@ckanner/flywheel 0.33.1 → 0.34.0

package/node_modules/dsh-subagent-codex-pro/docs/README.zh.md

@@ -1,9 +1,9 @@
 # dsh-subagent-codex-pro
 
 
-**0.9.0 未发布源码候选：**公开 machine API 新增可等待的结构化检查点、私有调用
+**0.9.0：**公开 machine API 新增可等待的结构化检查点、私有调用
 journal 与只读恢复。独立 supervisor 在调用者死亡后继续清理并保存原始终态回执。
-详见[生命周期与恢复](machine-lifecycle.zh.md)；没有因此发布 npm 或改动已有安装。
+详见[生命周期与恢复](machine-lifecycle.zh.md)；本次 0.10.0 仍是未发布的源码候选。
 
 [English](../README.md) | 中文
 
@@ -18,6 +18,53 @@ tools.subagent_codex({
 })
 ```
 
+## 0.10.0：插件设置、PTC 工具与原生能力
+
+原生能力已经接入**插件本身**。在 DSH「插件」中打开已安装的 bundle，配置
+**codex-pro** 这一行，即可选择继承、显式全部关闭、并发子线程上限、子模型、
+子 Agent 思考等级与 V2 后端。保存后下一次调用读取新设置；正在运行的任务
+保持原来的快照。遇到配置版本冲突，页面保留草稿，只有显式重新载入才放弃编辑。
+
+普通 `subagent_codex` 工具新增单次 `native` 参数，DSH 的 PTC 自动生成其工具
+SDK，不需要另外实现 PTC executor。外层用 PTC 编排，内层仍由 Codex 原生
+harness 执行原生工具与子 Agent。
+
+```js
+await tools.subagent_codex({
+  description: "实现独立模块",
+  prompt: "完成任务；合适时将独立工作交给原生子 Agent。",
+  native: { version: 1, agents: { enabled: true, maxConcurrentThreads: 3, backend: "v2" } },
+})
+await tools.subagent_codex_review({
+  description: "审查当前分支",
+  target: { type: "baseBranch", branch: "main" },
+})
+```
+
+| 单次 native 值 | 语义 |
+| --- | --- |
+| 省略 | 使用调用开始时的插件默认值；插件也未设置时保留 CLI 自己的默认行为。 |
+| `null` | 显式关闭两个 Agent 后端，不是退回 CLI 默认。 |
+| version 1 对象 | 整体替换插件默认值，不逐字段合并。 |
+| `{version:1,agents:{enabled:false}}` | 显式关闭；并发、子模型、effort、backend 等残留字段会报错。 |
+
+`modelSelection:false` 不会禁用用户配置中的子模型默认值，但单次 enabled 对象
+必须保留相同的子模型与 effort，包括字段是否省略；改变或清空选择需用户修改设置。
+`native` 不能扩大插件配置的文件与进程权限。
+
+独立原生 Review 使用专用 `subagent_codex_review`：每次显式 target、新的临时
+线程、read-only、agents off，不接收会被忽略的 prompt、thread_id、图片或
+output_schema。不能将 review 设成普通委派的默认任务。
+
+前台工具结果以独立 `native` 字段保留完整回执，`content` 中的结构化答案不混入
+调试文字。带 native 回执的后台 job 返回 JSON 字符串信封
+`{text,threadId,native}`；未启用显式 native 控制时保留原来的纯文本结果。
+Host provider 使用同一动态默认值，并通过官方 diagnostic 记录有界摘要。
+machine API 继续提供完整回执、逐子线程事件与用量，以及只读恢复。
+详见[中文完整契约](native-capabilities.zh.md) / [English contract](native-capabilities.md)。
+本次仍是 0.10.0 源码候选，未发布 npm；离线协议与组件测试不等于用户 Mac
+或真实付费模型已验收。
+
 ## 0.8.0 正式机器入口与迁移
 
 新增 [machine API/CLI](machine.md)，让 Go 等编排器直接复用本包的 Codex 运行核心，

package/node_modules/dsh-subagent-codex-pro/docs/machine-lifecycle-validation.md

@@ -1,6 +1,6 @@
 # Lifecycle 1 validation record
 
-Validated on 2026-11-08 against the **0.9.0 unreleased source candidate**,
+Validated on 2026-11-08 against **0.9.0**,
 based on repository commit `04ecdb677735d84f3a0f5dba01a9d9b28c324c0e`.
 This records local Linux validation with Node 24.22.1 and npm 12.2.1. It does
 not claim a registry release, a macOS run, or a live Codex account acceptance.

package/node_modules/dsh-subagent-codex-pro/docs/machine-lifecycle.md

@@ -1,6 +1,6 @@
 # Typed lifecycle and read-only recovery (lifecycle 1)
 
-This contract is in the **0.9.0 unreleased source candidate**. The public
+This contract is in **0.9.0**. The public
 `dsh-subagent-codex-pro/machine` result protocol stays 1. Lifecycle is a separate,
 versioned JavaScript API capability; the single-document CLI and existing DSH
 Host/tool results do not silently become a duplex protocol.

package/node_modules/dsh-subagent-codex-pro/docs/machine-lifecycle.zh.md

@@ -1,6 +1,6 @@
 # 结构化生命周期与只读恢复（lifecycle 1）
 
-本契约在 **0.9.0 未发布源码候选**中实现。公开
+本契约在 **0.9.0** 中实现。公开
 `dsh-subagent-codex-pro/machine` 结果协议仍为 1；lifecycle 是另行版本化的
 JavaScript 能力。单 JSON 输入的 CLI 与原 DSH Host/tool 输出保持原有方式。
 

package/node_modules/dsh-subagent-codex-pro/docs/machine.md

@@ -4,7 +4,7 @@ Version 0.8.0 introduced a public entry for orchestrators that need the complete
 without a DSH parent Agent. It uses the same app-server runner, configuration
 checks, usage tracker and process guardian as the DSH provider and tool.
 
-The **0.9.0 unreleased source candidate** adds [typed lifecycle and read-only
+**0.9.0** adds [typed lifecycle and read-only
 recovery](machine-lifecycle.md) ([中文](machine-lifecycle.zh.md)). The result protocol
 remains 1. The single-document CLI remains terminal-only; durable ACKs use the
 JavaScript API. Existing DSH callers do not opt into this additional supervisor.
@@ -52,7 +52,7 @@ npx --no-install codex-pro-machine --json < request.json > receipt.json
 The required fields are protocol, requestId, prompt, cwd, model, effort and
 permissionMode. Machine calls always name their model and permission explicitly.
 Optional fields are command, timeoutMs, maxOutputBytes, threadMode, threadId,
-images and outputSchema. Unknown fields fail before a process starts. The CLI
+images, outputSchema and native. See [native capabilities](native-capabilities.md) for versioned controls and evidence. Unknown fields fail before a process starts. The CLI
 limits the entire request to 1 MiB. The runner limits stdout and diagnostic bytes
 to 32 MiB by default; exceeding the configured positive maxOutputBytes stops the
 run and sets execution.truncated instead of accepting a partial answer.

package/node_modules/dsh-subagent-codex-pro/docs/native-capabilities.md

@@ -0,0 +1,254 @@
+# Native Codex capabilities (0.10.0 source candidate)
+
+Protocol 1 keeps its existing behavior when `native` is absent. A caller can now
+opt into a versioned native policy. The adapter still starts the user's installed,
+logged-in Codex app-server; it does not create a new account, billing path, SDK
+client, or DSH session. These controls apply to the public `/machine` API and CLI,
+and are now also connected to the DSH plugin settings and tools described below.
+
+English | [中文](native-capabilities.zh.md)
+
+```js
+import { runMachine, MACHINE_NATIVE_CAPABILITIES } from 'dsh-subagent-codex-pro/machine'
+
+const receipt = await runMachine({
+  protocol: 1, requestId: 'implementation-1', cwd: '/repo/worktree',
+  prompt: 'Implement the change. Delegate independent work when useful.',
+  model: 'your-installed-codex-model', effort: 'high',
+  permissionMode: 'workspace-write', threadMode: 'persistent',
+  native: {
+    version: 1,
+    agents: {
+      enabled: true,
+      maxConcurrentThreads: 4,
+      defaultModel: 'your-worker-model',
+      defaultEffort: 'high',
+      // Optional: explicitly select the current V2 collaboration backend.
+      backend: 'v2',
+    },
+  },
+}, {
+  recoveryDirectory: '/repo/run-evidence/implementation-1',
+  onLifecycle: async event => { /* durably save before resolving */ },
+  onNativeEvent: event => { /* bounded metadata for the host's activity view */ },
+})
+```
+
+## Desktop settings and PTC tools
+
+Open the installed bundle's `codex-pro` row configuration in DSH's Plugins page.
+The shipped browser entry registers `plugins.row.config` using the Host's shared
+React module. It edits only the `native` path through the owner form's atomic
+`mutate(ops, expectedRevision)`, never a deep merge of stale enabled controls.
+“Inherit configuration” unsets that path; “All off” writes `null`. The effective
+value preview distinguishes inherited configuration from the editable override.
+Read-only/unavailable forms cannot save; conflicts retain the draft and its
+original revision until the user reloads.
+
+The plugin exports an actual Schemastery `Config`. Its `native` field is
+volatile and read once at each delegation's start, including the Host provider
+path. Omission has no empty-object default. Other plugin configuration keeps its
+existing remount semantics. YAML configuration remains available:
+
+```yaml
+native:
+  version: 1
+  agents:
+    enabled: true
+    maxConcurrentThreads: 3
+    defaultModel: your-worker-model
+    defaultEffort: high
+    backend: v2
+```
+
+`subagent_codex({description, prompt, native, ...})` is the same registered tool
+in ordinary DSH execution and in the automatically generated PTC tool SDK.
+Omitting `native` inherits the current plugin default; no plugin default leaves
+CLI-native defaults alone. A supplied object replaces that default completely.
+Desktop `native:null` is shorthand for
+`{version:1,agents:{enabled:false}}`; the public protocol-1 machine API still
+uses the versioned object and does not accept this desktop shorthand.
+
+A disabled policy may not carry enabled-only fields. Unknown native fields and
+unknown tool arguments are rejected even if a caller bypasses JSON Schema.
+When `modelSelection:false`, inherited child model/effort settings remain valid.
+An enabled per-call object must keep those two values exactly, including
+omission; replacing an object must not silently clear a configured model.
+Explicit off is still permitted. Native fields do not expand the root sandbox.
+
+An implicit `threadMode:session` resume is bound to native policy, model,
+effort, permission and cwd. A binding change starts a new thread. Explicit
+`thread_id` remains supported, including externally created threads: requested
+configuration is reapplied and checked on every resume; a failed explicit
+resume is reported, never silently replaced.
+
+The latest DSH Host `SubagentStartRequest` has model/effort `agentOptions`,
+but no generic provider-options or native field. Its provider path therefore
+uses this plugin's live native default, while per-call native changes use
+`subagent_codex` or `/machine`. Unknown Host start/options fields are rejected.
+This is not a second Host Agent tree: Codex's children retain their native
+lifecycle, permission, tool and usage semantics.
+
+## Desktop native review
+
+```js
+await tools.subagent_codex_review({
+  description: "Review branch changes",
+  target: { type: "baseBranch", branch: "main" },
+  // Optional when model selection is enabled:
+  model: "your-review-model",
+  reasoning_effort: "high",
+})
+```
+
+This dedicated tool accepts description, target, cwd, timeout, model/effort when
+authorized, and background execution when the jobs service exists. It fixes
+fresh ephemeral execution, read-only sandbox, approvals=never, and agents off.
+It does not accept prompt, native, thread controls, images or output_schema.
+Review is rejected in plugin defaults and ordinary tool native overrides, so a
+normal task cannot accidentally become review/start or lose its prompt.
+For an agent-assisted review or structured verdict, use an ordinary independent
+delegation with the appropriate prompt and schema.
+
+## Desktop evidence
+
+| Entry | Evidence and answer |
+| --- | --- |
+| Foreground / PTC tool | `{content,native}`; complete native receipt is separate from unchanged answer blocks. Rendering preserves image attachments and appends a bounded native metadata block. |
+| Background job | With native evidence, `result` is a JSON string `{text,threadId,native}`; without it, the previous plain text result remains. Failed jobs retain an available native receipt. |
+| Host provider | Official `output`/`structured` are unchanged. `diagnostic` and the plugin log retain bounded metadata: config match, completion/cleanup, pending counts and abbreviated ids, child state counts, usage scope/status and event truncation. |
+| Machine API | Complete native receipt and existing durable recovery journal. |
+
+The Host's narrow result contract is not extended with invented fields. Its
+bounded summary is not the complete event ledger; callers needing all child
+identities and events use the dedicated tools or machine API. An unconfirmed
+native configuration, unfinished observed child or unconfirmed process cleanup
+prevents a successful result, even when the root already emitted a final answer.
+
+## Configuration and full agent access
+
+Native agents receive Codex's actual configured tools, permissions, MCP servers,
+and model behavior. This package does not replace their tools with a read-only
+helper subset. The caller selects the root sandbox explicitly; native agents
+inherit the native harness's rules. Agent role definitions already installed in
+Codex remain available. `defaultModel`/`defaultEffort` are defaults, not model
+allowlists: a native spawn may select a different allowed model.
+
+`maxConcurrentThreads` is a cap on open spawned threads, not a cumulative spawn,
+token, or cost budget. V2's internal setting includes the root, so explicit V2
+uses `N + 1`. With backend omitted, native/model backend selection remains intact;
+an inherited V2 cap that exceeds the requested cap causes a configuration failure.
+There is no claim that turning the V2 feature flag off forces a model to use V1.
+
+Explicit off is `{version:1, agents:{enabled:false}}`. A present `native` with no
+`agents` also disables agent dispatch. Off sets **both** `agents.enabled=false`
+and `features.multi_agent_v2=false`; the V2 flag otherwise takes precedence.
+Invalid/unknown controls fail before a process starts. The adapter passes config
+overrides as separate argv values and checks `config/read` in the requested cwd
+before it starts or resumes a thread. Missing, overridden or conflicting config
+does not authorize a model turn. A config match proves configured values; observed
+child/model events remain separate from requested defaults.
+
+## Independent native review
+
+```js
+const review = await runMachine({
+  protocol: 1, requestId: 'review-1', cwd: '/repo/reviewer-worktree',
+  prompt: 'Native review operation', model: 'your-review-model', effort: 'high',
+  permissionMode: 'read-only',
+  native: { version: 1, review: { target: { type: 'baseBranch', branch: 'main' } } },
+})
+```
+
+Targets are `uncommittedChanges`, `baseBranch` with `branch`, `commit` with `sha`
+and optional `title`, and `custom` with `instructions`. The operation creates a
+fresh thread, verifies its cwd/model/sandbox, then calls `review/start` with inline
+delivery on **that new thread**. Executor history is never resumed or forked.
+The operation's native target supplies the review instructions; the compatibility
+`prompt` field is not submitted as an ordinary turn. Requested model and effort
+are scoped `review_model`/`model_reasoning_effort` config overrides, checked before
+dispatch. The review response must identify the same new thread.
+
+Codex's native review internally disables collaboration, image viewing and web
+search. The API therefore rejects review combined with enabled native agents,
+images, outputSchema, or an existing threadId. For a multi-agent review or a
+schema-constrained verdict, start an independent normal query instead. A native
+review result is supporting evidence; it is not automatically a host's approval
+or a validated structured review decision.
+
+## Media and structured output
+
+The existing `images: ['/absolute/image.png']` and object-rooted `outputSchema`
+remain supported for normal turns with or without native agents. They use native
+`localImage` and `turn/start.outputSchema`; neither is a prompt-only convention.
+The result keeps text, structured output and returned image metadata in their
+existing fields. Native observations do not alter the model's answer.
+
+## Evidence, accounting and cancellation
+
+`receipt.native` adds requested controls; config source/match/values; bounded
+ordered observations; child identities/parents/models/states; per-child usage;
+and independent cleanup facts. `onNativeEvent` receives the same metadata. It is
+an advisory callback and cannot authorize dispatch or replace lifecycle ACKs.
+The terminal native receipt is persisted with the existing private machine
+journal, including when the caller disconnects. Recovery reads the original
+receipt and never resumes a model on its own.
+
+Only native parent relations, collaboration items and sub-agent activity items
+establish ownership. Foreign-thread text/usage cannot become a child result or
+root completion. Child approval requests are handled by the same unattended
+approval policy, and only for a known child turn. Unknown requests do not receive
+an expanded permission grant. A child `thread/started` received before the root
+response is buffered with its nested thread identity; its ancestry is replayed
+after the root becomes known before routing later child requests.
+
+`native.usage.strategy` is `per-thread`, and its `scope` is `observed-children`.
+`totalTokens` covers those children only; root usage remains in `outcome.usage`.
+Counters are cumulative snapshots, not increments. Duplicate snapshots do not
+increase spend; a resumed child adopts a historical baseline. Unknown baselines,
+counter anomalies, missing observations or a truncated ledger make aggregation
+partial/unknown. An unfinished child's last attributable snapshot remains
+partial, including after physical cleanup; the snapshot is retained while the
+complete aggregate total stays absent. No observed children is unknown, not
+fabricated zero. The host
+must not add a child snapshot more than once or confuse complete observed-child
+usage with proof that all possible external spend was measured.
+
+Late completions and replayed starts for an older child turn cannot replace the
+active turn's identity. Native `failed` turns are terminal, while failure and
+business success remain separate facts; a parent may handle a child failure.
+
+Cancellation sends `turn/interrupt` to known running children and the root, then
+uses the existing guardian's bounded process-group cleanup. A root interrupt by
+itself does not prove all children stopped. `native.cleanup.confirmed` is set from
+physical cleanup evidence, not an interrupt response or child completion text.
+Permissions, thread state and configuration must be revalidated on every explicit
+resume. No automatic retry occurs after a possibly dispatched failure.
+
+## Verification and primary references
+
+The desktop follow-up is validated by GitHub Actions against the actual npm
+Schemastery package, registered plugin tools and real offline app-server child
+processes. React component tests exercise saving, whole-value off/reset,
+validation, read-only forms and revision conflicts. Package tests install the
+real tarball into a clean consumer without DSH peers and exercise its public
+machine API and installed CLI. Local execution was unavailable for this follow-up;
+these checks do not claim an installed desktop or authenticated model run.
+
+Earlier machine-capability offline tests exercise actual child processes for config mismatch before dispatch,
+early child events, child approvals, deduplicated/replayed usage, cancellation,
+fresh native review, supervisor delivery and the built installed npm package.
+The package remains a source candidate until separately published. This change
+does not claim an authenticated live-model/desktop acceptance run. During the earlier machine-capability review, a zero-model probe of
+`codex-cli 0.167.0-alpha.4` could read CLI help but timed out at the configuration
+handshake. That historical probe is not a new desktop follow-up execution; no
+model turn was sent.
+
+Implementation contracts were checked against OpenAI's fixed source
+[`7924f95421a326bb66426a3ce232b72550948470`](https://github.com/openai/codex/tree/7924f95421a326bb66426a3ce232b72550948470):
+
+- [Native config schema](https://github.com/openai/codex/blob/7924f95421a326bb66426a3ce232b72550948470/codex-rs/core/config.schema.json)
+- [Backend precedence and caps](https://github.com/openai/codex/blob/7924f95421a326bb66426a3ce232b72550948470/codex-rs/core/src/config/mod.rs)
+- [Typed child items](https://github.com/openai/codex/blob/7924f95421a326bb66426a3ce232b72550948470/codex-rs/app-server-protocol/schema/typescript/v2/ThreadItem.ts)
+- [Review endpoint](https://github.com/openai/codex/blob/7924f95421a326bb66426a3ce232b72550948470/codex-rs/app-server-protocol/schema/typescript/v2/ReviewStartParams.ts)
+- [Native review restrictions](https://github.com/openai/codex/blob/7924f95421a326bb66426a3ce232b72550948470/codex-rs/core/src/tasks/review.rs)

package/node_modules/dsh-subagent-codex-pro/docs/native-capabilities.zh.md

@@ -0,0 +1,180 @@
+# Codex 原生能力与桌面插件（0.10.0 源码候选）
+
+[English](native-capabilities.md) | 中文
+
+本包继续启动用户已经安装、登录的 Codex app-server。它不创建另一套账号、
+计费入口或 DSH 子 Agent 运行时。外层 DSH 可以通过 PTC 生成的工具 SDK
+调用插件；内层的 Agent、工具、审批、上下文与 Review 仍由 Codex 原生
+harness 执行。PTC 与原生能力属于不同层，可以同时使用；本次没有另建
+PTC executor，也不声称未经测量的性能提升。
+
+## 在插件里设置默认能力
+
+在 DSH「插件」页面打开本 bundle，再配置 `codex-pro` 行。页面提供：
+
+- 继承配置：删除用户层的 `native` 覆盖；如果基础配置也没有设置，则保留
+  Codex CLI 自己的默认行为。
+- 全部关闭：保存 `native:null`，明确关闭两个 Agent 后端。
+- 启用原生 Agent：设置并发子线程上限、子 Agent 默认模型、默认思考等级，
+  以及是否明确选择 V2 后端。
+
+插件导出真正的 Schemastery `Config`，`native` 为 volatile 字段。每次调用
+开始读取一次 `.get()` 快照；保存后无需重载插件，已经开始的任务不被中途
+改写。其他已有插件参数仍沿用原来的重载语义。页面底部展示实际生效值，
+区分“用户层未覆盖”和“显式关闭”。
+
+浏览器入口注册官方 `plugins.row.config`，使用 DSH 共享的 React，不打包
+另一套 React。保存通过 owner form 的
+`mutate([{op:"set",path:["native"],value}], capturedRevision)` 原子写入整个
+native 值；继承用 `unset`。它不深合并旧配置，所以关闭不会保存并发、子模型
+或 backend 残留。不可写/未就绪时禁止保存；遇到版本冲突保留草稿及编辑起点
+revision，只有明确点“重新载入”才丢弃编辑。
+
+也可以在配置中设置：
+
+```yaml
+native:
+  version: 1
+  agents:
+    enabled: true
+    maxConcurrentThreads: 3
+    defaultModel: your-worker-model
+    defaultEffort: high
+    backend: v2
+```
+
+## 单次委派与默认值覆盖
+
+```js
+const result = await tools.subagent_codex({
+  description: "实现独立模块",
+  prompt: "完成需求；将能够独立验证的工作交给原生子 Agent。",
+  native: {
+    version: 1,
+    agents: { enabled: true, maxConcurrentThreads: 3, backend: "v2" },
+  },
+})
+```
+
+DSH 普通工具执行与 PTC 使用同一个注册工具及运行实现。
+
+| 单次参数 | 行为 |
+| --- | --- |
+| 不传 `native` | 使用调用开始时的插件默认；插件未设则继承 CLI 默认。 |
+| `native:null` | 显式关闭，不是回到默认。 |
+| version 1 对象 | 整体替换默认，不逐字段合并。 |
+| `agents:{enabled:false}` | 显式关闭，拒绝同时携带其他 Agent 字段。 |
+| 对象存在但省略 `agents` | 也会显式关闭 Agent。 |
+
+桌面的 `null` 是插件便利写法，进入共享协议前规范化为
+`{version:1,agents:{enabled:false}}`。公开 machine API 的协议仍要求版本化
+对象，不接受这个桌面简写。
+
+未知 native 字段、未知工具参数、非法并发以及 disabled 的残留参数，在启动
+进程前报错。即使调用者绕过 DSH 的 JSON Schema 校验，也不会被静默忽略。
+`modelSelection:false` 允许用户在设置页配置的子模型/effort 默认值正常使用；
+单次启用对象必须保持相同选择，包括字段是否省略。新增、改写或通过整体替换
+清空这些选择都需要用户修改插件配置；显式关闭仍允许。
+
+`maxConcurrentThreads` 限制同时打开的子线程数量，不是累计 spawn 次数、token
+或费用预算。V2 内部计数包含根线程，所以明确选择 V2 时写入 `N+1`。
+不写 backend 保留原生后端选择；继承的 V2 配置若与请求上限冲突，配置验证会失败。
+不声称关闭某个 V2 特性就能强制任意模型走 V1。
+
+普通原生子 Agent 继续使用 Codex 配置的工具、MCP、角色和模型行为；本插件不把
+它们替换成受限帮助工具。子模型与 effort 字段是默认值，不是 Codex 原生模型
+allowlist。根线程的 sandbox/审批边界仍由插件配置决定，调用方只能收窄权限；
+`native` 不授予额外的文件、进程或网络权限。
+
+## Host provider 与会话复用
+
+最新 DSH `SubagentStartRequest` 的 `agentOptions` 是 Host 的 provider、
+model、reasoningEffort、maxTokens 语义，没有通用的 providerOptions/native
+字段。Codex provider 读取插件相同的动态 native 默认值，并支持它能够兑现的
+model/effort；不支持的有值参数明确拒绝。合法但显式为 undefined 的可选字段不
+阻止启动。需要单次 native 覆盖时，使用专用 `subagent_codex` 工具或 machine API。
+
+`threadMode:session` 的隐式复用绑定 native 策略、根模型、effort、权限与 cwd。
+其中任一值改变，下一次隐式调用新建线程，避免已有会话掩盖设置变化。显式
+`thread_id` 继续支持，包括外部创建的线程；每次都重新应用并验证请求配置。
+显式恢复失败会报告错误，不会悄悄换成新线程。可能已经派发的任务不会自动重跑。
+
+## 独立原生 Review
+
+```js
+await tools.subagent_codex_review({
+  description: "检查分支变更",
+  target: { type: "baseBranch", branch: "main" },
+  model: "your-review-model",
+  reasoning_effort: "high",
+})
+```
+
+这是单独的、每次明确请求的操作。工具只接受 description、target、cwd、
+timeout，以及被允许的 model/effort、后台执行选项。它固定：
+
+- 新的临时线程，不继续实现者的历史。
+- read-only sandbox、approvals=never、agents off。
+- 在验证新线程后调用 `review/start`，inline 结果必须对应同一线程。
+
+target 支持 `uncommittedChanges`、携带 branch 的 `baseBranch`、携带 sha 和
+可选 title 的 `commit`、携带 instructions 的 `custom`。工具不接收普通 prompt、
+native、thread_id/thread_mode、图片或 output_schema，因此没有被静默丢弃的
+任务语义。插件默认值与普通工具里的 `native.review` 都会被拒绝。
+
+Codex 原生 Review 自身禁用 collaboration、图片查看与 web search。需要原生
+多 Agent 参与审查、图片或结构化 verdict 时，使用独立的普通委派并明确 prompt
+与 schema。Review 输出是审查证据，不自动等同于 Host 审批或通过验证的
+结构化决策。底层 machine Review 的兼容 prompt 字段不会作为普通 turn 提交，
+实际审查语义来自 target；桌面专用工具则完全不暴露这个兼容字段。
+
+## 回执、用量与终态
+
+| 入口 | 答案与证据 |
+| --- | --- |
+| 前台 / PTC 工具 | `{content,native}`：完整原生回执单独保存；答案正文保持不变，render 保留图片附件并另附有界元数据块。 |
+| 后台 job | 有原生证据时，result 为 JSON 字符串 `{text,threadId,native}`；没有原生控制时保留原来的纯文本。失败 job 也保留已获得的 native 回执。 |
+| Host provider | 保持官方 output/structured 形状；diagnostic 与插件日志记录有界摘要，不虚构 Host 扩展字段。 |
+| machine API | 完整原生回执、事件回调及原有私有恢复 journal。 |
+
+Host 摘要包含配置是否匹配、completion/cleanup、pending 数量与截短标记、
+子线程状态计数、用量范围/状态和事件截断。它不冒充完整事件账本；需要全部
+子线程身份与事件时使用专用工具或 machine API。结构化答案不会被 thread marker、
+native JSON 或调试前后缀污染。
+
+原生回执记录 requested、effective、observed、children、usage、completion、
+cleanup。只有可信原生父子关系、协作 item 与子 Agent 活动才能建立 ownership；
+无关线程的消息不能冒充根答案或子线程用量。父线程 id 尚未到达时，早到的子线程
+来源会暂存，根身份确认后再关联。
+
+`native.usage` 统计观察到的子线程，根线程用量仍在 `outcome.usage`。累计快照
+不是增量；重复快照不重复计费，恢复线程保留历史基线。未知基线、异常计数、
+缺失观察或截断账本会使统计成为 partial/unknown。没有观察到子线程不是零费用
+证明。尚未完成的子线程即使已有 token 快照，也不能被宣称为完整终态用量。
+
+根线程发出 final answer 仍不够：原生配置未确认、已观察子线程仍未终结、或
+实际进程清理未确认，都会导致失败。原生 child failed 是“已终结”事实，不自动
+等同于父任务业务失败；父任务可能已经处理了这个失败。
+
+取消向已知运行中的子 turn 和根 turn 发送 interrupt，然后通过 guardian 有界清理
+整个本地进程组。收到 interrupt 回复不等于已经清理；cleanup 以物理进程证据为准。
+完整 machine 终态随现有 journal 保存，读取恢复记录不会自动启动新模型。
+
+## 验证范围
+
+本轮本地执行环境不可用，实际验证在 GitHub Actions 的 Node 22/24、
+Ubuntu/macOS 矩阵完成。测试使用真正 npm 发布的 Schemastery，真实注册的
+插件工具/Host provider 到独立 app-server fixture 子进程的整条路径，以及真实
+React 组件的保存、关闭、继承、校验、只读与 revision 冲突交互。打包测试安装
+真实 tarball，在没有 DSH peer 的干净消费者中验证公开 machine API、CLI 与
+supervisor，并检查浏览器入口确实包含在包中。
+
+这些是离线协议、组件和包验证，不是用户已安装 DSH 桌面端或真实付费模型验收。
+版本保持未发布的 0.10.0 candidate。更早的 native machine 测试与 CLI 零模型探测
+历史记录见[英文契约的验证部分](native-capabilities.md#verification-and-primary-references)，
+不将旧测试算作本轮新执行。
+
+DSH 配置/页面契约以
+[39163dd](https://github.com/deepseek-ai/deepseek-harness/tree/39163dd30f703a79079e2d2446545cff3c453738)
+的 settings、subagent/types 与 ui-plugin-manager slot-contract 为依据；
+Codex 原生协议依据与具体文件链接列于[英文契约](native-capabilities.md#verification-and-primary-references)。

package/node_modules/dsh-subagent-codex-pro/lib/config.js

@@ -0,0 +1,56 @@
+/** The real Host settings schema. Only native defaults are edited without remounting. */
+import z from '@deepseek-ai/schemastery';
+/** Schemastery objects/arrays default to empty values; omission here means inheritance. */
+function optional(schema) {
+    delete schema.meta.default;
+    return schema;
+}
+// Start from any(): validating an object schema first can strip unknown fields
+// in a transform. This callback must be self-contained because the Host sends
+// its serialized schema to the browser for the same validation there.
+const native = z.transform(z.any(), (value) => {
+    if (value === undefined || value === null)
+        return value;
+    const object = (v) => v !== null && typeof v === 'object' && !Array.isArray(v);
+    const keys = (v, allowed) => Object.keys(v).every(key => allowed.includes(key));
+    const text = (v) => typeof v === 'string' && v.trim() !== ''
+        && !v.includes('\0') && new TextEncoder().encode(v).byteLength <= 65536;
+    if (!object(value) || value.version !== 1 || !keys(value, ['version', 'agents'])) {
+        throw new Error('invalid native capability version or fields; review uses subagent_codex_review');
+    }
+    const agents = value.agents;
+    if (agents !== undefined) {
+        if (!object(agents) || !keys(agents, ['enabled', 'maxConcurrentThreads', 'defaultModel', 'defaultEffort', 'backend'])
+            || typeof agents.enabled !== 'boolean')
+            throw new Error('native.agents requires an explicit enabled boolean and known fields');
+        if (agents.maxConcurrentThreads !== undefined && (!Number.isSafeInteger(agents.maxConcurrentThreads)
+            || Number(agents.maxConcurrentThreads) < 1 || Number(agents.maxConcurrentThreads) >= Number.MAX_SAFE_INTEGER)) {
+            throw new Error('native concurrency must be a positive safe integer with room for the root');
+        }
+        for (const field of ['defaultModel', 'defaultEffort']) {
+            if (agents[field] !== undefined && !text(agents[field]))
+                throw new Error('invalid native agents ' + field);
+        }
+        if (agents.backend !== undefined && agents.backend !== 'v2')
+            throw new Error('invalid native agent backend');
+        if (agents.enabled === false && Object.keys(agents).length !== 1)
+            throw new Error('disabled agents cannot have active controls');
+    }
+    return value;
+}).description('Native agent defaults. Unset inherits Codex CLI defaults; null explicitly turns agents off. Review is a separate explicit tool.').volatile();
+/** Exported as Config by the plugin, so DSH derives an editable live settings form. */
+export const ConfigSchema = z.object({
+    providerName: z.string(),
+    command: z.string(),
+    model: z.string(),
+    reasoningEffort: z.string(),
+    modelSelection: z.boolean(),
+    permissionMode: z.union(['read-only', 'workspace-write', 'never', 'approve-for-me', 'dangerously-bypass-approvals-and-sandbox']),
+    env: optional(z.dict(z.string())),
+    presets: optional(z.array(z.string())),
+    threadMode: z.union(['ephemeral', 'persistent', 'session']),
+    runTimeoutMs: z.natural(),
+    originator: z.string(),
+    native,
+});
+//# sourceMappingURL=config.js.map

package/node_modules/dsh-subagent-codex-pro/lib/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,OAAO,CAAC,MAAM,0BAA0B,CAAA;AAExC,2FAA2F;AAC3F,SAAS,QAAQ,CAAC,MAAS;IACzB,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAA;IAC1B,OAAO,MAAM,CAAA;AACf,CAAC;AAED,+EAA+E;AAC/E,8EAA8E;AAC9E,sEAAsE;AACtE,MAAM,MAAM,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAc,EAAW,EAAE;IAC9D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IACvD,MAAM,MAAM,GAAG,CAAC,CAAU,EAAgC,EAAE,CAC1D,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IAC1D,MAAM,IAAI,GAAG,CAAC,CAA0B,EAAE,OAAiB,EAAW,EAAE,CACtE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAA;IACpD,MAAM,IAAI,GAAG,CAAC,CAAU,EAAW,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;WACzE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,KAAK,CAAA;IACzE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;QACjF,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAA;IACnG,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAA;IAC3B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,sBAAsB,EAAE,cAAc,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC;eAChH,OAAO,MAAM,CAAC,OAAO,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAA;QAChI,IAAI,MAAM,CAAC,oBAAoB,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,oBAAoB,CAAC;eAC/F,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,IAAI,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAChH,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAA;QAC9F,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,CAAC,cAAc,EAAE,eAAe,CAAC,EAAE,CAAC;YACtD,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,KAAK,CAAC,CAAA;QAC5G,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;QAC5G,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;IAClI,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC,CAAC,CAAC,WAAW,CAAC,iIAAiI,CAAC,CAAC,QAAQ,EAAE,CAAA;AAE5J,uFAAuF;AACvF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;IAC3B,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,iBAAiB,EAAE,OAAO,EAAE,gBAAgB,EAAE,0CAA0C,CAAC,CAAC;IAChI,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACjC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACtC,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;IAC3D,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE;IACzB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,MAAM;CACP,CAAC,CAAA"}