dsh-capsule

LIMITATIONS

已知限制

Messages are strict, length-prefixed JSON with frame-byte limits; descriptor schemas additionally have depth and node-count limits. Time, concurrency, queue, stderr, prompt, and description limits are deployment-controlled. `describe` activates one fresh process only long enough to return immutable tool schemas and static prompt text. Each invocation activates a different process, revalidates the same descriptors, executes exactly one tool, completes an explicit shutdown handshake, and joins the managed process tree. Guest process state is therefore ephemeral. A read-only workspace file remains Host-owned and may change through trusted external activity, but the guest cannot use it to persist writes. Private persistent storage and all network or subprocess capabilities are unsupported in v0.1. Capsule guests are a distinct API and are not transparent replacements for arbitrary Cordis plugins. Read the [RFC](docs/RFC.md) for the exact protocol and lifecycle, and the dated [ecosystem review](docs/ECOSYSTEM_REVIEW.md) for the project scope.