极简模式会注入已安装插件的工具

[QianNianwen]

问题：已安装插件定义的工具会泄漏进极简模式的模型工具列表。极简模式应只暴露 str_replace_editor 与持久 shell（win32 下为 pwsh），实测却出现了全部插件工具。

复现：web profile 安装任一带工具的插件，切换到极简模式会话，查看发给模型的工具定义即可看到。

原因：插件工具注册在 tools 注册表的 global 层，而 agent preset 的 standing scope 会无条件继承 global 层，preset 没有任何排除继承工具的机制；插件挂载时也没有 agent/preset scope 可选，插件侧无从规避。

[argszero]

Good diagnosis — I verified the mechanism against the current source (dsh v0.1.3-alpha.1 / master d347e70390) and your analysis holds. Three confirmations:

1. The minimal preset's registrations ARE scoped, but they don't filter what the agent inherits globally.
packages/preset/agent-presets/presets/minimal/agent.cordis.yml mounts the shell + str_replace_editor under an isolate: group, so those tools register into the agent's own layer. But the tools registry resolves what an agent sees via the whole scope chain (packages/core/tools/src/index.ts, ToolRuntime.view()): it seeds inherited from this.layers.global.tools.entries() — the global layer — then walks the ancestor chain, and a name is visible unless every layer on the chain admits it.

2. Nothing in the preset composition registers a restrict() filter.
ToolRuntime.restrict(filter: {allow?, deny?}) (index.ts:1062) is the per-scope filter: it removes inherited global tools that aren't in allow / are in deny. But a grep across packages/preset/ finds no restrict() call — the preset machinery mounts registrations under a standing scope and parents the agent's scope key to it, but never issues a restriction. So the agent inherits every global tool, plugin tools included. That's the leak you described: the isolation is scoped, not a global-tool mask.

3. The isolate: in the preset is a different axis.
The preset's isolate: { terminals, fs } scopes services (PTY, filesystem) so the shell/editor live in an agent-owned realm — it doesn't restrict the tool registry's inherited surface. Two independent things.

Why this is hard to fix in-tree but tractable for a plugin: the clean fix is for the preset composition to apply a restrict({ allow: ['bash/pwsh', 'str_replace_editor', ...] }) on the agent's scope, OR expose a per-preset tool-filter (like the toolFilter already threaded through ContinuableSubagentDescriptorData / SubagentStartRequest). Neither exists on the preset mount path today, so it's a maintainers-only change. A plugin, though, can register exactly this on the agent/created hook: listen for the minimal preset selection and call tools.restrict(...) on the agent's agent.ctx to deny the plugin tool names — the restrict API is public and scoped, so it doesn't require patching the harness. I'm happy to sketch that plugin approach if it'd help; it's the community-side workaround for exactly this gap.

[argszero]

我确认了根因，并发布了一个社区插件来修复它。

根因（已在源码中验证）：minimal preset 只声明了 bash/pwsh/str_replace_editor，但预设组合从不对工具注册表调用 tools.restrict()。而 ToolRuntime.view() 会把全局层（layers.global.tools）以及作用域链上每一个祖先层当作 inherited 呈现给 agent——ToolRestriction 从不过滤它们。因此，任何安装的插件只要注册在全局层，就会被 minimal agent 继承。相关机制见 packages/core/tools/src/index.ts:673（ToolRestriction 接口）与 :1062（ToolRuntime.restrict）。

插件形态的修复：我发布了 @argszero/cordis-plugin-preset-tool-filter（npm latest，GitHub 公开仓库 argszero/cordis-plugin-preset-tool-filter）。

• 它订阅 agent/created，对任何 composedPreset 在 allowlists（默认 minimal）里的 agent，在其自己的作用域上下文上调用 tools.restrict({ allow })，从而掩蔽其它所有继承来的全局/祖先层工具。
• 该 restrict API 是公开且作用域化的，所以不需要给 harness 打补丁。这是现有公共接口上的一个插件式接线。
• 在 POSIX 上 pwsh 行被 minimal preset 禁用，所以插件会先探测每个候选名，只为实际可继承的名字构建 allow-list，避免 restrict 因缺席名抛错。

用法（cordis.yml）：

plugins:
  "@argszero/cordis-plugin-preset-tool-filter":
    allowlists:
      minimal: [bash, str_replace_editor]

说明：这个插件是社区侧竞态方案。上游如果在预设组合层面补上 restrict()（或者提供显式的 per-preset 工具白名单），那是更彻底的做法；插件只是在没有上游改动的情况下把现有公共 API 接进 preset 生命周期。