@khorsheed/dsh-local-agent-dsh 0.2.0 → 0.2.2

package/lib/dsh-cli-provider-B7s3zH0m.js

@@ -1,1782 +0,0 @@
-import { provisionDshScope, unitSubProfileName } from "./provision.js";
-import { t as resolveDshSessionLog } from "./session-log-DOsSz56-.js";
-import { join } from "node:path";
-import { LiveFlush, LiveStreamPublisher, assertResumeCwdUnchanged, assertResumeScopeUnchanged, containerExecSpawn, containerScopedHome, delegationEnv, establishSubagentCatalogChild, persistChildSession, probeCliVersion, resolveChildCwd, resolveRoundModel, subagentDelegationLabel } from "@khorsheed/dsh-local-agent";
-import { createHash, randomUUID } from "node:crypto";
-import { credentialRef } from "@deepseek-ai/dsh-credentials";
-import { SessionId } from "@deepseek-ai/dsh-session";
-import { NO_START_CAPABILITIES, SUBAGENT_DESCRIPTOR_VERSION, settleRunResult, subprocessRunHandle } from "@deepseek-ai/dsh-subagent";
-import { MEMBER_BRIDGE_SOCKET_ENV, MEMBER_BRIDGE_TOKEN_ENV } from "@khorsheed/dsh-local-agent/types";
-import { StringDecoder } from "node:string_decoder";
-import { BlockAssembler, createAssistantMessage } from "@deepseek-ai/dsh-llm";
-import { LIVE_SERVER_NAME, LIVE_WIRE_PROTOCOL_VERSION } from "@khorsheed/dsh-local-agent-dsh-headless/wire";
-import { readFile, readdir } from "node:fs/promises";
-import { promisify } from "node:util";
-import { zstdDecompress } from "node:zlib";
-//#region lib/types/model-launch.js
-/** Private launch environment: never persisted in a profile, transcript or argv. */
-const MODEL_CONFIG_ENV = "DSH_LOCAL_AGENT_MODEL_CONFIG";
-const MODEL_KEY_ENV = "DSH_LOCAL_AGENT_MODEL_API_KEY";
-function object(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
-}
-function settings(ctx) {
-	return new Map((ctx.get("settings")?.describe?.() ?? []).flatMap((row) => {
-		const value = object(row.value);
-		return value === void 0 ? [] : [[String(row.ns), value]];
-	}));
-}
-function piProfile(ctx, provider, values) {
-	const directory = ctx.get("llm")?.listConfigurableProviders?.().find((row) => row.provider === provider);
-	const ns = directory?.settingsNs ?? "llm-pi-ai";
-	if (ns !== "llm-pi-ai") return void 0;
-	if (directory && (directory.settingsPath.length !== 2 || directory.settingsPath[0] !== "providers" || directory.settingsPath[1] !== provider)) return void 0;
-	return object(object(values.get(ns)?.providers)?.[provider]);
-}
-/** Whether this provider has a supported local configuration transfer contract. */
-function canInheritModelProvider(ctx, provider) {
-	if (provider === "deepseek-official") return true;
-	const profile = piProfile(ctx, provider, settings(ctx));
-	return typeof profile?.apiKeyEnv === "string" && profile.apiKeyEnv.trim() !== "";
-}
-/** Snapshot only the selected local route and resolve only its explicitly named credential. */
-async function localModelLaunch(ctx, config, model) {
-	const provider = model?.includes("/") ? model.slice(0, model.indexOf("/")) : "deepseek-official";
-	const values = settings(ctx);
-	let inherited, ref, keyName;
-	if (provider === "deepseek-official") {
-		const profile = structuredClone(values.get("llm-deepseek") ?? {});
-		ref = config.apiKeyRef ?? (typeof profile.apiKeyEnv === "string" ? profile.apiKeyEnv : "DEEPSEEK_API_KEY");
-		inherited = { deepseek: {
-			...profile,
-			apiKeyEnv: "DEEPSEEK_API_KEY"
-		} };
-		keyName = "DEEPSEEK_API_KEY";
-	} else {
-		const profile = piProfile(ctx, provider, values);
-		if (typeof profile?.apiKeyEnv !== "string" || profile.apiKeyEnv.trim() === "") throw new Error(`subagent-dsh: model provider "${provider}" has no inheritable API-key route; configure its credential reference in the host Models settings`);
-		ref = profile.apiKeyEnv;
-		inherited = { piAi: { providers: { [provider]: {
-			...structuredClone(profile),
-			apiKeyEnv: MODEL_KEY_ENV
-		} } } };
-		keyName = MODEL_KEY_ENV;
-	}
-	const credential = await ctx.get("credentials")?.resolve(credentialRef(ref));
-	if (!credential?.value) throw new Error(`subagent-dsh: credential ${ref} is unavailable for model provider "${provider}"`);
-	const env = {
-		[MODEL_CONFIG_ENV]: JSON.stringify(inherited),
-		[keyName]: credential.value
-	};
-	return {
-		env,
-		fingerprint: createHash("sha256").update(JSON.stringify(env)).digest("hex")
-	};
-}
-//#endregion
-//#region lib/types/session-mirror.js
-/**
-* Mirror a sub-dsh session's events into the parent-side dsh subagent session,
-* so a dsh delegation shows its full conversation (task, replies, thinking)
-* and real token usage in the standard 子代理 surface — the same fidelity the
-* other family harnesses get from their CLI transcript files. The sub-dsh
-* writes a real dsh session into the harness scoped home with the SAME id as
-* the parent-side child session and the same SessionEvent format, so the
-* mirror copies finalized `user/message`/`assistant/message` events verbatim
-* (no parsing, no re-encoding): reasoning blocks render natively and usage
-* rides the assistant events' own `usage` field into the tokenUsage
-* projection.
-*
-* Round scoping: the parent provider appends one `turn/start` per delegation
-* round, and the sub-dsh session numbers its turns identically (fresh = 1,
-* each resume +1), so a round's span is the sub-dsh events from its
-* `turn/start` with `turn === round` to the next `turn/start`. The sub-dsh's
-* own scaffolding user messages (agent-instructions, plugin, skill-catalog
-* sources) are filtered — only the caller task (`source.kind === 'user'`)
-* crosses. The sub-dsh's own `step/start`/`step/end` pairs cross verbatim
-* (each carries its (turn, step) coordinates): the real-time conversation
-* assembler only registers a step — and materializes its assistant message —
-* at a boundary, so without them the live subsession view renders the prompt
-* and tool cards but no replies. Turn boundaries are NOT copied: the parent's
-* real-time spawn→settle boundaries stay the authoritative timing.
-*
-* `todo/write` passthrough: the sub-dsh's task list is a standing whole-list
-* snapshot (last-wins). Each pass appends the round's LATEST snapshot only
-* when it differs from the child session's last mirrored one, so repeated
-* passes never duplicate an identical snapshot and the child's `todos`
-* projection (and the official TodoPanel in non-takeover views) reads the
-* member's task list for free.
-* @module @khorsheed/dsh-local-agent-dsh/session-mirror
-*/
-/** Decompress one zstd session log (Node ≥22.15 built-in; engines require ^22.19). */
-const decompressZstd = promisify(zstdDecompress);
-/** Every zstd frame's little-endian magic number, marking a frame start in the stream. */
-const ZSTD_FRAME_MAGIC = 4247762216;
-/**
-* Decompress a multi-frame zstd session log. The persistence layer appends
-* one frame per flush batch, and Node's single-shot `zstdDecompress` stops at
-* the first frame's end (a streaming decoder does the same), so each frame
-* start is scanned and decompressed independently. A magic-looking byte
-* sequence inside compressed data fails decompression and is skipped.
-* @param content - the raw `.zstd` file bytes.
-* @returns the concatenated plaintext of every frame.
-*/
-async function decompressZstdFrames(content) {
-	const parts = [];
-	for (let offset = 0; offset + 4 <= content.length; offset += 1) {
-		if (content.readUInt32LE(offset) !== ZSTD_FRAME_MAGIC) continue;
-		try {
-			parts.push((await decompressZstd(content.subarray(offset))).toString("utf8"));
-		} catch {}
-	}
-	return parts.join("");
-}
-/**
-* Read a sub-dsh session's event log from the scoped home. The session lives
-* at `<homeDir>/sessions/<workspace>/<id>/` (the runner passes the bare uuid);
-* WHICH file inside that directory holds the history is the host's choice —
-* `session.jsonl` on the original generation, `session.v3.jsonl.zstd` on host
-* 0.1.5 — so the name is resolved, never assumed (see
-* {@link resolveDshSessionLog}). The first line is the header, the rest are
-* events.
-* @param homeDir - the `dsh` harness's scoped home.
-* @param sessionId - the sub-dsh session id (same uuid as the child session).
-* @returns the events and their source file, or undefined when the session is
-*   absent or unreadable.
-*/
-async function readSubDshEvents(homeDir, sessionId) {
-	let workspaces;
-	try {
-		workspaces = await readdir(join(homeDir, "sessions"));
-	} catch {
-		return;
-	}
-	for (const workspace of workspaces) for (const name of [sessionId, `session-${sessionId}`]) {
-		const log = await resolveDshSessionLog(join(homeDir, "sessions", workspace, name));
-		if (log === void 0) continue;
-		let text;
-		try {
-			const content = await readFile(log.path);
-			text = log.compressed ? await decompressZstdFrames(content) : content.toString("utf8");
-		} catch {
-			continue;
-		}
-		const events = [];
-		for (const line of text.split("\n")) {
-			if (line === "") continue;
-			try {
-				const parsed = JSON.parse(line);
-				if (parsed.type === "session") continue;
-				events.push(parsed);
-			} catch {}
-		}
-		if (events.length > 0) return {
-			events,
-			log
-		};
-	}
-}
-/**
-* Sum one more assistant event's usage into a running round total. Each
-* sub-dsh assistant event carries ONE LLM call's accounting; the round's
-* windows (live polls, settle pass) recompute it from the round's span, so
-* the total is span-derived and never double counts across passes.
-*/
-function addEventUsage(total, usage) {
-	const raw = usage;
-	if (raw === void 0 || typeof raw !== "object") return total;
-	const num = (value) => {
-		const n = Number(value);
-		return Number.isFinite(n) && n > 0 ? n : 0;
-	};
-	const merged = {
-		inputTokens: (total?.inputTokens ?? 0) + num(raw.inputTokens),
-		outputTokens: (total?.outputTokens ?? 0) + num(raw.outputTokens)
-	};
-	const cacheRead = (total?.cacheReadTokens ?? 0) + num(raw.cacheReadTokens);
-	const cacheWrite = (total?.cacheWriteTokens ?? 0) + num(raw.cacheWriteTokens);
-	if (cacheRead > 0) merged.cacheReadTokens = cacheRead;
-	if (cacheWrite > 0) merged.cacheWriteTokens = cacheWrite;
-	return merged;
-}
-/**
-* Extract the round's observed model and token usage from its event span:
-the LAST assistant event's `message.source` names the model that ran, and
-* the assistant events' `usage` fields sum to the round's accounting.
-*/
-function roundObservation(span) {
-	let observedModel;
-	let usage;
-	const byName = {};
-	let toolCount = 0;
-	for (const event of span) {
-		if (event.type === "tool/call") {
-			const name = event.data.name;
-			toolCount += 1;
-			const key = typeof name === "string" && name !== "" ? name : "tool";
-			byName[key] = (byName[key] ?? 0) + 1;
-			continue;
-		}
-		if (event.type !== "assistant/message") continue;
-		const data = event.data;
-		const source = data.message?.source;
-		if (source !== void 0 && typeof source === "object") {
-			const model = typeof source.model === "string" && source.model !== "" ? source.model : void 0;
-			if (model !== void 0) {
-				const provider = typeof source.provider === "string" && source.provider !== "" ? source.provider : void 0;
-				observedModel = provider === void 0 ? model : `${provider}/${model}`;
-			}
-		}
-		usage = addEventUsage(usage, data.usage);
-	}
-	return {
-		...observedModel === void 0 ? {} : { observedModel },
-		...usage === void 0 ? {} : { usage },
-		...toolCount === 0 ? {} : { toolCalls: {
-			count: toolCount,
-			byName
-		} }
-	};
-}
-/** Visible answer text for progress/results; reasoning stays in the verbatim transcript. */
-function mirroredEventText(event) {
-	const data = event.data;
-	return (data.message?.content ?? data.content ?? []).filter((block) => block.type === "text" && typeof block.text === "string").map((block) => block.text).join("");
-}
-/** The delta-progress text for one mirrored tool event. */
-function mirroredToolText(event) {
-	if (event.type === "tool/call") return `[工具 ${event.data.name ?? "tool"}]`;
-	const result = event.data.message?.content?.[0]?.content?.map((block) => block.text ?? "").join("") ?? "";
-	return result === "" ? "[工具结果]" : `[工具结果] ${result}`;
-}
-/**
-* Find the child-session seq of the mirrored `tool/call` carrying `callId`,
-* so a mirrored `tool/result`'s `sourceEventSeqs` points at the CHILD's call
-* event — the source event's own seqs reference the sub-dsh session's
-* numbering and are meaningless here.
-*/
-function findMirroredCallSeq(childSession, callId) {
-	for (let index = childSession.snapshotEvents().length - 1; index >= 0; index -= 1) {
-		const event = childSession.snapshotEvents()[index];
-		if (event?.type !== "tool/call") continue;
-		if (event.data.callId === callId) return event.seq;
-	}
-}
-/**
-* Append one mirrored `tool/call` or `tool/result` event — the native tool
-* card pair, so the child session renders the sub-dsh's tool activity with
-* the standard conversation's tool rows instead of not at all. Shared by the
-* file mirror's span loop and the live driver's per-event mirror.
-*/
-function appendMirroredToolEvent(childSession, event) {
-	if (event.type === "tool/call") childSession.append("tool/call", event.data);
-	else if (event.type === "tool/result") {
-		const data = event.data;
-		const callSeq = findMirroredCallSeq(childSession, String(data.message.source.callId));
-		childSession.append("tool/result", event.data, {
-			surfaceOp: "append",
-			...callSeq === void 0 ? {} : { sourceEventSeqs: [callSeq] }
-		});
-	}
-	return mirroredToolText(event);
-}
-/**
-* Append one mirrored `step/start` or `step/end` boundary verbatim — the event
-* carries its own (turn, step) coordinates, so the child session's location
-* index registers the same step the sub-dsh wrote. Shared by the file
-* mirror's span loop and the live driver's per-event mirror. An interrupted
-* step crosses as an OPEN pair (start without end): the location resolves to
-* the step either way, and no boundary is ever synthesized.
-*/
-function appendMirroredStepBoundary(childSession, event) {
-	if (event.type === "step/start") childSession.append("step/start", event.data);
-	else if (event.type === "step/end") childSession.append("step/end", event.data);
-}
-/**
-* Append one appendable message event verbatim and report its delta text —
-* the single append path shared by the file mirror's span loop and the live
-* driver's per-event mirror, so both transports produce identical child
-* sessions.
-*/
-function appendMirroredMessageEvent(childSession, event) {
-	if (event.type === "user/message") childSession.append("user/message", event.data, { surfaceOp: "append" });
-	else if (event.type === "assistant/message") childSession.append("assistant/message", event.data, { surfaceOp: "append" });
-	return mirroredEventText(event);
-}
-/**
-* Mirror ONE live-pushed sub-dsh session event (the serve mode's
-* `session/event` wire notification) into the child session. This is the
-* live driver's transport-side entry into the SAME fold the file mirror
-* owns: the filter (only the caller task's `user/message`, every
-* `assistant/message`, the tool events, and the `step/start`/`step/end`
-* boundaries cross — verbatim; turn boundaries stay the parent's; scaffolding
-* stays behind) and the verbatim append are exactly `mirrorDshSession`'s
-* span-loop rules. The 0.1.5 sub-dsh emits no per-chunk events (the
-* `assistant/chunk` type is retired — an interrupted attempt settles as
-* `assistant/attempt`, which carries no surface content and never crosses),
-* so the `token` granularity no longer streams deltas into the child log;
-* live text rides the run-progress channel only.
-* The caller owns offset/dedupe (the live runtime pushes
-* each event once) and persistence batching.
-* @param childSession - the parent-side dsh subagent session.
-* @param event - the live event from the resident sub-dsh.
-* @param _options - granularity; retained for caller compatibility — the
-*   retirement of per-chunk events leaves the mirror granularity-invariant.
-* @returns the mirrored text for delta progress, or undefined when the event
-*   was filtered out or carries no progress text (a step boundary crosses but
-*   is structure, not content).
-*/
-function mirrorDshLiveEvent(childSession, event, _options) {
-	if (event.type === "user/message" && event.data.source.kind === "user") return appendMirroredMessageEvent(childSession, event);
-	if (event.type === "assistant/message") return appendMirroredMessageEvent(childSession, event);
-	if (event.type === "tool/call" || event.type === "tool/result") return appendMirroredToolEvent(childSession, event);
-	if (event.type === "step/start" || event.type === "step/end") {
-		appendMirroredStepBoundary(childSession, event);
-		return;
-	}
-}
-/**
-* Mirror the current round's events from the sub-dsh session into the child
-* session, then persist (a live session syncs through the core's cached write
-* handle, a standalone one through a one-shot handle; see
-* {@link persistIfStandalone}). Runs both
-* from the provider's live poll (while the
-* sub-dsh writes its log in batches — a torn final zstd frame is skipped
-* until the next pass) and after the child process exits (the settle pass);
-* the round's already-mirrored prefix in the child session is the offset, so
-* the settle pass is a no-op when polling kept up. An aborted round still
-* preserves its partial work and real usage. All failures degrade to a warn:
-* the delegation result is already settled.
-* @param ctx - host context carrying session persistence.
-* @param childSession - the parent-side dsh subagent session.
-* @param homeDir - the `dsh` harness's scoped home.
-* @param subSessionId - the sub-dsh session id (same uuid as the child session).
-* @returns the newly mirrored events' texts and the round's mirrored total.
-*/
-async function mirrorDshSession(ctx, childSession, homeDir, subSessionId) {
-	const empty = {
-		texts: [],
-		total: 0
-	};
-	try {
-		const read = await readSubDshEvents(homeDir, subSessionId);
-		if (read === void 0) return empty;
-		const { events, log } = read;
-		const round = childSession.snapshotEvents().filter((event) => event.type === "turn/start").length;
-		if (round === 0) return empty;
-		let start = -1;
-		let end = events.length;
-		for (let index = 0; index < events.length; index += 1) {
-			const event = events[index];
-			if (event?.type !== "turn/start") continue;
-			if (start === -1 && event.data.turn === round) {
-				start = index;
-				continue;
-			}
-			if (start !== -1) {
-				end = index;
-				break;
-			}
-		}
-		if (start === -1) return empty;
-		let lastTurnStart = -1;
-		for (let index = 0; index < childSession.snapshotEvents().length; index += 1) if (childSession.snapshotEvents()[index]?.type === "turn/start") lastTurnStart = index;
-		const mirrored = childSession.snapshotEvents().slice(lastTurnStart + 1).filter((event) => event.type === "user/message" || event.type === "assistant/message" || event.type === "tool/call" || event.type === "tool/result" || event.type === "step/start" || event.type === "step/end").length;
-		const roundSpan = events.slice(start, end).filter((event) => event.type === "user/message" && event.data.source.kind === "user" || event.type === "assistant/message" || event.type === "tool/call" || event.type === "tool/result" || event.type === "step/start" || event.type === "step/end");
-		const span = roundSpan.slice(mirrored);
-		const texts = [];
-		let appended = 0;
-		for (const event of span) {
-			appended += 1;
-			if (event.type === "step/start" || event.type === "step/end") {
-				appendMirroredStepBoundary(childSession, event);
-				continue;
-			}
-			texts.push(event.type === "tool/call" || event.type === "tool/result" ? appendMirroredToolEvent(childSession, event) : appendMirroredMessageEvent(childSession, event));
-		}
-		const observation = roundObservation(roundSpan);
-		let todosAppended = 0;
-		const latestTodos = events.slice(start, end).filter((event) => event.type === "todo/write").at(-1);
-		const mirroredTodos = childSession.snapshotEvents().slice(lastTurnStart + 1).filter((event) => event.type === "todo/write");
-		if (latestTodos !== void 0 && latestTodos.type === "todo/write") {
-			if (JSON.stringify(mirroredTodos.at(-1)?.data) !== JSON.stringify(latestTodos.data)) {
-				childSession.append("todo/write", latestTodos.data);
-				todosAppended = 1;
-			}
-		}
-		if (appended > 0 || todosAppended > 0) await persistChildSession(ctx, childSession);
-		return {
-			texts,
-			total: mirrored + mirroredTodos.length + appended + todosAppended,
-			sessionLogFile: log.filename,
-			...observation
-		};
-	} catch (error) {
-		ctx.logger.warn(`subagent-dsh: session mirror failed: ${error instanceof Error ? error.message : String(error)}`);
-		return empty;
-	}
-}
-//#endregion
-//#region lib/types/live-driver.js
-/**
-* The dsh provider's live driver: one resident sub-dsh serve process per
-* member (child session), driven over the family-internal wire
-* (`@khorsheed/dsh-local-agent-dsh-headless/wire`). A delegation round is a
-* `turn/start` request to the member's resident runtime instead of a fresh
-* one-shot process, which buys what the process boundary could not:
-* runtime-level graceful interrupt (`turn/interrupt` → in-process
-* `Agent.cancel`; the process survives and the session stays continuable)
-* and push-mode mirroring (session events arrive as `session/event`
-* notifications and are mirrored event-by-event through the same fold the
-* file mirror owns, with the file-based `mirrorDshSession` as the settle
-* reconciliation pass).
-*
-* Lifecycle (the mode's main cost): the runtime spawns lazily on the member's
-* first live round, is reclaimed after an idle timeout or on plugin unload,
-* and is re-spawned — resuming the on-disk session — after a crash. Every
-* process is registered in {@link DshLiveDriver.runtimes} until reclaimed, so
-* no zombies survive a profile restart.
-* @module @khorsheed/dsh-local-agent-dsh/live-driver
-*/
-/** Default idle lifetime of an unused resident runtime before reclaim. */
-const DEFAULT_LIVE_IDLE_MS = 18e5;
-/** Default timeout for a wire request acknowledgement. */
-const DEFAULT_LIVE_REQUEST_TIMEOUT_MS = 3e4;
-/** Default timeout for the serve handshake (a cold sub-dsh boot can be slow). */
-const DEFAULT_LIVE_INITIALIZE_TIMEOUT_MS = 6e4;
-/** Bounded wait for an interrupted turn to converge while a run disposes. */
-const DEFAULT_LIVE_DISPOSE_CONVERGE_MS = 5e3;
-/** Bounded wait for a reclaimed runtime's own shutdown before SIGTERM. */
-const RECLAIM_SHUTDOWN_GRACE_MS = 1e3;
-/** How long the channel stays broken before a round retries live. */
-const DEFAULT_LIVE_CHANNEL_RETRY_MS = 3e5;
-/**
-* The serve channel could not come up (spawn failure or handshake
-* timeout/mismatch). The provider catches exactly this and falls back to the
-* exec one-shot; any other error is a real round failure.
-*/
-var LiveChannelUnavailableError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "LiveChannelUnavailableError";
-	}
-};
-const DEFAULT_TIMEOUTS = {
-	initializeMs: DEFAULT_LIVE_INITIALIZE_TIMEOUT_MS,
-	requestMs: DEFAULT_LIVE_REQUEST_TIMEOUT_MS,
-	convergeMs: DEFAULT_LIVE_DISPOSE_CONVERGE_MS,
-	channelRetryMs: DEFAULT_LIVE_CHANNEL_RETRY_MS
-};
-function delay(ms) {
-	return new Promise((resolve) => setTimeout(resolve, ms));
-}
-function thrown$1(value) {
-	return value instanceof Error ? value : new Error(String(value));
-}
-/**
-* One resident serve process: the wire client, the process registry entry,
-* and the reclaim ladder (wire shutdown → grace → SIGTERM → grace → SIGKILL
-* via the subprocess handle's own terminate).
-*/
-var LiveRuntime = class {
-	child;
-	timeouts;
-	warn;
-	/** Set once the process exited or was reclaimed; a dead runtime never serves again. */
-	dead = false;
-	/**
-	* The model this process bound at spawn (`--model`), or undefined when it
-	* spawned with no model flag at all. A round whose start model differs
-	* retires the runtime instead of silently running the old one.
-	*/
-	modelLaunchFingerprint;
-	configurationKey;
-	boundModel;
-	reclaimed = false;
-	pending = /* @__PURE__ */ new Map();
-	nextId = 0;
-	buffer = "";
-	decoder = new StringDecoder("utf8");
-	stderrDecoder = new StringDecoder("utf8");
-	stderrTail = "";
-	/**
-	* Per-round handlers, installed by the active round (one at a time per
-	* member) and CLEARED when it settles — a notification with no active
-	* round is dropped, never delivered into a stale closure.
-	*/
-	onEvent;
-	onStream;
-	onIdle;
-	/** Fires once when the process dies or is reclaimed (driver bookkeeping). */
-	onDead;
-	constructor(child, timeouts, warn) {
-		this.child = child;
-		this.timeouts = timeouts;
-		this.warn = warn;
-		child.stdout?.on("data", (chunk) => {
-			this.feed(this.decoder.write(chunk));
-		});
-		child.stderr?.on("data", (chunk) => {
-			this.stderrTail = (this.stderrTail + this.stderrDecoder.write(chunk)).slice(-4096);
-		});
-		child.done.then(() => {
-			this.markDead();
-		}, () => {
-			this.markDead();
-		});
-	}
-	/** Diagnostic tail for round-failure logs. */
-	get diagnostics() {
-		return this.stderrTail.trim();
-	}
-	feed(text) {
-		this.buffer += text;
-		let index = this.buffer.indexOf("\n");
-		while (index >= 0) {
-			const line = this.buffer.slice(0, index);
-			this.buffer = this.buffer.slice(index + 1);
-			index = this.buffer.indexOf("\n");
-			if (line.trim() === "") continue;
-			this.dispatchLine(line);
-		}
-	}
-	/** Handle one wire line; a malformed or hostile line never escapes this frame. */
-	dispatchLine(line) {
-		let message;
-		try {
-			message = JSON.parse(line);
-		} catch {
-			this.warn("subagent-dsh live: ignored a malformed wire line");
-			return;
-		}
-		try {
-			if (typeof message.id === "number" && ("result" in message || "error" in message)) {
-				const request = this.pending.get(message.id);
-				if (request === void 0) return;
-				this.pending.delete(message.id);
-				clearTimeout(request.timer);
-				const wireError = message.error;
-				if (wireError !== void 0 && wireError !== null) request.reject(/* @__PURE__ */ new Error(`subagent-dsh live: ${wireError.message ?? "wire error"}`));
-				else request.resolve(message.result);
-				return;
-			}
-			const params = message.params ?? {};
-			if (typeof params.sessionId !== "string") return;
-			if (message.method === "session/event") {
-				const event = params.event;
-				if (event === null || typeof event !== "object" || typeof event.type !== "string") return;
-				this.onEvent?.(params.sessionId, typeof params.turn === "number" ? params.turn : null, event);
-			} else if (message.method === "session/assistant-stream") {
-				if (typeof params.turn !== "number" || params.frame === null || typeof params.frame !== "object") return;
-				this.onStream?.(params.sessionId, params.turn, params.frame);
-			} else if (message.method === "session/idle") {
-				if (typeof params.turn !== "number") return;
-				this.onIdle?.(params.sessionId, params.turn, params.reason ?? null);
-			}
-		} catch (error) {
-			this.warn(`subagent-dsh live: notification handler failed: ${thrown$1(error).message}`);
-		}
-	}
-	/** Send one request and await its acknowledgement. */
-	request(method, params, timeoutMs) {
-		if (this.dead) return Promise.reject(/* @__PURE__ */ new Error("subagent-dsh live: the runtime process is gone"));
-		this.nextId += 1;
-		const id = this.nextId;
-		return new Promise((resolve, reject) => {
-			const timer = setTimeout(() => {
-				this.pending.delete(id);
-				reject(/* @__PURE__ */ new Error(`subagent-dsh live: ${method} timed out`));
-				timer.unref();
-			}, timeoutMs ?? this.timeouts.requestMs);
-			timer.unref();
-			this.pending.set(id, {
-				resolve: (result) => resolve(result),
-				reject,
-				timer
-			});
-			this.child.stdin?.write(JSON.stringify({
-				jsonrpc: "2.0",
-				id,
-				method,
-				params
-			}) + "\n");
-		});
-	}
-	markDead() {
-		if (this.dead) return;
-		this.dead = true;
-		for (const request of this.pending.values()) {
-			clearTimeout(request.timer);
-			request.reject(/* @__PURE__ */ new Error("subagent-dsh live: the runtime process exited"));
-		}
-		this.pending.clear();
-		this.onDead?.();
-	}
-	/** Graceful teardown: wire shutdown, a beat to exit on its own, then the terminate ladder. */
-	async reclaim() {
-		if (this.reclaimed) return;
-		this.reclaimed = true;
-		if (!this.dead) {
-			await this.request("shutdown", {}, RECLAIM_SHUTDOWN_GRACE_MS).catch(() => {});
-			await Promise.race([this.child.done.catch(() => {}), delay(RECLAIM_SHUTDOWN_GRACE_MS)]);
-		}
-		if (!this.dead) {
-			this.child.terminate();
-			await this.child.waitForExit();
-		}
-		await this.child.done.catch(() => {});
-		this.markDead();
-	}
-};
-/**
-* The live driver owns every resident runtime of this provider generation.
-* The LiveDriverSwitch builds a generation when the settings resolve live on,
-* retires one with {@link DshLiveDriver.drain} (never interrupts), and
-* disposes with the enabled toggle (disposeAll).
-*/
-var DshLiveDriver = class {
-	ctx;
-	config;
-	timeouts;
-	runtimes = /* @__PURE__ */ new Map();
-	/** In-flight spawns by member: concurrent rounds share one, disposeAll waits them out. */
-	ensuring = /* @__PURE__ */ new Map();
-	idleTimers = /* @__PURE__ */ new Map();
-	/** Per-member round serialization (the resume lock covers resume-vs-resume only). */
-	roundChains = /* @__PURE__ */ new Map();
-	/** When the channel last failed its spawn/handshake probe (breaker with cooldown). */
-	channelBrokenAt;
-	disposed = false;
-	/**
-	* Set by drain() (a settings-driven generation handoff): new rounds are
-	* refused so the provider falls back to exec, while in-flight rounds finish
-	* on their runtime undisturbed. Unlike `disposed`, the driver still serves
-	* what it already accepted.
-	*/
-	draining = false;
-	/** Aborts in-flight spawns when the driver is disposed mid-handshake. */
-	disposeController = new AbortController();
-	constructor(ctx, config, timeouts = DEFAULT_TIMEOUTS) {
-		this.ctx = ctx;
-		this.config = config;
-		this.timeouts = timeouts;
-	}
-	/**
-	* Whether the channel is in its post-failure cooldown. A spawn/handshake
-	* failure trips the breaker (rounds fall back to exec), but only for
-	* `channelRetryMs` — a transient boot fault must not disable live driving
-	* until the next plugin reload.
-	*/
-	get disabled() {
-		return this.channelBrokenAt !== void 0 && Date.now() - this.channelBrokenAt < (this.timeouts.channelRetryMs ?? 3e5);
-	}
-	/** Count of resident runtimes currently registered (zombie accounting in tests). */
-	get liveCount() {
-		return this.runtimes.size;
-	}
-	clearIdleTimer(key) {
-		const timer = this.idleTimers.get(key);
-		if (timer !== void 0) clearTimeout(timer);
-		this.idleTimers.delete(key);
-	}
-	/** Arm the idle reaper; every round settlement re-arms it. */
-	armIdleTimer(key) {
-		this.clearIdleTimer(key);
-		const idleMs = this.config.liveIdleMs ?? 18e5;
-		const timer = setTimeout(() => {
-			this.reclaim(key);
-		}, idleMs);
-		timer.unref();
-		this.idleTimers.set(key, timer);
-	}
-	/** Reclaim one runtime: deregister, wire shutdown, terminate ladder, member release. */
-	async reclaim(key) {
-		const runtime = this.runtimes.get(key);
-		this.clearIdleTimer(key);
-		if (runtime === void 0) return;
-		this.runtimes.delete(key);
-		await runtime.reclaim();
-	}
-	/** Reclaim every runtime (plugin unload); no process survives the profile. */
-	async disposeAll() {
-		this.disposed = true;
-		this.disposeController.abort();
-		await Promise.all([...this.ensuring.values()].map((pending) => pending.catch(() => void 0)));
-		for (const key of [...this.runtimes.keys()]) await this.reclaim(key);
-	}
-	/**
-	* True while the member's runtime exists or is being spawned. The settings
-	* controller gates a new generation on this: a fresh driver must not serve
-	* a member whose retiring generation still hosts the (same) sub-dsh session.
-	*/
-	hasRuntime(key) {
-		return this.runtimes.has(key) || this.ensuring.has(key);
-	}
-	/** @deprecated Compatibility no-op: live output is always incremental. */
-	setLiveMirrorGranularity(_granularity) {}
-	/**
-	* Drain for a settings-driven generation handoff: refuse new rounds (the
-	* provider's catch falls back to exec), let every in-flight round finish on
-	* its runtime, then reclaim. Resolves when no runtime or spawn remains.
-	* Unlike disposeAll, in-flight work is never interrupted.
-	*/
-	async drain() {
-		this.draining = true;
-		const keys = /* @__PURE__ */ new Set([
-			...this.runtimes.keys(),
-			...this.ensuring.keys(),
-			...this.roundChains.keys()
-		]);
-		await Promise.all([...keys].map(async (key) => {
-			await (this.roundChains.get(key) ?? Promise.resolve()).catch(() => void 0);
-			await (this.ensuring.get(key) ?? Promise.resolve()).catch(() => void 0);
-			await this.reclaim(key);
-		}));
-	}
-	/**
-	* The model the member's live runtime bound at spawn: the identifier, or
-	* undefined when the runtime spawned with no `--model`. Null when the
-	* member has no live runtime in this generation — the broker's switch check
-	* distinguishes "no runtime to retire" from "runtime bound to no model".
-	*/
-	boundModelOf(key) {
-		const runtime = this.runtimes.get(key);
-		if (runtime === void 0 || runtime.dead) return null;
-		return runtime.boundModel;
-	}
-	/**
-	* Retire the member's resident runtime so the NEXT round respawns (the
-	* sub-dsh session itself carries over via the on-disk resume). The
-	* composer's model switch calls this after storing the new override; the
-	* caller guarantees no round is in flight for the member.
-	*/
-	async retireRuntime(key) {
-		await this.reclaim(key);
-	}
-	/**
-	* The member's live runtime, spawning it (once per member at a time) when
-	* absent or dead. `signal` abandons the spawn on cancellation.
-	*/
-	async ensureRuntime(spec, launch, signal) {
-		const key = spec.sessionId;
-		const startModel = spec.startModel?.trim();
-		const existing = this.runtimes.get(key);
-		if (existing !== void 0 && !existing.dead) {
-			if (existing.modelLaunchFingerprint !== launch.fingerprint || spec.configuration !== void 0 && existing.configurationKey !== JSON.stringify(spec.configuration) || spec.configuration === void 0 && existing.configurationKey !== void 0 || startModel !== void 0 && startModel !== "" && existing.boundModel !== startModel) await this.reclaim(key);
-			else {
-				this.clearIdleTimer(key);
-				return existing;
-			}
-		} else if (existing !== void 0) this.runtimes.delete(key);
-		const pending = this.ensuring.get(key);
-		if (pending !== void 0) return pending;
-		const spawn = this.spawnRuntime(spec, launch, signal).finally(() => {
-			this.ensuring.delete(key);
-		});
-		this.ensuring.set(key, spawn);
-		return spawn;
-	}
-	/**
-	* Spawn the member's resident runtime and prove the wire with a handshake.
-	* Spawn/handshake failure trips the channel breaker (exec fallback) and
-	* throws {@link LiveChannelUnavailableError}; a later crash is NOT a broken
-	* channel — the next round re-spawns and resumes the on-disk session. A
-	* cancellation mid-spawn reclaims the half-started runtime and throws the
-	* abort instead, without touching the breaker.
-	*/
-	async spawnRuntime(spec, launch, signal) {
-		const key = spec.sessionId;
-		if (this.disposed) throw new LiveChannelUnavailableError("the live driver is disposed");
-		const profileName = this.config.profileName ?? "headless-local-agent-dsh";
-		const member = registerMemberRun(this.ctx, "dsh-cli", spec.sessionId, spec.parentSessionId);
-		const startModel = spec.startModel?.trim();
-		const model = spec.configuration !== void 0 ? spec.configuration.model : startModel !== void 0 && startModel !== "" ? startModel : this.config.modelFor?.(key)?.trim();
-		const spawnSpec = {
-			argv: [
-				...dshLaunchArgv(this.config),
-				"--profile",
-				profileName,
-				"--serve",
-				...model === void 0 || model === "" ? [] : ["--model", model],
-				...spec.configuration?.effort === void 0 ? [] : ["--effort", spec.configuration.effort]
-			],
-			cwd: spec.cwd,
-			stdio: {
-				stdin: "pipe",
-				stdout: "pipe",
-				stderr: "pipe"
-			},
-			graceMs: DEFAULT_DISPOSE_GRACE_MS,
-			env: delegationEnv({
-				DSH_HOME: spec.homeDir,
-				...launch.env,
-				...process.env.TSX_TSCONFIG_PATH === void 0 ? {} : { TSX_TSCONFIG_PATH: process.env.TSX_TSCONFIG_PATH },
-				...member === void 0 ? {} : member.env
-			})
-		};
-		let child;
-		try {
-			child = this.ctx.subprocess.spawn(spawnSpec);
-		} catch (error) {
-			member?.release();
-			this.markChannelBroken();
-			throw new LiveChannelUnavailableError(`the serve process failed to spawn: ${thrown$1(error).message}`);
-		}
-		const runtime = new LiveRuntime(child, this.timeouts, (message) => {
-			this.ctx.logger.warn(message);
-		});
-		runtime.boundModel = model === void 0 || model === "" ? void 0 : model;
-		runtime.modelLaunchFingerprint = launch.fingerprint;
-		runtime.configurationKey = spec.configuration === void 0 ? void 0 : JSON.stringify(spec.configuration);
-		runtime.onDead = () => {
-			if (this.runtimes.get(key) === runtime) this.runtimes.delete(key);
-			this.clearIdleTimer(key);
-			member?.release();
-		};
-		const aborted = new Promise((_, reject) => {
-			const cancel = () => {
-				reject(/* @__PURE__ */ new Error("subagent-dsh: run cancelled locally"));
-			};
-			const unload = () => {
-				reject(new LiveChannelUnavailableError("the live driver was disposed during spawn"));
-			};
-			if (signal.aborted) {
-				cancel();
-				return;
-			}
-			if (this.disposeController.signal.aborted) {
-				unload();
-				return;
-			}
-			signal.addEventListener("abort", cancel, { once: true });
-			this.disposeController.signal.addEventListener("abort", unload, { once: true });
-		});
-		aborted.catch(() => {});
-		try {
-			const hello = await Promise.race([runtime.request("initialize", {}, this.timeouts.initializeMs), aborted]);
-			if (hello.protocolVersion !== LIVE_WIRE_PROTOCOL_VERSION || hello.serverInfo.name !== LIVE_SERVER_NAME) throw new Error("the serve handshake reported an unexpected identity");
-		} catch (error) {
-			await runtime.reclaim();
-			if (signal.aborted) throw thrown$1(error);
-			this.markChannelBroken();
-			throw new LiveChannelUnavailableError(`the serve handshake failed: ${thrown$1(error).message}`);
-		}
-		if (this.disposed) {
-			await runtime.reclaim();
-			throw new LiveChannelUnavailableError("the live driver was disposed during spawn");
-		}
-		this.channelBrokenAt = void 0;
-		this.runtimes.set(key, runtime);
-		return runtime;
-	}
-	markChannelBroken() {
-		this.channelBrokenAt = Date.now();
-	}
-	/**
-	* Drive one delegation round on the member's resident runtime. Rounds of
-	* one member are strictly serialized: the facade's resume lock covers
-	* resume-vs-resume only, and a resume racing an in-flight fresh round would
-	* otherwise overwrite the runtime's single notification sink and strand
-	* the earlier round forever.
-	*/
-	/** Prepare the owned headless agent and validate its adapter without a model turn. */
-	async prepare(spec, signal) {
-		signal.throwIfAborted();
-		if (this.draining || this.disabled) throw new LiveChannelUnavailableError("the live driver is unavailable for preparation");
-		try {
-			provisionDshScope(spec.homeDir, {
-				...this.config,
-				inheritModelConfiguration: true
-			});
-			const launch = await localModelLaunch(this.ctx, this.config, spec.configuration?.model ?? spec.startModel ?? this.config.modelFor?.(spec.sessionId));
-			await (await this.ensureRuntime(spec, launch, signal)).request("session/prepare", {
-				sessionId: spec.sessionId,
-				resume: spec.resume !== void 0
-			});
-			signal.throwIfAborted();
-			this.armIdleTimer(spec.sessionId);
-		} catch (error) {
-			await this.reclaim(spec.sessionId);
-			throw error;
-		}
-	}
-	async startRound(request, spec) {
-		if (this.draining) throw new LiveChannelUnavailableError("the live driver is draining (a settings change retired this generation)");
-		const key = String(spec.childSession.id);
-		const round = (this.roundChains.get(key) ?? Promise.resolve()).catch(() => {}).then(() => this.startRoundLocked(request, spec));
-		this.roundChains.set(key, round.then((handle) => handle.result.catch(() => ({})), () => ({})));
-		return round;
-	}
-	/**
-	* The serialized round body. Mirrors the exec run's settlement contract
-	* exactly (settleRunResult + turn/end bookkeeping) so the facade, the
-	* tool, and the projections cannot tell the difference — except `cancel`
-	* is a runtime interrupt and the process survives. Cancellation is honored
-	* in EVERY window: a slow spawn/handshake or a slow accept races the abort
-	* signal and settles aborted instead of running the turn to completion
-	* unwatched.
-	*/
-	async startRoundLocked(request, spec) {
-		const task = dshTextTask(request.prompt);
-		if (request.signal.aborted) throw new Error("subagent-dsh: request was aborted before the run started");
-		if (this.draining) throw new LiveChannelUnavailableError("the live driver is draining (a settings change retired this generation)");
-		if (this.disposed) throw new Error("subagent-dsh: the live driver is disposed");
-		const turn = spec.resume?.turn ?? 1;
-		const childSession = spec.childSession;
-		const localAgent = this.ctx.get("localAgent");
-		const runAbort = new AbortController();
-		let roundSettled = false;
-		let runtime;
-		/** True once turn/start may have reached the sub-dsh (interrupt becomes meaningful). */
-		let acceptSent = false;
-		/** True once the parent's turn/start boundary is in the child session. */
-		let turnOpened = false;
-		let lastText = "";
-		let mirroredMessages = 0;
-		/** Events of this round that arrived before the boundary opened (same-chunk batching). */
-		const bufferedEvents = [];
-		let persistQueue = Promise.resolve();
-		const persist = () => {
-			persistQueue = persistQueue.then(() => persistChildSession(this.ctx, childSession)).catch((error) => {
-				this.ctx.logger.warn(`subagent-dsh: live persistence failed: ${thrown$1(error).message}`);
-			});
-		};
-		const streamPublisher = localAgent?.liveStreams === void 0 ? void 0 : new LiveStreamPublisher(localAgent.liveStreams, childSession, turn, persist, (error) => this.ctx.logger.warn(`live checkpoint failed: ${String(error)}`));
-		const liveFlush = new LiveFlush((error) => this.ctx.logger.warn(`subagent-dsh: live flush failed: ${String(error)}`));
-		let streaming;
-		const publishStream = () => {
-			if (streaming === void 0 || streamPublisher === void 0) return;
-			const blocks = streaming.assembler.interruptedBlocks();
-			const receivedAt = streaming.receivedAt ?? Date.now();
-			for (const [index, block] of blocks.entries()) if ((block.type === "reasoning" || block.type === "text") && block.text !== "") streamPublisher.update(streaming.step, block.type === "reasoning" ? "think" : "text", block.text, {
-				itemId: `${streaming.id}:${index}`,
-				receivedAt
-			});
-			delete streaming.receivedAt;
-		};
-		const acceptStream = (frame) => {
-			if (streamPublisher === void 0) return;
-			if (frame.type === "start") {
-				if (streaming !== void 0) liveFlush.cancel(streaming.step);
-				streaming = {
-					id: String(frame.attemptId),
-					step: frame.step,
-					assembler: new BlockAssembler(),
-					next: 0
-				};
-			} else if (frame.type === "chunk" && streaming?.id === frame.attemptId) {
-				if (frame.index < streaming.next) return;
-				if (frame.index !== streaming.next) throw new Error("non-contiguous DSH assistant stream");
-				streaming.next++;
-				streaming.receivedAt ??= Date.now();
-				streaming.assembler.push(frame.chunk);
-				liveFlush.schedule(streaming.step, publishStream);
-			}
-		};
-		const requestCancel = () => {
-			if (roundSettled || runAbort.signal.aborted) return;
-			runAbort.abort(/* @__PURE__ */ new Error("subagent-dsh: run cancelled locally"));
-			if (acceptSent && runtime !== void 0 && !runtime.dead) runtime.request("turn/interrupt", { sessionId: spec.sessionId }).catch(() => {});
-		};
-		const onAbort = () => {
-			requestCancel();
-		};
-		request.signal.addEventListener("abort", onAbort, { once: true });
-		const abortBranch = new Promise((_, reject) => {
-			runAbort.signal.addEventListener("abort", () => reject(/* @__PURE__ */ new Error("subagent-dsh: run cancelled locally")), { once: true });
-		});
-		const mirrorOne = (event) => {
-			const text = mirrorDshLiveEvent(childSession, event);
-			if (event.type === "assistant/message") {
-				liveFlush.cancel(event.data.step);
-				streamPublisher?.finish(event.data.step);
-				if (streaming?.step === event.data.step) streaming = void 0;
-			}
-			if (event.type === "user/message" || event.type === "assistant/message") {
-				mirroredMessages += 1;
-				persist();
-			}
-			if (text !== void 0) localAgent?.reportRunProgress(childSession.id, {
-				kind: "delta",
-				text
-			});
-			if (event.type === "assistant/message" && text !== void 0 && text !== "") lastText = text;
-		};
-		const openTurn = () => {
-			childSession.append("turn/start", { turn });
-			turnOpened = true;
-			for (const entry of bufferedEvents.splice(0)) if (entry.kind === "event") mirrorOne(entry.event);
-			else acceptStream(entry.frame);
-		};
-		let nativeFailure;
-		let resolveIdle;
-		const idle = new Promise((resolve) => {
-			resolveIdle = resolve;
-		});
-		const installHandlers = (rt) => {
-			rt.onEvent = (sessionId, eventTurn, event) => {
-				if (sessionId !== spec.sessionId || eventTurn !== turn) return;
-				if (!turnOpened) {
-					bufferedEvents.push({
-						kind: "event",
-						event
-					});
-					return;
-				}
-				mirrorOne(event);
-			};
-			rt.onStream = (sessionId, eventTurn, frame) => {
-				if (sessionId !== spec.sessionId || eventTurn !== turn || roundSettled) return;
-				if (!turnOpened) bufferedEvents.push({
-					kind: "stream",
-					frame
-				});
-				else acceptStream(frame);
-			};
-			rt.onIdle = (sessionId, idleTurn, reason) => {
-				if (sessionId !== spec.sessionId || idleTurn !== turn) return;
-				resolveIdle({ reason });
-			};
-		};
-		provisionDshScope(spec.homeDir, {
-			...this.config,
-			inheritModelConfiguration: true
-		});
-		const launch = await localModelLaunch(this.ctx, this.config, spec.configuration?.model ?? spec.startModel ?? this.config.modelFor?.(spec.sessionId));
-		const accepted = (async () => {
-			const rt = await this.ensureRuntime(spec, launch, request.signal);
-			runtime = rt;
-			if (runAbort.signal.aborted) {
-				await this.reclaim(spec.sessionId);
-				throw new Error("subagent-dsh: run cancelled locally");
-			}
-			installHandlers(rt);
-			acceptSent = true;
-			try {
-				await rt.request("turn/start", {
-					sessionId: spec.sessionId,
-					text: task,
-					resume: spec.resume !== void 0,
-					turn
-				});
-			} catch (error) {
-				if (!runAbort.signal.aborted) await this.reclaim(spec.sessionId);
-				throw thrown$1(error);
-			}
-			openTurn();
-		})();
-		const attempt = accepted.then(async () => {
-			if (runAbort.signal.aborted) throw new Error("subagent-dsh: run cancelled locally");
-			const processFailure = runtime.child.done.then((outcome) => Promise.reject(/* @__PURE__ */ new Error(`subagent-dsh: the live runtime exited mid-round (code ${String(outcome.exitCode)}, signal ${String(outcome.signal)})`)), (error) => Promise.reject(thrown$1(error)));
-			processFailure.catch(() => {});
-			const { reason } = await Promise.race([idle, processFailure]);
-			if (reason?.kind === "aborted") return {
-				output: collectOutput(),
-				stopReason: "aborted"
-			};
-			if (reason?.kind === "error") {
-				nativeFailure = {
-					message: reason.error.message,
-					code: reason.error.code
-				};
-				throw new Error(`subagent-dsh live: the turn failed: ${reason.error.message}`);
-			}
-			if (reason?.kind !== "completed") throw new Error("subagent-dsh live: the turn produced no outcome");
-			const output = collectOutput();
-			if (output.length === 0) throw new Error("subagent-dsh live: the turn completed but produced no answer");
-			return {
-				output,
-				stopReason: "completed"
-			};
-		});
-		const collectOutput = () => lastText === "" ? [] : [{
-			type: "text",
-			text: lastText
-		}];
-		const result = settleRunResult({
-			attempt: () => Promise.race([attempt, abortBranch]),
-			collectOutput,
-			cancelled: () => runAbort.signal.aborted,
-			onError: (error, stopReason) => {
-				const diagnostics = runtime?.diagnostics ?? "";
-				const suffix = diagnostics === "" ? "" : `; ${diagnostics}`;
-				this.ctx.logger.warn(`subagent-dsh: live round failed (${stopReason}): ${error.message}${suffix}`);
-			},
-			signal: request.signal,
-			onAbort
-		}).then(async (settled) => {
-			roundSettled = true;
-			liveFlush.dispose();
-			if (turnOpened && streaming !== void 0 && streamPublisher !== void 0) {
-				const blocks = streaming.assembler.interruptedBlocks();
-				if (blocks.length > 0) {
-					childSession.append("assistant/message", {
-						turn,
-						step: streaming.step,
-						message: createAssistantMessage({
-							content: blocks,
-							source: {
-								provider: "dsh-local",
-								model: "unobserved"
-							}
-						}),
-						stream: [],
-						interrupted: true
-					}, { surfaceOp: "append" });
-					streamPublisher.finish(streaming.step);
-					persist();
-				}
-			}
-			streamPublisher?.dispose();
-			if (turnOpened) {
-				if (settled.stopReason === "completed") childSession.append("turn/end", {
-					turn,
-					reason: { kind: "completed" }
-				});
-				else if (settled.stopReason === "aborted") childSession.append("turn/end", {
-					turn,
-					reason: {
-						kind: "aborted",
-						reason: { kind: "parent" }
-					}
-				});
-				else childSession.append("turn/end", {
-					turn,
-					reason: {
-						kind: "error",
-						error: nativeFailure ?? {
-							message: "the live round did not complete",
-							code: "UNKNOWN"
-						}
-					}
-				});
-			}
-			if (runtime !== void 0) {
-				runtime.onStream = void 0;
-				runtime.onEvent = void 0;
-				runtime.onIdle = void 0;
-			}
-			if (turnOpened) {
-				persist();
-				await persistQueue;
-			}
-			return settled;
-		});
-		result.then(async () => {
-			try {
-				if (turnOpened) {
-					await persistQueue;
-					if (mirroredMessages > 0) persist();
-					await persistQueue.catch(() => {});
-					const delta = await mirrorDshSession(this.ctx, childSession, spec.homeDir, spec.sessionId);
-					if (localAgent !== void 0) {
-						for (const text of delta.texts) localAgent.reportRunProgress(childSession.id, {
-							kind: "delta",
-							text
-						});
-						localAgent.reportRunProgress(childSession.id, {
-							kind: "mirror",
-							mirroredLines: delta.total
-						});
-						const round = {
-							...delta.observedModel === void 0 ? {} : { observedModel: delta.observedModel },
-							...delta.usage === void 0 ? {} : { usage: delta.usage },
-							...delta.toolCalls === void 0 ? {} : { toolCalls: delta.toolCalls }
-						};
-						localAgent?.recordRoundSettled?.(childSession.id, round);
-					}
-				}
-			} catch (error) {
-				this.ctx.logger.warn(`subagent-dsh: live settle mirror failed: ${thrown$1(error).message}`);
-			} finally {
-				this.armIdleTimer(spec.sessionId);
-			}
-		});
-		await Promise.race([accepted, abortBranch.catch(() => void 0)]);
-		return subprocessRunHandle({
-			id: SessionId(randomUUID()),
-			result,
-			signal: request.signal,
-			onAbort,
-			requestCancel,
-			teardown: async () => {
-				if (roundSettled) return;
-				await Promise.race([idle.catch(() => ({ reason: null })), delay(this.timeouts.convergeMs)]);
-			}
-		});
-	}
-};
-//#endregion
-//#region lib/types/dsh-cli-provider.js
-/**
-* One-shot and resumable dsh CLI subagent lifecycle: spawn the sub-dsh
-* headless profile (`dsh --profile <name> --session-id <uuid> "<task>"` or
-* `--resume <uuid>`) through the subprocess seam with the harness scoped home
-* as the child's `$DSH_HOME` and the parent's resolved DeepSeek key injected
-* explicitly (the shared env scrub drops credential-shaped names and every
-* `DSH_*` fact; the explicit env layer is the sanctioned override). The
-* caller-supplied session id is the same uuid on every round: the fresh round
-* creates the sub-dsh session with it, and each resume round continues exactly
-* that session. No stdout parsing — the sub-dsh session id is known a priori.
-* @module @khorsheed/dsh-local-agent-dsh/dsh-cli-provider
-*/
-/**
-* Spawn-env name carrying the bridge entry path into the sub-dsh process,
-* where the headless bundle's mcp-client row reads it (`!!js`). The name is a
-* family-internal contract between this provider and
-* `@khorsheed/dsh-local-agent-dsh-headless`'s cordis.patch.yml — the member
-* bridge itself reads only the socket/token env.
-*/
-const MEMBER_BRIDGE_ENTRY_ENV = "DSH_MEMBER_BRIDGE_ENTRY";
-/**
-* The `NODE_OPTIONS` a containerized round carries. dsh's HTTP client is
-* node's `fetch` (undici), which does NOT read `HTTP(S)_PROXY` by default: in
-* an evaluation unit whose only egress is a whitelist proxy the CLI dials the
-* API directly and fails with a transport error while the proxy never even
-* receives a `CONNECT`. `--use-env-proxy` opens undici's `EnvHttpProxyAgent`,
-* which does read those variables. Measured on the T16 image: without it the
-* round fails, with it the same round answers in 1.3 s. dsh is the only one
-* of the four CLIs that needs an extra knob to run inside a unit — the other
-* three carry their own proxy support — so the injection is automatic rather
-* than something every caller must remember, and the harness reports it in
-* its effective settings so the condition file can see it.
-*/
-const CONTAINER_NODE_OPTIONS = "--use-env-proxy";
-/** Default POSIX grace between subprocess termination tiers. */
-const DEFAULT_DISPOSE_GRACE_MS = 3e3;
-/** Default interval between live session-mirror polls during a run. */
-const DEFAULT_LIVE_MIRROR_INTERVAL_MS = 2e3;
-/** Register one member run with the channel; see {@link MemberRunHandle}. */
-function registerMemberRun(ctx, providerName, childSessionId, parentSessionId) {
-	const registry = ctx.localAgent;
-	if (typeof registry.registerMemberRun !== "function" || typeof registry.memberBridgeSocketPath !== "function" || typeof registry.memberBridgeCommand !== "function") return void 0;
-	const token = registry.registerMemberRun({
-		childSessionId,
-		parentSessionId,
-		provider: providerName
-	});
-	const bridge = registry.memberBridgeCommand();
-	let released = false;
-	return {
-		env: {
-			[MEMBER_BRIDGE_SOCKET_ENV]: registry.memberBridgeSocketPath(),
-			[MEMBER_BRIDGE_TOKEN_ENV]: token,
-			[MEMBER_BRIDGE_ENTRY_ENV]: bridge.args[0] ?? ""
-		},
-		release: () => {
-			if (released) return;
-			released = true;
-			registry.unregisterMemberRun(token);
-		}
-	};
-}
-/**
-* One-shot dsh CLI subagent provider: every accepted fresh run starts a fresh
-* sub-dsh headless process in the delegating Session's workspace, under the
-* harness scoped home; a resume round (the family tool's staged resume intent)
-* continues the SAME sub-dsh session with `--resume <uuid>` inside the SAME
-* dsh child session. Mirrors the other family providers' one-shot lifecycle,
-* including `NO_START_CAPABILITIES` — continuation is the family's own resume
-* mechanism, not the official Agent-type continuable seam. With the live
-* driver configured (`live: true`), rounds instead go to the resident sub-dsh
-* serve process (see live-driver.ts); the exec path below stays the fallback.
-*/
-var DshCliProvider = class {
-	ctx;
-	config;
-	live;
-	model;
-	overrides;
-	name = "dsh-cli";
-	capabilities = NO_START_CAPABILITIES;
-	inheritsParentContext = false;
-	/**
-	* @param live - the live driver, or a resolver returning the current
-	*   generation's driver per member (the settings toggle swaps generations;
-	*   a resolver may return undefined to steer one member's round to exec
-	*   while a retiring generation still hosts it).
-	*/
-	/**
-	* @param model - resolver for the harness's `model` plugin-config key, read
-	*   PER ROUND so a settings-card write reaches the next delegation without a
-	*   reload. A delegation that names its own model outranks it.
-	* @param overrides - resolver for the member's session-level model override
-	*   (the composer picker, owned by the model broker). It outranks BOTH the
-	*   delegation's recorded model and the configured one: on the exec path it
-	*   re-points the next round's `--model`, and on the live path it is the
-	*   member's start model — a resident runtime bound to a different model is
-	*   retired so the round respawns onto the override.
-	*/
-	constructor(ctx, config, live, model, overrides) {
-		this.ctx = ctx;
-		this.config = config;
-		this.live = live;
-		this.model = model;
-		this.overrides = overrides;
-	}
-	/** Resolve the live driver for one round's member, if live is on for it. */
-	liveDriver(childSessionId) {
-		const live = this.live;
-		if (live === void 0) return void 0;
-		return typeof live === "function" ? live(childSessionId) : live;
-	}
-	/** Per-round member-channel registration for the exec path (see {@link registerMemberRun}). */
-	memberRun(childSessionId, parentSessionId) {
-		return registerMemberRun(this.ctx, this.name, childSessionId, parentSessionId);
-	}
-	async start(request) {
-		const intent = this.ctx.localAgent.takeDelegationIntent(request.parent.session.id, this.name);
-		const scope = intent?.scope;
-		const homeDir = this.ctx.localAgent.homeDir("dsh", scope);
-		const cwd = resolveChildCwd(request.parent.session.header.cwd, intent?.cwd);
-		if (cwd === void 0) throw new Error("subagent-dsh: the parent session has no working directory to run the CLI in");
-		const exec = intent?.exec;
-		if (exec !== void 0) containerScopedHome(exec, "DSH_HOME", "subagent-dsh");
-		if (intent !== void 0 && intent.kind === "resume") {
-			const record = this.ctx.localAgent.getDelegation(intent.childSessionId);
-			assertResumeCwdUnchanged(record, cwd, "subagent-dsh");
-			assertResumeScopeUnchanged(record, scope, "subagent-dsh");
-			if (typeof this.ctx.localAgent.withMemberConfigurationRound !== "function") return this.startDshResume(request, intent, cwd, homeDir, exec, scope, record?.model);
-			return this.ctx.localAgent.withMemberConfigurationRound({
-				childSessionId: intent.childSessionId,
-				provider: this.name,
-				parentSessionId: request.parent.session.id,
-				cwd,
-				...scope === void 0 ? {} : { scope },
-				...record?.model === void 0 ? {} : { model: record.model },
-				...record?.effort === void 0 ? {} : { effort: record.effort },
-				...record?.configurationLock === void 0 ? {} : { configurationLock: record.configurationLock }
-			}, (configuration) => this.startDshResume(request, intent, cwd, homeDir, exec, scope, record?.model, configuration), request.signal, intent?.onAdmitted);
-		}
-		const childSessionId = SessionId(intent?.preparedMemberId ?? intent?.childSessionId ?? randomUUID());
-		if (typeof this.ctx.localAgent.withMemberConfigurationRound !== "function") {
-			if (intent?.effort !== void 0) throw new Error("DSH effort requires the configuration admission core");
-			return this.startDshFresh(request, cwd, homeDir, exec, scope, intent?.model, childSessionId);
-		}
-		return this.ctx.localAgent.withMemberConfigurationRound({
-			childSessionId,
-			provider: this.name,
-			parentSessionId: request.parent.session.id,
-			cwd,
-			...scope === void 0 ? {} : { scope },
-			...intent?.model === void 0 ? {} : { model: intent.model },
-			...intent?.effort === void 0 ? {} : { effort: intent.effort },
-			...intent?.configurationLock === void 0 ? {} : { configurationLock: intent.configurationLock }
-		}, (configuration) => this.startDshFresh(request, cwd, homeDir, exec, scope, intent?.model, childSessionId, configuration), request.signal, intent?.onAdmitted);
-	}
-	/** Fresh round: record the child session and delegation, spawn the sub-dsh create. */
-	async startDshFresh(request, cwd, homeDir, exec, scope, requestedModel, runId, configuration) {
-		let childSession;
-		try {
-			const sessions = this.ctx.get("sessions");
-			if (sessions === void 0) throw new Error("the sessions service is not mounted");
-			childSession = sessions.get(runId) ?? sessions.create(runId, { meta: {
-				cwd,
-				parentSession: request.parent.session.id,
-				origin: "subagent",
-				delegationDepth: (request.parent.session.header.delegationDepth ?? 0) + 1
-			} });
-			const harness = this.ctx.localAgent.get("dsh");
-			const label = subagentDelegationLabel(harness?.displayName ?? "dsh", request.label || void 0);
-			childSession.append("subagent/descriptor", {
-				version: SUBAGENT_DESCRIPTOR_VERSION,
-				mode: "one-shot",
-				provider: this.name,
-				label
-			});
-			establishSubagentCatalogChild(request.parent.session, childSession.header, label);
-		} catch (error) {
-			this.ctx.logger.warn(`subagent-dsh: subagent session record failed: ${error instanceof Error ? error.message : String(error)}`);
-		}
-		this.ctx.localAgent.recordDelegation({
-			childSessionId: runId,
-			provider: this.name,
-			parentSessionId: request.parent.session.id,
-			cliSessionId: runId,
-			cwd,
-			...scope === void 0 ? {} : { scope },
-			...requestedModel === void 0 ? {} : { model: requestedModel }
-		});
-		const live = exec === void 0 ? this.liveDriver(runId) : void 0;
-		if (live !== void 0 && childSession !== void 0 && !live.disabled) {
-			const startModel = configuration === void 0 ? this.overrides?.(runId) ?? requestedModel : configuration.resolved.model;
-			try {
-				return await live.startRound(request, {
-					cwd,
-					homeDir,
-					childSession,
-					sessionId: runId,
-					parentSessionId: request.parent.session.id,
-					...startModel === void 0 ? {} : { startModel },
-					...configuration === void 0 ? {} : { configuration: configuration.resolved }
-				});
-			} catch (error) {
-				if (!(error instanceof LiveChannelUnavailableError) || request.signal.aborted) throw error;
-				this.ctx.logger.warn(`subagent-dsh: live driver unavailable, using the exec one-shot: ${error.message}`);
-			}
-		}
-		const member = exec === void 0 ? this.memberRun(runId, request.parent.session.id) : void 0;
-		try {
-			const run = await startDshCliRun(request, {
-				cwd,
-				homeDir,
-				childSession,
-				sessionId: runId,
-				...configuration?.resolved ?? resolveRoundModel(this.overrides?.(runId) ?? requestedModel, this.model),
-				resume: void 0,
-				config: this.config,
-				ctx: this.ctx,
-				...member === void 0 ? {} : { memberEnv: member.env },
-				...exec === void 0 ? {} : { exec },
-				cliVersion: () => dshCliVersion(this.ctx, this.config, homeDir),
-				...scope === void 0 ? {} : { scope }
-			});
-			if (member !== void 0) run.result.then(member.release, member.release);
-			return run;
-		} catch (error) {
-			member?.release();
-			throw error;
-		}
-	}
-	/** Resume round: continue the recorded sub-dsh session inside the existing child session. */
-	async startDshResume(request, intent, cwd, homeDir, exec, scope, requestedModel, configuration) {
-		if (!this.ctx.localAgent.acquireResumeLock(intent.childSessionId)) throw new Error(`subagent-dsh: 该子会话有进行中的委派，等其完成后再追问 (child session ${intent.childSessionId})`);
-		try {
-			const childSession = this.ctx.get("sessions")?.get(SessionId(intent.childSessionId));
-			if (childSession === void 0) throw new Error(`subagent-dsh: resume target child session ${intent.childSessionId} is not live — start a fresh delegation instead`);
-			const nextTurn = childSession.snapshotEvents().filter((event) => event.type === "turn/start").length + 1;
-			const live = exec === void 0 ? this.liveDriver(intent.childSessionId) : void 0;
-			if (live !== void 0 && !live.disabled) {
-				const startModel = configuration === void 0 ? this.overrides?.(intent.childSessionId) ?? requestedModel : configuration.resolved.model;
-				try {
-					const liveRun = await live.startRound(request, {
-						cwd,
-						homeDir,
-						childSession,
-						sessionId: intent.cliSessionId,
-						parentSessionId: request.parent.session.id,
-						resume: { turn: nextTurn },
-						...startModel === void 0 ? {} : { startModel },
-						...configuration === void 0 ? {} : { configuration: configuration.resolved }
-					});
-					liveRun.result.then(() => {
-						this.ctx.localAgent.releaseResumeLock(intent.childSessionId);
-					}, () => {
-						this.ctx.localAgent.releaseResumeLock(intent.childSessionId);
-					});
-					return liveRun;
-				} catch (error) {
-					if (!(error instanceof LiveChannelUnavailableError) || request.signal.aborted) throw error;
-					this.ctx.logger.warn(`subagent-dsh: live driver unavailable, using the exec one-shot: ${error.message}`);
-				}
-			}
-			const member = exec === void 0 ? this.memberRun(intent.childSessionId, request.parent.session.id) : void 0;
-			try {
-				const run = await startDshCliRun(request, {
-					cwd,
-					homeDir,
-					childSession,
-					sessionId: intent.cliSessionId,
-					...configuration?.resolved ?? resolveRoundModel(this.overrides?.(intent.childSessionId) ?? requestedModel, this.model),
-					resume: {
-						cliSessionId: intent.cliSessionId,
-						turn: nextTurn
-					},
-					config: this.config,
-					ctx: this.ctx,
-					...member === void 0 ? {} : { memberEnv: member.env },
-					...exec === void 0 ? {} : { exec },
-					cliVersion: () => dshCliVersion(this.ctx, this.config, homeDir),
-					...scope === void 0 ? {} : { scope }
-				});
-				run.result.then(() => {
-					this.ctx.localAgent.releaseResumeLock(intent.childSessionId);
-					member?.release();
-				}, () => {
-					this.ctx.localAgent.releaseResumeLock(intent.childSessionId);
-					member?.release();
-				});
-				return run;
-			} catch (error) {
-				member?.release();
-				throw error;
-			}
-		} catch (error) {
-			this.ctx.localAgent.releaseResumeLock(intent.childSessionId);
-			throw error;
-		}
-	}
-};
-/** Validate and join the one-shot task before crossing the process boundary. */
-function dshTextTask(prompt) {
-	if (prompt.length === 0) throw new Error("subagent-dsh: the one-shot task must contain only text blocks");
-	const texts = [];
-	for (const block of prompt) {
-		if (block.type !== "text") throw new Error("subagent-dsh: the one-shot task must contain only text blocks");
-		texts.push(block.text);
-	}
-	if (texts.every((text) => text.trim().length === 0)) throw new Error("subagent-dsh: the one-shot task must not be empty");
-	return texts.join("\n");
-}
-function thrown(value) {
-	/* v8 ignore next -- typed subprocess failures reject with Error. */
-	return value instanceof Error ? value : new Error(String(value));
-}
-/**
-* The dsh launch argv the provider replicates: the parent instance's own
-* node + tsx import + entry point, so the sub-dsh runs the same dsh build as
-* its parent. A configured `cliLaunch` replaces this entirely.
-* @param config - plugin config carrying the optional override.
-* @returns the launch prefix before the profile flag.
-*/
-function dshLaunchArgv(config) {
-	if (config.cliLaunch !== void 0 && config.cliLaunch.length > 0) return config.cliLaunch;
-	return [
-		process.execPath,
-		...process.execArgv,
-		process.argv[1] ?? "dsh"
-	];
-}
-/**
-* Mark the harness credential verified after a completed round, degrading
-* silently on a core that predates the mark (the family's companion-pair
-* rule: a provider paired with an older core loses the grade, never the run).
-* @param ctx - host context carrying the family registry.
-*/
-function markCredentialVerified(ctx, scope) {
-	const registry = ctx.get("localAgent");
-	if (registry === void 0 || typeof registry.reportAuthSuccess !== "function") return;
-	registry.reportAuthSuccess("dsh", scope);
-}
-/**
-* The dsh build the sub-dsh runs, probed by asking the very launch argv the
-* delegation would spawn for its `--version` (the sub-dsh replicates the
-* parent instance's own node + entry point, so the parent's build IS the
-* child's). Cached by the family probe against that entry script's identity,
-* so a harness upgrade re-probes and an unchanged one never spawns twice.
-* @param ctx - host context carrying the subprocess seam.
-* @param config - plugin config carrying the optional launch override.
-* @param homeDir - the harness's scoped home.
-* @returns the version, or undefined when the launch cannot be asked.
-*/
-function dshCliVersion(ctx, config, homeDir) {
-	const subprocess = ctx.get("subprocess");
-	if (subprocess === void 0) return Promise.resolve(void 0);
-	return probeCliVersion({
-		argv: [...dshLaunchArgv(config), "--version"],
-		cwd: homeDir,
-		spawn: (spec) => subprocess.spawn(spec),
-		env: delegationEnv({ DSH_HOME: homeDir })
-	});
-}
-/**
-* Start the real sub-dsh headless child and publish its run. The final answer
-* is printed to stdout; stderr is inherited for diagnostics. The run id is
-* the child session id for a session-backed run, so the tool's
-* `resume="<id>"` self-description names the same handle the registry
-* records.
-* @param request - resolved shared subagent request.
-* @param spec - workspace, scoped home, child session, and resume facts.
-* @returns the published run after the child starts.
-*/
-async function startDshCliRun(request, spec) {
-	const { config, ctx } = spec;
-	const task = dshTextTask(request.prompt);
-	if (request.signal.aborted) throw new Error("subagent-dsh: request was aborted before the CLI started");
-	const profileName = spec.exec === void 0 ? config.profileName ?? "headless-local-agent-dsh" : unitSubProfileName(config);
-	if (spec.exec === void 0) provisionDshScope(spec.homeDir, {
-		...config,
-		inheritModelConfiguration: true
-	});
-	const modelEnv = spec.exec === void 0 ? (await localModelLaunch(ctx, config, spec.model)).env : { DEEPSEEK_API_KEY: await resolveApiKey(ctx, config) };
-	const turn = spec.resume?.turn ?? 1;
-	spec.childSession?.append("turn/start", { turn });
-	const launch = dshLaunchArgv(config);
-	const modelArgv = [...spec.model === void 0 ? [] : ["--model", spec.model], ...spec.effort === void 0 ? [] : ["--effort", spec.effort]];
-	const argv = spec.resume === void 0 ? [
-		...launch,
-		"--profile",
-		profileName,
-		"--session-id",
-		spec.sessionId,
-		...modelArgv,
-		task
-	] : [
-		...launch,
-		"--profile",
-		profileName,
-		"--resume",
-		spec.sessionId,
-		...modelArgv,
-		task
-	];
-	const env = delegationEnv({
-		DSH_HOME: spec.homeDir,
-		...modelEnv,
-		...spec.exec !== void 0 || process.env.TSX_TSCONFIG_PATH === void 0 ? {} : { TSX_TSCONFIG_PATH: process.env.TSX_TSCONFIG_PATH },
-		...spec.exec === void 0 || spec.exec.env?.["NODE_OPTIONS"] !== void 0 ? {} : { NODE_OPTIONS: CONTAINER_NODE_OPTIONS },
-		...spec.memberEnv
-	});
-	const spawnSpec = {
-		...spec.exec === void 0 ? {
-			argv,
-			env
-		} : containerExecSpawn(spec.exec, {
-			argv,
-			env
-		}, "subagent-dsh"),
-		cwd: spec.cwd,
-		stdio: {
-			stdin: "ignore",
-			stdout: "pipe",
-			stderr: "pipe"
-		},
-		graceMs: DEFAULT_DISPOSE_GRACE_MS
-	};
-	const child = ctx.subprocess.spawn(spawnSpec);
-	let output = "";
-	child.stdout?.on("data", (chunk) => {
-		output += chunk.toString();
-	});
-	let stderr = "";
-	child.stderr?.on("data", (chunk) => {
-		stderr += chunk.toString();
-	});
-	let mirrorQueue = Promise.resolve();
-	const enqueueMirror = (task) => {
-		mirrorQueue = mirrorQueue.then(task);
-	};
-	const mirrorAndReport = async (childSession, alwaysReport) => {
-		const delta = await mirrorDshSession(ctx, childSession, spec.homeDir, spec.sessionId);
-		const localAgent = ctx.get("localAgent");
-		if (localAgent === void 0) return;
-		if (delta.texts.length === 0 && !alwaysReport) return;
-		for (const text of delta.texts) localAgent.reportRunProgress(childSession.id, {
-			kind: "delta",
-			text
-		});
-		localAgent.reportRunProgress(childSession.id, {
-			kind: "mirror",
-			mirroredLines: delta.total
-		});
-		if (alwaysReport) {
-			const cliVersion = await spec.cliVersion?.();
-			localAgent.recordRoundSettled(childSession.id, {
-				...delta.observedModel === void 0 ? {} : { observedModel: delta.observedModel },
-				...cliVersion === void 0 ? {} : { cliVersion },
-				...delta.usage === void 0 ? {} : { usage: delta.usage },
-				...delta.toolCalls === void 0 ? {} : { toolCalls: delta.toolCalls }
-			});
-		}
-	};
-	if (spec.childSession !== void 0) {
-		const childSession = spec.childSession;
-		const liveMirror = setInterval(() => {
-			enqueueMirror(() => mirrorAndReport(childSession, false));
-		}, spec.liveMirrorIntervalMs ?? 2e3);
-		liveMirror.unref();
-		child.done.then(() => {
-			clearInterval(liveMirror);
-		}, () => {
-			clearInterval(liveMirror);
-		});
-	}
-	const disposeProcess = async () => {
-		child.terminate();
-		await child.waitForExit().catch(() => false);
-		await child.done.catch(() => {});
-	};
-	const runAbort = new AbortController();
-	const requestCancel = () => {
-		if (runAbort.signal.aborted) return;
-		runAbort.abort(/* @__PURE__ */ new Error("subagent-dsh: run cancelled locally"));
-	};
-	const onAbort = () => {
-		requestCancel();
-	};
-	request.signal.addEventListener("abort", onAbort, { once: true });
-	const abortBranch = new Promise((_, reject) => {
-		runAbort.signal.addEventListener("abort", () => reject(/* @__PURE__ */ new Error("subagent-dsh: run cancelled locally")), { once: true });
-	});
-	const processFailure = child.done.then((outcome) => Promise.reject(/* @__PURE__ */ new Error(`subagent-dsh: CLI exited before the run settled (code ${String(outcome.exitCode)}, signal ${String(outcome.signal)})`)), (error) => Promise.reject(thrown(error)));
-	processFailure.catch(() => {});
-	const collectOutput = () => {
-		const text = output.trim();
-		return text === "" ? [] : [{
-			type: "text",
-			text
-		}];
-	};
-	const result = settleRunResult({
-		attempt: () => Promise.race([
-			child.done.then((outcome) => {
-				if (outcome.exitCode !== 0) throw new Error(`subagent-dsh: dsh exited with code ${String(outcome.exitCode)}`);
-				const answer = collectOutput();
-				if (answer.length === 0) throw new Error("subagent-dsh: dsh exited 0 but produced no answer");
-				return {
-					output: answer,
-					stopReason: "completed"
-				};
-			}),
-			processFailure,
-			abortBranch
-		]),
-		collectOutput,
-		cancelled: () => runAbort.signal.aborted,
-		onError: (error, stopReason) => {
-			const suffix = stderr.trim() === "" ? "" : `; ${stderr.trim()}`;
-			ctx.logger.warn(`subagent-dsh: child run failed (${stopReason}): ${error.message}${suffix}`);
-		},
-		signal: request.signal,
-		onAbort
-	}).then((settled) => {
-		if (settled.stopReason === "completed") markCredentialVerified(ctx, spec.scope);
-		if (spec.childSession !== void 0) {
-			if (settled.stopReason === "completed") spec.childSession.append("turn/end", {
-				turn,
-				reason: { kind: "completed" }
-			});
-			else if (settled.stopReason === "aborted") spec.childSession.append("turn/end", {
-				turn,
-				reason: {
-					kind: "aborted",
-					reason: { kind: "parent" }
-				}
-			});
-			else spec.childSession.append("turn/end", {
-				turn,
-				reason: {
-					kind: "error",
-					error: {
-						message: "dsh exited before the run completed",
-						code: "UNKNOWN"
-					}
-				}
-			});
-		}
-		return settled;
-	});
-	result.then(() => child.done).then(() => {
-		if (spec.childSession !== void 0) {
-			const childSession = spec.childSession;
-			return enqueueMirror(() => mirrorAndReport(childSession, true));
-		}
-	}, () => {});
-	return Promise.resolve(subprocessRunHandle({
-		id: SessionId(randomUUID()),
-		result,
-		signal: request.signal,
-		onAbort,
-		requestCancel,
-		teardown: disposeProcess
-	}));
-}
-/** Resolve the sub-dsh credential or fail loud before any process spawns. */
-async function resolveApiKey(ctx, config) {
-	const ref = config.apiKeyRef ?? "DEEPSEEK_API_KEY";
-	const resolved = await ctx.credentials.resolve(credentialRef(ref));
-	if (resolved === void 0) throw new Error(`subagent-dsh: ${ref} is not configured; set it in the credential settings to delegate to dsh`);
-	return resolved.value;
-}
-//#endregion
-export { MEMBER_BRIDGE_ENTRY_ENV as a, dshTextTask as c, startDshCliRun as d, DEFAULT_LIVE_IDLE_MS as f, localModelLaunch as h, DshCliProvider as i, registerMemberRun as l, canInheritModelProvider as m, DEFAULT_DISPOSE_GRACE_MS as n, dshCliVersion as o, DshLiveDriver as p, DEFAULT_LIVE_MIRROR_INTERVAL_MS as r, dshLaunchArgv as s, CONTAINER_NODE_OPTIONS as t, resolveApiKey as u };