dsh-root-planner-preset 0.0.0-stage → 1.0.0

package/.gitattributes

@@ -0,0 +1,10 @@
+# This bundle is verified by BYTE identity: verify-patch.mjs asserts that the
+# persona parsed out of cordis.patch.yml equals persona.txt exactly. Git's
+# autocrlf would rewrite both files on checkout and silently break that check on
+# every Windows clone, so line endings are pinned to LF for the whole repository.
+* text=auto eol=lf
+
+# Binary if anyone ever adds artwork.
+*.png binary
+*.jpg binary
+*.webp binary

package/INSTALL.md

@@ -0,0 +1,125 @@
+# 安装说明
+
+面向**接收方**。本包是一个 DSH agent 预设（bundle），不改动 DSH 本体。
+
+[返回中文说明](README.md) | [维护者文档](docs/DEVELOPMENT.md)
+
+## 一、前置条件
+
+装之前请对照确认，缺哪条后面都会报错：
+
+| # | 条件 | 为什么 | 怎么确认 |
+|---|---|---|---|
+| 1 | **DSH 版本足够新**，预设中带有本包引用的那些工具行 | 本补丁**镜像了随包 `standard` 预设的工具行**；行被改名或删除会导致该预设激活失败 | 看 DSH 里是否存在 `standard` / `ptc` / `cordis` 预设；能正常用 `subagent` 工具即可 |
+| 2 | **本机已注册这些全局工具名** | 子代理白名单是 **allow 列表**，而 `tools.restrict()` 遇到**未知全局工具名会直接抛错、导致子代理创建失败** | 见下方清单 |
+| 3 | **git** 在 PATH 上 | 从 GitHub 安装时 pnpm 需要 git 拉源码 | `git --version` |
+| 4 | 能访问 GitHub | 拉取仓库 | 浏览器能打开本仓库 |
+| 5 | Node（**仅**跑校验脚本时需要） | 两个校验脚本用 | `node -v` |
+
+**第 2 条的必需工具名**（缺任何一个都要改白名单，见故障排查）：
+
+```
+read  glob  grep  read_image
+ops_inspect_local_file  ops_glob  ops_grep
+skill  todo_write  ask_user_question
+get_goal  create_goal  update_goal
+list_agents  send_message  interrupt_agent
+subagent  subagent_fork
+web_search  web_fetch
+```
+
+> 其中 `ops_*` 三个来自社区包 `dsh-ops`。如果你的环境没有它们，**必须**把它们从白名单里删掉——白名单在 `cordis.patch.yml` 里两个 `toolFilter.allow` 处，改完跑一次 `node verify-patch.mjs`。
+
+## 二、安装
+
+三种方式任选，推荐第 1 种。
+
+### 方式 1：命令行（推荐）
+
+```sh
+dsh plugin --profile web add github:XiaoOu2024/dsh-root-planner-preset
+```
+
+装完重启 `dsh web`。
+
+> 也可以指定版本或分支：`github:XiaoOu2024/dsh-root-planner-preset#v1.0.0`
+
+### 方式 2：让 DSH 里的 agent 装
+
+对 agent 说：
+
+> 用 `plugin_manager` 的 `install_bundle`，target 填 `github:XiaoOu2024/dsh-root-planner-preset`
+
+注意：这个工具调用需要 **Full access** 权限或当次授权。
+
+### 方式 3：先克隆再按路径装
+
+```sh
+git clone https://github.com/XiaoOu2024/dsh-root-planner-preset
+```
+
+然后让 agent 用 `install_bundle`，target 填**克隆下来的绝对路径**。
+
+### ❌ 不适用：插件市场界面
+
+**「设置 → 插件市场」搜不到本包，属正常。** dsh-market 只允许安装 `awesome-dsh-plugin` 精选列表内的来源，本包不在其中。请用上面三种方式。
+
+## 三、装完必做：设置深度
+
+进入 **设置 → 子智能体 → 深度上限**，填 **`2`**。
+
+- **为什么必须手动做**：`maxDepth` 是 Host 设置，**不属于本 bundle**——本包故意不在工具行上写死它，否则会把你以后调高的值悄悄压回去。
+- **数值含义**：`2` = 根(0) → 子代理(1) → 孙代理(2)，只有 depth 1 能再派，depth 2 是叶子。
+- **不要填 `0`**：那会禁掉全部委派，本预设的设计直接失效。
+- 填 `1` 也能跑，但子代理就不能再派了，中间层失去作用。
+
+## 四、启用与验证
+
+1. **开一个新会话**（已有会话和它的子代理会保留启动时的插件版本，不会变）。
+2. 在预设选择器里选 **Root Planner**。
+3. 派一个研究任务，确认两件事：
+
+   - 子代理的工具列表里**没有** `write`、`edit`、`ops_replace`、`ops_bash`、`pwsh`；
+   - 子代理**能**再派一层，而它的子代理**不能**（会返回深度错误）。
+
+4. （可选）在克隆下来的目录里跑校验：
+
+   ```sh
+   node verify-patch.mjs
+   node verify-depth-override.mjs
+   ```
+
+   两条都应输出 `ALL CHECKS PASSED`。第二条在没配深度覆盖的机器上会打印 `SKIP` 并说明原因——那是正常提示，不是失败。
+
+## 五、故障排查
+
+| 现象 | 原因 | 怎么办 |
+|---|---|---|
+| 预设列表里**没有 Root Planner** | bundle 没装上，或预设行激活失败（会带诊断留在名册上） | 看 DSH 的插件/加载诊断；多半是第 1 条前置不满足——本包的补丁引用了随包预设里不存在的工具行 |
+| DSH **启动失败**（进程直接退出） | DSH 启动是全有全无，一个插件加载失败整个进程就退出 | 用插件市场的「**调整插件**」恢复界面：DSH 点名的插件会标红并默认取消勾选，勾好再启动。找不到该界面时，手工编辑 profile 的 `cordis.patch.yml` 把对应行设为 `disabled: true` |
+| 子代理创建失败，报 **`tools.restrict() names unknown global tool …`** | 白名单里有你的环境**没注册**的工具名 | 按报错里点出的名字，从 `cordis.patch.yml` 两个 `toolFilter.allow` 里删掉该行，重装或重开会话 |
+| 委派立刻返回**深度错误** | `maxDepth` 没设或设得太小 | 见第三节，设为 `2` |
+| 子代理**什么都不能读** | 白名单过窄（比如你删过头了） | 至少保留 `read`、`glob`、`grep`、`ops_inspect_local_file`、`ops_glob`、`ops_grep` |
+| 子代理**还是能改文件** | 白名单被改坏了 | 确认 `cordis.patch.yml` 里两处 `toolFilter.allow` 都**不含** `write`、`edit`、`ops_replace`、`ops_bash`、`pwsh`；改完必须重开会话 |
+| 改了 `persona.txt` 但没生效 | 会话与子代理都锁定启动时的插件版本 | 开**新会话**；必要时把 `preset-root-planner` 在插件列表里关掉再打开 |
+| Windows 上校验报**人设不一致** | 换行符被 Git 改写了 | 确认 `.gitattributes` 存在且含 `* text=auto eol=lf`，重新克隆一次 |
+
+## 六、卸载
+
+**推荐**：让 agent 调 `plugin_manager` 的 `remove_bundle`，target 填 `dsh-root-planner-preset`。它会同时处理包和 profile 清单里的登记，最干净。
+
+**命令行备选**：
+
+```sh
+dsh plugin --profile web remove dsh-root-planner-preset
+```
+
+⚠️ 但注意：命令行的 `remove` 是**直接透传给 pnpm** 的（插件管理器只接管 `add`/`install`/`i`），所以它**只删包，不会清理** profile 的 `dsh.profile.bundles` 里的登记。用命令行卸载后，建议检查一下 `~/.dsh/profiles/<你的 profile>/package.json` 的 `dsh.profile.bundles` 数组，手工删掉残留条目，否则下次启动可能因找不到包而报错。
+
+卸载后**不影响**你已经设过的深度上限——那是 Host 设置，不是本包带来的。
+
+## 七、一个诚实的提醒
+
+本包**尚未在作者环境之外实测过子代理运行**——白名单里的工具名是按作者环境的实际工具清单交叉核对出来的。所以第 2 条前置条件务必先对照一遍，尤其是 `ops_*` 那几个（它们来自社区包 `dsh-ops`，不是 DSH 自带）。
+
+如果你撞上了没列在上面的错误，麻烦带上报错原文开个 issue。

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 小欧
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,82 @@
-# Temporary Holding Version
+# dsh-root-planner-preset
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+一个面向 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness)（DSH）的 agent 预设：**把「读书」和「决策」分开**。
+
+根 agent 的上下文只装任务分析、规划与决策；文件阅读、信息查询交给子代理，子代理只回摘要。而**创建、修改、删除文件只能由根 agent 执行**——子代理连工具都没有。
+
+> 一句话：让整棵树里只有一个 agent 有手，其余都只有眼睛。
+
+[安装步骤](INSTALL.md) | [维护者文档](docs/DEVELOPMENT.md)
+
+## 它解决什么问题
+
+用 coding agent 干长任务，上下文很快被原始文件内容塞满，于是忘了目标、丢了计划、开始重复劳动。常见对策是「让 agent 多派子代理」，但光靠提示词约束不住——子代理照样会顺手改文件，任务也会被无限往下转派。
+
+这个预设把两件事做成了结构约束，而不是靠自觉：
+
+| 要求 | 机制 | 强度 |
+|---|---|---|
+| 子代理**不能**创建/修改/删除文件 | 两个委派工具上的 `toolFilter.allow` 白名单，不含 `write`、`edit`、`ops_replace` | **结构性**：工具不存在，调不到 |
+| 子代理**没有** shell 可绕过 | 同一白名单，不含 `ops_bash`、`pwsh` | **结构性** |
+| 任务不会被无限转派 | 运行时深度上限（`subagent.maxDepth`） | **结构性**：超过上限直接抛 `SubagentDepthError` |
+| 根 agent 独揽所有修改 | 人设规则（白名单只作用于子级） | 提示词级 |
+| 根 agent 默认委派阅读 | 人设规则 | 提示词级 |
+
+白名单是 **allow 而非 deny**：将来某个插件新增的工具，对子代理默认不可见。
+
+## 工作方式
+
+```
+根 agent (depth 0)          ← 只有它有 write / edit / shell
+├── 子代理 (depth 1)        ← 只读；可以再派一层
+│   └── 孙代理 (depth 2)    ← 只读；叶子
+└── 子代理 (depth 1)
+```
+
+- **根 agent**：先立计划（目标、成功判据、约束、任务清单），把阅读/搜索/定位默认派出去，自己只在「单个已知文件、一小段范围、或核实子代理的某个断言」时才亲自读。
+- **子代理**：只读、只定位、只总结。发现**需要改文件**时不动手，而是回报精确的改动方案——目标路径、位置（file:line）、当前内容、建议替换、理由。
+- **根 agent 收到方案后决策**，然后亲自落盘。
+
+子代理怎么知道自己是子代理？DSH 会在每个子代理的提示词里强制插入一句 `You are a delegated subagent: …`，运行时注入、无法移除，而预设人设**没有** `{{role}}` 这类变量可用。所以人设里写的是一条**判定指令**：读自己的提示词里有没有那句话。这让人设只需要一份，父与子读到的是同一份文本，因此不会出现「父以为子被这么约束、子其实没读到」的漂移。
+
+## 快速开始
+
+```sh
+dsh plugin --profile web add github:XiaoOu2024/dsh-root-planner-preset
+```
+
+装完**必须**再做一步：**设置 → 子智能体 → 深度上限 = `2`**。（这是 Host 的 `subagent` 设置节，**全局生效、不属于** bundle；设成 `0` 会禁掉全部委派，设计就废了。）
+
+然后**开新会话**，在预设选择器里选 **Root Planner**。完整步骤与故障排查见 [INSTALL.md](INSTALL.md)。
+
+## 适合 / 不适合
+
+**适合**：需要跨很多文件调研的长任务、逆向分析、代码审查，以及任何「读得多、改得少」或「改动必须被仔细决策」的工作。
+
+**不适合**：
+
+- 只想快速改一个文件——多一层委派是纯粹的开销；
+- 需要子代理**并行写代码**——这是本预设**故意**禁止的，请改用 `standard` 预设；
+- 环境缺少 DSH 的工具基础（见 [INSTALL.md](INSTALL.md) 的前置条件）。
+
+## 仓库内容
+
+| 文件 | 说明 |
+|---|---|
+| `cordis.patch.yml` | 预设声明（**由脚本生成，不要手改**） |
+| `persona.txt` | 人设正文，**要改就改这个** |
+| `build-patch.mjs` | 从 `persona.txt` 生成 `cordis.patch.yml` |
+| `verify-patch.mjs` | 校验补丁结构、工具白名单，并断言人设逐字节一致 |
+| `verify-depth-override.mjs` | 校验深度覆盖是否落到合成配置 |
+| `lib-yaml.mjs` | 从本地 DSH 安装里解析 YAML，因此本包**零依赖** |
+| `docs/DEVELOPMENT.md` | 维护者文档：设计取舍、机制细节、已验证/未验证边界 |
+
+## 已验证 / 未验证
+
+**已验证**：补丁可被 loader 解析；解析出的人设与 `persona.txt` **逐字节相同**；两个委派工具的白名单排除了所有写入入口、且只包含本机实际注册的工具名；干净检出后校验通过（`.gitattributes` 已钉死 LF，否则 Windows 克隆会破坏逐字节校验）；深度覆盖已落到合成配置。
+
+**未验证**：**尚未在 `root-planner` 预设下真正派出过一个子代理。** 白名单里的工具名是按作者环境的实际工具清单交叉核对出来的，不是运行时实测。若你的环境缺少其中某个全局工具名，子代理创建会失败并报 `tools.restrict() names unknown global tool …`。详见 [INSTALL.md](INSTALL.md) 的故障排查。
+
+## 许可
+
+[MIT](LICENSE)

package/build-patch.mjs

@@ -0,0 +1,266 @@
+// Generates root-planner-preset/cordis.patch.yml from persona.txt.
+//
+// The persona is a long multi-paragraph text, and hand-indenting it into a YAML
+// block scalar is exactly the kind of edit that silently produces a truncated or
+// mis-indented prompt. This generator owns that indentation instead: edit
+// persona.txt, re-run this script, and the patch stays valid.
+//
+// Usage: node build-patch.mjs
+
+import { readFileSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const here = dirname(fileURLToPath(import.meta.url));
+
+/** Read persona.txt, normalize line endings, and require content. */
+function readPersona() {
+  const text = readFileSync(join(here, 'persona.txt'), 'utf8').replace(/\r\n/g, '\n').trimEnd();
+  if (text.length === 0) throw new Error('persona.txt is empty');
+  if (text.includes('\t')) throw new Error('persona.txt contains a tab: YAML block scalars forbid tab indentation');
+  return text;
+}
+
+/**
+ * Indent a block scalar body for `prefix: |-`. Every line gets `depth` spaces,
+ * because the first line of a literal block scalar sits on its own line at the
+ * same indentation as the rest; blank lines stay empty so no trailing
+ * whitespace reaches the prompt.
+ */
+function blockScalar(text, depth) {
+  const pad = ' '.repeat(depth);
+  return text
+    .split('\n')
+    .map((line) => line.replace(/\s+$/, ''))
+    .map((line) => (line.length === 0 ? '' : pad + line))
+    .join('\n');
+}
+
+/** Render one `allow:` key and its entry list at the given indentation. */
+function allowList(names, keyDepth) {
+  const keyPad = ' '.repeat(keyDepth);
+  const itemPad = ' '.repeat(keyDepth + 2);
+  return [`${keyPad}allow:`, ...names.map((name) => `${itemPad}- ${name}`)].join('\n');
+}
+
+/**
+ * The child mask: the only global tools a subagent may call. Everything absent
+ * is invisible to the child, including every mutation entry point.
+ */
+const CHILD_TOOLS = [
+  'read',
+  'glob',
+  'grep',
+  'ops_inspect_local_file',
+  'ops_glob',
+  'ops_grep',
+  'web_search',
+  'web_fetch',
+  'read_image',
+  'skill',
+  'todo_write',
+  'ask_user_question',
+  'get_goal',
+  'create_goal',
+  'update_goal',
+  'list_agents',
+  'send_message',
+  'interrupt_agent',
+  'subagent',
+  'subagent_fork',
+];
+
+const persona = readPersona();
+
+/** The delegation group is shared by both shapes of child, so the mask is declared once. */
+const patch = `# Generated by build-patch.mjs from persona.txt. Do not hand-edit:
+# edit persona.txt and re-run the generator.
+
+# The root-planner preset. It mirrors the shipped standard preset's tool list
+# so behavior differs only where this design intends it to, and it declares no
+# persona line on a delegation tool: the child must inherit this same
+# persona, because the persona itself carries the subagent rules.
+- insert:
+    - id: preset-root-planner
+      name: '@deepseek-ai/dsh-agent-preset'
+      config:
+        id: root-planner
+        name: Root Planner
+        description: Plans in a lean context, delegates reading to strictly read-only subagents, and owns every file mutation.
+        order: 5
+        plugins:
+          - id: persona
+            name: '@deepseek-ai/dsh-persona'
+            config:
+              suffix: Your working directory is {{cwd}}.
+              prefix: |-
+<PERSONA>
+          - id: agent-instructions
+            name: '@deepseek-ai/dsh-agent-instructions'
+            config:
+              maxBytes: 65536
+          - id: tool-bash
+            name: '@deepseek-ai/dsh-tool-bash'
+            disabled: !!js process.platform === 'win32'
+          - id: tool-pwsh
+            name: '@deepseek-ai/dsh-tool-pwsh'
+            disabled: !!js process.platform !== 'win32'
+          - id: tool-fs
+            name: '@deepseek-ai/dsh-tool-fs'
+          - id: tool-fs-search
+            name: '@deepseek-ai/dsh-tool-fs-search'
+            config:
+              sampleOverCapGlobResults: false
+          - id: tool-jobs
+            name: '@deepseek-ai/dsh-tool-jobs'
+          - id: skill-filesystem
+            name: '@deepseek-ai/dsh-skill-filesystem'
+          - id: tool-skill
+            name: '@deepseek-ai/dsh-tool-skill'
+          - id: command-goal
+            name: '@deepseek-ai/dsh-command-goal'
+          - id: tool-goal
+            name: '@deepseek-ai/dsh-tool-goal'
+          - id: planning
+            name: cordis:group
+            group: true
+            isolate:
+              planMode: true
+            config:
+              - id: plan-mode
+                name: '@deepseek-ai/dsh-plan-mode'
+                config:
+                  section: |
+                    You are in plan mode. Stay in plan mode until exit_plan_mode succeeds or the user switches the session mode. Imperative language to implement changes means plan the implementation, not execute it. A user's conversational agreement, including an answer confirming something you asked, approves nothing and does not end plan mode; fold the confirmed decision into the plan and submit it through exit_plan_mode.
+
+                    Explore first. Use non-mutating reads, searches, static analysis, and checks to ground the plan in the actual repository. Do not edit or write files, change configuration, run formatters or code generation that rewrites tracked files, commit, or otherwise carry out the plan. Prefer existing functions and patterns over new machinery.
+
+                    The tool catalog stays the same across modes for request-cache stability. These plan-mode rules override any later tool description or guidance that suggests using mutation tools; those tools remain listed only to keep the tool catalog unchanged. Do not use todo_write to track this planning phase: it tracks implementation after an approved plan, while the plan itself belongs in exit_plan_mode.
+
+                    Resolve discoverable facts by inspection. Use ask_user_question only for user-owned choices or material ambiguity that inspection cannot answer. Do not ask the user where code lives or how current behavior works when you can find out.
+
+                    Make the plan decision-complete: state the goal and success criteria; group implementation changes by subsystem; identify public API, schema, and data-flow changes; cover edge cases, failure modes, tests, acceptance criteria, and explicit assumptions. Keep it concise enough to review but detailed enough that another engineer can implement it without making design decisions.
+
+                    When ready, call exit_plan_mode with the complete plan markdown, starting with a # title. Make exit_plan_mode the only and final tool call in that assistant response: it presents the plan for approval, and implementation begins only in a later step after approval. Do not paste the final plan as a plain reply or ask "should I proceed?" through prose or ask_user_question. If review rejects it, incorporate the feedback and present again. If the review channel is unavailable or aborted, stay in plan mode and ask the user to switch modes manually; do not proceed with implementation.
+          - id: compaction
+            name: cordis:group
+            group: true
+            isolate:
+              compaction: true
+              toolResultPruner: true
+            config:
+              - id: compaction-basic
+                name: '@deepseek-ai/dsh-compaction-basic'
+              - id: command-compact
+                name: '@deepseek-ai/dsh-command-compact'
+              - id: tool-result-pruner
+                name: '@deepseek-ai/dsh-compaction-tool-result-pruner'
+                config:
+                  thresholdChars: 8192
+                  headChars: 4096
+                  tailChars: 1024
+          # Delegation. Both tools share ONE readonly mask, so every child in the
+          # tree is read-only no matter which tool produced it. maxDepth is left
+          # unset on purpose: it resolves from the Host subagent.maxDepth setting
+          # (default 1), and this preset needs unbounded depth for read-only
+          # recursion. Do not raise that Host setting to 0 while using this preset.
+          - id: delegation
+            name: cordis:group
+            group: true
+            isolate:
+              workflowEngine: true
+            config:
+              - id: tool-subagent-control
+                name: '@deepseek-ai/dsh-tool-subagent-control'
+              - id: tool-subagent-list-agents
+                name: '@deepseek-ai/dsh-tool-subagent-control/list-agents'
+              - id: tool-subagent
+                name: '@deepseek-ai/dsh-tool-subagent'
+                config:
+                  provider: spawn
+                  toolName: subagent
+                  modelSelectionSettings: true
+                  backgroundMode: continuable
+                  toolFilter:
+<MASK>
+              - id: tool-subagent-fork
+                name: '@deepseek-ai/dsh-tool-subagent'
+                config:
+                  provider: fork
+                  toolName: subagent_fork
+                  backgroundMode: continuable
+                  toolFilter:
+<MASK>
+              - id: tool-subagent-codex
+                name: '@deepseek-ai/dsh-tool-subagent'
+                disabled: true
+                config:
+                  provider: codex
+                  toolName: subagent_codex
+                  backgroundMode: one-shot
+                  maxDepth: provider-managed
+              - id: tool-subagent-claude-code
+                name: '@deepseek-ai/dsh-tool-subagent'
+                disabled: true
+                config:
+                  provider: claude-code
+                  toolName: subagent_claude_code
+                  backgroundMode: one-shot
+                  maxDepth: provider-managed
+              - id: workflow-ptc
+                name: '@deepseek-ai/dsh-workflow-ptc'
+                config:
+                  provider: spawn
+              - id: tool-workflow
+                name: '@deepseek-ai/dsh-tool-workflow'
+              - id: tool-ralph
+                name: '@deepseek-ai/dsh-tool-ralph'
+                disabled: true
+                config:
+                  subagentProvider: spawn
+                  maxRounds: 64
+          - id: tool-ask-user
+            name: '@deepseek-ai/dsh-tool-ask-user'
+          - id: tool-todo
+            name: '@deepseek-ai/dsh-tool-todo'
+            config:
+              allowParallelInProgress: true
+          - id: tool-web
+            name: '@deepseek-ai/dsh-tool-web'
+            config:
+              fetch: true
+              searchTimeoutMs: 60000
+          - id: present
+            name: '@deepseek-ai/dsh-tool-present'
+          - id: tool-plugin-manager
+            name: '@deepseek-ai/dsh-plugin-manager/tools'
+            disabled: true
+`;
+
+// Substitution happens after the template so the emitted indentation is owned by
+// blockScalar/allowList rather than by the whitespace in this file.
+const rendered = patch
+  .replace('<PERSONA>', blockScalar(persona, 16))
+  .replaceAll('<MASK>', allowList(CHILD_TOOLS, 20));
+
+if (rendered.includes('<PERSONA>') || rendered.includes('<MASK>')) {
+  throw new Error('a placeholder survived substitution');
+}
+// Structural checks on the emitted text. A literal "N spaces" assertion is
+// fragile against editor whitespace handling, so indentation is measured.
+const maskBlocks = [...rendered.matchAll(/^([ ]+)allow:\n([ ]+)- read\n/gm)];
+if (maskBlocks.length !== 2) {
+  throw new Error(`expected 2 toolFilter allow blocks, found ${maskBlocks.length}`);
+}
+for (const [, keyIndent, itemIndent] of maskBlocks) {
+  if (keyIndent.length !== 20 || itemIndent.length !== 22) {
+    throw new Error(`mask indentation is ${keyIndent.length}/${itemIndent.length}, expected 20/22`);
+  }
+}
+const personaBlock = rendered.match(/^([ ]+)prefix: \|-\n/gm);
+if (personaBlock === null || personaBlock.length !== 1) {
+  throw new Error(`expected 1 persona block scalar, found ${personaBlock?.length ?? 0}`);
+}
+
+writeFileSync(join(here, 'cordis.patch.yml'), rendered, 'utf8');
+process.stdout.write(`wrote cordis.patch.yml (persona ${persona.length} chars, ${persona.split('\n').length} lines)\n`);