463b72ce96
Oversized plain-text tool results now spill to a session-scoped file and return a bounded preview plus the spill path, so a verbose result stays readable via `read` without consuming the next model request in full. - dsh-spill: minimal SpillFiles seam (saveText → session-scoped SpillPath) - dsh-spill-local: private 0700 session dirs, traversal-safe names, exclusive owner-only writes - dsh-spill-policy: tools/post-execute transformer; no-op unless maxInlineBytes is set; skips read; best-effort on save failure (never turns a success into an isError) web_fetch is the showcase — no tool-specific spill code. The coding-agent example loads the stack so its keyless Loader smoke guards the namespace-plugin export shape. Snapshot gap for a transcript-visible web_fetch spill is recorded in the RFC's Consequences (ACP replay is keyless and cannot hit the web).
1.6 KiB
1.6 KiB
@deepseek-ai/dsh-spill-local
The local-filesystem implementation of the @deepseek-ai/dsh-spill storage seam. Registers as ctx.spillFiles and persists a tool's oversized text to a private, session-scoped file the model's read tool can open.
Storage layout
Files land at <root>/session-<hash>/<random>-<safeName>:
root— the configroot(resolved to absolute), or a lazily-created private (0700) per-process directory under the OS temp dir when omitted. A predictable, world-readable root would let other local users read spilled tool output or plant symlinks.session-<hash>— a shortsha256(sessionId)prefix, so a session's spill files group together and a future cleanup can drop them per session.<random>-<safeName>— an unpredictable hex prefix (defeats symlink planting in a shared root) plus the caller'ssuggestedNamesanitized to one safe path segment (traversal-proof; mirrors the JSONL persistence backend'sencodeSegment). The write is exclusive + owner-only (open(path, 'wx', 0o600)): it fails on any pre-existing path, symlink or not, so a planted target cannot redirect it.
Config
| Key | Default | Meaning |
|---|---|---|
root |
private 0700 temp dir | Root directory for spill files. Set to keep them under a known location. |
saveText rejects on a real storage failure (permissions, ENOSPC); the spill policy treats a rejection as best-effort and keeps the inline result. See the seam README for the vocabulary and the tool output spill RFC for the design.