kingwl
99650a201b
A ModeDefinition may declare access: the widest sandbox access shell commands run under while the mode holds, on the SANDBOX_MODES ladder. The bash seam gains the resolution point to hang it on: BashExecutor. resolveMode(session) folds override ?? default and dispatches the new bash/resolve-mode waterfall; dsh-tool-bash consults it at both the stamping site and the escalation baseline; dsh-mode's clamp listener takes the ladder minimum per call. Two independent log folds compose at read time — the mode never writes the sandbox knob, so the two switch in any order and the knob re-emerges intact on exit. The built-in plan definition ships access: read-only with the bash trio allowlisted CONDITIONALLY: both policy layers admit bash/bash_output/ bash_kill only while a confining executor is mounted (an unconfinable shell cannot honor the cap), and a bash call carrying sandbox_permissions under a cap is denied at the gate — no widening mid-mode; the widened step belongs in the plan. examples/plan-acp-agent swaps bash-local for sandbox-local + bash-sandbox (workspace-write default, clamped read-only inside plan) plus the approval seam; the re-recorded plan-mode arc runs a real cat inside plan under the clamped sandbox, and modes-advertise now pins the sandbox-mode and approval config options. RFC amended to the landed shape (access cap section, orthogonality FAQ, deferred item resolved into effects self-declaration).
Examples
Runnable demos (not workspaces) that showcase how the harness is wired. Each example is now a thin leaf: a cordis.yml that picks the swappable backends (an LLM adapter, a bash executor), loads ONE app package, and may add optional product tools or demo-only mocks. The composition — the spine, the front-door cluster, and the boot glue — lives in the app packages (@deepseek-ai/dsh-stdio-agent, @deepseek-ai/dsh-acp-agent) and the @deepseek-ai/dsh-agent-core bundle they share. There is no start.ts; the demo:* scripts invoke each app package's bin.
echo-agent
A mock model + echo tool on the stdio chat app — the all-mock skeleton. The leaf swaps dsh-stdio-agent's LLM backend to a local mock-echo adapter and adds a local echo tool. Demonstrates:
- A thin leaf
cordis.ymlloading the@deepseek-ai/dsh-stdio-agentapp - Registering a mock
LlmAdapter(streaming scripted responses) - Registering a tool via
ctx.tools.register() - "Swap the backend, keep the app" — the only difference from
coding-agentis the adapter
Run with: pnpm run demo:echo. When prompted, type "echo " to trigger a tool call round-trip.
coding-agent
A REPL agent demo: DeepSeek V4 + the read/write/edit filesystem tools + the bash tool suite, subagent delegation, and the todo_write task tracker on the same @deepseek-ai/dsh-stdio-agent app. The UI is a terminal readline REPL.
Run with: pnpm run demo:repl (needs DEEPSEEK_API_KEY in the environment or a gitignored repo-root .env). See coding-agent/README.md for details.
Its code-mode.cordis.yml overlay flips the same tree to Code Mode: the worker-thread code runtime is loaded and the tool registry runs mode: code, so the model gets exactly one wire tool — run_code — plus a generated TypeScript SDK section, and composes the other tools by writing a program whose output it curates. Run with: pnpm run demo:code-mode (the REPL is the default UI; acp as the argument serves the acp-agent example's same-shaped overlay instead) — see the Code Mode section for what to try.
cordis-agent
The self-referential demo: the coding spine plus @deepseek-ai/dsh-tool-cordis, whose three tools (cordis_inspect / cordis_mount / cordis_unmount) let the agent inspect the live cordis runtime it runs inside, mount model-written plugins into it (an event listener, a brand-new tool for itself, or a service another mount injects), and dispose them again — all dynamic mounts grouped under one cordis-dynamic fiber subtree. The ctx.fs/ctx.web services ride along provider-only, as the capabilities those plugins build on.
Run with: pnpm run demo:cordis (needs DEEPSEEK_API_KEY). See cordis-agent/README.md for the staged demo script and the toolset RFC for the design and sandbox caveats.
acp-agent
An agent demo exposed as an Agent Client Protocol (ACP) server over JSON-RPC stdio, via the @deepseek-ai/dsh-acp-agent app — drive it from Zed or any other ACP client. Also the home of the keyless snapshot tests.
Run with: pnpm run demo:acp (needs DEEPSEEK_API_KEY); pnpm run demo:code-mode acp boots the same server in Code Mode via the code-mode.cordis.yml overlay. See acp-agent/README.md for the Zed setup and the snapshot-test design.
plan-acp-agent
The ACP server with session modes composed (@deepseek-ai/dsh-mode) — the editor's mode picker switches the session into plan mode, the model works under the read-only allowlist, and it leaves through the user-reviewed exit_plan_mode tool (the review arrives as an elicitation form).
Run with: pnpm run demo:plan-acp (needs DEEPSEEK_API_KEY). See plan-acp-agent/README.md.
sandbox-acp-agent
The coding agent with its bash executor swapped for the sandbox stack (@deepseek-ai/dsh-sandbox-local + @deepseek-ai/dsh-bash-sandbox — the one-entry executor swap the ctx.bash capability seam exists for), served over ACP with @deepseek-ai/dsh-user-approval mounted — the first composition where the approval loop is LIVE: a sandbox denial escalated by the model becomes a session/request_permission prompt in the editor, and "Allow once" runs exactly that command under the wider mode.
Run with: pnpm run demo:sandbox-acp (needs DEEPSEEK_API_KEY; bwrap, a Landlock-enforcing kernel, or macOS for confined runs). See sandbox-acp-agent/README.md.