@linxin666/dsh-client-ui-task-board 0.4.1 → 0.4.3

package/lib/index.js

@@ -1,4 +1,3 @@
-import { createRequire } from "node:module";
 import z from "@deepseek-ai/schemastery";
 import { spawn, spawnSync } from "node:child_process";
 import { createHash, timingSafeEqual } from "node:crypto";
@@ -6,7 +5,8 @@ import { chmodSync, closeSync, existsSync, fsyncSync, mkdirSync, openSync, readF
 import { dirname, isAbsolute, join, win32 } from "node:path";
 import { homedir } from "node:os";
 import { isAbsolute as isAbsolute$1, join as join$1 } from "node:path/posix";
-import { Context, Service } from "@deepseek-ai/cordis";
+import { createUserMessage } from "@deepseek-ai/dsh-llm";
+import { defineTool } from "@deepseek-ai/dsh-tools";
 //#region src/core/schedule.ts
 /** Inclusive ranges per field, in cron order. */
 const FIELD_RANGES = [
@@ -368,6 +368,7 @@ function createTask(input, now, id) {
 		title: input.title.trim(),
 		description: input.description.trim(),
 		prompt: input.prompt.trim(),
+		parentId: normalizeTargetId(input.parentId),
 		status: "todo",
 		createdAt: now,
 		updatedAt: now,
@@ -377,6 +378,7 @@ function createTask(input, now, id) {
 		permission: isTaskPermission(input.permission) ? input.permission : void 0,
 		model: normalizeTargetId(input.model),
 		reuseSession: input.reuseSession === true ? true : void 0,
+		teamRun: input.teamRun === true ? true : void 0,
 		...input.freeze === void 0 ? {} : { freeze: freezeOf(input.freeze, now) },
 		...input.handover === void 0 ? {} : { handover: {
 			...input.handover,
@@ -420,8 +422,10 @@ function withSchedule(task, patch, now) {
 /**
 * Open a fresh execution on a task: move it to 'running' and append a
 * running execution record. Returns the new task and the new execution.
+* @param runGroupId - cascade run group, when this run also opened executions
+*   for the task's subtasks (see `core/subtask.ts`).
 */
-function startExecution(task, now, executionId, initiatedBy) {
+function startExecution(task, now, executionId, initiatedBy, runGroupId) {
 	const execution = {
 		id: executionId,
 		sessionId: void 0,
@@ -429,6 +433,7 @@ function startExecution(task, now, executionId, initiatedBy) {
 		endedAt: void 0,
 		result: void 0,
 		error: void 0,
+		...runGroupId === void 0 || runGroupId === "" ? {} : { runGroupId },
 		...initiatedBy === void 0 || initiatedBy === "" ? {} : { initiatedBy },
 		...task.freeze === void 0 ? {} : {
 			frozenAt: task.freeze.frozenAt,
@@ -471,6 +476,234 @@ function settleExecution(task, executionId, outcome, now, error) {
 		executions
 	};
 }
+/**
+* Clamp a configured depth into the supported range. Anything unusable
+* (absent, non-numeric, not finite) falls back to the default, so a bad
+* configuration narrows the tree instead of lifting the guard.
+*/
+function normalizeSubtaskDepth(value) {
+	if (typeof value !== "number" || !Number.isFinite(value)) return 1;
+	const depth = Math.trunc(value);
+	if (depth < 1) return 1;
+	if (depth > 3) return 3;
+	return depth;
+}
+/** Whether an unknown value is a settled execution outcome. */
+function isExecutionOutcome(value) {
+	return value === "succeeded" || value === "failed" || value === "cancelled";
+}
+function indexOf(tasks) {
+	return new Map(tasks.map((task) => [task.id, task]));
+}
+/**
+* Nearest-first ancestor chain of a task. The walk is cycle-safe and bounded
+* by the ledger size rather than by the deployment maximum: a chain stored
+* under a larger limit survives that limit being lowered, and restore and
+* inheritance must still see all of it.
+*/
+function ancestorChain(tasks, task) {
+	const index = indexOf(tasks);
+	const chain = [];
+	const seen = /* @__PURE__ */ new Set([task.id]);
+	let current = task.parentId === void 0 ? void 0 : index.get(task.parentId);
+	while (current !== void 0 && chain.length < tasks.length) {
+		if (seen.has(current.id)) break;
+		seen.add(current.id);
+		chain.push(current);
+		current = current.parentId === void 0 ? void 0 : index.get(current.parentId);
+	}
+	return chain;
+}
+/** Root-to-task depth: a root task is 0, its subtask 1, and so on. */
+function taskDepth(tasks, id) {
+	const task = indexOf(tasks).get(id);
+	return task === void 0 ? 0 : ancestorChain(tasks, task).length;
+}
+/** Direct subtasks of a task, in ledger order. */
+function directSubtasks(tasks, id) {
+	return tasks.filter((task) => task.parentId === id);
+}
+/**
+* Descendants of a task in breadth-first order, bounded by maxSubtaskDepth
+* total depth. The visited set keeps a malformed ledger from looping.
+*/
+function descendantTasks(tasks, id, maxSubtaskDepth) {
+	const visited = /* @__PURE__ */ new Set([id]);
+	const found = [];
+	let frontier = [id];
+	for (let depth = 1; depth <= maxSubtaskDepth && frontier.length > 0; depth += 1) {
+		const next = [];
+		for (const parentId of frontier) for (const task of tasks) {
+			if (task.parentId !== parentId || visited.has(task.id)) continue;
+			visited.add(task.id);
+			found.push(task);
+			next.push(task.id);
+		}
+		frontier = next;
+	}
+	return found;
+}
+/**
+* Height of a task's own subtree (0 for a leaf), bounded by the hard maximum.
+* The visited set makes the walk terminate on a cyclic hand-edited ledger
+* instead of recursing until the stack overflows.
+*/
+function subtreeHeight(tasks, id, visited = /* @__PURE__ */ new Set()) {
+	if (visited.has(id)) return 0;
+	const seen = /* @__PURE__ */ new Set([...visited, id]);
+	const children = directSubtasks(tasks, id);
+	if (children.length === 0) return 0;
+	let height = 0;
+	for (const child of children) height = Math.max(height, 1 + subtreeHeight(tasks, child.id, seen));
+	return Math.min(height, 3);
+}
+/**
+* Whether childId may be attached under parentId. A null parent detaches and
+* is always allowed for a known task. Otherwise the link must name an
+* on-board task that is neither the child itself nor one of its descendants,
+* and the resulting depth (parent depth + 1 + the child own subtree height)
+* must stay within maxSubtaskDepth.
+*/
+function checkParentLink(tasks, childId, parentId, maxSubtaskDepth) {
+	if (tasks.find((task) => task.id === childId) === void 0) return {
+		ok: false,
+		reason: "unknown-task"
+	};
+	if (parentId === null || parentId === "") return { ok: true };
+	if (parentId === childId) return {
+		ok: false,
+		reason: "self-parent"
+	};
+	const parent = tasks.find((task) => task.id === parentId);
+	if (parent === void 0) return {
+		ok: false,
+		reason: "unknown-parent"
+	};
+	if (parent.archivedAt !== void 0) return {
+		ok: false,
+		reason: "archived-parent"
+	};
+	if (descendantTasks(tasks, childId, 3).some((task) => task.id === parentId)) return {
+		ok: false,
+		reason: "cycle"
+	};
+	if (taskDepth(tasks, parentId) + 1 + subtreeHeight(tasks, childId) > maxSubtaskDepth) return {
+		ok: false,
+		reason: "depth-exceeded"
+	};
+	return { ok: true };
+}
+/**
+* The tasks one run request opens executions for: the requested task first,
+* then its on-board descendants within the configured depth. Archived tasks
+* never run; a participant that already has an open execution is skipped by
+* the caller, which cannot start it twice.
+*/
+function cascadeTargets(tasks, rootId, maxSubtaskDepth) {
+	const root = tasks.find((task) => task.id === rootId);
+	if (root === void 0) return [];
+	return [root, ...descendantTasks(tasks, rootId, maxSubtaskDepth)];
+}
+/** The open execution of a task inside a run group, if it still exists. */
+function openGroupExecution(task, runGroupId) {
+	return task.executions.find((execution) => execution.runGroupId === runGroupId && execution.endedAt === void 0);
+}
+/**
+* The direct subtasks of parentTaskId whose execution in this run group is
+* still open: the parent remaining waiters. The parent may settle once this
+* list is empty and its own outcome is known.
+*/
+function pendingCascadeChildren(tasks, parentTaskId, runGroupId) {
+	const pending = [];
+	for (const task of tasks) {
+		if (task.parentId !== parentTaskId) continue;
+		const execution = openGroupExecution(task, runGroupId);
+		if (execution !== void 0) pending.push({
+			taskId: task.id,
+			execution
+		});
+	}
+	return pending;
+}
+/**
+* Fold a cascade parent own outcome and its children outcomes into one
+* verdict: failure dominates, then cancellation, then success. The error text
+* is the first failure, falling back to the first cancellation.
+*/
+function combineCascadeOutcome(entries) {
+	let result = "succeeded";
+	let error;
+	for (const entry of entries) {
+		if (entry.result === "failed") {
+			if (result !== "failed") error = void 0;
+			result = "failed";
+			if (error === void 0 && entry.error !== void 0 && entry.error !== "") error = entry.error;
+			continue;
+		}
+		if (entry.result === "cancelled") {
+			if (result === "succeeded") result = "cancelled";
+			if (error === void 0 && entry.error !== void 0 && entry.error !== "") error = entry.error;
+		}
+	}
+	return error === void 0 ? {
+		result,
+		error: void 0
+	} : {
+		result,
+		error
+	};
+}
+/**
+* The permission a task would actually run under: its handover bundle's pin
+* wins over the plain pin field, exactly as the runner resolves it.
+*/
+function effectiveTaskPermission(task) {
+	return task.handover?.permission ?? task.permission;
+}
+/**
+* Resolve the execution targets a (sub)task actually runs with: its own value
+* wins, and an unset target inherits the nearest ancestor up to the root.
+* Workspace, agent preset and model inherit the ancestor's PIN only — a
+* handover bundle is a per-card continuation artefact and is never inherited.
+* The permission inherits the ancestor's EFFECTIVE binding, and its human
+* confirmation travels with it, so a subtask of an already-confirmed elevated
+* card is runnable while a subtask's own unconfirmed binding stays gated.
+*/
+/**
+* The immutable teammate name for one team-mode member. Teammate names are
+* lower-kebab-case and must stay unique for the lifetime of the Team, so the
+* run-group token is appended: two runs of the same tree never collide. A title
+* with no ASCII word characters (a CJK title, for example) keeps a stable
+* generic prefix and is still distinguished by the token.
+* @param title - the member task's title.
+* @param token - the run group id (the task id when no group is recorded).
+* @returns the teammate name handed to the Agent Teams service.
+*/
+function teammateName(title, token) {
+	const slug = title.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 32).replace(/-+$/g, "");
+	const suffix = token.replace(/[^a-z0-9]/gi, "").slice(0, 8).toLowerCase();
+	return `${slug === "" ? "subtask" : slug}-${suffix === "" ? "run" : suffix}`;
+}
+function resolveExecutionTargets(task, tasks, maxSubtaskDepth = 3) {
+	if (task.parentId === void 0) return task;
+	const chain = [task, ...ancestorChain(tasks, task).slice(0, maxSubtaskDepth)];
+	const first = (key) => {
+		for (const candidate of chain) {
+			const value = candidate[key];
+			if (value !== void 0) return value;
+		}
+	};
+	const own = effectiveTaskPermission(task);
+	const owner = own === void 0 ? chain.slice(1).find((candidate) => effectiveTaskPermission(candidate) !== void 0) : void 0;
+	return {
+		...task,
+		workspaceId: first("workspaceId"),
+		mode: first("mode"),
+		model: first("model"),
+		permission: own ?? (owner === void 0 ? void 0 : effectiveTaskPermission(owner)),
+		permissionConfirmedAt: own === void 0 ? owner?.permissionConfirmedAt : task.permissionConfirmedAt
+	};
+}
 /** Marker replacing every sensitive match. */
 const REDACTED_MARKER = "[REDACTED]";
 const SECTION_ORDER$1 = [
@@ -672,6 +905,7 @@ function isTaskRecordShape(value) {
 	if (typeof record.prompt !== "string") return false;
 	if (typeof record.createdAt !== "number") return false;
 	if (typeof record.updatedAt !== "number") return false;
+	if (record.parentId !== void 0 && typeof record.parentId !== "string") return false;
 	if (record.workspaceId !== void 0 && typeof record.workspaceId !== "string") return false;
 	if (record.mode !== void 0 && typeof record.mode !== "string") return false;
 	if (record.permission !== void 0 && typeof record.permission !== "string") return false;
@@ -785,6 +1019,13 @@ function parseLedger(raw) {
 			status: normalizeStatus(row.status)
 		};
 		task.schedule = normalizeSchedule(row.schedule);
+		task.parentId = normalizeTargetId(row.parentId);
+		task.executions = task.executions.map((execution) => ({
+			...execution,
+			runGroupId: normalizeTargetId(execution.runGroupId),
+			ownResult: isExecutionOutcome(execution.ownResult) ? execution.ownResult : void 0,
+			ownError: typeof execution.ownError === "string" ? execution.ownError : void 0
+		}));
 		task.workspaceId = normalizeTargetId(row.workspaceId);
 		task.mode = normalizeTargetId(row.mode);
 		task.archivedAt = typeof row.archivedAt === "number" && Number.isFinite(row.archivedAt) ? row.archivedAt : void 0;
@@ -801,17 +1042,46 @@ function parseLedger(raw) {
 //#endregion
 //#region src/core/use-cases/task-archive.ts
 /**
-* Archive one task: only a `running` task stays on the board (its runner
-* still owns its lifecycle until the execution settles); every other status
-* can be archived. Archiving disarms a schedule; already-archived tasks are
-* a no-op.
+* Archive/restore task use case: move a task off the main board and back,
+* whatever its status but running. The task keeps its status, execution
+* history, and transcript references, while archiving disarms any schedule so
+* it cannot create more execution records until the user restores and
+* re-enables it.
+*
+* Subtask trees move as a unit: archiving takes the whole subtree (an on-board
+* subtask under an archived parent would be unreachable from its parent) and
+* refuses the whole group while any member is running. Restoring brings the
+* task, its ancestors and its subtree back together.
+*/
+/** The archive/restore id set: the task, its subtree, and (for restore) its ancestors. */
+function groupIds(tasks, id, maxSubtaskDepth, withAncestors) {
+	const target = tasks.find((task) => task.id === id);
+	const ids = /* @__PURE__ */ new Set([id]);
+	for (const task of descendantTasks(tasks, id, normalizeSubtaskDepth(maxSubtaskDepth))) ids.add(task.id);
+	if (withAncestors && target !== void 0) for (const ancestor of ancestorChain(tasks, target)) ids.add(ancestor.id);
+	return ids;
+}
+/**
+* Archive one task and its subtasks: only a running member keeps the group on
+* the board (its runner still owns its lifecycle until the execution settles);
+* any other status can be archived. Archiving disarms schedules; an
+* already-archived task is a no-op.
 */
-function applyArchiveTask(tasks, id, now) {
+function applyArchiveTask(tasks, id, now, maxSubtaskDepth = 1) {
+	const target = tasks.find((task) => task.id === id);
+	if (target === void 0 || target.archivedAt !== void 0) return {
+		tasks,
+		archived: false
+	};
+	const ids = groupIds(tasks, id, maxSubtaskDepth, false);
+	if (tasks.some((task) => ids.has(task.id) && !ARCHIVABLE_STATUSES.includes(task.status))) return {
+		tasks,
+		archived: false
+	};
 	let applied = false;
 	return {
 		tasks: tasks.map((task) => {
-			if (task.id !== id || task.archivedAt !== void 0) return task;
-			if (!ARCHIVABLE_STATUSES.includes(task.status)) return task;
+			if (!ids.has(task.id) || task.archivedAt !== void 0) return task;
 			applied = true;
 			const schedule = task.schedule === void 0 ? void 0 : {
 				...task.schedule,
@@ -828,12 +1098,21 @@ function applyArchiveTask(tasks, id, now) {
 		archived: applied
 	};
 }
-/** Restore one task back onto the main board (clears the archive marker). */
-function applyRestoreTask(tasks, id, now) {
+/**
+* Restore one task back onto the main board, together with its ancestors (an
+* on-board subtask must not point at an archived parent) and its subtasks.
+*/
+function applyRestoreTask(tasks, id, now, maxSubtaskDepth = 1) {
+	const target = tasks.find((task) => task.id === id);
+	if (target === void 0 || target.archivedAt === void 0) return {
+		tasks,
+		archived: false
+	};
+	const ids = groupIds(tasks, id, maxSubtaskDepth, true);
 	let applied = false;
 	return {
 		tasks: tasks.map((task) => {
-			if (task.id !== id || task.archivedAt === void 0) return task;
+			if (!ids.has(task.id) || task.archivedAt === void 0) return task;
 			applied = true;
 			const { archivedAt: _archived, ...rest } = task;
 			return {
@@ -848,23 +1127,57 @@ function applyRestoreTask(tasks, id, now) {
 //#region src/core/use-cases/task-create.ts
 /**
 * Create-task use case: mint a new task from user input, rejecting a blank
-* title. Pure ledger transition (no persistence or notify — the controller
-* orchestrates those), so it is unit-testable without any runtime face.
+* title and any parent link the lineage gate refuses. Pure ledger transition
+* (no persistence or notify - the controller orchestrates those), so it is
+* unit-testable without any runtime face.
 */
 /**
 * Apply a create against the current ledger. Returns the new task and the
-* appended ledger, or the unchanged ledger when the title is blank.
+* appended ledger, or the unchanged ledger when the title is blank or the
+* requested parent link is refused.
+*
+* A subtask inherits the execution targets its parent already pins (workspace,
+* agent preset, permission, model) unless the form supplied its own; the
+* parent human permission confirmation travels with an inherited permission,
+* so a subtask of an already-confirmed elevated card is runnable at once.
 * @param tasks - current ledger.
-* @param input - raw user input (title/description/prompt + optional schedule).
+* @param input - raw user input (title/description/prompt + optional schedule/parent).
 * @param now - clock instant (ms epoch).
 * @param id - minted task id.
+* @param maxSubtaskDepth - deployment subtask depth limit.
 */
-function applyCreateTask(tasks, input, now, id) {
+function applyCreateTask(tasks, input, now, id, maxSubtaskDepth = 1) {
 	if (input.title.trim() === "") return {
 		task: void 0,
-		tasks
+		tasks,
+		error: "title is required"
 	};
-	let task = createTask(input, now, id);
+	const limit = normalizeSubtaskDepth(maxSubtaskDepth);
+	let parent;
+	if (input.parentId !== void 0) {
+		parent = tasks.find((task) => task.id === input.parentId);
+		if (parent === void 0) return {
+			task: void 0,
+			tasks,
+			error: "parent task not found"
+		};
+		if (parent.archivedAt !== void 0) return {
+			task: void 0,
+			tasks,
+			error: "parent task is archived"
+		};
+		if (taskDepth(tasks, parent.id) + 1 > limit) return {
+			task: void 0,
+			tasks,
+			error: `subtask depth limit (${limit}) exceeded`
+		};
+	}
+	let task = createTask(parent === void 0 ? input : {
+		...input,
+		workspaceId: input.workspaceId ?? parent.workspaceId,
+		mode: input.mode ?? parent.mode,
+		model: input.model ?? parent.model
+	}, now, id);
 	const requested = input.schedule;
 	if (requested?.enabled === true && requested.cron.trim() !== "" && isValidCron(requested.cron)) {
 		const cron = requested.cron.trim();
@@ -889,9 +1202,15 @@ function applyCreateTask(tasks, input, now, id) {
 * @param id - the task to remove.
 */
 function applyDeleteTask(tasks, selectedTaskId, id) {
+	if (tasks.some((task) => task.parentId === id)) return {
+		tasks,
+		selectionCleared: false,
+		blocked: true
+	};
 	return {
 		tasks: tasks.filter((task) => task.id !== id),
-		selectionCleared: selectedTaskId === id
+		selectionCleared: selectedTaskId === id,
+		blocked: false
 	};
 }
 //#endregion
@@ -955,6 +1274,70 @@ function applyScheduleNextRun(tasks, id, nextRunAt, lastTriggeredAt, now) {
 	}, now) : task);
 }
 //#endregion
+//#region src/core/use-cases/task-parent.ts
+/**
+* Parent-link use case: attach an existing on-board task under another as a
+* subtask, or detach it back to the root. The lineage gate is the same one
+* creation uses (unknown or archived parent, self, cycle, depth), so the two
+* ways into the tree cannot disagree. Pure ledger transition.
+*/
+/** Host error text per refusal reason (the wire carries the same strings). */
+const REJECTION_TEXT = {
+	"unknown-task": "task not found",
+	"unknown-parent": "parent task not found",
+	"archived-parent": "parent task is archived",
+	"self-parent": "a task cannot be its own parent",
+	"cycle": "a task cannot be attached under its own subtask",
+	"depth-exceeded": "subtask depth limit exceeded"
+};
+/**
+* Attach or detach one task. A null (or blank) parent detaches, which is always
+* allowed for a known on-board task; attaching validates the whole chain so a
+* cyclic or too-deep ledger can never be stored.
+* @param tasks - current ledger.
+* @param id - the task being moved.
+* @param parentId - the new parent, or null to detach.
+* @param now - clock instant (ms epoch).
+* @param maxSubtaskDepth - deployment subtask depth limit.
+*/
+function applySetParent(tasks, id, parentId, now, maxSubtaskDepth = 1) {
+	const task = tasks.find((candidate) => candidate.id === id);
+	if (task === void 0) return {
+		tasks,
+		applied: false,
+		error: REJECTION_TEXT["unknown-task"]
+	};
+	if (task.archivedAt !== void 0) return {
+		tasks,
+		applied: false,
+		error: "archived task is read-only"
+	};
+	if (task.status === "running" || task.executions.some((execution) => execution.endedAt === void 0)) return {
+		tasks,
+		applied: false,
+		error: "running task cannot be re-parented"
+	};
+	const check = checkParentLink(tasks, id, parentId, normalizeSubtaskDepth(maxSubtaskDepth));
+	if (!check.ok) return {
+		tasks,
+		applied: false,
+		error: REJECTION_TEXT[check.reason ?? "unknown-task"]
+	};
+	const nextParentId = parentId === null || parentId === "" ? void 0 : parentId;
+	if (nextParentId === task.parentId) return {
+		tasks: [...tasks],
+		applied: true
+	};
+	return {
+		tasks: tasks.map((candidate) => candidate.id === id ? {
+			...candidate,
+			parentId: nextParentId,
+			updatedAt: now
+		} : candidate),
+		applied: true
+	};
+}
+//#endregion
 //#region src/core/use-cases/task-update.ts
 /**
 * Update-task use case: apply an editable-field patch (title/description/
@@ -1027,6 +1410,7 @@ function applyUpdateTask(tasks, id, patch, now) {
 		if ("tags" in patch) next.tags = tagsPatch == null ? void 0 : normalizeTags(tagsPatch);
 		if ("permission" in patch && patch.permission !== void 0 && patch.permission !== task.permission || "handover" in patch) next.permissionConfirmedAt = void 0;
 		if ("reuseSession" in patch) next.reuseSession = patch.reuseSession === true ? true : void 0;
+		if ("teamRun" in patch) next.teamRun = patch.teamRun === true ? true : void 0;
 		if (workspaceId !== void 0 || "workspaceId" in patch) next.workspaceId = workspaceId;
 		if (mode !== void 0 || "mode" in patch) next.mode = mode;
 		if (permission !== void 0 || "permission" in patch) next.permission = permission;
@@ -1130,6 +1514,7 @@ function importedTask(value) {
 			nextRunAt: task.schedule.nextRunAt,
 			lastTriggeredAt: task.schedule.lastTriggeredAt
 		} },
+		...task.parentId === void 0 ? {} : { parentId: task.parentId },
 		...task.workspaceId === void 0 ? {} : { workspaceId: task.workspaceId },
 		...task.mode === void 0 ? {} : { mode: task.mode },
 		...task.permission === void 0 ? {} : { permission: task.permission },
@@ -1170,6 +1555,7 @@ function createInput(value) {
 		"title",
 		"description",
 		"prompt",
+		"parentId",
 		"workspaceId",
 		"mode",
 		"permission",
@@ -1178,11 +1564,14 @@ function createInput(value) {
 		"handover",
 		"model",
 		"reuseSession",
+		"teamRun",
 		"tags"
 	])) return false;
+	if (input.parentId !== void 0 && (typeof input.parentId !== "string" || input.parentId.trim() === "")) return false;
 	if (typeof input.title !== "string" || typeof input.description !== "string" || typeof input.prompt !== "string") return false;
 	if (!optionalString(input.workspaceId) || !optionalString(input.mode) || !optionalString(input.model)) return false;
 	if (input.reuseSession !== void 0 && typeof input.reuseSession !== "boolean") return false;
+	if (input.teamRun !== void 0 && typeof input.teamRun !== "boolean") return false;
 	if (input.permission !== void 0 && !isTaskPermission(input.permission)) return false;
 	if (input.tags !== void 0 && !isTaskTagList(input.tags)) return false;
 	if (input.freeze !== void 0 && freezePayload(input.freeze) === void 0) return false;
@@ -1207,9 +1596,11 @@ function updatePatch(value) {
 		"handover",
 		"model",
 		"reuseSession",
+		"teamRun",
 		"tags"
 	])) return false;
 	if (patch.reuseSession !== void 0 && patch.reuseSession !== null && typeof patch.reuseSession !== "boolean") return false;
+	if (patch.teamRun !== void 0 && patch.teamRun !== null && typeof patch.teamRun !== "boolean") return false;
 	for (const key of [
 		"title",
 		"description",
@@ -1319,6 +1710,24 @@ function parseEnvelopeAction(value) {
 				}
 			};
 		}
+		case "set-parent": {
+			if (!exactKeys(action, [
+				"kind",
+				"taskId",
+				"parentId"
+			])) return void 0;
+			if (taskId === void 0) return void 0;
+			const parentId = action.parentId;
+			if (parentId !== null && (typeof parentId !== "string" || parentId.trim() === "")) return void 0;
+			return {
+				requestId: envelope.requestId,
+				action: {
+					kind: "set-parent",
+					taskId,
+					parentId
+				}
+			};
+		}
 		case "set-schedule":
 			if (!exactKeys(action, [
 				"kind",
@@ -1355,6 +1764,13 @@ function parseEnvelopeAction(value) {
 }
 //#endregion
 //#region src/host-ledger.ts
+/** Human-facing text for a refused binding, per surface. */
+function bindingRefusalMessage(refusal, sessionDefault, surface) {
+	if (refusal.kind === "subtask-pin") return `team run cannot honor the permission binding of subtask "${refusal.title}": a teammate runs inside the Lead session; clear that card's permission or run the tree without Agent Team`;
+	if (surface === "schedule") return `task "${refusal.title}" has an unconfirmed above-default permission`;
+	if (refusal.kind === "root") return `confirmation-required: the effective permission is above the session default (${sessionDefault}); confirm the card's permission binding first`;
+	return `confirmation-required: subtask "${refusal.title}" inherits an above-default permission; confirm that card's permission binding first`;
+}
 const MAX_REQUEST_CACHE = 256;
 function timeZone() {
 	return Intl.DateTimeFormat().resolvedOptions().timeZone || "local";
@@ -1580,6 +1996,37 @@ function mergeTask(a, b) {
 		executions: retainRecentExecutions(executions)
 	};
 }
+/**
+* Repair parent links after a load or an import: a link whose parent row is
+* missing, cyclic, or names an archived parent while the child is on board is
+* dropped (the task becomes a root) instead of dropping the task. A chain
+* deeper than the current `maxSubtaskDepth` is deliberately KEPT: the limit
+* gates new links, it never deletes a stored one, and every cascade walk is
+* bounded by the limit anyway. The Host is the only writer of these links, so
+* this is a last-resort guard against a hand-edited or imported document.
+*/
+function repairParentLinks(tasks) {
+	const byId = new Map(tasks.map((task) => [task.id, task]));
+	return tasks.map((task) => {
+		if (task.parentId === void 0) return task;
+		const seen = /* @__PURE__ */ new Set([task.id]);
+		let current = byId.get(task.parentId);
+		let depth = 0;
+		while (current !== void 0) {
+			if (seen.has(current.id) || depth === 0 && current.archivedAt !== void 0 && task.archivedAt === void 0) return {
+				...task,
+				parentId: void 0
+			};
+			seen.add(current.id);
+			depth += 1;
+			current = current.parentId === void 0 ? void 0 : byId.get(current.parentId);
+		}
+		return depth === 0 ? {
+			...task,
+			parentId: void 0
+		} : task;
+	});
+}
 function parseHostTasks(values) {
 	const rawById = /* @__PURE__ */ new Map();
 	for (const value of values) {
@@ -1587,7 +2034,7 @@ function parseHostTasks(values) {
 		const raw = value;
 		if (typeof raw.id === "string") rawById.set(raw.id, raw);
 	}
-	return parseLedger(JSON.stringify(values)).map((task) => {
+	return repairParentLinks(parseLedger(JSON.stringify(values))).map((task) => {
 		const rawSchedule = rawById.get(task.id)?.schedule;
 		if (typeof rawSchedule !== "object" || rawSchedule === null) return task;
 		const schedule = rawSchedule;
@@ -1616,9 +2063,16 @@ var HostTaskLedger = class {
 	schedulerFile;
 	/** Session-default permission the confirmation gate compares against. */
 	sessionDefaultPermission;
+	/**
+	* Deployment subtask depth limit (1..3): the lineage gate every write obeys.
+	* The settings card edits it live, so {@link setMaxSubtaskDepth} mutates it
+	* instead of remounting the row.
+	*/
+	depthLimit;
 	constructor(dir = join(dshHome(), "task-board"), now = Date.now, options = {}) {
 		this.now = now;
 		this.sessionDefaultPermission = options.sessionDefaultPermission ?? "read-only";
+		this.depthLimit = normalizeSubtaskDepth(options.maxSubtaskDepth ?? 1);
 		mkdirSync(dir, { recursive: true });
 		this.file = join(dir, "ledger-v2.json");
 		this.lockFile = join(dir, "ledger-v2.lock");
@@ -1636,6 +2090,21 @@ var HostTaskLedger = class {
 			throw error;
 		}
 	}
+	/** Current subtask depth limit (1..3). */
+	get maxSubtaskDepth() {
+		return this.depthLimit;
+	}
+	/**
+	* Apply a live settings edit of the subtask depth limit. A no-op when the
+	* normalized limit is unchanged, so a coarse volatile invalidation that
+	* changed nothing emits nothing.
+	*/
+	setMaxSubtaskDepth(depth) {
+		const next = normalizeSubtaskDepth(depth);
+		if (next === this.depthLimit) return;
+		this.depthLimit = next;
+		this.notify();
+	}
 	/** Remove leftover *.tmp-* files from previous crashes or interrupted writes. */
 	cleanStaleTemporaryFiles(dir) {
 		try {
@@ -1673,6 +2142,7 @@ var HostTaskLedger = class {
 			if (task.archivedAt === void 0 && task.schedule?.enabled === true) armedSchedules += 1;
 			for (const execution of task.executions) {
 				if (execution.endedAt !== void 0) continue;
+				if (execution.ownResult !== void 0) continue;
 				openExecutions.push({
 					taskId: task.id,
 					executionId: execution.id,
@@ -1692,6 +2162,25 @@ var HostTaskLedger = class {
 		for (const task of this.document.tasks) if (task.archivedAt === void 0 && task.schedule?.enabled === true) count += 1;
 		return count;
 	}
+	/**
+	* The earliest armed `nextRunAt` strictly after the supplied Host time, or
+	* undefined when no schedule is armed in the future. This is the instant the
+	* Host arms its native timer at, so the board wakes exactly when work is due
+	* instead of polling a fixed heartbeat.
+	* @param now - current Host time in ms epoch.
+	* @returns the nearest future trigger, or undefined when none is armed.
+	*/
+	nextArmedRunAt(now) {
+		let nearest;
+		for (const task of this.document.tasks) {
+			if (task.archivedAt !== void 0) continue;
+			const schedule = task.schedule;
+			if (schedule === void 0 || !schedule.enabled || schedule.nextRunAt === void 0) continue;
+			if (schedule.nextRunAt <= now) continue;
+			if (nearest === void 0 || schedule.nextRunAt < nearest) nearest = schedule.nextRunAt;
+		}
+		return nearest;
+	}
 	/** Return value-only references for schedules due at the supplied Host time. */
 	dueSchedules(now) {
 		const due = [];
@@ -1740,24 +2229,29 @@ var HostTaskLedger = class {
 			throw error;
 		}
 	}
+	/**
+	* Open the cascade one due schedule triggers: an empty array means nothing
+	* ran (already running, or a participant whose elevated permission is still
+	* unconfirmed), and the rule rolls to its next occurrence either way.
+	*/
 	openScheduled(taskId, nextRunAt, triggeredAt) {
 		const task = this.document.tasks.find((item) => item.id === taskId);
-		if (task === void 0 || task.archivedAt !== void 0) return void 0;
-		if (requiresPermissionConfirmation(task, this.sessionDefaultPermission)) {
+		if (task === void 0 || task.archivedAt !== void 0) return [];
+		const rollForward = () => {
 			this.document.tasks = [...applyScheduleNextRun(this.document.tasks, taskId, nextRunAt, task.schedule?.lastTriggeredAt, triggeredAt)];
 			this.commit();
-			return;
+		};
+		const refusal = this.bindingRefusal(task);
+		if (refusal !== void 0) {
+			this.document.scheduler.error = `scheduled run refused for task ${taskId}: ${bindingRefusalMessage(refusal, this.sessionDefaultPermission, "schedule")}`;
+			rollForward();
+			return [];
 		}
 		if (task.status === "running" || hasOpenExecution(task)) {
-			this.document.tasks = [...applyScheduleNextRun(this.document.tasks, taskId, nextRunAt, task.schedule?.lastTriggeredAt, triggeredAt)];
-			this.commit();
-			return;
+			rollForward();
+			return [];
 		}
-		const opened = startExecution(task, triggeredAt, crypto.randomUUID());
-		this.document.tasks = this.document.tasks.map((item) => item.id === taskId ? opened.task : item);
-		this.document.tasks = [...applyScheduleNextRun(this.document.tasks, taskId, nextRunAt, triggeredAt, triggeredAt)];
-		this.commit();
-		return opened;
+		return this.startCascade(task, triggeredAt, void 0, false, nextRunAt);
 	}
 	skipMissed(now) {
 		let changed = false;
@@ -1792,6 +2286,39 @@ var HostTaskLedger = class {
 		}
 		this.commit(false);
 	}
+	/**
+	* Settle one execution. A cascade participant first records its OWN outcome
+	* and only finalizes once every child execution in its run group has
+	* settled, so a parent card leaves 'running' with the whole tree's verdict
+	* rather than its own turn alone.
+	*/
+	settle(taskId, executionId, outcome, error) {
+		const now = this.now();
+		const task = this.document.tasks.find((item) => item.id === taskId);
+		const execution = task?.executions.find((entry) => entry.id === executionId);
+		if (task === void 0 || execution === void 0 || execution.endedAt !== void 0) return;
+		const groupId = execution.runGroupId;
+		if (groupId === void 0) {
+			this.document.tasks = this.document.tasks.map((item) => item.id === taskId ? settleExecution(item, executionId, outcome, now, error) : item);
+			this.commit();
+			return;
+		}
+		let changed = false;
+		if (execution.ownResult === void 0) {
+			this.document.tasks = this.document.tasks.map((item) => item.id !== taskId ? item : {
+				...item,
+				updatedAt: now,
+				executions: item.executions.map((entry) => entry.id === executionId ? {
+					...entry,
+					ownResult: outcome,
+					ownError: error
+				} : entry)
+			});
+			changed = true;
+		}
+		if (this.settleCascade(taskId, groupId, now)) changed = true;
+		if (changed) this.commit();
+	}
 	attachSession(taskId, executionId, sessionId) {
 		const now = this.now();
 		this.document.tasks = this.document.tasks.map((task) => task.id !== taskId ? task : {
@@ -1804,13 +2331,9 @@ var HostTaskLedger = class {
 		});
 		this.commit();
 	}
-	settle(taskId, executionId, outcome, error) {
-		this.document.tasks = this.document.tasks.map((task) => task.id === taskId ? settleExecution(task, executionId, outcome, this.now(), error) : task);
-		this.commit();
-	}
 	apply(action, initiator) {
 		const now = this.now();
-		let run;
+		let runs;
 		switch (action.kind) {
 			case "import": {
 				const sources = new Set(this.document.scheduler.importedSources ?? []);
@@ -1819,7 +2342,7 @@ var HostTaskLedger = class {
 				const incoming = parseHostTasks(action.tasks);
 				const merged = new Map(this.document.tasks.map((task) => [task.id, task]));
 				for (const task of incoming) merged.set(task.id, merged.has(task.id) ? mergeTask(merged.get(task.id), task) : task);
-				this.document.tasks = [...merged.values()];
+				this.document.tasks = repairParentLinks([...merged.values()]);
 				this.document.scheduler.importedSources = [...sources, action.sourceId];
 				this.document.scheduler.error = invalidScheduleIds.length === 0 ? void 0 : `invalid cron disabled for task(s): ${invalidScheduleIds.join(", ")}`;
 				this.repairSchedules(true, false);
@@ -1836,8 +2359,8 @@ var HostTaskLedger = class {
 						frozenBy: initiator
 					}
 				};
-				const result = applyCreateTask(this.document.tasks, input, now, action.id);
-				if (result.task === void 0) throw new Error("invalid task");
+				const result = applyCreateTask(this.document.tasks, input, now, action.id, this.maxSubtaskDepth);
+				if (result.task === void 0) throw new Error(result.error ?? "invalid task");
 				this.document.tasks = [...result.tasks];
 				break;
 			}
@@ -1857,14 +2380,20 @@ var HostTaskLedger = class {
 				this.document.tasks = [...applyUpdateTask(this.document.tasks, action.taskId, patch, now)];
 				break;
 			}
-			case "delete":
-				{
-					const task = this.document.tasks.find((task) => task.id === action.taskId);
-					if (task === void 0) throw new Error("task not found");
-					if (task.status === "running" || hasOpenExecution(task)) throw new Error("running task cannot be deleted");
-				}
+			case "delete": {
+				const task = this.document.tasks.find((task) => task.id === action.taskId);
+				if (task === void 0) throw new Error("task not found");
+				if (task.status === "running" || hasOpenExecution(task)) throw new Error("running task cannot be deleted");
+				if (this.document.tasks.some((item) => item.parentId === action.taskId)) throw new Error("task has subtasks; detach or delete them first");
 				this.document.tasks = [...applyDeleteTask(this.document.tasks, void 0, action.taskId).tasks];
 				break;
+			}
+			case "set-parent": {
+				const result = applySetParent(this.document.tasks, action.taskId, action.parentId, now, this.maxSubtaskDepth);
+				if (!result.applied) throw new Error(result.error ?? "parent link refused");
+				this.document.tasks = [...result.tasks];
+				break;
+			}
 			case "move": {
 				const task = this.document.tasks.find((item) => item.id === action.taskId);
 				if (task === void 0) throw new Error("task not found");
@@ -1875,13 +2404,15 @@ var HostTaskLedger = class {
 				break;
 			}
 			case "archive": {
-				const result = applyArchiveTask(this.document.tasks, action.taskId, now);
+				if (this.subtreeHasOpenExecution(action.taskId)) throw new Error("running task cannot be archived");
+				const result = applyArchiveTask(this.document.tasks, action.taskId, now, this.maxSubtaskDepth);
 				if (!result.archived) throw new Error("task cannot be archived");
 				this.document.tasks = [...result.tasks];
 				break;
 			}
 			case "restore": {
-				const result = applyRestoreTask(this.document.tasks, action.taskId, now);
+				if (this.subtreeHasOpenExecution(action.taskId)) throw new Error("running task cannot be restored");
+				const result = applyRestoreTask(this.document.tasks, action.taskId, now, this.maxSubtaskDepth);
 				if (!result.archived) throw new Error("task is not archived");
 				this.document.tasks = [...result.tasks];
 				break;
@@ -1909,18 +2440,140 @@ var HostTaskLedger = class {
 				const task = this.document.tasks.find((item) => item.id === action.taskId);
 				if (task?.archivedAt !== void 0) throw new Error("archived task is read-only");
 				if (task === void 0 || task.status === "running" || hasOpenExecution(task)) throw new Error("task is already running or missing");
-				if (requiresPermissionConfirmation(task, this.sessionDefaultPermission)) throw new Error(`confirmation-required: the effective permission is above the session default (${this.sessionDefaultPermission}); confirm the card's permission binding first`);
-				run = startExecution(action.kind === "rerun" ? withStatus(task, "todo", now) : task, now, crypto.randomUUID(), initiator);
-				this.document.tasks = this.document.tasks.map((item) => item.id === task.id ? run.task : item);
+				const refusal = this.bindingRefusal(task);
+				if (refusal !== void 0) throw new Error(bindingRefusalMessage(refusal, this.sessionDefaultPermission, "run"));
+				runs = this.startCascade(task, now, initiator, action.kind === "rerun");
 				break;
 			}
 		}
-		this.commit();
+		if (runs === void 0 || runs.length === 0) this.commit();
 		return {
 			state: this.state(),
-			...run === void 0 ? {} : { run }
+			...runs === void 0 ? {} : { runs }
+		};
+	}
+	/**
+	* The binding that makes a run illegal, if any.
+	*
+	* A plain cascade launches one session per participant, so every participant
+	* carries its own resolved binding and each one gates the run. A team run
+	* launches only the Lead session: the Lead's binding gates it, while a
+	* subtask's OWN above-default pin cannot be applied to a teammate and is
+	* refused instead of being silently dropped (an inherited binding is the
+	* Lead's own and stays allowed once the Lead is confirmed).
+	* @param root - the task being run.
+	* @returns the first refusal, or undefined when the run may start.
+	*/
+	bindingRefusal(root) {
+		const participants = this.cascadeParticipants(root.id);
+		if (root.teamRun === true) {
+			const lead = participants.find((participant) => participant.id === root.id);
+			if (lead !== void 0 && requiresPermissionConfirmation(lead, this.sessionDefaultPermission)) return {
+				kind: "root",
+				title: lead.title
+			};
+			const pinned = participants.find((participant) => {
+				if (participant.id === root.id) return false;
+				const raw = this.document.tasks.find((task) => task.id === participant.id);
+				return raw !== void 0 && requiresPermissionConfirmation(raw, this.sessionDefaultPermission);
+			});
+			return pinned === void 0 ? void 0 : {
+				kind: "subtask-pin",
+				title: pinned.title
+			};
+		}
+		const unconfirmed = participants.find((participant) => requiresPermissionConfirmation(participant, this.sessionDefaultPermission));
+		if (unconfirmed === void 0) return void 0;
+		return {
+			kind: unconfirmed.id === root.id ? "root" : "inherited",
+			title: unconfirmed.title
 		};
 	}
+	/**
+	* The tasks a cascade from `rootId` would actually open executions for, with
+	* their effective execution targets resolved. Archived members never run, and
+	* a member that already has an open execution is skipped (a task cannot run
+	* twice), so the result is the participant set the launch will use.
+	*/
+	cascadeParticipants(rootId) {
+		return cascadeTargets(this.document.tasks, rootId, this.maxSubtaskDepth).map((participant) => resolveExecutionTargets(participant, this.document.tasks, this.maxSubtaskDepth)).filter((participant) => participant.archivedAt === void 0 && participant.status !== "running" && !hasOpenExecution(participant));
+	}
+	/** Whether a task or any of its subtasks still has an open execution. */
+	subtreeHasOpenExecution(id) {
+		return cascadeTargets(this.document.tasks, id, this.maxSubtaskDepth).some((task) => task.status === "running" || hasOpenExecution(task));
+	}
+	/**
+	* Open one execution per cascade participant (the requested task and its
+	* on-board descendants, within the depth limit) under a single run group, and
+	* commit the ledger once. The returned runs are ordered root-first, so the
+	* Host launches the parent before its subtasks.
+	* @param root - the task the user ran.
+	* @param now - clock instant (ms epoch).
+	* @param initiator - the DSH session that asked for the run (audit only).
+	* @param rerun - true to reset the root to 'todo' before starting it.
+	* @param nextRunAt - when set, the root's schedule also rolls forward.
+	*/
+	startCascade(root, now, initiator, rerun = false, nextRunAt) {
+		const before = this.document.tasks;
+		const groupId = crypto.randomUUID();
+		const team = root.teamRun === true;
+		const started = /* @__PURE__ */ new Map();
+		const runs = [];
+		for (const task of cascadeTargets(before, root.id, this.maxSubtaskDepth)) {
+			if (task.archivedAt !== void 0) continue;
+			if (task.status === "running" || hasOpenExecution(task)) continue;
+			const opened = startExecution(rerun && task.id === root.id ? withStatus(task, "todo", now) : task, now, crypto.randomUUID(), initiator, groupId);
+			started.set(task.id, opened.task);
+			runs.push({
+				task: resolveExecutionTargets(opened.task, before, this.maxSubtaskDepth),
+				execution: opened.execution,
+				...team && task.id !== root.id ? { dispatch: "teammate" } : {}
+			});
+		}
+		if (runs.length === 0) return [];
+		let tasks = before.map((task) => started.get(task.id) ?? task);
+		if (nextRunAt !== void 0) tasks = applyScheduleNextRun(tasks, root.id, nextRunAt, now, now);
+		this.document.tasks = [...tasks];
+		this.commit();
+		return runs;
+	}
+	/**
+	* Finalize every cascade parent that is ready, walking from `taskId` up the
+	* lineage: a member settles once its own outcome is recorded and none of its
+	* group children is still open, and its verdict folds those children in
+	* (failure dominates, then cancellation).
+	*/
+	settleCascade(taskId, groupId, now) {
+		let changed = false;
+		const visited = /* @__PURE__ */ new Set();
+		let current = taskId;
+		while (current !== void 0 && !visited.has(current)) {
+			visited.add(current);
+			const task = this.document.tasks.find((item) => item.id === current);
+			if (task === void 0) break;
+			const execution = openGroupExecution(task, groupId);
+			if (execution === void 0 || execution.ownResult === void 0) break;
+			if (pendingCascadeChildren(this.document.tasks, current, groupId).length > 0) break;
+			const entries = [{
+				result: execution.ownResult,
+				...execution.ownError === void 0 ? {} : { error: execution.ownError }
+			}];
+			for (const child of this.document.tasks) {
+				if (child.parentId !== current) continue;
+				const childExecution = child.executions.find((entry) => entry.runGroupId === groupId && entry.result !== void 0);
+				if (childExecution?.result === void 0) continue;
+				entries.push({
+					result: childExecution.result,
+					...childExecution.error === void 0 ? {} : { error: childExecution.error }
+				});
+			}
+			const combined = combineCascadeOutcome(entries);
+			this.document.tasks = this.document.tasks.map((item) => item.id === current ? settleExecution(item, execution.id, combined.result, now, combined.error) : item);
+			changed = true;
+			current = task.parentId;
+		}
+		return changed;
+	}
 	repairSchedules(skipPast, persist = true) {
 		const now = this.now();
 		let changed = false;
@@ -1958,13 +2611,23 @@ var HostTaskLedger = class {
 	reconcileInterruptedStarts(persist = true) {
 		const now = this.now();
 		let changed = false;
+		const interrupted = [];
 		this.document.tasks = this.document.tasks.map((task) => {
 			if (task.status !== "running") return task;
 			const execution = task.executions.at(-1);
 			if (execution === void 0 || execution.endedAt !== void 0 || execution.sessionId !== void 0) return task;
 			changed = true;
+			interrupted.push({
+				taskId: task.id,
+				runGroupId: execution.runGroupId
+			});
 			return settleExecution(task, execution.id, "cancelled", now, "host restarted before the execution session was recorded");
 		});
+		for (const entry of interrupted) {
+			if (entry.runGroupId === void 0) continue;
+			const parentId = this.document.tasks.find((task) => task.id === entry.taskId)?.parentId;
+			if (parentId !== void 0 && this.settleCascade(parentId, entry.runGroupId, now)) changed = true;
+		}
 		if (changed && persist) this.commit();
 	}
 	/**
@@ -2218,6 +2881,17 @@ function isInvocationUnavailable(error) {
 	const code = error.code;
 	return code === "invocation-unavailable" || code === "gateway/invocation-unavailable";
 }
+/**
+* Whether the endpoint exists but its strict definition was withdrawn by the
+* running gateway (the cohort changed under this plugin). The plugin can send
+* the call correctly and still be refused, and nothing in this repository can
+* restore the definition, so the roster is treated as unknown quietly instead
+* of printing an error the user has no action for (#1672).
+*/
+function isDefinitionWithdrawn(error) {
+	const code = error.code;
+	return code === "definition-unavailable" || code === "gateway/definition-unavailable";
+}
 const SERVICE_UNAVAILABLE_ATTEMPTS = 5;
 const SERVICE_UNAVAILABLE_BACKOFF_MS = 2e3;
 function delay(ms) {
@@ -2250,20 +2924,35 @@ function escapeProvenanceDelimiter(value) {
 	return value.replaceAll("来源声明 开始", "来源声明·开始").replaceAll("来源声明 结束", "来源声明·结束");
 }
 /**
-* Compose the execution prompt (issue #6): a continuation card (one carrying
-* a frozen snapshot) has its instruction mandatorily wrapped in a source
-* declaration (freeze instant, source session, unreviewed-content warning)
-* templated by the board, so the picking-up agent stays wary of stored
-* prompt-instruction injection in card text (adversarial scenario c). The
-* wrap composes with the T4 handover preamble: the reference preamble comes
-* first, the provenance wrap then encloses the instruction. Plain tasks (no
-* freeze) keep the bare handover preamble + prompt.
+* The execution-shape section: what else this run opens. A plain cascade opens
+* one independent session per member; a team run starts every other member as a
+* teammate inside THIS session, so the prompt names the Team tools instead.
+*/
+function peerPromptPreamble(context) {
+	const peers = context.peers ?? [];
+	if (peers.length === 0) return void 0;
+	if (context.team === true) {
+		const lines = peers.map((peer) => `- ${escapeProvenanceDelimiter(peer.title)}（teammate: ${peer.name ?? teammateName(peer.title, peer.id)}）`);
+		return `本任务是 Agent Team 的 Lead：本次运行不额外开启独立会话，以下 ${peers.length} 个子任务成员已在本会话中作为 teammate 启动。用 list_agents / send_message / wait_agent 协调它们，用任务看板工具读写它们在看板上的卡片：\n${lines.join("\n")}`;
+	}
+	const lines = peers.map((peer) => `- ${escapeProvenanceDelimiter(peer.title)}（任务 ${peer.id}）`);
+	return `本次运行同时并发开启 ${peers.length} 个独立 DSH 会话执行下列子任务成员（可用 task_board_* 工具查看它们的进度）：\n${lines.join("\n")}`;
+}
+/**
+* Build the execution prompt for one task.
+* @param task - the task being launched.
+* @param context - the run's other members, for the execution-shape section.
+* @returns the prompt text.
 */
-function promptText(task) {
+function promptText(task, context = {}) {
 	const body = task.prompt !== "" ? task.prompt : task.title;
 	const handover = task.handover;
 	const handoverPreamble = handover === void 0 || handover.references.length === 0 ? void 0 : `交接包引用（来自任务看板续接卡片，冻结于 ${new Date(handover.bundledAt).toISOString()}）：\n${handover.references.map((reference) => `- ${reference}`).join("\n")}`;
-	const preambles = [tagPromptPreamble(task), handoverPreamble].filter((part) => part !== void 0);
+	const preambles = [
+		tagPromptPreamble(task),
+		handoverPreamble,
+		peerPromptPreamble(context)
+	].filter((part) => part !== void 0);
 	const preamble = preambles.length === 0 ? void 0 : preambles.join("\n\n");
 	const freeze = task.freeze;
 	if (freeze === void 0) return preamble === void 0 ? body : `${preamble}\n\n${body}`;
@@ -2287,10 +2976,27 @@ function tagPromptPreamble(task) {
 	if (lines.length === 0) return void 0;
 	return `标签提示（任务看板标签，每次执行前注入）：\n${lines.join("\n")}`;
 }
-function isErrorTurnEnd(data) {
-	if (typeof data !== "object" || data === null) return false;
+/**
+* Why a `turn/end` did not complete successfully, or undefined when it did.
+*
+* The harness treats exactly `completed` as success (`headless` maps the turn
+* reason to its exit code, `subagent/projection` records `lastTurnCompleted`,
+* and `max-tokens` is a ceiling, not a result). A task-board execution is a
+* SUCCESS only on positive evidence of a completed turn; every other reason —
+* and an unreadable one — must be reported, or the board stamps a failed run
+* as `succeeded` and a schedule dies silently (issue #1708). `interrupted` is
+* the reason a restart produces: `interruptedTurnClosers` synthesizes it for a
+* log whose tail turn never ended, which is exactly an aborted resume.
+* @param data - the `turn/end` event payload.
+* @returns the reason kind when it is not `completed`, else undefined.
+*/
+function nonCompletedTurnEnd(data) {
+	if (typeof data !== "object" || data === null) return "unknown";
 	const reason = data.reason;
-	return typeof reason === "object" && reason !== null && reason.kind === "error";
+	if (typeof reason !== "object" || reason === null) return "unknown";
+	const kind = reason.kind;
+	if (typeof kind !== "string") return "unknown";
+	return kind === "completed" ? void 0 : kind;
 }
 /**
 * Wire-argument layout of the 0.1.2-alpha.2 descriptor tables; the gateway's
@@ -2366,7 +3072,8 @@ var HostExecutionRunner = class {
 		const reused = options.reuseSessionId;
 		if (reused !== void 0) {
 			try {
-				await this.pinAndPrompt(reused, task, permission);
+				await this.assertReusedPreset(reused, mode);
+				await this.pinAndPrompt(reused, task, permission, options.promptContext);
 			} catch (error) {
 				throw new SessionLaunchError(reused, error);
 			}
@@ -2381,18 +3088,38 @@ var HostExecutionRunner = class {
 				sessionId,
 				title: task.title
 			});
-			await this.pinAndPrompt(sessionId, task, permission);
+			await this.pinAndPrompt(sessionId, task, permission, options.promptContext);
 		} catch (error) {
 			throw new SessionLaunchError(sessionId, error);
 		}
 		return sessionId;
 	}
 	/**
+	* Fail closed when a reused session records a different Agent preset than
+	* the one this task pins.
+	*
+	* The fresh branch asserts the pin by passing `agentPreset` to
+	* `session/create`; the reuse branch must not call that method (it would
+	* create or re-adopt the very session the board only meant to continue), so
+	* the recorded value is read through `session/projections` — the documented
+	* read that resolves no Agent — and compared here (issue #1708). A session
+	* whose preset cannot be read is not treated as a match: silently continuing
+	* under an unknown composition is the failure this guards.
+	* @param sessionId - the session this execution continues in.
+	* @param pinned - the preset id the task pins, when it pins one.
+	*/
+	async assertReusedPreset(sessionId, pinned) {
+		if (pinned === void 0) return;
+		const recorded = (await this.invoke("session", "projections", { sessionId }))?.values?.agentPreset;
+		if (recorded === pinned) return;
+		throw new Error("reused session " + sessionId + " was composed from agent preset " + (typeof recorded === "string" ? "\"" + recorded + "\"" : "an unreadable value") + ", but the task pins \"" + pinned + "\"");
+	}
+	/**
 	* Re-assert the pinned execution contract on a session and queue the task
 	* prompt. Shared by the fresh-session and reuse paths so both apply exactly
 	* the same permission/model pins before the prompt.
 	*/
-	async pinAndPrompt(sessionId, task, permission) {
+	async pinAndPrompt(sessionId, task, permission, context = {}) {
 		if (permission !== void 0) {
 			if (this.commands === void 0) throw new Error("permission command dispatcher is unavailable");
 			const command = await this.commands.execute(sessionId, "/permission " + permission, AbortSignal.timeout(3e4));
@@ -2420,7 +3147,7 @@ var HostExecutionRunner = class {
 			mode: "queue",
 			content: [{
 				type: "text",
-				text: promptText(task)
+				text: promptText(task, context)
 			}]
 		});
 	}
@@ -2440,6 +3167,13 @@ var HostExecutionRunner = class {
 				}
 				return { known: false };
 			}
+			if (isDefinitionWithdrawn(error)) {
+				if (!this.unsupportedSessionListWarned) {
+					this.unsupportedSessionListWarned = true;
+					console.warn("[dsh-task-board] the host gateway withdrew the session/list definition for this DSH cohort; task board roster auto-discovery is disabled", error);
+				}
+				return { known: false };
+			}
 			if (!isServiceUnavailable(error) || attempt >= this.unavailableAttempts) {
 				console.error("[dsh-task-board] session/list failed; treating the host session roster as unknown", error);
 				return { known: false };
@@ -2463,6 +3197,10 @@ var HostExecutionRunner = class {
 					}
 					return { outcome: "pending" };
 				}
+				if (isDefinitionWithdrawn(error)) {
+					console.warn("[dsh-task-board] the host gateway withdrew the session/list definition for this DSH cohort; keeping the outcome pending", error);
+					return { outcome: "pending" };
+				}
 				console.warn("[dsh-task-board] session/list failed during execution inspection; keeping the outcome pending", error);
 				return { outcome: "pending" };
 			}
@@ -2533,10 +3271,15 @@ var HostExecutionRunner = class {
 			return { outcome: "pending" };
 		}
 		this.scanMemos.delete(sessionId);
-		return isErrorTurnEnd(turnEnd.event.data) ? {
+		const reason = nonCompletedTurnEnd(turnEnd.event.data);
+		if (reason === void 0) return { outcome: "succeeded" };
+		return reason === "error" ? {
 			outcome: "failed",
 			error: "agent turn ended with an error"
-		} : { outcome: "succeeded" };
+		} : {
+			outcome: "failed",
+			error: "agent turn ended without completing: " + reason
+		};
 	}
 };
 //#endregion
@@ -2843,19 +3586,55 @@ var PowerInhibitor = class {
 };
 //#endregion
 //#region src/host-service.ts
+/** Session-roster poll cadence — the one recurring Host timer this service still holds. */
 const SESSION_POLL_MS = 5e3;
-const SCHEDULE_TICK_MS = 3e4;
-const RESUME_GAP_MS = 45e3;
+/**
+* How late an armed schedule fire may be before it counts as a resume rather
+* than a normal occurrence. The schedule timer is armed AT the next due
+* instant, so landing this far past its target means the Host was suspended,
+* the process throttled, or the wall clock jumped forward — the same condition
+* the old fixed 30 s heartbeat detected through its own gap threshold.
+*/
+const RECOVERY_TOLERANCE_MS = 6e4;
+/** Largest delay a Node timer represents without clamping; longer targets re-arm in segments. */
+const MAX_TIMER_DELAY_MS = 2147483647;
+/**
+* Actions that can move an armed trigger. Only these re-arm the native timer;
+* an unrelated card edit leaves the pending fire untouched.
+*/
+const SCHEDULE_WRITE_ACTIONS = /* @__PURE__ */ new Set([
+	"set-schedule",
+	"delete",
+	"archive"
+]);
+/** Process-global fallback used when the deployment serves no cordis timer service. */
+const PROCESS_TIMERS = {
+	timeout(callback, delay) {
+		const handle = setTimeout(callback, delay);
+		return () => {
+			clearTimeout(handle);
+		};
+	},
+	interval(callback, delay) {
+		const handle = setInterval(callback, delay);
+		return () => {
+			clearInterval(handle);
+		};
+	}
+};
 var TaskBoardHostService = class {
 	ledger;
 	runner;
 	power;
 	listeners = /* @__PURE__ */ new Set();
-	timers = [];
-	lastScheduleTick;
+	/** The one recurring timer: the session-roster poll. */
+	pollTimer;
+	/** The armed schedule timer, if a trigger is pending. */
+	scheduleTimer;
+	/** The instant the armed schedule timer targets (ms epoch), for resume detection. */
+	scheduleTarget;
 	disposed = false;
 	pollInFlight = false;
-	tickInFlight = false;
 	active = true;
 	/**
 	* Ids the last roster poll saw as present and idle; undefined while the
@@ -2865,11 +3644,18 @@ var TaskBoardHostService = class {
 	*/
 	idleSessionIds;
 	preventIdleSleep = false;
+	team;
+	timers;
 	lastPowerJson = "";
 	now;
 	constructor(gateway, options = {}) {
-		this.ledger = options.ledger ?? new HostTaskLedger(void 0, void 0, { sessionDefaultPermission: options.sessionDefaultPermission });
+		this.ledger = options.ledger ?? new HostTaskLedger(void 0, void 0, {
+			sessionDefaultPermission: options.sessionDefaultPermission,
+			maxSubtaskDepth: options.maxSubtaskDepth
+		});
 		this.runner = new HostExecutionRunner(gateway, options.commandDispatcher, options.workspaceRegistry);
+		this.team = options.team;
+		this.timers = options.timers ?? PROCESS_TIMERS;
 		this.power = options.power ?? new PowerInhibitor();
 		this.now = options.now ?? Date.now;
 		installStreamErrorGuards();
@@ -2885,16 +3671,13 @@ var TaskBoardHostService = class {
 		});
 	}
 	start() {
-		if (this.disposed || this.timers.length > 0) return;
+		if (this.disposed || this.pollTimer !== void 0) return;
 		this.syncPowerReasons();
-		this.timers.push(setInterval(() => {
+		this.pollTimer = this.timers.interval(() => {
 			this.schedulePoll();
-		}, SESSION_POLL_MS));
-		this.timers.push(setInterval(() => {
-			this.scheduleTick(false);
-		}, SCHEDULE_TICK_MS));
+		}, SESSION_POLL_MS);
 		this.schedulePoll();
-		this.scheduleTick(true);
+		this.recoverSchedule();
 	}
 	setConfiguration(active, preventIdleSleep) {
 		const resumed = !this.active && active;
@@ -2911,8 +3694,8 @@ var TaskBoardHostService = class {
 		this.power.setEnabled(active && preventIdleSleep);
 		if (resumed) {
 			this.schedulePoll();
-			this.scheduleTick(true);
-		}
+			this.recoverSchedule();
+		} else if (!active) this.clearScheduleTimer();
 		this.emit();
 	}
 	snapshot() {
@@ -2923,7 +3706,9 @@ var TaskBoardHostService = class {
 			tasks: state.tasks,
 			scheduler: state.scheduler,
 			power: this.power.snapshot(),
-			sessionDefaultPermission: this.ledger.sessionDefaultPermission
+			sessionDefaultPermission: this.ledger.sessionDefaultPermission,
+			maxSubtaskDepth: this.ledger.maxSubtaskDepth,
+			teamRunAvailable: this.team !== void 0
 		};
 	}
 	/** SSE frame payload; deliberately skips the tasks deep-clone of {@link snapshot}. */
@@ -2943,8 +3728,12 @@ var TaskBoardHostService = class {
 	}
 	apply(requestId, action, initiator) {
 		if (!this.active) throw new Error("task board is disabled");
+		if (this.team === void 0 && (action.kind === "run" || action.kind === "rerun")) {
+			if (this.ledger.state().tasks.find((item) => item.id === action.taskId)?.teamRun === true) throw new Error("Agent Teams is unavailable in this deployment");
+		}
 		const result = this.ledger.applyRequest(requestId, action, initiator);
-		if (result.run !== void 0) this.scheduleLaunch(result.run);
+		if (result.runs !== void 0) this.dispatchRuns(result.runs);
+		if (SCHEDULE_WRITE_ACTIONS.has(action.kind)) this.refreshSchedule();
 		return {
 			schemaVersion: 3,
 			revision: result.state.revision,
@@ -2955,25 +3744,74 @@ var TaskBoardHostService = class {
 	}
 	dispose() {
 		this.disposed = true;
-		for (const timer of this.timers.splice(0)) clearInterval(timer);
+		this.clearScheduleTimer();
+		this.pollTimer?.();
+		this.pollTimer = void 0;
 		this.power.dispose();
 		this.ledger.dispose();
 		this.listeners.clear();
 	}
-	async launch(opened) {
+	async launch(opened, others = []) {
 		try {
-			const reuseSessionId = reusableSessionId(opened.task, this.idleSessionIds);
-			const sessionId = await this.runner.launch(opened.task, reuseSessionId === void 0 ? {} : { reuseSessionId });
+			const team = opened.task.teamRun === true;
+			const reuseSessionId = team ? void 0 : reusableSessionId(opened.task, this.idleSessionIds);
+			const promptContext = others.length === 0 ? void 0 : {
+				peers: others.map((other) => ({
+					id: other.task.id,
+					title: other.task.title,
+					...team ? { name: teammateName(other.task.title, other.execution.runGroupId ?? other.task.id) } : {}
+				})),
+				...team ? { team: true } : {}
+			};
+			const sessionId = await this.runner.launch(opened.task, {
+				...reuseSessionId === void 0 ? {} : { reuseSessionId },
+				...promptContext === void 0 ? {} : { promptContext }
+			});
 			this.ledger.attachSession(opened.task.id, opened.execution.id, sessionId);
+			if (team) for (const teammate of others) this.scheduleTeammate(teammate, sessionId);
 		} catch (error) {
 			if (error instanceof SessionLaunchError) this.ledger.attachSession(opened.task.id, opened.execution.id, error.sessionId);
 			this.ledger.settle(opened.task.id, opened.execution.id, "failed", error instanceof Error ? error.message : String(error));
 		}
 	}
-	async pollSessions() {
-		if (this.disposed) return;
-		if (!this.active && this.ledger.runtimeView().openExecutions.length === 0) return;
-		const running = await this.runner.listRunning();
+	scheduleTeammate(opened, leadSessionId) {
+		this.spawnTeammate(opened, leadSessionId).catch((error) => {
+			safeConsoleError("[dsh-task-board] teammate spawn settlement failed", error);
+		});
+	}
+	/**
+	* Spawn one teammate inside the Lead session and attach the teammate's
+	* session to the subtask execution, so the existing session monitor settles
+	* it from the teammate's own turn like any other execution. A spawn that
+	* fails settles the subtask as failed immediately, which then folds into the
+	* Lead's cascade verdict.
+	*/
+	async spawnTeammate(opened, leadSessionId) {
+		const team = this.team;
+		if (team === void 0) {
+			this.ledger.settle(opened.task.id, opened.execution.id, "failed", "Agent Teams is unavailable in this deployment");
+			return;
+		}
+		try {
+			const member = await team.spawn({
+				leadSessionId,
+				name: teammateName(opened.task.title, opened.execution.runGroupId ?? opened.task.id),
+				description: opened.task.title,
+				prompt: promptText(opened.task)
+			});
+			if (member.sessionId === void 0 || member.sessionId === "") {
+				this.ledger.settle(opened.task.id, opened.execution.id, "failed", member.error ?? "teammate provisioning failed");
+				return;
+			}
+			this.ledger.attachSession(opened.task.id, opened.execution.id, member.sessionId);
+		} catch (error) {
+			this.ledger.settle(opened.task.id, opened.execution.id, "failed", error instanceof Error ? error.message : String(error));
+		}
+	}
+	async pollSessions() {
+		if (this.disposed) return;
+		if (!this.active && this.ledger.runtimeView().openExecutions.length === 0) return;
+		const running = await this.runner.listRunning();
 		const previous = this.power.snapshot();
 		if (!running.known) {
 			this.idleSessionIds = void 0;
@@ -3004,27 +3842,87 @@ var TaskBoardHostService = class {
 			} catch {}
 		}
 	}
-	async tickSchedule(first) {
+	/** Drop the armed schedule timer and forget its target. */
+	clearScheduleTimer() {
+		this.scheduleTimer?.();
+		this.scheduleTimer = void 0;
+		this.scheduleTarget = void 0;
+	}
+	/**
+	* Boot / resume recovery: skip every occurrence that came due while the
+	* board was not running and roll each schedule to its next future target,
+	* then arm the timer for the nearest one. Rendering the occurrence is
+	* deliberately not attempted: the ACL of a card that fired hours ago is
+	* stale, and the board's own recovery contract is "missed triggers are
+	* skipped, never replayed".
+	*/
+	recoverSchedule() {
+		if (this.disposed) return;
+		this.clearScheduleTimer();
+		const now = this.now();
+		this.ledger.setScheduler({ lastTickAt: now });
+		this.ledger.skipMissed(now);
+		this.armSchedule();
+	}
+	/**
+	* Arm the native timer at the nearest armed future trigger. One timer serves
+	* every schedule: the ledger's next target is the only instant the Host has
+	* to wake for. A target beyond the platform's timer ceiling re-arms in
+	* segments, and a target already past (the wall clock jumped, or the process
+	* was suspended) is handled immediately as a recovery.
+	*/
+	armSchedule() {
+		if (this.disposed || !this.active) return;
+		this.clearScheduleTimer();
+		const target = this.ledger.nextArmedRunAt(this.now());
+		if (target === void 0) return;
+		this.scheduleTarget = target;
+		const delay = Math.max(0, Math.min(target - this.now(), MAX_TIMER_DELAY_MS));
+		this.scheduleTimer = this.timers.timeout(() => {
+			this.scheduleTimer = void 0;
+			this.onScheduleFire(target);
+		}, delay);
+	}
+	/**
+	* One armed target became due. A fire landing well past its target is a
+	* resume (suspend, throttle, forward clock jump) rather than a normal
+	* occurrence, so it takes the recovery path instead of launching a run for a
+	* long-stale instant.
+	*/
+	onScheduleFire(target) {
 		if (this.disposed || !this.active) return;
 		const now = this.now();
-		const recovered = first || this.lastScheduleTick !== void 0 && now - this.lastScheduleTick > RESUME_GAP_MS;
-		this.lastScheduleTick = now;
+		this.scheduleTarget = void 0;
 		this.ledger.setScheduler({ lastTickAt: now });
-		if (recovered) {
-			this.ledger.skipMissed(now);
+		if (now - target > RECOVERY_TOLERANCE_MS) {
+			this.recoverSchedule();
 			return;
 		}
 		for (const schedule of this.ledger.dueSchedules(now)) {
 			const next = nextRunAtMs(schedule.cron, schedule.nextRunAt);
-			const opened = this.ledger.openScheduled(schedule.taskId, next, now);
-			if (opened !== void 0) this.scheduleLaunch(opened);
+			this.dispatchRuns(this.ledger.openScheduled(schedule.taskId, next, now));
 		}
+		this.armSchedule();
 	}
 	armedSchedules() {
 		return this.ledger.armedScheduleCount();
 	}
-	scheduleLaunch(opened) {
-		this.launch(opened).catch((error) => {
+	/**
+	* Launch one run set. The root goes first and receives the run shape in its
+	* prompt (which members this run opens, and how they run); every plain-cascade
+	* member then launches on its own so one refused participant cannot hold the
+	* others back. A team run's members are spawned inside the root's Lead
+	* session instead, once that session exists.
+	*/
+	dispatchRuns(runs) {
+		if (runs.length === 0) return;
+		const root = runs.find((run) => run.dispatch !== "teammate") ?? runs[0];
+		const others = runs.filter((run) => run !== root);
+		this.scheduleLaunch(root, others);
+		for (const run of others) if (run.dispatch !== "teammate") this.scheduleLaunch(run);
+	}
+	scheduleLaunch(opened, others = []) {
+		this.launch(opened, others).catch((error) => {
 			safeConsoleError("[dsh-task-board] execution launch settlement failed", error);
 		});
 	}
@@ -3037,14 +3935,18 @@ var TaskBoardHostService = class {
 			this.pollInFlight = false;
 		});
 	}
-	scheduleTick(first) {
-		if (this.tickInFlight || this.disposed) return;
-		this.tickInFlight = true;
-		this.tickSchedule(first).catch((error) => {
-			safeConsoleError("[dsh-task-board] scheduler tick failed", error);
-		}).finally(() => {
-			this.tickInFlight = false;
-		});
+	/**
+	* Re-arm from the ledger's current targets. Callers that just changed a
+	* schedule (the host routes, the agent tools) invoke this after the write
+	* commits, so a new or edited trigger arms without waiting for the next fire.
+	*/
+	refreshSchedule() {
+		if (this.disposed) return;
+		if (!this.active) {
+			this.clearScheduleTimer();
+			return;
+		}
+		this.armSchedule();
 	}
 	syncPowerReasons() {
 		const current = this.power.snapshot();
@@ -3066,1346 +3968,17 @@ var TaskBoardHostService = class {
 */
 function installStreamErrorGuards() {
 	for (const stream of [process.stderr, process.stdout]) if (stream && typeof stream.on === "function") {
-		if (!(typeof stream.listenerCount === "function" && stream.listenerCount("error") > 0)) stream.on("error", () => {});
-	}
-}
-/**
-* Defensively log to console.error without letting stderr write failures
-* (e.g. ENOSPC from SyncWriteStream on redirected logs) crash the host process.
-*/
-function safeConsoleError(message, ...args) {
-	try {
-		console.error(message, ...args);
-	} catch {}
-}
-//#endregion
-//#region ../../node_modules/.pnpm/@deepseek-ai+dsh-typert-protocol@0.1.7-rc.1_@deepseek-ai+cordis@4.0.4/node_modules/@deepseek-ai/dsh-typert-protocol/lib/index.js
-/** The one Remote failure class shared by owners, the Gateway, and consumers. */
-/**
-* One Remote call failure: a real Error carrying its stable code and typed
-* details. Owners throw it at the failure point; the Host Gateway encodes it
-* onto the wire unchanged; the Client face rebuilds an instance for the
-* `RemoteResult` error branch, so `throw result.error` keeps throw semantics.
-* Discrimination is always by `code`, never by instanceof.
-*/
-var RemoteError = class extends Error {
-	code;
-	details;
-	/** Structural marker: cross-realm/bundle identification never uses instanceof. */
-	isDSHRemoteError = true;
-	/**
-	* @param code - stable failure code declared in {@link RemoteErrorDetailsMap}.
-	* @param message - human diagnostic carried across the wire.
-	* @param details - structured payload typed by the code.
-	* @param options - standard Error options (`cause` survives in-process only).
-	*/
-	constructor(code, message, details, options) {
-		super(message, options);
-		this.code = code;
-		this.details = details;
-		this.name = "RemoteError";
-	}
-};
-/**
-* Remote decorators and explicit Gateway bindings backed by versioned
-* descriptors carried on decorated class prototypes. Strict reflection
-* remains a Typert compiler responsibility.
-* @module @deepseek-ai/dsh-typert-protocol
-*/
-const TYPERT_REMOTE_SEGMENT_PATTERN = /^[A-Za-z0-9_$.-]+$/;
-/**
-* Test one generated Remote name against the Connection endpoint grammar.
-* @param value - namespace, method, lookup, or Context segment.
-* @returns whether the value can cross the shared RPC carrier unchanged.
-*/
-function isTypertRemoteSegment(value) {
-	return value !== "." && value !== ".." && TYPERT_REMOTE_SEGMENT_PATTERN.test(value);
-}
-const REMOTE_METHOD_DESCRIPTOR = "@deepseek-ai/dsh-typert-protocol/remote-methods";
-/**
-* Bind one visible Service field to a Cordis key and Remote namespace. A
-* service that owns a Cordis Context also gives its tree `ctx.invocation`,
-* `undefined` outside a Remote call, so no `TypertRemoteService` is needed for
-* a Host composition to read it.
-* @param service - owning Service instance, normally `this`.
-* @param serviceKey - exact Cordis service key.
-* @param options - optional distinct wire namespace.
-* @returns a frozen, inspectable binding with no compiler-injected metadata.
-*/
-function bindTypertRemote(service, serviceKey, options = {}) {
-	validateName("service key", serviceKey);
-	const namespace = options.namespace ?? serviceKey;
-	validateName("namespace", namespace);
-	const ctx = Reflect.get(service, "ctx");
-	if (ctx instanceof Context) provideInvocationAccessor(ctx);
-	return Object.freeze({
-		service,
-		serviceKey,
-		namespace
-	});
-}
-/** Cordis Service base that exposes its registered name through Typert Gateway. */
-var TypertRemoteService = class extends Service {
-	/** Visible binding consumed by the Gateway's source-mode discovery. */
-	typertRemote;
-	/**
-	* Register the Service and bind the same key to Typert Gateway.
-	* @param ctx - owning Cordis Context.
-	* @param serviceKey - exact Cordis service key and default wire namespace.
-	* @param options - optional distinct wire namespace.
-	*/
-	constructor(ctx, serviceKey, options = {}) {
-		super(ctx, serviceKey);
-		this.typertRemote = bindTypertRemote(this, this.name, options);
-	}
-};
-/**
-* Make `ctx.invocation` read as `undefined` outside a Remote call instead of the
-* reflect service's "cannot get property" error; a call-derived Context shadows
-* the accessor with its own property. The first Remote Service constructed in a
-* tree registers it on the root, where it outlives any one Service.
-*/
-function provideInvocationAccessor(ctx) {
-	if (Object.hasOwn(ctx.root.reflect.props, "invocation")) return;
-	ctx.root.accessor("invocation", { get: () => void 0 });
-}
-function Remote(methodExportOrOptions, context) {
-	if (typeof methodExportOrOptions === "string") {
-		validateName("Remote export name", methodExportOrOptions);
-		return remoteDecorator({ kind: "direct" }, void 0, methodExportOrOptions);
-	}
-	if (typeof methodExportOrOptions === "object") {
-		if (remoteOptionMode(methodExportOrOptions) !== "stream" || Reflect.ownKeys(methodExportOrOptions).length !== 1) throw new TypeError("typert-protocol: Remote options must contain exactly mode: \"stream\"");
-		return remoteDecorator({ kind: "direct" }, "stream");
-	}
-	if (context === void 0) throw new TypeError("typert-protocol: Remote decorator context is missing");
-	addMarkerInitializer(context, { kind: "direct" });
-}
-function remoteOptionMode(options) {
-	return Reflect.get(options, "mode");
-}
-function remoteDecorator(invocation, mode, exportName) {
-	return function(_method, context) {
-		addMarkerInitializer(context, invocation, mode, exportName);
-	};
-}
-function readRemoteMethodDescriptor(prototype) {
-	const property = Object.getOwnPropertyDescriptor(prototype, REMOTE_METHOD_DESCRIPTOR);
-	if (property === void 0) return void 0;
-	const descriptor = property.value;
-	if (descriptor === null || typeof descriptor !== "object") throw new TypeError("typert-protocol: Remote method descriptor must be an object");
-	const version = Reflect.get(descriptor, "version");
-	if (version !== 1) throw new TypeError(`typert-protocol: unsupported Remote method descriptor version ${String(version)}`);
-	const methods = Reflect.get(descriptor, "methods");
-	if (!Array.isArray(methods)) throw new TypeError("typert-protocol: Remote method descriptor methods must be an array");
-	return descriptor;
-}
-function addMarkerInitializer(context, invocation, mode, exportName) {
-	if (context.private || context.static || typeof context.name !== "string") throw new TypeError("typert-protocol: Remote decorators require a public instance method with a string name");
-	const method = context.name;
-	context.addInitializer(function() {
-		const prototype = Object.getPrototypeOf(this);
-		if (prototype === null) throw new TypeError(`typert-protocol: cannot mark Remote method "${method}" on an object without a prototype`);
-		mark(prototype, method, invocation, mode, exportName);
-	});
-}
-function mark(prototype, method, invocation, mode, exportName) {
-	const descriptor = readRemoteMethodDescriptor(prototype);
-	const marker = Object.freeze({
-		method,
-		...exportName === void 0 || exportName === method ? {} : { exportName },
-		...mode === void 0 ? {} : { mode },
-		invocation: Object.freeze(invocation)
-	});
-	const current = descriptor?.methods.find((candidate) => candidate.method === method);
-	if (current !== void 0) {
-		if (current.exportName === marker.exportName && current.mode === marker.mode && sameInvocation(current.invocation, invocation)) return;
-		throw new Error(`typert-protocol: Remote method "${method}" has conflicting invocation markers`);
-	}
-	Object.defineProperty(prototype, REMOTE_METHOD_DESCRIPTOR, {
-		configurable: true,
-		value: Object.freeze({
-			version: 1,
-			methods: Object.freeze([...descriptor?.methods ?? [], marker])
-		})
-	});
-}
-function sameInvocation(left, right) {
-	if (left.kind === "direct") return right.kind === "direct";
-	if (right.kind === "direct") return false;
-	return left.context === right.context;
-}
-function validateName(subject, value) {
-	if (!isTypertRemoteSegment(value)) throw new TypeError(`typert-protocol: ${subject} must contain only RPC endpoint segment characters`);
-}
-//#endregion
-//#region ../../node_modules/.pnpm/@deepseek-ai+dsh-util-values@0.1.7-rc.1_@deepseek-ai+cordis@4.0.4/node_modules/@deepseek-ai/dsh-util-values/lib/index.js
-/**
-* Deep-freeze an object graph in place while leaving live AbortSignal objects mutable.
-* @param value - value to freeze.
-* @returns the same value after every reachable enumerable child is frozen.
-*/
-function deepFreeze(value) {
-	const seen = /* @__PURE__ */ new WeakSet();
-	const pending = [{
-		kind: "visit",
-		node: value
-	}];
-	while (pending.length > 0) {
-		const task = pending.pop();
-		/* v8 ignore next -- the loop condition guarantees one pending task. */
-		if (task === void 0) continue;
-		if (task.kind === "property") {
-			pending.push({
-				kind: "visit",
-				node: task.source[task.key]
-			});
-			continue;
-		}
-		const node = task.node;
-		if (node === null || typeof node !== "object") continue;
-		if (node instanceof AbortSignal) continue;
-		if (seen.has(node)) continue;
-		seen.add(node);
-		Object.freeze(node);
-		const keys = Object.keys(node);
-		for (let index = keys.length - 1; index >= 0; index--) {
-			const key = keys[index];
-			/* v8 ignore next -- the loop is bounded by the captured key count. */
-			if (key === void 0) continue;
-			pending.push({
-				kind: "property",
-				source: node,
-				key
-			});
-		}
-	}
-	return value;
-}
-//#endregion
-//#region ../../node_modules/.pnpm/@deepseek-ai+dsh-util-crypto@0.1.7-rc.1_@deepseek-ai+cordis@4.0.4/node_modules/@deepseek-ai/dsh-util-crypto/lib/index.js
-/**
-* Random v4 UUID, minted from `crypto.getRandomValues`.
-* @returns the UUID string.
-*/
-function randomUUID() {
-	const bytes = globalThis.crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(16));
-	const hex = Array.from(bytes, (byte, index) => {
-		return (index === 6 ? byte & 15 | 64 : index === 8 ? byte & 63 | 128 : byte).toString(16).padStart(2, "0");
-	}).join("");
-	return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
-}
-//#endregion
-//#region ../../node_modules/.pnpm/@deepseek-ai+dsh-brand@0.1.7-rc.1_@deepseek-ai+cordis@4.0.4/node_modules/@deepseek-ai/dsh-brand/lib/index.js
-/**
-* Duplicate-install-safe nominal primitive helpers.
-*
-* A brand makes structurally identical strings or numbers non-interchangeable
-* at the type level: a `SessionId` cannot be passed where a `ToolCallId` is
-* expected, and an event sequence cannot be passed as a log offset. Comparison,
-* logging, and serialization retain the underlying primitive behavior.
-*
-* This package owns no concrete domain value and keeps no runtime identity or mutable
-* state, so independently installed copies produce interchangeable values.
-*
-* @module @deepseek-ai/dsh-brand
-*/
-/**
-* Apply a compile-time string brand without changing the value.
-* @param value - string admitted by the domain that owns the target brand.
-* @returns the same string with the requested compile-time brand.
-*/
-function brandString(value) {
-	return value;
-}
-//#endregion
-//#region ../../node_modules/.pnpm/@deepseek-ai+dsh-timeout@0.1.7-rc.1_@deepseek-ai+cordis@4.0.4/node_modules/@deepseek-ai/dsh-timeout/lib/index.js
-/** Largest delay Node schedules without clamping it to one millisecond. */
-const MAX_TIMER_DELAY_MS = 2147483647;
-//#endregion
-//#region ../../node_modules/.pnpm/@deepseek-ai+dsh-llm@0.1.7-rc.1_@deepseek-ai+cordis@4.0.4/node_modules/@deepseek-ai/dsh-llm/lib/index.js
-/**
-* Detach and deep-freeze a message whose identity already exists.
-* @param message - complete message, including its stable identity.
-* @returns an immutable snapshot that preserves the identity.
-*/
-function freezeMessage(message) {
-	return deepFreeze(structuredClone(message));
-}
-/**
-* Create one identified message and freeze it before publication.
-* @param input - complete role, content, and source for a new message.
-* @returns an immutable message with a fresh stable identity.
-*/
-function createMessage(input) {
-	return deepFreeze(structuredClone({
-		...input,
-		id: brandString(randomUUID())
-	}));
-}
-/**
-* Create one identified user-role message and freeze it before publication.
-* @param input - complete content and source for a new user message.
-* @returns an immutable user message with a fresh stable identity.
-*/
-function createUserMessage(input) {
-	return createMessage({
-		...input,
-		role: "user"
-	});
-}
-/**
-* Harness error base with a stable machine-routable code and chained cause.
-* Package errors extend it so tool results and replay can retain failure class.
-* @module @deepseek-ai/dsh-llm/error
-*/
-/**
-* Base class for all harness errors. Carries a `code` (stable, programmatic —
-* e.g. `NO_ADAPTER`, `INVALID_ARGS`, `INVARIANT`) distinct from the
-* human-readable `message`, and supports `cause` chaining via the standard
-* `ErrorOptions`. `name` defaults to the subclass constructor name.
-*/
-var HarnessError = class extends Error {
-	/** Stable machine-routable failure class (e.g. `RATE_LIMIT`); route on this, never by parsing `message`. */
-	code;
-	constructor(message, code, options) {
-		super(message, options);
-		this.code = code;
-		this.name = new.target.name;
-	}
-};
-/**
-* Canonical provider-neutral code for a response that completed normally but
-* carried no content blocks at all. Providers occasionally emit a degenerate
-* completion (a terminal stop with zero output); adapters classify it as this
-* failure instead of yielding an empty assistant message, because an empty
-* message silently ends the turn with nothing for the user or the loop to act
-* on. The attempt produced nothing durable, so retry policy treats it as safe
-* to repeat.
-*/
-const EMPTY_RESPONSE_CODE = "EMPTY_RESPONSE";
-new RegExp(String.raw`(?:^|[^a-z0-9])context[\s_-](?:length|window)[\s_-]` + String.raw`(?:exceed(?:ed|s)?|overflow(?:ed)?|limit[\s_-]exceeded)(?:$|[^a-z0-9])`, "i");
-new RegExp(String.raw`\b(?:request|prompt|input|messages?)\s+(?:is\s+|are\s+)?` + String.raw`too\s+(?:large|long)\s+for\s+(?:(?:this|the)\s+)?` + String.raw`(?:model(?:'s)?\s+)?context(?:\s+window)?\b`, "i");
-new RegExp(String.raw`\b(?:input|prompt|request|messages?)\b.{0,40}` + String.raw`\b(?:exceed(?:s|ed)?|overflows?|is\s+larger\s+than)\b.{0,40}` + String.raw`\b(?:the\s+)?(?:model(?:'s)?\s+)?context(?:\s+(?:length|window))?\b`, "i");
-/**
-* Provider-owned request-retry policy configuration and resolution.
-*
-* Adapters expose one resolved policy per registered provider route; the
-* optional dsh-llm-retry plugin executes it on the agent's failed-step extension point.
-*
-* @module @deepseek-ai/dsh-llm/retry-policy
-*/
-const DEFAULT_MAX_RETRIES = 5;
-const DEFAULT_INITIAL_DELAY_MS = 500;
-const DEFAULT_MAX_DELAY_MS = 1e4;
-const DEFAULT_JITTER_RATIO = .1;
-const DEFAULT_RETRYABLE_CODES = Object.freeze([
-	EMPTY_RESPONSE_CODE,
-	"RATE_LIMIT",
-	"SERVER",
-	"TIMEOUT",
-	"TRANSPORT"
-]);
-const backoffSchema = z.object({
-	initialDelayMs: z.number().max(MAX_TIMER_DELAY_MS).default(DEFAULT_INITIAL_DELAY_MS),
-	maxDelayMs: z.number().max(MAX_TIMER_DELAY_MS).default(DEFAULT_MAX_DELAY_MS),
-	jitterRatio: z.number().min(0).max(1).default(DEFAULT_JITTER_RATIO)
-});
-const normalPolicySchema = z.object({
-	mode: z.const("normal").required(),
-	maxRetries: z.number().step(1).min(0).max(Number.MAX_SAFE_INTEGER).default(DEFAULT_MAX_RETRIES),
-	retryableCodes: z.array(z.string()).default([...DEFAULT_RETRYABLE_CODES]),
-	backoff: backoffSchema
-});
-const alwaysPolicySchema = z.object({
-	mode: z.const("always").required(),
-	backoff: backoffSchema
-});
-z.union([normalPolicySchema, alwaysPolicySchema]);
-const NORMAL_POLICY_KEYS = /* @__PURE__ */ new Set([
-	"mode",
-	"maxRetries",
-	"retryableCodes",
-	"backoff"
-]);
-const ALWAYS_POLICY_KEYS = /* @__PURE__ */ new Set([
-	"mode",
-	"maxRetries",
-	"retryableCodes",
-	"backoff"
-]);
-const BACKOFF_KEYS = /* @__PURE__ */ new Set([
-	"initialDelayMs",
-	"maxDelayMs",
-	"jitterRatio"
-]);
-function validateKeys(value, allowed, path) {
-	for (const key of Object.keys(value)) if (!allowed.has(key)) throw new Error(`${path}: unknown key "${key}"`);
-}
-function resolveBackoff(config, path) {
-	if (config !== void 0) validateKeys(config, BACKOFF_KEYS, path);
-	const initialDelayMs = config?.initialDelayMs ?? DEFAULT_INITIAL_DELAY_MS;
-	const maxDelayMs = config?.maxDelayMs ?? DEFAULT_MAX_DELAY_MS;
-	const jitterRatio = config?.jitterRatio ?? DEFAULT_JITTER_RATIO;
-	if (!Number.isFinite(initialDelayMs) || initialDelayMs <= 0 || initialDelayMs > 2147483647) throw new Error(`${path}.initialDelayMs must be a positive finite number no greater than ${MAX_TIMER_DELAY_MS}`);
-	if (!Number.isFinite(maxDelayMs) || maxDelayMs <= 0 || maxDelayMs > 2147483647) throw new Error(`${path}.maxDelayMs must be a positive finite number no greater than ${MAX_TIMER_DELAY_MS}`);
-	if (initialDelayMs > maxDelayMs) throw new Error(`${path}.initialDelayMs must be less than or equal to maxDelayMs`);
-	if (!Number.isFinite(jitterRatio) || jitterRatio < 0 || jitterRatio > 1) throw new Error(`${path}.jitterRatio must be between 0 and 1`);
-	return Object.freeze({
-		initialDelayMs,
-		maxDelayMs,
-		jitterRatio
-	});
-}
-/**
-* Validate, default, and detach one provider-owned retry policy.
-* @param config - optional provider configuration; omission selects normal defaults.
-* @param path - diagnostic path naming the provider config that owns the value.
-* @returns an immutable policy safe to capture in provider registration state.
-*/
-function resolveRetryPolicy(config, path) {
-	if (config === void 0) return Object.freeze({
-		mode: "normal",
-		maxRetries: DEFAULT_MAX_RETRIES,
-		retryableCodes: DEFAULT_RETRYABLE_CODES,
-		...resolveBackoff(void 0, `${path}.backoff`)
-	});
-	switch (config.mode) {
-		case "normal": {
-			validateKeys(config, NORMAL_POLICY_KEYS, path);
-			const maxRetries = config.maxRetries ?? DEFAULT_MAX_RETRIES;
-			const retryableCodes = config.retryableCodes ?? [...DEFAULT_RETRYABLE_CODES];
-			if (!Number.isSafeInteger(maxRetries) || maxRetries < 0) throw new Error(`${path}.maxRetries must be a non-negative safe integer`);
-			if (retryableCodes.length === 0) throw new Error(`${path}.retryableCodes must not be empty`);
-			if (retryableCodes.some((code) => typeof code !== "string" || code.length === 0)) throw new Error(`${path}.retryableCodes must contain only non-empty strings`);
-			if (new Set(retryableCodes).size !== retryableCodes.length) throw new Error(`${path}.retryableCodes must not contain duplicates`);
-			return Object.freeze({
-				mode: "normal",
-				maxRetries,
-				retryableCodes: Object.freeze([...retryableCodes]),
-				...resolveBackoff(config.backoff, `${path}.backoff`)
-			});
-		}
-		case "always":
-			validateKeys(config, ALWAYS_POLICY_KEYS, path);
-			return Object.freeze({
-				mode: "always",
-				...resolveBackoff(config.backoff, `${path}.backoff`)
-			});
-		default: throw new Error(`${path}.mode must be "normal" or "always"`);
-	}
-}
-/**
-* Field-wise equality over {@link LlmCallConfig} — the comparison a caller
-* runs to decide whether a proposed configuration is a real change (worth a
-* logged header snapshot) or the held one restated.
-* @param a - one configuration.
-* @param b - the other.
-* @returns whether every field (including the `stop` list, element-wise) matches.
-*/
-function callConfigEquals(a, b) {
-	if (a.provider !== b.provider || a.model !== b.model || a.reasoningEffort !== b.reasoningEffort || a.temperature !== b.temperature || a.maxTokens !== b.maxTokens) return false;
-	if (a.stop === void 0 || b.stop === void 0) return a.stop === b.stop;
-	return a.stop.length === b.stop.length && a.stop.every((s, i) => s === b.stop?.[i]);
-}
-/**
-* Normalization for values thrown by a final LLM adapter boundary.
-*
-* @module @deepseek-ai/dsh-llm/adapter-failure
-*/
-/**
-* Detach serializable provider facts from a value thrown by an adapter.
-* @param value - arbitrary value thrown during adapter dispatch or iteration.
-* @returns immutable provider-neutral facts suitable for a terminal finish chunk.
-* @internal
-*/
-function normalizeLlmFailure(value) {
-	const error = value instanceof Error ? value : new HarnessError(thrownMessage(value), "UNKNOWN", { cause: value });
-	const carried = ownFailureSnapshot(error);
-	if (carried !== void 0 && carried.code === ownErrorCode(error)) return carried;
-	return Object.freeze({
-		message: errorMessage(error),
-		code: harnessErrorCode(error)
-	});
-}
-/** Render a non-Error throw without letting hostile coercion escape normalization. */
-function thrownMessage(value) {
-	try {
-		const message = String(value);
-		return message.length > 0 ? message : "LLM adapter failed";
-	} catch (_hostileThrownValue) {
-		return "LLM adapter failed";
-	}
-}
-/** Read a foreign error's own data-backed `code` without invoking accessors. */
-function ownErrorCode(error) {
-	try {
-		const descriptor = Object.getOwnPropertyDescriptor(error, "code");
-		return descriptor !== void 0 && "value" in descriptor ? descriptor.value : void 0;
-	} catch (_sdkPropertyTrap) {
-		return;
-	}
-}
-/** Snapshot an own data property without invoking an SDK-defined accessor. */
-function ownFailureSnapshot(error) {
-	try {
-		const descriptor = Object.getOwnPropertyDescriptor(error, "failure");
-		return descriptor !== void 0 && "value" in descriptor ? failureSnapshot(descriptor.value) : void 0;
-	} catch (_sdkPropertyTrap) {
-		return;
-	}
-}
-/** Validate and detach an arbitrary serializable failure payload. */
-function failureSnapshot(value) {
-	if (typeof value !== "object" || value === null) return void 0;
-	try {
-		const candidate = value;
-		const message = candidate.message;
-		const code = candidate.code;
-		const status = candidate.status;
-		const providerRetryAfterMs = candidate.providerRetryAfterMs;
-		const requestId = candidate.requestId;
-		const offloadImages = candidate.offloadImages;
-		if (typeof message !== "string" || message.length === 0 || typeof code !== "string" || code.length === 0 || status !== void 0 && (!Number.isInteger(status) || status < 100 || status > 599) || providerRetryAfterMs !== void 0 && (!Number.isFinite(providerRetryAfterMs) || providerRetryAfterMs <= 0) || requestId !== void 0 && (typeof requestId !== "string" || requestId.length === 0) || offloadImages !== void 0 && (!Number.isSafeInteger(offloadImages) || offloadImages <= 0)) return void 0;
-		return Object.freeze({
-			message,
-			code,
-			...status === void 0 ? {} : { status },
-			...providerRetryAfterMs === void 0 ? {} : { providerRetryAfterMs },
-			...requestId === void 0 ? {} : { requestId },
-			...offloadImages === void 0 ? {} : { offloadImages }
-		});
-	} catch (_sdkFailureGetter) {
-		return;
-	}
-}
-/** Read an SDK error message without letting an accessor replace the primary failure. */
-function errorMessage(error) {
-	try {
-		const message = error.message;
-		if (typeof message === "string" && message.length > 0) return message;
-	} catch (_sdkMessageGetter) {}
-	return "LLM adapter failed";
-}
-/** Trust only Harness-owned codes; third-party SDK codes are not our taxonomy. */
-function harnessErrorCode(error) {
-	return error instanceof HarnessError ? error.code : "UNKNOWN";
-}
-function quoted(value) {
-	return JSON.stringify(value);
-}
-/**
-* Stable text shown to a model that cannot accept one durable image reference.
-* @param ref - durable normalized attachment omitted from the request.
-* @returns deterministic text-only placeholder.
-*/
-function textOnlyImageText(ref) {
-	return `[image omitted because this model accepts text only; attachment sha256:${String(ref.attachmentId).slice(7, 15)}]`;
-}
-/**
-* True when typed model content contains an image block. This is the one image
-* walk shared by every image policy (capability gating, text-only
-* serialization, compaction survey), so a consumer cannot silently diverge.
-* @param content - typed model content blocks.
-* @returns whether any block is an image.
-*/
-function contentHasImage(content) {
-	return content.some((block) => block.type === "image");
-}
-/**
-* True when typed model content contains a file block.
-* Reads current content on every call without retaining scan results.
-* @param content - typed model content blocks.
-* @returns whether any block is a file.
-*/
-function contentHasFile(content) {
-	for (const block of content) if (block.type === "file") return true;
-	return false;
-}
-/**
-* Stable model-facing handle for one durable file reference: the address of
-* the verbatim stored copy and the instruction to read it on demand. This is
-* the only representation a provider ever receives for a file.
-* @param ref - durable verbatim file reference.
-* @param readonlyPath - execution-world path of the stored copy, when resolvable.
-* @returns deterministic handle text naming the file, its size, and its address.
-*/
-function fileHandleText(ref, readonlyPath) {
-	const digest = String(ref.attachmentId).slice(7, 15);
-	const identity = `File ${quoted(ref.name)} (${ref.bytes} bytes, sha256:${digest})`;
-	if (readonlyPath === void 0) return `[${identity} was uploaded, but the current execution environment cannot access a readable path. Report that limitation if its contents are needed; do not claim to have read it.]`;
-	return `[${identity}: verbatim read-only copy saved at ${quoted(readonlyPath)}. Read that path with your file tools when its contents are needed; copy it to a writable location before modifying it. When delegating file work, include this saved path in the delegation prompt; only subagents sharing this execution environment can read it.]`;
-}
-/** Replace every file occurrence with handle text. */
-function replaceFilesWithHandles(blocks, resolvePath) {
-	let next;
-	for (const [index, block] of blocks.entries()) {
-		if (block.type === "file") {
-			next ??= blocks.slice(0, index);
-			next.push({
-				type: "text",
-				text: fileHandleText(block.attachment, resolvePath(block.attachment))
-			});
-			continue;
-		}
-		next?.push(block);
-	}
-	return next ?? blocks;
-}
-function projectFilesToText(messages, resolvePath) {
-	if (!messages.some((message) => contentHasFile(message.content))) return messages;
-	return messages.map((message) => {
-		const content = replaceFilesWithHandles(message.content, resolvePath);
-		return content === message.content ? message : {
-			...message,
-			content
-		};
-	});
-}
-/** Replace every image occurrence for a text-only model. */
-function replaceImagesForTextModel(blocks) {
-	let next;
-	for (const [index, block] of blocks.entries()) {
-		if (block.type === "image") {
-			next ??= blocks.slice(0, index);
-			next.push({
-				type: "text",
-				text: textOnlyImageText(block.attachment)
-			});
-			continue;
-		}
-		next?.push(block);
-	}
-	return next ?? blocks;
-}
-function projectImagesForTextModel(messages) {
-	if (!messages.some((message) => contentHasImage(message.content))) return messages;
-	return messages.map((message) => {
-		const content = replaceImagesForTextModel(message.content);
-		return content === message.content ? message : {
-			...message,
-			content
-		};
-	});
-}
-/**
-* Centralize the non-secret product identity every provider request sends as `User-Agent`, keeping
-* adapters from drifting. See
-* `.agents/notes/implemented/architecture/2026-06-21-mandatory-app-attribution-headers.md`.
-*
-* App-attribution vocabulary for provider requests.
-* @module @deepseek-ai/dsh-llm/attribution
-*/
-const { version } = createRequire(import.meta.url)("../package.json");
-/**
-* LLM service: adapter registry with a waterfall-interceptable streaming call
-* API. Exports the `LlmRuntime` default, the abstract `LlmAdapter` for
-* provider backends, and `BlockAssembler` for chunk assembly.
-*
-* @module @deepseek-ai/dsh-llm
-*/
-var __runInitializers = function(thisArg, initializers, value) {
-	var useValue = arguments.length > 2;
-	for (var i = 0; i < initializers.length; i++) value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
-	return useValue ? value : void 0;
-};
-var __esDecorate = function(ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
-	function accept(f) {
-		if (f !== void 0 && typeof f !== "function") throw new TypeError("Function expected");
-		return f;
-	}
-	var kind = contextIn.kind, key = kind === "getter" ? "get" : kind === "setter" ? "set" : "value";
-	var target = !descriptorIn && ctor ? contextIn["static"] ? ctor : ctor.prototype : null;
-	var descriptor = descriptorIn || (target ? Object.getOwnPropertyDescriptor(target, contextIn.name) : {});
-	var _, done = false;
-	for (var i = decorators.length - 1; i >= 0; i--) {
-		var context = {};
-		for (var p in contextIn) context[p] = p === "access" ? {} : contextIn[p];
-		for (var p in contextIn.access) context.access[p] = contextIn.access[p];
-		context.addInitializer = function(f) {
-			if (done) throw new TypeError("Cannot add initializers after decoration has completed");
-			extraInitializers.push(accept(f || null));
-		};
-		var result = (0, decorators[i])(kind === "accessor" ? {
-			get: descriptor.get,
-			set: descriptor.set
-		} : descriptor[key], context);
-		if (kind === "accessor") {
-			if (result === void 0) continue;
-			if (result === null || typeof result !== "object") throw new TypeError("Object expected");
-			if (_ = accept(result.get)) descriptor.get = _;
-			if (_ = accept(result.set)) descriptor.set = _;
-			if (_ = accept(result.init)) initializers.unshift(_);
-		} else if (_ = accept(result)) if (kind === "field") initializers.unshift(_);
-		else descriptor[key] = _;
-	}
-	if (target) Object.defineProperty(target, contextIn.name, descriptor);
-	done = true;
-};
-/**
-* Typed error for LLM-related failures. Extends {@link HarnessError}, so the
-* `code` string (e.g. `AUTH`, `RATE_LIMIT`, `NO_ADAPTER`) is shared taxonomy.
-*/
-var LlmError = class extends HarnessError {
-	/** Serializable facts retained beside this live Error. */
-	failure;
-	/**
-	* @param message - non-empty human-readable failure summary.
-	* @param code - non-empty stable provider-neutral machine code.
-	* @param options - optional cause and validated serializable provider facts.
-	*/
-	constructor(message, code, options) {
-		if (typeof message !== "string" || message.length === 0) throw new Error("LlmError message must be a non-empty string");
-		if (typeof code !== "string" || code.length === 0) throw new Error("LlmError code must be a non-empty string");
-		if (options?.status !== void 0 && (!Number.isInteger(options.status) || options.status < 100 || options.status > 599)) throw new Error("LlmError status must be an integer from 100 through 599");
-		if (options?.providerRetryAfterMs !== void 0 && (!Number.isFinite(options.providerRetryAfterMs) || options.providerRetryAfterMs <= 0)) throw new Error("LlmError providerRetryAfterMs must be a positive finite number");
-		if (options?.requestId !== void 0 && (typeof options.requestId !== "string" || options.requestId.length === 0)) throw new Error("LlmError requestId must be a non-empty string");
-		super(message, code, options);
-		this.name = "LlmError";
-		this.failure = Object.freeze({
-			message,
-			code,
-			...options?.status === void 0 ? {} : { status: options.status },
-			...options?.providerRetryAfterMs === void 0 ? {} : { providerRetryAfterMs: options.providerRetryAfterMs },
-			...options?.requestId === void 0 ? {} : { requestId: options.requestId },
-			...options?.offloadImages === void 0 ? {} : { offloadImages: options.offloadImages }
-		});
-	}
-};
-(() => {
-	let _classSuper = TypertRemoteService;
-	let _instanceExtraInitializers = [];
-	let _listProviders_decorators;
-	let _listConfigurableProviders_decorators;
-	let _remoteDiscoverModels_decorators;
-	return class LlmRuntime extends _classSuper {
-		static {
-			const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
-			_listProviders_decorators = [Remote];
-			_listConfigurableProviders_decorators = [Remote];
-			_remoteDiscoverModels_decorators = [Remote("discoverModels")];
-			__esDecorate(this, null, _listProviders_decorators, {
-				kind: "method",
-				name: "listProviders",
-				static: false,
-				private: false,
-				access: {
-					has: (obj) => "listProviders" in obj,
-					get: (obj) => obj.listProviders
-				},
-				metadata: _metadata
-			}, null, _instanceExtraInitializers);
-			__esDecorate(this, null, _listConfigurableProviders_decorators, {
-				kind: "method",
-				name: "listConfigurableProviders",
-				static: false,
-				private: false,
-				access: {
-					has: (obj) => "listConfigurableProviders" in obj,
-					get: (obj) => obj.listConfigurableProviders
-				},
-				metadata: _metadata
-			}, null, _instanceExtraInitializers);
-			__esDecorate(this, null, _remoteDiscoverModels_decorators, {
-				kind: "method",
-				name: "remoteDiscoverModels",
-				static: false,
-				private: false,
-				access: {
-					has: (obj) => "remoteDiscoverModels" in obj,
-					get: (obj) => obj.remoteDiscoverModels
-				},
-				metadata: _metadata
-			}, null, _instanceExtraInitializers);
-			if (_metadata) Object.defineProperty(this, Symbol.metadata, {
-				enumerable: true,
-				configurable: true,
-				writable: true,
-				value: _metadata
-			});
-		}
-		adapters = (__runInitializers(this, _instanceExtraInitializers), /* @__PURE__ */ new Map());
-		directory = /* @__PURE__ */ new Map();
-		discoveries = /* @__PURE__ */ new Map();
-		constructor(ctx) {
-			super(ctx, "llm");
-		}
-		/** Notify topology observers without letting one broken listener veto the commit. */
-		emitAdaptersUpdated() {
-			let invariantFailure;
-			for (const listener of this.ctx.events.dispatch("emit", ["llm/adapters-updated"])) try {
-				const returned = listener();
-				if (returned != null && typeof returned.then === "function") Promise.resolve(returned).then(void 0, (error) => {
-					this.warnAdaptersListenerFailure(error);
-				});
-			} catch (error) {
-				if (error?.code === "INVARIANT") {
-					invariantFailure ??= error;
-					continue;
-				}
-				this.warnAdaptersListenerFailure(error);
-			}
-			if (invariantFailure !== void 0) throw invariantFailure;
-		}
-		/** Contained-listener diagnostic shared by the sync and async failure paths. */
-		warnAdaptersListenerFailure(error) {
-			this.ctx.logger.warn("llm: an llm/adapters-updated listener failed");
-			this.ctx.logger.warn(error);
-		}
-		/**
-		* Register an adapter for the given provider routes. Throws `LlmError` with code
-		* `DUPLICATE_ADAPTER` if any provider already has an adapter (all-or-nothing).
-		* Disposed with the fiber.
-		* @param providers - every provider route this adapter should serve.
-		* @param adapter - the adapter that streams calls for those providers.
-		* @returns the disposer, carrying {@link AdapterRegistrationHandle.replace}.
-		*/
-		registerAdapter(providers, adapter) {
-			const owned = /* @__PURE__ */ new Set();
-			let released = false;
-			const dispose = this.ctx.effect(function* () {
-				if (providers.length === 0) throw new LlmError("an adapter must register at least one provider", "INVALID_ADAPTER");
-				this.commitRoutes(owned, this.prepareRoutes(providers, adapter, owned));
-				yield () => {
-					released = true;
-					for (const provider of owned) this.adapters.delete(provider);
-					owned.clear();
-					this.emitAdaptersUpdated();
-				};
-			}.bind(this), "llm.registerAdapter()");
-			const handle = (() => void dispose());
-			handle.replace = (next) => {
-				if (released) throw new LlmError("a disposed adapter registration cannot replace its routes", "REGISTRATION_DISPOSED");
-				this.commitRoutes(owned, this.prepareRoutes(next, adapter, owned));
-			};
-			return handle;
-		}
-		/**
-		* Validate one candidate route set for `adapter`, treating routes this
-		* registration already holds as available. Nothing is mutated: a rejected
-		* candidate leaves the registry exactly as it was.
-		*/
-		prepareRoutes(providers, adapter, owned) {
-			const unique = /* @__PURE__ */ new Set();
-			const registrations = [];
-			for (const provider of providers) {
-				if (provider.length === 0) throw new LlmError("adapter provider names must be non-empty", "INVALID_ADAPTER");
-				if (unique.has(provider) || this.adapters.has(provider) && !owned.has(provider)) throw new LlmError(`an adapter for provider "${provider}" is already registered`, "DUPLICATE_ADAPTER");
-				const info = adapter.providerInfo(provider);
-				if (typeof info.id !== "string" || info.id !== provider || typeof info.name !== "string" || info.name.length === 0) throw new LlmError(`adapter metadata for provider "${provider}" must preserve its id and have a non-empty name`, "INVALID_ADAPTER");
-				unique.add(provider);
-				const retryPolicy = adapter.providerRetryPolicy(provider) ?? resolveRetryPolicy(void 0, `llm: provider "${provider}" retryPolicy`);
-				registrations.push({
-					adapter,
-					provider: {
-						id: info.id,
-						name: info.name
-					},
-					retryPolicy
-				});
-			}
-			return registrations;
-		}
-		/**
-		* Swap this registration's routes for the prepared ones in one synchronous
-		* section, so no observer can see the registry between the release and the
-		* re-registration. The route set's one mutation point is also where
-		* `llm/adapters-updated` is published, so a `replace` announces itself
-		* exactly like a first registration.
-		*/
-		commitRoutes(owned, registrations) {
-			for (const provider of owned) this.adapters.delete(provider);
-			owned.clear();
-			for (const registration of registrations) {
-				this.adapters.set(registration.provider.id, registration);
-				owned.add(registration.provider.id);
-			}
-			this.emitAdaptersUpdated();
-		}
-		/**
-		* Describe provider routes with a registered adapter.
-		* @returns detached provider metadata in registration order.
-		*/
-		listProviders() {
-			return [...this.adapters.values()].map(({ provider }) => ({ ...provider }));
-		}
-		/**
-		* Declare provider routes an adapter plugin can activate through
-		* configuration. Registration is all-or-nothing: an empty list, invalid
-		* entry, or a provider already declared by any registration throws
-		* `LlmError` without registering the rest. Disposed with the fiber.
-		* @param entries - every configurable provider this plugin owns.
-		* @returns a handle that withdraws all of them, and can atomically replace them.
-		*/
-		registerConfigurableProviders(entries) {
-			let held = [];
-			let disposed = false;
-			/**
-			* Validate a candidate set in full against everything this registration
-			* does not already hold, then publish it. Nothing is written until the
-			* whole set passes, so a refused candidate leaves the current entries in
-			* place — the property that makes `replace` a swap rather than a
-			* delete-then-add that can strand the directory empty.
-			*/
-			const commit = (candidates) => {
-				const detached = [];
-				const own = new Set(held.map((entry) => entry.provider));
-				for (const entry of candidates) {
-					if (entry.provider.length === 0 || entry.displayName.length === 0 || entry.settingsNs.length === 0) throw new LlmError("configurable providers need a non-empty provider, displayName, and settingsNs", "INVALID_DIRECTORY");
-					if (entry.settingsPath.some((segment) => segment.length === 0)) throw new LlmError(`configurable provider "${entry.provider}" has an empty settingsPath segment`, "INVALID_DIRECTORY");
-					if (this.directory.has(entry.provider) && !own.has(entry.provider) || detached.some((seen) => seen.provider === entry.provider)) throw new LlmError(`configurable provider "${entry.provider}" is already declared`, "DUPLICATE_DIRECTORY");
-					detached.push({
-						...entry,
-						settingsPath: [...entry.settingsPath]
-					});
-				}
-				for (const entry of held) this.directory.delete(entry.provider);
-				for (const entry of detached) this.directory.set(entry.provider, entry);
-				held = detached;
-				this.emitAdaptersUpdated();
-			};
-			const dispose = this.ctx.effect(function* () {
-				if (entries.length === 0) throw new LlmError("a configurable-provider registration must declare at least one provider", "INVALID_DIRECTORY");
-				commit(entries);
-				yield () => {
-					disposed = true;
-					for (const entry of held) this.directory.delete(entry.provider);
-					held = [];
-					this.emitAdaptersUpdated();
-				};
-			}.bind(this), "llm.registerConfigurableProviders()");
-			const handle = (() => void dispose());
-			handle.replace = (next) => {
-				if (disposed) throw new LlmError("this configurable-provider registration was disposed", "REGISTRATION_DISPOSED");
-				commit(next);
-			};
-			return handle;
-		}
-		/**
-		* List every declared configurable provider, registered or dormant.
-		* @returns detached directory entries in declaration order.
-		*/
-		listConfigurableProviders() {
-			return [...this.directory.values()].map((entry) => ({
-				...entry,
-				settingsPath: [...entry.settingsPath]
-			}));
-		}
-		/**
-		* Offer to interrogate provider endpoints on behalf of the settings
-		* namespace this plugin owns. The namespace is the key because that is what
-		* a configuration surface already holds from the configurable-provider
-		* directory, and because a provider being *added* has no route to name yet.
-		* Disposed with the fiber.
-		* @param settingsNs - the namespace whose profiles this discovery serves.
-		* @param discover - interrogates one endpoint and must honor the supplied signal.
-		* @returns the disposer that withdraws the offer.
-		*/
-		registerModelDiscovery(settingsNs, discover) {
-			const dispose = this.ctx.effect(function* () {
-				if (settingsNs.length === 0) throw new LlmError("model discovery needs a non-empty settings namespace", "INVALID_DISCOVERY");
-				if (this.discoveries.has(settingsNs)) throw new LlmError(`model discovery for "${settingsNs}" is already registered`, "DUPLICATE_DISCOVERY");
-				this.discoveries.set(settingsNs, discover);
-				yield () => {
-					this.discoveries.delete(settingsNs);
-				};
-			}.bind(this), "llm.registerModelDiscovery()");
-			return () => void dispose();
-		}
-		/**
-		* Interrogate one provider endpoint for the models it advertises. The
-		* request describes a draft, not a stored route, so nothing here reads or
-		* writes settings or credentials — the caller owns both, and the reply is
-		* candidate metadata a surface may offer for adoption.
-		* @param settingsNs - namespace whose registered discovery serves this draft.
-		* @param request - the endpoint, protocol, and one-shot credential to use.
-		* @param signal - caller cancellation.
-		* @returns the advertised models, deduplicated in endpoint order.
-		*/
-		async discoverModels(settingsNs, request, signal) {
-			const discover = this.discoveries.get(settingsNs);
-			if (discover === void 0) throw new LlmError(`no model discovery is registered for "${settingsNs}"`, "NO_DISCOVERY");
-			if ((request.provider ?? "").length === 0 && (request.baseURL ?? "").length === 0) throw new LlmError("model discovery needs a provider route or a baseURL", "INVALID_DISCOVERY");
-			const discovered = signal === void 0 ? await discover(request) : await discover(request, signal);
-			const seen = /* @__PURE__ */ new Set();
-			const models = [];
-			for (const model of discovered) {
-				if (typeof model.id !== "string" || model.id.length === 0 || seen.has(model.id)) continue;
-				seen.add(model.id);
-				models.push({
-					id: model.id,
-					...model.name === void 0 ? {} : { name: model.name },
-					...model.contextWindow === void 0 ? {} : { contextWindow: model.contextWindow },
-					...model.maxTokens === void 0 ? {} : { maxTokens: model.maxTokens },
-					...model.inputModalities === void 0 ? {} : { inputModalities: [...model.inputModalities] }
-				});
-			}
-			return models;
-		}
-		/**
-		* Remote adapter for one draft provider interrogation.
-		* @param settingsNs - namespace whose registered discovery serves this draft.
-		* @param request - endpoint, protocol, and one-shot credential to use.
-		* @param signal - caller cancellation supplied by the Remote carrier.
-		* @returns advertised models in endpoint order.
-		* @throws RemoteError with `llm/model-discovery-rejected` when discovery refuses or fails.
-		*/
-		async remoteDiscoverModels(settingsNs, request, signal) {
-			try {
-				return await this.discoverModels(settingsNs, request, signal);
-			} catch (error) {
-				throw new RemoteError("llm/model-discovery-rejected", error instanceof Error ? error.message : String(error), {
-					settingsNs,
-					...request.baseURL === void 0 ? {} : { baseURL: request.baseURL }
-				}, { cause: error });
-			}
-		}
-		/**
-		* Resolve the retry policy captured when one provider route was registered.
-		* @param provider - registered provider route to inspect.
-		* @returns the provider-owned policy, with normal defaults already resolved.
-		*/
-		providerRetryPolicy(provider) {
-			return this.registration(provider).retryPolicy;
-		}
-		/**
-		* Resolve provider-side request-image pricing for one exact route, or
-		* `undefined` when the provider is unregistered or declares none. Unknown
-		* providers degrade to `undefined` rather than throwing because callers
-		* price durable history whose route may no longer be mounted.
-		* @param provider - provider route named by a request header.
-		* @param model - exact model id named by the same header.
-		* @returns the owning adapter's image pricing for the route, when declared.
-		*/
-		imageRequestPricing(provider, model) {
-			return this.adapters.get(provider)?.adapter.imageRequestPricing(provider, model);
-		}
-		/**
-		* Resolve the exact text one durable file occurrence contributes to every
-		* provider request in the current execution environment.
-		* @param ref - durable verbatim file reference from model history.
-		* @returns the same deterministic handle text used at adapter dispatch.
-		*/
-		fileRequestText(ref) {
-			return fileHandleText(ref, this.fileReadPath(ref));
-		}
-		/** Detach typed adapter-owned modality metadata. */
-		detachedModalities(modalities) {
-			return modalities === void 0 ? void 0 : [...modalities];
-		}
-		/**
-		* Discover models advertised by one registered provider. Catalog membership
-		* is advisory and never changes routing or request validation.
-		* @param provider - registered provider route to inspect.
-		* @returns detached model metadata in adapter-preferred order.
-		*/
-		async listModels(provider) {
-			const models = await this.registration(provider).adapter.listModels(provider);
-			const seen = /* @__PURE__ */ new Set();
-			return models.map((model) => {
-				if (typeof model.provider !== "string" || model.provider !== provider || typeof model.id !== "string" || model.id.length === 0 || typeof model.name !== "string" || model.name.length === 0 || model.description !== void 0 && typeof model.description !== "string" || seen.has(model.id)) throw new LlmError(`adapter returned invalid or duplicate model metadata for provider "${provider}"`, "INVALID_CATALOG");
-				seen.add(model.id);
-				const inputModalities = this.detachedModalities(model.inputModalities);
-				return {
-					provider: model.provider,
-					id: model.id,
-					name: model.name,
-					...model.description === void 0 ? {} : { description: model.description },
-					...inputModalities === void 0 ? {} : { inputModalities }
-				};
-			});
-		}
-		/**
-		* Resolve and validate all metadata from the adapter that owns one exact
-		* route. The result is detached from adapter-owned objects; catalog
-		* membership remains advisory and does not control request routing.
-		* @param provider - registered provider route to inspect.
-		* @param model - exact model id passed to the adapter.
-		* @param signal - optional cancellation for adapter-owned asynchronous lookup.
-		* @returns exact model identity plus available context and reasoning metadata.
-		*/
-		async resolveModelInfo(provider, model, signal) {
-			return this.resolveModelInfoFor(this.registration(provider), model, signal);
-		}
-		async resolveModelInfoFor(registration, model, signal) {
-			const resolved = await registration.adapter.resolveModel(registration.provider.id, model, signal);
-			return this.normalizeModelInfo(registration, model, resolved);
-		}
-		/** Validate and detach one adapter-returned exact model result. */
-		normalizeModelInfo(registration, model, resolved) {
-			const provider = registration.provider.id;
-			if (typeof resolved.provider !== "string" || resolved.provider !== provider || typeof resolved.id !== "string" || resolved.id !== model || typeof resolved.name !== "string" || resolved.name.length === 0 || resolved.description !== void 0 && typeof resolved.description !== "string") throw new LlmError(`adapter returned invalid exact model metadata for provider "${provider}" model "${model}"`, "INVALID_MODEL_INFO");
-			const context = resolved.context;
-			if (context !== void 0 && (!Number.isInteger(context.contextWindow) || context.contextWindow <= 0)) throw new LlmError(`adapter returned invalid context metadata for provider "${provider}" model "${model}"`, "INVALID_MODEL_CONTEXT");
-			const inputModalities = this.detachedModalities(resolved.inputModalities);
-			const systemPromptUpdate = resolved.systemPromptUpdate;
-			if (systemPromptUpdate !== void 0 && systemPromptUpdate !== "in-history") throw new LlmError(`adapter returned invalid system prompt update mode for provider "${provider}" model "${model}"`, "INVALID_MODEL_INFO");
-			const defaultMaxTokens = resolved.defaultMaxTokens;
-			if (defaultMaxTokens !== void 0 && (!Number.isSafeInteger(defaultMaxTokens) || defaultMaxTokens <= 0)) throw new LlmError(`adapter returned invalid default maxTokens for provider "${provider}" model "${model}"`, "INVALID_MODEL_MAX_TOKENS");
-			const info = {
-				provider,
-				id: model,
-				name: resolved.name,
-				...resolved.description === void 0 ? {} : { description: resolved.description },
-				...inputModalities === void 0 ? {} : { inputModalities },
-				...context === void 0 ? {} : { context: { contextWindow: context.contextWindow } },
-				...defaultMaxTokens === void 0 ? {} : { defaultMaxTokens },
-				...resolved.systemPromptUpdate === void 0 ? {} : { systemPromptUpdate: resolved.systemPromptUpdate }
-			};
-			const reasoning = resolved.reasoning;
-			if (reasoning === void 0) return info;
-			if (reasoning.efforts.length === 0) throw new LlmError(`adapter returned invalid reasoning metadata for provider "${provider}" model "${model}"`, "INVALID_MODEL_REASONING");
-			const seen = /* @__PURE__ */ new Set();
-			const efforts = reasoning.efforts.map((effort) => {
-				if (typeof effort.id !== "string" || effort.id.length === 0 || typeof effort.name !== "string" || effort.name.length === 0 || effort.description !== void 0 && typeof effort.description !== "string" || seen.has(effort.id)) throw new LlmError(`adapter returned invalid or duplicate reasoning effort metadata for provider "${provider}" model "${model}"`, "INVALID_MODEL_REASONING");
-				seen.add(effort.id);
-				return {
-					id: effort.id,
-					name: effort.name,
-					...effort.description === void 0 ? {} : { description: effort.description }
-				};
-			});
-			if (reasoning.defaultEffort !== void 0 && !seen.has(reasoning.defaultEffort)) throw new LlmError(`adapter returned an unknown default reasoning effort for provider "${provider}" model "${model}"`, "INVALID_MODEL_REASONING");
-			return {
-				...info,
-				reasoning: {
-					efforts,
-					...reasoning.defaultEffort === void 0 ? {} : { defaultEffort: reasoning.defaultEffort }
-				}
-			};
-		}
-		/**
-		* Validate a conversation call config against its exact model capability and
-		* materialize adapter-configured defaults. Unsupported explicit efforts
-		* reject before provider I/O; no clamping or aliasing is performed. This
-		* standalone query does not bind a later dispatch; use {@link prepareCall}
-		* when logging and streaming must share one adapter registration.
-		* @param config - provider/model route and optional request controls.
-		* @param signal - optional cancellation for adapter-owned capability lookup.
-		* @returns a detached config only when a default must be materialized.
-		*/
-		async resolveCallConfig(config, signal) {
-			return (await this.resolveCallFor(this.registration(config.provider), config, signal)).config;
-		}
-		async resolveCallFor(registration, config, signal) {
-			const info = await this.resolveModelInfoFor(registration, config.model, signal);
-			return this.resolveCallWithInfo(config, info);
-		}
-		/** Validate request controls against one already-bound exact model result. */
-		resolveCallWithInfo(config, info) {
-			const defaulted = config.maxTokens === void 0 && info.defaultMaxTokens !== void 0 ? {
-				...config,
-				maxTokens: info.defaultMaxTokens
-			} : config;
-			const reasoning = info.reasoning;
-			const requested = defaulted.reasoningEffort;
-			let resolvedConfig = defaulted;
-			if (reasoning === void 0) {
-				if (requested !== void 0) throw new LlmError(`provider "${config.provider}" model "${config.model}" does not support reasoning effort "${requested}"`, "UNSUPPORTED_REASONING_EFFORT");
-			} else {
-				const effective = requested ?? reasoning.defaultEffort;
-				if (effective !== void 0) {
-					if (!reasoning.efforts.some((effort) => effort.id === effective)) throw new LlmError(`provider "${config.provider}" model "${config.model}" does not support reasoning effort "${effective}"`, "UNSUPPORTED_REASONING_EFFORT");
-					if (requested !== effective) resolvedConfig = {
-						...defaulted,
-						reasoningEffort: effective
-					};
-				}
-			}
-			return {
-				config: resolvedConfig,
-				...info.context === void 0 ? {} : { context: info.context },
-				modelInfo: info
-			};
-		}
-		/**
-		* Resolve one call under its current adapter registration. The returned
-		* one-shot handle keeps that registration across header logging and dispatch,
-		* so HMR cannot combine one adapter's capability result with another adapter.
-		* @param config - provider/model route and optional request controls.
-		* @param signal - optional cancellation for adapter-owned capability lookup.
-		* @returns a prepared config and its registration-bound stream entry point.
-		*/
-		async prepareCall(config, signal) {
-			const registration = this.registration(config.provider);
-			const adapterCall = await registration.adapter.prepareCall(config.provider, config.model, signal);
-			const modelInfo = this.normalizeModelInfo(registration, config.model, adapterCall.model);
-			const resolved = this.resolveCallWithInfo(config, modelInfo);
-			const resolvedConfig = deepFreeze(structuredClone(resolved.config));
-			const context = resolved.context === void 0 ? void 0 : deepFreeze(structuredClone(resolved.context));
-			const adapterDefaults = deepFreeze({
-				...config.reasoningEffort === void 0 && resolvedConfig.reasoningEffort !== void 0 ? { reasoningEffort: true } : {},
-				...config.maxTokens === void 0 && resolvedConfig.maxTokens !== void 0 ? { maxTokens: true } : {}
-			});
-			let dispatched = false;
-			return Object.freeze({
-				config: resolvedConfig,
-				retryPolicy: registration.retryPolicy,
-				adapterDefaults,
-				...context === void 0 ? {} : { context },
-				...modelInfo.inputModalities === void 0 ? {} : { inputModalities: Object.freeze([...modelInfo.inputModalities]) },
-				...modelInfo.systemPromptUpdate === void 0 ? {} : { systemPromptUpdate: modelInfo.systemPromptUpdate },
-				stream: (options) => {
-					if (dispatched) throw new LlmError("a prepared LLM call can only be dispatched once", "INVALID_PREPARED_CALL");
-					if (!callConfigEquals(options, resolvedConfig)) throw new LlmError("prepared LLM call config changed before adapter dispatch", "INVALID_PREPARED_CALL");
-					dispatched = true;
-					return this.streamWithRegistration(options, {
-						registration,
-						config: resolvedConfig,
-						modelInfo,
-						dispatch: (options) => adapterCall.stream(options)
-					});
-				}
-			});
-		}
-		registration(provider) {
-			const registration = this.adapters.get(provider);
-			if (!registration) throw new LlmError(`no adapter registered for provider "${provider}"`, "NO_ADAPTER");
-			return registration;
-		}
-		/** Remove replay state whose historical route is owned by another adapter. */
-		forAdapter(options, adapter) {
-			const messages = options.messages.map((message) => {
-				if (message.role !== "assistant") return message;
-				const source = message.source;
-				if (source.replayState === void 0) return message;
-				if (this.adapters.get(source.provider)?.adapter === adapter) return message;
-				return freezeMessage({
-					...message,
-					source: {
-						kind: "model",
-						provider: source.provider,
-						model: source.model
-					}
-				});
-			});
-			if (messages.every((message, index) => message === options.messages[index])) return options;
-			const filtered = {
-				...options,
-				messages
-			};
-			return Object.isFrozen(options) ? deepFreeze(filtered) : filtered;
-		}
-		/**
-		* Resolve the current execution-world read path of one durable file
-		* reference through the mounted attachment and filesystem providers.
-		*/
-		fileReadPath(ref) {
-			let hostPath;
-			try {
-				hostPath = this.ctx.get("attachments")?.fileHostPath(ref);
-			} catch {
-				return;
-			}
-			if (hostPath === void 0) return void 0;
-			return this.ctx.get("fs")?.processPathFromHostPath(hostPath);
-		}
-		/**
-		* Final adapter boundary. Adapter selection, dispatch, iterator construction,
-		* and iteration failures become one terminal failure chunk. Middleware and
-		* downstream consumer failures remain thrown plugin or consumer errors.
-		*/
-		async *adapterStream(options, prepared) {
-			let iterator;
-			try {
-				const registration = prepared?.registration ?? this.registration(options.provider);
-				const adapter = registration.adapter;
-				let modelInfo;
-				let resolvedConfig;
-				let dispatch;
-				if (prepared === void 0) {
-					const adapterCall = await adapter.prepareCall(options.provider, options.model, options.signal);
-					modelInfo = this.normalizeModelInfo(registration, options.model, adapterCall.model);
-					resolvedConfig = this.resolveCallWithInfo(options, modelInfo).config;
-					dispatch = (options) => adapterCall.stream(options);
-				} else {
-					modelInfo = prepared.modelInfo;
-					resolvedConfig = prepared.config;
-					dispatch = prepared.dispatch;
-				}
-				if (prepared !== void 0 && !callConfigEquals(options, resolvedConfig)) throw new LlmError("prepared LLM call config changed before adapter dispatch", "INVALID_PREPARED_CALL");
-				const resolvedOptions = callConfigEquals(options, resolvedConfig) ? options : Object.isFrozen(options) ? deepFreeze({
-					...options,
-					...resolvedConfig
-				}) : {
-					...options,
-					...resolvedConfig
-				};
-				let projectedMessages = resolvedOptions.messages;
-				if (projectedMessages.some((message) => contentHasFile(message.content))) projectedMessages = projectFilesToText(projectedMessages, (ref) => this.fileReadPath(ref));
-				if (modelInfo.inputModalities !== void 0 && !modelInfo.inputModalities.includes("image") && projectedMessages.some((message) => contentHasImage(message.content))) projectedMessages = projectImagesForTextModel(projectedMessages);
-				const projectedOptions = projectedMessages === resolvedOptions.messages ? resolvedOptions : Object.isFrozen(resolvedOptions) ? deepFreeze({
-					...resolvedOptions,
-					messages: projectedMessages
-				}) : {
-					...resolvedOptions,
-					messages: projectedMessages
-				};
-				iterator = dispatch(this.forAdapter(projectedOptions, adapter))[Symbol.asyncIterator]();
-			} catch (error) {
-				yield adapterFailureChunk(error, options.signal);
-				return;
-			}
-			let completed = false;
-			try {
-				while (true) {
-					let item;
-					try {
-						const next = await iterator.next();
-						item = next.done ? { done: true } : {
-							done: false,
-							value: next.value
-						};
-					} catch (error) {
-						completed = true;
-						yield adapterFailureChunk(error, options.signal);
-						return;
-					}
-					if (item.done) {
-						completed = true;
-						return;
-					}
-					yield item.value;
-				}
-			} finally {
-				if (!completed) {
-					const close = iterator.return?.bind(iterator);
-					if (close) await close();
-				}
-			}
-		}
-		/**
-		* Stream one model call as raw chunks (token-level deltas). Replay state is
-		* retained only when the same adapter instance owns its historical provider
-		* and the target provider. Final adapter selection remains fixed through
-		* asynchronous exact-model resolution and dispatch. Adapter selection,
-		* dispatch, and iteration failures become terminal `error` or `aborted`
-		* finish chunks; middleware, nested-call, cleanup, and consumer failures
-		* remain thrown.
-		* @param options - the full request; `options.provider` selects the adapter.
-		* @returns the chunk stream, possibly wrapped by `llm/stream` listeners.
-		*/
-		stream(options) {
-			return this.streamWithRegistration(options);
-		}
-		streamWithRegistration(options, prepared) {
-			return this.ctx.waterfall(this, "llm/stream", options, () => this.adapterStream(options, prepared));
-		}
-	};
-})();
-/** Convert one adapter throw into the stream protocol's terminal outcome. */
-function adapterFailureChunk(error, signal) {
-	const failure = normalizeLlmFailure(error);
-	return {
-		type: "finish",
-		reason: signal?.aborted || failure.code === "ABORTED" ? {
-			kind: "aborted",
-			failure
-		} : {
-			kind: "error",
-			failure
-		}
-	};
+		if (!(typeof stream.listenerCount === "function" && stream.listenerCount("error") > 0)) stream.on("error", () => {});
+	}
+}
+/**
+* Defensively log to console.error without letting stderr write failures
+* (e.g. ENOSPC from SyncWriteStream on redirected logs) crash the host process.
+*/
+function safeConsoleError(message, ...args) {
+	try {
+		console.error(message, ...args);
+	} catch {}
 }
 //#endregion
 //#region src/host-ai.ts
@@ -4554,6 +4127,780 @@ async function parseTaskDraft(llm, request, signal) {
 	}
 }
 //#endregion
+//#region src/host/agent-tools.ts
+/** Model-facing JSON rendering shared by every tool. */
+function renderJson(_args, value) {
+	return [{
+		type: "text",
+		text: JSON.stringify(value, null, 2)
+	}];
+}
+/** Mark an already JSON-safe projection as the tool's canonical value. */
+function json(value) {
+	return value;
+}
+/** A domain refusal the model is expected to read and act on. */
+function refused(code, message) {
+	return json({
+		ok: false,
+		code,
+		message
+	});
+}
+function messageOf(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+function has(value, key) {
+	return Object.prototype.hasOwnProperty.call(value, key);
+}
+/**
+* The calling session id, for the execution audit trail (the same stamp the
+* browser asserts). Absent when a call has no agent behind it.
+*/
+function callingSessionId(exec) {
+	const agent = exec.agent;
+	const id = agent?.session?.id ?? agent?.session?.header?.id;
+	return typeof id === "string" && id !== "" ? id : void 0;
+}
+function scheduleView(schedule) {
+	return {
+		enabled: schedule.enabled,
+		cron: schedule.cron,
+		...schedule.nextRunAt === void 0 ? {} : { nextRunAt: schedule.nextRunAt },
+		...schedule.lastTriggeredAt === void 0 ? {} : { lastTriggeredAt: schedule.lastTriggeredAt }
+	};
+}
+function tagView(tag) {
+	return {
+		name: tag.name,
+		...tag.promptPrefix === void 0 ? {} : { promptPrefix: tag.promptPrefix }
+	};
+}
+function executionView(execution) {
+	return {
+		id: execution.id,
+		...execution.sessionId === void 0 ? {} : { sessionId: execution.sessionId },
+		startedAt: execution.startedAt,
+		...execution.endedAt === void 0 ? {} : { endedAt: execution.endedAt },
+		...execution.result === void 0 ? {} : { result: execution.result },
+		...execution.error === void 0 ? {} : { error: execution.error },
+		...execution.initiatedBy === void 0 ? {} : { initiatedBy: execution.initiatedBy },
+		...execution.runGroupId === void 0 ? {} : { cascade: true },
+		...execution.ownResult === void 0 ? {} : {
+			ownResult: execution.ownResult,
+			awaitingSubtasks: execution.endedAt === void 0
+		}
+	};
+}
+/**
+* One compact task row for the model: identity, column, lineage, execution
+* targets, schedule, and the latest run. The prompt body rides only
+* task_board_get, so a fifty-task list stays readable.
+*/
+function taskSummary(task, tasks, sessionDefault) {
+	const latest = task.executions.at(-1);
+	const subtaskCount = directSubtasks(tasks, task.id).length;
+	return {
+		id: task.id,
+		title: task.title,
+		status: task.status,
+		description: task.description,
+		...task.parentId === void 0 ? {} : { parentId: task.parentId },
+		...subtaskCount === 0 ? {} : { subtaskCount },
+		...task.archivedAt === void 0 ? {} : { archivedAt: task.archivedAt },
+		...task.tags === void 0 ? {} : { tags: task.tags.map(tagView) },
+		...task.workspaceId === void 0 ? {} : { workspaceId: task.workspaceId },
+		...task.mode === void 0 ? {} : { mode: task.mode },
+		...task.permission === void 0 ? {} : { permission: task.permission },
+		...task.model === void 0 ? {} : { model: task.model },
+		...task.reuseSession === true ? { reuseSession: true } : {},
+		...task.teamRun === true ? { teamRun: true } : {},
+		...task.schedule === void 0 ? {} : { schedule: scheduleView(task.schedule) },
+		...task.freeze === void 0 ? {} : { continuationCard: true },
+		...task.permissionConfirmedAt === void 0 ? {} : { permissionConfirmedAt: task.permissionConfirmedAt },
+		...requiresPermissionConfirmation(task, sessionDefault ?? "read-only") ? { permissionPending: true } : {},
+		executionCount: task.executions.length,
+		...latest === void 0 ? {} : { latestExecution: executionView(latest) },
+		createdAt: task.createdAt,
+		updatedAt: task.updatedAt
+	};
+}
+/** One task's full detail: content, lineage, schedule, and recent runs. */
+function taskDetail(task, tasks, sessionDefault) {
+	const parent = task.parentId === void 0 ? void 0 : tasks.find((item) => item.id === task.parentId);
+	return {
+		...taskSummary(task, tasks, sessionDefault),
+		prompt: task.prompt,
+		depth: taskDepth(tasks, task.id),
+		...parent === void 0 ? {} : { parent: {
+			id: parent.id,
+			title: parent.title,
+			status: parent.status
+		} },
+		...task.freeze === void 0 ? {} : { freeze: {
+			goal: task.freeze.goal,
+			progress: task.freeze.progress,
+			next: task.freeze.next,
+			frozenAt: task.freeze.frozenAt,
+			...task.freeze.frozenBy === void 0 ? {} : { frozenBy: task.freeze.frozenBy },
+			...task.freeze.redacted === true ? { redacted: true } : {}
+		} },
+		...task.handover === void 0 ? {} : { handover: {
+			...task.handover.workspaceId === void 0 ? {} : { workspaceId: task.handover.workspaceId },
+			...task.handover.mode === void 0 ? {} : { mode: task.handover.mode },
+			...task.handover.permission === void 0 ? {} : { permission: task.handover.permission },
+			references: task.handover.references,
+			bundledAt: task.handover.bundledAt
+		} },
+		subtasks: directSubtasks(tasks, task.id).map((child) => taskSummary(child, tasks, sessionDefault)),
+		executions: task.executions.slice(-10).map(executionView)
+	};
+}
+/** The executions a run opened: everything that was not in the ledger before. */
+function openedExecutions(before, after) {
+	const known = new Set(before.map((execution) => execution.id));
+	return after.filter((execution) => !known.has(execution.id));
+}
+/** Board summary attached to task_board_list. */
+function boardView(snapshot, maxSubtaskDepth) {
+	const counts = {
+		backlog: 0,
+		todo: 0,
+		running: 0,
+		done: 0,
+		failed: 0,
+		archived: 0
+	};
+	for (const task of snapshot.tasks) if (task.archivedAt !== void 0) counts.archived += 1;
+	else counts[task.status] += 1;
+	return {
+		revision: snapshot.revision,
+		timeZone: snapshot.scheduler.timeZone,
+		...snapshot.scheduler.error === void 0 ? {} : { schedulerError: snapshot.scheduler.error },
+		maxSubtaskDepth,
+		sessionDefaultPermission: snapshot.sessionDefaultPermission ?? "read-only",
+		runningSessions: snapshot.power.runningSessions,
+		armedSchedules: snapshot.power.armedSchedules,
+		counts
+	};
+}
+/**
+* Build every task-board tool bound to one Host service.
+* @param host - the Host ledger/service face (TaskBoardHostService).
+* @returns the tool definitions, in TASK_BOARD_TOOL_NAMES order.
+*/
+function buildTaskBoardTools(host) {
+	return [
+		buildListTool(host),
+		buildGetTool(host),
+		buildCreateTool(host),
+		buildUpdateTool(host),
+		buildSetParentTool(host),
+		buildRunTool(host),
+		buildManageTool(host),
+		buildScheduleTool(host)
+	];
+}
+function buildSetParentTool(host) {
+	return defineTool({
+		name: "task_board_set_parent",
+		description: [
+			"Attach an existing task under a parent (making it a subtask) or detach it back to the root board by setting its parentId.",
+			"Pass an empty parentId to detach.",
+			"The Host refuses the link when the parent is unknown or archived, when the moved task is one of its own descendants, when the resulting depth exceeds the deployment subtask limit (default one level, maximum three), or while the task has an unsettled execution (its link may still be a running cascade parent pointer).",
+			"Running a task runs its whole subtree concurrently; a parent card settles only after its own turn and every direct subtask settle.",
+			"Triggers: 任务看板, task board, 看板, 子任务, subtask, 关联任务, link task, 解除关联, detach."
+		].join(" "),
+		parameters: {
+			taskId: {
+				type: "string",
+				required: true,
+				description: "The task whose parent link changes."
+			},
+			parentId: {
+				type: "string",
+				required: true,
+				description: "Parent task id, or an empty string to detach the task back to the root board."
+			}
+		},
+		output: {
+			schema: { type: "json" },
+			render: renderJson
+		},
+		async execute(args, exec) {
+			try {
+				const snapshot = host.apply(crypto.randomUUID(), {
+					kind: "set-parent",
+					taskId: args.taskId,
+					parentId: args.parentId === "" ? null : args.parentId
+				}, callingSessionId(exec));
+				const task = snapshot.tasks.find((item) => item.id === args.taskId);
+				if (task === void 0) return refused("task-not-found", "no task with id " + args.taskId);
+				return json({
+					ok: true,
+					task: taskSummary(task, snapshot.tasks, snapshot.sessionDefaultPermission)
+				});
+			} catch (error) {
+				return refused("refused", messageOf(error));
+			}
+		}
+	});
+}
+function buildRunTool(host) {
+	return defineTool({
+		name: "task_board_run",
+		description: [
+			"Run a task on the board now, or re-run a settled one.",
+			"Running a task also runs its whole subtask tree CONCURRENTLY: the Host opens one real DSH session per member under one run group, each replaying its card pinned workspace, agent preset, permission and model; a subtask that does not pin them inherits its nearest ancestor.",
+			"The parent card stays in the running column until its own turn and every direct subtask have settled, and it fails when any member failed; one failing subtask never stops the others.",
+			"A card whose effective permission is above the deployment session default is refused with confirmation-required until a HUMAN confirms the binding in the board UI; this tool cannot confirm it.",
+			"A card whose task carries teamRun instead starts ONE Team Lead session and the Host spawns a teammate per subtask inside it, so those cards run as an Agent Team rather than as independent sessions; that mode needs the deployment Agent Teams service and is refused when it is missing.",
+			"Executions consume real API quota. Sessions are created asynchronously, so read their ids and outcomes back with task_board_get.",
+			"Triggers: 任务看板, task board, 看板, 执行任务, run task, 重新执行, rerun, 子任务, subtask."
+		].join(" "),
+		parameters: {
+			taskId: {
+				type: "string",
+				required: true,
+				description: "The task to run; running a root task runs its whole subtree."
+			},
+			rerun: {
+				type: "boolean",
+				description: "Re-run a settled task: reset its column to todo before starting (default false)."
+			}
+		},
+		output: {
+			schema: { type: "json" },
+			render: renderJson
+		},
+		async execute(args, exec) {
+			const before = host.snapshot();
+			try {
+				const snapshot = host.apply(crypto.randomUUID(), {
+					kind: args.rerun === true ? "rerun" : "run",
+					taskId: args.taskId
+				}, callingSessionId(exec));
+				const beforeById = new Map(before.tasks.map((task) => [task.id, task]));
+				const started = snapshot.tasks.flatMap((task) => {
+					return openedExecutions(beforeById.get(task.id)?.executions ?? [], task.executions).map((execution) => ({
+						taskId: task.id,
+						title: task.title,
+						executionId: execution.id,
+						...execution.sessionId === void 0 ? {} : { sessionId: execution.sessionId }
+					}));
+				});
+				const root = snapshot.tasks.find((task) => task.id === args.taskId);
+				return json({
+					ok: true,
+					started,
+					...root === void 0 ? {} : { task: taskSummary(root, snapshot.tasks, snapshot.sessionDefaultPermission) },
+					note: "Executions run asynchronously; call task_board_get to read session ids and the settled outcome. The parent settles only after its own turn and every direct subtask settle."
+				});
+			} catch (error) {
+				const message = messageOf(error);
+				return refused(message.startsWith("confirmation-required") ? "confirmation-required" : "refused", message);
+			}
+		}
+	});
+}
+function buildManageTool(host) {
+	return defineTool({
+		name: "task_board_manage",
+		description: [
+			"Move, archive, restore, or delete one task board card.",
+			"move-todo and move-backlog are the manual column moves; a running card cannot be moved.",
+			"archive takes the whole subtask tree off the board and is refused while any member has an unsettled execution; restore brings the task, its ancestors and its subtree back; delete removes one card and is refused while it still has subtasks (detach or delete them first) or while it runs.",
+			"It cannot confirm a permission binding: the confirmation gate is a human act performed in the board UI.",
+			"Triggers: 任务看板, task board, 看板, 归档, archive, 删除任务, delete task, 移动任务, move task."
+		].join(" "),
+		parameters: {
+			taskId: {
+				type: "string",
+				required: true,
+				description: "The task to act on."
+			},
+			action: {
+				type: "string",
+				required: true,
+				enum: [
+					"move-todo",
+					"move-backlog",
+					"archive",
+					"restore",
+					"delete"
+				],
+				description: "The lifecycle operation to perform."
+			}
+		},
+		output: {
+			schema: { type: "json" },
+			render: renderJson
+		},
+		async execute(args, exec) {
+			const initiator = callingSessionId(exec);
+			const action = {
+				"move-todo": {
+					kind: "move",
+					taskId: args.taskId,
+					status: "todo"
+				},
+				"move-backlog": {
+					kind: "move",
+					taskId: args.taskId,
+					status: "backlog"
+				},
+				archive: {
+					kind: "archive",
+					taskId: args.taskId
+				},
+				restore: {
+					kind: "restore",
+					taskId: args.taskId
+				},
+				delete: {
+					kind: "delete",
+					taskId: args.taskId
+				}
+			}[args.action];
+			if (action === void 0) return refused("unknown-action", "unsupported action " + args.action);
+			if (!host.snapshot().tasks.some((task) => task.id === args.taskId)) return refused("task-not-found", "no task with id " + args.taskId);
+			try {
+				const snapshot = host.apply(crypto.randomUUID(), action, initiator);
+				if (args.action === "delete") return json({
+					ok: true,
+					action: args.action,
+					taskId: args.taskId
+				});
+				const task = snapshot.tasks.find((item) => item.id === args.taskId);
+				if (task === void 0) return refused("task-not-found", "no task with id " + args.taskId);
+				return json({
+					ok: true,
+					action: args.action,
+					task: taskSummary(task, snapshot.tasks, snapshot.sessionDefaultPermission)
+				});
+			} catch (error) {
+				return refused("refused", messageOf(error));
+			}
+		}
+	});
+}
+function buildScheduleTool(host) {
+	return defineTool({
+		name: "task_board_schedule",
+		description: [
+			"Arm, change, or disarm a task scheduled runs (5-field cron in the Host local time zone; day-of-month and day-of-week use OR semantics).",
+			"A due scheduled task runs the same cascade a manual run does, so a root task runs its whole subtask tree.",
+			"A schedule whose tree contains an unconfirmed above-default permission is refused and rolls to its next occurrence; the reason is reported in the list board summary as schedulerError.",
+			"Missed occurrences during Host downtime are skipped, never queued; a task that is already running skips its occurrence.",
+			"Triggers: 任务看板, task board, 看板, 定时任务, schedule, cron, 每天执行."
+		].join(" "),
+		parameters: {
+			taskId: {
+				type: "string",
+				required: true,
+				description: "The task whose schedule changes."
+			},
+			enabled: {
+				type: "boolean",
+				description: "Arm (true) or disarm (false) the schedule."
+			},
+			cron: {
+				type: "string",
+				description: "5-field cron expression: minute hour day-of-month month day-of-week."
+			}
+		},
+		output: {
+			schema: { type: "json" },
+			render: renderJson
+		},
+		async execute(args, exec) {
+			if (args.enabled === void 0 && args.cron === void 0) return refused("nothing-to-change", "pass enabled and/or cron");
+			if (!host.snapshot().tasks.some((task) => task.id === args.taskId)) return refused("task-not-found", "no task with id " + args.taskId);
+			const patch = {
+				...args.enabled === void 0 ? {} : { enabled: args.enabled },
+				...args.cron === void 0 ? {} : { cron: args.cron }
+			};
+			try {
+				const snapshot = host.apply(crypto.randomUUID(), {
+					kind: "set-schedule",
+					taskId: args.taskId,
+					patch
+				}, callingSessionId(exec));
+				const task = snapshot.tasks.find((item) => item.id === args.taskId);
+				if (task === void 0) return refused("task-not-found", "no task with id " + args.taskId);
+				return json({
+					ok: true,
+					schedule: task.schedule === void 0 ? null : scheduleView(task.schedule),
+					task: taskSummary(task, snapshot.tasks, snapshot.sessionDefaultPermission)
+				});
+			} catch (error) {
+				return refused("refused", messageOf(error));
+			}
+		}
+	});
+}
+function buildListTool(host) {
+	return defineTool({
+		name: "task_board_list",
+		description: [
+			"List tasks on the DSH task board (the Host-authoritative ledger behind the Web GUI task board).",
+			"Filters: status column, parentId (direct subtasks), rootsOnly, tag, free-text query, and archived inclusion.",
+			"Returns each task id, title, column, parent/subtask link, execution targets, schedule and latest run outcome, plus the board summary (revision, time zone, subtask depth limit, session-default permission).",
+			"Use task_board_get for one task in full, task_board_create to add work, and task_board_run to execute it.",
+			"Triggers: 任务看板, task board, 看板, 子任务, subtask, task list, 定时任务, scheduled task."
+		].join(" "),
+		parameters: {
+			status: {
+				type: "string",
+				enum: [
+					"backlog",
+					"todo",
+					"running",
+					"done",
+					"failed"
+				],
+				description: "Only cards in this column."
+			},
+			parentId: {
+				type: "string",
+				description: "Only the direct subtasks of this task id."
+			},
+			rootsOnly: {
+				type: "boolean",
+				description: "Only tasks that have no parent (default false)."
+			},
+			includeArchived: {
+				type: "boolean",
+				description: "Include archived tasks (default false)."
+			},
+			tag: {
+				type: "string",
+				description: "Only tasks carrying this label name."
+			},
+			query: {
+				type: "string",
+				description: "Case-insensitive match against title, description, prompt, and label names."
+			},
+			limit: {
+				type: "integer",
+				description: "Maximum rows to return (default 50, maximum 200)."
+			}
+		},
+		output: {
+			schema: { type: "json" },
+			render: renderJson
+		},
+		isConcurrencySafe: () => true,
+		async execute(args) {
+			const snapshot = host.snapshot();
+			const needle = typeof args.query === "string" ? args.query.trim().toLowerCase() : "";
+			const limit = Math.min(Math.max(typeof args.limit === "number" ? Math.trunc(args.limit) : 50, 1), 200);
+			const matched = snapshot.tasks.filter((task) => {
+				if (args.includeArchived !== true && task.archivedAt !== void 0) return false;
+				if (args.status !== void 0 && task.status !== args.status) return false;
+				if (args.parentId !== void 0 && task.parentId !== args.parentId) return false;
+				if (args.rootsOnly === true && task.parentId !== void 0) return false;
+				if (args.tag !== void 0 && !(task.tags ?? []).some((tag) => tag.name === args.tag)) return false;
+				if (needle !== "") {
+					if (![
+						task.title,
+						task.description,
+						task.prompt,
+						...(task.tags ?? []).map((tag) => tag.name)
+					].join("\n").toLowerCase().includes(needle)) return false;
+				}
+				return true;
+			});
+			return json({
+				ok: true,
+				board: boardView(snapshot, snapshot.maxSubtaskDepth ?? 1),
+				total: matched.length,
+				count: Math.min(matched.length, limit),
+				tasks: matched.slice(0, limit).map((task) => taskSummary(task, snapshot.tasks, snapshot.sessionDefaultPermission))
+			});
+		}
+	});
+}
+function buildGetTool(host) {
+	return defineTool({
+		name: "task_board_get",
+		description: [
+			"Read one task board card in full: prompt, description, labels, column, parent link, direct subtasks, execution targets, schedule, permission gate state, and the last ten execution attempts with their session ids and outcomes.",
+			"Use it before running or editing a card, and after a run to read the settled outcome.",
+			"Triggers: 任务看板, task board, 看板, 子任务, subtask, task detail."
+		].join(" "),
+		parameters: { taskId: {
+			type: "string",
+			required: true,
+			description: "Task id, as reported by task_board_list or task_board_create."
+		} },
+		output: {
+			schema: { type: "json" },
+			render: renderJson
+		},
+		isConcurrencySafe: () => true,
+		async execute(args) {
+			const snapshot = host.snapshot();
+			const task = snapshot.tasks.find((item) => item.id === args.taskId);
+			if (task === void 0) return refused("task-not-found", "no task with id " + args.taskId);
+			return json({
+				ok: true,
+				task: taskDetail(task, snapshot.tasks, snapshot.sessionDefaultPermission)
+			});
+		}
+	});
+}
+function buildCreateTool(host) {
+	return defineTool({
+		name: "task_board_create",
+		description: [
+			"Create a task on the DSH task board, or a subtask by passing parentId.",
+			"A subtask inherits every execution target it does not override (workspace, agent preset, permission, model) from its parent, and inherits the parent human permission confirmation together with an inherited binding.",
+			"The deployment caps subtask depth (default one level, maximum three): a subtask of a subtask is refused unless the board is configured deeper.",
+			"The task lands in the todo column and does NOT run; call task_board_run to execute it.",
+			"Triggers: 任务看板, task board, 看板, 新建任务, create task, 子任务, subtask, 定时任务."
+		].join(" "),
+		parameters: {
+			title: {
+				type: "string",
+				required: true,
+				description: "Short display title (one line)."
+			},
+			description: {
+				type: "string",
+				description: "Longer human description shown in the detail view."
+			},
+			prompt: {
+				type: "string",
+				description: "The instruction sent to the execution agent; the title is used when blank."
+			},
+			parentId: {
+				type: "string",
+				description: "Parent task id, making this a subtask. Omit for a root task."
+			},
+			workspaceId: {
+				type: "string",
+				description: "Workspace id the execution must run in; omit to inherit the parent value or use the most recent workspace."
+			},
+			mode: {
+				type: "string",
+				description: "Agent preset id the execution session is composed from; omit for the deployment default or the parent value."
+			},
+			permission: {
+				type: "string",
+				enum: [...TASK_PERMISSIONS],
+				description: "Permission preset for the execution session. Omit to inherit the parent binding; a value above the session default needs a human confirmation in the board UI before the card can run."
+			},
+			model: {
+				type: "string",
+				description: "Pinned model as provider/model (or a model id); omit for the host default or the parent value."
+			},
+			reuseSession: {
+				type: "boolean",
+				description: "Continue later runs in the previous execution session instead of a fresh conversation."
+			},
+			teamRun: {
+				type: "boolean",
+				description: "Run this task as an Agent Team: running it starts one Team Lead session and the Host spawns a teammate per subtask inside it. Omit or false for one independent session per member. Refused when the deployment serves no Agent Teams service."
+			},
+			tags: {
+				type: "array",
+				description: "Labels: the name renders as a badge and drives the board filter; promptPrefix is injected ahead of the execution prompt on every run.",
+				items: {
+					type: "object",
+					additionalProperties: false,
+					properties: {
+						name: {
+							type: "string",
+							required: true,
+							description: "Label name (unique within the task, at most 32 characters)."
+						},
+						promptPrefix: {
+							type: "string",
+							description: "Optional prompt line injected before the task prompt (at most 200 characters)."
+						}
+					}
+				}
+			},
+			schedule: {
+				type: "object",
+				additionalProperties: false,
+				description: "Arm a 5-field cron schedule at creation time (Host local time zone).",
+				properties: {
+					enabled: {
+						type: "boolean",
+						required: true,
+						description: "Whether the schedule is armed."
+					},
+					cron: {
+						type: "string",
+						required: true,
+						description: "5-field cron: minute hour day-of-month month day-of-week."
+					}
+				}
+			}
+		},
+		output: {
+			schema: { type: "json" },
+			render: renderJson
+		},
+		async execute(args, exec) {
+			if (args.title.trim() === "") return refused("title-required", "title must not be blank");
+			const id = crypto.randomUUID();
+			const tags = (args.tags ?? []).map((tag) => ({
+				name: tag.name,
+				...tag.promptPrefix === void 0 ? {} : { promptPrefix: tag.promptPrefix }
+			}));
+			const input = {
+				title: args.title,
+				description: args.description ?? "",
+				prompt: args.prompt ?? "",
+				...args.parentId === void 0 || args.parentId === "" ? {} : { parentId: args.parentId },
+				...args.workspaceId === void 0 || args.workspaceId === "" ? {} : { workspaceId: args.workspaceId },
+				...args.mode === void 0 || args.mode === "" ? {} : { mode: args.mode },
+				...args.permission === void 0 ? {} : { permission: args.permission },
+				...args.model === void 0 || args.model === "" ? {} : { model: args.model },
+				...args.reuseSession === true ? { reuseSession: true } : {},
+				...args.teamRun === true ? { teamRun: true } : {},
+				...tags.length === 0 ? {} : { tags },
+				...args.schedule === void 0 ? {} : { schedule: {
+					enabled: args.schedule.enabled,
+					cron: args.schedule.cron
+				} }
+			};
+			try {
+				const snapshot = host.apply(crypto.randomUUID(), {
+					kind: "create",
+					id,
+					input
+				}, callingSessionId(exec));
+				const task = snapshot.tasks.find((item) => item.id === id);
+				if (task === void 0) return refused("create-failed", "the Host did not confirm the new task");
+				return json({
+					ok: true,
+					task: taskDetail(task, snapshot.tasks, snapshot.sessionDefaultPermission)
+				});
+			} catch (error) {
+				return refused("refused", messageOf(error));
+			}
+		}
+	});
+}
+function buildUpdateTool(host) {
+	return defineTool({
+		name: "task_board_update",
+		description: [
+			"Edit a task board card: title, description, prompt, labels, and the execution targets (workspace, agent preset, permission, model, session reuse).",
+			"Only the fields you pass change; pass an empty string to clear a target, or an empty labels array to clear the labels.",
+			"Title, description and prompt freeze once the task has started executing; the execution targets stay editable because they only affect future runs.",
+			"Changing the pinned permission re-arms the permission confirmation gate.",
+			"Triggers: 任务看板, task board, 看板, 修改任务, edit task, 子任务, 标签, tags."
+		].join(" "),
+		parameters: {
+			taskId: {
+				type: "string",
+				required: true,
+				description: "Task id to edit."
+			},
+			title: {
+				type: "string",
+				description: "New title (a blank title is refused by the Host)."
+			},
+			description: {
+				type: "string",
+				description: "New description."
+			},
+			prompt: {
+				type: "string",
+				description: "New execution prompt."
+			},
+			workspaceId: {
+				type: "string",
+				description: "New workspace id; an empty string clears it."
+			},
+			mode: {
+				type: "string",
+				description: "New agent preset id; an empty string clears it."
+			},
+			permission: {
+				type: "string",
+				enum: [...TASK_PERMISSIONS, ""],
+				description: "New permission preset; an empty string clears it back to the session default."
+			},
+			model: {
+				type: "string",
+				description: "New pinned model; an empty string clears it."
+			},
+			reuseSession: {
+				type: "boolean",
+				description: "Continue later runs in the previous execution session."
+			},
+			teamRun: {
+				type: "boolean",
+				description: "Switches this task between a plain cascade (one session per member) and an Agent Team run (Lead session plus a teammate per subtask)."
+			},
+			tags: {
+				type: "array",
+				description: "Replacement label set; an empty array clears all labels.",
+				items: {
+					type: "object",
+					additionalProperties: false,
+					properties: {
+						name: {
+							type: "string",
+							required: true,
+							description: "Label name."
+						},
+						promptPrefix: {
+							type: "string",
+							description: "Optional prompt line injected before the task prompt."
+						}
+					}
+				}
+			}
+		},
+		output: {
+			schema: { type: "json" },
+			render: renderJson
+		},
+		async execute(args, exec) {
+			const patch = {};
+			if (has(args, "title") && typeof args.title === "string") patch.title = args.title;
+			if (has(args, "description") && typeof args.description === "string") patch.description = args.description;
+			if (has(args, "prompt") && typeof args.prompt === "string") patch.prompt = args.prompt;
+			if (has(args, "workspaceId") && typeof args.workspaceId === "string") patch.workspaceId = args.workspaceId;
+			if (has(args, "mode") && typeof args.mode === "string") patch.mode = args.mode;
+			if (has(args, "model") && typeof args.model === "string") patch.model = args.model;
+			if (has(args, "permission") && typeof args.permission === "string") patch.permission = args.permission === "" ? void 0 : args.permission;
+			if (has(args, "reuseSession")) patch.reuseSession = args.reuseSession === true;
+			if (has(args, "teamRun")) patch.teamRun = args.teamRun === true;
+			if (has(args, "tags")) {
+				const tags = args.tags ?? [];
+				patch.tags = tags.length === 0 ? null : tags.map((tag) => ({
+					name: tag.name,
+					...tag.promptPrefix === void 0 ? {} : { promptPrefix: tag.promptPrefix }
+				}));
+			}
+			if (Object.keys(patch).length === 0) return refused("nothing-to-change", "pass at least one field to update");
+			try {
+				const snapshot = host.apply(crypto.randomUUID(), {
+					kind: "update",
+					taskId: args.taskId,
+					patch
+				}, callingSessionId(exec));
+				const task = snapshot.tasks.find((item) => item.id === args.taskId);
+				if (task === void 0) return refused("task-not-found", "no task with id " + args.taskId);
+				return json({
+					ok: true,
+					task: taskDetail(task, snapshot.tasks, snapshot.sessionDefaultPermission)
+				});
+			} catch (error) {
+				return refused("refused", messageOf(error));
+			}
+		}
+	});
+}
+//#endregion
 //#region src/http.ts
 /** Family-default JSON response headers; callers may append or override. */
 const JSON_HEADERS = {
@@ -4656,13 +5003,47 @@ function resolveAccess(access) {
 	};
 }
 /**
+* Harness browser-auth cookie prefix (dsh-client-connection): the
+* authority-bound signed cookie the Host mints in exchange for its launch
+* token. dsh-web's remote channel redeems that token before re-issuing paired
+* traffic to 127.0.0.1 (packages/dsh-remote-web-ui/src/inner-auth.ts), and the
+* official DSH Desktop shell keeps its own copy from the same exchange and
+* attaches it to every request it forwards for the dsh-app://app/ page. The
+* two constants describe one fact and move together.
+*/
+const BROWSER_AUTH_COOKIE_PREFIX = "dsh-auth-";
+/**
+* Whether a Cookie header carries the Host's browser-auth credential. Only an
+* application on this machine can hold it: the desktop shell never lets it
+* reach the page's cookie jar, and SameSite=Strict keeps a cross-site page
+* from attaching it.
+* @param header - the raw Cookie header value.
+*/
+function carriesBrowserAuthCookie(header) {
+	if (header === void 0) return false;
+	return header.split(";").some((segment) => segment.trim().startsWith(BROWSER_AUTH_COOKIE_PREFIX));
+}
+/**
 * Browser-signal tripwire, NOT an authority check: a bare curl sends neither
 * header and is refused, but a curl with a forged Origin passes this too.
 * The real boundary is the loopback socket + Host + origin-equality checks
 * in isTrustedTaskBoardRequest below; do not rely on this marker alone.
+*
+* A first-party client that presents NEITHER header must still pass. The DSH
+* Desktop shell serves the Web GUI from dsh-app://app/ and forwards that
+* page's Host requests itself, deleting origin and sec-fetch-site on the
+* way (dsh-desktop-host's forwardWebRequest), so the panel's own fetch
+* arrives marker-less and every route behind this guard answered 403 - which
+* the panel renders as its board.hostError.unauthorized message. The shell
+* does attach the Host's browser-auth cookie, redeemed from the Host's launch
+* URL at startup and deliberately withheld from the page. That credential,
+* not a header the shell strips, is the browser signal of an application on
+* this machine; a marker-less, credential-less request stays refused.
 */
 function browserSameOriginMarker(req) {
-	return req.headers["sec-fetch-site"] === "same-origin" || typeof req.headers.origin === "string";
+	if (req.headers["sec-fetch-site"] === "same-origin") return true;
+	if (typeof req.headers.origin === "string") return true;
+	return carriesBrowserAuthCookie(req.headers.cookie);
 }
 function sameAuthority(req, host) {
 	if (req.headers["sec-fetch-site"] === "cross-site") return false;
@@ -4874,38 +5255,111 @@ function makeTaskBoardRoutes(service, access = {}, options = {}) {
 * the loader accepts a standalone install of the same package side by side;
 * without this guard the second instance would still re-register the same
 * webserver routes, tools, settings namespaces, and system-prompt sections
-* and fail the boot. mountOnce makes the second host apply a no-op for the
-* lifetime of the first instance (the browser half is already deduped by
-* package name in the client module host).
+* and fail the boot. mountOnce makes a mount of an already-mounted package a
+* no-op for as long as the first instance lives (the browser half is already
+* deduped by package name in the client module host).
+*
+* A no-op is only safe while the holder is ALIVE. The holder can be disposed
+* long after the refused mount ran its course: the Host reloads a profile by
+* creating the new loader entries before the old ones are torn down (a
+* plugin-manager enable/disable/install write, a settings-driven row reload,
+* HMR), so the new aggregate shell entry mounts its family plugin while the
+* previous entry still owns the name. Dropping that refused mount lost the
+* plugin for good - the previous entry then disposed its own mount, releasing
+* the name with nobody left to take it, and the family row stayed listed as
+* active while its host routes 404ed (the task-board panel showed
+* "board.hostError.notMounted", no degraded record appeared, and only a Host
+* restart recovered it).
+*
+* The refused mount is therefore QUEUED, not dropped, and replayed the moment
+* the holder releases the name - if the waiting fiber is still alive then. The
+* single-instance guarantee is unchanged: exactly one mount is live per
+* package name, and the replay re-enters the guard so a later mount still
+* dedupes against it.
 *
 * The registry rides a global symbol so two module instances of the same
-* package (npm copy vs repository link) still share one verdict. cordis
-* `ctx.effect` runs its callback immediately and treats the callback's
+* package (npm copy vs repository link) still share one verdict. That symbol
+* is a CROSS-REPOSITORY contract, not this file's private state: the four
+* satellite packages (dsh-skins / dsh-pet / dsh-presets /
+* dsh-community-plugins) are separate repositories carrying their own copy of
+* this guard, rebuilt on their own schedule, so the value under `MOUNTED`
+* must keep the shape every published copy reads (a `Set` of package names
+* with `has`/`add`/`delete`). The wait queues this guard added therefore live
+* under their own additive key, and the registry reads back a `Set` even when
+* some other build left a different value there. Changing `MOUNTED`'s shape
+* in place broke that contract once: a satellite's legacy copy created a
+* `Set`, the family's new copy read it as a `Map`, and every family row
+* mounted after it failed with "claims.get is not a function".
+*
+* cordis `ctx.effect` runs its callback immediately and treats the callback's
 * return value as the fiber disposer, so the unmarker is returned, not run.
 */
+/** Published cross-repository contract: package names currently mounted. */
 const MOUNTED = Symbol.for("dsh-web.mounted-plugins");
+/** Additive key this guard owns: refused mounts waiting for the name. */
+const WAITERS = Symbol.for("dsh-web.mounted-plugins.waiters");
+/**
+* The shared name registry, always a `Set` whatever another build stored here:
+* a foreign value (an interim shape, a hand-written global) must not take every
+* family plugin down with it.
+* @returns the process-wide set of mounted package names.
+*/
 function mountedSet() {
 	const registry = globalThis;
-	return registry[MOUNTED] ??= /* @__PURE__ */ new Set();
+	const existing = registry[MOUNTED];
+	if (existing instanceof Set) return existing;
+	const created = /* @__PURE__ */ new Set();
+	registry[MOUNTED] = created;
+	return created;
+}
+/** Queue per package name for mounts refused while a holder was alive. */
+function mountWaiters() {
+	const registry = globalThis;
+	return registry[WAITERS] ??= /* @__PURE__ */ new Map();
 }
 /**
 * Wrap a cordis plugin apply so the package runs at most once per process.
-* The first mount registers normally and unmarks when its fiber disposes;
-* any later mount of the same package name is a no-op.
+* The first mount registers normally and releases the name when its fiber
+* disposes; a mount refused while that name is held waits for the release and
+* then runs, unless its own fiber disposes first.
 * @param packageName - npm package identity shared by every install source.
 * @param fn - the original plugin apply.
 * @returns an apply of the same shape.
 */
 function mountOnce(packageName, fn) {
-	return ((...args) => {
+	const mount = (...args) => {
 		const mounted = mountedSet();
-		if (mounted.has(packageName)) return;
+		const ctx = args[0];
+		if (mounted.has(packageName)) {
+			const waiters = mountWaiters();
+			const queue = waiters.get(packageName) ?? [];
+			let alive = true;
+			const pending = { run: () => {
+				if (alive) mount(...args);
+			} };
+			ctx?.effect?.(() => () => {
+				alive = false;
+				const index = queue.indexOf(pending);
+				if (index >= 0) queue.splice(index, 1);
+			});
+			queue.push(pending);
+			waiters.set(packageName, queue);
+			return;
+		}
 		mounted.add(packageName);
-		args[0]?.effect?.(() => () => {
+		ctx?.effect?.(() => () => {
 			mounted.delete(packageName);
+			const waiters = mountWaiters();
+			const queue = waiters.get(packageName);
+			if (queue === void 0) return;
+			waiters.delete(packageName);
+			for (const waiter of queue.splice(0)) queueMicrotask(() => {
+				waiter.run();
+			});
 		});
 		return fn(...args);
-	});
+	};
+	return mount;
 }
 //#endregion
 //#region src/index.ts
@@ -4922,7 +5376,12 @@ const inject = [
 	"commands"
 ];
 /** Model-facing announcement: plugin presence, capabilities, and limits. */
-const TASK_BOARD_GUIDANCE = "本机已安装 dsh-task-board 插件（DSH Web GUI 的任务看板）：侧边栏「任务看板」入口；在 dsh-web 插件全家桶仓库（packages/dsh-task-board）统一维护，经聚合包 web-ui-all 一键安装。能力：多列看板管理任务；Host 权威账本；关闭浏览器后仍由 Host 执行和结算；任务可钉住工作区、agent 预设和权限；支持 Host 本地时区的 5 段 cron，错过的触发点不补跑；可选且默认关闭的空闲系统睡眠保护允许屏幕熄灭，但不承诺拦截合盖、手动睡眠、休眠、关机或唤醒已睡眠机器。执行消耗 API 额度。用户提到「任务看板 / 看板 / 定时任务」时即指本插件，请据此协作。若你同时用 todo_write 维护会话顶部的可见计划列表，最终回复前必须再次调用 todo_write 收尾：没有剩余工作时不要保留 in_progress，已完成的最后一步要标为 completed。";
+const TASK_BOARD_GUIDANCE = "本机已安装 dsh-task-board 插件（DSH Web GUI 的任务看板）：侧边栏「任务看板」入口；在 dsh-web 插件全家桶仓库（packages/dsh-task-board）统一维护，经聚合包 web-ui-all 一键安装。能力：多列看板管理任务；Host 权威账本；关闭浏览器后仍由 Host 执行和结算；任务可钉住工作区、agent 预设和权限；任务可建子任务（深度上限可配 1..3，默认 1 层，子任务不能再带子任务），执行父任务会并发执行其子任务树，子任务可单独覆盖权限与模型；另注册 task_board_* agent 工具（list/get/create/update/set_parent/run/manage/schedule），任何会话都可直接读写看板、子任务与定时计划，但运行任务会真实执行并消耗额度，高于会话默认权限的绑定仍必须由用户在 GUI 人工确认（工具刻意不提供确认能力）；支持 Host 本地时区的 5 段 cron，错过的触发点不补跑；可选且默认关闭的空闲系统睡眠保护允许屏幕熄灭，但不承诺拦截合盖、手动睡眠、休眠、关机或唤醒已睡眠机器。执行消耗 API 额度。用户提到「任务看板 / 看板 / 定时任务」时即指本插件，请据此协作。若你同时用 todo_write 维护会话顶部的可见计划列表，最终回复前必须再次调用 todo_write 收尾：没有剩余工作时不要保留 in_progress，已完成的最后一步要标为 completed。";
+/**
+* Continuable-subagent provider for fresh teammates, matching the Agent Teams
+* tool plugin's own `freshProvider` default.
+*/
+const DEFAULT_TEAM_PROVIDER = "spawn";
 /**
 * The schema is left to inference rather than annotated with `z<Config>`: a
 * volatile field's parsed output is a `Volatile` reference while its accepted
@@ -4935,7 +5394,9 @@ const Config = z.object({
 	preventIdleSleep: z.boolean().default(false).volatile(),
 	trustedProxyHosts: z.array(z.string()).default([]),
 	proxyTokenEnv: z.string().min(1).default(DEFAULT_PROXY_TOKEN_ENV),
-	sessionDefaultPermission: z.union(TASK_PERMISSIONS).default(DEFAULT_SESSION_PERMISSION)
+	sessionDefaultPermission: z.union(TASK_PERMISSIONS).default(DEFAULT_SESSION_PERMISSION),
+	maxSubtaskDepth: z.number().min(1).max(3).default(1).volatile(),
+	teamProvider: z.string().min(1).default(DEFAULT_TEAM_PROVIDER)
 });
 /**
 * Read one config field's current value.
@@ -4966,9 +5427,105 @@ function resolveProxyAccess(config, env = process.env) {
 		proxyToken
 	};
 }
+/**
+* Resolve the optional agent-tool registry. The board deliberately does not
+* inject it: a deployment whose runtime serves no registry must still mount the
+* whole board and lose only the agent-tool surface, the same tolerance the
+* optional llm service gets.
+* @param ctx - the plugin context.
+* @returns the registry, or undefined when this deployment serves none.
+*/
+function resolveToolRegistry(ctx) {
+	try {
+		const tools = ctx.get("tools");
+		return tools !== void 0 && typeof tools.register === "function" ? tools : void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* Resolve the native cordis timer service (dsh-base's own `cordis-plugin-timer`
+* row). The board arms its schedule through it so unloading the row clears
+* every pending timer with the owning fiber, instead of the row tracking raw
+* process handles by hand. A composition that serves no timer service keeps
+* working on the process globals.
+* @param ctx - the plugin context.
+* @returns the timer face, or undefined when this deployment serves none.
+*/
+function resolveHostTimers(ctx) {
+	try {
+		const timer = ctx.get("timer");
+		if (timer === void 0) return void 0;
+		return typeof timer.timeout === "function" && typeof timer.interval === "function" ? {
+			timeout: timer.timeout.bind(timer),
+			interval: timer.interval.bind(timer)
+		} : void 0;
+	} catch {
+		return;
+	}
+}
 /** Schema default, re-read for hand-built test contexts (the loader applies them normally). */
 const DEFAULT_ANNOUNCE = false;
 /**
+* How long one teammate may take to reach its durable active or failed edge.
+* Agent Teams provisioning normally resolves in seconds; the bound exists so a
+* hung spawn settles the subtask instead of holding the cascade open forever.
+*/
+const TEAMMATE_PROVISION_TIMEOUT_MS = 6e5;
+/**
+* Resolve the optional Agent Teams service. Like the tool registry and the llm
+* runtime, it is deliberately not injected: a deployment without Agent Teams
+* must still mount the whole board and only lose team-mode runs.
+* @param ctx - the plugin context.
+* @returns the service, or undefined when this deployment serves none.
+*/
+function resolveAgentTeams(ctx) {
+	try {
+		const teams = ctx.get("agentTeams");
+		return teams !== void 0 && typeof teams.spawnTeammate === "function" ? teams : void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* Build the team dispatcher: the run's Lead session spawns one teammate per
+* subtask through the Agent Teams service, and the teammate's session id is
+* attached to that subtask's execution so the ordinary session monitor settles
+* it. Returns undefined when the deployment serves no Agent Teams service or
+* no live-agent registry, which makes a team run fail closed.
+* @param ctx - the plugin context.
+* @param provider - the continuable-subagent provider for fresh teammates.
+* @returns the dispatcher, or undefined when team runs cannot be served.
+*/
+function buildTeamDispatcher(ctx, provider) {
+	const teams = resolveAgentTeams(ctx);
+	if (teams === void 0) return void 0;
+	if (typeof ctx.agents?.get !== "function") return void 0;
+	return { async spawn(input) {
+		const lead = ctx.agents.get(input.leadSessionId);
+		if (lead === void 0) return { error: `lead session ${input.leadSessionId} is not live` };
+		try {
+			const member = (await teams.spawnTeammate(lead, {
+				name: input.name,
+				description: input.description,
+				prompt: [{
+					type: "text",
+					text: input.prompt
+				}],
+				context: "fresh",
+				provider,
+				signal: AbortSignal.timeout(TEAMMATE_PROVISION_TIMEOUT_MS)
+			}))?.member;
+			if (member === void 0) return { error: "Agent Teams returned no teammate" };
+			if (member.phase === "failed") return { error: member.error ?? "teammate provisioning failed" };
+			if (typeof member.id !== "string" || member.id === "") return { error: "Agent Teams returned no teammate session" };
+			return { sessionId: member.id };
+		} catch (error) {
+			return { error: `teammate provisioning failed: ${error instanceof Error ? error.message : String(error)}` };
+		}
+	} };
+}
+/**
 * Read the optional `llm` service. The board deliberately does not inject it:
 * a deployment without a model must still mount the board, and the parse route
 * answers a typed failure instead of the plugin failing to load (issue #1540).
@@ -4987,8 +5544,8 @@ function resolveLlmRuntime(ctx) {
 * Activate the board's host half: ledger, routes, cron scheduler, power
 * inhibitor, and the model-facing announcement.
 *
-* The effective settings are the config the Host hands this row. The three
-* fields the browser card edits are schema-volatile, so the Loader commits an
+* The effective settings are the config the Host hands this row. The fields
+* the browser card edits are schema-volatile, so the Loader commits an
 * edit into the running fiber's references instead of remounting the row —
 * `sync` therefore reads them at use time and follows
 * `loader/volatile-update`, the event the Loader emits once it has committed
@@ -5004,9 +5561,14 @@ function applyImpl(ctx, config) {
 	const announceToAgent = () => readConfigField(config?.announceToAgent, DEFAULT_ANNOUNCE);
 	/** Current idle-sleep protection flag. */
 	const preventIdleSleep = () => readConfigField(config?.preventIdleSleep, false);
+	/** Current subtask depth limit (read live: the settings card edits it in place). */
+	const maxSubtaskDepth = () => readConfigField(config?.maxSubtaskDepth, 1);
 	const host = new TaskBoardHostService(ctx.typertGateway, {
 		workspaceRegistry: ctx.workspaceRegistry,
 		sessionDefaultPermission: config?.sessionDefaultPermission ?? "read-only",
+		maxSubtaskDepth: maxSubtaskDepth(),
+		timers: resolveHostTimers(ctx),
+		team: buildTeamDispatcher(ctx, config?.teamProvider ?? "spawn"),
 		commandDispatcher: { async execute(sessionId, line, signal) {
 			const agent = ctx.agents.get(sessionId);
 			if (agent === void 0) throw new Error(`execution session ${sessionId} is not available`);
@@ -5015,6 +5577,30 @@ function applyImpl(ctx, config) {
 	});
 	host.setConfiguration(enabled(), preventIdleSleep());
 	host.start();
+	let disposeTools;
+	const setToolsEnabled = (active) => {
+		if (!active) {
+			disposeTools?.();
+			disposeTools = void 0;
+			return;
+		}
+		if (disposeTools !== void 0) return;
+		const registry = resolveToolRegistry(ctx);
+		if (registry === void 0) return;
+		const disposers = buildTaskBoardTools(host).map((tool) => registry.register(tool));
+		disposeTools = () => {
+			for (const dispose of disposers.splice(0)) dispose();
+		};
+	};
+	setToolsEnabled(enabled());
+	const scopedInject = ctx.inject;
+	if (typeof scopedInject === "function") scopedInject.call(ctx, ["tools"], () => {
+		setToolsEnabled(enabled());
+		return () => {
+			disposeTools?.();
+			disposeTools = void 0;
+		};
+	});
 	ctx.effect(() => {
 		const disposers = [];
 		try {
@@ -5025,11 +5611,13 @@ function applyImpl(ctx, config) {
 			} });
 			for (const route of routes) disposers.push(ctx.webServer.register(route));
 		} catch (error) {
+			setToolsEnabled(false);
 			for (const dispose of disposers) dispose();
 			host.dispose();
 			throw error;
 		}
 		return () => {
+			setToolsEnabled(false);
 			for (const dispose of disposers) dispose();
 			host.dispose();
 		};
@@ -5040,11 +5628,14 @@ function applyImpl(ctx, config) {
 		const next = {
 			enabled: enabled(),
 			announceToAgent: announceToAgent(),
-			preventIdleSleep: preventIdleSleep()
+			preventIdleSleep: preventIdleSleep(),
+			maxSubtaskDepth: maxSubtaskDepth()
 		};
-		if (applied !== void 0 && applied.enabled === next.enabled && applied.announceToAgent === next.announceToAgent && applied.preventIdleSleep === next.preventIdleSleep) return;
+		if (applied !== void 0 && applied.enabled === next.enabled && applied.announceToAgent === next.announceToAgent && applied.preventIdleSleep === next.preventIdleSleep && applied.maxSubtaskDepth === next.maxSubtaskDepth) return;
 		applied = next;
+		host.ledger.setMaxSubtaskDepth(next.maxSubtaskDepth);
 		host.setConfiguration(next.enabled, next.preventIdleSleep);
+		setToolsEnabled(next.enabled);
 		if (disposeSection !== void 0) {
 			disposeSection();
 			disposeSection = void 0;
@@ -5062,4 +5653,4 @@ function applyImpl(ctx, config) {
 	sync();
 }
 //#endregion
-export { Config, DEFAULT_PROXY_TOKEN_ENV, TASK_BOARD_GUIDANCE, apply, inject, readConfigField, resolveLlmRuntime, resolveProxyAccess };
+export { Config, DEFAULT_PROXY_TOKEN_ENV, DEFAULT_TEAM_PROVIDER, TASK_BOARD_GUIDANCE, apply, buildTeamDispatcher, inject, readConfigField, resolveAgentTeams, resolveHostTimers, resolveLlmRuntime, resolveProxyAccess, resolveToolRegistry };