dsh-root-planner-preset 1.3.0 → 1.3.1

package/build-patch.mjs

@@ -226,17 +226,21 @@ const patch = `# Generated by build-patch.mjs from persona.txt. Do not hand-edit
           - id: tool-plugin-manager
             name: '@deepseek-ai/dsh-plugin-manager/tools'
             disabled: true
-          # The workspace fence. Mounted as a preset row so one install carries the
-          # protocol and its enforcement together: the persona tells a child to write
-          # under its own _agents/ directory, and this refuses anything else before
-          # the call runs. It is preset-scoped rather than a separate profile bundle
-          # because the _agents/ convention only exists here — a guard without this
-          # persona would fence agents that were never told where they may write.
-          - id: root-planner-guard
-            name: 'dsh-root-planner-preset/guard'
-            config:
-              directoryName: _agents
-              guardShell: true
+
+# The workspace fence travels in the same package, but as a SIBLING entry rather than a
+# row inside the preset above. A preset row is mounted per agent, and measured against a
+# live session that mount never took effect: six probe steps (write outside, .. escape,
+# shell without workdir, shell absolute path, plus the two allowed controls) all came
+# back allowed. As a profile-level entry — the shape the standalone guard bundle was
+# proved in — one instance sees every call and decides from the calling agent's session
+# header, which is all this guard needs. Shipping it here still means one install carries
+# the protocol and its enforcement together.
+- insert:
+    - id: root-planner-guard
+      name: 'dsh-root-planner-preset/guard'
+      config:
+        directoryName: _agents
+        guardShell: true
 `;
 
 // Substitution happens after the template so the emitted indentation is owned by

package/cordis.patch.yml

@@ -289,14 +289,18 @@
           - id: tool-plugin-manager
             name: '@deepseek-ai/dsh-plugin-manager/tools'
             disabled: true
-          # The workspace fence. Mounted as a preset row so one install carries the
-          # protocol and its enforcement together: the persona tells a child to write
-          # under its own _agents/ directory, and this refuses anything else before
-          # the call runs. It is preset-scoped rather than a separate profile bundle
-          # because the _agents/ convention only exists here — a guard without this
-          # persona would fence agents that were never told where they may write.
-          - id: root-planner-guard
-            name: 'dsh-root-planner-preset/guard'
-            config:
-              directoryName: _agents
-              guardShell: true
+
+# The workspace fence travels in the same package, but as a SIBLING entry rather than a
+# row inside the preset above. A preset row is mounted per agent, and measured against a
+# live session that mount never took effect: six probe steps (write outside, .. escape,
+# shell without workdir, shell absolute path, plus the two allowed controls) all came
+# back allowed. As a profile-level entry — the shape the standalone guard bundle was
+# proved in — one instance sees every call and decides from the calling agent's session
+# header, which is all this guard needs. Shipping it here still means one install carries
+# the protocol and its enforcement together.
+- insert:
+    - id: root-planner-guard
+      name: 'dsh-root-planner-preset/guard'
+      config:
+        directoryName: _agents
+        guardShell: true

package/guard.js

@@ -170,8 +170,17 @@ export function apply(ctx, config = {}) {
   // Registered on the plugin's own context: a plain-context guard applies globally,
   // and the decision is made per call from `exec.agent`, so no per-agent wiring is
   // needed and no registration leaks when an agent is disposed.
+  //
+  // The service is read with `ctx.get` rather than `ctx.tools` on purpose: a missing
+  // service should leave the guard absent and silent, not throw inside the effect where
+  // the failure would look like a plugin that simply does nothing.
   ctx.effect(() => {
-    const dispose = ctx.tools.guard((exec) => {
+    const tools = typeof ctx.get === 'function' ? ctx.get('tools') : ctx.tools
+    if (tools === undefined) {
+      trace('no tools service — guard not registered')
+      return () => {}
+    }
+    const dispose = tools.guard((exec) => {
       const header = exec?.agent?.session?.header
       // Only delegated sessions are fenced: the root owns the workspace and must be
       // able to write anywhere in it, or it could not integrate a child's artifacts.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-root-planner-preset",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "type": "module",
   "description": "DSH agent preset: the root agent plans and decides, subagent workers read, write and run commands inside their own _agents/ workspace, and nothing outlives its task.",
   "license": "MIT",

package/verify-patch.mjs

@@ -116,10 +116,15 @@ const delegation = plugins.find((row) => row.id === 'delegation');
 check(delegation?.group === true, 'delegation is a group row');
 
 // The workspace fence travels with the preset, so one install carries the protocol and
-// its enforcement. These assertions keep that promise honest: the row must exist, must
-// resolve to this package's own module, and must ship that module.
-const guardRow = plugins.find((row) => row.id === 'root-planner-guard');
-check(guardRow !== undefined, 'the preset mounts the workspace guard as its own row');
+// its enforcement. It must be a TOP-LEVEL insert, not a row inside `config.plugins`.
+//
+// That distinction is measured, not stylistic: while this guard was declared as a preset
+// row, a live six-step probe came back all-allowed — the row exists in the composed
+// config yet registers nothing that sees a tool call. As a sibling entry (the shape the
+// standalone guard bundle was proved in) one instance sees every call. The last check
+// here keeps a future refactor from quietly moving it back.
+const guardRow = inserted.find((row) => row.id === 'root-planner-guard');
+check(guardRow !== undefined, 'the patch inserts the workspace guard as a top-level entry');
 check(
   guardRow?.name === 'dsh-root-planner-preset/guard',
   `the guard row resolves to this package's subpath (found ${JSON.stringify(guardRow?.name)})`,
@@ -127,6 +132,10 @@ check(
 check(guardRow?.disabled !== true, 'the guard row is enabled');
 check(guardRow?.config?.directoryName === '_agents', 'the guard fences the _agents/ directory');
 check(guardRow?.config?.guardShell === true, 'the guard also applies the shell rules');
+check(
+  plugins.every((row) => row.id !== 'root-planner-guard'),
+  'the guard is NOT declared as a preset plugin row (that mount registers nothing)',
+);
 check(existsSync(join(here, 'guard.js')), 'guard.js ships inside the package');
 {
   const manifest = JSON.parse(readFileSync(join(here, 'package.json'), 'utf8'));