2026-06-16 21:00:24 +08:00
<!-- Generated by scripts/gen - module - graph.ts — do not edit by hand.
Run `pnpm run gen-module-graph` to regenerate. -->
# Module dependency graph
2026-07-05 01:25:58 +08:00
Inter-package dependencies among the `@deepseek-ai/dsh-*` harness packages, derived from each package's `peerDependencies` (the canonical runtime-dependency signal) and grouped by the `packages/<group>/<pkg>` hierarchy. An edge `a --> b` means package `a` depends on package `b` . Names have the `@deepseek-ai/dsh-` prefix stripped.
2026-06-16 21:00:24 +08:00
```mermaid
2026-07-05 01:25:58 +08:00
flowchart TD
subgraph group_util["packages/util"]
pkg_brand["brand"]
2026-07-05 16:49:39 +08:00
pkg_paths["paths"]
2026-07-07 09:31:53 +08:00
pkg_retention["retention"]
2026-07-06 16:23:52 +08:00
pkg_timeout["timeout"]
2026-07-05 01:25:58 +08:00
end
subgraph group_llm["packages/llm"]
pkg_llm["llm"]
pkg_llm_deepseek["llm-deepseek"]
pkg_llm_pi_ai["llm-pi-ai"]
2026-07-20 03:34:19 +08:00
pkg_llm_retry["llm-retry"]
2026-07-15 14:47:29 +08:00
pkg_token_meter["token-meter"]
2026-07-05 01:25:58 +08:00
end
subgraph group_core["packages/core"]
pkg_agent["agent"]
pkg_agent_loop["agent-loop"]
2026-07-08 23:54:03 +08:00
pkg_scope["scope"]
2026-07-05 01:25:58 +08:00
pkg_session["session"]
pkg_system_prompt["system-prompt"]
pkg_tools["tools"]
end
2026-07-19 18:47:34 +08:00
subgraph group_goal["packages/goal"]
2026-07-19 23:55:33 +08:00
pkg_command_goal["command-goal"]
2026-07-19 18:47:34 +08:00
pkg_goal["goal"]
2026-07-19 20:30:43 +08:00
pkg_goal_session["goal-session"]
2026-07-19 19:22:10 +08:00
pkg_tool_goal["tool-goal"]
2026-07-19 18:47:34 +08:00
end
2026-07-05 01:25:58 +08:00
subgraph group_bash["packages/bash"]
pkg_bash["bash"]
pkg_bash_local["bash-local"]
2026-07-09 16:05:44 +08:00
pkg_bash_sandbox["bash-sandbox"]
2026-07-05 01:25:58 +08:00
pkg_tool_bash["tool-bash"]
end
subgraph group_fs["packages/fs"]
pkg_fs["fs"]
pkg_fs_local["fs-local"]
pkg_fs_policy["fs-policy"]
feat(sandbox): cross-family file sandbox — one policy home, sandboxed fs provider, fs escalation parity
Extend SandboxMode enforcement from bash to the filesystem tools, the sandbox
RFC's deferred cross-family phase.
- dsh-sandbox-policy (new, ctx.sandboxPolicy): the single home for the
deployment default mode + workspaceRoot and the per-session override event,
renamed bash/sandbox-mode -> sandbox/mode and moved here with its fold/setter.
Decouples the bash seam from dsh-session.
- dsh-fs-sandbox (new): SandboxedFileSystem extends LocalFileSystem and fences
write/edit by the per-call mode (read-only denies, workspace-write contains to
the workspace + temp roots via the shared writableRoots, danger passes
through); reads pass through. Structured FS_SANDBOX_DENIED; in-lock parent
re-canonicalization. A policy fence in trusted code, not a kernel boundary.
- dsh-sandbox: the shared escalation kit (writableRoots, the strictly-wider
ladder, denial/hint markers, approveEscalation) both tool families use;
approveEscalation takes a structural approver so dsh-sandbox gains no
approval/agent dependency, and both tools stay duplication-free.
- tool-fs: write/edit advertise sandbox_permissions/justification under a
confining ctx.fs, map FS_SANDBOX_DENIED to the shared [sandbox: ...] marker,
and resolve the same one-approved-wider retry.
- examples/acp-agent: composes sandbox-policy + fs-sandbox, drops the gating
that disabled the fs stack under confined modes.
RFC docs/rfc/implemented/feature/2026-07-14-cross-family-fs-sandbox.md; the old
sandbox RFC's In-process/deferred/FAQ sections updated to shipped fact.
2026-07-14 20:05:57 +08:00
pkg_fs_sandbox["fs-sandbox"]
2026-07-05 01:25:58 +08:00
pkg_tool_fs["tool-fs"]
2026-07-09 20:44:32 +08:00
pkg_tool_fs_search["tool-fs-search"]
2026-07-05 01:25:58 +08:00
end
2026-07-10 14:19:06 +08:00
subgraph group_skill["packages/skill"]
pkg_skill["skill"]
pkg_skill_local["skill-local"]
pkg_tool_skill["tool-skill"]
end
2026-07-05 01:25:58 +08:00
subgraph group_compact["packages/compact"]
pkg_compact["compact"]
pkg_compact_basic["compact-basic"]
2026-07-16 18:51:26 +08:00
pkg_compact_tool_result_prune["compact-tool-result-prune"]
2026-07-05 01:25:58 +08:00
end
subgraph group_subagent["packages/subagent"]
pkg_subagent["subagent"]
pkg_subagent_acp["subagent-acp"]
pkg_subagent_fork["subagent-fork"]
pkg_subagent_inprocess["subagent-inprocess"]
pkg_subagent_spawn["subagent-spawn"]
rename: @deepseek-ai/dsh-subagent-process -> @deepseek-ai/dsh-subagent-subprocess
The extracted library's name sat one edit away from @deepseek-ai/dsh-subagent-inprocess
(process/inprocess), inviting a typo'd import to silently resolve to the wrong
package. subagent-subprocess also reads as the deliberate counterpart to
subagent-inprocess (in-process vs. subprocess), matching how the two shared
drivers actually differ.
Package directory, npm name, module doc, JSDoc module tags, test-file name and
its temp-dir prefixes, the subagent-acp import and its Config/tsconfig/package.json
references, root tsconfig.json/tsconfig.build.json/knip.json entries, and the
packages/subagent group README all renamed together; regenerated
docs/module-graph.md and docs/config-catalog.md. Pure rename — no behavior,
export, or Config shape changed.
2026-07-09 13:42:03 +08:00
pkg_subagent_subprocess["subagent-subprocess"]
2026-07-05 01:25:58 +08:00
pkg_tool_subagent["tool-subagent"]
end
subgraph group_web["packages/web"]
pkg_tool_web["tool-web"]
pkg_web["web"]
pkg_web_fetch_local["web-fetch-local"]
pkg_web_search_deepseek["web-search-deepseek"]
pkg_web_search_exa["web-search-exa"]
pkg_web_search_perplexity["web-search-perplexity"]
end
2026-07-08 19:20:50 +08:00
subgraph group_spill["packages/spill"]
pkg_spill["spill"]
pkg_spill_local["spill-local"]
pkg_spill_policy["spill-policy"]
end
2026-07-08 10:06:07 +08:00
subgraph group_timeout["packages/timeout"]
pkg_timeout_policy["timeout-policy"]
end
2026-07-05 01:25:58 +08:00
subgraph group_todo["packages/todo"]
pkg_tool_todo["tool-todo"]
end
2026-07-10 01:38:39 +08:00
subgraph group_mode["packages/mode"]
pkg_mode["mode"]
end
2026-07-08 11:50:12 +08:00
subgraph group_cordis["packages/cordis"]
pkg_tool_cordis["tool-cordis"]
end
2026-07-05 01:25:58 +08:00
subgraph group_hooks["packages/hooks"]
pkg_hook_protocol["hook-protocol"]
pkg_hooks_claude["hooks-claude"]
pkg_hooks_codex["hooks-codex"]
end
subgraph group_session_persistence["packages/session-persistence"]
pkg_session_persistence["session-persistence"]
pkg_session_persistence_jsonl["session-persistence-jsonl"]
pkg_session_persistence_sqlite["session-persistence-sqlite"]
end
2026-07-10 16:51:19 +08:00
subgraph group_session_query["packages/session-query"]
pkg_session_query["session-query"]
end
2026-07-21 01:54:00 +08:00
subgraph group_session_title["packages/session-title"]
pkg_session_title["session-title"]
pkg_session_title_all_messages_llm["session-title-all-messages-llm"]
pkg_session_title_first_message_llm["session-title-first-message-llm"]
pkg_session_title_llm["session-title-llm"]
end
2026-07-05 01:25:58 +08:00
subgraph group_support["packages/support"]
feat(acp-snapshot): extract the ACP snapshot suite into a support package
The snapshot tier's machinery leaves examples/acp-agent/tests for
packages/support/acp-snapshot (@deepseek-ai/dsh-acp-snapshot), where the
coverage gate measures it and a second example can consume it instead of
forking it: harness.ts (runScenario, parameterized by an AgentUnderTest
{binScript, configPath, tsconfigPath} instead of module constants),
normalize.ts (moved verbatim), and suite.ts (defineAcpSnapshotSuite — the
per-scenario golden/log compares, record write-back, per-suite header pin
with its uniformity guard, and the fixture guard block, lifted from
acp.snapshot.ts). The example file collapses to its scenario table plus
one factory call; env reading (DSH_SNAPSHOT) stays at that edge.
The exactly-one-pin meta-test generalizes from the hardcoded text-turn
name to "exactly one per suite" — which scenario pins is the scenario
table's reviewable choice (per-suite pinning per the proposal RFC).
Extraction parity: pnpm run test:snapshot is 36 passed + fs-policy-reject
failing BEFORE AND AFTER (BSD-sed environment failure, reproduced at the
base commit in a clean worktree — the recorded golden's sed -i syntax is
GNU-only), with zero byte changes under examples/acp-agent/tests/snapshots/.
Coverage for the new src files lands in the next commit.
2026-07-08 01:44:20 +08:00
pkg_acp_snapshot["acp-snapshot"]
2026-07-16 17:39:53 +08:00
pkg_agent_loop_testkit["agent-loop-testkit"]
2026-07-05 01:25:58 +08:00
pkg_invariants["invariants"]
pkg_llm_replay["llm-replay"]
2026-07-14 05:00:54 +08:00
pkg_loader_smoke["loader-smoke"]
2026-07-05 01:25:58 +08:00
end
subgraph group_ui["packages/ui"]
pkg_acp["acp"]
2026-07-05 01:53:13 +08:00
pkg_app_boot["app-boot"]
2026-07-19 22:11:59 +08:00
pkg_commands["commands"]
2026-07-11 14:08:12 +08:00
pkg_jsonrpc["jsonrpc"]
feat(permission): user-facing permission presets — one Permissions select over the two knobs
A preset names a bundle of the two mechanism knobs — request =
workspace-write + ask, yolo = danger-full-access + never — so the editor
shows ONE 'Permissions' select where the sandbox-mode and approval-policy
tiers stay orthogonal capabilities (the Codex /approvals shape: presets over
two dials). ctx.permission (dsh-permission) owns the config-defined table,
validates the default preset's bundle against the composed knob defaults at
load (fails loud), and writes a switch THROUGH: one log-only
permission/preset event (the audit fact reverse-mapping cannot recover —
the planned 'agent' preset shares request's knob values and differs only in
composed policy) plus each knob event via its own setter, deduped — a
net-zero switch appends nothing. Every knob consumer keeps reading its own
fold, untouched.
The current preset DERIVES from the effective knob values — the fold breaks
bundle ties, a knob state outside the table is the reserved 'custom' value
(a state, not an error: shown while it holds, switchable FROM, never a
target), and defaultPreset disappears (zero-event state reverse-maps from
the composition defaults).
The ACP bridge drops the two per-knob selects for the one preset select
(advertised only when ctx.permission is composed); pending/anchor/no-op
semantics carry over unchanged, with the no-op echo acknowledged before
vocabulary validation so a client re-pushing a derived 'custom' current
never errors. The sandbox variant example composes the
service with a workspace-write default; the permission-switching,
escalation-approved and escalation-rejected scenarios are re-recorded under
it (escalations now target an outside-workspace /tmp path under
danger-full-access, self-cleaning) and config-options is re-authored on the
single-select wire.
2026-07-12 21:03:41 +08:00
pkg_permission["permission"]
2026-07-05 17:05:33 +08:00
pkg_tool_ask_user["tool-ask-user"]
2026-07-17 12:01:37 +08:00
pkg_tui["tui"]
2026-07-11 21:37:38 +08:00
pkg_user_approval["user-approval"]
2026-07-09 17:55:01 +08:00
pkg_user_interaction["user-interaction"]
2026-07-05 01:25:58 +08:00
end
2026-07-08 02:17:24 +08:00
subgraph group_code_runtime["packages/code-runtime"]
pkg_code_runtime["code-runtime"]
feat: add the worker-thread code runtime (dsh-code-runtime-worker)
The shipped backend of the code-execution seam, per the Code Mode RFC's
worker-thread section: one fresh Node worker per run, executing the
model's TypeScript after a host-side type-strip (wrapped in an
async-function shell so top-level return/await parse, sliced back out
position-preserved), bindings bridged over the message port under
hostile-peer rules (own-property name lookup, at-most-once replies,
post-settlement drops, null-prototype namespaces), logs streamed eagerly
with an in-band truncation marker, and two independent budgets — measured
event-loop busy time (computeMs) plus a never-pausing wall ceiling
(maxWallMs) — funneling into worker.terminate(). env: {} and execArgv: []
keep the isolate hermetic; disposal aborts in-flight runs and awaits
worker exits.
The worker entry loads unbuilt via Node's native type stripping
(src/worker.ts, erasable-only) and ships built as a sibling tsdown bundle
(lib/worker.js); tests/built-lib.e2e.ts pins the built load path under
plain node and joins the built-artifact smoke gate. Unit suites cover the
bootstrap in-process (fake port) and the runtime over real workers,
per-file 100%.
2026-07-08 11:00:06 +08:00
pkg_code_runtime_worker["code-runtime-worker"]
2026-07-08 02:17:24 +08:00
end
2026-07-14 16:04:34 +08:00
subgraph group_context["packages/context"]
pkg_time_context["time-context"]
2026-07-16 16:01:06 +08:00
pkg_workspace_context["workspace-context"]
2026-07-14 16:04:34 +08:00
end
2026-07-15 15:57:57 +08:00
subgraph group_examples["packages/examples"]
pkg_acp_demo["acp-demo"]
pkg_agent_spine_demo["agent-spine-demo"]
2026-07-15 21:21:24 +08:00
pkg_cli_demo["cli-demo"]
2026-07-15 15:57:57 +08:00
pkg_jsonrpc_demo["jsonrpc-demo"]
2026-07-20 19:26:04 +08:00
pkg_tui_demo["tui-demo"]
2026-07-15 15:57:57 +08:00
end
2026-07-08 14:24:20 +08:00
subgraph group_guard["packages/guard"]
pkg_repeat_tool_guard["repeat-tool-guard"]
end
feat(lsp): LSP capability seam, generic stdio provider, and lsp tool
Implements the LSP capability seam RFC as three packages: dsh-lsp (the
ctx.lsp interface — provider registry by branded id + exclusive extension
mapping, per-query order-independent selection, closed request/result
vocabulary, LspError taxonomy), dsh-lsp-local (a generic stdio language-server
provider — Content-Length JSON-RPC framing, per-(provider, workspace) process
single-flight, transient didOpen/query/didClose, an abortable per-instance
queue, UTF-16 negotiation, host-namespace source reads outside ctx.fs, and
bounded shutdown/kill teardown), and dsh-tool-lsp (the model-facing lsp tool —
four operations, one-based UTF-16 cursor conversion, workspace-grouped location
rendering, hover capping, a required session workspace, and a timeout budget).
Why: an agent had text search and file reads but no way to identify a program
symbol — follow an alias, connect an interface to implementations, or read an
inferred type — before changing code. Splitting model contract, seam, and local
subprocess behavior keeps the four semantic queries stable across future remote
or sandbox-native providers without leaking a JSON-RPC escape hatch.
2026-07-16 12:05:35 +08:00
subgraph group_lsp["packages/lsp"]
pkg_lsp["lsp"]
pkg_lsp_local["lsp-local"]
pkg_tool_lsp["tool-lsp"]
end
2026-07-07 23:21:54 +08:00
subgraph group_mcp["packages/mcp"]
pkg_mcp_client["mcp-client"]
end
2026-07-09 15:42:37 +08:00
subgraph group_sandbox["packages/sandbox"]
pkg_sandbox["sandbox"]
pkg_sandbox_local["sandbox-local"]
feat(sandbox): cross-family file sandbox — one policy home, sandboxed fs provider, fs escalation parity
Extend SandboxMode enforcement from bash to the filesystem tools, the sandbox
RFC's deferred cross-family phase.
- dsh-sandbox-policy (new, ctx.sandboxPolicy): the single home for the
deployment default mode + workspaceRoot and the per-session override event,
renamed bash/sandbox-mode -> sandbox/mode and moved here with its fold/setter.
Decouples the bash seam from dsh-session.
- dsh-fs-sandbox (new): SandboxedFileSystem extends LocalFileSystem and fences
write/edit by the per-call mode (read-only denies, workspace-write contains to
the workspace + temp roots via the shared writableRoots, danger passes
through); reads pass through. Structured FS_SANDBOX_DENIED; in-lock parent
re-canonicalization. A policy fence in trusted code, not a kernel boundary.
- dsh-sandbox: the shared escalation kit (writableRoots, the strictly-wider
ladder, denial/hint markers, approveEscalation) both tool families use;
approveEscalation takes a structural approver so dsh-sandbox gains no
approval/agent dependency, and both tools stay duplication-free.
- tool-fs: write/edit advertise sandbox_permissions/justification under a
confining ctx.fs, map FS_SANDBOX_DENIED to the shared [sandbox: ...] marker,
and resolve the same one-approved-wider retry.
- examples/acp-agent: composes sandbox-policy + fs-sandbox, drops the gating
that disabled the fs stack under confined modes.
RFC docs/rfc/implemented/feature/2026-07-14-cross-family-fs-sandbox.md; the old
sandbox RFC's In-process/deferred/FAQ sections updated to shipped fact.
2026-07-14 20:05:57 +08:00
pkg_sandbox_policy["sandbox-policy"]
2026-07-09 15:42:37 +08:00
end
2026-07-15 18:17:38 +08:00
subgraph group_sdk["packages/sdk"]
pkg_helper["helper"]
pkg_scripts["scripts"]
2026-07-17 13:16:51 +08:00
pkg_telemetry["telemetry"]
2026-07-15 18:17:38 +08:00
end
feat(tasks): background task runtime, generic task_* control tools, bash/subagent producers
One shared ctx.tasks registry (branded <kind>-N ids, owner-fenced
read/kill/wait/list, attachSurface misconfiguration fence, reported-flag
notice dedup, atomic register) + dsh-tool-tasks (task_output/task_list/
task_kill, completion-notice injection, background prompt habit).
Producers opt in via their own enableRunInBackground config: bash
(stream kind; seam slimmed to resolve/run/start returning a BashProcess
handle, bash_output/bash_kill deleted) and subagent (final-output kind;
done settles after run.dispose()). Owner disposal drains tasks through
the new awaited ctx.agents.onCleanup seam in the loop's disposal chain.
Both RFCs moved to implemented/; docs, catalogs, snapshots re-pinned.
2026-07-09 21:22:54 +08:00
subgraph group_tasks["packages/tasks"]
pkg_tasks["tasks"]
pkg_tool_tasks["tool-tasks"]
end
2026-07-06 03:14:07 +08:00
subgraph group_workflow["packages/workflow"]
2026-07-20 00:51:19 +08:00
pkg_tool_ralph["tool-ralph"]
2026-07-06 03:14:07 +08:00
pkg_tool_workflow["tool-workflow"]
pkg_workflow["workflow"]
2026-07-09 19:06:55 +08:00
pkg_workflow_workerthread["workflow-workerthread"]
2026-07-06 03:14:07 +08:00
end
2026-07-19 22:13:50 +08:00
pkg_brand --> pkg_invariants
pkg_paths --> pkg_invariants
pkg_retention --> pkg_invariants
pkg_timeout --> pkg_invariants
2026-07-19 19:19:57 +08:00
pkg_scope --> pkg_invariants
2026-07-19 22:13:50 +08:00
pkg_skill --> pkg_invariants
pkg_subagent_subprocess --> pkg_invariants
pkg_acp_snapshot --> pkg_invariants
pkg_loader_smoke --> pkg_invariants
pkg_app_boot --> pkg_invariants
pkg_code_runtime --> pkg_invariants
pkg_jsonrpc_demo --> pkg_invariants
2026-07-05 01:25:58 +08:00
pkg_llm --> pkg_brand
2026-07-19 22:13:50 +08:00
pkg_llm --> pkg_invariants
feat: add the worker-thread code runtime (dsh-code-runtime-worker)
The shipped backend of the code-execution seam, per the Code Mode RFC's
worker-thread section: one fresh Node worker per run, executing the
model's TypeScript after a host-side type-strip (wrapped in an
async-function shell so top-level return/await parse, sliced back out
position-preserved), bindings bridged over the message port under
hostile-peer rules (own-property name lookup, at-most-once replies,
post-settlement drops, null-prototype namespaces), logs streamed eagerly
with an in-band truncation marker, and two independent budgets — measured
event-loop busy time (computeMs) plus a never-pausing wall ceiling
(maxWallMs) — funneling into worker.terminate(). env: {} and execArgv: []
keep the isolate hermetic; disposal aborts in-flight runs and awaits
worker exits.
The worker entry loads unbuilt via Node's native type stripping
(src/worker.ts, erasable-only) and ships built as a sibling tsdown bundle
(lib/worker.js); tests/built-lib.e2e.ts pins the built load path under
plain node and joins the built-artifact smoke gate. Unit suites cover the
bootstrap in-process (fake port) and the runtime over real workers,
per-file 100%.
2026-07-08 11:00:06 +08:00
pkg_code_runtime_worker --> pkg_code_runtime
2026-07-19 22:13:50 +08:00
pkg_code_runtime_worker --> pkg_invariants
2026-07-15 18:17:38 +08:00
pkg_helper --> pkg_brand
2026-07-19 22:13:50 +08:00
pkg_helper --> pkg_invariants
2026-07-15 18:17:38 +08:00
pkg_scripts --> pkg_app_boot
2026-07-19 22:13:50 +08:00
pkg_scripts --> pkg_invariants
2026-07-17 13:16:51 +08:00
pkg_telemetry --> pkg_brand
2026-07-20 00:35:06 +08:00
pkg_telemetry --> pkg_invariants
2026-07-21 13:52:00 +08:00
pkg_telemetry --> pkg_paths
2026-07-19 22:13:50 +08:00
pkg_llm_deepseek --> pkg_invariants
2026-07-05 01:25:58 +08:00
pkg_llm_deepseek --> pkg_llm
2026-07-20 03:34:19 +08:00
pkg_llm_deepseek --> pkg_timeout
2026-07-19 22:13:50 +08:00
pkg_llm_pi_ai --> pkg_invariants
2026-07-05 01:25:58 +08:00
pkg_llm_pi_ai --> pkg_llm
2026-07-20 03:34:19 +08:00
pkg_llm_pi_ai --> pkg_timeout
2026-07-05 01:25:58 +08:00
pkg_session --> pkg_brand
2026-07-19 19:19:57 +08:00
pkg_session --> pkg_invariants
2026-07-05 01:25:58 +08:00
pkg_session --> pkg_llm
2026-07-09 01:21:27 +08:00
pkg_session --> pkg_scope
2026-07-19 22:13:50 +08:00
pkg_system_prompt --> pkg_invariants
2026-07-05 01:25:58 +08:00
pkg_system_prompt --> pkg_llm
2026-07-12 22:49:46 +08:00
pkg_system_prompt --> pkg_scope
2026-07-19 22:13:50 +08:00
pkg_web --> pkg_invariants
2026-07-05 01:25:58 +08:00
pkg_web --> pkg_llm
feat(lsp): LSP capability seam, generic stdio provider, and lsp tool
Implements the LSP capability seam RFC as three packages: dsh-lsp (the
ctx.lsp interface — provider registry by branded id + exclusive extension
mapping, per-query order-independent selection, closed request/result
vocabulary, LspError taxonomy), dsh-lsp-local (a generic stdio language-server
provider — Content-Length JSON-RPC framing, per-(provider, workspace) process
single-flight, transient didOpen/query/didClose, an abortable per-instance
queue, UTF-16 negotiation, host-namespace source reads outside ctx.fs, and
bounded shutdown/kill teardown), and dsh-tool-lsp (the model-facing lsp tool —
four operations, one-based UTF-16 cursor conversion, workspace-grouped location
rendering, hover capping, a required session workspace, and a timeout budget).
Why: an agent had text search and file reads but no way to identify a program
symbol — follow an alias, connect an interface to implementations, or read an
inferred type — before changing code. Splitting model contract, seam, and local
subprocess behavior keeps the four semantic queries stable across future remote
or sandbox-native providers without leaking a JSON-RPC escape hatch.
2026-07-16 12:05:35 +08:00
pkg_lsp --> pkg_brand
2026-07-21 18:27:46 +08:00
pkg_lsp --> pkg_invariants
feat(lsp): LSP capability seam, generic stdio provider, and lsp tool
Implements the LSP capability seam RFC as three packages: dsh-lsp (the
ctx.lsp interface — provider registry by branded id + exclusive extension
mapping, per-query order-independent selection, closed request/result
vocabulary, LspError taxonomy), dsh-lsp-local (a generic stdio language-server
provider — Content-Length JSON-RPC framing, per-(provider, workspace) process
single-flight, transient didOpen/query/didClose, an abortable per-instance
queue, UTF-16 negotiation, host-namespace source reads outside ctx.fs, and
bounded shutdown/kill teardown), and dsh-tool-lsp (the model-facing lsp tool —
four operations, one-based UTF-16 cursor conversion, workspace-grouped location
rendering, hover capping, a required session workspace, and a timeout budget).
Why: an agent had text search and file reads but no way to identify a program
symbol — follow an alias, connect an interface to implementations, or read an
inferred type — before changing code. Splitting model contract, seam, and local
subprocess behavior keeps the four semantic queries stable across future remote
or sandbox-native providers without leaking a JSON-RPC escape hatch.
2026-07-16 12:05:35 +08:00
pkg_lsp --> pkg_llm
2026-07-19 22:13:50 +08:00
pkg_sandbox --> pkg_invariants
2026-07-09 15:42:37 +08:00
pkg_sandbox --> pkg_llm
2026-07-19 22:13:50 +08:00
pkg_token_meter --> pkg_invariants
2026-07-15 14:47:29 +08:00
pkg_token_meter --> pkg_llm
pkg_token_meter --> pkg_session
2026-07-05 01:25:58 +08:00
pkg_agent --> pkg_brand
2026-07-19 19:19:57 +08:00
pkg_agent --> pkg_invariants
2026-07-05 01:25:58 +08:00
pkg_agent --> pkg_llm
2026-07-12 22:49:46 +08:00
pkg_agent --> pkg_scope
2026-07-05 01:25:58 +08:00
pkg_agent --> pkg_session
2026-07-05 20:54:48 +08:00
pkg_agent --> pkg_system_prompt
2026-07-19 22:13:50 +08:00
pkg_bash --> pkg_invariants
2026-07-09 16:05:44 +08:00
pkg_bash --> pkg_sandbox
feat(sandbox): cross-family file sandbox — one policy home, sandboxed fs provider, fs escalation parity
Extend SandboxMode enforcement from bash to the filesystem tools, the sandbox
RFC's deferred cross-family phase.
- dsh-sandbox-policy (new, ctx.sandboxPolicy): the single home for the
deployment default mode + workspaceRoot and the per-session override event,
renamed bash/sandbox-mode -> sandbox/mode and moved here with its fold/setter.
Decouples the bash seam from dsh-session.
- dsh-fs-sandbox (new): SandboxedFileSystem extends LocalFileSystem and fences
write/edit by the per-call mode (read-only denies, workspace-write contains to
the workspace + temp roots via the shared writableRoots, danger passes
through); reads pass through. Structured FS_SANDBOX_DENIED; in-lock parent
re-canonicalization. A policy fence in trusted code, not a kernel boundary.
- dsh-sandbox: the shared escalation kit (writableRoots, the strictly-wider
ladder, denial/hint markers, approveEscalation) both tool families use;
approveEscalation takes a structural approver so dsh-sandbox gains no
approval/agent dependency, and both tools stay duplication-free.
- tool-fs: write/edit advertise sandbox_permissions/justification under a
confining ctx.fs, map FS_SANDBOX_DENIED to the shared [sandbox: ...] marker,
and resolve the same one-approved-wider retry.
- examples/acp-agent: composes sandbox-policy + fs-sandbox, drops the gating
that disabled the fs stack under confined modes.
RFC docs/rfc/implemented/feature/2026-07-14-cross-family-fs-sandbox.md; the old
sandbox RFC's In-process/deferred/FAQ sections updated to shipped fact.
2026-07-14 20:05:57 +08:00
pkg_fs --> pkg_brand
2026-07-20 19:48:51 +08:00
pkg_fs --> pkg_invariants
feat(sandbox): cross-family file sandbox — one policy home, sandboxed fs provider, fs escalation parity
Extend SandboxMode enforcement from bash to the filesystem tools, the sandbox
RFC's deferred cross-family phase.
- dsh-sandbox-policy (new, ctx.sandboxPolicy): the single home for the
deployment default mode + workspaceRoot and the per-session override event,
renamed bash/sandbox-mode -> sandbox/mode and moved here with its fold/setter.
Decouples the bash seam from dsh-session.
- dsh-fs-sandbox (new): SandboxedFileSystem extends LocalFileSystem and fences
write/edit by the per-call mode (read-only denies, workspace-write contains to
the workspace + temp roots via the shared writableRoots, danger passes
through); reads pass through. Structured FS_SANDBOX_DENIED; in-lock parent
re-canonicalization. A policy fence in trusted code, not a kernel boundary.
- dsh-sandbox: the shared escalation kit (writableRoots, the strictly-wider
ladder, denial/hint markers, approveEscalation) both tool families use;
approveEscalation takes a structural approver so dsh-sandbox gains no
approval/agent dependency, and both tools stay duplication-free.
- tool-fs: write/edit advertise sandbox_permissions/justification under a
confining ctx.fs, map FS_SANDBOX_DENIED to the shared [sandbox: ...] marker,
and resolve the same one-approved-wider retry.
- examples/acp-agent: composes sandbox-policy + fs-sandbox, drops the gating
that disabled the fs stack under confined modes.
RFC docs/rfc/implemented/feature/2026-07-14-cross-family-fs-sandbox.md; the old
sandbox RFC's In-process/deferred/FAQ sections updated to shipped fact.
2026-07-14 20:05:57 +08:00
pkg_fs --> pkg_llm
pkg_fs --> pkg_sandbox
2026-07-19 22:13:50 +08:00
pkg_compact --> pkg_invariants
2026-07-05 01:25:58 +08:00
pkg_compact --> pkg_llm
pkg_compact --> pkg_session
2026-07-20 19:48:51 +08:00
pkg_compact_tool_result_prune --> pkg_invariants
2026-07-20 23:32:37 +08:00
pkg_compact_tool_result_prune --> pkg_llm
pkg_compact_tool_result_prune --> pkg_session
2026-07-19 22:13:50 +08:00
pkg_web_fetch_local --> pkg_invariants
2026-07-06 16:23:52 +08:00
pkg_web_fetch_local --> pkg_timeout
2026-07-05 01:25:58 +08:00
pkg_web_fetch_local --> pkg_web
2026-07-19 22:13:50 +08:00
pkg_web_search_deepseek --> pkg_invariants
2026-07-05 01:25:58 +08:00
pkg_web_search_deepseek --> pkg_web
2026-07-19 22:13:50 +08:00
pkg_web_search_exa --> pkg_invariants
2026-07-05 01:25:58 +08:00
pkg_web_search_exa --> pkg_web
2026-07-19 22:13:50 +08:00
pkg_web_search_perplexity --> pkg_invariants
2026-07-05 01:25:58 +08:00
pkg_web_search_perplexity --> pkg_web
2026-07-08 19:20:50 +08:00
pkg_spill --> pkg_brand
2026-07-19 22:13:50 +08:00
pkg_spill --> pkg_invariants
2026-07-08 19:20:50 +08:00
pkg_spill --> pkg_llm
pkg_spill --> pkg_session
2026-07-19 22:13:50 +08:00
pkg_session_persistence --> pkg_invariants
2026-07-05 01:25:58 +08:00
pkg_session_persistence --> pkg_session
2026-07-21 01:54:00 +08:00
pkg_session_title --> pkg_brand
2026-07-21 21:11:32 +08:00
pkg_session_title --> pkg_invariants
2026-07-21 01:54:00 +08:00
pkg_session_title --> pkg_llm
pkg_session_title --> pkg_session
2026-07-19 22:13:50 +08:00
pkg_llm_replay --> pkg_invariants
2026-07-05 01:25:58 +08:00
pkg_llm_replay --> pkg_llm
pkg_llm_replay --> pkg_session
feat(lsp): LSP capability seam, generic stdio provider, and lsp tool
Implements the LSP capability seam RFC as three packages: dsh-lsp (the
ctx.lsp interface — provider registry by branded id + exclusive extension
mapping, per-query order-independent selection, closed request/result
vocabulary, LspError taxonomy), dsh-lsp-local (a generic stdio language-server
provider — Content-Length JSON-RPC framing, per-(provider, workspace) process
single-flight, transient didOpen/query/didClose, an abortable per-instance
queue, UTF-16 negotiation, host-namespace source reads outside ctx.fs, and
bounded shutdown/kill teardown), and dsh-tool-lsp (the model-facing lsp tool —
four operations, one-based UTF-16 cursor conversion, workspace-grouped location
rendering, hover capping, a required session workspace, and a timeout budget).
Why: an agent had text search and file reads but no way to identify a program
symbol — follow an alias, connect an interface to implementations, or read an
inferred type — before changing code. Splitting model contract, seam, and local
subprocess behavior keeps the four semantic queries stable across future remote
or sandbox-native providers without leaking a JSON-RPC escape hatch.
2026-07-16 12:05:35 +08:00
pkg_lsp_local --> pkg_brand
2026-07-21 18:27:46 +08:00
pkg_lsp_local --> pkg_invariants
feat(lsp): LSP capability seam, generic stdio provider, and lsp tool
Implements the LSP capability seam RFC as three packages: dsh-lsp (the
ctx.lsp interface — provider registry by branded id + exclusive extension
mapping, per-query order-independent selection, closed request/result
vocabulary, LspError taxonomy), dsh-lsp-local (a generic stdio language-server
provider — Content-Length JSON-RPC framing, per-(provider, workspace) process
single-flight, transient didOpen/query/didClose, an abortable per-instance
queue, UTF-16 negotiation, host-namespace source reads outside ctx.fs, and
bounded shutdown/kill teardown), and dsh-tool-lsp (the model-facing lsp tool —
four operations, one-based UTF-16 cursor conversion, workspace-grouped location
rendering, hover capping, a required session workspace, and a timeout budget).
Why: an agent had text search and file reads but no way to identify a program
symbol — follow an alias, connect an interface to implementations, or read an
inferred type — before changing code. Splitting model contract, seam, and local
subprocess behavior keeps the four semantic queries stable across future remote
or sandbox-native providers without leaking a JSON-RPC escape hatch.
2026-07-16 12:05:35 +08:00
pkg_lsp_local --> pkg_llm
pkg_lsp_local --> pkg_lsp
pkg_lsp_local --> pkg_timeout
2026-07-19 22:13:50 +08:00
pkg_sandbox_local --> pkg_invariants
2026-07-09 15:42:37 +08:00
pkg_sandbox_local --> pkg_llm
pkg_sandbox_local --> pkg_sandbox
2026-07-20 19:48:51 +08:00
pkg_sandbox_policy --> pkg_invariants
feat(sandbox): cross-family file sandbox — one policy home, sandboxed fs provider, fs escalation parity
Extend SandboxMode enforcement from bash to the filesystem tools, the sandbox
RFC's deferred cross-family phase.
- dsh-sandbox-policy (new, ctx.sandboxPolicy): the single home for the
deployment default mode + workspaceRoot and the per-session override event,
renamed bash/sandbox-mode -> sandbox/mode and moved here with its fold/setter.
Decouples the bash seam from dsh-session.
- dsh-fs-sandbox (new): SandboxedFileSystem extends LocalFileSystem and fences
write/edit by the per-call mode (read-only denies, workspace-write contains to
the workspace + temp roots via the shared writableRoots, danger passes
through); reads pass through. Structured FS_SANDBOX_DENIED; in-lock parent
re-canonicalization. A policy fence in trusted code, not a kernel boundary.
- dsh-sandbox: the shared escalation kit (writableRoots, the strictly-wider
ladder, denial/hint markers, approveEscalation) both tool families use;
approveEscalation takes a structural approver so dsh-sandbox gains no
approval/agent dependency, and both tools stay duplication-free.
- tool-fs: write/edit advertise sandbox_permissions/justification under a
confining ctx.fs, map FS_SANDBOX_DENIED to the shared [sandbox: ...] marker,
and resolve the same one-approved-wider retry.
- examples/acp-agent: composes sandbox-policy + fs-sandbox, drops the gating
that disabled the fs stack under confined modes.
RFC docs/rfc/implemented/feature/2026-07-14-cross-family-fs-sandbox.md; the old
sandbox RFC's In-process/deferred/FAQ sections updated to shipped fact.
2026-07-14 20:05:57 +08:00
pkg_sandbox_policy --> pkg_sandbox
pkg_sandbox_policy --> pkg_session
2026-07-20 03:34:19 +08:00
pkg_llm_retry --> pkg_agent
2026-07-20 23:16:08 +08:00
pkg_llm_retry --> pkg_invariants
2026-07-20 03:34:19 +08:00
pkg_llm_retry --> pkg_llm
pkg_llm_retry --> pkg_session
pkg_llm_retry --> pkg_timeout
2026-07-19 18:47:34 +08:00
pkg_goal --> pkg_agent
pkg_goal --> pkg_brand
2026-07-21 00:44:39 +08:00
pkg_goal --> pkg_invariants
2026-07-19 18:47:34 +08:00
pkg_goal --> pkg_llm
pkg_goal --> pkg_scope
pkg_goal --> pkg_session
2026-07-09 16:05:44 +08:00
pkg_bash_local --> pkg_bash
2026-07-19 22:13:50 +08:00
pkg_bash_local --> pkg_invariants
2026-07-09 16:05:44 +08:00
pkg_bash_local --> pkg_timeout
feat(sandbox): cross-family file sandbox — one policy home, sandboxed fs provider, fs escalation parity
Extend SandboxMode enforcement from bash to the filesystem tools, the sandbox
RFC's deferred cross-family phase.
- dsh-sandbox-policy (new, ctx.sandboxPolicy): the single home for the
deployment default mode + workspaceRoot and the per-session override event,
renamed bash/sandbox-mode -> sandbox/mode and moved here with its fold/setter.
Decouples the bash seam from dsh-session.
- dsh-fs-sandbox (new): SandboxedFileSystem extends LocalFileSystem and fences
write/edit by the per-call mode (read-only denies, workspace-write contains to
the workspace + temp roots via the shared writableRoots, danger passes
through); reads pass through. Structured FS_SANDBOX_DENIED; in-lock parent
re-canonicalization. A policy fence in trusted code, not a kernel boundary.
- dsh-sandbox: the shared escalation kit (writableRoots, the strictly-wider
ladder, denial/hint markers, approveEscalation) both tool families use;
approveEscalation takes a structural approver so dsh-sandbox gains no
approval/agent dependency, and both tools stay duplication-free.
- tool-fs: write/edit advertise sandbox_permissions/justification under a
confining ctx.fs, map FS_SANDBOX_DENIED to the shared [sandbox: ...] marker,
and resolve the same one-approved-wider retry.
- examples/acp-agent: composes sandbox-policy + fs-sandbox, drops the gating
that disabled the fs stack under confined modes.
RFC docs/rfc/implemented/feature/2026-07-14-cross-family-fs-sandbox.md; the old
sandbox RFC's In-process/deferred/FAQ sections updated to shipped fact.
2026-07-14 20:05:57 +08:00
pkg_fs_local --> pkg_fs
2026-07-20 19:48:51 +08:00
pkg_fs_local --> pkg_invariants
feat(sandbox): cross-family file sandbox — one policy home, sandboxed fs provider, fs escalation parity
Extend SandboxMode enforcement from bash to the filesystem tools, the sandbox
RFC's deferred cross-family phase.
- dsh-sandbox-policy (new, ctx.sandboxPolicy): the single home for the
deployment default mode + workspaceRoot and the per-session override event,
renamed bash/sandbox-mode -> sandbox/mode and moved here with its fold/setter.
Decouples the bash seam from dsh-session.
- dsh-fs-sandbox (new): SandboxedFileSystem extends LocalFileSystem and fences
write/edit by the per-call mode (read-only denies, workspace-write contains to
the workspace + temp roots via the shared writableRoots, danger passes
through); reads pass through. Structured FS_SANDBOX_DENIED; in-lock parent
re-canonicalization. A policy fence in trusted code, not a kernel boundary.
- dsh-sandbox: the shared escalation kit (writableRoots, the strictly-wider
ladder, denial/hint markers, approveEscalation) both tool families use;
approveEscalation takes a structural approver so dsh-sandbox gains no
approval/agent dependency, and both tools stay duplication-free.
- tool-fs: write/edit advertise sandbox_permissions/justification under a
confining ctx.fs, map FS_SANDBOX_DENIED to the shared [sandbox: ...] marker,
and resolve the same one-approved-wider retry.
- examples/acp-agent: composes sandbox-policy + fs-sandbox, drops the gating
that disabled the fs stack under confined modes.
RFC docs/rfc/implemented/feature/2026-07-14-cross-family-fs-sandbox.md; the old
sandbox RFC's In-process/deferred/FAQ sections updated to shipped fact.
2026-07-14 20:05:57 +08:00
pkg_fs_policy --> pkg_fs
2026-07-20 19:48:51 +08:00
pkg_fs_policy --> pkg_invariants
feat(sandbox): cross-family file sandbox — one policy home, sandboxed fs provider, fs escalation parity
Extend SandboxMode enforcement from bash to the filesystem tools, the sandbox
RFC's deferred cross-family phase.
- dsh-sandbox-policy (new, ctx.sandboxPolicy): the single home for the
deployment default mode + workspaceRoot and the per-session override event,
renamed bash/sandbox-mode -> sandbox/mode and moved here with its fold/setter.
Decouples the bash seam from dsh-session.
- dsh-fs-sandbox (new): SandboxedFileSystem extends LocalFileSystem and fences
write/edit by the per-call mode (read-only denies, workspace-write contains to
the workspace + temp roots via the shared writableRoots, danger passes
through); reads pass through. Structured FS_SANDBOX_DENIED; in-lock parent
re-canonicalization. A policy fence in trusted code, not a kernel boundary.
- dsh-sandbox: the shared escalation kit (writableRoots, the strictly-wider
ladder, denial/hint markers, approveEscalation) both tool families use;
approveEscalation takes a structural approver so dsh-sandbox gains no
approval/agent dependency, and both tools stay duplication-free.
- tool-fs: write/edit advertise sandbox_permissions/justification under a
confining ctx.fs, map FS_SANDBOX_DENIED to the shared [sandbox: ...] marker,
and resolve the same one-approved-wider retry.
- examples/acp-agent: composes sandbox-policy + fs-sandbox, drops the gating
that disabled the fs stack under confined modes.
RFC docs/rfc/implemented/feature/2026-07-14-cross-family-fs-sandbox.md; the old
sandbox RFC's In-process/deferred/FAQ sections updated to shipped fact.
2026-07-14 20:05:57 +08:00
pkg_skill_local --> pkg_fs
2026-07-20 19:48:51 +08:00
pkg_skill_local --> pkg_invariants
2026-07-21 13:52:00 +08:00
pkg_skill_local --> pkg_paths
feat(sandbox): cross-family file sandbox — one policy home, sandboxed fs provider, fs escalation parity
Extend SandboxMode enforcement from bash to the filesystem tools, the sandbox
RFC's deferred cross-family phase.
- dsh-sandbox-policy (new, ctx.sandboxPolicy): the single home for the
deployment default mode + workspaceRoot and the per-session override event,
renamed bash/sandbox-mode -> sandbox/mode and moved here with its fold/setter.
Decouples the bash seam from dsh-session.
- dsh-fs-sandbox (new): SandboxedFileSystem extends LocalFileSystem and fences
write/edit by the per-call mode (read-only denies, workspace-write contains to
the workspace + temp roots via the shared writableRoots, danger passes
through); reads pass through. Structured FS_SANDBOX_DENIED; in-lock parent
re-canonicalization. A policy fence in trusted code, not a kernel boundary.
- dsh-sandbox: the shared escalation kit (writableRoots, the strictly-wider
ladder, denial/hint markers, approveEscalation) both tool families use;
approveEscalation takes a structural approver so dsh-sandbox gains no
approval/agent dependency, and both tools stay duplication-free.
- tool-fs: write/edit advertise sandbox_permissions/justification under a
confining ctx.fs, map FS_SANDBOX_DENIED to the shared [sandbox: ...] marker,
and resolve the same one-approved-wider retry.
- examples/acp-agent: composes sandbox-policy + fs-sandbox, drops the gating
that disabled the fs stack under confined modes.
RFC docs/rfc/implemented/feature/2026-07-14-cross-family-fs-sandbox.md; the old
sandbox RFC's In-process/deferred/FAQ sections updated to shipped fact.
2026-07-14 20:05:57 +08:00
pkg_skill_local --> pkg_skill
2026-07-20 23:32:37 +08:00
pkg_compact_basic --> pkg_agent
pkg_compact_basic --> pkg_compact
pkg_compact_basic --> pkg_compact_tool_result_prune
2026-07-19 22:13:50 +08:00
pkg_compact_basic --> pkg_invariants
2026-07-20 23:32:37 +08:00
pkg_compact_basic --> pkg_llm
pkg_compact_basic --> pkg_session
pkg_compact_basic --> pkg_token_meter
2026-07-19 22:13:50 +08:00
pkg_spill_local --> pkg_invariants
2026-07-08 19:20:50 +08:00
pkg_spill_local --> pkg_spill
2026-07-09 16:05:44 +08:00
pkg_hook_protocol --> pkg_bash
2026-07-19 22:13:50 +08:00
pkg_hook_protocol --> pkg_invariants
2026-07-09 16:05:44 +08:00
pkg_hook_protocol --> pkg_session
2026-07-19 22:13:50 +08:00
pkg_session_persistence_jsonl --> pkg_invariants
2026-07-05 01:25:58 +08:00
pkg_session_persistence_jsonl --> pkg_session
pkg_session_persistence_jsonl --> pkg_session_persistence
2026-07-19 22:13:50 +08:00
pkg_session_persistence_sqlite --> pkg_invariants
2026-07-05 01:25:58 +08:00
pkg_session_persistence_sqlite --> pkg_session
pkg_session_persistence_sqlite --> pkg_session_persistence
2026-07-19 22:13:50 +08:00
pkg_session_query --> pkg_invariants
2026-07-10 16:51:19 +08:00
pkg_session_query --> pkg_llm
pkg_session_query --> pkg_session
pkg_session_query --> pkg_session_persistence
2026-07-21 01:54:00 +08:00
pkg_session_query --> pkg_session_title
2026-07-21 21:11:32 +08:00
pkg_session_title_llm --> pkg_invariants
2026-07-21 01:54:00 +08:00
pkg_session_title_llm --> pkg_llm
2026-07-21 12:08:00 +08:00
pkg_session_title_llm --> pkg_session
2026-07-21 01:54:00 +08:00
pkg_session_title_llm --> pkg_session_title
pkg_session_title_llm --> pkg_timeout
2026-07-19 22:11:59 +08:00
pkg_commands --> pkg_agent
2026-07-21 01:13:28 +08:00
pkg_commands --> pkg_invariants
2026-07-19 22:11:59 +08:00
pkg_commands --> pkg_scope
2026-07-11 21:37:38 +08:00
pkg_user_approval --> pkg_agent
pkg_user_approval --> pkg_brand
2026-07-19 22:13:50 +08:00
pkg_user_approval --> pkg_invariants
2026-07-11 21:37:38 +08:00
pkg_user_approval --> pkg_llm
2026-07-11 23:14:09 +08:00
pkg_user_approval --> pkg_scope
2026-07-11 21:37:38 +08:00
pkg_user_approval --> pkg_session
pkg_user_approval --> pkg_system_prompt
2026-07-09 17:55:01 +08:00
pkg_user_interaction --> pkg_agent
2026-07-19 22:13:50 +08:00
pkg_user_interaction --> pkg_invariants
2026-07-09 17:55:01 +08:00
pkg_user_interaction --> pkg_llm
2026-07-14 16:04:34 +08:00
pkg_time_context --> pkg_agent
2026-07-19 22:13:50 +08:00
pkg_time_context --> pkg_invariants
2026-07-21 17:46:43 +08:00
pkg_time_context --> pkg_session
feat(tasks): background task runtime, generic task_* control tools, bash/subagent producers
One shared ctx.tasks registry (branded <kind>-N ids, owner-fenced
read/kill/wait/list, attachSurface misconfiguration fence, reported-flag
notice dedup, atomic register) + dsh-tool-tasks (task_output/task_list/
task_kill, completion-notice injection, background prompt habit).
Producers opt in via their own enableRunInBackground config: bash
(stream kind; seam slimmed to resolve/run/start returning a BashProcess
handle, bash_output/bash_kill deleted) and subagent (final-output kind;
done settles after run.dispose()). Owner disposal drains tasks through
the new awaited ctx.agents.onCleanup seam in the loop's disposal chain.
Both RFCs moved to implemented/; docs, catalogs, snapshots re-pinned.
2026-07-09 21:22:54 +08:00
pkg_tasks --> pkg_agent
pkg_tasks --> pkg_brand
2026-07-19 22:13:50 +08:00
pkg_tasks --> pkg_invariants
2026-07-12 17:10:02 +08:00
pkg_tasks --> pkg_session
refactor(tasks): declare-then-execute — ctx.tasks.start() replaces register()
start({ kind, label, owner, run }) preflights everything that can fail
(the attachSurface fence, validation, the owner-cleanup attach) BEFORE
invoking the producer's run() starter, then commits atomically —
'work started but never got a collectable id' is now structurally
impossible instead of a producer try/catch rollback obligation (the
P1 review fix, rebuilt on #185's declare/execute split). Producers
lose their catch-wraps; the leak tests now pin the stronger property
that a failed preflight never spawns anything. TaskRegistration splits
into TaskStart (identity + run) and TaskHooks (cancel/done/readOutput);
docs, type-equiv manifest, catalogs, and both RFCs move with it.
2026-07-09 21:53:48 +08:00
pkg_tasks --> pkg_timeout
2026-07-06 03:14:07 +08:00
pkg_workflow --> pkg_agent
pkg_workflow --> pkg_brand
2026-07-19 22:13:50 +08:00
pkg_workflow --> pkg_invariants
2026-07-06 03:14:07 +08:00
pkg_workflow --> pkg_llm
2026-07-15 23:50:33 +08:00
pkg_workflow --> pkg_session
2026-07-09 15:25:18 +08:00
pkg_tools --> pkg_agent
pkg_tools --> pkg_code_runtime
2026-07-19 22:13:50 +08:00
pkg_tools --> pkg_invariants
2026-07-09 15:25:18 +08:00
pkg_tools --> pkg_llm
2026-07-11 23:14:09 +08:00
pkg_tools --> pkg_scope
2026-07-09 15:25:18 +08:00
pkg_tools --> pkg_session
pkg_tools --> pkg_system_prompt
2026-07-11 21:37:38 +08:00
pkg_tools --> pkg_user_approval
2026-07-19 23:55:33 +08:00
pkg_command_goal --> pkg_commands
pkg_command_goal --> pkg_goal
2026-07-21 01:13:28 +08:00
pkg_command_goal --> pkg_invariants
2026-07-19 20:30:43 +08:00
pkg_goal_session --> pkg_agent
pkg_goal_session --> pkg_goal
2026-07-21 01:13:28 +08:00
pkg_goal_session --> pkg_invariants
2026-07-19 20:30:43 +08:00
pkg_goal_session --> pkg_llm
pkg_goal_session --> pkg_session
2026-07-09 16:05:44 +08:00
pkg_bash_sandbox --> pkg_bash
pkg_bash_sandbox --> pkg_bash_local
2026-07-19 22:13:50 +08:00
pkg_bash_sandbox --> pkg_invariants
2026-07-09 16:05:44 +08:00
pkg_bash_sandbox --> pkg_sandbox
feat(sandbox): cross-family file sandbox — one policy home, sandboxed fs provider, fs escalation parity
Extend SandboxMode enforcement from bash to the filesystem tools, the sandbox
RFC's deferred cross-family phase.
- dsh-sandbox-policy (new, ctx.sandboxPolicy): the single home for the
deployment default mode + workspaceRoot and the per-session override event,
renamed bash/sandbox-mode -> sandbox/mode and moved here with its fold/setter.
Decouples the bash seam from dsh-session.
- dsh-fs-sandbox (new): SandboxedFileSystem extends LocalFileSystem and fences
write/edit by the per-call mode (read-only denies, workspace-write contains to
the workspace + temp roots via the shared writableRoots, danger passes
through); reads pass through. Structured FS_SANDBOX_DENIED; in-lock parent
re-canonicalization. A policy fence in trusted code, not a kernel boundary.
- dsh-sandbox: the shared escalation kit (writableRoots, the strictly-wider
ladder, denial/hint markers, approveEscalation) both tool families use;
approveEscalation takes a structural approver so dsh-sandbox gains no
approval/agent dependency, and both tools stay duplication-free.
- tool-fs: write/edit advertise sandbox_permissions/justification under a
confining ctx.fs, map FS_SANDBOX_DENIED to the shared [sandbox: ...] marker,
and resolve the same one-approved-wider retry.
- examples/acp-agent: composes sandbox-policy + fs-sandbox, drops the gating
that disabled the fs stack under confined modes.
RFC docs/rfc/implemented/feature/2026-07-14-cross-family-fs-sandbox.md; the old
sandbox RFC's In-process/deferred/FAQ sections updated to shipped fact.
2026-07-14 20:05:57 +08:00
pkg_bash_sandbox --> pkg_sandbox_policy
pkg_fs_sandbox --> pkg_fs
pkg_fs_sandbox --> pkg_fs_local
2026-07-20 19:48:51 +08:00
pkg_fs_sandbox --> pkg_invariants
feat(sandbox): cross-family file sandbox — one policy home, sandboxed fs provider, fs escalation parity
Extend SandboxMode enforcement from bash to the filesystem tools, the sandbox
RFC's deferred cross-family phase.
- dsh-sandbox-policy (new, ctx.sandboxPolicy): the single home for the
deployment default mode + workspaceRoot and the per-session override event,
renamed bash/sandbox-mode -> sandbox/mode and moved here with its fold/setter.
Decouples the bash seam from dsh-session.
- dsh-fs-sandbox (new): SandboxedFileSystem extends LocalFileSystem and fences
write/edit by the per-call mode (read-only denies, workspace-write contains to
the workspace + temp roots via the shared writableRoots, danger passes
through); reads pass through. Structured FS_SANDBOX_DENIED; in-lock parent
re-canonicalization. A policy fence in trusted code, not a kernel boundary.
- dsh-sandbox: the shared escalation kit (writableRoots, the strictly-wider
ladder, denial/hint markers, approveEscalation) both tool families use;
approveEscalation takes a structural approver so dsh-sandbox gains no
approval/agent dependency, and both tools stay duplication-free.
- tool-fs: write/edit advertise sandbox_permissions/justification under a
confining ctx.fs, map FS_SANDBOX_DENIED to the shared [sandbox: ...] marker,
and resolve the same one-approved-wider retry.
- examples/acp-agent: composes sandbox-policy + fs-sandbox, drops the gating
that disabled the fs stack under confined modes.
RFC docs/rfc/implemented/feature/2026-07-14-cross-family-fs-sandbox.md; the old
sandbox RFC's In-process/deferred/FAQ sections updated to shipped fact.
2026-07-14 20:05:57 +08:00
pkg_fs_sandbox --> pkg_sandbox
pkg_fs_sandbox --> pkg_sandbox_policy
2026-07-21 21:11:32 +08:00
pkg_session_title_all_messages_llm --> pkg_invariants
2026-07-21 01:54:00 +08:00
pkg_session_title_all_messages_llm --> pkg_llm
2026-07-21 12:08:00 +08:00
pkg_session_title_all_messages_llm --> pkg_session
2026-07-21 01:54:00 +08:00
pkg_session_title_all_messages_llm --> pkg_session_title
pkg_session_title_all_messages_llm --> pkg_session_title_llm
2026-07-21 21:11:32 +08:00
pkg_session_title_first_message_llm --> pkg_invariants
2026-07-21 01:54:00 +08:00
pkg_session_title_first_message_llm --> pkg_llm
2026-07-21 12:08:00 +08:00
pkg_session_title_first_message_llm --> pkg_session
2026-07-21 01:54:00 +08:00
pkg_session_title_first_message_llm --> pkg_session_title
pkg_session_title_first_message_llm --> pkg_session_title_llm
feat(permission): user-facing permission presets — one Permissions select over the two knobs
A preset names a bundle of the two mechanism knobs — request =
workspace-write + ask, yolo = danger-full-access + never — so the editor
shows ONE 'Permissions' select where the sandbox-mode and approval-policy
tiers stay orthogonal capabilities (the Codex /approvals shape: presets over
two dials). ctx.permission (dsh-permission) owns the config-defined table,
validates the default preset's bundle against the composed knob defaults at
load (fails loud), and writes a switch THROUGH: one log-only
permission/preset event (the audit fact reverse-mapping cannot recover —
the planned 'agent' preset shares request's knob values and differs only in
composed policy) plus each knob event via its own setter, deduped — a
net-zero switch appends nothing. Every knob consumer keeps reading its own
fold, untouched.
The current preset DERIVES from the effective knob values — the fold breaks
bundle ties, a knob state outside the table is the reserved 'custom' value
(a state, not an error: shown while it holds, switchable FROM, never a
target), and defaultPreset disappears (zero-event state reverse-maps from
the composition defaults).
The ACP bridge drops the two per-knob selects for the one preset select
(advertised only when ctx.permission is composed); pending/anchor/no-op
semantics carry over unchanged, with the no-op echo acknowledged before
vocabulary validation so a client re-pushing a derived 'custom' current
never errors. The sandbox variant example composes the
service with a workspace-write default; the permission-switching,
escalation-approved and escalation-rejected scenarios are re-recorded under
it (escalations now target an outside-workspace /tmp path under
danger-full-access, self-cleaning) and config-options is re-authored on the
single-select wire.
2026-07-12 21:03:41 +08:00
pkg_permission --> pkg_bash
2026-07-19 22:13:50 +08:00
pkg_permission --> pkg_invariants
feat(permission): user-facing permission presets — one Permissions select over the two knobs
A preset names a bundle of the two mechanism knobs — request =
workspace-write + ask, yolo = danger-full-access + never — so the editor
shows ONE 'Permissions' select where the sandbox-mode and approval-policy
tiers stay orthogonal capabilities (the Codex /approvals shape: presets over
two dials). ctx.permission (dsh-permission) owns the config-defined table,
validates the default preset's bundle against the composed knob defaults at
load (fails loud), and writes a switch THROUGH: one log-only
permission/preset event (the audit fact reverse-mapping cannot recover —
the planned 'agent' preset shares request's knob values and differs only in
composed policy) plus each knob event via its own setter, deduped — a
net-zero switch appends nothing. Every knob consumer keeps reading its own
fold, untouched.
The current preset DERIVES from the effective knob values — the fold breaks
bundle ties, a knob state outside the table is the reserved 'custom' value
(a state, not an error: shown while it holds, switchable FROM, never a
target), and defaultPreset disappears (zero-event state reverse-maps from
the composition defaults).
The ACP bridge drops the two per-knob selects for the one preset select
(advertised only when ctx.permission is composed); pending/anchor/no-op
semantics carry over unchanged, with the no-op echo acknowledged before
vocabulary validation so a client re-pushing a derived 'custom' current
never errors. The sandbox variant example composes the
service with a workspace-write default; the permission-switching,
escalation-approved and escalation-rejected scenarios are re-recorded under
it (escalations now target an outside-workspace /tmp path under
danger-full-access, self-cleaning) and config-options is re-authored on the
single-select wire.
2026-07-12 21:03:41 +08:00
pkg_permission --> pkg_sandbox
feat(sandbox): cross-family file sandbox — one policy home, sandboxed fs provider, fs escalation parity
Extend SandboxMode enforcement from bash to the filesystem tools, the sandbox
RFC's deferred cross-family phase.
- dsh-sandbox-policy (new, ctx.sandboxPolicy): the single home for the
deployment default mode + workspaceRoot and the per-session override event,
renamed bash/sandbox-mode -> sandbox/mode and moved here with its fold/setter.
Decouples the bash seam from dsh-session.
- dsh-fs-sandbox (new): SandboxedFileSystem extends LocalFileSystem and fences
write/edit by the per-call mode (read-only denies, workspace-write contains to
the workspace + temp roots via the shared writableRoots, danger passes
through); reads pass through. Structured FS_SANDBOX_DENIED; in-lock parent
re-canonicalization. A policy fence in trusted code, not a kernel boundary.
- dsh-sandbox: the shared escalation kit (writableRoots, the strictly-wider
ladder, denial/hint markers, approveEscalation) both tool families use;
approveEscalation takes a structural approver so dsh-sandbox gains no
approval/agent dependency, and both tools stay duplication-free.
- tool-fs: write/edit advertise sandbox_permissions/justification under a
confining ctx.fs, map FS_SANDBOX_DENIED to the shared [sandbox: ...] marker,
and resolve the same one-approved-wider retry.
- examples/acp-agent: composes sandbox-policy + fs-sandbox, drops the gating
that disabled the fs stack under confined modes.
RFC docs/rfc/implemented/feature/2026-07-14-cross-family-fs-sandbox.md; the old
sandbox RFC's In-process/deferred/FAQ sections updated to shipped fact.
2026-07-14 20:05:57 +08:00
pkg_permission --> pkg_sandbox_policy
feat(permission): user-facing permission presets — one Permissions select over the two knobs
A preset names a bundle of the two mechanism knobs — request =
workspace-write + ask, yolo = danger-full-access + never — so the editor
shows ONE 'Permissions' select where the sandbox-mode and approval-policy
tiers stay orthogonal capabilities (the Codex /approvals shape: presets over
two dials). ctx.permission (dsh-permission) owns the config-defined table,
validates the default preset's bundle against the composed knob defaults at
load (fails loud), and writes a switch THROUGH: one log-only
permission/preset event (the audit fact reverse-mapping cannot recover —
the planned 'agent' preset shares request's knob values and differs only in
composed policy) plus each knob event via its own setter, deduped — a
net-zero switch appends nothing. Every knob consumer keeps reading its own
fold, untouched.
The current preset DERIVES from the effective knob values — the fold breaks
bundle ties, a knob state outside the table is the reserved 'custom' value
(a state, not an error: shown while it holds, switchable FROM, never a
target), and defaultPreset disappears (zero-event state reverse-maps from
the composition defaults).
The ACP bridge drops the two per-knob selects for the one preset select
(advertised only when ctx.permission is composed); pending/anchor/no-op
semantics carry over unchanged, with the no-op echo acknowledged before
vocabulary validation so a client re-pushing a derived 'custom' current
never errors. The sandbox variant example composes the
service with a workspace-write default; the permission-switching,
escalation-approved and escalation-rejected scenarios are re-recorded under
it (escalations now target an outside-workspace /tmp path under
danger-full-access, self-cleaning) and config-options is re-authored on the
single-select wire.
2026-07-12 21:03:41 +08:00
pkg_permission --> pkg_session
pkg_permission --> pkg_user_approval
2026-07-05 01:25:58 +08:00
pkg_agent_loop --> pkg_agent
2026-07-19 19:19:57 +08:00
pkg_agent_loop --> pkg_invariants
2026-07-05 01:25:58 +08:00
pkg_agent_loop --> pkg_llm
2026-07-09 01:21:27 +08:00
pkg_agent_loop --> pkg_scope
2026-07-05 01:25:58 +08:00
pkg_agent_loop --> pkg_session
pkg_agent_loop --> pkg_session_persistence
pkg_agent_loop --> pkg_system_prompt
pkg_agent_loop --> pkg_tools
2026-07-19 19:22:10 +08:00
pkg_tool_goal --> pkg_agent
pkg_tool_goal --> pkg_goal
2026-07-21 01:13:28 +08:00
pkg_tool_goal --> pkg_invariants
2026-07-19 19:22:10 +08:00
pkg_tool_goal --> pkg_llm
pkg_tool_goal --> pkg_session
pkg_tool_goal --> pkg_system_prompt
pkg_tool_goal --> pkg_tools
2026-07-05 01:25:58 +08:00
pkg_tool_bash --> pkg_agent
pkg_tool_bash --> pkg_bash
2026-07-19 22:13:50 +08:00
pkg_tool_bash --> pkg_invariants
2026-07-05 01:25:58 +08:00
pkg_tool_bash --> pkg_llm
2026-07-21 13:52:00 +08:00
pkg_tool_bash --> pkg_paths
2026-07-09 16:05:44 +08:00
pkg_tool_bash --> pkg_sandbox
feat(sandbox): cross-family file sandbox — one policy home, sandboxed fs provider, fs escalation parity
Extend SandboxMode enforcement from bash to the filesystem tools, the sandbox
RFC's deferred cross-family phase.
- dsh-sandbox-policy (new, ctx.sandboxPolicy): the single home for the
deployment default mode + workspaceRoot and the per-session override event,
renamed bash/sandbox-mode -> sandbox/mode and moved here with its fold/setter.
Decouples the bash seam from dsh-session.
- dsh-fs-sandbox (new): SandboxedFileSystem extends LocalFileSystem and fences
write/edit by the per-call mode (read-only denies, workspace-write contains to
the workspace + temp roots via the shared writableRoots, danger passes
through); reads pass through. Structured FS_SANDBOX_DENIED; in-lock parent
re-canonicalization. A policy fence in trusted code, not a kernel boundary.
- dsh-sandbox: the shared escalation kit (writableRoots, the strictly-wider
ladder, denial/hint markers, approveEscalation) both tool families use;
approveEscalation takes a structural approver so dsh-sandbox gains no
approval/agent dependency, and both tools stay duplication-free.
- tool-fs: write/edit advertise sandbox_permissions/justification under a
confining ctx.fs, map FS_SANDBOX_DENIED to the shared [sandbox: ...] marker,
and resolve the same one-approved-wider retry.
- examples/acp-agent: composes sandbox-policy + fs-sandbox, drops the gating
that disabled the fs stack under confined modes.
RFC docs/rfc/implemented/feature/2026-07-14-cross-family-fs-sandbox.md; the old
sandbox RFC's In-process/deferred/FAQ sections updated to shipped fact.
2026-07-14 20:05:57 +08:00
pkg_tool_bash --> pkg_sandbox_policy
2026-07-10 20:52:27 +08:00
pkg_tool_bash --> pkg_session_persistence
2026-07-05 20:54:48 +08:00
pkg_tool_bash --> pkg_system_prompt
feat(tasks): background task runtime, generic task_* control tools, bash/subagent producers
One shared ctx.tasks registry (branded <kind>-N ids, owner-fenced
read/kill/wait/list, attachSurface misconfiguration fence, reported-flag
notice dedup, atomic register) + dsh-tool-tasks (task_output/task_list/
task_kill, completion-notice injection, background prompt habit).
Producers opt in via their own enableRunInBackground config: bash
(stream kind; seam slimmed to resolve/run/start returning a BashProcess
handle, bash_output/bash_kill deleted) and subagent (final-output kind;
done settles after run.dispose()). Owner disposal drains tasks through
the new awaited ctx.agents.onCleanup seam in the loop's disposal chain.
Both RFCs moved to implemented/; docs, catalogs, snapshots re-pinned.
2026-07-09 21:22:54 +08:00
pkg_tool_bash --> pkg_tasks
2026-07-05 01:25:58 +08:00
pkg_tool_bash --> pkg_tools
2026-07-11 21:37:38 +08:00
pkg_tool_bash --> pkg_user_approval
2026-07-05 01:25:58 +08:00
pkg_tool_fs --> pkg_fs
2026-07-19 22:13:50 +08:00
pkg_tool_fs --> pkg_invariants
2026-07-05 01:25:58 +08:00
pkg_tool_fs --> pkg_llm
feat(sandbox): cross-family file sandbox — one policy home, sandboxed fs provider, fs escalation parity
Extend SandboxMode enforcement from bash to the filesystem tools, the sandbox
RFC's deferred cross-family phase.
- dsh-sandbox-policy (new, ctx.sandboxPolicy): the single home for the
deployment default mode + workspaceRoot and the per-session override event,
renamed bash/sandbox-mode -> sandbox/mode and moved here with its fold/setter.
Decouples the bash seam from dsh-session.
- dsh-fs-sandbox (new): SandboxedFileSystem extends LocalFileSystem and fences
write/edit by the per-call mode (read-only denies, workspace-write contains to
the workspace + temp roots via the shared writableRoots, danger passes
through); reads pass through. Structured FS_SANDBOX_DENIED; in-lock parent
re-canonicalization. A policy fence in trusted code, not a kernel boundary.
- dsh-sandbox: the shared escalation kit (writableRoots, the strictly-wider
ladder, denial/hint markers, approveEscalation) both tool families use;
approveEscalation takes a structural approver so dsh-sandbox gains no
approval/agent dependency, and both tools stay duplication-free.
- tool-fs: write/edit advertise sandbox_permissions/justification under a
confining ctx.fs, map FS_SANDBOX_DENIED to the shared [sandbox: ...] marker,
and resolve the same one-approved-wider retry.
- examples/acp-agent: composes sandbox-policy + fs-sandbox, drops the gating
that disabled the fs stack under confined modes.
RFC docs/rfc/implemented/feature/2026-07-14-cross-family-fs-sandbox.md; the old
sandbox RFC's In-process/deferred/FAQ sections updated to shipped fact.
2026-07-14 20:05:57 +08:00
pkg_tool_fs --> pkg_sandbox
pkg_tool_fs --> pkg_sandbox_policy
2026-07-05 01:25:58 +08:00
pkg_tool_fs --> pkg_session
pkg_tool_fs --> pkg_system_prompt
pkg_tool_fs --> pkg_tools
feat(sandbox): cross-family file sandbox — one policy home, sandboxed fs provider, fs escalation parity
Extend SandboxMode enforcement from bash to the filesystem tools, the sandbox
RFC's deferred cross-family phase.
- dsh-sandbox-policy (new, ctx.sandboxPolicy): the single home for the
deployment default mode + workspaceRoot and the per-session override event,
renamed bash/sandbox-mode -> sandbox/mode and moved here with its fold/setter.
Decouples the bash seam from dsh-session.
- dsh-fs-sandbox (new): SandboxedFileSystem extends LocalFileSystem and fences
write/edit by the per-call mode (read-only denies, workspace-write contains to
the workspace + temp roots via the shared writableRoots, danger passes
through); reads pass through. Structured FS_SANDBOX_DENIED; in-lock parent
re-canonicalization. A policy fence in trusted code, not a kernel boundary.
- dsh-sandbox: the shared escalation kit (writableRoots, the strictly-wider
ladder, denial/hint markers, approveEscalation) both tool families use;
approveEscalation takes a structural approver so dsh-sandbox gains no
approval/agent dependency, and both tools stay duplication-free.
- tool-fs: write/edit advertise sandbox_permissions/justification under a
confining ctx.fs, map FS_SANDBOX_DENIED to the shared [sandbox: ...] marker,
and resolve the same one-approved-wider retry.
- examples/acp-agent: composes sandbox-policy + fs-sandbox, drops the gating
that disabled the fs stack under confined modes.
RFC docs/rfc/implemented/feature/2026-07-14-cross-family-fs-sandbox.md; the old
sandbox RFC's In-process/deferred/FAQ sections updated to shipped fact.
2026-07-14 20:05:57 +08:00
pkg_tool_fs --> pkg_user_approval
2026-07-09 20:44:32 +08:00
pkg_tool_fs_search --> pkg_bash
2026-07-19 22:13:50 +08:00
pkg_tool_fs_search --> pkg_invariants
2026-07-09 20:44:32 +08:00
pkg_tool_fs_search --> pkg_llm
pkg_tool_fs_search --> pkg_retention
pkg_tool_fs_search --> pkg_session
pkg_tool_fs_search --> pkg_spill
pkg_tool_fs_search --> pkg_system_prompt
pkg_tool_fs_search --> pkg_tools
2026-07-10 14:19:06 +08:00
pkg_tool_skill --> pkg_agent
2026-07-19 22:13:50 +08:00
pkg_tool_skill --> pkg_invariants
2026-07-10 14:19:06 +08:00
pkg_tool_skill --> pkg_llm
pkg_tool_skill --> pkg_skill
pkg_tool_skill --> pkg_tools
2026-07-05 01:25:58 +08:00
pkg_subagent --> pkg_agent
2026-07-18 14:26:14 +08:00
pkg_subagent --> pkg_brand
2026-07-19 22:13:50 +08:00
pkg_subagent --> pkg_invariants
2026-07-05 01:25:58 +08:00
pkg_subagent --> pkg_llm
2026-07-09 05:21:06 +08:00
pkg_subagent --> pkg_scope
2026-07-15 23:50:33 +08:00
pkg_subagent --> pkg_session
2026-07-05 01:25:58 +08:00
pkg_subagent --> pkg_tools
2026-07-19 22:13:50 +08:00
pkg_tool_web --> pkg_invariants
2026-07-05 01:25:58 +08:00
pkg_tool_web --> pkg_llm
pkg_tool_web --> pkg_system_prompt
pkg_tool_web --> pkg_tools
pkg_tool_web --> pkg_web
2026-07-19 22:13:50 +08:00
pkg_spill_policy --> pkg_invariants
2026-07-08 19:20:50 +08:00
pkg_spill_policy --> pkg_llm
pkg_spill_policy --> pkg_retention
pkg_spill_policy --> pkg_session
pkg_spill_policy --> pkg_spill
pkg_spill_policy --> pkg_tools
2026-07-19 22:13:50 +08:00
pkg_timeout_policy --> pkg_invariants
2026-07-08 10:06:07 +08:00
pkg_timeout_policy --> pkg_llm
pkg_timeout_policy --> pkg_timeout
pkg_timeout_policy --> pkg_tools
2026-07-05 01:25:58 +08:00
pkg_tool_todo --> pkg_agent
2026-07-19 22:13:50 +08:00
pkg_tool_todo --> pkg_invariants
2026-07-05 01:25:58 +08:00
pkg_tool_todo --> pkg_session
pkg_tool_todo --> pkg_tools
2026-07-10 01:38:39 +08:00
pkg_mode --> pkg_agent
2026-07-21 11:11:35 +08:00
pkg_mode --> pkg_commands
2026-07-22 02:13:39 +08:00
pkg_mode --> pkg_invariants
2026-07-10 01:38:39 +08:00
pkg_mode --> pkg_session
pkg_mode --> pkg_system_prompt
pkg_mode --> pkg_tools
feat(mode): exit_plan_mode + the ACP session-mode picker + scriptable review answers
Plan mode's stage 2 (RFC 2026-07-07-plan-mode). The exit tool: one
required plan argument (the durable log artifact), execute re-checks the
folded mode, then conducts the review over the user-interaction seam —
one single-select question (Approve / Keep planning) with free text open
— so an approval appends mode/set back to default in-turn and every
other outcome (keep-planning feedback verbatim, aborted, no provider)
returns the corrective isError with the mode unchanged. presentCall is a
generic card titled by the plan's first heading carrying the plan
markdown; over ACP the review rides the ask_user elicitation flow, in
the terminal the stdio prompt queue — no approval-seam dependency.
The ACP bridge maps the picker 1:1 onto ctx.modes (opportunistic, a
type-only peer edge): session/new + session/load advertise
availableModes/currentModeId, session/set_mode validates through set()
and echoes an optimistic current_mode_update (the pending mode IS the
selection; the logged mode/set lands at the boundary and, matching, is
not re-sent), and a session/event listener re-notifies on each logged
flip that differs from the last sent — the tool-driven exit updates the
picker. The feature matrix rows move from 'not modeled' to the
picker-to-modes / knobs-to-config-options division, with the ACP v2
removal direction recorded as a mechanical-migration risk.
The snapshot harness gains the setMode/setModeExpectError ops and a
scripted elicitationAnswers FIFO (cancel on exhaustion; a stray choice
string reaches the agent verbatim as a non-consenting custom answer, so
a scenario bug fails safe). The suite factory's header-pin requirement
now applies only to model-turn scenarios — a protocol-only suite has no
header content to anchor. examples/plan-acp-agent is the live
composition; its keyless modes-advertise scenario pins the wire surface
(advertisement, both set_mode round-trips, unknown-id rejection). The
recorded plan-mode approve/reject arc awaits a with-key recording
session; its texts are pinned at the unit tier meanwhile.
examples/AGENTS.md ceiling 653 → 680: the new example's required smoke
row does not fit the old budget.
2026-07-10 02:57:40 +08:00
pkg_mode --> pkg_user_interaction
2026-07-19 22:13:50 +08:00
pkg_tool_cordis --> pkg_invariants
Merge origin/master: scope-aware fusion of the tools/execute seam, session-prefix, and tool-cordis
Master brought 50 commits (the tool-cordis group, dsh-code-runtime + worker,
the tools/execute around-dispatch seam + timeout-policy, repeat-tool-guard,
agent/session-prefix, the ui reorganization). Beyond the ten textual
conflicts, the merge reconciles master's new seams with this branch's
scoped-registration world:
- tools/execute (new waterfall around core dispatch): dispatched with the
SAME exec.agent carrier as the pre/post waterfalls — an agent.ctx wrapper
times/retries only its own agent's calls — and its base thunk resolves the
tool through the caller's visible view (get(exec.name, exec.agent)), so a
scoped/shadowed tool dispatches and a restricted-away global stays
UNKNOWN_TOOL. Declared this: Scoped<ToolRegistry> with the scope-filtered
doc sentence; invariants table + verify-scoped-dispatch pin it (21 events).
- agent/session-prefix (new waterfall, once per loop instance): composed via
the fused agentEvents dispatcher (scope-filtered like every agent-subject
event), declared this: Scoped<Agent>, table-pinned. agent/pre-step keeps
master's new sessionPrefix parameter with this branch's Scoped this.
- timeout-policy reads the budget through the caller's visible view
(get(exec.name, exec.agent)): a scoped tool's own timeoutMs governs its
calls; a global name-twin's budget is never misapplied to a shadowing
per-agent variant.
- tool-cordis: cordis_inspect's tools section lists the CALLING agent's view
(its description promises "what you can call"); the sandbox tool façade's
reads resolve through the mount's own scope, mirroring where its register
lands writes; sandboxRegisterTool's return type carries the exact-disposer
union honestly. dsh-scope declared as peer+dev with the project reference.
- doc-sync chain unions master's verify-cordis-api with this branch's
verify-scoped-dispatch; the generated catalogs, event matrix (the
zero-dispatcher guard passes over master's new events), module graph, and
the cordis api-catalog are regenerated on the merged surface.
Full gate sequence green on the merged tree: typecheck, lint, per-file 100%
coverage (2668 tests), snapshots (38), doc-sync, module graph, build,
hygiene, demo smoke.
2026-07-09 23:24:42 +08:00
pkg_tool_cordis --> pkg_scope
2026-07-08 11:50:12 +08:00
pkg_tool_cordis --> pkg_tools
2026-07-05 01:25:58 +08:00
pkg_hooks_codex --> pkg_agent
pkg_hooks_codex --> pkg_hook_protocol
2026-07-19 22:13:50 +08:00
pkg_hooks_codex --> pkg_invariants
2026-07-05 01:25:58 +08:00
pkg_hooks_codex --> pkg_llm
pkg_hooks_codex --> pkg_session
2026-07-10 20:52:27 +08:00
pkg_hooks_codex --> pkg_session_persistence
2026-07-05 01:25:58 +08:00
pkg_hooks_codex --> pkg_tools
2026-07-16 17:39:53 +08:00
pkg_agent_loop_testkit --> pkg_agent
2026-07-19 22:13:50 +08:00
pkg_agent_loop_testkit --> pkg_invariants
2026-07-16 17:39:53 +08:00
pkg_agent_loop_testkit --> pkg_llm
pkg_agent_loop_testkit --> pkg_session
pkg_agent_loop_testkit --> pkg_system_prompt
pkg_agent_loop_testkit --> pkg_tools
2026-07-05 17:05:33 +08:00
pkg_tool_ask_user --> pkg_agent
2026-07-19 22:13:50 +08:00
pkg_tool_ask_user --> pkg_invariants
2026-07-05 17:05:33 +08:00
pkg_tool_ask_user --> pkg_tools
pkg_tool_ask_user --> pkg_user_interaction
2026-07-10 14:32:44 +08:00
pkg_workspace_context --> pkg_agent
pkg_workspace_context --> pkg_fs
2026-07-19 22:13:50 +08:00
pkg_workspace_context --> pkg_invariants
2026-07-10 14:32:44 +08:00
pkg_workspace_context --> pkg_llm
pkg_workspace_context --> pkg_paths
pkg_workspace_context --> pkg_session
pkg_workspace_context --> pkg_tools
2026-07-08 14:24:20 +08:00
pkg_repeat_tool_guard --> pkg_agent
2026-07-19 22:13:50 +08:00
pkg_repeat_tool_guard --> pkg_invariants
2026-07-08 14:24:20 +08:00
pkg_repeat_tool_guard --> pkg_tools
2026-07-21 18:27:46 +08:00
pkg_tool_lsp --> pkg_invariants
feat(lsp): LSP capability seam, generic stdio provider, and lsp tool
Implements the LSP capability seam RFC as three packages: dsh-lsp (the
ctx.lsp interface — provider registry by branded id + exclusive extension
mapping, per-query order-independent selection, closed request/result
vocabulary, LspError taxonomy), dsh-lsp-local (a generic stdio language-server
provider — Content-Length JSON-RPC framing, per-(provider, workspace) process
single-flight, transient didOpen/query/didClose, an abortable per-instance
queue, UTF-16 negotiation, host-namespace source reads outside ctx.fs, and
bounded shutdown/kill teardown), and dsh-tool-lsp (the model-facing lsp tool —
four operations, one-based UTF-16 cursor conversion, workspace-grouped location
rendering, hover capping, a required session workspace, and a timeout budget).
Why: an agent had text search and file reads but no way to identify a program
symbol — follow an alias, connect an interface to implementations, or read an
inferred type — before changing code. Splitting model contract, seam, and local
subprocess behavior keeps the four semantic queries stable across future remote
or sandbox-native providers without leaking a JSON-RPC escape hatch.
2026-07-16 12:05:35 +08:00
pkg_tool_lsp --> pkg_llm
pkg_tool_lsp --> pkg_lsp
pkg_tool_lsp --> pkg_system_prompt
2026-07-21 13:29:40 +08:00
pkg_tool_lsp --> pkg_timeout
feat(lsp): LSP capability seam, generic stdio provider, and lsp tool
Implements the LSP capability seam RFC as three packages: dsh-lsp (the
ctx.lsp interface — provider registry by branded id + exclusive extension
mapping, per-query order-independent selection, closed request/result
vocabulary, LspError taxonomy), dsh-lsp-local (a generic stdio language-server
provider — Content-Length JSON-RPC framing, per-(provider, workspace) process
single-flight, transient didOpen/query/didClose, an abortable per-instance
queue, UTF-16 negotiation, host-namespace source reads outside ctx.fs, and
bounded shutdown/kill teardown), and dsh-tool-lsp (the model-facing lsp tool —
four operations, one-based UTF-16 cursor conversion, workspace-grouped location
rendering, hover capping, a required session workspace, and a timeout budget).
Why: an agent had text search and file reads but no way to identify a program
symbol — follow an alias, connect an interface to implementations, or read an
inferred type — before changing code. Splitting model contract, seam, and local
subprocess behavior keeps the four semantic queries stable across future remote
or sandbox-native providers without leaking a JSON-RPC escape hatch.
2026-07-16 12:05:35 +08:00
pkg_tool_lsp --> pkg_tools
2026-07-19 22:13:50 +08:00
pkg_mcp_client --> pkg_invariants
2026-07-07 23:21:54 +08:00
pkg_mcp_client --> pkg_llm
pkg_mcp_client --> pkg_tools
feat(tasks): background task runtime, generic task_* control tools, bash/subagent producers
One shared ctx.tasks registry (branded <kind>-N ids, owner-fenced
read/kill/wait/list, attachSurface misconfiguration fence, reported-flag
notice dedup, atomic register) + dsh-tool-tasks (task_output/task_list/
task_kill, completion-notice injection, background prompt habit).
Producers opt in via their own enableRunInBackground config: bash
(stream kind; seam slimmed to resolve/run/start returning a BashProcess
handle, bash_output/bash_kill deleted) and subagent (final-output kind;
done settles after run.dispose()). Owner disposal drains tasks through
the new awaited ctx.agents.onCleanup seam in the loop's disposal chain.
Both RFCs moved to implemented/; docs, catalogs, snapshots re-pinned.
2026-07-09 21:22:54 +08:00
pkg_tool_tasks --> pkg_agent
2026-07-19 22:13:50 +08:00
pkg_tool_tasks --> pkg_invariants
feat(tasks): background task runtime, generic task_* control tools, bash/subagent producers
One shared ctx.tasks registry (branded <kind>-N ids, owner-fenced
read/kill/wait/list, attachSurface misconfiguration fence, reported-flag
notice dedup, atomic register) + dsh-tool-tasks (task_output/task_list/
task_kill, completion-notice injection, background prompt habit).
Producers opt in via their own enableRunInBackground config: bash
(stream kind; seam slimmed to resolve/run/start returning a BashProcess
handle, bash_output/bash_kill deleted) and subagent (final-output kind;
done settles after run.dispose()). Owner disposal drains tasks through
the new awaited ctx.agents.onCleanup seam in the loop's disposal chain.
Both RFCs moved to implemented/; docs, catalogs, snapshots re-pinned.
2026-07-09 21:22:54 +08:00
pkg_tool_tasks --> pkg_system_prompt
pkg_tool_tasks --> pkg_tasks
pkg_tool_tasks --> pkg_tools
2026-07-06 03:14:07 +08:00
pkg_tool_workflow --> pkg_agent
2026-07-19 22:13:50 +08:00
pkg_tool_workflow --> pkg_invariants
2026-07-06 03:14:07 +08:00
pkg_tool_workflow --> pkg_llm
pkg_tool_workflow --> pkg_system_prompt
pkg_tool_workflow --> pkg_tools
pkg_tool_workflow --> pkg_workflow
2026-07-05 01:25:58 +08:00
pkg_subagent_acp --> pkg_agent
2026-07-19 22:13:50 +08:00
pkg_subagent_acp --> pkg_invariants
2026-07-05 01:25:58 +08:00
pkg_subagent_acp --> pkg_llm
2026-07-15 23:50:33 +08:00
pkg_subagent_acp --> pkg_session
2026-07-05 01:25:58 +08:00
pkg_subagent_acp --> pkg_subagent
rename: @deepseek-ai/dsh-subagent-process -> @deepseek-ai/dsh-subagent-subprocess
The extracted library's name sat one edit away from @deepseek-ai/dsh-subagent-inprocess
(process/inprocess), inviting a typo'd import to silently resolve to the wrong
package. subagent-subprocess also reads as the deliberate counterpart to
subagent-inprocess (in-process vs. subprocess), matching how the two shared
drivers actually differ.
Package directory, npm name, module doc, JSDoc module tags, test-file name and
its temp-dir prefixes, the subagent-acp import and its Config/tsconfig/package.json
references, root tsconfig.json/tsconfig.build.json/knip.json entries, and the
packages/subagent group README all renamed together; regenerated
docs/module-graph.md and docs/config-catalog.md. Pure rename — no behavior,
export, or Config shape changed.
2026-07-09 13:42:03 +08:00
pkg_subagent_acp --> pkg_subagent_subprocess
2026-07-05 01:25:58 +08:00
pkg_subagent_inprocess --> pkg_agent
2026-07-19 22:13:50 +08:00
pkg_subagent_inprocess --> pkg_invariants
2026-07-05 01:25:58 +08:00
pkg_subagent_inprocess --> pkg_llm
pkg_subagent_inprocess --> pkg_session
pkg_subagent_inprocess --> pkg_subagent
Structured output on the subagent seam: schema subset, capture runtime, spawn/fork support
Carved out of #170 per review feedback — the foundation the workflow tool
builds on, now standing alone on master:
- dsh-tools: the structured-output JSON Schema subset (StructuredOutputSchema,
assertSupportedOutputSchema, validateStructuredValue) — rejects loud outside
the enforced subset, listing every violation
- dsh-subagent: SubagentStartRequest.outputSchema / SubagentResult.structured
become a real capability; the service rejects a schema'd request whose
provider lacks it
- dsh-subagent-inprocess: the shared structured runtime — one global
structured_output capture tool, a prepend final-assembly listener that
strips the placeholder for plain agents and swaps in the run's own schema
(plus the calling instruction as a trailing section) for structured
children, an agent/turn-continuation veto once captured, and the
capture/nudge loop in the run driver (structuredNudgeRetries, cancellation
honored mid-nudge); lifetime refcounted by backends and live runs
- subagent-spawn / subagent-fork flip outputSchema: true
One deliberate divergence from the #170 revision: the backends do NOT add
'tools' to their plugin inject. Doing so deferred their apply past the todo
plugin, and the delegation tool mirrors provider lifecycle — so the
model-visible tool order of every existing prompt changed, invalidating every
recorded snapshot fixture. The runtime now gates its capture-tool registration
on tools availability itself (sync when live, a scoped inject fiber when the
Loader starts the backend first), keeping this PR byte-invisible to existing
transcripts: all 35 snapshot scenarios pass against master's fixtures
unchanged.
2026-07-06 23:29:08 +08:00
pkg_subagent_inprocess --> pkg_system_prompt
pkg_subagent_inprocess --> pkg_tools
2026-07-05 01:25:58 +08:00
pkg_tool_subagent --> pkg_agent
2026-07-19 22:13:50 +08:00
pkg_tool_subagent --> pkg_invariants
2026-07-05 01:25:58 +08:00
pkg_tool_subagent --> pkg_llm
pkg_tool_subagent --> pkg_subagent
feat(tasks): background task runtime, generic task_* control tools, bash/subagent producers
One shared ctx.tasks registry (branded <kind>-N ids, owner-fenced
read/kill/wait/list, attachSurface misconfiguration fence, reported-flag
notice dedup, atomic register) + dsh-tool-tasks (task_output/task_list/
task_kill, completion-notice injection, background prompt habit).
Producers opt in via their own enableRunInBackground config: bash
(stream kind; seam slimmed to resolve/run/start returning a BashProcess
handle, bash_output/bash_kill deleted) and subagent (final-output kind;
done settles after run.dispose()). Owner disposal drains tasks through
the new awaited ctx.agents.onCleanup seam in the loop's disposal chain.
Both RFCs moved to implemented/; docs, catalogs, snapshots re-pinned.
2026-07-09 21:22:54 +08:00
pkg_tool_subagent --> pkg_tasks
2026-07-05 01:25:58 +08:00
pkg_tool_subagent --> pkg_tools
pkg_hooks_claude --> pkg_agent
pkg_hooks_claude --> pkg_hook_protocol
2026-07-19 22:13:50 +08:00
pkg_hooks_claude --> pkg_invariants
2026-07-05 01:25:58 +08:00
pkg_hooks_claude --> pkg_llm
pkg_hooks_claude --> pkg_session
2026-07-10 20:52:27 +08:00
pkg_hooks_claude --> pkg_session_persistence
2026-07-05 01:25:58 +08:00
pkg_hooks_claude --> pkg_subagent
pkg_hooks_claude --> pkg_tools
feat(mode): exit_plan_mode + the ACP session-mode picker + scriptable review answers
Plan mode's stage 2 (RFC 2026-07-07-plan-mode). The exit tool: one
required plan argument (the durable log artifact), execute re-checks the
folded mode, then conducts the review over the user-interaction seam —
one single-select question (Approve / Keep planning) with free text open
— so an approval appends mode/set back to default in-turn and every
other outcome (keep-planning feedback verbatim, aborted, no provider)
returns the corrective isError with the mode unchanged. presentCall is a
generic card titled by the plan's first heading carrying the plan
markdown; over ACP the review rides the ask_user elicitation flow, in
the terminal the stdio prompt queue — no approval-seam dependency.
The ACP bridge maps the picker 1:1 onto ctx.modes (opportunistic, a
type-only peer edge): session/new + session/load advertise
availableModes/currentModeId, session/set_mode validates through set()
and echoes an optimistic current_mode_update (the pending mode IS the
selection; the logged mode/set lands at the boundary and, matching, is
not re-sent), and a session/event listener re-notifies on each logged
flip that differs from the last sent — the tool-driven exit updates the
picker. The feature matrix rows move from 'not modeled' to the
picker-to-modes / knobs-to-config-options division, with the ACP v2
removal direction recorded as a mechanical-migration risk.
The snapshot harness gains the setMode/setModeExpectError ops and a
scripted elicitationAnswers FIFO (cancel on exhaustion; a stray choice
string reaches the agent verbatim as a non-consenting custom answer, so
a scenario bug fails safe). The suite factory's header-pin requirement
now applies only to model-turn scenarios — a protocol-only suite has no
header content to anchor. examples/plan-acp-agent is the live
composition; its keyless modes-advertise scenario pins the wire surface
(advertisement, both set_mode round-trips, unknown-id rejection). The
recorded plan-mode approve/reject arc awaits a with-key recording
session; its texts are pinned at the unit tier meanwhile.
examples/AGENTS.md ceiling 653 → 680: the new example's required smoke
row does not fit the old budget.
2026-07-10 02:57:40 +08:00
pkg_acp --> pkg_agent
Merge branch 'worktree-session-modes-rfc' (master: sandbox stack #169, skills #109, prompt snapshots #254)
The stack rebases onto a moved master through its base branch. Beyond
mechanical unions (both branches' demo scripts, example rows, service
roles, tool lists, acp deps, doc budgets — each side fit alone, the
union needs the higher ceilings), three semantic reconciliations:
- The ACP bridge now carries BOTH per-session surfaces: the sandbox
stack's config options + approval answerer and this branch's session
modes; session/new and session/load advertise modes AND configOptions
side by side.
- The feature matrix supersedes the sandbox stance per the RFC's
second-lander rule: session/set_mode and current_mode_update flip to
shipped-by-dsh-mode, config-option rows stay as #169 wrote them, and
§6 records both landed features under the picker-to-modes /
knobs-to-config-options division.
- The snapshot pin grammar (#254: one header snapshot + declared deltas
+ a Markdown prompt golden) gains a symmetric declaration for what a
delta cannot express: expectedHeaderSnapshots — a plan-mode flip
resorts the canonical tool list, so its widening lands as a second
full snapshot, now its own Markdown section. The pin-less-class and
model-turn-only-pin amendments carry over; new fixtures cover the
extended writer paths, and the plan-acp-agent scenarios re-recorded
under the merged composition (the app now bundles the skill tool)
with the suite's refresh mode wired through.
2026-07-12 20:08:00 +08:00
pkg_acp --> pkg_bash
2026-07-21 00:50:00 +08:00
pkg_acp --> pkg_commands
2026-07-22 02:13:39 +08:00
pkg_acp --> pkg_invariants
feat(mode): exit_plan_mode + the ACP session-mode picker + scriptable review answers
Plan mode's stage 2 (RFC 2026-07-07-plan-mode). The exit tool: one
required plan argument (the durable log artifact), execute re-checks the
folded mode, then conducts the review over the user-interaction seam —
one single-select question (Approve / Keep planning) with free text open
— so an approval appends mode/set back to default in-turn and every
other outcome (keep-planning feedback verbatim, aborted, no provider)
returns the corrective isError with the mode unchanged. presentCall is a
generic card titled by the plan's first heading carrying the plan
markdown; over ACP the review rides the ask_user elicitation flow, in
the terminal the stdio prompt queue — no approval-seam dependency.
The ACP bridge maps the picker 1:1 onto ctx.modes (opportunistic, a
type-only peer edge): session/new + session/load advertise
availableModes/currentModeId, session/set_mode validates through set()
and echoes an optimistic current_mode_update (the pending mode IS the
selection; the logged mode/set lands at the boundary and, matching, is
not re-sent), and a session/event listener re-notifies on each logged
flip that differs from the last sent — the tool-driven exit updates the
picker. The feature matrix rows move from 'not modeled' to the
picker-to-modes / knobs-to-config-options division, with the ACP v2
removal direction recorded as a mechanical-migration risk.
The snapshot harness gains the setMode/setModeExpectError ops and a
scripted elicitationAnswers FIFO (cancel on exhaustion; a stray choice
string reaches the agent verbatim as a non-consenting custom answer, so
a scenario bug fails safe). The suite factory's header-pin requirement
now applies only to model-turn scenarios — a protocol-only suite has no
header content to anchor. examples/plan-acp-agent is the live
composition; its keyless modes-advertise scenario pins the wire surface
(advertisement, both set_mode round-trips, unknown-id rejection). The
recorded plan-mode approve/reject arc awaits a with-key recording
session; its texts are pinned at the unit tier meanwhile.
examples/AGENTS.md ceiling 653 → 680: the new example's required smoke
row does not fit the old budget.
2026-07-10 02:57:40 +08:00
pkg_acp --> pkg_llm
2026-07-20 23:28:07 +08:00
pkg_acp --> pkg_llm_retry
feat(mode): exit_plan_mode + the ACP session-mode picker + scriptable review answers
Plan mode's stage 2 (RFC 2026-07-07-plan-mode). The exit tool: one
required plan argument (the durable log artifact), execute re-checks the
folded mode, then conducts the review over the user-interaction seam —
one single-select question (Approve / Keep planning) with free text open
— so an approval appends mode/set back to default in-turn and every
other outcome (keep-planning feedback verbatim, aborted, no provider)
returns the corrective isError with the mode unchanged. presentCall is a
generic card titled by the plan's first heading carrying the plan
markdown; over ACP the review rides the ask_user elicitation flow, in
the terminal the stdio prompt queue — no approval-seam dependency.
The ACP bridge maps the picker 1:1 onto ctx.modes (opportunistic, a
type-only peer edge): session/new + session/load advertise
availableModes/currentModeId, session/set_mode validates through set()
and echoes an optimistic current_mode_update (the pending mode IS the
selection; the logged mode/set lands at the boundary and, matching, is
not re-sent), and a session/event listener re-notifies on each logged
flip that differs from the last sent — the tool-driven exit updates the
picker. The feature matrix rows move from 'not modeled' to the
picker-to-modes / knobs-to-config-options division, with the ACP v2
removal direction recorded as a mechanical-migration risk.
The snapshot harness gains the setMode/setModeExpectError ops and a
scripted elicitationAnswers FIFO (cancel on exhaustion; a stray choice
string reaches the agent verbatim as a non-consenting custom answer, so
a scenario bug fails safe). The suite factory's header-pin requirement
now applies only to model-turn scenarios — a protocol-only suite has no
header content to anchor. examples/plan-acp-agent is the live
composition; its keyless modes-advertise scenario pins the wire surface
(advertisement, both set_mode round-trips, unknown-id rejection). The
recorded plan-mode approve/reject arc awaits a with-key recording
session; its texts are pinned at the unit tier meanwhile.
examples/AGENTS.md ceiling 653 → 680: the new example's required smoke
row does not fit the old budget.
2026-07-10 02:57:40 +08:00
pkg_acp --> pkg_mode
2026-07-15 23:17:18 +08:00
pkg_acp --> pkg_permission
Merge branch 'worktree-session-modes-rfc' (master: sandbox stack #169, skills #109, prompt snapshots #254)
The stack rebases onto a moved master through its base branch. Beyond
mechanical unions (both branches' demo scripts, example rows, service
roles, tool lists, acp deps, doc budgets — each side fit alone, the
union needs the higher ceilings), three semantic reconciliations:
- The ACP bridge now carries BOTH per-session surfaces: the sandbox
stack's config options + approval answerer and this branch's session
modes; session/new and session/load advertise modes AND configOptions
side by side.
- The feature matrix supersedes the sandbox stance per the RFC's
second-lander rule: session/set_mode and current_mode_update flip to
shipped-by-dsh-mode, config-option rows stay as #169 wrote them, and
§6 records both landed features under the picker-to-modes /
knobs-to-config-options division.
- The snapshot pin grammar (#254: one header snapshot + declared deltas
+ a Markdown prompt golden) gains a symmetric declaration for what a
delta cannot express: expectedHeaderSnapshots — a plan-mode flip
resorts the canonical tool list, so its widening lands as a second
full snapshot, now its own Markdown section. The pin-less-class and
model-turn-only-pin amendments carry over; new fixtures cover the
extended writer paths, and the plan-acp-agent scenarios re-recorded
under the merged composition (the app now bundles the skill tool)
with the suite's refresh mode wired through.
2026-07-12 20:08:00 +08:00
pkg_acp --> pkg_sandbox
feat(mode): exit_plan_mode + the ACP session-mode picker + scriptable review answers
Plan mode's stage 2 (RFC 2026-07-07-plan-mode). The exit tool: one
required plan argument (the durable log artifact), execute re-checks the
folded mode, then conducts the review over the user-interaction seam —
one single-select question (Approve / Keep planning) with free text open
— so an approval appends mode/set back to default in-turn and every
other outcome (keep-planning feedback verbatim, aborted, no provider)
returns the corrective isError with the mode unchanged. presentCall is a
generic card titled by the plan's first heading carrying the plan
markdown; over ACP the review rides the ask_user elicitation flow, in
the terminal the stdio prompt queue — no approval-seam dependency.
The ACP bridge maps the picker 1:1 onto ctx.modes (opportunistic, a
type-only peer edge): session/new + session/load advertise
availableModes/currentModeId, session/set_mode validates through set()
and echoes an optimistic current_mode_update (the pending mode IS the
selection; the logged mode/set lands at the boundary and, matching, is
not re-sent), and a session/event listener re-notifies on each logged
flip that differs from the last sent — the tool-driven exit updates the
picker. The feature matrix rows move from 'not modeled' to the
picker-to-modes / knobs-to-config-options division, with the ACP v2
removal direction recorded as a mechanical-migration risk.
The snapshot harness gains the setMode/setModeExpectError ops and a
scripted elicitationAnswers FIFO (cancel on exhaustion; a stray choice
string reaches the agent verbatim as a non-consenting custom answer, so
a scenario bug fails safe). The suite factory's header-pin requirement
now applies only to model-turn scenarios — a protocol-only suite has no
header content to anchor. examples/plan-acp-agent is the live
composition; its keyless modes-advertise scenario pins the wire surface
(advertisement, both set_mode round-trips, unknown-id rejection). The
recorded plan-mode approve/reject arc awaits a with-key recording
session; its texts are pinned at the unit tier meanwhile.
examples/AGENTS.md ceiling 653 → 680: the new example's required smoke
row does not fit the old budget.
2026-07-10 02:57:40 +08:00
pkg_acp --> pkg_session
pkg_acp --> pkg_session_persistence
2026-07-22 02:28:47 +08:00
pkg_acp --> pkg_session_title
2026-07-20 23:28:07 +08:00
pkg_acp --> pkg_system_prompt
feat(mode): exit_plan_mode + the ACP session-mode picker + scriptable review answers
Plan mode's stage 2 (RFC 2026-07-07-plan-mode). The exit tool: one
required plan argument (the durable log artifact), execute re-checks the
folded mode, then conducts the review over the user-interaction seam —
one single-select question (Approve / Keep planning) with free text open
— so an approval appends mode/set back to default in-turn and every
other outcome (keep-planning feedback verbatim, aborted, no provider)
returns the corrective isError with the mode unchanged. presentCall is a
generic card titled by the plan's first heading carrying the plan
markdown; over ACP the review rides the ask_user elicitation flow, in
the terminal the stdio prompt queue — no approval-seam dependency.
The ACP bridge maps the picker 1:1 onto ctx.modes (opportunistic, a
type-only peer edge): session/new + session/load advertise
availableModes/currentModeId, session/set_mode validates through set()
and echoes an optimistic current_mode_update (the pending mode IS the
selection; the logged mode/set lands at the boundary and, matching, is
not re-sent), and a session/event listener re-notifies on each logged
flip that differs from the last sent — the tool-driven exit updates the
picker. The feature matrix rows move from 'not modeled' to the
picker-to-modes / knobs-to-config-options division, with the ACP v2
removal direction recorded as a mechanical-migration risk.
The snapshot harness gains the setMode/setModeExpectError ops and a
scripted elicitationAnswers FIFO (cancel on exhaustion; a stray choice
string reaches the agent verbatim as a non-consenting custom answer, so
a scenario bug fails safe). The suite factory's header-pin requirement
now applies only to model-turn scenarios — a protocol-only suite has no
header content to anchor. examples/plan-acp-agent is the live
composition; its keyless modes-advertise scenario pins the wire surface
(advertisement, both set_mode round-trips, unknown-id rejection). The
recorded plan-mode approve/reject arc awaits a with-key recording
session; its texts are pinned at the unit tier meanwhile.
examples/AGENTS.md ceiling 653 → 680: the new example's required smoke
row does not fit the old budget.
2026-07-10 02:57:40 +08:00
pkg_acp --> pkg_tools
Merge branch 'worktree-session-modes-rfc' (master: sandbox stack #169, skills #109, prompt snapshots #254)
The stack rebases onto a moved master through its base branch. Beyond
mechanical unions (both branches' demo scripts, example rows, service
roles, tool lists, acp deps, doc budgets — each side fit alone, the
union needs the higher ceilings), three semantic reconciliations:
- The ACP bridge now carries BOTH per-session surfaces: the sandbox
stack's config options + approval answerer and this branch's session
modes; session/new and session/load advertise modes AND configOptions
side by side.
- The feature matrix supersedes the sandbox stance per the RFC's
second-lander rule: session/set_mode and current_mode_update flip to
shipped-by-dsh-mode, config-option rows stay as #169 wrote them, and
§6 records both landed features under the picker-to-modes /
knobs-to-config-options division.
- The snapshot pin grammar (#254: one header snapshot + declared deltas
+ a Markdown prompt golden) gains a symmetric declaration for what a
delta cannot express: expectedHeaderSnapshots — a plan-mode flip
resorts the canonical tool list, so its widening lands as a second
full snapshot, now its own Markdown section. The pin-less-class and
model-turn-only-pin amendments carry over; new fixtures cover the
extended writer paths, and the plan-acp-agent scenarios re-recorded
under the merged composition (the app now bundles the skill tool)
with the suite's refresh mode wired through.
2026-07-12 20:08:00 +08:00
pkg_acp --> pkg_user_approval
feat(mode): exit_plan_mode + the ACP session-mode picker + scriptable review answers
Plan mode's stage 2 (RFC 2026-07-07-plan-mode). The exit tool: one
required plan argument (the durable log artifact), execute re-checks the
folded mode, then conducts the review over the user-interaction seam —
one single-select question (Approve / Keep planning) with free text open
— so an approval appends mode/set back to default in-turn and every
other outcome (keep-planning feedback verbatim, aborted, no provider)
returns the corrective isError with the mode unchanged. presentCall is a
generic card titled by the plan's first heading carrying the plan
markdown; over ACP the review rides the ask_user elicitation flow, in
the terminal the stdio prompt queue — no approval-seam dependency.
The ACP bridge maps the picker 1:1 onto ctx.modes (opportunistic, a
type-only peer edge): session/new + session/load advertise
availableModes/currentModeId, session/set_mode validates through set()
and echoes an optimistic current_mode_update (the pending mode IS the
selection; the logged mode/set lands at the boundary and, matching, is
not re-sent), and a session/event listener re-notifies on each logged
flip that differs from the last sent — the tool-driven exit updates the
picker. The feature matrix rows move from 'not modeled' to the
picker-to-modes / knobs-to-config-options division, with the ACP v2
removal direction recorded as a mechanical-migration risk.
The snapshot harness gains the setMode/setModeExpectError ops and a
scripted elicitationAnswers FIFO (cancel on exhaustion; a stray choice
string reaches the agent verbatim as a non-consenting custom answer, so
a scenario bug fails safe). The suite factory's header-pin requirement
now applies only to model-turn scenarios — a protocol-only suite has no
header content to anchor. examples/plan-acp-agent is the live
composition; its keyless modes-advertise scenario pins the wire surface
(advertisement, both set_mode round-trips, unknown-id rejection). The
recorded plan-mode approve/reject arc awaits a with-key recording
session; its texts are pinned at the unit tier meanwhile.
examples/AGENTS.md ceiling 653 → 680: the new example's required smoke
row does not fit the old budget.
2026-07-10 02:57:40 +08:00
pkg_acp --> pkg_user_interaction
2026-07-11 14:08:12 +08:00
pkg_jsonrpc --> pkg_agent
2026-07-19 22:13:50 +08:00
pkg_jsonrpc --> pkg_invariants
2026-07-11 14:08:12 +08:00
pkg_jsonrpc --> pkg_llm
pkg_jsonrpc --> pkg_llm_deepseek
2026-07-15 23:51:45 +08:00
pkg_jsonrpc --> pkg_scope
2026-07-11 14:08:12 +08:00
pkg_jsonrpc --> pkg_session
pkg_jsonrpc --> pkg_subagent
2026-07-19 11:37:14 +08:00
pkg_tui --> pkg_agent
pkg_tui --> pkg_agent_loop
2026-07-19 22:11:59 +08:00
pkg_tui --> pkg_commands
2026-07-19 22:13:50 +08:00
pkg_tui --> pkg_invariants
2026-07-19 11:37:14 +08:00
pkg_tui --> pkg_llm
2026-07-20 03:34:19 +08:00
pkg_tui --> pkg_llm_retry
2026-07-19 11:37:14 +08:00
pkg_tui --> pkg_session
2026-07-21 01:54:00 +08:00
pkg_tui --> pkg_session_title
2026-07-20 22:44:01 +08:00
pkg_tui --> pkg_system_prompt
2026-07-20 22:47:55 +08:00
pkg_tui --> pkg_token_meter
2026-07-19 11:37:14 +08:00
pkg_tui --> pkg_tools
pkg_tui --> pkg_user_interaction
2026-07-15 15:57:57 +08:00
pkg_agent_spine_demo --> pkg_agent
pkg_agent_spine_demo --> pkg_agent_loop
2026-07-19 23:55:33 +08:00
pkg_agent_spine_demo --> pkg_goal
pkg_agent_spine_demo --> pkg_goal_session
2026-07-15 15:57:57 +08:00
pkg_agent_spine_demo --> pkg_invariants
pkg_agent_spine_demo --> pkg_llm
2026-07-20 03:34:19 +08:00
pkg_agent_spine_demo --> pkg_llm_retry
2026-07-21 13:52:00 +08:00
pkg_agent_spine_demo --> pkg_paths
2026-07-19 19:19:57 +08:00
pkg_agent_spine_demo --> pkg_scope
2026-07-15 15:57:57 +08:00
pkg_agent_spine_demo --> pkg_session
2026-07-21 01:54:00 +08:00
pkg_agent_spine_demo --> pkg_session_title
2026-07-15 15:57:57 +08:00
pkg_agent_spine_demo --> pkg_skill
pkg_agent_spine_demo --> pkg_skill_local
pkg_agent_spine_demo --> pkg_system_prompt
2026-07-15 16:57:03 +08:00
pkg_agent_spine_demo --> pkg_tasks
2026-07-15 15:57:57 +08:00
pkg_agent_spine_demo --> pkg_tool_bash
2026-07-19 23:55:33 +08:00
pkg_agent_spine_demo --> pkg_tool_goal
2026-07-15 15:57:57 +08:00
pkg_agent_spine_demo --> pkg_tool_skill
2026-07-15 16:57:03 +08:00
pkg_agent_spine_demo --> pkg_tool_tasks
2026-07-15 15:57:57 +08:00
pkg_agent_spine_demo --> pkg_tools
2026-07-15 17:04:16 +08:00
pkg_agent_spine_demo --> pkg_workspace_context
2026-07-20 00:51:19 +08:00
pkg_tool_ralph --> pkg_agent
2026-07-21 01:23:19 +08:00
pkg_tool_ralph --> pkg_invariants
2026-07-20 00:51:19 +08:00
pkg_tool_ralph --> pkg_llm
pkg_tool_ralph --> pkg_subagent
pkg_tool_ralph --> pkg_system_prompt
pkg_tool_ralph --> pkg_tools
pkg_tool_ralph --> pkg_workflow
2026-07-09 19:06:55 +08:00
pkg_workflow_workerthread --> pkg_agent
pkg_workflow_workerthread --> pkg_brand
2026-07-19 22:13:50 +08:00
pkg_workflow_workerthread --> pkg_invariants
2026-07-09 19:06:55 +08:00
pkg_workflow_workerthread --> pkg_llm
2026-07-12 03:51:55 +08:00
pkg_workflow_workerthread --> pkg_session
2026-07-09 19:06:55 +08:00
pkg_workflow_workerthread --> pkg_subagent
pkg_workflow_workerthread --> pkg_tools
pkg_workflow_workerthread --> pkg_workflow
2026-07-05 01:25:58 +08:00
pkg_subagent_fork --> pkg_agent
2026-07-19 22:13:50 +08:00
pkg_subagent_fork --> pkg_invariants
2026-07-05 01:25:58 +08:00
pkg_subagent_fork --> pkg_session
pkg_subagent_fork --> pkg_subagent
pkg_subagent_fork --> pkg_subagent_inprocess
2026-07-19 22:13:50 +08:00
pkg_subagent_spawn --> pkg_invariants
2026-07-05 01:25:58 +08:00
pkg_subagent_spawn --> pkg_subagent
pkg_subagent_spawn --> pkg_subagent_inprocess
2026-07-15 15:57:57 +08:00
pkg_acp_demo --> pkg_acp
pkg_acp_demo --> pkg_agent_spine_demo
pkg_acp_demo --> pkg_app_boot
2026-07-19 23:55:33 +08:00
pkg_acp_demo --> pkg_command_goal
2026-07-19 22:11:59 +08:00
pkg_acp_demo --> pkg_commands
2026-07-19 22:13:50 +08:00
pkg_acp_demo --> pkg_invariants
2026-07-15 15:57:57 +08:00
pkg_acp_demo --> pkg_session_persistence_jsonl
pkg_acp_demo --> pkg_tools
pkg_acp_demo --> pkg_user_interaction
2026-07-15 17:04:16 +08:00
pkg_acp_demo --> pkg_workspace_context
2026-07-15 21:21:24 +08:00
pkg_cli_demo --> pkg_agent
pkg_cli_demo --> pkg_agent_spine_demo
pkg_cli_demo --> pkg_app_boot
2026-07-19 22:13:50 +08:00
pkg_cli_demo --> pkg_invariants
2026-07-15 21:21:24 +08:00
pkg_cli_demo --> pkg_llm
pkg_cli_demo --> pkg_session
pkg_cli_demo --> pkg_session_persistence_jsonl
pkg_cli_demo --> pkg_tools
2026-07-19 13:11:50 +08:00
pkg_cli_demo --> pkg_workspace_context
2026-07-20 19:26:04 +08:00
pkg_tui_demo --> pkg_agent
pkg_tui_demo --> pkg_agent_loop
pkg_tui_demo --> pkg_agent_spine_demo
pkg_tui_demo --> pkg_app_boot
2026-07-20 22:18:20 +08:00
pkg_tui_demo --> pkg_command_goal
2026-07-20 22:05:51 +08:00
pkg_tui_demo --> pkg_commands
2026-07-20 21:02:52 +08:00
pkg_tui_demo --> pkg_invariants
2026-07-20 19:26:04 +08:00
pkg_tui_demo --> pkg_llm
pkg_tui_demo --> pkg_session
pkg_tui_demo --> pkg_session_persistence_jsonl
pkg_tui_demo --> pkg_tool_ask_user
pkg_tui_demo --> pkg_tools
pkg_tui_demo --> pkg_tui
pkg_tui_demo --> pkg_user_interaction
pkg_tui_demo --> pkg_workspace_context
2026-06-16 21:00:24 +08:00
```
2026-07-05 01:25:58 +08:00
| Package | Group | Depends on |
| --- | --- | --- |
2026-07-19 19:19:57 +08:00
| [`invariants` ](../packages/support/invariants ) | `support` | — |
2026-07-19 22:13:50 +08:00
| [`brand` ](../packages/util/brand ) | `util` | [`invariants` ](../packages/support/invariants ) |
| [`paths` ](../packages/util/paths ) | `util` | [`invariants` ](../packages/support/invariants ) |
| [`retention` ](../packages/util/retention ) | `util` | [`invariants` ](../packages/support/invariants ) |
| [`timeout` ](../packages/util/timeout ) | `util` | [`invariants` ](../packages/support/invariants ) |
2026-07-19 19:19:57 +08:00
| [`scope` ](../packages/core/scope ) | `core` | [`invariants` ](../packages/support/invariants ) |
2026-07-19 22:13:50 +08:00
| [`skill` ](../packages/skill/skill ) | `skill` | [`invariants` ](../packages/support/invariants ) |
| [`subagent-subprocess` ](../packages/subagent/subagent-subprocess ) | `subagent` | [`invariants` ](../packages/support/invariants ) |
| [`acp-snapshot` ](../packages/support/acp-snapshot ) | `support` | [`invariants` ](../packages/support/invariants ) |
| [`loader-smoke` ](../packages/support/loader-smoke ) | `support` | [`invariants` ](../packages/support/invariants ) |
| [`app-boot` ](../packages/ui/app-boot ) | `ui` | [`invariants` ](../packages/support/invariants ) |
| [`code-runtime` ](../packages/code-runtime/code-runtime ) | `code-runtime` | [`invariants` ](../packages/support/invariants ) |
| [`jsonrpc-demo` ](../packages/examples/jsonrpc-demo ) | `examples` | [`invariants` ](../packages/support/invariants ) |
| [`llm` ](../packages/llm/llm ) | `llm` | [`brand` ](../packages/util/brand ), [`invariants` ](../packages/support/invariants ) |
| [`code-runtime-worker` ](../packages/code-runtime/code-runtime-worker ) | `code-runtime` | [`code-runtime` ](../packages/code-runtime/code-runtime ), [`invariants` ](../packages/support/invariants ) |
| [`helper` ](../packages/sdk/helper ) | `sdk` | [`brand` ](../packages/util/brand ), [`invariants` ](../packages/support/invariants ) |
| [`scripts` ](../packages/sdk/scripts ) | `sdk` | [`app-boot` ](../packages/ui/app-boot ), [`invariants` ](../packages/support/invariants ) |
2026-07-21 21:20:43 +08:00
| [`telemetry` ](../packages/sdk/telemetry ) | `sdk` | [`brand` ](../packages/util/brand ), [`invariants` ](../packages/support/invariants ), [`paths` ](../packages/util/paths ) |
2026-07-20 22:49:27 +08:00
| [`llm-deepseek` ](../packages/llm/llm-deepseek ) | `llm` | [`invariants` ](../packages/support/invariants ), [`llm` ](../packages/llm/llm ), [`timeout` ](../packages/util/timeout ) |
| [`llm-pi-ai` ](../packages/llm/llm-pi-ai ) | `llm` | [`invariants` ](../packages/support/invariants ), [`llm` ](../packages/llm/llm ), [`timeout` ](../packages/util/timeout ) |
2026-07-19 19:19:57 +08:00
| [`session` ](../packages/core/session ) | `core` | [`brand` ](../packages/util/brand ), [`invariants` ](../packages/support/invariants ), [`llm` ](../packages/llm/llm ), [`scope` ](../packages/core/scope ) |
2026-07-19 22:13:50 +08:00
| [`system-prompt` ](../packages/core/system-prompt ) | `core` | [`invariants` ](../packages/support/invariants ), [`llm` ](../packages/llm/llm ), [`scope` ](../packages/core/scope ) |
| [`web` ](../packages/web/web ) | `web` | [`invariants` ](../packages/support/invariants ), [`llm` ](../packages/llm/llm ) |
2026-07-21 18:27:46 +08:00
| [`lsp` ](../packages/lsp/lsp ) | `lsp` | [`brand` ](../packages/util/brand ), [`invariants` ](../packages/support/invariants ), [`llm` ](../packages/llm/llm ) |
2026-07-19 22:13:50 +08:00
| [`sandbox` ](../packages/sandbox/sandbox ) | `sandbox` | [`invariants` ](../packages/support/invariants ), [`llm` ](../packages/llm/llm ) |
| [`token-meter` ](../packages/llm/token-meter ) | `llm` | [`invariants` ](../packages/support/invariants ), [`llm` ](../packages/llm/llm ), [`session` ](../packages/core/session ) |
2026-07-19 19:19:57 +08:00
| [`agent` ](../packages/core/agent ) | `core` | [`brand` ](../packages/util/brand ), [`invariants` ](../packages/support/invariants ), [`llm` ](../packages/llm/llm ), [`scope` ](../packages/core/scope ), [`session` ](../packages/core/session ), [`system-prompt` ](../packages/core/system-prompt ) |
2026-07-20 19:48:51 +08:00
| [`bash` ](../packages/bash/bash ) | `bash` | [`invariants` ](../packages/support/invariants ), [`sandbox` ](../packages/sandbox/sandbox ) |
| [`fs` ](../packages/fs/fs ) | `fs` | [`brand` ](../packages/util/brand ), [`invariants` ](../packages/support/invariants ), [`llm` ](../packages/llm/llm ), [`sandbox` ](../packages/sandbox/sandbox ) |
2026-07-19 22:13:50 +08:00
| [`compact` ](../packages/compact/compact ) | `compact` | [`invariants` ](../packages/support/invariants ), [`llm` ](../packages/llm/llm ), [`session` ](../packages/core/session ) |
2026-07-20 19:48:51 +08:00
| [`compact-tool-result-prune` ](../packages/compact/compact-tool-result-prune ) | `compact` | [`invariants` ](../packages/support/invariants ), [`llm` ](../packages/llm/llm ), [`session` ](../packages/core/session ) |
2026-07-19 22:13:50 +08:00
| [`web-fetch-local` ](../packages/web/web-fetch-local ) | `web` | [`invariants` ](../packages/support/invariants ), [`timeout` ](../packages/util/timeout ), [`web` ](../packages/web/web ) |
| [`web-search-deepseek` ](../packages/web/web-search-deepseek ) | `web` | [`invariants` ](../packages/support/invariants ), [`web` ](../packages/web/web ) |
| [`web-search-exa` ](../packages/web/web-search-exa ) | `web` | [`invariants` ](../packages/support/invariants ), [`web` ](../packages/web/web ) |
| [`web-search-perplexity` ](../packages/web/web-search-perplexity ) | `web` | [`invariants` ](../packages/support/invariants ), [`web` ](../packages/web/web ) |
| [`spill` ](../packages/spill/spill ) | `spill` | [`brand` ](../packages/util/brand ), [`invariants` ](../packages/support/invariants ), [`llm` ](../packages/llm/llm ), [`session` ](../packages/core/session ) |
| [`session-persistence` ](../packages/session-persistence/session-persistence ) | `session-persistence` | [`invariants` ](../packages/support/invariants ), [`session` ](../packages/core/session ) |
2026-07-21 21:11:32 +08:00
| [`session-title` ](../packages/session-title/session-title ) | `session-title` | [`brand` ](../packages/util/brand ), [`invariants` ](../packages/support/invariants ), [`llm` ](../packages/llm/llm ), [`session` ](../packages/core/session ) |
2026-07-19 22:13:50 +08:00
| [`llm-replay` ](../packages/support/llm-replay ) | `support` | [`invariants` ](../packages/support/invariants ), [`llm` ](../packages/llm/llm ), [`session` ](../packages/core/session ) |
2026-07-21 18:27:46 +08:00
| [`lsp-local` ](../packages/lsp/lsp-local ) | `lsp` | [`brand` ](../packages/util/brand ), [`invariants` ](../packages/support/invariants ), [`llm` ](../packages/llm/llm ), [`lsp` ](../packages/lsp/lsp ), [`timeout` ](../packages/util/timeout ) |
2026-07-19 22:13:50 +08:00
| [`sandbox-local` ](../packages/sandbox/sandbox-local ) | `sandbox` | [`invariants` ](../packages/support/invariants ), [`llm` ](../packages/llm/llm ), [`sandbox` ](../packages/sandbox/sandbox ) |
2026-07-20 19:48:51 +08:00
| [`sandbox-policy` ](../packages/sandbox/sandbox-policy ) | `sandbox` | [`invariants` ](../packages/support/invariants ), [`sandbox` ](../packages/sandbox/sandbox ), [`session` ](../packages/core/session ) |
2026-07-20 23:16:08 +08:00
| [`llm-retry` ](../packages/llm/llm-retry ) | `llm` | [`agent` ](../packages/core/agent ), [`invariants` ](../packages/support/invariants ), [`llm` ](../packages/llm/llm ), [`session` ](../packages/core/session ), [`timeout` ](../packages/util/timeout ) |
2026-07-21 00:44:39 +08:00
| [`goal` ](../packages/goal/goal ) | `goal` | [`agent` ](../packages/core/agent ), [`brand` ](../packages/util/brand ), [`invariants` ](../packages/support/invariants ), [`llm` ](../packages/llm/llm ), [`scope` ](../packages/core/scope ), [`session` ](../packages/core/session ) |
2026-07-19 22:13:50 +08:00
| [`bash-local` ](../packages/bash/bash-local ) | `bash` | [`bash` ](../packages/bash/bash ), [`invariants` ](../packages/support/invariants ), [`timeout` ](../packages/util/timeout ) |
2026-07-20 19:48:51 +08:00
| [`fs-local` ](../packages/fs/fs-local ) | `fs` | [`fs` ](../packages/fs/fs ), [`invariants` ](../packages/support/invariants ) |
| [`fs-policy` ](../packages/fs/fs-policy ) | `fs` | [`fs` ](../packages/fs/fs ), [`invariants` ](../packages/support/invariants ) |
2026-07-21 21:20:43 +08:00
| [`skill-local` ](../packages/skill/skill-local ) | `skill` | [`fs` ](../packages/fs/fs ), [`invariants` ](../packages/support/invariants ), [`paths` ](../packages/util/paths ), [`skill` ](../packages/skill/skill ) |
2026-07-20 19:48:51 +08:00
| [`compact-basic` ](../packages/compact/compact-basic ) | `compact` | [`agent` ](../packages/core/agent ), [`compact` ](../packages/compact/compact ), [`compact-tool-result-prune` ](../packages/compact/compact-tool-result-prune ), [`invariants` ](../packages/support/invariants ), [`llm` ](../packages/llm/llm ), [`session` ](../packages/core/session ), [`token-meter` ](../packages/llm/token-meter ) |
2026-07-19 22:13:50 +08:00
| [`spill-local` ](../packages/spill/spill-local ) | `spill` | [`invariants` ](../packages/support/invariants ), [`spill` ](../packages/spill/spill ) |
| [`hook-protocol` ](../packages/hooks/hook-protocol ) | `hooks` | [`bash` ](../packages/bash/bash ), [`invariants` ](../packages/support/invariants ), [`session` ](../packages/core/session ) |
| [`session-persistence-jsonl` ](../packages/session-persistence/session-persistence-jsonl ) | `session-persistence` | [`invariants` ](../packages/support/invariants ), [`session` ](../packages/core/session ), [`session-persistence` ](../packages/session-persistence/session-persistence ) |
| [`session-persistence-sqlite` ](../packages/session-persistence/session-persistence-sqlite ) | `session-persistence` | [`invariants` ](../packages/support/invariants ), [`session` ](../packages/core/session ), [`session-persistence` ](../packages/session-persistence/session-persistence ) |
2026-07-21 21:11:32 +08:00
| [`session-query` ](../packages/session-query/session-query ) | `session-query` | [`invariants` ](../packages/support/invariants ), [`llm` ](../packages/llm/llm ), [`session` ](../packages/core/session ), [`session-persistence` ](../packages/session-persistence/session-persistence ), [`session-title` ](../packages/session-title/session-title ) |
| [`session-title-llm` ](../packages/session-title/session-title-llm ) | `session-title` | [`invariants` ](../packages/support/invariants ), [`llm` ](../packages/llm/llm ), [`session` ](../packages/core/session ), [`session-title` ](../packages/session-title/session-title ), [`timeout` ](../packages/util/timeout ) |
2026-07-21 01:13:28 +08:00
| [`commands` ](../packages/ui/commands ) | `ui` | [`agent` ](../packages/core/agent ), [`invariants` ](../packages/support/invariants ), [`scope` ](../packages/core/scope ) |
2026-07-19 22:13:50 +08:00
| [`user-approval` ](../packages/ui/user-approval ) | `ui` | [`agent` ](../packages/core/agent ), [`brand` ](../packages/util/brand ), [`invariants` ](../packages/support/invariants ), [`llm` ](../packages/llm/llm ), [`scope` ](../packages/core/scope ), [`session` ](../packages/core/session ), [`system-prompt` ](../packages/core/system-prompt ) |
| [`user-interaction` ](../packages/ui/user-interaction ) | `ui` | [`agent` ](../packages/core/agent ), [`invariants` ](../packages/support/invariants ), [`llm` ](../packages/llm/llm ) |
2026-07-21 17:46:43 +08:00
| [`time-context` ](../packages/context/time-context ) | `context` | [`agent` ](../packages/core/agent ), [`invariants` ](../packages/support/invariants ), [`session` ](../packages/core/session ) |
2026-07-19 22:13:50 +08:00
| [`tasks` ](../packages/tasks/tasks ) | `tasks` | [`agent` ](../packages/core/agent ), [`brand` ](../packages/util/brand ), [`invariants` ](../packages/support/invariants ), [`session` ](../packages/core/session ), [`timeout` ](../packages/util/timeout ) |
| [`workflow` ](../packages/workflow/workflow ) | `workflow` | [`agent` ](../packages/core/agent ), [`brand` ](../packages/util/brand ), [`invariants` ](../packages/support/invariants ), [`llm` ](../packages/llm/llm ), [`session` ](../packages/core/session ) |
| [`tools` ](../packages/core/tools ) | `core` | [`agent` ](../packages/core/agent ), [`code-runtime` ](../packages/code-runtime/code-runtime ), [`invariants` ](../packages/support/invariants ), [`llm` ](../packages/llm/llm ), [`scope` ](../packages/core/scope ), [`session` ](../packages/core/session ), [`system-prompt` ](../packages/core/system-prompt ), [`user-approval` ](../packages/ui/user-approval ) |
2026-07-21 01:13:28 +08:00
| [`command-goal` ](../packages/goal/command-goal ) | `goal` | [`commands` ](../packages/ui/commands ), [`goal` ](../packages/goal/goal ), [`invariants` ](../packages/support/invariants ) |
| [`goal-session` ](../packages/goal/goal-session ) | `goal` | [`agent` ](../packages/core/agent ), [`goal` ](../packages/goal/goal ), [`invariants` ](../packages/support/invariants ), [`llm` ](../packages/llm/llm ), [`session` ](../packages/core/session ) |
2026-07-20 19:48:51 +08:00
| [`bash-sandbox` ](../packages/bash/bash-sandbox ) | `bash` | [`bash` ](../packages/bash/bash ), [`bash-local` ](../packages/bash/bash-local ), [`invariants` ](../packages/support/invariants ), [`sandbox` ](../packages/sandbox/sandbox ), [`sandbox-policy` ](../packages/sandbox/sandbox-policy ) |
| [`fs-sandbox` ](../packages/fs/fs-sandbox ) | `fs` | [`fs` ](../packages/fs/fs ), [`fs-local` ](../packages/fs/fs-local ), [`invariants` ](../packages/support/invariants ), [`sandbox` ](../packages/sandbox/sandbox ), [`sandbox-policy` ](../packages/sandbox/sandbox-policy ) |
2026-07-21 21:11:32 +08:00
| [`session-title-all-messages-llm` ](../packages/session-title/session-title-all-messages-llm ) | `session-title` | [`invariants` ](../packages/support/invariants ), [`llm` ](../packages/llm/llm ), [`session` ](../packages/core/session ), [`session-title` ](../packages/session-title/session-title ), [`session-title-llm` ](../packages/session-title/session-title-llm ) |
| [`session-title-first-message-llm` ](../packages/session-title/session-title-first-message-llm ) | `session-title` | [`invariants` ](../packages/support/invariants ), [`llm` ](../packages/llm/llm ), [`session` ](../packages/core/session ), [`session-title` ](../packages/session-title/session-title ), [`session-title-llm` ](../packages/session-title/session-title-llm ) |
2026-07-20 19:48:51 +08:00
| [`permission` ](../packages/ui/permission ) | `ui` | [`bash` ](../packages/bash/bash ), [`invariants` ](../packages/support/invariants ), [`sandbox` ](../packages/sandbox/sandbox ), [`sandbox-policy` ](../packages/sandbox/sandbox-policy ), [`session` ](../packages/core/session ), [`user-approval` ](../packages/ui/user-approval ) |
2026-07-19 19:19:57 +08:00
| [`agent-loop` ](../packages/core/agent-loop ) | `core` | [`agent` ](../packages/core/agent ), [`invariants` ](../packages/support/invariants ), [`llm` ](../packages/llm/llm ), [`scope` ](../packages/core/scope ), [`session` ](../packages/core/session ), [`session-persistence` ](../packages/session-persistence/session-persistence ), [`system-prompt` ](../packages/core/system-prompt ), [`tools` ](../packages/core/tools ) |
2026-07-21 01:13:28 +08:00
| [`tool-goal` ](../packages/goal/tool-goal ) | `goal` | [`agent` ](../packages/core/agent ), [`goal` ](../packages/goal/goal ), [`invariants` ](../packages/support/invariants ), [`llm` ](../packages/llm/llm ), [`session` ](../packages/core/session ), [`system-prompt` ](../packages/core/system-prompt ), [`tools` ](../packages/core/tools ) |
2026-07-21 21:20:43 +08:00
| [`tool-bash` ](../packages/bash/tool-bash ) | `bash` | [`agent` ](../packages/core/agent ), [`bash` ](../packages/bash/bash ), [`invariants` ](../packages/support/invariants ), [`llm` ](../packages/llm/llm ), [`paths` ](../packages/util/paths ), [`sandbox` ](../packages/sandbox/sandbox ), [`sandbox-policy` ](../packages/sandbox/sandbox-policy ), [`session-persistence` ](../packages/session-persistence/session-persistence ), [`system-prompt` ](../packages/core/system-prompt ), [`tasks` ](../packages/tasks/tasks ), [`tools` ](../packages/core/tools ), [`user-approval` ](../packages/ui/user-approval ) |
2026-07-20 19:48:51 +08:00
| [`tool-fs` ](../packages/fs/tool-fs ) | `fs` | [`fs` ](../packages/fs/fs ), [`invariants` ](../packages/support/invariants ), [`llm` ](../packages/llm/llm ), [`sandbox` ](../packages/sandbox/sandbox ), [`sandbox-policy` ](../packages/sandbox/sandbox-policy ), [`session` ](../packages/core/session ), [`system-prompt` ](../packages/core/system-prompt ), [`tools` ](../packages/core/tools ), [`user-approval` ](../packages/ui/user-approval ) |
2026-07-19 22:13:50 +08:00
| [`tool-fs-search` ](../packages/fs/tool-fs-search ) | `fs` | [`bash` ](../packages/bash/bash ), [`invariants` ](../packages/support/invariants ), [`llm` ](../packages/llm/llm ), [`retention` ](../packages/util/retention ), [`session` ](../packages/core/session ), [`spill` ](../packages/spill/spill ), [`system-prompt` ](../packages/core/system-prompt ), [`tools` ](../packages/core/tools ) |
| [`tool-skill` ](../packages/skill/tool-skill ) | `skill` | [`agent` ](../packages/core/agent ), [`invariants` ](../packages/support/invariants ), [`llm` ](../packages/llm/llm ), [`skill` ](../packages/skill/skill ), [`tools` ](../packages/core/tools ) |
| [`subagent` ](../packages/subagent/subagent ) | `subagent` | [`agent` ](../packages/core/agent ), [`brand` ](../packages/util/brand ), [`invariants` ](../packages/support/invariants ), [`llm` ](../packages/llm/llm ), [`scope` ](../packages/core/scope ), [`session` ](../packages/core/session ), [`tools` ](../packages/core/tools ) |
| [`tool-web` ](../packages/web/tool-web ) | `web` | [`invariants` ](../packages/support/invariants ), [`llm` ](../packages/llm/llm ), [`system-prompt` ](../packages/core/system-prompt ), [`tools` ](../packages/core/tools ), [`web` ](../packages/web/web ) |
| [`spill-policy` ](../packages/spill/spill-policy ) | `spill` | [`invariants` ](../packages/support/invariants ), [`llm` ](../packages/llm/llm ), [`retention` ](../packages/util/retention ), [`session` ](../packages/core/session ), [`spill` ](../packages/spill/spill ), [`tools` ](../packages/core/tools ) |
| [`timeout-policy` ](../packages/timeout/timeout-policy ) | `timeout` | [`invariants` ](../packages/support/invariants ), [`llm` ](../packages/llm/llm ), [`timeout` ](../packages/util/timeout ), [`tools` ](../packages/core/tools ) |
| [`tool-todo` ](../packages/todo/tool-todo ) | `todo` | [`agent` ](../packages/core/agent ), [`invariants` ](../packages/support/invariants ), [`session` ](../packages/core/session ), [`tools` ](../packages/core/tools ) |
2026-07-22 02:13:39 +08:00
| [`mode` ](../packages/mode/mode ) | `mode` | [`agent` ](../packages/core/agent ), [`commands` ](../packages/ui/commands ), [`invariants` ](../packages/support/invariants ), [`session` ](../packages/core/session ), [`system-prompt` ](../packages/core/system-prompt ), [`tools` ](../packages/core/tools ), [`user-interaction` ](../packages/ui/user-interaction ) |
2026-07-19 22:13:50 +08:00
| [`tool-cordis` ](../packages/cordis/tool-cordis ) | `cordis` | [`invariants` ](../packages/support/invariants ), [`scope` ](../packages/core/scope ), [`tools` ](../packages/core/tools ) |
| [`hooks-codex` ](../packages/hooks/hooks-codex ) | `hooks` | [`agent` ](../packages/core/agent ), [`hook-protocol` ](../packages/hooks/hook-protocol ), [`invariants` ](../packages/support/invariants ), [`llm` ](../packages/llm/llm ), [`session` ](../packages/core/session ), [`session-persistence` ](../packages/session-persistence/session-persistence ), [`tools` ](../packages/core/tools ) |
| [`agent-loop-testkit` ](../packages/support/agent-loop-testkit ) | `support` | [`agent` ](../packages/core/agent ), [`invariants` ](../packages/support/invariants ), [`llm` ](../packages/llm/llm ), [`session` ](../packages/core/session ), [`system-prompt` ](../packages/core/system-prompt ), [`tools` ](../packages/core/tools ) |
| [`tool-ask-user` ](../packages/ui/tool-ask-user ) | `ui` | [`agent` ](../packages/core/agent ), [`invariants` ](../packages/support/invariants ), [`tools` ](../packages/core/tools ), [`user-interaction` ](../packages/ui/user-interaction ) |
| [`workspace-context` ](../packages/context/workspace-context ) | `context` | [`agent` ](../packages/core/agent ), [`fs` ](../packages/fs/fs ), [`invariants` ](../packages/support/invariants ), [`llm` ](../packages/llm/llm ), [`paths` ](../packages/util/paths ), [`session` ](../packages/core/session ), [`tools` ](../packages/core/tools ) |
| [`repeat-tool-guard` ](../packages/guard/repeat-tool-guard ) | `guard` | [`agent` ](../packages/core/agent ), [`invariants` ](../packages/support/invariants ), [`tools` ](../packages/core/tools ) |
2026-07-21 18:27:46 +08:00
| [`tool-lsp` ](../packages/lsp/tool-lsp ) | `lsp` | [`invariants` ](../packages/support/invariants ), [`llm` ](../packages/llm/llm ), [`lsp` ](../packages/lsp/lsp ), [`system-prompt` ](../packages/core/system-prompt ), [`timeout` ](../packages/util/timeout ), [`tools` ](../packages/core/tools ) |
2026-07-19 22:13:50 +08:00
| [`mcp-client` ](../packages/mcp/mcp-client ) | `mcp` | [`invariants` ](../packages/support/invariants ), [`llm` ](../packages/llm/llm ), [`tools` ](../packages/core/tools ) |
| [`tool-tasks` ](../packages/tasks/tool-tasks ) | `tasks` | [`agent` ](../packages/core/agent ), [`invariants` ](../packages/support/invariants ), [`system-prompt` ](../packages/core/system-prompt ), [`tasks` ](../packages/tasks/tasks ), [`tools` ](../packages/core/tools ) |
| [`tool-workflow` ](../packages/workflow/tool-workflow ) | `workflow` | [`agent` ](../packages/core/agent ), [`invariants` ](../packages/support/invariants ), [`llm` ](../packages/llm/llm ), [`system-prompt` ](../packages/core/system-prompt ), [`tools` ](../packages/core/tools ), [`workflow` ](../packages/workflow/workflow ) |
| [`subagent-acp` ](../packages/subagent/subagent-acp ) | `subagent` | [`agent` ](../packages/core/agent ), [`invariants` ](../packages/support/invariants ), [`llm` ](../packages/llm/llm ), [`session` ](../packages/core/session ), [`subagent` ](../packages/subagent/subagent ), [`subagent-subprocess` ](../packages/subagent/subagent-subprocess ) |
| [`subagent-inprocess` ](../packages/subagent/subagent-inprocess ) | `subagent` | [`agent` ](../packages/core/agent ), [`invariants` ](../packages/support/invariants ), [`llm` ](../packages/llm/llm ), [`session` ](../packages/core/session ), [`subagent` ](../packages/subagent/subagent ), [`system-prompt` ](../packages/core/system-prompt ), [`tools` ](../packages/core/tools ) |
| [`tool-subagent` ](../packages/subagent/tool-subagent ) | `subagent` | [`agent` ](../packages/core/agent ), [`invariants` ](../packages/support/invariants ), [`llm` ](../packages/llm/llm ), [`subagent` ](../packages/subagent/subagent ), [`tasks` ](../packages/tasks/tasks ), [`tools` ](../packages/core/tools ) |
| [`hooks-claude` ](../packages/hooks/hooks-claude ) | `hooks` | [`agent` ](../packages/core/agent ), [`hook-protocol` ](../packages/hooks/hook-protocol ), [`invariants` ](../packages/support/invariants ), [`llm` ](../packages/llm/llm ), [`session` ](../packages/core/session ), [`session-persistence` ](../packages/session-persistence/session-persistence ), [`subagent` ](../packages/subagent/subagent ), [`tools` ](../packages/core/tools ) |
2026-07-22 02:28:47 +08:00
| [`acp` ](../packages/ui/acp ) | `ui` | [`agent` ](../packages/core/agent ), [`bash` ](../packages/bash/bash ), [`commands` ](../packages/ui/commands ), [`invariants` ](../packages/support/invariants ), [`llm` ](../packages/llm/llm ), [`llm-retry` ](../packages/llm/llm-retry ), [`mode` ](../packages/mode/mode ), [`permission` ](../packages/ui/permission ), [`sandbox` ](../packages/sandbox/sandbox ), [`session` ](../packages/core/session ), [`session-persistence` ](../packages/session-persistence/session-persistence ), [`session-title` ](../packages/session-title/session-title ), [`system-prompt` ](../packages/core/system-prompt ), [`tools` ](../packages/core/tools ), [`user-approval` ](../packages/ui/user-approval ), [`user-interaction` ](../packages/ui/user-interaction ) |
2026-07-19 22:13:50 +08:00
| [`jsonrpc` ](../packages/ui/jsonrpc ) | `ui` | [`agent` ](../packages/core/agent ), [`invariants` ](../packages/support/invariants ), [`llm` ](../packages/llm/llm ), [`llm-deepseek` ](../packages/llm/llm-deepseek ), [`scope` ](../packages/core/scope ), [`session` ](../packages/core/session ), [`subagent` ](../packages/subagent/subagent ) |
2026-07-21 21:11:32 +08:00
| [`tui` ](../packages/ui/tui ) | `ui` | [`agent` ](../packages/core/agent ), [`agent-loop` ](../packages/core/agent-loop ), [`commands` ](../packages/ui/commands ), [`invariants` ](../packages/support/invariants ), [`llm` ](../packages/llm/llm ), [`llm-retry` ](../packages/llm/llm-retry ), [`session` ](../packages/core/session ), [`session-title` ](../packages/session-title/session-title ), [`system-prompt` ](../packages/core/system-prompt ), [`token-meter` ](../packages/llm/token-meter ), [`tools` ](../packages/core/tools ), [`user-interaction` ](../packages/ui/user-interaction ) |
2026-07-21 22:59:41 +08:00
| [`agent-spine-demo` ](../packages/examples/agent-spine-demo ) | `examples` | [`agent` ](../packages/core/agent ), [`agent-loop` ](../packages/core/agent-loop ), [`goal` ](../packages/goal/goal ), [`goal-session` ](../packages/goal/goal-session ), [`invariants` ](../packages/support/invariants ), [`llm` ](../packages/llm/llm ), [`llm-retry` ](../packages/llm/llm-retry ), [`paths` ](../packages/util/paths ), [`scope` ](../packages/core/scope ), [`session` ](../packages/core/session ), [`session-title` ](../packages/session-title/session-title ), [`skill` ](../packages/skill/skill ), [`skill-local` ](../packages/skill/skill-local ), [`system-prompt` ](../packages/core/system-prompt ), [`tasks` ](../packages/tasks/tasks ), [`tool-bash` ](../packages/bash/tool-bash ), [`tool-goal` ](../packages/goal/tool-goal ), [`tool-skill` ](../packages/skill/tool-skill ), [`tool-tasks` ](../packages/tasks/tool-tasks ), [`tools` ](../packages/core/tools ), [`workspace-context` ](../packages/context/workspace-context ) |
2026-07-21 01:23:19 +08:00
| [`tool-ralph` ](../packages/workflow/tool-ralph ) | `workflow` | [`agent` ](../packages/core/agent ), [`invariants` ](../packages/support/invariants ), [`llm` ](../packages/llm/llm ), [`subagent` ](../packages/subagent/subagent ), [`system-prompt` ](../packages/core/system-prompt ), [`tools` ](../packages/core/tools ), [`workflow` ](../packages/workflow/workflow ) |
2026-07-19 22:13:50 +08:00
| [`workflow-workerthread` ](../packages/workflow/workflow-workerthread ) | `workflow` | [`agent` ](../packages/core/agent ), [`brand` ](../packages/util/brand ), [`invariants` ](../packages/support/invariants ), [`llm` ](../packages/llm/llm ), [`session` ](../packages/core/session ), [`subagent` ](../packages/subagent/subagent ), [`tools` ](../packages/core/tools ), [`workflow` ](../packages/workflow/workflow ) |
| [`subagent-fork` ](../packages/subagent/subagent-fork ) | `subagent` | [`agent` ](../packages/core/agent ), [`invariants` ](../packages/support/invariants ), [`session` ](../packages/core/session ), [`subagent` ](../packages/subagent/subagent ), [`subagent-inprocess` ](../packages/subagent/subagent-inprocess ) |
| [`subagent-spawn` ](../packages/subagent/subagent-spawn ) | `subagent` | [`invariants` ](../packages/support/invariants ), [`subagent` ](../packages/subagent/subagent ), [`subagent-inprocess` ](../packages/subagent/subagent-inprocess ) |
2026-07-21 01:13:28 +08:00
| [`acp-demo` ](../packages/examples/acp-demo ) | `examples` | [`acp` ](../packages/ui/acp ), [`agent-spine-demo` ](../packages/examples/agent-spine-demo ), [`app-boot` ](../packages/ui/app-boot ), [`command-goal` ](../packages/goal/command-goal ), [`commands` ](../packages/ui/commands ), [`invariants` ](../packages/support/invariants ), [`session-persistence-jsonl` ](../packages/session-persistence/session-persistence-jsonl ), [`tools` ](../packages/core/tools ), [`user-interaction` ](../packages/ui/user-interaction ), [`workspace-context` ](../packages/context/workspace-context ) |
2026-07-19 22:13:50 +08:00
| [`cli-demo` ](../packages/examples/cli-demo ) | `examples` | [`agent` ](../packages/core/agent ), [`agent-spine-demo` ](../packages/examples/agent-spine-demo ), [`app-boot` ](../packages/ui/app-boot ), [`invariants` ](../packages/support/invariants ), [`llm` ](../packages/llm/llm ), [`session` ](../packages/core/session ), [`session-persistence-jsonl` ](../packages/session-persistence/session-persistence-jsonl ), [`tools` ](../packages/core/tools ), [`workspace-context` ](../packages/context/workspace-context ) |
2026-07-21 01:13:28 +08:00
| [`tui-demo` ](../packages/examples/tui-demo ) | `examples` | [`agent` ](../packages/core/agent ), [`agent-loop` ](../packages/core/agent-loop ), [`agent-spine-demo` ](../packages/examples/agent-spine-demo ), [`app-boot` ](../packages/ui/app-boot ), [`command-goal` ](../packages/goal/command-goal ), [`commands` ](../packages/ui/commands ), [`invariants` ](../packages/support/invariants ), [`llm` ](../packages/llm/llm ), [`session` ](../packages/core/session ), [`session-persistence-jsonl` ](../packages/session-persistence/session-persistence-jsonl ), [`tool-ask-user` ](../packages/ui/tool-ask-user ), [`tools` ](../packages/core/tools ), [`tui` ](../packages/ui/tui ), [`user-interaction` ](../packages/ui/user-interaction ), [`workspace-context` ](../packages/context/workspace-context ) |
