master's bilingual README pairing (new since this branch forked) covers
packages/core/tools and packages/client/runtime, whose EN sides this PR
edits. Translate the scheduling-contract sentences (bridge pool, SDK
overlap line, loop cross-reference, codeDispatches lifecycle) into the zh
sides — including the verbatim shared model-facing block — and re-record
both pairing records.
Master's layout block already sits exactly at the 1680-word ceiling; this
PR's one new line (the subprocess/ package group) is seven words the doc
genuinely needs, so the ceiling moves just far enough to admit it.
Master made bilingual pairing mandatory repo-wide; this PR's seam-split
edits to the tasks docs get their zh counterparts: a new pair for the
dsh-tasks-local README and minimal updates to the tasks core-data doc,
agent-spine-demo README, and the tasks family READMEs, with pairing
records re-recorded.
The sandbox note's deferred-phases plan for the Windows chain now points
at the proposed landstrip evaluation gate, so whoever picks up that rung
finds the pending evaluation. The landstrip note itself stays proposed;
this only tracks where the pending decision lives (a permitted
keep-implemented-notes-current edit). Mirrored in the .zh.md and the
pair re-recorded.
Two new keyless scenarios for the functionality master gained since this
lane's base (#644 websettings, #643 workspace browser rework), both zero
model calls:
- settings-chrome: the modal shell (sidebar-foot trigger aria states,
role=dialog, aria-current section switch to the deliberately empty
Models, Escape + close-button paths, dialog aria golden); the Appearance
row as the REAL theme gesture — retiring lifecycle-chrome's
TODO(web-theme-gesture): clicking 深色 runs aria-pressed -> persisted
dsh.theme -> body[data-ds-dark-theme] -> alias-token flip, survives
reload, and 'system' follows the emulated OS scheme both ways; the
Language row switches the settings-scoped copy to English (dsh.locale
persisted, survives reload) and restores zh. Intentional reloads tear
the SSE stream, so the spec drains exactly its own reconnect warnings —
the tripwire still fails on unexpected connection loss.
- workspace-management: create-by-name twice through the region-header
dialog (host-durable via ctx.workspace.list()); rename end to end —
hover-revealed row menu (the button is display:none until the row
hovers), duplicate-name pre-check (inline role=alert + disabled primary
before any wire call), then workspace.rename through the real RPC,
row update, host durability, reload survival; the flat 'In one list'
view (section label flips, group headers drop, dsh.workspace.view
persists across reload, grouped restored); the session hover card
(dwell to open, closes on pointer leave). The one session row reuses
seeded-history's committed seed — no new recording. Deliberately not
driven: the inert menu rows and drag reorder (deferred in the note
with re-entry triggers).
Agent Note gains scenarios 8-9 and the drag-reorder deferred item in both
languages; llm-replay README's zh side catches up with the { patches }
paragraph; pairings re-recorded.
Faithfulness pass from the translation review: 接入 over 搭乘, first-mention
disposition annotation, 原始的 Readable/Writable, 留在原地, 评审 over 审阅;
pairing records re-recorded.
An awaited waitForExit()/dispose() must hold the event loop open until the
tree really exits: with the liveness tick and the escalation timer unref'd,
a parent with no other live handles could exit claiming quiescence and
orphan the survivors it promised to reap. The escalation's pending SIGKILL
is a commitment; it self-bounds at graceMs. Module graph picks up the
subprocess-local -> timeout edge.
- Drop the AGENTS.md budget bump: trim filler words in the layout map
and command comments so the new convention line fits the existing
1680 ceiling (1679/1680; master was 1680/1680)
- timers/promises note: 'Replace both' -> all three sites, and add
pty-local to the acceptance criteria (EN+ZH)
- execa note: 17 value-taking options plus boolean flags, not 18 (EN+ZH)
- rejected roll-up: lsp-local src is ~1,800 lines, not 2,112 (EN+ZH)
- re-record the three touched i18n pairs
The scenario inspects the tools service API; the round-2 content-contract
JSDoc change shifted its rendered output. Keyless DSH_SNAPSHOT=refresh —
the resulting fixture is byte-identical to the one the shiki branch
already carries (the downstream trees were green for this reason).
CI per-file coverage flagged the new sandboxMode/approvalPolicy branches:
invalid-type cases in both session header validation tables, and a shared
persistence-contract case pinning that both backends round-trip the
baselines verbatim and keep absent fields ABSENT (presence is the signal
the policy owners branch on).
Responding to ds-review-bot round 2 on #662:
- LANG_ALIASES is a Map: an assistant-authored fence label like
constructor or __proto__ now misses (plain render) instead of resolving
an inherited object property and crashing shiki mid-conversation. Test
sweeps the inherited-key labels.
- The singleton is pre-warmed in a deferred task at plugin boot (the
~120-175ms engine+grammar construction long task moves off the first
finalized fence's render); the lazy path remains the correctness
fallback, and unref keeps non-browser imports from pinning the loop.
Agent Note updated (both languages).
Responding to ds-review-bot round 2 on #661:
- logWork is bounded: past maxParallelSubCalls pending shaped-append tasks
the ordered commit lane holds (Promise.race drains one), so a slow spill
backend backpressures the run instead of accumulating unbounded pending
I/O and retained results. Tasks self-remove on settlement; run
settlement still drains every task inside the open turn. New spill test
drives three oversized reads against a hung backend at cap 1 and proves
the third dispatch cannot start until a save drains.
- shapeDispatchLog's catch uses errorMessage() (total), so a thrown value
with a throwing toString cannot escape the containment and lose the
settle event.
- CodeDispatchLog.content documented as the RENDERED result projection
(native tool/result vocabulary), not what the program received — the
program gets the structured value; doc pair + type-equiv re-synced.
- New RECORDED tui-agent snapshot scenario code-mode-dispatch-spill: the
real Loader-visible composition (worker runtime + spill-local + policy)
drives an oversized bash sub-call end-to-end; replay proves the durable
dispatch copy is bounded to preview + locator while the program value
stays whole (the outer result carries just the line count).
Agent Note updated (both languages).
The cordis_inspect api surface embeds the SessionHeader declaration, which
gained sandboxMode/approvalPolicy; keyless refresh, model transcript
untouched.
Review fix (ds-review-bot critical #2 on #623): the first-turn event stamp
had a durability hole no turn anchoring can close — an idle SessionStart-
style injection persists a complete one-shot turn before any prompt turn
opens, so a crash in that window left a resumable-looking child with no
inherited policy, falling back to a possibly wider deployment default.
The captured overrides now ride the child's creation meta into its
immutable SessionHeader (sandboxMode/approvalPolicy, neutral strings at the
session boundary — the delegationDepth precedent), durable from the moment
the session exists: no listener ordering can starve the baseline and no
crash window can lose it. overrideOf(session) on both policy services
resolves fold(events past header.seedLength) ?? header baseline, validating
against the closed vocabulary on read; stampOverride and the prompt-submit
listener machinery are deleted. The header field rides both persistence
backends (JSONL header line; SQLite sessions columns, SCHEMA_VERSION 11 —
pre-release, no migration). pty-local reads through overrideOf so PTY
spawns see the baseline too.
Red-first: header-durability-before-any-turn test (the injection crash
window shape), baseline/seed-boundary/closed-vocabulary contract tests in
both service suites; the real-wall suite (race, veto, fork stale-seed,
grandchild) re-anchored on header assertions and green. The Agent Note's
Alternatives now records the superseded event-stamping iteration with the
review evidence; bilingual docs updated.
(A1) terminate()/dispose()/service teardown keyed on direct-child settlement
could leak a TERM-trapping descendant that outlived the leader (Codex
reproduced it with a disowned trap-SIGTERM helper). kill()/terminate() now
gate on tree liveness instead of outcome settlement; the SIGKILL escalation
timer survives settle (unref'd, re-probing the tree); dispose's tier
quiescence is whole-tree exit via a bounded waitForExit; the service's live
set releases handles only when their tree is gone, and its teardown awaits
tree exit. Three new suites pin the survivor scenarios end to end
(terminate, dispose, service teardown).
(A2) the escalation branch is now real tested behavior — its ignore is gone;
the one remaining signalTree guard ignore states why it is unreachable
through the handle verbs.
(A3) docs contradictions fixed: the impl README's stale POSIX-only bullet
now states the contained best-effort Windows tree story; the lsp-local
README no longer claims taskkill failures stay visible (containment + the
tree-liveness wait is the actual contract); the architecture tables (en+zh)
list all three consumer families.
(B1) OutputCollector keeps a byte-exact tail across uneven chunk boundaries
(trim the head chunk instead of dropping it whole) — the LSP diagnostic-tail
contract; pinned by a cross-chunk test.
(B2) the subagent-acp coverage ignore is narrowed to exactly the
never-settling success arm.
The automation-only ACP refactor (#586) removed the bridge's pendingSwitches
idle-preset anchoring the inheritance note cited as precedent. Replace the
dangling analogy with the load-bearing fact a reviewer actually needs: an
injection-triggered first turn (a SessionStart hook racing the prompt)
dispatches no prompt-submit and no model request, so the one-shot stamp
listener still lands before the child's first model request.
A repo-wide Not Invented Here audit (ten parallel domain surveys covering
every package group, scripts/, native/, vendor/ edges, python/, test
infrastructure, and CI) asked of each hand-rolled surface whether a
maintained external package or Node builtin deletes it with a net win.
Policy: new implemented process note records that a dependency which
genuinely deletes owned code is a preferred simplification (bar: net
deletion, health, boundary fit, settled seams stay); root AGENTS.md
carries the one-line rule and dsh-find-simplifications now surveys for
hand-rolled-where-a-dependency-exists candidates.
Findings, all bilingual from birth:
- proposed/simplification: eventsource-parser for llm-deepseek SSE,
node:timers/promises for three hand-rolled sleeps, turndown (or
minimal 'entities') for tool-web HTML->markdown, gate-script
consolidation onto mdast/parseArgs/globSync
- proposed/testing: execa + parseArgs + loadEnvFile + vi.waitFor for
hand-rolled test subprocess plumbing
- proposed/process: pnpm/action-setup for symmetric CI caching
- proposed/feature: evaluate landstrip before building a Windows
sandbox launcher
- rejected/simplification: ~30 swap verdicts recorded (vscode-jsonrpc,
p-retry, Ajv, write-file-atomic, msw, hono, better-sqlite3, wireit,
landstrip-for-linux, YAML consolidation, ...) so the survey is not
re-litigated from scratch
Also drops the stale prompt/ entry from the AGENTS.md layout map
(workspace instructions live in packages/context/workspace-context).
