dsh-plugin-tool-management 0.1.3 → 0.5.0

package/lib/index.js

@@ -12,8 +12,14 @@
 // artifact — same convention as DSH's own packages, which ship compiled JS).
 import { defineTool } from '@deepseek-ai/dsh-tools';
 import { createRequire } from 'node:module';
-import { createSkillsService } from './skills/service.js';
+import { createSkillsService, pluginLog } from './skills/service.js';
 import { createAgentsMdService } from './agents-md/service.js';
+import { createRulesService } from './rules/service.js';
+import { createArchiveEngine } from './rules/archive-engine.js';
+import { createSubagentService } from './subagents/service.js';
+import { isApprovalNever } from './approval-policy.js';
+import { hubPath, relocateEntries } from './hub.js';
+import { defineSubagentListTool, defineSubagentRunTool } from './subagents/tools.js';
 import { detectFormat, extractText, parseGenericText, parseJsonlTranscript, parseMarkdownTranscript } from './imports/parsers.js';
 import { homedir } from 'node:os';
 import { spawn } from 'node:child_process';
@@ -70,7 +76,7 @@ export default {
         catch (e) { /* keep unknown */ }
         // Optional access token (defense in depth for LAN exposure). Enabled by
         // setting `config.token` on this plugin's loader row (profile
-        // cordis.patch.yml override) or the DSH_SKILL_MCP_MANAGER_TOKEN env var. When
+        // cordis.patch.yml override) or the DSH_PLUGIN_TOOL_MANAGEMENT_TOKEN env var. When
         // set, every state-changing op requires `x-dsh-token: <token>`. Read-only
         // ops (plugin-version, mcpm-list, skill-state) stay open so the UI still
         // renders; mcpm-export is guarded too because it leaks full configs.
@@ -79,24 +85,6 @@ export default {
         // is not an injected service and throws "cannot get property without
         // inject" at boot.
         const TOKEN = String(config?.token || process.env.DSH_PLUGIN_TOOL_MANAGEMENT_TOKEN || '').trim();
-        const WRITE_OPS = new Set([
-            'mcpm-add', 'mcpm-edit', 'mcpm-remove', 'mcpm-set-enabled', 'mcpm-set-all', 'mcpm-restart',
-            'mcpm-export', 'mcpm-import', 'mcpm-note', 'mcpm-settings', 'mcpm-tool-enabled',
-            // mcpm-reveal returns UNMASKED secrets; even though it is a read, it is
-            // token-gated like a write — on a LAN-exposed port the token must be the
-            // last line of defense for plaintext credentials too, not just writes.
-            'mcpm-reveal',
-            'skill-enable', 'skill-disable', 'skill-source-enable', 'skill-source-disable',
-            'skill-create', 'skill-import', 'skill-upload', 'skill-delete',
-            'skill-trash-restore', 'skill-trash-delete', 'skill-open',
-            'skill-custom-add', 'skill-custom-remove',
-            // agents-md 写操作（create/update/remove 改预设库；apply 写全局 AGENTS.md；import 从外部内容建预设）
-            'agentsmd-create', 'agentsmd-update', 'agentsmd-apply', 'agentsmd-remove', 'agentsmd-import',
-            // history 写操作（archive/unarchive 改归档集合；delete 永久删除；retention-set 写保留期）
-            'history-archive', 'history-unarchive', 'history-delete', 'history-retention-set',
-            'history-unarchive-batch', 'history-delete-batch', 'history-import', 'history-export',
-            'history-archive-batch',
-        ]);
         const wait = (ms) => ctx.timeout(ms);
         const message = (e) => String((e && e.message) || e);
         let writeChain = Promise.resolve();
@@ -119,9 +107,11 @@ export default {
         }
         // ---------- agents-md 预设库 + 切换 ----------
         // DSH 全局指令基线只有 ~/.dsh/AGENTS.md 一个文件，无内置多预设切换；
-        // 本服务在插件目录内 data/agents-md-presets/ 维护预设库，「应用」= 写入
-        // ~/.dsh/AGENTS.md，新会话生效（当前会话不变，DSH 本身如此）。
-        // presetsDir 可由 config 注入（测试用），否则落到插件根 data/。
+        // 本服务在 hub 内 agents-md/ 维护预设库，「应用」= 写入 ~/.dsh/AGENTS.md，
+        // 新会话生效（当前会话不变，DSH 本身如此）。
+        // presetsDir 可由 config 注入（测试用），否则落到 $DSH_HOME/tool-management/agents-md。
+        // v0.4：旧位置（插件目录 data/agents-md-presets/）在启动时搬入 hub——
+        // 插件目录在 npm 安装下会被覆盖，放用户数据在那里本身就丢数据风险。
         const PLUGIN_ROOT = (() => {
             try {
                 return dirname(createRequire(import.meta.url).resolve('../package.json'));
@@ -130,7 +120,10 @@ export default {
                 return process.cwd();
             }
         })();
-        const agentsMdPresetsDir = String(config?.presetsDir || join(PLUGIN_ROOT, 'data', 'agents-md-presets'));
+        const legacyAgentsMdPresetsDir = join(PLUGIN_ROOT, 'data', 'agents-md-presets');
+        const agentsMdPresetsDir = String(config?.presetsDir || hubPath('agents-md'));
+        void relocateEntries(legacyAgentsMdPresetsDir, agentsMdPresetsDir, (n) => n !== '__last-applied__')
+            .catch(() => 0);
         const agentsMdService = createAgentsMdService(ctx, {
             presetsDir: agentsMdPresetsDir,
             getGlobalAgentsMdPath: async () => {
@@ -139,6 +132,194 @@ export default {
                 return p.home + sep + 'AGENTS.md';
             },
         });
+        // ---------- rules（规则/记忆，v0.4）----------
+        // 记忆真源 $DSH_HOME/tool-management/memories/<场景>/<name>.md（仅用户级，D1）。
+        // **场景是显式记录**（rules-index.json 的 scenes 切片）：含保留场景 `global`（界面「全局」，
+        // 其记忆注入任何对话），空场景也合法存在——不再是"恰好有这个目录名"的隐式约定。
+        // 单投影 = 活动场景记忆 → per-agent systemPrompt 段（自动在场，模型无需调用任何工具）。
+        // 原"始终层写 ~/.dsh/AGENTS.md"已下线（变更单 01 §4/§10）：公共基线由 _shared/ 承担。
+        // 旧的 $DSH_HOME/scene-memory 与 $DSH_HOME/rules 由服务在首次读盘前搬入本目录。
+        // rulesRoot / rulesStateDir / rulesScenesDir 仅测试注入，生产留空由服务按 DSH_HOME 解析。
+        const rulesService = createRulesService(ctx, {
+            rulesRoot: String(config?.rulesRoot || ''),
+            stateDir: String(config?.rulesStateDir || ''),
+            scenesDir: String(config?.rulesScenesDir || ''),
+            // 场景记忆段预算（字节），默认 65536；仅用于测试与特殊部署调优。
+            ...(Number.isFinite(Number(config?.rulesMaxBytes))
+                ? { maxBytes: Number(config.rulesMaxBytes) }
+                : {}),
+        });
+        try {
+            ctx.effect(() => rulesService.registerProviders(), 'dsh-plugin-tool-management: rules providers');
+        }
+        catch (e) {
+            console.error('[dsh-plugin-tool-management] rules provider setup failed:', message(e));
+        }
+        // ---------- 场景档案引擎（设计 §2）----------
+        // deps 把既有写通道（MCP 单工具启停 / 技能启停）注入引擎；引擎自身串行，
+        // 状态机与纯逻辑在 ./rules/archive*.ts。mcpmToolEnabled / readDisabledTools
+        // 为函数声明（提升），此处引用安全。
+        const toolKeyParts = (toolName) => {
+            if (!toolName.startsWith('mcp__'))
+                return null;
+            const rest = toolName.slice(5);
+            const i = rest.indexOf('__');
+            if (i <= 0)
+                return null;
+            const server = rest.slice(0, i);
+            const tool = rest.slice(i + 2);
+            return server && tool ? { key: server + '/' + tool, server, tool } : null;
+        };
+        async function toolStates() {
+            const disabled = await readDisabledTools();
+            const states = {};
+            let schemas = [];
+            try {
+                schemas = await tools.schemas();
+            }
+            catch { /* 无 live 工具 → 仅启停表 */ }
+            const liveByServer = {};
+            for (const s of schemas) {
+                const p = toolKeyParts(String((s && s.name) || ''));
+                if (!p)
+                    continue;
+                const list = liveByServer[p.server] || (liveByServer[p.server] = []);
+                if (list.indexOf(p.tool) < 0)
+                    list.push(p.tool);
+            }
+            for (const [server, list] of Object.entries(disabled)) {
+                // 整台停用（['*']）：在 live 工具上展开成具体键，不产出 `server/*` 伪键（那会污染勾选器）。
+                if (list.indexOf('*') >= 0) {
+                    for (const t of (liveByServer[server] || []))
+                        states[server + '/' + t] = false;
+                    continue;
+                }
+                for (const t of list)
+                    states[server + '/' + t] = false;
+            }
+            for (const [server, list] of Object.entries(liveByServer)) {
+                for (const t of list)
+                    if (!(server + '/' + t in states))
+                        states[server + '/' + t] = true;
+            }
+            return states;
+        }
+        async function skillStates() {
+            const r = await skillsService.ops['skill-state']({});
+            const states = {};
+            for (const root of ((r && r.data && r.data.roots) || [])) {
+                for (const sk of (root.skills || [])) {
+                    const name = String(sk.declaredName || sk.name || '');
+                    if (name)
+                        states[String(root.key || '') + '/' + name] = sk.enabled !== false;
+                }
+            }
+            return states;
+        }
+        const archiveService = createArchiveEngine({
+            loadSlice: async () => ({ ...(await rulesService.readArchiveSlice()) }),
+            saveSlice: (slice) => rulesService.patchIndex(slice),
+            configuredServers: async () => {
+                const r = await mcpmListView();
+                const out = [];
+                for (const row of ((r && r.rows) || [])) {
+                    const n = String((row && row.serverName) || '');
+                    if (n && out.indexOf(n) < 0)
+                        out.push(n);
+                }
+                return out;
+            },
+            serverKnownTools: async () => {
+                const out = {};
+                const raw = await readDisabledTools();
+                for (const [server, list] of Object.entries(raw))
+                    out[server] = list.filter((t) => t !== '*');
+                let schemas = [];
+                try {
+                    schemas = await tools.schemas();
+                }
+                catch { /* 无 live 工具 → 仅启停表 */ }
+                for (const s of schemas) {
+                    const p = toolKeyParts(String((s && s.name) || ''));
+                    if (!p)
+                        continue;
+                    const list = out[p.server] || (out[p.server] = []);
+                    if (list.indexOf(p.tool) < 0)
+                        list.push(p.tool);
+                }
+                return out;
+            },
+            currentMcpRaw: () => readDisabledTools(),
+            applyMcpEntries: async (entries) => {
+                const p = await ensurePaths();
+                await withWriteLock(async () => {
+                    await writeJsonFile(sidecarPath(p.home, DISABLED_TOOLS_FILE), entries);
+                });
+                disabledToolsCache = { at: Date.now(), value: entries };
+                scheduleToolRestrictions();
+            },
+            knownSkillKeys: async () => new Set(Object.keys(await skillStates())),
+            currentSkills: skillStates,
+            applySkills: async (target) => {
+                for (const [key, on] of Object.entries(target)) {
+                    const i = key.indexOf('/');
+                    if (i <= 0)
+                        throw new Error(`技能 key 不合法: ${key}`);
+                    const root = key.slice(0, i);
+                    const name = key.slice(i + 1);
+                    const r = await skillsService.ops[on ? 'skill-enable' : 'skill-disable']({ root, name });
+                    if (r && r.ok === false)
+                        throw new Error(`技能 ${key} 应用失败: ${r.error}`);
+                }
+            },
+            sceneExists: async (name) => {
+                const r = await rulesService.ops['rules-list']({});
+                return !!(r && r.ok !== false && (r.scenes || []).some((s) => s.name === name));
+            },
+            // 人设名全集（保存 subagents 段时校验并报 stale，与 mcp/skills 两段同口径）。
+            knownPersonas: async () => new Set((await subagentService.list()).map((p) => p.name)),
+            // 记忆 id 全集（保存 memories 段时校验并报 stale）。
+            knownMemoryIds: async () => {
+                const r = await rulesService.ops['rules-list']({});
+                return new Set(((r && r.rules) || []).filter((x) => !x.shadowed).map((x) => String(x.id)));
+            },
+        });
+        // ---------- 轻量子智能体（设计 §3）----------
+        // 人设 = $DSH_HOME/tool-management/agents/<name>.md；运行走官方 ctx.subagents.start（spawn provider）。
+        // sceneLists 供场景绑定校验：启用场景（rules-list 的 active 行）档案里的 subagents 并集。
+        const subagentService = createSubagentService(ctx, {});
+        const subagentSceneLists = async () => {
+            const slice = await rulesService.readArchiveSlice();
+            const r = await rulesService.ops['rules-list']({});
+            if (!r || r.ok === false)
+                return [];
+            return (r.scenes || [])
+                .filter((s) => s.active)
+                .map((s) => slice.archives[s.name]?.subagents ?? []);
+        };
+        // HTTP 写操作门禁清单。skills/rules/档案引擎域由各自 service 导出的 writeOps 派生
+        // （与其 ops 表同文件维护，新增写 op 改对应 service 即可）；本文件内联域
+        // （mcpm-* / skill-open / agentsmd-* / history-*）在此列举。
+        // 注意：必须在上述 service 创建之后构造（依赖其 writeOps）。
+        const WRITE_OPS = new Set([
+            ...skillsService.writeOps,
+            ...rulesService.writeOps,
+            ...archiveService.writeOps,
+            ...subagentService.writeOps,
+            'mcpm-add', 'mcpm-edit', 'mcpm-remove', 'mcpm-set-enabled', 'mcpm-set-all', 'mcpm-restart',
+            'mcpm-export', 'mcpm-import', 'mcpm-note', 'mcpm-settings', 'mcpm-tool-enabled',
+            // mcpm-reveal returns UNMASKED secrets; even though it is a read, it is
+            // token-gated like a write — on a LAN-exposed port the token must be the
+            // last line of defense for plaintext credentials too, not just writes.
+            'mcpm-reveal',
+            'skill-open',
+            // agents-md 写操作（create/update/remove 改预设库；apply 写全局 AGENTS.md；import 从外部内容建预设）
+            'agentsmd-create', 'agentsmd-update', 'agentsmd-apply', 'agentsmd-remove', 'agentsmd-import',
+            // history 写操作（archive/unarchive 改归档集合；delete 永久删除；retention-set 写保留期）
+            'history-archive', 'history-unarchive', 'history-delete', 'history-retention-set',
+            'history-unarchive-batch', 'history-delete-batch', 'history-import', 'history-export',
+            'history-archive-batch',
+        ]);
         // ---------- history（归档会话管理，折叠自 dsh-archive-manager）----------
         // cordis.patch.yml 禁用官方 workspace 与 session-projection-cache，插入本插件
         // 的归档感知子类（lib/history/workspace.js + lib/history/projcache.js）。子类
@@ -171,15 +352,10 @@ export default {
             }
         }
         async function writeHistoryRetention(retentionDays) {
-            try {
-                const dir = dirname(historyRetentionPath);
-                await mkdir(dir, { recursive: true });
-                // updatedAt = 修改时刻：每次改保留期，已归档会话的到期基线重置为此时刻。
-                await writeFile(historyRetentionPath, JSON.stringify({ retentionDays, updatedAt: Date.now() }), 'utf8');
-            }
-            catch (e) {
-                console.error('[dsh-plugin-tool-management] write history-retention failed:', message(e));
-            }
+            const dir = dirname(historyRetentionPath);
+            await mkdir(dir, { recursive: true });
+            // updatedAt = 修改时刻：每次改保留期，已归档会话的到期基线重置为此时刻。
+            await writeFile(historyRetentionPath, JSON.stringify({ retentionDays, updatedAt: Date.now() }), 'utf8');
         }
         /**
          * 计算到期应删的归档会话。基线 = max(archivedAt（账本）?? createdAt（元数据),
@@ -899,7 +1075,7 @@ export default {
                 return { ok: true, notes: map };
             });
         }
-        const SETTINGS_DEFAULTS = { pollIntervalMs: 5000, toolDescriptionMaxLength: 0 };
+        const SETTINGS_DEFAULTS = { pollIntervalMs: 5000, toolDescriptionMaxLength: 0, requireConfirmForModelRuleWrite: true, requireConfirmForModelSubagentRun: true };
         let pluginSettingsCache = null;
         function clampInt(value, min, max, fallback) {
             // Number(null) is 0 — treat missing/empty input as "use the default".
@@ -921,6 +1097,14 @@ export default {
                     pollIntervalMs: clampInt(raw && raw.pollIntervalMs, 2000, 60000, SETTINGS_DEFAULTS.pollIntervalMs),
                     // 0 = keep descriptions in full (the UI default); > 0 truncates.
                     toolDescriptionMaxLength: clampInt(raw && raw.toolDescriptionMaxLength, 0, 2000, SETTINGS_DEFAULTS.toolDescriptionMaxLength),
+                    // 模型写规则需确认（D2）：程序化强制，只读设置供 tools/pre-execute 判定。
+                    requireConfirmForModelRuleWrite: (raw && typeof raw.requireConfirmForModelRuleWrite === 'boolean')
+                        ? raw.requireConfirmForModelRuleWrite
+                        : SETTINGS_DEFAULTS.requireConfirmForModelRuleWrite,
+                    // 子代理运行花真 token：默认确认，设置可关（设计 §3.2）。
+                    requireConfirmForModelSubagentRun: (raw && typeof raw.requireConfirmForModelSubagentRun === 'boolean')
+                        ? raw.requireConfirmForModelSubagentRun
+                        : SETTINGS_DEFAULTS.requireConfirmForModelSubagentRun,
                 },
             };
             return pluginSettingsCache.value;
@@ -932,6 +1116,12 @@ export default {
             const next = {
                 pollIntervalMs: clampInt(args.pollIntervalMs, 2000, 60000, current.pollIntervalMs),
                 toolDescriptionMaxLength: clampInt(args.toolDescriptionMaxLength, 0, 2000, current.toolDescriptionMaxLength),
+                requireConfirmForModelRuleWrite: (args && typeof args.requireConfirmForModelRuleWrite === 'boolean')
+                    ? args.requireConfirmForModelRuleWrite
+                    : current.requireConfirmForModelRuleWrite,
+                requireConfirmForModelSubagentRun: (args && typeof args.requireConfirmForModelSubagentRun === 'boolean')
+                    ? args.requireConfirmForModelSubagentRun
+                    : current.requireConfirmForModelSubagentRun,
             };
             const p = await ensurePaths();
             return withWriteLock(async () => {
@@ -963,7 +1153,9 @@ export default {
                 for (const serverName of Object.keys(raw)) {
                     const list = raw[serverName];
                     if (Array.isArray(list)) {
-                        const names = list.map((name) => String(name)).filter((name) => /^[A-Za-z0-9_-]{1,128}$/.test(name));
+                        // `*` 必须原样保留：它是「整台服务器停用」的通配（场景档案未勾选的服务器写的就是它），
+                        // 被这里过滤掉的话 guard / restrict / 快照三条链路一起失效——整台停用变成空转。
+                        const names = list.map((name) => String(name)).filter((name) => name === '*' || /^[A-Za-z0-9_-]{1,128}$/.test(name));
                         if (names.length)
                             out[serverName] = names;
                     }
@@ -981,6 +1173,21 @@ export default {
             }
             return out;
         }
+        /** 单工具停用判定（含整服务器通配 `*`——场景档案的"MCP 工具集=整台"写的就是它）。 */
+        function isToolDisabled(map, fullName) {
+            if (!fullName.startsWith('mcp__'))
+                return false;
+            const rest = fullName.slice(5);
+            const i = rest.indexOf('__');
+            if (i <= 0)
+                return false;
+            const list = map[rest.slice(0, i)];
+            if (!list)
+                return false;
+            if (list.indexOf('*') >= 0)
+                return true;
+            return list.indexOf(rest.slice(i + 2)) >= 0;
+        }
         async function mcpmToolEnabled(args) {
             const serverName = String((args && args.serverName) || '').trim();
             const tool = String((args && args.tool) || '').trim();
@@ -1024,6 +1231,7 @@ export default {
             // Force re-read: this runs on the tools/change path, which is rare, so a
             // stale cache must not keep an externally edited deny list hidden.
             const map = await readDisabledTools(true);
+            // 通配 `*`（整服务器停用）先展开成已注册的全名，再与精确名单合并。
             const wanted = disabledToolNames(map);
             let registered;
             try {
@@ -1032,6 +1240,14 @@ export default {
             catch (e) {
                 return;
             }
+            for (const [serverName, list] of Object.entries(map)) {
+                if (list.indexOf('*') < 0)
+                    continue;
+                const prefix = 'mcp__' + serverName + '__';
+                for (const fullName of registered)
+                    if (fullName.startsWith(prefix))
+                        wanted.push(fullName);
+            }
             const names = wanted.filter((name) => registered.has(name));
             if (restrictDisposer) {
                 try {
@@ -1140,7 +1356,9 @@ export default {
                 return { ok: false, error: message(e) };
             }
             const descriptionLimit = (await readPluginSettings()).toolDescriptionMaxLength;
-            const disabledHere = new Set((await readDisabledTools())[serverName] || []);
+            const disabledMapHere = await readDisabledTools();
+            const disabledHere = new Set(disabledMapHere[serverName] || []);
+            const wildcardHere = disabledHere.has('*');
             const toolsList = [];
             for (const s of schemas) {
                 const fullName = String(s && s.name || '');
@@ -1169,7 +1387,7 @@ export default {
                 toolsList.push({
                     name: rawName,
                     description: truncateText(typeof s.description === 'string' ? s.description : '', descriptionLimit),
-                    enabled: !disabledHere.has(rawName),
+                    enabled: wildcardHere ? false : !disabledHere.has(rawName),
                     parameters: params,
                 });
             }
@@ -1179,6 +1397,8 @@ export default {
             // stay reachable; the description is unavailable once the schema is gone.
             const listed = new Set(toolsList.map((t) => t.name));
             for (const name of disabledHere) {
+                if (name === '*')
+                    continue; // 整服务器通配：已在上方逐工具体现，不再展示占位行
                 if (!listed.has(name)) {
                     toolsList.push({ name, description: '（已停用；描述暂不可用）', enabled: false, parameters: [] });
                 }
@@ -1759,6 +1979,168 @@ export default {
                 },
             };
         }
+        /**
+         * 记忆候选（档案编辑器第 4 段「记忆」）：`[{ id, scene, name, description }]`。
+         * 只读、不读正文（勾选集只存 id）；任何异常降级为空列表，不让档案弹窗崩掉。
+         */
+        async function memoryCandidates() {
+            try {
+                const r = await rulesService.ops['rules-list']({});
+                if (!r || r.ok === false)
+                    return [];
+                return (r.rules || [])
+                    .filter((x) => !x.shadowed)
+                    .map((x) => ({
+                    id: String(x.id),
+                    scene: String(x.group || ''),
+                    name: String(x.name || ''),
+                    description: String(x.description || ''),
+                }));
+            }
+            catch {
+                return [];
+            }
+        }
+        /** 场景候选（档案编辑器第 4 段的分组维度）：`[{ name, label, description, count, global }]`。 */
+        async function memorySceneCandidates() {
+            try {
+                const r = await rulesService.ops['rules-list']({});
+                if (!r || r.ok === false)
+                    return [];
+                return (r.scenes || []).map((s) => ({
+                    name: String(s.name),
+                    label: String(s.label || s.name),
+                    description: String(s.description || ''),
+                    count: Number(s.count || 0),
+                    global: s.global === true,
+                }));
+            }
+            catch {
+                return [];
+            }
+        }
+        /**
+         * 工具候选（人设的「工具白名单 / 黑名单」选择器）：
+         * 取**全体 Agent 预设工具名的并集**——人设可能在任意预设下被子代理复用，
+         * 只列当前会话的工具会让换预设后的子代理启动失败（官方 `toolFilter` 对未知名直接拒绝）。
+         * 同时标注 `current`：当前会话可见的工具（其余只是「本预设可用，当前会话看不到」）。
+         *
+         * 每次调用都会为尚未挂载的预设建立 standing mount（官方语义：一个预设在本进程内只挂一次，
+         * 正常创建会话时同样会挂），因此结果会按需缓存 60 秒，避免频繁枚举。
+         */
+        let presetToolsCache = null;
+        async function presetToolCandidates() {
+            if (presetToolsCache && Date.now() - presetToolsCache.at < 60000)
+                return presetToolsCache.value;
+            const byName = new Map();
+            const presets = [];
+            // 当前会话的可见工具（用于标 current）；拿不到就全部按「非当前」处理。
+            const currentNames = new Set();
+            try {
+                const schemas = await tools.schemas();
+                for (const s of schemas || [])
+                    currentNames.add(String(s.name));
+            }
+            catch { /* 无 live 工具 → current 全 false */ }
+            const agentPresets = (typeof ctx.get === 'function' ? ctx.get('agentPresets') : undefined);
+            if (agentPresets && typeof agentPresets.list === 'function') {
+                try {
+                    const roster = await agentPresets.list();
+                    for (const p of roster || []) {
+                        const id = String((p && p.id) || '');
+                        if (!id)
+                            continue;
+                        presets.push({ id, name: String((p && (p.name || p.id)) || id) });
+                        let scopeKey;
+                        try {
+                            // 官方说明：该调用会确保预设的 standing mount（不创建 agent/session），
+                            // 已挂载的预设直接复用；正因如此才需要这里的 60 秒缓存。
+                            scopeKey = typeof agentPresets.standingKeyFor === 'function' ? await agentPresets.standingKeyFor(id) : undefined;
+                        }
+                        catch {
+                            scopeKey = undefined;
+                        }
+                        let names = [];
+                        try {
+                            names = (await tools.schemas(scopeKey) || []).map((s) => String(s.name)).filter(Boolean);
+                        }
+                        catch {
+                            names = [];
+                        }
+                        for (const name of names) {
+                            // MCP 工具名形如 `mcp__<server>__<tool>`：面向上百个条目，噪声大于价值 → 不进候选。
+                            if (name.startsWith('mcp__'))
+                                continue;
+                            const rec = byName.get(name) || { name, presets: new Set(), current: false };
+                            rec.presets.add(id);
+                            byName.set(name, rec);
+                        }
+                    }
+                }
+                catch { /* 预设服务不可用 → 退回「仅当前会话工具」 */ }
+            }
+            // 当前会话的工具即便没有任何预设可枚举，也要出现在候选里（否则选择器是空的）。
+            for (const name of currentNames) {
+                if (name.startsWith('mcp__'))
+                    continue;
+                const rec = byName.get(name) || { name, presets: new Set(), current: false };
+                byName.set(name, rec);
+            }
+            for (const rec of byName.values())
+                rec.current = currentNames.has(rec.name);
+            const value = {
+                tools: [...byName.values()]
+                    .map((r) => ({ name: r.name, presets: [...r.presets].sort(), current: r.current }))
+                    .sort((a, b) => a.name.localeCompare(b.name)),
+                presets: presets.sort((a, b) => a.id.localeCompare(b.id)),
+            };
+            presetToolsCache = { at: Date.now(), value };
+            return value;
+        }
+        /**
+         * 模型候选（人设的「模型」下拉）：宿主已注册的 provider + 各 provider 能宣告的模型。
+         * 只读宿主 LLM 目录，**不发起网络请求**（`discoverModels` 会打端点，这里不用）；
+         * 拿不到就返回空列表，UI 退回手填（跨来源模型如 sensenova 的手工条目仍需手填兜底）。
+         * 返回扁平列表：DSH 的模型路由是 (provider, model) 一对，两个键必须同时给。
+         */
+        async function modelCandidates() {
+            const llm = (typeof ctx.get === 'function' ? ctx.get('llm') : undefined);
+            if (!llm || typeof llm.listProviders !== 'function')
+                return { models: [] };
+            let list = [];
+            try {
+                list = llm.listProviders() || [];
+            }
+            catch {
+                return { models: [] };
+            }
+            const models = [];
+            const seen = new Set();
+            for (const p of list) {
+                const provider = String((p && (p.id || p.provider)) || '');
+                if (!provider)
+                    continue;
+                const providerName = String((p && (p.name || p.displayName)) || provider);
+                let discovered = [];
+                try {
+                    // 适配器可选提供 listModels（官方 LlmAdapter 契约）；未提供时该 provider 只报名字。
+                    if (typeof llm.listModels === 'function')
+                        discovered = (await llm.listModels(provider)) || [];
+                }
+                catch { /* 该 provider 的目录读失败 → 只报 provider 本身 */ }
+                for (const m of discovered) {
+                    const id = String((m && (m.id || m.model)) || '');
+                    if (!id)
+                        continue;
+                    const key = provider + '\u0000' + id;
+                    if (seen.has(key))
+                        continue;
+                    seen.add(key);
+                    models.push({ provider, providerName, id, name: String((m && m.name) || id) });
+                }
+            }
+            return { models };
+        }
         const handlers = {
             'plugin-version': pluginVersion,
             'mcpm-list': mcpmListView,
@@ -1782,6 +2164,59 @@ export default {
             // skill-delete / skill-trash-restore / skill-trash-delete
             // 成功返回 {ok:true, data}；core 业务失败原样透传 {ok:false, error, code?, params?}。
             ...skillsService.ops,
+            // rules ops（由 ./rules/service.js 提供）：rules-list / rules-read / rules-budget /
+            // rules-diagnose / rules-create / rules-update / rules-remove / rules-restore /
+            // rules-attach / rules-detach / rules-trash-list / rules-trash-remove /
+            // rules-toggle / rules-set-index / rules-set-active / rules-create-scene /
+            // rules-remove-scene。
+            // 成功返回扁平 {ok:true, ...}（不套 data），失败 {ok:false, error, code?}。
+            ...rulesService.ops,
+            // 场景档案 ops（由 ./rules/archive-engine.ts 提供）：scene-mode-get /
+            // scene-archive-save / scene-mode-set。成功返回扁平 {ok:true, ...}，
+            // 失败 {ok:false, error}；写 op 已含 archiveService.writeOps 门禁派生。
+            ...archiveService.ops,
+            // 子智能体 ops（由 ./subagents/service.ts 提供）：subagent-list/get（只读）
+            // + subagent-create/update/delete（写，writeOps 已派生进门禁）。
+            ...subagentService.ops,
+            // 人设表单的两个候选源（只读，均为「按需拉取」——不进 scene-inventory，避免每次开档案弹窗都枚举预设）。
+            // preset-tools：全体 Agent 预设工具名并集 + 各工具所属预设 + 当前会话是否可见。
+            'preset-tools': async () => ({ ok: true, ...(await presetToolCandidates()) }),
+            // model-candidates：宿主 LLM 目录里的 (provider, model) 对（不发网络请求）。
+            'model-candidates': async () => ({ ok: true, ...(await modelCandidates()) }),
+            // 场景档案勾选器数据源 v2：全部 MCP 服务器（含未运行）+ 技能全集 + 人设清单。
+            'scene-inventory': async () => {
+                const [rowsR, tools, skills, subs] = await Promise.all([mcpmListView(), toolStates(), skillStates(), subagentService.list()]);
+                const disabledRaw = await readDisabledTools();
+                const rows = (rowsR && rowsR.rows) || [];
+                const mcpServers = [];
+                const seen = new Set();
+                for (const row of rows) {
+                    const name = String((row && row.serverName) || '');
+                    if (!name || seen.has(name))
+                        continue;
+                    seen.add(name);
+                    mcpServers.push({
+                        name,
+                        level: row.level || null,
+                        live: !!(row.live && row.live.enabled),
+                        serverDisabled: !!row.disabled,
+                        // 停用表里的 ['*'] = 整台工具停用（勾选器据此预勾，避免把"全停"读成"全启用"）。
+                        allToolsDisabled: (disabledRaw[name] || []).indexOf('*') >= 0,
+                        toolCount: typeof row.toolCount === 'number' ? row.toolCount : null,
+                    });
+                }
+                return {
+                    ok: true,
+                    mcpServers,
+                    tools: Object.entries(tools).map(([key, enabled]) => ({ key, enabled })),
+                    skills: Object.entries(skills).map(([key, enabled]) => ({ key, enabled })),
+                    subagents: subs.map((p) => ({ name: p.name, description: p.description })),
+                    // 档案编辑器第 4 段「记忆」的候选：场景 + 每个场景里的记忆条数。
+                    // 记忆正文不在这里返回（勾选集只存 id，渲染时才读盘）。
+                    scenes: await memorySceneCandidates(),
+                    memories: await memoryCandidates(),
+                };
+            },
             // AGENTS.md 预设库 ops（由 ./agents-md/service.js 提供）：agentsmd-list /
             // agentsmd-read / agentsmd-create / agentsmd-update / agentsmd-remove /
             // agentsmd-apply / agentsmd-get-current
@@ -2191,7 +2626,12 @@ export default {
                 const days = Number((args && args.retentionDays) ?? -1);
                 if (!Number.isFinite(days) || days < 0)
                     return { ok: false, error: 'retentionDays 需为非负整数（0=永久不删除）' };
-                await writeHistoryRetention(Math.floor(days));
+                try {
+                    await writeHistoryRetention(Math.floor(days));
+                }
+                catch (e) {
+                    return { ok: false, error: '写入保留期失败: ' + message(e) };
+                }
                 // 设置变更后立即扫一次，UI 反映新策略。
                 await sweepHistory().catch(() => { });
                 return { ok: true, retentionDays: Math.floor(days) };
@@ -2349,13 +2789,112 @@ export default {
                 return 'OK: preset ' + args.id + ' applied to ~/.dsh/AGENTS.md (next session; current session unchanged' + (r.backedUp ? '; previous backed up to __last-applied__' : '') + ')';
             },
         }));
+        // ---------- rules model tools（v0.4）----------
+        // 活动场景的记忆正文会自动进入系统提示词（无需调用工具读取）；这里的工具用于
+        // 查询/编辑规则本身。rule_manager_write 受 tools/pre-execute 审批门禁（D2）。
+        // 路径锚点：$DSH_HOME/tool-management/memories/<场景>/…（场景 `global` = 界面「全局」）。
+        tools.register(defineTool({
+            name: 'rule_manager_list',
+            description: 'List memories under ~/.dsh/tool-management/memories (id, scene, enabled, description).',
+            parameters: {
+                group: { type: 'string', description: 'Optional scene filter.' },
+            },
+            output: { schema: { type: 'string' }, render: (_a, v) => text(v) },
+            async execute(args) {
+                const r = await rulesService.ops['rules-list'](args);
+                if (!r || r.ok === false)
+                    throw new Error((r && r.error) || '读取规则失败');
+                const lines = (r.rules || []).map((x) => ('- ' + x.id + ' [' + (x.group || '未归属场景') + '] ' + (x.enabled ? '已启用' : '已停用') +
+                    (x.description ? ' — ' + x.description : '')));
+                const scenes = (r.scenes || []).map((s) => (s.label || s.name) + (s.active ? '(启用)' : '(未启用)')).join('、');
+                return '记忆（' + (r.rules || []).length + '）：\n' + (lines.join('\n') || '(无记忆)') +
+                    '\n场景：' + (scenes || '(无)') + (r.activeMode === 'all' ? '（默认全部启用）' : '（已收窄）');
+            },
+        }));
+        tools.register(defineTool({
+            name: 'rule_manager_read',
+            description: 'Read the full body of one memory under ~/.dsh/tool-management/memories.',
+            parameters: {
+                id: { type: 'string', required: true, description: 'Memory id like <scene>/<name>.' },
+            },
+            output: { schema: { type: 'string' }, render: (_a, v) => text(v) },
+            async execute(args) {
+                const r = await rulesService.ops['rules-read'](args);
+                if (!r || r.ok === false)
+                    throw new Error((r && r.error) || '读取规则失败');
+                return '# ' + r.rule.id + '\n\n' + (r.rule.body || '');
+            },
+        }));
+        tools.register(defineTool({
+            name: 'rule_manager_write',
+            description: 'Create a new memory as ~/.dsh/tool-management/memories/<scene>/<name>.md. The scene must already exist (use global for the always-on scene). It becomes active automatically once its scene is enabled. Requires user confirmation (configurable).',
+            parameters: {
+                group: { type: 'string', required: true, description: 'Scene name under ~/.dsh/tool-management/memories; `global` = the always-on scene (any Unicode except path separators and < > : " | ? *).' },
+                name: { type: 'string', required: true, description: 'Memory name = the .md file name without the extension; any Unicode is fine (Chinese included), <=64 chars, no path separators or < > : " | ? *, must not start with a dot.' },
+                description: { type: 'string', required: true, description: 'One-sentence description (<=500 chars).' },
+                body: { type: 'string', required: true, description: 'Markdown body (<=256 KiB).' },
+            },
+            output: { schema: { type: 'string' }, render: (_a, v) => text(v) },
+            async execute(args) {
+                const r = await rulesService.ops['rules-create'](args);
+                if (!r || r.ok === false)
+                    throw new Error((r && r.error) || '创建规则失败');
+                return 'OK: memory ' + r.rule.id + '（场景「' + (r.rule.group || '未归属') + '」启用后自动生效）';
+            },
+        }));
+        // ---------- 子智能体工具（subagent_list / subagent_run）----------
+        // exec.agent / exec.signal 由工具运行时提供（parent 与取消信号的官方通道）。
+        try {
+            // 与其余 12 个工具同一条注册通道：defineTool 负责编译 parameters（object root + required），
+            // 裸 register 会把未编译的参数声明直接发给模型 API。
+            tools.register(defineTool(defineSubagentListTool({ list: () => subagentService.list(), sceneLists: subagentSceneLists })));
+            tools.register(defineTool(defineSubagentRunTool({ ...subagentService, sceneLists: subagentSceneLists })));
+        }
+        catch (e) {
+            console.error('[dsh-plugin-tool-management] subagent tool registration failed:', message(e));
+        }
         if (typeof ctx.on === 'function') {
-            ;
+            // 三个确认门的统一前裁决。口径（用户裁定，方案 B）：会话审批策略为 never（「完全权限」预设）
+            // = 用户已在预设层面预先批准一切确认门，**直接放行**并写审计日志留痕。
+            // 不能把 ask 丢给审批层：宿主 decide() 对 never 直接返回 rejected（fail-closed），确认卡
+            // 永远弹不出，模型只会收到一句无信息量的「用户拒绝」。这与官方子代理工具（无 ask 门）
+            // 在完全权限下的行为一致；探测实现与回归测试见 approval-policy.ts（必须 ctx.get('approval')，
+            // 不能用 ctx.approval——inject 未声明该服务时 cordis 代理会抛 "cannot get property without inject"）。
+            const CONFIRM_LABELS = {
+                skill_manager_create: '「新建技能」',
+                rule_manager_write: '「写入记忆」',
+                subagent_run: '「运行子代理」',
+            };
+            const bypassedByFullAccess = (exec) => {
+                if (!isApprovalNever(ctx, exec))
+                    return false;
+                // 留痕：完全权限下跳过确认属于「用户已授权」，但要可审计（日志失败不阻塞主流程）。
+                pluginLog()('confirm-bypass', `完全权限（approval=never）：跳过${CONFIRM_LABELS[String(exec && exec.name)]}的确认，直接放行`).catch(() => { });
+                return true;
+            };
             ctx.on('tools/pre-execute', (exec, next) => {
-                if (exec && exec.name === 'skill_manager_create') {
+                if (!exec || !CONFIRM_LABELS[String(exec.name)])
+                    return next();
+                if (bypassedByFullAccess(exec))
+                    return next();
+                if (exec.name === 'skill_manager_create') {
                     return Promise.resolve({ kind: 'ask', reason: 'Create a new skill under DSH_HOME/skills' });
                 }
-                return next();
+                if (exec.name === 'rule_manager_write') {
+                    // D2：模型写规则默认需确认；设置关闭后直接放行。ask 无应答者时降级为拒绝（fail-closed），
+                    // 不在此处做任何兜底放行。
+                    return readPluginSettings()
+                        .then((s) => (s.requireConfirmForModelRuleWrite
+                        ? { kind: 'ask', reason: 'Write a memory under ~/.dsh/tool-management/memories' }
+                        : next()))
+                        .catch(() => ({ kind: 'ask', reason: 'Write a memory under ~/.dsh/tool-management/memories' }));
+                }
+                // subagent_run：子代理运行花真 token：默认确认（requireConfirmForModelSubagentRun !== false），可关。
+                return readPluginSettings()
+                    .then((s) => (s.requireConfirmForModelSubagentRun !== false
+                    ? { kind: 'ask', reason: 'Run a subagent (consumes tokens)' }
+                    : next()))
+                    .catch(() => ({ kind: 'ask', reason: 'Run a subagent (consumes tokens)' }));
             });
         }
         // ---------- per-tool MCP switches: execution guard + visibility ----------
@@ -2368,7 +2907,7 @@ export default {
                 try {
                     // Reads the TTL cache without I/O: the guard runs on the hot path.
                     const value = disabledToolsCache ? disabledToolsCache.value : {};
-                    if (disabledToolNames(value).indexOf(String((exec && exec.name) || '')) >= 0) {
+                    if (isToolDisabled(value, String((exec && exec.name) || ''))) {
                         return '该工具已在 MCP 管理页停用';
                     }
                 }
@@ -2507,76 +3046,10 @@ export default {
                 console.error('[dsh-plugin-tool-management] webServer route registration failed:', message(e));
             }
         }
-        // ---------- human chat commands (/mcp, /skills) ----------
-        // The commands service is optional, so probe for it and skip silently when
-        // it is missing (same defensive shape as pluginInventory above).
-        try {
-            const commands = (typeof ctx.get === 'function' ? ctx.get('commands') : undefined);
-            if (commands && typeof commands.register === 'function') {
-                ctx.effect(() => commands.register({
-                    name: 'mcp',
-                    description: '列出已配置的 MCP 服务（级别 / 启停 / loader 状态 / 工具数）',
-                    handler: async () => {
-                        const r = await mcpmList();
-                        if (!r || r.ok === false)
-                            return { kind: 'error', text: (r && r.error) || '读取 MCP 服务失败' };
-                        // 启用的在前，同组内按名称排序。
-                        const rows = (r.rows || []).slice().sort((a, b) => {
-                            if (!!a.disabled !== !!b.disabled)
-                                return a.disabled ? 1 : -1;
-                            return String(a.serverName).localeCompare(String(b.serverName));
-                        });
-                        if (!rows.length)
-                            return { kind: 'success', text: '未配置任何 MCP 服务。' };
-                        // Human-facing command: show localized levels, not the raw keys.
-                        const labels = { project: 'Profile 级', global: '全局', loader: '已加载' };
-                        const text = 'MCP 服务（' + rows.length + '）：\n' + rows.map((row) => ('- ' + row.serverName + ' [' + (labels[row.level] || row.level) + '] ' + (row.disabled ? '已停用' : '已启用') +
-                            (row.live ? ' · loader:' + (row.live.enabled ? 'on' : 'off') + (row.live.phase ? '/' + row.live.phase : '') : '') +
-                            (typeof row.toolCount === 'number' ? ' · ' + row.toolCount + ' 工具' : ''))).join('\n');
-                        return { kind: 'success', text };
-                    },
-                }), 'dsh-plugin-tool-management: /mcp command');
-                ctx.effect(() => commands.register({
-                    name: 'skills',
-                    description: '列出各来源的技能及其启停状态',
-                    handler: async () => {
-                        const r = await skillsService.ops['skill-state']({});
-                        if (!r || r.ok === false)
-                            return { kind: 'error', text: (r && r.error) || '读取技能失败' };
-                        const data = r.data || {};
-                        const entries = [];
-                        for (const root of data.roots || []) {
-                            for (const skill of root.skills || []) {
-                                entries.push({
-                                    line: '- ' + (skill.declaredName || skill.name) + ' [' + (root.label || root.key) + '] ' + (skill.enabled === false ? '已停用' : '已启用'),
-                                    enabled: skill.enabled !== false,
-                                });
-                            }
-                        }
-                        // 启用的在前，同组内保持原有顺序（来源与名称序）。
-                        entries.sort((a, b) => (a.enabled === b.enabled ? 0 : a.enabled ? -1 : 1));
-                        const lines = entries.map((entry) => entry.line);
-                        return { kind: 'success', text: lines.length ? '技能（' + lines.length + '）：\n' + lines.join('\n') : '未发现任何技能。' };
-                    },
-                }), 'dsh-plugin-tool-management: /skills command');
-                ctx.effect(() => commands.register({
-                    name: 'agents-md',
-                    description: '列出 AGENTS.md 预设及当前生效（应用后新会话生效，当前会话不变）',
-                    handler: async () => {
-                        const r = await agentsMdService.list();
-                        if (!r || r.ok === false)
-                            return { kind: 'error', text: (r && r.error) || '读取 AGENTS.md 预设失败' };
-                        const presets = r.presets || [];
-                        if (!presets.length)
-                            return { kind: 'success', text: '未发现任何 AGENTS.md 预设。' };
-                        const text = 'AGENTS.md 预设（' + presets.length + '）：\n' + presets.map((p) => ('- ' + p.id + (p.active ? ' [生效中]' : ''))).join('\n') + '\n（应用后新会话生效，当前会话不变）';
-                        return { kind: 'success', text };
-                    },
-                }), 'dsh-plugin-tool-management: /agents-md command');
-            }
-        }
-        catch (e) {
-            console.error('[dsh-plugin-tool-management] command registration failed:', message(e));
-        }
+        // ---------- 斜杠命令：已下线 ----------
+        // 曾有 /mcp、/skills、/agents-md、/scene-memory 四条（注册到 commands 服务）。
+        // 用户 2026-09-13 判定「斜杠命令没多大用」→ 全部删除：面板里每一项都有等价入口，
+        // 而命令输出是纯文本快照，既不能操作也容易与面板状态不一致。
+        // 保留这段注释是为了让「为什么没有 /mcp」这个问题有答案可查。
     },
 };