dsh-root-planner-preset 1.3.0 → 1.3.2

package/INSTALL.md

@@ -62,7 +62,14 @@ of writing "...\report.md" directly.
 
 **一个仍然存在的限制**：shell 命令能在运行时拼出路径（`$env:X` 拼 `'..'`、脚本内部写、Here-String），参数扫描看不见。要真正关住子代理的 shell 需要给它更窄的沙箱写域，而 DSH 给不了（`sandboxPolicy.resolve()` 只接受 `{session, mode}`，`workspaceRoot` 恒等于不可变的会话 cwd）。所以父 agent 的时间戳核验仍是兜底——人设里已经写了。
 
-> 守卫以**预设行**形式挂载，所以只有用 `root-planner` 预设的 agent 才受约束：`_agents/` 这套约定只有这个预设的人设定义过。
+> 守卫是以**profile 级条目**挂载的（不是预设内的一行）。这意味着它约束**这个 profile 里的每个被委派 agent**——包括用着别的预设、从没被告知 `_agents/` 的子代理。如果你在同一个 profile 里也用别的预设加子代理，可以在 profile 补丁里关掉它：
+>
+> ```yaml
+> - id: root-planner-guard
+>   disabled: true
+> ```
+>
+> 为什么不做成预设行（那样就只约束本预设）？试过了，**实测不生效**：配置里那一行存在且看起来正常，但真实会话上六步探针全部放行。所以 `verify-patch.mjs` 现在会在有人改回预设行时直接失败。
 
 ### 方式 2：GitHub 源码
 

package/README.md

@@ -36,11 +36,11 @@ the root decides which to copy in — merging into an existing file where that i
 change means, keeping them separate where it is not. `_agents/` stays (and belongs in
 `.gitignore`) so the same agent can be continued later.
 
-**The boundary is enforced, not just agreed.** This preset ships the fence as its own
-plugin row (`dsh-root-planner-preset/guard`), so one install carries the protocol and its
-enforcement together. It refuses a `write`, `edit` or `ops_replace` whose target resolves
-outside `<workspace>/_agents/`, and refuses a shell call whose `workdir` is outside it or
-whose command names an absolute path into your files:
+**The boundary is enforced, not just agreed.** This preset's package also ships the fence
+as a profile-level entry (`dsh-root-planner-preset/guard`), so one install carries the
+protocol and its enforcement together. It refuses a `write`, `edit` or `ops_replace` whose
+target resolves outside `<workspace>/_agents/`, and refuses a shell call whose `workdir` is
+outside it or whose command names an absolute path into your files:
 
 ```
 write: outside your workspace. You may write only inside "...\_agents"; everything else
@@ -51,9 +51,25 @@ of writing "...\report.md" directly.
 The root session is never fenced: it owns the workspace and has to be able to write
 anywhere in it to integrate a child's artifacts.
 
+**Being profile-level, it fences every delegated agent in this profile** — including
+subagents under a different preset, which were never told about `_agents/`. If that matters
+on your machine, turn the entry off in your profile patch:
+
+```yaml
+- id: root-planner-guard
+  disabled: true
+```
+
+Declaring the guard as a row *inside* the preset would scope it to this preset only, and
+that was tried first: measured against a live session it registered nothing — six probe
+steps all came back allowed while the composed config looked correct. `verify-patch.mjs`
+now fails if anyone declares it as a preset row again.
+
 One limitation survives, and it is worth knowing before you rely on this: a shell command
 can build a path at runtime (`$env:X` + `'..'`, a script that writes, a Here-String), and
-no argument scan can see it. Confining a child's shell properly would need a narrower
+no argument scan can see it. The command scan matches **drive-letter** paths, so on POSIX
+it detects nothing at all — the two CI cases for it are skipped there rather than pretending
+otherwise. Confining a child's shell properly would need a narrower
 sandbox write root, which DSH cannot give a child — `sandboxPolicy.resolve()` accepts only
 `{ session, mode }` and derives `workspaceRoot` from the immutable, inherited
 `session.header.cwd`. So keep the parent's check as the backstop:

package/README.zh.md

@@ -30,7 +30,7 @@
 
 并发问题是用**隔离**解决的，不是用协调。派活之前，根创建 `_agents/<label>/` 并把**绝对路径**写进任务；子代理**只往那里写**，父目录的文件随便读，要改就发申请。完成后它报告产物清单，由根决定复制哪些进自己的工作区——该合并进现有文件的就合并，该保持独立的就独立。`_agents/` 会保留（并应进 `.gitignore`），以便日后继续使用同一个子代理。
 
-**这条边界是强制执行的，不只是约定。** 预设自带围栏（自己的插件行 `dsh-root-planner-preset/guard`），一次安装同时得到协议和它的执行。它拒绝目标落在 `<工作区>/_agents/` 之外的 `write`、`edit`、`ops_replace`；也拒绝 `workdir` 在工作区之外的 shell 调用，以及命令里写着你文件的绝对路径：
+**这条边界是强制执行的，不只是约定。** 预设所在的包同时提供围栏，作为一条**profile 级条目**（`dsh-root-planner-preset/guard`），一次安装同时得到协议和它的执行。它拒绝目标落在 `<工作区>/_agents/` 之外的 `write`、`edit`、`ops_replace`；也拒绝 `workdir` 在工作区之外的 shell 调用，以及命令里写着你文件的绝对路径：
 
 ```
 write: outside your workspace. You may write only inside "...\_agents"; everything else
@@ -40,7 +40,16 @@ of writing "...\report.md" directly.
 
 根会话**不受围栏限制**——它必须能在自己工作区任意位置写，才能把子代理的产物并入。
 
-**有一个限制必须知道**：shell 命令能在运行时拼出路径（`$env:X` 拼 `'..'`、脚本内部写、Here-String），参数扫描看不见。要真正关住子代理的 shell，需要给它一个更窄的沙箱写域，而 DSH 给不了——`sandboxPolicy.resolve()` 只接受 `{ session, mode }`，`workspaceRoot` 恒等于不可变、从父会话继承的 `session.header.cwd`。所以父 agent 的核验仍然是兜底：
+**因为它是 profile 级的，它约束这个 profile 里的每个被委派 agent**——包括用着别的预设、从没被告知 `_agents/` 的子代理。如果这会影响到你，在 profile 补丁里把这条关掉：
+
+```yaml
+- id: root-planner-guard
+  disabled: true
+```
+
+把守卫声明成**预设内的一行**可以只约束本预设，但那是先试过的做法：在真实会话上实测，它什么都注册不上——六步探针全部放行，而 composed 配置看起来完全正常。现在 `verify-patch.mjs` 会在有人把它改回预设行时直接失败。
+
+**还有一个限制必须知道**：shell 命令能在运行时拼出路径（`$env:X` 拼 `'..'`、脚本内部写、Here-String），参数扫描看不见。而且命令扫描只认**盘符路径**，所以在 POSIX 上它**什么也检测不到**——CI 里那两条用例在 Linux 上是**显式跳过**的，而不是假装通过。要真正关住子代理的 shell，需要给它一个更窄的沙箱写域，而 DSH 给不了——`sandboxPolicy.resolve()` 只接受 `{ session, mode }`，`workspaceRoot` 恒等于不可变、从父会话继承的 `session.header.cwd`。所以父 agent 的核验仍然是兜底：
 
 ```sh
 # 派活前

package/build-patch.mjs

@@ -226,17 +226,21 @@ const patch = `# Generated by build-patch.mjs from persona.txt. Do not hand-edit
           - id: tool-plugin-manager
             name: '@deepseek-ai/dsh-plugin-manager/tools'
             disabled: true
-          # The workspace fence. Mounted as a preset row so one install carries the
-          # protocol and its enforcement together: the persona tells a child to write
-          # under its own _agents/ directory, and this refuses anything else before
-          # the call runs. It is preset-scoped rather than a separate profile bundle
-          # because the _agents/ convention only exists here — a guard without this
-          # persona would fence agents that were never told where they may write.
-          - id: root-planner-guard
-            name: 'dsh-root-planner-preset/guard'
-            config:
-              directoryName: _agents
-              guardShell: true
+
+# The workspace fence travels in the same package, but as a SIBLING entry rather than a
+# row inside the preset above. A preset row is mounted per agent, and measured against a
+# live session that mount never took effect: six probe steps (write outside, .. escape,
+# shell without workdir, shell absolute path, plus the two allowed controls) all came
+# back allowed. As a profile-level entry — the shape the standalone guard bundle was
+# proved in — one instance sees every call and decides from the calling agent's session
+# header, which is all this guard needs. Shipping it here still means one install carries
+# the protocol and its enforcement together.
+- insert:
+    - id: root-planner-guard
+      name: 'dsh-root-planner-preset/guard'
+      config:
+        directoryName: _agents
+        guardShell: true
 `;
 
 // Substitution happens after the template so the emitted indentation is owned by

package/cordis.patch.yml

@@ -289,14 +289,18 @@
           - id: tool-plugin-manager
             name: '@deepseek-ai/dsh-plugin-manager/tools'
             disabled: true
-          # The workspace fence. Mounted as a preset row so one install carries the
-          # protocol and its enforcement together: the persona tells a child to write
-          # under its own _agents/ directory, and this refuses anything else before
-          # the call runs. It is preset-scoped rather than a separate profile bundle
-          # because the _agents/ convention only exists here — a guard without this
-          # persona would fence agents that were never told where they may write.
-          - id: root-planner-guard
-            name: 'dsh-root-planner-preset/guard'
-            config:
-              directoryName: _agents
-              guardShell: true
+
+# The workspace fence travels in the same package, but as a SIBLING entry rather than a
+# row inside the preset above. A preset row is mounted per agent, and measured against a
+# live session that mount never took effect: six probe steps (write outside, .. escape,
+# shell without workdir, shell absolute path, plus the two allowed controls) all came
+# back allowed. As a profile-level entry — the shape the standalone guard bundle was
+# proved in — one instance sees every call and decides from the calling agent's session
+# header, which is all this guard needs. Shipping it here still means one install carries
+# the protocol and its enforcement together.
+- insert:
+    - id: root-planner-guard
+      name: 'dsh-root-planner-preset/guard'
+      config:
+        directoryName: _agents
+        guardShell: true

package/guard.js

@@ -170,8 +170,17 @@ export function apply(ctx, config = {}) {
   // Registered on the plugin's own context: a plain-context guard applies globally,
   // and the decision is made per call from `exec.agent`, so no per-agent wiring is
   // needed and no registration leaks when an agent is disposed.
+  //
+  // The service is read with `ctx.get` rather than `ctx.tools` on purpose: a missing
+  // service should leave the guard absent and silent, not throw inside the effect where
+  // the failure would look like a plugin that simply does nothing.
   ctx.effect(() => {
-    const dispose = ctx.tools.guard((exec) => {
+    const tools = typeof ctx.get === 'function' ? ctx.get('tools') : ctx.tools
+    if (tools === undefined) {
+      trace('no tools service — guard not registered')
+      return () => {}
+    }
+    const dispose = tools.guard((exec) => {
       const header = exec?.agent?.session?.header
       // Only delegated sessions are fenced: the root owns the workspace and must be
       // able to write anywhere in it, or it could not integrate a child's artifacts.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-root-planner-preset",
-  "version": "1.3.0",
+  "version": "1.3.2",
   "type": "module",
   "description": "DSH agent preset: the root agent plans and decides, subagent workers read, write and run commands inside their own _agents/ workspace, and nothing outlives its task.",
   "license": "MIT",

package/verify-patch.mjs

@@ -116,10 +116,15 @@ const delegation = plugins.find((row) => row.id === 'delegation');
 check(delegation?.group === true, 'delegation is a group row');
 
 // The workspace fence travels with the preset, so one install carries the protocol and
-// its enforcement. These assertions keep that promise honest: the row must exist, must
-// resolve to this package's own module, and must ship that module.
-const guardRow = plugins.find((row) => row.id === 'root-planner-guard');
-check(guardRow !== undefined, 'the preset mounts the workspace guard as its own row');
+// its enforcement. It must be a TOP-LEVEL insert, not a row inside `config.plugins`.
+//
+// That distinction is measured, not stylistic: while this guard was declared as a preset
+// row, a live six-step probe came back all-allowed — the row exists in the composed
+// config yet registers nothing that sees a tool call. As a sibling entry (the shape the
+// standalone guard bundle was proved in) one instance sees every call. The last check
+// here keeps a future refactor from quietly moving it back.
+const guardRow = inserted.find((row) => row.id === 'root-planner-guard');
+check(guardRow !== undefined, 'the patch inserts the workspace guard as a top-level entry');
 check(
   guardRow?.name === 'dsh-root-planner-preset/guard',
   `the guard row resolves to this package's subpath (found ${JSON.stringify(guardRow?.name)})`,
@@ -127,6 +132,10 @@ check(
 check(guardRow?.disabled !== true, 'the guard row is enabled');
 check(guardRow?.config?.directoryName === '_agents', 'the guard fences the _agents/ directory');
 check(guardRow?.config?.guardShell === true, 'the guard also applies the shell rules');
+check(
+  plugins.every((row) => row.id !== 'root-planner-guard'),
+  'the guard is NOT declared as a preset plugin row (that mount registers nothing)',
+);
 check(existsSync(join(here, 'guard.js')), 'guard.js ships inside the package');
 {
   const manifest = JSON.parse(readFileSync(join(here, 'package.json'), 'utf8'));