dsh-subagent-profile 0.4.0 → 0.5.0

package/presets/{orchestrator → orchestrator-v2}/agent.cordis.yml

@@ -1,4 +1,4 @@
-# `orchestrator` 编排者预设：主 Agent 协调模式。
+# `orchestrator-v2` 编排者预设 V2：主 Agent 协调模式 + 梁神 V2 两阶段引导。
 #
 # 与官方 `standard` 预设逐行一致，仅 persona 段改写为「主协调 Agent」身份：
 # 拆解任务、经宿主注册的 `dispatch` 工具（按场景选方案/预设/模型/推理强度）
@@ -6,8 +6,27 @@
 # 再集成结果。`dispatch` 工具本身由 dsh-subagent-profile 宿主行注册，对所有
 # 预设可见；本预设只补下面的委派工具。
 #
-# 改编自官方 `standard` 预设（仅 persona 段不同）；原始 DeepSeek 版权与
-# MIT 许可声明见开源仓库。
+# V2 改造（模仿梁神模式 V2，适配当前 DSH >= 0.1.2）：
+# - 引入两阶段引导 `./tool-bootstrap.mjs`：第一个持久工具/调用事件之前，
+#   模型只看到 Minimal 双工具（`bash` + `str_replace_editor`）与本预设的
+#   persona 段，无运行时上下文、只放行白名单消息来源；锚定（或四步兜底、
+#   或首轮结束）后升入 PTC 模式（单 `run_code` 工具）并恢复全量目录，
+#   工作区指令与技能目录延迟一步注入。压缩后回落到受控阶段
+#   （双工具 + compactionTools 核心工作集，含 dispatch/subagent 以维持委派），
+#   等待新的升态信号。
+# - tool-bootstrap.mjs 已适配 0.1.2：经 `session.snapshotEvents()` 读事件日志
+#   （旧 `session.events` 属性已移除，直接读会每轮崩 "Cannot read properties
+#   of undefined (reading 'length')"）；persona 已含 `{{cwd}}` 模板时不再追加
+#   字面工作目录行。
+# - 补 `str_replace_editor`（phase-1 编辑器）；win32 下补 `custom-bash`
+#   （Git Bash `bash` 工具）以保住 phase-1 的 `bash` 锚点——官方 tool-bash
+#   在 win32 禁用、tool-pwsh 不叫 bash，没有它 phase-1 会退化成全量目录。
+#   posix 下官方 tool-bash 本身就叫 bash，无需补行。
+# - 补 `command-goal`（/goal 人机命令，对齐当前官方 standard）；spawn 行补
+#   `modelSelectionSettings: true`。
+#
+# 改编自官方 `standard` 预设与梁神模式 V2（liangshen-v2）；原始 DeepSeek
+# 版权与 MIT 许可声明见开源仓库与随附 NOTICE。
 #
 # 本文件是 agent 平面组成：由 roster 挂载一次到 standing scope，引用它的会话
 # 经 scope 父系加入，本文件注册的工具与 prompt 段覆盖每个加入的 agent；会话
@@ -37,6 +56,35 @@
 
       边界：子 Agent 能力 ⊆ 你，派发不豁免父会话的审批要求；子 Agent 失败或超出权限时自己接手重做，或用 ask_user_question 向用户澄清。
 
+# 两阶段输入引导（同梁神 V2 的 tool-bootstrap）：在第一个持久 tool/call 事件
+# 之前，模型只看到 `bash` + `str_replace_editor` 双工具与本预设 persona 段、
+# 无运行时上下文、只放行白名单消息来源（直接用户消息 + goal 自动轮次）。
+# anchorGate 让升态保持到首个 minimal-like 推理块（四步兜底）；
+# promoteAfterFirstResponse 避免无工具首答后永久双工具，并在首轮结束时释放
+# 锚门会话。升态后目录以 PTC 模式呈现（线上单一 run_code 工具，步边界切换），
+# 工作区指令与技能目录延迟一步；bootstrapMaxTokens 封顶 phase-1 输出预算
+# （1024），升态后再剥离。压缩后回落到受控阶段（双工具 + compactionTools），
+# 直到新升态信号——本预设把 dispatch/subagent 加进 compactionTools，
+# 让压缩后的编排者仍能继续委派。
+- id: tool-bootstrap
+  name: ./tool-bootstrap.mjs
+  config:
+    shellTools: [bash]
+    commonTools: [str_replace_editor]
+    messageSources: [user, goal]
+    anchorGate: true
+    maxBootstrapSteps: 4
+    promoteAfterFirstResponse: true
+    bootstrapMaxTokens: 1024
+    compactionTools: [read, write, edit, glob, grep, todo_write, ask_user_question, dispatch, subagent]
+    deferredSources: [agent-instructions, skill-catalog]
+    deferredGraceSteps: 1
+    promotedPresentation: code
+    # 升态后以一次性非指令式提示替代 AGENTS.md 全文注入（梁神 V2 保留的
+    # issue #388 设定），知识经 read / skill_load 可达。设 false 恢复全文注入。
+    instructionHint: true
+
+# 工作区指令在 phase 1 被 tool-bootstrap 隔离，升态后延迟一步注入并保持更新。
 - id: agent-instructions
   name: '@deepseek-ai/dsh-agent-instructions'
   config:
@@ -57,8 +105,25 @@
   name: '@deepseek-ai/dsh-tool-pwsh'
   disabled: !!js process.platform !== 'win32'
 
+# win32 专用 `bash` 工具（custom-bash.mjs，同梁神 V2）：官方 tool-bash 在
+# win32 禁用、tool-pwsh 又不叫 bash，phase-1 的 Minimal 锚点（shellTools:
+# [bash]）会找不到 shell 而退化成全量目录。此工具经跨平台 subprocess 缝隙
+# 执行 Git Bash（`bash -c`），保住锚点；posix 下官方 tool-bash 已提供
+# 同名工具，此行走禁用。非零退出上报不抛；调用间状态不持久；Windows 无
+# OS 沙箱限制。`bashPath` 可选（缺省按 Git 安装根推断）。
+- id: custom-bash
+  name: ./custom-bash.mjs
+  disabled: !!js process.platform !== 'win32'
+
 # ── filesystem ──────────────────────────────────────────────────────────────
 
+# Phase-1 编辑器（同梁神 V2）：顶层直排，复用宿主沙箱 ctx.fs 而非裸本地
+# 文件系统，schema 与官方 Minimal `str_replace_editor` 一致。
+- id: str-replace-editor
+  name: '@deepseek-ai/dsh-tool-str-replace-editor'
+  config:
+    maxOutputChars: 16000
+
 # 两者都注册进宿主 tools 注册表且不提供服务，无需 realm；fs 服务与其策略留在宿主。
 - id: tool-fs
   name: '@deepseek-ai/dsh-tool-fs'
@@ -90,10 +155,15 @@
 
 # ── goals ───────────────────────────────────────────────────────────────────
 
-# 只放模型可见的工具。goal 服务、会话驱动与 /goal 命令留在宿主平面：
-# Gateway 以 Remote endpoint 服务 goal 域，接收方来自生成描述符，条目本地
-# realm 会隐藏它。注册表本就按会话键控，一个宿主实例服务所有会话；预设
-# 只决定其 agent 能否调用 goal 工具。
+# goal 服务与会话驱动留在宿主平面，Gateway 在那里解析它们。人机命令与
+# 模型可见工具注册进本预设的 scope 层。
+- id: command-goal
+  name: '@deepseek-ai/dsh-command-goal'
+
+# 只放模型可见的工具。goal 服务与会话驱动留在宿主平面：Gateway 以 Remote
+# endpoint 服务 goal 域，接收方来自生成描述符，条目本地 realm 会隐藏它。
+# 注册表本就按会话键控，一个宿主实例服务所有会话；预设只决定其 agent
+# 能否调用 goal 工具。
 - id: tool-goal
   name: '@deepseek-ai/dsh-tool-goal'
 
@@ -182,6 +252,7 @@
       config:
         provider: spawn
         toolName: subagent
+        modelSelectionSettings: true
         backgroundMode: continuable
 
     - id: tool-subagent-fork

package/presets/orchestrator-v2/custom-bash.mjs

@@ -0,0 +1,213 @@
+/**
+ * custom-bash — a Windows-capable `bash` tool for the liangshen preset. It
+ * registers under the SAME name (`bash`) as the persistent shell so the
+ * phase-1 Minimal anchor (bash + str_replace_editor) holds on every platform,
+ * but executes through `ctx.subprocess.spawn` instead of a PTY.
+ *
+ * WHY: DSH's PTY backend is linux/darwin-only — subprocess-local throws
+ * "terminal inspection is unsupported on platform win32", so the
+ * persistent-shell group (dsh-terminal + dsh-terminal-bash +
+ * dsh-tool-bash-persistent) cannot spawn on Windows. agent.cordis.yml disables
+ * that group on win32 and enables this tool instead; both platforms end up
+ * with exactly one `bash` tool and the byte-exact schema anchor is kept.
+ *
+ * Executable resolution (config `bashPath`, no hardcoded install path):
+ * an explicit non-empty `bashPath` wins unconditionally. Unset, the Git Bash
+ * executable is INFERRED in probe order:
+ *  1. the `git` executable on PATH — its install root carries `bin\bash.exe`
+ *     one level up from `cmd\`, beside `bin\`, or two levels up from
+ *     `mingw64\bin\` (the standard installer, choco, and winget all resolve
+ *     here);
+ *  2. the well-known Git-for-Windows roots derived from environment variables
+ *     (ProgramFiles, ProgramFiles(x86), LOCALAPPDATA\Programs\Git, scoop's
+ *     ~\scoop\apps\git\current junction);
+ *  3. plain `bash` through `ctx.subprocess.resolveExecutable` (PATH lookup —
+ *     last resort; on Windows that may pick the WSL shim, which is still true
+ *     bash even though paths shift to /mnt/…).
+ *
+ * If NOTHING resolves the tool fails with an actionable error — it never
+ * silently executes under pwsh/cmd, which are different command languages.
+ *
+ * Semantics mirror the official bash tool: `bash -c <command>` in a fresh
+ * process, bounded output, non-zero exit reported not thrown. No sandbox
+ * confinement on Windows (the sandbox backend is linux-only); the description
+ * says so.
+ *
+ * Ported from xiaobright/dsh-anchored-standard (MIT) — see NOTICE.
+ */
+
+import { access } from 'node:fs/promises'
+import { dirname, join } from 'node:path'
+
+/** Cordis plugin name used by loader diagnostics. */
+export const name = 'custom-bash'
+
+/** The subprocess and tools services must exist before this tool can register. */
+export const inject = ['subprocess', 'tools']
+
+const DEFAULT_TIMEOUT_MS = 120000
+const DEFAULT_MAX_OUTPUT_BYTES = 64000
+
+/**
+ * Git Bash candidate paths, in probe order (see the header): the `git`
+ * executable's install root first, then the well-known env-derived roots.
+ * Exported for tests; pure — existence probing happens at the call site.
+ */
+export function bashCandidates(env, gitExe) {
+  const candidates = []
+  // git at <root>\cmd\git.exe (installer/scoop) or <root>\bin\git.exe →
+  // <root>\bin\bash.exe; <root>\mingw64\bin\git.exe (portable) → two up.
+  // A bare relative name means `git` did not actually resolve to a path.
+  if (typeof gitExe === 'string' && /[/\\]/.test(gitExe)) {
+    const dir = dirname(gitExe)
+    const root = dirname(dir)
+    candidates.push(
+      join(root, 'bin', 'bash.exe'),
+      join(dir, 'bash.exe'),
+      join(dirname(root), 'bin', 'bash.exe'),
+    )
+  }
+  if (env.ProgramFiles) candidates.push(join(env.ProgramFiles, 'Git', 'bin', 'bash.exe'))
+  if (env['ProgramFiles(x86)']) candidates.push(join(env['ProgramFiles(x86)'], 'Git', 'bin', 'bash.exe'))
+  if (env.LOCALAPPDATA) candidates.push(join(env.LOCALAPPDATA, 'Programs', 'Git', 'bin', 'bash.exe'))
+  if (env.USERPROFILE) candidates.push(join(env.USERPROFILE, 'scoop', 'apps', 'git', 'current', 'bin', 'bash.exe'))
+  // Layouts overlap (a `bin` git.exe derives the same bash twice) — probe
+  // order survives the dedupe, insertion order is preserved.
+  return [...new Set(candidates)]
+}
+
+/** Tool parameter schema for the model-facing command. */
+const commandSchema = {
+  type: 'object',
+  properties: {
+    command: {
+      type: 'string',
+      description: 'The bash command to execute (`bash -c` string domain).',
+    },
+    workdir: {
+      type: 'string',
+      description: 'Optional working directory; defaults to the session cwd.',
+    },
+  },
+  required: ['command'],
+  additionalProperties: false,
+}
+
+/** Register the model-facing `bash` tool. */
+export function apply(ctx, config) {
+  const explicitBashPath = typeof config?.bashPath === 'string' && config.bashPath.length > 0 ? config.bashPath : undefined
+  const timeoutMs = Number.isSafeInteger(config?.timeoutMs) && config.timeoutMs > 0 ? config.timeoutMs : DEFAULT_TIMEOUT_MS
+  const maxOutputBytes = Number.isSafeInteger(config?.maxOutputBytes) && config.maxOutputBytes > 0 ? config.maxOutputBytes : DEFAULT_MAX_OUTPUT_BYTES
+
+  // The inferred executable is memoized per plugin instance: candidate probing
+  // walks the filesystem, and the answer cannot change within a mount. A
+  // failed inference is NOT memoized — the plain `bash` fallback resolves
+  // fresh on every execute until some probe succeeds.
+  let inferredShell
+  const exists = (path) => access(path).then(() => true, () => false)
+  const resolveShell = async (signal) => {
+    if (explicitBashPath !== undefined) {
+      // A misconfigured explicit path must fail as itself, not as a
+      // discovery miss — the raw resolution error says which path failed.
+      return ctx.subprocess.resolveExecutable(explicitBashPath, undefined, signal)
+    }
+    if (inferredShell !== undefined) {
+      return ctx.subprocess.resolveExecutable(inferredShell, undefined, signal)
+    }
+    let gitExe
+    try {
+      gitExe = await ctx.subprocess.resolveExecutable('git', undefined, signal)
+    } catch {
+      // git unresolvable → the env-derived candidates below still apply
+    }
+    for (const candidate of bashCandidates(process.env, gitExe)) {
+      if (!(await exists(candidate))) continue
+      try {
+        inferredShell = await ctx.subprocess.resolveExecutable(candidate, undefined, signal)
+        return inferredShell
+      } catch {
+        // Exists but unresolvable (EPERM, a broken scoop junction): keep
+        // probing — one bad root must not block the rest of the chain, and
+        // nothing is memoized so later executes can still find a good one.
+        continue
+      }
+    }
+    try {
+      return await ctx.subprocess.resolveExecutable('bash', undefined, signal)
+    } catch (error) {
+      // Total discovery failure (no Git Bash root, no env root, no bash on
+      // PATH): name the remedies instead of leaking a raw ENOENT. Never
+      // fall back to pwsh/cmd here — the schema promises `bash -c`
+      // semantics; a different shell would silently break every command.
+      throw new Error(`bash executable not found — install Git for Windows, expose a bash on PATH, or set the custom-bash \`bashPath\` config (${String((error && error.message) || error)})`)
+    }
+  }
+
+  ctx.tools.register({
+    name: 'bash',
+    description: [
+      'Run commands in a bash shell (Git Bash on Windows)',
+      '* When invoking this tool, the contents of the "command" parameter does NOT need to be XML-escaped.',
+      "* You don't have access to the internet via this tool.",
+      '* You do have access to a mirror of common linux and python packages via apt and pip.',
+      '* State does NOT persist across command calls: each call runs in a fresh shell.',
+      "* To inspect a particular line range of a file, e.g. lines 10-25, try 'sed -n 10,25p /path/to/the/file'.",
+      '* Please avoid commands that may produce a very large amount of output.',
+      '* NOTE: runs without OS sandbox confinement on Windows (no landlock); treat output as untrusted.',
+    ].join('\n'),
+    parameters: commandSchema,
+    output: {
+      schema: {
+        type: 'object',
+        additionalProperties: false,
+        properties: {
+          text: { type: 'string' },
+        },
+        required: ['text'],
+      },
+      render: (_args, value) => [{ type: 'text', text: value.text }],
+    },
+    async execute(args, exec) {
+      const shell = await resolveShell(exec?.signal)
+      const workdir = typeof args.workdir === 'string' && args.workdir.length > 0
+        ? args.workdir
+        : exec?.agent?.session?.header?.cwd
+      const signal = exec?.signal
+      const handle = ctx.subprocess.spawn({
+        argv: [shell, '-c', args.command],
+        ...workdir !== undefined ? { cwd: workdir } : {},
+        stdio: {
+          stdin: 'ignore',
+          stdout: { maxBytes: maxOutputBytes },
+          stderr: { maxBytes: maxOutputBytes },
+        },
+        ...signal !== undefined ? { signal } : {},
+        graceMs: 3000,
+      })
+      let outcome
+      try {
+        outcome = await handle.done
+      } catch (error) {
+        // A spawn-level failure (bad executable, EPERM) surfaces as a throw,
+        // which the runtime turns into an isError result.
+        throw new Error(`bash spawn failed: ${String(error)}`)
+      }
+      let stdout = ''
+      let stderr = ''
+      try {
+        stdout = handle.collected.stdout.readFrom(0).text
+        stderr = handle.collected.stderr.readFrom(0).text
+      } catch {
+        // Collected readers may be unavailable on some backends; tolerate.
+      }
+      const text = [stdout, stderr].filter((part) => part.length > 0).join('\n')
+      const tail = text.length > 0 ? text : `exit code: ${outcome.exitCode} (no output)`
+      if (outcome.exitCode !== 0) {
+        // Non-zero exit is a reported failure, not a throw: the model sees the
+        // command output plus the exit code.
+        throw new Error(tail)
+      }
+      return { text: tail }
+    },
+  })
+}

package/presets/orchestrator-v2/preset.yml

@@ -0,0 +1,2 @@
+name: 编排者模式 V2
+description: 编排者模式（orchestrator）的梁神 V2 改造版：第一阶段只暴露 Minimal 双工具（bash + str_replace_editor）与编排者 persona 锚定轨迹，稳定后升入 PTC 模式恢复全量编排能力（dispatch / subagent / workflow / ralph）。已适配当前 DSH 0.1.2+。