super-dsh 0.1.6 → 0.1.10

package/agent-codex/dist/permission.js

@@ -10,6 +10,10 @@ const PRESETS = {
 export function isPresetName(raw) {
     return typeof raw === "string" && Object.hasOwn(PRESETS, raw);
 }
+/** Narrow an untrusted value to a known sandbox mode. */
+export function isSandboxMode(raw) {
+    return raw === "read-only" || raw === "workspace-write" || raw === "danger-full-access";
+}
 /**
  * `CODEX_APPROVAL_MODE` when it names an approval policy Codex implements,
  * else undefined. An invalid value is IGNORED (the preset mapping applies).
@@ -19,16 +23,44 @@ export function envApprovalMode() {
     return raw !== undefined && APPROVAL_POLICIES.includes(raw) ? raw : undefined;
 }
 /**
- * Map a preset onto Codex's `--approval-mode` value; no preset → never.
+ * Map a preset onto Codex's launch approval policy; no preset → never.
  * A value that is ALREADY a codex approval policy (the env override rides
  * through the same folded call) passes through untouched; unknown preset
  * names degrade to never.
+ *
+ * Still used at create/resume for `thread/start|resume.approvalPolicy` — the
+ * thread's initial posture before the first per-turn fold lands.
  */
 export function codexApprovalMode(preset) {
     if (preset !== undefined && APPROVAL_POLICIES.includes(preset))
         return preset;
     return isPresetName(preset) ? PRESETS[preset].codexPolicy : "never";
 }
+/** The codex approval policy a Dash `approval/policy` value maps onto. */
+export function approvalPolicyForDashPolicy(policy) {
+    return policy === "ask" ? "on-request" : "never";
+}
+/** The structured codex sandbox policy for one Dash sandbox mode. */
+export function sandboxPolicyFor(mode, cwd) {
+    switch (mode) {
+        case "danger-full-access":
+            return { type: "dangerFullAccess" };
+        case "read-only":
+            return { type: "readOnly", networkAccess: false };
+        case "workspace-write":
+            return {
+                type: "workspaceWrite",
+                writableRoots: [cwd],
+                networkAccess: false,
+                excludeTmpdirEnvVar: false,
+                excludeSlashTmp: false,
+            };
+    }
+}
+/** The Dash sandbox mode a preset pins (unknown/absent → danger-full-access, matching the profile pin). */
+export function sandboxModeForPreset(preset) {
+    return isPresetName(preset) ? PRESETS[preset].sandbox : "danger-full-access";
+}
 /**
  * The default preset for FUTURE sessions, as the permission service
  * resolves it (settings-backed; the profile patch pins the base default).
@@ -56,6 +88,48 @@ export function presetFromEvents(events) {
     }
     return undefined;
 }
+/** The session's effective sandbox mode: the last `sandbox/mode` event. */
+export function sandboxModeFromEvents(events) {
+    for (let index = events.length - 1; index >= 0; index -= 1) {
+        const event = events[index];
+        if (event.type === "sandbox/mode" && isSandboxMode(event.data?.mode))
+            return event.data.mode;
+    }
+    return undefined;
+}
+/** The session's effective approval policy: the last `approval/policy` event. */
+export function approvalPolicyFromEvents(events) {
+    for (let index = events.length - 1; index >= 0; index -= 1) {
+        const event = events[index];
+        if (event.type === "approval/policy") {
+            const policy = event.data?.policy;
+            if (policy === "ask" || policy === "never")
+                return approvalPolicyForDashPolicy(policy);
+        }
+    }
+    return undefined;
+}
+/**
+ * Fold the session's live permission state into the codex overrides for the
+ * NEXT `turn/start`. Never throws; every unknown value degrades to the
+ * fallback preset, and the env override wins for the approval half.
+ *
+ * @param events - the session log (or any suffix ending at the current state).
+ * @param fallbackPreset - the preset to use when the log carries no event
+ *   (the recorded preset from the identity map, else the service default).
+ * @param cwd - the session workspace, used for `workspaceWrite.writableRoots`.
+ */
+export function turnPolicyFromEvents(events, fallbackPreset, cwd) {
+    const preset = isPresetName(fallbackPreset) ? fallbackPreset : undefined;
+    const presetSpec = preset === undefined ? undefined : PRESETS[preset];
+    const sandboxMode = sandboxModeFromEvents(events) ?? presetSpec?.sandbox ?? "danger-full-access";
+    const fromEvents = approvalPolicyFromEvents(events);
+    const envMode = envApprovalMode();
+    const approvalPolicy = envMode === "never" || envMode === "on-request" || envMode === "untrusted"
+        ? envMode
+        : fromEvents ?? codexApprovalMode(preset);
+    return { approvalPolicy, sandbox: sandboxPolicyFor(sandboxMode, cwd) };
+}
 /**
  * The three Dash events `pinInitialPermission` stamps for a fresh session,
  * in its append order (preset, sandbox, approval). Cold replay prepends

package/agent-codex/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@pgmi-builds/agent-codex",
   "version": "0.1.0",
-  "description": "Codex provider for DeepSeek Harness (dsh) — an AgentFactory that embeds Codex CLI via the @openai/codex-sdk and bridges Codex's session surface into Dash Agent/Session contracts .",
+  "description": "Codex provider for DeepSeek Harness (dsh) — an AgentFactory that drives a `codex app-server` child process (stdio JSONL JSON-RPC) per session and bridges its thread/turn surface, approvals and permission policy into Dash Agent/Session contracts.",
   "type": "module",
   "exports": {
     ".": "./dist/index.js",
@@ -23,7 +23,6 @@
   },
   "dependencies": {
     "@openai/codex": "0.154.0",
-    "@openai/codex-sdk": "0.154.0",
     "zod": "4.4.3"
   },
   "peerDependencies": {

package/agent-codex-sdk/README.md

@@ -0,0 +1,79 @@
+# @pgmi-builds/agent-codex-sdk
+
+superd 外壳下的 **Codex adapter**（super-dsh 线，AW-E）：把 Codex CLI 经由
+`@openai/codex-sdk` 接进 DSH —— 会话、事件、模型目录、持久化全部按 DSH 语义呈现，
+WebUI 消费的是 DSH 服务提供的数据面。
+
+> 通用规则（定位 / 两形态 / 测试准则 / 接线域 / per-agent 定制权 / home 与 profile 布局）
+> 见上级目录的 `agent-adapter-dev-rules.md` —— 改本包前先读它。
+
+## 它是什么
+
+- 一个**普通 dsh plugin bundle**：`package.json` 的 `dsh.bundle.patch` 指向本目录的
+  `cordis.patch.yml`（挂 codex provider、关掉它替代的原生行、重写权限三档表、pin 应用内目录选择器）。
+- 一个 **AgentFactory**：`src/index.ts` 里的 `CodexProvider` 在 `ctx.agents` 注册工厂，
+  每个会话一个 `CodexSdkClient`（真 `@openai/codex-sdk` 线程）；`src/agent.ts` 把 Codex 线程事件
+  投影成 DSH 会话事件。
+- **带自己的 world 入口**：`src/world-plugin.ts`（`./world`，world key `codex-sdk`）把它作为
+  superd 世界挂载（`spawnWorld` + `worldMountPatches`），需要 hub 的 `@pgmi-builds/superd-hub`；
+  同一份 adapter 代码也可作为普通 bundle 点亮一个完整 web app（两形态一条代码路径）。
+
+## 零声明依赖与运行时自取（2026-10-04 user 裁决）
+
+本包 **不声明任何运行时依赖** —— `@openai/codex-sdk` / `@openai/codex` / `zod` 既不在
+`dependencies`、也不在 `optionalDependencies`、也不在 `peerDependencies`（`dependencies` 恒为
+`{}`），安装期零下载、零 postinstall。SDK 树在**首个真 prompt** 时才被 fetch 进
+`<worldHome>/sdk-runtime/`（`src/sdk-runtime.ts`）：
+
+- marker `<worldHome>/sdk-runtime.json`（**最后写**：写不到就不算成功）、锁 `.lock`（mkdir 原子，
+  30 min 判陈旧可夺）、失败留 `.error.log`；
+- marker 身份 = 本包版本 + 两个 pin，任一变化即重取；命中且 entry 存在则零网络短路；
+- 装完立刻 smoke `import()` entry 并要求 `Codex` 构造器存在 —— 坏树在 fetch 时报错，不留到首 prompt；
+- 预热（dev/运维）：`npm run fetch-sdk-runtime [<home>]`（只接受仓内 `.tests` 下的 home）。
+
+## 跑起来
+
+本包默认 **disabled**（composite 行 `agent-codex-sdk`，打开该行即启用）：行为级验证只走整包
+pack 线（`super-dsh/test/start-4999.sh` + dev3 实装），不另起 per-agent 场景 rig（2026-09-24
+场景退役，见 `agent-adapter-dev-rules.md` §2）。`CODEX_TRACE=1` 开 provider/agent 追踪。
+## Home 与 profile 布局（user 裁定）
+
+| 位置 | 内容 |
+|---|---|
+| `$DSH_HOME`（测试 = `<repo>/.tests`） | 测试 DSH home |
+| `<DSH_HOME>/agents/codex-sdk` | 该世界的 **world DSH home**（`dsh-sessions.json` 映射等 adapter 态）+ **自取 SDK 运行时** `<worldHome>/sdk-runtime/`；codex app home 仍是原生 `~/.codex`（绝不重定向） |
+| `$DSH_HOME/profiles/codex-sdk` | 该世界的 dsh profile（bundles + `cordis.patch.yml`） |
+| `$DSH_HOME/sessions/...` | **DSH 会话日志**（上游 `session-persistence-jsonl`，zstd）——list/replay 都由此提供 |
+
+**禁止**自造 per-app home（如 `.tests/codex-app`）。
+
+## 关键实现点
+
+- **session 身份 = 一对一映射**：DSH session id 是权威；Codex thread id 在其物化后写入
+  `<worldHome>/dsh-sessions.json`（`src/session-map.ts`）。resume 只经该映射重挂线程，查不到即
+  fail-closed。**不自建 rollout 扫描做 list，也不自解析 JSONL 做 replay。**
+- **DSH-native 持久化**：工厂按上游 agent-loop 的方式持有写通道（create `persistence.create` /
+  resume `persistence.open(id,'write')` → `read` → `interruptedTurnClosers` → `prepare`），
+  发布点刷未存后缀，dispose 时 `handle.close()` 排空。
+- **每会话路由钉住**：工厂在 create/resume 时同步钉住本会话路由（追加 `model/selection` +
+  `installModelSelection`），**不依赖全局默认模型的落盘时序**（共享 test home 里 settings 默认可能属别线）。
+- **事件映射**：`system/message`（Codex 系统提示，rollout HEAD `base_instructions`）、
+  `request/context`（provider/model/contextWindow）、`assistant/message`（reasoning 用
+  `{type:'reasoning',text}`）、`tool/call`（原始 JSON 串）/`tool/result`、`step/start|end`、`turn/start|end`。
+
+## 测试
+
+```bash
+npm run build                                   # tsc strict
+DSH_HOME=<repo>/.tests \
+SUPERD_DSH_ANCHOR=<repo>/upstream/deepseek-harness/package.json \
+node --test test/*.test.mjs
+```
+
+## 已知边界（V1）
+
+- 审批仅 launch-only 预设（SDK 无运行时审批；app-server 线才有 `*/requestApproval`）；
+- 无 steer / 无运行时换模型（下一轮生效）/ usage 滞后一轮 / 无 fork；
+- `compaction/*`、`todo/write`、`subagent/*` 未接（见规则文档 §9.4 backlog）；
+- **world 入口**：`src/world-plugin.ts`（world key `codex-sdk`）已接线 `spawnWorld`；roster 条目
+  fiber-scoped、行关闭时 dispose 世界（2026-10-03 omp-sdk 验收踩到的两条卸载契约）。

package/agent-codex-sdk/cordis.patch.yml

@@ -0,0 +1,81 @@
+# @pgmi-builds/agent-codex-sdk bundle patch (SDK line, standalone form).
+# This file is the `dsh.bundle.patch` layer of the adapter package: when the
+# codex world profile mounts the bundle, the boot merges THIS patch — mount
+# the Codex provider plus disable the native components it replaces.
+#
+# Profile-specific values are deliberately NOT here: `webserver.port` (port
+# choice) belongs to the world/profile patch layer (the superd-codex-world
+# fixture carries the 127.0.0.1:0 listener posture).
+
+# Mount the Codex provider: a Cordis Service that registers an AgentFactory
+# on ctx.agents. The provider drives @openai/codex-sdk threads (one
+# CodexSdkClient per session) plus resume (--resume-thread); the model
+# selector is served by a Codex-backed LlmAdapter reading the codex home's
+# config.toml + model_catalog_json.
+- insert:
+    - id: codex-sdk-provider
+      name: '@pgmi-builds/agent-codex-sdk'
+
+# Codex owns the live agent transcript (the rollout JSONL); disable the
+# built-in loop so it does not double-run alongside the SDK thread.
+- id: agent-loop
+  disabled: true
+
+# The native routes register deepseek-official / pi-ai providers; the Codex
+# provider registers its own adapter (the single `codex` route) on ctx.llm.
+# Leaving them mounted would advertise native models alongside Codex's.
+- id: llm-deepseek
+  disabled: true
+- id: llm-pi-ai
+  disabled: true
+
+# Codex is single-mode: the SDK thread drives tools itself, so no Dash preset
+# composition is needed (the provider ships the fixed single-preset roster).
+# 0.1.7: the host AgentPresetRegistry row (renamed `agent-presets` ->
+# `agent-preset-registry`) stays MOUNTED — the adapter registers its one
+# fixed preset into it (src/agent-preset-codex.ts); pin only the default.
+- id: agent-preset-registry
+  config:
+    default: codex
+
+# The upstream jsonl persistence row STAYS MOUNTED (2026-09-16): the provider
+# writes the DSH session log through it (create/open/append/close), so
+# list/read/replay/workspace grouping are ordinary DSH services over that log.
+# The adapter no longer provides its own persistence.
+
+# Codex has no runtime approval control — the adapter maps the preset onto
+# the launch-only --approval-mode flag (3:3 table in src/permission.ts).
+# Default to danger-full-access. Restate the full 3-preset table: a patch
+# with only defaultPreset silently drops the bundle's 3-preset table to the
+# plugin's built-in 2, breaking the 3:3 Dash<->Codex pairing.
+- id: permission
+  config:
+    presets:
+      read-only:
+        sandbox: read-only
+        approval: ask
+      workspace-write:
+        sandbox: workspace-write
+        approval: ask
+      danger-full-access:
+        sandbox: danger-full-access
+        approval: never
+    defaultPreset: danger-full-access
+
+# Directory picker: the stock `directory-picker-auto` is never a simple alias —
+# it RESOLVES the interaction once per boot and mounts BOTH faces through the
+# loader: the host backend package AND the matching CLIENT SURFACE package
+# (`dsh-client-ui-directory-picker-<kind>`). The client surface is what
+# occupies the workspace picker's directory-flow hole; with the hole empty the
+# client hides the "add workspace" entry entirely (WorkspacePicker: `flowAvailable
+# ? [ADD_WORKSPACE] : []`). NEVER just `disabled: true` this row — that removed
+# the button. Pin the in-app browser by mounting both faces of `browse`
+# ourselves (backend first: the surface's browser half drives the capability the
+# backend registers) and unmounting the auto row.
+- insert:
+    - id: directory-picker-browse
+      name: '@deepseek-ai/dsh-host-directory-picker-browse'
+    - id: directory-picker-browse-surface
+      name: '@deepseek-ai/dsh-client-ui-directory-picker-browse'
+- id: directory-picker
+  disabled: true

package/agent-codex-sdk/dist/adapter.js

@@ -0,0 +1,91 @@
+/**
+ * Codex-backed `LlmAdapter` registered on `ctx.llm` by the Codex provider.
+ *
+ * The browser model selector never touches the Codex agent directly: it is an
+ * RPC round-trip through the apiproxy, which reads `ctx.llm.listProviders /
+ * listModels / resolveModelInfo` to build the catalog. This adapter answers
+ * those queries from the ADAPTER's canonical provider store
+ * (`codex-providers.ts`), registering ONE ROUTE PER CONFIGURED PROVIDER.
+ *
+ * That one-route-per-provider shape is the 2026-10-04 rework, and it is what
+ * makes the whole feature DSH-native: the harness's own model selector already
+ * renders a provider-grouped catalog, already keeps the choice per session
+ * (`session/selectModel` → the durable `model/selection` event + the
+ * `modelSelection` projection), and already reports which route a session last
+ * used. Registering the Codex providers as real routes means Super D gets all
+ * of that by construction instead of re-implementing it — there is no "active
+ * provider" left for the UI to hold.
+ *
+ * `stream` is never dispatched: Codex owns generation through its app-server
+ * thread (`CodexAgent`), so the adapter only serves catalog/metadata queries.
+ * It throws rather than fabricating a wire route the harness would misuse.
+ *
+ * @module agent-codex/adapter
+ */
+import { LlmAdapter, LlmError, } from "@deepseek-ai/dsh-llm";
+import { readProviderStore } from "./codex-providers.js";
+/**
+ * The single route every Codex model was served under before the multi-provider
+ * rework. No longer registered (a session pinned to it falls back to whatever
+ * the native `config.toml` runs), but kept as the one named constant so the
+ * legacy value is greppable in session logs.
+ */
+export const CODEX_PROVIDER_ID = "codex";
+/** Whether a provider may be registered as a model route. */
+export function routableProvider(entry) {
+    return entry.models.length > 0;
+}
+/** The route ids a store currently contributes to `ctx.llm`. */
+export function routeIds(store) {
+    return store.providers.filter(routableProvider).map((entry) => entry.id);
+}
+/** The provider entry a route id names, or `undefined`. */
+export function providerFor(worldHome, providerId) {
+    return readProviderStore(worldHome).providers.find((entry) => entry.id === providerId);
+}
+export class CodexLlmAdapter extends LlmAdapter {
+    worldHome;
+    /**
+     * @param worldHome - the world's DSH home, holding the canonical provider
+     *   store in `<worldHome>/codex-providers.json`. Read on every call, so a
+     *   panel edit is visible to the next catalog query without re-registration.
+     */
+    constructor(worldHome) {
+        super();
+        this.worldHome = worldHome;
+    }
+    providerInfo(provider) {
+        // The display name is the entry's label — for a provider folded in from the
+        // user's own config that is its endpoint URL, which is the only name a
+        // hand-written codex config supplies.
+        return { id: provider, name: providerFor(this.worldHome, provider)?.label ?? provider };
+    }
+    async listModels(provider) {
+        const entry = providerFor(this.worldHome, provider);
+        if (entry === undefined)
+            return [];
+        return entry.models.map((model) => ({
+            provider,
+            id: model.id,
+            name: model.displayName ?? model.id,
+        }));
+    }
+    async resolveModel(provider, model, _signal) {
+        const entry = providerFor(this.worldHome, provider);
+        const found = entry?.models.find((candidate) => candidate.id === model);
+        if (found === undefined) {
+            throw new LlmError(`Codex provider "${provider}" does not serve model "${model}"`, "MODEL_NOT_FOUND");
+        }
+        return {
+            provider,
+            id: found.id,
+            name: found.displayName ?? found.id,
+            ...(found.contextWindow !== undefined && found.contextWindow > 0
+                ? { context: { contextWindow: found.contextWindow } }
+                : {}),
+        };
+    }
+    stream(_options) {
+        throw new LlmError("the Codex adapter does not stream: Codex owns generation through its app-server thread", "UNSUPPORTED_STREAM");
+    }
+}

package/agent-codex-sdk/dist/agent-preset-codex.js

@@ -0,0 +1,32 @@
+export const CODEX_PRESET_ID = "codex";
+/** The single fixed Codex preset: mounting it composes nothing. */
+export const CODEX_PRESET = Object.freeze({
+    id: CODEX_PRESET_ID,
+    name: "Codex",
+    description: "Codex agent via the agent-codex adapter",
+    plugins: Object.freeze([]),
+});
+/**
+ * Register the fixed preset into the host `AgentPresetRegistry` once the
+ * service is up. Registration failure keeps the roster row visible as
+ * `broken` inside the registry (upstream owns that lifecycle) — the adapter
+ * only owns the disposer.
+ */
+export function registerCodexPreset(ctx) {
+    ctx.inject(["agentPresets"], (scoped) => {
+        let dispose;
+        let settled = false;
+        void scoped.agentPresets.register(CODEX_PRESET).then((unregister) => {
+            if (settled) {
+                void unregister();
+            }
+            else {
+                dispose = unregister;
+            }
+        });
+        ctx.effect(() => async () => {
+            settled = true;
+            await dispose?.();
+        }, "codexAdapter.preset");
+    });
+}