dsh-plugin-prompt-tool 0.1.0

package/vendor/dsh-anchored-standard/README.md

@@ -0,0 +1,280 @@
+# dsh-anchored-standard
+
+[中文说明](./README.zh-CN.md)
+
+An experimental DeepSeek Harness agent preset that bootstraps the first model
+request with a Minimal-aligned prompt, the Minimal preset's real tool schema
+(`bash` + `str_replace_editor`), and no auto-injected workspace/skill context,
+then exposes the complete Standard tool catalog after the first durable tool
+call or reply.
+
+This is a community project. It is not an official DeepSeek preset and is not
+affiliated with or endorsed by DeepSeek.
+
+## Why
+
+DeepSeek V4 Pro conditions strongly on the API-visible tool catalog. In the
+Project2 evaluation, Standard and PTC produced scores of 91 and 92, while the
+official Minimal preset produced 99 and 96. Permanently staying on Minimal,
+however, gives up the Standard preset's broader tool set.
+
+Anchored Standard separates initial trajectory selection from later tool use:
+
+1. Keep the Minimal complete system prompt.
+2. Expose the Minimal preset's REAL tool schemas — persistent `bash` +
+   `str_replace_editor`, byte-identical to the official Minimal composition —
+   on the first model request. Issue #11 measured this exact schema anchoring
+   5/5 runs at the adapter-default maxTokens (256000) with zero `let me`
+   first-lines, while every standard-family schema (pwsh/read, pwsh only,
+   sandboxed bash/read) fell into standard-like behavior 11/11. The tool
+   schema identity is the decisive first-request variable at 256000, so no
+   output cap is needed.
+3. Strip the auto-injected context on that first request as well — the
+   AGENTS.md/CLAUDE.md workspace digest and the available-skills reminder that
+   true Minimal never mounts (`suppressedContextSources` in the
+   `tool-bootstrap` row). User-initiated skill gestures are not filtered, and
+   both injections return unchanged from request #2 on.
+4. After the session records its first durable promotion signal — a `tool/call`
+   or the first `assistant/message`, whichever comes first — expose all
+   Standard tools. Request #1 always sees the bootstrap catalog; request #2
+   always sees the full catalog, so a text-only first reply can no longer trap
+   the session in bootstrap. (`promoteOn` in the `tool-bootstrap` row selects
+   the trigger: `either` default, `tool-call`, or `assistant-message`.)
+5. Derive the phase from durable session events so resume and reload preserve it.
+
+The bootstrap catalog is the same on every platform: the Minimal pair
+(`bash`/`str_replace_editor`). The preset's shell is the persistent PTY bash
+(the sandboxed Standard `bash` row is disabled — both register the `bash` name
+into the same layer, and the tools registry rejects duplicates; Windows never
+had the sandboxed bash anyway). `pwsh` remains available in the promoted
+catalog on Windows.
+
+## Results
+
+Project2 V4.1b, DeepSeek V4 Pro, `reasoningEffort=max`, Windows native:
+
+| Run | Ability | Reasoning blocks | `we` | `let's` | `let me` | Visible replies |
+|---|---:|---:|---:|---:|---:|---:|
+| r1 | 98 | 193 | 179 | 88 | 1 | 1 |
+| r2 | 99 | 162 | 165 | 98 | 0 | 1 |
+
+Both runs emitted exactly two tool-catalog snapshots: the two-tool Minimal
+bootstrap, followed by the 25-tool Standard catalog. The result is reproducible
+evidence for this task, not a claim of universal improvement across models or
+workloads.
+
+Cross-version evidence (issue #11, Windows + official endpoint, first-request
+trajectory only): at the adapter-default maxTokens the Minimal tool schema
+anchored 5/5 (`We need modify…` first lines, `we` 1.4, `let me` 0.0), while
+pwsh/read, pwsh-only, and sandboxed bash/read all produced standard-like
+first lines 11/11 — the tool schema, not the output cap, is the decisive
+first-request variable at 256000.
+
+Full methodology and aggregate evidence are in
+[`xiaobright/modeltest`](https://github.com/xiaobright/modeltest).
+
+## Compatibility
+
+Developed and tested against:
+
+- DeepSeek Harness `0.1.0-rc.5`
+- repository commit [`47f9438`](https://github.com/deepseek-ai/deepseek-harness/tree/47f943859bef60e4160492346772ded9b24f765a)
+- Node.js 24 on Windows
+
+On the `0.1.0-rc.5` source checkout, `bootstrapMaxTokens` reaches the actual
+first request (the first `request/header` records the cap, `adapterDefaults`
+stays empty), because `llm.prepareCall` only materializes a default maxTokens
+when the proposed config has none. One prebuilt profile package observed in
+issue #11 (CLI launcher reporting `0.1.0-rc.6`) overwrote the proposed cap
+with `adapterDefaults.maxTokens`; there the cap is a no-op. The default
+composition therefore relies on the Minimal tool schema alone (which anchors
+at the adapter default with no cap) and leaves `bootstrapMaxTokens` as an
+opt-in for standard-schema bootstraps.
+
+DeepSeek Harness is currently a developer preview and explicitly permits
+breaking changes. This preset is a full snapshot of the Standard composition,
+so review upstream changes before using it with a newer release.
+
+## Install
+
+Clone this repository, then copy the entire `preset` directory into the user
+preset root under the id `anchored-standard`.
+
+PowerShell:
+
+```powershell
+$target = Join-Path $env:USERPROFILE '.dsh\.agent-presets\anchored-standard'
+if (Test-Path -LiteralPath $target) { throw "Preset already exists: $target" }
+New-Item -ItemType Directory -Force -Path (Split-Path -Parent $target) | Out-Null
+Copy-Item -Recurse -LiteralPath '.\preset' -Destination $target
+```
+
+Linux/macOS:
+
+```sh
+dsh_home="${DSH_HOME:-$HOME/.dsh}"
+mkdir -p "$dsh_home/.agent-presets"
+test ! -e "$dsh_home/.agent-presets/anchored-standard"
+cp -R preset "$dsh_home/.agent-presets/anchored-standard"
+```
+
+Fully restart DeepSeek Harness, create a blank session, and select
+**Anchored Standard (experimental)**. Do not switch an active session from a
+different preset.
+
+## Verify
+
+Export the session JSONL and inspect `request/header` events. Reproduction
+checklist (issue #11 asks for the first two explicitly, because both are the
+variables that decide the anchor):
+
+- **First-request `config.maxTokens` value**: with `bootstrapMaxTokens` unset
+  (the default), the first header records the adapter default (e.g. 256000
+  with `adapterDefaults.maxTokens: true`); with a cap configured it records
+  the cap (e.g. 1024 with no maxTokens adapterDefault).
+- **First-request tool schema source**: the first header's `tools` array must
+  be exactly `["bash", "str_replace_editor"]` — the official Minimal preset's
+  real schemas, not Standard's `pwsh`/`read`.
+- the first request's messages should contain no AGENTS.md/CLAUDE.md digest and
+  no available-skills reminder — only the user message and the minimal persona
+  system prompt;
+- after the first tool call or the first assistant reply, the next changed
+  header should contain the full Standard catalog;
+- subsequent requests should keep that full catalog and restore the standard
+  context injections.
+
+Run the local zero-dependency tests with:
+
+```sh
+npm test
+```
+
+## Important behavior
+
+- With the default `promoteOn: either`, the session promotes after its first
+  durable `tool/call` OR its first `assistant/message`, whichever comes first —
+  request #1 sees the bootstrap catalog and every later request sees the full
+  catalog. A text-only first reply therefore still promotes at request #2;
+  set `promoteOn: tool-call` to restore the original behavior, where a first
+  response that makes no tool call never promotes.
+- A failed tool execution still promotes the session because the durable
+  `tool/call` already exists.
+- The first request's output budget is NOT capped by default: the Minimal tool
+  schema anchors at the adapter-default maxTokens, so `bootstrapMaxTokens` is
+  opt-in. When set, the first request is capped and the cap is explicitly
+  stripped after promotion (the next request's seed proposal carries the
+  previous header's maxTokens forward).
+- The Minimal pair stays mounted after promotion, so the promoted catalog is
+  the Standard catalog plus `bash` (persistent) and `str_replace_editor` —
+  and the Standard sandboxed `bash` row is disabled in favor of the persistent
+  shell (same tool name, same layer; see Why). The `read`/`write`/`edit` tools
+  keep the sandboxed filesystem while `str_replace_editor` uses the preset's
+  local fs.
+- A missing bootstrap tool degrades to the full catalog with a one-time
+  warning instead of failing requests, so a composition drift cannot brick a
+  session; invalid `promoteOn` values fail at preset mount instead.
+- Promotion decisions are memoized per session for the process lifetime; the
+  durable event scan runs once per session per process.
+- While a session is unpromoted, the pre-step filter strips messages whose
+  `source.kind` is listed in `suppressedContextSources` (default:
+  `agent-instructions` and `skill-catalog`, the two automatic injections
+  Standard adds over Minimal). Set the list to `[]` to disable the context
+  filter; add other `source.kind` values to suppress more. A filter failure
+  degrades to keeping every message rather than eating context.
+- The tool catalog changes once, so request-prefix cache continuity also changes
+  once between the first and second model requests.
+- The preset has the same trust level as shell access. Review its files before
+  installation.
+- The plugin performs no network requests and adds no telemetry.
+
+## Zero-Anchored Standard (experimental)
+
+An extra test mode that does not change the Anchored Standard logic above. It
+uses the same Minimal-aligned system prompt, but instead of exposing two tools
+on the first request it injects one fixed zero-tool anchor turn:
+
+1. When the user sends their first message, the `anchor-turn` plugin prepends a
+   fixed user message — "This round is a test. Tools are not open yet; all
+   tools will open next round." — ahead of it.
+2. The first real model request carries ZERO tools, so the session's first
+   reasoning chain follows the zero-injection "we" trajectory.
+3. Once that anchor response is durable, the full Standard catalog is exposed
+   and the real message proceeds with all tools.
+
+Anchoring on the first message — not on session creation — keeps the
+blank-session preset switcher usable. Subagents always see the full catalog.
+
+Measured behavior (opencode-go, DeepSeek V4 Pro, `reasoningEffort=max`): the
+anchor request is stable "we"-style with zero `let me`; the following
+tool-bearing requests return to the "The user wants…/Let me" style. This mode
+is a comparison point for whether the zero-tool first turn is worth the extra
+model call — not a claim that tool rounds stay "we"-style.
+
+Install as a separate preset id:
+
+```sh
+dsh_home="${DSH_HOME:-$HOME/.dsh}"
+mkdir -p "$dsh_home/.agent-presets"
+test ! -e "$dsh_home/.agent-presets/zero-anchored-standard"
+cp -R zero-anchored-standard "$dsh_home/.agent-presets/zero-anchored-standard"
+```
+
+Restart DeepSeek Harness, create a blank session, select **Zero-Anchored
+Standard (experimental)**, then send your first message.
+
+## Whoami Standard (experimental)
+
+A usability-oriented variant of the zero-tool anchor idea: the first turn is a
+natural self-introduction prompt instead of a fixed test message, and the
+user's real first message is deferred to the next turn. Whatever the user types
+first, the session warms up exactly one round and everything is ready when the
+real message is processed:
+
+1. When the user sends their first message, the `whoami-turn` plugin prepends a
+   fixed user message — "你是谁" (who are you) — ahead of it in the `next-turn`
+   inbox queue.
+2. dsh claims exactly ONE `next-turn` message per turn, so the first model
+   request sees only the anchor on an EMPTY tool surface and replies with a
+   self-introduction; that reply is the promotion signal.
+3. The real message is claimed by the NEXT turn, with the promoted resident
+   catalog (shells, `str_replace_editor`, the discovery tools) already
+   unlocked — heavier Standard tools are one `dev_tool_search` away.
+
+The anchor text is configurable via the `whoami-turn` row's `text` option
+(default "你是谁"). Anchoring on the first message — not session creation —
+keeps the blank-session preset switcher usable; subagents always see the full
+catalog. The trade-off is one extra model call per session: the anchor turn is
+always taken, even when the first message is urgent.
+
+The preset shares plugin modules with the anchored `preset/` directory via
+`../preset/` references, so install that directory as well (see the Install
+section above).
+
+Install as a separate preset id:
+
+```sh
+dsh_home="${DSH_HOME:-$HOME/.dsh}"
+mkdir -p "$dsh_home/.agent-presets"
+test ! -e "$dsh_home/.agent-presets/whoami-standard"
+cp -R whoami-standard "$dsh_home/.agent-presets/whoami-standard"
+```
+
+Restart DeepSeek Harness, create a blank session, select **Whoami Standard
+(experimental)**, then send your first message — the self-introduction round
+runs first, and your message is answered with the full tooling on the next
+turn.
+
+## Official ecosystem guidance
+
+DeepSeek currently asks community plugin authors to publish plugins in their own
+GitHub projects and add the [`dsh-plugin`](https://github.com/topics/dsh-plugin)
+repository topic for discovery. The official repository does not currently
+accept external pull requests and does not mandate a community repository
+template. See the official
+[`CONTRIBUTING.md`](https://github.com/deepseek-ai/deepseek-harness/blob/47f943859bef60e4160492346772ded9b24f765a/CONTRIBUTING.md).
+
+## License
+
+MIT. `preset/agent.cordis.yml` is derived from the DeepSeek Harness Standard
+preset; the original DeepSeek copyright and MIT notice are retained in
+[`NOTICE`](./NOTICE).

package/vendor/dsh-anchored-standard/preset/agent.cordis.yml

@@ -0,0 +1,400 @@
+# The `anchored-standard` experimental preset: Standard capabilities with the
+# Minimal mode system-prompt condition used by the V4 trajectory evaluation.
+#
+# This file is an AGENT-PLANE composition. The roster mounts it ONCE under a
+# standing scope; every session naming it joins by scope parentage, so the
+# tools and prompt sections registered here cover each joined agent while a
+# session's own state stays keyed per Session/Agent inside the plugins. The
+# host composition (`base.cordis.yml` + `web.cordis.yml`) keeps everything a
+# preset must not own: the registries themselves, the sandbox and approval
+# stack, persistence, and the model route.
+#
+# A service row here MUST sit inside a group carrying an `isolate` realm.
+# Without one it publishes into the root realm, where it is process-global —
+# another preset publishing the same name collides, and a host reader would
+# resolve one preset's instance for every session; `dsh-agent-presets` rejects
+# that at mount. `true` means an entry-local realm: this standing mount's own
+# private instance, apart from every other preset's. (A shared label does NOT
+# pool instances — `provide()` throws on the second registration under the
+# same realm symbol; labels join REALMS, and are not what this file needs.)
+
+# ── bootstrap (must stay FIRST) ─────────────────────────────────────────────
+
+# This row deliberately sits before every other row: dsh-agent-instructions and
+# dsh-tool-skill inject workspace instructions and the skill catalog into the
+# first request via the agent/pre-step waterfall, and waterfall after-next
+# transforms apply in reverse registration order. Registering first (plus the
+# plugin empty inject list and the listener's `prepend` flag) makes this filter
+# strip the final transform, so request #1 stays Minimal-exact (see issue #6).
+#
+# V4 Pro conditions strongly on the API tool catalog AND the first request
+# output budget. Bootstrap request #1 with the OFFICIAL Minimal preset's real
+# tool pair — persistent `bash` + `str_replace_editor` — which anchors at the
+# adapter-default maxTokens (256000) with no output cap needed (issue #11:
+# 5/5 anchored vs 11/11 standard-like for every standard-family schema);
+# after the session records its first durable promotion signal (a tool call OR
+# the first assistant message, default `promoteOn: either`), later steps
+# narrow to the minimal RESIDENT set (see below). `bootstrapMaxTokens` is
+# opt-in for standard-schema bootstraps; unset, the adapter default flows. See
+# tool-bootstrap.mjs for the other triggers.
+#
+# The same phase gate suppresses AUTO-INJECTED context on request #1:
+# `suppressedContextSources` lists the `agent/pre-step` message sources the
+# bootstrap filter strips while the session is unpromoted. The defaults are the
+# two automatic injections Standard adds over Minimal — the available-skills
+# reminder (`skill-catalog`) and the workspace instruction digest
+# (`agent-instructions`). User-initiated skill gestures are not filtered, and
+# both injections return unchanged from request #2 on. Set the list to [] to
+# disable the context filter while keeping the tool bootstrap.
+#
+# POST-PROMOTION (local addition): the promoted catalog is NOT the full
+# Standard dump — it stays on the bootstrap pair + the three discovery tools
+# (dev_tool_search / skill_search / skill_load) + whatever the model unlocked
+# via dev_tool_search. Heavier tools are one dev_tool_search away; the
+# trajectory is not pulled back to standard-like behavior by a 25-tool dump.
+#
+# COMPACTION (local addition): after `compaction/end` the session falls back
+# to the controlled phase — bootstrap pair + `compactionTools` — until a NEW
+# durable promotion signal exists past the boundary (epoch-aware, see
+# compaction-epoch.mjs).
+- id: tool-bootstrap
+  name: ./tool-bootstrap.mjs
+  config:
+    bootstrapTools: [bash, str_replace_editor]
+    promoteOn: either
+    suppressedContextSources: [agent-instructions, skill-catalog]
+    # Post-compaction core work set: the model is mid-task and needs to keep
+    # working, but faces a small catalog instead of the full Standard set.
+    compactionTools: [read, write, edit, glob, grep, todo_write, ask_user_question]
+
+# ── identity ────────────────────────────────────────────────────────────────
+
+# Keep this text byte-identical to the Minimal preset. `complete` prevents the
+# Harness identity and per-tool guidance from changing the system prompt, while
+# runtime-context suppression leaves task and repository rules to user messages
+# and explicit file reads. Tool schemas and their runtime enforcement remain.
+- id: persona
+  name: '@deepseek-ai/dsh-persona'
+  config:
+    text: You are a helpful software engineer assistant.
+    complete: true
+    includeRuntimeContext: false
+
+# Instruction FILES are NOT injected (replaces dsh-agent-instructions, local
+# addition): the full AGENTS.md/CLAUDE.md digest is a large injected block
+# that perturbs the trajectory even after promotion. Instead, after promotion
+# ONE short hint is injected once per session — "these instruction files
+# exist; read them before acting" — and the model reads the files itself via
+# the filesystem tools when relevant.
+- id: instruction-hint
+  name: ./instruction-hint.mjs
+  config:
+    promoteOn: either
+
+# On-demand tool discovery (the tool-search pattern, local addition): the
+# promoted catalog keeps a minimal resident set; heavier Standard tools
+# (web_search, subagent, workflow, …) are unlocked on demand via
+# dev_tool_search.
+- id: dev-tool-search
+  name: ./dev-tool-search.mjs
+
+# ── shell ───────────────────────────────────────────────────────────────────
+
+# `shell-env` stays in the HOST composition: `apps/cli/src/web.ts` injects it to
+# publish `DSH_WEB_URL`/`DSH_WEB_MODE`, and a host row that injects a service is
+# the criterion for host-plane ownership — injection resolves before any session
+# exists, so there is no agent to key by. Behind a preset realm those variables
+# never reached the model's shell at all. Both shell tools consume the host
+# registry from here; their executors (`bash-sandbox`/`pwsh-sandbox`) are
+# host-plane too.
+- id: tool-bash
+  name: '@deepseek-ai/dsh-tool-bash'
+  # Disabled on EVERY platform, not just Windows: `dsh-tool-bash-persistent`
+  # below registers the same `bash` tool name into this same preset layer, and
+  # the tools registry rejects duplicates within one layer. The persistent
+  # shell (the Minimal preset's own shell) is the preset's bash; it consumes
+  # the host sandbox policy through the terminals realm.
+  disabled: true
+
+- id: tool-pwsh
+  name: '@deepseek-ai/dsh-tool-pwsh'
+  disabled: !!js process.platform !== 'win32'
+
+# The Minimal preset's shell: a PTY-backed persistent bash, byte-identical in
+# configuration to the official `minimal` preset's `persistent-shell` group so
+# the first request exposes exactly Minimal's real `bash` schema. The PTY
+# registry is an agent-owned service, so it lives in an entry-local realm; the
+# backend still consumes the host sandbox policy and subprocess implementation,
+# while the tool registers into this agent's scoped catalog.
+#
+# DISABLED ON WINDOWS: DSH's PTY backend is linux/darwin-only, so the
+# persistent shell cannot serve win32. The `custom-bash` row below registers
+# the same `bash` tool name there instead (platform-exclusive).
+- id: persistent-shell
+  name: cordis:group
+  group: true
+  disabled: !!js process.platform === 'win32'
+  isolate:
+    terminals: true
+  config:
+    - id: pty
+      name: '@deepseek-ai/dsh-terminal'
+
+    - id: terminal-bash
+      name: '@deepseek-ai/dsh-terminal-bash'
+      config:
+        timeoutMs: 300000
+
+    - id: persistent-bash
+      name: '@deepseek-ai/dsh-tool-bash-persistent'
+      config:
+        timeoutMs: 300000
+        description: |-
+          Run commands in a bash shell
+          * When invoking this tool, the contents of the "command" parameter does NOT need to be XML-escaped.
+          * You don't have access to the internet via this tool.
+          * You do have access to a mirror of common linux and python packages via apt and pip.
+          * State is persistent across command calls and discussions with the user.
+          * To inspect a particular line range of a file, e.g. lines 10-25, try 'sed -n 10,25p /path/to/the/file'.
+          * Please avoid commands that may produce a very large amount of output.
+          * Please run long lived commands in the background, e.g. 'sleep 10 &' or start a server in the background.
+
+# Windows-only `bash` tool (see preset/custom-bash.mjs): registers the SAME
+# tool name as the persistent shell with a Minimal-compatible description, but
+# executes through the ordinary cross-platform subprocess seam (`bash -c`)
+# instead of a PTY. `bashPath` defaults to `bash` on PATH; point it at Git
+# Bash explicitly when the WSL shim would otherwise be picked up. No OS
+# sandbox confinement on Windows (landlock is linux-only); the tool
+# description says so.
+- id: custom-bash
+  name: ./custom-bash.mjs
+  disabled: !!js process.platform !== 'win32'
+  config:
+    bashPath: 'C:\Program Files\Git\bin\bash.exe'
+
+# ── filesystem ──────────────────────────────────────────────────────────────
+
+# Both register into the host `tools` registry and provide nothing, so
+# they need no realm. The `fs` service and its policy stay in the host.
+- id: tool-fs
+  name: '@deepseek-ai/dsh-tool-fs'
+
+- id: tool-fs-search
+  name: '@deepseek-ai/dsh-tool-fs-search'
+  config:
+    sampleOverCapGlobResults: false
+
+# The Minimal preset's second tool: `str_replace_editor` over a bare local
+# filesystem, byte-identical in configuration to the official `minimal`
+# preset's `filesystem` group. The editor's own realm shadows the host's
+# sandboxed `fs` provider only inside this group, so the standard `read`/
+# `write`/`edit` tools keep the sandboxed fs while the bootstrap editor uses
+# the local one.
+- id: bootstrap-filesystem
+  name: cordis:group
+  group: true
+  isolate:
+    fs: true
+  config:
+    - id: fs-local
+      name: '@deepseek-ai/dsh-fs-local'
+      config:
+        cwd: !!js process.env.DSH_CWD ?? process.cwd()
+
+    - id: str-replace-editor
+      name: '@deepseek-ai/dsh-tool-str-replace-editor'
+      config:
+        maxOutputChars: 16000
+
+# ── background jobs ────────────────────────────────────────────────────────
+
+# Only the model-facing controls. The task REGISTRY stays on the host plane:
+# its producers sit outside any realm this file could put it in — `tool-bash`
+# above resolves it with `ctx.get`, and an entry-local realm here is invisible
+# to every sibling row, so `run_in_background` would answer "background jobs
+# unavailable" while these controls sat in the catalog. The registry is keyed by
+# owning agent anyway, so one host instance serves every session. What a preset
+# chooses is whether its agent can collect and stop background work at all.
+- id: tool-jobs
+  name: '@deepseek-ai/dsh-tool-jobs'
+
+# ── skills ──────────────────────────────────────────────────────────────────
+
+# The skill REGISTRY lives in the host composition and is layered per scope:
+# these rows register into THIS preset's layer of it, so they need no realm.
+# `skill-filesystem` contributes local-root discovery for agents on this
+# preset. The full skill CATALOG injection (`dsh-tool-skill`, the ~9KB
+# `<available_skills>` reminder) is REMOVED (local addition): it perturbs the
+# trajectory (issue #6: 0/9 anchored with the catalog present vs ~81%
+# without). Instead `skill-search` exposes two small on-demand tools —
+# skill_search (list matching summaries) and skill_load (inject one skill's
+# full instructions) — the tool-search pattern.
+- id: skill-filesystem
+  name: '@deepseek-ai/dsh-skill-filesystem'
+
+- id: skill-search
+  name: ./skill-search.mjs
+
+# ── goals ───────────────────────────────────────────────────────────────────
+
+# Only the model-facing tool. The goal SERVICE, its session driver, and the
+# `/goal` command stay on the host plane: the Gateway serves the goal domain as
+# Remote endpoints whose receiver comes from a generated descriptor, so it
+# resolves `goals` on the host and an entry-local realm here would hide it. The
+# registry is keyed by session anyway, so one host instance serves every
+# session. What a preset chooses is whether its agent can call the goal tool.
+- id: tool-goal
+  name: '@deepseek-ai/dsh-tool-goal'
+
+# ── plan mode ───────────────────────────────────────────────────────────────
+
+# Plan state is per-agent by nature, so an entry-local realm is not a
+# workaround here — it is the correct lifetime.
+- id: planning
+  name: cordis:group
+  group: true
+  isolate:
+    planMode: true
+  config:
+    - id: plan-mode
+      name: '@deepseek-ai/dsh-plan-mode'
+      config:
+        section: |
+              You are in plan mode. Stay in plan mode until exit_plan_mode succeeds or the user switches the session mode. Imperative language to implement changes means plan the implementation, not execute it. A user's conversational agreement — including an answer confirming something you asked — approves nothing and does not end plan mode; fold the confirmed decision into the plan and submit it through exit_plan_mode.
+
+              Explore first. Use non-mutating reads, searches, static analysis, and checks to ground the plan in the actual repository. Do not edit or write files, change configuration, run formatters or code generation that rewrites tracked files, commit, or otherwise carry out the plan. Prefer existing functions and patterns over new machinery.
+
+              The tool catalog stays the same across modes for request-cache stability. These plan-mode rules override any later tool description or guidance that suggests using mutation tools; those tools remain listed to keep the tool catalog unchanged. Do not use todo_write to track this planning phase: it tracks implementation after an approved plan, while the plan itself belongs in exit_plan_mode.
+
+              Resolve discoverable facts by inspection. Use ask_user_question only for user-owned choices or material ambiguity that inspection cannot answer. Do not ask the user where code lives or how current behavior works when you can find out.
+
+              Make the plan decision-complete: state the goal and success criteria; group implementation changes by subsystem; identify public API, schema, and data-flow changes; cover edge cases, failure modes, tests, acceptance criteria, and explicit assumptions. Keep it concise enough to review but detailed enough that another engineer can implement it without making design decisions.
+
+              When ready, call exit_plan_mode with the complete plan markdown, starting with a # title. Make exit_plan_mode the only and final tool call in that assistant response: it presents the plan for approval, and implementation begins only in a later step after approval. Do not paste the final plan as a plain reply or ask "should I proceed?" through prose or ask_user_question. If review rejects it, incorporate the feedback and present again. If the review channel is unavailable or aborted, stay in plan mode and ask the user to switch modes manually; do not proceed with implementation.
+
+# ── compaction ──────────────────────────────────────────────────────────────
+
+# `compaction-basic` reads `toolResultPrune` through `ctx.get`, so the pruner must
+# share this realm rather than sit outside it.
+#
+# `tokenMeter` is deliberately NOT in this realm: the meter stays on the HOST
+# plane, and the rows here resolve that one instance. It takes no configuration,
+# keys every fold by Session, and owns the context-meter projection units the
+# browser reads for every session — behind a realm those units would come and go
+# with whichever presets happen to be mounted. What a preset chooses is whether
+# its agent compacts at all, which is `compaction-basic` below.
+- id: compaction
+  name: cordis:group
+  group: true
+  isolate:
+    compaction: true
+    toolResultPruner: true
+  config:
+    - id: compaction-basic
+      name: '@deepseek-ai/dsh-compaction-basic'
+
+    - id: command-compact
+      name: '@deepseek-ai/dsh-command-compact'
+
+    - id: tool-result-pruner
+      name: '@deepseek-ai/dsh-compaction-tool-result-pruner'
+      config:
+        thresholdChars: 8192
+        headChars: 4096
+        tailChars: 1024
+
+# ── delegation and workflows ────────────────────────────────────────────────
+
+# The `subagents` registry and its spawn/fork backends live in the HOST
+# composition: the registry is a process singleton whose cross-session queries
+# the api-proxy serves to the browser, and a provider name may only be
+# registered once. This preset contributes the delegation TOOLS, which resolve
+# that host registry.
+#
+# `workflows` is different — nothing outside an agent reads it — so every row
+# that reaches it shares one entry-local realm here, and a consumer left
+# outside would resolve a host registry this preset does not populate.
+#
+# `tool-subagent-report` is host-plane for the same reason as the registry,
+# not because a preset may not want it: it registers a CONTINUABLE SETUP on
+# that singleton rather than a tool this agent calls, and the setup list is
+# not scope-aware — one copy per mounted preset means every child gets
+# `report` registered once per live session, which throws on the second.
+- id: delegation
+  name: cordis:group
+  group: true
+  isolate:
+    workflowEngine: true
+  config:
+    - id: tool-subagent-control
+      name: '@deepseek-ai/dsh-tool-subagent-control'
+
+    - id: tool-subagent-list-agents
+      name: '@deepseek-ai/dsh-tool-subagent-control/list-agents'
+
+    - id: tool-subagent
+      name: '@deepseek-ai/dsh-tool-subagent'
+      config:
+        provider: spawn
+        toolName: subagent
+        backgroundMode: continuable
+
+    - id: tool-subagent-fork
+      name: '@deepseek-ai/dsh-tool-subagent'
+      config:
+        provider: fork
+        toolName: subagent_fork
+        backgroundMode: continuable
+
+    # Product providers are host-plane singletons. Copy this preset, then
+    # remove `disabled` from either ordinary tool row to expose that product
+    # only to agents composed from the copy.
+    - id: tool-subagent-codex
+      name: '@deepseek-ai/dsh-tool-subagent'
+      disabled: true
+      config:
+        provider: codex
+        toolName: subagent_codex
+        enableRunInBackground: false
+        maxDepth: provider-managed
+
+    - id: tool-subagent-claude-code
+      name: '@deepseek-ai/dsh-tool-subagent'
+      disabled: true
+      config:
+        provider: claude-code
+        toolName: subagent_claude_code
+        enableRunInBackground: false
+        maxDepth: provider-managed
+
+    - id: workflow-worker-thread
+      name: '@deepseek-ai/dsh-workflow-worker-thread'
+      config:
+        provider: spawn
+
+    - id: tool-workflow
+      name: '@deepseek-ai/dsh-tool-workflow'
+
+    - id: tool-ralph
+      name: '@deepseek-ai/dsh-tool-ralph'
+      config:
+        subagentProvider: spawn
+        maxRounds: 64
+
+# ── remaining model-facing rows ─────────────────────────────────────────────
+
+- id: tool-ask-user
+  name: '@deepseek-ai/dsh-tool-ask-user'
+
+- id: tool-todo
+  name: '@deepseek-ai/dsh-tool-todo'
+  config:
+    allowParallelInProgress: true
+
+# The `web` service and its search provider stay in the host composition; only
+# the model-facing tool is per-session.
+- id: tool-web
+  name: '@deepseek-ai/dsh-tool-web'
+  config:
+    fetch: false
+    searchTimeoutMs: 60000