@eddyskywalker/dsh-chatgpt-subscription 0.2.15 → 0.2.17

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## Unreleased
+
+- 修复开启系统代理的机器上 `web_fetch` 必然失败的问题：DSH 内置抓取 provider 在连接前解析、校验并固定目标地址，而代理工具（Clash/Mihomo 等）的 fake-ip DNS 会把域名解析成 `198.18.0.0/15` 里的保留地址（实测 `api.github.com` → `198.18.0.17`），于是每次调用都以 `WEB_BLOCKED_URL`（`resolves to a non-public IP address`）结束——代理根本没被用上。DSH 只在进程环境变量里读到代理时才走代理，看不到系统代理。现在只要插件配置了可用代理（系统代理自动检测或自定义代理），`web_fetch` 就改用本插件的抓取 provider：由代理解析源站，与 DSH 对“走代理的请求”采用的语义一致；未配置代理时仍由内置 provider 抓取，其解析与固定策略不变。
+- 抓取 provider 新增地址策略 `src/host/fetch-address-policy.ts`，保留内置 provider 安全边界中不需要 DNS 的那一半：URL 里写明的 IP 字面量只有全球可路由单播才放行（loopback、私网、链路本地、CGNAT、多播、保留地址、IPv6 转换与隧道前缀一律拒绝）；域名用本机解析器检查一次，落在私网（含 `localhost`、`127.0.0.1.nip.io` 这类）一律拒绝；只有代理的 fake-ip 答案被接受，本机解析不出的域名交给代理处理。与内置 provider 的差别是不再固定（pin）连接地址——fake-ip 环境下这一步无法成立，已在 README 的安全边界中写明。
+- 代理偏好在运行时变化（例如系统代理 ↔ 直连）会重新选择抓取后端；选择 ChatGPT 搜索来源时同时切换搜索与抓取的行为保持不变。
+- 新增 `test/fetch-address-policy.test.ts`（地址分类、fake-ip 识别、私网解析拒绝、解析失败放行），并扩充 `test/codex-fetch.test.ts`、`test/search-provider-switcher.test.ts`、`test/web-provider-lifecycle.test.ts` 覆盖抓取 provider 的拒绝路径与后端切换。
+
+## 0.2.15 - 2026-09-11
+
+- 新增子代理模型授权守卫：DSH 的「Subagent」允许列表（`subagent-model-selection`）原本只在模型**显式**填写 `provider`/`model` 时生效，而委派调用不填路由时子代理会继承父级模型——于是 DeepSeek 会话里的子代理仍会在未授权模型上运行。插件现在在 Host 工具注册表上注册一个单调守卫（`ctx.tools.guard`），当调用会话（或最近的、记录了策略的祖先会话）带有允许列表时，任何生效路由不在此列表内的委派都会在子代理启动前被拒绝，拒绝理由里带上全部已授权路由，模型据此重试即可选中合规模型。
+- 该守卫只在会话确实记录了允许列表时介入（与 DSH 委派工具的会话快照语义一致），不会改变未启用该设置的会话；`subagentModelScope: 'preference'` 可让当前设置卡允许列表也约束未记录策略的会话（含恢复的旧会话）。
+- 只读取公开接口：会话日志事件 `subagent/model-selection-policy`、父会话谱系、Host 设置文档与 `ctx.tools.guard`，不修改 DSH 本体。
+- 新增配置项：`subagentModelAuthorization`（默认 `true`）、`subagentModelTools`（默认 `['subagent']`）、`subagentModelScope`（默认 `session`，可选 `preference`）。
+- 新增 14 条单测覆盖策略解析、谱系继承、设置读取、显式/继承路由的拒绝与放行、作用域切换以及守卫安装路径（含注册与释放）。
 ## 0.2.14 - 2026-09-10
 
 - 移除失效的「子代理最大嵌套深度 / 子代理上下文预算」设置：这两个偏好键在 DSH 侧没有任何消费方（全仓库无引用），插件自身也只有写、没有读，保存了也不生效。它们源于 2026-08-28 的 `5b08e2e`——那次提交迁移到 DSH 原生子代理模型路由，删除了 `subagent-context-adapter` / `subagent-policy` / `SubagentSettingsSection`，但把这两个控件和偏好键留了下来。相关 DTO 字段、schema、路由校验、界面控件、6 条未引用文案与失效单测一并移除；子代理模型与思考深度改用 DSH 自身的“Subagent”设置卡片，最大嵌套深度由 preset 中 `tool-subagent` 的 `maxDepth` 决定，README 同步更正。
@@ -61,4 +75,4 @@
 - 适配 DSH `0.1.0-rc.8`：peerDependencies / devDependencies 中全部 DSH 包范围从 `^0.1.0-rc.6` 提升至 `^0.1.0-rc.8`，并重新生成 package-lock.json。已在本机 rc.8 依赖集上验证：typecheck、55 项测试与 tsdown 构建全部通过，插件代码无需改动。
 - 移除已无引用的 `@deepseek-ai/dsh-agent` peer 依赖（子代理报告去重兼容模块已于 0.1.11 移除）。
 - 新增 `@deepseek-ai/dsh-client-connection` peer 依赖（客户端 `ContentBlock` 类型来源，符合 rc.8 客户端包 peer 声明惯例）。
-- 说明：rc.8 中 `@deepseek-ai/dsh-client-ui-slots` 不再是 DSH 运行时依赖图成员（仅保留为各客户端包的 devDependency），插件继续将其声明为 peer 依赖以保证安装时解析（`^0.1.0-rc.6` 联网安装时解析到 rc.8；本地锁文件因离线环境暂固定 rc.7，API 与 rc.8 用法一致）。
+- 说明：rc.8 中 `@deepseek-ai/dsh-client-ui-slots` 不再是 DSH 运行时依赖图成员（仅保留为各客户端包的 devDependency），插件继续将其声明为 peer 依赖以保证安装时解析（`^0.1.0-rc.6` 联网安装时解析到 rc.8；本地锁文件因离线环境暂固定 rc.7，API 与 rc.8 用法一致）。

package/README.md

@@ -11,6 +11,7 @@
 - [环境要求](#环境要求)
 - [安装](#安装)
 - [使用](#使用)
+- [子代理模型授权](#子代理模型授权0215-起)
 - [升级、降级与卸载](#升级降级与卸载)
 - [安全边界](#安全边界)
 - [插件路由](#插件路由)
@@ -120,7 +121,9 @@ DSH 模型选择器应显示 **“Codex（ChatGPT 订阅）”**。6 Astra 与 G
 
 **设置 → Codex 订阅 → 网络代理** 同时控制 GPT 与 Antigravity（Gemini）的 Host 请求，可选择系统代理（自动检测）、自定义代理或直连。Gemini 模型生成、网页登录后的令牌交换、令牌刷新、账号信息、项目发现、配额与模型目录查询均使用此设置；修改后对后续请求生效，无需重启 DSH。浏览器中的 Google 授权页面使用浏览器自己的网络设置。
 
-**搜索与抓取来源** 同时切换 DSH 的搜索和网页抓取后端。选择 ChatGPT 来源后，网页由本插件在 Host 抓取，并使用上述网络代理设置；纯 TUN 模式可使用直连，流量由虚拟网卡接管。来源切换即时生效，DSH web 服务重载后会重新注册插件后端，并保留切回 DSH 默认来源所需的配置。选择 DSH 默认来源时，抓取仍遵循 DSH 自身的代理及非公网地址校验策略。
+**搜索与抓取来源** 切换 DSH 的搜索后端；网页抓取后端在有可用代理时自动改用本插件。选择 ChatGPT 来源后，网页由本插件在 Host 抓取，并使用上述网络代理设置；纯 TUN 模式可使用直连，流量由虚拟网卡接管。来源切换即时生效，DSH web 服务重载后会重新注册插件后端，并保留切回 DSH 默认来源所需的配置。
+
+**网页抓取后端（web_fetch）** DSH 内置抓取 provider 会先解析域名、校验并固定解析结果，而且只在进程环境变量里读到代理时才走代理——系统代理对它不可见。代理工具（Clash/Mihomo 等）常把域名解析成自己的 fake-ip 地址（默认 `198.18.0.0/15`），于是内置 provider 直接以 `WEB_BLOCKED_URL`（resolves to a non-public IP address）拒绝，代理根本没被用上。因此只要插件配置了可用代理（**网络代理** 选系统代理且检测到，或填写自定义代理），`web_fetch` 就改用本插件的 provider：由代理解析源站，与 DSH 对“走代理的请求”采用的语义一致；未配置代理时仍由 DSH 内置 provider 抓取，保留其解析与固定策略。若在纯 TUN 模式下把代理设为**直连**，内置 provider 会重新接管，此时可改回系统代理让插件接管抓取。
 
 卸载前建议先在设置页点击 **“注销”**，它会删除当前平台的凭据和 Host 内存中的额度缓存。
 
@@ -132,6 +135,27 @@ DSH 模型选择器应显示 **“Codex（ChatGPT 订阅）”**。6 Astra 与 G
 
 > Windows 文件只能由创建它的用户通过 DPAPI 解密。macOS 凭据由登录钥匙串在本机加密保存。Linux 文件是未额外加密的 JSON，依赖目录 `0700` 和文件 `0600` 隔离；不要复制、打印或提交该文件。跨平台迁移需要重新登录。
 
+## 子代理模型授权（0.2.15 起）
+
+DSH 设置页的「Subagent」卡片会把勾选的模型写成会话级的允许列表（会话日志事件 `subagent/model-selection-policy`）。DSH 内置委派工具只拒绝**模型显式填写**且不在列表内的路由；调用里不写 `provider`/`model` 时，子代理会继承父级模型，于是白名单之外的主模型（例如 `deepseek-official/deepseek-flash`）仍会被子代理使用。
+
+插件在 Host 工具注册表上补一个单调守卫（`ctx.tools.guard`），在委派执行前判定生效路由：
+
+- 调用会话（或最近的、记录了策略的祖先会话）带有允许列表时，生效路由必须落在列表内；
+- 不写路由的委派按“继承父级模型”判定，因此父级模型不在列表内时会被拒绝；
+- 拒绝结果里会列出全部已授权路由（例如 `antigravity/gemini-3.8-flash`），模型照此重试即可；`list_subagent_models` 仍只展示已授权路由；
+- 未记录允许列表的会话（例如恢复的旧会话、未启用该设置的会话）保持 DSH 原有行为。
+
+配置项（插件行 `config`，全部可省略）：
+
+| 字段 | 默认 | 含义 |
+|---|---|---|
+| `subagentModelAuthorization` | `true` | 是否启用上述授权守卫；设为 `false` 回到 DSH 原有行为 |
+| `subagentModelTools` | `['subagent']` | 需要授权的委派工具名；preset 里自定义了 `toolName` 时在此列出 |
+| `subagentModelScope` | `session` | `session` 只约束记录了允许列表的会话；`preference` 额外用当前设置卡列表约束未记录的会话 |
+
+改动只在设置卡片里保存过的勾选生效：设置改动只影响之后新建的会话（DSH 的会话快照语义），已运行的会话继续使用它自己记录的那份列表。
+
 ## 安全边界
 
 Antigravity 的 access token / refresh token 使用独立的系统凭据存储：Windows 使用 CurrentUser DPAPI（`$DSH_HOME/storages/antigravity-oauth.json.dpapi`），macOS 使用登录钥匙串，Linux 使用 Secret Service。macOS / Linux 的服务名为 `dsh-antigravity`，账号键按旧凭据文件的绝对路径生成，隔离不同的 `DSH_HOME`。
@@ -148,6 +172,7 @@ Antigravity 的 Gemini 用量以流结束时的上游累计计数为准，缓存
 - Windows token bundle 使用 CurrentUser DPAPI；明文只经过 Host 内存和 PowerShell stdin/stdout；
 - macOS token bundle 存入登录钥匙串，通过系统 `security` 命令读写；明文只经过 Host 内存和 `security` 命令行参数，Keychain 在本机加密保存；
 - Linux token bundle 原子写入当前用户私有文件并在读取时校验普通文件、所有者与 `0600` 权限，同时拒绝符号链接；该文件没有应用层加密，同 UID 进程、root、备份和磁盘快照仍可读取；
+- 本插件抓取 provider 的地址策略：URL 里直接写明的 IP 字面量只有在全球可路由单播时才放行（loopback、私网、链路本地、CGNAT、多播、保留地址、IPv6 转换与隧道前缀一律拒绝）；域名会先用本机解析器检查一次，解析结果落在私网时同样拒绝，只有代理的 fake-ip 地址（`198.18.0.0/15`）被接受——那正是本机代理声称拥有该域名的表现；本机解析不出的域名交给代理处理。与 DSH 内置 provider 的差别是不固定（pin）连接地址，因为 fake-ip 环境下这一步无法成立；
 - 所有平台的 token 都不会进入浏览器、`settings.yaml` 或日志；
 - 工具调用只有在参数是完整 JSON 对象时才产生可执行的 `block-end`；畸形参数终止本次生成；
 - 所有修改状态的路由只接受同源 JSON POST，并校验 `Origin` 与 `Host`。
@@ -190,6 +215,7 @@ npm pack --dry-run
 | 额度显示旧数据 | 设置页会保留最后成功值；等待 15 秒节流窗口后手动刷新 |
 | 429 | 插件遵守 `Retry-After`，不会高频轮询；模型请求由 DSH retry policy 有界重试 |
 | 模型不可用 | 检查 ChatGPT 套餐、workspace 权限与当前模型可用性 |
+| `web_fetch` 报 `resolves to a non-public IP address` | 机器启用了系统代理（fake-ip DNS），但插件没有可用代理可接管抓取：在 **设置 → Codex 订阅 → 网络代理** 选择系统代理（自动检测）或填写自定义代理 |
 | DPAPI 读取失败 | 确认 DSH 以创建凭据时的同一 Windows 用户运行；必要时清理凭据后重新登录 |
 | Linux 凭据存储不可用 | 确认凭据属于当前用户且权限为 `0600`，父目录权限为 `0700`；修复权限或注销后重新登录 |
-| Linux 上工具调用语法错误 | 确认 DSH 暴露的是 `bash`、`sh` 或 `shell`，并使用相应的 Bash/POSIX 语法与 `/` 路径 |
+| Linux 上工具调用语法错误 | 确认 DSH 暴露的是 `bash`、`sh` 或 `shell`，并使用相应的 Bash/POSIX 语法与 `/` 路径 |

package/lib/index.js

@@ -1,7 +1,10 @@
 import { createRequire } from "node:module";
+import z from "@deepseek-ai/schemastery";
 import * as LlmModule from "@deepseek-ai/dsh-llm";
 import { HarnessError, LlmAdapter, LlmError, ProviderRequestId, ReasoningEffortId, attributionHeaders, resolveRetryPolicy } from "@deepseek-ai/dsh-llm";
 import { WebError } from "@deepseek-ai/dsh-web";
+import { lookup } from "node:dns/promises";
+import { isIP } from "node:net";
 import { createUserMessage } from "@deepseek-ai/dsh-llm/message";
 import { defineTool } from "@deepseek-ai/dsh-tools";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
@@ -12,7 +15,6 @@ import path, { dirname, join } from "node:path";
 import os, { homedir } from "node:os";
 import { ProxyAgent, fetch as fetch$1 } from "undici";
 import * as SettingsModule from "@deepseek-ai/dsh-settings";
-import z from "@deepseek-ai/schemastery";
 import fsPromises, { chmod, lstat, mkdir, open, rename, stat, unlink } from "node:fs/promises";
 import { isDeepStrictEqual } from "node:util";
 import { URL as URL$1, URLSearchParams as URLSearchParams$1 } from "node:url";
@@ -274,6 +276,225 @@ var CodexChatGptAdapter = class extends LlmAdapter {
 	}
 };
 //#endregion
+//#region src/host/fetch-address-policy.ts
+/**
+* Destination policy for this plugin's fetch provider.
+*
+* DSH's built-in provider resolves every destination and validates and pins the
+* address before it connects. That cannot work on a machine whose proxy answers
+* DNS with its own fake-ip range (`198.18.0.0/15` for Clash/Mihomo, the usual
+* companion of a system proxy): the hostname is ordinary, the answer is reserved
+* space, and every request is refused before the proxy that could have resolved
+* it is ever consulted. This provider exists for that machine, so it cannot
+* validate names the way the built-in one does.
+*
+* It keeps the half of the policy that needs no resolution — an address the URL
+* states outright is refused unless it is globally reachable unicast, because a
+* proxy on this machine must not become a path into loopback or a LAN — and it
+* also refuses a name this machine resolves into private space. Only the proxy's
+* own fake-ip answers are accepted, since that is what the proxy's name
+* resolution looks like from here; the URL hostname still reaches the proxy
+* intact, so the proxy decides where the name really goes.
+*
+* @module dsh-chatgpt-subscription/fetch-address-policy
+*/
+/**
+* Every IPv4 range a fetch may not target: "this network", private space,
+* carrier-grade NAT, loopback, link-local, IETF assignments, documentation,
+* the 6to4 relay anycast, the benchmarking range the mainstream proxy tools use
+* for fake-ip answers, multicast, and reserved space including the broadcast
+* address.
+*/
+const NON_PUBLIC_IPV4 = [
+	"0.0.0.0/8",
+	"10.0.0.0/8",
+	"100.64.0.0/10",
+	"127.0.0.0/8",
+	"169.254.0.0/16",
+	"172.16.0.0/12",
+	"192.0.0.0/24",
+	"192.0.2.0/24",
+	"192.88.99.0/24",
+	"192.168.0.0/16",
+	"198.18.0.0/15",
+	"198.51.100.0/24",
+	"203.0.113.0/24",
+	"224.0.0.0/4",
+	"240.0.0.0/4"
+];
+/** The fake-ip range the mainstream proxy tools hand out for the names they own. */
+const FAKE_IP_RANGE = "198.18.0.0/15";
+/**
+* Resolve one hostname to every address the local resolver returns, or to no
+* addresses when it cannot.
+*
+* A failure is not evidence of a local destination: the configured proxy
+* resolves the origin itself, so a name this machine cannot resolve must not
+* fail a request the proxy could have served.
+*
+* @param hostname - the URL hostname, without brackets.
+* @returns the resolved addresses, or an empty list when resolution failed.
+*/
+async function lookupHostAddresses(hostname) {
+	try {
+		return (await lookup(hostname, {
+			all: true,
+			verbatim: true
+		})).map((answer) => answer.address);
+	} catch {
+		return [];
+	}
+}
+/**
+* Whether a host is stated as an IP address rather than as a name.
+*
+* @param hostname - a URL hostname, bracketed or not.
+* @returns true when the host is an IPv4 or IPv6 literal.
+*/
+function isIpLiteral(hostname) {
+	return isIP(unbracket(hostname)) !== 0;
+}
+/**
+* Whether an address is one only a proxy's fake-ip resolver hands out. The IANA
+* benchmarking range carries no real host, so an answer inside it is this
+* machine's proxy claiming the name, not a private destination.
+*
+* @param address - a textual IPv4 (or IPv4-mapped IPv6) address.
+* @returns true when the address is inside the proxy fake-ip range.
+*/
+function isProxyFakeIpAddress(address) {
+	const value = ipv4Value(unbracket(address).replace(/^::ffff:/i, ""));
+	return value !== void 0 && inRange(value, FAKE_IP_RANGE);
+}
+/**
+* Whether an address is globally reachable unicast. IPv4-mapped IPv6 is
+* classified by the IPv4 address it embeds; every other IPv6 address is public
+* only inside `2000::/3`, which excludes loopback, unique-local, link-local,
+* multicast, and the transition and translation prefixes whose real destination
+* cannot be seen from the address alone.
+*
+* @param address - a textual IPv4 or IPv6 address, bracketed or not.
+* @returns true only for a public unicast destination.
+*/
+function isPublicIpAddress(address) {
+	const unbracketed = unbracket(address);
+	const family = isIP(unbracketed);
+	if (family === 4) return isPublicIpv4(unbracketed);
+	if (family !== 6) return false;
+	const mapped = unbracketed.replace(/^::ffff:/i, "");
+	if (isIP(mapped) === 4) return isPublicIpv4(mapped);
+	return isPublicIpv6(unbracketed);
+}
+/**
+* Whether a hostname is an IP literal no request may target.
+*
+* @param hostname - a URL hostname, bracketed or not.
+* @returns true when the host is a literal address that is not public.
+*/
+function isNonPublicIpLiteral(hostname) {
+	const unbracketed = unbracket(hostname);
+	return isIP(unbracketed) !== 0 && !isPublicIpAddress(unbracketed);
+}
+/**
+* Refuse a fetch destination the local network policy exists to keep out of
+* reach, before any request is made.
+*
+* @param hostname - the URL hostname, bracketed or not.
+* @param addresses - every address the local resolver returned for the host.
+* @throws WebError `WEB_BLOCKED_URL` for a non-public literal, or for a name
+*   this machine resolves into private space that is not the proxy's fake-ip.
+*/
+function assertPublicFetchTarget(hostname, addresses) {
+	if (isNonPublicIpLiteral(hostname)) throw new WebError(`URL hostname "${hostname}" is not a public IP address`, "WEB_BLOCKED_URL");
+	for (const address of addresses) {
+		if (isPublicIpAddress(address) || isProxyFakeIpAddress(address)) continue;
+		throw new WebError(`URL hostname "${hostname}" resolves to a non-public IP address`, "WEB_BLOCKED_URL");
+	}
+}
+/** Whether a dotted quad is public, using {@link NON_PUBLIC_IPV4}. */
+function isPublicIpv4(address) {
+	const value = ipv4Value(address);
+	if (value === void 0) return false;
+	return !NON_PUBLIC_IPV4.some((cidr) => inRange(value, cidr));
+}
+/** Whether a 32-bit address sits inside one `a.b.c.d/prefix` range. */
+function inRange(value, cidr) {
+	const slash = cidr.indexOf("/");
+	const network = ipv4Value(cidr.slice(0, slash));
+	const prefix = Number(cidr.slice(slash + 1));
+	if (network === void 0 || !Number.isInteger(prefix) || prefix < 0 || prefix > 32) return false;
+	const mask = prefix === 0 ? 0 : 4294967295 << 32 - prefix >>> 0;
+	return (value & mask) >>> 0 === (network & mask) >>> 0;
+}
+/** Parse a dotted quad into its 32-bit value, or `undefined` when it is not one. */
+function ipv4Value(address) {
+	const parts = address.split(".");
+	if (parts.length !== 4) return void 0;
+	let value = 0;
+	for (const part of parts) {
+		if (!/^\d{1,3}$/.test(part)) return void 0;
+		const octet = Number(part);
+		if (octet > 255) return void 0;
+		value = (value << 8 | octet) >>> 0;
+	}
+	return value;
+}
+/** Whether an IPv6 literal is inside `2000::/3` and outside its blocked sub-ranges. */
+function isPublicIpv6(address) {
+	const words = ipv6Words(address);
+	if (words === void 0) return false;
+	const [first = 0, second = 0] = words;
+	if ((first >> 8 & 224) !== 32) return false;
+	if (first === 8193) {
+		if (second === 3512) return false;
+		if (second === 0) return false;
+		if (second === 2) return false;
+		if ((second & 65520) === 16) return false;
+		if ((second & 65520) === 32) return false;
+	}
+	if (first === 8194) return false;
+	if (first === 16383 && second <= 4095) return false;
+	return true;
+}
+/** Parse an IPv6 literal into its eight 16-bit words, or `undefined` when it is not one. */
+function ipv6Words(address) {
+	const zone = address.indexOf("%");
+	const halves = (zone === -1 ? address : address.slice(0, zone)).split("::");
+	if (halves.length > 2) return void 0;
+	const head = parseIpv6Half(halves[0] ?? "");
+	if (head === void 0) return void 0;
+	if (halves.length === 1) return head.length === 8 ? head : void 0;
+	const tail = parseIpv6Half(halves[1] ?? "");
+	if (tail === void 0) return void 0;
+	const gap = 8 - head.length - tail.length;
+	if (gap < 1) return void 0;
+	return [
+		...head,
+		...new Array(gap).fill(0),
+		...tail
+	];
+}
+/** Parse one '::'-free half of an IPv6 literal, expanding a trailing dotted quad. */
+function parseIpv6Half(segment) {
+	if (segment === "") return [];
+	const words = [];
+	for (const piece of segment.split(":")) {
+		if (piece.includes(".")) {
+			const value = ipv4Value(piece);
+			if (value === void 0) return void 0;
+			words.push(value >>> 16, value & 65535);
+			continue;
+		}
+		if (!/^[0-9a-fA-F]{1,4}$/.test(piece)) return void 0;
+		words.push(parseInt(piece, 16));
+	}
+	return words;
+}
+/** WHATWG URL keeps brackets around an IPv6 hostname; IP parsers do not. */
+function unbracket(hostname) {
+	return hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
+}
+//#endregion
 //#region src/host/codex-fetch.ts
 const DEFAULT_MAX_RESPONSE_BYTES = 2 * 1024 * 1024;
 const DEFAULT_MAX_BODY_CHARS = 1e5;
@@ -281,6 +502,7 @@ function createCodexFetchProvider(options = {}) {
 	const fetchFn = options.fetchFn ?? fetch;
 	const maxResponseBytes = options.maxResponseBytes ?? DEFAULT_MAX_RESPONSE_BYTES;
 	const maxBodyChars = options.maxBodyChars ?? DEFAULT_MAX_BODY_CHARS;
+	const resolveHostAddresses = options.resolveHostAddresses ?? lookupHostAddresses;
 	return {
 		id: CODEX_FETCH_PROVIDER_ID,
 		available: () => true,
@@ -293,6 +515,7 @@ function createCodexFetchProvider(options = {}) {
 				throw new WebError(`invalid URL: ${targetUrl}`, "WEB_INVALID_URL", { cause: error });
 			}
 			if (parsedUrl.protocol !== "http:" && parsedUrl.protocol !== "https:") throw new WebError(`unsupported URL scheme "${parsedUrl.protocol}" (only http and https are allowed)`, "WEB_INVALID_URL");
+			assertPublicFetchTarget(parsedUrl.hostname, isIpLiteral(parsedUrl.hostname) ? [] : await resolveHostAddresses(parsedUrl.hostname));
 			let response;
 			try {
 				response = await fetchFn(targetUrl, {
@@ -3538,7 +3761,7 @@ var SearchProviderSwitcher = class {
 	constructor(loader) {
 		this.loader = loader;
 	}
-	async select(preference) {
+	async select(preference, options = {}) {
 		const entry = this.findWebEntry();
 		if (entry === null) return;
 		const config = currentConfig(entry);
@@ -3547,9 +3770,9 @@ var SearchProviderSwitcher = class {
 			this.originalFetchProvider = typeof config.fetchProvider === "string" && config.fetchProvider !== "codex-subscription" ? config.fetchProvider : void 0;
 			this.initialized = true;
 		}
-		const selected = preference === "codex" ? CODEX_SEARCH_PROVIDER_ID : void 0;
-		const nextSearch = selected ?? this.originalSearchProvider;
-		const nextFetch = selected ? CODEX_FETCH_PROVIDER_ID : this.originalFetchProvider;
+		const codexSelected = preference === SEARCH_PROVIDER_CODEX;
+		const nextSearch = codexSelected ? CODEX_SEARCH_PROVIDER_ID : this.originalSearchProvider;
+		const nextFetch = codexSelected || options.pluginFetch === true ? CODEX_FETCH_PROVIDER_ID : this.originalFetchProvider;
 		if (config.searchProvider === nextSearch && config.fetchProvider === nextFetch) return;
 		const nextConfig = { ...config };
 		if (nextSearch === void 0) delete nextConfig.searchProvider;
@@ -4912,7 +5135,7 @@ function sanitizeText(text) {
 function isRecord(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function asString(value) {
+function asString$1(value) {
 	return typeof value === "string" ? value : void 0;
 }
 function safeJsonParse(text) {
@@ -4935,10 +5158,10 @@ function parseArguments(raw) {
 	return isRecord(parsed) ? parsed : {};
 }
 function imageBlockToPart(block) {
-	let data = asString(block.data) || asString(block.base64);
+	let data = asString$1(block.data) || asString$1(block.base64);
 	const source = isRecord(block.source) ? block.source : void 0;
-	if (!data && source) data = asString(source.data) || asString(source.base64);
-	let mimeType = asString(block.mimeType) || asString(block.mediaType) || (source ? asString(source.mimeType) || asString(source.mediaType) : void 0) || "image/png";
+	if (!data && source) data = asString$1(source.data) || asString$1(source.base64);
+	let mimeType = asString$1(block.mimeType) || asString$1(block.mediaType) || (source ? asString$1(source.mimeType) || asString$1(source.mediaType) : void 0) || "image/png";
 	if (data?.startsWith("data:")) {
 		const match = data.match(/^data:([^;,]+);base64,(.*)$/s);
 		if (match) {
@@ -4984,7 +5207,7 @@ function replayBlockFor(message, index) {
 	}
 }
 function thoughtSignature(part) {
-	return asString(part?.thoughtSignature) || asString(part?.thought_signature) || asString(part?.thinkingSignature) || asString(part?.textSignature);
+	return asString$1(part?.thoughtSignature) || asString$1(part?.thought_signature) || asString$1(part?.thinkingSignature) || asString$1(part?.textSignature);
 }
 function replayPart(part) {
 	const copy = { ...part };
@@ -5003,7 +5226,7 @@ function assistantParts(message, model, runtimeModel, toolCalls) {
 		if (!isRecord(block)) continue;
 		const replay = replayBlockFor(message, index);
 		const originalParts = Array.isArray(replay?.parts) ? replay.parts.filter(isRecord) : [];
-		if ((block.type === "text" || block.type === "reasoning") && originalParts.length > 0 && originalParts.every((part) => !part.functionCall) && originalParts.map((part) => asString(part.text) || "").join("") === sanitizeText(String(block.text || ""))) {
+		if ((block.type === "text" || block.type === "reasoning") && originalParts.length > 0 && originalParts.every((part) => !part.functionCall) && originalParts.map((part) => asString$1(part.text) || "").join("") === sanitizeText(String(block.text || ""))) {
 			parts.push(...originalParts.map(replayPart));
 			continue;
 		}
@@ -5024,7 +5247,7 @@ function assistantParts(message, model, runtimeModel, toolCalls) {
 			const toolId = String(block.id || "");
 			const toolName = String(block.name || "");
 			const originalCall = originalParts.find((part) => isRecord(part.functionCall));
-			const wireId = asString((isRecord(originalCall?.functionCall) ? originalCall.functionCall : void 0)?.id) || (toolCallIdNeeded(model.id, runtimeModel) ? sanitizeToolCallId(toolId, toolName) : originalCall ? void 0 : toolId || void 0);
+			const wireId = asString$1((isRecord(originalCall?.functionCall) ? originalCall.functionCall : void 0)?.id) || (toolCallIdNeeded(model.id, runtimeModel) ? sanitizeToolCallId(toolId, toolName) : originalCall ? void 0 : toolId || void 0);
 			toolCalls.set(toolId, {
 				name: toolName,
 				id: wireId
@@ -5301,8 +5524,8 @@ function processStreamLine(line, state) {
 		if (isRecord(part.functionCall)) {
 			out.push(...closeCurrentBlock(state));
 			const fc = part.functionCall;
-			const toolName = asString(fc.name) || "";
-			const toolId = asString(fc.id) || sanitizeToolCallId("", toolName);
+			const toolName = asString$1(fc.name) || "";
+			const toolId = asString$1(fc.id) || sanitizeToolCallId("", toolName);
 			const argsText = JSON.stringify(isRecord(fc.args) ? fc.args : {});
 			const index = state.blocks.length;
 			const block = {
@@ -5340,7 +5563,7 @@ function processStreamLine(line, state) {
 	}
 	collectUsage(chunk.usageMetadata, state);
 	if (responseData !== chunk) collectUsage(responseData.usageMetadata, state);
-	const finishReason = asString(candidate?.finishReason) || asString(responseData.finishReason);
+	const finishReason = asString$1(candidate?.finishReason) || asString$1(responseData.finishReason);
 	if (finishReason) {
 		state.finishReason = finishReason;
 		out.push(...closeCurrentBlock(state));
@@ -5685,7 +5908,230 @@ function registerAntigravityRoutes(ctx, store, modelSettings, preferences, fetch
 	});
 }
 //#endregion
+//#region src/host/subagent-model-authorization.ts
+/** DSH settings namespace owned by the Subagent settings card. */
+const SUBAGENT_MODEL_SELECTION_NAMESPACE = "subagent-model-selection";
+/** Durable Session event carrying one Session's authorized child routes. */
+const SUBAGENT_POLICY_EVENT = "subagent/model-selection-policy";
+/** Delegation tools whose child routes this guard authorizes. */
+const DEFAULT_DELEGATION_TOOLS = ["subagent"];
+/**
+* Read one deployment event field as a string.
+* @param value - Candidate field value from a durable event.
+* @returns the string value, or undefined for any other type.
+*/
+function asString(value) {
+	return typeof value === "string" ? value : void 0;
+}
+/**
+* Read one deployment event field as a plain object.
+* @param value - Candidate field value from a durable event.
+* @returns the record value, or undefined for arrays, null, and primitives.
+*/
+function asRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
+}
+/**
+* Read one deployment event field as a boolean.
+* @param value - Candidate field value from a durable event.
+* @returns the boolean value, or undefined for any other type.
+*/
+function asBoolean(value) {
+	return typeof value === "boolean" ? value : void 0;
+}
+/**
+* Parse the allowlist out of a durable route-policy event.
+* @param data - `subagent/model-selection-policy` event payload.
+* @returns every well-formed route, or undefined when the payload carries none.
+*/
+function parseAllowedRoutes(data) {
+	const allowed = asRecord(data)?.["allowedModels"];
+	if (!Array.isArray(allowed)) return void 0;
+	const routes = [];
+	for (const entry of allowed) {
+		const record = asRecord(entry);
+		const provider = asString(record?.["provider"]);
+		const model = asString(record?.["model"]);
+		if (provider === void 0 || model === void 0) continue;
+		if (provider.length === 0 || model.length === 0) continue;
+		routes.push({
+			provider,
+			model
+		});
+	}
+	return routes.length === 0 ? void 0 : routes;
+}
+/**
+* Find one Session's recorded allowlist among its durable events.
+* @param session - Session whose log is scanned.
+* @returns the authorized routes, or undefined for a Session that recorded none.
+*/
+function policyRoutesOf(session) {
+	if (session === void 0 || typeof session.eventAt !== "function") return void 0;
+	for (let seq = 0; seq < 256; seq += 1) {
+		let event;
+		try {
+			event = session.eventAt(seq);
+		} catch {
+			return;
+		}
+		if (event === void 0) return void 0;
+		if (event.type !== "subagent/model-selection-policy") continue;
+		const routes = parseAllowedRoutes(event.data);
+		if (routes !== void 0) return routes;
+	}
+}
+/**
+* Resolve the allowlist a delegation from this agent must respect: the agent's
+* own recorded policy, else the nearest ancestor Session that recorded one
+* (the inheritance the delegation tool applies to child Sessions).
+* @param agent - Calling agent.
+* @param sessions - Session registry used for ancestor lookup.
+* @returns the authorized routes, or undefined when no Session recorded any.
+*/
+function authorizedRoutesFor(agent, sessions) {
+	let session = agent?.session;
+	for (let depth = 0; depth < 8 && session !== void 0; depth += 1) {
+		const recorded = policyRoutesOf(session);
+		if (recorded !== void 0) return recorded;
+		const header = session.header;
+		if (header?.origin !== "subagent") return void 0;
+		const parentId = asString(header.parentSession);
+		if (parentId === void 0) return void 0;
+		session = sessions.get(parentId);
+	}
+}
+/**
+* Read the Host preference that owns the allowlist. Values in the stored
+* document are untrusted JSON, so every field is narrowed before use.
+* @param settings - Live settings service, when composed.
+* @returns the resolved preference, or undefined without a settings service.
+*/
+function subagentModelSelectionPreference(settings) {
+	if (settings === void 0) return void 0;
+	const register = settings["register"];
+	if (typeof register !== "function") return void 0;
+	try {
+		const value = asRecord(register.call(settings, SUBAGENT_MODEL_SELECTION_NAMESPACE, z.object({
+			enabled: z.boolean().default(false),
+			allowedModels: z.array(z.object({
+				provider: z.string().min(1).required(),
+				model: z.string().min(1).required()
+			})).default([])
+		})).get());
+		if (value === void 0) return void 0;
+		return {
+			enabled: asBoolean(value["enabled"]) === true,
+			allowedModels: parseAllowedRoutes(value) ?? []
+		};
+	} catch {
+		return;
+	}
+}
+/** Whether an exact route is authorized by a allowlist. */
+function routesInclude(allowed, provider, model) {
+	return allowed.some((route) => route.provider === provider && route.model === model);
+}
+/**
+* Build the denial reason for a delegation that would run on an unauthorized
+* route. The reason names the authorized routes so the next call can select one.
+* @param provider - Effective child provider id, when one is known.
+* @param model - Effective child model id, when one is known.
+* @param allowed - Routes the calling Session authorizes.
+* @param explicit - Whether the model named the route in the tool arguments.
+* @returns the corrective reason handed back to the model.
+*/
+function unauthorizedRouteReason(provider, model, allowed, explicit) {
+	const route = provider === void 0 || model === void 0 ? "the inherited route" : `route "${provider}/${model}"`;
+	return `subagent model selection: ${explicit ? "the model this call selected is not on the Session allowlist" : "the route this call would inherit from the parent is not on the Session allowlist"} (${route}). Provide an authorized provider and model — ${allowed.map((entry) => `${entry.provider}/${entry.model}`).join(", ")} — using list_subagent_models to inspect their reasoning efforts.`;
+}
+/**
+* Decide whether one delegation call may start its child.
+* @param agent - Calling agent.
+* @param toolName - Tool being dispatched.
+* @param args - Parsed tool arguments.
+* @param preference - Current Host preference, when the settings service exists.
+* @param sessions - Session registry used for ancestor lookup.
+* @param toolNames - Delegation tool names this guard authorizes.
+* @param scope - Whether an unrecorded Session falls back to the preference.
+* @returns a denial reason, or undefined to leave the call untouched.
+*/
+function delegationDenialReason(agent, toolName, args, preference, sessions, toolNames = DEFAULT_DELEGATION_TOOLS, scope = "session") {
+	if (!toolNames.includes(toolName)) return void 0;
+	if (preference !== void 0 && !preference.enabled) return void 0;
+	const allowed = authorizedRoutesFor(agent, sessions) ?? (scope === "preference" ? preference?.allowedModels ?? [] : []);
+	if (allowed.length === 0) return void 0;
+	const request = asRecord(args) ?? {};
+	const requestedProvider = asString(request["provider"]);
+	const requestedModel = asString(request["model"]);
+	const explicit = requestedProvider !== void 0 || requestedModel !== void 0;
+	const implicit = requestedProvider === void 0 && requestedModel === void 0;
+	const provider = implicit ? asString(agent?.options?.provider) : requestedProvider;
+	const model = implicit ? asString(agent?.options?.model) : requestedModel;
+	if (provider === void 0 || model === void 0) return;
+	if (routesInclude(allowed, provider, model)) return void 0;
+	return unauthorizedRouteReason(provider, model, allowed, explicit);
+}
+/**
+* Build the monotonic tool guard for one deployment. The Host preference is
+* sampled from the live settings document on every call, because a settings
+* edit must not rebuild the guard the way it cannot rebuild a Session.
+* @param options - settings, session registry, and delegation tool names.
+* @returns a guard that denies delegations outside the Session allowlist.
+*/
+function createSubagentAuthorization(options) {
+	return (agent, toolName, args) => delegationDenialReason(agent, toolName, args, subagentModelSelectionPreference(options.settings), options.sessions, options.toolNames, options.scope ?? "session");
+}
+/** Delegation names this guard recognizes when configuration omits them. */
+function normalizeDelegationToolNames(value) {
+	const names = Array.isArray(value) ? value.filter((entry) => typeof entry === "string" && entry.trim().length > 0) : [];
+	return [...new Set(names.length === 0 ? [...DEFAULT_DELEGATION_TOOLS] : names.map((name) => name.trim()))];
+}
+/**
+* Validate the plugin configuration that owns this guard.
+* @param toolNames - Candidate delegation tool names.
+* @returns the exact names this guard authorizes.
+*/
+function validateDelegationToolNames(toolNames) {
+	if (toolNames.length === 0) throw new Error("dsh-chatgpt-subscription: subagentModelAuthorization.toolNames must name at least one delegation tool");
+	for (const name of toolNames) if (name.length === 0 || name !== name.trim()) throw new Error(`dsh-chatgpt-subscription: subagentModelAuthorization.toolNames entry "${name}" must be a non-empty trimmed string`);
+	return [...toolNames];
+}
+/**
+* Register the monotonic guard on the Host tool registry.
+* @param ctx - Host context carrying `tools` (and optionally `settings`).
+* @param sessions - Session registry used for ancestor lookup.
+* @param config - Enforcement toggle and delegation tool names.
+* @returns the exact disposer that unregisters the guard.
+*/
+function installSubagentModelAuthorization(ctx, sessions, config = {}) {
+	const toolNames = validateDelegationToolNames(config.toolNames ?? [...DEFAULT_DELEGATION_TOOLS]);
+	const scope = validateAuthorizationScope(config.scope ?? "session");
+	const settings = ctx.get?.("settings");
+	const authorize = createSubagentAuthorization({
+		settings,
+		sessions,
+		toolNames,
+		scope
+	});
+	return ctx.tools.guard((exec) => authorize(exec.agent, exec.name, exec.arguments));
+}
+/**
+* Validate the configured authorization scope.
+* @param scope - Candidate scope from deployment configuration.
+* @returns the exact scope this guard enforces.
+*/
+function validateAuthorizationScope(scope) {
+	if (scope === "session" || scope === "preference") return scope;
+	throw new Error(`dsh-chatgpt-subscription: subagentModelScope must be "session" or "preference", received ${JSON.stringify(scope)}`);
+}
+//#endregion
 //#region src/index.ts
+const Config = z.object({
+	subagentModelAuthorization: z.boolean().default(true),
+	subagentModelTools: z.array(z.string()).default([]),
+	subagentModelScope: z.union([z.const("session"), z.const("preference")]).default("session")
+});
 const inject = [
 	"webServer",
 	"llm",
@@ -5694,12 +6140,24 @@ const inject = [
 	"settings",
 	"loader"
 ];
-function apply(ctx) {
+function apply(ctx, pluginConfig = {}) {
 	const store = createPlatformTokenStore();
 	const preferences = registerPreferenceStore(ctx.settings);
 	const antigravityStore = new FileCredentialStore();
 	const antigravityModelSettings = new FileModelSettingsStore();
 	const antigravityPreferences = registerAntigravityPreferenceStore(ctx.settings, antigravityModelSettings);
+	const delegationToolNames = normalizeDelegationToolNames(pluginConfig.subagentModelTools);
+	if (pluginConfig.subagentModelAuthorization !== false) ctx.inject(["sessions"], (scoped) => {
+		const sessions = scoped.get("sessions");
+		if (sessions === void 0) return;
+		scoped.effect(() => {
+			if (typeof scoped.tools?.guard !== "function") return () => void 0;
+			return installSubagentModelAuthorization(scoped, sessions, {
+				toolNames: delegationToolNames,
+				scope: pluginConfig.subagentModelScope ?? "session"
+			});
+		}, "dsh-chatgpt-subscription: subagent model authorization");
+	});
 	ctx.effect(() => {
 		const proxyManager = new ProxyManager({
 			getPreferences: () => preferences.status(),
@@ -5723,9 +6181,10 @@ function apply(ctx) {
 			reasoningSummary: () => preferences.status().reasoningSummary
 		}), preferences);
 		const searchSwitcher = new SearchProviderSwitcher(ctx.loader);
-		const applySearchPreference = (searchProvider = preferences.status().searchProvider) => {
-			searchSwitcher.select(searchProvider).catch((error) => {
-				ctx.logger.warn(`[dsh-chatgpt-subscription] Search provider preference could not be applied: ${error instanceof Error ? error.message : String(error)}`);
+		const applyWebProviders = (current = preferences.status()) => {
+			const pluginFetch = proxyManager.resolveActiveProxyUrl() !== null;
+			searchSwitcher.select(current.searchProvider, { pluginFetch }).catch((error) => {
+				ctx.logger.warn(`[dsh-chatgpt-subscription] Web provider selection could not be applied: ${error instanceof Error ? error.message : String(error)}`);
 			});
 		};
 		const disposeRoutes = registerRoutes(ctx, oauth, usage, preferences, proxyManager);
@@ -5734,9 +6193,9 @@ function apply(ctx) {
 		ctx.inject(["web"], (ctx) => {
 			ctx.web.registerSearchProvider(createCodexSearchProvider(oauth, { fetchFn: proxyFetch }));
 			ctx.web.registerFetchProvider(createCodexFetchProvider({ fetchFn: proxyFetch }));
-			applySearchPreference();
+			applyWebProviders();
 		});
-		const disposePreferenceWatch = preferences.watch((next) => applySearchPreference(next.searchProvider));
+		const disposePreferenceWatch = preferences.watch((next) => applyWebProviders(next));
 		return () => {
 			disposePreferenceWatch();
 			disposeImageTool();
@@ -5753,4 +6212,4 @@ function localWebServerBaseUrl(host, port) {
 	return `http://${host === "0.0.0.0" ? "127.0.0.1" : host}:${port}`;
 }
 //#endregion
-export { AntigravityAdapter, CodexChatGptAdapter, FileCredentialStore, FileModelSettingsStore, LinuxFileTokenStore, MacKeychainTokenStore, OAuthService, ProxyManager, ResponsesClient, UsageService, WindowsDpapiTokenStore, apply, beginWebLogin, clearCachedQuota, createCodexFetchProvider, createCodexImageTool, createCodexSearchProvider, createPlatformTokenStore, credentialPath, detectSystemProxy, fetchAccountQuota, getCachedQuota, inject, loginAndSave, mapCodexUsage, modelSettingsPath, parseCodexUsage, parseResponsesStream, refreshAntigravityToken };
+export { AntigravityAdapter, CodexChatGptAdapter, Config, FileCredentialStore, FileModelSettingsStore, LinuxFileTokenStore, MacKeychainTokenStore, OAuthService, ProxyManager, ResponsesClient, SUBAGENT_MODEL_SELECTION_NAMESPACE, SUBAGENT_POLICY_EVENT, UsageService, WindowsDpapiTokenStore, apply, authorizedRoutesFor, beginWebLogin, clearCachedQuota, createCodexFetchProvider, createCodexImageTool, createCodexSearchProvider, createPlatformTokenStore, createSubagentAuthorization, credentialPath, delegationDenialReason, detectSystemProxy, fetchAccountQuota, getCachedQuota, inject, installSubagentModelAuthorization, loginAndSave, mapCodexUsage, modelSettingsPath, normalizeDelegationToolNames, parseAllowedRoutes, parseCodexUsage, parseResponsesStream, policyRoutesOf, refreshAntigravityToken, subagentModelSelectionPreference, unauthorizedRouteReason, validateAuthorizationScope, validateDelegationToolNames };

package/lib/types/host/codex-fetch.d.ts

@@ -1,9 +1,16 @@
 import { type WebFetchProvider } from '@deepseek-ai/dsh-web';
 type FetchLike = typeof fetch;
+/** Resolves a hostname to every address this machine's resolver returns. */
+export type HostAddressResolver = (hostname: string) => Promise<readonly string[]>;
 export interface CodexFetchProviderOptions {
     fetchFn?: FetchLike;
     maxResponseBytes?: number;
     maxBodyChars?: number;
+    /**
+     * Address lookup behind the destination policy. Overridden only by focused
+     * tests; the policy itself is what every request goes through.
+     */
+    resolveHostAddresses?: HostAddressResolver;
 }
 export declare function createCodexFetchProvider(options?: CodexFetchProviderOptions): WebFetchProvider;
 export {};

package/lib/types/host/codex-fetch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex-fetch.d.ts","sourceRoot":"","sources":["../../../src/host/codex-fetch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,KAAK,gBAAgB,EAA6C,MAAM,sBAAsB,CAAA;AAGjH,KAAK,SAAS,GAAG,OAAO,KAAK,CAAA;AAE7B,MAAM,WAAW,yBAAyB;IACxC,OAAO,CAAC,EAAE,SAAS,CAAA;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAKD,wBAAgB,wBAAwB,CACtC,OAAO,GAAE,yBAA8B,GACtC,gBAAgB,CAqFlB"}
+{"version":3,"file":"codex-fetch.d.ts","sourceRoot":"","sources":["../../../src/host/codex-fetch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,KAAK,gBAAgB,EAA6C,MAAM,sBAAsB,CAAA;AAIjH,KAAK,SAAS,GAAG,OAAO,KAAK,CAAA;AAE7B,4EAA4E;AAC5E,MAAM,MAAM,mBAAmB,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAA;AAElF,MAAM,WAAW,yBAAyB;IACxC,OAAO,CAAC,EAAE,SAAS,CAAA;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,mBAAmB,CAAA;CAC3C;AAKD,wBAAgB,wBAAwB,CACtC,OAAO,GAAE,yBAA8B,GACtC,gBAAgB,CAgGlB"}

package/lib/types/host/fetch-address-policy.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Destination policy for this plugin's fetch provider.
+ *
+ * DSH's built-in provider resolves every destination and validates and pins the
+ * address before it connects. That cannot work on a machine whose proxy answers
+ * DNS with its own fake-ip range (`198.18.0.0/15` for Clash/Mihomo, the usual
+ * companion of a system proxy): the hostname is ordinary, the answer is reserved
+ * space, and every request is refused before the proxy that could have resolved
+ * it is ever consulted. This provider exists for that machine, so it cannot
+ * validate names the way the built-in one does.
+ *
+ * It keeps the half of the policy that needs no resolution — an address the URL
+ * states outright is refused unless it is globally reachable unicast, because a
+ * proxy on this machine must not become a path into loopback or a LAN — and it
+ * also refuses a name this machine resolves into private space. Only the proxy's
+ * own fake-ip answers are accepted, since that is what the proxy's name
+ * resolution looks like from here; the URL hostname still reaches the proxy
+ * intact, so the proxy decides where the name really goes.
+ *
+ * @module dsh-chatgpt-subscription/fetch-address-policy
+ */
+/**
+ * Resolve one hostname to every address the local resolver returns, or to no
+ * addresses when it cannot.
+ *
+ * A failure is not evidence of a local destination: the configured proxy
+ * resolves the origin itself, so a name this machine cannot resolve must not
+ * fail a request the proxy could have served.
+ *
+ * @param hostname - the URL hostname, without brackets.
+ * @returns the resolved addresses, or an empty list when resolution failed.
+ */
+export declare function lookupHostAddresses(hostname: string): Promise<readonly string[]>;
+/**
+ * Whether a host is stated as an IP address rather than as a name.
+ *
+ * @param hostname - a URL hostname, bracketed or not.
+ * @returns true when the host is an IPv4 or IPv6 literal.
+ */
+export declare function isIpLiteral(hostname: string): boolean;
+/**
+ * Whether an address is one only a proxy's fake-ip resolver hands out. The IANA
+ * benchmarking range carries no real host, so an answer inside it is this
+ * machine's proxy claiming the name, not a private destination.
+ *
+ * @param address - a textual IPv4 (or IPv4-mapped IPv6) address.
+ * @returns true when the address is inside the proxy fake-ip range.
+ */
+export declare function isProxyFakeIpAddress(address: string): boolean;
+/**
+ * Whether an address is globally reachable unicast. IPv4-mapped IPv6 is
+ * classified by the IPv4 address it embeds; every other IPv6 address is public
+ * only inside `2000::/3`, which excludes loopback, unique-local, link-local,
+ * multicast, and the transition and translation prefixes whose real destination
+ * cannot be seen from the address alone.
+ *
+ * @param address - a textual IPv4 or IPv6 address, bracketed or not.
+ * @returns true only for a public unicast destination.
+ */
+export declare function isPublicIpAddress(address: string): boolean;
+/**
+ * Whether a hostname is an IP literal no request may target.
+ *
+ * @param hostname - a URL hostname, bracketed or not.
+ * @returns true when the host is a literal address that is not public.
+ */
+export declare function isNonPublicIpLiteral(hostname: string): boolean;
+/**
+ * Refuse a fetch destination the local network policy exists to keep out of
+ * reach, before any request is made.
+ *
+ * @param hostname - the URL hostname, bracketed or not.
+ * @param addresses - every address the local resolver returned for the host.
+ * @throws WebError `WEB_BLOCKED_URL` for a non-public literal, or for a name
+ *   this machine resolves into private space that is not the proxy's fake-ip.
+ */
+export declare function assertPublicFetchTarget(hostname: string, addresses: readonly string[]): void;
+//# sourceMappingURL=fetch-address-policy.d.ts.map

package/lib/types/host/fetch-address-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch-address-policy.d.ts","sourceRoot":"","sources":["../../../src/host/fetch-address-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAkCH;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAOtF;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAErD;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAG7D;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAQ1D;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAG9D;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAQ5F"}

package/lib/types/host/search-provider-switcher.d.ts

@@ -3,13 +3,27 @@ import type { SearchProviderPreference } from '../shared/contracts.ts';
 interface LoaderLike {
     entries(): Iterable<Entry>;
 }
+/** What one selection asks for on top of the settings preference. */
+export interface WebProviderSelectionOptions {
+    /**
+     * Whether this plugin's fetch provider must serve the `web_fetch` tool.
+     *
+     * DSH's built-in provider resolves and pins every destination before it
+     * connects and routes through a proxy only when the process environment names
+     * one, so an OS-level proxy plus the fake-ip DNS that usually comes with it
+     * fails every fetch with `WEB_BLOCKED_URL`. Selecting this plugin's provider
+     * hands the origin's resolution to the configured proxy — the same
+     * proxied-hop semantics DSH applies to a URL it routes through a proxy.
+     */
+    readonly pluginFetch?: boolean;
+}
 export declare class SearchProviderSwitcher {
     private readonly loader;
     private originalSearchProvider;
     private originalFetchProvider;
     private initialized;
     constructor(loader: LoaderLike);
-    select(preference: SearchProviderPreference): Promise<void>;
+    select(preference: SearchProviderPreference, options?: WebProviderSelectionOptions): Promise<void>;
     private findWebEntry;
 }
 export {};

package/lib/types/host/search-provider-switcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"search-provider-switcher.d.ts","sourceRoot":"","sources":["../../../src/host/search-provider-switcher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mCAAmC,CAAA;AAG9D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAA;AAEtE,UAAU,UAAU;IAClB,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAA;CAC3B;AAED,qBAAa,sBAAsB;IAKrB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJnC,OAAO,CAAC,sBAAsB,CAAoB;IAClD,OAAO,CAAC,qBAAqB,CAAoB;IACjD,OAAO,CAAC,WAAW,CAAQ;gBAEE,MAAM,EAAE,UAAU;IAEzC,MAAM,CAAC,UAAU,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC;IAkCjE,OAAO,CAAC,YAAY;CAOrB"}
+{"version":3,"file":"search-provider-switcher.d.ts","sourceRoot":"","sources":["../../../src/host/search-provider-switcher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mCAAmC,CAAA;AAG9D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAA;AAEtE,UAAU,UAAU;IAClB,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAA;CAC3B;AAED,qEAAqE;AACrE,MAAM,WAAW,2BAA2B;IAC1C;;;;;;;;;OASG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAC/B;AAED,qBAAa,sBAAsB;IAKrB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJnC,OAAO,CAAC,sBAAsB,CAAoB;IAClD,OAAO,CAAC,qBAAqB,CAAoB;IACjD,OAAO,CAAC,WAAW,CAAQ;gBAEE,MAAM,EAAE,UAAU;IAEzC,MAAM,CAAC,UAAU,EAAE,wBAAwB,EAAE,OAAO,GAAE,2BAAgC,GAAG,OAAO,CAAC,IAAI,CAAC;IAkC5G,OAAO,CAAC,YAAY;CAOrB"}

package/lib/types/host/subagent-model-authorization.d.ts

@@ -0,0 +1,177 @@
+/**
+ * Host-side authorization for the models a subagent may run.
+ *
+ * The `subagent-model-selection` preference is sampled into each Session as a
+ * durable route allowlist, but the built-in delegation tool only rejects an
+ * explicit route outside that list: a call that selects no route lets the child
+ * inherit the parent's model, so a DeepSeek parent could spawn DeepSeek
+ * children even though the allowlist authorizes only other models.
+ *
+ * This guard closes that gap from the plugin plane. Whenever the calling
+ * Session (or the nearest ancestor that recorded one) carries an allowlist,
+ * a delegation whose effective child route the list does not authorize is
+ * denied before the child starts, with the authorized routes in the reason so
+ * the model can retry and pick one of them.
+ * @module dsh-chatgpt-subscription/subagent-model-authorization
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import type { SettingsProvider } from '@deepseek-ai/dsh-settings';
+/** DSH settings namespace owned by the Subagent settings card. */
+export declare const SUBAGENT_MODEL_SELECTION_NAMESPACE = "subagent-model-selection";
+/** Durable Session event carrying one Session's authorized child routes. */
+export declare const SUBAGENT_POLICY_EVENT = "subagent/model-selection-policy";
+/** Delegation tools whose child routes this guard authorizes. */
+export declare const DEFAULT_DELEGATION_TOOLS: readonly string[];
+/** One exact provider/model route the user authorized for children. */
+export interface AllowedModelRoute {
+    readonly provider: string;
+    readonly model: string;
+}
+/** Resolved model-selection preference read from the Host settings document. */
+export interface SubagentModelSelectionPreference {
+    readonly enabled: boolean;
+    readonly allowedModels: readonly AllowedModelRoute[];
+}
+/** One durable Session record this module reads: its events and its lineage. */
+export interface PolicySession {
+    eventAt?(seq: number): {
+        type?: unknown;
+        data?: unknown;
+    } | undefined;
+    readonly header?: {
+        readonly origin?: unknown;
+        readonly parentSession?: unknown;
+    };
+}
+/** Session lookup the guard walks from the calling agent to its ancestors. */
+export interface SessionsResolver {
+    get(id: string): PolicySession | undefined;
+}
+/** Calling agent fields the guard reads. */
+export interface AuthorizationAgent {
+    readonly session?: PolicySession;
+    readonly options?: {
+        readonly provider?: unknown;
+        readonly model?: unknown;
+    };
+}
+/** What the delegation tool received from the model. */
+export interface DelegationArguments {
+    readonly provider?: unknown;
+    readonly model?: unknown;
+}
+/**
+ * Parse the allowlist out of a durable route-policy event.
+ * @param data - `subagent/model-selection-policy` event payload.
+ * @returns every well-formed route, or undefined when the payload carries none.
+ */
+export declare function parseAllowedRoutes(data: unknown): AllowedModelRoute[] | undefined;
+/**
+ * Find one Session's recorded allowlist among its durable events.
+ * @param session - Session whose log is scanned.
+ * @returns the authorized routes, or undefined for a Session that recorded none.
+ */
+export declare function policyRoutesOf(session: PolicySession | undefined): AllowedModelRoute[] | undefined;
+/**
+ * Resolve the allowlist a delegation from this agent must respect: the agent's
+ * own recorded policy, else the nearest ancestor Session that recorded one
+ * (the inheritance the delegation tool applies to child Sessions).
+ * @param agent - Calling agent.
+ * @param sessions - Session registry used for ancestor lookup.
+ * @returns the authorized routes, or undefined when no Session recorded any.
+ */
+export declare function authorizedRoutesFor(agent: AuthorizationAgent | undefined, sessions: SessionsResolver): AllowedModelRoute[] | undefined;
+/**
+ * Read the Host preference that owns the allowlist. Values in the stored
+ * document are untrusted JSON, so every field is narrowed before use.
+ * @param settings - Live settings service, when composed.
+ * @returns the resolved preference, or undefined without a settings service.
+ */
+export declare function subagentModelSelectionPreference(settings: SettingsProvider | undefined): SubagentModelSelectionPreference | undefined;
+/**
+ * Build the denial reason for a delegation that would run on an unauthorized
+ * route. The reason names the authorized routes so the next call can select one.
+ * @param provider - Effective child provider id, when one is known.
+ * @param model - Effective child model id, when one is known.
+ * @param allowed - Routes the calling Session authorizes.
+ * @param explicit - Whether the model named the route in the tool arguments.
+ * @returns the corrective reason handed back to the model.
+ */
+export declare function unauthorizedRouteReason(provider: string | undefined, model: string | undefined, allowed: readonly AllowedModelRoute[], explicit: boolean): string;
+/** Which Session's recorded allowlist a delegation must respect. */
+export type AuthorizationScope = 
+/**
+ * `session` (default): a Session that recorded an allowlist governs itself
+ * and its descendants, matching the delegation tool's durable snapshot; a
+ * Session that recorded none keeps the built-in behavior.
+ */
+'session'
+/**
+ * `preference`: the current Host preference also governs Sessions that never
+ * recorded an allowlist, so the Settings card applies without restarting the
+ * Session. A Session that recorded its own routes still outranks it.
+ */
+ | 'preference';
+/**
+ * Decide whether one delegation call may start its child.
+ * @param agent - Calling agent.
+ * @param toolName - Tool being dispatched.
+ * @param args - Parsed tool arguments.
+ * @param preference - Current Host preference, when the settings service exists.
+ * @param sessions - Session registry used for ancestor lookup.
+ * @param toolNames - Delegation tool names this guard authorizes.
+ * @param scope - Whether an unrecorded Session falls back to the preference.
+ * @returns a denial reason, or undefined to leave the call untouched.
+ */
+export declare function delegationDenialReason(agent: AuthorizationAgent | undefined, toolName: string, args: unknown, preference: SubagentModelSelectionPreference | undefined, sessions: SessionsResolver, toolNames?: readonly string[], scope?: AuthorizationScope): string | undefined;
+/** Runtime inputs the guard closes over. */
+export interface SubagentAuthorizationOptions {
+    /** Live settings service, when composed; absent leaves recorded policies in charge. */
+    readonly settings?: SettingsProvider;
+    /** Session registry used for ancestor lookup. */
+    readonly sessions: SessionsResolver;
+    /** Exact delegation tool names this guard authorizes. */
+    readonly toolNames: readonly string[];
+    /** Whether an unrecorded Session falls back to the current preference. */
+    readonly scope?: AuthorizationScope;
+}
+/** The exact guard signature the Host tool registry evaluates. */
+export type DelegationGuard = (agent: AuthorizationAgent | undefined, toolName: string, args: unknown) => string | undefined;
+/**
+ * Build the monotonic tool guard for one deployment. The Host preference is
+ * sampled from the live settings document on every call, because a settings
+ * edit must not rebuild the guard the way it cannot rebuild a Session.
+ * @param options - settings, session registry, and delegation tool names.
+ * @returns a guard that denies delegations outside the Session allowlist.
+ */
+export declare function createSubagentAuthorization(options: SubagentAuthorizationOptions): DelegationGuard;
+/** Delegation names this guard recognizes when configuration omits them. */
+export declare function normalizeDelegationToolNames(value: unknown): string[];
+/**
+ * Validate the plugin configuration that owns this guard.
+ * @param toolNames - Candidate delegation tool names.
+ * @returns the exact names this guard authorizes.
+ */
+export declare function validateDelegationToolNames(toolNames: readonly string[]): string[];
+/** Configuration accepted by {@link installSubagentModelAuthorization}. */
+export interface SubagentModelAuthorizationConfig {
+    /** Delegation tool names the guard authorizes. */
+    readonly toolNames?: readonly string[];
+    /** Whether an unrecorded Session falls back to the current preference. */
+    readonly scope?: AuthorizationScope;
+}
+/**
+ * Register the monotonic guard on the Host tool registry.
+ * @param ctx - Host context carrying `tools` (and optionally `settings`).
+ * @param sessions - Session registry used for ancestor lookup.
+ * @param config - Enforcement toggle and delegation tool names.
+ * @returns the exact disposer that unregisters the guard.
+ */
+export declare function installSubagentModelAuthorization(ctx: Context, sessions: SessionsResolver, config?: SubagentModelAuthorizationConfig): () => void;
+/**
+ * Validate the configured authorization scope.
+ * @param scope - Candidate scope from deployment configuration.
+ * @returns the exact scope this guard enforces.
+ */
+export declare function validateAuthorizationScope(scope: unknown): AuthorizationScope;
+//# sourceMappingURL=subagent-model-authorization.d.ts.map

package/lib/types/host/subagent-model-authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"subagent-model-authorization.d.ts","sourceRoot":"","sources":["../../../src/host/subagent-model-authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAIjE,kEAAkE;AAClE,eAAO,MAAM,kCAAkC,6BAA6B,CAAA;AAE5E,4EAA4E;AAC5E,eAAO,MAAM,qBAAqB,oCAAoC,CAAA;AAEtE,iEAAiE;AACjE,eAAO,MAAM,wBAAwB,EAAE,SAAS,MAAM,EAAiB,CAAA;AAEvE,uEAAuE;AACvE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACvB;AAED,gFAAgF;AAChF,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,aAAa,EAAE,SAAS,iBAAiB,EAAE,CAAA;CACrD;AAED,gFAAgF;AAChF,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG;QAAE,IAAI,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,SAAS,CAAA;IACrE,QAAQ,CAAC,MAAM,CAAC,EAAE;QAChB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;QACzB,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAA;KACjC,CAAA;CACF;AAED,8EAA8E;AAC9E,MAAM,WAAW,gBAAgB;IAC/B,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAAA;CAC3C;AAED,4CAA4C;AAC5C,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAA;IAChC,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;CAC7E;AAED,wDAAwD;AACxD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CACzB;AA+BD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,iBAAiB,EAAE,GAAG,SAAS,CAajF;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,aAAa,GAAG,SAAS,GAAG,iBAAiB,EAAE,GAAG,SAAS,CAiBlG;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,kBAAkB,GAAG,SAAS,EACrC,QAAQ,EAAE,gBAAgB,GACzB,iBAAiB,EAAE,GAAG,SAAS,CAYjC;AAED;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAC9C,QAAQ,EAAE,gBAAgB,GAAG,SAAS,GACrC,gCAAgC,GAAG,SAAS,CAwB9C;AAWD;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,OAAO,EAAE,SAAS,iBAAiB,EAAE,EACrC,QAAQ,EAAE,OAAO,GAChB,MAAM,CAWR;AAED,oEAAoE;AACpE,MAAM,MAAM,kBAAkB;AAC5B;;;;GAIG;AACD,SAAS;AACX;;;;GAIG;GACD,YAAY,CAAA;AAEhB;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,kBAAkB,GAAG,SAAS,EACrC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,EACb,UAAU,EAAE,gCAAgC,GAAG,SAAS,EACxD,QAAQ,EAAE,gBAAgB,EAC1B,SAAS,GAAE,SAAS,MAAM,EAA6B,EACvD,KAAK,GAAE,kBAA8B,GACpC,MAAM,GAAG,SAAS,CA0BpB;AAED,4CAA4C;AAC5C,MAAM,WAAW,4BAA4B;IAC3C,uFAAuF;IACvF,QAAQ,CAAC,QAAQ,CAAC,EAAE,gBAAgB,CAAA;IACpC,iDAAiD;IACjD,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAA;IACnC,yDAAyD;IACzD,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,0EAA0E;IAC1E,QAAQ,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAA;CACpC;AAED,kEAAkE;AAClE,MAAM,MAAM,eAAe,GAAG,CAC5B,KAAK,EAAE,kBAAkB,GAAG,SAAS,EACrC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,KACV,MAAM,GAAG,SAAS,CAAA;AAEvB;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,4BAA4B,GACpC,eAAe,CAUjB;AAED,4EAA4E;AAC5E,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAKrE;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAUlF;AAED,2EAA2E;AAC3E,MAAM,WAAW,gCAAgC;IAC/C,kDAAkD;IAClD,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACtC,0EAA0E;IAC1E,QAAQ,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAA;CACpC;AAED;;;;;;GAMG;AACH,wBAAgB,iCAAiC,CAC/C,GAAG,EAAE,OAAO,EACZ,QAAQ,EAAE,gBAAgB,EAC1B,MAAM,GAAE,gCAAqC,GAC5C,MAAM,IAAI,CAOZ;AACD;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,kBAAkB,CAK7E"}

package/lib/types/index.d.ts

@@ -1,7 +1,27 @@
 import type { Context } from '@deepseek-ai/cordis';
+import z from '@deepseek-ai/schemastery';
+/** Optional deployment configuration for this plugin. */
+export interface Config {
+    /**
+     * Whether the Subagent model allowlist also governs the route a delegation
+     * that selects no model would inherit from its parent. Default `true`; set
+     * `false` to leave inherited routes to the built-in delegation tool.
+     */
+    subagentModelAuthorization?: boolean;
+    /** Delegation tool names the authorization guard recognizes (default `subagent`). */
+    subagentModelTools?: string[];
+    /**
+     * `session` (default) enforces the allowlist a Session recorded, matching the
+     * delegation tool's snapshot; `preference` also enforces the current Settings
+     * card allowlist for Sessions that recorded none.
+     */
+    subagentModelScope?: 'session' | 'preference';
+}
+export declare const Config: z<Config>;
 export declare const inject: string[];
-export declare function apply(ctx: Context): void;
+export declare function apply(ctx: Context, pluginConfig?: Config): void;
 export { ProxyManager, detectSystemProxy } from './host/proxy-manager.ts';
+export { SUBAGENT_MODEL_SELECTION_NAMESPACE, SUBAGENT_POLICY_EVENT, authorizedRoutesFor, createSubagentAuthorization, delegationDenialReason, installSubagentModelAuthorization, normalizeDelegationToolNames, parseAllowedRoutes, policyRoutesOf, subagentModelSelectionPreference, unauthorizedRouteReason, validateAuthorizationScope, validateDelegationToolNames, } from './host/subagent-model-authorization.ts';
 export { OAuthService } from './host/oauth-service.ts';
 export { CodexChatGptAdapter } from './host/adapter.ts';
 export { createCodexImageTool } from './host/codex-images.ts';

package/lib/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AA+BlD,eAAO,MAAM,MAAM,UAAqE,CAAA;AAExF,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAuExC;AAED,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAC7D,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAA;AAClE,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAA;AAChE,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AAClF,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AACtF,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAA;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAA;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAA;AACtE,YAAY,EAAE,UAAU,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAA;AAE/E,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAA;AAClE,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,cAAc,EACd,iBAAiB,GAClB,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAA;AAClG,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,CAAC,MAAM,0BAA0B,CAAA;AAsCxC,yDAAyD;AACzD,MAAM,WAAW,MAAM;IACrB;;;;OAIG;IACH,0BAA0B,CAAC,EAAE,OAAO,CAAA;IACpC,qFAAqF;IACrF,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC7B;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,SAAS,GAAG,YAAY,CAAA;CAC9C;AAED,eAAO,MAAM,MAAM,EAAE,CAAC,CAAC,MAAM,CAI3B,CAAA;AAEF,eAAO,MAAM,MAAM,UAAqE,CAAA;AAExF,wBAAgB,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,YAAY,GAAE,MAAW,GAAG,IAAI,CAsGnE;AAED,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AACzE,OAAO,EACL,kCAAkC,EAClC,qBAAqB,EACrB,mBAAmB,EACnB,2BAA2B,EAC3B,sBAAsB,EACtB,iCAAiC,EACjC,4BAA4B,EAC5B,kBAAkB,EAClB,cAAc,EACd,gCAAgC,EAChC,uBAAuB,EACvB,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAC7D,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAA;AAClE,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAA;AAChE,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AAClF,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AACtF,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAA;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAA;AACnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAA;AACtE,YAAY,EAAE,UAAU,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAA;AAE/E,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAA;AAClE,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,cAAc,EACd,iBAAiB,GAClB,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAA;AAClG,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eddyskywalker/dsh-chatgpt-subscription",
-  "version": "0.2.15",
+  "version": "0.2.17",
   "description": "DSH provider plugin for Codex access through a ChatGPT subscription.",
   "author": {
     "name": "eddyskywalker",