dsh-acp-enhanced 0.3.2 → 0.3.5

package/README-zh.md

@@ -26,9 +26,12 @@ ACP 线上。
 
 ### Zed 深度集成
 
-- **工具卡片**：折叠态即显示一行摘要——`Read <路径>`、执行的命令、`Search: <模式>`、
-  `Fetch: <URL>` 等；展开可见每次调用的完整参数与结果预览（`rawInput` / `rawOutput`），
-  按工具类型渲染图标
+- **工具卡片**：折叠态即显示一行摘要——`Read <路径>`、shell 命令显示模型自己给出的意图描述
+  （`description`，Codex 风格，展开可见完整命令）、`Search: <模式>`、
+  `Fetch: <URL>` 等。卡片正文遵循 ACP 最佳实践：文件编辑渲染为真实 **diff 视图**、
+  shell 命令渲染为高亮代码块并在下方附输出、涉及文件以**可点击路径**呈现（点击直达）；
+  `rawInput` / `rawOutput` 保留在展开区备查，按工具类型渲染图标，
+  状态机为进行中 → 完成/失败
 - **Zed 文件与终端**：`zed_read_text_file` / `zed_write_text_file` / `zed_terminal` 把
   文件编辑放进 Zed 的"编辑文件"区（diff + 接受/拒绝）、命令跑在 Zed 真实终端
 - **原生表单提问**：`ask_user_question` → `elicitation/create` 表单，选项即点即答
@@ -38,6 +41,10 @@ ACP 线上。
 
 - **恢复与归档**：`session/load` 恢复历史线程（完整回放）；`session/list` /
   `session/delete` 管理线程归档（带标题、按更新时间排序）；标题实时推送
+- **多根工作区**：`sessionCapabilities.additionalDirectories` 已声明，Zed 不再提示
+  "This agent doesn't currently support multi-root workspaces"，而是把所有工作区根
+  通过 `session/new` / `session/load` 传入。所有根都会写进系统提示词并在
+  `session/list` 上回报；沙箱仍以主 `cwd` 为唯一可写根（见已知限制）
 
 ### 命令
 
@@ -189,7 +196,8 @@ dsh plugin --profile acp-enhanced add dsh-web-search-openrouter
 |---|---|
 | `exec: dsh: not found`（status 127） | 用随附 `dsh-acp-zed.sh` 启动器（自定位 node/dsh） |
 | `no API key for provider route "xxx"` | 写入 `~/.dsh/.credentials.yaml`，或在 agent_servers 里设 `env.DEEPSEEK_API_KEY` |
-| 无法切换模型 / 上下文用量不显示 | 选到了不可路由的"幽灵 provider"；本桥默认过滤（只广播 `config.provider` 的模型），确认 profile 的 provider 指向真实路由 |
+| 无法切换模型 | 保存的 `reasoning_effort` 默认值（或会话当前 effort）被带到新模型上；0.3.3 起新模型不支持的 effort 会自动回退为该模型默认值，不再让整个切换失败。另检查：是否选到了不可路由的"幽灵 provider"——本桥默认过滤（只广播 `config.provider` 的模型），确认 profile 的 provider 指向真实路由 |
+| 上下文用量不显示 | 选到了不可路由的"幽灵 provider"；本桥默认过滤（只广播 `config.provider` 的模型），确认 profile 的 provider 指向真实路由 |
 | 需要详细诊断 | `ACP_DEBUG=1 dsh --profile acp-enhanced`（stderr 生命周期 trace） |
 
 ## 开发
@@ -204,8 +212,13 @@ node scripts/acp-resume-test.mjs      # 会话恢复测试
 
 ## 已知限制
 
-仅 baseline prompt（无图片/音频附件）、不支持 `additionalDirectories`、文本按块粒度
-流式、每会话同时一个 in-flight prompt。MCP 支持 stdio 与 streamable HTTP（不声明
-legacy SSE / `acp` 传输）。`session/close` / `session/fork` / `session/resume` 未实现
-（不声明能力，合规客户端不会调用）；`session/delete` 因 dsh 持久化无官方删除 API，
-采用直接删除后端目录的方式。
+仅 baseline prompt（无图片/音频附件）、文本按块粒度流式、每会话同时一个 in-flight
+prompt。MCP 支持 stdio 与 streamable HTTP（不声明 legacy SSE / `acp` 传输）。
+`session/close` / `session/fork` / `session/resume` 未实现（不声明能力，合规客户端
+不会调用）；`session/delete` 因 dsh 持久化无官方删除 API，采用直接删除后端目录的方式。
+
+多根工作区已声明、模型可见所有根，但 dsh 沙箱策略每会话只解析**一个可写根**（主
+`cwd`，即 `session.header.cwd`），本地沙箱也只为该根开放写权限。读操作在所有根均可
+用；`workspace-write` 下对附加根的写入会先被拒绝、需升级/批准，`danger-full-access`
+下所有根均可写。真正的多根写支持需改 dsh 核心（`dsh-sandbox-policy` /
+`dsh-sandbox-local` 需要根列表而非单根）。

package/README.md

@@ -30,9 +30,13 @@ over the ACP wire.
 ### Zed deep integration
 
 - **Tool cards**: one-line summary in the collapsed header — `Read <path>`, the
-  executed command, `Search: <pattern>`, `Fetch: <url>`, etc. — with the full
-  arguments and result preview (`rawInput` / `rawOutput`) one click away, plus
-  per-kind icons
+  model's own intent line for shell commands (`description`, Codex-style — the
+  exact command stays one click away), `Search: <pattern>`, `Fetch: <url>`, etc.
+  The card body follows the ACP best practice: file edits render as a real
+  **diff**, shell commands as a syntax-highlighted code block with the output
+  beneath, and touched files as **clickable locations** that open the file —
+  with `rawInput` / `rawOutput` kept one click away for transparency, plus
+  per-kind icons and a proper in-progress → completed/failed status lifecycle
 - **Zed files & terminal**: `zed_read_text_file` / `zed_write_text_file` / `zed_terminal`
   put file edits into Zed's "edited files" area (diff + accept/reject) and commands into a
   real Zed terminal
@@ -45,6 +49,11 @@ over the ACP wire.
 - **Resume & archive**: `session/load` restores past threads (full replay);
   `session/list` / `session/delete` manage the thread archive (titled, sorted by last
   activity); live title updates
+- **Multi-root workspaces**: `sessionCapabilities.additionalDirectories` is advertised,
+  so Zed no longer shows "this agent doesn't currently support multi-root workspaces"
+  and instead passes every workspace root on `session/new` / `session/load`. All roots
+  are described to the model in the system prompt and reported on `session/list`; the
+  sandbox keeps the primary `cwd` as its single writable root (see Known limitations)
 
 ### Commands
 
@@ -206,7 +215,8 @@ dsh plugin --profile acp-enhanced add dsh-web-search-openrouter
 |---|---|
 | `exec: dsh: not found` (status 127) | Use the shipped `dsh-acp-zed.sh` launcher (locates node/dsh itself) |
 | `no API key for provider route "xxx"` | Write `~/.dsh/.credentials.yaml`, or set `env.DEEPSEEK_API_KEY` on the agent_servers entry |
-| Cannot switch models / context usage missing | A "phantom provider" route was picked; this bridge filters them by default (only `config.provider`'s models are advertised) — point the profile's provider at a real route |
+| Cannot switch models | The saved `reasoning_effort` default (or the session's current effort) is carried onto the new model; since 0.3.3 an unsupported effort resets to the model's default instead of failing the switch. Also check: a "phantom provider" route was picked — this bridge filters them by default (only `config.provider`'s models are advertised), so point the profile's provider at a real route |
+| Context usage missing | A "phantom provider" route was picked; this bridge filters them by default (only `config.provider`'s models are advertised) — point the profile's provider at a real route |
 | Need detailed diagnostics | `ACP_DEBUG=1 dsh --profile acp-enhanced` (stderr lifecycle trace) |
 
 ## Development
@@ -221,9 +231,17 @@ node scripts/acp-resume-test.mjs      # session resume test
 
 ## Known limitations
 
-Baseline prompts only (no image/audio attachments), no `additionalDirectories`, text
-streams at block granularity, one in-flight prompt per session. MCP supports stdio and
-streamable HTTP (legacy SSE / `acp` transports are not advertised).
+Baseline prompts only (no image/audio attachments), text streams at block granularity,
+one in-flight prompt per session. MCP supports stdio and streamable HTTP (legacy SSE /
+`acp` transports are not advertised).
 `session/close` / `session/fork` / `session/resume` are not implemented (capabilities
-undeclared, compliant clients will not call them); `session/delete` removes the persisted
-directory directly because dsh persistence has no official delete API.
+undeclared, compliant clients will not call them); `session/delete` removes the
+persisted directory directly because dsh persistence has no official delete API.
+
+Multi-root workspaces are advertised and all roots are visible to the model, but dsh's
+sandbox policy resolves **one writable root per session** (the primary `cwd`, i.e.
+`session.header.cwd`) and the local sandboxes bind exactly that root for writes. Reads
+work in every root; under `workspace-write` a write under an additional root is denied
+first and needs escalation/approval, while `danger-full-access` writes everywhere.
+True multi-root write enforcement belongs in dsh core (`dsh-sandbox-policy` /
+`dsh-sandbox-local` would need a root list instead of a single root).

package/lib/index.js

@@ -23,6 +23,12 @@
  * - **Session modes**: permission presets are exposed as ACP modes
  *   (`session/set_mode`), so the client's mode UI drives the sandbox/approval
  *   preset of the session.
+ * - **Multi-root workspaces**: `sessionCapabilities.additionalDirectories` is
+ *   advertised, so Zed passes every workspace root on the session lifecycle
+ *   requests instead of warning "this agent doesn't currently support
+ *   multi-root workspaces". All roots are described to the model in the
+ *   system prompt; the sandbox still enforces one writable root (the primary
+ *   `cwd`) — writes under an additional root go through escalation.
  *
  * Stdout is reserved for ACP JSON-RPC; diagnostics go to stderr only.
  *
@@ -32,7 +38,7 @@
 import { randomUUID } from 'node:crypto'
 import { rm } from 'node:fs/promises'
 import { createRequire } from 'node:module'
-import { isAbsolute, dirname } from 'node:path'
+import { isAbsolute, dirname, resolve } from 'node:path'
 import { Readable, Writable } from 'node:stream'
 import Schema from '@deepseek-ai/schemastery'
 import { AgentSideConnection, ndJsonStream, PROTOCOL_VERSION, RequestError } from '@agentclientprotocol/sdk'
@@ -48,7 +54,7 @@ const AGENT_VERSION = createRequire(import.meta.url)('../package.json').version
 
 export const name = 'acp-enhanced'
 /** The bridge creates and owns agents; every other concern is carried by the composition. */
-export const inject = ['agents', 'llm', 'approval', 'tools', 'commands']
+export const inject = ['agents', 'llm', 'approval', 'tools', 'commands', 'systemPrompt']
 
 export const Config = Schema.object({
   /** Initial provider route for every created agent. */
@@ -77,12 +83,13 @@ function internalError(detail) {
 /**
  * Map a dsh tool name to the ACP ToolKind used for icons and card UX.
  *
- * Zed treats kind == 'execute' as a TERMINAL tool and kind == 'edit' as a
- * diff tool, and for both it HIDES rawInput (the "Raw Input:" section). Only
- * genuinely terminal tools (zed_terminal) should be 'execute'; local executors
- * like bash/run_code must stay 'other' so the editor shows the exact arguments
- * (the command) plus the output. Write/edit tools likewise stay 'other' unless
- * the bridge also emits diff content — otherwise the card would show nothing.
+ * Kind and content must agree: Zed treats kind == 'execute' as a terminal tool
+ * and kind == 'edit' as a diff tool, and for both it HIDES the rawInput
+ * section. `zed_terminal` is genuinely terminal; write/edit tools map to
+ * 'edit' only because the bridge always pairs them with a `diff` content
+ * block (see toolCallContentFor) — the diff replaces the raw dump as the card
+ * body. Local executors like bash/run_code stay 'other' and carry the command
+ * as a markdown code block, keeping the raw sections available too.
  */
 function toolKindFor(name) {
   if (name === 'zed_terminal') return 'execute'
@@ -90,6 +97,7 @@ function toolKindFor(name) {
   if (/search|find|grep/.test(name)) return 'search'
   if (/fetch|http/.test(name)) return 'fetch'
   if (/think/.test(name)) return 'think'
+  if (/write|edit|patch|apply/.test(name)) return 'edit'
   return 'other'
 }
 
@@ -120,6 +128,94 @@ function mdEscape(text) {
   return String(text).replace(/([\\*_`[\]<>])/g, '\\$1')
 }
 
+/** Executor-class tool names (command runners) shared by title/content/kind. */
+const EXECUTOR_NAME = /bash|pwsh|powershell|shell|exec|run_code|execute|terminal/
+
+/** Fenced-code language hint per executor tool (best effort — highlight only). */
+function executorLang(name) {
+  if (/pwsh|powershell/.test(name)) return 'powershell'
+  if (/run_code/.test(name)) return 'typescript'
+  return 'bash'
+}
+
+/** Shared file-path argument lookup (key order = display preference). */
+function pathArg(obj) {
+  for (const key of ['path', 'file_path', 'filePath', 'file', 'target']) {
+    if (typeof obj[key] === 'string' && obj[key].trim() !== '') return obj[key].trim()
+  }
+  return undefined
+}
+
+/** Cap a long text body for a card, marking the cut so nothing looks lost. */
+function boundBody(text, max) {
+  const body = String(text ?? '')
+  return body.length > max ? `${body.slice(0, max)}\n… (truncated)` : body
+}
+
+/** A markdown fenced code block, widening the fence when the text itself
+ *  contains ``` runs so the body always renders literally. */
+function codeFence(text, lang) {
+  const body = String(text ?? '')
+  const ticks = body.includes('```') ? '````' : '```'
+  return `${ticks}${lang}\n${boundBody(body, 12000)}\n${ticks}`
+}
+
+/**
+ * ACP content blocks giving the card a friendly body — the protocol's
+ * best-practice surface (clients render these INSTEAD of the raw JSON dump,
+ * which stays available as rawInput/rawOutput for transparency):
+ * - write/edit tools → a `diff` block rendered as a real diff card;
+ * - executors → the command as a syntax-highlighted code block.
+ */
+function toolCallContentFor(name, argumentsValue, kind) {
+  const obj = argumentsValue !== null && typeof argumentsValue === 'object' && !Array.isArray(argumentsValue)
+    ? argumentsValue
+    : {}
+  if (kind === 'edit') {
+    const path = pathArg(obj)
+    if (path === undefined) return undefined
+    const newText = ['content', 'new_string', 'new_str', 'newText'].find((key) => typeof obj[key] === 'string')
+    if (newText === undefined) return undefined
+    const oldKey = ['old_string', 'old_str', 'oldText'].find((key) => typeof obj[key] === 'string')
+    return [{
+      type: 'diff',
+      path,
+      newText: boundBody(obj[newText], 8000),
+      ...oldKey === undefined ? {} : { oldText: boundBody(obj[oldKey], 8000) },
+    }]
+  }
+  if (name !== 'zed_terminal' && EXECUTOR_NAME.test(name)) {
+    const command = typeof obj.command === 'string' ? obj.command
+      : typeof obj.cmd === 'string' ? obj.cmd
+      : typeof obj.script === 'string' ? obj.script
+      : Array.isArray(obj.args) && obj.args.every((part) => typeof part === 'string')
+        ? obj.args.join(' ')
+      : undefined
+    if (typeof command === 'string' && command.trim() !== '') {
+      return [{ type: 'content', content: { type: 'text', text: codeFence(command.trim(), executorLang(name)) } }]
+    }
+  }
+  return undefined
+}
+
+/**
+ * Files the call touches, as ACP `locations` — the "follow the agent"
+ * surface. Editors render them as clickable chips that open the file (and
+ * scroll to `line`), so a read or an edit is one click from its target.
+ */
+function toolCallLocationsFor(kind, argumentsValue) {
+  if (kind !== 'read' && kind !== 'edit' && kind !== 'delete' && kind !== 'move') return undefined
+  const obj = argumentsValue !== null && typeof argumentsValue === 'object' && !Array.isArray(argumentsValue)
+    ? argumentsValue
+    : {}
+  const path = pathArg(obj)
+  if (path === undefined) return undefined
+  const line = [obj.line, obj.offset].find((value) => (
+    typeof value === 'number' && Number.isFinite(value) && value >= 1
+  ))
+  return [{ path, ...line === undefined ? {} : { line } }]
+}
+
 /**
  * One-line human-readable summary of a tool call for the ACP `title` field.
  * Zed renders this as the collapsed tool-call header, so a bare tool name
@@ -146,11 +242,16 @@ function toolCallTitle(name, argumentsValue) {
   )
 
   // Execute-kind tools (plain-text label): show the command itself.
-  if (name === 'zed_terminal' || /bash|shell|exec|run_code|execute|terminal/.test(name)) {
+  if (name === 'zed_terminal' || EXECUTOR_NAME.test(name)) {
     // Only zed_terminal maps to kind 'execute' (Zed renders its label as plain
     // text); local executors like bash/run_code are kind 'other' and render as
     // markdown, so their command must be escaped to stay literal.
     const literal = (text) => (name === 'zed_terminal' ? text : mdEscape(text))
+    // Codex-style card: the collapsed title is the model's own intent line
+    // (bash/pwsh mark `description` required — "Show working tree status"),
+    // and the exact command stays visible in rawInput when the card expands.
+    const description = str('description')
+    if (description) return clipOneLine(literal(description), 100)
     const command = str('command') ?? str('cmd') ?? str('script')
     if (command) return clipOneLine(literal(command), 100)
     const argv = obj.args
@@ -161,7 +262,7 @@ function toolCallTitle(name, argumentsValue) {
 
   // File-content tools: `Read <path>` (incl. line range when present).
   if (/read|cat|show|view/.test(name)) {
-    const path = str('path') ?? str('file_path') ?? str('filePath') ?? str('file')
+    const path = pathArg(obj)
     if (path) {
       const range = [num('line') ?? num('offset'), num('limit')].filter((value) => value !== undefined)
       const suffix = range.length === 2 && Number.isFinite(range[0]) && Number.isFinite(range[1]) && range[1] > 0
@@ -175,7 +276,7 @@ function toolCallTitle(name, argumentsValue) {
 
   // File-modifying tools: `Write <path>` / `Edit <path>`.
   if (/write|edit|patch|apply/.test(name)) {
-    const path = str('path') ?? str('file_path') ?? str('filePath') ?? str('file') ?? str('target')
+    const path = pathArg(obj)
     if (path) return clipOneLine(`Write ${mdEscape(path)}`, 120)
   }
 
@@ -275,6 +376,24 @@ export function apply(ctx, config) {
   /** Resolve the permission-presets service, tolerating a lazy mount. */
   const permissionPresets = () => ctx.get('permissionPresets')
 
+  // Multi-root workspaces: describe the session's roots to the model. Zed
+  // passes the primary cwd plus every additional workspace root on the
+  // session lifecycle requests; the sandbox policy still resolves a single
+  // writable root (the primary cwd), so the text tells the model how writes
+  // behave under each policy. Reads are unrestricted by the file sandbox.
+  ctx.systemPrompt?.context({
+    name: 'acp:workspace-roots',
+    order: 115,
+    text: (context) => {
+      const session = context.agent?.session
+      if (session === undefined) return ''
+      return renderWorkspaceRoots(
+        session.header.cwd,
+        sessions.get(session.id)?.additionalDirectories ?? [],
+      )
+    },
+  })
+
   /** Return the bridge-owned record for an agent, rejecting same-id impostors. */
   const ownedRecord = (agent) => {
     const record = sessions.get(agent.session.id)
@@ -309,6 +428,70 @@ export function apply(ctx, config) {
     inflight.reject(internalError(`turn failed: ${reason.error.message}`))
   }
 
+  /**
+   * Wire update for a harness `tool/call`: the one-line title header plus the
+   * protocol's friendly-body surfaces — `content` (diff for file edits, the
+   * command as a code block for executors), `locations` (clickable file chips),
+   * and `rawInput`/`rawOutput`-class transparency fields.
+   */
+  function toolCallUpdateFor(record, event) {
+    const parsedArgs = parseToolArguments(event.data.arguments)
+    const kind = toolKindFor(event.data.name)
+    const content = toolCallContentFor(event.data.name, parsedArgs, kind)
+    const locations = toolCallLocationsFor(kind, parsedArgs)
+    // Result-side card bodies need the call's own args (the executor output
+    // fence); remember them per callId with a small ceiling against
+    // aborted-call leaks.
+    if (record.callArgs.size >= 64) record.callArgs.delete(record.callArgs.keys().next().value)
+    record.callArgs.set(event.data.callId, { name: event.data.name, parsedArgs })
+    return {
+      sessionUpdate: 'tool_call',
+      toolCallId: event.data.callId,
+      name: event.data.name,
+      title: toolCallTitle(event.data.name, parsedArgs),
+      kind,
+      status: 'in_progress',
+      ...content === undefined ? {} : { content },
+      ...locations === undefined ? {} : { locations },
+      rawInput: parsedArgs,
+      _meta: {
+        turn: event.data.turn,
+        step: event.data.step,
+        name: event.data.name,
+        argumentsPreview: event.data.arguments.slice(0, 200),
+      },
+    }
+  }
+
+  /** Wire update for a harness `tool/result`: terminal status plus, for
+   *  executors, the output as a friendly code block under the command. */
+  function toolResultUpdateFor(record, event, callId, elapsed) {
+    const preview = resultPreview(event)
+    const call = record.callArgs.get(callId)
+    record.callArgs.delete(callId)
+    const isError = event.data.error !== undefined
+    let content
+    if (!isError && preview !== undefined && call !== undefined
+      && call.name !== 'zed_terminal' && EXECUTOR_NAME.test(call.name)) {
+      content = [{ type: 'content', content: { type: 'text', text: codeFence(preview, executorLang(call.name)) } }]
+    }
+    return {
+      sessionUpdate: 'tool_call_update',
+      toolCallId: callId,
+      ...call === undefined ? {} : { name: call.name },
+      status: isError ? 'failed' : 'completed',
+      ...content === undefined ? {} : { content },
+      ...preview === undefined ? {} : { rawOutput: preview },
+      _meta: {
+        turn: event.data.turn,
+        step: event.data.step,
+        elapsedMs: elapsed,
+        count: record.toolStats.count,
+        totalMs: record.toolStats.totalMs,
+      },
+    }
+  }
+
   // ── session/event → ACP notifications ─────────────────────────────────────
 
   ctx.on('session/event', (session, event) => {
@@ -369,25 +552,9 @@ export function apply(ctx, config) {
         case 'tool/call': {
           record.toolStats.lastCallAt = Date.now()
           record.toolStats.lastName = event.data.name
-          const parsedArgs = parseToolArguments(event.data.arguments)
           notify({
             sessionId: session.header.id,
-            update: {
-              sessionUpdate: 'tool_call',
-              toolCallId: event.data.callId,
-              // A one-line summary (not just the tool name) so Zed's collapsed
-              // header shows what the call is doing — which file is read, which
-              // command runs, what is searched — before expanding the card.
-              title: toolCallTitle(event.data.name, parsedArgs),
-              kind: toolKindFor(event.data.name),
-              rawInput: parsedArgs,
-              _meta: {
-                turn: event.data.turn,
-                step: event.data.step,
-                name: event.data.name,
-                argumentsPreview: event.data.arguments.slice(0, 200),
-              },
-            },
+            update: toolCallUpdateFor(record, event),
           })
           break
         }
@@ -400,22 +567,9 @@ export function apply(ctx, config) {
           record.toolStats.lastCallAt = undefined
           // The tool call id lives on the ToolResultBlock, not on the event root.
           const callId = event.data.message?.content?.[0]?.toolCallId ?? event.data.callId
-          const preview = resultPreview(event)
           notify({
             sessionId: session.header.id,
-            update: {
-              sessionUpdate: 'tool_call_update',
-              toolCallId: callId,
-              status: event.data.error === undefined ? 'completed' : 'error',
-              ...preview === undefined ? {} : { rawOutput: preview },
-              _meta: {
-                turn: event.data.turn,
-                step: event.data.step,
-                elapsedMs: elapsed,
-                count: record.toolStats.count,
-                totalMs: record.toolStats.totalMs,
-              },
-            },
+            update: toolResultUpdateFor(record, event, callId, elapsed),
           })
           break
         }
@@ -747,7 +901,22 @@ export function apply(ctx, config) {
 
   /** Resolve and apply a new model/effort selection to the session. */
   async function applySelection(record, next) {
-    const resolved = await llm.resolveCallConfig(next)
+    let resolved
+    try {
+      resolved = await llm.resolveCallConfig(next)
+    } catch (error) {
+      // A reasoning effort can outlive the model that supported it: Zed
+      // re-applies its saved `default_config_options` on every session, and
+      // switching models carries the session's current effort onto the newly
+      // picked model, which may not offer it (glm-* and gpt-5.6-luna reject
+      // "max"). Rejecting the whole switch snapped Zed's dropdown back and
+      // made model switching itself appear broken, so drop the stale effort
+      // and resolve against the target model's own default instead. Any other
+      // failure (unknown route, missing credential) still surfaces.
+      if (error?.code !== 'UNSUPPORTED_REASONING_EFFORT' || next.reasoningEffort === undefined) throw error
+      logger.warn(`acp-enhanced: dropped reasoning effort "${next.reasoningEffort}" for ${next.provider}/${next.model} (unsupported); using the model default`)
+      resolved = await llm.resolveCallConfig({ ...next, reasoningEffort: undefined })
+    }
     const selected = {
       provider: resolved.provider,
       model: resolved.model,
@@ -1278,6 +1447,8 @@ export function apply(ctx, config) {
     return {
       agent: handle.agent,
       dispose: () => handle.dispose(),
+      /** Additional workspace roots beyond the primary cwd (multi-root). */
+      additionalDirectories: [],
       inflight: undefined,
       messageId: undefined,
       stepStartedAt: undefined,
@@ -1286,6 +1457,8 @@ export function apply(ctx, config) {
       title: undefined,
       lastActivityAt: undefined,
       toolStats: { count: 0, totalMs: 0, lastCallAt: undefined, lastName: undefined },
+      /** callId → { name, parsedArgs } for result-time card bodies (bounded). */
+      callArgs: new Map(),
       buffer: {},
       thoughtBuffer: {},
       contextWindow: undefined,
@@ -1397,36 +1570,14 @@ export function apply(ctx, config) {
             break
           }
           case 'tool/call': {
-            const parsedArgs = parseToolArguments(event.data.arguments)
-            await notifyNow(record, {
-              sessionUpdate: 'tool_call',
-              toolCallId: event.data.callId,
-              title: toolCallTitle(event.data.name, parsedArgs),
-              kind: toolKindFor(event.data.name),
-              rawInput: parsedArgs,
-              _meta: {
-                turn: event.data.turn,
-                step: event.data.step,
-                name: event.data.name,
-                argumentsPreview: String(event.data.arguments ?? '').slice(0, 200),
-              },
-            })
+            // Same card shape as the live path — replayed threads render the
+            // friendly body (diff / command block) and clickable locations too.
+            await notifyNow(record, toolCallUpdateFor(record, event))
             break
           }
           case 'tool/result': {
-            const preview = resultPreview(event)
             const callId = event.data.message?.content?.[0]?.toolCallId ?? event.data.callId
-            await notifyNow(record, {
-              sessionUpdate: 'tool_call_update',
-              toolCallId: callId,
-              status: event.data.error === undefined ? 'completed' : 'error',
-              ...preview === undefined ? {} : { rawOutput: preview },
-              _meta: {
-                turn: event.data.turn,
-                step: event.data.step,
-                name: event.data.name,
-              },
-            })
+            await notifyNow(record, toolResultUpdateFor(record, event, callId, 0))
             break
           }
         }
@@ -1459,7 +1610,10 @@ export function apply(ctx, config) {
           agentInfo: { name: 'deepseek-harness-acp-enhanced', version: AGENT_VERSION },
           agentCapabilities: {
             loadSession: true,
-            sessionCapabilities: { list: {}, delete: {} },
+            // additionalDirectories: multi-root workspaces (Zed passes every
+            // workspace root on session/new / session/load instead of showing
+            // the "doesn't currently support multi-root workspaces" callout).
+            sessionCapabilities: { list: {}, delete: {}, additionalDirectories: {} },
             promptCapabilities: { image: false, audio: false, embeddedContext: false },
             // Stdio MCP servers always work; streamable HTTP maps onto
             // dsh-mcp-client's second transport. Legacy SSE does not.
@@ -1475,7 +1629,7 @@ export function apply(ctx, config) {
 
       async newSession(params) {
         assertOpen()
-        validateSessionParams(params)
+        const additionalDirectories = normalizeSessionParams(params)
         const sessionId = SessionId(randomUUID())
         const handle = await agents.create({
           sessionId,
@@ -1490,6 +1644,7 @@ export function apply(ctx, config) {
           throw internalError('connection closed during session/new')
         }
         const record = makeRecord(handle)
+        record.additionalDirectories = additionalDirectories
         sessions.set(sessionId, record)
         await syncMcpServers(params.mcpServers, params.cwd)
         publishCommandsAfterResponse(record)
@@ -1515,15 +1670,14 @@ export function apply(ctx, config) {
 
       async loadSession(params) {
         assertOpen()
-        if (!isAbsolute(params.cwd)) throw invalidParams(`cwd must be an absolute path: ${params.cwd}`)
-        if (params.additionalDirectories !== undefined && params.additionalDirectories.length > 0) {
-          throw invalidParams('additionalDirectories is not supported')
-        }
+        const additionalDirectories = normalizeSessionParams(params)
         await syncMcpServers(params.mcpServers, params.cwd)
         const sessionId = SessionId(params.sessionId)
         const live = sessions.get(sessionId)
         if (live !== undefined) {
           // Already live on this connection: return its state without replay.
+          // The client's root list is authoritative for the loaded workspace.
+          live.additionalDirectories = additionalDirectories
           const permission = permissionPresets()
           return {
             ...permission === undefined ? {} : {
@@ -1550,6 +1704,7 @@ export function apply(ctx, config) {
           throw internalError('connection closed during session/load')
         }
         const record = makeRecord(handle)
+        record.additionalDirectories = additionalDirectories
         sessions.set(sessionId, record)
         // Zed inserts the thread before the load RPC completes; replay the
         // conversation history as notifications so the thread renders.
@@ -1760,9 +1915,11 @@ export function apply(ctx, config) {
           const live = sessions.get(header.id)
           const title = live?.title ?? await readStoredTitle(persistence, header.id)
           const updatedAtMs = live?.lastActivityAt ?? header.createdAt
+          const liveDirs = live?.additionalDirectories ?? []
           out.push({
             sessionId: header.id,
             cwd: header.cwd ?? cwd ?? process.cwd(),
+            ...liveDirs.length === 0 ? {} : { additionalDirectories: liveDirs },
             ...title === undefined ? {} : { title },
             updatedAt: new Date(updatedAtMs).toISOString(),
           })
@@ -1865,10 +2022,46 @@ export function apply(ctx, config) {
   ctx.effect(() => quiesce, 'acp-enhanced.connection')
 }
 
-/** Reject session features outside the automation contract. */
-function validateSessionParams(params) {
+/**
+ * Validate `session/new`-style params and normalize the optional
+ * `additionalDirectories` list. Entries must be absolute paths; they are
+ * lexically resolved, deduplicated, and the primary cwd itself is dropped
+ * (the schema treats the cwd as the first root — Zed never repeats it, but a
+ * hand-rolled client may).
+ */
+function normalizeSessionParams(params) {
   if (!isAbsolute(params.cwd)) throw invalidParams(`cwd must be an absolute path: ${params.cwd}`)
-  if (params.additionalDirectories !== undefined && params.additionalDirectories.length > 0) {
-    throw invalidParams('additionalDirectories is not supported')
+  const raw = params.additionalDirectories
+  if (raw === undefined || raw === null) return []
+  if (!Array.isArray(raw)) throw invalidParams('additionalDirectories must be an array of absolute paths')
+  const primary = resolve(params.cwd)
+  const seen = new Set()
+  const dirs = []
+  for (const entry of raw) {
+    if (typeof entry !== 'string' || !isAbsolute(entry)) {
+      throw invalidParams(`additionalDirectories entries must be absolute paths: ${String(entry)}`)
+    }
+    const dir = resolve(entry)
+    if (dir === primary || seen.has(dir)) continue
+    seen.add(dir)
+    dirs.push(dir)
   }
+  return dirs
+}
+
+/**
+ * System-prompt context for a multi-root session (empty for single-root).
+ * Reads are unrestricted by the file sandbox; writes follow the session
+ * policy, whose single writable root is the primary cwd (dsh-sandbox-policy
+ * resolves one `workspaceRoot` per session), so additional roots need
+ * escalation under workspace-write and are unrestricted under
+ * danger-full-access.
+ */
+function renderWorkspaceRoots(cwd, dirs) {
+  if (dirs.length === 0 || cwd === undefined) return ''
+  return [
+    `Multi-root workspace: relative paths resolve against the primary root ${JSON.stringify(cwd)}. The session also spans these additional workspace roots:`,
+    ...dirs.map((dir) => `- ${dir}`),
+    'File reads work in every root. File writes follow the sandbox policy: in workspace-write mode only the primary root (plus temp areas) is writable without approval, so a write under an additional root must obtain wider access first; in danger-full-access mode every root is writable.',
+  ].join('\n')
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-acp-enhanced",
-  "version": "0.3.2",
+  "version": "0.3.5",
   "description": "Enhanced ACP server for DeepSeek Harness: block-level streaming, usage/stat telemetry (cache hit rate, token speed, input/output tokens, context length, turns, tool timing), model & reasoning-effort switching, and permission-preset control over the ACP wire (Zed-friendly)",
   "keywords": [
     "dsh",