Merge remote-tracking branch 'origin/master' into codex/enforce-tool-cancellation

# Conflicts:
#	docs/event-producer-consumer.md
#	examples/acp-agent/tests/snapshots/bash-spill/session.jsonl
#	examples/acp-agent/tests/snapshots/escalation-approved/session.jsonl
#	examples/acp-agent/tests/snapshots/escalation-rejected/session.jsonl
#	examples/acp-agent/tests/snapshots/fs-escalation-approved/session.jsonl
#	examples/acp-agent/tests/snapshots/hook-cc-pretool-ask/session.jsonl
#	packages/context/workspace-context/tests/workspace-context.spec.ts
#	packages/core/agent/src/index.ts
#	packages/support/invariants/tests/invariants.spec.ts
#	packages/ui/acp/src/index.ts
#	packages/ui/tui/tests/harness.ts
#	packages/ui/tui/tests/tui.spec.ts

packages/ui/acp/src/index.ts

@@ -44,10 +44,15 @@ import {
   type Stream,
   type StopReason,
 } from '@agentclientprotocol/sdk'
-import type { ContentBlock, LlmCallConfig, LlmModelInfo, LlmProviderInfo } from '@deepseek-ai/dsh-llm'
+import type { ContentBlock, LlmModelInfo, LlmProviderInfo } from '@deepseek-ai/dsh-llm'
 import { assertNever, CallId } from '@deepseek-ai/dsh-llm'
 import type {} from '@deepseek-ai/dsh-llm-retry'
-import type { Agent } from '@deepseek-ai/dsh-agent'
+import {
+  installAgentLlmTarget,
+  type Agent,
+  type AgentLlmTarget as LlmTarget,
+  type AgentLlmTargetRef as LlmTargetRef,
+} from '@deepseek-ai/dsh-agent'
 import type {} from '@deepseek-ai/dsh-commands'
 import { SessionId } from '@deepseek-ai/dsh-session'
 // Side-effect type import: resolves `ctx.get('permission')` to the service.
@@ -258,19 +263,6 @@ export const Config: Schema<AcpConfig> = Schema.object({
   model: Schema.string(),
 })
 
-/** Provider/model pair selected for one ACP session. */
-interface LlmTarget {
-  provider: string
-  model: string
-}
-
-/** Mutable target shared by one agent's scoped assembly and request listeners. */
-interface LlmTargetRef {
-  current: LlmTarget | undefined
-  /** Step snapshot captured by prompt assembly so target switches cannot split prompt and request. */
-  assembled: LlmTarget | undefined
-}
-
 /** One resolved ACP model selector plus its opaque value lookup. */
 interface ModelDirectory {
   option: Extract<SessionConfigOption, { type: 'select' }> | undefined
@@ -338,32 +330,7 @@ export function apply(ctx: Context, config: AcpConfig): void {
     const logged = agent.session.requestHeader()?.config
     if (logged !== undefined) target.current = { provider: logged.provider, model: logged.model }
 
-    // Capture once at assembly entry and apply the same pair after downstream
-    // prompt listeners. A selector change during async assembly therefore takes
-    // effect on the following step instead of splitting {{model}} from routing.
-    agentCtx.on('system-prompt/assemble', async (_assembly, _context, next) => {
-      const selected = target.current
-      const assembled = await next()
-      target.assembled = selected
-      if (selected === undefined) return assembled
-      return {
-        ...assembled,
-        variables: {
-          ...assembled.variables,
-          provider: selected.provider,
-          model: selected.model,
-        },
-      }
-    })
-    agentCtx.on('agent/request', async (_agent, _turn, _step, _callConfig, _signal, next): Promise<LlmCallConfig> => {
-      const resolved = await next()
-      const selected = target.assembled
-      return selected === undefined ? resolved : {
-        ...resolved,
-        provider: selected.provider,
-        model: selected.model,
-      }
-    })
+    installAgentLlmTarget(agentCtx, target)
   }
 
   /** Opaque ACP value preserving both routing dimensions. */

packages/ui/acp/src/invariant.ts

@@ -0,0 +1,30 @@
+/**
+ * Package-owned invariant companion for `@deepseek-ai/dsh-acp`.
+ * @module @deepseek-ai/dsh-acp/invariant
+ */
+
+/* jscpd:ignore-start */
+import type { Context } from 'cordis'
+import type { InvariantInstaller } from '@deepseek-ai/dsh-invariants'
+
+const PACKAGE_NAME = '@deepseek-ai/dsh-acp'
+
+/** Cordis companion plugin name. */
+export const name = 'acp-invariant'
+/** Service required before the companion can reserve package ownership. */
+export const inject = ['invariants']
+
+/**
+ * No runtime invariant: this presentation adapter owns no durable package-local event stream;
+ * boundary and replay tests cover its protocol mapping.
+ */
+const install: InvariantInstaller = () => {}
+
+/**
+ * Register this package's invariant companion.
+ * @param ctx - Cordis context carrying the invariant service.
+ * @returns the installed registration's disposer after setup succeeds.
+ */
+export const apply = (ctx: Context): Promise<() => void> =>
+  Promise.resolve(ctx.invariants.register(PACKAGE_NAME, install))
+/* jscpd:ignore-end */