kingwl
2dc62497ce
Extend SandboxMode enforcement from bash to the filesystem tools, the sandbox RFC's deferred cross-family phase. - dsh-sandbox-policy (new, ctx.sandboxPolicy): the single home for the deployment default mode + workspaceRoot and the per-session override event, renamed bash/sandbox-mode -> sandbox/mode and moved here with its fold/setter. Decouples the bash seam from dsh-session. - dsh-fs-sandbox (new): SandboxedFileSystem extends LocalFileSystem and fences write/edit by the per-call mode (read-only denies, workspace-write contains to the workspace + temp roots via the shared writableRoots, danger passes through); reads pass through. Structured FS_SANDBOX_DENIED; in-lock parent re-canonicalization. A policy fence in trusted code, not a kernel boundary. - dsh-sandbox: the shared escalation kit (writableRoots, the strictly-wider ladder, denial/hint markers, approveEscalation) both tool families use; approveEscalation takes a structural approver so dsh-sandbox gains no approval/agent dependency, and both tools stay duplication-free. - tool-fs: write/edit advertise sandbox_permissions/justification under a confining ctx.fs, map FS_SANDBOX_DENIED to the shared [sandbox: ...] marker, and resolve the same one-approved-wider retry. - examples/acp-agent: composes sandbox-policy + fs-sandbox, drops the gating that disabled the fs stack under confined modes. RFC docs/rfc/implemented/feature/2026-07-14-cross-family-fs-sandbox.md; the old sandbox RFC's In-process/deferred/FAQ sections updated to shipped fact.
21 KiB
21 KiB
RFC index
Generated by pnpm run gen-rfc-index from the RFC tree — never edit by hand; verify-rfc-classification fails when this file is stale. The curated front door — layout, classification, when to write one, and the in-file format — is README.md.
Proposed
Feature
| Title | First proposed |
|---|---|
| Pre-tool input rewrite — a consistent design | 2026-06-30 |
| Claude Code and Codex subagent backends (out-of-process delegation to external coding agents) | 2026-07-07 |
| Interactive side sessions and merge-back | 2026-07-08 |
| SQLite FTS5 session search | 2026-07-10 |
| Stream workflow progress through tool calls | 2026-07-13 |
Simplification
| Title | First proposed |
|---|---|
| Unify the agent id and the session id | 2026-06-20 |
| Prune dead public and result surface | 2026-07-04 |
| Drop unconsumed skill provider events | 2026-07-12 |
| Prune unused web seam fields | 2026-07-12 |
| Simplify session-log representation | 2026-07-12 |
Architecture
| Title | First proposed |
|---|---|
| Runtime schemas for the event vocabulary (Zod vs the merge-extensible-map pattern) | 2026-06-16 |
| Extract a generic long-running tool runtime | 2026-06-20 |
Process
| Title | First proposed |
|---|---|
| API extractor reports | 2026-06-11 |
| Architectural conformance — dependency rules and the adapter kit | 2026-06-11 |
| Supply chain checks and vendor drift verification | 2026-06-11 |
| Discover package inventories instead of maintaining static lists | 2026-06-20 |
Testing
| Title | First proposed |
|---|---|
| Deterministic tests, the replay invariant fixture, and race stress | 2026-06-11 |
| Mutation testing as the coverage counterweight | 2026-06-11 |
Implemented
Feature
Simplification
Architecture
Process
Testing
| Title | First proposed |
|---|---|
| Property-based testing for protocol-shaped code | 2026-06-11 |
| ACP snapshot tests — record-once / replay-deterministic | 2026-06-19 |
| Real-API e2e in CI against the external DeepSeek API | 2026-06-19 |
Use session.jsonl as the only snapshot session-log artifact |
2026-06-20 |
| Persist the seed boundary so fork-child replay routes correctly | 2026-06-22 |
| Record fork and mixed spawn+fork snapshot scenarios | 2026-06-22 |
| Per-session snapshot replay for nested agents | 2026-06-22 |
| Hook snapshot matrix — end-to-end goldens for both bridges | 2026-07-04 |
| Single-source the acp-agent replay config | 2026-07-04 |
| Pin request-header content in one snapshot scenario | 2026-07-06 |
| Extract the ACP snapshot suite into a support package | 2026-07-08 |
Rejected
Simplification
| Title | First proposed |
|---|---|
| Persist assembled assistant messages, not stream chunks | 2026-06-20 |
| Drop ACP session/load until resume has a product shape | 2026-06-20 |
Drop ACP terminal _meta rendering |
2026-06-20 |
| Drop bash full-output spill files | 2026-06-20 |
| Drop durable step boundary events | 2026-06-20 |
| Drop unused session lineage metadata | 2026-06-20 |
| Fold the persistence interface into dsh-session | 2026-06-20 |
| Collapse tool-owned UI presentation | 2026-06-20 |
| Retire mid-turn steering | 2026-06-20 |
| Return the ACP bridge to one live session per connection | 2026-06-20 |
| Truncate interrupted final turns on load | 2026-06-20 |
| Prune the unimplemented subagent seam vocabulary | 2026-07-04 |
| Collapse workflows to the exercised foreground core | 2026-07-12 |
| Prune unused skill registry surface | 2026-07-12 |
Architecture
| Title | First proposed |
|---|---|
| Deep-readonly public surfaces | 2026-06-11 |
| Make the shared example base providerless | 2026-06-20 |