feat(dsh): add structured iteration form and SSH execution

.gitattributes

@@ -10,3 +10,6 @@
 
 # Retain this upstream license's original CRLF Git blob bytes.
 /src/inferrsi/data/skill_library/frameworks/torch-npu/torch-npu/references/licenses/op-plugin-LICENSE.txt -text
+
+# Generated third-party SSH transport, with source and notices beside it.
+/plugins/inferrsi-dsh/vendor/ssh2.cjs linguist-generated=true linguist-vendored=true

README.md

@@ -136,7 +136,9 @@ python -m pip install "<download-directory>/inferrsi-<version>-py3-none-any.whl"
 ```
 
 For Codex, use the [standalone plugin ZIP](docs/codex-plugin.md#install-from-the-release-zip).
+For DeepSeek Harness, build and install the [native DSH bundle](docs/dsh-plugin.md).
 For openJiuwen WorkSwarm v0.2.7, use the [native plugin ZIP](docs/workswarm-plugin.md#download-and-install).
+
 For CLI development from this checkout:
 
 ```bash

plugins/inferrsi-dsh/cordis.patch.yml

@@ -0,0 +1,3 @@
+- insert:
+    - id: inferrsi-dsh
+      name: inferrsi-dsh

plugins/inferrsi-dsh/form.cjs

@@ -0,0 +1,71 @@
+const frameworks = ['auto', 'vllm', 'vllm-omni', 'sglang', 'pytorch', 'other'];
+const backends = ['gpu', 'npu'];
+const planes = ['harness', 'model', 'infra'];
+
+function taskFromForm(form, connection) {
+  const task = {};
+  const labels = {
+    repository: '目标仓库', model: '模型', objective: '优化目标',
+    framework: '推理框架', backend: '计算后端', plane: '本轮改动范围',
+    maxRounds: '最多迭代轮数', maxMinutes: '总时间预算',
+  };
+  for (const name of [
+    'repository', 'model', 'objective', 'framework', 'backend', 'plane', 'execution',
+    'device', 'acceptance', 'baseline', 'benchmark', 'quality', 'campaign', 'constraints',
+  ]) {
+    const value = form[name];
+    if (value !== undefined && typeof value !== 'string') {
+      throw new Error(`${labels[name] || name} 的格式无效。`);
+    }
+    task[name] = value?.trim() || null;
+  }
+  for (const name of ['repository', 'model', 'objective', 'plane']) {
+    if (!task[name]) throw new Error(`请填写${labels[name]}。`);
+  }
+  for (const [name, options] of Object.entries({ framework: frameworks, backend: backends, plane: planes })) {
+    if (!options.includes(task[name])) throw new Error(`请选择${labels[name]}。`);
+  }
+  if (!['local', 'remote'].includes(task.execution)) throw new Error('请选择本机或远程机器。');
+  if (task.execution === 'remote') {
+    if (!connection?.connectionId) throw new Error('请先测试并验证远程连接。');
+    task.remote = { connectionId: connection.connectionId };
+  }
+  for (const name of ['maxRounds', 'maxMinutes']) {
+    const value = form[name];
+    if (typeof value !== 'string' && typeof value !== 'number') {
+      throw new Error(`请填写${labels[name]}。`);
+    }
+    const number = Number(value);
+    if (!Number.isSafeInteger(number) || number <= 0) {
+      throw new Error(`${labels[name]}必须是正整数。`);
+    }
+    task[name] = number;
+  }
+  return task;
+}
+
+function buildPrompt(form, connection) {
+  const task = taskFromForm(form, connection);
+  return [
+    '请使用已安装的 InferRSI 技能，在本会话中执行下面的迭代优化任务。',
+    '这份请求由用户填写表单并点击“启动迭代”提交。按填写的仓库、改动范围和预算开展工作。',
+    '',
+    '任务参数',
+    '```json',
+    JSON.stringify({ schema_version: 1, ...task }, null, 2),
+    '```',
+    '',
+    '执行要求',
+    '1. 校验目标仓库和运行环境，读取仓库的 AGENTS.md，加载 InferRSI 技能并检查随包运行时。',
+    '   backend 表示 GPU 或 NPU 硬件类别。检查设备后再选择受支持的实际运行时后端。execution=remote 时，使用 inferrsi_remote 工具和 remote.connectionId，在已经测试的远程仓库内开展工作；通过 cli 操作运行随包 InferRSI，通过 dashboard 操作打开转发后的实时页面。',
+    '2. 从 acceptance 引用读取已有验收条件。字段为空时先检查仓库内相关计划和脚本，准备缺失项。冻结 baseline、工作负载、验证器和数值门槛后再开始候选实验。关键验收输入无法确定时说明缺口。',
+    '3. 在用户选择的 plane 范围内逐轮提出假设、修改、比较和决策。使用 maxRounds 限制优化迭代轮数，使用 maxMinutes 限制总时间。每轮中的 A/B 重复测量次数由冻结计划确定。到达预算后停止新实验并汇报当前证据。',
+    '4. 使用现有 InferRSI CLI 和目标仓库的基准、质量脚本。远程 run_script 必须传入 maxMinutes，远程长时间 cli 操作也传入该参数，按任务剩余总时间预算设置，不能为每次调用重新分配完整预算。保留现有用户改动，遵守已有资源和执行授权。复用已准备好的目标环境。',
+    '5. 使用明确的 campaign 记录目标、知识检索上下文、搜索空间、每轮假设、决策和 run_id 关联，保留失败、跳过和回滚记录。使用 campaign capture-context、campaign record 和 campaign log。',
+    '6. execution=remote 时通过 inferrsi_remote 的 dashboard 操作打开该 campaign 的实时页面，保留连接标识；本机模式通过随包启动器运行 dashboard --live --port 0 并保留服务进程标识。返回实际 URL，实时监控和历史轮次由现有 dashboard 展示。',
+    '7. 结论依据冻结验证器与运行证据，保留 PASS、FAIL、INCONCLUSIVE。服务性能结论需要相应 L4 或 campaign 定义的端到端证据。',
+    '8. 汇报完成的轮数、候选决策、证据目录、dashboard 链接、剩余缺口和下一步。',
+  ].join('\n');
+}
+
+module.exports = { taskFromForm, buildPrompt };

plugins/inferrsi-dsh/index.js

@@ -0,0 +1,29 @@
+import { readFileSync } from 'node:fs'
+import { dirname } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import remoteHost from './remote-host.cjs'
+
+export const name = 'inferrsi-dsh'
+export const inject = ['skills']
+
+export function apply(ctx) {
+  const path = fileURLToPath(new URL('./assets/inferrsi/SKILL.md', import.meta.url))
+  const skill = readFileSync(path, 'utf8')
+  const frontmatter = /^---\r?\n([\s\S]*?)\r?\n---\r?\n/u.exec(skill)
+  const description = frontmatter?.[1].match(/^description:[ \t]+([^\r\n]+)/mu)?.[1].trim()
+  const content = frontmatter && skill.slice(frontmatter[0].length)
+  if (!description || !content?.trim()) {
+    throw new Error('The bundled InferRSI skill requires a description and instructions.')
+  }
+  ctx.skills.register({
+    name: 'inferrsi',
+    description,
+    content,
+    source: 'runtime',
+    path,
+    resourceBase: { kind: 'directory', path: dirname(path) },
+  })
+  ctx.inject(['connection', 'tools'], bridge => {
+    remoteHost.installRemote(bridge, fileURLToPath(new URL('./runtime/', import.meta.url)))
+  })
+}

plugins/inferrsi-dsh/package.json

@@ -0,0 +1,21 @@
+{
+  "name": "inferrsi-dsh",
+  "version": "0.0.0",
+  "description": "InferRSI inference-engine research and evidence workflows for DeepSeek Harness",
+  "license": "Apache-2.0",
+  "type": "module",
+  "main": "index.js",
+  "exports": { ".": "./index.js", "./client": "./client.js" },
+  "files": ["index.js", "client.js", "remote.cjs", "remote-host.cjs", "remote-runtime.zip", "vendor", "cordis.patch.yml", "assets", "runtime"],
+  "engines": { "dsh": ">=0.2.1-rc.2 <0.2.2" },
+  "dsh": {
+    "bundle": { "patch": "./cordis.patch.yml" },
+    "client": {
+      "platform": "web",
+      "inject": [
+        "@deepseek-ai/dsh-client-ui-conversation",
+        "@deepseek-ai/dsh-client-ui-session"
+      ]
+    }
+  }
+}

plugins/inferrsi-dsh/remote-host.cjs

@@ -0,0 +1,107 @@
+const { createRemoteManager } = require('./remote.cjs');
+
+async function readBody(request) {
+  const reader = request.body?.getReader();
+  if (!reader) throw new Error('invalid_request');
+  const parts = [];
+  let size = 0;
+  try {
+    for (;;) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      size += value.byteLength;
+      if (size > 192 * 1024) throw new Error('request_too_large');
+      parts.push(Buffer.from(value));
+    }
+    return JSON.parse(Buffer.concat(parts).toString('utf8'));
+  } finally {
+    await reader.cancel().catch(() => {});
+    reader.releaseLock();
+  }
+}
+
+function installRemote(ctx, runtimeDir) {
+  const manager = createRemoteManager({ runtimeDir });
+  const lifetime = new AbortController();
+  const pending = new Set();
+  function track(promise) {
+    pending.add(promise);
+    promise.finally(() => pending.delete(promise)).catch(() => {});
+    return promise;
+  }
+  ctx.effect(() => async () => {
+    lifetime.abort();
+    await manager.dispose();
+    await Promise.allSettled([...pending]);
+  });
+  ctx.on('agent/disposed', ({ agent }) => {
+    track(Promise.resolve().then(() => manager.closeSession(agent.id))).catch(() => {});
+  });
+  ctx.on('session/disposed', session => {
+    track(Promise.resolve().then(() => manager.closeSession(session.id))).catch(() => {});
+  });
+  ctx.connection.fetch.register({
+    path: '/api/inferrsi/connection', methods: ['POST'], requestBody: 'buffered',
+    fetch: request => track((async () => {
+      try {
+        const body = await readBody(request);
+        // DSH admits only authenticated owner Peers to exact Fetch routes.
+        // This is the owner's selected session, not a caller identity credential.
+        if (typeof body.sessionId !== 'string' || body.sessionId.length > 256) {
+          throw new Error('invalid_session');
+        }
+        const signal = AbortSignal.any([request.signal, lifetime.signal]);
+        if (body.action === 'close') {
+          const result = await manager.close(body.sessionId, body.connectionId);
+          return Response.json(result, { headers: { 'Cache-Control': 'no-store' } });
+        }
+        if (body.action !== 'test') throw new Error('invalid_action');
+        const result = await manager.test(body.options, { sessionId: body.sessionId, signal });
+        if (result.connectionId && signal.aborted) {
+          await manager.close(body.sessionId, result.connectionId);
+          throw new Error('cancelled');
+        }
+        // A completed test transfers the connection to the session/plugin lifetime.
+        // Later HTTP cancellation must not close that established connection.
+        return Response.json(result, { headers: { 'Cache-Control': 'no-store' } });
+      } catch (error) {
+        return Response.json({ status: 'error', code: error.code || 'connection_failed',
+          message: '连接未完成，请核对主机、认证和服务器指纹后重试。' },
+        { status: 400, headers: { 'Cache-Control': 'no-store' } });
+      }
+    })()),
+  });
+  ctx.tools.register({
+    name: 'inferrsi_remote',
+    description: 'Operate on the SSH repository explicitly selected and tested in the InferRSI form. Credentials stay in the Host. Use cli for canonical InferRSI operations, dashboard for a local live-dashboard tunnel, list/read/write for scoped repository files, and run_script for the user-designated benchmark or quality script. run_script requires maxMinutes from the remaining task budget; cli accepts it optionally and cli run uses the smaller of it and --max-minutes. Fixed operations, not an execution sandbox: edited repository code and designated scripts run with the SSH user\'s permissions.',
+    parameters: {
+      type: 'object', additionalProperties: false,
+      properties: {
+        connectionId: { type: 'string' },
+        operation: { type: 'string', enum: ['list', 'read', 'write', 'run_script', 'cli', 'dashboard', 'close'] },
+        path: { type: 'string' }, content: { type: 'string' },
+        args: { type: 'array', items: { type: 'string' } },
+        script: { type: 'string', enum: ['benchmark', 'quality'] },
+        maxMinutes: { type: 'number', exclusiveMinimum: 0, maximum: 10080 },
+      },
+      required: ['connectionId', 'operation'],
+    },
+    output: {
+      schema: { type: 'object', additionalProperties: true },
+      render: (_args, value) => [{ type: 'text', text: JSON.stringify(value) }],
+    },
+    execute: (args, exec) => track((async () => {
+      if (!exec.agent?.id) throw new Error('This connection requires its owning Agent session.');
+      if (!args || typeof args.connectionId !== 'string' || typeof args.operation !== 'string') {
+        throw new Error('Invalid remote operation.');
+      }
+      if (args.operation === 'close') {
+        return manager.close(exec.agent.id, args.connectionId);
+      }
+      const signal = AbortSignal.any([exec.signal, lifetime.signal]);
+      return manager.run(exec.agent.id, args.connectionId, args, signal);
+    })()),
+  });
+}
+
+module.exports = { installRemote };