feat(acp): tool-owned tool-call UI presentation (title/command/output)

In Zed the tool-call card showed only "bash" — the bare tool name — instead
of what the command does. Fix it by letting each TOOL own how its calls render,
rather than the bridge special-casing names.

dsh-tools: add an optional two-state presentation seam to ToolDefinition /
defineTool — `presentCall(args)` (pending: title, kind, rawInput) and
`presentResult(args, result)` (completed: title?, content?). Provider-neutral
`ToolCallKind`/`ToolCallPresentation`/`ToolResultPresentation` vocabulary so
tools never depend on ACP. defineTool soft-validates args (display runs on log
replay, so a malformed/old shape returns undefined instead of throwing).

dsh-tool-bash: bash declares presentCall (model `description` → title, exact
`command` → rawInput, kind execute) and presentResult (wrap output in a fenced
```console block — a UI-only affordance kept out of the model-facing result);
bash_output/bash_kill present task-scoped titles.

dsh-acp: inject `tools`; a per-session `ToolPresenter` looks the tool up by name
and maps its neutral presentation to the ACP tool_call/tool_call_update wire
shape, with a generic fallback (title = name) for tools that declare nothing.
Because the `tool/result` event carries only {callId, content, isError}, the
presenter keeps a small bridge-local map of ONLY in-flight calls' (name, args),
keyed by callId and removed as each result is presented — no event-schema or
core change. Replay uses a throwaway presenter so loaded sessions render
identically to live ones.

Tests: dsh-tools defineTool presenters (typed args, soft-validate), tool-bash
bash/bash_output/bash_kill presenters, acp ToolPresenter (tool-owned mapping,
unknown-callId fallback, in-flight-only map), and an end-to-end turn through the
bridge. The key-gated e2e now asserts a real bash call's title is the model
description (not "bash") and rawInput is the command — verified against the real
DeepSeek model. The test harness derives its inject from the bridge's exported
`inject` so it can't drift again.

packages/tool-bash/README.md

@@ -32,6 +32,10 @@ Result text: stdout, then a `[stderr]` section, then status markers — `[timed
 
 The owning agent is recorded per task id at spawn and kept for the lifetime of the loaded plugin instance (it is **not** cleared on completion). `bash_output`/`bash_kill` reject a task owned by a *different* agent with `task <id> belongs to another session` (a task started with no agent — a non-loop caller — has no owner and is open to anyone; a call with no `exec.agent` cannot access an owned task). Task ids are global and predictable, so under multi-session ACP this ownership check is the fence that stops one session's agent from reading or killing another session's background task. (`TODO(tool-bash-owner-hmr)`: an independent HMR reload of this plugin starts a fresh map, so a task spawned before the reload becomes un-owned — acceptable as HMR is dev-only and the session boundary is one user's cooperative editor; a durable fix attaches ownership to the executor/task lifetime.)
 
+## UI presentation
+
+These tools own how their calls render in a UI (an editor's tool-call card) via the `dsh-tools` `presentCall`/`presentResult` seam — a UI never special-cases tool names. For `bash`: the model-written `description` is the always-visible **title** (e.g. "List files in the current directory"), the exact `command` is the **rawInput** (the verbatim command stays visible in a detail view without crowding the title), `kind` is `execute` (terminal/run treatment), and the completed output is wrapped in a fenced ` ```console ` block — a UI-only affordance, so the model-facing result text stays unfenced. `bash_output`/`bash_kill` present a task-scoped title ("Read output from background task bash-3" / "Kill background task bash-3") with the task id as rawInput. These methods are pure/display-only (they also run on `session/load` replay), and a malformed/older logged arg shape falls back to a generic presentation rather than throwing. See `packages/tools` ("Tool-owned UI presentation") and `packages/acp` ("Tool-call presentation").
+
 ## Background completion notices
 
 When a background task finishes, a short notice is injected into the owning agent's session (`agent.inject()`, source `{kind: 'plugin', plugin: 'tool-bash'}`). Injection is **durable context for the next model request, not a wake-up** — an idle agent stays idle until something sends a message. That's why the tool descriptions tell the model to poll with `bash_output`.

packages/tool-bash/src/index.ts

@@ -39,6 +39,8 @@
 import type { Context } from 'cordis'
 import { isAbsolute, resolve as resolvePath } from 'node:path'
 import { defineTool } from '@deepseek-ai/dsh-tools'
+import type { ToolCallPresentation, ToolResult, ToolResultPresentation } from '@deepseek-ai/dsh-tools'
+import type { ContentBlock } from '@deepseek-ai/dsh-llm'
 import type { Agent } from '@deepseek-ai/dsh-agent'
 import type { BashRunResult, BashTask, CollectedOutput } from '@deepseek-ai/dsh-bash'
 
@@ -124,6 +126,44 @@ export function renderResult(result: BashRunResult): string {
   return body + markers.join('\n')
 }
 
+// ---------------------------------------------------------------------------
+// UI presentation (tool-owned). These shape how a UI (e.g. the ACP bridge)
+// renders a bash call's pending and completed states. They are display-only and
+// pure — a UI may call them during live streaming AND a session-log replay.
+// ---------------------------------------------------------------------------
+
+/**
+ * Pending-state presentation for a `bash` call: the model-written `description`
+ * is the always-visible title (the schema requires it precisely so a UI has a
+ * readable summary — "List files in the current directory"), `kind: 'execute'`
+ * (a terminal/run treatment), and the exact `command` is the `rawInput` so the
+ * verbatim command stays visible in a UI's detail view without crowding the
+ * title. Mirrors how Zed / the reference ACP adapters render execute tools.
+ */
+function presentBashCall(args: { command: string; description: string }): ToolCallPresentation {
+  return { title: args.description, kind: 'execute', rawInput: args.command }
+}
+
+/**
+ * Completed-state presentation for a `bash` call: wrap the model-facing result
+ * text in a fenced ```console block so a UI renders the output monospaced as a
+ * terminal transcript. The model-facing `content` (what `execute` returned) is
+ * intentionally NOT fenced — the fences are a UI-only affordance, so they live
+ * here, not in `renderResult`. A non-text result (unexpected for bash) is left
+ * untouched by falling back to `undefined`.
+ */
+function presentBashResult(_args: unknown, result: ToolResult): ToolResultPresentation | undefined {
+  const block = result.content.length === 1 ? result.content[0] : undefined
+  if (block === undefined || block.type !== 'text') return undefined
+  const fenced: ContentBlock = { type: 'text', text: `\`\`\`console\n${block.text.replace(/\n+$/, '')}\n\`\`\`` }
+  return { content: [fenced] }
+}
+
+/** Pending-state presentation for `bash_output`/`bash_kill` (background-task tools). */
+function presentTaskCall(verb: string, args: { task_id: string }): ToolCallPresentation {
+  return { title: `${verb} background task ${args.task_id}`, kind: 'execute', rawInput: args.task_id }
+}
+
 /**
  * Resolve the working directory for a bash call. Precedence: an explicit model
  * `workdir` wins; otherwise default to the calling agent's session cwd
@@ -242,6 +282,8 @@ export function apply(ctx: Context): void {
       if (result.aborted) throw new Error('command aborted')
       return [{ type: 'text', text: renderResult(result) }]
     },
+    presentCall: presentBashCall,
+    presentResult: presentBashResult,
   }))
 
   ctx.tools.register(defineTool({
@@ -266,6 +308,7 @@ export function apply(ctx: Context): void {
       text += `\n${statusLine(read.task)}`
       return Promise.resolve([{ type: 'text', text }])
     },
+    presentCall: args => presentTaskCall('Read output from', args),
   }))
 
   ctx.tools.register(defineTool({
@@ -283,5 +326,6 @@ export function apply(ctx: Context): void {
         text: killed ? `killed background task ${id}` : `task ${id} had already finished`,
       }])
     },
+    presentCall: args => presentTaskCall('Kill', args),
   }))
 }

packages/tool-bash/tests/tools.spec.ts

@@ -562,3 +562,58 @@ describe('status lines', () => {
     expect(text(read)).toContain('[status: completed, exit code: 0]')
   })
 })
+
+describe('tool-owned UI presentation (presentCall / presentResult)', () => {
+  it('bash presentCall: the model description is the title, the command is the rawInput, kind execute', async () => {
+    const ctx = await setup()
+    const present = ctx.tools.get('bash')!.presentCall!({ command: 'ls -la src', description: 'List files in src' })
+    expect(present).toEqual({ title: 'List files in src', kind: 'execute', rawInput: 'ls -la src' })
+  })
+
+  it('bash presentResult: wraps the model-facing text in a fenced console block', async () => {
+    const ctx = await setup()
+    const present = ctx.tools.get('bash')!.presentResult!(
+      { command: 'echo hi', description: 'echo' },
+      { content: [{ type: 'text', text: 'hi\n[exit code: 0]\n\n' }], isError: false },
+    )
+    // Trailing blank lines are trimmed; the body is fenced as ```console.
+    expect(present).toEqual({ content: [{ type: 'text', text: '```console\nhi\n[exit code: 0]\n```' }] })
+  })
+
+  it('bash presentResult: leaves a non-text (unexpected) result untouched → undefined (UI keeps raw content)', async () => {
+    const ctx = await setup()
+    const present = ctx.tools.get('bash')!.presentResult!(
+      { command: 'x', description: 'x' },
+      { content: [{ type: 'image', url: 'https://x/y.png' }], isError: false },
+    )
+    expect(present).toBeUndefined()
+  })
+
+  it('bash presentResult: a result that is not exactly one block → undefined (no single text to fence)', async () => {
+    const ctx = await setup()
+    const args = { command: 'x', description: 'x' }
+    // Empty content (no block) and multi-block content both fall through.
+    expect(ctx.tools.get('bash')!.presentResult!(args, { content: [], isError: false })).toBeUndefined()
+    expect(ctx.tools.get('bash')!.presentResult!(args, {
+      content: [{ type: 'text', text: 'a' }, { type: 'text', text: 'b' }],
+      isError: false,
+    })).toBeUndefined()
+  })
+
+  it('bash_output / bash_kill presentCall: a readable task-scoped title, task id as rawInput', async () => {
+    const ctx = await setup()
+    expect(ctx.tools.get('bash_output')!.presentCall!({ task_id: 'bash-3' }))
+      .toEqual({ title: 'Read output from background task bash-3', kind: 'execute', rawInput: 'bash-3' })
+    expect(ctx.tools.get('bash_kill')!.presentCall!({ task_id: 'bash-3' }))
+      .toEqual({ title: 'Kill background task bash-3', kind: 'execute', rawInput: 'bash-3' })
+  })
+
+  it('presentCall validates softly: malformed args (missing required description) return undefined, never throw', async () => {
+    const ctx = await setup()
+    // defineTool wraps presentCall to soft-validate against the schema and fall
+    // back to undefined (a generic UI presentation) rather than throwing on the
+    // display path — it may run on replay of arbitrary logged args. The
+    // ToolDefinition.presentCall takes `unknown`, so a malformed shape needs no cast.
+    expect(ctx.tools.get('bash')?.presentCall?.({ command: 'ls' })).toBeUndefined()
+  })
+})