dsh-subagent-profile 0.1.0 → 0.2.0

package/lib/pure.mjs

@@ -0,0 +1,331 @@
+// lib/pure.mjs — import-free pure helpers extracted from index.mjs (V2 T0-2).
+// These four have no @deepseek-ai imports and no external dependencies; each
+// function body is verbatim from index.mjs. @deepseek-ai symbols stay out of
+// this module — the readResult symbols converge in lib/shims.mjs, and index.mjs's
+// remaining direct @deepseek-ai imports converge there too after the V2.0-mid
+// 12-module split (target state).
+
+// Shipped toStopReason: map a turn-end reason to the seam's terminal vocabulary.
+export function toStopReason(reason) {
+  switch (reason?.kind) {
+    case 'completed': return 'completed';
+    case 'max-tokens': return 'max-tokens';
+    case 'aborted': return 'aborted';
+    case 'blocked': return 'refusal';
+    default: return 'error';
+  }
+}
+
+// Shipped stopReasonError + withPartialText wording (dsh-tool-subagent L55-75).
+export function stopReasonError(result) {
+  switch (result.stopReason) {
+    case 'completed': return;
+    case 'aborted': return 'dispatch: subagent run was cancelled';
+    case 'error': return 'dispatch: subagent run failed';
+    case 'max-tokens': return 'dispatch: subagent run hit its token limit before finishing';
+    case 'refusal': return 'dispatch: subagent declined the task';
+    default: return `dispatch: subagent run ended abnormally (${String(result.stopReason)})`;
+  }
+}
+
+export function withPartialText(error, output) {
+  const text = (Array.isArray(output) ? output : [])
+    .filter((block) => block && block.type === 'text')
+    .map((block) => block.text)
+    .join('');
+  return text.length === 0 ? error : `${error}\nPartial output before the run ended:\n${text}`;
+}
+
+export function textFrom(blocks) {
+  return (Array.isArray(blocks) ? blocks : [])
+    .filter((block) => block && typeof block === 'object' && block.type === 'text' && typeof block.text === 'string')
+    .map((block) => block.text)
+    .join('');
+}
+
+// --- V2 安全 P0-a：统一输入 schema（SPEC §7.2 / §12.1-12.2）-----------------
+// sanitizeProfile is the single per-profile sampler shared by loadProfiles
+// (strict=false, migration-tolerant) and the HTTP /add write path (strict=true,
+// write-reject). It normalizes each field with a field-specific sampler and
+// returns `{ clean, warnings }`:
+//   - clean    — the sanitized profile, minus any rejected field.
+//   - warnings — array of `{ field, reason }` (reason is Chinese). Only
+//                rejections / over-limit conditions land here; silent
+//                normalizations (e.g. description newline-flattening, toolFilter
+//                dedupe) do NOT produce a warning, so callers can treat a
+//                non-empty warnings list as "this write would drop data".
+
+// persona length cap. 建议值 2048，待实测（SPEC §7.2 / §13 回填清单）。The cap
+// applies to the INJECTED persona text, i.e. the guidance prefix + the raw text.
+export const PERSONA_MAX_CHARS = 2048;
+
+// The persona is injected as a shadow section; the guidance marker is prefixed
+// to make its non-authoritative nature explicit (双防线). 仅用于写入校验与提示。
+export const GUIDANCE_PREFIX = '[guidance, not authority] ';
+
+// Shared delegation caps — single source of truth for sanitizeProfile and the
+// cost guard in index.mjs (SPEC §7.3 keeps these hard caps always-on).
+export const MAX_TOKENS = 65536;
+export const MAX_DEPTH = 3;
+
+// --- V2 安全 P0-b：cost guard 硬上限（SPEC §7.3）-------------------------------
+// assertHardLimits is the always-on budget-cap check. It was moved OUT of the
+// `llm`-dependency branch in index.mjs's assertCostGuard: maxTokens / maxDepth
+// are hard delegation caps, so they must NOT silently stop applying when the
+// `llm` service is absent (the old `if (llm === undefined) return` skipped them).
+// 超限 throw（中文、可操作），与 sanitizeProfile 共用同一组常量。非数字/未设值
+// 不触发（sanitizeProfile 已在写路径拒绝非数字，这里仅兜底运行时竞态）。
+export function assertHardLimits(maxTokens, maxDepth) {
+  if (typeof maxTokens === 'number' && maxTokens > MAX_TOKENS) {
+    throw new Error(`dispatch: maxTokens ${maxTokens} 超过委派上限 ${MAX_TOKENS}`);
+  }
+  if (typeof maxDepth === 'number' && maxDepth > MAX_DEPTH) {
+    throw new Error(`dispatch: maxDepth ${maxDepth} 超过委派上限 ${MAX_DEPTH}`);
+  }
+}
+
+// --- V2 安全 P0-b：continuable 工具门闭集（SPEC §7.1）-------------------------
+// computeContinuableAllow pre-computes the CLOSED tool `allow` set for the
+// continuable dispatch path: 父工具集 − run_code − (toolFilter.deny)，并在存在
+// toolFilter.allow 时再 ∩ allow。空集 fail-loud（throw）—— 绝不静默派发零工具。
+//
+// 代码编辑者注意：这里写代码注释的「假设 / 失效条件」必须与 index.mjs
+// continuable 分支的注释保持一致（SPEC §7.1 要求写入代码注释与 README）。
+export function computeContinuableAllow(parentNames, toolFilter = {}) {
+  const parent = new Set(parentNames);
+  parent.delete('run_code');
+  // deny 与 allow 对称守卫：非数组（如恶意/异常输入）按「无 deny」处理，防抛裸
+  // TypeError；allow 同理在下方用 Array.isArray 守卫。
+  const deny = Array.isArray(toolFilter?.deny) ? toolFilter.deny : [];
+  for (const name of deny) parent.delete(name);
+  let result = [...parent];
+  const allow = toolFilter?.allow;
+  if (Array.isArray(allow)) {
+    const allowSet = new Set(allow);
+    result = result.filter((name) => allowSet.has(name));
+  }
+  // 空集 fail-loud：派发一个零工具子 Agent 是静默降级，必须拒绝。
+  if (result.length === 0) {
+    throw new Error('dispatch: continuable 工具集为空，拒绝派发');
+  }
+  return result;
+}
+
+// description/name sampler: `\n→空格`压平. These are display lines (the
+// dispatch:profiles section interpolates them into a single row), so a newline
+// would break the row. 压平仅作存储层；引号包裹由显示层负责——显示层在该行给
+// description 加引号（空时显示 '(无描述)' 不套引号），本纯函数只保证存储值
+// 是单行、无换行。
+function sanitizeShortText(value) {
+  return value.replace(/\r\n|\r|\n/g, ' ');
+}
+
+// --- V2 Token P0：结果回收默认剪枝（SPEC §8.2）-------------------------------
+// 子结果默认复用宿主 `toolResultPruner.pruneContent` 预剪（纯函数、零 LLM），
+// 在 `textFrom` 之前执行，把回灌进父上下文的体积压到阈值内。
+//
+// 阈值常量：head / tail / minKeep 是**子级**预期裁剪口径（比 agent.cordis.yml
+// 现行 compaction-basic 的 4096/1024 更保守）。**待实测**——宿主
+// toolResultPruner.pruneContent(blocks) 只接收 blocks，自身读取其配置
+// （thresholdChars/headChars/tailChars），因此这三个常量当前**不会**作为实参
+// 传给宿主 pruner；它们记录本条目的子级口径，并保留给 V2.0-中期「信封 / 精修
+// 剪枝」路径使用。改动前先实测真实分布再回填 SPEC §13。
+export const PRUNE_HEAD_CHARS = 2048;
+export const PRUNE_TAIL_CHARS = 1024;
+export const PRUNE_MIN_KEEP = 128;
+
+// Apply host pruning to one subagent result's content blocks.
+//   - `blocks`   — the result.output content blocks (or undefined; not an array).
+//   - `pruner`   — the `toolResultPruner` service, or undefined.
+// Returns the (possibly pruned) blocks, or an empty array placeholder. When the
+// pruner is absent (headless deployment without the compaction pruner) OR the
+// content is not an array, it falls back to NO pruning — 剪枝是增强，绝非硬依赖
+// （SPEC §8.2）。A host pruner that throws on an unusual content shape also
+// falls back to the full output, because automatic pruning must NEVER swallow a
+// legitimate child result.
+export function pruneBlocks(blocks, pruner) {
+  if (Array.isArray(blocks) && pruner !== undefined && typeof pruner.pruneContent === 'function') {
+    try {
+      const pruned = pruner.pruneContent(blocks);
+      return pruned ?? blocks;
+    } catch {
+      return blocks;
+    }
+  }
+  return Array.isArray(blocks) ? blocks : [];
+}
+
+// --- V2 Token P0：continuable 可见性修复（SPEC §8.4 / 共享规则 R1）-----------
+// R1 requires the three closed `output.schema.oneOf` branches
+// (background / continuable / foreground) to carry an IDENTICAL shared meta key
+// set whenever a result-meta field is added — so `ignored`, `reasoningEffort`,
+// `profile/preset/provider/model` must appear in ALL three branches, keeping the
+// model-side schema from rejecting a分支 that "forgot" the field.
+//
+// 判据：元数据集合 = 每个分支 properties 的键集，**剔除**各分支自有的判别键
+// （`kind`/`jobId`/`subagentId`/`output`——background/continuable/foreground 各自
+// 的判别字段不同，不纳入一致性比较）。剩下必须是三者的公共元数据集合，三处
+// 逐一对齐；任一分支缺漏/多余公共元数据键即 throw（中文、指明 R1）。
+const RESULT_SCHEMA_DISCRIMINATOR_KEYS = new Set(['kind', 'jobId', 'subagentId', 'output']);
+
+export function assertResultSchemaConsistency(schema) {
+  if (!schema || typeof schema !== 'object') {
+    throw new Error('dispatch: 结果 schema 必须为对象（R1 closed oneOf）');
+  }
+  const branches = schema.oneOf;
+  if (!Array.isArray(branches) || branches.length === 0) {
+    throw new Error('dispatch: 结果 schema 必须包含非空 oneOf 分支');
+  }
+  const metaSets = branches.map((branch, index) => {
+    if (!branch || typeof branch !== 'object' || branch.properties === null || typeof branch.properties !== 'object') {
+      throw new Error(`dispatch: 结果 schema oneOf 分支 ${index + 1} 缺少 properties 对象`);
+    }
+    return new Set(
+      Object.keys(branch.properties).filter((key) => !RESULT_SCHEMA_DISCRIMINATOR_KEYS.has(key))
+    );
+  });
+  const ref = metaSets[0];
+  for (let i = 1; i < metaSets.length; i++) {
+    const current = metaSets[i];
+    const same = current.size === ref.size && [...ref].every((key) => current.has(key));
+    if (!same) {
+      throw new Error(
+        `dispatch: 结果 schema oneOf 分支 ${i + 1} 的元数据字段集与分支 1 不一致（R1：凡向结果 meta 增字段须同步全三分支；期望 ${[...ref].join(', ')}，实际 ${[...current].join(', ')}）`
+      );
+    }
+  }
+  return true;
+}
+
+// The full field set that may live on a profile. ANY other key — including
+// __proto__ / constructor / prototype (which JSON.parse can produce as OWN
+// properties) — is dropped instead of copied, so assignment never walks into
+// the object prototype chain (prototype-pollution guard).
+const KNOWN_PROFILE_FIELDS = new Set([
+  'id', 'name', 'description', 'persona', 'preset', 'provider', 'model',
+  'reasoningEffort', 'enabled', 'maxTokens', 'maxDepth', 'toolFilter',
+  'builtin', 'deleted',
+]);
+
+/**
+ * Sanitize one profile entry. `options.strict`:
+ *   - strict=false (migration read): an over-length persona is KEPT (not
+ *     truncated) and warned; over-limit maxTokens/maxDepth and illegal
+ *     toolFilter subfields are dropped (field removed) + warned.
+ *   - strict=true (write path): an over-length persona is also REMOVED from
+ *     clean and warned, so the caller can reject the whole write with a 400.
+ * Non-rejection normalizations (description/name flatten, toolFilter dedupe) are
+ * silent and never produce a warning.
+ *
+ * Security (P1): `clean` is `Object.create(null)` (no inherited `__proto__`
+ * setter) and only whitelisted fields are copied, so a hostile `__proto__` /
+ * `constructor` / `prototype` key is ignored rather than polluting the result.
+ */
+export function sanitizeProfile(profile, options = {}) {
+  const { strict = false } = options;
+  const clean = Object.create(null);
+  const warnings = [];
+  if (profile === null || typeof profile !== 'object' || Array.isArray(profile)) {
+    return { clean, warnings: [{ field: '(root)', reason: 'profile 不是对象' }] };
+  }
+  for (const [key, value] of Object.entries(profile)) {
+    if (!KNOWN_PROFILE_FIELDS.has(key)) {
+      warnings.push({ field: key, reason: '未知字段已忽略' });
+      continue;
+    }
+    switch (key) {
+      case 'name':
+      case 'description': {
+        if (value === undefined) break;
+        // null / '' are the "clear this field" sentinels the /add merge layer
+        // handles; pass them through unchanged rather than flagging null as an
+        // illegal type. Any OTHER non-string (number / object / array) is
+        // rejected.
+        if (value === null || value === '') { clean[key] = value; break; }
+        if (typeof value !== 'string') {
+          warnings.push({ field: key, reason: `${key} 必须为字符串` });
+          break;
+        }
+        clean[key] = sanitizeShortText(value);
+        break;
+      }
+      case 'persona': {
+        if (value === undefined) break;
+        if (typeof value !== 'string') {
+          warnings.push({ field: 'persona', reason: 'persona 必须为字符串' });
+          break;
+        }
+        const wrappedLength = value.length === 0 ? 0 : GUIDANCE_PREFIX.length + value.length;
+        if (wrappedLength > PERSONA_MAX_CHARS) {
+          if (strict) {
+            warnings.push({
+              field: 'persona',
+              reason: `persona 超长：计入引导前缀 '${GUIDANCE_PREFIX.trim()}' 后 ${wrappedLength} 字符，超过上限 ${PERSONA_MAX_CHARS}，拒绝写入`,
+            });
+            break;
+          }
+          warnings.push({
+            field: 'persona',
+            reason: `persona 超长：计入引导前缀 '${GUIDANCE_PREFIX.trim()}' 后 ${wrappedLength} 字符，超过上限 ${PERSONA_MAX_CHARS}；保留原值（不截断），建议人工精简`,
+          });
+          clean[key] = value;
+          break;
+        }
+        clean[key] = value;
+        break;
+      }
+      case 'maxTokens': {
+        if (value === undefined) break;
+        if (typeof value !== 'number' || !Number.isFinite(value)) {
+          warnings.push({ field: 'maxTokens', reason: 'maxTokens 必须为有限数字' });
+          break;
+        }
+        if (value > MAX_TOKENS) {
+          warnings.push({ field: 'maxTokens', reason: `maxTokens ${value} 超过上限 ${MAX_TOKENS}` });
+          break;
+        }
+        clean[key] = value;
+        break;
+      }
+      case 'maxDepth': {
+        if (value === undefined) break;
+        if (typeof value !== 'number' || !Number.isFinite(value)) {
+          warnings.push({ field: 'maxDepth', reason: 'maxDepth 必须为有限数字' });
+          break;
+        }
+        if (value > MAX_DEPTH) {
+          warnings.push({ field: 'maxDepth', reason: `maxDepth ${value} 超过上限 ${MAX_DEPTH}` });
+          break;
+        }
+        clean[key] = value;
+        break;
+      }
+      case 'toolFilter': {
+        if (value === undefined) break;
+        if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+          warnings.push({ field: 'toolFilter', reason: 'toolFilter 必须为对象' });
+          break;
+        }
+        const tf = {};
+        for (const op of ['allow', 'deny']) {
+          const sub = value[op];
+          if (sub === undefined) continue;
+          if (!Array.isArray(sub) || !sub.every((s) => typeof s === 'string')) {
+            warnings.push({ field: `toolFilter.${op}`, reason: `toolFilter.${op} 必须为字符串数组` });
+            continue;
+          }
+          const deduped = [...new Set(sub.filter((s) => s.length > 0))];
+          if (deduped.length > 0) tf[op] = deduped;
+        }
+        // Unknown toolFilter keys are ignored; an empty (or fully-invalid)
+        // toolFilter is simply omitted from clean (mirrors the /add write path).
+        if (Object.keys(tf).length > 0) clean.toolFilter = tf;
+        break;
+      }
+      default:
+        clean[key] = value;
+        break;
+    }
+  }
+  return { clean, warnings };
+}

package/lib/shims.mjs

@@ -0,0 +1,215 @@
+// lib/shims.mjs — facade (V2 Task 6a). The ONLY module that imports the
+// @deepseek-ai symbols index.mjs relies on, converging the previously
+// top-level-scattered import surface (SPEC §9.2). Two failure classes:
+//
+//   Guard-type (fail-loud, NO fallback): assertSubagentMaxDepth /
+//   resolveChildDepth are STATICALLY imported and re-exported. A rename/removal
+//   in the host rc makes this module — and therefore index.mjs — fail at load
+//   time with the ESM link error "The requested module ... does not provide an
+//   export named '...'". That is exactly the loading-time isolation the spec
+//   wants for the delegation-depth safety gates: no weakened reimplementation is
+//   ever substituted, so a child can never be dispatched past MAX_DEPTH.
+//
+//   Function-mapping (fail-soft + warn): foldConsumedWork / finalAssistantOutput
+//   / createUserMessage / appendDelegatedPolicyOverrides /
+//   captureDelegatedPolicyOverrides / resolveChildAgentOptions / defineTool are
+//   loaded with a dynamic top-level-await import wrapped in try/catch. On an
+//   import failure (or a renamed/absent named export) the module still loads, a
+//   console.warn is emitted (module top level has no ctx, so no logger), and a
+//   local functionally-equivalent (or safe-degraded) implementation is used.
+//
+//   A dynamic import whose package loads but whose named export was renamed or
+//   removed resolves the destructure to `undefined` WITHOUT throwing, so loadSoft
+//   also verifies the value is a function before accepting it.
+
+import { randomUUID } from 'node:crypto';
+// Guard-type: static, fail-loud — no fallback (SPEC §9.2). Kept as the only two
+// static @deepseek-ai imports; a missing export aborts module load with a clear
+// error BEFORE apply can run, which is the isolation this class exists for.
+import { assertSubagentMaxDepth, resolveChildDepth } from '@deepseek-ai/dsh-subagent';
+import { toStopReason } from './pure.mjs';
+
+// warn: at module top level there is no ctx / logger, so degrade to console.warn
+// (SPEC §9.2). The prefix keeps the source recognizable in a shared host log.
+function warn(...parts) {
+  console.warn('[dsh-subagent-profile]', ...parts);
+}
+
+// Load one function-mapping `@deepseek-ai` symbol, returning a local fallback when
+// the package or the named export is unavailable. `warnMessage` carries the
+// actionable user-facing text. `importer` is an injectable loader (defaults to
+// the dynamic `import` — see DYNAMIC_IMPORT) so tests / future loaders can
+// override the failure route (e.g. stub it to throw, or return a module object
+// missing the symbol). It is exported as a seam for that purpose.
+//
+// Note: `import` is a keyword and cannot be used as a value reference
+// (`importer = import` is a SyntaxError), so the default is a thin wrapper around
+// the dynamic import expression.
+const DYNAMIC_IMPORT = (specifier) => import(specifier);
+async function loadSoft(pkg, symbol, fallback, warnMessage, importer = DYNAMIC_IMPORT) {
+  try {
+    const mod = await importer(pkg);
+    if (typeof mod?.[symbol] === 'function') return mod[symbol];
+    warn(warnMessage);
+    return fallback;
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    warn(`${warnMessage}（导入失败：${detail}）`);
+    return fallback;
+  }
+}
+
+// --- local fallbacks (import-free, duck-typed, functionally equivalent) ----
+// Each is the minimal local reimplementation that preserves the observable
+// contract of the shipped helper. See the fallback-semantics report in the Task
+// 6a summary; these are exported via `__fallbacks` so tests can exercise the
+// degraded path even though the junction packages resolve successfully here.
+
+// foldConsumedWork: **近似、非等价**——readResult 只读 `.end`（终止 turn/end 事件）来
+// 推导 stopReason。shipped fold 是精密的 stepped/claimed 状态机；本降级实现取最后一个
+// `turn/end` 事件。在多 turn 或「有 claim 但未 step」的 turn 边缘场景，`.end` 可能异于
+// 宿主 shipped fold（后者只在 stepped 或 claimed+accountsForClaim 的 turn 上落 `.end`），
+// 因此**勿当作完全等价**。仅因 readResult 只消费 `.end`、且此为减压路径才作此近似；
+// `droppedUnrun` 不被 readResult 使用，保守置 false。
+function foldConsumedWorkFallback(events) {
+  let end;
+  for (const event of events) {
+    if (event && event.type === 'turn/end') end = event;
+  }
+  return { ...(end === undefined ? {} : { end }), droppedUnrun: false };
+}
+
+// finalAssistantOutput: identical fold rule — last non-empty assistant/message,
+// else accumulated text-delta chunks, else undefined.
+function finalAssistantOutputFallback(events) {
+  let message;
+  const partial = [];
+  for (const event of events) {
+    if (event && event.type === 'assistant/message') {
+      const content = event.data?.message?.content;
+      if (Array.isArray(content) && content.length > 0) message = content;
+    } else if (event && event.type === 'assistant/chunk' && event.data?.chunk?.type === 'text-delta') {
+      const text = event.data.chunk.text;
+      if (typeof text === 'string' && text.length > 0) partial.push(text);
+    }
+  }
+  if (message !== undefined) return message;
+  const text = partial.join('');
+  return text.length > 0 ? [{ type: 'text', text }] : undefined;
+}
+
+// createUserMessage: build the user-role message the followup driver needs. The
+// shipped helper uses a branded MessageId + deepFreeze; the fallback provides the
+// same observable shape (role/content/id/source) with a fresh random id. Note:
+// the returned object is MUTABLE (no deepFreeze) — consumers must NOT rely on
+// the shipped deepFreeze immutability; treat it as a plain message object.
+function createUserMessageFallback(input) {
+  return {
+    ...input,
+    role: 'user',
+    id: randomUUID(),
+  };
+}
+
+// appendDelegatedPolicyOverrides: the delegation policy is authored INTO the
+// child's log for reconstruction. This is also the security-relevant
+// "approval: never" pin, so it must NOT be a no-op — reproduce the append
+// faithfully to keep the child's own log reconstructable and the pin visible.
+function appendDelegatedPolicyOverridesFallback(childSession, overrides) {
+  const o = overrides || {};
+  if (o.sandboxMode !== undefined) {
+    childSession.append('sandbox/mode', { mode: o.sandboxMode, source: 'delegation' });
+  }
+  if (o.approvalPolicy !== undefined) {
+    childSession.append('approval/policy', { policy: o.approvalPolicy, source: 'delegation' });
+  }
+}
+
+// captureDelegatedPolicyOverrides: the parent's explicit sandbox override (or
+// undefined when none) plus the approval pin 'never' when the parent has an
+// approval service. Optional chaining keeps a mock parent (tests) working.
+function captureDelegatedPolicyOverridesFallback(parent) {
+  return {
+    sandboxMode: parent.ctx?.get?.('sandboxPolicy')?.overrideOf?.(parent.session),
+    approvalPolicy: parent.ctx?.get?.('approval') === undefined ? undefined : 'never',
+  };
+}
+
+// resolveChildAgentOptions: merge the parent's route (provider/model/maxTokens,
+// present-only) with the per-child overrides and stamp the child's own depth.
+// This must preserve the child-config semantics — a no-op here would silently
+// break delegation routing.
+function resolveChildAgentOptionsFallback(parent, requested, childDepth) {
+  const parentProvider = parent.options?.provider;
+  const parentModel = parent.options?.model;
+  const parentMaxTokens = parent.options?.maxTokens;
+  return {
+    ...(parentProvider !== undefined ? { provider: parentProvider } : {}),
+    ...(parentModel !== undefined ? { model: parentModel } : {}),
+    ...(parentMaxTokens !== undefined ? { maxTokens: parentMaxTokens } : {}),
+    ...(requested || {}),
+    subagentDepth: childDepth,
+  };
+}
+
+// defineTool: the dispatch tool cannot exist without dsh-tools. Fail-loud at the
+// point of use with a clear, actionable message — the module still LOADS, and
+// calling this during apply surfaces the exact missing-dependency story instead
+// of a cryptic module-not-found at import time (SPEC §9.2 "不崩溃").
+function defineToolFallback() {
+  throw new Error('dsh-tools 缺失：dispatch 工具不可用');
+}
+
+// --- wire the function-mapping symbols (module top-level await) --------------
+// The seven loads are independent, so they run in parallel (Promise.all) to cut
+// module-load latency; each still degrades to its local fallback on failure. We
+// keep the real functions when the junction resolves, and the fallbacks when a
+// host rc renamed/removed a symbol.
+const [foldConsumedWork, finalAssistantOutput, createUserMessage, appendDelegatedPolicyOverrides, captureDelegatedPolicyOverrides, resolveChildAgentOptions, defineTool] = await Promise.all([
+  loadSoft('@deepseek-ai/dsh-agent', 'foldConsumedWork', foldConsumedWorkFallback, 'dsh-agent 的 foldConsumedWork 不可用，结果裁切使用本地降级实现'),
+  loadSoft('@deepseek-ai/dsh-subagent', 'finalAssistantOutput', finalAssistantOutputFallback, 'dsh-subagent 的 finalAssistantOutput 不可用，子结果选取使用本地降级实现'),
+  loadSoft('@deepseek-ai/dsh-llm', 'createUserMessage', createUserMessageFallback, 'dsh-llm 的 createUserMessage 不可用，用户消息构造使用本地降级实现'),
+  loadSoft('@deepseek-ai/dsh-subagent', 'appendDelegatedPolicyOverrides', appendDelegatedPolicyOverridesFallback, 'dsh-subagent 的 appendDelegatedPolicyOverrides 不可用，委派策略追加使用本地降级实现'),
+  loadSoft('@deepseek-ai/dsh-subagent', 'captureDelegatedPolicyOverrides', captureDelegatedPolicyOverridesFallback, 'dsh-subagent 的 captureDelegatedPolicyOverrides 不可用，委派策略捕获使用本地降级实现'),
+  loadSoft('@deepseek-ai/dsh-subagent', 'resolveChildAgentOptions', resolveChildAgentOptionsFallback, 'dsh-subagent 的 resolveChildAgentOptions 不可用，子 Agent 选项解析使用本地降级实现'),
+  loadSoft('@deepseek-ai/dsh-tools', 'defineTool', defineToolFallback, 'dsh-tools 缺失：dispatch 工具不可用'),
+]);
+
+// readResult: shipped shape. The terminal turn reason comes from foldConsumedWork;
+// the selected output comes from finalAssistantOutput (last non-empty assistant
+// message, else joined text-delta chunks, else undefined -> []).
+function readResult(child, boundary, cancelled) {
+  const own = child.session.events.slice(boundary);
+  const end = foldConsumedWork(own).end;
+  const recorded = toStopReason(end?.data.reason);
+  const stopReason = cancelled && recorded !== 'completed' ? 'aborted' : recorded;
+  return { output: finalAssistantOutput(own) ?? [], stopReason };
+}
+
+// Test-only access to the local degraded implementations (package imports
+// resolve here, so the real functions win; __fallbacks lets a test exercise the
+// fail-soft path without deleting node_modules).
+export const __fallbacks = {
+  foldConsumedWork: foldConsumedWorkFallback,
+  finalAssistantOutput: finalAssistantOutputFallback,
+  createUserMessage: createUserMessageFallback,
+  appendDelegatedPolicyOverrides: appendDelegatedPolicyOverridesFallback,
+  captureDelegatedPolicyOverrides: captureDelegatedPolicyOverridesFallback,
+  resolveChildAgentOptions: resolveChildAgentOptionsFallback,
+  defineTool: defineToolFallback,
+};
+
+export {
+  assertSubagentMaxDepth,
+  resolveChildDepth,
+  // ---- test seam / injectable loader (see loadSoft doc) ----
+  loadSoft,
+  foldConsumedWork,
+  finalAssistantOutput,
+  createUserMessage,
+  appendDelegatedPolicyOverrides,
+  captureDelegatedPolicyOverrides,
+  resolveChildAgentOptions,
+  defineTool,
+  readResult,
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-subagent-profile",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Dispatch one-shot subtasks to derived subagents with per-task overrides (preset/model/provider/reasoningEffort/persona/tool whitelist), a runtime-derived cost guard, a subagent-profiles service, observability metadata, and a web-GUI settings page plus a dispatch tool-call card.",
   "repository": {
     "type": "git",
@@ -15,7 +15,7 @@
   },
   "files": [
     "index.mjs",
-    "lib/client.js",
+    "lib",
     "cordis.patch.yml",
     "presets",
     "docs",
@@ -70,5 +70,9 @@
     "dispatch",
     "profiles"
   ],
-  "license": "MIT"
+  "license": "MIT",
+  "scripts": {
+    "release": "node scripts/release.mjs",
+    "test": "node --test \"test/**/*.test.mjs\""
+  }
 }

package/presets/orchestrator/agent.cordis.yml

@@ -35,15 +35,13 @@
   name: '@deepseek-ai/dsh-persona'
   config:
     text: |-
-      你是主协调 Agent（Orchestrator），由 {{model}} 驱动，工作目录是 {{cwd}}。
-
-      你的职责是「拆解 → 委派 → 集成」，把复杂任务交给合适的子 Agent 并行或串行完成，而不是事事亲力亲为：
-      1. 先规划：用 todo_write 记下总体计划，把任务拆成彼此独立、边界清晰的子任务，标注依赖与并行关系。
-      2. 再委派：优先用 dispatch 工具按场景选方案派发（dispatch.profile 内置 swap-standard=标准编码、researcher=调研检索，可在「子 Agent 方案」设置页自定义）。多轮可续探索用 subagent / subagent_fork，多路批量并行用 workflow，需要从头反复迭代的长任务才用 ralph。能后台并行就 run_in_background，不要串行干等。
-      3. 自包含 prompt：每个子 Agent 都看不到你的对话，prompt 必须写全背景、目标、期望产出、验收标准与禁止事项，别让它回头猜。
-      4. 亲自兜底与集成：读文件、搜索、小改动等比委派更便宜的事自己直接做；收集子 Agent 产出后亲自核对质量，整合成一份连贯的最终交付，不要原样堆砌。
-      5. 失败处理：子 Agent 失败或超出权限时，自己接手重做，或用 ask_user_question 向用户澄清。
-      6. 边界：子 Agent 的能力 ⊆ 你的能力，审批恒为「永不」；不要委派你也没有权限做的事，也不要让子 Agent 提权。
+      你是主协调 Agent（Orchestrator），由 {{model}} 驱动，工作目录是 {{cwd}}。职责是「拆解 → 委派 → 集成」：把复杂任务拆成边界清晰的子任务，按场景交给合适的子 Agent，再亲自核对质量、整合成连贯交付（别原样堆砌）。
+
+      委派：优先 dispatch 按场景选方案（swap-standard=标准编码、researcher=调研检索，可在「子 Agent 方案」设置页自定义）；多轮可续探索用 subagent/subagent_fork，多路批量并行用 workflow，长任务反复迭代用 ralph；能后台并行就 run_in_background，不要串行干等。
+
+      prompt 必须自包含：子 Agent 看不到你的对话，写全背景、目标、期望产出、验收标准与禁止事项。
+
+      边界：子 Agent 能力 ⊆ 你，审批恒为「永不」；子 Agent 失败或超出权限时自己接手重做，或用 ask_user_question 向用户澄清。
 
 - id: agent-instructions
   name: '@deepseek-ai/dsh-agent-instructions'