@khorsheed/dsh-local-agent-codex 0.1.0-rc.8 → 0.2.0-rc.1

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # 变更记录
 
+## 0.2.0-rc.1（2026-09-30）
+
+- **家族折叠：委派工具收进本包**。新增 `./tool` 组合入口（`src/tool.ts`）——`subagent_codex` 委派工具由 agent 预设点名 `name: '@khorsheed/dsh-local-agent-codex/tool'` 按会话授予，Config 两字段（`provider` / `toolName`）全部可选、默认即本包取值，预设行无需配置；行 id `tool-subagent-codex-local` 不变。bundle patch 不再插 profile 根工具行（官方 `tool-subagent-codex` 行的停用覆盖保留），本包自挂载恰好一行（provider 行）。实现共享自家族核 `@khorsheed/dsh-local-agent` 的 `./tool-factory` 导出；对 `@khorsheed/dsh-local-agent-tool-subagent` 的依赖移除（该包退役）。
+
 ## 0.1.0-rc.8（2026-09-30）
 
 家族同版联动：加宽 `@deepseek-ai/dsh-*` peer 区间以覆盖宿主 0.2.0（0.2.0 的兼容闸会禁用 peer 区间不覆盖宿主版本的已装插件）。无功能变更。

package/README.en.md

@@ -10,7 +10,7 @@ dsh agents already get work done, but some tasks you simply want to give to your
 
 ## Features
 
-- **Delegate from any preset** — the `subagent_codex` tool mounts at the profile root; no per-preset setup.
+- **Per-session delegation grant** — the `subagent_codex` tool is this package's `./tool` composition entry, granted to the sessions of an agent preset that names it (e.g. dev mode); no per-preset setup.
 - **Scoped-home isolation** — all Codex state (config, credentials, rollout session records) lives in `$DSH_HOME/local-agent/codex`, separate from your `~/.codex`.
 - **In-session login** — `/codex login` runs `codex login` on a pseudo-terminal and the authorization page opens in your browser by itself; when the page hands you a code, paste it back with `/codex code <code>`. The settings card shows auth status and offers sign-out.
 - **Resident mode (live)** — one resident `codex app-server` process per member, one turn per round: output streams into the child session in real time, cancel does not kill the process, and a crash resumes the same thread; off — or a channel that cannot come up — means the one-shot `codex exec` path, hot-switched without a reload.
@@ -114,7 +114,7 @@ The last line selects the provider for delegations; keep the rest of the file in
 
 **Named scopes.** `/codex login --scope <name>` opens a second scoped home at `<homesRoot>/codex@<name>`: the directory is provisioned with the same `config.toml` that pins credential storage to a file rather than the macOS keychain, so that scope's login lands in its own `auth.json`. A scoped delegation runs `codex exec` there, writes its rollout there and reads it back from there — exec-only, because the resident app-server is bound to the default scoped home.
 
-**Bundle composition.** The patch registers the `codex` harness (scoped `CODEX_HOME`, PTY login, rollout-file session records) and mounts the `subagent_codex` tool at the profile root — the official preset row of that name already ships `disabled: true`, and the patch disables it once more, so a community install can never register two `subagent_codex` tools; a user who deliberately re-enables the official row in their own preset layer gets a loud duplicate-name conflict and must choose one, by design. The `codex-local` provider spawns `codex exec` under that home (the one-shot drive when live is off). The browser half ships with this package's `./client`: the Codex settings card composes the family core's shared `ProviderAuthBlock`, landing on the Plugins page's per-package detail view (`plugins.bundle.config`, keyed by package name) for a standalone install, on the bundle detail view's row-level configure entry (`plugins.row.config`) when installed as a family-bundle member, and — on 0.1.5 — on the Settings → Plugins → 插件配置 tab (`settings.plugin.item`, keyed by the settings namespace); card writes ride the bound settingsScope and hot-apply without a reload. The core itself comes from `@khorsheed/dsh-local-agent`, declared as a dependency.
+**Bundle composition.** The patch registers the `codex` harness (scoped `CODEX_HOME`, PTY login, rollout-file session records) — exactly one provider row; since the family fold the `subagent_codex` tool is this package's `./tool` composition entry, granted per session by an agent preset that names it (the dev preset's `tool-subagent-codex-local` row), no longer mounted at the profile root. The family keeps the official model-facing name `subagent_codex`: the official preset row of that name already ships `disabled: true`, and the patch disables the profile-root row once more, so a community install can never register two `subagent_codex` tools; a user who deliberately re-enables the official row in their own preset layer gets a loud duplicate-name conflict and must choose one, by design. The `codex-local` provider spawns `codex exec` under that home (the one-shot drive when live is off). The browser half ships with this package's `./client`: the Codex settings card composes the family core's shared `ProviderAuthBlock`, landing on the Plugins page's per-package detail view (`plugins.bundle.config`, keyed by package name) for a standalone install, on the bundle detail view's row-level configure entry (`plugins.row.config`) when installed as a family-bundle member, and — on 0.1.5 — on the Settings → Plugins → 插件配置 tab (`settings.plugin.item`, keyed by the settings namespace); card writes ride the bound settingsScope and hot-apply without a reload. The core itself comes from `@khorsheed/dsh-local-agent`, declared as a dependency.
 
 **Login and credentials.** `/codex login` runs `codex login` on a pseudo-terminal through the host's subprocess seam — the CLI starts its own localhost callback server and opens the browser itself, the first-class flow; the command reply carries the authorization URL captured from the output as a fallback link, and when the CLI asks for a code the user pastes it with `/codex code <code>` (written to the child's stdin). Completion is decided by a credential watch on the scoped home: `auth.json` present with a stamp newer than the watch start — a leftover credential is never mistaken for a fresh login. A browserless remote terminal can still run `codex login --device-auth` by hand with `CODEX_HOME` pointed at the scoped home, landing in the same `auth.json`. First start writes a minimal `config.toml` pinning `cli_auth_credentials_store = "file"` — Codex's default `auto` would resolve to the macOS keychain, leaking credentials outside the scoped home and defeating this package's `auth.json` presence check; an existing config is left untouched. `/codex logout` deletes the scoped `auth.json`, so a later login authorizes a fresh account.
 
@@ -128,7 +128,7 @@ Both the locate and the scan are calibrated for concurrency. codex writes `turn_
 
 **Container delegation.** An orchestrator may run the round inside an **already-acquired container** through the facade's `DelegationCallOptions.exec` (`{ container, workdir, env? }`): the argv becomes `docker exec -w <workdir> [-e NAME…] <container> codex exec …` and everything else (stream parse, settle, rollout readback, recording) is byte-for-byte unchanged. `env` must name the in-container `CODEX_HOME`, and it should be the read-write bind mount of the host scoped home — the rollout readback reads the host copy. A container round always takes the exec one-shot (the resident app-server is a host process) and declares no member bridge (a host unix socket cannot reach into the container). Measured: one "answer 2+2" round in an `eval-env:pinned` unit settles `completed` with output `4`, and `observedModel` reads back as `gpt-5.6-sol` from the rollout the container wrote into the host scoped home.
 
-**Resume.** The family tool (`@khorsheed/dsh-local-agent-tool-subagent`) adds an optional `resume` parameter to the official `description`/`prompt` subset. A fresh delegation's result self-describes its handle (`追问请带 resume="<childSessionId>"`); passing it back continues the same codex thread (`codex exec --json resume <thread_id>`) in the same dsh child session, with per-round accounting. The handle is read only from the `resume` parameter and resolved by the `localAgent` registry only for the recording parent session and provider — a forged handle is rejected before any CLI process starts.
+**Resume.** The family tool (this package's `./tool` composition entry, sharing the family core's `./tool-factory` implementation) adds an optional `resume` parameter to the official `description`/`prompt` subset. A fresh delegation's result self-describes its handle (`追问请带 resume="<childSessionId>"`); passing it back continues the same codex thread (`codex exec --json resume <thread_id>`) in the same dsh child session, with per-round accounting. The handle is read only from the `resume` parameter and resolved by the `localAgent` registry only for the recording parent session and provider — a forged handle is rejected before any CLI process starts.
 
 **Event-stream mirror.** The subagent session mirrors the `codex exec --json` stream in order: `reasoning` → reasoning blocks, `agent_message` → reply text, `command_execution`/`web_search_call`/`function_call_output` → tool lines (`[工具 Bash] <command> → output`), `file_change` → an `ApplyPatch` card (kind and path per change), `function_call` (e.g. the multi-agent `wait`) → a card under its own name with the `function_call_output` merged in; the final `agent_message` is the run output and the round's usage rides the last mirrored assistant message. Resumed rounds append their own turn without duplication. Aborting settles the tool result immediately while keeping the events and usage already received.
 

package/README.i18n.yaml

@@ -2,5 +2,5 @@
 # last confirmed-consistent state. Both languages carry equal authority; after
 # editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/local-agent-codex/README.en.md
-packages/local-agent-codex/README.en.md: cc127472d85b28dfbb599b9a6c545682be5f6a4b
-packages/local-agent-codex/README.md: fbc7461e9bd406f05b9988e9a6ad1ed2fe3fab78
+packages/local-agent-codex/README.en.md: db346c4441e59ca802de149ec93b253a250e9cdd
+packages/local-agent-codex/README.md: 10d69741bf5034c13705231065546981d5596aaf

package/README.md

@@ -10,7 +10,7 @@ dsh 的 agent 已经能干活,但有些任务你就是想交给本机的 Codex C
 
 ## 特性
 
-- **任意 preset 皆可委派**——`subagent_codex` 工具挂在 profile 根,无需逐 preset 配置。
+- **按会话授予的委派**——`subagent_codex` 工具是本包的 `./tool` 组合入口,由点名它的 agent 预设(如开发模式)授予该预设的会话,无需逐 preset 配置。
 - **作用域目录隔离**——Codex 的全部状态(config、凭据、rollout 会话记录)留在 `$DSH_HOME/local-agent/codex`,与你的 `~/.codex` 互不干扰。
 - **会话内登录**——`/codex login` 在伪终端里跑 `codex login`,授权页自动在浏览器打开;页面给出 code 时用 `/codex code <code>` 粘贴回来。设置卡片显示认证状态并提供退出登录。
 - **常驻模式(live)**——每成员常驻一个 `codex app-server` 进程,按轮发 turn:输出实时流入子会话、取消不杀进程、崩溃后自动续上原线程;关闭或通道起不来即回一次性 `codex exec`,热切换无需重载。
@@ -114,7 +114,7 @@ model_provider = "dsh-router"
 
 **命名 scope。** `/codex login --scope <名>` 会在 `<homesRoot>/codex@<名>` 里另开一份作用域目录:目录建立时自动跑同一份 `config.toml` provision(把凭据存储钉在文件而非 macOS keychain),因此该 scope 的登录落在它自己的 `auth.json` 里。带 scope 的委派用它跑 `codex exec`、把 rollout 写进它、从它回读;只走 exec——常驻 app-server 绑的是缺省作用域目录。
 
-**bundle 组成。** patch 注册 `codex` harness(`CODEX_HOME` 作用域目录、PTY 登录、rollout 文件会话记录),并把 `subagent_codex` 工具挂到 profile 根——官方 preset 的同名行本就 `disabled: true`,patch 再禁一次,社区安装永远不会注册出两个 `subagent_codex`;刻意在自有 preset 层重新启用官方行的用户会得到响亮的重名冲突,按设计必须二选一。`codex-local` provider 在该作用域目录下 spawn `codex exec`(live 未启用时的一次性驱动)。浏览器半部分随本包 `./client` 提供:Codex 设置卡组合家族 core 的共享 `ProviderAuthBlock`,独立安装落在 Plugins 页的包详情视图(`plugins.bundle.config`,按包名派发),作为家族 bundle 成员安装落在 bundle 详情页的行级配置入口(`plugins.row.config`),0.1.5 落在 设置 → 插件 → 插件配置(`settings.plugin.item`,按设置命名空间派发);卡片写入经绑定的 settingsScope 热生效,不用重载。core 本身来自声明为依赖的 `@khorsheed/dsh-local-agent`。
+**bundle 组成。** patch 注册 `codex` harness(`CODEX_HOME` 作用域目录、PTY 登录、rollout 文件会话记录)——恰好一行 provider 行;`subagent_codex` 工具自家族折叠起是本包的 `./tool` 组合入口,由点名它的 agent 预设按会话授予(dev 预设的 `tool-subagent-codex-local` 行),不再挂 profile 根。家族沿用官方模型名 `subagent_codex`:官方 preset 的同名行本就 `disabled: true`,patch 对 profile 根的同名行再禁一次,社区安装永远不会注册出两个 `subagent_codex`;刻意在自有 preset 层重新启用官方行的用户会得到响亮的重名冲突,按设计必须二选一。`codex-local` provider 在该作用域目录下 spawn `codex exec`(live 未启用时的一次性驱动)。浏览器半部分随本包 `./client` 提供:Codex 设置卡组合家族 core 的共享 `ProviderAuthBlock`,独立安装落在 Plugins 页的包详情视图(`plugins.bundle.config`,按包名派发),作为家族 bundle 成员安装落在 bundle 详情页的行级配置入口(`plugins.row.config`),0.1.5 落在 设置 → 插件 → 插件配置(`settings.plugin.item`,按设置命名空间派发);卡片写入经绑定的 settingsScope 热生效,不用重载。core 本身来自声明为依赖的 `@khorsheed/dsh-local-agent`。
 
 **登录与凭据。** `/codex login` 经宿主 subprocess seam 在伪终端里跑 `codex login`——CLI 自己起 localhost 回调服务并打开浏览器,这是第一类流程;命令回复附带从输出里抓取的授权 URL 作兜底链接,CLI 追问 code 时用户以 `/codex code <code>` 粘贴(写入子进程 stdin)。完成由监听作用域目录的凭证 watch 判定:`auth.json` 出现且时间戳新于 watch 起点——残留的旧凭证不会被误认成新登录。无浏览器的远程终端可以手动以 `CODEX_HOME` 指向作用域目录跑 `codex login --device-auth`,凭据落在同一份 `auth.json`。首次启动写入一份最小 `config.toml`,固定 `cli_auth_credentials_store = "file"`——Codex 默认的 `auto` 会解析到 macOS keychain,把凭据泄漏到作用域目录之外并使本包的 `auth.json` 存在性检查失效;已存在的 config 保持不动。`/codex logout` 删除作用域 `auth.json`,之后重新登录即可换账号。
 
@@ -128,7 +128,7 @@ model_provider = "dsh-router"
 
 **容器内委派。** 编排器可以经门面 `DelegationCallOptions.exec`(`{ container, workdir, env? }`)让本轮跑在一个**已取得的容器**里:argv 变成 `docker exec -w <workdir> [-e NAME…] <container> codex exec …`,其余(流解析、settle、rollout 回读、记录)逐字节不变。`env` 必须给出容器内的 `CODEX_HOME`,且它应当是宿主作用域目录的 rw bind 挂载点——rollout 回读读的是宿主那份文件。容器轮固定走 exec 一次性驱动(长驻 app-server 是宿主进程),且不声明成员桥(宿主 unix socket 进不去容器)。实测:`eval-env:pinned` 单元里一次「回答 2+2」settle 为 `completed`,输出 `4`,`observedModel` 从容器写进宿主作用域目录的 rollout 里回读为 `gpt-5.6-sol`。
 
-**续聊(resume)。** 家族工具(`@khorsheed/dsh-local-agent-tool-subagent`)在官方 `description`/`prompt` 子集上增加可选 `resume` 参数。首次委派的结果文本自述句柄(`追问请带 resume="<childSessionId>"`);后续轮次传回它即在**同一个** dsh 子会话里继续**同一个** codex 线程(`codex exec --json resume <thread_id>`),按轮记账。句柄只从 `resume` 参数读取,localAgent registry 仅对记录该委派的同一 parent 会话与 provider 解析——伪造句柄在任何 CLI 进程启动前就被拒绝。
+**续聊(resume)。** 家族工具(本包的 `./tool` 组合入口,实现共享自家族 core 的 `./tool-factory`)在官方 `description`/`prompt` 子集上增加可选 `resume` 参数。首次委派的结果文本自述句柄(`追问请带 resume="<childSessionId>"`);后续轮次传回它即在**同一个** dsh 子会话里继续**同一个** codex 线程(`codex exec --json resume <thread_id>`),按轮记账。句柄只从 `resume` 参数读取,localAgent registry 仅对记录该委派的同一 parent 会话与 provider 解析——伪造句柄在任何 CLI 进程启动前就被拒绝。
 
 **事件流镜像。** 子代理会话按顺序镜像 `codex exec --json` 事件流:`reasoning` → 推理块、`agent_message` → 回复文本、`command_execution`/`web_search_call`/`function_call_output` → 工具行(`[工具 Bash] <command> → output`),`file_change` → `ApplyPatch` 卡(逐 change 列出 kind 与路径),`function_call`(如 multi-agent 的 `wait`)→ 同名工具卡、结果由 `function_call_output` 并入;最终 `agent_message` 作为运行输出,当轮用量挂在最后一条镜像的 assistant 消息上。续聊轮各自追加自己的 turn,不会重复。中止会让工具结果立即 settle,并保留已收到的事件与用量。
 

package/cordis.patch.yml

@@ -8,25 +8,23 @@
 # alongside this bundle, or this provider stays pending. No other patch inserts
 # the core row id.
 #
-# Two rows are inserted:
-#   - local-agent-codex: this bundle's plugin registers the `codex` harness
-#     (CODEX_HOME scoped home, `codex login --device-auth`, rollout-file
-#     session records).
-#   - tool-subagent-codex-local: the family-owned delegation tool (schema
-#     description/prompt plus optional resume) over the `codex-local`
-#     provider. The toolName is `subagent_codex` — the family takes the
-#     model-facing name: the official preset row of that name ships
-#     `disabled: true`, and this patch disables it too (below) so a community
-#     install can never register two `subagent_codex` tools. A user who
-#     deliberately re-enables the official row in their own preset layer gets
-#     a loud duplicate-name conflict — by design, they must choose one. The
-#     family tool adds continuation: a later round may pass the dsh child
-#     session id returned by the first delegation to continue the same codex
-#     thread.
+# Exactly ONE row is inserted: the provider (this bundle's plugin registers the
+# `codex` harness — CODEX_HOME scoped home, `codex login --device-auth`,
+# rollout-file session records). The `subagent_codex` delegation tool is no
+# longer a profile-root row: since the family fold it ships as this package's
+# `./tool` composition entry (`name: '@khorsheed/dsh-local-agent-codex/tool'`
+# in an agent preset), granted per session — the dev preset's
+# `tool-subagent-codex-local` row is the grant point. The family keeps the
+# official model-facing name `subagent_codex`: the official preset row of that
+# name ships `disabled: true`, and this patch disables the profile-root row
+# too (below) so a community install can never register two `subagent_codex`
+# tools. A user who deliberately re-enables the official row in their own
+# preset layer gets a loud duplicate-name conflict — by design, they must
+# choose one. The family tool keeps its continuation parameter: a later round
+# may pass the dsh child session id returned by the first delegation to
+# continue the same codex thread.
 #
-# The tool mounts at the profile root, so every agent preset can delegate
-# without per-preset variants. The provider starts no codex process until a
-# tool call or /codex login.
+# The provider starts no codex process until a tool call or /codex login.
 
 - id: tool-subagent-codex
   disabled: true
@@ -34,9 +32,3 @@
 - insert:
     - id: local-agent-codex
       name: '@khorsheed/dsh-local-agent-codex'
-
-    - id: tool-subagent-codex-local
-      name: '@khorsheed/dsh-local-agent-tool-subagent'
-      config:
-        provider: codex-local
-        toolName: subagent_codex

package/lib/client.js

@@ -243,30 +243,30 @@ window.__ModuleLoader__.load({
 			document.head.appendChild(tag);
 		}
 		var ProviderAuthBlock_module_css_default = {
-			"loginButton": "On5p7W_loginButton",
-			"title": "On5p7W_title",
-			"promptText": "On5p7W_promptText",
+			"rowHead": "On5p7W_rowHead",
+			"rowTag": "On5p7W_rowTag",
+			"credentialDot": "On5p7W_credentialDot",
+			"retryButton": "On5p7W_retryButton",
+			"rows": "On5p7W_rows",
 			"rowIdentity": "On5p7W_rowIdentity",
+			"loginPrompt": "On5p7W_loginPrompt",
+			"openPage": "On5p7W_openPage",
 			"intro": "On5p7W_intro",
-			"credentialDot": "On5p7W_credentialDot",
+			"title": "On5p7W_title",
+			"rosterError": "On5p7W_rosterError",
+			"rowCard": "On5p7W_rowCard",
+			"loginButton": "On5p7W_loginButton",
+			"dotOff": "On5p7W_dotOff",
+			"promptText": "On5p7W_promptText",
+			"codeInput": "On5p7W_codeInput",
 			"dotPending": "On5p7W_dotPending",
-			"rowName": "On5p7W_rowName",
-			"dotOn": "On5p7W_dotOn",
-			"rows": "On5p7W_rows",
-			"rowActions": "On5p7W_rowActions",
+			"logoutButton": "On5p7W_logoutButton",
 			"section": "On5p7W_section",
-			"rowCard": "On5p7W_rowCard",
-			"loginPrompt": "On5p7W_loginPrompt",
 			"status": "On5p7W_status",
-			"codeInput": "On5p7W_codeInput",
+			"dotOn": "On5p7W_dotOn",
 			"rowPending": "On5p7W_rowPending",
-			"rowTag": "On5p7W_rowTag",
-			"logoutButton": "On5p7W_logoutButton",
-			"dotOff": "On5p7W_dotOff",
-			"rowHead": "On5p7W_rowHead",
-			"rosterError": "On5p7W_rosterError",
-			"retryButton": "On5p7W_retryButton",
-			"openPage": "On5p7W_openPage"
+			"rowActions": "On5p7W_rowActions",
+			"rowName": "On5p7W_rowName"
 		};
 		//#endregion
 		//#region ../local-agent/src/client/ProviderAuthBlock.tsx
@@ -539,10 +539,10 @@ window.__ModuleLoader__.load({
 			document.head.appendChild(tag);
 		}
 		var AuthStatusDot_module_css_default = {
-			"credentialDot": "OFjNUG_credentialDot",
+			"dotPending": "OFjNUG_dotPending",
 			"dotOn": "OFjNUG_dotOn",
 			"dotOff": "OFjNUG_dotOff",
-			"dotPending": "OFjNUG_dotPending"
+			"credentialDot": "OFjNUG_credentialDot"
 		};
 		//#endregion
 		//#region ../local-agent/src/client/AuthStatusDot.tsx
@@ -568,40 +568,40 @@ window.__ModuleLoader__.load({
 			document.head.appendChild(tag);
 		}
 		var SettingsCard_module_css_default = {
-			"rowLabel": "oWITGW_rowLabel",
-			"modelField": "oWITGW_modelField",
-			"modelMenuChevron": "oWITGW_modelMenuChevron",
-			"saved": "oWITGW_saved",
-			"modelItemCheck": "oWITGW_modelItemCheck",
-			"modelItemCurrent": "oWITGW_modelItemCurrent",
-			"info": "oWITGW_info",
+			"modelMenuUp": "oWITGW_modelMenuUp",
+			"headText": "oWITGW_headText",
+			"card": "oWITGW_card",
 			"cardOpen": "oWITGW_cardOpen",
+			"hint": "oWITGW_hint",
+			"name": "oWITGW_name",
+			"modelItem": "oWITGW_modelItem",
+			"chevron": "oWITGW_chevron",
+			"errorText": "oWITGW_errorText",
 			"body": "oWITGW_body",
-			"description": "oWITGW_description",
 			"chevronOpen": "oWITGW_chevronOpen",
-			"modelMenuUp": "oWITGW_modelMenuUp",
+			"modelField": "oWITGW_modelField",
+			"modelMenuChevron": "oWITGW_modelMenuChevron",
+			"description": "oWITGW_description",
 			"modelItemLabel": "oWITGW_modelItemLabel",
-			"hint": "oWITGW_hint",
-			"nameRow": "oWITGW_nameRow",
-			"header": "oWITGW_header",
-			"errorText": "oWITGW_errorText",
-			"switch": "oWITGW_switch",
-			"modelItem": "oWITGW_modelItem",
-			"modelMenuButton": "oWITGW_modelMenuButton",
+			"saved": "oWITGW_saved",
+			"info": "oWITGW_info",
 			"modelMenu": "oWITGW_modelMenu",
 			"block": "oWITGW_block",
-			"headText": "oWITGW_headText",
-			"name": "oWITGW_name",
-			"chevron": "oWITGW_chevron",
+			"modelSave": "oWITGW_modelSave",
+			"nameRow": "oWITGW_nameRow",
+			"switchOn": "oWITGW_switchOn",
+			"modelItemCurrent": "oWITGW_modelItemCurrent",
 			"blockTitle": "oWITGW_blockTitle",
+			"rowLabel": "oWITGW_rowLabel",
+			"modelItemCheck": "oWITGW_modelItemCheck",
+			"modelItemDefault": "oWITGW_modelItemDefault",
 			"knob": "oWITGW_knob",
+			"header": "oWITGW_header",
+			"switch": "oWITGW_switch",
 			"modelInput": "oWITGW_modelInput",
-			"modelSave": "oWITGW_modelSave",
-			"modelItemDefault": "oWITGW_modelItemDefault",
 			"modelMenuChevronOpen": "oWITGW_modelMenuChevronOpen",
 			"row": "oWITGW_row",
-			"card": "oWITGW_card",
-			"switchOn": "oWITGW_switchOn"
+			"modelMenuButton": "oWITGW_modelMenuButton"
 		};
 		//#endregion
 		//#region src/client/SettingsCard.tsx

package/lib/tool.js

@@ -0,0 +1,40 @@
+import { mountSubagentDelegationTool, subagentToolConfigSchema } from "@khorsheed/dsh-local-agent/tool-factory";
+//#region lib/types/tool.js
+const PACKAGE_NAME = "@khorsheed/dsh-local-agent-codex";
+/** This entry's own defaults: a preset row needs no config. */
+const DEFAULT_PROVIDER = "codex-local";
+const DEFAULT_TOOL_NAME = "subagent_codex";
+/** Cordis plugin name used by loader diagnostics. */
+const name = "local-agent-codex-tool";
+/**
+* The family core's `localAgent` service is a declared inject (the
+* owning-family companion exception to the community-service probe rule): a
+* preset's standing scope mounts at registry-activation time, BEFORE the
+* profile's later bundle rows provide the core, so a one-shot ctx.get probe
+* at apply saw ABSENT there and nothing re-ran the row (rc.1 boot order; the
+* worktrees `./tool` entry documents the incident). The declared inject pends
+* the row until the core provides, then the body applies.
+*/
+const inject = [
+	"tools",
+	"subagents",
+	"localAgent"
+];
+const Config = subagentToolConfigSchema(DEFAULT_PROVIDER, DEFAULT_TOOL_NAME);
+/**
+* Plugin body: mount the delegation tool through the family factory, stamped
+* with THIS package as the tool-origin owner (AGENTS.md § Tool origin
+* tagging — the shared factory never hardcodes an owner).
+* @param ctx - Cordis context (the preset's agent-plane mount).
+* @param config - row config (schema defaults already applied; the `??`
+* fallbacks cover a direct ctx.plugin caller that bypassed validation).
+*/
+function apply(ctx, config) {
+	const resolved = {
+		provider: config.provider ?? DEFAULT_PROVIDER,
+		toolName: config.toolName ?? DEFAULT_TOOL_NAME
+	};
+	mountSubagentDelegationTool(ctx, resolved, PACKAGE_NAME);
+}
+//#endregion
+export { Config, apply, inject, name };

package/lib/types/tool.d.ts

@@ -0,0 +1,54 @@
+/**
+ * The session-granted `subagent_codex` delegation tool — this package's
+ * `./tool` composition entry (the worktrees 0.3.0 / room 0.2.0 fold pattern)
+ * for agent-preset compositions. The row provides NO service (the
+ * preset-mount isolate-realm rule forbids service rows); it registers the
+ * model-facing tool into the host tools registry through the family factory
+ * (`@khorsheed/dsh-local-agent/tool-factory`), delegating to the `codex-local`
+ * provider this package's main row registers at the profile root — the
+ * official tool-row shape (the shipped `tool-bash` rows work the same way).
+ * Granting is therefore per-session: a preset names the row
+ * (`- id: tool-subagent-codex-local / name: '@khorsheed/dsh-local-agent-codex/tool'`),
+ * its sessions get the tool; every other preset's sessions do not.
+ *
+ * This row used to mount at the profile ROOT from this package's own bundle
+ * patch, pointing at the shared `@khorsheed/dsh-local-agent-tool-subagent`
+ * companion package; the family fold retired that package (the factory moved
+ * into the family core) and moved the row here. The package's bundle patch
+ * now mounts ONLY the provider row — a profile-root tool row would grant
+ * every session, exactly what the fold removed.
+ *
+ * @module @khorsheed/dsh-local-agent-codex/tool
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import type z from '@deepseek-ai/schemastery';
+/** Cordis plugin name used by loader diagnostics. */
+export declare const name = "local-agent-codex-tool";
+/**
+ * The family core's `localAgent` service is a declared inject (the
+ * owning-family companion exception to the community-service probe rule): a
+ * preset's standing scope mounts at registry-activation time, BEFORE the
+ * profile's later bundle rows provide the core, so a one-shot ctx.get probe
+ * at apply saw ABSENT there and nothing re-ran the row (rc.1 boot order; the
+ * worktrees `./tool` entry documents the incident). The declared inject pends
+ * the row until the core provides, then the body applies.
+ */
+export declare const inject: string[];
+/** Config: every field optional, defaulting to THIS provider's own values. */
+export interface Config {
+    /** The `ctx.subagents` provider name to delegate to (default `codex-local`). */
+    provider?: string;
+    /** Model-facing tool name (default `subagent_codex`). */
+    toolName?: string;
+}
+export declare const Config: z;
+/**
+ * Plugin body: mount the delegation tool through the family factory, stamped
+ * with THIS package as the tool-origin owner (AGENTS.md § Tool origin
+ * tagging — the shared factory never hardcodes an owner).
+ * @param ctx - Cordis context (the preset's agent-plane mount).
+ * @param config - row config (schema defaults already applied; the `??`
+ * fallbacks cover a direct ctx.plugin caller that bypassed validation).
+ */
+export declare function apply(ctx: Context, config: Config): void;
+//# sourceMappingURL=tool.d.ts.map

package/lib/types/tool.js

@@ -0,0 +1,34 @@
+import { mountSubagentDelegationTool, subagentToolConfigSchema } from '@khorsheed/dsh-local-agent/tool-factory';
+const PACKAGE_NAME = '@khorsheed/dsh-local-agent-codex';
+/** This entry's own defaults: a preset row needs no config. */
+const DEFAULT_PROVIDER = 'codex-local';
+const DEFAULT_TOOL_NAME = 'subagent_codex';
+/** Cordis plugin name used by loader diagnostics. */
+export const name = 'local-agent-codex-tool';
+/**
+ * The family core's `localAgent` service is a declared inject (the
+ * owning-family companion exception to the community-service probe rule): a
+ * preset's standing scope mounts at registry-activation time, BEFORE the
+ * profile's later bundle rows provide the core, so a one-shot ctx.get probe
+ * at apply saw ABSENT there and nothing re-ran the row (rc.1 boot order; the
+ * worktrees `./tool` entry documents the incident). The declared inject pends
+ * the row until the core provides, then the body applies.
+ */
+export const inject = ['tools', 'subagents', 'localAgent'];
+// Bare `z` annotation per the shared helper's variance note.
+export const Config = subagentToolConfigSchema(DEFAULT_PROVIDER, DEFAULT_TOOL_NAME);
+/**
+ * Plugin body: mount the delegation tool through the family factory, stamped
+ * with THIS package as the tool-origin owner (AGENTS.md § Tool origin
+ * tagging — the shared factory never hardcodes an owner).
+ * @param ctx - Cordis context (the preset's agent-plane mount).
+ * @param config - row config (schema defaults already applied; the `??`
+ * fallbacks cover a direct ctx.plugin caller that bypassed validation).
+ */
+export function apply(ctx, config) {
+    const resolved = {
+        provider: config.provider ?? DEFAULT_PROVIDER,
+        toolName: config.toolName ?? DEFAULT_TOOL_NAME,
+    };
+    mountSubagentDelegationTool(ctx, resolved, PACKAGE_NAME);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@khorsheed/dsh-local-agent-codex",
-  "description": "Codex harness for dsh-local-agent: scoped CODEX_HOME, one-shot codex exec delegation visible in the 子代理 surface, rollout-file session records",
+  "description": "Codex harness for dsh-local-agent: scoped CODEX_HOME, one-shot codex exec delegation visible in the 子代理 surface, rollout-file session records; the session-granted `subagent_codex` delegation tool ships as the package's `./tool` composition entry",
   "keywords": [
     "dsh",
     "dsh-plugin",
@@ -8,7 +8,7 @@
     "local-agent",
     "codex"
   ],
-  "version": "0.1.0-rc.8",
+  "version": "0.2.0-rc.1",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",
@@ -25,6 +25,10 @@
       "types": "./lib/types/records.d.ts",
       "default": "./lib/records.js"
     },
+    "./tool": {
+      "types": "./lib/types/tool.d.ts",
+      "default": "./lib/tool.js"
+    },
     "./client": {
       "types": "./lib/types/client/index.d.ts",
       "default": "./lib/client.js"
@@ -65,8 +69,7 @@
   ],
   "license": "MIT",
   "dependencies": {
-    "@khorsheed/dsh-local-agent": "^0.1.0-rc.8",
-    "@khorsheed/dsh-local-agent-tool-subagent": "^0.1.0-rc.8"
+    "@khorsheed/dsh-local-agent": "^0.2.0-rc.1"
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",