@deepseek-ai/dsh-api-session-controller 0.1.3-alpha.2 → 0.1.5-alpha.2

package/lib/typert.remote-client.js

@@ -99,6 +99,10 @@ const _deepseek_ai_dsh_api_session_controller_session_control_result$schema = z.
   'projections': z.record(z.intersection(z.string(), z.unknown()), z.object({
   'asOfSeq': z.number().readonly(),
   'values': z.intersection(z.object({
+  'inbox': z.object({
+  'next-turn': z.array(z.union([z.literal(null), z.string(), z.number(), z.literal(false), z.literal(true), z.array(z.lazy(() => JsonValueRemoteCodec$schema4)), z.record(z.string(), z.lazy(() => JsonValueRemoteCodec$schema4))])).readonly(),
+  'next-step': z.array(z.union([z.literal(null), z.string(), z.number(), z.literal(false), z.literal(true), z.array(z.lazy(() => JsonValueRemoteCodec$schema4)), z.record(z.string(), z.lazy(() => JsonValueRemoteCodec$schema4))])).readonly(),
+}).optional(),
   'agentPreset': z.union([z.literal(null), z.string()]).optional(),
   'title': z.union([z.literal(null), z.string()]).optional(),
   'todos': z.union([z.literal(null), z.array(z.object({
@@ -129,6 +133,19 @@ const _deepseek_ai_dsh_api_session_controller_session_control_result$schema = z.
   'reasoningEffort': z.string().readonly().optional(),
 })]).readonly(),
 }).optional(),
+  'subagentCatalog': z.array(z.union([z.intersection(z.object({
+  'id': z.intersection(z.string(), z.unknown()).readonly(),
+  'createdAt': z.number().readonly(),
+}), z.object({
+  'mode': z.literal("one-shot").readonly(),
+  'label': z.string().readonly().optional(),
+})), z.intersection(z.object({
+  'id': z.intersection(z.string(), z.unknown()).readonly(),
+  'createdAt': z.number().readonly(),
+}), z.object({
+  'mode': z.literal("continuable").readonly(),
+  'label': z.string().readonly(),
+}))])).optional(),
   'subagentTiming': z.object({
   'settledMs': z.number(),
   'active': z.object({
@@ -227,12 +244,8 @@ const _deepseek_ai_dsh_api_session_controller_session_follow_result$schema = z.u
   'time': z.number().readonly(),
   'data': z.union([z.literal(null), z.string(), z.number(), z.literal(false), z.literal(true), z.array(z.lazy(() => JsonValueRemoteCodec$schema3)), z.record(z.string(), z.lazy(() => JsonValueRemoteCodec$schema3))]).readonly(),
   'ignorable': z.literal(true).readonly().optional(),
-  'sourceEventSeqs': z.array(z.number()).readonly().optional(),
-  'surfaceOp': z.union([z.literal("append"), z.object({
-  'op': z.literal("replace").readonly(),
-  'start': z.number().readonly(),
-  'end': z.number().readonly(),
-})]).readonly().optional(),
+  'sourceEventSeqs': z.union([z.literal(null), z.string(), z.number(), z.literal(false), z.literal(true), z.array(z.lazy(() => JsonValueRemoteCodec$schema3)), z.record(z.string(), z.lazy(() => JsonValueRemoteCodec$schema3))]).readonly().optional(),
+  'surfaceOp': z.union([z.literal(null), z.string(), z.number(), z.literal(false), z.literal(true), z.array(z.lazy(() => JsonValueRemoteCodec$schema3)), z.record(z.string(), z.lazy(() => JsonValueRemoteCodec$schema3))]).readonly().optional(),
 }).readonly(),
 }), z.object({
   'type': z.literal("snapshot").readonly(),
@@ -256,18 +269,18 @@ const _deepseek_ai_dsh_api_session_controller_session_follow_result$schema = z.u
   'time': z.number().readonly(),
   'data': z.union([z.literal(null), z.string(), z.number(), z.literal(false), z.literal(true), z.array(z.lazy(() => JsonValueRemoteCodec$schema3)), z.record(z.string(), z.lazy(() => JsonValueRemoteCodec$schema3))]).readonly(),
   'ignorable': z.literal(true).readonly().optional(),
-  'sourceEventSeqs': z.array(z.number()).readonly().optional(),
-  'surfaceOp': z.union([z.literal("append"), z.object({
-  'op': z.literal("replace").readonly(),
-  'start': z.number().readonly(),
-  'end': z.number().readonly(),
-})]).readonly().optional(),
+  'sourceEventSeqs': z.union([z.literal(null), z.string(), z.number(), z.literal(false), z.literal(true), z.array(z.lazy(() => JsonValueRemoteCodec$schema3)), z.record(z.string(), z.lazy(() => JsonValueRemoteCodec$schema3))]).readonly().optional(),
+  'surfaceOp': z.union([z.literal(null), z.string(), z.number(), z.literal(false), z.literal(true), z.array(z.lazy(() => JsonValueRemoteCodec$schema3)), z.record(z.string(), z.lazy(() => JsonValueRemoteCodec$schema3))]).readonly().optional(),
 }).readonly(),
 })).readonly(),
   'hasMore': z.boolean().readonly(),
   'projections': z.object({
   'asOfSeq': z.number().readonly(),
   'values': z.intersection(z.object({
+  'inbox': z.object({
+  'next-turn': z.array(z.union([z.literal(null), z.string(), z.number(), z.literal(false), z.literal(true), z.array(z.lazy(() => JsonValueRemoteCodec$schema3)), z.record(z.string(), z.lazy(() => JsonValueRemoteCodec$schema3))])).readonly(),
+  'next-step': z.array(z.union([z.literal(null), z.string(), z.number(), z.literal(false), z.literal(true), z.array(z.lazy(() => JsonValueRemoteCodec$schema3)), z.record(z.string(), z.lazy(() => JsonValueRemoteCodec$schema3))])).readonly(),
+}).optional(),
   'agentPreset': z.union([z.literal(null), z.string()]).optional(),
   'title': z.union([z.literal(null), z.string()]).optional(),
   'todos': z.union([z.literal(null), z.array(z.object({
@@ -298,6 +311,19 @@ const _deepseek_ai_dsh_api_session_controller_session_follow_result$schema = z.u
   'reasoningEffort': z.string().readonly().optional(),
 })]).readonly(),
 }).optional(),
+  'subagentCatalog': z.array(z.union([z.intersection(z.object({
+  'id': z.intersection(z.string(), z.unknown()).readonly(),
+  'createdAt': z.number().readonly(),
+}), z.object({
+  'mode': z.literal("one-shot").readonly(),
+  'label': z.string().readonly().optional(),
+})), z.intersection(z.object({
+  'id': z.intersection(z.string(), z.unknown()).readonly(),
+  'createdAt': z.number().readonly(),
+}), z.object({
+  'mode': z.literal("continuable").readonly(),
+  'label': z.string().readonly(),
+}))])).optional(),
   'subagentTiming': z.object({
   'settledMs': z.number(),
   'active': z.object({
@@ -395,6 +421,10 @@ const _deepseek_ai_dsh_api_session_controller_session_list_result$schema = z.obj
   'projections': z.object({
   'asOfSeq': z.number().readonly(),
   'values': z.intersection(z.object({
+  'inbox': z.object({
+  'next-turn': z.array(z.union([z.literal(null), z.string(), z.number(), z.literal(false), z.literal(true), z.array(z.lazy(() => JsonValueRemoteCodec$schema)), z.record(z.string(), z.lazy(() => JsonValueRemoteCodec$schema))])).readonly(),
+  'next-step': z.array(z.union([z.literal(null), z.string(), z.number(), z.literal(false), z.literal(true), z.array(z.lazy(() => JsonValueRemoteCodec$schema)), z.record(z.string(), z.lazy(() => JsonValueRemoteCodec$schema))])).readonly(),
+}).optional(),
   'agentPreset': z.union([z.literal(null), z.string()]).optional(),
   'title': z.union([z.literal(null), z.string()]).optional(),
   'todos': z.union([z.literal(null), z.array(z.object({
@@ -425,6 +455,19 @@ const _deepseek_ai_dsh_api_session_controller_session_list_result$schema = z.obj
   'reasoningEffort': z.string().readonly().optional(),
 })]).readonly(),
 }).optional(),
+  'subagentCatalog': z.array(z.union([z.intersection(z.object({
+  'id': z.intersection(z.string(), z.unknown()).readonly(),
+  'createdAt': z.number().readonly(),
+}), z.object({
+  'mode': z.literal("one-shot").readonly(),
+  'label': z.string().readonly().optional(),
+})), z.intersection(z.object({
+  'id': z.intersection(z.string(), z.unknown()).readonly(),
+  'createdAt': z.number().readonly(),
+}), z.object({
+  'mode': z.literal("continuable").readonly(),
+  'label': z.string().readonly(),
+}))])).optional(),
   'subagentTiming': z.object({
   'settledMs': z.number(),
   'active': z.object({
@@ -492,6 +535,7 @@ const _deepseek_ai_dsh_api_session_controller_session_modelCatalog_result$schema
 })).readonly(),
 })
 const _deepseek_ai_dsh_api_session_controller_session_openWorkspacePath_parameter_0$schema = z.object({
+  'action': z.literal("reveal").readonly().optional(),
   'path': z.string().readonly(),
 })
 const _deepseek_ai_dsh_api_session_controller_session_openWorkspacePath_result$schema = z.object({
@@ -520,12 +564,8 @@ const _deepseek_ai_dsh_api_session_controller_session_page_result$schema = z.obj
   'time': z.number().readonly(),
   'data': z.union([z.literal(null), z.string(), z.number(), z.literal(false), z.literal(true), z.array(z.lazy(() => JsonValueRemoteCodec$schema2)), z.record(z.string(), z.lazy(() => JsonValueRemoteCodec$schema2))]).readonly(),
   'ignorable': z.literal(true).readonly().optional(),
-  'sourceEventSeqs': z.array(z.number()).readonly().optional(),
-  'surfaceOp': z.union([z.literal("append"), z.object({
-  'op': z.literal("replace").readonly(),
-  'start': z.number().readonly(),
-  'end': z.number().readonly(),
-})]).readonly().optional(),
+  'sourceEventSeqs': z.union([z.literal(null), z.string(), z.number(), z.literal(false), z.literal(true), z.array(z.lazy(() => JsonValueRemoteCodec$schema2)), z.record(z.string(), z.lazy(() => JsonValueRemoteCodec$schema2))]).readonly().optional(),
+  'surfaceOp': z.union([z.literal(null), z.string(), z.number(), z.literal(false), z.literal(true), z.array(z.lazy(() => JsonValueRemoteCodec$schema2)), z.record(z.string(), z.lazy(() => JsonValueRemoteCodec$schema2))]).readonly().optional(),
 }).readonly(),
 })).readonly(),
   'hasMore': z.boolean().readonly(),
@@ -713,7 +753,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: '@deepseek-ai/dsh-api-session-controller/types#SessionAttachmentValue',
         schema: _deepseek_ai_dsh_api_session_controller_session_attachment_result$schema,
       },
-      sourceLocation: {"file":"packages/api/session-controller/src/index.ts","line":340,"column":3},
+      sourceLocation: {"file":"packages/api/session-controller/src/index.ts","line":357,"column":3},
     },
     {
       id: '@deepseek-ai/dsh-api-session-controller#session/cancel',
@@ -738,7 +778,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: '@deepseek-ai/dsh-api-session-controller/types#SessionCancelValue',
         schema: _deepseek_ai_dsh_api_session_controller_session_cancel_result$schema,
       },
-      sourceLocation: {"file":"packages/api/session-controller/src/index.ts","line":360,"column":3},
+      sourceLocation: {"file":"packages/api/session-controller/src/index.ts","line":377,"column":3},
     },
     {
       id: '@deepseek-ai/dsh-api-session-controller#session/canOpenWorkspacePath',
@@ -753,7 +793,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: '@deepseek-ai/dsh-api-session-controller#session/canOpenWorkspacePath:result',
         schema: _deepseek_ai_dsh_api_session_controller_session_canOpenWorkspacePath_result$schema,
       },
-      sourceLocation: {"file":"packages/api/session-controller/src/index.ts","line":265,"column":3},
+      sourceLocation: {"file":"packages/api/session-controller/src/index.ts","line":272,"column":3},
     },
     {
       id: '@deepseek-ai/dsh-api-session-controller#session/control',
@@ -770,7 +810,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: '@deepseek-ai/dsh-api-session-controller/types#SessionControlFrame',
         schema: _deepseek_ai_dsh_api_session_controller_session_control_result$schema,
       },
-      sourceLocation: {"file":"packages/api/session-controller/src/index.ts","line":393,"column":3},
+      sourceLocation: {"file":"packages/api/session-controller/src/index.ts","line":410,"column":3},
     },
     {
       id: '@deepseek-ai/dsh-api-session-controller#session/create',
@@ -795,7 +835,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: '@deepseek-ai/dsh-api-session-controller/types#SessionCreateValue',
         schema: _deepseek_ai_dsh_api_session_controller_session_create_result$schema,
       },
-      sourceLocation: {"file":"packages/api/session-controller/src/index.ts","line":237,"column":3},
+      sourceLocation: {"file":"packages/api/session-controller/src/index.ts","line":244,"column":3},
     },
     {
       id: '@deepseek-ai/dsh-api-session-controller#session/follow',
@@ -822,7 +862,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: '@deepseek-ai/dsh-api-session-controller/types#SessionFollowFrame',
         schema: _deepseek_ai_dsh_api_session_controller_session_follow_result$schema,
       },
-      sourceLocation: {"file":"packages/api/session-controller/src/index.ts","line":383,"column":3},
+      sourceLocation: {"file":"packages/api/session-controller/src/index.ts","line":400,"column":3},
     },
     {
       id: '@deepseek-ai/dsh-api-session-controller#session/fork',
@@ -847,7 +887,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: '@deepseek-ai/dsh-api-session-controller/types#SessionForkValue',
         schema: _deepseek_ai_dsh_api_session_controller_session_fork_result$schema,
       },
-      sourceLocation: {"file":"packages/api/session-controller/src/index.ts","line":318,"column":3},
+      sourceLocation: {"file":"packages/api/session-controller/src/index.ts","line":335,"column":3},
     },
     {
       id: '@deepseek-ai/dsh-api-session-controller#session/list',
@@ -873,7 +913,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: '@deepseek-ai/dsh-api-session-controller/types#SessionListValue',
         schema: _deepseek_ai_dsh_api_session_controller_session_list_result$schema,
       },
-      sourceLocation: {"file":"packages/api/session-controller/src/index.ts","line":216,"column":9},
+      sourceLocation: {"file":"packages/api/session-controller/src/index.ts","line":223,"column":9},
     },
     {
       id: '@deepseek-ai/dsh-api-session-controller#session/modelCatalog',
@@ -888,7 +928,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: '@deepseek-ai/dsh-api-session-controller/types#ModelCatalog',
         schema: _deepseek_ai_dsh_api_session_controller_session_modelCatalog_result$schema,
       },
-      sourceLocation: {"file":"packages/api/session-controller/src/index.ts","line":256,"column":3},
+      sourceLocation: {"file":"packages/api/session-controller/src/index.ts","line":263,"column":3},
     },
     {
       id: '@deepseek-ai/dsh-api-session-controller#session/openWorkspacePath',
@@ -914,7 +954,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: '@deepseek-ai/dsh-api-session-controller/types#SessionOpenWorkspacePathValue',
         schema: _deepseek_ai_dsh_api_session_controller_session_openWorkspacePath_result$schema,
       },
-      sourceLocation: {"file":"packages/api/session-controller/src/index.ts","line":277,"column":9},
+      sourceLocation: {"file":"packages/api/session-controller/src/index.ts","line":293,"column":9},
     },
     {
       id: '@deepseek-ai/dsh-api-session-controller#session/page',
@@ -940,7 +980,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: '@deepseek-ai/dsh-api-session-controller/types#SessionPage',
         schema: _deepseek_ai_dsh_api_session_controller_session_page_result$schema,
       },
-      sourceLocation: {"file":"packages/api/session-controller/src/index.ts","line":371,"column":3},
+      sourceLocation: {"file":"packages/api/session-controller/src/index.ts","line":388,"column":3},
     },
     {
       id: '@deepseek-ai/dsh-api-session-controller#session/prompt',
@@ -966,7 +1006,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: '@deepseek-ai/dsh-api-session-controller/types#SessionPromptValue',
         schema: _deepseek_ai_dsh_api_session_controller_session_prompt_result$schema,
       },
-      sourceLocation: {"file":"packages/api/session-controller/src/index.ts","line":329,"column":3},
+      sourceLocation: {"file":"packages/api/session-controller/src/index.ts","line":346,"column":3},
     },
     {
       id: '@deepseek-ai/dsh-api-session-controller#session/rename',
@@ -991,7 +1031,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: '@deepseek-ai/dsh-api-session-controller/types#SessionRenameValue',
         schema: _deepseek_ai_dsh_api_session_controller_session_rename_result$schema,
       },
-      sourceLocation: {"file":"packages/api/session-controller/src/index.ts","line":308,"column":3},
+      sourceLocation: {"file":"packages/api/session-controller/src/index.ts","line":325,"column":3},
     },
     {
       id: '@deepseek-ai/dsh-api-session-controller#session/search',
@@ -1017,7 +1057,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: '@deepseek-ai/dsh-api-session-controller/types#SessionSearchValue',
         schema: _deepseek_ai_dsh_api_session_controller_session_search_result$schema,
       },
-      sourceLocation: {"file":"packages/api/session-controller/src/index.ts","line":227,"column":3},
+      sourceLocation: {"file":"packages/api/session-controller/src/index.ts","line":234,"column":3},
     },
     {
       id: '@deepseek-ai/dsh-api-session-controller#session/selectModel',
@@ -1042,7 +1082,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: '@deepseek-ai/dsh-api-session-controller/types#SessionSelectModelValue',
         schema: _deepseek_ai_dsh_api_session_controller_session_selectModel_result$schema,
       },
-      sourceLocation: {"file":"packages/api/session-controller/src/index.ts","line":247,"column":3},
+      sourceLocation: {"file":"packages/api/session-controller/src/index.ts","line":254,"column":3},
     },
     {
       id: '@deepseek-ai/dsh-api-session-controller#session/updateQueue',
@@ -1067,7 +1107,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: '@deepseek-ai/dsh-api-session-controller/types#SessionUpdateQueueValue',
         schema: _deepseek_ai_dsh_api_session_controller_session_updateQueue_result$schema,
       },
-      sourceLocation: {"file":"packages/api/session-controller/src/index.ts","line":350,"column":3},
+      sourceLocation: {"file":"packages/api/session-controller/src/index.ts","line":367,"column":3},
     },
     {
       id: '@deepseek-ai/dsh-api-session-controller#skills/list',

package/lib/types/agent.js

@@ -380,13 +380,14 @@ export class ApiSessionAgentController {
      */
     async composeAgent(presetId) {
         const presets = this.ctx.get('agentPresets');
-        if (presets === undefined)
-            return { setup: (agentCtx) => { this.installSelection(agentCtx); } };
+        if (presets === undefined) {
+            return { setup: (_agentCtx, agent) => { this.installSelection(agent); } };
+        }
         const resolvedId = (await presets.resolve(presetId)).id;
         return {
             agentPreset: resolvedId,
-            setup: async (agentCtx) => {
-                this.installSelection(agentCtx);
+            setup: async (agentCtx, agent) => {
+                this.installSelection(agent);
                 await presets.mount(agentCtx, resolvedId);
             },
         };
@@ -506,10 +507,7 @@ export class ApiSessionAgentController {
         const { provider, model } = this.ctx.agentDefaultModel.currentSelection();
         return { provider, model };
     }
-    installSelection(agentCtx) {
-        const agent = agentCtx.agent;
-        if (agent === undefined)
-            throw new Error('api-session: Agent setup has no scoped Agent');
+    installSelection(agent) {
         this.selectionFor(agent);
     }
     /**

package/lib/types/client/session-wire-event.d.ts

@@ -0,0 +1,11 @@
+/** Event-local acceptance for raw Session journal responses; payloads remain owner-defined JSON. */
+import type { SessionWireEvent } from '../types.ts';
+/**
+ * Reject non-current event envelopes without stripping or normalizing wire fields.
+ * Range membership and source existence require the durable log and remain Host-owned.
+ * @param value - one event received in a follow frame or history page.
+ * @returns nothing after narrowing the accepted event envelope.
+ * @throws when the envelope or current event-local metadata is invalid.
+ */
+export declare function assertSessionWireEvent(value: unknown): asserts value is SessionWireEvent;
+//# sourceMappingURL=session-wire-event.d.ts.map

package/lib/types/client/session-wire-event.js

@@ -0,0 +1,43 @@
+/** Event-local acceptance for raw Session journal responses; payloads remain owner-defined JSON. */
+import { validateSessionEventData, validateSurfaceMetadata } from '@deepseek-ai/dsh-session/surface';
+/**
+ * Reject non-current event envelopes without stripping or normalizing wire fields.
+ * Range membership and source existence require the durable log and remain Host-owned.
+ * @param value - one event received in a follow frame or history page.
+ * @returns nothing after narrowing the accepted event envelope.
+ * @throws when the envelope or current event-local metadata is invalid.
+ */
+export function assertSessionWireEvent(value) {
+    const subject = 'session wire event';
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        throw new Error(`${subject} must be an object`);
+    }
+    const event = value;
+    for (const key of Object.keys(event)) {
+        switch (key) {
+            case 'type':
+            case 'seq':
+            case 'time':
+            case 'data':
+            case 'ignorable':
+            case 'surfaceOp':
+            case 'sourceEventSeqs':
+                break;
+            default:
+                throw new Error(`${subject} has unexpected field ${key}`);
+        }
+    }
+    const seq = event['seq'];
+    if (typeof event['type'] !== 'string'
+        || typeof seq !== 'number' || !Number.isSafeInteger(seq) || seq < 0 || Object.is(seq, -0)
+        || typeof event['time'] !== 'number' || !Number.isSafeInteger(event['time'])
+        || !Object.hasOwn(event, 'data') || event['data'] === undefined
+        || (Object.hasOwn(event, 'ignorable') && event['ignorable'] !== true)) {
+        throw new Error(`${subject} has an invalid envelope`);
+    }
+    // Event names and payloads are merge-extensible; only event-local owner rules run here.
+    const current = event;
+    validateSurfaceMetadata(current);
+    validateSessionEventData(current, subject);
+}
+//# sourceMappingURL=session-wire-event.js.map

package/lib/types/client/transport.js

@@ -2,6 +2,7 @@
 import { RemoteError } from '@deepseek-ai/dsh-typert-protocol';
 import { RemoteJournalStream, RemoteSnapshotStream, RemoteStreamCarrierError, } from '@deepseek-ai/dsh-api-gateway/client';
 import { historyEntries, historyRecordFirstSeq, historyRecordLastSeq, } from "./sessions/history-records.js";
+import { assertSessionWireEvent } from "./session-wire-event.js";
 export { SESSION_SEARCH_RESULT_LIMIT, SESSION_SEARCH_SNIPPET_MAX_CODE_POINTS, } from "../types.js";
 function toSessionJournalChange(change) {
     switch (change.type) {
@@ -78,6 +79,8 @@ export class SessionEventStream extends RemoteJournalStream {
             ...(request.maxMessages === undefined ? {} : { maxMessages: request.maxMessages }),
         }, signal)) {
             if (frame.type === 'snapshot') {
+                for (const record of frame.records)
+                    assertSessionWireEvent(record.event);
                 if (frame.assistantStream === undefined) {
                     throw new RemoteError('gateway/internal', 'session assistant stream omitted its opted-in opening baseline', {});
                 }
@@ -103,6 +106,7 @@ export class SessionEventStream extends RemoteJournalStream {
                 yield { type: 'notification', notification: frame.frame };
                 continue;
             }
+            assertSessionWireEvent(frame.event);
             yield { type: 'entry', entry: frame };
         }
     }
@@ -111,6 +115,8 @@ export class SessionEventStream extends RemoteJournalStream {
         const result = await this.remote.session.page({ address: this.address, throughSeq, ...request }, signal);
         if (!result.ok)
             throw result.error;
+        for (const record of result.value.records)
+            assertSessionWireEvent(record.event);
         return result.value;
     }
     /** @inheritdoc */

package/lib/types/commands.d.ts

@@ -38,7 +38,7 @@ export declare class SessionCommandController {
      */
     fork(request: SessionForkRequest): Promise<SessionForkValue>;
     /**
-     * Admit one browser prompt after explicit Agent resume and image validation.
+     * Reject empty content, then admit one prompt after Agent and attachment validation.
      * @param request - Session identity, prompt content, source metadata, and delivery mode.
      * @returns acknowledgement that the Agent accepted the prompt.
      */

package/lib/types/commands.js

@@ -62,6 +62,9 @@ import { canonicalClientTimeZone } from '@deepseek-ai/dsh-util-time';
 import { assertNever } from '@deepseek-ai/dsh-util-values';
 import { RemoteError, remoteErrorOf } from '@deepseek-ai/dsh-typert-protocol';
 import { ApiSessionCwdConflict, ApiSessionNotFound, ApiSessionPresetConflict, ApiSessionSubagentOwnership, apiSessionSubagentOwnershipError, hasApiSessionSubagentOwner, inspectApiSession, } from "./agent.js";
+function hasPromptContent(content) {
+    return content.some(part => part.type !== 'text' || part.text.trim().length > 0);
+}
 /** Implements Session business commands delegated by the Session Controller Remote service. */
 export class SessionCommandController {
     ctx;
@@ -271,11 +274,14 @@ export class SessionCommandController {
         }
     }
     /**
-     * Admit one browser prompt after explicit Agent resume and image validation.
+     * Reject empty content, then admit one prompt after Agent and attachment validation.
      * @param request - Session identity, prompt content, source metadata, and delivery mode.
      * @returns acknowledgement that the Agent accepted the prompt.
      */
     async prompt(request) {
+        if (!hasPromptContent(request.content)) {
+            throw new RemoteError('gateway/bad-request', 'prompt content must include non-whitespace text or an attachment', {});
+        }
         const clientTimeZone = request.clientTimeZone === undefined
             ? undefined
             : canonicalClientTimeZone(request.clientTimeZone);
@@ -379,9 +385,13 @@ export class SessionCommandController {
      * @returns acknowledgement that the queue mutation was applied.
      */
     updateQueue(request) {
-        if (request.action.kind === 'edit'
-            && request.action.content.some(block => block.type !== 'text')) {
-            throw new RemoteError('session/attachment-invalid', 'queue edits accept text content only', { reason: 'QUEUE_EDIT_NON_TEXT' });
+        if (request.action.kind === 'edit') {
+            if (request.action.content.some(block => block.type !== 'text')) {
+                throw new RemoteError('session/attachment-invalid', 'queue edits accept text content only', { reason: 'QUEUE_EDIT_NON_TEXT' });
+            }
+            if (!hasPromptContent(request.action.content)) {
+                throw new RemoteError('gateway/bad-request', 'queue edit content must include non-whitespace text', {});
+            }
         }
         const agent = this.ctx.agents.get(request.sessionId);
         if (agent === undefined) {

package/lib/types/control.d.ts

@@ -15,7 +15,6 @@ export declare class SessionControlController {
     control(signal: AbortSignal): AsyncIterable<SessionControlFrame>;
     private baseline;
     private projectionBaseline;
-    private onSessionEvent;
     private onJobsChanged;
     private jobsFor;
     private broadcast;

package/lib/types/control.js

@@ -7,7 +7,6 @@ export class SessionControlController {
     /** @param ctx - Host context carrying live Agent, projection, and jobs services. */
     constructor(ctx) {
         this.ctx = ctx;
-        ctx.on('session/event', (session, event) => { this.onSessionEvent(session, event); });
         ctx.sessionProjections.onChanged((session, key, value, seq) => {
             this.broadcast({
                 type: 'projection',
@@ -16,6 +15,16 @@ export class SessionControlController {
                 value: value,
                 seq,
             });
+            if (key !== 'inbox')
+                return;
+            const agent = this.ctx.agents.get(session.id);
+            if (agent?.session !== session)
+                return;
+            this.broadcast({
+                type: 'queue',
+                sessionId: session.id,
+                items: queueItemsFromInbox(value),
+            });
         });
         ctx.inject(['jobs'], (jobsCtx) => {
             jobsCtx.jobs.onJobsChanged((owner) => { this.onJobsChanged(owner); });
@@ -76,18 +85,6 @@ export class SessionControlController {
         }
         return blocks;
     }
-    onSessionEvent(session, event) {
-        if (event.type !== 'agent/inbox/spliced')
-            return;
-        const agent = this.ctx.agents.get(session.id);
-        if (agent?.session !== session)
-            return;
-        this.broadcast({
-            type: 'queue',
-            sessionId: session.id,
-            items: queueItems(agent, event.data),
-        });
-    }
     onJobsChanged(owner) {
         if (owner !== undefined) {
             this.broadcast({ type: 'jobs', sessionId: owner.id, jobs: this.jobsFor(owner) });
@@ -151,21 +148,21 @@ class ControlQueue {
         }
     }
 }
-function queueItems(agent, splice) {
-    const project = (target) => {
-        const messages = target === 'next-turn' ? agent.inbox.nextTurn : agent.inbox.nextStep;
-        return splice?.target === target
-            ? messages.toSpliced(splice.start, splice.removedCount ?? 0, ...splice.inserted)
-            : messages;
-    };
+function queueItems(agent) {
+    return queueItemsFromInbox({
+        'next-turn': agent.inbox.nextTurn,
+        'next-step': agent.inbox.nextStep,
+    });
+}
+function queueItemsFromInbox(inbox) {
     return [
-        ...project('next-turn').map(message => ({
+        ...inbox['next-turn'].map(message => ({
             id: message.id,
             placement: 'queued',
             ...promptRpcId(message),
             message: { id: message.id, content: message.content },
         })),
-        ...project('next-step').map(message => ({
+        ...inbox['next-step'].map(message => ({
             id: message.id,
             placement: message.source.kind === 'user' ? 'steering' : 'context',
             ...promptRpcId(message),

package/lib/types/index.d.ts

@@ -26,6 +26,8 @@ export interface Config {
 export interface SessionControllerInternals {
     /** Native default-application handoff. */
     readonly openPath?: (path: string, signal: AbortSignal) => Promise<void>;
+    /** Native file-manager handoff. */
+    readonly revealPath?: (path: string, signal: AbortSignal) => Promise<void>;
     /** Native handoff availability probe. */
     readonly canOpenPath?: () => boolean;
 }
@@ -39,6 +41,7 @@ export declare class SessionController extends TypertRemoteService {
     private readonly history;
     private readonly listState;
     private readonly openPath;
+    private readonly revealPath;
     private readonly canOpenPath;
     private readonly promotions;
     /**
@@ -97,6 +100,15 @@ export declare class SessionController extends TypertRemoteService {
      * @returns true when the matching open operation is available.
      */
     canOpenWorkspacePath(): boolean;
+    /**
+     * Describe the serving desktop for authenticated file-action routes.
+     * @returns Host name, configured availability, and platform-specific file-manager behavior.
+     */
+    workspaceDesktop(): {
+        name: string;
+        available: boolean;
+        fileManager: 'finder' | 'explorer' | 'directory' | null;
+    };
     /**
      * Open one path prepared by a Session-aware caller on the Host desktop.
      * @param request - path after best-effort Session workspace resolution.

package/lib/types/index.js

@@ -85,9 +85,10 @@ var __disposeResources = (this && this.__disposeResources) || (function (Suppres
     var e = new Error(message);
     return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
 });
+import { hostname } from 'node:os';
 import z from '@deepseek-ai/schemastery';
 import { errorChain } from '@deepseek-ai/dsh-llm';
-import { canOpenNativePath, openNativePath } from '@deepseek-ai/dsh-native-command';
+import { canOpenNativePath, nativeFileManager, openNativePath, revealNativePath } from '@deepseek-ai/dsh-native-command';
 import { Remote, RemoteError, TypertRemoteService } from '@deepseek-ai/dsh-typert-protocol';
 import { ApiSessionAgentController, inspectApiSession, } from "./agent.js";
 import { SessionCommandController } from "./commands.js";
@@ -98,6 +99,7 @@ import { ApiSessionList } from "./list.js";
 import { buildModelCatalog } from "./catalog.js";
 import { installModelSelectionProjection } from "./model-selection-projection.js";
 import { SessionSkillCatalog } from "./skill-catalog.js";
+import { SessionMediaReferences } from "./media-references.js";
 export { ApiSessionNotFound } from "./agent.js";
 export { SessionFileReferences } from "./file-references.js";
 export { SessionSkillCatalog } from "./skill-catalog.js";
@@ -179,6 +181,7 @@ let SessionController = (() => {
         history;
         listState;
         openPath;
+        revealPath;
         canOpenPath;
         promotions = new Set();
         /**
@@ -206,9 +209,11 @@ let SessionController = (() => {
             this.history = new SessionHistoryController(ctx, (observation) => { this.promote(observation); });
             this.listState = new ApiSessionList(ctx);
             this.openPath = internals.openPath ?? openNativePath;
+            this.revealPath = internals.revealPath ?? revealNativePath;
             this.canOpenPath = internals.canOpenPath
                 ?? (() => config.nativeOpen ?? (internals.openPath !== undefined || canOpenNativePath()));
             ctx.plugin(SessionFileReferences);
+            ctx.plugin(SessionMediaReferences);
             ctx.plugin(SessionSkillCatalog);
             ctx.on('session/created', (session) => {
                 ctx.emit('api-session/added', this.listState.summaryFor(session));
@@ -329,6 +334,14 @@ let SessionController = (() => {
         canOpenWorkspacePath() {
             return this.canOpenPath();
         }
+        /**
+         * Describe the serving desktop for authenticated file-action routes.
+         * @returns Host name, configured availability, and platform-specific file-manager behavior.
+         */
+        workspaceDesktop() {
+            const fileManager = nativeFileManager();
+            return { name: hostname(), available: fileManager !== null && this.canOpenPath(), fileManager };
+        }
         /**
          * Open one path prepared by a Session-aware caller on the Host desktop.
          * @param request - path after best-effort Session workspace resolution.
@@ -342,7 +355,10 @@ let SessionController = (() => {
             }
             signal.throwIfAborted();
             try {
-                await this.openPath(request.path, signal);
+                if (request.action === 'reveal')
+                    await this.revealPath(request.path, signal);
+                else
+                    await this.openPath(request.path, signal);
                 return { opened: true };
             }
             catch (error) {