feat: native DSH ACP backend with compact tools and reliable session events

[kui123456789]

What changes

Add DeepSeek Harness (DSH) as an opt-in native ACP backend to the existing ComfyUI MCP orchestrator. A user with an already-configured DSH CLI can select its models from the companion Agent Panel, keep DSH session history and memory, and operate ComfyUI through the existing MCP servers.

Proposal: #2938. Companion panel: artokun/comfyui-mcp-panel#2304.

I have read the sunset notice. This contribution is offered for review/merge or reuse by a successor; it does not assume the project will resume releases. Prepared with AI assistance (OpenAI Codex).

ACP runtime and configuration

• Add dsh-discovery.ts, dsh-transport.ts, dsh-profile.ts, and dsh-backend.ts, using @agentclientprotocol/sdk@1.4.0 rather than a private DSH Web protocol.
• Discover DSH on the orchestrator host: explicit executable/home overrides, PATH, standard installations, a validated hint, or same-user Linux processes. Resolve Windows npm shims to a JavaScript entry without passing user paths to a shell.
• Start the existing CLI with --profile acp; use a temporary startup/settings overlay for the exact provider/model. DSH reads its own credentials. Consume child diagnostics without forwarding raw provider bodies to the browser.
• For a fresh/default ACP profile, reuse installed official components and a previously selected Mnemon bundle. Preserve customized profiles. Disable Mnemon only in catalog-probe processes so model enumeration does not launch background memory reviews.
• Support standard session creation/resume, model and reasoning-effort options, permission-card forwarding, cancellation and process teardown. Model changes reconnect with the same session ID so the negotiated vision capability matches the selected route.

Correctness fixes included with the adapter

Trigger	Previous prototype behavior	Included behavior
Resume fails	Risk of a new conversation being created by generic recovery	Retain identity and surface the error; do not substitute a fresh session
Transport fails after a prompt	A generic retry could duplicate a tool action	Do not automatically replay the turn; preserve history and ask the user to reconcile an existing prompt ID
The same session gets two in-process owners	Conflicting execution channels	Reject the second owner and release ownership on close
A tool call separates two model replies	Final summary reused the first thought bubble	Commit the pre-tool segment, close thought-only segments, assign a new ID after the tools
ACP reports used tokens and capacity	Token number updated but ring ratio was absent	Forward session-scoped used/capacity/ratio and derive a ratio for cached snapshots
Image-bearing turn	Capability mismatch or an oversized request	Check negotiated capability and blind mode; bounded image read/resize and 4 MiB turn budget

Image processing uses the repository's requireSharp entry point. Error messages are categorized/redacted and do not expose upstream credentials or endpoints. No private DSH history deletion or cross-Web execution API is introduced.

Prompt and tool budget

• Pin only the DSH lane to compact ComfyUI tools, even if the shared environment says full. All business tools remain available through list_tools, describe_tool, and call_tool.
• Add editable panel.persona.dsh, separate from the shared persona. Load detailed model/operation skills on demand, require live panel tools for canvas actions, and do not turn an image-read failure into a new generation.
• Limit the full DSH append including environment/capability notes to 8 KiB. Oversized custom instructions produce an explicit error; user text is not truncated. Inject this preamble only on the first turn of a new session, never again on resume.
• The historical prototype measured 78,352 → 18,322 first-input tokens including cache reads, 41 initial ComfyUI declarations → 3 routers, and a 5,970-byte append. These are same-model/workspace measurements, not a universal guarantee or measurements generated by this PR's CI.

Validation

• npm run build and npm run lint: passed.
• 73 targeted tests passed, including DSH discovery/profile/session behavior, prompt isolation, message ordering, usage updates, error redaction, inherited-MCP wiring and the sharp-loader invariant.
• Final full npm test: 14,321 tests passed, 5 failed (783 test files). All 12 non-changelog static/documentation gates passed. The overall command exits 1; this is not a green full-suite claim.
• Four failing cases also reproduced on clean upstream 1d5b12b1: late-mutation-e2e, panel-template-relay-production, skills-access-panel-template-relay.integration, and divergent-install-reachable. The fifth, the model-management pending-visibility case, passed when rerun individually on both this branch and clean upstream; its full-suite failure remains disclosed as an unresolved intermittent result.
• check:changelog also fails unchanged on clean upstream: release 0.52.203 omits shipped PR chore: remove docker/ and the anti-slop lint tooling #2928. No unrelated release-history rewrite is included.
• The production prototype was separately exercised against DSH 0.1.5-rc.1. This PR rebases the portable subset onto current main; it is not a copy of the deployment's complete patched dist tree.

Compatibility and review boundaries

The panel companion is needed for the DSH picker, raw token readout, think_end and process presentation. Upstream shared-conversation behavior is retained: a fresh browser tab is not an isolated production test. Use a separate orchestrator or injected ACP fixtures.

The ownership guard is process-local; do not execute the same session concurrently in DSH Web. Audio input, private Web thinking snapshots, backend history deletion, launcher/service rewrites, background-session architecture changes, model downloads and node-management changes are outside this PR. The raw turn-size guard does not bound the provider's entire historical context.

No credentials, private sessions, workstation/server addresses, model weights, generated media or deployment backups are included. The release version remains upstream-controlled. See NATIVE-DSH.md for setup, capabilities, measurement context and limitations.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[artokun]

Limited maintenance audit — October 1, 2026.

Scope: a new DSH provider and ACP transport are explicitly outside limited maintenance. This is a scope decision, not a judgment against the contribution; the branch remains available for reuse.

Closing this PR does not close or mark the underlying bug as fixed. Conflicts and age were not used as quality criteria. Automatic issue reporting remains disabled.