@dsh-cc/subagent-task 0.5.0

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.i18n.yaml

@@ -0,0 +1,6 @@
+# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
+# side as of the last confirmed-consistent state. Both languages carry equal authority;
+# after editing either side, bring the other along and re-record with:
+#   pnpm run verify-translation-pairing --write packages/subagent/task/README.md
+README.md: 2f41225a5a429d06b1c499a0f764797183ce6ab4
+README.zh.md: 5388f67d88f9e8bec717ab5cb353e35e962de8b1

package/README.md

@@ -0,0 +1,214 @@
+# @dsh-cc/subagent-task
+
+English | [中文](README.zh.md)
+
+The Claude Code-compatible **Task tool** and **per-workspace subagent catalog** for the
+DeepSeek Harness. It mounts:
+
+- the `subagent_fork` tool (CC display name `Task`) with `subagent_type` dispatch over the
+  session workspace's `.claude/agents` definitions;
+- the `Available subagents` system-prompt section, rendered per workspace;
+- the reserved tool names (`subagent`, `workflow`) that keep disabled harness rows
+  restrictable;
+- a pre-step strip listener that removes the harness `agent-instructions` workspace
+  baseline (CLAUDE.md / AGENTS.md) from delegated Task children.
+
+The `ccModelRoutes` service (from `@dsh-cc/model-aliases`) supplies the spawn-time
+alias resolver; when it is absent, every child inherits its parent's route (the builtin
+fallback).
+
+## What it is
+
+Claude Code's `Task` tool lets the main agent delegate to a named subagent
+(`subagent_type`, e.g. `deep-reasoner`) defined in `.claude/agents`, and the runner loads
+that agent's own system prompt, model, and tool restriction. Historically the DeepSeek
+Harness only had a generic fork (`description`/`prompt`), so `subagent_type` dispatch was a
+dead letter: the child only ever got the *hand-written role copy* the main model put in the
+prompt, and the agent's `model: opus` alias never reached the backend route.
+
+This package restores the real link. It discovers the CC `.claude/agents` definitions that
+are visible from the **session's** working directory (not the host process cwd — a web host
+serves many workspaces, so `~/.dsh/…` startup must still see `my-repo/.claude/agents`), and
+turns the internal `subagent_fork` tool into a genuine subagent-type dispatcher.
+
+## How dispatch works
+
+Given a `Task(subagent_type, description, prompt)` call from a CC preset session:
+
+1. **`subagent_type` omitted, blank, or `general-purpose`** → a **fresh spawn** of the
+   caller: the prompt text becomes the child's first user message, no definition
+   participates, no parent conversation is copied. Write a self-contained prompt.
+2. **`subagent_type` equal to the reserved sentinel `fork`** → a conversation-inheriting
+   **fork** of the caller (Claude Code's `subagent_type: "fork"`): completed parent turns
+   seed the child; no definition participates. The sentinel is reserved and wins over a
+   workspace file of the same name — `.claude/agents/fork.md` is unreachable.
+3. **A type that matches a definition** under the session cwd (`cwdOf` the assembling agent)
+   → a `spawn` with:
+   - `persona` = the definition's `systemPrompt` (delivered as the child's system segment);
+   - the task text as the child's **first user message**;
+   - `agentOptions` = the alias-resolved `{ provider?, model? }` from
+     `ctx.get('ccModelRoutes').resolve(def.model)` (only provider/model fields that resolve
+     to a value are forwarded, so per-field inheritance never breaks);
+   - `toolFilter` = the definition's `toolRestriction` (allow/deny), **sanitized** of tool
+     names this composition no longer registers;
+   - `maxDepth` = 3 (matches the harness default; configurable).
+4. **Any other type** (not found in the workspace) → an **error result** listing the
+   available types in this workspace (or noting the workspace defines none).
+
+The dispatch is **foreground unless the child is explicitly or definition-pinned background**:
+with `run_in_background` omitted, the run is foreground — the tool awaits the child to
+completion, surfaces a non-`completed` stop reason as an error, and concatenates only the
+`text` blocks of the child output — unless the definition pins `background: true`, in which
+case the run backgrounds on omit. Explicit `run_in_background: false` wins over the pin and
+forces foreground. An explicit `run_in_background: true` (or a pin on omit) starts the child
+as a durable continuable background agent and returns promptly with its `agentId`.
+
+### Tool-restriction sanitization and reserved names
+
+When a definition's frontmatter narrows tools (e.g. `tools: Read, Task`), the allow/deny
+lists are forced through the CC→harness translation and then checked against the **live**
+set of names the tools registry knows (`ctx.tools.view(callingAgent).restrictableNames` —
+registered and reserved names, read at execute time against the calling agent's scope so
+standing-scope MCP reservations are visible). A name the registry does not know is dropped
+with a warning; there is no static legal-names set, so mounted MCP tools and any future
+registered row are accepted without code churn:
+
+- **MCP public names.** An exact `mcp__<server>__<tool>` entry is kept as written — it must
+  be the tool's public name, including the deterministic 12-hex identity-hash suffix when
+  normalization truncated or replaced the name.
+- **Server-level MCP wildcards.** `mcp__<server>` and `mcp__<server>__*` both expand to
+  every mounted tool of that server (`mcp__<server>__` prefix), so frontmatter survives
+  servers publishing new tools without naming hashed entries.
+- **A bare `mcp__`** (no server segment) is dropped with an invalid-wildcard warning.
+- **Auto-`ToolSearch`.** If the filter carried an `allow` list, any kept allow name is an
+  MCP tool, and the `ToolSearch` tool is itself mounted (restrictable), `ToolSearch` is
+  appended (deduped) — otherwise the child would hold MCP names with no load path. When
+  `ToolSearch` is not mounted it is never injected.
+- **Spawn-time preload of explicit deferred MCP names.** An explicit `tools:` entry that is
+  still deferred (not yet registered) is activated through the duck-typed `ctx.toolSearch`
+  seam at spawn, BEFORE the child starts, on BOTH dispatch paths (foreground collect and
+  background) — activation is process-global, so every admitting agent's schema grows after
+  the spawn. Server-level wildcard entries (`mcp__<server>`, `mcp__<server>__*`) are
+  restrict-only: their expansions are never preloaded. Names the sanitized deny list
+  excludes, or that sanitize dropped as unknown, are never activated; already-registered
+  (eager) names are skipped silently. Outcomes surface in the Task result text
+  (`Preloaded deferred tools for child: …`, plus `Not preloaded: <name> (<reason>)` for
+  denied/unknown activations); with no `toolSearch` service mounted the step degrades to a
+  single warning and the spawn proceeds normally.
+- **Unmounted names are dropped** with the standard `dropping unknown tool name …`
+  warning — including MCP names of servers that are not mounted.
+- **An allow-list that matches nothing is deny-all, loudly.** If the filter carried an
+  `allow` list and sanitization left zero names, the emitted filter is `{ allow: [] }`
+  (the child runs with zero tools) with a warning naming the dropped originals — omitting
+  `allow` would instead widen the child to every tool. An emptied `deny` list is simply
+  omitted.
+
+The internal tool name `subagent_fork` is registered by this package, and
+`ctx.tools.reserve('subagent')` / `reserve('workflow')` keep those names in the restrictable
+universe without exposing visible definitions (the CC frontmatter `Task` translation is
+`['subagent', 'subagent_fork']`, so `subagent` must remain legal even though the harness
+spawn row is disabled; `workflow` is reserved for the deferred workflow row). Because
+sanitization checks the live registry rather than a static list, these reserved names and
+every static CC name (`read`, `bash`, …) survive only when they are actually
+reserved/registered — which they are in the cc preset. A definition that omits both
+`tools` and `disallowedTools` passes no `toolFilter`, so the child inherits the full
+parent tool view (including MCP schemas).
+
+## Available subagents system-prompt section
+
+A single global section (`cc:subagent-catalog`, order 110) serves every agent. Its text
+callback receives the assembling agent through the assemble scope, derives that agent's cwd,
+and renders:
+
+```
+## Available subagents
+
+- deep-reasoner — reason through hard architecture and design problems
+- fast-worker — execute a pre-approved mechanical plan
+
+To delegate to one, pass its name as the `subagent_type` argument of the Task tool.
+```
+
+Because the section text is composed synchronously but discovery is async, the first
+assembly for an unknown workspace shows nothing, then `system-prompt/change` fires once
+discovery lands and reassembly reveals the catalog. When a workspace defines no agents (or
+there is no agent to scope to) the section renders an empty string and drops out of the
+prompt. The catalog lists only file definitions — it deliberately does **not** enumerate seam
+backend provider names (`fork`/`spawn`/`codex`/`claude-code`) as if they were addressable
+agent types.
+
+## Workspace instructions on Task children
+
+The harness `agent-instructions` plugin injects the workspace CLAUDE.md / AGENTS.md
+baseline as an `agent-instructions`-sourced user message on every session — including
+Task children. This package mounts an `agent/pre-step` listener that strips that baseline
+from delegated children (`delegationDepth > 0`):
+
+- A delegated child receives only the enter batch and pending inbox messages that are not
+  `agent-instructions`-sourced; its persona remains the agent-file `systemPrompt` (or the
+  deployment persona for `general-purpose`).
+- Fork children still inherit any CLAUDE.md already in the parent seed — the listener only
+  skips a *fresh* child scan; parent history is never rewritten.
+- This is an intentional deviation from Claude Code, whose custom subagents **do** load
+  CLAUDE.md (Explore/Plan in CC skip it). dsh-cc applies the skip to every Task child
+  because the dsh-cc repo CLAUDE.md is orchestrator policy, not a worker contract.
+- Residual: the harness still reads the instruction files from disk on the child's behalf;
+  they just never enter the child's model-visible batch.
+
+## Mounting
+
+Mounted by the `cc` preset's `tool-task` row (`@dsh-cc/subagent-task`) inside the
+`cc-services` group, alongside `cc-model-routes` (`@dsh-cc/model-aliases`) which
+supplies the alias resolver. The cc preset **disables** the harness `tool-subagent` and
+`tool-subagent-fork` rows in favour of this tool so there is no double registration of the
+`subagent_fork` name.
+
+## Known limits
+
+- **Cold resume drops extra `agentOptions`.** Background (continuable) dispatch exists —
+  `run_in_background: true` or a `background: true` definition pin — but cold resume restores
+  `persona`/`toolFilter`/model route only and drops every other `agentOptions` field
+  (alias-stamped `reasoningEffort`, `maxTokens`). See the parity matrix for the full
+  background contract (drain on parent exit, no `outputFile`, fork + background rejected).
+- **Process-level discovery cache.** The registry caches per workspace root for the process
+  lifetime and does not watch the filesystem. Editing a `.claude/agents` definition takes
+  effect on the next session for a workspace whose cache entry has not yet been created, and
+  on process restart otherwise. mtime-based invalidation is a follow-up.
+- **No plugin-agent dispatch (v1).** Only file definitions under `.claude/agents` are
+  dispatched. Seam plugin agents (`AgentProvider`) are not addressed by `subagent_type` in v1
+  (their start contract does not carry the task text and their capability flags would reject
+  `maxDepth`) — see the parity matrix.
+- **Reserved type names.** `general-purpose` and `fork` are sentinels, not file types. A
+  workspace file `.claude/agents/fork.md` is unreachable; `subagent_type: "fork"` always
+  means inherit completed parent turns.
+- **Instruction files are still scanned.** The strip happens after the harness
+  `agent-instructions` plugin has read the workspace CLAUDE.md / AGENTS.md from disk and
+  injected them; this listener only keeps them out of the child's model-visible batch, so
+  the disk scan itself cannot be prevented without changing the harness. A fork child's
+  parent seed is never rewritten, so CLAUDE.md already in the seed is inherited.
+
+## API
+
+- `apply(ctx)` — cordis plugin entry (plugin id `cc-subagent-task`); safe when either the
+  tools or the system-prompt seam is absent.
+- `AgentRegistry` (`./registry`) — per-workspace definition cache (`ensure` / `list` /
+  `resolve`), lazily loading `loadClaudeCodeAgents(root)` (user layer + project layer,
+  project shadows user).
+- `registerTaskTool` / `TASK_TOOL` (`./tool`) — register the `subagent_fork` Task tool.
+- `mountAgentCatalog` / `CATALOG_SECTION_NAME` / `CATALOG_SECTION_ORDER` (`./catalog`) —
+  mount the `Available subagents` section.
+- `mountStripWorkspaceInstructions` / `isDelegated` / `isAgentInstructions`
+  (`./strip-instructions`) — mount (or classify for) the pre-step strip of the harness
+  `agent-instructions` workspace baseline on delegated Task children.
+
+## Non-goals
+
+- Treating omitted `run_in_background` as background as a session policy (the Claude Code
+  interactive omit=background rule); dsh-cc stays foreground on omit unless the definition
+  pins `background: true`.
+- In-flight promotion of a running foreground Task to background (TUI Ctrl+B) — a follow-up,
+  not a limitation of the package's existence.
+- Seam plugin-agent dispatch.
+- CC frontmatter `permissionMode` / `isolation` / `memory` / `effort` projection onto the
+  child (the loader parses them, v1 does not consume them).
+- `registerBaseAgents` in cc-shell (base-agent discovery moved here; see the cc-shell README).

package/README.zh.md

@@ -0,0 +1,100 @@
+# @dsh-cc/subagent-task
+
+[English](README.md) | 中文
+
+面向 DeepSeek Harness 的 **Claude Code 兼容 Task 工具** 与 **按工作区隔离的 subagent 目录**。它挂载:
+
+- 内部工具名 `subagent_fork`(CC 显示名 `Task`),以 `subagent_type` 对会话工作区的 `.claude/agents` 定义做派发;
+- `Available subagents` 系统提示词 section(**按工作区**渲染);
+- 保留的工具名(`subagent`、`workflow`),使被禁用的 harness 行仍可被 restrict;
+- 一个 pre-step 剥离监听器,把 harness `agent-instructions` 的工作区基线(CLAUDE.md / AGENTS.md)从被委派的 Task child 中移除。
+
+`ccModelRoutes` 服务(来自 `@dsh-cc/model-aliases`)提供派发时的别名解析器;当其缺席时,每个 child 继承父路由(内置 fallback)。
+
+## 是什么
+
+Claude Code 的 `Task` 工具允许主代理按 `subagent_type`(如 `deep-reasoner`)委派给 `.claude/agents` 里定义的具名 subagent,运行时加载该 agent 自己的 system prompt、model 与工具限制。历史上 DeepSeek Harness 只有通用 fork(`description`/`prompt`),因此 `subagent_type` 派发形同虚设:child 只能拿到主模型写在 prompt 里的**手写角色文字**,而该 agent 的 `model: opus` alias 也从未抵达后端路由。
+
+本包恢复真实链路。它发现从**会话**工作目录(而非宿主进程 cwd——web 宿主同时服务多个工作区,从 `~/.dsh/…` 启动也必须看到 `my-repo/.claude/agents`)可见的 CC `.claude/agents` 定义,并把内部 `subagent_fork` 工具变成一个真正的 subagent-type 派发器。
+
+## 派发机制
+
+给定 CC preset 会话中的一次 `Task(subagent_type, description, prompt)` 调用:
+
+1. **`subagent_type` 省略、空白或为 `general-purpose`** → **全新 spawn**:prompt 文本成为 child 的首条 user message,无定义参与,不拷贝父对话。prompt 必须自包含。
+2. **`subagent_type` 等于保留哨兵 `fork`** → 继承对话的 **fork**(Claude Code 的 `subagent_type: "fork"`):父已完成轮次作为 seed,无定义参与。哨兵优先于同名文件,`.claude/agents/fork.md` 不可达。
+3. **命中会话 cwd(`cwdOf` 组装 agent)下的定义** → 以 `spawn` 启动并携带:
+   - `persona` = 定义的 `systemPrompt`(作为 child 的系统段下发);
+   - 任务文本作为 child 的**首条 user message**;
+   - `agentOptions` = 来自 `ctx.get('ccModelRoutes').resolve(def.model)` 的别名解析结果 `{ provider?, model? }`(只透传解析到值的 provider/model 字段,绝不破坏按字段继承);
+   - `toolFilter` = 定义的 `toolRestriction`(allow/deny),**消毒**掉本组合已不再注册的工具名;
+   - `maxDepth` = 3(与 harness 默认一致;可配置)。
+4. **其它类型**(工作区内找不到)→ **报错结果**,附带本工作区可用类型清单(或说明本工作区未定义任何 agent)。
+
+派发规则是**前台,除非显式指定或定义钉死了后台**:`run_in_background` 缺省时运行是前台——工具等待 child 跑完,非 `completed` 的 stop reason 以错误浮出,child 输出只拼接 `text` 块——除非定义钉了 `background: true`,此时缺省即后台。显式 `run_in_background: false` 覆盖钉死,强制前台。显式 `run_in_background: true`(或钉死时缺省)则把 child 作为 durable continuable 后台 agent 启动,并立即返回其 `agentId`。
+
+### 工具限制消毒与保留名
+
+当定义 frontmatter 收窄工具(如 `tools: Read, Task`)时,allow/deny 清单会强制经过 CC→harness 翻译,再对照工具注册表**实时**已知的名集合(`ctx.tools.view(callingAgent).restrictableNames`——已注册与已保留名的并集,在 execute 时按调用 agent 的 scope 读取,因此 standing-scope 上的 MCP 保留名可见)做校验。注册表不认识的名会被丢弃并告警;这里没有静态合法名集合,因此已挂载的 MCP 工具和未来新增的注册行都无需改代码即可通过:
+
+- **MCP 公开名。** 精确的 `mcp__<server>__<tool>` 原样保留——必须用该工具的公开名,包括名字被规范化截断/替换时追加的 12 位十六进制确定性 hash 后缀。
+- **server 级 MCP 通配。** `mcp__<server>` 与 `mcp__<server>__*` 都会展开为该 server 已挂载的全部工具(`mcp__<server>__` 前缀),frontmatter 因此不必逐个点名带 hash 的条目也能在 server 发布新工具后继续生效。
+- **裸 `mcp__`**(无 server 段)被丢弃并给出 invalid-wildcard 告警。
+- **自动带上 `ToolSearch`。** 若过滤器带有 `allow` 清单、保留下来的 allow 名中有 MCP 工具、且 `ToolSearch` 工具本身已挂载(可限制),则追加 `ToolSearch`(去重)——否则 child 手握 MCP 名却没有任何加载路径。`ToolSearch` 未挂载时绝不注入。
+- **spawn 时预激活显式列出的延后 MCP 名。** `tools:` 中显式点名、且仍处于延后(未注册)状态的 MCP 名,会在 spawn 时、child 启动之前,经 duck-typed `ctx.toolSearch` seam 激活——前台 collect 与后台两条派发路径都会执行,激活是进程全局的(spawn 之后每个可接纳该工具的 agent 的 schema 都会变大)。server 级通配(`mcp__<server>`、`mcp__<server>__*`)仅用于限制、绝不预激活;被消毒 deny 清单排除或被消毒丢弃的名永不激活,已注册(急加载)的名静默跳过。结果浮现在 Task 结果文本中(`Preloaded deferred tools for child: …`,以及 `Not preloaded: <名>(<原因>)`);未挂载 `toolSearch` 服务时只告警一次、照常 spawn。
+- **未挂载的名被丢弃**,给出标准 `dropping unknown tool name …` 告警——包括未挂载 server 的 MCP 名。
+- **匹配不到任何工具的 allow 清单 = 醒目的 deny-all。** 若过滤器带有 `allow` 清单而消毒后一个名都不剩,产出的过滤器是 `{ allow: [] }`(child 以零工具运行)并告警列出被丢弃的原始名——省略 `allow` 反而会把 child 放宽到全部工具。被清空的 `deny` 清单则直接省略。
+
+本包注册内部工具名 `subagent_fork`,并经 `ctx.tools.reserve('subagent')` / `reserve('workflow')` 把这些名放进可限制 universe 而不暴露可见定义(CC frontmatter `Task` 的翻译是 `['subagent', 'subagent_fork']`,故即使 harness spawn 行被禁,`subagent` 也必须保持合法;`workflow` 为延后的 workflow 行保留)。由于消毒对照的是实时注册表而非静态清单,这些保留名和每个静态 CC 名(`read`、`bash` 等)只有在真正被保留/注册时才会存活——在 cc preset 中它们正是如此。定义同时省略 `tools` 与 `disallowedTools` 时不传 `toolFilter`,child 继承父的完整工具面(含 MCP schema)。
+
+## Available subagents 系统提示词 section
+
+一个全局 section(`cc:subagent-catalog`,order 110)服务所有 agent。其 text 回调通过 assemble scope 拿到组装 agent,推导其 cwd,并渲染:
+
+```
+## Available subagents
+
+- deep-reasoner — reason through hard architecture and design problems
+- fast-worker — execute a pre-approved mechanical plan
+
+To delegate to one, pass its name as the `subagent_type` argument of the Task tool.
+```
+
+由于 section 文本是同步组装的而发现是异步的,未知工作区的首次组装会显示空,随后 discovery 落地后触发 `system-prompt/change`,重组即显示目录。当工作区未定义任何 agent(或没有可 scope 的 agent)时,section 渲染空串并从提示词中消失。目录只列**文件定义**——刻意**不**把 seam 后端 provider 名(`fork`/`spawn`/`codex`/`claude-code`)当作可寻址的 agent 类型来枚举。
+
+## Task child 上的工作区指令
+
+harness 的 `agent-instructions` 插件会在**每个**会话(包括 Task child)注入工作区 CLAUDE.md / AGENTS.md 基线,作为一条 `agent-instructions` 来源的 user message。本包挂载一个 `agent/pre-step` 监听器,为被委派的 child(`delegationDepth > 0`)剥离该基线:
+
+- 被委派的 child 收到的 enter 批次与待处理 inbox 消息中不再包含 `agent-instructions` 来源的消息;其 persona 仍是 agent 文件的 `systemPrompt`(`general-purpose` 则是部署 persona)。
+- fork child 仍继承父 seed 中已有的 CLAUDE.md——监听器只跳过*全新* child 的扫描,从不改写父历史。
+- 这是对 Claude Code 的**有意偏离**:CC 的自定义 subagent **会**加载 CLAUDE.md(CC 的 Explore/Plan 则跳过)。dsh-cc 对所有 Task child 施加跳过,因为 dsh-cc 仓库的 CLAUDE.md 是编排者策略,而非 worker 契约。
+- 残余: harness 仍会代 child 从磁盘读取指令文件,只是它们不再进入 child 的模型可见批次。
+
+## 挂载
+
+由 `cc` preset 的 `tool-task` 行(`@dsh-cc/subagent-task`)挂载在 `cc-services` 组内,旁边是提供别名解析器的 `cc-model-routes`(`@dsh-cc/model-aliases`)。cc preset **禁用** harness 的 `tool-subagent` 与 `tool-subagent-fork` 两行以改用本工具,避免 `subagent_fork` 名被重复注册。
+
+## 已知限制
+
+- **冷恢复丢弃其余 `agentOptions`。** 后台(continuable)派发已存在——`run_in_background: true` 或定义钉 `background: true`——但冷恢复只还原 `persona`/`toolFilter`/模型路由,丢弃其余全部 `agentOptions` 字段(别名标记的 `reasoningEffort`、`maxTokens`)。完整后台契约(父退出 drain、无 `outputFile`、fork + 后台被拒)见 parity matrix。
+- **进程级发现缓存。** 注册表按工作区 root 缓存整个进程生命周期,不监听文件系统。编辑 `.claude/agents` 定义:对缓存条目尚未创建的工作区在下次会话生效,否则在进程重启后生效。基于 mtime 的失效刷为 follow-up。
+- **v1 不做插件 agent 派发。** 只派发 `.claude/agents` 下的文件定义。seam 插件 agent(`AgentProvider`)在 v1 不被 `subagent_type` 寻址(其 start 契约不携带任务正文,且 capability 标志会拒绝 `maxDepth`)——见 parity matrix。
+- **保留类型名。** `general-purpose` 与 `fork` 是哨兵,不是文件类型。工作区文件 `.claude/agents/fork.md` 不可达;`subagent_type: "fork"` 永远表示继承父已完成轮次。
+- **指令文件仍会被扫描。** 剥离发生在 harness `agent-instructions` 插件已从磁盘读取工作区 CLAUDE.md / AGENTS.md 并注入之后;本监听器只把它们挡在 child 的模型可见批次之外,不改 harness 就无法阻止磁盘扫描。fork child 的父 seed 从不改写,seed 中已有的 CLAUDE.md 会被继承。
+
+## API
+
+- `apply(ctx)` — cordis 插件入口(插件 id `cc-subagent-task`);tools 或 system-prompt seam 任一缺席时也安全。
+- `AgentRegistry`(`./registry`)— 按工作区的定义缓存(`ensure` / `list` / `resolve`),惰性加载 `loadClaudeCodeAgents(root)`(用户层 + 项目层,项目遮蔽用户)。
+- `registerTaskTool` / `TASK_TOOL`(`./tool`)— 注册 `subagent_fork` Task 工具。
+- `mountAgentCatalog` / `CATALOG_SECTION_NAME` / `CATALOG_SECTION_ORDER`(`./catalog`)— 挂载 `Available subagents` section。
+- `mountStripWorkspaceInstructions` / `isDelegated` / `isAgentInstructions`(`./strip-instructions`)— 挂载(或为测试分类)pre-step 剥离监听器,把 harness `agent-instructions` 工作区基线从被委派的 Task child 中移除。
+
+## 非目标
+
+- 把缺省的 `run_in_background` 视为后台的会话级策略(Claude Code 交互式的 omit=background 规则);dsh-cc 在缺省时保持前台,除非定义钉了 `background: true`。
+- 正在运行的前台 Task 的在途转后台(TUI Ctrl+B)——follow-up,而非本包存在性上的限制。
+- seam 插件 agent 派发。
+- 把 CC frontmatter 的 `permissionMode` / `isolation` / `memory` / `effort` 投影到 child(loader 会解析,v1 不消费)。
+- cc-shell 里的 `registerBaseAgents`(base agent 发现迁至此处;见 cc-shell README)。