dsh-root-planner-preset 1.1.0 → 1.1.2

package/.github/CONTRIBUTING.md

@@ -82,6 +82,36 @@ script prints `SKIP` and explains why. That is a pass, not a failure.
 - Keep `main` linear — the branch protection refuses merge commits, so rebase
   rather than merge.
 
+## Releasing
+
+`node release.mjs <patch|minor|major|X.Y.Z>` does the whole sequence. Every step in
+it exists because the manual version went wrong at least once:
+
+1. regenerates `cordis.patch.yml` and refuses to continue unless
+   `verify-patch.mjs` passes;
+2. bumps `package.json` and commits with a local-time stamp;
+3. pushes (the owner bypasses branch protection; a collaborator's push is refused,
+   so open a pull request instead);
+4. publishes to `https://registry.npmjs.org/` **explicitly** — the configured
+   registry is a read-only mirror that also lags behind, which is how an install
+   right after a release fails with *No matching version found*;
+5. **polls the registry for the exact version** rather than trusting the exit code,
+   because publishing on this account is staged and `npm publish` can print success
+   without the version ever appearing;
+6. upgrades the local profile so the machine runs what was published.
+
+`--dry-run` walks the whole thing without changing anything; `--skip-install` and
+`--skip-gh` drop the last two steps.
+
+Run it from a terminal. Inside DSH's own sandbox its `spawn` calls fail with
+`EPERM` on Windows — that is the sandbox's piped-stdio boundary, not a defect in
+the script.
+
+**A release is not a verification.** The script can put a version on npm while the
+preset stays unproven. Restart `dsh web`, open a new session on Root Planner, and
+confirm the *root* actually composed with it — `node tools/verify-session.mjs
+<session-dir>` — before believing anything about behaviour.
+
 ## How `main` is protected
 
 `main` requires the `verify` status check (strict: the branch must be up to date),

package/INSTALL.md

@@ -114,7 +114,7 @@ git clone https://github.com/XiaoOu2024/dsh-root-planner-preset
 | 委派立刻返回**深度错误** | `maxDepth` 没设或设得太小 | 见第三节，设为 `2` |
 | 子代理**什么都不能读** | 白名单过窄（比如你删过头了） | 至少保留 `read`、`glob`、`grep`、`ops_inspect_local_file`、`ops_glob`、`ops_grep` |
 | 子代理**还是能改文件** | 根会话没选中 Root Planner（见第四节），或白名单被改坏了 | 先查会话文件的 `agentPreset` 字段是否 `root-planner`；再确认 `cordis.patch.yml` 里两处 `toolFilter.allow` 都**不含** `write`、`edit`、`ops_replace`、`ops_bash`、`pwsh`。改完必须重开会话 |
-| 行为与人设描述**对不上**（比如"子代理能写"、"规则没生效"） | 最常见的原因就是**根会话跑在别的预设上**，而它的子代理跑在 root-planner 上——两者的规则和权限本来就不一样 | 查会话文件第一行的 `agentPreset`；也可跑 `node tools/inspect-sessions.mjs <会话目录>` 一次性打印根与全部子会话的预设、深度与工具清单 |
+| 行为与人设描述**对不上**（比如"子代理能写"、"规则没生效"） | 最常见的原因就是**根会话跑在别的预设上**，而它的子代理跑在 root-planner 上——两者的规则和权限本来就不一样 | 跑 `node tools/verify-session.mjs <会话目录>`，它会判定根与全部子会话的预设、深度与父子关系 |
 | 改了 `persona.txt` 但没生效 | 会话与子代理都锁定启动时的插件版本 | 开**新会话**；必要时把 `preset-root-planner` 在插件列表里关掉再打开 |
 | Windows 上校验报**人设不一致** | 换行符被 Git 改写了 | 确认 `.gitattributes` 存在且含 `* text=auto eol=lf`，重新克隆一次 |
 

package/README.md

@@ -78,7 +78,7 @@ Then **one required step**: set **Settings → Subagents → depth limit** to **
 
 Then **start a new session** and pick **Root Planner** in the preset selector. Full steps and troubleshooting are in [INSTALL.md](INSTALL.md).
 
-> ⚠️ **The easiest mistake to make: the root session must actually be composed with Root Planner.** In one real trial the root session was still `standard`, so the root was bound by none of this preset while the subagents it spawned *were* `root-planner` — every rule and permission in the tree was mismatched, and a batch of confident conclusions about the preset followed from it. **To check:** the first line of `~/.dsh/sessions/<cwd>/<session-id>/session.v4.jsonl.zstd` carries `"agentPreset"`, which must read `root-planner`; or run `node tools/inspect-sessions.mjs <session-dir>` to print the preset, depth and tool inventory of the root and every child at once.
+> ⚠️ **The easiest mistake to make: the root session must actually be composed with Root Planner.** In one real trial the root session was still `standard`, so the root was bound by none of this preset while the subagents it spawned *were* `root-planner` — every rule and permission in the tree was mismatched, and a batch of confident conclusions about the preset followed from it. **To check:** run `node tools/verify-session.mjs <session-dir>`, which reports the preset and depth of the root and every descendant, and fails loudly when the root is not `root-planner`.
 
 ## When it fits, and when it does not
 

package/README.zh.md

@@ -66,7 +66,7 @@ dsh plugin --profile web add github:XiaoOu2024/dsh-root-planner-preset
 
 然后**开新会话**，在预设选择器里选 **Root Planner**。完整步骤与故障排查见 [INSTALL.md](INSTALL.md)。
 
-> ⚠️ **最容易踩的坑：根会话必须真的选中 Root Planner。** 有人实测时根会话仍是 `standard`，于是根不受本预设约束、而它派出的子代理却是 `root-planner`——权限与规则整棵树错位，最后据此得出一批关于本预设的错误结论。**确认方法**：会话文件 `~/.dsh/sessions/<cwd>/<session-id>/session.v4.jsonl.zstd` 第一行的 `"agentPreset"` 字段应为 `root-planner`；或跑 `node tools/inspect-sessions.mjs <会话目录>` 一次性列出根与全部子会话的预设、深度与工具清单。
+> ⚠️ **最容易踩的坑：根会话必须真的选中 Root Planner。** 有人实测时根会话仍是 `standard`，于是根不受本预设约束、而它派出的子代理却是 `root-planner`——权限与规则整棵树错位，最后据此得出一批关于本预设的错误结论。**确认方法**：跑 `node tools/verify-session.mjs <会话目录>`，它会报出根与全部子会话的预设与深度，**根不是 root-planner 就直接判 FAIL**。
 
 ## 适合 / 不适合
 

package/docs/DEVELOPMENT.md

@@ -27,7 +27,9 @@ Paths below are relative to the repository root; this file lives in `docs/`.
 | `lib-yaml.mjs` | Resolves a YAML parser from the local DSH installation, so the scripts need no dependencies. |
 | `verify-patch.mjs` | Parses the generated patch and checks persona integrity, role wiring, and the child mask. |
 | `child-tools.mjs` | The child mask, defined once so the generator and the verifier cannot disagree. |
-| `tools/inspect-sessions.mjs` | Forensics for a real run: prints each session's `agentPreset`, delegation depth and tool inventory from the `.jsonl.zstd` logs. Use it before trusting any claim about what a run did — an apparent bundle defect turned out twice to be the *root* session composed with a different preset. |
+| `release.mjs` | One-command release: regenerate, verify, bump, commit, push, publish to the **official** registry, confirm the version is live, upgrade the local profile. `--dry-run` changes nothing. Run it from a terminal, not from inside the DSH sandbox, whose piped-stdio boundary makes its `spawn` calls fail with `EPERM` on Windows. |
+| `tools/verify-session.mjs` | Reads a real run's `.jsonl.zstd` logs (frame by frame — one decompress call returns 323 bytes of a 140 KB log) and checks that the **root** and every descendant composed with root-planner, at the expected depth. |
+| `tools/extract-tool-inventory.mjs` | Pulls the runtime's own `known global tools:` line out of a log. That line, not memory, is what the child mask must be a subset of. |
 | `verify-depth-override.mjs` | Checks that the profile patch layer still parses and that the `subagent` depth override landed in the composed profile. |
 | `package.json` | Bundle manifest (`dsh.bundle.patch`). |
 | `.gitattributes` | Pins LF; without it a Windows checkout breaks the byte-identity check. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-root-planner-preset",
-  "version": "1.1.0",
+  "version": "1.1.2",
   "type": "module",
   "description": "DSH agent preset that outsources file reading to strictly read-only subagents, while the root agent keeps the plan and owns every file mutation.",
   "license": "MIT",
@@ -30,4 +30,4 @@
   "devDependencies": {
     "js-yaml": "^4.1.0"
   }
-}
+}

package/release.mjs

@@ -0,0 +1,237 @@
+// One-command release for this bundle.
+//
+// It exists because the manual sequence has four places that bite, all of them
+// discovered the hard way in this repository:
+//
+//  1. `cordis.patch.yml` is GENERATED. Editing it by hand, or forgetting to
+//     regenerate after a persona edit, is the most common mistake — and CI only
+//     catches it after the push.
+//  2. The configured registry is registry.npmmirror.com, a read-only MIRROR. A
+//     plain `npm publish` goes to the wrong place, and the mirror can lag the
+//     official registry by hours, so an install right after a release fails with
+//     "No matching version found".
+//  3. Publishing this account goes through npm's STAGED publishing. `npm publish`
+//     can print a success line while the version never reaches the registry, so
+//     the exit code proves nothing. The only reliable check is asking the registry
+//     for the exact version, with retries: propagation is not instant.
+//  4. The local profile must be upgraded explicitly, or the machine keeps running
+//     the previous version while you believe you are testing the new one.
+//
+// Usage:
+//   node release.mjs patch                 # 1.1.1 -> 1.1.2, then release
+//   node release.mjs minor                 # 1.1.1 -> 1.2.0
+//   node release.mjs 2.0.0                 # an explicit version
+//   node release.mjs patch -m "人设：…"     # override the commit message body
+//
+// Flags:
+//   --dry-run       do everything except commit, push, publish and install
+//   --skip-install  do not upgrade the local DSH profile afterwards
+//   --skip-gh       skip the GitHub CI wait (still pushes)
+//   --profile NAME  DSH profile to upgrade (default: web)
+
+import { execFileSync, spawnSync } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const here = dirname(fileURLToPath(import.meta.url));
+const OFFICIAL_REGISTRY = 'https://registry.npmjs.org/';
+const PROXY = process.env.HTTPS_PROXY ?? process.env.HTTP_PROXY ?? 'http://127.0.0.1:7897';
+const GIT = process.env.DSH_RELEASE_GIT ?? 'git';
+const NPM = process.env.DSH_RELEASE_NPM ?? 'npm';
+const GH = process.env.DSH_RELEASE_GH ?? 'gh';
+
+const argv = process.argv.slice(2);
+const dryRun = argv.includes('--dry-run');
+const skipInstall = argv.includes('--skip-install');
+const skipGh = argv.includes('--skip-gh');
+const profileIndex = argv.indexOf('--profile');
+const profile = profileIndex === -1 ? 'web' : argv[profileIndex + 1];
+const messageIndex = argv.indexOf('-m');
+const body = messageIndex === -1 ? undefined : argv[messageIndex + 1];
+
+/** The version argument: the first token that is neither a flag nor a flag's value. */
+const flagValues = new Set([profileIndex + 1, messageIndex + 1].filter((index) => index > 0));
+const bump = argv.find((arg, index) => !arg.startsWith('-') && !flagValues.has(index));
+
+if (bump === undefined) {
+  process.stderr.write('usage: node release.mjs <patch|minor|major|X.Y.Z> [-m "commit body"] [--dry-run] [--skip-install]\n');
+  process.exit(2);
+}
+
+const env = { ...process.env, HTTPS_PROXY: PROXY, HTTP_PROXY: PROXY, GIT_TERMINAL_PROMPT: '0' };
+const step = (text) => process.stdout.write(`\n\u25b6 ${text}\n`);
+const run = (command, args, options = {}) => {
+  const result = spawnSync(command, args, { cwd: here, env, encoding: 'utf8', ...options });
+  if (result.status !== 0 && options.allowFailure !== true) {
+    throw new Error(`${command} ${args.join(' ')} failed (${result.status})\n${result.stdout ?? ''}${result.stderr ?? ''}`);
+  }
+  return `${result.stdout ?? ''}${result.stderr ?? ''}`;
+};
+const git = (...args) => run(GIT, args).trim();
+
+/** Bump a semver string by one of patch/minor/major. */
+function nextVersion(current, kind) {
+  if (/^\d+\.\d+\.\d+$/.test(kind)) return kind;
+  const [major, minor, patch] = current.split('.').map(Number);
+  if (kind === 'patch') return `${major}.${minor}.${patch + 1}`;
+  if (kind === 'minor') return `${major}.${minor + 1}.0`;
+  if (kind === 'major') return `${major + 1}.0.0`;
+  throw new Error(`unknown bump "${kind}" — use patch, minor, major, or an explicit X.Y.Z`);
+}
+
+// ── Preconditions ────────────────────────────────────────────────────────────
+step('Preconditions');
+const manifestPath = join(here, 'package.json');
+const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
+const current = manifest.version;
+const version = nextVersion(current, bump);
+
+const dirty = git('status', '--porcelain');
+if (dirty.length > 0) {
+  process.stdout.write(`  uncommitted changes are present; they will be included in this release:\n${dirty.split('\n').map((l) => `    ${l}`).join('\n')}\n`);
+}
+const branch = git('rev-parse', '--abbrev-ref', 'HEAD');
+if (branch !== 'main') throw new Error(`on branch "${branch}", expected main`);
+process.stdout.write(`  ${manifest.name}  ${current} -> ${version}\n`);
+
+// ── Build and verify ─────────────────────────────────────────────────────────
+step('Regenerate the patch from persona.txt');
+process.stdout.write(`  ${run(process.execPath, ['build-patch.mjs']).trim()}\n`);
+
+step('Verify the patch, the persona and the mask');
+const patchReport = run(process.execPath, ['verify-patch.mjs']);
+if (!patchReport.includes('ALL CHECKS PASSED')) throw new Error(`verify-patch.mjs did not pass:\n${patchReport}`);
+process.stdout.write('  verify-patch.mjs: ALL CHECKS PASSED\n');
+const depthReport = run(process.execPath, ['verify-depth-override.mjs'], { allowFailure: true });
+process.stdout.write(
+  depthReport.includes('ALL CHECKS PASSED')
+    ? '  verify-depth-override.mjs: ALL CHECKS PASSED\n'
+    : '  verify-depth-override.mjs: SKIPped (no depth override on this machine)\n',
+);
+
+// ── Version and commit ───────────────────────────────────────────────────────
+step(`Set version ${version}`);
+if (dryRun) {
+  process.stdout.write('  --dry-run: not writing package.json\n');
+} else {
+  const updated = readFileSync(manifestPath, 'utf8').replace(/"version": "[^"]+"/, `"version": "${version}"`);
+  if (updated === readFileSync(manifestPath, 'utf8')) throw new Error('could not find the version field to replace');
+  run(process.execPath, ['-e', `require('node:fs').writeFileSync(${JSON.stringify(manifestPath)}, ${JSON.stringify(updated)})`]);
+}
+
+/** `yyyy-MM-dd HH:mm` in LOCAL time — the project's commit-message convention. */
+function localStamp() {
+  const now = new Date();
+  const pad = (value) => String(value).padStart(2, '0');
+  return (
+    `${now.getFullYear()}-${pad(now.getMonth() + 1)}-${pad(now.getDate())} ` +
+    `${pad(now.getHours())}:${pad(now.getMinutes())}`
+  );
+}
+
+const commitMessage = `[Agent任务] ${localStamp()} | ${body ?? `发布 v${version}`}`;
+
+step('Commit and push');
+if (dryRun) {
+  process.stdout.write(`  --dry-run: would commit "${commitMessage}" and push to origin/main\n`);
+} else {
+  git('add', '-A');
+  git('commit', '-m', commitMessage);
+  process.stdout.write(`  committed ${git('rev-parse', '--short', 'HEAD')}\n`);
+  const pushed = run(GIT, ['push', 'origin', 'main'], { allowFailure: true });
+  // The owner bypasses branch protection; collaborators cannot, and will need a PR.
+  if (!/main -> main|Everything up-to-date/.test(pushed)) {
+    throw new Error(`push failed — if branch protection refused it, open a pull request instead:\n${pushed}`);
+  }
+  process.stdout.write('  pushed to origin/main\n');
+}
+
+// ── Publish ──────────────────────────────────────────────────────────────────
+step(`Publish to the official registry (the configured one is a read-only mirror)`);
+if (dryRun) {
+  process.stdout.write(`  --dry-run: would run npm publish --registry ${OFFICIAL_REGISTRY}\n`);
+} else {
+  const published = run(NPM, ['publish', '--registry', OFFICIAL_REGISTRY, '--access', 'public'], { allowFailure: true });
+  process.stdout.write(`  ${published.split('\n').filter((line) => /\+ |error|Publishing/.test(line)).join('\n  ') || '(no output)'}\n`);
+}
+
+// ── Confirm on the registry ──────────────────────────────────────────────────
+step('Confirm the version is actually live (the exit code does not prove it)');
+if (dryRun) {
+  process.stdout.write('  --dry-run: skipped\n');
+} else {
+  // curl, not fetch: this machine reaches the network through a proxy that Node's
+  // global fetch does not read, so a fetch here would fail for a reason that has
+  // nothing to do with the release.
+  const probe = (url) =>
+    spawnSync('curl', ['-s', '-o', '/dev/null', '-w', '%{http_code}', '-m', '20', '-x', PROXY, url], {
+      encoding: 'utf8',
+    }).stdout?.trim();
+
+  let live = false;
+  for (let attempt = 1; attempt <= 20 && !live; attempt += 1) {
+    await new Promise((resolve) => setTimeout(resolve, 10_000));
+    const code = probe(`${OFFICIAL_REGISTRY}${manifest.name}/${version}`);
+    if (code === '200') {
+      live = true;
+      process.stdout.write(`  ${manifest.name}@${version} is live on the registry\n`);
+    } else if (attempt % 5 === 0) {
+      process.stdout.write(`  still not visible after ${attempt * 10}s (last HTTP ${code})\n`);
+    }
+  }
+  if (!live) {
+    process.stderr.write(
+      '\n  NOT VISIBLE. On this account publishing is STAGED: check for a pending\n' +
+        '  approval on npmjs.com — `npm stage list` can report nothing while the\n' +
+        '  registry still refuses the version.\n',
+    );
+    process.exit(1);
+  }
+}
+
+// ── Upgrade the local profile ────────────────────────────────────────────────
+step(`Upgrade the local "${profile}" profile so the machine runs what was published`);
+if (dryRun || skipInstall) {
+  process.stdout.write('  skipped\n');
+} else {
+  const spec = `${manifest.name}@${version}`;
+  const output = run('dsh', ['plugin', '--profile', profile, 'add', spec, '--registry', OFFICIAL_REGISTRY], {
+    allowFailure: true,
+  });
+  const installed = (() => {
+    try {
+      return JSON.parse(
+        readFileSync(join(homedir(), '.dsh', 'profiles', profile, 'node_modules', manifest.name, 'package.json'), 'utf8'),
+      ).version;
+    } catch {
+      return undefined;
+    }
+  })();
+  if (installed === version) {
+    process.stdout.write(`  profile now runs ${manifest.name}@${installed}\n`);
+  } else {
+    process.stdout.write(`  install reported ${installed ?? 'unknown'} — run it by hand if this matters:\n${output.trim()}\n`);
+  }
+}
+
+// ── CI ───────────────────────────────────────────────────────────────────────
+if (!dryRun && !skipGh) {
+  step('Wait for CI on the pushed commit');
+  const sha = git('rev-parse', 'HEAD');
+  const waited = run(
+    GH,
+    ['run', 'watch', sha, '--repo', 'XiaoOu2024/dsh-root-planner-preset', '--exit-status'],
+    { allowFailure: true },
+  );
+  process.stdout.write(`  ${waited.trim().split('\n').slice(-2).join('\n  ') || '(no output)'}\n`);
+}
+
+step(dryRun ? 'Dry run complete — nothing was changed' : `Released ${manifest.name}@${version}`);
+if (!dryRun) {
+  process.stdout.write(
+    '\n  Next: restart `dsh web`, open a new session on the Root Planner preset, then\n' +
+      '  confirm it with tools/verify-session.mjs before trusting any behaviour.\n',
+  );
+}

package/tools/extract-tool-inventory.mjs

@@ -0,0 +1,65 @@
+// Extracts the runtime's own global-tool inventory from a session log.
+//
+// `tools.restrict()` prints every known global tool when it refuses a name, so a
+// session that hit `names unknown global tool` carries the authoritative list for
+// its own environment. That list is what the child mask has to be a subset of, and
+// it is the only trustworthy source — a mask built from memory breaks every child
+// creation, which is exactly what happened twice in this repository.
+//
+// Usage: node tools/extract-tool-inventory.mjs <session.jsonl.zstd> [...]
+
+import { readFileSync } from 'node:fs';
+import { createZstdDecompress } from 'node:zlib';
+
+/** Locate the end of the first zstd frame, where the next one begins. */
+function firstFrameEnd(buf) {
+  for (let i = 4; i + 4 <= buf.length; i += 1) {
+    if (buf[i] === 0x28 && buf[i + 1] === 0xb5 && buf[i + 2] === 0x2f && buf[i + 3] === 0xfd) return i;
+  }
+  return buf.length;
+}
+
+/**
+ * Decompress a concatenated-zstd log frame by frame. A single decompress call
+ * stops at the first frame, which is why a naive read of these logs returns a few
+ * hundred bytes out of tens of kilobytes and hides every event.
+ * @param {string} path - the .jsonl.zstd log.
+ * @returns {Promise<string>} the whole decompressed text.
+ */
+async function decompressAll(path) {
+  let rest = readFileSync(path);
+  let text = '';
+  while (rest.length > 0) {
+    const slice = rest.subarray(0, firstFrameEnd(rest));
+    try {
+      text += await new Promise((resolve, reject) => {
+        const chunks = [];
+        const decoder = createZstdDecompress();
+        decoder.on('data', (chunk) => chunks.push(chunk));
+        decoder.on('error', reject);
+        decoder.on('end', () => resolve(Buffer.concat(chunks).toString('utf8')));
+        decoder.end(slice);
+      });
+    } catch {
+      break;
+    }
+    if (slice.length >= rest.length) break;
+    rest = rest.subarray(slice.length);
+  }
+  return text;
+}
+
+for (const path of process.argv.slice(2)) {
+  const text = await decompressAll(path);
+  const match = /known global tools: ([^"\\\]]+)/.exec(text);
+  process.stdout.write(`\n=== ${path.split(/[\\/]/).pop()} (${text.length} chars decompressed) ===\n`);
+  if (match === null) {
+    process.stdout.write(`no inventory line found. mentions "unknown global tool": ${text.includes('unknown global tool')}\n`);
+    continue;
+  }
+  const tools = match[1]
+    .split(',')
+    .map((name) => name.trim())
+    .filter(Boolean);
+  process.stdout.write(`${tools.length} global tools:\n  ${tools.join('\n  ')}\n`);
+}

package/tools/verify-session.mjs

@@ -17,42 +17,45 @@ import { readdirSync, readFileSync, statSync } from 'node:fs';
 import { join } from 'node:path';
 import { createZstdDecompress } from 'node:zlib';
 
+/** Locate the end of the first zstd frame, where the next one begins. */
+function frameBytes(buf) {
+  for (let i = 4; i + 4 <= buf.length; i += 1) {
+    if (buf[i] === 0x28 && buf[i + 1] === 0xb5 && buf[i + 2] === 0x2f && buf[i + 3] === 0xfd) return i;
+  }
+  return buf.length;
+}
+
 /**
- * Decompress a concatenated-zstd file. The session logs are appended frame by
- * frame, and a single decompress call stops at the first frame — which yields a
- * 300-byte file out of an 85 KB one and silently hides every event.
+ * Decompress a concatenated-zstd file frame by frame.
+ *
+ * A single decompress call stops at the first frame, which is why a naive read of
+ * these logs returns 323 bytes out of 139 KB and silently hides every event.
+ * Measured on a real log: frame-by-frame reads 143 654 characters where one call
+ * read 323.
  * @param {Buffer} buf - whole file.
  * @returns {Promise<string>} the complete decompressed text.
  */
 async function decompressAll(buf) {
-  const out = [];
   let rest = buf;
-  for (;;) {
-    const text = await new Promise((resolve, reject) => {
-      const chunks = [];
-      const dec = createZstdDecompress();
-      dec.on('data', (chunk) => chunks.push(chunk));
-      dec.on('error', reject);
-      dec.on('end', () => resolve(Buffer.concat(chunks).toString('utf8')));
-      dec.end(rest);
-    });
-    if (text.length === 0) break;
-    out.push(text);
-    // Each frame's decompressed size is not exposed; feed the remainder in and let
-    // the next frame fail once the buffer is exhausted.
-    const consumed = frameBytes(rest, text.length);
-    if (consumed === undefined || consumed >= rest.length) break;
-    rest = rest.subarray(consumed);
-  }
-  return out.join('');
-}
-
-/** Locate the end of the first zstd frame by magic-number scanning. */
-function frameBytes(buf, ) {
-  for (let i = 4; i + 4 <= buf.length; i += 1) {
-    if (buf[i] === 0x28 && buf[i + 1] === 0xb5 && buf[i + 2] === 0x2f && buf[i + 3] === 0xfd) return i;
+  let text = '';
+  while (rest.length > 0) {
+    const slice = rest.subarray(0, frameBytes(rest));
+    try {
+      text += await new Promise((resolve, reject) => {
+        const chunks = [];
+        const dec = createZstdDecompress();
+        dec.on('data', (chunk) => chunks.push(chunk));
+        dec.on('error', reject);
+        dec.on('end', () => resolve(Buffer.concat(chunks).toString('utf8')));
+        dec.end(slice);
+      });
+    } catch {
+      break;
+    }
+    if (slice.length >= rest.length) break;
+    rest = rest.subarray(slice.length);
   }
-  return undefined;
+  return text;
 }
 
 /** Read one session directory into {header, events}. */
@@ -86,6 +89,7 @@ const base = join(rootDir, '..');
 const root = await readSession(rootDir);
 
 const sessions = [{ dir: rootDir, ...root }];
+const candidates = [];
 for (const name of readdirSync(base)) {
   if (name === rootDir.split(/[\\/]/).pop()) continue;
   const candidate = join(base, name);
@@ -96,10 +100,31 @@ for (const name of readdirSync(base)) {
   }
   const session = await readSession(candidate);
   // Only real children count. Sibling ROOT sessions of other conversations live in
-  // the same directory and have no parentSession — including them made the report
-  // claim the run failed when it had not.
+  // the same directory and have no parentSession — including them made this report
+  // claim a run had failed when it had not.
   if (session.header?.origin !== 'subagent') continue;
-  sessions.push({ dir: candidate, ...session });
+  candidates.push({ dir: candidate, ...session });
+}
+
+/**
+ * Keep only the root's real descendants. Other presets delegate too, and their
+ * subagent sessions sit in the same directory; without this walk they appear as
+ * children of this run and fail the preset check for the wrong reason.
+ */
+const rootId = root.header?.id;
+const childrenOf = new Map();
+for (const session of candidates) {
+  const parent = session.header?.parentSession;
+  if (parent === undefined) continue;
+  const list = childrenOf.get(parent) ?? [];
+  list.push(session);
+  childrenOf.set(parent, list);
+}
+const queue = [...(childrenOf.get(rootId) ?? [])];
+while (queue.length > 0) {
+  const session = queue.shift();
+  sessions.push(session);
+  queue.push(...(childrenOf.get(session.header?.id) ?? []));
 }
 
 const failures = [];

package/tools/inspect-sessions.mjs

@@ -1,71 +0,0 @@
-// Forensics on the real root-planner test run: which preset did the root session
-// compose with, and what tools did each level actually receive?
-//
-// Usage: node inspect-sessions.mjs <rootSessionDir> [childSessionDir ...]
-
-import { readFileSync } from 'node:fs';
-import { join } from 'node:path';
-import { zstdDecompressSync } from 'node:zlib';
-
-/** Read one .jsonl.zstd session log into parsed events. */
-function readSession(dir) {
-  const raw = zstdDecompressSync(readFileSync(join(dir, 'session.v4.jsonl.zstd')));
-  return raw
-    .toString('utf8')
-    .split('\n')
-    .filter((line) => line.trim().length > 0)
-    .map((line) => {
-      try {
-        return JSON.parse(line);
-      } catch {
-        return undefined;
-      }
-    })
-    .filter(Boolean);
-}
-
-for (const dir of process.argv.slice(2)) {
-  const events = readSession(dir);
-  const types = new Map();
-  for (const event of events) types.set(event.type, (types.get(event.type) ?? 0) + 1);
-
-  process.stdout.write(`\n===== ${dir.split(/[\\/]/).pop()} — ${events.length} events =====\n`);
-  process.stdout.write(`event types: ${[...types.entries()].sort((a, b) => b[1] - a[1]).slice(0, 12).map(([t, n]) => `${t}×${n}`).join(', ')}\n`);
-
-  // Session header: the composition that was actually in force.
-  for (const event of events) {
-    if (event.type === 'session/header' || event.type === 'session/start') {
-      const h = event.data ?? event;
-      process.stdout.write(
-        `header: origin=${h.header?.origin ?? h.origin} parent=${h.header?.parentSession ?? h.parentSession} ` +
-          `depth=${h.header?.delegationDepth ?? h.delegationDepth} preset=${h.preset ?? h.presetId ?? '(not in header)'}\n`,
-      );
-    }
-  }
-
-  // Tool names actually offered to this session, from its request payloads.
-  const offered = new Set();
-  for (const event of events) {
-    const message = event.data?.request?.messages ?? event.request?.messages;
-    if (!Array.isArray(message)) continue;
-    for (const entry of message) {
-      if (entry?.role !== 'system') continue;
-      const text = typeof entry.content === 'string' ? entry.content : JSON.stringify(entry.content);
-      for (const match of text.matchAll(/"name":\s*"([a-z_0-9]+)"/g)) offered.add(match[1]);
-    }
-  }
-  if (offered.size > 0) {
-    process.stdout.write(`tools seen in request payloads (${offered.size}): ${[...offered].sort().join(', ')}\n`);
-  }
-
-  // Any tool error mentioning a mask or an executor.
-  for (const event of events) {
-    const text = JSON.stringify(event);
-    for (const needle of ['unknown global tool', 'EXECUTOR_UNAVAILABLE', 'SubagentDepthError', 'exceeds maxDepth']) {
-      if (text.includes(needle)) {
-        const start = Math.max(0, text.indexOf(needle) - 220);
-        process.stdout.write(`  [${needle}] …${text.slice(start, text.indexOf(needle) + 220)}…\n`);
-      }
-    }
-  }
-}