kingwl
2dc62497ce
feat(sandbox): cross-family file sandbox — one policy home, sandboxed fs provider, fs escalation parity
...
Extend SandboxMode enforcement from bash to the filesystem tools, the sandbox
RFC's deferred cross-family phase.
- dsh-sandbox-policy (new, ctx.sandboxPolicy): the single home for the
deployment default mode + workspaceRoot and the per-session override event,
renamed bash/sandbox-mode -> sandbox/mode and moved here with its fold/setter.
Decouples the bash seam from dsh-session.
- dsh-fs-sandbox (new): SandboxedFileSystem extends LocalFileSystem and fences
write/edit by the per-call mode (read-only denies, workspace-write contains to
the workspace + temp roots via the shared writableRoots, danger passes
through); reads pass through. Structured FS_SANDBOX_DENIED; in-lock parent
re-canonicalization. A policy fence in trusted code, not a kernel boundary.
- dsh-sandbox: the shared escalation kit (writableRoots, the strictly-wider
ladder, denial/hint markers, approveEscalation) both tool families use;
approveEscalation takes a structural approver so dsh-sandbox gains no
approval/agent dependency, and both tools stay duplication-free.
- tool-fs: write/edit advertise sandbox_permissions/justification under a
confining ctx.fs, map FS_SANDBOX_DENIED to the shared [sandbox: ...] marker,
and resolve the same one-approved-wider retry.
- examples/acp-agent: composes sandbox-policy + fs-sandbox, drops the gating
that disabled the fs stack under confined modes.
RFC docs/rfc/implemented/feature/2026-07-14-cross-family-fs-sandbox.md; the old
sandbox RFC's In-process/deferred/FAQ sections updated to shipped fact.
2026-07-14 20:05:57 +08:00
Tianyi Cui
d409bb23ba
Merge branch 'codex/simp-shared-acp-test-launcher' into codex/simp-trim-hook-snapshot-noise
2026-07-14 20:03:57 +08:00
Tianyi Cui
b09efae186
Merge branch 'codex/simp-snapshot-fixture-inventory' into codex/simp-shared-acp-test-launcher
2026-07-14 20:03:57 +08:00
Tianyi Cui
9524122c0c
Merge branch 'codex/simp-agent-entry-state' into codex/simp-unify-agent-session-id
2026-07-14 20:03:57 +08:00
Tianyi Cui
cdb87fbefb
Merge branch 'codex/simp-session-log-representation' into codex/simp-snapshot-fixture-inventory
2026-07-14 20:03:56 +08:00
Tianyi Cui
b12b5f8a95
test: refresh permission-switching header snapshot
2026-07-14 20:03:28 +08:00
Yichen Jiang
ee111fd978
Merge remote-tracking branch 'origin/master' into codex/project-instruction-files
...
# Conflicts:
# AGENTS.md
# docs/config-catalog.md
# docs/cordis-catalog/events.md
# docs/cordis-catalog/services.md
# docs/core-data-structures/core.md
# docs/event-producer-consumer.md
# docs/persistence-catalog.md
# docs/rfc/implemented/architecture/2026-07-05-reconstructable-requests.md
# docs/rfc/implemented/feature/2026-06-15-code-mode.md
# docs/rfc/implemented/feature/2026-06-30-hook-bridges.md
# docs/rfc/implemented/feature/2026-06-30-interception-seams.md
# docs/rfc/implemented/feature/2026-07-08-repeat-tool-guard.md
# docs/rfc/proposed/simplification/2026-07-04-prune-dead-core-spine-surface.md
# examples/AGENTS.md
# examples/acp-agent/cordis.yml
# examples/acp-agent/tests/acp.snapshot.ts
# examples/echo-agent/cordis.yml
# examples/sandbox-acp-agent/cordis.yml
# packages/cordis/tool-cordis/src/api-catalog.ts
# packages/core/agent-core/README.md
# packages/core/agent-core/src/index.ts
# packages/core/agent-loop/README.md
# packages/core/agent-loop/src/loop.ts
# packages/core/agent-loop/tests/interception.spec.ts
# packages/core/agent/src/types.ts
# packages/core/tools/README.md
# packages/core/tools/src/code-mode.ts
# packages/core/tools/src/index.ts
# packages/fs/fs-local/src/index.ts
# packages/fs/fs/README.md
# packages/fs/fs/src/index.ts
# packages/guard/repeat-tool-guard/README.md
# packages/guard/repeat-tool-guard/src/index.ts
# packages/hooks/hooks-claude/src/index.ts
# packages/hooks/hooks-codex/src/index.ts
# packages/ui/acp-agent/src/index.ts
2026-07-14 19:50:25 +08:00
Tianyi Cui
087ea9f866
Merge branch 'codex/simp-ui-identity-residue' into codex/simp-hide-concrete-agent-loop
2026-07-14 19:30:53 +08:00
Tianyi Cui
5409452cc7
test: refresh snapshots after master merge
2026-07-14 19:30:29 +08:00
Tianyi Cui
59c5010283
Merge branch 'codex/simp-prune-tools-prompt-surface' into codex/simp-prune-code-runtime-surface
...
# Conflicts:
# docs/config-catalog.md
# docs/cordis-catalog/services.md
# docs/rfc/implemented/feature/2026-06-15-code-mode.md
2026-07-14 19:05:23 +08:00
Tianyi Cui
93dc0f30a9
Merge branch 'codex/simp-ui-identity-residue' into codex/simp-hide-concrete-agent-loop
...
# Conflicts:
# docs/config-catalog.md
# docs/cordis-catalog/events.md
# docs/cordis-catalog/services.md
# docs/event-producer-consumer.md
# packages/core/agent-loop/tests/agent.spec.ts
# packages/core/agent-loop/tests/contract-regressions.spec.ts
2026-07-14 18:58:29 +08:00
Tianyi Cui
83271191d1
Merge branch 'codex/simp-agent-entry-state' into codex/simp-unify-agent-session-id
...
# Conflicts:
# docs/config-catalog.md
# docs/cordis-catalog/services.md
# docs/event-producer-consumer.md
# docs/rfc/implemented/architecture/2026-06-18-agent-lifecycle-and-ownership-seams.md
# docs/rfc/implemented/architecture/2026-06-20-branded-ids.md
# docs/rfc/implemented/simplification/2026-06-20-remove-agent-boundary-mirror-events.md
# docs/rfc/proposed/feature/2026-07-07-claude-code-and-codex-subagent-backends.md
# docs/rfc/proposed/simplification/2026-06-20-unify-agent-and-session-id.md
# packages/bash/tool-bash/README.md
# packages/bash/tool-bash/src/index.ts
# packages/bash/tool-bash/tests/tools.spec.ts
# packages/core/agent-loop/README.md
# packages/core/agent-loop/tests/properties.spec.ts
# packages/core/agent/README.md
# packages/core/agent/src/index.ts
# packages/guard/repeat-tool-guard/src/index.ts
# packages/hooks/hooks-claude/tests/bridge.spec.ts
# packages/subagent/subagent-acp/tests/mock-acp-server.ts
# packages/ui/acp/tests/dispose.spec.ts
# packages/ui/stdio-agent/src/index.ts
# packages/ui/stdio-agent/src/stdio-chat.ts
# packages/ui/stdio-agent/tests/stdio-chat.spec.ts
# packages/util/brand/src/index.ts
2026-07-14 18:51:24 +08:00
Tianyi Cui
38213ff244
Merge branch 'codex/simp-shared-acp-test-launcher' into codex/simp-trim-hook-snapshot-noise
2026-07-14 18:41:56 +08:00
Tianyi Cui
66c2996b36
Merge branch 'codex/simp-snapshot-fixture-inventory' into codex/simp-shared-acp-test-launcher
...
# Conflicts:
# docs/rfc/implemented/testing/2026-07-08-shared-acp-snapshot-package.md
# examples/acp-agent/tests/acp.e2e.ts
# examples/acp-agent/tests/escalation.e2e.ts
# packages/support/acp-snapshot/README.md
# packages/support/acp-snapshot/src/harness.ts
# packages/support/acp-snapshot/src/index.ts
2026-07-14 18:40:49 +08:00
Tianyi Cui
36a2430ec9
Merge branch 'codex/simp-session-log-representation' into codex/simp-snapshot-fixture-inventory
...
# Conflicts:
# docs/rfc/proposed/process/2026-06-20-discover-package-inventory.md
# examples/acp-agent/tests/acp.snapshot.ts
2026-07-14 18:38:18 +08:00
Tianyi Cui
78276c52a7
Merge branch 'codex/simp-session-dead-surface' into codex/simp-session-log-representation
...
# Conflicts:
# docs/cordis-catalog/events.md
# docs/cordis-catalog/services.md
# docs/core-data-structures/core.md
# docs/persistence-catalog.md
# docs/rfc/implemented/architecture/2026-07-05-reconstructable-requests.md
# docs/rfc/implemented/feature/2026-06-18-compaction-capability-seam.md
# docs/rfc/implemented/feature/2026-07-06-explicit-tool-order.md
# docs/rfc/implemented/feature/2026-07-06-sandbox.md
# docs/rfc/implemented/feature/2026-07-07-session-prefix.md
# packages/compact/compact-basic/src/index.ts
# packages/compact/compact-basic/tests/compact-basic.spec.ts
# packages/core/agent-loop/src/loop.ts
# packages/core/agent-loop/src/request-log.ts
# packages/core/agent-loop/tests/request-reconstruction.spec.ts
# packages/core/agent/src/types.ts
# packages/core/session/README.md
# packages/core/session/src/request-header.ts
# packages/core/session/src/surface.ts
# packages/core/session/src/tool-pairing.ts
# packages/core/session/src/types.ts
# packages/core/session/tests/surface.spec.ts
# packages/core/session/tests/tool-pairing.spec.ts
# packages/llm/llm/src/call-config.ts
# packages/support/acp-snapshot/src/suite.ts
# packages/support/invariants/README.md
# packages/ui/user-approval/README.md
2026-07-14 18:34:34 +08:00
Tianyi Cui
dbf4bebe83
Merge remote-tracking branch 'origin/master' into codex/simp-share-loader-smoke-harness
...
# Conflicts:
# examples/AGENTS.md
# examples/coding-agent/tests/code-mode-keyless-smoke.e2e.ts
# examples/coding-agent/tests/keyless-smoke.e2e.ts
# examples/cordis-agent/tests/keyless-smoke.e2e.ts
# examples/echo-agent/tests/echo.e2e.ts
2026-07-14 18:30:10 +08:00
Yichen Jiang
9956528495
Merge remote-tracking branch 'origin/master' into codex/rfc-subagent-background-tasks
...
# Conflicts:
# docs/architecture.md
# docs/config-catalog.md
# docs/cordis-catalog/services.md
# docs/core-data-structures/bash.md
# docs/event-producer-consumer.md
# docs/rfc/implemented/feature/2026-07-06-sandbox.md
# docs/rfc/proposed/architecture/2026-06-20-generic-long-running-tool-runtime.md
# examples/AGENTS.md
# examples/acp-agent/tests/snapshots/advanced-toolchain/session.1.jsonl
# examples/acp-agent/tests/snapshots/advanced-toolchain/session.2.jsonl
# examples/acp-agent/tests/snapshots/advanced-toolchain/session.jsonl
# examples/acp-agent/tests/snapshots/advanced-toolchain/system-prompt.golden.md
# examples/acp-agent/tests/snapshots/both-mode-turn/session.jsonl
# examples/acp-agent/tests/snapshots/both-mode-turn/system-prompt.golden.md
# examples/acp-agent/tests/snapshots/code-mode-turn/system-prompt.golden.md
# examples/acp-agent/tests/snapshots/permission-switching/system-prompt.golden.md
# examples/acp-agent/tests/snapshots/skill-load/session.jsonl
# examples/acp-agent/tests/snapshots/skill-load/system-prompt.golden.md
# examples/acp-agent/tests/snapshots/text-turn/session.jsonl
# examples/acp-agent/tests/snapshots/text-turn/system-prompt.golden.md
# examples/coding-agent/cordis.yml
# examples/sandbox-acp-agent/tests/snapshots/escalation-approved/session.jsonl
# examples/sandbox-acp-agent/tests/snapshots/escalation-rejected/session.jsonl
# examples/sandbox-acp-agent/tests/snapshots/mode-switching/session.jsonl
# packages/bash/bash-local/README.md
# packages/bash/bash-local/src/index.ts
# packages/bash/bash-local/tests/executor.spec.ts
# packages/bash/bash-sandbox/README.md
# packages/bash/bash-sandbox/src/index.ts
# packages/bash/bash/README.md
# packages/bash/bash/src/index.ts
# packages/bash/bash/src/types.ts
# packages/bash/tool-bash/README.md
# packages/bash/tool-bash/src/index.ts
# packages/bash/tool-bash/tests/tools.spec.ts
# packages/cordis/tool-cordis/src/api-catalog.ts
# packages/core/agent-core/README.md
# packages/core/agent-core/src/index.ts
# packages/subagent/subagent/README.md
# packages/subagent/tool-subagent/README.md
# packages/subagent/tool-subagent/src/index.ts
# packages/ui/acp-agent/README.md
# packages/ui/acp/README.md
# packages/ui/stdio-agent/README.md
# packages/util/brand/src/index.ts
# scripts/doc-budgets.manifest.json
2026-07-14 18:05:46 +08:00
Yichen Jiang
0d67c16d56
Merge remote-tracking branch 'origin/master' into codex/agent-session-jsonl-location
...
# Conflicts:
# docs/config-catalog.md
# docs/cordis-catalog/services.md
# docs/core-data-structures/bash.md
# docs/module-graph.md
# docs/rfc/INDEX.md
# docs/rfc/implemented/architecture/2026-06-30-bash-stdin-env-trusted-plugin-surface.md
# docs/rfc/implemented/feature/2026-06-30-hook-bridges.md
# examples/acp-agent/tests/snapshots/advanced-toolchain/session.1.jsonl
# examples/acp-agent/tests/snapshots/advanced-toolchain/session.2.jsonl
# examples/acp-agent/tests/snapshots/advanced-toolchain/session.jsonl
# examples/acp-agent/tests/snapshots/advanced-toolchain/system-prompt.golden.md
# examples/acp-agent/tests/snapshots/both-mode-turn/session.jsonl
# examples/acp-agent/tests/snapshots/both-mode-turn/system-prompt.golden.md
# examples/acp-agent/tests/snapshots/code-mode-turn/system-prompt.golden.md
# examples/acp-agent/tests/snapshots/skill-load/session.jsonl
# examples/acp-agent/tests/snapshots/text-turn/session.jsonl
# examples/sandbox-acp-agent/tests/snapshots/mode-switching/session.jsonl
# packages/bash/bash-local/README.md
# packages/bash/bash-local/src/run.ts
# packages/bash/bash-local/tests/run.spec.ts
# packages/bash/bash/README.md
# packages/bash/tool-bash/README.md
# packages/bash/tool-bash/src/index.ts
# packages/bash/tool-bash/tests/tools.spec.ts
# packages/cordis/tool-cordis/src/api-catalog.ts
# packages/core/agent-core/src/index.ts
# packages/session-persistence/session-persistence-jsonl/src/index.ts
# packages/session-persistence/session-persistence-sqlite/src/index.ts
# packages/session-persistence/session-persistence/README.md
# packages/session-persistence/session-persistence/src/index.ts
# packages/ui/acp-agent/README.md
# packages/ui/stdio-agent/README.md
2026-07-14 18:04:05 +08:00
Tianyi Cui
fd91515d1a
Merge remote-tracking branch 'origin/master' into codex/simp-prune-llm-contract
...
# Conflicts:
# docs/cordis-catalog/services.md
# packages/llm/llm-deepseek/src/adapter.ts
# packages/llm/llm/src/assembler.ts
# packages/llm/llm/tests/assembler.spec.ts
2026-07-14 17:45:52 +08:00
Tianyi Cui
f0fc20ca42
docs: align prose with runtime contracts
2026-07-14 16:21:41 +08:00
Tianyi Cui
26b4b036fc
test: refresh prose snapshots
2026-07-14 14:43:52 +08:00
Tianyi Cui
04c956a900
Merge branch 'codex/simp-ui-identity-residue' into codex/simp-hide-concrete-agent-loop
...
# Conflicts:
# docs/config-catalog.md
# docs/cordis-catalog/events.md
# docs/cordis-catalog/services.md
# docs/event-producer-consumer.md
2026-07-14 14:28:40 +08:00
Tianyi Cui
5caa9c4f33
Merge branch 'codex/simp-agent-entry-state' into codex/simp-unify-agent-session-id
...
# Conflicts:
# docs/cordis-catalog/services.md
2026-07-14 14:14:22 +08:00
Tianyi Cui
57a5cb4c94
Merge branch 'codex/simp-shared-acp-test-launcher' into codex/simp-trim-hook-snapshot-noise
2026-07-14 14:14:09 +08:00
Tianyi Cui
bb40259083
test: preserve ACP cleanup failures
2026-07-14 14:11:33 +08:00
Tianyi Cui
1ab64dba62
Merge remote-tracking branch 'origin/master' into codex/trim-ai-prose
...
# Conflicts:
# docs/config-catalog.md
# docs/development.i18n.yaml
# docs/development.zh.md
# docs/rfc/implemented/feature/2026-06-14-acp-agent-client-protocol.md
# docs/rfc/implemented/feature/2026-07-06-sandbox.md
# examples/AGENTS.md
# examples/README.md
# examples/acp-agent/README.md
# examples/acp-agent/cordis.yml
# examples/acp-agent/tests/acp.e2e.ts
# examples/acp-agent/tests/escalation.e2e.ts
# examples/sandbox-acp-agent/README.md
# examples/sandbox-acp-agent/cordis.snapshot.yml
# examples/sandbox-acp-agent/cordis.yml
# examples/sandbox-acp-agent/tests/acp.snapshot.ts
# packages/ui/acp-agent/src/bin.ts
# packages/ui/acp/README.md
# packages/ui/jsonrpc-agent/README.md
# packages/ui/jsonrpc-agent/src/bin.ts
# scripts/verify-translation-pairing.ts
2026-07-14 12:34:14 +08:00
Tianyi Cui
b5d3caf3d3
Merge remote-tracking branch 'origin/master' into codex/simp-share-loader-smoke-harness
2026-07-14 11:58:43 +08:00
Tianyi Cui
6a0466583b
Merge remote-tracking branch 'origin/master' into codex/simp-prune-llm-contract
2026-07-14 11:58:21 +08:00
Tianyi Cui
7e58e9a35b
Merge branch 'codex/simp-prune-tools-prompt-surface' into codex/simp-prune-code-runtime-surface
2026-07-14 11:57:51 +08:00
Tianyi Cui
e2ba1e61da
Merge branch 'codex/simp-ui-identity-residue' into codex/simp-hide-concrete-agent-loop
2026-07-14 11:56:47 +08:00
Tianyi Cui
9272d2871b
Merge branch 'codex/simp-agent-entry-state' into codex/simp-unify-agent-session-id
...
# Conflicts:
# docs/config-catalog.md
# docs/cordis-catalog/services.md
2026-07-14 11:56:09 +08:00
Tianyi Cui
99d2d5a092
Merge branch 'codex/simp-shared-acp-test-launcher' into codex/simp-trim-hook-snapshot-noise
2026-07-14 11:53:55 +08:00
Tianyi Cui
795371a209
Merge branch 'codex/simp-snapshot-fixture-inventory' into codex/simp-shared-acp-test-launcher
...
# Conflicts:
# examples/acp-agent/tests/acp.e2e.ts
# examples/acp-agent/tests/escalation.e2e.ts
# examples/acp-agent/tests/hooks.e2e.ts
# packages/support/acp-snapshot/src/harness.ts
2026-07-14 11:53:45 +08:00
Tianyi Cui
fd5ee06a97
Merge branch 'codex/simp-session-log-representation' into codex/simp-snapshot-fixture-inventory
2026-07-14 11:49:56 +08:00
Tianyi Cui
4d5fb2cb1d
Merge branch 'codex/simp-session-dead-surface' into codex/simp-session-log-representation
...
# Conflicts:
# docs/core-data-structures/session.md
# docs/rfc/implemented/feature/2026-07-06-sandbox.md
# examples/acp-agent/tests/snapshots/permission-switching/system-prompt.golden.md
# examples/sandbox-acp-agent/tests/acp.snapshot.ts
# examples/sandbox-acp-agent/tests/snapshots/mode-switching/session.jsonl
# packages/core/session/README.md
# packages/core/session/src/index.ts
# packages/core/session/src/surface.ts
# packages/core/session/tests/surface.spec.ts
# scripts/type-equiv.manifest.json
2026-07-14 11:49:46 +08:00
Dudu-0223
b69129601e
test: satisfy post-merge push gates
2026-07-14 11:02:49 +08:00
Dudu-0223
30ba5bd23c
Merge remote-tracking branch 'origin/master' into codex/truncated-design
...
# Conflicts:
# docs/config-catalog.md
# docs/rfc/INDEX.md
# examples/acp-agent/README.md
# packages/bash/tool-bash/tests/tools.spec.ts
2026-07-14 10:57:29 +08:00
kingwl
85a2140781
Merge origin/master (single-exe pipeline #253 , duplication lint #281 , side-sessions RFC)
...
Beyond line merges: python/sdk-runtime's deploy manifest gains
@deepseek-ai/dsh-mode — the single-exe closure gate
(verify-runtime-closure) requires every workspace peer of dsh-acp, and
the bridge's type-only peer edge on dsh-mode counts; the AGENTS.md
efficiency section is condensed to fit the 1820-word ceiling after
master's single-exe additions. Catalogs and graphs regenerated.
2026-07-14 10:46:09 +08:00
Yichen Jiang
cb78634bf2
Merge remote-tracking branch 'origin/master' into codex/rfc-subagent-background-tasks
...
# Conflicts:
# docs/event-producer-consumer.md
# packages/bash/tool-bash/tests/tools.spec.ts
2026-07-14 09:59:21 +08:00
Yichen Jiang
415907a162
test(acp): sync advanced snapshot with bash environment hint
2026-07-14 09:54:00 +08:00
Yichen Jiang
f570d2201e
Merge remote-tracking branch 'origin/master' into codex/agent-session-jsonl-location
...
# Conflicts:
# docs/config-catalog.md
# packages/hooks/hooks-codex/src/index.ts
# packages/ui/acp-agent/src/index.ts
# packages/ui/stdio-agent/src/index.ts
2026-07-14 09:51:50 +08:00
Tianyi Cui
4da2956db1
Merge branch 'codex/simp-agent-entry-state' into codex/simp-unify-agent-session-id
2026-07-14 07:58:02 +08:00
Tianyi Cui
6e908b9978
Merge branch 'codex/simp-ui-identity-residue' into codex/simp-hide-concrete-agent-loop
2026-07-14 07:58:02 +08:00
Tianyi Cui
47812b45db
test: re-record Codex hook snapshot
2026-07-14 07:57:45 +08:00
Tianyi Cui
3adf429cf3
Merge branch 'codex/simp-ui-identity-residue' into codex/simp-hide-concrete-agent-loop
2026-07-14 06:41:37 +08:00
Tianyi Cui
a5fc15bdd2
Merge branch 'codex/simp-shared-acp-test-launcher' into codex/simp-trim-hook-snapshot-noise
2026-07-14 06:41:36 +08:00
Tianyi Cui
3c90cd7a6f
Merge branch 'codex/simp-agent-entry-state' into codex/simp-unify-agent-session-id
2026-07-14 06:41:36 +08:00
Tianyi Cui
140d32681e
fix: make ACP test teardown failure-safe
2026-07-14 06:33:22 +08:00
Tianyi Cui
0815ff4db4
refactor: share loader smoke harness
2026-07-14 05:00:54 +08:00
kingwl
Tianyi Cui
Yichen Jiang
Dudu-0223