@ckanner/flywheel 0.33.0 → 0.34.0

package/CHANGELOG.md

@@ -5,6 +5,38 @@ results are recorded separately in the [release runbook](docs/en/releasing.md)
 and [validation index](docs/validation/README.md). Historical entries retain
 their original language.
 
+## 0.34.0 — Native harness capabilities
+
+- Align native companion fixtures and provenance with published Codex 0.10.0, Claude 0.5.0, LCU 0.5.0 and ChatGPT 0.1.20; verify the exact registry Claude tarball in CI and release jobs. Document separate desktop, worker and SDK dependency trees.
+
+- Add versioned native profiles across loops, routes, model profiles, second
+  opinions and allowed execution bindings, including workbench selection,
+  frozen history identity, durable native receipts and import-only diagnostics.
+- Run DSH PTC composition from the shared generator with actual behavior probes,
+  native subagents/Team/Workflow and managed LCU. Serialize desktop ownership,
+  retain epoch-safe handles and durable media, and prove journal/physical cleanup.
+- Add an owned Kimi Server worker for Agent/Swarm/Tower. Use independent Tower
+  Git candidates, preserve dirty/untracked/binary changes and transfer only after
+  completion, cleanup and source/contract checks.
+- Integrate Codex Pro 0.10.0 and Claude Code Pro 0.5.0 native controls, child events
+  and truthful accounting. Add independent Review/interactive Team job commands;
+  unknown cloud work, child usage and cleanup never become inferred success.
+- Preserve role independence, explicit accounts/permissions and existing JEV
+  controls. Keep one complete npm package, bundle generator 0.4.0 and record the
+  reviewed companion source artifacts without claiming registry publication.
+- Refresh the bundled generator to create a profile's first preset patch or a
+  new output file, preserving existing settings and concurrent file creation.
+
+## 0.33.1 — Strict desktop read codecs
+
+- Fix task discovery and configuration reads rejected by the actual DSH Client
+  Gateway. Supply strict schema factories for session identity, read requests and
+  result envelopes; consume the dynamic namespace through an owned injected
+  scope, use the host Agent registry's `agentId` wire field, and preserve session
+  isolation, teardown and silent reads.
+- Exercise the shipped Client descriptor through the real public Client and Host
+  Gateway on both supported host fixtures instead of mocking Remote mounting.
+
 ## 0.33.0 — One complete npm distribution
 
 - Consolidate the CLI, DSH host/client, workers, embedded skills and four native

package/README.md

@@ -27,6 +27,7 @@ retries, budgets, workspaces, and delivery. Use it from the DeepSeek Harness
 - **Coordinates bounded parallel execution.** Packets with explicit
   dependencies and non-overlapping write scopes can execute concurrently;
   review and integration remain coordinated by the engine.
+- **Uses native harness capabilities.** Select PTC Agents/Teams, Kimi Swarm/Tower, Codex agents, Claude Workflows or managed LCU per role; see [native capabilities](docs/en/native-capabilities.md).
 - **Provides a desktop workbench.** Inspect task progress, evidence, sessions,
   run history, and configuration from DSH's native Flywheel view.
 - **Makes failures visible.** Unknown execution, usage, or cleanup stays

package/README.zh-CN.md

@@ -22,6 +22,8 @@ Flywheel 是面向 coding agent 的确定性 Go 编排器。模型负责规划
 - **提供桌面工作台。** 在 DSH 原生 Flywheel 视图中查看任务进度、证据、会话、运行记录和配置。
 - **明确呈现失败。** 未知执行结果、用量或清理状态保持未知；无法安全继续时保留成果并停止。
 
+原生能力可以按阶段配置：DSH PTC／Team、Kimi Swarm／Tower、Codex agents、Claude Workflow 和受管 LCU。入口、依赖和实际运行边界见[原生能力指南](docs/zh-CN/native-capabilities.md)。
+
 ## 安装
 
 使用桌面入口前，请准备 **Node.js 22.18.0 或更高版本**、npm、Git，以及带可用 `dsh` 命令的受支持 DSH 桌面。插件采用 **DSH 0.2 兼容系列**范围，从 **0.2.1-rc.5** 起，到 **0.3.0 的任何预发布版之前**；范围内常规 rc／补丁升级无需重新发布 Flywheel。还需准备所选模型路由使用的账号和 CLI 工具。DSH 自身可能要求更高版本的 Node；DSH 0.2.2 SDK 要求 Node 24.9 或更高。

package/THIRD_PARTY_NOTICES.md

@@ -39,4 +39,8 @@ SOFTWARE.
 
 ## Bundled Codex Pro public package
 
-This distribution bundles `dsh-subagent-codex-pro@0.9.0`, Copyright (c) 2026 ckanner, under the MIT License. Its complete license is retained at `node_modules/dsh-subagent-codex-pro/LICENSE` inside the complete package. Source identity and tarball integrity are recorded in `plugins/dsh/vendor/README.md` and `plugins/dsh/vendor/codex-pro.json` in the source repository. The bundled package is the upstream public machine API implementation, including its compiled supervisor; it contains no native Codex executable or user credentials.
+This distribution bundles `dsh-subagent-codex-pro@0.10.0`, Copyright (c) 2026 ckanner, under the MIT License. Its complete license is retained at `node_modules/dsh-subagent-codex-pro/LICENSE` inside the complete package. Source identity and tarball integrity are recorded in `plugins/dsh/vendor/README.md` and `plugins/dsh/vendor/codex-pro.json` in the source repository. The bundled package is the upstream public machine API implementation, including its compiled supervisor; it contains no native Codex executable or user credentials.
+
+## Bundled PTC composition source
+
+This distribution also bundles `dsh-preset-generator@0.4.0`, Copyright (c) 2026 ckanner, under the MIT License. Its original license remains at `node_modules/dsh-preset-generator/LICENSE`. The public composition module shares the desktop daily/heavy policy with the owned SDK worker. Source identity and actual tarball integrity are recorded in `plugins/dsh/vendor/preset-generator.json`; no DSH application resources, native executable or credentials are bundled.

package/bin/flywheel-kimi-native-worker.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+"use strict";
+const { loadKimiNativeWorkerPath, runChild } = require('./runtime.js');
+runChild(process.execPath, [loadKimiNativeWorkerPath(), ...process.argv.slice(2)], { label: 'flywheel-kimi-native-worker' })
+  .then(code => { process.exitCode = code; }).catch(error => { console.error(`flywheel-kimi-native-worker: ${error.message}`); process.exitCode = 1; });

package/bin/flywheel.js

@@ -2,7 +2,7 @@
 // Copyright (c) 2026 ckanner. SPDX-License-Identifier: MIT
 "use strict";
 
-const { loadNativePath, loadWorkerPath, loadCodexProWorkerPath, loadClaudeCodeProWorkerPath, assertSupportedNode, runChild } = require("./runtime.js");
+const { loadNativePath, loadWorkerPath, loadCodexProWorkerPath, loadClaudeCodeProWorkerPath, loadKimiNativeWorkerPath, assertSupportedNode, runChild } = require("./runtime.js");
 
 async function main() {
   const args = process.argv.slice(2);
@@ -11,6 +11,10 @@ async function main() {
   }
   assertSupportedNode();
 
+  if (args[0] === 'native') {
+    return (await import('../dist/native-jobs.mjs')).main(args.slice(1));
+  }
+
   const env = { ...process.env };
   // An npm dependency's bin is not necessarily on a desktop application's
   // PATH. Resolve this installation's worker without changing an explicit
@@ -24,6 +28,9 @@ async function main() {
   if (env.FLYWHEEL_CLAUDE_CODE_PRO_WORKER === undefined) {
     env.FLYWHEEL_CLAUDE_CODE_PRO_WORKER = loadClaudeCodeProWorkerPath();
   }
+  if (env.FLYWHEEL_KIMI_NATIVE_WORKER === undefined) {
+    env.FLYWHEEL_KIMI_NATIVE_WORKER = loadKimiNativeWorkerPath();
+  }
   return runChild(loadNativePath(), args, { env });
 }
 

package/bin/runtime.js

@@ -53,6 +53,10 @@ function loadClaudeCodeProWorkerPath() {
   return packageFile('dist/claude-code-pro-worker.mjs');
 }
 
+function loadKimiNativeWorkerPath() {
+  return packageFile('dist/kimi-native-worker.mjs');
+}
+
 function assertSupportedNode(version = process.versions.node) {
   const match = /^(\d+)\.(\d+)\.(\d+)(?:$|-)/.exec(version);
   if (!match || Number(match[1]) < 22 || (Number(match[1]) === 22 && Number(match[2]) < 18)) {
@@ -97,4 +101,4 @@ function runChild(command, args, { env = process.env, cwd, label = "flywheel" }
   });
 }
 
-module.exports = { loadNativePath, loadWorkerPath, loadCodexProWorkerPath, loadClaudeCodeProWorkerPath, assertSupportedNode, runChild };
+module.exports = { loadNativePath, loadWorkerPath, loadCodexProWorkerPath, loadClaudeCodeProWorkerPath, loadKimiNativeWorkerPath, assertSupportedNode, runChild };

package/dist/bridge.mjs

@@ -1,13 +1,18 @@
 import { spawn } from 'node:child_process';
 import { randomUUID } from 'node:crypto';
-import { mkdtemp, realpath, rm, writeFile } from 'node:fs/promises';
+import { mkdtemp, realpath, rm, writeFile, readFile, open } from 'node:fs/promises';
+import { constants } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { validatePrepare, matchWarmStart, writeWarmReceipt } from './prewarm.mjs';
 import { BridgeError, MAX_FRAME_BYTES, normalizedError, readPolicyReceipt, record, SESSION_PROTOCOL, SessionFold, validateStart } from './protocol.mjs';
+import { nativeOverlay } from './native-policy.mjs';
+import { NativeTree } from './native.mjs';
+import { acquireGuiLease, settleGuiLease } from './native-resources.mjs';
 
 export function makeOverlay(request, policyPath = fileURLToPath(new URL('./policy.mjs', import.meta.url)), admission = {}, historyRoot) {
+  const native = request.native ? nativeOverlay(request, admission.runtimeProfile ?? 'sdk') : null;
   // Each patch replaces an entire config row. Pin the checked rc.5/rc.1 enforcement
   // implementations, not the user's mutable permission dropdown defaults.
   const disable = ['permission', 'tool-plugin-manager', 'tool-working-directory',
@@ -17,6 +22,7 @@ export function makeOverlay(request, policyPath = fileURLToPath(new URL('./polic
     'session-title-llm', 'tool-web', 'compaction-basic', 'command-compact', 'hmr'];
   return [
     ...disable.map(id => ({ id, disabled: true })),
+    ...(native?.overlay ?? []),
     ...(historyRoot ? [{ id: 'session-persistence-jsonl', config: { root: historyRoot } }] : []),
     { id: 'sandbox', name: '@deepseek-ai/dsh-sandbox-local', disabled: false, config: {} },
     { id: 'sandbox-policy', name: '@deepseek-ai/dsh-sandbox-policy', disabled: false,
@@ -28,6 +34,8 @@ export function makeOverlay(request, policyPath = fileURLToPath(new URL('./polic
     { id: 'sdk-jsonrpc-server', config: { maxTokensAsSuccess: false } },
     { insert: [{ id: 'flywheel-worker-policy', name: policyPath,
       config: { permissionMode: request.permissionMode, cwd: request.cwd,
+        ...(native ? { native: request.native, managed: request.managed, composition: native.composition,
+          provider: request.provider, model: request.model, reasoningEffort: request.reasoningEffort, resuming: Boolean(request.sessionId) } : {}),
         ...(request.workspaceCwd ? { workspaceCwd: request.workspaceCwd } : {}),
         ...(!request.sessionId && request.sessionTitle ? { sessionTitle: request.sessionTitle } : {}), ...admission } }] },
   ];
@@ -55,6 +63,26 @@ async function abortable(promise, signal) {
   }
 }
 
+export async function readNativeEvents(directory, identity, summary) {
+  const file = await open(join(directory, 'native-events.jsonl'), constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+  let events;
+  try {
+    const stat = await file.stat();
+    if (!stat.isFile() || stat.size > 2 * 1024 * 1024) throw new Error('native runtime evidence exceeds its bounded receipt');
+    events = await file.readFile('utf8');
+  } finally { await file.close(); }
+  const bytes = Buffer.byteLength(events);
+  if (bytes > 2 * 1024 * 1024 || (bytes && !events.endsWith('\n'))) throw new Error('native runtime evidence is incomplete or oversized');
+  const values = events.split('\n').filter(Boolean).map(line => JSON.parse(line));
+  if (values.length > 4096 || values.some((value, index) => !record(value) || value.version !== 1 ||
+      value.journalSequence !== index + 1 || value.requestId !== identity.requestId || value.nonce !== identity.nonce ||
+      value.rootSessionId !== identity.rootSessionId)) throw new Error('native runtime evidence has invalid sequence or invocation ownership');
+  if (summary !== undefined && (!record(summary) || summary.complete !== true || summary.events !== values.length || summary.bytes !== bytes)) {
+    throw new Error('native runtime journal did not confirm complete durable evidence');
+  }
+  return values;
+}
+
 /** A bounded JSON-RPC transport. It does not own a new process group. */
 export class Runtime {
   constructor(bin, args, options, notify) {
@@ -144,7 +172,7 @@ export class Runtime {
     });
   }
 
-  async close() {
+  async close({ graceMs = 2000 } = {}) {
     // The Go watchdog owns the whole inherited process group. We request the
     // SDK's child-first drain and bound the leader wait; Go performs the final
     // group sweep even on normal exit. A child must not detach/setsid.
@@ -154,7 +182,7 @@ export class Runtime {
       // SDK shutdown includes persistent history flush and plugin disposal.
       // Keep this bounded below Go's default 5s cancellation grace, while
       // allowing a normal fsync to complete under concurrent local workloads.
-      await bounded(this.exited, 2000);
+      await bounded(this.exited, graceMs);
     }
     if (!this.exit) {
       forced = true;
@@ -184,6 +212,10 @@ export async function runWorker(input, { emit, env = process.env, signal, doctor
   let temp;
   let sessionId;
   let fold;
+  let nativeTree, guiLease, nativeCleanup, nativeAdmission, policyIdentity;
+  let nativeRuntimeEvents = [];
+  let completionAtRootEnd;
+  let nativeAttempted = false;
   let outcome;
   let failure;
   let cancelled = false;
@@ -232,9 +264,24 @@ export async function runWorker(input, { emit, env = process.env, signal, doctor
     sessionId = prepared ? undefined : request.sessionId ?? `flywheel-${randomUUID()}`;
     const admission = { receiptPath: join(temp, 'policy.json'), requestId: prepared ? prepared.warmId : request.requestId,
       ...(prepared ? { deferredAdmissionPath: join(temp, 'admission.json') } : { sessionId }), nonce: randomUUID() };
+    policyIdentity = { requestId: admission.requestId, nonce: admission.nonce };
+    if (!prepared && request.native?.lcu?.enabled) {
+      guiLease = await acquireGuiLease(request.managed, { env, signal: controller.signal });
+      request = { ...request, managed: { ...request.managed, lease: guiLease } };
+    }
+    if (request.native) admission.runtimeProfile = profile;
     await writeFile(patch, JSON.stringify(makeOverlay(request, undefined, admission, doctor ? join(temp, 'probe-history') : undefined)), { mode: 0o600 });
     controller.signal.throwIfAborted();
     if (!prepared) fold = new SessionFold(sessionId, { strict: request.protocol === 2 });
+    const observeNative = event => {
+      const eventFrame = { type: 'native-event', sessionId, event };
+      if (readySent) frame(eventFrame);
+      else {
+        beforeReady.push(eventFrame);
+        if (beforeReady.length > 256) throw new BridgeError('TRANSPORT', 'excessive native events before readiness');
+      }
+    };
+    if (!prepared && request.native) nativeTree = new NativeTree(sessionId, request.native, observeNative);
     runtime = new Runtime(bin, ['--profile', profile, '--patch', patch], {
       cwd: request.cwd,
       env: { ...env, DSH_PERMISSION_MODE: request.permissionMode,
@@ -252,7 +299,8 @@ export async function runWorker(input, { emit, env = process.env, signal, doctor
           if (beforeReady.length > 256) throw new BridgeError('TRANSPORT', 'excessive SDK events before readiness');
         }
       }
-      if (method === 'subagent.started' && params?.parentSessionId === sessionId) {
+      if (nativeTree) nativeTree.notify(method, params);
+      else if (method === 'subagent.started' && params?.parentSessionId === sessionId) {
         throw new BridgeError('INVALID_REQUEST', 'DSH child delegation is disabled: the Go engine owns workers');
       }
     });
@@ -284,12 +332,18 @@ export async function runWorker(input, { emit, env = process.env, signal, doctor
       deadline = setTimeout(() => controller.abort(new BridgeError('TIMEOUT', 'DSH worker lifecycle deadline exceeded')), formalBudget);
       request = await abortable(validateStart(next), controller.signal);
       matchWarmStart(prepared, request);
+      if (request.native?.lcu?.enabled) {
+        guiLease = await acquireGuiLease(request.managed, { env, signal: controller.signal });
+        request = { ...request, managed: { ...request.managed, lease: guiLease } };
+      }
       sessionId = request.sessionId ?? `flywheel-${randomUUID()}`;
       fold = new SessionFold(sessionId, { strict: request.protocol === 2 });
+      if (request.native) nativeTree = new NativeTree(sessionId, request.native, observeNative);
       await writeFile(admission.deferredAdmissionPath, JSON.stringify({ requestId: admission.requestId,
-        nonce: admission.nonce, sessionId, ...(!request.sessionId && request.sessionTitle ? { sessionTitle: request.sessionTitle } : {}) }),
+        nonce: admission.nonce, sessionId, ...(request.native ? { managed: request.managed, resuming: Boolean(request.sessionId) } : {}), ...(!request.sessionId && request.sessionTitle ? { sessionTitle: request.sessionTitle } : {}) }),
       { mode: 0o600, flag: 'wx' });
     }
+    nativeAttempted = Boolean(request.native);
     if (request.sessionId !== undefined) {
       // Public SDK resume restores exactly this identity, without a new input
       // and without a replacement on failure. A generic RPC error cannot tell
@@ -314,6 +368,8 @@ export async function runWorker(input, { emit, env = process.env, signal, doctor
       throw new BridgeError('INVALID_REQUEST', 'DSH session project workspace differs from the requested project');
     }
     fold.verifiedPolicy(request);
+    nativeAdmission = fold.policy.native;
+    if (request.native && nativeAdmission?.matched !== true) throw new BridgeError('INVALID_REQUEST', 'native runtime did not attest its effective capabilities');
     frame({ type: 'ready', sessionId, cwd: request.cwd, ...(request.workspaceCwd ? { workspaceCwd: request.workspaceCwd } : {}), provider: request.provider, model: request.model,
       ...(request.reasoningEffort === undefined ? {} : { reasoningEffort: request.reasoningEffort }),
       permissionMode: request.permissionMode, approvalPolicy: 'never',
@@ -347,13 +403,19 @@ export async function runWorker(input, { emit, env = process.env, signal, doctor
       }
       waited = true;
       outcome = fold.finish(receipt.messageId);
+      if (nativeTree) {
+        nativeRuntimeEvents = await readNativeEvents(temp, { ...policyIdentity, rootSessionId: sessionId });
+        nativeTree.observeRuntime(nativeRuntimeEvents);
+        completionAtRootEnd = nativeTree.completion();
+        if (!completionAtRootEnd.confirmed) throw new BridgeError('TRANSPORT', 'Native children remain active at root completion');
+      }
     }
   } catch (error) {
     if (!warmClosed) failure = normalizedError(error);
   } finally {
     if (runtime) {
       try {
-        const exit = await runtime.close();
+        const exit = await runtime.close({ graceMs: request?.native?.lcu?.enabled ? 135000 : request?.native ? 15000 : 2000 });
         if (exit.spawned && (exit.forced || exit.code !== 0 || exit.signal || !exit.graceful)) {
           settled = false;
           failure ??= { code: 'TRANSPORT', message: 'DSH runtime did not prove graceful shutdown of its managed processes' };
@@ -376,6 +438,23 @@ export async function runWorker(input, { emit, env = process.env, signal, doctor
     if (request && Date.now() - started > request.timeoutMs && !cancelled) {
       failure = { code: 'TIMEOUT', message: 'DSH worker lifecycle deadline exceeded (including cleanup)' };
     }
+    if (temp && nativeAttempted) {
+      try {
+        nativeCleanup = JSON.parse(await readFile(join(temp, 'native-cleanup.json'), 'utf8'));
+        if (nativeCleanup.version !== 1 || nativeCleanup.requestId !== policyIdentity.requestId || nativeCleanup.nonce !== policyIdentity.nonce ||
+            nativeCleanup.error !== undefined || nativeCleanup.journal?.complete !== true ||
+            (request.native?.lcu?.enabled && (!Array.isArray(nativeCleanup.cleanup) || nativeCleanup.cleanup.length < 1 ||
+              nativeCleanup.cleanup.some(value => value.cleanup !== 'confirmed' || !value.runtimeExitConfirmed || !value.turnCleanupConfirmed)))) {
+          throw new Error('native runtime did not confirm complete owned cleanup');
+        }
+        nativeRuntimeEvents = await readNativeEvents(temp, { ...policyIdentity, rootSessionId: sessionId }, nativeCleanup.journal);
+        nativeTree.observeRuntime(nativeRuntimeEvents);
+      } catch (error) { settled = false; failure ??= normalizedError(error); }
+    }
+    if (guiLease) {
+      try { await settleGuiLease(guiLease, settled && (!nativeAttempted || Boolean(nativeCleanup)), nativeCleanup ?? null); }
+      catch (error) { settled = false; failure ??= normalizedError(error); }
+    }
     if (temp) await rm(temp, { recursive: true, force: true }).catch(error => {
       failure ??= { code: 'TRANSPORT', message: `could not remove worker overlay: ${error.message}` };
     });
@@ -395,7 +474,10 @@ export async function runWorker(input, { emit, env = process.env, signal, doctor
     type: 'result', status: cancelled ? 'cancelled' : failure ? 'error' : 'ok', settled,
     ...(sessionId ? { sessionId } : {}),
     text: outcome?.text ?? fold?.text ?? '',
-    usage: outcome?.usage ?? null, costUsd: null,
+    usage: nativeTree ? nativeTree.addUsage(outcome?.usage ?? null) : outcome?.usage ?? null, costUsd: null,
+    ...(nativeTree ? { native: { ...nativeTree.receipt(nativeAdmission ?? { matched: false, observed: null },
+      { confirmed: settled, scope: 'owned-sdk-tree', gui: nativeCleanup?.lcu ?? null }), runtimeEvents: nativeRuntimeEvents,
+      completion: completionAtRootEnd ?? { confirmed: false, pendingIds: [] } } } : {}),
     ...(failure ? { error: failure } : {}),
   };
   if ((formalStarted ? request.protocol : input?.protocol) === 2) {

package/dist/claude-code-pro-bridge.mjs

@@ -1,8 +1,9 @@
 // Claude Code is an independent harness, not a DSH native model provider.
 import { createRequire } from 'node:module';
 import { isAbsolute } from 'node:path';
+import { validateNativeAdmission } from './machine-worker.mjs';
 
-export const ADAPTER = Object.freeze({ package: 'dsh-subagent-claude-code-pro', version: '0.4.0', protocol: 1 });
+export const ADAPTER = Object.freeze({ package: 'dsh-subagent-claude-code-pro', version: '0.5.0', protocol: 1 });
 export const LIMITS = Object.freeze({ requestBytes: 1024 * 1024, machineOutputBytes: 1024 * 1024,
   progressBytes: 1024 * 1024, receiptFrameBytes: 8 * 1024 * 1024, admissionMs: 10000 });
 const require = createRequire(import.meta.url);
@@ -19,9 +20,9 @@ export async function loadAdapter() {
   }
   let manifest, api;
   try { manifest = require('dsh-subagent-claude-code-pro/package.json'); }
-  catch { throw new WorkerError('ADAPTER_UNAVAILABLE', 'Install dsh-subagent-claude-code-pro@0.4.0 alongside @ckanner/flywheel; the optional adapter is not installed'); }
+  catch { throw new WorkerError('ADAPTER_UNAVAILABLE', 'Install dsh-subagent-claude-code-pro@0.5.0 alongside @ckanner/flywheel; the optional adapter is not installed'); }
   if (manifest.name !== ADAPTER.package || manifest.version !== ADAPTER.version) {
-    throw new WorkerError('ADAPTER_MISMATCH', 'Claude Code Pro package identity or version does not match the pinned 0.4.0 machine contract');
+    throw new WorkerError('ADAPTER_MISMATCH', 'Claude Code Pro package identity or version does not match the pinned 0.5.0 machine contract');
   }
   try { api = await import('dsh-subagent-claude-code-pro/machine'); }
   catch { throw new WorkerError('ADAPTER_UNAVAILABLE', 'The pinned Claude Code Pro public machine API could not be imported'); }
@@ -29,7 +30,12 @@ export async function loadAdapter() {
       typeof api.runMachine !== 'function' || typeof api.MachineInputError !== 'function' ||
       api.MACHINE_LIFECYCLE_VERSION !== 1 || typeof api.recoverMachine !== 'function' ||
       api.MACHINE_LIFECYCLE_CAPABILITIES?.durableJournal !== true || api.MACHINE_LIFECYCLE_CAPABILITIES?.readOnlyRecovery !== true ||
-      api.MACHINE_LIFECYCLE_CAPABILITIES?.threadReadyBeforeDispatch !== false) {
+      api.MACHINE_LIFECYCLE_CAPABILITIES?.threadReadyBeforeDispatch !== false ||
+      api.MACHINE_NATIVE_VERSION !== 1 || api.MACHINE_NATIVE_CAPABILITIES?.version !== 1 ||
+      api.MACHINE_NATIVE_CAPABILITIES?.agents !== true || api.MACHINE_NATIVE_CAPABILITIES?.workflows !== true ||
+      typeof api.validateNativeReviewRequest !== 'function' || typeof api.validateInteractiveTeamRequest !== 'function' ||
+      typeof api.runNativeReview !== 'function' || typeof api.runInteractiveTeam !== 'function' ||
+      typeof api.recoverNativeJob !== 'function' || typeof api.controlInteractiveTeam !== 'function') {
     throw new WorkerError('ADAPTER_MISMATCH', 'Claude Code Pro does not expose the pinned public machine API');
   }
   return api;
@@ -39,8 +45,9 @@ export async function loadAdapter() {
 export function machineRequest(value, api, env) {
   const lifecycle = value?.protocol === 3;
   const persistent = value?.protocol === 2 || (lifecycle && value.threadMode === 'persistent');
-  const keys = new Set(['type', 'protocol', 'requestId', 'cwd', 'model', 'reasoningEffort', 'permissionMode', 'prompt', 'timeoutMs',
+  const keys = new Set(['type', 'protocol', 'requestId', 'cwd', 'model', 'reasoningEffort', 'permissionMode', 'prompt', 'timeoutMs', 'native', 'managed', 'images', 'outputSchema', 'maxBudgetUsd',
     ...(persistent || lifecycle ? ['threadMode', 'threadId'] : []), ...(lifecycle ? ['recoveryDirectory'] : [])]);
+  if (lifecycle) keys.add('nativeOperation');
   if (value === null || typeof value !== 'object' || Array.isArray(value) || value.type !== 'start' ||
       ![1, 2, 3].includes(value.protocol) || Object.keys(value).some(key => !keys.has(key)) ||
       typeof value.requestId !== 'string' || !value.requestId.trim() || value.requestId.length > 256 || value.requestId.includes('\0') ||
@@ -56,18 +63,60 @@ export function machineRequest(value, api, env) {
   if (value.timeoutMs !== undefined && (!Number.isSafeInteger(value.timeoutMs) || value.timeoutMs < 1 || value.timeoutMs > 2147483647)) {
     throw new WorkerError('INVALID_REQUEST', 'timeoutMs must be a positive safe integer no greater than 2147483647');
   }
+  validateNativeAdmission(value.managed, value.requestId, WorkerError);
   try {
+    if (value.nativeOperation !== undefined) return nativeJobRequest(value, api, env);
     return api.parseMachineRequest({ protocol: 1, requestId: value.requestId, cwd: value.cwd, prompt: value.prompt,
       model: value.model, effort: value.reasoningEffort, permissionMode: 'bypassPermissions',
       sessionMode: persistent ? 'persistent' : 'ephemeral',
       ...(persistent && value.threadId !== undefined ? { sessionId: value.threadId } : {}),
       ...(value.timeoutMs === undefined ? {} : { timeoutMs: value.timeoutMs }),
+      ...(value.native === undefined ? {} : { native: value.native }),
+      ...(value.images === undefined ? {} : { images: value.images }),
+      ...(value.outputSchema === undefined ? {} : { outputSchema: value.outputSchema }),
+      ...(value.maxBudgetUsd === undefined ? {} : { maxBudgetUsd: value.maxBudgetUsd }),
       command: env.FLYWHEEL_CLAUDE_BIN || 'claude', maxOutputBytes: LIMITS.machineOutputBytes });
   } catch (error) {
     throw new WorkerError('INVALID_REQUEST', error instanceof api.MachineInputError ? error.message : 'Invalid Claude Code Pro machine request');
   }
 }
 
+/** Independent operations have their own public API, fresh identity and journal. */
+function nativeJobRequest(value, api, env) {
+  const op = value.nativeOperation;
+  const common = { protocol: 1, requestId: value.requestId, cwd: value.cwd,
+    command: env.FLYWHEEL_CLAUDE_BIN || 'claude', ...(value.timeoutMs === undefined ? {} : { timeoutMs: value.timeoutMs }) };
+  if (!op || typeof op !== 'object' || Array.isArray(op) || value.threadMode !== 'ephemeral' || value.threadId !== undefined ||
+      value.images !== undefined || value.outputSchema !== undefined || value.maxBudgetUsd !== undefined) {
+    throw new api.MachineInputError('native operations require a fresh independent request without query-only media, schema or budget controls');
+  }
+  let request;
+  if (op.kind === 'remote-review') {
+    if (Object.keys(op).some(key => !['kind', 'target', 'consent', 'trustWorkspace', 'timeoutMinutes'].includes(key)) || value.native !== undefined) {
+      throw new api.MachineInputError('remote review accepts only its native target, consent, trust and timeout controls');
+    }
+    const { kind, ...review } = op;
+    request = { ...common, ...review, maxOutputBytes: LIMITS.machineOutputBytes };
+    api.validateNativeReviewRequest(request);
+  } else if (op.kind === 'interactive-team') {
+    if (Object.keys(op).some(key => !['kind', 'tmuxCommand', 'columns', 'rows'].includes(key))) throw new api.MachineInputError('unsupported interactive team control');
+    const { kind, ...team } = op;
+    request = { ...common, ...team, prompt: value.prompt, model: value.model, effort: value.reasoningEffort,
+      permissionMode: 'bypassPermissions', ...(value.native === undefined ? {} : { native: value.native }) };
+    api.validateInteractiveTeamRequest(request);
+  } else throw new api.MachineInputError('unsupported independent native operation');
+  return { requestId: value.requestId, nativeJob: { kind: op.kind, request } };
+}
+
+export function invokeAdapter(api, request, options) {
+  if (request.nativeJob?.kind === 'remote-review') return api.runNativeReview(request.nativeJob.request, options);
+  if (request.nativeJob?.kind === 'interactive-team') return api.runInteractiveTeam(request.nativeJob.request, options);
+  return api.runMachine(request, options);
+}
+export function recoverAdapter(api, request, original) {
+  return original.nativeOperation === undefined ? api.recoverMachine(request) : api.recoverNativeJob(request);
+}
+
 // Go has already filtered its child's environment: credentials only enter via
 // the explicitly selected channel, never from the orchestrator's ambient env.
 export function runtimeOptions(env) {
@@ -78,5 +127,5 @@ export function runtimeOptions(env) {
 
 export function doctorResult() {
   return { protocol: 1, type: 'doctor', package: ADAPTER.package, version: ADAPTER.version,
-    machineProtocol: ADAPTER.protocol, available: true, inferenceTested: false };
+    machineProtocol: ADAPTER.protocol, nativeVersion: 1, available: true, inferenceTested: false };
 }