // 两个都拿不到才整体失败（UI 据此提示“已回退文件扫描”）。
+  const ok = plugin.ok || tools.ok
+  if (!ok) errors.unshift('tools service unavailable (pluginInventory/tools both missing)')
+
+  let error = errors.join('; ')
+  if (error.length > MAX_ERROR_LEN) error = error.slice(0, MAX_ERROR_LEN) + '…'
+  return {
+    ok,
+    ...(error !== '' ? { error } : {}),
+    pluginEntries: plugin.entries,
+    toolNames: tools.names,
+  }
+}

package/presets/orchestrator/agent.cordis.yml

@@ -0,0 +1,323 @@
+# orchestrator (编排模式) agent composition
+#
+# 基于 builtin `standard` preset 全量组合（基础工具注册在 preset 层，不在 global
+# 层——这是本 preset 此前运行时 tools.restrict() 报 "unknown global tools" 的根因），
+# 叠加编排层：
+#   · persona            → 编排人设（主 agent 分工指引）
+#   · orchestrator-restrict → restrict.mjs 在 system-prompt/assemble 瀑布上把
+#     主 agent 的工具面裁剪为「编排 + 内部搜索」白名单；子 agent（origin:
+#     'subagent'）放行，由各自 toolFilter 决定工具面
+#   · delegation-*       → 3 个角色委派工具（dsh-tool-subagent），子 agent 创建时
+#     以 per-child tools.restrict() 只保留各自 allow 的工具
+#
+# 工具税（每请求估算）：主 agent 全量 ~16.2k → 白名单后 ~5.5k（含 3 个委派工具）；
+# search_external ~3.0k / design ~3.2k / implement ~3.7k，仅实际委派时发生。
+
+# ── identity ────────────────────────────────────────────────────────────────
+
+# 编排人设：{{model}}/{{cwd}} 由 agent 的 route/workspace 解析（同 standard）。
+- id: persona
+  name: '@deepseek-ai/dsh-persona'
+  config:
+    text: |-
+      You are the orchestrator agent powered by the {{model}} model. Your working directory is {{cwd}}.
+
+      Decompose the task, delegate to role agents, integrate results.
+      - Internal file questions (finding code, references, reading files): solve yourself with glob/grep/read/codegraph — never delegate them.
+      - External research: delegate to search_external.
+      - UI/design work: delegate to design.
+      - Code implementation: delegate to implement.
+      Keep your own context lean; integrate only summaries. Use todo_write to plan, and ask_user_question only for user-owned choices.
+
+      Delegation failure handling (SOP):
+      - A delegated run reports failure either as a thrown tool error (foreground)
+        or as a failed background job; both carry the child's partial output and
+        a stop reason (error / max-tokens / refusal / aborted / completed-but-poor).
+      - Diagnose by stop reason, never retry blindly:
+        · error (runtime/tool-level) → re-delegate ONCE as a fresh task (not a continuation);
+          if the failure cites a missing tool or permission, pick a different role or do it yourself.
+        · max-tokens → split the task into smaller steps and re-delegate, or ask the child to
+          output incrementally.
+        · refusal → do NOT retry the same task: adjust the task's scope or framing, switch roles,
+          or handle it yourself (a refusal is a policy decision, not a transient error).
+        · aborted → only re-delegate when the cancellation was accidental.
+        · completed but poor output → re-delegate with concrete missing points, or send_message
+          to ask a continuable child to finish the gaps.
+      - If the same task fails twice, stop retrying: report to the user what failed, why,
+        and what you already tried. Never loop a failing delegation.
+      - When re-delegating (fresh task or continuation), always include your integration
+        summary of the previous attempt (what was done, what failed, what to pick up from),
+        so the child never re-derives it from a cold context.
+
+- id: agent-instructions
+  name: '@deepseek-ai/dsh-agent-instructions'
+  config:
+    maxBytes: 65536
+
+# ── 主 agent 工具面白名单 ───────────────────────────────────────────────────
+# 过滤主 agent 的 assembly.tools 为编排 + 内部搜索面；子 agent 放行。
+- id: orchestrator-restrict
+  name: ./restrict.mjs
+
+# ── shell ───────────────────────────────────────────────────────────────────
+
+- id: tool-bash
+  name: '@deepseek-ai/dsh-tool-bash'
+  disabled: !!js process.platform === 'win32'
+
+- id: tool-pwsh
+  name: '@deepseek-ai/dsh-tool-pwsh'
+  disabled: !!js process.platform !== 'win32'
+
+# ── filesystem ──────────────────────────────────────────────────────────────
+
+- id: tool-fs
+  name: '@deepseek-ai/dsh-tool-fs'
+
+- id: tool-fs-search
+  name: '@deepseek-ai/dsh-tool-fs-search'
+  config:
+    sampleOverCapGlobResults: false
+
+# ── background jobs ────────────────────────────────────────────────────────
+
+- id: tool-jobs
+  name: '@deepseek-ai/dsh-tool-jobs'
+
+# ── skills ──────────────────────────────────────────────────────────────────
+
+- id: skill-filesystem
+  name: '@deepseek-ai/dsh-skill-filesystem'
+
+- id: tool-skill
+  name: '@deepseek-ai/dsh-tool-skill'
+
+# ── goals ───────────────────────────────────────────────────────────────────
+
+- id: tool-goal
+  name: '@deepseek-ai/dsh-tool-goal'
+
+# ── plan mode ───────────────────────────────────────────────────────────────
+
+- id: planning
+  name: cordis:group
+  group: true
+  isolate:
+    planMode: true
+  config:
+    - id: plan-mode
+      name: '@deepseek-ai/dsh-plan-mode'
+      config:
+        section: |
+              You are in plan mode. Stay in plan mode until exit_plan_mode succeeds or the user switches the session mode. Imperative language to implement changes means plan the implementation, not execute it. A user's conversational agreement — including an answer confirming something you asked — approves nothing and does not end plan mode; fold the confirmed decision into the plan and submit it through exit_plan_mode.
+
+              Explore first. Use non-mutating reads, searches, static analysis, and checks to ground the plan in the actual repository. Do not edit or write files, change configuration, run formatters or code generation that rewrites tracked files, commit, or otherwise carry out the plan. Prefer existing functions and patterns over new machinery.
+
+              The tool catalog stays the same across modes for request-cache stability. These plan-mode rules override any later tool description or guidance that suggests using mutation tools; those tools remain listed to keep the tool catalog unchanged. Do not use todo_write to track this planning phase: it tracks implementation after an approved plan, while the plan itself belongs in exit_plan_mode.
+
+              Resolve discoverable facts by inspection. Use ask_user_question only for user-owned choices or material ambiguity that inspection cannot answer. Do not ask the user where code lives or how current behavior works when you can find out.
+
+              Make the plan decision-complete: state the goal and success criteria; group implementation changes by subsystem; identify public API, schema, and data-flow changes; cover edge cases, failure modes, tests, acceptance criteria, and explicit assumptions. Keep it concise enough to review but detailed enough that another engineer can implement it without making design decisions.
+
+              When ready, call exit_plan_mode with the complete plan markdown, starting with a # title. Make exit_plan_mode the only and final tool call in that assistant response: it presents the plan for approval, and implementation begins only in a later step after approval. Do not paste the final plan as a plain reply or ask "should I proceed?" through prose or ask_user_question. If review rejects it, incorporate the feedback and present again. If the review channel is unavailable or aborted, stay in plan mode and ask the user to switch modes manually; do not proceed with implementation.
+
+# ── compaction ──────────────────────────────────────────────────────────────
+# 触发线（实测校准，2026-08-20）：
+#   默认 thresholdRatio 0.8（窗口 256K → 209,715 tokens 才压缩），长会话
+#   裸涨到 ~137K-142K 稳态且从未触发——这是「每请求 token 是 opencode 近两倍」
+#   的真凶（opencode 同项目 73 会话平均 68K，且全部发生过压缩）。
+#   0.45 → 117,965 tokens 触发，保留 16% 尾部（≈42K）+ 摘要 checkpoint，
+#   稳态平均回落到 ~80K 量级。保留尾部由 retainRatio 控制，不会丢最近上下文。
+#   如需更激进可改 0.35（≈92K 触发，平均 ~67K，逼近 opencode）；0.45 是
+#   「省 token 与不频繁摘要的平衡点」（压缩会调用一次 LLM 摘要，复用前缀缓存）。
+
+- id: compaction
+  name: cordis:group
+  group: true
+  isolate:
+    compaction: true
+    toolResultPruner: true
+  config:
+    - id: compaction-basic
+      name: '@deepseek-ai/dsh-compaction-basic'
+      config:
+        thresholdRatio: 0.45
+
+    - id: command-compact
+      name: '@deepseek-ai/dsh-command-compact'
+
+    - id: tool-result-pruner
+      name: '@deepseek-ai/dsh-compaction-tool-result-pruner'
+      config:
+        thresholdChars: 8192
+        headChars: 4096
+        tailChars: 1024
+
+# ── delegation and workflows ────────────────────────────────────────────────
+
+- id: delegation
+  name: cordis:group
+  group: true
+  isolate:
+    workflowEngine: true
+  config:
+    - id: tool-subagent-control
+      name: '@deepseek-ai/dsh-tool-subagent-control'
+
+    - id: tool-subagent-list-agents
+      name: '@deepseek-ai/dsh-tool-subagent-control/list-agents'
+
+    - id: tool-subagent
+      name: '@deepseek-ai/dsh-tool-subagent'
+      config:
+        provider: spawn
+        toolName: subagent
+        backgroundMode: continuable
+
+    - id: tool-subagent-fork
+      name: '@deepseek-ai/dsh-tool-subagent'
+      config:
+        provider: fork
+        toolName: subagent_fork
+        backgroundMode: continuable
+
+    - id: workflow-worker-thread
+      name: '@deepseek-ai/dsh-workflow-worker-thread'
+      config:
+        provider: spawn
+
+    - id: tool-workflow
+      name: '@deepseek-ai/dsh-tool-workflow'
+
+    - id: tool-ralph
+      name: '@deepseek-ai/dsh-tool-ralph'
+      config:
+        subagentProvider: spawn
+        maxRounds: 64
+
+    # ── 角色委派工具 ─────────────────────────────────────────────
+    # 每个实例把一个 spawn provider 绑定到一个 toolName；主 agent 调哪个工具，
+    # 即选择该子 agent 的工具面。子 agent 创建时 tools.restrict(toolFilter)
+    # 校验 allow 名字必须存在于其可见注册面 —— 本组合（standard 全量 + host
+    # patch 的 mcp/memory）就是这些名字的来源，缺一行都会报 unknown tools。
+
+    # search_external：外部调研（冷路径，用一次才付一次 ~3.0k）
+    - id: delegation-search-external
+      name: '@deepseek-ai/dsh-tool-subagent'
+      config:
+        provider: spawn
+        toolName: search_external
+        persona: |-
+          You are the external-research agent. Your job is web research only — use web_search and the tavily tools; you never modify files. Search the web, extract key facts, and return a concise structured research summary (findings, sources, open questions).
+          On tool failure, do not retry a denied operation: report the failure compactly — what you completed, the exact error, which tool/permission you lack, and your suggested next step — so the orchestrator can re-delegate or adjust.
+        toolFilter:
+          allow:
+            - web_search
+            - mcp__tavily__tavily_search
+            - mcp__tavily__tavily_crawl
+            - mcp__tavily__tavily_extract
+            - mcp__tavily__tavily_map
+            - mcp__tavily__tavily_research
+            - glob
+            - grep
+            - read
+            - ask_user_question
+
+    # design：设计（读参考 + 设计技能 + 出 spec，不写最终代码）~3.2k
+    - id: delegation-design
+      name: '@deepseek-ai/dsh-tool-subagent'
+      config:
+        provider: spawn
+        toolName: design
+        persona: |-
+          You are the design agent. You produce UI/UX designs, wireframes, and frontend specs — and may load design skills (frontend-design, html-ppt) via the skill tool. Read reference material first, then deliver a concrete design spec. You do not implement final code.
+          On tool failure, do not retry a denied operation: report the failure compactly — what you completed, the exact error, which tool/permission you lack, and your suggested next step — so the orchestrator can re-delegate or adjust.
+        toolFilter:
+          allow:
+            - read
+            - read_image
+            - glob
+            - grep
+            - bash
+            - skill
+            - write
+            - edit
+            - ask_user_question
+            - todo_write
+            - job_output
+            - job_list
+            - job_kill
+
+    # implement：实现（读上下文 → 外科手术式修改 → 验证）~3.7k
+    - id: delegation-implement
+      name: '@deepseek-ai/dsh-tool-subagent'
+      config:
+        provider: spawn
+        toolName: implement
+        persona: |-
+          You are the implementation agent. You write and edit code: read surrounding context first, make surgical changes, then verify (build/test/grep). Report what you changed and how you verified. You do not redesign architecture.
+          On tool failure, do not retry a denied operation: report the failure compactly — what you completed, the exact error, which tool/permission you lack, and your suggested next step — so the orchestrator can re-delegate or adjust.
+        toolFilter:
+          allow:
+            - read
+            - write
+            - edit
+            - glob
+            - grep
+            - bash
+            - skill
+            - web_search
+            - ask_user_question
+            - todo_write
+            - job_output
+            - job_list
+            - job_kill
+            - get_goal
+            - create_goal
+            - update_goal
+
+    # search_internal_deep：全仓深度探索（冷路径，把大 dump 隔离出主上下文）
+    # 主 agent 遇到「超大仓库全量探索」（全仓 grep dump / 大文件通读 / 跨目录
+    # 符号追踪）时委派到这里：子 agent 内部消化大输出，只回浓缩摘要。
+    # 与 search_external 的区别：search_external 只联网不碰仓库；这个只碰仓库
+    # 不联网。工具面 = 内部搜索全量（read 无 limit 限制由它自己权衡），
+    # 不含 write/edit —— 它只读不改。
+    - id: delegation-search-internal-deep
+      name: '@deepseek-ai/dsh-tool-subagent'
+      config:
+        provider: spawn
+        toolName: search_internal_deep
+        persona: |-
+          You are the internal deep-search agent. Your job is repository exploration only — you never modify files and you never use the network. Handle exactly the tasks the orchestrator can't afford in its own context: whole-repo grep dumps, full-file reads beyond a page, cross-directory symbol/definition tracking. Search thoroughly, then return a CONCISE structured summary: what you searched, key files with line numbers, definitions/symbols found, and the takeaway the orchestrator needs to decide next. Never echo large dumps back — condense aggressively; the orchestrator re-delegates or reads specific ranges itself if it needs details.
+          On tool failure, do not retry a denied operation: report the failure compactly — what you completed, the exact error, which tool/permission you lack, and your suggested next step — so the orchestrator can re-delegate or adjust.
+        # 2026-09-02: memory_search / mcp__codegraph__codegraph_explore 已从 allow 移除——
+        # 两者对应插件（magic-memory / codegraph MCP）停用时不在子 agent 注册面，
+        # tools.restrict() 会以 unknown tools 拒绝创建该角色；重开插件时按需加回。
+        toolFilter:
+          allow:
+            - glob
+            - grep
+            - read
+            - read_image
+            - bash
+            - ask_user_question
+            - todo_write
+            - job_output
+            - job_list
+            - job_kill
+
+# ── remaining model-facing rows ─────────────────────────────────────────────
+
+- id: tool-ask-user
+  name: '@deepseek-ai/dsh-tool-ask-user'
+
+- id: tool-todo
+  name: '@deepseek-ai/dsh-tool-todo'
+  config:
+    allowParallelInProgress: true
+
+- id: tool-web
+  name: '@deepseek-ai/dsh-tool-web'
+  config:
+    fetch: false
+    searchTimeoutMs: 60000

package/presets/orchestrator/preset.yml

@@ -0,0 +1,6 @@
+name: 编排模式 (Orchestrator)
+description: 按角色分工的编排架构——主 agent 只做编排与内部搜索（glob/grep/read/codegraph），
+  通过 search_external / design / implement 三个委派工具把联网调研、设计、实现分别交给
+  各自只加载必要工具的子 agent；主 agent 不加载任何外部搜索、写文件或技能工具，
+  每请求工具税从 ~16.2k tokens 降到 ~5.5k。主 agent 技能目录注入亦归零（实测 ≈1.3k tokens/轮）。
+order: 5