dsh-subagent-profile 0.1.0 → 0.3.0

package/README.md

@@ -2,10 +2,11 @@
 
 <!-- Hero -->
 <div align="center">
-  <b style="font-size: 1.15em;">子 Agent 派发方案化插件 —— 用对的人（预设 / 模型 / 推理强度）干对的事</b><br /><br />
+  <b style="font-size: 1.15em;">Subagent dispatch, profiled — the right agent for the right task (preset / model / reasoning effort)</b><br /><br />
   <img alt="License: MIT" src="https://img.shields.io/badge/License-MIT-yellow.svg" />
-  <img alt="Version: 0.1.0" src="https://img.shields.io/badge/version-0.1.0-blue.svg" />
-  <img alt="DSH" src="https://img.shields.io/badge/DSH-0.1.0--rc.6%20~%20rc.8-blue.svg" />
+  <img alt="Version: v0.3.0" src="https://img.shields.io/badge/Version-v0.3.0-blue.svg" />
+  <img alt="npm" src="https://img.shields.io/npm/v/dsh-subagent-profile.svg" />
+  <img alt="DSH" src="https://img.shields.io/badge/DSH-0.1.0--rc.6%20~%200.1.1--rc.2-blue.svg" />
 </div>
 
 <div align="center">English · <a href="README.zh.md">中文</a></div>
@@ -90,6 +91,48 @@ Delegation never lets a subagent gain more power than you already have — this
 
 - **Background** one-shot dispatch requires `@deepseek-ai/dsh-jobs` and `@deepseek-ai/dsh-tool-jobs` to be loaded; otherwise it fails with "background jobs unavailable".
 - **Continuable** mode goes through the DSH standard composition path, so the `preset` swap and `reasoningEffort` are ignored (the child inherits the parent preset at the default reasoning effort).
+- **Continuable** tool gate is a plugin-side mitigation: the child's `allow` is pre-computed as a closed set — parent tool set − `run_code` − `deny`, then intersected with `allow`. **Assumption:** continuable inherits the parent preset, so the child's tool set ≈ the parent's. **Failure condition:** any host behavior change that makes the child's tool set differ from the parent's (not only preset swap — e.g. a future preset swap, composing a different tool set) means the parent set can contain tools the child does not have, so `tools.restrict` throws "unknown tool" and this mitigation automatically degrades to fail-loud (conservatively safe); it must then be replaced with a true parent ∩ child intersection once the upstream provides a provider guard seam.
+
+## Repository structure
+
+```
+dsh-subagent-profile/
+├── index.mjs                     # host side: the plugin itself (dispatch tool, profile provider, service, HTTP routes)
+├── lib/
+│   ├── client.js                 # browser side: settings page + dispatch tool-call card
+│   └── core/                     # host-side modules (lightweight layering)
+│       ├── pure.mjs              # dependency-free pure functions (sanitize / prune / guard math — unit-tested)
+│       ├── shims.mjs             # the single @deepseek-ai import facade (guards fail loud, helpers degrade softly)
+│       └── *.mjs                 # catalog / whitelist / intersection / cost-guard / delegation / profiles-store /
+│                                 #   presets-sync / http-routes / profile-provider / dispatch-tool
+├── presets/orchestrator/         # bundled "orchestrator" agent preset (self-installed, synced on every startup)
+├── cordis.patch.yml              # bundle patch: inserts the plugin row into the host composition
+├── .gitea/workflows/ci.yml       # bare-CI (Gitea Actions; needs an Act runner on the server)
+├── package.json                  # metadata, files whitelist, exports (test / test:bare / preflight scripts)
+├── scripts/
+│   ├── release.mjs               # release helper (version bump / tag checks)
+│   └── preflight.mjs             # preflight: preset-tree reconciliation + README badge == version (zero-dep)
+├── docs/
+│   └── screenshots/              # README screenshots
+├── test/                         # host-side tests (node:test, zero extra deps; 101 cases = 26 bare + 75 junction)
+│   ├── README.md / README.zh.md  # test directory guide (EN/ZH) — two-tier split explained
+│   ├── harness/ctx.mjs           # fake Cordis ctx + ~/.dsh isolation
+│   ├── pure / input-schema / catalog-integrity.test.mjs   # bare tier (import-free, runs in bare CI)
+│   └── characterization / facade / gating / persist / recycle / cost-guard / continuable-guard.test.mjs  # junction tier (local only)
+├── README.md / README.zh.md      # this document (EN/ZH)
+└── LICENSE
+```
+
+## Contributing
+
+Found a bug or have an idea? [Open an issue](https://github.com/muzyLink/dsh-subagent-profile/issues) or submit a pull request — all contributions are welcome.
+
+### CI (bare) & preflight
+
+- **Gitea Actions** (`.gitea/workflows/ci.yml`): on `push` / `pull_request` to `v2-midterm` / `main`, runs the **bare-CI** subset — the tests that never load `@deepseek-ai` (`npm run test:bare`: pure / input-schema / catalog-integrity), `node --check` syntax checks, eslint (installed in isolation, since the bare environment cannot install the `@deepseek-ai` devDependencies), and `npm run preflight`. **Enabling Gitea Actions requires installing an Act runner on the server** (register it with the `ubuntu-latest` label); the workflow takes effect automatically once the runner is ready. Junction-dependent tests (characterization / facade / gating / persist / recycle / cost-guard / continuable-guard) run locally only — see `test/README.md` for the two-tier split and its rationale.
+- **Preflight** (`npm run preflight`): zero-dependency self-check — ① reconciles the bundled `presets/` tree against a fresh `$DSH_HOME/.agent-presets` derived tree (byte-identical set, both directions; never touches the real `~/.dsh`), ② asserts the README version badge (`v<version>` in the hero) matches `package.json` `version`. Non-zero exit means drift — fix and re-run before release.
+
+If this plugin has been useful to you, please give it a ⭐ on GitHub — it helps others find it.
 
 ## Credits
 

package/README.zh.md

@@ -4,8 +4,9 @@
 <div align="center">
   <b style="font-size: 1.15em;">子 Agent 派发方案化插件 —— 用对的人（预设 / 模型 / 推理强度）干对的事</b><br /><br />
   <img alt="License: MIT" src="https://img.shields.io/badge/License-MIT-yellow.svg" />
-  <img alt="Version: 0.1.0" src="https://img.shields.io/badge/version-0.1.0-blue.svg" />
-  <img alt="DSH" src="https://img.shields.io/badge/DSH-0.1.0--rc.6%20~%20rc.8-blue.svg" />
+  <img alt="Version: v0.3.0" src="https://img.shields.io/badge/Version-v0.3.0-blue.svg" />
+  <img alt="npm" src="https://img.shields.io/npm/v/dsh-subagent-profile.svg" />
+  <img alt="DSH" src="https://img.shields.io/badge/DSH-0.1.0--rc.6%20~%200.1.1--rc.2-blue.svg" />
 </div>
 
 <div align="center"><a href="README.md">English</a> · 中文</div>
@@ -90,6 +91,48 @@ dispatch(
 
 - **后台**一次性派发需要加载 `@deepseek-ai/dsh-jobs` 与 `@deepseek-ai/dsh-tool-jobs`，否则报「background jobs unavailable」。
 - **可续跑**模式走 DSH 标准组合路径，因此 `preset` 换用与 `reasoningEffort` 会被忽略（继承父预设、使用默认推理强度）。
+- **可续跑**工具门为插件侧缓解：子 Agent 的 `allow` 预加工为闭集 —— 父工具集 − `run_code` − `deny`，再与 `allow` 取交集。**假设：** 可续跑继承父预设 ⇒ 子工具集 ≈ 父工具集。**失效条件：** 任何导致子工具集与父工具集不一致的宿主行为变化（非仅换用预设——例如未来允许换用预设、组合不同工具集等），父集都可能含子集没有的工具，`tools.restrict` 会抛「未知工具」→ 本缓解自动降级为 fail-loud（保守安全）；待上游提供 provider 守卫接缝后替换为真交集。
+
+## 目录结构
+
+```
+dsh-subagent-profile/
+├── index.mjs                     # 宿主侧：插件本体（dispatch 工具、profile provider、服务、HTTP 路由）
+├── lib/
+│   ├── client.js                 # 浏览器侧：设置页 + dispatch 工具调用卡片
+│   └── core/                     # 宿主侧模块（轻量分层）
+│       ├── pure.mjs              # 无依赖纯函数（净化 / 剪枝 / 护栏计算——可单测）
+│       ├── shims.mjs             # @deepseek-ai 依赖唯一入口（facade：守卫型 fail-loud、功能映射型软降级）
+│       └── *.mjs                 # catalog / whitelist / intersection / cost-guard / delegation / profiles-store /
+│                                 #   presets-sync / http-routes / profile-provider / dispatch-tool
+├── presets/orchestrator/         # 内置「编排者模式」agent 预设（自安装，每次启动同步）
+├── cordis.patch.yml              # bundle 补丁：把插件行插入宿主组成
+├── .gitea/workflows/ci.yml       # bare-CI（Gitea Actions；需服务器装 Act runner）
+├── package.json                  # 元数据、files 发布白名单、exports（test / test:bare / preflight scripts）
+├── scripts/
+│   ├── release.mjs               # 发布脚本（版本 bump / tag 校验）
+│   └── preflight.mjs             # preflight：preset 树对账 + README 徽章 == version（零依赖）
+├── docs/
+│   └── screenshots/              # README 截图
+├── test/                         # 宿主侧自动化测试（node:test，零新增依赖；101 用例 = 26 bare + 75 junction）
+│   ├── README.md / README.zh.md  # 测试目录说明（中英双语）——两档测试划分
+│   ├── harness/ctx.mjs           # 假宿主环境（fake ctx + ~/.dsh 隔离）
+│   ├── pure / input-schema / catalog-integrity.test.mjs   # bare 档（import-free，bare CI 可跑）
+│   └── characterization / facade / gating / persist / recycle / cost-guard / continuable-guard.test.mjs  # junction 档（仅本机）
+├── README.md / README.zh.md      # 本文档（中英双语）
+└── LICENSE
+```
+
+## 贡献
+
+发现 Bug 或有新想法?欢迎[提 Issue](https://github.com/muzyLink/dsh-subagent-profile/issues)或提交 Pull Request,任何形式的贡献都欢迎。
+
+### CI（bare）与 preflight
+
+- **Gitea Actions**（`.gitea/workflows/ci.yml`）：`push` / `pull_request` 到 `v2-midterm` / `main` 时运行 **bare-CI** 子集——从不加载 `@deepseek-ai` 的测试（`npm run test:bare`：pure / input-schema / catalog-integrity）、`node --check` 全仓库语法检查、eslint 行门（eslint 在仓库外隔离安装，因裸环境装不到 `@deepseek-ai` devDependencies）、以及 `npm run preflight`。**启用 Gitea Actions 需服务器装 Act runner**（注册时带上 `ubuntu-latest` 标签），runner 就绪后本工作流自动生效。依赖 junction 的测试（characterization / facade / gating / persist / recycle / cost-guard / continuable-guard）仅本机跑——两档测试的划分与理由见 `test/README.zh.md`。
+- **Preflight**（`npm run preflight`）：零依赖自检——① `presets/` 与全新 `$DSH_HOME/.agent-presets` 派生树做 byte 一致集合对账（双向；绝不写真实 `~/.dsh`）；② 断言 README 版本徽章（Hero 区 `v<version>`）与 `package.json` 的 `version` 一致。非零退出即漂移，发布前修复后重跑。
+
+如果这个插件帮到了你,欢迎在 GitHub 上点个 ⭐,让更多人看到它。
 
 ## 致谢
 

package/cordis.patch.yml

@@ -1,8 +1,8 @@
 # dsh-subagent-profile bundle patch: inserts the dual-face plugin row into the
-# profile roster. The node half (exports ".") runs in the host process — it
+# profile roster. The node side (exports ".") runs in the host process — it
 # registers the dispatch tool, the profile provider, the subagent-profiles
 # service, and the /subagent-profiles/* loopback HTTP routes; the `dsh.client`
-# declaration in package.json makes the browser half (exports "./client", served
+# declaration in package.json makes the browser side (exports "./client", served
 # at /plugins/<id>/client.js) load in the web GUI as the settings page and the
 # dispatch tool-call card.
 - insert: