kingwl
c0146b9c4a
Review follow-up (tianyicui): plan mode and the sandbox are orthogonal
AXES, not just orthogonal state — entering plan must not change what the
sandbox enforces, matching Codex's separation of Plan/Default
collaboration presets from sandbox and approval settings.
ModeDefinition.access, the bash/resolve-mode clamp, and both cap-derived
guards are removed; a ModeDefinition is exactly { section }, and a mode
now carries only its guidance section plus the exit_plan_mode review.
The bash seam's resolveMode + waterfall go with their only listener:
dsh-bash and dsh-tool-bash revert to master byte-for-byte, and the
dsh-mode → dsh-bash dependency edge is gone. A deployment that wants
kernel-enforced read-only planning pairs the mode picker with the
independent sandbox-mode option, in either order.
The RFC archives this as the second removed enforcement shape (after
the interim allowlist) with the same restart trigger — effects
self-declaration; the orthogonality FAQ now answers with the two-axis
rule. The plan example demonstrates the axes side by side, and the
re-recorded fixtures pin the guidance-only section.
40 lines
1.8 KiB
YAML
40 lines
1.8 KiB
YAML
# Snapshot-test REPLAY overlay for the plan-mode composition: the SAME app
|
|
# tree as cordis.yml, derived from it by an include — the one difference is
|
|
# the model backend. A keyless replay run cannot boot the real adapter
|
|
# (llm-deepseek's apply() throws without DEEPSEEK_API_KEY), so the include
|
|
# patches the live tree at load time: the llm-deepseek entry is disabled by
|
|
# id, and the llm-replay entry (which serves a recorded session JSONL — no
|
|
# API key, no network) is inserted. Every other entry — the mode plugin, the
|
|
# filesystem stack, the app — IS the live tree.
|
|
#
|
|
# The dsh-acp-demo bin selects this file for DSH_SNAPSHOT=replay (the
|
|
# sibling-swap of whatever config path it was handed). The replay fixture
|
|
# path comes from $DSH_SNAPSHOT_FILE, set by the snapshot harness. stdout
|
|
# stays reserved for the ACP JSON-RPC protocol.
|
|
- id: base
|
|
name: '@cordisjs/plugin-include'
|
|
config:
|
|
path: ./cordis.yml
|
|
patches:
|
|
# The name is an assertion, not an override: the include skips the patch
|
|
# (warning) when the id points at a different plugin, so this can never
|
|
# disable the wrong entry.
|
|
- id: llm-deepseek
|
|
name: '@deepseek-ai/dsh-llm-deepseek'
|
|
disabled: true
|
|
# Replay swaps the sandbox runner for the pure-config passthrough (same
|
|
# knob as examples/acp-agent): deterministic on hosts without bwrap.
|
|
- id: sandbox
|
|
name: '@deepseek-ai/dsh-sandbox-local'
|
|
config:
|
|
runnerCommand:
|
|
- bash
|
|
- -c
|
|
- while [ "$1" != "--" ]; do shift; done; shift; exec "$@"
|
|
- passthrough-runner
|
|
runnerFailureSignatures:
|
|
- 'passthrough-runner: profile rejected'
|
|
- insert:
|
|
- id: llm-replay
|
|
name: '@deepseek-ai/dsh-llm-replay'
|