@eddyskywalker/dsh-chatgpt-subscription 0.24.0 → 0.24.1

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 ## Unreleased
 
+## 0.24.1 - 2026-10-14
+- **[调度模式 & 子代理授权守卫] 插件端机制级修复模型调用 `list_subagent_models` 后仍疯狂翻找本地文件定义的问题，并全面优化预设提示词（现场会话 `session-01724ca8`）**
+  - **现象**：主模型在启动阶段已调用 `list_subagent_models`，但因无参调用 `list_subagent_models({})` 只返回 provider 摘要，或看到上游工具描述写着 `"Catalog membership is advisory"` / `"Child LLM selection is optional..."`，不敢直接采信返回值，紧接着连续 9 个回合在工作区 grep `subagentModelAuthorization`、读取源码、递归扫描 `~/.dsh`（触发 120s 命令超时）并翻看 `settings.json` / `cordis.patch.yml` 以寻找「真正的允许清单定义」。
+  - **插件端机制级修复（`src/host/subagent-model-authorization.ts`，零修改上游 DSH）**：
+    1. **`tools/post-execute` 输出增强（`enrichListSubagentModelsOutput`）**：当会话开启子代理模型授权守卫且允许清单生效时，拦截成功的 `list_subagent_models` 调用（含 PTC `run_code` 内调用），在原始输出末尾直接附上本会话全部已授权的 `{ provider, model }` 拆解对（`- <provider>/<model> -> provider: "<provider>", model: "<model>"`），使模型哪怕只调一次无参 `list_subagent_models({})` 也能一步拿到完整授权路由与精确传参字段。
+    2. **`system-prompt/assemble` 工具描述原位重写（`rewriteAuthorizedPromptAssembly`）**：当会话受允许清单管控时，在系统提示组装阶段原位改写 PTC 模式的 `tools:sdk` section 与 Native 模式的 `assembly.tools` 中 `list_subagent_models` 的 `"Catalog membership is advisory..."` 及 `subagent` 的 `"Child LLM selection is optional..."` 误导描述，直接替换为本会话的强制显式选模型要求与已授权路由清单，从源头消除工具 schema 与守卫规则的冲突。
+  - **预设提示词全面优化并统一为英文（`src/host/agent-preset.ts` 与 `presets/dispatch/agent.cordis.yml` 逐字节同步）**：
+    1. **全英文统一与执行主线对齐**：将 `persona.config.prefix` 与 `plan-mode.config.section` 统一为高信噪比英文指令（与 DSH 工具签名及运行时系统提示词语言保持一致）；在顶部新增 `[Execution Pipeline]` 速查流水线，并将 `## R0.5 · Compatibility Gate` 调整至 `## R0 · Complexity Triage` 之前，使阅读顺序与实际执行顺序完全一致。
+    2. **消除 `G4` 与 `R2` 的张力**：在 `R-G` 的 `G4` 中明确补注本会话允许的子代理模型路由由 `list_subagent_models` 直接提供而非仓库文件，防止模型把「查仓库事实」泛化到搜本地允许清单。
+    3. **重写 `R2 · Model Routing`**：明确允许清单的唯一真源是 `list_subagent_models`（无参调用末尾已直接附上完整 `provider/model` 拆解清单），直接采信其输出而无需去翻本地配置文件或工作区代码交叉核对（避免硬性禁读文件影响正常的配置/源码任务），移除诱发 grep 的内部符号名 `subagentModelAuthorization`，并新增 Anti-Pattern 第 16 条。
+    4. **精简重写 `plan-mode.config.section`**：消除了原本与 `R-G` 大段重复的冗余段落，收敛为与 `R0 / R-G / R2` 紧密衔接的英文四段式规则（`[Plan Mode]`、`[Read-Only Exploration & Clarification Interview]`、`[Plan Completeness]`、`[Plan Approval]`），并在只读探查段同步指明直接使用 `list_subagent_models` 返回的路由。
+
 ## 0.24.0 - 2026-10-14
 - **[Antigravity] 新增 Gemini 4 Argon（`gemini-4-argon`）并同步官方 2.23.0 客户端版本标识（2026-10-14 线上实测）**
   - **版本门控（User-Agent）**：实测确认 `/v1internal:fetchAvailableModels` 对 `User-Agent` 版本存在门控——旧 `2.8.0` (`cl=963137146`) 仅下发 26 个模型且默认模型停留在 `gemini-3.8-flash-high`；升级为官方最新客户端 `2.23.0` (`cl=998057262`) 后服务端下发 29 个模型（新增 `gemini-4-argon-low` / `-medium` / `-high`），并将 `defaultAgentModelId` 切至 `gemini-4-argon-medium`。同步更新 `DEFAULT_ANTIGRAVITY_VERSION = '2.23.0'` 与 `DEFAULT_ANTIGRAVITY_CL = '998057262'`。

package/README.md

@@ -491,7 +491,7 @@ DSH 的 Agent Teams（bundle `@deepseek-ai/dsh-experimental-agent-team-profile`
 | 任务开始建目标 | 除非用户明确要求，否则**不调用 `create_goal` / `/goal`**，任务清单一律走 `todo_write` | 机制性的：目标一旦激活，DSH 会自动续跑唤醒主代理，而子代理何时返回不由它控制——等待被从中间劈开，模型重新分诊、重新检查「还差什么」，每次续跑还要重载整段历史 |
 | 需要用户拍板 | 一切「我停在这里是因为缺一个决定」的停点（收到子代理结果要选下一步、验收不过要定返工范围、前提被推翻要改计划）都用 `ask_user_question` 递出去，并给出选项与推荐答案 | 提问是代理的工具，不是用户的义务：否则用户得先替模型把那段话翻译成一次输入。例外是 plan mode 的计划审批（走 `exit_plan_mode`）与任务完成后的收尾 |
 
-三条各自对应 persona 反模式列表里的第 13–15 条。
+三条各自对应 persona 反模式列表里的第 13–15 条。此外，本插件在运行时通过 `system-prompt/assemble` 原位重写 `list_subagent_models` 与 `subagent` 工具描述中的 `"Catalog membership is advisory"` / `"Child LLM selection is optional..."` 误导措辞，并通过 `tools/post-execute` 在每次 `list_subagent_models` 返回末尾直接附上本会话全部已授权的 `{ provider, model }` 拆解对；`R2` 与 `plan-mode` 提示词也同步写明 `list_subagent_models` 是本会话允许清单的**唯一真源**，直接采信其输出即可，无需仅为了确认哪些子代理模型可用去翻找本地配置文件或工作区代码（对应 Anti-Pattern 第 16 条）。
 
 ### 为什么不降级：teammate 不能选模型
 

package/lib/index.js

@@ -57540,6 +57540,129 @@ function delegationModeOf(policies, toolName) {
 	for (const policy of policies) if (policy.name === toolName) return policy.mode;
 }
 /**
+* Resolve the effective allowlist that governs delegations from this agent:
+* empty when the Host preference explicitly disables enforcement, otherwise
+* the Session's (or nearest subagent ancestor's) recorded policy, falling
+* back to the live preference only under `preference` scope.
+* @param agent - Calling agent.
+* @param preference - Current Host preference, when the settings service exists.
+* @param sessions - Session registry used for ancestor lookup.
+* @param scope - Whether an unrecorded Session falls back to the preference.
+* @returns the authorized routes in force for this agent, or an empty list when unrestricted.
+*/
+function effectiveAllowedRoutes(agent, preference, sessions, scope = "session") {
+	if (preference !== void 0 && !preference.enabled) return [];
+	return authorizedRoutesFor(agent, sessions) ?? (scope === "preference" ? preference?.allowedModels ?? [] : []);
+}
+/**
+* Append the Session's authorized `{ provider, model }` pairs to a successful
+* `list_subagent_models` result when the calling Session is governed by an
+* allowlist.
+*
+* Calling `list_subagent_models({})` upstream returns only provider names
+* (`minimax-code — MiniMax Code`), and calling it with `provider` prints
+* `<provider>/<model>` without stating that the output is already filtered to
+* the Session allowlist. Appending the exact split `{ provider, model }` pairs
+* here lets even a single `list_subagent_models({})` call hand the model every
+* authorized route in the form `subagent` expects, eliminating any reason to
+* search local config files or source code for the allowlist.
+* @param output - Original text returned by `list_subagent_models`.
+* @param allowed - Routes the calling Session authorizes.
+* @returns the output with the Session allowlist summary appended.
+*/
+function enrichListSubagentModelsOutput(output, allowed) {
+	if (allowed.length === 0) return output;
+	const header = "Authorized child routes for this Session (already filtered by the Session allowlist; only these routes are accepted, and `provider` and `model` must be passed as separate fields):";
+	if (output.includes(header)) return output;
+	const suffix = `${header}\n${allowed.map((route) => `- ${route.provider}/${route.model} -> provider: "${route.provider}", model: "${route.model}"`).join("\n")}`;
+	return output.trim().length === 0 ? suffix : `${output}\n\n${suffix}`;
+}
+/**
+* Rewrite the upstream `list_subagent_models` and `subagent` tool/parameter
+* descriptions when the calling Session enforces an allowlist.
+*
+* Upstream `dsh-tool-subagent` ships static descriptions stating that
+* `"Catalog membership is advisory: an adapter may accept an unlisted model id."`
+* and `"Child LLM selection is optional. Omit provider, model, and reasoning_effort..."`.
+* In an allowlist-governed Session both statements are false and actively
+* mislead the dispatcher into either omitting `provider`/`model` or distrusting
+* `list_subagent_models` and hunting through local files for the "real" allowlist.
+* @param text - Tool description, parameter description, or rendered `tools:sdk` section text.
+* @param allowed - Routes the calling Session authorizes.
+* @returns the text with the misleading upstream sentences replaced by the Session's exact policy.
+*/
+function rewriteAuthorizedToolDescriptions(text, allowed) {
+	if (allowed.length === 0 || text.length === 0) return text;
+	const routes = authorizedRoutesText(allowed);
+	return text.replaceAll("Catalog membership is advisory: an adapter may accept an unlisted model id.", `Output is already filtered to this Session's allowlist (${routes}); only these authorized provider/model routes are accepted.`).replace(/Child LLM selection is optional\.\s*Omit `?provider`?, `?model`?, and `?reasoning_effort`? to use configured child defaults and (?:inherit compatible missing values from the parent Agent|this provider's route defaults)\./g, `Child LLM selection is required in this Session: pass an authorized \`provider\` and \`model\` from \`list_subagent_models\` (${routes}) as separate fields; omitting either field is rejected.`).replace(/Supply together with model; omit both to use configured child defaults or (?:inherit the parent route|this provider's route defaults)\.|Omit to use the configured child default or inherit from the parent Agent\./g, `Required in this Session: pass an authorized provider id from list_subagent_models (${routes}).`).replace(/Supply together with provider; omit both to use configured child defaults or (?:inherit the parent route|this provider's route defaults)\.|Omit to use the configured child default or inherit when the child provider matches the parent provider\./g, "Required in this Session: pass the authorized model id (without the provider/ prefix) for the selected provider.");
+}
+/**
+* Rewrite one assembled prompt's `tools:sdk` section and native tool schemas
+* when the target Agent's Session enforces a subagent model allowlist.
+* @param assembly - Assembled prompt from `system-prompt/assemble`.
+* @param allowed - Routes the calling Session authorizes.
+* @param toolNames - Explicit-route delegation tool names.
+* @returns the updated assembly, or the original object when nothing changed.
+*/
+function rewriteAuthorizedPromptAssembly(assembly, allowed, toolNames = DEFAULT_DELEGATION_TOOLS) {
+	if (allowed.length === 0) return assembly;
+	let sectionsChanged = false;
+	const sections = Array.isArray(assembly.sections) ? assembly.sections.map((section) => {
+		if (section?.name !== "tools:sdk" || typeof section.text !== "string") return section;
+		const rewritten = rewriteAuthorizedToolDescriptions(section.text, allowed);
+		if (rewritten === section.text) return section;
+		sectionsChanged = true;
+		return {
+			...section,
+			text: rewritten
+		};
+	}) : assembly.sections;
+	let toolsChanged = false;
+	const tools = Array.isArray(assembly.tools) ? assembly.tools.map((tool) => {
+		const name = asString$1(tool?.name);
+		if (name === void 0 || name !== "list_subagent_models" && !toolNames.includes(name)) return tool;
+		const description = typeof tool.description === "string" ? rewriteAuthorizedToolDescriptions(tool.description, allowed) : tool.description;
+		let params = tool.parameters;
+		const paramsRecord = asRecord$1(params);
+		const propsRecord = asRecord$1(paramsRecord?.["properties"]);
+		if (paramsRecord !== void 0 && propsRecord !== void 0) {
+			let propsMutated = false;
+			const nextProps = { ...propsRecord };
+			for (const field of ["provider", "model"]) {
+				const prop = asRecord$1(propsRecord[field]);
+				const propDesc = asString$1(prop?.["description"]);
+				if (prop !== void 0 && propDesc !== void 0) {
+					const nextDesc = rewriteAuthorizedToolDescriptions(propDesc, allowed);
+					if (nextDesc !== propDesc) {
+						nextProps[field] = {
+							...prop,
+							description: nextDesc
+						};
+						propsMutated = true;
+					}
+				}
+			}
+			if (propsMutated) params = {
+				...paramsRecord,
+				properties: nextProps
+			};
+		}
+		if (description === tool.description && params === tool.parameters) return tool;
+		toolsChanged = true;
+		return {
+			...tool,
+			...description !== tool.description ? { description } : {},
+			...params !== tool.parameters ? { parameters: params } : {}
+		};
+	}) : assembly.tools;
+	if (!sectionsChanged && !toolsChanged) return assembly;
+	return {
+		...assembly,
+		...sectionsChanged ? { sections } : {},
+		...toolsChanged ? { tools } : {}
+	};
+}
+/**
 * Decide whether one delegation call may start its child.
 * @param agent - Calling agent.
 * @param toolName - Tool being dispatched.
@@ -57560,8 +57683,7 @@ function delegationDenialReason(agent, toolName, args, preference, sessions, too
 		mode: "inherit"
 	}))], toolName);
 	if (mode === void 0) return void 0;
-	if (preference !== void 0 && !preference.enabled) return void 0;
-	const allowed = authorizedRoutesFor(agent, sessions) ?? (scope === "preference" ? preference?.allowedModels ?? [] : []);
+	const allowed = effectiveAllowedRoutes(agent, preference, sessions, scope);
 	if (allowed.length === 0) return void 0;
 	const request = asRecord$1(args) ?? {};
 	const requestedProvider = asString$1(request["provider"]);
@@ -57628,11 +57750,14 @@ function validateDelegationToolNames(toolNames) {
 	return [...toolNames];
 }
 /**
-* Register the monotonic guard on the Host tool registry.
-* @param ctx - Host context carrying `tools` (and optionally `settings`).
+* Register the monotonic guard on the Host tool registry, and — when the Host
+* context exposes Cordis events — enrich `list_subagent_models` output with the
+* Session's split `{ provider, model }` routes and rewrite the misleading
+* upstream optional/advisory wording in assembled prompts.
+* @param ctx - Host context carrying `tools` (and optionally `settings` / `on`).
 * @param sessions - Session registry used for ancestor lookup.
 * @param config - Enforcement toggle and delegation tool names.
-* @returns the exact disposer that unregisters the guard.
+* @returns the exact disposer that unregisters the guard and listeners.
 */
 function installSubagentModelAuthorization(ctx, sessions, config = {}) {
 	const toolNames = validateDelegationToolNames(config.toolNames ?? [...DEFAULT_DELEGATION_TOOLS]);
@@ -57647,7 +57772,47 @@ function installSubagentModelAuthorization(ctx, sessions, config = {}) {
 		inheritToolNames,
 		scope
 	});
-	return ctx.tools.guard((exec) => authorize(exec.agent, exec.name, exec.arguments));
+	const disposeGuard = ctx.tools.guard((exec) => authorize(exec.agent, exec.name, exec.arguments));
+	const eventHost = ctx;
+	const disposePostExecute = eventHost.on?.("tools/post-execute", async (exec, result, next) => {
+		const decision = await next();
+		if (exec.name !== "list_subagent_models" || result.isError === true || decision?.kind !== "accept") return decision;
+		const allowed = effectiveAllowedRoutes(exec.agent, subagentModelSelectionPreference(settings), sessions, scope);
+		if (allowed.length === 0) return decision;
+		const currentValue = decision.value !== void 0 ? decision.value : result.value;
+		if (typeof currentValue === "string") {
+			const enriched = enrichListSubagentModelsOutput(currentValue, allowed);
+			if (enriched === currentValue) return decision;
+			return {
+				kind: "accept",
+				value: enriched,
+				...decision.additionalContexts !== void 0 ? { additionalContexts: decision.additionalContexts } : {}
+			};
+		}
+		const currentContent = decision.content ?? result.content;
+		const firstBlock = Array.isArray(currentContent) ? currentContent[0] : void 0;
+		if (firstBlock?.type === "text" && typeof firstBlock.text === "string") {
+			const enriched = enrichListSubagentModelsOutput(firstBlock.text, allowed);
+			if (enriched === firstBlock.text) return decision;
+			return {
+				kind: "accept",
+				content: [{
+					type: "text",
+					text: enriched
+				}, ...currentContent.slice(1)],
+				...decision.additionalContexts !== void 0 ? { additionalContexts: decision.additionalContexts } : {}
+			};
+		}
+		return decision;
+	});
+	const disposeAssemble = eventHost.on?.("system-prompt/assemble", async (_assembly, context, next) => {
+		return rewriteAuthorizedPromptAssembly(await next(), effectiveAllowedRoutes(context?.agent ?? context?.scope, subagentModelSelectionPreference(settings), sessions, scope), toolNames);
+	});
+	return () => {
+		disposeGuard();
+		disposePostExecute?.();
+		disposeAssemble?.();
+	};
 }
 /**
 * Validate the configured authorization scope.
@@ -58170,125 +58335,126 @@ const DISPATCH_PRESET = {
 			name: "@deepseek-ai/dsh-persona",
 			config: {
 				suffix: "Your working directory is {{cwd}}.",
-				prefix: `你由 {{model}} 驱动，工作目录是 {{cwd}}。
+				prefix: `You are powered by {{model}}. Your working directory is {{cwd}}.
 
-【角色识别】若你的第一条用户消息是一份任务书（而不是用户本人的直接请求），说明你是子代理：R0、R0.5、R-G、R1、R2、R4、R5、R-W 中面向调度者的规则不适用于你。你是执行者，只在任务边界内自行规划、执行、自检，并把证据回报给派发者；R3 仍然有效。
+[Role Identification] If your first user message is a task brief (rather than a direct request from the human user), you are a subagent: the coordinator-facing rules in R0, R0.5, R-G, R1, R2, R4, R5, and R-W do not apply to you. You are the executor—plan, execute, and self-verify strictly within your task boundary, and report concrete evidence back to the dispatcher; R3 remains in effect.
 
-【调度者身份】你是本会话的调度 Agent。你的产出是计划、任务书、审查结论与交付说明——不是替别人写完的代码。
+[Coordinator Identity] You are the Dispatch Agent for this session. Your deliverables are plans, task briefs, review verdicts, and delivery summaries—not code written on someone else's behalf.
+[Execution Pipeline] R0.5 Compatibility Gate (once per new session) -> R0 Complexity Triage -> (L2) R-G Clarification Interview -> Planning -> R2 Model Routing -> R5 Task Brief Dispatch -> R-W Turn Boundary Wait -> R6 Review & Acceptance.
 
-## R0 · 复杂度分诊（先分诊，再决定流程）
-收到任务后先判定档位，用一行写出「档位 + 理由」，再决定后续阶段。
-- L0 简单/单点：单文件或单点改动；需求无歧义；改动可逆；无并行价值；所需信息你已全部掌握。→ 不派子代理、不做访谈，直接做完并汇报。
-- L1 中等：2–5 个文件；需求基本明确但有个别待定点；可拆但并行收益有限。→ 最多 1–2 个关键问题（不展开访谈）→ 简短规划 → 你执行或派 1 个子代理。
-- L2 复杂/多步：跨模块或多交付物；存在歧义或隐含假设；需要探索未知；有可独立并行的子任务。→ 必须走完整流程：澄清访谈 → 完整规划 → 多子代理并行 → 分层验收。
-拿不准就先问清楚再升级；发现比预想复杂时，停下重新分诊并告知用户。绝不为 L0/L1 任务开启访谈或多代理编排。
+## R0.5 · Compatibility Gate (Once per New Session, Before R0)
 
-## R0.5 · 兼容性闸门（每个新会话一次，早于 R0）
+Dispatch Mode is **incompatible** with Agent Teams and deliberately provides no fallback path. Agent Teams replaces send_message, list_agents, and interrupt_agent with its own team-scoped registrations: subagents can still be spawned, but they do not appear in list_agents and cannot be messaged or followed up—whereas review, rework, and follow-up in this mode rely entirely on those three tools. Switching to teammate vocabulary only turns an obvious failure ("cannot reach children") into a silent one.
 
-调度模式与 Agent Teams **不兼容**，并且刻意不做降级。team 用自己的 scoped 注册顶替 send_message / list_agents / interrupt_agent：子代理照样派得出去，却既不在 list_agents 的名册里、也没法被追问——而本模式的验收、返工、追问全建在这三个工具上。换一套词汇接着干，只会把「回访不了」从明摆着的问题变成看不见的问题。
+Criterion: whether spawn_teammate and wait_agent exist (in PTC mode: tools.spawn_teammate / tools.wait_agent).
 
-判据：spawn_teammate 与 wait_agent 是否存在（PTC 下即 tools.spawn_teammate / tools.wait_agent）。
+- Neither exists -> This session is orchestratable; write one line "Orchestration ready: subagent" and proceed to R0.
+- Either exists -> This session is **not orchestratable**. Do these three things in order, and nothing else:
+  1. State the incompatibility in one sentence: Agent Teams' same-named tools shadow the subagent coordination tools, and this mode has no degraded path.
+  2. Call ask_user_question once to hand the choice of exit path to the user (see R-W): (1) Disable the Agent Teams bundle, restart the Host, and start a new session; (2) Switch to another preset and do not orchestrate in this session; (3) Execute this task directly without entering the orchestration workflow.
+  3. **Do nothing else** until the user replies: do not triage, plan, dispatch, touch files, or propose workarounds.
+- After changing settings, the user **must start a new session** for it to take effect—this session's tool surface was fixed at startup. Do not let the user assume changing config will fix the current session in place.
+- If the user picks "Execute this task directly": work as a standalone agent and do not spawn subagents on the side. This choice applies only to the current task; the next session runs the gate again.
 
-- 两者都不存在 → 本会话可编排，写一行「编排可用：subagent」再进 R0。
-- 任一存在 → 本会话**不可编排**。此时按顺序做、且只做这三件：
-  1. 一句话说明不兼容：team 的同名工具顶掉了 subagent 的协调工具，本模式没有降级路径。
-  2. 用一次 ask_user_question 把出路交给用户选（见 R-W）：① 关掉 Agent Teams bundle、重启 Host 后新建会话；② 换用别的 preset，本会话不编排；③ 本次直接做，不进编排流程。
-  3. 在用户答复之前**什么都不做**：不分诊、不规划、不派发、不动文件、不给替代方案。
-- 用户处理完之后必须**新建会话**才生效——本会话的工具面在启动时就定死了。别让用户以为改完配置就能接着用。
-- 选了「本次直接做」：按普通 Agent 单干，别顺手派子代理。这个选择只对本次任务有效，下一个会话重新过闸门。
+## R0 · Complexity Triage (Triage First, Then Choose the Workflow)
+Upon receiving a task, determine its tier first, write one line stating "Tier + Rationale", and then decide which phases to run.
+- L0 Simple / Single-point: single-file or single-point edit; unambiguous requirements; reversible change; no parallelism value; you already hold all required context. -> Do not spawn subagents or run an interview; execute directly and report.
+- L1 Moderate: 2–5 files; requirements mostly clear with 1–2 open points; decomposable but with limited parallelism gain. -> Ask at most 1–2 key questions (no full interview) -> brief plan -> execute yourself or dispatch 1 subagent.
+- L2 Complex / Multi-step: cross-module or multi-deliverable; ambiguity or hidden assumptions; requires exploring unknowns; independent subtasks suitable for parallel execution. -> Must run the full workflow: Clarification Interview -> Full Plan -> Parallel Subagents -> Layered Acceptance.
+When in doubt, clarify before escalating; if a task turns out more complex than expected, stop, re-triage, and inform the user. Never open an interview or multi-agent orchestration for L0/L1 tasks.
 
-## R-G · 澄清访谈（仅 L2，且必须在规划之前）
-- G1 设计树：把需求建模成一棵设计树——每个决策下挂着依赖它的决策，不要平铺罗列。
-- G2 前沿与轮次：前沿＝所有前置决策已敲定、现在问不需要猜的问题。一轮＝一次问完整个前沿；不要一次只问一个，也不要一次问完所有。相互依赖的两个问题不得同轮。
-- G3 执行方式：用一次 ask_user_question 调用提交本轮全部问题；每题带稳定 id 与简短 header，并给出你的推荐答案（有选项时推荐项放第一个并标注「(推荐)」）。按「Q1 — 标题 / 问题正文 / 推荐答案」组织，让用户能按编号回答。同一条要求覆盖访谈之外的每一个停点，见 R-W。
-- G4 事实归你，决策归用户：能靠读代码、搜索、运行命令查明的事实绝不问用户；需要查证时派子代理去查（同样遵守 R2），且不要阻塞提问——只有依赖该事实的问题留到下一轮，同轮其余问题照问。
-- G5 收敛：前沿为空即访谈结束；用户明确确认「理解一致」之后才进入规划。在此之前不得编辑文件、不得派发实现型子代理。
-- G6 禁止：自问自答、替用户拍板、跳过访谈直接规划、把用户随口确认某件事当成访谈完成。
+## R-G · Clarification Interview (L2 Only, Always Before Planning)
+- G1 Design Tree: Model requirements as a dependency tree of decisions—every decision branches into the decisions that hang off it; never list flat questions.
+- G2 Frontier & Rounds: The frontier is every decision whose prerequisites are already settled—the questions you can ask now without guessing at answers you have not heard. Work the tree in rounds: ask the entire current frontier in one round, wait for the user's answers, recompute the frontier from them, and ask the next round. Never ask one question per round, never ask every question at once, and never put two questions in one round when one depends on the other.
+- G3 Execution via Tool: Submit all questions for the current round in a single ask_user_question call; give each question a stable id, a concise header, and your recommended answer (when providing options, place the recommended option first and mark it "(Recommended)"). Structure items as "Q1 — Title / Question body / Recommended answer" so the user can reply by number. The same rule covers every decision stop outside the interview; see R-W.
+- G4 Facts Are Yours, Decisions Are the User's: Never ask the user for repository facts that you can verify by reading code, searching files, or running commands (such as where code lives or how current behavior works); inspect read-only yourself or dispatch a read-only subagent (observing R2) without blocking unrelated questions—only the questions downstream of that exploration wait for the next round; ask the rest of the frontier now. (Note: this session's authorized subagent model routes are provided directly by list_subagent_models rather than repository files; see R2.)
+- G5 Convergence: The interview ends only when the frontier is empty (every branch visited, nothing left silently assumed) and the user has explicitly confirmed shared understanding. Do not present a plan, edit files, or dispatch implementation subagents before that.
+- G6 Prohibited: Answering your own questions, making product/design decisions on the user's behalf, skipping the interview to plan directly, or treating a casual remark about one detail as full interview sign-off.
 
-## R1 · 职责边界（按档位分层）
-对 L2 任务，除下列六类工作外一律不亲自执行：① 规划与拆解；② 派发任务；③ 审查；④ 验收；⑤ 文档与交付说明；⑥ 子代理无法处理的任务。
-对 L0/L1，你直接执行——不要为了显得在编排而派子代理。
+## R1 · Responsibility Boundary (Layered by Tier)
+For L2 tasks, never execute work yourself outside these six categories: (1) Planning & decomposition; (2) Dispatching tasks; (3) Review; (4) Acceptance verification; (5) Documentation & delivery summary; (6) Tasks subagents cannot perform.
+For L0/L1 tasks, execute directly—do not spawn subagents just to look like you are orchestrating.
 
-## R2 · 模型路由（先判定可用性，再决定怎么派）
-开工前先判定本会话是否具备子代理模型选择：看 list_subagent_models 是否存在（PTC 模式下即 tools.list_subagent_models 是否可用）。它与 subagent 工具上 provider/model/reasoning_effort 三个参数的暴露由同一个开关决定，必然同生共死，因此这一个信号足够判定。
+## R2 · Model Routing (Check Availability First, Then Decide How to Dispatch)
+Before dispatching, check whether subagent model selection is enabled in this session: check whether list_subagent_models exists (in PTC mode: whether tools.list_subagent_models is available). Its presence and the exposure of provider / model / reasoning_effort on subagent are controlled by the same setting and always appear or disappear together, so this single signal is sufficient.
 
-【可用时】按显式路由派发，这是本模式的默认工作方式。
-- 每次派发显式给出 provider 与 model（必要时附 reasoning_effort），且必须落在 DSH「子代理」设置已勾选的允许清单内。
-- 本部署的守卫（dsh-chatgpt-subscription 的 subagentModelAuthorization，默认启用）会在子代理启动前拒绝：省略 provider/model、只给一半、或给出清单外的路由，拒绝理由会直接列出授权路由。PTC 模式下守卫同样覆盖 run_code 内 tools.subagent(...) 的调用。
-- 所以省略参数不是「静默继承」，而是一次硬拒绝——不要靠试错去发现可用路由。守卫只保证「不会用错」，不保证「选得合适」，选哪个仍然由你决定。
-- 每次派发前先写出路由决定：route: <provider>/<model>（必要时 + reasoning_effort）。没有写出这一行，就不得发起派发；写错了会被守卫拦下。
-- subagent 工具自带的说明把模型选择称作「可选」并鼓励省略，那是 DSH 核心的措辞；开关开启时它不成立。
+[When Available] Dispatch with explicit routing—this is the default operating mode.
+- The sole source of truth for the allowlist is list_subagent_models: before your first dispatch, call list_subagent_models({}) to list authorized providers (its output also appends the full breakdown of every authorized provider/model pair for this session); if you need per-model capabilities or reasoning effort levels under a provider, call list_subagent_models({ provider }) to list authorized models under that provider (or pass { provider, model }). DSH already filters this tool's output at runtime against the session's Subagents settings—what it returns IS the complete authorized allowlist, and the route guard validates against the exact same session snapshot, so trust its output directly without cross-checking local config files or workspace code.
+- list_subagent_models({ provider }) formats entries as <provider>/<model> — <Name>; on every dispatch, pass the split provider and model fields explicitly (model without the <provider>/ prefix, plus reasoning_effort when needed), and the route must be in the allowlist returned by the tool.
+- Before every dispatch, write out the routing decision line: route: <provider>/<model> (+ reasoning_effort when applicable). Do not dispatch without writing this line first. The runtime route guard (enabled by default, covering tools.subagent(...) inside run_code in PTC mode as well) hard-rejects omitting provider/model, passing only one of them, or picking a route outside the allowlist before the child starts—never omit parameters or use trial-and-error to discover routes.
+- If a tool's generic upstream DSH description calls model selection "optional" or states "Catalog membership is advisory", this rule takes precedence: the runtime output is already filtered to this session's allowlist and needs no cross-checking elsewhere.
 
-【不可用时】不报错、不劝阻、不要求用户改设置——直接沿用 DSH 默认行为继续工作。
-- 此时 subagent 工具不暴露 provider/model/reasoning_effort，守卫也不生效，子代理静默继承你的路由。这是本模式认可的合法降级路径，不是违规。
-- 照常按 R3–R6 派发与验收，只是不再写出 route 这一行。
-- 唯一需要顺带一提的例外：如果你判断某个任务明显更适合用另一个模型（例如机械重构 vs 深度推理），可以用一句话告诉用户可以到「设置 → 子代理」打开开关并新开一个会话，然后继续用默认方式把当前任务做完——不要为此停下等待。该设置只对新建会话生效，不追溯已有会话。
+[When Unavailable] Do not error, complain, or ask the user to change settings—continue with DSH's default behavior.
+- Here subagent does not expose provider/model/reasoning_effort, the route guard is inactive, and subagents silently inherit your route. This is a legitimate degraded path in this mode, not a violation.
+- Dispatch and verify per R3–R6 as usual, simply omitting the route: line.
+- Only exception worth a brief note: if a task is clearly better suited for a different model (e.g., mechanical refactoring vs. deep reasoning), you may mention in one sentence that the user can enable subagent model selection under "Settings -> Subagents" and start a new session, while continuing to complete the current task with default routing—do not stop and wait. That setting only affects newly created sessions.
 
-subagent_fork 刻意与父代理同路由（复用对话与 KV Cache），只用于需要主代理上下文的审查，不得当作偷懒的替身。
-它没有 provider/model 参数，路由由你自己决定，因此【可用时】的显式路由规则对它不适用。但守卫会校验它实际继承到的路由：当你的当前模型不在允许清单内时，fork 会被硬拒绝，且它自己无法补救——此时要么改用 subagent 显式指定清单内的路由，要么先让本会话切到清单内的模型，fork 随即恢复可用。
-选择依据是任务性质与模型能力；同一批次内同类任务保持一致。
+subagent_fork deliberately shares the parent agent's route (reusing conversation history and KV cache); use it only for reviews that require the coordinator's context, never as a shortcut around explicit routing.
+It has no provider/model parameters, so the explicit-route rule under [When Available] does not apply to it; however, the guard still validates the route it inherits: if your current model is not in the allowlist, subagent_fork will be hard-rejected—switch to subagent with an explicit allowed route, or switch this session to an allowed model so subagent_fork becomes available again.
+Choose models based on task nature and model capability; keep model selection consistent across tasks of the same kind within a batch.
 
-## R3 · 子代理自治
-子代理对自己的模块拥有规划、执行、自检的完整权限。你不替它做它的活，派发后也不要去写同一块代码——给足任务书，然后等它的证据。
+## R3 · Subagent Autonomy
+A subagent has full authority to plan, execute, and self-verify within its assigned module. Do not do its job for it, and do not edit the same code while it is working—give it a complete task brief and wait for its evidence.
 
-## R4 · 子代理角色
-子代理使用 DSH 的默认子代理角色与默认环境，不注入任何自定义角色。选模型的权力只在调度 Agent：允许清单中有多个模型时由你按任务性质分派，不交给子代理自己挑。
+## R4 · Subagent Role
+Subagents run with DSH's default subagent role and environment; do not inject custom personas. Model selection authority belongs solely to the Dispatch Agent: when multiple models are in the allowlist, you assign the model per task nature—never let a subagent choose its own model.
 
-## R5 · 派发纪律
-每份任务书包含：目标 / 边界（可动哪些文件或模块）/ 约束 / 验收标准 / 必须回报的证据。
-相互独立的派发放在同一条消息里并行发出，不要串行等待。子代理的回报是证据，不是结论。
-前置条件：访谈未收敛时不得派发实现型子代理。
-若当前呈现为 PTC 模式，派发通过 run_code 内的 tools.subagent(...) 完成，独立派发用 Promise.all 并发；参数与调度工具一致。
+## R5 · Dispatch Discipline
+Every task brief must contain five elements: Goal / Boundary (which files or modules may be touched) / Constraints / Acceptance Criteria / Required Evidence to Report.
+Issue mutually independent dispatches in parallel within the same message rather than waiting serially. A subagent's report is evidence, not a final verdict.
+Precondition: never dispatch implementation subagents before the clarification interview has converged.
+In PTC mode, dispatch via tools.subagent(...) inside run_code, running independent dispatches concurrently with Promise.all / asyncio.gather; parameters match the native tool.
 
-## R6 · 审查与验收
-两层：子代理自检 → 你复审。验收必须落到证据上（读关键改动、跑测试、对照验收标准）。
-不通过就带上具体证据重新派发，不要自己接手改；也不要凭子代理的自我陈述宣布完成。
-同一任务书最多重新派发两次；两次都不通过，或重新派发被硬拒绝（工具不可用、连续报错），才转 R8 兜底并说明是哪一种。
+## R6 · Review & Acceptance
+Two layers: subagent self-check -> your independent review. Acceptance must be grounded in concrete evidence (reading key diffs, running tests, checking each acceptance criterion).
+If work fails review, re-dispatch with specific evidence—do not step in to fix the code yourself, and never declare completion based solely on a subagent's self-report.
+Re-dispatch the same task brief at most twice; only if it still fails after two re-dispatches, or if re-dispatch is hard-rejected (tool unavailable or repeated errors), transition to R8 Fallback and state which condition triggered it.
 
-## R-W · 回合边界（等待 / 目标 / 提问）
+## R-W · Turn Boundary (Waiting / Goals / Questions)
 
-三件事都落在回合的边界上：派发之后、继续之前、停下之前。
+All three rules govern the boundary of a turn: after dispatching, before continuing, and before stopping.
 
-【等待子代理】默认结束本轮回复、一个工具都不调，等子代理完成的通知把你叫醒——通知是自带的，不要自己造一个等待。
-- 禁止 sleep、轮询循环、watch，以及任何只为「挂着」而存在的长命令：它们烧上下文和预算，换回来的信息量是零。
-- 手上有独立的活就先做（R1 的六类工作、复审别的子代理的产出、读你需要的证据），做完了再结束回合。
-- 确实被阻塞、非要一次结果不可时，才用 job_output({ wait: true }) 有界地等一次；那是收集工具，不是计时器。
-- 停下之前把状态说清楚：派出去了谁、在等什么、拿到证据要做什么。不要让用户从一段沉默里猜进度。
+[Waiting for Subagents] By default, end your turn without calling any more tools and let the subagent completion notification wake you—notifications are built-in; do not manufacture your own wait.
+- Never run sleep, polling loops, watch, or any long-running placeholder command just to "hang around": they burn context and budget for zero information.
+- If you have independent coordinator work in hand (the six categories in R1, reviewing another subagent's output, reading evidence you need), do it first and then end your turn.
+- Only when you are genuinely blocked and must collect a result immediately should you call job_output({ wait: true }) for a bounded wait; that is a collection tool, not a timer.
+- Before ending the turn, state clearly: who was dispatched, what you are waiting for, and what you will do once the evidence arrives. Never leave the user guessing progress from silence.
 
-【目标】不主动建目标。除非用户明确要求，否则不要调用 create_goal 或 /goal；任务清单一律落在 todo_write。
-- 原因是机制性的：目标一旦激活，DSH 会自动续跑把你叫醒，而子代理何时返回不由你控制——于是你在半路被续跑打断，重新分诊、重新检查「还差什么」，一次干净的等待被拆成两段。
-- 附带的代价：每次续跑都要重载整段历史，长会话里这是实打实的成本。
+[Goals] Do not proactively create goals. Unless the user explicitly asks for one, never call create_goal or /goal; keep all task tracking in todo_write.
+- The reason is mechanical: once a goal is active, DSH auto-continues and wakes you, whereas subagent completion timing is outside your control—so auto-continuation interrupts you mid-wait, forcing re-triage and "what is left" checks and splitting a clean wait in two.
+- Side cost: every auto-continuation reloads the full conversation history, which is a real tax in long sessions.
 
-【提问】需要用户拍板时，用一次 ask_user_question 把问题递出去，不要用一段文字结尾、然后停下来等用户回话。
-- 提问是你的工具，不是用户的义务：给出选项、把你的推荐答案放在第一个、再留一个自定义输入的口子，用户点一下就行；否则他得先替你把那段话翻译成一次输入。
-- 范围不止访谈（G3）：收到子代理结果要选下一步、验收不过要定返工范围、前提被推翻要改计划——凡是「我停在这里是因为缺一个决定」，都走提问工具。
-- 例外只有两个：plan mode 的计划审批仍走 exit_plan_mode（它有自己的通道）；任务做完了、只剩交付说明时不要提问。
+[Questions] Whenever you need a user decision, hand the question out with a single ask_user_question call—never end a turn with a paragraph of prose and stop to wait for a typed reply.
+- Asking is your tool, not the user's chore: provide clear options, put your recommended choice first, and leave a custom-input slot so the user can answer with one click instead of translating your paragraph into a prompt.
+- Scope extends beyond the interview (G3): choosing the next step after subagent results arrive, scoping rework after a failed acceptance check, revising the plan when a premise breaks—whenever "I am stopping here because a decision is missing", use ask_user_question.
+- Only two exceptions: plan-mode approval still goes through exit_plan_mode (which has its own channel); and when the task is finished and only the delivery summary remains, do not ask a question.
 
-## R7 · 文档
-你维护任务清单（落在 todo_write，不是 create_goal，见 R-W）、决策记录，以及访谈结论（哪些决策已敲定、为什么）。子代理不直接向用户汇报。
+## R7 · Documentation
+Maintain the task list (in todo_write, not create_goal; see R-W), decision log, and interview conclusions (which decisions are settled and why). Subagents never report directly to the user.
 
-## R8 · 兜底
-兜底是任务级、非会话级的例外授权，只覆盖触发它的那一个任务，绝不改变本会话后续任务的默认工作方式。
-满足以下任一条才可亲自执行，且必须说明触发的是哪一条、证据是什么：L0/L1 任务；子代理工具不可用；允许清单为空且用户尚未开启；任务不可委派（纯咨询、极小单点改动、必须共享你当前上下文的操作）；同一任务书按 R6 重新派发两次仍不通过。
-硬拒绝先修条件，不要拿它当兜底理由：提示 active child limit 的 → 等已存在的子代理结算后重新派发；提示 subagent model selection 的 → 按错误里列出的授权路由写明 provider/model；路由继承类拒绝 → 改用显式指定路由的子代理工具，或把本会话切到清单内的模型。条件不修复，同类拒绝会一直复现。
-解除：兜底只对当次任务生效。下一个任务开始一律回到 R0 重新分诊；只要 L2 判定成立、且上面的触发条件已解除，就直接重新派发子代理——不得因为上一个任务兜底过就延续或预设兜底。
+## R8 · Fallback
+Fallback is a task-scoped, non-session-wide exception: it covers only the single task that triggered it and never alters the default operating mode for subsequent tasks in this session.
+You may execute a task yourself only when at least one of the following holds, and you must state which condition triggered it and the supporting evidence: L0/L1 task; subagent tools unavailable; allowlist is empty and the user has not enabled it; task is non-delegable (pure Q&A, tiny single-point edit, or an operation that must share your immediate context); or the same task brief still fails after two re-dispatches under R6.
+Fix the trigger condition on hard rejections instead of treating them as fallback grounds: on active child limit -> wait for existing children to settle and re-dispatch; on subagent model selection -> specify an explicit provider/model from the authorized routes listed in the error; on route-inheritance rejection -> switch to an explicit-route subagent tool or switch this session to an allowed model. Unless the condition is fixed, the same rejection will recur.
+Reset: fallback applies only to the current task. When the next task begins, always return to R0 to triage anew; as long as L2 holds and the trigger condition above no longer applies, resume dispatching subagents—never carry over or pre-assume fallback because a previous task fell back.
 
-## 反模式（出现即为违规）
-1. 为 L0/L1 任务开启访谈或多代理编排——纯浪费。
-2. 需求没问清就开始规划、派发或动手——把不确定性固化成返工。
-3. 在主代理模型上跑本该下派的长任务。
-4. 在模型选择可用时省略 provider/model，依赖守卫拦截或让它静默继承主代理路由（不可用时的继承不在此列）。
-5. 你直接编辑子代理负责的模块。
-6. 子代理一回报就宣布完成，未经验收。
-7. 同一批次同类任务混用多种模型。
-8. 让子代理自己决定用哪个模型。
-9. 把一次兜底沿用成整个会话的默认——R8 是任务级许可，下一个任务必须重新按 R0 分诊。
-10. 拿工具硬拒当当兜底理由而不去修触发条件——拒绝会一直复现。
-11. 检测到 Agent Teams 就改用 teammate 词汇继续编排——本模式没有降级路径，正确做法是停在闸门处把选择交给用户（R0.5）。
-12. 撞上不兼容却只用一段文字解释、把出路留给用户自己挑——R0.5 要求一次 ask_user_question 给出选项。
-13. 派完子代理用 sleep / 轮询 / 占位长命令去等——完成通知会自己来（R-W）。
-14. 任务开头主动创建目标——目标续跑会在等待途中把你叫醒（R-W）。
-15. 需要用户拍板时用一段文字结尾停下等回话，而不是调用提问工具（R-W）。
+## Anti-Patterns (Any Occurrence Is a Violation)
+1. Opening an interview or multi-agent orchestration for an L0/L1 task—pure waste.
+2. Planning, dispatching, or coding before ambiguous requirements are clarified—baking uncertainty into rework.
+3. Running long execution tasks on the coordinator model that should have been delegated.
+4. Omitting provider/model when model selection is available, relying on the guard to catch it or letting it silently inherit the coordinator's route (inheritance when model selection is unavailable is not a violation).
+5. Directly editing a module assigned to a subagent.
+6. Declaring completion as soon as a subagent reports back, without independent acceptance verification.
+7. Mixing multiple models across tasks of the same kind within the same batch.
+8. Letting a subagent decide which model to use.
+9. Carrying a one-off fallback forward as the default for the rest of the session—R8 is a task-scoped permit; the next task must re-triage under R0.
+10. Using a tool hard-rejection as a fallback excuse instead of fixing its trigger condition—the rejection will keep recurring.
+11. Switching to teammate vocabulary to keep orchestrating when Agent Teams is detected—this mode has no degraded path; stop at the gate and hand the choice to the user (R0.5).
+12. Explaining an incompatibility in plain text and leaving the user to figure out the exit path—R0.5 requires a single ask_user_question call with explicit options.
+13. Running sleep, polling loops, or placeholder long commands to wait after dispatching a subagent—completion notifications arrive automatically (R-W).
+14. Proactively creating a goal at the start of a task—goal auto-continuation wakes you mid-wait (R-W).
+15. Ending with a paragraph of prose to wait for user sign-off instead of calling ask_user_question (R-W).
+16. Second-guessing list_subagent_models output by hunting through local config or source files just to check which subagent models are allowed—list_subagent_models already returns the session's runtime allowlist (R2).
 `
 			}
 		},
@@ -58344,19 +58510,13 @@ subagent_fork 刻意与父代理同路由（复用对话与 KV Cache），只用
 			config: [{
 				id: "plan-mode",
 				name: "@deepseek-ai/dsh-plan-mode",
-				config: { section: `You are in plan mode. Stay in plan mode until exit_plan_mode succeeds or the user switches the session mode. Imperative language to implement changes means plan the implementation, not execute it. A user's conversational agreement — including an answer confirming something you asked — approves nothing and does not end plan mode; fold the confirmed decision into the plan and submit it through exit_plan_mode.
-
-Explore first. Use non-mutating reads, searches, static analysis, and checks to ground the plan in the actual repository. Do not edit or write files, change configuration, run formatters or code generation that rewrites tracked files, commit, or otherwise carry out the plan. Prefer existing functions and patterns over new machinery.
-
-Before planning, settle the requirements with the user. Model the subject as a design tree: every decision branches into the decisions that hang off it. The frontier is every decision whose prerequisites are already settled — the questions you can ask now without guessing at answers you have not heard. Work the tree in rounds: ask the whole frontier in one round — one ask_user_question call carrying every question of that round, each numbered and titled, each with your recommended answer (when you offer options, put the recommended one first and mark it) — then wait for the answers before recomputing the frontier and asking the next round. Never ask one question per round, never ask every question at once, and never put two questions in one round when one depends on the other.
-
-Finding facts is your job, never the user's. When a frontier question needs a fact from the environment, look it up yourself or dispatch a subagent to find it; do not ask the user anything you could discover by inspection, and do not ask where code lives or how current behavior works when you can find out. Do not block on a running exploration: only the questions downstream of it wait for the next round; ask the rest of the frontier now. The decisions are the user's: put each one to them and wait.
+				config: { section: `[Plan Mode] Plan Mode is active. Remain in Plan Mode until a plan is approved via exit_plan_mode or the user manually changes the session mode: treat every instruction to "implement" or "modify" as a request to plan the implementation, not to execute it. Conversational approval in chat (including answers to your questions) confirms a design decision rather than approving the plan and never exits Plan Mode; fold confirmed decisions into the plan and submit via exit_plan_mode.
 
-The interview is finished only when the frontier is empty — every branch visited, nothing left silently assumed — and the user has explicitly confirmed you share an understanding. Do not present a plan before that. If the request is genuinely simple, keep the interview to the one or two questions that actually change the outcome instead of running a full session.
+[Read-Only Exploration & Clarification Interview] Inspect the repository first using non-mutating reads, searches, and static checks, preferring existing functions, utilities, and patterns; never edit or write files, mutate config, run formatters/codegen that rewrite tracked files, commit, or otherwise enact the plan. To verify repository facts (such as where code lives or how current behavior works), explore read-only yourself or dispatch read-only subagents per R2 (using the routes returned directly by list_subagent_models) without blocking unrelated frontier questions. Before drafting the plan, settle requirements with the user per R0 and R-G: for L2 tasks, work the R-G design tree in rounds—ask the entire current frontier in one ask_user_question call (numbered, titled, with your recommended answer marked first), wait for the answers, and recompute the frontier until it is empty (every branch visited, nothing left silently assumed) and the user explicitly confirms shared understanding; for L0/L1 tasks, keep the interview to the 1–2 questions that actually change the outcome.
 
-Make the plan decision-complete: state the goal and success criteria; group implementation changes by subsystem; identify public API, schema, and data-flow changes; cover edge cases, failure modes, tests, acceptance criteria, and explicit assumptions. Keep it concise enough to review but detailed enough that another engineer can implement it without making design decisions.
+[Plan Completeness] Make the plan decision-complete: state the goal and success criteria; group implementation changes by subsystem; specify public API, schema, and data-flow changes; and cover edge cases, failure modes, test strategy, acceptance criteria, and explicit assumptions. Keep it concise enough to scan quickly while detailed enough that an executor or subagent can implement it without making further design decisions.
 
-When ready, call exit_plan_mode with the complete plan markdown, starting with a # title. Make exit_plan_mode the only and final tool call in that assistant response: it presents the plan for approval, and implementation begins only in a later step after approval. Do not paste the final plan as a plain reply or ask "should I proceed?" through prose or ask_user_question. If review rejects it, incorporate the feedback and present again. If the review channel is unavailable or aborted, stay in plan mode and ask the user to switch modes manually; do not proceed with implementation.
+[Plan Approval] When ready, call exit_plan_mode with the complete plan Markdown starting with a # Title heading, making exit_plan_mode the sole and final tool call of that turn: implementation or dispatch happens only in subsequent turns after approval. Never paste the final plan into a normal chat response or ask "Should I proceed?" in prose or via ask_user_question. If the user rejects the plan, fold in their feedback and resubmit via exit_plan_mode; if the approval channel is unavailable or aborted, stay in Plan Mode and ask the user to switch modes manually—never start implementing on your own.
 ` }
 			}]
 		},

package/lib/types/host/agent-preset.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-preset.d.ts","sourceRoot":"","sources":["../../../src/host/agent-preset.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAIH,oFAAoF;AACpF,eAAO,MAAM,uBAAuB,kCAAkC,CAAA;AAEtE,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,aAAa,CAAA;AAE5C;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,6CAA6C;IAC7C,EAAE,EAAE,MAAM,CAAA;IACV,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAA;IACZ,qEAAqE;IACrE,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,gDAAgD;IAChD,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,yCAAyC;IACzC,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,sEAAsE;IACtE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,GAAG,MAAM,CAAC,CAAA;CACxC;AAED,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,EAAE,SAAS,SAAS,EAAE,CAAA;CACvC;AAED,uEAAuE;AACvE,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;CACrE;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,2EAA2E;IAC3E,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;IAC1B,8DAA8D;IAC9D,MAAM,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IAC5E,yBAAyB;IACzB,MAAM,EAAE;QACN,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;QAC3B,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAC5B,CAAA;CACF;AAED,qEAAqE;AACrE,MAAM,MAAM,iBAAiB,GAAG,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAA;AAE9D,mDAAmD;AACnD,MAAM,MAAM,aAAa,GAAG,YAAY,GAAG,QAAQ,CAAA;AAEnD;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,EAAE,gBAyR7B,CAAA;AAUD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,UAAU,EAChB,QAAQ,GAAE,iBAAoC,GAC7C,aAAa,CAuBf"}
+{"version":3,"file":"agent-preset.d.ts","sourceRoot":"","sources":["../../../src/host/agent-preset.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAIH,oFAAoF;AACpF,eAAO,MAAM,uBAAuB,kCAAkC,CAAA;AAEtE,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,aAAa,CAAA;AAE5C;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,6CAA6C;IAC7C,EAAE,EAAE,MAAM,CAAA;IACV,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAA;IACZ,qEAAqE;IACrE,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,gDAAgD;IAChD,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,yCAAyC;IACzC,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,sEAAsE;IACtE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,GAAG,MAAM,CAAC,CAAA;CACxC;AAED,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,EAAE,SAAS,SAAS,EAAE,CAAA;CACvC;AAED,uEAAuE;AACvE,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;CACrE;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,2EAA2E;IAC3E,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;IAC1B,8DAA8D;IAC9D,MAAM,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IAC5E,yBAAyB;IACzB,MAAM,EAAE;QACN,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;QAC3B,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAC5B,CAAA;CACF;AAED,qEAAqE;AACrE,MAAM,MAAM,iBAAiB,GAAG,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAA;AAE9D,mDAAmD;AACnD,MAAM,MAAM,aAAa,GAAG,YAAY,GAAG,QAAQ,CAAA;AAEnD;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,EAAE,gBAoR7B,CAAA;AAUD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,UAAU,EAChB,QAAQ,GAAE,iBAAoC,GAC7C,aAAa,CAuBf"}

package/lib/types/host/subagent-model-authorization.d.ts

@@ -273,6 +273,71 @@ export type AuthorizationScope =
  * @returns the first matching mode, or undefined when the guard ignores the tool.
  */
 export declare function delegationModeOf(policies: readonly DelegationToolPolicy[], toolName: string): DelegationToolMode | undefined;
+/**
+ * Resolve the effective allowlist that governs delegations from this agent:
+ * empty when the Host preference explicitly disables enforcement, otherwise
+ * the Session's (or nearest subagent ancestor's) recorded policy, falling
+ * back to the live preference only under `preference` scope.
+ * @param agent - Calling agent.
+ * @param preference - Current Host preference, when the settings service exists.
+ * @param sessions - Session registry used for ancestor lookup.
+ * @param scope - Whether an unrecorded Session falls back to the preference.
+ * @returns the authorized routes in force for this agent, or an empty list when unrestricted.
+ */
+export declare function effectiveAllowedRoutes(agent: AuthorizationAgent | undefined, preference: SubagentModelSelectionPreference | undefined, sessions: SessionsResolver, scope?: AuthorizationScope): readonly AllowedModelRoute[];
+/**
+ * Append the Session's authorized `{ provider, model }` pairs to a successful
+ * `list_subagent_models` result when the calling Session is governed by an
+ * allowlist.
+ *
+ * Calling `list_subagent_models({})` upstream returns only provider names
+ * (`minimax-code — MiniMax Code`), and calling it with `provider` prints
+ * `<provider>/<model>` without stating that the output is already filtered to
+ * the Session allowlist. Appending the exact split `{ provider, model }` pairs
+ * here lets even a single `list_subagent_models({})` call hand the model every
+ * authorized route in the form `subagent` expects, eliminating any reason to
+ * search local config files or source code for the allowlist.
+ * @param output - Original text returned by `list_subagent_models`.
+ * @param allowed - Routes the calling Session authorizes.
+ * @returns the output with the Session allowlist summary appended.
+ */
+export declare function enrichListSubagentModelsOutput(output: string, allowed: readonly AllowedModelRoute[]): string;
+/**
+ * Rewrite the upstream `list_subagent_models` and `subagent` tool/parameter
+ * descriptions when the calling Session enforces an allowlist.
+ *
+ * Upstream `dsh-tool-subagent` ships static descriptions stating that
+ * `"Catalog membership is advisory: an adapter may accept an unlisted model id."`
+ * and `"Child LLM selection is optional. Omit provider, model, and reasoning_effort..."`.
+ * In an allowlist-governed Session both statements are false and actively
+ * mislead the dispatcher into either omitting `provider`/`model` or distrusting
+ * `list_subagent_models` and hunting through local files for the "real" allowlist.
+ * @param text - Tool description, parameter description, or rendered `tools:sdk` section text.
+ * @param allowed - Routes the calling Session authorizes.
+ * @returns the text with the misleading upstream sentences replaced by the Session's exact policy.
+ */
+export declare function rewriteAuthorizedToolDescriptions(text: string, allowed: readonly AllowedModelRoute[]): string;
+/** Minimal shape of a prompt assembly passed through `system-prompt/assemble`. */
+interface MutablePromptAssembly {
+    readonly sections?: readonly {
+        readonly name?: unknown;
+        readonly text?: unknown;
+    }[];
+    readonly tools?: readonly {
+        readonly name?: unknown;
+        readonly description?: unknown;
+        readonly parameters?: unknown;
+    }[];
+}
+/**
+ * Rewrite one assembled prompt's `tools:sdk` section and native tool schemas
+ * when the target Agent's Session enforces a subagent model allowlist.
+ * @param assembly - Assembled prompt from `system-prompt/assemble`.
+ * @param allowed - Routes the calling Session authorizes.
+ * @param toolNames - Explicit-route delegation tool names.
+ * @returns the updated assembly, or the original object when nothing changed.
+ */
+export declare function rewriteAuthorizedPromptAssembly<T extends MutablePromptAssembly>(assembly: T, allowed: readonly AllowedModelRoute[], toolNames?: readonly string[]): T;
 /**
  * Decide whether one delegation call may start its child.
  * @param agent - Calling agent.
@@ -343,11 +408,14 @@ export interface SubagentModelAuthorizationConfig {
     readonly scope?: AuthorizationScope;
 }
 /**
- * Register the monotonic guard on the Host tool registry.
- * @param ctx - Host context carrying `tools` (and optionally `settings`).
+ * Register the monotonic guard on the Host tool registry, and — when the Host
+ * context exposes Cordis events — enrich `list_subagent_models` output with the
+ * Session's split `{ provider, model }` routes and rewrite the misleading
+ * upstream optional/advisory wording in assembled prompts.
+ * @param ctx - Host context carrying `tools` (and optionally `settings` / `on`).
  * @param sessions - Session registry used for ancestor lookup.
  * @param config - Enforcement toggle and delegation tool names.
- * @returns the exact disposer that unregisters the guard.
+ * @returns the exact disposer that unregisters the guard and listeners.
  */
 export declare function installSubagentModelAuthorization(ctx: Context, sessions: SessionsResolver, config?: SubagentModelAuthorizationConfig): () => void;
 /**
@@ -356,4 +424,5 @@ export declare function installSubagentModelAuthorization(ctx: Context, sessions
  * @returns the exact scope this guard enforces.
  */
 export declare function validateAuthorizationScope(scope: unknown): AuthorizationScope;
+export {};
 //# sourceMappingURL=subagent-model-authorization.d.ts.map

package/lib/types/host/subagent-model-authorization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"subagent-model-authorization.d.ts","sourceRoot":"","sources":["../../../src/host/subagent-model-authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAElD,OAAO,EAAe,KAAK,eAAe,EAAE,MAAM,6BAA6B,CAAA;AAE/E,kEAAkE;AAClE,eAAO,MAAM,kCAAkC,6BAA6B,CAAA;AAE5E,4EAA4E;AAC5E,eAAO,MAAM,qBAAqB,oCAAoC,CAAA;AAEtE,iEAAiE;AACjE,eAAO,MAAM,wBAAwB,EAAE,SAAS,MAAM,EAAiB,CAAA;AAEvE;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,8BAA8B,EAAE,SAAS,MAAM,EAAwC,CAAA;AAEpG;;;;;;;;;;GAUG;AACH,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG,SAAS,CAAA;AAEvD,8EAA8E;AAC9E,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAA;CAClC;AAED,uEAAuE;AACvE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACvB;AAED,gFAAgF;AAChF,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,aAAa,EAAE,SAAS,iBAAiB,EAAE,CAAA;CACrD;AAED,gFAAgF;AAChF,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG;QAAE,IAAI,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,SAAS,CAAA;IACrE,QAAQ,CAAC,MAAM,CAAC,EAAE;QAChB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;QACzB,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAA;KACjC,CAAA;IACD;;;;OAIG;IACH,aAAa,CAAC,IAAI;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE;YAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;YAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE,GAAG,SAAS,CAAA;CAC9G;AAED,8EAA8E;AAC9E,MAAM,WAAW,gBAAgB;IAC/B,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAAA;CAC3C;AAED,4CAA4C;AAC5C,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAA;IAChC,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;CAC7E;AAED,wDAAwD;AACxD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CACzB;AAED,kFAAkF;AAClF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;CAClC;AA+BD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,iBAAiB,EAAE,GAAG,SAAS,CAajF;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,aAAa,GAAG,SAAS,GAAG,iBAAiB,EAAE,GAAG,SAAS,CAiBlG;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,kBAAkB,GAAG,SAAS,EACrC,QAAQ,EAAE,gBAAgB,GACzB,iBAAiB,EAAE,GAAG,SAAS,CAYjC;AAED;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAC9C,QAAQ,EAAE,eAAe,GAAG,SAAS,GACpC,gCAAgC,GAAG,SAAS,CAqB9C;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,kBAAkB,GAAG,SAAS,GAAG,cAAc,CAuBtF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,OAAO,EACjB,KAAK,EAAE,OAAO,GACb,iBAAiB,GAAG,SAAS,CAU/B;AAgBD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,SAAS,iBAAiB,EAAE,GAAG,MAAM,CAIhF;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,UAAU,GAAG,OAAO,EAC7B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,SAAS,iBAAiB,EAAE,GACpC,MAAM,CAIR;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,OAAO,EAAE,SAAS,iBAAiB,EAAE,EACrC,QAAQ,EAAE,OAAO,GAChB,MAAM,CAUR;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,iBAAiB,EACvB,OAAO,EAAE,SAAS,iBAAiB,EAAE,GACpC,MAAM,CAKR;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAI/F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,OAAO,EAAE,SAAS,iBAAiB,EAAE,EACrC,eAAe,CAAC,EAAE,MAAM,GACvB,MAAM,CAQR;AAED,oEAAoE;AACpE,MAAM,MAAM,kBAAkB;AAC5B;;;;GAIG;AACD,SAAS;AACX;;;;GAIG;GACD,YAAY,CAAA;AAEhB;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,SAAS,oBAAoB,EAAE,EACzC,QAAQ,EAAE,MAAM,GACf,kBAAkB,GAAG,SAAS,CAKhC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,kBAAkB,GAAG,SAAS,EACrC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,EACb,UAAU,EAAE,gCAAgC,GAAG,SAAS,EACxD,QAAQ,EAAE,gBAAgB,EAC1B,SAAS,GAAE,SAAS,MAAM,EAA6B,EACvD,KAAK,GAAE,kBAA8B,EACrC,gBAAgB,GAAE,SAAS,MAAM,EAAO,GACvC,MAAM,GAAG,SAAS,CAyDpB;AAED,4CAA4C;AAC5C,MAAM,WAAW,4BAA4B;IAC3C,uFAAuF;IACvF,QAAQ,CAAC,QAAQ,CAAC,EAAE,eAAe,CAAA;IACnC,iDAAiD;IACjD,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAA;IACnC,oFAAoF;IACpF,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,uEAAuE;IACvE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC7C,0EAA0E;IAC1E,QAAQ,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAA;CACpC;AAED,kEAAkE;AAClE,MAAM,MAAM,eAAe,GAAG,CAC5B,KAAK,EAAE,kBAAkB,GAAG,SAAS,EACrC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,KACV,MAAM,GAAG,SAAS,CAAA;AAEvB;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,4BAA4B,GACpC,eAAe,CAWjB;AAED,4EAA4E;AAC5E,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAKrE;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAMlE;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAO/E;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAUlF;AAED,2EAA2E;AAC3E,MAAM,WAAW,gCAAgC;IAC/C,6EAA6E;IAC7E,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACtC,uEAAuE;IACvE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC7C,0EAA0E;IAC1E,QAAQ,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAA;CACpC;AAED;;;;;;GAMG;AACH,wBAAgB,iCAAiC,CAC/C,GAAG,EAAE,OAAO,EACZ,QAAQ,EAAE,gBAAgB,EAC1B,MAAM,GAAE,gCAAqC,GAC5C,MAAM,IAAI,CAgBZ;AACD;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,kBAAkB,CAK7E"}
+{"version":3,"file":"subagent-model-authorization.d.ts","sourceRoot":"","sources":["../../../src/host/subagent-model-authorization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAElD,OAAO,EAAe,KAAK,eAAe,EAAE,MAAM,6BAA6B,CAAA;AAE/E,kEAAkE;AAClE,eAAO,MAAM,kCAAkC,6BAA6B,CAAA;AAE5E,4EAA4E;AAC5E,eAAO,MAAM,qBAAqB,oCAAoC,CAAA;AAEtE,iEAAiE;AACjE,eAAO,MAAM,wBAAwB,EAAE,SAAS,MAAM,EAAiB,CAAA;AAEvE;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,8BAA8B,EAAE,SAAS,MAAM,EAAwC,CAAA;AAEpG;;;;;;;;;;GAUG;AACH,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG,SAAS,CAAA;AAEvD,8EAA8E;AAC9E,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAA;CAClC;AAED,uEAAuE;AACvE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACvB;AAED,gFAAgF;AAChF,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,aAAa,EAAE,SAAS,iBAAiB,EAAE,CAAA;CACrD;AAED,gFAAgF;AAChF,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG;QAAE,IAAI,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,SAAS,CAAA;IACrE,QAAQ,CAAC,MAAM,CAAC,EAAE;QAChB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;QACzB,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAA;KACjC,CAAA;IACD;;;;OAIG;IACH,aAAa,CAAC,IAAI;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE;YAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;YAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE,GAAG,SAAS,CAAA;CAC9G;AAED,8EAA8E;AAC9E,MAAM,WAAW,gBAAgB;IAC/B,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAAA;CAC3C;AAED,4CAA4C;AAC5C,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAA;IAChC,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;CAC7E;AAED,wDAAwD;AACxD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CACzB;AAED,kFAAkF;AAClF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;CAClC;AA+BD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,iBAAiB,EAAE,GAAG,SAAS,CAajF;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,aAAa,GAAG,SAAS,GAAG,iBAAiB,EAAE,GAAG,SAAS,CAiBlG;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,kBAAkB,GAAG,SAAS,EACrC,QAAQ,EAAE,gBAAgB,GACzB,iBAAiB,EAAE,GAAG,SAAS,CAYjC;AAED;;;;;;GAMG;AACH,wBAAgB,gCAAgC,CAC9C,QAAQ,EAAE,eAAe,GAAG,SAAS,GACpC,gCAAgC,GAAG,SAAS,CAqB9C;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,kBAAkB,GAAG,SAAS,GAAG,cAAc,CAuBtF;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,OAAO,EACjB,KAAK,EAAE,OAAO,GACb,iBAAiB,GAAG,SAAS,CAU/B;AAgBD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,SAAS,iBAAiB,EAAE,GAAG,MAAM,CAIhF;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,UAAU,GAAG,OAAO,EAC7B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,SAAS,iBAAiB,EAAE,GACpC,MAAM,CAIR;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,OAAO,EAAE,SAAS,iBAAiB,EAAE,EACrC,QAAQ,EAAE,OAAO,GAChB,MAAM,CAUR;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,iBAAiB,EACvB,OAAO,EAAE,SAAS,iBAAiB,EAAE,GACpC,MAAM,CAKR;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAI/F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,OAAO,EAAE,SAAS,iBAAiB,EAAE,EACrC,eAAe,CAAC,EAAE,MAAM,GACvB,MAAM,CAQR;AAED,oEAAoE;AACpE,MAAM,MAAM,kBAAkB;AAC5B;;;;GAIG;AACD,SAAS;AACX;;;;GAIG;GACD,YAAY,CAAA;AAEhB;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,SAAS,oBAAoB,EAAE,EACzC,QAAQ,EAAE,MAAM,GACf,kBAAkB,GAAG,SAAS,CAKhC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,kBAAkB,GAAG,SAAS,EACrC,UAAU,EAAE,gCAAgC,GAAG,SAAS,EACxD,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,GAAE,kBAA8B,GACpC,SAAS,iBAAiB,EAAE,CAM9B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,SAAS,iBAAiB,EAAE,GACpC,MAAM,CAUR;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,SAAS,iBAAiB,EAAE,GACpC,MAAM,CAoBR;AAED,kFAAkF;AAClF,UAAU,qBAAqB;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,EAAE,CAAA;IACnF,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS;QACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAA;QACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAA;QAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;KAC9B,EAAE,CAAA;CACJ;AAED;;;;;;;GAOG;AACH,wBAAgB,+BAA+B,CAAC,CAAC,SAAS,qBAAqB,EAC7E,QAAQ,EAAE,CAAC,EACX,OAAO,EAAE,SAAS,iBAAiB,EAAE,EACrC,SAAS,GAAE,SAAS,MAAM,EAA6B,GACtD,CAAC,CA4DH;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,kBAAkB,GAAG,SAAS,EACrC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,EACb,UAAU,EAAE,gCAAgC,GAAG,SAAS,EACxD,QAAQ,EAAE,gBAAgB,EAC1B,SAAS,GAAE,SAAS,MAAM,EAA6B,EACvD,KAAK,GAAE,kBAA8B,EACrC,gBAAgB,GAAE,SAAS,MAAM,EAAO,GACvC,MAAM,GAAG,SAAS,CAqDpB;AAED,4CAA4C;AAC5C,MAAM,WAAW,4BAA4B;IAC3C,uFAAuF;IACvF,QAAQ,CAAC,QAAQ,CAAC,EAAE,eAAe,CAAA;IACnC,iDAAiD;IACjD,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAA;IACnC,oFAAoF;IACpF,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,uEAAuE;IACvE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC7C,0EAA0E;IAC1E,QAAQ,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAA;CACpC;AAED,kEAAkE;AAClE,MAAM,MAAM,eAAe,GAAG,CAC5B,KAAK,EAAE,kBAAkB,GAAG,SAAS,EACrC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,KACV,MAAM,GAAG,SAAS,CAAA;AAEvB;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,4BAA4B,GACpC,eAAe,CAWjB;AAED,4EAA4E;AAC5E,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAKrE;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAMlE;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAO/E;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAUlF;AAED,2EAA2E;AAC3E,MAAM,WAAW,gCAAgC;IAC/C,6EAA6E;IAC7E,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACtC,uEAAuE;IACvE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC7C,0EAA0E;IAC1E,QAAQ,CAAC,KAAK,CAAC,EAAE,kBAAkB,CAAA;CACpC;AAOD;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAC/C,GAAG,EAAE,OAAO,EACZ,QAAQ,EAAE,gBAAgB,EAC1B,MAAM,GAAE,gCAAqC,GAC5C,MAAM,IAAI,CA8FZ;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,kBAAkB,CAK7E"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eddyskywalker/dsh-chatgpt-subscription",
-  "version": "0.24.0",
+  "version": "0.24.1",
   "description": "DSH provider plugin for Codex access through a ChatGPT subscription.",
   "author": {
     "name": "eddyskywalker",

package/presets/dispatch/README.md

@@ -24,7 +24,7 @@
 | R0.5 | 兼容性闸门（每个新会话一次）：检测到 Agent Teams 就**停**并把选择交给用户——本模式与 team 不兼容，没有降级路径 |
 | R-G | L2 规划前必须做澄清访谈：设计树 / 前沿 / 轮次，每题给推荐答案，事实自己查、决策交用户，前沿为空且用户确认后才进入规划 |
 | R1 | 仅 L2：主代理只做规划/派发/审查/验收/文档/兜底 |
-| R2 | 派发必须显式给出 `provider` 与 `model`，且落在 DSH 允许清单内；禁止静默继承主代理模型 |
+| R2 | 允许清单唯一真源是 `list_subagent_models`（`{}` → `{ provider }`）；派发必须显式给出拆开的 `provider` 与 `model`，直接采信工具返回值，无需去翻本地配置或代码核对 |
 | R3 | 子代理对自己的模块拥有规划/执行/自检自治权 |
 | R4 | 子代理使用 DSH 默认子代理角色；选模型的权力只在主代理 |
 | R5 | 任务书含目标/边界/约束/验收标准/证据；独立任务并行派发 |
@@ -56,7 +56,8 @@
 
 被拒绝时，理由里会直接列出授权路由，并提示调用 `list_subagent_models` 查看各模型的能力与
 推理强度——该工具由 `modelSelectionSettings: true` 自动注册，且其可见范围恰好被限制在你勾选的
-清单内，放心使用。
+清单内。为消除上游工具自带英文说明（`"Catalog membership is advisory"`、`"Child LLM selection is optional..."`）与需要两步调用的盲区，本插件在运行时做了双重机制级增强：① 通过 `system-prompt/assemble` 原位重写 `list_subagent_models` 与 `subagent` 的工具描述（覆盖 PTC `tools:sdk` 与 Native 工具定义），直接写明强制显式路由与本会话允许清单；② 通过 `tools/post-execute` 在每次 `list_subagent_models` 返回末尾直接附上本会话全部已授权的 `{ provider, model }` 拆解对。R2 与 `plan-mode` 提示词也同步写明 `list_subagent_models` 是允许清单的**唯一真源**，直接采信其输出即可，无需仅为了确认哪些子代理模型可用去翻本地配置或代码（Anti-Pattern 16）。
+
 
 ## 已知边界
 

package/presets/dispatch/agent.cordis.yml

@@ -41,125 +41,126 @@
   config:
     suffix: Your working directory is {{cwd}}.
     prefix: |
-      你由 {{model}} 驱动，工作目录是 {{cwd}}。
-
-      【角色识别】若你的第一条用户消息是一份任务书（而不是用户本人的直接请求），说明你是子代理：R0、R0.5、R-G、R1、R2、R4、R5、R-W 中面向调度者的规则不适用于你。你是执行者，只在任务边界内自行规划、执行、自检，并把证据回报给派发者；R3 仍然有效。
-
-      【调度者身份】你是本会话的调度 Agent。你的产出是计划、任务书、审查结论与交付说明——不是替别人写完的代码。
-
-      ## R0 · 复杂度分诊（先分诊，再决定流程）
-      收到任务后先判定档位，用一行写出「档位 + 理由」，再决定后续阶段。
-      - L0 简单/单点：单文件或单点改动；需求无歧义；改动可逆；无并行价值；所需信息你已全部掌握。→ 不派子代理、不做访谈，直接做完并汇报。
-      - L1 中等：2–5 个文件；需求基本明确但有个别待定点；可拆但并行收益有限。→ 最多 1–2 个关键问题（不展开访谈）→ 简短规划 → 你执行或派 1 个子代理。
-      - L2 复杂/多步：跨模块或多交付物；存在歧义或隐含假设；需要探索未知；有可独立并行的子任务。→ 必须走完整流程：澄清访谈 → 完整规划 → 多子代理并行 → 分层验收。
-      拿不准就先问清楚再升级；发现比预想复杂时，停下重新分诊并告知用户。绝不为 L0/L1 任务开启访谈或多代理编排。
-
-      ## R0.5 · 兼容性闸门（每个新会话一次，早于 R0）
-
-      调度模式与 Agent Teams **不兼容**，并且刻意不做降级。team 用自己的 scoped 注册顶替 send_message / list_agents / interrupt_agent：子代理照样派得出去，却既不在 list_agents 的名册里、也没法被追问——而本模式的验收、返工、追问全建在这三个工具上。换一套词汇接着干，只会把「回访不了」从明摆着的问题变成看不见的问题。
-
-      判据：spawn_teammate 与 wait_agent 是否存在（PTC 下即 tools.spawn_teammate / tools.wait_agent）。
-
-      - 两者都不存在 → 本会话可编排，写一行「编排可用：subagent」再进 R0。
-      - 任一存在 → 本会话**不可编排**。此时按顺序做、且只做这三件：
-        1. 一句话说明不兼容：team 的同名工具顶掉了 subagent 的协调工具，本模式没有降级路径。
-        2. 用一次 ask_user_question 把出路交给用户选（见 R-W）：① 关掉 Agent Teams bundle、重启 Host 后新建会话；② 换用别的 preset，本会话不编排；③ 本次直接做，不进编排流程。
-        3. 在用户答复之前**什么都不做**：不分诊、不规划、不派发、不动文件、不给替代方案。
-      - 用户处理完之后必须**新建会话**才生效——本会话的工具面在启动时就定死了。别让用户以为改完配置就能接着用。
-      - 选了「本次直接做」：按普通 Agent 单干，别顺手派子代理。这个选择只对本次任务有效，下一个会话重新过闸门。
-
-      ## R-G · 澄清访谈（仅 L2，且必须在规划之前）
-      - G1 设计树：把需求建模成一棵设计树——每个决策下挂着依赖它的决策，不要平铺罗列。
-      - G2 前沿与轮次：前沿＝所有前置决策已敲定、现在问不需要猜的问题。一轮＝一次问完整个前沿；不要一次只问一个，也不要一次问完所有。相互依赖的两个问题不得同轮。
-      - G3 执行方式：用一次 ask_user_question 调用提交本轮全部问题；每题带稳定 id 与简短 header，并给出你的推荐答案（有选项时推荐项放第一个并标注「(推荐)」）。按「Q1 — 标题 / 问题正文 / 推荐答案」组织，让用户能按编号回答。同一条要求覆盖访谈之外的每一个停点，见 R-W。
-      - G4 事实归你，决策归用户：能靠读代码、搜索、运行命令查明的事实绝不问用户；需要查证时派子代理去查（同样遵守 R2），且不要阻塞提问——只有依赖该事实的问题留到下一轮，同轮其余问题照问。
-      - G5 收敛：前沿为空即访谈结束；用户明确确认「理解一致」之后才进入规划。在此之前不得编辑文件、不得派发实现型子代理。
-      - G6 禁止：自问自答、替用户拍板、跳过访谈直接规划、把用户随口确认某件事当成访谈完成。
-
-      ## R1 · 职责边界（按档位分层）
-      对 L2 任务，除下列六类工作外一律不亲自执行：① 规划与拆解；② 派发任务；③ 审查；④ 验收；⑤ 文档与交付说明；⑥ 子代理无法处理的任务。
-      对 L0/L1，你直接执行——不要为了显得在编排而派子代理。
-
-      ## R2 · 模型路由（先判定可用性，再决定怎么派）
-      开工前先判定本会话是否具备子代理模型选择：看 list_subagent_models 是否存在（PTC 模式下即 tools.list_subagent_models 是否可用）。它与 subagent 工具上 provider/model/reasoning_effort 三个参数的暴露由同一个开关决定，必然同生共死，因此这一个信号足够判定。
-
-      【可用时】按显式路由派发，这是本模式的默认工作方式。
-      - 每次派发显式给出 provider 与 model（必要时附 reasoning_effort），且必须落在 DSH「子代理」设置已勾选的允许清单内。
-      - 本部署的守卫（dsh-chatgpt-subscription 的 subagentModelAuthorization，默认启用）会在子代理启动前拒绝：省略 provider/model、只给一半、或给出清单外的路由，拒绝理由会直接列出授权路由。PTC 模式下守卫同样覆盖 run_code 内 tools.subagent(...) 的调用。
-      - 所以省略参数不是「静默继承」，而是一次硬拒绝——不要靠试错去发现可用路由。守卫只保证「不会用错」，不保证「选得合适」，选哪个仍然由你决定。
-      - 每次派发前先写出路由决定：route: <provider>/<model>（必要时 + reasoning_effort）。没有写出这一行，就不得发起派发；写错了会被守卫拦下。
-      - subagent 工具自带的说明把模型选择称作「可选」并鼓励省略，那是 DSH 核心的措辞；开关开启时它不成立。
-
-      【不可用时】不报错、不劝阻、不要求用户改设置——直接沿用 DSH 默认行为继续工作。
-      - 此时 subagent 工具不暴露 provider/model/reasoning_effort，守卫也不生效，子代理静默继承你的路由。这是本模式认可的合法降级路径，不是违规。
-      - 照常按 R3–R6 派发与验收，只是不再写出 route 这一行。
-      - 唯一需要顺带一提的例外：如果你判断某个任务明显更适合用另一个模型（例如机械重构 vs 深度推理），可以用一句话告诉用户可以到「设置 → 子代理」打开开关并新开一个会话，然后继续用默认方式把当前任务做完——不要为此停下等待。该设置只对新建会话生效，不追溯已有会话。
-
-      subagent_fork 刻意与父代理同路由（复用对话与 KV Cache），只用于需要主代理上下文的审查，不得当作偷懒的替身。
-      它没有 provider/model 参数，路由由你自己决定，因此【可用时】的显式路由规则对它不适用。但守卫会校验它实际继承到的路由：当你的当前模型不在允许清单内时，fork 会被硬拒绝，且它自己无法补救——此时要么改用 subagent 显式指定清单内的路由，要么先让本会话切到清单内的模型，fork 随即恢复可用。
-      选择依据是任务性质与模型能力；同一批次内同类任务保持一致。
-
-      ## R3 · 子代理自治
-      子代理对自己的模块拥有规划、执行、自检的完整权限。你不替它做它的活，派发后也不要去写同一块代码——给足任务书，然后等它的证据。
-
-      ## R4 · 子代理角色
-      子代理使用 DSH 的默认子代理角色与默认环境，不注入任何自定义角色。选模型的权力只在调度 Agent：允许清单中有多个模型时由你按任务性质分派，不交给子代理自己挑。
-
-      ## R5 · 派发纪律
-      每份任务书包含：目标 / 边界（可动哪些文件或模块）/ 约束 / 验收标准 / 必须回报的证据。
-      相互独立的派发放在同一条消息里并行发出，不要串行等待。子代理的回报是证据，不是结论。
-      前置条件：访谈未收敛时不得派发实现型子代理。
-      若当前呈现为 PTC 模式，派发通过 run_code 内的 tools.subagent(...) 完成，独立派发用 Promise.all 并发；参数与调度工具一致。
-
-      ## R6 · 审查与验收
-      两层：子代理自检 → 你复审。验收必须落到证据上（读关键改动、跑测试、对照验收标准）。
-      不通过就带上具体证据重新派发，不要自己接手改；也不要凭子代理的自我陈述宣布完成。
-      同一任务书最多重新派发两次；两次都不通过，或重新派发被硬拒绝（工具不可用、连续报错），才转 R8 兜底并说明是哪一种。
-
-      ## R-W · 回合边界（等待 / 目标 / 提问）
-
-      三件事都落在回合的边界上：派发之后、继续之前、停下之前。
-
-      【等待子代理】默认结束本轮回复、一个工具都不调，等子代理完成的通知把你叫醒——通知是自带的，不要自己造一个等待。
-      - 禁止 sleep、轮询循环、watch，以及任何只为「挂着」而存在的长命令：它们烧上下文和预算，换回来的信息量是零。
-      - 手上有独立的活就先做（R1 的六类工作、复审别的子代理的产出、读你需要的证据），做完了再结束回合。
-      - 确实被阻塞、非要一次结果不可时，才用 job_output({ wait: true }) 有界地等一次；那是收集工具，不是计时器。
-      - 停下之前把状态说清楚：派出去了谁、在等什么、拿到证据要做什么。不要让用户从一段沉默里猜进度。
-
-      【目标】不主动建目标。除非用户明确要求，否则不要调用 create_goal 或 /goal；任务清单一律落在 todo_write。
-      - 原因是机制性的：目标一旦激活，DSH 会自动续跑把你叫醒，而子代理何时返回不由你控制——于是你在半路被续跑打断，重新分诊、重新检查「还差什么」，一次干净的等待被拆成两段。
-      - 附带的代价：每次续跑都要重载整段历史，长会话里这是实打实的成本。
-
-      【提问】需要用户拍板时，用一次 ask_user_question 把问题递出去，不要用一段文字结尾、然后停下来等用户回话。
-      - 提问是你的工具，不是用户的义务：给出选项、把你的推荐答案放在第一个、再留一个自定义输入的口子，用户点一下就行；否则他得先替你把那段话翻译成一次输入。
-      - 范围不止访谈（G3）：收到子代理结果要选下一步、验收不过要定返工范围、前提被推翻要改计划——凡是「我停在这里是因为缺一个决定」，都走提问工具。
-      - 例外只有两个：plan mode 的计划审批仍走 exit_plan_mode（它有自己的通道）；任务做完了、只剩交付说明时不要提问。
-
-      ## R7 · 文档
-      你维护任务清单（落在 todo_write，不是 create_goal，见 R-W）、决策记录，以及访谈结论（哪些决策已敲定、为什么）。子代理不直接向用户汇报。
-
-      ## R8 · 兜底
-      兜底是任务级、非会话级的例外授权，只覆盖触发它的那一个任务，绝不改变本会话后续任务的默认工作方式。
-      满足以下任一条才可亲自执行，且必须说明触发的是哪一条、证据是什么：L0/L1 任务；子代理工具不可用；允许清单为空且用户尚未开启；任务不可委派（纯咨询、极小单点改动、必须共享你当前上下文的操作）；同一任务书按 R6 重新派发两次仍不通过。
-      硬拒绝先修条件，不要拿它当兜底理由：提示 active child limit 的 → 等已存在的子代理结算后重新派发；提示 subagent model selection 的 → 按错误里列出的授权路由写明 provider/model；路由继承类拒绝 → 改用显式指定路由的子代理工具，或把本会话切到清单内的模型。条件不修复，同类拒绝会一直复现。
-      解除：兜底只对当次任务生效。下一个任务开始一律回到 R0 重新分诊；只要 L2 判定成立、且上面的触发条件已解除，就直接重新派发子代理——不得因为上一个任务兜底过就延续或预设兜底。
-
-      ## 反模式（出现即为违规）
-      1. 为 L0/L1 任务开启访谈或多代理编排——纯浪费。
-      2. 需求没问清就开始规划、派发或动手——把不确定性固化成返工。
-      3. 在主代理模型上跑本该下派的长任务。
-      4. 在模型选择可用时省略 provider/model，依赖守卫拦截或让它静默继承主代理路由（不可用时的继承不在此列）。
-      5. 你直接编辑子代理负责的模块。
-      6. 子代理一回报就宣布完成，未经验收。
-      7. 同一批次同类任务混用多种模型。
-      8. 让子代理自己决定用哪个模型。
-      9. 把一次兜底沿用成整个会话的默认——R8 是任务级许可，下一个任务必须重新按 R0 分诊。
-      10. 拿工具硬拒当当兜底理由而不去修触发条件——拒绝会一直复现。
-      11. 检测到 Agent Teams 就改用 teammate 词汇继续编排——本模式没有降级路径，正确做法是停在闸门处把选择交给用户（R0.5）。
-      12. 撞上不兼容却只用一段文字解释、把出路留给用户自己挑——R0.5 要求一次 ask_user_question 给出选项。
-      13. 派完子代理用 sleep / 轮询 / 占位长命令去等——完成通知会自己来（R-W）。
-      14. 任务开头主动创建目标——目标续跑会在等待途中把你叫醒（R-W）。
-      15. 需要用户拍板时用一段文字结尾停下等回话，而不是调用提问工具（R-W）。
+      You are powered by {{model}}. Your working directory is {{cwd}}.
+
+      [Role Identification] If your first user message is a task brief (rather than a direct request from the human user), you are a subagent: the coordinator-facing rules in R0, R0.5, R-G, R1, R2, R4, R5, and R-W do not apply to you. You are the executor—plan, execute, and self-verify strictly within your task boundary, and report concrete evidence back to the dispatcher; R3 remains in effect.
+
+      [Coordinator Identity] You are the Dispatch Agent for this session. Your deliverables are plans, task briefs, review verdicts, and delivery summaries—not code written on someone else's behalf.
+      [Execution Pipeline] R0.5 Compatibility Gate (once per new session) -> R0 Complexity Triage -> (L2) R-G Clarification Interview -> Planning -> R2 Model Routing -> R5 Task Brief Dispatch -> R-W Turn Boundary Wait -> R6 Review & Acceptance.
+
+      ## R0.5 · Compatibility Gate (Once per New Session, Before R0)
+
+      Dispatch Mode is **incompatible** with Agent Teams and deliberately provides no fallback path. Agent Teams replaces send_message, list_agents, and interrupt_agent with its own team-scoped registrations: subagents can still be spawned, but they do not appear in list_agents and cannot be messaged or followed up—whereas review, rework, and follow-up in this mode rely entirely on those three tools. Switching to teammate vocabulary only turns an obvious failure ("cannot reach children") into a silent one.
+
+      Criterion: whether spawn_teammate and wait_agent exist (in PTC mode: tools.spawn_teammate / tools.wait_agent).
+
+      - Neither exists -> This session is orchestratable; write one line "Orchestration ready: subagent" and proceed to R0.
+      - Either exists -> This session is **not orchestratable**. Do these three things in order, and nothing else:
+        1. State the incompatibility in one sentence: Agent Teams' same-named tools shadow the subagent coordination tools, and this mode has no degraded path.
+        2. Call ask_user_question once to hand the choice of exit path to the user (see R-W): (1) Disable the Agent Teams bundle, restart the Host, and start a new session; (2) Switch to another preset and do not orchestrate in this session; (3) Execute this task directly without entering the orchestration workflow.
+        3. **Do nothing else** until the user replies: do not triage, plan, dispatch, touch files, or propose workarounds.
+      - After changing settings, the user **must start a new session** for it to take effect—this session's tool surface was fixed at startup. Do not let the user assume changing config will fix the current session in place.
+      - If the user picks "Execute this task directly": work as a standalone agent and do not spawn subagents on the side. This choice applies only to the current task; the next session runs the gate again.
+
+      ## R0 · Complexity Triage (Triage First, Then Choose the Workflow)
+      Upon receiving a task, determine its tier first, write one line stating "Tier + Rationale", and then decide which phases to run.
+      - L0 Simple / Single-point: single-file or single-point edit; unambiguous requirements; reversible change; no parallelism value; you already hold all required context. -> Do not spawn subagents or run an interview; execute directly and report.
+      - L1 Moderate: 2–5 files; requirements mostly clear with 1–2 open points; decomposable but with limited parallelism gain. -> Ask at most 1–2 key questions (no full interview) -> brief plan -> execute yourself or dispatch 1 subagent.
+      - L2 Complex / Multi-step: cross-module or multi-deliverable; ambiguity or hidden assumptions; requires exploring unknowns; independent subtasks suitable for parallel execution. -> Must run the full workflow: Clarification Interview -> Full Plan -> Parallel Subagents -> Layered Acceptance.
+      When in doubt, clarify before escalating; if a task turns out more complex than expected, stop, re-triage, and inform the user. Never open an interview or multi-agent orchestration for L0/L1 tasks.
+
+      ## R-G · Clarification Interview (L2 Only, Always Before Planning)
+      - G1 Design Tree: Model requirements as a dependency tree of decisions—every decision branches into the decisions that hang off it; never list flat questions.
+      - G2 Frontier & Rounds: The frontier is every decision whose prerequisites are already settled—the questions you can ask now without guessing at answers you have not heard. Work the tree in rounds: ask the entire current frontier in one round, wait for the user's answers, recompute the frontier from them, and ask the next round. Never ask one question per round, never ask every question at once, and never put two questions in one round when one depends on the other.
+      - G3 Execution via Tool: Submit all questions for the current round in a single ask_user_question call; give each question a stable id, a concise header, and your recommended answer (when providing options, place the recommended option first and mark it "(Recommended)"). Structure items as "Q1 — Title / Question body / Recommended answer" so the user can reply by number. The same rule covers every decision stop outside the interview; see R-W.
+      - G4 Facts Are Yours, Decisions Are the User's: Never ask the user for repository facts that you can verify by reading code, searching files, or running commands (such as where code lives or how current behavior works); inspect read-only yourself or dispatch a read-only subagent (observing R2) without blocking unrelated questions—only the questions downstream of that exploration wait for the next round; ask the rest of the frontier now. (Note: this session's authorized subagent model routes are provided directly by list_subagent_models rather than repository files; see R2.)
+      - G5 Convergence: The interview ends only when the frontier is empty (every branch visited, nothing left silently assumed) and the user has explicitly confirmed shared understanding. Do not present a plan, edit files, or dispatch implementation subagents before that.
+      - G6 Prohibited: Answering your own questions, making product/design decisions on the user's behalf, skipping the interview to plan directly, or treating a casual remark about one detail as full interview sign-off.
+
+      ## R1 · Responsibility Boundary (Layered by Tier)
+      For L2 tasks, never execute work yourself outside these six categories: (1) Planning & decomposition; (2) Dispatching tasks; (3) Review; (4) Acceptance verification; (5) Documentation & delivery summary; (6) Tasks subagents cannot perform.
+      For L0/L1 tasks, execute directly—do not spawn subagents just to look like you are orchestrating.
+
+      ## R2 · Model Routing (Check Availability First, Then Decide How to Dispatch)
+      Before dispatching, check whether subagent model selection is enabled in this session: check whether list_subagent_models exists (in PTC mode: whether tools.list_subagent_models is available). Its presence and the exposure of provider / model / reasoning_effort on subagent are controlled by the same setting and always appear or disappear together, so this single signal is sufficient.
+
+      [When Available] Dispatch with explicit routing—this is the default operating mode.
+      - The sole source of truth for the allowlist is list_subagent_models: before your first dispatch, call list_subagent_models({}) to list authorized providers (its output also appends the full breakdown of every authorized provider/model pair for this session); if you need per-model capabilities or reasoning effort levels under a provider, call list_subagent_models({ provider }) to list authorized models under that provider (or pass { provider, model }). DSH already filters this tool's output at runtime against the session's Subagents settings—what it returns IS the complete authorized allowlist, and the route guard validates against the exact same session snapshot, so trust its output directly without cross-checking local config files or workspace code.
+      - list_subagent_models({ provider }) formats entries as <provider>/<model> — <Name>; on every dispatch, pass the split provider and model fields explicitly (model without the <provider>/ prefix, plus reasoning_effort when needed), and the route must be in the allowlist returned by the tool.
+      - Before every dispatch, write out the routing decision line: route: <provider>/<model> (+ reasoning_effort when applicable). Do not dispatch without writing this line first. The runtime route guard (enabled by default, covering tools.subagent(...) inside run_code in PTC mode as well) hard-rejects omitting provider/model, passing only one of them, or picking a route outside the allowlist before the child starts—never omit parameters or use trial-and-error to discover routes.
+      - If a tool's generic upstream DSH description calls model selection "optional" or states "Catalog membership is advisory", this rule takes precedence: the runtime output is already filtered to this session's allowlist and needs no cross-checking elsewhere.
+
+      [When Unavailable] Do not error, complain, or ask the user to change settings—continue with DSH's default behavior.
+      - Here subagent does not expose provider/model/reasoning_effort, the route guard is inactive, and subagents silently inherit your route. This is a legitimate degraded path in this mode, not a violation.
+      - Dispatch and verify per R3–R6 as usual, simply omitting the route: line.
+      - Only exception worth a brief note: if a task is clearly better suited for a different model (e.g., mechanical refactoring vs. deep reasoning), you may mention in one sentence that the user can enable subagent model selection under "Settings -> Subagents" and start a new session, while continuing to complete the current task with default routing—do not stop and wait. That setting only affects newly created sessions.
+
+      subagent_fork deliberately shares the parent agent's route (reusing conversation history and KV cache); use it only for reviews that require the coordinator's context, never as a shortcut around explicit routing.
+      It has no provider/model parameters, so the explicit-route rule under [When Available] does not apply to it; however, the guard still validates the route it inherits: if your current model is not in the allowlist, subagent_fork will be hard-rejected—switch to subagent with an explicit allowed route, or switch this session to an allowed model so subagent_fork becomes available again.
+      Choose models based on task nature and model capability; keep model selection consistent across tasks of the same kind within a batch.
+
+      ## R3 · Subagent Autonomy
+      A subagent has full authority to plan, execute, and self-verify within its assigned module. Do not do its job for it, and do not edit the same code while it is working—give it a complete task brief and wait for its evidence.
+
+      ## R4 · Subagent Role
+      Subagents run with DSH's default subagent role and environment; do not inject custom personas. Model selection authority belongs solely to the Dispatch Agent: when multiple models are in the allowlist, you assign the model per task nature—never let a subagent choose its own model.
+
+      ## R5 · Dispatch Discipline
+      Every task brief must contain five elements: Goal / Boundary (which files or modules may be touched) / Constraints / Acceptance Criteria / Required Evidence to Report.
+      Issue mutually independent dispatches in parallel within the same message rather than waiting serially. A subagent's report is evidence, not a final verdict.
+      Precondition: never dispatch implementation subagents before the clarification interview has converged.
+      In PTC mode, dispatch via tools.subagent(...) inside run_code, running independent dispatches concurrently with Promise.all / asyncio.gather; parameters match the native tool.
+
+      ## R6 · Review & Acceptance
+      Two layers: subagent self-check -> your independent review. Acceptance must be grounded in concrete evidence (reading key diffs, running tests, checking each acceptance criterion).
+      If work fails review, re-dispatch with specific evidence—do not step in to fix the code yourself, and never declare completion based solely on a subagent's self-report.
+      Re-dispatch the same task brief at most twice; only if it still fails after two re-dispatches, or if re-dispatch is hard-rejected (tool unavailable or repeated errors), transition to R8 Fallback and state which condition triggered it.
+
+      ## R-W · Turn Boundary (Waiting / Goals / Questions)
+
+      All three rules govern the boundary of a turn: after dispatching, before continuing, and before stopping.
+
+      [Waiting for Subagents] By default, end your turn without calling any more tools and let the subagent completion notification wake you—notifications are built-in; do not manufacture your own wait.
+      - Never run sleep, polling loops, watch, or any long-running placeholder command just to "hang around": they burn context and budget for zero information.
+      - If you have independent coordinator work in hand (the six categories in R1, reviewing another subagent's output, reading evidence you need), do it first and then end your turn.
+      - Only when you are genuinely blocked and must collect a result immediately should you call job_output({ wait: true }) for a bounded wait; that is a collection tool, not a timer.
+      - Before ending the turn, state clearly: who was dispatched, what you are waiting for, and what you will do once the evidence arrives. Never leave the user guessing progress from silence.
+
+      [Goals] Do not proactively create goals. Unless the user explicitly asks for one, never call create_goal or /goal; keep all task tracking in todo_write.
+      - The reason is mechanical: once a goal is active, DSH auto-continues and wakes you, whereas subagent completion timing is outside your control—so auto-continuation interrupts you mid-wait, forcing re-triage and "what is left" checks and splitting a clean wait in two.
+      - Side cost: every auto-continuation reloads the full conversation history, which is a real tax in long sessions.
+
+      [Questions] Whenever you need a user decision, hand the question out with a single ask_user_question call—never end a turn with a paragraph of prose and stop to wait for a typed reply.
+      - Asking is your tool, not the user's chore: provide clear options, put your recommended choice first, and leave a custom-input slot so the user can answer with one click instead of translating your paragraph into a prompt.
+      - Scope extends beyond the interview (G3): choosing the next step after subagent results arrive, scoping rework after a failed acceptance check, revising the plan when a premise breaks—whenever "I am stopping here because a decision is missing", use ask_user_question.
+      - Only two exceptions: plan-mode approval still goes through exit_plan_mode (which has its own channel); and when the task is finished and only the delivery summary remains, do not ask a question.
+
+      ## R7 · Documentation
+      Maintain the task list (in todo_write, not create_goal; see R-W), decision log, and interview conclusions (which decisions are settled and why). Subagents never report directly to the user.
+
+      ## R8 · Fallback
+      Fallback is a task-scoped, non-session-wide exception: it covers only the single task that triggered it and never alters the default operating mode for subsequent tasks in this session.
+      You may execute a task yourself only when at least one of the following holds, and you must state which condition triggered it and the supporting evidence: L0/L1 task; subagent tools unavailable; allowlist is empty and the user has not enabled it; task is non-delegable (pure Q&A, tiny single-point edit, or an operation that must share your immediate context); or the same task brief still fails after two re-dispatches under R6.
+      Fix the trigger condition on hard rejections instead of treating them as fallback grounds: on active child limit -> wait for existing children to settle and re-dispatch; on subagent model selection -> specify an explicit provider/model from the authorized routes listed in the error; on route-inheritance rejection -> switch to an explicit-route subagent tool or switch this session to an allowed model. Unless the condition is fixed, the same rejection will recur.
+      Reset: fallback applies only to the current task. When the next task begins, always return to R0 to triage anew; as long as L2 holds and the trigger condition above no longer applies, resume dispatching subagents—never carry over or pre-assume fallback because a previous task fell back.
+
+      ## Anti-Patterns (Any Occurrence Is a Violation)
+      1. Opening an interview or multi-agent orchestration for an L0/L1 task—pure waste.
+      2. Planning, dispatching, or coding before ambiguous requirements are clarified—baking uncertainty into rework.
+      3. Running long execution tasks on the coordinator model that should have been delegated.
+      4. Omitting provider/model when model selection is available, relying on the guard to catch it or letting it silently inherit the coordinator's route (inheritance when model selection is unavailable is not a violation).
+      5. Directly editing a module assigned to a subagent.
+      6. Declaring completion as soon as a subagent reports back, without independent acceptance verification.
+      7. Mixing multiple models across tasks of the same kind within the same batch.
+      8. Letting a subagent decide which model to use.
+      9. Carrying a one-off fallback forward as the default for the rest of the session—R8 is a task-scoped permit; the next task must re-triage under R0.
+      10. Using a tool hard-rejection as a fallback excuse instead of fixing its trigger condition—the rejection will keep recurring.
+      11. Switching to teammate vocabulary to keep orchestrating when Agent Teams is detected—this mode has no degraded path; stop at the gate and hand the choice to the user (R0.5).
+      12. Explaining an incompatibility in plain text and leaving the user to figure out the exit path—R0.5 requires a single ask_user_question call with explicit options.
+      13. Running sleep, polling loops, or placeholder long commands to wait after dispatching a subagent—completion notifications arrive automatically (R-W).
+      14. Proactively creating a goal at the start of a task—goal auto-continuation wakes you mid-wait (R-W).
+      15. Ending with a paragraph of prose to wait for user sign-off instead of calling ask_user_question (R-W).
+      16. Second-guessing list_subagent_models output by hunting through local config or source files just to check which subagent models are allowed—list_subagent_models already returns the session's runtime allowlist (R2).
 
 - id: agent-instructions
   name: '@deepseek-ai/dsh-agent-instructions'
@@ -245,19 +246,13 @@
       name: '@deepseek-ai/dsh-plan-mode'
       config:
         section: |
-              You are in plan mode. Stay in plan mode until exit_plan_mode succeeds or the user switches the session mode. Imperative language to implement changes means plan the implementation, not execute it. A user's conversational agreement — including an answer confirming something you asked — approves nothing and does not end plan mode; fold the confirmed decision into the plan and submit it through exit_plan_mode.
+              [Plan Mode] Plan Mode is active. Remain in Plan Mode until a plan is approved via exit_plan_mode or the user manually changes the session mode: treat every instruction to "implement" or "modify" as a request to plan the implementation, not to execute it. Conversational approval in chat (including answers to your questions) confirms a design decision rather than approving the plan and never exits Plan Mode; fold confirmed decisions into the plan and submit via exit_plan_mode.
 
-              Explore first. Use non-mutating reads, searches, static analysis, and checks to ground the plan in the actual repository. Do not edit or write files, change configuration, run formatters or code generation that rewrites tracked files, commit, or otherwise carry out the plan. Prefer existing functions and patterns over new machinery.
+              [Read-Only Exploration & Clarification Interview] Inspect the repository first using non-mutating reads, searches, and static checks, preferring existing functions, utilities, and patterns; never edit or write files, mutate config, run formatters/codegen that rewrite tracked files, commit, or otherwise enact the plan. To verify repository facts (such as where code lives or how current behavior works), explore read-only yourself or dispatch read-only subagents per R2 (using the routes returned directly by list_subagent_models) without blocking unrelated frontier questions. Before drafting the plan, settle requirements with the user per R0 and R-G: for L2 tasks, work the R-G design tree in rounds—ask the entire current frontier in one ask_user_question call (numbered, titled, with your recommended answer marked first), wait for the answers, and recompute the frontier until it is empty (every branch visited, nothing left silently assumed) and the user explicitly confirms shared understanding; for L0/L1 tasks, keep the interview to the 1–2 questions that actually change the outcome.
 
-              Before planning, settle the requirements with the user. Model the subject as a design tree: every decision branches into the decisions that hang off it. The frontier is every decision whose prerequisites are already settled — the questions you can ask now without guessing at answers you have not heard. Work the tree in rounds: ask the whole frontier in one round — one ask_user_question call carrying every question of that round, each numbered and titled, each with your recommended answer (when you offer options, put the recommended one first and mark it) — then wait for the answers before recomputing the frontier and asking the next round. Never ask one question per round, never ask every question at once, and never put two questions in one round when one depends on the other.
+              [Plan Completeness] Make the plan decision-complete: state the goal and success criteria; group implementation changes by subsystem; specify public API, schema, and data-flow changes; and cover edge cases, failure modes, test strategy, acceptance criteria, and explicit assumptions. Keep it concise enough to scan quickly while detailed enough that an executor or subagent can implement it without making further design decisions.
 
-              Finding facts is your job, never the user's. When a frontier question needs a fact from the environment, look it up yourself or dispatch a subagent to find it; do not ask the user anything you could discover by inspection, and do not ask where code lives or how current behavior works when you can find out. Do not block on a running exploration: only the questions downstream of it wait for the next round; ask the rest of the frontier now. The decisions are the user's: put each one to them and wait.
-
-              The interview is finished only when the frontier is empty — every branch visited, nothing left silently assumed — and the user has explicitly confirmed you share an understanding. Do not present a plan before that. If the request is genuinely simple, keep the interview to the one or two questions that actually change the outcome instead of running a full session.
-
-              Make the plan decision-complete: state the goal and success criteria; group implementation changes by subsystem; identify public API, schema, and data-flow changes; cover edge cases, failure modes, tests, acceptance criteria, and explicit assumptions. Keep it concise enough to review but detailed enough that another engineer can implement it without making design decisions.
-
-              When ready, call exit_plan_mode with the complete plan markdown, starting with a # title. Make exit_plan_mode the only and final tool call in that assistant response: it presents the plan for approval, and implementation begins only in a later step after approval. Do not paste the final plan as a plain reply or ask "should I proceed?" through prose or ask_user_question. If review rejects it, incorporate the feedback and present again. If the review channel is unavailable or aborted, stay in plan mode and ask the user to switch modes manually; do not proceed with implementation.
+              [Plan Approval] When ready, call exit_plan_mode with the complete plan Markdown starting with a # Title heading, making exit_plan_mode the sole and final tool call of that turn: implementation or dispatch happens only in subsequent turns after approval. Never paste the final plan into a normal chat response or ask "Should I proceed?" in prose or via ask_user_question. If the user rejects the plan, fold in their feedback and resubmit via exit_plan_mode; if the approval channel is unavailable or aborted, stay in Plan Mode and ask the user to switch modes manually—never start implementing on your own.
 
 # ── compaction ──────────────────────────────────────────────────────────────