The naming trapACP calls the update `agent_message_chunk`, but rc.8 emits it from a committed message. The wire label does not prove token-by-token streaming.

What works today.

Fresh Sessions

One absolute cwd and one Agent per `session/new`.

Text prompts

Baseline text and flattened resource links.

Cancellation

Addressed work settles as cancelled.

One-shot permission

Machine policy can allow or reject one retry.

What stays off the wire.

Progressraw deltas + reasoning

No live tokens, thinking, tool cards, plans, titles, or usage.

Historyload + resume + fork

A new process cannot restore the prior ACP thread.

Host contextMCP + extra roots

Non-empty forwarded servers and additional directories reject.

Use a disposable source-demo probe.

Zed can launch a custom ACP process, but that is not proof DSH is a registry-supported editor integration. Keep stdout protocol-pure and credentials outside editor settings.

A complete bridge needs three contracts.

Stream retry-safe deltas and stable tool lifecycles; resume one exact persisted Session without duplicate replay; and advertise only capabilities whose workspace, MCP, permission, trust, and billing boundaries DSH actually enforces.

Primary evidence.

Test the boundary, not the badge.

The complete guide includes ACP/MCP/SDK routing, a capability ledger, source-demo and Zed probes, current message timing, trust boundaries, implementation requirements, and twelve acceptance gates.

Read the complete guide