fix(preset): align minimal agent with RL composition

apps/cli/config/agent-presets/minimal/agent.cordis.yml

@@ -1,39 +1,71 @@
-# The `minimal` agent preset: the two-tool benchmark surface.
+# The `minimal` agent preset: the Claude SWE-compatible RL surface.
 #
-# The native model surface is exactly persistent `bash` plus
-# `str_replace_editor`. Everything else a session could reach — skills, goals,
-# plan mode, delegation, workflows, todo, web — is simply absent rather than
-# disabled, because a preset composes what an agent has instead of subtracting
-# from a shared default.
-#
-# The host composition is unchanged: this agent still runs inside the same
-# sandbox, approval, persistence, and model routing as any other session.
+# The persona is the complete system prompt, so global identity, Web surface,
+# tool guidance, and later assembly listeners cannot add prompt text. The model
+# composes only the persistent `bash` and `str_replace_editor` tools.
 
 - id: persona
   name: '@deepseek-ai/dsh-persona'
   config:
-    text: >-
-      You are a coding agent powered by the {{model}} model. Your working directory is {{cwd}}.
+    text: You are a helpful software engineer assistant.
+    complete: true
 
-# `bash-env` stays in the HOST composition: `apps/cli/src/web.ts` injects it to
-# publish `DSH_WEB_URL`/`DSH_WEB_MODE`, and a host row that injects a service is
-# the criterion for host-plane ownership — injection resolves before any session
-# exists, so there is no agent to key by. Behind a preset realm those variables
-# never reached the model's shell at all. `tool-bash` consumes the host registry
-# from here; the executor behind it (`bash-sandbox`) is host-plane too, where the
-# sandbox policy owns it.
-#
-# `run_in_background` is off because this preset mounts no `tool-tasks`. The
-# host registry already refuses a start for an owner no attached control
-# surface serves, so this is not the safety boundary — it is the model-facing
-# one: an agent that could never collect a task should not be offered the
-# parameter at all, and disabling it drops the parameter from the schema.
-- id: tool-bash
-  name: '@deepseek-ai/dsh-tool-bash'
+# The PTY registry is an agent-owned service, so it lives in an entry-local
+# realm. The backend still consumes the host sandbox policy and subprocess
+# implementation, while the tool registers into this agent's scoped catalog.
+- id: persistent-shell
+  name: cordis:group
+  group: true
+  isolate:
+    pty: true
   config:
-    enableRunInBackground: false
+    - id: pty
+      name: '@deepseek-ai/dsh-pty'
 
-- id: tool-str-replace-editor
+    - id: pty-local
+      name: '@deepseek-ai/dsh-pty-local'
+      config:
+        timeoutMs: 300000
+
+    - id: persistent-bash
+      name: '@deepseek-ai/dsh-tool-bash-persistent'
+      config:
+        timeoutMs: 300000
+        description: |-
+          Run commands in a bash shell
+          * When invoking this tool, the contents of the "command" parameter does NOT need to be XML-escaped.
+          * You don't have access to the internet via this tool.
+          * You do have access to a mirror of common linux and python packages via apt and pip.
+          * State is persistent across command calls and discussions with the user.
+          * To inspect a particular line range of a file, e.g. lines 10-25, try 'sed -n 10,25p /path/to/the/file'.
+          * Please avoid commands that may produce a very large amount of output.
+          * Please run long lived commands in the background, e.g. 'sleep 10 &' or start a server in the background.
+
+# Absolute paths are unconditional in the current editor; the legacy
+# `requireAbsolutePath` switch is no longer a configuration field.
+- id: str-replace-editor
   name: '@deepseek-ai/dsh-tool-str-replace-editor'
   config:
     maxOutputChars: 16000
+
+# RL core's fixed 128K window now comes from the routed model metadata rather
+# than compact-basic config. Its remaining policy is preserved explicitly.
+- id: compaction
+  name: cordis:group
+  group: true
+  isolate:
+    tokenMeter: true
+    compact: true
+  config:
+    - id: token-meter
+      name: '@deepseek-ai/dsh-token-meter'
+
+    - id: compact-basic
+      name: '@deepseek-ai/dsh-compact-basic'
+      config:
+        thresholdRatio: 0.8
+        retainTokens: 20480
+        summarizationProvider: ''
+        summarizationModel: ''
+        maxTokens: 8192
+        compactionRetries: 1

apps/cli/config/agent-presets/minimal/preset.yml

@@ -1,3 +1,3 @@
 name: 极简模式
-description: 只向模型呈现 bash 与 str_replace_editor，适合 benchmark 与最小复现。
+description: 固定 RL 系统提示词，只呈现持久 bash 与 str_replace_editor。
 order: 3

apps/cli/config/core-web.cordis.yml

@@ -1,113 +0,0 @@
-# Opt-in Web shell for the RL core agent contract. The model receives exactly
-# the configured persona plus the native `bash` and `str_replace_editor`
-# schemas; the Web host, browser shell, persistence, and permission stack stay.
-
-# Match the Claude SWE-compatible RL core prompt. Disabling the Web runtime's
-# surface context removes its GUI orientation, managed shell variables, and the
-# launcher's source-checkout section through one configuration contract.
-# Workspace instructions are model-visible user context rather than a system
-# section, but RL core disables them as part of the same prompt contract.
-- id: system-prompt
-  config:
-    includeHarnessIdentity: false
-    persona: !!js process.env.DSH_SYSTEM_PROMPT ?? 'You are a helpful software engineer assistant.'
-
-- id: web-runtime
-  config:
-    surfaceContext: false
-
-- id: workspace-context
-  disabled: true
-
-- id: tools
-  config:
-    mode: native
-
-# Disable every model-facing consumer in the base/Web tree. plan-mode owns the
-# always-registered exit_plan_mode tool even while the session is not planning.
-- id: tool-bash
-  disabled: true
-
-- id: tool-tasks
-  disabled: true
-
-- id: tool-fs
-  disabled: true
-
-- id: tool-fs-search
-  disabled: true
-
-- id: tool-web
-  disabled: true
-
-- id: tool-skill
-  disabled: true
-
-- id: plan-mode
-  disabled: true
-
-- id: tool-subagent-control
-  disabled: true
-
-- id: tool-subagent-list-agents
-  disabled: true
-
-- id: tool-subagent
-  disabled: true
-
-- id: tool-subagent-fork
-  disabled: true
-
-- id: tool-workflow
-  disabled: true
-
-- id: tool-todo
-  disabled: true
-
-# These consumers are shared defaults on the ordinary shipped surfaces, but
-# this opt-in profile keeps exactly its two named tools.
-- id: tool-goal
-  disabled: true
-
-- id: tool-ralph
-  disabled: true
-
-- id: tool-str-replace-editor
-  disabled: true
-
-# The matching browser controls must not offer surfaces whose tool this
-# overlay omits: the panels would render for a capability the model does not
-# have. Turning the row off no longer removes a tool — `ui-question`'s host
-# half is empty and `tool-ask-user` is composed per preset — so this is a UI
-# decision now, not a capability one.
-- id: ui-plan
-  disabled: true
-
-- id: ui-question
-  disabled: true
-
-- insert:
-    - id: pty
-      name: '@deepseek-ai/dsh-pty'
-
-    # This backend consumes the existing Web sandbox and permission policy.
-    # It loads only on Linux/macOS; Windows and other platforms fail at boot.
-    # Its 300s send wait matches the persistent Bash command timeout instead of
-    # pty-local's 30s default. An open persistent shell fences permission-mode
-    # changes until it closes.
-    - id: pty-local
-      name: '@deepseek-ai/dsh-pty-local'
-      config:
-        timeoutMs: 300000
-
-    - id: persistent-bash
-      name: '@deepseek-ai/dsh-tool-bash-persistent'
-      config:
-        timeoutMs: 300000
-
-    # The editor consumes the Web fs-sandbox provider and therefore retains
-    # the selected session permission mode.
-    - id: str-replace-editor
-      name: '@deepseek-ai/dsh-tool-str-replace-editor'
-      config:
-        maxOutputChars: 16000

apps/cli/reference/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write apps/cli/reference/README.md
-README.md: 0b5faf8993cd8065fffcfec5f240b0084508db91
-README.zh.md: b9c48c16dd4be186266d30a438329463c31aca70
+README.md: 12574a369acf2697842ae3aae95ce152d52c009d
+README.zh.md: f80dfba10292a03b1d855481bf4fa947a42a53c2

apps/cli/reference/README.md

@@ -59,9 +59,7 @@ All modes treat the invoking directory as the default workspace root, load appli
 
 New sessions default to the `workspace-write` permission preset. Bash and filesystem mutations are restricted to the session workspace and platform temporary roots; reads, network access, and process visibility are not confined. `DSH_PERMISSION_MODE` changes the process fallback. Stored General-settings permissions affect later Web sessions, not an already-open one.
 
-`DSH_TOOLS_MODE` selects `native`, `code`, or `both` for the process; another value fails at boot. [`config/core-web.cordis.yml`](../config/core-web.cordis.yml) is an optional RL-compatible `--patch` overlay that pins native mode, renders only `DSH_SYSTEM_PROMPT` or `You are a helpful software engineer assistant.` as the system prompt, disables Workspace instructions and every Web runtime prompt contribution, and exposes only persistent `bash` and `str_replace_editor` while retaining the shipped host, browser, workspace, persistence, and permission composition.
-
-`DSH_SYSTEM_PROMPT` is passed as the system-prompt [`persona`](../../../packages/core/system-prompt/README.md#config): complete `{{…}}` groups use that contract's strict variable interpolation rules and have no literal-brace escape; any set value, including an empty string, is authoritative and an empty value therefore removes the system prompt, while only an unset variable selects the fallback.
+`DSH_TOOLS_MODE` selects `native`, `code`, or `both` for the process; another value fails at boot. The shipped `minimal` agent preset keeps that deployment presentation, fixes the complete system prompt to `You are a helpful software engineer assistant.`, and composes only persistent `bash` plus `str_replace_editor`. Select 极简模式 when creating a Web session; every other prompt section and model-facing plugin remains absent from that agent while the shared browser, workspace, persistence, sandbox, and permission host stays in place.
 
 ## Shared deployment behavior
 

apps/cli/reference/README.zh.md

@@ -59,9 +59,7 @@ dsh web --dump-config
 
 新会话默认使用 `workspace-write` 权限预设。Bash 和文件系统修改仅限于会话 workspace 与平台临时根目录；读取、网络访问和进程可见性不受限制。`DSH_PERMISSION_MODE` 更改进程后备值。General settings 中存储的权限影响后续 Web 会话，不改变已打开的会话。
 
-`DSH_TOOLS_MODE` 为进程选择 `native`、`code` 或 `both`；其他值会导致启动失败。[`config/core-web.cordis.yml`](../config/core-web.cordis.yml) 是可选的 RL 兼容 `--patch` overlay：它固定使用 `native` 模式，仅将 `DSH_SYSTEM_PROMPT` 或 `You are a helpful software engineer assistant.` 渲染为系统提示词，禁用 Workspace 指令与所有 Web 运行时提示词贡献，并且在保留随附宿主、浏览器、workspace、持久化和权限组合的同时，仅暴露持久 `bash` 和 `str_replace_editor`。
-
-`DSH_SYSTEM_PROMPT` 会传给系统提示词的 [`persona`](../../../packages/core/system-prompt/README.md#config)：完整的 `{{…}}` 分组遵循该约定的严格变量插值规则，且无法转义为字面花括号；任何已设置的值（包括空字符串）都具有权威性，因此空值会移除系统提示词，只有未设置该变量时才会选择后备值。
+`DSH_TOOLS_MODE` 为进程选择 `native`、`code` 或 `both`；其他值会导致启动失败。随附的 `minimal` agent preset 会保留该部署的呈现方式，将完整系统提示词固定为 `You are a helpful software engineer assistant.`，并且仅组合持久 `bash` 和 `str_replace_editor`。创建 Web 会话时请选择极简模式；该 agent 不包含任何其他提示词段落或面向模型的插件，而共享的浏览器、workspace、持久化、沙箱与权限宿主保持不变。
 
 ## 共享部署行为
 

apps/cli/tests/built-bin.e2e.ts

@@ -9,7 +9,6 @@ import { afterEach, beforeEach, describe, expect, it } from 'vitest'
 /** Published-entry acceptance for argument errors, profile lifecycle, and boot-free config dumps. */
 const repoRoot = fileURLToPath(new URL('../../../', import.meta.url))
 const dshBin = join(repoRoot, 'apps/cli/lib/bin.js')
-const coreWebOverlay = fileURLToPath(new URL('../config/core-web.cordis.yml', import.meta.url))
 const invalidProvider = fileURLToPath(new URL('./fixtures/invalid-provider.cordis.yml', import.meta.url))
 
 async function runBuiltBin(
@@ -543,16 +542,5 @@ describe.skipIf(!existsSync(dshBin))('dsh BUILT bin (node lib/bin.js, no tsx)',
       expect(stdout).toContain(`patched by ${profilePatch}, ${overlay}`)
       expect(stderr).toContain('patch: entry "absent-row" not found')
     }, 30_000)
-
-    it('shows the RL Web patch disabling runtime surface context', async () => {
-      const { stdout, code, stderr } = await runBuiltBin(
-        ['web', '--patch', coreWebOverlay, '--dump-config'],
-        { DSH_HOME: home },
-      )
-      expect(code).toBe(0)
-      expect(stderr).toBe('')
-      expect(stdout).toContain("name: '@deepseek-ai/dsh-web-app'")
-      expect(stdout).toContain('surfaceContext: false')
-    }, 30_000)
   })
 })

apps/cli/tests/web-agent-presets.e2e.ts

@@ -22,6 +22,15 @@ const BASE_PATCH = join(REPO_ROOT, 'packages/bundle/base/cordis.patch.yml')
 const WEB_PATCH = join(REPO_ROOT, 'packages/bundle/web-app/cordis.patch.yml')
 /** The installation anchor whose dependency surface the preset module fallback mirrors. */
 const INSTALL_ANCHOR = join(REPO_ROOT, 'apps/cli/package.json')
+const MINIMAL_PROMPT = 'You are a helpful software engineer assistant.'
+const MINIMAL_BASH_DESCRIPTION = `Run commands in a bash shell
+* When invoking this tool, the contents of the "command" parameter does NOT need to be XML-escaped.
+* You don't have access to the internet via this tool.
+* You do have access to a mirror of common linux and python packages via apt and pip.
+* State is persistent across command calls and discussions with the user.
+* To inspect a particular line range of a file, e.g. lines 10-25, try 'sed -n 10,25p /path/to/the/file'.
+* Please avoid commands that may produce a very large amount of output.
+* Please run long lived commands in the background, e.g. 'sleep 10 &' or start a server in the background.`
 
 /**
  * Boot the shipped Web composition, minus the rows that would bind a port,
@@ -143,14 +152,20 @@ describe('the shipped Web composition', () => {
     }
   })
 
-  it('composes exactly two tools from `minimal`', async () => {
+  it('composes the exact RL prompt and two tools from `minimal`', async () => {
     const handle = await ctx.agents.create({
       sessionId: SessionId('preset-minimal'),
       setup: agentCtx => ctx.agentPresets.mount(agentCtx, 'minimal').then(() => undefined),
     })
     try {
-      // Exactly what the preset lists — nothing arrives from the host.
-      expect(toolNames(ctx, handle.agent)).toEqual(['bash', 'str_replace_editor'])
+      const assembly = await ctx.systemPrompt.assemble({ scope: handle.agent })
+      expect(assembly.sections).toEqual([
+        { name: 'deployment:persona', text: MINIMAL_PROMPT },
+      ])
+      expect(assembly.tools.map(tool => tool.name)).toEqual(['bash', 'str_replace_editor'])
+      expect(assembly.tools.find(tool => tool.name === 'bash')?.description).toBe(MINIMAL_BASH_DESCRIPTION)
+      expect(JSON.stringify(assembly.tools.find(tool => tool.name === 'str_replace_editor')?.parameters))
+        .toContain('Absolute path')
     } finally {
       await handle.dispose()
     }
@@ -340,15 +355,14 @@ describe('the shipped Web composition', () => {
     expect(await readFile(path, 'utf8')).toBe(before)
   })
 
-  it('gives each session its own persona', async () => {
+  it('gives each session its own complete persona', async () => {
     const handle = await ctx.agents.create({
       sessionId: SessionId('preset-persona'),
       setup: agentCtx => ctx.agentPresets.mount(agentCtx, 'minimal').then(() => undefined),
     })
     try {
       const assembly = await ctx.systemPrompt.assemble({ scope: handle.agent })
-      expect(assembly.sections.find(section => section.name === 'deployment:persona')?.text)
-        .toContain('You are a coding agent powered by')
+      expect(assembly.sections).toEqual([{ name: 'deployment:persona', text: MINIMAL_PROMPT }])
     } finally {
       await handle.dispose()
     }