odai-dsh-agent 0.0.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 orziz
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,86 @@
+# odai dsh agent
+
+`odai-dsh-agent` installs a selectable, session-scoped Odai Agent preset for DeepSeek Harness (`dsh`). It is independent from the profile-wide `odai-dsh-plugin`: installing this package does not edit any DSH profile or activate a global bundle.
+
+The installed preset is self-contained:
+
+```text
+$DSH_HOME/.agent-presets/odai/
+  agent.cordis.yml
+  preset.yml
+  runtime/*.mjs
+  skills/odai/**
+  .odai-agent.json
+```
+
+The composition is pinned to the standard agent surface from `@deepseek-ai/dsh@0.1.0-rc.6`, then adds the scoped Odai runtime in default `auto` mode. Host-owned persistence, sandbox, approval, registries, and base controller selection remain in the selected DSH profile. Ordinary requests stay on that controller. A complete contextual high-impact decision gap upgrades the same turn only when a planner mapping exists; the controller's durable `request/header` proves the actual route. Explicit independent planning/review requests still start a verified child when their mappings exist. `execute` remains an explicit all-delegation comparison mode. `observe` changes no model and starts no child; it injects a local evidence-and-decision protocol and makes an unresolved high-impact turn read-only.
+
+## Install
+
+With DSH already installed, run the single Agent package command below. The package already contains the canonical skill and shared runtime; it does not require the Plugin or a separate skill installation:
+
+```sh
+npx odai-dsh-agent install
+```
+
+The installer checks `dsh -V` and currently requires exactly `0.1.0-rc.6`; a preset built from one developer-preview composition is not silently installed into another version.
+
+`DSH_HOME` is honored. An explicit location can be supplied without changing the environment:
+
+```sh
+npx odai-dsh-agent install --dsh-home /path/to/dsh-home
+```
+
+Open a new DSH session and select `Odai` from the Agent preset picker. Existing sessions retain the preset they were composed with.
+
+In `dsh@0.1.0-rc.6`, the one-shot `--profile headless` driver creates a global agent directly and neither mounts nor accepts a session Agent preset. Automated Agent runs must create a Web session with `agentPreset: odai`; use the profile-wide Plugin for one-shot headless tasks.
+
+The installer copies through a mode-tightened staging directory and atomically publishes the preset. Updates verify every previously managed file first, refuse to overwrite local edits, and always change the composition generation key so new sessions in a running DSH process do not reuse stale runtime code.
+
+DSH classifies this as a `trust: user` preset. User presets have the same privileges as shell access, so install only reviewed package versions; the installer repeats this trust notice in both plain and JSON output.
+
+## Responsibility models
+
+The Agent ships no planner, executor, or reviewer model mapping. It stays quiet when an unconfigured responsibility is not needed. If a real task gap needs one, Odai says which responsibility is missing, confirms that no route ran, and asks for the provider, model, and optional reasoning effort in natural language. For example:
+
+```text
+规划用 provider-x/model-plan，推理档 high。
+执行模型设为 provider-x/model-y。
+验收改用 provider-z/model-review，推理档 max。
+```
+
+The controller calls `odai_routing_config` to persist that explicit choice. The user does not edit Agent files, YAML, or JSON and does not add trigger terms to later tasks. Mappings live in `$DSH_HOME/odai/routing.json`, outside the managed preset, so installer updates do not report them as drift. Changes apply from the next user turn. If reasoning effort is omitted, the target provider/model uses its own default rather than inheriting the source controller's setting. Plugin and Agent read the same store when both are deliberately present.
+
+Planner, executor, and reviewer are independent optional responsibilities. If any needed one has no mapping, high-impact work fails closed and remains read-only; lower-impact work continues only where it does not depend on the missing independent responsibility. Odai never chooses a model on the user's behalf.
+
+## Status and uninstall
+
+```sh
+npx odai-dsh-agent status
+npx odai-dsh-agent status --json
+npx odai-dsh-agent uninstall
+```
+
+`status` reports `absent`, `installed`, or `drifted`. Update and uninstall fail closed when managed files were changed or unmanaged files were added. Uninstall also refuses while `agent-presets.default` still names `odai`; select another default first so the next session cannot fail on a missing preset.
+
+## Plugin versus Agent
+
+Use only the surface that matches the desired scope:
+
+- `odai-dsh-plugin`: profile-wide governance for every preset in that profile.
+- `odai-dsh-agent`: selectable Odai governance for only sessions using this preset.
+- both: supported only for a deliberate combination of profile-wide and Agent-scoped behavior; normally redundant, so it is not the default recommendation.
+
+When both are deliberate, durable tool and route evidence is deduplicated and denials remain monotonic. Neither package installs or changes the provider-neutral `odai-cli`.
+
+## Development
+
+`dsh/runtime/` and `skills/odai/` remain the only editable sources. `npm pack` generates the preset's `runtime/` and `skills/` directories and removes them immediately afterward:
+
+```sh
+npm --prefix dsh/agent test
+npm --prefix dsh/agent run verify:dsh
+npm --prefix dsh/agent run pack:dry-run
+```
+
+The DSH verification uses a temporary home and one isolated Web process. It creates standard and Odai sessions, proves the canonical prompt appears only for Odai, dispatches `odai_routing_config` through the live Odai session and checks its persisted mapping, and proves the child write guard does not leak into the standard preset.

package/bin/odai-dsh-agent.mjs

@@ -0,0 +1,87 @@
+#!/usr/bin/env node
+
+import { execFileSync } from "node:child_process";
+
+import {
+  inspectAgentInstallation,
+  installAgentPreset,
+  SUPPORTED_DSH_VERSION,
+  uninstallAgentPreset,
+} from "../src/installer.mjs";
+
+const HELP = `Usage: odai-dsh-agent <command> [options]
+
+Commands:
+  install       Install or update the managed Odai preset
+  status        Inspect the managed Odai preset
+  uninstall     Remove the preset when its managed files are unchanged
+
+Options:
+  --dsh-home <path>  Override DSH_HOME
+  --json             Print JSON
+  -h, --help         Show this help
+`;
+
+try {
+  const args = parseArgs(process.argv.slice(2));
+  if (args.help) {
+    process.stdout.write(HELP);
+  } else if (args.command === "install") {
+    assertDshVersion();
+    print(await installAgentPreset({ dshHome: args.dshHome }), args.json);
+  } else if (args.command === "status") {
+    const result = await inspectAgentInstallation({ dshHome: args.dshHome });
+    print(result, args.json);
+    if (result.status === "drifted") process.exitCode = 2;
+  } else if (args.command === "uninstall") {
+    print(await uninstallAgentPreset({ dshHome: args.dshHome }), args.json);
+  } else {
+    throw new Error("a command is required\n\n" + HELP);
+  }
+} catch (error) {
+  process.stderr.write(`odai-dsh-agent: ${error instanceof Error ? error.message : String(error)}\n`);
+  process.exitCode = 1;
+}
+
+function assertDshVersion() {
+  const dsh = process.env.DSH_BIN ?? "dsh";
+  let actual;
+  try {
+    actual = execFileSync(dsh, ["-V"], { encoding: "utf8" }).trim();
+  } catch (error) {
+    throw new Error(`cannot run ${dsh} -V; install DSH ${SUPPORTED_DSH_VERSION} before installing the preset`);
+  }
+  if (actual !== SUPPORTED_DSH_VERSION) {
+    throw new Error(`unsupported DSH version ${actual || "<empty>"}; expected ${SUPPORTED_DSH_VERSION}`);
+  }
+}
+
+function parseArgs(argv) {
+  const parsed = { command: undefined, dshHome: undefined, json: false, help: false };
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index];
+    if (arg === "-h" || arg === "--help") parsed.help = true;
+    else if (arg === "--json") parsed.json = true;
+    else if (arg === "--dsh-home") parsed.dshHome = argv[++index];
+    else if (!parsed.command && ["install", "status", "uninstall"].includes(arg)) parsed.command = arg;
+    else throw new Error(`unknown argument: ${arg}`);
+  }
+  if (parsed.dshHome !== undefined && (typeof parsed.dshHome !== "string" || parsed.dshHome.trim() === "")) {
+    throw new Error("--dsh-home requires a non-empty path");
+  }
+  return parsed;
+}
+
+function print(result, json) {
+  if (json) {
+    process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+    return;
+  }
+  if (result.status) {
+    process.stdout.write(`${result.status}: ${result.target}\n`);
+    for (const issue of result.issues ?? []) process.stdout.write(`- ${issue}\n`);
+    return;
+  }
+  process.stdout.write(`${result.operation}: ${result.target}\n`);
+  if (result.security) process.stdout.write(`security: ${result.security}\n`);
+}

package/package.json

@@ -0,0 +1,68 @@
+{
+  "name": "odai-dsh-agent",
+  "version": "0.0.1",
+  "description": "Self-contained Odai agent preset for DeepSeek Harness.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/orziz/odai.git",
+    "directory": "dsh/agent"
+  },
+  "homepage": "https://github.com/orziz/odai#readme",
+  "bugs": {
+    "url": "https://github.com/orziz/odai/issues"
+  },
+  "type": "module",
+  "main": "./src/installer.mjs",
+  "exports": {
+    ".": "./src/installer.mjs",
+    "./package.json": "./package.json"
+  },
+  "bin": {
+    "odai-dsh-agent": "./bin/odai-dsh-agent.mjs"
+  },
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org/",
+    "access": "public"
+  },
+  "files": [
+    "bin",
+    "src",
+    "scripts/verify-agent-load.mjs",
+    "preset",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "check": "find bin src scripts tests -name '*.mjs' -print0 | xargs -0 -n1 node --check",
+    "prepare:artifact": "node ../../scripts/package-odai-artifact.mjs prepare --skill-root preset/odai/skills --runtime-root preset/odai/runtime",
+    "clean:artifact": "node ../../scripts/package-odai-artifact.mjs clean --skill-root preset/odai/skills --runtime-root preset/odai/runtime",
+    "prepare": "npm run prepare:artifact",
+    "prepack": "node ../../scripts/validate-odai-skill.mjs",
+    "postpack": "npm run clean:artifact",
+    "pack:dry-run": "node ../../scripts/run-package-pack.mjs --clean preset/odai/runtime --clean preset/odai/skills -- --dry-run",
+    "test": "node --test ./tests/*.test.mjs",
+    "verify:dsh": "node ./scripts/verify-agent-load.mjs"
+  },
+  "dependencies": {
+    "yaml": "^2.8.1"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/dsh": "0.1.0-rc.6"
+  },
+  "peerDependenciesMeta": {
+    "@deepseek-ai/dsh": {
+      "optional": true
+    }
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "keywords": [
+    "agent",
+    "deepseek-harness",
+    "dsh",
+    "odai",
+    "preset"
+  ]
+}

package/preset/odai/agent.cordis.yml

@@ -0,0 +1,260 @@
+# The `standard` agent preset: the full coding agent, mounted once per process.
+#
+# This file is an AGENT-PLANE composition. The roster mounts it ONCE under a
+# standing scope; every session naming it joins by scope parentage, so the
+# tools and prompt sections registered here cover each joined agent while a
+# session's own state stays keyed per Session/Agent inside the plugins. The
+# host composition (`base.cordis.yml` + `web.cordis.yml`) keeps everything a
+# preset must not own: the registries themselves, the sandbox and approval
+# stack, persistence, and the model route.
+#
+# A service row here MUST sit inside a group carrying an `isolate` realm.
+# Without one it publishes into the root realm, where it is process-global —
+# another preset publishing the same name collides, and a host reader would
+# resolve one preset's instance for every session; `dsh-agent-presets` rejects
+# that at mount. `true` means an entry-local realm: this standing mount's own
+# private instance, apart from every other preset's. (A shared label does NOT
+# pool instances — `provide()` throws on the second registration under the
+# same realm symbol; labels join REALMS, and are not what this file needs.)
+
+# ── identity ────────────────────────────────────────────────────────────────
+
+# The preset's own model-neutral persona shadows the deployment default. Auto
+# routing can upgrade after prompt assembly; `{{cwd}}` remains workspace-local.
+- id: persona
+  name: '@deepseek-ai/dsh-persona'
+  config:
+    text: >-
+      You are Odai, a coding agent. Your working directory is {{cwd}}.
+
+- id: agent-instructions
+  name: '@deepseek-ai/dsh-agent-instructions'
+  config:
+    maxBytes: 65536
+
+# ── shell ───────────────────────────────────────────────────────────────────
+
+# `shell-env` stays in the HOST composition: `apps/cli/src/web.ts` injects it to
+# publish `DSH_WEB_URL`/`DSH_WEB_MODE`, and a host row that injects a service is
+# the criterion for host-plane ownership — injection resolves before any session
+# exists, so there is no agent to key by. Behind a preset realm those variables
+# never reached the model's shell at all. Both shell tools consume the host
+# registry from here; their executors (`bash-sandbox`/`pwsh-sandbox`) are
+# host-plane too.
+- id: tool-bash
+  name: '@deepseek-ai/dsh-tool-bash'
+  disabled: !!js process.platform === 'win32'
+
+- id: tool-pwsh
+  name: '@deepseek-ai/dsh-tool-pwsh'
+  disabled: !!js process.platform !== 'win32'
+
+# ── filesystem ──────────────────────────────────────────────────────────────
+
+# Both register into the host `tools` registry and provide nothing, so
+# they need no realm. The `fs` service and its policy stay in the host.
+- id: tool-fs
+  name: '@deepseek-ai/dsh-tool-fs'
+
+- id: tool-fs-search
+  name: '@deepseek-ai/dsh-tool-fs-search'
+  config:
+    sampleOverCapGlobResults: false
+
+# ── background jobs ────────────────────────────────────────────────────────
+
+# Only the model-facing controls. The task REGISTRY stays on the host plane:
+# its producers sit outside any realm this file could put it in — `tool-bash`
+# above resolves it with `ctx.get`, and an entry-local realm here is invisible
+# to every sibling row, so `run_in_background` would answer "background jobs
+# unavailable" while these controls sat in the catalog. The registry is keyed by
+# owning agent anyway, so one host instance serves every session. What a preset
+# chooses is whether its agent can collect and stop background work at all.
+- id: tool-jobs
+  name: '@deepseek-ai/dsh-tool-jobs'
+
+# ── skills ──────────────────────────────────────────────────────────────────
+
+# The skill REGISTRY lives in the host composition and is layered per scope:
+# these rows register into THIS preset's layer of it, so they need no realm.
+# `skill-filesystem` contributes local-root discovery for agents on this preset, and
+# `tool-skill` gives them the catalog and loader; the merged catalog also
+# carries whatever the deployment registered globally (repository plugins).
+- id: skill-filesystem
+  name: '@deepseek-ai/dsh-skill-filesystem'
+
+- id: tool-skill
+  name: '@deepseek-ai/dsh-tool-skill'
+
+# ── goals ───────────────────────────────────────────────────────────────────
+
+# Only the model-facing tool. The goal SERVICE, its session driver, and the
+# `/goal` command stay on the host plane: the Gateway serves the goal domain as
+# Remote endpoints whose receiver comes from a generated descriptor, so it
+# resolves `goals` on the host and an entry-local realm here would hide it. The
+# registry is keyed by session anyway, so one host instance serves every
+# session. What a preset chooses is whether its agent can call the goal tool.
+- id: tool-goal
+  name: '@deepseek-ai/dsh-tool-goal'
+
+# ── plan mode ───────────────────────────────────────────────────────────────
+
+# Plan state is per-agent by nature, so an entry-local realm is not a
+# workaround here — it is the correct lifetime.
+- id: planning
+  name: cordis:group
+  group: true
+  isolate:
+    planMode: true
+  config:
+    - id: plan-mode
+      name: '@deepseek-ai/dsh-plan-mode'
+      config:
+        section: |
+              You are in plan mode. Stay in plan mode until exit_plan_mode succeeds or the user switches the session mode. Imperative language to implement changes means plan the implementation, not execute it. A user's conversational agreement — including an answer confirming something you asked — approves nothing and does not end plan mode; fold the confirmed decision into the plan and submit it through exit_plan_mode.
+
+              Explore first. Use non-mutating reads, searches, static analysis, and checks to ground the plan in the actual repository. Do not edit or write files, change configuration, run formatters or code generation that rewrites tracked files, commit, or otherwise carry out the plan. Prefer existing functions and patterns over new machinery.
+
+              The tool catalog stays the same across modes for request-cache stability. These plan-mode rules override any later tool description or guidance that suggests using mutation tools; those tools remain listed to keep the tool catalog unchanged. Do not use todo_write to track this planning phase: it tracks implementation after an approved plan, while the plan itself belongs in exit_plan_mode.
+
+              Resolve discoverable facts by inspection. Use ask_user_question only for user-owned choices or material ambiguity that inspection cannot answer. Do not ask the user where code lives or how current behavior works when you can find out.
+
+              Make the plan decision-complete: state the goal and success criteria; group implementation changes by subsystem; identify public API, schema, and data-flow changes; cover edge cases, failure modes, tests, acceptance criteria, and explicit assumptions. Keep it concise enough to review but detailed enough that another engineer can implement it without making design decisions.
+
+              When ready, call exit_plan_mode with the complete plan markdown, starting with a # title. Make exit_plan_mode the only and final tool call in that assistant response: it presents the plan for approval, and implementation begins only in a later step after approval. Do not paste the final plan as a plain reply or ask "should I proceed?" through prose or ask_user_question. If review rejects it, incorporate the feedback and present again. If the review channel is unavailable or aborted, stay in plan mode and ask the user to switch modes manually; do not proceed with implementation.
+
+# ── compaction ──────────────────────────────────────────────────────────────
+
+# `compaction-basic` reads `toolResultPrune` through `ctx.get`, so the pruner must
+# share this realm rather than sit outside it.
+#
+# `tokenMeter` is deliberately NOT in this realm: the meter stays on the HOST
+# plane, and the rows here resolve that one instance. It takes no configuration,
+# keys every fold by Session, and owns the context-meter projection units the
+# browser reads for every session — behind a realm those units would come and go
+# with whichever presets happen to be mounted. What a preset chooses is whether
+# its agent compacts at all, which is `compaction-basic` below.
+- id: compaction
+  name: cordis:group
+  group: true
+  isolate:
+    compaction: true
+    toolResultPruner: true
+  config:
+    - id: compaction-basic
+      name: '@deepseek-ai/dsh-compaction-basic'
+
+    - id: command-compact
+      name: '@deepseek-ai/dsh-command-compact'
+
+    - id: tool-result-pruner
+      name: '@deepseek-ai/dsh-compaction-tool-result-pruner'
+      config:
+        thresholdChars: 8192
+        headChars: 4096
+        tailChars: 1024
+
+# ── delegation and workflows ────────────────────────────────────────────────
+
+# The `subagents` registry and its spawn/fork backends live in the HOST
+# composition: the registry is a process singleton whose cross-session queries
+# the api-proxy serves to the browser, and a provider name may only be
+# registered once. This preset contributes the delegation TOOLS, which resolve
+# that host registry.
+#
+# `workflows` is different — nothing outside an agent reads it — so every row
+# that reaches it shares one entry-local realm here, and a consumer left
+# outside would resolve a host registry this preset does not populate.
+#
+# `tool-subagent-report` is host-plane for the same reason as the registry,
+# not because a preset may not want it: it registers a CONTINUABLE SETUP on
+# that singleton rather than a tool this agent calls, and the setup list is
+# not scope-aware — one copy per mounted preset means every child gets
+# `report` registered once per live session, which throws on the second.
+- id: delegation
+  name: cordis:group
+  group: true
+  isolate:
+    workflowEngine: true
+  config:
+    - id: tool-subagent-control
+      name: '@deepseek-ai/dsh-tool-subagent-control'
+
+    - id: tool-subagent-list-agents
+      name: '@deepseek-ai/dsh-tool-subagent-control/list-agents'
+
+    - id: tool-subagent
+      name: '@deepseek-ai/dsh-tool-subagent'
+      config:
+        provider: spawn
+        toolName: subagent
+        backgroundMode: continuable
+
+    - id: tool-subagent-fork
+      name: '@deepseek-ai/dsh-tool-subagent'
+      config:
+        provider: fork
+        toolName: subagent_fork
+        backgroundMode: continuable
+
+    # Product providers are host-plane singletons. Copy this preset, then
+    # remove `disabled` from either ordinary tool row to expose that product
+    # only to agents composed from the copy.
+    - id: tool-subagent-codex
+      name: '@deepseek-ai/dsh-tool-subagent'
+      disabled: true
+      config:
+        provider: codex
+        toolName: subagent_codex
+        enableRunInBackground: false
+        maxDepth: provider-managed
+
+    - id: tool-subagent-claude-code
+      name: '@deepseek-ai/dsh-tool-subagent'
+      disabled: true
+      config:
+        provider: claude-code
+        toolName: subagent_claude_code
+        enableRunInBackground: false
+        maxDepth: provider-managed
+
+    - id: workflow-worker-thread
+      name: '@deepseek-ai/dsh-workflow-worker-thread'
+      config:
+        provider: spawn
+
+    - id: tool-workflow
+      name: '@deepseek-ai/dsh-tool-workflow'
+
+    - id: tool-ralph
+      name: '@deepseek-ai/dsh-tool-ralph'
+      config:
+        subagentProvider: spawn
+        maxRounds: 64
+
+# ── remaining model-facing rows ─────────────────────────────────────────────
+
+- id: tool-ask-user
+  name: '@deepseek-ai/dsh-tool-ask-user'
+
+- id: tool-todo
+  name: '@deepseek-ai/dsh-tool-todo'
+  config:
+    allowParallelInProgress: true
+
+# The `web` service and its search provider stay in the host composition; only
+# the model-facing tool is per-session.
+- id: tool-web
+  name: '@deepseek-ai/dsh-tool-web'
+  config:
+    fetch: false
+    searchTimeoutMs: 60000
+
+# Odai contributes scoped prompt, guard, routing, user-owned responsibility
+# mappings, and evidence listeners. Base controller selection stays host-owned.
+- id: odai-governance
+  name: ./runtime/index.mjs
+  config:
+    routing:
+      mode: auto
+      provider: spawn

package/preset/odai/preset.yml

@@ -0,0 +1,3 @@
+name: Odai
+order: 40
+description: DSH coding agent with scoped odai governance, evidence, and automatic routing.

package/preset/odai/runtime/governance.mjs

@@ -0,0 +1,120 @@
+export const DEFAULT_CHILD_DENIED_TOOLS = Object.freeze([
+  "write",
+  "edit",
+  "str_replace_editor",
+  "bash",
+  "pwsh",
+  "ask_user_question",
+  "subagent",
+  "subagent_fork",
+  "subagent_codex",
+  "subagent_claude_code",
+  "send_message",
+  "interrupt_agent",
+  "list_agents",
+  "workflow",
+  "ralph",
+  "job_output",
+  "job_list",
+  "job_kill",
+]);
+
+export const DEFAULT_PROTECTED_CONTROLLER_ALLOWED_TOOLS = Object.freeze([
+  "read",
+  "read_image",
+  "glob",
+  "grep",
+  "web_search",
+  "web_fetch",
+  "ask_user_question",
+  "get_goal",
+  "list_agents",
+  "job_output",
+  "job_list",
+  "skill",
+]);
+
+export function isSubagent(agent) {
+  const header = agent?.session?.header;
+  return header?.origin === "subagent"
+    || (Number.isSafeInteger(header?.delegationDepth) && header.delegationDepth > 0);
+}
+
+export function createChildToolGuard(options = {}) {
+  const denied = new Set([
+    ...DEFAULT_CHILD_DENIED_TOOLS,
+    ...(Array.isArray(options.additionalDeniedTools) ? options.additionalDeniedTools : []),
+  ]);
+  const onDenied = typeof options.onDenied === "function" ? options.onDenied : () => {};
+
+  return (execution) => {
+    if (!isSubagent(execution?.agent)) return undefined;
+    if (!denied.has(execution?.name)) return undefined;
+
+    const reason = `ODAI_SUBAGENT_BOUNDARY: child agents may not execute ${execution.name}; return evidence to the controller instead.`;
+    onDenied(execution, reason);
+    return reason;
+  };
+}
+
+export function activeRouteProtection(agent) {
+  if (isSubagent(agent)) return undefined;
+  const events = agent?.session?.events;
+  if (!Array.isArray(events)) return undefined;
+
+  let currentTurn;
+  for (let index = events.length - 1; index >= 0; index -= 1) {
+    const event = events[index];
+    if (event?.type !== "odai/route-decided") continue;
+    if (!Number.isSafeInteger(event.data?.turn)) return undefined;
+    currentTurn = event.data.turn;
+    break;
+  }
+  if (currentTurn === undefined) return undefined;
+
+  for (let index = events.length - 1; index >= 0; index -= 1) {
+    const event = events[index];
+    if (event?.type !== "odai/route-protection") continue;
+    if (event.data?.turn === currentTurn && event.data?.mode === "read-only") return event.data;
+  }
+  return undefined;
+}
+
+export function createRouteProtectionGuard(options = {}) {
+  const allowed = new Set(DEFAULT_PROTECTED_CONTROLLER_ALLOWED_TOOLS);
+  for (const name of Array.isArray(options.additionalDeniedTools) ? options.additionalDeniedTools : []) {
+    allowed.delete(name);
+  }
+  const onDenied = typeof options.onDenied === "function" ? options.onDenied : () => {};
+  const protectionFor = typeof options.protectionFor === "function"
+    ? options.protectionFor
+    : activeRouteProtection;
+
+  return (execution) => {
+    if (isSubagent(execution?.agent)) return undefined;
+    if (allowed.has(execution?.name)) return undefined;
+    const protection = protectionFor(execution?.agent);
+    if (!protection) return undefined;
+
+    const reasonCode = protection.reasonCode ?? "unresolved-high-impact-route";
+    const reason = `ODAI_HIGH_IMPACT_ROUTE_BLOCKED: controller may not execute ${execution.name} while ${reasonCode} remains unresolved; use read-only evidence and provide an actionable decision path.`;
+    onDenied(execution, reason);
+    return reason;
+  };
+}
+
+export function summarizeToolResult(execution, result) {
+  const summary = {
+    callId: String(execution.callId),
+    rootCallId: String(execution.rootCallId),
+    tool: execution.name,
+    child: isSubagent(execution.agent),
+    isError: result.isError === true,
+  };
+
+  if (result.isError === true && result.error?.code) {
+    summary.errorCode = String(result.error.code);
+  }
+
+  return summary;
+}