# oh-my-dsh's opinionated coding layer. Profiles compose this after
# @deepseek-ai/dsh-base and their mode bundle, so these complete row configs
# intentionally replace the conservative upstream defaults.

- id: system-prompt
  config:
    includeHarnessIdentity: true
    includeRuntimeContext: true
    persona: >-
      You are a pragmatic software-engineering agent powered by {{model}}, working in {{cwd}}.
      Inspect before editing, prefer the smallest correct change, preserve user work, and verify
      behavior with the narrowest relevant checks before claiming completion. Use semantic code
      navigation when text search is ambiguous. Keep the user informed only when progress,
      assumptions, or blockers materially change.

- id: tools
  config:
    mode: both
    maxParallelSubCalls: 10

- id: permission
  config:
    defaultPreset: workspace-write
    presets:
      read-only:
        sandbox: read-only
        approval: ask
      workspace-write:
        sandbox: workspace-write
        approval: ask
      danger-full-access:
        sandbox: danger-full-access
        approval: ask

- id: compaction-basic
  config:
    thresholdRatio: 0.78
    retainRatio: 0.2
    maxTokens: 8192
    compactionRetries: 1
    maxOverflowRetries: 1
    auto: true

- id: agent-instructions
  config:
    maxBytes: 98304
    maxSourceBytes: 1048576
    instructionFileCandidates:
      - AGENTS.md
      - CLAUDE.md
      - GEMINI.md
    localInstructionFileCandidates:
      - AGENTS.local.md
      - CLAUDE.local.md

# Prefer a configured third-party search provider, then DeepSeek's provider.
# Fetch routes through oh-my-dsh's SSRF-hardened provider by default.
- id: web
  config:
    searchProvider: !!js "process.env.DSH_WEB_SEARCH_PROVIDER ?? (process.env.EXA_API_KEY ? 'exa' : (process.env.PERPLEXITY_API_KEY ? 'perplexity' : 'deepseek-official'))"
    fetchProvider: !!js "process.env.DSH_WEB_FETCH_PROVIDER ?? 'omd-safe'"

# Fetch is on by default: private and reserved destinations are blocked at
# the network layer by omd-web-guard, which removes the reason upstream ships
# it disabled. OMD_DISABLE_WEB_FETCH=1 turns the tool off again.
- id: tool-web
  config:
    fetch: !!js "process.env.OMD_DISABLE_WEB_FETCH !== '1'"
    searchTimeoutMs: 60000
    fetchTimeoutMs: 60000

- insert:
    - id: omd-lsp
      name: '@deepseek-ai/dsh-lsp'

    - id: omd-proposals
      name: 'oh-my-dsh/proposals'

    # Distill session-verified procedures into durable skills; writes go
    # through the proposal plane and the upstream skill watcher picks them up.
    - id: omd-skill-forge
      name: 'oh-my-dsh/skill-forge'

    - id: omd-mcp-control
      name: 'oh-my-dsh/mcp-control'

    # Session-scoped curated plugins stay inert until an approved proposal
    # mounts one exact-pinned entry from the curated bank.
    - id: omd-plugin-control
      name: 'oh-my-dsh/plugin-control'

    # Agent-authored session plugins: full source rides an approval-gated
    # proposal; nothing is written or mounted without an approved apply.
    - id: omd-plugin-forge
      name: 'oh-my-dsh/plugin-forge'

    # Frozen-suite scoring: snapshot, run, compare, show. Does not apply
    # proposals or write the curated catalog.
    - id: omd-harness-eval
      name: 'oh-my-dsh/harness-eval'

    # Durable bandit over promote/forge/unload/save. Suggests only; never applies.
    - id: omd-harness-opt
      name: 'oh-my-dsh/harness-opt'

    # Read-only unified search across tools, skills, commands, MCP servers,
    # and curated plugins. Activation still goes through the control tools.
    - id: omd-capability-discovery
      name: 'oh-my-dsh/capability-discovery'

    - id: omd-refactor
      name: 'oh-my-dsh/refactor'

    - id: omd-lsp-auto
      name: 'oh-my-dsh/lsp-auto'

    - id: omd-tool-lsp
      name: '@deepseek-ai/dsh-tool-lsp'
      config:
        maxLocations: 100
        maxResultChars: 16000
        timeoutMs: 60000

    - id: omd-banner
      name: 'oh-my-dsh/banner'

    - id: omd-discovery
      name: 'oh-my-dsh/discovery'

    - id: omd-editor
      name: 'oh-my-dsh/editor'

    - id: omd-mentions
      name: 'oh-my-dsh/mentions'

    - id: omd-advisor
      name: 'oh-my-dsh/advisor'
      config:
        enabled: !!js Boolean(process.env.OMD_ADVISOR_PROVIDER && process.env.OMD_ADVISOR_MODEL)
        provider: !!js process.env.OMD_ADVISOR_PROVIDER ?? ''
        model: !!js process.env.OMD_ADVISOR_MODEL ?? ''

    - id: omd-notify
      name: 'oh-my-dsh/notify'
      config:
        minRunMs: 15000
        title: oh-my-dsh
        notifyApproval: true

    - id: omd-usage
      name: 'oh-my-dsh/usage'

    # SSRF-hardened fetch provider; guards shell curl/wget only when the
    # web_fetch tool has been disabled (silent-degradation interception).
    - id: omd-web-guard
      name: 'oh-my-dsh/web-guard'
      config:
        allowPrivateNetwork: !!js "process.env.OMD_WEB_FETCH_ALLOW_PRIVATE === '1'"
        guardShellFetch: !!js "process.env.OMD_DISABLE_WEB_FETCH === '1'"

    # Registers the launch directory as a workspace so the web UI's picker
    # starts where you are. Inert outside web profiles (no workspaceRegistry).
    - id: omd-workspace
      name: 'oh-my-dsh/workspace'

    - id: omd-kernel
      name: 'oh-my-dsh/kernel'

    # DAP debugging is capability-heavy; sessions stay proposal-gated even when enabled.
    - id: omd-debug
      name: 'oh-my-dsh/debug'
      disabled: !!js "process.env.OMD_ENABLE_DEBUG !== '1'"

    # Upstream opt-in: durable zoned time and elapsed time in model steps.
    - id: omd-time-context
      name: '@deepseek-ai/dsh-time-context'
      config:
        refreshIntervalMs: 60000

    # Optional search providers become active only when their key is present.
    - id: omd-web-search-exa
      name: '@deepseek-ai/dsh-web-search-exa'
      config:
        apiKey: !!js process.env.EXA_API_KEY

    - id: omd-web-search-perplexity
      name: '@deepseek-ai/dsh-web-search-perplexity'
      config:
        apiKey: !!js process.env.PERPLEXITY_API_KEY

    # Upstream anonymous fetcher, only for an explicit opt-out of the
    # hardened provider (it has no private-network protection).
    - id: omd-web-fetch-http
      name: '@deepseek-ai/dsh-web-fetch-http'
      disabled: !!js "process.env.DSH_WEB_FETCH_PROVIDER !== 'http'"