@deepseek-ai/dsh-subagent 0.1.2-alpha.2 → 0.1.2-alpha.3

package/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/subagent/subagent/README.md
-README.md: 76df70351d711d580d3ab1a89d0f929b85eab172
-README.zh.md: c4deb001c47435d29a5ca18cc0f8c0d26e48941e
+README.md: f13de661015f3aa59b776273376f07653f6bbba5
+README.zh.md: 42923504ed11b8eff7c0bdcd9d0c9505d741f42e

package/README.md

@@ -48,7 +48,7 @@ One-shot children run once and settle with a single result, plus an optional str
 
 ### Following up, interrupting, and discovering
 
-Continuable children answer follow-up messages as their next turns, and the parent can interrupt a running turn or list its children at any time. Discovery covers both shapes: the service lists direct children and the full descendant tree — mode, activity, and lineage — reading live session state and optional persistence, without loading any child.
+Continuable children answer follow-up messages as their next turns, and the parent can interrupt a running turn or list its children at any time. A browser continuation prompt may carry image parts: the Host admits and persists each image batch through the attachment store before the child inbox accepts the message, and refuses delivery when the child's declared model does not accept image input. Discovery covers both shapes: the service lists direct children and the full descendant tree — mode, activity, and lineage — reading live session state and optional persistence, without loading any child.
 
 ### Failure and recovery
 

package/README.zh.md

@@ -48,7 +48,7 @@ kind: "package-reference"
 
 ### 后续消息、中断与发现
 
-可继续子 agent 把后续消息作为下一个轮次回答，父级随时可以中断运行中的轮次或列举自己的子级。发现覆盖两种形态：服务列举直接子级与完整后代树——模式、活动状态与血缘——直接读取在线会话状态与可选持久化，不加载任何子 agent。
+可继续子 agent 把后续消息作为下一个轮次回答，父级随时可以中断运行中的轮次或列举自己的子级。浏览器发出的继续执行 prompt 可以携带图片部分：Host 先通过附件存储完成整批图片的准入与持久化，子级 inbox 才接受这条消息；当子级声明的模型不接受图片输入时拒绝投递。发现覆盖两种形态：服务列举直接子级与完整后代树——模式、活动状态与血缘——直接读取在线会话状态与可选持久化，不加载任何子 agent。
 
 ### 失败与恢复
 

package/lib/index.js

@@ -1,9 +1,10 @@
+import { AttachmentError, admitPromptContent } from "@deepseek-ai/dsh-attachment";
 import { scopeTarget } from "@deepseek-ai/dsh-scope";
 import { assertObjectJsonSchema } from "@deepseek-ai/dsh-tools";
 import { canonicalClientTimeZone } from "@deepseek-ai/dsh-util-time";
 import { Remote, RemoteError, TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
 import { z } from "zod";
-import { HarnessError, ReasoningEffortId, boundContextSummary, createUserMessage, errorChain } from "@deepseek-ai/dsh-llm";
+import { HarnessError, ReasoningEffortId, boundContextSummary, contentHasImage, createUserMessage, errorChain } from "@deepseek-ai/dsh-llm";
 import { randomUUID } from "node:crypto";
 import { foldConsumedWork } from "@deepseek-ai/dsh-agent";
 import { brandString } from "@deepseek-ai/dsh-brand";
@@ -59,31 +60,6 @@ function validateControlRequest(method, payload) {
 	if (!parsed.success) throw new RemoteError("gateway/bad-request", `invalid payload for ${method}`, { issues: parsed.error.issues });
 }
 /**
-* Admit the content one continuation may deliver, refusing every image.
-*
-* The blocks become the child's user message verbatim, and this surface admits
-* no attachment: nothing here registers encoded bytes with the attachment
-* service, so an image would reach the child as a reference nothing resolves.
-* The wire accepts the encoded upload so this refusal — not a Client that
-* strips the block — is what the caller is answered with. Other block types
-* still cross unnarrowed.
-* @param childSessionId - the addressed child, named by the refusal.
-* @param content - blocks the caller asked to deliver.
-* @returns the admitted blocks, in order, as the durable content vocabulary.
-* @throws {RemoteError} `subagent/attachment-unsupported` when any block is an image.
-*/
-function admitPromptContent(childSessionId, content) {
-	const admitted = [];
-	for (const block of content) {
-		if (block.type === "image") throw new RemoteError("subagent/attachment-unsupported", "subagent continuation does not accept images", {
-			childSessionId,
-			reason: "SUBAGENT_IMAGE_UNSUPPORTED"
-		});
-		admitted.push(block);
-	}
-	return admitted;
-}
-/**
 * Project one durable listing onto the catalog view, replacing each row's
 * store-derived activity with the live Agent driver's status and reporting
 * whether the exact parent Agent is live. Without an Agent registry no driver
@@ -128,7 +104,9 @@ function rejectCatalogRead(error, signal) {
 */
 function rejectPrompt(error, childSessionId, signal) {
 	if (isCancellation(error, signal)) throw new RemoteError("gateway/cancelled", "subagent prompt was cancelled", {}, { cause: error });
+	if (error instanceof AttachmentError) throw new RemoteError("subagent/attachment-invalid", error.message, { reason: error.code }, { cause: error });
 	if (error instanceof SubagentError) switch (error.code) {
+		case "MODEL_DOES_NOT_SUPPORT_IMAGES": throw new RemoteError("subagent/attachment-invalid", error.message, { reason: error.code }, { cause: error });
 		case "NOT_RESUMABLE": throw new RemoteError("subagent/not-resumable", "subagent cannot be resumed", { childSessionId }, { cause: error });
 		case "UNAUTHORIZED": throw new RemoteError("subagent/unauthorized", "subagent does not belong to this parent", { childSessionId }, { cause: error });
 		case "DRAINING":
@@ -1070,11 +1048,19 @@ var SubagentContinuationManager = class {
 			const live = await this.locks.run(childId, async () => {
 				const activation = this.activations.get(childId);
 				if (activation === void 0) return this.coldResume(parent, childId, content, options);
+				const disposal = activation.disposal;
 				/* v8 ignore next 3 -- the send-versus-dispose cutoff: reaching this arm needs a
 				* delivery to observe the transaction inside the same critical section that opened it,
 				* which no test can schedule deterministically. The behavior is covered end-to-end by
 				* "cold-resumes a delivery that lost the race with final disposal". */
-				if (activation.disposal !== void 0) return activation.disposal.then(() => void 0, () => void 0);
+				if (disposal !== void 0) return disposal.then(() => void 0, () => void 0);
+				if (contentHasImage(content)) {
+					await this.assertImageCapable(activation.handle.agent, options.signal);
+					if (activation.disposal !== void 0) {
+						await Promise.allSettled([activation.disposal]);
+						return;
+					}
+				}
 				return this.submitAdmitted(activation, content, options.source, parent, options.signal);
 			});
 			/* v8 ignore start -- only the lost-cutoff arm above returns undefined, so only that
@@ -1414,6 +1400,10 @@ var SubagentContinuationManager = class {
 	*/
 	async submitMaterialized(activation, content, source, parent, signal) {
 		try {
+			if (contentHasImage(content)) {
+				await this.assertImageCapable(activation.handle.agent, signal);
+				if (activation.disposal !== void 0) throw new SubagentError(`subagent "${activation.childId}" is closing`, "ACTIVATION_CLOSING");
+			}
 			return this.submitAdmitted(activation, content, source, parent, signal);
 		} catch (error) {
 			/* v8 ignore next -- rollback disposal failures must not mask the
@@ -1423,6 +1413,28 @@ var SubagentContinuationManager = class {
 		}
 	}
 	/**
+	* Refuse image content addressed to a child whose model accepts text only.
+	* Callers guard with `contentHasImage`, so text-only delivery never awaits.
+	* The check runs inside the per-child delivery lock, before the message
+	* exists, so a rejection leaves no partial user message. When the child's
+	* route is not fixed by its options (a request-waterfall listener owns it)
+	* or no LLM registry is composed, delivery proceeds and the LLM layer's
+	* text-only projection replaces each image with its stable placeholder.
+	* @param agent - the live or freshly materialized child agent.
+	* @param signal - caller cancellation bounding the model-info read.
+	* @throws {SubagentError} `MODEL_DOES_NOT_SUPPORT_IMAGES` when the child's resolved model declines image input.
+	*/
+	async assertImageCapable(agent, signal) {
+		const { provider, model } = agent.options;
+		if (provider === void 0 || model === void 0) return;
+		const llm = this.ctx.get("llm");
+		/* v8 ignore next -- a deployment without the LLM registry serves no model
+		* to refuse against; delivery then defers to the text-only projection. */
+		if (llm === void 0) return;
+		const info = await llm.resolveModelInfo(provider, model, signal);
+		if (info.inputModalities !== void 0 && !info.inputModalities.includes("image")) throw new SubagentError(`Model "${model}" does not support image input.`, "MODEL_DOES_NOT_SUPPORT_IMAGES");
+	}
+	/**
 	* Create or resume the child Agent through the private activation-owner
 	* scope, install the handle in a fresh Activation, and register ownership on
 	* a continuation-managed parent. Rejection leaves no Activation, no handle,
@@ -2971,10 +2983,12 @@ let SubagentRuntime = (() => {
 		* validated browser zone on the accepted message. Success identifies the
 		* message the child's FIFO inbox accepted; later execution is independent of
 		* this call.
+		* Image parts are admitted and persisted through the attachment store
+		* before delivery, and the child's model must accept image input.
 		* @param request - durable address, minted identity, content, and optional browser zone.
 		* @param signal - carrier cancellation, owning the call until inbox acceptance.
 		* @returns the accepted message's inbox identity.
-		* @throws {RemoteError} `gateway/bad-request`, `subagent/attachment-unsupported`,
+		* @throws {RemoteError} `gateway/bad-request`, `subagent/attachment-invalid`,
 		*   `subagent/invalid-time-zone`, `subagent/parent-unavailable`,
 		*   `subagent/not-resumable`, `subagent/unauthorized`,
 		*   `subagent/delivery-unavailable`, `gateway/cancelled`, or `gateway/internal`.
@@ -2982,7 +2996,6 @@ let SubagentRuntime = (() => {
 		async prompt(request, signal) {
 			const { parentSessionId, childSessionId, clientTimeZone } = request;
 			validateControlRequest("subagent.prompt", request);
-			const content = admitPromptContent(childSessionId, request.content);
 			const canonicalTimeZone = clientTimeZone === void 0 ? void 0 : canonicalClientTimeZone(clientTimeZone);
 			if (clientTimeZone !== void 0 && canonicalTimeZone === void 0) throw new RemoteError("subagent/invalid-time-zone", "clientTimeZone must be UTC or a valid IANA Area/Location name", { value: clientTimeZone });
 			const parent = this.ctx.get("agents")?.get(parentSessionId);
@@ -2993,6 +3006,16 @@ let SubagentRuntime = (() => {
 				...canonicalTimeZone === void 0 ? {} : { clientTimeZone: canonicalTimeZone }
 			};
 			try {
+				let content;
+				if (request.content.every((part) => part.type === "text")) content = request.content.map((part) => ({
+					type: "text",
+					text: part.text
+				}));
+				else {
+					const attachments = this.ctx.get("attachments");
+					if (attachments === void 0) throw new Error("subagent image prompt requires an attachment store");
+					content = await admitPromptContent(attachments, request.content);
+				}
 				return { messageId: await this.followup(parent, childSessionId, content, {
 					source,
 					signal

package/lib/typert.host.js

@@ -1,37 +1,6 @@
 /* Generated by @deepseek-ai/dsh-typert-generator from FaceModel — do not edit. */
 import { z } from 'zod'
 
-const ToolResultBlockRemoteCodec$schema = z.object({
-  'type': z.literal("tool-result"),
-  'toolCallId': z.intersection(z.string(), z.unknown()),
-  'content': z.array(z.union([z.object({
-  'type': z.literal("text"),
-  'text': z.string(),
-}), z.object({
-  'type': z.literal("image"),
-  'attachment': z.object({
-  'attachmentId': z.intersection(z.string(), z.unknown()),
-  'mediaType': z.union([z.literal("image/png"), z.literal("image/jpeg"), z.literal("image/webp"), z.literal("image/gif")]),
-  'bytes': z.number(),
-  'width': z.number(),
-  'height': z.number(),
-  'name': z.string().optional(),
-  'originalDimensions': z.object({
-  'width': z.number(),
-  'height': z.number(),
-}).optional(),
-}),
-}), z.object({
-  'type': z.literal("reasoning"),
-  'text': z.string(),
-}), z.object({
-  'type': z.literal("tool-call"),
-  'id': z.intersection(z.string(), z.unknown()),
-  'name': z.string(),
-  'arguments': z.string(),
-}), z.lazy(() => ToolResultBlockRemoteCodec$schema)])),
-  'isError': z.boolean().optional(),
-})
 const _deepseek_ai_dsh_subagent_subagents_interruptByParent_parameter_0$schema = z.intersection(z.string(), z.unknown())
 const _deepseek_ai_dsh_subagent_subagents_interruptByParent_parameter_1$schema = z.intersection(z.string(), z.unknown())
 const _deepseek_ai_dsh_subagent_subagents_interruptByParent_parameter_2$schema = z.literal("continuable")
@@ -69,65 +38,13 @@ const _deepseek_ai_dsh_subagent_subagents_prompt_parameter_0$schema = z.object({
   'childSessionId': z.intersection(z.string(), z.unknown()).readonly(),
   'mode': z.literal("continuable").readonly(),
   'content': z.array(z.union([z.object({
-  'type': z.literal("text"),
-  'text': z.string(),
-}), z.object({
-  'type': z.literal("image"),
-  'attachment': z.object({
-  'attachmentId': z.intersection(z.string(), z.unknown()),
-  'mediaType': z.union([z.literal("image/png"), z.literal("image/jpeg"), z.literal("image/webp"), z.literal("image/gif")]),
-  'bytes': z.number(),
-  'width': z.number(),
-  'height': z.number(),
-  'name': z.string().optional(),
-  'originalDimensions': z.object({
-  'width': z.number(),
-  'height': z.number(),
-}).optional(),
-}),
-}), z.object({
-  'type': z.literal("reasoning"),
-  'text': z.string(),
-}), z.object({
-  'type': z.literal("tool-call"),
-  'id': z.intersection(z.string(), z.unknown()),
-  'name': z.string(),
-  'arguments': z.string(),
-}), z.object({
-  'type': z.literal("tool-result"),
-  'toolCallId': z.intersection(z.string(), z.unknown()),
-  'content': z.array(z.union([z.object({
-  'type': z.literal("text"),
-  'text': z.string(),
-}), z.object({
-  'type': z.literal("image"),
-  'attachment': z.object({
-  'attachmentId': z.intersection(z.string(), z.unknown()),
-  'mediaType': z.union([z.literal("image/png"), z.literal("image/jpeg"), z.literal("image/webp"), z.literal("image/gif")]),
-  'bytes': z.number(),
-  'width': z.number(),
-  'height': z.number(),
-  'name': z.string().optional(),
-  'originalDimensions': z.object({
-  'width': z.number(),
-  'height': z.number(),
-}).optional(),
-}),
-}), z.object({
-  'type': z.literal("reasoning"),
-  'text': z.string(),
-}), z.object({
-  'type': z.literal("tool-call"),
-  'id': z.intersection(z.string(), z.unknown()),
-  'name': z.string(),
-  'arguments': z.string(),
-}), z.lazy(() => ToolResultBlockRemoteCodec$schema)])),
-  'isError': z.boolean().optional(),
+  'type': z.literal("text").readonly(),
+  'text': z.string().readonly(),
 }), z.object({
   'type': z.literal("image").readonly(),
-  'mediaType': z.union([z.literal("image/png"), z.literal("image/jpeg"), z.literal("image/webp"), z.literal("image/gif")]),
-  'data': z.string(),
-  'name': z.string().optional(),
+  'mediaType': z.union([z.literal("image/png"), z.literal("image/jpeg"), z.literal("image/webp"), z.literal("image/gif")]).readonly(),
+  'data': z.string().readonly(),
+  'name': z.string().readonly().optional(),
 })])).readonly(),
   'clientTimeZone': z.string().readonly().optional(),
 })
@@ -184,7 +101,7 @@ export const TYPERT = {
         typeSymbol: '@deepseek-ai/dsh-subagent/client#SubagentInterruptReceipt',
         schema: _deepseek_ai_dsh_subagent_subagents_interruptByParent_result$schema,
       },
-      sourceLocation: {"file":"packages/subagent/subagent/src/index.ts","line":479,"column":3},
+      sourceLocation: {"file":"packages/subagent/subagent/src/index.ts","line":491,"column":3},
     },
     {
       id: '@deepseek-ai/dsh-subagent#subagents/list',
@@ -211,7 +128,7 @@ export const TYPERT = {
         typeSymbol: '@deepseek-ai/dsh-subagent/client#SubagentCatalog',
         schema: _deepseek_ai_dsh_subagent_subagents_list_result$schema,
       },
-      sourceLocation: {"file":"packages/subagent/subagent/src/index.ts","line":406,"column":9},
+      sourceLocation: {"file":"packages/subagent/subagent/src/index.ts","line":407,"column":9},
     },
     {
       id: '@deepseek-ai/dsh-subagent#subagents/prompt',
@@ -237,7 +154,7 @@ export const TYPERT = {
         typeSymbol: '@deepseek-ai/dsh-subagent/client#SubagentPromptReceipt',
         schema: _deepseek_ai_dsh_subagent_subagents_prompt_result$schema,
       },
-      sourceLocation: {"file":"packages/subagent/subagent/src/index.ts","line":430,"column":9},
+      sourceLocation: {"file":"packages/subagent/subagent/src/index.ts","line":433,"column":9},
     },
   ],
   model: {
@@ -325,7 +242,7 @@ export const TYPERT = {
             "name": "prompt",
             "signature": "@Remote('prompt') async prompt(request: SubagentPromptRequest, signal: AbortSignal): Promise<SubagentPromptReceipt>",
             "summary": "Deliver one browser-authored message to a continuable child through the exact live direct parent, retaining the caller-minted request identity and validated browser zone on the accepted message.",
-            "jsDoc": "/**\n * Deliver one browser-authored message to a continuable child through the\n * exact live direct parent, retaining the caller-minted request identity and\n * validated browser zone on the accepted message. Success identifies the\n * message the child's FIFO inbox accepted; later execution is independent of\n * this call.\n * @param request - durable address, minted identity, content, and optional browser zone.\n * @param signal - carrier cancellation, owning the call until inbox acceptance.\n * @returns the accepted message's inbox identity.\n * @throws {RemoteError} `gateway/bad-request`, `subagent/attachment-unsupported`,\n *   `subagent/invalid-time-zone`, `subagent/parent-unavailable`,\n *   `subagent/not-resumable`, `subagent/unauthorized`,\n *   `subagent/delivery-unavailable`, `gateway/cancelled`, or `gateway/internal`.\n */"
+            "jsDoc": "/**\n * Deliver one browser-authored message to a continuable child through the\n * exact live direct parent, retaining the caller-minted request identity and\n * validated browser zone on the accepted message. Success identifies the\n * message the child's FIFO inbox accepted; later execution is independent of\n * this call.\n * Image parts are admitted and persisted through the attachment store\n * before delivery, and the child's model must accept image input.\n * @param request - durable address, minted identity, content, and optional browser zone.\n * @param signal - carrier cancellation, owning the call until inbox acceptance.\n * @returns the accepted message's inbox identity.\n * @throws {RemoteError} `gateway/bad-request`, `subagent/attachment-invalid`,\n *   `subagent/invalid-time-zone`, `subagent/parent-unavailable`,\n *   `subagent/not-resumable`, `subagent/unauthorized`,\n *   `subagent/delivery-unavailable`, `gateway/cancelled`, or `gateway/internal`.\n */"
           },
           {
             "kind": "method",
@@ -476,14 +393,6 @@ export const TYPERT = {
             "name": "CoordinatorMessageSource",
             "declaration": "export interface CoordinatorMessageSource {\n    readonly kind: 'coordinator';\n    readonly form: 'relay';\n    readonly senderSessionId: SessionId;\n}"
           },
-          {
-            "name": "EncodedImageAttachment",
-            "declaration": "export interface EncodedImageAttachment {\n    mediaType: ImageMediaType;\n    data: string;\n    name?: string;\n}"
-          },
-          {
-            "name": "EncodedImagePromptBlock",
-            "declaration": "export interface EncodedImagePromptBlock extends EncodedImageAttachment {\n    readonly type: 'image';\n}"
-          },
           {
             "name": "EpochHeader",
             "declaration": "export interface EpochHeader {\n    config: LlmCallConfig;\n    adapterDefaults?: LlmCallConfigAdapterDefaults;\n    system?: string;\n    tools?: ToolSchema[];\n}"
@@ -616,6 +525,10 @@ export const TYPERT = {
             "name": "OneShotSubagentDescriptorData",
             "declaration": "export interface OneShotSubagentDescriptorData extends SubagentDescriptorBase {\n    readonly mode: 'one-shot';\n    readonly label?: string;\n}"
           },
+          {
+            "name": "PromptContentPart",
+            "declaration": "export type PromptContentPart = { readonly type: 'text'; readonly text: string; } | { readonly type: 'image'; readonly mediaType: ImageMediaType; readonly data: string; readonly name?: string; };"
+          },
           {
             "name": "ProviderRequestId",
             "declaration": "export type ProviderRequestId = Branded<'ProviderRequestId'>;"
@@ -752,17 +665,13 @@ export const TYPERT = {
             "name": "SubagentListEntry",
             "declaration": "export type SubagentListEntry = { readonly kind: 'child'; readonly id: SessionId; readonly activity: 'running' | 'inactive'; readonly hasChildren: boolean; } & ({ readonly mode: 'one-shot'; readonly label?: string; } | { readonly mode: 'continuable'; readonly label: string; }) | { readonly kind: 'diagnostic'; readonly id: SessionId; readonly reason: 'corrupt' | 'unsupported' | 'unavailable'; };"
           },
-          {
-            "name": "SubagentPromptContentPart",
-            "declaration": "export type SubagentPromptContentPart = ContentBlock | EncodedImagePromptBlock;"
-          },
           {
             "name": "SubagentPromptReceipt",
             "declaration": "export interface SubagentPromptReceipt {\n    readonly messageId: MessageId;\n}"
           },
           {
             "name": "SubagentPromptRequest",
-            "declaration": "export interface SubagentPromptRequest {\n    readonly requestId: SubagentPromptRequestId;\n    readonly parentSessionId: SessionId;\n    readonly childSessionId: SessionId;\n    readonly mode: 'continuable';\n    readonly content: readonly SubagentPromptContentPart[];\n    readonly clientTimeZone?: string;\n}"
+            "declaration": "export interface SubagentPromptRequest {\n    readonly requestId: SubagentPromptRequestId;\n    readonly parentSessionId: SessionId;\n    readonly childSessionId: SessionId;\n    readonly mode: 'continuable';\n    readonly content: readonly PromptContentPart[];\n    readonly clientTimeZone?: string;\n}"
           },
           {
             "name": "SubagentPromptRequestId",

package/lib/typert.remote-client.js

@@ -1,37 +1,6 @@
 /* Generated by @deepseek-ai/dsh-typert-generator from the Host FaceModel — do not edit. */
 import { z } from 'zod'
 
-const ToolResultBlockRemoteCodec$schema = z.object({
-  'type': z.literal("tool-result"),
-  'toolCallId': z.intersection(z.string(), z.unknown()),
-  'content': z.array(z.union([z.object({
-  'type': z.literal("text"),
-  'text': z.string(),
-}), z.object({
-  'type': z.literal("image"),
-  'attachment': z.object({
-  'attachmentId': z.intersection(z.string(), z.unknown()),
-  'mediaType': z.union([z.literal("image/png"), z.literal("image/jpeg"), z.literal("image/webp"), z.literal("image/gif")]),
-  'bytes': z.number(),
-  'width': z.number(),
-  'height': z.number(),
-  'name': z.string().optional(),
-  'originalDimensions': z.object({
-  'width': z.number(),
-  'height': z.number(),
-}).optional(),
-}),
-}), z.object({
-  'type': z.literal("reasoning"),
-  'text': z.string(),
-}), z.object({
-  'type': z.literal("tool-call"),
-  'id': z.intersection(z.string(), z.unknown()),
-  'name': z.string(),
-  'arguments': z.string(),
-}), z.lazy(() => ToolResultBlockRemoteCodec$schema)])),
-  'isError': z.boolean().optional(),
-})
 const _deepseek_ai_dsh_subagent_subagents_interruptByParent_parameter_0$schema = z.intersection(z.string(), z.unknown())
 const _deepseek_ai_dsh_subagent_subagents_interruptByParent_parameter_1$schema = z.intersection(z.string(), z.unknown())
 const _deepseek_ai_dsh_subagent_subagents_interruptByParent_parameter_2$schema = z.literal("continuable")
@@ -69,65 +38,13 @@ const _deepseek_ai_dsh_subagent_subagents_prompt_parameter_0$schema = z.object({
   'childSessionId': z.intersection(z.string(), z.unknown()).readonly(),
   'mode': z.literal("continuable").readonly(),
   'content': z.array(z.union([z.object({
-  'type': z.literal("text"),
-  'text': z.string(),
-}), z.object({
-  'type': z.literal("image"),
-  'attachment': z.object({
-  'attachmentId': z.intersection(z.string(), z.unknown()),
-  'mediaType': z.union([z.literal("image/png"), z.literal("image/jpeg"), z.literal("image/webp"), z.literal("image/gif")]),
-  'bytes': z.number(),
-  'width': z.number(),
-  'height': z.number(),
-  'name': z.string().optional(),
-  'originalDimensions': z.object({
-  'width': z.number(),
-  'height': z.number(),
-}).optional(),
-}),
-}), z.object({
-  'type': z.literal("reasoning"),
-  'text': z.string(),
-}), z.object({
-  'type': z.literal("tool-call"),
-  'id': z.intersection(z.string(), z.unknown()),
-  'name': z.string(),
-  'arguments': z.string(),
-}), z.object({
-  'type': z.literal("tool-result"),
-  'toolCallId': z.intersection(z.string(), z.unknown()),
-  'content': z.array(z.union([z.object({
-  'type': z.literal("text"),
-  'text': z.string(),
-}), z.object({
-  'type': z.literal("image"),
-  'attachment': z.object({
-  'attachmentId': z.intersection(z.string(), z.unknown()),
-  'mediaType': z.union([z.literal("image/png"), z.literal("image/jpeg"), z.literal("image/webp"), z.literal("image/gif")]),
-  'bytes': z.number(),
-  'width': z.number(),
-  'height': z.number(),
-  'name': z.string().optional(),
-  'originalDimensions': z.object({
-  'width': z.number(),
-  'height': z.number(),
-}).optional(),
-}),
-}), z.object({
-  'type': z.literal("reasoning"),
-  'text': z.string(),
-}), z.object({
-  'type': z.literal("tool-call"),
-  'id': z.intersection(z.string(), z.unknown()),
-  'name': z.string(),
-  'arguments': z.string(),
-}), z.lazy(() => ToolResultBlockRemoteCodec$schema)])),
-  'isError': z.boolean().optional(),
+  'type': z.literal("text").readonly(),
+  'text': z.string().readonly(),
 }), z.object({
   'type': z.literal("image").readonly(),
-  'mediaType': z.union([z.literal("image/png"), z.literal("image/jpeg"), z.literal("image/webp"), z.literal("image/gif")]),
-  'data': z.string(),
-  'name': z.string().optional(),
+  'mediaType': z.union([z.literal("image/png"), z.literal("image/jpeg"), z.literal("image/webp"), z.literal("image/gif")]).readonly(),
+  'data': z.string().readonly(),
+  'name': z.string().readonly().optional(),
 })])).readonly(),
   'clientTimeZone': z.string().readonly().optional(),
 })
@@ -181,7 +98,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: '@deepseek-ai/dsh-subagent/client#SubagentInterruptReceipt',
         schema: _deepseek_ai_dsh_subagent_subagents_interruptByParent_result$schema,
       },
-      sourceLocation: {"file":"packages/subagent/subagent/src/index.ts","line":479,"column":3},
+      sourceLocation: {"file":"packages/subagent/subagent/src/index.ts","line":491,"column":3},
     },
     {
       id: '@deepseek-ai/dsh-subagent#subagents/list',
@@ -208,7 +125,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: '@deepseek-ai/dsh-subagent/client#SubagentCatalog',
         schema: _deepseek_ai_dsh_subagent_subagents_list_result$schema,
       },
-      sourceLocation: {"file":"packages/subagent/subagent/src/index.ts","line":406,"column":9},
+      sourceLocation: {"file":"packages/subagent/subagent/src/index.ts","line":407,"column":9},
     },
     {
       id: '@deepseek-ai/dsh-subagent#subagents/prompt',
@@ -234,7 +151,7 @@ export const TYPERT_REMOTE = {
         typeSymbol: '@deepseek-ai/dsh-subagent/client#SubagentPromptReceipt',
         schema: _deepseek_ai_dsh_subagent_subagents_prompt_result$schema,
       },
-      sourceLocation: {"file":"packages/subagent/subagent/src/index.ts","line":430,"column":9},
+      sourceLocation: {"file":"packages/subagent/subagent/src/index.ts","line":433,"column":9},
     },
   ],
 }

package/lib/types/continuation.d.ts

@@ -340,6 +340,19 @@ export declare class SubagentContinuationManager {
      * @returns the accepted inbox message id.
      */
     private submitMaterialized;
+    /**
+     * Refuse image content addressed to a child whose model accepts text only.
+     * Callers guard with `contentHasImage`, so text-only delivery never awaits.
+     * The check runs inside the per-child delivery lock, before the message
+     * exists, so a rejection leaves no partial user message. When the child's
+     * route is not fixed by its options (a request-waterfall listener owns it)
+     * or no LLM registry is composed, delivery proceeds and the LLM layer's
+     * text-only projection replaces each image with its stable placeholder.
+     * @param agent - the live or freshly materialized child agent.
+     * @param signal - caller cancellation bounding the model-info read.
+     * @throws {SubagentError} `MODEL_DOES_NOT_SUPPORT_IMAGES` when the child's resolved model declines image input.
+     */
+    private assertImageCapable;
     /**
      * Create or resume the child Agent through the private activation-owner
      * scope, install the handle in a fresh Activation, and register ownership on

package/lib/types/continuation.js

@@ -74,7 +74,7 @@ var __disposeResources = (this && this.__disposeResources) || (function (Suppres
 });
 import { randomUUID } from 'node:crypto';
 import { brandString } from '@deepseek-ai/dsh-brand';
-import { ReasoningEffortId, boundContextSummary, createUserMessage, errorChain } from '@deepseek-ai/dsh-llm';
+import { ReasoningEffortId, boundContextSummary, contentHasImage, createUserMessage, errorChain } from '@deepseek-ai/dsh-llm';
 import { foldSubagentDescriptor, snapshotSubagentDescriptor } from "./descriptor.js";
 import { appendDelegatedPolicyOverrides, applyChildComposition, captureDelegatedPolicyOverrides, childSessionMeta, resolveChildAgentOptions, resolveChildDepth, } from "./child-agent.js";
 import { assertSubagentMaxDepth } from "./depth.js";
@@ -297,12 +297,25 @@ export class SubagentContinuationManager {
                     return this.coldResume(parent, childId, content, options);
                 // A delivery that arrives after the disposal transaction began must not
                 // reach a handle being torn down; wait for release, then cold-resume.
+                const disposal = activation.disposal;
                 /* v8 ignore next 3 -- the send-versus-dispose cutoff: reaching this arm needs a
                  * delivery to observe the transaction inside the same critical section that opened it,
                  * which no test can schedule deterministically. The behavior is covered end-to-end by
                  * "cold-resumes a delivery that lost the race with final disposal". */
-                if (activation.disposal !== undefined) {
-                    return activation.disposal.then(() => undefined, () => undefined);
+                if (disposal !== undefined) {
+                    return disposal.then(() => undefined, () => undefined);
+                }
+                // Text-only delivery stays await-free, so the disposal-cutoff check
+                // above and the submit share one critical window. The image path
+                // awaits a capability read, so it re-checks the cutoff afterwards; a
+                // disposal that began during the read is waited out and retried like
+                // one observed on entry.
+                if (contentHasImage(content)) {
+                    await this.assertImageCapable(activation.handle.agent, options.signal);
+                    if (activation.disposal !== undefined) {
+                        await Promise.allSettled([activation.disposal]);
+                        return undefined;
+                    }
                 }
                 return this.submitAdmitted(activation, content, options.source, parent, options.signal);
             });
@@ -742,6 +755,15 @@ export class SubagentContinuationManager {
      */
     async submitMaterialized(activation, content, source, parent, signal) {
         try {
+            if (contentHasImage(content)) {
+                // The capability read awaits with the activation already published, so
+                // the disposal cutoff is re-checked before the submit; a drain that
+                // began during the read turns into a clean closing rejection.
+                await this.assertImageCapable(activation.handle.agent, signal);
+                if (activation.disposal !== undefined) {
+                    throw new SubagentError(`subagent "${activation.childId}" is closing`, 'ACTIVATION_CLOSING');
+                }
+            }
             return this.submitAdmitted(activation, content, source, parent, signal);
         }
         catch (error) {
@@ -751,6 +773,32 @@ export class SubagentContinuationManager {
             throw error;
         }
     }
+    /**
+     * Refuse image content addressed to a child whose model accepts text only.
+     * Callers guard with `contentHasImage`, so text-only delivery never awaits.
+     * The check runs inside the per-child delivery lock, before the message
+     * exists, so a rejection leaves no partial user message. When the child's
+     * route is not fixed by its options (a request-waterfall listener owns it)
+     * or no LLM registry is composed, delivery proceeds and the LLM layer's
+     * text-only projection replaces each image with its stable placeholder.
+     * @param agent - the live or freshly materialized child agent.
+     * @param signal - caller cancellation bounding the model-info read.
+     * @throws {SubagentError} `MODEL_DOES_NOT_SUPPORT_IMAGES` when the child's resolved model declines image input.
+     */
+    async assertImageCapable(agent, signal) {
+        const { provider, model } = agent.options;
+        if (provider === undefined || model === undefined)
+            return;
+        const llm = this.ctx.get('llm');
+        /* v8 ignore next -- a deployment without the LLM registry serves no model
+         * to refuse against; delivery then defers to the text-only projection. */
+        if (llm === undefined)
+            return;
+        const info = await llm.resolveModelInfo(provider, model, signal);
+        if (info.inputModalities !== undefined && !info.inputModalities.includes('image')) {
+            throw new SubagentError(`Model "${model}" does not support image input.`, 'MODEL_DOES_NOT_SUPPORT_IMAGES');
+        }
+    }
     /**
      * Create or resume the child Agent through the private activation-owner
      * scope, install the handle in a fresh Activation, and register ownership on

package/lib/types/control-types.d.ts

@@ -5,10 +5,9 @@
  *
  * @module @deepseek-ai/dsh-subagent/control-types
  */
-import type { EncodedImageAttachment } from '@deepseek-ai/dsh-attachment/types';
+import type { PromptContentPart } from '@deepseek-ai/dsh-attachment/types';
 import type { Branded } from '@deepseek-ai/dsh-brand';
 import type { MessageId } from '@deepseek-ai/dsh-llm/brand';
-import type { ContentBlock } from '@deepseek-ai/dsh-llm/types';
 import type { SessionId } from '@deepseek-ai/dsh-session/types';
 /**
  * Client-minted identity of one browser prompt, persisted on the exact accepted
@@ -83,19 +82,6 @@ export type SubagentAddress = {
 } | {
     readonly mode: 'continuable';
 });
-/**
- * One browser-encoded upload as the Session prompt wire carries it: the shared
- * attachment vocabulary under the content-block tag.
- */
-export interface EncodedImagePromptBlock extends EncodedImageAttachment {
-    readonly type: 'image';
-}
-/**
- * One block a browser prompt may carry. The encoded upload is accepted by the
- * wire and refused by the Host, so the Client narrows nothing: a caller that
- * attaches an image is answered, not silently stripped.
- */
-export type SubagentPromptContentPart = ContentBlock | EncodedImagePromptBlock;
 /** One human message addressed to a continuable direct child. */
 export interface SubagentPromptRequest {
     /** Identity persisted on the accepted message, minted before the call. */
@@ -104,8 +90,12 @@ export interface SubagentPromptRequest {
     readonly childSessionId: SessionId;
     /** Required discriminator retained from the browser control address. */
     readonly mode: 'continuable';
-    /** Content proposed as the child's user message; images are refused. */
-    readonly content: readonly SubagentPromptContentPart[];
+    /**
+     * Browser prompt parts delivered as the child's user message. The Host
+     * admits and persists image parts before delivery, so the wire never
+     * carries a durable attachment reference the caller could fabricate.
+     */
+    readonly content: readonly PromptContentPart[];
     /** Optional browser zone sampled for this exact human prompt. */
     readonly clientTimeZone?: string;
 }
@@ -118,10 +108,8 @@ export interface SubagentInterruptReceipt {
     readonly accepted: true;
 }
 /**
- * Failure details the control surface answers with. The catalog read, the
- * prompt, and the interrupt produce these codes; a Client fabricates
- * `subagent/not-resumable` and `subagent/delivery-unavailable` for a one-shot
- * address it refuses before the call, so both planes read one vocabulary.
+ * Failure details the control surface answers with. Catalog reads, prompts,
+ * and interrupts share this vocabulary with the Client Remote result.
  */
 declare module '@deepseek-ai/dsh-typert-protocol' {
     interface RemoteErrorDetailsMap {
@@ -141,12 +129,8 @@ declare module '@deepseek-ai/dsh-typert-protocol' {
         'subagent/unauthorized': {
             readonly childSessionId: SessionId;
         };
-        /**
-         * The continuation admits no attachment. `reason` names the refused plane
-         * for the caller's copy, as the Session prompt's attachment refusals do.
-         */
-        'subagent/attachment-unsupported': {
-            readonly childSessionId: SessionId;
+        /** Image admission or model image-capability refusal. */
+        'subagent/attachment-invalid': {
             readonly reason: string;
         };
         /** The child exists but its inbox cannot admit the message now. */

package/lib/types/control.d.ts

@@ -6,10 +6,9 @@
  * @module @deepseek-ai/dsh-subagent
  */
 import type { Context } from '@deepseek-ai/cordis';
-import type { ContentBlock } from '@deepseek-ai/dsh-llm';
 import type { SessionId } from '@deepseek-ai/dsh-session';
 import { z } from 'zod';
-import type { SubagentCatalog, SubagentListEntry, SubagentPromptContentPart } from './control-types.ts';
+import type { SubagentCatalog, SubagentListEntry } from './control-types.ts';
 declare const CONTROL_ID_SCHEMAS: {
     readonly 'subagent.list': z.ZodObject<{
         parentSessionId: z.ZodString;
@@ -33,21 +32,6 @@ declare const CONTROL_ID_SCHEMAS: {
  * @throws {RemoteError} `gateway/bad-request` with the original Zod issues.
  */
 export declare function validateControlRequest(method: keyof typeof CONTROL_ID_SCHEMAS, payload: unknown): void;
-/**
- * Admit the content one continuation may deliver, refusing every image.
- *
- * The blocks become the child's user message verbatim, and this surface admits
- * no attachment: nothing here registers encoded bytes with the attachment
- * service, so an image would reach the child as a reference nothing resolves.
- * The wire accepts the encoded upload so this refusal — not a Client that
- * strips the block — is what the caller is answered with. Other block types
- * still cross unnarrowed.
- * @param childSessionId - the addressed child, named by the refusal.
- * @param content - blocks the caller asked to deliver.
- * @returns the admitted blocks, in order, as the durable content vocabulary.
- * @throws {RemoteError} `subagent/attachment-unsupported` when any block is an image.
- */
-export declare function admitPromptContent(childSessionId: SessionId, content: readonly SubagentPromptContentPart[]): ContentBlock[];
 /**
  * Project one durable listing onto the catalog view, replacing each row's
  * store-derived activity with the live Agent driver's status and reporting

package/lib/types/control.js

@@ -5,6 +5,7 @@
  *
  * @module @deepseek-ai/dsh-subagent
  */
+import { AttachmentError } from '@deepseek-ai/dsh-attachment';
 import { RemoteError } from '@deepseek-ai/dsh-typert-protocol';
 import { z } from 'zod';
 import { SubagentError } from "./error.js";
@@ -35,30 +36,6 @@ export function validateControlRequest(method, payload) {
         throw new RemoteError('gateway/bad-request', `invalid payload for ${method}`, { issues: parsed.error.issues });
     }
 }
-/**
- * Admit the content one continuation may deliver, refusing every image.
- *
- * The blocks become the child's user message verbatim, and this surface admits
- * no attachment: nothing here registers encoded bytes with the attachment
- * service, so an image would reach the child as a reference nothing resolves.
- * The wire accepts the encoded upload so this refusal — not a Client that
- * strips the block — is what the caller is answered with. Other block types
- * still cross unnarrowed.
- * @param childSessionId - the addressed child, named by the refusal.
- * @param content - blocks the caller asked to deliver.
- * @returns the admitted blocks, in order, as the durable content vocabulary.
- * @throws {RemoteError} `subagent/attachment-unsupported` when any block is an image.
- */
-export function admitPromptContent(childSessionId, content) {
-    const admitted = [];
-    for (const block of content) {
-        if (block.type === 'image') {
-            throw new RemoteError('subagent/attachment-unsupported', 'subagent continuation does not accept images', { childSessionId, reason: 'SUBAGENT_IMAGE_UNSUPPORTED' });
-        }
-        admitted.push(block);
-    }
-    return admitted;
-}
 /**
  * Project one durable listing onto the catalog view, replacing each row's
  * store-derived activity with the live Agent driver's status and reporting
@@ -109,8 +86,13 @@ export function rejectPrompt(error, childSessionId, signal) {
     if (isCancellation(error, signal)) {
         throw new RemoteError('gateway/cancelled', 'subagent prompt was cancelled', {}, { cause: error });
     }
+    if (error instanceof AttachmentError) {
+        throw new RemoteError('subagent/attachment-invalid', error.message, { reason: error.code }, { cause: error });
+    }
     if (error instanceof SubagentError) {
         switch (error.code) {
+            case 'MODEL_DOES_NOT_SUPPORT_IMAGES':
+                throw new RemoteError('subagent/attachment-invalid', error.message, { reason: error.code }, { cause: error });
             case 'NOT_RESUMABLE':
                 throw new RemoteError('subagent/not-resumable', 'subagent cannot be resumed', { childSessionId }, { cause: error });
             case 'UNAUTHORIZED':

package/lib/types/index.d.ts

@@ -248,10 +248,12 @@ export declare class SubagentRuntime extends TypertRemoteService {
      * validated browser zone on the accepted message. Success identifies the
      * message the child's FIFO inbox accepted; later execution is independent of
      * this call.
+     * Image parts are admitted and persisted through the attachment store
+     * before delivery, and the child's model must accept image input.
      * @param request - durable address, minted identity, content, and optional browser zone.
      * @param signal - carrier cancellation, owning the call until inbox acceptance.
      * @returns the accepted message's inbox identity.
-     * @throws {RemoteError} `gateway/bad-request`, `subagent/attachment-unsupported`,
+     * @throws {RemoteError} `gateway/bad-request`, `subagent/attachment-invalid`,
      *   `subagent/invalid-time-zone`, `subagent/parent-unavailable`,
      *   `subagent/not-resumable`, `subagent/unauthorized`,
      *   `subagent/delivery-unavailable`, `gateway/cancelled`, or `gateway/internal`.

package/lib/types/index.js

@@ -62,11 +62,12 @@ var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn,
     if (target) Object.defineProperty(target, contextIn.name, descriptor);
     done = true;
 };
+import { admitPromptContent } from '@deepseek-ai/dsh-attachment';
 import { scopeTarget } from '@deepseek-ai/dsh-scope';
 import { assertObjectJsonSchema } from '@deepseek-ai/dsh-tools';
 import { canonicalClientTimeZone } from '@deepseek-ai/dsh-util-time';
 import { Remote, RemoteError, TypertRemoteService } from '@deepseek-ai/dsh-typert-protocol';
-import { admitPromptContent, catalogView, rejectCatalogRead, rejectPrompt, validateControlRequest, } from "./control.js";
+import { catalogView, rejectCatalogRead, rejectPrompt, validateControlRequest, } from "./control.js";
 import { SubagentError } from "./error.js";
 import { assertSubagentMaxDepth } from "./depth.js";
 import { createActivationObserver, createLifecycleEmitter, observeRun } from "./lifecycle.js";
@@ -305,10 +306,12 @@ let SubagentRuntime = (() => {
          * validated browser zone on the accepted message. Success identifies the
          * message the child's FIFO inbox accepted; later execution is independent of
          * this call.
+         * Image parts are admitted and persisted through the attachment store
+         * before delivery, and the child's model must accept image input.
          * @param request - durable address, minted identity, content, and optional browser zone.
          * @param signal - carrier cancellation, owning the call until inbox acceptance.
          * @returns the accepted message's inbox identity.
-         * @throws {RemoteError} `gateway/bad-request`, `subagent/attachment-unsupported`,
+         * @throws {RemoteError} `gateway/bad-request`, `subagent/attachment-invalid`,
          *   `subagent/invalid-time-zone`, `subagent/parent-unavailable`,
          *   `subagent/not-resumable`, `subagent/unauthorized`,
          *   `subagent/delivery-unavailable`, `gateway/cancelled`, or `gateway/internal`.
@@ -316,7 +319,6 @@ let SubagentRuntime = (() => {
         async prompt(request, signal) {
             const { parentSessionId, childSessionId, clientTimeZone } = request;
             validateControlRequest('subagent.prompt', request);
-            const content = admitPromptContent(childSessionId, request.content);
             const canonicalTimeZone = clientTimeZone === undefined
                 ? undefined
                 : canonicalClientTimeZone(clientTimeZone);
@@ -333,6 +335,18 @@ let SubagentRuntime = (() => {
                 ...(canonicalTimeZone === undefined ? {} : { clientTimeZone: canonicalTimeZone }),
             };
             try {
+                // Admission precedes delivery: image parts become durable references
+                // here, so the child inbox only ever accepts Host-persisted attachments.
+                let content;
+                if (request.content.every((part) => part.type === 'text')) {
+                    content = request.content.map(part => ({ type: 'text', text: part.text }));
+                }
+                else {
+                    const attachments = this.ctx.get('attachments');
+                    if (attachments === undefined)
+                        throw new Error('subagent image prompt requires an attachment store');
+                    content = await admitPromptContent(attachments, request.content);
+                }
                 return { messageId: await this.followup(parent, childSessionId, content, { source, signal }) };
             }
             catch (error) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@deepseek-ai/dsh-subagent",
   "description": "Abstract subagent seam (ctx.subagents): named-provider registry for delegating to child agents",
-  "version": "0.1.2-alpha.2",
+  "version": "0.1.2-alpha.3",
   "publishConfig": {
     "access": "public"
   },
@@ -50,30 +50,30 @@
   "license": "MIT",
   "dependencies": {
     "zod": "^4.4.3",
-    "@deepseek-ai/dsh-brand": "^0.1.2-alpha.2",
-    "@deepseek-ai/dsh-util-values": "^0.1.2-alpha.2"
+    "@deepseek-ai/dsh-brand": "^0.1.2-alpha.3",
+    "@deepseek-ai/dsh-util-values": "^0.1.2-alpha.3"
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.2",
-    "@deepseek-ai/dsh-agent": "^0.1.2-alpha.2",
-    "@deepseek-ai/dsh-agent-presets": "^0.1.2-alpha.2",
-    "@deepseek-ai/dsh-attachment": "^0.1.2-alpha.2",
-    "@deepseek-ai/dsh-invariants": "^0.1.2-alpha.2",
-    "@deepseek-ai/dsh-jobs": "^0.1.2-alpha.2",
-    "@deepseek-ai/dsh-llm": "^0.1.2-alpha.2",
-    "@deepseek-ai/dsh-sandbox": "^0.1.2-alpha.2",
-    "@deepseek-ai/dsh-sandbox-policy": "^0.1.2-alpha.2",
-    "@deepseek-ai/dsh-scope": "^0.1.2-alpha.2",
-    "@deepseek-ai/dsh-session": "^0.1.2-alpha.2",
-    "@deepseek-ai/dsh-session-persistence": "^0.1.2-alpha.2",
-    "@deepseek-ai/dsh-session-projection-cache": "^0.1.2-alpha.2",
-    "@deepseek-ai/dsh-session-query": "^0.1.2-alpha.2",
-    "@deepseek-ai/dsh-system-prompt": "^0.1.2-alpha.2",
-    "@deepseek-ai/dsh-tools": "^0.1.2-alpha.2",
-    "@deepseek-ai/dsh-typert-protocol": "^0.1.2-alpha.2",
-    "@deepseek-ai/dsh-session-projection": "^0.1.2-alpha.2",
-    "@deepseek-ai/dsh-user-approval": "^0.1.2-alpha.2",
-    "@deepseek-ai/dsh-util-time": "^0.1.2-alpha.2"
+    "@deepseek-ai/dsh-agent": "^0.1.2-alpha.3",
+    "@deepseek-ai/dsh-agent-presets": "^0.1.2-alpha.3",
+    "@deepseek-ai/dsh-attachment": "^0.1.2-alpha.3",
+    "@deepseek-ai/dsh-invariants": "^0.1.2-alpha.3",
+    "@deepseek-ai/dsh-jobs": "^0.1.2-alpha.3",
+    "@deepseek-ai/dsh-llm": "^0.1.2-alpha.3",
+    "@deepseek-ai/dsh-sandbox": "^0.1.2-alpha.3",
+    "@deepseek-ai/dsh-sandbox-policy": "^0.1.2-alpha.3",
+    "@deepseek-ai/dsh-scope": "^0.1.2-alpha.3",
+    "@deepseek-ai/dsh-session": "^0.1.2-alpha.3",
+    "@deepseek-ai/dsh-session-projection": "^0.1.2-alpha.3",
+    "@deepseek-ai/dsh-session-projection-cache": "^0.1.2-alpha.3",
+    "@deepseek-ai/dsh-system-prompt": "^0.1.2-alpha.3",
+    "@deepseek-ai/dsh-tools": "^0.1.2-alpha.3",
+    "@deepseek-ai/dsh-typert-protocol": "^0.1.2-alpha.3",
+    "@deepseek-ai/dsh-user-approval": "^0.1.2-alpha.3",
+    "@deepseek-ai/dsh-session-persistence": "^0.1.2-alpha.3",
+    "@deepseek-ai/dsh-util-time": "^0.1.2-alpha.3",
+    "@deepseek-ai/dsh-session-query": "^0.1.2-alpha.3"
   },
   "peerDependenciesMeta": {
     "@deepseek-ai/dsh-agent-presets": {
@@ -106,27 +106,27 @@
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "^4.0.2",
-    "@deepseek-ai/dsh-agent": "^0.1.2-alpha.2",
-    "@deepseek-ai/dsh-attachment": "^0.1.2-alpha.2",
-    "@deepseek-ai/dsh-agent-presets": "^0.1.2-alpha.2",
-    "@deepseek-ai/dsh-invariants": "^0.1.2-alpha.2",
-    "@deepseek-ai/dsh-jobs": "^0.1.2-alpha.2",
-    "@deepseek-ai/dsh-llm": "^0.1.2-alpha.2",
-    "@deepseek-ai/dsh-sandbox": "^0.1.2-alpha.2",
-    "@deepseek-ai/dsh-sandbox-policy": "^0.1.2-alpha.2",
-    "@deepseek-ai/dsh-scope": "^0.1.2-alpha.2",
-    "@deepseek-ai/dsh-session": "^0.1.2-alpha.2",
-    "@deepseek-ai/dsh-session-persistence": "^0.1.2-alpha.2",
-    "@deepseek-ai/dsh-session-projection": "^0.1.2-alpha.2",
-    "@deepseek-ai/dsh-session-projection-cache": "^0.1.2-alpha.2",
-    "@deepseek-ai/dsh-storage-domain": "^0.1.2-alpha.2",
-    "@deepseek-ai/dsh-storage-json": "^0.1.2-alpha.2",
-    "@deepseek-ai/dsh-system-prompt": "^0.1.2-alpha.2",
-    "@deepseek-ai/dsh-tools": "^0.1.2-alpha.2",
-    "@deepseek-ai/dsh-typert-protocol": "^0.1.2-alpha.2",
-    "@deepseek-ai/dsh-user-approval": "^0.1.2-alpha.2",
-    "@deepseek-ai/dsh-util-time": "^0.1.2-alpha.2",
-    "@deepseek-ai/dsh-storage": "^0.1.2-alpha.2",
-    "@deepseek-ai/dsh-session-query": "^0.1.2-alpha.2"
+    "@deepseek-ai/dsh-agent": "^0.1.2-alpha.3",
+    "@deepseek-ai/dsh-agent-presets": "^0.1.2-alpha.3",
+    "@deepseek-ai/dsh-attachment": "^0.1.2-alpha.3",
+    "@deepseek-ai/dsh-jobs": "^0.1.2-alpha.3",
+    "@deepseek-ai/dsh-invariants": "^0.1.2-alpha.3",
+    "@deepseek-ai/dsh-llm": "^0.1.2-alpha.3",
+    "@deepseek-ai/dsh-sandbox": "^0.1.2-alpha.3",
+    "@deepseek-ai/dsh-sandbox-policy": "^0.1.2-alpha.3",
+    "@deepseek-ai/dsh-scope": "^0.1.2-alpha.3",
+    "@deepseek-ai/dsh-session": "^0.1.2-alpha.3",
+    "@deepseek-ai/dsh-session-projection": "^0.1.2-alpha.3",
+    "@deepseek-ai/dsh-session-projection-cache": "^0.1.2-alpha.3",
+    "@deepseek-ai/dsh-session-query": "^0.1.2-alpha.3",
+    "@deepseek-ai/dsh-storage": "^0.1.2-alpha.3",
+    "@deepseek-ai/dsh-storage-domain": "^0.1.2-alpha.3",
+    "@deepseek-ai/dsh-storage-json": "^0.1.2-alpha.3",
+    "@deepseek-ai/dsh-system-prompt": "^0.1.2-alpha.3",
+    "@deepseek-ai/dsh-tools": "^0.1.2-alpha.3",
+    "@deepseek-ai/dsh-typert-protocol": "^0.1.2-alpha.3",
+    "@deepseek-ai/dsh-user-approval": "^0.1.2-alpha.3",
+    "@deepseek-ai/dsh-util-time": "^0.1.2-alpha.3",
+    "@deepseek-ai/dsh-session-persistence": "^0.1.2-alpha.3"
   }
 }