- subagent-sdk: the default registry name becomes `dsh-sdk` (the bare
`sdk` read ambiguously in configs); READMEs, config catalog, fixture,
and suites follow. The Loader fixture now omits providerName to exercise
the shipped default end to end.
- loader-composition.e2e: two full harness runtimes boot in sequence, so
the default 30s loader-smoke window times out under host load; raise the
subprocess deadline to 120s with matching vitest headroom (the
real-model.e2e precedent).
The local PTY readiness poll held its inferred_idle fallback for exactly
one pollIntervalMs after a prompt marker, so a bash foreground handoff
that lands on the silence boundary only wins the exact stdin_read
attribution when the kernel publishes it inside that single poll. On a
slow or loaded host it does not, and the attribution flips.
handoffGraceMs replaces the hardcoded one-poll window as a validated,
deployment-owned config field defaulting to 500ms, rejected at load when
it cannot contain one readiness poll. Real-shell tests that interrupt a
send now assert the session is usable again rather than which readiness
tier observed the handoff, because no fixed grace removes the race.
`config.maxWallMs` is only checked for positivity, and it is handed to
`setTimeout`, which clamps any delay above 2^31-1 ms to 1 ms. A deployment
configuring a 25-day wall ceiling therefore gets the opposite of what it asked
for: every run times out on the first tick. The runtime now range-checks the
field at load against MAX_TIMER_DELAY_MS from dsh-timeout and throws, so the
misconfiguration fails loud where it is self-contained instead of silently
inverting the budget.
`computeMs` needs no matching bound: it is compared against measured event-loop
utilization rather than fed to a timer.
The test asserts both the rejection and that the boundary value itself loads.
Two review findings on the turndown swap, both verified empirically:
- Unclosed-tag nesting makes the synchronous turndown/domino walk
superlinear (measured: depth 512 ~0.15s, 2k ~2s, 20k ~5s), during
which the cooperative fetchTimeoutMs timer cannot fire. renderBody
now preflights nesting depth with a linear tag scan and passes
bodies past 512 levels through raw; the try/catch stays for markup
the scan cannot see (comment-hidden tags), simulated in tests via a
converter throw.
- Markdown escaping can expand converted HTML ~2x (100k underscores
render as 200k chars), so provider body caps no longer bounded the
model-visible result. formatFetchOutput now caps the complete output
(header + body + footer) under new fetchMaxOutputChars config
(default 200000 = 2x the local provider's default body cap), reusing
the truncation notice.
README EN+ZH, config catalog, Agent Note EN+ZH updated; the new
web-fetch fixture is migrated to the packed layout master now
requires; tool-web coverage stays 100% per-file.
- ui-model README pair (short-form Model Experience + audited registry
entry + Known Limitations), recorded in the pairing manifest
- llm-deepseek README pair rebased onto master's version with this PR's
real deltas (friendly names, 256k, selector consumers) on both sides;
runtime/ui-conversation READMEs revert to master (their sections
documented the removed Session state machine and control slot)
- config catalog regenerated for the ui-model roster row
- ModelDirectory.store JSDoc; ui-model files join the TODO(gui) coverage
deferral lane beside their ui-command/ui-slash siblings
- examples/jsonrpc-agent gains its first snapshot suite (sdk.snapshot.ts):
the real dsh-jsonrpc-agent runtime driven through the real dsh-sdk-client,
keyless llm-replay behind a new cordis.snapshot.yml overlay; three recorded
scenarios (text turn, bash tool, spawn subagent) pin the notification
stream, the SDK turn result, and the persisted parent+child session logs.
- Bilingual READMEs for dsh-sdk-protocol / dsh-sdk-client / dsh-subagent-sdk;
sdk/ and subagent/ group tables extended; dsh-jsonrpc README points at the
extracted protocol package; Agent Note (en+zh) owns the decision.
- The proposed make-jsonrpc-directional note is updated for the transport's
new home and its second (client) consumer.
- Model Experience sentence allowlist entries for the two client-side
packages; module graph + config catalog regenerated; i18n pairings
recorded. doc-sync passes 24/24.
Resolve merge by regenerating cordis/config catalogs and the doc graphs from
the merged tree, and re-record the tools README and tools doc bilingual pair
hashes so the pairing gate matches the merged content.
Turtle