dsh-root-planner-preset 1.1.2 → 1.1.4

package/child-tools.mjs

@@ -63,13 +63,25 @@ export const CHILD_TOOLS = [
   // Running commands. `pwsh` is the one shell this profile reports as a global
   // tool, and background jobs are switched off for it in the preset (see above).
   //
-  // `ops_bash` is deliberately NOT here even though it looks like the natural
-  // choice on Windows: the runtime's own tool inventory — the list
-  // `tools.restrict()` prints when it refuses a name — includes
-  // ops_glob/ops_grep/ops_inspect_local_file but NOT ops_bash, so naming it breaks
-  // every child creation exactly the way `subagent` did. The dsh-ops shell
-  // component publishes it through a different path than its file component. Add
-  // it only after seeing it in your own environment's inventory line.
+  // `ops_bash` is deliberately NOT here, and it is not an oversight — it CANNOT be
+  // here, for the same reason `subagent` cannot:
+  //
+  //   * dsh-ops publishes it per AGENT, not globally. `lib/session-shells.js`
+  //     mounts a child plugin on each `agent.ctx` and registers the tool there
+  //     (`entry.ctx.tools.register(definition)`), then walks the agents again to
+  //     `tools.restrict({ deny: [BASH_TOOL] })` on the ones it may not serve. So it
+  //     never appears in the runtime's global inventory, and naming it in a mask
+  //     fails child creation the way `subagent` did.
+  //   * It cannot be granted because it does not need granting. `allowed(agent)`
+  //     tests the agent's OWN session policy — full access, or a confinement
+  //     provider available — and a child qualifies on the same terms as the root,
+  //     so a child receives `ops_bash` from dsh-ops by itself. That project's own
+  //     manual-validation notes say it plainly: a restricted session does not
+  //     publish `ops_bash`; it appears only with full access, `publishBashTool`,
+  //     a resolvable bash payload and an available subprocess service.
+  //
+  // The consequence worth knowing: a child's shell can differ from the root's
+  // because of its own permission mode, not because of anything this mask says.
   'pwsh',
   'todo_write',
   'ask_user_question',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-root-planner-preset",
-  "version": "1.1.2",
+  "version": "1.1.4",
   "type": "module",
   "description": "DSH agent preset that outsources file reading to strictly read-only subagents, while the root agent keeps the plan and owns every file mutation.",
   "license": "MIT",

package/release.mjs

@@ -39,8 +39,9 @@ const here = dirname(fileURLToPath(import.meta.url));
 const OFFICIAL_REGISTRY = 'https://registry.npmjs.org/';
 const PROXY = process.env.HTTPS_PROXY ?? process.env.HTTP_PROXY ?? 'http://127.0.0.1:7897';
 const GIT = process.env.DSH_RELEASE_GIT ?? 'git';
-const NPM = process.env.DSH_RELEASE_NPM ?? 'npm';
-const GH = process.env.DSH_RELEASE_GH ?? 'gh';
+// `gh` is not installed on PATH on this machine; it lives in a standalone extract.
+const GH = process.env.DSH_RELEASE_GH ?? 'D:/Tools/gh/2.102.0/bin/gh.exe';
+const PUBLISHER = process.env.DSH_RELEASE_PUBLISHER ?? (process.platform === 'win32' ? 'pnpm' : 'npm');
 
 const argv = process.argv.slice(2);
 const dryRun = argv.includes('--dry-run');
@@ -62,12 +63,15 @@ if (bump === undefined) {
 
 const env = { ...process.env, HTTPS_PROXY: PROXY, HTTP_PROXY: PROXY, GIT_TERMINAL_PROMPT: '0' };
 const step = (text) => process.stdout.write(`\n\u25b6 ${text}\n`);
-const run = (command, args, options = {}) => {
-  const result = spawnSync(command, args, { cwd: here, env, encoding: 'utf8', ...options });
-  if (result.status !== 0 && options.allowFailure !== true) {
-    throw new Error(`${command} ${args.join(' ')} failed (${result.status})\n${result.stdout ?? ''}${result.stderr ?? ''}`);
+const run = (command, args, { allowFailure = false, shell = false, ...rest } = {}) => {
+  const result = spawnSync(command, args, { cwd: here, env, encoding: 'utf8', shell, ...rest });
+  // A spawn that never started reports status null and puts the reason in `error`;
+  // surfacing that by name is what turns a silent no-op into a diagnosable failure.
+  if (result.status !== 0 && !allowFailure) {
+    const reason = result.error ? `${result.error.code}: ${result.error.message}` : `exit ${result.status}`;
+    throw new Error(`${command} ${args.join(' ')} failed (${reason})\n${result.stdout ?? ''}${result.stderr ?? ''}`);
   }
-  return `${result.stdout ?? ''}${result.stderr ?? ''}`;
+  return `${result.stdout ?? ''}${result.stderr ?? ''}${result.error ? `\n${result.error.code}: ${result.error.message}` : ''}`;
 };
 const git = (...args) => run(GIT, args).trim();
 
@@ -149,12 +153,28 @@ if (dryRun) {
 }
 
 // ── Publish ──────────────────────────────────────────────────────────────────
-step(`Publish to the official registry (the configured one is a read-only mirror)`);
+step(`Publish with ${PUBLISHER} to the official registry (the configured one is a read-only mirror)`);
 if (dryRun) {
-  process.stdout.write(`  --dry-run: would run npm publish --registry ${OFFICIAL_REGISTRY}\n`);
+  process.stdout.write(`  --dry-run: would run ${PUBLISHER} publish --registry ${OFFICIAL_REGISTRY}\n`);
 } else {
-  const published = run(NPM, ['publish', '--registry', OFFICIAL_REGISTRY, '--access', 'public'], { allowFailure: true });
-  process.stdout.write(`  ${published.split('\n').filter((line) => /\+ |error|Publishing/.test(line)).join('\n  ') || '(no output)'}\n`);
+  // Two Windows facts force the shape of this call, both learned by watching a
+  // publish silently do nothing:
+  //  * `npm` and `pnpm` are shell shims, not executables — `npm` is an sh script
+  //    (ENOENT), `npm.cmd`/`pnpm.cmd` refuse to spawn without a shell (EINVAL),
+  //    and `npm.ps1` is PowerShell (EFTYPE). So the publisher is invoked WITH a
+  //    shell, which is why every argument below must stay shell-safe.
+  //  * The output must be shown even on failure. The first version filtered it
+  //    down to matching lines and printed a blank line when the command never
+  //    ran, hiding the real problem behind a successful-looking step.
+  const published = run(PUBLISHER, ['publish', '--registry', OFFICIAL_REGISTRY, '--access', 'public'], {
+    allowFailure: true,
+    shell: true,
+  });
+  const summary = published
+    .split('\n')
+    .map((line) => line.trim())
+    .filter((line) => line.length > 0 && !/^Progress:|^Packages:|^\+?$/.test(line));
+  process.stdout.write(`${summary.map((line) => `  ${line}`).join('\n') || '  (the publisher printed nothing — treat that as a failure)'}\n`);
 }
 
 // ── Confirm on the registry ──────────────────────────────────────────────────
@@ -170,22 +190,26 @@ if (dryRun) {
       encoding: 'utf8',
     }).stdout?.trim();
 
+  // Measured on this account: 1.1.2 was still 404 at 200s and live shortly after,
+  // so the window has to be generous or a successful release reads as a failure.
   let live = false;
-  for (let attempt = 1; attempt <= 20 && !live; attempt += 1) {
+  for (let attempt = 1; attempt <= 60 && !live; attempt += 1) {
     await new Promise((resolve) => setTimeout(resolve, 10_000));
     const code = probe(`${OFFICIAL_REGISTRY}${manifest.name}/${version}`);
     if (code === '200') {
       live = true;
       process.stdout.write(`  ${manifest.name}@${version} is live on the registry\n`);
-    } else if (attempt % 5 === 0) {
+    } else if (attempt % 6 === 0) {
       process.stdout.write(`  still not visible after ${attempt * 10}s (last HTTP ${code})\n`);
     }
   }
   if (!live) {
     process.stderr.write(
-      '\n  NOT VISIBLE. On this account publishing is STAGED: check for a pending\n' +
-        '  approval on npmjs.com — `npm stage list` can report nothing while the\n' +
-        '  registry still refuses the version.\n',
+      '\n  NOT VISIBLE after 10 minutes. Two known causes, in order of likelihood:\n' +
+        '   1. propagation lag — this registry answered 404 for over three minutes on a\n' +
+        '      publish that had already succeeded, so re-check before concluding anything;\n' +
+        '   2. staged publishing — check npmjs.com for a pending approval. `npm stage list`\n' +
+        '      reports nothing even when a version is held, so it is not the test.\n',
     );
     process.exit(1);
   }
@@ -196,10 +220,14 @@ step(`Upgrade the local "${profile}" profile so the machine runs what was publis
 if (dryRun || skipInstall) {
   process.stdout.write('  skipped\n');
 } else {
-  const spec = `${manifest.name}@${version}`;
-  const output = run('dsh', ['plugin', '--profile', profile, 'add', spec, '--registry', OFFICIAL_REGISTRY], {
-    allowFailure: true,
-  });
+  // `dsh` is a shell shim on Windows too, so it is invoked through Node rather
+  // than spawned directly. DSH_RELEASE_DSH overrides the entry point.
+  const dshEntry = process.env.DSH_RELEASE_DSH ?? 'D:/nodejs/npm_global/node_modules/@deepseek-ai/dsh/lib/bin.js';
+  const output = run(
+    process.execPath,
+    [dshEntry, 'plugin', '--profile', profile, 'add', `${manifest.name}@${version}`, '--registry', OFFICIAL_REGISTRY],
+    { allowFailure: true },
+  );
   const installed = (() => {
     try {
       return JSON.parse(
@@ -212,7 +240,11 @@ if (dryRun || skipInstall) {
   if (installed === version) {
     process.stdout.write(`  profile now runs ${manifest.name}@${installed}\n`);
   } else {
-    process.stdout.write(`  install reported ${installed ?? 'unknown'} — run it by hand if this matters:\n${output.trim()}\n`);
+    process.stdout.write(
+      `  the profile reports ${installed ?? 'unknown'} rather than ${version} — install it by hand:\n` +
+        `    dsh plugin --profile ${profile} add ${manifest.name}@${version} --registry ${OFFICIAL_REGISTRY}\n` +
+        `${output.trim().split('\n').slice(-6).map((line) => `    ${line}`).join('\n')}\n`,
+    );
   }
 }
 

package/tools/inspect-preset-events.mjs

@@ -0,0 +1,85 @@
+// Reports the preset-related events in one session log — the durable evidence of
+// which preset a session was composed with, and whether a selection was attempted.
+//
+// Usage: node tools/inspect-preset-events.mjs <session-dir>
+
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { createZstdDecompress } from 'node:zlib';
+
+/** Locate the end of the first zstd frame, where the next one begins. */
+function firstFrameEnd(buf) {
+  for (let i = 4; i + 4 <= buf.length; i += 1) {
+    if (buf[i] === 0x28 && buf[i + 1] === 0xb5 && buf[i + 2] === 0x2f && buf[i + 3] === 0xfd) return i;
+  }
+  return buf.length;
+}
+
+/** Decompress a concatenated-zstd log frame by frame. */
+async function decompressAll(buf) {
+  let rest = buf;
+  let text = '';
+  while (rest.length > 0) {
+    const slice = rest.subarray(0, firstFrameEnd(rest));
+    try {
+      text += await new Promise((resolve, reject) => {
+        const chunks = [];
+        const dec = createZstdDecompress();
+        dec.on('data', (chunk) => chunks.push(chunk));
+        dec.on('error', reject);
+        dec.on('end', () => resolve(Buffer.concat(chunks).toString('utf8')));
+        dec.end(slice);
+      });
+    } catch {
+      break;
+    }
+    if (slice.length >= rest.length) break;
+    rest = rest.subarray(slice.length);
+  }
+  return text;
+}
+
+const dir = process.argv[2];
+if (dir === undefined) {
+  process.stderr.write('usage: node tools/inspect-preset-events.mjs <session-dir>\n');
+  process.exit(2);
+}
+
+const text = await decompressAll(readFileSync(join(dir, 'session.v4.jsonl.zstd')));
+const events = text
+  .split('\n')
+  .filter((line) => line.trim().length > 0)
+  .flatMap((line) => {
+    try {
+      return [JSON.parse(line)];
+    } catch {
+      return [];
+    }
+  });
+
+process.stdout.write(`${events.length} events, ${text.length} chars\n\n`);
+
+const header = events[0];
+process.stdout.write(`header: id=${header?.id}\n  agentPreset=${header?.agentPreset}\n  origin=${header?.origin} depth=${header?.delegationDepth}\n`);
+
+process.stdout.write('\npreset-related events:\n');
+let found = 0;
+for (const event of events) {
+  const type = String(event.type ?? '');
+  if (!/preset/i.test(type)) continue;
+  found += 1;
+  process.stdout.write(`  #${events.indexOf(event)} ${type} ${JSON.stringify(event.data ?? event).slice(0, 220)}\n`);
+}
+if (found === 0) process.stdout.write('  (none — no agent-preset/selected event was ever appended)\n');
+
+process.stdout.write('\nuser messages (first 3):\n');
+let users = 0;
+for (const event of events) {
+  const content = event.data?.message?.content ?? event.message?.content;
+  const role = event.data?.message?.role ?? event.message?.role;
+  if (role !== 'user' || typeof content !== 'string') continue;
+  users += 1;
+  if (users > 3) break;
+  process.stdout.write(`  #${events.indexOf(event)} ${JSON.stringify(content.slice(0, 160))}\n`);
+}
+if (users === 0) process.stdout.write('  (no user messages recorded yet)\n');

package/tools/verify-session.mjs

@@ -58,7 +58,7 @@ async function decompressAll(buf) {
   return text;
 }
 
-/** Read one session directory into {header, events}. */
+/** Read one session directory into {header, events, text}. */
 async function readSession(dir) {
   const text = await decompressAll(readFileSync(join(dir, 'session.v4.jsonl.zstd')));
   const events = text
@@ -71,9 +71,17 @@ async function readSession(dir) {
         return [];
       }
     });
-  return { header: events[0], events };
+  return { header: events[0], events, text };
 }
 
+/**
+ * A phrase only this preset's persona contains, so finding it in a session proves
+ * that session was composed with root-planner. Chosen against the alternative of
+ * matching "You are a delegated subagent", which DSH injects into EVERY subagent's
+ * runtime context and therefore proves nothing.
+ */
+const PERSONA_MARKER = 'the same rules govern every node';
+
 const argv = process.argv.slice(2);
 const quiet = argv.includes('--quiet');
 const expectDepthIndex = argv.indexOf('--expect-depth');
@@ -139,11 +147,48 @@ const check = (ok, label) => {
 
 if (!quiet) process.stdout.write(`root session: ${root.header?.id}\n`);
 
+/**
+ * Which preset a session is ACTUALLY running.
+ *
+ * The session header's `agentPreset` is written when the session is created, with
+ * the default preset, and the client then switches preset through
+ * `agentPresets.select()` — which appends an `agent-preset/selected` event and
+ * recomposes the agent, but never rewrites the header. Judging a run by the header
+ * reports "standard" for a session that is genuinely running something else, and
+ * this tool made exactly that mistake twice before the prompt text settled it.
+ *
+ * Identity is therefore taken from the strongest available evidence, in order:
+ *   1. this preset's persona prose appearing in the session's own content — only a
+ *      session composed with root-planner can contain it;
+ *   2. the recorded `agent-preset/selected` event;
+ *   3. the header, which is the creation default and the weakest of the three.
+ * @param session - one read session.
+ * @returns the resolved preset id and what it was resolved from.
+ */
+function resolvePreset(session) {
+  if ((session.text ?? '').includes(PERSONA_MARKER)) {
+    return { preset: 'root-planner', evidence: 'persona text in the session' };
+  }
+  for (const event of session.events) {
+    if (event.type === 'agent-preset/selected' && typeof event.data?.agentPreset === 'string') {
+      return { preset: event.data.agentPreset, evidence: 'agent-preset/selected event' };
+    }
+  }
+  return { preset: session.header?.agentPreset, evidence: 'session header (creation default)' };
+}
+
+const rootPreset = resolvePreset(root);
 check(
-  root.header?.agentPreset === 'root-planner',
-  `root session is composed with root-planner (found "${root.header?.agentPreset ?? '?'}") — if this fails, the run proves nothing about the preset`,
+  rootPreset.preset === 'root-planner',
+  `root session runs root-planner (found "${rootPreset.preset}" via ${rootPreset.evidence})`,
 );
 check(root.header?.delegationDepth === 0, `root is at depth 0 (found ${root.header?.delegationDepth})`);
+if (!quiet && root.header?.agentPreset !== rootPreset.preset) {
+  process.stdout.write(
+    `note: the header says "${root.header?.agentPreset}" while the session runs "${rootPreset.preset}" ` +
+      `(${rootPreset.evidence}) — the header is the creation default, not the running preset\n`,
+  );
+}
 
 const children = sessions.filter((session) => session.header?.parentSession === root.header?.id);
 const byId = new Map(sessions.map((session) => [session.header?.id, session]));
@@ -160,8 +205,9 @@ const depthOf = (session) => {
 if (!quiet) {
   process.stdout.write(`\n${sessions.length} session(s) total:\n`);
   for (const session of sessions) {
+    const preset = resolvePreset(session);
     process.stdout.write(
-      `  ${String(session.header?.id).slice(0, 20)}  preset=${String(session.header?.agentPreset).padEnd(14)} ` +
+      `  ${String(session.header?.id).slice(0, 20)}  preset=${String(preset.preset).padEnd(14)} ` +
         `depth=${depthOf(session)}  parent=${String(session.header?.parentSession ?? '(root)').slice(0, 20)}\n`,
     );
   }
@@ -173,9 +219,10 @@ check(descendants.length > 0, 'the root actually delegated (at least one child s
 
 for (const session of descendants) {
   const depth = depthOf(session);
+  const preset = resolvePreset(session);
   check(
-    session.header?.agentPreset === 'root-planner',
-    `child ${String(session.header?.id).slice(0, 8)} at depth ${depth} inherits root-planner (found "${session.header?.agentPreset ?? '?'}")`,
+    preset.preset === 'root-planner',
+    `child ${String(session.header?.id).slice(0, 8)} at depth ${depth} runs root-planner (found "${preset.preset}" via ${preset.evidence})`,
   );
 }