refactor(agent-presets,web): copy-only preset authoring with a path to the files

The web YAML editor is gone. agentPreset.write (arbitrary composition
text) became agentPreset.copy { from, agentPreset, name? }: a host-side
whole-directory copy of ids the host resolves itself — symlinks
dereferenced, modes re-tightened to owner-only with owner-execute kept,
metadata rewritten to keep the source's description but never its name or
roster order. No composition text or path crosses the wire in either
authoring direction, and the entryListSchema/!!js concern dissolves with
assertComposition itself.

The settings section becomes: a read-only viewer over shipped
compositions, a copy dialog (id + optional display name) as the only
create entry, delete for custom rows, and a location action leading into
the preset's own files — agentPreset.openDocument { agentPreset } resolves
the directory host-side and opens it natively, or answers
{ opened: false, path } for the row to show as text where the deployment
has no desktop. agentPreset.list reports hasDocument beside authorable;
the gateway's nativeOpen config pins the capability where
canOpenNativePath platform detection would mislead. The privileged set is
now read/copy/openDocument/remove.

With files as the only composition editor, standing mounts grew
stamp-keyed generations: ensureStanding compares the composition file's
mtime+size and starts the next generation for later sessions, while every
joined session keeps the generation it runs on.

New keyless web lane (agent-preset-authoring, overlay pins
nativeOpen: false so goldens render one branch on every platform) drives
view/copy/reveal/delete end to end; the real-composition CLI e2e switches
to copy semantics.

packages/host/apiproxy/src/api/agent-presets.schema.ts

@@ -26,6 +26,7 @@ export const agentPresetListRequestSchema = z.object({
 export const agentPresetListValueSchema = z.object({
   presets: z.array(agentPresetEntrySchema),
   authorable: z.boolean(),
+  hasDocument: z.boolean(),
 }) satisfies z.ZodType<Wire<ResponseValue<'agentPreset.list'>>>
 
 /** agentPreset.select request payload. */
@@ -49,23 +50,32 @@ export const agentPresetReadValueSchema = z.object({
   agentPreset: z.string(),
   trust: z.union([z.literal('system'), z.literal('user')]),
   content: z.string(),
-  writable: z.boolean(),
   name: z.string().optional(),
   description: z.string().optional(),
 }) satisfies z.ZodType<Wire<ResponseValue<'agentPreset.read'>>>
 
-/** agentPreset.write request payload. */
-export const agentPresetWriteRequestSchema = z.object({
+/** agentPreset.copy request payload. */
+export const agentPresetCopyRequestSchema = z.object({
+  from: z.string().min(1),
   agentPreset: z.string().min(1),
-  content: z.string(),
   name: z.string().optional(),
-  description: z.string().optional(),
-}) satisfies z.ZodType<Wire<RequestPayload<'agentPreset.write'>>>
+}) satisfies z.ZodType<Wire<RequestPayload<'agentPreset.copy'>>>
 
-/** agentPreset.write response value. */
-export const agentPresetWriteValueSchema = z.object({
+/** agentPreset.copy response value. */
+export const agentPresetCopyValueSchema = z.object({
   agentPreset: z.string(),
-}) satisfies z.ZodType<Wire<ResponseValue<'agentPreset.write'>>>
+}) satisfies z.ZodType<Wire<ResponseValue<'agentPreset.copy'>>>
+
+/** agentPreset.openDocument request payload. */
+export const agentPresetOpenDocumentRequestSchema = z.object({
+  agentPreset: z.string().min(1),
+}) satisfies z.ZodType<Wire<RequestPayload<'agentPreset.openDocument'>>>
+
+/** agentPreset.openDocument response value. */
+export const agentPresetOpenDocumentValueSchema = z.union([
+  z.object({ opened: z.literal(true) }),
+  z.object({ opened: z.literal(false), path: z.string() }),
+]) satisfies z.ZodType<Wire<ResponseValue<'agentPreset.openDocument'>>>
 
 /** agentPreset.remove request payload. */
 export const agentPresetRemoveRequestSchema = z.object({

packages/host/apiproxy/src/api/agent-presets.ts

@@ -3,10 +3,10 @@
  * session, plus the authoring calls behind it.
  *
  * `list` is ordinary: it carries ids and trust, and every preset picker needs
- * it. Everything else is privileged and loopback-pinned — a composition names
- * the plugins a session runs, so reading one is reconnaissance, writing one is
- * arbitrary capability, and selecting one can move a session onto a preset
- * that edits the live runtime.
+ * it. The authoring calls are privileged and loopback-pinned — a composition
+ * names the plugins a session runs, so reading one is reconnaissance, and
+ * although authoring is copy-only (no caller supplies composition text or a
+ * path), copying and deleting still rearrange what the deployment offers.
  */
 
 import type { SessionId } from '@deepseek-ai/dsh-session/types'
@@ -45,11 +45,13 @@ export interface AgentPresetsApi {
    * shipped ids.
    * An empty roster means the deployment composes no presets at all, and
    * every session shares the host composition. `authorable` reports whether
-   * the deployment configures a root new presets can be written to, which is
-   * a deployment fact rather than a per-preset one.
+   * the deployment configures a root new presets can be written to, and
+   * `hasDocument` whether `openDocument` can hand a preset directory to a
+   * native opener — both deployment facts rather than per-preset ones, and
+   * neither exposes a Host path.
    */
   list(request: RpcRequest<{}>):
-  Promise<RpcResponse<{ presets: readonly AgentPresetEntry[]; authorable: boolean }>>
+  Promise<RpcResponse<{ presets: readonly AgentPresetEntry[]; authorable: boolean; hasDocument: boolean }>>
 
   /**
    * Recompose one session's agent from a different preset.
@@ -63,29 +65,45 @@ export interface AgentPresetsApi {
   Promise<RpcResponse<{ agentPreset: string }>>
 
   /**
-   * Read one preset's composition text, for an editor.
+   * Read one preset's composition text, for the read-only viewer.
    *
-   * Privileged: a composition names the plugins a session runs, so reading one
-   * is reconnaissance and writing one is arbitrary capability.
+   * Privileged: a composition names the plugins a session runs, so reading
+   * one is reconnaissance.
    */
   read(request: RpcRequest<{ agentPreset: string }>):
   Promise<RpcResponse<{
     agentPreset: string
     trust: 'system' | 'user'
     content: string
-    writable: boolean
     name?: string
     description?: string
   }>>
 
   /**
-   * Create or replace a locally authored preset. Shipped presets are refused;
-   * the text is shape-checked before it lands, so a save cannot leave a file no
-   * session could load.
+   * Create a locally authored preset by copying an existing one whole.
+   *
+   * The only authoring write. No composition text and no path crosses the
+   * wire: `from` and `agentPreset` are ids the Host resolves against its own
+   * roots, so a copy is exactly as loadable as its source and grants nothing
+   * the roster did not already carry. The copy keeps the source's description
+   * (the file is the author's to edit afterwards) but not its name — `name`
+   * here or the id fallback is what distinguishes the rows.
    */
-  write(request: RpcRequest<{ agentPreset: string; content: string; name?: string; description?: string }>):
+  copy(request: RpcRequest<{ from: string; agentPreset: string; name?: string }>):
   Promise<RpcResponse<{ agentPreset: string }>>
 
+  /**
+   * Hand one locally authored preset's DIRECTORY to the platform opener, for
+   * editing the files that are now the only composition editor. The request
+   * carries an id, never a path — the Host resolves it — so no browser
+   * payload can select an arbitrary filesystem target. Where the deployment
+   * has no native opener (`hasDocument: false` on `list`), the reply carries
+   * the resolved directory for the surface to show as text instead. Shipped
+   * presets are refused: their install is not the user's to manage.
+   */
+  openDocument(request: RpcRequest<{ agentPreset: string }>, signal: AbortSignal):
+  Promise<RpcResponse<{ opened: true } | { opened: false; path: string }>>
+
   /** Delete a locally authored preset. Shipped presets are refused. */
   remove(request: RpcRequest<{ agentPreset: string }>): Promise<RpcResponse<{}>>
 }

packages/host/apiproxy/src/api/rpc-map.ts

@@ -54,7 +54,8 @@ export interface RpcMethodMap {
   'agentPreset.list': AgentPresetsApi['list']
   'agentPreset.select': AgentPresetsApi['select']
   'agentPreset.read': AgentPresetsApi['read']
-  'agentPreset.write': AgentPresetsApi['write']
+  'agentPreset.copy': AgentPresetsApi['copy']
+  'agentPreset.openDocument': AgentPresetsApi['openDocument']
   'agentPreset.remove': AgentPresetsApi['remove']
   'goal.create': GoalsApi['create']
   'goal.edit': GoalsApi['edit']