1fe2f99580
A ModeDefinition is now exactly { section, access? }; unknown keys (a
tools list included) fail loud at load. What plan mode still does: the
guidance section, the exit_plan_mode visibility rule (plan only, both
soft surfaces), the access cap's bash/resolve-mode clamp, and the two
cap-derived pre-execute guards (the bash trio is withheld when no
confining executor can honor the cap; sandbox escalation is denied
while it holds). The general deny-by-default gate and the assemble
allowlist filter are gone: which tools a mode admits is an effects
question, and a hand-maintained name list mislabels it — it must track
every composed tool and rots silently as tools arrive. The dimension
returns as a consumer of effects self-declaration on tool definitions
(MCP ToolAnnotations as the template) — rationale and restart trigger
archived in the RFC's Alternatives/Deferred; the interim guidance-only
non-shell restraint is priced in Consequences.
Exiting plan is now a pure removal (the exit tool + section), which the
delta encoding CAN express: the re-recorded plan-mode fixture pins one
plan-shaped initial header snapshot plus one header-delta instead of
two snapshots.
102 lines
4.5 KiB
YAML
102 lines
4.5 KiB
YAML
# The plan-acp-agent plugin tree: the coding agent served over the Agent
|
|
# Client Protocol WITH session modes composed — the plan-mode RFC's live
|
|
# composition. The editor's mode picker (session/set_mode) switches the
|
|
# session between `default` and `plan`; in plan mode the model works under
|
|
# the plan guidance section with bash clamped to a read-only sandbox by plan
|
|
# mode's `access` cap, and leaves through the user-reviewed exit_plan_mode
|
|
# tool (the review rides the same elicitation flow as ask_user_question).
|
|
#
|
|
# CRITICAL: this tree loads NO stdout logger and NO hmr — stdout is reserved
|
|
# for the ACP JSON-RPC protocol (a property of @deepseek-ai/dsh-acp-agent,
|
|
# same as examples/acp-agent).
|
|
#
|
|
# Requires DEEPSEEK_API_KEY (and optionally DEEPSEEK_BASE_URL) — the
|
|
# dsh-acp-agent bin loads the gitignored repo-root .env first (on STDERR only).
|
|
|
|
# The DeepSeek adapter.
|
|
- id: llm-deepseek
|
|
name: '@deepseek-ai/dsh-llm-deepseek'
|
|
config:
|
|
apiKey: !!js process.env.DEEPSEEK_API_KEY
|
|
baseURL: !!js process.env.DEEPSEEK_BASE_URL
|
|
models:
|
|
- deepseek-v4-flash
|
|
|
|
# The ACP server app: the agent-core spine + JSONL persistence + the ACP
|
|
# bridge (which advertises the mode picker and answers the plan review).
|
|
- id: acp-agent
|
|
name: '@deepseek-ai/dsh-acp-agent'
|
|
config:
|
|
model: deepseek-v4-flash
|
|
# Persistence root: $DSH_SNAPSHOT_SESSIONS_ROOT when the snapshot harness
|
|
# sets it (so a record run's logs land where the harness harvests them),
|
|
# else the local ./.sessions default.
|
|
persistenceRoot: !!js process.env.DSH_SNAPSHOT_SESSIONS_ROOT ?? './.sessions'
|
|
persona: |
|
|
You are a coding assistant powered by the {{model}} model. Your working directory is {{cwd}}. Your bash tool runs under a file sandbox — a `[sandbox: file access denied …]` result is policy, not a command bug.
|
|
|
|
Verify your work by running the code or tests. Keep answers brief and factual.
|
|
|
|
# Session modes (ctx.modes — the shipped `plan` definition, no overrides):
|
|
# the mode/set vocabulary, the mode section, the exit_plan_mode tool, and
|
|
# plan's read-only `access` cap on the sandbox stack below. The ACP bridge
|
|
# above reads it opportunistically and advertises the picker.
|
|
- id: mode
|
|
name: '@deepseek-ai/dsh-mode'
|
|
|
|
# The sandbox stack: the platform-runner provider (bwrap → per-platform
|
|
# Landlock launcher → Seatbelt, functionally probed), then the confined bash
|
|
# executor. workspace-write is the day-to-day default; plan mode's `access`
|
|
# cap clamps every call to read-only while it is in force — which is exactly
|
|
# what keeps the bash tools AVAILABLE in plan mode: exploration commands run,
|
|
# a write is denied by the sandbox. The cap and the session's own
|
|
# sandbox-mode knob compose at read time (neither writes the other), so a
|
|
# knob switched during plan re-emerges intact on exit. NOTE: the workspace
|
|
# root is CONFIG-FIXED for the executor's lifetime (the launch dir here),
|
|
# while each ACP session has its own cwd — a per-session root is config-phase
|
|
# future work in the sandbox RFC.
|
|
- id: sandbox
|
|
name: '@deepseek-ai/dsh-sandbox-local'
|
|
- id: bash
|
|
name: '@deepseek-ai/dsh-bash-sandbox'
|
|
config:
|
|
mode: workspace-write
|
|
workspaceRoot: !!js process.cwd()
|
|
|
|
- id: tool-bash
|
|
name: '@deepseek-ai/dsh-tool-bash'
|
|
|
|
# The approval seam (ctx.approval — mechanism only, no config): the confined
|
|
# executor makes tool-bash advertise the escalation fields, and this seam is
|
|
# what lets an escalating retry actually reach the editor as a
|
|
# session/request_permission prompt. In plan mode the `access` cap denies
|
|
# escalation outright — the widened step belongs in the plan.
|
|
- id: approval
|
|
name: '@deepseek-ai/dsh-user-approval'
|
|
|
|
# The model-facing ask_user_question tool: the plan section tells the model
|
|
# to raise a blocking decision to the user while planning; the review and
|
|
# the questions ride the same elicitation flow.
|
|
- id: tool-ask-user
|
|
name: '@deepseek-ai/dsh-tool-ask-user'
|
|
|
|
# Filesystem capability stack: local provider, read-before-write/edit policy
|
|
# gate, then the model-facing read/write/edit tools. Plan mode restrains
|
|
# these by guidance only (the section says changes belong in the plan) — the
|
|
# enforced boundary in plan is the bash sandbox clamp above.
|
|
- id: fs-local
|
|
name: '@deepseek-ai/dsh-fs-local'
|
|
config:
|
|
cwd: !!js process.cwd()
|
|
|
|
- id: fs-policy
|
|
name: '@deepseek-ai/dsh-fs-policy'
|
|
|
|
- id: tool-fs
|
|
name: '@deepseek-ai/dsh-tool-fs'
|
|
|
|
# The model-facing todo_write tool — the model tracks its plan while
|
|
# exploring.
|
|
- id: tool-todo
|
|
name: '@deepseek-ai/dsh-tool-todo'
|