Also folds the duplication the three controls had grown: the draft-and-commit
input both editable fields render is now one component, and the two sibling
executors' identical import surface is marked as the deliberate mirror their
READMEs already describe.
The section knows no namespace: it declares `settings.plugin.item` and
renders whatever cards were registered into it, so a plugin that ships a
browser half owns its card and its controls. The three cards here cover the
host-plane sections this deployment exposes.
A field shows its effective value and, when the raw user layer carries it, an
override badge and a reset that clears it back to the composition layer.
Controls commit on blur and Enter rather than per keystroke, which would burn
namespace revisions and race its own reads. The search key is the one value
that never rides a response: the card reports only whether one is configured
and writes it through the credentials domain, addressed by the reference the
section names.
A card renders nothing while its namespace is unavailable — a deployment that
does not compose the owning plugin should show no trace of it rather than a
disabled card the user cannot act on.
The provider now takes a thunk rather than a value: it projects the
authoritative section per search, so a stored endpoint, model, or key
reference reaches the next call without re-registering the provider — which
would make the seam's provider selection observable as a flicker.
apiKey already carries role('secret'), so the section is safe to describe:
the literal never rides a response in any layer and a configuration surface
learns only that a key is set.
The section is a strict subset of the plugin config: `agents` is consumed
once when the service starts, so a stored change there could only look like
it had an effect. The cap resolves through a getter over the settings source,
which the scheduler destructures at the start of each tool group, so a
committed change bounds the next group without disturbing the one in flight.
`resolveMaxParallelToolCalls` becomes the section validator, refusing a value
at the write instead of at that group.
The deferred-resume effect-shape assertion now allows the one plugin effect
the optional settings wiring adds at the fiber's own level; a resumed agent
joining it there is still the regression it pins.
The capability's namespace is owned by the seam because it names the
capability, not an implementation: a host composes exactly one provider of
ctx.bash, so both executor families register the same namespace with their
own schema and composition entry without ever colliding, and a settings
document carried between platforms keeps resolving on both.
Both executors read their config through a source thunk, so a stored change
reaches the next command. The constructor checks the schema cannot express
become the section validator, refusing a bad value at the write instead of
at the next command. pwsh re-resolves its executable only when the declared
path changed, so an unrelated settings change never re-probes the filesystem.
The skills subsystem page and dsh-skill README describe the host+per-scope
layers, SkillViewOptions joins the type-equiv corpus and the cordis-catalog
type pages, generated catalogs pick up the shifted source refs, and the
architecture Agent Note records the decision, the nearest-layer-wins
precedence choice, and the rejected alternatives.
Delete design-session citations (decision/audit/plan ordinals, stack
positions), change narration, review choreography, and reviewer-addressed
justification from comments, JSDoc, docs, READMEs, Agent Notes, tests, and
generator templates; restate every affected fact as current-state contract
prose. Fix generated docs at their sources and regenerate the catalogs and
cordis-surface regions; re-paste type-equiv blocks; update every bilingual
counterpart and re-record the pairs. Record the citation rule in the
committed-artifact-citations Agent Note.
The per-session random write SID forced a full tree propagation per
session per server lifetime (minutes on large workspaces). The write
SID is now the per-workspace identity derived from the canonical
workspace path (workspaceWriteSid: sha256 -> S-1-4-x-y), stored
nowhere: the workspace-root ACE materializes once per workspace per
machine and every later provision hits the exact-ACE skip.
- workspace ACEs are STANDING (never revoked - the reuse cache); temp
ACEs stay revocable (disposed with the provider), so an inheritable
ACE never outlives its session's temp dir on the ambient temp root
- AclSandbox requires the write SID under workspace-write; read-only
parses/grants nothing; the runner derives the SID itself (the
--write-sid flag's presence still marks the seam-managed contract)
- the acl-session record drops writeSid (sessionId/workspace/tempDir
remain): the SID-tamper surface and its validation are gone
- sandbox-local holds two grant maps: standing workspace grants and
revocable per-session temp grants
Docs (README pair, design note pair, catalogs, type-equiv) and the
acl-session/grant/acl/probe/runner suites updated; workspace-sid.spec
pins the derivation contract.
Yichen Jiang
Turtle
creatixchu
Huanqi Cao
Tianyi Cui
imccyu