0 Fork 0

Files

T

Tianyi Cui 64ce7caedc docs: address review on RFCs 009-011

Resolve the inline review feedback on PR #18 (all verified against the
codebase, the published @agentclientprotocol/sdk@0.25.1 tarball, and
Cordis fiber semantics):

- 009: dsh-session owns SessionMeta (persistence re-exports) to avoid a
  package cycle; split mutable summary into a sidecar so the event log
  stays append-only and list/load can return it; pick one load-repair
  rule (resume from the last complete turn/end, overwrite the orphan).
- 010: SDK has a zod peer dep + runtime zod/v4 import (drop "zero runtime
  deps"); session/new needs a create seam taking {sessionId, meta};
  propose an abstract create/resume factory on dsh-agent so the bridge
  depends on the interface not the loop, and observe agent/status for
  quiescence since agent.done is LoopAgent-only; add the explicit
  TurnEndReason -> ACP StopReason wire mapping + test; reject non-empty
  additionalDirectories for the MVP; remove the EOF blank line.
- 011: ctx.extend() does not create a disposable fiber — use a real
  per-session disposer scope.

2026-06-14 21:43:16 +08:00

4.1 KiB

Raw Blame History

RFC 011: Multiplex concurrent ACP sessions over one connection

Status: proposed

Problem

RFC 010 ships ACP support with a single active session per connection: a second session/new is rejected. Editors expect to run several conversations over one agent subprocess — a user opens multiple threads, or a client pre-warms sessions. The single-session guard is a deliberate MVP scope cut, not an architectural limit; this RFC lifts it.

Proposal

The harness core already supports many agents (AgentRegistry.list() and AgentLoop.create impose no count limit), so multiplexing is a bridge-layer change in @deepseek-ai/dsh-acp, not a loop or core change.

Lift the single-session guard in session/new; allow N live sessions, each mapped to its own LoopAgent.
The bridge's sessionId→agent and Session→sessionId maps (introduced single-entry in RFC 010) become true multi-entry, plus a third agent→sessionId reverse map: the tools/execute permission gate receives only exec.agent (no sessionId), so it needs an O(1) reverse lookup to find the owning session. Every agent/* event and every session/event is demuxed strictly by id, so two sessions streaming at once never interleave their session/update notifications.
Per-session prompt queues: RFC 010's single-entry in-flight-prompt state becomes multi-entry — one in-flight prompt per session, tracked per sessionId.
Per-session cancel routing: session/cancel aborts only its own session's agent and settles only that session's in-flight prompt. agent.abort() drives a per-agent AbortController, so the per-session exec.signal is the natural isolation fence.
Per-session permission ownership: a session/request_permission and its outcome are bound to the originating session via the reverse map, so a permission prompt or a cancel in one session can never resolve another session's pending permission.

Plan

Generalize the two id maps to multi-entry and add the agent→sessionId reverse map; add a per-session record holding the agent, the in-flight-prompt state, the pending-permission registry, and the session's disposer scope (see step 2).
Give each session a real per-session disposer scope, NOT ctx.extend() — in Cordis ctx.extend() only creates a child context/prototype, but ctx.on() registered on it is still owned by the current plugin fiber, so disposing it would not remove that session's listeners. Use a genuine child fiber (load a per-session sub-plugin, e.g. ctx.plugin(...) returning a fork, or collect each session's ctx.on disposers in its session record and call them on teardown). Demux every agent/* and session/event by id into the right session record. Note the single global tools/execute listener stays on the bridge root (it must see all agents) and routes via the reverse map.
Lift the session/new guard; keep session/load (RFC 010) working per session.
Tests for cross-session isolation: two sessions streaming and permission-prompting concurrently never interleave; a cancel/abort in one session leaves the other's stream and pending permission untouched; per-session in-flight-prompt enforcement holds independently; disposing one session leaves the others running.

Risks

Listener fan-out cost: each session adds listeners; ensure disposal of one session removes exactly its own and the connection teardown (RFC 010) still reaches quiescence across all sessions.

The subtle correctness trap is cross-session leakage — a cancel or abort on one session settling another session's pending permission. The per-session permission ownership rule (routed via the agent→sessionId reverse map) and its isolation test are the guard.

Shared background-task state: the bash executor's task ids are global and predictable (bash-1, bash-2, …), and bash_output/bash_kill look up by id without checking the caller. Under one session this is benign; under N sessions one session's agent could read or kill another's background task. This is a pre-existing tool-bash gap that multi-session turns into a real isolation hole — fixing it (validate the caller against the task owner) belongs with this RFC or a companion tool-bash change.

4.1 KiB Raw Blame History