dsh-acp-enhanced 0.3.6 → 0.5.0

package/README-zh.md

@@ -16,6 +16,11 @@ ACP 线上。
   `agent_thought_chunk`），取消/重试不留半截输出
 - **完整遥测**：上下文用量环 + 缓存命中率 / TPS / 输入-输出-推理 token / 工具耗时 /
   轮次计数（`usage_update._meta` 携带全量明细）
+- **图片支持（多模态）**：当 dsh 组合挂载了附件存储（dsh 0.1.1-rc.2+，`dsh-base`
+  默认装配 `dsh-attachment-local`）时，会声明 `promptCapabilities.image` 并把粘贴/
+  上传的图片持久化进 harness 附件存储——支持视觉的模型（如 `deepseek-v4-flash-vision-exp`）
+  可按线序原生读取，图文交替不乱序。旧版栈（无附件存储）自动降级：不声明 image、
+  收到图片 prompt 明确报错。
 
 ### 模型与权限
 
@@ -26,13 +31,22 @@ ACP 线上。
   绝不出现空的 "unknown" 选择
 - **权限预设**：read-only / workspace-write / full-access 三种会话模式
 - **审批**：工具调用弹出原生 allow-once / reject-once 审批
+- **Agent 预设**：每个会话的模型侧组合（工具 + 提示词段）来自 dsh agent-presets
+  名册。`standard` 为完整编码 agent（默认），`minimal`（极简模式）只有裸 shell +
+  文件编辑器，**不含** subagent/web/todo/plan 等工具——极简 agent 不会泄漏任何
+  host 层工具；`code` 与 `cordis` 随 dsh CLI 附带，`~/.dsh/.agent-presets` 下你
+  自己的预设也会自动出现。通过 `agent_preset` 配置项、`/preset` 命令或
+  `DSH_ACP_PRESET` 环境变量（会话默认）选择；**仅空会话可切换**（还没跑过对话），
+  历史记录永远不会横跨两套工具面
 
 ### Zed 深度集成
 
 - **工具卡片**：折叠态即显示一行摘要——`Read <路径>`、shell 命令显示模型自己给出的意图描述
   （`description`，Codex 风格，展开可见完整命令）、`Search: <模式>`、
   `Fetch: <URL>` 等。卡片正文遵循 ACP 最佳实践：文件编辑渲染为真实 **diff 视图**、
-  shell 命令渲染为高亮代码块并在下方附输出、涉及文件以**可点击路径**呈现（点击直达）；
+  **bash/pwsh 命令渲染为真实终端卡片**（codex-acp 线格式：命令 + 输出 + 退出码
+   pill 都在终端面板里，告别 raw-JSON 卡片）、其他执行器渲染为高亮代码块并在下方
+  附输出、涉及文件以**可点击路径**呈现（点击直达）；
   `rawInput` / `rawOutput` 保留在展开区备查，按工具类型渲染图标，
   状态机为进行中 → 完成/失败
 - **Zed 文件与终端**：`zed_read_text_file` / `zed_write_text_file` / `zed_terminal` 把
@@ -52,9 +66,11 @@ ACP 线上。
 ### 命令
 
 - **Slash 命令**：输入 `/` 即可见命令列表（`available_commands_update`）：`/status`
-  查看路由与遥测、`/model` 列出或切换模型（列表以等宽代码块排版，一眼全见），其余
-  （`/compact` `/goal` `/permission` `/plan`…）直通 harness 命令注册表，全部**不经过
-  模型 turn** 即时执行；未解析的 slash 放行给模型（`/skill-name` 技能手势）
+  查看路由与遥测、`/model` 列出或切换模型、`/preset` 列出或切换 agent 预设
+  （列表以等宽代码块排版，一眼全见），其余（`/compact` `/goal` `/permission`
+  `/plan`…）直通 harness 命令注册表，全部**不经过模型 turn** 即时执行。所有
+  userInvocable 技能也会作为命令广播，`/ask-matt`、`/code-review`、`/tdd` 等能被
+  编辑器放行到达桥，技能正文按 dsh-tool-skill 的用户调用方式注入消息
 
 ### MCP
 
@@ -105,7 +121,8 @@ Zed 会用极简 PATH 拉起 agent，因此用随附启动器 `scripts/dsh-acp-z
       "args": ["/absolute/path/to/dsh-acp-enhanced/scripts/dsh-acp-zed.sh"],
       "env": {
         "DSH_ACP_PROVIDER": "deepseek-official",  // 官方 provider id
-        "DSH_ACP_MODEL": "deepseek-v4-flash"      // 官方模型 id
+        "DSH_ACP_MODEL": "deepseek-v4-flash",     // 官方模型 id
+        "DSH_ACP_PRESET": "standard"              // 可选：agent 预设 id（minimal / standard / code / cordis / 自定义）
       }
     }
   }
@@ -113,7 +130,8 @@ Zed 会用极简 PATH 拉起 agent，因此用随附启动器 `scripts/dsh-acp-z
 ```
 
 > 这两项 env 与包自带 patch 的缺省值一致，**省略也能工作**——显式写上只是让路由意图
-> 一目了然。API key 不必写进 Zed：存入 `~/.dsh/.credentials.yaml`
+> 一目了然。`DSH_ACP_PRESET` 在名册侧默认 `standard`；想让每个新会话从一开始就是
+> 某个特定模式就设置它。API key 不必写进 Zed：存入 `~/.dsh/.credentials.yaml`
 > （`DEEPSEEK_API_KEY`）由 dsh 凭据服务解析即可；启动脚本还会兜底继承正在运行的
 > `dsh web` 进程的 key。
 
@@ -124,6 +142,7 @@ Zed 会用极简 PATH 拉起 agent，因此用随附启动器 `scripts/dsh-acp-z
   // ...上面的 type/command/args/env...
   "default_config_options": {
     "model": "deepseek-official/deepseek-v4-flash",
+    "agent_preset": "standard",
     "plan_mode": false,
     "reasoning_effort": "high"
   },
@@ -211,11 +230,14 @@ node scripts/acp-client-tools.mjs     # 客户端工具测试（模拟 Zed 的 f
 node scripts/acp-mcp-test.mjs         # MCP 挂载测试（无模型调用）
 node scripts/acp-smoke-keyless.mjs    # keyless 冒烟（CI 用）
 node scripts/acp-resume-test.mjs      # 会话恢复测试
+node scripts/codec-image-test.mjs     # 图片编解码单元测试（无网络，假 store）
+node scripts/terminal-codec-test.mjs  # 终端卡片编解码单元测试（无网络）
+node scripts/acp-image-e2e.mjs        # 图片能力端到端（vision 模型段需 API key）
 ```
 
 ## 已知限制
 
-仅 baseline prompt（无图片/音频附件）、文本按块粒度流式、每会话同时一个 in-flight
+不支持音频附件（不声明 audio 能力）、文本按块粒度流式、每会话同时一个 in-flight
 prompt。MCP 支持 stdio 与 streamable HTTP（不声明 legacy SSE / `acp` 传输）。
 `session/close` / `session/fork` / `session/resume` 未实现（不声明能力，合规客户端
 不会调用）；`session/delete` 因 dsh 持久化无官方删除 API，采用直接删除后端目录的方式。
@@ -225,3 +247,13 @@ prompt。MCP 支持 stdio 与 streamable HTTP（不声明 legacy SSE / `acp` 传
 用；`workspace-write` 下对附加根的写入会先被拒绝、需升级/批准，`danger-full-access`
 下所有根均可写。真正的多根写支持需改 dsh 核心（`dsh-sandbox-policy` /
 `dsh-sandbox-local` 需要根列表而非单根）。
+
+Agent 预设接管了模型侧相关行：自带 `cordis.patch.yml` 会禁用 preset 拥有的 dsh-base
+行（tool-bash/fs/subagent/todo/web/…——与官方 dsh-web-app/tui 清单逐行一致，仅少
+`hmr`），并挂载 `agent-presets` 名册（默认 `standard`；`code`/`minimal`/`cordis`
+随 dsh CLI 附带，`~/.dsh/.agent-presets` 下的自定义预设目录自动收录）。bundle 自带
+patch 会自动装配（package.json `dsh.bundle.patch`）——**不要**把它复制进 profile
+的用户层 `cordis.patch.yml`，否则 loader 在启动时因重复 entry id 拒绝装配。**升级**
+一个已有自定义用户层 patch 的 profile 时，用户层只保留你自己的定制行（例如
+acp-enhanced 行的 `includeAllProviders: true`，同时 restate provider/model/preset——
+patch 条目是整体替换、不做合并）。升级前创建的会话恢复时会落到名册默认预设上。

package/README.md

@@ -18,6 +18,12 @@ over the ACP wire.
   torn output
 - **Full telemetry**: context usage ring plus cache hit rate / TPS / input-output-reasoning
   tokens / tool timing / turn counts (`usage_update._meta` carries the full breakdown)
+- **Image support (multimodal)**: when the dsh composition mounts an attachment store
+  (dsh 0.1.1-rc.2+ with `dsh-attachment-local`, the default in dsh-base), `promptCapabilities.image`
+  is advertised and pasted/uploaded images are ingested into the harness's durable attachment
+  store — a vision-capable model (e.g. `deepseek-v4-flash-vision-exp`) reads them natively,
+  in wire order with surrounding text. Older stacks (no attachment store) automatically
+  downgrade: image is not advertised and an image prompt is refused with a clear error.
 
 ### Model & permissions
 
@@ -28,6 +34,14 @@ over the ACP wire.
   its first offered effort — instead of an empty "unknown" selection
 - **Permission presets**: read-only / workspace-write / full-access session modes
 - **Approval**: native allow-once / reject-once prompts per tool call
+- **Agent presets**: per-session model-facing composition (tools + prompt sections)
+  from the dsh agent-presets roster. `standard` is the full coding agent (default),
+  `minimal` (极简模式) is a bare shell + files editor with **no** subagent/web/todo/plan
+  tools — nothing from the host layer leaks into a minimal agent; `code` and `cordis`
+  ship alongside, and your own presets under `~/.dsh/.agent-presets` appear too.
+  Choose via the `agent_preset` config option, the `/preset` command, or the
+  `DSH_ACP_PRESET` env var (per-session default); switching is only allowed while the
+  session is still blank (no turn has run), so history never straddles two tool sets.
 
 ### Zed deep integration
 
@@ -35,10 +49,12 @@ over the ACP wire.
   model's own intent line for shell commands (`description`, Codex-style — the
   exact command stays one click away), `Search: <pattern>`, `Fetch: <url>`, etc.
   The card body follows the ACP best practice: file edits render as a real
-  **diff**, shell commands as a syntax-highlighted code block with the output
-  beneath, and touched files as **clickable locations** that open the file —
-  with `rawInput` / `rawOutput` kept one click away for transparency, plus
-  per-kind icons and a proper in-progress → completed/failed status lifecycle
+  **diff**, **bash/pwsh commands as a real terminal card** (codex-acp wire
+  shape: command line + output + exit pill inside a terminal panel — no more
+  raw-JSON cards), other executors as a syntax-highlighted code block, and
+  touched files as **clickable locations** that open the file — with `rawInput`
+  / `rawOutput` kept one click away for transparency, plus per-kind icons and a
+  proper in-progress → completed/failed status lifecycle
 - **Zed files & terminal**: `zed_read_text_file` / `zed_write_text_file` / `zed_terminal`
   put file edits into Zed's "edited files" area (diff + accept/reject) and commands into a
   real Zed terminal
@@ -60,11 +76,13 @@ over the ACP wire.
 ### Commands
 
 - **Slash commands**: typing `/` reveals the command list (`available_commands_update`):
-  `/status` shows the route and telemetry, `/model` lists or switches the model (listings
-  render as monospace code blocks — readable at a glance), everything
-  else (`/compact` `/goal` `/permission` `/plan`…) runs straight through the harness
-  command registry — all executed **without a model turn**; unresolved slashes fall
-  through to the model (the `/skill-name` skill gesture)
+  `/status` shows the route and telemetry, `/model` lists or switches the model, `/preset`
+  lists or switches the agent preset (listings render as monospace code blocks — readable
+  at a glance), everything else (`/compact` `/goal` `/permission` `/plan`…) runs straight
+  through the harness command registry — all executed **without a model turn**. Every
+  user-invocable skill is advertised as a command too, so `/ask-matt`, `/code-review`,
+  `/tdd`, … reach the bridge instead of being rejected by the editor, and the skill's
+  instructions are injected into the message (dsh-tool-skill-style user invocation)
 
 ### MCP
 
@@ -118,7 +136,8 @@ Zed spawns agents with a minimal PATH, so use the shipped launcher
       "args": ["/absolute/path/to/dsh-acp-enhanced/scripts/dsh-acp-zed.sh"],
       "env": {
         "DSH_ACP_PROVIDER": "deepseek-official",  // the official provider id
-        "DSH_ACP_MODEL": "deepseek-v4-flash"      // the official model id
+        "DSH_ACP_MODEL": "deepseek-v4-flash",     // the official model id
+        "DSH_ACP_PRESET": "standard"              // optional: agent preset id (minimal / standard / code / cordis / yours)
       }
     }
   }
@@ -126,7 +145,9 @@ Zed spawns agents with a minimal PATH, so use the shipped launcher
 ```
 
 > Both env vars match the shipped patch's defaults, so **they can be omitted entirely** —
-> writing them out just makes the route explicit. The API key does not have to live in Zed:
+> writing them out just makes the route explicit. `DSH_ACP_PRESET` defaults to `standard`
+> on the roster side; set it when you want every new session to start in a specific mode.
+> The API key does not have to live in Zed:
 > store it in `~/.dsh/.credentials.yaml` (`DEEPSEEK_API_KEY`) and the dsh credentials
 > service resolves it; the launcher also falls back to a running `dsh web` process's key.
 
@@ -137,6 +158,7 @@ Optional: pin the panel's default config options (all still changeable in the pa
   // ...the type/command/args/env above...
   "default_config_options": {
     "model": "deepseek-official/deepseek-v4-flash",
+    "agent_preset": "standard",
     "plan_mode": false,
     "reasoning_effort": "high"
   },
@@ -229,13 +251,16 @@ node scripts/acp-client-tools.mjs     # client-tool tests (mocks Zed fs/terminal
 node scripts/acp-mcp-test.mjs         # MCP mount test (no model calls)
 node scripts/acp-smoke-keyless.mjs    # keyless boot smoke (CI)
 node scripts/acp-resume-test.mjs      # session resume test
+node scripts/codec-image-test.mjs     # image-codec unit tests (no network, fake store)
+node scripts/terminal-codec-test.mjs  # terminal-card codec unit tests (no network)
+node scripts/acp-image-e2e.mjs        # image capability e2e (vision-model leg needs an API key)
 ```
 
 ## Known limitations
 
-Baseline prompts only (no image/audio attachments), text streams at block granularity,
-one in-flight prompt per session. MCP supports stdio and streamable HTTP (legacy SSE /
-`acp` transports are not advertised).
+Audio attachments are not supported (audio capability is not advertised), text streams at
+block granularity, one in-flight prompt per session. MCP supports stdio and streamable HTTP
+(legacy SSE / `acp` transports are not advertised).
 `session/close` / `session/fork` / `session/resume` are not implemented (capabilities
 undeclared, compliant clients will not call them); `session/delete` removes the
 persisted directory directly because dsh persistence has no official delete API.
@@ -247,3 +272,16 @@ work in every root; under `workspace-write` a write under an additional root is
 first and needs escalation/approval, while `danger-full-access` writes everywhere.
 True multi-root write enforcement belongs in dsh core (`dsh-sandbox-policy` /
 `dsh-sandbox-local` would need a root list instead of a single root).
+
+Agent presets take over the model-facing rows: the shipped `cordis.patch.yml` disables
+the dsh-base rows a preset owns (tool-bash/fs/subagent/todo/web/… — exactly the official
+dsh-web-app/tui list minus `hmr`) and mounts the `agent-presets` roster (`standard`
+default; `code`/`minimal`/`cordis` ship with the dsh CLI, your own preset dirs under
+`~/.dsh/.agent-presets` are picked up automatically). The bundle's own patch applies
+automatically (package.json `dsh.bundle.patch`) — do **not** copy it into the profile's
+user-layer `cordis.patch.yml`, or the loader rejects the duplicate entry ids at boot.
+When **upgrading** a profile that already carries a customized user-layer patch, keep
+only your custom row configs there (e.g. `includeAllProviders: true` on the
+acp-enhanced row, restating provider/model/preset since patch entries replace whole
+rows, they do not merge). A session created before the upgrade resumes under the
+roster's default preset.

package/cordis.patch.yml

@@ -11,18 +11,123 @@
 # agent_servers env, or export before `dsh --profile <name>`):
 #   DSH_ACP_PROVIDER  provider id, e.g. deepseek-official or your gateway id
 #   DSH_ACP_MODEL     model id, e.g. deepseek-v4-flash
-# Both default to the DeepSeek official route. Overriding `agent-default-model`
-# keeps the bridge's per-session selection fallback on the same route (before
-# any request header exists), so the first prompt never falls back to a
-# non-routable default.
+#   DSH_ACP_PRESET    agent preset id, e.g. minimal / standard / code / cordis
+# Both route values default to the DeepSeek official route. Overriding
+# `agent-default-model` keeps the bridge's per-session selection fallback on
+# the same route (before any request header exists), so the first prompt never
+# falls back to a non-routable default.
 - id: agent-default-model
   config:
     provider: !!js "process.env.DSH_ACP_PROVIDER ?? 'deepseek-official'"
     model: !!js "process.env.DSH_ACP_MODEL ?? 'deepseek-v4-flash'"
 
+# ── agent presets ───────────────────────────────────────────────────────────
+#
+# The model-facing plugin set moves INTO the dsh agent-presets roster: every
+# session composes its tools/prompt sections from one preset directory
+# (standard/code/minimal/cordis, plus user-authored presets in
+# ~/.dsh/.agent-presets). The dsh CLI's profile-boot overlays the shipped
+# `config/agent-presets/` root onto the `agent-presets` row automatically, and
+# the roster itself appends the user root (`includeUserRoot` default).
+#
+# The bridge composes each session from this roster through
+# `presets.mount()` (inside the agent factory's `setup`) and exposes the choice
+# on the ACP wire as the `agent_preset` config option + `/preset` command.
+#
+# Every dsh-base model-facing row a preset now owns is disabled here, so a
+# `minimal` (极简模式) agent does not leak host-layer tools — an agent's tool
+# registry view resolves agent → preset → global. This mirrors the official
+# dsh-web-app / dsh-tui patch exactly (minus `hmr`, which is web-app-specific).
+- id: agent-instructions
+  disabled: true
+
+- id: command-compact
+  disabled: true
+
+- id: compaction-basic
+  disabled: true
+
+- id: plan-mode
+  disabled: true
+
+- id: skill-filesystem
+  disabled: true
+
+- id: tool-bash
+  disabled: true
+
+- id: tool-fs
+  disabled: true
+
+- id: tool-fs-search
+  disabled: true
+
+- id: tool-goal
+  disabled: true
+
+- id: tool-jobs
+  disabled: true
+
+- id: tool-pwsh
+  disabled: true
+
+- id: tool-ralph
+  disabled: true
+
+- id: tool-result-pruner
+  disabled: true
+
+- id: tool-skill
+  disabled: true
+
+- id: tool-str-replace-editor
+  disabled: true
+
+- id: tool-subagent
+  disabled: true
+
+- id: tool-subagent-control
+  disabled: true
+
+- id: tool-subagent-fork
+  disabled: true
+
+- id: tool-subagent-list-agents
+  disabled: true
+
+- id: tool-todo
+  disabled: true
+
+- id: tool-web
+  disabled: true
+
+- id: tool-workflow
+  disabled: true
+
+- id: workflow-worker-thread
+  disabled: true
+
 - insert:
+    # The agent-preset roster: `ctx.agentPresets`, the service the bridge
+    # composes every session's model-facing world from. No `roots` here — the
+    # dsh CLI's profile-boot overlays its shipped `config/agent-presets/`
+    # directory (standard/code/minimal/cordis, system trust) onto this row
+    # whenever a composition carries it, and the roster appends the
+    # user-authored `$DSH_HOME/.agent-presets` root.
+    - id: agent-presets
+      name: '@deepseek-ai/dsh-agent-presets'
+      config:
+        default: !!js "process.env.DSH_ACP_PRESET ?? 'standard'"
+
+    # Host-plane services the `cordis` preset's plugin-experimentation tool
+    # waits on (dynamicCordisRunner/cordisInspect); dsh-base carries no such
+    # row — the official web app and dsh-tui insert it the same way.
+    - id: cordis-host-runner
+      name: '@deepseek-ai/dsh-cordis-host-runner'
+
     - id: acp-enhanced
       name: 'dsh-acp-enhanced'
       config:
         provider: !!js "process.env.DSH_ACP_PROVIDER ?? 'deepseek-official'"
         model: !!js "process.env.DSH_ACP_MODEL ?? 'deepseek-v4-flash'"
+        preset: !!js "process.env.DSH_ACP_PRESET"

package/lib/codec.js

@@ -57,6 +57,191 @@ export function promptHasUnsupportedContent(prompt) {
   return prompt.some((block) => block.type !== 'text' && block.type !== 'resource_link')
 }
 
+/** Raster media types the harness attachment seam admits (dsh-attachment). */
+const IMAGE_MEDIA_TYPES = new Set(['image/png', 'image/jpeg', 'image/webp', 'image/gif'])
+
+/**
+ * Canonicalize an ACP image MIME type for the harness attachment store.
+ * @param mimeType - the client-declared type (may be `image/jpg`, which
+ *   the raster vocabulary spells `image/jpeg`).
+ * @returns the harness media type, or `undefined` when the value is not a
+ *   raster we ingest.
+ */
+export function canonicalImageMediaType(mimeType) {
+  const lower = String(mimeType ?? '').trim().toLowerCase()
+  const mapped = lower === 'image/jpg' ? 'image/jpeg' : lower
+  return IMAGE_MEDIA_TYPES.has(mapped) ? mapped : undefined
+}
+
+/** Error for prompt content this adapter does not advertise. */
+export class UnsupportedPromptContentError extends Error {
+  constructor(contentType) {
+    super(`unsupported prompt content type: ${contentType}`)
+    this.name = 'UnsupportedPromptContentError'
+  }
+}
+
+/** Error when an advertised image cannot be ingested (limits, decode, store). */
+export class PromptImageError extends Error {
+  constructor(message, options) {
+    super(message, options)
+    this.name = 'PromptImageError'
+  }
+}
+
+/**
+ * Narrow an unknown `ctx.attachments` value to the ingest surface used by
+ * {@link convertPrompt}. Capability detection instead of version detection:
+ * the service exists (with methods) on dsh 0.1.1-rc.2+, while the 0.1.0-rc.x
+ * seam is an empty shell without `validateImage`/`saveImage` — and a
+ * deployment without the attachment-local row has no service at all. All
+ * three fall back to `undefined` here, so the caller simply does not
+ * advertise image support.
+ * @param value - `ctx.get('attachments')` (or anything shaped like it).
+ * @returns the ingest surface, or `undefined` when absent/empty.
+ */
+export function attachmentIngestOf(value) {
+  if (value === null || typeof value !== 'object') return undefined
+  const candidate = value
+  if (typeof candidate.validateImage !== 'function' || typeof candidate.saveImage !== 'function') {
+    return undefined
+  }
+  const limits = candidate.imageLimits
+  if (limits === undefined
+    || typeof limits.maxImagesPerMessage !== 'number'
+    || typeof limits.maxMessageImageBytes !== 'number'
+    || typeof limits.maxImageBytes !== 'number') {
+    return undefined
+  }
+  return candidate
+}
+
+function decodeImageData(data) {
+  if (typeof data !== 'string' || data.length === 0) throw new PromptImageError('image data is empty')
+  const decoded = Buffer.from(data, 'base64')
+  if (decoded.byteLength === 0) throw new PromptImageError('image data is empty')
+  return new Uint8Array(decoded)
+}
+
+/** Display name from an image URI's leaf, with local path info stripped. */
+function imageName(uri) {
+  if (typeof uri !== 'string' || uri.length === 0) return undefined
+  let leaf
+  try {
+    leaf = new URL(uri).pathname.split('/').filter(Boolean).at(-1)
+  } catch {
+    leaf = uri.split(/[/\\]/).filter(Boolean).at(-1)
+  }
+  if (leaf === undefined || leaf.length === 0) return undefined
+  try {
+    return decodeURIComponent(leaf)
+  } catch {
+    return leaf
+  }
+}
+
+/** Flush accumulated text into the block list (keeps 图文交替 wire order). */
+function flushText(parts, blocks) {
+  const text = parts.join('')
+  parts.length = 0
+  if (text.length > 0) blocks.push({ type: 'text', text })
+}
+
+/**
+ * Convert an ACP prompt's content blocks into harness user-message content
+ * blocks. Text and resource links concatenate in wire order; when the
+ * composition provides an attachment ingest, ACP `image` blocks are decoded,
+ * admission-checked against the store limits, and durably committed with
+ * `saveImage`, keeping block order with surrounding text. Binary `resource`
+ * payloads and audio stay rejected — silently dropping them would be worse
+ * than refusing.
+ * @param prompt - ACP `session/prompt` content, in wire order.
+ * @param attachments - `ctx.attachments` ingest when the composition mounted
+ *   one; omit (or pass `undefined`) to refuse images.
+ * @returns `{ blocks, displayText }` ready for `createUserMessage` plus a
+ *   human-readable text rendering (used for titles, transcripts, commands).
+ * @throws UnsupportedPromptContentError for audio/binary blocks, or images
+ *   with no ingest; PromptImageError when advertised image bytes fail
+ *   admission.
+ */
+export async function convertPrompt(prompt, attachments) {
+  const preparedImages = []
+  for (const block of prompt) {
+    if (block?.type !== 'image') continue
+    if (attachments === undefined) throw new UnsupportedPromptContentError('image')
+    const mediaType = canonicalImageMediaType(block.mimeType)
+    if (mediaType === undefined) throw new PromptImageError(`unsupported image media type: ${block.mimeType}`)
+    const data = decodeImageData(block.data)
+    preparedImages.push({
+      data,
+      mediaType,
+      ...imageName(block.uri) === undefined ? {} : { name: imageName(block.uri) },
+    })
+  }
+
+  if (preparedImages.length > 0) {
+    const { maxImagesPerMessage, maxMessageImageBytes, maxImageBytes } = attachments.imageLimits
+    if (preparedImages.length > maxImagesPerMessage) {
+      throw new PromptImageError('prompt exceeds the configured image-count limit')
+    }
+    const totalBytes = preparedImages.reduce((sum, image) => sum + image.data.byteLength, 0)
+    if (totalBytes > maxMessageImageBytes) {
+      throw new PromptImageError('prompt exceeds the configured aggregate image-byte limit')
+    }
+    for (const image of preparedImages) {
+      if (image.data.byteLength > maxImageBytes) {
+        throw new PromptImageError('image exceeds the configured encoded-byte limit')
+      }
+      try {
+        await attachments.validateImage({ data: image.data, mediaType: image.mediaType, ...image.name === undefined ? {} : { name: image.name } })
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error)
+        throw new PromptImageError(`image validation failed: ${message}`, { cause: error })
+      }
+    }
+  }
+
+  const parts = []
+  const display = []
+  const blocks = []
+  let imageIndex = 0
+  for (const block of prompt) {
+    switch (block?.type) {
+      case 'text':
+        parts.push(block.text)
+        display.push(block.text)
+        break
+      case 'resource_link':
+        // Mirror the baseline bridge's textual reference so plain clients
+        // keep file mentions without the bridge dropping them.
+        parts.push(`\n[resource_link name=${JSON.stringify(block.name)} uri=${JSON.stringify(block.uri)}]\n`)
+        display.push(`@${block.name}`)
+        break
+      case 'image': {
+        if (attachments === undefined) throw new UnsupportedPromptContentError('image')
+        const prepared = preparedImages[imageIndex]
+        imageIndex += 1
+        if (prepared === undefined) throw new PromptImageError('image block was not prepared')
+        flushText(parts, blocks)
+        let attachment
+        try {
+          attachment = await attachments.saveImage(prepared)
+        } catch (error) {
+          const message = error instanceof Error ? error.message : String(error)
+          throw new PromptImageError(message, { cause: error })
+        }
+        blocks.push({ type: 'image', attachment })
+        display.push(`[image${prepared.name === undefined ? '' : `: ${prepared.name}`}]`)
+        break
+      }
+      default:
+        throw new UnsupportedPromptContentError(block?.type ?? 'unknown')
+    }
+  }
+  flushText(parts, blocks)
+  return { blocks, displayText: display.join(' ').trim() }
+}
+
 /** Kramdown attribute-style inline markup (SiYuan exports), including
  *  truncation-damaged tails — titles are byte-budgeted upstream, so a cut
  *  can land mid-attribute (unterminated `"` or no closing `]`):

package/lib/index.js

@@ -45,9 +45,12 @@ import Schema from '@deepseek-ai/schemastery'
 import { AgentSideConnection, ndJsonStream, PROTOCOL_VERSION, RequestError } from '@agentclientprotocol/sdk'
 import { createUserMessage, errorChain, ReasoningEffortId } from '@deepseek-ai/dsh-llm'
 import { installModelSelection } from '@deepseek-ai/dsh-agent'
+import { resolveSessionPreset, UnknownPresetError, PresetMountError } from '@deepseek-ai/dsh-agent-presets'
+import { renderSkillContent } from '@deepseek-ai/dsh-skill'
 import { defineTool } from '@deepseek-ai/dsh-tools'
 import { SessionId } from '@deepseek-ai/dsh-session'
-import { acpPromptToText, promptHasUnsupportedContent, sanitizeWireTitle, turnEndToStopReason, usageTelemetry } from './codec.js'
+import { attachmentIngestOf, convertPrompt, PromptImageError, sanitizeWireTitle, turnEndToStopReason, UnsupportedPromptContentError, usageTelemetry } from './codec.js'
+import { isTerminalToolName, parseShellExitStatus, resultText, shellCallCwd, stripShellPrefix, toolKindFor } from './terminal-codec.js'
 
 /** Agent version advertised on the ACP wire — read from package.json so the
  *  handshake can never drift from the released package version. */
@@ -104,7 +107,7 @@ function rememberEffort(provider, model, effort) {
 
 export const name = 'acp-enhanced'
 /** The bridge creates and owns agents; every other concern is carried by the composition. */
-export const inject = ['agents', 'llm', 'approval', 'tools', 'commands', 'systemPrompt']
+export const inject = ['agents', 'llm', 'approval', 'tools', 'commands', 'skills', 'systemPrompt']
 
 export const Config = Schema.object({
   /** Initial provider route for every created agent. */
@@ -118,6 +121,11 @@ export const Config = Schema.object({
    *  but fail to dispatch with a MISSING_CREDENTIAL error. Set true to list
    *  every served provider's models regardless. */
   includeAllProviders: Schema.boolean().default(false),
+  /** Initial agent preset every created agent is composed from, when an
+   *  `agent-presets` roster is mounted. Absent adopts the roster's own
+   *  default. The `DSH_ACP_PRESET` environment variable overrides this value
+   *  when set. */
+  preset: Schema.string().default(undefined),
 })
 
 /** Preserve invalid-parameter detail in the SDK wire error message. */
@@ -130,27 +138,6 @@ function internalError(detail) {
   return RequestError.internalError(undefined, detail)
 }
 
-/**
- * Map a dsh tool name to the ACP ToolKind used for icons and card UX.
- *
- * Kind and content must agree: Zed treats kind == 'execute' as a terminal tool
- * and kind == 'edit' as a diff tool, and for both it HIDES the rawInput
- * section. `zed_terminal` is genuinely terminal; write/edit tools map to
- * 'edit' only because the bridge always pairs them with a `diff` content
- * block (see toolCallContentFor) — the diff replaces the raw dump as the card
- * body. Local executors like bash/run_code stay 'other' and carry the command
- * as a markdown code block, keeping the raw sections available too.
- */
-function toolKindFor(name) {
-  if (name === 'zed_terminal') return 'execute'
-  if (/^fs_.*read|read_text|cat|show/.test(name)) return 'read'
-  if (/search|find|grep/.test(name)) return 'search'
-  if (/fetch|http/.test(name)) return 'fetch'
-  if (/think/.test(name)) return 'think'
-  if (/write|edit|patch|apply/.test(name)) return 'edit'
-  return 'other'
-}
-
 /** Parse a tool's raw arguments JSON into a JSON value for ACP rawInput. */
 function parseToolArguments(raw) {
   try {
@@ -410,6 +397,7 @@ export function apply(ctx, config) {
   const approval = ctx.approval
   const tools = ctx.tools
   const commands = ctx.commands
+  const skills = ctx.skills
   const logger = ctx.logger
   /** The user-questions service (mounted by dsh-base); absent in minimal deployments. */
   const userQuestions = ctx.get('userQuestions')
@@ -426,6 +414,82 @@ export function apply(ctx, config) {
   /** Resolve the permission-presets service, tolerating a lazy mount. */
   const permissionPresets = () => ctx.get('permissionPresets')
 
+  /**
+   * The terminal-output meta dialect the connected client renders, exactly as
+   * codex-acp resolves it: Zed declares `_meta.terminal_output` support on
+   * initialize; older clients stream via `terminal_output_delta`.
+   */
+  const terminalOutputMode = () => clientCaps._meta?.['terminal_output'] === true
+    ? 'terminal_output'
+    : 'terminal_output_delta'
+
+  /** Resolve the agent-presets roster, tolerating its absence (a profile that
+   *  mounts no roster composes every session from the host layer). */
+  const agentPresets = () => ctx.get('agentPresets')
+
+  /**
+   * Resolve one service the way a joined agent sees it: through its preset
+   * scope chain when a roster is mounted (preset `isolate` realms hide e.g.
+   * `planMode`/`compaction` from the root context), falling back to the host
+   * context otherwise. Mirrors dsh-tui's `serviceForAgent`.
+   */
+  const serviceForAgent = (agent, key) => {
+    const scoped = agentPresets()?.serviceFor?.(agent, key)
+    if (scoped !== undefined) return scoped
+    return ctx.get(key)
+  }
+
+  /** The preset a session actually runs, read from its log: the last
+   *  `agent-preset/selected` event wins over the creation header. */
+  const runningPresetOf = (session) => resolveSessionPreset(session)
+
+  /** Whether one live session has produced anything yet. A preset swap is only
+   *  legal while it is blank (dsh-agent-presets product rule): swapping tools
+   *  mid-conversation would strand logged tool calls the new composition cannot
+   *  make. */
+  const isBlankSession = (session) => !session.events.some((event) => event.type === 'turn/start')
+
+  /**
+   * Resolve the preset a new/resumed session will run under, and the setup hook
+   * that installs it inside the agent factory's `setup(agentCtx)`.
+   *
+   * Mirrors dsh-tui / dsh-host-apiproxy `composeAgent`: the id is resolved
+   * BEFORE `agents.create` because the session boundary snapshots `meta` before
+   * asynchronous setup begins, while the mount itself must run in `setup` so a
+   * composition failure rolls the whole creation back. A deployment without a
+   * roster returns an empty composition — every session then shares the host
+   * composition (the pre-preset behavior).
+   *
+   * @param requested - preset id, or undefined for the roster default.
+   * @returns `{ agentPreset, setup }`, or `{}` without a roster.
+   * @throws UnknownPresetError / PresetMountError (mapped by callers).
+   */
+  async function composePreset(requested) {
+    const presets = agentPresets()
+    if (presets === undefined) return {}
+    const resolvedId = (await presets.resolveMountable(requested)).id
+    return {
+      agentPreset: resolvedId,
+      setup: async (agentCtx) => {
+        await presets.mount(agentCtx, resolvedId)
+      },
+    }
+  }
+
+  /** The preset a persisted session runs, or undefined when unrecorded. */
+  async function persistedPresetOf(sessionId) {
+    const persistence = ctx.get('sessionPersistence')
+    if (persistence === undefined) return undefined
+    try {
+      const { meta, events } = await persistence.load(sessionId)
+      return resolveSessionPreset({ header: meta, events })
+    } catch {
+      // A missing/corrupt artifact leaves resume itself to report the failure;
+      // the preset lookup must not mask it with a second, misleading error.
+      return undefined
+    }
+  }
+
   // Multi-root workspaces: describe the session's roots to the model. Zed
   // passes the primary cwd plus every additional workspace root on the
   // session lifecycle requests; the sandbox policy still resolves a single
@@ -486,6 +550,35 @@ export function apply(ctx, config) {
    */
   function toolCallUpdateFor(record, event) {
     const parsedArgs = parseToolArguments(event.data.arguments)
+    if (isTerminalToolName(event.data.name)) {
+      // codex-acp terminal-card shape: kind 'execute' plus a terminal content
+      // block and terminal_info meta, so Zed renders the command and output in
+      // a terminal panel instead of a raw-JSON card. rawInput keeps the exact
+      // command + resolved cwd for transparency.
+      const command = typeof parsedArgs === 'object' && parsedArgs !== null && typeof parsedArgs.command === 'string'
+        ? parsedArgs.command
+        : typeof event.data.arguments === 'string' ? event.data.arguments : event.data.name
+      const cwd = shellCallCwd(parsedArgs, record.agent.session)
+      if (record.callArgs.size >= 64) record.callArgs.delete(record.callArgs.keys().next().value)
+      record.callArgs.set(event.data.callId, { name: event.data.name, parsedArgs })
+      return {
+        sessionUpdate: 'tool_call',
+        toolCallId: event.data.callId,
+        name: event.data.name,
+        title: stripShellPrefix(command) || event.data.name,
+        kind: 'execute',
+        status: 'in_progress',
+        content: [{ type: 'terminal', terminalId: event.data.callId }],
+        rawInput: { command, cwd },
+        _meta: {
+          turn: event.data.turn,
+          step: event.data.step,
+          name: event.data.name,
+          argumentsPreview: event.data.arguments.slice(0, 200),
+          terminal_info: { cwd, terminal_id: event.data.callId },
+        },
+      }
+    }
     const kind = toolKindFor(event.data.name)
     const content = toolCallContentFor(event.data.name, parsedArgs, kind)
     const locations = toolCallLocationsFor(kind, parsedArgs)
@@ -516,10 +609,48 @@ export function apply(ctx, config) {
   /** Wire update for a harness `tool/result`: terminal status plus, for
    *  executors, the output as a friendly code block under the command. */
   function toolResultUpdateFor(record, event, callId, elapsed) {
-    const preview = resultPreview(event)
     const call = record.callArgs.get(callId)
     record.callArgs.delete(callId)
     const isError = event.data.error !== undefined
+    if (call !== undefined && isTerminalToolName(call.name)) {
+      // Close the terminal panel from the codex-acp terminal-card shape opened
+      // by toolCallUpdateFor: stream the rendered output (minus the exit
+      // marker the shell tool appends) via terminal_output(_delta) and finish
+      // with terminal_exit, while rawOutput keeps the structured
+      // { formatted_output, exit_code } shape. A failed call carries no
+      // formatted body (the real exit code lives inside the text marker the
+      // error path does not produce), so the panel closes status-failed bare.
+      const parsed = isError ? undefined : parseShellExitStatus(resultText(event) ?? '')
+      const body = parsed?.body ?? ''
+      const meta = {
+        terminal_exit: {
+          exit_code: parsed?.exitCode ?? 0,
+          signal: parsed?.signal ?? null,
+          terminal_id: callId,
+        },
+      }
+      if (body.length > 0) {
+        Object.assign(meta, terminalOutputMode() === 'terminal_output'
+          ? { terminal_output: { data: body, terminal_id: callId } }
+          : { terminal_output_delta: { data: body, terminal_id: callId } })
+      }
+      return {
+        sessionUpdate: 'tool_call_update',
+        toolCallId: callId,
+        name: call.name,
+        status: isError ? 'failed' : 'completed',
+        ...(!isError && body.length > 0) ? { rawOutput: { formatted_output: body, exit_code: parsed.exitCode } } : {},
+        _meta: {
+          turn: event.data.turn,
+          step: event.data.step,
+          elapsedMs: elapsed,
+          count: record.toolStats.count,
+          totalMs: record.toolStats.totalMs,
+          ...meta,
+        },
+      }
+    }
+    const preview = resultPreview(event)
     let content
     if (!isError && preview !== undefined && call !== undefined
       && call.name !== 'zed_terminal' && EXECUTOR_NAME.test(call.name)) {
@@ -560,6 +691,21 @@ export function apply(ctx, config) {
           // Final accounting when the adapter reported usage on the message
           // rather than as a stream chunk.
           if (event.data.usage !== undefined) emitUsage(record, event.data.usage, event)
+          // Model-produced image blocks never stream through the text chunk
+          // path; surface them as a wire placeholder so the reply is not
+          // silently missing a block (ACP clients render the text).
+          for (const block of event.data.message?.content ?? []) {
+            if (block?.type === 'image' && block.attachment?.attachmentId !== undefined) {
+              notify({
+                sessionId: session.header.id,
+                update: {
+                  sessionUpdate: 'agent_message_chunk',
+                  messageId: record.messageId,
+                  content: { type: 'text', text: `[image attachment ${block.attachment.attachmentId}]` },
+                },
+              })
+            }
+          }
           break
         case 'turn/start': {
           record.turnCount += 1
@@ -939,7 +1085,27 @@ export function apply(ctx, config) {
         }),
       })
     }
-    const planMode = ctx.get('planMode')
+    const presets = agentPresets()
+    if (presets !== undefined) {
+      // Broken presets must not be offered: mounting one always fails.
+      const mountable = (await presets.list()).filter((preset) => preset.broken === undefined)
+      if (mountable.length > 0) {
+        options.push({
+          id: 'agent_preset',
+          type: 'select',
+          name: 'Agent preset',
+          description: 'Model-facing tool/prompt composition for this session (switch only while blank).',
+          category: 'model_config',
+          currentValue: runningPresetOf(record.agent.session) ?? '',
+          options: mountable.map((preset) => ({
+            value: preset.id,
+            name: preset.name ?? preset.id,
+            ...preset.description === undefined ? {} : { description: preset.description },
+          })),
+        })
+      }
+    }
+    const planMode = serviceForAgent(record.agent, 'planMode')
     if (planMode !== undefined) {
       options.push({
         id: 'plan_mode',
@@ -1396,6 +1562,7 @@ export function apply(ctx, config) {
   const BUILTIN_COMMANDS = [
     { name: 'status', description: 'Show session status: model route, context usage, telemetry.' },
     { name: 'model', description: 'List the model catalog, or switch with /model <provider/model | substring>.' },
+    { name: 'preset', description: 'List agent presets, or switch with /preset <id> (blank session only).' },
   ]
 
   /**
@@ -1419,6 +1586,21 @@ export function apply(ctx, config) {
     } catch (error) {
       logger.warn(`acp-enhanced: command listing failed: ${String(error)}`)
     }
+    // User-invocable skills (e.g. /ask-matt) must be advertised as commands or
+    // the Zed client rejects the slash before it reaches the bridge (its
+    // available_skills only covers native agents, and it validates ACP
+    // connections against available_commands locally).
+    try {
+      const summaries = await skills.list({ scope: record.agent, cwd: record.agent.session.header.cwd })
+      for (const skill of summaries) {
+        if (!skill.invocation?.userInvocable) continue
+        if (seen.has(skill.name)) continue
+        seen.add(skill.name)
+        list.push({ name: skill.name, description: `Run the ${skill.name} skill` })
+      }
+    } catch (error) {
+      logger.warn(`acp-enhanced: skill command listing failed: ${String(error)}`)
+    }
     notify({
       sessionId: record.agent.session.id,
       update: { sessionUpdate: 'available_commands_update', availableCommands: list },
@@ -1446,6 +1628,7 @@ export function apply(ctx, config) {
     const last = record.lastUsage
     const lines = [
       `route      ${selection.provider ?? '?'}/${selection.model ?? '?'}`,
+      `preset     ${runningPresetOf(record.agent.session) ?? 'host'}`,
       `turns      ${record.turnCount}`,
       ...last === undefined ? [] : [
         `context    ${last.used}/${last.size}`,
@@ -1477,6 +1660,45 @@ export function apply(ctx, config) {
     return `switched to ${matches[0].provider}/${matches[0].model}`
   }
 
+  /** The /preset command: list the roster or switch by exact id/substring. */
+  async function presetCommandText(record, query) {
+    const presets = agentPresets()
+    if (presets === undefined) return 'no agent-presets roster is mounted in this profile'
+    const roster = (await presets.list()).filter((preset) => preset.broken === undefined)
+    const current = runningPresetOf(record.agent.session)
+    if (query.trim().length === 0) {
+      const lines = roster.map((preset) => {
+        const mark = preset.id === current ? '* ' : '  '
+        return `${mark}${preset.id}${preset.name !== undefined ? ` — ${preset.name}` : ''}`
+      })
+      return lines.length > 0 ? ['```', ...lines, '```'].join('\n') : 'no agent presets available'
+    }
+    const needle = query.trim().toLowerCase()
+    const matches = roster.filter((preset) => (
+      preset.id.toLowerCase().includes(needle) || preset.name?.toLowerCase().includes(needle)
+    ))
+    if (matches.length === 0) return `no agent preset matches "${query}"`
+    if (matches.length > 1) return `ambiguous: ${matches.map((preset) => preset.id).join(', ')}`
+    const target = matches[0]
+    if (target.id === current) return `already on agent preset ${target.id}`
+    if (!isBlankSession(record.agent.session)) {
+      return `cannot switch agent preset on a non-blank session (current: ${current ?? 'host'})`
+    }
+    let preset
+    try {
+      preset = await presets.recompose(record.agent.ctx, target.id)
+    } catch (error) {
+      // A listed preset can still fail to mount (a missing service in this
+      // deployment); report it as a command failure, not a wire crash.
+      const detail = error instanceof Error ? error.message : String(error)
+      return `⚠ /preset failed: ${detail}`
+    }
+    // The switch is a logged session fact (model-visible ⟺ logged), so a
+    // resume re-resolves the NEW composition.
+    record.agent.session.append('agent-preset/selected', { agentPreset: preset.id })
+    return `switched to agent preset ${preset.id}`
+  }
+
   /** Refresh every client-visible surface a command may have mutated. */
   function refreshAfterCommand(record) {
     const permission = permissionPresets()
@@ -1492,7 +1714,9 @@ export function apply(ctx, config) {
     broadcastConfig(record).catch((error) => {
       logger.warn(`acp-enhanced: config rebroadcast after command failed: ${String(error)}`)
     })
-    publishCommands(record)
+    publishCommands(record).catch((error) => {
+      logger.warn(`acp-enhanced: command broadcast after command failed: ${String(error)}`)
+    })
   }
 
   // ── session records + history replay ─────────────────────────────────────
@@ -1585,6 +1809,11 @@ export function apply(ctx, config) {
     const parts = []
     for (const block of content ?? []) {
       if (block?.type === 'text' && typeof block.text === 'string') parts.push(block.text)
+      else if (block?.type === 'image' && block.attachment?.attachmentId !== undefined) {
+        // Model-produced images replay as a textual reference — the wire
+        // surface does not carry attachment bytes.
+        parts.push(`[image attachment ${block.attachment.attachmentId}]`)
+      }
     }
     return parts.join('\n')
   }
@@ -1689,7 +1918,15 @@ export function apply(ctx, config) {
             // workspace root on session/new / session/load instead of showing
             // the "doesn't currently support multi-root workspaces" callout).
             sessionCapabilities: { list: {}, delete: {}, additionalDirectories: {} },
-            promptCapabilities: { image: false, audio: false, embeddedContext: false },
+            // Image support is a live capability: the harness advertises
+            // `image: true` only when the composition mounted a working
+            // attachment store (duck-typed, so dsh 0.1.1-rc.2+ with
+            // dsh-attachment-local enables it and older stacks report false).
+            promptCapabilities: {
+              image: attachmentIngestOf(ctx.get('attachments')) !== undefined,
+              audio: false,
+              embeddedContext: false,
+            },
             // Stdio MCP servers always work; streamable HTTP maps onto
             // dsh-mcp-client's second transport. Legacy SSE does not.
             mcpCapabilities: { http: true, sse: false },
@@ -1706,13 +1943,30 @@ export function apply(ctx, config) {
         assertOpen()
         const additionalDirectories = normalizeSessionParams(params)
         const sessionId = SessionId(randomUUID())
+        const requestedPreset = process.env.DSH_ACP_PRESET ?? config.preset
+        let composition
+        try {
+          composition = await composePreset(requestedPreset)
+        } catch (error) {
+          // A bad DSH_ACP_PRESET / preset config is a client-side setup mistake,
+          // not a server fault: surface the roster's detail as invalid params.
+          const detail = error instanceof Error ? error.message : String(error)
+          if (error instanceof UnknownPresetError || error instanceof PresetMountError) {
+            throw invalidParams(detail)
+          }
+          throw error
+        }
         const handle = await agents.create({
           sessionId,
-          meta: { cwd: params.cwd },
+          meta: {
+            cwd: params.cwd,
+            ...composition.agentPreset === undefined ? {} : { agentPreset: composition.agentPreset },
+          },
           agentOptions: {
             ...config.provider === undefined ? {} : { provider: config.provider },
             ...config.model === undefined ? {} : { model: config.model },
           },
+          ...composition.setup === undefined ? {} : { setup: composition.setup },
         })
         if (closed) {
           await handle.dispose()
@@ -1767,12 +2021,26 @@ export function apply(ctx, config) {
             configOptions: await buildConfigOptions(live),
           }
         }
+        const runningPreset = await persistedPresetOf(sessionId)
+        let composition
+        try {
+          composition = await composePreset(runningPreset)
+        } catch (error) {
+          // Same mapping as session/new: a roster that cannot supply the
+          // session's logged preset is reported as a client mistake.
+          const detail = error instanceof Error ? error.message : String(error)
+          if (error instanceof UnknownPresetError || error instanceof PresetMountError) {
+            throw invalidParams(detail)
+          }
+          throw error
+        }
         const handle = await agents.resume({
           resumeSessionId: sessionId,
           agentOptions: {
             ...config.provider === undefined ? {} : { provider: config.provider },
             ...config.model === undefined ? {} : { model: config.model },
           },
+          ...composition.setup === undefined ? {} : { setup: composition.setup },
         })
         if (closed) {
           await handle.dispose()
@@ -1810,16 +2078,36 @@ export function apply(ctx, config) {
         if (record.inflight !== undefined) {
           throw invalidParams('a prompt is already in flight for this session')
         }
-        if (promptHasUnsupportedContent(params.prompt)) {
-          throw invalidParams('only text and resource_link prompt content is supported')
+        // Capability-gated content conversion: text/resource_link always work;
+        // image blocks are ingested through the composition's attachment
+        // store when one is mounted (advertised on initialize). A client that
+        // sends unsupported content gets the exact failing kind — never a
+        // silent drop — and an image that fails admission (bad type, over
+        // limits, store rejection) surfaces its precise reason.
+        let blocks
+        let text
+        try {
+          const ingest = attachmentIngestOf(ctx.get('attachments'))
+          const converted = await convertPrompt(params.prompt, ingest)
+          blocks = converted.blocks
+          text = converted.displayText
+        } catch (error) {
+          if (error instanceof UnsupportedPromptContentError) {
+            throw invalidParams(error.message)
+          }
+          if (error instanceof PromptImageError) {
+            throw invalidParams(`image rejected: ${error.message}`)
+          }
+          throw error
         }
-        const text = acpPromptToText(params.prompt)
         if (text.trim().length === 0) throw invalidParams('empty prompt')
 
         // Insurance: by the first prompt the client is guaranteed to know the
         // session, so re-advertise the command surface (idempotent) — covers
         // any client that missed the post-session/new broadcast.
-        publishCommands(record)
+        publishCommands(record).catch((error) => {
+          logger.warn(`acp-enhanced: command broadcast failed: ${String(error)}`)
+        })
 
         // Adapter-level slash commands never reach the model: /status and
         // /model are built in, any other registered slash (compact/goal/
@@ -1843,6 +2131,11 @@ export function apply(ctx, config) {
         if (commandMatch?.[1] === 'model') {
           return respond(await modelCommandText(record, trimmed.slice(commandMatch[0].length).trim()))
         }
+        if (commandMatch?.[1] === 'preset') {
+          const reply = await presetCommandText(record, trimmed.slice(commandMatch[0].length).trim())
+          refreshAfterCommand(record)
+          return respond(reply)
+        }
         if (commandMatch !== null && commandMatch[1] !== undefined) {
           let execution
           try {
@@ -1858,10 +2151,31 @@ export function apply(ctx, config) {
           }
         }
 
+        // The slash is not a harness command: it may be a skill gesture
+        // (`/skill-name`, e.g. `/ask-matt`). Zed would normally reject unknown
+        // slashes, but we advertise user-invocable skills in publishCommands,
+        // so this path is reachable. Load the skill body and append it to the
+        // message so the model reads the skill's instructions, exactly like
+        // dsh-tool-skill's user-invocation injection would.
+        if (commandMatch !== null && commandMatch[1] !== undefined) {
+          const skillName = commandMatch[1]
+          try {
+            const skill = await skills.get(skillName, {
+              scope: record.agent,
+              cwd: record.agent.session.header.cwd,
+            })
+            if (skill !== undefined && skill.invocation?.userInvocable !== false) {
+              blocks = [...blocks, { type: 'text', text: renderSkillContent(skill) }]
+            }
+          } catch (error) {
+            logger.warn(`acp-enhanced: skill gesture "${skillName}" failed: ${String(error)}`)
+          }
+        }
+
         if (ctx.agents.get(record.agent.id) !== record.agent) {
           throw internalError('prompt was not queued: the agent was disposed outside the bridge')
         }
-        const message = createUserMessage({ content: [{ type: 'text', text }], source: { kind: 'user' } })
+        const message = createUserMessage({ content: blocks, source: { kind: 'user' } })
         if (process.env.ACP_DEBUG) process.stderr.write(`[acp-debug] followup queued, agent phase=${record.agent.phase?.kind} inboxPending=${record.agent.inbox?.hasPending}\n`)
         const stopReason = await new Promise((resolve, reject) => {
           const inflight = {
@@ -1948,15 +2262,42 @@ export function apply(ctx, config) {
             applyPermissionPreset(record, value, permission)
             break
           }
+          case 'agent_preset': {
+            if (typeof value !== 'string' || value.length === 0) {
+              throw invalidParams('agent_preset value must be a non-empty preset id')
+            }
+            const presets = agentPresets()
+            if (presets === undefined) throw internalError('agent presets are not mounted')
+            if (!isBlankSession(record.agent.session)) {
+              throw invalidParams('agent preset can only be switched while the session is blank (no turn has run)')
+            }
+            let preset
+            try {
+              preset = await presets.recompose(record.agent.ctx, value)
+            } catch (error) {
+              // Map the roster's typed failures onto the wire error shape: an
+              // unknown/broken preset id is a client mistake (invalid params),
+              // while a composition that fails to mount is a server fault.
+              const detail = error instanceof Error ? error.message : String(error)
+              if (error instanceof UnknownPresetError || error instanceof PresetMountError) {
+                throw invalidParams(detail)
+              }
+              throw internalError(detail)
+            }
+            // The switch is a logged session fact (model-visible ⟺ logged), so a
+            // resume re-resolves the NEW composition.
+            record.agent.session.append('agent-preset/selected', { agentPreset: preset.id })
+            break
+          }
           case 'plan_mode': {
             if (typeof value !== 'boolean') throw invalidParams('plan_mode value must be a boolean')
-            const planMode = ctx.get('planMode')
+            const planMode = serviceForAgent(record.agent, 'planMode')
             if (planMode === undefined) throw internalError('plan mode is not mounted')
             planMode.set(record.agent, value)
             break
           }
           default:
-            throw invalidParams(`unknown config option "${params.configId}" (available: model, reasoning_effort, permission_preset, plan_mode)`)
+            throw invalidParams(`unknown config option "${params.configId}" (available: model, reasoning_effort, permission_preset, agent_preset, plan_mode)`)
         }
         const configOptions = await broadcastConfig(record)
         return { configOptions }

package/lib/terminal-codec.js

@@ -0,0 +1,96 @@
+/**
+ * Terminal-card wire helpers for the ACP bridge — the pure slice of the
+ * codex-acp-style bash/pwsh presentation. Kept separate from `index.js` so the
+ * parsing and mapping rules are unit-testable without a live profile (mirrors
+ * `codec.js` for the image surface).
+ *
+ * @module dsh-acp-enhanced/terminal-codec
+ */
+
+import { isAbsolute, resolve } from 'node:path'
+
+/**
+ * Map a dsh tool name to the ACP ToolKind used for icons and card UX.
+ *
+ * Kind and content must agree: Zed treats kind == 'execute' as a terminal tool
+ * and kind == 'edit' as a diff tool, and for both it HIDES the rawInput
+ * section. Genuine terminals (`zed_terminal`, plus the model-facing shell
+ * executors `bash`/`pwsh`) map to 'execute': for bash/pwsh the bridge emits
+ * the codex-acp terminal-card wire shape (terminal content + terminal_info /
+ * terminal_output / terminal_exit meta), so the command and output render in a
+ * terminal panel instead of a raw-JSON card. Write/edit tools map to 'edit'
+ * only because the bridge always pairs them with a `diff` content block — the
+ * diff replaces the raw dump as the card body. Remaining local executors like
+ * run_code stay 'other' and carry the command as a markdown code block,
+ * keeping the raw sections available too.
+ */
+export function toolKindFor(name) {
+  if (name === 'bash' || name === 'pwsh' || name === 'zed_terminal') return 'execute'
+  if (/^fs_.*read|read_text|cat|show/.test(name)) return 'read'
+  if (/search|find|grep/.test(name)) return 'search'
+  if (/fetch|http/.test(name)) return 'fetch'
+  if (/think/.test(name)) return 'think'
+  if (/write|edit|patch|apply/.test(name)) return 'edit'
+  return 'other'
+}
+
+/** Whether a tool's result is presented through the Zed terminal panel. Only
+ *  the model-facing shell executors are terminal-presented; `zed_terminal`
+ *  runs client-side and its result comes from the client, not from dsh. */
+export function isTerminalToolName(name) {
+  return name === 'bash' || name === 'pwsh'
+}
+
+/** Strip a `bash -lc`-style shell prefix from a command line, codex-acp style.
+ *  Handles both single- and double-quoted payloads so the terminal card title
+ *  shows the command itself, not the wrapping evaluator. */
+export function stripShellPrefix(command) {
+  const withoutShell = String(command ?? '').replace(/^(?:\/bin\/)?(?:bash|zsh|sh)\s+(?:-[lc]+\s+)?/, '')
+  const wrapped = withoutShell
+  if (wrapped.length >= 2
+    && ((wrapped.startsWith("'") && wrapped.endsWith("'"))
+      || (wrapped.startsWith('"') && wrapped.endsWith('"')))) {
+    return wrapped.slice(1, -1)
+  }
+  return withoutShell
+}
+
+/** Full text of a dsh tool result, or `undefined` when the tool failed. */
+export function resultText(event) {
+  if (event.data.error !== undefined) return undefined
+  const parts = []
+  for (const block of event.data.message?.content ?? []) {
+    for (const inner of block?.content ?? []) {
+      if (inner?.type === 'text' && typeof inner.text === 'string') parts.push(inner.text)
+    }
+  }
+  return parts.join('\n')
+}
+
+/**
+ * Recover the terminal exit pill from a rendered shell-tool result — the
+ * inverse of the `[exit code: N]` / `[killed by signal: X]` markers the shell
+ * tools append (guaranteed to be the last line, prefixed with a newline).
+ * Returns the marker-free body plus exit code/signal; a body without a marker
+ * is a clean exit with code 0.
+ */
+export function parseShellExitStatus(text) {
+  const signal = /\n\[killed by signal: ([^\]\n]+)\]$/.exec(text)
+  if (signal?.[1] !== undefined) {
+    return { body: text.slice(0, signal.index), exitCode: 0, signal: signal[1] }
+  }
+  const exit = /\n\[exit code: (\d+)\]$/.exec(text)
+  if (exit?.[1] !== undefined) {
+    return { body: text.slice(0, exit.index), exitCode: Number(exit[1]), signal: null }
+  }
+  return { body: text, exitCode: 0, signal: null }
+}
+
+/** Resolve the cwd a bash/pwsh call runs in, for the terminal_info card. */
+export function shellCallCwd(args, session) {
+  const headerCwd = session?.header?.cwd
+  if (typeof args === 'object' && args !== null && typeof args.workdir === 'string' && args.workdir.length > 0) {
+    return isAbsolute(args.workdir) ? args.workdir : headerCwd === undefined ? args.workdir : resolve(headerCwd, args.workdir)
+  }
+  return headerCwd ?? process.cwd()
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-acp-enhanced",
-  "version": "0.3.6",
+  "version": "0.5.0",
   "description": "Enhanced ACP server for DeepSeek Harness: block-level streaming, usage/stat telemetry (cache hit rate, token speed, input/output tokens, context length, turns, tool timing), model & reasoning-effort switching, and permission-preset control over the ACP wire (Zed-friendly)",
   "keywords": [
     "dsh",
@@ -43,12 +43,14 @@
     "@deepseek-ai/cordis-plugin-loader": "^1.0.2-rc.1",
     "@deepseek-ai/dsh-agent": "^0.1.0-rc.6",
     "@deepseek-ai/dsh-agent-instructions": "^0.1.0-rc.6",
+    "@deepseek-ai/dsh-agent-presets": "^0.1.0-rc.6",
     "@deepseek-ai/dsh-invariants": "^0.1.0-rc.6",
     "@deepseek-ai/dsh-llm": "^0.1.0-rc.6",
     "@deepseek-ai/dsh-mcp-client": "^0.1.0-rc.6",
     "@deepseek-ai/dsh-permission-presets": "^0.1.0-rc.6",
     "@deepseek-ai/dsh-session": "^0.1.0-rc.6",
     "@deepseek-ai/dsh-session-query": "^0.1.0-rc.6",
+    "@deepseek-ai/dsh-skill": "^0.1.0-rc.6",
     "@deepseek-ai/dsh-tools": "^0.1.0-rc.6",
     "@deepseek-ai/dsh-user-approval": "^0.1.0-rc.6"
   },
@@ -58,16 +60,28 @@
     "@deepseek-ai/cordis-plugin-loader": "1.0.2-rc.4",
     "@deepseek-ai/dsh-agent": "0.1.0-rc.6",
     "@deepseek-ai/dsh-agent-instructions": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-agent-presets": "0.1.0-rc.6",
     "@deepseek-ai/dsh-invariants": "0.1.0-rc.6",
     "@deepseek-ai/dsh-llm": "0.1.0-rc.6",
     "@deepseek-ai/dsh-mcp-client": "0.1.0-rc.6",
     "@deepseek-ai/dsh-permission-presets": "0.1.0-rc.6",
     "@deepseek-ai/dsh-session": "0.1.0-rc.6",
     "@deepseek-ai/dsh-session-query": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-skill": "0.1.0-rc.6",
     "@deepseek-ai/dsh-tools": "0.1.0-rc.6",
     "@deepseek-ai/dsh-user-approval": "0.1.0-rc.6"
   },
   "license": "MIT",
+  "author": {
+    "name": "grunmin",
+    "url": "https://github.com/grunmin"
+  },
+  "contributors": [
+    {
+      "name": "Mickey Sun",
+      "url": "https://github.com/sunstrikes"
+    }
+  ],
   "repository": {
     "type": "git",
     "url": "git+https://github.com/grunmin/dsh-acp-enhanced.git"