dsh-root-planner-preset 1.1.3 → 1.1.4

package/child-tools.mjs

@@ -63,13 +63,25 @@ export const CHILD_TOOLS = [
   // Running commands. `pwsh` is the one shell this profile reports as a global
   // tool, and background jobs are switched off for it in the preset (see above).
   //
-  // `ops_bash` is deliberately NOT here even though it looks like the natural
-  // choice on Windows: the runtime's own tool inventory — the list
-  // `tools.restrict()` prints when it refuses a name — includes
-  // ops_glob/ops_grep/ops_inspect_local_file but NOT ops_bash, so naming it breaks
-  // every child creation exactly the way `subagent` did. The dsh-ops shell
-  // component publishes it through a different path than its file component. Add
-  // it only after seeing it in your own environment's inventory line.
+  // `ops_bash` is deliberately NOT here, and it is not an oversight — it CANNOT be
+  // here, for the same reason `subagent` cannot:
+  //
+  //   * dsh-ops publishes it per AGENT, not globally. `lib/session-shells.js`
+  //     mounts a child plugin on each `agent.ctx` and registers the tool there
+  //     (`entry.ctx.tools.register(definition)`), then walks the agents again to
+  //     `tools.restrict({ deny: [BASH_TOOL] })` on the ones it may not serve. So it
+  //     never appears in the runtime's global inventory, and naming it in a mask
+  //     fails child creation the way `subagent` did.
+  //   * It cannot be granted because it does not need granting. `allowed(agent)`
+  //     tests the agent's OWN session policy — full access, or a confinement
+  //     provider available — and a child qualifies on the same terms as the root,
+  //     so a child receives `ops_bash` from dsh-ops by itself. That project's own
+  //     manual-validation notes say it plainly: a restricted session does not
+  //     publish `ops_bash`; it appears only with full access, `publishBashTool`,
+  //     a resolvable bash payload and an available subprocess service.
+  //
+  // The consequence worth knowing: a child's shell can differ from the root's
+  // because of its own permission mode, not because of anything this mask says.
   'pwsh',
   'todo_write',
   'ask_user_question',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-root-planner-preset",
-  "version": "1.1.3",
+  "version": "1.1.4",
   "type": "module",
   "description": "DSH agent preset that outsources file reading to strictly read-only subagents, while the root agent keeps the plan and owns every file mutation.",
   "license": "MIT",

package/release.mjs

@@ -39,7 +39,8 @@ const here = dirname(fileURLToPath(import.meta.url));
 const OFFICIAL_REGISTRY = 'https://registry.npmjs.org/';
 const PROXY = process.env.HTTPS_PROXY ?? process.env.HTTP_PROXY ?? 'http://127.0.0.1:7897';
 const GIT = process.env.DSH_RELEASE_GIT ?? 'git';
-const GH = process.env.DSH_RELEASE_GH ?? 'gh';
+// `gh` is not installed on PATH on this machine; it lives in a standalone extract.
+const GH = process.env.DSH_RELEASE_GH ?? 'D:/Tools/gh/2.102.0/bin/gh.exe';
 const PUBLISHER = process.env.DSH_RELEASE_PUBLISHER ?? (process.platform === 'win32' ? 'pnpm' : 'npm');
 
 const argv = process.argv.slice(2);

package/tools/inspect-preset-events.mjs

@@ -0,0 +1,85 @@
+// Reports the preset-related events in one session log — the durable evidence of
+// which preset a session was composed with, and whether a selection was attempted.
+//
+// Usage: node tools/inspect-preset-events.mjs <session-dir>
+
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { createZstdDecompress } from 'node:zlib';
+
+/** Locate the end of the first zstd frame, where the next one begins. */
+function firstFrameEnd(buf) {
+  for (let i = 4; i + 4 <= buf.length; i += 1) {
+    if (buf[i] === 0x28 && buf[i + 1] === 0xb5 && buf[i + 2] === 0x2f && buf[i + 3] === 0xfd) return i;
+  }
+  return buf.length;
+}
+
+/** Decompress a concatenated-zstd log frame by frame. */
+async function decompressAll(buf) {
+  let rest = buf;
+  let text = '';
+  while (rest.length > 0) {
+    const slice = rest.subarray(0, firstFrameEnd(rest));
+    try {
+      text += await new Promise((resolve, reject) => {
+        const chunks = [];
+        const dec = createZstdDecompress();
+        dec.on('data', (chunk) => chunks.push(chunk));
+        dec.on('error', reject);
+        dec.on('end', () => resolve(Buffer.concat(chunks).toString('utf8')));
+        dec.end(slice);
+      });
+    } catch {
+      break;
+    }
+    if (slice.length >= rest.length) break;
+    rest = rest.subarray(slice.length);
+  }
+  return text;
+}
+
+const dir = process.argv[2];
+if (dir === undefined) {
+  process.stderr.write('usage: node tools/inspect-preset-events.mjs <session-dir>\n');
+  process.exit(2);
+}
+
+const text = await decompressAll(readFileSync(join(dir, 'session.v4.jsonl.zstd')));
+const events = text
+  .split('\n')
+  .filter((line) => line.trim().length > 0)
+  .flatMap((line) => {
+    try {
+      return [JSON.parse(line)];
+    } catch {
+      return [];
+    }
+  });
+
+process.stdout.write(`${events.length} events, ${text.length} chars\n\n`);
+
+const header = events[0];
+process.stdout.write(`header: id=${header?.id}\n  agentPreset=${header?.agentPreset}\n  origin=${header?.origin} depth=${header?.delegationDepth}\n`);
+
+process.stdout.write('\npreset-related events:\n');
+let found = 0;
+for (const event of events) {
+  const type = String(event.type ?? '');
+  if (!/preset/i.test(type)) continue;
+  found += 1;
+  process.stdout.write(`  #${events.indexOf(event)} ${type} ${JSON.stringify(event.data ?? event).slice(0, 220)}\n`);
+}
+if (found === 0) process.stdout.write('  (none — no agent-preset/selected event was ever appended)\n');
+
+process.stdout.write('\nuser messages (first 3):\n');
+let users = 0;
+for (const event of events) {
+  const content = event.data?.message?.content ?? event.message?.content;
+  const role = event.data?.message?.role ?? event.message?.role;
+  if (role !== 'user' || typeof content !== 'string') continue;
+  users += 1;
+  if (users > 3) break;
+  process.stdout.write(`  #${events.indexOf(event)} ${JSON.stringify(content.slice(0, 160))}\n`);
+}
+if (users === 0) process.stdout.write('  (no user messages recorded yet)\n');

package/tools/verify-session.mjs

@@ -58,7 +58,7 @@ async function decompressAll(buf) {
   return text;
 }
 
-/** Read one session directory into {header, events}. */
+/** Read one session directory into {header, events, text}. */
 async function readSession(dir) {
   const text = await decompressAll(readFileSync(join(dir, 'session.v4.jsonl.zstd')));
   const events = text
@@ -71,9 +71,17 @@ async function readSession(dir) {
         return [];
       }
     });
-  return { header: events[0], events };
+  return { header: events[0], events, text };
 }
 
+/**
+ * A phrase only this preset's persona contains, so finding it in a session proves
+ * that session was composed with root-planner. Chosen against the alternative of
+ * matching "You are a delegated subagent", which DSH injects into EVERY subagent's
+ * runtime context and therefore proves nothing.
+ */
+const PERSONA_MARKER = 'the same rules govern every node';
+
 const argv = process.argv.slice(2);
 const quiet = argv.includes('--quiet');
 const expectDepthIndex = argv.indexOf('--expect-depth');
@@ -139,11 +147,48 @@ const check = (ok, label) => {
 
 if (!quiet) process.stdout.write(`root session: ${root.header?.id}\n`);
 
+/**
+ * Which preset a session is ACTUALLY running.
+ *
+ * The session header's `agentPreset` is written when the session is created, with
+ * the default preset, and the client then switches preset through
+ * `agentPresets.select()` — which appends an `agent-preset/selected` event and
+ * recomposes the agent, but never rewrites the header. Judging a run by the header
+ * reports "standard" for a session that is genuinely running something else, and
+ * this tool made exactly that mistake twice before the prompt text settled it.
+ *
+ * Identity is therefore taken from the strongest available evidence, in order:
+ *   1. this preset's persona prose appearing in the session's own content — only a
+ *      session composed with root-planner can contain it;
+ *   2. the recorded `agent-preset/selected` event;
+ *   3. the header, which is the creation default and the weakest of the three.
+ * @param session - one read session.
+ * @returns the resolved preset id and what it was resolved from.
+ */
+function resolvePreset(session) {
+  if ((session.text ?? '').includes(PERSONA_MARKER)) {
+    return { preset: 'root-planner', evidence: 'persona text in the session' };
+  }
+  for (const event of session.events) {
+    if (event.type === 'agent-preset/selected' && typeof event.data?.agentPreset === 'string') {
+      return { preset: event.data.agentPreset, evidence: 'agent-preset/selected event' };
+    }
+  }
+  return { preset: session.header?.agentPreset, evidence: 'session header (creation default)' };
+}
+
+const rootPreset = resolvePreset(root);
 check(
-  root.header?.agentPreset === 'root-planner',
-  `root session is composed with root-planner (found "${root.header?.agentPreset ?? '?'}") — if this fails, the run proves nothing about the preset`,
+  rootPreset.preset === 'root-planner',
+  `root session runs root-planner (found "${rootPreset.preset}" via ${rootPreset.evidence})`,
 );
 check(root.header?.delegationDepth === 0, `root is at depth 0 (found ${root.header?.delegationDepth})`);
+if (!quiet && root.header?.agentPreset !== rootPreset.preset) {
+  process.stdout.write(
+    `note: the header says "${root.header?.agentPreset}" while the session runs "${rootPreset.preset}" ` +
+      `(${rootPreset.evidence}) — the header is the creation default, not the running preset\n`,
+  );
+}
 
 const children = sessions.filter((session) => session.header?.parentSession === root.header?.id);
 const byId = new Map(sessions.map((session) => [session.header?.id, session]));
@@ -160,8 +205,9 @@ const depthOf = (session) => {
 if (!quiet) {
   process.stdout.write(`\n${sessions.length} session(s) total:\n`);
   for (const session of sessions) {
+    const preset = resolvePreset(session);
     process.stdout.write(
-      `  ${String(session.header?.id).slice(0, 20)}  preset=${String(session.header?.agentPreset).padEnd(14)} ` +
+      `  ${String(session.header?.id).slice(0, 20)}  preset=${String(preset.preset).padEnd(14)} ` +
         `depth=${depthOf(session)}  parent=${String(session.header?.parentSession ?? '(root)').slice(0, 20)}\n`,
     );
   }
@@ -173,9 +219,10 @@ check(descendants.length > 0, 'the root actually delegated (at least one child s
 
 for (const session of descendants) {
   const depth = depthOf(session);
+  const preset = resolvePreset(session);
   check(
-    session.header?.agentPreset === 'root-planner',
-    `child ${String(session.header?.id).slice(0, 8)} at depth ${depth} inherits root-planner (found "${session.header?.agentPreset ?? '?'}")`,
+    preset.preset === 'root-planner',
+    `child ${String(session.header?.id).slice(0, 8)} at depth ${depth} runs root-planner (found "${preset.preset}" via ${preset.evidence})`,
   );
 }