@khorsheed/dsh-local-agent 0.2.0-rc.1 → 0.2.0

package/lib/index.js

@@ -4,10 +4,13 @@ import { appendFileSync, chmodSync, closeSync, fsyncSync, mkdirSync, openSync, r
 import { delimiter, dirname, isAbsolute, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import z from "@deepseek-ai/schemastery";
+import * as sessionModule from "@deepseek-ai/dsh-session";
 import { SessionId } from "@deepseek-ai/dsh-session";
 import { Remote, TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
 import { createServer } from "node:net";
+import { createScope } from "@deepseek-ai/dsh-scope";
 import { scrubbedParentEnv } from "@deepseek-ai/dsh-subprocess";
+import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
 //#region lib/types/cli-version.js
 /**
 * The family's CLI version probe: one bounded `<cli> --version` spawn whose
@@ -503,6 +506,11 @@ let LocalAgentGateway = (() => {
 	let _sessions_decorators;
 	let _memberOf_decorators;
 	let _harnessModel_decorators;
+	let _checkEndpoint_decorators;
+	let _endpointAuth_decorators;
+	let _configureEndpoint_decorators;
+	let _modelList_decorators;
+	let _configureModelList_decorators;
 	let _memberModel_decorators;
 	let _setMemberModel_decorators;
 	let _memberConfiguration_decorators;
@@ -529,6 +537,11 @@ let LocalAgentGateway = (() => {
 			_sessions_decorators = [Remote("sessions")];
 			_memberOf_decorators = [Remote("memberOf")];
 			_harnessModel_decorators = [Remote("harnessModel")];
+			_checkEndpoint_decorators = [Remote("checkEndpoint")];
+			_endpointAuth_decorators = [Remote("endpointAuth")];
+			_configureEndpoint_decorators = [Remote("configureEndpoint")];
+			_modelList_decorators = [Remote("modelList")];
+			_configureModelList_decorators = [Remote("configureModelList")];
 			_memberModel_decorators = [Remote("memberModel")];
 			_setMemberModel_decorators = [Remote("setMemberModel")];
 			_memberConfiguration_decorators = [Remote("memberConfiguration")];
@@ -672,6 +685,61 @@ let LocalAgentGateway = (() => {
 				},
 				metadata: _metadata
 			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _checkEndpoint_decorators, {
+				kind: "method",
+				name: "checkEndpoint",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "checkEndpoint" in obj,
+					get: (obj) => obj.checkEndpoint
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _endpointAuth_decorators, {
+				kind: "method",
+				name: "endpointAuth",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "endpointAuth" in obj,
+					get: (obj) => obj.endpointAuth
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _configureEndpoint_decorators, {
+				kind: "method",
+				name: "configureEndpoint",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "configureEndpoint" in obj,
+					get: (obj) => obj.configureEndpoint
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _modelList_decorators, {
+				kind: "method",
+				name: "modelList",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "modelList" in obj,
+					get: (obj) => obj.modelList
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
+			__esDecorate(this, null, _configureModelList_decorators, {
+				kind: "method",
+				name: "configureModelList",
+				static: false,
+				private: false,
+				access: {
+					has: (obj) => "configureModelList" in obj,
+					get: (obj) => obj.configureModelList
+				},
+				metadata: _metadata
+			}, null, _instanceExtraInitializers);
 			__esDecorate(this, null, _memberModel_decorators, {
 				kind: "method",
 				name: "memberModel",
@@ -981,6 +1049,75 @@ let LocalAgentGateway = (() => {
 			});
 		}
 		/**
+		* Verify one harness's saved endpoint from the host — the settings card's
+		* verify button. The answer is the harness's human-readable verdict text.
+		* Session-less by design: the commands channel needs a main agent session,
+		* which a settings card may not have. Null when the harness is unknown or
+		* declares no probe (the card then hides the button — declare-and-degrade).
+		* @param name - the harness name.
+		* @returns the verdict text, or null.
+		*/
+		async checkEndpoint(name) {
+			const harness = this.ctx.localAgent.get(name);
+			if (typeof harness?.checkEndpoint !== "function") return null;
+			return harness.checkEndpoint(this.ctx.localAgent.homeDir(name));
+		}
+		/**
+		* The settings card's read of one harness's resolved endpoint state —
+		* baseUrl verbatim, credentials as presence booleans (secrets never cross).
+		* Session-less like the rest of the gateway. Null when the harness is
+		* unknown or declares no endpoint face (the card then hides the form).
+		* @param name - the harness name.
+		* @returns the resolved per-field state, or null.
+		*/
+		async endpointAuth(name) {
+			const harness = this.ctx.localAgent.get(name);
+			if (harness?.endpointAuth === void 0) return null;
+			return harness.endpointAuth.read(this.ctx.localAgent.homeDir(name));
+		}
+		/**
+		* Apply one endpoint-credential edit into the harness's own credential
+		* store (a string sets, null clears, absent leaves), answering the
+		* post-write resolved state so the card can flip immediately. The write
+		* deliberately bypasses the volatile row-config channel — a credential
+		* never lands in the profile patch document. Null when the harness is
+		* unknown or declares no endpoint face.
+		* @param name - the harness name.
+		* @param fields - the field edits.
+		* @returns the post-write resolved state, or null.
+		*/
+		async configureEndpoint(name, fields) {
+			const harness = this.ctx.localAgent.get(name);
+			if (harness?.endpointAuth === void 0) return null;
+			await harness.endpointAuth.write(this.ctx.localAgent.homeDir(name), fields);
+			return harness.endpointAuth.read(this.ctx.localAgent.homeDir(name));
+		}
+		/**
+		* The settings card's read of one harness's curated model list — ordered
+		* identifiers, first is the default. Null when the harness is unknown or
+		* declares no list face (the card then hides the editor).
+		* @param name - the harness name.
+		* @returns the ordered list, or null.
+		*/
+		async modelList(name) {
+			const harness = this.ctx.localAgent.get(name);
+			if (harness?.modelList === void 0) return null;
+			return harness.modelList.read(this.ctx.localAgent.homeDir(name));
+		}
+		/**
+		* Replace one harness's curated model list wholesale (reorders, removals
+		* and additions all ride the same write), answering the list as persisted.
+		* Null when the harness is unknown or declares no list face.
+		* @param name - the harness name.
+		* @param models - the new ordered list.
+		* @returns the persisted list, or null.
+		*/
+		async configureModelList(name, models) {
+			const harness = this.ctx.localAgent.get(name);
+			if (harness?.modelList === void 0) return null;
+			return harness.modelList.write(this.ctx.localAgent.homeDir(name), models);
+		}
+		/**
 		* The model surface of one member — the composer's picker read. The
 		* delegation record's requested model rides in from the core so the broker
 		* can rank it between the override and the settings layer; the record's
@@ -1125,6 +1262,65 @@ let LocalAgentGateway = (() => {
 	};
 })();
 //#endregion
+//#region lib/types/mode-skills.js
+/**
+* Mode skills, installed the CLI's own way: a member with a mode gets the
+* skills that mode contributes (e.g. the 剪辑 mode's `video-studio`) written
+* into its harness home's skill directory — `skills/<name>/SKILL.md`, the
+* layout Codex (`$CODEX_HOME`), Claude Code (`$CLAUDE_CONFIG_DIR`) and Kimi
+* (`$KIMI_CODE_HOME`, its auto-discovered user skill directory) load. The home is shared by every member of that harness, so each skill is
+* named `dsh-<name>` and says it applies only alongside the mode's tools.
+* Harnesses without a known skill directory get none. Best-effort:
+* a failed write never fails the member's tool listing.
+* @module @khorsheed/dsh-local-agent/mode-skills
+*/
+/** Harnesses whose CLI loads `<home>/skills/<name>/SKILL.md`. */
+const SKILL_HOMES = /* @__PURE__ */ new Set([
+	"codex",
+	"claude-code",
+	"kimi"
+]);
+/** The skill directory of a harness home, or undefined when its CLI has none we know. */
+function harnessSkillsDir(harness, home) {
+	return SKILL_HOMES.has(harness) ? join(home, "skills") : void 0;
+}
+/** The SKILL.md a mode skill installs as. */
+function modeSkillFile(skill, mode) {
+	const name = `dsh-${skill.name}`;
+	const description = `${skill.description} (dsh mode "${mode}": use only when your tools include this mode's tools.)`.replace(/\s+/g, " ");
+	return {
+		name,
+		text: `---\nname: ${name}\ndescription: ${JSON.stringify(description)}\n---\n\n${skill.content.trim()}\n`
+	};
+}
+/**
+* Write the mode's skills into the harness's skill directory, skipping files
+* already up to date.
+* @param dir - the harness skill directory.
+* @param mode - the member's mode id.
+* @param skills - the mode's skills.
+* @returns the installed skill names.
+*/
+function installModeSkills(dir, mode, skills) {
+	const installed = [];
+	for (const skill of skills) {
+		const file = modeSkillFile(skill, mode);
+		const target = join(dir, file.name, "SKILL.md");
+		let current;
+		try {
+			current = readFileSync(target, "utf8");
+		} catch {
+			current = void 0;
+		}
+		if (current !== file.text) {
+			mkdirSync(join(dir, file.name), { recursive: true });
+			writeFileSync(target, file.text);
+		}
+		installed.push(file.name);
+	}
+	return installed;
+}
+//#endregion
 //#region lib/types/member-channel.js
 /**
 * Member channel, host side: the loopback listener the bridge MCP servers call
@@ -1153,6 +1349,8 @@ let LocalAgentGateway = (() => {
 *    `busy`; else the facade `resume` with a provenance-tagged prompt.
 * @module @khorsheed/dsh-local-agent/member-channel
 */
+/** How long one bridged mode-tool call may run before it is cancelled. */
+const MODE_TOOL_TIMEOUT_MS = 18e5;
 /**
 * The member-channel host: owns the loopback unix-socket listener and the
 * delivery chain. Mounted by the plugin's `apply` and disposed with its fiber.
@@ -1161,11 +1359,13 @@ var MemberChannel = class {
 	ctx;
 	registry;
 	socketPath;
+	modeTools;
 	server;
-	constructor(ctx, registry, socketPath) {
+	constructor(ctx, registry, socketPath, modeTools) {
 		this.ctx = ctx;
 		this.registry = registry;
 		this.socketPath = socketPath;
+		this.modeTools = modeTools;
 	}
 	/**
 	* Start listening. A listener failure (e.g. a socket path beyond the
@@ -1225,7 +1425,8 @@ var MemberChannel = class {
 	async answer(socket, line) {
 		let outcome;
 		try {
-			outcome = await this.handle(JSON.parse(line));
+			const request = JSON.parse(line);
+			outcome = request !== null && typeof request === "object" && "modeTools" in request ? await this.handleModeTools(request) : await this.handle(request);
 		} catch (error) {
 			outcome = {
 				ok: false,
@@ -1323,6 +1524,75 @@ var MemberChannel = class {
 			receipt: "sent"
 		};
 	}
+	/**
+	* The member's mode tools: the room says which mode the member has; the
+	* preset tool host lists or runs that mode's plugin tools. No room, no mode
+	* or no host = an empty list.
+	* @param request - the bridge callback.
+	* @returns the list or the call result.
+	*/
+	async handleModeTools(request) {
+		const run = typeof request.token === "string" ? this.registry.resolveMemberRun(request.token) : void 0;
+		if (run === void 0) return {
+			ok: false,
+			error: "localAgent: unknown or expired member token"
+		};
+		const mode = this.modeTools === void 0 ? void 0 : await this.probeRoom()?.memberMode?.(run);
+		if ("list" in request.modeTools) {
+			if (mode === void 0) {
+				this.modeTools?.note({
+					childSessionId: run.childSessionId,
+					provider: run.provider,
+					mode: false
+				});
+				return {
+					ok: true,
+					tools: []
+				};
+			}
+			try {
+				const tools = await this.modeTools.list(run.childSessionId, mode.preset, mode.cwd);
+				await this.installSkills(run, mode.preset);
+				return {
+					ok: true,
+					tools
+				};
+			} catch (error) {
+				this.ctx.logger.warn(`localAgent: mode tools for ${run.childSessionId} unavailable: ${String(error)}`);
+				return {
+					ok: true,
+					tools: []
+				};
+			}
+		}
+		if (mode === void 0) return {
+			ok: false,
+			error: "This member has no mode tools"
+		};
+		const { name, arguments: args } = request.modeTools.call;
+		try {
+			return {
+				ok: true,
+				result: await this.modeTools.call(run.childSessionId, mode.preset, name, args ?? {}, AbortSignal.timeout(MODE_TOOL_TIMEOUT_MS), mode.cwd)
+			};
+		} catch (error) {
+			return {
+				ok: false,
+				error: String(error)
+			};
+		}
+	}
+	/** Install the mode's skills into the member's harness skill directory (best-effort). */
+	async installSkills(run, preset) {
+		try {
+			const harness = this.registry.list().map((name) => this.registry.get(name)).find((candidate) => candidate?.delegationProvider === run.provider);
+			const dir = harness === void 0 ? void 0 : harnessSkillsDir(harness.name, this.registry.homeDir(harness.name));
+			if (dir === void 0) return;
+			installModeSkills(dir, preset, await this.modeTools.skills(run.childSessionId, preset));
+		} catch (error) {
+			this.ctx.logger.warn(`localAgent: mode skills for ${run.childSessionId} not installed: ${String(error)}`);
+		}
+	}
 	/** Probe the optional room gate without importing any room package. */
 	probeRoom() {
 		const room = this.ctx.get.call(this.ctx, "room");
@@ -1344,6 +1614,10 @@ var MemberChannel = class {
 			to: request.to,
 			content: request.text,
 			parentSessionId: from.parentSessionId,
+			...request.kind === "task" || request.kind === "notify" ? { kind: request.kind } : {},
+			...typeof request.inReplyTo === "string" ? { inReplyTo: request.inReplyTo } : {},
+			...typeof request.note === "string" ? { note: request.note } : {},
+			...typeof request.task === "string" ? { task: request.task } : {},
 			provenance: {
 				childSessionId: from.childSessionId,
 				provider: from.provider,
@@ -1372,6 +1646,251 @@ var MemberChannel = class {
 	}
 };
 //#endregion
+//#region lib/types/preset-tool-host.js
+/**
+* Preset tool host: lets an external CLI member use the plugin tools of a
+* host agent preset (a mode), through its member bridge, ON THE MEMBER'S OWN
+* SESSION. The tool registry keys scoped tools by an agent identity, and
+* plugin tools read only `agent.id` and `agent.session` from it — so the
+* member gets a model-less stand-in: `{ id, session }` over its own child
+* session, given a scope (`createScope`) with the preset mounted. Calls run
+* through the registry's normal pipeline (policies, approvals, timeouts) as
+* that stand-in, so plugin state (a video project) belongs to the member's
+* session and the mode's panels show there; the session also records the mode
+* (`agent-preset/selected`), so per-session plugin visibility follows it.
+* Only PLUGIN tools are offered (`Symbol.for('dsh.tool.origin')` channel
+* `plugin`; the CLI brings its own shell, files and todo).
+*
+* Everything host-side is probed, never injected: without `sessions`,
+* `agentPresets` or `tools` the member simply gets no extra tools.
+* @module @khorsheed/dsh-local-agent/preset-tool-host
+*/
+/** Owners whose tools the bridge already serves itself (room), or that delegate from dsh (the local-agent family). */
+const skippedOwner = (owner) => owner === "@khorsheed/dsh-room" || owner.startsWith("@khorsheed/dsh-local-agent");
+/** How long a freshly mounted preset may take to finish registering its tools, and how often to look. */
+const SETTLE_MS = 3e3;
+const SETTLE_STEP_MS = 150;
+const ORIGIN = Symbol.for("dsh.tool.origin");
+/** The mode a session records: its header, overridden by the latest selection. */
+function sessionPreset(session) {
+	let preset = session.header.agentPreset ?? void 0;
+	for (const event of session.snapshotEvents()) if (event.type === "agent-preset/selected") preset = event.data?.agentPreset ?? preset;
+	return preset;
+}
+/** Whether a definition is a plugin tool the bridge may forward. */
+function isPluginTool(definition) {
+	const origin = definition?.[ORIGIN];
+	return origin?.channel === "plugin" && !skippedOwner(String(origin.owner));
+}
+/** Map registry content blocks to MCP content (text and images; anything else as text). */
+function mcpContent(blocks) {
+	return blocks.map((block) => {
+		if (block.type === "text") return {
+			type: "text",
+			text: block.text ?? ""
+		};
+		if (block.type === "image" && typeof block.data === "string") return {
+			type: "image",
+			data: block.data,
+			mimeType: block.mediaType ?? block.mimeType ?? "image/png"
+		};
+		return {
+			type: "text",
+			text: JSON.stringify(block)
+		};
+	});
+}
+/** The per-member preset agents and the list/call operations the bridge forwards. */
+var PresetToolHost = class {
+	ctx;
+	diagnostics;
+	hosts = /* @__PURE__ */ new Map();
+	/** Stand-in → the member's child session, for routing approvals its calls raise. */
+	standIns = /* @__PURE__ */ new WeakMap();
+	/** The member a stand-in agent acts for, if it is one of ours. */
+	memberOf(agent) {
+		return typeof agent === "object" && agent !== null ? this.standIns.get(agent) : void 0;
+	}
+	/**
+	* @param ctx - the local-agent plugin context.
+	* @param diagnostics - optional JSONL file each listing appends a summary to
+	*   (what the preset agent's scope saw and which tools passed the filter).
+	*/
+	constructor(ctx, diagnostics) {
+		this.ctx = ctx;
+		this.diagnostics = diagnostics;
+	}
+	/** Append one diagnostics line (best-effort). */
+	note(entry) {
+		if (this.diagnostics === void 0) return;
+		try {
+			appendFileSync(this.diagnostics, `${JSON.stringify({
+				time: (/* @__PURE__ */ new Date()).toISOString(),
+				...entry
+			})}\n`);
+		} catch {}
+	}
+	probe(name) {
+		return this.ctx.get.call(this.ctx, name);
+	}
+	/** The member's stand-in, scoped with its preset on first use (and re-scoped when the preset changed). */
+	async agentFor(childSessionId, preset, _cwd) {
+		const sessions = this.probe("sessions");
+		const presets = this.probe("agentPresets");
+		const session = sessions?.get(SessionId(childSessionId));
+		if (presets?.mount === void 0 || session === void 0) return void 0;
+		const current = this.hosts.get(childSessionId);
+		if (current !== void 0 && current.preset === preset && (await current.agent).agent.session === session) return (await current.agent).agent;
+		if (current !== void 0) {
+			this.hosts.delete(childSessionId);
+			current.agent.then((handle) => handle.dispose()).catch(() => {});
+		}
+		const agent = (async () => {
+			const resolved = await presets.resolve(preset);
+			const member = {
+				id: childSessionId,
+				session
+			};
+			this.standIns.set(member, childSessionId);
+			const scope = createScope(this.ctx, member);
+			member.ctx = scope.ctx;
+			try {
+				await presets.mount(scope.ctx, resolved.id);
+			} catch (error) {
+				await scope.dispose();
+				throw error;
+			}
+			if (sessionPreset(session) !== resolved.id) session.append("agent-preset/selected", { agentPreset: resolved.id });
+			return {
+				agent: member,
+				dispose: () => scope.dispose()
+			};
+		})();
+		this.hosts.set(childSessionId, {
+			preset,
+			agent
+		});
+		try {
+			return (await agent).agent;
+		} catch (error) {
+			this.hosts.delete(childSessionId);
+			throw error;
+		}
+	}
+	/**
+	* The preset's plugin tools, for a member's `tools/list`.
+	* @param childSessionId - the member's child session.
+	* @param preset - the member's mode.
+	* @param cwd - the member's working directory.
+	* @returns the tools, empty when the host lacks the capabilities.
+	*/
+	async list(childSessionId, preset, cwd) {
+		const tools = this.probe("tools");
+		const fresh = this.hosts.get(childSessionId)?.preset !== preset;
+		const agent = await this.agentFor(childSessionId, preset, cwd);
+		if (tools === void 0 || agent === void 0) {
+			this.note({
+				childSessionId,
+				preset,
+				tools: tools !== void 0,
+				agent: agent !== void 0
+			});
+			return [];
+		}
+		let schemas = tools.schemas(agent);
+		if (fresh) for (let waited = 0; waited < SETTLE_MS; waited += SETTLE_STEP_MS) {
+			await new Promise((resolve) => setTimeout(resolve, SETTLE_STEP_MS));
+			const next = tools.schemas(agent);
+			if (next.length === schemas.length && waited >= 450) break;
+			schemas = next;
+		}
+		const listed = schemas.filter((schema) => isPluginTool(tools.get(schema.name, agent)));
+		this.note({
+			childSessionId,
+			preset,
+			agent: agent.id,
+			scope: schemas.map((schema) => {
+				const origin = tools.get(schema.name, agent)?.[ORIGIN];
+				return origin === void 0 ? schema.name : `${schema.name}<${String(origin.channel)}:${String(origin.owner)}>`;
+			}),
+			listed: listed.map((schema) => schema.name)
+		});
+		return listed.map((schema) => ({
+			name: schema.name,
+			description: schema.description ?? "",
+			inputSchema: schema.parameters ?? {
+				type: "object",
+				properties: {}
+			}
+		}));
+	}
+	/**
+	* Run one plugin tool for a member through the registry's execution
+	* pipeline (policies, approvals, timeouts), as the member's preset agent.
+	* @param childSessionId - the member's child session.
+	* @param preset - the member's mode.
+	* @param name - the tool name.
+	* @param args - the tool arguments.
+	* @param signal - cancellation.
+	* @param cwd - the member's working directory.
+	* @returns the MCP result.
+	*/
+	async call(childSessionId, preset, name, args, signal, cwd) {
+		const tools = this.probe("tools");
+		const agent = await this.agentFor(childSessionId, preset, cwd);
+		if (tools === void 0 || agent === void 0) return {
+			content: [{
+				type: "text",
+				text: "Mode tools are unavailable on this host"
+			}],
+			isError: true
+		};
+		if (!isPluginTool(tools.get(name, agent))) return {
+			content: [{
+				type: "text",
+				text: `Unknown tool ${name} in mode ${preset}`
+			}],
+			isError: true
+		};
+		const result = await tools.execute({
+			callId: `bridge-${randomUUID()}`,
+			name,
+			arguments: args,
+			agent,
+			signal
+		});
+		return {
+			content: mcpContent(result.content),
+			isError: result.isError
+		};
+	}
+	/**
+	* The skills the member's mode contributes: visible in its scope, absent
+	* from the global view (installed skills every CLI already sees stay out).
+	* @param childSessionId - the member's child session.
+	* @param preset - the member's mode.
+	* @returns the mode's skills with their content; empty without a skill registry.
+	*/
+	async skills(childSessionId, preset) {
+		const registry = this.probe("skills");
+		const agent = await this.agentFor(childSessionId, preset, void 0);
+		if (registry?.list === void 0 || agent === void 0) return [];
+		const global = new Set((await registry.list()).map((skill) => skill.name));
+		const own = (await registry.list({ scope: agent })).filter((skill) => !global.has(skill.name));
+		return (await Promise.all(own.map((skill) => registry.get(skill.name, { scope: agent })))).flatMap((skill) => skill === void 0 ? [] : [{
+			name: skill.name,
+			description: skill.description,
+			content: skill.content
+		}]);
+	}
+	/** Dispose every preset agent. */
+	async dispose() {
+		const hosts = [...this.hosts.values()];
+		this.hosts.clear();
+		await Promise.all(hosts.map((host) => host.agent.then((handle) => handle.dispose()).catch(() => {})));
+	}
+};
+//#endregion
 //#region lib/types/member-inbox.js
 /** Durable human input; the provider FIFO remains the sole execution order. */
 var MemberInbox = class {
@@ -2059,9 +2578,20 @@ var MemberControls = class {
 	adapter;
 	onError;
 	admitted = /* @__PURE__ */ new WeakMap();
+	/**
+	* Latest admitted configuration per child session id. Host 0.2.1 note: the
+	* activation manager wraps the provider's run, so a facade/tool caller never
+	* holds the exact object {@link admitted} keys — its run adapter names the
+	* child session id instead. Rounds of one child serialize through this
+	* class's queue, so the latest entry at read time is the reader's own round.
+	*/
+	admittedByChild = /* @__PURE__ */ new Map();
 	configurationOf(run) {
-		const configuration = this.admitted.get(run);
-		return configuration === void 0 ? void 0 : structuredClone(configuration);
+		const exact = this.admitted.get(run);
+		if (exact !== void 0) return structuredClone(exact);
+		const id = run.id;
+		const byChild = typeof id === "string" ? this.admittedByChild.get(id) : void 0;
+		return byChild === void 0 ? void 0 : structuredClone(byChild);
 	}
 	members = /* @__PURE__ */ new Map();
 	constructor(storage, adapter, onError) {
@@ -2176,6 +2706,7 @@ var MemberControls = class {
 			nativeStarted = true;
 			const run = await start(lease.configuration);
 			this.admitted.set(run, lease.configuration);
+			this.admittedByChild.set(binding.childSessionId, lease.configuration);
 			const release = () => {
 				try {
 					lease.release();
@@ -2394,6 +2925,99 @@ function delegationEnv(extra) {
 	};
 }
 //#endregion
+//#region lib/types/model-list.js
+/**
+* A harness's curated model list: `<scopedHome>/models.json` holds an
+* ORDERED array of model identifiers the user picked from the endpoint's
+* served catalog. The list's FIRST entry is the harness's default model —
+* it answers wherever the plugin-config `model` key answered before (round
+* resolution, the broker's settings layer, the eval snapshot's model
+* field), ahead of that key; an absent or empty list leaves the
+* pre-existing chain untouched (settings key → the scoped config file →
+* the CLI's own default). One store shape serves every harness in the
+* family (claude-code, codex, kimi): the file is keyed by the scoped home
+* alone, so a scope carries its own list exactly like its own endpoint
+* credential.
+*
+* Why a file and not the settings channel: the credential form's
+* endpoint-auth.json proved the pattern — the harness owns the store, the
+* volatile row-config channel rejects writes a deployment cannot explain,
+* and the file keeps every scope free to carry its own list. The settings
+* card edits the default scope's file through the gateway's
+* `modelList`/`configureModelList` Remotes; nothing here is secret (0600 is
+* for uniformity with the credential file, not necessity).
+* @module @khorsheed/dsh-local-agent/model-list
+*/
+/** The scoped-home model list file. */
+const MODEL_LIST_FILE = "models.json";
+/** Normalize one list: trimmed, blank-dropped, deduplicated keeping first occurrence. */
+function normalizeModelList(models) {
+	const out = [];
+	for (const candidate of models) {
+		if (typeof candidate !== "string") continue;
+		const trimmed = candidate.trim();
+		if (trimmed !== "" && !out.includes(trimmed)) out.push(trimmed);
+	}
+	return out;
+}
+/** Fold a parsed file payload into a list; any other shape reads as empty. */
+function fold(parsed) {
+	if (Array.isArray(parsed)) return normalizeModelList(parsed);
+	if (typeof parsed === "object" && parsed !== null && Array.isArray(parsed.models)) return normalizeModelList(parsed.models);
+	return [];
+}
+/**
+* Read the scope's model list. Absent, unreadable, or malformed content all
+* read as an empty list — the fallback chain then decides, exactly as
+* before the file existed.
+* @param homeDir - the harness's scoped home.
+* @returns the ordered model identifiers.
+*/
+async function readModelList(homeDir) {
+	try {
+		return fold(JSON.parse(await readFile(join(homeDir, MODEL_LIST_FILE), "utf8")));
+	} catch {
+		return [];
+	}
+}
+/**
+* The sync twin of {@link readModelList} for the per-round model resolver —
+* one small file read per resolution, no caching, so a card write always
+* reaches the very next round.
+* @param homeDir - the scope's scoped home.
+* @returns the ordered model identifiers.
+*/
+function readModelListSync(homeDir) {
+	try {
+		return fold(JSON.parse(readFileSync(join(homeDir, MODEL_LIST_FILE), "utf8")));
+	} catch {
+		return [];
+	}
+}
+/** The list's default model: its first entry, or undefined when empty. */
+function firstModelOf(models) {
+	return models.length === 0 ? void 0 : models[0];
+}
+/**
+* Persist the scope's model list (normalized; an empty list DELETES the
+* file rather than shadowing the fallback chain with nothing). Answers the
+* normalized list as written, so the writer can flip its surface without a
+* re-read.
+* @param homeDir - the scope's scoped home.
+* @param models - the new ordered list.
+* @returns the normalized list.
+*/
+async function writeModelList(homeDir, models) {
+	const normalized = normalizeModelList(models);
+	if (normalized.length === 0) {
+		await rm(join(homeDir, MODEL_LIST_FILE), { force: true });
+		return [];
+	}
+	await mkdir(homeDir, { recursive: true });
+	await writeFile(join(homeDir, MODEL_LIST_FILE), JSON.stringify({ models: normalized }, void 0, 2) + "\n", { mode: 384 });
+	return normalized;
+}
+//#endregion
 //#region lib/types/live-flush.js
 /** Maximum batching delay for a live mirror; independent of persistence cadence. */
 const LIVE_FLUSH_INTERVAL_MS = 50;
@@ -2553,6 +3177,8 @@ var LiveStreamPublisher = class {
 	persist;
 	onError;
 	states = /* @__PURE__ */ new Map();
+	/** Items shown live but not yet in the log: their step cannot open before the earlier steps close. */
+	previews = /* @__PURE__ */ new Map();
 	constructor(streams, session, turn, persist, onError) {
 		this.streams = streams;
 		this.session = session;
@@ -2560,8 +3186,29 @@ var LiveStreamPublisher = class {
 		this.persist = persist;
 		this.onError = onError;
 	}
+	/**
+	* Show an item live without writing it to the session: a step may open in
+	* the log only after every earlier step has closed, so a later item that
+	* streams first waits here (browser-only) until the driver can open it.
+	*/
+	preview(step, kind, text, options = {}) {
+		const id = `${this.turn}:${step}${options.itemId === void 0 ? "" : `:${options.itemId}`}`;
+		const previous = this.previews.get(id);
+		if (previous?.text === text && previous.kind === kind) return;
+		const item = {
+			id,
+			turn: this.turn,
+			step,
+			kind,
+			text,
+			receivedAt: previous?.receivedAt ?? options.receivedAt ?? Date.now()
+		};
+		this.previews.set(id, item);
+		this.streams.publish(String(this.session.id), item);
+	}
 	update(step, kind, text, options = {}) {
 		const id = `${this.turn}:${step}${options.itemId === void 0 ? "" : `:${options.itemId}`}`;
+		this.previews.delete(id);
 		let state = this.states.get(id);
 		if (state?.item.text === text && state.item.kind === kind) return;
 		const receivedAt = options.receivedAt ?? Date.now();
@@ -2620,6 +3267,11 @@ var LiveStreamPublisher = class {
 	}
 	/** Call only after the corresponding native final message has been appended. */
 	finish(step) {
+		for (const [id, item] of this.previews) {
+			if (item.step !== step) continue;
+			this.previews.delete(id);
+			this.streams.finish(String(this.session.id), id);
+		}
 		for (const [id, state] of this.states) {
 			if (state.item.step !== step) continue;
 			if (state.timer !== void 0) clearTimeout(state.timer);
@@ -2639,6 +3291,8 @@ var LiveStreamPublisher = class {
 	}
 	/** A producer failure keeps a durable partial, without claiming completion. */
 	dispose() {
+		for (const id of this.previews.keys()) this.streams.finish(String(this.session.id), id);
+		this.previews.clear();
 		for (const [id, state] of this.states) {
 			this.checkpoint(id);
 			if (state.timer !== void 0) clearTimeout(state.timer);
@@ -3094,12 +3748,49 @@ function delegationIntentKey(parentSessionId, provider) {
 * `cancel()` and the caller's own abort channel both reach the run.
 * `AbortSignal.any` is the harness's own fusion primitive (agent-loop's resume
 * uses it); either source aborts the run.
+*
+* Host 0.2.1 note: the fused signal reaches `startActivation`'s `spec.signal`,
+* which owns cancellation only up to publication — after the activation is
+* published the manager unlinks it and `dispose()` is the sole cancel channel.
+* {@link activationRun} therefore re-wires the caller signal to disposal.
 */
 function fusedSignal(controller, caller) {
 	if (caller === void 0) return controller.signal;
 	return AbortSignal.any([controller.signal, caller]);
 }
 /**
+* Adapt a 0.2.1 managed activation to the family's published `SubagentRun`
+* shape. The adapter's `id` is the dsh child session id — the family's
+* tracking key, resume handle, and client-facing identity — NOT the
+* activation's `childId`, which for an external (CLI) provider is the
+* provider's per-execution id and never names the mirrored live Session.
+* `dispose()` is the activation's exact-epoch cancellation: it settles the
+* result with an `aborted`-class stop reason and runs teardown, so a caller
+* signal aborted mid-run is re-wired to it (the start signal the facade fused
+* is unlinked by the manager at publication). The listener detaches when the
+* result settles, so a long-lived caller signal never accumulates them.
+*/
+function activationRun(activation, childSessionId, caller, warn) {
+	const dispose = () => activation.dispose();
+	if (caller !== void 0) {
+		const onAbort = () => {
+			dispose().catch((error) => {
+				warn(`localAgent: caller-signal disposal of ${childSessionId} failed: ${String(error)}`);
+			});
+		};
+		caller.addEventListener("abort", onAbort, { once: true });
+		const detach = () => {
+			caller.removeEventListener("abort", onAbort);
+		};
+		activation.result.then(detach, detach);
+	}
+	return {
+		id: SessionId(childSessionId),
+		result: activation.result,
+		dispose
+	};
+}
+/**
 * The per-harness append-only delegation-mapping log inside the harness's
 * scoped home (`<homeDir>/<harness>/delegations.jsonl`): one JSON record per
 * line, the last line per childSessionId wins — the same replace semantics as
@@ -3259,6 +3950,11 @@ function parseScopeFlag(input) {
 		...scope === void 0 ? {} : { scope }
 	};
 }
+/** A delegation record without its requested model. */
+function withoutModel(record) {
+	const { model: _model, ...rest } = record;
+	return rest;
+}
 /** Map a login failure to a command error, naming the swallowed signal. */
 function loginFailure(harness, exitCode, signal) {
 	return `${harness.name} login exited with ${signal ?? `code ${exitCode ?? "unknown"}`}; try /${harness.name} login again.`;
@@ -3428,9 +4124,9 @@ var LocalAgentRegistry = class {
 	/**
 	* Per-(parent session, provider) FIFO of delegation intents. The family
 	* resume tool stages exactly one intent per call before awaiting
-	* `ctx.subagents.start()`, and the owning provider consumes exactly one per
-	* start, so fresh and resume rounds stay paired even under parallel
-	* delegations from one parent.
+	* `ctx.subagents.startActivation()`, and the owning provider consumes
+	* exactly one per start, so fresh and resume rounds stay paired even under
+	* parallel delegations from one parent.
 	*/
 	delegationIntents = /* @__PURE__ */ new Map();
 	/**
@@ -3483,10 +4179,12 @@ var LocalAgentRegistry = class {
 	* - **facade-tracked** ({@link trackRun}): runs started through
 	*   {@link LocalAgentRegistry.start} / {@link LocalAgentRegistry.resume},
 	*   carrying the fused AbortController whose signal reached
-	*   `ctx.subagents.start`; cancel aborts it.
+	*   `ctx.subagents.startActivation`; cancel aborts the pre-publication
+	*   signal and disposes the published activation.
 	* - **tool-registered** ({@link trackDelegationRun}): runs the family tool
-	*   starts directly through `ctx.subagents.start`, carrying an explicit
-	*   cancel lever (its fused controller); cancel calls it.
+	*   starts directly through `ctx.subagents.startActivation`, carrying an
+	*   explicit cancel lever (its fused controller plus the activation's
+	*   dispose); cancel calls it.
 	*
 	* Every entry clears itself when the run's result settles (any stop
 	* reason), and facade entries also stop their heartbeat timer then.
@@ -3863,7 +4561,8 @@ var LocalAgentRegistry = class {
 	recordDelegation(record) {
 		const binding = this.memberControls.binding(record.childSessionId);
 		if (binding !== void 0) record = {
-			...record,
+			...withoutModel(record),
+			...binding.model === void 0 ? {} : { model: binding.model },
 			...binding.effort === void 0 ? {} : { effort: binding.effort },
 			...binding.configurationLock === void 0 ? {} : { configurationLock: binding.configurationLock }
 		};
@@ -3899,9 +4598,10 @@ var LocalAgentRegistry = class {
 	/**
 	* Stage one delegation intent for a provider's next `start()`. The family
 	* resume tool stages exactly one intent per call before awaiting
-	* `ctx.subagents.start()`; the provider consumes exactly one per start via
-	* {@link takeDelegationIntent}, so the per-(parent, provider) FIFO pairs
-	* fresh and resume rounds even under parallel delegations from one parent.
+	* `ctx.subagents.startActivation()`; the provider consumes exactly one per
+	* start via {@link takeDelegationIntent}, so the per-(parent, provider)
+	* FIFO pairs fresh and resume rounds even under parallel delegations from
+	* one parent.
 	* @param parentSessionId - the delegating parent session id.
 	* @param provider - the `ctx.subagents` provider name.
 	* @param intent - the fresh or resume intent for the next start.
@@ -3933,7 +4633,7 @@ var LocalAgentRegistry = class {
 	}
 	/**
 	* Remove one previously staged intent by reference, returning whether it was
-	* still queued. The delegation facade calls this when `ctx.subagents.start()`
+	* still queued. The delegation facade calls this when `ctx.subagents.startActivation()`
 	* throws: an intent the provider never consumed must not linger in the FIFO,
 	* where the NEXT same-(parent, provider) start would misconsume it as its own
 	* (orphan-intent crosstalk). When the provider already consumed the intent
@@ -3956,9 +4656,7 @@ var LocalAgentRegistry = class {
 		return true;
 	}
 	/**
-	* Every recorded delegation, in recording order. The invariant companion
-	* cross-checks each record's provider against the mounted subagent
-	* providers so a provider rename cannot leave a stale resume mapping.
+	* Every recorded delegation, in recording order.
 	* @returns the recorded delegations.
 	*/
 	listDelegations() {
@@ -4276,7 +4974,9 @@ var LocalAgentRegistry = class {
 	* {@link unstageDelegationIntent} (a no-op once the provider consumed it).
 	*
 	* The returned run is tracked under its `run.id` (== the new dsh child
-	* session id) until `run.result` settles; {@link cancel} aborts it by that
+	* session id, minted here and carried to the provider through the staged
+	* intent — host 0.2.1's `startActivation` never surfaces it on the
+	* activation) until `run.result` settles; {@link cancel} aborts it by that
 	* id. Note on trust: cordis plugins share one process, so the ownership
 	* checks here and in {@link resume} guard against caller MISTAKES, not
 	* against a malicious plugin — their real protection target is untrusted
@@ -4314,10 +5014,12 @@ var LocalAgentRegistry = class {
 		const subagents = this.requireSubagents();
 		this.requireProvider(subagents, provider);
 		const parent = this.requireLiveParent(parentSessionId);
+		const childSessionId = prepared?.binding.childSessionId ?? randomUUID();
 		const intent = {
 			kind: "fresh",
 			...options?.onAdmitted === void 0 ? {} : { onAdmitted: options.onAdmitted },
 			...options?.preparedMemberId === void 0 ? {} : { preparedMemberId: options.preparedMemberId },
+			...prepared === void 0 ? { childSessionId } : {},
 			...options?.cwd === void 0 ? {} : { cwd: options.cwd },
 			...options?.exec === void 0 ? {} : { exec: options.exec },
 			...options?.scope === void 0 ? {} : { scope: options.scope },
@@ -4329,17 +5031,21 @@ var LocalAgentRegistry = class {
 		const controller = new AbortController();
 		let run;
 		try {
-			run = await subagents.start(provider, {
-				prompt,
-				parent,
+			run = activationRun(await subagents.startActivation({
+				provider,
+				label: options?.label ?? "",
+				request: {
+					prompt,
+					parent
+				},
 				signal: fusedSignal(controller, options?.signal),
-				...options?.label === void 0 ? {} : { label: options.label }
-			});
+				delivery: "caller"
+			}), childSessionId, options?.signal, (message) => this.ctx.logger.warn(message));
 		} catch (error) {
 			this.unstageDelegationIntent(parentSessionId, provider, intent);
 			throw error;
 		}
-		this.trackRun(run.id, controller, run, options?.onProgress);
+		this.trackRun(childSessionId, controller, run, options?.onProgress);
 		if (prepared !== void 0) try {
 			this.preparedMembers.write({
 				...prepared,
@@ -4363,12 +5069,12 @@ var LocalAgentRegistry = class {
 	*    without staging; the provider still takes the authoritative lock inside
 	*    its `start()`;
 	* 4. live parent agent resolution (`ctx.agents.get`) — a harness hard
-	*    constraint, since `ctx.subagents.start` requires a live parent;
+	*    constraint, since `ctx.subagents.startActivation` requires a live parent;
 	* 5. child-session REATTACH when `ctx.sessions.get(childSessionId)` is
 	*    undefined (recipe below; `opts.reattach === false` disables this step
 	*    and fails loud on a non-live child instead);
 	* 6. stage `{ kind: 'resume', childSessionId, cliSessionId }` and, in the
-	*    same synchronous flow, `await ctx.subagents.start(provider, …)`;
+	*    same synchronous flow, `await ctx.subagents.startActivation({…})`;
 	* 7. on start failure, roll the intent back via
 	*    {@link unstageDelegationIntent} (no-op once consumed);
 	* 8. on success, track the run under `childSessionId` for {@link cancel}
@@ -4381,8 +5087,12 @@ var LocalAgentRegistry = class {
 	* const handle = await ctx.sessionPersistence.open(SessionId(childSessionId), 'write')
 	* try {
 	*   const cold = await handle.read(0)
+	*   // Close a turn a restart interrupted, or the next round's turn/start
+	*   // makes the stored log unreadable.
+	*   const closers = interruptedTurnClosers(cold.events)
+	*   if (closers.length > 0) await handle.append(closers)
 	*   const session = ctx.sessions.prepare(SessionId(childSessionId), {
-	*     seed: [...cold.events],
+	*     seed: [...cold.events, ...closers],
 	*     meta: structuredClone(handle.header),
 	*     inheritedEventCount: handle.inheritedEventCount,
 	*     eventState: cold.eventState,
@@ -4390,7 +5100,7 @@ var LocalAgentRegistry = class {
 	*   // The seeded constructor's session/end-seed marker lands before enter()
 	*   // installs publication hooks — push the unstored suffix through the
 	*   // handle directly, or the writer's contiguous cursor diverges.
-	*   const unstored = session.snapshotEvents().slice(cold.events.length)
+	*   const unstored = session.snapshotEvents().slice(cold.events.length + closers.length)
 	*   if (unstored.length > 0) await handle.append(unstored)
 	*   const detach = ctx.sessions.enter(session)
 	*   try { ctx.sessions.announce(session) }
@@ -4448,12 +5158,16 @@ var LocalAgentRegistry = class {
 		const controller = new AbortController();
 		let run;
 		try {
-			run = await subagents.start(provider, {
-				prompt,
-				parent,
+			run = activationRun(await subagents.startActivation({
+				provider,
+				label: options?.label ?? "",
+				request: {
+					prompt,
+					parent
+				},
 				signal: fusedSignal(controller, options?.signal),
-				...options?.label === void 0 ? {} : { label: options.label }
-			});
+				delivery: "caller"
+			}), childSessionId, options?.signal, (message) => this.ctx.logger.warn(message));
 		} catch (error) {
 			this.unstageDelegationIntent(parentSessionId, provider, intent);
 			throw error;
@@ -4462,11 +5176,12 @@ var LocalAgentRegistry = class {
 		return run;
 	}
 	/**
-	* Cancel an in-flight facade-started run by its dsh child session id: aborts
-	* the internal controller whose (fused) signal was passed to
-	* `ctx.subagents.start`, which is the canonical cancellation channel for a
-	* one-shot run. The provider settles the run with an `aborted`-class stop
-	* reason. A caller holding the `SubagentRun` may also `run.dispose()`.
+	* Cancel an in-flight facade-started run by its dsh child session id:
+	* aborts the internal controller (the pre-publication channel fused into
+	* the activation's start signal) and disposes the activation — host 0.2.1's
+	* canonical POST-publication cancellation, which settles the run with an
+	* `aborted`-class stop reason. A caller holding the `SubagentRun` may also
+	* `run.dispose()`.
 	* @param childSessionId - the dsh child session id of the run to cancel.
 	* @returns whether an in-flight run was found and signalled (false on a
 	*   miss — never a silent success, never a throw).
@@ -4474,24 +5189,29 @@ var LocalAgentRegistry = class {
 	cancel(childSessionId) {
 		const entry = this.runs.get(childSessionId);
 		if (entry === void 0) return this.memberInbox.cancelStarting(childSessionId);
-		if (entry.controller !== void 0) entry.controller.abort();
-		else entry.cancel?.();
+		if (entry.controller !== void 0) {
+			entry.controller.abort();
+			entry.run.dispose().catch((error) => {
+				this.ctx.logger.warn(`localAgent: cancel disposal of ${childSessionId} failed: ${String(error)}`);
+			});
+		} else entry.cancel?.();
 		return true;
 	}
 	/**
 	* Register a NON-facade in-flight delegation run with the active-delegation
 	* registry, keyed by the dsh child session id, so the `/local-agent stop`
 	* command and {@link cancel} can reach it. This is the family TOOL's entry
-	* point: the tool starts its runs through `ctx.subagents.start` directly
-	* (not the facade), so without this registration its in-flight runs would
-	* be invisible to the stop command. The caller owns the cancel lever — a
-	* controller fused with the run's request signal, aborted exactly like the
-	* facade's tracked controller. The entry clears itself when the run's
-	* result settles (any stop reason); an existing facade entry for the same
-	* child session wins (it already owns cancellation and progress).
-	* @param childSessionId - the dsh child session id (the run id).
-	* @param run - the published subagent run.
-	* @param cancel - the lever that aborts the run's request signal.
+	* point: the tool starts its runs through `ctx.subagents.startActivation`
+	* directly (not the facade), so without this registration its in-flight
+	* runs would be invisible to the stop command. The caller owns the cancel
+	* lever — aborting the fused controller (pre-publication) and disposing the
+	* activation (post-publication), the same channels the facade drives. The
+	* entry clears itself when the run's result settles (any stop reason); an
+	* existing facade entry for the same child session wins (it already owns
+	* cancellation and progress).
+	* @param childSessionId - the dsh child session id.
+	* @param run - the published subagent run (the tool's activation adapter).
+	* @param cancel - the lever that cancels the run.
 	*/
 	trackDelegationRun(childSessionId, run, cancel) {
 		if (this.runs.has(childSessionId)) return;
@@ -4581,7 +5301,7 @@ var LocalAgentRegistry = class {
 	* from persistence when it is not — a host restart evicts every child from
 	* the live store. This is the public entry of the facade resume's reattach
 	* recipe for callers that start resume rounds WITHOUT the facade (the
-	* family subagent tool starts runs directly through `ctx.subagents.start`;
+	* family subagent tool starts runs directly through `ctx.subagents.startActivation`;
 	* without this call the provider refuses the resume as "not live").
 	* Idempotent; a child that was never persisted fails through the
 	* persistence layer's own not-found error.
@@ -4608,13 +5328,16 @@ var LocalAgentRegistry = class {
 		const handle = await this.acquireChildWriteHandle(childSessionId);
 		try {
 			const cold = await handle.read(0);
+			const closeOpenTurn = sessionModule.interruptedTurnClosers;
+			const closers = closeOpenTurn === void 0 ? [] : closeOpenTurn(cold.events);
+			if (closers.length > 0) await handle.append(closers);
 			const session = sessions.prepare(SessionId(childSessionId), {
-				seed: [...cold.events],
+				seed: [...cold.events, ...closers],
 				meta: structuredClone(handle.header),
 				inheritedEventCount: handle.inheritedEventCount,
 				eventState: cold.eventState
 			});
-			const unstored = session.snapshotEvents().slice(cold.events.length);
+			const unstored = session.snapshotEvents().slice(cold.events.length + closers.length);
 			if (unstored.length > 0) await handle.append(unstored);
 			const detach = sessions.enter(session);
 			try {
@@ -4644,18 +5367,41 @@ var LocalAgentRegistry = class {
 	* @param session - the live child session to sync.
 	*/
 	async syncChildSession(session, strict = false) {
+		const id = String(session.id);
 		try {
-			const handle = await this.acquireChildWriteHandle(String(session.id), session.header);
-			const stored = await handle.read(0);
-			const suffix = session.snapshotEvents().slice(stored.events.length);
-			if (suffix.length > 0) await handle.append(suffix);
-			await handle.flush();
+			try {
+				await this.syncChildSessionOnce(session);
+			} catch (error) {
+				if (!/append seq mismatch/.test(error instanceof Error ? error.message : String(error))) throw error;
+				await this.releaseChildWriteHandle(id);
+				await this.syncChildSessionOnce(session);
+			}
 		} catch (error) {
 			if (strict) throw error;
-			this.ctx.logger.warn(`localAgent: syncing child session ${String(session.id)} to persistence failed: ${error instanceof Error ? error.message : String(error)}`);
+			this.ctx.logger.warn(`localAgent: syncing child session ${id} to persistence failed: ${error instanceof Error ? error.message : String(error)}`);
 		}
 	}
 	/**
+	* One sync pass. While the write handle is open the host routes every live
+	* append into the writer's buffer, so the routed events are drained first
+	* (`sessions.flush`: drain + flush) and only what is STILL missing — events
+	* from before the handle opened, or a host that routes nothing — goes in
+	* explicitly, bounded to the events that existed before the drain. Appending
+	* routed-but-undrained events explicitly as well would land them twice: the
+	* explicit write wins, the buffered copy then fails contiguity forever, and
+	* every later flush — the host's tool-execution checkpoint included —
+	* throws "append seq mismatch".
+	*/
+	async syncChildSessionOnce(session) {
+		const handle = await this.acquireChildWriteHandle(String(session.id), session.header);
+		const known = session.snapshotEvents().length;
+		await this.ctx.get("sessions")?.flush(session);
+		const stored = await handle.read(0);
+		const missing = session.snapshotEvents().slice(stored.events.length, known);
+		if (missing.length > 0) await handle.append(missing);
+		await handle.flush();
+	}
+	/**
 	* Get or open the child session's registry-owned WRITE handle (the
 	* {@link childWriteHandles} cache). When the caller carries the session
 	* header (a sync), a missing stored session is created from it; a create
@@ -5247,10 +5993,29 @@ async function apply(ctx, config) {
 	const registry = new LocalAgentRegistry(ctx, config.homesRoot, config.loginPromptTimeoutMs ?? 1e4);
 	ctx.provide(LOCAL_AGENT_SERVICE, registry);
 	new LocalAgentGateway(ctx);
-	const memberChannel = new MemberChannel(ctx, registry, registry.memberBridgeSocketPath());
+	const modeTools = new PresetToolHost(ctx, join(config.homesRoot, "mode-tools.jsonl"));
+	const memberChannel = new MemberChannel(ctx, registry, registry.memberBridgeSocketPath(), modeTools);
 	memberChannel.start();
+	ctx.on("approval/request", async (request, next) => {
+		const child = modeTools.memberOf(request.agent);
+		const delegation = child === void 0 ? void 0 : registry.getDelegation(child);
+		const room = ctx.get.call(ctx, "room");
+		if (child === void 0 || delegation === void 0 || room?.askMemberApproval === void 0) return next();
+		const reason = request.displayReason ?? request.reason;
+		const outcome = await room.askMemberApproval({
+			childSessionId: child,
+			parentSessionId: delegation.parentSessionId,
+			provider: delegation.provider
+		}, {
+			toolName: request.toolName,
+			...reason === void 0 ? {} : { reason },
+			...request.signal === void 0 ? {} : { signal: request.signal }
+		});
+		return outcome === "unavailable" ? next() : outcome;
+	}, { prepend: true });
 	ctx.effect(() => () => {
 		memberChannel.dispose();
+		modeTools.dispose();
 	});
 	ctx.commands.register({
 		name: "local-agent",
@@ -5278,4 +6043,4 @@ async function apply(ctx, config) {
 	});
 }
 //#endregion
-export { CLI_VERSION_FAILURE_TTL_MS, CLI_VERSION_PROBE_TIMEOUT_MS, Config, DELEGATIONS_FILENAME, FileMemberControlStorage, LIVE_CHECKPOINT_INTERVAL_MS, LIVE_FLUSH_INTERVAL_MS, LOCAL_AGENT_SERVICE, LiveFlush, LiveStreamPublisher, LocalAgentRegistry, LocalAgentStreams, MANUAL_LOGIN_LIMIT_MS, MANUAL_LOGIN_POLL_MS, MEMBER_BRIDGE_SOCKET_FILENAME, MemberConfigurationController, ModelDirectoryCache, REPLACE_LOGIN_GRACE_MS, RUN_PROGRESS_HEARTBEAT_MS, RUN_PROGRESS_SETTLE_GRACE_MS, SCOPE_NAME_RE, apply, assertModelExecOnly, assertResumeCwdUnchanged, assertResumeScopeUnchanged, assertScopeExecOnly, clearCliVersionCache, containerExecSpawn, containerScopedHome, delegationEnv, establishSubagentCatalogChild, extendModelDirectory, inject, modelDirectoryContextKey, name, parseCliVersion, parseScopeFlag, persistChildSession, probeCliVersion, resolveChildCwd, resolveRoundModel, scopedHomeName, settingsFace, stripAnsi, subagentDelegationLabel, vol };
+export { CLI_VERSION_FAILURE_TTL_MS, CLI_VERSION_PROBE_TIMEOUT_MS, Config, DELEGATIONS_FILENAME, FileMemberControlStorage, LIVE_CHECKPOINT_INTERVAL_MS, LIVE_FLUSH_INTERVAL_MS, LOCAL_AGENT_SERVICE, LiveFlush, LiveStreamPublisher, LocalAgentRegistry, LocalAgentStreams, MANUAL_LOGIN_LIMIT_MS, MANUAL_LOGIN_POLL_MS, MEMBER_BRIDGE_SOCKET_FILENAME, MODEL_LIST_FILE, MemberConfigurationController, ModelDirectoryCache, REPLACE_LOGIN_GRACE_MS, RUN_PROGRESS_HEARTBEAT_MS, RUN_PROGRESS_SETTLE_GRACE_MS, SCOPE_NAME_RE, apply, assertModelExecOnly, assertResumeCwdUnchanged, assertResumeScopeUnchanged, assertScopeExecOnly, clearCliVersionCache, containerExecSpawn, containerScopedHome, delegationEnv, establishSubagentCatalogChild, extendModelDirectory, firstModelOf, inject, modelDirectoryContextKey, name, normalizeModelList, parseCliVersion, parseScopeFlag, persistChildSession, probeCliVersion, readModelList, readModelListSync, resolveChildCwd, resolveRoundModel, scopedHomeName, settingsFace, stripAnsi, subagentDelegationLabel, vol, writeModelList };