# ACP coding agent with sandbox and approval composed. A retry carrying
# `sandbox_permissions` and `justification` becomes `session/request_permission`;
# “Allow once” grants only that command the wider mode.
# `dsh-acp-agent` loads no stdout logger or HMR because stdout carries ACP JSON-RPC.
# It loads the gitignored root `.env` on stderr before reading `DEEPSEEK_API_KEY`
# and optional `DEEPSEEK_BASE_URL` here.

# The DeepSeek adapter.
- id: llm-deepseek
  name: '@deepseek-ai/dsh-llm-deepseek'
  config:
    apiKey: !!js process.env.DEEPSEEK_API_KEY
    baseURL: !!js process.env.DEEPSEEK_BASE_URL
    models:
      - deepseek-v4-flash

# The provider probes bwrap, Landlock, then Seatbelt for each run. `read-only`
# is the fail-safe default; `workspace-write` permits `workspaceRoot` and the
# platform temp area. This root is fixed for the executor lifetime even though
# ACP sessions have distinct cwd values; per-session roots remain deferred in
# ../../docs/rfc/implemented/feature/2026-07-06-sandbox.md.
- id: sandbox
  name: '@deepseek-ai/dsh-sandbox-local'
- id: bash
  name: '@deepseek-ai/dsh-bash-sandbox'
  config:
    mode: read-only
    workspaceRoot: !!js process.cwd()

# `ctx.approval` supplies the escalation channel; the ACP bridge answers for its
# sessions by prompting the editor. Without an attached editor, every ask fails closed.
- id: approval
  name: '@deepseek-ai/dsh-user-approval'

# The app bundles the agent spine, JSONL persistence, ACP bridge, and approval answerer.
- id: acp-agent
  name: '@deepseek-ai/dsh-acp-agent'
  config:
    model: deepseek-v4-flash
    # Persistence root: $DSH_SNAPSHOT_SESSIONS_ROOT when the snapshot harness
    # sets it (so a record run's logs land where the harness harvests them),
    # else the local ./.sessions default.
    persistenceRoot: !!js process.env.DSH_SNAPSHOT_SESSIONS_ROOT ?? './.sessions'
    persona: |
      You are a coding assistant powered by the {{model}} model. Your working directory is {{cwd}}. Your bash tool runs under a file sandbox — a `[sandbox: file access denied …]` result is policy, not a command bug.

      Verify your work by running the code or tests. Keep answers brief and factual.