@morlay/dsh-subagent 0.0.1-alpha.2

package/dist/index.d.cts

@@ -0,0 +1,2197 @@
+import { Context, Service, Volatile } from "@deepseek-ai/cordis";
+import z from "@deepseek-ai/schemastery";
+import { ContentBlock, HarnessError, MessageId, ReasoningEffortId } from "@deepseek-ai/dsh-llm";
+import { Agent, AgentOptions, CreateAgentOptions } from "@deepseek-ai/dsh-agent";
+import { Session, SessionEvent, SessionId, SessionLogOffset } from "@deepseek-ai/dsh-session";
+import { TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
+import { PromptContentPart } from "@deepseek-ai/dsh-attachment/types";
+import { Branded } from "@deepseek-ai/dsh-brand";
+import { MessageId as MessageId$1 } from "@deepseek-ai/dsh-llm/brand";
+import { SessionId as SessionId$1, SessionSeq } from "@deepseek-ai/dsh-session/types";
+import { ObjectJsonSchema, ToolRestriction } from "@deepseek-ai/dsh-tools";
+import { Scoped } from "@deepseek-ai/dsh-scope";
+//#region ../../../vendor/deepseek-harness/packages/subagent/subagent/src/control-types.d.ts
+/**
+ * Client-minted identity of one browser prompt, persisted on the exact accepted
+ * message. It carries the Session Controller's `session-request-id` brand so a
+ * subagent prompt and an ordinary Session prompt share one identity
+ * vocabulary; that package depends on this one, so the brand is spelled here
+ * rather than imported.
+ */
+type SubagentPromptRequestId = Branded<'session-request-id'>;
+/** Shared child fields for complete-descendant listing. */
+type SubagentCatalogRow = {
+  /** The durable child session id, stable across Activations. */
+  readonly id: SessionId$1;
+  /**
+   * Whether complete-descendant listing observed a resident Session. This
+   * does not encode a durable outcome or guarantee continuation delivery.
+   */
+  readonly activity: 'running' | 'inactive';
+} & ({
+  /** A terminal one-shot child. */
+  readonly mode: 'one-shot';
+  /** Optional durable creation label from the owning catalog or child descriptor. */
+  readonly label?: string;
+} | {
+  /** A resumable conversation. */
+  readonly mode: 'continuable';
+  /** Durable creation label from the owning catalog or child descriptor. */
+  readonly label: string;
+});
+/**
+ * One complete-descendant row. Enumeration may also return diagnostics for
+ * child identity observations from the complete Session corpus.
+ */
+type SubagentListEntry = (SubagentCatalogRow & {
+  readonly kind: 'child';
+  /** Whether complete-corpus enumeration observed a direct child. */
+  readonly hasChildren: boolean;
+}) | {
+  readonly kind: 'diagnostic';
+  /** The candidate's session id. */
+  readonly id: SessionId$1;
+  /**
+   * Why the candidate has no `child` row: `corrupt` for a settled candidate
+   * whose projection fold served no identity (a missing, malformed, or
+   * unrecognized-version descriptor — deliberately undistinguished), and
+   * for any candidate whose log makes a registered unit's fold or schema
+   * throw (deterministic data damage, contained per child); `unavailable`
+   * when the candidate's Session observation was absent or transiently
+   * unreadable (retried on the next listing). `unsupported` is never produced; it remains in the
+   * union for consumers that route on it.
+   */
+  readonly reason: 'corrupt' | 'unsupported' | 'unavailable';
+};
+/** Durable parent/child browsing address; unknown mode is resolved when child history is read. */
+type SubagentAddress = {
+  readonly parentSessionId: SessionId$1;
+  readonly childSessionId: SessionId$1;
+} & ({
+  readonly mode: 'one-shot';
+} | {
+  readonly mode: 'continuable';
+} | {
+  readonly mode: 'unknown';
+});
+/** One human message addressed to a continuable direct child. */
+interface SubagentPromptRequest {
+  /** Identity persisted on the accepted message, minted before the call. */
+  readonly requestId: SubagentPromptRequestId;
+  readonly parentSessionId: SessionId$1;
+  readonly childSessionId: SessionId$1;
+  /** Required discriminator retained from the browser control address. */
+  readonly mode: 'continuable';
+  /** Whether this message queues a later turn or targets the nearest step. */
+  readonly delivery: 'queue' | 'steer';
+  /**
+   * Browser prompt parts delivered as the child's user message. The Host
+   * admits and persists image parts before delivery, so the wire never
+   * carries a durable attachment reference the caller could fabricate.
+   */
+  readonly content: readonly PromptContentPart[];
+  /** Optional browser zone sampled for this exact human prompt. */
+  readonly clientTimeZone?: string;
+}
+/** Inbox identity returned once the continuation accepts one human message. */
+interface SubagentPromptReceipt {
+  readonly messageId: MessageId$1;
+}
+/** Uniform acknowledgement that one interrupt request was admitted. */
+interface SubagentInterruptReceipt {
+  readonly accepted: true;
+}
+/**
+ * Failure details the control surface answers with. Prompts and interrupts
+ * share these failures with the Client Remote result.
+ */
+declare module '@deepseek-ai/dsh-workspace/types' {
+  interface SessionActivityKindMap {
+    /** A subagent session delegated from this session (at any depth) is inside a turn. */
+    subagent: true;
+  }
+}
+declare module '@deepseek-ai/dsh-typert-protocol' {
+  interface RemoteErrorDetailsMap {
+    /** A browser-supplied zone is neither UTC nor a canonical IANA name. */
+    'subagent/invalid-time-zone': {
+      readonly value: string;
+    };
+    /** No live Agent carries the addressed parent session. */
+    'subagent/parent-unavailable': {
+      readonly parentSessionId: SessionId$1;
+    };
+    /** The addressed child cannot take a continuation. */
+    'subagent/not-resumable': {
+      readonly childSessionId: SessionId$1;
+    };
+    /** The claimed parent does not own the addressed child. */
+    'subagent/unauthorized': {
+      readonly childSessionId: SessionId$1;
+    };
+    /** Image admission or model image-capability refusal. */
+    'subagent/attachment-invalid': {
+      readonly reason: string;
+    };
+    /** The child exists but its inbox cannot admit the message now. */
+    'subagent/delivery-unavailable': {
+      readonly childSessionId: SessionId$1;
+    };
+  }
+}
+//#endregion
+//#region ../../../vendor/deepseek-harness/packages/subagent/subagent/src/descriptor.d.ts
+declare module '@deepseek-ai/dsh-session/types' {
+  interface SessionEventMap {
+    /**
+     * Durable identity and lifecycle mode of a session-backed subagent child,
+     * appended once by the establishing provider inside the child's initial
+     * turn, before its first request. Continuable records also carry their
+     * resumable composition. Log-only: it carries no `surfaceOp`, never enters
+     * model history, and survives compaction.
+     */
+    'subagent/descriptor': SubagentDescriptorData;
+  }
+}
+/**
+ * The current descriptor format version, stamped into every appended
+ * `subagent/descriptor` event and required verbatim by {@link foldSubagentDescriptor}.
+ * Supporting another composition input is a deliberate version change, never
+ * an implicit extra field.
+ */
+declare const SUBAGENT_DESCRIPTOR_VERSION = 3;
+/** Fields shared by every supported `subagent/descriptor` payload. */
+interface SubagentDescriptorBase {
+  /** Descriptor format version ({@link SUBAGENT_DESCRIPTOR_VERSION}). */
+  readonly version: number;
+  /** Whether the child is a terminal one-shot run or a resumable conversation. */
+  readonly mode: 'one-shot' | 'continuable';
+  /** The `ctx.subagents` provider name that established the child. */
+  readonly provider: string;
+}
+/** A session-backed subagent that cannot be cold-resumed after its run. */
+interface OneShotSubagentDescriptorData extends SubagentDescriptorBase {
+  readonly mode: 'one-shot';
+  /**
+   * The initial delegation's short `description`, kept as the child's durable
+   * creation label so enumeration can identify the conversation without
+   * replaying parent tool results or exposing the child prompt.
+   */
+  readonly label?: string;
+}
+/** A session-backed subagent whose declared composition supports cold resume. */
+interface ContinuableSubagentDescriptorData extends SubagentDescriptorBase {
+  readonly mode: 'continuable';
+  /** The initial delegation's short `description`, used for durable enumeration. */
+  readonly label: string;
+  /** Resolved child `agentOptions.provider`, when one was declared. */
+  readonly agentProvider?: string;
+  /** Resolved child `agentOptions.model`, when one was declared. */
+  readonly agentModel?: string;
+  /** Resolved child `agentOptions.reasoningEffort`, when one was declared. */
+  readonly agentReasoningEffort?: ReasoningEffortId;
+  /** Per-child persona that shadows the deployment persona on resume. */
+  readonly persona?: string;
+  /** Child tool scoping reapplied on resume. */
+  readonly toolFilter?: ToolRestriction;
+}
+/** The supported durable subagent identity and optional continuation composition. */
+type SubagentDescriptorData = OneShotSubagentDescriptorData | ContinuableSubagentDescriptorData;
+/** Fields shared by descriptor snapshot inputs. */
+interface SubagentDescriptorInputBase {
+  /** Whether the child is a terminal one-shot run or a resumable conversation. */
+  readonly mode: 'one-shot' | 'continuable';
+  /** The `ctx.subagents` provider name that will establish the child. */
+  readonly provider: string;
+}
+/** Input for a one-shot child's durable identity. */
+interface OneShotSubagentDescriptorInput extends SubagentDescriptorInputBase {
+  readonly mode: 'one-shot';
+  /** Optional initial delegation `description` used as the durable creation label. */
+  readonly label?: string;
+}
+/** Input for a continuable child's durable identity and resumable composition. */
+interface ContinuableSubagentDescriptorInput extends SubagentDescriptorInputBase {
+  readonly mode: 'continuable';
+  /** Initial delegation `description` used for durable enumeration. */
+  readonly label: string;
+  /** Requested child `agentOptions.provider`. */
+  readonly agentProvider?: string;
+  /** Requested child `agentOptions.model`. */
+  readonly agentModel?: string;
+  /** Requested child `agentOptions.reasoningEffort`. */
+  readonly agentReasoningEffort?: ReasoningEffortId;
+  /** Requested per-child persona. */
+  readonly persona?: string;
+  /** Requested child tool scoping. */
+  readonly toolFilter?: ToolRestriction;
+}
+/** Inputs {@link snapshotSubagentDescriptor} validates and detaches. */
+type SubagentDescriptorInput = OneShotSubagentDescriptorInput | ContinuableSubagentDescriptorInput;
+/**
+ * Validate and detach descriptor inputs into the durable payload, before any
+ * Task or provider work begins — the same detached lossless-JSON boundary the
+ * session log itself enforces, applied early so a synchronous validation
+ * failure rejects the tool call without creating a Task.
+ * @param input - the caller-collected composition fields.
+ * @returns the versioned, detached descriptor payload.
+ * @throws when a field is not losslessly JSON-serializable.
+ */
+declare function snapshotSubagentDescriptor(input: OneShotSubagentDescriptorInput): OneShotSubagentDescriptorData;
+/**
+ * Validate and detach a continuable descriptor input.
+ * @param input - the caller-collected continuable composition fields.
+ * @returns the versioned, detached continuable descriptor payload.
+ * @throws when a field is not losslessly JSON-serializable.
+ */
+declare function snapshotSubagentDescriptor(input: ContinuableSubagentDescriptorInput): ContinuableSubagentDescriptorData;
+/**
+ * Fold a persisted child log to its supported descriptor. The first
+ * `subagent/descriptor` event is authoritative — the establishing provider
+ * appends exactly one, so a later same-type event cannot rewrite the declared
+ * composition.
+ * @param events - the loaded child session events.
+ * @returns the descriptor, or `undefined` when the log has none or its
+ *   version is not {@link SUBAGENT_DESCRIPTOR_VERSION} (the child cannot be
+ *   classified by this runtime).
+ * @throws when a current-version persisted payload does not match its complete
+ *   declared schema.
+ */
+declare function foldSubagentDescriptor(events: readonly SessionEvent[]): SubagentDescriptorData | undefined;
+//#endregion
+//#region ../../../vendor/deepseek-harness/packages/subagent/subagent/src/types.d.ts
+/** Identifies one accepted subagent run across its lifecycle event pair. */
+type SubagentRunId = Branded<'SubagentRunId'>;
+/**
+ * Brand a string as a {@link SubagentRunId}.
+ * @param id - the raw run id.
+ * @returns the same string, branded.
+ */
+declare function SubagentRunId(id: string): SubagentRunId;
+/** What a caller asks for when starting a continuable background child. */
+interface ContinuableStartSpec {
+  /** The `ctx.subagents` provider whose continuable-creation capability establishes the child. */
+  readonly provider: string;
+  /** The initial delegation's short `description`, persisted as the child's creation label. */
+  readonly label: string;
+  /**
+   * Optional caller-reserved child identity. Omission preserves the manager's
+   * UUID allocation; supplying one lets a durable parent record provisioning
+   * before child materialization without a second identity handshake.
+   */
+  readonly childId?: SessionId;
+  /**
+   * The delegation request. The manager reserves the stable child id, resolves
+   * the durable descriptor, and composes the child itself.
+   */
+  readonly request: Omit<SubagentStartRequest, 'label' | 'signal' | 'outputSchema'>;
+  /** Caller cancellation, owning the operation only until inbox acceptance. */
+  readonly signal: AbortSignal;
+}
+/** Identities returned once a continuable child accepted its initial prompt. */
+interface ContinuableStart {
+  /** The durable child session id, stable across activations. */
+  readonly childId: SessionId;
+  /** The accepted initial prompt's inbox message id. */
+  readonly messageId: MessageId;
+}
+/**
+ * Authority under which one interrupt request is admitted. `user` carries the
+ * durable direct-parent address a human client presented; `ancestor` carries
+ * the exact live Agent object whose recorded lineage must contain the caller.
+ */
+type SubagentInterruptAuthority = {
+  readonly kind: 'user';
+  readonly parentSessionId: SessionId;
+} | {
+  readonly kind: 'ancestor';
+  readonly agent: Agent;
+};
+/** Options for one model-authored message between adjacent Agents. */
+interface SubagentSendMessageOptions {
+  /** Caller cancellation, owning the operation only until inbox acceptance. */
+  readonly signal: AbortSignal;
+}
+/**
+ * Observe-only identifying detail for a published subagent run, carried by
+ * `subagent/start`. One-shot runs and continuable Activation epochs share this
+ * payload, so an observer sees the same vocabulary for both.
+ */
+interface SubagentRunInfo {
+  /** Unique identity shared with the paired terminal event. */
+  readonly runId: SubagentRunId;
+  /**
+   * Provider name recorded when the child was first created. The provider may
+   * be absent when an accepted one-shot run becomes ready or a persisted
+   * Activation cold-resumes, because neither lifecycle depends on continued
+   * registration.
+   */
+  readonly provider: string;
+  /** The child agent's id. */
+  readonly id: SessionId;
+  /** Snapshot of whether `SubagentRun.localAgent` was present when start fulfilled. */
+  readonly local: boolean;
+}
+/**
+ * Observe-only outcome detail for a settled subagent run, carried by
+ * `subagent/end` and paired with one {@link SubagentRunInfo} by `runId`.
+ */
+interface SubagentRunEndInfo {
+  /** Unique identity shared with the paired start event. */
+  readonly runId: SubagentRunId;
+  /** The same provider name carried by the paired start event. */
+  readonly provider: string;
+  /** The child agent's id. */
+  readonly id: SessionId;
+  /** Snapshot of whether `SubagentRun.localAgent` was present when start fulfilled. */
+  readonly local: boolean;
+  /** The terminal stop reason. */
+  readonly stopReason: SubagentResult['stopReason'];
+  /**
+   * The child's final assistant output, selected by the same rule as
+   * {@link SubagentResult.output}; absent on infrastructure rejection or when
+   * the child produced none.
+   */
+  readonly lastAssistantMessage?: readonly ContentBlock[];
+}
+/**
+ * Which START-TIME features a provider supports. Checked by the service before delegating to
+ * {@link SubagentProvider.start}: a request that needs a capability the chosen provider lacks
+ * is rejected with a typed error rather than accepted-then-ignored (the "fail loud, no silent
+ * degradation" rule). These flags describe the ONE-SHOT
+ * {@link SubagentProvider.start} path, where the provider composes the child;
+ * continuable children are composed by the continuation manager itself and are
+ * gated by {@link SubagentProvider.prepareContinuable} instead. Each flag
+ * corresponds one-to-one to a {@link SubagentStartRequest} option: `depthLimit`
+ * to `maxDepth`; the other names match.
+ */
+interface SubagentCapabilities {
+  readonly agentOptions: boolean;
+  readonly outputSchema: boolean;
+  readonly depthLimit: boolean;
+  readonly toolFilter: boolean;
+  readonly persona: boolean;
+}
+/**
+ * What a caller asks for when starting a ONE-SHOT subagent. The tool layer
+ * builds this from the model's `{ description, prompt }` plus its own config;
+ * the service validates {@link SubagentCapabilities} against the named provider
+ * and resolves the durable descriptor before dispatching to
+ * {@link SubagentProvider.start}.
+ */
+interface SubagentStartRequest {
+  /** Optional short display label persisted with a session-backed child. */
+  readonly label?: string;
+  /** Content delivered as the child's user message. */
+  readonly prompt: ContentBlock[];
+  /**
+   * The spawning agent. In-process providers derive workspace, lineage, and
+   * delegation depth from its durable session state. ACP reads only its cwd,
+   * and only when no deployment `cwd` override is configured.
+   */
+  readonly parent: Agent;
+  /**
+   * Cancellation signal from the spawning context (the tool's `exec.signal`).
+   * This is the canonical cancellation channel both before and after startup:
+   * a provider rejects `start()` after cleaning partial resources when it
+   * fires before the run is published, and cancels the published run's
+   * remaining turn work when it fires afterward.
+   */
+  readonly signal: AbortSignal;
+  /**
+   * Optional host-Agent provider, model, reasoning-effort, and output-token
+   * overrides. Requires {@link SubagentCapabilities.agentOptions}; in-process
+   * providers merge them over the parent Agent's options when they create the
+   * child, while the DSH SDK provider merges them over its instance defaults
+   * before initializing the separate child runtime.
+   */
+  readonly agentOptions?: AgentOptions;
+  /**
+   * Object-rooted JSON Schema within `assertObjectJsonSchema`'s enforced subset. Start rejects
+   * unsupported schemas or providers without the capability. Data must be plain host-realm JSON;
+   * a successful child returns the matching value as {@link SubagentResult.structured}.
+   */
+  readonly outputSchema?: ObjectJsonSchema;
+  /**
+   * Optional absolute delegation-depth cap for the child being started: its
+   * computed depth must be less than or equal to this non-negative safe
+   * integer. Requires {@link SubagentCapabilities.depthLimit}; rejected at
+   * start otherwise.
+   */
+  readonly maxDepth?: number;
+  /**
+   * Optional child tool scoping. Requires {@link SubagentCapabilities.toolFilter};
+   * rejected at start otherwise. In-process backends apply it as a scoped
+   * `tools.restrict()` in the child's creation window: the named tools vanish
+   * from the child's prompt AND refuse to execute (one visibility), with loud
+   * unknown-name validation.
+   */
+  readonly toolFilter?: ToolRestriction;
+  /**
+   * Optional per-child persona. Requires {@link SubagentCapabilities.persona};
+   * rejected at start otherwise. In-process backends register it as a scoped
+   * `deployment:persona-prefix` section on the child, SHADOWING the deployment's
+   * persona for this child alone — same template semantics as the deployment
+   * persona (strict `{{…}}` interpolation against the registered variables).
+   */
+  readonly persona?: string;
+}
+/**
+ * Provider-facing one-shot request after {@link SubagentRuntime.start} resolves
+ * the durable child descriptor.
+ */
+interface ResolvedSubagentStartRequest extends SubagentStartRequest {
+  /** Detached descriptor a session-backed provider persists in the child log. */
+  readonly descriptor: SubagentDescriptorData;
+}
+/**
+ * What the continuation manager asks a provider for while materializing one
+ * continuable child's FIRST activation. The manager has already reserved the
+ * durable child identity and owns every later operation, so this request
+ * carries only what distinguishes a fresh child from one seeded with parent
+ * history.
+ */
+interface ContinuableCreateRequest {
+  /** The reserved durable child session id, for provider diagnostics. */
+  readonly sessionId: SessionId;
+  /** The delegating parent agent whose history a seeding provider reads. */
+  readonly parent: Agent;
+  /**
+   * Caller cancellation, which owns preparation only until the manager accepts
+   * the initial prompt into the child's inbox.
+   */
+  readonly signal: AbortSignal;
+}
+/**
+ * A provider's detached contribution to one continuable child's creation. This
+ * is DATA, never a capability: it carries no Agent, `AgentHandle`, prompt
+ * delivery, result, disposal, or resume operation, because the continuation
+ * manager owns the child's whole lifecycle after preparation.
+ */
+interface ContinuableCreateSpec {
+  /**
+   * Completed-turn prefix of the parent's log to seed the child session with,
+   * or absent for a fresh child. Same durable contract as
+   * `CreateAgentOptions.seed`: contiguous from seq 0, lossless JSON, balanced.
+   */
+  readonly seed?: readonly SessionEvent[];
+}
+/**
+ * Why a subagent run ended. Merge-extensible (a backend may add variants);
+ * consumers branch on the known cases and fall through `default`. The known
+ * cases mirror the harness turn-end vocabulary so the tool layer can map a
+ * non-`completed` result to an `isError` tool result.
+ */
+interface SubagentStopReasonMap {
+  /** The child finished its turn normally. */
+  completed: 'completed';
+  /** Cancelled through the request signal or disposal. */
+  aborted: 'aborted';
+  /** Model or transport failure. */
+  error: 'error';
+  /** The child hit its token ceiling before finishing. */
+  'max-tokens': 'max-tokens';
+  /** The child declined the task. */
+  refusal: 'refusal';
+}
+/** The union over {@link SubagentStopReasonMap} — widens automatically as backends merge in variants. */
+type SubagentStopReason = SubagentStopReasonMap[keyof SubagentStopReasonMap];
+/**
+ * The terminal outcome of a subagent run, resolved by {@link SubagentRun.result}.
+ */
+interface SubagentResult {
+  /**
+   * The child's final assistant output is the content of its last non-empty
+   * assistant message. Empty-content messages, including usage-only messages,
+   * are skipped. Without a non-empty message, the output is its accumulated
+   * assistant text stream, or `[]` when the child produced neither.
+   */
+  readonly output: readonly ContentBlock[];
+  /**
+   * The structured result after a requested `outputSchema` was successfully
+   * satisfied. Requesting a schema does not guarantee presence: a provider can
+   * end with `stopReason: 'error'` when the child fails or finishes without a
+   * valid capture. The structured value is validated against the requested
+   * output schema by the provider; `unknown` here because the seam is
+   * schema-agnostic.
+   */
+  readonly structured?: unknown;
+  /**
+   * Provider-authored, non-assistant failure detail for a non-`completed`
+   * result. Providers keep this text free of tool inputs, file contents,
+   * environment values, credentials, and raw protocol payloads, and limit it
+   * to 4096 UTF-8 bytes. Consumers present it separately from {@link output}.
+   */
+  readonly diagnostic?: string;
+  /** Why the run ended. A non-`completed` reason means `output` may be partial. */
+  readonly stopReason: SubagentStopReason;
+}
+/**
+ * ONE-SHOT child handle returned after publication. Prompt submission, turn
+ * work, and infrastructure faults after that boundary belong to {@link result}.
+ * Consumers await that result and must always {@link dispose} to cancel
+ * remaining work and reach quiescence. A run is one disposable foreground
+ * delegation with one result; continuable conversations have no run — the
+ * continuation manager holds their `AgentHandle` directly and orders every
+ * turn through the child's own inbox.
+ */
+interface SubagentRun {
+  /**
+   * Parent-scoped run id. For a local run, this MUST equal the published child
+   * session id, whose `parentSession` records `request.parent.session.id`; a
+   * remote provider mints an id unique in the parent namespace.
+   */
+  readonly id: SessionId;
+  /**
+   * The exact published in-process child, or `undefined` for a remote run.
+   * When present, its id is {@link id}; the provider retains no ownership
+   * implication beyond the run's ordinary {@link dispose} contract.
+   */
+  readonly localAgent: Agent | undefined;
+  /**
+   * Resolves with the child's terminal {@link SubagentResult} when the run
+   * settles. Does NOT reject on a child-level failure — a model/transport
+   * failure resolves with `stopReason: 'error'` so the consumer maps it to an
+   * `isError` tool result. Rejects on an infrastructure fault the seam cannot
+   * represent as a stop reason.
+   */
+  readonly result: Promise<SubagentResult>;
+  /**
+   * Cancel remaining work, reach child quiescence, and release resources.
+   * Idempotent.
+   */
+  dispose(): Promise<void>;
+}
+/**
+ * One registered transport for running child agents. Providers are trusted
+ * same-process implementations; callers treat descriptors and returned values
+ * as borrowed immutable data. The service may call one provider concurrently
+ * for distinct children. Providers isolate operation-local mutable state; a
+ * shared capacity controller may delay an operation but must not couple its
+ * settlement or cleanup to a sibling.
+ */
+interface SubagentProvider {
+  /** Unique registry name (e.g. `spawn`, `fork`, `acp`). */
+  readonly name: string;
+  /** The start-time features this provider supports (see {@link SubagentCapabilities}). */
+  readonly capabilities: SubagentCapabilities;
+  /**
+   * Whether the child sees the parent's completed-turn prefix. This is descriptive, not a
+   * service-validated start capability: the model-facing tool derives truthful wording from it.
+   * It says nothing about tool registration, injected services, or authority inheritance.
+   */
+  readonly inheritsParentContext: boolean;
+  /**
+   * Optional static provider-owned provider/model route for one-shot Agent
+   * options. Consumers merge tool/model overrides over these values before
+   * preflight; providers whose route derives from the parent omit it. The value
+   * is detached immutable data and requires `agentOptions` support.
+   */
+  readonly agentRouteDefaults?: Readonly<{
+    provider: string;
+    model: string;
+  }>;
+  /**
+   * Establish a ONE-SHOT child and return its handle after publication.
+   * The service has already validated that every requested start-time
+   * capability is supported and resolved `request.descriptor`, so a
+   * session-backed implementation appends that descriptor inside the child's
+   * initial turn. Before fulfillment, the provider owns setup and cleans any
+   * unpublished partial resources before rejecting. Ownership transfers on
+   * fulfillment; subsequent turn or infrastructure failure settles through
+   * the returned run. Distinct starts may overlap; cancellation, failure,
+   * result settlement, and disposal remain independent for each run.
+   */
+  start(request: ResolvedSubagentStartRequest): Promise<SubagentRun>;
+  /**
+   * OPTIONAL (continuable-creation capability): contribute the detached
+   * creation inputs that distinguish this provider's continuable children —
+   * only whether the child session is seeded with parent history. Method
+   * presence IS the capability: the service rejects continuable starts on
+   * providers without it, while a provider that has it may still serve
+   * ordinary one-shot delegations.
+   *
+   * This is the provider's ONLY participation in a continuable child. The
+   * continuation manager owns identity reservation, composition, Agent
+   * creation, prompt delivery, cold resume, ownership, and disposal, so a
+   * provider never sees the child's Agent, handle, turns, or teardown.
+   * Distinct preparations may overlap; each follows its own signal and returns
+   * data belonging only to `request.sessionId`.
+   */
+  prepareContinuable?(request: ContinuableCreateRequest): Promise<ContinuableCreateSpec>;
+}
+//#endregion
+//#region ../../../vendor/deepseek-harness/packages/subagent/subagent/src/projection-types.d.ts
+/** One current direct-child discovery row materialized from parent facts. */
+type SubagentCatalogEntry = {
+  readonly id: SessionId$1;
+  readonly createdAt: number;
+} & ({
+  readonly mode: 'one-shot';
+  readonly label?: string;
+} | {
+  readonly mode: 'continuable';
+  readonly label: string;
+} | {
+  readonly mode: 'unknown';
+  readonly label?: string;
+});
+/** Durable active-turn timing for one descriptor-backed child session. */
+interface SubagentTimingProjection {
+  /** Milliseconds accumulated across completed turns after the child's own descriptor. */
+  settledMs: number;
+  /** Same-cut bounds of the currently open turn, when one has not reached `turn/end`. */
+  active?: {
+    /** Start of the open turn. */
+    since: number;
+    /** Latest event time folded into this projection cut. */
+    through: number;
+  };
+  /**
+   * Whether the latest closed turn after the child's own descriptor completed
+   * normally; absent while a turn is open or before one closes.
+   */
+  lastTurnCompleted?: boolean;
+}
+/**
+ * Durable identity of one descriptor-backed subagent session: lifecycle mode
+ * plus creation label, folded last-wins from `subagent/descriptor` events.
+ * Label strength follows the descriptor schema: a continuable child always
+ * carries one, a one-shot child may omit it.
+ */
+type SubagentIdentityProjection = {
+  /** A terminal one-shot child. */
+  mode: 'one-shot';
+  /** Optional durable creation label from the child's descriptor. */
+  label?: string;
+  /**
+   * Seq of the `subagent/descriptor` event this identity was folded from.
+   * `session.isOwnSeq(seq)` proves the identity comes from the child's
+   * OWN log suffix — where a descriptor is immutable once appended — and
+   * not from a fork seed's replayed ancestor descriptor.
+   */
+  seq: SessionSeq;
+} | {
+  /** A resumable conversation. */
+  mode: 'continuable';
+  /** Durable creation label from the child's descriptor. */
+  label: string;
+  /** Seq of the folded descriptor event; see the one-shot arm for the own-suffix proof. */
+  seq: SessionSeq;
+};
+declare module '@deepseek-ai/dsh-session-projection/types' {
+  interface SessionProjectionMap {
+    /** Direct children in parent catalog event order, excluding fork-inherited facts. */
+    subagentCatalog: SubagentCatalogEntry[];
+    /** Active-turn duration and latest closed-turn completion for a descriptor-backed subagent session. */
+    subagentTiming: SubagentTimingProjection;
+    /**
+     * Identity of a descriptor-backed subagent session. `null` ⟺ no valid
+     * descriptor (missing, malformed, or unrecognized-version — deliberately
+     * undistinguished). The sentinel is deliberately serializable: a
+     * value pushed over JSON transports must survive `JSON.stringify`
+     * losslessly, where an `undefined` field would be dropped and a stale
+     * identity would survive on the receiving side. The entry itself stays
+     * non-optional.
+     */
+    subagent: SubagentIdentityProjection | null;
+  }
+}
+//#endregion
+//#region ../../../vendor/deepseek-harness/packages/subagent/subagent/src/list-children.d.ts
+/**
+ * One entry of a descendant listing: the interpreted subagent facts plus its
+ * position in the complete session tree. `parentId` is the durable direct
+ * parent from the enumerated header, and `depth` counts edges from the root.
+ */
+type SubagentDescendantListEntry = SubagentListEntry & {
+  /** Durable direct parent of this candidate in the enumerated tree. */
+  readonly parentId: SessionId;
+  /** Edge distance from the requested root; direct children are `1`. */
+  readonly depth: number;
+};
+//#endregion
+//#region ../../../vendor/deepseek-harness/packages/util/chunked-list/lib/types/index.d.ts
+/**
+ * Newest chunk of an immutable list; `undefined` represents the empty list.
+ * Values within each chunk follow insertion order. Callers treat nodes, arrays,
+ * and stored values as immutable; operations share values and older chunks.
+ */
+interface ChunkedList<T> {
+  readonly values: readonly T[];
+  readonly previous?: ChunkedList<T> | undefined;
+}
+//#endregion
+//#region ../../../vendor/deepseek-harness/packages/subagent/subagent/src/catalog.d.ts
+type KnownCatalogMode = {
+  readonly mode: 'one-shot';
+  readonly label?: string;
+} | {
+  readonly mode: 'continuable';
+  readonly label: string;
+};
+/** Parent catalog v0 records known modes; v1 also retains children with unknown mode. */
+type SubagentCatalogEvent = {
+  readonly childId: SessionId;
+  readonly childCreatedAt: number;
+} & (({
+  readonly version: 0;
+} & KnownCatalogMode) | ({
+  readonly version: 1;
+} & (KnownCatalogMode | {
+  readonly mode: 'unknown';
+  readonly label?: string;
+})));
+declare module '@deepseek-ai/dsh-session/types' {
+  interface SessionEventMap {
+    /**
+     * A direct child's identity and available discovery fields.
+     * @param data - versioned parent-owned catalog entry.
+     */
+    'subagent/catalog': SubagentCatalogEvent;
+  }
+}
+/** Host fold state for one parent catalog. */
+interface SubagentCatalogState {
+  readonly inheritedEventCount: SessionLogOffset;
+  readonly head?: ChunkedList<SubagentCatalogEvent> | undefined;
+}
+declare module '@deepseek-ai/dsh-session-projection/types' {
+  interface SessionProjectionStateMap {
+    subagentCatalog: SubagentCatalogState;
+  }
+}
+//#endregion
+//#region ../../../vendor/deepseek-harness/packages/subagent/subagent/src/out-of-process.d.ts
+/**
+ * The capability advertisement of an out-of-process backend: NONE. A child in
+ * another process cannot honor parent-enforced start features
+ * (`agentOptions`/`outputSchema`/`maxDepth`/`toolFilter`/`persona`), so the service rejects a
+ * request needing any of them before `start` runs — never accepted-then-ignored.
+ */
+declare const NO_START_CAPABILITIES: SubagentCapabilities;
+/**
+ * Assert a configured timing bound is a positive finite number (it bounds a
+ * teardown or shutdown wait; zero, negative, or NaN would skip or wedge it).
+ * @param prefix - the consuming plugin's diagnostic prefix (e.g. `subagent-acp`).
+ * @param name - the config field name, for the diagnostic.
+ * @param value - the configured value.
+ */
+declare function assertPositiveFinite(prefix: string, name: string, value: number): void;
+/**
+ * Assert `cwd` can actually host the child: absolute (it doubles as the
+ * child's workspace identity, and a relative path would be re-anchored to the
+ * server process's launch directory) and an existing directory (fail here,
+ * before the process boundary, instead of as an ambiguous spawn ENOENT).
+ * @param prefix - the consuming plugin's diagnostic prefix.
+ * @param label - which source supplied the value, for the diagnostic.
+ * @param cwd - the candidate working directory.
+ * @returns `cwd`, validated.
+ */
+declare function assertUsableCwd(prefix: string, label: string, cwd: string): string;
+/**
+ * Validate a configured `cwd` override ONCE, at plugin load: reject the empty
+ * string (`path.resolve('')` is the process cwd — it would silently
+ * reintroduce the launch-directory fallback this resolution removes),
+ * interpret a relative path against the harness launch directory, and require
+ * an enterable directory.
+ * @param prefix - the consuming plugin's diagnostic prefix.
+ * @param cwd - the configured override, or `undefined` when the config omits it.
+ * @returns the validated absolute override, or `undefined` when omitted.
+ */
+declare function validateConfiguredCwd(prefix: string, cwd: string | undefined): string | undefined;
+/**
+ * Resolve the child's working directory at start: the deployment override
+ * when configured (already validated at load), else the parent session's
+ * workspace cwd (validated here, its earliest resolvable point). Fails loud
+ * when neither exists — falling back to the harness process cwd would
+ * silently bind the child to the server's launch directory instead of the
+ * delegating session's workspace (one server process serves many sessions,
+ * each with its own cwd).
+ * @param prefix - the consuming plugin's diagnostic prefix.
+ * @param configured - the load-validated override, or `undefined`.
+ * @param parentCwd - the delegating parent session's workspace cwd, if any.
+ * @returns the absolute child working directory.
+ */
+declare function resolveChildCwd(prefix: string, configured: string | undefined, parentCwd: string | undefined): string;
+/** Inputs to {@link settleRunResult}. */
+interface RunResultSettlement {
+  /** The turn attempt (typically racing local cancellation); returns the terminal result. */
+  attempt: () => Promise<SubagentResult>;
+  /** Snapshot the provider exposes when cancellation or failure wins settlement. */
+  collectOutput: () => readonly ContentBlock[];
+  /** Snapshot safe provider-authored detail when a failure wins settlement. */
+  collectDiagnostic?: (() => string | undefined) | undefined;
+  /** Whether local cancellation settled before the attempt's outcome is observed. */
+  cancelled: () => boolean;
+  /** Diagnostic sink for a failure flattened to a stop reason; a throw from it is contained. */
+  onError?: ((error: Error, stopReason: SubagentStopReason) => void) | undefined;
+  /** The request's cancellation signal (the listener is removed at settlement). */
+  signal: AbortSignal;
+  /** The abort listener registered on {@link signal} at start. */
+  onAbort: () => void;
+}
+/**
+ * Settle an out-of-process run result under the seam contract: `result` never
+ * rejects after publication. A normally completed or rejected attempt resolves
+ * as `aborted` when cancellation already settled locally; another rejection is
+ * flattened to `stopReason: 'error'` through the contained diagnostic sink.
+ * Provider-returned diagnostics use the same byte limit. The abort listener is
+ * removed on every path.
+ * @param parts - the attempt, output snapshot, cancellation state, sink, and signal wiring.
+ * @returns the terminal result (never a rejection).
+ */
+declare function settleRunResult(parts: RunResultSettlement): Promise<SubagentResult>;
+/** Inputs to {@link subprocessRunHandle}. */
+interface SubprocessRunHandleParts {
+  /** The parent-scoped run id. */
+  id: SubagentRun['id'];
+  /** The flattened, never-rejecting result (the seam contract). */
+  result: Promise<SubagentResult>;
+  /** The request's cancellation signal (the listener is removed on dispose). */
+  signal: AbortSignal;
+  /** The abort listener registered on {@link signal} at start. */
+  onAbort: () => void;
+  /** Settle local cancellation so {@link result} resolves without the child. */
+  requestCancel: () => void;
+  /** Tear the child process down to quiescence (backend-owned ladder). */
+  teardown: () => Promise<void>;
+}
+/**
+ * Publish the seam run handle for an out-of-process child. `dispose()` is
+ * idempotent (one memoized teardown): it removes the abort listener, settles
+ * local cancellation — there is no assumption the child cooperates — and then
+ * awaits the backend's teardown to actual exit.
+ * @param parts - the run identity, result, cancellation wiring, and teardown.
+ * @returns the seam run handle (`localAgent` is `undefined` for remote runs).
+ */
+declare function subprocessRunHandle(parts: SubprocessRunHandleParts): SubagentRun;
+//#endregion
+//#region ../../../vendor/deepseek-harness/packages/subagent/subagent/src/assistant-output.d.ts
+/**
+ * Incremental fold of the selection rule, for backends that observe a child's
+ * output as it streams: session-event backends {@link push} each event, and
+ * transports without session events (ACP content chunks) {@link pushText} raw
+ * text into the same streamed fallback.
+ */
+declare class AssistantOutputFold {
+  private message;
+  private partial;
+  /**
+   * Fold one session event: a non-empty assistant message becomes the
+   * candidate final answer, while its embedded stream and any log-only attempt
+   * extend the streamed fallback; every other event contributes nothing.
+   * @param event - the next observed session event.
+   */
+  push(event: SessionEvent): void;
+  /**
+   * Extend the streamed fallback with text observed outside session events.
+   * @param text - the next streamed text piece (an empty piece is a no-op).
+   */
+  pushText(text: string): void;
+  /**
+   * Select the final output folded so far.
+   * @returns the last non-empty assistant message, else the accumulated
+   *   streamed text, or `undefined` when the child produced neither.
+   */
+  collect(): readonly ContentBlock[] | undefined;
+}
+/**
+ * Apply the selection rule to one complete child-owned event suffix.
+ * @param events - the child-owned events (after any seed or epoch boundary).
+ * @returns the selected output, or `undefined` when the child produced none.
+ */
+declare function finalAssistantOutput(events: readonly SessionEvent[]): readonly ContentBlock[] | undefined;
+//#endregion
+//#region ../../../vendor/deepseek-harness/packages/subagent/subagent/src/error.d.ts
+/** Typed failure for the subagent seam. */
+declare class SubagentError extends HarnessError {
+  constructor(message: string, code: string, options?: ErrorOptions);
+}
+//#endregion
+//#region ../../../vendor/deepseek-harness/packages/jobs/jobs/lib/types/brand.d.ts
+/**
+ * Identifies a background job. The registry generates `<kind>-N`; predictable
+ * ids rely on owner authorization rather than secrecy.
+ */
+type JobId = Branded<'JobId'>;
+/**
+ * Brand a string as a {@link JobId}.
+ * @param id - the raw job-id string (the registry generates `<kind>-N`).
+ * @returns the same string, branded; no validation is performed.
+ */
+declare function JobId(id: string): JobId;
+//#endregion
+//#region ../../../vendor/deepseek-harness/packages/jobs/jobs/lib/types/view.d.ts
+/**
+ * Job lifecycle: `running`, optionally `stopping`, then exactly one terminal
+ * status. Producer-specific facts belong in {@link JobView.progress} and
+ * {@link JobView.detail}.
+ */
+type JobStatus = 'running' | 'stopping' | 'completed' | 'killed' | 'failed';
+declare module '@deepseek-ai/dsh-workspace/types' {
+  interface SessionActivityKindMap {
+    /** A background job owned by this session is running or stopping. */
+    job: true;
+  }
+}
+/**
+ * Producer-defined job kinds. Plugins extend this map by declaration merging;
+ * the registry treats every value as an opaque id namespace.
+ */
+interface JobKindMap {
+  bash: 'bash';
+  subagent: 'subagent';
+}
+/** The merge-extensible union of registered producer kind names. */
+type JobKind = JobKindMap[keyof JobKindMap];
+/**
+ * Stream label of one output chunk. `stdout` and `stderr` reach the model's
+ * consuming read; `log` marks producer narration (a workflow's phase lines)
+ * that only observers see. Consumers treat an unrecognized label like an
+ * absent one.
+ */
+type JobChannel = 'stdout' | 'stderr' | 'log';
+/** One chunk of a job's output ring: absolute offset, text, channel, and loss marker. */
+interface JobChunk {
+  /** Absolute offset of the chunk's first byte; offsets never move once assigned. */
+  readonly at: number;
+  /** Chunk text exactly as appended (possibly tail-trimmed by retention). */
+  readonly text: string;
+  /** Stream label, when the producer supplied one. */
+  readonly channel?: JobChannel;
+  /** Bytes immediately before this chunk were lost, at the producer or to retention. */
+  readonly gapBefore?: true;
+}
+/**
+ * Read-only projection of one job — a fresh object per call, never live
+ * registry state. The model tools, the browser roster, and the observation
+ * stream all consume this one shape.
+ */
+interface JobView {
+  /** The registry-issued id (`<kind>-N`). */
+  readonly id: JobId;
+  /**
+   * The producer kind the job was registered with: a Host-registered
+   * `JobKind`, carried as an open string because a browser bundle or a Remote
+   * codec sees only the `JobKindMap` merges its own program compiles.
+   */
+  readonly kind: string;
+  /** The producer-supplied one-line label. */
+  readonly label: string;
+  /** Owning session; absent for an unowned job, which every caller can see. */
+  readonly owner?: SessionId$1;
+  /** Producer-owned cap for complete model-facing notices and reads, in UTF-8 bytes. */
+  readonly outputLimitBytes?: number;
+  /** Current lifecycle state. */
+  readonly status: JobStatus;
+  /** The producer's live progress line (`3/10`, the current phase); cleared at settlement. */
+  readonly progress?: string;
+  /** Terminal reason (`exit code: 3`); a recorded kill reason is merged in. */
+  readonly detail?: string;
+  /** Epoch ms when the job was registered. */
+  readonly startedAt: number;
+  /** Epoch ms when the job settled; absent while live. */
+  readonly finishedAt?: number;
+  /**
+   * The output ring's absolute coordinates and the complete-stream files
+   * behind it. `total` is the offset the next chunk starts at (0 while
+   * nothing was written); `earliest` is the oldest retained byte, greater
+   * than zero exactly when retention dropped the head. `spillPaths` lists the
+   * spill files the job's pull sources currently keep, in source order and
+   * deduplicated, and is absent while no source keeps one: it outlives any
+   * chunk, so a reader below `earliest` can still name where the bytes went.
+   */
+  readonly output: {
+    readonly total: number;
+    readonly earliest: number;
+    readonly spillPaths?: readonly string[];
+  };
+}
+//#endregion
+//#region ../../../vendor/deepseek-harness/packages/jobs/jobs/lib/types/types.d.ts
+/** Terminal result supplied by a producer through {@link JobHooks.done}. */
+interface JobOutcome {
+  /** How the job ended: finished (`completed`), cancelled (`killed`), or broke (`failed`). */
+  status: 'completed' | 'killed' | 'failed';
+  /**
+   * Terminal reason rendered into status lines (`exit code: 3`, `max-tokens`).
+   * When the job settles `killed` after a {@link JobRegistry.kill} with a
+   * reason, the registry appends that reason.
+   */
+  detail?: string;
+  /**
+   * Return value for jobs whose result is a value rather than a stream (a
+   * workflow's rendered result, a subagent's report). The output ring carries
+   * the stream; this is handed out once by the model's next {@link JobRegistry.read}.
+   */
+  result?: string;
+}
+/** One incremental read from a {@link JobOutputSource}. */
+interface JobSourceRead {
+  /** Text captured since the requested offset (the whole retained tail when lossy). */
+  text: string;
+  /** Whole-stream offset to resume from on the next read. */
+  nextOffset: number;
+  /** True when the requested offset slid out of the source's retained window. */
+  lossy: boolean;
+  /**
+   * Host path of a file holding the complete stream, when the source
+   * currently keeps an intact one. Reported on every read, so the registry
+   * tracks it as source metadata: a later read without it withdraws the file.
+   */
+  spillPath?: string;
+}
+/**
+ * A pull source the registry pumps into the job's output ring — the subprocess
+ * `readFrom` family. The registry owns the cadence and drains every source one
+ * last time before settlement closes the ring, so a producer folds nothing
+ * into its `done`.
+ */
+interface JobOutputSource {
+  /** Stream label attached to every chunk this source yields. */
+  channel?: JobChannel;
+  /**
+   * Read everything captured since `fromByte` without consuming it.
+   * @param fromByte - whole-stream offset to resume from (a prior read's `nextOffset`; 0 first).
+   * @returns the delta text, the next offset, the lossy flag, and the spill path the source currently keeps.
+   */
+  read(fromByte: number): JobSourceRead;
+}
+/** Options for one {@link JobHandle.append}. */
+interface JobAppendOptions {
+  /** Stream label for the chunk; omitted for producers without distinct streams. */
+  channel?: JobChannel;
+  /**
+   * Marks that producer-side bytes between the previous chunk and this one
+   * were lost, so an observer can render the discontinuity instead of a
+   * silent splice.
+   */
+  gapBefore?: true;
+}
+/**
+ * Producer face of one registered job, handed to {@link JobSpec.run} and
+ * valid for the job's whole life. All methods are synchronous. Writes staged
+ * inside the starter call are retained and become visible with the
+ * registration commit; after settlement — the producer's own outcome, a kill,
+ * or a registry-forced teardown end — writes log and drop instead of
+ * throwing, so a producer's trailing flush cannot break its own teardown path.
+ */
+interface JobHandle {
+  /** The registry-issued id (`<kind>-N`). */
+  readonly id: JobId;
+  /**
+   * Append one chunk to the output ring. Offsets advance by the chunk's UTF-8
+   * byte length; an empty chunk is dropped without waking observers.
+   * @param text - the chunk text, exactly as produced.
+   * @param options - stream label and gap marker.
+   */
+  append(text: string, options?: JobAppendOptions): void;
+  /**
+   * Replace the live progress line (`3/10`, the current phase). Settlement
+   * clears it; the terminal reason travels in {@link JobOutcome.detail}.
+   * @param line - the new progress line.
+   */
+  updateProgress(line: string): void;
+}
+/** Hooks through which the runtime controls and observes producer work. */
+interface JobHooks {
+  /**
+   * Request termination. Must be synchronous, idempotent, and eventually settle
+   * {@link done}; throws propagate. The optional reason is forwarded verbatim.
+   */
+  cancel(reason?: string): void;
+  /**
+   * Resolves after the producer releases its resources, not merely when work
+   * finishes. Must not reject; the runtime converts a rejection to `failed`.
+   * If teardown cancellation throws, the runtime may force-fail only the
+   * registry record without claiming that the work stopped.
+   */
+  done: Promise<JobOutcome>;
+}
+/**
+ * Producer declaration passed to {@link JobRegistry.start}. The runtime
+ * preflights access and cleanup before invoking {@link run}; the producer owns
+ * execution resources while the runtime owns identity, lifecycle state, and
+ * the output ring.
+ */
+interface JobSpec {
+  /** Producer kind — also the id prefix (`bash`, `subagent`, …). */
+  kind: JobKind;
+  /** One-line model-facing label (the command; the delegation description). */
+  label: string;
+  /**
+   * Owning session. Access is fenced by it, and the owner's live Agent must be
+   * the one currently registered under that id: its disposal cancels and
+   * awaits the job. Omitting the owner creates an unowned job, open to any
+   * caller until service disposal.
+   */
+  owner?: SessionId;
+  /**
+   * Optional UTF-8 byte cap for each complete model-facing completion notice or
+   * output read, including controller status metadata. Independent of ring
+   * retention: it bounds the consuming model surface, never observers.
+   */
+  outputLimitBytes?: number;
+  /**
+   * Pull sources the registry pumps into the ring at its own cadence.
+   * Producers that narrate their own progress use {@link JobHandle.append}
+   * instead; a job may use both.
+   */
+  output?: readonly JobOutputSource[];
+  /**
+   * Start the work after preflight and synchronously return its hooks. Called
+   * once with the job's producer face; a throw leaves nothing registered (the
+   * spent ordinal is skipped), and the producer must clean up any partially
+   * started resources.
+   * @param job - the issued id plus the ring append and progress writers.
+   */
+  run(job: JobHandle): JobHooks;
+}
+/** Output and post-read state returned by the consuming {@link JobRegistry.read}. */
+interface JobRead {
+  /** Ring chunks appended since the model cursor, in offset order; every channel included. */
+  chunks: readonly JobChunk[];
+  /** True when the cursor fell below the oldest retained byte, so bytes are missing before `chunks`. */
+  lossy: boolean;
+  /** The producer's {@link JobOutcome.result}, handed out by the first read after settlement only. */
+  result?: string;
+  /** The job's state at read time. */
+  job: JobView;
+}
+/** Result of one non-consuming {@link JobRegistry.readAt}. */
+interface JobOutputRead {
+  /** Retained chunks overlapping `[from, total)`, in offset order. */
+  chunks: readonly JobChunk[];
+  /**
+   * Offset to resume from — the ring's current `total`. Always a chunk
+   * boundary: appends land whole and trimming only advances chunk starts, and
+   * consumers concatenate `chunks` under that assumption, so a provider
+   * serving partial chunks would silently duplicate text.
+   */
+  next: number;
+  /** True when `from` fell below the oldest retained byte, so bytes are missing before `chunks`. */
+  lossy: boolean;
+}
+/**
+ * Why a job settled: its producer finished (`producer`), a
+ * {@link JobRegistry.kill} ran first (`kill`), or owner or service teardown
+ * cancelled it (`teardown`) — a settlement whose owner has no reader left.
+ */
+type JobSettleCause = 'producer' | 'kill' | 'teardown';
+/**
+ * One lifecycle or output event. Lifecycle events carry the job's projection
+ * after the commit they announce; `output` carries only the id and the new
+ * total, so an observer schedules a {@link JobRegistry.readAt} from its own
+ * cursor and the registry never pushes payloads.
+ */
+type JobEvent = {
+  /** Registration commit, progress line change, stopping transition, or removal from the visible set. */
+  readonly type: 'registered' | 'progress' | 'stopping' | 'removed';
+  readonly job: JobView;
+} | {
+  readonly type: 'settled';
+  readonly job: JobView;
+  readonly cause: JobSettleCause;
+  /**
+   * Whether this settlement released a live {@link JobRegistry.wait}. That
+   * waiter's caller receives the terminal projection as its own result, so
+   * a completion reporter treats an awaited settlement as already delivered
+   * and reports only the unawaited ones. A wait that timed out or was
+   * aborted before the settlement does not count.
+   */
+  readonly awaited: boolean;
+} | {
+  readonly type: 'output';
+  readonly id: JobId;
+  /** Owning session, absent for an unowned job. */
+  readonly owner?: SessionId;
+  /** The ring's total after the append (or at settlement, which ends the stream). */
+  readonly total: number;
+};
+/**
+ * Who a subscription hears about. `{ owner }` delivers that session's jobs
+ * plus every unowned job (the set that session can see). `{ owners: 'scope' }`
+ * delivers the owners composed under the subscribing context — one registry
+ * serves every composition in the process, and a mount under one preset must
+ * not hear another preset's agents. `{ owners: 'all' }` delivers everything.
+ */
+type JobEventFilter = {
+  readonly owner: SessionId;
+} | {
+  readonly owners: 'all' | 'scope';
+};
+/** Event callback; contained by the registry, never awaited. */
+type JobEventListener = (event: JobEvent) => void;
+/** The registry's event stream. */
+interface JobEvents {
+  /**
+   * Register an effect-scoped listener. Events are dispatched synchronously
+   * after the commit they announce; a job's first event is `registered`, and
+   * a `settled` event follows the release of every waiter. No listener runs
+   * after service disposal.
+   * @param filter - which owners' events to deliver.
+   * @param listener - receives each matching event.
+   * @returns disposer that unregisters the listener.
+   */
+  subscribe(filter: JobEventFilter, listener: JobEventListener): () => void;
+}
+//#endregion
+//#region ../../../vendor/deepseek-harness/packages/jobs/jobs/lib/types/index.d.ts
+declare module '@deepseek-ai/cordis' {
+  interface Context {
+    jobs: JobRegistry;
+  }
+}
+/**
+ * Abstract background job registry. Subclass, implement the abstract members,
+ * and load the subclass as a plugin — it registers as `ctx.jobs` (one
+ * implementation per context; loading a second throws, which is cordis'
+ * standard duplicate-service behavior).
+ *
+ * Implementations must honor these semantics:
+ * - Registrations outlive producer and controller fibers. Owner and
+ *   service disposal cancel live work and await compliant producers; a
+ *   throwing teardown cancel force-fails only the record. Such settlements
+ *   announce `cause: 'teardown'`, because a job whose owner is being destroyed
+ *   has no reader left.
+ * - Owned-job access is fenced by the owner's session id. Ids are
+ *   predictable, so authorization — not secrecy — is the boundary.
+ * - Settlement is first-wins: one terminal record, released waiters, then one
+ *   round of contained event delivery, even against a late producer outcome.
+ *   The `settled` event follows every released waiter and reports whether it
+ *   released one (`awaited`), so a completion reporter can skip settlements a
+ *   waiting caller already collected.
+ * - A settled record stays listed until its owner's disposal, service
+ *   disposal, or an explicit {@link remove} by a caller that collected the
+ *   terminal state itself and never handed the id out.
+ * - {@link start} refuses work while no attached job controller serves the
+ *   spec's owner, so a producer cannot start work that owner cannot collect
+ *   or stop. One registry serves every composition in the process, so this
+ *   question — and event delivery under `{ owners: 'scope' }` — is
+ *   owner-relative rather than process-wide: registrations made from an
+ *   unscoped context serve every owner, and registrations made under an agent
+ *   composition's scope serve exactly the agents composed under it.
+ * - Every job owns one output ring. Pull sources named by the spec are pumped
+ *   by the registry and drained once more before settlement; pushed appends
+ *   land whole. The model's consuming cursor and observers' absolute offsets
+ *   read the same bytes and never disturb each other.
+ * - Ring retention is bounded. Appends past the live cap drop the oldest
+ *   retained bytes; a reader below the retained window gets a lossy read,
+ *   never an error. Settlement trims retention to the settled cap and ends
+ *   the stream; the ring has no separate lifecycle.
+ */
+declare abstract class JobRegistry extends Service {
+  constructor(ctx: Context);
+  /** Lifecycle and output events, filtered per subscription. */
+  abstract readonly events: JobEvents;
+  /**
+   * Preflight access, validation, owner cleanup, and implementation-owned
+   * admission before starting and atomically registering work. Any preflight
+   * rejection leaves no job id or execution resource. A throwing starter
+   * leaves nothing registered; after it returns, registration cannot fail.
+   * @param spec - job identity, owner, output sources, and synchronous starter.
+   * @returns the registry-issued `<kind>-N` id.
+   */
+  abstract start(spec: JobSpec): JobId;
+  /**
+   * List caller-owned and unowned jobs in registration order.
+   * @param caller - reading session; omission sees only unowned jobs.
+   * @returns fresh projections.
+   */
+  abstract list(caller?: SessionId): JobView[];
+  /**
+   * Project one job without changing its cursor. Throws for an unknown or
+   * foreign job.
+   * @param id - job to look up.
+   * @param caller - reading session checked against the owner.
+   * @returns a fresh projection.
+   */
+  abstract get(id: JobId, caller?: SessionId): JobView;
+  /**
+   * Consume the ring from the model cursor and advance it to the current
+   * total. After settlement the first read also carries the producer's
+   * result. Throws for an unknown or foreign job.
+   * @param id - job to read.
+   * @param caller - reading session checked against the owner.
+   * @returns the chunks since the cursor, the lossy flag, the result once, and the post-read projection.
+   */
+  abstract read(id: JobId, caller?: SessionId): JobRead;
+  /**
+   * Read retained ring output without moving the model cursor. Resume with
+   * a previous read's `next`; an offset inside a retained chunk returns the
+   * whole chunk (its `at` may precede `from`). Throws for a negative or
+   * non-integer offset, or an unknown or foreign job.
+   * @param id - job to read.
+   * @param from - absolute byte offset to read from (0 for the retained head).
+   * @param caller - reading session checked against the owner.
+   * @returns retained chunks overlapping `[from, total)`, the resume offset, and the lossy flag.
+   */
+  abstract readAt(id: JobId, from: number, caller?: SessionId): JobOutputRead;
+  /**
+   * Request cancellation, then mark the job stopping. A producer throw
+   * propagates without changing job state. A supplied reason is merged into
+   * terminal `detail` when the job settles `killed`. Throws for an unknown
+   * or foreign job.
+   * @param id - job to cancel.
+   * @param caller - killing session checked against the owner.
+   * @param reason - cancellation reason forwarded verbatim to the producer.
+   * @returns `requested` for live work, otherwise `already-finished`.
+   */
+  abstract kill(id: JobId, caller?: SessionId, reason?: string): 'requested' | 'already-finished';
+  /**
+   * Wait for settlement or timeout without cancelling the job. Caller abort
+   * rejects only while the job is live; after settlement the terminal
+   * projection wins. Rejects for an invalid timeout or an unknown or foreign
+   * job.
+   * @param id - job to wait for.
+   * @param timeoutMs - positive finite wait bound in milliseconds.
+   * @param caller - waiting session checked against the owner.
+   * @param signal - optional cancellation of the wait itself.
+   * @returns projection at settlement or timeout.
+   */
+  abstract wait(id: JobId, timeoutMs: number, caller?: SessionId, signal?: AbortSignal): Promise<JobView>;
+  /**
+   * Drop one settled job's record from the visible set and announce
+   * `removed`. For a caller that collected the terminal state through its own
+   * {@link wait} and never handed the id to the model, such as a shell tool's
+   * foreground call. Throws for a job that is still live, unknown, or foreign.
+   * @param id - settled job to drop.
+   * @param caller - removing session checked against the owner.
+   */
+  abstract remove(id: JobId, caller?: SessionId): void;
+  /**
+   * Attach an effect-scoped controller that can read and stop jobs. It serves the
+   * owners its registering context's scope covers, and {@link start} refuses an
+   * owner no attached controller serves.
+   * @param name - diagnostic label; duplicate names remain independent.
+   * @returns disposer that detaches this controller.
+   */
+  abstract attachController(name: string): () => void;
+}
+//#endregion
+//#region ../../../vendor/deepseek-harness/packages/subagent/subagent/src/run-settlement.d.ts
+/**
+ * Await the child result, dispose the run, then return its task outcome. Result
+ * and disposal failures become `failed`; when both fail, both details survive.
+ * @param run - live run to settle and release.
+ * @returns outcome after child resources are released.
+ */
+declare function settleRun(run: SubagentRun): Promise<JobOutcome>;
+//#endregion
+//#region ../../../vendor/deepseek-harness/packages/subagent/subagent/src/depth.d.ts
+declare module '@deepseek-ai/dsh-agent' {
+  interface AgentOptions {
+    /** Delegation depth: zero for a top-level agent and parent depth + 1 for a child. */
+    subagentDepth?: number;
+  }
+}
+/**
+ * Read an agent's delegation depth, treating absence as top-level depth zero.
+ * The persisted session header is authoritative and monotone: runtime
+ * `AgentOptions.subagentDepth` may DEEPEN the count but can never lower it —
+ * a resumed child arrives with fresh options, and counting it from zero would
+ * let it delegate as if it were top-level.
+ * @param agent - the agent whose header and options carry the depth.
+ * @returns its non-negative safe-integer depth.
+ * @throws if the runtime `AgentOptions.subagentDepth` is not a non-negative safe integer.
+ */
+declare function delegationDepthOf(agent: Agent): number;
+/**
+ * Reject a recursion cap that cannot represent an exact delegation depth.
+ * @param maxDepth - the optional runtime value to validate.
+ */
+declare function assertSubagentMaxDepth(maxDepth: unknown): void;
+//#endregion
+//#region ../../../vendor/deepseek-harness/packages/sandbox/sandbox/lib/types/index.d.ts
+/**
+ * File-effect policy for confined processes. `read-only` permits only required
+ * sinks such as `/dev/null`; `workspace-write` also permits the workspace and a
+ * backend-defined temp area; `danger-full-access` bypasses confinement. Network
+ * and process visibility are outside this vocabulary.
+ */
+type SandboxMode = 'read-only' | 'workspace-write' | 'danger-full-access';
+/** A confining (non-`danger-full-access`) mode — the modes a {@link SandboxPolicy} can carry. */
+type ConfinedSandboxMode = Exclude<SandboxMode, 'danger-full-access'>;
+/**
+ * The complete file-effect policy resolved for one capability call. The root
+ * is carried even under modes that do not consume it so callers can resolve
+ * policy once before choosing the enforcement path.
+ */
+interface SandboxExecutionPolicy {
+  /** The file-effect mode this execution runs under. */
+  mode: SandboxMode;
+  /** Absolute root directory `workspace-write` may write under. */
+  workspaceRoot: string;
+  /**
+   * Opaque identity of the calling session (the branded `dsh-session`
+   * SessionId). Backends key per-session state off it (e.g. windows-acl gives
+   * each live session/workspace pair a random private temp directory and SID,
+   * while the workspace SID and standing grant remain per-workspace); absent
+   * for agentless calls, which fall back to per-call backend state.
+   */
+  sessionId?: SessionId;
+}
+/**
+ * Enforcement completeness for this host. `partial` means an active backend or
+ * older kernel ABI cannot govern every promised file effect; callers requiring
+ * an absolute boundary must not treat it as `full`.
+ */
+type SandboxEnforcement = 'full' | 'partial';
+/**
+ * What one confined execution is allowed to touch — carried PER CALL, not
+ * fixed on the provider: two consumers may confine under different policies
+ * at the same instant (bash under `read-only` while a confined child agent
+ * needs its state directory writable), and an approved escalated retry is a
+ * new call with a wider policy. Defaulting/resolution is an explicit step at
+ * the consumer boundary; the provider treats the policy as fully specified.
+ */
+interface SandboxPolicy extends SandboxExecutionPolicy {
+  /** The file-effect mode this execution runs under. */
+  mode: ConfinedSandboxMode;
+}
+/**
+ * Evidence that identifies a sandbox runner failing before it executes the
+ * wrapped command. A consumer first applies {@link allowedExitCodes} when
+ * present, removes {@link informationalLines} by case-insensitive exact line
+ * equality, then matches {@link fatalSignatures} case-insensitively within
+ * each remaining stderr line. Exit status alone never proves runner failure.
+ */
+interface RunnerFailureRule {
+  /** Nonzero process exit codes on which this rule may match; omitted permits any nonzero exit. */
+  allowedExitCodes?: readonly number[];
+  /** Non-empty substrings identifying a fatal runner diagnostic on one stderr line. */
+  fatalSignatures: readonly string[];
+  /** Benign stderr lines excluded by exact full-line equality before fatal matching. */
+  informationalLines?: readonly string[];
+}
+/**
+ * A {@link SandboxProvider.confine} result: the argv to spawn in place of
+ * the caller's own, plus the enforcement completeness the selected backend
+ * achieves for it.
+ */
+interface ConfinedArgv {
+  /** The wrapped argv (runner, profile, separator, then the caller's argv). */
+  argv: string[];
+  /** How completely the selected backend enforces the policy's file effects. */
+  enforcement: SandboxEnforcement;
+  /**
+   * The selected backend's denial DIALECT: the case-insensitive stderr
+   * substrings a file effect denied by THIS backend produces (EROFS text
+   * under bwrap's read-only binds, EACCES under Landlock, EPERM under
+   * Seatbelt). A consumer that infers denials from a failed run's stderr
+   * matches against exactly these rather than a cross-backend union — the
+   * union claims denials a given backend never produces.
+   */
+  denialSignatures: readonly string[];
+  /**
+   * Structured runner-failure evidence rules. Consumers require a matching
+   * fatal stderr line (after informational exclusions) and any rule-specific
+   * exit-code gate before checking denial signatures: runner failure means the
+   * command never ran, while denial means confinement worked and blocked it.
+   */
+  runnerFailureRules: readonly RunnerFailureRule[];
+}
+declare module '@deepseek-ai/cordis' {
+  interface Context {
+    sandbox: SandboxProvider;
+  }
+}
+/**
+ * Abstract process-sandbox service. {@link confine} must return enforcing argv
+ * or fail closed at wrap or runner-execution time; silent unconfined passthrough
+ * is forbidden. Functional probes arbitrate multi-runner chains and may be
+ * skipped for a sole candidate, whose own refusal remains the fail-closed end.
+ */
+declare abstract class SandboxProvider extends Service {
+  constructor(ctx: Context);
+  /**
+   * Wrap `argv` so it executes confined under `policy` on this host; the
+   * caller spawns the returned argv in place of its own.
+   * @param argv - the exact argv the caller is about to spawn (program plus
+   *   arguments), NOT a shell string — a shell-shaped consumer passes
+   *   `['bash', '-c', command]`.
+   * @param policy - the file-effect policy this execution runs under,
+   *   carried per call (see {@link SandboxPolicy}).
+   * @param signal - cancellation while the provider resolves the policy and runner.
+   * @returns the argv to spawn instead, plus the enforcement completeness
+   *   the selected backend achieves for it.
+   */
+  abstract confine(argv: readonly string[], policy: SandboxPolicy, signal?: AbortSignal): Promise<ConfinedArgv>;
+}
+//#endregion
+//#region ../../../vendor/deepseek-harness/packages/subagent/subagent/src/child-agent.d.ts
+/** Thrown when starting a child would exceed the requested depth cap. */
+declare class SubagentDepthError extends Error {
+  readonly attemptedDepth: number;
+  readonly maxDepth: number;
+  constructor(attemptedDepth: number, maxDepth: number);
+}
+/**
+ * Resolve the child's delegation depth from its parent and enforce an optional
+ * cap. The persisted parent header is the monotone floor, so a resumed parent
+ * cannot delegate as if it were top-level.
+ * @param parent - the delegating parent agent.
+ * @param maxDepth - optional absolute cap the resolved depth must not exceed.
+ * @returns the child's non-negative safe-integer depth.
+ * @throws {SubagentDepthError} when the resolved depth exceeds `maxDepth`.
+ * @throws {RangeError} when the resolved depth leaves the safe-integer range.
+ */
+declare function resolveChildDepth(parent: Agent, maxDepth: number | undefined): number;
+/**
+ * Resolve the parent values inherited by a child. The latest request header
+ * owns provider, model, and reasoning effort after request-time selection;
+ * creation options remain the fallback before the first request and retain
+ * the configured output-token limit.
+ * @param parent - delegating parent Agent.
+ * @returns detached Agent options for child-option merging.
+ */
+declare function parentAgentOptionsForDelegation(parent: Agent): AgentOptions;
+/**
+ * Resolve the child's `AgentOptions`: the parent's provider/model,
+ * reasoning-effort, and maxTokens values unless the request overrides them,
+ * stamped with the child's own delegation depth. Changing the route without
+ * naming an effort clears the parent's route-owned effort so the selected
+ * model resolves its own default.
+ * @param parent - the delegating parent whose route the child inherits.
+ * @param requested - per-child overrides, if any.
+ * @param childDepth - the resolved delegation depth to stamp.
+ * @returns the resolved options for `ctx.agents.create()`.
+ */
+declare function resolveChildAgentOptions(parent: Agent, requested: AgentOptions | undefined, childDepth: number): AgentOptions;
+/**
+ * Build the child session's durable creation metadata: the parent's workspace,
+ * its direct lineage, coarse product origin, the recursion budget that must
+ * survive persistence, the seed boundary that separates inherited parent
+ * history from child work, and the composition the child runs under.
+ *
+ * The preset is read from the parent's LIVE scope chain rather than from its
+ * header, because a parent that switched preset while blank runs on the newer
+ * composition and its header still names the older one. Recording it is what
+ * makes a child's history reconstructable: without it a cold read of the child
+ * resolves the deployment default and rebuilds turns under a tool set the
+ * child never had.
+ * @param parent - the delegating parent agent.
+ * @param childDepth - the resolved delegation depth to persist.
+ * @param isSeeded - whether this child inherits a parent-log prefix, including an explicitly empty one.
+ * @returns the `meta` for `ctx.agents.create()`.
+ */
+declare function childSessionMeta(parent: Agent, childDepth: number, isSeeded: boolean): NonNullable<CreateAgentOptions['meta']>;
+/** The scoped composition a child agent's creation window applies. */
+interface ChildComposition {
+  /** Per-child persona shadowing the deployment persona. */
+  readonly persona?: string | undefined;
+  /** Per-child tool scoping. */
+  readonly toolFilter?: ToolRestriction | undefined;
+}
+/**
+ * Compose one child inside its creation window: join its parent's preset,
+ * register the fixed delegation-scope statement, then apply the child's own
+ * shadowing persona section and tool restriction, all owned by the child's
+ * scope and therefore invisible to its parent and siblings. Creation and cold
+ * resume both pass through here.
+ *
+ * The join comes first and the child's own registrations second, which is the
+ * order the layering already implies — the nearest scope wins a name, and a
+ * per-child restriction intersects with everything its chain admits — but
+ * stating it here keeps the two steps from being read as independent.
+ *
+ * The join and the per-child registrations live in ONE call because a child
+ * composed without the join is exactly the defect this function exists to
+ * prevent: with every model-facing row on the agent plane, a child that joins
+ * no preset sees an empty tool registry and none of its parent's prompt
+ * sections. Taking the parent as a parameter is what makes that omission
+ * unrepresentable at the call sites.
+ * @param childCtx - the child agent's scoped creation context.
+ * @param parent - the delegating parent whose composition the child joins.
+ * @param composition - the per-child persona and tool filter to install.
+ */
+declare function applyChildComposition(childCtx: Context, parent: Agent, composition: ChildComposition): void;
+/** Policy seeded onto a child session's log at the delegation boundary. */
+interface DelegatedPolicyOverrides {
+  /** The shared-bundle preset identity when the parent currently runs in Auto or Full access. */
+  readonly permissionPreset: 'auto' | 'danger-full-access' | undefined;
+  /** The parent session's explicit sandbox-mode override, or `undefined` without one. */
+  readonly sandboxMode: SandboxMode | undefined;
+  /**
+   * `'never'` whenever the approval capability is composed, `undefined`
+   * otherwise: a delegated child acts only within the sandbox scope fixed at
+   * delegation, so its asks are rejected deterministically.
+   */
+  readonly approvalPolicy: 'never' | undefined;
+}
+/**
+ * Capture the permission state to seed into one delegation. Call synchronously before
+ * the child start's first await: a later parent switch belongs to the
+ * parent's future, not to this child. Auto and Full access identities are
+ * inherited only through the in-process DSH path so either can replace a stale
+ * same-bundle fork value. Only the parent session's explicit sandbox override
+ * is captured — never deployment defaults or one-shot grants — and the approval
+ * policy is pinned to `'never'` regardless of the parent's own policy.
+ * @param parent - the delegating parent agent.
+ * @returns the sandbox override (or `undefined` without one) and the approval pin.
+ */
+declare function captureDelegatedPolicyOverrides(parent: Agent): DelegatedPolicyOverrides;
+/**
+ * Append the captured delegation policy onto the child's own log as
+ * `source: 'delegation'` events inside the unpublished creation window, so the
+ * child's effective policy is reconstructable from its log alone. Appends land
+ * after any fork seed, so fresh policy wins stale seed state; later child
+ * switches still win over these events.
+ * @param childSession - the unpublished child's session.
+ * @param overrides - the policy captured at delegation.
+ */
+declare function appendDelegatedPolicyOverrides(childSession: Session, overrides: DelegatedPolicyOverrides): void;
+//#endregion
+//#region ../../../vendor/deepseek-harness/packages/subagent/subagent/src/continuation-messages.d.ts
+/** Durable attribution for one model-authored message between adjacent Agents. */
+interface AgentMessageSource$1 {
+  readonly kind: 'agent-message';
+  /** A message another agent addressed to this one (`relay` context form). */
+  readonly form: 'relay';
+  /** Session id of the Agent whose tool call produced the message. */
+  readonly senderSessionId: SessionId;
+}
+/**
+ * Durable attribution for the runtime's own account of a continuable child
+ * settling. Deliberately a different kind from
+ * {@link AgentMessageSource}: an Agent message is content the sender chose,
+ * while this message is the manager stating what became of the child, and a
+ * transcript that merged them would credit the child with words it never wrote.
+ */
+interface SubagentSettledMessageSource$1 {
+  readonly kind: 'subagent-settled';
+  /** A runtime account shown without expanding the row (`notice` context form). */
+  readonly form: 'notice';
+  /** One-line account of how the child ended. */
+  readonly summary: string;
+  /** Session id of the child that settled. */
+  readonly senderSessionId: SessionId;
+}
+declare module '@deepseek-ai/dsh-llm' {
+  interface MessageSourceMap {
+    'agent-message': AgentMessageSource$1;
+    'subagent-settled': SubagentSettledMessageSource$1;
+  }
+}
+//#endregion
+//#region ../../../vendor/deepseek-harness/packages/subagent/subagent/src/index.d.ts
+declare module '@deepseek-ai/cordis' {
+  interface Context {
+    subagents: SubagentRuntime$1;
+  }
+  interface Events {
+    /**
+     * A provider became resolvable in the registry.
+     * @param provider - the registered provider.
+     * @mode emit
+     */
+    'subagent/provider-added'(provider: SubagentProvider): void;
+    /**
+     * A provider left the registry. Accepted runs remain holder-owned.
+     * @param name - the provider name that no longer resolves.
+     * @mode emit
+     */
+    'subagent/provider-removed'(name: string): void;
+    /**
+     * A provider established a published child. For in-process providers,
+     * `ctx.agents.get(info.id)` resolves during this notification.
+     * Scope-filtered dispatch keys the carrier by the delegating parent, so a
+     * parent-scoped listener observes only its own delegations. Paired with
+     * `subagent/end`.
+     * @param info - the provider and published child identity.
+     * @dshScopeScan unsupported
+     * @mode emit
+     */
+    'subagent/start'(this: Scoped<SubagentRuntime$1>, info: SubagentRunInfo): void;
+    /**
+     * A published child settled. Scope-filtered dispatch uses the same delegating
+     * parent carrier as `subagent/start`, so the lifecycle pair reaches the
+     * same scoped audience.
+     * @param info - the run identity and terminal outcome.
+     * @dshScopeScan unsupported
+     * @mode emit
+     */
+    'subagent/end'(this: Scoped<SubagentRuntime$1>, info: SubagentRunEndInfo): void;
+  }
+}
+/** Host configuration for continuable subagent capacity. */
+interface Config$1 {
+  /** Maximum live children sharing uninterrupted continuable parent links; defaults to 8. */
+  maxActiveSubagents: Volatile<number>;
+  /** Default delegation depth for tools without an explicit limit; defaults to 1. */
+  maxDepth: Volatile<number>;
+}
+/** Named provider registry with one-shot runs, durable discovery, and continuable-child operations. */
+declare class SubagentRuntime$1 extends TypertRemoteService {
+  private config;
+  static Config: z<Schemastery.ObjectS<NoInfer<{
+    maxDepth: z<number, number, "volatile-defined">;
+    maxActiveSubagents: z<number, number, "volatile-defined">;
+  }>>, Schemastery.ObjectT<NoInfer<{
+    maxDepth: z<number, number, "volatile-defined">;
+    maxActiveSubagents: z<number, number, "volatile-defined">;
+  }>>, "plain">;
+  private providers;
+  private continuations;
+  /**
+   * The contained lifecycle-edge publisher. Built here because scoped dispatch
+   * keys its carrier by this exact service instance, whose own context filter
+   * composes into the carrier.
+   */
+  private readonly emitLifecycle;
+  constructor(ctx: Context, config: Config$1);
+  /**
+   * Resolve a delegation tool's depth policy against the current user setting.
+   * @param configured - Explicit tool limit, or provider-managed for external delegation.
+   * @returns The numeric limit, or undefined when the provider owns depth enforcement.
+   */
+  resolveMaxDepth(configured?: number | 'provider-managed'): number | undefined;
+  /**
+   * Establish one durable continuable child and deliver its initial prompt.
+   * Resolves when the child's inbox accepts that prompt, without waiting for the
+   * turn to start or for the message to reach the Session log; any earlier
+   * failure rejects with no ids and rolls back the child entirely.
+   * @param spec - provider, delegation request, and caller cancellation.
+   * @returns the durable child id and the accepted prompt's message id.
+   * @throws when continuation services are unavailable or materialization fails.
+   */
+  startContinuable(spec: ContinuableStartSpec): Promise<ContinuableStart>;
+  /**
+   * Steer one model-authored message to the sender's direct parent or direct
+   * continuable child. A running target admits it at the nearest step boundary;
+   * an idle target starts a turn, and an absent direct child cold-resumes from
+   * persistence. The service derives durable sender attribution from the exact
+   * live sender. Caller cancellation stops only pre-acceptance work.
+   * @param sender - exact live Agent authorizing and originating the message.
+   * @param targetId - durable direct-parent or direct-child session id.
+   * @param content - model-authored content to deliver.
+   * @param options - caller cancellation before inbox acceptance.
+   * @returns the accepted message's inbox id.
+   * @throws when continuation services are unavailable, adjacency is rejected,
+   *   or the message was not admitted.
+   */
+  sendMessage(sender: Agent, targetId: SessionId, content: ContentBlock[], options: SubagentSendMessageOptions): Promise<MessageId>;
+  /**
+   * Deliver one host-protocol message to a direct continuable child.
+   * Symbol-keyed so host adapters can preserve their own source descriptors without
+   * widening the public Service Definition or impersonating an Agent sender.
+   * @param parent - exact live direct parent authorizing delivery.
+   * @param childId - durable direct-child session id.
+   * @param content - host-authored content to deliver.
+   * @param source - durable host-protocol source descriptor.
+   * @param signal - caller cancellation before inbox acceptance.
+   * @param delivery - Queue as a distinct turn or Steer at the nearest step.
+   * @returns the accepted message's inbox id.
+   */
+  private [deliverSubagentPrompt];
+  /**
+   * Interrupt one live continuable child's current turn under a human parent
+   * address or an exact live ancestor Agent. Fire-and-return: the cancel
+   * signal is issued before this returns, but the target may keep running
+   * until it observes the signal. Unclaimed pending inbox work, the Activation,
+   * and published descendants are preserved; claimed work is not requeued.
+   * Once the interrupted driver is idle, a waking send resumes the parked FIFO
+   * queue. An absent target — including a one-shot or unknown id —
+   * is an accepted no-op, as is a manager-less composition, which cannot own a
+   * live Activation.
+   * @param targetSessionId - the durable child session id to interrupt.
+   * @param authority - the human parent address or exact live ancestor Agent.
+   * @throws {SubagentError} `UNAUTHORIZED` when the authority does not own the
+   *   live target.
+   */
+  interrupt(targetSessionId: SessionId, authority: SubagentInterruptAuthority): void;
+  /**
+   * Close continuable admission below exact live parent Agents, stop only their
+   * visible descendant Activations synchronously, then await admitted scoped
+   * materializations and release those forests child-first. The scoped cutoff
+   * lasts until each exact parent leaves the registry; unrelated parent trees
+   * remain live.
+   * @param parents - exact host-owned parent Agents entering teardown.
+   * @returns once every retained descendant Activation released its `AgentHandle`.
+   * @throws an aggregate error after all branches settle when any failed.
+   */
+  drainContinuableDescendants(parents: readonly Agent[]): Promise<void>;
+  /**
+   * Release selected resident continuable direct children of one exact live
+   * parent. Other children of the same parent remain admitted and resident.
+   * Absent targets and a manager-less composition are accepted no-ops.
+   * @param parent - exact live direct parent authorizing the selected release.
+   * @param childIds - durable direct-child ids to release when resident.
+   * @returns once every selected Activation released its `AgentHandle`.
+   * @throws {SubagentError} `UNAUTHORIZED` when a resident target belongs to a
+   *   different parent or the supplied parent identity is stale.
+   */
+  drainContinuableChildren(parent: Agent, childIds: readonly SessionId[]): Promise<void>;
+  /**
+   * Read the parent's durable direct-child catalog without loading or resuming an Agent.
+   * The service owns and releases the live-preferred Session observation.
+   * @param parentSessionId - parent whose direct children are requested.
+   * @param signal - cancellation forwarded to the Session query.
+   * @returns catalog children in parent event order.
+   * @throws {@link SubagentError} when query or catalog projection is unavailable.
+   * @throws SessionQueryError when the parent cannot be read or the query is cancelled.
+   */
+  listChildren(parentSessionId: SessionId, signal?: AbortSignal): Promise<SubagentCatalogEntry[]>;
+  /**
+   * Enumerate the root's complete session-backed subagent tree in stable
+   * pre-order from one live-preferred corpus, without loading or resuming an
+   * Agent. Ordinary sessions and one-shot children remain traversal nodes so
+   * continuable descendants below them are discovered; each returned entry
+   * adds its durable `parentId` and root-relative `depth`. Identity resolution,
+   * diagnostics, optional persistence, and cancellation use the registered
+   * child identity projection and complete Session corpus.
+   * @param rootSessionId - session whose complete descendant tree is listed.
+   * @param signal - caller-owned cancellation forwarded to persistence reads
+   *   and observed around every read await.
+   * @returns children and per-candidate diagnostics with tree position, in
+   *   stable pre-order.
+   * @throws {@link SubagentError} when listing dependencies are unavailable or the caller cancels.
+   */
+  listDescendants(rootSessionId: SessionId, signal?: AbortSignal): Promise<SubagentDescendantListEntry[]>;
+  /**
+   * Deliver one browser-authored message to a continuable child through the
+   * exact live direct parent, retaining the caller-minted request identity and
+   * validated browser zone on the accepted message. Success identifies the
+   * message the child's inbox accepted; later execution is independent of this
+   * call. Queue delivery targets a later turn; steer delivery targets the
+   * nearest step and retains the Agent loop's best-effort fallback semantics.
+   * Image parts are admitted and persisted through the attachment store
+   * before delivery, and the child's model must accept image input.
+   * Cold resume at capacity rejects with `subagent/delivery-unavailable`.
+   * @param request - durable address, delivery, minted identity, content, and optional browser zone.
+   * @param signal - carrier cancellation, owning the call until inbox acceptance.
+   * @returns the accepted message's inbox identity.
+   * @throws {RemoteError} `gateway/bad-request`, `subagent/attachment-invalid`,
+   *   `subagent/invalid-time-zone`, `subagent/parent-unavailable`,
+   *   `subagent/not-resumable`, `subagent/unauthorized`,
+   *   `subagent/delivery-unavailable`, `gateway/cancelled`, or `gateway/internal`.
+   */
+  prompt(request: SubagentPromptRequest, signal: AbortSignal): Promise<SubagentPromptReceipt>;
+  /**
+   * Remote face of {@link interrupt} under one durable parent address. No
+   * catalog, history, persistence, or parent Agent lookup runs: the core
+   * primitive alone authorizes the address against the live Activation, which
+   * is what keeps a live child interruptible while its parent Agent is offline.
+   * Absent, idle, and already-completed targets are accepted no-ops there.
+   * @param childSessionId - durable child session id to interrupt.
+   * @param parentSessionId - durable direct parent whose authority is claimed.
+   * @param mode - required continuable-address discriminator.
+   * @returns acknowledgement that the cancel signal was admitted, not that the target is quiescent.
+   * @throws {RemoteError} `gateway/bad-request` for an empty id,
+   *   `subagent/unauthorized` when the address does not own the live target,
+   *   otherwise `gateway/internal`.
+   */
+  interruptByParent(childSessionId: SessionId, parentSessionId: SessionId, mode: 'continuable'): SubagentInterruptReceipt;
+  /**
+   * Register a provider under its name. Registration is effect-scoped and HMR
+   * safe; removing a provider blocks new starts but does not revoke runs that
+   * were already returned to their holders.
+   * @param provider - the trusted provider implementation.
+   * @returns the exact Cordis effect disposer.
+   */
+  registerProvider(provider: SubagentProvider): () => void;
+  /**
+   * Look up a provider by name.
+   * @param name - the provider name.
+   * @returns the provider, or undefined when absent.
+   */
+  getProvider(name: string): SubagentProvider | undefined;
+  /**
+   * List registered provider names in insertion order.
+   * @returns the registered names.
+   */
+  list(): string[];
+  /**
+   * Establish a published child on the named provider. Capability and semantic
+   * checks run before delegation. Provider ownership lasts until its promise
+   * fulfills; a rejection therefore has no run for the caller to dispose and
+   * emits no run lifecycle events. Post-publication turn and infrastructure
+   * failures settle through the returned run.
+   * A catalog append failure disposes the run and handles its result rejection;
+   * the caller receives the catalog error even if disposal also fails.
+   * @param name - the provider to use.
+   * @param request - child label, prompt, parent, signal, and optional capabilities.
+   * @returns the published holder-owned run.
+   */
+  start(name: string, request: SubagentStartRequest): Promise<SubagentRun>;
+  /**
+   * Resolve one provider's detached continuable-creation contribution. Method
+   * presence on the provider IS the capability, so a provider without it is
+   * rejected before the manager reserves any child resources.
+   */
+  private prepareContinuable;
+  /** Look up a provider for dispatch or fail loud. */
+  private expectProvider;
+  /** Resolve the optional continuable-subagent manager or fail loud. */
+  private requireContinuations;
+  /**
+   * Build the lifecycle observer for one continuable Activation's residency
+   * epoch, so the manager publishes its edges without owning event dispatch.
+   */
+  private observeActivation;
+  /** Reject the first requested capability that the provider lacks. */
+  private assertCapabilities;
+}
+//#endregion
+//#region ../../../vendor/deepseek-harness/packages/subagent/subagent/src/internal.d.ts
+/**
+ * Process-stable symbol-keyed host delivery shared by the bundled runtime
+ * entry and this unbundled internal subpath.
+ * @internal
+ */
+declare const deliverSubagentPrompt: unique symbol;
+//#endregion
+//#region src/continuation-messages.d.ts
+/** Durable attribution for one model-authored message between adjacent Agents. */
+interface AgentMessageSource {
+  readonly kind: 'agent-message';
+  /** A message another agent addressed to this one (`relay` context form). */
+  readonly form: 'relay';
+  /** Session id of the Agent whose tool call produced the message. */
+  readonly senderSessionId: SessionId;
+}
+/**
+ * Durable attribution for the runtime's own account of a continuable child
+ * settling. Deliberately a different kind from
+ * {@link AgentMessageSource}: an Agent message is content the sender chose,
+ * while this message is the manager stating what became of the child, and a
+ * transcript that merged them would credit the child with words it never wrote.
+ */
+interface SubagentSettledMessageSource {
+  readonly kind: 'subagent-settled';
+  /** A runtime account shown without expanding the row (`notice` context form). */
+  readonly form: 'notice';
+  /** One-line account of how the child ended. */
+  readonly summary: string;
+  /** Session id of the child that settled. */
+  readonly senderSessionId: SessionId;
+}
+declare module '@deepseek-ai/dsh-llm' {
+  interface MessageSourceMap {
+    'agent-message': AgentMessageSource;
+    'subagent-settled': SubagentSettledMessageSource;
+  }
+}
+//#endregion
+//#region src/index.d.ts
+/** Host configuration for continuable subagent capacity. */
+interface Config {
+  /** Maximum live children sharing uninterrupted continuable parent links; defaults to 8. */
+  maxActiveSubagents: Volatile<number>;
+  /** Default delegation depth for tools without an explicit limit; defaults to 1. */
+  maxDepth: Volatile<number>;
+}
+/** Named provider registry with one-shot runs, durable discovery, and continuable-child operations. */
+declare class SubagentRuntime extends TypertRemoteService {
+  private config;
+  static Config: z<Schemastery.ObjectS<NoInfer<{
+    maxDepth: z<number, number, "volatile-defined">;
+    maxActiveSubagents: z<number, number, "volatile-defined">;
+  }>>, Schemastery.ObjectT<NoInfer<{
+    maxDepth: z<number, number, "volatile-defined">;
+    maxActiveSubagents: z<number, number, "volatile-defined">;
+  }>>, "plain">;
+  private providers;
+  private continuations;
+  /**
+   * The contained lifecycle-edge publisher. Built here because scoped dispatch
+   * keys its carrier by this exact service instance, whose own context filter
+   * composes into the carrier.
+   */
+  private readonly emitLifecycle;
+  constructor(ctx: Context, config: Config);
+  /**
+   * Resolve a delegation tool's depth policy against the current user setting.
+   * @param configured - Explicit tool limit, or provider-managed for external delegation.
+   * @returns The numeric limit, or undefined when the provider owns depth enforcement.
+   */
+  resolveMaxDepth(configured?: number | 'provider-managed'): number | undefined;
+  /**
+   * Establish one durable continuable child and deliver its initial prompt.
+   * Resolves when the child's inbox accepts that prompt, without waiting for the
+   * turn to start or for the message to reach the Session log; any earlier
+   * failure rejects with no ids and rolls back the child entirely.
+   * @param spec - provider, delegation request, and caller cancellation.
+   * @returns the durable child id and the accepted prompt's message id.
+   * @throws when continuation services are unavailable or materialization fails.
+   */
+  startContinuable(spec: ContinuableStartSpec): Promise<ContinuableStart>;
+  /**
+   * Steer one model-authored message to the sender's direct parent or direct
+   * continuable child. A running target admits it at the nearest step boundary;
+   * an idle target starts a turn, and an absent direct child cold-resumes from
+   * persistence. The service derives durable sender attribution from the exact
+   * live sender. Caller cancellation stops only pre-acceptance work.
+   * @param sender - exact live Agent authorizing and originating the message.
+   * @param targetId - durable direct-parent or direct-child session id.
+   * @param content - model-authored content to deliver.
+   * @param options - caller cancellation before inbox acceptance.
+   * @returns the accepted message's inbox id.
+   * @throws when continuation services are unavailable, adjacency is rejected,
+   *   or the message was not admitted.
+   */
+  sendMessage(sender: Agent, targetId: SessionId, content: ContentBlock[], options: SubagentSendMessageOptions): Promise<MessageId>;
+  /**
+   * Deliver one host-protocol message to a direct continuable child.
+   * Symbol-keyed so host adapters can preserve their own source descriptors without
+   * widening the public Service Definition or impersonating an Agent sender.
+   * @param parent - exact live direct parent authorizing delivery.
+   * @param childId - durable direct-child session id.
+   * @param content - host-authored content to deliver.
+   * @param source - durable host-protocol source descriptor.
+   * @param signal - caller cancellation before inbox acceptance.
+   * @param delivery - Queue as a distinct turn or Steer at the nearest step.
+   * @returns the accepted message's inbox id.
+   */
+  private [deliverSubagentPrompt];
+  /**
+   * Interrupt one live continuable child's current turn under a human parent
+   * address or an exact live ancestor Agent. Fire-and-return: the cancel
+   * signal is issued before this returns, but the target may keep running
+   * until it observes the signal. Unclaimed pending inbox work, the Activation,
+   * and published descendants are preserved; claimed work is not requeued.
+   * Once the interrupted driver is idle, a waking send resumes the parked FIFO
+   * queue. An absent target — including a one-shot or unknown id —
+   * is an accepted no-op, as is a manager-less composition, which cannot own a
+   * live Activation.
+   * @param targetSessionId - the durable child session id to interrupt.
+   * @param authority - the human parent address or exact live ancestor Agent.
+   * @throws {SubagentError} `UNAUTHORIZED` when the authority does not own the
+   *   live target.
+   */
+  interrupt(targetSessionId: SessionId, authority: SubagentInterruptAuthority): void;
+  /**
+   * Close continuable admission below exact live parent Agents, stop only their
+   * visible descendant Activations synchronously, then await admitted scoped
+   * materializations and release those forests child-first. The scoped cutoff
+   * lasts until each exact parent leaves the registry; unrelated parent trees
+   * remain live.
+   * @param parents - exact host-owned parent Agents entering teardown.
+   * @returns once every retained descendant Activation released its `AgentHandle`.
+   * @throws an aggregate error after all branches settle when any failed.
+   */
+  drainContinuableDescendants(parents: readonly Agent[]): Promise<void>;
+  /**
+   * Release selected resident continuable direct children of one exact live
+   * parent. Other children of the same parent remain admitted and resident.
+   * Absent targets and a manager-less composition are accepted no-ops.
+   * @param parent - exact live direct parent authorizing the selected release.
+   * @param childIds - durable direct-child ids to release when resident.
+   * @returns once every selected Activation released its `AgentHandle`.
+   * @throws {SubagentError} `UNAUTHORIZED` when a resident target belongs to a
+   *   different parent or the supplied parent identity is stale.
+   */
+  drainContinuableChildren(parent: Agent, childIds: readonly SessionId[]): Promise<void>;
+  /**
+   * Read the parent's durable direct-child catalog without loading or resuming an Agent.
+   * The service owns and releases the live-preferred Session observation.
+   * @param parentSessionId - parent whose direct children are requested.
+   * @param signal - cancellation forwarded to the Session query.
+   * @returns catalog children in parent event order.
+   * @throws {@link SubagentError} when query or catalog projection is unavailable.
+   * @throws SessionQueryError when the parent cannot be read or the query is cancelled.
+   */
+  listChildren(parentSessionId: SessionId, signal?: AbortSignal): Promise<SubagentCatalogEntry[]>;
+  /**
+   * Enumerate the root's complete session-backed subagent tree in stable
+   * pre-order from one live-preferred corpus, without loading or resuming an
+   * Agent. Ordinary sessions and one-shot children remain traversal nodes so
+   * continuable descendants below them are discovered; each returned entry
+   * adds its durable `parentId` and root-relative `depth`. Identity resolution,
+   * diagnostics, optional persistence, and cancellation use the registered
+   * child identity projection and complete Session corpus.
+   * @param rootSessionId - session whose complete descendant tree is listed.
+   * @param signal - caller-owned cancellation forwarded to persistence reads
+   *   and observed around every read await.
+   * @returns children and per-candidate diagnostics with tree position, in
+   *   stable pre-order.
+   * @throws {@link SubagentError} when listing dependencies are unavailable or the caller cancels.
+   */
+  listDescendants(rootSessionId: SessionId, signal?: AbortSignal): Promise<SubagentDescendantListEntry[]>;
+  /**
+   * Deliver one browser-authored message to a continuable child through the
+   * exact live direct parent, retaining the caller-minted request identity and
+   * validated browser zone on the accepted message. Success identifies the
+   * message the child's inbox accepted; later execution is independent of this
+   * call. Queue delivery targets a later turn; steer delivery targets the
+   * nearest step and retains the Agent loop's best-effort fallback semantics.
+   * Image parts are admitted and persisted through the attachment store
+   * before delivery, and the child's model must accept image input.
+   * Cold resume at capacity rejects with `subagent/delivery-unavailable`.
+   * @param request - durable address, delivery, minted identity, content, and optional browser zone.
+   * @param signal - carrier cancellation, owning the call until inbox acceptance.
+   * @returns the accepted message's inbox identity.
+   * @throws {RemoteError} `gateway/bad-request`, `subagent/attachment-invalid`,
+   *   `subagent/invalid-time-zone`, `subagent/parent-unavailable`,
+   *   `subagent/not-resumable`, `subagent/unauthorized`,
+   *   `subagent/delivery-unavailable`, `gateway/cancelled`, or `gateway/internal`.
+   */
+  prompt(request: SubagentPromptRequest, signal: AbortSignal): Promise<SubagentPromptReceipt>;
+  /**
+   * Remote face of {@link interrupt} under one durable parent address. No
+   * catalog, history, persistence, or parent Agent lookup runs: the core
+   * primitive alone authorizes the address against the live Activation, which
+   * is what keeps a live child interruptible while its parent Agent is offline.
+   * Absent, idle, and already-completed targets are accepted no-ops there.
+   * @param childSessionId - durable child session id to interrupt.
+   * @param parentSessionId - durable direct parent whose authority is claimed.
+   * @param mode - required continuable-address discriminator.
+   * @returns acknowledgement that the cancel signal was admitted, not that the target is quiescent.
+   * @throws {RemoteError} `gateway/bad-request` for an empty id,
+   *   `subagent/unauthorized` when the address does not own the live target,
+   *   otherwise `gateway/internal`.
+   */
+  interruptByParent(childSessionId: SessionId, parentSessionId: SessionId, mode: 'continuable'): SubagentInterruptReceipt;
+  /**
+   * Register a provider under its name. Registration is effect-scoped and HMR
+   * safe; removing a provider blocks new starts but does not revoke runs that
+   * were already returned to their holders.
+   * @param provider - the trusted provider implementation.
+   * @returns the exact Cordis effect disposer.
+   */
+  registerProvider(provider: SubagentProvider): () => void;
+  /**
+   * Look up a provider by name.
+   * @param name - the provider name.
+   * @returns the provider, or undefined when absent.
+   */
+  getProvider(name: string): SubagentProvider | undefined;
+  /**
+   * List registered provider names in insertion order.
+   * @returns the registered names.
+   */
+  list(): string[];
+  /**
+   * Establish a published child on the named provider. Capability and semantic
+   * checks run before delegation. Provider ownership lasts until its promise
+   * fulfills; a rejection therefore has no run for the caller to dispose and
+   * emits no run lifecycle events. Post-publication turn and infrastructure
+   * failures settle through the returned run.
+   * A catalog append failure disposes the run and handles its result rejection;
+   * the caller receives the catalog error even if disposal also fails.
+   * @param name - the provider to use.
+   * @param request - child label, prompt, parent, signal, and optional capabilities.
+   * @returns the published holder-owned run.
+   */
+  start(name: string, request: SubagentStartRequest): Promise<SubagentRun>;
+  /**
+   * Resolve one provider's detached continuable-creation contribution. Method
+   * presence on the provider IS the capability, so a provider without it is
+   * rejected before the manager reserves any child resources.
+   */
+  private prepareContinuable;
+  /** Look up a provider for dispatch or fail loud. */
+  private expectProvider;
+  /** Resolve the optional continuable-subagent manager or fail loud. */
+  private requireContinuations;
+  /**
+   * Build the lifecycle observer for one continuable Activation's residency
+   * epoch, so the manager publishes its edges without owning event dispatch.
+   */
+  private observeActivation;
+  /** Reject the first requested capability that the provider lacks. */
+  private assertCapabilities;
+}
+//#endregion
+export { type AgentMessageSource, AssistantOutputFold, type ChildComposition, Config, type ContinuableCreateRequest, type ContinuableCreateSpec, type ContinuableStart, type ContinuableStartSpec, type ContinuableSubagentDescriptorData, type ContinuableSubagentDescriptorInput, type DelegatedPolicyOverrides, NO_START_CAPABILITIES, type OneShotSubagentDescriptorData, type OneShotSubagentDescriptorInput, type ResolvedSubagentStartRequest, RunResultSettlement, SUBAGENT_DESCRIPTOR_VERSION, type SubagentAddress, type SubagentCapabilities, type SubagentCatalogEntry, type SubagentCatalogRow, SubagentDepthError, type SubagentDescendantListEntry, type SubagentDescriptorData, type SubagentDescriptorInput, SubagentError, type SubagentIdentityProjection, type SubagentInterruptAuthority, type SubagentInterruptReceipt, type SubagentListEntry, type SubagentPromptReceipt, type SubagentPromptRequest, type SubagentPromptRequestId, type SubagentProvider, type SubagentResult, type SubagentRun, type SubagentRunEndInfo, SubagentRunId, type SubagentRunInfo, SubagentRuntime, SubagentRuntime as default, type SubagentSendMessageOptions, type SubagentSettledMessageSource, type SubagentStartRequest, type SubagentStopReason, type SubagentStopReasonMap, type SubagentTimingProjection, SubprocessRunHandleParts, appendDelegatedPolicyOverrides, applyChildComposition, assertPositiveFinite, assertSubagentMaxDepth, assertUsableCwd, captureDelegatedPolicyOverrides, childSessionMeta, delegationDepthOf, finalAssistantOutput, foldSubagentDescriptor, parentAgentOptionsForDelegation, resolveChildAgentOptions, resolveChildCwd, resolveChildDepth, settleRun, settleRunResult, snapshotSubagentDescriptor, subprocessRunHandle, validateConfiguredCwd };