docs: trim generated prose

examples/sandbox-acp-agent/tests/acp.snapshot.ts

@@ -3,54 +3,20 @@ import { fileURLToPath } from 'node:url'
 import { defineAcpSnapshotSuite, type Scenario, type SnapshotSuiteOptions } from '@deepseek-ai/dsh-acp-snapshot'
 
 /**
- * Snapshot suite for the SANDBOXED composition (`../cordis.yml`, swapped to
- * the sibling `cordis.snapshot.yml` replay overlay by the bin under
- * `DSH_SNAPSHOT=replay`). Replay swaps only the MODEL for the recorded
- * transcript — every bash call re-executes for real under the host's actual
- * runner (Seatbelt on macOS, bwrap on Linux CI: ci.yml's snapshot lane
- * installs bubblewrap for exactly this), so the recorded scenarios double as
- * cross-backend confinement regression: an allowed command a runner change
- * starts denying fails replay outright. Their commands are limited to
- * `cat`/`printf` shapes whose bytes are identical across those backends and
- * across GNU/BSD userlands.
- *
- * Deliberately ABSENT: a scenario whose transcript carries a real sandbox
- * DENIAL. The harness-authored `[sandbox: file access denied …]` marker is
- * byte-stable, but the denied command's own stderr is the backend's dialect
- * (bwrap EROFS "Read-only file system", Landlock EACCES "Permission
- * denied", Seatbelt EPERM "Operation not permitted", GNU vs BSD phrasing on
- * top), and stderr reaches both compared surfaces — such a fixture replays
- * only on the platform that recorded it. The denial→marker path stays on
- * dsh-tool-bash's unit tests and the real-kernel sandbox e2e legs
- * (.github/workflows/sandbox.yml); the escalation scenarios below sidestep
- * it by having the USER assert the prior denial, so the recorded model
- * escalates without a platform-variant denial in the log.
+ * Snapshot suite for the sandboxed composition (`../cordis.yml`, swapped to the sibling
+ * `cordis.snapshot.yml` replay overlay by the bin under `DSH_SNAPSHOT=replay`).
  */
 const SCENARIOS: Scenario[] = [
-  // Protocol-only (keyless, authored): the session config-option surface
-  // this composition adds — both advertised selects on session/new, the
-  // complete refreshed state every session/set_config_option answers with,
-  // and both rejection shapes — as committed wire bytes. No bash runs, so
-  // this one still replays on runner-less hosts.
+  // Protocol-only (keyless, authored): the session config-option surface this composition adds
+  // — both advertised selects on session/new, the complete refreshed state every
+  // session/set_config_option answers with, and both rejection shapes — as committed wire
+  // bytes.
   { name: 'config-options', hasModelTurn: false, recorded: false },
-  // The runtime mode-switching arc, and NECESSARILY the pinned-header
-  // scenario: an approval-policy switch rewrites its prompt section, and the
-  // resulting request/header-delta is legal only in the pinning scenario
-  // (the factory's uniformity guard). The pin commits this composition's
-  // full header — persona, tool schemas WITH the escalation fields — plus
-  // the approval delta and its "changed by the user" notice verbatim. The
-  // SANDBOX switch is deliberately silent (no section, no notice — the
-  // sandbox RFC's visibility asymmetry): the recorded arc proves it by
-  // BEHAVIOR, a confined write landing under the switched mode with no
-  // header change.
+  // The runtime mode-switching arc, and NECESSARILY the pinned-header scenario: an
+  // approval-policy switch rewrites its prompt section, and the resulting request/header-delta
+  // is legal only in the pinning scenario (the factory's uniformity guard).
   { name: 'mode-switching', hasModelTurn: true, recorded: true, pinsHeader: true, expectedHeaderDeltas: 1 },
-  // The approval wire end-to-end, under the DEFAULT read-only/ask (a switch
-  // would emit a header-delta the uniformity guard forbids here): the
-  // escalating bash call streams, session/request_permission attaches to it
-  // (allow-once / reject-once), and the scripted answer drives each branch —
-  // an approved run executes CONFINED under the granted workspace-write; a
-  // rejected one executes nothing and fails with the deterministic
-  // rejection text.
+  // Pin both approval branches under the default read-only/ask policy.
   { name: 'escalation-approved', hasModelTurn: true, recorded: true },
   { name: 'escalation-rejected', hasModelTurn: true, recorded: true },
 ]

examples/sandbox-acp-agent/tests/escalation.e2e.ts

@@ -18,21 +18,6 @@ import {
 
 /**
  * examples/sandbox-acp-agent end to end.
- *
- * Keyless smoke: boot the REAL `cordis.yml` through the `dsh-acp-agent` bin as
- * an ACP subprocess and drive initialize + session/new — the real-Loader-path
- * guard (postmortem 0001) for THIS tree's export shapes, which now include the
- * sandbox executor AND the approval service. No prompt is sent, so neither the
- * model nor a sandbox runner is ever exercised.
- *
- * With-key escalation flow (self-skips without DEEPSEEK_API_KEY or a usable
- * platform runner): a scripted ACP client plays the human. The real model is
- * denied under `read-only`, escalates with `sandbox_permissions` +
- * `justification`, the bridge prompts THIS client over
- * `session/request_permission`, the client answers `allow-once`, and the
- * retried write must land ON DISK (world-verified). The session cwd is a temp
- * dir under the platform temp area, which `workspace-write` grants — so either
- * escalation target the model picks can land the write.
  */
 
 const binScript = fileURLToPath(new URL('../../../packages/ui/acp-agent/src/bin.ts', import.meta.url))
@@ -42,10 +27,8 @@ const tsxLoader = fileURLToPath(import.meta.resolve('tsx'))
 // tsconfig so the unbuilt `paths` map resolves (see examples/AGENTS.md).
 const repoTsconfig = fileURLToPath(new URL('../../../tsconfig.json', import.meta.url))
 
-// A usable confining runner, probed the same way the executor suites do:
-// bwrap on Linux, Seatbelt's sandbox-exec on macOS. Without one the strict
-// attempt would fail closed (SANDBOX_UNAVAILABLE) instead of producing the
-// denial this flow starts from.
+// A usable confining runner, probed the same way the executor suites do: bwrap on Linux,
+// Seatbelt's sandbox-exec on macOS.
 const hasBwrap = spawnSync('bwrap', ['--ro-bind', '/', '/', '--dev', '/dev', '--proc', '/proc', '--die-with-parent', '--', 'true'], {
   timeout: 5_000,
   stdio: 'ignore',
@@ -121,9 +104,8 @@ describe('sandbox-acp-agent keyless smoke (real cordis.yml via the Loader)', ()
     workdir = await mkdtemp(join(tmpdir(), 'sandbox-acp-smoke-'))
     spawned = spawnSandboxAcpAgent(workdir, 'reject-once')
     const { client } = spawned
-    // A dummy key boots the adapter; no prompt is ever sent, so no model call
-    // and no sandbox runner probe happen. This drives the fiber tree the same
-    // way an editor would, which is what catches a broken export/inject shape.
+    // A dummy key boots the adapter; no prompt is ever sent, so no model call and no sandbox
+    // runner probe happen.
     const init = await client.initialize({ protocolVersion: PROTOCOL_VERSION, clientCapabilities: {} })
     expect(init.protocolVersion).toBe(PROTOCOL_VERSION)
     const { sessionId } = await client.newSession({ cwd: workdir, mcpServers: [] })