Merge origin/master into feat/plan-mode

examples/plan-acp-agent/cordis.yml

@@ -1,88 +1,62 @@
-# The plan-acp-agent plugin tree: the coding agent served over the Agent
-# Client Protocol WITH session modes composed — the plan-mode RFC's live
-# composition. The editor's mode picker (session/set_mode) switches the
-# session between `default` and `plan`; in plan mode the model works under
-# the plan guidance section and leaves through the user-reviewed
-# exit_plan_mode tool (the review rides the same elicitation flow as
-# ask_user_question). The mode never touches the sandbox or approval knobs —
-# collaboration mode and enforcement are independent axes, switched
-# separately and in any order.
-#
-# CRITICAL: this tree loads NO stdout logger and NO hmr — stdout is reserved
-# for the ACP JSON-RPC protocol (a property of @deepseek-ai/dsh-acp-demo,
-# same as examples/acp-agent).
-#
-# Requires DEEPSEEK_API_KEY (and optionally DEEPSEEK_BASE_URL) — the
-# dsh-acp-demo bin loads the gitignored repo-root .env first (on STDERR only).
+# ACP reserves stdout for JSON-RPC, so this tree loads no stdout logger or HMR.
+# Collaboration mode remains independent from the sandbox and approval knobs.
 
-# The DeepSeek adapter.
 - id: llm-deepseek
   name: '@deepseek-ai/dsh-llm-deepseek'
   config:
     apiKey: !!js process.env.DEEPSEEK_API_KEY
     baseURL: !!js process.env.DEEPSEEK_BASE_URL
     models:
-      - deepseek-v4-flash
+      - id: deepseek-v4-flash
 
-# The ACP server app: the agent-core spine + JSONL persistence + the ACP
-# bridge (which advertises the mode picker and answers the plan review).
 - id: acp-agent
   name: '@deepseek-ai/dsh-acp-demo'
   config:
+    provider: deepseek
     model: deepseek-v4-flash
-    # Keep this example's prompt fixed to its explicit persona; workspace
-    # instructions are demonstrated by a separate composition.
     workspaceContext: false
     # Persistence root: $DSH_SNAPSHOT_SESSIONS_ROOT when the snapshot harness
     # sets it (so a record run's logs land where the harness harvests them),
     # else the local ./.sessions default.
     persistenceRoot: !!js process.env.DSH_SNAPSHOT_SESSIONS_ROOT ?? './.sessions'
+    persistenceCompression: !!js "process.env.DSH_SNAPSHOT === undefined ? 'zstd' : 'none'"
     persona: |
       You are a coding assistant powered by the {{model}} model. Your working directory is {{cwd}}. Your bash tool runs under a file sandbox — a `[sandbox: file access denied …]` result is policy, not a command bug.
 
       Verify your work by running the code or tests. Keep answers brief and factual.
 
-# Session modes (ctx.modes — the shipped `plan` definition, no overrides):
-# the mode/set vocabulary, the mode section, and the exit_plan_mode tool.
-# The ACP bridge above reads it opportunistically and advertises the picker.
+# Session modes: dsh-mode owns logged state, built-in plan guidance, and the
+# plan-only exit tool.
 - id: mode
   name: '@deepseek-ai/dsh-mode'
 
-# The sandbox stack: the platform-runner provider (bwrap → per-platform
-# Landlock launcher → Seatbelt, functionally probed), then the confined bash
-# executor. workspace-write is the day-to-day default; it applies identically
-# in every mode — plan mode does not change it. A user who wants a hard
-# read-only floor while planning switches the sandbox-mode option to
-# read-only, independently of the mode picker, in either order. NOTE: the
-# workspace root is CONFIG-FIXED for the executor's lifetime (the launch dir
-# here), while each ACP session has its own cwd — a per-session root is
-# config-phase future work in the sandbox RFC.
+# One shared sandbox policy serves bash and filesystem tools in every mode.
 - id: sandbox
   name: '@deepseek-ai/dsh-sandbox-local'
-- id: bash
-  name: '@deepseek-ai/dsh-bash-sandbox'
+
+- id: sandbox-policy
+  name: '@deepseek-ai/dsh-sandbox-policy'
   config:
     mode: workspace-write
     workspaceRoot: !!js process.cwd()
 
-# The approval seam (ctx.approval — mechanism only, no config): the confined
-# executor makes tool-bash advertise the escalation fields, and this seam is
-# what lets an escalating retry actually reach the editor as a
-# session/request_permission prompt — in plan mode exactly as in default.
+- id: bash
+  name: '@deepseek-ai/dsh-bash-sandbox'
+  config:
+    timeoutMs: 60000
+
 - id: approval
   name: '@deepseek-ai/dsh-user-approval'
 
-# The model-facing ask_user_question tool: the plan section tells the model
-# to raise a blocking decision to the user while planning; the review and
-# the questions ride the same elicitation flow.
+- id: permission
+  name: '@deepseek-ai/dsh-permission'
+
 - id: tool-ask-user
   name: '@deepseek-ai/dsh-tool-ask-user'
 
-# Filesystem capability stack: local provider, read-before-write/edit policy
-# gate, then the model-facing read/write/edit tools. Plan mode restrains
-# these by guidance only — the section says changes belong in the plan.
-- id: fs-local
-  name: '@deepseek-ai/dsh-fs-local'
+# The filesystem provider enforces the shared policy; plan mode is guidance-only.
+- id: fs-sandbox
+  name: '@deepseek-ai/dsh-fs-sandbox'
   config:
     cwd: !!js process.cwd()
 
@@ -92,7 +66,6 @@
 - id: tool-fs
   name: '@deepseek-ai/dsh-tool-fs'
 
-# The model-facing todo_write tool — the model tracks its plan while
-# exploring.
+# Model-facing task tracking remains composed in both modes.
 - id: tool-todo
   name: '@deepseek-ai/dsh-tool-todo'