deepseek-harness/apps/cli/cordis.yml

# dsh web — the full web-shape composition: host runtime (layer 1), the
# transport/service layer (layer 2), and the browser plugin roster (dshClient
# rows the modules node half scans into window.__DSH_BOOT__). Row order
# carries no load semantics (activation is service-availability driven); the
# grouping below is for readers. `--dev` appends the dsh-client-hmr row in
# code (AppCLIEntry) — prod and dev differ by exactly that one row.
# AppCLIEntry patches this tree before boot: profile json + CLI flags +
# distIndex land as config patches over the rows below (yaml = engineering
# defaults, json = user config, user wins per field).

# ── layer 1: runtime ────────────────────────────────────────────────────────

- id: timer
  name: '@cordisjs/plugin-timer'

- id: llm
  name: '@deepseek-ai/dsh-llm'

- id: session
  name: '@deepseek-ai/dsh-session'

# Projection registry: drives every registered domain unit over committed
# session events and serves finished values (history-tail projections block +
# session/projection frames). Without this row every domain's optional unit
# injection stays silent — no block, no frames, no titles/todos on the web.
- id: session-projection
  name: '@deepseek-ai/dsh-session-projection'

- id: session-title
  name: '@deepseek-ai/dsh-session-title'
  config:
    fallbackMaxWords: 5
    fallbackMaxBytes: 40
    maxTitleBytes: 80

# Model-made titles on the first-message cadence (the web sidebar renders
# session/title). Same values as the TUI composition.
- id: session-title-llm
  name: '@deepseek-ai/dsh-session-title-first-message-llm'
  config:
    targetWords: 5
    targetCjkCharacters: 10
    maxInputBytes: 4096
    maxOutputTokens: 64
    timeoutMs: 60000

- id: system-prompt
  name: '@deepseek-ai/dsh-system-prompt'
  config:
    persona: ''

- id: tools
  name: '@deepseek-ai/dsh-tools'
  config:
    # TEMPORARY workaround: DSH_TOOLS_MODE (native|code|both) opts a whole dsh
    # process into Code Mode while per-session tool-mode selection is being
    # designed; unset keeps the schema default (native). Remove the env seam
    # once the web UI owns the choice per session.
    mode: !!js process.env.DSH_TOOLS_MODE

# Code Mode substrate for the row above. Mounted unconditionally because
# Loader metadata is static (no conditional rows): a native-mode boot only
# registers the service — a worker thread spawns per run_code execution.
- id: code-runtime
  name: '@deepseek-ai/dsh-code-runtime-worker'

- id: user-interaction
  name: '@deepseek-ai/dsh-user-interaction'

- id: agent
  name: '@deepseek-ai/dsh-agent'

- id: tasks
  name: '@deepseek-ai/dsh-tasks-local'

- id: agent-loop
  name: '@deepseek-ai/dsh-agent-loop'
  config:
    agents: []

# The native DeepSeek adapter; reads the key/base-url the boot's layered
# .env loading (cwd then $DSH_HOME) left in the environment.
- id: llm-deepseek
  name: '@deepseek-ai/dsh-llm-deepseek'
  config:
    apiKey: !!js process.env.DEEPSEEK_API_KEY
    baseURL: !!js process.env.DEEPSEEK_BASE_URL

# Transient-failure recovery around the loop's model calls (same policy as
# the TUI's agent-spine composition; defaults: 2 retries, 500ms→10s backoff).
- id: llm-retry
  name: '@deepseek-ai/dsh-llm-retry'

# Session store root. AppCLIEntry resolves the engineering default to a
# global dir under the Harness home ($DSH_HOME, else ~/.dsh): sessions live
# in one place across every cwd, not a project-local ./.sessions. The
# persistenceRoot profile key (user config) still overrides this per field.
- id: session-persistence-jsonl
  name: '@deepseek-ai/dsh-session-persistence-jsonl'
  config:
    root: './.sessions'

- id: storage
  name: '@deepseek-ai/dsh-storage'

- id: storage-json
  name: '@deepseek-ai/dsh-storage-json'
  config:
    root: './.storages'

- id: storage-domain
  name: '@deepseek-ai/dsh-storage-domain'
  config:
    backend: json

- id: workspace
  name: '@deepseek-ai/dsh-workspace'

# Persisted projection cache: durable per-session checkpoints of every
# registered projection unit (json backend → ./.storages/session_projcache.json,
# beside workspace.json), throttled between the two mandatory points
# (turn/end + detach), serving cold listings without full-log loads.
- id: session-projection-cache
  name: '@deepseek-ai/dsh-session-projection-cache'
  config:
    writeEveryEvents: 200
    writeIntervalMs: 5000

# Managed child-process groups for the bash executor (spawn/kill/output plumbing).
- id: subprocess
  name: '@deepseek-ai/dsh-subprocess-local'

# The sandboxed product path (the acp-agent composition): per-platform
# runner provider, the shared policy home, the confined bash executor, and
# the approval seam its escalation asks through. The web deployment default
# is danger-full-access + never (same behavior as the former bash-local
# rows); DSH_PERMISSION_MODE opts a process into a confined default, and
# per-session switches ride the /permission command's knob events.
- id: sandbox
  name: '@deepseek-ai/dsh-sandbox-local'

- id: sandbox-policy
  name: '@deepseek-ai/dsh-sandbox-policy'
  config:
    mode: !!js process.env.DSH_PERMISSION_MODE ?? 'danger-full-access'
    workspaceRoot: !!js process.cwd()

- id: bash-sandbox
  name: '@deepseek-ai/dsh-bash-sandbox'

- id: approval
  name: '@deepseek-ai/dsh-user-approval'
  config:
    policy: !!js "(process.env.DSH_PERMISSION_MODE ?? 'danger-full-access') === 'danger-full-access' ? 'never' : 'ask'"

# Presets over the two knobs (requires the confining executor + approval):
# the web permission chip's table, served through the permissions projection
# and switched through /permission.
- id: permission
  name: '@deepseek-ai/dsh-permission'
  config:
    presets:
      read-only:
        sandbox: read-only
        approval: ask
      workspace-write:
        sandbox: workspace-write
        approval: ask
      danger-full-access:
        sandbox: danger-full-access
        approval: never

- id: tool-bash
  name: '@deepseek-ai/dsh-tool-bash'

- id: tool-todo
  name: '@deepseek-ai/dsh-tool-todo'

- id: tool-tasks
  name: '@deepseek-ai/dsh-tool-tasks'

# fs cwd stays the package default (process.cwd()) — the same value the
# gateway injects into session.cwd, so paths and sessions agree. The
# sandboxed backend rides the SAME policy as bash: write/edit fence by the
# effective mode, so read/write/edit stay available under every mode.
- id: fs-sandbox
  name: '@deepseek-ai/dsh-fs-sandbox'

- id: fs-policy
  name: '@deepseek-ai/dsh-fs-policy'

- id: tool-fs
  name: '@deepseek-ai/dsh-tool-fs'

- id: tool-fs-search
  name: '@deepseek-ai/dsh-tool-fs-search'

- id: workspace-context
  name: '@deepseek-ai/dsh-workspace-context'
  config:
    maxBytes: 65536

- id: skill
  name: '@deepseek-ai/dsh-skill'

- id: skill-local
  name: '@deepseek-ai/dsh-skill-local'

- id: tool-skill
  name: '@deepseek-ai/dsh-tool-skill'

# Host command registry: the single source of truth behind command.list /
# command.execute; the web '/' menu is a pure projection of this registry.
- id: commands
  name: '@deepseek-ai/dsh-commands'

# Goal service + automatic same-session continuation + the /goal command.
# The GoalService registers the 'goal' session projection unit; the web
# GoalBar reads it through useProjection.
- id: goal
  name: '@deepseek-ai/dsh-goal'

- id: goal-session
  name: '@deepseek-ai/dsh-goal-session'

- id: command-goal
  name: '@deepseek-ai/dsh-command-goal'

# Plan mode registers /plan (the first real command on the web surface).
# Section text mirrors examples/tui-agent/cordis.yml (the reference
# deployment); plan-mode throws at load on an empty section.
- id: plan-mode
  name: '@deepseek-ai/dsh-plan-mode'
  config:
    section: |
          You are in plan mode. Stay in plan mode until exit_plan_mode succeeds or the user switches the session mode. Imperative language to implement changes means plan the implementation, not execute it. A user's conversational agreement — including an answer confirming something you asked — approves nothing and does not end plan mode; fold the confirmed decision into the plan and submit it through exit_plan_mode.

          Explore first. Use non-mutating reads, searches, static analysis, and checks to ground the plan in the actual repository. Do not edit or write files, change configuration, run formatters or code generation that rewrites tracked files, commit, or otherwise carry out the plan. Prefer existing functions and patterns over new machinery.

          The tool catalog stays the same across modes for request-cache stability. These plan-mode rules override any later tool description or guidance that suggests using mutation tools; those tools remain listed only to keep the request shape stable. Do not use todo_write to track this planning phase: it tracks implementation after an approved plan, while the plan itself belongs in exit_plan_mode.

          Resolve discoverable facts by inspection. Use ask_user_question only for user-owned choices or material ambiguity that inspection cannot answer. Do not ask the user where code lives or how current behavior works when you can find out.

          Make the plan decision-complete: state the goal and success criteria; group implementation changes by subsystem; identify public API, schema, and data-flow changes; cover edge cases, failure modes, tests, acceptance criteria, and explicit assumptions. Keep it concise enough to review but detailed enough that another engineer can implement it without making design decisions.

          When ready, call exit_plan_mode with the complete plan markdown, starting with a # title. Make exit_plan_mode the only and final tool call in that assistant response: it presents the plan for approval, and implementation begins only in a later step after approval. Do not paste the final plan as a plain reply or ask "should I proceed?" through prose or ask_user_question. If review rejects it, incorporate the feedback and present again. If the review channel is unavailable or aborted, stay in plan mode and ask the user to switch modes manually; do not proceed with implementation.

# token-meter rejects unknown config keys — keep this row bare.
- id: token-meter
  name: '@deepseek-ai/dsh-token-meter'

- id: compact-basic
  name: '@deepseek-ai/dsh-compact-basic'

- id: subagent
  name: '@deepseek-ai/dsh-subagent'

- id: subagent-spawn
  name: '@deepseek-ai/dsh-subagent-spawn'
  config:
    providerName: spawn

- id: subagent-fork
  name: '@deepseek-ai/dsh-subagent-fork'
  config:
    providerName: fork

- id: tool-subagent
  name: '@deepseek-ai/dsh-tool-subagent'
  config:
    provider: spawn
    toolName: subagent

- id: tool-subagent-fork
  name: '@deepseek-ai/dsh-tool-subagent'
  config:
    provider: fork
    toolName: subagent_fork

- id: workflow-workerthread
  name: '@deepseek-ai/dsh-workflow-workerthread'
  config:
    provider: spawn

- id: tool-workflow
  name: '@deepseek-ai/dsh-tool-workflow'

- id: timeout-policy
  name: '@deepseek-ai/dsh-timeout-policy'

- id: spill-local
  name: '@deepseek-ai/dsh-spill-local'

# Omitting maxInlineBytes makes the whole policy a silent no-op — always
# state it explicitly.
- id: spill-policy
  name: '@deepseek-ai/dsh-spill-policy'
  config:
    maxInlineBytes: 50000

# The API gateway: the transport-agnostic dispatch face every client shape
# shares. provider/model are the host default routing — the profile json's
# mapping target (user config overrides these engineering defaults).
# Directory-picking package, dual-face: the node half serves the gateway's
# host.* picker RPCs, the browser half fills ui-workspace's directory-flow
# slots — one row composes the whole interaction. Swap point: mount
# '-native' instead for the host-display OS chooser.
- id: directory-picker
  name: '@deepseek-ai/dsh-host-directory-picker-browse'

- id: api-gateway
  name: '@deepseek-ai/dsh-host-apiproxy'
  config:
    provider: deepseek
    model: deepseek-v4-flash

# ── layer 2: transport/service ──────────────────────────────────────────────

# Plain route-registration carrier. distIndex is an assembly fact, not user
# config — AppCLIEntry resolves the frontend dist and patches it in; host and
# port arrive as CLI-flag patches over these defaults.
- id: webserver
  name: '@deepseek-ai/dsh-host-webserver'
  config:
    host: 127.0.0.1
    port: 3080

# ── browser plugin roster (dshClient rows; node halves are layer-2 hosts) ──

# Dual-face: node half scans this very tree for dshClient rows, composes
# window.__DSH_BOOT__, serves /plugins/<id>/client.js; browser half is the
# module table the shell kernel constructs before cordis exists (§4.7 —
# adopted as a plugin entry by the kernel, never fetched).
- id: modules
  name: '@deepseek-ai/dsh-client-modules'

# Owns both ends of the web transport: node half binds the gateway to the
# webserver under /api; browser half is the fetch/SSE client.
- id: connection
  name: '@deepseek-ai/dsh-client-connection'

- id: client-runtime
  name: '@deepseek-ai/dsh-client-runtime'

- id: ui-theme
  name: '@deepseek-ai/dsh-client-ui-theme'

- id: locale
  name: '@deepseek-ai/dsh-client-locale'

- id: ui-layout
  name: '@deepseek-ai/dsh-client-ui-layout'

- id: ui-sidebar
  name: '@deepseek-ai/dsh-client-ui-sidebar'

- id: ui-settings
  name: '@deepseek-ai/dsh-client-ui-settings'

- id: ui-settings-general
  name: '@deepseek-ai/dsh-client-ui-settings-general'

- id: ui-models
  name: '@deepseek-ai/dsh-client-ui-models'

- id: ui-conversation
  name: '@deepseek-ai/dsh-client-ui-conversation'


- id: ui-workspace
  name: '@deepseek-ai/dsh-client-ui-workspace'

# Input triggers: the '/' | '@' pipeline (ui-slash), the command surface over
# it (ui-command), and the two reference sources (ui-skill / ui-subagent).
- id: ui-slash
  name: '@deepseek-ai/dsh-client-ui-slash'

- id: ui-command
  name: '@deepseek-ai/dsh-client-ui-command'

- id: ui-skill
  name: '@deepseek-ai/dsh-client-ui-skill'

- id: ui-subagent
  name: '@deepseek-ai/dsh-client-ui-subagent'

# Goal surface: GoalBar in the input dock over the goal session projection.
- id: ui-goal
  name: '@deepseek-ai/dsh-client-ui-goal'

# Model selection: the /model popupSelect + composer seat over session.models.
- id: ui-model
  name: '@deepseek-ai/dsh-client-ui-model'

# The /permission popup picker (hostBacked over the host /permission command).
- id: ui-permission
  name: '@deepseek-ai/dsh-client-ui-permission'

# Plan control: the composer plan seat over the plan projection + /plan channel.
- id: ui-plan
  name: '@deepseek-ai/dsh-client-ui-plan'

- id: ui-question
  name: '@deepseek-ai/dsh-client-ui-question'

- id: ui-trajectory
  name: '@deepseek-ai/dsh-client-ui-trajectory'