dsh-subagent-profile 0.1.0 → 0.2.0

package/README.md

@@ -2,10 +2,10 @@
 
 <!-- Hero -->
 <div align="center">
-  <b style="font-size: 1.15em;">子 Agent 派发方案化插件 —— 用对的人（预设 / 模型 / 推理强度）干对的事</b><br /><br />
+  <b style="font-size: 1.15em;">Subagent dispatch, profiled — the right agent for the right task (preset / model / reasoning effort)</b><br /><br />
   <img alt="License: MIT" src="https://img.shields.io/badge/License-MIT-yellow.svg" />
-  <img alt="Version: 0.1.0" src="https://img.shields.io/badge/version-0.1.0-blue.svg" />
-  <img alt="DSH" src="https://img.shields.io/badge/DSH-0.1.0--rc.6%20~%20rc.8-blue.svg" />
+  <img alt="npm" src="https://img.shields.io/npm/v/dsh-subagent-profile.svg" />
+  <img alt="DSH" src="https://img.shields.io/badge/DSH-0.1.0--rc.6%20~%200.1.1--rc.2-blue.svg" />
 </div>
 
 <div align="center">English · <a href="README.zh.md">中文</a></div>
@@ -90,6 +90,37 @@ Delegation never lets a subagent gain more power than you already have — this
 
 - **Background** one-shot dispatch requires `@deepseek-ai/dsh-jobs` and `@deepseek-ai/dsh-tool-jobs` to be loaded; otherwise it fails with "background jobs unavailable".
 - **Continuable** mode goes through the DSH standard composition path, so the `preset` swap and `reasoningEffort` are ignored (the child inherits the parent preset at the default reasoning effort).
+- **Continuable** tool gate is a plugin-side mitigation: the child's `allow` is pre-computed as a closed set — parent tool set − `run_code` − `deny`, then intersected with `allow`. **Assumption:** continuable inherits the parent preset, so the child's tool set ≈ the parent's. **Failure condition:** any host behavior change that makes the child's tool set differ from the parent's (not only preset swap — e.g. a future preset swap, composing a different tool set) means the parent set can contain tools the child does not have, so `tools.restrict` throws "unknown tool" and this mitigation automatically degrades to fail-loud (conservatively safe); it must then be replaced with a true parent ∩ child intersection once the upstream provides a provider guard seam.
+
+## Repository structure
+
+```
+dsh-subagent-profile/
+├── index.mjs                     # host side: the plugin itself (dispatch tool, profile provider, service, HTTP routes)
+├── lib/
+│   ├── client.js                 # browser side: settings page + dispatch tool-call card
+│   ├── pure.mjs                  # dependency-free pure functions (sanitize / prune / guard math — unit-tested)
+│   └── shims.mjs                 # the single @deepseek-ai import facade (guards fail loud, helpers degrade softly)
+├── presets/orchestrator/         # bundled "orchestrator" agent preset (self-installed, synced on every startup)
+├── cordis.patch.yml              # bundle patch: inserts the plugin row into the host composition
+├── package.json                  # metadata, files whitelist, exports
+├── scripts/release.mjs           # release helper (version bump / tag checks)
+├── docs/
+│   └── screenshots/              # README screenshots
+├── test/                         # host-side tests (node:test, zero extra deps; 96 cases)
+│   ├── README.md / README.zh.md  # test directory guide (EN/ZH)
+│   ├── harness/ctx.mjs           # fake Cordis ctx + ~/.dsh isolation
+│   ├── characterization.test.mjs # apply() behavior snapshot
+│   └── *.test.mjs                # pure / input-schema / persist / continuable-guard / cost-guard / gating / recycle / facade
+├── README.md / README.zh.md      # this document (EN/ZH)
+└── LICENSE
+```
+
+## Contributing
+
+Found a bug or have an idea? [Open an issue](https://github.com/muzyLink/dsh-subagent-profile/issues) or submit a pull request — all contributions are welcome.
+
+If this plugin has been useful to you, please give it a ⭐ on GitHub — it helps others find it.
 
 ## Credits
 

package/README.zh.md

@@ -4,8 +4,8 @@
 <div align="center">
   <b style="font-size: 1.15em;">子 Agent 派发方案化插件 —— 用对的人（预设 / 模型 / 推理强度）干对的事</b><br /><br />
   <img alt="License: MIT" src="https://img.shields.io/badge/License-MIT-yellow.svg" />
-  <img alt="Version: 0.1.0" src="https://img.shields.io/badge/version-0.1.0-blue.svg" />
-  <img alt="DSH" src="https://img.shields.io/badge/DSH-0.1.0--rc.6%20~%20rc.8-blue.svg" />
+  <img alt="npm" src="https://img.shields.io/npm/v/dsh-subagent-profile.svg" />
+  <img alt="DSH" src="https://img.shields.io/badge/DSH-0.1.0--rc.6%20~%200.1.1--rc.2-blue.svg" />
 </div>
 
 <div align="center"><a href="README.md">English</a> · 中文</div>
@@ -90,6 +90,37 @@ dispatch(
 
 - **后台**一次性派发需要加载 `@deepseek-ai/dsh-jobs` 与 `@deepseek-ai/dsh-tool-jobs`，否则报「background jobs unavailable」。
 - **可续跑**模式走 DSH 标准组合路径，因此 `preset` 换用与 `reasoningEffort` 会被忽略（继承父预设、使用默认推理强度）。
+- **可续跑**工具门为插件侧缓解：子 Agent 的 `allow` 预加工为闭集 —— 父工具集 − `run_code` − `deny`，再与 `allow` 取交集。**假设：** 可续跑继承父预设 ⇒ 子工具集 ≈ 父工具集。**失效条件：** 任何导致子工具集与父工具集不一致的宿主行为变化（非仅换用预设——例如未来允许换用预设、组合不同工具集等），父集都可能含子集没有的工具，`tools.restrict` 会抛「未知工具」→ 本缓解自动降级为 fail-loud（保守安全）；待上游提供 provider 守卫接缝后替换为真交集。
+
+## 目录结构
+
+```
+dsh-subagent-profile/
+├── index.mjs                     # 宿主侧：插件本体（dispatch 工具、profile provider、服务、HTTP 路由）
+├── lib/
+│   ├── client.js                 # 浏览器侧：设置页 + dispatch 工具调用卡片
+│   ├── pure.mjs                  # 无依赖纯函数（净化 / 剪枝 / 护栏计算——可单测）
+│   └── shims.mjs                 # @deepseek-ai 依赖唯一入口（facade：守卫型 fail-loud、功能映射型软降级）
+├── presets/orchestrator/         # 内置「编排者模式」agent 预设（自安装，每次启动同步）
+├── cordis.patch.yml              # bundle 补丁：把插件行插入宿主组成
+├── package.json                  # 元数据、files 发布白名单、exports
+├── scripts/release.mjs           # 发布脚本（版本 bump / tag 校验）
+├── docs/
+│   └── screenshots/              # README 截图
+├── test/                         # 宿主侧自动化测试（node:test，零新增依赖；96 用例）
+│   ├── README.md / README.zh.md  # 测试目录说明（中英双语）
+│   ├── harness/ctx.mjs           # 假宿主环境（fake ctx + ~/.dsh 隔离）
+│   ├── characterization.test.mjs # apply() 行为快照
+│   └── *.test.mjs                # pure / input-schema / persist / continuable-guard / cost-guard / gating / recycle / facade
+├── README.md / README.zh.md      # 本文档（中英双语）
+└── LICENSE
+```
+
+## 贡献
+
+发现 Bug 或有新想法?欢迎[提 Issue](https://github.com/muzyLink/dsh-subagent-profile/issues)或提交 Pull Request,任何形式的贡献都欢迎。
+
+如果这个插件帮到了你,欢迎在 GitHub 上点个 ⭐,让更多人看到它。
 
 ## 致谢
 

package/cordis.patch.yml

@@ -1,8 +1,8 @@
 # dsh-subagent-profile bundle patch: inserts the dual-face plugin row into the
-# profile roster. The node half (exports ".") runs in the host process — it
+# profile roster. The node side (exports ".") runs in the host process — it
 # registers the dispatch tool, the profile provider, the subagent-profiles
 # service, and the /subagent-profiles/* loopback HTTP routes; the `dsh.client`
-# declaration in package.json makes the browser half (exports "./client", served
+# declaration in package.json makes the browser side (exports "./client", served
 # at /plugins/<id>/client.js) load in the web GUI as the settings page and the
 # dispatch tool-call card.
 - insert: