@deepseek-ai/dsh-subagent 0.1.2-alpha.2 → 0.1.2-alpha.4

package/lib/types/control-types.d.ts

@@ -5,10 +5,9 @@
  *
  * @module @deepseek-ai/dsh-subagent/control-types
  */
-import type { EncodedImageAttachment } from '@deepseek-ai/dsh-attachment/types';
+import type { PromptContentPart } from '@deepseek-ai/dsh-attachment/types';
 import type { Branded } from '@deepseek-ai/dsh-brand';
 import type { MessageId } from '@deepseek-ai/dsh-llm/brand';
-import type { ContentBlock } from '@deepseek-ai/dsh-llm/types';
 import type { SessionId } from '@deepseek-ai/dsh-session/types';
 /**
  * Client-minted identity of one browser prompt, persisted on the exact accepted
@@ -83,19 +82,6 @@ export type SubagentAddress = {
 } | {
     readonly mode: 'continuable';
 });
-/**
- * One browser-encoded upload as the Session prompt wire carries it: the shared
- * attachment vocabulary under the content-block tag.
- */
-export interface EncodedImagePromptBlock extends EncodedImageAttachment {
-    readonly type: 'image';
-}
-/**
- * One block a browser prompt may carry. The encoded upload is accepted by the
- * wire and refused by the Host, so the Client narrows nothing: a caller that
- * attaches an image is answered, not silently stripped.
- */
-export type SubagentPromptContentPart = ContentBlock | EncodedImagePromptBlock;
 /** One human message addressed to a continuable direct child. */
 export interface SubagentPromptRequest {
     /** Identity persisted on the accepted message, minted before the call. */
@@ -104,8 +90,12 @@ export interface SubagentPromptRequest {
     readonly childSessionId: SessionId;
     /** Required discriminator retained from the browser control address. */
     readonly mode: 'continuable';
-    /** Content proposed as the child's user message; images are refused. */
-    readonly content: readonly SubagentPromptContentPart[];
+    /**
+     * Browser prompt parts delivered as the child's user message. The Host
+     * admits and persists image parts before delivery, so the wire never
+     * carries a durable attachment reference the caller could fabricate.
+     */
+    readonly content: readonly PromptContentPart[];
     /** Optional browser zone sampled for this exact human prompt. */
     readonly clientTimeZone?: string;
 }
@@ -118,10 +108,8 @@ export interface SubagentInterruptReceipt {
     readonly accepted: true;
 }
 /**
- * Failure details the control surface answers with. The catalog read, the
- * prompt, and the interrupt produce these codes; a Client fabricates
- * `subagent/not-resumable` and `subagent/delivery-unavailable` for a one-shot
- * address it refuses before the call, so both planes read one vocabulary.
+ * Failure details the control surface answers with. Catalog reads, prompts,
+ * and interrupts share this vocabulary with the Client Remote result.
  */
 declare module '@deepseek-ai/dsh-typert-protocol' {
     interface RemoteErrorDetailsMap {
@@ -141,12 +129,8 @@ declare module '@deepseek-ai/dsh-typert-protocol' {
         'subagent/unauthorized': {
             readonly childSessionId: SessionId;
         };
-        /**
-         * The continuation admits no attachment. `reason` names the refused plane
-         * for the caller's copy, as the Session prompt's attachment refusals do.
-         */
-        'subagent/attachment-unsupported': {
-            readonly childSessionId: SessionId;
+        /** Image admission or model image-capability refusal. */
+        'subagent/attachment-invalid': {
             readonly reason: string;
         };
         /** The child exists but its inbox cannot admit the message now. */

package/lib/types/control.d.ts

@@ -6,10 +6,9 @@
  * @module @deepseek-ai/dsh-subagent
  */
 import type { Context } from '@deepseek-ai/cordis';
-import type { ContentBlock } from '@deepseek-ai/dsh-llm';
 import type { SessionId } from '@deepseek-ai/dsh-session';
 import { z } from 'zod';
-import type { SubagentCatalog, SubagentListEntry, SubagentPromptContentPart } from './control-types.ts';
+import type { SubagentCatalog, SubagentListEntry } from './control-types.ts';
 declare const CONTROL_ID_SCHEMAS: {
     readonly 'subagent.list': z.ZodObject<{
         parentSessionId: z.ZodString;
@@ -33,21 +32,6 @@ declare const CONTROL_ID_SCHEMAS: {
  * @throws {RemoteError} `gateway/bad-request` with the original Zod issues.
  */
 export declare function validateControlRequest(method: keyof typeof CONTROL_ID_SCHEMAS, payload: unknown): void;
-/**
- * Admit the content one continuation may deliver, refusing every image.
- *
- * The blocks become the child's user message verbatim, and this surface admits
- * no attachment: nothing here registers encoded bytes with the attachment
- * service, so an image would reach the child as a reference nothing resolves.
- * The wire accepts the encoded upload so this refusal — not a Client that
- * strips the block — is what the caller is answered with. Other block types
- * still cross unnarrowed.
- * @param childSessionId - the addressed child, named by the refusal.
- * @param content - blocks the caller asked to deliver.
- * @returns the admitted blocks, in order, as the durable content vocabulary.
- * @throws {RemoteError} `subagent/attachment-unsupported` when any block is an image.
- */
-export declare function admitPromptContent(childSessionId: SessionId, content: readonly SubagentPromptContentPart[]): ContentBlock[];
 /**
  * Project one durable listing onto the catalog view, replacing each row's
  * store-derived activity with the live Agent driver's status and reporting

package/lib/types/control.js

@@ -5,6 +5,7 @@
  *
  * @module @deepseek-ai/dsh-subagent
  */
+import { AttachmentError } from '@deepseek-ai/dsh-attachment';
 import { RemoteError } from '@deepseek-ai/dsh-typert-protocol';
 import { z } from 'zod';
 import { SubagentError } from "./error.js";
@@ -35,30 +36,6 @@ export function validateControlRequest(method, payload) {
         throw new RemoteError('gateway/bad-request', `invalid payload for ${method}`, { issues: parsed.error.issues });
     }
 }
-/**
- * Admit the content one continuation may deliver, refusing every image.
- *
- * The blocks become the child's user message verbatim, and this surface admits
- * no attachment: nothing here registers encoded bytes with the attachment
- * service, so an image would reach the child as a reference nothing resolves.
- * The wire accepts the encoded upload so this refusal — not a Client that
- * strips the block — is what the caller is answered with. Other block types
- * still cross unnarrowed.
- * @param childSessionId - the addressed child, named by the refusal.
- * @param content - blocks the caller asked to deliver.
- * @returns the admitted blocks, in order, as the durable content vocabulary.
- * @throws {RemoteError} `subagent/attachment-unsupported` when any block is an image.
- */
-export function admitPromptContent(childSessionId, content) {
-    const admitted = [];
-    for (const block of content) {
-        if (block.type === 'image') {
-            throw new RemoteError('subagent/attachment-unsupported', 'subagent continuation does not accept images', { childSessionId, reason: 'SUBAGENT_IMAGE_UNSUPPORTED' });
-        }
-        admitted.push(block);
-    }
-    return admitted;
-}
 /**
  * Project one durable listing onto the catalog view, replacing each row's
  * store-derived activity with the live Agent driver's status and reporting
@@ -109,8 +86,13 @@ export function rejectPrompt(error, childSessionId, signal) {
     if (isCancellation(error, signal)) {
         throw new RemoteError('gateway/cancelled', 'subagent prompt was cancelled', {}, { cause: error });
     }
+    if (error instanceof AttachmentError) {
+        throw new RemoteError('subagent/attachment-invalid', error.message, { reason: error.code }, { cause: error });
+    }
     if (error instanceof SubagentError) {
         switch (error.code) {
+            case 'MODEL_DOES_NOT_SUPPORT_IMAGES':
+                throw new RemoteError('subagent/attachment-invalid', error.message, { reason: error.code }, { cause: error });
             case 'NOT_RESUMABLE':
                 throw new RemoteError('subagent/not-resumable', 'subagent cannot be resumed', { childSessionId }, { cause: error });
             case 'UNAUTHORIZED':

package/lib/types/descriptor-seed.d.ts

@@ -17,5 +17,5 @@ import type { SubagentDescriptorData } from './descriptor.ts';
  * @param descriptor - the snapshotted composition record to persist.
  * @returns the complete seed events, contiguous from sequence zero.
  */
-export declare function seedDescriptorTurn(childId: SessionId, seed: readonly SessionEvent[] | undefined, descriptor: SubagentDescriptorData): SessionEvent[];
+export declare function seedDescriptorTurn(childId: SessionId, seed: readonly SessionEvent[] | undefined, descriptor: SubagentDescriptorData): readonly SessionEvent[];
 //# sourceMappingURL=descriptor-seed.d.ts.map

package/lib/types/descriptor-seed.js

@@ -19,6 +19,6 @@ import { Session } from '@deepseek-ai/dsh-session';
 export function seedDescriptorTurn(childId, seed, descriptor) {
     const staged = Session.create(childId, seed);
     staged.append('subagent/descriptor', descriptor);
-    return [...staged.events];
+    return staged.snapshotEvents();
 }
 //# sourceMappingURL=descriptor-seed.js.map

package/lib/types/index.d.ts

@@ -13,8 +13,8 @@
  *
  * Public operations express caller intent: `start` returns one published owned
  * one-shot run, `startContinuable` establishes a durable continuable child, and
- * `followup` delivers later content without exposing whether the child is
- * resident. Continuable children never become a {@link SubagentRun}: the
+ * `sendMessage` steers between adjacent Agents without exposing whether a child
+ * is resident. Continuable children never become a {@link SubagentRun}: the
  * continuation manager holds their `AgentHandle` directly and orders every turn
  * through the child's own inbox, so providers contribute only the detached
  * creation spec and see no handle, turn, or teardown. Child and descendant
@@ -36,9 +36,9 @@ import type { SessionId } from '@deepseek-ai/dsh-session';
 import { TypertRemoteService } from '@deepseek-ai/dsh-typert-protocol';
 import type { SubagentCatalog, SubagentInterruptReceipt, SubagentPromptReceipt, SubagentPromptRequest } from './control-types.ts';
 import type { SubagentProvider, SubagentRun, SubagentRunEndInfo, SubagentRunInfo, SubagentStartRequest } from './types.ts';
-import type { ContinuableStart, ContinuableStartSpec, SubagentFollowupOptions, SubagentInterruptAuthority, SubagentReportOptions } from './continuation.ts';
-import type { ContinuableSetupContribution } from './activation-setup-registry.ts';
+import type { ContinuableStart, ContinuableStartSpec, SubagentInterruptAuthority, SubagentSendMessageOptions } from './continuation.ts';
 import type { SubagentDescendantListEntry, SubagentListEntry } from './list-children.ts';
+import { queueSubagentPrompt } from './internal.ts';
 export * from './out-of-process.ts';
 export { AssistantOutputFold, finalAssistantOutput } from './assistant-output.ts';
 export { SubagentRunId } from './types.ts';
@@ -51,8 +51,7 @@ export { settleRun } from './run-settlement.ts';
 export { assertSubagentMaxDepth, delegationDepthOf } from './depth.ts';
 export { appendDelegatedPolicyOverrides, applyChildComposition, captureDelegatedPolicyOverrides, childSessionMeta, parentAgentOptionsForDelegation, resolveChildAgentOptions, resolveChildDepth, SubagentDepthError, } from './child-agent.ts';
 export type { ChildComposition, DelegatedPolicyOverrides } from './child-agent.ts';
-export type { ContinuableStart, ContinuableStartSpec, CoordinatorMessageSource, SubagentFollowupOptions, SubagentInterruptAuthority, SubagentReportDelivery, SubagentReportMessageSource, SubagentReportOptions, SubagentSettledMessageSource, } from './continuation.ts';
-export type { ContinuableSetupContribution } from './activation-setup-registry.ts';
+export type { AgentMessageSource, ContinuableStart, ContinuableStartSpec, SubagentInterruptAuthority, SubagentSendMessageOptions, SubagentSettledMessageSource, } from './continuation.ts';
 export type * from './control-types.ts';
 export type { SubagentDescendantListEntry } from './list-children.ts';
 export type { SubagentRunEndInfo, SubagentRunInfo } from './types.ts';
@@ -100,8 +99,6 @@ declare module '@deepseek-ai/cordis' {
 export declare class SubagentRuntime extends TypertRemoteService {
     private providers;
     private continuations;
-    /** Deployment contributions composed into unpublished continuable children. */
-    private readonly setupRegistry;
     /**
      * The contained lifecycle-edge publisher. Built here because scoped dispatch
      * keys its carrier by this exact service instance, whose own context filter
@@ -120,21 +117,32 @@ export declare class SubagentRuntime extends TypertRemoteService {
      */
     startContinuable(spec: ContinuableStartSpec): Promise<ContinuableStart>;
     /**
-     * Deliver one later message to a continuable child as its next FIFO turn. A
-     * resident child's Agent inbox accepts it directly (waking a `waiting`
-     * Activation), while an absent one is cold-resumed from its persisted
-     * Session. The Agent inbox is the only queue, so every accepted message has
-     * one observable order.
-     * @param parent - the exact live direct parent authorizing this delivery.
-     * @param childId - durable child session id.
-     * @param content - user-role content to deliver.
-     * @param options - the message source fields and caller cancellation, which stops the
-     *   operation only before inbox acceptance.
+     * Steer one model-authored message to the sender's direct parent or direct
+     * continuable child. A running target admits it at the nearest step boundary;
+     * an idle target starts a turn, and an absent direct child cold-resumes from
+     * persistence. The service derives durable sender attribution from the exact
+     * live sender. Caller cancellation stops only pre-acceptance work.
+     * @param sender - exact live Agent authorizing and originating the message.
+     * @param targetId - durable direct-parent or direct-child session id.
+     * @param content - model-authored content to deliver.
+     * @param options - caller cancellation before inbox acceptance.
      * @returns the accepted message's inbox id.
-     * @throws when continuation services are unavailable, parent authority is
-     *   rejected, or the message was not admitted.
+     * @throws when continuation services are unavailable, adjacency is rejected,
+     *   or the message was not admitted.
      */
-    followup(parent: Agent, childId: SessionId, content: ContentBlock[], options: SubagentFollowupOptions): Promise<MessageId>;
+    sendMessage(sender: Agent, targetId: SessionId, content: ContentBlock[], options: SubagentSendMessageOptions): Promise<MessageId>;
+    /**
+     * Queue one host-protocol message as a distinct direct-child turn.
+     * Symbol-keyed so host adapters can preserve their own provenance without
+     * widening the public Service Definition or impersonating an Agent sender.
+     * @param parent - exact live direct parent authorizing delivery.
+     * @param childId - durable direct-child session id.
+     * @param content - host-authored content to deliver.
+     * @param source - durable host-protocol provenance.
+     * @param signal - caller cancellation before inbox acceptance.
+     * @returns the accepted message's inbox id.
+     */
+    private [queueSubagentPrompt];
     /**
      * Interrupt one live continuable child's current turn under a human parent
      * address or an exact live ancestor Agent. Fire-and-return: the cancel
@@ -151,27 +159,6 @@ export declare class SubagentRuntime extends TypertRemoteService {
      *   live target.
      */
     interrupt(targetSessionId: SessionId, authority: SubagentInterruptAuthority): void;
-    /**
-     * Deliver selected content from one live continuable child to its durable
-     * direct parent. The child is the authority credential; callers cannot name a
-     * recipient. Reporting does not conclude the child's turn or Activation.
-     * @param child - exact live reporting child.
-     * @param content - selected model-facing content.
-     * @param options - parent scheduling and pre-acceptance cancellation.
-     * @returns the stable identity of the parent-accepted message.
-     * @throws when continuation services are unavailable, sender authorization
-     *   fails, or the direct parent is not live.
-     */
-    reportFrom(child: Agent, content: ContentBlock[], options: SubagentReportOptions): Promise<MessageId>;
-    /**
-     * Compose one deployment capability into every continuable child's
-     * unpublished creation context on fresh creation and cold resume. Grants wait
-     * for the next Activation; removing the contribution revokes every resident
-     * installation immediately.
-     * @param contribution - synchronous child-scope installer.
-     * @returns the exact Cordis effect disposer.
-     */
-    registerContinuableSetup(contribution: ContinuableSetupContribution): () => void;
     /**
      * Close continuable admission below exact live parent Agents, stop only their
      * visible descendant Activations synchronously, then await admitted scoped
@@ -248,10 +235,12 @@ export declare class SubagentRuntime extends TypertRemoteService {
      * validated browser zone on the accepted message. Success identifies the
      * message the child's FIFO inbox accepted; later execution is independent of
      * this call.
+     * Image parts are admitted and persisted through the attachment store
+     * before delivery, and the child's model must accept image input.
      * @param request - durable address, minted identity, content, and optional browser zone.
      * @param signal - carrier cancellation, owning the call until inbox acceptance.
      * @returns the accepted message's inbox identity.
-     * @throws {RemoteError} `gateway/bad-request`, `subagent/attachment-unsupported`,
+     * @throws {RemoteError} `gateway/bad-request`, `subagent/attachment-invalid`,
      *   `subagent/invalid-time-zone`, `subagent/parent-unavailable`,
      *   `subagent/not-resumable`, `subagent/unauthorized`,
      *   `subagent/delivery-unavailable`, `gateway/cancelled`, or `gateway/internal`.

package/lib/types/index.js

@@ -13,8 +13,8 @@
  *
  * Public operations express caller intent: `start` returns one published owned
  * one-shot run, `startContinuable` establishes a durable continuable child, and
- * `followup` delivers later content without exposing whether the child is
- * resident. Continuable children never become a {@link SubagentRun}: the
+ * `sendMessage` steers between adjacent Agents without exposing whether a child
+ * is resident. Continuable children never become a {@link SubagentRun}: the
  * continuation manager holds their `AgentHandle` directly and orders every turn
  * through the child's own inbox, so providers contribute only the detached
  * creation spec and see no handle, turn, or teardown. Child and descendant
@@ -62,19 +62,20 @@ var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn,
     if (target) Object.defineProperty(target, contextIn.name, descriptor);
     done = true;
 };
+import { admitPromptContent } from '@deepseek-ai/dsh-attachment';
 import { scopeTarget } from '@deepseek-ai/dsh-scope';
 import { assertObjectJsonSchema } from '@deepseek-ai/dsh-tools';
 import { canonicalClientTimeZone } from '@deepseek-ai/dsh-util-time';
 import { Remote, RemoteError, TypertRemoteService } from '@deepseek-ai/dsh-typert-protocol';
-import { admitPromptContent, catalogView, rejectCatalogRead, rejectPrompt, validateControlRequest, } from "./control.js";
+import { catalogView, rejectCatalogRead, rejectPrompt, validateControlRequest, } from "./control.js";
 import { SubagentError } from "./error.js";
 import { assertSubagentMaxDepth } from "./depth.js";
 import { createActivationObserver, createLifecycleEmitter, observeRun } from "./lifecycle.js";
 import SubagentContinuationManager from "./continuation.js";
-import SubagentActivationSetupRegistry from "./activation-setup-registry.js";
 import { listChildren as listSubagentChildren, listDescendants as listSubagentDescendants } from "./list-children.js";
 import { snapshotSubagentDescriptor } from "./descriptor.js";
 import { subagentIdentityProjectionDefinition, subagentTimingProjectionDefinition } from "./projection.js";
+import { queueSubagentPrompt } from "./internal.js";
 export * from "./out-of-process.js";
 export { AssistantOutputFold, finalAssistantOutput } from "./assistant-output.js";
 export { SubagentRunId } from "./types.js";
@@ -104,8 +105,6 @@ let SubagentRuntime = (() => {
         }
         providers = (__runInitializers(this, _instanceExtraInitializers), new Map());
         continuations;
-        /** Deployment contributions composed into unpublished continuable children. */
-        setupRegistry = new SubagentActivationSetupRegistry();
         /**
          * The contained lifecycle-edge publisher. Built here because scoped dispatch
          * keys its carrier by this exact service instance, whose own context filter
@@ -119,7 +118,7 @@ let SubagentRuntime = (() => {
                 const manager = new SubagentContinuationManager(childCtx, {
                     prepareContinuable: (name, request) => this.prepareContinuable(name, request),
                     observeActivation: (provider, childId, parent) => this.observeActivation(provider, childId, parent),
-                }, this.setupRegistry);
+                });
                 this.continuations = manager;
                 childCtx.effect(() => () => {
                     /* v8 ignore else -- one injected binding owns the slot until its fiber disposes. */
@@ -145,22 +144,35 @@ let SubagentRuntime = (() => {
             return this.requireContinuations().startContinuable(spec);
         }
         /**
-         * Deliver one later message to a continuable child as its next FIFO turn. A
-         * resident child's Agent inbox accepts it directly (waking a `waiting`
-         * Activation), while an absent one is cold-resumed from its persisted
-         * Session. The Agent inbox is the only queue, so every accepted message has
-         * one observable order.
-         * @param parent - the exact live direct parent authorizing this delivery.
-         * @param childId - durable child session id.
-         * @param content - user-role content to deliver.
-         * @param options - the message source fields and caller cancellation, which stops the
-         *   operation only before inbox acceptance.
+         * Steer one model-authored message to the sender's direct parent or direct
+         * continuable child. A running target admits it at the nearest step boundary;
+         * an idle target starts a turn, and an absent direct child cold-resumes from
+         * persistence. The service derives durable sender attribution from the exact
+         * live sender. Caller cancellation stops only pre-acceptance work.
+         * @param sender - exact live Agent authorizing and originating the message.
+         * @param targetId - durable direct-parent or direct-child session id.
+         * @param content - model-authored content to deliver.
+         * @param options - caller cancellation before inbox acceptance.
          * @returns the accepted message's inbox id.
-         * @throws when continuation services are unavailable, parent authority is
-         *   rejected, or the message was not admitted.
+         * @throws when continuation services are unavailable, adjacency is rejected,
+         *   or the message was not admitted.
          */
-        async followup(parent, childId, content, options) {
-            return this.requireContinuations().followup(parent, childId, content, options);
+        async sendMessage(sender, targetId, content, options) {
+            return this.requireContinuations().sendMessage(sender, targetId, content, options);
+        }
+        /**
+         * Queue one host-protocol message as a distinct direct-child turn.
+         * Symbol-keyed so host adapters can preserve their own provenance without
+         * widening the public Service Definition or impersonating an Agent sender.
+         * @param parent - exact live direct parent authorizing delivery.
+         * @param childId - durable direct-child session id.
+         * @param content - host-authored content to deliver.
+         * @param source - durable host-protocol provenance.
+         * @param signal - caller cancellation before inbox acceptance.
+         * @returns the accepted message's inbox id.
+         */
+        [queueSubagentPrompt](parent, childId, content, source, signal) {
+            return this.requireContinuations().queuePrompt(parent, childId, content, source, signal);
         }
         /**
          * Interrupt one live continuable child's current turn under a human parent
@@ -180,32 +192,6 @@ let SubagentRuntime = (() => {
         interrupt(targetSessionId, authority) {
             this.continuations?.interrupt(targetSessionId, authority);
         }
-        /**
-         * Deliver selected content from one live continuable child to its durable
-         * direct parent. The child is the authority credential; callers cannot name a
-         * recipient. Reporting does not conclude the child's turn or Activation.
-         * @param child - exact live reporting child.
-         * @param content - selected model-facing content.
-         * @param options - parent scheduling and pre-acceptance cancellation.
-         * @returns the stable identity of the parent-accepted message.
-         * @throws when continuation services are unavailable, sender authorization
-         *   fails, or the direct parent is not live.
-         */
-        async reportFrom(child, content, options) {
-            return this.requireContinuations().reportFrom(child, content, options);
-        }
-        /**
-         * Compose one deployment capability into every continuable child's
-         * unpublished creation context on fresh creation and cold resume. Grants wait
-         * for the next Activation; removing the contribution revokes every resident
-         * installation immediately.
-         * @param contribution - synchronous child-scope installer.
-         * @returns the exact Cordis effect disposer.
-         */
-        registerContinuableSetup(contribution) {
-            // oxlint-disable-next-line typescript/no-misused-promises -- synchronous disposer
-            return this.ctx.effect(() => this.setupRegistry.register(contribution), 'subagents.registerContinuableSetup()');
-        }
         /**
          * Close continuable admission below exact live parent Agents, stop only their
          * visible descendant Activations synchronously, then await admitted scoped
@@ -305,10 +291,12 @@ let SubagentRuntime = (() => {
          * validated browser zone on the accepted message. Success identifies the
          * message the child's FIFO inbox accepted; later execution is independent of
          * this call.
+         * Image parts are admitted and persisted through the attachment store
+         * before delivery, and the child's model must accept image input.
          * @param request - durable address, minted identity, content, and optional browser zone.
          * @param signal - carrier cancellation, owning the call until inbox acceptance.
          * @returns the accepted message's inbox identity.
-         * @throws {RemoteError} `gateway/bad-request`, `subagent/attachment-unsupported`,
+         * @throws {RemoteError} `gateway/bad-request`, `subagent/attachment-invalid`,
          *   `subagent/invalid-time-zone`, `subagent/parent-unavailable`,
          *   `subagent/not-resumable`, `subagent/unauthorized`,
          *   `subagent/delivery-unavailable`, `gateway/cancelled`, or `gateway/internal`.
@@ -316,7 +304,6 @@ let SubagentRuntime = (() => {
         async prompt(request, signal) {
             const { parentSessionId, childSessionId, clientTimeZone } = request;
             validateControlRequest('subagent.prompt', request);
-            const content = admitPromptContent(childSessionId, request.content);
             const canonicalTimeZone = clientTimeZone === undefined
                 ? undefined
                 : canonicalClientTimeZone(clientTimeZone);
@@ -333,7 +320,21 @@ let SubagentRuntime = (() => {
                 ...(canonicalTimeZone === undefined ? {} : { clientTimeZone: canonicalTimeZone }),
             };
             try {
-                return { messageId: await this.followup(parent, childSessionId, content, { source, signal }) };
+                // Admission precedes delivery: image parts become durable references
+                // here, so the child inbox only ever accepts Host-persisted attachments.
+                let content;
+                if (request.content.every((part) => part.type === 'text')) {
+                    content = request.content.map(part => ({ type: 'text', text: part.text }));
+                }
+                else {
+                    const attachments = this.ctx.get('attachments');
+                    if (attachments === undefined)
+                        throw new Error('subagent image prompt requires an attachment store');
+                    content = await admitPromptContent(attachments, request.content);
+                }
+                return {
+                    messageId: await this[queueSubagentPrompt](parent, childSessionId, content, source, signal),
+                };
             }
             catch (error) {
                 return rejectPrompt(error, childSessionId, signal);

package/lib/types/internal.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Continuation integration markers and host adapters outside the public
+ * Service Definition and model-facing Agent messaging contract.
+ * @module @deepseek-ai/dsh-subagent/internal
+ */
+import type { Agent } from '@deepseek-ai/dsh-agent';
+import type { ContentBlock, MessageId, MessageSource } from '@deepseek-ai/dsh-llm';
+import type { SessionId } from '@deepseek-ai/dsh-session';
+import type { ToolDefinition } from '@deepseek-ai/dsh-tools';
+import type SubagentRuntime from './index.ts';
+/** Process-stable identity carried only by the standard adjacent-Agent messaging tool. */
+export declare const adjacentAgentSendMessageTool: unique symbol;
+/**
+ * Mark the standard adjacent-Agent messaging tool without changing its model-visible schema.
+ * @param definition - the standard `send_message` definition.
+ * @returns the same definition with its internal identity installed.
+ */
+export declare function markAdjacentAgentSendMessageTool(definition: ToolDefinition): ToolDefinition;
+/**
+ * Test whether one visible definition is the standard adjacent-Agent messaging tool.
+ * @param definition - the scope-resolved `send_message` candidate.
+ * @returns whether the definition carries the internal standard-tool identity.
+ */
+export declare function isAdjacentAgentSendMessageTool(definition: ToolDefinition | undefined): boolean;
+/**
+ * Process-stable symbol-keyed Queue delivery shared by the bundled runtime
+ * entry and this unbundled internal subpath.
+ * @internal
+ */
+export declare const queueSubagentPrompt: unique symbol;
+/** Runtime face required by the host-only Queue adapter. */
+export interface HostPromptQueue {
+    [queueSubagentPrompt](parent: Agent, childId: SessionId, content: ContentBlock[], source: MessageSource, signal: AbortSignal): Promise<MessageId>;
+}
+/**
+ * Queue one host-protocol message without exposing another Service operation.
+ * @param runtime - subagent runtime owning continuation residency.
+ * @param parent - exact live direct parent authorizing delivery.
+ * @param childId - durable direct-child session id.
+ * @param content - host-authored content to deliver.
+ * @param source - durable host-protocol provenance.
+ * @param signal - caller cancellation before inbox acceptance.
+ * @returns the accepted message's inbox id.
+ */
+export declare function queueHostSubagentPrompt(runtime: SubagentRuntime, parent: Agent, childId: SessionId, content: ContentBlock[], source: MessageSource, signal: AbortSignal): Promise<MessageId>;
+//# sourceMappingURL=internal.d.ts.map

package/lib/types/internal.js

@@ -0,0 +1,45 @@
+/**
+ * Continuation integration markers and host adapters outside the public
+ * Service Definition and model-facing Agent messaging contract.
+ * @module @deepseek-ai/dsh-subagent/internal
+ */
+/** Process-stable identity carried only by the standard adjacent-Agent messaging tool. */
+export const adjacentAgentSendMessageTool = Symbol.for('dsh.subagent.adjacentAgentSendMessageTool');
+/**
+ * Mark the standard adjacent-Agent messaging tool without changing its model-visible schema.
+ * @param definition - the standard `send_message` definition.
+ * @returns the same definition with its internal identity installed.
+ */
+export function markAdjacentAgentSendMessageTool(definition) {
+    Object.defineProperty(definition, adjacentAgentSendMessageTool, { value: true });
+    return definition;
+}
+/**
+ * Test whether one visible definition is the standard adjacent-Agent messaging tool.
+ * @param definition - the scope-resolved `send_message` candidate.
+ * @returns whether the definition carries the internal standard-tool identity.
+ */
+export function isAdjacentAgentSendMessageTool(definition) {
+    return definition !== undefined
+        && definition[adjacentAgentSendMessageTool] === true;
+}
+/**
+ * Process-stable symbol-keyed Queue delivery shared by the bundled runtime
+ * entry and this unbundled internal subpath.
+ * @internal
+ */
+export const queueSubagentPrompt = Symbol.for('dsh.subagent.queuePrompt');
+/**
+ * Queue one host-protocol message without exposing another Service operation.
+ * @param runtime - subagent runtime owning continuation residency.
+ * @param parent - exact live direct parent authorizing delivery.
+ * @param childId - durable direct-child session id.
+ * @param content - host-authored content to deliver.
+ * @param source - durable host-protocol provenance.
+ * @param signal - caller cancellation before inbox acceptance.
+ * @returns the accepted message's inbox id.
+ */
+export function queueHostSubagentPrompt(runtime, parent, childId, content, source, signal) {
+    return runtime[queueSubagentPrompt](parent, childId, content, source, signal);
+}
+//# sourceMappingURL=internal.js.map

package/lib/types/lifecycle.js

@@ -15,6 +15,7 @@
  */
 import { randomUUID } from 'node:crypto';
 import { foldConsumedWork } from '@deepseek-ai/dsh-agent';
+import { SessionLogOffset } from '@deepseek-ai/dsh-session';
 import { finalAssistantOutput } from "./assistant-output.js";
 import { SubagentRunId } from "./types.js";
 /**
@@ -90,7 +91,7 @@ export function createActivationObserver(emit, provider, childId, parent) {
     // A cold resume replays earlier turns, so this epoch's telemetry must come
     // from the suffix it actually produced — never the whole session, which
     // would report a previous epoch's answer when this one opened no turn.
-    let boundary = 0;
+    let boundary = SessionLogOffset(0);
     // Assigned by `capture()`, which the disposal path always runs before
     // `settle()`; a resident epoch therefore always has its facts by then.
     let captured = { stopReason: 'completed' };
@@ -101,11 +102,11 @@ export function createActivationObserver(emit, provider, childId, parent) {
         : { stopReason: 'error' };
     return {
         start: (child) => {
-            boundary = child.session.events.length;
+            boundary = child.session.seq;
             emit('subagent/start', identity, parent);
         },
         capture: (child) => {
-            const own = child.session.events.slice(boundary);
+            const own = child.session.snapshotEvents(boundary);
             const output = finalAssistantOutput(own);
             captured = {
                 stopReason: epochStopReason(own),

package/lib/types/list-children.d.ts

@@ -4,9 +4,10 @@
  * corpus; each child's mode/label is the registered `subagent` projection
  * unit's value, resolved
  * down a three-rung ladder: the registry's watermark cache for a live child,
- * a durable projection-cache row when it serves an own-suffix identity (the
- * seq gate), and one shared Session observation otherwise, validated against
- * the enumerated lifecycle. The projection fold is the single classification
+ * an unseeded durable projection-cache row, and one shared Session observation
+ * otherwise. A seeded header deliberately lacks its exact inherited cut, so
+ * it takes the body-bearing observation path before classifying an identity.
+ * The projection fold is the single classification
  * authority — this module parses no descriptor
  * itself. Absent persistence, enumeration is live-only: a cold child is
  * unreachable for resume anyway, so its absence is capability absence, not an
@@ -35,8 +36,8 @@ export type SubagentDescendantListEntry = SubagentListEntry & {
  * live-preferred merge of `ctx.sessions` and optional session persistence,
  * serving each identity from the `subagent` projection unit: the registry's
  * watermark snapshot for a live child; for a cold one, a durable
- * projection-cache read when it serves an own-suffix identity (the seq gate),
- * else one bounded-concurrency shared Session observation.
+ * projection-cache read for an unseeded lifecycle, else one bounded-concurrency
+ * shared Session observation carrying the exact inherited cut.
  * @see SubagentRuntime.listChildren for the public cancellation and failure contract.
  * @param ctx - context carrying the session store, the projection registry,
  *   optional persistence, and the optional projection cache.