dsh-rtk-slim 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Cooper Zhuang
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,197 @@
-# Temporary Holding Version
+# dsh-rtk-slim
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+DSH（DeepSeek Harness）宿主插件：把 `bash` / `job_output` 的超大输出交给
+[rtk](https://github.com/rtk-ai/rtk)（Rust Token Killer）精简后再交给模型，并且**每一次精简都可追溯、
+每一次失败都保留原文**。
+
+## 功能
+
+- 挂在官方 `tools/post-execute` waterfall 上，**登记为最内层**（不加 `prepend`），因此看到的是原始结果；
+  `dsh-spill-policy` 在外层，仍可对精简后的文本再落盘。
+- 只改模型看到的 `content`，**从不动命令、不动 `value`、绝不把成功调用变成 `isError`**。
+- 家族嗅探决定 rtk 参数：识别得出才用 `-f <filter>`（cargo-test / pytest / git-log / grep / find），
+  识别不出走裸 `rtk pipe`（rtk 对认不出的内容逐字节透传）。这避免了「`-f` 选错把内容删掉」的失败模式。
+- 替换前过四道闸门：标记逐字保全、失败证据保全、压缩比合理、**必须严格变小**；任一不过就保留原文。
+- 每次替换都把**全文**经官方 `ctx.spillStore` 落盘，并在文本末尾附一行
+  `(rtk condensed A → B bytes. Full formatted result stored at: <path>. …)`，
+  模型随时可以按路径取回原文。
+- 同一进程内同类失败只告警一次（不刷屏）；宿主日志里能分清「没挂上」「挂了但被停用」「挂了但 rtk 不可用」。
+
+## 依赖：外部 `rtk` 二进制
+
+**本插件不捆绑 rtk。** 精简能力来自外部命令行程序 rtk：
+
+- 上游仓库：<https://github.com/rtk-ai/rtk>（按上游说明自行安装）；
+- 安装完成后确认 `rtk` 在宿主进程的 `PATH` 里：
+
+  ```sh
+  rtk --version          # 能打印版本即可
+  ```
+
+- 不在 `PATH` 或想用别的路径时，用配置项 `command`（默认 `'rtk'`）指定绝对路径。
+
+平台要求：只要 DSH 宿主与 `rtk` 能在同一平台运行即可（macOS / Linux / Windows 均可）；
+插件按平台处理子进程的超时与取消（POSIX 杀进程组，Windows 用 `taskkill /T`）。
+
+### rtk 缺失 / 不可用时的行为
+
+**不生效，但绝不影响原有结果**：
+
+- 启动 `rtk` 失败（未安装、不在 `PATH`、权限不足）→ 插件放弃压缩，模型看到的内容与**完全没装本插件时一致**，
+  宿主日志留一条 `rtk-slim: rtk:spawn: rtk did not condense bash output` 告警（每个进程只告警一次）。
+- rtk 崩溃（非 0 退出）、超时（默认 10 s）、输出超限或调用被取消 → 同样保留原文，日志记录对应原因。
+- 全文落盘失败且 `requireSpill` 为 `true`（默认）→ 放弃替换、保留原文（「有损必可追溯」）。
+
+这些降级路径都有自动化测试覆盖；rtk 存在但内容本身压缩不了时，插件同样原样放行。
+
+## 安装
+
+```sh
+dsh plugin --profile <profile> add dsh-rtk-slim
+```
+
+把 `<profile>` 换成目标 profile（例如桌面版 `desktop`、`dsh web` 用 `web`）。
+安装后**重启一次宿主**最稳妥（bundle 是否支持热挂载取决于宿主版本）；重启后按下一节确认已激活。
+
+从源码安装：
+
+```sh
+git clone https://github.com/CooperZhuang/dsh-plugins-cooper-custom.git
+dsh plugin --profile <profile> add ./dsh-plugins-cooper-custom/packages/dsh-rtk-slim
+```
+
+### 卸载
+
+```sh
+dsh plugin --profile <profile> remove dsh-rtk-slim
+```
+
+删除后重启宿主一次。
+
+## 如何确认已激活
+
+插件在挂载时写一行启动记录（宿主本身不把插件激活写进磁盘，这是最直接的证据）：
+
+```sh
+tail -n 3 "${DSH_HOME:-$HOME/.dsh}/logs/dsh-rtk-slim.log"
+# 2026-10-16T04:35:12.345Z mounted pid=14813 enabled=true command=rtk tools=bash,job_output minBytes=2048 timeoutMs=10000 spill=true requireSpill=true notice=true ultraCompact=false filters={}
+```
+
+- 有 `mounted` 行 → 宿主确实加载了（`enabled=false` 也会留痕，便于区分「没挂上」与「挂了但被停用」）。
+- 想快速停用而不卸载：在 profile 的 `cordis.patch.yml` 里给 `rtk-slim` 行加 `config: { enabled: false }`
+  （同样需要重启宿主）。
+
+## 配置（全部有默认值）
+
+配置写在 profile 的补丁层里（`dsh plugin add` 会接入本包自带的 `cordis.patch.yml`）：
+
+```yaml
+- insert:
+    - id: rtk-slim
+      name: dsh-rtk-slim
+      config:
+        enabled: true
+```
+
+| 字段 | 默认 | 说明 |
+|---|---|---|
+| `enabled` | `true` | `false` 时完全不注册监听器 |
+| `command` | `'rtk'` | rtk 可执行文件（裸名走 PATH） |
+| `tools` | `['bash','job_output']` | 需要过滤的工具名 |
+| `minBytes` | `2048` | 低于此字节数放行（避免为小输出付一次 spawn） |
+| `maxInputBytes` | `4194304` | 高于此字节数不调 rtk |
+| `timeoutMs` | `10000` | rtk 超时（超时按进程组击杀整个进程树） |
+| `maxOutputBytes` | `8388608` | 捕获 stdout 上限 |
+| `filters` | `{}` | 按家族 id 覆盖 filter 名，或传 `false` 停用某家族 |
+| `spill` | `true` | 是否落盘全文 |
+| `requireSpill` | `true` | 落盘失败时是否放弃替换（「有损必可追溯」） |
+| `notice` | `true` | 是否追加 notice 行 |
+| `ultraCompact` | `false` | 透传 `--ultra-compact` 给 rtk |
+
+把 `requireSpill` 设为 `false` 即可放宽成「压缩但不落盘」。
+
+## 兼容性
+
+- **DSH**：`engines.dsh: ^0.2.1-rc.2 || ^0.2.2-alpha.2`。
+- **Node.js**：`>=24`。
+- **rtk**：不依赖特定版本；`rtk --version` 能跑即可（下表数字在 rtk 1.1.0 上测得）。
+
+本插件碰到的内核面只有三处：
+
+- `tools/post-execute` waterfall（`dsh-tools`）：`exec` / `result` / `next()` 签名、
+  `PostToolDecision` 的两种 `accept` 形态（`content` 与 `value`）以及 `additionalContexts` 透传；
+  `next()` 的兜底仍是 `{kind:'accept'}`（不带 `content`），所以本插件拿到的仍是**原始**文本。
+- `ctx.get('spillStore')`（`dsh-spill`）：`saveText({owner, source, suggestedName, content})` →
+  `{locator, bytes, retrievalHint}`。归属取 `exec.agent.session.header.id`。
+- 插件契约：`export const name / inject / Config / apply`（cordis 的 object plugin）、
+  `dsh.bundle.patch` 清单字段、`cordis.patch.yml` 的 `insert` 行格式。
+
+`lib/` 对 `@deepseek-ai/dsh-*` 的**运行时导入为 0**（只用 JSDoc `import type`）。所以 DSH 将来改 API，
+最坏后果是「不压缩」，而不是加载即失败。
+
+## 评测（真实 rtk，`test/fixtures/` 语料）
+
+`minBytes: 512`，rtk 1.1.0，数字为字节数；输入含末尾的 `[exit code: 0]` 状态标记：
+
+| 输入 | 压缩前 | 压缩后正文 | filter |
+|---|---|---|---|
+| `git log --oneline`（74 提交） | 4120 B | **247 B** | `-f git-log` |
+| pytest（30 用例） | 2327 B | **26 B** | `-f pytest` |
+| cargo test 通过（40 用例） | 880 B | 38 B | `-f cargo-test` |
+| cargo test 失败（40 用例） | 888 B | **98 B** | `-f cargo-test`（失败行保留） |
+| `grep -rn`（70 命中 / 4 文件） | 7718 B | **3138 B** | `-f grep`（rtk 按文件分组） |
+| `ls -la` | 2253 B | 逐字节不变 | 落 `auto` 透传 |
+| 源码 / JSON | — | 逐字节不变 | 落 `auto` 透传 |
+
+数字只作量级参考：随 rtk 版本与输入变化，插件不依赖具体数值；默认 `minBytes: 2048` 时
+低于门槛的输入（如上面 880 B 的 cargo 通过）不会调用 rtk。
+
+## 排错
+
+- **先看启动记录**：`${DSH_HOME:-$HOME/.dsh}/logs/dsh-rtk-slim.log` 的 `mounted` 行（见「如何确认已激活」）。
+- **宿主日志**：DSH Desktop 把宿主日志写在应用数据目录的 `logs/host/dsh-<date>.log`
+  （macOS 为 `~/Library/Application Support/DSH Desktop/logs/host/`）。纯文本行（`[I]/[W]/[E]`）
+  记配置重载、包解析失败等；`rtk-slim:*` 的告警也在这里。
+- **只想验证「下次启动会不会挂上」而不重启**：Desktop profile 被应用独占，`--dump-config` 会被拒绝时，
+  可以复制一份 profile 用同一套组合逻辑验证：
+
+  ```sh
+  cp -Rc ~/.dsh/profiles/desktop ~/.dsh/profiles/rtkcheck   # APFS clone，秒级
+  node .../dsh/lib/bin.js --profile rtkcheck --dump-config | grep -A3 rtk-slim
+  rm -rf ~/.dsh/profiles/rtkcheck                            # 验完删掉
+  ```
+
+- **想在一个一次性的隔离宿主里验证挂载**（不碰自己的会话/记忆/凭据）：
+
+  ```sh
+  export DSH_HOME=/tmp/rtk-verify
+  node .../dsh/lib/bin.js --profile rtkcheck --from-default-profile headless --dump-config
+  ```
+
+  headless 模板自带的 base bundle 已含 `bash` / `job_output` / `spill-local` / `spill-policy`，插件全路径可用；
+  没有凭据时 LLM 调用会失败，但**插件挂载已经发生**——启动日志就是证据。
+
+## 开发
+
+```sh
+npm install --ignore-scripts
+npm test                               # node --test test/*.test.mjs
+npm run typecheck                      # tsc --checkJs（仅 lib/）
+npm run check                          # 两者都跑
+node test/fixtures/make-fixtures.mjs   # 重新生成语料（确定性）
+```
+
+- 端到端用例会调用**真实 rtk**：`rtk` 不在 `PATH` 时自动跳过；装在非标准路径时用
+  `RTK_BIN=/path/to/rtk npm test` 指定。其余用例用 `test/bin/rtk-stub.mjs`，不依赖外部程序。
+- 类型检查只覆盖 `lib/**`：那是「用运行时同版本类型校验插件契约」的落点；测试文件是动态桩。
+- 语料必须**忠实于真实输出**：例如 rtk 的 `grep` filter 按文件分组，语料若写成「每个文件 1 行命中」
+  就不会被压缩（曾因此误判为代码 bug）。
+
+## 设计文档
+
+- 设计（v3）：[docs/superpowers/specs/2026-10-16-dsh-rtk-slim-design.md](https://github.com/CooperZhuang/dsh-plugins-cooper-custom/blob/main/packages/dsh-rtk-slim/docs/superpowers/specs/2026-10-16-dsh-rtk-slim-design.md)
+- 实施计划：[docs/superpowers/plans/2026-10-16-dsh-rtk-slim-implementation.md](https://github.com/CooperZhuang/dsh-plugins-cooper-custom/blob/main/packages/dsh-rtk-slim/docs/superpowers/plans/2026-10-16-dsh-rtk-slim-implementation.md)
+
+## License
+
+MIT

package/cordis.patch.yml

@@ -0,0 +1,17 @@
+# The dsh-rtk-slim bundle patch: one row inserting the rtk output condenser over
+# the profile root. Address it by id (`rtk-slim`) from the profile's own patch
+# layer; the last write wins.
+#
+# Every behavioural knob lives on this row as a live config field (see the
+# plugin's Config schema). This row carries deployment facts only.
+- insert:
+    - id: rtk-slim
+      name: dsh-rtk-slim
+      config:
+        # command: rtk            # bare name resolves through PATH
+        # tools: ['bash', 'job_output']
+        # minBytes: 2048
+        # spill: true
+        # requireSpill: true
+        # notice: true
+        enabled: true

package/docs/DETAIL.md

@@ -0,0 +1,11 @@
+# Tool output slimming
+
+Condenses oversized tool output: the model sees a short notice with byte counts; the full text goes to the spill store and can be fetched later.
+
+## How it works
+  - Hooks the tools/post-execute waterfall shared by native and PTC execution.
+  - Content-aware condensation with line/byte thresholds and an rtk condensed notice.
+
+## Caveat
+  - Native mode: condensation changes what the model sees.
+  - PTC mode: only the session-log dispatch content is condensed; the program value and model context are unchanged.

package/docs/DETAIL.zh.md

@@ -0,0 +1,12 @@
+# 工具输出瘦身
+
+对过长的工具输出做压缩：模型先看到摘要与字节数，完整原文写进 spill 存储，需要时按路径取回。
+
+## 工作方式
+  - 挂在 tools/post-execute waterfall 上，native 与 PTC 执行路径共用这条流水线。
+  - 按内容类型挑选压缩器（行数/字节阈值、format 提示），输出 rtk condensed 通知。
+  - 原文写入 spill（目录由 profile 的 spill-local 行固定），可随时取回。
+
+## 口径
+  - native 模式：压缩直接影响模型可见输出。
+  - PTC 模式：压缩只作用于会话日志里的 dispatch content，模型拿到的是程序返回值，上下文大小不变。

package/icon.svg

@@ -0,0 +1 @@
+<svg width="36" height="36" viewBox="0 0 36 36" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M7 8h22l-8.5 10.5V27l-5 2v-10.5L7 8z" fill="#14B8A6"/></svg>

package/lib/content.js

@@ -0,0 +1,35 @@
+/**
+ * Boundary between the harness content-block payload and plain text.
+ *
+ * `tools/post-execute` hands over `result.content` as a `ContentBlock[]`, not a
+ * string. The plugin is only interested in the common single-text-block case
+ * (what `bash` and `job_output` render); anything else is left untouched so we
+ * never fight a tool's own definition-owned content finalizer.
+ *
+ * @module dsh-rtk-slim/content
+ */
+
+/**
+ * @typedef {import('@deepseek-ai/dsh-llm').ContentBlock} ContentBlock
+ */
+
+/**
+ * Text of a payload that is exactly one text block.
+ * @param {readonly ContentBlock[] | undefined} content
+ * @returns {string | undefined} `undefined` means "out of scope, bail".
+ */
+export function singleText(content) {
+  if (!Array.isArray(content) || content.length !== 1) return undefined
+  const block = content[0]
+  if (block === null || typeof block !== 'object' || block.type !== 'text') return undefined
+  return block.text
+}
+
+/**
+ * Re-wrap condensed text as the single text block the registry expects.
+ * @param {string} text
+ * @returns {ContentBlock[]}
+ */
+export function textBlock(text) {
+  return [{ type: 'text', text }]
+}

package/lib/guards.js

@@ -0,0 +1,64 @@
+/**
+ * Invariants a condensation must satisfy before it may replace model-visible
+ * text. Any failure means "keep the original" — never an error result.
+ *
+ * I1 (marker preservation) is structural: callers split the trailing status
+ * block off before calling rtk and re-attach it verbatim afterwards, so it
+ * cannot be lost here.
+ *
+ * @module dsh-rtk-slim/guards
+ */
+
+/**
+ * Failure-signal lines. Deliberately narrow: a bare `failed` word would make
+ * the invariant vacuously false on a passing run ("0 failed"), killing the
+ * main win.
+ */
+export const FAILURE_PATTERNS = [
+  /^test result: FAILED/,
+  /^FAILED\b/,
+  /^--- FAIL:/,
+  /^error(\[E\d+\])?:/,
+  /^Traceback \(most recent call last\):/,
+  /panicked at/,
+  /^AssertionError\b/,
+  /^FAIL\b/,
+]
+
+/**
+ * Distinct failure-signal lines in `text` (trimmed).
+ * @param {string} text
+ * @returns {string[]}
+ */
+export function collectFailureLines(text) {
+  const found = new Set()
+  for (const line of text.split('\n')) {
+    const trimmed = line.trim()
+    if (trimmed.length === 0) continue
+    if (FAILURE_PATTERNS.some((pattern) => pattern.test(trimmed))) found.add(trimmed)
+  }
+  return [...found]
+}
+
+/** @typedef {{ ok: true } | { ok: false, reason: 'empty' | 'unchanged' | 'expanded' | 'failures' | 'ratio' }} GuardResult */
+
+/**
+ * @param {{ raw: string, condensed: string }} input both already-extracted text
+ * @returns {GuardResult}
+ */
+export function checkInvariants({ raw, condensed }) {
+  if (condensed.length === 0) return { ok: false, reason: 'empty' }
+  const rawBytes = Buffer.byteLength(raw, 'utf8')
+  const condensedBytes = Buffer.byteLength(condensed, 'utf8')
+  if (condensed.trim() === raw.trim()) return { ok: false, reason: 'unchanged' }
+  if (condensedBytes >= rawBytes) return { ok: false, reason: 'expanded' }
+  if (collectFailureLines(raw).some((line) => !condensed.includes(line))) {
+    return { ok: false, reason: 'failures' }
+  }
+  if (condensedBytes < rawBytes * 0.02 && rawBytes >= 32 * 1024) {
+    const hasOmissionMarker = /\[\+\d+ lines? omitted\]/.test(condensed)
+    const hasSpillNotice = condensed.includes('Full formatted result stored at:')
+    if (!hasOmissionMarker && !hasSpillNotice) return { ok: false, reason: 'ratio' }
+  }
+  return { ok: true }
+}

package/lib/index.js

@@ -0,0 +1,202 @@
+/**
+ * dsh-rtk-slim: condense oversized `bash` / `job_output` text through `rtk`
+ * before the model sees it, with a recoverable full-text copy and a
+ * no-surprises failure surface.
+ *
+ * Registered WITHOUT `prepend`, i.e. as the innermost listener of the
+ * `tools/post-execute` waterfall: every outer listener (notably
+ * `dsh-spill-policy`, which prepends) has already run `next()` by the time we
+ * see the result, so we condense the original text and spill-policy then gets
+ * to post-process our (smaller) output.
+ *
+ * @module dsh-rtk-slim
+ */
+
+import z from '@deepseek-ai/schemastery'
+import { singleText, textBlock } from './content.js'
+import { checkInvariants } from './guards.js'
+import { logStartup } from './log.js'
+import { joinTailMarkers, splitTailMarkers } from './markers.js'
+import { runRtk } from './rtk.js'
+import { chooseFilter } from './sniff.js'
+import { formatCondenseNotice, saveFullText } from './spill.js'
+
+export const name = 'rtk-slim'
+
+/** The tools registry owns the waterfall we hook. */
+export const inject = ['tools']
+
+export const Config = z.object({
+  enabled: z.boolean().default(true),
+  command: z.string().default('rtk'),
+  tools: z.array(z.string()).default(['bash', 'job_output']),
+  minBytes: z.number().default(2048),
+  maxInputBytes: z.number().default(4194304),
+  timeoutMs: z.number().default(10000),
+  maxOutputBytes: z.number().default(8388608),
+  filters: z.dict(z.union([z.string(), z.const(false)])).default({}),
+  spill: z.boolean().default(true),
+  requireSpill: z.boolean().default(true),
+  notice: z.boolean().default(true),
+  ultraCompact: z.boolean().default(false),
+})
+
+/**
+ * @typedef {object} SlimConfig
+ * @property {boolean} enabled
+ * @property {string} command
+ * @property {string[]} tools
+ * @property {number} minBytes
+ * @property {number} maxInputBytes
+ * @property {number} timeoutMs
+ * @property {number} maxOutputBytes
+ * @property {Record<string, string | false>} filters
+ * @property {boolean} spill
+ * @property {boolean} requireSpill
+ * @property {boolean} notice
+ * @property {boolean} ultraCompact
+ */
+
+/**
+ * Defensive defaults so the handler is usable with a raw config object in
+ * tests, and with a schema-validated one from the loader.
+ * @param {Partial<SlimConfig> | undefined} raw
+ * @returns {SlimConfig}
+ */
+function normalizeConfig(raw) {
+  const defaults = {
+    enabled: true,
+    command: 'rtk',
+    tools: ['bash', 'job_output'],
+    minBytes: 2048,
+    maxInputBytes: 4194304,
+    timeoutMs: 10000,
+    maxOutputBytes: 8388608,
+    filters: {},
+    spill: true,
+    requireSpill: true,
+    notice: true,
+    ultraCompact: false,
+  }
+  const merged = { ...defaults, ...(raw ?? {}) }
+  if (!Array.isArray(merged.tools)) merged.tools = defaults.tools
+  if (merged.filters === null || typeof merged.filters !== 'object') merged.filters = {}
+  return merged
+}
+
+/**
+ * Build the `tools/post-execute` listener. Exported for tests that drive it
+ * without a cordis context.
+ * @param {{ logger?: { warn: (message: string) => void }, get: (name: string) => any }} ctx
+ * @param {Partial<SlimConfig> | undefined} rawConfig
+ * @param {{ runRtk?: typeof runRtk, saveFullText?: typeof saveFullText }} [deps]
+ * @returns {(exec: any, result: any, next: () => Promise<any>) => Promise<any>}
+ */
+export function createPostExecuteHandler(ctx, rawConfig, deps = {}) {
+  const config = normalizeConfig(rawConfig)
+  const run = deps.runRtk ?? runRtk
+  const spill = deps.saveFullText ?? saveFullText
+  const warned = new Set()
+
+  /**
+   * One line per distinct reason, ever.
+   * @param {string} key
+   * @param {string} detail
+   */
+  function warn(key, detail) {
+    if (warned.has(key)) return
+    warned.add(key)
+    ctx.logger?.warn(`rtk-slim: ${key}: ${detail}`)
+  }
+
+  return async function postExecute(exec, result, next) {
+    // Let downstream (more inner) listeners settle first; a throw here belongs
+    // to the registry, not to us.
+    const decision = await next()
+    try {
+      if (decision === null || typeof decision !== 'object' || decision.kind !== 'accept') return decision
+      if (Object.hasOwn(decision, 'value')) return decision
+      if (result?.isError === true) return decision
+      if (!config.tools.includes(exec?.name)) return decision
+
+      const raw = singleText(decision.content ?? result?.content)
+      if (raw === undefined) return decision
+
+      const rawBytes = Buffer.byteLength(raw, 'utf8')
+      if (rawBytes < config.minBytes || rawBytes > config.maxInputBytes) return decision
+
+      const { body, tail } = splitTailMarkers(raw)
+      if (body.length === 0) return decision
+
+      const { filter } = chooseFilter(body, config.filters)
+      const args = filter === undefined ? ['pipe'] : ['pipe', '-f', filter]
+      if (config.ultraCompact) args.push('--ultra-compact')
+
+      const produced = await run({
+        command: config.command,
+        args,
+        input: body,
+        timeoutMs: config.timeoutMs,
+        signal: exec?.signal,
+        maxOutputBytes: config.maxOutputBytes,
+      })
+      if (!produced.ok) {
+        warn(`rtk:${produced.reason}`, `rtk did not condense ${exec?.name} output`)
+        return decision
+      }
+
+      const condensedBody = produced.text.replace(/\n+$/, '')
+      const guard = checkInvariants({ raw: body, condensed: condensedBody })
+      if (!guard.ok) {
+        if (guard.reason !== 'unchanged') warn(`guard:${guard.reason}`, `condensation rejected for ${exec?.name}`)
+        return decision
+      }
+
+      /** @type {import('./spill.js').Ref | undefined} */
+      let ref
+      if (config.spill) {
+        ref = await spill(ctx, exec, raw)
+        if (ref === undefined && config.requireSpill) {
+          warn('spill:failed', `no recoverable copy for ${exec?.name}; keeping the original`)
+          return decision
+        }
+      }
+
+      const notice =
+        config.notice && ref !== undefined
+          ? formatCondenseNotice({
+              beforeBytes: rawBytes,
+              afterBytes: Buffer.byteLength(condensedBody, 'utf8'),
+              ref,
+            })
+          : undefined
+
+      const assembled = [condensedBody, notice, tail].filter((part) => part !== undefined && part !== '').join('\n')
+      return {
+        kind: 'accept',
+        content: textBlock(assembled),
+        ...(decision.additionalContexts === undefined ? {} : { additionalContexts: decision.additionalContexts }),
+      }
+    } catch (error) {
+      warn('unexpected', String(error instanceof Error ? error.message : error))
+      return decision
+    }
+  }
+}
+
+/**
+ * @param {{ on: (event: string, listener: any) => any, logger?: { warn: (message: string) => void }, get: (name: string) => any }} ctx
+ * @param {Partial<SlimConfig> | undefined} config
+ */
+export function apply(ctx, config) {
+  const resolved = normalizeConfig(config)
+  // Nothing else in the harness records activation to disk, so this one line is
+  // what makes "did it mount, and with which config?" answerable after a restart.
+  logStartup(
+    `mounted pid=${process.pid} enabled=${resolved.enabled} command=${resolved.command} tools=${resolved.tools.join(',')} ` +
+      `minBytes=${resolved.minBytes} timeoutMs=${resolved.timeoutMs} spill=${resolved.spill} requireSpill=${resolved.requireSpill} ` +
+      `notice=${resolved.notice} ultraCompact=${resolved.ultraCompact} filters=${JSON.stringify(resolved.filters)}`,
+  )
+  if (resolved.enabled === false) return
+  ctx.on('tools/post-execute', createPostExecuteHandler(ctx, resolved))
+}

package/lib/log.js

@@ -0,0 +1,39 @@
+/**
+ * Startup evidence. The harness never logs plugin activation to disk (dsh web
+ * and the Desktop shell keep stdout in memory), so "did it actually mount, and
+ * with which config?" is otherwise unanswerable after a restart. One appended
+ * line per activation settles it.
+ *
+ * Never throws: a logging failure must not stop the plugin from loading.
+ *
+ * @module dsh-rtk-slim/log
+ */
+
+import { appendFileSync, mkdirSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { dirname, join } from 'node:path'
+
+/**
+ * `$DSH_HOME/logs/dsh-rtk-slim.log`, falling back to `~/.dsh/logs/...`.
+ * @returns {string}
+ */
+export function defaultLogPath() {
+  const home = typeof process.env.DSH_HOME === 'string' && process.env.DSH_HOME.length > 0 ? process.env.DSH_HOME : join(homedir(), '.dsh')
+  return join(home, 'logs', 'dsh-rtk-slim.log')
+}
+
+/**
+ * Append one timestamped line.
+ * @param {string} line
+ * @param {string} [path]
+ * @returns {boolean} whether the line was written
+ */
+export function logStartup(line, path = defaultLogPath()) {
+  try {
+    mkdirSync(dirname(path), { recursive: true })
+    appendFileSync(path, `${new Date().toISOString()} ${line}\n`)
+    return true
+  } catch {
+    return false
+  }
+}

package/lib/markers.js

@@ -0,0 +1,41 @@
+/**
+ * Trailing status markers, exactly as the harness bash tool renders them
+ * (`dsh-tool-bash`'s `renderResult` / `renderPromoted`). They are the model's
+ * contract for exit status, so they must survive condensation byte-for-byte.
+ *
+ * @module dsh-rtk-slim/markers
+ */
+
+/** One trailing status marker line. `[status: …]` is `job_output`'s own line. */
+const MARKER = /^\[(?:exit code: -?\d+|timed out after \d+ms|stopped: [^\]]*|status: [^\]]*|killed by signal: [^\]]*|sandbox: [^\]]*|still running after \d+ms; moved to background job [^\]]+)\]$/
+
+/** Opening words of the guidance paragraph that follows a background promotion. */
+const BACKGROUND_GUIDANCE = 'The command keeps running in the background.'
+
+/**
+ * Split the trailing status block off a rendered tool result.
+ * @param {string} text
+ * @returns {{ body: string, tail: string }} `tail` is `''` when nothing matched.
+ */
+export function splitTailMarkers(text) {
+  if (text.length === 0) return { body: '', tail: '' }
+  const lines = text.split('\n')
+  let cut = lines.length
+  // The promoted-to-background shape is "<marker>\n<guidance>"; consume the
+  // guidance only when a real marker sits directly above it.
+  if (cut > 1 && lines[cut - 1].startsWith(BACKGROUND_GUIDANCE) && MARKER.test(lines[cut - 2])) cut -= 1
+  while (cut > 0 && MARKER.test(lines[cut - 1])) cut -= 1
+  if (cut === lines.length) return { body: text, tail: '' }
+  return { body: lines.slice(0, cut).join('\n'), tail: lines.slice(cut).join('\n') }
+}
+
+/**
+ * Re-attach a split `tail`. `joinTailMarkers(...split(x)) === x` for every `x`.
+ * @param {string} body
+ * @param {string} tail
+ * @returns {string}
+ */
+export function joinTailMarkers(body, tail) {
+  if (tail === '') return body
+  return body === '' ? tail : `${body}\n${tail}`
+}

package/lib/rtk.js

@@ -0,0 +1,115 @@
+/**
+ * rtk invocation. Owns every way the child can misbehave: missing binary,
+ * non-zero exit, timeout, caller cancellation, runaway output. Every failure is
+ * a value, never a throw — the caller keeps the original text.
+ *
+ * @module dsh-rtk-slim/rtk
+ */
+
+import { spawn } from 'node:child_process'
+
+/** @typedef {{ ok: true, text: string } | { ok: false, reason: 'spawn' | 'exit' | 'timeout' | 'aborted' | 'too-large' }} RunResult */
+
+/**
+ * @param {object} input
+ * @param {string} input.command
+ * @param {string[]} input.args
+ * @param {string} input.input stdin payload
+ * @param {number} input.timeoutMs
+ * @param {AbortSignal} [input.signal]
+ * @param {number} input.maxOutputBytes
+ * @returns {Promise<RunResult>}
+ */
+export function runRtk({ command, args, input, timeoutMs, signal, maxOutputBytes }) {
+  return new Promise((resolve) => {
+    if (signal !== undefined && signal.aborted) {
+      resolve({ ok: false, reason: 'aborted' })
+      return
+    }
+    /** @type {import('node:child_process').ChildProcess} */
+    let child
+    try {
+      // `detached` gives the child its own process group so a runaway rtk and
+      // its descendants can be killed as a unit.
+      child = spawn(command, args, { detached: true, stdio: ['pipe', 'pipe', 'ignore'], signal })
+    } catch {
+      resolve({ ok: false, reason: 'spawn' })
+      return
+    }
+
+    let settled = false
+    let bytes = 0
+    /** @type {Buffer[]} */
+    const chunks = []
+
+    const timer = setTimeout(() => finish({ ok: false, reason: 'timeout' }, true), timeoutMs)
+    const onAbort = () => finish({ ok: false, reason: 'aborted' }, true)
+
+    function cleanup() {
+      clearTimeout(timer)
+      if (signal !== undefined) signal.removeEventListener('abort', onAbort)
+    }
+
+    function killGroup() {
+      if (child.pid === undefined) return
+      if (process.platform === 'win32') {
+        // Windows has no process-group signals: `process.kill(-pid)` throws, the
+        // child survives, and its open stdout pipe keeps this process alive after
+        // a timeout/abort (observed as the whole test file hanging). taskkill /T
+        // walks the tree, which is what `detached` was buying on POSIX.
+        try {
+          spawn('taskkill', ['/pid', String(child.pid), '/t', '/f'], { stdio: 'ignore', windowsHide: true })
+            .on('error', () => { /* already gone */ })
+        } catch {
+          // already gone
+        }
+        return
+      }
+      try {
+        process.kill(-child.pid, 'SIGKILL')
+      } catch {
+        // already gone
+      }
+    }
+
+    /**
+     * @param {RunResult} result
+     * @param {boolean} [kill]
+     */
+    function finish(result, kill) {
+      if (settled) return
+      settled = true
+      cleanup()
+      if (kill === true) killGroup()
+      resolve(result)
+    }
+
+    if (signal !== undefined) signal.addEventListener('abort', onAbort, { once: true })
+
+    child.on('error', () => {
+      finish({ ok: false, reason: signal !== undefined && signal.aborted ? 'aborted' : 'spawn' })
+    })
+
+    child.stdout?.on('data', (/** @type {Buffer} */ chunk) => {
+      bytes += chunk.length
+      if (bytes > maxOutputBytes) {
+        finish({ ok: false, reason: 'too-large' }, true)
+        return
+      }
+      chunks.push(chunk)
+    })
+
+    child.on('close', (code) => {
+      if (code !== 0) {
+        finish({ ok: false, reason: 'exit' })
+        return
+      }
+      finish({ ok: true, text: Buffer.concat(chunks).toString('utf8') })
+    })
+
+    child.stdin?.on('error', () => {
+      // EPIPE when the child is already gone; the close/error handler decides.
+    })
+    child.stdin?.end(input)
+  })
+}

package/lib/sniff.js

@@ -0,0 +1,82 @@
+/**
+ * Family detection: decide whether `rtk pipe -f <filter>` is provably
+ * applicable to this text. A wrong `-f` destroys content (measured: 751 B of
+ * unrelated text collapsed to 4 lines), so anything unrecognised falls through
+ * to a bare `rtk pipe`, which passes unrecognised text through byte-for-byte.
+ *
+ * @module dsh-rtk-slim/sniff
+ */
+
+const CARGO_RUNNING = /^running \d+ tests?$/m
+const CARGO_RESULT = /^test result:/m
+const PYTEST_HEADER = /^=+ .*test session starts.* =+$/m
+const PYTEST_OUTCOME = /^\S+::\S+ (?:PASSED|FAILED|ERROR)/m
+const GIT_ONELINE = /^[0-9a-f]{7,40} \S/
+const GIT_COMMIT = /^commit [0-9a-f]{40}$/m
+const GREP_LINE = /^[^\s:]*[/.][^\s:]*:\d+:/
+const BARE_LINE = /^\S+$/
+
+/**
+ * @param {string} text
+ * @param {RegExp} re
+ * @returns {number}
+ */
+function countLines(text, re) {
+  const global = new RegExp(re.source, 'gm')
+  const found = text.match(global)
+  return found === null ? 0 : found.length
+}
+
+/** @typedef {{ id: string, filter: string, test: (text: string) => boolean }} Family */
+
+/** Ordered families; first match wins. */
+export const FAMILIES = /** @type {Family[]} */ ([
+  {
+    id: 'cargo-test',
+    filter: 'cargo-test',
+    test: (text) => CARGO_RUNNING.test(text) && CARGO_RESULT.test(text),
+  },
+  {
+    id: 'pytest',
+    filter: 'pytest',
+    test: (text) => PYTEST_HEADER.test(text) || PYTEST_OUTCOME.test(text),
+  },
+  {
+    id: 'git-log',
+    filter: 'git-log',
+    test: (text) => countLines(text, GIT_ONELINE) >= 5 || GIT_COMMIT.test(text),
+  },
+  {
+    id: 'grep',
+    filter: 'grep',
+    test: (text) => countLines(text, GREP_LINE) >= 5,
+  },
+  {
+    id: 'find',
+    filter: 'find',
+    test: (text) => {
+      const bare = text.split('\n').filter((line) => BARE_LINE.test(line))
+      if (bare.length < 10) return false
+      return bare.every((line) => line.includes('/')) && bare.every((line) => !line.includes(':'))
+    },
+  },
+])
+
+/**
+ * @typedef {Record<string, string | false>} FilterOverrides
+ */
+
+/**
+ * @param {string} text body text (trailing status markers already removed)
+ * @param {FilterOverrides} [overrides] config `filters`
+ * @returns {{ family: string, filter: string | undefined }} `auto` means "bare rtk pipe"
+ */
+export function chooseFilter(text, overrides = {}) {
+  for (const family of FAMILIES) {
+    const override = overrides[family.id]
+    if (override === false) continue
+    if (!family.test(text)) continue
+    return { family: family.id, filter: typeof override === 'string' ? override : family.filter }
+  }
+  return { family: 'auto', filter: undefined }
+}

package/lib/spill.js

@@ -0,0 +1,49 @@
+/**
+ * Lossy-but-traceable condensation: every condensed text is recoverable in
+ * full. The store is the official `ctx.spillStore` service (backed by
+ * `dsh-spill-local`), used exactly the way `dsh-spill-policy` uses it, so the
+ * notice wording and the file layout are the ones the harness already knows.
+ *
+ * @module dsh-rtk-slim/spill
+ */
+
+/** @typedef {{ locator: string, bytes?: number, retrievalHint?: string }} Ref */
+
+const FALLBACK_HINT = 'Use read with offset/limit, or grep this path to search within it.'
+
+/**
+ * Persist the untouched original text.
+ * @param {{ get: (name: string) => any }} ctx
+ * @param {{ name: string, callId?: string, agent?: any }} exec
+ * @param {string} text
+ * @returns {Promise<Ref | undefined>} `undefined` means "no traceability available".
+ */
+export async function saveFullText(ctx, exec, text) {
+  const store = ctx.get('spillStore')
+  if (store === null || typeof store !== 'object' || typeof store.saveText !== 'function') return undefined
+  const sessionId = exec.agent?.session?.header?.id
+  if (typeof sessionId !== 'string' || sessionId.length === 0) return undefined
+  try {
+    const ref = await store.saveText({
+      owner: { sessionId },
+      source: { kind: 'tool', toolName: exec.name, callId: exec.callId, label: 'result' },
+      suggestedName: `${exec.name}.txt`,
+      content: text,
+    })
+    if (ref === null || typeof ref !== 'object' || typeof ref.locator !== 'string' || ref.locator.length === 0) {
+      return undefined
+    }
+    return ref
+  } catch {
+    return undefined
+  }
+}
+
+/**
+ * @param {{ beforeBytes: number, afterBytes: number, ref: Ref }} input
+ * @returns {string}
+ */
+export function formatCondenseNotice({ beforeBytes, afterBytes, ref }) {
+  const hint = typeof ref.retrievalHint === 'string' && ref.retrievalHint.length > 0 ? ref.retrievalHint : FALLBACK_HINT
+  return `(rtk condensed ${beforeBytes} → ${afterBytes} bytes. Full formatted result stored at: ${ref.locator}. ${hint})`
+}

package/locale/en.json

@@ -0,0 +1,7 @@
+{
+  "meta": {
+    "title": "Tool output slimming",
+    "description": "Condenses oversized tool output, spilling the full text to a file that can be fetched on demand.",
+    "detail": "docs/DETAIL.md"
+  }
+}

package/locale/zh.json

@@ -0,0 +1,7 @@
+{
+  "meta": {
+    "title": "工具输出瘦身",
+    "description": "把超长的工具输出压缩成摘要，原文落进 spill 文件，需要时再取回。",
+    "detail": "docs/DETAIL.zh.md"
+  }
+}

package/package.json

@@ -1,6 +1,74 @@
 {
   "name": "dsh-rtk-slim",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "private": false,
+  "publishConfig": {
+    "access": "public"
+  },
+  "description": "DSH host plugin: condense oversized bash/job_output text through rtk, with lossless spill traceability",
+  "type": "module",
+  "main": "lib/index.js",
+  "exports": {
+    ".": {
+      "default": "./lib/index.js"
+    },
+    "./cordis.patch.yml": "./cordis.patch.yml",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib",
+    "cordis.patch.yml",
+    "README.md",
+    "LICENSE",
+    "icon.svg",
+    "locale/*.json",
+    "docs/DETAIL.md",
+    "docs/DETAIL.zh.md"
+  ],
+  "license": "MIT",
+  "scripts": {
+    "test": "node --test test/*.test.mjs",
+    "typecheck": "tsc -p jsconfig.json",
+    "check": "npm run typecheck && npm test"
+  },
+  "engines": {
+    "node": ">=24",
+    "dsh": "^0.2.1-rc.2 || ^0.2.2-alpha.2"
+  },
+  "keywords": [
+    "dsh",
+    "deepseek-harness",
+    "dsh-plugin",
+    "cordis-plugin",
+    "rtk",
+    "token-reduction",
+    "output-compaction",
+    "bash",
+    "spill"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/CooperZhuang/dsh-plugins-cooper-custom.git",
+    "directory": "packages/dsh-rtk-slim"
+  },
+  "homepage": "https://github.com/CooperZhuang/dsh-plugins-cooper-custom/tree/main/packages/dsh-rtk-slim#readme",
+  "bugs": {
+    "url": "https://github.com/CooperZhuang/dsh-plugins-cooper-custom/issues"
+  },
+  "dependencies": {
+    "@deepseek-ai/schemastery": "^3.18.5"
+  },
+  "devDependencies": {
+    "@deepseek-ai/dsh-llm": "0.2.2-rc.1",
+    "@deepseek-ai/dsh-tools": "0.2.2-rc.1",
+    "@types/node": "^26.6.5",
+    "typescript": "^7.0.2"
+  },
+  "dsh": {
+    "manifestVersion": 1,
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    }
+  },
+  "icon": "./icon.svg"
+}