weir-harness 1.2.1 → 1.2.3

package/cordis.patch.yml

@@ -104,7 +104,6 @@
                 You are the Orchestrator, the user's single point of collaboration, powered by the {{model}} model.
                 You understand intent, decompose work, delegate to specialist sub-agents, choose parallel fan-out
                 or sequenced waiting, verify evidence, and report results.
-              suffix: Your working directory is {{cwd}}.
           - id: weir-core
             name: 'weir-harness/core'
           - id: agent-instructions
@@ -294,7 +293,6 @@
                 You are the Orchestrator, the user's single point of collaboration, powered by the {{model}} model.
                 You understand intent, decompose work, delegate to specialist sub-agents, choose parallel fan-out
                 or sequenced waiting, verify evidence, and report results.
-              suffix: Your working directory is {{cwd}}.
           - id: weir-core
             name: 'weir-harness/core'
           # Creative-only: how to use the fused tooling (inspection order,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "weir-harness",
-  "version": "1.2.1",
+  "version": "1.2.3",
   "type": "module",
   "description": "Weir \u2014 orchestrator-centric DSH agent preset: intent gate, category delegation, todo driver, pull-based background jobs, auto-compaction, hashline edit.",
   "license": "MIT",
@@ -28,8 +28,11 @@
     "whitelist-defaults.json",
     "icon.svg"
   ],
+  "engines": {
+    "dsh": ">=0.2.1-rc.1 <0.3.0"
+  },
   "peerDependencies": {
-    "@deepseek-ai/dsh": ">=0.2.0-rc.2 <0.3.0"
+    "@deepseek-ai/dsh": ">=0.2.1-rc.1 <0.3.0"
   },
   "exports": {
     "./package.json": "./package.json",

package/src/capabilities/skill-office-adapter.js

@@ -30,7 +30,13 @@ export function createOfficeAdapter(skills, machineId) {
     const observation = Array.isArray(output) ? { candidates: output, complete: true } : output
     const candidates = []
     for (const raw of observation.candidates) {
-      if (!OFFICE_NAMES.includes(raw.name) || raw.provider !== 'dsh-office' || raw.source !== 'bundled' || typeof raw.locator !== 'string') {
+      // DSH 0.2.1's office provider lists MORE bundled siblings than the three
+      // Weir composes (`office`, `office-render`, `office-recalculate`,
+      // `office-export-pdf`). This adapter only owns OFFICE_NAMES: a foreign
+      // sibling is skipped, never an error — while a candidate that CLAIMS one
+      // of our names with an unexpected shape still fails closed below.
+      if (!OFFICE_NAMES.includes(raw.name)) continue
+      if (raw.provider !== 'dsh-office' || raw.source !== 'bundled' || typeof raw.locator !== 'string') {
         throw new Error('Unsupported Office provider candidate')
       }
       const path = await realpath(raw.locator)

package/src/creative-guide/guide.js

@@ -20,7 +20,7 @@ Call \`cordis_inspect_list\` first to enumerate the Host and Client Inspect Prov
 
 ## Manage plugins deliberately
 
-\`plugin_manager\` lists, installs, enables, disables, and removes profile bundles and plugins. List first to obtain exact identifiers. Changes affect every session in the profile and apply immediately in a live profile. To re-apply a changed bundle, disable then enable it (\`set_bundle\`) — repeating \`install_bundle\` for an already-installed bundle is rejected as ambiguous. A version exemption risks crashes and data loss: warn the user and obtain explicit permission for the exact plugin and runtime versions before granting one.
+\`plugin_manager\` lists, installs, enables, disables, and removes profile bundles and plugins. List first to obtain exact identifiers. Changes affect every session in the profile and apply immediately in a live profile. To re-apply a changed bundle, disable then enable it (\`set_bundle\`) — repeating \`install_bundle\` for a known, already-installed bundle is refused up front as \`already-installed\`. A version exemption risks crashes and data loss: warn the user and obtain explicit permission for the exact plugin and runtime versions before granting one.
 
 ## Load the development skills
 

package/src/delegate/child-composition.js

@@ -0,0 +1,258 @@
+// Child composition shim: the creation-window replacement for the
+// request-level `persona`/`toolFilter` fields DSH 0.2.1 removed from
+// `subagents.startActivation`. The delegate module reserves the childId before
+// spawning, registers the composition here, and the `agent/created` listener
+// applies it inside the child's creation window — before the subagent runtime
+// delivers the initial prompt (startLocal → materialize → agents.create →
+// setup → announce → submitMaterialized, verified against 0.2.1).
+//
+// Timing is race-free by construction and fail-closed: a fresh spawn waits for
+// the recorded verdict and tears the child down when the composition did not
+// land, so no child ever runs with the orchestrator-tool deny list missing.
+//
+// Cold resume: the applied sections/restrictions are runtime state of one
+// agent incarnation, so a host restart loses them. Every spawn therefore also
+// writes a `delegate/spawn` fact on the shared audit channel (the cold-safe
+// channel — never a custom session event type, S13) and this listener replays
+// the composition for a resumed child whose fact is still in the audit tail.
+// Missing fact: persona/allow-lists degrade fail-open (same posture as the
+// supervision rebuild), while the orchestrator-tool deny floor is still applied
+// whenever the child is attributable to a weir-managed parent session.
+import { AUDIT_TYPES, AUDIT_SUBTYPES } from '../shared/audit.js'
+import { auditFilePathOf, readAuditTail } from '../shared/terminal-evidence.js'
+import { CHILD_DENY_TOOLS, childToolFilter } from '../shared/child-scope.js'
+
+/**
+ * The spawn-fact audit type AS PASSED TO the audit sink: UNPREFIXED, because
+ * createAudit prepends `weir/` itself (see src/shared/audit.js). Mirrors the
+ * AUDIT_TYPES/AUDIT_SUBTYPES registry; passing a pre-prefixed value here is
+ * what produced `weir/weir/delegate/spawn` records in the wild.
+ */
+export const SPAWN_FACT_TYPE = `${AUDIT_TYPES.delegate}/${AUDIT_SUBTYPES.delegate[0]}`
+
+/**
+ * The spawn-fact type AS STORED in the audit channel (JSONL record + cordis
+ * event name): the sink's single `weir/` prefix is part of the record, so every
+ * comparison against a stored `record.type` must use THIS constant.
+ */
+export const SPAWN_FACT_RECORD_TYPE = `weir/${SPAWN_FACT_TYPE}`
+
+/** Deployment persona prefix section (dsh-system-prompt / dsh-persona contract). */
+const PERSONA_PREFIX_SECTION = 'deployment:persona-prefix'
+const PERSONA_PREFIX_ORDER = 'DEPLOYMENT_PERSONA_PREFIX'
+
+/**
+ * @typedef {object} SpawnComposition
+ * @property {string} [childId]
+ * @property {string} [lane] - one of 'one-shot' | 'continuable' | 'supervised'
+ * @property {string} [label]
+ * @property {string} persona - full persona text applied as the child's prefix section
+ * @property {{ allow?: string[], deny?: string[] }} [toolFilter] - requested child tool filter
+ */
+
+/**
+ * Mount the composition listener on one plugin ctx.
+ * @param {object} deps
+ * @param {any} deps.ctx - plugin context (on / tools)
+ * @param {(session: object | null, type: string, data?: unknown) => void} deps.audit - createAudit sink
+ * @param {{ warn?: (message: string) => void }} [deps.logger]
+ * @param {() => Set<string> | undefined} [deps.restrictableNames] - fallback composition view
+ * @param {(fact: { session?: object | null, childId: string, lane?: string }) => void} [deps.onSpawn] - live spawn-fact sink (supervision catalog cross-check)
+ * @returns {{ beginSpawn: (composition: SpawnComposition & { session?: object | null }) => { outcome: () => { ok: boolean, error?: Error }, forget: () => void }, dispose: () => void }}
+ */
+export function createChildComposition({ ctx, audit, logger, restrictableNames, onSpawn }) {
+  /** @type {Map<string, { session: object | null, childId: string, lane: string, label: string, persona: string, toolFilter?: object, applied: boolean, error?: Error }>} */
+  const pending = new Map()
+
+  /**
+   * Reserve one composition and write its cold-safe spawn fact. Called
+   * synchronously BEFORE startActivation: the child's creation window runs
+   * inside that call, so the entry is always present when the listener fires.
+   * @param {SpawnComposition & { session?: object | null }} composition
+   */
+  function beginSpawn(composition) {
+    const entry = {
+      session: composition.session ?? null,
+      childId: composition.childId,
+      lane: composition.lane ?? 'one-shot',
+      label: composition.label ?? '',
+      persona: composition.persona ?? '',
+      toolFilter: composition.toolFilter,
+      applied: false,
+      error: undefined,
+    }
+    pending.set(entry.childId, entry)
+    // Audit mirrors the fact to <cwd>/.weir/audit.jsonl (cold-safe replay) and
+    // emits it in-process. Never throws.
+    const fact = {
+      childId: entry.childId,
+      lane: entry.lane,
+      label: entry.label,
+      persona: entry.persona,
+      ...(entry.toolFilter ? { toolFilter: entry.toolFilter } : {}),
+    }
+    audit(entry.session, SPAWN_FACT_TYPE, fact)
+    // Live consumers (the supervision catalog cross-check) see the same fact
+    // without re-reading the file.
+    try {
+      onSpawn?.({ session: entry.session, childId: entry.childId, lane: entry.lane })
+    } catch {
+      // a live sink failure must never break the spawn
+    }
+    return {
+      outcome: () => (entry.applied
+        ? { ok: true }
+        : {
+            ok: false,
+            error: entry.error ?? new Error(`child "${entry.childId}": the composition was not applied inside the creation window`),
+          }),
+      forget: () => {
+        if (pending.get(entry.childId) === entry) pending.delete(entry.childId)
+      },
+    }
+  }
+
+  /** Apply a composition to one live child agent (throws on any failure). */
+  function apply(agent, composition) {
+    const systemPrompt = agent?.ctx?.systemPrompt
+    const tools = agent?.ctx?.tools
+    if (typeof composition.persona === 'string' && composition.persona.length > 0) {
+      if (typeof systemPrompt?.section !== 'function') {
+        throw new Error('the child agent exposes no systemPrompt service')
+      }
+      // Same section name the deployment/preset persona uses, so the child's
+      // own layer shadows it instead of duplicating a prompt paragraph.
+      systemPrompt.section({
+        name: PERSONA_PREFIX_SECTION,
+        order: systemPrompt.getSectionOrder(PERSONA_PREFIX_ORDER),
+        text: composition.persona,
+      })
+    }
+    const filter = composition.toolFilter
+    if (!filter) return
+    if (typeof tools?.restrict !== 'function') {
+      // An allow filter with no restriction channel would silently widen the
+      // child surface; the deny list is the safety floor. Fail closed.
+      throw new Error('the child agent exposes no tools service')
+    }
+    // tools.restrict() rejects unknown deny/allow names, so the deny list is
+    // merged against the CHILD scope's restrictable set (the composition's own
+    // view is only a fallback). childToolFilter keeps the existing merge
+    // semantics: allow-list filters pass through, every other filter gets
+    // CHILD_DENY_TOOLS intersected in, so the orchestrator-tool deny never
+    // degrades with the requested filter. The final deny list is then
+    // intersected with that same child set: a name the child scope never
+    // registered needs no deny (it is absent either way) and naming it would
+    // make restrict() throw.
+    const known = restrictableNamesOf(agent) ?? restrictableNames?.()
+    const merged = childToolFilter(filter, known)
+    const deny = Array.isArray(merged.deny) && known ? merged.deny.filter((name) => known.has(name)) : merged.deny
+    const effective = deny === merged.deny ? merged : { ...merged, deny }
+    const hasAllow = effective.allow !== undefined
+    const hasDeny = Array.isArray(effective.deny) && effective.deny.length > 0
+    if (!hasAllow && !hasDeny) return
+    tools.restrict(effective)
+  }
+
+  /** Resolve the child scope's restrictable tool names (undefined when unavailable). */
+  function restrictableNamesOf(agent) {
+    try {
+      const view = agent?.ctx?.tools?.view?.(agent)
+      if (view?.restrictableNames instanceof Set) return view.restrictableNames
+    } catch {
+      // view() failures fall back to the composition view
+    }
+    return undefined
+  }
+
+  /**
+   * Replay the composition of a cold-resumed child from the audit tail.
+   * @param {any} agent
+   * @param {object} header - the child session header
+   */
+  function replayFromAudit(agent, header) {
+    const file = auditFilePathOf(agent.session)
+    const records = readAuditTail(file)
+    if (records.length === 0) return
+    let fact
+    let parentManaged = false
+    for (const record of records) {
+      if (!record || typeof record !== 'object') continue
+      if (record.session !== header.parentSession) continue
+      if (typeof record.type !== 'string' || !record.type.startsWith('weir/')) continue
+      parentManaged = true
+      if (record.type === SPAWN_FACT_RECORD_TYPE && record.data?.childId === agent.id) fact = record.data
+    }
+    if (!parentManaged) return // not a weir-managed parent session: not our child
+    if (!fact) {
+      // Degraded: the spawn fact aged out of the tail (or the audit channel was
+      // unavailable). Persona and allow-lists stay unapplied, but the
+      // orchestrator-tool deny floor never does.
+      logger?.warn?.(`weir-delegate: child "${agent.id}" has no delegate/spawn fact in the audit tail — replaying the static orchestrator-tool deny floor only`)
+      applyDenyFloor(agent)
+      return
+    }
+    try {
+      apply(agent, fact)
+    } catch (error) {
+      logger?.warn?.(`weir-delegate: child "${agent.id}" composition replay failed (fail-open): ${String(error?.message ?? error)}`)
+      applyDenyFloor(agent)
+    }
+  }
+
+  /** Apply only the static orchestrator-tool deny floor (best-effort, warns). */
+  function applyDenyFloor(agent) {
+    try {
+      const known = restrictableNamesOf(agent) ?? restrictableNames?.()
+      const deny = known ? CHILD_DENY_TOOLS.filter((name) => known.has(name)) : [...CHILD_DENY_TOOLS]
+      if (deny.length === 0) return
+      agent.ctx.tools.restrict({ deny })
+    } catch (error) {
+      logger?.warn?.(`weir-delegate: child "${agent.id}" deny-floor application failed: ${String(error?.message ?? error)}`)
+    }
+  }
+
+  /**
+   * `agent/created` listener. A failure on the fresh-spawn path is thrown so
+   * the spawn call itself rejects (the runtime disposes the unpublished child
+   * after a rejected creation announcement); the recorded verdict lets the
+   * spawn's own fail-closed branch also catch a listener that never ran.
+   */
+  function onAgentCreated(payload) {
+    const agent = payload?.agent
+    const header = agent?.session?.header
+    if (!header) return
+    if ((header.delegationDepth ?? 0) < 1) return
+    const childId = agent.id
+    const entry = pending.get(childId)
+    if (entry) {
+      pending.delete(childId)
+      try {
+        apply(agent, entry)
+        entry.applied = true
+      } catch (error) {
+        entry.error = compositionError(childId, error)
+        throw entry.error
+      }
+      return
+    }
+    replayFromAudit(agent, header)
+  }
+
+  const off = ctx.on('agent/created', onAgentCreated)
+
+  return {
+    beginSpawn,
+    dispose: () => {
+      pending.clear()
+      off?.()
+    },
+  }
+}
+
+/** Wrap one composition failure with the delegate-facing cause. */
+function compositionError(childId, error) {
+  const wrapped = new Error(`delegate: failed to apply the child composition for "${childId}" — ${String(error?.message ?? error)}`)
+  wrapped.cause = error
+  return wrapped
+}

package/src/delegate/group-coordinator.js

@@ -47,18 +47,31 @@ export function createGroupRecord(name, { sealed = false, settled = false, membe
 }
 
 /**
- * Single exit for the untracked-catalog predicate: continuable catalog entries
- * the registry does not track. mode is normalized (undefined → 'continuable');
- * the row shape is { id, label, mode }. `isTracked(id)` is the caller's lookup.
+ * Single exit for the untracked-catalog predicate: catalog children the
+ * supervision registry does not track AND no one-shot/continuable spawn fact
+ * claims. The row shape is { id, label, mode } (mode is passed through
+ * verbatim: DSH 0.2.1 reports every local child as 'continuable' and may also
+ * report 'external', so the catalog mode no longer discriminates lanes — the
+ * durable spawn facts do).
+ * `isTracked(id)` is the caller's registry lookup. `spawnFactOf(id)` returns
+ * the durable delegate/spawn fact for a weir-spawned child (lane included):
+ * one-shot and plain-continuable children must never be resurrected as
+ * supervision orphans, while a supervised child normally IS tracked and a
+ * supervised child missing from the fact chain stays visible as an orphan
+ * (never hidden). Only a fact-less orphan (not spawned by this weir build)
+ * keeps the promoted/recovered semantics.
+ * @param {object[]} entries - DSH catalog children
+ * @param {(id: string) => boolean} isTracked
+ * @param {(id: string) => { lane?: string } | undefined} [spawnFactOf]
  */
-export function untrackedCatalogEntries(entries, isTracked) {
+export function untrackedCatalogEntries(entries, isTracked, spawnFactOf) {
   const untracked = []
   for (const entry of entries ?? []) {
     if (!entry || typeof entry !== 'object') continue
-    const mode = entry.mode === undefined ? 'continuable' : entry.mode
-    if (mode !== 'continuable') continue
     if (isTracked(entry.id)) continue
-    untracked.push({ id: entry.id, label: entry.label ?? '', mode })
+    const lane = spawnFactOf?.(entry.id)?.lane
+    if (lane === 'one-shot' || lane === 'continuable') continue
+    untracked.push({ id: entry.id, label: entry.label ?? '', mode: entry.mode })
   }
   return untracked
 }
@@ -73,7 +86,8 @@ export function untrackedCatalogEntries(entries, isTracked) {
  * @param {(delayMs: number, fn: () => void) => void} deps.schedule - delayed retry scheduler
  * @param {(reason: string) => void} [deps.onAudit]
   * @param {(fact: object) => void} [deps.onFact] - structured supervision facts (durability)
-  * @param {(text: string) => void} [deps.notifyParent] - deliver a parent-facing signal (timer-deferred followup)
+ * @param {(text: string) => void} [deps.notifyParent] - deliver a parent-facing signal (timer-deferred followup)
+ * @param {(childId: string) => { lane?: string } | undefined} [deps.spawnFactOf] - durable delegate/spawn fact for one child id (lane decides orphan resurrection; see untrackedCatalogEntries)
   */
 export function createGroupCoordinator(deps, config = {}) {
   const cfg = { ...DEFAULT_SUPERVISION, ...config }
@@ -174,9 +188,9 @@ export function createGroupCoordinator(deps, config = {}) {
     }
   }
 
-  /** Catalog cross-check: continuable catalog entries this registry does not track. */
+  /** Catalog cross-check: catalog children this registry does not track (spawn-fact aware). */
   function untrackedAgainstCatalog(entries) {
-    return untrackedCatalogEntries(entries, (id) => children.has(id))
+    return untrackedCatalogEntries(entries, (id) => children.has(id), deps.spawnFactOf)
   }
 
   function noteAssistantText(childId, text) {

package/src/delegate/index.js

@@ -18,6 +18,7 @@ import { createDelegateTool } from './tool.js'
 import { attachWorktreeModeGuard } from './worktree-mode.js'
 import { DOCTRINE_SECTION_ORDER } from '../core/doctrine.js'
 import { isDelegatedChild } from '../shared/child-scope.js'
+import { createChildComposition } from './child-composition.js'
 import {
   DELEGATE_TARGETS_SECTION_NAME,
   DELEGATE_TARGETS_SECTION_ORDER_OFFSET,
@@ -97,6 +98,20 @@ function apply(ctx, config = {}) {
     onAdaptersUpdated: (fn) => ctx.on('llm/adapters-updated', fn),
   })
 
+  // Creation-window child composition (DSH 0.2.1 removed the request-level
+  // persona/toolFilter): the shim applies the reserved spawn's composition in
+  // the child's agent/created window and replays it from the audit channel on
+  // cold resume. One instance per plugin context; dispose unregisters it.
+  const composition = createChildComposition({
+    ctx,
+    audit,
+    logger: ctx.logger,
+    restrictableNames: () => ctx.tools.view?.(undefined)?.restrictableNames,
+    // Feed the supervision catalog cross-check the same durable fact without a
+    // file re-read (spawn-fact lane decides orphan resurrection).
+    onSpawn: mount.noteSpawnFact,
+  })
+
   ctx.tools.register(
     createDelegateTool({
       resolveTarget: targetResolver.resolveTarget,
@@ -114,6 +129,7 @@ function apply(ctx, config = {}) {
       // names, so the child deny list names only tools this composition
       // actually registers (tools.restrict() rejects unknown deny names).
       restrictableNames: () => ctx.tools.view?.(undefined)?.restrictableNames,
+      composition,
     }),
   )
 
@@ -165,6 +181,7 @@ function apply(ctx, config = {}) {
   return () => {
     offModeGuard()
     mount.dispose()
+    composition.dispose()
   }
 }
 

package/src/delegate/rehydrate.js

@@ -9,21 +9,37 @@ import { parseTerminalStatus, isTerminalStatus } from '../shared/terminal-eviden
  * Rebuild supervision state by replaying structured audit facts and
  * cross-checking the DSH subagent catalog.
  *
+ * Two fact channels ride the same audit file: the supervision facts
+ * (`weir/supervision/<kind>`) and the child-composition spawn facts
+ * (`weir/delegate/spawn`, which carry the lane). The spawn facts decide which
+ * catalog children are supervision orphans — DSH 0.2.1 reports every local
+ * child as mode 'continuable', so the catalog mode can no longer tell a
+ * one-shot child from a supervised one.
+ *
  * @param {object} input
  * @param {string} input.parentId - the parent session id (record filter key)
  * @param {object[]} input.records - parsed audit JSONL records (already tail-read; may contain other sessions/types)
  * @param {object[]} input.catalogChildren - DSH catalog entries ({ id, label?, mode? }); best-effort
- * @returns {{ children: object[], groups: object[], untracked: object[], confidence: 'full'|'partial', factsSeen: number }}
+ * @returns {{ children: object[], groups: object[], untracked: object[], spawnFacts: object[], confidence: 'full'|'partial', factsSeen: number }}
  */
 export function rehydrateSupervision({ parentId, records, catalogChildren }) {
   const children = new Map()
   const groups = new Map()
+  /** @type {Map<string, { childId: string, lane?: string }>} */
+  const spawnFacts = new Map()
   let factsSeen = 0
 
   for (const record of records ?? []) {
     if (!record || typeof record !== 'object') continue
     if (record.session !== undefined && record.session !== null && record.session !== parentId) continue
     const type = typeof record.type === 'string' ? record.type : ''
+    if (type === 'weir/delegate/spawn') {
+      const fact = record.data
+      if (fact && typeof fact === 'object' && typeof fact.childId === 'string' && fact.childId.length > 0) {
+        spawnFacts.set(fact.childId, { childId: fact.childId, lane: typeof fact.lane === 'string' ? fact.lane : undefined })
+      }
+      continue
+    }
     if (!type.startsWith('weir/supervision/')) continue
     const fact = record.data
     if (!fact || typeof fact !== 'object' || typeof fact.kind !== 'string') continue
@@ -37,13 +53,16 @@ export function rehydrateSupervision({ parentId, records, catalogChildren }) {
     group.settled = group.sealed === true && group.memberIds.length > 0 && terminal
   }
 
-  // Catalog cross-check: continuable children the registry does not track.
-  const untracked = untrackedCatalogEntries(catalogChildren, (id) => children.has(id))
+  // Catalog cross-check: only fact-less orphans remain untracked (the spawn
+  // facts identify the one-shot/continuable children this registry must never
+  // resurrect, and keep a supervised child whose fact chain is broken visible).
+  const untracked = untrackedCatalogEntries(catalogChildren, (id) => children.has(id), (id) => spawnFacts.get(id))
 
   return {
     children: [...children.values()],
     groups: [...groups.values()],
     untracked,
+    spawnFacts: [...spawnFacts.values()],
     confidence: factsSeen > 0 ? 'full' : 'partial',
     factsSeen,
   }