@toddzheng024/dscode-desktop 0.7.35 → 0.7.36

package/README.md

@@ -3,7 +3,7 @@
 DSCODE adds a coding preset, browser workflows, cross-session collaboration,
 memory and task management to the official DeepSeek Harness Desktop application.
 
-**Version:** 0.7.35 · **Harness runtime:** 0.2.0-rc.2
+**Version:** 0.7.36 · **Harness runtime:** 0.2.0-rc.2
 
 Preview release candidate; publication is a separate step.
 
@@ -48,7 +48,7 @@ public release; a candidate build alone does not publish a package.
 ## Install a published version
 
 After this version is available on npm, enter
-`@toddzheng024/dscode-desktop@0.7.35` in **Plugins → Add plugin**,
+`@toddzheng024/dscode-desktop@0.7.36` in **Plugins → Add plugin**,
 review the installation, install, then choose **Enable now**. Using the exact
 version keeps the installation tied to these instructions and compatibility
 requirements. The `preview` tag tracks the current Desktop preview release.

package/docs/CHANGELOG.md

@@ -6,6 +6,15 @@ Per-release notes live in [`docs/releases/`](releases/); the entries below summa
 
 <!-- Add upcoming changes under Unreleased. -->
 
+## [0.7.36] - 2026-10-09
+
+### Added
+
+- `dscode acp` serves standard ACP stdio clients with the DSCODE agent preset and configured providers. It supports native DSH session controls and forwards approval requests to the client. See [ACP clients](acp.md) for setup and inherited protocol limitations.
+
+- The source and npm launchers preserve ACP stdin/stdout, use client tool approvals, and require an installed-protocol probe before Hub publication.
+- Linux CI pulls the official Node image through its ECR Public mirror to avoid Docker Hub anonymous pull limits.
+
 ## [0.7.35] - 2026-10-08
 
 - Promote the verified Desktop package to both `preview` and `latest` so default installations receive this fix instead of 0.7.33. Promotion requires a matching public-install receipt.

package/docs/acp.md

@@ -0,0 +1,31 @@
+# ACP clients
+
+Run `dscode acp` to expose the DSCODE agent preset through Agent Client Protocol over newline-delimited JSON-RPC on stdin/stdout. The terminal interface is disabled. The ACP client supplies an absolute workspace directory when creating a session; tools run on the computer running DSCODE.
+
+## Connect a client
+
+Configure your client's custom ACP agent with executable `dscode` and arguments `["acp"]`. If the editor cannot find commands installed through nvm, use the absolute path printed by `command -v dscode`. Keep stdin open for the lifetime of the connection.
+
+To select an initial model explicitly, use:
+
+```sh
+dscode acp --model custom-your-provider-id/your-model-id
+```
+
+Without `--model`, the bridge uses DSCODE's saved default provider and model. Set up credentials and custom services in the normal TUI first with `/login` or `/provider custom`. The stable custom provider ID is recorded in `~/.dscode/providers.yaml`; it is not the service's display name. API keys stay in the existing credential store. Clients supporting ACP configuration options can select an advertised model and reasoning effort after creating a session.
+
+For a source checkout, the equivalent executable is `node` with arguments `["/absolute/path/to/dscode/bin/dscode.mjs", "acp"]`. Source and npm installations use their existing, separate state directories. `--patch FILE` adds a trusted composition overlay and can be repeated. `dscode acp --help` prints usage without starting the runtime or installing a profile.
+
+## Behavior and limits
+
+- New and resumed ACP agents mount the `dscode` preset, including its tools and provider adapters. The bridge reuses DSH's native ACP implementation rather than translating terminal output.
+- ACP sessions use the `ask` permission preset. Tool requests requiring approval are sent to the ACP client; the client can allow once, reject, or cancel. Normal sandbox rules still apply. The terminal's automatic model review is not the approval decision maker for these sessions.
+- Standard session creation, prompts, cancellation, model configuration, listing, resume, close and MCP attachment are inherited from the pinned DSH bridge. Resume reconnects a session without replaying its transcript.
+- The inherited bridge identifies itself as `deepseek-harness-acp`. It does not advertise `session/load`, modes, slash commands, terminal delegation, client filesystem operations or interactive question forms. Clients requiring those features need additional integration; a successful protocol handshake does not establish full editor compatibility.
+- Title generation, session-card generation and memory generation are disabled in this transport. Configured providers, tools and other integrations remain available; ACP is not an offline mode.
+- Stdout is reserved for protocol frames. First-install progress and launcher diagnostics go to stderr. Trusted custom patches must also respect this rule.
+- Closing stdin shuts down the runtime. SIGTERM is forwarded by the launcher. Sessions persist in the same installation's state directory, and a running ACP process holds the normal installation lock against upgrades.
+
+## Verification
+
+`node scripts/verify-acp.mjs` exercises the source CLI with a fixture model and custom API, without paid model requests. Unit tests cover argument validation, preset composition, source and npm launcher routing, cleanup and signal forwarding. Client-specific UI behavior must be verified in the intended editor.

package/docs/releases/0.7.36.md

@@ -0,0 +1,14 @@
+# DSCODE 0.7.36
+
+This release exposes the DSCODE agent preset to ACP clients through the source and npm launchers.
+
+- **ACP entry point:** `dscode acp` runs DSH's native stdio bridge with DSCODE tools and provider adapters. It uses the saved model selection or `--model PROVIDER/ID`; configure credentials and custom services in the terminal interface first. Configure clients with executable `dscode` and arguments `["acp"]`. See the [ACP guide](../acp.md) for setup.
+- **Client approvals and session lifecycle:** ACP sessions use the `ask` permission preset and send approval requests to the client. Creation, prompts, cancellation, model configuration, listing, resume, close and MCP attachment inherit the pinned native bridge. Stdout carries protocol frames, terminal-only generation is disabled, and closing stdin exits the runtime while preserving the installation's session state.
+- **Support boundary:** the bridge retains the `deepseek-harness-acp` identity. It does not add transcript replay through `session/load`, modes, slash commands, client filesystem/terminal delegation or interactive question forms. This is a terminal-launcher transport; the Desktop plugin retains its existing support boundary.
+- **Distribution checks:** the npm launcher includes its ACP routing code, the bundle includes the bridge, and Hub publication requires a successful protocol probe against the installed artifacts. Native tool-result regression cases cover all three custom API formats using upstream's serializer. Linux CI uses the official Node image's ECR Public mirror to avoid Docker Hub anonymous pull limits.
+
+Update the global launcher with `npm install -g @toddzheng024/dscode@latest`, then run `dscode update` to refresh an existing Hub profile. A fresh installation provisions its matching profile on first use.
+
+Verification of the merged feature code passed `npm run check` on Node 22.19.0 and 24.19.0: 1,087 unit/component tests, both TypeScript checks, 80.16% complete source line coverage, integration/package checks and 63 offline evaluation cases. Real Chrome checks and the scripted browser evaluation passed. Linux end-to-end verification passed all seven steps, including installed ACP, Hub installation, agent execution, failed upgrade and rollback; the GitHub macOS and Linux gates also passed. Documentation and lint checks run for this version change, and the release workflow requalifies the exact versioned terminal and Desktop archives before publication.
+
+The ACP probe covers initialization, a fixture custom API, DSCODE tool calls, allow/reject approvals, cancellation, list/resume/close and EOF shutdown. Specific editor compatibility and paid model endpoints have no automated case in this release. No live-model quality claim follows from the fixture probes.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@toddzheng024/dscode-desktop",
-  "version": "0.7.35",
+  "version": "0.7.36",
   "private": false,
   "description": "DSCODE for Harness Desktop: coding collaboration, session memory, browser workflows and task management.",
   "license": "MIT",

package/plugins/acp/cli.mjs

@@ -0,0 +1,45 @@
+export const USAGE = `Usage: dscode acp [options]
+Serve Agent Client Protocol over stdio using the DSCODE agent preset.
+The client supplies each session's workspace. Stdout contains only ACP frames.
+
+Options:
+  --model PROVIDER/ID   initial model (default: the saved default model)
+  --patch FILE          additional composition overlay (repeatable)
+  -h, --help            show this help
+
+Configure credentials and custom providers in the TUI before connecting.
+Permission requests are answered by the ACP client. Disconnecting exits.`;
+
+export function parseAcpArgs(argv) {
+  const options = { patches: [], help: false };
+  for (let index = 0; index < argv.length; index++) {
+    const arg = argv[index];
+    if (arg === '--help' || arg === '-h') { options.help = true; continue; }
+    if (!['--model', '--patch'].includes(arg)) throw Error(`Unknown ACP option: ${arg}`);
+    const value = argv[++index];
+    if (!value || value.startsWith('-')) throw Error(`${arg} requires a value`);
+    if (arg === '--patch') options.patches.push(value);
+    else {
+      if (!/^[^/\s]+\/\S+$/.test(value)) throw Error('--model expects provider/model');
+      options.model = value;
+    }
+  }
+  return options;
+}
+
+export function acpOverlay(entry, options = {}) {
+  return `${['tui-startup', 'tui-runner', 'session-title-llm'].map(id => `- id: ${id}\n  disabled: true`).join('\n')}
+- id: dscode-session-cards
+  config:
+    enabled: false
+- id: dscode-memory
+  config:
+    generate: false
+- insert:
+    - id: acp-app-startup
+      name: '@deepseek-ai/dsh-acp-app'
+    - id: dscode-acp
+      name: ${JSON.stringify(entry)}
+      config: ${JSON.stringify(options.model ? { model: options.model } : {})}
+`;
+}

package/plugins/acp/index.mjs

@@ -0,0 +1,44 @@
+import { apply as applyAcp } from '@deepseek-ai/dsh-acp';
+import z from '@deepseek-ai/schemastery';
+
+export const name = 'dscode-acp';
+export const inject = ['acpAppStartup', 'agents', 'agentPresets', 'agentDefaultModel', 'permissionPresets', 'llm', 'sessionPersistence', 'sessions', 'dscodeCustom'];
+export const Config = z.object({ model: z.string() });
+
+// Scope the factory to this bridge: TUI and delegated agents keep their own
+// composition. ACP still owns model selection, MCP attachment and disposal.
+export function presetAgents(ctx) {
+  const wrap = method => async (options) => {
+    const handle = await ctx.agents[method]({
+      ...options,
+      ...(method === 'create' ? { meta: { ...options.meta, agentPreset: 'dscode' } } : {}),
+      setup: async (agentCtx, agent) => {
+        await ctx.agentPresets.mount(agentCtx, 'dscode');
+        await options.setup?.(agentCtx, agent);
+      },
+    });
+    ctx.permissionPresets.set(handle.agent.session, 'ask');
+    return handle;
+  };
+  const overrides = { create: wrap('create'), resume: wrap('resume') };
+  return new Proxy(ctx.agents, {
+    get(target, key) {
+      if (Object.hasOwn(overrides, key)) return overrides[key];
+      const value = Reflect.get(target, key, target);
+      return typeof value === 'function' ? value.bind(target) : value;
+    },
+  });
+}
+
+export function startAcp(ctx, config = {}, bridge = applyAcp) {
+  const selection = config.model
+    ? { provider: config.model.slice(0, config.model.indexOf('/')), model: config.model.slice(config.model.indexOf('/') + 1) }
+    : ctx.agentDefaultModel.currentSelection();
+  const scoped = ctx.extend({ agents: presetAgents(ctx) });
+  bridge(scoped, { provider: selection.provider, model: selection.model });
+}
+
+export async function apply(ctx, config) {
+  await ctx.get('dscodeCustom').refresh();
+  startAcp(ctx, config);
+}

package/plugins/dscode/index.mjs

@@ -58,7 +58,7 @@ const childLimit = owner => (owner.session.requestHeader?.()?.config ?? owner.op
 // repository there instead of pointing at a path that does not exist.
 const DOCS_DIR = fileURLToPath(new URL('../../docs/', import.meta.url));
 const DOCS_REPO = 'https://github.com/qiz029/dscode/blob/main/docs/';
-export const DOCS_SECTION = `To answer questions about DSCODE itself - what it supports, how a feature is configured, what a command does - treat the bundled user guides as the source of truth instead of guessing: ${existsSync(DOCS_DIR) ? `${DOCS_DIR} plus the repository root README.md (session-bridge.md, session-communication.md, session-cards.md, memory.md, exec.md, email.md, browser-use.md, plugin-hub.md, computer-use.md, skills.md, tui-commands.md, session-metrics.md, dscode-ultra.md, auto-review.md, account-login.md, opencode-go.md, custom-providers.md, demo.md, triggers.md)` : `the repository documentation at ${DOCS_REPO} plus the root README.md (session-bridge.md, session-communication.md, session-cards.md, memory.md, exec.md, email.md, browser-use.md, plugin-hub.md, computer-use.md, skills.md, tui-commands.md, session-metrics.md, dscode-ultra.md, auto-review.md, account-login.md, opencode-go.md, custom-providers.md, demo.md, triggers.md)`}. Read the relevant guide before answering rather than relying on memory of an earlier session. docs/CONTEXT-HANDOFF.md, docs/session-messaging-design.md, docs/cloud-webapp-host.md, docs/triggers-design.md, docs/verification.md, docs/maintainability.md and docs/vendored-tui-upgrade.md are internal development records, not user documentation: never quote them to a user or treat them as a specification. When the guides do not cover something, describe only what the running installation actually does and say plainly that it is not documented.`;
+export const DOCS_SECTION = `To answer questions about DSCODE itself - what it supports, how a feature is configured, what a command does - treat the bundled user guides as the source of truth instead of guessing: ${existsSync(DOCS_DIR) ? `${DOCS_DIR} plus the repository root README.md (session-bridge.md, session-communication.md, session-cards.md, memory.md, exec.md, acp.md, email.md, browser-use.md, plugin-hub.md, computer-use.md, skills.md, tui-commands.md, session-metrics.md, dscode-ultra.md, auto-review.md, account-login.md, opencode-go.md, custom-providers.md, demo.md, triggers.md)` : `the repository documentation at ${DOCS_REPO} plus the root README.md (session-bridge.md, session-communication.md, session-cards.md, memory.md, exec.md, acp.md, email.md, browser-use.md, plugin-hub.md, computer-use.md, skills.md, tui-commands.md, session-metrics.md, dscode-ultra.md, auto-review.md, account-login.md, opencode-go.md, custom-providers.md, demo.md, triggers.md)`}. Read the relevant guide before answering rather than relying on memory of an earlier session. docs/CONTEXT-HANDOFF.md, docs/session-messaging-design.md, docs/cloud-webapp-host.md, docs/triggers-design.md, docs/verification.md, docs/maintainability.md and docs/vendored-tui-upgrade.md are internal development records, not user documentation: never quote them to a user or treat them as a specification. When the guides do not cover something, describe only what the running installation actually does and say plainly that it is not documented.`;
 
 export function apply(ctx, config = {}) {
   const viewer = config.desktop ? 'Delegation board in the right sidebar' : '/delegate-dashboard';