dsh-root-planner-preset 1.4.1 → 1.4.2

package/build-patch.mjs

@@ -236,10 +236,17 @@ const patch = `# Generated by build-patch.mjs from persona.txt. Do not hand-edit
 # default persona instead of this preset's.
 #
 # The worker preset carries the same persona (it addresses both roles) and only the tool
-# plugins a worker needs. It also mounts worker-mask, which restricts the agent to
-# CHILD_TOOLS: several newer tools (tool-cordis, plugin-manager, working-directory,
-# schedule) are mounted at the app level rather than per preset, so leaving their rows out
-# would NOT remove them. The restriction is what makes the working set exactly CHILD_TOOLS.
+# plugins a worker needs. What the worker can call is decided HERE, by which rows exist:
+# in 0.2.1 a preset's rows register their tools per agent scope, and tools.restrict()
+# filters GLOBAL tools only — "restrictions intersect; scoped registrations remain
+# visible". A restriction therefore cannot narrow a preset's own tools, which is why an
+# earlier attempt on this branch mounted a mask row and failed with
+#   tools.restrict() names unknown global tools "read", "glob", "write", ...
+#   known global tools: ops_glob, ops_grep, ops_inspect_local_file, ops_replace,
+#                       working_directory
+# That short list is the whole set of globally mounted tools on this machine; every other
+# tool a worker sees comes from a row below. So the curated set is the row list itself,
+# and omitting a row really does remove its tools.
 - insert:
     - id: preset-root-planner-worker
       name: '@deepseek-ai/dsh-agent-preset'
@@ -259,8 +266,6 @@ const patch = `# Generated by build-patch.mjs from persona.txt. Do not hand-edit
             name: '@deepseek-ai/dsh-agent-instructions'
             config:
               maxBytes: 65536
-          - id: worker-mask
-            name: 'dsh-root-planner-preset/worker-mask'
           - id: tool-bash
             name: '@deepseek-ai/dsh-tool-bash'
             disabled: !!js process.platform === 'win32'

package/child-tools.mjs

@@ -1,9 +1,23 @@
 /**
- * The child tool mask — the single source of truth shared by the generator and
- * the verifier, so the two cannot disagree about what a subagent may call.
+ * The expected worker toolset — the list this bundle wants a subagent to end up with, kept
+ * in one place so the intent is stated once.
  *
- * These are the only GLOBAL tools a subagent may call. Everything absent is
- * invisible to the child.
+ * ## It is no longer a runtime mask, and cannot be one
+ *
+ * Until DSH 0.2.0 this list was handed to `dsh-tool-subagent` as `toolFilter.allow`.
+ * 0.2.1 removed that field: zod strips it silently and the child then runs the platform's
+ * default preset. The replacement the error message names is a preset (`agentPreset`), so
+ * what a worker can call is decided by which rows the `root-planner-worker` preset mounts.
+ *
+ * A `tools.restrict()` stand-in was tried and cannot work either: a preset's rows register
+ * their tools in the agent scope, and a restriction filters GLOBAL tools only
+ * ("restrictions intersect; scoped registrations remain visible"). On this machine the
+ * globally mounted set is just `ops_glob`, `ops_grep`, `ops_inspect_local_file`,
+ * `ops_replace` and `working_directory`; everything else a worker sees comes from a row.
+ *
+ * So this file is the documented expectation, verified against a live session rather than
+ * asserted against a snapshot: `verify-patch.mjs` proves the worker preset's row list, and
+ * `tools/extract-offered-tools.mjs` reads what a real child was actually offered.
  *
  * ## What a subagent MAY do
  *
@@ -12,7 +26,7 @@
  * project cannot run tests, git, or a verification script, so every executable
  * step bounces back to the root and the parallelism the tree exists for buys
  * nothing. `write`, `edit`, `ops_replace`, `ops_bash` and `pwsh` are all in the
- * mask for that reason.
+ * list for that reason.
  *
  * ## What is forbidden, and how it is enforced
  *

package/cordis.patch.yml

@@ -253,10 +253,17 @@
 # default persona instead of this preset's.
 #
 # The worker preset carries the same persona (it addresses both roles) and only the tool
-# plugins a worker needs. It also mounts worker-mask, which restricts the agent to
-# CHILD_TOOLS: several newer tools (tool-cordis, plugin-manager, working-directory,
-# schedule) are mounted at the app level rather than per preset, so leaving their rows out
-# would NOT remove them. The restriction is what makes the working set exactly CHILD_TOOLS.
+# plugins a worker needs. What the worker can call is decided HERE, by which rows exist:
+# in 0.2.1 a preset's rows register their tools per agent scope, and tools.restrict()
+# filters GLOBAL tools only — "restrictions intersect; scoped registrations remain
+# visible". A restriction therefore cannot narrow a preset's own tools, which is why an
+# earlier attempt on this branch mounted a mask row and failed with
+#   tools.restrict() names unknown global tools "read", "glob", "write", ...
+#   known global tools: ops_glob, ops_grep, ops_inspect_local_file, ops_replace,
+#                       working_directory
+# That short list is the whole set of globally mounted tools on this machine; every other
+# tool a worker sees comes from a row below. So the curated set is the row list itself,
+# and omitting a row really does remove its tools.
 - insert:
     - id: preset-root-planner-worker
       name: '@deepseek-ai/dsh-agent-preset'
@@ -347,8 +354,6 @@
             name: '@deepseek-ai/dsh-agent-instructions'
             config:
               maxBytes: 65536
-          - id: worker-mask
-            name: 'dsh-root-planner-preset/worker-mask'
           - id: tool-bash
             name: '@deepseek-ai/dsh-tool-bash'
             disabled: !!js process.platform === 'win32'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-root-planner-preset",
-  "version": "1.4.1",
+  "version": "1.4.2",
   "type": "module",
   "description": "DSH agent preset: the root agent plans and decides, subagent workers read, write and run commands inside their own _agents/ workspace, and nothing outlives its task.",
   "license": "MIT",
@@ -8,12 +8,10 @@
   "exports": {
     ".": "./guard.js",
     "./guard": "./guard.js",
-    "./worker-mask": "./worker-mask.js",
     "./package.json": "./package.json"
   },
   "files": [
     "guard.js",
-    "worker-mask.js",
     "persona.txt",
     "child-tools.mjs",
     "build-patch.mjs",

package/verify-patch.mjs

@@ -144,20 +144,56 @@ check(existsSync(join(here, 'guard.js')), 'guard.js ships inside the package');
 }
 const delegationRows = delegation?.config ?? [];
 
-// DSH 0.2.1 removed `toolFilter` from the delegation tool. It does not warn: zod strips
-// the key and the child then runs the platform's DEFAULT preset, which is how a live child
-// ended up with all 39 tools and the wrong persona. The curated child toolset therefore
-// moved to two places at once — a worker preset (which decides the mounted tool plugins)
-// and `worker-mask` (which subtracts the app-level tools a preset cannot omit).
+// DSH 0.2.1 removed `toolFilter` from the delegation tool, and it does not warn: zod
+// strips the key and the child then runs the platform's DEFAULT preset. The worker's tool
+// set is now decided by which rows the worker preset mounts, because a preset's rows
+// register their tools in the agent scope while `tools.restrict()` filters GLOBAL tools
+// only ("restrictions intersect; scoped registrations remain visible"). A mask row was
+// tried first and failed at activation with:
+//   tools.restrict() names unknown global tools "read", "glob", "write", ...
+//   known global tools: ops_glob, ops_grep, ops_inspect_local_file, ops_replace,
+//                       working_directory
+// Those five are the entire global set on this machine; everything else a worker sees
+// comes from a row. So the assertions below are about rows, and they are two-sided:
+// required rows must exist, forbidden rows must not.
 const workerRow = inserted.find((row) => row.id === 'preset-root-planner-worker');
 check(workerRow !== undefined, 'the patch declares a worker preset');
 check(workerRow?.config?.id === 'root-planner-worker', 'the worker preset id is root-planner-worker');
 check(workerRow?.config?.order === 6, 'the worker preset order is 6');
 const workerPlugins = workerRow?.config?.plugins ?? [];
+const workerRowIds = new Set(workerPlugins.map((row) => row.id));
+
+/** Rows a worker needs: persona, the working tools, and delegation so the tree recurses. */
+const WORKER_REQUIRED_ROWS = [
+  'persona',
+  'agent-instructions',
+  'tool-pwsh',
+  'tool-fs',
+  'tool-fs-search',
+  'tool-skill',
+  'tool-web',
+  'tool-todo',
+  'tool-ask-user',
+  'delegation',
+];
+for (const id of WORKER_REQUIRED_ROWS) {
+  check(workerRowIds.has(id), `the worker preset mounts ${id}`);
+}
+
+/**
+ * Rows a worker must not have. Each one was in the root preset and not here: workflow
+ * orchestration, deliverables, job control, plan mode, plugin management. Anything that
+ * lets a worker outlive its task or re-plan the tree belongs to the root.
+ */
+const WORKER_FORBIDDEN_ROWS = ['tool-workflow', 'workflow-ptc', 'present', 'tool-jobs', 'tool-plugin-manager', 'planning'];
+for (const id of WORKER_FORBIDDEN_ROWS) {
+  check(!workerRowIds.has(id), `the worker preset does not mount ${id}`);
+}
 check(
-  workerPlugins.some((row) => row.id === 'worker-mask' && row.name === 'dsh-root-planner-preset/worker-mask'),
-  'the worker preset mounts worker-mask (the tool restriction)',
+  !workerPlugins.some((row) => /worker-mask/.test(String(row?.id)) || /worker-mask/.test(String(row?.name))),
+  'no mask row is mounted (a restriction cannot narrow a preset\'s own tools)',
 );
+
 const workerDelegation = workerPlugins.find((row) => row.id === 'delegation');
 const workerDelegationRows = workerDelegation?.config ?? [];
 
@@ -227,83 +263,12 @@ for (const [label, rows] of [
   );
 }
 
-/**
- * The global tool inventory of the author's profile, captured from a runtime
- * error rather than hand-kept: `tools.restrict()` prints every known global tool
- * when it refuses a name. Replace this list with the equivalent line from your
- * own environment — it is what makes the check below meaningful.
- *
- * Provenance: transcribed on DSH 0.2.1-rc.2. The upgrade from 0.2.0-rc.2 added
- * `working_directory`, the four `schedule_*` tools, `cordis_inspect_list`,
- * `cordis_inspect_query` and `plugin_manager`; all are registered by profile-level tool
- * packages, so they are global. None of them is in the child mask, which is the intended
- * behaviour of an allow list — a new tool is invisible to children until it is named.
- *
- * Regenerate after a DSH upgrade: break the mask on purpose (add a bogus name), let the
- * agent-creation error print the list, and transcribe it — `tools/extract-tool-inventory.mjs`
- * reads exactly that line out of a session log.
- */
-const OBSERVED_GLOBAL_TOOLS = new Set([
-  'ask_user_question',
-  'cordis_inspect_list',
-  'cordis_inspect_query',
-  'create_goal',
-  'edit',
-  'exit_plan_mode',
-  'get_goal',
-  'glob',
-  'grep',
-  'interrupt_agent',
-  'job_kill',
-  'job_list',
-  'job_output',
-  'list_agents',
-  'ops_glob',
-  'ops_grep',
-  'ops_inspect_local_file',
-  'ops_replace',
-  'plugin_manager',
-  'present',
-  'pwsh',
-  'read',
-  'read_image',
-  'schedule_create',
-  'schedule_delete',
-  'schedule_list',
-  'schedule_update',
-  'send_message',
-  'skill',
-  'subagent_fork',
-  'todo_write',
-  'update_goal',
-  'web_fetch',
-  'web_search',
-  'workflow',
-  'working_directory',
-  'write',
-]);
-
-/**
- * Tools that are agent-scoped rather than global, so `tools.restrict()` can never name
- * them. `subagent` is the one this bundle ran into: with `modelSelectionSettings: true`
- * it is mounted inside each composed Agent's own scope, and a restriction accepts global
- * names only. The curated set is the source of truth now — the old per-call mask is gone.
- */
-{
-  const unknown = CHILD_TOOLS.filter((name) => !OBSERVED_GLOBAL_TOOLS.has(name));
-  const scoped = new Set(SCOPE_LOCAL_TOOLS);
-  const unexpected = unknown.filter((name) => !scoped.has(name));
-  check(
-    unexpected.length === 0,
-    `the curated set names only tools the runtime reports as global` +
-      (unexpected.length ? ` (not global: ${unexpected.join(', ')})` : ''),
-  );
-  // `subagent` reaches a worker through the preset's own delegation row rather than the
-  // restriction, so it may legitimately sit in the curated set while being scope-local.
-  for (const name of unknown) {
-    check(scoped.has(name), `the only scope-local name in the curated set is declared as such (${name})`);
-  }
-}
+// The curated child toolset is not checkable against a static global inventory, and this
+// file must not pretend otherwise. In DSH 0.2.1 a preset row registers its tool in the
+// agent scope, and `tools.restrict()` filters GLOBAL tools only, so the names in
+// `child-tools.mjs` are not global names. What proves the toolset is the row list —
+// asserted above — plus one live run: spawn from a Root Planner session and read the
+// child's `request/header` with `node tools/extract-offered-tools.mjs <session-dir>`.
 
 process.stdout.write(failures.length === 0 ? '\nALL CHECKS PASSED\n' : `\n${failures.length} CHECK(S) FAILED\n`);
 process.exit(failures.length === 0 ? 0 : 1);

package/worker-mask.js

@@ -1,30 +0,0 @@
-// Restricts a Root Planner worker to the curated child toolset.
-//
-// DSH 0.2.1 removed `toolFilter` from `dsh-tool-subagent` — its error says to "configure
-// persona and tool plugins in an Agent Preset and select it with agentPreset (spawn
-// only)". A preset decides which tool plugins are mounted for that agent, but not which
-// globally mounted tools it may call: several newer tools (tool-cordis, plugin-manager,
-// working-directory, schedule) are registered at the app level and would reach every
-// agent regardless of the preset's rows. `tools.restrict()` is the mechanism that still
-// subtracts them, and this module is that call, mounted as a row inside the worker
-// preset so it applies to the worker's own agent scope.
-//
-// The allow list lives in `child-tools.mjs` — the same file the previous mask used, so
-// the curated set is still declared once.
-
-import { CHILD_TOOLS } from './child-tools.mjs'
-
-export const name = 'root-planner-worker-mask'
-
-export const inject = ['tools']
-
-export function apply(ctx) {
-  // `tools.restrict()` requires a scoped context: it refuses to run from a global one
-  // because that would mask every agent in the process. A preset row is mounted into the
-  // agent's own scope, which is exactly the scope this needs.
-  ctx.effect(() => {
-    const tools = typeof ctx.get === 'function' ? ctx.get('tools') : ctx.tools
-    if (tools === undefined) return () => {}
-    return tools.restrict({ allow: CHILD_TOOLS })
-  })
-}