dsh-subagent-profile 0.3.0 → 0.3.2

package/lib/core/pure.mjs

@@ -1,4 +1,4 @@
-// lib/core/pure.mjs — import-free pure helpers (extracted from index.mjs and grown
+// lib/core/pure.mjs — import-free pure helpers (extracted from index.mjs and grown
 // by later refactors). No @deepseek-ai imports and no external dependencies:
 // @deepseek-ai symbols converge in lib/core/shims.mjs (the only such entry point),
 // and this module is safe to import from bare-CI tests without the junction
@@ -197,6 +197,19 @@ function sanitizeToolFilterField(value, clean, warnings) {
   if (Object.keys(tf).length > 0) clean.toolFilter = tf;
 }
 
+// tokenTier：成本/深度分层（cheap/balanced/premium），供目录排序与结果卡
+// 展示分层。合法值透传；非法值剔除 + warn（与 maxTokens 等超限字段同口径——
+// 剔除而非回填缺省值）。缺省 'balanced' 在 sanitizeProfile 末尾按「字段未提供」
+// 单独回填，非法值不受该回填影响。
+const TOKEN_TIERS = new Set(['cheap', 'balanced', 'premium']);
+function sanitizeTokenTierField(value, clean, warnings) {
+  if (typeof value !== 'string' || !TOKEN_TIERS.has(value)) {
+    warnings.push({ field: 'tokenTier', reason: 'tokenTier 必须为 cheap/balanced/premium 之一' });
+    return;
+  }
+  clean.tokenTier = value;
+}
+
 // --- 结果回收默认剪枝 ----------------------------------------------------------
 // 子结果默认复用宿主 `toolResultPruner.pruneContent` 预剪（纯函数、零 LLM），
 // 在 `textFrom` 之前执行，把回灌进父上下文的体积压到阈值内。
@@ -281,7 +294,7 @@ export function assertResultSchemaConsistency(schema) {
 const KNOWN_PROFILE_FIELDS = new Set([
   'id', 'name', 'description', 'persona', 'preset', 'provider', 'model',
   'reasoningEffort', 'enabled', 'maxTokens', 'maxDepth', 'toolFilter',
-  'builtin', 'deleted',
+  'tokenTier', 'builtin', 'deleted',
 ]);
 
 /**
@@ -305,6 +318,7 @@ export function sanitizeProfile(profile, options = {}) {
   if (profile === null || typeof profile !== 'object' || Array.isArray(profile)) {
     return { clean, warnings: [{ field: '(root)', reason: 'profile 不是对象' }] };
   }
+  let tokenTierProvided = false;
   for (const [key, value] of Object.entries(profile)) {
     if (!KNOWN_PROFILE_FIELDS.has(key)) {
       warnings.push({ field: key, reason: '未知字段已忽略' });
@@ -327,10 +341,27 @@ export function sanitizeProfile(profile, options = {}) {
       case 'toolFilter':
         sanitizeToolFilterField(value, clean, warnings);
         break;
+      case 'tokenTier':
+        tokenTierProvided = true;
+        sanitizeTokenTierField(value, clean, warnings);
+        break;
       default:
         clean[key] = value;
         break;
     }
   }
+  // tokenTier 缺省 'balanced'：仅当字段未被提供时回填；被提供的非法值已在
+  // sanitizeTokenTierField 剔除（clean 保持无该键），不会被此回填覆盖。
+  if (!tokenTierProvided) clean.tokenTier = 'balanced';
   return { clean, warnings };
 }
+
+// --- tokenTier 目录排序 ---------------------------------------------------------
+// tokenTier 排序权重：cheap→balanced→premium。dispatch:profiles 目录行按此
+// 升序排列（省 token 方案在前）。缺省/未知 tier 按 balanced 处理，保证旧数据
+// 与无 tokenTier 字段的 profile 落到中间档而非报错。
+export const TIER_ORDER = { cheap: 0, balanced: 1, premium: 2 };
+export function tierSortKey(tokenTier) {
+  const order = TIER_ORDER[tokenTier];
+  return order === undefined ? TIER_ORDER.balanced : order;
+}

package/lib/core/shims.mjs

@@ -1,4 +1,4 @@
-// lib/core/shims.mjs — facade. The ONLY module that imports the
+// lib/core/shims.mjs — facade. The ONLY module that imports the
 // @deepseek-ai symbols index.mjs relies on, converging the previously
 // top-level-scattered import surface. Two failure classes:
 //
@@ -23,6 +23,7 @@
 //   also verifies the value is a function before accepting it.
 
 import { randomUUID } from 'node:crypto';
+import { createRequire } from 'node:module';
 // Guard-type: static, fail-loud — no fallback. Kept as the only two
 // static @deepseek-ai imports; a missing export aborts module load with a clear
 // error BEFORE apply can run, which is the isolation this class exists for.
@@ -186,6 +187,89 @@ function readResult(child, boundary, cancelled) {
   return { output: finalAssistantOutput(own) ?? [], stopReason };
 }
 
+// --- version detection (pure probe) ------------------------------------------
+// 读取 @deepseek-ai 三包（subagent/agent/llm）的 package.json version，与
+// peerDependencies 范围（>=PEER_MIN <PEER_MAX）比对后产出中文 warnings。纯探测：
+// 只读 manifest、不 import 新符号、不触发副作用；每包独立 try/catch，失败记
+// 'unknown'。headless / 宿主裁剪部署下任一包都可能缺失，此时 warnings 非空，
+// 设置页据此在顶部渲染 amber 提示条（不阻断派发）。
+const requirePkg = createRequire(import.meta.url);
+const PEER_MIN = '0.1.0-rc.6';
+const PEER_MAX = '0.2.0';
+const PROBED_PACKAGES = ['dsh-subagent', 'dsh-agent', 'dsh-llm'];
+
+// 读单包 version（每包独立 try/catch，失败记 'unknown'）。用 createRequire 直接
+// require 包的 package.json（返回解析后的对象），免去 fs 读取与 JSON.parse。
+function readPackageVersion(pkg) {
+  try {
+    const manifest = requirePkg(`@deepseek-ai/${pkg}/package.json`);
+    return typeof manifest.version === 'string' && manifest.version !== '' ? manifest.version : 'unknown';
+  } catch {
+    return 'unknown';
+  }
+}
+
+// 极简 semver 比较：major.minor.patch + 可选 `-预发布` 段（覆盖 peerDependencies
+// 范围判断所需）。预发布 < 正式版；预发布段逐段比较，纯数字段按数值、否则按字典序
+// （`0.1.0-rc.10` > `0.1.0-rc.6`）。
+function compareSemver(a, b) {
+  const [aCore, aPre = ''] = a.split('-');
+  const [bCore, bPre = ''] = b.split('-');
+  const aNums = aCore.split('.').map((n) => Number(n));
+  const bNums = bCore.split('.').map((n) => Number(n));
+  for (let i = 0; i < 3; i++) {
+    const x = aNums[i] ?? 0;
+    const y = bNums[i] ?? 0;
+    if (x !== y) return x < y ? -1 : 1;
+  }
+  if (aPre === bPre) return 0;
+  if (aPre === '') return 1;   // 正式版 > 预发布
+  if (bPre === '') return -1;
+  const aParts = aPre.split('.');
+  const bParts = bPre.split('.');
+  const len = Math.max(aParts.length, bParts.length);
+  for (let i = 0; i < len; i++) {
+    const x = aParts[i];
+    const y = bParts[i];
+    if (x === undefined) return -1;
+    if (y === undefined) return 1;
+    const xNumeric = /^\d+$/.test(x);
+    const yNumeric = /^\d+$/.test(y);
+    if (xNumeric && yNumeric) {
+      const diff = Number(x) - Number(y);
+      if (diff !== 0) return diff;
+    } else if (xNumeric !== yNumeric) {
+      return xNumeric ? -1 : 1;   // 数字标识 < 非数字标识（semver 约定）
+    } else if (x !== y) {
+      return x < y ? -1 : 1;
+    }
+  }
+  return 0;
+}
+
+// 版本是否落在 peerDependencies 范围（>=PEER_MIN 且 <PEER_MAX）。
+function inPeerRange(version) {
+  return compareSemver(version, PEER_MIN) >= 0 && compareSemver(version, PEER_MAX) < 0;
+}
+
+// detectVersions(reader?) — 纯探测三包版本并产出 { versions, warnings }。
+// `reader` 可选注入（默认 readPackageVersion），供测试模拟「包缺失 / 版本越界」
+// 而无需删除 node_modules（与 loadSoft 的 importer 注入同一思路）。
+export function detectVersions(reader = readPackageVersion) {
+  const versions = {};
+  for (const pkg of PROBED_PACKAGES) versions[pkg] = reader(pkg);
+  const warnings = [];
+  for (const pkg of PROBED_PACKAGES) {
+    const version = versions[pkg];
+    if (version === 'unknown') {
+      warnings.push(`未检测到 @deepseek-ai/${pkg} 版本（包缺失或被宿主裁剪）——请确认其已按 peerDependencies 范围安装`);
+    } else if (!inPeerRange(version)) {
+      warnings.push(`@deepseek-ai/${pkg} 版本 ${version} 超出 peerDependencies 范围（>=${PEER_MIN} <${PEER_MAX}），派发行为可能与预期不符`);
+    }
+  }
+  return { versions, warnings };
+}
+
 // Test-only access to the local degraded implementations (package imports
 // resolve here, so the real functions win; __fallbacks lets a test exercise the
 // fail-soft path without deleting node_modules).
@@ -212,4 +296,6 @@ export {
   resolveChildAgentOptions,
   defineTool,
   readResult,
+  // ---- version probe seam (see detectVersions doc) ----
+  readPackageVersion,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-subagent-profile",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "Dispatch one-shot subtasks to derived subagents with per-task overrides (preset/model/provider/reasoningEffort/persona/tool whitelist), a runtime-derived cost guard, a subagent-profiles service, observability metadata, and a web-GUI settings page plus a dispatch tool-call card.",
   "repository": {
     "type": "git",
@@ -77,6 +77,7 @@
     "release": "node scripts/release.mjs",
     "test": "node --test \"test/**/*.test.mjs\"",
     "test:bare": "node --test test/pure.test.mjs test/input-schema.test.mjs test/catalog-integrity.test.mjs",
-    "preflight": "node scripts/preflight.mjs"
+    "preflight": "node scripts/preflight.mjs",
+    "leak-scan": "node scripts/leak-scan.mjs"
   }
 }