kingwl
95635dfa66
A preset names a bundle of the two mechanism knobs — request = workspace-write + ask, yolo = danger-full-access + never — so the editor shows ONE 'Permissions' select where the sandbox-mode and approval-policy tiers stay orthogonal capabilities (the Codex /approvals shape: presets over two dials). ctx.permission (dsh-permission) owns the config-defined table, validates the default preset's bundle against the composed knob defaults at load (fails loud), and writes a switch THROUGH: one log-only permission/preset event (the audit fact reverse-mapping cannot recover — the planned 'agent' preset shares request's knob values and differs only in composed policy) plus each knob event via its own setter, deduped — a net-zero switch appends nothing. Every knob consumer keeps reading its own fold, untouched. The current preset DERIVES from the effective knob values — the fold breaks bundle ties, a knob state outside the table is the reserved 'custom' value (a state, not an error: shown while it holds, switchable FROM, never a target), and defaultPreset disappears (zero-event state reverse-maps from the composition defaults). The ACP bridge drops the two per-knob selects for the one preset select (advertised only when ctx.permission is composed); pending/anchor/no-op semantics carry over unchanged, with the no-op echo acknowledged before vocabulary validation so a client re-pushing a derived 'custom' current never errors. The sandbox variant example composes the service with a workspace-write default; the permission-switching, escalation-approved and escalation-rejected scenarios are re-recorded under it (escalations now target an outside-workspace /tmp path under danger-full-access, self-cleaning) and config-options is re-authored on the single-select wire.
Examples
Runnable demos (not workspaces) that showcase how the harness is wired. Each example is now a thin leaf: a cordis.yml that picks the swappable backends (an LLM adapter, a bash executor), loads ONE app package, and may add optional product tools or demo-only mocks. The composition — the spine, the front-door cluster, and the boot glue — lives in the app packages (@deepseek-ai/dsh-stdio-agent, @deepseek-ai/dsh-acp-agent) and the @deepseek-ai/dsh-agent-core bundle they share. There is no start.ts; the demo:* scripts invoke each app package's bin.
echo-agent
A mock model + echo tool on the stdio chat app — the all-mock skeleton. The leaf swaps dsh-stdio-agent's LLM backend to a local mock-echo adapter and adds a local echo tool. Demonstrates:
- A thin leaf
cordis.ymlloading the@deepseek-ai/dsh-stdio-agentapp - Registering a mock
LlmAdapter(streaming scripted responses) - Registering a tool via
ctx.tools.register() - "Swap the backend, keep the app" — the only difference from
coding-agentis the adapter
Run with: pnpm run demo:echo. When prompted, type "echo " to trigger a tool call round-trip.
coding-agent
A REPL agent demo: DeepSeek V4 + the read/write/edit filesystem tools + the bash tool suite, subagent delegation, and the todo_write task tracker on the same @deepseek-ai/dsh-stdio-agent app. The UI is a terminal readline REPL.
Run with: pnpm run demo:repl (needs DEEPSEEK_API_KEY in the environment or a gitignored repo-root .env). See coding-agent/README.md for details.
Its code-mode.cordis.yml overlay flips the same tree to Code Mode: the worker-thread code runtime is loaded and the tool registry runs mode: code, so its registry contribution is the reserved run_code transport plus a generated TypeScript SDK section, and the model composes the other tools by writing a program whose output it curates. Run with: pnpm run demo:code-mode (the REPL is the default UI; acp as the argument serves the acp-agent example's same-shaped overlay instead) — see the Code Mode section for what to try.
cordis-agent
The self-referential demo: the coding spine plus @deepseek-ai/dsh-tool-cordis, whose three tools (cordis_inspect / cordis_mount / cordis_unmount) let the agent inspect the live cordis runtime it runs inside, mount model-written plugins into it (an event listener, a brand-new tool for itself, or a service another mount injects), and dispose them again — all dynamic mounts grouped under one cordis-dynamic fiber subtree. The ctx.fs/ctx.web services ride along provider-only, as the capabilities those plugins build on.
Run with: pnpm run demo:cordis (needs DEEPSEEK_API_KEY). See cordis-agent/README.md for the staged demo script and the toolset RFC for the design and sandbox caveats.
acp-agent
An agent demo exposed as an Agent Client Protocol (ACP) server over JSON-RPC stdio, via the @deepseek-ai/dsh-acp-agent app — drive it from Zed or any other ACP client. Also the home of the keyless snapshot tests.
Run with: pnpm run demo:acp (needs DEEPSEEK_API_KEY); pnpm run demo:code-mode acp boots the same server in Code Mode via the code-mode.cordis.yml overlay. See acp-agent/README.md for the Zed setup and the snapshot-test design.
The sandbox variant (sandbox.cordis.yml) swaps the bash executor for the sandbox stack (@deepseek-ai/dsh-sandbox-local + @deepseek-ai/dsh-bash-sandbox — the one-entry executor swap the ctx.bash capability seam exists for) and mounts @deepseek-ai/dsh-user-approval — the composition where the approval loop is LIVE: a sandbox denial escalated by the model becomes a session/request_permission prompt in the editor, and "Allow once" runs exactly that command under the wider mode. Run with: pnpm run demo:sandbox-acp (needs DEEPSEEK_API_KEY; bwrap, a Landlock-enforcing kernel, or macOS for confined runs).