dsh-plugin-prompt-tool 0.7.2 → 0.8.1

package/engine/compositions/library/tool-fs-search.yml

@@ -1,18 +1,9 @@
 # module: tool-fs-search
-# source: D:\AI\GitHub\deepseek-harness/packages/preset/agent-presets/presets/standard/agent.cordis.yml
+# source: master/packages/bundle/web-app/presets/standard.patch.yml
+# commit: c36a83ff6bb95e3f82cf79f9be7c724270a8aa61
 # local patches: 0
 
 - id: tool-fs-search
   name: '@deepseek-ai/dsh-tool-fs-search'
   config:
     sampleOverCapGlobResults: false
-
-# ── background jobs ────────────────────────────────────────────────────────
-
-# Only the model-facing controls. The task REGISTRY stays on the host plane:
-# its producers sit outside any realm this file could put it in — `tool-bash`
-# above resolves it with `ctx.get`, and an entry-local realm here is invisible
-# to every sibling row, so `run_in_background` would answer "background jobs
-# unavailable" while these controls sat in the catalog. The registry is keyed by
-# owning agent anyway, so one host instance serves every session. What a preset
-# chooses is whether its agent can collect and stop background work at all.

package/engine/compositions/library/tool-fs.yml

@@ -1,10 +1,7 @@
 # module: tool-fs
-# source: D:\AI\GitHub\deepseek-harness/packages/preset/agent-presets/presets/standard/agent.cordis.yml
+# source: master/packages/bundle/web-app/presets/standard.patch.yml
+# commit: c36a83ff6bb95e3f82cf79f9be7c724270a8aa61
 # local patches: 0
 
-# ── filesystem ──────────────────────────────────────────────────────────────
-
-# Both register into the host `tools` registry and provide nothing, so
-# they need no realm. The `fs` service and its policy stay in the host.
 - id: tool-fs
   name: '@deepseek-ai/dsh-tool-fs'

package/engine/compositions/library/tool-goal.yml

@@ -1,11 +1,7 @@
 # module: tool-goal
-# source: D:\AI\GitHub\deepseek-harness/packages/preset/agent-presets/presets/standard/agent.cordis.yml
+# source: master/packages/bundle/web-app/presets/standard.patch.yml
+# commit: c36a83ff6bb95e3f82cf79f9be7c724270a8aa61
 # local patches: 0
 
 - id: tool-goal
   name: '@deepseek-ai/dsh-tool-goal'
-
-# ── plan mode ───────────────────────────────────────────────────────────────
-
-# Plan state is per-agent by nature, so an entry-local realm is not a
-# workaround here — it is the correct lifetime.

package/engine/compositions/library/tool-jobs.yml

@@ -1,23 +1,7 @@
 # module: tool-jobs
-# source: D:\AI\GitHub\deepseek-harness/packages/preset/agent-presets/presets/standard/agent.cordis.yml
+# source: master/packages/bundle/web-app/presets/standard.patch.yml
+# commit: c36a83ff6bb95e3f82cf79f9be7c724270a8aa61
 # local patches: 0
 
-# ── background jobs ────────────────────────────────────────────────────────
-
-# Only the model-facing controls. The task REGISTRY stays on the host plane:
-# its producers sit outside any realm this file could put it in — `tool-bash`
-# above resolves it with `ctx.get`, and an entry-local realm here is invisible
-# to every sibling row, so `run_in_background` would answer "background jobs
-# unavailable" while these controls sat in the catalog. The registry is keyed by
-# owning agent anyway, so one host instance serves every session. What a preset
-# chooses is whether its agent can collect and stop background work at all.
 - id: tool-jobs
   name: '@deepseek-ai/dsh-tool-jobs'
-
-# ── skills ──────────────────────────────────────────────────────────────────
-
-# The skill REGISTRY lives in the host composition and is layered per scope:
-# these rows register into THIS preset's layer of it, so they need no realm.
-# `skill-filesystem` contributes local-root discovery for agents on this preset, and
-# `tool-skill` gives them the catalog and loader; the merged catalog also
-# carries whatever the deployment registered globally (repository plugins).

package/engine/compositions/library/tool-plugin-manager-disabled.yml

@@ -0,0 +1,8 @@
+# module: tool-plugin-manager-disabled
+# source: master/packages/bundle/web-app/presets/standard.patch.yml
+# commit: c36a83ff6bb95e3f82cf79f9be7c724270a8aa61
+# local patches: 0
+
+- id: tool-plugin-manager
+  name: '@deepseek-ai/dsh-plugin-manager/tools'
+  disabled: true

package/engine/compositions/library/tool-plugin-manager.yml

@@ -0,0 +1,8 @@
+# module: tool-plugin-manager
+# source: master/packages/bundle/web-app/presets/cordis.patch.yml
+# commit: c36a83ff6bb95e3f82cf79f9be7c724270a8aa61
+# local patches: 0
+
+- id: tool-plugin-manager
+  name: '@deepseek-ai/dsh-plugin-manager/tools'
+  disabled: !!js "!ctx.get('profileContext')"

package/engine/compositions/library/tool-present.yml

@@ -0,0 +1,7 @@
+# module: tool-present
+# source: master/packages/bundle/web-app/presets/standard.patch.yml
+# commit: c36a83ff6bb95e3f82cf79f9be7c724270a8aa61
+# local patches: 0
+
+- id: present
+  name: '@deepseek-ai/dsh-tool-present'

package/engine/compositions/library/tool-presentation.yml

@@ -0,0 +1,9 @@
+# module: tool-presentation
+# source: master/packages/bundle/web-app/presets/ptc.patch.yml
+# commit: c36a83ff6bb95e3f82cf79f9be7c724270a8aa61
+# local patches: 0
+
+- id: tool-presentation
+  name: '@deepseek-ai/dsh-agent-tool-presentation'
+  config:
+    mode: ptc

package/engine/compositions/library/tool-pwsh.yml

@@ -1,12 +1,8 @@
 # module: tool-pwsh
-# source: D:\AI\GitHub\deepseek-harness/packages/preset/agent-presets/presets/standard/agent.cordis.yml
+# source: master/packages/bundle/web-app/presets/standard.patch.yml
+# commit: c36a83ff6bb95e3f82cf79f9be7c724270a8aa61
 # local patches: 0
 
 - id: tool-pwsh
   name: '@deepseek-ai/dsh-tool-pwsh'
   disabled: !!js process.platform !== 'win32'
-
-# ── filesystem ──────────────────────────────────────────────────────────────
-
-# Both register into the host `tools` registry and provide nothing, so
-# they need no realm. The `fs` service and its policy stay in the host.

package/engine/compositions/library/tool-skill.yml

@@ -0,0 +1,7 @@
+# module: tool-skill
+# source: master/packages/bundle/web-app/presets/standard.patch.yml
+# commit: c36a83ff6bb95e3f82cf79f9be7c724270a8aa61
+# local patches: 0
+
+- id: tool-skill
+  name: '@deepseek-ai/dsh-tool-skill'

package/engine/compositions/library/tool-todo.yml

@@ -1,11 +1,9 @@
 # module: tool-todo
-# source: D:\AI\GitHub\deepseek-harness/packages/preset/agent-presets/presets/standard/agent.cordis.yml
+# source: master/packages/bundle/web-app/presets/standard.patch.yml
+# commit: c36a83ff6bb95e3f82cf79f9be7c724270a8aa61
 # local patches: 0
 
 - id: tool-todo
   name: '@deepseek-ai/dsh-tool-todo'
   config:
     allowParallelInProgress: true
-
-# The `web` service and its search provider stay in the host composition; only
-# the model-facing tool is per-session.

package/engine/compositions/library/tool-web.yml

@@ -1,5 +1,6 @@
 # module: tool-web
-# source: D:\AI\GitHub\deepseek-harness/packages/preset/agent-presets/presets/standard/agent.cordis.yml
+# source: master/packages/bundle/web-app/presets/standard.patch.yml
+# commit: c36a83ff6bb95e3f82cf79f9be7c724270a8aa61
 # local patches: 0
 
 - id: tool-web

package/engine/compositions/source/local/character-tools.yml

@@ -0,0 +1,5 @@
+# module: character-tools
+# source: engine/compositions/source/local/character-tools.yml (本地附加,非官方模块)
+
+- id: character-tools
+  name: ./engine/character-tools.mjs

package/engine/compositions/source/local/declared-triggers.yml

@@ -0,0 +1,12 @@
+# module: declared-triggers
+# source: 本地新增（B7 声明式触发器：preset.yml 顶层 triggers 段 → triggers.yml → 本模块注册）
+# 声明由预设提供，引擎不带默认（2026-09-22 拍板）：triggers.yml 缺失 = 没有声明，不注册任何
+# 触发器、也不让预设启动失败（与 subagent-tool-policy 的 ENOENT 降级同一纪律）。
+# 本行由 writePreset 按「有 triggers 段」自动装配（见 src/host/manifest.ts 的 implied modules）。
+# triggersFile 是**初值**：迁移/物化时由 preset-install 的 ENGINE_MANAGED_PATHS 改写成
+# ../<presetId>/triggers.yml（与 subagent-tool-policy 的 policyFile 同一规则）。
+
+- id: declared-triggers
+  name: ./engine/declared-triggers.mjs
+  config:
+    triggersFile: ../triggers.yml

package/engine/compositions/source/local/filesystem-editor.yml

@@ -0,0 +1,30 @@
+# module: filesystem-editor
+# source: engine/compositions/source/local/filesystem-editor.yml (本地能力)
+# rc.2 官方 minimal 只保留单 shell 工具，不再提供 filesystem 组；本模块保留为
+# 本插件自己的引导期文件系统能力，只由显式声明本模块的预设装配（既有用户预设可继续引用）。
+#
+# 能力提供者边界（T4 文件归属校正）：本行行下的 str-replace-editor 是**官方实现**
+# —— `@deepseek-ai/dsh-tool-str-replace-editor`（官方包，配置声明与注册都在包内），
+# 本仓库**没有**对应的 .mjs。它连同 subagent-tool-policy、tool-config-engine 一起
+# 构成 PLAN T4 的三个能力提供者，三者都不接入 engine/trigger.mjs。
+# 判据：会给模型提供可调用能力（注册工具/域）的 → 能力提供者；干预流程
+# （改提示词、改装配、裁决、追加）的 → 声明式触发器。
+# 注意 engine/tool-git-bash.mjs 提供的是 `bash` 工具，**不是**这第三个提供者。
+
+# The bare local filesystem shadows the host's sandboxed provider only for this
+# preset. The editor shares that realm and requires absolute paths.
+- id: filesystem-editor
+  name: cordis:group
+  group: true
+  isolate:
+    fs: true
+  config:
+    - id: fs-local
+      name: '@deepseek-ai/dsh-fs-local'
+      config:
+        cwd: !!js process.env.DSH_CWD ?? process.cwd()
+
+    - id: str-replace-editor
+      name: '@deepseek-ai/dsh-tool-str-replace-editor'
+      config:
+        maxOutputChars: 16000

package/engine/compositions/source/local/instruction-hint.yml

@@ -0,0 +1,15 @@
+# module: instruction-hint
+# source: engine/compositions/source/local/instruction-hint.yml (本地附加,非官方模块)
+# context-gate 的 instructionHint 转换在本模块的归属行——删除前的原始语义见
+# context-gate.mjs:64-66，替换点 :243-248，pre-step 挂载 :226-255：晋升后把
+# agent-instructions 全文换成一次性非命令式 hint，后续全文 dump 丢弃。
+# opt-in：enabled 默认 false（与原 instructionHint 默认 false 同值），由参数桥
+# params.instructionHint（→ 本行 enabled）或本行 config.enabled: true 打开；
+# 相位词汇与 tool-bootstrap / promoted-code-mode 同源（compaction-epoch.mjs）。
+
+- id: instruction-hint
+  name: ./engine/instruction-hint.mjs
+  config:
+    enabled: false
+    promoteOn: either
+    includeSubagents: false

package/engine/compositions/{library/official-persistent-shell.yml → source/local/persistent-shell-posix.yml}

@@ -1,9 +1,14 @@
-# module: official-persistent-shell
-# source: deepseek-harness official minimal agent preset (persistent-shell)
+# module: persistent-shell-posix
+# source: engine/compositions/source/local/persistent-shell-posix.yml (本地适配)
+# based on: dsh-v0.1.5-rc.2 minimal/agent.cordis.yml#persistent-shell
+# commit: fb2c4b9e698e30edb738bca4cf0618587db7d203
+# 本地差异：Windows 禁用整组；POSIX 缺少 /bin/bash 时从 PATH 查找 bash。
+# 保留原组内服务、工具配置与隔离域，不改变工具名和权限边界。
 
-- id: persistent-shell
+- id: persistent-shell-posix
   name: cordis:group
   group: true
+  disabled: !!js process.platform === 'win32'
   isolate:
     terminals: true
   config:
@@ -14,6 +19,7 @@
       name: '@deepseek-ai/dsh-terminal-bash'
       disabled: !!js process.platform === 'win32'
       config:
+        shellPath: !!js "process.getBuiltinModule?.('node:fs')?.existsSync('/bin/bash') ? '/bin/bash' : 'bash'"
         timeoutMs: 300000
 
     - id: persistent-bash
@@ -24,8 +30,7 @@
         description: |-
           Run commands in a bash shell
           * When invoking this tool, the contents of the "command" parameter does NOT need to be XML-escaped.
-          * You don't have access to the internet via this tool.
-          * You do have access to a mirror of common linux and python packages via apt and pip.
+          * Network access depends on the task environment. Prefer configured mirrors/proxies when they are available.
           * State is persistent across command calls and discussions with the user.
           * To inspect a particular line range of a file, e.g. lines 10-25, try 'sed -n 10,25p /path/to/the/file'.
           * Please avoid commands that may produce a very large amount of output.
@@ -51,6 +56,3 @@
           * Use native Windows paths (C:\...) and $env:NAME variables; this is PowerShell, not bash.
           * Please avoid commands that may produce a very large amount of output.
           * Please run long lived commands in the background, e.g. 'Start-Job' or start a server with Start-Process.
-
-# The bare local filesystem shadows the host's sandboxed provider only for this
-# preset. The editor shares that realm and requires absolute paths.

package/engine/compositions/source/local/prompt-config-engine.yml

@@ -1,13 +1,7 @@
+# module: prompt-config-engine
+# source: engine/compositions/source/local/prompt-config-engine.yml (本地附加,非官方模块)
+
 - id: prompt-config-engine
   name: ./engine/prompt-config-engine.mjs
   config:
     configsDir: ../prompt-configs
-
-# ── PTC run_code environment (prompt-tool local addition) ──────────────────
-#
-# Official Code Mode runs the model program in a worker with env={}; the
-# program cannot read system environment. This row patches the reserved
-# run_code transport so every program gets a frozen `env` global containing
-# the whitelisted non-secret host variables below plus managed DSH_* facts
-# and DSH_WORKSPACE. Add deployment-specific names to envKeys as needed.
-# Credential-shaped names (KEY/PASSWORD/SECRET/TOKEN) are always rejected.

package/engine/compositions/source/local/run-code-env.yml

@@ -1,12 +1,9 @@
+# module: run-code-env
+# source: engine/compositions/source/local/run-code-env.yml (本地附加,非官方模块)
+# 为 PTC run_code 注入冻结的非敏感环境变量快照；凭据形态键始终拒绝。
+
 - id: run-code-env
   name: ./engine/run-code-env.mjs
   config:
     enabled: true
     envKeys: [PATH, PATHEXT, HOME, USERPROFILE, USERNAME, COMPUTERNAME, OS, TEMP, TMP, SystemRoot, ProgramFiles, ProgramFiles(x86), LOCALAPPDATA, APPDATA]
-
-# ── identity ────────────────────────────────────────────────────────────────
-
-# Keep this text byte-identical to the Minimal preset. `complete` prevents the
-# Harness identity and per-tool guidance from changing the system prompt, while
-# runtime-context suppression leaves task and repository rules to user messages
-# and explicit file reads. Tool schemas and their runtime enforcement remain.

package/engine/compositions/source/local/session-var-tools.yml

@@ -0,0 +1,5 @@
+# module: session-var-tools
+# source: engine/compositions/source/local/session-var-tools.yml (本地附加,非官方模块)
+
+- id: session-var-tools
+  name: ./engine/session-var-tools.mjs

package/engine/compositions/source/local/skill-search.yml

@@ -1,11 +1,5 @@
+# module: skill-search
+# source: engine/compositions/source/local/skill-search.yml (本地附加,非官方模块)
+
 - id: skill-search
   name: ./engine/skill-search.mjs
-
-# ── goals ───────────────────────────────────────────────────────────────────
-
-# Only the model-facing tool. The goal SERVICE, its session driver, and the
-# `/goal` command stay on the host plane: the Gateway serves the goal domain as
-# Remote endpoints whose receiver comes from a generated descriptor, so it
-# resolves `goals` on the host and an entry-local realm here would hide it. The
-# registry is keyed by session anyway, so one host instance serves every
-# session. What a preset chooses is whether its agent can call the goal tool.

package/engine/compositions/source/local/subagent-tool-policy.yml

@@ -0,0 +1,21 @@
+# module: subagent-tool-policy
+# source: 本地新增（子代理实例级工具策略：agent-scoped subagent/subagent_fork shadow）
+# 策略数据源 = 预设目录 subagent-tools/policy.yml（writePreset 从 preset.yml 顶层
+# subagentToolPolicy 物化）。策略启用时参数桥不再把主代理 toolFilter 写入
+# delegation.toolFilter；未启用策略的预设完全保持官方 delegation 行为。
+#
+# 能力提供者边界（T4）：本行是**能力提供者**（给模型提供 subagent/subagent_fork 两个
+# 可调用工具），**不接入** engine/trigger.mjs。判据：会给模型提供可调用能力
+# （注册工具/域）的 → 能力提供者；干预流程（改提示词、改装配、裁决、追加）的 →
+# 声明式触发器。登记数据在 engine/subagent-tool-policy.mjs 的 `engineProvider`
+# 导出，与 `engineTriggers`（声明式触发器）互斥；守卫见
+# test/engine/provider-boundary.test.mjs。模块内扩权审批门与 fail loud 语义是安全
+# 边界，改装配方式时不得放宽。
+
+- id: subagent-tool-policy
+  name: ./engine/subagent-tool-policy.mjs
+  config:
+    policyFile: ../subagent-tools/policy.yml
+    spawnProvider: spawn
+    forkProvider: fork
+    maxDepth: 3

package/engine/compositions/source/local/tool-bash-disabled.yml

@@ -0,0 +1,9 @@
+# module: tool-bash-disabled
+# source: engine/compositions/source/local/tool-bash-disabled.yml (本地适配)
+# based on: dsh-v0.1.5-rc.2 standard/agent.cordis.yml#tool-bash
+# commit: fb2c4b9e698e30edb738bca4cf0618587db7d203
+# 声明本模块的预设改用持久 bash 或 Windows Git Bash，因此本行保持显式禁用，不属于原样官方模块。
+
+- id: tool-bash-disabled
+  name: '@deepseek-ai/dsh-tool-bash'
+  disabled: true

package/engine/compositions/source/local/tool-config-engine.yml

@@ -2,6 +2,14 @@
 # source: 本地新增（自定义工具引擎：preset.yml customTools 段 → 渲染 custom-tools/ → 运行时注册）
 # 工具定义在预设目录 custom-tools/*.yml；执行器 shell/http/delegate/fs/ask-user。
 # requireApproval 数组可列出需 approval 门的执行器（默认空 = 不要求）。
+#
+# 能力提供者边界（T4）：本行是**能力提供者**（把预设声明的自定义工具注册进官方
+# registry），**不接入** engine/trigger.mjs。判据：会给模型提供可调用能力
+# （注册工具/域）的 → 能力提供者；干预流程（改提示词、改装配、裁决、追加）的 →
+# 声明式触发器。登记数据在 engine/tool-config-engine.mjs 的 `engineProvider` 导出
+# （provides.kind = 'dynamic'：工具名在装配期才由 customTools 段决定），与
+# `engineTriggers`（声明式触发器）互斥；守卫见 test/engine/provider-boundary.test.mjs。
+# 模块内 approvalGate 与 withinCwd 是安全边界，改装配方式时不得放宽。
 
 - id: tool-config-engine
   name: ./engine/tool-config-engine.mjs

package/engine/compositions/source/local/tool-git-bash.yml

@@ -0,0 +1,15 @@
+# module: tool-git-bash
+# source: engine/compositions/source/local/tool-git-bash.yml (本地附加,上游 dsh-anchored-standard 移植)
+# Windows Git Bash 适配；与 tool-bash-disabled 同时声明时，普通 tool-bash 保持关闭。
+# config.enabled 是本行的能力开关（引擎未声明 = 关闭）：本模块此前没有开关，靠「行在组合里」
+# 即启用，故这里补显式 true 保持既有装配结果不变。
+# 下面的 disabled 只是**平台条件**（非 Windows 不装配），不是能力开关；disabled: 只用于平台
+# 条件、树内子项与命名禁用变体（见 tool-bash-disabled.yml），能力启停一律走 config.enabled。
+
+- id: tool-git-bash
+  name: ./engine/tool-git-bash.mjs
+  disabled: !!js process.platform !== 'win32'
+  config:
+    enabled: true
+    timeoutMs: 120000
+    maxOutputBytes: 64000

package/engine/compositions/source/local/world-book-tools.yml

@@ -0,0 +1,5 @@
+# module: world-book-tools
+# source: engine/compositions/source/local/world-book-tools.yml (本地附加,非官方模块)
+
+- id: world-book-tools
+  name: ./engine/world-book-tools.mjs

package/engine/condition.mjs

@@ -0,0 +1,83 @@
+/**
+ * condition — 声明式条件判定的共享实现（pre-step / tool-pipeline / 事件层共用）。
+ *
+ * 匹配语义来自 anchor-match.mjs：键集合由 schema.mjs 在挂载期归一化并预编译为
+ * `config.matchScan`（非法 logic / 空键集合 / 非法正则在挂载期 fail loud）。
+ * 本模块只负责「按 subject 取文本」与「是否命中」两件事。
+ *
+ * 语义约定：
+ *   - 未声明 match 的配置是**无条件**的（与引入条件判定前逐字一致）；
+ *   - 取不到匹配文本（字段缺失、类型不符、序列化失败）一律按空串处理，即不命中；
+ *   - 判定异常不抛出：门配错不应该阻断正常链路。
+ */
+
+import { extractText, sessionEvents } from './shared.mjs'
+
+/** subject → 载荷字段名。改这里等于改所有层的匹配对象。 */
+const SUBJECT_FIELDS = {
+  toolArgs: 'argsText',
+  toolResult: 'resultText',
+  userMessage: 'userText',
+  assistantText: 'assistantText',
+  subagentInfo: 'subagentText',
+}
+
+/** 按 subject 取参与匹配的文本；取不到一律空串（不命中，不抛错）。 */
+export function subjectTextOf(subject, payload) {
+  if (payload === undefined || payload === null) return ''
+  const field = SUBJECT_FIELDS[subject]
+  return field !== undefined && typeof payload[field] === 'string' ? payload[field] : ''
+}
+
+/**
+ * 条件判定：未声明 match 恒真。
+ * 消费 schema 预编译的 `config.matchScan`；外部手工构造的 config 没有该函数时按无条件处理。
+ */
+export function conditionHit(config, payload) {
+  if (config?.match === undefined) return true
+  const scan = config.matchScan
+  if (typeof scan !== 'function') return true
+  try {
+    return scan(subjectTextOf(config.subject, payload)).active === true
+  } catch {
+    return true
+  }
+}
+
+/** 工具参数的可匹配文本：对象按 JSON 序列化，字符串原样；序列化失败按空串。 */
+export function toolArgsText(args) {
+  if (typeof args === 'string') return args
+  try {
+    return JSON.stringify(args ?? {})
+  } catch {
+    return ''
+  }
+}
+
+/** pre-step 的缺省匹配对象：本批用户消息的文本。 */
+export function userMessagesText(messages) {
+  if (!Array.isArray(messages)) return ''
+  return messages
+    .filter((message) => message?.role === 'user')
+    .map((message) => extractText(message))
+    .filter((text) => text.length > 0)
+    .join('\n')
+}
+
+/** 最后一条 assistant 消息的文本（turn-stop 的缺省匹配对象）。 */
+export function lastAssistantText(session) {
+  const events = sessionEvents(session)
+  for (let index = events.length - 1; index >= 0; index -= 1) {
+    if (events[index]?.type === 'assistant/message') return extractText(events[index].data)
+  }
+  return ''
+}
+
+/** 子代理事件的匹配文本：事件载荷序列化，取不到即空串。 */
+export function subagentTextOf(info) {
+  try {
+    return JSON.stringify(info ?? {})
+  } catch {
+    return ''
+  }
+}

package/engine/declared-triggers.mjs

@@ -0,0 +1,93 @@
+/**
+ * declared-triggers — 声明式触发器的运行时（B7）。
+ *
+ * 链路：`preset.yml` 顶层 `triggers` 段 →（`writePreset` 保存期校验 + 物化）→ 预设根
+ * `triggers.yml` → 本模块读入、编译、注册。
+ *
+ * ## 声明由预设提供，引擎不带默认（2026-09-22 拍板）
+ *
+ * 所以 `triggers.yml` 缺失 = **没有声明**，不是错误：不注册任何触发器，也不让预设启动失败
+ * ——与 `subagent-tool-policy` 的 ENOENT 降级同一纪律。文件在但内容非法才是真错误：
+ * fail loud（且保存期就会先被 `engine/trigger-spec.mjs` 拒一次，这里是第二道）。
+ *
+ * ## 为什么 `apply` 是 async
+ *
+ * `preset` 原语要在**挂载期一次**解析官方模块导出（判定期零 IO，见 `predicates.mjs` 的
+ * 三条硬约束），而那是动态 import。async `apply` 有官方先例（`dsh-api-remotes`、
+ * `dsh-client-connection`），本仓库此前没有——这是第一处。
+ */
+import { readFileSync } from 'node:fs'
+import { isAbsolute } from 'node:path'
+import { fileURLToPath, pathToFileURL } from 'node:url'
+import { parse as parseYaml } from './vendor/yaml/index.js'
+import { defineConfig, passthrough } from './fields.mjs'
+import { createWarnOnce, keepDisposer } from './shared.mjs'
+import { compileDeclarations, mountDeclarations } from './trigger-spec.mjs'
+import { loadStandingMountFor } from './predicates.mjs'
+
+/** Cordis plugin name used by loader diagnostics. */
+export const name = 'declared-triggers'
+
+/** 只经 `ctx.on`（动作注册）与 agent scope 的 tools 工作，无宿主服务依赖。 */
+export const inject = []
+
+export const configContract = defineConfig({
+  triggersFile: passthrough((value) => (typeof value === 'string' && value.length > 0 ? value : '../triggers.yml')),
+  strategyDir: passthrough((value) => (typeof value === 'string' && value.length > 0 ? value : undefined)),
+  presetRoot: passthrough((value) => (typeof value === 'string' && value.length > 0 ? value : undefined)),
+})
+
+/**
+ * 插件装配由注册层传入声明文件的绝对 file URL；引擎实现始终来自已安装插件包。
+ * 独立使用时才按本模块 URL 解析相对值，缺省路径不代表任何用户预设目录。
+ *
+ * 绝对路径必须走 `isAbsolute` 分支：`new URL(绝对路径, base)` 只在 POSIX 形态下忽略 base，
+ * Windows 盘符会被当成 URL scheme 并抛 `ERR_INVALID_URL_SCHEME`。而「测试/嵌入可显式
+ * 指定绝对路径」是本模块的契约（`loadStandingMountFor(entry)` 有同一约定）。
+ */
+function resolveTriggersFile(config) {
+  const raw = typeof config?.triggersFile === 'string' && config.triggersFile.length > 0
+    ? config.triggersFile
+    : '../triggers.yml'
+  if (isAbsolute(raw)) return raw
+  return fileURLToPath(new URL(raw, import.meta.url))
+}
+
+/** 读声明；文件缺失返回 `undefined`（= 没有声明，交由调用方静默返回）。 */
+function readTriggerSpecs(file) {
+  let raw
+  try {
+    raw = readFileSync(file, 'utf8')
+  } catch (error) {
+    if (error?.code === 'ENOENT') return undefined
+    throw error
+  }
+  const parsed = parseYaml(raw, { logLevel: 'silent' })
+  if (!Array.isArray(parsed)) {
+    throw new TypeError(`${name}: triggers.yml must be a YAML array of trigger declarations`)
+  }
+  return parsed
+}
+
+export async function apply(ctx, config) {
+  const source = configContract.parse(config, name)
+  const file = resolveTriggersFile(source)
+  const specs = readTriggerSpecs(file)
+  if (specs === undefined || specs.length === 0) return
+  // 数据路径相对实际声明文件；允许根由注册层提供，不从包内引擎位置猜测用户目录。
+  const templateBaseUrl = pathToFileURL(file)
+  const templatePresetRoot = source.presetRoot === undefined
+    ? new URL('./', templateBaseUrl)
+    : isAbsolute(source.presetRoot) ? pathToFileURL(source.presetRoot.replace(/[\\/]?$/, '/'))
+      : new URL(source.presetRoot.replace(/\/?$/, '/'), templateBaseUrl)
+  const strategyDir = source.strategyDir === undefined ? undefined : (isAbsolute(source.strategyDir)
+    ? pathToFileURL(source.strategyDir).href
+    : new URL(source.strategyDir, templateBaseUrl).href)
+  const promptConfigOptions = { templateBaseUrl, templatePresetRoot, strategyDir }
+  // `preset` 原语需要官方模块导出（判定期零 IO，故在这里一次解析）；其余原语用不到它。
+  const standingMountFor = await loadStandingMountFor()
+  // 声明非法在这里 fail loud——保存期已校验过一次，这里再炸说明文件被绕过保存手改了。
+  const compiled = compileDeclarations(specs, { ctx, standingMountFor, promptConfigOptions })
+  const dispose = mountDeclarations(ctx, compiled, { plugin: name, warnOnce: createWarnOnce(ctx, name) })
+  keepDisposer(ctx, dispose, `${name}: declarations`)
+}