@deepseek-ai/dsh-subagent-dsh-sdk 0.2.0-rc.2 → 0.2.1-alpha.2

package/README.i18n.yaml

@@ -18,17 +18,17 @@
   en: d6eb16d8fc690671
   zh: 5865ee3bed0b36ca
 /deepseek-ai-dsh-subagent-dsh-sdk/use-this-package/when-to-choose-it:
-  en: 617cbcee49ca46d6
-  zh: fbe52df163a1e64f
+  en: 83a84f1d42a071da
+  zh: 0dce8e7ea861f8c2
 /deepseek-ai-dsh-subagent-dsh-sdk/use-this-package/configuration:
-  en: a242a1a4d16e5241
-  zh: 20a8e87d4fec4117
+  en: 67cf17bbc985cad7
+  zh: ea432ae524f4ade9
 /deepseek-ai-dsh-subagent-dsh-sdk/use-this-package/what-you-get:
   en: b9ccfa85b40b07eb
   zh: 4f84e7327b4ff188
 /deepseek-ai-dsh-subagent-dsh-sdk/use-this-package/failure-and-recovery:
-  en: 21eb548e92fe20ce
-  zh: d865a29acf60018e
+  en: 9e3838df9eba09bb
+  zh: fbd00b9d72e41adc
 /deepseek-ai-dsh-subagent-dsh-sdk/understand-the-implementation:
   en: 00d076edd7fee716
   zh: 7aea818c13fe3cc1
@@ -39,8 +39,8 @@
   en: 1bed6c1577997df6
   zh: 8c99f132377f6ca2
 /deepseek-ai-dsh-subagent-dsh-sdk/understand-the-implementation/run-flow:
-  en: f268db0520abf6f7
-  zh: 4517fc7ea6bd099c
+  en: 6c50e4e8dc5e0698
+  zh: 9d0011e28341bbde
 /deepseek-ai-dsh-subagent-dsh-sdk/understand-the-implementation/stop-reason-mapping:
   en: e040a57202916f91
   zh: 196bf38f0f0db310
@@ -69,17 +69,17 @@
   en: 75d061c2151624a7
   zh: 71e58e020b60ff90
 /deepseek-ai-dsh-subagent-dsh-sdk/model-experience/parent-tool-result-indirectly/what-the-model-sees:
-  en: e299c74b31e3ed7d
-  zh: 118adc28e0755bfb
+  en: 5e4e3efe7517f782
+  zh: 0465e164583f6bc3
 /deepseek-ai-dsh-subagent-dsh-sdk/model-experience/parent-tool-result-indirectly/token-effect:
-  en: 600ac97cdd163650
-  zh: d08f0a72321a9548
+  en: 4fae54e2ff0c4874
+  zh: 1574bfe874f66a1f
 /deepseek-ai-dsh-subagent-dsh-sdk/model-experience/parent-tool-result-indirectly/kv-cache-effect:
   en: f5d5f97a153f7c70
   zh: 3d6bc05b9eadfbc2
 /deepseek-ai-dsh-subagent-dsh-sdk/known-limitations-and-deferred-work:
-  en: 01cbee2a855b1d6a
-  zh: 701e7afc9a7fc862
+  en: 9158e90d1a521c05
+  zh: 246ed0c694ead7ac
 /deepseek-ai-dsh-subagent-dsh-sdk/known-limitations-and-deferred-work/dev-note:
-  en: 854b5d4640bb8c07
-  zh: acd7a2aa4a4f457c
+  en: 04a404ccea615ef3
+  zh: df2d9d901d75f024

package/README.md

@@ -31,7 +31,7 @@ Mount this provider when a delegation should run as a complete Harness runtime i
 
 Choose this backend when the child must be a full harness peer — its own composition, session persistence, model route, and tools — rather than an agent that shares the parent's process. Choose an in-process backend when the child must share the parent's composition or honor parent-enforced non-route capabilities: this provider accepts agent route options but rejects structured output, depth caps, tool filters, and personas rather than silently omitting them.
 
-The provider advertises `agentOptions: true`, with `outputSchema`/`depthLimit`/`toolFilter`/`persona` false, and `inheritsParentContext: false`. Its immutable `agentRouteDefaults` publish the configured provider/model baseline to `dsh-tool-subagent` before model overrides and exact-route preflight; `start()` independently applies the same configuration defaults for direct callers and `maxTokens`. Agent route values cross the SDK wire as an explicit whitelist; the child remains a fresh runtime in another process, and the only value derived from the parent agent itself is the workspace cwd. `dsh-tool-subagent` deployments over this provider set `maxDepth: 'provider-managed'` — the child harness owns its own recursion budget.
+The provider advertises `agentOptions: true`, with `outputSchema`/`depthLimit`/`toolFilter`/`persona` false, and `inheritsParentContext: false`. Its immutable `agentRouteDefaults` publish the configured provider/model baseline to `dsh-tool-subagent` before model overrides and exact-route preflight; the backend applies the same configuration defaults during activation startup, including `maxTokens`. Agent route values cross the SDK wire as an explicit whitelist; the child remains a fresh runtime in another process, and the child process uses the selected effective directory while its Session retains the parent origin directory. `dsh-tool-subagent` deployments over this provider set `maxDepth: 'provider-managed'` — the child harness owns its own recursion budget.
 
 ### Configuration
 
@@ -42,7 +42,6 @@ The provider advertises `agentOptions: true`, with `outputSchema`/`depthLimit`/`
 | `profile` | `sdk` | Named child profile |
 | `patches` | `[]` | Ordered per-launch profile patch files, resolved and checked at plugin load |
 | `dshHome` | required | Absolute isolated Harness home for every nested child process |
-| `cwd` | parent session cwd | Working-directory override for the child process and its SDK session |
 | `provider` | `deepseek-official` | Provider route sent in the child's `initialize` |
 | `model` | `deepseek-v4-flash` | Model sent in the child's `initialize` |
 | `maxTokens` | adapter/provider route default | Per-request output-token cap sent in the child's `initialize` |
@@ -77,7 +76,7 @@ A successful run returns the child's final assistant text (or accumulated partia
 
 ### Failure and recovery
 
-An already-aborted request fails before path resolution or spawn. A route, spawn, handshake, or pre-publication cancellation failure ordinarily rejects only after the subprocess is reaped. If initialization and cleanup both fail, the ordered safe facts preserve both failures without claiming quiescence. A child runtime that fails after publication settles through the run rather than rejecting it; partial output stays separate from the safe diagnostic. Diagnostics expose only the provider plus `initialize`, `session-run`, or `shutdown` stage and a fixed category. They never copy SDK messages, stderr, paths, task content, environment values, credentials, or protocol payloads.
+The configured SDK runtime must implement `session/wait`; a runtime without it reports an execution failure. Update the provider and a separately configured `dshBin` runtime together. An already-aborted request fails before path resolution or spawn. A route, spawn, handshake, or pre-publication cancellation failure ordinarily rejects only after the subprocess is reaped. If initialization and cleanup both fail, the ordered safe facts preserve both failures without claiming quiescence. A child runtime that fails after publication settles through the run rather than rejecting it; partial output stays separate from the safe diagnostic. Diagnostics expose only the provider plus `initialize`, `session-run`, or `shutdown` stage and a fixed category. They never copy SDK messages, stderr, paths, task content, environment values, credentials, or protocol payloads.
 
 -----
 
@@ -104,7 +103,7 @@ This section explains how the backend drives a child Harness runtime and where t
 
 ### Run flow
 
-A start resolves the child's working directory and one process-wide SDK route before spawning. Each declared `request.agentOptions` field (`provider`, `model`, `reasoningEffort`, or `maxTokens`) overrides the matching provider-instance default; omission preserves the configured provider/model and optional cap, while reasoning effort remains absent unless the request supplies it. The provider spawns the runtime through the SDK client and completes the `initialize` handshake, including exact-model and effort validation, before it fulfills. A route, spawn, handshake, or pre-publication cancellation failure rejects only after the subprocess is reaped; a working-directory resolution failure rejects before spawning. After publication the provider owns one SDK activity and reads the child's answer from its session events: the last complete non-empty `assistant/message` (an empty-content message that records usage is skipped), or the accumulated `text-delta` stream when no such message exists. Disposal is idempotent: it settles the result locally as `aborted`, sends a bounded protocol `shutdown` request, then escalates through stdin EOF → SIGTERM → SIGKILL to actual exit.
+A start resolves the child's working directory and one process-wide SDK route before spawning. Each declared `request.agentOptions` field (`provider`, `model`, `reasoningEffort`, or `maxTokens`) overrides the matching provider-instance default; omission preserves the configured provider/model and optional cap, while reasoning effort remains absent unless the request supplies it. The provider spawns the runtime through the SDK client and completes the `initialize` handshake, including exact-model and effort validation, before it fulfills. A route, spawn, handshake, or pre-publication cancellation failure rejects only after the subprocess is reaped; a working-directory resolution failure rejects before spawning. After publication the provider subscribes to the child Session, queues its prompt, and waits through `session/wait` for managed descendants and subsequent root turns. It reads the child's answer from the ordered session events: the last complete non-empty `assistant/message` (an empty-content message that records usage is skipped), or the accumulated `text-delta` stream when no such message exists. Disposal is idempotent: it settles the result locally as `aborted`, sends a bounded protocol `shutdown` request, then escalates through stdin EOF → SIGTERM → SIGKILL to actual exit. The activation manager owns that run after acceptance; the caller's startup signal no longer cancels the child. Each activation executes once, and its receipt cancels execution and awaits cleanup.
 
 ### Stop-reason mapping
 
@@ -152,11 +151,11 @@ Independent of the parent request cache. Each SDK child can reuse only prefixes
 
 #### What the model sees
 
-Through `dsh-tool-subagent`, the parent receives only the child's final assistant text (or accumulated partial text) or that consumer's exact stop-reason error, not intermediate messages or tool traffic. A diagnostic-bearing non-completed result presents the safe diagnostic before separately preserved partial assistant output; startup and shutdown errors expose the same fixed facts without raw SDK text.
+Through `dsh-tool-subagent`, the parent model first receives a child id, then a completion notice containing final or partial assistant text, the stop reason, and safe diagnostic. The parent Session independently retains the external task identity and complete terminal result. Intermediate messages and tool traffic do not enter the parent Session.
 
 #### Token effect
 
-Parent input grows only by the final result or error, which is data-dependent and retained until compaction. This provider adds no parent schema itself.
+Parent input grows by the start acknowledgement and completion notice, whose size depends on the result data and persists until compaction. This provider adds no parent schema by itself.
 
 #### KV Cache effect
 
@@ -171,7 +170,7 @@ These limits define when this backend is a poor fit or needs special operational
 
 - **A fresh runtime process per run** — no pooling; a harness runtime boots a full plugin tree, so per-run spawn cost is higher than the ACP backend's typical child.
 - **No non-route start-time capabilities** — the parent can select the child agent route but cannot enforce `outputSchema`, depth, tool filters, or persona inside the child process; configure the selected child profile and its ordered patches instead.
-- **The child's transcript stays in the child's own session root** — the parent log records only the delegation tool call and result; the streamed `session.event` channel is consumed for output extraction, not bridged into the parent log.
+- **The child's transcript stays in the child's own session root** — the parent log retains the external task identity and full result, while the streamed `session.event` channel is consumed for output extraction rather than transcript replication.
 - **Local child processes only** — the resolved working directory is a local path; a remote runtime would need its own backend.
 
 <a id="dev-note"></a>
@@ -186,5 +185,3 @@ This Dev Note is working context for maintainers: open questions and undecided d
 - **Remote runtimes** — a remote runtime would need its own backend and workspace mapping.
 
 </details>
-
-**Runtime invariant:** No companion is published. Run lifecycle pairing is owned and checked by the subagent seam's invariant; this backend's own state lives in the child process beyond this context's event streams.

package/README.zh.md

@@ -31,7 +31,7 @@ kind: "package-reference"
 
 当子进程必须是完整的 harness 对等体——拥有自己的组合、会话持久化、模型路由与工具——而不是共享父进程的 agent 时，选择此后端。当子进程必须共享父级组合或遵守父级强制的非路由能力时，请选择进程内后端：本提供方接受 agent 路由选项，但会拒绝结构化输出、深度上限、工具过滤或 persona，而不是静默省略。
 
-提供方声明 `agentOptions: true`，同时保持 `outputSchema`/`depthLimit`/`toolFilter`/`persona` 为 false，并且 `inheritsParentContext: false`。不可变的 `agentRouteDefaults` 会在模型覆盖与确切路由预检前，把配置的 provider／model 基线公开给 `dsh-tool-subagent`；`start()` 则为直接调用方独立应用同一份配置默认值，包括 `maxTokens`。agent 路由值通过显式白名单跨越 SDK 协议；子进程仍是另一进程里的全新运行时，唯一从父 agent 本身派生的值是工作区 cwd。基于本提供方的 `dsh-tool-subagent` 部署应设置 `maxDepth: 'provider-managed'`——子 harness 拥有自己的递归预算。
+提供方声明 `agentOptions: true`，同时保持 `outputSchema`/`depthLimit`/`toolFilter`/`persona` 为 false，并且 `inheritsParentContext: false`。不可变的 `agentRouteDefaults` 会在模型覆盖与确切路由预检前，把配置的 provider／model 基线公开给 `dsh-tool-subagent`；后端在 activation 启动时应用同一份配置默认值，包括 `maxTokens`。agent 路由值通过显式白名单跨越 SDK 协议；子进程仍是另一进程里的全新运行时，子进程使用所选有效目录，而其 Session 保留父级起始目录。基于本提供方的 `dsh-tool-subagent` 部署应设置 `maxDepth: 'provider-managed'`——子 harness 拥有自己的递归预算。
 
 ### 配置
 
@@ -42,7 +42,6 @@ kind: "package-reference"
 | `profile` | `sdk` | 具名子 profile |
 | `patches` | `[]` | 每次启动的有序 profile patch 文件，在插件加载时解析并校验 |
 | `dshHome` | 必填 | 每个嵌套子进程的绝对隔离 Harness home |
-| `cwd` | 父会话 cwd | 子进程及其 SDK 会话的工作目录覆盖值 |
 | `provider` | `deepseek-official` | 写入子进程 `initialize` 的提供方路由 |
 | `model` | `deepseek-v4-flash` | 写入子进程 `initialize` 的模型 |
 | `maxTokens` | 适配器／提供方路由默认值 | 写入子进程 `initialize` 的单次请求输出 token 上限 |
@@ -77,7 +76,7 @@ kind: "package-reference"
 
 ### 失败与恢复
 
-已取消的请求会在路径解析或 spawn 之前失败。路由、spawn、握手或发布前取消失败通常只在子进程被回收后拒绝；如果初始化与清理均失败，有序安全事实会保留两项失败，而不会宣称已完全停稳。子运行时在发布后失败时会通过运行本身结算，而不是拒绝；部分输出与安全诊断保持分离。诊断只公开提供方、`initialize`、`session-run` 或 `shutdown` 阶段，以及固定类别。SDK 消息、stderr、路径、任务内容、环境值、凭据和协议载荷绝不会复制到诊断中。
+配置的 SDK 运行时必须实现 `session/wait`；不支持该请求的运行时会报告执行失败。请一并更新提供方与单独配置的 `dshBin` 运行时。已取消的请求会在路径解析或 spawn 之前失败。路由、spawn、握手或发布前取消失败通常只在子进程被回收后拒绝；如果初始化与清理均失败，有序安全事实会保留两项失败，而不会宣称已完全停稳。子运行时在发布后失败时会通过运行本身结算，而不是拒绝；部分输出与安全诊断保持分离。诊断只公开提供方、`initialize`、`session-run` 或 `shutdown` 阶段，以及固定类别。SDK 消息、stderr、路径、任务内容、环境值、凭据和协议载荷绝不会复制到诊断中。
 
 -----
 
@@ -104,7 +103,7 @@ kind: "package-reference"
 
 ### 运行流程
 
-一次启动会在 spawn 前解析子进程工作目录与一条进程级 SDK 路由。`request.agentOptions` 中每个已声明字段（`provider`、`model`、`reasoningEffort` 或 `maxTokens`）都会覆盖对应的提供方实例默认值；省略时保留已配置的提供方／模型与可选上限，而推理强度只有在请求提供时才会出现。随后，提供方通过 SDK 客户端 spawn 运行时，并在履行前完成 `initialize` 握手，其中包括确切模型与推理强度校验。路由、spawn、握手或发布前取消失败时，只会在子进程被回收后拒绝；工作目录解析失败则会在尚未 spawn 任何内容时拒绝。发布后，提供方拥有一段 SDK 活动，并从子会话事件中读取答案：最后一条完整且非空的 `assistant/message`（记录 usage 的空内容消息会被跳过）；若没有这类消息，则取累积的 `text-delta` 流。dispose 是幂等的：先在本地把结果确定为 `aborted`，发出有界的协议 `shutdown` 请求，再经 stdin EOF → SIGTERM → SIGKILL 升级到实际退出。
+一次启动会在 spawn 前解析子进程工作目录与一条进程级 SDK 路由。`request.agentOptions` 中每个已声明字段（`provider`、`model`、`reasoningEffort` 或 `maxTokens`）都会覆盖对应的提供方实例默认值；省略时保留已配置的提供方／模型与可选上限，而推理强度只有在请求提供时才会出现。随后，提供方通过 SDK 客户端 spawn 运行时，并在履行前完成 `initialize` 握手，其中包括确切模型与推理强度校验。路由、spawn、握手或发布前取消失败时，只会在子进程被回收后拒绝；工作目录解析失败则会在尚未 spawn 任何内容时拒绝。发布后，提供方先订阅子会话，再排入提示词，并通过 `session/wait` 等待受管理后代与根 Agent 后续轮次。它从有序会话事件中读取答案：最后一条完整且非空的 `assistant/message`（记录 usage 的空内容消息会被跳过）；若没有这类消息，则取累积的 `text-delta` 流。dispose 是幂等的：先在本地把结果确定为 `aborted`，发出有界的协议 `shutdown` 请求，再经 stdin EOF → SIGTERM → SIGKILL 升级到实际退出。任务接受后由 activation 管理器拥有该运行；此后调用方的启动信号不再取消子任务。每个 activation 只执行一次，其凭据用于取消执行并等待清理。
 
 ### 停止原因映射
 
@@ -152,11 +151,11 @@ kind: "package-reference"
 
 #### 模型看到什么
 
-经由 `dsh-tool-subagent`，父级只会收到子运行时最终的 assistant 文本（或累积的部分文本），或该消费方给出的精确停止原因错误；不会收到中间消息或工具流量。带诊断的非完成结果会先呈现安全诊断，再单独呈现保留的部分 assistant 输出；启动与 shutdown 错误使用同一固定事实，不公开原始 SDK 文本。
+通过 `dsh-tool-subagent`，父模型先收到 child id，随后收到含最终或部分 assistant 文本、停止原因与安全诊断的完成通知。父会话独立保存外部任务身份和完整终态结果。中间消息与工具通信不进入父会话。
 
 #### Token 影响
 
-父级输入只增加最终结果或错误，其大小取决于数据，并保留到压缩（compaction）为止。本提供方自身不会向父级添加任何 schema。
+父级输入增加启动确认与完成通知，内容大小取决于数据，并保留到压缩（compaction）为止。本提供方自身不会向父级添加任何 schema。
 
 #### KV Cache 影响
 
@@ -171,7 +170,7 @@ kind: "package-reference"
 
 - **每次运行都使用全新的运行时进程**——不使用进程池；harness 运行时需要启动完整的插件树，因此每次运行的 spawn 成本高于 ACP 后端通常使用的子进程。
 - **不支持路由之外的启动时能力**——父级可以选择子 agent 路由，但无法在子进程内强制执行 `outputSchema`、深度限制、工具过滤或 persona；应改为配置所选子 profile 及其有序 patch。
-- **子进程的 transcript（文本记录）保留在其自身的会话根目录中**——父级日志只记录委派工具调用与结果；流式 `session.event` 通道只用于提取输出，不会桥接到父级日志中。
+- **子任务转录保留在子进程自己的会话根目录中**——父日志保留外部任务身份与完整结果；流式 `session.event` 通道用于提取输出，不用于复制子任务转录。
 - **仅支持本地子进程**——解析出的工作目录是本地路径；远程运行时需要独立的后端。
 
 <a id="dev-note"></a>
@@ -186,5 +185,3 @@ kind: "package-reference"
 - **远程运行时**——远程运行时需要独立的后端与工作区映射。
 
 </details>
-
-**运行时不变式：** 不发布伴生入口。run 生命周期配对由 subagent seam 的不变式检查；本后端自身的状态位于子进程中，不在当前上下文的事件流内。

package/lib/index.js

@@ -1,10 +1,10 @@
 import { statSync } from "node:fs";
 import { isAbsolute, resolve } from "node:path";
 import z from "@deepseek-ai/schemastery";
-import { AssistantOutputFold, NO_START_CAPABILITIES, assertPositiveFinite, resolveChildCwd, settleRunResult, subprocessRunHandle, validateConfiguredCwd } from "@deepseek-ai/dsh-subagent";
+import { AssistantOutputFold, NO_START_CAPABILITIES, assertPositiveFinite, assertUsableCwd, settleRunResult, subprocessRunHandle } from "@deepseek-ai/dsh-subagent";
 import { randomUUID } from "node:crypto";
 import { brandString } from "@deepseek-ai/dsh-brand";
-import { DeepSeekHarness, JsonRpcResponseError, SdkProtocolError, TransportClosedError } from "@deepseek-ai/dsh-sdk-client";
+import { DeepSeekHarness, JsonRpcResponseError, SdkProtocolError, TransportClosedError, validatedSessionEvent } from "@deepseek-ai/dsh-sdk-client";
 import { scrubbedParentEnv } from "@deepseek-ai/dsh-subprocess";
 //#region lib/types/run.js
 /**
@@ -165,7 +165,7 @@ async function startSdkRun(request, spec) {
 		shutdownTimeoutMs: spec.shutdownTimeoutMs,
 		disposeEofGraceMs: spec.disposeEofGraceMs,
 		disposeGraceMs: spec.disposeGraceMs,
-		cwd: spec.cwd,
+		cwd: spec.originCwd ?? spec.cwd,
 		provider: spec.provider,
 		model: spec.model,
 		...spec.reasoningEffort === void 0 ? {} : { reasoningEffort: spec.reasoningEffort },
@@ -209,9 +209,15 @@ async function startSdkRun(request, spec) {
 	}
 	const childSessionId = `session-${randomUUID().replaceAll("-", "")}`;
 	const fold = new AssistantOutputFold();
-	const observe = (notification) => {
-		if (notification.method !== "session.event" || notification.params.sessionId !== childSessionId) return;
-		fold.push(notification.params.event);
+	const subscription = harness.client.subscribe((notification) => notification.method === "session.event" && notification.params.sessionId === childSessionId);
+	let lastEnd;
+	const drainNotifications = () => {
+		let notification;
+		while ((notification = subscription.tryNext()) !== void 0) {
+			const event = validatedSessionEvent(notification.params.event);
+			fold.push(event);
+			if (event.type === "turn/end") lastEnd = event.data.reason;
+		}
 	};
 	const collectOutput = () => fold.collect() ?? [];
 	const teardown = async () => {
@@ -226,17 +232,28 @@ async function startSdkRun(request, spec) {
 		}
 	};
 	let diagnostic;
+	let accepted = false;
 	return subprocessRunHandle({
 		id,
 		result: settleRunResult({
 			attempt: async () => {
 				try {
-					const turn = await Promise.race([harness.session(childSessionId).run(request.prompt, { onNotification: observe }), cancelSettled.then(() => "cancelled")]);
-					if (turn === "cancelled") return {
+					try {
+						await Promise.race([(async () => {
+							await harness.session(childSessionId).setWorkingDirectory(spec.cwd);
+							if (flags.cancelled) return;
+							await harness.client.prompt(childSessionId, request.prompt);
+							accepted = true;
+							await harness.client.request("session/wait", { sessionId: childSessionId });
+						})(), cancelSettled]);
+					} finally {
+						if (accepted) drainNotifications();
+					}
+					if (flags.cancelled) return {
 						output: collectOutput(),
 						stopReason: "aborted"
 					};
-					const outcome = sdkChildOutcome(turn.events.findLast((event) => event.type === "turn/end")?.data.reason);
+					const outcome = sdkChildOutcome(lastEnd);
 					diagnostic = outcome.diagnostic;
 					return {
 						output: collectOutput(),
@@ -245,6 +262,8 @@ async function startSdkRun(request, spec) {
 				} catch (error) {
 					diagnostic = failureDiagnostic(sdkFailure(error, "session-run").facts);
 					throw error;
+				} finally {
+					subscription.close();
 				}
 			},
 			collectOutput,
@@ -268,8 +287,8 @@ async function startSdkRun(request, spec) {
 * session, model route, and tools — driven over stdio JSON-RPC through the
 * TypeScript SDK client, so it shares no Cordis context. It accepts the
 * provider/model/reasoning/maxTokens subset of `agentOptions`; other start
-* features remain unsupported. The ONE thing it reads off `request.parent`
-* is the session's workspace cwd. This plugin uses named
+* features remain unsupported. The child retains its parent's origin directory
+* while starting in the directory selected by the subagent service. This plugin uses named
 * exports only; a default would hide its loader metadata (see
 * `docs/postmortem/0001-acp-default-export-drops-inject.md`).
 * @module @deepseek-ai/dsh-subagent-dsh-sdk
@@ -282,7 +301,6 @@ const Config = z.object({
 	profile: z.string().default("sdk"),
 	patches: z.array(z.string()).default([]),
 	dshHome: z.string().required(),
-	cwd: z.string(),
 	provider: z.string().default("deepseek-official"),
 	model: z.string().default("deepseek-v4-flash"),
 	maxTokens: z.number().step(1).min(1).max(Number.MAX_SAFE_INTEGER),
@@ -339,7 +357,7 @@ var SdkSubagentProvider = class {
 		if (request.signal.aborted) throw new Error("subagent request was aborted before the SDK child started");
 		let cwd;
 		try {
-			cwd = resolveChildCwd("subagent-dsh-sdk", this.config.cwd, request.parent.session.header.cwd);
+			cwd = assertUsableCwd("subagent-dsh-sdk", "child cwd", request.cwd);
 		} catch (error) {
 			const failure = sdkConfigurationFailure(error);
 			this.ctx.logger.warn(`subagent-dsh-sdk "${this.name}": child start failed: %o`, error);
@@ -352,6 +370,7 @@ var SdkSubagentProvider = class {
 			patches: this.config.patches,
 			dshHome: this.config.dshHome,
 			cwd,
+			originCwd: request.parent.session.header.cwd,
 			...route,
 			env: this.config.env,
 			shutdownTimeoutMs: this.config.shutdownTimeoutMs,
@@ -375,12 +394,7 @@ function apply(ctx, config) {
 		patches: resolved.patches.map((path, index) => resolveConfiguredFile(`patches[${String(index)}]`, path)),
 		...resolved.dshBin === void 0 ? {} : { dshBin: resolveConfiguredFile("dshBin", resolved.dshBin) }
 	};
-	const configuredCwd = validateConfiguredCwd("subagent-dsh-sdk", resolved.cwd);
-	const validated = configuredCwd === void 0 ? launchPaths : {
-		...launchPaths,
-		cwd: configuredCwd
-	};
-	ctx.subagents.registerProvider(new SdkSubagentProvider(validated.providerName, ctx, validated));
+	ctx.subagents.registerProvider(new SdkSubagentProvider(launchPaths.providerName, ctx, launchPaths));
 }
 //#endregion
 export { Config, apply, inject, name };

package/lib/types/index.d.ts

@@ -4,8 +4,8 @@
  * session, model route, and tools — driven over stdio JSON-RPC through the
  * TypeScript SDK client, so it shares no Cordis context. It accepts the
  * provider/model/reasoning/maxTokens subset of `agentOptions`; other start
- * features remain unsupported. The ONE thing it reads off `request.parent`
- * is the session's workspace cwd. This plugin uses named
+ * features remain unsupported. The child retains its parent's origin directory
+ * while starting in the directory selected by the subagent service. This plugin uses named
  * exports only; a default would hide its loader metadata (see
  * `docs/postmortem/0001-acp-default-export-drops-inject.md`).
  * @module @deepseek-ai/dsh-subagent-dsh-sdk
@@ -26,15 +26,6 @@ export interface Config {
     patches: string[];
     /** Absolute isolated Harness home for every nested child process. */
     dshHome: string;
-    /**
-     * Working directory override for the child process and its SDK session
-     * workspace. Must be non-empty; a relative path resolves against the
-     * harness launch directory at load, and the result must be an existing
-     * directory. When omitted, each child inherits its delegating parent
-     * session's cwd — and starting one from a parent session that has no cwd
-     * fails.
-     */
-    cwd?: string;
     /** Provider route the child runtime initializes with (default `deepseek-official`). */
     provider: string;
     /** Model the child runtime initializes with (default `deepseek-v4-flash`). */

package/lib/types/run.d.ts

@@ -23,12 +23,10 @@ export interface SdkRunSpec {
     patches: string[];
     /** Absolute isolated Harness home for the nested runtime. */
     dshHome: string;
-    /**
-     * Absolute working directory for the child process AND the workspace cwd
-     * of its SDK session. The provider resolves it before this spec exists:
-     * config override, else the delegating parent session's workspace.
-     */
+    /** Absolute initial working directory selected by the delegating runtime. */
     cwd: string;
+    /** Parent origin directory recorded independently of the child's effective directory. */
+    originCwd?: string | undefined;
     /** Provider route the child runtime initializes with. */
     provider: string;
     /** Model the child runtime initializes with. */

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@deepseek-ai/dsh-subagent-dsh-sdk",
   "description": "Out-of-process SDK subagent backend: drives a child DeepSeek Harness runtime subprocess over stdio JSON-RPC through the TypeScript SDK client",
-  "version": "0.2.0-rc.2",
+  "version": "0.2.1-alpha.2",
   "publishConfig": {
     "access": "public"
   },
@@ -27,38 +27,38 @@
   ],
   "license": "MIT",
   "peerDependencies": {
-    "@deepseek-ai/cordis": "~4.0.4",
-    "@deepseek-ai/dsh-llm": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-sdk-client": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-agent": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-subprocess": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-subagent": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-session": "0.2.0-rc.2"
+    "@deepseek-ai/cordis": "~4.0.5-alpha.1",
+    "@deepseek-ai/dsh-agent": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-llm": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-sdk-client": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-session": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-subagent": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-subprocess": "0.2.1-alpha.2"
   },
   "dependencies": {
-    "@deepseek-ai/dsh-brand": "0.2.0-rc.2",
-    "@deepseek-ai/schemastery": "~3.18.4"
+    "@deepseek-ai/dsh-brand": "0.2.1-alpha.2",
+    "@deepseek-ai/schemastery": "~3.18.5-alpha.1"
   },
   "devDependencies": {
-    "@deepseek-ai/cordis": "~4.0.4",
-    "@deepseek-ai/cordis-plugin-loader": "~1.0.5",
-    "@deepseek-ai/dsh-agent": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-agent-instructions": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-app-boot": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-llm": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-llm-deepseek": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-llm-deepseek-api-key": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-sdk-client": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-sdk-protocol": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-session": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-session-checkpoint-policy": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-session-persistence-jsonl": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-session-projection": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-loader-smoke": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-subagent": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-subprocess": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-system-prompt": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-tool-subagent": "0.2.0-rc.2",
-    "@deepseek-ai/dsh-skill-filesystem": "0.2.0-rc.2"
+    "@deepseek-ai/cordis": "~4.0.5-alpha.1",
+    "@deepseek-ai/cordis-plugin-loader": "~1.0.6-alpha.1",
+    "@deepseek-ai/dsh-agent": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-agent-instructions": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-app-boot": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-llm": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-llm-deepseek": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-llm-deepseek-api-key": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-loader-smoke": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-sdk-client": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-sdk-protocol": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-session": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-session-checkpoint-policy": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-session-persistence-jsonl": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-session-projection": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-skill-filesystem": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-subagent": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-subprocess": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-system-prompt": "0.2.1-alpha.2",
+    "@deepseek-ai/dsh-tool-subagent": "0.2.1-alpha.2"
   }
 }