75de01f06d
refactor(session): centralize surface provenance validation
2026-07-13 14:46:43 +08:00
95635dfa66
feat(permission): user-facing permission presets — one Permissions select over the two knobs
...
A preset names a bundle of the two mechanism knobs — request =
workspace-write + ask, yolo = danger-full-access + never — so the editor
shows ONE 'Permissions' select where the sandbox-mode and approval-policy
tiers stay orthogonal capabilities (the Codex /approvals shape: presets over
two dials). ctx.permission (dsh-permission) owns the config-defined table,
validates the default preset's bundle against the composed knob defaults at
load (fails loud), and writes a switch THROUGH: one log-only
permission/preset event (the audit fact reverse-mapping cannot recover —
the planned 'agent' preset shares request's knob values and differs only in
composed policy) plus each knob event via its own setter, deduped — a
net-zero switch appends nothing. Every knob consumer keeps reading its own
fold, untouched.
The current preset DERIVES from the effective knob values — the fold breaks
bundle ties, a knob state outside the table is the reserved 'custom' value
(a state, not an error: shown while it holds, switchable FROM, never a
target), and defaultPreset disappears (zero-event state reverse-maps from
the composition defaults).
The ACP bridge drops the two per-knob selects for the one preset select
(advertised only when ctx.permission is composed); pending/anchor/no-op
semantics carry over unchanged, with the no-op echo acknowledged before
vocabulary validation so a client re-pushing a derived 'custom' current
never errors. The sandbox variant example composes the
service with a workspace-write default; the permission-switching,
escalation-approved and escalation-rejected scenarios are re-recorded under
it (escalations now target an outside-workspace /tmp path under
danger-full-access, self-cleaning) and config-options is re-authored on the
single-select wire.
2026-07-13 14:38:26 +08:00
624d8d5df4
refactor(examples): fold the sandbox composition into acp-agent as its variant
...
sandbox-acp-agent's whole surface moves into examples/acp-agent following
the example's existing multi-variant shape (the code-mode/both-mode
overlays): sandbox.cordis.yml + its replay overlay, the four snapshot
scenarios (config-options / mode-switching / escalation-approved /
escalation-rejected) as a 'sandbox' header class over per-scenario
configPath — goldens byte-identical, zero re-recording — and
escalation.e2e.ts unchanged apart from the config path. One ACP example
remains; demo:sandbox-acp keeps its name and boots the variant. References
(both RFCs, group/package READMEs, the examples table and test map, the
e2e workflow comment) now point at the variant.
2026-07-13 14:37:59 +08:00
adf6b8a1ab
Merge remote-tracking branch 'origin/master' into codex/project-instruction-files
...
# Conflicts:
# docs/config-catalog.md
# docs/cordis-catalog/events.md
# docs/cordis-catalog/services.md
# docs/core-data-structures/core.md
# docs/event-producer-consumer.md
# docs/persistence-catalog.md
# docs/rfc/implemented/feature/2026-06-15-code-mode.md
# docs/rfc/implemented/feature/2026-06-30-interception-seams.md
# docs/rfc/proposed/simplification/2026-07-04-prune-dead-core-spine-surface.md
# docs/tool-execution-pipeline.md
# packages/cordis/tool-cordis/src/api-catalog.ts
# packages/core/agent-core/tests/agent-core.spec.ts
# packages/core/agent-loop/src/agent.ts
# packages/core/agent/README.md
# packages/core/session/src/index.ts
# packages/core/tools/README.md
# packages/core/tools/src/index.ts
# pnpm-lock.yaml
# scripts/gen-doc-graphs.ts
# scripts/type-equiv.manifest.json
2026-07-13 14:37:32 +08:00
50f0d3a299
Merge remote-tracking branch 'origin/master' into parallel-tool-call
...
# Conflicts:
# docs/architecture.md
# docs/config-catalog.md
# docs/cordis-catalog/services.md
# docs/rfc/INDEX.md
# packages/cordis/tool-cordis/src/api-catalog.ts
# packages/core/agent-loop/README.md
# packages/core/agent-loop/src/index.ts
# packages/core/agent-loop/src/loop.ts
# packages/core/tools/README.md
# packages/core/tools/src/index.ts
# packages/subagent/subagent/src/types.ts
# packages/subagent/tool-subagent/README.md
# scripts/gen-cordis-catalog.ts
# scripts/type-equiv.manifest.json
2026-07-13 14:28:32 +08:00
00bfc03d20
Merge remote-tracking branch 'origin/master' into session-query
...
# Conflicts:
# docs/core-data-structures/core.md
# docs/module-graph.md
# docs/rfc/INDEX.md
# vendor/README.md
2026-07-13 14:27:31 +08:00
f859332e9c
Merge remote-tracking branch 'origin/master' into codex/truncated-design
...
# Conflicts:
# docs/config-catalog.md
# docs/event-producer-consumer.md
# docs/rfc/INDEX.md
# packages/cordis/tool-cordis/src/api-catalog.ts
# pnpm-lock.yaml
2026-07-13 14:23:52 +08:00
4e47a7c1bf
Fix path-dependent Code Mode snapshots
2026-07-13 14:18:22 +08:00
768c79fd45
Fix Code Mode workspace context propagation
2026-07-13 13:56:45 +08:00
f658fb35e3
Merge remote-tracking branch 'origin/worktree-agent-scope-design' into codex/trim-ai-prose
2026-07-13 13:46:51 +08:00
320de5466a
feat(session-query): add relationship tracing (round 1)
2026-07-13 13:44:01 +08:00
6a8118c967
docs: align scoped runtime contracts
2026-07-13 13:41:27 +08:00
7c84611e38
Merge remote-tracking branch 'origin/worktree-agent-scope-design' into codex/trim-ai-prose
2026-07-13 13:22:22 +08:00
e04ec07345
refactor(core): remove owner-final assembly machinery
2026-07-13 13:09:41 +08:00
4ded5a32f6
Merge remote-tracking branch 'origin/worktree-agent-scope-design' into codex/trim-ai-prose
2026-07-13 12:07:23 +08:00
f32cfafa1a
refactor: narrow synchronous extension contracts
2026-07-13 11:58:55 +08:00
7ea1bf119f
feat(agent-loop): run safe tool calls in parallel
2026-07-13 11:13:21 +08:00
5ac03dde3f
fix(review): generalize spill storage locators
2026-07-13 11:07:27 +08:00
43535aab42
Merge remote-tracking branch 'origin/master' into codex/truncated-design
...
# Conflicts:
# docs/capability-seams.md
# docs/config-catalog.md
# docs/cordis-catalog/services.md
# docs/core-data-structures/core.md
# docs/event-producer-consumer.md
# docs/module-graph.md
# docs/rfc/INDEX.md
# docs/tool-catalog.md
# examples/acp-agent/README.md
# packages/README.md
# packages/bash/bash/README.md
# packages/core/tools/tests/gen-tool-catalog.spec.ts
# packages/support/acp-snapshot/src/harness.ts
# pnpm-lock.yaml
# scripts/gen-doc-graphs.ts
# scripts/gen-tool-catalog.ts
# scripts/type-equiv.manifest.json
2026-07-13 09:49:46 +08:00
74ada5777c
Merge PR #224 updates into prose cleanup
2026-07-12 23:36:49 +08:00
ed5304fb6d
docs(rfc): align scoped runtime contracts
2026-07-12 22:49:46 +08:00
bb3f6bd736
refactor(subagent): unify async readiness and cancellation
2026-07-12 22:41:59 +08:00
e8fed4fb66
fix(session): contain post-commit observers
2026-07-12 18:57:42 +08:00
d4b5227071
fix(bash): validate managed env namespace
2026-07-12 17:03:11 +08:00
1aadce9fe7
refactor(core): centralize DSH home resolution
2026-07-12 16:30:01 +08:00
48e7bde361
refactor(bash): centralize managed env prefix
2026-07-12 16:14:13 +08:00
df9617aaff
feat(bash): generalize managed shell environment
2026-07-12 15:41:42 +08:00
7e3d46a3ce
docs(scope): split contract from runtime design
2026-07-12 13:25:04 +08:00
e9a54f0e71
fix(workspace-context): require explicit byte budgets
2026-07-12 12:09:35 +08:00
03ce8bfea3
Merge remote-tracking branch 'origin/master' into session-query
...
# Conflicts:
# docs/capability-seams.md
# docs/config-catalog.md
# packages/README.md
# packages/cordis/tool-cordis/src/api-catalog.ts
# pnpm-lock.yaml
2026-07-12 10:09:16 +08:00
36b8370027
fix(scope): close remaining ownership boundaries
2026-07-12 03:51:55 +08:00
75838e10b5
docs: trim generated prose
2026-07-12 03:36:43 +08:00
3529b3c166
fix(scope): close final ownership races
...
Drain idle injection flushes before agent teardown, snapshot approval and subagent provider inputs, and gate subagent lifecycle events on real child readiness. Align the RFCs and generated contracts with the hardened behavior.
2026-07-12 00:31:46 +08:00
56e34619d7
Merge remote-tracking branch 'origin/master' into codex/pr224-rfc-rewrite
...
# Conflicts:
# docs/architecture.md
# docs/capability-seams.md
# docs/config-catalog.md
# docs/cookbook/extension-cookbook.md
# docs/cordis-catalog/events.md
# docs/cordis-catalog/services.md
# docs/event-producer-consumer.md
# docs/module-graph.md
# docs/rfc/implemented/feature/2026-06-30-interception-seams.md
# docs/rfc/proposed/feature/2026-06-14-acp-agent-client-protocol.md
# docs/tool-execution-pipeline.md
# packages/cordis/tool-cordis/src/api-catalog.ts
# packages/core/agent-core/README.md
# packages/core/agent-loop/README.md
# packages/core/tools/README.md
# packages/core/tools/src/index.ts
# packages/core/tools/tests/tools.spec.ts
# packages/core/tools/tsconfig.json
# packages/ui/acp/src/index.ts
# scripts/doc-budgets.manifest.json
# scripts/gen-cordis-catalog.ts
# scripts/gen-doc-graphs.ts
2026-07-11 23:14:09 +08:00
740106a51a
Merge remote-tracking branch 'origin/master' into codex/rfc-subagent-background-tasks
...
# Conflicts:
# docs/config-catalog.md
# docs/cordis-catalog/services.md
# docs/core-data-structures/bash.md
# docs/core-data-structures/core.md
# docs/event-producer-consumer.md
# docs/module-graph.md
# docs/tool-catalog.md
# examples/acp-agent/tests/snapshots/both-mode-turn/session.jsonl
# examples/acp-agent/tests/snapshots/code-mode-turn/session.jsonl
# examples/acp-agent/tests/snapshots/text-turn/session.jsonl
# packages/README.md
# packages/bash/README.md
# packages/bash/bash-local/src/index.ts
# packages/bash/bash/README.md
# packages/bash/bash/package.json
# packages/bash/bash/src/index.ts
# packages/bash/bash/src/types.ts
# packages/bash/bash/tests/service.spec.ts
# packages/bash/bash/tsconfig.json
# packages/bash/tool-bash/README.md
# packages/bash/tool-bash/src/index.ts
# packages/bash/tool-bash/tests/tools.spec.ts
# packages/bash/tool-bash/tsconfig.json
# packages/cordis/tool-cordis/src/api-catalog.ts
# packages/core/agent-core/README.md
# packages/core/agent-core/package.json
# packages/core/agent-core/src/index.ts
# packages/core/agent-core/tests/agent-core.spec.ts
# packages/core/tools/tests/gen-tool-catalog.spec.ts
# packages/hooks/hook-protocol/tests/runner.spec.ts
# packages/ui/acp-agent/tests/acp-agent.spec.ts
# packages/ui/stdio-agent/tests/stdio-agent.spec.ts
# pnpm-lock.yaml
# scripts/doc-budgets.manifest.json
# scripts/gen-tool-catalog.ts
2026-07-11 23:04:27 +08:00
1a3113ebb0
Merge remote-tracking branch 'origin/master' into codex/project-instruction-files
2026-07-11 23:02:24 +08:00
e1f317dcce
Merge remote-tracking branch 'origin/master' into codex/agent-session-jsonl-location
...
# Conflicts:
# docs/module-graph.md
# docs/tool-catalog.md
# examples/acp-agent/tests/snapshots/both-mode-turn/session.jsonl
# examples/acp-agent/tests/snapshots/code-mode-turn/session.jsonl
# examples/acp-agent/tests/snapshots/text-turn/session.jsonl
# packages/bash/tool-bash/README.md
# packages/bash/tool-bash/package.json
# packages/bash/tool-bash/src/index.ts
# packages/cordis/tool-cordis/src/api-catalog.ts
2026-07-11 22:57:27 +08:00
36c94fbe3e
docs: align the agent-scope contracts
2026-07-11 22:55:40 +08:00
3baaecc078
Merge remote-tracking branch 'origin/master' into codex/skill-system
...
# Conflicts:
# docs/rfc/INDEX.md
# examples/acp-agent/tests/snapshots/both-mode-turn/session.jsonl
# examples/acp-agent/tests/snapshots/code-mode-turn/session.jsonl
# examples/acp-agent/tests/snapshots/text-turn/session.jsonl
# packages/README.md
2026-07-11 22:31:28 +08:00
28f7fa0969
docs(rfc): record deferred skill extensions
2026-07-11 22:18:58 +08:00
0d23d95dde
docs(sandbox): record follow-up boundaries
2026-07-11 22:07:56 +08:00
b29a8eca71
fix(review): reconcile sandbox and approval contracts
2026-07-11 21:37:38 +08:00
ad32c57e72
refactor(session-query): narrow phase one to exact reads
2026-07-11 12:20:35 +08:00
eea0a99985
feat: expose agent session log location
2026-07-10 20:52:27 +08:00
aa1dc0e2c7
feat(session-query): checkpoint build round 1
2026-07-10 16:51:19 +08:00
ca39fd89b0
feat(example): sandbox-acp-agent — the live composition; RFCs to implemented
...
The three-entry cordis.yml (dsh-sandbox-local + dsh-bash-sandbox at a
read-only default + dsh-approval) served over ACP: the first live approval
composition. Recorded snapshot scenarios pin the wire end to end —
config-options advertisement, the mode-switching arc as the suite pinned
header (both switches, the prompt-section delta, one changed-by-the-user
notice per knob, a confined write landing under the switched mode), and
both escalation branches over scripted permissionAnswers (a grant runs
confined under workspace-write; a rejection executes nothing and pins the
fail-closed text). The with-key escalation e2e drives a real model +
real runner + the real bridge answerer, world-verified; ci.yml snapshot
lane and e2e.yml install bubblewrap so the confined replays actually
execute.
Both RFCs move to implemented/ (Decision/Consequences form, deferred
phases tracked in their own sections), with every cross-reference flipped.
2026-07-10 15:44:38 +08:00
680ae53bb6
Merge remote-tracking branch 'origin/master' into codex/skill-system
...
# Conflicts:
# docs/architecture.md
# docs/config-catalog.md
# docs/module-graph.md
# docs/rfc/INDEX.md
# examples/acp-agent/tests/snapshots/text-turn/session.jsonl
# packages/core/agent-core/src/index.ts
# packages/core/tools/tests/gen-tool-catalog.spec.ts
# packages/support/acp-snapshot/src/suite.ts
# packages/ui/acp-agent/src/index.ts
2026-07-10 14:43:33 +08:00
eee4f02108
Merge remote-tracking branch 'origin/master' into codex/project-instruction-files
...
# Conflicts:
# docs/architecture.md
# docs/config-catalog.md
# docs/event-producer-consumer.md
# docs/module-graph.md
# packages/core/agent-core/src/index.ts
# packages/ui/acp-agent/src/index.ts
2026-07-10 14:40:33 +08:00
3fe196a751
Adapt workspace context to session prefixes
2026-07-10 14:32:44 +08:00
6292d52236
feat(skill): move catalogs into session prefixes
2026-07-10 14:19:06 +08:00
Hypatia May