2026-07-05 01:25:58 +08:00
<!-- Generated by scripts/gen - doc - graphs.ts - do not edit by hand.
Run `pnpm run gen-doc-graphs` to regenerate. -->
# ACP Agent App Composition
The ACP demo exposes the same agent spine over JSON-RPC stdio, with no stdout logger and no pre-created agent; clients create sessions through the ACP bridge.
```mermaid
flowchart LR
cfg["examples/acp-agent< br / > cordis.yml"]
plugin_acp_llm_deepseek["llm-deepseek< br /> @deepseek -ai/dsh-llm-deepseek"]
cfg --> plugin_acp_llm_deepseek
2026-07-14 01:09:44 +08:00
plugin_acp_sandbox["sandbox< br /> @deepseek -ai/dsh-sandbox-local"]
cfg --> plugin_acp_sandbox
feat(sandbox): cross-family file sandbox — one policy home, sandboxed fs provider, fs escalation parity
Extend SandboxMode enforcement from bash to the filesystem tools, the sandbox
RFC's deferred cross-family phase.
- dsh-sandbox-policy (new, ctx.sandboxPolicy): the single home for the
deployment default mode + workspaceRoot and the per-session override event,
renamed bash/sandbox-mode -> sandbox/mode and moved here with its fold/setter.
Decouples the bash seam from dsh-session.
- dsh-fs-sandbox (new): SandboxedFileSystem extends LocalFileSystem and fences
write/edit by the per-call mode (read-only denies, workspace-write contains to
the workspace + temp roots via the shared writableRoots, danger passes
through); reads pass through. Structured FS_SANDBOX_DENIED; in-lock parent
re-canonicalization. A policy fence in trusted code, not a kernel boundary.
- dsh-sandbox: the shared escalation kit (writableRoots, the strictly-wider
ladder, denial/hint markers, approveEscalation) both tool families use;
approveEscalation takes a structural approver so dsh-sandbox gains no
approval/agent dependency, and both tools stay duplication-free.
- tool-fs: write/edit advertise sandbox_permissions/justification under a
confining ctx.fs, map FS_SANDBOX_DENIED to the shared [sandbox: ...] marker,
and resolve the same one-approved-wider retry.
- examples/acp-agent: composes sandbox-policy + fs-sandbox, drops the gating
that disabled the fs stack under confined modes.
RFC docs/rfc/implemented/feature/2026-07-14-cross-family-fs-sandbox.md; the old
sandbox RFC's In-process/deferred/FAQ sections updated to shipped fact.
2026-07-14 20:05:57 +08:00
plugin_acp_sandbox_policy["sandbox-policy< br /> @deepseek -ai/dsh-sandbox-policy"]
cfg --> plugin_acp_sandbox_policy
2026-07-14 01:09:44 +08:00
plugin_acp_bash["bash< br /> @deepseek -ai/dsh-bash-sandbox"]
2026-07-05 01:25:58 +08:00
cfg --> plugin_acp_bash
2026-07-14 01:09:44 +08:00
plugin_acp_approval["approval< br /> @deepseek -ai/dsh-user-approval"]
cfg --> plugin_acp_approval
plugin_acp_permission["permission< br /> @deepseek -ai/dsh-permission"]
cfg --> plugin_acp_permission
2026-07-15 15:57:57 +08:00
plugin_acp_acp_agent["acp-agent< br /> @deepseek -ai/dsh-acp-demo"]
2026-07-05 01:25:58 +08:00
cfg --> plugin_acp_acp_agent
2026-07-15 15:57:57 +08:00
plugin_acp_acp_agent --> bundle_agent_core["@deepseek -ai/dsh-agent-spine-demo"]
2026-07-05 01:25:58 +08:00
plugin_acp_acp_agent --> bundle_jsonl["@deepseek -ai/dsh-session-persistence-jsonl"]
plugin_acp_acp_agent --> frontdoor_acp["@deepseek -ai/dsh-acp< br /> JSON-RPC stdio bridge< br /> sessions created by client"]
bundle_agent_core --> spine_llm["ctx.llm"]
bundle_agent_core --> spine_sessions["ctx.sessions"]
bundle_agent_core --> spine_tools["ctx.tools + tool-bash"]
bundle_agent_core --> spine_loop["ctx.agents + ctx.agentLoop"]
2026-07-20 11:47:17 +08:00
plugin_acp_token_meter["token-meter< br /> @deepseek -ai/dsh-token-meter"]
cfg --> plugin_acp_token_meter
2026-07-15 16:42:32 +08:00
plugin_acp_compact_basic["compact-basic< br /> @deepseek -ai/dsh-compact-basic"]
cfg --> plugin_acp_compact_basic
2026-07-05 01:25:58 +08:00
plugin_acp_subagent["subagent< br /> @deepseek -ai/dsh-subagent"]
cfg --> plugin_acp_subagent
plugin_acp_subagent_spawn["subagent-spawn< br /> @deepseek -ai/dsh-subagent-spawn"]
cfg --> plugin_acp_subagent_spawn
plugin_acp_subagent_fork["subagent-fork< br /> @deepseek -ai/dsh-subagent-fork"]
cfg --> plugin_acp_subagent_fork
plugin_acp_tool_subagent["tool-subagent< br /> @deepseek -ai/dsh-tool-subagent"]
cfg --> plugin_acp_tool_subagent
plugin_acp_tool_subagent_fork["tool-subagent-fork< br /> @deepseek -ai/dsh-tool-subagent"]
cfg --> plugin_acp_tool_subagent_fork
2026-07-09 19:06:55 +08:00
plugin_acp_workflow_workerthread["workflow-workerthread< br /> @deepseek -ai/dsh-workflow-workerthread"]
cfg --> plugin_acp_workflow_workerthread
2026-07-06 03:14:07 +08:00
plugin_acp_tool_workflow["tool-workflow< br /> @deepseek -ai/dsh-tool-workflow"]
cfg --> plugin_acp_tool_workflow
2026-07-05 01:25:58 +08:00
plugin_acp_tool_todo["tool-todo< br /> @deepseek -ai/dsh-tool-todo"]
cfg --> plugin_acp_tool_todo
2026-07-08 14:24:20 +08:00
plugin_acp_repeat_tool_guard["repeat-tool-guard< br /> @deepseek -ai/dsh-repeat-tool-guard"]
cfg --> plugin_acp_repeat_tool_guard
feat(sandbox): cross-family file sandbox — one policy home, sandboxed fs provider, fs escalation parity
Extend SandboxMode enforcement from bash to the filesystem tools, the sandbox
RFC's deferred cross-family phase.
- dsh-sandbox-policy (new, ctx.sandboxPolicy): the single home for the
deployment default mode + workspaceRoot and the per-session override event,
renamed bash/sandbox-mode -> sandbox/mode and moved here with its fold/setter.
Decouples the bash seam from dsh-session.
- dsh-fs-sandbox (new): SandboxedFileSystem extends LocalFileSystem and fences
write/edit by the per-call mode (read-only denies, workspace-write contains to
the workspace + temp roots via the shared writableRoots, danger passes
through); reads pass through. Structured FS_SANDBOX_DENIED; in-lock parent
re-canonicalization. A policy fence in trusted code, not a kernel boundary.
- dsh-sandbox: the shared escalation kit (writableRoots, the strictly-wider
ladder, denial/hint markers, approveEscalation) both tool families use;
approveEscalation takes a structural approver so dsh-sandbox gains no
approval/agent dependency, and both tools stay duplication-free.
- tool-fs: write/edit advertise sandbox_permissions/justification under a
confining ctx.fs, map FS_SANDBOX_DENIED to the shared [sandbox: ...] marker,
and resolve the same one-approved-wider retry.
- examples/acp-agent: composes sandbox-policy + fs-sandbox, drops the gating
that disabled the fs stack under confined modes.
RFC docs/rfc/implemented/feature/2026-07-14-cross-family-fs-sandbox.md; the old
sandbox RFC's In-process/deferred/FAQ sections updated to shipped fact.
2026-07-14 20:05:57 +08:00
plugin_acp_fs_sandbox["fs-sandbox< br /> @deepseek -ai/dsh-fs-sandbox"]
cfg --> plugin_acp_fs_sandbox
2026-07-05 01:25:58 +08:00
plugin_acp_fs_policy["fs-policy< br /> @deepseek -ai/dsh-fs-policy"]
cfg --> plugin_acp_fs_policy
plugin_acp_tool_fs["tool-fs< br /> @deepseek -ai/dsh-tool-fs"]
cfg --> plugin_acp_tool_fs
plugin_acp_hooks_claude["hooks-claude< br /> @deepseek -ai/dsh-hooks-claude"]
cfg --> plugin_acp_hooks_claude
plugin_acp_hooks_codex["hooks-codex< br /> @deepseek -ai/dsh-hooks-codex"]
cfg --> plugin_acp_hooks_codex
```
| Plugin id | Package / module |
| --- | --- |
| `llm-deepseek` | `@deepseek-ai/dsh-llm-deepseek` |
2026-07-14 01:09:44 +08:00
| `sandbox` | `@deepseek-ai/dsh-sandbox-local` |
feat(sandbox): cross-family file sandbox — one policy home, sandboxed fs provider, fs escalation parity
Extend SandboxMode enforcement from bash to the filesystem tools, the sandbox
RFC's deferred cross-family phase.
- dsh-sandbox-policy (new, ctx.sandboxPolicy): the single home for the
deployment default mode + workspaceRoot and the per-session override event,
renamed bash/sandbox-mode -> sandbox/mode and moved here with its fold/setter.
Decouples the bash seam from dsh-session.
- dsh-fs-sandbox (new): SandboxedFileSystem extends LocalFileSystem and fences
write/edit by the per-call mode (read-only denies, workspace-write contains to
the workspace + temp roots via the shared writableRoots, danger passes
through); reads pass through. Structured FS_SANDBOX_DENIED; in-lock parent
re-canonicalization. A policy fence in trusted code, not a kernel boundary.
- dsh-sandbox: the shared escalation kit (writableRoots, the strictly-wider
ladder, denial/hint markers, approveEscalation) both tool families use;
approveEscalation takes a structural approver so dsh-sandbox gains no
approval/agent dependency, and both tools stay duplication-free.
- tool-fs: write/edit advertise sandbox_permissions/justification under a
confining ctx.fs, map FS_SANDBOX_DENIED to the shared [sandbox: ...] marker,
and resolve the same one-approved-wider retry.
- examples/acp-agent: composes sandbox-policy + fs-sandbox, drops the gating
that disabled the fs stack under confined modes.
RFC docs/rfc/implemented/feature/2026-07-14-cross-family-fs-sandbox.md; the old
sandbox RFC's In-process/deferred/FAQ sections updated to shipped fact.
2026-07-14 20:05:57 +08:00
| `sandbox-policy` | `@deepseek-ai/dsh-sandbox-policy` |
2026-07-14 01:09:44 +08:00
| `bash` | `@deepseek-ai/dsh-bash-sandbox` |
| `approval` | `@deepseek-ai/dsh-user-approval` |
| `permission` | `@deepseek-ai/dsh-permission` |
2026-07-15 15:57:57 +08:00
| `acp-agent` | `@deepseek-ai/dsh-acp-demo` |
2026-07-20 11:47:17 +08:00
| `token-meter` | `@deepseek-ai/dsh-token-meter` |
2026-07-15 16:42:32 +08:00
| `compact-basic` | `@deepseek-ai/dsh-compact-basic` |
2026-07-05 01:25:58 +08:00
| `subagent` | `@deepseek-ai/dsh-subagent` |
| `subagent-spawn` | `@deepseek-ai/dsh-subagent-spawn` |
| `subagent-fork` | `@deepseek-ai/dsh-subagent-fork` |
| `tool-subagent` | `@deepseek-ai/dsh-tool-subagent` |
| `tool-subagent-fork` | `@deepseek-ai/dsh-tool-subagent` |
2026-07-09 19:06:55 +08:00
| `workflow-workerthread` | `@deepseek-ai/dsh-workflow-workerthread` |
2026-07-06 03:14:07 +08:00
| `tool-workflow` | `@deepseek-ai/dsh-tool-workflow` |
2026-07-05 01:25:58 +08:00
| `tool-todo` | `@deepseek-ai/dsh-tool-todo` |
2026-07-08 14:24:20 +08:00
| `repeat-tool-guard` | `@deepseek-ai/dsh-repeat-tool-guard` |
feat(sandbox): cross-family file sandbox — one policy home, sandboxed fs provider, fs escalation parity
Extend SandboxMode enforcement from bash to the filesystem tools, the sandbox
RFC's deferred cross-family phase.
- dsh-sandbox-policy (new, ctx.sandboxPolicy): the single home for the
deployment default mode + workspaceRoot and the per-session override event,
renamed bash/sandbox-mode -> sandbox/mode and moved here with its fold/setter.
Decouples the bash seam from dsh-session.
- dsh-fs-sandbox (new): SandboxedFileSystem extends LocalFileSystem and fences
write/edit by the per-call mode (read-only denies, workspace-write contains to
the workspace + temp roots via the shared writableRoots, danger passes
through); reads pass through. Structured FS_SANDBOX_DENIED; in-lock parent
re-canonicalization. A policy fence in trusted code, not a kernel boundary.
- dsh-sandbox: the shared escalation kit (writableRoots, the strictly-wider
ladder, denial/hint markers, approveEscalation) both tool families use;
approveEscalation takes a structural approver so dsh-sandbox gains no
approval/agent dependency, and both tools stay duplication-free.
- tool-fs: write/edit advertise sandbox_permissions/justification under a
confining ctx.fs, map FS_SANDBOX_DENIED to the shared [sandbox: ...] marker,
and resolve the same one-approved-wider retry.
- examples/acp-agent: composes sandbox-policy + fs-sandbox, drops the gating
that disabled the fs stack under confined modes.
RFC docs/rfc/implemented/feature/2026-07-14-cross-family-fs-sandbox.md; the old
sandbox RFC's In-process/deferred/FAQ sections updated to shipped fact.
2026-07-14 20:05:57 +08:00
| `fs-sandbox` | `@deepseek-ai/dsh-fs-sandbox` |
2026-07-05 01:25:58 +08:00
| `fs-policy` | `@deepseek-ai/dsh-fs-policy` |
| `tool-fs` | `@deepseek-ai/dsh-tool-fs` |
| `hooks-claude` | `@deepseek-ai/dsh-hooks-claude` |
| `hooks-codex` | `@deepseek-ai/dsh-hooks-codex` |
2026-07-05 02:54:01 +08:00
Source config: [`examples/acp-agent/cordis.yml` ](cordis.yml ).
Maintenance mode: hybrid: the leaf plugin list is parsed from its `cordis.yml` ; app package expansion is curated from package source.