@duckmind/dm-darwin-x64 0.66.5 → 0.66.7

package/extensions/dm-subagents/src/extension/tool-activation.js

@@ -1,116 +1,77 @@
-import * as fs from "node:fs";
-import * as path from "node:path";
 import { Type } from "typebox";
-import { DM_CODING_AGENT_PACKAGE_ROOT_ENV } from "../shared/utils.js";
-import { DM_CODING_AGENT_PACKAGE, resolveInstalledPiPackageRoot, resolveRunningPiPackageRoot } from "../runs/shared/dm-spawn.js";
+import { MODEL_ONLY_TOOL } from "../shared/extension-context.js";
+import { registerPinnedTool } from "./declaration-pinning.js";
 const LOADER_NAME = "subagents_enable";
 const SUBAGENT_NAME = "subagent";
-const MINIMUM_DYNAMIC_TOOLS_VERSION = [0, 86, 1];
-const UNSUPPORTED_HOST_MESSAGE = "Dynamic tool activation requires DM 0.86.1 or newer";
 let warnedUnsupportedHost = false;
-export function unsupportedDynamicToolsReason(dm, deps = {}) {
-  if (typeof dm.getAllTools !== "function" || typeof dm.getActiveTools !== "function" || typeof dm.setActiveTools !== "function")
-    return UNSUPPORTED_HOST_MESSAGE;
-  const probe = probeHostPiVersion(deps);
-  if ("reason" in probe)
-    return probe.reason;
-  return supportsMinimumVersion(probe.version) ? undefined : `${UNSUPPORTED_HOST_MESSAGE} (detected ${probe.version} in ${probe.root})`;
-}
-function probeHostPiVersion(deps) {
-  const runningRoot = resolveRunningPiPackageRoot(deps);
-  if (runningRoot && "reason" in runningRoot)
-    return runningRoot;
-  if (runningRoot)
-    return readHostPiManifest(runningRoot.root, runningRoot.source === "DM_SUBAGENTS_DM_CODING_AGENT_PACKAGE_ROOT", deps.readFileSync, deps.platform, runningRoot.source === "bun-adjacent");
-  const installedRoot = resolveInstalledPiPackageRoot();
-  return { reason: installedRoot ? `Could not verify the running DM installation; ${installedRoot} is not confirmed to be the host that owns this session` : "Could not locate the running DM installation to verify dynamic tool support" };
-}
-function readHostPiManifest(root, fromOverride, readFileSync = (filePath, encoding) => fs.readFileSync(filePath, encoding), platform = process.platform, bundledBinary = false) {
-  const manifestPath = (platform === "win32" ? path.win32 : path.posix).join(root, "package.json");
-  let source;
-  try {
-    source = readFileSync(manifestPath, "utf-8");
-  } catch (error) {
-    return { reason: `Could not read the DM package manifest at ${manifestPath}: ${errorMessage(error)}` };
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(source);
-  } catch (error) {
-    return { reason: `Invalid DM package manifest at ${manifestPath}: ${errorMessage(error)}` };
-  }
-  if (bundledBinary && isRecord(parsed) && typeof parsed.name === "string" && /^@duckmind\/dm-(?:darwin-(?:arm64|x64)|linux-(?:arm64|x64)|windows-x64)$/.test(parsed.name) && path.basename(root) === parsed.name.slice("@duckmind/".length)) {
-    return { reason: `${UNSUPPORTED_HOST_MESSAGE} (bundled npm binary has no SDK manifest)` };
-  }
-  if (!isRecord(parsed) || parsed.name !== DM_CODING_AGENT_PACKAGE) {
-    return { reason: `${manifestPath} is not ${DM_CODING_AGENT_PACKAGE}${fromOverride ? ` (${DM_CODING_AGENT_PACKAGE_ROOT_ENV} override)` : ""}` };
-  }
-  return typeof parsed.version === "string" && parsed.version ? { version: parsed.version, root } : { reason: `The DM package manifest at ${manifestPath} has no version` };
-}
-function errorMessage(error) {
-  return error instanceof Error ? error.message : String(error);
-}
-function isRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-export function supportsMinimumVersion(version) {
-  const parsed = version.split(".").slice(0, 3).map(Number);
-  if (parsed.length !== 3 || parsed.some((part) => !Number.isInteger(part) || part < 0))
-    return false;
-  for (let index = 0;index < 3; index++) {
-    const part = parsed[index];
-    const minimum = MINIMUM_DYNAMIC_TOOLS_VERSION[index];
-    if (part !== minimum)
-      return part > minimum;
-  }
-  return true;
-}
 function hasNativeToolSelection(messages) {
   return messages.some((message) => message.role === "system" && (Object.hasOwn(message, "toolsAdded") || Object.hasOwn(message, "toolsRemoved")));
 }
-function setSelection(dm, includeSubagent) {
-  const active = dm.getActiveTools();
-  const next = includeSubagent ? [...active, SUBAGENT_NAME] : active.filter((name) => name !== SUBAGENT_NAME);
-  if (!next.includes(LOADER_NAME))
+function setSelection(dm, includeSubagent, includeLoader) {
+  const next = dm.getActiveTools().filter((name) => (includeSubagent || name !== SUBAGENT_NAME) && (includeLoader || name !== LOADER_NAME));
+  if (includeSubagent)
+    next.push(SUBAGENT_NAME);
+  if (includeLoader)
     next.push(LOADER_NAME);
   dm.setActiveTools([...new Set(next)]);
 }
-function applyRecordedSelection(dm, ctx) {
+function addsToolsWithoutCheckpoint(model) {
+  const compat = model?.compat;
+  if (!model || compat?.supportsMidConvoSystemMessages !== true)
+    return false;
+  switch (model.api) {
+    case "anthropic-messages":
+      return compat.supportsMidConvoToolChanges === true;
+    case "openai-completions":
+      return compat.supportsMidConvoToolAdditions === true;
+    case "openai-responses":
+    case "openai-codex-responses":
+    case "azure-openai-responses":
+      return compat.supportsAdditionalTools === true || compat.supportsToolSearch === true;
+    default:
+      return false;
+  }
+}
+function applyRecordedSelection(dm, ctx, mode) {
   const available = dm.getAllTools();
   if (!Array.isArray(available) || !Array.isArray(dm.getActiveTools()))
-    return;
+    return true;
   if (!available.some((tool) => tool.name === LOADER_NAME))
-    return;
+    return true;
   const messages = ctx.sessionManager.buildSessionContext().messages;
   if (hasNativeToolSelection(messages)) {
-    let selected = false;
+    const recorded = new Set;
     for (const message of messages) {
       if (message.role !== "system")
         continue;
-      if (message.toolsRemoved?.some((tool) => tool.name === SUBAGENT_NAME))
-        selected = false;
-      if (message.toolsAdded?.some((tool) => tool.name === SUBAGENT_NAME))
-        selected = true;
+      for (const tool of message.toolsRemoved ?? [])
+        recorded.delete(tool.name);
+      for (const tool of message.toolsAdded ?? [])
+        recorded.add(tool.name);
     }
-    setSelection(dm, selected);
-    return;
+    const loaderSelected = mode === "dynamic" || recorded.has(LOADER_NAME);
+    setSelection(dm, recorded.has(SUBAGENT_NAME), loaderSelected);
+    return loaderSelected;
   }
-  setSelection(dm, messages.length > 0 && dm.getActiveTools().includes(SUBAGENT_NAME));
+  const eager = mode === "auto" && messages.length === 0 && !addsToolsWithoutCheckpoint(ctx.model);
+  setSelection(dm, eager || messages.length > 0 && dm.getActiveTools().includes(SUBAGENT_NAME), !eager);
+  return !eager;
 }
 export function registerSubagentToolActivation(dm, options) {
-  const unsupportedReason = unsupportedDynamicToolsReason(dm);
-  if (unsupportedReason) {
-    if (unsupportedReason.startsWith(UNSUPPORTED_HOST_MESSAGE))
-      return;
+  const mode = options.mode ?? "auto";
+  if (mode === "eager")
+    return;
+  if (typeof dm.getAllTools !== "function" || typeof dm.getActiveTools !== "function" || typeof dm.setActiveTools !== "function") {
     if (!warnedUnsupportedHost) {
       warnedUnsupportedHost = true;
-      console.warn(`[dm-subagents] ${unsupportedReason}; keeping subagent eagerly available.`);
+      console.warn("[dm-subagents] Dynamic tool activation requires DM 0.86.1 or newer; keeping subagent eagerly available.");
     }
     return;
   }
-  const parameters = Type.Object({}, { additionalProperties: false });
+  const parameters = Type.Object({});
   const loader = {
     name: LOADER_NAME,
+    ...MODEL_ONLY_TOOL,
     label: "Enable Subagents",
     description: "Enable dm-subagents delegation and management tools without launching work. Call when delegation is authorized by the current request or applicable user/project instructions, or when managing existing runs. Direct execution is the default; complexity alone never authorizes delegation. Full tools are available on the next model request.",
     promptSnippet: "dm-subagents is installed. For authorized specialist, independent-review, or parallel work, call subagents_enable, then subagent. Authorization must come from the current request or applicable instructions; complexity alone is not authorization.",
@@ -123,7 +84,7 @@ export function registerSubagentToolActivation(dm, options) {
           details: { unavailable: [SUBAGENT_NAME] }
         };
       try {
-        setSelection(dm, true);
+        setSelection(dm, true, true);
       } catch (error) {
         return {
           isError: true,
@@ -139,17 +100,24 @@ export function registerSubagentToolActivation(dm, options) {
         };
       const advertised = await options.advertisedPrompt();
       return {
-        content: [{ type: "text", text: `Enabled: subagent. On the next model request, call subagent({action:"list",capabilities:true}) for current capabilities.${advertised ? `
+        content: [{ type: "text", text: `Enabled: subagent. If your tool list includes subagent (possibly prefixed), call it now. Otherwise, wait for the next user prompt; do not retry now. Start DM with --exclude-tools subagents_enable to keep subagent always available.${advertised ? `
 
 ${advertised}` : ""}` }],
         details: { enabled: [SUBAGENT_NAME] }
       };
     }
   };
-  dm.registerTool(loader);
-  dm.on("session_start", (_event, ctx) => applyRecordedSelection(dm, ctx));
-  dm.on("session_tree", (_event, ctx) => applyRecordedSelection(dm, ctx));
+  registerPinnedTool(dm, loader);
+  let loaderSelected = true;
+  dm.on("session_start", (_event, ctx) => {
+    loaderSelected = applyRecordedSelection(dm, ctx, mode);
+  });
+  dm.on("session_tree", (_event, ctx) => {
+    loaderSelected = applyRecordedSelection(dm, ctx, mode);
+  });
   dm.on("before_agent_start", (event) => {
+    if (!loaderSelected)
+      return;
     const available = dm.getAllTools();
     if (!Array.isArray(available) || !available.some((tool) => tool.name === LOADER_NAME))
       return;

package/extensions/dm-subagents/src/extension/tool-description.js

@@ -1,54 +1,67 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { getAgentDir, getProjectConfigDir } from "../shared/utils.js";
+import { resolveDisabledFeatureSurface } from "../shared/disabled-features.js";
 const CUSTOM_TOOL_DESCRIPTION_FILE = "subagent-tool-description.md";
 const CUSTOM_TOOL_DESCRIPTION_MAX_BYTES = 50 * 1024;
-const AGENT_SELECTION_GUIDANCE = 'First call {action:"list",capabilities:true}: executable, non-disabled agents only; external-cli requires runner.available === true. Passive PATH/PATHEXT/X_OK is not authentication/version/launch proof; preflight is authoritative.';
-const SUBAGENT_FAILURE_RECOVERY_GUIDANCE = "Workflow, child launch, prompt runtime, extension load or child tooling failure is a lane infrastructure blocker. Stop; report exact failure, run/status and repo/cwd/worktree/branch/ref; verify clean worktree or capture partial diff before same-protocol retry or asking the owner. Never silently switch to interactive_shell, dm -ne, Codex/Claude/Cursor CLI or foreground/external mode: governed-workflow fallback requires explicit owner approval, not DM core's generic dm -ne hint. Explicit foreground/CLI requests and work outside that protocol remain valid.";
+function featureText(disabled) {
+  return (feature, text, disabledText = "") => disabled.features.has(feature) ? disabledText : text;
+}
 export const SUBAGENT_SAFETY_GUIDANCE = `SAFETY-CRITICAL SUBAGENT GUIDANCE:
-• Direct parent execution is the default. Invoke subagents only when delegation is authorized by the operator's current request or applicable user/project instructions; task size, complexity, risk, tool-call count, or recipe fit do not independently authorize delegation.
-• ${AGENT_SELECTION_GUIDANCE}
-• ${SUBAGENT_FAILURE_RECOVERY_GUIDANCE}
-• Omit action for execution. For an authorized delegated multi-step/parallel workflow: exactly one top-level subagent workflow call with async:true; children launch only inside it.
-• Async follows asyncByDefault (normally true); async:false only to block the parent, not for final reviews/gates. Consume results at dependency barriers. Native async completion wakes this session: return control, no sleep/poll or bg_wait merely for a wake. bg_wait is for provider/detached work without native notification needing a same-turn result.
-• Ordinary child subagents are not orchestrators; only configured fanout within depth/session limits. For an authorized delegated workflow, keep one writer per cwd/worktree and isolate concurrent writers. Use fresh-context read-only reviewers when independent review was requested, then parent synthesis/fixes. Oracle/advisor unknowns use supervisor dialogue; one-shot only when requested.
-• Bind durable output on runs.run/runs.all, not task filename prose; return actual outputReference/outputPathMapping/artifactPaths, evidence and residual risks.
-• children.list is workflow-only, not an exhaustive list of direct native children: resume only resumable rows. When an intended child's exact run id is known, inspect it with {action:"status",id}; if status identifies the candidate, attempt {action:"resume",id,message}. Resume authoritatively checks eligibility, may reject it, and otherwise detaches a follow-up/challenge with the stored agent/model/tool contract. Use a labeled same-role fallback only when no known candidate exists or resume rejects eligibility. Scripts await runs.run(newKey,{resume:runId,task}); continue from latest returned runId. Each distinct resume pass needs a new stable key; same-key reuse requires identical launch parameters.
-• Named resources own authority; raw workflowScript/workflowScriptPath cannot use runs.host. Granted commands/relative outputs use workflow cwd, never per-step cwd.
-• Inspect asyncId/asyncDir (status.json, events.jsonl, logs) with status/debug.run; control with interrupt/stop/resume/steer. Read {action:"guide",topic:"tool-reference"} for controls/evidence gates.`;
-const EXECUTION_GUIDANCE = `Delegate one child with {agent,task?}; otherwise choose exactly one of {workflowScript,args?}, {workflowScriptPath,args?} or {workflow,args}. agent/task exclude workflow inputs; task excludes action. agent may target management actions. action is management/control; validate accepts either script without launching. workflowScriptPath loads from request cwd before sandbox execution.
-Scripts: JavaScript statement bodies with explicit return, top-level await, plain helpers/Promise chains; nested async function/arrow/method helpers are rejected. Await runs.run('key',{agent,task}) before .output; await runs.all([{key,agent,task},...]) for an ordered array, not a key map. Observe every stored run promise with direct await, Promise.race or Promise.all. Await/return runs.steer(key,message,options?) for a prior key, never raw run ids; queued/delivered/missed/failed receipts are not compliance proof.
-Before advanced orchestration (runs.lanes, rolling fanout, mission state, handoffs), read {action:"guide",topic:"workflows"} or the dm-subagents skill. Raw-script sandboxes add deeply frozen args; all sandboxes provide runs, emit, console, JavaScript and enabled mission state, with no filesystem/shell/DM tools/host globals. External CLI agents support native options only when their runner declares them; read guide tool-reference before passing model, structured output, acceptance/agentContract, tool budget, fast, fork context or skills/tools.
-Model override: first call {action:"models"}; copy exact provider/id, not agent names. Thinking uses model suffix, not watchdog-only thinking.
-Named resources: {workflow:'review',args:{task:'...'}} or {workflow:'run-ci',args:{command:'npm test'}}. Raw scripts also accept bounded plain-data args; raw-script args persist as evidence, so never include secrets. worktree:true requires clean source; baseRef defaults to HEAD at allocation or a supported named ref, never full 40/64-character commit IDs or revision expressions.`;
-export const DEFAULT_SUBAGENT_TOOL_DESCRIPTION = `${EXECUTION_GUIDANCE}
+- Delegate only when the operator asked, directly or through applicable user/project instructions; size, complexity or risk alone is not authorization.
+- Native async completion wakes this session: return control; do not sleep, poll or call bg_wait for it.
+- One writer per cwd/worktree; isolate concurrent writers.
+- After a launch or runtime failure, stop and report it; never silently switch to interactive_shell, dm -ne or another CLI.`;
+const scriptCalls = 'One child: {agent,task}. Independent parallel children: {workflow:"parallel",args:{tasks:[{agent,task},...]}}. Dependent multi-step work: exactly one top-level subagent workflow call with async:true; write one ```js workflow block in this reply, then call subagent({workflow:true}); children launch only inside it.';
+const structuredCalls = "One child: {agent,task}. Parallel: tasks:[{agent,task},...]. In order: chain:[{agent,task?,as?} or {parallel:[{agent,task},...]}]; step tasks can use {task}, {previous} and {outputs.name}. Use exactly one top-level subagent chain or tasks call with async:true.";
+const essentials = (on) => `${on("workflow-scripts", scriptCalls, structuredCalls)}
+Management: {action,id?,options:{...}}; fields not in this schema go in options.
+Launch agents by name and pass models as exact provider/id; an unknown agent or model returns the valid choices.
+Details: guide workflows/recommended-orchestration-pattern (async, review, failure recovery), ${on("workflow-scripts", "guide workflows/scripted-workflows, ")}guide tool-reference/retained-children, guide tool-reference/external-cli-agent-profiles.
 
 ${SUBAGENT_SAFETY_GUIDANCE}`;
-export const SUBAGENT_TOOL_PROMPT_SNIPPET = "For operator-requested delegation, use subagents; compose multi-child work in one workflow call.";
-export const SUBAGENT_TOOL_PROMPT_GUIDELINES = [
-  "Do not invoke subagents unless the operator requested delegation directly or through applicable instructions."
-];
-export const COMPACT_SUBAGENT_TOOL_DESCRIPTION = DEFAULT_SUBAGENT_TOOL_DESCRIPTION;
-export const FULL_SUBAGENT_TOOL_DESCRIPTION = `${DEFAULT_SUBAGENT_TOOL_DESCRIPTION}
-
-WORKFLOW DETAILS:
+const managementDiscovery = (on) => [
+  ["list/get/models/guide"],
+  [on("agent-management", "create/update/delete/eject/disable/enable/reset/refine")],
+  [on("missions", "mission.*"), on("schedules", "schedule.*"), on("watchdog", "watchdog.*"), on("panes", "inspector.*, project.*"), on("lane-management", "lane.status/recordMerge/recordSupersession")],
+  [on("lane-management", "worktree.discard and reviewed worktree.cleanup")],
+  [`doctor${on("spawn-budget-grants", " and grant-spawn-budget")}`]
+].map((group) => group.filter(Boolean).join(", ")).filter(Boolean).join("; ");
+const scriptDetails = `• Scripts: JavaScript statement bodies with explicit return, top-level await, plain helpers/Promise chains; nested async function/arrow/method helpers are rejected. Await runs.run('key',{agent,task}) before .output; await runs.all([{key,agent,task},...]) for an ordered array, not a key map. Observe every stored run promise with direct await, Promise.race or Promise.all. Await/return runs.steer(key,message,options?) for a prior key, never raw run ids; queued/delivered/missed/failed receipts are not compliance proof.
+• workflow:'./path.js' (any value with '/') loads a file from request cwd; other strings name a resource, such as {workflow:'review',args:{task:'...'}}. agent/task exclude workflow; task excludes action; validate accepts workflow:true or a path without launching. Raw-script sandboxes add deeply frozen args that persist as evidence, so never include secrets; raw scripts cannot use runs.host. Granted commands/relative outputs use workflow cwd, never per-step cwd.
 • runs.lanes([{key,stages:[{key,agent,task},{key,resume:'previous',task}]}]) runs first stages together, later stages sequentially per lane. Failures stay lane-local; only explicit structuredOutput.verdict === 'blocked' blocks a successful stage, never reviewer prose.
-• Workflow child controls default onto runs.run/runs.all items; child fields override them. worktree:true isolates each child and returns handoff artifacts. usageBudget is shared across the workflow; already-running children are not stopped.
-• Missions auto-attach unless mission:false; await state.get(key)/state.set(key,JSONValue) requires a mission. See guide topic missions. Omit acceptance for reviewer/read-only calls; acceptance.review.required requests independent writer review.
-• Management discovery: list/get/models/guide; create/update/delete/eject/disable/enable/reset/refine; mission.*, schedule.*, watchdog.*, inspector.*, project.*, lane.status/recordMerge/recordSupersession; worktree.discard and plan-only worktree.cleanup; doctor and grant-spawn-budget. Use guide topics agents, missions, observability, tool-reference, configuration, models, watchdog or extension-api for exact action fields. Schedules take script inputs, not direct children; recipes live in the missions guide.`;
+`;
+const fullDetails = (on) => `DETAILS:
+${on("workflow-scripts", scriptDetails)}• ${on("workflow-scripts", "Workflow child controls default onto runs.run/runs.all items; child fields override them.", "Top-level child controls apply to every chain/tasks child.")} worktree:true requires clean source, isolates each child and returns handoff artifacts; options.baseRef defaults to HEAD at allocation or a supported named ref, never full 40/64-character commit IDs or revision expressions.${on("usage-budgets", " usageBudget is shared across the workflow; already-running children are not stopped.")}
+• Async follows asyncByDefault (normally true); async:false only to block the parent, not for final reviews/gates. Consume results at dependency barriers. bg_wait is for provider/detached work without native notification that needs a same-turn result.
+• Bind durable output ${on("workflow-scripts", "on runs.run/runs.all", "with output")}, not task filename prose; return actual outputReference/outputPathMapping/artifactPaths, evidence and residual risks.
+• Ordinary child subagents are not orchestrators; only configured fanout within depth/session limits. Use fresh-context read-only reviewers when independent review was requested. Oracle/advisor unknowns use supervisor dialogue; one-shot only when requested.
+• children.list is workflow-only, not an exhaustive list of direct native children: resume only resumable rows. When an intended child's exact run id is known, inspect it with {action:"status",id}; if status identifies the candidate, attempt {action:"resume",id,message}. Resume authoritatively checks eligibility and may reject it. Use a labeled same-role fallback only when no known candidate exists or resume rejects eligibility.${on("workflow-scripts", " Scripts await runs.run(newKey,{resume:runId,task}); continue from the latest returned runId. Each distinct resume pass needs a new stable key; same-key reuse requires identical launch parameters.")}
+• External CLI agents need an installed, authenticated CLI; preflight at launch decides, and passive PATH/PATHEXT/X_OK is not authentication/version/launch proof. They support native options only when their runner declares them: model, structured output, acceptance/agentContract, ${on("tool-budgets", "tool budget, ")}fast, fork context or skills/tools.
+• Model override: copy exact provider/id, not agent names. Thinking uses model suffix${on("watchdog", ", not watchdog-only thinking")}.
+• Missions auto-attach${on("missions", " unless options.mission:false")}; ${on("workflow-scripts", "await state.get(key)/state.set(key,JSONValue) requires a mission. ")}See guide topic missions. Omit acceptance for reviewer/read-only calls; acceptance.review.required requests independent writer review.
+• Inspect asyncId/asyncDir (status.json, events.jsonl, logs) with status/debug.run; control with interrupt/stop/resume/steer. For local DM children explicitly granted subagent_command, command.status/yield/cancel targets one exact toolCallId without interrupting the child.
+• After a failure, report the exact failure, run/status and repo/cwd/worktree/branch/ref, and verify a clean worktree or capture the partial diff before a same-protocol retry. Governed-workflow fallback to foreground/CLI needs explicit owner approval, not DM core's generic dm -ne hint.
+• Management discovery: ${managementDiscovery(on)}. Use guide topics agents, ${on("missions", "missions, ")}observability, tool-reference, configuration, models${on("watchdog", ", watchdog")} or extension-api for exact action fields.${on("schedules", on("workflow-scripts", " Schedules take script inputs, not direct children; recipes live in the missions guide."))}`;
+const fullDescription = (on) => `${essentials(on)}
+
+${fullDetails(on)}`;
+const allEnabled = featureText(resolveDisabledFeatureSurface({}));
+export const DEFAULT_SUBAGENT_TOOL_DESCRIPTION = essentials(allEnabled);
+export const SUBAGENT_TOOL_PROMPT_SNIPPET = "Delegate focused work to child agents; compose multi-child work in one workflow call.";
+const STRUCTURED_SUBAGENT_TOOL_PROMPT_SNIPPET = "Delegate focused work to child agents; compose multi-child work in one chain or tasks call.";
+export const COMPACT_SUBAGENT_TOOL_DESCRIPTION = DEFAULT_SUBAGENT_TOOL_DESCRIPTION;
+export const FULL_SUBAGENT_TOOL_DESCRIPTION = fullDescription(allEnabled);
 function isToolDescriptionMode(value) {
   return value === "full" || value === "compact" || value === "custom";
 }
 function warn(options, message) {
   (options?.warn ?? console.warn)(`[dm-subagents] ${message}`);
 }
-export function buildSubagentToolPromptMetadata(config = {}) {
+export function buildSubagentToolPromptMetadata(config = {}, disabledFeatures) {
   if (config.toolDescriptionMode !== undefined)
     return {};
-  return {
-    promptSnippet: SUBAGENT_TOOL_PROMPT_SNIPPET,
-    promptGuidelines: SUBAGENT_TOOL_PROMPT_GUIDELINES
-  };
+  return { promptSnippet: disabledFeatures?.features.has("workflow-scripts") ? STRUCTURED_SUBAGENT_TOOL_PROMPT_SNIPPET : SUBAGENT_TOOL_PROMPT_SNIPPET };
 }
 export function resolveToolDescriptionMode(config, options) {
   const mode = config.toolDescriptionMode;
@@ -127,7 +140,7 @@ function loadCustomToolDescription(options) {
   return;
 }
 function withMandatorySafetyGuidance(description) {
-  const customDescription = description.split(SUBAGENT_SAFETY_GUIDANCE).flatMap((part) => part.split(SUBAGENT_FAILURE_RECOVERY_GUIDANCE)).map((part) => part.trim()).filter(Boolean).join(`
+  const customDescription = description.split(SUBAGENT_SAFETY_GUIDANCE).map((part) => part.trim()).filter(Boolean).join(`
 
 `);
   return customDescription ? `${customDescription}
@@ -135,21 +148,17 @@ function withMandatorySafetyGuidance(description) {
 ${SUBAGENT_SAFETY_GUIDANCE}` : SUBAGENT_SAFETY_GUIDANCE;
 }
 export function buildSubagentToolDescription(config = {}, options) {
+  const on = options?.disabledFeatures ? featureText(options.disabledFeatures) : allEnabled;
   if (config.toolDescriptionMode === undefined)
-    return DEFAULT_SUBAGENT_TOOL_DESCRIPTION;
+    return essentials(on);
   const mode = resolveToolDescriptionMode(config, options);
-  let description;
   if (mode === "compact")
-    description = COMPACT_SUBAGENT_TOOL_DESCRIPTION;
-  else if (mode === "custom") {
+    return essentials(on);
+  if (mode === "custom") {
     const custom = loadCustomToolDescription(options);
     if (custom)
-      description = withMandatorySafetyGuidance(custom);
-    else {
-      warn(options, `${CUSTOM_TOOL_DESCRIPTION_FILE} was not found or valid for toolDescriptionMode "custom"; using full description.`);
-      description = FULL_SUBAGENT_TOOL_DESCRIPTION;
-    }
-  } else
-    description = FULL_SUBAGENT_TOOL_DESCRIPTION;
-  return description;
+      return withMandatorySafetyGuidance(custom);
+    warn(options, `${CUSTOM_TOOL_DESCRIPTION_FILE} was not found or valid for toolDescriptionMode "custom"; using full description.`);
+  }
+  return fullDescription(on);
 }

package/extensions/dm-subagents/src/extension/upgrade-notice.js

@@ -0,0 +1,36 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { fileURLToPath } from "node:url";
+import packageJson from "../../package.json";
+import { writeAtomicJson } from "../shared/atomic-json.js";
+import { getAgentDir } from "../shared/utils.js";
+const versionNumber = (version) => typeof version === "string" && /^\d+\.\d+\.\d+$/.test(version) ? version.split(".").reduce((total, part) => total * 1e6 + Number(part), 0) : undefined;
+export async function showUpgradeNotice(ctx, stateDir = path.join(getAgentDir(), "dm-subagents"), changelogPath = fileURLToPath(new URL("../../CHANGELOG.md", import.meta.url)), version = packageJson.version) {
+  if (!ctx.hasUI)
+    return;
+  const statePath = path.join(stateDir, "last-seen-version.json");
+  const lastSeen = await fs.promises.readFile(statePath, "utf-8").then((raw) => JSON.parse(raw).version).catch(() => {
+    return;
+  });
+  const previous = versionNumber(lastSeen);
+  const current = versionNumber(version);
+  if (current === undefined || previous === current)
+    return;
+  writeAtomicJson(statePath, { version });
+  if (previous === undefined || previous > current)
+    return;
+  const bullets = (await fs.promises.readFile(changelogPath, "utf-8")).split(/^## /m).flatMap((section) => {
+    const released = versionNumber(/^\[([^\]]+)\]/.exec(section)?.[1]);
+    if (released === undefined || released <= previous || released > current)
+      return [];
+    const highlights = section.split(/^### /m).find((part) => part.startsWith("Highlights")) ?? "";
+    return (highlights.match(/^- .*/gm) ?? []).map((bullet) => bullet.replace(/\[([^\]]*)\]\([^)]*\)/g, "$1").trim());
+  });
+  ctx.ui.notify([
+    `dm-subagents updated from ${lastSeen} to ${version}`,
+    ...bullets.slice(0, 5),
+    ...bullets.length > 5 ? [`...and ${bullets.length - 5} more`] : [],
+    "Changelog: https://github.com/DuckMind/extensions/blob/main/dm-subagents/CHANGELOG.md"
+  ].join(`
+`), "info");
+}

package/extensions/dm-subagents/src/inspectors/actions.js

@@ -5,12 +5,14 @@ import { readMissionBinding } from "../missions/lifecycle.js";
 import { listMissions, missionRecordPath, resolveMissionStoreLocation } from "../missions/store.js";
 import { resolveAuthorityDecision } from "../policy/authority.js";
 import { DIRS } from "../shared/types.js";
+import { tryLease } from "../shared/file-lease.js";
 import { readStatus } from "../shared/utils.js";
 import { resolveSubagentRunId } from "../runs/background/run-id-resolver.js";
 import { resolveNodeExecutable } from "../shared/node-executable.js";
 import { encodeSessionRoots } from "./session-roots-codec.js";
 import { formatShellCommand } from "./shell-command.js";
 export { INSPECTOR_ACTIONS } from "./types.js";
+const INSPECTOR_LEASE_WAIT_MS = 30000;
 function result(text, isError = false) {
   const response = {
     content: [{ type: "text", text }],
@@ -128,18 +130,39 @@ export async function handleInspectorAction(action, params, deps) {
   if (action === "inspector.command")
     return result(launchFor(target, deps).displayCommand);
   const plugins = deps.plugins ?? [];
-  if (action === "inspector.open") {
-    for (const plugin of plugins) {
-      if (await plugin.available(context))
-        return plugin.open(context, launchFor(target, deps), params);
-    }
-    return result("No inspector plugin is available. Start a supported inspector host, or use inspector.command for a standalone command.", true);
-  }
-  const owner = plugins.find((plugin) => plugin.owns(context));
-  if (!owner)
-    return result(`No inspector plugin owns this binding for async run ${target.runId}.`);
   if (action === "inspector.status") {
+    const owner = plugins.find((plugin) => plugin.owns(context));
+    if (!owner)
+      return result(`No inspector plugin owns this binding for async run ${target.runId}.`);
     return owner.status ? owner.status(context) : result(`Inspector plugin '${owner.name}' does not support status for async run ${target.runId}.`, true);
   }
-  return owner.close ? owner.close(context) : result(`Inspector plugin '${owner.name}' does not support close for async run ${target.runId}.`, true);
+  const label = target.index === undefined ? "" : ` child ${target.index}`;
+  const lockPath = path.join(fs.realpathSync.native(target.asyncDir), `inspector-${target.index ?? "root"}.lock`);
+  const deadline = Date.now() + (deps.leaseWaitMs ?? INSPECTOR_LEASE_WAIT_MS);
+  let release = tryLease(lockPath);
+  while (!release) {
+    if (deps.signal?.aborted)
+      return result(`Inspector ${action} for async run ${target.runId}${label} was cancelled while waiting for another inspector open or close to finish.`, true);
+    if (Date.now() >= deadline)
+      return result(`Another inspector open or close for async run ${target.runId}${label} is still in progress. Try again when it finishes.`, true);
+    await new Promise((resolve) => setTimeout(resolve, 50));
+    release = tryLease(lockPath);
+  }
+  try {
+    if (deps.signal?.aborted)
+      return result(`Inspector ${action} for async run ${target.runId}${label} was cancelled while waiting for another inspector open or close to finish.`, true);
+    if (action === "inspector.open") {
+      for (const plugin of plugins) {
+        if (await plugin.available(context))
+          return await plugin.open(context, launchFor(target, deps), params);
+      }
+      return result("No inspector plugin is available. Start a supported inspector host, or use inspector.command for a standalone command.", true);
+    }
+    const owner = plugins.find((plugin) => plugin.owns(context));
+    if (!owner)
+      return result(`No inspector plugin owns this binding for async run ${target.runId}.`);
+    return owner.close ? await owner.close(context) : result(`Inspector plugin '${owner.name}' does not support close for async run ${target.runId}.`, true);
+  } finally {
+    release();
+  }
 }

package/extensions/dm-subagents/src/inspectors/plugins.js

@@ -1,5 +1,74 @@
+import { INSPECTOR_REGISTER_EVENT } from "../api/inspectors.js";
 import { createHerdrInspectorPlugin } from "./herdr/plugin.js";
 import { createGhosttyInspectorPlugin } from "./ghostty/plugin.js";
-export function createBuiltinInspectorPlugins() {
-  return [createHerdrInspectorPlugin(), createGhosttyInspectorPlugin()];
+import { createTmuxInspectorPlugin } from "./tmux/plugin.js";
+const registries = new WeakMap;
+export function getInspectorPlugins(dm) {
+  return [createHerdrInspectorPlugin(), createGhosttyInspectorPlugin(), createTmuxInspectorPlugin(), ...registries.get(dm.events)?.plugins.values() ?? []];
+}
+export function registerInspectorEventListener(dm) {
+  let registry = registries.get(dm.events);
+  if (!registry) {
+    registry = { plugins: new Map, owners: 0 };
+    registries.set(dm.events, registry);
+  }
+  registry.owners += 1;
+  const { plugins } = registry;
+  const builtinNames = new Set([createHerdrInspectorPlugin().name, createGhosttyInspectorPlugin().name, createTmuxInspectorPlugin().name]);
+  const unsubscribe = dm.events.on(INSPECTOR_REGISTER_EVENT, (rawRequest) => {
+    if (!rawRequest || typeof rawRequest !== "object" || Array.isArray(rawRequest))
+      return;
+    const request = rawRequest;
+    if (request.result !== undefined)
+      return;
+    try {
+      if (request.version !== 1)
+        throw new Error(`Unsupported inspector registration version '${String(request.version)}'.`);
+      const plugin = request.plugin;
+      if (!plugin || typeof plugin !== "object" || Array.isArray(plugin))
+        throw new Error("Inspector plugin must be an object.");
+      const name = plugin.name;
+      if (typeof name !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(name)) {
+        throw new Error("Inspector plugin name must contain 1–128 letters, digits, dots, underscores, or hyphens and start with a letter or digit.");
+      }
+      if (builtinNames.has(name) || plugins.has(name))
+        throw new Error(`Inspector plugin '${name}' is already registered.`);
+      for (const method of ["available", "owns", "open"]) {
+        if (typeof plugin[method] !== "function")
+          throw new Error(`Inspector plugin '${name}' requires ${method}().`);
+      }
+      for (const method of ["status", "close"]) {
+        if (plugin[method] !== undefined && typeof plugin[method] !== "function")
+          throw new Error(`Inspector plugin '${name}' ${method} must be a function when provided.`);
+      }
+      plugins.set(name, plugin);
+      let disposed = false;
+      request.result = {
+        ok: true,
+        registration: {
+          dispose() {
+            if (disposed)
+              return;
+            disposed = true;
+            plugins.delete(name);
+          }
+        }
+      };
+    } catch (error) {
+      request.result = { ok: false, error: error instanceof Error ? error : new Error(String(error)) };
+    }
+  });
+  let closed = false;
+  return () => {
+    if (closed)
+      return;
+    closed = true;
+    unsubscribe();
+    registry.owners -= 1;
+    if (registry.owners > 0)
+      return;
+    plugins.clear();
+    if (registries.get(dm.events) === registry)
+      registries.delete(dm.events);
+  };
 }