Real-session evidence (Zed, 2026-07-21): in plan mode the model asked for
deletion confirmation through ask_user_question, took the user's follow-up
"对的" as approval, and attempted the rm directly — the independent
read-only sandbox contained it, and the one-shot escalation was rejected.
The plan instructions covered imperative execution requests but not a
confirming answer to the model's own question, so add the missing sentence:
conversational agreement approves nothing and does not end plan mode; the
confirmed decision belongs in the exit_plan_mode plan. Codex's plan template
carries the equivalent rule ("Plan Mode is not changed by user intent").
The plan-mode system-prompt pin refreshes with the section text.
Rename the six model-facing tools pty_* -> terminal_* and align every
description, guidance section, ACP card title, and rendered result to
terminal terminology. Package and service internals keep their technical
PTY names (PtyService, "unknown PTY session", node-pty).
Harden the local backend teardown:
- a failed close is retryable: drop the memoized rejection so a later
terminal_close re-runs against the live process table
- service disposal clears the backend, reservation, and owner-cleanup
registries even when a close fails
- stop readiness polling before teardown so an in-flight send settles as
session_exit instead of a mis-inferred wait reason
- bound the sanitizer's pending buffer against unterminated escape runs
Update the tool catalog, package READMEs, the bilingual Agent Note, and the
acp/headless pty-tools snapshots to match.
Master landed the tool-subagent depth budget while this branch was in
flight: the numeric default maxDepth now fails the mount against the
ACP provider's depthLimit: false, so the composition fixture must state
maxDepth: 'provider-managed' — the documented opt-out for a provider
whose recursion budget lives in the child harness. The fixture also
moves off the retired stdio-demo REPL onto the current app-boot driver
pattern (runLoaderSmoke + one-shot cli), and the split isDirectory
statements gain the file-not-a-directory case the single-expression
form used to cover implicitly.
The inheritance branch ran only under hand-mounted plugin tests, and
the with-key e2e always configures an explicit cwd. Add a test-only
cordis.yml (scripted delegating model + the scripted mock ACP child)
booting the stdio app through the real Loader with cwd omitted: the
child proves it ran in — and was announced — the parent session's
workspace, keylessly.
The master merge brought the tool registry's per-scope restriction layer
(tools.restrict), which makes dsh-mode's prepend assemble filter a duplicate
enforcement shape: it re-implemented the registry's SDK-section rendering
(renderToolsSdk + the RUN_CODE_NAME exclusion) and hid the exit tool from
prompts only — dispatch stayed open and the execute-time re-check was the
real gate. The service now reconciles a per-agent deny restriction on
agent.ctx at agent/created and at every boundary flush, so wire schemas, the
Code Mode tools:sdk section, AND dispatch resolve exit_plan_mode through the
one registry view (a default-mode call answers UNKNOWN_TOOL, byte-identical
to a no-dsh-mode deployment). The execute-time folded-mode re-check stays as
defense in depth for a direct foreign mode/set append no boundary has
reconciled yet.
Two zero-consumer surfaces removed per the pre-release stance:
- AgentOptions.mode creation seeding (declaration merge + agent/created
listener); a caller selects through set() before the first turn, and the
deferred subagent inheritance returns together with its consumer.
- The dropped-definition boundary notice (droppedNoticed + narration):
custom mode definitions have no production consumer, so nothing can be
dropped; fold-to-default degradation is unchanged.
The stdio removal had left plan mode ACP-only while docs still claimed a
/mode command. dsh-mode now registers /mode on the plugin-owned command
registry through an optional ctx.inject(['commands']) child (type-only peer
edge on dsh-commands), so the TUI and the ACP slash-command surface both
gain it; examples/tui-agent composes dsh-mode. ACP/TUI expected outputs
refreshed keyless for the available_commands_update delta.
Docs updated in place (mode READMEs, the plan-mode Agent Note's realization
sections); catalogs and graphs regenerated.
Tianyi Cui
kingwl
Yichen Jiang
NI0317
Dudu-0223