odai-dsh-agent 0.2.2 → 0.2.3

package/README.md

@@ -13,7 +13,7 @@ $DSH_HOME/.agent-presets/odai/
   .odai-agent.json
 ```
 
-The source composition preserves every capability row and setting from the `standard` agent surface in `@deepseek-ai/dsh@0.1.0-rc.7`, then adds the scoped Odai runtime in default `auto` mode. For rc.6, the installer deterministically restores that release's two disabled optional-provider fields before hashing and publishing the managed preset. Release verification compares each rendered composition against its exact DSH Standard source; a missing, added, reordered, or changed Standard row fails the probe. Host-owned persistence, sandbox, approval, registries, and base controller selection remain in the selected DSH profile. Ordinary requests stay on that controller. Responsibility words are optional signals rather than commands: evidence-grounded task-state gaps route at any step, identical gaps are consumed once, and an identical planner/controller model remains inline without another model call. An original request that already authorizes implementation automatically continues from a frozen planner card to executor; plan-only, new-task, expanded-scope, and unknown authorization cannot do so. Reviewer children require a current hash-addressed evidence packet whose diff and latest successful test are newer than the last write. An incomplete packet keeps the current controller route so it can gather project-available evidence without claiming independent acceptance or terminating the authorized task. Every route is resolved before provider I/O; deterministic invalid persisted mappings are backed up and exact-match removed, while recoverable provider failures preserve them. Frontend route failure becomes an explicit local controller fallback without a routed receipt. `execute` remains an explicit comparison mode and `observe` changes no model or child while retaining fail-closed high-impact protection. Configured compaction streams are buffered so partial failed output cannot contaminate the inherited-route retry or replace original history.
+The source composition preserves every capability row and setting from the `standard` agent surface in `@deepseek-ai/dsh@0.1.0-rc.8`, then adds the scoped Odai runtime in default `auto` mode. For rc.7, the installer restores that release's optional-provider wording; for rc.6, it additionally restores the two disabled-provider fields before hashing and publishing the managed preset. Release verification compares each rendered composition against its exact DSH Standard source; a missing, added, reordered, or changed Standard row fails the probe. Host-owned persistence, sandbox, approval, registries, and base controller selection remain in the selected DSH profile. Ordinary requests stay on that controller. Responsibility words are optional signals rather than commands: evidence-grounded task-state gaps route at any step, identical gaps are consumed once, and an identical planner/controller model remains inline without another model call. An original request that already authorizes implementation automatically continues from a frozen planner card to executor; plan-only, new-task, expanded-scope, and unknown authorization cannot do so. Reviewer children require a current hash-addressed evidence packet whose diff and latest successful test are newer than the last write. An incomplete packet keeps the current controller route so it can gather project-available evidence without claiming independent acceptance or terminating the authorized task. Every route is resolved before provider I/O; deterministic invalid persisted mappings are backed up and exact-match removed, while recoverable provider failures preserve them. Frontend route failure becomes an explicit local controller fallback without a routed receipt. `execute` remains an explicit comparison mode and `observe` changes no model or child while retaining fail-closed high-impact protection. Configured compaction streams are buffered so partial failed output cannot contaminate the inherited-route retry or replace original history.
 
 The preset includes the same local long-term semantic memory runtime as the Plugin. Default `auto` mode performs no hidden model call: it automatically captures only high-confidence durable statements from the direct-human message authenticated by the latest open-turn session event, keeps ambiguous or conflicting candidates inert, and recalls only bounded active global/project records as untrusted historical context. Matching direct intent, or the compact capability gateway on a later step, exposes the controller-only `odai_memory` tool for inspection, search, confirmation, correction, physical forgetting, exact-phrase clearing, and `auto`/`off` mode changes. Recognized secrets, contact identifiers, health/crisis content, temporary instructions, hypotheses, quotes, and code are rejected; the current user and project authority always override memory. State lives at `$DSH_HOME/odai/memory/store.json`, outside `.agent-presets`, so install, update, and uninstall preserve it. An invalid or symlinked store fails closed. The matcher is not a replacement for protecting the underlying DSH session history from sensitive input.
 
@@ -31,7 +31,7 @@ With DSH already installed, run the single Agent package command below. The pack
 npx odai-dsh-agent install
 ```
 
-The installer checks `dsh -V` and currently accepts exactly `0.1.0-rc.6` or `0.1.0-rc.7`. It records the detected version in the managed manifest and renders that release's exact Standard composition; any other developer-preview version fails closed.
+The installer checks `dsh -V` and currently accepts exactly `0.1.0-rc.6`, `0.1.0-rc.7`, or `0.1.0-rc.8`. It records the detected version in the managed manifest and renders that release's exact Standard composition; any other developer-preview version fails closed.
 
 `DSH_HOME` is honored. An explicit location can be supplied without changing the environment:
 
@@ -41,7 +41,7 @@ npx odai-dsh-agent install --dsh-home /path/to/dsh-home
 
 Open a new DSH session and select `Odai` from the Agent preset picker. Existing sessions retain the preset they were composed with.
 
-In supported DSH rc.6 and rc.7 releases, the one-shot `--profile headless` driver creates a global agent directly and neither mounts nor accepts a session Agent preset. Automated Agent runs must create a Web session with `agentPreset: odai`; use the profile-wide Plugin for one-shot headless tasks.
+In supported DSH rc.6, rc.7, and rc.8 releases, the one-shot `--profile headless` driver creates a global agent directly and neither mounts nor accepts a session Agent preset. Automated Agent runs must create a Web session with `agentPreset: odai`; use the profile-wide Plugin for one-shot headless tasks.
 
 The installer copies through a mode-tightened staging directory and atomically publishes the preset. Updates verify every previously managed file first, refuse to overwrite local edits, and always change the composition generation key so new sessions in a running DSH process do not reuse stale runtime code. If install or update finds recognized historical Odai audit records, it refuses to change the preset until every DSH process is stopped and the command is rerun with `--yes`. The confirmed migration adds DSH's official `ignorable: true` envelope marker, covers both plaintext and concatenated-frame Zstandard session artifacts, verifies each replacement, and retains a content-addressed backup without deleting messages or evidence. Confirmation alone is insufficient: migration also refuses when local process inspection fails or finds any active DSH process. Keep DSH stopped until the installer exits because historical runtimes do not participate in a migration lock. An unknown unmarked `odai/*` type blocks the operation instead of being assumed safe to ignore.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "odai-dsh-agent",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "description": "完整继承 DSH 标准模式 全部能力的 Odai Agent preset。主要用于治理、规划、测试、验证 等，可当成默认总控使用。",
   "license": "MIT",
   "repository": {
@@ -49,7 +49,7 @@
     "yaml": "^2.8.1"
   },
   "peerDependencies": {
-    "@deepseek-ai/dsh": "0.1.0-rc.6 || 0.1.0-rc.7"
+    "@deepseek-ai/dsh": "0.1.0-rc.6 || 0.1.0-rc.7 || 0.1.0-rc.8"
   },
   "peerDependenciesMeta": {
     "@deepseek-ai/dsh": {

package/preset/odai/agent.cordis.yml

@@ -197,9 +197,10 @@
         toolName: subagent_fork
         backgroundMode: continuable
 
-    # Production dsh does not install these optional providers. An opting-in
-    # Profile mounts each provider once on the host plane; copy this preset,
-    # then remove `disabled` from the matching tool row.
+    # Production dsh does not install these optional providers. Install the
+    # matching Bundle in this Profile and restart the Host, then copy this
+    # preset and remove `disabled` from the matching tool row. Host availability
+    # alone grants no tool.
     - id: tool-subagent-codex
       name: '@deepseek-ai/dsh-tool-subagent'
       disabled: true

package/src/installer.mjs

@@ -31,7 +31,20 @@ export const SUPPORTED_DSH_VERSIONS = Object.freeze(
 if (SUPPORTED_DSH_VERSIONS.length === 0 || SUPPORTED_DSH_VERSIONS.some((version) => !DSH_VERSION_PATTERN.test(version))) {
   throw new Error("odai-dsh-agent peer dependency must list exact supported DSH versions");
 }
-export const SUPPORTED_DSH_VERSION = SUPPORTED_DSH_VERSIONS.at(-1);
+const SOURCE_DSH_VERSION = "0.1.0-rc.8";
+const OPTIONAL_PROVIDER_COMMENTS = Object.freeze({
+  "0.1.0-rc.6": "    # Product providers are host-plane singletons. Copy this preset, then\n    # remove `disabled` from either ordinary tool row to expose that product\n    # only to agents composed from the copy.",
+  "0.1.0-rc.7": "    # Production dsh does not install these optional providers. An opting-in\n    # Profile mounts each provider once on the host plane; copy this preset,\n    # then remove `disabled` from the matching tool row.",
+  "0.1.0-rc.8": "    # Production dsh does not install these optional providers. Install the\n    # matching Bundle in this Profile and restart the Host, then copy this\n    # preset and remove `disabled` from the matching tool row. Host availability\n    # alone grants no tool.",
+});
+const compositionVersions = Object.keys(OPTIONAL_PROVIDER_COMMENTS);
+if (JSON.stringify(SUPPORTED_DSH_VERSIONS) !== JSON.stringify(compositionVersions)) {
+  throw new Error(`Odai Agent peer versions ${SUPPORTED_DSH_VERSIONS.join(", ")} must exactly match composition contracts ${compositionVersions.join(", ")}`);
+}
+if (compositionVersions.at(-1) !== SOURCE_DSH_VERSION) {
+  throw new Error(`Odai Agent source composition targets ${SOURCE_DSH_VERSION}, not contract baseline ${compositionVersions.at(-1)}`);
+}
+export const SUPPORTED_DSH_VERSION = SOURCE_DSH_VERSION;
 const requiredFiles = Object.freeze([
   "agent.cordis.yml",
   "preset.yml",
@@ -50,7 +63,7 @@ const requiredFiles = Object.freeze([
 function replaceCompositionContract(composition, before, after, label) {
   const first = composition.indexOf(before);
   if (first < 0 || composition.indexOf(before, first + before.length) >= 0) {
-    throw new Error(`Odai Agent composition does not contain exactly one rc.7 ${label} contract`);
+    throw new Error(`Odai Agent source composition does not contain exactly one ${label} contract`);
   }
   return `${composition.slice(0, first)}${after}${composition.slice(first + before.length)}`;
 }
@@ -63,13 +76,16 @@ export function renderAgentCompositionForDsh(composition, dshVersion = SUPPORTED
     throw new Error(`unsupported DSH version ${dshVersion || "<empty>"}; expected one of ${SUPPORTED_DSH_VERSIONS.join(", ")}`);
   }
   let rendered = composition.replace(/\r\n/gu, "\n");
-  if (dshVersion === "0.1.0-rc.7") return rendered;
+  if (dshVersion === SOURCE_DSH_VERSION) return rendered;
+  const targetComment = OPTIONAL_PROVIDER_COMMENTS[dshVersion];
+  if (!targetComment) throw new Error(`missing Agent composition contract for DSH ${dshVersion}`);
   rendered = replaceCompositionContract(
     rendered,
-    "    # Production dsh does not install these optional providers. An opting-in\n    # Profile mounts each provider once on the host plane; copy this preset,\n    # then remove `disabled` from the matching tool row.",
-    "    # Product providers are host-plane singletons. Copy this preset, then\n    # remove `disabled` from either ordinary tool row to expose that product\n    # only to agents composed from the copy.",
+    OPTIONAL_PROVIDER_COMMENTS[SOURCE_DSH_VERSION],
+    targetComment,
     "optional-provider comment",
   );
+  if (dshVersion === "0.1.0-rc.7") return rendered;
   rendered = replaceCompositionContract(
     rendered,
     "        provider: codex\n        toolName: subagent_codex\n        backgroundMode: one-shot",