@deepseek-ai/dsh-subagent 0.1.2-alpha.2 → 0.1.2-alpha.4

package/lib/index.js

@@ -1,14 +1,15 @@
+import { AttachmentError, admitPromptContent } from "@deepseek-ai/dsh-attachment";
 import { scopeTarget } from "@deepseek-ai/dsh-scope";
 import { assertObjectJsonSchema } from "@deepseek-ai/dsh-tools";
 import { canonicalClientTimeZone } from "@deepseek-ai/dsh-util-time";
 import { Remote, RemoteError, TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
 import { z } from "zod";
-import { HarnessError, ReasoningEffortId, boundContextSummary, createUserMessage, errorChain } from "@deepseek-ai/dsh-llm";
+import { HarnessError, ReasoningEffortId, boundContextSummary, contentHasImage, createUserMessage, errorChain } from "@deepseek-ai/dsh-llm";
 import { randomUUID } from "node:crypto";
 import { foldConsumedWork } from "@deepseek-ai/dsh-agent";
+import { Session, SessionLogOffset, SessionSeq } from "@deepseek-ai/dsh-session";
 import { brandString } from "@deepseek-ai/dsh-brand";
 import { snapshotJsonValue } from "@deepseek-ai/dsh-util-values";
-import { Session } from "@deepseek-ai/dsh-session";
 import { accessSync, constants, statSync } from "node:fs";
 import { isAbsolute, resolve } from "node:path";
 //#region lib/types/error.js
@@ -59,31 +60,6 @@ function validateControlRequest(method, payload) {
 	if (!parsed.success) throw new RemoteError("gateway/bad-request", `invalid payload for ${method}`, { issues: parsed.error.issues });
 }
 /**
-* Admit the content one continuation may deliver, refusing every image.
-*
-* The blocks become the child's user message verbatim, and this surface admits
-* no attachment: nothing here registers encoded bytes with the attachment
-* service, so an image would reach the child as a reference nothing resolves.
-* The wire accepts the encoded upload so this refusal — not a Client that
-* strips the block — is what the caller is answered with. Other block types
-* still cross unnarrowed.
-* @param childSessionId - the addressed child, named by the refusal.
-* @param content - blocks the caller asked to deliver.
-* @returns the admitted blocks, in order, as the durable content vocabulary.
-* @throws {RemoteError} `subagent/attachment-unsupported` when any block is an image.
-*/
-function admitPromptContent(childSessionId, content) {
-	const admitted = [];
-	for (const block of content) {
-		if (block.type === "image") throw new RemoteError("subagent/attachment-unsupported", "subagent continuation does not accept images", {
-			childSessionId,
-			reason: "SUBAGENT_IMAGE_UNSUPPORTED"
-		});
-		admitted.push(block);
-	}
-	return admitted;
-}
-/**
 * Project one durable listing onto the catalog view, replacing each row's
 * store-derived activity with the live Agent driver's status and reporting
 * whether the exact parent Agent is live. Without an Agent registry no driver
@@ -128,7 +104,9 @@ function rejectCatalogRead(error, signal) {
 */
 function rejectPrompt(error, childSessionId, signal) {
 	if (isCancellation(error, signal)) throw new RemoteError("gateway/cancelled", "subagent prompt was cancelled", {}, { cause: error });
+	if (error instanceof AttachmentError) throw new RemoteError("subagent/attachment-invalid", error.message, { reason: error.code }, { cause: error });
 	if (error instanceof SubagentError) switch (error.code) {
+		case "MODEL_DOES_NOT_SUPPORT_IMAGES": throw new RemoteError("subagent/attachment-invalid", error.message, { reason: error.code }, { cause: error });
 		case "NOT_RESUMABLE": throw new RemoteError("subagent/not-resumable", "subagent cannot be resumed", { childSessionId }, { cause: error });
 		case "UNAUTHORIZED": throw new RemoteError("subagent/unauthorized", "subagent does not belong to this parent", { childSessionId }, { cause: error });
 		case "DRAINING":
@@ -349,16 +327,16 @@ function createActivationObserver(emit, provider, childId, parent) {
 		id: childId,
 		local: true
 	};
-	let boundary = 0;
+	let boundary = SessionLogOffset(0);
 	let captured = { stopReason: "completed" };
 	const terminal = (failure) => failure === void 0 ? captured : { stopReason: "error" };
 	return {
 		start: (child) => {
-			boundary = child.session.events.length;
+			boundary = child.session.seq;
 			emit("subagent/start", identity, parent);
 		},
 		capture: (child) => {
-			const own = child.session.events.slice(boundary);
+			const own = child.session.snapshotEvents(boundary);
 			const output = finalAssistantOutput(own);
 			captured = {
 				stopReason: epochStopReason(own),
@@ -675,19 +653,19 @@ function resolveChildAgentOptions(parent, requested, childDepth) {
 * child never had.
 * @param parent - the delegating parent agent.
 * @param childDepth - the resolved delegation depth to persist.
-* @param lineageSeedLength - how many leading events came from the parent's log.
+* @param isSeeded - whether this child inherits a parent-log prefix, including an explicitly empty one.
 * @returns the `meta` for `ctx.agents.create()`.
 */
-function childSessionMeta(parent, childDepth, lineageSeedLength) {
+function childSessionMeta(parent, childDepth, isSeeded) {
 	const parentHeader = parent.session.header;
 	const agentPreset = parent.ctx.get("agentPresets")?.composedPreset(parent.ctx);
 	return {
 		...parentHeader.cwd !== void 0 ? { cwd: parentHeader.cwd } : {},
 		...agentPreset === void 0 ? {} : { agentPreset },
 		parentSession: parentHeader.id,
+		isSeeded,
 		origin: "subagent",
-		delegationDepth: childDepth,
-		...lineageSeedLength > 0 ? { seedLength: lineageSeedLength } : {}
+		delegationDepth: childDepth
 	};
 }
 /**
@@ -789,9 +767,32 @@ function appendDelegatedPolicyOverrides(childSession, overrides) {
 function seedDescriptorTurn(childId, seed, descriptor) {
 	const staged = Session.create(childId, seed);
 	staged.append("subagent/descriptor", descriptor);
-	return [...staged.events];
+	return staged.snapshotEvents();
 }
 //#endregion
+//#region lib/types/internal.js
+/**
+* Continuation integration markers and host adapters outside the public
+* Service Definition and model-facing Agent messaging contract.
+* @module @deepseek-ai/dsh-subagent/internal
+*/
+/** Process-stable identity carried only by the standard adjacent-Agent messaging tool. */
+const adjacentAgentSendMessageTool = Symbol.for("dsh.subagent.adjacentAgentSendMessageTool");
+/**
+* Test whether one visible definition is the standard adjacent-Agent messaging tool.
+* @param definition - the scope-resolved `send_message` candidate.
+* @returns whether the definition carries the internal standard-tool identity.
+*/
+function isAdjacentAgentSendMessageTool(definition) {
+	return definition !== void 0 && definition[adjacentAgentSendMessageTool] === true;
+}
+/**
+* Process-stable symbol-keyed Queue delivery shared by the bundled runtime
+* entry and this unbundled internal subpath.
+* @internal
+*/
+const queueSubagentPrompt = Symbol.for("dsh.subagent.queuePrompt");
+//#endregion
 //#region lib/types/continuation.js
 /**
 * Internal continuable-subagent manager: stable child ids, descriptor
@@ -883,6 +884,32 @@ var __disposeResources$1 = (function(SuppressedError) {
 function disposalOf(activation) {
 	return activation.disposal;
 }
+/** Build durable attribution for one adjacent-Agent message. */
+function agentMessageSource(sender) {
+	return {
+		kind: "agent-message",
+		form: "relay",
+		senderSessionId: sender.id
+	};
+}
+/** Build the model-visible and durable representation of one adjacent-Agent message. */
+function agentMessage(sender, content) {
+	return createUserMessage({
+		content: [{
+			type: "text",
+			text: `Agent ${sender.id} sent a message:`
+		}, ...content],
+		source: agentMessageSource(sender)
+	});
+}
+/** Append adjacent-Agent return guidance to a continuable child's initial task. */
+function continuableInitialPrompt(parentId, prompt) {
+	const encodedParentId = JSON.stringify(parentId);
+	return [...prompt, {
+		type: "text",
+		text: `Your parent agent id is ${encodedParentId}. Before you finish, send your result to that agent with send_message({ agent_id: ${encodedParentId}, message: "<self-contained result>" }). The parent shares your workspace but does not automatically receive your transcript, tool output, or reasoning. Send earlier messages as well when a finding changes what the parent should do next; sending a message does not end your turn.`
+	}];
+}
 /**
 * One line telling a parent that a background child is finished and why, in
 * the parent's own task vocabulary.
@@ -932,7 +959,6 @@ var ChildLock = class {
 var SubagentContinuationManager = class {
 	ctx;
 	host;
-	setupRegistry;
 	/** Child session id → its live Activation. Process-local, never durable. */
 	activations = /* @__PURE__ */ new Map();
 	/** Materializations admitted before drain, tracked through publication or rollback. */
@@ -948,10 +974,9 @@ var SubagentContinuationManager = class {
 	*/
 	closingScopes = /* @__PURE__ */ new Map();
 	draining = false;
-	constructor(ctx, host, setupRegistry) {
+	constructor(ctx, host) {
 		this.ctx = ctx;
 		this.host = host;
-		this.setupRegistry = setupRegistry;
 		const scope = ctx.plugin(function activationOwner() {});
 		this.ownerCtx = scope.ctx;
 		ctx.on("agent/disposed", ({ agent }) => {
@@ -1008,7 +1033,7 @@ var SubagentContinuationManager = class {
 		});
 		spec.signal.throwIfAborted();
 		this.assertAdmitting(parent);
-		const lineageSeedLength = prepared.seed?.length ?? 0;
+		const inheritedEventCount = SessionLogOffset(prepared.seed?.length ?? 0);
 		const seed = seedDescriptorTurn(childId, prepared.seed, descriptor);
 		return {
 			childId,
@@ -1029,7 +1054,8 @@ var SubagentContinuationManager = class {
 					parent,
 					create: {
 						seed,
-						meta: childSessionMeta(parent, childDepth, lineageSeedLength),
+						meta: childSessionMeta(parent, childDepth, prepared.seed !== void 0),
+						inheritedEventCount,
 						delegatedPolicies
 					},
 					agentOptions,
@@ -1039,7 +1065,11 @@ var SubagentContinuationManager = class {
 					},
 					signal: spec.signal
 				});
-				return this.submitMaterialized(activation, request.prompt, { kind: "user" }, parent, spec.signal);
+				return this.submitMaterialized(activation, isAdjacentAgentSendMessageTool(this.ctx.get("tools")?.get("send_message", activation.handle.agent)) ? continuableInitialPrompt(parent.id, request.prompt) : request.prompt, {
+					source: { kind: "user" },
+					signal: spec.signal,
+					delivery: "queue"
+				}, parent);
 			})
 		};
 	}
@@ -1048,34 +1078,69 @@ var SubagentContinuationManager = class {
 		if (this.ctx.agents.get(childId) !== void 0 || this.ctx.get("sessions")?.get(childId) !== void 0) throw new SubagentError(`subagent "${childId}" already exists`, "DUPLICATE_CHILD");
 	}
 	/**
-	* Deliver one later message to a known continuable child as its next FIFO
-	* turn. Routing depends only on Activation residency: a `running` Activation
-	* enqueues, a `waiting` one wakes the same Agent, and an absent one
-	* cold-resumes a new Activation from the persisted Session. The Agent inbox
-	* is the only queue, so every accepted message has one observable order.
-	*
-	* The caller signal owns lookup, materialization, and admission only until
-	* inbox acceptance; afterwards the accepted turn cannot be cancelled through
-	* this service.
-	* @param parent - the exact live direct parent authorizing this delivery.
-	* @param childId - the durable child session id.
-	* @param content - the user-role content to deliver.
-	* @param options - the message source fields and caller cancellation.
+	* Deliver one model-authored message to a direct continuable child or to the
+	* sender's direct parent. Both directions use Steer: a running target admits
+	* the message at its nearest step boundary, while an idle target starts a
+	* turn. A missing direct child cold-resumes through the ordinary continuation
+	* lifecycle. The caller signal owns the operation only until inbox acceptance.
+	* @param sender - exact live Agent authorizing and originating the message.
+	* @param targetId - durable direct-parent or direct-child session id.
+	* @param content - model-authored content to deliver.
+	* @param options - caller cancellation before acceptance.
 	* @returns the accepted message's inbox id.
-	* @throws when parent authority, availability, or admission rejects the delivery.
+	* @throws when adjacency, availability, or admission rejects delivery.
 	*/
-	async followup(parent, childId, content, options) {
+	async sendMessage(sender, targetId, content, options) {
+		if (this.ctx.agents.get(sender.id) !== sender) throw new SubagentError("message delivery requires the exact live sender agent", "UNAUTHORIZED");
+		this.assertAdmitting(sender);
+		const senderActivation = this.activations.get(sender.id);
+		if (senderActivation !== void 0 && senderActivation.handle.agent === sender && senderActivation.parentSession === targetId) {
+			options.signal.throwIfAborted();
+			return this.sendToParent(senderActivation, sender, content);
+		}
+		if (sender.session.header.parentSession === targetId) throw new SubagentError(`agent "${sender.id}" is not a resident continuable child and cannot send to parent "${targetId}"`, "UNAUTHORIZED");
+		return this.deliverToChild(sender, targetId, content, {
+			signal: options.signal,
+			delivery: "steer"
+		});
+	}
+	/**
+	* Queue one human-authored prompt as a distinct direct-child turn.
+	* @param parent - exact live direct parent authorizing delivery.
+	* @param childId - durable direct-child session id.
+	* @param content - human-authored content to deliver.
+	* @param source - durable host-protocol provenance.
+	* @param signal - caller cancellation before inbox acceptance.
+	* @returns the accepted message's inbox id.
+	*/
+	async queuePrompt(parent, childId, content, source, signal) {
+		return this.deliverToChild(parent, childId, content, {
+			source,
+			signal,
+			delivery: "queue"
+		});
+	}
+	/** Route one parent-originated delivery through residency and cold resume. */
+	async deliverToChild(parent, childId, content, options) {
 		this.assertAdmitting(parent);
 		while (true) {
 			const live = await this.locks.run(childId, async () => {
 				const activation = this.activations.get(childId);
 				if (activation === void 0) return this.coldResume(parent, childId, content, options);
+				const disposal = activation.disposal;
 				/* v8 ignore next 3 -- the send-versus-dispose cutoff: reaching this arm needs a
 				* delivery to observe the transaction inside the same critical section that opened it,
 				* which no test can schedule deterministically. The behavior is covered end-to-end by
 				* "cold-resumes a delivery that lost the race with final disposal". */
-				if (activation.disposal !== void 0) return activation.disposal.then(() => void 0, () => void 0);
-				return this.submitAdmitted(activation, content, options.source, parent, options.signal);
+				if (disposal !== void 0) return disposal.then(() => void 0, () => void 0);
+				if (contentHasImage(content)) {
+					await this.assertImageCapable(activation.handle.agent, options.signal);
+					if (activation.disposal !== void 0) {
+						await Promise.allSettled([activation.disposal]);
+						return;
+					}
+				}
+				return this.submitAdmitted(activation, content, options, parent);
 			});
 			/* v8 ignore start -- only the lost-cutoff arm above returns undefined, so only that
 			* race reaches the retry below, which then cold-resumes a new Activation. */
@@ -1119,59 +1184,17 @@ var SubagentContinuationManager = class {
 		if (activation.disposal !== void 0) return;
 		activation.handle.agent.cancel(authority.kind === "user" ? { kind: "user" } : { kind: "parent" }, { keepInbox: true });
 	}
-	/**
-	* Deliver explicitly selected content from one resident continuable child to
-	* its durable direct parent. Sender authorization, parent resolution, and
-	* send acceptance share one no-await span. Reporting neither concludes the
-	* child's turn nor changes its Activation lifetime.
-	* @param child - exact live reporting child; this is the authority credential.
-	* @param content - selected model-facing content.
-	* @param options - scheduling policy and pre-acceptance cancellation.
-	* @returns the stable identity of the message accepted by the parent.
-	* @throws {SubagentError} when the sender is unauthorized, the parent is not
-	*   live, or continuation admission is closing.
-	*/
-	async reportFrom(child, content, options) {
-		options.signal.throwIfAborted();
-		this.assertAdmitting(child);
-		const activation = this.authorizeReporter(child);
-		const parent = this.resolveReportParent(child);
-		return this.deliverReport(activation, parent, content, options.delivery);
-	}
-	/** Authorize only the exact Agent of one resident Activation. */
-	authorizeReporter(child) {
-		const activation = this.activations.get(child.id);
-		if (activation === void 0 || activation.handle.agent !== child) throw new SubagentError(`agent "${child.id}" is not a live continuable subagent and cannot report`, "UNAUTHORIZED");
-		/* v8 ignore next 6 -- only a synchronous re-entrant disposer can open this
-		* transaction between exact-agent authorization and this no-await cutoff. */
-		if (activation.disposal !== void 0) throw new SubagentError(`subagent "${child.id}" activation is being disposed; the report was not delivered`, "ACTIVATION_CLOSING");
-		return activation;
-	}
-	/** Resolve the reporting child's live direct parent from durable lineage. */
-	resolveReportParent(child) {
-		const parentId = child.session.header.parentSession;
-		/* v8 ignore next -- every continuation-managed child has direct-parent metadata. */
-		const parent = parentId === void 0 ? void 0 : this.ctx.agents.get(parentId);
-		if (parent === void 0) throw new SubagentError("direct parent is not live; report was not delivered", "PARENT_UNAVAILABLE");
-		return parent;
-	}
-	/** Deliver one framed report through the selected parent scheduling preset. */
-	deliverReport(activation, parent, content, delivery) {
-		const message = createUserMessage({
-			content: [{
-				type: "text",
-				text: `Background subagent ${activation.childId} reported:`
-			}, ...content],
-			source: {
-				kind: "subagent-report",
-				form: "relay",
-				senderSessionId: activation.childId
-			}
-		});
-		if (delivery === "next-step") this.sendWaking(parent, message, () => {
-			this.sendReport(parent, message, delivery);
+	/** Deliver one resident continuable child's message to its live direct parent. */
+	sendToParent(activation, sender, content) {
+		/* v8 ignore next 6 -- only synchronous re-entrant teardown can open this
+		* transaction between exact-agent authorization and this no-await span. */
+		if (activation.disposal !== void 0) throw new SubagentError(`subagent "${sender.id}" activation is being disposed; the message was not delivered`, "ACTIVATION_CLOSING");
+		const parent = this.ctx.agents.get(activation.parentSession);
+		if (parent === void 0) throw new SubagentError("direct parent is not live; the message was not delivered", "PARENT_UNAVAILABLE");
+		const message = agentMessage(sender, content);
+		this.sendWaking(parent, message, () => {
+			this.sendAgentMessage(parent, message);
 		});
-		else this.sendReport(parent, message, delivery);
 		return message.id;
 	}
 	/**
@@ -1188,13 +1211,12 @@ var SubagentContinuationManager = class {
 		if (parentActivation !== void 0 && parentActivation.handle.agent === parent) this.admitWaking(parentActivation, message.id, send);
 		else send();
 	}
-	/** Send one report while translating only the parent's own rejection. */
-	sendReport(parent, message, delivery) {
+	/** Send one Agent message while translating only the target's own rejection. */
+	sendAgentMessage(parent, message) {
 		try {
-			if (delivery === "next-step") parent.steer(message);
-			else parent.inject(message);
+			parent.steer(message);
 		} catch (error) {
-			throw new SubagentError("direct parent is not live; report was not delivered", "PARENT_UNAVAILABLE", { cause: error });
+			throw new SubagentError("direct parent is not live; the message was not delivered", "PARENT_UNAVAILABLE", { cause: error });
 		}
 	}
 	/**
@@ -1371,8 +1393,8 @@ var SubagentContinuationManager = class {
 			const source = __addDisposableResource$1(env_1, observation, false);
 			this.assertAdmitting(parent);
 			this.authorizeLineage(parent, childId, source.header.parentSession);
-			const descriptor = foldSubagentDescriptor(source.events.slice(source.header.seedLength ?? 0));
-			if (descriptor === void 0 || descriptor.mode !== "continuable") throw new SubagentError(`subagent "${childId}" has no supported continuation state and cannot be resumed; do not retry send_message with this id`, "NOT_RESUMABLE");
+			const descriptor = foldSubagentDescriptor(source.events.slice(source.inheritedEventCount));
+			if (descriptor === void 0 || descriptor.mode !== "continuable") throw new SubagentError(`subagent "${childId}" has no supported continuation state and cannot be resumed; choose a different target`, "NOT_RESUMABLE");
 			let activation;
 			try {
 				activation = await this.materialize({
@@ -1395,7 +1417,7 @@ var SubagentContinuationManager = class {
 				if (error instanceof SubagentError) throw error;
 				throw new SubagentError(`subagent "${childId}" is unavailable`, "NOT_RESUMABLE", { cause: error });
 			}
-			return await this.submitMaterialized(activation, content, options.source, parent, options.signal);
+			return await this.submitMaterialized(activation, content, options, parent);
 		} catch (e_1) {
 			env_1.error = e_1;
 			env_1.hasError = true;
@@ -1407,14 +1429,17 @@ var SubagentContinuationManager = class {
 	* Submit to a freshly materialized Activation or roll it back completely.
 	* @param activation - the just-published Activation to admit or release.
 	* @param content - the initial or resumed message content.
-	* @param source - durable fields naming who supplied the accepted message.
+	* @param options - durable source, scheduling, and pre-acceptance cancellation.
 	* @param parent - the live direct parent authorizing admission.
-	* @param signal - caller cancellation owning admission until acceptance.
 	* @returns the accepted inbox message id.
 	*/
-	async submitMaterialized(activation, content, source, parent, signal) {
+	async submitMaterialized(activation, content, options, parent) {
 		try {
-			return this.submitAdmitted(activation, content, source, parent, signal);
+			if (contentHasImage(content)) {
+				await this.assertImageCapable(activation.handle.agent, options.signal);
+				if (activation.disposal !== void 0) throw new SubagentError(`subagent "${activation.childId}" is closing`, "ACTIVATION_CLOSING");
+			}
+			return this.submitAdmitted(activation, content, options, parent);
 		} catch (error) {
 			/* v8 ignore next -- rollback disposal failures must not mask the
 			* pre-acceptance signal, drain, or lifecycle failure. */
@@ -1423,6 +1448,28 @@ var SubagentContinuationManager = class {
 		}
 	}
 	/**
+	* Refuse image content addressed to a child whose model accepts text only.
+	* Callers guard with `contentHasImage`, so text-only delivery never awaits.
+	* The check runs inside the per-child delivery lock, before the message
+	* exists, so a rejection leaves no partial user message. When the child's
+	* route is not fixed by its options (a request-waterfall listener owns it)
+	* or no LLM registry is composed, delivery proceeds and the LLM layer's
+	* text-only projection replaces each image with its stable placeholder.
+	* @param agent - the live or freshly materialized child agent.
+	* @param signal - caller cancellation bounding the model-info read.
+	* @throws {SubagentError} `MODEL_DOES_NOT_SUPPORT_IMAGES` when the child's resolved model declines image input.
+	*/
+	async assertImageCapable(agent, signal) {
+		const { provider, model } = agent.options;
+		if (provider === void 0 || model === void 0) return;
+		const llm = this.ctx.get("llm");
+		/* v8 ignore next -- a deployment without the LLM registry serves no model
+		* to refuse against; delivery then defers to the text-only projection. */
+		if (llm === void 0) return;
+		const info = await llm.resolveModelInfo(provider, model, signal);
+		if (info.inputModalities !== void 0 && !info.inputModalities.includes("image")) throw new SubagentError(`Model "${model}" does not support image input.`, "MODEL_DOES_NOT_SUPPORT_IMAGES");
+	}
+	/**
 	* Create or resume the child Agent through the private activation-owner
 	* scope, install the handle in a fresh Activation, and register ownership on
 	* a continuation-managed parent. Rejection leaves no Activation, no handle,
@@ -1453,7 +1500,6 @@ var SubagentContinuationManager = class {
 		const setup = (childCtx) => {
 			if (create !== void 0) appendDelegatedPolicyOverrides(childCtx.agent.session, create.delegatedPolicies);
 			applyChildComposition(childCtx, parent, inputs.composition);
-			return this.setupRegistry.apply(childCtx);
 		};
 		const observer = this.host.observeActivation(provider, childId, parent);
 		const handle = create === void 0 ? await this.ownerCtx.agents.resume({
@@ -1465,6 +1511,7 @@ var SubagentContinuationManager = class {
 			sessionId: childId,
 			meta: create.meta,
 			seed: create.seed,
+			inheritedEventCount: create.inheritedEventCount,
 			agentOptions: inputs.agentOptions,
 			signal: inputs.signal,
 			setup
@@ -1546,14 +1593,15 @@ var SubagentContinuationManager = class {
 	* inbox id. Acceptance is the operation's success boundary; the manager owns
 	* the Activation independently afterwards.
 	*/
-	submit(activation, content, source, parent) {
+	submit(activation, content, options, parent) {
 		this.acquireOwnership(parent, activation.childId);
-		const message = createUserMessage({
+		const message = options.delivery === "steer" ? agentMessage(parent, content) : createUserMessage({
 			content,
-			source
+			source: options.source
 		});
 		const accepted = this.admitWaking(activation, message.id, () => {
-			activation.handle.agent.followup(message);
+			if (options.delivery === "steer") activation.handle.agent.steer(message);
+			else activation.handle.agent.followup(message);
 		});
 		activation.announced = true;
 		return accepted;
@@ -1581,14 +1629,14 @@ var SubagentContinuationManager = class {
 	* manager drain, or Activation disposal that wins before this synchronous
 	* span rejects without inbox acceptance.
 	*/
-	submitAdmitted(activation, content, source, parent, signal) {
-		signal.throwIfAborted();
+	submitAdmitted(activation, content, options, parent) {
+		options.signal.throwIfAborted();
 		this.assertAdmitting(parent);
 		/* v8 ignore next 6 -- only a synchronous re-entrant disposer can change
 		* this field between the caller's live check and this no-await boundary. */
 		if (disposalOf(activation) !== void 0) throw new SubagentError(`subagent "${activation.childId}" activation is being disposed; the message was not accepted`, "ACTIVATION_CLOSING");
 		this.authorizeLineage(parent, activation.childId, activation.handle.agent.session.header.parentSession);
-		return this.submit(activation, content, source, parent);
+		return this.submit(activation, content, options, parent);
 	}
 	/**
 	* Authorize one operation against the durable direct-parent lineage. Other
@@ -1774,134 +1822,6 @@ var SubagentContinuationManager = class {
 	}
 };
 //#endregion
-//#region lib/types/activation-setup-registry.js
-/**
-* Internal registry of deployment capabilities composed into every continuable
-* child's unpublished creation context.
-*
-* A contribution grants a child-scoped capability without teaching the
-* continuation manager which capabilities exist. The manager owns residency;
-* this registry owns the join between plugin lifetime, unpublished setup, and
-* Activation disposal, so no installation outlives either owner and no removed
-* contribution can be installed after revocation reports completion.
-*
-* @module @deepseek-ai/dsh-subagent/activation-setup-registry
-*/
-/** Re-read mutable removal state after a contribution may have revoked itself. */
-function isRemoved(registration) {
-	return registration.removed;
-}
-/**
-* Owns continuable-child setup registrations, installations, rollback, child
-* cleanup, and immediate live revocation.
-*/
-var SubagentActivationSetupRegistry = class {
-	/** Live contributions in installation order. */
-	registrations = /* @__PURE__ */ new Set();
-	/** Child context to its live installations. */
-	byChild = /* @__PURE__ */ new Map();
-	/**
-	* Register one contribution.
-	* @param contribution - synchronous child-scope installer.
-	* @returns an idempotent registration undo.
-	* @throws after attempting every installation when any disposer fails.
-	*/
-	register(contribution) {
-		const registration = {
-			contribution,
-			removed: false,
-			installations: /* @__PURE__ */ new Set()
-		};
-		this.registrations.add(registration);
-		return () => {
-			if (registration.removed) return;
-			registration.removed = true;
-			this.registrations.delete(registration);
-			this.releaseAll([...registration.installations], "contribution removal");
-		};
-	}
-	/**
-	* Install every live contribution into one unpublished child context.
-	* @param childCtx - the child's unpublished scoped context.
-	* @returns the provisioning commit consumed at Agent publication.
-	*/
-	apply(childCtx) {
-		const state = {
-			installations: [],
-			invalidated: false
-		};
-		try {
-			for (const registration of [...this.registrations]) {
-				/* v8 ignore next -- only a synchronous re-entrant revocation of an
-				* already-snapshotted registration reaches this guard. */
-				if (registration.removed) continue;
-				const installation = {
-					registration,
-					childCtx,
-					dispose: registration.contribution(childCtx),
-					released: false,
-					transaction: state
-				};
-				registration.installations.add(installation);
-				state.installations.push(installation);
-				let indexed = this.byChild.get(childCtx);
-				if (indexed === void 0) {
-					indexed = /* @__PURE__ */ new Set();
-					this.byChild.set(childCtx, indexed);
-				}
-				indexed.add(installation);
-				if (isRemoved(registration)) this.release(installation);
-			}
-		} catch (error) {
-			try {
-				this.releaseAll([...state.installations], "setup rollback");
-			} catch (releaseFailure) {}
-			throw error;
-		}
-		childCtx.effect(() => () => {
-			this.releaseChild(childCtx);
-		}, "subagents.activationSetup()");
-		return { commit: () => {
-			if (state.invalidated) throw new SubagentError("a continuable-subagent setup contribution was revoked while this child was being built; the child was not established", "ACTIVATION_SETUP_REVOKED");
-			for (const installation of state.installations) installation.transaction = void 0;
-		} };
-	}
-	/** Release every remaining installation owned by one disposed child scope. */
-	releaseChild(childCtx) {
-		const indexed = this.byChild.get(childCtx) ?? [];
-		this.releaseAll([...indexed], "child scope disposal");
-	}
-	/**
-	* Release a batch completely before reporting disposer failures.
-	* @param installations - records to release.
-	* @param during - operation name for diagnostics.
-	*/
-	releaseAll(installations, during) {
-		const failures = [];
-		for (const installation of installations) try {
-			this.release(installation);
-		} catch (error) {
-			failures.push(error);
-		}
-		if (failures.length === 0) return;
-		throw new SubagentError(`continuable-subagent setup ${during} failed to release ${failures.length} installation(s): ` + failures.map((failure) => errorChain(failure)).join("; "), "ACTIVATION_SETUP_RELEASE_FAILED");
-	}
-	/** Drop one installation from both indices and dispose it exactly once. */
-	release(installation) {
-		if (installation.released) return;
-		installation.released = true;
-		installation.registration.installations.delete(installation);
-		const indexed = this.byChild.get(installation.childCtx);
-		/* v8 ignore next 4 -- every live installation is indexed until this method removes it. */
-		if (indexed !== void 0) {
-			indexed.delete(installation);
-			if (indexed.size === 0) this.byChild.delete(installation.childCtx);
-		}
-		if (installation.transaction !== void 0) installation.transaction.invalidated = true;
-		installation.dispose();
-	}
-};
-//#endregion
 //#region lib/types/list-children.js
 /**
 * Read-only enumeration of durable subagent children and descendant trees
@@ -1909,9 +1829,10 @@ var SubagentActivationSetupRegistry = class {
 * corpus; each child's mode/label is the registered `subagent` projection
 * unit's value, resolved
 * down a three-rung ladder: the registry's watermark cache for a live child,
-* a durable projection-cache row when it serves an own-suffix identity (the
-* seq gate), and one shared Session observation otherwise, validated against
-* the enumerated lifecycle. The projection fold is the single classification
+* an unseeded durable projection-cache row, and one shared Session observation
+* otherwise. A seeded header deliberately lacks its exact inherited cut, so
+* it takes the body-bearing observation path before classifying an identity.
+* The projection fold is the single classification
 * authority — this module parses no descriptor
 * itself. Absent persistence, enumeration is live-only: a cold child is
 * unreachable for resume anyway, so its absence is capability absence, not an
@@ -1989,8 +1910,8 @@ const COLD_READ_CONCURRENCY = 4;
 * live-preferred merge of `ctx.sessions` and optional session persistence,
 * serving each identity from the `subagent` projection unit: the registry's
 * watermark snapshot for a live child; for a cold one, a durable
-* projection-cache read when it serves an own-suffix identity (the seq gate),
-* else one bounded-concurrency shared Session observation.
+* projection-cache read for an unseeded lifecycle, else one bounded-concurrency
+* shared Session observation carrying the exact inherited cut.
 * @see SubagentRuntime.listChildren for the public cancellation and failure contract.
 * @param ctx - context carrying the session store, the projection registry,
 *   optional persistence, and the optional projection cache.
@@ -2093,7 +2014,7 @@ async function resolveCandidateRows(candidates, listing, signal) {
 			};
 			return;
 		}
-		if (identity === void 0 || identity === null || identity.seq < (candidate.header.seedLength ?? 0)) return;
+		if (identity === void 0 || identity === null || !candidate.live.isOwnSeq(identity.seq)) return;
 		rows[index] = childRow(childId, identity, "running", subagentParents.has(childId));
 	});
 	if (coldReads.length > 0) {
@@ -2143,9 +2064,8 @@ function compareCorpusRecords(a, b) {
 	return a.header.createdAt - b.header.createdAt || a.header.id.localeCompare(b.header.id);
 }
 /**
-* Resolve one cold candidate down the remaining ladder: a durable
-* projection-cache row when it serves an own-suffix identity (the seq gate),
-* otherwise one shared Session observation. An absent or transiently failed
+* Resolve one cold candidate down the remaining ladder: an unseeded durable
+* projection-cache row, otherwise one shared Session observation. An absent or transiently failed
 * observation is one `unavailable` row retried on the next listing; an observation
 * source naming another lifecycle, and a
 * settled log the fold cannot identify — or that makes any registered unit
@@ -2159,14 +2079,14 @@ async function resolveColdIdentity(query, cache, header, hasChildren, signal) {
 	};
 	try {
 		const childId = header.id;
-		if (cache !== void 0) {
+		if (cache !== void 0 && !header.isSeeded) {
 			let cached;
 			try {
-				cached = cache.cachedSnapshot(header, ["subagent"])?.values.subagent;
+				cached = cache.cachedSnapshot(header, SessionLogOffset(0), ["subagent"])?.values.subagent;
 			} catch {
 				cached = void 0;
 			}
-			if (cached !== void 0 && cached !== null && cached.seq >= (header.seedLength ?? 0)) return childRow(childId, cached, "inactive", hasChildren);
+			if (cached !== void 0 && cached !== null) return childRow(childId, cached, "inactive", hasChildren);
 		}
 		assertListingNotCancelled(signal);
 		let observation;
@@ -2188,7 +2108,7 @@ async function resolveColdIdentity(query, cache, header, hasChildren, signal) {
 			reason: "corrupt"
 		};
 		const identity = ownedObservation.projections?.values.subagent;
-		if (identity === void 0 || identity === null || identity.seq < (header.seedLength ?? 0)) return {
+		if (identity === void 0 || identity === null || identity.seq < ownedObservation.inheritedEventCount) return {
 			kind: "diagnostic",
 			id: childId,
 			reason: "corrupt"
@@ -2226,7 +2146,7 @@ const LIFECYCLE_WITNESS_KEYS = [
 	"createdAt",
 	"cwd",
 	"parentSession",
-	"seedLength",
+	"isSeeded",
 	"delegationDepth",
 	"origin",
 	"agentPreset"
@@ -2337,11 +2257,11 @@ const subagentTimingProjectionDefinition = {
 const identityValueSchema = z.discriminatedUnion("mode", [z.object({
 	mode: z.literal("one-shot"),
 	label: z.string().optional(),
-	seq: z.number().int().nonnegative()
+	seq: z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER).transform(SessionSeq)
 }).strict(), z.object({
 	mode: z.literal("continuable"),
 	label: z.string(),
-	seq: z.number().int().nonnegative()
+	seq: z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER).transform(SessionSeq)
 }).strict()]);
 const identitySchema = identityValueSchema.nullable();
 const identityStateSchema = z.object({ identity: identityValueSchema.optional() }).strict();
@@ -2668,8 +2588,8 @@ async function settleRun(run) {
 *
 * Public operations express caller intent: `start` returns one published owned
 * one-shot run, `startContinuable` establishes a durable continuable child, and
-* `followup` delivers later content without exposing whether the child is
-* resident. Continuable children never become a {@link SubagentRun}: the
+* `sendMessage` steers between adjacent Agents without exposing whether a child
+* is resident. Continuable children never become a {@link SubagentRun}: the
 * continuation manager holds their `AgentHandle` directly and orders every turn
 * through the child's own inbox, so providers contribute only the detached
 * creation spec and see no handle, turn, or teardown. Child and descendant
@@ -2776,8 +2696,6 @@ let SubagentRuntime = (() => {
 		}
 		providers = (__runInitializers(this, _instanceExtraInitializers), /* @__PURE__ */ new Map());
 		continuations;
-		/** Deployment contributions composed into unpublished continuable children. */
-		setupRegistry = new SubagentActivationSetupRegistry();
 		/**
 		* The contained lifecycle-edge publisher. Built here because scoped dispatch
 		* keys its carrier by this exact service instance, whose own context filter
@@ -2791,7 +2709,7 @@ let SubagentRuntime = (() => {
 				const manager = new SubagentContinuationManager(childCtx, {
 					prepareContinuable: (name, request) => this.prepareContinuable(name, request),
 					observeActivation: (provider, childId, parent) => this.observeActivation(provider, childId, parent)
-				}, this.setupRegistry);
+				});
 				this.continuations = manager;
 				childCtx.effect(() => () => {
 					/* v8 ignore else -- one injected binding owns the slot until its fiber disposes. */
@@ -2816,22 +2734,35 @@ let SubagentRuntime = (() => {
 			return this.requireContinuations().startContinuable(spec);
 		}
 		/**
-		* Deliver one later message to a continuable child as its next FIFO turn. A
-		* resident child's Agent inbox accepts it directly (waking a `waiting`
-		* Activation), while an absent one is cold-resumed from its persisted
-		* Session. The Agent inbox is the only queue, so every accepted message has
-		* one observable order.
-		* @param parent - the exact live direct parent authorizing this delivery.
-		* @param childId - durable child session id.
-		* @param content - user-role content to deliver.
-		* @param options - the message source fields and caller cancellation, which stops the
-		*   operation only before inbox acceptance.
+		* Steer one model-authored message to the sender's direct parent or direct
+		* continuable child. A running target admits it at the nearest step boundary;
+		* an idle target starts a turn, and an absent direct child cold-resumes from
+		* persistence. The service derives durable sender attribution from the exact
+		* live sender. Caller cancellation stops only pre-acceptance work.
+		* @param sender - exact live Agent authorizing and originating the message.
+		* @param targetId - durable direct-parent or direct-child session id.
+		* @param content - model-authored content to deliver.
+		* @param options - caller cancellation before inbox acceptance.
 		* @returns the accepted message's inbox id.
-		* @throws when continuation services are unavailable, parent authority is
-		*   rejected, or the message was not admitted.
+		* @throws when continuation services are unavailable, adjacency is rejected,
+		*   or the message was not admitted.
 		*/
-		async followup(parent, childId, content, options) {
-			return this.requireContinuations().followup(parent, childId, content, options);
+		async sendMessage(sender, targetId, content, options) {
+			return this.requireContinuations().sendMessage(sender, targetId, content, options);
+		}
+		/**
+		* Queue one host-protocol message as a distinct direct-child turn.
+		* Symbol-keyed so host adapters can preserve their own provenance without
+		* widening the public Service Definition or impersonating an Agent sender.
+		* @param parent - exact live direct parent authorizing delivery.
+		* @param childId - durable direct-child session id.
+		* @param content - host-authored content to deliver.
+		* @param source - durable host-protocol provenance.
+		* @param signal - caller cancellation before inbox acceptance.
+		* @returns the accepted message's inbox id.
+		*/
+		[queueSubagentPrompt](parent, childId, content, source, signal) {
+			return this.requireContinuations().queuePrompt(parent, childId, content, source, signal);
 		}
 		/**
 		* Interrupt one live continuable child's current turn under a human parent
@@ -2852,31 +2783,6 @@ let SubagentRuntime = (() => {
 			this.continuations?.interrupt(targetSessionId, authority);
 		}
 		/**
-		* Deliver selected content from one live continuable child to its durable
-		* direct parent. The child is the authority credential; callers cannot name a
-		* recipient. Reporting does not conclude the child's turn or Activation.
-		* @param child - exact live reporting child.
-		* @param content - selected model-facing content.
-		* @param options - parent scheduling and pre-acceptance cancellation.
-		* @returns the stable identity of the parent-accepted message.
-		* @throws when continuation services are unavailable, sender authorization
-		*   fails, or the direct parent is not live.
-		*/
-		async reportFrom(child, content, options) {
-			return this.requireContinuations().reportFrom(child, content, options);
-		}
-		/**
-		* Compose one deployment capability into every continuable child's
-		* unpublished creation context on fresh creation and cold resume. Grants wait
-		* for the next Activation; removing the contribution revokes every resident
-		* installation immediately.
-		* @param contribution - synchronous child-scope installer.
-		* @returns the exact Cordis effect disposer.
-		*/
-		registerContinuableSetup(contribution) {
-			return this.ctx.effect(() => this.setupRegistry.register(contribution), "subagents.registerContinuableSetup()");
-		}
-		/**
 		* Close continuable admission below exact live parent Agents, stop only their
 		* visible descendant Activations synchronously, then await admitted scoped
 		* materializations and release those forests child-first. The scoped cutoff
@@ -2971,10 +2877,12 @@ let SubagentRuntime = (() => {
 		* validated browser zone on the accepted message. Success identifies the
 		* message the child's FIFO inbox accepted; later execution is independent of
 		* this call.
+		* Image parts are admitted and persisted through the attachment store
+		* before delivery, and the child's model must accept image input.
 		* @param request - durable address, minted identity, content, and optional browser zone.
 		* @param signal - carrier cancellation, owning the call until inbox acceptance.
 		* @returns the accepted message's inbox identity.
-		* @throws {RemoteError} `gateway/bad-request`, `subagent/attachment-unsupported`,
+		* @throws {RemoteError} `gateway/bad-request`, `subagent/attachment-invalid`,
 		*   `subagent/invalid-time-zone`, `subagent/parent-unavailable`,
 		*   `subagent/not-resumable`, `subagent/unauthorized`,
 		*   `subagent/delivery-unavailable`, `gateway/cancelled`, or `gateway/internal`.
@@ -2982,7 +2890,6 @@ let SubagentRuntime = (() => {
 		async prompt(request, signal) {
 			const { parentSessionId, childSessionId, clientTimeZone } = request;
 			validateControlRequest("subagent.prompt", request);
-			const content = admitPromptContent(childSessionId, request.content);
 			const canonicalTimeZone = clientTimeZone === void 0 ? void 0 : canonicalClientTimeZone(clientTimeZone);
 			if (clientTimeZone !== void 0 && canonicalTimeZone === void 0) throw new RemoteError("subagent/invalid-time-zone", "clientTimeZone must be UTC or a valid IANA Area/Location name", { value: clientTimeZone });
 			const parent = this.ctx.get("agents")?.get(parentSessionId);
@@ -2993,10 +2900,17 @@ let SubagentRuntime = (() => {
 				...canonicalTimeZone === void 0 ? {} : { clientTimeZone: canonicalTimeZone }
 			};
 			try {
-				return { messageId: await this.followup(parent, childSessionId, content, {
-					source,
-					signal
-				}) };
+				let content;
+				if (request.content.every((part) => part.type === "text")) content = request.content.map((part) => ({
+					type: "text",
+					text: part.text
+				}));
+				else {
+					const attachments = this.ctx.get("attachments");
+					if (attachments === void 0) throw new Error("subagent image prompt requires an attachment store");
+					content = await admitPromptContent(attachments, request.content);
+				}
+				return { messageId: await this[queueSubagentPrompt](parent, childSessionId, content, source, signal) };
 			} catch (error) {
 				return rejectPrompt(error, childSessionId, signal);
 			}